Merge GH #1594 Add EdDSA/X25519 Wycheproof tests

1 files changed, 193 insertions, 1 deletions

diff --git a/src/tests/data/pubkey/ed25519_verify.vec b/src/tests/data/pubkey/ed25519_verify.vec
index ad918969c..326a92ad3 100644
--- a/src/tests/data/pubkey/ed25519_verify.vec
+++ b/src/tests/data/pubkey/ed25519_verify.vec
@@ -1,7 +1,199 @@
 [Pure]
 
+Valid = 0
+
 # OSS-Fuzz #7156
 Pubkey = 29A5670182010000000000002007643AE1720EF35AA223252F021A68F707511A
 Msg = 30820143A0030201020209009C28A1A9B4502044300506032B65703045310B30090603550406130241553113301106035504080C0A536F6D652D53746174653121301F060355040A0C18496E7465726E6574205769646769747320507479204C7464301E170D3134303432333233323135375A170D3134303532333233323135375A3045310B30090603550406130241553113301106035504080C0A536F6D652D53746174653121301F060355040A0C18496E7465726E6574205769646769747320507479204C7464302A300506032B657003210029A5670182010000000000002007643AE1720EF35AA223252F021A68F707511AA350304E301D060362E3E704160414A29B7B795F9F24ADAFDDA87A40F526963D7FFBB5301F0603555F2304183016821421EC7B795F9F1F000000A87AC0F53D7FB5963FFB300C0603551DAA040530030101FF
-Valid = 0
 Signature = 6EFA4FC58BA3BCF7C51598710C8D7182857E28C06D8C310BB5090603550406132020202020202020202020202020202020202020202020202020202020202016
+
+# Wycheproof invalid tests
+# (Valid tests are test in both sign and verify direction)
+
+# Test 10 (special values for r and s)
+Pubkey = 7d4d0e7f6153a69b6242b522abbee685fda4420f8834b108c3bdae369ef549fa
+Msg = 3f
+Valid = 0
+Signature = 00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
+
+# Test 11 (special values for r and s)
+Signature = 00000000000000000000000000000000000000000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000
+
+# Test 12 (special values for r and s)
+Signature = 0000000000000000000000000000000000000000000000000000000000000000ecd3f55c1a631258d69cf7a2def9de1400000000000000000000000000000010
+
+# Test 13 (special values for r and s)
+Signature = 0000000000000000000000000000000000000000000000000000000000000000edd3f55c1a631258d69cf7a2def9de1400000000000000000000000000000010
+
+# Test 14 (special values for r and s)
+Signature = 0000000000000000000000000000000000000000000000000000000000000000edffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff7f
+
+# Test 15 (special values for r and s)
+Signature = 01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
+
+# Test 16 (special values for r and s)
+Signature = 01000000000000000000000000000000000000000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000
+
+# Test 17 (special values for r and s)
+Signature = 0100000000000000000000000000000000000000000000000000000000000000ecd3f55c1a631258d69cf7a2def9de1400000000000000000000000000000010
+
+# Test 18 (special values for r and s)
+Signature = 0100000000000000000000000000000000000000000000000000000000000000edd3f55c1a631258d69cf7a2def9de1400000000000000000000000000000010
+
+# Test 19 (special values for r and s)
