From 86dd0ff05413e1cf1f9f0f480e2ac8de246a4090 Mon Sep 17 00:00:00 2001
From: Bastien Gillon <bastien.gillondevreese@gmail.com>
Date: Wed, 10 Jul 2024 11:13:46 +0200
Subject: [PATCH] Decode FORS indices similarly to WOTS

As proposed by NIST's David Cooper:
https://groups.google.com/a/list.nist.gov/g/pqc-forum/c/88tuvtb7nN4/m/DA1QCoJWBAAJ
---
 src/sig/sphincs/pqclean_sphincs-sha2-128f-simple_avx2/fors.c    | 2 +-
 src/sig/sphincs/pqclean_sphincs-sha2-128f-simple_clean/fors.c   | 2 +-
 src/sig/sphincs/pqclean_sphincs-sha2-128s-simple_avx2/fors.c    | 2 +-
 src/sig/sphincs/pqclean_sphincs-sha2-128s-simple_clean/fors.c   | 2 +-
 src/sig/sphincs/pqclean_sphincs-sha2-192f-simple_avx2/fors.c    | 2 +-
 src/sig/sphincs/pqclean_sphincs-sha2-192f-simple_clean/fors.c   | 2 +-
 src/sig/sphincs/pqclean_sphincs-sha2-192s-simple_avx2/fors.c    | 2 +-
 src/sig/sphincs/pqclean_sphincs-sha2-192s-simple_clean/fors.c   | 2 +-
 src/sig/sphincs/pqclean_sphincs-sha2-256f-simple_avx2/fors.c    | 2 +-
 src/sig/sphincs/pqclean_sphincs-sha2-256f-simple_clean/fors.c   | 2 +-
 src/sig/sphincs/pqclean_sphincs-sha2-256s-simple_avx2/fors.c    | 2 +-
 src/sig/sphincs/pqclean_sphincs-sha2-256s-simple_clean/fors.c   | 2 +-
 .../sphincs/pqclean_sphincs-shake-128f-simple_aarch64/fors.c    | 2 +-
 src/sig/sphincs/pqclean_sphincs-shake-128f-simple_avx2/fors.c   | 2 +-
 src/sig/sphincs/pqclean_sphincs-shake-128f-simple_clean/fors.c  | 2 +-
 .../sphincs/pqclean_sphincs-shake-128s-simple_aarch64/fors.c    | 2 +-
 src/sig/sphincs/pqclean_sphincs-shake-128s-simple_avx2/fors.c   | 2 +-
 src/sig/sphincs/pqclean_sphincs-shake-128s-simple_clean/fors.c  | 2 +-
 .../sphincs/pqclean_sphincs-shake-192f-simple_aarch64/fors.c    | 2 +-
 src/sig/sphincs/pqclean_sphincs-shake-192f-simple_avx2/fors.c   | 2 +-
 src/sig/sphincs/pqclean_sphincs-shake-192f-simple_clean/fors.c  | 2 +-
 .../sphincs/pqclean_sphincs-shake-192s-simple_aarch64/fors.c    | 2 +-
 src/sig/sphincs/pqclean_sphincs-shake-192s-simple_avx2/fors.c   | 2 +-
 src/sig/sphincs/pqclean_sphincs-shake-192s-simple_clean/fors.c  | 2 +-
 .../sphincs/pqclean_sphincs-shake-256f-simple_aarch64/fors.c    | 2 +-
 src/sig/sphincs/pqclean_sphincs-shake-256f-simple_avx2/fors.c   | 2 +-
 src/sig/sphincs/pqclean_sphincs-shake-256f-simple_clean/fors.c  | 2 +-
 .../sphincs/pqclean_sphincs-shake-256s-simple_aarch64/fors.c    | 2 +-
 src/sig/sphincs/pqclean_sphincs-shake-256s-simple_avx2/fors.c   | 2 +-
 src/sig/sphincs/pqclean_sphincs-shake-256s-simple_clean/fors.c  | 2 +-
 30 files changed, 30 insertions(+), 30 deletions(-)

diff --git a/src/sig/sphincs/pqclean_sphincs-sha2-128f-simple_avx2/fors.c b/src/sig/sphincs/pqclean_sphincs-sha2-128f-simple_avx2/fors.c
index 3097a80eaa..1d317301ca 100644
--- a/src/sig/sphincs/pqclean_sphincs-sha2-128f-simple_avx2/fors.c
+++ b/src/sig/sphincs/pqclean_sphincs-sha2-128f-simple_avx2/fors.c
@@ -120,7 +120,7 @@ static void message_to_indices(uint32_t *indices, const unsigned char *m) {
     for (i = 0; i < SPX_FORS_TREES; i++) {
         indices[i] = 0;
         for (j = 0; j < SPX_FORS_HEIGHT; j++) {
-            indices[i] ^= (uint32_t)(((m[offset >> 3] >> (offset & 0x7)) & 0x1) << j);
