Skip to content

Commit 0fe7111

Browse files
Dani-HubDani-Hub
committed
Wording improvements by Matt Stephanson and Thomas Köppe
1 parent a1d6d28 commit 0fe7111

File tree

1 file changed

+115
-3
lines changed

1 file changed

+115
-3
lines changed

‎xml/issue4212.xml‎

Lines changed: 115 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -36,9 +36,7 @@ is an alias for the initial value, <math><mi>X</mi></math>), so that the final r
3636
Set priority to 3 after reflector poll.
3737
</p>
3838

39-
</discussion>
40-
41-
<resolution>
39+
<superseded>
4240
<p>
4341
This wording is relative to <paper num="N5001"/>.
4442
</p>
@@ -122,6 +120,120 @@ where<del>:</del>
122120
</ol>
123121
</li>
124122

123+
</ol>
124+
</blockquote>
125+
</li>
126+
</ol>
127+
</superseded>
128+
129+
<note>2025-08-08; Matt Stephanson comments and makes wording improvements with Thomas Köppe</note>
130+
<ol>
131+
<li><p>For what it's worth, I believe the new wording correctly describes the algorithm and does not make any substantive changes.</p></li>
132+
<li><p>As for the wording itself:</p>
133+
<ol style="list-style-type:lower-alpha">
134+
<li><p>Paragraphs 1, 2, and 3 still refer to the output sequence as <tt><i>Y</i></tt>, so I don't think
135+
it should be removed from the end of the first sentence in p4. On the contrary, to maintain the connection
136+
and parallel the "$X^{(0)} := X$" wording, I think the final sentence should also be
137+
"The output sequence is $X^{(r)} := Y$".</p></li>
138+
<li><p>I can't explain why, but my intuition is that, in bullet (4.2), "the elements of $V^{(q)}$"
139+
sounds better than "the elements of the $V^{(q)}$". The second "the" worked with the original wording
140+
"the <tt><i>V</i></tt> sequence", but "sequence" is omitted in the proposed resolution.</p></li>
141+
<li><p>The use of <tt><i>K</i></tt> for both the fixed key sequence and the round keys seems potentially
142+
confusing. Maybe <tt><i>R</i></tt> for "round key" is better?</p></li>
143+
</ol>
144+
</li>
145+
</ol>
146+
<p>
147+
After discussion with Thomas Köppe there was agreement that (a) should be applied with the modification
148+
that we should write it as definition of <tt><i>Y</i></tt> and not the other way around, that (b) should
149+
be applied as suggested, and that there was no real consensus for proposal (c).
150+
</p>
151+
</discussion>
152+
153+
<resolution>
154+
<p>
155+
This wording is relative to <paper num="N5014"/>.
156+
</p>
157+
158+
<ol>
159+
<li><p>Modify <sref ref="[rand.eng.philox]"/> as indicated:</p>
160+
161+
<blockquote>
162+
<p>
163+
-2- The generation algorithm returns <math><msub><mi>Y</mi><mrow><mi>i</mi></mrow></msub></math>, the value stored in
164+
the <math><msup><mi>i</mi><mtext>th</mtext></msup></math> element of <math><mi>Y</mi></math> after applying the
165+
transition algorithm.
