PRCYCoin  2.0.0.7rc1
P2P Digital Currency
tests.c
Go to the documentation of this file.
1 /**********************************************************************
2  * Copyright (c) 2013-2015 Pieter Wuille, Gregory Maxwell *
3  * Distributed under the MIT software license, see the accompanying *
4  * file COPYING or http://www.opensource.org/licenses/mit-license.php.*
5  **********************************************************************/
6 
7 #if defined HAVE_CONFIG_H
8 #include "libsecp256k1-config.h"
9 #endif
10 
11 #include <stdio.h>
12 #include <stdlib.h>
13 #include <string.h>
14 
15 #include <time.h>
16 
17 #include "secp256k1_2.c"
18 #include "include/secp256k1_2.h"
19 #include "testrand_impl.h"
20 
21 #ifdef ENABLE_OPENSSL_TESTS
22 #include "openssl/bn.h"
23 #include "openssl/ec.h"
24 #include "openssl/ecdsa.h"
25 #include "openssl/obj_mac.h"
26 # if OPENSSL_VERSION_NUMBER < 0x10100000L
27 void ECDSA_SIG_get0(const ECDSA_SIG *sig, const BIGNUM **pr, const BIGNUM **ps) {*pr = sig->r; *ps = sig->s;}
28 # endif
29 #endif
30 
31 #include "contrib/lax_der_parsing.c"
32 #include "contrib/lax_der_privatekey_parsing.c"
33 
34 #if !defined(VG_CHECK)
35 # if defined(VALGRIND)
36 # include <valgrind/memcheck.h>
37 # define VG_UNDEF(x,y) VALGRIND_MAKE_MEM_UNDEFINED((x),(y))
38 # define VG_CHECK(x,y) VALGRIND_CHECK_MEM_IS_DEFINED((x),(y))
39 # else
40 # define VG_UNDEF(x,y)
41 # define VG_CHECK(x,y)
42 # endif
43 #endif
44 
45 static int count = 64;
46 static secp256k1_context2 *ctx = NULL;
47 
48 static void counting_illegal_callback_fn(const char* str, void* data) {
49  /* Dummy callback function that just counts. */
50  int32_t *p;
51  (void)str;
52  p = data;
53  (*p)++;
54 }
55 
56 static void uncounting_illegal_callback_fn(const char* str, void* data) {
57  /* Dummy callback function that just counts (backwards). */
58  int32_t *p;
59  (void)str;
60  p = data;
61  (*p)--;
62 }
63 
64 void random_field_element_test(secp256k1_fe *fe) {
65  do {
66  unsigned char b32[32];
67  secp256k1_rand256_test(b32);
68  if (secp256k1_fe_set_b32(fe, b32)) {
69  break;
70  }
71  } while(1);
72 }
73 
74 void random_field_element_magnitude(secp256k1_fe *fe) {
75  secp256k1_fe zero;
76  int n = secp256k1_rand_int(9);
77  secp256k1_fe_normalize(fe);
78  if (n == 0) {
79  return;
80  }
81  secp256k1_fe_clear(&zero);
82  secp256k1_fe_negate(&zero, &zero, 0);
83  secp256k1_fe_mul_int(&zero, n - 1);
84  secp256k1_fe_add(fe, &zero);
85  VERIFY_CHECK(fe->magnitude == n);
86 }
87 
88 void random_group_element_test(secp256k1_ge *ge) {
89  secp256k1_fe fe;
90  do {
91  random_field_element_test(&fe);
92  if (secp256k1_ge_set_xo_var(ge, &fe, secp256k1_rand_bits(1))) {
93  secp256k1_fe_normalize(&ge->y);
94  break;
95  }
96  } while(1);
97 }
98 
99 void random_group_element_jacobian_test(secp256k1_gej *gej, const secp256k1_ge *ge) {
100  secp256k1_fe z2, z3;
101  do {
102  random_field_element_test(&gej->z);
103  if (!secp256k1_fe_is_zero(&gej->z)) {
104  break;
105  }
106  } while(1);
107  secp256k1_fe_sqr(&z2, &gej->z);
108  secp256k1_fe_mul(&z3, &z2, &gej->z);
109  secp256k1_fe_mul(&gej->x, &ge->x, &z2);
110  secp256k1_fe_mul(&gej->y, &ge->y, &z3);
111  gej->infinity = ge->infinity;
112 }
113 
114 void random_scalar_order_test(secp256k1_scalar *num) {
115  do {
116  unsigned char b32[32];
117  int overflow = 0;
118  secp256k1_rand256_test(b32);
119  secp256k1_scalar_set_b32(num, b32, &overflow);
120  if (overflow || secp256k1_scalar_is_zero(num)) {
121  continue;
122  }
123  break;
124  } while(1);
125 }
126 
127 void random_scalar_order(secp256k1_scalar *num) {
128  do {
129  unsigned char b32[32];
130  int overflow = 0;
131  secp256k1_rand256(b32);
132  secp256k1_scalar_set_b32(num, b32, &overflow);
133  if (overflow || secp256k1_scalar_is_zero(num)) {
134  continue;
135  }
136  break;
137  } while(1);
138 }
139 
140 void run_util_tests(void) {
141  int i;
142  uint64_t r;
143  uint64_t r2;
144  uint64_t r3;
145  int64_t s;
146  CHECK(secp256k1_clz64_var(0) == 64);
147  CHECK(secp256k1_clz64_var(1) == 63);
148  CHECK(secp256k1_clz64_var(2) == 62);
149  CHECK(secp256k1_clz64_var(3) == 62);
150  CHECK(secp256k1_clz64_var(~0ULL) == 0);
151  CHECK(secp256k1_clz64_var((~0ULL) - 1) == 0);
152  CHECK(secp256k1_clz64_var((~0ULL) >> 1) == 1);
153  CHECK(secp256k1_clz64_var((~0ULL) >> 2) == 2);
154  CHECK(secp256k1_sign_and_abs64(&r, INT64_MAX) == 0);
155  CHECK(r == INT64_MAX);
156  CHECK(secp256k1_sign_and_abs64(&r, INT64_MAX - 1) == 0);
157  CHECK(r == INT64_MAX - 1);
158  CHECK(secp256k1_sign_and_abs64(&r, INT64_MIN) == 1);
159  CHECK(r == (uint64_t)INT64_MAX + 1);
160  CHECK(secp256k1_sign_and_abs64(&r, INT64_MIN + 1) == 1);
161  CHECK(r == (uint64_t)INT64_MAX);
162  CHECK(secp256k1_sign_and_abs64(&r, 0) == 0);
163  CHECK(r == 0);
164  CHECK(secp256k1_sign_and_abs64(&r, 1) == 0);
165  CHECK(r == 1);
166  CHECK(secp256k1_sign_and_abs64(&r, -1) == 1);
167  CHECK(r == 1);
168  CHECK(secp256k1_sign_and_abs64(&r, 2) == 0);
169  CHECK(r == 2);
170  CHECK(secp256k1_sign_and_abs64(&r, -2) == 1);
171  CHECK(r == 2);
172  for (i = 0; i < 10; i++) {
173  CHECK(secp256k1_clz64_var((~0ULL) - secp256k1_rand32()) == 0);
174  r = ((uint64_t)secp256k1_rand32() << 32) | secp256k1_rand32();
175  r2 = secp256k1_rands64(0, r);
176  CHECK(r2 <= r);
177  r3 = secp256k1_rands64(r2, r);
178  CHECK((r3 >= r2) && (r3 <= r));
179  r = secp256k1_rands64(0, INT64_MAX);
180  s = (int64_t)r * (secp256k1_rand32()&1?-1:1);
181  CHECK(secp256k1_sign_and_abs64(&r2, s) == (s < 0));
182  CHECK(r2 == r);
183  }
184 }
185 
186 void run_context_tests(void) {
187  secp256k1_pubkey2 pubkey;
188  secp256k1_pubkey2 zero_pubkey;
189  secp256k1_ecdsa_sign2ature2 sig;
190  unsigned char ctmp[32];
191  int32_t ecount;
192  int32_t ecount2;
193  secp256k1_context2 *none = secp256k1_context_create2(SECP256K1_CONTEXT_NONE);
194  secp256k1_context2 *sign = secp256k1_context_create2(SECP256K1_CONTEXT_SIGN);
195  secp256k1_context2 *vrfy = secp256k1_context_create2(SECP256K1_CONTEXT_VERIFY);
196  secp256k1_context2 *both = secp256k1_context_create2(SECP256K1_CONTEXT_SIGN | SECP256K1_CONTEXT_VERIFY);
197 
198  secp256k1_gej pubj;
199  secp256k1_ge pub;
200  secp256k1_scalar msg, key, nonce;
201  secp256k1_scalar sigr, sigs;
202 
203  memset(&zero_pubkey, 0, sizeof(zero_pubkey));
204 
205  ecount = 0;
206  ecount2 = 10;
207  secp256k1_context_set_illegal_callback(vrfy, counting_illegal_callback_fn, &ecount);
208  secp256k1_context_set_illegal_callback(sign, counting_illegal_callback_fn, &ecount2);
209  secp256k1_context_set_error_callback(sign, counting_illegal_callback_fn, NULL);
210  CHECK(vrfy->error_callback.fn != sign->error_callback.fn);
211 
212  /*** clone and destroy all of them to make sure cloning was complete ***/
213  {
214  secp256k1_context2 *ctx_tmp;
215 
216  ctx_tmp = none; none = secp256k1_context_clone(none); secp256k1_context_destroy(ctx_tmp);
217  ctx_tmp = sign; sign = secp256k1_context_clone(sign); secp256k1_context_destroy(ctx_tmp);
218  ctx_tmp = vrfy; vrfy = secp256k1_context_clone(vrfy); secp256k1_context_destroy(ctx_tmp);
219  ctx_tmp = both; both = secp256k1_context_clone(both); secp256k1_context_destroy(ctx_tmp);
220  }
221 
222  /* Verify that the error callback makes it across the clone. */
223  CHECK(vrfy->error_callback.fn != sign->error_callback.fn);
224  /* And that it resets back to default. */
225  secp256k1_context_set_error_callback(sign, NULL, NULL);
226  CHECK(vrfy->error_callback.fn == sign->error_callback.fn);
227 
228  /*** attempt to use them ***/
229  random_scalar_order_test(&msg);
230  random_scalar_order_test(&key);
231  secp256k1_ecmult_gen(&both->ecmult_gen_ctx, &pubj, &key);
232  secp256k1_ge_set_gej(&pub, &pubj);
233 
234  /* Verify context-type checking illegal-argument errors. */
235  memset(ctmp, 1, 32);
236  CHECK(secp256k1_ec_pubkey_create2(vrfy, &pubkey, ctmp) == 0);
237  CHECK(ecount == 1);
238  VG_UNDEF(&pubkey, sizeof(pubkey));
239  CHECK(secp256k1_ec_pubkey_create2(sign, &pubkey, ctmp) == 1);
240  VG_CHECK(&pubkey, sizeof(pubkey));
241  CHECK(secp256k1_ecdsa_sign2(vrfy, &sig, ctmp, ctmp, NULL, NULL) == 0);
242  CHECK(ecount == 2);
243  VG_UNDEF(&sig, sizeof(sig));
244  CHECK(secp256k1_ecdsa_sign2(sign, &sig, ctmp, ctmp, NULL, NULL) == 1);
245  VG_CHECK(&sig, sizeof(sig));
246  CHECK(ecount2 == 10);
247  CHECK(secp256k1_ecdsa_verify2(sign, &sig, ctmp, &pubkey) == 0);
248  CHECK(ecount2 == 11);
249  CHECK(secp256k1_ecdsa_verify2(vrfy, &sig, ctmp, &pubkey) == 1);
250  CHECK(ecount == 2);
251  CHECK(secp256k1_ec_pubkey_tweak_add2(sign, &pubkey, ctmp) == 0);
252  CHECK(ecount2 == 12);
253  CHECK(secp256k1_ec_pubkey_tweak_add2(vrfy, &pubkey, ctmp) == 1);
254  CHECK(ecount == 2);
255  CHECK(secp256k1_ec_pubkey_tweak_mul2(sign, &pubkey, ctmp) == 0);
256  CHECK(ecount2 == 13);
257  CHECK(secp256k1_ec_pubkey_negate2(vrfy, &pubkey) == 1);
258  CHECK(ecount == 2);
259  CHECK(secp256k1_ec_pubkey_negate2(sign, &pubkey) == 1);
260  CHECK(ecount == 2);
261  CHECK(secp256k1_ec_pubkey_negate2(sign, NULL) == 0);
262  CHECK(ecount2 == 14);
263  CHECK(secp256k1_ec_pubkey_negate2(vrfy, &zero_pubkey) == 0);
264  CHECK(ecount == 3);
265  CHECK(secp256k1_ec_pubkey_tweak_mul2(vrfy, &pubkey, ctmp) == 1);
266  CHECK(ecount == 3);
267  CHECK(secp256k1_context_randomize2(vrfy, ctmp) == 0);
268  CHECK(ecount == 4);
269  CHECK(secp256k1_context_randomize2(sign, NULL) == 1);
270  CHECK(ecount2 == 14);
271  secp256k1_context_set_illegal_callback(vrfy, NULL, NULL);
272  secp256k1_context_set_illegal_callback(sign, NULL, NULL);
273 
274  /* This shouldn't leak memory, due to already-set tests. */
275  secp256k1_ecmult_gen_context_build(&sign->ecmult_gen_ctx, NULL);
276  secp256k1_ecmult_context_build(&vrfy->ecmult_ctx, NULL);
277 
278  /* obtain a working nonce */
279  do {
280  random_scalar_order_test(&nonce);
281  } while(!secp256k1_ecdsa_sig_sign(&both->ecmult_gen_ctx, &sigr, &sigs, &key, &msg, &nonce, NULL));
282 
283  /* try signing */
284  CHECK(secp256k1_ecdsa_sig_sign(&sign->ecmult_gen_ctx, &sigr, &sigs, &key, &msg, &nonce, NULL));
285  CHECK(secp256k1_ecdsa_sig_sign(&both->ecmult_gen_ctx, &sigr, &sigs, &key, &msg, &nonce, NULL));
286 
287  /* try verifying */
288  CHECK(secp256k1_ecdsa_sig_verify(&vrfy->ecmult_ctx, &sigr, &sigs, &pub, &msg));
289  CHECK(secp256k1_ecdsa_sig_verify(&both->ecmult_ctx, &sigr, &sigs, &pub, &msg));
290 
291  /* cleanup */
292  secp256k1_context_destroy(none);
293  secp256k1_context_destroy(sign);
294  secp256k1_context_destroy(vrfy);
295  secp256k1_context_destroy(both);
296  /* Defined as no-op. */
297  secp256k1_context_destroy(NULL);
298 }
299 
300 void run_scratch_tests(void) {
301  int32_t ecount = 0;
302  secp256k1_context2 *none = secp256k1_context_create2(SECP256K1_CONTEXT_NONE);
303  secp256k1_scratch_space2 *scratch;
304 
305  /* Test public API */
306  secp256k1_context_set_illegal_callback(none, counting_illegal_callback_fn, &ecount);
307 
308  scratch = secp256k1_scratch_space_create(none, 1000);
309  CHECK(scratch != NULL);
310  CHECK(ecount == 0);
311 
312  /* Test internal API */
313  CHECK(secp256k1_scratch_max_allocation(scratch, 0) == 1000);
314  CHECK(secp256k1_scratch_max_allocation(scratch, 1) < 1000);
315 
316  /* Allocating 500 bytes with no frame fails */
317  CHECK(secp256k1_scratch_alloc(scratch, 500) == NULL);
318  CHECK(secp256k1_scratch_max_allocation(scratch, 0) == 1000);
319 
320  /* ...but pushing a new stack frame does affect the max allocation */
321  CHECK(secp256k1_scratch_allocate_frame(scratch, 500, 1 == 1));
322  CHECK(secp256k1_scratch_max_allocation(scratch, 1) < 500); /* 500 - ALIGNMENT */
323  CHECK(secp256k1_scratch_alloc(scratch, 500) != NULL);
324  CHECK(secp256k1_scratch_alloc(scratch, 500) == NULL);
325 
326  CHECK(secp256k1_scratch_allocate_frame(scratch, 500, 1) == 0);
327 
328  /* ...and this effect is undone by popping the frame */
329  secp256k1_scratch_deallocate_frame(scratch);
330  CHECK(secp256k1_scratch_max_allocation(scratch, 0) == 1000);
331  CHECK(secp256k1_scratch_alloc(scratch, 500) == NULL);
332 
333  /* cleanup */
334  secp256k1_scratch_space_destroy(scratch);
335  secp256k1_context_destroy(none);
336 }
337 
338 /***** HASH TESTS *****/
339 
340 void run_sha256_tests(void) {
341  static const char *inputs[8] = {
342  "", "abc", "message digest", "secure hash algorithm", "SHA256 is considered to be safe",
343  "abcdbcdecdefdefgefghfghighijhijkijkljklmklmnlmnomnopnopq",
344  "For this sample, this 63-byte string will be used as input data",
345  "This is exactly 64 bytes long, not counting the terminating byte"
346  };
347  static const unsigned char outputs[8][32] = {
348  {0xe3, 0xb0, 0xc4, 0x42, 0x98, 0xfc, 0x1c, 0x14, 0x9a, 0xfb, 0xf4, 0xc8, 0x99, 0x6f, 0xb9, 0x24, 0x27, 0xae, 0x41, 0xe4, 0x64, 0x9b, 0x93, 0x4c, 0xa4, 0x95, 0x99, 0x1b, 0x78, 0x52, 0xb8, 0x55},
349  {0xba, 0x78, 0x16, 0xbf, 0x8f, 0x01, 0xcf, 0xea, 0x41, 0x41, 0x40, 0xde, 0x5d, 0xae, 0x22, 0x23, 0xb0, 0x03, 0x61, 0xa3, 0x96, 0x17, 0x7a, 0x9c, 0xb4, 0x10, 0xff, 0x61, 0xf2, 0x00, 0x15, 0xad},
350  {0xf7, 0x84, 0x6f, 0x55, 0xcf, 0x23, 0xe1, 0x4e, 0xeb, 0xea, 0xb5, 0xb4, 0xe1, 0x55, 0x0c, 0xad, 0x5b, 0x50, 0x9e, 0x33, 0x48, 0xfb, 0xc4, 0xef, 0xa3, 0xa1, 0x41, 0x3d, 0x39, 0x3c, 0xb6, 0x50},
351  {0xf3, 0x0c, 0xeb, 0x2b, 0xb2, 0x82, 0x9e, 0x79, 0xe4, 0xca, 0x97, 0x53, 0xd3, 0x5a, 0x8e, 0xcc, 0x00, 0x26, 0x2d, 0x16, 0x4c, 0xc0, 0x77, 0x08, 0x02, 0x95, 0x38, 0x1c, 0xbd, 0x64, 0x3f, 0x0d},
352  {0x68, 0x19, 0xd9, 0x15, 0xc7, 0x3f, 0x4d, 0x1e, 0x77, 0xe4, 0xe1, 0xb5, 0x2d, 0x1f, 0xa0, 0xf9, 0xcf, 0x9b, 0xea, 0xea, 0xd3, 0x93, 0x9f, 0x15, 0x87, 0x4b, 0xd9, 0x88, 0xe2, 0xa2, 0x36, 0x30},
353  {0x24, 0x8d, 0x6a, 0x61, 0xd2, 0x06, 0x38, 0xb8, 0xe5, 0xc0, 0x26, 0x93, 0x0c, 0x3e, 0x60, 0x39, 0xa3, 0x3c, 0xe4, 0x59, 0x64, 0xff, 0x21, 0x67, 0xf6, 0xec, 0xed, 0xd4, 0x19, 0xdb, 0x06, 0xc1},
354  {0xf0, 0x8a, 0x78, 0xcb, 0xba, 0xee, 0x08, 0x2b, 0x05, 0x2a, 0xe0, 0x70, 0x8f, 0x32, 0xfa, 0x1e, 0x50, 0xc5, 0xc4, 0x21, 0xaa, 0x77, 0x2b, 0xa5, 0xdb, 0xb4, 0x06, 0xa2, 0xea, 0x6b, 0xe3, 0x42},
355  {0xab, 0x64, 0xef, 0xf7, 0xe8, 0x8e, 0x2e, 0x46, 0x16, 0x5e, 0x29, 0xf2, 0xbc, 0xe4, 0x18, 0x26, 0xbd, 0x4c, 0x7b, 0x35, 0x52, 0xf6, 0xb3, 0x82, 0xa9, 0xe7, 0xd3, 0xaf, 0x47, 0xc2, 0x45, 0xf8}
356  };
357  int i;
358  for (i = 0; i < 8; i++) {
359  unsigned char out[32];
360  secp256k1_sha256 hasher;
361  secp256k1_sha256_initialize(&hasher);
362  secp256k1_sha256_write(&hasher, (const unsigned char*)(inputs[i]), strlen(inputs[i]));
363  secp256k1_sha256_finalize(&hasher, out);
364  CHECK(memcmp(out, outputs[i], 32) == 0);
365  if (strlen(inputs[i]) > 0) {
366  int split = secp256k1_rand_int(strlen(inputs[i]));
367  secp256k1_sha256_initialize(&hasher);
368  secp256k1_sha256_write(&hasher, (const unsigned char*)(inputs[i]), split);
369  secp256k1_sha256_write(&hasher, (const unsigned char*)(inputs[i] + split), strlen(inputs[i]) - split);
370  secp256k1_sha256_finalize(&hasher, out);
371  CHECK(memcmp(out, outputs[i], 32) == 0);
372  }
373  }
374 }
375 
376 void run_hmac_sha256_tests(void) {
377  static const char *keys[6] = {
378  "\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b",
379  "\x4a\x65\x66\x65",
380  "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa",
381  "\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19",
382  "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa",
383  "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
384  };
385  static const char *inputs[6] = {
386  "\x48\x69\x20\x54\x68\x65\x72\x65",
387  "\x77\x68\x61\x74\x20\x64\x6f\x20\x79\x61\x20\x77\x61\x6e\x74\x20\x66\x6f\x72\x20\x6e\x6f\x74\x68\x69\x6e\x67\x3f",
388  "\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd",
389  "\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd",
390  "\x54\x65\x73\x74\x20\x55\x73\x69\x6e\x67\x20\x4c\x61\x72\x67\x65\x72\x20\x54\x68\x61\x6e\x20\x42\x6c\x6f\x63\x6b\x2d\x53\x69\x7a\x65\x20\x4b\x65\x79\x20\x2d\x20\x48\x61\x73\x68\x20\x4b\x65\x79\x20\x46\x69\x72\x73\x74",
391  "\x54\x68\x69\x73\x20\x69\x73\x20\x61\x20\x74\x65\x73\x74\x20\x75\x73\x69\x6e\x67\x20\x61\x20\x6c\x61\x72\x67\x65\x72\x20\x74\x68\x61\x6e\x20\x62\x6c\x6f\x63\x6b\x2d\x73\x69\x7a\x65\x20\x6b\x65\x79\x20\x61\x6e\x64\x20\x61\x20\x6c\x61\x72\x67\x65\x72\x20\x74\x68\x61\x6e\x20\x62\x6c\x6f\x63\x6b\x2d\x73\x69\x7a\x65\x20\x64\x61\x74\x61\x2e\x20\x54\x68\x65\x20\x6b\x65\x79\x20\x6e\x65\x65\x64\x73\x20\x74\x6f\x20\x62\x65\x20\x68\x61\x73\x68\x65\x64\x20\x62\x65\x66\x6f\x72\x65\x20\x62\x65\x69\x6e\x67\x20\x75\x73\x65\x64\x20\x62\x79\x20\x74\x68\x65\x20\x48\x4d\x41\x43\x20\x61\x6c\x67\x6f\x72\x69\x74\x68\x6d\x2e"
392  };
393  static const unsigned char outputs[6][32] = {
394  {0xb0, 0x34, 0x4c, 0x61, 0xd8, 0xdb, 0x38, 0x53, 0x5c, 0xa8, 0xaf, 0xce, 0xaf, 0x0b, 0xf1, 0x2b, 0x88, 0x1d, 0xc2, 0x00, 0xc9, 0x83, 0x3d, 0xa7, 0x26, 0xe9, 0x37, 0x6c, 0x2e, 0x32, 0xcf, 0xf7},
395  {0x5b, 0xdc, 0xc1, 0x46, 0xbf, 0x60, 0x75, 0x4e, 0x6a, 0x04, 0x24, 0x26, 0x08, 0x95, 0x75, 0xc7, 0x5a, 0x00, 0x3f, 0x08, 0x9d, 0x27, 0x39, 0x83, 0x9d, 0xec, 0x58, 0xb9, 0x64, 0xec, 0x38, 0x43},
396  {0x77, 0x3e, 0xa9, 0x1e, 0x36, 0x80, 0x0e, 0x46, 0x85, 0x4d, 0xb8, 0xeb, 0xd0, 0x91, 0x81, 0xa7, 0x29, 0x59, 0x09, 0x8b, 0x3e, 0xf8, 0xc1, 0x22, 0xd9, 0x63, 0x55, 0x14, 0xce, 0xd5, 0x65, 0xfe},
397  {0x82, 0x55, 0x8a, 0x38, 0x9a, 0x44, 0x3c, 0x0e, 0xa4, 0xcc, 0x81, 0x98, 0x99, 0xf2, 0x08, 0x3a, 0x85, 0xf0, 0xfa, 0xa3, 0xe5, 0x78, 0xf8, 0x07, 0x7a, 0x2e, 0x3f, 0xf4, 0x67, 0x29, 0x66, 0x5b},
398  {0x60, 0xe4, 0x31, 0x59, 0x1e, 0xe0, 0xb6, 0x7f, 0x0d, 0x8a, 0x26, 0xaa, 0xcb, 0xf5, 0xb7, 0x7f, 0x8e, 0x0b, 0xc6, 0x21, 0x37, 0x28, 0xc5, 0x14, 0x05, 0x46, 0x04, 0x0f, 0x0e, 0xe3, 0x7f, 0x54},
399  {0x9b, 0x09, 0xff, 0xa7, 0x1b, 0x94, 0x2f, 0xcb, 0x27, 0x63, 0x5f, 0xbc, 0xd5, 0xb0, 0xe9, 0x44, 0xbf, 0xdc, 0x63, 0x64, 0x4f, 0x07, 0x13, 0x93, 0x8a, 0x7f, 0x51, 0x53, 0x5c, 0x3a, 0x35, 0xe2}
400  };
401  int i;
402  for (i = 0; i < 6; i++) {
403  secp256k1_hmac_sha256 hasher;
404  unsigned char out[32];
405  secp256k1_hmac_sha256_initialize(&hasher, (const unsigned char*)(keys[i]), strlen(keys[i]));
406  secp256k1_hmac_sha256_write(&hasher, (const unsigned char*)(inputs[i]), strlen(inputs[i]));
407  secp256k1_hmac_sha256_finalize(&hasher, out);
408  CHECK(memcmp(out, outputs[i], 32) == 0);
409  if (strlen(inputs[i]) > 0) {
410  int split = secp256k1_rand_int(strlen(inputs[i]));
411  secp256k1_hmac_sha256_initialize(&hasher, (const unsigned char*)(keys[i]), strlen(keys[i]));
412  secp256k1_hmac_sha256_write(&hasher, (const unsigned char*)(inputs[i]), split);
413  secp256k1_hmac_sha256_write(&hasher, (const unsigned char*)(inputs[i] + split), strlen(inputs[i]) - split);
414  secp256k1_hmac_sha256_finalize(&hasher, out);
415  CHECK(memcmp(out, outputs[i], 32) == 0);
416  }
417  }
418 }
419 
420 void run_rfc6979_hmac_sha256_tests(void) {
421  static const unsigned char key1[65] = {0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f, 0x10, 0x11, 0x12, 0x13, 0x14, 0x15, 0x16, 0x17, 0x18, 0x19, 0x1a, 0x1b, 0x1c, 0x1d, 0x1e, 0x1f, 0x00, 0x4b, 0xf5, 0x12, 0x2f, 0x34, 0x45, 0x54, 0xc5, 0x3b, 0xde, 0x2e, 0xbb, 0x8c, 0xd2, 0xb7, 0xe3, 0xd1, 0x60, 0x0a, 0xd6, 0x31, 0xc3, 0x85, 0xa5, 0xd7, 0xcc, 0xe2, 0x3c, 0x77, 0x85, 0x45, 0x9a, 0};
422  static const unsigned char out1[3][32] = {
423  {0x4f, 0xe2, 0x95, 0x25, 0xb2, 0x08, 0x68, 0x09, 0x15, 0x9a, 0xcd, 0xf0, 0x50, 0x6e, 0xfb, 0x86, 0xb0, 0xec, 0x93, 0x2c, 0x7b, 0xa4, 0x42, 0x56, 0xab, 0x32, 0x1e, 0x42, 0x1e, 0x67, 0xe9, 0xfb},
424  {0x2b, 0xf0, 0xff, 0xf1, 0xd3, 0xc3, 0x78, 0xa2, 0x2d, 0xc5, 0xde, 0x1d, 0x85, 0x65, 0x22, 0x32, 0x5c, 0x65, 0xb5, 0x04, 0x49, 0x1a, 0x0c, 0xbd, 0x01, 0xcb, 0x8f, 0x3a, 0xa6, 0x7f, 0xfd, 0x4a},
425  {0xf5, 0x28, 0xb4, 0x10, 0xcb, 0x54, 0x1f, 0x77, 0x00, 0x0d, 0x7a, 0xfb, 0x6c, 0x5b, 0x53, 0xc5, 0xc4, 0x71, 0xea, 0xb4, 0x3e, 0x46, 0x6d, 0x9a, 0xc5, 0x19, 0x0c, 0x39, 0xc8, 0x2f, 0xd8, 0x2e}
426  };
427 
428  static const unsigned char key2[64] = {0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xe3, 0xb0, 0xc4, 0x42, 0x98, 0xfc, 0x1c, 0x14, 0x9a, 0xfb, 0xf4, 0xc8, 0x99, 0x6f, 0xb9, 0x24, 0x27, 0xae, 0x41, 0xe4, 0x64, 0x9b, 0x93, 0x4c, 0xa4, 0x95, 0x99, 0x1b, 0x78, 0x52, 0xb8, 0x55};
429  static const unsigned char out2[3][32] = {
430  {0x9c, 0x23, 0x6c, 0x16, 0x5b, 0x82, 0xae, 0x0c, 0xd5, 0x90, 0x65, 0x9e, 0x10, 0x0b, 0x6b, 0xab, 0x30, 0x36, 0xe7, 0xba, 0x8b, 0x06, 0x74, 0x9b, 0xaf, 0x69, 0x81, 0xe1, 0x6f, 0x1a, 0x2b, 0x95},
431  {0xdf, 0x47, 0x10, 0x61, 0x62, 0x5b, 0xc0, 0xea, 0x14, 0xb6, 0x82, 0xfe, 0xee, 0x2c, 0x9c, 0x02, 0xf2, 0x35, 0xda, 0x04, 0x20, 0x4c, 0x1d, 0x62, 0xa1, 0x53, 0x6c, 0x6e, 0x17, 0xae, 0xd7, 0xa9},
432  {0x75, 0x97, 0x88, 0x7c, 0xbd, 0x76, 0x32, 0x1f, 0x32, 0xe3, 0x04, 0x40, 0x67, 0x9a, 0x22, 0xcf, 0x7f, 0x8d, 0x9d, 0x2e, 0xac, 0x39, 0x0e, 0x58, 0x1f, 0xea, 0x09, 0x1c, 0xe2, 0x02, 0xba, 0x94}
433  };
434 
435  secp256k1_rfc6979_hmac_sha256 rng;
436  unsigned char out[32];
437  int i;
438 
439  secp256k1_rfc6979_hmac_sha256_initialize(&rng, key1, 64);
440  for (i = 0; i < 3; i++) {
441  secp256k1_rfc6979_hmac_sha256_generate(&rng, out, 32);
442  CHECK(memcmp(out, out1[i], 32) == 0);
443  }
444  secp256k1_rfc6979_hmac_sha256_finalize(&rng);
445 
446  secp256k1_rfc6979_hmac_sha256_initialize(&rng, key1, 65);
447  for (i = 0; i < 3; i++) {
448  secp256k1_rfc6979_hmac_sha256_generate(&rng, out, 32);
449  CHECK(memcmp(out, out1[i], 32) != 0);
450  }
451  secp256k1_rfc6979_hmac_sha256_finalize(&rng);
452 
453  secp256k1_rfc6979_hmac_sha256_initialize(&rng, key2, 64);
454  for (i = 0; i < 3; i++) {
455  secp256k1_rfc6979_hmac_sha256_generate(&rng, out, 32);
456  CHECK(memcmp(out, out2[i], 32) == 0);
457  }
458  secp256k1_rfc6979_hmac_sha256_finalize(&rng);
459 }
460 
461 /***** RANDOM TESTS *****/
462 
463 void test_rand_bits(int rand32, int bits) {
464  /* (1-1/2^B)^rounds[B] < 1/10^9, so rounds is the number of iterations to
465  * get a false negative chance below once in a billion */
466  static const unsigned int rounds[7] = {1, 30, 73, 156, 322, 653, 1316};
467  /* We try multiplying the results with various odd numbers, which shouldn't
468  * influence the uniform distribution modulo a power of 2. */
469  static const uint32_t mults[6] = {1, 3, 21, 289, 0x9999, 0x80402011};
470  /* We only select up to 6 bits from the output to analyse */
471  unsigned int usebits = bits > 6 ? 6 : bits;
472  unsigned int maxshift = bits - usebits;
473  /* For each of the maxshift+1 usebits-bit sequences inside a bits-bit
474  number, track all observed outcomes, one per bit in a uint64_t. */
475  uint64_t x[6][27] = {{0}};
476  unsigned int i, shift, m;
477  /* Multiply the output of all rand calls with the odd number m, which
478  should not change the uniformity of its distribution. */
479  for (i = 0; i < rounds[usebits]; i++) {
480  uint32_t r = (rand32 ? secp256k1_rand32() : secp256k1_rand_bits(bits));
481  CHECK((((uint64_t)r) >> bits) == 0);
482  for (m = 0; m < sizeof(mults) / sizeof(mults[0]); m++) {
483  uint32_t rm = r * mults[m];
484  for (shift = 0; shift <= maxshift; shift++) {
485  x[m][shift] |= (((uint64_t)1) << ((rm >> shift) & ((1 << usebits) - 1)));
486  }
487  }
488  }
489  for (m = 0; m < sizeof(mults) / sizeof(mults[0]); m++) {
490  for (shift = 0; shift <= maxshift; shift++) {
491  /* Test that the lower usebits bits of x[shift] are 1 */
492  CHECK(((~x[m][shift]) << (64 - (1 << usebits))) == 0);
493  }
494  }
495 }
496 
497 /* Subrange must be a whole divisor of range, and at most 64 */
498 void test_rand_int(uint32_t range, uint32_t subrange) {
499  /* (1-1/subrange)^rounds < 1/10^9 */
500  int rounds = (subrange * 2073) / 100;
501  int i;
502  uint64_t x = 0;
503  CHECK((range % subrange) == 0);
504  for (i = 0; i < rounds; i++) {
505  uint32_t r = secp256k1_rand_int(range);
506  CHECK(r < range);
507  r = r % subrange;
508  x |= (((uint64_t)1) << r);
509  }
510  /* Test that the lower subrange bits of x are 1. */
511  CHECK(((~x) << (64 - subrange)) == 0);
512 }
513 
514 void run_rand_bits(void) {
515  size_t b;
516  test_rand_bits(1, 32);
517  for (b = 1; b <= 32; b++) {
518  test_rand_bits(0, b);
519  }
520 }
521 
522 void run_rand_int(void) {
523  static const uint32_t ms[] = {1, 3, 17, 1000, 13771, 999999, 33554432};
524  static const uint32_t ss[] = {1, 3, 6, 9, 13, 31, 64};
525  unsigned int m, s;
526  for (m = 0; m < sizeof(ms) / sizeof(ms[0]); m++) {
527  for (s = 0; s < sizeof(ss) / sizeof(ss[0]); s++) {
528  test_rand_int(ms[m] * ss[s], ss[s]);
529  }
530  }
531 }
532 
533 /***** NUM TESTS *****/
534 
535 #ifndef USE_NUM_NONE
536 void random_num_negate(secp256k1_num *num) {
537  if (secp256k1_rand_bits(1)) {
538  secp256k1_num_negate(num);
539  }
540 }
541 
542 void random_num_order_test(secp256k1_num *num) {
543  secp256k1_scalar sc;
544  random_scalar_order_test(&sc);
545  secp256k1_scalar_get_num(num, &sc);
546 }
547 
548 void random_num_order(secp256k1_num *num) {
549  secp256k1_scalar sc;
550  random_scalar_order(&sc);
551  secp256k1_scalar_get_num(num, &sc);
552 }
553 
554 void test_num_negate(void) {
555  secp256k1_num n1;
556  secp256k1_num n2;
557  random_num_order_test(&n1); /* n1 = R */
558  random_num_negate(&n1);
559  secp256k1_num_copy(&n2, &n1); /* n2 = R */
560  secp256k1_num_sub(&n1, &n2, &n1); /* n1 = n2-n1 = 0 */
561  CHECK(secp256k1_num_is_zero(&n1));
562  secp256k1_num_copy(&n1, &n2); /* n1 = R */
563  secp256k1_num_negate(&n1); /* n1 = -R */
564  CHECK(!secp256k1_num_is_zero(&n1));
565  secp256k1_num_add(&n1, &n2, &n1); /* n1 = n2+n1 = 0 */
566  CHECK(secp256k1_num_is_zero(&n1));
567  secp256k1_num_copy(&n1, &n2); /* n1 = R */
568  secp256k1_num_negate(&n1); /* n1 = -R */
569  CHECK(secp256k1_num_is_neg(&n1) != secp256k1_num_is_neg(&n2));
570  secp256k1_num_negate(&n1); /* n1 = R */
571  CHECK(secp256k1_num_eq(&n1, &n2));
572 }
573 
574 void test_num_add_sub(void) {
575  int i;
576  secp256k1_scalar s;
577  secp256k1_num n1;
578  secp256k1_num n2;
579  secp256k1_num n1p2, n2p1, n1m2, n2m1;
580  random_num_order_test(&n1); /* n1 = R1 */
581  if (secp256k1_rand_bits(1)) {
582  random_num_negate(&n1);
583  }
584  random_num_order_test(&n2); /* n2 = R2 */
585  if (secp256k1_rand_bits(1)) {
586  random_num_negate(&n2);
587  }
588  secp256k1_num_add(&n1p2, &n1, &n2); /* n1p2 = R1 + R2 */
589  secp256k1_num_add(&n2p1, &n2, &n1); /* n2p1 = R2 + R1 */
590  secp256k1_num_sub(&n1m2, &n1, &n2); /* n1m2 = R1 - R2 */
591  secp256k1_num_sub(&n2m1, &n2, &n1); /* n2m1 = R2 - R1 */
592  CHECK(secp256k1_num_eq(&n1p2, &n2p1));
593  CHECK(!secp256k1_num_eq(&n1p2, &n1m2));
594  secp256k1_num_negate(&n2m1); /* n2m1 = -R2 + R1 */
595  CHECK(secp256k1_num_eq(&n2m1, &n1m2));
596  CHECK(!secp256k1_num_eq(&n2m1, &n1));
597  secp256k1_num_add(&n2m1, &n2m1, &n2); /* n2m1 = -R2 + R1 + R2 = R1 */
598  CHECK(secp256k1_num_eq(&n2m1, &n1));
599  CHECK(!secp256k1_num_eq(&n2p1, &n1));
600  secp256k1_num_sub(&n2p1, &n2p1, &n2); /* n2p1 = R2 + R1 - R2 = R1 */
601  CHECK(secp256k1_num_eq(&n2p1, &n1));
602 
603  /* check is_one */
604  secp256k1_scalar_set_int(&s, 1);
605  secp256k1_scalar_get_num(&n1, &s);
606  CHECK(secp256k1_num_is_one(&n1));
607  /* check that 2^n + 1 is never 1 */
608  secp256k1_scalar_get_num(&n2, &s);
609  for (i = 0; i < 250; ++i) {
610  secp256k1_num_add(&n1, &n1, &n1); /* n1 *= 2 */
611  secp256k1_num_add(&n1p2, &n1, &n2); /* n1p2 = n1 + 1 */
612  CHECK(!secp256k1_num_is_one(&n1p2));
613  }
614 }
615 
616 void test_num_mod(void) {
617  int i;
618  secp256k1_scalar s;
619  secp256k1_num order, n;
620 
621  /* check that 0 mod anything is 0 */
622  random_scalar_order_test(&s);
623  secp256k1_scalar_get_num(&order, &s);
624  secp256k1_scalar_set_int(&s, 0);
625  secp256k1_scalar_get_num(&n, &s);
626  secp256k1_num_mod(&n, &order);
627  CHECK(secp256k1_num_is_zero(&n));
628 
629  /* check that anything mod 1 is 0 */
630  secp256k1_scalar_set_int(&s, 1);
631  secp256k1_scalar_get_num(&order, &s);
632  secp256k1_scalar_get_num(&n, &s);
633  secp256k1_num_mod(&n, &order);
634  CHECK(secp256k1_num_is_zero(&n));
635 
636  /* check that increasing the number past 2^256 does not break this */
637  random_scalar_order_test(&s);
638  secp256k1_scalar_get_num(&n, &s);
639  /* multiply by 2^8, which'll test this case with high probability */
640  for (i = 0; i < 8; ++i) {
641  secp256k1_num_add(&n, &n, &n);
642  }
643  secp256k1_num_mod(&n, &order);
644  CHECK(secp256k1_num_is_zero(&n));
645 }
646 
647 void test_num_jacobi(void) {
648  secp256k1_scalar sqr;
649  secp256k1_scalar small;
650  secp256k1_scalar five; /* five is not a quadratic residue */
651  secp256k1_num order, n;
652  int i;
653  /* squares mod 5 are 1, 4 */
654  const int jacobi5[10] = { 0, 1, -1, -1, 1, 0, 1, -1, -1, 1 };
655 
656  /* check some small values with 5 as the order */
657  secp256k1_scalar_set_int(&five, 5);
658  secp256k1_scalar_get_num(&order, &five);
659  for (i = 0; i < 10; ++i) {
660  secp256k1_scalar_set_int(&small, i);
661  secp256k1_scalar_get_num(&n, &small);
662  CHECK(secp256k1_num_jacobi(&n, &order) == jacobi5[i]);
663  }
664 
666  secp256k1_scalar_get_num(&order, &five);
