GNU Linux-libre 5.19-rc6-gnu
[releases.git] / lib / crypto / curve25519-selftest.c
1 // SPDX-License-Identifier: GPL-2.0 OR MIT
2 /*
3  * Copyright (C) 2015-2019 Jason A. Donenfeld <Jason@zx2c4.com>. All Rights Reserved.
4  */
5
6 #include <crypto/curve25519.h>
7
8 struct curve25519_test_vector {
9         u8 private[CURVE25519_KEY_SIZE];
10         u8 public[CURVE25519_KEY_SIZE];
11         u8 result[CURVE25519_KEY_SIZE];
12         bool valid;
13 };
14 static const struct curve25519_test_vector curve25519_test_vectors[] __initconst = {
15         {
16                 .private = { 0x77, 0x07, 0x6d, 0x0a, 0x73, 0x18, 0xa5, 0x7d,
17                              0x3c, 0x16, 0xc1, 0x72, 0x51, 0xb2, 0x66, 0x45,
18                              0xdf, 0x4c, 0x2f, 0x87, 0xeb, 0xc0, 0x99, 0x2a,
19                              0xb1, 0x77, 0xfb, 0xa5, 0x1d, 0xb9, 0x2c, 0x2a },
20                 .public = { 0xde, 0x9e, 0xdb, 0x7d, 0x7b, 0x7d, 0xc1, 0xb4,
21                             0xd3, 0x5b, 0x61, 0xc2, 0xec, 0xe4, 0x35, 0x37,
22                             0x3f, 0x83, 0x43, 0xc8, 0x5b, 0x78, 0x67, 0x4d,
23                             0xad, 0xfc, 0x7e, 0x14, 0x6f, 0x88, 0x2b, 0x4f },
24                 .result = { 0x4a, 0x5d, 0x9d, 0x5b, 0xa4, 0xce, 0x2d, 0xe1,
25                             0x72, 0x8e, 0x3b, 0xf4, 0x80, 0x35, 0x0f, 0x25,
26                             0xe0, 0x7e, 0x21, 0xc9, 0x47, 0xd1, 0x9e, 0x33,
27                             0x76, 0xf0, 0x9b, 0x3c, 0x1e, 0x16, 0x17, 0x42 },
28                 .valid = true
29         },
30         {
31                 .private = { 0x5d, 0xab, 0x08, 0x7e, 0x62, 0x4a, 0x8a, 0x4b,
32                              0x79, 0xe1, 0x7f, 0x8b, 0x83, 0x80, 0x0e, 0xe6,
33                              0x6f, 0x3b, 0xb1, 0x29, 0x26, 0x18, 0xb6, 0xfd,
34                              0x1c, 0x2f, 0x8b, 0x27, 0xff, 0x88, 0xe0, 0xeb },
35                 .public = { 0x85, 0x20, 0xf0, 0x09, 0x89, 0x30, 0xa7, 0x54,
36                             0x74, 0x8b, 0x7d, 0xdc, 0xb4, 0x3e, 0xf7, 0x5a,
37                             0x0d, 0xbf, 0x3a, 0x0d, 0x26, 0x38, 0x1a, 0xf4,
38                             0xeb, 0xa4, 0xa9, 0x8e, 0xaa, 0x9b, 0x4e, 0x6a },
39                 .result = { 0x4a, 0x5d, 0x9d, 0x5b, 0xa4, 0xce, 0x2d, 0xe1,
40                             0x72, 0x8e, 0x3b, 0xf4, 0x80, 0x35, 0x0f, 0x25,
41                             0xe0, 0x7e, 0x21, 0xc9, 0x47, 0xd1, 0x9e, 0x33,
42                             0x76, 0xf0, 0x9b, 0x3c, 0x1e, 0x16, 0x17, 0x42 },
43                 .valid = true
44         },
45         {
46                 .private = { 1 },
47                 .public = { 0x25, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
48                             0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
49                             0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
50                             0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 },
51                 .result = { 0x3c, 0x77, 0x77, 0xca, 0xf9, 0x97, 0xb2, 0x64,
52                             0x41, 0x60, 0x77, 0x66, 0x5b, 0x4e, 0x22, 0x9d,
53                             0x0b, 0x95, 0x48, 0xdc, 0x0c, 0xd8, 0x19, 0x98,
54                             0xdd, 0xcd, 0xc5, 0xc8, 0x53, 0x3c, 0x79, 0x7f },
55                 .valid = true
56         },
57         {
58                 .private = { 1 },
59                 .public = { 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
60                             0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
61                             0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
62                             0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff },
63                 .result = { 0xb3, 0x2d, 0x13, 0x62, 0xc2, 0x48, 0xd6, 0x2f,
64                             0xe6, 0x26, 0x19, 0xcf, 0xf0, 0x4d, 0xd4, 0x3d,
65                             0xb7, 0x3f, 0xfc, 0x1b, 0x63, 0x08, 0xed, 0xe3,
66                             0x0b, 0x78, 0xd8, 0x73, 0x80, 0xf1, 0xe8, 0x34 },
67                 .valid = true
68         },
69         {
70                 .private = { 0xa5, 0x46, 0xe3, 0x6b, 0xf0, 0x52, 0x7c, 0x9d,
71                              0x3b, 0x16, 0x15, 0x4b, 0x82, 0x46, 0x5e, 0xdd,
72                              0x62, 0x14, 0x4c, 0x0a, 0xc1, 0xfc, 0x5a, 0x18,
73                              0x50, 0x6a, 0x22, 0x44, 0xba, 0x44, 0x9a, 0xc4 },
74                 .public = { 0xe6, 0xdb, 0x68, 0x67, 0x58, 0x30, 0x30, 0xdb,
75                             0x35, 0x94, 0xc1, 0xa4, 0x24, 0xb1, 0x5f, 0x7c,
76                             0x72, 0x66, 0x24, 0xec, 0x26, 0xb3, 0x35, 0x3b,
77                             0x10, 0xa9, 0x03, 0xa6, 0xd0, 0xab, 0x1c, 0x4c },
78                 .result = { 0xc3, 0xda, 0x55, 0x37, 0x9d, 0xe9, 0xc6, 0x90,
79                             0x8e, 0x94, 0xea, 0x4d, 0xf2, 0x8d, 0x08, 0x4f,
80                             0x32, 0xec, 0xcf, 0x03, 0x49, 0x1c, 0x71, 0xf7,
81                             0x54, 0xb4, 0x07, 0x55, 0x77, 0xa2, 0x85, 0x52 },
82                 .valid = true
83         },
84         {
85                 .private = { 1, 2, 3, 4 },
86                 .public = { 0 },
87                 .result = { 0 },
88                 .valid = false
89         },
90         {
91                 .private = { 2, 4, 6, 8 },
92                 .public = { 0xe0, 0xeb, 0x7a, 0x7c, 0x3b, 0x41, 0xb8, 0xae,
93                             0x16, 0x56, 0xe3, 0xfa, 0xf1, 0x9f, 0xc4, 0x6a,
94                             0xda, 0x09, 0x8d, 0xeb, 0x9c, 0x32, 0xb1, 0xfd,
95                             0x86, 0x62, 0x05, 0x16, 0x5f, 0x49, 0xb8 },
96                 .result = { 0 },
97                 .valid = false
98         },
99         {
100                 .private = { 0xff, 0xff, 0xff, 0xff, 0x0a, 0xff, 0xff, 0xff,
101                              0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
102                              0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
103                              0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff },
104                 .public = { 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
105                             0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
106                             0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
107                             0xff, 0xff, 0xff, 0xff, 0x0a, 0x00, 0xfb, 0x9f },
108                 .result = { 0x77, 0x52, 0xb6, 0x18, 0xc1, 0x2d, 0x48, 0xd2,
109                             0xc6, 0x93, 0x46, 0x83, 0x81, 0x7c, 0xc6, 0x57,
110                             0xf3, 0x31, 0x03, 0x19, 0x49, 0x48, 0x20, 0x05,
111                             0x42, 0x2b, 0x4e, 0xae, 0x8d, 0x1d, 0x43, 0x23 },
112                 .valid = true
113         },
114         {
115                 .private = { 0x8e, 0x0a, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
116                              0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
117                              0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
118                              0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 },
119                 .public = { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
120                             0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
121                             0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
122                             0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x8e, 0x06 },
123                 .result = { 0x5a, 0xdf, 0xaa, 0x25, 0x86, 0x8e, 0x32, 0x3d,
124                             0xae, 0x49, 0x62, 0xc1, 0x01, 0x5c, 0xb3, 0x12,
125                             0xe1, 0xc5, 0xc7, 0x9e, 0x95, 0x3f, 0x03, 0x99,
126                             0xb0, 0xba, 0x16, 0x22, 0xf3, 0xb6, 0xf7, 0x0c },
127                 .valid = true
128         },
129         /* wycheproof - normal case */
130         {
131                 .private = { 0x48, 0x52, 0x83, 0x4d, 0x9d, 0x6b, 0x77, 0xda,
132                              0xde, 0xab, 0xaa, 0xf2, 0xe1, 0x1d, 0xca, 0x66,
133                              0xd1, 0x9f, 0xe7, 0x49, 0x93, 0xa7, 0xbe, 0xc3,
134                              0x6c, 0x6e, 0x16, 0xa0, 0x98, 0x3f, 0xea, 0xba },
135                 .public = { 0x9c, 0x64, 0x7d, 0x9a, 0xe5, 0x89, 0xb9, 0xf5,
136                             0x8f, 0xdc, 0x3c, 0xa4, 0x94, 0x7e, 0xfb, 0xc9,
137                             0x15, 0xc4, 0xb2, 0xe0, 0x8e, 0x74, 0x4a, 0x0e,
138                             0xdf, 0x46, 0x9d, 0xac, 0x59, 0xc8, 0xf8, 0x5a },
139                 .result = { 0x87, 0xb7, 0xf2, 0x12, 0xb6, 0x27, 0xf7, 0xa5,
140                             0x4c, 0xa5, 0xe0, 0xbc, 0xda, 0xdd, 0xd5, 0x38,
141                             0x9d, 0x9d, 0xe6, 0x15, 0x6c, 0xdb, 0xcf, 0x8e,
142                             0xbe, 0x14, 0xff, 0xbc, 0xfb, 0x43, 0x65, 0x51 },
143                 .valid = true
144         },
145         /* wycheproof - public key on twist */
146         {
147                 .private = { 0x58, 0x8c, 0x06, 0x1a, 0x50, 0x80, 0x4a, 0xc4,
148                              0x88, 0xad, 0x77, 0x4a, 0xc7, 0x16, 0xc3, 0xf5,
149                              0xba, 0x71, 0x4b, 0x27, 0x12, 0xe0, 0x48, 0x49,
150                              0x13, 0x79, 0xa5, 0x00, 0x21, 0x19, 0x98, 0xa8 },
151                 .public = { 0x63, 0xaa, 0x40, 0xc6, 0xe3, 0x83, 0x46, 0xc5,
152                             0xca, 0xf2, 0x3a, 0x6d, 0xf0, 0xa5, 0xe6, 0xc8,
153                             0x08, 0x89, 0xa0, 0x86, 0x47, 0xe5, 0x51, 0xb3,
154                             0x56, 0x34, 0x49, 0xbe, 0xfc, 0xfc, 0x97, 0x33 },
155                 .result = { 0xb1, 0xa7, 0x07, 0x51, 0x94, 0x95, 0xff, 0xff,
156                             0xb2, 0x98, 0xff, 0x94, 0x17, 0x16, 0xb0, 0x6d,
157                             0xfa, 0xb8, 0x7c, 0xf8, 0xd9, 0x11, 0x23, 0xfe,
158                             0x2b, 0xe9, 0xa2, 0x33, 0xdd, 0xa2, 0x22, 0x12 },
159                 .valid = true
160         },
161         /* wycheproof - public key on twist */
162         {
163                 .private = { 0xb0, 0x5b, 0xfd, 0x32, 0xe5, 0x53, 0x25, 0xd9,
164                              0xfd, 0x64, 0x8c, 0xb3, 0x02, 0x84, 0x80, 0x39,
165                              0x00, 0x0b, 0x39, 0x0e, 0x44, 0xd5, 0x21, 0xe5,
166                              0x8a, 0xab, 0x3b, 0x29, 0xa6, 0x96, 0x0b, 0xa8 },
167                 .public = { 0x0f, 0x83, 0xc3, 0x6f, 0xde, 0xd9, 0xd3, 0x2f,
168                             0xad, 0xf4, 0xef, 0xa3, 0xae, 0x93, 0xa9, 0x0b,
169                             0xb5, 0xcf, 0xa6, 0x68, 0x93, 0xbc, 0x41, 0x2c,
170                             0x43, 0xfa, 0x72, 0x87, 0xdb, 0xb9, 0x97, 0x79 },
171                 .result = { 0x67, 0xdd, 0x4a, 0x6e, 0x16, 0x55, 0x33, 0x53,
172                             0x4c, 0x0e, 0x3f, 0x17, 0x2e, 0x4a, 0xb8, 0x57,
173                             0x6b, 0xca, 0x92, 0x3a, 0x5f, 0x07, 0xb2, 0xc0,
174                             0x69, 0xb4, 0xc3, 0x10, 0xff, 0x2e, 0x93, 0x5b },
175                 .valid = true
176         },
177         /* wycheproof - public key on twist */
178         {