+            indices[i] ^= (uint32_t)(((m[offset >> 3] >> (~offset & 0x7)) & 0x1) << (SPX_FORS_HEIGHT-1-j));
             offset++;
         }
     }
diff --git a/src/sig/sphincs/pqclean_sphincs-sha2-128f-simple_clean/fors.c b/src/sig/sphincs/pqclean_sphincs-sha2-128f-simple_clean/fors.c
index 96ca72e986..a217797718 100644
--- a/src/sig/sphincs/pqclean_sphincs-sha2-128f-simple_clean/fors.c
+++ b/src/sig/sphincs/pqclean_sphincs-sha2-128f-simple_clean/fors.c
@@ -53,7 +53,7 @@ static void message_to_indices(uint32_t *indices, const unsigned char *m) {
     for (i = 0; i < SPX_FORS_TREES; i++) {
         indices[i] = 0;
         for (j = 0; j < SPX_FORS_HEIGHT; j++) {
-            indices[i] ^= (uint32_t)(((m[offset >> 3] >> (offset & 0x7)) & 0x1) << j);
+            indices[i] ^= (uint32_t)(((m[offset >> 3] >> (~offset & 0x7)) & 0x1) << (SPX_FORS_HEIGHT-1-j));
             offset++;
         }
     }
diff --git a/src/sig/sphincs/pqclean_sphincs-sha2-128s-simple_avx2/fors.c b/src/sig/sphincs/pqclean_sphincs-sha2-128s-simple_avx2/fors.c
index 3097a80eaa..1d317301ca 100644
--- a/src/sig/sphincs/pqclean_sphincs-sha2-128s-simple_avx2/fors.c
+++ b/src/sig/sphincs/pqclean_sphincs-sha2-128s-simple_avx2/fors.c
@@ -120,7 +120,7 @@ static void message_to_indices(uint32_t *indices, const unsigned char *m) {
     for (i = 0; i < SPX_FORS_TREES; i++) {
         indices[i] = 0;
         for (j = 0; j < SPX_FORS_HEIGHT; j++) {
-            indices[i] ^= (uint32_t)(((m[offset >> 3] >> (offset & 0x7)) & 0x1) << j);
+            indices[i] ^= (uint32_t)(((m[offset >> 3] >> (~offset & 0x7)) & 0x1) << (SPX_FORS_HEIGHT-1-j));
             offset++;
         }
     }
diff --git a/src/sig/sphincs/pqclean_sphincs-sha2-128s-simple_clean/fors.c b/src/sig/sphincs/pqclean_sphincs-sha2-128s-simple_clean/fors.c
index 96ca72e986..a217797718 100644
--- a/src/sig/sphincs/pqclean_sphincs-sha2-128s-simple_clean/fors.c
+++ b/src/sig/sphincs/pqclean_sphincs-sha2-128s-simple_clean/fors.c
@@ -53,7 +53,7 @@ static void message_to_indices(uint32_t *indices, const unsigned char *m) {
     for (i = 0; i < SPX_FORS_TREES; i++) {
         indices[i] = 0;
         for (j = 0; j < SPX_FORS_HEIGHT; j++) {
-            indices[i] ^= (uint32_t)(((m[offset >> 3] >> (offset & 0x7)) & 0x1) << j);
+            indices[i] ^= (uint32_t)(((m[offset >> 3] >> (~offset & 0x7)) & 0x1) << (SPX_FORS_HEIGHT-1-j));
             offset++;
         }
     }
diff --git a/src/sig/sphincs/pqclean_sphincs-sha2-192f-simple_avx2/fors.c b/src/sig/sphincs/pqclean_sphincs-sha2-192f-simple_avx2/fors.c
index 3097a80eaa..1d317301ca 100644
--- a/src/sig/sphincs/pqclean_sphincs-sha2-192f-simple_avx2/fors.c
+++ b/src/sig/sphincs/pqclean_sphincs-sha2-192f-simple_avx2/fors.c
@@ -120,7 +120,7 @@ static void message_to_indices(uint32_t *indices, const unsigned char *m) {
     for (i = 0; i < SPX_FORS_TREES; i++) {
         indices[i] = 0;
         for (j = 0; j < SPX_FORS_HEIGHT; j++) {
-            indices[i] ^= (uint32_t)(((m[offset >> 3] >> (offset & 0x7)) & 0x1) << j);
+            indices[i] ^= (uint32_t)(((m[offset >> 3] >> (~offset & 0x7)) & 0x1) << (SPX_FORS_HEIGHT-1-j));
             offset++;
         }
     }
