Nevar pievienot vairāk kā 25 tēmas Tēmai ir jāsākas ar burtu vai ciparu, tā var saturēt domu zīmes ('-') un var būt līdz 35 simboliem gara.
 
 
 
 

1125 rindas
33 KiB

  1. import sys
  2. import pickle
  3. import hashlib
  4. import pytest
  5. try:
  6. import unittest2 as unittest
  7. except ImportError:
  8. import unittest
  9. from hypothesis import given, settings, example
  10. import hypothesis.strategies as st
  11. from .ellipticcurve import PointEdwards, INFINITY, CurveEdTw
  12. from .eddsa import (
  13. generator_ed25519,
  14. curve_ed25519,
  15. generator_ed448,
  16. curve_ed448,
  17. PrivateKey,
  18. PublicKey,
  19. )
  20. from .ecdsa import generator_256, curve_256
  21. from .errors import MalformedPointError
  22. from ._compat import a2b_hex, compat26_str
  23. class TestA2B_Hex(unittest.TestCase):
  24. def test_invalid_input(self):
  25. with self.assertRaises(ValueError):
  26. a2b_hex("abcdefghi")
  27. def test_ed25519_curve_compare():
  28. assert curve_ed25519 != curve_256
  29. def test_ed25519_and_ed448_compare():
  30. assert curve_ed448 != curve_ed25519
  31. def test_ed25519_and_custom_curve_compare():
  32. a = CurveEdTw(curve_ed25519.p(), -curve_ed25519.a(), 1)
  33. assert curve_ed25519 != a
  34. def test_ed25519_and_almost_exact_curve_compare():
  35. a = CurveEdTw(curve_ed25519.p(), curve_ed25519.a(), 1)
  36. assert curve_ed25519 != a
  37. def test_ed25519_and_same_curve_params():
  38. a = CurveEdTw(curve_ed25519.p(), curve_ed25519.a(), curve_ed25519.d())
  39. assert curve_ed25519 == a
  40. assert not (curve_ed25519 != a)
  41. def test_ed25519_contains_point():
  42. g = generator_ed25519
  43. assert curve_ed25519.contains_point(g.x(), g.y())
  44. def test_ed25519_contains_point_bad():
  45. assert not curve_ed25519.contains_point(1, 1)
  46. def test_ed25519_double():
  47. a = generator_ed25519
  48. z = a.double()
  49. assert isinstance(z, PointEdwards)
  50. x2 = int(
  51. "24727413235106541002554574571675588834622768167397638456726423"
  52. "682521233608206"
  53. )
  54. y2 = int(
  55. "15549675580280190176352668710449542251549572066445060580507079"
  56. "593062643049417"
  57. )
  58. b = PointEdwards(curve_ed25519, x2, y2, 1, x2 * y2)
  59. assert z == b
  60. assert a != b
  61. def test_ed25519_add_as_double():
  62. a = generator_ed25519
  63. z = a + a
  64. assert isinstance(z, PointEdwards)
  65. b = generator_ed25519.double()
  66. assert z == b
  67. def test_ed25519_double_infinity():
  68. a = PointEdwards(curve_ed25519, 0, 1, 1, 0)
  69. z = a.double()
  70. assert z is INFINITY
  71. def test_ed25519_double_badly_encoded_infinity():
  72. # invalid point, mostly to make instrumental happy
  73. a = PointEdwards(curve_ed25519, 1, 1, 1, 0)
  74. z = a.double()
  75. assert z is INFINITY
  76. def test_ed25519_eq_with_different_z():
  77. x = generator_ed25519.x()
  78. y = generator_ed25519.y()
  79. p = curve_ed25519.p()
  80. a = PointEdwards(curve_ed25519, x * 2 % p, y * 2 % p, 2, x * y * 2 % p)
  81. b = PointEdwards(curve_ed25519, x * 3 % p, y * 3 % p, 3, x * y * 3 % p)
  82. assert a == b
  83. assert not (a != b)
  84. def test_ed25519_eq_against_infinity():
  85. assert generator_ed25519 != INFINITY
  86. def test_ed25519_eq_encoded_infinity_against_infinity():
  87. a = PointEdwards(curve_ed25519, 0, 1, 1, 0)
  88. assert a == INFINITY
  89. def test_ed25519_eq_bad_encode_of_infinity_against_infinity():
  90. # technically incorrect encoding of the point at infinity, but we check
  91. # both X and T, so verify that just T==0 works
  92. a = PointEdwards(curve_ed25519, 1, 1, 1, 0)
  93. assert a == INFINITY
  94. def test_ed25519_eq_against_non_Edwards_point():
  95. assert generator_ed25519 != generator_256
  96. def test_ed25519_eq_against_negated_point():
  97. g = generator_ed25519
  98. neg = PointEdwards(curve_ed25519, -g.x(), g.y(), 1, -g.x() * g.y())
  99. assert g != neg
  100. def test_ed25519_eq_x_different_y():
  101. # not points on the curve, but __eq__ doesn't care
  102. a = PointEdwards(curve_ed25519, 1, 1, 1, 1)
  103. b = PointEdwards(curve_ed25519, 1, 2, 1, 2)
  104. assert a != b
  105. def test_ed25519_mul_by_order():
  106. g = PointEdwards(
  107. curve_ed25519,
  108. generator_ed25519.x(),
  109. generator_ed25519.y(),
  110. 1,
  111. generator_ed25519.x() * generator_ed25519.y(),
  112. )
  113. assert g * generator_ed25519.order() == INFINITY
  114. def test_radd():
  115. a = PointEdwards(curve_ed25519, 1, 1, 1, 1)
  116. p = INFINITY + a
  117. assert p == a
  118. def test_ed25519_test_normalisation_and_scaling():
  119. x = generator_ed25519.x()
  120. y = generator_ed25519.y()
  121. p = curve_ed25519.p()
  122. a = PointEdwards(curve_ed25519, x * 11 % p, y * 11 % p, 11, x * y * 11 % p)
  123. assert a.x() == x
  124. assert a.y() == y
  125. a.scale()
  126. assert a.x() == x