179                 .private = { 0x70, 0xe3, 0x4b, 0xcb, 0xe1, 0xf4, 0x7f, 0xbc,
180                              0x0f, 0xdd, 0xfd, 0x7c, 0x1e, 0x1a, 0xa5, 0x3d,
181                              0x57, 0xbf, 0xe0, 0xf6, 0x6d, 0x24, 0x30, 0x67,
182                              0xb4, 0x24, 0xbb, 0x62, 0x10, 0xbe, 0xd1, 0x9c },
183                 .public = { 0x0b, 0x82, 0x11, 0xa2, 0xb6, 0x04, 0x90, 0x97,
184                             0xf6, 0x87, 0x1c, 0x6c, 0x05, 0x2d, 0x3c, 0x5f,
185                             0xc1, 0xba, 0x17, 0xda, 0x9e, 0x32, 0xae, 0x45,
186                             0x84, 0x03, 0xb0, 0x5b, 0xb2, 0x83, 0x09, 0x2a },
187                 .result = { 0x4a, 0x06, 0x38, 0xcf, 0xaa, 0x9e, 0xf1, 0x93,
188                             0x3b, 0x47, 0xf8, 0x93, 0x92, 0x96, 0xa6, 0xb2,
189                             0x5b, 0xe5, 0x41, 0xef, 0x7f, 0x70, 0xe8, 0x44,
190                             0xc0, 0xbc, 0xc0, 0x0b, 0x13, 0x4d, 0xe6, 0x4a },
191                 .valid = true
192         },
193         /* wycheproof - public key on twist */
194         {
195                 .private = { 0x68, 0xc1, 0xf3, 0xa6, 0x53, 0xa4, 0xcd, 0xb1,
196                              0xd3, 0x7b, 0xba, 0x94, 0x73, 0x8f, 0x8b, 0x95,
197                              0x7a, 0x57, 0xbe, 0xb2, 0x4d, 0x64, 0x6e, 0x99,
198                              0x4d, 0xc2, 0x9a, 0x27, 0x6a, 0xad, 0x45, 0x8d },
199                 .public = { 0x34, 0x3a, 0xc2, 0x0a, 0x3b, 0x9c, 0x6a, 0x27,
200                             0xb1, 0x00, 0x81, 0x76, 0x50, 0x9a, 0xd3, 0x07,
201                             0x35, 0x85, 0x6e, 0xc1, 0xc8, 0xd8, 0xfc, 0xae,
202                             0x13, 0x91, 0x2d, 0x08, 0xd1, 0x52, 0xf4, 0x6c },
203                 .result = { 0x39, 0x94, 0x91, 0xfc, 0xe8, 0xdf, 0xab, 0x73,
204                             0xb4, 0xf9, 0xf6, 0x11, 0xde, 0x8e, 0xa0, 0xb2,
205                             0x7b, 0x28, 0xf8, 0x59, 0x94, 0x25, 0x0b, 0x0f,
206                             0x47, 0x5d, 0x58, 0x5d, 0x04, 0x2a, 0xc2, 0x07 },
207                 .valid = true
208         },
209         /* wycheproof - public key on twist */
210         {
211                 .private = { 0xd8, 0x77, 0xb2, 0x6d, 0x06, 0xdf, 0xf9, 0xd9,
212                              0xf7, 0xfd, 0x4c, 0x5b, 0x37, 0x69, 0xf8, 0xcd,
213                              0xd5, 0xb3, 0x05, 0x16, 0xa5, 0xab, 0x80, 0x6b,
214                              0xe3, 0x24, 0xff, 0x3e, 0xb6, 0x9e, 0xa0, 0xb2 },
215                 .public = { 0xfa, 0x69, 0x5f, 0xc7, 0xbe, 0x8d, 0x1b, 0xe5,
216                             0xbf, 0x70, 0x48, 0x98, 0xf3, 0x88, 0xc4, 0x52,
217                             0xba, 0xfd, 0xd3, 0xb8, 0xea, 0xe8, 0x05, 0xf8,
218                             0x68, 0x1a, 0x8d, 0x15, 0xc2, 0xd4, 0xe1, 0x42 },
219                 .result = { 0x2c, 0x4f, 0xe1, 0x1d, 0x49, 0x0a, 0x53, 0x86,
220                             0x17, 0x76, 0xb1, 0x3b, 0x43, 0x54, 0xab, 0xd4,
221                             0xcf, 0x5a, 0x97, 0x69, 0x9d, 0xb6, 0xe6, 0xc6,
222                             0x8c, 0x16, 0x26, 0xd0, 0x76, 0x62, 0xf7, 0x58 },
223                 .valid = true
224         },
225         /* wycheproof - public key = 0 */
226         {
227                 .private = { 0x20, 0x74, 0x94, 0x03, 0x8f, 0x2b, 0xb8, 0x11,
228                              0xd4, 0x78, 0x05, 0xbc, 0xdf, 0x04, 0xa2, 0xac,
229                              0x58, 0x5a, 0xda, 0x7f, 0x2f, 0x23, 0x38, 0x9b,
230                              0xfd, 0x46, 0x58, 0xf9, 0xdd, 0xd4, 0xde, 0xbc },
231                 .public = { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
232                             0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
233                             0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
234                             0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 },
235                 .result = { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
236                             0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
237                             0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
238                             0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 },
239                 .valid = false
240         },
241         /* wycheproof - public key = 1 */
242         {
243                 .private = { 0x20, 0x2e, 0x89, 0x72, 0xb6, 0x1c, 0x7e, 0x61,
244                              0x93, 0x0e, 0xb9, 0x45, 0x0b, 0x50, 0x70, 0xea,
245                              0xe1, 0xc6, 0x70, 0x47, 0x56, 0x85, 0x54, 0x1f,
246                              0x04, 0x76, 0x21, 0x7e, 0x48, 0x18, 0xcf, 0xab },
247                 .public = { 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
248                             0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
249                             0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
250                             0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 },
251                 .result = { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
252                             0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
253                             0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
254                             0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 },
255                 .valid = false
256         },
257         /* wycheproof - edge case on twist */
258         {
259                 .private = { 0x38, 0xdd, 0xe9, 0xf3, 0xe7, 0xb7, 0x99, 0x04,
260                              0x5f, 0x9a, 0xc3, 0x79, 0x3d, 0x4a, 0x92, 0x77,
261                              0xda, 0xde, 0xad, 0xc4, 0x1b, 0xec, 0x02, 0x90,
262                              0xf8, 0x1f, 0x74, 0x4f, 0x73, 0x77, 0x5f, 0x84 },
263                 .public = { 0x02, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
264                             0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
265                             0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
266                             0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 },
267                 .result = { 0x9a, 0x2c, 0xfe, 0x84, 0xff, 0x9c, 0x4a, 0x97,
268                             0x39, 0x62, 0x5c, 0xae, 0x4a, 0x3b, 0x82, 0xa9,
269                             0x06, 0x87, 0x7a, 0x44, 0x19, 0x46, 0xf8, 0xd7,
270                             0xb3, 0xd7, 0x95, 0xfe, 0x8f, 0x5d, 0x16, 0x39 },
271                 .valid = true
272         },
273         /* wycheproof - edge case on twist */
274         {
275                 .private = { 0x98, 0x57, 0xa9, 0x14, 0xe3, 0xc2, 0x90, 0x36,
276                              0xfd, 0x9a, 0x44, 0x2b, 0xa5, 0x26, 0xb5, 0xcd,
277                              0xcd, 0xf2, 0x82, 0x16, 0x15, 0x3e, 0x63, 0x6c,
278                              0x10, 0x67, 0x7a, 0xca, 0xb6, 0xbd, 0x6a, 0xa5 },
279                 .public = { 0x03, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
280                             0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
281                             0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
282                             0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 },
283                 .result = { 0x4d, 0xa4, 0xe0, 0xaa, 0x07, 0x2c, 0x23, 0x2e,
284                             0xe2, 0xf0, 0xfa, 0x4e, 0x51, 0x9a, 0xe5, 0x0b,
285                             0x52, 0xc1, 0xed, 0xd0, 0x8a, 0x53, 0x4d, 0x4e,
286                             0xf3, 0x46, 0xc2, 0xe1, 0x06, 0xd2, 0x1d, 0x60 },
287                 .valid = true
288         },
289         /* wycheproof - edge case on twist */
290         {
291                 .private = { 0x48, 0xe2, 0x13, 0x0d, 0x72, 0x33, 0x05, 0xed,
292                              0x05, 0xe6, 0xe5, 0x89, 0x4d, 0x39, 0x8a, 0x5e,
293                              0x33, 0x36, 0x7a, 0x8c, 0x6a, 0xac, 0x8f, 0xcd,
294                              0xf0, 0xa8, 0x8e, 0x4b, 0x42, 0x82, 0x0d, 0xb7 },
295                 .public = { 0xff, 0xff, 0xff, 0x03, 0x00, 0x00, 0xf8, 0xff,
296                             0xff, 0x1f, 0x00, 0x00, 0xc0, 0xff, 0xff, 0xff,
297                             0x00, 0x00, 0x00, 0xfe, 0xff, 0xff, 0x07, 0x00,
298                             0x00, 0xf0, 0xff, 0xff, 0x3f, 0x00, 0x00, 0x00 },
299                 .result = { 0x9e, 0xd1, 0x0c, 0x53, 0x74, 0x7f, 0x64, 0x7f,
300                             0x82, 0xf4, 0x51, 0x25, 0xd3, 0xde, 0x15, 0xa1,
301                             0xe6, 0xb8, 0x24, 0x49, 0x6a, 0xb4, 0x04, 0x10,
302                             0xff, 0xcc, 0x3c, 0xfe, 0x95, 0x76, 0x0f, 0x3b },
303                 .valid = true
304         },
305         /* wycheproof - edge case on twist */
306         {
307                 .private = { 0x28, 0xf4, 0x10, 0x11, 0x69, 0x18, 0x51, 0xb3,
308                              0xa6, 0x2b, 0x64, 0x15, 0x53, 0xb3, 0x0d, 0x0d,
309                              0xfd, 0xdc, 0xb8, 0xff, 0xfc, 0xf5, 0x37, 0x00,
310                              0xa7, 0xbe, 0x2f, 0x6a, 0x87, 0x2e, 0x9f, 0xb0 },
311                 .public = { 0x00, 0x00, 0x00, 0xfc, 0xff, 0xff, 0x07, 0x00,
312                             0x00, 0xe0, 0xff, 0xff, 0x3f, 0x00, 0x00, 0x00,
313                             0xff, 0xff, 0xff, 0x01, 0x00, 0x00, 0xf8, 0xff,
314                             0xff, 0x0f, 0x00, 0x00, 0xc0, 0xff, 0xff, 0x7f },
315                 .result = { 0xcf, 0x72, 0xb4, 0xaa, 0x6a, 0xa1, 0xc9, 0xf8,
316                             0x94, 0xf4, 0x16, 0x5b, 0x86, 0x10, 0x9a, 0xa4,
317                             0x68, 0x51, 0x76, 0x48, 0xe1, 0xf0, 0xcc, 0x70,
318                             0xe1, 0xab, 0x08, 0x46, 0x01, 0x76, 0x50, 0x6b },
319                 .valid = true
320         },
321         /* wycheproof - edge case on twist */
322         {
323                 .private = { 0x18, 0xa9, 0x3b, 0x64, 0x99, 0xb9, 0xf6, 0xb3,
324                              0x22, 0x5c, 0xa0, 0x2f, 0xef, 0x41, 0x0e, 0x0a,
325                              0xde, 0xc2, 0x35, 0x32, 0x32, 0x1d, 0x2d, 0x8e,
326                              0xf1, 0xa6, 0xd6, 0x02, 0xa8, 0xc6, 0x5b, 0x83 },
327                 .public = { 0x00, 0x00, 0x00, 0x00, 0xff, 0xff, 0xff, 0xff,
328                             0x00, 0x00, 0x00, 0x00, 0xff, 0xff, 0xff, 0xff,
329                             0x00, 0x00, 0x00, 0x00, 0xff, 0xff, 0xff, 0xff,
330                             0x00, 0x00, 0x00, 0x00, 0xff, 0xff, 0xff, 0x7f },
331                 .result = { 0x5d, 0x50, 0xb6, 0x28, 0x36, 0xbb, 0x69, 0x57,
332                             0x94, 0x10, 0x38, 0x6c, 0xf7, 0xbb, 0x81, 0x1c,
333                             0x14, 0xbf, 0x85, 0xb1, 0xc7, 0xb1, 0x7e, 0x59,
334                             0x24, 0xc7, 0xff, 0xea, 0x91, 0xef, 0x9e, 0x12 },
335                 .valid = true
336         },
337         /* wycheproof - edge case on twist */
338         {
339                 .private = { 0xc0, 0x1d, 0x13, 0x05, 0xa1, 0x33, 0x8a, 0x1f,
340                              0xca, 0xc2, 0xba, 0x7e, 0x2e, 0x03, 0x2b, 0x42,
341                              0x7e, 0x0b, 0x04, 0x90, 0x31, 0x65, 0xac, 0xa9,
342                              0x57, 0xd8, 0xd0, 0x55, 0x3d, 0x87, 0x17, 0xb0 },
