lib/crypto/curve25519-selftest.c

   1 // SPDX-License-Identifier: GPL-2.0 OR MIT
   2 /*
   3  * Copyright (C) 2015-2019 Jason A. Donenfeld <Jason@zx2c4.com>. All Rights Reserved.
   4  */
   5
   6 #include <crypto/curve25519.h>
   7
   8 struct curve25519_test_vector {
   9         u8 private[CURVE25519_KEY_SIZE];
  10         u8 public[CURVE25519_KEY_SIZE];
  11         u8 result[CURVE25519_KEY_SIZE];
  12         bool valid;
  13 };
  14 static const struct curve25519_test_vector curve25519_test_vectors[] __initconst = {
  15         {
  16                 .private = { 0x77, 0x07, 0x6d, 0x0a, 0x73, 0x18, 0xa5, 0x7d,
  17                              0x3c, 0x16, 0xc1, 0x72, 0x51, 0xb2, 0x66, 0x45,
  18                              0xdf, 0x4c, 0x2f, 0x87, 0xeb, 0xc0, 0x99, 0x2a,
  19                              0xb1, 0x77, 0xfb, 0xa5, 0x1d, 0xb9, 0x2c, 0x2a },
  20                 .public = { 0xde, 0x9e, 0xdb, 0x7d, 0x7b, 0x7d, 0xc1, 0xb4,
  21                             0xd3, 0x5b, 0x61, 0xc2, 0xec, 0xe4, 0x35, 0x37,
  22                             0x3f, 0x83, 0x43, 0xc8, 0x5b, 0x78, 0x67, 0x4d,
  23                             0xad, 0xfc, 0x7e, 0x14, 0x6f, 0x88, 0x2b, 0x4f },
  24                 .result = { 0x4a, 0x5d, 0x9d, 0x5b, 0xa4, 0xce, 0x2d, 0xe1,
  25                             0x72, 0x8e, 0x3b, 0xf4, 0x80, 0x35, 0x0f, 0x25,
  26                             0xe0, 0x7e, 0x21, 0xc9, 0x47, 0xd1, 0x9e, 0x33,
  27                             0x76, 0xf0, 0x9b, 0x3c, 0x1e, 0x16, 0x17, 0x42 },
  28                 .valid = true
  29         },
  30         {
  31                 .private = { 0x5d, 0xab, 0x08, 0x7e, 0x62, 0x4a, 0x8a, 0x4b,
  32                              0x79, 0xe1, 0x7f, 0x8b, 0x83, 0x80, 0x0e, 0xe6,
  33                              0x6f, 0x3b, 0xb1, 0x29, 0x26, 0x18, 0xb6, 0xfd,
  34                              0x1c, 0x2f, 0x8b, 0x27, 0xff, 0x88, 0xe0, 0xeb },
  35                 .public = { 0x85, 0x20, 0xf0, 0x09, 0x89, 0x30, 0xa7, 0x54,
  36                             0x74, 0x8b, 0x7d, 0xdc, 0xb4, 0x3e, 0xf7, 0x5a,
  37                             0x0d, 0xbf, 0x3a, 0x0d, 0x26, 0x38, 0x1a, 0xf4,
  38                             0xeb, 0xa4, 0xa9, 0x8e, 0xaa, 0x9b, 0x4e, 0x6a },
  39                 .result = { 0x4a, 0x5d, 0x9d, 0x5b, 0xa4, 0xce, 0x2d, 0xe1,
  40                             0x72, 0x8e, 0x3b, 0xf4, 0x80, 0x35, 0x0f, 0x25,
  41                             0xe0, 0x7e, 0x21, 0xc9, 0x47, 0xd1, 0x9e, 0x33,
  42                             0x76, 0xf0, 0x9b, 0x3c, 0x1e, 0x16, 0x17, 0x42 },
  43                 .valid = true
  44         },
  45         {
  46                 .private = { 1 },
  47                 .public = { 0x25, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
  48                             0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
  49                             0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
  50                             0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 },
  51                 .result = { 0x3c, 0x77, 0x77, 0xca, 0xf9, 0x97, 0xb2, 0x64,
  52                             0x41, 0x60, 0x77, 0x66, 0x5b, 0x4e, 0x22, 0x9d,
  53                             0x0b, 0x95, 0x48, 0xdc, 0x0c, 0xd8, 0x19, 0x98,
  54                             0xdd, 0xcd, 0xc5, 0xc8, 0x53, 0x3c, 0x79, 0x7f },
  55                 .valid = true
  56         },
  57         {
  58                 .private = { 1 },
  59                 .public = { 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
  60                             0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
  61                             0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
  62                             0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff },
  63                 .result = { 0xb3, 0x2d, 0x13, 0x62, 0xc2, 0x48, 0xd6, 0x2f,
  64                             0xe6, 0x26, 0x19, 0xcf, 0xf0, 0x4d, 0xd4, 0x3d,
  65                             0xb7, 0x3f, 0xfc, 0x1b, 0x63, 0x08, 0xed, 0xe3,
  66                             0x0b, 0x78, 0xd8, 0x73, 0x80, 0xf1, 0xe8, 0x34 },
  67                 .valid = true
  68         },
  69         {
  70                 .private = { 0xa5, 0x46, 0xe3, 0x6b, 0xf0, 0x52, 0x7c, 0x9d,
  71                              0x3b, 0x16, 0x15, 0x4b, 0x82, 0x46, 0x5e, 0xdd,
  72                              0x62, 0x14, 0x4c, 0x0a, 0xc1, 0xfc, 0x5a, 0x18,
  73                              0x50, 0x6a, 0x22, 0x44, 0xba, 0x44, 0x9a, 0xc4 },
  74                 .public = { 0xe6, 0xdb, 0x68, 0x67, 0x58, 0x30, 0x30, 0xdb,
  75                             0x35, 0x94, 0xc1, 0xa4, 0x24, 0xb1, 0x5f, 0x7c,
  76                             0x72, 0x66, 0x24, 0xec, 0x26, 0xb3, 0x35, 0x3b,
  77                             0x10, 0xa9, 0x03, 0xa6, 0xd0, 0xab, 0x1c, 0x4c },
  78                 .result = { 0xc3, 0xda, 0x55, 0x37, 0x9d, 0xe9, 0xc6, 0x90,
  79                             0x8e, 0x94, 0xea, 0x4d, 0xf2, 0x8d, 0x08, 0x4f,
  80                             0x32, 0xec, 0xcf, 0x03, 0x49, 0x1c, 0x71, 0xf7,
  81                             0x54, 0xb4, 0x07, 0x55, 0x77, 0xa2, 0x85, 0x52 },
  82                 .valid = true
  83         },
  84         {
  85                 .private = { 1, 2, 3, 4 },
  86                 .public = { 0 },
  87                 .result = { 0 },
  88                 .valid = false
  89         },
  90         {
  91                 .private = { 2, 4, 6, 8 },
  92                 .public = { 0xe0, 0xeb, 0x7a, 0x7c, 0x3b, 0x41, 0xb8, 0xae,
  93                             0x16, 0x56, 0xe3, 0xfa, 0xf1, 0x9f, 0xc4, 0x6a,
  94                             0xda, 0x09, 0x8d, 0xeb, 0x9c, 0x32, 0xb1, 0xfd,
  95                             0x86, 0x62, 0x05, 0x16, 0x5f, 0x49, 0xb8 },
  96                 .result = { 0 },
  97                 .valid = false
  98         },
  99         {
 100                 .private = { 0xff, 0xff, 0xff, 0xff, 0x0a, 0xff, 0xff, 0xff,
 101                              0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
 102                              0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
 103                              0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff },
 104                 .public = { 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
 105                             0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
 106                             0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
 107                             0xff, 0xff, 0xff, 0xff, 0x0a, 0x00, 0xfb, 0x9f },
 108                 .result = { 0x77, 0x52, 0xb6, 0x18, 0xc1, 0x2d, 0x48, 0xd2,
 109                             0xc6, 0x93, 0x46, 0x83, 0x81, 0x7c, 0xc6, 0x57,
 110                             0xf3, 0x31, 0x03, 0x19, 0x49, 0x48, 0x20, 0x05,
 111                             0x42, 0x2b, 0x4e, 0xae, 0x8d, 0x1d, 0x43, 0x23 },
 112                 .valid = true
 113         },
 114         {
 115                 .private = { 0x8e, 0x0a, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 116                              0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 117                              0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 118                              0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 },
 119                 .public = { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 120                             0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 121                             0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 122                             0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x8e, 0x06 },
 123                 .result = { 0x5a, 0xdf, 0xaa, 0x25, 0x86, 0x8e, 0x32, 0x3d,
 124                             0xae, 0x49, 0x62, 0xc1, 0x01, 0x5c, 0xb3, 0x12,
 125                             0xe1, 0xc5, 0xc7, 0x9e, 0x95, 0x3f, 0x03, 0x99,
 126                             0xb0, 0xba, 0x16, 0x22, 0xf3, 0xb6, 0xf7, 0x0c },
 127                 .valid = true
 128         },
 129         /* wycheproof - normal case */
 130         {
 131                 .private = { 0x48, 0x52, 0x83, 0x4d, 0x9d, 0x6b, 0x77, 0xda,
 132                              0xde, 0xab, 0xaa, 0xf2, 0xe1, 0x1d, 0xca, 0x66,
 133                              0xd1, 0x9f, 0xe7, 0x49, 0x93, 0xa7, 0xbe, 0xc3,
 134                              0x6c, 0x6e, 0x16, 0xa0, 0x98, 0x3f, 0xea, 0xba },
 135                 .public = { 0x9c, 0x64, 0x7d, 0x9a, 0xe5, 0x89, 0xb9, 0xf5,
 136                             0x8f, 0xdc, 0x3c, 0xa4, 0x94, 0x7e, 0xfb, 0xc9,
 137                             0x15, 0xc4, 0xb2, 0xe0, 0x8e, 0x74, 0x4a, 0x0e,
 138                             0xdf, 0x46, 0x9d, 0xac, 0x59, 0xc8, 0xf8, 0x5a },
 139                 .result = { 0x87, 0xb7, 0xf2, 0x12, 0xb6, 0x27, 0xf7, 0xa5,
 140                             0x4c, 0xa5, 0xe0, 0xbc, 0xda, 0xdd, 0xd5, 0x38,
 141                             0x9d, 0x9d, 0xe6, 0x15, 0x6c, 0xdb, 0xcf, 0x8e,
 142                             0xbe, 0x14, 0xff, 0xbc, 0xfb, 0x43, 0x65, 0x51 },
 143                 .valid = true
 144         },
 145         /* wycheproof - public key on twist */
 146         {
 147                 .private = { 0x58, 0x8c, 0x06, 0x1a, 0x50, 0x80, 0x4a, 0xc4,
 148                              0x88, 0xad, 0x77, 0x4a, 0xc7, 0x16, 0xc3, 0xf5,
 149                              0xba, 0x71, 0x4b, 0x27, 0x12, 0xe0, 0x48, 0x49,
 150                              0x13, 0x79, 0xa5, 0x00, 0x21, 0x19, 0x98, 0xa8 },
 151                 .public = { 0x63, 0xaa, 0x40, 0xc6, 0xe3, 0x83, 0x46, 0xc5,
 152                             0xca, 0xf2, 0x3a, 0x6d, 0xf0, 0xa5, 0xe6, 0xc8,
 153                             0x08, 0x89, 0xa0, 0x86, 0x47, 0xe5, 0x51, 0xb3,
 154                             0x56, 0x34, 0x49, 0xbe, 0xfc, 0xfc, 0x97, 0x33 },
 155                 .result = { 0xb1, 0xa7, 0x07, 0x51, 0x94, 0x95, 0xff, 0xff,
 156                             0xb2, 0x98, 0xff, 0x94, 0x17, 0x16, 0xb0, 0x6d,
 157                             0xfa, 0xb8, 0x7c, 0xf8, 0xd9, 0x11, 0x23, 0xfe,
 158                             0x2b, 0xe9, 0xa2, 0x33, 0xdd, 0xa2, 0x22, 0x12 },
 159                 .valid = true
 160         },
 161         /* wycheproof - public key on twist */
 162         {
 163                 .private = { 0xb0, 0x5b, 0xfd, 0x32, 0xe5, 0x53, 0x25, 0xd9,
 164                              0xfd, 0x64, 0x8c, 0xb3, 0x02, 0x84, 0x80, 0x39,
 165                              0x00, 0x0b, 0x39, 0x0e, 0x44, 0xd5, 0x21, 0xe5,
 166                              0x8a, 0xab, 0x3b, 0x29, 0xa6, 0x96, 0x0b, 0xa8 },
 167                 .public = { 0x0f, 0x83, 0xc3, 0x6f, 0xde, 0xd9, 0xd3, 0x2f,
 168                             0xad, 0xf4, 0xef, 0xa3, 0xae, 0x93, 0xa9, 0x0b,
 169                             0xb5, 0xcf, 0xa6, 0x68, 0x93, 0xbc, 0x41, 0x2c,
 170                             0x43, 0xfa, 0x72, 0x87, 0xdb, 0xb9, 0x97, 0x79 },
 171                 .result = { 0x67, 0xdd, 0x4a, 0x6e, 0x16, 0x55, 0x33, 0x53,
 172                             0x4c, 0x0e, 0x3f, 0x17, 0x2e, 0x4a, 0xb8, 0x57,
 173                             0x6b, 0xca, 0x92, 0x3a, 0x5f, 0x07, 0xb2, 0xc0,
 174                             0x69, 0xb4, 0xc3, 0x10, 0xff, 0x2e, 0x93, 0x5b },
 175                 .valid = true
 176         },