  127. assert a.y() == y
  128. a.scale() # second execution should be a noop
  129. assert a.x() == x
  130. assert a.y() == y
  131. def test_ed25519_add_three_times():
  132. a = generator_ed25519
  133. z = a + a + a
  134. x3 = int(
  135. "468967334644549386571235445953867877890461982801326656862413"
  136. "21779790909858396"
  137. )
  138. y3 = int(
  139. "832484377853344397649037712036920113830141722629755531674120"
  140. "2210403726505172"
  141. )
  142. b = PointEdwards(curve_ed25519, x3, y3, 1, x3 * y3)
  143. assert z == b
  144. def test_ed25519_add_to_infinity():
  145. # generator * (order-1)
  146. x1 = int(
  147. "427838232691226969392843410947554224151809796397784248136826"
  148. "78720006717057747"
  149. )
  150. y1 = int(
  151. "463168356949264781694283940034751631413079938662562256157830"
  152. "33603165251855960"
  153. )
  154. inf_m_1 = PointEdwards(curve_ed25519, x1, y1, 1, x1 * y1)
  155. inf = inf_m_1 + generator_ed25519
  156. assert inf is INFINITY
  157. def test_ed25519_add_and_mul_equivalence():
  158. g = generator_ed25519
  159. assert g + g == g * 2
  160. assert g + g + g == g * 3
  161. def test_ed25519_add_literal_infinity():
  162. g = generator_ed25519
  163. z = g + INFINITY
  164. assert z == g
  165. def test_ed25519_add_infinity():
  166. inf = PointEdwards(curve_ed25519, 0, 1, 1, 0)
  167. g = generator_ed25519
  168. z = g + inf
  169. assert z == g
  170. z = inf + g
  171. assert z == g
  172. class TestEd25519(unittest.TestCase):
  173. def test_add_wrong_curves(self):
  174. with self.assertRaises(ValueError) as e:
  175. generator_ed25519 + generator_ed448
  176. self.assertIn("different curve", str(e.exception))
  177. def test_add_wrong_point_type(self):
  178. with self.assertRaises(ValueError) as e:
  179. generator_ed25519 + generator_256
  180. self.assertIn("different curve", str(e.exception))
  181. def test_generate_with_point():
  182. x1 = int(
  183. "427838232691226969392843410947554224151809796397784248136826"
  184. "78720006717057747"
  185. )
  186. y1 = int(
  187. "463168356949264781694283940034751631413079938662562256157830"
  188. "33603165251855960"
  189. )
  190. p = PointEdwards(curve_ed25519, x1, y1, 1, x1 * y1)
  191. pk = PublicKey(generator_ed25519, b"0" * 32, public_point=p)
  192. assert pk.public_point() == p
  193. def test_ed25519_mul_to_order_min_1():
  194. x1 = int(
  195. "427838232691226969392843410947554224151809796397784248136826"
  196. "78720006717057747"
  197. )
  198. y1 = int(
  199. "463168356949264781694283940034751631413079938662562256157830"
  200. "33603165251855960"
  201. )
  202. inf_m_1 = PointEdwards(curve_ed25519, x1, y1, 1, x1 * y1)
  203. assert generator_ed25519 * (generator_ed25519.order() - 1) == inf_m_1
  204. def test_ed25519_mul_to_infinity():
  205. assert generator_ed25519 * generator_ed25519.order() == INFINITY
  206. def test_ed25519_mul_to_infinity_plus_1():
  207. g = generator_ed25519
  208. assert g * (g.order() + 1) == g
  209. def test_ed25519_mul_and_add():
  210. g = generator_ed25519
  211. a = g * 128
  212. b = g * 64 + g * 64
  213. assert a == b
  214. def test_ed25519_mul_and_add_2():
  215. g = generator_ed25519
  216. a = g * 123
  217. b = g * 120 + g * 3
  218. assert a == b
  219. def test_ed25519_mul_infinity():
  220. inf = PointEdwards(curve_ed25519, 0, 1, 1, 0)
  221. z = inf * 11
  222. assert z == INFINITY
  223. def test_ed25519_mul_by_zero():
  224. z = generator_ed25519 * 0
  225. assert z == INFINITY
  226. def test_ed25519_mul_by_one():
  227. z = generator_ed25519 * 1
  228. assert z == generator_ed25519
  229. def test_ed25519_mul_custom_point():
  230. # verify that multiplication without order set works
  231. g = generator_ed25519
  232. a = PointEdwards(curve_ed25519, g.x(), g.y(), 1, g.x() * g.y())
  233. z = a * 11
  234. assert z == g * 11
  235. def test_ed25519_pickle():
  236. g = generator_ed25519
  237. assert pickle.loads(pickle.dumps(g)) == g
  238. def test_ed448_eq_against_different_curve():
  239. assert generator_ed25519 != generator_ed448
  240. def test_ed448_double():
  241. g = generator_ed448
  242. z = g.double()
  243. assert isinstance(z, PointEdwards)
  244. x2 = int(
  245. "4845591495304045936995492052586696895690942404582120401876"
  246. "6013278705691214670908136440114445572635086627683154494739"
  247. "7859048262938744149"
  248. )
  249. y2 = int(
  250. "4940887598674337276743026725267350893505445523037277237461"
  251. "2648447308771911703729389009346215770388834286503647778745"
  252. "3078312060500281069"
  253. )
  254. b = PointEdwards(curve_ed448, x2, y2, 1, x2 * y2)
  255. assert z == b
  256. assert g != b
  257. def test_ed448_add_as_double():
  258. g = generator_ed448
  259. z = g + g
  260. b = g.double()
  261. assert z == b
  262. def test_ed448_mul_as_double():
  263. g = generator_ed448
