Add Ed25519, BLAKE2b-512 and (sigil crypto minisign)

Message

(sigil crypto) gains ed25519-verify, ed25519-public-key, ed25519-sign and blake2b-512 on Monocypher. The verify core (native/ed25519-verify.c) adds RFC 8032's y < p rule and libsodium's small-order rejection to Monocypher's cofactored check. (sigil crypto minisign) parses minisign public keys and .minisig files and verifies ED and Ed signatures and the trusted-comment global signature, as minisign -V does.

On wasm32-wasi only the Monocypher half is built: Mbed TLS is skipped and every Mbed TLS native is a stub raising "not available on wasm".

Tests: RFC 8032, Wycheproof and ed25519-speccheck vectors; negatives built from valid signatures; minisign fixtures made by minisign 0.12, production registry.json under the registry root key and minisign's own release tarball; a libsodium differential (test/differential); a host, static musl and wasm32-wasi differential (test/wasm).

Version 0.16.7.

Changed

 README.md                                           |   66 ++-
 RELEASES.md                                         |   18 +
 native/crypto.c                                     |   68 ++-
 native/ed25519-verify.c                             |   72 +++
 native/ed25519-verify.h                             |   26 ++
 native/ed25519.c                                    |  195 +++++++++
 native/ed25519.h                                    |   16 +
 package.sgl                                         |   63 ++-
 src/sigil/crypto.sgl                                |   79 +++-
 src/sigil/crypto/minisign.sgl                       |  380 ++++++++++++++++
 test/differential/ed25519-vs-libsodium.c            |  232 ++++++++++
 test/differential/run.sh                            |   25 ++
 test/fixtures/minisign/SHA256SUMS.fixtures          |   16 +
 test/fixtures/minisign/a.pub                        |    2 +
 test/fixtures/minisign/b.pub                        |    2 +
 test/fixtures/minisign/binary.bin                   |  Bin 0 -> 1024 bytes
 test/fixtures/minisign/binary.bin.ED.minisig        |    4 +
 test/fixtures/minisign/binary.bin.Ed.minisig        |    4 +
 test/fixtures/minisign/empty.txt                    |    0
 test/fixtures/minisign/empty.txt.ED.minisig         |    4 +
 test/fixtures/minisign/hello.txt                    |    1 +
 test/fixtures/minisign/hello.txt.ED.minisig         |    4 +
 test/fixtures/minisign/hello.txt.Ed.minisig         |    4 +
 test/fixtures/minisign/hello.txt.keyb.minisig       |    4 +
 test/fixtures/minisign/hello.txt.unicode.minisig    |    4 +
 test/fixtures/minisign/make-fixtures.sh             |   69 +++
 test/fixtures/minisign/minisign-0.12.tar.gz         |  Bin 0 -> 21808 bytes
 test/fixtures/minisign/minisign-0.12.tar.gz.minisig |    4 +
 test/fixtures/minisign/registry.json                |   16 +
 test/fixtures/minisign/registry.json.minisig        |    4 +
 test/test-ed25519-vectors.sgl                       |  366 ++++++++++++++++
 test/test-ed25519.sgl                               |  156 +++++++
 test/test-minisign.sgl                              |  303 +++++++++++++
 test/vectors/ed25519-cases.txt                      |  168 +++++++
 test/vectors/gen-ed25519-vectors.sh                 |   65 +++
 test/vectors/speccheck-cases.json                   |    1 +
 test/vectors/wycheproof-ed25519_test.json           | 3360 +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
 test/wasm/.gitignore                                |    4 +
 test/wasm/gen-fixtures.sh                           |   41 ++
 test/wasm/package.sgl                               |   69 +++
 test/wasm/run-wasm-test.mjs                         |  346 +++++++++++++++
 test/wasm/src/crypto-probe/fixtures.sgl             |   34 ++
 test/wasm/src/crypto-probe/main.sgl                 |   88 ++++
 43 files changed, 6355 insertions(+), 28 deletions(-)

Diff

README.mdmodified

@@ -2,15 +2,17 @@

Cryptographic primitives for [Sigil](https://codeberg.org/sigil/sigil).

−5

Hashing, message authentication, key derivation, base64 encoding, and

Hashing, message authentication, key derivation, Ed25519 signatures,

minisign verification, base64 encoding, and

cryptographically secure random bytes. Built on a vendored mbedTLS and

usable independently of TLS.

## Modules

−11

| Module | Purpose |

−12

|-----------------|-----------------------------------------------|

−13

| `(sigil crypto)`| SHA/HMAC/PBKDF2 hashes, base64, random bytes |

+12

| Module | Purpose |

+13

|--------------------------|----------------------------------------------------------|

+14

| `(sigil crypto)` | SHA/HMAC/PBKDF2 hashes, Ed25519, BLAKE2b, base64, random |

+15

| `(sigil crypto minisign)`| Parse and verify minisign public keys and signatures |

## API summary

@@ -26,6 +28,43 @@ usable independently of TLS.

| `base64-decode` | Base64 decoding to a string |

| `random-bytes` | Cryptographically secure random bytevector |

| `timing-safe-equal?` | Constant-time string comparison |

+31

| `ed25519-verify` | Verify an Ed25519 (RFC 8032) signature |

+32

| `ed25519-public-key` | Ed25519 public key from a 32-byte seed |

+33

| `ed25519-sign` | Ed25519 signature with a 32-byte seed |

+34

| `blake2b-512` | BLAKE2b digest (64 bytes) as a bytevector |

+35

| `minisign-verify` | Verify a minisign signature; returns the trusted comment or #f |

+36

| `minisign-verify-prehashed` | As `minisign-verify`, refusing legacy signatures (`minisign -V -H`) |

+37

| `minisign-failure-reason` | #f when a signature verifies, else why it failed |

+38

+39

## minisign without the minisign binary

+40

+41

```scheme

+42

(import (sigil crypto minisign) (sigil fs))

+43

+44

(define key (minisign-parse-public-key

+45

"RWRa9dPSUBFexBbLdzZIfuAmuCYL736UeHC7IbdAOIYpgGIyDmWRaQHY"))

+46

(define sig (minisign-parse-signature (read-file-bytes "registry.json.minisig")))

+47

+48

(minisign-verify-prehashed key sig (read-file-bytes "registry.json"))

+49

; => "registry=pkg.usesigil.org path=/v1/meta/registry.json seq=1 ts=..."

+50

; or #f when the file, signature or trusted comment has been altered

+51

```

+52

+53

Checks the key id, the signature over the file (`ED`, prehashed with

+54

BLAKE2b-512, or legacy `Ed`) and the global signature over the trusted

+55

comment, as `minisign -V` does. Verification is cofactored (RFC 8032

+56

section 5.1.7) and rejects small-order keys and R values; it agrees with

+57

libsodium, which minisign uses, except for keys with a small-order

+58

component, which an honest minisign key never has.

+59

+60

## WebAssembly

+61

+62

On wasm32-wasi only the Monocypher half of the package is built:

+63

`ed25519-verify`, `ed25519-public-key`, `ed25519-sign`, `blake2b-512` and

+64

`(sigil crypto minisign)`. Every Mbed TLS-backed procedure raises

+65

"not available on wasm" there, because Mbed TLS does not build for

+66

wasm32-wasi yet. The browser build uses this same compiled Ed25519 rather

+67

than WebCrypto, so the API stays synchronous.

## System prerequisites

@@ -36,6 +75,10 @@ are enabled, including PSA, HKDF and RSA-PSS support. Session tickets,

PSK handshakes and early data remain disabled. The vendored version is

Mbed TLS 3.6.7; see `vendor/MBEDTLS.md` for upstream provenance.

+78

Ed25519 and BLAKE2b come from Monocypher 4.0.3, vendored unmodified under

+79

`vendor/monocypher/` (provenance and the reasons for choosing it in

+80

`vendor/MONOCYPHER.md`).

+81

## Dependencies

- sigil-stdlib

@@ -48,8 +91,17 @@ sigil build

sigil test --report

```

+94

Two further gates need tools the suite does not:

+95

+96

```sh

+97

test/differential/run.sh # Ed25519 against libsodium (needs guix)

+98

node test/wasm/run-wasm-test.mjs # host, static musl and wasm32-wasi agree (needs guix, node)