 177         /* wycheproof - public key on twist */
 178         {
 179                 .private = { 0x70, 0xe3, 0x4b, 0xcb, 0xe1, 0xf4, 0x7f, 0xbc,
 180                              0x0f, 0xdd, 0xfd, 0x7c, 0x1e, 0x1a, 0xa5, 0x3d,
 181                              0x57, 0xbf, 0xe0, 0xf6, 0x6d, 0x24, 0x30, 0x67,
 182                              0xb4, 0x24, 0xbb, 0x62, 0x10, 0xbe, 0xd1, 0x9c },
 183                 .public = { 0x0b, 0x82, 0x11, 0xa2, 0xb6, 0x04, 0x90, 0x97,
 184                             0xf6, 0x87, 0x1c, 0x6c, 0x05, 0x2d, 0x3c, 0x5f,
 185                             0xc1, 0xba, 0x17, 0xda, 0x9e, 0x32, 0xae, 0x45,
 186                             0x84, 0x03, 0xb0, 0x5b, 0xb2, 0x83, 0x09, 0x2a },
 187                 .result = { 0x4a, 0x06, 0x38, 0xcf, 0xaa, 0x9e, 0xf1, 0x93,
 188                             0x3b, 0x47, 0xf8, 0x93, 0x92, 0x96, 0xa6, 0xb2,
 189                             0x5b, 0xe5, 0x41, 0xef, 0x7f, 0x70, 0xe8, 0x44,
 190                             0xc0, 0xbc, 0xc0, 0x0b, 0x13, 0x4d, 0xe6, 0x4a },
 191                 .valid = true
 192         },
 193         /* wycheproof - public key on twist */
 194         {
 195                 .private = { 0x68, 0xc1, 0xf3, 0xa6, 0x53, 0xa4, 0xcd, 0xb1,
 196                              0xd3, 0x7b, 0xba, 0x94, 0x73, 0x8f, 0x8b, 0x95,
 197                              0x7a, 0x57, 0xbe, 0xb2, 0x4d, 0x64, 0x6e, 0x99,
 198                              0x4d, 0xc2, 0x9a, 0x27, 0x6a, 0xad, 0x45, 0x8d },
 199                 .public = { 0x34, 0x3a, 0xc2, 0x0a, 0x3b, 0x9c, 0x6a, 0x27,
 200                             0xb1, 0x00, 0x81, 0x76, 0x50, 0x9a, 0xd3, 0x07,
 201                             0x35, 0x85, 0x6e, 0xc1, 0xc8, 0xd8, 0xfc, 0xae,
 202                             0x13, 0x91, 0x2d, 0x08, 0xd1, 0x52, 0xf4, 0x6c },
 203                 .result = { 0x39, 0x94, 0x91, 0xfc, 0xe8, 0xdf, 0xab, 0x73,
 204                             0xb4, 0xf9, 0xf6, 0x11, 0xde, 0x8e, 0xa0, 0xb2,
 205                             0x7b, 0x28, 0xf8, 0x59, 0x94, 0x25, 0x0b, 0x0f,
 206                             0x47, 0x5d, 0x58, 0x5d, 0x04, 0x2a, 0xc2, 0x07 },
 207                 .valid = true
 208         },
 209         /* wycheproof - public key on twist */
 210         {
 211                 .private = { 0xd8, 0x77, 0xb2, 0x6d, 0x06, 0xdf, 0xf9, 0xd9,
 212                              0xf7, 0xfd, 0x4c, 0x5b, 0x37, 0x69, 0xf8, 0xcd,
 213                              0xd5, 0xb3, 0x05, 0x16, 0xa5, 0xab, 0x80, 0x6b,
 214                              0xe3, 0x24, 0xff, 0x3e, 0xb6, 0x9e, 0xa0, 0xb2 },
 215                 .public = { 0xfa, 0x69, 0x5f, 0xc7, 0xbe, 0x8d, 0x1b, 0xe5,
 216                             0xbf, 0x70, 0x48, 0x98, 0xf3, 0x88, 0xc4, 0x52,
 217                             0xba, 0xfd, 0xd3, 0xb8, 0xea, 0xe8, 0x05, 0xf8,
 218                             0x68, 0x1a, 0x8d, 0x15, 0xc2, 0xd4, 0xe1, 0x42 },
 219                 .result = { 0x2c, 0x4f, 0xe1, 0x1d, 0x49, 0x0a, 0x53, 0x86,
 220                             0x17, 0x76, 0xb1, 0x3b, 0x43, 0x54, 0xab, 0xd4,
 221                             0xcf, 0x5a, 0x97, 0x69, 0x9d, 0xb6, 0xe6, 0xc6,
 222                             0x8c, 0x16, 0x26, 0xd0, 0x76, 0x62, 0xf7, 0x58 },
 223                 .valid = true
 224         },
 225         /* wycheproof - public key = 0 */
 226         {
 227                 .private = { 0x20, 0x74, 0x94, 0x03, 0x8f, 0x2b, 0xb8, 0x11,
 228                              0xd4, 0x78, 0x05, 0xbc, 0xdf, 0x04, 0xa2, 0xac,
 229                              0x58, 0x5a, 0xda, 0x7f, 0x2f, 0x23, 0x38, 0x9b,
 230                              0xfd, 0x46, 0x58, 0xf9, 0xdd, 0xd4, 0xde, 0xbc },
 231                 .public = { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 232                             0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 233                             0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 234                             0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 },
 235                 .result = { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 236                             0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 237                             0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 238                             0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 },
 239                 .valid = false
 240         },
 241         /* wycheproof - public key = 1 */
 242         {
 243                 .private = { 0x20, 0x2e, 0x89, 0x72, 0xb6, 0x1c, 0x7e, 0x61,
 244                              0x93, 0x0e, 0xb9, 0x45, 0x0b, 0x50, 0x70, 0xea,
 245                              0xe1, 0xc6, 0x70, 0x47, 0x56, 0x85, 0x54, 0x1f,
 246                              0x04, 0x76, 0x21, 0x7e, 0x48, 0x18, 0xcf, 0xab },
 247                 .public = { 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 248                             0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 249                             0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 250                             0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 },
 251                 .result = { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 252                             0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 253                             0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 254                             0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 },
 255                 .valid = false
 256         },
 257         /* wycheproof - edge case on twist */
 258         {
 259                 .private = { 0x38, 0xdd, 0xe9, 0xf3, 0xe7, 0xb7, 0x99, 0x04,
 260                              0x5f, 0x9a, 0xc3, 0x79, 0x3d, 0x4a, 0x92, 0x77,
 261                              0xda, 0xde, 0xad, 0xc4, 0x1b, 0xec, 0x02, 0x90,
 262                              0xf8, 0x1f, 0x74, 0x4f, 0x73, 0x77, 0x5f, 0x84 },
 263                 .public = { 0x02, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 264                             0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 265                             0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 266                             0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 },
 267                 .result = { 0x9a, 0x2c, 0xfe, 0x84, 0xff, 0x9c, 0x4a, 0x97,
 268                             0x39, 0x62, 0x5c, 0xae, 0x4a, 0x3b, 0x82, 0xa9,
 269                             0x06, 0x87, 0x7a, 0x44, 0x19, 0x46, 0xf8, 0xd7,
 270                             0xb3, 0xd7, 0x95, 0xfe, 0x8f, 0x5d, 0x16, 0x39 },
 271                 .valid = true
 272         },
 273         /* wycheproof - edge case on twist */
 274         {
 275                 .private = { 0x98, 0x57, 0xa9, 0x14, 0xe3, 0xc2, 0x90, 0x36,
 276                              0xfd, 0x9a, 0x44, 0x2b, 0xa5, 0x26, 0xb5, 0xcd,
 277                              0xcd, 0xf2, 0x82, 0x16, 0x15, 0x3e, 0x63, 0x6c,
 278                              0x10, 0x67, 0x7a, 0xca, 0xb6, 0xbd, 0x6a, 0xa5 },
 279                 .public = { 0x03, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 280                             0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 281                             0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 282                             0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 },
 283                 .result = { 0x4d, 0xa4, 0xe0, 0xaa, 0x07, 0x2c, 0x23, 0x2e,
 284                             0xe2, 0xf0, 0xfa, 0x4e, 0x51, 0x9a, 0xe5, 0x0b,
 285                             0x52, 0xc1, 0xed, 0xd0, 0x8a, 0x53, 0x4d, 0x4e,
 286                             0xf3, 0x46, 0xc2, 0xe1, 0x06, 0xd2, 0x1d, 0x60 },
 287                 .valid = true
 288         },
 289         /* wycheproof - edge case on twist */
 290         {
 291                 .private = { 0x48, 0xe2, 0x13, 0x0d, 0x72, 0x33, 0x05, 0xed,
 292                              0x05, 0xe6, 0xe5, 0x89, 0x4d, 0x39, 0x8a, 0x5e,
 293                              0x33, 0x36, 0x7a, 0x8c, 0x6a, 0xac, 0x8f, 0xcd,
 294                              0xf0, 0xa8, 0x8e, 0x4b, 0x42, 0x82, 0x0d, 0xb7 },
 295                 .public = { 0xff, 0xff, 0xff, 0x03, 0x00, 0x00, 0xf8, 0xff,
 296                             0xff, 0x1f, 0x00, 0x00, 0xc0, 0xff, 0xff, 0xff,
 297                             0x00, 0x00, 0x00, 0xfe, 0xff, 0xff, 0x07, 0x00,
 298                             0x00, 0xf0, 0xff, 0xff, 0x3f, 0x00, 0x00, 0x00 },
 299                 .result = { 0x9e, 0xd1, 0x0c, 0x53, 0x74, 0x7f, 0x64, 0x7f,
 300                             0x82, 0xf4, 0x51, 0x25, 0xd3, 0xde, 0x15, 0xa1,
 301                             0xe6, 0xb8, 0x24, 0x49, 0x6a, 0xb4, 0x04, 0x10,
 302                             0xff, 0xcc, 0x3c, 0xfe, 0x95, 0x76, 0x0f, 0x3b },
 303                 .valid = true
 304         },
 305         /* wycheproof - edge case on twist */
 306         {
 307                 .private = { 0x28, 0xf4, 0x10, 0x11, 0x69, 0x18, 0x51, 0xb3,
 308                              0xa6, 0x2b, 0x64, 0x15, 0x53, 0xb3, 0x0d, 0x0d,
 309                              0xfd, 0xdc, 0xb8, 0xff, 0xfc, 0xf5, 0x37, 0x00,
 310                              0xa7, 0xbe, 0x2f, 0x6a, 0x87, 0x2e, 0x9f, 0xb0 },
 311                 .public = { 0x00, 0x00, 0x00, 0xfc, 0xff, 0xff, 0x07, 0x00,
 312                             0x00, 0xe0, 0xff, 0xff, 0x3f, 0x00, 0x00, 0x00,
 313                             0xff, 0xff, 0xff, 0x01, 0x00, 0x00, 0xf8, 0xff,
 314                             0xff, 0x0f, 0x00, 0x00, 0xc0, 0xff, 0xff, 0x7f },
 315                 .result = { 0xcf, 0x72, 0xb4, 0xaa, 0x6a, 0xa1, 0xc9, 0xf8,
 316                             0x94, 0xf4, 0x16, 0x5b, 0x86, 0x10, 0x9a, 0xa4,
 317                             0x68, 0x51, 0x76, 0x48, 0xe1, 0xf0, 0xcc, 0x70,
 318                             0xe1, 0xab, 0x08, 0x46, 0x01, 0x76, 0x50, 0x6b },
 319                 .valid = true
 320         },
 321         /* wycheproof - edge case on twist */
 322         {
 323                 .private = { 0x18, 0xa9, 0x3b, 0x64, 0x99, 0xb9, 0xf6, 0xb3,
 324                              0x22, 0x5c, 0xa0, 0x2f, 0xef, 0x41, 0x0e, 0x0a,
 325                              0xde, 0xc2, 0x35, 0x32, 0x32, 0x1d, 0x2d, 0x8e,
 326                              0xf1, 0xa6, 0xd6, 0x02, 0xa8, 0xc6, 0x5b, 0x83 },
 327                 .public = { 0x00, 0x00, 0x00, 0x00, 0xff, 0xff, 0xff, 0xff,
 328                             0x00, 0x00, 0x00, 0x00, 0xff, 0xff, 0xff, 0xff,
 329                             0x00, 0x00, 0x00, 0x00, 0xff, 0xff, 0xff, 0xff,
 330                             0x00, 0x00, 0x00, 0x00, 0xff, 0xff, 0xff, 0x7f },
 331                 .result = { 0x5d, 0x50, 0xb6, 0x28, 0x36, 0xbb, 0x69, 0x57,
 332                             0x94, 0x10, 0x38, 0x6c, 0xf7, 0xbb, 0x81, 0x1c,
 333                             0x14, 0xbf, 0x85, 0xb1, 0xc7, 0xb1, 0x7e, 0x59,
 334                             0x24, 0xc7, 0xff, 0xea, 0x91, 0xef, 0x9e, 0x12 },
 335                 .valid = true
 336         },
 337         /* wycheproof - edge case on twist */
 338         {
 339                 .private = { 0xc0, 0x1d, 0x13, 0x05, 0xa1, 0x33, 0x8a, 0x1f,
 340                              0xca, 0xc2, 0xba, 0x7e, 0x2e, 0x03, 0x2b, 0x42,