  264. z = g * 2
  265. b = g.double()
  266. assert z == b
  267. def test_ed448_add_to_infinity():
  268. # generator * (order - 1)
  269. x1 = int(
  270. "5022586839996825903617194737881084981068517190547539260353"
  271. "6473749366191269932473977736719082931859264751085238669719"
  272. "1187378895383117729"
  273. )
  274. y1 = int(
  275. "2988192100784814926760179304439306734375440401540802420959"
  276. "2824137233150618983587600353687865541878473398230323350346"
  277. "2500531545062832660"
  278. )
  279. inf_m_1 = PointEdwards(curve_ed448, x1, y1, 1, x1 * y1)
  280. inf = inf_m_1 + generator_ed448
  281. assert inf is INFINITY
  282. def test_ed448_mul_to_infinity():
  283. g = generator_ed448
  284. inf = g * g.order()
  285. assert inf is INFINITY
  286. def test_ed448_mul_to_infinity_plus_1():
  287. g = generator_ed448
  288. z = g * (g.order() + 1)
  289. assert z == g
  290. def test_ed448_add_and_mul_equivalence():
  291. g = generator_ed448
  292. assert g + g == g * 2
  293. assert g + g + g == g * 3
  294. def test_ed25519_encode():
  295. g = generator_ed25519
  296. g_bytes = g.to_bytes()
  297. assert len(g_bytes) == 32
  298. exp_bytes = (
  299. b"\x58\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66"
  300. b"\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66"
  301. )
  302. assert g_bytes == exp_bytes
  303. def test_ed25519_decode():
  304. exp_bytes = (
  305. b"\x58\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66"
  306. b"\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66"
  307. )
  308. a = PointEdwards.from_bytes(curve_ed25519, exp_bytes)
  309. assert a == generator_ed25519
  310. class TestEdwardsMalformed(unittest.TestCase):
  311. def test_invalid_point(self):
  312. exp_bytes = (
  313. b"\x78\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66"
  314. b"\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66"
  315. )
  316. with self.assertRaises(MalformedPointError):
  317. PointEdwards.from_bytes(curve_ed25519, exp_bytes)
  318. def test_invalid_length(self):
  319. exp_bytes = (
  320. b"\x58\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66"
  321. b"\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66\x66"
  322. b"\x66"
  323. )
  324. with self.assertRaises(MalformedPointError) as e:
  325. PointEdwards.from_bytes(curve_ed25519, exp_bytes)
  326. self.assertIn("length", str(e.exception))
  327. def test_ed448_invalid(self):
  328. exp_bytes = b"\xff" * 57
  329. with self.assertRaises(MalformedPointError):
  330. PointEdwards.from_bytes(curve_ed448, exp_bytes)
  331. def test_ed448_encode():
  332. g = generator_ed448
  333. g_bytes = g.to_bytes()
  334. assert len(g_bytes) == 57
  335. exp_bytes = (
  336. b"\x14\xfa\x30\xf2\x5b\x79\x08\x98\xad\xc8\xd7\x4e\x2c\x13\xbd"
  337. b"\xfd\xc4\x39\x7c\xe6\x1c\xff\xd3\x3a\xd7\xc2\xa0\x05\x1e\x9c"
  338. b"\x78\x87\x40\x98\xa3\x6c\x73\x73\xea\x4b\x62\xc7\xc9\x56\x37"
  339. b"\x20\x76\x88\x24\xbc\xb6\x6e\x71\x46\x3f\x69\x00"
  340. )
  341. assert g_bytes == exp_bytes
  342. def test_ed448_decode():
  343. exp_bytes = (
  344. b"\x14\xfa\x30\xf2\x5b\x79\x08\x98\xad\xc8\xd7\x4e\x2c\x13\xbd"
  345. b"\xfd\xc4\x39\x7c\xe6\x1c\xff\xd3\x3a\xd7\xc2\xa0\x05\x1e\x9c"
  346. b"\x78\x87\x40\x98\xa3\x6c\x73\x73\xea\x4b\x62\xc7\xc9\x56\x37"
  347. b"\x20\x76\x88\x24\xbc\xb6\x6e\x71\x46\x3f\x69\x00"
  348. )
  349. a = PointEdwards.from_bytes(curve_ed448, exp_bytes)
  350. assert a == generator_ed448
  351. class TestEdDSAEquality(unittest.TestCase):
  352. def test_equal_public_points(self):
  353. key1 = PublicKey(generator_ed25519, b"\x01" * 32)
  354. key2 = PublicKey(generator_ed25519, b"\x01" * 32)
  355. self.assertEqual(key1, key2)
  356. # verify that `__ne__` works as expected
  357. self.assertFalse(key1 != key2)
  358. def test_unequal_public_points(self):
  359. key1 = PublicKey(generator_ed25519, b"\x01" * 32)
  360. key2 = PublicKey(generator_ed25519, b"\x03" * 32)
  361. self.assertNotEqual(key1, key2)
  362. def test_unequal_to_string(self):
  363. key1 = PublicKey(generator_ed25519, b"\x01" * 32)
  364. key2 = b"\x01" * 32
  365. self.assertNotEqual(key1, key2)
  366. def test_unequal_publickey_curves(self):
  367. key1 = PublicKey(generator_ed25519, b"\x01" * 32)
  368. key2 = PublicKey(generator_ed448, b"\x03" * 56 + b"\x00")
  369. self.assertNotEqual(key1, key2)
  370. # verify that `__ne__` works as expected
  371. self.assertTrue(key1 != key2)
  372. def test_equal_private_keys(self):
  373. key1 = PrivateKey(generator_ed25519, b"\x01" * 32)
  374. key2 = PrivateKey(generator_ed25519, b"\x01" * 32)
  375. self.assertEqual(key1, key2)
  376. # verify that `__ne__` works as expected
  377. self.assertFalse(key1 != key2)
  378. def test_unequal_private_keys(self):
  379. key1 = PrivateKey(generator_ed25519, b"\x01" * 32)
  380. key2 = PrivateKey(generator_ed25519, b"\x02" * 32)