diff --git a/src/sig/sphincs/pqclean_sphincs-sha2-192f-simple_clean/fors.c b/src/sig/sphincs/pqclean_sphincs-sha2-192f-simple_clean/fors.c
index 96ca72e986..a217797718 100644
--- a/src/sig/sphincs/pqclean_sphincs-sha2-192f-simple_clean/fors.c
+++ b/src/sig/sphincs/pqclean_sphincs-sha2-192f-simple_clean/fors.c
@@ -53,7 +53,7 @@ static void message_to_indices(uint32_t *indices, const unsigned char *m) {
     for (i = 0; i < SPX_FORS_TREES; i++) {
         indices[i] = 0;
         for (j = 0; j < SPX_FORS_HEIGHT; j++) {
-            indices[i] ^= (uint32_t)(((m[offset >> 3] >> (offset & 0x7)) & 0x1) << j);
+            indices[i] ^= (uint32_t)(((m[offset >> 3] >> (~offset & 0x7)) & 0x1) << (SPX_FORS_HEIGHT-1-j));
             offset++;
         }
     }
diff --git a/src/sig/sphincs/pqclean_sphincs-sha2-192s-simple_avx2/fors.c b/src/sig/sphincs/pqclean_sphincs-sha2-192s-simple_avx2/fors.c
index 3097a80eaa..1d317301ca 100644
--- a/src/sig/sphincs/pqclean_sphincs-sha2-192s-simple_avx2/fors.c
+++ b/src/sig/sphincs/pqclean_sphincs-sha2-192s-simple_avx2/fors.c
@@ -120,7 +120,7 @@ static void message_to_indices(uint32_t *indices, const unsigned char *m) {
     for (i = 0; i < SPX_FORS_TREES; i++) {
         indices[i] = 0;
         for (j = 0; j < SPX_FORS_HEIGHT; j++) {
-            indices[i] ^= (uint32_t)(((m[offset >> 3] >> (offset & 0x7)) & 0x1) << j);
+            indices[i] ^= (uint32_t)(((m[offset >> 3] >> (~offset & 0x7)) & 0x1) << (SPX_FORS_HEIGHT-1-j));
             offset++;
         }
     }
diff --git a/src/sig/sphincs/pqclean_sphincs-sha2-192s-simple_clean/fors.c b/src/sig/sphincs/pqclean_sphincs-sha2-192s-simple_clean/fors.c
index 96ca72e986..a217797718 100644
--- a/src/sig/sphincs/pqclean_sphincs-sha2-192s-simple_clean/fors.c
+++ b/src/sig/sphincs/pqclean_sphincs-sha2-192s-simple_clean/fors.c
@@ -53,7 +53,7 @@ static void message_to_indices(uint32_t *indices, const unsigned char *m) {
     for (i = 0; i < SPX_FORS_TREES; i++) {
         indices[i] = 0;
         for (j = 0; j < SPX_FORS_HEIGHT; j++) {
-            indices[i] ^= (uint32_t)(((m[offset >> 3] >> (offset & 0x7)) & 0x1) << j);
+            indices[i] ^= (uint32_t)(((m[offset >> 3] >> (~offset & 0x7)) & 0x1) << (SPX_FORS_HEIGHT-1-j));
             offset++;
         }
     }
diff --git a/src/sig/sphincs/pqclean_sphincs-sha2-256f-simple_avx2/fors.c b/src/sig/sphincs/pqclean_sphincs-sha2-256f-simple_avx2/fors.c
index 3097a80eaa..1d317301ca 100644
--- a/src/sig/sphincs/pqclean_sphincs-sha2-256f-simple_avx2/fors.c
+++ b/src/sig/sphincs/pqclean_sphincs-sha2-256f-simple_avx2/fors.c
@@ -120,7 +120,7 @@ static void message_to_indices(uint32_t *indices, const unsigned char *m) {
     for (i = 0; i < SPX_FORS_TREES; i++) {
         indices[i] = 0;
         for (j = 0; j < SPX_FORS_HEIGHT; j++) {
-            indices[i] ^= (uint32_t)(((m[offset >> 3] >> (offset & 0x7)) & 0x1) << j);
+            indices[i] ^= (uint32_t)(((m[offset >> 3] >> (~offset & 0x7)) & 0x1) << (SPX_FORS_HEIGHT-1-j));
             offset++;
         }
     }
diff --git a/src/sig/sphincs/pqclean_sphincs-sha2-256f-simple_clean/fors.c b/src/sig/sphincs/pqclean_sphincs-sha2-256f-simple_clean/fors.c