 341                              0x7e, 0x0b, 0x04, 0x90, 0x31, 0x65, 0xac, 0xa9,
 342                              0x57, 0xd8, 0xd0, 0x55, 0x3d, 0x87, 0x17, 0xb0 },
 343                 .public = { 0xea, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
 344                             0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
 345                             0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
 346                             0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x7f },
 347                 .result = { 0x19, 0x23, 0x0e, 0xb1, 0x48, 0xd5, 0xd6, 0x7c,
 348                             0x3c, 0x22, 0xab, 0x1d, 0xae, 0xff, 0x80, 0xa5,
 349                             0x7e, 0xae, 0x42, 0x65, 0xce, 0x28, 0x72, 0x65,
 350                             0x7b, 0x2c, 0x80, 0x99, 0xfc, 0x69, 0x8e, 0x50 },
 351                 .valid = true
 352         },
 353         /* wycheproof - edge case for public key */
 354         {
 355                 .private = { 0x38, 0x6f, 0x7f, 0x16, 0xc5, 0x07, 0x31, 0xd6,
 356                              0x4f, 0x82, 0xe6, 0xa1, 0x70, 0xb1, 0x42, 0xa4,
 357                              0xe3, 0x4f, 0x31, 0xfd, 0x77, 0x68, 0xfc, 0xb8,
 358                              0x90, 0x29, 0x25, 0xe7, 0xd1, 0xe2, 0x1a, 0xbe },
 359                 .public = { 0x04, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 360                             0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 361                             0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 362                             0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 },
 363                 .result = { 0x0f, 0xca, 0xb5, 0xd8, 0x42, 0xa0, 0x78, 0xd7,
 364                             0xa7, 0x1f, 0xc5, 0x9b, 0x57, 0xbf, 0xb4, 0xca,
 365                             0x0b, 0xe6, 0x87, 0x3b, 0x49, 0xdc, 0xdb, 0x9f,
 366                             0x44, 0xe1, 0x4a, 0xe8, 0xfb, 0xdf, 0xa5, 0x42 },
 367                 .valid = true
 368         },
 369         /* wycheproof - edge case for public key */
 370         {
 371                 .private = { 0xe0, 0x23, 0xa2, 0x89, 0xbd, 0x5e, 0x90, 0xfa,
 372                              0x28, 0x04, 0xdd, 0xc0, 0x19, 0xa0, 0x5e, 0xf3,
 373                              0xe7, 0x9d, 0x43, 0x4b, 0xb6, 0xea, 0x2f, 0x52,
 374                              0x2e, 0xcb, 0x64, 0x3a, 0x75, 0x29, 0x6e, 0x95 },
 375                 .public = { 0xff, 0xff, 0xff, 0xff, 0x00, 0x00, 0x00, 0x00,
 376                             0xff, 0xff, 0xff, 0xff, 0x00, 0x00, 0x00, 0x00,
 377                             0xff, 0xff, 0xff, 0xff, 0x00, 0x00, 0x00, 0x00,
 378                             0xff, 0xff, 0xff, 0xff, 0x00, 0x00, 0x00, 0x00 },
 379                 .result = { 0x54, 0xce, 0x8f, 0x22, 0x75, 0xc0, 0x77, 0xe3,
 380                             0xb1, 0x30, 0x6a, 0x39, 0x39, 0xc5, 0xe0, 0x3e,
 381                             0xef, 0x6b, 0xbb, 0x88, 0x06, 0x05, 0x44, 0x75,
 382                             0x8d, 0x9f, 0xef, 0x59, 0xb0, 0xbc, 0x3e, 0x4f },
 383                 .valid = true
 384         },
 385         /* wycheproof - edge case for public key */
 386         {
 387                 .private = { 0x68, 0xf0, 0x10, 0xd6, 0x2e, 0xe8, 0xd9, 0x26,
 388                              0x05, 0x3a, 0x36, 0x1c, 0x3a, 0x75, 0xc6, 0xea,
 389                              0x4e, 0xbd, 0xc8, 0x60, 0x6a, 0xb2, 0x85, 0x00,
 390                              0x3a, 0x6f, 0x8f, 0x40, 0x76, 0xb0, 0x1e, 0x83 },
 391                 .public = { 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
 392                             0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
 393                             0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
 394                             0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x03 },
 395                 .result = { 0xf1, 0x36, 0x77, 0x5c, 0x5b, 0xeb, 0x0a, 0xf8,
 396                             0x11, 0x0a, 0xf1, 0x0b, 0x20, 0x37, 0x23, 0x32,
 397                             0x04, 0x3c, 0xab, 0x75, 0x24, 0x19, 0x67, 0x87,
 398                             0x75, 0xa2, 0x23, 0xdf, 0x57, 0xc9, 0xd3, 0x0d },
 399                 .valid = true
 400         },
 401         /* wycheproof - edge case for public key */
 402         {
 403                 .private = { 0x58, 0xeb, 0xcb, 0x35, 0xb0, 0xf8, 0x84, 0x5c,
 404                              0xaf, 0x1e, 0xc6, 0x30, 0xf9, 0x65, 0x76, 0xb6,
 405                              0x2c, 0x4b, 0x7b, 0x6c, 0x36, 0xb2, 0x9d, 0xeb,
 406                              0x2c, 0xb0, 0x08, 0x46, 0x51, 0x75, 0x5c, 0x96 },
 407                 .public = { 0xff, 0xff, 0xff, 0xfb, 0xff, 0xff, 0xfb, 0xff,
 408                             0xff, 0xdf, 0xff, 0xff, 0xdf, 0xff, 0xff, 0xff,
 409                             0xfe, 0xff, 0xff, 0xfe, 0xff, 0xff, 0xf7, 0xff,
 410                             0xff, 0xf7, 0xff, 0xff, 0xbf, 0xff, 0xff, 0x3f },
 411                 .result = { 0xbf, 0x9a, 0xff, 0xd0, 0x6b, 0x84, 0x40, 0x85,
 412                             0x58, 0x64, 0x60, 0x96, 0x2e, 0xf2, 0x14, 0x6f,
 413                             0xf3, 0xd4, 0x53, 0x3d, 0x94, 0x44, 0xaa, 0xb0,
 414                             0x06, 0xeb, 0x88, 0xcc, 0x30, 0x54, 0x40, 0x7d },
 415                 .valid = true
 416         },
 417         /* wycheproof - edge case for public key */
 418         {
 419                 .private = { 0x18, 0x8c, 0x4b, 0xc5, 0xb9, 0xc4, 0x4b, 0x38,
 420                              0xbb, 0x65, 0x8b, 0x9b, 0x2a, 0xe8, 0x2d, 0x5b,
 421                              0x01, 0x01, 0x5e, 0x09, 0x31, 0x84, 0xb1, 0x7c,
 422                              0xb7, 0x86, 0x35, 0x03, 0xa7, 0x83, 0xe1, 0xbb },
 423                 .public = { 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
 424                             0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
 425                             0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
 426                             0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x3f },
 427                 .result = { 0xd4, 0x80, 0xde, 0x04, 0xf6, 0x99, 0xcb, 0x3b,
 428                             0xe0, 0x68, 0x4a, 0x9c, 0xc2, 0xe3, 0x12, 0x81,
 429                             0xea, 0x0b, 0xc5, 0xa9, 0xdc, 0xc1, 0x57, 0xd3,
 430                             0xd2, 0x01, 0x58, 0xd4, 0x6c, 0xa5, 0x24, 0x6d },
 431                 .valid = true
 432         },
 433         /* wycheproof - edge case for public key */
 434         {
 435                 .private = { 0xe0, 0x6c, 0x11, 0xbb, 0x2e, 0x13, 0xce, 0x3d,
 436                              0xc7, 0x67, 0x3f, 0x67, 0xf5, 0x48, 0x22, 0x42,
 437                              0x90, 0x94, 0x23, 0xa9, 0xae, 0x95, 0xee, 0x98,
 438                              0x6a, 0x98, 0x8d, 0x98, 0xfa, 0xee, 0x23, 0xa2 },
 439                 .public = { 0xff, 0xff, 0xff, 0xff, 0xfe, 0xff, 0xff, 0x7f,
 440                             0xff, 0xff, 0xff, 0xff, 0xfe, 0xff, 0xff, 0x7f,
 441                             0xff, 0xff, 0xff, 0xff, 0xfe, 0xff, 0xff, 0x7f,
 442                             0xff, 0xff, 0xff, 0xff, 0xfe, 0xff, 0xff, 0x7f },
 443                 .result = { 0x4c, 0x44, 0x01, 0xcc, 0xe6, 0xb5, 0x1e, 0x4c,
 444                             0xb1, 0x8f, 0x27, 0x90, 0x24, 0x6c, 0x9b, 0xf9,
 445                             0x14, 0xdb, 0x66, 0x77, 0x50, 0xa1, 0xcb, 0x89,
 446                             0x06, 0x90, 0x92, 0xaf, 0x07, 0x29, 0x22, 0x76 },
 447                 .valid = true
 448         },
 449         /* wycheproof - edge case for public key */
 450         {
 451                 .private = { 0xc0, 0x65, 0x8c, 0x46, 0xdd, 0xe1, 0x81, 0x29,
 452                              0x29, 0x38, 0x77, 0x53, 0x5b, 0x11, 0x62, 0xb6,
 453                              0xf9, 0xf5, 0x41, 0x4a, 0x23, 0xcf, 0x4d, 0x2c,
 454                              0xbc, 0x14, 0x0a, 0x4d, 0x99, 0xda, 0x2b, 0x8f },
 455                 .public = { 0xeb, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
 456                             0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
 457                             0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
 458                             0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x7f },
 459                 .result = { 0x57, 0x8b, 0xa8, 0xcc, 0x2d, 0xbd, 0xc5, 0x75,
 460                             0xaf, 0xcf, 0x9d, 0xf2, 0xb3, 0xee, 0x61, 0x89,
 461                             0xf5, 0x33, 0x7d, 0x68, 0x54, 0xc7, 0x9b, 0x4c,
 462                             0xe1, 0x65, 0xea, 0x12, 0x29, 0x3b, 0x3a, 0x0f },
 463                 .valid = true
 464         },
 465         /* wycheproof - public key with low order */
 466         {
 467                 .private = { 0x10, 0x25, 0x5c, 0x92, 0x30, 0xa9, 0x7a, 0x30,
 468                              0xa4, 0x58, 0xca, 0x28, 0x4a, 0x62, 0x96, 0x69,
 469                              0x29, 0x3a, 0x31, 0x89, 0x0c, 0xda, 0x9d, 0x14,
 470                              0x7f, 0xeb, 0xc7, 0xd1, 0xe2, 0x2d, 0x6b, 0xb1 },
 471                 .public = { 0xe0, 0xeb, 0x7a, 0x7c, 0x3b, 0x41, 0xb8, 0xae,
 472                             0x16, 0x56, 0xe3, 0xfa, 0xf1, 0x9f, 0xc4, 0x6a,
 473                             0xda, 0x09, 0x8d, 0xeb, 0x9c, 0x32, 0xb1, 0xfd,
 474                             0x86, 0x62, 0x05, 0x16, 0x5f, 0x49, 0xb8, 0x00 },
 475                 .result = { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 476                             0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 477                             0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 478                             0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 },
 479                 .valid = false
 480         },
 481         /* wycheproof - public key with low order */
 482         {
 483                 .private = { 0x78, 0xf1, 0xe8, 0xed, 0xf1, 0x44, 0x81, 0xb3,
 484                              0x89, 0x44, 0x8d, 0xac, 0x8f, 0x59, 0xc7, 0x0b,
 485                              0x03, 0x8e, 0x7c, 0xf9, 0x2e, 0xf2, 0xc7, 0xef,
 486                              0xf5, 0x7a, 0x72, 0x46, 0x6e, 0x11, 0x52, 0x96 },
 487                 .public = { 0x5f, 0x9c, 0x95, 0xbc, 0xa3, 0x50, 0x8c, 0x24,
 488                             0xb1, 0xd0, 0xb1, 0x55, 0x9c, 0x83, 0xef, 0x5b,
 489                             0x04, 0x44, 0x5c, 0xc4, 0x58, 0x1c, 0x8e, 0x86,
 490                             0xd8, 0x22, 0x4e, 0xdd, 0xd0, 0x9f, 0x11, 0x57 },
 491                 .result = { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 492                             0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 493                             0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 494                             0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 },
 495                 .valid = false
 496         },
 497         /* wycheproof - public key with low order */
 498         {
 499                 .private = { 0xa0, 0xa0, 0x5a, 0x3e, 0x8f, 0x9f, 0x44, 0x20,
 500                              0x4d, 0x5f, 0x80, 0x59, 0xa9, 0x4a, 0xc7, 0xdf,
 501                              0xc3, 0x9a, 0x49, 0xac, 0x01, 0x6d, 0xd7, 0x43,
 502                              0xdb, 0xfa, 0x43, 0xc5, 0xd6, 0x71, 0xfd, 0x88 },