+99

```

+100

101

The first build compiles ~108 mbedTLS translation units plus

−52

`native/crypto.c`. Subsequent builds hit the cache.

+102

`native/crypto.c`. Subsequent builds hit the cache. The minisign

+103

fixtures in `test/fixtures/minisign` are regenerated with

+104

`test/fixtures/minisign/make-fixtures.sh`.

105

106

## Usage

107

@@ -73,3 +125,7 @@ BSD-3-Clause.

125

Vendored mbedTLS (under `vendor/mbedtls/`) is distributed under

126

Apache-2.0 OR GPL-2.0-or-later. sigil-crypto's own sources are

127

BSD-3-Clause. See `vendor/mbedtls/LICENSE` for the mbedTLS terms.

+128

+129

Vendored Monocypher (under `vendor/monocypher/`) is dual-licensed

+130

BSD-2-Clause OR CC0-1.0; sigil-crypto uses it under BSD-2-Clause. See

+131

`vendor/monocypher/LICENCE.md`.

RELEASES.mdadded

@@ -0,0 +1,18 @@

# sigil-crypto Releases

## v0.16.7 — 2026-09-23

Sigil can now check minisign signatures itself. `(sigil crypto)` gains Ed25519 (RFC 8032) and BLAKE2b-512, and the new `(sigil crypto minisign)` parses minisign public keys and `.minisig` files and verifies them the way `minisign -V` does, with no `minisign` binary on PATH. Both build for wasm32-wasi as well as native and static musl targets, so a browser build can verify a signed registry index with the same code as the CLI.

## Changes

- `ed25519-verify` checks an Ed25519 signature and returns `#t` or `#f`. It rejects non-canonical encodings, small-order keys and R values, and S values outside the group order, and checks the cofactored equation that RFC 8032 section 5.1.7 allows. It agrees with libsodium, which the minisign tool uses, on every RFC 8032, Wycheproof and ed25519-speccheck vector except speccheck cases 4 and 5, which need a public key with a small-order component and which an honest key never has.

+10

- `ed25519-public-key` and `ed25519-sign` derive a key and sign with a 32-byte seed; they come with the vendored implementation.

+11

- `blake2b-512` hashes a string or bytevector to 64 bytes.

+12

- `(sigil crypto minisign)`: `minisign-parse-public-key` (a `minisign.pub` file or the bare key line), `minisign-parse-signature`, and `minisign-verify` / `minisign-verify-prehashed`, which return the authenticated trusted comment or `#f`. `minisign-failure-reason` returns `#f` for a good signature and otherwise why it failed: `key-id-mismatch`, `legacy-refused`, `bad-signature` or `bad-trusted-comment-signature`. Both minisign formats verify: prehashed `ED` and legacy `Ed`.

+13

- Ed25519 and BLAKE2b come from Monocypher 4.0.3, vendored unmodified under `vendor/monocypher/` with its provenance in `vendor/MONOCYPHER.md`.

+14

- On wasm32-wasi only the Monocypher procedures and `(sigil crypto minisign)` are built. The Mbed TLS-backed procedures (hashes, HMAC, PBKDF2, ECDSA, ECDH, AES-GCM, base64, random bytes) raise "not available on wasm" there instead of being unbound. Before this release the package did not build for wasm32-wasi at all.

+15

+16

## Upgrade notes

+17

+18

Nothing changes for existing callers on native targets.

native/crypto.cmodified

@@ -7,21 +7,66 @@

* - Base64 encoding/decoding

* - Cryptographically secure random number generation (CTR-DRBG)

*

−10

* Note: Crypto is not available on Emscripten/WebAssembly builds.

−11

* Web applications should use the Web Crypto API via JavaScript interop.

+10

* Ed25519 and BLAKE2b-512 live in native/ed25519.c (vendored Monocypher)

+11

* and are registered into the same module on every target.

+12

*

+13

* On wasm (wasm32-wasi, and Emscripten) Mbed TLS is not built: it needs a

+14

* platform entropy source, sockets and a clock that the wasm build does not

+15

* provide yet (t-8c222f). There the module carries only the Monocypher

+16

* natives; every Mbed TLS-backed name is registered as a stub that raises

+17

* "not available on wasm" when called, so a program that uses one fails

+18

* with that message rather than an unbound variable.

*/

#include <sigil/sigil.h>

−16

#ifdef __EMSCRIPTEN__

−17

/*

−18

* Stub implementation for Emscripten builds.

−19

* Crypto operations should use Web Crypto API in the browser.

−20

*/

+23

#include "ed25519.h"

+24

+25

#if defined(__EMSCRIPTEN__) || defined(__wasi__)

+26

+27

/* Keep in step with the registrations in the native branch below. The wasm

+28

* harness (test/wasm/run-wasm-test.mjs) calls every (sigil crypto) export

+29

* that is not in its working set and fails if one is missing here. */

+30

static const char *const mbedtls_only_natives[] = {

+31

"sha1", "sha256", "sha256-bytes", "ripemd160",

+32

"hmac-sha256", "hmac-sha256-bytes", "hmac-sha512-bytes", "hmac-sha1",

+33

"pbkdf2-sha1", "pbkdf2-sha256", "pbkdf2-sha512",

+34

"base64-encode", "base64-decode", "random-bytes",

+35

"mpi-add", "mpi-sub", "mpi-mul", "mpi-div", "mpi-mod", "mpi-mod-add",

+36

"mpi-inv-mod", "mpi-cmp", "mpi-is-zero?", "mpi-shift-l", "mpi-shift-r",

+37

"ecdsa-p256-generate-keypair", "ecdsa-p256-sign", "ecdsa-p256-verify",

+38

"ecdh-p256-shared-secret", "aes-128-gcm-encrypt", "aes-128-gcm-decrypt",

+39

NULL

+40

};

+41

+42

static Value native_unavailable_on_wasm(SigilVM *vm, int argc, Value *args)

+43

{

+44

(void)argc;

+45

(void)args;

+46

sigil__vm_error(vm, SIGIL_ERR_RUNTIME,

+47

"(sigil crypto): not available on wasm; this procedure "

+48

"needs Mbed TLS, which the wasm build does not include. "

+49

"On wasm only ed25519-verify, ed25519-public-key, "

+50

"ed25519-sign, blake2b-512 and (sigil crypto minisign) "

+51

"are available");

+52

return SIGIL_UNDEFINED;

+53

}

+54

void sigil__init_sigil_crypto_module(SigilVM *vm)

{

−23

(void)vm;

−24

/* Crypto module not available on web platform */

+57

SigilModule *module = sigil_begin_module(vm, "(sigil crypto)");

+58

if (!module) return;

+59

+60

for (const char *const *name = mbedtls_only_natives; *name; name++) {

+61

sigil_module_register_native(vm, *name, native_unavailable_on_wasm,

+62

SIGIL_ARITY_VARIADIC,

+63

"Not available on wasm (needs Mbed TLS)");

+64

sigil_module_export(vm, *name);

+65

}

+66

+67

sigil_crypto_register_ed25519(vm);

+68

+69

sigil_end_module(vm);

}

#else /* Native build */

@@ -1927,9 +1972,12 @@ void sigil__init_sigil_crypto_module(SigilVM *vm)

1972

SIGIL_ARITY_EXACT(5),

1973

"AES-128-GCM decrypt: returns plaintext or #f on auth fail");

1974

+1975

/* Ed25519 and BLAKE2b-512 (Monocypher, native/ed25519.c) */

+1976

sigil_crypto_register_ed25519(vm);

+1977

1978

sigil_end_module(vm);

1979

}

1980

1981

#undef REGISTER_AND_EXPORT

1982

−1935

#endif /* !__EMSCRIPTEN__ */

+1983

#endif /* !(__EMSCRIPTEN__ || __wasi__) */

native/ed25519-verify.cadded

@@ -0,0 +1,72 @@

/*

* Ed25519 signature verification core for sigil-crypto.

*

* Pure C99 over the vendored Monocypher 4.0.3: no Sigil runtime, no

* allocation, no platform calls. Kept apart from native/ed25519.c (the

* Sigil natives) so it can be linked into a plain C harness and compared

* against libsodium (test/differential/).

*/

+10

#include <string.h>

+11

+12

#include "monocypher.h"

+13

#include "monocypher-ed25519.h"

+14

+15

#include "ed25519-verify.h"

+16

+17

/*

+18

* RFC 8032 section 5.1.3 step 1: the low 255 bits of an encoded point are

+19

* y, and "if the y-coordinate is >= p, decoding fails". p = 2^255 - 19, so

+20

* y >= p exactly when the encoding (sign bit masked) is one of

+21

* ed ff .. ff 7f, ee ff .. ff 7f, ..., ff ff .. ff 7f (little-endian).

+22

* Monocypher reduces y mod p instead, so this check is ours.

+23

*/

+24

int sigil_crypto_ed25519_point_is_canonical(const unsigned char p[32])

+25

{

+26

if ((p[31] & 0x7f) != 0x7f) return 1;

+27

for (int i = 30; i >= 1; i--) {

+28

if (p[i] != 0xff) return 1;

+29

}

+30

return p[0] < 0xed;

+31

}

+32

+33

/*

+34

* True when the encoded point decodes and has order dividing 8.

+35

*

+36

* Uses Monocypher's public crypto_eddsa_check_equation, which returns 0

+37

* exactly when the encodings decode and [8]([s]B - [h]A - R) is the

+38

* identity. With s = 0, h = 0 and A = the identity, that is [8](-R) = 0,

+39

* i.e. R has small order. No curve arithmetic is done here.

+40

*

+41

* RFC 8032 section 5.1.3 step 4 ("if x = 0 and x_0 = 1, decoding fails")

+42

* only concerns y = 1 and y = p - 1, the points of order 1 and 2; both are

+43

* rejected by this test, so step 4 needs no separate check.

+44

*/

+45

int sigil_crypto_ed25519_has_small_order(const unsigned char p[32])

+46

{

+47

static const unsigned char identity[32] = {1};

+48

static const unsigned char zero[32] = {0};

+49

unsigned char sig[64];

+50

memcpy(sig, p, 32);

+51

memset(sig + 32, 0, 32);

+52

return crypto_eddsa_check_equation(sig, identity, zero) == 0;

+53

}

+54

+55

int sigil_crypto_ed25519_verify(const unsigned char public_key[32],

+56

const unsigned char *message,

+57

size_t message_len,

+58

const unsigned char signature[64])

+59

{

+60

/* Encodings first: A and R must be canonical and not of small order.

+61

* These are the checks libsodium's crypto_sign_verify_detached (which

+62

* minisign uses) makes before the equation. S < L is checked inside

+63

* crypto_ed25519_check. */

