linux/lib/crypto/curve25519-selftest.c
<<
>>
Prefs
   1// SPDX-License-Identifier: GPL-2.0 OR MIT
   2/*
   3 * Copyright (C) 2015-2019 Jason A. Donenfeld <Jason@zx2c4.com>. All Rights Reserved.
   4 */
   5
   6#include <crypto/curve25519.h>
   7
   8struct curve25519_test_vector {
   9        u8 private[CURVE25519_KEY_SIZE];
  10        u8 public[CURVE25519_KEY_SIZE];
  11        u8 result[CURVE25519_KEY_SIZE];
  12        bool valid;
  13};
  14static const struct curve25519_test_vector curve25519_test_vectors[] __initconst = {
  15        {
  16                .private = { 0x77, 0x07, 0x6d, 0x0a, 0x73, 0x18, 0xa5, 0x7d,
  17                             0x3c, 0x16, 0xc1, 0x72, 0x51, 0xb2, 0x66, 0x45,
  18                             0xdf, 0x4c, 0x2f, 0x87, 0xeb, 0xc0, 0x99, 0x2a,
  19                             0xb1, 0x77, 0xfb, 0xa5, 0x1d, 0xb9, 0x2c, 0x2a },
  20                .public = { 0xde, 0x9e, 0xdb, 0x7d, 0x7b, 0x7d, 0xc1, 0xb4,
  21                            0xd3, 0x5b, 0x61, 0xc2, 0xec, 0xe4, 0x35, 0x37,
  22                            0x3f, 0x83, 0x43, 0xc8, 0x5b, 0x78, 0x67, 0x4d,
  23                            0xad, 0xfc, 0x7e, 0x14, 0x6f, 0x88, 0x2b, 0x4f },
  24                .result = { 0x4a, 0x5d, 0x9d, 0x5b, 0xa4, 0xce, 0x2d, 0xe1,
  25                            0x72, 0x8e, 0x3b, 0xf4, 0x80, 0x35, 0x0f, 0x25,
  26                            0xe0, 0x7e, 0x21, 0xc9, 0x47, 0xd1, 0x9e, 0x33,
  27                            0x76, 0xf0, 0x9b, 0x3c, 0x1e, 0x16, 0x17, 0x42 },
  28                .valid = true
  29        },
  30        {
  31                .private = { 0x5d, 0xab, 0x08, 0x7e, 0x62, 0x4a, 0x8a, 0x4b,
  32                             0x79, 0xe1, 0x7f, 0x8b, 0x83, 0x80, 0x0e, 0xe6,
  33                             0x6f, 0x3b, 0xb1, 0x29, 0x26, 0x18, 0xb6, 0xfd,
  34                             0x1c, 0x2f, 0x8b, 0x27, 0xff, 0x88, 0xe0, 0xeb },
  35                .public = { 0x85, 0x20, 0xf0, 0x09, 0x89, 0x30, 0xa7, 0x54,
  36                            0x74, 0x8b, 0x7d, 0xdc, 0xb4, 0x3e, 0xf7, 0x5a,
  37                            0x0d, 0xbf, 0x3a, 0x0d, 0x26, 0x38, 0x1a, 0xf4,
  38                            0xeb, 0xa4, 0xa9, 0x8e, 0xaa, 0x9b, 0x4e, 0x6a },
  39                .result = { 0x4a, 0x5d, 0x9d, 0x5b, 0xa4, 0xce, 0x2d, 0xe1,
  40                            0x72, 0x8e, 0x3b, 0xf4, 0x80, 0x35, 0x0f, 0x25,
  41                            0xe0, 0x7e, 0x21, 0xc9, 0x47, 0xd1, 0x9e, 0x33,
  42                            0x76, 0xf0, 0x9b, 0x3c, 0x1e, 0x16, 0x17, 0x42 },
  43                .valid = true
  44        },
  45        {
  46                .private = { 1 },
  47                .public = { 0x25, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
  48                            0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
  49                            0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
  50                            0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 },
  51                .result = { 0x3c, 0x77, 0x77, 0xca, 0xf9, 0x97, 0xb2, 0x64,
  52                            0x41, 0x60, 0x77, 0x66, 0x5b, 0x4e, 0x22, 0x9d,
  53                            0x0b, 0x95, 0x48, 0xdc, 0x0c, 0xd8, 0x19, 0x98,
  54                            0xdd, 0xcd, 0xc5, 0xc8, 0x53, 0x3c, 0x79, 0x7f },
  55                .valid = true
  56        },
  57        {
  58                .private = { 1 },
  59                .public = { 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
  60                            0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
  61                            0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
  62                            0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff },
  63                .result = { 0xb3, 0x2d, 0x13, 0x62, 0xc2, 0x48, 0xd6, 0x2f,
  64                            0xe6, 0x26, 0x19, 0xcf, 0xf0, 0x4d, 0xd4, 0x3d,
  65                            0xb7, 0x3f, 0xfc, 0x1b, 0x63, 0x08, 0xed, 0xe3,
  66                            0x0b, 0x78, 0xd8, 0x73, 0x80, 0xf1, 0xe8, 0x34 },
  67                .valid = true
  68        },
  69        {
  70                .private = { 0xa5, 0x46, 0xe3, 0x6b, 0xf0, 0x52, 0x7c, 0x9d,
  71                             0x3b, 0x16, 0x15, 0x4b, 0x82, 0x46, 0x5e, 0xdd,
  72                             0x62, 0x14, 0x4c, 0x0a, 0xc1, 0xfc, 0x5a, 0x18,
  73                             0x50, 0x6a, 0x22, 0x44, 0xba, 0x44, 0x9a, 0xc4 },
  74                .public = { 0xe6, 0xdb, 0x68, 0x67, 0x58, 0x30, 0x30, 0xdb,
  75                            0x35, 0x94, 0xc1, 0xa4, 0x24, 0xb1, 0x5f, 0x7c,
  76                            0x72, 0x66, 0x24, 0xec, 0x26, 0xb3, 0x35, 0x3b,
  77                            0x10, 0xa9, 0x03, 0xa6, 0xd0, 0xab, 0x1c, 0x4c },
  78                .result = { 0xc3, 0xda, 0x55, 0x37, 0x9d, 0xe9, 0xc6, 0x90,
  79                            0x8e, 0x94, 0xea, 0x4d, 0xf2, 0x8d, 0x08, 0x4f,
  80                            0x32, 0xec, 0xcf, 0x03, 0x49, 0x1c, 0x71, 0xf7,
  81                            0x54, 0xb4, 0x07, 0x55, 0x77, 0xa2, 0x85, 0x52 },
  82                .valid = true
  83        },
  84        {
  85                .private = { 1, 2, 3, 4 },
  86                .public = { 0 },
  87                .result = { 0 },
  88                .valid = false
  89        },
  90        {
  91                .private = { 2, 4, 6, 8 },
  92                .public = { 0xe0, 0xeb, 0x7a, 0x7c, 0x3b, 0x41, 0xb8, 0xae,
  93                            0x16, 0x56, 0xe3, 0xfa, 0xf1, 0x9f, 0xc4, 0x6a,
  94                            0xda, 0x09, 0x8d, 0xeb, 0x9c, 0x32, 0xb1, 0xfd,
  95                            0x86, 0x62, 0x05, 0x16, 0x5f, 0x49, 0xb8 },
  96                .result = { 0 },
  97                .valid = false
  98        },
  99        {
 100                .private = { 0xff, 0xff, 0xff, 0xff, 0x0a, 0xff, 0xff, 0xff,
 101                             0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
 102                             0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
 103                             0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff },
 104                .public = { 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
 105                            0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
 106                            0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
 107                            0xff, 0xff, 0xff, 0xff, 0x0a, 0x00, 0xfb, 0x9f },
 108                .result = { 0x77, 0x52, 0xb6, 0x18, 0xc1, 0x2d, 0x48, 0xd2,
 109                            0xc6, 0x93, 0x46, 0x83, 0x81, 0x7c, 0xc6, 0x57,
 110                            0xf3, 0x31, 0x03, 0x19, 0x49, 0x48, 0x20, 0x05,
 111                            0x42, 0x2b, 0x4e, 0xae, 0x8d, 0x1d, 0x43, 0x23 },
 112                .valid = true
 113        },
 114        {
 115                .private = { 0x8e, 0x0a, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 116                             0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 117                             0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 118                             0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 },
 119                .public = { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 120                            0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 121                            0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 122                            0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x8e, 0x06 },
 123                .result = { 0x5a, 0xdf, 0xaa, 0x25, 0x86, 0x8e, 0x32, 0x3d,
 124                            0xae, 0x49, 0x62, 0xc1, 0x01, 0x5c, 0xb3, 0x12,
 125                            0xe1, 0xc5, 0xc7, 0x9e, 0x95, 0x3f, 0x03, 0x99,
 126                            0xb0, 0xba, 0x16, 0x22, 0xf3, 0xb6, 0xf7, 0x0c },
 127                .valid = true
 128        },
 129        /* wycheproof - normal case */
 130        {
 131                .private = { 0x48, 0x52, 0x83, 0x4d, 0x9d, 0x6b, 0x77, 0xda,
 132                             0xde, 0xab, 0xaa, 0xf2, 0xe1, 0x1d, 0xca, 0x66,
 133                             0xd1, 0x9f, 0xe7, 0x49, 0x93, 0xa7, 0xbe, 0xc3,
 134                             0x6c, 0x6e, 0x16, 0xa0, 0x98, 0x3f, 0xea, 0xba },
 135                .public = { 0x9c, 0x64, 0x7d, 0x9a, 0xe5, 0x89, 0xb9, 0xf5,
 136                            0x8f, 0xdc, 0x3c, 0xa4, 0x94, 0x7e, 0xfb, 0xc9,
 137                            0x15, 0xc4, 0xb2, 0xe0, 0x8e, 0x74, 0x4a, 0x0e,
 138                            0xdf, 0x46, 0x9d, 0xac, 0x59, 0xc8, 0xf8, 0x5a },
 139                .result = { 0x87, 0xb7, 0xf2, 0x12, 0xb6, 0x27, 0xf7, 0xa5,
 140                            0x4c, 0xa5, 0xe0, 0xbc, 0xda, 0xdd, 0xd5, 0x38,
 141                            0x9d, 0x9d, 0xe6, 0x15, 0x6c, 0xdb, 0xcf, 0x8e,
 142                            0xbe, 0x14, 0xff, 0xbc, 0xfb, 0x43, 0x65, 0x51 },
 143                .valid = true
 144        },
 145        /* wycheproof - public key on twist */
 146        {
 147                .private = { 0x58, 0x8c, 0x06, 0x1a, 0x50, 0x80, 0x4a, 0xc4,
 148                             0x88, 0xad, 0x77, 0x4a, 0xc7, 0x16, 0xc3, 0xf5,
 149                             0xba, 0x71, 0x4b, 0x27, 0x12, 0xe0, 0x48, 0x49,
 150                             0x13, 0x79, 0xa5, 0x00, 0x21, 0x19, 0x98, 0xa8 },
 151                .public = { 0x63, 0xaa, 0x40, 0xc6, 0xe3, 0x83, 0x46, 0xc5,
 152                            0xca, 0xf2, 0x3a, 0x6d, 0xf0, 0xa5, 0xe6, 0xc8,
 153                            0x08, 0x89, 0xa0, 0x86, 0x47, 0xe5, 0x51, 0xb3,
 154                            0x56, 0x34, 0x49, 0xbe, 0xfc, 0xfc, 0x97, 0x33 },
 155                .result = { 0xb1, 0xa7, 0x07, 0x51, 0x94, 0x95, 0xff, 0xff,
 156                            0xb2, 0x98, 0xff, 0x94, 0x17, 0x16, 0xb0, 0x6d,
 157                            0xfa, 0xb8, 0x7c, 0xf8, 0xd9, 0x11, 0x23, 0xfe,
 158                            0x2b, 0xe9, 0xa2, 0x33, 0xdd, 0xa2, 0x22, 0x12 },
 159                .valid = true
 160        },
 161        /* wycheproof - public key on twist */
 162        {
 163                .private = { 0xb0, 0x5b, 0xfd, 0x32, 0xe5, 0x53, 0x25, 0xd9,
 164                             0xfd, 0x64, 0x8c, 0xb3, 0x02, 0x84, 0x80, 0x39,
 165                             0x00, 0x0b, 0x39, 0x0e, 0x44, 0xd5, 0x21, 0xe5,
 166                             0x8a, 0xab, 0x3b, 0x29, 0xa6, 0x96, 0x0b, 0xa8 },
 167                .public = { 0x0f, 0x83, 0xc3, 0x6f, 0xde, 0xd9, 0xd3, 0x2f,
 168                            0xad, 0xf4, 0xef, 0xa3, 0xae, 0x93, 0xa9, 0x0b,
 169                            0xb5, 0xcf, 0xa6, 0x68, 0x93, 0xbc, 0x41, 0x2c,
 170                            0x43, 0xfa, 0x72, 0x87, 0xdb, 0xb9, 0x97, 0x79 },
 171                .result = { 0x67, 0xdd, 0x4a, 0x6e, 0x16, 0x55, 0x33, 0x53,
 172                            0x4c, 0x0e, 0x3f, 0x17, 0x2e, 0x4a, 0xb8, 0x57,
 173                            0x6b, 0xca, 0x92, 0x3a, 0x5f, 0x07, 0xb2, 0xc0,
 174                            0x69, 0xb4, 0xc3, 0x10, 0xff, 0x2e, 0x93, 0x5b },
 175                .valid = true