343                 .public = { 0xea, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
344                             0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
345                             0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
346                             0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x7f },
347                 .result = { 0x19, 0x23, 0x0e, 0xb1, 0x48, 0xd5, 0xd6, 0x7c,
348                             0x3c, 0x22, 0xab, 0x1d, 0xae, 0xff, 0x80, 0xa5,
349                             0x7e, 0xae, 0x42, 0x65, 0xce, 0x28, 0x72, 0x65,
350                             0x7b, 0x2c, 0x80, 0x99, 0xfc, 0x69, 0x8e, 0x50 },
351                 .valid = true
352         },
353         /* wycheproof - edge case for public key */
354         {
355                 .private = { 0x38, 0x6f, 0x7f, 0x16, 0xc5, 0x07, 0x31, 0xd6,
356                              0x4f, 0x82, 0xe6, 0xa1, 0x70, 0xb1, 0x42, 0xa4,
357                              0xe3, 0x4f, 0x31, 0xfd, 0x77, 0x68, 0xfc, 0xb8,
358                              0x90, 0x29, 0x25, 0xe7, 0xd1, 0xe2, 0x1a, 0xbe },
359                 .public = { 0x04, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
360                             0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
361                             0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
362                             0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 },
363                 .result = { 0x0f, 0xca, 0xb5, 0xd8, 0x42, 0xa0, 0x78, 0xd7,
364                             0xa7, 0x1f, 0xc5, 0x9b, 0x57, 0xbf, 0xb4, 0xca,
365                             0x0b, 0xe6, 0x87, 0x3b, 0x49, 0xdc, 0xdb, 0x9f,
366                             0x44, 0xe1, 0x4a, 0xe8, 0xfb, 0xdf, 0xa5, 0x42 },
367                 .valid = true
368         },
369         /* wycheproof - edge case for public key */
370         {
371                 .private = { 0xe0, 0x23, 0xa2, 0x89, 0xbd, 0x5e, 0x90, 0xfa,
372                              0x28, 0x04, 0xdd, 0xc0, 0x19, 0xa0, 0x5e, 0xf3,
373                              0xe7, 0x9d, 0x43, 0x4b, 0xb6, 0xea, 0x2f, 0x52,
374                              0x2e, 0xcb, 0x64, 0x3a, 0x75, 0x29, 0x6e, 0x95 },
375                 .public = { 0xff, 0xff, 0xff, 0xff, 0x00, 0x00, 0x00, 0x00,
376                             0xff, 0xff, 0xff, 0xff, 0x00, 0x00, 0x00, 0x00,
377                             0xff, 0xff, 0xff, 0xff, 0x00, 0x00, 0x00, 0x00,
378                             0xff, 0xff, 0xff, 0xff, 0x00, 0x00, 0x00, 0x00 },
379                 .result = { 0x54, 0xce, 0x8f, 0x22, 0x75, 0xc0, 0x77, 0xe3,
380                             0xb1, 0x30, 0x6a, 0x39, 0x39, 0xc5, 0xe0, 0x3e,
381                             0xef, 0x6b, 0xbb, 0x88, 0x06, 0x05, 0x44, 0x75,
382                             0x8d, 0x9f, 0xef, 0x59, 0xb0, 0xbc, 0x3e, 0x4f },
383                 .valid = true
384         },
385         /* wycheproof - edge case for public key */
386         {
387                 .private = { 0x68, 0xf0, 0x10, 0xd6, 0x2e, 0xe8, 0xd9, 0x26,
388                              0x05, 0x3a, 0x36, 0x1c, 0x3a, 0x75, 0xc6, 0xea,
389                              0x4e, 0xbd, 0xc8, 0x60, 0x6a, 0xb2, 0x85, 0x00,
390                              0x3a, 0x6f, 0x8f, 0x40, 0x76, 0xb0, 0x1e, 0x83 },
391                 .public = { 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
392                             0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
393                             0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
394                             0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x03 },
395                 .result = { 0xf1, 0x36, 0x77, 0x5c, 0x5b, 0xeb, 0x0a, 0xf8,
396                             0x11, 0x0a, 0xf1, 0x0b, 0x20, 0x37, 0x23, 0x32,
397                             0x04, 0x3c, 0xab, 0x75, 0x24, 0x19, 0x67, 0x87,
398                             0x75, 0xa2, 0x23, 0xdf, 0x57, 0xc9, 0xd3, 0x0d },
399                 .valid = true
400         },
401         /* wycheproof - edge case for public key */
402         {
403                 .private = { 0x58, 0xeb, 0xcb, 0x35, 0xb0, 0xf8, 0x84, 0x5c,
404                              0xaf, 0x1e, 0xc6, 0x30, 0xf9, 0x65, 0x76, 0xb6,
405                              0x2c, 0x4b, 0x7b, 0x6c, 0x36, 0xb2, 0x9d, 0xeb,
406                              0x2c, 0xb0, 0x08, 0x46, 0x51, 0x75, 0x5c, 0x96 },
407                 .public = { 0xff, 0xff, 0xff, 0xfb, 0xff, 0xff, 0xfb, 0xff,
408                             0xff, 0xdf, 0xff, 0xff, 0xdf, 0xff, 0xff, 0xff,
409                             0xfe, 0xff, 0xff, 0xfe, 0xff, 0xff, 0xf7, 0xff,
410                             0xff, 0xf7, 0xff, 0xff, 0xbf, 0xff, 0xff, 0x3f },
411                 .result = { 0xbf, 0x9a, 0xff, 0xd0, 0x6b, 0x84, 0x40, 0x85,
412                             0x58, 0x64, 0x60, 0x96, 0x2e, 0xf2, 0x14, 0x6f,
413                             0xf3, 0xd4, 0x53, 0x3d, 0x94, 0x44, 0xaa, 0xb0,
414                             0x06, 0xeb, 0x88, 0xcc, 0x30, 0x54, 0x40, 0x7d },
415                 .valid = true
416         },
417         /* wycheproof - edge case for public key */
418         {
419                 .private = { 0x18, 0x8c, 0x4b, 0xc5, 0xb9, 0xc4, 0x4b, 0x38,
420                              0xbb, 0x65, 0x8b, 0x9b, 0x2a, 0xe8, 0x2d, 0x5b,
421                              0x01, 0x01, 0x5e, 0x09, 0x31, 0x84, 0xb1, 0x7c,
422                              0xb7, 0x86, 0x35, 0x03, 0xa7, 0x83, 0xe1, 0xbb },
423                 .public = { 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
424                             0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
425                             0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
426                             0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x3f },
427                 .result = { 0xd4, 0x80, 0xde, 0x04, 0xf6, 0x99, 0xcb, 0x3b,
428                             0xe0, 0x68, 0x4a, 0x9c, 0xc2, 0xe3, 0x12, 0x81,
429                             0xea, 0x0b, 0xc5, 0xa9, 0xdc, 0xc1, 0x57, 0xd3,
430                             0xd2, 0x01, 0x58, 0xd4, 0x6c, 0xa5, 0x24, 0x6d },
431                 .valid = true
432         },
433         /* wycheproof - edge case for public key */
434         {
435                 .private = { 0xe0, 0x6c, 0x11, 0xbb, 0x2e, 0x13, 0xce, 0x3d,
436                              0xc7, 0x67, 0x3f, 0x67, 0xf5, 0x48, 0x22, 0x42,
437                              0x90, 0x94, 0x23, 0xa9, 0xae, 0x95, 0xee, 0x98,
438                              0x6a, 0x98, 0x8d, 0x98, 0xfa, 0xee, 0x23, 0xa2 },
439                 .public = { 0xff, 0xff, 0xff, 0xff, 0xfe, 0xff, 0xff, 0x7f,
440                             0xff, 0xff, 0xff, 0xff, 0xfe, 0xff, 0xff, 0x7f,
441                             0xff, 0xff, 0xff, 0xff, 0xfe, 0xff, 0xff, 0x7f,
442                             0xff, 0xff, 0xff, 0xff, 0xfe, 0xff, 0xff, 0x7f },
443                 .result = { 0x4c, 0x44, 0x01, 0xcc, 0xe6, 0xb5, 0x1e, 0x4c,
444                             0xb1, 0x8f, 0x27, 0x90, 0x24, 0x6c, 0x9b, 0xf9,
445                             0x14, 0xdb, 0x66, 0x77, 0x50, 0xa1, 0xcb, 0x89,
446                             0x06, 0x90, 0x92, 0xaf, 0x07, 0x29, 0x22, 0x76 },
447                 .valid = true
448         },
449         /* wycheproof - edge case for public key */
450         {
451                 .private = { 0xc0, 0x65, 0x8c, 0x46, 0xdd, 0xe1, 0x81, 0x29,
452                              0x29, 0x38, 0x77, 0x53, 0x5b, 0x11, 0x62, 0xb6,
453                              0xf9, 0xf5, 0x41, 0x4a, 0x23, 0xcf, 0x4d, 0x2c,
454                              0xbc, 0x14, 0x0a, 0x4d, 0x99, 0xda, 0x2b, 0x8f },
455                 .public = { 0xeb, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
456                             0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
457                             0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
458                             0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x7f },
459                 .result = { 0x57, 0x8b, 0xa8, 0xcc, 0x2d, 0xbd, 0xc5, 0x75,
460                             0xaf, 0xcf, 0x9d, 0xf2, 0xb3, 0xee, 0x61, 0x89,
461                             0xf5, 0x33, 0x7d, 0x68, 0x54, 0xc7, 0x9b, 0x4c,
462                             0xe1, 0x65, 0xea, 0x12, 0x29, 0x3b, 0x3a, 0x0f },
463                 .valid = true
464         },
465         /* wycheproof - public key with low order */
466         {
467                 .private = { 0x10, 0x25, 0x5c, 0x92, 0x30, 0xa9, 0x7a, 0x30,
468                              0xa4, 0x58, 0xca, 0x28, 0x4a, 0x62, 0x96, 0x69,
469                              0x29, 0x3a, 0x31, 0x89, 0x0c, 0xda, 0x9d, 0x14,
470                              0x7f, 0xeb, 0xc7, 0xd1, 0xe2, 0x2d, 0x6b, 0xb1 },
471                 .public = { 0xe0, 0xeb, 0x7a, 0x7c, 0x3b, 0x41, 0xb8, 0xae,
472                             0x16, 0x56, 0xe3, 0xfa, 0xf1, 0x9f, 0xc4, 0x6a,
473                             0xda, 0x09, 0x8d, 0xeb, 0x9c, 0x32, 0xb1, 0xfd,
474                             0x86, 0x62, 0x05, 0x16, 0x5f, 0x49, 0xb8, 0x00 },
475                 .result = { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
476                             0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
477                             0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
478                             0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 },
479                 .valid = false
480         },
481         /* wycheproof - public key with low order */
482         {
483                 .private = { 0x78, 0xf1, 0xe8, 0xed, 0xf1, 0x44, 0x81, 0xb3,
484                              0x89, 0x44, 0x8d, 0xac, 0x8f, 0x59, 0xc7, 0x0b,
485                              0x03, 0x8e, 0x7c, 0xf9, 0x2e, 0xf2, 0xc7, 0xef,
486                              0xf5, 0x7a, 0x72, 0x46, 0x6e, 0x11, 0x52, 0x96 },
487                 .public = { 0x5f, 0x9c, 0x95, 0xbc, 0xa3, 0x50, 0x8c, 0x24,
488                             0xb1, 0xd0, 0xb1, 0x55, 0x9c, 0x83, 0xef, 0x5b,
489                             0x04, 0x44, 0x5c, 0xc4, 0x58, 0x1c, 0x8e, 0x86,
490                             0xd8, 0x22, 0x4e, 0xdd, 0xd0, 0x9f, 0x11, 0x57 },
491                 .result = { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
492                             0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
493                             0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
494                             0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 },
495                 .valid = false
496         },
497         /* wycheproof - public key with low order */
498         {
499                 .private = { 0xa0, 0xa0, 0x5a, 0x3e, 0x8f, 0x9f, 0x44, 0x20,
500                              0x4d, 0x5f, 0x80, 0x59, 0xa9, 0x4a, 0xc7, 0xdf,
501                              0xc3, 0x9a, 0x49, 0xac, 0x01, 0x6d, 0xd7, 0x43,
502                              0xdb, 0xfa, 0x43, 0xc5, 0xd6, 0x71, 0xfd, 0x88 },
503                 .public = { 0xec, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
504                             0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
