The bits of the
input message M are numbered from i = 0 to i = |M| - 1. When the bits are gathered in
bytes, it implies the equivalent numbering i = ibit + 8ibyte with 0 <= ibit < 8.
In our internal convention, ibit = 0 indicates the least signicant bit (LSB) of a byte while
ibit = 7 indicates the most signicant one (MSB). The NIST convention [2] is dierent: The
bits of a byte are numbered from 0 for the MSB to 7 for the LSB. To be compatible with the
API convention outside and with our convention inside, the following formal bit-reordering
is performed on the input bit string M before it is processed:
For all bytes that contain 8 bits, position ibit+8ibyte is mapped to position 7-ibit+8ibyte.
For the last byte if it contains p < 8 bits, position ibit + 8ibyte is mapped to position
(p - 1) - ibit + 8ibyte.
This mapping is bijective and does not aect the security.
In practice, the above operation cancels with the change of convention, so there is nothing
to do, except:
For the last byte if it contains p < 8 bits, the bits are shifted by 8-p positions towards
the LSB (i.e., to the "right").
5.2