Encrypt
Key schedule
Inside block 0
Diffusion flip one plaintext bit, count differing state bytes after each round
One flipped bit touches a single byte through the first SubBytes. MixColumns spreads it to a column, and ShiftRows then moves that column across all four. After two rounds every byte of the state depends on the bit.
SHA-256
HMAC-SHA256
Avalanche
Flip bit
Each square is one bit of the digest. Teal bits changed when a single input bit was flipped. A good hash flips about half of them, with no pattern.
Message schedule, block 0 W0 to W63
Compression rounds, block 0 working variables a and e after each round
·
published test vectors·
random cases against WebCrypto·
mismatches·
total timePublished vectors FIPS 197, FIPS 180-2, RFC 4231, the GCM spec
| Case | Expected |
|---|
Differential testing random keys, IVs and lengths from 0 to 400 bytes
| Primitive | Cases | Agree |
|---|
Every case is computed twice, once here and once by the browser's native implementation, and the bytes compared.