667  /* we first need a scalar which is not a multiple of 5 */
668  do {
669  secp256k1_num fiven;
670  random_scalar_order_test(&sqr);
671  secp256k1_scalar_get_num(&fiven, &five);
672  secp256k1_scalar_get_num(&n, &sqr);
673  secp256k1_num_mod(&n, &fiven);
674  } while (secp256k1_num_is_zero(&n));
675  /* next force it to be a residue. 2 is a nonresidue mod 5 so we can
676  * just multiply by two, i.e. add the number to itself */
677  if (secp256k1_num_jacobi(&n, &order) == -1) {
678  secp256k1_num_add(&n, &n, &n);
679  }
680 
681  /* test residue */
682  CHECK(secp256k1_num_jacobi(&n, &order) == 1);
683  /* test nonresidue */
684  secp256k1_num_add(&n, &n, &n);
685  CHECK(secp256k1_num_jacobi(&n, &order) == -1);
686 
688  secp256k1_scalar_order_get_num(&order);
689  random_scalar_order_test(&sqr);
690  secp256k1_scalar_sqr(&sqr, &sqr);
691  /* test residue */
692  secp256k1_scalar_get_num(&n, &sqr);
693  CHECK(secp256k1_num_jacobi(&n, &order) == 1);
694  /* test nonresidue */
695  secp256k1_scalar_mul(&sqr, &sqr, &five);
696  secp256k1_scalar_get_num(&n, &sqr);
697  CHECK(secp256k1_num_jacobi(&n, &order) == -1);
698  /* test multiple of the order*/
699  CHECK(secp256k1_num_jacobi(&order, &order) == 0);
700 
701  /* check one less than the order */
702  secp256k1_scalar_set_int(&small, 1);
703  secp256k1_scalar_get_num(&n, &small);
704  secp256k1_num_sub(&n, &order, &n);
705  CHECK(secp256k1_num_jacobi(&n, &order) == 1); /* sage confirms this is 1 */
706 }
707 
708 void run_num_smalltests(void) {
709  int i;
710  for (i = 0; i < 100*count; i++) {
711  test_num_negate();
712  test_num_add_sub();
713  test_num_mod();
714  test_num_jacobi();
715  }
716 }
717 #endif
718 
719 /***** SCALAR TESTS *****/
720 
721 void scalar_test(void) {
722  secp256k1_scalar s;
723  secp256k1_scalar s1;
724  secp256k1_scalar s2;
725 #ifndef USE_NUM_NONE
726  secp256k1_num snum, s1num, s2num;
727  secp256k1_num order, half_order;
728 #endif
729  unsigned char c[32];
730 
731  /* Set 's' to a random scalar, with value 'snum'. */
732  random_scalar_order_test(&s);
733 
734  /* Set 's1' to a random scalar, with value 's1num'. */
735  random_scalar_order_test(&s1);
736 
737  /* Set 's2' to a random scalar, with value 'snum2', and byte array representation 'c'. */
738  random_scalar_order_test(&s2);
739  secp256k1_scalar_get_b32(c, &s2);
740 
741 #ifndef USE_NUM_NONE
742  secp256k1_scalar_get_num(&snum, &s);
743  secp256k1_scalar_get_num(&s1num, &s1);
744  secp256k1_scalar_get_num(&s2num, &s2);
745 
746  secp256k1_scalar_order_get_num(&order);
747  half_order = order;
748  secp256k1_num_shift(&half_order, 1);
749 #endif
750 
751  {
752  int i;
753  /* Test that fetching groups of 4 bits from a scalar and recursing n(i)=16*n(i-1)+p(i) reconstructs it. */
754  secp256k1_scalar n;
755  secp256k1_scalar_set_int(&n, 0);
756  for (i = 0; i < 256; i += 4) {
757  secp256k1_scalar t;
758  int j;
759  secp256k1_scalar_set_int(&t, secp256k1_scalar_get_bits(&s, 256 - 4 - i, 4));
760  for (j = 0; j < 4; j++) {
761  secp256k1_scalar_add(&n, &n, &n);
762  }
763  secp256k1_scalar_add(&n, &n, &t);
764  }
765  CHECK(secp256k1_scalar_eq(&n, &s));
766  }
767 
768  {
769  /* Test that fetching groups of randomly-sized bits from a scalar and recursing n(i)=b*n(i-1)+p(i) reconstructs it. */
770  secp256k1_scalar n;
771  int i = 0;
772  secp256k1_scalar_set_int(&n, 0);
773  while (i < 256) {
774  secp256k1_scalar t;
775  int j;
776  int now = secp256k1_rand_int(15) + 1;
777  if (now + i > 256) {
778  now = 256 - i;
779  }
780  secp256k1_scalar_set_int(&t, secp256k1_scalar_get_bits_var(&s, 256 - now - i, now));
781  for (j = 0; j < now; j++) {
782  secp256k1_scalar_add(&n, &n, &n);
783  }
784  secp256k1_scalar_add(&n, &n, &t);
785  i += now;
786  }
787  CHECK(secp256k1_scalar_eq(&n, &s));
788  }
789 
790 #ifndef USE_NUM_NONE
791  {
792  /* Test that adding the scalars together is equal to adding their numbers together modulo the order. */
793  secp256k1_num rnum;
794  secp256k1_num r2num;
795  secp256k1_scalar r;
796  secp256k1_num_add(&rnum, &snum, &s2num);
797  secp256k1_num_mod(&rnum, &order);
798  secp256k1_scalar_add(&r, &s, &s2);
799  secp256k1_scalar_get_num(&r2num, &r);
800  CHECK(secp256k1_num_eq(&rnum, &r2num));
801  }
802 
803  {
804  /* Test that multiplying the scalars is equal to multiplying their numbers modulo the order. */
805  secp256k1_scalar r;
806  secp256k1_num r2num;
807  secp256k1_num rnum;
808  secp256k1_num_mul(&rnum, &snum, &s2num);
809  secp256k1_num_mod(&rnum, &order);
810  secp256k1_scalar_mul(&r, &s, &s2);
811  secp256k1_scalar_get_num(&r2num, &r);
812  CHECK(secp256k1_num_eq(&rnum, &r2num));
813  /* The result can only be zero if at least one of the factors was zero. */
814  CHECK(secp256k1_scalar_is_zero(&r) == (secp256k1_scalar_is_zero(&s) || secp256k1_scalar_is_zero(&s2)));
815  /* The results can only be equal to one of the factors if that factor was zero, or the other factor was one. */
816  CHECK(secp256k1_num_eq(&rnum, &snum) == (secp256k1_scalar_is_zero(&s) || secp256k1_scalar_is_one(&s2)));
817  CHECK(secp256k1_num_eq(&rnum, &s2num) == (secp256k1_scalar_is_zero(&s2) || secp256k1_scalar_is_one(&s)));
818  }
819 
820  {
821  secp256k1_scalar neg;
822  secp256k1_num negnum;
823  secp256k1_num negnum2;
824  /* Check that comparison with zero matches comparison with zero on the number. */
825  CHECK(secp256k1_num_is_zero(&snum) == secp256k1_scalar_is_zero(&s));
826  /* Check that comparison with the half order is equal to testing for high scalar. */
827  CHECK(secp256k1_scalar_is_high(&s) == (secp256k1_num_cmp(&snum, &half_order) > 0));
828  secp256k1_scalar_negate(&neg, &s);
829  secp256k1_num_sub(&negnum, &order, &snum);
830  secp256k1_num_mod(&negnum, &order);
831  /* Check that comparison with the half order is equal to testing for high scalar after negation. */
832  CHECK(secp256k1_scalar_is_high(&neg) == (secp256k1_num_cmp(&negnum, &half_order) > 0));
833  /* Negating should change the high property, unless the value was already zero. */
834  CHECK((secp256k1_scalar_is_high(&s) == secp256k1_scalar_is_high(&neg)) == secp256k1_scalar_is_zero(&s));
835  secp256k1_scalar_get_num(&negnum2, &neg);
836  /* Negating a scalar should be equal to (order - n) mod order on the number. */
837  CHECK(secp256k1_num_eq(&negnum, &negnum2));
838  secp256k1_scalar_add(&neg, &neg, &s);
839  /* Adding a number to its negation should result in zero. */
840  CHECK(secp256k1_scalar_is_zero(&neg));
841  secp256k1_scalar_negate(&neg, &neg);
842  /* Negating zero should still result in zero. */
843  CHECK(secp256k1_scalar_is_zero(&neg));
844  }
845 
846  {
847  /* Test secp256k1_scalar_mul_shift_var. */
848  secp256k1_scalar r;
849  secp256k1_num one;
850  secp256k1_num rnum;
851  secp256k1_num rnum2;
852  unsigned char cone[1] = {0x01};
853  unsigned int shift = 256 + secp256k1_rand_int(257);
854  secp256k1_scalar_mul_shift_var(&r, &s1, &s2, shift);
855  secp256k1_num_mul(&rnum, &s1num, &s2num);
856  secp256k1_num_shift(&rnum, shift - 1);
857  secp256k1_num_set_bin(&one, cone, 1);
858  secp256k1_num_add(&rnum, &rnum, &one);
859  secp256k1_num_shift(&rnum, 1);
860  secp256k1_scalar_get_num(&rnum2, &r);
861  CHECK(secp256k1_num_eq(&rnum, &rnum2));
862  }
863 
864  {
865  /* test secp256k1_scalar_shr_int */
866  secp256k1_scalar r;
867  int i;
868  random_scalar_order_test(&r);
869  for (i = 0; i < 100; ++i) {
870  int low;
871  int shift = 1 + secp256k1_rand_int(15);
872  int expected = r.d[0] % (1 << shift);
873  low = secp256k1_scalar_shr_int(&r, shift);
874  CHECK(expected == low);
875  }
876  }
877 #endif
878 
879  {
880  /* Test that scalar inverses are equal to the inverse of their number modulo the order. */
881  if (!secp256k1_scalar_is_zero(&s)) {
882  secp256k1_scalar inv;
883 #ifndef USE_NUM_NONE
884  secp256k1_num invnum;
885  secp256k1_num invnum2;
886 #endif
887  secp256k1_scalar_inverse(&inv, &s);
888 #ifndef USE_NUM_NONE
889  secp256k1_num_mod_inverse(&invnum, &snum, &order);
890  secp256k1_scalar_get_num(&invnum2, &inv);
891  CHECK(secp256k1_num_eq(&invnum, &invnum2));
892 #endif
893  secp256k1_scalar_mul(&inv, &inv, &s);
894  /* Multiplying a scalar with its inverse must result in one. */
895  CHECK(secp256k1_scalar_is_one(&inv));
896  secp256k1_scalar_inverse(&inv, &inv);
897  /* Inverting one must result in one. */
898  CHECK(secp256k1_scalar_is_one(&inv));
899 #ifndef USE_NUM_NONE
900  secp256k1_scalar_get_num(&invnum, &inv);
901  CHECK(secp256k1_num_is_one(&invnum));
902 #endif
903  }
904  }
905 
906  {
907  /* Test commutativity of add. */
908  secp256k1_scalar r1, r2;
909  secp256k1_scalar_add(&r1, &s1, &s2);
910  secp256k1_scalar_add(&r2, &s2, &s1);
911  CHECK(secp256k1_scalar_eq(&r1, &r2));
912  }
913 
914  {
915  secp256k1_scalar r1, r2;
916  secp256k1_scalar b;
917  int i;
918  /* Test add_bit. */
919  int bit = secp256k1_rand_bits(8);
920  secp256k1_scalar_set_int(&b, 1);
921  CHECK(secp256k1_scalar_is_one(&b));
922  for (i = 0; i < bit; i++) {
923  secp256k1_scalar_add(&b, &b, &b);
924  }
925  r1 = s1;
926  r2 = s1;
927  if (!secp256k1_scalar_add(&r1, &r1, &b)) {
928  /* No overflow happened. */
929  secp256k1_scalar_cadd_bit(&r2, bit, 1);
930  CHECK(secp256k1_scalar_eq(&r1, &r2));
931  /* cadd is a noop when flag is zero */
932  secp256k1_scalar_cadd_bit(&r2, bit, 0);
933  CHECK(secp256k1_scalar_eq(&r1, &r2));
934  }
935  }
936 
937  {
938  /* Test commutativity of mul. */
939  secp256k1_scalar r1, r2;
940  secp256k1_scalar_mul(&r1, &s1, &s2);
941  secp256k1_scalar_mul(&r2, &s2, &s1);
942  CHECK(secp256k1_scalar_eq(&r1, &r2));
943  }
944 
945  {
946  /* Test associativity of add. */
947  secp256k1_scalar r1, r2;
948  secp256k1_scalar_add(&r1, &s1, &s2);
949  secp256k1_scalar_add(&r1, &r1, &s);
950  secp256k1_scalar_add(&r2, &s2, &s);
951  secp256k1_scalar_add(&r2, &s1, &r2);
952  CHECK(secp256k1_scalar_eq(&r1, &r2));
953  }
954 
955  {
956  /* Test associativity of mul. */
957  secp256k1_scalar r1, r2;
958  secp256k1_scalar_mul(&r1, &s1, &s2);
959  secp256k1_scalar_mul(&r1, &r1, &s);
960  secp256k1_scalar_mul(&r2, &s2, &s);
961  secp256k1_scalar_mul(&r2, &s1, &r2);
962  CHECK(secp256k1_scalar_eq(&r1, &r2));
963  }
964 
965  {
966  /* Test distributitivity of mul over add. */
967  secp256k1_scalar r1, r2, t;
968  secp256k1_scalar_add(&r1, &s1, &s2);
969  secp256k1_scalar_mul(&r1, &r1, &s);
970  secp256k1_scalar_mul(&r2, &s1, &s);
971  secp256k1_scalar_mul(&t, &s2, &s);
972  secp256k1_scalar_add(&r2, &r2, &t);
973  CHECK(secp256k1_scalar_eq(&r1, &r2));
974  }
975 
976  {
977  /* Test square. */
978  secp256k1_scalar r1, r2;
979  secp256k1_scalar_sqr(&r1, &s1);
980  secp256k1_scalar_mul(&r2, &s1, &s1);
981  CHECK(secp256k1_scalar_eq(&r1, &r2));
982  }
983 
984  {
985  /* Test multiplicative identity. */
986  secp256k1_scalar r1, v1;
987  secp256k1_scalar_set_int(&v1,1);
988  secp256k1_scalar_mul(&r1, &s1, &v1);
989  CHECK(secp256k1_scalar_eq(&r1, &s1));
990  }
991 
992  {
993  /* Test additive identity. */
994  secp256k1_scalar r1, v0;
995  secp256k1_scalar_set_int(&v0,0);
996  secp256k1_scalar_add(&r1, &s1, &v0);
997  CHECK(secp256k1_scalar_eq(&r1, &s1));
998  }
999 
1000  {
1001  /* Test zero product property. */
1002  secp256k1_scalar r1, v0;
1003  secp256k1_scalar_set_int(&v0,0);
1004  secp256k1_scalar_mul(&r1, &s1, &v0);
1005  CHECK(secp256k1_scalar_eq(&r1, &v0));
1006  }
1007 
1008 }
1009 
1010 void scalar_chacha_tests(void) {
1011  unsigned char expected1[64] = {
1012  0x76, 0xb8, 0xe0, 0xad, 0xa0, 0xf1, 0x3d, 0x90,
1013  0x40, 0x5d, 0x6a, 0xe5, 0x53, 0x86, 0xbd, 0x28,
1014  0xbd, 0xd2, 0x19, 0xb8, 0xa0, 0x8d, 0xed, 0x1a,
1015  0xa8, 0x36, 0xef, 0xcc, 0x8b, 0x77, 0x0d, 0xc7,
1016  0xda, 0x41, 0x59, 0x7c, 0x51, 0x57, 0x48, 0x8d,
1017  0x77, 0x24, 0xe0, 0x3f, 0xb8, 0xd8, 0x4a, 0x37,
1018  0x6a, 0x43, 0xb8, 0xf4, 0x15, 0x18, 0xa1, 0x1c,
1019  0xc3, 0x87, 0xb6, 0x69, 0xb2, 0xee, 0x65, 0x86
1020  };
1021  unsigned char expected2[64] = {
1022  0x45, 0x40, 0xf0, 0x5a, 0x9f, 0x1f, 0xb2, 0x96,
1023  0xd7, 0x73, 0x6e, 0x7b, 0x20, 0x8e, 0x3c, 0x96,
1024  0xeb, 0x4f, 0xe1, 0x83, 0x46, 0x88, 0xd2, 0x60,
1025  0x4f, 0x45, 0x09, 0x52, 0xed, 0x43, 0x2d, 0x41,
1026  0xbb, 0xe2, 0xa0, 0xb6, 0xea, 0x75, 0x66, 0xd2,
1027  0xa5, 0xd1, 0xe7, 0xe2, 0x0d, 0x42, 0xaf, 0x2c,
1028  0x53, 0xd7, 0x92, 0xb1, 0xc4, 0x3f, 0xea, 0x81,
1029  0x7e, 0x9a, 0xd2, 0x75, 0xae, 0x54, 0x69, 0x63
1030  };
1031  unsigned char expected3[64] = {
1032  0x47, 0x4a, 0x4f, 0x35, 0x4f, 0xee, 0x93, 0x59,
1033  0xbb, 0x65, 0x81, 0xe5, 0xd9, 0x15, 0xa6, 0x01,
1034  0xb6, 0x8c, 0x68, 0x03, 0x38, 0xff, 0x65, 0xe6,
1035  0x56, 0x4a, 0x3e, 0x65, 0x59, 0xfc, 0x12, 0x3f,
1036  0xa9, 0xb2, 0xf9, 0x3e, 0x57, 0xc3, 0xa5, 0xcb,
1037  0xe0, 0x72, 0x74, 0x27, 0x88, 0x1c, 0x23, 0xdf,
1038  0xe2, 0xb6, 0xcc, 0xfb, 0x93, 0xed, 0xcb, 0x02,
1039  0xd7, 0x50, 0x52, 0x45, 0x84, 0x88, 0xbb, 0xea
1040  };
1041 
1042  secp256k1_scalar exp_r1, exp_r2;
1043  secp256k1_scalar r1, r2;
1044  unsigned char seed1[32] = { 0 };
1045 
1046  secp256k1_scalar_chacha20(&r1, &r2, seed1, 0);
1047  secp256k1_scalar_set_b32(&exp_r1, &expected1[0], NULL);
1048  secp256k1_scalar_set_b32(&exp_r2, &expected1[32], NULL);
1049  CHECK(secp256k1_scalar_eq(&exp_r1, &r1));
1050  CHECK(secp256k1_scalar_eq(&exp_r2, &r2));
1051 
1052  seed1[31] = 1;
1053  secp256k1_scalar_chacha20(&r1, &r2, seed1, 0);
1054  secp256k1_scalar_set_b32(&exp_r1, &expected2[0], NULL);
1055  secp256k1_scalar_set_b32(&exp_r2, &expected2[32], NULL);
1056  CHECK(secp256k1_scalar_eq(&exp_r1, &r1));
1057  CHECK(secp256k1_scalar_eq(&exp_r2, &r2));
1058 
1059  secp256k1_scalar_chacha20(&r1, &r2, seed1, 100);
1060  secp256k1_scalar_set_b32(&exp_r1, &expected3[0], NULL);
1061  secp256k1_scalar_set_b32(&exp_r2, &expected3[32], NULL);
1062  CHECK(secp256k1_scalar_eq(&exp_r1, &r1));
1063  CHECK(secp256k1_scalar_eq(&exp_r2, &r2));
1064 }
1065 
1066 void run_scalar_tests(void) {
1067  int i;
1068  for (i = 0; i < 128 * count; i++) {
1069  scalar_test();
1070  }
1071 
1072  scalar_chacha_tests();
1073 
1074  {
1075  /* (-1)+1 should be zero. */
1076  secp256k1_scalar s, o;
1077  secp256k1_scalar_set_int(&s, 1);
1078  CHECK(secp256k1_scalar_is_one(&s));
1079  secp256k1_scalar_negate(&o, &s);
1080  secp256k1_scalar_add(&o, &o, &s);
1081  CHECK(secp256k1_scalar_is_zero(&o));
1082  secp256k1_scalar_negate(&o, &o);
1083  CHECK(secp256k1_scalar_is_zero(&o));
1084  }
1085 
1086 #ifndef USE_NUM_NONE
1087  {
1088  /* A scalar with value of the curve order should be 0. */
1089  secp256k1_num order;
1090  secp256k1_scalar zero;
1091  unsigned char bin[32];
1092  int overflow = 0;
1093  secp256k1_scalar_order_get_num(&order);
1094  secp256k1_num_get_bin(bin, 32, &order);
1095  secp256k1_scalar_set_b32(&zero, bin, &overflow);
1096  CHECK(overflow == 1);
1097  CHECK(secp256k1_scalar_is_zero(&zero));
1098  }
1099 #endif
1100 
1101  {
1102  /* Does check_overflow check catch all ones? */
1103  static const secp256k1_scalar overflowed = SECP256K1_SCALAR_CONST(
1104  0xFFFFFFFFUL, 0xFFFFFFFFUL, 0xFFFFFFFFUL, 0xFFFFFFFFUL,
1105  0xFFFFFFFFUL, 0xFFFFFFFFUL, 0xFFFFFFFFUL, 0xFFFFFFFFUL
1106  );
1107  CHECK(secp256k1_scalar_check_overflow(&overflowed));
1108  }
1109 
1110  {
1111  /* Static test vectors.
1112  * These were reduced from ~10^12 random vectors based on comparison-decision
1113  * and edge-case coverage on 32-bit and 64-bit implementations.
1114  * The responses were generated with Sage 5.9.
1115  */
1116  secp256k1_scalar x;
1117  secp256k1_scalar y;
1118  secp256k1_scalar z;
1119  secp256k1_scalar zz;
1120  secp256k1_scalar one;
1121  secp256k1_scalar r1;
1122  secp256k1_scalar r2;
1123 #if defined(USE_SCALAR_INV_NUM)
1124  secp256k1_scalar zzv;
1125 #endif
1126  int overflow;
1127  unsigned char chal[33][2][32] = {
1128  {{0xff, 0xff, 0x03, 0x07, 0x00, 0x00, 0x00, 0x00,
1129  0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x03,
1130  0x00, 0x00, 0x00, 0x00, 0x00, 0xf8, 0xff, 0xff,
1131  0xff, 0xff, 0x03, 0x00, 0xc0, 0xff, 0xff, 0xff},
1132  {0xff, 0xff, 0xff, 0xff, 0xff, 0x0f, 0x00, 0x00,
1133  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xf8,
1134  0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
1135  0xff, 0x03, 0x00, 0x00, 0x00, 0x00, 0xe0, 0xff}},
1136  {{0xef, 0xff, 0x1f, 0x00, 0x00, 0x00, 0x00, 0x00,
1137  0xfe, 0xff, 0xff, 0xff, 0xff, 0xff, 0x3f, 0x00,
1138  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
1139  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00},
1140  {0xff, 0xff, 0xff, 0x00, 0x00, 0x00, 0x00, 0x00,
1141  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xe0,
1142  0xff, 0xff, 0xff, 0xff, 0xfc, 0xff, 0xff, 0xff,
1143  0xff, 0xff, 0xff, 0xff, 0x7f, 0x00, 0x80, 0xff}},
1144  {{0xff, 0xff, 0xff, 0x00, 0x00, 0x00, 0x00, 0x00,
1145  0x00, 0x00, 0x00, 0x00, 0x00, 0x06, 0x00, 0x00,
1146  0x80, 0x00, 0x00, 0x80, 0xff, 0x3f, 0x00, 0x00,
1147  0x00, 0x00, 0x00, 0xf8, 0xff, 0xff, 0xff, 0x00},
1148  {0x00, 0x00, 0xfc, 0xff, 0xff, 0xff, 0xff, 0x80,
1149  0xff, 0xff, 0xff, 0xff, 0xff, 0x0f, 0x00, 0xe0,
1150  0xff, 0xff, 0xff, 0xff, 0xff, 0x7f, 0x00, 0x00,
1151  0x00, 0x00, 0x00, 0x00, 0x7f, 0xff, 0xff, 0xff}},
1152  {{0xff, 0xff, 0xff, 0x00, 0x00, 0x00, 0x00, 0x00,
1153  0x00, 0x00, 0x00, 0x00, 0x80, 0x00, 0x00, 0x80,
1154  0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x00,
1155  0x00, 0x1e, 0xf8, 0xff, 0xff, 0xff, 0xfd, 0xff},
1156  {0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x1f,
1157  0x00, 0x00, 0x00, 0xf8, 0xff, 0x03, 0x00, 0xe0,
1158  0xff, 0x0f, 0x00, 0x00, 0x00, 0x00, 0xf0, 0xff,
1159  0xf3, 0xff, 0x03, 0x00, 0x00, 0x00, 0x00, 0x00}},
1160  {{0x80, 0x00, 0x00, 0x80, 0xff, 0xff, 0xff, 0x00,
1161  0x00, 0x1c, 0x00, 0x00, 0x00, 0xff, 0xff, 0xff,
1162  0xff, 0xff, 0xff, 0xe0, 0xff, 0xff, 0xff, 0x00,
1163  0x00, 0x00, 0x00, 0x00, 0xe0, 0xff, 0xff, 0xff},
1164  {0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x03, 0x00,
1165  0xf8, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
1166  0xff, 0x1f, 0x00, 0x00, 0x80, 0xff, 0xff, 0x3f,
1167  0x00, 0xfe, 0xff, 0xff, 0xff, 0xdf, 0xff, 0xff}},
1168  {{0xff, 0xff, 0xff, 0xff, 0x00, 0x0f, 0xfc, 0x9f,
1169  0xff, 0xff, 0xff, 0x00, 0x80, 0x00, 0x00, 0x80,
1170  0xff, 0x0f, 0xfc, 0xff, 0x7f, 0x00, 0x00, 0x00,
1171  0x00, 0xf8, 0xff, 0xff, 0xff, 0xff, 0xff, 0x00},
1172  {0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x80,
1173  0x00, 0x00, 0xf8, 0xff, 0x0f, 0xc0, 0xff, 0xff,
1174  0xff, 0x1f, 0x00, 0x00, 0x00, 0xc0, 0xff, 0xff,
1175  0xff, 0xff, 0xff, 0x07, 0x80, 0xff, 0xff, 0xff}},
1176  {{0xff, 0xff, 0xff, 0xff, 0xff, 0x3f, 0x00, 0x00,
1177  0x80, 0x00, 0x00, 0x80, 0xff, 0xff, 0xff, 0xff,
1178  0xf7, 0xff, 0xff, 0xef, 0xff, 0xff, 0xff, 0x00,
1179  0xff, 0xff, 0xff, 0x00, 0x00, 0x00, 0x00, 0xf0},
1180  {0x00, 0x00, 0x00, 0x00, 0xf8, 0xff, 0xff, 0xff,
1181  0xff, 0xff, 0xff, 0xff, 0x01, 0x00, 0x00, 0x00,
1182  0x00, 0x00, 0x80, 0xff, 0xff, 0xff, 0xff, 0xff,
1183  0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff}},
1184  {{0x00, 0xf8, 0xff, 0x03, 0xff, 0xff, 0xff, 0x00,
1185  0x00, 0xfe, 0xff, 0xff, 0xff, 0xff, 0xff, 0x00,
1186  0x80, 0x00, 0x00, 0x80, 0xff, 0xff, 0xff, 0xff,
1187  0xff, 0xff, 0x03, 0xc0, 0xff, 0x0f, 0xfc, 0xff},
1188  {0xff, 0xff, 0xff, 0xff, 0xff, 0xe0, 0xff, 0xff,
1189  0xff, 0x01, 0x00, 0x00, 0x00, 0x3f, 0x00, 0xc0,
1190  0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
1191  0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff}},
1192  {{0x8f, 0x0f, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
1193  0x00, 0x00, 0xf8, 0xff, 0xff, 0xff, 0xff, 0xff,
1194  0xff, 0x7f, 0x00, 0x00, 0x80, 0x00, 0x00, 0x80,
1195  0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x00},
1196  {0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
1197  0xff, 0x0f, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
1198  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
1199  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00}},
1200  {{0x00, 0x00, 0x00, 0xc0, 0xff, 0xff, 0xff, 0xff,
1201  0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
1202  0xff, 0xff, 0x03, 0x00, 0x80, 0x00, 0x00, 0x80,
1203  0xff, 0xff, 0xff, 0x00, 0x00, 0x80, 0xff, 0x7f},
1204  {0xff, 0xcf, 0xff, 0xff, 0x01, 0x00, 0x00, 0x00,
1205  0x00, 0xc0, 0xff, 0xcf, 0xff, 0xff, 0xff, 0xff,
1206  0xbf, 0xff, 0x0e, 0x00, 0x00, 0x00, 0x00, 0x00,
1207  0x80, 0xff, 0xff, 0xff, 0xff, 0x00, 0x00, 0x00}},
1208  {{0x00, 0x00, 0x00, 0x00, 0x00, 0x80, 0xff, 0xff,
1209  0xff, 0xff, 0x00, 0xfc, 0xff, 0xff, 0xff, 0xff,
1210  0xff, 0xff, 0xff, 0x00, 0x80, 0x00, 0x00, 0x80,
1211  0xff, 0x01, 0xfc, 0xff, 0x01, 0x00, 0xfe, 0xff},
1212  {0xff, 0xff, 0xff, 0x03, 0x00, 0x00, 0x00, 0x00,
1213  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
1214  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xc0,
1215  0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x03, 0x00}},
1216  {{0xff, 0xff, 0xff, 0x00, 0x00, 0x00, 0x00, 0x00,
1217  0xe0, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
1218  0x00, 0xf8, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
1219  0x7f, 0x00, 0x00, 0x00, 0x80, 0x00, 0x00, 0x80},
1220  {0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
1221  0x00, 0xf8, 0xff, 0x01, 0x00, 0xf0, 0xff, 0xff,
1222  0xe0, 0xff, 0x0f, 0x00, 0x00, 0x00, 0x00, 0x00,
1223  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00}},
1224  {{0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
1225  0xff, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
1226  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
1227  0x00, 0x00, 0x00, 0x00, 0x00, 0xf8, 0xff, 0x00},
1228  {0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x00, 0x00,
1229  0xfc, 0xff, 0xff, 0x3f, 0xf0, 0xff, 0xff, 0x3f,
1230  0x00, 0x00, 0xf8, 0x07, 0x00, 0x00, 0x00, 0xff,
1231  0xff, 0xff, 0xff, 0xff, 0x0f, 0x7e, 0x00, 0x00}},
1232  {{0x00, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x00,
1233  0x00, 0x00, 0x00, 0x00, 0x80, 0x00, 0x00, 0x80,
1234  0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
1235  0xff, 0xff, 0x1f, 0x00, 0x00, 0xfe, 0x07, 0x00},
1236  {0x00, 0x00, 0x00, 0xf0, 0xff, 0xff, 0xff, 0xff,
1237  0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
1238  0xff, 0xfb, 0xff, 0x07, 0x00, 0x00, 0x00, 0x00,
1239  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x60}},
1240  {{0xff, 0x01, 0x00, 0xff, 0xff, 0xff, 0x0f, 0x00,
1241  0x80, 0x7f, 0xfe, 0xff, 0xff, 0xff, 0xff, 0x03,
1242  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
1243  0x00, 0x80, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff},
1244  {0xff, 0xff, 0x1f, 0x00, 0xf0, 0xff, 0xff, 0xff,
1245  0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
1246  0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
1247  0xff, 0xff, 0xff, 0x3f, 0x00, 0x00, 0x00, 0x00}},
1248  {{0x80, 0x00, 0x00, 0x00, 0xff, 0xff, 0xff, 0xff,
1249  0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
1250  0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
1251  0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff},
1252  {0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
1253  0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xf1, 0xff,
1254  0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x03,
1255  0x00, 0x00, 0x00, 0xe0, 0xff, 0xff, 0xff, 0xff}},
1256  {{0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x00,
1257  0x7e, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
1258  0xc0, 0xff, 0xff, 0xcf, 0xff, 0x1f, 0x00, 0x00,
1259  0x80, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x80},
1260  {0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
1261  0x00, 0x00, 0x00, 0x00, 0x00, 0xe0, 0xff, 0xff,
1262  0xff, 0xff, 0xff, 0xff, 0xff, 0x3f, 0x00, 0x7e,
1263  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00}},
1264  {{0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
1265  0x00, 0x00, 0x00, 0xfc, 0xff, 0xff, 0xff, 0xff,
1266  0xff, 0xff, 0x03, 0x00, 0x00, 0x00, 0x00, 0x00,
1267  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x7c, 0x00},
1268  {0x80, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x80,
1269  0xff, 0xff, 0x7f, 0x00, 0x80, 0x00, 0x00, 0x00,
1270  0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x00,
1271  0x00, 0x00, 0xe0, 0xff, 0xff, 0xff, 0xff, 0xff}},
1272  {{0xff, 0xff, 0xff, 0xff, 0xff, 0x1f, 0x00, 0x80,
1273  0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x00,
1274  0x80, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x80,
1275  0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x00},
1276  {0xf0, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
1277  0xff, 0xff, 0xff, 0xff, 0x3f, 0x00, 0x00, 0x80,
1278  0xff, 0x01, 0x00, 0x00, 0x00, 0x00, 0xff, 0xff,
1279  0xff, 0x7f, 0xf8, 0xff, 0xff, 0x1f, 0x00, 0xfe}},
1280  {{0xff, 0xff, 0xff, 0x3f, 0xf8, 0xff, 0xff, 0xff,
1281  0xff, 0x03, 0xfe, 0x01, 0x00, 0x00, 0x00, 0x00,
1282  0xf0, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
1283  0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x07},
1284  {0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x00,
1285  0x80, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x80,
1286  0xff, 0xff, 0xff, 0xff, 0x01, 0x80, 0xff, 0xff,
1287  0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x00}},
1288  {{0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
1289  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
1290  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
1291  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00},
1292  {0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
1293  0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xfe,
1294  0xba, 0xae, 0xdc, 0xe6, 0xaf, 0x48, 0xa0, 0x3b,
1295  0xbf, 0xd2, 0x5e, 0x8c, 0xd0, 0x36, 0x41, 0x40}},
1296  {{0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
1297  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
1298  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
1299  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01},
1300  {0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
1301  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
1302  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
1303  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00}},
1304  {{0x7f, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
1305  0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
1306  0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
1307  0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff},
1308  {0x7f, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
1309  0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
1310  0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
1311  0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff}},
1312  {{0xff, 0xff, 0xff, 0xff, 0xff, 0x00, 0x00, 0xc0,
1313  0xff, 0x0f, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
1314  0x00, 0x00, 0xf0, 0xff, 0xff, 0xff, 0xff, 0xff,
1315  0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x7f},
1316  {0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x01, 0x00,
1317  0xf0, 0xff, 0xff, 0xff, 0xff, 0x07, 0x00, 0x00,
1318  0x00, 0x00, 0x00, 0xfe, 0xff, 0xff, 0xff, 0xff,
1319  0xff, 0xff, 0xff, 0xff, 0x01, 0xff, 0xff, 0xff}},
1320  {{0x7f, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
1321  0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
1322  0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
1323  0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff},
1324  {0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
1325  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
1326  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
1327  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02}},
1328  {{0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
1329  0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xfe,
1330  0xba, 0xae, 0xdc, 0xe6, 0xaf, 0x48, 0xa0, 0x3b,
1331  0xbf, 0xd2, 0x5e, 0x8c, 0xd0, 0x36, 0x41, 0x40},
1332  {0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
1333  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
1334  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
1335  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01}},
1336  {{0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
1337  0x7e, 0x00, 0x00, 0xc0, 0xff, 0xff, 0x07, 0x00,
1338  0x80, 0x00, 0x00, 0x00, 0x80, 0x00, 0x00, 0x00,
1339  0xfc, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff},
1340  {0xff, 0x01, 0x00, 0x00, 0x00, 0xe0, 0xff, 0xff,
1341  0xff, 0xff, 0xff, 0xff, 0xff, 0x1f, 0x00, 0x80,
1342  0xff, 0xff, 0xff, 0xff, 0xff, 0x03, 0x00, 0x00,
1343  0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff}},
1344  {{0xff, 0xff, 0xf0, 0xff, 0xff, 0xff, 0xff, 0x00,
1345  0xf0, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x00,
1346  0x00, 0xe0, 0xff, 0xff, 0xff, 0xff, 0xff, 0x01,
1347  0x80, 0x00, 0x00, 0x80, 0xff, 0xff, 0xff, 0xff},
1348  {0x00, 0x00, 0x00, 0x00, 0x00, 0xe0, 0xff, 0xff,
1349  0xff, 0xff, 0x3f, 0x00, 0xf8, 0xff, 0xff, 0xff,
1350  0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
