Clause 6.2: Deoxys-TBC encryption

What the clause requires

Encryption applies, in order, a sub-tweakey exclusive-or, a byte substitution using the AES S-box, a row rotation by 0, 1, 2 and 3 positions, and a column mixing step with the named matrix. The sub-tweakey step runs once more after the last round. The round count is 14 for the 256-bit version and 16 for the 384-bit version.

What the public text does not state

• The Annex A vector values, which are not in the ISO public preview
• Whether the amendment changes the round function

What it means for you

The clause is a specification of the forward direction. It gives the order of the four transformations, the rotation offsets, the matrix and the S-box, and it gives the pseudo-code that ties them together. The order is not interchangeable: a review that finds the substitution after the mixing step is looking at a different construction, whatever the function names say.

The extra sub-tweakey step after the final round is the detail most often dropped in a summary. The text is explicit that the step runs again after the last round, and the final ciphertext is the state after that second application. A conformance test will catch it; a code review that reads only the loop may not.

The buyer does not need to check the mathematics. The buyer needs to know that the evidence exists. A known-answer test from Annex A is the cheapest proof that the forward direction matches the standard, and it is the artefact to ask for when a supplier says its implementation is conformant.

Evidence to keep

What an auditor or a customer is likely to ask for

Artefact	Owner	Why it matters
Known-answer test for the forward direction, with the input, key, tweak and expected output recorded	Engineering	The annex supplies the values; the test record proves the implementation matches.
Code review note confirming the order of the four transformations	Security architecture	Catches a construction that passes a name check but not the text.
Round count per version in the configuration record	Engineering	A wrong round count changes the algorithm.

How to verify it

Run one published vector for the version in use. If it fails, check the final sub-tweakey step first, then the rotation offsets.

Dates

The kit plan for clause 6.2 sets the evidence review at 17 June 2027, 90 days before the estimated publication date of 15 September 2027.

Cross references

• 6 Deoxys-TBC
• 6.1 Deoxys-TBC versions
• 6.3 Deoxys-TBC decryption
• 6.4 Deoxys-TBC tweakey schedule
• A.1 Deoxys-TBC-256 example
• A.2 Deoxys-TBC-384 example

Where this comes from