index 96ca72e986..a217797718 100644
--- a/src/sig/sphincs/pqclean_sphincs-sha2-256f-simple_clean/fors.c
+++ b/src/sig/sphincs/pqclean_sphincs-sha2-256f-simple_clean/fors.c
@@ -53,7 +53,7 @@ static void message_to_indices(uint32_t *indices, const unsigned char *m) {
     for (i = 0; i < SPX_FORS_TREES; i++) {
         indices[i] = 0;
         for (j = 0; j < SPX_FORS_HEIGHT; j++) {
-            indices[i] ^= (uint32_t)(((m[offset >> 3] >> (offset & 0x7)) & 0x1) << j);
+            indices[i] ^= (uint32_t)(((m[offset >> 3] >> (~offset & 0x7)) & 0x1) << (SPX_FORS_HEIGHT-1-j));
             offset++;
         }
     }
diff --git a/src/sig/sphincs/pqclean_sphincs-sha2-256s-simple_avx2/fors.c b/src/sig/sphincs/pqclean_sphincs-sha2-256s-simple_avx2/fors.c
index 3097a80eaa..1d317301ca 100644
--- a/src/sig/sphincs/pqclean_sphincs-sha2-256s-simple_avx2/fors.c
+++ b/src/sig/sphincs/pqclean_sphincs-sha2-256s-simple_avx2/fors.c
@@ -120,7 +120,7 @@ static void message_to_indices(uint32_t *indices, const unsigned char *m) {
     for (i = 0; i < SPX_FORS_TREES; i++) {
         indices[i] = 0;
         for (j = 0; j < SPX_FORS_HEIGHT; j++) {
-            indices[i] ^= (uint32_t)(((m[offset >> 3] >> (offset & 0x7)) & 0x1) << j);
+            indices[i] ^= (uint32_t)(((m[offset >> 3] >> (~offset & 0x7)) & 0x1) << (SPX_FORS_HEIGHT-1-j));
             offset++;
         }
     }
diff --git a/src/sig/sphincs/pqclean_sphincs-sha2-256s-simple_clean/fors.c b/src/sig/sphincs/pqclean_sphincs-sha2-256s-simple_clean/fors.c
index 96ca72e986..a217797718 100644
--- a/src/sig/sphincs/pqclean_sphincs-sha2-256s-simple_clean/fors.c
+++ b/src/sig/sphincs/pqclean_sphincs-sha2-256s-simple_clean/fors.c
@@ -53,7 +53,7 @@ static void message_to_indices(uint32_t *indices, const unsigned char *m) {
     for (i = 0; i < SPX_FORS_TREES; i++) {
         indices[i] = 0;
         for (j = 0; j < SPX_FORS_HEIGHT; j++) {
-            indices[i] ^= (uint32_t)(((m[offset >> 3] >> (offset & 0x7)) & 0x1) << j);
+            indices[i] ^= (uint32_t)(((m[offset >> 3] >> (~offset & 0x7)) & 0x1) << (SPX_FORS_HEIGHT-1-j));
             offset++;
         }
     }
diff --git a/src/sig/sphincs/pqclean_sphincs-shake-128f-simple_aarch64/fors.c b/src/sig/sphincs/pqclean_sphincs-shake-128f-simple_aarch64/fors.c
index 39193d04e2..e5ef891ac1 100644
--- a/src/sig/sphincs/pqclean_sphincs-shake-128f-simple_aarch64/fors.c
+++ b/src/sig/sphincs/pqclean_sphincs-shake-128f-simple_aarch64/fors.c
@@ -86,7 +86,7 @@ static void message_to_indices(uint32_t *indices, const unsigned char *m) {
     for (i = 0; i < SPX_FORS_TREES; i++) {
         indices[i] = 0;
         for (j = 0; j < SPX_FORS_HEIGHT; j++) {
-            indices[i] ^= (uint32_t)(((m[offset >> 3] >> (offset & 0x7)) & 0x1) << j);
+            indices[i] ^= (uint32_t)(((m[offset >> 3] >> (~offset & 0x7)) & 0x1) << (SPX_FORS_HEIGHT-1-j));
             offset++;
         }
     }
diff --git a/src/sig/sphincs/pqclean_sphincs-shake-128f-simple_avx2/fors.c b/src/sig/sphincs/pqclean_sphincs-shake-128f-simple_avx2/fors.c
index f1b0639cfc..c348c61962 100644
--- a/src/sig/sphincs/pqclean_sphincs-shake-128f-simple_avx2/fors.c
+++ b/src/sig/sphincs/pqclean_sphincs-shake-128f-simple_avx2/fors.c