  381. self.assertNotEqual(key1, key2)
  382. # verify that `__ne__` works as expected
  383. self.assertTrue(key1 != key2)
  384. def test_unequal_privatekey_to_string(self):
  385. key1 = PrivateKey(generator_ed25519, b"\x01" * 32)
  386. key2 = b"\x01" * 32
  387. self.assertNotEqual(key1, key2)
  388. def test_unequal_privatekey_curves(self):
  389. key1 = PrivateKey(generator_ed25519, b"\x01" * 32)
  390. key2 = PrivateKey(generator_ed448, b"\x01" * 57)
  391. self.assertNotEqual(key1, key2)
  392. class TestInvalidEdDSAInputs(unittest.TestCase):
  393. def test_wrong_length_of_private_key(self):
  394. with self.assertRaises(ValueError):
  395. PrivateKey(generator_ed25519, b"\x01" * 31)
  396. def test_wrong_length_of_public_key(self):
  397. with self.assertRaises(ValueError):
  398. PublicKey(generator_ed25519, b"\x01" * 33)
  399. def test_wrong_cofactor_curve(self):
  400. ed_c = curve_ed25519
  401. def _hash(data):
  402. return hashlib.new("sha512", compat26_str(data)).digest()
  403. curve = CurveEdTw(ed_c.p(), ed_c.a(), ed_c.d(), 1, _hash)
  404. g = generator_ed25519
  405. fake_gen = PointEdwards(curve, g.x(), g.y(), 1, g.x() * g.y())
  406. with self.assertRaises(ValueError) as e:
  407. PrivateKey(fake_gen, g.to_bytes())
  408. self.assertIn("cofactor", str(e.exception))
  409. def test_invalid_signature_length(self):
  410. key = PublicKey(generator_ed25519, b"\x01" * 32)
  411. with self.assertRaises(ValueError) as e:
  412. key.verify(b"", b"\x01" * 65)
  413. self.assertIn("length", str(e.exception))
  414. def test_changing_public_key(self):
  415. key = PublicKey(generator_ed25519, b"\x01" * 32)
  416. g = key.point
  417. new_g = PointEdwards(curve_ed25519, g.x(), g.y(), 1, g.x() * g.y())
  418. key.point = new_g
  419. self.assertEqual(g, key.point)
  420. def test_changing_public_key_to_different_point(self):
  421. key = PublicKey(generator_ed25519, b"\x01" * 32)
  422. with self.assertRaises(ValueError) as e:
  423. key.point = generator_ed25519
  424. self.assertIn("coordinates", str(e.exception))
  425. def test_invalid_s_value(self):
  426. key = PublicKey(
  427. generator_ed25519,
  428. b"\xd7\x5a\x98\x01\x82\xb1\x0a\xb7\xd5\x4b\xfe\xd3\xc9\x64\x07\x3a"
  429. b"\x0e\xe1\x72\xf3\xda\xa6\x23\x25\xaf\x02\x1a\x68\xf7\x07\x51\x1a",
  430. )
  431. sig_valid = bytearray(
  432. b"\xe5\x56\x43\x00\xc3\x60\xac\x72\x90\x86\xe2\xcc\x80\x6e\x82\x8a"
  433. b"\x84\x87\x7f\x1e\xb8\xe5\xd9\x74\xd8\x73\xe0\x65\x22\x49\x01\x55"
  434. b"\x5f\xb8\x82\x15\x90\xa3\x3b\xac\xc6\x1e\x39\x70\x1c\xf9\xb4\x6b"
  435. b"\xd2\x5b\xf5\xf0\x59\x5b\xbe\x24\x65\x51\x41\x43\x8e\x7a\x10\x0b"
  436. )
  437. self.assertTrue(key.verify(b"", sig_valid))
  438. sig_invalid = bytearray(sig_valid)
  439. sig_invalid[-1] = 0xFF
  440. with self.assertRaises(ValueError):
  441. key.verify(b"", sig_invalid)
  442. def test_invalid_r_value(self):
  443. key = PublicKey(
  444. generator_ed25519,
  445. b"\xd7\x5a\x98\x01\x82\xb1\x0a\xb7\xd5\x4b\xfe\xd3\xc9\x64\x07\x3a"
  446. b"\x0e\xe1\x72\xf3\xda\xa6\x23\x25\xaf\x02\x1a\x68\xf7\x07\x51\x1a",
  447. )
  448. sig_valid = bytearray(
  449. b"\xe5\x56\x43\x00\xc3\x60\xac\x72\x90\x86\xe2\xcc\x80\x6e\x82\x8a"
  450. b"\x84\x87\x7f\x1e\xb8\xe5\xd9\x74\xd8\x73\xe0\x65\x22\x49\x01\x55"
  451. b"\x5f\xb8\x82\x15\x90\xa3\x3b\xac\xc6\x1e\x39\x70\x1c\xf9\xb4\x6b"
  452. b"\xd2\x5b\xf5\xf0\x59\x5b\xbe\x24\x65\x51\x41\x43\x8e\x7a\x10\x0b"
  453. )
  454. self.assertTrue(key.verify(b"", sig_valid))
  455. sig_invalid = bytearray(sig_valid)
  456. sig_invalid[0] = 0xE0
  457. with self.assertRaises(ValueError):
  458. key.verify(b"", sig_invalid)
  459. HYP_SETTINGS = dict()
  460. if "--fast" in sys.argv: # pragma: no cover
  461. HYP_SETTINGS["max_examples"] = 2
  462. else:
  463. HYP_SETTINGS["max_examples"] = 10
  464. @settings(**HYP_SETTINGS)
  465. @example(1)
  466. @example(5) # smallest multiple that requires changing sign of x
  467. @given(st.integers(min_value=1, max_value=int(generator_ed25519.order() - 1)))
  468. def test_ed25519_encode_decode(multiple):
  469. a = generator_ed25519 * multiple
  470. b = PointEdwards.from_bytes(curve_ed25519, a.to_bytes())
  471. assert a == b
  472. @settings(**HYP_SETTINGS)
  473. @example(1)
  474. @example(2) # smallest multiple that requires changing the sign of x
  475. @given(st.integers(min_value=1, max_value=int(generator_ed448.order() - 1)))
  476. def test_ed448_encode_decode(multiple):
  477. a = generator_ed448 * multiple
  478. b = PointEdwards.from_bytes(curve_ed448, a.to_bytes())
  479. assert a == b
  480. @settings(**HYP_SETTINGS)
  481. @example(1)
  482. @example(2)
  483. @given(st.integers(min_value=1, max_value=int(generator_ed25519.order()) - 1))
  484. def test_ed25519_mul_precompute_vs_naf(multiple):
  485. """Compare multiplication with and without precomputation."""