 503                 .public = { 0xec, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
 504                             0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
 505                             0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
 506                             0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x7f },
 507                 .result = { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 508                             0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 509                             0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 510                             0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 },
 511                 .valid = false
 512         },
 513         /* wycheproof - public key with low order */
 514         {
 515                 .private = { 0xd0, 0xdb, 0xb3, 0xed, 0x19, 0x06, 0x66, 0x3f,
 516                              0x15, 0x42, 0x0a, 0xf3, 0x1f, 0x4e, 0xaf, 0x65,
 517                              0x09, 0xd9, 0xa9, 0x94, 0x97, 0x23, 0x50, 0x06,
 518                              0x05, 0xad, 0x7c, 0x1c, 0x6e, 0x74, 0x50, 0xa9 },
 519                 .public = { 0xed, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
 520                             0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
 521                             0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
 522                             0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x7f },
 523                 .result = { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 524                             0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 525                             0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 526                             0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 },
 527                 .valid = false
 528         },
 529         /* wycheproof - public key with low order */
 530         {
 531                 .private = { 0xc0, 0xb1, 0xd0, 0xeb, 0x22, 0xb2, 0x44, 0xfe,
 532                              0x32, 0x91, 0x14, 0x00, 0x72, 0xcd, 0xd9, 0xd9,
 533                              0x89, 0xb5, 0xf0, 0xec, 0xd9, 0x6c, 0x10, 0x0f,
 534                              0xeb, 0x5b, 0xca, 0x24, 0x1c, 0x1d, 0x9f, 0x8f },
 535                 .public = { 0xee, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
 536                             0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
 537                             0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
 538                             0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x7f },
 539                 .result = { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 540                             0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 541                             0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 542                             0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 },
 543                 .valid = false
 544         },
 545         /* wycheproof - public key with low order */
 546         {
 547                 .private = { 0x48, 0x0b, 0xf4, 0x5f, 0x59, 0x49, 0x42, 0xa8,
 548                              0xbc, 0x0f, 0x33, 0x53, 0xc6, 0xe8, 0xb8, 0x85,
 549                              0x3d, 0x77, 0xf3, 0x51, 0xf1, 0xc2, 0xca, 0x6c,
 550                              0x2d, 0x1a, 0xbf, 0x8a, 0x00, 0xb4, 0x22, 0x9c },
 551                 .public = { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 552                             0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 553                             0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 554                             0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x80 },
 555                 .result = { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 556                             0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 557                             0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 558                             0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 },
 559                 .valid = false
 560         },
 561         /* wycheproof - public key with low order */
 562         {
 563                 .private = { 0x30, 0xf9, 0x93, 0xfc, 0xf8, 0x51, 0x4f, 0xc8,
 564                              0x9b, 0xd8, 0xdb, 0x14, 0xcd, 0x43, 0xba, 0x0d,
 565                              0x4b, 0x25, 0x30, 0xe7, 0x3c, 0x42, 0x76, 0xa0,
 566                              0x5e, 0x1b, 0x14, 0x5d, 0x42, 0x0c, 0xed, 0xb4 },
 567                 .public = { 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 568                             0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 569                             0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 570                             0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x80 },
 571                 .result = { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 572                             0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 573                             0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 574                             0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 },
 575                 .valid = false
 576         },
 577         /* wycheproof - public key with low order */
 578         {
 579                 .private = { 0xc0, 0x49, 0x74, 0xb7, 0x58, 0x38, 0x0e, 0x2a,
 580                              0x5b, 0x5d, 0xf6, 0xeb, 0x09, 0xbb, 0x2f, 0x6b,
 581                              0x34, 0x34, 0xf9, 0x82, 0x72, 0x2a, 0x8e, 0x67,
 582                              0x6d, 0x3d, 0xa2, 0x51, 0xd1, 0xb3, 0xde, 0x83 },
 583                 .public = { 0xe0, 0xeb, 0x7a, 0x7c, 0x3b, 0x41, 0xb8, 0xae,
 584                             0x16, 0x56, 0xe3, 0xfa, 0xf1, 0x9f, 0xc4, 0x6a,
 585                             0xda, 0x09, 0x8d, 0xeb, 0x9c, 0x32, 0xb1, 0xfd,
 586                             0x86, 0x62, 0x05, 0x16, 0x5f, 0x49, 0xb8, 0x80 },
 587                 .result = { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 588                             0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 589                             0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 590                             0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 },
 591                 .valid = false
 592         },
 593         /* wycheproof - public key with low order */
 594         {
 595                 .private = { 0x50, 0x2a, 0x31, 0x37, 0x3d, 0xb3, 0x24, 0x46,
 596                              0x84, 0x2f, 0xe5, 0xad, 0xd3, 0xe0, 0x24, 0x02,
 597                              0x2e, 0xa5, 0x4f, 0x27, 0x41, 0x82, 0xaf, 0xc3,
 598                              0xd9, 0xf1, 0xbb, 0x3d, 0x39, 0x53, 0x4e, 0xb5 },
 599                 .public = { 0x5f, 0x9c, 0x95, 0xbc, 0xa3, 0x50, 0x8c, 0x24,
 600                             0xb1, 0xd0, 0xb1, 0x55, 0x9c, 0x83, 0xef, 0x5b,
 601                             0x04, 0x44, 0x5c, 0xc4, 0x58, 0x1c, 0x8e, 0x86,
 602                             0xd8, 0x22, 0x4e, 0xdd, 0xd0, 0x9f, 0x11, 0xd7 },
 603                 .result = { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 604                             0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 605                             0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 606                             0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 },
 607                 .valid = false
 608         },
 609         /* wycheproof - public key with low order */
 610         {
 611                 .private = { 0x90, 0xfa, 0x64, 0x17, 0xb0, 0xe3, 0x70, 0x30,
 612                              0xfd, 0x6e, 0x43, 0xef, 0xf2, 0xab, 0xae, 0xf1,
 613                              0x4c, 0x67, 0x93, 0x11, 0x7a, 0x03, 0x9c, 0xf6,
 614                              0x21, 0x31, 0x8b, 0xa9, 0x0f, 0x4e, 0x98, 0xbe },
 615                 .public = { 0xec, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
 616                             0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
 617                             0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
 618                             0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff },
 619                 .result = { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 620                             0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 621                             0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 622                             0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 },
 623                 .valid = false
 624         },
 625         /* wycheproof - public key with low order */
 626         {
 627                 .private = { 0x78, 0xad, 0x3f, 0x26, 0x02, 0x7f, 0x1c, 0x9f,
 628                              0xdd, 0x97, 0x5a, 0x16, 0x13, 0xb9, 0x47, 0x77,
 629                              0x9b, 0xad, 0x2c, 0xf2, 0xb7, 0x41, 0xad, 0xe0,
 630                              0x18, 0x40, 0x88, 0x5a, 0x30, 0xbb, 0x97, 0x9c },
 631                 .public = { 0xed, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
 632                             0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
 633                             0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
 634                             0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff },
 635                 .result = { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 636                             0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 637                             0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 638                             0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 },
 639                 .valid = false
 640         },
 641         /* wycheproof - public key with low order */
 642         {
 643                 .private = { 0x98, 0xe2, 0x3d, 0xe7, 0xb1, 0xe0, 0x92, 0x6e,
 644                              0xd9, 0xc8, 0x7e, 0x7b, 0x14, 0xba, 0xf5, 0x5f,
 645                              0x49, 0x7a, 0x1d, 0x70, 0x96, 0xf9, 0x39, 0x77,
 646                              0x68, 0x0e, 0x44, 0xdc, 0x1c, 0x7b, 0x7b, 0x8b },
 647                 .public = { 0xee, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
 648                             0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
 649                             0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
 650                             0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff },
 651                 .result = { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 652                             0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 653                             0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 654                             0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 },
 655                 .valid = false
 656         },
 657         /* wycheproof - public key >= p */
 658         {
 659                 .private = { 0xf0, 0x1e, 0x48, 0xda, 0xfa, 0xc9, 0xd7, 0xbc,
 660                              0xf5, 0x89, 0xcb, 0xc3, 0x82, 0xc8, 0x78, 0xd1,