@@ -97,7 +97,7 @@ static void message_to_indices(uint32_t *indices, const unsigned char *m) {
     for (i = 0; i < SPX_FORS_TREES; i++) {
         indices[i] = 0;
         for (j = 0; j < SPX_FORS_HEIGHT; j++) {
-            indices[i] ^= (uint32_t)(((m[offset >> 3] >> (offset & 0x7)) & 0x1) << j);
+            indices[i] ^= (uint32_t)(((m[offset >> 3] >> (~offset & 0x7)) & 0x1) << (SPX_FORS_HEIGHT-1-j));
             offset++;
         }
     }
diff --git a/src/sig/sphincs/pqclean_sphincs-shake-128f-simple_clean/fors.c b/src/sig/sphincs/pqclean_sphincs-shake-128f-simple_clean/fors.c
index 96ca72e986..a217797718 100644
--- a/src/sig/sphincs/pqclean_sphincs-shake-128f-simple_clean/fors.c
+++ b/src/sig/sphincs/pqclean_sphincs-shake-128f-simple_clean/fors.c
@@ -53,7 +53,7 @@ static void message_to_indices(uint32_t *indices, const unsigned char *m) {
     for (i = 0; i < SPX_FORS_TREES; i++) {
         indices[i] = 0;
         for (j = 0; j < SPX_FORS_HEIGHT; j++) {
-            indices[i] ^= (uint32_t)(((m[offset >> 3] >> (offset & 0x7)) & 0x1) << j);
+            indices[i] ^= (uint32_t)(((m[offset >> 3] >> (~offset & 0x7)) & 0x1) << (SPX_FORS_HEIGHT-1-j));
             offset++;
         }
     }
diff --git a/src/sig/sphincs/pqclean_sphincs-shake-128s-simple_aarch64/fors.c b/src/sig/sphincs/pqclean_sphincs-shake-128s-simple_aarch64/fors.c
index 39193d04e2..e5ef891ac1 100644
--- a/src/sig/sphincs/pqclean_sphincs-shake-128s-simple_aarch64/fors.c
+++ b/src/sig/sphincs/pqclean_sphincs-shake-128s-simple_aarch64/fors.c
@@ -86,7 +86,7 @@ static void message_to_indices(uint32_t *indices, const unsigned char *m) {
     for (i = 0; i < SPX_FORS_TREES; i++) {
         indices[i] = 0;
         for (j = 0; j < SPX_FORS_HEIGHT; j++) {
-            indices[i] ^= (uint32_t)(((m[offset >> 3] >> (offset & 0x7)) & 0x1) << j);
+            indices[i] ^= (uint32_t)(((m[offset >> 3] >> (~offset & 0x7)) & 0x1) << (SPX_FORS_HEIGHT-1-j));
             offset++;
         }
     }
diff --git a/src/sig/sphincs/pqclean_sphincs-shake-128s-simple_avx2/fors.c b/src/sig/sphincs/pqclean_sphincs-shake-128s-simple_avx2/fors.c
index f1b0639cfc..c348c61962 100644
--- a/src/sig/sphincs/pqclean_sphincs-shake-128s-simple_avx2/fors.c
+++ b/src/sig/sphincs/pqclean_sphincs-shake-128s-simple_avx2/fors.c
@@ -97,7 +97,7 @@ static void message_to_indices(uint32_t *indices, const unsigned char *m) {
     for (i = 0; i < SPX_FORS_TREES; i++) {
         indices[i] = 0;
         for (j = 0; j < SPX_FORS_HEIGHT; j++) {
-            indices[i] ^= (uint32_t)(((m[offset >> 3] >> (offset & 0x7)) & 0x1) << j);
+            indices[i] ^= (uint32_t)(((m[offset >> 3] >> (~offset & 0x7)) & 0x1) << (SPX_FORS_HEIGHT-1-j));
             offset++;
         }
     }
diff --git a/src/sig/sphincs/pqclean_sphincs-shake-128s-simple_clean/fors.c b/src/sig/sphincs/pqclean_sphincs-shake-128s-simple_clean/fors.c
index 96ca72e986..a217797718 100644
--- a/src/sig/sphincs/pqclean_sphincs-shake-128s-simple_clean/fors.c
+++ b/src/sig/sphincs/pqclean_sphincs-shake-128s-simple_clean/fors.c
@@ -53,7 +53,7 @@ static void message_to_indices(uint32_t *indices, const unsigned char *m) {