  486. g = generator_ed25519
  487. new_g = PointEdwards(curve_ed25519, g.x(), g.y(), 1, g.x() * g.y())
  488. assert g * multiple == multiple * new_g
  489. # Test vectors from RFC 8032
  490. TEST_VECTORS = [
  491. # TEST 1
  492. (
  493. generator_ed25519,
  494. "9d61b19deffd5a60ba844af492ec2cc4" "4449c5697b326919703bac031cae7f60",
  495. "d75a980182b10ab7d54bfed3c964073a" "0ee172f3daa62325af021a68f707511a",
  496. "",
  497. "e5564300c360ac729086e2cc806e828a"
  498. "84877f1eb8e5d974d873e06522490155"
  499. "5fb8821590a33bacc61e39701cf9b46b"
  500. "d25bf5f0595bbe24655141438e7a100b",
  501. ),
  502. # TEST 2
  503. (
  504. generator_ed25519,
  505. "4ccd089b28ff96da9db6c346ec114e0f" "5b8a319f35aba624da8cf6ed4fb8a6fb",
  506. "3d4017c3e843895a92b70aa74d1b7ebc" "9c982ccf2ec4968cc0cd55f12af4660c",
  507. "72",
  508. "92a009a9f0d4cab8720e820b5f642540"
  509. "a2b27b5416503f8fb3762223ebdb69da"
  510. "085ac1e43e15996e458f3613d0f11d8c"
  511. "387b2eaeb4302aeeb00d291612bb0c00",
  512. ),
  513. # TEST 3
  514. (
  515. generator_ed25519,
  516. "c5aa8df43f9f837bedb7442f31dcb7b1" "66d38535076f094b85ce3a2e0b4458f7",
  517. "fc51cd8e6218a1a38da47ed00230f058" "0816ed13ba3303ac5deb911548908025",
  518. "af82",
  519. "6291d657deec24024827e69c3abe01a3"
  520. "0ce548a284743a445e3680d7db5ac3ac"
  521. "18ff9b538d16f290ae67f760984dc659"
  522. "4a7c15e9716ed28dc027beceea1ec40a",
  523. ),
  524. # TEST 1024
  525. (
  526. generator_ed25519,
  527. "f5e5767cf153319517630f226876b86c" "8160cc583bc013744c6bf255f5cc0ee5",
  528. "278117fc144c72340f67d0f2316e8386" "ceffbf2b2428c9c51fef7c597f1d426e",
  529. "08b8b2b733424243760fe426a4b54908"
  530. "632110a66c2f6591eabd3345e3e4eb98"
  531. "fa6e264bf09efe12ee50f8f54e9f77b1"
  532. "e355f6c50544e23fb1433ddf73be84d8"
  533. "79de7c0046dc4996d9e773f4bc9efe57"
  534. "38829adb26c81b37c93a1b270b20329d"
  535. "658675fc6ea534e0810a4432826bf58c"
  536. "941efb65d57a338bbd2e26640f89ffbc"
  537. "1a858efcb8550ee3a5e1998bd177e93a"
  538. "7363c344fe6b199ee5d02e82d522c4fe"
  539. "ba15452f80288a821a579116ec6dad2b"
  540. "3b310da903401aa62100ab5d1a36553e"
  541. "06203b33890cc9b832f79ef80560ccb9"
  542. "a39ce767967ed628c6ad573cb116dbef"
  543. "efd75499da96bd68a8a97b928a8bbc10"
  544. "3b6621fcde2beca1231d206be6cd9ec7"
  545. "aff6f6c94fcd7204ed3455c68c83f4a4"
  546. "1da4af2b74ef5c53f1d8ac70bdcb7ed1"
  547. "85ce81bd84359d44254d95629e9855a9"
  548. "4a7c1958d1f8ada5d0532ed8a5aa3fb2"
  549. "d17ba70eb6248e594e1a2297acbbb39d"
  550. "502f1a8c6eb6f1ce22b3de1a1f40cc24"
  551. "554119a831a9aad6079cad88425de6bd"
  552. "e1a9187ebb6092cf67bf2b13fd65f270"
  553. "88d78b7e883c8759d2c4f5c65adb7553"
  554. "878ad575f9fad878e80a0c9ba63bcbcc"
  555. "2732e69485bbc9c90bfbd62481d9089b"
  556. "eccf80cfe2df16a2cf65bd92dd597b07"
  557. "07e0917af48bbb75fed413d238f5555a"
  558. "7a569d80c3414a8d0859dc65a46128ba"
  559. "b27af87a71314f318c782b23ebfe808b"
  560. "82b0ce26401d2e22f04d83d1255dc51a"
  561. "ddd3b75a2b1ae0784504df543af8969b"
  562. "e3ea7082ff7fc9888c144da2af58429e"
  563. "c96031dbcad3dad9af0dcbaaaf268cb8"
  564. "fcffead94f3c7ca495e056a9b47acdb7"
  565. "51fb73e666c6c655ade8297297d07ad1"
  566. "ba5e43f1bca32301651339e22904cc8c"
  567. "42f58c30c04aafdb038dda0847dd988d"
  568. "cda6f3bfd15c4b4c4525004aa06eeff8"
  569. "ca61783aacec57fb3d1f92b0fe2fd1a8"
  570. "5f6724517b65e614ad6808d6f6ee34df"
  571. "f7310fdc82aebfd904b01e1dc54b2927"
  572. "094b2db68d6f903b68401adebf5a7e08"
  573. "d78ff4ef5d63653a65040cf9bfd4aca7"
  574. "984a74d37145986780fc0b16ac451649"
  575. "de6188a7dbdf191f64b5fc5e2ab47b57"
  576. "f7f7276cd419c17a3ca8e1b939ae49e4"
  577. "88acba6b965610b5480109c8b17b80e1"
  578. "b7b750dfc7598d5d5011fd2dcc5600a3"