+Signature = 0100000000000000000000000000000000000000000000000000000000000000edffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff7f
+
+# Test 20 (special values for r and s)
+Signature = edd3f55c1a631258d69cf7a2def9de14000000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000000
+
+# Test 21 (special values for r and s)
+Signature = edd3f55c1a631258d69cf7a2def9de14000000000000000000000000000000100100000000000000000000000000000000000000000000000000000000000000
+
+# Test 22 (special values for r and s)
+Signature = edd3f55c1a631258d69cf7a2def9de1400000000000000000000000000000010ecd3f55c1a631258d69cf7a2def9de1400000000000000000000000000000010
+
+# Test 23 (special values for r and s)
+Signature = edd3f55c1a631258d69cf7a2def9de1400000000000000000000000000000010edd3f55c1a631258d69cf7a2def9de1400000000000000000000000000000010
+
+# Test 24 (special values for r and s)
+Signature = edd3f55c1a631258d69cf7a2def9de1400000000000000000000000000000010edffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff7f
+
+# Test 25 (special values for r and s)
+Signature = edffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff7f0000000000000000000000000000000000000000000000000000000000000000
+
+# Test 26 (special values for r and s)
+Signature = edffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff7f0100000000000000000000000000000000000000000000000000000000000000
+
+# Test 27 (special values for r and s)
+Signature = edffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff7fecd3f55c1a631258d69cf7a2def9de1400000000000000000000000000000010
+
+# Test 28 (special values for r and s)
+Signature = edffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff7fedd3f55c1a631258d69cf7a2def9de1400000000000000000000000000000010
+
+# Test 29 (special values for r and s)
+Signature = edffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff7fedffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff7f
+
+# Test 30 (empty signature)
+Msg = 54657374
+Signature = 
+
+# Test 31 (s missing)
+Signature = 7c38e026f29e14aabd059a0f2db8b0cd783040609a8be684db12f82a27774ab0
+
+# Test 32 (signature too short)
+Signature = 7c38e026f29e14aabd059a0f2db8b0cd783040609a8be684db12f82a27774ab07a9155711ecfaf7f99f277bad0c6ae7e39d4eef676573336a5c51eb6f946
+
+# Test 33 (signature too long)
+Signature = 7c38e026f29e14aabd059a0f2db8b0cd783040609a8be684db12f82a27774ab07a9155711ecfaf7f99f277bad0c6ae7e39d4eef676573336a5c51eb6f946b30d2020
+
+# Test 34 (include pk in signature)
+Signature = 7c38e026f29e14aabd059a0f2db8b0cd783040609a8be684db12f82a27774ab07a9155711ecfaf7f99f277bad0c6ae7e39d4eef676573336a5c51eb6f946b30d7d4d0e7f6153a69b6242b522abbee685fda4420f8834b108c3bdae369ef549fa
+
+# Test 35 (prepending 0 byte to signature)
+Signature = 007c38e026f29e14aabd059a0f2db8b0cd783040609a8be684db12f82a27774ab07a9155711ecfaf7f99f277bad0c6ae7e39d4eef676573336a5c51eb6f946b30d
+
+# Test 36 (prepending 0 byte to s)