     for (i = 0; i < SPX_FORS_TREES; i++) {
         indices[i] = 0;
         for (j = 0; j < SPX_FORS_HEIGHT; j++) {
-            indices[i] ^= (uint32_t)(((m[offset >> 3] >> (offset & 0x7)) & 0x1) << j);
+            indices[i] ^= (uint32_t)(((m[offset >> 3] >> (~offset & 0x7)) & 0x1) << (SPX_FORS_HEIGHT-1-j));
             offset++;
         }
     }
diff --git a/src/sig/sphincs/pqclean_sphincs-shake-192f-simple_aarch64/fors.c b/src/sig/sphincs/pqclean_sphincs-shake-192f-simple_aarch64/fors.c
index 39193d04e2..e5ef891ac1 100644
--- a/src/sig/sphincs/pqclean_sphincs-shake-192f-simple_aarch64/fors.c
+++ b/src/sig/sphincs/pqclean_sphincs-shake-192f-simple_aarch64/fors.c
@@ -86,7 +86,7 @@ static void message_to_indices(uint32_t *indices, const unsigned char *m) {
     for (i = 0; i < SPX_FORS_TREES; i++) {
         indices[i] = 0;
         for (j = 0; j < SPX_FORS_HEIGHT; j++) {
-            indices[i] ^= (uint32_t)(((m[offset >> 3] >> (offset & 0x7)) & 0x1) << j);
+            indices[i] ^= (uint32_t)(((m[offset >> 3] >> (~offset & 0x7)) & 0x1) << (SPX_FORS_HEIGHT-1-j));
             offset++;
         }
     }
diff --git a/src/sig/sphincs/pqclean_sphincs-shake-192f-simple_avx2/fors.c b/src/sig/sphincs/pqclean_sphincs-shake-192f-simple_avx2/fors.c
index f1b0639cfc..c348c61962 100644
--- a/src/sig/sphincs/pqclean_sphincs-shake-192f-simple_avx2/fors.c
+++ b/src/sig/sphincs/pqclean_sphincs-shake-192f-simple_avx2/fors.c
@@ -97,7 +97,7 @@ static void message_to_indices(uint32_t *indices, const unsigned char *m) {
     for (i = 0; i < SPX_FORS_TREES; i++) {
         indices[i] = 0;
         for (j = 0; j < SPX_FORS_HEIGHT; j++) {
-            indices[i] ^= (uint32_t)(((m[offset >> 3] >> (offset & 0x7)) & 0x1) << j);
+            indices[i] ^= (uint32_t)(((m[offset >> 3] >> (~offset & 0x7)) & 0x1) << (SPX_FORS_HEIGHT-1-j));
             offset++;
         }
     }
diff --git a/src/sig/sphincs/pqclean_sphincs-shake-192f-simple_clean/fors.c b/src/sig/sphincs/pqclean_sphincs-shake-192f-simple_clean/fors.c
index 96ca72e986..a217797718 100644
--- a/src/sig/sphincs/pqclean_sphincs-shake-192f-simple_clean/fors.c
+++ b/src/sig/sphincs/pqclean_sphincs-shake-192f-simple_clean/fors.c
@@ -53,7 +53,7 @@ static void message_to_indices(uint32_t *indices, const unsigned char *m) {
     for (i = 0; i < SPX_FORS_TREES; i++) {
         indices[i] = 0;
         for (j = 0; j < SPX_FORS_HEIGHT; j++) {
-            indices[i] ^= (uint32_t)(((m[offset >> 3] >> (offset & 0x7)) & 0x1) << j);
+            indices[i] ^= (uint32_t)(((m[offset >> 3] >> (~offset & 0x7)) & 0x1) << (SPX_FORS_HEIGHT-1-j));
             offset++;
         }
     }
diff --git a/src/sig/sphincs/pqclean_sphincs-shake-192s-simple_aarch64/fors.c b/src/sig/sphincs/pqclean_sphincs-shake-192s-simple_aarch64/fors.c
index 39193d04e2..e5ef891ac1 100644
--- a/src/sig/sphincs/pqclean_sphincs-shake-192s-simple_aarch64/fors.c
+++ b/src/sig/sphincs/pqclean_sphincs-shake-192s-simple_aarch64/fors.c
@@ -86,7 +86,7 @@ static void message_to_indices(uint32_t *indices, const unsigned char *m) {
     for (i = 0; i < SPX_FORS_TREES; i++) {
         indices[i] = 0;
         for (j = 0; j < SPX_FORS_HEIGHT; j++) {