505                             0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
506                             0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x7f },
507                 .result = { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
508                             0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
509                             0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
510                             0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 },
511                 .valid = false
512         },
513         /* wycheproof - public key with low order */
514         {
515                 .private = { 0xd0, 0xdb, 0xb3, 0xed, 0x19, 0x06, 0x66, 0x3f,
516                              0x15, 0x42, 0x0a, 0xf3, 0x1f, 0x4e, 0xaf, 0x65,
517                              0x09, 0xd9, 0xa9, 0x94, 0x97, 0x23, 0x50, 0x06,
518                              0x05, 0xad, 0x7c, 0x1c, 0x6e, 0x74, 0x50, 0xa9 },
519                 .public = { 0xed, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
520                             0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
521                             0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
522                             0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x7f },
523                 .result = { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
524                             0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
525                             0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
526                             0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 },
527                 .valid = false
528         },
529         /* wycheproof - public key with low order */
530         {
531                 .private = { 0xc0, 0xb1, 0xd0, 0xeb, 0x22, 0xb2, 0x44, 0xfe,
532                              0x32, 0x91, 0x14, 0x00, 0x72, 0xcd, 0xd9, 0xd9,
533                              0x89, 0xb5, 0xf0, 0xec, 0xd9, 0x6c, 0x10, 0x0f,
534                              0xeb, 0x5b, 0xca, 0x24, 0x1c, 0x1d, 0x9f, 0x8f },
535                 .public = { 0xee, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
536                             0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
537                             0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
538                             0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x7f },
539                 .result = { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
540                             0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
541                             0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
542                             0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 },
543                 .valid = false
544         },
545         /* wycheproof - public key with low order */
546         {
547                 .private = { 0x48, 0x0b, 0xf4, 0x5f, 0x59, 0x49, 0x42, 0xa8,
548                              0xbc, 0x0f, 0x33, 0x53, 0xc6, 0xe8, 0xb8, 0x85,
549                              0x3d, 0x77, 0xf3, 0x51, 0xf1, 0xc2, 0xca, 0x6c,
550                              0x2d, 0x1a, 0xbf, 0x8a, 0x00, 0xb4, 0x22, 0x9c },
551                 .public = { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
552                             0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
553                             0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
554                             0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x80 },
555                 .result = { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
556                             0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
557                             0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
558                             0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 },
559                 .valid = false
560         },
561         /* wycheproof - public key with low order */
562         {
563                 .private = { 0x30, 0xf9, 0x93, 0xfc, 0xf8, 0x51, 0x4f, 0xc8,
564                              0x9b, 0xd8, 0xdb, 0x14, 0xcd, 0x43, 0xba, 0x0d,
565                              0x4b, 0x25, 0x30, 0xe7, 0x3c, 0x42, 0x76, 0xa0,
566                              0x5e, 0x1b, 0x14, 0x5d, 0x42, 0x0c, 0xed, 0xb4 },
567                 .public = { 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
568                             0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
569                             0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
570                             0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x80 },
571                 .result = { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
572                             0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
573                             0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
574                             0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 },
575                 .valid = false
576         },
577         /* wycheproof - public key with low order */
578         {
579                 .private = { 0xc0, 0x49, 0x74, 0xb7, 0x58, 0x38, 0x0e, 0x2a,
580                              0x5b, 0x5d, 0xf6, 0xeb, 0x09, 0xbb, 0x2f, 0x6b,
581                              0x34, 0x34, 0xf9, 0x82, 0x72, 0x2a, 0x8e, 0x67,
582                              0x6d, 0x3d, 0xa2, 0x51, 0xd1, 0xb3, 0xde, 0x83 },
583                 .public = { 0xe0, 0xeb, 0x7a, 0x7c, 0x3b, 0x41, 0xb8, 0xae,
584                             0x16, 0x56, 0xe3, 0xfa, 0xf1, 0x9f, 0xc4, 0x6a,
585                             0xda, 0x09, 0x8d, 0xeb, 0x9c, 0x32, 0xb1, 0xfd,
586                             0x86, 0x62, 0x05, 0x16, 0x5f, 0x49, 0xb8, 0x80 },
587                 .result = { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
588                             0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
589                             0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
590                             0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 },
591                 .valid = false
592         },
593         /* wycheproof - public key with low order */
594         {
595                 .private = { 0x50, 0x2a, 0x31, 0x37, 0x3d, 0xb3, 0x24, 0x46,
596                              0x84, 0x2f, 0xe5, 0xad, 0xd3, 0xe0, 0x24, 0x02,
597                              0x2e, 0xa5, 0x4f, 0x27, 0x41, 0x82, 0xaf, 0xc3,
598                              0xd9, 0xf1, 0xbb, 0x3d, 0x39, 0x53, 0x4e, 0xb5 },
599                 .public = { 0x5f, 0x9c, 0x95, 0xbc, 0xa3, 0x50, 0x8c, 0x24,
600                             0xb1, 0xd0, 0xb1, 0x55, 0x9c, 0x83, 0xef, 0x5b,
601                             0x04, 0x44, 0x5c, 0xc4, 0x58, 0x1c, 0x8e, 0x86,
602                             0xd8, 0x22, 0x4e, 0xdd, 0xd0, 0x9f, 0x11, 0xd7 },
603                 .result = { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
604                             0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
605                             0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
606                             0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 },
607                 .valid = false
608         },
609         /* wycheproof - public key with low order */
610         {
611                 .private = { 0x90, 0xfa, 0x64, 0x17, 0xb0, 0xe3, 0x70, 0x30,
612                              0xfd, 0x6e, 0x43, 0xef, 0xf2, 0xab, 0xae, 0xf1,
613                              0x4c, 0x67, 0x93, 0x11, 0x7a, 0x03, 0x9c, 0xf6,
614                              0x21, 0x31, 0x8b, 0xa9, 0x0f, 0x4e, 0x98, 0xbe },
615                 .public = { 0xec, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
616                             0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
617                             0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
618                             0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff },
619                 .result = { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
620                             0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
621                             0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
622                             0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 },
623                 .valid = false
624         },
625         /* wycheproof - public key with low order */
626         {
627                 .private = { 0x78, 0xad, 0x3f, 0x26, 0x02, 0x7f, 0x1c, 0x9f,
628                              0xdd, 0x97, 0x5a, 0x16, 0x13, 0xb9, 0x47, 0x77,
629                              0x9b, 0xad, 0x2c, 0xf2, 0xb7, 0x41, 0xad, 0xe0,
630                              0x18, 0x40, 0x88, 0x5a, 0x30, 0xbb, 0x97, 0x9c },
631                 .public = { 0xed, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
632                             0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
633                             0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
634                             0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff },
635                 .result = { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
636                             0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
637                             0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
638                             0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 },
639                 .valid = false
640         },
641         /* wycheproof - public key with low order */
642         {
643                 .private = { 0x98, 0xe2, 0x3d, 0xe7, 0xb1, 0xe0, 0x92, 0x6e,
644                              0xd9, 0xc8, 0x7e, 0x7b, 0x14, 0xba, 0xf5, 0x5f,
645                              0x49, 0x7a, 0x1d, 0x70, 0x96, 0xf9, 0x39, 0x77,
646                              0x68, 0x0e, 0x44, 0xdc, 0x1c, 0x7b, 0x7b, 0x8b },
647                 .public = { 0xee, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
648                             0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
649                             0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
650                             0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff },
651                 .result = { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
652                             0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
653                             0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
654                             0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 },
655                 .valid = false
656         },
657         /* wycheproof - public key >= p */
658         {
659                 .private = { 0xf0, 0x1e, 0x48, 0xda, 0xfa, 0xc9, 0xd7, 0xbc,
660                              0xf5, 0x89, 0xcb, 0xc3, 0x82, 0xc8, 0x78, 0xd1,
661                              0x8b, 0xda, 0x35, 0x50, 0x58, 0x9f, 0xfb, 0x5d,
662                              0x50, 0xb5, 0x23, 0xbe, 0xbe, 0x32, 0x9d, 0xae },