 176        },
 177        /* wycheproof - public key on twist */
 178        {
 179                .private = { 0x70, 0xe3, 0x4b, 0xcb, 0xe1, 0xf4, 0x7f, 0xbc,
 180                             0x0f, 0xdd, 0xfd, 0x7c, 0x1e, 0x1a, 0xa5, 0x3d,
 181                             0x57, 0xbf, 0xe0, 0xf6, 0x6d, 0x24, 0x30, 0x67,
 182                             0xb4, 0x24, 0xbb, 0x62, 0x10, 0xbe, 0xd1, 0x9c },
 183                .public = { 0x0b, 0x82, 0x11, 0xa2, 0xb6, 0x04, 0x90, 0x97,
 184                            0xf6, 0x87, 0x1c, 0x6c, 0x05, 0x2d, 0x3c, 0x5f,
 185                            0xc1, 0xba, 0x17, 0xda, 0x9e, 0x32, 0xae, 0x45,
 186                            0x84, 0x03, 0xb0, 0x5b, 0xb2, 0x83, 0x09, 0x2a },
 187                .result = { 0x4a, 0x06, 0x38, 0xcf, 0xaa, 0x9e, 0xf1, 0x93,
 188                            0x3b, 0x47, 0xf8, 0x93, 0x92, 0x96, 0xa6, 0xb2,
 189                            0x5b, 0xe5, 0x41, 0xef, 0x7f, 0x70, 0xe8, 0x44,
 190                            0xc0, 0xbc, 0xc0, 0x0b, 0x13, 0x4d, 0xe6, 0x4a },
 191                .valid = true
 192        },
 193        /* wycheproof - public key on twist */
 194        {
 195                .private = { 0x68, 0xc1, 0xf3, 0xa6, 0x53, 0xa4, 0xcd, 0xb1,
 196                             0xd3, 0x7b, 0xba, 0x94, 0x73, 0x8f, 0x8b, 0x95,
 197                             0x7a, 0x57, 0xbe, 0xb2, 0x4d, 0x64, 0x6e, 0x99,
 198                             0x4d, 0xc2, 0x9a, 0x27, 0x6a, 0xad, 0x45, 0x8d },
 199                .public = { 0x34, 0x3a, 0xc2, 0x0a, 0x3b, 0x9c, 0x6a, 0x27,
 200                            0xb1, 0x00, 0x81, 0x76, 0x50, 0x9a, 0xd3, 0x07,
 201                            0x35, 0x85, 0x6e, 0xc1, 0xc8, 0xd8, 0xfc, 0xae,
 202                            0x13, 0x91, 0x2d, 0x08, 0xd1, 0x52, 0xf4, 0x6c },
 203                .result = { 0x39, 0x94, 0x91, 0xfc, 0xe8, 0xdf, 0xab, 0x73,
 204                            0xb4, 0xf9, 0xf6, 0x11, 0xde, 0x8e, 0xa0, 0xb2,
 205                            0x7b, 0x28, 0xf8, 0x59, 0x94, 0x25, 0x0b, 0x0f,
 206                            0x47, 0x5d, 0x58, 0x5d, 0x04, 0x2a, 0xc2, 0x07 },
 207                .valid = true
 208        },
 209        /* wycheproof - public key on twist */
 210        {
 211                .private = { 0xd8, 0x77, 0xb2, 0x6d, 0x06, 0xdf, 0xf9, 0xd9,
 212                             0xf7, 0xfd, 0x4c, 0x5b, 0x37, 0x69, 0xf8, 0xcd,
 213                             0xd5, 0xb3, 0x05, 0x16, 0xa5, 0xab, 0x80, 0x6b,
 214                             0xe3, 0x24, 0xff, 0x3e, 0xb6, 0x9e, 0xa0, 0xb2 },
 215                .public = { 0xfa, 0x69, 0x5f, 0xc7, 0xbe, 0x8d, 0x1b, 0xe5,
 216                            0xbf, 0x70, 0x48, 0x98, 0xf3, 0x88, 0xc4, 0x52,
 217                            0xba, 0xfd, 0xd3, 0xb8, 0xea, 0xe8, 0x05, 0xf8,
 218                            0x68, 0x1a, 0x8d, 0x15, 0xc2, 0xd4, 0xe1, 0x42 },
 219                .result = { 0x2c, 0x4f, 0xe1, 0x1d, 0x49, 0x0a, 0x53, 0x86,
 220                            0x17, 0x76, 0xb1, 0x3b, 0x43, 0x54, 0xab, 0xd4,
 221                            0xcf, 0x5a, 0x97, 0x69, 0x9d, 0xb6, 0xe6, 0xc6,
 222                            0x8c, 0x16, 0x26, 0xd0, 0x76, 0x62, 0xf7, 0x58 },
 223                .valid = true
 224        },
 225        /* wycheproof - public key = 0 */
 226        {
 227                .private = { 0x20, 0x74, 0x94, 0x03, 0x8f, 0x2b, 0xb8, 0x11,
 228                             0xd4, 0x78, 0x05, 0xbc, 0xdf, 0x04, 0xa2, 0xac,
 229                             0x58, 0x5a, 0xda, 0x7f, 0x2f, 0x23, 0x38, 0x9b,
 230                             0xfd, 0x46, 0x58, 0xf9, 0xdd, 0xd4, 0xde, 0xbc },
 231                .public = { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 232                            0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 233                            0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 234                            0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 },
 235                .result = { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 236                            0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 237                            0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 238                            0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 },
 239                .valid = false
 240        },
 241        /* wycheproof - public key = 1 */
 242        {
 243                .private = { 0x20, 0x2e, 0x89, 0x72, 0xb6, 0x1c, 0x7e, 0x61,
 244                             0x93, 0x0e, 0xb9, 0x45, 0x0b, 0x50, 0x70, 0xea,
 245                             0xe1, 0xc6, 0x70, 0x47, 0x56, 0x85, 0x54, 0x1f,
 246                             0x04, 0x76, 0x21, 0x7e, 0x48, 0x18, 0xcf, 0xab },
 247                .public = { 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 248                            0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 249                            0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 250                            0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 },
 251                .result = { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 252                            0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 253                            0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 254                            0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 },
 255                .valid = false
 256        },
 257        /* wycheproof - edge case on twist */
 258        {
 259                .private = { 0x38, 0xdd, 0xe9, 0xf3, 0xe7, 0xb7, 0x99, 0x04,
 260                             0x5f, 0x9a, 0xc3, 0x79, 0x3d, 0x4a, 0x92, 0x77,
 261                             0xda, 0xde, 0xad, 0xc4, 0x1b, 0xec, 0x02, 0x90,
 262                             0xf8, 0x1f, 0x74, 0x4f, 0x73, 0x77, 0x5f, 0x84 },
 263                .public = { 0x02, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 264                            0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 265                            0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 266                            0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 },
 267                .result = { 0x9a, 0x2c, 0xfe, 0x84, 0xff, 0x9c, 0x4a, 0x97,
 268                            0x39, 0x62, 0x5c, 0xae, 0x4a, 0x3b, 0x82, 0xa9,
 269                            0x06, 0x87, 0x7a, 0x44, 0x19, 0x46, 0xf8, 0xd7,
 270                            0xb3, 0xd7, 0x95, 0xfe, 0x8f, 0x5d, 0x16, 0x39 },
 271                .valid = true
 272        },
 273        /* wycheproof - edge case on twist */
 274        {
 275                .private = { 0x98, 0x57, 0xa9, 0x14, 0xe3, 0xc2, 0x90, 0x36,
 276                             0xfd, 0x9a, 0x44, 0x2b, 0xa5, 0x26, 0xb5, 0xcd,
 277                             0xcd, 0xf2, 0x82, 0x16, 0x15, 0x3e, 0x63, 0x6c,
 278                             0x10, 0x67, 0x7a, 0xca, 0xb6, 0xbd, 0x6a, 0xa5 },
 279                .public = { 0x03, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 280                            0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 281                            0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 282                            0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 },
 283                .result = { 0x4d, 0xa4, 0xe0, 0xaa, 0x07, 0x2c, 0x23, 0x2e,
 284                            0xe2, 0xf0, 0xfa, 0x4e, 0x51, 0x9a, 0xe5, 0x0b,
 285                            0x52, 0xc1, 0xed, 0xd0, 0x8a, 0x53, 0x4d, 0x4e,
 286                            0xf3, 0x46, 0xc2, 0xe1, 0x06, 0xd2, 0x1d, 0x60 },
 287                .valid = true
 288        },
 289        /* wycheproof - edge case on twist */
 290        {
 291                .private = { 0x48, 0xe2, 0x13, 0x0d, 0x72, 0x33, 0x05, 0xed,
 292                             0x05, 0xe6, 0xe5, 0x89, 0x4d, 0x39, 0x8a, 0x5e,
 293                             0x33, 0x36, 0x7a, 0x8c, 0x6a, 0xac, 0x8f, 0xcd,
 294                             0xf0, 0xa8, 0x8e, 0x4b, 0x42, 0x82, 0x0d, 0xb7 },
 295                .public = { 0xff, 0xff, 0xff, 0x03, 0x00, 0x00, 0xf8, 0xff,
 296                            0xff, 0x1f, 0x00, 0x00, 0xc0, 0xff, 0xff, 0xff,
 297                            0x00, 0x00, 0x00, 0xfe, 0xff, 0xff, 0x07, 0x00,
 298                            0x00, 0xf0, 0xff, 0xff, 0x3f, 0x00, 0x00, 0x00 },
 299                .result = { 0x9e, 0xd1, 0x0c, 0x53, 0x74, 0x7f, 0x64, 0x7f,
 300                            0x82, 0xf4, 0x51, 0x25, 0xd3, 0xde, 0x15, 0xa1,
 301                            0xe6, 0xb8, 0x24, 0x49, 0x6a, 0xb4, 0x04, 0x10,
 302                            0xff, 0xcc, 0x3c, 0xfe, 0x95, 0x76, 0x0f, 0x3b },
 303                .valid = true
 304        },
 305        /* wycheproof - edge case on twist */
 306        {
 307                .private = { 0x28, 0xf4, 0x10, 0x11, 0x69, 0x18, 0x51, 0xb3,
 308                             0xa6, 0x2b, 0x64, 0x15, 0x53, 0xb3, 0x0d, 0x0d,
 309                             0xfd, 0xdc, 0xb8, 0xff, 0xfc, 0xf5, 0x37, 0x00,
 310                             0xa7, 0xbe, 0x2f, 0x6a, 0x87, 0x2e, 0x9f, 0xb0 },
 311                .public = { 0x00, 0x00, 0x00, 0xfc, 0xff, 0xff, 0x07, 0x00,
 312                            0x00, 0xe0, 0xff, 0xff, 0x3f, 0x00, 0x00, 0x00,
 313                            0xff, 0xff, 0xff, 0x01, 0x00, 0x00, 0xf8, 0xff,
 314                            0xff, 0x0f, 0x00, 0x00, 0xc0, 0xff, 0xff, 0x7f },
 315                .result = { 0xcf, 0x72, 0xb4, 0xaa, 0x6a, 0xa1, 0xc9, 0xf8,
 316                            0x94, 0xf4, 0x16, 0x5b, 0x86, 0x10, 0x9a, 0xa4,
 317                            0x68, 0x51, 0x76, 0x48, 0xe1, 0xf0, 0xcc, 0x70,
 318                            0xe1, 0xab, 0x08, 0x46, 0x01, 0x76, 0x50, 0x6b },
 319                .valid = true
 320        },
 321        /* wycheproof - edge case on twist */
 322        {
 323                .private = { 0x18, 0xa9, 0x3b, 0x64, 0x99, 0xb9, 0xf6, 0xb3,
 324                             0x22, 0x5c, 0xa0, 0x2f, 0xef, 0x41, 0x0e, 0x0a,
 325                             0xde, 0xc2, 0x35, 0x32, 0x32, 0x1d, 0x2d, 0x8e,
 326                             0xf1, 0xa6, 0xd6, 0x02, 0xa8, 0xc6, 0x5b, 0x83 },
 327                .public = { 0x00, 0x00, 0x00, 0x00, 0xff, 0xff, 0xff, 0xff,
 328                            0x00, 0x00, 0x00, 0x00, 0xff, 0xff, 0xff, 0xff,
 329                            0x00, 0x00, 0x00, 0x00, 0xff, 0xff, 0xff, 0xff,
 330                            0x00, 0x00, 0x00, 0x00, 0xff, 0xff, 0xff, 0x7f },
 331                .result = { 0x5d, 0x50, 0xb6, 0x28, 0x36, 0xbb, 0x69, 0x57,
 332                            0x94, 0x10, 0x38, 0x6c, 0xf7, 0xbb, 0x81, 0x1c,
 333                            0x14, 0xbf, 0x85, 0xb1, 0xc7, 0xb1, 0x7e, 0x59,
 334                            0x24, 0xc7, 0xff, 0xea, 0x91, 0xef, 0x9e, 0x12 },
 335                .valid = true
 336        },
 337        /* wycheproof - edge case on twist */
 338        {
 339                .private = { 0xc0, 0x1d, 0x13, 0x05, 0xa1, 0x33, 0x8a, 0x1f,
 340                             0xca, 0xc2, 0xba, 0x7e, 0x2e, 0x03, 0x2b, 0x42,