+64

if (!sigil_crypto_ed25519_point_is_canonical(public_key) ||

+65

!sigil_crypto_ed25519_point_is_canonical(signature))

+66

return 0;

+67

if (sigil_crypto_ed25519_has_small_order(public_key) ||

+68

sigil_crypto_ed25519_has_small_order(signature))

+69

return 0;

+70

return crypto_ed25519_check(signature, public_key,

+71

message, message_len) == 0;

+72

}

native/ed25519-verify.hadded

@@ -0,0 +1,26 @@

/*

* Ed25519 verification core. See ed25519-verify.c. No Sigil dependency.

*/

#ifndef SIGIL_CRYPTO_ED25519_VERIFY_H

#define SIGIL_CRYPTO_ED25519_VERIFY_H

#include <stddef.h>

/* 1 when signature (R || S) is a valid RFC 8032 Ed25519 signature of

+10

* message under public_key, 0 otherwise. Non-canonical or small-order A

+11

* and R, and S >= L, are rejected. */

+12

int sigil_crypto_ed25519_verify(const unsigned char public_key[32],

+13

const unsigned char *message,

+14

size_t message_len,

+15

const unsigned char signature[64]);

+16

+17

/* 1 when the 32-byte point encoding has y < p (RFC 8032 section 5.1.3

+18

* step 1). Exposed for the differential harness's boundary tests. */

+19

int sigil_crypto_ed25519_point_is_canonical(const unsigned char p[32]);

+20

+21

/* 1 when the encoding decodes to a point whose order divides 8. Exposed

+22

* for the differential harness, which checks it against the 8-torsion

+23

* points derived independently from the curve equation. */

+24

int sigil_crypto_ed25519_has_small_order(const unsigned char p[32]);

+25

+26

#endif

native/ed25519.cadded

@@ -0,0 +1,195 @@

/*

* Ed25519 (RFC 8032) and BLAKE2b-512 for (sigil crypto), backed by the

* vendored Monocypher 4.0.3 (vendor/monocypher, see vendor/MONOCYPHER.md).

*

* This file has no platform dependencies: no allocation beyond the result

* bytevector, no entropy, no clock. It is compiled on every target,

* including wasm32-wasi, where the Mbed TLS half of the package is not.

*

* Natives registered into the (sigil crypto) module:

+10

*

+11

* ed25519-verify public-key message signature -> #t | #f

+12

* ed25519-public-key seed -> bytevector(32)

+13

* ed25519-sign seed message -> bytevector(64)

+14

* blake2b-512 data -> bytevector(64)

+15

*

+16

* GC discipline: every pointer into a Sigil string or bytevector is used

+17

* before the single allocation that builds the result, and never after it.

+18

*/

+19

+20

#include <sigil/sigil.h>

+21

+22

#include <string.h>

+23

+24

#include "monocypher.h"

+25

#include "monocypher-ed25519.h"

+26

+27

#include "ed25519.h"

+28

+29

#define ED25519_KEY_LEN 32

+30

#define ED25519_SIG_LEN 64

+31

#define BLAKE2B_512_LEN 64

+32

+33

static int ed_read_bytes(SigilVM *vm, Value v, const char *what,

+34

const unsigned char **out_data, size_t *out_len)

+35

{

+36

if (sigil_is_string(v)) {

+37

SigilString *s = (SigilString *)sigil_as_ptr(v);

+38

*out_data = (const unsigned char *)s->data;

+39

*out_len = s->byte_length;

+40

return 1;

+41

}

+42

if (sigil_is_bytevector(v)) {

+43

SigilBytevector *bv = (SigilBytevector *)sigil_as_ptr(v);

+44

*out_data = bv->data;

+45

*out_len = bv->length;

+46

return 1;

+47

}

+48

(void)what;

+49

sigil__vm_error(vm, SIGIL_ERR_TYPE,

+50

"expected string or bytevector argument");

+51

return 0;

+52

}

+53

+54

static int ed_read_bv_exact(SigilVM *vm, Value v, size_t want,

+55

const char *type_msg, const char *length_msg,

+56

const unsigned char **out_data)

+57

{

+58

if (!sigil_is_bytevector(v)) {

+59

sigil__vm_error(vm, SIGIL_ERR_TYPE, type_msg);

+60

return 0;

+61

}

+62

SigilBytevector *bv = (SigilBytevector *)sigil_as_ptr(v);

+63

if (bv->length != want) {

+64

sigil__vm_error(vm, SIGIL_ERR_RUNTIME, length_msg);

+65

return 0;

+66

}

+67

*out_data = bv->data;

+68

return 1;

+69

}

+70

+71

static Value ed_make_bytevector(SigilVM *vm, const unsigned char *data,

+72

size_t len)

+73

{

+74

Value result = sigil_make_bytevector(vm, len);

+75

if (sigil_is_bytevector(result)) {

+76

memcpy(sigil_bytevector_data(result), data, len);

+77

}

+78

return result;

+79

}

+80

+81

/*

+82

* ed25519-verify public-key message signature -> #t | #f

+83

*

+84

* public-key: 32-byte bytevector. signature: 64-byte bytevector (R || S).

+85

* message: string (its UTF-8 bytes) or bytevector. Wrong types or lengths

+86

* raise; a well-formed signature that does not verify returns #f.

+87

*/

+88

static Value native_ed25519_verify(SigilVM *vm, int argc, Value *args)

+89

{

+90

(void)argc;

+91

const unsigned char *pk, *msg, *sig;

+92

size_t msg_len;

+93

if (!ed_read_bv_exact(vm, args[0], ED25519_KEY_LEN,

+94

"ed25519-verify: public key must be a bytevector",

+95

"ed25519-verify: public key must be 32 bytes", &pk) ||

+96

!ed_read_bytes(vm, args[1], "message", &msg, &msg_len) ||

+97

!ed_read_bv_exact(vm, args[2], ED25519_SIG_LEN,

+98

"ed25519-verify: signature must be a bytevector",

+99

"ed25519-verify: signature must be 64 bytes", &sig)) {

+100

return SIGIL_UNDEFINED;

+101

}

+102

return sigil_crypto_ed25519_verify(pk, msg, msg_len, sig)

+103

? SIGIL_TRUE : SIGIL_FALSE;

+104

}

+105

+106

/*

+107

* ed25519-public-key seed -> bytevector(32)

+108

*

+109

* seed is the 32-byte RFC 8032 private key. Deterministic, no RNG.

+110

*/

+111

static Value native_ed25519_public_key(SigilVM *vm, int argc, Value *args)

+112

{

+113

(void)argc;

+114

const unsigned char *seed_in;

+115

if (!ed_read_bv_exact(vm, args[0], ED25519_KEY_LEN,

+116

"ed25519-public-key: seed must be a bytevector",

+117

"ed25519-public-key: seed must be 32 bytes",

+118

&seed_in)) {

+119

return SIGIL_UNDEFINED;

+120

}

+121

/* crypto_ed25519_key_pair wipes the seed buffer it is given, so it

+122

* gets a copy, never the caller's bytevector. */

+123

unsigned char seed[32], secret[64], pk[32];

+124

memcpy(seed, seed_in, 32);

+125

crypto_ed25519_key_pair(secret, pk, seed);

+126

crypto_wipe(secret, sizeof secret);

+127

return ed_make_bytevector(vm, pk, sizeof pk);

+128

}

+129

+130

/*

+131

* ed25519-sign seed message -> bytevector(64)

+132

*

+133

* Deterministic RFC 8032 signature with the 32-byte seed. Provided because

+134

* Monocypher implements it alongside verification; sigil-crypto's own use

+135

* is verification.

+136

*/

+137

static Value native_ed25519_sign(SigilVM *vm, int argc, Value *args)

+138

{

+139

(void)argc;

+140

const unsigned char *seed_in, *msg;

+141

size_t msg_len;

+142

if (!ed_read_bv_exact(vm, args[0], ED25519_KEY_LEN,

+143

"ed25519-sign: seed must be a bytevector",

+144

"ed25519-sign: seed must be 32 bytes", &seed_in) ||

+145

!ed_read_bytes(vm, args[1], "message", &msg, &msg_len)) {

+146

return SIGIL_UNDEFINED;

+147

}

+148

unsigned char seed[32], secret[64], pk[32], sig[64];

+149

memcpy(seed, seed_in, 32);

+150

crypto_ed25519_key_pair(secret, pk, seed);

+151

crypto_ed25519_sign(sig, secret, msg, msg_len);

+152

crypto_wipe(secret, sizeof secret);

+153

/* msg is not touched after this allocation. */

+154

return ed_make_bytevector(vm, sig, sizeof sig);

+155

}

+156

+157

/*

+158

* blake2b-512 data -> bytevector(64)

+159

*

+160

* Unkeyed BLAKE2b with a 64-byte digest (RFC 7693), the hash minisign's

+161

* prehashed "ED" signatures sign.

+162

*/

+163

static Value native_blake2b_512(SigilVM *vm, int argc, Value *args)

+164

{

+165

(void)argc;

+166

const unsigned char *data;

+167

size_t len;

+168

if (!ed_read_bytes(vm, args[0], "data", &data, &len)) {

+169

return SIGIL_UNDEFINED;

+170

}

+171

unsigned char hash[BLAKE2B_512_LEN];

+172

crypto_blake2b(hash, sizeof hash, data, len);

+173

return ed_make_bytevector(vm, hash, sizeof hash);

+174

}

+175

+176

void sigil_crypto_register_ed25519(SigilVM *vm)

+177

{

+178

sigil_module_register_native(vm, "ed25519-verify", native_ed25519_verify,

+179

SIGIL_ARITY_EXACT(3),

+180

"Verify an Ed25519 (RFC 8032) signature");

+181

sigil_module_export(vm, "ed25519-verify");

+182

sigil_module_register_native(vm, "ed25519-public-key",

+183

native_ed25519_public_key,

+184

SIGIL_ARITY_EXACT(1),

+185

"Ed25519 public key from a 32-byte seed");

+186

sigil_module_export(vm, "ed25519-public-key");

+187

sigil_module_register_native(vm, "ed25519-sign", native_ed25519_sign,

+188

SIGIL_ARITY_EXACT(2),

+189

"Ed25519 (RFC 8032) signature with a 32-byte seed");

+190

sigil_module_export(vm, "ed25519-sign");

+191

sigil_module_register_native(vm, "blake2b-512", native_blake2b_512,

+192

SIGIL_ARITY_EXACT(1),

+193

"BLAKE2b-512 digest (bytevector)");

+194

sigil_module_export(vm, "blake2b-512");

+195

}

native/ed25519.hadded

@@ -0,0 +1,16 @@

/*

* Ed25519 and BLAKE2b-512 natives for (sigil crypto). See ed25519.c.

*/

#ifndef SIGIL_CRYPTO_ED25519_H

#define SIGIL_CRYPTO_ED25519_H

#include <sigil/sigil.h>

#include "ed25519-verify.h"

+10

+11

/* Register ed25519-verify, ed25519-public-key, ed25519-sign and

+12

* blake2b-512 into the module currently being built. Call between

+13

* sigil_begin_module and sigil_end_module. */

+14

void sigil_crypto_register_ed25519(SigilVM *vm);

+15

+16

#endif

package.sglmodified

@@ -11,13 +11,32 @@