1351  0xff, 0x3f, 0x00, 0x00, 0xc0, 0xf1, 0x7f, 0x00}},
1352  {{0xff, 0xff, 0xff, 0x00, 0x00, 0x00, 0x00, 0x00,
1353  0x00, 0x00, 0x00, 0xc0, 0xff, 0xff, 0xff, 0xff,
1354  0xff, 0xff, 0xff, 0x00, 0x00, 0x00, 0x00, 0x00,
1355  0x80, 0x00, 0x00, 0x80, 0xff, 0xff, 0xff, 0x00},
1356  {0x00, 0xf8, 0xff, 0xff, 0xff, 0xff, 0xff, 0x01,
1357  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xf8, 0xff,
1358  0xff, 0x7f, 0x00, 0x00, 0x00, 0x00, 0x80, 0x1f,
1359  0x00, 0x00, 0xfc, 0xff, 0xff, 0x01, 0xff, 0xff}},
1360  {{0x00, 0xfe, 0xff, 0xff, 0xff, 0xff, 0xff, 0x00,
1361  0x80, 0x00, 0x00, 0x80, 0xff, 0x03, 0xe0, 0x01,
1362  0xff, 0xff, 0xff, 0x00, 0x00, 0x00, 0xfc, 0xff,
1363  0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x00},
1364  {0xff, 0xff, 0xff, 0xff, 0x00, 0x00, 0x00, 0x00,
1365  0xfe, 0xff, 0xff, 0xf0, 0x07, 0x00, 0x3c, 0x80,
1366  0xff, 0xff, 0xff, 0xff, 0xfc, 0xff, 0xff, 0xff,
1367  0xff, 0xff, 0x07, 0xe0, 0xff, 0x00, 0x00, 0x00}},
1368  {{0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x00,
1369  0xfc, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
1370  0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x07, 0xf8,
1371  0x00, 0x00, 0x00, 0x00, 0x80, 0x00, 0x00, 0x80},
1372  {0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
1373  0xff, 0xff, 0xff, 0xff, 0xff, 0x0c, 0x80, 0x00,
1374  0x00, 0x00, 0x00, 0xc0, 0x7f, 0xfe, 0xff, 0x1f,
1375  0x00, 0xfe, 0xff, 0x03, 0x00, 0x00, 0xfe, 0xff}},
1376  {{0xff, 0xff, 0x81, 0xff, 0xff, 0xff, 0xff, 0x00,
1377  0x80, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x83,
1378  0xff, 0xff, 0x00, 0x00, 0x80, 0x00, 0x00, 0x80,
1379  0xff, 0xff, 0x7f, 0x00, 0x00, 0x00, 0x00, 0xf0},
1380  {0xff, 0x01, 0x00, 0x00, 0x00, 0x00, 0xf8, 0xff,
1381  0xff, 0xff, 0xff, 0xff, 0xff, 0x1f, 0x00, 0x00,
1382  0xf8, 0x07, 0x00, 0x80, 0xff, 0xff, 0xff, 0xff,
1383  0xff, 0xc7, 0xff, 0xff, 0xe0, 0xff, 0xff, 0xff}},
1384  {{0x82, 0xc9, 0xfa, 0xb0, 0x68, 0x04, 0xa0, 0x00,
1385  0x82, 0xc9, 0xfa, 0xb0, 0x68, 0x04, 0xa0, 0x00,
1386  0xff, 0xff, 0xff, 0xff, 0xff, 0x6f, 0x03, 0xfb,
1387  0xfa, 0x8a, 0x7d, 0xdf, 0x13, 0x86, 0xe2, 0x03},
1388  {0x82, 0xc9, 0xfa, 0xb0, 0x68, 0x04, 0xa0, 0x00,
1389  0x82, 0xc9, 0xfa, 0xb0, 0x68, 0x04, 0xa0, 0x00,
1390  0xff, 0xff, 0xff, 0xff, 0xff, 0x6f, 0x03, 0xfb,
1391  0xfa, 0x8a, 0x7d, 0xdf, 0x13, 0x86, 0xe2, 0x03}}
1392  };
1393  unsigned char res[33][2][32] = {
1394  {{0x0c, 0x3b, 0x0a, 0xca, 0x8d, 0x1a, 0x2f, 0xb9,
1395  0x8a, 0x7b, 0x53, 0x5a, 0x1f, 0xc5, 0x22, 0xa1,
1396  0x07, 0x2a, 0x48, 0xea, 0x02, 0xeb, 0xb3, 0xd6,
1397  0x20, 0x1e, 0x86, 0xd0, 0x95, 0xf6, 0x92, 0x35},
1398  {0xdc, 0x90, 0x7a, 0x07, 0x2e, 0x1e, 0x44, 0x6d,
1399  0xf8, 0x15, 0x24, 0x5b, 0x5a, 0x96, 0x37, 0x9c,
1400  0x37, 0x7b, 0x0d, 0xac, 0x1b, 0x65, 0x58, 0x49,
1401  0x43, 0xb7, 0x31, 0xbb, 0xa7, 0xf4, 0x97, 0x15}},
1402  {{0xf1, 0xf7, 0x3a, 0x50, 0xe6, 0x10, 0xba, 0x22,
1403  0x43, 0x4d, 0x1f, 0x1f, 0x7c, 0x27, 0xca, 0x9c,
1404  0xb8, 0xb6, 0xa0, 0xfc, 0xd8, 0xc0, 0x05, 0x2f,
1405  0xf7, 0x08, 0xe1, 0x76, 0xdd, 0xd0, 0x80, 0xc8},
1406  {0xe3, 0x80, 0x80, 0xb8, 0xdb, 0xe3, 0xa9, 0x77,
1407  0x00, 0xb0, 0xf5, 0x2e, 0x27, 0xe2, 0x68, 0xc4,
1408  0x88, 0xe8, 0x04, 0xc1, 0x12, 0xbf, 0x78, 0x59,
1409  0xe6, 0xa9, 0x7c, 0xe1, 0x81, 0xdd, 0xb9, 0xd5}},
1410  {{0x96, 0xe2, 0xee, 0x01, 0xa6, 0x80, 0x31, 0xef,
1411  0x5c, 0xd0, 0x19, 0xb4, 0x7d, 0x5f, 0x79, 0xab,
1412  0xa1, 0x97, 0xd3, 0x7e, 0x33, 0xbb, 0x86, 0x55,
1413  0x60, 0x20, 0x10, 0x0d, 0x94, 0x2d, 0x11, 0x7c},
1414  {0xcc, 0xab, 0xe0, 0xe8, 0x98, 0x65, 0x12, 0x96,
1415  0x38, 0x5a, 0x1a, 0xf2, 0x85, 0x23, 0x59, 0x5f,
1416  0xf9, 0xf3, 0xc2, 0x81, 0x70, 0x92, 0x65, 0x12,
1417  0x9c, 0x65, 0x1e, 0x96, 0x00, 0xef, 0xe7, 0x63}},
1418  {{0xac, 0x1e, 0x62, 0xc2, 0x59, 0xfc, 0x4e, 0x5c,
1419  0x83, 0xb0, 0xd0, 0x6f, 0xce, 0x19, 0xf6, 0xbf,
1420  0xa4, 0xb0, 0xe0, 0x53, 0x66, 0x1f, 0xbf, 0xc9,
1421  0x33, 0x47, 0x37, 0xa9, 0x3d, 0x5d, 0xb0, 0x48},
1422  {0x86, 0xb9, 0x2a, 0x7f, 0x8e, 0xa8, 0x60, 0x42,
1423  0x26, 0x6d, 0x6e, 0x1c, 0xa2, 0xec, 0xe0, 0xe5,
1424  0x3e, 0x0a, 0x33, 0xbb, 0x61, 0x4c, 0x9f, 0x3c,
1425  0xd1, 0xdf, 0x49, 0x33, 0xcd, 0x72, 0x78, 0x18}},
1426  {{0xf7, 0xd3, 0xcd, 0x49, 0x5c, 0x13, 0x22, 0xfb,
1427  0x2e, 0xb2, 0x2f, 0x27, 0xf5, 0x8a, 0x5d, 0x74,
1428  0xc1, 0x58, 0xc5, 0xc2, 0x2d, 0x9f, 0x52, 0xc6,
1429  0x63, 0x9f, 0xba, 0x05, 0x76, 0x45, 0x7a, 0x63},
1430  {0x8a, 0xfa, 0x55, 0x4d, 0xdd, 0xa3, 0xb2, 0xc3,
1431  0x44, 0xfd, 0xec, 0x72, 0xde, 0xef, 0xc0, 0x99,
1432  0xf5, 0x9f, 0xe2, 0x52, 0xb4, 0x05, 0x32, 0x58,
1433  0x57, 0xc1, 0x8f, 0xea, 0xc3, 0x24, 0x5b, 0x94}},
1434  {{0x05, 0x83, 0xee, 0xdd, 0x64, 0xf0, 0x14, 0x3b,
1435  0xa0, 0x14, 0x4a, 0x3a, 0x41, 0x82, 0x7c, 0xa7,
1436  0x2c, 0xaa, 0xb1, 0x76, 0xbb, 0x59, 0x64, 0x5f,
1437  0x52, 0xad, 0x25, 0x29, 0x9d, 0x8f, 0x0b, 0xb0},
1438  {0x7e, 0xe3, 0x7c, 0xca, 0xcd, 0x4f, 0xb0, 0x6d,
1439  0x7a, 0xb2, 0x3e, 0xa0, 0x08, 0xb9, 0xa8, 0x2d,
1440  0xc2, 0xf4, 0x99, 0x66, 0xcc, 0xac, 0xd8, 0xb9,
1441  0x72, 0x2a, 0x4a, 0x3e, 0x0f, 0x7b, 0xbf, 0xf4}},
1442  {{0x8c, 0x9c, 0x78, 0x2b, 0x39, 0x61, 0x7e, 0xf7,
1443  0x65, 0x37, 0x66, 0x09, 0x38, 0xb9, 0x6f, 0x70,
1444  0x78, 0x87, 0xff, 0xcf, 0x93, 0xca, 0x85, 0x06,
1445  0x44, 0x84, 0xa7, 0xfe, 0xd3, 0xa4, 0xe3, 0x7e},
1446  {0xa2, 0x56, 0x49, 0x23, 0x54, 0xa5, 0x50, 0xe9,
1447  0x5f, 0xf0, 0x4d, 0xe7, 0xdc, 0x38, 0x32, 0x79,
1448  0x4f, 0x1c, 0xb7, 0xe4, 0xbb, 0xf8, 0xbb, 0x2e,
1449  0x40, 0x41, 0x4b, 0xcc, 0xe3, 0x1e, 0x16, 0x36}},
1450  {{0x0c, 0x1e, 0xd7, 0x09, 0x25, 0x40, 0x97, 0xcb,
1451  0x5c, 0x46, 0xa8, 0xda, 0xef, 0x25, 0xd5, 0xe5,
1452  0x92, 0x4d, 0xcf, 0xa3, 0xc4, 0x5d, 0x35, 0x4a,
1453  0xe4, 0x61, 0x92, 0xf3, 0xbf, 0x0e, 0xcd, 0xbe},
1454  {0xe4, 0xaf, 0x0a, 0xb3, 0x30, 0x8b, 0x9b, 0x48,
1455  0x49, 0x43, 0xc7, 0x64, 0x60, 0x4a, 0x2b, 0x9e,
1456  0x95, 0x5f, 0x56, 0xe8, 0x35, 0xdc, 0xeb, 0xdc,
1457  0xc7, 0xc4, 0xfe, 0x30, 0x40, 0xc7, 0xbf, 0xa4}},
1458  {{0xd4, 0xa0, 0xf5, 0x81, 0x49, 0x6b, 0xb6, 0x8b,
1459  0x0a, 0x69, 0xf9, 0xfe, 0xa8, 0x32, 0xe5, 0xe0,
1460  0xa5, 0xcd, 0x02, 0x53, 0xf9, 0x2c, 0xe3, 0x53,
1461  0x83, 0x36, 0xc6, 0x02, 0xb5, 0xeb, 0x64, 0xb8},
1462  {0x1d, 0x42, 0xb9, 0xf9, 0xe9, 0xe3, 0x93, 0x2c,
1463  0x4c, 0xee, 0x6c, 0x5a, 0x47, 0x9e, 0x62, 0x01,
1464  0x6b, 0x04, 0xfe, 0xa4, 0x30, 0x2b, 0x0d, 0x4f,
1465  0x71, 0x10, 0xd3, 0x55, 0xca, 0xf3, 0x5e, 0x80}},
1466  {{0x77, 0x05, 0xf6, 0x0c, 0x15, 0x9b, 0x45, 0xe7,
1467  0xb9, 0x11, 0xb8, 0xf5, 0xd6, 0xda, 0x73, 0x0c,
1468  0xda, 0x92, 0xea, 0xd0, 0x9d, 0xd0, 0x18, 0x92,
1469  0xce, 0x9a, 0xaa, 0xee, 0x0f, 0xef, 0xde, 0x30},
1470  {0xf1, 0xf1, 0xd6, 0x9b, 0x51, 0xd7, 0x77, 0x62,
1471  0x52, 0x10, 0xb8, 0x7a, 0x84, 0x9d, 0x15, 0x4e,
1472  0x07, 0xdc, 0x1e, 0x75, 0x0d, 0x0c, 0x3b, 0xdb,
1473  0x74, 0x58, 0x62, 0x02, 0x90, 0x54, 0x8b, 0x43}},
1474  {{0xa6, 0xfe, 0x0b, 0x87, 0x80, 0x43, 0x67, 0x25,
1475  0x57, 0x5d, 0xec, 0x40, 0x50, 0x08, 0xd5, 0x5d,
1476  0x43, 0xd7, 0xe0, 0xaa, 0xe0, 0x13, 0xb6, 0xb0,
1477  0xc0, 0xd4, 0xe5, 0x0d, 0x45, 0x83, 0xd6, 0x13},
1478  {0x40, 0x45, 0x0a, 0x92, 0x31, 0xea, 0x8c, 0x60,
1479  0x8c, 0x1f, 0xd8, 0x76, 0x45, 0xb9, 0x29, 0x00,
1480  0x26, 0x32, 0xd8, 0xa6, 0x96, 0x88, 0xe2, 0xc4,
1481  0x8b, 0xdb, 0x7f, 0x17, 0x87, 0xcc, 0xc8, 0xf2}},
1482  {{0xc2, 0x56, 0xe2, 0xb6, 0x1a, 0x81, 0xe7, 0x31,
1483  0x63, 0x2e, 0xbb, 0x0d, 0x2f, 0x81, 0x67, 0xd4,
1484  0x22, 0xe2, 0x38, 0x02, 0x25, 0x97, 0xc7, 0x88,
1485  0x6e, 0xdf, 0xbe, 0x2a, 0xa5, 0x73, 0x63, 0xaa},
1486  {0x50, 0x45, 0xe2, 0xc3, 0xbd, 0x89, 0xfc, 0x57,
1487  0xbd, 0x3c, 0xa3, 0x98, 0x7e, 0x7f, 0x36, 0x38,
1488  0x92, 0x39, 0x1f, 0x0f, 0x81, 0x1a, 0x06, 0x51,
1489  0x1f, 0x8d, 0x6a, 0xff, 0x47, 0x16, 0x06, 0x9c}},
1490  {{0x33, 0x95, 0xa2, 0x6f, 0x27, 0x5f, 0x9c, 0x9c,
1491  0x64, 0x45, 0xcb, 0xd1, 0x3c, 0xee, 0x5e, 0x5f,
1492  0x48, 0xa6, 0xaf, 0xe3, 0x79, 0xcf, 0xb1, 0xe2,
1493  0xbf, 0x55, 0x0e, 0xa2, 0x3b, 0x62, 0xf0, 0xe4},
1494  {0x14, 0xe8, 0x06, 0xe3, 0xbe, 0x7e, 0x67, 0x01,
1495  0xc5, 0x21, 0x67, 0xd8, 0x54, 0xb5, 0x7f, 0xa4,
1496  0xf9, 0x75, 0x70, 0x1c, 0xfd, 0x79, 0xdb, 0x86,
1497  0xad, 0x37, 0x85, 0x83, 0x56, 0x4e, 0xf0, 0xbf}},
1498  {{0xbc, 0xa6, 0xe0, 0x56, 0x4e, 0xef, 0xfa, 0xf5,
1499  0x1d, 0x5d, 0x3f, 0x2a, 0x5b, 0x19, 0xab, 0x51,
1500  0xc5, 0x8b, 0xdd, 0x98, 0x28, 0x35, 0x2f, 0xc3,
1501  0x81, 0x4f, 0x5c, 0xe5, 0x70, 0xb9, 0xeb, 0x62},
1502  {0xc4, 0x6d, 0x26, 0xb0, 0x17, 0x6b, 0xfe, 0x6c,
1503  0x12, 0xf8, 0xe7, 0xc1, 0xf5, 0x2f, 0xfa, 0x91,
1504  0x13, 0x27, 0xbd, 0x73, 0xcc, 0x33, 0x31, 0x1c,
1505  0x39, 0xe3, 0x27, 0x6a, 0x95, 0xcf, 0xc5, 0xfb}},
1506  {{0x30, 0xb2, 0x99, 0x84, 0xf0, 0x18, 0x2a, 0x6e,
1507  0x1e, 0x27, 0xed, 0xa2, 0x29, 0x99, 0x41, 0x56,
1508  0xe8, 0xd4, 0x0d, 0xef, 0x99, 0x9c, 0xf3, 0x58,
1509  0x29, 0x55, 0x1a, 0xc0, 0x68, 0xd6, 0x74, 0xa4},
1510  {0x07, 0x9c, 0xe7, 0xec, 0xf5, 0x36, 0x73, 0x41,
1511  0xa3, 0x1c, 0xe5, 0x93, 0x97, 0x6a, 0xfd, 0xf7,
1512  0x53, 0x18, 0xab, 0xaf, 0xeb, 0x85, 0xbd, 0x92,
1513  0x90, 0xab, 0x3c, 0xbf, 0x30, 0x82, 0xad, 0xf6}},
1514  {{0xc6, 0x87, 0x8a, 0x2a, 0xea, 0xc0, 0xa9, 0xec,
1515  0x6d, 0xd3, 0xdc, 0x32, 0x23, 0xce, 0x62, 0x19,
1516  0xa4, 0x7e, 0xa8, 0xdd, 0x1c, 0x33, 0xae, 0xd3,
1517  0x4f, 0x62, 0x9f, 0x52, 0xe7, 0x65, 0x46, 0xf4},
1518  {0x97, 0x51, 0x27, 0x67, 0x2d, 0xa2, 0x82, 0x87,
1519  0x98, 0xd3, 0xb6, 0x14, 0x7f, 0x51, 0xd3, 0x9a,
1520  0x0b, 0xd0, 0x76, 0x81, 0xb2, 0x4f, 0x58, 0x92,
1521  0xa4, 0x86, 0xa1, 0xa7, 0x09, 0x1d, 0xef, 0x9b}},
1522  {{0xb3, 0x0f, 0x2b, 0x69, 0x0d, 0x06, 0x90, 0x64,
1523  0xbd, 0x43, 0x4c, 0x10, 0xe8, 0x98, 0x1c, 0xa3,
1524  0xe1, 0x68, 0xe9, 0x79, 0x6c, 0x29, 0x51, 0x3f,
1525  0x41, 0xdc, 0xdf, 0x1f, 0xf3, 0x60, 0xbe, 0x33},
1526  {0xa1, 0x5f, 0xf7, 0x1d, 0xb4, 0x3e, 0x9b, 0x3c,
1527  0xe7, 0xbd, 0xb6, 0x06, 0xd5, 0x60, 0x06, 0x6d,
1528  0x50, 0xd2, 0xf4, 0x1a, 0x31, 0x08, 0xf2, 0xea,
1529  0x8e, 0xef, 0x5f, 0x7d, 0xb6, 0xd0, 0xc0, 0x27}},
1530  {{0x62, 0x9a, 0xd9, 0xbb, 0x38, 0x36, 0xce, 0xf7,
1531  0x5d, 0x2f, 0x13, 0xec, 0xc8, 0x2d, 0x02, 0x8a,
1532  0x2e, 0x72, 0xf0, 0xe5, 0x15, 0x9d, 0x72, 0xae,
1533  0xfc, 0xb3, 0x4f, 0x02, 0xea, 0xe1, 0x09, 0xfe},
1534  {0x00, 0x00, 0x00, 0x00, 0xfa, 0x0a, 0x3d, 0xbc,
1535  0xad, 0x16, 0x0c, 0xb6, 0xe7, 0x7c, 0x8b, 0x39,
1536  0x9a, 0x43, 0xbb, 0xe3, 0xc2, 0x55, 0x15, 0x14,
1537  0x75, 0xac, 0x90, 0x9b, 0x7f, 0x9a, 0x92, 0x00}},
1538  {{0x8b, 0xac, 0x70, 0x86, 0x29, 0x8f, 0x00, 0x23,
1539  0x7b, 0x45, 0x30, 0xaa, 0xb8, 0x4c, 0xc7, 0x8d,
1540  0x4e, 0x47, 0x85, 0xc6, 0x19, 0xe3, 0x96, 0xc2,
1541  0x9a, 0xa0, 0x12, 0xed, 0x6f, 0xd7, 0x76, 0x16},
1542  {0x45, 0xaf, 0x7e, 0x33, 0xc7, 0x7f, 0x10, 0x6c,
1543  0x7c, 0x9f, 0x29, 0xc1, 0xa8, 0x7e, 0x15, 0x84,
1544  0xe7, 0x7d, 0xc0, 0x6d, 0xab, 0x71, 0x5d, 0xd0,
1545  0x6b, 0x9f, 0x97, 0xab, 0xcb, 0x51, 0x0c, 0x9f}},
1546  {{0x9e, 0xc3, 0x92, 0xb4, 0x04, 0x9f, 0xc8, 0xbb,
1547  0xdd, 0x9e, 0xc6, 0x05, 0xfd, 0x65, 0xec, 0x94,
1548  0x7f, 0x2c, 0x16, 0xc4, 0x40, 0xac, 0x63, 0x7b,
1549  0x7d, 0xb8, 0x0c, 0xe4, 0x5b, 0xe3, 0xa7, 0x0e},
1550  {0x43, 0xf4, 0x44, 0xe8, 0xcc, 0xc8, 0xd4, 0x54,
1551  0x33, 0x37, 0x50, 0xf2, 0x87, 0x42, 0x2e, 0x00,
1552  0x49, 0x60, 0x62, 0x02, 0xfd, 0x1a, 0x7c, 0xdb,
1553  0x29, 0x6c, 0x6d, 0x54, 0x53, 0x08, 0xd1, 0xc8}},
1554  {{0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
1555  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
1556  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
1557  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00},
1558  {0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
1559  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
1560  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
1561  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00}},
1562  {{0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
1563  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
1564  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
1565  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00},
1566  {0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
1567  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
1568  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
1569  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01}},
1570  {{0x27, 0x59, 0xc7, 0x35, 0x60, 0x71, 0xa6, 0xf1,
1571  0x79, 0xa5, 0xfd, 0x79, 0x16, 0xf3, 0x41, 0xf0,
1572  0x57, 0xb4, 0x02, 0x97, 0x32, 0xe7, 0xde, 0x59,
1573  0xe2, 0x2d, 0x9b, 0x11, 0xea, 0x2c, 0x35, 0x92},
1574  {0x27, 0x59, 0xc7, 0x35, 0x60, 0x71, 0xa6, 0xf1,
1575  0x79, 0xa5, 0xfd, 0x79, 0x16, 0xf3, 0x41, 0xf0,
1576  0x57, 0xb4, 0x02, 0x97, 0x32, 0xe7, 0xde, 0x59,
1577  0xe2, 0x2d, 0x9b, 0x11, 0xea, 0x2c, 0x35, 0x92}},
1578  {{0x28, 0x56, 0xac, 0x0e, 0x4f, 0x98, 0x09, 0xf0,
1579  0x49, 0xfa, 0x7f, 0x84, 0xac, 0x7e, 0x50, 0x5b,
1580  0x17, 0x43, 0x14, 0x89, 0x9c, 0x53, 0xa8, 0x94,
1581  0x30, 0xf2, 0x11, 0x4d, 0x92, 0x14, 0x27, 0xe8},
1582  {0x39, 0x7a, 0x84, 0x56, 0x79, 0x9d, 0xec, 0x26,
1583  0x2c, 0x53, 0xc1, 0x94, 0xc9, 0x8d, 0x9e, 0x9d,
1584  0x32, 0x1f, 0xdd, 0x84, 0x04, 0xe8, 0xe2, 0x0a,
1585  0x6b, 0xbe, 0xbb, 0x42, 0x40, 0x67, 0x30, 0x6c}},
1586  {{0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
1587  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01,
1588  0x45, 0x51, 0x23, 0x19, 0x50, 0xb7, 0x5f, 0xc4,
1589  0x40, 0x2d, 0xa1, 0x73, 0x2f, 0xc9, 0xbe, 0xbd},
1590  {0x27, 0x59, 0xc7, 0x35, 0x60, 0x71, 0xa6, 0xf1,
1591  0x79, 0xa5, 0xfd, 0x79, 0x16, 0xf3, 0x41, 0xf0,
1592  0x57, 0xb4, 0x02, 0x97, 0x32, 0xe7, 0xde, 0x59,
1593  0xe2, 0x2d, 0x9b, 0x11, 0xea, 0x2c, 0x35, 0x92}},
1594  {{0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
1595  0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xfe,
1596  0xba, 0xae, 0xdc, 0xe6, 0xaf, 0x48, 0xa0, 0x3b,
1597  0xbf, 0xd2, 0x5e, 0x8c, 0xd0, 0x36, 0x41, 0x40},
1598  {0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
1599  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
1600  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
1601  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01}},
1602  {{0x1c, 0xc4, 0xf7, 0xda, 0x0f, 0x65, 0xca, 0x39,
1603  0x70, 0x52, 0x92, 0x8e, 0xc3, 0xc8, 0x15, 0xea,
1604  0x7f, 0x10, 0x9e, 0x77, 0x4b, 0x6e, 0x2d, 0xdf,
1605  0xe8, 0x30, 0x9d, 0xda, 0xe8, 0x9a, 0x65, 0xae},
1606  {0x02, 0xb0, 0x16, 0xb1, 0x1d, 0xc8, 0x57, 0x7b,
1607  0xa2, 0x3a, 0xa2, 0xa3, 0x38, 0x5c, 0x8f, 0xeb,
1608  0x66, 0x37, 0x91, 0xa8, 0x5f, 0xef, 0x04, 0xf6,
1609  0x59, 0x75, 0xe1, 0xee, 0x92, 0xf6, 0x0e, 0x30}},
1610  {{0x8d, 0x76, 0x14, 0xa4, 0x14, 0x06, 0x9f, 0x9a,
1611  0xdf, 0x4a, 0x85, 0xa7, 0x6b, 0xbf, 0x29, 0x6f,
1612  0xbc, 0x34, 0x87, 0x5d, 0xeb, 0xbb, 0x2e, 0xa9,
1613  0xc9, 0x1f, 0x58, 0xd6, 0x9a, 0x82, 0xa0, 0x56},
1614  {0xd4, 0xb9, 0xdb, 0x88, 0x1d, 0x04, 0xe9, 0x93,
1615  0x8d, 0x3f, 0x20, 0xd5, 0x86, 0xa8, 0x83, 0x07,
1616  0xdb, 0x09, 0xd8, 0x22, 0x1f, 0x7f, 0xf1, 0x71,
1617  0xc8, 0xe7, 0x5d, 0x47, 0xaf, 0x8b, 0x72, 0xe9}},
1618  {{0x83, 0xb9, 0x39, 0xb2, 0xa4, 0xdf, 0x46, 0x87,
1619  0xc2, 0xb8, 0xf1, 0xe6, 0x4c, 0xd1, 0xe2, 0xa9,
1620  0xe4, 0x70, 0x30, 0x34, 0xbc, 0x52, 0x7c, 0x55,
1621  0xa6, 0xec, 0x80, 0xa4, 0xe5, 0xd2, 0xdc, 0x73},
1622  {0x08, 0xf1, 0x03, 0xcf, 0x16, 0x73, 0xe8, 0x7d,
1623  0xb6, 0x7e, 0x9b, 0xc0, 0xb4, 0xc2, 0xa5, 0x86,
1624  0x02, 0x77, 0xd5, 0x27, 0x86, 0xa5, 0x15, 0xfb,
1625  0xae, 0x9b, 0x8c, 0xa9, 0xf9, 0xf8, 0xa8, 0x4a}},
1626  {{0x8b, 0x00, 0x49, 0xdb, 0xfa, 0xf0, 0x1b, 0xa2,
1627  0xed, 0x8a, 0x9a, 0x7a, 0x36, 0x78, 0x4a, 0xc7,
1628  0xf7, 0xad, 0x39, 0xd0, 0x6c, 0x65, 0x7a, 0x41,
1629  0xce, 0xd6, 0xd6, 0x4c, 0x20, 0x21, 0x6b, 0xc7},
1630  {0xc6, 0xca, 0x78, 0x1d, 0x32, 0x6c, 0x6c, 0x06,
1631  0x91, 0xf2, 0x1a, 0xe8, 0x43, 0x16, 0xea, 0x04,
1632  0x3c, 0x1f, 0x07, 0x85, 0xf7, 0x09, 0x22, 0x08,
1633  0xba, 0x13, 0xfd, 0x78, 0x1e, 0x3f, 0x6f, 0x62}},
1634  {{0x25, 0x9b, 0x7c, 0xb0, 0xac, 0x72, 0x6f, 0xb2,
1635  0xe3, 0x53, 0x84, 0x7a, 0x1a, 0x9a, 0x98, 0x9b,
1636  0x44, 0xd3, 0x59, 0xd0, 0x8e, 0x57, 0x41, 0x40,
1637  0x78, 0xa7, 0x30, 0x2f, 0x4c, 0x9c, 0xb9, 0x68},
1638  {0xb7, 0x75, 0x03, 0x63, 0x61, 0xc2, 0x48, 0x6e,
1639  0x12, 0x3d, 0xbf, 0x4b, 0x27, 0xdf, 0xb1, 0x7a,
1640  0xff, 0x4e, 0x31, 0x07, 0x83, 0xf4, 0x62, 0x5b,
1641  0x19, 0xa5, 0xac, 0xa0, 0x32, 0x58, 0x0d, 0xa7}},
1642  {{0x43, 0x4f, 0x10, 0xa4, 0xca, 0xdb, 0x38, 0x67,
1643  0xfa, 0xae, 0x96, 0xb5, 0x6d, 0x97, 0xff, 0x1f,
1644  0xb6, 0x83, 0x43, 0xd3, 0xa0, 0x2d, 0x70, 0x7a,
1645  0x64, 0x05, 0x4c, 0xa7, 0xc1, 0xa5, 0x21, 0x51},
1646  {0xe4, 0xf1, 0x23, 0x84, 0xe1, 0xb5, 0x9d, 0xf2,
1647  0xb8, 0x73, 0x8b, 0x45, 0x2b, 0x35, 0x46, 0x38,
1648  0x10, 0x2b, 0x50, 0xf8, 0x8b, 0x35, 0xcd, 0x34,
1649  0xc8, 0x0e, 0xf6, 0xdb, 0x09, 0x35, 0xf0, 0xda}},
1650  {{0xdb, 0x21, 0x5c, 0x8d, 0x83, 0x1d, 0xb3, 0x34,
1651  0xc7, 0x0e, 0x43, 0xa1, 0x58, 0x79, 0x67, 0x13,
1652  0x1e, 0x86, 0x5d, 0x89, 0x63, 0xe6, 0x0a, 0x46,
1653  0x5c, 0x02, 0x97, 0x1b, 0x62, 0x43, 0x86, 0xf5},
1654  {0xdb, 0x21, 0x5c, 0x8d, 0x83, 0x1d, 0xb3, 0x34,
1655  0xc7, 0x0e, 0x43, 0xa1, 0x58, 0x79, 0x67, 0x13,
1656  0x1e, 0x86, 0x5d, 0x89, 0x63, 0xe6, 0x0a, 0x46,
1657  0x5c, 0x02, 0x97, 0x1b, 0x62, 0x43, 0x86, 0xf5}}
1658  };
1659  secp256k1_scalar_set_int(&one, 1);
1660  for (i = 0; i < 33; i++) {
1661  secp256k1_scalar_set_b32(&x, chal[i][0], &overflow);
1662  CHECK(!overflow);
1663  secp256k1_scalar_set_b32(&y, chal[i][1], &overflow);
1664  CHECK(!overflow);
1665  secp256k1_scalar_set_b32(&r1, res[i][0], &overflow);
1666  CHECK(!overflow);
1667  secp256k1_scalar_set_b32(&r2, res[i][1], &overflow);
1668  CHECK(!overflow);
1669  secp256k1_scalar_mul(&z, &x, &y);
1670  CHECK(!secp256k1_scalar_check_overflow(&z));
1671  CHECK(secp256k1_scalar_eq(&r1, &z));
1672  if (!secp256k1_scalar_is_zero(&y)) {
1673  secp256k1_scalar_inverse(&zz, &y);
1674  CHECK(!secp256k1_scalar_check_overflow(&zz));
1675 #if defined(USE_SCALAR_INV_NUM)
1676  secp256k1_scalar_inverse_var(&zzv, &y);
1677  CHECK(secp256k1_scalar_eq(&zzv, &zz));
1678 #endif
1679  secp256k1_scalar_mul(&z, &z, &zz);
1680  CHECK(!secp256k1_scalar_check_overflow(&z));
1681  CHECK(secp256k1_scalar_eq(&x, &z));
1682  secp256k1_scalar_mul(&zz, &zz, &y);
1683  CHECK(!secp256k1_scalar_check_overflow(&zz));
1684  CHECK(secp256k1_scalar_eq(&one, &zz));
1685  }
1686  secp256k1_scalar_mul(&z, &x, &x);
1687  CHECK(!secp256k1_scalar_check_overflow(&z));
1688  secp256k1_scalar_sqr(&zz, &x);
1689  CHECK(!secp256k1_scalar_check_overflow(&zz));
1690  CHECK(secp256k1_scalar_eq(&zz, &z));
1691  CHECK(secp256k1_scalar_eq(&r2, &zz));
1692  }
1693  }
1694 }
1695 
1696 /***** FIELD TESTS *****/
1697 
1698 void random_fe(secp256k1_fe *x) {
1699  unsigned char bin[32];
1700  do {
1701  secp256k1_rand256(bin);
1702  if (secp256k1_fe_set_b32(x, bin)) {
1703  return;
1704  }
1705  } while(1);
1706 }
1707 
1708 void random_fe_test(secp256k1_fe *x) {
1709  unsigned char bin[32];
1710  do {
1711  secp256k1_rand256_test(bin);
1712  if (secp256k1_fe_set_b32(x, bin)) {
1713  return;
1714  }
1715  } while(1);
1716 }
1717 
1718 void random_fe_non_zero(secp256k1_fe *nz) {
1719  int tries = 10;
1720  while (--tries >= 0) {
1721  random_fe(nz);
1722  secp256k1_fe_normalize(nz);
1723  if (!secp256k1_fe_is_zero(nz)) {
1724  break;
1725  }
1726  }
1727  /* Infinitesimal probability of spurious failure here */
1728  CHECK(tries >= 0);
1729 }
1730 
1731 void random_fe_non_square(secp256k1_fe *ns) {
1732  secp256k1_fe r;
1733  random_fe_non_zero(ns);
1734  if (secp256k1_fe_sqrt(&r, ns)) {
1735  secp256k1_fe_negate(ns, ns, 1);
1736  }
1737 }
1738 
1739 int check_fe_equal(const secp256k1_fe *a, const secp256k1_fe *b) {
1740  secp256k1_fe an = *a;
1741  secp256k1_fe bn = *b;
1742  secp256k1_fe_normalize_weak(&an);
1743  secp256k1_fe_normalize_var(&bn);
1744  return secp256k1_fe_equal_var(&an, &bn);
1745 }
1746 
1747 int check_fe_inverse(const secp256k1_fe *a, const secp256k1_fe *ai) {
1748  secp256k1_fe x;
1749  secp256k1_fe one = SECP256K1_FE_CONST(0, 0, 0, 0, 0, 0, 0, 1);
1750  secp256k1_fe_mul(&x, a, ai);
1751  return check_fe_equal(&x, &one);
1752 }
1753 
1754 void run_field_convert(void) {
1755  static const unsigned char b32[32] = {
1756  0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07,
1757  0x11, 0x12, 0x13, 0x14, 0x15, 0x16, 0x17, 0x18,
1758  0x22, 0x23, 0x24, 0x25, 0x26, 0x27, 0x28, 0x29,
1759  0x33, 0x34, 0x35, 0x36, 0x37, 0x38, 0x39, 0x40
1760  };
1761  static const secp256k1_fe_storage fes = SECP256K1_FE_STORAGE_CONST(
1762  0x00010203UL, 0x04050607UL, 0x11121314UL, 0x15161718UL,
1763  0x22232425UL, 0x26272829UL, 0x33343536UL, 0x37383940UL
1764  );
1765  static const secp256k1_fe fe = SECP256K1_FE_CONST(
1766  0x00010203UL, 0x04050607UL, 0x11121314UL, 0x15161718UL,
1767  0x22232425UL, 0x26272829UL, 0x33343536UL, 0x37383940UL
1768  );
1769  secp256k1_fe fe2;
1770  unsigned char b322[32];
1771  secp256k1_fe_storage fes2;
1772  /* Check conversions to fe. */
1773  CHECK(secp256k1_fe_set_b32(&fe2, b32));
1774  CHECK(secp256k1_fe_equal_var(&fe, &fe2));
1775  secp256k1_fe_from_storage(&fe2, &fes);
1776  CHECK(secp256k1_fe_equal_var(&fe, &fe2));
1777  /* Check conversion from fe. */
1778  secp256k1_fe_get_b32(b322, &fe);
1779  CHECK(memcmp(b322, b32, 32) == 0);
1780  secp256k1_fe_to_storage(&fes2, &fe);
1781  CHECK(memcmp(&fes2, &fes, sizeof(fes)) == 0);
1782 }
1783 
1784 int fe_memcmp(const secp256k1_fe *a, const secp256k1_fe *b) {
1785  secp256k1_fe t = *b;
1786 #ifdef VERIFY
1787  t.magnitude = a->magnitude;
1788  t.normalized = a->normalized;
1789 #endif
1790  return memcmp(a, &t, sizeof(secp256k1_fe));
1791 }
1792 
1793 void run_field_misc(void) {
1794  secp256k1_fe x;
1795  secp256k1_fe y;
1796  secp256k1_fe z;
1797  secp256k1_fe q;
1798  secp256k1_fe fe5 = SECP256K1_FE_CONST(0, 0, 0, 0, 0, 0, 0, 5);
1799  int i, j;
1800  for (i = 0; i < 5*count; i++) {
1801  secp256k1_fe_storage xs, ys, zs;
1802  random_fe(&x);
1803  random_fe_non_zero(&y);
1804  /* Test the fe equality and comparison operations. */
1805  CHECK(secp256k1_fe_cmp_var(&x, &x) == 0);
1806  CHECK(secp256k1_fe_equal_var(&x, &x));
1807  z = x;
1808  secp256k1_fe_add(&z,&y);
1809  /* Test fe conditional move; z is not normalized here. */
1810  q = x;
1811  secp256k1_fe_cmov(&x, &z, 0);
1812  VERIFY_CHECK(!x.normalized && x.magnitude == z.magnitude);
1813  secp256k1_fe_cmov(&x, &x, 1);
1814  CHECK(fe_memcmp(&x, &z) != 0);
1815  CHECK(fe_memcmp(&x, &q) == 0);
1816  secp256k1_fe_cmov(&q, &z, 1);
1817  VERIFY_CHECK(!q.normalized && q.magnitude == z.magnitude);
1818  CHECK(fe_memcmp(&q, &z) == 0);
1819  secp256k1_fe_normalize_var(&x);
1820  secp256k1_fe_normalize_var(&z);
1821  CHECK(!secp256k1_fe_equal_var(&x, &z));
1822  secp256k1_fe_normalize_var(&q);
1823  secp256k1_fe_cmov(&q, &z, (i&1));
1824  VERIFY_CHECK(q.normalized && q.magnitude == 1);
1825  for (j = 0; j < 6; j++) {
1826  secp256k1_fe_negate(&z, &z, j+1);
1827  secp256k1_fe_normalize_var(&q);
1828  secp256k1_fe_cmov(&q, &z, (j&1));
1829  VERIFY_CHECK(!q.normalized && q.magnitude == (j+2));
1830  }
1831  secp256k1_fe_normalize_var(&z);
1832  /* Test storage conversion and conditional moves. */
1833  secp256k1_fe_to_storage(&xs, &x);
1834  secp256k1_fe_to_storage(&ys, &y);
1835  secp256k1_fe_to_storage(&zs, &z);
1836  secp256k1_fe_storage_cmov(&zs, &xs, 0);
1837  secp256k1_fe_storage_cmov(&zs, &zs, 1);
1838  CHECK(memcmp(&xs, &zs, sizeof(xs)) != 0);
1839  secp256k1_fe_storage_cmov(&ys, &xs, 1);
1840  CHECK(memcmp(&xs, &ys, sizeof(xs)) == 0);
1841  secp256k1_fe_from_storage(&x, &xs);
1842  secp256k1_fe_from_storage(&y, &ys);
1843  secp256k1_fe_from_storage(&z, &zs);
1844  /* Test that mul_int, mul, and add agree. */
1845  secp256k1_fe_add(&y, &x);
1846  secp256k1_fe_add(&y, &x);
1847  z = x;
1848  secp256k1_fe_mul_int(&z, 3);
1849  CHECK(check_fe_equal(&y, &z));
1850  secp256k1_fe_add(&y, &x);
1851  secp256k1_fe_add(&z, &x);
1852  CHECK(check_fe_equal(&z, &y));
1853  z = x;
1854  secp256k1_fe_mul_int(&z, 5);
1855  secp256k1_fe_mul(&q, &x, &fe5);
1856  CHECK(check_fe_equal(&z, &q));
1857  secp256k1_fe_negate(&x, &x, 1);
1858  secp256k1_fe_add(&z, &x);
1859  secp256k1_fe_add(&q, &x);
1860  CHECK(check_fe_equal(&y, &z));
1861  CHECK(check_fe_equal(&q, &y));
1862  }
1863 }
1864 
1865 void run_field_inv(void) {
1866  secp256k1_fe x, xi, xii;
1867  int i;
1868  for (i = 0; i < 10*count; i++) {
1869  random_fe_non_zero(&x);
1870  secp256k1_fe_inv(&xi, &x);
1871  CHECK(check_fe_inverse(&x, &xi));
1872  secp256k1_fe_inv(&xii, &xi);
1873  CHECK(check_fe_equal(&x, &xii));
1874  }
1875 }
1876 
1877 void run_field_inv_var(void) {
1878  secp256k1_fe x, xi, xii;
1879  int i;
1880  for (i = 0; i < 10*count; i++) {
1881  random_fe_non_zero(&x);
1882  secp256k1_fe_inv_var(&xi, &x);
1883  CHECK(check_fe_inverse(&x, &xi));
1884  secp256k1_fe_inv_var(&xii, &xi);
1885  CHECK(check_fe_equal(&x, &xii));
1886  }
1887 }
1888 
1889 void run_field_inv_all_var(void) {
1890  secp256k1_fe x[16], xi[16], xii[16];
1891  int i;
1892  /* Check it's safe to call for 0 elements */
1893  secp256k1_fe_inv_all_var(xi, x, 0);
1894  for (i = 0; i < count; i++) {
1895  size_t j;
1896  size_t len = secp256k1_rand_int(15) + 1;
1897  for (j = 0; j < len; j++) {
1898  random_fe_non_zero(&x[j]);
1899  }
1900  secp256k1_fe_inv_all_var(xi, x, len);
1901  for (j = 0; j < len; j++) {
1902  CHECK(check_fe_inverse(&x[j], &xi[j]));
1903  }
1904  secp256k1_fe_inv_all_var(xii, xi, len);
1905  for (j = 0; j < len; j++) {
1906  CHECK(check_fe_equal(&x[j], &xii[j]));
1907  }
1908  }
1909 }
1910 
1911 void run_sqr(void) {
1912  secp256k1_fe x, s;
1913 
1914  {
1915  int i;
1916  secp256k1_fe_set_int(&x, 1);
1917  secp256k1_fe_negate(&x, &x, 1);
1918 
1919  for (i = 1; i <= 512; ++i) {
1920  secp256k1_fe_mul_int(&x, 2);
1921  secp256k1_fe_normalize(&x);
1922  secp256k1_fe_sqr(&s, &x);
1923  }
1924  }
1925 }
1926 
1927 void test_sqrt(const secp256k1_fe *a, const secp256k1_fe *k) {
1928  secp256k1_fe r1, r2;
1929  int v = secp256k1_fe_sqrt(&r1, a);
1930  CHECK((v == 0) == (k == NULL));
1931 
1932  if (k != NULL) {
1933  /* Check that the returned root is +/- the given known answer */
1934  secp256k1_fe_negate(&r2, &r1, 1);
1935  secp256k1_fe_add(&r1, k); secp256k1_fe_add(&r2, k);
1936  secp256k1_fe_normalize(&r1); secp256k1_fe_normalize(&r2);
1937  CHECK(secp256k1_fe_is_zero(&r1) || secp256k1_fe_is_zero(&r2));
1938  }
1939 }
1940 
1941 void run_sqrt(void) {
1942  secp256k1_fe ns, x, s, t;
1943  int i;
1944 
1945  /* Check sqrt(0) is 0 */
1946  secp256k1_fe_set_int(&x, 0);
1947  secp256k1_fe_sqr(&s, &x);
1948  test_sqrt(&s, &x);
1949 
1950  /* Check sqrt of small squares (and their negatives) */
1951  for (i = 1; i <= 100; i++) {
1952  secp256k1_fe_set_int(&x, i);
1953  secp256k1_fe_sqr(&s, &x);
1954  test_sqrt(&s, &x);
1955  secp256k1_fe_negate(&t, &s, 1);
1956  test_sqrt(&t, NULL);
1957  }
1958 
1959  /* Consistency checks for large random values */
1960  for (i = 0; i < 10; i++) {
1961  int j;
1962  random_fe_non_square(&ns);
1963  for (j = 0; j < count; j++) {
1964  random_fe(&x);
1965  secp256k1_fe_sqr(&s, &x);
1966  test_sqrt(&s, &x);
1967  secp256k1_fe_negate(&t, &s, 1);
1968  test_sqrt(&t, NULL);
1969  secp256k1_fe_mul(&t, &s, &ns);
1970  test_sqrt(&t, NULL);
1971  }
1972  }
1973 }
1974 
1975 /***** GROUP TESTS *****/
1976 
1977 void ge_equals_ge(const secp256k1_ge *a, const secp256k1_ge *b) {
1978  CHECK(a->infinity == b->infinity);
1979  if (a->infinity) {
1980  return;
1981  }
1982  CHECK(secp256k1_fe_equal_var(&a->x, &b->x));
1983  CHECK(secp256k1_fe_equal_var(&a->y, &b->y));
1984 }
1985 
1986 /* This compares jacobian points including their Z, not just their geometric meaning. */
1987 int gej_xyz_equals_gej(const secp256k1_gej *a, const secp256k1_gej *b) {
1988  secp256k1_gej a2;
1989  secp256k1_gej b2;
1990  int ret = 1;
1991  ret &= a->infinity == b->infinity;
1992  if (ret && !a->infinity) {
1993  a2 = *a;
1994  b2 = *b;
1995  secp256k1_fe_normalize(&a2.x);
1996  secp256k1_fe_normalize(&a2.y);
1997  secp256k1_fe_normalize(&a2.z);
1998  secp256k1_fe_normalize(&b2.x);
1999  secp256k1_fe_normalize(&b2.y);
2000  secp256k1_fe_normalize(&b2.z);
2001  ret &= secp256k1_fe_cmp_var(&a2.x, &b2.x) == 0;
2002  ret &= secp256k1_fe_cmp_var(&a2.y, &b2.y) == 0;
2003  ret &= secp256k1_fe_cmp_var(&a2.z, &b2.z) == 0;
2004  }
2005  return ret;
2006 }
2007 
2008 void ge_equals_gej(const secp256k1_ge *a, const secp256k1_gej *b) {
2009  secp256k1_fe z2s;
2010  secp256k1_fe u1, u2, s1, s2;
2011  CHECK(a->infinity == b->infinity);
2012  if (a->infinity) {
2013  return;
2014  }
2015  /* Check a.x * b.z^2 == b.x && a.y * b.z^3 == b.y, to avoid inverses. */
2016  secp256k1_fe_sqr(&z2s, &b->z);
2017  secp256k1_fe_mul(&u1, &a->x, &z2s);
2018  u2 = b->x; secp256k1_fe_normalize_weak(&u2);
2019  secp256k1_fe_mul(&s1, &a->y, &z2s); secp256k1_fe_mul(&s1, &s1, &b->z);
2020  s2 = b->y; secp256k1_fe_normalize_weak(&s2);
2021  CHECK(secp256k1_fe_equal_var(&u1, &u2));
2022  CHECK(secp256k1_fe_equal_var(&s1, &s2));
2023 }
2024 
2025 void test_ge(void) {
2026  int i, i1;
2027 #ifdef USE_ENDOMORPHISM
2028  int runs = 6;
2029 #else
2030  int runs = 4;
2031 #endif
2032  /* Points: (infinity, p1, p1, -p1, -p1, p2, p2, -p2, -p2, p3, p3, -p3, -p3, p4, p4, -p4, -p4).