166+
<p/>
167+
-3- The state transition is performed as if by the following algorithm:
168+
</p>
169+
<blockquote><pre>
170+
<math><mi>i</mi><mo>=</mo><mi>i</mi><mo>+</mo><mn>1</mn></math>
171+
<tt>if (<math><mi>i</mi></math> == <math><mi>n</mi></math>) {</tt>
172+
<math><mi>Y</mi><mo>=</mo></math><tt>Philox</tt>(<math><mi>K</mi></math>, <math><mi>X</mi></math>) <i>// see below</i>
173+
<math><mi>Z</mi><mo>=</mo><mi>Z</mi><mo>+</mo><mn>1</mn></math> <ins><i>// this updates <math><mi>X</mi></math></i></ins>
174+
<math><mi>i</mi><mo>=</mo><mn>0</mn></math>
175+
}
176+
</pre></blockquote>
177+
<p>
178+
-4- The <tt>Philox</tt> function maps the length-<math><mi>n</mi></math>/2 sequence <math><mi>K</mi></math>
179+
and the length-<math><mi>n</mi></math> sequence <math><mi>X</mi></math> into a length-<math><mi>n</mi></math> output
180+
sequence <del><math><mi>Y</mi></math></del>. Philox applies an <math><mi>r</mi></math>-round substitution-permutation network to
181+
the values in <math><mi>X</mi></math>. <del>A single round of the generation algorithm performs the following steps:</del>
182+
<ins>That is, there are intermediate values <math><msup><mi>X</mi><mrow><mo>(</mo><mn>0</mn><mo>)</mo></mrow></msup></math>,
183+
<math><msup><mi>X</mi><mrow><mo>(</mo><mn>1</mn><mo>)</mo></mrow></msup></math>, &hellip;,
184+
<math><msup><mi>X</mi><mrow><mo>(</mo><mi>r</mi><mo>)</mo></mrow></msup></math>, where
185+
<math><msup><mi>X</mi><mrow><mo>(</mo><mn>0</mn><mo>)</mo></mrow></msup><mo>:=</mo><mi>X</mi></math>, and for each round
186+
<math><mi>q</mi></math> (with <math><mi>q</mi><mo>=</mo><mn>1</mn><mo>,</mo><mo>&hellip;</mo><mo>,</mo><mi>r</mi></math>),
187+
<math><msup><mi>X</mi><mrow><mo>(</mo><mi>q</mi><mo>)</mo></mrow></msup></math> is computed from
188+
<math><msup><mi>X</mi><mrow><mo>(</mo><mi>q</mi><mo>-</mo><mn>1</mn><mo>)</mo></mrow></msup></math> as follows. The output sequence
189+
is <math><mi>Y</mi><mo>:=</mo><msup><mi>X</mi><mrow><mo>(</mo><mi>r</mi><mo>)</mo></mrow></msup></math>.</ins>
190+
</p>
191+
<ol style="list-style-type: none">
192+
<li><p>(4.1) &mdash; <del>The output sequence <math><mi>X</mi><mi>'</mi></math> of the previous round (<math><mi>X</mi></math>
193+
in case of the first round) is permuted to obtain the intermediate state <math><mi>V</mi></math>:</del></p>
194+
<blockquote><pre>
195+
<del><math><msub><mi>V</mi><mrow><mi>j</mi></mrow></msub><mo>=</mo><msub><mi>X</mi><mi>'</mi><mrow><msub><mi>f</mi><mrow><mi>n</mi></mrow></msub><mo>(</mo><mi>j</mi><mo>)</mo></mrow></msub></math></del>
196+
</pre></blockquote>
197+
<p>
198+
<ins>An intermediate state <math><msup><mi>V</mi><mrow><mo>(</mo><mi>q</mi><mo>)</mo></mrow></msup></math> is obtained
199+
by permuting the previous output,
200+
