SIMON implementation, decryption issues I've been trying to implement the new SIMON block cipher in Ruby as a personal challenge. The spec didn't include a pseudocode version of the decryption but I thought I had it figured out. The code I wrote is located at https://github.com/Rami114/Personal/blob/master/Simon/Simon.rb

I've based this on the spec available at http://eprint.iacr.org/2013/404.pdf

Currently my encryption does not work (at all I'd say) which may be due to code issues or do to math failure on my behalf. Could someone please help me validate if the decryption is correct. Most notably the inversion of the rounds:

# f(x) ((LCS(x,1) &amp; LCS(x,8)) ^ LCS(x,2))

def self.f (x, block_size)
  ((lcs(x, block_size, 1) &amp; lcs(x, block_size, 8)) ^ lcs(x, block_size, 2))
end

def self.round_inv (x, y, k1, k2)
  x ^= k2 
  x ^= f(y, N)
  y ^= k1
  y ^= f(x, N)
  return x, y
end


And the decryption function which I won't fully paste here as it's defined in the link above (the whole thing is only 200 lines long total so not a monster to read).

I have a stackoverflow question up at the moment which is specific to the way I'm currently converting strings to bignums and back (to accommodate the circular shift) but I didn't think that would be appropriate to this SE site. 

Are there any glaring errors in my implementation? I'm by no means an expert in this.

E: the stackoverflow question I have up for code concerns: https://stackoverflow.com/questions/17785691/string-to-bignum-and-back-again-in-ruby-to-allow-circular-shift
From a quick read, there are a couple of potential issues.


decrypt_128_256 is iterating rounds in the same order as in encrypt_128_256, so the round keys are being applied in the wrong order on decrypt.
decrypt_128_256 needs to iterate through the round keys starting from the last round and working backwards.
68 rounds are being used for Speck128/256 (should be 72) - this won't stop it being symmetric, but it will stop it passing test vectors.


A reference you can run against is a really good idea - I tend to instrument all of the intermediate calculations on the reference and new implementations, pipe both sets of output to files and diff the output to see where things need fixing up. 

As you've discovered the Simon/Speck algorithms are a wee bit short of reference code - I managed to bootstrap off the Speck128/128 example at the end of the spec to a working implementation of the Speck variants, and Simon was straightforward after that. 

I've just pushed my Java implementations of Simon (and Speck), which you can use for comparison or runtime reference (it's in a feature fork of Bouncy Castle, so you should be able to build from the root with little trouble).