2033  * The second in each pair of identical points uses a random Z coordinate in the Jacobian form.
2034  * All magnitudes are randomized.
2035  * All 17*17 combinations of points are added to each other, using all applicable methods.
2036  *
2037  * When the endomorphism code is compiled in, p5 = lambda*p1 and p6 = lambda^2*p1 are added as well.
2038  */
2039  secp256k1_ge *ge = (secp256k1_ge *)checked_malloc(&ctx->error_callback, sizeof(secp256k1_ge) * (1 + 4 * runs));
2040  secp256k1_gej *gej = (secp256k1_gej *)checked_malloc(&ctx->error_callback, sizeof(secp256k1_gej) * (1 + 4 * runs));
2041  secp256k1_fe *zinv = (secp256k1_fe *)checked_malloc(&ctx->error_callback, sizeof(secp256k1_fe) * (1 + 4 * runs));
2042  secp256k1_fe zf;
2043  secp256k1_fe zfi2, zfi3;
2044 
2045  secp256k1_gej_set_infinity(&gej[0]);
2046  secp256k1_ge_clear(&ge[0]);
2047  secp256k1_ge_set_gej_var(&ge[0], &gej[0]);
2048  for (i = 0; i < runs; i++) {
2049  int j;
2050  secp256k1_ge g;
2051  random_group_element_test(&g);
2052 #ifdef USE_ENDOMORPHISM
2053  if (i >= runs - 2) {
2054  secp256k1_ge_mul_lambda(&g, &ge[1]);
2055  }
2056  if (i >= runs - 1) {
2057  secp256k1_ge_mul_lambda(&g, &g);
2058  }
2059 #endif
2060  ge[1 + 4 * i] = g;
2061  ge[2 + 4 * i] = g;
2062  secp256k1_ge_neg(&ge[3 + 4 * i], &g);
2063  secp256k1_ge_neg(&ge[4 + 4 * i], &g);
2064  secp256k1_gej_set_ge(&gej[1 + 4 * i], &ge[1 + 4 * i]);
2065  random_group_element_jacobian_test(&gej[2 + 4 * i], &ge[2 + 4 * i]);
2066  secp256k1_gej_set_ge(&gej[3 + 4 * i], &ge[3 + 4 * i]);
2067  random_group_element_jacobian_test(&gej[4 + 4 * i], &ge[4 + 4 * i]);
2068  for (j = 0; j < 4; j++) {
2069  random_field_element_magnitude(&ge[1 + j + 4 * i].x);
2070  random_field_element_magnitude(&ge[1 + j + 4 * i].y);
2071  random_field_element_magnitude(&gej[1 + j + 4 * i].x);
2072  random_field_element_magnitude(&gej[1 + j + 4 * i].y);
2073  random_field_element_magnitude(&gej[1 + j + 4 * i].z);
2074  }
2075  }
2076 
2077  /* Compute z inverses. */
2078  {
2079  secp256k1_fe *zs = checked_malloc(&ctx->error_callback, sizeof(secp256k1_fe) * (1 + 4 * runs));
2080  for (i = 0; i < 4 * runs + 1; i++) {
2081  if (i == 0) {
2082  /* The point at infinity does not have a meaningful z inverse. Any should do. */
2083  do {
2084  random_field_element_test(&zs[i]);
2085  } while(secp256k1_fe_is_zero(&zs[i]));
2086  } else {
2087  zs[i] = gej[i].z;
2088  }
2089  }
2090  secp256k1_fe_inv_all_var(zinv, zs, 4 * runs + 1);
2091  free(zs);
2092  }
2093 
2094  /* Generate random zf, and zfi2 = 1/zf^2, zfi3 = 1/zf^3 */
2095  do {
2096  random_field_element_test(&zf);
2097  } while(secp256k1_fe_is_zero(&zf));
2098  random_field_element_magnitude(&zf);
2099  secp256k1_fe_inv_var(&zfi3, &zf);
2100  secp256k1_fe_sqr(&zfi2, &zfi3);
2101  secp256k1_fe_mul(&zfi3, &zfi3, &zfi2);
2102 
2103  for (i1 = 0; i1 < 1 + 4 * runs; i1++) {
2104  int i2;
2105  for (i2 = 0; i2 < 1 + 4 * runs; i2++) {
2106  /* Compute reference result using gej + gej (var). */
2107  secp256k1_gej refj, resj;
2108  secp256k1_ge ref;
2109  secp256k1_fe zr;
2110  secp256k1_gej_add_var(&refj, &gej[i1], &gej[i2], secp256k1_gej_is_infinity(&gej[i1]) ? NULL : &zr);
2111  /* Check Z ratio. */
2112  if (!secp256k1_gej_is_infinity(&gej[i1]) && !secp256k1_gej_is_infinity(&refj)) {
2113  secp256k1_fe zrz; secp256k1_fe_mul(&zrz, &zr, &gej[i1].z);
2114  CHECK(secp256k1_fe_equal_var(&zrz, &refj.z));
2115  }
2116  secp256k1_ge_set_gej_var(&ref, &refj);
2117 
2118  /* Test gej + ge with Z ratio result (var). */
2119  secp256k1_gej_add_ge_var(&resj, &gej[i1], &ge[i2], secp256k1_gej_is_infinity(&gej[i1]) ? NULL : &zr);
2120  ge_equals_gej(&ref, &resj);
2121  if (!secp256k1_gej_is_infinity(&gej[i1]) && !secp256k1_gej_is_infinity(&resj)) {
2122  secp256k1_fe zrz; secp256k1_fe_mul(&zrz, &zr, &gej[i1].z);
2123  CHECK(secp256k1_fe_equal_var(&zrz, &resj.z));
2124  }
2125 
2126  /* Test gej + ge (var, with additional Z factor). */
2127  {
2128  secp256k1_ge ge2_zfi = ge[i2]; /* the second term with x and y rescaled for z = 1/zf */
2129  secp256k1_fe_mul(&ge2_zfi.x, &ge2_zfi.x, &zfi2);
2130  secp256k1_fe_mul(&ge2_zfi.y, &ge2_zfi.y, &zfi3);
2131  random_field_element_magnitude(&ge2_zfi.x);
2132  random_field_element_magnitude(&ge2_zfi.y);
2133  secp256k1_gej_add_zinv_var(&resj, &gej[i1], &ge2_zfi, &zf);
2134  ge_equals_gej(&ref, &resj);
2135  }
2136 
2137  /* Test gej + ge (const). */
2138  if (i2 != 0) {
2139  /* secp256k1_gej_add_ge does not support its second argument being infinity. */
2140  secp256k1_gej_add_ge(&resj, &gej[i1], &ge[i2]);
2141  ge_equals_gej(&ref, &resj);
2142  }
2143 
2144  /* Test doubling (var). */
2145  if ((i1 == 0 && i2 == 0) || ((i1 + 3)/4 == (i2 + 3)/4 && ((i1 + 3)%4)/2 == ((i2 + 3)%4)/2)) {
2146  secp256k1_fe zr2;
2147  /* Normal doubling with Z ratio result. */
2148  secp256k1_gej_double_var(&resj, &gej[i1], &zr2);
2149  ge_equals_gej(&ref, &resj);
2150  /* Check Z ratio. */
2151  secp256k1_fe_mul(&zr2, &zr2, &gej[i1].z);
2152  CHECK(secp256k1_fe_equal_var(&zr2, &resj.z));
2153  /* Normal doubling. */
2154  secp256k1_gej_double_var(&resj, &gej[i2], NULL);
2155  ge_equals_gej(&ref, &resj);
2156  }
2157 
2158  /* Test adding opposites. */
2159  if ((i1 == 0 && i2 == 0) || ((i1 + 3)/4 == (i2 + 3)/4 && ((i1 + 3)%4)/2 != ((i2 + 3)%4)/2)) {
2160  CHECK(secp256k1_ge_is_infinity(&ref));
2161  }
2162 
2163  /* Test adding infinity. */
2164  if (i1 == 0) {
2165  CHECK(secp256k1_ge_is_infinity(&ge[i1]));
2166  CHECK(secp256k1_gej_is_infinity(&gej[i1]));
2167  ge_equals_gej(&ref, &gej[i2]);
2168  }
2169  if (i2 == 0) {
2170  CHECK(secp256k1_ge_is_infinity(&ge[i2]));
2171  CHECK(secp256k1_gej_is_infinity(&gej[i2]));
2172  ge_equals_gej(&ref, &gej[i1]);
2173  }
2174  }
2175  }
2176 
2177  /* Test adding all points together in random order equals infinity. */
2178  {
2179  secp256k1_gej sum = SECP256K1_GEJ_CONST_INFINITY;
2180  secp256k1_gej *gej_shuffled = (secp256k1_gej *)checked_malloc(&ctx->error_callback, (4 * runs + 1) * sizeof(secp256k1_gej));
2181  for (i = 0; i < 4 * runs + 1; i++) {
2182  gej_shuffled[i] = gej[i];
2183  }
2184  for (i = 0; i < 4 * runs + 1; i++) {
2185  int swap = i + secp256k1_rand_int(4 * runs + 1 - i);
2186  if (swap != i) {
2187  secp256k1_gej t = gej_shuffled[i];
2188  gej_shuffled[i] = gej_shuffled[swap];
2189  gej_shuffled[swap] = t;
2190  }
2191  }
2192  for (i = 0; i < 4 * runs + 1; i++) {
2193  secp256k1_gej_add_var(&sum, &sum, &gej_shuffled[i], NULL);
2194  }
2195  CHECK(secp256k1_gej_is_infinity(&sum));
2196  free(gej_shuffled);
2197  }
2198 
2199  /* Test batch gej -> ge conversion with and without known z ratios. */
2200  {
2201  secp256k1_fe *zr = (secp256k1_fe *)checked_malloc(&ctx->error_callback, (4 * runs + 1) * sizeof(secp256k1_fe));
2202  secp256k1_ge *ge_set_table = (secp256k1_ge *)checked_malloc(&ctx->error_callback, (4 * runs + 1) * sizeof(secp256k1_ge));
2203  secp256k1_ge *ge_set_all = (secp256k1_ge *)checked_malloc(&ctx->error_callback, (4 * runs + 1) * sizeof(secp256k1_ge));
2204  for (i = 0; i < 4 * runs + 1; i++) {
2205  /* Compute gej[i + 1].z / gez[i].z (with gej[n].z taken to be 1). */
2206  if (i < 4 * runs) {
2207  secp256k1_fe_mul(&zr[i + 1], &zinv[i], &gej[i + 1].z);
2208  }
2209  }
2210  secp256k1_ge_set_table_gej_var(ge_set_table, gej, zr, 4 * runs + 1);
2211  secp256k1_ge_set_all_gej_var(ge_set_all, gej, 4 * runs + 1, &ctx->error_callback);
2212  for (i = 0; i < 4 * runs + 1; i++) {
2213  secp256k1_fe s;
2214  random_fe_non_zero(&s);
2215  secp256k1_gej_rescale(&gej[i], &s);
2216  ge_equals_gej(&ge_set_table[i], &gej[i]);
2217  ge_equals_gej(&ge_set_all[i], &gej[i]);
2218  }
2219  free(ge_set_table);
2220  free(ge_set_all);
2221  free(zr);
2222  }
2223 
2224  free(ge);
2225  free(gej);
2226  free(zinv);
2227 }
2228 
2229 void test_add_neg_y_diff_x(void) {
2230  /* The point of this test is to check that we can add two points
2231  * whose y-coordinates are negatives of each other but whose x
2232  * coordinates differ. If the x-coordinates were the same, these
2233  * points would be negatives of each other and their sum is
2234  * infinity. This is cool because it "covers up" any degeneracy
2235  * in the addition algorithm that would cause the xy coordinates
2236  * of the sum to be wrong (since infinity has no xy coordinates).
2237  * HOWEVER, if the x-coordinates are different, infinity is the
2238  * wrong answer, and such degeneracies are exposed. This is the
2239  * root of https://github.com/bitcoin-core/secp256k1/issues/257
2240  * which this test is a regression test for.
2241  *
2242  * These points were generated in sage as
2243  * # secp256k1 params
2244  * F = FiniteField (0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFFC2F)
2245  * C = EllipticCurve ([F (0), F (7)])
2246  * G = C.lift_x(0x79BE667EF9DCBBAC55A06295CE870B07029BFCDB2DCE28D959F2815B16F81798)
2247  * N = FiniteField(G.order())
2248  *
2249  * # endomorphism values (lambda is 1^{1/3} in N, beta is 1^{1/3} in F)
2250  * x = polygen(N)
2251  * lam = (1 - x^3).roots()[1][0]
2252  *
2253  * # random "bad pair"
2254  * P = C.random_element()
2255  * Q = -int(lam) * P
2256  * print " P: %x %x" % P.xy()
2257  * print " Q: %x %x" % Q.xy()
2258  * print "P + Q: %x %x" % (P + Q).xy()
2259  */
2260  secp256k1_gej aj = SECP256K1_GEJ_CONST(
2261  0x8d24cd95, 0x0a355af1, 0x3c543505, 0x44238d30,
2262  0x0643d79f, 0x05a59614, 0x2f8ec030, 0xd58977cb,
2263  0x001e337a, 0x38093dcd, 0x6c0f386d, 0x0b1293a8,
2264  0x4d72c879, 0xd7681924, 0x44e6d2f3, 0x9190117d
2265  );
2266  secp256k1_gej bj = SECP256K1_GEJ_CONST(
2267  0xc7b74206, 0x1f788cd9, 0xabd0937d, 0x164a0d86,
2268  0x95f6ff75, 0xf19a4ce9, 0xd013bd7b, 0xbf92d2a7,
2269  0xffe1cc85, 0xc7f6c232, 0x93f0c792, 0xf4ed6c57,
2270  0xb28d3786, 0x2897e6db, 0xbb192d0b, 0x6e6feab2
2271  );
2272  secp256k1_gej sumj = SECP256K1_GEJ_CONST(
2273  0x671a63c0, 0x3efdad4c, 0x389a7798, 0x24356027,
2274  0xb3d69010, 0x278625c3, 0x5c86d390, 0x184a8f7a,
2275  0x5f6409c2, 0x2ce01f2b, 0x511fd375, 0x25071d08,
2276  0xda651801, 0x70e95caf, 0x8f0d893c, 0xbed8fbbe
2277  );
2278  secp256k1_ge b;
2279  secp256k1_gej resj;
2280  secp256k1_ge res;
2281  secp256k1_ge_set_gej(&b, &bj);
2282 
2283  secp256k1_gej_add_var(&resj, &aj, &bj, NULL);
2284  secp256k1_ge_set_gej(&res, &resj);
2285  ge_equals_gej(&res, &sumj);
2286 
2287  secp256k1_gej_add_ge(&resj, &aj, &b);
2288  secp256k1_ge_set_gej(&res, &resj);
2289  ge_equals_gej(&res, &sumj);
2290 
2291  secp256k1_gej_add_ge_var(&resj, &aj, &b, NULL);
2292  secp256k1_ge_set_gej(&res, &resj);
2293  ge_equals_gej(&res, &sumj);
2294 }
2295 
2296 void run_ge(void) {
2297  int i;
2298  for (i = 0; i < count * 32; i++) {
2299  test_ge();
2300  }
2301  test_add_neg_y_diff_x();
2302 }
2303 
2304 void test_ec_combine(void) {
2305  secp256k1_scalar sum = SECP256K1_SCALAR_CONST(0, 0, 0, 0, 0, 0, 0, 0);
2306  secp256k1_pubkey2 data[6];
2307  const secp256k1_pubkey2* d[6];
2308  secp256k1_pubkey2 sd;
2309  secp256k1_pubkey2 sd2;
2310  secp256k1_gej Qj;
2311  secp256k1_ge Q;
2312  int i;
2313  for (i = 1; i <= 6; i++) {
2314  secp256k1_scalar s;
2315  random_scalar_order_test(&s);
2316  secp256k1_scalar_add(&sum, &sum, &s);
2317  secp256k1_ecmult_gen(&ctx->ecmult_gen_ctx, &Qj, &s);
2318  secp256k1_ge_set_gej(&Q, &Qj);
2319  secp256k1_pubkey2_save(&data[i - 1], &Q);
2320  d[i - 1] = &data[i - 1];
2321  secp256k1_ecmult_gen(&ctx->ecmult_gen_ctx, &Qj, &sum);
2322  secp256k1_ge_set_gej(&Q, &Qj);
2323  secp256k1_pubkey2_save(&sd, &Q);
2324  CHECK(secp256k1_ec_pubkey_combine2(ctx, &sd2, d, i) == 1);
2325  CHECK(memcmp(&sd, &sd2, sizeof(sd)) == 0);
2326  }
2327 }
2328 
2329 void run_ec_combine(void) {
2330  int i;
2331  for (i = 0; i < count * 8; i++) {
2332  test_ec_combine();
2333  }
2334 }
2335 
2336 void test_group_decompress(const secp256k1_fe* x) {
2337  /* The input itself, normalized. */
2338  secp256k1_fe fex = *x;
2339  secp256k1_fe fez;
2340  /* Results of set_xquad_var, set_xo_var(..., 0), set_xo_var(..., 1). */
2341  secp256k1_ge ge_quad, ge_even, ge_odd;
2342  secp256k1_gej gej_quad;
2343  /* Return values of the above calls. */
2344  int res_quad, res_even, res_odd;
2345 
2346  secp256k1_fe_normalize_var(&fex);
2347 
2348  res_quad = secp256k1_ge_set_xquad(&ge_quad, &fex);
2349  res_even = secp256k1_ge_set_xo_var(&ge_even, &fex, 0);
2350  res_odd = secp256k1_ge_set_xo_var(&ge_odd, &fex, 1);
2351 
2352  CHECK(res_quad == res_even);
2353  CHECK(res_quad == res_odd);
2354 
2355  if (res_quad) {
2356  secp256k1_fe_normalize_var(&ge_quad.x);
2357  secp256k1_fe_normalize_var(&ge_odd.x);
2358  secp256k1_fe_normalize_var(&ge_even.x);
2359  secp256k1_fe_normalize_var(&ge_quad.y);
2360  secp256k1_fe_normalize_var(&ge_odd.y);
2361  secp256k1_fe_normalize_var(&ge_even.y);
2362 
2363  /* No infinity allowed. */
2364  CHECK(!ge_quad.infinity);
2365  CHECK(!ge_even.infinity);
2366  CHECK(!ge_odd.infinity);
2367 
2368  /* Check that the x coordinates check out. */
2369  CHECK(secp256k1_fe_equal_var(&ge_quad.x, x));
2370  CHECK(secp256k1_fe_equal_var(&ge_even.x, x));
2371  CHECK(secp256k1_fe_equal_var(&ge_odd.x, x));
2372 
2373  /* Check that the Y coordinate result in ge_quad is a square. */
2374  CHECK(secp256k1_fe_is_quad_var(&ge_quad.y));
2375 
2376  /* Check odd/even Y in ge_odd, ge_even. */
2377  CHECK(secp256k1_fe_is_odd(&ge_odd.y));
2378  CHECK(!secp256k1_fe_is_odd(&ge_even.y));
2379 
2380  /* Check secp256k1_gej_has_quad_y_var. */
2381  secp256k1_gej_set_ge(&gej_quad, &ge_quad);
2382  CHECK(secp256k1_gej_has_quad_y_var(&gej_quad));
2383  do {
2384  random_fe_test(&fez);
2385  } while (secp256k1_fe_is_zero(&fez));
2386  secp256k1_gej_rescale(&gej_quad, &fez);
2387  CHECK(secp256k1_gej_has_quad_y_var(&gej_quad));
2388  secp256k1_gej_neg(&gej_quad, &gej_quad);
2389  CHECK(!secp256k1_gej_has_quad_y_var(&gej_quad));
2390  do {
2391  random_fe_test(&fez);
2392  } while (secp256k1_fe_is_zero(&fez));
2393  secp256k1_gej_rescale(&gej_quad, &fez);
2394  CHECK(!secp256k1_gej_has_quad_y_var(&gej_quad));
2395  secp256k1_gej_neg(&gej_quad, &gej_quad);
2396  CHECK(secp256k1_gej_has_quad_y_var(&gej_quad));
2397  }
2398 }
2399 
2400 void run_group_decompress(void) {
2401  int i;
2402  for (i = 0; i < count * 4; i++) {
2403  secp256k1_fe fe;
2404  random_fe_test(&fe);
2405  test_group_decompress(&fe);
2406  }
2407 }
2408 
2409 /***** ECMULT TESTS *****/
2410 
2411 void run_ecmult_chain(void) {
2412  /* random starting point A (on the curve) */
2413  secp256k1_gej a = SECP256K1_GEJ_CONST(
2414  0x8b30bbe9, 0xae2a9906, 0x96b22f67, 0x0709dff3,
2415  0x727fd8bc, 0x04d3362c, 0x6c7bf458, 0xe2846004,
2416  0xa357ae91, 0x5c4a6528, 0x1309edf2, 0x0504740f,
2417  0x0eb33439, 0x90216b4f, 0x81063cb6, 0x5f2f7e0f
2418  );
2419  /* two random initial factors xn and gn */
2420  secp256k1_scalar xn = SECP256K1_SCALAR_CONST(
2421  0x84cc5452, 0xf7fde1ed, 0xb4d38a8c, 0xe9b1b84c,
2422  0xcef31f14, 0x6e569be9, 0x705d357a, 0x42985407
2423  );
2424  secp256k1_scalar gn = SECP256K1_SCALAR_CONST(
2425  0xa1e58d22, 0x553dcd42, 0xb2398062, 0x5d4c57a9,
2426  0x6e9323d4, 0x2b3152e5, 0xca2c3990, 0xedc7c9de
2427  );
2428  /* two small multipliers to be applied to xn and gn in every iteration: */
2429  static const secp256k1_scalar xf = SECP256K1_SCALAR_CONST(0, 0, 0, 0, 0, 0, 0, 0x1337);
2430  static const secp256k1_scalar gf = SECP256K1_SCALAR_CONST(0, 0, 0, 0, 0, 0, 0, 0x7113);
2431  /* accumulators with the resulting coefficients to A and G */
2432  secp256k1_scalar ae = SECP256K1_SCALAR_CONST(0, 0, 0, 0, 0, 0, 0, 1);
2433  secp256k1_scalar ge = SECP256K1_SCALAR_CONST(0, 0, 0, 0, 0, 0, 0, 0);
2434  /* actual points */
2435  secp256k1_gej x;
2436  secp256k1_gej x2;
2437  int i;
2438 
2439  /* the point being computed */
2440  x = a;
2441  for (i = 0; i < 200*count; i++) {
2442  /* in each iteration, compute X = xn*X + gn*G; */
2443  secp256k1_ecmult(&ctx->ecmult_ctx, &x, &x, &xn, &gn);
2444  /* also compute ae and ge: the actual accumulated factors for A and G */
2445  /* if X was (ae*A+ge*G), xn*X + gn*G results in (xn*ae*A + (xn*ge+gn)*G) */
2446  secp256k1_scalar_mul(&ae, &ae, &xn);
2447  secp256k1_scalar_mul(&ge, &ge, &xn);
2448  secp256k1_scalar_add(&ge, &ge, &gn);
2449  /* modify xn and gn */
2450  secp256k1_scalar_mul(&xn, &xn, &xf);
2451  secp256k1_scalar_mul(&gn, &gn, &gf);
2452 
2453  /* verify */
2454  if (i == 19999) {
2455  /* expected result after 19999 iterations */
2456  secp256k1_gej rp = SECP256K1_GEJ_CONST(
2457  0xD6E96687, 0xF9B10D09, 0x2A6F3543, 0x9D86CEBE,
2458  0xA4535D0D, 0x409F5358, 0x6440BD74, 0xB933E830,
2459  0xB95CBCA2, 0xC77DA786, 0x539BE8FD, 0x53354D2D,
2460  0x3B4F566A, 0xE6580454, 0x07ED6015, 0xEE1B2A88
2461  );
2462 
2463  secp256k1_gej_neg(&rp, &rp);
2464  secp256k1_gej_add_var(&rp, &rp, &x, NULL);
2465  CHECK(secp256k1_gej_is_infinity(&rp));
2466  }
2467  }
2468  /* redo the computation, but directly with the resulting ae and ge coefficients: */
2469  secp256k1_ecmult(&ctx->ecmult_ctx, &x2, &a, &ae, &ge);
2470  secp256k1_gej_neg(&x2, &x2);
2471  secp256k1_gej_add_var(&x2, &x2, &x, NULL);
2472  CHECK(secp256k1_gej_is_infinity(&x2));
2473 }
2474 
2475 void test_point_times_order(const secp256k1_gej *point) {
2476  /* X * (point + G) + (order-X) * (pointer + G) = 0 */
2477  secp256k1_scalar x;
2478  secp256k1_scalar nx;
2479  secp256k1_scalar zero = SECP256K1_SCALAR_CONST(0, 0, 0, 0, 0, 0, 0, 0);
2480  secp256k1_scalar one = SECP256K1_SCALAR_CONST(0, 0, 0, 0, 0, 0, 0, 1);
2481  secp256k1_gej res1, res2;
2482  secp256k1_ge res3;
2483  unsigned char pub[65];
2484  size_t psize = 65;
2485  random_scalar_order_test(&x);
2486  secp256k1_scalar_negate(&nx, &x);
2487  secp256k1_ecmult(&ctx->ecmult_ctx, &res1, point, &x, &x); /* calc res1 = x * point + x * G; */
2488  secp256k1_ecmult(&ctx->ecmult_ctx, &res2, point, &nx, &nx); /* calc res2 = (order - x) * point + (order - x) * G; */
2489  secp256k1_gej_add_var(&res1, &res1, &res2, NULL);
2490  CHECK(secp256k1_gej_is_infinity(&res1));
2491  CHECK(secp256k1_gej_is_valid_var(&res1) == 0);
2492  secp256k1_ge_set_gej(&res3, &res1);
2493  CHECK(secp256k1_ge_is_infinity(&res3));
2494  CHECK(secp256k1_ge_is_valid_var(&res3) == 0);
2495  CHECK(secp256k1_eckey_pubkey_serialize(&res3, pub, &psize, 0) == 0);
2496  psize = 65;
2497  CHECK(secp256k1_eckey_pubkey_serialize(&res3, pub, &psize, 1) == 0);
2498  /* check zero/one edge cases */
2499  secp256k1_ecmult(&ctx->ecmult_ctx, &res1, point, &zero, &zero);
2500  secp256k1_ge_set_gej(&res3, &res1);
2501  CHECK(secp256k1_ge_is_infinity(&res3));
2502  secp256k1_ecmult(&ctx->ecmult_ctx, &res1, point, &one, &zero);
2503  secp256k1_ge_set_gej(&res3, &res1);
2504  ge_equals_gej(&res3, point);
2505  secp256k1_ecmult(&ctx->ecmult_ctx, &res1, point, &zero, &one);
2506  secp256k1_ge_set_gej(&res3, &res1);
2507  ge_equals_ge(&res3, &secp256k1_ge_const_g);
2508 }
2509 
2510 void run_point_times_order(void) {
2511  int i;
2512  secp256k1_fe x = SECP256K1_FE_CONST(0, 0, 0, 0, 0, 0, 0, 2);
2513  static const secp256k1_fe xr = SECP256K1_FE_CONST(
2514  0x7603CB59, 0xB0EF6C63, 0xFE608479, 0x2A0C378C,
2515  0xDB3233A8, 0x0F8A9A09, 0xA877DEAD, 0x31B38C45
2516  );
2517  for (i = 0; i < 500; i++) {
2518  secp256k1_ge p;
2519  if (secp256k1_ge_set_xo_var(&p, &x, 1)) {
2520  secp256k1_gej j;
2521  CHECK(secp256k1_ge_is_valid_var(&p));
2522  secp256k1_gej_set_ge(&j, &p);
2523  CHECK(secp256k1_gej_is_valid_var(&j));
2524  test_point_times_order(&j);
2525  }
2526  secp256k1_fe_sqr(&x, &x);
2527  }
2528  secp256k1_fe_normalize_var(&x);
2529  CHECK(secp256k1_fe_equal_var(&x, &xr));
2530 }
2531 
2532 void ecmult_const_random_mult(void) {
2533  /* random starting point A (on the curve) */
2534  secp256k1_ge a = SECP256K1_GE_CONST(
2535  0x6d986544, 0x57ff52b8, 0xcf1b8126, 0x5b802a5b,
2536  0xa97f9263, 0xb1e88044, 0x93351325, 0x91bc450a,
2537  0x535c59f7, 0x325e5d2b, 0xc391fbe8, 0x3c12787c,
2538  0x337e4a98, 0xe82a9011, 0x0123ba37, 0xdd769c7d
2539  );
2540  /* random initial factor xn */
2541  secp256k1_scalar xn = SECP256K1_SCALAR_CONST(
2542  0x649d4f77, 0xc4242df7, 0x7f2079c9, 0x14530327,
2543  0xa31b876a, 0xd2d8ce2a, 0x2236d5c6, 0xd7b2029b
2544  );
2545  /* expected xn * A (from sage) */
2546  secp256k1_ge expected_b = SECP256K1_GE_CONST(
2547  0x23773684, 0x4d209dc7, 0x098a786f, 0x20d06fcd,
2548  0x070a38bf, 0xc11ac651, 0x03004319, 0x1e2a8786,
2549  0xed8c3b8e, 0xc06dd57b, 0xd06ea66e, 0x45492b0f,
2550  0xb84e4e1b, 0xfb77e21f, 0x96baae2a, 0x63dec956
2551  );
2552  secp256k1_gej b;
2553  secp256k1_ecmult_const(&b, &a, &xn, 256);
2554 
2555  CHECK(secp256k1_ge_is_valid_var(&a));
2556  ge_equals_gej(&expected_b, &b);
2557 }
2558 
2559 void ecmult_const_commutativity(void) {
2560  secp256k1_scalar a;
2561  secp256k1_scalar b;
2562  secp256k1_gej res1;
2563  secp256k1_gej res2;
2564  secp256k1_ge mid1;
2565  secp256k1_ge mid2;
2566  random_scalar_order_test(&a);
2567  random_scalar_order_test(&b);
2568 
2569  secp256k1_ecmult_const(&res1, &secp256k1_ge_const_g, &a, 256);
2570  secp256k1_ecmult_const(&res2, &secp256k1_ge_const_g, &b, 256);
2571  secp256k1_ge_set_gej(&mid1, &res1);
2572  secp256k1_ge_set_gej(&mid2, &res2);
2573  secp256k1_ecmult_const(&res1, &mid1, &b, 256);
2574  secp256k1_ecmult_const(&res2, &mid2, &a, 256);
2575  secp256k1_ge_set_gej(&mid1, &res1);
2576  secp256k1_ge_set_gej(&mid2, &res2);
2577  ge_equals_ge(&mid1, &mid2);
2578 }
2579 
2580 void ecmult_const_mult_zero_one(void) {
2581  secp256k1_scalar zero = SECP256K1_SCALAR_CONST(0, 0, 0, 0, 0, 0, 0, 0);
2582  secp256k1_scalar one = SECP256K1_SCALAR_CONST(0, 0, 0, 0, 0, 0, 0, 1);
2583  secp256k1_scalar negone;
2584  secp256k1_gej res1;
2585  secp256k1_ge res2;
2586  secp256k1_ge point;
2587  secp256k1_scalar_negate(&negone, &one);
2588 
2589  random_group_element_test(&point);
2590  secp256k1_ecmult_const(&res1, &point, &zero, 3);
2591  secp256k1_ge_set_gej(&res2, &res1);
2592  CHECK(secp256k1_ge_is_infinity(&res2));
2593  secp256k1_ecmult_const(&res1, &point, &one, 2);
2594  secp256k1_ge_set_gej(&res2, &res1);
2595  ge_equals_ge(&res2, &point);
2596  secp256k1_ecmult_const(&res1, &point, &negone, 256);
2597  secp256k1_gej_neg(&res1, &res1);
2598  secp256k1_ge_set_gej(&res2, &res1);
2599  ge_equals_ge(&res2, &point);
2600 }
2601 
2602 void ecmult_const_chain_multiply(void) {
2603  /* Check known result (randomly generated test problem from sage) */
2604  const secp256k1_scalar scalar = SECP256K1_SCALAR_CONST(
2605  0x4968d524, 0x2abf9b7a, 0x466abbcf, 0x34b11b6d,
2606  0xcd83d307, 0x827bed62, 0x05fad0ce, 0x18fae63b
2607  );
2608  const secp256k1_gej expected_point = SECP256K1_GEJ_CONST(
2609  0x5494c15d, 0x32099706, 0xc2395f94, 0x348745fd,
2610  0x757ce30e, 0x4e8c90fb, 0xa2bad184, 0xf883c69f,
2611  0x5d195d20, 0xe191bf7f, 0x1be3e55f, 0x56a80196,
2612  0x6071ad01, 0xf1462f66, 0xc997fa94, 0xdb858435
2613  );
2614  secp256k1_gej point;
2615  secp256k1_ge res;
2616  int i;
2617 
2618  secp256k1_gej_set_ge(&point, &secp256k1_ge_const_g);
2619  for (i = 0; i < 100; ++i) {
2620  secp256k1_ge tmp;
2621  secp256k1_ge_set_gej(&tmp, &point);
2622  secp256k1_ecmult_const(&point, &tmp, &scalar, 256);
2623  }
2624  secp256k1_ge_set_gej(&res, &point);
2625  ge_equals_gej(&res, &expected_point);
2626 }
2627 
2628 void run_ecmult_const_tests(void) {
2629  ecmult_const_mult_zero_one();
2630  ecmult_const_random_mult();
2631  ecmult_const_commutativity();
2632  ecmult_const_chain_multiply();
2633 }
2634 
2635 typedef struct {
2636  secp256k1_scalar *sc;
2637  secp256k1_ge *pt;
2638 } ecmult_multi_data;
2639 
2640 static int ecmult_multi_callback(secp256k1_scalar *sc, secp256k1_ge *pt, size_t idx, void *cbdata) {
2641  ecmult_multi_data *data = (ecmult_multi_data*) cbdata;
2642  *sc = data->sc[idx];
2643  *pt = data->pt[idx];
2644  return 1;
2645 }
2646 
2647 static int ecmult_multi_false_callback(secp256k1_scalar *sc, secp256k1_ge *pt, size_t idx, void *cbdata) {
2648  (void)sc;
2649  (void)pt;
2650  (void)idx;
2651  (void)cbdata;
2652  return 0;
2653 }
2654 
2655 void test_ecmult_multi(secp256k1_scratch *scratch, secp256k1_ecmult_multi_func ecmult_multi) {
2656  int ncount;
2657  secp256k1_scalar szero;
2658  secp256k1_scalar sc[32];
2659  secp256k1_ge pt[32];
2660  secp256k1_gej r;
2661  secp256k1_gej r2;
2662  ecmult_multi_data data;
2663  secp256k1_scratch *scratch_empty;
2664 
2665  data.sc = sc;
2666  data.pt = pt;
2667  secp256k1_scalar_set_int(&szero, 0);
2668 
2669  /* No points to multiply */
2670  CHECK(ecmult_multi(&ctx->ecmult_ctx, scratch, &r, NULL, ecmult_multi_callback, &data, 0));
2671 
2672  /* Check 1- and 2-point multiplies against ecmult */
2673  for (ncount = 0; ncount < count; ncount++) {
2674  secp256k1_ge ptg;
2675  secp256k1_gej ptgj;
2676  random_scalar_order(&sc[0]);
2677  random_scalar_order(&sc[1]);
2678 
2679  random_group_element_test(&ptg);
2680  secp256k1_gej_set_ge(&ptgj, &ptg);
2681  pt[0] = ptg;
2682  pt[1] = secp256k1_ge_const_g;
2683 
2684  /* only G scalar */
2685  secp256k1_ecmult(&ctx->ecmult_ctx, &r2, &ptgj, &szero, &sc[0]);
2686  CHECK(ecmult_multi(&ctx->ecmult_ctx, scratch, &r, &sc[0], ecmult_multi_callback, &data, 0));
2687  secp256k1_gej_neg(&r2, &r2);
2688  secp256k1_gej_add_var(&r, &r, &r2, NULL);
2689  CHECK(secp256k1_gej_is_infinity(&r));
2690 
2691  /* 1-point */
2692  secp256k1_ecmult(&ctx->ecmult_ctx, &r2, &ptgj, &sc[0], &szero);
2693  CHECK(ecmult_multi(&ctx->ecmult_ctx, scratch, &r, &szero, ecmult_multi_callback, &data, 1));
2694  secp256k1_gej_neg(&r2, &r2);
2695  secp256k1_gej_add_var(&r, &r, &r2, NULL);
2696  CHECK(secp256k1_gej_is_infinity(&r));
2697 
2698  /* Try to multiply 1 point, but scratch space is empty */
2699  scratch_empty = secp256k1_scratch_create(&ctx->error_callback, 0);
2700  CHECK(!ecmult_multi(&ctx->ecmult_ctx, scratch_empty, &r, &szero, ecmult_multi_callback, &data, 1));
2701  secp256k1_scratch_destroy(scratch_empty);
2702 
2703  /* Try to multiply 1 point, but callback returns false */
2704  CHECK(!ecmult_multi(&ctx->ecmult_ctx, scratch, &r, &szero, ecmult_multi_false_callback, &data, 1));
2705 
2706  /* 2-point */
2707  secp256k1_ecmult(&ctx->ecmult_ctx, &r2, &ptgj, &sc[0], &sc[1]);
2708  CHECK(ecmult_multi(&ctx->ecmult_ctx, scratch, &r, &szero, ecmult_multi_callback, &data, 2));
2709  secp256k1_gej_neg(&r2, &r2);
2710  secp256k1_gej_add_var(&r, &r, &r2, NULL);
2711  CHECK(secp256k1_gej_is_infinity(&r));
2712 
2713  /* 2-point with G scalar */
2714  secp256k1_ecmult(&ctx->ecmult_ctx, &r2, &ptgj, &sc[0], &sc[1]);
2715  CHECK(ecmult_multi(&ctx->ecmult_ctx, scratch, &r, &sc[1], ecmult_multi_callback, &data, 1));
2716  secp256k1_gej_neg(&r2, &r2);
2717  secp256k1_gej_add_var(&r, &r, &r2, NULL);
2718  CHECK(secp256k1_gej_is_infinity(&r));
2719  }
2720 
2721  /* Check infinite outputs of various forms */
2722  for (ncount = 0; ncount < count; ncount++) {
2723  secp256k1_ge ptg;
2724  size_t i, j;
2725  size_t sizes[] = { 2, 10, 32 };
2726 
2727  for (j = 0; j < 3; j++) {
2728  for (i = 0; i < 32; i++) {
2729  random_scalar_order(&sc[i]);
2730  secp256k1_ge_set_infinity(&pt[i]);
2731  }
2732  CHECK(ecmult_multi(&ctx->ecmult_ctx, scratch, &r, &szero, ecmult_multi_callback, &data, sizes[j]));
2733  CHECK(secp256k1_gej_is_infinity(&r));
2734  }
2735 
2736  for (j = 0; j < 3; j++) {
2737  for (i = 0; i < 32; i++) {
2738  random_group_element_test(&ptg);
2739  pt[i] = ptg;
2740  secp256k1_scalar_set_int(&sc[i], 0);
2741  }
2742  CHECK(ecmult_multi(&ctx->ecmult_ctx, scratch, &r, &szero, ecmult_multi_callback, &data, sizes[j]));
2743  CHECK(secp256k1_gej_is_infinity(&r));
2744  }
2745 
2746  for (j = 0; j < 3; j++) {
2747  random_group_element_test(&ptg);
2748  for (i = 0; i < 16; i++) {
2749  random_scalar_order(&sc[2*i]);
2750  secp256k1_scalar_negate(&sc[2*i + 1], &sc[2*i]);
2751  pt[2 * i] = ptg;
2752  pt[2 * i + 1] = ptg;
2753  }
2754 
2755  CHECK(ecmult_multi(&ctx->ecmult_ctx, scratch, &r, &szero, ecmult_multi_callback, &data, sizes[j]));
2756  CHECK(secp256k1_gej_is_infinity(&r));
2757 
2758  random_scalar_order(&sc[0]);
2759  for (i = 0; i < 16; i++) {
2760  random_group_element_test(&ptg);
2761 
2762  sc[2*i] = sc[0];
2763  sc[2*i+1] = sc[0];
2764  pt[2 * i] = ptg;
2765  secp256k1_ge_neg(&pt[2*i+1], &pt[2*i]);
2766  }
2767 
2768  CHECK(ecmult_multi(&ctx->ecmult_ctx, scratch, &r, &szero, ecmult_multi_callback, &data, sizes[j]));
2769  CHECK(secp256k1_gej_is_infinity(&r));
2770  }
2771 
2772  random_group_element_test(&ptg);
2773  secp256k1_scalar_set_int(&sc[0], 0);
2774  pt[0] = ptg;
2775  for (i = 1; i < 32; i++) {
2776  pt[i] = ptg;
2777 
2778  random_scalar_order(&sc[i]);
2779  secp256k1_scalar_add(&sc[0], &sc[0], &sc[i]);
2780  secp256k1_scalar_negate(&sc[i], &sc[i]);
2781  }
2782 
2783  CHECK(ecmult_multi(&ctx->ecmult_ctx, scratch, &r, &szero, ecmult_multi_callback, &data, 32));
2784  CHECK(secp256k1_gej_is_infinity(&r));
2785  }
2786 
2787  /* Check random points, constant scalar */
2788  for (ncount = 0; ncount < count; ncount++) {
2789  size_t i;
2790  secp256k1_gej_set_infinity(&r);
2791 
2792  random_scalar_order(&sc[0]);
2793  for (i = 0; i < 20; i++) {
2794  secp256k1_ge ptg;
2795  sc[i] = sc[0];
2796  random_group_element_test(&ptg);
2797  pt[i] = ptg;
2798  secp256k1_gej_add_ge_var(&r, &r, &pt[i], NULL);
2799  }
2800 
2801  secp256k1_ecmult(&ctx->ecmult_ctx, &r2, &r, &sc[0], &szero);
2802  CHECK(ecmult_multi(&ctx->ecmult_ctx, scratch, &r, &szero, ecmult_multi_callback, &data, 20));
2803  secp256k1_gej_neg(&r2, &r2);
2804  secp256k1_gej_add_var(&r, &r, &r2, NULL);
2805  CHECK(secp256k1_gej_is_infinity(&r));
2806  }
2807 
2808  /* Check random scalars, constant point */
2809  for (ncount = 0; ncount < count; ncount++) {
2810  size_t i;
2811  secp256k1_ge ptg;
2812  secp256k1_gej p0j;
2813  secp256k1_scalar rs;
2814  secp256k1_scalar_set_int(&rs, 0);
2815 
2816  random_group_element_test(&ptg);
2817  for (i = 0; i < 20; i++) {
2818  random_scalar_order(&sc[i]);
2819  pt[i] = ptg;
2820  secp256k1_scalar_add(&rs, &rs, &sc[i]);
2821  }
2822 
2823  secp256k1_gej_set_ge(&p0j, &pt[0]);
2824  secp256k1_ecmult(&ctx->ecmult_ctx, &r2, &p0j, &rs, &szero);