 661                              0x8b, 0xda, 0x35, 0x50, 0x58, 0x9f, 0xfb, 0x5d,
 662                              0x50, 0xb5, 0x23, 0xbe, 0xbe, 0x32, 0x9d, 0xae },
 663                 .public = { 0xef, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
 664                             0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
 665                             0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
 666                             0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x7f },
 667                 .result = { 0xbd, 0x36, 0xa0, 0x79, 0x0e, 0xb8, 0x83, 0x09,
 668                             0x8c, 0x98, 0x8b, 0x21, 0x78, 0x67, 0x73, 0xde,
 669                             0x0b, 0x3a, 0x4d, 0xf1, 0x62, 0x28, 0x2c, 0xf1,
 670                             0x10, 0xde, 0x18, 0xdd, 0x48, 0x4c, 0xe7, 0x4b },
 671                 .valid = true
 672         },
 673         /* wycheproof - public key >= p */
 674         {
 675                 .private = { 0x28, 0x87, 0x96, 0xbc, 0x5a, 0xff, 0x4b, 0x81,
 676                              0xa3, 0x75, 0x01, 0x75, 0x7b, 0xc0, 0x75, 0x3a,
 677                              0x3c, 0x21, 0x96, 0x47, 0x90, 0xd3, 0x86, 0x99,
 678                              0x30, 0x8d, 0xeb, 0xc1, 0x7a, 0x6e, 0xaf, 0x8d },
 679                 .public = { 0xf0, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
 680                             0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
 681                             0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
 682                             0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x7f },
 683                 .result = { 0xb4, 0xe0, 0xdd, 0x76, 0xda, 0x7b, 0x07, 0x17,
 684                             0x28, 0xb6, 0x1f, 0x85, 0x67, 0x71, 0xaa, 0x35,
 685                             0x6e, 0x57, 0xed, 0xa7, 0x8a, 0x5b, 0x16, 0x55,
 686                             0xcc, 0x38, 0x20, 0xfb, 0x5f, 0x85, 0x4c, 0x5c },
 687                 .valid = true
 688         },
 689         /* wycheproof - public key >= p */
 690         {
 691                 .private = { 0x98, 0xdf, 0x84, 0x5f, 0x66, 0x51, 0xbf, 0x11,
 692                              0x38, 0x22, 0x1f, 0x11, 0x90, 0x41, 0xf7, 0x2b,
 693                              0x6d, 0xbc, 0x3c, 0x4a, 0xce, 0x71, 0x43, 0xd9,
 694                              0x9f, 0xd5, 0x5a, 0xd8, 0x67, 0x48, 0x0d, 0xa8 },
 695                 .public = { 0xf1, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
 696                             0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
 697                             0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
 698                             0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x7f },
 699                 .result = { 0x6f, 0xdf, 0x6c, 0x37, 0x61, 0x1d, 0xbd, 0x53,
 700                             0x04, 0xdc, 0x0f, 0x2e, 0xb7, 0xc9, 0x51, 0x7e,
 701                             0xb3, 0xc5, 0x0e, 0x12, 0xfd, 0x05, 0x0a, 0xc6,
 702                             0xde, 0xc2, 0x70, 0x71, 0xd4, 0xbf, 0xc0, 0x34 },
 703                 .valid = true
 704         },
 705         /* wycheproof - public key >= p */
 706         {
 707                 .private = { 0xf0, 0x94, 0x98, 0xe4, 0x6f, 0x02, 0xf8, 0x78,
 708                              0x82, 0x9e, 0x78, 0xb8, 0x03, 0xd3, 0x16, 0xa2,
 709                              0xed, 0x69, 0x5d, 0x04, 0x98, 0xa0, 0x8a, 0xbd,
 710                              0xf8, 0x27, 0x69, 0x30, 0xe2, 0x4e, 0xdc, 0xb0 },
 711                 .public = { 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
 712                             0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
 713                             0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
 714                             0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x7f },
 715                 .result = { 0x4c, 0x8f, 0xc4, 0xb1, 0xc6, 0xab, 0x88, 0xfb,
 716                             0x21, 0xf1, 0x8f, 0x6d, 0x4c, 0x81, 0x02, 0x40,
 717                             0xd4, 0xe9, 0x46, 0x51, 0xba, 0x44, 0xf7, 0xa2,
 718                             0xc8, 0x63, 0xce, 0xc7, 0xdc, 0x56, 0x60, 0x2d },
 719                 .valid = true
 720         },
 721         /* wycheproof - public key >= p */
 722         {
 723                 .private = { 0x18, 0x13, 0xc1, 0x0a, 0x5c, 0x7f, 0x21, 0xf9,
 724                              0x6e, 0x17, 0xf2, 0x88, 0xc0, 0xcc, 0x37, 0x60,
 725                              0x7c, 0x04, 0xc5, 0xf5, 0xae, 0xa2, 0xdb, 0x13,
 726                              0x4f, 0x9e, 0x2f, 0xfc, 0x66, 0xbd, 0x9d, 0xb8 },
 727                 .public = { 0x02, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 728                             0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 729                             0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 730                             0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x80 },
 731                 .result = { 0x1c, 0xd0, 0xb2, 0x82, 0x67, 0xdc, 0x54, 0x1c,
 732                             0x64, 0x2d, 0x6d, 0x7d, 0xca, 0x44, 0xa8, 0xb3,
 733                             0x8a, 0x63, 0x73, 0x6e, 0xef, 0x5c, 0x4e, 0x65,
 734                             0x01, 0xff, 0xbb, 0xb1, 0x78, 0x0c, 0x03, 0x3c },
 735                 .valid = true
 736         },
 737         /* wycheproof - public key >= p */
 738         {
 739                 .private = { 0x78, 0x57, 0xfb, 0x80, 0x86, 0x53, 0x64, 0x5a,
 740                              0x0b, 0xeb, 0x13, 0x8a, 0x64, 0xf5, 0xf4, 0xd7,
 741                              0x33, 0xa4, 0x5e, 0xa8, 0x4c, 0x3c, 0xda, 0x11,
 742                              0xa9, 0xc0, 0x6f, 0x7e, 0x71, 0x39, 0x14, 0x9e },
 743                 .public = { 0x03, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 744                             0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 745                             0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 746                             0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x80 },
 747                 .result = { 0x87, 0x55, 0xbe, 0x01, 0xc6, 0x0a, 0x7e, 0x82,
 748                             0x5c, 0xff, 0x3e, 0x0e, 0x78, 0xcb, 0x3a, 0xa4,
 749                             0x33, 0x38, 0x61, 0x51, 0x6a, 0xa5, 0x9b, 0x1c,
 750                             0x51, 0xa8, 0xb2, 0xa5, 0x43, 0xdf, 0xa8, 0x22 },
 751                 .valid = true
 752         },
 753         /* wycheproof - public key >= p */
 754         {
 755                 .private = { 0xe0, 0x3a, 0xa8, 0x42, 0xe2, 0xab, 0xc5, 0x6e,
 756                              0x81, 0xe8, 0x7b, 0x8b, 0x9f, 0x41, 0x7b, 0x2a,
 757                              0x1e, 0x59, 0x13, 0xc7, 0x23, 0xee, 0xd2, 0x8d,
 758                              0x75, 0x2f, 0x8d, 0x47, 0xa5, 0x9f, 0x49, 0x8f },
 759                 .public = { 0x04, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 760                             0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 761                             0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 762                             0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x80 },
 763                 .result = { 0x54, 0xc9, 0xa1, 0xed, 0x95, 0xe5, 0x46, 0xd2,
 764                             0x78, 0x22, 0xa3, 0x60, 0x93, 0x1d, 0xda, 0x60,
 765                             0xa1, 0xdf, 0x04, 0x9d, 0xa6, 0xf9, 0x04, 0x25,
 766                             0x3c, 0x06, 0x12, 0xbb, 0xdc, 0x08, 0x74, 0x76 },
 767                 .valid = true
 768         },
 769         /* wycheproof - public key >= p */
 770         {
 771                 .private = { 0xf8, 0xf7, 0x07, 0xb7, 0x99, 0x9b, 0x18, 0xcb,
 772                              0x0d, 0x6b, 0x96, 0x12, 0x4f, 0x20, 0x45, 0x97,
 773                              0x2c, 0xa2, 0x74, 0xbf, 0xc1, 0x54, 0xad, 0x0c,
 774                              0x87, 0x03, 0x8c, 0x24, 0xc6, 0xd0, 0xd4, 0xb2 },
 775                 .public = { 0xda, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
 776                             0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
 777                             0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
 778                             0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff },
 779                 .result = { 0xcc, 0x1f, 0x40, 0xd7, 0x43, 0xcd, 0xc2, 0x23,
 780                             0x0e, 0x10, 0x43, 0xda, 0xba, 0x8b, 0x75, 0xe8,
 781                             0x10, 0xf1, 0xfb, 0xab, 0x7f, 0x25, 0x52, 0x69,
 782                             0xbd, 0x9e, 0xbb, 0x29, 0xe6, 0xbf, 0x49, 0x4f },
 783                 .valid = true
 784         },
 785         /* wycheproof - public key >= p */
 786         {
 787                 .private = { 0xa0, 0x34, 0xf6, 0x84, 0xfa, 0x63, 0x1e, 0x1a,
 788                              0x34, 0x81, 0x18, 0xc1, 0xce, 0x4c, 0x98, 0x23,
 789                              0x1f, 0x2d, 0x9e, 0xec, 0x9b, 0xa5, 0x36, 0x5b,
 790                              0x4a, 0x05, 0xd6, 0x9a, 0x78, 0x5b, 0x07, 0x96 },
 791                 .public = { 0xdb, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
 792                             0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
 793                             0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
 794                             0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff },
 795                 .result = { 0x54, 0x99, 0x8e, 0xe4, 0x3a, 0x5b, 0x00, 0x7b,
 796                             0xf4, 0x99, 0xf0, 0x78, 0xe7, 0x36, 0x52, 0x44,
 797                             0x00, 0xa8, 0xb5, 0xc7, 0xe9, 0xb9, 0xb4, 0x37,
 798                             0x71, 0x74, 0x8c, 0x7c, 0xdf, 0x88, 0x04, 0x12 },
 799                 .valid = true
 800         },
 801         /* wycheproof - public key >= p */
 802         {
 803                 .private = { 0x30, 0xb6, 0xc6, 0xa0, 0xf2, 0xff, 0xa6, 0x80,
 804                              0x76, 0x8f, 0x99, 0x2b, 0xa8, 0x9e, 0x15, 0x2d,
 805                              0x5b, 0xc9, 0x89, 0x3d, 0x38, 0xc9, 0x11, 0x9b,
 806                              0xe4, 0xf7, 0x67, 0xbf, 0xab, 0x6e, 0x0c, 0xa5 },
 807                 .public = { 0xdc, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
 808                             0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
 809                             0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
 810                             0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff },
 811                 .result = { 0xea, 0xd9, 0xb3, 0x8e, 0xfd, 0xd7, 0x23, 0x63,
 812                             0x79, 0x34, 0xe5, 0x5a, 0xb7, 0x17, 0xa7, 0xae,
 813                             0x09, 0xeb, 0x86, 0xa2, 0x1d, 0xc3, 0x6a, 0x3f,
 814                             0xee, 0xb8, 0x8b, 0x75, 0x9e, 0x39, 0x1e, 0x09 },
 815                 .valid = true
 816         },
 817         /* wycheproof - public key >= p */
 818         {
 819                 .private = { 0x90, 0x1b, 0x9d, 0xcf, 0x88, 0x1e, 0x01, 0xe0,
 820                              0x27, 0x57, 0x50, 0x35, 0xd4, 0x0b, 0x43, 0xbd,
 821                              0xc1, 0xc5, 0x24, 0x2e, 0x03, 0x08, 0x47, 0x49,
 822                              0x5b, 0x0c, 0x72, 0x86, 0x46, 0x9b, 0x65, 0x91 },