663                 .public = { 0xef, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
664                             0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
665                             0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
666                             0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x7f },
667                 .result = { 0xbd, 0x36, 0xa0, 0x79, 0x0e, 0xb8, 0x83, 0x09,
668                             0x8c, 0x98, 0x8b, 0x21, 0x78, 0x67, 0x73, 0xde,
669                             0x0b, 0x3a, 0x4d, 0xf1, 0x62, 0x28, 0x2c, 0xf1,
670                             0x10, 0xde, 0x18, 0xdd, 0x48, 0x4c, 0xe7, 0x4b },
671                 .valid = true
672         },
673         /* wycheproof - public key >= p */
674         {
675                 .private = { 0x28, 0x87, 0x96, 0xbc, 0x5a, 0xff, 0x4b, 0x81,
676                              0xa3, 0x75, 0x01, 0x75, 0x7b, 0xc0, 0x75, 0x3a,
677                              0x3c, 0x21, 0x96, 0x47, 0x90, 0xd3, 0x86, 0x99,
678                              0x30, 0x8d, 0xeb, 0xc1, 0x7a, 0x6e, 0xaf, 0x8d },
679                 .public = { 0xf0, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
680                             0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
681                             0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
682                             0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x7f },
683                 .result = { 0xb4, 0xe0, 0xdd, 0x76, 0xda, 0x7b, 0x07, 0x17,
684                             0x28, 0xb6, 0x1f, 0x85, 0x67, 0x71, 0xaa, 0x35,
685                             0x6e, 0x57, 0xed, 0xa7, 0x8a, 0x5b, 0x16, 0x55,
686                             0xcc, 0x38, 0x20, 0xfb, 0x5f, 0x85, 0x4c, 0x5c },
687                 .valid = true
688         },
689         /* wycheproof - public key >= p */
690         {
691                 .private = { 0x98, 0xdf, 0x84, 0x5f, 0x66, 0x51, 0xbf, 0x11,
692                              0x38, 0x22, 0x1f, 0x11, 0x90, 0x41, 0xf7, 0x2b,
693                              0x6d, 0xbc, 0x3c, 0x4a, 0xce, 0x71, 0x43, 0xd9,
694                              0x9f, 0xd5, 0x5a, 0xd8, 0x67, 0x48, 0x0d, 0xa8 },
695                 .public = { 0xf1, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
696                             0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
697                             0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
698                             0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x7f },
699                 .result = { 0x6f, 0xdf, 0x6c, 0x37, 0x61, 0x1d, 0xbd, 0x53,
700                             0x04, 0xdc, 0x0f, 0x2e, 0xb7, 0xc9, 0x51, 0x7e,
701                             0xb3, 0xc5, 0x0e, 0x12, 0xfd, 0x05, 0x0a, 0xc6,
702                             0xde, 0xc2, 0x70, 0x71, 0xd4, 0xbf, 0xc0, 0x34 },
703                 .valid = true
704         },
705         /* wycheproof - public key >= p */
706         {
707                 .private = { 0xf0, 0x94, 0x98, 0xe4, 0x6f, 0x02, 0xf8, 0x78,
708                              0x82, 0x9e, 0x78, 0xb8, 0x03, 0xd3, 0x16, 0xa2,
709                              0xed, 0x69, 0x5d, 0x04, 0x98, 0xa0, 0x8a, 0xbd,
710                              0xf8, 0x27, 0x69, 0x30, 0xe2, 0x4e, 0xdc, 0xb0 },
711                 .public = { 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
712                             0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
713                             0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
714                             0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x7f },
715                 .result = { 0x4c, 0x8f, 0xc4, 0xb1, 0xc6, 0xab, 0x88, 0xfb,
716                             0x21, 0xf1, 0x8f, 0x6d, 0x4c, 0x81, 0x02, 0x40,
717                             0xd4, 0xe9, 0x46, 0x51, 0xba, 0x44, 0xf7, 0xa2,
718                             0xc8, 0x63, 0xce, 0xc7, 0xdc, 0x56, 0x60, 0x2d },
719                 .valid = true
720         },
721         /* wycheproof - public key >= p */
722         {
723                 .private = { 0x18, 0x13, 0xc1, 0x0a, 0x5c, 0x7f, 0x21, 0xf9,
724                              0x6e, 0x17, 0xf2, 0x88, 0xc0, 0xcc, 0x37, 0x60,
725                              0x7c, 0x04, 0xc5, 0xf5, 0xae, 0xa2, 0xdb, 0x13,
726                              0x4f, 0x9e, 0x2f, 0xfc, 0x66, 0xbd, 0x9d, 0xb8 },
727                 .public = { 0x02, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
728                             0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
729                             0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
730                             0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x80 },
731                 .result = { 0x1c, 0xd0, 0xb2, 0x82, 0x67, 0xdc, 0x54, 0x1c,
732                             0x64, 0x2d, 0x6d, 0x7d, 0xca, 0x44, 0xa8, 0xb3,
733                             0x8a, 0x63, 0x73, 0x6e, 0xef, 0x5c, 0x4e, 0x65,
734                             0x01, 0xff, 0xbb, 0xb1, 0x78, 0x0c, 0x03, 0x3c },
735                 .valid = true
736         },
737         /* wycheproof - public key >= p */
738         {
739                 .private = { 0x78, 0x57, 0xfb, 0x80, 0x86, 0x53, 0x64, 0x5a,
740                              0x0b, 0xeb, 0x13, 0x8a, 0x64, 0xf5, 0xf4, 0xd7,
741                              0x33, 0xa4, 0x5e, 0xa8, 0x4c, 0x3c, 0xda, 0x11,
742                              0xa9, 0xc0, 0x6f, 0x7e, 0x71, 0x39, 0x14, 0x9e },
743                 .public = { 0x03, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
744                             0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
745                             0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
746                             0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x80 },
747                 .result = { 0x87, 0x55, 0xbe, 0x01, 0xc6, 0x0a, 0x7e, 0x82,
748                             0x5c, 0xff, 0x3e, 0x0e, 0x78, 0xcb, 0x3a, 0xa4,
749                             0x33, 0x38, 0x61, 0x51, 0x6a, 0xa5, 0x9b, 0x1c,
750                             0x51, 0xa8, 0xb2, 0xa5, 0x43, 0xdf, 0xa8, 0x22 },
751                 .valid = true
752         },
753         /* wycheproof - public key >= p */
754         {
755                 .private = { 0xe0, 0x3a, 0xa8, 0x42, 0xe2, 0xab, 0xc5, 0x6e,
756                              0x81, 0xe8, 0x7b, 0x8b, 0x9f, 0x41, 0x7b, 0x2a,
757                              0x1e, 0x59, 0x13, 0xc7, 0x23, 0xee, 0xd2, 0x8d,
758                              0x75, 0x2f, 0x8d, 0x47, 0xa5, 0x9f, 0x49, 0x8f },
759                 .public = { 0x04, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
760                             0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
761                             0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
762                             0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x80 },
763                 .result = { 0x54, 0xc9, 0xa1, 0xed, 0x95, 0xe5, 0x46, 0xd2,
764                             0x78, 0x22, 0xa3, 0x60, 0x93, 0x1d, 0xda, 0x60,
765                             0xa1, 0xdf, 0x04, 0x9d, 0xa6, 0xf9, 0x04, 0x25,
766                             0x3c, 0x06, 0x12, 0xbb, 0xdc, 0x08, 0x74, 0x76 },
767                 .valid = true
768         },
769         /* wycheproof - public key >= p */
770         {
771                 .private = { 0xf8, 0xf7, 0x07, 0xb7, 0x99, 0x9b, 0x18, 0xcb,
772                              0x0d, 0x6b, 0x96, 0x12, 0x4f, 0x20, 0x45, 0x97,
773                              0x2c, 0xa2, 0x74, 0xbf, 0xc1, 0x54, 0xad, 0x0c,
774                              0x87, 0x03, 0x8c, 0x24, 0xc6, 0xd0, 0xd4, 0xb2 },
775                 .public = { 0xda, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
776                             0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
777                             0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
778                             0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff },
779                 .result = { 0xcc, 0x1f, 0x40, 0xd7, 0x43, 0xcd, 0xc2, 0x23,
780                             0x0e, 0x10, 0x43, 0xda, 0xba, 0x8b, 0x75, 0xe8,
781                             0x10, 0xf1, 0xfb, 0xab, 0x7f, 0x25, 0x52, 0x69,
782                             0xbd, 0x9e, 0xbb, 0x29, 0xe6, 0xbf, 0x49, 0x4f },
783                 .valid = true
784         },
785         /* wycheproof - public key >= p */
786         {
787                 .private = { 0xa0, 0x34, 0xf6, 0x84, 0xfa, 0x63, 0x1e, 0x1a,
788                              0x34, 0x81, 0x18, 0xc1, 0xce, 0x4c, 0x98, 0x23,
789                              0x1f, 0x2d, 0x9e, 0xec, 0x9b, 0xa5, 0x36, 0x5b,
790                              0x4a, 0x05, 0xd6, 0x9a, 0x78, 0x5b, 0x07, 0x96 },
791                 .public = { 0xdb, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
792                             0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
793                             0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
794                             0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff },
795                 .result = { 0x54, 0x99, 0x8e, 0xe4, 0x3a, 0x5b, 0x00, 0x7b,
796                             0xf4, 0x99, 0xf0, 0x78, 0xe7, 0x36, 0x52, 0x44,
797                             0x00, 0xa8, 0xb5, 0xc7, 0xe9, 0xb9, 0xb4, 0x37,
798                             0x71, 0x74, 0x8c, 0x7c, 0xdf, 0x88, 0x04, 0x12 },
799                 .valid = true
800         },
801         /* wycheproof - public key >= p */
802         {
803                 .private = { 0x30, 0xb6, 0xc6, 0xa0, 0xf2, 0xff, 0xa6, 0x80,
804                              0x76, 0x8f, 0x99, 0x2b, 0xa8, 0x9e, 0x15, 0x2d,
805                              0x5b, 0xc9, 0x89, 0x3d, 0x38, 0xc9, 0x11, 0x9b,
806                              0xe4, 0xf7, 0x67, 0xbf, 0xab, 0x6e, 0x0c, 0xa5 },
807                 .public = { 0xdc, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
808                             0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
809                             0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
810                             0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff },
811                 .result = { 0xea, 0xd9, 0xb3, 0x8e, 0xfd, 0xd7, 0x23, 0x63,
812                             0x79, 0x34, 0xe5, 0x5a, 0xb7, 0x17, 0xa7, 0xae,
813                             0x09, 0xeb, 0x86, 0xa2, 0x1d, 0xc3, 0x6a, 0x3f,
814                             0xee, 0xb8, 0x8b, 0x75, 0x9e, 0x39, 0x1e, 0x09 },
815                 .valid = true
816         },
817         /* wycheproof - public key >= p */
818         {
819                 .private = { 0x90, 0x1b, 0x9d, 0xcf, 0x88, 0x1e, 0x01, 0xe0,
820                              0x27, 0x57, 0x50, 0x35, 0xd4, 0x0b, 0x43, 0xbd,
821                              0xc1, 0xc5, 0x24, 0x2e, 0x03, 0x08, 0x47, 0x49,
822                              0x5b, 0x0c, 0x72, 0x86, 0x46, 0x9b, 0x65, 0x91 },
823                 .public = { 0xea, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
824                             0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