  579. "2ef5b52a1ecc820e308aa342721aac09"
  580. "43bf6686b64b2579376504ccc493d97e"
  581. "6aed3fb0f9cd71a43dd497f01f17c0e2"
  582. "cb3797aa2a2f256656168e6c496afc5f"
  583. "b93246f6b1116398a346f1a641f3b041"
  584. "e989f7914f90cc2c7fff357876e506b5"
  585. "0d334ba77c225bc307ba537152f3f161"
  586. "0e4eafe595f6d9d90d11faa933a15ef1"
  587. "369546868a7f3a45a96768d40fd9d034"
  588. "12c091c6315cf4fde7cb68606937380d"
  589. "b2eaaa707b4c4185c32eddcdd306705e"
  590. "4dc1ffc872eeee475a64dfac86aba41c"
  591. "0618983f8741c5ef68d3a101e8a3b8ca"
  592. "c60c905c15fc910840b94c00a0b9d0",
  593. "0aab4c900501b3e24d7cdf4663326a3a"
  594. "87df5e4843b2cbdb67cbf6e460fec350"
  595. "aa5371b1508f9f4528ecea23c436d94b"
  596. "5e8fcd4f681e30a6ac00a9704a188a03",
  597. ),
  598. # TEST SHA(abc)
  599. (
  600. generator_ed25519,
  601. "833fe62409237b9d62ec77587520911e" "9a759cec1d19755b7da901b96dca3d42",
  602. "ec172b93ad5e563bf4932c70e1245034" "c35467ef2efd4d64ebf819683467e2bf",
  603. "ddaf35a193617abacc417349ae204131"
  604. "12e6fa4e89a97ea20a9eeee64b55d39a"
  605. "2192992a274fc1a836ba3c23a3feebbd"
  606. "454d4423643ce80e2a9ac94fa54ca49f",
  607. "dc2a4459e7369633a52b1bf277839a00"
  608. "201009a3efbf3ecb69bea2186c26b589"
  609. "09351fc9ac90b3ecfdfbc7c66431e030"
  610. "3dca179c138ac17ad9bef1177331a704",
  611. ),
  612. # Blank
  613. (
  614. generator_ed448,
  615. "6c82a562cb808d10d632be89c8513ebf"
  616. "6c929f34ddfa8c9f63c9960ef6e348a3"
  617. "528c8a3fcc2f044e39a3fc5b94492f8f"
  618. "032e7549a20098f95b",
  619. "5fd7449b59b461fd2ce787ec616ad46a"
  620. "1da1342485a70e1f8a0ea75d80e96778"
  621. "edf124769b46c7061bd6783df1e50f6c"
  622. "d1fa1abeafe8256180",
  623. "",
  624. "533a37f6bbe457251f023c0d88f976ae"
  625. "2dfb504a843e34d2074fd823d41a591f"
  626. "2b233f034f628281f2fd7a22ddd47d78"
  627. "28c59bd0a21bfd3980ff0d2028d4b18a"
  628. "9df63e006c5d1c2d345b925d8dc00b41"
  629. "04852db99ac5c7cdda8530a113a0f4db"
  630. "b61149f05a7363268c71d95808ff2e65"
  631. "2600",
  632. ),
  633. # 1 octet
  634. (
  635. generator_ed448,
  636. "c4eab05d357007c632f3dbb48489924d"
  637. "552b08fe0c353a0d4a1f00acda2c463a"
  638. "fbea67c5e8d2877c5e3bc397a659949e"
  639. "f8021e954e0a12274e",
  640. "43ba28f430cdff456ae531545f7ecd0a"
  641. "c834a55d9358c0372bfa0c6c6798c086"
  642. "6aea01eb00742802b8438ea4cb82169c"
  643. "235160627b4c3a9480",
  644. "03",
  645. "26b8f91727bd62897af15e41eb43c377"
  646. "efb9c610d48f2335cb0bd0087810f435"
  647. "2541b143c4b981b7e18f62de8ccdf633"
  648. "fc1bf037ab7cd779805e0dbcc0aae1cb"
  649. "cee1afb2e027df36bc04dcecbf154336"
  650. "c19f0af7e0a6472905e799f1953d2a0f"
  651. "f3348ab21aa4adafd1d234441cf807c0"
  652. "3a00",
  653. ),
  654. # 11 octets
  655. (
  656. generator_ed448,
  657. "cd23d24f714274e744343237b93290f5"
  658. "11f6425f98e64459ff203e8985083ffd"
  659. "f60500553abc0e05cd02184bdb89c4cc"
  660. "d67e187951267eb328",
  661. "dcea9e78f35a1bf3499a831b10b86c90"
  662. "aac01cd84b67a0109b55a36e9328b1e3"
  663. "65fce161d71ce7131a543ea4cb5f7e9f"
  664. "1d8b00696447001400",
  665. "0c3e544074ec63b0265e0c",
  666. "1f0a8888ce25e8d458a21130879b840a"
  667. "9089d999aaba039eaf3e3afa090a09d3"
  668. "89dba82c4ff2ae8ac5cdfb7c55e94d5d"
  669. "961a29fe0109941e00b8dbdeea6d3b05"
  670. "1068df7254c0cdc129cbe62db2dc957d"
  671. "bb47b51fd3f213fb8698f064774250a5"
  672. "028961c9bf8ffd973fe5d5c206492b14"
  673. "0e00",
  674. ),
  675. # 12 octets
  676. (
  677. generator_ed448,
  678. "258cdd4ada32ed9c9ff54e63756ae582"
  679. "fb8fab2ac721f2c8e676a72768513d93"
  680. "9f63dddb55609133f29adf86ec9929dc"
  681. "cb52c1c5fd2ff7e21b",
  682. "3ba16da0c6f2cc1f30187740756f5e79"