 341                             0x7e, 0x0b, 0x04, 0x90, 0x31, 0x65, 0xac, 0xa9,
 342                             0x57, 0xd8, 0xd0, 0x55, 0x3d, 0x87, 0x17, 0xb0 },
 343                .public = { 0xea, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
 344                            0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
 345                            0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
 346                            0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x7f },
 347                .result = { 0x19, 0x23, 0x0e, 0xb1, 0x48, 0xd5, 0xd6, 0x7c,
 348                            0x3c, 0x22, 0xab, 0x1d, 0xae, 0xff, 0x80, 0xa5,
 349                            0x7e, 0xae, 0x42, 0x65, 0xce, 0x28, 0x72, 0x65,
 350                            0x7b, 0x2c, 0x80, 0x99, 0xfc, 0x69, 0x8e, 0x50 },
 351                .valid = true
 352        },
 353        /* wycheproof - edge case for public key */
 354        {
 355                .private = { 0x38, 0x6f, 0x7f, 0x16, 0xc5, 0x07, 0x31, 0xd6,
 356                             0x4f, 0x82, 0xe6, 0xa1, 0x70, 0xb1, 0x42, 0xa4,
 357                             0xe3, 0x4f, 0x31, 0xfd, 0x77, 0x68, 0xfc, 0xb8,
 358                             0x90, 0x29, 0x25, 0xe7, 0xd1, 0xe2, 0x1a, 0xbe },
 359                .public = { 0x04, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 360                            0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 361                            0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 362                            0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 },
 363                .result = { 0x0f, 0xca, 0xb5, 0xd8, 0x42, 0xa0, 0x78, 0xd7,
 364                            0xa7, 0x1f, 0xc5, 0x9b, 0x57, 0xbf, 0xb4, 0xca,
 365                            0x0b, 0xe6, 0x87, 0x3b, 0x49, 0xdc, 0xdb, 0x9f,
 366                            0x44, 0xe1, 0x4a, 0xe8, 0xfb, 0xdf, 0xa5, 0x42 },
 367                .valid = true
 368        },
 369        /* wycheproof - edge case for public key */
 370        {
 371                .private = { 0xe0, 0x23, 0xa2, 0x89, 0xbd, 0x5e, 0x90, 0xfa,
 372                             0x28, 0x04, 0xdd, 0xc0, 0x19, 0xa0, 0x5e, 0xf3,
 373                             0xe7, 0x9d, 0x43, 0x4b, 0xb6, 0xea, 0x2f, 0x52,
 374                             0x2e, 0xcb, 0x64, 0x3a, 0x75, 0x29, 0x6e, 0x95 },
 375                .public = { 0xff, 0xff, 0xff, 0xff, 0x00, 0x00, 0x00, 0x00,
 376                            0xff, 0xff, 0xff, 0xff, 0x00, 0x00, 0x00, 0x00,
 377                            0xff, 0xff, 0xff, 0xff, 0x00, 0x00, 0x00, 0x00,
 378                            0xff, 0xff, 0xff, 0xff, 0x00, 0x00, 0x00, 0x00 },
 379                .result = { 0x54, 0xce, 0x8f, 0x22, 0x75, 0xc0, 0x77, 0xe3,
 380                            0xb1, 0x30, 0x6a, 0x39, 0x39, 0xc5, 0xe0, 0x3e,
 381                            0xef, 0x6b, 0xbb, 0x88, 0x06, 0x05, 0x44, 0x75,
 382                            0x8d, 0x9f, 0xef, 0x59, 0xb0, 0xbc, 0x3e, 0x4f },
 383                .valid = true
 384        },
 385        /* wycheproof - edge case for public key */
 386        {
 387                .private = { 0x68, 0xf0, 0x10, 0xd6, 0x2e, 0xe8, 0xd9, 0x26,
 388                             0x05, 0x3a, 0x36, 0x1c, 0x3a, 0x75, 0xc6, 0xea,
 389                             0x4e, 0xbd, 0xc8, 0x60, 0x6a, 0xb2, 0x85, 0x00,
 390                             0x3a, 0x6f, 0x8f, 0x40, 0x76, 0xb0, 0x1e, 0x83 },
 391                .public = { 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
 392                            0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
 393                            0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
 394                            0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x03 },
 395                .result = { 0xf1, 0x36, 0x77, 0x5c, 0x5b, 0xeb, 0x0a, 0xf8,
 396                            0x11, 0x0a, 0xf1, 0x0b, 0x20, 0x37, 0x23, 0x32,
 397                            0x04, 0x3c, 0xab, 0x75, 0x24, 0x19, 0x67, 0x87,
 398                            0x75, 0xa2, 0x23, 0xdf, 0x57, 0xc9, 0xd3, 0x0d },
 399                .valid = true
 400        },
 401        /* wycheproof - edge case for public key */
 402        {
 403                .private = { 0x58, 0xeb, 0xcb, 0x35, 0xb0, 0xf8, 0x84, 0x5c,
 404                             0xaf, 0x1e, 0xc6, 0x30, 0xf9, 0x65, 0x76, 0xb6,
 405                             0x2c, 0x4b, 0x7b, 0x6c, 0x36, 0xb2, 0x9d, 0xeb,
 406                             0x2c, 0xb0, 0x08, 0x46, 0x51, 0x75, 0x5c, 0x96 },
 407                .public = { 0xff, 0xff, 0xff, 0xfb, 0xff, 0xff, 0xfb, 0xff,
 408                            0xff, 0xdf, 0xff, 0xff, 0xdf, 0xff, 0xff, 0xff,
 409                            0xfe, 0xff, 0xff, 0xfe, 0xff, 0xff, 0xf7, 0xff,
 410                            0xff, 0xf7, 0xff, 0xff, 0xbf, 0xff, 0xff, 0x3f },
 411                .result = { 0xbf, 0x9a, 0xff, 0xd0, 0x6b, 0x84, 0x40, 0x85,
 412                            0x58, 0x64, 0x60, 0x96, 0x2e, 0xf2, 0x14, 0x6f,
 413                            0xf3, 0xd4, 0x53, 0x3d, 0x94, 0x44, 0xaa, 0xb0,
 414                            0x06, 0xeb, 0x88, 0xcc, 0x30, 0x54, 0x40, 0x7d },
 415                .valid = true
 416        },
 417        /* wycheproof - edge case for public key */
 418        {
 419                .private = { 0x18, 0x8c, 0x4b, 0xc5, 0xb9, 0xc4, 0x4b, 0x38,
 420                             0xbb, 0x65, 0x8b, 0x9b, 0x2a, 0xe8, 0x2d, 0x5b,
 421                             0x01, 0x01, 0x5e, 0x09, 0x31, 0x84, 0xb1, 0x7c,
 422                             0xb7, 0x86, 0x35, 0x03, 0xa7, 0x83, 0xe1, 0xbb },
 423                .public = { 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
 424                            0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
 425                            0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
 426                            0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x3f },
 427                .result = { 0xd4, 0x80, 0xde, 0x04, 0xf6, 0x99, 0xcb, 0x3b,
 428                            0xe0, 0x68, 0x4a, 0x9c, 0xc2, 0xe3, 0x12, 0x81,
 429                            0xea, 0x0b, 0xc5, 0xa9, 0xdc, 0xc1, 0x57, 0xd3,
 430                            0xd2, 0x01, 0x58, 0xd4, 0x6c, 0xa5, 0x24, 0x6d },
 431                .valid = true
 432        },
 433        /* wycheproof - edge case for public key */
 434        {
 435                .private = { 0xe0, 0x6c, 0x11, 0xbb, 0x2e, 0x13, 0xce, 0x3d,
 436                             0xc7, 0x67, 0x3f, 0x67, 0xf5, 0x48, 0x22, 0x42,
 437                             0x90, 0x94, 0x23, 0xa9, 0xae, 0x95, 0xee, 0x98,
 438                             0x6a, 0x98, 0x8d, 0x98, 0xfa, 0xee, 0x23, 0xa2 },
 439                .public = { 0xff, 0xff, 0xff, 0xff, 0xfe, 0xff, 0xff, 0x7f,
 440                            0xff, 0xff, 0xff, 0xff, 0xfe, 0xff, 0xff, 0x7f,
 441                            0xff, 0xff, 0xff, 0xff, 0xfe, 0xff, 0xff, 0x7f,
 442                            0xff, 0xff, 0xff, 0xff, 0xfe, 0xff, 0xff, 0x7f },
 443                .result = { 0x4c, 0x44, 0x01, 0xcc, 0xe6, 0xb5, 0x1e, 0x4c,
 444                            0xb1, 0x8f, 0x27, 0x90, 0x24, 0x6c, 0x9b, 0xf9,
 445                            0x14, 0xdb, 0x66, 0x77, 0x50, 0xa1, 0xcb, 0x89,
 446                            0x06, 0x90, 0x92, 0xaf, 0x07, 0x29, 0x22, 0x76 },
 447                .valid = true
 448        },
 449        /* wycheproof - edge case for public key */
 450        {
 451                .private = { 0xc0, 0x65, 0x8c, 0x46, 0xdd, 0xe1, 0x81, 0x29,
 452                             0x29, 0x38, 0x77, 0x53, 0x5b, 0x11, 0x62, 0xb6,
 453                             0xf9, 0xf5, 0x41, 0x4a, 0x23, 0xcf, 0x4d, 0x2c,
 454                             0xbc, 0x14, 0x0a, 0x4d, 0x99, 0xda, 0x2b, 0x8f },
 455                .public = { 0xeb, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
 456                            0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
 457                            0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
 458                            0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x7f },
 459                .result = { 0x57, 0x8b, 0xa8, 0xcc, 0x2d, 0xbd, 0xc5, 0x75,
 460                            0xaf, 0xcf, 0x9d, 0xf2, 0xb3, 0xee, 0x61, 0x89,
 461                            0xf5, 0x33, 0x7d, 0x68, 0x54, 0xc7, 0x9b, 0x4c,
 462                            0xe1, 0x65, 0xea, 0x12, 0x29, 0x3b, 0x3a, 0x0f },
 463                .valid = true
 464        },
 465        /* wycheproof - public key with low order */
 466        {
 467                .private = { 0x10, 0x25, 0x5c, 0x92, 0x30, 0xa9, 0x7a, 0x30,
 468                             0xa4, 0x58, 0xca, 0x28, 0x4a, 0x62, 0x96, 0x69,
 469                             0x29, 0x3a, 0x31, 0x89, 0x0c, 0xda, 0x9d, 0x14,
 470                             0x7f, 0xeb, 0xc7, 0xd1, 0xe2, 0x2d, 0x6b, 0xb1 },
 471                .public = { 0xe0, 0xeb, 0x7a, 0x7c, 0x3b, 0x41, 0xb8, 0xae,
 472                            0x16, 0x56, 0xe3, 0xfa, 0xf1, 0x9f, 0xc4, 0x6a,
 473                            0xda, 0x09, 0x8d, 0xeb, 0x9c, 0x32, 0xb1, 0xfd,
 474                            0x86, 0x62, 0x05, 0x16, 0x5f, 0x49, 0xb8, 0x00 },
 475                .result = { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 476                            0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 477                            0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 478                            0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 },
 479                .valid = false
 480        },
 481        /* wycheproof - public key with low order */
 482        {
 483                .private = { 0x78, 0xf1, 0xe8, 0xed, 0xf1, 0x44, 0x81, 0xb3,
 484                             0x89, 0x44, 0x8d, 0xac, 0x8f, 0x59, 0xc7, 0x0b,
 485                             0x03, 0x8e, 0x7c, 0xf9, 0x2e, 0xf2, 0xc7, 0xef,
 486                             0xf5, 0x7a, 0x72, 0x46, 0x6e, 0x11, 0x52, 0x96 },
 487                .public = { 0x5f, 0x9c, 0x95, 0xbc, 0xa3, 0x50, 0x8c, 0x24,
 488                            0xb1, 0xd0, 0xb1, 0x55, 0x9c, 0x83, 0xef, 0x5b,
 489                            0x04, 0x44, 0x5c, 0xc4, 0x58, 0x1c, 0x8e, 0x86,
 490                            0xd8, 0x22, 0x4e, 0xdd, 0xd0, 0x9f, 0x11, 0x57 },
 491                .result = { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 492                            0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 493                            0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 494                            0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 },
 495                .valid = false
 496        },
 497        /* wycheproof - public key with low order */
 498        {
 499                .private = { 0xa0, 0xa0, 0x5a, 0x3e, 0x8f, 0x9f, 0x44, 0x20,
 500                             0x4d, 0x5f, 0x80, 0x59, 0xa9, 0x4a, 0xc7, 0xdf,
 501                             0xc3, 0x9a, 0x49, 0xac, 0x01, 0x6d, 0xd7, 0x43,
 502                             0xdb, 0xfa, 0x43, 0xc5, 0xd6, 0x71, 0xfd, 0x88 },