<math><msubsup><mi>V</mi><mi>j</mi><mrow><mo>(</mo><mi>q</mi><mo>)</mo></mrow></msubsup><mo>:=</mo><msubsup><mi>X</mi><mrow><msub><mi>f</mi><mrow><mi>n</mi></mrow></msub><mo>(</mo><mi>j</mi><mo>)</mo></mrow><mrow><mo>(</mo><mi>q</mi><mo>-</mo><mn>1</mn><mo>)</mo></mrow></msubsup></math>,</ins>
201+
where <math><mi>j</mi><mo>=</mo><mn>0</mn><mo>,</mo><mo>&hellip;</mo><mo>,</mo><mi>n</mi><mo>−</mo><mn>1</mn></math><ins>,</ins> and
202+
<math><msub><mi>f</mi><mrow><mi>n</mi></mrow></msub><mo>(</mo><mi>j</mi><mo>)</mo></math> is defined in Table 124.
203+
</p>
204+
</li>
205+
<li><p>(4.2) &mdash; <del>The following computations are applied to the elements of the <math><mi>V</mi></math> sequence:</del>
206+
<ins>The next output <math><msup><mi>X</mi><mrow><mo>(</mo><mi>q</mi><mo>)</mo></mrow></msup></math> is computed from the elements of
207+
<math><msup><mi>V</mi><mrow><mo>(</mo><mi>q</mi><mo>)</mo></mrow></msup></math> as follows. For <math><mi>k</mi><mo>=</mo><mn>0</mn><mo>,</mo><mo>&hellip;</mo><mo>,</mo><mi>n</mi><mo>/</mo><mn>2</mn><mo>-</mo><mn>1</mn><mo>,</mo></math></ins></p>
208+
<ol style="list-style-type: none">
209+
<li><p><ins>(4.2.?) &mdash; <math><msubsup><mi>X</mi><mrow><mn>2</mn><mi>k</mi><mo>+</mo><mn>0</mn></mrow><mrow><mo>(</mo><mi>q</mi><mo>)</mo></mrow></msubsup></math> = mulhi(<math><msubsup><mi>V</mi><mrow><mn>2</mn><mi>k</mi></mrow><mrow><mo>(</mo><mi>q</mi><mo>)</mo></mrow></msubsup></math>,<math><msub><mi>M</mi><mi>k</mi></msub></math>,<i>w</i>) xor <math><msubsup><mi>K</mi><mi>k</mi><mrow><mo>(</mo><mi>q</mi><mo>)</mo></mrow></msubsup></math> xor <math><msubsup><mi>V</mi><mrow><mn>2</mn><mi>k</mi><mo>+</mo><mn>1</mn></mrow><mrow><mo>(</mo><mi>q</mi><mo>)</mo></mrow></msubsup></math>, and</ins><del><math><msub><mi>X</mi><mrow><mn>2</mn><mi>k</mi><mo>+</mo><mn>0</mn></mrow></msub></math> = mulhi(<math><msub><mi>V</mi><mrow><mn>2</mn><mi>k</mi></mrow></msub></math>,<math><msub><mi>M</mi><mi>k</mi></msub></math>,<i>w</i>) xor <math><msubsup><mi style="font-style: italic">key</mi><mi>k</mi><mi>q</mi></msubsup></math> xor <math><msub><mi>V</mi><mrow><mn>2</mn><mi>k</mi><mo>+</mo><mn>1</mn></mrow></msub></math></del></p></li>
210+
<li><p><ins>(4.2.?) &mdash; <math><msubsup><mi>X</mi><mrow><mn>2</mn><mi>k</mi><mo>+</mo><mn>1</mn></mrow><mrow><mo>(</mo><mi>q</mi><mo>)</mo></mrow></msubsup></math> = mullo(<math><msubsup><mi>V</mi><mrow><mn>2</mn><mi>k</mi></mrow><mrow><mo>(</mo><mi>q</mi><mo>)</mo></mrow></msubsup></math>,<math><msub><mi>M</mi><mi>k</mi></msub></math>,<i>w</i>),</ins><del><math><msub><mi>X</mi><mrow><mn>2</mn><mi>k</mi><mo>+</mo><mn>1</mn></mrow></msub></math> = mullo(<math><msub><mi>V</mi><mrow><mn>2</mn><mi>k</mi></mrow></msub></math>,<math><msub><mi>M</mi><mi>k</mi></msub></math>,<i>w</i>)</del></p></li>
211+
</ol>
212+
<p>
213+
where<del>:</del>
214+
</p>
215+
<ol style="list-style-type: none">
216+