;;; - Base64 + base64url (RFC 4648 § 5) encoding/decoding

;;; - Cryptographically secure random bytes

;;;

+14

;;; and, using the vendored Monocypher (vendor/MONOCYPHER.md):

+15

;;; - Ed25519 (RFC 8032) verify, sign and public-key derivation

+16

;;; - BLAKE2b-512

+17

;;; - minisign public keys and signatures, (sigil crypto minisign)

+18

;;;

;;; This package vendors mbedTLS and can be used independently of TLS.

+20

;;;

+21

;;; On wasm targets only the Monocypher half is built: Mbed TLS needs an

+22

;;; entropy source, sockets and a clock that the wasm build does not provide

+23

;;; yet (t-8c222f), and the Mbed TLS-backed procedures raise "not available

+24

;;; on wasm" there.

−16

(package

+26

;; skip-on-wasm wraps a build step so it is a no-op on wasm/wasi targets.

+27

;; run-steps threads each step's return value as the ctx for the next step,

+28

;; so a skipped step must return ctx unchanged. Same shape as sigil-audio.

+29

(let ((skip-on-wasm

+30

(lambda (step)

+31

(lambda (ctx)

+32

(if (memq (target-os ctx) '(wasm wasi))

+33

ctx

+34

(step ctx))))))

+35

(package

name: "sigil-crypto"

−18

version: "0.16.6"

+37

version: "0.16.7"

sigil: "0.20"

−20

description: "Cryptographic functions for Sigil (SHA, HMAC, ECDSA, ECDH, AES-GCM, HKDF, base64, random)"

+39

  description: "Cryptographic functions for Sigil (SHA, HMAC, ECDSA, ECDH, AES-GCM, HKDF, Ed25519, BLAKE2b, minisign, base64, random)"

url: "https://codeberg.org/sigil/sigil-crypto"

license: "BSD-3-Clause"

authors: (list "David Wilson <david@daviwil.com>")

@@ -52,14 +71,22 @@

(from-git url: "codeberg:sigil/sigil" package: "sigil-test" version: ">=0.21")

(from-git url: "codeberg:sigil/sigil" package: "sigil-test-runner" version: ">=0.21"))

−55

;; Native library definition

+74

;; Native library definition. sigil-build reads c-sources as a "has native

+75

;; code" test and for the include dirs; the build task below compiles the

+76

;; real, target-dependent list.

libraries: (list

(library

name: 'sigil-crypto

c-sources: '("native/crypto.c"

+81

"native/ed25519.c"

+82

"native/ed25519-verify.c"

+83

"vendor/monocypher/src/monocypher.c"

+84

"vendor/monocypher/src/optional/monocypher-ed25519.c"

"vendor/mbedtls/library/*.c")

c-include-dirs: '("vendor/mbedtls/include"

−62

"vendor/mbedtls")

+87

"vendor/mbedtls"

+88

"vendor/monocypher/src"

+89

"vendor/monocypher/src/optional")

c-flags: '("-DMBEDTLS_CONFIG_FILE=\"sigil_mbedtls_config.h\"")

native-init: "sigil__init_sigil_crypto_module"))

@@ -70,22 +97,36 @@

steps: (list

;; Compile mbedTLS library with our minimal config

;; Shared TLS 1.2/1.3 client configuration, including PSA prerequisites.

−73

(compile-c-sources

+100

;; Not on wasm: three of its units #error there (t-8c222f).

+101

(skip-on-wasm (compile-c-sources

102

sources: "vendor/mbedtls/library/*.c"

103

include-dirs: '("vendor/mbedtls/include"

104

"vendor/mbedtls")

105

flags: '("-std=c99"

106

"-Wall" "-Wno-unused-function"

−79

"-DMBEDTLS_CONFIG_FILE=\"sigil_mbedtls_config.h\""))

+107

"-DMBEDTLS_CONFIG_FILE=\"sigil_mbedtls_config.h\"")))

108

−81

;; Compile crypto.c

+109

;; Compile vendored Monocypher (unmodified upstream 4.0.3) on every

+110

;; target. Plain C99 with no platform calls.

+111

(compile-c-sources

+112

sources: '("vendor/monocypher/src/monocypher.c"

+113

"vendor/monocypher/src/optional/monocypher-ed25519.c")

+114

include-dirs: '("vendor/monocypher/src"

+115

"vendor/monocypher/src/optional")

+116

flags: '("-std=c99" "-Wall" "-Wextra"))

+117

+118

;; Compile crypto.c and ed25519.c

119

;; Flags go through with-sigil-c-flags so the build system injects

120

;; -I<sigil-lib>/include + -I<sigil-lib>/src. crypto.c's

121

;; #include <sigil/sigil.h> resolves via that auto-injection.

122

(compile-c-sources

−86

sources: '("native/crypto.c")

+123

sources: '("native/crypto.c"

+124

"native/ed25519.c"

+125

"native/ed25519-verify.c")

126

include-dirs: '("vendor/mbedtls/include"

−88

"vendor/mbedtls")

+127

"vendor/mbedtls"

+128

"vendor/monocypher/src"

+129

"vendor/monocypher/src/optional")

130

flags: (with-sigil-c-flags '("-std=c99"

131

"-Wall" "-Wextra"

132

"-Wno-unused-parameter"

@@ -98,4 +139,4 @@

139

140

;; Compile Scheme module

141

(compile-sigil-modules

−101

sources: "src/**/*.sgl")))))

+142

sources: "src/**/*.sgl"))))))

src/sigil/crypto.sglmodified

@@ -1,7 +1,9 @@

;;; (sigil crypto) - Cryptographic Functions

;;;

;;; Hashing, message authentication, key derivation, base64 encoding,

−4

;;; and cryptographically secure random bytes. Built on mbedTLS.

;;; and cryptographically secure random bytes, built on Mbed TLS; and

;;; Ed25519 (RFC 8032) and BLAKE2b-512, built on the vendored Monocypher.

;;; minisign signatures are verified by (sigil crypto minisign).

;;;

;;; ```scheme

;;; (import (sigil crypto))

@@ -12,7 +14,20 @@

;;; (base64-encode "hello") ; => "aGVsbG8="

;;; (base64-decode "aGVsbG8=") ; => "hello"

;;; (random-bytes 16) ; => bytevector of 16 random bytes

+17

;;; (ed25519-verify pk msg sig) ; => #t or #f

+18

;;; (blake2b-512 "hello") ; => 64-byte bytevector

;;; ```

+20

;;;

+21

;;; ## Targets

+22

;;;

+23

;;; Native builds (glibc and static musl) have everything. On wasm32-wasi

+24

;;; only the Monocypher procedures are built: `ed25519-verify`,

+25

;;; `ed25519-public-key`, `ed25519-sign` and `blake2b-512`, which is all

+26

;;; (sigil crypto minisign) needs. Mbed TLS needs an entropy source,

+27

;;; sockets and a clock that the wasm build does not provide yet, so every

+28

;;; Mbed TLS-backed procedure raises "not available on wasm" there instead

+29

;;; of being unbound. The Ed25519 API is synchronous on every target; the

+30

;;; browser build uses this compiled implementation, not WebCrypto.

(define-library (sigil crypto)

(export

@@ -52,7 +67,11 @@

aes-128-gcm-decrypt

hkdf-sha256-extract

hkdf-sha256-expand

−55

hkdf-sha256)

+70

hkdf-sha256

+71

ed25519-verify

+72

ed25519-public-key

+73

ed25519-sign

+74

blake2b-512)

(import (sigil math))

@@ -426,6 +445,62 @@

445

-> (any-of bytevector? boolean?)))

446

447

+448

;;; Verify an Ed25519 signature (RFC 8032, pure Ed25519).

+449

;;;

+450

;;; `public-key` is the 32-byte encoded public key, `signature` the

+451

;;; 64-byte R || S, and `message` a string (its UTF-8 bytes) or a

+452

;;; bytevector. Returns #t when the signature is valid and #f

+453

;;; otherwise. A wrong argument type or length raises an error.

+454

;;;

+455

;;; Rejects non-canonical encodings of the key or of R, keys and R

+456

;;; values of small order, and S >= L, as libsodium (and so minisign)

+457

;;; does; checks the cofactored equation of RFC 8032 section 5.1.7.

+458

;;; Cofactored verification is deliberate: RFC 8032 allows it and it

+459

;;; agrees with batch verification. It accepts more than libsodium

+460

;;; only when the key or R has a small-order component, which only the

+461

;;; key holder can produce.

+462

;;; Backed by the vendored Monocypher on every target, including wasm.

+463

;;; The browser build deliberately uses this same compiled

+464

;;; implementation rather than WebCrypto, to keep the API synchronous.

+465

;;;

+466

;;; ```scheme

+467

;;; (ed25519-verify pk "message" sig) ; => #t or #f

+468

;;; ```

+469

(define-native (ed25519-verify public-key message signature)

+470

(: bytevector? (any-of string? bytevector?) bytevector? -> boolean?))

+471

+472

;;; Derive the 32-byte Ed25519 public key from a 32-byte seed

+473

;;; (the RFC 8032 private key).

+474

;;;

+475

;;; ```scheme

+476

;;; (ed25519-public-key (random-bytes 32)) ; => 32-byte bytevector

+477

;;; ```

+478

(define-native (ed25519-public-key seed)

+479

(: bytevector? -> bytevector?))

+480

+481

;;; Sign `message` (string or bytevector) with the 32-byte `seed`.

+482

;;; Returns the deterministic 64-byte RFC 8032 signature. Provided

+483

;;; because the vendored implementation includes it; this package's

+484

;;; own use of Ed25519 is verification.

+485

;;;

+486

;;; ```scheme

+487

;;; (ed25519-sign seed "message") ; => 64-byte bytevector

+488

;;; ```

+489

(define-native (ed25519-sign seed message)

+490

(: bytevector? (any-of string? bytevector?) -> bytevector?))

+491

+492

;;; Compute the unkeyed BLAKE2b hash (RFC 7693) with a 64-byte digest.

+493

;;;

+494

;;; Accepts a string or bytevector. This is the hash minisign's

+495

;;; prehashed signatures sign. Available on every target.

+496

;;;

+497

;;; ```scheme

+498

;;; (bytevector-length (blake2b-512 "abc")) ; => 64

+499

;;; ```

+500

(define-native (blake2b-512 data)

+501

(: (any-of string? bytevector?) -> bytevector?))

+502

+503

504

;;; URL-safe base64 encoding (RFC 4648 § 5).

505

;;;

506

;;; Same alphabet as base64 but with `-` and `_` replacing `+`

src/sigil/crypto/minisign.sgladded

@@ -0,0 +1,380 @@

;;; (sigil crypto minisign) - Verify minisign signatures natively

;;;

;;; Parses minisign public keys and `.minisig` signature files and verifies

;;; them with (sigil crypto)'s Ed25519 and BLAKE2b-512, so no external

;;; `minisign` binary is needed. Verification only; there is no signing.