 503                .public = { 0xec, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
 504                            0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
 505                            0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
 506                            0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x7f },
 507                .result = { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 508                            0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 509                            0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 510                            0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 },
 511                .valid = false
 512        },
 513        /* wycheproof - public key with low order */
 514        {
 515                .private = { 0xd0, 0xdb, 0xb3, 0xed, 0x19, 0x06, 0x66, 0x3f,
 516                             0x15, 0x42, 0x0a, 0xf3, 0x1f, 0x4e, 0xaf, 0x65,
 517                             0x09, 0xd9, 0xa9, 0x94, 0x97, 0x23, 0x50, 0x06,
 518                             0x05, 0xad, 0x7c, 0x1c, 0x6e, 0x74, 0x50, 0xa9 },
 519                .public = { 0xed, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
 520                            0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
 521                            0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
 522                            0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x7f },
 523                .result = { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 524                            0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 525                            0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 526                            0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 },
 527                .valid = false
 528        },
 529        /* wycheproof - public key with low order */
 530        {
 531                .private = { 0xc0, 0xb1, 0xd0, 0xeb, 0x22, 0xb2, 0x44, 0xfe,
 532                             0x32, 0x91, 0x14, 0x00, 0x72, 0xcd, 0xd9, 0xd9,
 533                             0x89, 0xb5, 0xf0, 0xec, 0xd9, 0x6c, 0x10, 0x0f,
 534                             0xeb, 0x5b, 0xca, 0x24, 0x1c, 0x1d, 0x9f, 0x8f },
 535                .public = { 0xee, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
 536                            0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
 537                            0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
 538                            0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x7f },
 539                .result = { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 540                            0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 541                            0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 542                            0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 },
 543                .valid = false
 544        },
 545        /* wycheproof - public key with low order */
 546        {
 547                .private = { 0x48, 0x0b, 0xf4, 0x5f, 0x59, 0x49, 0x42, 0xa8,
 548                             0xbc, 0x0f, 0x33, 0x53, 0xc6, 0xe8, 0xb8, 0x85,
 549                             0x3d, 0x77, 0xf3, 0x51, 0xf1, 0xc2, 0xca, 0x6c,
 550                             0x2d, 0x1a, 0xbf, 0x8a, 0x00, 0xb4, 0x22, 0x9c },
 551                .public = { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 552                            0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 553                            0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 554                            0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x80 },
 555                .result = { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 556                            0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 557                            0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 558                            0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 },
 559                .valid = false
 560        },
 561        /* wycheproof - public key with low order */
 562        {
 563                .private = { 0x30, 0xf9, 0x93, 0xfc, 0xf8, 0x51, 0x4f, 0xc8,
 564                             0x9b, 0xd8, 0xdb, 0x14, 0xcd, 0x43, 0xba, 0x0d,
 565                             0x4b, 0x25, 0x30, 0xe7, 0x3c, 0x42, 0x76, 0xa0,
 566                             0x5e, 0x1b, 0x14, 0x5d, 0x42, 0x0c, 0xed, 0xb4 },
 567                .public = { 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 568                            0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 569                            0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 570                            0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x80 },
 571                .result = { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 572                            0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 573                            0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 574                            0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 },
 575                .valid = false
 576        },
 577        /* wycheproof - public key with low order */
 578        {
 579                .private = { 0xc0, 0x49, 0x74, 0xb7, 0x58, 0x38, 0x0e, 0x2a,
 580                             0x5b, 0x5d, 0xf6, 0xeb, 0x09, 0xbb, 0x2f, 0x6b,
 581                             0x34, 0x34, 0xf9, 0x82, 0x72, 0x2a, 0x8e, 0x67,
 582                             0x6d, 0x3d, 0xa2, 0x51, 0xd1, 0xb3, 0xde, 0x83 },
 583                .public = { 0xe0, 0xeb, 0x7a, 0x7c, 0x3b, 0x41, 0xb8, 0xae,
 584                            0x16, 0x56, 0xe3, 0xfa, 0xf1, 0x9f, 0xc4, 0x6a,
 585                            0xda, 0x09, 0x8d, 0xeb, 0x9c, 0x32, 0xb1, 0xfd,
 586                            0x86, 0x62, 0x05, 0x16, 0x5f, 0x49, 0xb8, 0x80 },
 587                .result = { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 588                            0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 589                            0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 590                            0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 },
 591                .valid = false
 592        },
 593        /* wycheproof - public key with low order */
 594        {
 595                .private = { 0x50, 0x2a, 0x31, 0x37, 0x3d, 0xb3, 0x24, 0x46,
 596                             0x84, 0x2f, 0xe5, 0xad, 0xd3, 0xe0, 0x24, 0x02,
 597                             0x2e, 0xa5, 0x4f, 0x27, 0x41, 0x82, 0xaf, 0xc3,
 598                             0xd9, 0xf1, 0xbb, 0x3d, 0x39, 0x53, 0x4e, 0xb5 },
 599                .public = { 0x5f, 0x9c, 0x95, 0xbc, 0xa3, 0x50, 0x8c, 0x24,
 600                            0xb1, 0xd0, 0xb1, 0x55, 0x9c, 0x83, 0xef, 0x5b,
 601                            0x04, 0x44, 0x5c, 0xc4, 0x58, 0x1c, 0x8e, 0x86,
 602                            0xd8, 0x22, 0x4e, 0xdd, 0xd0, 0x9f, 0x11, 0xd7 },
 603                .result = { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 604                            0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 605                            0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 606                            0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 },
 607                .valid = false
 608        },
 609        /* wycheproof - public key with low order */
 610        {
 611                .private = { 0x90, 0xfa, 0x64, 0x17, 0xb0, 0xe3, 0x70, 0x30,
 612                             0xfd, 0x6e, 0x43, 0xef, 0xf2, 0xab, 0xae, 0xf1,
 613                             0x4c, 0x67, 0x93, 0x11, 0x7a, 0x03, 0x9c, 0xf6,
 614                             0x21, 0x31, 0x8b, 0xa9, 0x0f, 0x4e, 0x98, 0xbe },
 615                .public = { 0xec, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
 616                            0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
 617                            0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
 618                            0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff },
 619                .result = { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 620                            0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 621                            0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 622                            0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 },
 623                .valid = false
 624        },
 625        /* wycheproof - public key with low order */
 626        {
 627                .private = { 0x78, 0xad, 0x3f, 0x26, 0x02, 0x7f, 0x1c, 0x9f,
 628                             0xdd, 0x97, 0x5a, 0x16, 0x13, 0xb9, 0x47, 0x77,
 629                             0x9b, 0xad, 0x2c, 0xf2, 0xb7, 0x41, 0xad, 0xe0,
 630                             0x18, 0x40, 0x88, 0x5a, 0x30, 0xbb, 0x97, 0x9c },
 631                .public = { 0xed, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
 632                            0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
 633                            0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
 634                            0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff },
 635                .result = { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 636                            0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 637                            0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 638                            0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 },
 639                .valid = false
 640        },
 641        /* wycheproof - public key with low order */
 642        {
 643                .private = { 0x98, 0xe2, 0x3d, 0xe7, 0xb1, 0xe0, 0x92, 0x6e,
 644                             0xd9, 0xc8, 0x7e, 0x7b, 0x14, 0xba, 0xf5, 0x5f,
 645                             0x49, 0x7a, 0x1d, 0x70, 0x96, 0xf9, 0x39, 0x77,
 646                             0x68, 0x0e, 0x44, 0xdc, 0x1c, 0x7b, 0x7b, 0x8b },
 647                .public = { 0xee, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
 648                            0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
 649                            0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
 650                            0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff },
 651                .result = { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 652                            0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 653                            0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 654                            0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 },
 655                .valid = false
 656        },
 657        /* wycheproof - public key >= p */
 658        {
 659                .private = { 0xf0, 0x1e, 0x48, 0xda, 0xfa, 0xc9, 0xd7, 0xbc,
 660                             0xf5, 0x89, 0xcb, 0xc3, 0x82, 0xc8, 0x78, 0xd1,