-            indices[i] ^= (uint32_t)(((m[offset >> 3] >> (offset & 0x7)) & 0x1) << j);
+            indices[i] ^= (uint32_t)(((m[offset >> 3] >> (~offset & 0x7)) & 0x1) << (SPX_FORS_HEIGHT-1-j));
             offset++;
         }
     }
diff --git a/src/sig/sphincs/pqclean_sphincs-shake-192s-simple_avx2/fors.c b/src/sig/sphincs/pqclean_sphincs-shake-192s-simple_avx2/fors.c
index f1b0639cfc..c348c61962 100644
--- a/src/sig/sphincs/pqclean_sphincs-shake-192s-simple_avx2/fors.c
+++ b/src/sig/sphincs/pqclean_sphincs-shake-192s-simple_avx2/fors.c
@@ -97,7 +97,7 @@ static void message_to_indices(uint32_t *indices, const unsigned char *m) {
     for (i = 0; i < SPX_FORS_TREES; i++) {
         indices[i] = 0;
         for (j = 0; j < SPX_FORS_HEIGHT; j++) {
-            indices[i] ^= (uint32_t)(((m[offset >> 3] >> (offset & 0x7)) & 0x1) << j);
+            indices[i] ^= (uint32_t)(((m[offset >> 3] >> (~offset & 0x7)) & 0x1) << (SPX_FORS_HEIGHT-1-j));
             offset++;
         }
     }
diff --git a/src/sig/sphincs/pqclean_sphincs-shake-192s-simple_clean/fors.c b/src/sig/sphincs/pqclean_sphincs-shake-192s-simple_clean/fors.c
index 96ca72e986..a217797718 100644
--- a/src/sig/sphincs/pqclean_sphincs-shake-192s-simple_clean/fors.c
+++ b/src/sig/sphincs/pqclean_sphincs-shake-192s-simple_clean/fors.c
@@ -53,7 +53,7 @@ static void message_to_indices(uint32_t *indices, const unsigned char *m) {
     for (i = 0; i < SPX_FORS_TREES; i++) {
         indices[i] = 0;
         for (j = 0; j < SPX_FORS_HEIGHT; j++) {
-            indices[i] ^= (uint32_t)(((m[offset >> 3] >> (offset & 0x7)) & 0x1) << j);
+            indices[i] ^= (uint32_t)(((m[offset >> 3] >> (~offset & 0x7)) & 0x1) << (SPX_FORS_HEIGHT-1-j));
             offset++;
         }
     }
diff --git a/src/sig/sphincs/pqclean_sphincs-shake-256f-simple_aarch64/fors.c b/src/sig/sphincs/pqclean_sphincs-shake-256f-simple_aarch64/fors.c
index 39193d04e2..e5ef891ac1 100644
--- a/src/sig/sphincs/pqclean_sphincs-shake-256f-simple_aarch64/fors.c
+++ b/src/sig/sphincs/pqclean_sphincs-shake-256f-simple_aarch64/fors.c
@@ -86,7 +86,7 @@ static void message_to_indices(uint32_t *indices, const unsigned char *m) {
     for (i = 0; i < SPX_FORS_TREES; i++) {
         indices[i] = 0;
         for (j = 0; j < SPX_FORS_HEIGHT; j++) {
-            indices[i] ^= (uint32_t)(((m[offset >> 3] >> (offset & 0x7)) & 0x1) << j);
+            indices[i] ^= (uint32_t)(((m[offset >> 3] >> (~offset & 0x7)) & 0x1) << (SPX_FORS_HEIGHT-1-j));
             offset++;
         }
     }
diff --git a/src/sig/sphincs/pqclean_sphincs-shake-256f-simple_avx2/fors.c b/src/sig/sphincs/pqclean_sphincs-shake-256f-simple_avx2/fors.c
index f1b0639cfc..c348c61962 100644
--- a/src/sig/sphincs/pqclean_sphincs-shake-256f-simple_avx2/fors.c
+++ b/src/sig/sphincs/pqclean_sphincs-shake-256f-simple_avx2/fors.c
@@ -97,7 +97,7 @@ static void message_to_indices(uint32_t *indices, const unsigned char *m) {
     for (i = 0; i < SPX_FORS_TREES; i++) {
         indices[i] = 0;
         for (j = 0; j < SPX_FORS_HEIGHT; j++) {
-            indices[i] ^= (uint32_t)(((m[offset >> 3] >> (offset & 0x7)) & 0x1) << j);