;;;

;;; ```scheme

;;; (import (sigil crypto minisign) (sigil fs))

;;;

+10

;;; (define key (minisign-parse-public-key

+11

;;; "RWQf6LRCGA9i53mlYecO4IzT51TGPpvWucNSCh1CBM0QTaLn73Y7GFO3"))

+12

;;; (define sig (minisign-parse-signature

+13

;;; (read-file-bytes "SHA256SUMS.minisig")))

+14

;;;

+15

;;; (minisign-verify key sig (read-file-bytes "SHA256SUMS"))

+16

;;; ; => the trusted comment string when valid, #f otherwise

+17

;;; ```

+18

;;;

+19

;;; ## What is checked

+20

;;;

+21

;;; The same things `minisign -V` checks, in the same order:

+22

;;;

+23

;;; 1. The signature's key id equals the public key's key id.

+24

;;; 2. The signature over the file: `ED` (prehashed, minisign's default

+25

;;; since 0.10) is Ed25519 over BLAKE2b-512 of the file; `Ed` (legacy)

+26

;;; is Ed25519 over the file itself. `minisign-verify-prehashed` refuses

+27

;;; `Ed`, like `minisign -V -H`.

+28

;;; 3. The global signature: Ed25519 over the 64 signature bytes followed

+29

;;; by the trusted comment's bytes. This is what makes the trusted

+30

;;; comment trusted.

+31

;;;

+32

;;; The trusted comment is only ever returned by a successful verification;

+33

;;; the parsed signature does not expose it, so an unverified comment

+34

;;; cannot be read by mistake.

+35

;;;

+36

;;; Ed25519 here accepts what RFC 8032 section 5.1.7 accepts (cofactored

+37

;;; equation, canonical encodings, S < L) and rejects small-order keys and

+38

;;; R values as libsodium does. Verification is cofactored, deliberately:

+39

;;; RFC 8032 allows it and it agrees with batch verification. It accepts

+40

;;; more than libsodium (which the minisign tool uses) only when the key or

+41

;;; R has a small-order component (ed25519-speccheck cases 4 and 5), which

+42

;;; only the key holder can produce and an honest minisign key never has.

+43

;;;

+44

;;; ## Parsing is strict

+45

;;;

+46

;;; Anything `minisign` would reject is rejected here, and a few things it

+47

;;; would tolerate are rejected too: base64 must be canonical (standard

+48

;;; alphabet, correct padding, zero pad bits), lines may end in LF or CRLF

+49

;;; but may not contain other CR or NUL bytes, and nothing but blank lines

+50

;;; may follow the fourth line of a signature file. Parse errors raise;

+51

;;; a well-formed signature that does not verify is not an error.

+52

;;;

+53

;;; ## Every target, including the browser

+54

;;;

+55

;;; This module and the natives under it build on native targets and on

+56

;;; wasm32-wasi. The browser build deliberately uses the same compiled

+57

;;; implementation rather than WebCrypto, to keep the API synchronous.

+58

;;; The consumer that makes this load-bearing is Slate running in the

+59

;;; browser and installing extension packages from the registry: there,

+60

;;; verifying the signed index is the security boundary, because a hash

+61

;;; check only proves the bytes match an index that an attacker could

+62

;;; have served too. Verification needs no entropy and no clock, so it

+63

;;; runs anywhere the module loads.

+64

+65

(define-library (sigil crypto minisign)

+66

(export minisign-parse-public-key

+67

minisign-public-key?

+68

minisign-public-key-id

+69

minisign-public-key-bytes

+70

minisign-parse-signature

+71

minisign-signature?

+72

minisign-signature-algorithm

+73

minisign-signature-key-id

+74

minisign-failure-reason

+75

minisign-verify

+76

minisign-verify-prehashed)

+77

+78

(import (sigil crypto)

+79

(sigil io)

+80

(sigil math)

+81

(sigil string)

+82

(sigil struct))

+83

+84

(begin

+85

+86

;; Parsed values. The constructors are not exported: a key or signature

+87

;; can only come from the parsers below.

+88

(define-struct minisign-public-key

+89

(raw-key-id) ; 8-byte bytevector

+90

(raw-bytes)) ; 32-byte Ed25519 public key

+91

+92

(define-struct minisign-signature

+93

(algorithm) ; 'prehashed ("ED") or 'legacy ("Ed")

+94

(raw-key-id) ; 8-byte bytevector

+95

(raw-bytes) ; 64-byte Ed25519 signature over the file (or its hash)

+96

(comment) ; trusted comment as a bytevector, NOT yet authenticated

+97

(global)) ; 64-byte Ed25519 signature over bytes || comment

+98

+99

(define untrusted-prefix "untrusted comment: ")

+100

(define trusted-prefix "trusted comment: ")

+101

+102

;; minisign reads the trusted comment line with fgets into an 8192-byte

+103

;; buffer (TRUSTEDCOMMENTMAXBYTES) and refuses a line that does not

+104

;; fit with its newline and NUL: 8190 bytes including the prefix.

+105

(define max-trusted-line-bytes 8190)

+106

+107

(define (fail what)

+108

(error (string-append "minisign: " what)))

+109

+110

;; --- bytes -----------------------------------------------------------

+111

+112

(define (->bytes x what)

+113

(cond

+114

((bytevector? x) x)

+115

((string? x) (string->utf8 x))

+116

(else (fail (string-append what " must be a string or bytevector")))))

+117

+118

(define (bv-slice bv start end)

+119

(bytevector-copy bv start end))

+120

+121

(define (bv-equal? a b)

+122

(and (= (bytevector-length a) (bytevector-length b))

+123

(let loop ((i 0))

+124

(or (= i (bytevector-length a))

+125

(and (= (bytevector-u8-ref a i) (bytevector-u8-ref b i))

+126

(loop (+ i 1)))))))

+127

+128

(define (bv-prefix? bv prefix-string)

+129

(let ((p (string->utf8 prefix-string)))

+130

(and (>= (bytevector-length bv) (bytevector-length p))

+131

(bv-equal? (bv-slice bv 0 (bytevector-length p)) p))))

+132

+133

(define (bv-contains-byte? bv byte)

+134

(let loop ((i 0))

+135

(and (< i (bytevector-length bv))

+136

(or (= (bytevector-u8-ref bv i) byte)

+137

(loop (+ i 1))))))

+138

+139

;; Split on LF. Each line loses one trailing CR. The piece after a

+140

;; final LF is an empty line, which callers treat as blank.

+141

(define (split-lines bv)

+142

(let ((n (bytevector-length bv)))

+143

(let loop ((i 0) (start 0) (acc '()))

+144

(cond

+145

((= i n)

+146

(reverse (cons (strip-cr (bv-slice bv start n)) acc)))

+147

((= (bytevector-u8-ref bv i) 10)

+148

(loop (+ i 1) (+ i 1) (cons (strip-cr (bv-slice bv start i)) acc)))

+149

(else (loop (+ i 1) start acc))))))

+150

+151

(define (strip-cr line)

+152

(let ((n (bytevector-length line)))

+153

(if (and (> n 0) (= (bytevector-u8-ref line (- n 1)) 13))

+154

(bv-slice line 0 (- n 1))

+155

line)))

+156

+157

(define (blank? line) (= (bytevector-length line) 0))

+158

+159

;; list-tail is not bound in this Sigil's base library (measured); nth

+160

;; is its list-ref twin, kept beside it.

+161

(define (nth lst k) (if (= k 0) (car lst) (nth (cdr lst) (- k 1))))

+162

(define (drop lst k) (if (= k 0) lst (drop (cdr lst) (- k 1))))

+163

+164

;; A line may not carry a CR (other than the stripped trailing one)

+165

;; or a NUL: minisign's line handling truncates at both, so it would

+166

;; not see the same bytes this parser sees.

+167

(define (check-line-bytes line what)

+168

(when (or (bv-contains-byte? line 13) (bv-contains-byte? line 0))

+169

(fail (string-append what " contains a CR or NUL byte"))))

+170

+171

;; --- strict base64 ---------------------------------------------------

+172

+173

(define (b64-value c)

+174

(cond

+175

((and (>= c 65) (<= c 90)) (- c 65)) ; A-Z

+176

((and (>= c 97) (<= c 122)) (+ 26 (- c 97))) ; a-z

+177

((and (>= c 48) (<= c 57)) (+ 52 (- c 48))) ; 0-9

+178

((= c 43) 62) ; +

+179

((= c 47) 63) ; /

+180

(else #f)))

+181

+182

;; Decode standard base64 that must be exactly `want` bytes long.

+183

;; Refuses: a length that is not a multiple of 4, characters outside

+184

;; the alphabet, padding anywhere but the end, the wrong amount of

+185

;; padding for `want`, and non-zero pad bits.

+186

(define (base64-decode-exact line want what)

+187

(let* ((n (bytevector-length line))

+188

(pad (cond

+189

((and (>= n 2)

+190

(= (bytevector-u8-ref line (- n 1)) 61)

+191

(= (bytevector-u8-ref line (- n 2)) 61)) 2)

+192

((and (>= n 1) (= (bytevector-u8-ref line (- n 1)) 61)) 1)

+193

(else 0)))

+194

(expected-pad (modulo (- 3 (modulo want 3)) 3))

+195

(expected-len (* 4 (quotient (+ want 2) 3))))

+196

(unless (and (= n expected-len) (= pad expected-pad))

+197

(fail (string-append what " has the wrong base64 length")))

+198

(let ((out (make-bytevector want 0))

+199

(data-chars (- n pad)))

+200

(let loop ((i 0) (acc 0) (bits 0) (j 0))

+201

(if (< i data-chars)

+202

(let ((v (b64-value (bytevector-u8-ref line i))))

+203

(unless v

+204

(fail (string-append what " contains a character outside base64")))

+205

(let ((acc (+ (* acc 64) v))

+206

(bits (+ bits 6)))

+207

(if (>= bits 8)

+208

(let* ((shift (arithmetic-shift 1 (- bits 8)))

+209

(byte (quotient acc shift)))

+210

(bytevector-u8-set! out j byte)

+211

(loop (+ i 1) (- acc (* byte shift)) (- bits 8) (+ j 1)))

+212

(loop (+ i 1) acc bits j))))

+213

(begin

+214

;; Leftover bits are the pad bits; they must be zero.

+215

(unless (and (= j want) (= acc 0))

+216

(fail (string-append what " has non-canonical base64 padding")))

+217

out))))))

+218

+219