2825  CHECK(ecmult_multi(&ctx->ecmult_ctx, scratch, &r, &szero, ecmult_multi_callback, &data, 20));
2826  secp256k1_gej_neg(&r2, &r2);
2827  secp256k1_gej_add_var(&r, &r, &r2, NULL);
2828  CHECK(secp256k1_gej_is_infinity(&r));
2829  }
2830 
2831  /* Sanity check that zero scalars don't cause problems */
2832  secp256k1_scalar_clear(&sc[0]);
2833  CHECK(ecmult_multi(&ctx->ecmult_ctx, scratch, &r, &szero, ecmult_multi_callback, &data, 20));
2834  secp256k1_scalar_clear(&sc[1]);
2835  secp256k1_scalar_clear(&sc[2]);
2836  secp256k1_scalar_clear(&sc[3]);
2837  secp256k1_scalar_clear(&sc[4]);
2838  CHECK(ecmult_multi(&ctx->ecmult_ctx, scratch, &r, &szero, ecmult_multi_callback, &data, 6));
2839  CHECK(ecmult_multi(&ctx->ecmult_ctx, scratch, &r, &szero, ecmult_multi_callback, &data, 5));
2840  CHECK(secp256k1_gej_is_infinity(&r));
2841 
2842  /* Run through s0*(t0*P) + s1*(t1*P) exhaustively for many small values of s0, s1, t0, t1 */
2843  {
2844  const size_t TOP = 8;
2845  size_t s0i, s1i;
2846  size_t t0i, t1i;
2847  secp256k1_ge ptg;
2848  secp256k1_gej ptgj;
2849 
2850  random_group_element_test(&ptg);
2851  secp256k1_gej_set_ge(&ptgj, &ptg);
2852 
2853  for(t0i = 0; t0i < TOP; t0i++) {
2854  for(t1i = 0; t1i < TOP; t1i++) {
2855  secp256k1_gej t0p, t1p;
2856  secp256k1_scalar t0, t1;
2857 
2858  secp256k1_scalar_set_int(&t0, (t0i + 1) / 2);
2859  secp256k1_scalar_cond_negate(&t0, t0i & 1);
2860  secp256k1_scalar_set_int(&t1, (t1i + 1) / 2);
2861  secp256k1_scalar_cond_negate(&t1, t1i & 1);
2862 
2863  secp256k1_ecmult(&ctx->ecmult_ctx, &t0p, &ptgj, &t0, &szero);
2864  secp256k1_ecmult(&ctx->ecmult_ctx, &t1p, &ptgj, &t1, &szero);
2865 
2866  for(s0i = 0; s0i < TOP; s0i++) {
2867  for(s1i = 0; s1i < TOP; s1i++) {
2868  secp256k1_scalar tmp1, tmp2;
2869  secp256k1_gej expected, actual;
2870 
2871  secp256k1_ge_set_gej(&pt[0], &t0p);
2872  secp256k1_ge_set_gej(&pt[1], &t1p);
2873 
2874  secp256k1_scalar_set_int(&sc[0], (s0i + 1) / 2);
2875  secp256k1_scalar_cond_negate(&sc[0], s0i & 1);
2876  secp256k1_scalar_set_int(&sc[1], (s1i + 1) / 2);
2877  secp256k1_scalar_cond_negate(&sc[1], s1i & 1);
2878 
2879  secp256k1_scalar_mul(&tmp1, &t0, &sc[0]);
2880  secp256k1_scalar_mul(&tmp2, &t1, &sc[1]);
2881  secp256k1_scalar_add(&tmp1, &tmp1, &tmp2);
2882 
2883  secp256k1_ecmult(&ctx->ecmult_ctx, &expected, &ptgj, &tmp1, &szero);
2884  CHECK(ecmult_multi(&ctx->ecmult_ctx, scratch, &actual, &szero, ecmult_multi_callback, &data, 2));
2885  secp256k1_gej_neg(&expected, &expected);
2886  secp256k1_gej_add_var(&actual, &actual, &expected, NULL);
2887  CHECK(secp256k1_gej_is_infinity(&actual));
2888  }
2889  }
2890  }
2891  }
2892  }
2893 }
2894 
2895 void test_secp256k1_pippenger_bucket_window_inv(void) {
2896  int i;
2897 
2898  CHECK(secp256k1_pippenger_bucket_window_inv(0) == 0);
2899  for(i = 1; i <= PIPPENGER_MAX_BUCKET_WINDOW; i++) {
2900 #ifdef USE_ENDOMORPHISM
2901  /* Bucket_window of 8 is not used with endo */
2902  if (i == 8) {
2903  continue;
2904  }
2905 #endif
2906  CHECK(secp256k1_pippenger_bucket_window(secp256k1_pippenger_bucket_window_inv(i)) == i);
2907  if (i != PIPPENGER_MAX_BUCKET_WINDOW) {
2908  CHECK(secp256k1_pippenger_bucket_window(secp256k1_pippenger_bucket_window_inv(i)+1) > i);
2909  }
2910  }
2911 }
2912 
2917 void test_ecmult_multi_pippenger_max_points(void) {
2918  size_t scratch_size = secp256k1_rand_int(256);
2919  size_t max_size = secp256k1_pippenger_scratch_size(secp256k1_pippenger_bucket_window_inv(PIPPENGER_MAX_BUCKET_WINDOW-1)+512, 12);
2920  secp256k1_scratch *scratch;
2921  size_t n_points_supported;
2922  int bucket_window = 0;
2923 
2924  for(; scratch_size < max_size; scratch_size+=256) {
2925  scratch = secp256k1_scratch_create(&ctx->error_callback, scratch_size);
2926  CHECK(scratch != NULL);
2927  n_points_supported = secp256k1_pippenger_max_points(scratch);
2928  if (n_points_supported == 0) {
2929  secp256k1_scratch_destroy(scratch);
2930  continue;
2931  }
2932  bucket_window = secp256k1_pippenger_bucket_window(n_points_supported);
2933  CHECK(secp256k1_scratch_allocate_frame(scratch, secp256k1_pippenger_scratch_size(n_points_supported, bucket_window), PIPPENGER_SCRATCH_OBJECTS));
2934  secp256k1_scratch_deallocate_frame(scratch);
2935  secp256k1_scratch_destroy(scratch);
2936  }
2937  CHECK(bucket_window == PIPPENGER_MAX_BUCKET_WINDOW);
2938 }
2939 
2944 void test_ecmult_multi_batching(void) {
2945  static const int n_points = 2*ECMULT_PIPPENGER_THRESHOLD;
2946  secp256k1_scalar scG;
2947  secp256k1_scalar szero;
2948  secp256k1_scalar *sc = (secp256k1_scalar *)checked_malloc(&ctx->error_callback, sizeof(secp256k1_scalar) * n_points);
2949  secp256k1_ge *pt = (secp256k1_ge *)checked_malloc(&ctx->error_callback, sizeof(secp256k1_ge) * n_points);
2950  secp256k1_gej r;
2951  secp256k1_gej r2;
2952  ecmult_multi_data data;
2953  int i;
2954  secp256k1_scratch *scratch;
2955 
2956  secp256k1_gej_set_infinity(&r2);
2957  secp256k1_scalar_set_int(&szero, 0);
2958 
2959  /* Get random scalars and group elements and compute result */
2960  random_scalar_order(&scG);
2961  secp256k1_ecmult(&ctx->ecmult_ctx, &r2, &r2, &szero, &scG);
2962  for(i = 0; i < n_points; i++) {
2963  secp256k1_ge ptg;
2964  secp256k1_gej ptgj;
2965  random_group_element_test(&ptg);
2966  secp256k1_gej_set_ge(&ptgj, &ptg);
2967  pt[i] = ptg;
2968  random_scalar_order(&sc[i]);
2969  secp256k1_ecmult(&ctx->ecmult_ctx, &ptgj, &ptgj, &sc[i], NULL);
2970  secp256k1_gej_add_var(&r2, &r2, &ptgj, NULL);
2971  }
2972  data.sc = sc;
2973  data.pt = pt;
2974 
2975  /* Test with empty scratch space */
2976  scratch = secp256k1_scratch_create(&ctx->error_callback, 0);
2977  CHECK(!secp256k1_ecmult_multi_var(&ctx->ecmult_ctx, scratch, &r, &scG, ecmult_multi_callback, &data, 1));
2978  secp256k1_scratch_destroy(scratch);
2979 
2980  /* Test with space for 1 point in pippenger. That's not enough because
2981  * ecmult_multi selects strauss which requires more memory. */
2982  scratch = secp256k1_scratch_create(&ctx->error_callback, secp256k1_pippenger_scratch_size(1, 1) + PIPPENGER_SCRATCH_OBJECTS*ALIGNMENT);
2983  CHECK(!secp256k1_ecmult_multi_var(&ctx->ecmult_ctx, scratch, &r, &scG, ecmult_multi_callback, &data, 1));
2984  secp256k1_scratch_destroy(scratch);
2985 
2986  secp256k1_gej_neg(&r2, &r2);
2987  for(i = 1; i <= n_points; i++) {
2988  if (i > ECMULT_PIPPENGER_THRESHOLD) {
2989  int bucket_window = secp256k1_pippenger_bucket_window(i);
2990  size_t scratch_size = secp256k1_pippenger_scratch_size(i, bucket_window);
2991  scratch = secp256k1_scratch_create(&ctx->error_callback, scratch_size + PIPPENGER_SCRATCH_OBJECTS*ALIGNMENT);
2992  } else {
2993  size_t scratch_size = secp256k1_strauss_scratch_size(i);
2994  scratch = secp256k1_scratch_create(&ctx->error_callback, scratch_size + STRAUSS_SCRATCH_OBJECTS*ALIGNMENT);
2995  }
2996  CHECK(secp256k1_ecmult_multi_var(&ctx->ecmult_ctx, scratch, &r, &scG, ecmult_multi_callback, &data, n_points));
2997  secp256k1_gej_add_var(&r, &r, &r2, NULL);
2998  CHECK(secp256k1_gej_is_infinity(&r));
2999  secp256k1_scratch_destroy(scratch);
3000  }
3001  free(sc);
3002  free(pt);
3003 }
3004 
3005 void run_ecmult_multi_tests(void) {
3006  secp256k1_scratch *scratch;
3007 
3008  test_secp256k1_pippenger_bucket_window_inv();
3009  test_ecmult_multi_pippenger_max_points();
3010  scratch = secp256k1_scratch_create(&ctx->error_callback, 819200);
3011  test_ecmult_multi(scratch, secp256k1_ecmult_multi_var);
3012  test_ecmult_multi(scratch, secp256k1_ecmult_pippenger_batch_single);
3013  test_ecmult_multi(scratch, secp256k1_ecmult_strauss_batch_single);
3014  secp256k1_scratch_destroy(scratch);
3015 
3016  /* Run test_ecmult_multi with space for exactly one point */
3017  scratch = secp256k1_scratch_create(&ctx->error_callback, secp256k1_strauss_scratch_size(1) + STRAUSS_SCRATCH_OBJECTS*ALIGNMENT);
3018  test_ecmult_multi(scratch, secp256k1_ecmult_multi_var);
3019  secp256k1_scratch_destroy(scratch);
3020 
3021  test_ecmult_multi_batching();
3022 }
3023 
3024 void test_wnaf(const secp256k1_scalar *number, int w) {
3025  secp256k1_scalar x, two, t;
3026  int wnaf[256];
3027  int zeroes = -1;
3028  int i;
3029  int bits;
3030  secp256k1_scalar_set_int(&x, 0);
3031  secp256k1_scalar_set_int(&two, 2);
3032  bits = secp256k1_ecmult_wnaf(wnaf, 256, number, w);
3033  CHECK(bits <= 256);
3034  for (i = bits-1; i >= 0; i--) {
3035  int v = wnaf[i];
3036  secp256k1_scalar_mul(&x, &x, &two);
3037  if (v) {
3038  CHECK(zeroes == -1 || zeroes >= w-1); /* check that distance between non-zero elements is at least w-1 */
3039  zeroes=0;
3040  CHECK((v & 1) == 1); /* check non-zero elements are odd */
3041  CHECK(v <= (1 << (w-1)) - 1); /* check range below */
3042  CHECK(v >= -(1 << (w-1)) - 1); /* check range above */
3043  } else {
3044  CHECK(zeroes != -1); /* check that no unnecessary zero padding exists */
3045  zeroes++;
3046  }
3047  if (v >= 0) {
3048  secp256k1_scalar_set_int(&t, v);
3049  } else {
3050  secp256k1_scalar_set_int(&t, -v);
3051  secp256k1_scalar_negate(&t, &t);
3052  }
3053  secp256k1_scalar_add(&x, &x, &t);
3054  }
3055  CHECK(secp256k1_scalar_eq(&x, number)); /* check that wnaf represents number */
3056 }
3057 
3058 void test_constant_wnaf_negate(const secp256k1_scalar *number) {
3059  secp256k1_scalar neg1 = *number;
3060  secp256k1_scalar neg2 = *number;
3061  int sign1 = 1;
3062  int sign2 = 1;
3063 
3064  if (!secp256k1_scalar_get_bits(&neg1, 0, 1)) {
3065  secp256k1_scalar_negate(&neg1, &neg1);
3066  sign1 = -1;
3067  }
3068  sign2 = secp256k1_scalar_cond_negate(&neg2, secp256k1_scalar_is_even(&neg2));
3069  CHECK(sign1 == sign2);
3070  CHECK(secp256k1_scalar_eq(&neg1, &neg2));
3071 }
3072 
3073 void test_constant_wnaf(const secp256k1_scalar *number, int w) {
3074  secp256k1_scalar x, shift;
3075  int wnaf[256] = {0};
3076  int i;
3077  int skew;
3078  int bits = 256;
3079  secp256k1_scalar num = *number;
3080 
3081  secp256k1_scalar_set_int(&x, 0);
3082  secp256k1_scalar_set_int(&shift, 1 << w);
3083  /* With USE_ENDOMORPHISM on we only consider 128-bit numbers */
3084 #ifdef USE_ENDOMORPHISM
3085  for (i = 0; i < 16; ++i) {
3086  secp256k1_scalar_shr_int(&num, 8);
3087  }
3088  bits = 128;
3089 #endif
3090  skew = secp256k1_wnaf_const(wnaf, num, w, bits);
3091 
3092  for (i = WNAF_SIZE_BITS(bits, w); i >= 0; --i) {
3093  secp256k1_scalar t;
3094  int v = wnaf[i];
3095  CHECK(v != 0); /* check nonzero */
3096  CHECK(v & 1); /* check parity */
3097  CHECK(v > -(1 << w)); /* check range above */
3098  CHECK(v < (1 << w)); /* check range below */
3099 
3100  secp256k1_scalar_mul(&x, &x, &shift);
3101  if (v >= 0) {
3102  secp256k1_scalar_set_int(&t, v);
3103  } else {
3104  secp256k1_scalar_set_int(&t, -v);
3105  secp256k1_scalar_negate(&t, &t);
3106  }
3107  secp256k1_scalar_add(&x, &x, &t);
3108  }
3109  /* Skew num because when encoding numbers as odd we use an offset */
3110  secp256k1_scalar_cadd_bit(&num, skew == 2, 1);
3111  CHECK(secp256k1_scalar_eq(&x, &num));
3112 }
3113 
3114 void test_fixed_wnaf(const secp256k1_scalar *number, int w) {
3115  secp256k1_scalar x, shift;
3116  int wnaf[256] = {0};
3117  int i;
3118  int skew;
3119  secp256k1_scalar num = *number;
3120 
3121  secp256k1_scalar_set_int(&x, 0);
3122  secp256k1_scalar_set_int(&shift, 1 << w);
3123  /* With USE_ENDOMORPHISM on we only consider 128-bit numbers */
3124 #ifdef USE_ENDOMORPHISM
3125  for (i = 0; i < 16; ++i) {
3126  secp256k1_scalar_shr_int(&num, 8);
3127  }
3128 #endif
3129  skew = secp256k1_wnaf_fixed(wnaf, &num, w);
3130 
3131  for (i = WNAF_SIZE(w)-1; i >= 0; --i) {
3132  secp256k1_scalar t;
3133  int v = wnaf[i];
3134  CHECK(v == 0 || v & 1); /* check parity */
3135  CHECK(v > -(1 << w)); /* check range above */
3136  CHECK(v < (1 << w)); /* check range below */
3137 
3138  secp256k1_scalar_mul(&x, &x, &shift);
3139  if (v >= 0) {
3140  secp256k1_scalar_set_int(&t, v);
3141  } else {
3142  secp256k1_scalar_set_int(&t, -v);
3143  secp256k1_scalar_negate(&t, &t);
3144  }
3145  secp256k1_scalar_add(&x, &x, &t);
3146  }
3147  /* If skew is 1 then add 1 to num */
3148  secp256k1_scalar_cadd_bit(&num, 0, skew == 1);
3149  CHECK(secp256k1_scalar_eq(&x, &num));
3150 }
3151 
3152 /* Checks that the first 8 elements of wnaf are equal to wnaf_expected and the
3153  * rest is 0.*/
3154 void test_fixed_wnaf_small_helper(int *wnaf, int *wnaf_expected, int w) {
3155  int i;
3156  for (i = WNAF_SIZE(w)-1; i >= 8; --i) {
3157  CHECK(wnaf[i] == 0);
3158  }
3159  for (i = 7; i >= 0; --i) {
3160  CHECK(wnaf[i] == wnaf_expected[i]);
3161  }
3162 }
3163 
3164 void test_fixed_wnaf_small(void) {
3165  int w = 4;
3166  int wnaf[256] = {0};
3167  int i;
3168  int skew;
3169  secp256k1_scalar num;
3170 
3171  secp256k1_scalar_set_int(&num, 0);
3172  skew = secp256k1_wnaf_fixed(wnaf, &num, w);
3173  for (i = WNAF_SIZE(w)-1; i >= 0; --i) {
3174  int v = wnaf[i];
3175  CHECK(v == 0);
3176  }
3177  CHECK(skew == 0);
3178 
3179  secp256k1_scalar_set_int(&num, 1);
3180  skew = secp256k1_wnaf_fixed(wnaf, &num, w);
3181  for (i = WNAF_SIZE(w)-1; i >= 1; --i) {
3182  int v = wnaf[i];
3183  CHECK(v == 0);
3184  }
3185  CHECK(wnaf[0] == 1);
3186  CHECK(skew == 0);
3187 
3188  {
3189  int wnaf_expected[8] = { 0xf, 0xf, 0xf, 0xf, 0xf, 0xf, 0xf, 0xf };
3190  secp256k1_scalar_set_int(&num, 0xffffffff);
3191  skew = secp256k1_wnaf_fixed(wnaf, &num, w);
3192  test_fixed_wnaf_small_helper(wnaf, wnaf_expected, w);
3193  CHECK(skew == 0);
3194  }
3195  {
3196  int wnaf_expected[8] = { -1, -1, -1, -1, -1, -1, -1, 0xf };
3197  secp256k1_scalar_set_int(&num, 0xeeeeeeee);
3198  skew = secp256k1_wnaf_fixed(wnaf, &num, w);
3199  test_fixed_wnaf_small_helper(wnaf, wnaf_expected, w);
3200  CHECK(skew == 1);
3201  }
3202  {
3203  int wnaf_expected[8] = { 1, 0, 1, 0, 1, 0, 1, 0 };
3204  secp256k1_scalar_set_int(&num, 0x01010101);
3205  skew = secp256k1_wnaf_fixed(wnaf, &num, w);
3206  test_fixed_wnaf_small_helper(wnaf, wnaf_expected, w);
3207  CHECK(skew == 0);
3208  }
3209  {
3210  int wnaf_expected[8] = { -0xf, 0, 0xf, -0xf, 0, 0xf, 1, 0 };
3211  secp256k1_scalar_set_int(&num, 0x01ef1ef1);
3212  skew = secp256k1_wnaf_fixed(wnaf, &num, w);
3213  test_fixed_wnaf_small_helper(wnaf, wnaf_expected, w);
3214  CHECK(skew == 0);
3215  }
3216 }
3217 
3218 void run_wnaf(void) {
3219  int i;
3220  secp256k1_scalar n = {{0}};
3221 
3222  /* Sanity check: 1 and 2 are the smallest odd and even numbers and should
3223  * have easier-to-diagnose failure modes */
3224  n.d[0] = 1;
3225  test_constant_wnaf(&n, 4);
3226  n.d[0] = 2;
3227  test_constant_wnaf(&n, 4);
3228  /* Test 0 */
3229  test_fixed_wnaf_small();
3230  /* Random tests */
3231  for (i = 0; i < count; i++) {
3232  random_scalar_order(&n);
3233  test_wnaf(&n, 4+(i%10));
3234  test_constant_wnaf_negate(&n);
3235  test_constant_wnaf(&n, 4 + (i % 10));
3236  test_fixed_wnaf(&n, 4 + (i % 10));
3237  }
3238  secp256k1_scalar_set_int(&n, 0);
3239  CHECK(secp256k1_scalar_cond_negate(&n, 1) == -1);
3240  CHECK(secp256k1_scalar_is_zero(&n));
3241  CHECK(secp256k1_scalar_cond_negate(&n, 0) == 1);
3242  CHECK(secp256k1_scalar_is_zero(&n));
3243 }
3244 
3245 void test_ecmult_constants(void) {
3246  /* Test ecmult_gen() for [0..36) and [order-36..0). */
3247  secp256k1_scalar x;
3248  secp256k1_gej r;
3249  secp256k1_ge ng;
3250  int i;
3251  int j;
3252  secp256k1_ge_neg(&ng, &secp256k1_ge_const_g);
3253  for (i = 0; i < 36; i++ ) {
3254  secp256k1_scalar_set_int(&x, i);
3255  secp256k1_ecmult_gen(&ctx->ecmult_gen_ctx, &r, &x);
3256  for (j = 0; j < i; j++) {
3257  if (j == i - 1) {
3258  ge_equals_gej(&secp256k1_ge_const_g, &r);
3259  }
3260  secp256k1_gej_add_ge(&r, &r, &ng);
3261  }
3262  CHECK(secp256k1_gej_is_infinity(&r));
3263  }
3264  for (i = 1; i <= 36; i++ ) {
3265  secp256k1_scalar_set_int(&x, i);
3266  secp256k1_scalar_negate(&x, &x);
3267  secp256k1_ecmult_gen(&ctx->ecmult_gen_ctx, &r, &x);
3268  for (j = 0; j < i; j++) {
3269  if (j == i - 1) {
3270  ge_equals_gej(&ng, &r);
3271  }
3272  secp256k1_gej_add_ge(&r, &r, &secp256k1_ge_const_g);
3273  }
3274  CHECK(secp256k1_gej_is_infinity(&r));
3275  }
3276 }
3277 
3278 void run_ecmult_constants(void) {
3279  test_ecmult_constants();
3280 }
3281 
3282 void test_ecmult_gen_blind(void) {
3283  /* Test ecmult_gen() blinding and confirm that the blinding changes, the affine points match, and the z's don't match. */
3284  secp256k1_scalar key;
3285  secp256k1_scalar b;
3286  unsigned char seed32[32];
3287  secp256k1_gej pgej;
3288  secp256k1_gej pgej2;
3289  secp256k1_gej i;
3290  secp256k1_ge pge;
3291  random_scalar_order_test(&key);
3292  secp256k1_ecmult_gen(&ctx->ecmult_gen_ctx, &pgej, &key);
3293  secp256k1_rand256(seed32);
3294  b = ctx->ecmult_gen_ctx.blind;
3295  i = ctx->ecmult_gen_ctx.initial;
3296  secp256k1_ecmult_gen_blind(&ctx->ecmult_gen_ctx, seed32);
3297  CHECK(!secp256k1_scalar_eq(&b, &ctx->ecmult_gen_ctx.blind));
3298  secp256k1_ecmult_gen(&ctx->ecmult_gen_ctx, &pgej2, &key);
3299  CHECK(!gej_xyz_equals_gej(&pgej, &pgej2));
3300  CHECK(!gej_xyz_equals_gej(&i, &ctx->ecmult_gen_ctx.initial));
3301  secp256k1_ge_set_gej(&pge, &pgej);
3302  ge_equals_gej(&pge, &pgej2);
3303 }
3304 
3305 void test_ecmult_gen_blind_reset(void) {
3306  /* Test ecmult_gen() blinding reset and confirm that the blinding is consistent. */
3307  secp256k1_scalar b;
3308  secp256k1_gej initial;
3309  secp256k1_ecmult_gen_blind(&ctx->ecmult_gen_ctx, 0);
3310  b = ctx->ecmult_gen_ctx.blind;
3311  initial = ctx->ecmult_gen_ctx.initial;
3312  secp256k1_ecmult_gen_blind(&ctx->ecmult_gen_ctx, 0);
3313  CHECK(secp256k1_scalar_eq(&b, &ctx->ecmult_gen_ctx.blind));
3314  CHECK(gej_xyz_equals_gej(&initial, &ctx->ecmult_gen_ctx.initial));
3315 }
3316 
3317 void run_ecmult_gen_blind(void) {
3318  int i;
3319  test_ecmult_gen_blind_reset();
3320  for (i = 0; i < 10; i++) {
3321  test_ecmult_gen_blind();
3322  }
3323 }
3324 
3325 #ifdef USE_ENDOMORPHISM
3326 /***** ENDOMORPHISH TESTS *****/
3327 void test_scalar_split(void) {
3328  secp256k1_scalar full;
3329  secp256k1_scalar s1, slam;
3330  const unsigned char zero[32] = {0};
3331  unsigned char tmp[32];
3332 
3333  random_scalar_order_test(&full);
3334  secp256k1_scalar_split_lambda(&s1, &slam, &full);
3335 
3336  /* check that both are <= 128 bits in size */
3337  if (secp256k1_scalar_is_high(&s1)) {
3338  secp256k1_scalar_negate(&s1, &s1);
3339  }
3340  if (secp256k1_scalar_is_high(&slam)) {
3341  secp256k1_scalar_negate(&slam, &slam);
3342  }
3343 
3344  secp256k1_scalar_get_b32(tmp, &s1);
3345  CHECK(memcmp(zero, tmp, 16) == 0);
3346  secp256k1_scalar_get_b32(tmp, &slam);
3347  CHECK(memcmp(zero, tmp, 16) == 0);
3348 }
3349 
3350 void run_endomorphism_tests(void) {
3351  test_scalar_split();
3352 }
3353 #endif
3354 
3355 void ec_pubkey_parse_pointtest(const unsigned char *input, int xvalid, int yvalid) {
3356  unsigned char pubkeyc[65];
3357  secp256k1_pubkey2 pubkey;
3358  secp256k1_ge ge;
3359  size_t pubkeyclen;
3360  int32_t ecount;
3361  ecount = 0;
3362  secp256k1_context_set_illegal_callback(ctx, counting_illegal_callback_fn, &ecount);
3363  for (pubkeyclen = 3; pubkeyclen <= 65; pubkeyclen++) {
3364  /* Smaller sizes are tested exhaustively elsewhere. */
3365  int32_t i;
3366  memcpy(&pubkeyc[1], input, 64);
3367  VG_UNDEF(&pubkeyc[pubkeyclen], 65 - pubkeyclen);
3368  for (i = 0; i < 256; i++) {
3369  /* Try all type bytes. */
3370  int xpass;
3371  int ypass;
3372  int ysign;
3373  pubkeyc[0] = i;
3374  /* What sign does this point have? */
3375  ysign = (input[63] & 1) + 2;
3376  /* For the current type (i) do we expect parsing to work? Handled all of compressed/uncompressed/hybrid. */
3377  xpass = xvalid && (pubkeyclen == 33) && ((i & 254) == 2);
3378  /* Do we expect a parse and re-serialize as uncompressed to give a matching y? */
3379  ypass = xvalid && yvalid && ((i & 4) == ((pubkeyclen == 65) << 2)) &&
3380  ((i == 4) || ((i & 251) == ysign)) && ((pubkeyclen == 33) || (pubkeyclen == 65));
3381  if (xpass || ypass) {
3382  /* These cases must parse. */
3383  unsigned char pubkeyo[65];
3384  size_t outl;
3385  memset(&pubkey, 0, sizeof(pubkey));
3386  VG_UNDEF(&pubkey, sizeof(pubkey));
3387  ecount = 0;
3388  CHECK(secp256k1_ec_pubkey_parse2(ctx, &pubkey, pubkeyc, pubkeyclen) == 1);
3389  VG_CHECK(&pubkey, sizeof(pubkey));
3390  outl = 65;
3391  VG_UNDEF(pubkeyo, 65);
3392  CHECK(secp256k1_ec_pubkey_serialize2(ctx, pubkeyo, &outl, &pubkey, SECP256K1_EC_COMPRESSED) == 1);
3393  VG_CHECK(pubkeyo, outl);
3394  CHECK(outl == 33);
3395  CHECK(memcmp(&pubkeyo[1], &pubkeyc[1], 32) == 0);
3396  CHECK((pubkeyclen != 33) || (pubkeyo[0] == pubkeyc[0]));
3397  if (ypass) {
3398  /* This test isn't always done because we decode with alternative signs, so the y won't match. */
3399  CHECK(pubkeyo[0] == ysign);
3400  CHECK(secp256k1_pubkey2_load(ctx, &ge, &pubkey) == 1);
3401  memset(&pubkey, 0, sizeof(pubkey));
3402  VG_UNDEF(&pubkey, sizeof(pubkey));
3403  secp256k1_pubkey2_save(&pubkey, &ge);
3404  VG_CHECK(&pubkey, sizeof(pubkey));
3405  outl = 65;
3406  VG_UNDEF(pubkeyo, 65);
3407  CHECK(secp256k1_ec_pubkey_serialize2(ctx, pubkeyo, &outl, &pubkey, SECP256K1_EC_UNCOMPRESSED) == 1);
3408  VG_CHECK(pubkeyo, outl);
3409  CHECK(outl == 65);
3410  CHECK(pubkeyo[0] == 4);
3411  CHECK(memcmp(&pubkeyo[1], input, 64) == 0);
3412  }
3413  CHECK(ecount == 0);
3414  } else {
3415  /* These cases must fail to parse. */
3416  memset(&pubkey, 0xfe, sizeof(pubkey));
3417  ecount = 0;
3418  VG_UNDEF(&pubkey, sizeof(pubkey));
3419  CHECK(secp256k1_ec_pubkey_parse2(ctx, &pubkey, pubkeyc, pubkeyclen) == 0);
3420  VG_CHECK(&pubkey, sizeof(pubkey));
3421  CHECK(ecount == 0);
3422  CHECK(secp256k1_pubkey2_load(ctx, &ge, &pubkey) == 0);
3423  CHECK(ecount == 1);
3424  }
3425  }
3426  }
3427  secp256k1_context_set_illegal_callback(ctx, NULL, NULL);
3428 }
3429 
3430 void run_ec_pubkey_parse_test(void) {
3431 #define SECP256K1_EC_PARSE_TEST_NVALID (12)
3432  const unsigned char valid[SECP256K1_EC_PARSE_TEST_NVALID][64] = {
3433  {
3434  /* Point with leading and trailing zeros in x and y serialization. */
3435  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x42, 0x52,
3436  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
3437  0x00, 0x00, 0x64, 0xef, 0xa1, 0x7b, 0x77, 0x61, 0xe1, 0xe4, 0x27, 0x06, 0x98, 0x9f, 0xb4, 0x83,
3438  0xb8, 0xd2, 0xd4, 0x9b, 0xf7, 0x8f, 0xae, 0x98, 0x03, 0xf0, 0x99, 0xb8, 0x34, 0xed, 0xeb, 0x00
3439  },
3440  {
3441  /* Point with x equal to a 3rd root of unity.*/
3442  0x7a, 0xe9, 0x6a, 0x2b, 0x65, 0x7c, 0x07, 0x10, 0x6e, 0x64, 0x47, 0x9e, 0xac, 0x34, 0x34, 0xe9,
3443  0x9c, 0xf0, 0x49, 0x75, 0x12, 0xf5, 0x89, 0x95, 0xc1, 0x39, 0x6c, 0x28, 0x71, 0x95, 0x01, 0xee,
3444  0x42, 0x18, 0xf2, 0x0a, 0xe6, 0xc6, 0x46, 0xb3, 0x63, 0xdb, 0x68, 0x60, 0x58, 0x22, 0xfb, 0x14,
3445  0x26, 0x4c, 0xa8, 0xd2, 0x58, 0x7f, 0xdd, 0x6f, 0xbc, 0x75, 0x0d, 0x58, 0x7e, 0x76, 0xa7, 0xee,
3446  },
3447  {
3448  /* Point with largest x. (1/2) */
3449  0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
3450  0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xfe, 0xff, 0xff, 0xfc, 0x2c,
3451  0x0e, 0x99, 0x4b, 0x14, 0xea, 0x72, 0xf8, 0xc3, 0xeb, 0x95, 0xc7, 0x1e, 0xf6, 0x92, 0x57, 0x5e,
3452  0x77, 0x50, 0x58, 0x33, 0x2d, 0x7e, 0x52, 0xd0, 0x99, 0x5c, 0xf8, 0x03, 0x88, 0x71, 0xb6, 0x7d,
3453  },
3454  {
3455  /* Point with largest x. (2/2) */
3456  0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
3457  0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xfe, 0xff, 0xff, 0xfc, 0x2c,
3458  0xf1, 0x66, 0xb4, 0xeb, 0x15, 0x8d, 0x07, 0x3c, 0x14, 0x6a, 0x38, 0xe1, 0x09, 0x6d, 0xa8, 0xa1,
3459  0x88, 0xaf, 0xa7, 0xcc, 0xd2, 0x81, 0xad, 0x2f, 0x66, 0xa3, 0x07, 0xfb, 0x77, 0x8e, 0x45, 0xb2,
3460  },
3461  {
3462  /* Point with smallest x. (1/2) */
3463  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
3464  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01,
3465  0x42, 0x18, 0xf2, 0x0a, 0xe6, 0xc6, 0x46, 0xb3, 0x63, 0xdb, 0x68, 0x60, 0x58, 0x22, 0xfb, 0x14,
3466  0x26, 0x4c, 0xa8, 0xd2, 0x58, 0x7f, 0xdd, 0x6f, 0xbc, 0x75, 0x0d, 0x58, 0x7e, 0x76, 0xa7, 0xee,
3467  },
3468  {
3469  /* Point with smallest x. (2/2) */
3470  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
3471  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01,
3472  0xbd, 0xe7, 0x0d, 0xf5, 0x19, 0x39, 0xb9, 0x4c, 0x9c, 0x24, 0x97, 0x9f, 0xa7, 0xdd, 0x04, 0xeb,
3473  0xd9, 0xb3, 0x57, 0x2d, 0xa7, 0x80, 0x22, 0x90, 0x43, 0x8a, 0xf2, 0xa6, 0x81, 0x89, 0x54, 0x41,
3474  },
3475  {
3476  /* Point with largest y. (1/3) */
3477  0x1f, 0xe1, 0xe5, 0xef, 0x3f, 0xce, 0xb5, 0xc1, 0x35, 0xab, 0x77, 0x41, 0x33, 0x3c, 0xe5, 0xa6,
3478  0xe8, 0x0d, 0x68, 0x16, 0x76, 0x53, 0xf6, 0xb2, 0xb2, 0x4b, 0xcb, 0xcf, 0xaa, 0xaf, 0xf5, 0x07,
3479  0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
3480  0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xfe, 0xff, 0xff, 0xfc, 0x2e,
3481  },
3482  {
3483  /* Point with largest y. (2/3) */
3484  0xcb, 0xb0, 0xde, 0xab, 0x12, 0x57, 0x54, 0xf1, 0xfd, 0xb2, 0x03, 0x8b, 0x04, 0x34, 0xed, 0x9c,
3485  0xb3, 0xfb, 0x53, 0xab, 0x73, 0x53, 0x91, 0x12, 0x99, 0x94, 0xa5, 0x35, 0xd9, 0x25, 0xf6, 0x73,
3486  0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
3487  0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xfe, 0xff, 0xff, 0xfc, 0x2e,
3488  },
3489  {
3490  /* Point with largest y. (3/3) */
3491  0x14, 0x6d, 0x3b, 0x65, 0xad, 0xd9, 0xf5, 0x4c, 0xcc, 0xa2, 0x85, 0x33, 0xc8, 0x8e, 0x2c, 0xbc,
3492  0x63, 0xf7, 0x44, 0x3e, 0x16, 0x58, 0x78, 0x3a, 0xb4, 0x1f, 0x8e, 0xf9, 0x7c, 0x2a, 0x10, 0xb5,
3493  0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
3494  0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xfe, 0xff, 0xff, 0xfc, 0x2e,
3495  },
3496  {
3497  /* Point with smallest y. (1/3) */
3498  0x1f, 0xe1, 0xe5, 0xef, 0x3f, 0xce, 0xb5, 0xc1, 0x35, 0xab, 0x77, 0x41, 0x33, 0x3c, 0xe5, 0xa6,
3499  0xe8, 0x0d, 0x68, 0x16, 0x76, 0x53, 0xf6, 0xb2, 0xb2, 0x4b, 0xcb, 0xcf, 0xaa, 0xaf, 0xf5, 0x07,
3500  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
3501  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01,
3502  },
3503  {
3504  /* Point with smallest y. (2/3) */
3505  0xcb, 0xb0, 0xde, 0xab, 0x12, 0x57, 0x54, 0xf1, 0xfd, 0xb2, 0x03, 0x8b, 0x04, 0x34, 0xed, 0x9c,
3506  0xb3, 0xfb, 0x53, 0xab, 0x73, 0x53, 0x91, 0x12, 0x99, 0x94, 0xa5, 0x35, 0xd9, 0x25, 0xf6, 0x73,
3507  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
3508  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01,
3509  },
3510  {
3511  /* Point with smallest y. (3/3) */
3512  0x14, 0x6d, 0x3b, 0x65, 0xad, 0xd9, 0xf5, 0x4c, 0xcc, 0xa2, 0x85, 0x33, 0xc8, 0x8e, 0x2c, 0xbc,
3513  0x63, 0xf7, 0x44, 0x3e, 0x16, 0x58, 0x78, 0x3a, 0xb4, 0x1f, 0x8e, 0xf9, 0x7c, 0x2a, 0x10, 0xb5,
3514  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
3515  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01
3516  }
3517  };
3518 #define SECP256K1_EC_PARSE_TEST_NXVALID (4)
3519  const unsigned char onlyxvalid[SECP256K1_EC_PARSE_TEST_NXVALID][64] = {
3520  {
3521  /* Valid if y overflow ignored (y = 1 mod p). (1/3) */
3522  0x1f, 0xe1, 0xe5, 0xef, 0x3f, 0xce, 0xb5, 0xc1, 0x35, 0xab, 0x77, 0x41, 0x33, 0x3c, 0xe5, 0xa6,
3523  0xe8, 0x0d, 0x68, 0x16, 0x76, 0x53, 0xf6, 0xb2, 0xb2, 0x4b, 0xcb, 0xcf, 0xaa, 0xaf, 0xf5, 0x07,
3524  0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
3525  0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xfe, 0xff, 0xff, 0xfc, 0x30,
3526  },
3527  {
3528  /* Valid if y overflow ignored (y = 1 mod p). (2/3) */
3529  0xcb, 0xb0, 0xde, 0xab, 0x12, 0x57, 0x54, 0xf1, 0xfd, 0xb2, 0x03, 0x8b, 0x04, 0x34, 0xed, 0x9c,
3530  0xb3, 0xfb, 0x53, 0xab, 0x73, 0x53, 0x91, 0x12, 0x99, 0x94, 0xa5, 0x35, 0xd9, 0x25, 0xf6, 0x73,
3531  0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
3532  0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xfe, 0xff, 0xff, 0xfc, 0x30,
3533  },
3534  {
3535  /* Valid if y overflow ignored (y = 1 mod p). (3/3)*/
3536  0x14, 0x6d, 0x3b, 0x65, 0xad, 0xd9, 0xf5, 0x4c, 0xcc, 0xa2, 0x85, 0x33, 0xc8, 0x8e, 0x2c, 0xbc,
3537  0x63, 0xf7, 0x44, 0x3e, 0x16, 0x58, 0x78, 0x3a, 0xb4, 0x1f, 0x8e, 0xf9, 0x7c, 0x2a, 0x10, 0xb5,
3538  0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
3539  0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xfe, 0xff, 0xff, 0xfc, 0x30,
3540  },
3541  {
3542  /* x on curve, y is from y^2 = x^3 + 8. */
3543  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
3544  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01,
3545  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
3546  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x03
3547  }
3548  };
3549 #define SECP256K1_EC_PARSE_TEST_NINVALID (7)
3550  const unsigned char invalid[SECP256K1_EC_PARSE_TEST_NINVALID][64] = {
3551  {
3552  /* x is third root of -8, y is -1 * (x^3+7); also on the curve for y^2 = x^3 + 9. */
3553  0x0a, 0x2d, 0x2b, 0xa9, 0x35, 0x07, 0xf1, 0xdf, 0x23, 0x37, 0x70, 0xc2, 0xa7, 0x97, 0x96, 0x2c,
3554  0xc6, 0x1f, 0x6d, 0x15, 0xda, 0x14, 0xec, 0xd4, 0x7d, 0x8d, 0x27, 0xae, 0x1c, 0xd5, 0xf8, 0x53,
3555  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
3556  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01,
3557  },
3558  {
3559  /* Valid if x overflow ignored (x = 1 mod p). */
3560  0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
3561  0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xfe, 0xff, 0xff, 0xfc, 0x30,
3562  0x42, 0x18, 0xf2, 0x0a, 0xe6, 0xc6, 0x46, 0xb3, 0x63, 0xdb, 0x68, 0x60, 0x58, 0x22, 0xfb, 0x14,
3563  0x26, 0x4c, 0xa8, 0xd2, 0x58, 0x7f, 0xdd, 0x6f, 0xbc, 0x75, 0x0d, 0x58, 0x7e, 0x76, 0xa7, 0xee,
3564  },
3565  {
3566  /* Valid if x overflow ignored (x = 1 mod p). */
3567  0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
3568  0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xfe, 0xff, 0xff, 0xfc, 0x30,
3569  0xbd, 0xe7, 0x0d, 0xf5, 0x19, 0x39, 0xb9, 0x4c, 0x9c, 0x24, 0x97, 0x9f, 0xa7, 0xdd, 0x04, 0xeb,
3570  0xd9, 0xb3, 0x57, 0x2d, 0xa7, 0x80, 0x22, 0x90, 0x43, 0x8a, 0xf2, 0xa6, 0x81, 0x89, 0x54, 0x41,