 661                             0x8b, 0xda, 0x35, 0x50, 0x58, 0x9f, 0xfb, 0x5d,
 662                             0x50, 0xb5, 0x23, 0xbe, 0xbe, 0x32, 0x9d, 0xae },
 663                .public = { 0xef, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
 664                            0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
 665                            0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
 666                            0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x7f },
 667                .result = { 0xbd, 0x36, 0xa0, 0x79, 0x0e, 0xb8, 0x83, 0x09,
 668                            0x8c, 0x98, 0x8b, 0x21, 0x78, 0x67, 0x73, 0xde,
 669                            0x0b, 0x3a, 0x4d, 0xf1, 0x62, 0x28, 0x2c, 0xf1,
 670                            0x10, 0xde, 0x18, 0xdd, 0x48, 0x4c, 0xe7, 0x4b },
 671                .valid = true
 672        },
 673        /* wycheproof - public key >= p */
 674        {
 675                .private = { 0x28, 0x87, 0x96, 0xbc, 0x5a, 0xff, 0x4b, 0x81,
 676                             0xa3, 0x75, 0x01, 0x75, 0x7b, 0xc0, 0x75, 0x3a,
 677                             0x3c, 0x21, 0x96, 0x47, 0x90, 0xd3, 0x86, 0x99,
 678                             0x30, 0x8d, 0xeb, 0xc1, 0x7a, 0x6e, 0xaf, 0x8d },
 679                .public = { 0xf0, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
 680                            0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
 681                            0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
 682                            0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x7f },
 683                .result = { 0xb4, 0xe0, 0xdd, 0x76, 0xda, 0x7b, 0x07, 0x17,
 684                            0x28, 0xb6, 0x1f, 0x85, 0x67, 0x71, 0xaa, 0x35,
 685                            0x6e, 0x57, 0xed, 0xa7, 0x8a, 0x5b, 0x16, 0x55,
 686                            0xcc, 0x38, 0x20, 0xfb, 0x5f, 0x85, 0x4c, 0x5c },
 687                .valid = true
 688        },
 689        /* wycheproof - public key >= p */
 690        {
 691                .private = { 0x98, 0xdf, 0x84, 0x5f, 0x66, 0x51, 0xbf, 0x11,
 692                             0x38, 0x22, 0x1f, 0x11, 0x90, 0x41, 0xf7, 0x2b,
 693                             0x6d, 0xbc, 0x3c, 0x4a, 0xce, 0x71, 0x43, 0xd9,
 694                             0x9f, 0xd5, 0x5a, 0xd8, 0x67, 0x48, 0x0d, 0xa8 },
 695                .public = { 0xf1, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
 696                            0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
 697                            0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
 698                            0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x7f },
 699                .result = { 0x6f, 0xdf, 0x6c, 0x37, 0x61, 0x1d, 0xbd, 0x53,
 700                            0x04, 0xdc, 0x0f, 0x2e, 0xb7, 0xc9, 0x51, 0x7e,
 701                            0xb3, 0xc5, 0x0e, 0x12, 0xfd, 0x05, 0x0a, 0xc6,
 702                            0xde, 0xc2, 0x70, 0x71, 0xd4, 0xbf, 0xc0, 0x34 },
 703                .valid = true
 704        },
 705        /* wycheproof - public key >= p */
 706        {
 707                .private = { 0xf0, 0x94, 0x98, 0xe4, 0x6f, 0x02, 0xf8, 0x78,
 708                             0x82, 0x9e, 0x78, 0xb8, 0x03, 0xd3, 0x16, 0xa2,
 709                             0xed, 0x69, 0x5d, 0x04, 0x98, 0xa0, 0x8a, 0xbd,
 710                             0xf8, 0x27, 0x69, 0x30, 0xe2, 0x4e, 0xdc, 0xb0 },
 711                .public = { 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
 712                            0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
 713                            0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
 714                            0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x7f },
 715                .result = { 0x4c, 0x8f, 0xc4, 0xb1, 0xc6, 0xab, 0x88, 0xfb,
 716                            0x21, 0xf1, 0x8f, 0x6d, 0x4c, 0x81, 0x02, 0x40,
 717                            0xd4, 0xe9, 0x46, 0x51, 0xba, 0x44, 0xf7, 0xa2,
 718                            0xc8, 0x63, 0xce, 0xc7, 0xdc, 0x56, 0x60, 0x2d },
 719                .valid = true
 720        },
 721        /* wycheproof - public key >= p */
 722        {
 723                .private = { 0x18, 0x13, 0xc1, 0x0a, 0x5c, 0x7f, 0x21, 0xf9,
 724                             0x6e, 0x17, 0xf2, 0x88, 0xc0, 0xcc, 0x37, 0x60,
 725                             0x7c, 0x04, 0xc5, 0xf5, 0xae, 0xa2, 0xdb, 0x13,
 726                             0x4f, 0x9e, 0x2f, 0xfc, 0x66, 0xbd, 0x9d, 0xb8 },
 727                .public = { 0x02, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 728                            0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 729                            0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 730                            0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x80 },
 731                .result = { 0x1c, 0xd0, 0xb2, 0x82, 0x67, 0xdc, 0x54, 0x1c,
 732                            0x64, 0x2d, 0x6d, 0x7d, 0xca, 0x44, 0xa8, 0xb3,
 733                            0x8a, 0x63, 0x73, 0x6e, 0xef, 0x5c, 0x4e, 0x65,
 734                            0x01, 0xff, 0xbb, 0xb1, 0x78, 0x0c, 0x03, 0x3c },
 735                .valid = true
 736        },
 737        /* wycheproof - public key >= p */
 738        {
 739                .private = { 0x78, 0x57, 0xfb, 0x80, 0x86, 0x53, 0x64, 0x5a,
 740                             0x0b, 0xeb, 0x13, 0x8a, 0x64, 0xf5, 0xf4, 0xd7,
 741                             0x33, 0xa4, 0x5e, 0xa8, 0x4c, 0x3c, 0xda, 0x11,
 742                             0xa9, 0xc0, 0x6f, 0x7e, 0x71, 0x39, 0x14, 0x9e },
 743                .public = { 0x03, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 744                            0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 745                            0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 746                            0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x80 },
 747                .result = { 0x87, 0x55, 0xbe, 0x01, 0xc6, 0x0a, 0x7e, 0x82,
 748                            0x5c, 0xff, 0x3e, 0x0e, 0x78, 0xcb, 0x3a, 0xa4,
 749                            0x33, 0x38, 0x61, 0x51, 0x6a, 0xa5, 0x9b, 0x1c,
 750                            0x51, 0xa8, 0xb2, 0xa5, 0x43, 0xdf, 0xa8, 0x22 },
 751                .valid = true
 752        },
 753        /* wycheproof - public key >= p */
 754        {
 755                .private = { 0xe0, 0x3a, 0xa8, 0x42, 0xe2, 0xab, 0xc5, 0x6e,
 756                             0x81, 0xe8, 0x7b, 0x8b, 0x9f, 0x41, 0x7b, 0x2a,
 757                             0x1e, 0x59, 0x13, 0xc7, 0x23, 0xee, 0xd2, 0x8d,
 758                             0x75, 0x2f, 0x8d, 0x47, 0xa5, 0x9f, 0x49, 0x8f },
 759                .public = { 0x04, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 760                            0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 761                            0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 762                            0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x80 },
 763                .result = { 0x54, 0xc9, 0xa1, 0xed, 0x95, 0xe5, 0x46, 0xd2,
 764                            0x78, 0x22, 0xa3, 0x60, 0x93, 0x1d, 0xda, 0x60,
 765                            0xa1, 0xdf, 0x04, 0x9d, 0xa6, 0xf9, 0x04, 0x25,
 766                            0x3c, 0x06, 0x12, 0xbb, 0xdc, 0x08, 0x74, 0x76 },
 767                .valid = true
 768        },
 769        /* wycheproof - public key >= p */
 770        {
 771                .private = { 0xf8, 0xf7, 0x07, 0xb7, 0x99, 0x9b, 0x18, 0xcb,
 772                             0x0d, 0x6b, 0x96, 0x12, 0x4f, 0x20, 0x45, 0x97,
 773                             0x2c, 0xa2, 0x74, 0xbf, 0xc1, 0x54, 0xad, 0x0c,
 774                             0x87, 0x03, 0x8c, 0x24, 0xc6, 0xd0, 0xd4, 0xb2 },
 775                .public = { 0xda, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
 776                            0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
 777                            0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
 778                            0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff },
 779                .result = { 0xcc, 0x1f, 0x40, 0xd7, 0x43, 0xcd, 0xc2, 0x23,
 780                            0x0e, 0x10, 0x43, 0xda, 0xba, 0x8b, 0x75, 0xe8,
 781                            0x10, 0xf1, 0xfb, 0xab, 0x7f, 0x25, 0x52, 0x69,
 782                            0xbd, 0x9e, 0xbb, 0x29, 0xe6, 0xbf, 0x49, 0x4f },
 783                .valid = true
 784        },
 785        /* wycheproof - public key >= p */
 786        {
 787                .private = { 0xa0, 0x34, 0xf6, 0x84, 0xfa, 0x63, 0x1e, 0x1a,
 788                             0x34, 0x81, 0x18, 0xc1, 0xce, 0x4c, 0x98, 0x23,
 789                             0x1f, 0x2d, 0x9e, 0xec, 0x9b, 0xa5, 0x36, 0x5b,
 790                             0x4a, 0x05, 0xd6, 0x9a, 0x78, 0x5b, 0x07, 0x96 },
 791                .public = { 0xdb, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
 792                            0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
 793                            0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
 794                            0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff },
 795                .result = { 0x54, 0x99, 0x8e, 0xe4, 0x3a, 0x5b, 0x00, 0x7b,
 796                            0xf4, 0x99, 0xf0, 0x78, 0xe7, 0x36, 0x52, 0x44,
 797                            0x00, 0xa8, 0xb5, 0xc7, 0xe9, 0xb9, 0xb4, 0x37,
 798                            0x71, 0x74, 0x8c, 0x7c, 0xdf, 0x88, 0x04, 0x12 },
 799                .valid = true
 800        },
 801        /* wycheproof - public key >= p */
 802        {
 803                .private = { 0x30, 0xb6, 0xc6, 0xa0, 0xf2, 0xff, 0xa6, 0x80,
 804                             0x76, 0x8f, 0x99, 0x2b, 0xa8, 0x9e, 0x15, 0x2d,
 805                             0x5b, 0xc9, 0x89, 0x3d, 0x38, 0xc9, 0x11, 0x9b,
 806                             0xe4, 0xf7, 0x67, 0xbf, 0xab, 0x6e, 0x0c, 0xa5 },
 807                .public = { 0xdc, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
 808                            0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
 809                            0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
 810                            0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff },
 811                .result = { 0xea, 0xd9, 0xb3, 0x8e, 0xfd, 0xd7, 0x23, 0x63,
 812                            0x79, 0x34, 0xe5, 0x5a, 0xb7, 0x17, 0xa7, 0xae,
 813                            0x09, 0xeb, 0x86, 0xa2, 0x1d, 0xc3, 0x6a, 0x3f,
 814                            0xee, 0xb8, 0x8b, 0x75, 0x9e, 0x39, 0x1e, 0x09 },
 815                .valid = true
 816        },
 817        /* wycheproof - public key >= p */
 818        {
 819                .private = { 0x90, 0x1b, 0x9d, 0xcf, 0x88, 0x1e, 0x01, 0xe0,
 820                             0x27, 0x57, 0x50, 0x35, 0xd4, 0x0b, 0x43, 0xbd,
 821                             0xc1, 0xc5, 0x24, 0x2e, 0x03, 0x08, 0x47, 0x49,
 822                             0x5b, 0x0c, 0x72, 0x86, 0x46, 0x9b, 0x65, 0x91 },