;; --- public keys -----------------------------------------------------

+220

+221

;;; Parse a minisign public key.

+222

;;;

+223

;;; `text` (string or bytevector) is either the contents of a

+224

;;; `minisign.pub` file (an `untrusted comment:` line, then the key line)

+225

;;; or the bare base64 key line, as given to `minisign -P`. Raises on

+226

;;; anything else.

+227

(define (minisign-parse-public-key text)

+228

(let* ((lines (split-lines (->bytes text "public key")))

+229

(content (filter-non-blank lines))

+230

(key-line

+231

(cond

+232

((and (= (length content) 2)

+233

(bv-prefix? (car content) "untrusted comment:"))

+234

(cadr content))

+235

((= (length content) 1) (car content))

+236

(else (fail "public key must be one base64 line, optionally after an untrusted comment line")))))

+237

(check-line-bytes key-line "public key")

+238

(let ((raw (base64-decode-exact key-line 42 "public key")))

+239

(unless (and (= (bytevector-u8-ref raw 0) 69) ; E

+240

(= (bytevector-u8-ref raw 1) 100)) ; d

+241

(fail "public key algorithm is not Ed"))

+242

(minisign-public-key raw-key-id: (bv-slice raw 2 10)

+243

raw-bytes: (bv-slice raw 10 42)))))

+244

+245

(define (filter-non-blank lines)

+246

(cond

+247

((null? lines) '())

+248

((blank? (car lines)) (filter-non-blank (cdr lines)))

+249

(else (cons (car lines) (filter-non-blank (cdr lines))))))

+250

+251

;;; The key id of a parsed public key, as a 16-digit upper-case hex

+252

;;; string in the order `minisign` prints it.

+253

(define (minisign-public-key-id key)

+254

(key-id->hex (minisign-public-key-raw-key-id key)))

+255

+256

;; minisign prints the 8 key id bytes as a little-endian 64-bit number.

+257

(define (key-id->hex id)

+258

(let loop ((i 7) (acc '()))

+259

(if (< i 0)

+260

(apply string-append (reverse acc))

+261

(let* ((b (bytevector-u8-ref id i))

+262

(h (string-upcase (number->string b 16))))

+263

(loop (- i 1) (cons (if (< b 16) (string-append "0" h) h) acc))))))

+264

+265

;;; The raw 32-byte Ed25519 public key.

+266

(define (minisign-public-key-bytes key)

+267

(bytevector-copy (minisign-public-key-raw-bytes key)))

+268

+269

;; --- signatures ------------------------------------------------------

+270

+271

;;; Parse the contents of a `.minisig` file (string or bytevector).

+272

;;;

+273

;;; Four lines: `untrusted comment: ...`, the base64 signature, `trusted

+274

;;; comment: ...`, the base64 global signature. Raises when the file is

+275

;;; malformed or uses an algorithm other than `ED` or `Ed`.

+276

(define (minisign-parse-signature text)

+277

(let* ((lines (split-lines (->bytes text "signature")))

+278

(n (length lines)))

+279

(when (< n 4)

+280

(fail "signature file has fewer than four lines"))

+281

(let ((untrusted (nth lines 0))

+282

(sig-line (nth lines 1))

+283

(trusted-line (nth lines 2))

+284

(global-line (nth lines 3)))

+285

(unless (null? (filter-non-blank (drop lines 4)))

+286

(fail "signature file has content after the global signature"))

+287

(unless (bv-prefix? untrusted untrusted-prefix)

+288

(fail "first line must start with \"untrusted comment: \""))

+289

(unless (bv-prefix? trusted-line trusted-prefix)

+290

(fail "third line must start with \"trusted comment: \""))

+291

(when (> (bytevector-length trusted-line) max-trusted-line-bytes)

+292

(fail "trusted comment is too long"))

+293

(check-line-bytes sig-line "signature")

+294

(check-line-bytes trusted-line "trusted comment")

+295

(check-line-bytes global-line "global signature")

+296

(let* ((raw (base64-decode-exact sig-line 74 "signature"))

+297

(a0 (bytevector-u8-ref raw 0))

+298

(a1 (bytevector-u8-ref raw 1))

+299

(algorithm

+300

(cond

+301

((and (= a0 69) (= a1 68)) 'prehashed) ; "ED"

+302

((and (= a0 69) (= a1 100)) 'legacy) ; "Ed"

+303

(else (fail "unsupported signature algorithm"))))

+304

(comment (bv-slice trusted-line

+305

(string-length trusted-prefix)

+306

(bytevector-length trusted-line))))

+307

(minisign-signature

+308

algorithm: algorithm

+309

raw-key-id: (bv-slice raw 2 10)

+310

raw-bytes: (bv-slice raw 10 74)

+311

comment: comment

+312

global: (base64-decode-exact global-line 64 "global signature"))))))

+313

+314

;;; The key id the signature names, as `minisign-public-key-id` formats

+315

;;; it. Read from the signature file, so it is not authenticated.

+316

(define (minisign-signature-key-id sig)

+317

(key-id->hex (minisign-signature-raw-key-id sig)))

+318

+319

;; --- verification ----------------------------------------------------

+320

+321

;;; Check `sig` against `message` (string or bytevector) under `key`.

+322

;;;

+323

;;; Returns #f when the signature verifies, and otherwise a symbol naming

+324

;;; the first check that failed. #f for success is deliberate: a caller

+325

;;; who tests the result for truth by mistake then rejects every valid

+326

;;; signature, which the first real use shows, rather than accepting

+327

;;; every invalid one, which nothing shows.

+328

;;;

+329

;;; - `'key-id-mismatch`: the signature names a different key

+330

;;; - `'legacy-refused`: `prehashed-only?` is true and the signature

+331

;;; is a legacy `Ed` one

+332

;;; - `'bad-signature`: the signature over the message is wrong

+333

;;; - `'bad-trusted-comment-signature`: the message verifies but the

+334

;;; trusted comment has been altered

+335

;;;

+336

;;; Most callers want `minisign-verify` or `minisign-verify-prehashed`,

+337

;;; which return the authenticated trusted comment or #f.

+338

(define (minisign-failure-reason key sig message prehashed-only?)

+339

(unless (minisign-public-key? key)

+340

(fail "minisign-failure-reason: not a parsed public key"))

+341

(unless (minisign-signature? sig)

+342

(fail "minisign-failure-reason: not a parsed signature"))

+343

(let ((message (->bytes message "message"))

+344

(pk (minisign-public-key-raw-bytes key))

+345

(sig-bytes (minisign-signature-raw-bytes sig)))

+346

(cond

+347

((not (bv-equal? (minisign-public-key-raw-key-id key)

+348

(minisign-signature-raw-key-id sig)))

+349

'key-id-mismatch)

+350

((and prehashed-only?

+351

(eq? (minisign-signature-algorithm sig) 'legacy))

+352

'legacy-refused)

+353

((not (ed25519-verify pk

+354

(if (eq? (minisign-signature-algorithm sig) 'prehashed)

+355

(blake2b-512 message)

+356

message)

+357

sig-bytes))

+358

'bad-signature)

+359

((not (ed25519-verify pk

+360

(bytevector-append sig-bytes

+361

(minisign-signature-comment sig))

+362

(minisign-signature-global sig)))

+363

'bad-trusted-comment-signature)

+364

(else #f))))

+365

+366

;;; Verify like `minisign -V`: accepts prehashed `ED` and legacy `Ed`

+367

;;; signatures. Returns the authenticated trusted comment (a string)

+368

;;; when everything verifies, and #f otherwise.

+369

(define (minisign-verify key sig message)

+370

(verified-comment key sig message #f))

+371

+372

;;; Verify like `minisign -V -H`: as `minisign-verify`, but a legacy

+373

;;; `Ed` signature is refused (#f).

+374

(define (minisign-verify-prehashed key sig message)

+375

(verified-comment key sig message #t))

+376

+377

(define (verified-comment key sig message prehashed-only?)

+378

(if (eq? #f (minisign-failure-reason key sig message prehashed-only?))

+379

(utf8->string (minisign-signature-comment sig))

+380

#f))))

test/differential/ed25519-vs-libsodium.cadded

@@ -0,0 +1,232 @@

/*

* Differential test: sigil-crypto's Ed25519 verify against libsodium's

* crypto_sign_verify_detached, the verifier the minisign tool uses.

*

* Input (stdin): one case per line, "<label> <pk-hex> <sig-hex> <msg-hex>"

* (msg-hex may be "-" for the empty message). For each case both verifiers

* run and the verdicts are printed. Then a mutation phase signs random

* messages with libsodium and flips single bits in the key, the signature

* and the message, comparing verdicts on every mutant.

+10

*

+11

* Output ends with a summary line

+12

* SUMMARY cases=N agree=A expected-divergence=E disagree=D mutants=M ...

+13

* and the exit status is 0 only when N > 0, D = 0, E = 2 (speccheck 4 and

+14

* 5, see below), no mutant is accepted or disagrees, all 200 unmutated

+15

* signatures verify, and all 20 units (7 encoding boundaries, 10 small-order

+16

* encodings, 3 large-order controls) pass.

+17

*

+18

* Build and run: test/differential/run.sh

+19

*/

+20

+21

#include <stdio.h>

+22

#include <stdlib.h>

+23

#include <string.h>

+24

+25

#include <sodium.h>

+26

+27

#include "ed25519-verify.h"

+28

+29

static int hexval(int c)

+30

{

+31

if (c >= '0' && c <= '9') return c - '0';

+32

if (c >= 'a' && c <= 'f') return c - 'a' + 10;

+33

if (c >= 'A' && c <= 'F') return c - 'A' + 10;

+34

return -1;

+35

}

+36

+37

/* Decode hex into out (capacity cap). Returns length, or -1. */

+38

static long unhex(const char *hex, unsigned char *out, size_t cap)

+39

{

+40

if (strcmp(hex, "-") == 0) return 0;

+41

size_t n = strlen(hex);

+42

if (n % 2 != 0 || n / 2 > cap) return -1;

+43

for (size_t i = 0; i < n / 2; i++) {

+44

int hi = hexval(hex[2 * i]), lo = hexval(hex[2 * i + 1]);