3571  },
3572  {
3573  /* x is -1, y is the result of the sqrt ladder; also on the curve for y^2 = x^3 - 5. */
3574  0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
3575  0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xfe, 0xff, 0xff, 0xfc, 0x2e,
3576  0xf4, 0x84, 0x14, 0x5c, 0xb0, 0x14, 0x9b, 0x82, 0x5d, 0xff, 0x41, 0x2f, 0xa0, 0x52, 0xa8, 0x3f,
3577  0xcb, 0x72, 0xdb, 0x61, 0xd5, 0x6f, 0x37, 0x70, 0xce, 0x06, 0x6b, 0x73, 0x49, 0xa2, 0xaa, 0x28,
3578  },
3579  {
3580  /* x is -1, y is the result of the sqrt ladder; also on the curve for y^2 = x^3 - 5. */
3581  0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
3582  0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xfe, 0xff, 0xff, 0xfc, 0x2e,
3583  0x0b, 0x7b, 0xeb, 0xa3, 0x4f, 0xeb, 0x64, 0x7d, 0xa2, 0x00, 0xbe, 0xd0, 0x5f, 0xad, 0x57, 0xc0,
3584  0x34, 0x8d, 0x24, 0x9e, 0x2a, 0x90, 0xc8, 0x8f, 0x31, 0xf9, 0x94, 0x8b, 0xb6, 0x5d, 0x52, 0x07,
3585  },
3586  {
3587  /* x is zero, y is the result of the sqrt ladder; also on the curve for y^2 = x^3 - 7. */
3588  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
3589  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
3590  0x8f, 0x53, 0x7e, 0xef, 0xdf, 0xc1, 0x60, 0x6a, 0x07, 0x27, 0xcd, 0x69, 0xb4, 0xa7, 0x33, 0x3d,
3591  0x38, 0xed, 0x44, 0xe3, 0x93, 0x2a, 0x71, 0x79, 0xee, 0xcb, 0x4b, 0x6f, 0xba, 0x93, 0x60, 0xdc,
3592  },
3593  {
3594  /* x is zero, y is the result of the sqrt ladder; also on the curve for y^2 = x^3 - 7. */
3595  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
3596  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
3597  0x70, 0xac, 0x81, 0x10, 0x20, 0x3e, 0x9f, 0x95, 0xf8, 0xd8, 0x32, 0x96, 0x4b, 0x58, 0xcc, 0xc2,
3598  0xc7, 0x12, 0xbb, 0x1c, 0x6c, 0xd5, 0x8e, 0x86, 0x11, 0x34, 0xb4, 0x8f, 0x45, 0x6c, 0x9b, 0x53
3599  }
3600  };
3601  const unsigned char pubkeyc[66] = {
3602  /* Serialization of G. */
3603  0x04, 0x79, 0xBE, 0x66, 0x7E, 0xF9, 0xDC, 0xBB, 0xAC, 0x55, 0xA0, 0x62, 0x95, 0xCE, 0x87, 0x0B,
3604  0x07, 0x02, 0x9B, 0xFC, 0xDB, 0x2D, 0xCE, 0x28, 0xD9, 0x59, 0xF2, 0x81, 0x5B, 0x16, 0xF8, 0x17,
3605  0x98, 0x48, 0x3A, 0xDA, 0x77, 0x26, 0xA3, 0xC4, 0x65, 0x5D, 0xA4, 0xFB, 0xFC, 0x0E, 0x11, 0x08,
3606  0xA8, 0xFD, 0x17, 0xB4, 0x48, 0xA6, 0x85, 0x54, 0x19, 0x9C, 0x47, 0xD0, 0x8F, 0xFB, 0x10, 0xD4,
3607  0xB8, 0x00
3608  };
3609  unsigned char sout[65];
3610  unsigned char shortkey[2];
3611  secp256k1_ge ge;
3612  secp256k1_pubkey2 pubkey;
3613  size_t len;
3614  int32_t i;
3615  int32_t ecount;
3616  int32_t ecount2;
3617  ecount = 0;
3618  /* Nothing should be reading this far into pubkeyc. */
3619  VG_UNDEF(&pubkeyc[65], 1);
3620  secp256k1_context_set_illegal_callback(ctx, counting_illegal_callback_fn, &ecount);
3621  /* Zero length claimed, fail, zeroize, no illegal arg error. */
3622  memset(&pubkey, 0xfe, sizeof(pubkey));
3623  ecount = 0;
3624  VG_UNDEF(shortkey, 2);
3625  VG_UNDEF(&pubkey, sizeof(pubkey));
3626  CHECK(secp256k1_ec_pubkey_parse2(ctx, &pubkey, shortkey, 0) == 0);
3627  VG_CHECK(&pubkey, sizeof(pubkey));
3628  CHECK(ecount == 0);
3629  CHECK(secp256k1_pubkey2_load(ctx, &ge, &pubkey) == 0);
3630  CHECK(ecount == 1);
3631  /* Length one claimed, fail, zeroize, no illegal arg error. */
3632  for (i = 0; i < 256 ; i++) {
3633  memset(&pubkey, 0xfe, sizeof(pubkey));
3634  ecount = 0;
3635  shortkey[0] = i;
3636  VG_UNDEF(&shortkey[1], 1);
3637  VG_UNDEF(&pubkey, sizeof(pubkey));
3638  CHECK(secp256k1_ec_pubkey_parse2(ctx, &pubkey, shortkey, 1) == 0);
3639  VG_CHECK(&pubkey, sizeof(pubkey));
3640  CHECK(ecount == 0);
3641  CHECK(secp256k1_pubkey2_load(ctx, &ge, &pubkey) == 0);
3642  CHECK(ecount == 1);
3643  }
3644  /* Length two claimed, fail, zeroize, no illegal arg error. */
3645  for (i = 0; i < 65536 ; i++) {
3646  memset(&pubkey, 0xfe, sizeof(pubkey));
3647  ecount = 0;
3648  shortkey[0] = i & 255;
3649  shortkey[1] = i >> 8;
3650  VG_UNDEF(&pubkey, sizeof(pubkey));
3651  CHECK(secp256k1_ec_pubkey_parse2(ctx, &pubkey, shortkey, 2) == 0);
3652  VG_CHECK(&pubkey, sizeof(pubkey));
3653  CHECK(ecount == 0);
3654  CHECK(secp256k1_pubkey2_load(ctx, &ge, &pubkey) == 0);
3655  CHECK(ecount == 1);
3656  }
3657  memset(&pubkey, 0xfe, sizeof(pubkey));
3658  ecount = 0;
3659  VG_UNDEF(&pubkey, sizeof(pubkey));
3660  /* 33 bytes claimed on otherwise valid input starting with 0x04, fail, zeroize output, no illegal arg error. */
3661  CHECK(secp256k1_ec_pubkey_parse2(ctx, &pubkey, pubkeyc, 33) == 0);
3662  VG_CHECK(&pubkey, sizeof(pubkey));
3663  CHECK(ecount == 0);
3664  CHECK(secp256k1_pubkey2_load(ctx, &ge, &pubkey) == 0);
3665  CHECK(ecount == 1);
3666  /* NULL pubkey, illegal arg error. Pubkey isn't rewritten before this step, since it's NULL into the parser. */
3667  CHECK(secp256k1_ec_pubkey_parse2(ctx, NULL, pubkeyc, 65) == 0);
3668  CHECK(ecount == 2);
3669  /* NULL input string. Illegal arg and zeroize output. */
3670  memset(&pubkey, 0xfe, sizeof(pubkey));
3671  ecount = 0;
3672  VG_UNDEF(&pubkey, sizeof(pubkey));
3673  CHECK(secp256k1_ec_pubkey_parse2(ctx, &pubkey, NULL, 65) == 0);
3674  VG_CHECK(&pubkey, sizeof(pubkey));
3675  CHECK(ecount == 1);
3676  CHECK(secp256k1_pubkey2_load(ctx, &ge, &pubkey) == 0);
3677  CHECK(ecount == 2);
3678  /* 64 bytes claimed on input starting with 0x04, fail, zeroize output, no illegal arg error. */
3679  memset(&pubkey, 0xfe, sizeof(pubkey));
3680  ecount = 0;
3681  VG_UNDEF(&pubkey, sizeof(pubkey));
3682  CHECK(secp256k1_ec_pubkey_parse2(ctx, &pubkey, pubkeyc, 64) == 0);
3683  VG_CHECK(&pubkey, sizeof(pubkey));
3684  CHECK(ecount == 0);
3685  CHECK(secp256k1_pubkey2_load(ctx, &ge, &pubkey) == 0);
3686  CHECK(ecount == 1);
3687  /* 66 bytes claimed, fail, zeroize output, no illegal arg error. */
3688  memset(&pubkey, 0xfe, sizeof(pubkey));
3689  ecount = 0;
3690  VG_UNDEF(&pubkey, sizeof(pubkey));
3691  CHECK(secp256k1_ec_pubkey_parse2(ctx, &pubkey, pubkeyc, 66) == 0);
3692  VG_CHECK(&pubkey, sizeof(pubkey));
3693  CHECK(ecount == 0);
3694  CHECK(secp256k1_pubkey2_load(ctx, &ge, &pubkey) == 0);
3695  CHECK(ecount == 1);
3696  /* Valid parse. */
3697  memset(&pubkey, 0, sizeof(pubkey));
3698  ecount = 0;
3699  VG_UNDEF(&pubkey, sizeof(pubkey));
3700  CHECK(secp256k1_ec_pubkey_parse2(ctx, &pubkey, pubkeyc, 65) == 1);
3701  VG_CHECK(&pubkey, sizeof(pubkey));
3702  CHECK(ecount == 0);
3703  VG_UNDEF(&ge, sizeof(ge));
3704  CHECK(secp256k1_pubkey2_load(ctx, &ge, &pubkey) == 1);
3705  VG_CHECK(&ge.x, sizeof(ge.x));
3706  VG_CHECK(&ge.y, sizeof(ge.y));
3707  VG_CHECK(&ge.infinity, sizeof(ge.infinity));
3708  ge_equals_ge(&secp256k1_ge_const_g, &ge);
3709  CHECK(ecount == 0);
3710  /* secp256k1_ec_pubkey_serialize2 illegal args. */
3711  ecount = 0;
3712  len = 65;
3713  CHECK(secp256k1_ec_pubkey_serialize2(ctx, NULL, &len, &pubkey, SECP256K1_EC_UNCOMPRESSED) == 0);
3714  CHECK(ecount == 1);
3715  CHECK(len == 0);
3716  CHECK(secp256k1_ec_pubkey_serialize2(ctx, sout, NULL, &pubkey, SECP256K1_EC_UNCOMPRESSED) == 0);
3717  CHECK(ecount == 2);
3718  len = 65;
3719  VG_UNDEF(sout, 65);
3720  CHECK(secp256k1_ec_pubkey_serialize2(ctx, sout, &len, NULL, SECP256K1_EC_UNCOMPRESSED) == 0);
3721  VG_CHECK(sout, 65);
3722  CHECK(ecount == 3);
3723  CHECK(len == 0);
3724  len = 65;
3725  CHECK(secp256k1_ec_pubkey_serialize2(ctx, sout, &len, &pubkey, ~0) == 0);
3726  CHECK(ecount == 4);
3727  CHECK(len == 0);
3728  len = 65;
3729  VG_UNDEF(sout, 65);
3730  CHECK(secp256k1_ec_pubkey_serialize2(ctx, sout, &len, &pubkey, SECP256K1_EC_UNCOMPRESSED) == 1);
3731  VG_CHECK(sout, 65);
3732  CHECK(ecount == 4);
3733  CHECK(len == 65);
3734  /* Multiple illegal args. Should still set arg error only once. */
3735  ecount = 0;
3736  ecount2 = 11;
3737  CHECK(secp256k1_ec_pubkey_parse2(ctx, NULL, NULL, 65) == 0);
3738  CHECK(ecount == 1);
3739  /* Does the illegal arg callback actually change the behavior? */
3740  secp256k1_context_set_illegal_callback(ctx, uncounting_illegal_callback_fn, &ecount2);
3741  CHECK(secp256k1_ec_pubkey_parse2(ctx, NULL, NULL, 65) == 0);
3742  CHECK(ecount == 1);
3743  CHECK(ecount2 == 10);
3744  secp256k1_context_set_illegal_callback(ctx, NULL, NULL);
3745  /* Try a bunch of prefabbed points with all possible encodings. */
3746  for (i = 0; i < SECP256K1_EC_PARSE_TEST_NVALID; i++) {
3747  ec_pubkey_parse_pointtest(valid[i], 1, 1);
3748  }
3749  for (i = 0; i < SECP256K1_EC_PARSE_TEST_NXVALID; i++) {
3750  ec_pubkey_parse_pointtest(onlyxvalid[i], 1, 0);
3751  }
3752  for (i = 0; i < SECP256K1_EC_PARSE_TEST_NINVALID; i++) {
3753  ec_pubkey_parse_pointtest(invalid[i], 0, 0);
3754  }
3755 }
3756 
3757 void run_eckey_edge_case_test(void) {
3758  const unsigned char orderc[32] = {
3759  0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
3760  0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xfe,
3761  0xba, 0xae, 0xdc, 0xe6, 0xaf, 0x48, 0xa0, 0x3b,
3762  0xbf, 0xd2, 0x5e, 0x8c, 0xd0, 0x36, 0x41, 0x41
3763  };
3764  const unsigned char zeros[sizeof(secp256k1_pubkey2)] = {0x00};
3765  unsigned char ctmp[33];
3766  unsigned char ctmp2[33];
3767  secp256k1_pubkey2 pubkey;
3768  secp256k1_pubkey2 pubkey2;
3769  secp256k1_pubkey2 pubkey_one;
3770  secp256k1_pubkey2 pubkey_negone;
3771  const secp256k1_pubkey2 *pubkeys[3];
3772  size_t len;
3773  int32_t ecount;
3774  /* Group order is too large, reject. */
3775  CHECK(secp256k1_ec_seckey_verify2(ctx, orderc) == 0);
3776  VG_UNDEF(&pubkey, sizeof(pubkey));
3777  CHECK(secp256k1_ec_pubkey_create2(ctx, &pubkey, orderc) == 0);
3778  VG_CHECK(&pubkey, sizeof(pubkey));
3779  CHECK(memcmp(&pubkey, zeros, sizeof(secp256k1_pubkey2)) == 0);
3780  /* Maximum value is too large, reject. */
3781  memset(ctmp, 255, 32);
3782  CHECK(secp256k1_ec_seckey_verify2(ctx, ctmp) == 0);
3783  memset(&pubkey, 1, sizeof(pubkey));
3784  VG_UNDEF(&pubkey, sizeof(pubkey));
3785  CHECK(secp256k1_ec_pubkey_create2(ctx, &pubkey, ctmp) == 0);
3786  VG_CHECK(&pubkey, sizeof(pubkey));
3787  CHECK(memcmp(&pubkey, zeros, sizeof(secp256k1_pubkey2)) == 0);
3788  /* Zero is too small, reject. */
3789  memset(ctmp, 0, 32);
3790  CHECK(secp256k1_ec_seckey_verify2(ctx, ctmp) == 0);
3791  memset(&pubkey, 1, sizeof(pubkey));
3792  VG_UNDEF(&pubkey, sizeof(pubkey));
3793  CHECK(secp256k1_ec_pubkey_create2(ctx, &pubkey, ctmp) == 0);
3794  VG_CHECK(&pubkey, sizeof(pubkey));
3795  CHECK(memcmp(&pubkey, zeros, sizeof(secp256k1_pubkey2)) == 0);
3796  /* One must be accepted. */
3797  ctmp[31] = 0x01;
3798  CHECK(secp256k1_ec_seckey_verify2(ctx, ctmp) == 1);
3799  memset(&pubkey, 0, sizeof(pubkey));
3800  VG_UNDEF(&pubkey, sizeof(pubkey));
3801  CHECK(secp256k1_ec_pubkey_create2(ctx, &pubkey, ctmp) == 1);
3802  VG_CHECK(&pubkey, sizeof(pubkey));
3803  CHECK(memcmp(&pubkey, zeros, sizeof(secp256k1_pubkey2)) > 0);
3804  pubkey_one = pubkey;
3805  /* Group order + 1 is too large, reject. */
3806  memcpy(ctmp, orderc, 32);
3807  ctmp[31] = 0x42;
3808  CHECK(secp256k1_ec_seckey_verify2(ctx, ctmp) == 0);
3809  memset(&pubkey, 1, sizeof(pubkey));
3810  VG_UNDEF(&pubkey, sizeof(pubkey));
3811  CHECK(secp256k1_ec_pubkey_create2(ctx, &pubkey, ctmp) == 0);
3812  VG_CHECK(&pubkey, sizeof(pubkey));
3813  CHECK(memcmp(&pubkey, zeros, sizeof(secp256k1_pubkey2)) == 0);
3814  /* -1 must be accepted. */
3815  ctmp[31] = 0x40;
3816  CHECK(secp256k1_ec_seckey_verify2(ctx, ctmp) == 1);
3817  memset(&pubkey, 0, sizeof(pubkey));
3818  VG_UNDEF(&pubkey, sizeof(pubkey));
3819  CHECK(secp256k1_ec_pubkey_create2(ctx, &pubkey, ctmp) == 1);
3820  VG_CHECK(&pubkey, sizeof(pubkey));
3821  CHECK(memcmp(&pubkey, zeros, sizeof(secp256k1_pubkey2)) > 0);
3822  pubkey_negone = pubkey;
3823  /* Tweak of zero leaves the value unchanged. */
3824  memset(ctmp2, 0, 32);
3825  CHECK(secp256k1_ec_privkey_tweak_add2(ctx, ctmp, ctmp2) == 1);
3826  CHECK(memcmp(orderc, ctmp, 31) == 0 && ctmp[31] == 0x40);
3827  memcpy(&pubkey2, &pubkey, sizeof(pubkey));
3828  CHECK(secp256k1_ec_pubkey_tweak_add2(ctx, &pubkey, ctmp2) == 1);
3829  CHECK(memcmp(&pubkey, &pubkey2, sizeof(pubkey)) == 0);
3830  /* Multiply tweak of zero zeroizes the output. */
3831  CHECK(secp256k1_ec_privkey_tweak_mul2(ctx, ctmp, ctmp2) == 0);
3832  CHECK(memcmp(zeros, ctmp, 32) == 0);
3833  CHECK(secp256k1_ec_pubkey_tweak_mul2(ctx, &pubkey, ctmp2) == 0);
3834  CHECK(memcmp(&pubkey, zeros, sizeof(pubkey)) == 0);
3835  memcpy(&pubkey, &pubkey2, sizeof(pubkey));
3836  /* Overflowing key tweak zeroizes. */
3837  memcpy(ctmp, orderc, 32);
3838  ctmp[31] = 0x40;
3839  CHECK(secp256k1_ec_privkey_tweak_add2(ctx, ctmp, orderc) == 0);
3840  CHECK(memcmp(zeros, ctmp, 32) == 0);
3841  memcpy(ctmp, orderc, 32);
3842  ctmp[31] = 0x40;
3843  CHECK(secp256k1_ec_privkey_tweak_mul2(ctx, ctmp, orderc) == 0);
3844  CHECK(memcmp(zeros, ctmp, 32) == 0);
3845  memcpy(ctmp, orderc, 32);
3846  ctmp[31] = 0x40;
3847  CHECK(secp256k1_ec_pubkey_tweak_add2(ctx, &pubkey, orderc) == 0);
3848  CHECK(memcmp(&pubkey, zeros, sizeof(pubkey)) == 0);
3849  memcpy(&pubkey, &pubkey2, sizeof(pubkey));
3850  CHECK(secp256k1_ec_pubkey_tweak_mul2(ctx, &pubkey, orderc) == 0);
3851  CHECK(memcmp(&pubkey, zeros, sizeof(pubkey)) == 0);
3852  memcpy(&pubkey, &pubkey2, sizeof(pubkey));
3853  /* Private key tweaks results in a key of zero. */
3854  ctmp2[31] = 1;
3855  CHECK(secp256k1_ec_privkey_tweak_add2(ctx, ctmp2, ctmp) == 0);
3856  CHECK(memcmp(zeros, ctmp2, 32) == 0);
3857  ctmp2[31] = 1;
3858  CHECK(secp256k1_ec_pubkey_tweak_add2(ctx, &pubkey, ctmp2) == 0);
3859  CHECK(memcmp(&pubkey, zeros, sizeof(pubkey)) == 0);
3860  memcpy(&pubkey, &pubkey2, sizeof(pubkey));
3861  /* Tweak computation wraps and results in a key of 1. */
3862  ctmp2[31] = 2;
3863  CHECK(secp256k1_ec_privkey_tweak_add2(ctx, ctmp2, ctmp) == 1);
3864  CHECK(memcmp(ctmp2, zeros, 31) == 0 && ctmp2[31] == 1);
3865  ctmp2[31] = 2;
3866  CHECK(secp256k1_ec_pubkey_tweak_add2(ctx, &pubkey, ctmp2) == 1);
3867  ctmp2[31] = 1;
3868  CHECK(secp256k1_ec_pubkey_create2(ctx, &pubkey2, ctmp2) == 1);
3869  CHECK(memcmp(&pubkey, &pubkey2, sizeof(pubkey)) == 0);
3870  /* Tweak mul * 2 = 1+1. */
3871  CHECK(secp256k1_ec_pubkey_tweak_add2(ctx, &pubkey, ctmp2) == 1);
3872  ctmp2[31] = 2;
3873  CHECK(secp256k1_ec_pubkey_tweak_mul2(ctx, &pubkey2, ctmp2) == 1);
3874  CHECK(memcmp(&pubkey, &pubkey2, sizeof(pubkey)) == 0);
3875  /* Test argument errors. */
3876  ecount = 0;
3877  secp256k1_context_set_illegal_callback(ctx, counting_illegal_callback_fn, &ecount);
3878  CHECK(ecount == 0);
3879  /* Zeroize pubkey on parse error. */
3880  memset(&pubkey, 0, 32);
3881  CHECK(secp256k1_ec_pubkey_tweak_add2(ctx, &pubkey, ctmp2) == 0);
3882  CHECK(ecount == 1);
3883  CHECK(memcmp(&pubkey, zeros, sizeof(pubkey)) == 0);
3884  memcpy(&pubkey, &pubkey2, sizeof(pubkey));
3885  memset(&pubkey2, 0, 32);
3886  CHECK(secp256k1_ec_pubkey_tweak_mul2(ctx, &pubkey2, ctmp2) == 0);
3887  CHECK(ecount == 2);
3888  CHECK(memcmp(&pubkey2, zeros, sizeof(pubkey2)) == 0);
3889  /* Plain argument errors. */
3890  ecount = 0;
3891  CHECK(secp256k1_ec_seckey_verify2(ctx, ctmp) == 1);
3892  CHECK(ecount == 0);
3893  CHECK(secp256k1_ec_seckey_verify2(ctx, NULL) == 0);
3894  CHECK(ecount == 1);
3895  ecount = 0;
3896  memset(ctmp2, 0, 32);
3897  ctmp2[31] = 4;
3898  CHECK(secp256k1_ec_pubkey_tweak_add2(ctx, NULL, ctmp2) == 0);
3899  CHECK(ecount == 1);
3900  CHECK(secp256k1_ec_pubkey_tweak_add2(ctx, &pubkey, NULL) == 0);
3901  CHECK(ecount == 2);
3902  ecount = 0;
3903  memset(ctmp2, 0, 32);
3904  ctmp2[31] = 4;
3905  CHECK(secp256k1_ec_pubkey_tweak_mul2(ctx, NULL, ctmp2) == 0);
3906  CHECK(ecount == 1);
3907  CHECK(secp256k1_ec_pubkey_tweak_mul2(ctx, &pubkey, NULL) == 0);
3908  CHECK(ecount == 2);
3909  ecount = 0;
3910  memset(ctmp2, 0, 32);
3911  CHECK(secp256k1_ec_privkey_tweak_add2(ctx, NULL, ctmp2) == 0);
3912  CHECK(ecount == 1);
3913  CHECK(secp256k1_ec_privkey_tweak_add2(ctx, ctmp, NULL) == 0);
3914  CHECK(ecount == 2);
3915  ecount = 0;
3916  memset(ctmp2, 0, 32);
3917  ctmp2[31] = 1;
3918  CHECK(secp256k1_ec_privkey_tweak_mul2(ctx, NULL, ctmp2) == 0);
3919  CHECK(ecount == 1);
3920  CHECK(secp256k1_ec_privkey_tweak_mul2(ctx, ctmp, NULL) == 0);
3921  CHECK(ecount == 2);
3922  ecount = 0;
3923  CHECK(secp256k1_ec_pubkey_create2(ctx, NULL, ctmp) == 0);
3924  CHECK(ecount == 1);
3925  memset(&pubkey, 1, sizeof(pubkey));
3926  CHECK(secp256k1_ec_pubkey_create2(ctx, &pubkey, NULL) == 0);
3927  CHECK(ecount == 2);
3928  CHECK(memcmp(&pubkey, zeros, sizeof(secp256k1_pubkey2)) == 0);
3929  /* secp256k1_ec_pubkey_combine2 tests. */
3930  ecount = 0;
3931  pubkeys[0] = &pubkey_one;
3932  VG_UNDEF(&pubkeys[0], sizeof(secp256k1_pubkey2 *));
3933  VG_UNDEF(&pubkeys[1], sizeof(secp256k1_pubkey2 *));
3934  VG_UNDEF(&pubkeys[2], sizeof(secp256k1_pubkey2 *));
3935  memset(&pubkey, 255, sizeof(secp256k1_pubkey2));
3936  VG_UNDEF(&pubkey, sizeof(secp256k1_pubkey2));
3937  CHECK(secp256k1_ec_pubkey_combine2(ctx, &pubkey, pubkeys, 0) == 0);
3938  VG_CHECK(&pubkey, sizeof(secp256k1_pubkey2));
3939  CHECK(memcmp(&pubkey, zeros, sizeof(secp256k1_pubkey2)) == 0);
3940  CHECK(ecount == 1);
3941  CHECK(secp256k1_ec_pubkey_combine2(ctx, NULL, pubkeys, 1) == 0);
3942  CHECK(memcmp(&pubkey, zeros, sizeof(secp256k1_pubkey2)) == 0);
3943  CHECK(ecount == 2);
3944  memset(&pubkey, 255, sizeof(secp256k1_pubkey2));
3945  VG_UNDEF(&pubkey, sizeof(secp256k1_pubkey2));
3946  CHECK(secp256k1_ec_pubkey_combine2(ctx, &pubkey, NULL, 1) == 0);
3947  VG_CHECK(&pubkey, sizeof(secp256k1_pubkey2));
3948  CHECK(memcmp(&pubkey, zeros, sizeof(secp256k1_pubkey2)) == 0);
3949  CHECK(ecount == 3);
3950  pubkeys[0] = &pubkey_negone;
3951  memset(&pubkey, 255, sizeof(secp256k1_pubkey2));
3952  VG_UNDEF(&pubkey, sizeof(secp256k1_pubkey2));
3953  CHECK(secp256k1_ec_pubkey_combine2(ctx, &pubkey, pubkeys, 1) == 1);
3954  VG_CHECK(&pubkey, sizeof(secp256k1_pubkey2));
3955  CHECK(memcmp(&pubkey, zeros, sizeof(secp256k1_pubkey2)) > 0);
3956  CHECK(ecount == 3);
3957  len = 33;
3958  CHECK(secp256k1_ec_pubkey_serialize2(ctx, ctmp, &len, &pubkey, SECP256K1_EC_COMPRESSED) == 1);
3959  CHECK(secp256k1_ec_pubkey_serialize2(ctx, ctmp2, &len, &pubkey_negone, SECP256K1_EC_COMPRESSED) == 1);
3960  CHECK(memcmp(ctmp, ctmp2, 33) == 0);
3961  /* Result is infinity. */
3962  pubkeys[0] = &pubkey_one;
3963  pubkeys[1] = &pubkey_negone;
3964  memset(&pubkey, 255, sizeof(secp256k1_pubkey2));
3965  VG_UNDEF(&pubkey, sizeof(secp256k1_pubkey2));
3966  CHECK(secp256k1_ec_pubkey_combine2(ctx, &pubkey, pubkeys, 2) == 0);
3967  VG_CHECK(&pubkey, sizeof(secp256k1_pubkey2));
3968  CHECK(memcmp(&pubkey, zeros, sizeof(secp256k1_pubkey2)) == 0);
3969  CHECK(ecount == 3);
3970  /* Passes through infinity but comes out one. */
3971  pubkeys[2] = &pubkey_one;
3972  memset(&pubkey, 255, sizeof(secp256k1_pubkey2));
3973  VG_UNDEF(&pubkey, sizeof(secp256k1_pubkey2));
3974  CHECK(secp256k1_ec_pubkey_combine2(ctx, &pubkey, pubkeys, 3) == 1);
3975  VG_CHECK(&pubkey, sizeof(secp256k1_pubkey2));
3976  CHECK(memcmp(&pubkey, zeros, sizeof(secp256k1_pubkey2)) > 0);
3977  CHECK(ecount == 3);
3978  len = 33;
3979  CHECK(secp256k1_ec_pubkey_serialize2(ctx, ctmp, &len, &pubkey, SECP256K1_EC_COMPRESSED) == 1);
3980  CHECK(secp256k1_ec_pubkey_serialize2(ctx, ctmp2, &len, &pubkey_one, SECP256K1_EC_COMPRESSED) == 1);
3981  CHECK(memcmp(ctmp, ctmp2, 33) == 0);
3982  /* Adds to two. */
3983  pubkeys[1] = &pubkey_one;
3984  memset(&pubkey, 255, sizeof(secp256k1_pubkey2));
3985  VG_UNDEF(&pubkey, sizeof(secp256k1_pubkey2));
3986  CHECK(secp256k1_ec_pubkey_combine2(ctx, &pubkey, pubkeys, 2) == 1);
3987  VG_CHECK(&pubkey, sizeof(secp256k1_pubkey2));
3988  CHECK(memcmp(&pubkey, zeros, sizeof(secp256k1_pubkey2)) > 0);
3989  CHECK(ecount == 3);
3990  secp256k1_context_set_illegal_callback(ctx, NULL, NULL);
3991 }
3992 
3993 void random_sign(secp256k1_scalar *sigr, secp256k1_scalar *sigs, const secp256k1_scalar *key, const secp256k1_scalar *msg, int *recid) {
3994  secp256k1_scalar nonce;
3995  do {
3996  random_scalar_order_test(&nonce);
3997  } while(!secp256k1_ecdsa_sig_sign(&ctx->ecmult_gen_ctx, sigr, sigs, key, msg, &nonce, recid));
3998 }
3999 
4000 void test_ecdsa_sign_verify(void) {
4001  secp256k1_gej pubj;
4002  secp256k1_ge pub;
4003  secp256k1_scalar one;
4004  secp256k1_scalar msg, key;
4005  secp256k1_scalar sigr, sigs;
4006  int recid;
4007  int getrec;
4008  random_scalar_order_test(&msg);
4009  random_scalar_order_test(&key);
4010  secp256k1_ecmult_gen(&ctx->ecmult_gen_ctx, &pubj, &key);
4011  secp256k1_ge_set_gej(&pub, &pubj);
4012  getrec = secp256k1_rand_bits(1);
4013  random_sign(&sigr, &sigs, &key, &msg, getrec?&recid:NULL);
4014  if (getrec) {
4015  CHECK(recid >= 0 && recid < 4);
4016  }
4017  CHECK(secp256k1_ecdsa_sig_verify(&ctx->ecmult_ctx, &sigr, &sigs, &pub, &msg));
4018  secp256k1_scalar_set_int(&one, 1);
4019  secp256k1_scalar_add(&msg, &msg, &one);
4020  CHECK(!secp256k1_ecdsa_sig_verify(&ctx->ecmult_ctx, &sigr, &sigs, &pub, &msg));
4021 }
4022 
4023 void run_ecdsa_sign_verify(void) {
4024  int i;
4025  for (i = 0; i < 10*count; i++) {
4026  test_ecdsa_sign_verify();
4027  }
4028 }
4029 
4031 static int precomputed_nonce_function(unsigned char *nonce32, const unsigned char *msg32, const unsigned char *key32, const unsigned char *algo16, void *data, unsigned int counter) {
4032  (void)msg32;
4033  (void)key32;
4034  (void)algo16;
4035  memcpy(nonce32, data, 32);
4036  return (counter == 0);
4037 }
4038 
4039 static int nonce_function_test_fail(unsigned char *nonce32, const unsigned char *msg32, const unsigned char *key32, const unsigned char *algo16, void *data, unsigned int counter) {
4040  /* Dummy nonce generator that has a fatal error on the first counter value. */
4041  if (counter == 0) {
4042  return 0;
4043  }
4044  return nonce_function_rfc6979(nonce32, msg32, key32, algo16, data, counter - 1);
4045 }
4046 
4047 static int nonce_function_test_retry(unsigned char *nonce32, const unsigned char *msg32, const unsigned char *key32, const unsigned char *algo16, void *data, unsigned int counter) {
4048  /* Dummy nonce generator that produces unacceptable nonces for the first several counter values. */
4049  if (counter < 3) {
4050  memset(nonce32, counter==0 ? 0 : 255, 32);
4051  if (counter == 2) {
4052  nonce32[31]--;
4053  }
4054  return 1;
4055  }
4056  if (counter < 5) {
4057  static const unsigned char order[] = {
4058  0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,
4059  0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFE,
4060  0xBA,0xAE,0xDC,0xE6,0xAF,0x48,0xA0,0x3B,
4061  0xBF,0xD2,0x5E,0x8C,0xD0,0x36,0x41,0x41
4062  };
4063  memcpy(nonce32, order, 32);
4064  if (counter == 4) {
4065  nonce32[31]++;
4066  }
4067  return 1;
4068  }
4069  /* Retry rate of 6979 is negligible esp. as we only call this in deterministic tests. */
4070  /* If someone does fine a case where it retries for secp256k1, we'd like to know. */
4071  if (counter > 5) {
4072  return 0;
4073  }
4074  return nonce_function_rfc6979(nonce32, msg32, key32, algo16, data, counter - 5);
4075 }
4076 
4077 int is_empty_signature(const secp256k1_ecdsa_sign2ature2 *sig) {
4078  static const unsigned char res[sizeof(secp256k1_ecdsa_sign2ature2)] = {0};
4079  return memcmp(sig, res, sizeof(secp256k1_ecdsa_sign2ature2)) == 0;
4080 }
4081 
4082 void test_ecdsa_end_to_end(void) {
4083  unsigned char extra[32] = {0x00};
4084  unsigned char privkey[32];
4085  unsigned char message[32];
4086  unsigned char privkey2[32];
4087  secp256k1_ecdsa_sign2ature2 signature[6];
4088  secp256k1_scalar r, s;
4089  unsigned char sig[74];
4090  size_t siglen = 74;
4091  unsigned char pubkeyc[65];
4092  size_t pubkeyclen = 65;
4093  secp256k1_pubkey2 pubkey;
4094  secp256k1_pubkey2 pubkey_tmp;
4095  unsigned char seckey[300];
4096  size_t seckeylen = 300;
4097 
4098  /* Generate a random key and message. */
4099  {
4100  secp256k1_scalar msg, key;
4101  random_scalar_order_test(&msg);
4102  random_scalar_order_test(&key);
4103  secp256k1_scalar_get_b32(privkey, &key);
4104  secp256k1_scalar_get_b32(message, &msg);
4105  }
4106 
4107  /* Construct and verify corresponding public key. */
4108  CHECK(secp256k1_ec_seckey_verify2(ctx, privkey) == 1);
4109  CHECK(secp256k1_ec_pubkey_create2(ctx, &pubkey, privkey) == 1);
4110 
4111  /* Verify exporting and importing public key. */
4112  CHECK(secp256k1_ec_pubkey_serialize2(ctx, pubkeyc, &pubkeyclen, &pubkey, secp256k1_rand_bits(1) == 1 ? SECP256K1_EC_COMPRESSED : SECP256K1_EC_UNCOMPRESSED));
4113  memset(&pubkey, 0, sizeof(pubkey));
4114  CHECK(secp256k1_ec_pubkey_parse2(ctx, &pubkey, pubkeyc, pubkeyclen) == 1);
4115 
4116  /* Verify negation changes the key and changes it back */
4117  memcpy(&pubkey_tmp, &pubkey, sizeof(pubkey));
4118  CHECK(secp256k1_ec_pubkey_negate2(ctx, &pubkey_tmp) == 1);
4119  CHECK(memcmp(&pubkey_tmp, &pubkey, sizeof(pubkey)) != 0);
4120  CHECK(secp256k1_ec_pubkey_negate2(ctx, &pubkey_tmp) == 1);
4121  CHECK(memcmp(&pubkey_tmp, &pubkey, sizeof(pubkey)) == 0);
4122 
4123  /* Verify private key import and export. */
4124  CHECK(ec_privkey_export_der(ctx, seckey, &seckeylen, privkey, secp256k1_rand_bits(1) == 1));
4125  CHECK(ec_privkey_import_der(ctx, privkey2, seckey, seckeylen) == 1);
4126  CHECK(memcmp(privkey, privkey2, 32) == 0);
4127 
4128  /* Optionally tweak the keys using addition. */
4129  if (secp256k1_rand_int(3) == 0) {
4130  int ret1;
4131  int ret2;
4132  unsigned char rnd[32];
4133  secp256k1_pubkey2 pubkey2;
4134  secp256k1_rand256_test(rnd);
4135  ret1 = secp256k1_ec_privkey_tweak_add2(ctx, privkey, rnd);
4136  ret2 = secp256k1_ec_pubkey_tweak_add2(ctx, &pubkey, rnd);
4137  CHECK(ret1 == ret2);
4138  if (ret1 == 0) {
4139  return;
4140  }
4141  CHECK(secp256k1_ec_pubkey_create2(ctx, &pubkey2, privkey) == 1);
4142  CHECK(memcmp(&pubkey, &pubkey2, sizeof(pubkey)) == 0);
4143  }
4144 
4145  /* Optionally tweak the keys using multiplication. */
4146  if (secp256k1_rand_int(3) == 0) {
4147  int ret1;
4148  int ret2;
4149  unsigned char rnd[32];
4150  secp256k1_pubkey2 pubkey2;
4151  secp256k1_rand256_test(rnd);
4152  ret1 = secp256k1_ec_privkey_tweak_mul2(ctx, privkey, rnd);
4153  ret2 = secp256k1_ec_pubkey_tweak_mul2(ctx, &pubkey, rnd);
4154  CHECK(ret1 == ret2);
4155  if (ret1 == 0) {
4156  return;
4157  }
4158  CHECK(secp256k1_ec_pubkey_create2(ctx, &pubkey2, privkey) == 1);
4159  CHECK(memcmp(&pubkey, &pubkey2, sizeof(pubkey)) == 0);
4160  }
4161 
4162  /* Sign. */
4163  CHECK(secp256k1_ecdsa_sign2(ctx, &signature[0], message, privkey, NULL, NULL) == 1);
4164  CHECK(secp256k1_ecdsa_sign2(ctx, &signature[4], message, privkey, NULL, NULL) == 1);
4165  CHECK(secp256k1_ecdsa_sign2(ctx, &signature[1], message, privkey, NULL, extra) == 1);
4166  extra[31] = 1;
4167  CHECK(secp256k1_ecdsa_sign2(ctx, &signature[2], message, privkey, NULL, extra) == 1);
4168  extra[31] = 0;
4169  extra[0] = 1;
4170  CHECK(secp256k1_ecdsa_sign2(ctx, &signature[3], message, privkey, NULL, extra) == 1);
4171  CHECK(memcmp(&signature[0], &signature[4], sizeof(signature[0])) == 0);
4172  CHECK(memcmp(&signature[0], &signature[1], sizeof(signature[0])) != 0);
4173  CHECK(memcmp(&signature[0], &signature[2], sizeof(signature[0])) != 0);
4174  CHECK(memcmp(&signature[0], &signature[3], sizeof(signature[0])) != 0);
4175  CHECK(memcmp(&signature[1], &signature[2], sizeof(signature[0])) != 0);
4176  CHECK(memcmp(&signature[1], &signature[3], sizeof(signature[0])) != 0);
4177  CHECK(memcmp(&signature[2], &signature[3], sizeof(signature[0])) != 0);
4178  /* Verify. */
4179  CHECK(secp256k1_ecdsa_verify2(ctx, &signature[0], message, &pubkey) == 1);
4180  CHECK(secp256k1_ecdsa_verify2(ctx, &signature[1], message, &pubkey) == 1);
4181  CHECK(secp256k1_ecdsa_verify2(ctx, &signature[2], message, &pubkey) == 1);
4182  CHECK(secp256k1_ecdsa_verify2(ctx, &signature[3], message, &pubkey) == 1);
4183  /* Test lower-S form, malleate, verify and fail, test again, malleate again */
4184  CHECK(!secp256k1_ecdsa_sign2ature2_normalize(ctx, NULL, &signature[0]));
4185  secp256k1_ecdsa_sign2ature2_load(ctx, &r, &s, &signature[0]);
4186  secp256k1_scalar_negate(&s, &s);
4187  secp256k1_ecdsa_sign2ature2_save(&signature[5], &r, &s);
4188  CHECK(secp256k1_ecdsa_verify2(ctx, &signature[5], message, &pubkey) == 0);
4189  CHECK(secp256k1_ecdsa_sign2ature2_normalize(ctx, NULL, &signature[5]));
4190  CHECK(secp256k1_ecdsa_sign2ature2_normalize(ctx, &signature[5], &signature[5]));
4191  CHECK(!secp256k1_ecdsa_sign2ature2_normalize(ctx, NULL, &signature[5]));
4192  CHECK(!secp256k1_ecdsa_sign2ature2_normalize(ctx, &signature[5], &signature[5]));
4193  CHECK(secp256k1_ecdsa_verify2(ctx, &signature[5], message, &pubkey) == 1);
4194  secp256k1_scalar_negate(&s, &s);
4195  secp256k1_ecdsa_sign2ature2_save(&signature[5], &r, &s);
4196  CHECK(!secp256k1_ecdsa_sign2ature2_normalize(ctx, NULL, &signature[5]));
4197  CHECK(secp256k1_ecdsa_verify2(ctx, &signature[5], message, &pubkey) == 1);
4198  CHECK(memcmp(&signature[5], &signature[0], 64) == 0);
4199 
4200  /* Serialize/parse DER and verify again */
4201  CHECK(secp256k1_ecdsa_sign2ature2_serialize_der(ctx, sig, &siglen, &signature[0]) == 1);
4202  memset(&signature[0], 0, sizeof(signature[0]));
4203  CHECK(secp256k1_ecdsa_sign2ature2_parse_der(ctx, &signature[0], sig, siglen) == 1);
4204  CHECK(secp256k1_ecdsa_verify2(ctx, &signature[0], message, &pubkey) == 1);
4205  /* Serialize/destroy/parse DER and verify again. */
4206  siglen = 74;
4207  CHECK(secp256k1_ecdsa_sign2ature2_serialize_der(ctx, sig, &siglen, &signature[0]) == 1);
4208  sig[secp256k1_rand_int(siglen)] += 1 + secp256k1_rand_int(255);
4209  CHECK(secp256k1_ecdsa_sign2ature2_parse_der(ctx, &signature[0], sig, siglen) == 0 ||
4210  secp256k1_ecdsa_verify2(ctx, &signature[0], message, &pubkey) == 0);
4211 }
4212 
4213 void test_random_pubkeys(void) {
4214  secp256k1_ge elem;
4215  secp256k1_ge elem2;
4216  unsigned char in[65];
4217  /* Generate some randomly sized pubkeys. */
4218  size_t len = secp256k1_rand_bits(2) == 0 ? 65 : 33;
4219  if (secp256k1_rand_bits(2) == 0) {
4220  len = secp256k1_rand_bits(6);