825                             0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
826                             0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff },
827                 .result = { 0x60, 0x2f, 0xf4, 0x07, 0x89, 0xb5, 0x4b, 0x41,
828                             0x80, 0x59, 0x15, 0xfe, 0x2a, 0x62, 0x21, 0xf0,
829                             0x7a, 0x50, 0xff, 0xc2, 0xc3, 0xfc, 0x94, 0xcf,
830                             0x61, 0xf1, 0x3d, 0x79, 0x04, 0xe8, 0x8e, 0x0e },
831                 .valid = true
832         },
833         /* wycheproof - public key >= p */
834         {
835                 .private = { 0x80, 0x46, 0x67, 0x7c, 0x28, 0xfd, 0x82, 0xc9,
836                              0xa1, 0xbd, 0xb7, 0x1a, 0x1a, 0x1a, 0x34, 0xfa,
837                              0xba, 0x12, 0x25, 0xe2, 0x50, 0x7f, 0xe3, 0xf5,
838                              0x4d, 0x10, 0xbd, 0x5b, 0x0d, 0x86, 0x5f, 0x8e },
839                 .public = { 0xeb, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
840                             0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
841                             0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
842                             0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff },
843                 .result = { 0xe0, 0x0a, 0xe8, 0xb1, 0x43, 0x47, 0x12, 0x47,
844                             0xba, 0x24, 0xf1, 0x2c, 0x88, 0x55, 0x36, 0xc3,
845                             0xcb, 0x98, 0x1b, 0x58, 0xe1, 0xe5, 0x6b, 0x2b,
846                             0xaf, 0x35, 0xc1, 0x2a, 0xe1, 0xf7, 0x9c, 0x26 },
847                 .valid = true
848         },
849         /* wycheproof - public key >= p */
850         {
851                 .private = { 0x60, 0x2f, 0x7e, 0x2f, 0x68, 0xa8, 0x46, 0xb8,
852                              0x2c, 0xc2, 0x69, 0xb1, 0xd4, 0x8e, 0x93, 0x98,
853                              0x86, 0xae, 0x54, 0xfd, 0x63, 0x6c, 0x1f, 0xe0,
854                              0x74, 0xd7, 0x10, 0x12, 0x7d, 0x47, 0x24, 0x91 },
855                 .public = { 0xef, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
856                             0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
857                             0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
858                             0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff },
859                 .result = { 0x98, 0xcb, 0x9b, 0x50, 0xdd, 0x3f, 0xc2, 0xb0,
860                             0xd4, 0xf2, 0xd2, 0xbf, 0x7c, 0x5c, 0xfd, 0xd1,
861                             0x0c, 0x8f, 0xcd, 0x31, 0xfc, 0x40, 0xaf, 0x1a,
862                             0xd4, 0x4f, 0x47, 0xc1, 0x31, 0x37, 0x63, 0x62 },
863                 .valid = true
864         },
865         /* wycheproof - public key >= p */
866         {
867                 .private = { 0x60, 0x88, 0x7b, 0x3d, 0xc7, 0x24, 0x43, 0x02,
868                              0x6e, 0xbe, 0xdb, 0xbb, 0xb7, 0x06, 0x65, 0xf4,
869                              0x2b, 0x87, 0xad, 0xd1, 0x44, 0x0e, 0x77, 0x68,
870                              0xfb, 0xd7, 0xe8, 0xe2, 0xce, 0x5f, 0x63, 0x9d },
871                 .public = { 0xf0, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
872                             0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
873                             0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
874                             0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff },
875                 .result = { 0x38, 0xd6, 0x30, 0x4c, 0x4a, 0x7e, 0x6d, 0x9f,
876                             0x79, 0x59, 0x33, 0x4f, 0xb5, 0x24, 0x5b, 0xd2,
877                             0xc7, 0x54, 0x52, 0x5d, 0x4c, 0x91, 0xdb, 0x95,
878                             0x02, 0x06, 0x92, 0x62, 0x34, 0xc1, 0xf6, 0x33 },
879                 .valid = true
880         },
881         /* wycheproof - public key >= p */
882         {
883                 .private = { 0x78, 0xd3, 0x1d, 0xfa, 0x85, 0x44, 0x97, 0xd7,
884                              0x2d, 0x8d, 0xef, 0x8a, 0x1b, 0x7f, 0xb0, 0x06,
885                              0xce, 0xc2, 0xd8, 0xc4, 0x92, 0x46, 0x47, 0xc9,
886                              0x38, 0x14, 0xae, 0x56, 0xfa, 0xed, 0xa4, 0x95 },
887                 .public = { 0xf1, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
888                             0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
889                             0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
890                             0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff },
891                 .result = { 0x78, 0x6c, 0xd5, 0x49, 0x96, 0xf0, 0x14, 0xa5,
892                             0xa0, 0x31, 0xec, 0x14, 0xdb, 0x81, 0x2e, 0xd0,
893                             0x83, 0x55, 0x06, 0x1f, 0xdb, 0x5d, 0xe6, 0x80,
894                             0xa8, 0x00, 0xac, 0x52, 0x1f, 0x31, 0x8e, 0x23 },
895                 .valid = true
896         },
897         /* wycheproof - public key >= p */
898         {
899                 .private = { 0xc0, 0x4c, 0x5b, 0xae, 0xfa, 0x83, 0x02, 0xdd,
900                              0xde, 0xd6, 0xa4, 0xbb, 0x95, 0x77, 0x61, 0xb4,
901                              0xeb, 0x97, 0xae, 0xfa, 0x4f, 0xc3, 0xb8, 0x04,
902                              0x30, 0x85, 0xf9, 0x6a, 0x56, 0x59, 0xb3, 0xa5 },
903                 .public = { 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
904                             0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
905                             0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
906                             0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff },
907                 .result = { 0x29, 0xae, 0x8b, 0xc7, 0x3e, 0x9b, 0x10, 0xa0,
908                             0x8b, 0x4f, 0x68, 0x1c, 0x43, 0xc3, 0xe0, 0xac,
909                             0x1a, 0x17, 0x1d, 0x31, 0xb3, 0x8f, 0x1a, 0x48,
910                             0xef, 0xba, 0x29, 0xae, 0x63, 0x9e, 0xa1, 0x34 },
911                 .valid = true
912         },
913         /* wycheproof - RFC 7748 */
914         {
915                 .private = { 0xa0, 0x46, 0xe3, 0x6b, 0xf0, 0x52, 0x7c, 0x9d,
916                              0x3b, 0x16, 0x15, 0x4b, 0x82, 0x46, 0x5e, 0xdd,
917                              0x62, 0x14, 0x4c, 0x0a, 0xc1, 0xfc, 0x5a, 0x18,
918                              0x50, 0x6a, 0x22, 0x44, 0xba, 0x44, 0x9a, 0x44 },
919                 .public = { 0xe6, 0xdb, 0x68, 0x67, 0x58, 0x30, 0x30, 0xdb,
920                             0x35, 0x94, 0xc1, 0xa4, 0x24, 0xb1, 0x5f, 0x7c,
921                             0x72, 0x66, 0x24, 0xec, 0x26, 0xb3, 0x35, 0x3b,
922                             0x10, 0xa9, 0x03, 0xa6, 0xd0, 0xab, 0x1c, 0x4c },
923                 .result = { 0xc3, 0xda, 0x55, 0x37, 0x9d, 0xe9, 0xc6, 0x90,
924                             0x8e, 0x94, 0xea, 0x4d, 0xf2, 0x8d, 0x08, 0x4f,
925                             0x32, 0xec, 0xcf, 0x03, 0x49, 0x1c, 0x71, 0xf7,
926                             0x54, 0xb4, 0x07, 0x55, 0x77, 0xa2, 0x85, 0x52 },
927                 .valid = true
928         },
929         /* wycheproof - RFC 7748 */
930         {
931                 .private = { 0x48, 0x66, 0xe9, 0xd4, 0xd1, 0xb4, 0x67, 0x3c,
932                              0x5a, 0xd2, 0x26, 0x91, 0x95, 0x7d, 0x6a, 0xf5,
933                              0xc1, 0x1b, 0x64, 0x21, 0xe0, 0xea, 0x01, 0xd4,
934                              0x2c, 0xa4, 0x16, 0x9e, 0x79, 0x18, 0xba, 0x4d },
935                 .public = { 0xe5, 0x21, 0x0f, 0x12, 0x78, 0x68, 0x11, 0xd3,
936                             0xf4, 0xb7, 0x95, 0x9d, 0x05, 0x38, 0xae, 0x2c,
937                             0x31, 0xdb, 0xe7, 0x10, 0x6f, 0xc0, 0x3c, 0x3e,
938                             0xfc, 0x4c, 0xd5, 0x49, 0xc7, 0x15, 0xa4, 0x13 },
939                 .result = { 0x95, 0xcb, 0xde, 0x94, 0x76, 0xe8, 0x90, 0x7d,
940                             0x7a, 0xad, 0xe4, 0x5c, 0xb4, 0xb8, 0x73, 0xf8,
941                             0x8b, 0x59, 0x5a, 0x68, 0x79, 0x9f, 0xa1, 0x52,
942                             0xe6, 0xf8, 0xf7, 0x64, 0x7a, 0xac, 0x79, 0x57 },
943                 .valid = true
944         },
945         /* wycheproof - edge case for shared secret */
946         {
947                 .private = { 0xa0, 0xa4, 0xf1, 0x30, 0xb9, 0x8a, 0x5b, 0xe4,
948                              0xb1, 0xce, 0xdb, 0x7c, 0xb8, 0x55, 0x84, 0xa3,
949                              0x52, 0x0e, 0x14, 0x2d, 0x47, 0x4d, 0xc9, 0xcc,
950                              0xb9, 0x09, 0xa0, 0x73, 0xa9, 0x76, 0xbf, 0x63 },
951                 .public = { 0x0a, 0xb4, 0xe7, 0x63, 0x80, 0xd8, 0x4d, 0xde,
952                             0x4f, 0x68, 0x33, 0xc5, 0x8f, 0x2a, 0x9f, 0xb8,
953                             0xf8, 0x3b, 0xb0, 0x16, 0x9b, 0x17, 0x2b, 0xe4,
954                             0xb6, 0xe0, 0x59, 0x28, 0x87, 0x74, 0x1a, 0x36 },
955                 .result = { 0x02, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
956                             0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
957                             0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
958                             0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 },
959                 .valid = true
960         },
961         /* wycheproof - edge case for shared secret */
962         {
963                 .private = { 0xa0, 0xa4, 0xf1, 0x30, 0xb9, 0x8a, 0x5b, 0xe4,
964                              0xb1, 0xce, 0xdb, 0x7c, 0xb8, 0x55, 0x84, 0xa3,
965                              0x52, 0x0e, 0x14, 0x2d, 0x47, 0x4d, 0xc9, 0xcc,
966                              0xb9, 0x09, 0xa0, 0x73, 0xa9, 0x76, 0xbf, 0x63 },
967                 .public = { 0x89, 0xe1, 0x0d, 0x57, 0x01, 0xb4, 0x33, 0x7d,
968                             0x2d, 0x03, 0x21, 0x81, 0x53, 0x8b, 0x10, 0x64,
969                             0xbd, 0x40, 0x84, 0x40, 0x1c, 0xec, 0xa1, 0xfd,
970                             0x12, 0x66, 0x3a, 0x19, 0x59, 0x38, 0x80, 0x00 },
971                 .result = { 0x09, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
972                             0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
973                             0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
974                             0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 },
975                 .valid = true
976         },
977         /* wycheproof - edge case for shared secret */
978         {
979                 .private = { 0xa0, 0xa4, 0xf1, 0x30, 0xb9, 0x8a, 0x5b, 0xe4,
980                              0xb1, 0xce, 0xdb, 0x7c, 0xb8, 0x55, 0x84, 0xa3,
981                              0x52, 0x0e, 0x14, 0x2d, 0x47, 0x4d, 0xc9, 0xcc,
982                              0xb9, 0x09, 0xa0, 0x73, 0xa9, 0x76, 0xbf, 0x63 },
983                 .public = { 0x2b, 0x55, 0xd3, 0xaa, 0x4a, 0x8f, 0x80, 0xc8,
984                             0xc0, 0xb2, 0xae, 0x5f, 0x93, 0x3e, 0x85, 0xaf,
985                             0x49, 0xbe, 0xac, 0x36, 0xc2, 0xfa, 0x73, 0x94,
986                             0xba, 0xb7, 0x6c, 0x89, 0x33, 0xf8, 0xf8, 0x1d },
987                 .result = { 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