+45

if (hi < 0 || lo < 0) return -1;

+46

out[i] = (unsigned char)(hi * 16 + lo);

+47

}

+48

return (long)(n / 2);

+49

}

+50

+51

static int sodium_verdict(const unsigned char *pk, const unsigned char *sig,

+52

const unsigned char *msg, size_t len)

+53

{

+54

return crypto_sign_verify_detached(sig, msg, len, pk) == 0;

+55

}

+56

+57

int main(void)

+58

{

+59

if (sodium_init() < 0) {

+60

fprintf(stderr, "SETUP-FAILED: sodium_init\n");

+61

return 2;

+62

}

+63

printf("libsodium %s\n", sodium_version_string());

+64

+65

static char line[1 << 20];

+66

static unsigned char msg[1 << 19];

+67

long cases = 0, agree = 0, disagree = 0, expected_diverged = 0;

+68

+69

while (fgets(line, sizeof line, stdin)) {

+70

char label[256], pkh[256], sigh[512];

+71

static char msgh[1 << 20];

+72

if (line[0] == '#' || line[0] == '\n') continue;

+73

if (sscanf(line, "%255s %255s %511s %1048575s",

+74

label, pkh, sigh, msgh) != 4) {

+75

fprintf(stderr, "SETUP-FAILED: bad input line: %s", line);

+76

return 2;

+77

}

+78

unsigned char pk[32], sig[64];

+79

long mlen;

+80

if (unhex(pkh, pk, 32) != 32 || unhex(sigh, sig, 64) != 64 ||

+81

(mlen = unhex(msgh, msg, sizeof msg)) < 0) {

+82

/* Wrong-length keys or signatures are rejected by both APIs'

+83

* callers before verification; skip them visibly. */

+84

printf("SKIP %s (not 32-byte key / 64-byte signature)\n", label);

+85

continue;

+86

}

+87

int ours = sigil_crypto_ed25519_verify(pk, msg, (size_t)mlen, sig);

+88

int theirs = sodium_verdict(pk, sig, msg, (size_t)mlen);

+89

cases++;

+90

/* The documented divergence: speccheck cases 4 and 5 need a public

+91

* key with a small-order component and pass the cofactored

+92

* equation (ours) but not libsodium's cofactorless one. They must

+93

* diverge in exactly that direction; anything else is a finding. */

+94

int expected_divergence = strcmp(label, "speccheck-4") == 0 ||

+95

strcmp(label, "speccheck-5") == 0;

+96

const char *tag;

+97

if (expected_divergence) {

+98

if (ours == 1 && theirs == 0) {

+99

expected_diverged++;

+100

tag = "EXPECTED-DIVERGENCE";

+101

} else {

+102

disagree++;

+103

tag = "DIVERGENCE-CHANGED";

+104

}

+105

} else if (ours == theirs) {

+106

agree++;

+107

tag = "AGREE";

+108

} else {

+109

disagree++;

+110

tag = "DISAGREE";

+111

}

+112

printf("%s %s ours=%d libsodium=%d\n", tag, label, ours, theirs);

+113

}

+114

+115

/* Mutation phase: valid signatures from libsodium, one bit flipped. */

+116

long mutants = 0, mutant_disagree = 0, valid_ok = 0;

+117

for (int round = 0; round < 200; round++) {

+118

unsigned char pk[32], sk[64], sig[64], m[97];

+119

size_t mlen = (size_t)(round % (int)sizeof m);

+120

crypto_sign_keypair(pk, sk);

+121

randombytes_buf(m, sizeof m);

+122

crypto_sign_detached(sig, NULL, m, mlen, sk);

+123

if (sigil_crypto_ed25519_verify(pk, m, mlen, sig) &&

+124

sodium_verdict(pk, sig, m, mlen)) {

+125

valid_ok++;

+126

} else {

+127

printf("DISAGREE unmutated round=%d\n", round);

+128

mutant_disagree++;

+129

}

+130

for (int bit = 0; bit < 8; bit++) {

+131

unsigned char p2[32], s2[64], m2[97];

+132

memcpy(p2, pk, 32); memcpy(s2, sig, 64); memcpy(m2, m, sizeof m);

+133

int which = (round + bit) % 3;

+134

if (which == 0) {

+135

p2[randombytes_uniform(32)] ^= (unsigned char)(1u << bit);

+136

} else if (which == 1) {

+137

s2[randombytes_uniform(64)] ^= (unsigned char)(1u << bit);

+138

} else if (mlen > 0) {

+139

m2[randombytes_uniform((uint32_t)mlen)] ^= (unsigned char)(1u << bit);

+140

} else {

+141

s2[0] ^= 1;

+142

}

+143

int ours = sigil_crypto_ed25519_verify(p2, m2, mlen, s2);

+144

int theirs = sodium_verdict(p2, s2, m2, mlen);

+145

mutants++;

+146

if (ours != theirs || ours) {

+147

/* Any accepted mutant is a finding, agreeing or not. */

+148

printf("MUTANT-%s round=%d bit=%d which=%d ours=%d libsodium=%d\n",

+149

ours == theirs ? "ACCEPTED" : "DISAGREE",

+150

round, bit, which, ours, theirs);

+151

mutant_disagree++;

+152

}

+153

}

+154

}

+155

+156

/* Unit phase: the y < p encoding check at its boundaries. No signature

+157

* can reach this check alone (a y >= p encoding of a large-order point

+158

* has no known discrete log to sign with, and the small-order ones are

+159

* also caught by the small-order check), so it is tested directly. */

+160

struct { const char *label; int want; unsigned char last; unsigned char first; int mid_ff; } bounds[] = {

+161

/* little-endian: first byte, 30 middle bytes, last byte */

+162

{ "y=p-1 (ec ff..ff 7f)", 1, 0x7f, 0xec, 1 },

+163

{ "y=p (ed ff..ff 7f)", 0, 0x7f, 0xed, 1 },

+164

{ "y=p+18 (ff ff..ff 7f)", 0, 0x7f, 0xff, 1 },

+165

{ "y=p, sign bit (ed ff..ff ff)", 0, 0xff, 0xed, 1 },

+166

{ "y=p-1, sign bit (ec ff..ff ff)",1, 0xff, 0xec, 1 },

+167

{ "y=0 (00..00)", 1, 0x00, 0x00, 0 },

+168

{ "y=2^254 (00..00 40)", 1, 0x40, 0x00, 0 },

+169

};

+170

long unit = 0, unit_bad = 0;

+171

for (size_t i = 0; i < sizeof bounds / sizeof bounds[0]; i++) {

+172

unsigned char p[32];

+173

memset(p, bounds[i].mid_ff ? 0xff : 0x00, 32);

+174

p[0] = bounds[i].first;

+175

p[31] = bounds[i].last;

+176

int got = sigil_crypto_ed25519_point_is_canonical(p);

+177

unit++;

+178

if (got != bounds[i].want) unit_bad++;

+179

printf("%s canonical(%s) = %d, want %d\n",

+180

got == bounds[i].want ? "UNIT-OK" : "UNIT-BAD",

+181

bounds[i].label, got, bounds[i].want);

+182

}

+183

+184

/* Unit phase: the small-order test against the 8-torsion subgroup,

+185

* derived independently (Python, RFC 8032 section 6 arithmetic: [L]P

+186

* for random points P until 8 distinct points appear). Also the two

+187

* non-canonical encodings of torsion points (y = p, y = p + 1) and

+188

* large-order controls that must NOT be flagged. */

+189

static const char *const torsion[] = {

+190

"0000000000000000000000000000000000000000000000000000000000000000", /* 4 */

+191

"0000000000000000000000000000000000000000000000000000000000000080", /* 4 */

+192

"0100000000000000000000000000000000000000000000000000000000000000", /* 1 */

+193

"26e8958fc2b227b045c3f489f2ef98f0d5dfac05d3c63339b13802886d53fc05", /* 8 */

+194

"26e8958fc2b227b045c3f489f2ef98f0d5dfac05d3c63339b13802886d53fc85", /* 8 */

+195

"c7176a703d4dd84fba3c0b760d10670f2a2053fa2c39ccc64ec7fd7792ac037a", /* 8 */

+196

"c7176a703d4dd84fba3c0b760d10670f2a2053fa2c39ccc64ec7fd7792ac03fa", /* 8 */

+197

"ecffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff7f", /* 2 */

+198

"edffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff7f", /* y=p (0) */

+199

"eeffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff7f", /* y=p+1 (1) */

+200

};

+201

static const char *const large_order[] = {

+202

"d75a980182b10ab7d54bfed3c964073a0ee172f3daa62325af021a68f707511a", /* RFC 8032 T1 */

+203

"3d4017c3e843895a92b70aa74d1b7ebc9c982ccf2ec4968cc0cd55f12af4660c", /* RFC 8032 T2 */

+204

"5866666666666666666666666666666666666666666666666666666666666666", /* base point */

+205

};

+206

for (size_t i = 0; i < sizeof torsion / sizeof torsion[0]; i++) {

+207

unsigned char p[32];

+208

unhex(torsion[i], p, 32);

+209

int got = sigil_crypto_ed25519_has_small_order(p);

+210

unit++;

+211

if (got != 1) unit_bad++;

+212

printf("%s small-order(%s) = %d, want 1\n",

+213

got == 1 ? "UNIT-OK" : "UNIT-BAD", torsion[i], got);

+214

}

+215

for (size_t i = 0; i < sizeof large_order / sizeof large_order[0]; i++) {

+216

unsigned char p[32];

+217

unhex(large_order[i], p, 32);

+218

int got = sigil_crypto_ed25519_has_small_order(p);

+219

unit++;

+220

if (got != 0) unit_bad++;

+221

printf("%s small-order(%s) = %d, want 0\n",

+222

got == 0 ? "UNIT-OK" : "UNIT-BAD", large_order[i], got);

+223

}

+224

+225

printf("SUMMARY cases=%ld agree=%ld expected-divergence=%ld disagree=%ld mutants=%ld "

+226

"mutant-disagree=%ld valid-ok=%ld unit=%ld unit-bad=%ld\n",

+227

cases, agree, expected_diverged, disagree, mutants, mutant_disagree, valid_ok,

+228

unit, unit_bad);

+229

return (cases > 0 && disagree == 0 && expected_diverged == 2 &&

+230

mutant_disagree == 0 &&

+231

valid_ok == 200 && unit == 20 && unit_bad == 0) ? 0 : 1;

+232

}

test/differential/run.shadded

@@ -0,0 +1,25 @@

#!/bin/sh

# Differential gate: sigil-crypto's Ed25519 verify core against libsodium

# (what the minisign tool verifies with), over RFC 8032, Wycheproof and

# ed25519-speccheck vectors plus 1,600 single-bit mutants.

#

# Needs guix (for gcc-toolchain + libsodium). Run from the repo root:

# test/differential/run.sh

# Exit 0 only when every case and mutant agrees; see the SUMMARY line.

set -eu

+10

ROOT=$(cd "$(dirname "$0")/../.." && pwd)

+11

OUT=$(mktemp -d)

+12

trap 'rm -rf "$OUT"' EXIT

+13

guix shell gcc-toolchain libsodium pkg-config -- sh -c '

+14

set -eu

+15

gcc -std=c99 -O2 -Wall -Wextra \

+16

-I"$1/native" -I"$1/vendor/monocypher/src" -I"$1/vendor/monocypher/src/optional" \

+17

"$1/test/differential/ed25519-vs-libsodium.c" \

+18

"$1/native/ed25519-verify.c" \

+19

"$1/vendor/monocypher/src/monocypher.c" \

+20