  683. "8d6bc5fc015d7c63cc9510ee3fd44adc"
  684. "24d8e968b6e46e6f94d19b945361726b"
  685. "d75e149ef09817f580",
  686. "64a65f3cdedcdd66811e2915",
  687. "7eeeab7c4e50fb799b418ee5e3197ff6"
  688. "bf15d43a14c34389b59dd1a7b1b85b4a"
  689. "e90438aca634bea45e3a2695f1270f07"
  690. "fdcdf7c62b8efeaf00b45c2c96ba457e"
  691. "b1a8bf075a3db28e5c24f6b923ed4ad7"
  692. "47c3c9e03c7079efb87cb110d3a99861"
  693. "e72003cbae6d6b8b827e4e6c143064ff"
  694. "3c00",
  695. ),
  696. # 13 octets
  697. (
  698. generator_ed448,
  699. "7ef4e84544236752fbb56b8f31a23a10"
  700. "e42814f5f55ca037cdcc11c64c9a3b29"
  701. "49c1bb60700314611732a6c2fea98eeb"
  702. "c0266a11a93970100e",
  703. "b3da079b0aa493a5772029f0467baebe"
  704. "e5a8112d9d3a22532361da294f7bb381"
  705. "5c5dc59e176b4d9f381ca0938e13c6c0"
  706. "7b174be65dfa578e80",
  707. "64a65f3cdedcdd66811e2915e7",
  708. "6a12066f55331b6c22acd5d5bfc5d712"
  709. "28fbda80ae8dec26bdd306743c5027cb"
  710. "4890810c162c027468675ecf645a8317"
  711. "6c0d7323a2ccde2d80efe5a1268e8aca"
  712. "1d6fbc194d3f77c44986eb4ab4177919"
  713. "ad8bec33eb47bbb5fc6e28196fd1caf5"
  714. "6b4e7e0ba5519234d047155ac727a105"
  715. "3100",
  716. ),
  717. # 64 octets
  718. (
  719. generator_ed448,
  720. "d65df341ad13e008567688baedda8e9d"
  721. "cdc17dc024974ea5b4227b6530e339bf"
  722. "f21f99e68ca6968f3cca6dfe0fb9f4fa"
  723. "b4fa135d5542ea3f01",
  724. "df9705f58edbab802c7f8363cfe5560a"
  725. "b1c6132c20a9f1dd163483a26f8ac53a"
  726. "39d6808bf4a1dfbd261b099bb03b3fb5"
  727. "0906cb28bd8a081f00",
  728. "bd0f6a3747cd561bdddf4640a332461a"
  729. "4a30a12a434cd0bf40d766d9c6d458e5"
  730. "512204a30c17d1f50b5079631f64eb31"
  731. "12182da3005835461113718d1a5ef944",
  732. "554bc2480860b49eab8532d2a533b7d5"
  733. "78ef473eeb58c98bb2d0e1ce488a98b1"
  734. "8dfde9b9b90775e67f47d4a1c3482058"
  735. "efc9f40d2ca033a0801b63d45b3b722e"
  736. "f552bad3b4ccb667da350192b61c508c"
  737. "f7b6b5adadc2c8d9a446ef003fb05cba"
  738. "5f30e88e36ec2703b349ca229c267083"
  739. "3900",
  740. ),
  741. # 256 octets
  742. (
  743. generator_ed448,
  744. "2ec5fe3c17045abdb136a5e6a913e32a"
  745. "b75ae68b53d2fc149b77e504132d3756"
  746. "9b7e766ba74a19bd6162343a21c8590a"
  747. "a9cebca9014c636df5",
  748. "79756f014dcfe2079f5dd9e718be4171"
  749. "e2ef2486a08f25186f6bff43a9936b9b"
  750. "fe12402b08ae65798a3d81e22e9ec80e"
  751. "7690862ef3d4ed3a00",
  752. "15777532b0bdd0d1389f636c5f6b9ba7"
  753. "34c90af572877e2d272dd078aa1e567c"
  754. "fa80e12928bb542330e8409f31745041"
  755. "07ecd5efac61ae7504dabe2a602ede89"
  756. "e5cca6257a7c77e27a702b3ae39fc769"
  757. "fc54f2395ae6a1178cab4738e543072f"
  758. "c1c177fe71e92e25bf03e4ecb72f47b6"
  759. "4d0465aaea4c7fad372536c8ba516a60"
  760. "39c3c2a39f0e4d832be432dfa9a706a6"
  761. "e5c7e19f397964ca4258002f7c0541b5"
  762. "90316dbc5622b6b2a6fe7a4abffd9610"
  763. "5eca76ea7b98816af0748c10df048ce0"
  764. "12d901015a51f189f3888145c03650aa"
  765. "23ce894c3bd889e030d565071c59f409"
  766. "a9981b51878fd6fc110624dcbcde0bf7"
  767. "a69ccce38fabdf86f3bef6044819de11",
  768. "c650ddbb0601c19ca11439e1640dd931"
  769. "f43c518ea5bea70d3dcde5f4191fe53f"
  770. "00cf966546b72bcc7d58be2b9badef28"
  771. "743954e3a44a23f880e8d4f1cfce2d7a"
  772. "61452d26da05896f0a50da66a239a8a1"
  773. "88b6d825b3305ad77b73fbac0836ecc6"
  774. "0987fd08527c1a8e80d5823e65cafe2a"
  775. "3d00",
  776. ),
  777. # 1023 octets
  778. (
  779. generator_ed448,
  780. "872d093780f5d3730df7c212664b37b8"
  781. "a0f24f56810daa8382cd4fa3f77634ec"
  782. "44dc54f1c2ed9bea86fafb7632d8be19"
  783. "9ea165f5ad55dd9ce8",
  784. "a81b2e8a70a5ac94ffdbcc9badfc3feb"
  785. "0801f258578bb114ad44ece1ec0e799d"
  786. "a08effb81c5d685c0c56f64eecaef8cd"