988                             0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
989                             0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
990                             0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 },
991                 .valid = true
992         },
993         /* wycheproof - edge case for shared secret */
994         {
995                 .private = { 0xa0, 0xa4, 0xf1, 0x30, 0xb9, 0x8a, 0x5b, 0xe4,
996                              0xb1, 0xce, 0xdb, 0x7c, 0xb8, 0x55, 0x84, 0xa3,
997                              0x52, 0x0e, 0x14, 0x2d, 0x47, 0x4d, 0xc9, 0xcc,
998                              0xb9, 0x09, 0xa0, 0x73, 0xa9, 0x76, 0xbf, 0x63 },
999                 .public = { 0x63, 0xe5, 0xb1, 0xfe, 0x96, 0x01, 0xfe, 0x84,
1000                             0x38, 0x5d, 0x88, 0x66, 0xb0, 0x42, 0x12, 0x62,
1001                             0xf7, 0x8f, 0xbf, 0xa5, 0xaf, 0xf9, 0x58, 0x5e,
1002                             0x62, 0x66, 0x79, 0xb1, 0x85, 0x47, 0xd9, 0x59 },
1003                 .result = { 0xfe, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
1004                             0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
1005                             0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
1006                             0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x3f },
1007                 .valid = true
1008         },
1009         /* wycheproof - edge case for shared secret */
1010         {
1011                 .private = { 0xa0, 0xa4, 0xf1, 0x30, 0xb9, 0x8a, 0x5b, 0xe4,
1012                              0xb1, 0xce, 0xdb, 0x7c, 0xb8, 0x55, 0x84, 0xa3,
1013                              0x52, 0x0e, 0x14, 0x2d, 0x47, 0x4d, 0xc9, 0xcc,
1014                              0xb9, 0x09, 0xa0, 0x73, 0xa9, 0x76, 0xbf, 0x63 },
1015                 .public = { 0xe4, 0x28, 0xf3, 0xda, 0xc1, 0x78, 0x09, 0xf8,
1016                             0x27, 0xa5, 0x22, 0xce, 0x32, 0x35, 0x50, 0x58,
1017                             0xd0, 0x73, 0x69, 0x36, 0x4a, 0xa7, 0x89, 0x02,
1018                             0xee, 0x10, 0x13, 0x9b, 0x9f, 0x9d, 0xd6, 0x53 },
1019                 .result = { 0xfc, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
1020                             0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
1021                             0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
1022                             0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x3f },
1023                 .valid = true
1024         },
1025         /* wycheproof - edge case for shared secret */
1026         {
1027                 .private = { 0xa0, 0xa4, 0xf1, 0x30, 0xb9, 0x8a, 0x5b, 0xe4,
1028                              0xb1, 0xce, 0xdb, 0x7c, 0xb8, 0x55, 0x84, 0xa3,
1029                              0x52, 0x0e, 0x14, 0x2d, 0x47, 0x4d, 0xc9, 0xcc,
1030                              0xb9, 0x09, 0xa0, 0x73, 0xa9, 0x76, 0xbf, 0x63 },
1031                 .public = { 0xb3, 0xb5, 0x0e, 0x3e, 0xd3, 0xa4, 0x07, 0xb9,
1032                             0x5d, 0xe9, 0x42, 0xef, 0x74, 0x57, 0x5b, 0x5a,
1033                             0xb8, 0xa1, 0x0c, 0x09, 0xee, 0x10, 0x35, 0x44,
1034                             0xd6, 0x0b, 0xdf, 0xed, 0x81, 0x38, 0xab, 0x2b },
1035                 .result = { 0xf9, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
1036                             0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
1037                             0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
1038                             0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x3f },
1039                 .valid = true
1040         },
1041         /* wycheproof - edge case for shared secret */
1042         {
1043                 .private = { 0xa0, 0xa4, 0xf1, 0x30, 0xb9, 0x8a, 0x5b, 0xe4,
1044                              0xb1, 0xce, 0xdb, 0x7c, 0xb8, 0x55, 0x84, 0xa3,
1045                              0x52, 0x0e, 0x14, 0x2d, 0x47, 0x4d, 0xc9, 0xcc,
1046                              0xb9, 0x09, 0xa0, 0x73, 0xa9, 0x76, 0xbf, 0x63 },
1047                 .public = { 0x21, 0x3f, 0xff, 0xe9, 0x3d, 0x5e, 0xa8, 0xcd,
1048                             0x24, 0x2e, 0x46, 0x28, 0x44, 0x02, 0x99, 0x22,
1049                             0xc4, 0x3c, 0x77, 0xc9, 0xe3, 0xe4, 0x2f, 0x56,
1050                             0x2f, 0x48, 0x5d, 0x24, 0xc5, 0x01, 0xa2, 0x0b },
1051                 .result = { 0xf3, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
1052                             0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
1053                             0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
1054                             0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x3f },
1055                 .valid = true
1056         },
1057         /* wycheproof - edge case for shared secret */
1058         {
1059                 .private = { 0xa0, 0xa4, 0xf1, 0x30, 0xb9, 0x8a, 0x5b, 0xe4,
1060                              0xb1, 0xce, 0xdb, 0x7c, 0xb8, 0x55, 0x84, 0xa3,
1061                              0x52, 0x0e, 0x14, 0x2d, 0x47, 0x4d, 0xc9, 0xcc,
1062                              0xb9, 0x09, 0xa0, 0x73, 0xa9, 0x76, 0xbf, 0x63 },
1063                 .public = { 0x91, 0xb2, 0x32, 0xa1, 0x78, 0xb3, 0xcd, 0x53,
1064                             0x09, 0x32, 0x44, 0x1e, 0x61, 0x39, 0x41, 0x8f,
1065                             0x72, 0x17, 0x22, 0x92, 0xf1, 0xda, 0x4c, 0x18,
1066                             0x34, 0xfc, 0x5e, 0xbf, 0xef, 0xb5, 0x1e, 0x3f },
1067                 .result = { 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
1068                             0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
1069                             0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
1070                             0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x03 },
1071                 .valid = true
1072         },
1073         /* wycheproof - edge case for shared secret */
1074         {
1075                 .private = { 0xa0, 0xa4, 0xf1, 0x30, 0xb9, 0x8a, 0x5b, 0xe4,
1076                              0xb1, 0xce, 0xdb, 0x7c, 0xb8, 0x55, 0x84, 0xa3,
1077                              0x52, 0x0e, 0x14, 0x2d, 0x47, 0x4d, 0xc9, 0xcc,
1078                              0xb9, 0x09, 0xa0, 0x73, 0xa9, 0x76, 0xbf, 0x63 },
1079                 .public = { 0x04, 0x5c, 0x6e, 0x11, 0xc5, 0xd3, 0x32, 0x55,
1080                             0x6c, 0x78, 0x22, 0xfe, 0x94, 0xeb, 0xf8, 0x9b,
1081                             0x56, 0xa3, 0x87, 0x8d, 0xc2, 0x7c, 0xa0, 0x79,
1082                             0x10, 0x30, 0x58, 0x84, 0x9f, 0xab, 0xcb, 0x4f },
1083                 .result = { 0xe5, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
1084                             0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
1085                             0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
1086                             0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x7f },
1087                 .valid = true
1088         },
1089         /* wycheproof - edge case for shared secret */
1090         {
1091                 .private = { 0xa0, 0xa4, 0xf1, 0x30, 0xb9, 0x8a, 0x5b, 0xe4,
1092                              0xb1, 0xce, 0xdb, 0x7c, 0xb8, 0x55, 0x84, 0xa3,
1093                              0x52, 0x0e, 0x14, 0x2d, 0x47, 0x4d, 0xc9, 0xcc,
1094                              0xb9, 0x09, 0xa0, 0x73, 0xa9, 0x76, 0xbf, 0x63 },
1095                 .public = { 0x1c, 0xa2, 0x19, 0x0b, 0x71, 0x16, 0x35, 0x39,
1096                             0x06, 0x3c, 0x35, 0x77, 0x3b, 0xda, 0x0c, 0x9c,
1097                             0x92, 0x8e, 0x91, 0x36, 0xf0, 0x62, 0x0a, 0xeb,
1098                             0x09, 0x3f, 0x09, 0x91, 0x97, 0xb7, 0xf7, 0x4e },
1099                 .result = { 0xe3, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
1100                             0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
1101                             0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
1102                             0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x7f },
1103                 .valid = true
1104         },
1105         /* wycheproof - edge case for shared secret */
1106         {
1107                 .private = { 0xa0, 0xa4, 0xf1, 0x30, 0xb9, 0x8a, 0x5b, 0xe4,
1108                              0xb1, 0xce, 0xdb, 0x7c, 0xb8, 0x55, 0x84, 0xa3,
1109                              0x52, 0x0e, 0x14, 0x2d, 0x47, 0x4d, 0xc9, 0xcc,
1110                              0xb9, 0x09, 0xa0, 0x73, 0xa9, 0x76, 0xbf, 0x63 },
1111                 .public = { 0xf7, 0x6e, 0x90, 0x10, 0xac, 0x33, 0xc5, 0x04,
1112                             0x3b, 0x2d, 0x3b, 0x76, 0xa8, 0x42, 0x17, 0x10,
1113                             0x00, 0xc4, 0x91, 0x62, 0x22, 0xe9, 0xe8, 0x58,
1114                             0x97, 0xa0, 0xae, 0xc7, 0xf6, 0x35, 0x0b, 0x3c },
1115                 .result = { 0xdd, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
1116                             0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
1117                             0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
1118                             0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x7f },
1119                 .valid = true
1120         },
1121         /* wycheproof - edge case for shared secret */
1122         {
1123                 .private = { 0xa0, 0xa4, 0xf1, 0x30, 0xb9, 0x8a, 0x5b, 0xe4,
1124                              0xb1, 0xce, 0xdb, 0x7c, 0xb8, 0x55, 0x84, 0xa3,
1125                              0x52, 0x0e, 0x14, 0x2d, 0x47, 0x4d, 0xc9, 0xcc,
1126                              0xb9, 0x09, 0xa0, 0x73, 0xa9, 0x76, 0xbf, 0x63 },
1127                 .public = { 0xbb, 0x72, 0x68, 0x8d, 0x8f, 0x8a, 0xa7, 0xa3,
1128                             0x9c, 0xd6, 0x06, 0x0c, 0xd5, 0xc8, 0x09, 0x3c,
1129                             0xde, 0xc6, 0xfe, 0x34, 0x19, 0x37, 0xc3, 0x88,
1130                             0x6a, 0x99, 0x34, 0x6c, 0xd0, 0x7f, 0xaa, 0x55 },
1131                 .result = { 0xdb, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
1132                             0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
1133                             0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
1134                             0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x7f },
1135                 .valid = true
1136         },
1137         /* wycheproof - edge case for shared secret */
1138         {
1139                 .private = { 0xa0, 0xa4, 0xf1, 0x30, 0xb9, 0x8a, 0x5b, 0xe4,
1140                              0xb1, 0xce, 0xdb, 0x7c, 0xb8, 0x55, 0x84, 0xa3,
1141                              0x52, 0x0e, 0x14, 0x2d, 0x47, 0x4d, 0xc9, 0xcc,
1142                              0xb9, 0x09, 0xa0, 0x73, 0xa9, 0x76, 0xbf, 0x63 },
1143                 .public = { 0x88, 0xfd, 0xde, 0xa1, 0x93, 0x39, 0x1c, 0x6a,
1144                             0x59, 0x33, 0xef, 0x9b, 0x71, 0x90, 0x15, 0x49,
1145                             0x44, 0x72, 0x05, 0xaa, 0xe9, 0xda, 0x92, 0x8a,
