解密器修正

src/gift256/interleave.rs

@@ -134,11 +134,13 @@ pub fn interleave_key_half(input: &[u32], output: &mut [u32]) {
 /// Reverse of pack_input: apply masks in reverse order (0x0F -> 0x33 -> 0x55).
 pub fn unpack_output(s: &[u32; 8], final_rk: &[u32; 8]) -> [u32; 8] {
     // XOR with final round keys first
+    // Mapping from pack_input output indices:
+    //   out7=a, out3=e, out5=c, out1=g, out6=b, out2=f, out4=d, out0=h
     let mut a = s[7] ^ final_rk[7];
     let mut b = s[6] ^ final_rk[6];
     let mut c = s[5] ^ final_rk[5];
-    let mut d = s[3] ^ final_rk[3];
-    let mut e = s[4] ^ final_rk[4];
+    let mut d = s[4] ^ final_rk[4];  // out4 = d part
+    let mut e = s[3] ^ final_rk[3];  // out3 = e part
     let mut f = s[2] ^ final_rk[2];
     let mut g = s[1] ^ final_rk[1];
     let mut h = s[0] ^ final_rk[0];