+            indices[i] ^= (uint32_t)(((m[offset >> 3] >> (~offset & 0x7)) & 0x1) << (SPX_FORS_HEIGHT-1-j));
             offset++;
         }
     }
diff --git a/src/sig/sphincs/pqclean_sphincs-shake-256f-simple_clean/fors.c b/src/sig/sphincs/pqclean_sphincs-shake-256f-simple_clean/fors.c
index 96ca72e986..a217797718 100644
--- a/src/sig/sphincs/pqclean_sphincs-shake-256f-simple_clean/fors.c
+++ b/src/sig/sphincs/pqclean_sphincs-shake-256f-simple_clean/fors.c
@@ -53,7 +53,7 @@ static void message_to_indices(uint32_t *indices, const unsigned char *m) {
     for (i = 0; i < SPX_FORS_TREES; i++) {
         indices[i] = 0;
         for (j = 0; j < SPX_FORS_HEIGHT; j++) {
-            indices[i] ^= (uint32_t)(((m[offset >> 3] >> (offset & 0x7)) & 0x1) << j);
+            indices[i] ^= (uint32_t)(((m[offset >> 3] >> (~offset & 0x7)) & 0x1) << (SPX_FORS_HEIGHT-1-j));
             offset++;
         }
     }
diff --git a/src/sig/sphincs/pqclean_sphincs-shake-256s-simple_aarch64/fors.c b/src/sig/sphincs/pqclean_sphincs-shake-256s-simple_aarch64/fors.c
index 39193d04e2..e5ef891ac1 100644
--- a/src/sig/sphincs/pqclean_sphincs-shake-256s-simple_aarch64/fors.c
+++ b/src/sig/sphincs/pqclean_sphincs-shake-256s-simple_aarch64/fors.c
@@ -86,7 +86,7 @@ static void message_to_indices(uint32_t *indices, const unsigned char *m) {
     for (i = 0; i < SPX_FORS_TREES; i++) {
         indices[i] = 0;
         for (j = 0; j < SPX_FORS_HEIGHT; j++) {
-            indices[i] ^= (uint32_t)(((m[offset >> 3] >> (offset & 0x7)) & 0x1) << j);
+            indices[i] ^= (uint32_t)(((m[offset >> 3] >> (~offset & 0x7)) & 0x1) << (SPX_FORS_HEIGHT-1-j));
             offset++;
         }
     }
diff --git a/src/sig/sphincs/pqclean_sphincs-shake-256s-simple_avx2/fors.c b/src/sig/sphincs/pqclean_sphincs-shake-256s-simple_avx2/fors.c
index f1b0639cfc..c348c61962 100644
--- a/src/sig/sphincs/pqclean_sphincs-shake-256s-simple_avx2/fors.c
+++ b/src/sig/sphincs/pqclean_sphincs-shake-256s-simple_avx2/fors.c
@@ -97,7 +97,7 @@ static void message_to_indices(uint32_t *indices, const unsigned char *m) {
     for (i = 0; i < SPX_FORS_TREES; i++) {
         indices[i] = 0;
         for (j = 0; j < SPX_FORS_HEIGHT; j++) {
-            indices[i] ^= (uint32_t)(((m[offset >> 3] >> (offset & 0x7)) & 0x1) << j);
+            indices[i] ^= (uint32_t)(((m[offset >> 3] >> (~offset & 0x7)) & 0x1) << (SPX_FORS_HEIGHT-1-j));
             offset++;
         }
     }
diff --git a/src/sig/sphincs/pqclean_sphincs-shake-256s-simple_clean/fors.c b/src/sig/sphincs/pqclean_sphincs-shake-256s-simple_clean/fors.c
index 96ca72e986..a217797718 100644
--- a/src/sig/sphincs/pqclean_sphincs-shake-256s-simple_clean/fors.c
+++ b/src/sig/sphincs/pqclean_sphincs-shake-256s-simple_clean/fors.c
@@ -53,7 +53,7 @@ static void message_to_indices(uint32_t *indices, const unsigned char *m) {
     for (i = 0; i < SPX_FORS_TREES; i++) {
         indices[i] = 0;
         for (j = 0; j < SPX_FORS_HEIGHT; j++) {
-            indices[i] ^= (uint32_t)(((m[offset >> 3] >> (offset & 0x7)) & 0x1) << j);
+            indices[i] ^= (uint32_t)(((m[offset >> 3] >> (~offset & 0x7)) & 0x1) << (SPX_FORS_HEIGHT-1-j));
             offset++;
         }
     }