 823                .public = { 0xea, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
 824                            0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
 825                            0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
 826                            0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff },
 827                .result = { 0x60, 0x2f, 0xf4, 0x07, 0x89, 0xb5, 0x4b, 0x41,
 828                            0x80, 0x59, 0x15, 0xfe, 0x2a, 0x62, 0x21, 0xf0,
 829                            0x7a, 0x50, 0xff, 0xc2, 0xc3, 0xfc, 0x94, 0xcf,
 830                            0x61, 0xf1, 0x3d, 0x79, 0x04, 0xe8, 0x8e, 0x0e },
 831                .valid = true
 832        },
 833        /* wycheproof - public key >= p */
 834        {
 835                .private = { 0x80, 0x46, 0x67, 0x7c, 0x28, 0xfd, 0x82, 0xc9,
 836                             0xa1, 0xbd, 0xb7, 0x1a, 0x1a, 0x1a, 0x34, 0xfa,
 837                             0xba, 0x12, 0x25, 0xe2, 0x50, 0x7f, 0xe3, 0xf5,
 838                             0x4d, 0x10, 0xbd, 0x5b, 0x0d, 0x86, 0x5f, 0x8e },
 839                .public = { 0xeb, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
 840                            0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
 841                            0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
 842                            0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff },
 843                .result = { 0xe0, 0x0a, 0xe8, 0xb1, 0x43, 0x47, 0x12, 0x47,
 844                            0xba, 0x24, 0xf1, 0x2c, 0x88, 0x55, 0x36, 0xc3,
 845                            0xcb, 0x98, 0x1b, 0x58, 0xe1, 0xe5, 0x6b, 0x2b,
 846                            0xaf, 0x35, 0xc1, 0x2a, 0xe1, 0xf7, 0x9c, 0x26 },
 847                .valid = true
 848        },
 849        /* wycheproof - public key >= p */
 850        {
 851                .private = { 0x60, 0x2f, 0x7e, 0x2f, 0x68, 0xa8, 0x46, 0xb8,
 852                             0x2c, 0xc2, 0x69, 0xb1, 0xd4, 0x8e, 0x93, 0x98,
 853                             0x86, 0xae, 0x54, 0xfd, 0x63, 0x6c, 0x1f, 0xe0,
 854                             0x74, 0xd7, 0x10, 0x12, 0x7d, 0x47, 0x24, 0x91 },
 855                .public = { 0xef, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
 856                            0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
 857                            0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
 858                            0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff },
 859                .result = { 0x98, 0xcb, 0x9b, 0x50, 0xdd, 0x3f, 0xc2, 0xb0,
 860                            0xd4, 0xf2, 0xd2, 0xbf, 0x7c, 0x5c, 0xfd, 0xd1,
 861                            0x0c, 0x8f, 0xcd, 0x31, 0xfc, 0x40, 0xaf, 0x1a,
 862                            0xd4, 0x4f, 0x47, 0xc1, 0x31, 0x37, 0x63, 0x62 },
 863                .valid = true
 864        },
 865        /* wycheproof - public key >= p */
 866        {
 867                .private = { 0x60, 0x88, 0x7b, 0x3d, 0xc7, 0x24, 0x43, 0x02,
 868                             0x6e, 0xbe, 0xdb, 0xbb, 0xb7, 0x06, 0x65, 0xf4,
 869                             0x2b, 0x87, 0xad, 0xd1, 0x44, 0x0e, 0x77, 0x68,
 870                             0xfb, 0xd7, 0xe8, 0xe2, 0xce, 0x5f, 0x63, 0x9d },
 871                .public = { 0xf0, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
 872                            0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
 873                            0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
 874                            0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff },
 875                .result = { 0x38, 0xd6, 0x30, 0x4c, 0x4a, 0x7e, 0x6d, 0x9f,
 876                            0x79, 0x59, 0x33, 0x4f, 0xb5, 0x24, 0x5b, 0xd2,
 877                            0xc7, 0x54, 0x52, 0x5d, 0x4c, 0x91, 0xdb, 0x95,
 878                            0x02, 0x06, 0x92, 0x62, 0x34, 0xc1, 0xf6, 0x33 },
 879                .valid = true
 880        },
 881        /* wycheproof - public key >= p */
 882        {
 883                .private = { 0x78, 0xd3, 0x1d, 0xfa, 0x85, 0x44, 0x97, 0xd7,
 884                             0x2d, 0x8d, 0xef, 0x8a, 0x1b, 0x7f, 0xb0, 0x06,
 885                             0xce, 0xc2, 0xd8, 0xc4, 0x92, 0x46, 0x47, 0xc9,
 886                             0x38, 0x14, 0xae, 0x56, 0xfa, 0xed, 0xa4, 0x95 },
 887                .public = { 0xf1, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
 888                            0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
 889                            0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
 890                            0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff },
 891                .result = { 0x78, 0x6c, 0xd5, 0x49, 0x96, 0xf0, 0x14, 0xa5,
 892                            0xa0, 0x31, 0xec, 0x14, 0xdb, 0x81, 0x2e, 0xd0,
 893                            0x83, 0x55, 0x06, 0x1f, 0xdb, 0x5d, 0xe6, 0x80,
 894                            0xa8, 0x00, 0xac, 0x52, 0x1f, 0x31, 0x8e, 0x23 },
 895                .valid = true
 896        },
 897        /* wycheproof - public key >= p */
 898        {
 899                .private = { 0xc0, 0x4c, 0x5b, 0xae, 0xfa, 0x83, 0x02, 0xdd,
 900                             0xde, 0xd6, 0xa4, 0xbb, 0x95, 0x77, 0x61, 0xb4,
 901                             0xeb, 0x97, 0xae, 0xfa, 0x4f, 0xc3, 0xb8, 0x04,
 902                             0x30, 0x85, 0xf9, 0x6a, 0x56, 0x59, 0xb3, 0xa5 },
 903                .public = { 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
 904                            0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
 905                            0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
 906                            0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff },
 907                .result = { 0x29, 0xae, 0x8b, 0xc7, 0x3e, 0x9b, 0x10, 0xa0,
 908                            0x8b, 0x4f, 0x68, 0x1c, 0x43, 0xc3, 0xe0, 0xac,
 909                            0x1a, 0x17, 0x1d, 0x31, 0xb3, 0x8f, 0x1a, 0x48,
 910                            0xef, 0xba, 0x29, 0xae, 0x63, 0x9e, 0xa1, 0x34 },
 911                .valid = true
 912        },
 913        /* wycheproof - RFC 7748 */
 914        {
 915                .private = { 0xa0, 0x46, 0xe3, 0x6b, 0xf0, 0x52, 0x7c, 0x9d,
 916                             0x3b, 0x16, 0x15, 0x4b, 0x82, 0x46, 0x5e, 0xdd,
 917                             0x62, 0x14, 0x4c, 0x0a, 0xc1, 0xfc, 0x5a, 0x18,
 918                             0x50, 0x6a, 0x22, 0x44, 0xba, 0x44, 0x9a, 0x44 },
 919                .public = { 0xe6, 0xdb, 0x68, 0x67, 0x58, 0x30, 0x30, 0xdb,
 920                            0x35, 0x94, 0xc1, 0xa4, 0x24, 0xb1, 0x5f, 0x7c,
 921                            0x72, 0x66, 0x24, 0xec, 0x26, 0xb3, 0x35, 0x3b,
 922                            0x10, 0xa9, 0x03, 0xa6, 0xd0, 0xab, 0x1c, 0x4c },
 923                .result = { 0xc3, 0xda, 0x55, 0x37, 0x9d, 0xe9, 0xc6, 0x90,
 924                            0x8e, 0x94, 0xea, 0x4d, 0xf2, 0x8d, 0x08, 0x4f,
 925                            0x32, 0xec, 0xcf, 0x03, 0x49, 0x1c, 0x71, 0xf7,
 926                            0x54, 0xb4, 0x07, 0x55, 0x77, 0xa2, 0x85, 0x52 },
 927                .valid = true
 928        },
 929        /* wycheproof - RFC 7748 */
 930        {
 931                .private = { 0x48, 0x66, 0xe9, 0xd4, 0xd1, 0xb4, 0x67, 0x3c,
 932                             0x5a, 0xd2, 0x26, 0x91, 0x95, 0x7d, 0x6a, 0xf5,
 933                             0xc1, 0x1b, 0x64, 0x21, 0xe0, 0xea, 0x01, 0xd4,
 934                             0x2c, 0xa4, 0x16, 0x9e, 0x79, 0x18, 0xba, 0x4d },
 935                .public = { 0xe5, 0x21, 0x0f, 0x12, 0x78, 0x68, 0x11, 0xd3,
 936                            0xf4, 0xb7, 0x95, 0x9d, 0x05, 0x38, 0xae, 0x2c,
 937                            0x31, 0xdb, 0xe7, 0x10, 0x6f, 0xc0, 0x3c, 0x3e,
 938                            0xfc, 0x4c, 0xd5, 0x49, 0xc7, 0x15, 0xa4, 0x13 },
 939                .result = { 0x95, 0xcb, 0xde, 0x94, 0x76, 0xe8, 0x90, 0x7d,
 940                            0x7a, 0xad, 0xe4, 0x5c, 0xb4, 0xb8, 0x73, 0xf8,
 941                            0x8b, 0x59, 0x5a, 0x68, 0x79, 0x9f, 0xa1, 0x52,
 942                            0xe6, 0xf8, 0xf7, 0x64, 0x7a, 0xac, 0x79, 0x57 },
 943                .valid = true
 944        },
 945        /* wycheproof - edge case for shared secret */
 946        {
 947                .private = { 0xa0, 0xa4, 0xf1, 0x30, 0xb9, 0x8a, 0x5b, 0xe4,
 948                             0xb1, 0xce, 0xdb, 0x7c, 0xb8, 0x55, 0x84, 0xa3,
 949                             0x52, 0x0e, 0x14, 0x2d, 0x47, 0x4d, 0xc9, 0xcc,
 950                             0xb9, 0x09, 0xa0, 0x73, 0xa9, 0x76, 0xbf, 0x63 },
 951                .public = { 0x0a, 0xb4, 0xe7, 0x63, 0x80, 0xd8, 0x4d, 0xde,
 952                            0x4f, 0x68, 0x33, 0xc5, 0x8f, 0x2a, 0x9f, 0xb8,
 953                            0xf8, 0x3b, 0xb0, 0x16, 0x9b, 0x17, 0x2b, 0xe4,
 954                            0xb6, 0xe0, 0x59, 0x28, 0x87, 0x74, 0x1a, 0x36 },
 955                .result = { 0x02, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 956                            0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 957                            0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 958                            0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 },
 959                .valid = true
 960        },
 961        /* wycheproof - edge case for shared secret */
 962        {
 963                .private = { 0xa0, 0xa4, 0xf1, 0x30, 0xb9, 0x8a, 0x5b, 0xe4,
 964                             0xb1, 0xce, 0xdb, 0x7c, 0xb8, 0x55, 0x84, 0xa3,
 965                             0x52, 0x0e, 0x14, 0x2d, 0x47, 0x4d, 0xc9, 0xcc,
 966                             0xb9, 0x09, 0xa0, 0x73, 0xa9, 0x76, 0xbf, 0x63 },
 967                .public = { 0x89, 0xe1, 0x0d, 0x57, 0x01, 0xb4, 0x33, 0x7d,
 968                            0x2d, 0x03, 0x21, 0x81, 0x53, 0x8b, 0x10, 0x64,
 969                            0xbd, 0x40, 0x84, 0x40, 0x1c, 0xec, 0xa1, 0xfd,
 970                            0x12, 0x66, 0x3a, 0x19, 0x59, 0x38, 0x80, 0x00 },
 971                .result = { 0x09, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 972                            0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 973                            0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 974                            0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 },
 975                .valid = true
 976        },
 977        /* wycheproof - edge case for shared secret */
 978        {
 979                .private = { 0xa0, 0xa4, 0xf1, 0x30, 0xb9, 0x8a, 0x5b, 0xe4,
 980                             0xb1, 0xce, 0xdb, 0x7c, 0xb8, 0x55, 0x84, 0xa3,
 981                             0x52, 0x0e, 0x14, 0x2d, 0x47, 0x4d, 0xc9, 0xcc,
 982                             0xb9, 0x09, 0xa0, 0x73, 0xa9, 0x76, 0xbf, 0x63 },
 983                .public = { 0x2b, 0x55, 0xd3, 0xaa, 0x4a, 0x8f, 0x80, 0xc8,
 984                            0xc0, 0xb2, 0xae, 0x5f, 0x93, 0x3e, 0x85, 0xaf,
