Annex A.2: Deoxys-TBC-384 example

What the clause requires

What the public text does not state

• The example values
• Any amendment change to the example

What it means for you

The 384-bit Deoxys example is the wider-tweakey version of the same family. The block stays at 128 bits, the tweakey grows to 384 bits, and the round count rises to 16. The extra input can be used as key, as tweak or as a mix, so the example is also a test of whether the implementation has understood the split.

A longer tweakey is not the same as a longer key. An organisation that reads "384" as a 384-bit key will overstate the security claim and may miss the actual key length in its inventory. The record asks for the key and tweak lengths separately for exactly this reason, and the example page repeats the point because it is the page a reader lands on from the algorithm name.

The evidence is the same shape as the 256-bit page with one addition: a side-channel review. A wider tweakey changes the amount of key material loaded per round, and the load path is worth a look in any implementation that handles secret data. The standard does not require the review; a serious buyer will ask for it.

Evidence to keep

What an auditor or a customer is likely to ask for

Artefact	Owner	Why it matters
Known-answer test record for Deoxys-TBC-384 with the five fields and the build	Engineering	The annex supplies the expected output.
Configuration record with the key and tweak lengths that sum to 384	Engineering	The version name alone does not prove the key floor.
Side-channel review note for the key load path	Security architecture	A wider tweakey changes the amount of secret material handled per round.

How to verify it

Ask for the 384-bit test record and the split. If the answer gives only "384-bit", the key length is still unknown.

Dates

The kit plan for annex A.2 sets the evidence review at 17 June 2027, 90 days before the estimated publication date of 15 September 2027.

Cross references

• A Annex A, Numerical examples
• 5 Requirements on the usage of tweakable block ciphers
• 6.1 Deoxys-TBC versions
• 6.3 Deoxys-TBC decryption

Where this comes from