 823                 .public = { 0xea, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
 824                             0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
 825                             0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
 826                             0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff },
 827                 .result = { 0x60, 0x2f, 0xf4, 0x07, 0x89, 0xb5, 0x4b, 0x41,
 828                             0x80, 0x59, 0x15, 0xfe, 0x2a, 0x62, 0x21, 0xf0,
 829                             0x7a, 0x50, 0xff, 0xc2, 0xc3, 0xfc, 0x94, 0xcf,
 830                             0x61, 0xf1, 0x3d, 0x79, 0x04, 0xe8, 0x8e, 0x0e },
 831                 .valid = true
 832         },
 833         /* wycheproof - public key >= p */
 834         {
 835                 .private = { 0x80, 0x46, 0x67, 0x7c, 0x28, 0xfd, 0x82, 0xc9,
 836                              0xa1, 0xbd, 0xb7, 0x1a, 0x1a, 0x1a, 0x34, 0xfa,
 837                              0xba, 0x12, 0x25, 0xe2, 0x50, 0x7f, 0xe3, 0xf5,
 838                              0x4d, 0x10, 0xbd, 0x5b, 0x0d, 0x86, 0x5f, 0x8e },
 839                 .public = { 0xeb, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
 840                             0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
 841                             0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
 842                             0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff },
 843                 .result = { 0xe0, 0x0a, 0xe8, 0xb1, 0x43, 0x47, 0x12, 0x47,
 844                             0xba, 0x24, 0xf1, 0x2c, 0x88, 0x55, 0x36, 0xc3,
 845                             0xcb, 0x98, 0x1b, 0x58, 0xe1, 0xe5, 0x6b, 0x2b,
 846                             0xaf, 0x35, 0xc1, 0x2a, 0xe1, 0xf7, 0x9c, 0x26 },
 847                 .valid = true
 848         },
 849         /* wycheproof - public key >= p */
 850         {
 851                 .private = { 0x60, 0x2f, 0x7e, 0x2f, 0x68, 0xa8, 0x46, 0xb8,
 852                              0x2c, 0xc2, 0x69, 0xb1, 0xd4, 0x8e, 0x93, 0x98,
 853                              0x86, 0xae, 0x54, 0xfd, 0x63, 0x6c, 0x1f, 0xe0,
 854                              0x74, 0xd7, 0x10, 0x12, 0x7d, 0x47, 0x24, 0x91 },
 855                 .public = { 0xef, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
 856                             0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
 857                             0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
 858                             0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff },
 859                 .result = { 0x98, 0xcb, 0x9b, 0x50, 0xdd, 0x3f, 0xc2, 0xb0,
 860                             0xd4, 0xf2, 0xd2, 0xbf, 0x7c, 0x5c, 0xfd, 0xd1,
 861                             0x0c, 0x8f, 0xcd, 0x31, 0xfc, 0x40, 0xaf, 0x1a,
 862                             0xd4, 0x4f, 0x47, 0xc1, 0x31, 0x37, 0x63, 0x62 },
 863                 .valid = true
 864         },
 865         /* wycheproof - public key >= p */
 866         {
 867                 .private = { 0x60, 0x88, 0x7b, 0x3d, 0xc7, 0x24, 0x43, 0x02,
 868                              0x6e, 0xbe, 0xdb, 0xbb, 0xb7, 0x06, 0x65, 0xf4,
 869                              0x2b, 0x87, 0xad, 0xd1, 0x44, 0x0e, 0x77, 0x68,
 870                              0xfb, 0xd7, 0xe8, 0xe2, 0xce, 0x5f, 0x63, 0x9d },
 871                 .public = { 0xf0, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
 872                             0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
 873                             0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
 874                             0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff },
 875                 .result = { 0x38, 0xd6, 0x30, 0x4c, 0x4a, 0x7e, 0x6d, 0x9f,
 876                             0x79, 0x59, 0x33, 0x4f, 0xb5, 0x24, 0x5b, 0xd2,
 877                             0xc7, 0x54, 0x52, 0x5d, 0x4c, 0x91, 0xdb, 0x95,
 878                             0x02, 0x06, 0x92, 0x62, 0x34, 0xc1, 0xf6, 0x33 },
 879                 .valid = true
 880         },
 881         /* wycheproof - public key >= p */
 882         {
 883                 .private = { 0x78, 0xd3, 0x1d, 0xfa, 0x85, 0x44, 0x97, 0xd7,
 884                              0x2d, 0x8d, 0xef, 0x8a, 0x1b, 0x7f, 0xb0, 0x06,
 885                              0xce, 0xc2, 0xd8, 0xc4, 0x92, 0x46, 0x47, 0xc9,
 886                              0x38, 0x14, 0xae, 0x56, 0xfa, 0xed, 0xa4, 0x95 },
 887                 .public = { 0xf1, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
 888                             0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
 889                             0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
 890                             0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff },
 891                 .result = { 0x78, 0x6c, 0xd5, 0x49, 0x96, 0xf0, 0x14, 0xa5,
 892                             0xa0, 0x31, 0xec, 0x14, 0xdb, 0x81, 0x2e, 0xd0,
 893                             0x83, 0x55, 0x06, 0x1f, 0xdb, 0x5d, 0xe6, 0x80,
 894                             0xa8, 0x00, 0xac, 0x52, 0x1f, 0x31, 0x8e, 0x23 },
 895                 .valid = true
 896         },
 897         /* wycheproof - public key >= p */
 898         {
 899                 .private = { 0xc0, 0x4c, 0x5b, 0xae, 0xfa, 0x83, 0x02, 0xdd,
 900                              0xde, 0xd6, 0xa4, 0xbb, 0x95, 0x77, 0x61, 0xb4,
 901                              0xeb, 0x97, 0xae, 0xfa, 0x4f, 0xc3, 0xb8, 0x04,
 902                              0x30, 0x85, 0xf9, 0x6a, 0x56, 0x59, 0xb3, 0xa5 },
 903                 .public = { 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
 904                             0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
 905                             0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
 906                             0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff },
 907                 .result = { 0x29, 0xae, 0x8b, 0xc7, 0x3e, 0x9b, 0x10, 0xa0,
 908                             0x8b, 0x4f, 0x68, 0x1c, 0x43, 0xc3, 0xe0, 0xac,
 909                             0x1a, 0x17, 0x1d, 0x31, 0xb3, 0x8f, 0x1a, 0x48,
 910                             0xef, 0xba, 0x29, 0xae, 0x63, 0x9e, 0xa1, 0x34 },
 911                 .valid = true
 912         },
 913         /* wycheproof - RFC 7748 */
 914         {
 915                 .private = { 0xa0, 0x46, 0xe3, 0x6b, 0xf0, 0x52, 0x7c, 0x9d,
 916                              0x3b, 0x16, 0x15, 0x4b, 0x82, 0x46, 0x5e, 0xdd,
 917                              0x62, 0x14, 0x4c, 0x0a, 0xc1, 0xfc, 0x5a, 0x18,
 918                              0x50, 0x6a, 0x22, 0x44, 0xba, 0x44, 0x9a, 0x44 },
 919                 .public = { 0xe6, 0xdb, 0x68, 0x67, 0x58, 0x30, 0x30, 0xdb,
 920                             0x35, 0x94, 0xc1, 0xa4, 0x24, 0xb1, 0x5f, 0x7c,
 921                             0x72, 0x66, 0x24, 0xec, 0x26, 0xb3, 0x35, 0x3b,
 922                             0x10, 0xa9, 0x03, 0xa6, 0xd0, 0xab, 0x1c, 0x4c },
 923                 .result = { 0xc3, 0xda, 0x55, 0x37, 0x9d, 0xe9, 0xc6, 0x90,
 924                             0x8e, 0x94, 0xea, 0x4d, 0xf2, 0x8d, 0x08, 0x4f,
 925                             0x32, 0xec, 0xcf, 0x03, 0x49, 0x1c, 0x71, 0xf7,
 926                             0x54, 0xb4, 0x07, 0x55, 0x77, 0xa2, 0x85, 0x52 },
 927                 .valid = true
 928         },
 929         /* wycheproof - RFC 7748 */
 930         {
 931                 .private = { 0x48, 0x66, 0xe9, 0xd4, 0xd1, 0xb4, 0x67, 0x3c,
 932                              0x5a, 0xd2, 0x26, 0x91, 0x95, 0x7d, 0x6a, 0xf5,
 933                              0xc1, 0x1b, 0x64, 0x21, 0xe0, 0xea, 0x01, 0xd4,
 934                              0x2c, 0xa4, 0x16, 0x9e, 0x79, 0x18, 0xba, 0x4d },
 935                 .public = { 0xe5, 0x21, 0x0f, 0x12, 0x78, 0x68, 0x11, 0xd3,
 936                             0xf4, 0xb7, 0x95, 0x9d, 0x05, 0x38, 0xae, 0x2c,
 937                             0x31, 0xdb, 0xe7, 0x10, 0x6f, 0xc0, 0x3c, 0x3e,
 938                             0xfc, 0x4c, 0xd5, 0x49, 0xc7, 0x15, 0xa4, 0x13 },
 939                 .result = { 0x95, 0xcb, 0xde, 0x94, 0x76, 0xe8, 0x90, 0x7d,
 940                             0x7a, 0xad, 0xe4, 0x5c, 0xb4, 0xb8, 0x73, 0xf8,
 941                             0x8b, 0x59, 0x5a, 0x68, 0x79, 0x9f, 0xa1, 0x52,
 942                             0xe6, 0xf8, 0xf7, 0x64, 0x7a, 0xac, 0x79, 0x57 },
 943                 .valid = true
 944         },
 945         /* wycheproof - edge case for shared secret */
 946         {
 947                 .private = { 0xa0, 0xa4, 0xf1, 0x30, 0xb9, 0x8a, 0x5b, 0xe4,
 948                              0xb1, 0xce, 0xdb, 0x7c, 0xb8, 0x55, 0x84, 0xa3,
 949                              0x52, 0x0e, 0x14, 0x2d, 0x47, 0x4d, 0xc9, 0xcc,
 950                              0xb9, 0x09, 0xa0, 0x73, 0xa9, 0x76, 0xbf, 0x63 },
 951                 .public = { 0x0a, 0xb4, 0xe7, 0x63, 0x80, 0xd8, 0x4d, 0xde,
 952                             0x4f, 0x68, 0x33, 0xc5, 0x8f, 0x2a, 0x9f, 0xb8,
 953                             0xf8, 0x3b, 0xb0, 0x16, 0x9b, 0x17, 0x2b, 0xe4,
 954                             0xb6, 0xe0, 0x59, 0x28, 0x87, 0x74, 0x1a, 0x36 },
 955                 .result = { 0x02, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 956                             0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 957                             0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 958                             0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 },
 959                 .valid = true
 960         },
 961         /* wycheproof - edge case for shared secret */
 962         {
 963                 .private = { 0xa0, 0xa4, 0xf1, 0x30, 0xb9, 0x8a, 0x5b, 0xe4,
 964                              0xb1, 0xce, 0xdb, 0x7c, 0xb8, 0x55, 0x84, 0xa3,
 965                              0x52, 0x0e, 0x14, 0x2d, 0x47, 0x4d, 0xc9, 0xcc,
 966                              0xb9, 0x09, 0xa0, 0x73, 0xa9, 0x76, 0xbf, 0x63 },
 967                 .public = { 0x89, 0xe1, 0x0d, 0x57, 0x01, 0xb4, 0x33, 0x7d,
 968                             0x2d, 0x03, 0x21, 0x81, 0x53, 0x8b, 0x10, 0x64,
 969                             0xbd, 0x40, 0x84, 0x40, 0x1c, 0xec, 0xa1, 0xfd,
 970                             0x12, 0x66, 0x3a, 0x19, 0x59, 0x38, 0x80, 0x00 },
 971                 .result = { 0x09, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 972                             0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 973                             0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 974                             0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 },
 975                 .valid = true
 976         },
 977         /* wycheproof - edge case for shared secret */
 978         {
 979                 .private = { 0xa0, 0xa4, 0xf1, 0x30, 0xb9, 0x8a, 0x5b, 0xe4,
 980                              0xb1, 0xce, 0xdb, 0x7c, 0xb8, 0x55, 0x84, 0xa3,
 981                              0x52, 0x0e, 0x14, 0x2d, 0x47, 0x4d, 0xc9, 0xcc,
 982                              0xb9, 0x09, 0xa0, 0x73, 0xa9, 0x76, 0xbf, 0x63 },
 983                 .public = { 0x2b, 0x55, 0xd3, 0xaa, 0x4a, 0x8f, 0x80, 0xc8,
 984                             0xc0, 0xb2, 0xae, 0x5f, 0x93, 0x3e, 0x85, 0xaf,