+Signature = 7c38e026f29e14aabd059a0f2db8b0cd783040609a8be684db12f82a27774ab0007a9155711ecfaf7f99f277bad0c6ae7e39d4eef676573336a5c51eb6f946b30d
+
+# Test 37 (appending 0 byte to signature)
+Signature = 7c38e026f29e14aabd059a0f2db8b0cd783040609a8be684db12f82a27774ab07a9155711ecfaf7f99f277bad0c6ae7e39d4eef676573336a5c51eb6f946b30d00
+
+# Test 38 (removing 0 byte from signature)
+Msg = 54657374313236
+Signature = 7c38e026f29e14aabd059a0f2db8b0cd783040609a8be684db12f82a27774ab09155711ecfaf7f99f277bad0c6ae7e39d4eef676573336a5c51eb6f946b30d
+
+# Test 39 (removing 0 byte from signature)
+Msg = 546573743137
+Signature = 7c38e026f29e14aabd059a0f2db8b0cd783040609a8be684db12f82a27774ab07a9155711ecfaf7f99f277bad0c6ae7e39d4eef676573336a5c51eb6f946b3
+
+# Test 40 (modified bit 0 in R)
+Msg = 313233343030
+Signature = 647c1492402ab5ce03e2c3a7f0384d051b9cf3570f1207fc78c1bcc98c281c2b1d125e5538f38afbcc1c84e489521083041d24bc6240767029da063271a1ff0c
+
+# Test 41 (modified bit 1 in R)
+Signature = 677c1492402ab5ce03e2c3a7f0384d051b9cf3570f1207fc78c1bcc98c281c2bc108ca4b87a49c9ed2cf383aecad8f54a962b2899da891e12004d7993a627e01
+
+# Test 42 (modified bit 2 in R)
+Signature = 617c1492402ab5ce03e2c3a7f0384d051b9cf3570f1207fc78c1bcc98c281c2b9ce23fc6213ed5b87912e9bbf92f5e2c780eae26d15c50a112d1e97d2ea33c06
+
+# Test 43 (modified bit 7 in R)
+Signature = e57c1492402ab5ce03e2c3a7f0384d051b9cf3570f1207fc78c1bcc98c281c2bbb3eb51cd98dddb235a5f46f2bded6af184a58d09cce928bda43f41d69118a03
+
+# Test 44 (modified bit 8 in R)
+Signature = 657d1492402ab5ce03e2c3a7f0384d051b9cf3570f1207fc78c1bcc98c281c2bcd237dda9a116501f67a5705a854b9adc304f34720803a91b324f2c13e0f5a09
+
+# Test 45 (modified bit 16 in R)
+Signature = 657c1592402ab5ce03e2c3a7f0384d051b9cf3570f1207fc78c1bcc98c281c2b6b167bbdc0d881cc04d28905552c1876f3709851abc5007376940cc8a435c300
+
+# Test 46 (modified bit 31 in R)
+Signature = 657c1412402ab5ce03e2c3a7f0384d051b9cf3570f1207fc78c1bcc98c281c2b7fd2ac7da14afffcceeb13f2a0d6b887941cb1a5eb57a52f3cb131a16cce7b0e
+
+# Test 47 (modified bit 32 in R)
+Signature = 657c1492412ab5ce03e2c3a7f0384d051b9cf3570f1207fc78c1bcc98c281c2b7373ba13ebbef99cd2a8ead55ce735c987d85a35320925a8e871702dc7c5c40d
+
+# Test 48 (modified bit 63 in R)
+Signature = 657c1492402ab54e03e2c3a7f0384d051b9cf3570f1207fc78c1bcc98c281c2bd35bd331c03f0855504ca1cab87b83c36a028425a3cf007ede4f4254c261cb00
+
+# Test 49 (modified bit 64 in R)
+Signature = 657c1492402ab5ce02e2c3a7f0384d051b9cf3570f1207fc78c1bcc98c281c2bcb35101f73cf467deac8c1a03b6c3dc35af544132734b7e57ab20c89b2e4750d
+
+# Test 50 (modified bit 97 in R)
+Signature = 657c1492402ab5ce03e2c3a7f2384d051b9cf3570f1207fc78c1bcc98c281c2bb58d2e8878290bff8d3355fdd4ea381924ee578752354eb6dee678ab4011c301
+
+# Test 51 (modified bit 127 in R)
+Signature = 657c1492402ab5ce03e2c3a7f0384d851b9cf3570f1207fc78c1bcc98c281c2bb978c866187ffb1cc7b29a0b4045aefc08768df65717194ff0c6e63f4dea0d02
+
+# Test 52 (modified bit 240 in R)
+Signature = 657c1492402ab5ce03e2c3a7f0384d051b9cf3570f1207fc78c1bcc98c281d2b0576ecf8eaf675f00f3dfbe19f75b83b7607a6c96414f6821af920a2498d0305