<li><p>(4.2.1) &mdash; mullo(<math><mi>a</mi><mo>,</mo><mi>b</mi><mo>,</mo><mi>w</mi></math>) is the low half of the modular multiplication of
217+
<math><mi>a</mi></math> and <math><mi>b</mi></math>: <math><mo>(</mo><mi>a</mi><mo>&#8901;</mo><mi>b</mi><mo>)</mo><mo>mod</mo><msup><mn>2</mn><mi>w</mi></msup></math>,</p></li>
218+
<li><p>(4.2.2) &mdash; mulhi(<math><mi>a</mi><mo>,</mo><mi>b</mi><mo>,</mo><mi>w</mi></math>) is the high half of the modular multiplication of
219+
<math><mi>a</mi></math> and <math><mi>b</mi></math>: <math><mo>(</mo><mo>&#x230A;</mo><mo>(</mo><mi>a</mi><mo>&#8901;</mo><mi>b</mi><mo>)</mo><mo>/</mo><msup><mn>2</mn><mi>w</mi></msup><mo>&#x230B;</mo><mo>)</mo></math>,</p></li>
220+
<li><p>(4.2.3) &mdash;
221+
<del><math><mi>k</mi><mo>=</mo><mn>0</mn><mo>,</mo><mo>&hellip;</mo><mo>,</mo><mi>n</mi><mo>/</mo><mn>2</mn><mo>−</mo><mn>1</mn></math> is the index in the sequences,</del>
222+
<ins><math><msubsup><mi>K</mi><mi>k</mi><mrow><mo>(</mo><mi>q</mi><mo>)</mo></mrow></msubsup></math> is the
223+
<math><msup><mi>k</mi><mtext>th</mtext></msup></math> round key for round <math><mi>q</mi></math>,
224+
<math><msubsup><mi>K</mi><mi>k</mi><mrow><mo>(</mo><mi>q</mi><mo>)</mo></mrow></msubsup><mo>:=</mo><mo>(</mo><msub><mi>K</mi><mi>k</mi></msub><mo>+</mo><mo>(</mo><mi>q</mi><mo>-</mo><mn>1</mn><mo>)</mo><mo>&#8901;</mo><msub><mi>C</mi><mi>k</mi></msub><mo>)</mo><mo>mod</mo><msup><mn>2</mn><mi>w</mi></msup></math>,</ins></p></li>
225+
<li><p>(4.2.4) &mdash; <del><math><mi>q</mi><mo>=</mo><mn>0</mn><mo>,</mo><mo>&hellip;</mo><mo>,</mo><mi>r</mi><mo>−</mo><mn>1</mn></math> is the index of the round,</del>
226+
<ins><math><msub><mi>K</mi><mi>k</mi></msub></math> is the <math><msup><mi>k</mi><mtext>th</mtext></msup></math> element of the key sequence
227+
<math><mi>K</mi></math>,</ins></p></li>
228+
<li><p><del>(4.2.5) &mdash; <math><msubsup><mi style="font-style: italic">key</mi><mi>k</mi><mi>q</mi></msubsup></math> is the
229+
<math><msup><mi>k</mi><mtext>th</mtext></msup></math> round key for round <math><mi>q</mi></math>,
230+
<math><msubsup><mi style="font-style: italic">key</mi><mi>k</mi><mi>q</mi></msubsup><mo>:=</mo><mo>(</mo><msub><mi>K</mi><mi>k</mi></msub><mo>+</mo><mi>q</mi><mo>&#8901;</mo><msub><mi>C</mi><mi>k</mi></msub><mo>)</mo><mo>mod</mo><msup><mn>2</mn><mi>w</mi></msup></math>,</del></p></li>
231+
<li><p><del>(4.2.6) &mdash; <math><msub><mi>K</mi><mi>k</mi></msub></math> are the elements of the key sequence <math><mi>K</mi></math>,</del></p></li>
232+
<li><p>(4.2.7) &mdash; <math><msub><mi>M</mi><mi>k</mi></msub></math> is <tt>multipliers[<math><mi>k</mi></math>]</tt>, and</p></li>
233+
<li><p>(4.2.8) &mdash; <math><msub><mi>C</mi><mi>k</mi></msub></math> is <tt>round_consts[<math><mi>k</mi></math>]</tt>.</p></li>
234+
</ol>
235+
</li>
236+
125237
</ol>
126238
</blockquote>
127239
</li>

0 commit comments

Comments
 (0)