 985                             0x49, 0xbe, 0xac, 0x36, 0xc2, 0xfa, 0x73, 0x94,
 986                             0xba, 0xb7, 0x6c, 0x89, 0x33, 0xf8, 0xf8, 0x1d },
 987                 .result = { 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 988                             0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 989                             0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 990                             0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 },
 991                 .valid = true
 992         },
 993         /* wycheproof - edge case for shared secret */
 994         {
 995                 .private = { 0xa0, 0xa4, 0xf1, 0x30, 0xb9, 0x8a, 0x5b, 0xe4,
 996                              0xb1, 0xce, 0xdb, 0x7c, 0xb8, 0x55, 0x84, 0xa3,
 997                              0x52, 0x0e, 0x14, 0x2d, 0x47, 0x4d, 0xc9, 0xcc,
 998                              0xb9, 0x09, 0xa0, 0x73, 0xa9, 0x76, 0xbf, 0x63 },
 999                 .public = { 0x63, 0xe5, 0xb1, 0xfe, 0x96, 0x01, 0xfe, 0x84,
1000                             0x38, 0x5d, 0x88, 0x66, 0xb0, 0x42, 0x12, 0x62,
1001                             0xf7, 0x8f, 0xbf, 0xa5, 0xaf, 0xf9, 0x58, 0x5e,
1002                             0x62, 0x66, 0x79, 0xb1, 0x85, 0x47, 0xd9, 0x59 },
1003                 .result = { 0xfe, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
1004                             0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
1005                             0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
1006                             0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x3f },
1007                 .valid = true
1008         },
1009         /* wycheproof - edge case for shared secret */
1010         {
1011                 .private = { 0xa0, 0xa4, 0xf1, 0x30, 0xb9, 0x8a, 0x5b, 0xe4,
1012                              0xb1, 0xce, 0xdb, 0x7c, 0xb8, 0x55, 0x84, 0xa3,
1013                              0x52, 0x0e, 0x14, 0x2d, 0x47, 0x4d, 0xc9, 0xcc,
1014                              0xb9, 0x09, 0xa0, 0x73, 0xa9, 0x76, 0xbf, 0x63 },
1015                 .public = { 0xe4, 0x28, 0xf3, 0xda, 0xc1, 0x78, 0x09, 0xf8,
1016                             0x27, 0xa5, 0x22, 0xce, 0x32, 0x35, 0x50, 0x58,
1017                             0xd0, 0x73, 0x69, 0x36, 0x4a, 0xa7, 0x89, 0x02,
1018                             0xee, 0x10, 0x13, 0x9b, 0x9f, 0x9d, 0xd6, 0x53 },
1019                 .result = { 0xfc, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
1020                             0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
1021                             0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
1022                             0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x3f },
1023                 .valid = true
1024         },
1025         /* wycheproof - edge case for shared secret */
1026         {
1027                 .private = { 0xa0, 0xa4, 0xf1, 0x30, 0xb9, 0x8a, 0x5b, 0xe4,
1028                              0xb1, 0xce, 0xdb, 0x7c, 0xb8, 0x55, 0x84, 0xa3,
1029                              0x52, 0x0e, 0x14, 0x2d, 0x47, 0x4d, 0xc9, 0xcc,
1030                              0xb9, 0x09, 0xa0, 0x73, 0xa9, 0x76, 0xbf, 0x63 },
1031                 .public = { 0xb3, 0xb5, 0x0e, 0x3e, 0xd3, 0xa4, 0x07, 0xb9,
1032                             0x5d, 0xe9, 0x42, 0xef, 0x74, 0x57, 0x5b, 0x5a,
1033                             0xb8, 0xa1, 0x0c, 0x09, 0xee, 0x10, 0x35, 0x44,
1034                             0xd6, 0x0b, 0xdf, 0xed, 0x81, 0x38, 0xab, 0x2b },
1035                 .result = { 0xf9, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
1036                             0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
1037                             0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
1038                             0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x3f },
1039                 .valid = true
1040         },
1041         /* wycheproof - edge case for shared secret */
1042         {
1043                 .private = { 0xa0, 0xa4, 0xf1, 0x30, 0xb9, 0x8a, 0x5b, 0xe4,
1044                              0xb1, 0xce, 0xdb, 0x7c, 0xb8, 0x55, 0x84, 0xa3,
1045                              0x52, 0x0e, 0x14, 0x2d, 0x47, 0x4d, 0xc9, 0xcc,
1046                              0xb9, 0x09, 0xa0, 0x73, 0xa9, 0x76, 0xbf, 0x63 },
1047                 .public = { 0x21, 0x3f, 0xff, 0xe9, 0x3d, 0x5e, 0xa8, 0xcd,
1048                             0x24, 0x2e, 0x46, 0x28, 0x44, 0x02, 0x99, 0x22,
1049                             0xc4, 0x3c, 0x77, 0xc9, 0xe3, 0xe4, 0x2f, 0x56,
1050                             0x2f, 0x48, 0x5d, 0x24, 0xc5, 0x01, 0xa2, 0x0b },
1051                 .result = { 0xf3, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
1052                             0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
1053                             0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
1054                             0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x3f },
1055                 .valid = true
1056         },
1057         /* wycheproof - edge case for shared secret */
1058         {
1059                 .private = { 0xa0, 0xa4, 0xf1, 0x30, 0xb9, 0x8a, 0x5b, 0xe4,
1060                              0xb1, 0xce, 0xdb, 0x7c, 0xb8, 0x55, 0x84, 0xa3,
1061                              0x52, 0x0e, 0x14, 0x2d, 0x47, 0x4d, 0xc9, 0xcc,
1062                              0xb9, 0x09, 0xa0, 0x73, 0xa9, 0x76, 0xbf, 0x63 },
1063                 .public = { 0x91, 0xb2, 0x32, 0xa1, 0x78, 0xb3, 0xcd, 0x53,
1064                             0x09, 0x32, 0x44, 0x1e, 0x61, 0x39, 0x41, 0x8f,
1065                             0x72, 0x17, 0x22, 0x92, 0xf1, 0xda, 0x4c, 0x18,
1066                             0x34, 0xfc, 0x5e, 0xbf, 0xef, 0xb5, 0x1e, 0x3f },
1067                 .result = { 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
1068                             0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
1069                             0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
1070                             0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x03 },
1071                 .valid = true
1072         },
1073         /* wycheproof - edge case for shared secret */
1074         {
1075                 .private = { 0xa0, 0xa4, 0xf1, 0x30, 0xb9, 0x8a, 0x5b, 0xe4,
1076                              0xb1, 0xce, 0xdb, 0x7c, 0xb8, 0x55, 0x84, 0xa3,
1077                              0x52, 0x0e, 0x14, 0x2d, 0x47, 0x4d, 0xc9, 0xcc,
1078                              0xb9, 0x09, 0xa0, 0x73, 0xa9, 0x76, 0xbf, 0x63 },
1079                 .public = { 0x04, 0x5c, 0x6e, 0x11, 0xc5, 0xd3, 0x32, 0x55,
1080                             0x6c, 0x78, 0x22, 0xfe, 0x94, 0xeb, 0xf8, 0x9b,
1081                             0x56, 0xa3, 0x87, 0x8d, 0xc2, 0x7c, 0xa0, 0x79,
1082                             0x10, 0x30, 0x58, 0x84, 0x9f, 0xab, 0xcb, 0x4f },
1083                 .result = { 0xe5, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
1084                             0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
1085                             0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
1086                             0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x7f },
1087                 .valid = true
1088         },
1089         /* wycheproof - edge case for shared secret */
1090         {
1091                 .private = { 0xa0, 0xa4, 0xf1, 0x30, 0xb9, 0x8a, 0x5b, 0xe4,
1092                              0xb1, 0xce, 0xdb, 0x7c, 0xb8, 0x55, 0x84, 0xa3,
1093                              0x52, 0x0e, 0x14, 0x2d, 0x47, 0x4d, 0xc9, 0xcc,
1094                              0xb9, 0x09, 0xa0, 0x73, 0xa9, 0x76, 0xbf, 0x63 },
1095                 .public = { 0x1c, 0xa2, 0x19, 0x0b, 0x71, 0x16, 0x35, 0x39,
1096                             0x06, 0x3c, 0x35, 0x77, 0x3b, 0xda, 0x0c, 0x9c,
1097                             0x92, 0x8e, 0x91, 0x36, 0xf0, 0x62, 0x0a, 0xeb,
1098                             0x09, 0x3f, 0x09, 0x91, 0x97, 0xb7, 0xf7, 0x4e },
1099                 .result = { 0xe3, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
1100                             0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
1101                             0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
1102                             0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x7f },
1103                 .valid = true
1104         },
1105         /* wycheproof - edge case for shared secret */
1106         {
1107                 .private = { 0xa0, 0xa4, 0xf1, 0x30, 0xb9, 0x8a, 0x5b, 0xe4,
1108                              0xb1, 0xce, 0xdb, 0x7c, 0xb8, 0x55, 0x84, 0xa3,
1109                              0x52, 0x0e, 0x14, 0x2d, 0x47, 0x4d, 0xc9, 0xcc,
1110                              0xb9, 0x09, 0xa0, 0x73, 0xa9, 0x76, 0xbf, 0x63 },
1111                 .public = { 0xf7, 0x6e, 0x90, 0x10, 0xac, 0x33, 0xc5, 0x04,
1112                             0x3b, 0x2d, 0x3b, 0x76, 0xa8, 0x42, 0x17, 0x10,
1113                             0x00, 0xc4, 0x91, 0x62, 0x22, 0xe9, 0xe8, 0x58,
1114                             0x97, 0xa0, 0xae, 0xc7, 0xf6, 0x35, 0x0b, 0x3c },
1115                 .result = { 0xdd, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
1116                             0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
1117                             0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
1118                             0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x7f },
1119                 .valid = true
1120         },
1121         /* wycheproof - edge case for shared secret */
1122         {
1123                 .private = { 0xa0, 0xa4, 0xf1, 0x30, 0xb9, 0x8a, 0x5b, 0xe4,
1124                              0xb1, 0xce, 0xdb, 0x7c, 0xb8, 0x55, 0x84, 0xa3,
1125                              0x52, 0x0e, 0x14, 0x2d, 0x47, 0x4d, 0xc9, 0xcc,
1126                              0xb9, 0x09, 0xa0, 0x73, 0xa9, 0x76, 0xbf, 0x63 },
1127                 .public = { 0xbb, 0x72, 0x68, 0x8d, 0x8f, 0x8a, 0xa7, 0xa3,
1128                             0x9c, 0xd6, 0x06, 0x0c, 0xd5, 0xc8, 0x09, 0x3c,
1129                             0xde, 0xc6, 0xfe, 0x34, 0x19, 0x37, 0xc3, 0x88,
1130                             0x6a, 0x99, 0x34, 0x6c, 0xd0, 0x7f, 0xaa, 0x55 },
1131                 .result = { 0xdb, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
1132                             0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
1133                             0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
1134                             0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x7f },
1135                 .valid = true
1136         },
1137         /* wycheproof - edge case for shared secret */
1138         {
1139                 .private = { 0xa0, 0xa4, 0xf1, 0x30, 0xb9, 0x8a, 0x5b, 0xe4,
1140                              0xb1, 0xce, 0xdb, 0x7c, 0xb8, 0x55, 0x84, 0xa3,
1141                              0x52, 0x0e, 0x14, 0x2d, 0x47, 0x4d, 0xc9, 0xcc,
1142                              0xb9, 0x09, 0xa0, 0x73, 0xa9, 0x76, 0xbf, 0x63 },
1143                 .public = { 0x88, 0xfd, 0xde, 0xa1, 0x93, 0x39, 0x1c, 0x6a,
1144                             0x59, 0x33, 0xef, 0x9b, 0x71, 0x90, 0x15, 0x49,