4221  }
4222  if (len == 65) {
4223  in[0] = secp256k1_rand_bits(1) ? 4 : (secp256k1_rand_bits(1) ? 6 : 7);
4224  } else {
4225  in[0] = secp256k1_rand_bits(1) ? 2 : 3;
4226  }
4227  if (secp256k1_rand_bits(3) == 0) {
4228  in[0] = secp256k1_rand_bits(8);
4229  }
4230  if (len > 1) {
4231  secp256k1_rand256(&in[1]);
4232  }
4233  if (len > 33) {
4234  secp256k1_rand256(&in[33]);
4235  }
4236  if (secp256k1_eckey_pubkey_parse(&elem, in, len)) {
4237  unsigned char out[65];
4238  unsigned char firstb;
4239  int res;
4240  size_t size = len;
4241  firstb = in[0];
4242  /* If the pubkey can be parsed, it should round-trip... */
4243  CHECK(secp256k1_eckey_pubkey_serialize(&elem, out, &size, len == 33));
4244  CHECK(size == len);
4245  CHECK(memcmp(&in[1], &out[1], len-1) == 0);
4246  /* ... except for the type of hybrid inputs. */
4247  if ((in[0] != 6) && (in[0] != 7)) {
4248  CHECK(in[0] == out[0]);
4249  }
4250  size = 65;
4251  CHECK(secp256k1_eckey_pubkey_serialize(&elem, in, &size, 0));
4252  CHECK(size == 65);
4253  CHECK(secp256k1_eckey_pubkey_parse(&elem2, in, size));
4254  ge_equals_ge(&elem,&elem2);
4255  /* Check that the X9.62 hybrid type is checked. */
4256  in[0] = secp256k1_rand_bits(1) ? 6 : 7;
4257  res = secp256k1_eckey_pubkey_parse(&elem2, in, size);
4258  if (firstb == 2 || firstb == 3) {
4259  if (in[0] == firstb + 4) {
4260  CHECK(res);
4261  } else {
4262  CHECK(!res);
4263  }
4264  }
4265  if (res) {
4266  ge_equals_ge(&elem,&elem2);
4267  CHECK(secp256k1_eckey_pubkey_serialize(&elem, out, &size, 0));
4268  CHECK(memcmp(&in[1], &out[1], 64) == 0);
4269  }
4270  }
4271 }
4272 
4273 void run_random_pubkeys(void) {
4274  int i;
4275  for (i = 0; i < 10*count; i++) {
4276  test_random_pubkeys();
4277  }
4278 }
4279 
4280 void run_ecdsa_end_to_end(void) {
4281  int i;
4282  for (i = 0; i < 64*count; i++) {
4283  test_ecdsa_end_to_end();
4284  }
4285 }
4286 
4287 int test_ecdsa_der_parse(const unsigned char *sig, size_t siglen, int certainly_der, int certainly_not_der) {
4288  static const unsigned char zeroes[32] = {0};
4289 #ifdef ENABLE_OPENSSL_TESTS
4290  static const unsigned char max_scalar[32] = {
4291  0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
4292  0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xfe,
4293  0xba, 0xae, 0xdc, 0xe6, 0xaf, 0x48, 0xa0, 0x3b,
4294  0xbf, 0xd2, 0x5e, 0x8c, 0xd0, 0x36, 0x41, 0x40
4295  };
4296 #endif
4297 
4298  int ret = 0;
4299 
4300  secp256k1_ecdsa_sign2ature2 sig_der;
4301  unsigned char roundtrip_der[2048];
4302  unsigned char compact_der[64];
4303  size_t len_der = 2048;
4304  int parsed_der = 0, valid_der = 0, roundtrips_der = 0;
4305 
4306  secp256k1_ecdsa_sign2ature2 sig_der_lax;
4307  unsigned char roundtrip_der_lax[2048];
4308  unsigned char compact_der_lax[64];
4309  size_t len_der_lax = 2048;
4310  int parsed_der_lax = 0, valid_der_lax = 0, roundtrips_der_lax = 0;
4311 
4312 #ifdef ENABLE_OPENSSL_TESTS
4313  ECDSA_SIG *sig_openssl;
4314  const BIGNUM *r = NULL, *s = NULL;
4315  const unsigned char *sigptr;
4316  unsigned char roundtrip_openssl[2048];
4317  int len_openssl = 2048;
4318  int parsed_openssl, valid_openssl = 0, roundtrips_openssl = 0;
4319 #endif
4320 
4321  parsed_der = secp256k1_ecdsa_sign2ature2_parse_der(ctx, &sig_der, sig, siglen);
4322  if (parsed_der) {
4323  ret |= (!secp256k1_ecdsa_sign2ature2_serialize_compact(ctx, compact_der, &sig_der)) << 0;
4324  valid_der = (memcmp(compact_der, zeroes, 32) != 0) && (memcmp(compact_der + 32, zeroes, 32) != 0);
4325  }
4326  if (valid_der) {
4327  ret |= (!secp256k1_ecdsa_sign2ature2_serialize_der(ctx, roundtrip_der, &len_der, &sig_der)) << 1;
4328  roundtrips_der = (len_der == siglen) && memcmp(roundtrip_der, sig, siglen) == 0;
4329  }
4330 
4331  parsed_der_lax = ecdsa_signature_parse_der_lax(ctx, &sig_der_lax, sig, siglen);
4332  if (parsed_der_lax) {
4333  ret |= (!secp256k1_ecdsa_sign2ature2_serialize_compact(ctx, compact_der_lax, &sig_der_lax)) << 10;
4334  valid_der_lax = (memcmp(compact_der_lax, zeroes, 32) != 0) && (memcmp(compact_der_lax + 32, zeroes, 32) != 0);
4335  }
4336  if (valid_der_lax) {
4337  ret |= (!secp256k1_ecdsa_sign2ature2_serialize_der(ctx, roundtrip_der_lax, &len_der_lax, &sig_der_lax)) << 11;
4338  roundtrips_der_lax = (len_der_lax == siglen) && memcmp(roundtrip_der_lax, sig, siglen) == 0;
4339  }
4340 
4341  if (certainly_der) {
4342  ret |= (!parsed_der) << 2;
4343  }
4344  if (certainly_not_der) {
4345  ret |= (parsed_der) << 17;
4346  }
4347  if (valid_der) {
4348  ret |= (!roundtrips_der) << 3;
4349  }
4350 
4351  if (valid_der) {
4352  ret |= (!roundtrips_der_lax) << 12;
4353  ret |= (len_der != len_der_lax) << 13;
4354  ret |= (memcmp(roundtrip_der_lax, roundtrip_der, len_der) != 0) << 14;
4355  }
4356  ret |= (roundtrips_der != roundtrips_der_lax) << 15;
4357  if (parsed_der) {
4358  ret |= (!parsed_der_lax) << 16;
4359  }
4360 
4361 #ifdef ENABLE_OPENSSL_TESTS
4362  sig_openssl = ECDSA_SIG_new();
4363  sigptr = sig;
4364  parsed_openssl = (d2i_ECDSA_SIG(&sig_openssl, &sigptr, siglen) != NULL);
4365  if (parsed_openssl) {
4366  ECDSA_SIG_get0(sig_openssl, &r, &s);
4367  valid_openssl = !BN_is_negative(r) && !BN_is_negative(s) && BN_num_bits(r) > 0 && BN_num_bits(r) <= 256 && BN_num_bits(s) > 0 && BN_num_bits(s) <= 256;
4368  if (valid_openssl) {
4369  unsigned char tmp[32] = {0};
4370  BN_bn2bin(r, tmp + 32 - BN_num_bytes(r));
4371  valid_openssl = memcmp(tmp, max_scalar, 32) < 0;
4372  }
4373  if (valid_openssl) {
4374  unsigned char tmp[32] = {0};
4375  BN_bn2bin(s, tmp + 32 - BN_num_bytes(s));
4376  valid_openssl = memcmp(tmp, max_scalar, 32) < 0;
4377  }
4378  }
4379  len_openssl = i2d_ECDSA_SIG(sig_openssl, NULL);
4380  if (len_openssl <= 2048) {
4381  unsigned char *ptr = roundtrip_openssl;
4382  CHECK(i2d_ECDSA_SIG(sig_openssl, &ptr) == len_openssl);
4383  roundtrips_openssl = valid_openssl && ((size_t)len_openssl == siglen) && (memcmp(roundtrip_openssl, sig, siglen) == 0);
4384  } else {
4385  len_openssl = 0;
4386  }
4387  ECDSA_SIG_free(sig_openssl);
4388 
4389  ret |= (parsed_der && !parsed_openssl) << 4;
4390  ret |= (valid_der && !valid_openssl) << 5;
4391  ret |= (roundtrips_openssl && !parsed_der) << 6;
4392  ret |= (roundtrips_der != roundtrips_openssl) << 7;
4393  if (roundtrips_openssl) {
4394  ret |= (len_der != (size_t)len_openssl) << 8;
4395  ret |= (memcmp(roundtrip_der, roundtrip_openssl, len_der) != 0) << 9;
4396  }
4397 #endif
4398  return ret;
4399 }
4400 
4401 static void assign_big_endian(unsigned char *ptr, size_t ptrlen, uint32_t val) {
4402  size_t i;
4403  for (i = 0; i < ptrlen; i++) {
4404  int shift = ptrlen - 1 - i;
4405  if (shift >= 4) {
4406  ptr[i] = 0;
4407  } else {
4408  ptr[i] = (val >> shift) & 0xFF;
4409  }
4410  }
4411 }
4412 
4413 static void damage_array(unsigned char *sig, size_t *len) {
4414  int pos;
4415  int action = secp256k1_rand_bits(3);
4416  if (action < 1 && *len > 3) {
4417  /* Delete a byte. */
4418  pos = secp256k1_rand_int(*len);
4419  memmove(sig + pos, sig + pos + 1, *len - pos - 1);
4420  (*len)--;
4421  return;
4422  } else if (action < 2 && *len < 2048) {
4423  /* Insert a byte. */
4424  pos = secp256k1_rand_int(1 + *len);
4425  memmove(sig + pos + 1, sig + pos, *len - pos);
4426  sig[pos] = secp256k1_rand_bits(8);
4427  (*len)++;
4428  return;
4429  } else if (action < 4) {
4430  /* Modify a byte. */
4431  sig[secp256k1_rand_int(*len)] += 1 + secp256k1_rand_int(255);
4432  return;
4433  } else { /* action < 8 */
4434  /* Modify a bit. */
4435  sig[secp256k1_rand_int(*len)] ^= 1 << secp256k1_rand_bits(3);
4436  return;
4437  }
4438 }
4439 
4440 static void random_ber_signature(unsigned char *sig, size_t *len, int* certainly_der, int* certainly_not_der) {
4441  int der;
4442  int nlow[2], nlen[2], nlenlen[2], nhbit[2], nhbyte[2], nzlen[2];
4443  size_t tlen, elen, glen;
4444  int indet;
4445  int n;
4446 
4447  *len = 0;
4448  der = secp256k1_rand_bits(2) == 0;
4449  *certainly_der = der;
4450  *certainly_not_der = 0;
4451  indet = der ? 0 : secp256k1_rand_int(10) == 0;
4452 
4453  for (n = 0; n < 2; n++) {
4454  /* We generate two classes of numbers: nlow==1 "low" ones (up to 32 bytes), nlow==0 "high" ones (32 bytes with 129 top bits set, or larger than 32 bytes) */
4455  nlow[n] = der ? 1 : (secp256k1_rand_bits(3) != 0);
4456  /* The length of the number in bytes (the first byte of which will always be nonzero) */
4457  nlen[n] = nlow[n] ? secp256k1_rand_int(33) : 32 + secp256k1_rand_int(200) * secp256k1_rand_int(8) / 8;
4458  CHECK(nlen[n] <= 232);
4459  /* The top bit of the number. */
4460  nhbit[n] = (nlow[n] == 0 && nlen[n] == 32) ? 1 : (nlen[n] == 0 ? 0 : secp256k1_rand_bits(1));
4461  /* The top byte of the number (after the potential hardcoded 16 0xFF characters for "high" 32 bytes numbers) */
4462  nhbyte[n] = nlen[n] == 0 ? 0 : (nhbit[n] ? 128 + secp256k1_rand_bits(7) : 1 + secp256k1_rand_int(127));
4463  /* The number of zero bytes in front of the number (which is 0 or 1 in case of DER, otherwise we extend up to 300 bytes) */
4464  nzlen[n] = der ? ((nlen[n] == 0 || nhbit[n]) ? 1 : 0) : (nlow[n] ? secp256k1_rand_int(3) : secp256k1_rand_int(300 - nlen[n]) * secp256k1_rand_int(8) / 8);
4465  if (nzlen[n] > ((nlen[n] == 0 || nhbit[n]) ? 1 : 0)) {
4466  *certainly_not_der = 1;
4467  }
4468  CHECK(nlen[n] + nzlen[n] <= 300);
4469  /* The length of the length descriptor for the number. 0 means short encoding, anything else is long encoding. */
4470  nlenlen[n] = nlen[n] + nzlen[n] < 128 ? 0 : (nlen[n] + nzlen[n] < 256 ? 1 : 2);
4471  if (!der) {
4472  /* nlenlen[n] max 127 bytes */
4473  int add = secp256k1_rand_int(127 - nlenlen[n]) * secp256k1_rand_int(16) * secp256k1_rand_int(16) / 256;
4474  nlenlen[n] += add;
4475  if (add != 0) {
4476  *certainly_not_der = 1;
4477  }
4478  }
4479  CHECK(nlen[n] + nzlen[n] + nlenlen[n] <= 427);
4480  }
4481 
4482  /* The total length of the data to go, so far */
4483  tlen = 2 + nlenlen[0] + nlen[0] + nzlen[0] + 2 + nlenlen[1] + nlen[1] + nzlen[1];
4484  CHECK(tlen <= 856);
4485 
4486  /* The length of the garbage inside the tuple. */
4487  elen = (der || indet) ? 0 : secp256k1_rand_int(980 - tlen) * secp256k1_rand_int(8) / 8;
4488  if (elen != 0) {
4489  *certainly_not_der = 1;
4490  }
4491  tlen += elen;
4492  CHECK(tlen <= 980);
4493 
4494  /* The length of the garbage after the end of the tuple. */
4495  glen = der ? 0 : secp256k1_rand_int(990 - tlen) * secp256k1_rand_int(8) / 8;
4496  if (glen != 0) {
4497  *certainly_not_der = 1;
4498  }
4499  CHECK(tlen + glen <= 990);
4500 
4501  /* Write the tuple header. */
4502  sig[(*len)++] = 0x30;
4503  if (indet) {
4504  /* Indeterminate length */
4505  sig[(*len)++] = 0x80;
4506  *certainly_not_der = 1;
4507  } else {
4508  int tlenlen = tlen < 128 ? 0 : (tlen < 256 ? 1 : 2);
4509  if (!der) {
4510  int add = secp256k1_rand_int(127 - tlenlen) * secp256k1_rand_int(16) * secp256k1_rand_int(16) / 256;
4511  tlenlen += add;
4512  if (add != 0) {
4513  *certainly_not_der = 1;
4514  }
4515  }
4516  if (tlenlen == 0) {
4517  /* Short length notation */
4518  sig[(*len)++] = tlen;
4519  } else {
4520  /* Long length notation */
4521  sig[(*len)++] = 128 + tlenlen;
4522  assign_big_endian(sig + *len, tlenlen, tlen);
4523  *len += tlenlen;
4524  }
4525  tlen += tlenlen;
4526  }
4527  tlen += 2;
4528  CHECK(tlen + glen <= 1119);
4529 
4530  for (n = 0; n < 2; n++) {
4531  /* Write the integer header. */
4532  sig[(*len)++] = 0x02;
4533  if (nlenlen[n] == 0) {
4534  /* Short length notation */
4535  sig[(*len)++] = nlen[n] + nzlen[n];
4536  } else {
4537  /* Long length notation. */
4538  sig[(*len)++] = 128 + nlenlen[n];
4539  assign_big_endian(sig + *len, nlenlen[n], nlen[n] + nzlen[n]);
4540  *len += nlenlen[n];
4541  }
4542  /* Write zero padding */
4543  while (nzlen[n] > 0) {
4544  sig[(*len)++] = 0x00;
4545  nzlen[n]--;
4546  }
4547  if (nlen[n] == 32 && !nlow[n]) {
4548  /* Special extra 16 0xFF bytes in "high" 32-byte numbers */
4549  int i;
4550  for (i = 0; i < 16; i++) {
4551  sig[(*len)++] = 0xFF;
4552  }
4553  nlen[n] -= 16;
4554  }
4555  /* Write first byte of number */
4556  if (nlen[n] > 0) {
4557  sig[(*len)++] = nhbyte[n];
4558  nlen[n]--;
4559  }
4560  /* Generate remaining random bytes of number */
4561  secp256k1_rand_bytes_test(sig + *len, nlen[n]);
4562  *len += nlen[n];
4563  nlen[n] = 0;
4564  }
4565 
4566  /* Generate random garbage inside tuple. */
4567  secp256k1_rand_bytes_test(sig + *len, elen);
4568  *len += elen;
4569 
4570  /* Generate end-of-contents bytes. */
4571  if (indet) {
4572  sig[(*len)++] = 0;
4573  sig[(*len)++] = 0;
4574  tlen += 2;
4575  }
4576  CHECK(tlen + glen <= 1121);
4577 
4578  /* Generate random garbage outside tuple. */
4579  secp256k1_rand_bytes_test(sig + *len, glen);
4580  *len += glen;
4581  tlen += glen;
4582  CHECK(tlen <= 1121);
4583  CHECK(tlen == *len);
4584 }
4585 
4586 void run_ecdsa_der_parse(void) {
4587  int i,j;
4588  for (i = 0; i < 200 * count; i++) {
4589  unsigned char buffer[2048];
4590  size_t buflen = 0;
4591  int certainly_der = 0;
4592  int certainly_not_der = 0;
4593  random_ber_signature(buffer, &buflen, &certainly_der, &certainly_not_der);
4594  CHECK(buflen <= 2048);
4595  for (j = 0; j < 16; j++) {
4596  int ret = 0;
4597  if (j > 0) {
4598  damage_array(buffer, &buflen);
4599  /* We don't know anything anymore about the DERness of the result */
4600  certainly_der = 0;
4601  certainly_not_der = 0;
4602  }
4603  ret = test_ecdsa_der_parse(buffer, buflen, certainly_der, certainly_not_der);
4604  if (ret != 0) {
4605  size_t k;
4606  fprintf(stderr, "Failure %x on ", ret);
4607  for (k = 0; k < buflen; k++) {
4608  fprintf(stderr, "%02x ", buffer[k]);
4609  }
4610  fprintf(stderr, "\n");
4611  }
4612  CHECK(ret == 0);
4613  }
4614  }
4615 }
4616 
4617 /* Tests several edge cases. */
4618 void test_ecdsa_edge_cases(void) {
4619  int t;
4620  secp256k1_ecdsa_sign2ature2 sig;
4621 
4622  /* Test the case where ECDSA recomputes a point that is infinity. */
4623  {
4624  secp256k1_gej keyj;
4625  secp256k1_ge key;
4626  secp256k1_scalar msg;
4627  secp256k1_scalar sr, ss;
4628  secp256k1_scalar_set_int(&ss, 1);
4629  secp256k1_scalar_negate(&ss, &ss);
4630  secp256k1_scalar_inverse(&ss, &ss);
4631  secp256k1_scalar_set_int(&sr, 1);
4632  secp256k1_ecmult_gen(&ctx->ecmult_gen_ctx, &keyj, &sr);
4633  secp256k1_ge_set_gej(&key, &keyj);
4634  msg = ss;
4635  CHECK(secp256k1_ecdsa_sig_verify(&ctx->ecmult_ctx, &sr, &ss, &key, &msg) == 0);
4636  }
4637 
4638  /* Verify signature with r of zero fails. */
4639  {
4640  const unsigned char pubkey_mods_zero[33] = {
4641  0x02, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
4642  0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
4643  0xfe, 0xba, 0xae, 0xdc, 0xe6, 0xaf, 0x48, 0xa0,
4644  0x3b, 0xbf, 0xd2, 0x5e, 0x8c, 0xd0, 0x36, 0x41,
4645  0x41
4646  };
4647  secp256k1_ge key;
4648  secp256k1_scalar msg;
4649  secp256k1_scalar sr, ss;
4650  secp256k1_scalar_set_int(&ss, 1);
4651  secp256k1_scalar_set_int(&msg, 0);
4652  secp256k1_scalar_set_int(&sr, 0);
4653  CHECK(secp256k1_eckey_pubkey_parse(&key, pubkey_mods_zero, 33));
4654  CHECK(secp256k1_ecdsa_sig_verify(&ctx->ecmult_ctx, &sr, &ss, &key, &msg) == 0);
4655  }
4656 
4657  /* Verify signature with s of zero fails. */
4658  {
4659  const unsigned char pubkey[33] = {
4660  0x02, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
4661  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
4662  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
4663  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
4664  0x01
4665  };
4666  secp256k1_ge key;
4667  secp256k1_scalar msg;
4668  secp256k1_scalar sr, ss;
4669  secp256k1_scalar_set_int(&ss, 0);
4670  secp256k1_scalar_set_int(&msg, 0);
4671  secp256k1_scalar_set_int(&sr, 1);
4672  CHECK(secp256k1_eckey_pubkey_parse(&key, pubkey, 33));
4673  CHECK(secp256k1_ecdsa_sig_verify(&ctx->ecmult_ctx, &sr, &ss, &key, &msg) == 0);
4674  }
4675 
4676  /* Verify signature with message 0 passes. */
4677  {
4678  const unsigned char pubkey[33] = {
4679  0x02, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
4680  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
4681  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
4682  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
4683  0x02
4684  };
4685  const unsigned char pubkey2[33] = {
4686  0x02, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
4687  0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
4688  0xfe, 0xba, 0xae, 0xdc, 0xe6, 0xaf, 0x48, 0xa0,
4689  0x3b, 0xbf, 0xd2, 0x5e, 0x8c, 0xd0, 0x36, 0x41,
4690  0x43
4691  };
4692  secp256k1_ge key;
4693  secp256k1_ge key2;
4694  secp256k1_scalar msg;
4695  secp256k1_scalar sr, ss;
4696  secp256k1_scalar_set_int(&ss, 2);
4697  secp256k1_scalar_set_int(&msg, 0);
4698  secp256k1_scalar_set_int(&sr, 2);
4699  CHECK(secp256k1_eckey_pubkey_parse(&key, pubkey, 33));
4700  CHECK(secp256k1_eckey_pubkey_parse(&key2, pubkey2, 33));
4701  CHECK(secp256k1_ecdsa_sig_verify(&ctx->ecmult_ctx, &sr, &ss, &key, &msg) == 1);
4702  CHECK(secp256k1_ecdsa_sig_verify(&ctx->ecmult_ctx, &sr, &ss, &key2, &msg) == 1);
4703  secp256k1_scalar_negate(&ss, &ss);
4704  CHECK(secp256k1_ecdsa_sig_verify(&ctx->ecmult_ctx, &sr, &ss, &key, &msg) == 1);
4705  CHECK(secp256k1_ecdsa_sig_verify(&ctx->ecmult_ctx, &sr, &ss, &key2, &msg) == 1);
4706  secp256k1_scalar_set_int(&ss, 1);
4707  CHECK(secp256k1_ecdsa_sig_verify(&ctx->ecmult_ctx, &sr, &ss, &key, &msg) == 0);
4708  CHECK(secp256k1_ecdsa_sig_verify(&ctx->ecmult_ctx, &sr, &ss, &key2, &msg) == 0);
4709  }
4710 
4711  /* Verify signature with message 1 passes. */
4712  {
4713  const unsigned char pubkey[33] = {
4714  0x02, 0x14, 0x4e, 0x5a, 0x58, 0xef, 0x5b, 0x22,
4715  0x6f, 0xd2, 0xe2, 0x07, 0x6a, 0x77, 0xcf, 0x05,
4716  0xb4, 0x1d, 0xe7, 0x4a, 0x30, 0x98, 0x27, 0x8c,
4717  0x93, 0xe6, 0xe6, 0x3c, 0x0b, 0xc4, 0x73, 0x76,
4718  0x25
4719  };
4720  const unsigned char pubkey2[33] = {
4721  0x02, 0x8a, 0xd5, 0x37, 0xed, 0x73, 0xd9, 0x40,
4722  0x1d, 0xa0, 0x33, 0xd2, 0xdc, 0xf0, 0xaf, 0xae,
4723  0x34, 0xcf, 0x5f, 0x96, 0x4c, 0x73, 0x28, 0x0f,
4724  0x92, 0xc0, 0xf6, 0x9d, 0xd9, 0xb2, 0x09, 0x10,
4725  0x62
4726  };
4727  const unsigned char csr[32] = {
4728  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
4729  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01,
4730  0x45, 0x51, 0x23, 0x19, 0x50, 0xb7, 0x5f, 0xc4,
4731  0x40, 0x2d, 0xa1, 0x72, 0x2f, 0xc9, 0xba, 0xeb
4732  };
4733  secp256k1_ge key;
4734  secp256k1_ge key2;
4735  secp256k1_scalar msg;
4736  secp256k1_scalar sr, ss;
4737  secp256k1_scalar_set_int(&ss, 1);
4738  secp256k1_scalar_set_int(&msg, 1);
4739  secp256k1_scalar_set_b32(&sr, csr, NULL);
4740  CHECK(secp256k1_eckey_pubkey_parse(&key, pubkey, 33));
4741  CHECK(secp256k1_eckey_pubkey_parse(&key2, pubkey2, 33));
4742  CHECK(secp256k1_ecdsa_sig_verify(&ctx->ecmult_ctx, &sr, &ss, &key, &msg) == 1);
4743  CHECK(secp256k1_ecdsa_sig_verify(&ctx->ecmult_ctx, &sr, &ss, &key2, &msg) == 1);
4744  secp256k1_scalar_negate(&ss, &ss);
4745  CHECK(secp256k1_ecdsa_sig_verify(&ctx->ecmult_ctx, &sr, &ss, &key, &msg) == 1);
4746  CHECK(secp256k1_ecdsa_sig_verify(&ctx->ecmult_ctx, &sr, &ss, &key2, &msg) == 1);
4747  secp256k1_scalar_set_int(&ss, 2);
4748  secp256k1_scalar_inverse_var(&ss, &ss);
4749  CHECK(secp256k1_ecdsa_sig_verify(&ctx->ecmult_ctx, &sr, &ss, &key, &msg) == 0);
4750  CHECK(secp256k1_ecdsa_sig_verify(&ctx->ecmult_ctx, &sr, &ss, &key2, &msg) == 0);
4751  }
4752 
4753  /* Verify signature with message -1 passes. */
4754  {
4755  const unsigned char pubkey[33] = {
4756  0x03, 0xaf, 0x97, 0xff, 0x7d, 0x3a, 0xf6, 0xa0,
4757  0x02, 0x94, 0xbd, 0x9f, 0x4b, 0x2e, 0xd7, 0x52,
4758  0x28, 0xdb, 0x49, 0x2a, 0x65, 0xcb, 0x1e, 0x27,
4759  0x57, 0x9c, 0xba, 0x74, 0x20, 0xd5, 0x1d, 0x20,
4760  0xf1
4761  };
4762  const unsigned char csr[32] = {
4763  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
4764  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01,
4765  0x45, 0x51, 0x23, 0x19, 0x50, 0xb7, 0x5f, 0xc4,
4766  0x40, 0x2d, 0xa1, 0x72, 0x2f, 0xc9, 0xba, 0xee
4767  };
4768  secp256k1_ge key;
4769  secp256k1_scalar msg;
4770  secp256k1_scalar sr, ss;
4771  secp256k1_scalar_set_int(&ss, 1);
4772  secp256k1_scalar_set_int(&msg, 1);
4773  secp256k1_scalar_negate(&msg, &msg);
4774  secp256k1_scalar_set_b32(&sr, csr, NULL);
4775  CHECK(secp256k1_eckey_pubkey_parse(&key, pubkey, 33));
4776  CHECK(secp256k1_ecdsa_sig_verify(&ctx->ecmult_ctx, &sr, &ss, &key, &msg) == 1);
4777  secp256k1_scalar_negate(&ss, &ss);
4778  CHECK(secp256k1_ecdsa_sig_verify(&ctx->ecmult_ctx, &sr, &ss, &key, &msg) == 1);
4779  secp256k1_scalar_set_int(&ss, 3);
4780  secp256k1_scalar_inverse_var(&ss, &ss);
4781  CHECK(secp256k1_ecdsa_sig_verify(&ctx->ecmult_ctx, &sr, &ss, &key, &msg) == 0);
4782  }
4783 
4784  /* Signature where s would be zero. */
4785  {
4786  secp256k1_pubkey2 pubkey;
4787  size_t siglen;
4788  int32_t ecount;
4789  unsigned char signature[72];
4790  static const unsigned char nonce[32] = {
4791  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
4792  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
4793  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
4794  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01,
4795  };
4796  static const unsigned char nonce2[32] = {
4797  0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,
4798  0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFE,
4799  0xBA,0xAE,0xDC,0xE6,0xAF,0x48,0xA0,0x3B,
4800  0xBF,0xD2,0x5E,0x8C,0xD0,0x36,0x41,0x40
4801  };
4802  const unsigned char key[32] = {
4803  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
4804  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
4805  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
4806  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01,
4807  };
4808  unsigned char msg[32] = {
4809  0x86, 0x41, 0x99, 0x81, 0x06, 0x23, 0x44, 0x53,
4810  0xaa, 0x5f, 0x9d, 0x6a, 0x31, 0x78, 0xf4, 0xf7,
4811  0xb8, 0x12, 0xe0, 0x0b, 0x81, 0x7a, 0x77, 0x62,
4812  0x65, 0xdf, 0xdd, 0x31, 0xb9, 0x3e, 0x29, 0xa9,
4813  };
4814  ecount = 0;
4815  secp256k1_context_set_illegal_callback(ctx, counting_illegal_callback_fn, &ecount);
4816  CHECK(secp256k1_ecdsa_sign2(ctx, &sig, msg, key, precomputed_nonce_function, nonce) == 0);
4817  CHECK(secp256k1_ecdsa_sign2(ctx, &sig, msg, key, precomputed_nonce_function, nonce2) == 0);
4818  msg[31] = 0xaa;
4819  CHECK(secp256k1_ecdsa_sign2(ctx, &sig, msg, key, precomputed_nonce_function, nonce) == 1);
4820  CHECK(ecount == 0);
4821  CHECK(secp256k1_ecdsa_sign2(ctx, NULL, msg, key, precomputed_nonce_function, nonce2) == 0);
4822  CHECK(ecount == 1);
4823  CHECK(secp256k1_ecdsa_sign2(ctx, &sig, NULL, key, precomputed_nonce_function, nonce2) == 0);
4824  CHECK(ecount == 2);
4825  CHECK(secp256k1_ecdsa_sign2(ctx, &sig, msg, NULL, precomputed_nonce_function, nonce2) == 0);
4826  CHECK(ecount == 3);
4827  CHECK(secp256k1_ecdsa_sign2(ctx, &sig, msg, key, precomputed_nonce_function, nonce2) == 1);
4828  CHECK(secp256k1_ec_pubkey_create2(ctx, &pubkey, key) == 1);
4829  CHECK(secp256k1_ecdsa_verify2(ctx, NULL, msg, &pubkey) == 0);
4830  CHECK(ecount == 4);
4831  CHECK(secp256k1_ecdsa_verify2(ctx, &sig, NULL, &pubkey) == 0);
4832  CHECK(ecount == 5);
4833  CHECK(secp256k1_ecdsa_verify2(ctx, &sig, msg, NULL) == 0);
4834  CHECK(ecount == 6);
4835  CHECK(secp256k1_ecdsa_verify2(ctx, &sig, msg, &pubkey) == 1);
4836  CHECK(ecount == 6);
4837  CHECK(secp256k1_ec_pubkey_create2(ctx, &pubkey, NULL) == 0);
4838  CHECK(ecount == 7);
4839  /* That pubkeyload fails via an ARGCHECK is a little odd but makes sense because pubkeys are an opaque data type. */
4840  CHECK(secp256k1_ecdsa_verify2(ctx, &sig, msg, &pubkey) == 0);
4841  CHECK(ecount == 8);
4842  siglen = 72;
4843  CHECK(secp256k1_ecdsa_sign2ature2_serialize_der(ctx, NULL, &siglen, &sig) == 0);
4844  CHECK(ecount == 9);
4845  CHECK(secp256k1_ecdsa_sign2ature2_serialize_der(ctx, signature, NULL, &sig) == 0);
4846  CHECK(ecount == 10);
4847  CHECK(secp256k1_ecdsa_sign2ature2_serialize_der(ctx, signature, &siglen, NULL) == 0);
4848  CHECK(ecount == 11);
4849  CHECK(secp256k1_ecdsa_sign2ature2_serialize_der(ctx, signature, &siglen, &sig) == 1);
4850  CHECK(ecount == 11);
4851  CHECK(secp256k1_ecdsa_sign2ature2_parse_der(ctx, NULL, signature, siglen) == 0);
4852  CHECK(ecount == 12);
4853  CHECK(secp256k1_ecdsa_sign2ature2_parse_der(ctx, &sig, NULL, siglen) == 0);
4854  CHECK(ecount == 13);
4855  CHECK(secp256k1_ecdsa_sign2ature2_parse_der(ctx, &sig, signature, siglen) == 1);
4856  CHECK(ecount == 13);
4857  siglen = 10;
4858  /* Too little room for a signature does not fail via ARGCHECK. */
4859  CHECK(secp256k1_ecdsa_sign2ature2_serialize_der(ctx, signature, &siglen, &sig) == 0);
4860  CHECK(ecount == 13);
4861  ecount = 0;
4862  CHECK(secp256k1_ecdsa_sign2ature2_normalize(ctx, NULL, NULL) == 0);
4863  CHECK(ecount == 1);
4864  CHECK(secp256k1_ecdsa_sign2ature2_serialize_compact(ctx, NULL, &sig) == 0);
4865  CHECK(ecount == 2);
4866  CHECK(secp256k1_ecdsa_sign2ature2_serialize_compact(ctx, signature, NULL) == 0);
4867  CHECK(ecount == 3);
4868  CHECK(secp256k1_ecdsa_sign2ature2_serialize_compact(ctx, signature, &sig) == 1);
4869  CHECK(ecount == 3);
4870  CHECK(secp256k1_ecdsa_sign2ature2_parse_compact(ctx, NULL, signature) == 0);
4871  CHECK(ecount == 4);
4872  CHECK(secp256k1_ecdsa_sign2ature2_parse_compact(ctx, &sig, NULL) == 0);
4873  CHECK(ecount == 5);
4874  CHECK(secp256k1_ecdsa_sign2ature2_parse_compact(ctx, &sig, signature) == 1);
4875  CHECK(ecount == 5);
4876  memset(signature, 255, 64);
4877  CHECK(secp256k1_ecdsa_sign2ature2_parse_compact(ctx, &sig, signature) == 0);
4878  CHECK(ecount == 5);
4879  secp256k1_context_set_illegal_callback(ctx, NULL, NULL);
4880  }
4881 
4882  /* Nonce function corner cases. */
4883  for (t = 0; t < 2; t++) {
4884  static const unsigned char zero[32] = {0x00};
4885  int i;
4886  unsigned char key[32];
4887  unsigned char msg[32];
4888  secp256k1_ecdsa_sign2ature2 sig2;
4889  secp256k1_scalar sr[512], ss;
4890  const unsigned char *extra;
4891  extra = t == 0 ? NULL : zero;
4892  memset(msg, 0, 32);
4893  msg[31] = 1;
4894  /* High key results in signature failure. */
4895  memset(key, 0xFF, 32);
4896  CHECK(secp256k1_ecdsa_sign2(ctx, &sig, msg, key, NULL, extra) == 0);
4897  CHECK(is_empty_signature(&sig));
4898  /* Zero key results in signature failure. */
4899  memset(key, 0, 32);
4900  CHECK(secp256k1_ecdsa_sign2(ctx, &sig, msg, key, NULL, extra) == 0);
4901  CHECK(is_empty_signature(&sig));
4902  /* Nonce function failure results in signature failure. */
4903  key[31] = 1;
4904  CHECK(secp256k1_ecdsa_sign2(ctx, &sig, msg, key, nonce_function_test_fail, extra) == 0);
4905  CHECK(is_empty_signature(&sig));
4906  /* The retry loop successfully makes its way to the first good value. */
4907  CHECK(secp256k1_ecdsa_sign2(ctx, &sig, msg, key, nonce_function_test_retry, extra) == 1);
4908  CHECK(!is_empty_signature(&sig));
4909  CHECK(secp256k1_ecdsa_sign2(ctx, &sig2, msg, key, nonce_function_rfc6979, extra) == 1);
4910  CHECK(!is_empty_signature(&sig2));
4911  CHECK(memcmp(&sig, &sig2, sizeof(sig)) == 0);
4912  /* The default nonce function is deterministic. */
4913  CHECK(secp256k1_ecdsa_sign2(ctx, &sig2, msg, key, NULL, extra) == 1);
4914  CHECK(!is_empty_signature(&sig2));
4915  CHECK(memcmp(&sig, &sig2, sizeof(sig)) == 0);
4916  /* The default nonce function changes output with different messages. */
4917  for(i = 0; i < 256; i++) {
4918  int j;
4919  msg[0] = i;
4920  CHECK(secp256k1_ecdsa_sign2(ctx, &sig2, msg, key, NULL, extra) == 1);
4921  CHECK(!is_empty_signature(&sig2));
4922  secp256k1_ecdsa_sign2ature2_load(ctx, &sr[i], &ss, &sig2);
4923  for (j = 0; j < i; j++) {
4924  CHECK(!secp256k1_scalar_eq(&sr[i], &sr[j]));
4925  }
4926  }
4927  msg[0] = 0;
4928  msg[31] = 2;
4929  /* The default nonce function changes output with different keys. */
4930  for(i = 256; i < 512; i++) {
4931  int j;
4932  key[0] = i - 256;
4933  CHECK(secp256k1_ecdsa_sign2(ctx, &sig2, msg, key, NULL, extra) == 1);
4934  CHECK(!is_empty_signature(&sig2));
4935  secp256k1_ecdsa_sign2ature2_load(ctx, &sr[i], &ss, &sig2);
4936  for (j = 0; j < i; j++) {
4937  CHECK(!secp256k1_scalar_eq(&sr[i], &sr[j]));
4938  }
4939  }
4940  key[0] = 0;
4941  }
4942 
4943  {
4944  /* Check that optional nonce arguments do not have equivalent effect. */
4945  const unsigned char zeros[32] = {0};
4946  unsigned char nonce[32];
4947  unsigned char nonce2[32];
4948  unsigned char nonce3[32];
4949  unsigned char nonce4[32];
4950  VG_UNDEF(nonce,32);
4951  VG_UNDEF(nonce2,32);
4952  VG_UNDEF(nonce3,32);
4953  VG_UNDEF(nonce4,32);
4954  CHECK(nonce_function_rfc6979(nonce, zeros, zeros, NULL, NULL, 0) == 1);
4955  VG_CHECK(nonce,32);
4956  CHECK(nonce_function_rfc6979(nonce2, zeros, zeros, zeros, NULL, 0) == 1);
4957  VG_CHECK(nonce2,32);
4958  CHECK(nonce_function_rfc6979(nonce3, zeros, zeros, NULL, (void *)zeros, 0) == 1);
4959  VG_CHECK(nonce3,32);
4960  CHECK(nonce_function_rfc6979(nonce4, zeros, zeros, zeros, (void *)zeros, 0) == 1);
4961  VG_CHECK(nonce4,32);
4962  CHECK(memcmp(nonce, nonce2, 32) != 0);
4963  CHECK(memcmp(nonce, nonce3, 32) != 0);
4964  CHECK(memcmp(nonce, nonce4, 32) != 0);
4965  CHECK(memcmp(nonce2, nonce3, 32) != 0);
4966  CHECK(memcmp(nonce2, nonce4, 32) != 0);
4967  CHECK(memcmp(nonce3, nonce4, 32) != 0);
4968  }
4969 
4970 
4971  /* Privkey export where pubkey is the point at infinity. */
4972  {
4973  unsigned char privkey[300];
4974  unsigned char seckey[32] = {
4975  0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
4976  0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xfe,
4977  0xba, 0xae, 0xdc, 0xe6, 0xaf, 0x48, 0xa0, 0x3b,
4978  0xbf, 0xd2, 0x5e, 0x8c, 0xd0, 0x36, 0x41, 0x41,
4979  };
4980  size_t outlen = 300;
4981  CHECK(!ec_privkey_export_der(ctx, privkey, &outlen, seckey, 0));
4982  outlen = 300;