+
+# Test 53 (modified bit 247 in R)
+Signature = 657c1492402ab5ce03e2c3a7f0384d051b9cf3570f1207fc78c1bcc98c289c2be5241a345c7b5428054c74b7c382fa10d4a5f1e8f8b79a71d3fdea2254f1ff0e
+
+# Test 54 (modified bit 248 in R)
+Signature = 657c1492402ab5ce03e2c3a7f0384d051b9cf3570f1207fc78c1bcc98c281c2a63950c85cd6dc96364e768de50ff7732b538f8a0b1615d799190ab600849230e
+
+# Test 55 (modified bit 253 in R)
+Signature = 657c1492402ab5ce03e2c3a7f0384d051b9cf3570f1207fc78c1bcc98c281c0b543bd3da0a56a8c9c152f59c9fec12f31fa66434d48b817b30d90cb4efa8b501
+
+# Test 56 (modified bit 254 in R)
+Signature = 657c1492402ab5ce03e2c3a7f0384d051b9cf3570f1207fc78c1bcc98c281c6b8da07efd07a6dafb015ed6a32fe136319a972ffbc341f3a0beae97ccf8136505
+
+# Test 57 (modified bit 255 in R)
+Signature = 657c1492402ab5ce03e2c3a7f0384d051b9cf3570f1207fc78c1bcc98c281cab227aedf259f910f0f3a759a335062665217925d019173b88917eae294f75d40f
+
+# Test 58 (R==0)
+Signature = 0000000000000000000000000000000000000000000000000000000000000000e0b8e7770d51c7a36375d006c5bffd6af43ff54aaf47e4330dc118c71d61ec02
+
+# Test 59 (invalid R)
+Signature = ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff463a1908382e7eb7693acef9884f7cf931a215e0791876be22c631a59881fd0e
+
+# Test 60 (all bits flipped in R)
+Signature = 9a83eb6dbfd54a31fc1d3c580fc7b2fae4630ca8f0edf803873e433673d7e3d40e94254586cb6188c5386c3febed477cb9a6cb29e3979adc4cb27cf5278fb70a
+
+# Test 61 (checking malleability )
+Msg = 54657374
+
+# This signature verifies, but shouldn't: why?
+#Signature = 7c38e026f29e14aabd059a0f2db8b0cd783040609a8be684db12f82a27774ab067654bce3832c2d76f8f6f5dafc08d9339d4eef676573336a5c51eb6f946b31d
+
+# Test 62 (checking malleability )
+Signature = 7c38e026f29e14aabd059a0f2db8b0cd783040609a8be684db12f82a27774ab05439412b5395d42f462c67008eba6ca839d4eef676573336a5c51eb6f946b32d
+
+# Test 63 (checking malleability )
+Signature = 7c38e026f29e14aabd059a0f2db8b0cd783040609a8be684db12f82a27774ab02ee12ce5875bf9dff26556464bae2ad239d4eef676573336a5c51eb6f946b34d
+
+# Test 64 (checking malleability )
+Signature = 7c38e026f29e14aabd059a0f2db8b0cd783040609a8be684db12f82a27774ab0e2300459f1e742404cd934d2c595a6253ad4eef676573336a5c51eb6f946b38d
+
+# Test 65 (checking malleability )
+Signature = 7c38e026f29e14aabd059a0f2db8b0cd783040609a8be684db12f82a27774ab07a9155711ecfaf7f99f277bad0c6ae7e39d4eef676573336a5c51eb6f946b32d
+
+# Test 66 (checking malleability )
+Signature = 7c38e026f29e14aabd059a0f2db8b0cd783040609a8be684db12f82a27774ab07a9155711ecfaf7f99f277bad0c6ae7e39d4eef676573336a5c51eb6f946b34d
+
+# Test 67 (checking malleability )
+Signature = 7c38e026f29e14aabd059a0f2db8b0cd783040609a8be684db12f82a27774ab07a9155711ecfaf7f99f277bad0c6ae7e39d4eef676573336a5c51eb6f946b38d
+
+# Test 68 (checking malleability )
+Signature = 7c38e026f29e14aabd059a0f2db8b0cd783040609a8be684db12f82a27774ab0679155711ecfaf7f99f277bad0c6ae7e39d4eef676573336a5c51eb6f946b38d
+