  787. "f11cc38737838cf400",
  788. "6ddf802e1aae4986935f7f981ba3f035"
  789. "1d6273c0a0c22c9c0e8339168e675412"
  790. "a3debfaf435ed651558007db4384b650"
  791. "fcc07e3b586a27a4f7a00ac8a6fec2cd"
  792. "86ae4bf1570c41e6a40c931db27b2faa"
  793. "15a8cedd52cff7362c4e6e23daec0fbc"
  794. "3a79b6806e316efcc7b68119bf46bc76"
  795. "a26067a53f296dafdbdc11c77f7777e9"
  796. "72660cf4b6a9b369a6665f02e0cc9b6e"
  797. "dfad136b4fabe723d2813db3136cfde9"
  798. "b6d044322fee2947952e031b73ab5c60"
  799. "3349b307bdc27bc6cb8b8bbd7bd32321"
  800. "9b8033a581b59eadebb09b3c4f3d2277"
  801. "d4f0343624acc817804728b25ab79717"
  802. "2b4c5c21a22f9c7839d64300232eb66e"
  803. "53f31c723fa37fe387c7d3e50bdf9813"
  804. "a30e5bb12cf4cd930c40cfb4e1fc6225"
  805. "92a49588794494d56d24ea4b40c89fc0"
  806. "596cc9ebb961c8cb10adde976a5d602b"
  807. "1c3f85b9b9a001ed3c6a4d3b1437f520"
  808. "96cd1956d042a597d561a596ecd3d173"
  809. "5a8d570ea0ec27225a2c4aaff26306d1"
  810. "526c1af3ca6d9cf5a2c98f47e1c46db9"
  811. "a33234cfd4d81f2c98538a09ebe76998"
  812. "d0d8fd25997c7d255c6d66ece6fa56f1"
  813. "1144950f027795e653008f4bd7ca2dee"
  814. "85d8e90f3dc315130ce2a00375a318c7"
  815. "c3d97be2c8ce5b6db41a6254ff264fa6"
  816. "155baee3b0773c0f497c573f19bb4f42"
  817. "40281f0b1f4f7be857a4e59d416c06b4"
  818. "c50fa09e1810ddc6b1467baeac5a3668"
  819. "d11b6ecaa901440016f389f80acc4db9"
  820. "77025e7f5924388c7e340a732e554440"
  821. "e76570f8dd71b7d640b3450d1fd5f041"
  822. "0a18f9a3494f707c717b79b4bf75c984"
  823. "00b096b21653b5d217cf3565c9597456"
  824. "f70703497a078763829bc01bb1cbc8fa"
  825. "04eadc9a6e3f6699587a9e75c94e5bab"
  826. "0036e0b2e711392cff0047d0d6b05bd2"
  827. "a588bc109718954259f1d86678a579a3"
  828. "120f19cfb2963f177aeb70f2d4844826"
  829. "262e51b80271272068ef5b3856fa8535"
  830. "aa2a88b2d41f2a0e2fda7624c2850272"
  831. "ac4a2f561f8f2f7a318bfd5caf969614"
  832. "9e4ac824ad3460538fdc25421beec2cc"
  833. "6818162d06bbed0c40a387192349db67"
  834. "a118bada6cd5ab0140ee273204f628aa"
  835. "d1c135f770279a651e24d8c14d75a605"
  836. "9d76b96a6fd857def5e0b354b27ab937"
  837. "a5815d16b5fae407ff18222c6d1ed263"
  838. "be68c95f32d908bd895cd76207ae7264"
  839. "87567f9a67dad79abec316f683b17f2d"
  840. "02bf07e0ac8b5bc6162cf94697b3c27c"
  841. "d1fea49b27f23ba2901871962506520c"
  842. "392da8b6ad0d99f7013fbc06c2c17a56"
  843. "9500c8a7696481c1cd33e9b14e40b82e"
  844. "79a5f5db82571ba97bae3ad3e0479515"
  845. "bb0e2b0f3bfcd1fd33034efc6245eddd"
  846. "7ee2086ddae2600d8ca73e214e8c2b0b"
  847. "db2b047c6a464a562ed77b73d2d841c4"
  848. "b34973551257713b753632efba348169"
  849. "abc90a68f42611a40126d7cb21b58695"
  850. "568186f7e569d2ff0f9e745d0487dd2e"
  851. "b997cafc5abf9dd102e62ff66cba87",
  852. "e301345a41a39a4d72fff8df69c98075"
  853. "a0cc082b802fc9b2b6bc503f926b65bd"
  854. "df7f4c8f1cb49f6396afc8a70abe6d8a"
  855. "ef0db478d4c6b2970076c6a0484fe76d"
  856. "76b3a97625d79f1ce240e7c576750d29"
  857. "5528286f719b413de9ada3e8eb78ed57"
  858. "3603ce30d8bb761785dc30dbc320869e"
  859. "1a00",
  860. ),
  861. ]
  862. @pytest.mark.parametrize(
  863. "generator,private_key,public_key,message,signature",
  864. TEST_VECTORS,
  865. )
  866. def test_vectors(generator, private_key, public_key, message, signature):
  867. private_key = a2b_hex(private_key)
  868. public_key = a2b_hex(public_key)
  869. message = a2b_hex(message)
  870. signature = a2b_hex(signature)
  871. sig_key = PrivateKey(generator, private_key)
  872. ver_key = PublicKey(generator, public_key)
  873. assert sig_key.public_key().public_key() == ver_key.public_key()
  874. gen_sig = sig_key.sign(message)
  875. assert gen_sig == signature
  876. assert ver_key.verify(message, signature)