I also tried to verify "table 6", which appears to be correct except for the second row, where the hex value shown for "C" is accidentally the same as "E". Cor

I also tried to verify "table 6", which appears to be correct except for the second row, where the hex value shown for "C" is accidentally the same as "E". Correcting it to 0x7761792c20666f72 causes all the "test cases" to come out as claimed. https://emergent.unpythonic.net/files/sandbox/474bis.py https://emergent.unpythonic.net/files/sandbox/474bis.py It does seem like there has to be some interesting cryptanalysis going on to produce this many interesting pairs, particularly when they're (claimed to be) drawn from a relatively short corpus. However, when considering how you would generate such pairs, you need not actually do "Algorithm 1" (in which step 6 is "do the secret magic"); you can select your block Pi and key Ki, then see if the result happens to be a block Ci that you can claim you picked first. In "pg10.txt" there are 53103 distinct 4-byte blocks, or about 2^32 pairs of blocks, so if you work in this way you only have to do around 2^33 SIMON-64/32 block encryptions to be able to produce a new row of "table 6". Also, some of the C/E values are not actually present in "pg10.txt", their supposed restricted corpus. For instance, "{" is a character in several of them, but appears nowhere at all in my copy downloaded from the URL they gave. So they have somehow failed to accurately describe the corpus they actually used.