4983  CHECK(!ec_privkey_export_der(ctx, privkey, &outlen, seckey, 1));
4984  }
4985 }
4986 
4987 void run_ecdsa_edge_cases(void) {
4988  test_ecdsa_edge_cases();
4989 }
4990 
4991 #ifdef ENABLE_OPENSSL_TESTS
4992 EC_KEY *get_openssl_key(const unsigned char *key32) {
4993  unsigned char privkey[300];
4994  size_t privkeylen;
4995  const unsigned char* pbegin = privkey;
4996  int compr = secp256k1_rand_bits(1);
4997  EC_KEY *ec_key = EC_KEY_new_by_curve_name(NID_secp256k1);
4998  CHECK(ec_privkey_export_der(ctx, privkey, &privkeylen, key32, compr));
4999  CHECK(d2i_ECPrivateKey(&ec_key, &pbegin, privkeylen));
5000  CHECK(EC_KEY_check_key(ec_key));
5001  return ec_key;
5002 }
5003 
5004 void test_ecdsa_openssl(void) {
5005  secp256k1_gej qj;
5006  secp256k1_ge q;
5007  secp256k1_scalar sigr, sigs;
5008  secp256k1_scalar one;
5009  secp256k1_scalar msg2;
5010  secp256k1_scalar key, msg;
5011  EC_KEY *ec_key;
5012  unsigned int sigsize = 80;
5013  size_t secp_sigsize = 80;
5014  unsigned char message[32];
5015  unsigned char signature[80];
5016  unsigned char key32[32];
5017  secp256k1_rand256_test(message);
5018  secp256k1_scalar_set_b32(&msg, message, NULL);
5019  random_scalar_order_test(&key);
5020  secp256k1_scalar_get_b32(key32, &key);
5021  secp256k1_ecmult_gen(&ctx->ecmult_gen_ctx, &qj, &key);
5022  secp256k1_ge_set_gej(&q, &qj);
5023  ec_key = get_openssl_key(key32);
5024  CHECK(ec_key != NULL);
5025  CHECK(ECDSA_sign(0, message, sizeof(message), signature, &sigsize, ec_key));
5026  CHECK(secp256k1_ecdsa_sig_parse(&sigr, &sigs, signature, sigsize));
5027  CHECK(secp256k1_ecdsa_sig_verify(&ctx->ecmult_ctx, &sigr, &sigs, &q, &msg));
5028  secp256k1_scalar_set_int(&one, 1);
5029  secp256k1_scalar_add(&msg2, &msg, &one);
5030  CHECK(!secp256k1_ecdsa_sig_verify(&ctx->ecmult_ctx, &sigr, &sigs, &q, &msg2));
5031 
5032  random_sign(&sigr, &sigs, &key, &msg, NULL);
5033  CHECK(secp256k1_ecdsa_sig_serialize(signature, &secp_sigsize, &sigr, &sigs));
5034  CHECK(ECDSA_verify(0, message, sizeof(message), signature, secp_sigsize, ec_key) == 1);
5035 
5036  EC_KEY_free(ec_key);
5037 }
5038 
5039 void run_ecdsa_openssl(void) {
5040  int i;
5041  for (i = 0; i < 10*count; i++) {
5042  test_ecdsa_openssl();
5043  }
5044 }
5045 #endif
5046 
5047 #define ENABLE_MODULE_BULLETPROOF 1
5048 
5049 #ifdef ENABLE_MODULE_ECDH
5050 # include "modules/ecdh/tests_impl.h"
5051 #endif
5052 
5053 #ifdef ENABLE_MODULE_RECOVERY
5054 # include "modules/recovery/tests_impl.h"
5055 #endif
5056 
5057 #ifdef ENABLE_MODULE_GENERATOR
5058 # include "modules/generator/tests_impl.h"
5059 #endif
5060 
5061 #ifdef ENABLE_MODULE_COMMITMENT
5062 # include "modules/commitment/tests_impl.h"
5063 #endif
5064 
5065 #ifdef ENABLE_MODULE_RANGEPROOF
5066 # include "modules/rangeproof/tests_impl.h"
5067 #endif
5068 
5069 #ifdef ENABLE_MODULE_BULLETPROOF
5070 # include "modules/bulletproofs/tests_impl.h"
5071 #endif
5072 
5073 #ifdef ENABLE_MODULE_WHITELIST
5074 # include "modules/whitelist/tests_impl.h"
5075 #endif
5076 
5077 #ifdef ENABLE_MODULE_SURJECTIONPROOF
5078 # include "modules/surjection/tests_impl.h"
5079 #endif
5080 
5081 int main(int argc, char **argv) {
5082  unsigned char seed16[16] = {0};
5083  unsigned char run32[32] = {0};
5084  /* find iteration count */
5085  if (argc > 1) {
5086  count = strtol(argv[1], NULL, 0);
5087  }
5088 
5089  /* find random seed */
5090  if (argc > 2) {
5091  int pos = 0;
5092  const char* ch = argv[2];
5093  while (pos < 16 && ch[0] != 0 && ch[1] != 0) {
5094  unsigned short sh;
5095  if (sscanf(ch, "%2hx", &sh)) {
5096  seed16[pos] = sh;
5097  } else {
5098  break;
5099  }
5100  ch += 2;
5101  pos++;
5102  }
5103  } else {
5104  FILE *frand = fopen("/dev/urandom", "r");
5105  if ((frand == NULL) || fread(&seed16, sizeof(seed16), 1, frand) != sizeof(seed16)) {
5106  uint64_t t = time(NULL) * (uint64_t)1337;
5107  seed16[0] ^= t;
5108  seed16[1] ^= t >> 8;
5109  seed16[2] ^= t >> 16;
5110  seed16[3] ^= t >> 24;
5111  seed16[4] ^= t >> 32;
5112  seed16[5] ^= t >> 40;
5113  seed16[6] ^= t >> 48;
5114  seed16[7] ^= t >> 56;
5115  }
5116  if (frand) {
5117  fclose(frand);
5118  }
5119  }
5120  secp256k1_rand_seed(seed16);
5121 
5122  printf("test count = %i\n", count);
5123  printf("random seed = %02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x\n", seed16[0], seed16[1], seed16[2], seed16[3], seed16[4], seed16[5], seed16[6], seed16[7], seed16[8], seed16[9], seed16[10], seed16[11], seed16[12], seed16[13], seed16[14], seed16[15]);
5124 
5125  /* initialize */
5126  run_context_tests();
5127  run_scratch_tests();
5128  ctx = secp256k1_context_create2(SECP256K1_CONTEXT_SIGN | SECP256K1_CONTEXT_VERIFY);
5129  if (secp256k1_rand_bits(1)) {
5130  secp256k1_rand256(run32);
5131  CHECK(secp256k1_context_randomize2(ctx, secp256k1_rand_bits(1) ? run32 : NULL));
5132  }
5133 
5134  run_rand_bits();
5135  run_rand_int();
5136  run_util_tests();
5137 
5138  run_sha256_tests();
5139  run_hmac_sha256_tests();
5140  run_rfc6979_hmac_sha256_tests();
5141 
5142 #ifndef USE_NUM_NONE
5143  /* num tests */
5144  run_num_smalltests();
5145 #endif
5146 
5147  /* scalar tests */
5148  run_scalar_tests();
5149 
5150  /* field tests */
5151  run_field_inv();
5152  run_field_inv_var();
5153  run_field_inv_all_var();
5154  run_field_misc();
5155  run_field_convert();
5156  run_sqr();
5157  run_sqrt();
5158 
5159  /* group tests */
5160  run_ge();
5161  run_group_decompress();
5162 
5163  /* ecmult tests */
5164  run_wnaf();
5165  run_point_times_order();
5166  run_ecmult_chain();
5167  run_ecmult_constants();
5168  run_ecmult_gen_blind();
5169  run_ecmult_const_tests();
5170  run_ecmult_multi_tests();
5171  run_ec_combine();
5172 
5173  /* endomorphism tests */
5174 #ifdef USE_ENDOMORPHISM
5175  run_endomorphism_tests();
5176 #endif
5177 
5178  /* EC point parser test */
5179  run_ec_pubkey_parse_test();
5180 
5181  /* EC key edge cases */
5182  run_eckey_edge_case_test();
5183 
5184 #ifdef ENABLE_MODULE_ECDH
5185  /* ecdh tests */
5186  run_ecdh_tests();
5187 #endif
5188 
5189  /* ecdsa tests */
5190  run_random_pubkeys();
5191  run_ecdsa_der_parse();
5192  run_ecdsa_sign_verify();
5193  run_ecdsa_end_to_end();
5194  run_ecdsa_edge_cases();
5195 #ifdef ENABLE_OPENSSL_TESTS
5196  run_ecdsa_openssl();
5197 #endif
5198 
5199 #ifdef ENABLE_MODULE_RECOVERY
5200  /* ECDSA pubkey recovery tests */
5201  run_recovery_tests();
5202 #endif
5203 
5204 #ifdef ENABLE_MODULE_GENERATOR
5205  run_generator_tests();
5206 #endif
5207 
5208 #ifdef ENABLE_MODULE_RANGEPROOF
5209  run_rangeproof_tests();
5210 #endif
5211 
5212 #ifdef ENABLE_MODULE_BULLETPROOF
5213  printf("Running bulletproofs");
5214  run_bulletproofs_tests();
5215 #endif
5216 
5217 #ifdef ENABLE_MODULE_WHITELIST
5218  /* Key whitelisting tests */
5219  run_whitelist_tests();
5220 #endif
5221 
5222 #ifdef ENABLE_MODULE_SURJECTIONPROOF
5223  run_surjection_tests();
5224 #endif
5225 
5226  secp256k1_rand256(run32);
5227  printf("random run = %02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x\n", run32[0], run32[1], run32[2], run32[3], run32[4], run32[5], run32[6], run32[7], run32[8], run32[9], run32[10], run32[11], run32[12], run32[13], run32[14], run32[15]);
5228 
5229  /* shutdown */
5230  secp256k1_context_destroy(ctx);
5231 
5232  printf("no problems found\n");
5233  return 0;
5234 }
test_point_times_order
void test_point_times_order(const secp256k1_gej_t *point)
Definition: tests.c:771
SECP256K1_EC_COMPRESSED
#define SECP256K1_EC_COMPRESSED
Flag to pass to secp256k1_ec_pubkey_serialize2 and secp256k1_ec_privkey_export.
Definition: secp256k1_2.h:172
secp256k1_scratch_space_struct2
Definition: scratch.h:14
secp256k1_gej::infinity
int infinity
Definition: group.h:28
secp256k1_scratch_space_destroy
SECP256K1_API void secp256k1_scratch_space_destroy(secp256k1_scratch_space2 *scratch)
Destroy a secp256k1 scratch space.
Definition: secp256k1_2.c:140
run_field_misc
void run_field_misc(void)
Definition: tests.c:1793
PIPPENGER_MAX_BUCKET_WINDOW
#define PIPPENGER_MAX_BUCKET_WINDOW
Definition: ecmult_impl.h:60
SECP256K1_GEJ_CONST_INFINITY
#define SECP256K1_GEJ_CONST_INFINITY
Definition: group.h:32
random_fe_non_zero
void random_fe_non_zero(secp256k1_fe_t *nz)
Definition: tests.c:447
VERIFY_CHECK
#define VERIFY_CHECK(cond)
Definition: util.h:61
run_ecdsa_end_to_end
void run_ecdsa_end_to_end(void)
Definition: tests.c:970
run_ecmult_constants
void run_ecmult_constants(void)
Definition: tests.c:3278
test_constant_wnaf
void test_constant_wnaf(const secp256k1_scalar *number, int w)
Definition: tests.c:3073
test_num_mod
void test_num_mod(void)
Definition: tests.c:616
SECP256K1_GEJ_CONST
#define SECP256K1_GEJ_CONST(a, b, c, d, e, f, g, h, i, j, k, l, m, n, o, p)
Definition: group.h:31
secp256k1_fe_storage
Definition: field_10x26.h:41
SECP256K1_CONTEXT_NONE
#define SECP256K1_CONTEXT_NONE
Definition: secp256k1_2.h:169
secp256k1_ge::y
secp256k1_fe y
Definition: group.h:20
random_field_element_magnitude
void random_field_element_magnitude(secp256k1_fe_t *fe)
Definition: tests.c:36
secp256k1_ec_pubkey_tweak_mul2
SECP256K1_API SECP256K1_WARN_UNUSED_RESULT int secp256k1_ec_pubkey_tweak_mul2(const secp256k1_context2 *ctx, secp256k1_pubkey2 *pubkey, const unsigned char *tweak) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3)
Tweak a public key by multiplying it by a tweak value.
Definition: secp256k1_2.c:564
WNAF_SIZE_BITS
#define WNAF_SIZE_BITS(bits, w)
Definition: ecmult_impl.h:50
ECMULT_PIPPENGER_THRESHOLD
#define ECMULT_PIPPENGER_THRESHOLD
Definition: ecmult_impl.h:66
b
void const uint64_t * b
Definition: field_5x52_asm_impl.h:10
test_ecmult_multi_pippenger_max_points
void test_ecmult_multi_pippenger_max_points(void)
Probabilistically test the function returning the maximum number of possible points for a given scrat...
Definition: tests.c:2917
ecmult_const_chain_multiply
void ecmult_const_chain_multiply(void)
Definition: tests.c:2602
fsbridge::fopen
FILE * fopen(const fs::path &p, const char *mode)
Definition: fs.cpp:13
ecmult_multi_data::sc
secp256k1_scalar * sc
Definition: tests.c:2636
secp256k1_ecdsa_sign2ature2
Opaque data structured that holds a parsed ECDSA signature.
Definition: secp256k1_2.h:79
secp256k1_ec_pubkey_create2
SECP256K1_API SECP256K1_WARN_UNUSED_RESULT int secp256k1_ec_pubkey_create2(const secp256k1_context2 *ctx, secp256k1_pubkey2 *pubkey, const unsigned char *seckey) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3)
Compute the public key for a secret key.
Definition: secp256k1_2.c:434
run_group_decompress
void run_group_decompress(void)
Definition: tests.c:2400
secp256k1_ecdsa_sign2ature2_parse_compact
SECP256K1_API int secp256k1_ecdsa_sign2ature2_parse_compact(const secp256k1_context2 *ctx, secp256k1_ecdsa_sign2ature2 *sig, const unsigned char *input64) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3)
Parse an ECDSA signature in compact (64 bytes) format.
Definition: secp256k1_2.c:255
run_sqr
void run_sqr(void)
Definition: tests.c:535
testrand_impl.h
check_fe_inverse
int check_fe_inverse(const secp256k1_fe_t *a, const secp256k1_fe_t *ai)
Definition: tests.c:473
secp256k1_gej::x
secp256k1_fe x
Definition: group.h:25
test_ge
void test_ge(void)
Definition: tests.c:619
test_sqrt
void test_sqrt(const secp256k1_fe_t *a, const secp256k1_fe_t *k)
Definition: tests.c:550
SECP256K1_SCALAR_CONST
#define SECP256K1_SCALAR_CONST(d7, d6, d5, d4, d3, d2, d1, d0)
Definition: scalar_4x64.h:17
run_rand_int
void run_rand_int(void)
Definition: tests.c:522
random_group_element_jacobian_test
void random_group_element_jacobian_test(secp256k1_gej_t *gej, const secp256k1_ge_t *ge)
Definition: tests.c:54
tinyformat::printf
void printf(const char *fmt, const Args &... args)
Format list of arguments to std::cout, according to the given format string.
Definition: tinyformat.h:975
random_fe
void random_fe(secp256k1_fe_t *x)
Definition: tests.c:437
tests_impl.h
secp256k1_scratch_space_create
SECP256K1_API SECP256K1_WARN_UNUSED_RESULT secp256k1_scratch_space2 * secp256k1_scratch_space_create(const secp256k1_context2 *ctx, size_t max_size) SECP256K1_ARG_NONNULL(1)
Create a secp256k1 scratch space object.
Definition: secp256k1_2.c:135
WNAF_SIZE
#define WNAF_SIZE(w)
Definition: ecmult_impl.h:51
secp256k1_context_set_error_callback
SECP256K1_API void secp256k1_context_set_error_callback(secp256k1_context2 *ctx, void(*fun)(const char *message, void *data), const void *data) SECP256K1_ARG_NONNULL(1)
Set a callback function to be called when an internal consistency check fails.
Definition: secp256k1_2.c:127
run_ecdsa_sign_verify
void run_ecdsa_sign_verify(void)
Definition: tests.c:875
ec_privkey_export_der
int ec_privkey_export_der(const secp256k1_context2 *ctx, unsigned char *privkey, size_t *privkeylen, const unsigned char *key32, int compressed)
Export a private key in DER format.
Definition: lax_der_privatekey_parsing.c:56
ge_equals_ge
int ge_equals_ge(const secp256k1_ge_t *a, const secp256k1_ge_t *b)
Definition: tests.c:598
random_num_order
void random_num_order(secp256k1_num_t *num)
Definition: tests.c:106
run_scalar_tests
void run_scalar_tests(void)
Definition: tests.c:405
ecmult_multi_data
Definition: tests.c:2635
SECP256K1_GE_CONST
#define SECP256K1_GE_CONST(a, b, c, d, e, f, g, h, i, j, k, l, m, n, o, p)
Definition: group.h:20
test_group_decompress
void test_group_decompress(const secp256k1_fe *x)
Definition: tests.c:2336
ecmult_const_commutativity
void ecmult_const_commutativity(void)
Definition: tests.c:2559
test_ec_combine
void test_ec_combine(void)
Definition: tests.c:2304
run_ec_pubkey_parse_test
void run_ec_pubkey_parse_test(void)
Definition: tests.c:3430
memcpy
void * memcpy(void *a, const void *b, size_t c)
Definition: glibc_compat.cpp:15
run_ecmult_multi_tests
void run_ecmult_multi_tests(void)
Definition: tests.c:3005
secp256k1_pubkey2
Opaque data structure that holds a parsed and valid public key.
Definition: secp256k1_2.h:66
tests_impl.h
VG_UNDEF
#define VG_UNDEF(x, y)
Definition: tests.c:40
secp256k1_ec_pubkey_serialize2
SECP256K1_API int secp256k1_ec_pubkey_serialize2(const secp256k1_context2 *ctx, unsigned char *output, size_t *outputlen, const secp256k1_pubkey2 *pubkey, unsigned int flags) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3) SECP256K1_ARG_NONNULL(4)
Serialize a pubkey object into a serialized byte sequence.
Definition: secp256k1_2.c:192
memmove
void * memmove(void *a, const void *b, size_t c)
run_ecmult_gen_blind
void run_ecmult_gen_blind(void)
Definition: tests.c:3317
secp256k1_sha256
Definition: hash.h:13
run_point_times_order
void run_point_times_order(void)
Definition: tests.c:789
secp256k1_context_destroy
SECP256K1_API void secp256k1_context_destroy(secp256k1_context2 *ctx)
Destroy a secp256k1 context object.
Definition: secp256k1_2.c:110
lax_der_parsing.c
run_ecmult_const_tests
void run_ecmult_const_tests(void)
Definition: tests.c:2628
secp256k1_gej::z
secp256k1_fe z
Definition: group.h:27
test_fixed_wnaf_small
void test_fixed_wnaf_small(void)
Definition: tests.c:3164
run_eckey_edge_case_test
void run_eckey_edge_case_test(void)
Definition: tests.c:3757
random_scalar_order_test
void random_scalar_order_test(secp256k1_scalar_t *num)
Definition: tests.c:68
secp256k1_context_struct2::ecmult_ctx
secp256k1_ecmult_context ecmult_ctx
Definition: secp256k1_types.h:16
run_ecdh_tests
void run_ecdh_tests(void)
Definition: tests_impl.h:99
test_secp256k1_pippenger_bucket_window_inv
void test_secp256k1_pippenger_bucket_window_inv(void)
Definition: tests.c:2895
run_rand_bits
void run_rand_bits(void)
Definition: tests.c:514
test_ecmult_gen_blind_reset
void test_ecmult_gen_blind_reset(void)
Definition: tests.c:3305
check_fe_equal
int check_fe_equal(const secp256k1_fe_t *a, const secp256k1_fe_t *b)
Definition: tests.c:467
ge_equals_gej
void ge_equals_gej(const secp256k1_ge_t *a, const secp256k1_gej_t *b)
Definition: tests.c:604
test_ecmult_gen_blind
void test_ecmult_gen_blind(void)
Definition: tests.c:3282
r
void const uint64_t uint64_t * r
Definition: field_5x52_asm_impl.h:10
run_ecmult_chain
void run_ecmult_chain(void)
Definition: tests.c:706
test_ecdsa_der_parse
int test_ecdsa_der_parse(const unsigned char *sig, size_t siglen, int certainly_der, int certainly_not_der)
Definition: tests.c:4287
run_num_smalltests
void run_num_smalltests(void)
Definition: tests.c:161
secp256k1_scalar
A scalar modulo the group order of the secp256k1 curve.
Definition: scalar_4x64.h:13
random_num_negate
void random_num_negate(secp256k1_num_t *num)
Definition: tests.c:95
run_ec_combine
void run_ec_combine(void)
Definition: tests.c:2329
is_empty_signature
int is_empty_signature(const secp256k1_ecdsa_sign2ature2 *sig)
Definition: tests.c:4077
random_scalar_order
void random_scalar_order(secp256k1_scalar_t *num)
Definition: tests.c:80
run_sha256_tests
void run_sha256_tests(void)
Definition: tests.c:340
SECP256K1_EC_UNCOMPRESSED
#define SECP256K1_EC_UNCOMPRESSED
Definition: secp256k1_2.h:173
SECP256K1_EC_PARSE_TEST_NXVALID
#define SECP256K1_EC_PARSE_TEST_NXVALID
secp256k1_ec_seckey_verify2
SECP256K1_API SECP256K1_WARN_UNUSED_RESULT int secp256k1_ec_seckey_verify2(const secp256k1_context2 *ctx, const unsigned char *seckey) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2)
Verify an ECDSA secret key.
Definition: secp256k1_2.c:421
secp256k1_gej
A group element of the secp256k1 curve, in jacobian coordinates.
Definition: group.h:24
test_random_pubkeys
void test_random_pubkeys(void)
Definition: tests.c:4213
test_ecdsa_sign_verify
void test_ecdsa_sign_verify(void)
Definition: tests.c:856
PIPPENGER_SCRATCH_OBJECTS
#define PIPPENGER_SCRATCH_OBJECTS
Definition: ecmult_impl.h:57
test_num_negate
void test_num_negate(void)
Definition: tests.c:112
secp256k1_context_randomize2
SECP256K1_API SECP256K1_WARN_UNUSED_RESULT int secp256k1_context_randomize2(secp256k1_context2 *ctx, const unsigned char *seed32) SECP256K1_ARG_NONNULL(1)
Updates the context randomization to protect against side-channel leakage.
Definition: secp256k1_2.c:588
random_fe_non_square
void random_fe_non_square(secp256k1_fe_t *ns)
Definition: tests.c:459
test_ecmult_multi_batching
void test_ecmult_multi_batching(void)
Run secp256k1_ecmult_multi_var with num points and a scratch space restricted to 1 <= i <= num points...
Definition: tests.c:2944
run_whitelist_tests
void run_whitelist_tests(void)
Definition: tests_impl.h:140
secp256k1_ec_pubkey_tweak_add2
SECP256K1_API SECP256K1_WARN_UNUSED_RESULT int secp256k1_ec_pubkey_tweak_add2(const secp256k1_context2 *ctx, secp256k1_pubkey2 *pubkey, const unsigned char *tweak) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3)
Tweak a public key by adding tweak times the generator to it.
Definition: secp256k1_2.c:518
run_random_pubkeys
void run_random_pubkeys(void)
Definition: tests.c:4273
run_hmac_sha256_tests
void run_hmac_sha256_tests(void)
Definition: tests.c:376
ecmult_multi_data::pt
secp256k1_ge * pt
Definition: tests.c:2637
secp256k1_fe
Definition: field_10x26.h:12
secp256k1_ecdsa_sign2
SECP256K1_API int secp256k1_ecdsa_sign2(const secp256k1_context2 *ctx, secp256k1_ecdsa_sign2ature2 *sig, const unsigned char *msg32, const unsigned char *seckey, secp256k1_nonce_function2 noncefp, const void *ndata) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3) SECP256K1_ARG_NONNULL(4)
Create an ECDSA signature.
Definition: secp256k1_2.c:375
test_ecmult_multi
void test_ecmult_multi(secp256k1_scratch *scratch, secp256k1_ecmult_multi_func ecmult_multi)
Definition: tests.c:2655
secp256k1_gej::y
secp256k1_fe y
Definition: group.h:26
run_sqrt
void run_sqrt(void)
Definition: tests.c:564
run_ge
void run_ge(void)
Definition: tests.c:698
gej_xyz_equals_gej
int gej_xyz_equals_gej(const secp256k1_gej *a, const secp256k1_gej *b)
Definition: tests.c:1987
ec_privkey_import_der
int ec_privkey_import_der(const secp256k1_context2 *ctx, unsigned char *out32, const unsigned char *privkey, size_t privkeylen)
Import a private key in DER format.
Definition: lax_der_privatekey_parsing.c:12
STRAUSS_SCRATCH_OBJECTS
#define STRAUSS_SCRATCH_OBJECTS
Definition: ecmult_impl.h:58
run_field_inv_all_var
void run_field_inv_all_var(void)
Definition: tests.c:518
test_wnaf
void test_wnaf(const secp256k1_scalar_t *number, int w)
Definition: tests.c:807
SECP256K1_EC_PARSE_TEST_NVALID
#define SECP256K1_EC_PARSE_TEST_NVALID
run_context_tests
void run_context_tests(void)
Definition: tests.c:186
secp256k1_ecdsa_sign2ature2_normalize
SECP256K1_API int secp256k1_ecdsa_sign2ature2_normalize(const secp256k1_context2 *ctx, secp256k1_ecdsa_sign2ature2 *sigout, const secp256k1_ecdsa_sign2ature2 *sigin) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(3)
Convert a signature to a normalized lower-S form.
Definition: secp256k1_2.c:301
secp256k1_ec_privkey_tweak_mul2
SECP256K1_API SECP256K1_WARN_UNUSED_RESULT int secp256k1_ec_privkey_tweak_mul2(const secp256k1_context2 *ctx, unsigned char *seckey, const unsigned char *tweak) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3)
Tweak a private key by multiplying it by a tweak.
Definition: secp256k1_2.c:542
ecdsa_signature_parse_der_lax
int ecdsa_signature_parse_der_lax(const secp256k1_context2 *ctx, secp256k1_ecdsa_sign2ature2 *sig, const unsigned char *input, size_t inputlen)
Parse a signature in "lax DER" format.
Definition: lax_der_parsing.c:12
run_ecdsa_der_parse
void run_ecdsa_der_parse(void)
Definition: tests.c:4586
tests_impl.h
secp256k1_ecmult_multi_func
int(* secp256k1_ecmult_multi_func)(const secp256k1_ecmult_context *, secp256k1_scratch *, secp256k1_gej *, const secp256k1_scalar *, secp256k1_ecmult_multi_callback cb, void *, size_t)
Definition: ecmult_impl.h:975
secp256k1_scalar::d
uint64_t d[4]
Definition: scalar_4x64.h:18
secp256k1_ecdsa_sign2ature2_serialize_der
SECP256K1_API int secp256k1_ecdsa_sign2ature2_serialize_der(const secp256k1_context2 *ctx, unsigned char *output, size_t *outputlen, const secp256k1_ecdsa_sign2ature2 *sig) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3) SECP256K1_ARG_NONNULL(4)
Serialize an ECDSA signature in DER format.
Definition: secp256k1_2.c:276
lax_der_privatekey_parsing.c
run_field_inv
void run_field_inv(void)
Definition: tests.c:479
secp256k1_ecmult_gen_context::initial
secp256k1_gej initial
Definition: ecmult_gen.h:32
secp256k1_num
Definition: num_gmp.h:14
low
sph_u32 low
Definition: keccak.c:370
secp256k1_ec_pubkey_negate2
SECP256K1_API SECP256K1_WARN_UNUSED_RESULT int secp256k1_ec_pubkey_negate2(const secp256k1_context2 *ctx, secp256k1_pubkey2 *pubkey) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2)
Negates a public key in place.
Definition: secp256k1_2.c:469
secp256k1_context_clone
SECP256K1_API secp256k1_context2 * secp256k1_context_clone(const secp256k1_context2 *ctx) SECP256K1_ARG_NONNULL(1) SECP256K1_WARN_UNUSED_RESULT
Copies a secp256k1 context object.
Definition: secp256k1_2.c:101
secp256k1_context_struct2::error_callback
secp256k1_callback error_callback
Definition: secp256k1_types.h:19
test_fixed_wnaf
void test_fixed_wnaf(const secp256k1_scalar *number, int w)
Definition: tests.c:3114
run_recovery_tests
void run_recovery_tests(void)
Definition: tests_impl.h:382
test_fixed_wnaf_small_helper
void test_fixed_wnaf_small_helper(int *wnaf, int *wnaf_expected, int w)
Definition: tests.c:3154
SECP256K1_EC_PARSE_TEST_NINVALID
#define SECP256K1_EC_PARSE_TEST_NINVALID
random_sign
void random_sign(secp256k1_ecdsa_sig_t *sig, const secp256k1_scalar_t *key, const secp256k1_scalar_t *msg, int *recid)
Definition: tests.c:849
test_ecdsa_end_to_end
void test_ecdsa_end_to_end(void)
Definition: tests.c:881
main
int main(int argc, char **argv)
Definition: tests.c:1143
random_field_element_test
void random_field_element_test(secp256k1_fe_t *fe)
Definition: tests.c:26
secp256k1_ge::infinity
int infinity
Definition: group.h:21
secp256k1_ec_pubkey_combine2
SECP256K1_API SECP256K1_WARN_UNUSED_RESULT int secp256k1_ec_pubkey_combine2(const secp256k1_context2 *ctx, secp256k1_pubkey2 *out, const secp256k1_pubkey2 *const *ins, size_t n) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3)
Add a number of public keys together.
Definition: secp256k1_2.c:595
run_rangeproof_tests
void run_rangeproof_tests(void)
Definition: tests_impl.h:514
secp256k1_2.c
run_bulletproofs_tests
void run_bulletproofs_tests(void)
Definition: tests_impl.h:1137
secp256k1_hmac_sha256
Definition: hash.h:23
tests_impl.h
tests_impl.h
secp256k1_context_struct2
Definition: secp256k1_types.h:15
test_num_add_sub
void test_num_add_sub(void)
Definition: tests.c:132
scalar_test
void scalar_test(void)
Definition: tests.c:171
test_rand_bits
void test_rand_bits(int rand32, int bits)
Definition: tests.c:463
secp256k1_callback::fn
void(* fn)(const char *text, void *data)
Definition: util.h:23
random_num_order_test
void random_num_order_test(secp256k1_num_t *num)
Definition: tests.c:100
VG_CHECK
#define VG_CHECK(x, y)
Definition: tests.c:41
run_surjection_tests
void run_surjection_tests(void)
Definition: tests_impl.h:474
tests_impl.h
test_rand_int
void test_rand_int(uint32_t range, uint32_t subrange)
Definition: tests.c:498
SECP256K1_FE_STORAGE_CONST
#define SECP256K1_FE_STORAGE_CONST(d7, d6, d5, d4, d3, d2, d1, d0)
Definition: field_10x26.h:45
test_constant_wnaf_negate
void test_constant_wnaf_negate(const secp256k1_scalar *number)
Definition: tests.c:3058
ec_pubkey_parse_pointtest
void ec_pubkey_parse_pointtest(const unsigned char *input, int xvalid, int yvalid)
Definition: tests.c:3355
key
CKey key
Definition: bip38tooldialog.cpp:173
secp256k1_ecdsa_sign2ature2_parse_der
SECP256K1_API int secp256k1_ecdsa_sign2ature2_parse_der(const secp256k1_context2 *ctx, secp256k1_ecdsa_sign2ature2 *sig, const unsigned char *input, size_t inputlen) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3)
Parse a DER ECDSA signature.
Definition: secp256k1_2.c:239
random_group_element_test
void random_group_element_test(secp256k1_ge_t *ge)
Definition: tests.c:45
secp256k1_2.h
run_util_tests
void run_util_tests(void)
Definition: tests.c:140
secp256k1_rfc6979_hmac_sha256
Definition: hash.h:31
run_scratch_tests
void run_scratch_tests(void)
Definition: tests.c:300
test_ecmult_constants
void test_ecmult_constants(void)
Definition: tests.c:3245
secp256k1_context_set_illegal_callback
SECP256K1_API void secp256k1_context_set_illegal_callback(secp256k1_context2 *ctx, void(*fun)(const char *message, void *data), const void *data) SECP256K1_ARG_NONNULL(1)
Set a callback function to be called when an illegal argument is passed to an API call.
Definition: secp256k1_2.c:119
tests_impl.h
secp256k1_ecmult_gen_context::blind
secp256k1_scalar blind
Definition: ecmult_gen.h:31
run_rfc6979_hmac_sha256_tests
void run_rfc6979_hmac_sha256_tests(void)
Definition: tests.c:420
run_generator_tests
void run_generator_tests(void)
Definition: tests_impl.h:212
test_ecdsa_edge_cases
void test_ecdsa_edge_cases(void)
Definition: tests.c:977
tests_impl.h
secp256k1_ecdsa_verify2
SECP256K1_API SECP256K1_WARN_UNUSED_RESULT int secp256k1_ecdsa_verify2(const secp256k1_context2 *ctx, const secp256k1_ecdsa_sign2ature2 *sig, const unsigned char *msg32, const secp256k1_pubkey2 *pubkey) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3) SECP256K1_ARG_NONNULL(4)
Verify an ECDSA signature.
Definition: secp256k1_2.c:320
secp256k1_context_create2
SECP256K1_API secp256k1_context2 * secp256k1_context_create2(unsigned int flags) SECP256K1_WARN_UNUSED_RESULT
Create a secp256k1 context object.
Definition: secp256k1_2.c:75
random_fe_test
void random_fe_test(secp256k1_fe *x)
Definition: tests.c:1708
run_ecdsa_edge_cases
void run_ecdsa_edge_cases(void)
Definition: tests.c:1087
run_field_convert
void run_field_convert(void)
Definition: tests.c:1754
scalar_chacha_tests
void scalar_chacha_tests(void)
Definition: tests.c:1010
test_add_neg_y_diff_x
void test_add_neg_y_diff_x(void)
Definition: tests.c:2229
ecmult_const_mult_zero_one
void ecmult_const_mult_zero_one(void)
Definition: tests.c:2580
run_wnaf
void run_wnaf(void)
Definition: tests.c:839
ALIGNMENT
#define ALIGNMENT
Definition: scratch_impl.h:16
secp256k1_ge::x
secp256k1_fe x
Definition: group.h:19
ecmult_const_random_mult
void ecmult_const_random_mult(void)
Definition: tests.c:2532
secp256k1_ecdsa_sign2ature2_serialize_compact
SECP256K1_API int secp256k1_ecdsa_sign2ature2_serialize_compact(const secp256k1_context2 *ctx, unsigned char *output64, const secp256k1_ecdsa_sign2ature2 *sig) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3)
Serialize an ECDSA signature in compact (64 byte) format.
Definition: secp256k1_2.c:288
SECP256K1_CONTEXT_VERIFY
#define SECP256K1_CONTEXT_VERIFY
Flags to pass to secp256k1_context_create2.
Definition: secp256k1_2.h:167
fe_memcmp
int fe_memcmp(const secp256k1_fe *a, const secp256k1_fe *b)
Definition: tests.c:1784
CHECK
#define CHECK(cond)
Definition: util.h:43
secp256k1_ec_privkey_tweak_add2
SECP256K1_API SECP256K1_WARN_UNUSED_RESULT int secp256k1_ec_privkey_tweak_add2(const secp256k1_context2 *ctx, unsigned char *seckey, const unsigned char *tweak) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3)
Tweak a private key by adding tweak to it.
Definition: secp256k1_2.c:495
secp256k1_ge
A group element of the secp256k1 curve, in affine coordinates.
Definition: group.h:14
secp256k1_ec_pubkey_parse2
SECP256K1_API SECP256K1_WARN_UNUSED_RESULT int secp256k1_ec_pubkey_parse2(const secp256k1_context2 *ctx, secp256k1_pubkey2 *pubkey, const unsigned char *input, size_t inputlen) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3)
Parse a variable-length public key into the pubkey object.
Definition: secp256k1_2.c:177
run_field_inv_var
void run_field_inv_var(void)
Definition: tests.c:490
secp256k1_context_struct2::ecmult_gen_ctx
secp256k1_ecmult_gen_context ecmult_gen_ctx
Definition: secp256k1_types.h:17
SECP256K1_FE_CONST
#define SECP256K1_FE_CONST(d7, d6, d5, d4, d3, d2, d1, d0)
Definition: field_10x26.h:38
SECP256K1_CONTEXT_SIGN
#define SECP256K1_CONTEXT_SIGN
Definition: secp256k1_2.h:168
test_num_jacobi
void test_num_jacobi(void)
Definition: tests.c:647
Generated on Tue Apr 28 2026 00:02:59 for PRCYCoin by   doxygen 1.8.17