 985                            0x49, 0xbe, 0xac, 0x36, 0xc2, 0xfa, 0x73, 0x94,
 986                            0xba, 0xb7, 0x6c, 0x89, 0x33, 0xf8, 0xf8, 0x1d },
 987                .result = { 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 988                            0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 989                            0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 990                            0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 },
 991                .valid = true
 992        },
 993        /* wycheproof - edge case for shared secret */
 994        {
 995                .private = { 0xa0, 0xa4, 0xf1, 0x30, 0xb9, 0x8a, 0x5b, 0xe4,
 996                             0xb1, 0xce, 0xdb, 0x7c, 0xb8, 0x55, 0x84, 0xa3,
 997                             0x52, 0x0e, 0x14, 0x2d, 0x47, 0x4d, 0xc9, 0xcc,
 998                             0xb9, 0x09, 0xa0, 0x73, 0xa9, 0x76, 0xbf, 0x63 },
 999                .public = { 0x63, 0xe5, 0xb1, 0xfe, 0x96, 0x01, 0xfe, 0x84,
1000                            0x38, 0x5d, 0x88, 0x66, 0xb0, 0x42, 0x12, 0x62,
1001                            0xf7, 0x8f, 0xbf, 0xa5, 0xaf, 0xf9, 0x58, 0x5e,
1002                            0x62, 0x66, 0x79, 0xb1, 0x85, 0x47, 0xd9, 0x59 },
1003                .result = { 0xfe, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
1004                            0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
1005                            0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
1006                            0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x3f },
1007                .valid = true
1008        },
1009        /* wycheproof - edge case for shared secret */
1010        {
1011                .private = { 0xa0, 0xa4, 0xf1, 0x30, 0xb9, 0x8a, 0x5b, 0xe4,
1012                             0xb1, 0xce, 0xdb, 0x7c, 0xb8, 0x55, 0x84, 0xa3,
1013                             0x52, 0x0e, 0x14, 0x2d, 0x47, 0x4d, 0xc9, 0xcc,
1014                             0xb9, 0x09, 0xa0, 0x73, 0xa9, 0x76, 0xbf, 0x63 },
1015                .public = { 0xe4, 0x28, 0xf3, 0xda, 0xc1, 0x78, 0x09, 0xf8,
1016                            0x27, 0xa5, 0x22, 0xce, 0x32, 0x35, 0x50, 0x58,
1017                            0xd0, 0x73, 0x69, 0x36, 0x4a, 0xa7, 0x89, 0x02,
1018                            0xee, 0x10, 0x13, 0x9b, 0x9f, 0x9d, 0xd6, 0x53 },
1019                .result = { 0xfc, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
1020                            0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
1021                            0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
1022                            0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x3f },
1023                .valid = true
1024        },
1025        /* wycheproof - edge case for shared secret */
1026        {
1027                .private = { 0xa0, 0xa4, 0xf1, 0x30, 0xb9, 0x8a, 0x5b, 0xe4,
1028                             0xb1, 0xce, 0xdb, 0x7c, 0xb8, 0x55, 0x84, 0xa3,
1029                             0x52, 0x0e, 0x14, 0x2d, 0x47, 0x4d, 0xc9, 0xcc,
1030                             0xb9, 0x09, 0xa0, 0x73, 0xa9, 0x76, 0xbf, 0x63 },
1031                .public = { 0xb3, 0xb5, 0x0e, 0x3e, 0xd3, 0xa4, 0x07, 0xb9,
1032                            0x5d, 0xe9, 0x42, 0xef, 0x74, 0x57, 0x5b, 0x5a,
1033                            0xb8, 0xa1, 0x0c, 0x09, 0xee, 0x10, 0x35, 0x44,
1034                            0xd6, 0x0b, 0xdf, 0xed, 0x81, 0x38, 0xab, 0x2b },
1035                .result = { 0xf9, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
1036                            0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
1037                            0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
1038                            0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x3f },
1039                .valid = true
1040        },
1041        /* wycheproof - edge case for shared secret */
1042        {
1043                .private = { 0xa0, 0xa4, 0xf1, 0x30, 0xb9, 0x8a, 0x5b, 0xe4,
1044                             0xb1, 0xce, 0xdb, 0x7c, 0xb8, 0x55, 0x84, 0xa3,
1045                             0x52, 0x0e, 0x14, 0x2d, 0x47, 0x4d, 0xc9, 0xcc,
1046                             0xb9, 0x09, 0xa0, 0x73, 0xa9, 0x76, 0xbf, 0x63 },
1047                .public = { 0x21, 0x3f, 0xff, 0xe9, 0x3d, 0x5e, 0xa8, 0xcd,
1048                            0x24, 0x2e, 0x46, 0x28, 0x44, 0x02, 0x99, 0x22,
1049                            0xc4, 0x3c, 0x77, 0xc9, 0xe3, 0xe4, 0x2f, 0x56,
1050                            0x2f, 0x48, 0x5d, 0x24, 0xc5, 0x01, 0xa2, 0x0b },
1051                .result = { 0xf3, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
1052                            0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
1053                            0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
1054                            0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x3f },
1055                .valid = true
1056        },
1057        /* wycheproof - edge case for shared secret */
1058        {
1059                .private = { 0xa0, 0xa4, 0xf1, 0x30, 0xb9, 0x8a, 0x5b, 0xe4,
1060                             0xb1, 0xce, 0xdb, 0x7c, 0xb8, 0x55, 0x84, 0xa3,
1061                             0x52, 0x0e, 0x14, 0x2d, 0x47, 0x4d, 0xc9, 0xcc,
1062                             0xb9, 0x09, 0xa0, 0x73, 0xa9, 0x76, 0xbf, 0x63 },
1063                .public = { 0x91, 0xb2, 0x32, 0xa1, 0x78, 0xb3, 0xcd, 0x53,
1064                            0x09, 0x32, 0x44, 0x1e, 0x61, 0x39, 0x41, 0x8f,
1065                            0x72, 0x17, 0x22, 0x92, 0xf1, 0xda, 0x4c, 0x18,
1066                            0x34, 0xfc, 0x5e, 0xbf, 0xef, 0xb5, 0x1e, 0x3f },
1067                .result = { 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
1068                            0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
1069                            0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
1070                            0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x03 },
1071                .valid = true
1072        },
1073        /* wycheproof - edge case for shared secret */
1074        {
1075                .private = { 0xa0, 0xa4, 0xf1, 0x30, 0xb9, 0x8a, 0x5b, 0xe4,
1076                             0xb1, 0xce, 0xdb, 0x7c, 0xb8, 0x55, 0x84, 0xa3,
1077                             0x52, 0x0e, 0x14, 0x2d, 0x47, 0x4d, 0xc9, 0xcc,
1078                             0xb9, 0x09, 0xa0, 0x73, 0xa9, 0x76, 0xbf, 0x63 },
1079                .public = { 0x04, 0x5c, 0x6e, 0x11, 0xc5, 0xd3, 0x32, 0x55,
1080                            0x6c, 0x78, 0x22, 0xfe, 0x94, 0xeb, 0xf8, 0x9b,
1081                            0x56, 0xa3, 0x87, 0x8d, 0xc2, 0x7c, 0xa0, 0x79,
1082                            0x10, 0x30, 0x58, 0x84, 0x9f, 0xab, 0xcb, 0x4f },
1083                .result = { 0xe5, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
1084                            0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
1085                            0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
1086                            0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x7f },
1087                .valid = true
1088        },
1089        /* wycheproof - edge case for shared secret */
1090        {
1091                .private = { 0xa0, 0xa4, 0xf1, 0x30, 0xb9, 0x8a, 0x5b, 0xe4,
1092                             0xb1, 0xce, 0xdb, 0x7c, 0xb8, 0x55, 0x84, 0xa3,
1093                             0x52, 0x0e, 0x14, 0x2d, 0x47, 0x4d, 0xc9, 0xcc,
1094                             0xb9, 0x09, 0xa0, 0x73, 0xa9, 0x76, 0xbf, 0x63 },
1095                .public = { 0x1c, 0xa2, 0x19, 0x0b, 0x71, 0x16, 0x35, 0x39,
1096                            0x06, 0x3c, 0x35, 0x77, 0x3b, 0xda, 0x0c, 0x9c,
1097                            0x92, 0x8e, 0x91, 0x36, 0xf0, 0x62, 0x0a, 0xeb,
1098                            0x09, 0x3f, 0x09, 0x91, 0x97, 0xb7, 0xf7, 0x4e },
1099                .result = { 0xe3, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
1100                            0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
1101                            0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
1102                            0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x7f },
1103                .valid = true
1104        },
1105        /* wycheproof - edge case for shared secret */
1106        {
1107                .private = { 0xa0, 0xa4, 0xf1, 0x30, 0xb9, 0x8a, 0x5b, 0xe4,
1108                             0xb1, 0xce, 0xdb, 0x7c, 0xb8, 0x55, 0x84, 0xa3,
1109                             0x52, 0x0e, 0x14, 0x2d, 0x47, 0x4d, 0xc9, 0xcc,
1110                             0xb9, 0x09, 0xa0, 0x73, 0xa9, 0x76, 0xbf, 0x63 },
1111                .public = { 0xf7, 0x6e, 0x90, 0x10, 0xac, 0x33, 0xc5, 0x04,
1112                            0x3b, 0x2d, 0x3b, 0x76, 0xa8, 0x42, 0x17, 0x10,
1113                            0x00, 0xc4, 0x91, 0x62, 0x22, 0xe9, 0xe8, 0x58,
1114                            0x97, 0xa0, 0xae, 0xc7, 0xf6, 0x35, 0x0b, 0x3c },
1115                .result = { 0xdd, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
1116                            0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
1117                            0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
1118                            0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x7f },
1119                .valid = true
1120        },
1121        /* wycheproof - edge case for shared secret */
1122        {
1123                .private = { 0xa0, 0xa4, 0xf1, 0x30, 0xb9, 0x8a, 0x5b, 0xe4,
1124                             0xb1, 0xce, 0xdb, 0x7c, 0xb8, 0x55, 0x84, 0xa3,
1125                             0x52, 0x0e, 0x14, 0x2d, 0x47, 0x4d, 0xc9, 0xcc,
1126                             0xb9, 0x09, 0xa0, 0x73, 0xa9, 0x76, 0xbf, 0x63 },
1127                .public = { 0xbb, 0x72, 0x68, 0x8d, 0x8f, 0x8a, 0xa7, 0xa3,
1128                            0x9c, 0xd6, 0x06, 0x0c, 0xd5, 0xc8, 0x09, 0x3c,
1129                            0xde, 0xc6, 0xfe, 0x34, 0x19, 0x37, 0xc3, 0x88,
1130                            0x6a, 0x99, 0x34, 0x6c, 0xd0, 0x7f, 0xaa, 0x55 },
1131                .result = { 0xdb, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
1132                            0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
1133                            0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
1134                            0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x7f },
1135                .valid = true
1136        },
1137        /* wycheproof - edge case for shared secret */
1138        {
1139                .private = { 0xa0, 0xa4, 0xf1, 0x30, 0xb9, 0x8a, 0x5b, 0xe4,
1140                             0xb1, 0xce, 0xdb, 0x7c, 0xb8, 0x55, 0x84, 0xa3,
1141                             0x52, 0x0e, 0x14, 0x2d, 0x47, 0x4d, 0xc9, 0xcc,
1142                             0xb9, 0x09, 0xa0, 0x73, 0xa9, 0x76, 0xbf, 0x63 },
1143                .public = { 0x88, 0xfd, 0xde, 0xa1, 0x93, 0x39, 0x1c, 0x6a,
1144                            0x59, 0x33, 0xef, 0x9b, 0x71, 0x90, 0x15, 0x49,