1146                             0x6b, 0x91, 0xa3, 0x52, 0xba, 0x10, 0xf4, 0x1f },
1147                 .result = { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
1148                             0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
1149                             0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
1150                             0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02 },
1151                 .valid = true
1152         },
1153         /* wycheproof - edge case for shared secret */
1154         {
1155                 .private = { 0xa0, 0xa4, 0xf1, 0x30, 0xb9, 0x8a, 0x5b, 0xe4,
1156                              0xb1, 0xce, 0xdb, 0x7c, 0xb8, 0x55, 0x84, 0xa3,
1157                              0x52, 0x0e, 0x14, 0x2d, 0x47, 0x4d, 0xc9, 0xcc,
1158                              0xb9, 0x09, 0xa0, 0x73, 0xa9, 0x76, 0xbf, 0x63 },
1159                 .public = { 0x30, 0x3b, 0x39, 0x2f, 0x15, 0x31, 0x16, 0xca,
1160                             0xd9, 0xcc, 0x68, 0x2a, 0x00, 0xcc, 0xc4, 0x4c,
1161                             0x95, 0xff, 0x0d, 0x3b, 0xbe, 0x56, 0x8b, 0xeb,
1162                             0x6c, 0x4e, 0x73, 0x9b, 0xaf, 0xdc, 0x2c, 0x68 },
1163                 .result = { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
1164                             0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
1165                             0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
1166                             0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x80, 0x00 },
1167                 .valid = true
1168         },
1169         /* wycheproof - checking for overflow */
1170         {
1171                 .private = { 0xc8, 0x17, 0x24, 0x70, 0x40, 0x00, 0xb2, 0x6d,
1172                              0x31, 0x70, 0x3c, 0xc9, 0x7e, 0x3a, 0x37, 0x8d,
1173                              0x56, 0xfa, 0xd8, 0x21, 0x93, 0x61, 0xc8, 0x8c,
1174                              0xca, 0x8b, 0xd7, 0xc5, 0x71, 0x9b, 0x12, 0xb2 },
1175                 .public = { 0xfd, 0x30, 0x0a, 0xeb, 0x40, 0xe1, 0xfa, 0x58,
1176                             0x25, 0x18, 0x41, 0x2b, 0x49, 0xb2, 0x08, 0xa7,
1177                             0x84, 0x2b, 0x1e, 0x1f, 0x05, 0x6a, 0x04, 0x01,
1178                             0x78, 0xea, 0x41, 0x41, 0x53, 0x4f, 0x65, 0x2d },
1179                 .result = { 0xb7, 0x34, 0x10, 0x5d, 0xc2, 0x57, 0x58, 0x5d,
1180                             0x73, 0xb5, 0x66, 0xcc, 0xb7, 0x6f, 0x06, 0x27,
1181                             0x95, 0xcc, 0xbe, 0xc8, 0x91, 0x28, 0xe5, 0x2b,
1182                             0x02, 0xf3, 0xe5, 0x96, 0x39, 0xf1, 0x3c, 0x46 },
1183                 .valid = true
1184         },
1185         /* wycheproof - checking for overflow */
1186         {
1187                 .private = { 0xc8, 0x17, 0x24, 0x70, 0x40, 0x00, 0xb2, 0x6d,
1188                              0x31, 0x70, 0x3c, 0xc9, 0x7e, 0x3a, 0x37, 0x8d,
1189                              0x56, 0xfa, 0xd8, 0x21, 0x93, 0x61, 0xc8, 0x8c,
1190                              0xca, 0x8b, 0xd7, 0xc5, 0x71, 0x9b, 0x12, 0xb2 },
1191                 .public = { 0xc8, 0xef, 0x79, 0xb5, 0x14, 0xd7, 0x68, 0x26,
1192                             0x77, 0xbc, 0x79, 0x31, 0xe0, 0x6e, 0xe5, 0xc2,
1193                             0x7c, 0x9b, 0x39, 0x2b, 0x4a, 0xe9, 0x48, 0x44,
1194                             0x73, 0xf5, 0x54, 0xe6, 0x67, 0x8e, 0xcc, 0x2e },
1195                 .result = { 0x64, 0x7a, 0x46, 0xb6, 0xfc, 0x3f, 0x40, 0xd6,
1196                             0x21, 0x41, 0xee, 0x3c, 0xee, 0x70, 0x6b, 0x4d,
1197                             0x7a, 0x92, 0x71, 0x59, 0x3a, 0x7b, 0x14, 0x3e,
1198                             0x8e, 0x2e, 0x22, 0x79, 0x88, 0x3e, 0x45, 0x50 },
1199                 .valid = true
1200         },
1201         /* wycheproof - checking for overflow */
1202         {
1203                 .private = { 0xc8, 0x17, 0x24, 0x70, 0x40, 0x00, 0xb2, 0x6d,
1204                              0x31, 0x70, 0x3c, 0xc9, 0x7e, 0x3a, 0x37, 0x8d,
1205                              0x56, 0xfa, 0xd8, 0x21, 0x93, 0x61, 0xc8, 0x8c,
1206                              0xca, 0x8b, 0xd7, 0xc5, 0x71, 0x9b, 0x12, 0xb2 },
1207                 .public = { 0x64, 0xae, 0xac, 0x25, 0x04, 0x14, 0x48, 0x61,
1208                             0x53, 0x2b, 0x7b, 0xbc, 0xb6, 0xc8, 0x7d, 0x67,
1209                             0xdd, 0x4c, 0x1f, 0x07, 0xeb, 0xc2, 0xe0, 0x6e,
1210                             0xff, 0xb9, 0x5a, 0xec, 0xc6, 0x17, 0x0b, 0x2c },
1211                 .result = { 0x4f, 0xf0, 0x3d, 0x5f, 0xb4, 0x3c, 0xd8, 0x65,
1212                             0x7a, 0x3c, 0xf3, 0x7c, 0x13, 0x8c, 0xad, 0xce,
1213                             0xcc, 0xe5, 0x09, 0xe4, 0xeb, 0xa0, 0x89, 0xd0,
1214                             0xef, 0x40, 0xb4, 0xe4, 0xfb, 0x94, 0x61, 0x55 },
1215                 .valid = true
1216         },
1217         /* wycheproof - checking for overflow */
1218         {
1219                 .private = { 0xc8, 0x17, 0x24, 0x70, 0x40, 0x00, 0xb2, 0x6d,
1220                              0x31, 0x70, 0x3c, 0xc9, 0x7e, 0x3a, 0x37, 0x8d,
1221                              0x56, 0xfa, 0xd8, 0x21, 0x93, 0x61, 0xc8, 0x8c,
1222                              0xca, 0x8b, 0xd7, 0xc5, 0x71, 0x9b, 0x12, 0xb2 },
1223                 .public = { 0xbf, 0x68, 0xe3, 0x5e, 0x9b, 0xdb, 0x7e, 0xee,
1224                             0x1b, 0x50, 0x57, 0x02, 0x21, 0x86, 0x0f, 0x5d,
1225                             0xcd, 0xad, 0x8a, 0xcb, 0xab, 0x03, 0x1b, 0x14,
1226                             0x97, 0x4c, 0xc4, 0x90, 0x13, 0xc4, 0x98, 0x31 },
1227                 .result = { 0x21, 0xce, 0xe5, 0x2e, 0xfd, 0xbc, 0x81, 0x2e,
1228                             0x1d, 0x02, 0x1a, 0x4a, 0xf1, 0xe1, 0xd8, 0xbc,
1229                             0x4d, 0xb3, 0xc4, 0x00, 0xe4, 0xd2, 0xa2, 0xc5,
1230                             0x6a, 0x39, 0x26, 0xdb, 0x4d, 0x99, 0xc6, 0x5b },
1231                 .valid = true
1232         },
1233         /* wycheproof - checking for overflow */
1234         {
1235                 .private = { 0xc8, 0x17, 0x24, 0x70, 0x40, 0x00, 0xb2, 0x6d,
1236                              0x31, 0x70, 0x3c, 0xc9, 0x7e, 0x3a, 0x37, 0x8d,
1237                              0x56, 0xfa, 0xd8, 0x21, 0x93, 0x61, 0xc8, 0x8c,
1238                              0xca, 0x8b, 0xd7, 0xc5, 0x71, 0x9b, 0x12, 0xb2 },
1239                 .public = { 0x53, 0x47, 0xc4, 0x91, 0x33, 0x1a, 0x64, 0xb4,
1240                             0x3d, 0xdc, 0x68, 0x30, 0x34, 0xe6, 0x77, 0xf5,
1241                             0x3d, 0xc3, 0x2b, 0x52, 0xa5, 0x2a, 0x57, 0x7c,
1242                             0x15, 0xa8, 0x3b, 0xf2, 0x98, 0xe9, 0x9f, 0x19 },
1243                 .result = { 0x18, 0xcb, 0x89, 0xe4, 0xe2, 0x0c, 0x0c, 0x2b,
1244                             0xd3, 0x24, 0x30, 0x52, 0x45, 0x26, 0x6c, 0x93,
1245                             0x27, 0x69, 0x0b, 0xbe, 0x79, 0xac, 0xb8, 0x8f,
1246                             0x5b, 0x8f, 0xb3, 0xf7, 0x4e, 0xca, 0x3e, 0x52 },
1247                 .valid = true
1248         },
1249         /* wycheproof - private key == -1 (mod order) */
1250         {
1251                 .private = { 0xa0, 0x23, 0xcd, 0xd0, 0x83, 0xef, 0x5b, 0xb8,
1252                              0x2f, 0x10, 0xd6, 0x2e, 0x59, 0xe1, 0x5a, 0x68,
1253                              0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
1254                              0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x50 },
1255                 .public = { 0x25, 0x8e, 0x04, 0x52, 0x3b, 0x8d, 0x25, 0x3e,
1256                             0xe6, 0x57, 0x19, 0xfc, 0x69, 0x06, 0xc6, 0x57,
1257                             0x19, 0x2d, 0x80, 0x71, 0x7e, 0xdc, 0x82, 0x8f,
1258                             0xa0, 0xaf, 0x21, 0x68, 0x6e, 0x2f, 0xaa, 0x75 },
1259                 .result = { 0x25, 0x8e, 0x04, 0x52, 0x3b, 0x8d, 0x25, 0x3e,
1260                             0xe6, 0x57, 0x19, 0xfc, 0x69, 0x06, 0xc6, 0x57,
1261                             0x19, 0x2d, 0x80, 0x71, 0x7e, 0xdc, 0x82, 0x8f,
1262                             0xa0, 0xaf, 0x21, 0x68, 0x6e, 0x2f, 0xaa, 0x75 },
1263                 .valid = true
1264         },
1265         /* wycheproof - private key == 1 (mod order) on twist */
1266         {
1267                 .private = { 0x58, 0x08, 0x3d, 0xd2, 0x61, 0xad, 0x91, 0xef,
1268                              0xf9, 0x52, 0x32, 0x2e, 0xc8, 0x24, 0xc6, 0x82,
1269                              0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
1270                              0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x5f },
1271                 .public = { 0x2e, 0xae, 0x5e, 0xc3, 0xdd, 0x49, 0x4e, 0x9f,
1272                             0x2d, 0x37, 0xd2, 0x58, 0xf8, 0x73, 0xa8, 0xe6,
1273                             0xe9, 0xd0, 0xdb, 0xd1, 0xe3, 0x83, 0xef, 0x64,
1274                             0xd9, 0x8b, 0xb9, 0x1b, 0x3e, 0x0b, 0xe0, 0x35 },
1275                 .result = { 0x2e, 0xae, 0x5e, 0xc3, 0xdd, 0x49, 0x4e, 0x9f,
1276                             0x2d, 0x37, 0xd2, 0x58, 0xf8, 0x73, 0xa8, 0xe6,
1277                             0xe9, 0xd0, 0xdb, 0xd1, 0xe3, 0x83, 0xef, 0x64,
1278                             0xd9, 0x8b, 0xb9, 0x1b, 0x3e, 0x0b, 0xe0, 0x35 },
1279                 .valid = true
1280         }
1281 };
1282
1283 bool __init curve25519_selftest(void)
1284 {
1285         bool success = true, ret, ret2;
1286         size_t i = 0, j;
1287         u8 in[CURVE25519_KEY_SIZE];
1288         u8 out[CURVE25519_KEY_SIZE], out2[CURVE25519_KEY_SIZE],
1289            out3[CURVE25519_KEY_SIZE];
1290
1291         for (i = 0; i < ARRAY_SIZE(curve25519_test_vectors); ++i) {
1292                 memset(out, 0, CURVE25519_KEY_SIZE);
1293                 ret = curve25519(out, curve25519_test_vectors[i].private,
1294                                  curve25519_test_vectors[i].public);
1295                 if (ret != curve25519_test_vectors[i].valid ||
1296                     memcmp(out, curve25519_test_vectors[i].result,
1297                            CURVE25519_KEY_SIZE)) {
1298                         pr_err("curve25519 self-test %zu: FAIL\n", i + 1);
1299                         success = false;
1300                 }
1301         }
1302
1303         for (i = 0; i < 5; ++i) {
1304                 get_random_bytes(in, sizeof(in));
1305                 ret = curve25519_generate_public(out, in);
1306                 ret2 = curve25519(out2, in, (u8[CURVE25519_KEY_SIZE]){ 9 });
1307                 curve25519_generic(out3, in, (u8[CURVE25519_KEY_SIZE]){ 9 });
1308                 if (ret != ret2 ||
1309                     memcmp(out, out2, CURVE25519_KEY_SIZE) ||
1310                     memcmp(out, out3, CURVE25519_KEY_SIZE)) {
1311                         pr_err("curve25519 basepoint self-test %zu: FAIL: input - 0x",
1312                                i + 1);
1313                         for (j = CURVE25519_KEY_SIZE; j-- > 0;)
1314                                 printk(KERN_CONT "%02x", in[j]);
1315                         printk(KERN_CONT "\n");
1316                         success = false;
1317                 }
1318         }
1319
1320         return success;
1321 }