1145                             0x44, 0x72, 0x05, 0xaa, 0xe9, 0xda, 0x92, 0x8a,
1146                             0x6b, 0x91, 0xa3, 0x52, 0xba, 0x10, 0xf4, 0x1f },
1147                 .result = { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
1148                             0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
1149                             0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
1150                             0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02 },
1151                 .valid = true
1152         },
1153         /* wycheproof - edge case for shared secret */
1154         {
1155                 .private = { 0xa0, 0xa4, 0xf1, 0x30, 0xb9, 0x8a, 0x5b, 0xe4,
1156                              0xb1, 0xce, 0xdb, 0x7c, 0xb8, 0x55, 0x84, 0xa3,
1157                              0x52, 0x0e, 0x14, 0x2d, 0x47, 0x4d, 0xc9, 0xcc,
1158                              0xb9, 0x09, 0xa0, 0x73, 0xa9, 0x76, 0xbf, 0x63 },
1159                 .public = { 0x30, 0x3b, 0x39, 0x2f, 0x15, 0x31, 0x16, 0xca,
1160                             0xd9, 0xcc, 0x68, 0x2a, 0x00, 0xcc, 0xc4, 0x4c,
1161                             0x95, 0xff, 0x0d, 0x3b, 0xbe, 0x56, 0x8b, 0xeb,
1162                             0x6c, 0x4e, 0x73, 0x9b, 0xaf, 0xdc, 0x2c, 0x68 },
1163                 .result = { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
1164                             0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
1165                             0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
1166                             0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x80, 0x00 },
1167                 .valid = true
1168         },
1169         /* wycheproof - checking for overflow */
1170         {
1171                 .private = { 0xc8, 0x17, 0x24, 0x70, 0x40, 0x00, 0xb2, 0x6d,
1172                              0x31, 0x70, 0x3c, 0xc9, 0x7e, 0x3a, 0x37, 0x8d,
1173                              0x56, 0xfa, 0xd8, 0x21, 0x93, 0x61, 0xc8, 0x8c,
1174                              0xca, 0x8b, 0xd7, 0xc5, 0x71, 0x9b, 0x12, 0xb2 },
1175                 .public = { 0xfd, 0x30, 0x0a, 0xeb, 0x40, 0xe1, 0xfa, 0x58,
1176                             0x25, 0x18, 0x41, 0x2b, 0x49, 0xb2, 0x08, 0xa7,
1177                             0x84, 0x2b, 0x1e, 0x1f, 0x05, 0x6a, 0x04, 0x01,
1178                             0x78, 0xea, 0x41, 0x41, 0x53, 0x4f, 0x65, 0x2d },
1179                 .result = { 0xb7, 0x34, 0x10, 0x5d, 0xc2, 0x57, 0x58, 0x5d,
1180                             0x73, 0xb5, 0x66, 0xcc, 0xb7, 0x6f, 0x06, 0x27,
1181                             0x95, 0xcc, 0xbe, 0xc8, 0x91, 0x28, 0xe5, 0x2b,
1182                             0x02, 0xf3, 0xe5, 0x96, 0x39, 0xf1, 0x3c, 0x46 },
1183                 .valid = true
1184         },
1185         /* wycheproof - checking for overflow */
1186         {
1187                 .private = { 0xc8, 0x17, 0x24, 0x70, 0x40, 0x00, 0xb2, 0x6d,
1188                              0x31, 0x70, 0x3c, 0xc9, 0x7e, 0x3a, 0x37, 0x8d,
1189                              0x56, 0xfa, 0xd8, 0x21, 0x93, 0x61, 0xc8, 0x8c,
1190                              0xca, 0x8b, 0xd7, 0xc5, 0x71, 0x9b, 0x12, 0xb2 },
1191                 .public = { 0xc8, 0xef, 0x79, 0xb5, 0x14, 0xd7, 0x68, 0x26,
1192                             0x77, 0xbc, 0x79, 0x31, 0xe0, 0x6e, 0xe5, 0xc2,
1193                             0x7c, 0x9b, 0x39, 0x2b, 0x4a, 0xe9, 0x48, 0x44,
1194                             0x73, 0xf5, 0x54, 0xe6, 0x67, 0x8e, 0xcc, 0x2e },
1195                 .result = { 0x64, 0x7a, 0x46, 0xb6, 0xfc, 0x3f, 0x40, 0xd6,
1196                             0x21, 0x41, 0xee, 0x3c, 0xee, 0x70, 0x6b, 0x4d,
1197                             0x7a, 0x92, 0x71, 0x59, 0x3a, 0x7b, 0x14, 0x3e,
1198                             0x8e, 0x2e, 0x22, 0x79, 0x88, 0x3e, 0x45, 0x50 },
1199                 .valid = true
1200         },
1201         /* wycheproof - checking for overflow */
1202         {
1203                 .private = { 0xc8, 0x17, 0x24, 0x70, 0x40, 0x00, 0xb2, 0x6d,
1204                              0x31, 0x70, 0x3c, 0xc9, 0x7e, 0x3a, 0x37, 0x8d,
1205                              0x56, 0xfa, 0xd8, 0x21, 0x93, 0x61, 0xc8, 0x8c,
1206                              0xca, 0x8b, 0xd7, 0xc5, 0x71, 0x9b, 0x12, 0xb2 },
1207                 .public = { 0x64, 0xae, 0xac, 0x25, 0x04, 0x14, 0x48, 0x61,
1208                             0x53, 0x2b, 0x7b, 0xbc, 0xb6, 0xc8, 0x7d, 0x67,
1209                             0xdd, 0x4c, 0x1f, 0x07, 0xeb, 0xc2, 0xe0, 0x6e,
1210                             0xff, 0xb9, 0x5a, 0xec, 0xc6, 0x17, 0x0b, 0x2c },
1211                 .result = { 0x4f, 0xf0, 0x3d, 0x5f, 0xb4, 0x3c, 0xd8, 0x65,
1212                             0x7a, 0x3c, 0xf3, 0x7c, 0x13, 0x8c, 0xad, 0xce,
1213                             0xcc, 0xe5, 0x09, 0xe4, 0xeb, 0xa0, 0x89, 0xd0,
1214                             0xef, 0x40, 0xb4, 0xe4, 0xfb, 0x94, 0x61, 0x55 },
1215                 .valid = true
1216         },
1217         /* wycheproof - checking for overflow */
1218         {
1219                 .private = { 0xc8, 0x17, 0x24, 0x70, 0x40, 0x00, 0xb2, 0x6d,
1220                              0x31, 0x70, 0x3c, 0xc9, 0x7e, 0x3a, 0x37, 0x8d,
1221                              0x56, 0xfa, 0xd8, 0x21, 0x93, 0x61, 0xc8, 0x8c,
1222                              0xca, 0x8b, 0xd7, 0xc5, 0x71, 0x9b, 0x12, 0xb2 },
1223                 .public = { 0xbf, 0x68, 0xe3, 0x5e, 0x9b, 0xdb, 0x7e, 0xee,
1224                             0x1b, 0x50, 0x57, 0x02, 0x21, 0x86, 0x0f, 0x5d,
1225                             0xcd, 0xad, 0x8a, 0xcb, 0xab, 0x03, 0x1b, 0x14,
1226                             0x97, 0x4c, 0xc4, 0x90, 0x13, 0xc4, 0x98, 0x31 },
1227                 .result = { 0x21, 0xce, 0xe5, 0x2e, 0xfd, 0xbc, 0x81, 0x2e,
1228                             0x1d, 0x02, 0x1a, 0x4a, 0xf1, 0xe1, 0xd8, 0xbc,
1229                             0x4d, 0xb3, 0xc4, 0x00, 0xe4, 0xd2, 0xa2, 0xc5,
1230                             0x6a, 0x39, 0x26, 0xdb, 0x4d, 0x99, 0xc6, 0x5b },
1231                 .valid = true
1232         },
1233         /* wycheproof - checking for overflow */
1234         {
1235                 .private = { 0xc8, 0x17, 0x24, 0x70, 0x40, 0x00, 0xb2, 0x6d,
1236                              0x31, 0x70, 0x3c, 0xc9, 0x7e, 0x3a, 0x37, 0x8d,
1237                              0x56, 0xfa, 0xd8, 0x21, 0x93, 0x61, 0xc8, 0x8c,
1238                              0xca, 0x8b, 0xd7, 0xc5, 0x71, 0x9b, 0x12, 0xb2 },
1239                 .public = { 0x53, 0x47, 0xc4, 0x91, 0x33, 0x1a, 0x64, 0xb4,
1240                             0x3d, 0xdc, 0x68, 0x30, 0x34, 0xe6, 0x77, 0xf5,
1241                             0x3d, 0xc3, 0x2b, 0x52, 0xa5, 0x2a, 0x57, 0x7c,
1242                             0x15, 0xa8, 0x3b, 0xf2, 0x98, 0xe9, 0x9f, 0x19 },
1243                 .result = { 0x18, 0xcb, 0x89, 0xe4, 0xe2, 0x0c, 0x0c, 0x2b,
1244                             0xd3, 0x24, 0x30, 0x52, 0x45, 0x26, 0x6c, 0x93,
1245                             0x27, 0x69, 0x0b, 0xbe, 0x79, 0xac, 0xb8, 0x8f,
1246                             0x5b, 0x8f, 0xb3, 0xf7, 0x4e, 0xca, 0x3e, 0x52 },
1247                 .valid = true
1248         },
1249         /* wycheproof - private key == -1 (mod order) */
1250         {
1251                 .private = { 0xa0, 0x23, 0xcd, 0xd0, 0x83, 0xef, 0x5b, 0xb8,
1252                              0x2f, 0x10, 0xd6, 0x2e, 0x59, 0xe1, 0x5a, 0x68,
1253                              0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
1254                              0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x50 },
1255                 .public = { 0x25, 0x8e, 0x04, 0x52, 0x3b, 0x8d, 0x25, 0x3e,
1256                             0xe6, 0x57, 0x19, 0xfc, 0x69, 0x06, 0xc6, 0x57,
1257                             0x19, 0x2d, 0x80, 0x71, 0x7e, 0xdc, 0x82, 0x8f,
1258                             0xa0, 0xaf, 0x21, 0x68, 0x6e, 0x2f, 0xaa, 0x75 },
1259                 .result = { 0x25, 0x8e, 0x04, 0x52, 0x3b, 0x8d, 0x25, 0x3e,
1260                             0xe6, 0x57, 0x19, 0xfc, 0x69, 0x06, 0xc6, 0x57,
1261                             0x19, 0x2d, 0x80, 0x71, 0x7e, 0xdc, 0x82, 0x8f,
1262                             0xa0, 0xaf, 0x21, 0x68, 0x6e, 0x2f, 0xaa, 0x75 },
1263                 .valid = true
1264         },
1265         /* wycheproof - private key == 1 (mod order) on twist */
1266         {
1267                 .private = { 0x58, 0x08, 0x3d, 0xd2, 0x61, 0xad, 0x91, 0xef,
1268                              0xf9, 0x52, 0x32, 0x2e, 0xc8, 0x24, 0xc6, 0x82,
1269                              0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
1270                              0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x5f },
1271                 .public = { 0x2e, 0xae, 0x5e, 0xc3, 0xdd, 0x49, 0x4e, 0x9f,
1272                             0x2d, 0x37, 0xd2, 0x58, 0xf8, 0x73, 0xa8, 0xe6,
1273                             0xe9, 0xd0, 0xdb, 0xd1, 0xe3, 0x83, 0xef, 0x64,
1274                             0xd9, 0x8b, 0xb9, 0x1b, 0x3e, 0x0b, 0xe0, 0x35 },
1275                 .result = { 0x2e, 0xae, 0x5e, 0xc3, 0xdd, 0x49, 0x4e, 0x9f,
1276                             0x2d, 0x37, 0xd2, 0x58, 0xf8, 0x73, 0xa8, 0xe6,
1277                             0xe9, 0xd0, 0xdb, 0xd1, 0xe3, 0x83, 0xef, 0x64,
1278                             0xd9, 0x8b, 0xb9, 0x1b, 0x3e, 0x0b, 0xe0, 0x35 },
1279                 .valid = true
1280         }
1281 };
1282
1283 bool __init curve25519_selftest(void)
1284 {
1285         bool success = true, ret, ret2;
1286         size_t i = 0, j;
1287         u8 in[CURVE25519_KEY_SIZE];
1288         u8 out[CURVE25519_KEY_SIZE], out2[CURVE25519_KEY_SIZE],
1289            out3[CURVE25519_KEY_SIZE];
1290
1291         for (i = 0; i < ARRAY_SIZE(curve25519_test_vectors); ++i) {
1292                 memset(out, 0, CURVE25519_KEY_SIZE);
1293                 ret = curve25519(out, curve25519_test_vectors[i].private,
1294                                  curve25519_test_vectors[i].public);
1295                 if (ret != curve25519_test_vectors[i].valid ||
1296                     memcmp(out, curve25519_test_vectors[i].result,
1297                            CURVE25519_KEY_SIZE)) {
1298                         pr_err("curve25519 self-test %zu: FAIL\n", i + 1);
1299                         success = false;
1300                 }
1301         }
1302
1303         for (i = 0; i < 5; ++i) {
1304                 get_random_bytes(in, sizeof(in));
1305                 ret = curve25519_generate_public(out, in);
1306                 ret2 = curve25519(out2, in, (u8[CURVE25519_KEY_SIZE]){ 9 });
1307                 curve25519_generic(out3, in, (u8[CURVE25519_KEY_SIZE]){ 9 });
1308                 if (ret != ret2 ||
1309                     memcmp(out, out2, CURVE25519_KEY_SIZE) ||
1310                     memcmp(out, out3, CURVE25519_KEY_SIZE)) {
1311                         pr_err("curve25519 basepoint self-test %zu: FAIL: input - 0x",
1312                                i + 1);
1313                         for (j = CURVE25519_KEY_SIZE; j-- > 0;)
1314                                 printk(KERN_CONT "%02x", in[j]);
1315                         printk(KERN_CONT "\n");
1316                         success = false;
1317                 }
1318         }
1319
1320         return success;
1321 }