1145                            0x44, 0x72, 0x05, 0xaa, 0xe9, 0xda, 0x92, 0x8a,
1146                            0x6b, 0x91, 0xa3, 0x52, 0xba, 0x10, 0xf4, 0x1f },
1147                .result = { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
1148                            0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
1149                            0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
1150                            0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02 },
1151                .valid = true
1152        },
1153        /* wycheproof - edge case for shared secret */
1154        {
1155                .private = { 0xa0, 0xa4, 0xf1, 0x30, 0xb9, 0x8a, 0x5b, 0xe4,
1156                             0xb1, 0xce, 0xdb, 0x7c, 0xb8, 0x55, 0x84, 0xa3,
1157                             0x52, 0x0e, 0x14, 0x2d, 0x47, 0x4d, 0xc9, 0xcc,
1158                             0xb9, 0x09, 0xa0, 0x73, 0xa9, 0x76, 0xbf, 0x63 },
1159                .public = { 0x30, 0x3b, 0x39, 0x2f, 0x15, 0x31, 0x16, 0xca,
1160                            0xd9, 0xcc, 0x68, 0x2a, 0x00, 0xcc, 0xc4, 0x4c,
1161                            0x95, 0xff, 0x0d, 0x3b, 0xbe, 0x56, 0x8b, 0xeb,
1162                            0x6c, 0x4e, 0x73, 0x9b, 0xaf, 0xdc, 0x2c, 0x68 },
1163                .result = { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
1164                            0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
1165                            0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
1166                            0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x80, 0x00 },
1167                .valid = true
1168        },
1169        /* wycheproof - checking for overflow */
1170        {
1171                .private = { 0xc8, 0x17, 0x24, 0x70, 0x40, 0x00, 0xb2, 0x6d,
1172                             0x31, 0x70, 0x3c, 0xc9, 0x7e, 0x3a, 0x37, 0x8d,
1173                             0x56, 0xfa, 0xd8, 0x21, 0x93, 0x61, 0xc8, 0x8c,
1174                             0xca, 0x8b, 0xd7, 0xc5, 0x71, 0x9b, 0x12, 0xb2 },
1175                .public = { 0xfd, 0x30, 0x0a, 0xeb, 0x40, 0xe1, 0xfa, 0x58,
1176                            0x25, 0x18, 0x41, 0x2b, 0x49, 0xb2, 0x08, 0xa7,
1177                            0x84, 0x2b, 0x1e, 0x1f, 0x05, 0x6a, 0x04, 0x01,
1178                            0x78, 0xea, 0x41, 0x41, 0x53, 0x4f, 0x65, 0x2d },
1179                .result = { 0xb7, 0x34, 0x10, 0x5d, 0xc2, 0x57, 0x58, 0x5d,
1180                            0x73, 0xb5, 0x66, 0xcc, 0xb7, 0x6f, 0x06, 0x27,
1181                            0x95, 0xcc, 0xbe, 0xc8, 0x91, 0x28, 0xe5, 0x2b,
1182                            0x02, 0xf3, 0xe5, 0x96, 0x39, 0xf1, 0x3c, 0x46 },
1183                .valid = true
1184        },
1185        /* wycheproof - checking for overflow */
1186        {
1187                .private = { 0xc8, 0x17, 0x24, 0x70, 0x40, 0x00, 0xb2, 0x6d,
1188                             0x31, 0x70, 0x3c, 0xc9, 0x7e, 0x3a, 0x37, 0x8d,
1189                             0x56, 0xfa, 0xd8, 0x21, 0x93, 0x61, 0xc8, 0x8c,
1190                             0xca, 0x8b, 0xd7, 0xc5, 0x71, 0x9b, 0x12, 0xb2 },
1191                .public = { 0xc8, 0xef, 0x79, 0xb5, 0x14, 0xd7, 0x68, 0x26,
1192                            0x77, 0xbc, 0x79, 0x31, 0xe0, 0x6e, 0xe5, 0xc2,
1193                            0x7c, 0x9b, 0x39, 0x2b, 0x4a, 0xe9, 0x48, 0x44,
1194                            0x73, 0xf5, 0x54, 0xe6, 0x67, 0x8e, 0xcc, 0x2e },
1195                .result = { 0x64, 0x7a, 0x46, 0xb6, 0xfc, 0x3f, 0x40, 0xd6,
1196                            0x21, 0x41, 0xee, 0x3c, 0xee, 0x70, 0x6b, 0x4d,
1197                            0x7a, 0x92, 0x71, 0x59, 0x3a, 0x7b, 0x14, 0x3e,
1198                            0x8e, 0x2e, 0x22, 0x79, 0x88, 0x3e, 0x45, 0x50 },
1199                .valid = true
1200        },
1201        /* wycheproof - checking for overflow */
1202        {
1203                .private = { 0xc8, 0x17, 0x24, 0x70, 0x40, 0x00, 0xb2, 0x6d,
1204                             0x31, 0x70, 0x3c, 0xc9, 0x7e, 0x3a, 0x37, 0x8d,
1205                             0x56, 0xfa, 0xd8, 0x21, 0x93, 0x61, 0xc8, 0x8c,
1206                             0xca, 0x8b, 0xd7, 0xc5, 0x71, 0x9b, 0x12, 0xb2 },
1207                .public = { 0x64, 0xae, 0xac, 0x25, 0x04, 0x14, 0x48, 0x61,
1208                            0x53, 0x2b, 0x7b, 0xbc, 0xb6, 0xc8, 0x7d, 0x67,
1209                            0xdd, 0x4c, 0x1f, 0x07, 0xeb, 0xc2, 0xe0, 0x6e,
1210                            0xff, 0xb9, 0x5a, 0xec, 0xc6, 0x17, 0x0b, 0x2c },
1211                .result = { 0x4f, 0xf0, 0x3d, 0x5f, 0xb4, 0x3c, 0xd8, 0x65,
1212                            0x7a, 0x3c, 0xf3, 0x7c, 0x13, 0x8c, 0xad, 0xce,
1213                            0xcc, 0xe5, 0x09, 0xe4, 0xeb, 0xa0, 0x89, 0xd0,
1214                            0xef, 0x40, 0xb4, 0xe4, 0xfb, 0x94, 0x61, 0x55 },
1215                .valid = true
1216        },
1217        /* wycheproof - checking for overflow */
1218        {
1219                .private = { 0xc8, 0x17, 0x24, 0x70, 0x40, 0x00, 0xb2, 0x6d,
1220                             0x31, 0x70, 0x3c, 0xc9, 0x7e, 0x3a, 0x37, 0x8d,
1221                             0x56, 0xfa, 0xd8, 0x21, 0x93, 0x61, 0xc8, 0x8c,
1222                             0xca, 0x8b, 0xd7, 0xc5, 0x71, 0x9b, 0x12, 0xb2 },
1223                .public = { 0xbf, 0x68, 0xe3, 0x5e, 0x9b, 0xdb, 0x7e, 0xee,
1224                            0x1b, 0x50, 0x57, 0x02, 0x21, 0x86, 0x0f, 0x5d,
1225                            0xcd, 0xad, 0x8a, 0xcb, 0xab, 0x03, 0x1b, 0x14,
1226                            0x97, 0x4c, 0xc4, 0x90, 0x13, 0xc4, 0x98, 0x31 },
1227                .result = { 0x21, 0xce, 0xe5, 0x2e, 0xfd, 0xbc, 0x81, 0x2e,
1228                            0x1d, 0x02, 0x1a, 0x4a, 0xf1, 0xe1, 0xd8, 0xbc,
1229                            0x4d, 0xb3, 0xc4, 0x00, 0xe4, 0xd2, 0xa2, 0xc5,
1230                            0x6a, 0x39, 0x26, 0xdb, 0x4d, 0x99, 0xc6, 0x5b },
1231                .valid = true
1232        },
1233        /* wycheproof - checking for overflow */
1234        {
1235                .private = { 0xc8, 0x17, 0x24, 0x70, 0x40, 0x00, 0xb2, 0x6d,
1236                             0x31, 0x70, 0x3c, 0xc9, 0x7e, 0x3a, 0x37, 0x8d,
1237                             0x56, 0xfa, 0xd8, 0x21, 0x93, 0x61, 0xc8, 0x8c,
1238                             0xca, 0x8b, 0xd7, 0xc5, 0x71, 0x9b, 0x12, 0xb2 },
1239                .public = { 0x53, 0x47, 0xc4, 0x91, 0x33, 0x1a, 0x64, 0xb4,
1240                            0x3d, 0xdc, 0x68, 0x30, 0x34, 0xe6, 0x77, 0xf5,
1241                            0x3d, 0xc3, 0x2b, 0x52, 0xa5, 0x2a, 0x57, 0x7c,
1242                            0x15, 0xa8, 0x3b, 0xf2, 0x98, 0xe9, 0x9f, 0x19 },
1243                .result = { 0x18, 0xcb, 0x89, 0xe4, 0xe2, 0x0c, 0x0c, 0x2b,
1244                            0xd3, 0x24, 0x30, 0x52, 0x45, 0x26, 0x6c, 0x93,
1245                            0x27, 0x69, 0x0b, 0xbe, 0x79, 0xac, 0xb8, 0x8f,
1246                            0x5b, 0x8f, 0xb3, 0xf7, 0x4e, 0xca, 0x3e, 0x52 },
1247                .valid = true
1248        },
1249        /* wycheproof - private key == -1 (mod order) */
1250        {
1251                .private = { 0xa0, 0x23, 0xcd, 0xd0, 0x83, 0xef, 0x5b, 0xb8,
1252                             0x2f, 0x10, 0xd6, 0x2e, 0x59, 0xe1, 0x5a, 0x68,
1253                             0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
1254                             0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x50 },
1255                .public = { 0x25, 0x8e, 0x04, 0x52, 0x3b, 0x8d, 0x25, 0x3e,
1256                            0xe6, 0x57, 0x19, 0xfc, 0x69, 0x06, 0xc6, 0x57,
1257                            0x19, 0x2d, 0x80, 0x71, 0x7e, 0xdc, 0x82, 0x8f,
1258                            0xa0, 0xaf, 0x21, 0x68, 0x6e, 0x2f, 0xaa, 0x75 },
1259                .result = { 0x25, 0x8e, 0x04, 0x52, 0x3b, 0x8d, 0x25, 0x3e,
1260                            0xe6, 0x57, 0x19, 0xfc, 0x69, 0x06, 0xc6, 0x57,
1261                            0x19, 0x2d, 0x80, 0x71, 0x7e, 0xdc, 0x82, 0x8f,
1262                            0xa0, 0xaf, 0x21, 0x68, 0x6e, 0x2f, 0xaa, 0x75 },
1263                .valid = true
1264        },
1265        /* wycheproof - private key == 1 (mod order) on twist */
1266        {
1267                .private = { 0x58, 0x08, 0x3d, 0xd2, 0x61, 0xad, 0x91, 0xef,
1268                             0xf9, 0x52, 0x32, 0x2e, 0xc8, 0x24, 0xc6, 0x82,
1269                             0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
1270                             0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x5f },
1271                .public = { 0x2e, 0xae, 0x5e, 0xc3, 0xdd, 0x49, 0x4e, 0x9f,
1272                            0x2d, 0x37, 0xd2, 0x58, 0xf8, 0x73, 0xa8, 0xe6,
1273                            0xe9, 0xd0, 0xdb, 0xd1, 0xe3, 0x83, 0xef, 0x64,
1274                            0xd9, 0x8b, 0xb9, 0x1b, 0x3e, 0x0b, 0xe0, 0x35 },
1275                .result = { 0x2e, 0xae, 0x5e, 0xc3, 0xdd, 0x49, 0x4e, 0x9f,
1276                            0x2d, 0x37, 0xd2, 0x58, 0xf8, 0x73, 0xa8, 0xe6,
1277                            0xe9, 0xd0, 0xdb, 0xd1, 0xe3, 0x83, 0xef, 0x64,
1278                            0xd9, 0x8b, 0xb9, 0x1b, 0x3e, 0x0b, 0xe0, 0x35 },
1279                .valid = true
1280        }
1281};
1282
1283bool __init curve25519_selftest(void)
1284{
1285        bool success = true, ret, ret2;
1286        size_t i = 0, j;
1287        u8 in[CURVE25519_KEY_SIZE];
1288        u8 out[CURVE25519_KEY_SIZE], out2[CURVE25519_KEY_SIZE],
1289           out3[CURVE25519_KEY_SIZE];
1290
1291        for (i = 0; i < ARRAY_SIZE(curve25519_test_vectors); ++i) {
1292                memset(out, 0, CURVE25519_KEY_SIZE);
1293                ret = curve25519(out, curve25519_test_vectors[i].private,
1294                                 curve25519_test_vectors[i].public);
1295                if (ret != curve25519_test_vectors[i].valid ||
1296                    memcmp(out, curve25519_test_vectors[i].result,
1297                           CURVE25519_KEY_SIZE)) {
1298                        pr_err("curve25519 self-test %zu: FAIL\n", i + 1);
1299                        success = false;
1300                }
1301        }
1302
1303        for (i = 0; i < 5; ++i) {
1304                get_random_bytes(in, sizeof(in));
1305                ret = curve25519_generate_public(out, in);
1306                ret2 = curve25519(out2, in, (u8[CURVE25519_KEY_SIZE]){ 9 });
1307                curve25519_generic(out3, in, (u8[CURVE25519_KEY_SIZE]){ 9 });
1308                if (ret != ret2 ||
1309                    memcmp(out, out2, CURVE25519_KEY_SIZE) ||
1310                    memcmp(out, out3, CURVE25519_KEY_SIZE)) {
1311                        pr_err("curve25519 basepoint self-test %zu: FAIL: input - 0x",
1312                               i + 1);
1313                        for (j = CURVE25519_KEY_SIZE; j-- > 0;)
1314                                printk(KERN_CONT "%02x", in[j]);
1315                        printk(KERN_CONT "\n");
1316                        success = false;
1317                }
1318        }
1319
1320        return success;
1321}
1322