"$1/vendor/monocypher/src/optional/monocypher-ed25519.c" \

+21

$(pkg-config --cflags --libs libsodium) -o "$2/diff"

+22

' sh "$ROOT" "$OUT"

+23

# Input lines are "<label> <pk> <sig> <msg> <expected>"; the harness reads

+24

# the first four fields.

+25

"$OUT/diff" < "$ROOT/test/vectors/ed25519-cases.txt"

test/fixtures/minisign/SHA256SUMS.fixturesadded

@@ -0,0 +1,16 @@

dd29f07c6d5bc0f20c537730d3ceb1b428aeb68da3f414b15e0153096a63010c a.pub

584d5cbcbd670d1665637e92cbc9d4355cb8e4a15a9257d30f62fd7a656c6077 b.pub

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 empty.txt

d2e6b126d73e31b47434966470187c19c1875e08d36f869fe666753e714414ea hello.txt

785b0751fc2c53dc14a4ce3d800e69ef9ce1009eb327ccf458afe09c242c26c9 binary.bin

e1084688607a8358e8713f65d62793d4c70656277bb8a417caae77e04ff460ab binary.bin.ED.minisig

9a6fe11e0b9b5e230ae4475a141ddf7ba4afa9f0108d30526a642f3a1a821a21 binary.bin.Ed.minisig

b1ffb765f93dd346afad1f8c2ea4cf3870b5fa0b88fd4d6ddabb6243d484c7da empty.txt.ED.minisig

3201ca35d18f0c9b8a21a280a12f017ba3842d6ca8ab3ecd80d025847ec498d8 hello.txt.ED.minisig

+10

71dc5d67dae8a7a6acf28a4b9a70cc91a43a0584da03d4dfed161b084a78cf2e hello.txt.Ed.minisig

+11

db2cd82e57408f28bd78a1cc31a14011bd68f75ea89e484d40aea02f31683cdf hello.txt.keyb.minisig

+12

d151631a336ef2cdbbabc84d09e7dba0220ff9fd8b0d5ddb276d5aa090c0a4ed hello.txt.unicode.minisig

+13

dd286956a4c8fd832e9d0654c2bd8bd4b1d0035987e65c42445b3850c1f2cc7e minisign-0.12.tar.gz.minisig

+14

e7fbb737645ee2b0a79cbf94429f903d914db8895339dd6f25debb12c888eef4 registry.json.minisig

+15

dda48047824314698331702a12d8d50dd1f167a399e098d663ed08975bd93a09 registry.json

+16

677e3dd52f559992c72be932d958587b5f731a1a295bcee37be878ed3f585926 minisign-0.12.tar.gz

test/fixtures/minisign/a.pubadded

@@ -0,0 +1,2 @@

untrusted comment: minisign public key 14EB3FB290B96204

RWQEYrmQsj/rFOITx6WOfk1JVuOslJV7zwvh6mM3NCDJHhsYfllcASAM

test/fixtures/minisign/b.pubadded

@@ -0,0 +1,2 @@

untrusted comment: minisign public key C18A2BC89C1116E4

RWTkFhGcyCuKwcaayKgqBhF4tXBbxLlYd5YzwRAJiE1+UBN/VjsO6emt

test/fixtures/minisign/binary.binbinary

Binary. Not rendered here.

test/fixtures/minisign/binary.bin.ED.minisigadded

@@ -0,0 +1,4 @@

untrusted comment: signature from minisign secret key

RUQEYrmQsj/rFLV7uZuuDOZndblCG1t7hvSAp+7svcm5Co8ImUnUR26/Fd0zDaO+Up+0NRSeLDlZz7o2iKFmm2KSOPih/Yii+Qc=

trusted comment: sigil-crypto fixture: binary

x23O9YaUJcbmAAOoRf5zSoRGj8gvl3fjEV5nMtlCqz8iGuD2c0NeVb+tcos90vMIkjOv7HIlDDlrS3+Mg0iaCA==

test/fixtures/minisign/binary.bin.Ed.minisigadded

@@ -0,0 +1,4 @@

untrusted comment: signature from minisign secret key

RWQEYrmQsj/rFFPr+gm0F6fTajvcnJ9sw6dyLAO2+87zdqgeB7KE9pUJh6olqYNPztjXBCw2/c8mXZ8YW0G1daRCoAUrOsBeGgU=

trusted comment: sigil-crypto fixture: binary legacy

qMXYd3ygQ9Tntxg7BvGgVFPgxBCdhiUueRkuSnhhdm93BSVxu3nOoedYHm48FMkJPHz+sVTp+qiBaaz2EMxCAg==

test/fixtures/minisign/empty.txtadded

No content change.

test/fixtures/minisign/empty.txt.ED.minisigadded

@@ -0,0 +1,4 @@

untrusted comment: signature from minisign secret key

RUQEYrmQsj/rFOXiTiZAjZxEAUtoox3cvNRemTMRSVgsxBDK2T2WdaR2IES7oXUHKIDEA65st42VuIuN0Re0QeCrAqDDpHbhbA0=

trusted comment: sigil-crypto fixture: empty file

L0fWkEvuUd3D+vi8i1e3y3qeRNFGHMo39R5LD3GnvNhCnd/oG4wpTB3Vo4M/myiZK+5PvkK4QawsF0j8bcjLCQ==

test/fixtures/minisign/hello.txtadded

@@ -0,0 +1 @@

hello, minisign

test/fixtures/minisign/hello.txt.ED.minisigadded

@@ -0,0 +1,4 @@

untrusted comment: signature from minisign secret key

RUQEYrmQsj/rFGAyTtKQ+4xZK+0g3fTMxrwdwVx7Zjj99HA7wtkILpBp5KJKc60Q6Gb/+YEBOFMGdO/iEzPsE1StElYtKSlfdgM=

trusted comment: sigil-crypto fixture: prehashed

gWEm4hy15jT9JNQqTqllc58wBdpu1m4bDJycmgqbPKkr/Zb+Qu/R+R5aSHy3kL3Q7vy4LZtABSdGP4OYPuTbAg==

test/fixtures/minisign/hello.txt.Ed.minisigadded

@@ -0,0 +1,4 @@

untrusted comment: signature from minisign secret key

RWQEYrmQsj/rFBykYBac8OeKibJSYKcd+vrVMQ44BnmpbBibg2RMi75aC4zJKnPb2q4YwmUEfanfUccJ4Nn9ujGmkxui/Ms1cQ8=

trusted comment: sigil-crypto fixture: legacy

n3F3KbUvZENZMrgMek8cM48rRatGbW0n5RhKPR7YKcuwAbw9bb0NcQpo635PBwQ4QjoG5mOXAbUz1tShz1JwAg==

test/fixtures/minisign/hello.txt.keyb.minisigadded

@@ -0,0 +1,4 @@

untrusted comment: signature from minisign secret key

RUTkFhGcyCuKwYTMUo4X8cdeC3c3LfG1rSDfz0MncA4JU60b51ReaUS53TOK0zjnYHs5JWshctEzUMALsI0iwm+6MV2dAor0Zgo=

trusted comment: sigil-crypto fixture: key b

2fz1Bwvo58gwgkeTH4CXzyHA3cO6YiB9u2ZejnG4mIZG0Z7KqXv1STMonZ0y15BY5n55GnQ+97dxfa+lRpOlAg==

test/fixtures/minisign/hello.txt.unicode.minisigadded

@@ -0,0 +1,4 @@

untrusted comment: signature from minisign secret key

RUQEYrmQsj/rFGAyTtKQ+4xZK+0g3fTMxrwdwVx7Zjj99HA7wtkILpBp5KJKc60Q6Gb/+YEBOFMGdO/iEzPsE1StElYtKSlfdgM=

trusted comment: fixture ✓ unicode — trusted

eWW/fZv93llWpOOLFin428gYhWSYuaKdIfV7LcOvEUnrtv8RUxnfpN+dNf4rFJoa1j9WDn2wpSjMKHDM134DBQ==

test/fixtures/minisign/make-fixtures.shadded

@@ -0,0 +1,69 @@

#!/bin/sh

# Regenerate the minisign interop fixtures with the real minisign tool.

#

# guix shell minisign curl -- test/fixtures/minisign/make-fixtures.sh

#

# Keys are generated fresh (unencrypted, in a temp dir that is deleted);

# only public keys, messages and signatures are kept. Re-running changes

# every key and signature, so commit the whole directory together.

#

+10

# Also fetches two signatures made by other people's keys:

+11

# - production registry.json(.minisig) from pkg.usesigil.org, signed by

+12

# the Sigil registry ROOT key that sigil-env pins (trust.sgl);

+13

# - minisign-0.12.tar.gz(.minisig) from minisign's GitHub release,

+14

# signed by the minisign author's published key (minisign README).

+15

set -eu

+16

DIR=$(cd "$(dirname "$0")" && pwd)

+17

KEYS=$(mktemp -d)

+18

trap 'rm -rf "$KEYS"' EXIT

+19

cd "$DIR"

+20

minisign -v

+21

+22

minisign -G -W -f -p a.pub -s "$KEYS/a.key" >/dev/null

+23

minisign -G -W -f -p b.pub -s "$KEYS/b.key" >/dev/null

+24

+25

printf 'hello, minisign\n' > hello.txt

+26

: > empty.txt

+27

# Every byte value, including NUL and CR, four times over.

+28

LC_ALL=C awk 'BEGIN { for (r = 0; r < 4; r++) for (i = 0; i < 256; i++) printf "%c", i }' > binary.bin

+29

[ "$(wc -c < binary.bin)" -eq 1024 ] || { echo "REFUSING: binary.bin is not 1024 bytes"; exit 1; }

+30

+31

sign() { # sign <key> <file> <sigfile> <trusted-comment> [extra flags]

+32

key=$1 file=$2 out=$3 tc=$4; shift 4

+33

minisign -S -s "$KEYS/$key.key" -m "$file" -x "$out" -t "$tc" "$@" >/dev/null

+34

}

+35

sign a hello.txt hello.txt.ED.minisig "sigil-crypto fixture: prehashed"

+36

sign a hello.txt hello.txt.Ed.minisig "sigil-crypto fixture: legacy" -l

+37

sign a empty.txt empty.txt.ED.minisig "sigil-crypto fixture: empty file"

+38

sign a binary.bin binary.bin.ED.minisig "sigil-crypto fixture: binary"

+39

sign a binary.bin binary.bin.Ed.minisig "sigil-crypto fixture: binary legacy" -l

+40

sign a hello.txt hello.txt.unicode.minisig "fixture ✓ unicode — trusted"

+41

sign b hello.txt hello.txt.keyb.minisig "sigil-crypto fixture: key b"

+42

+43

# Every signature must verify with the tool itself before it is a fixture.

+44

minisign -V -q -p a.pub -m hello.txt -x hello.txt.ED.minisig

+45

minisign -V -q -p a.pub -m hello.txt -x hello.txt.Ed.minisig

+46

minisign -V -q -p a.pub -m empty.txt -x empty.txt.ED.minisig

+47

minisign -V -q -p a.pub -m binary.bin -x binary.bin.ED.minisig

+48

minisign -V -q -p a.pub -m binary.bin -x binary.bin.Ed.minisig

+49

minisign -V -q -p a.pub -m hello.txt -x hello.txt.unicode.minisig

+50

minisign -V -q -p b.pub -m hello.txt -x hello.txt.keyb.minisig

+51

# -H refuses the legacy one: the positive control for minisign-verify-prehashed.

+52

if minisign -V -q -H -p a.pub -m hello.txt -x hello.txt.Ed.minisig 2>/dev/null; then

+53

echo "REFUSING: minisign -H accepted a legacy signature"; exit 1

+54

fi

+55

+56

curl -fsS -o registry.json https://pkg.usesigil.org/v1/meta/registry.json

+57

curl -fsS -o registry.json.minisig https://pkg.usesigil.org/v1/meta/registry.json.minisig

+58

minisign -V -q -P RWRa9dPSUBFexBbLdzZIfuAmuCYL736UeHC7IbdAOIYpgGIyDmWRaQHY \

+59

-m registry.json -x registry.json.minisig

+60

+61

curl -fsSL -o minisign-0.12.tar.gz \

+62

https://github.com/jedisct1/minisign/releases/download/0.12/minisign-0.12.tar.gz

+63

curl -fsSL -o minisign-0.12.tar.gz.minisig \

+64

https://github.com/jedisct1/minisign/releases/download/0.12/minisign-0.12.tar.gz.minisig

+65

minisign -V -q -P RWQf6LRCGA9i53mlYecO4IzT51TGPpvWucNSCh1CBM0QTaLn73Y7GFO3 \

+66

-m minisign-0.12.tar.gz -x minisign-0.12.tar.gz.minisig

+67

+68

sha256sum *.pub *.txt *.bin *.minisig registry.json minisign-0.12.tar.gz > SHA256SUMS.fixtures

+69

echo FIXTURES-COMPLETE

test/fixtures/minisign/minisign-0.12.tar.gzbinary

Binary. Not rendered here.

test/fixtures/minisign/minisign-0.12.tar.gz.minisigadded

@@ -0,0 +1,4 @@

untrusted comment: signature from minisign secret key

RUQf6LRCGA9i5waVmlhf9oT0Gur6lx+L3WKuMprQQ1BqCWqdCZnzPHFjFRadIlQxZlaymKfeCz8QHg3Ulh4lYxVQ89K/gKejDA0=

trusted comment: timestamp:1736977639 file:minisign-0.12.tar.gz hashed

NzfDbdEGyVNkoxsrCAJMh7udzsrRhRAJoq59PEcPy0JnFM2/jdF8UE68unWZVejyZ0TUGWI0VJTTbFQ4HL1UAQ==

test/fixtures/minisign/registry.jsonadded

@@ -0,0 +1,16 @@

{

"schema": 1,

"protocol": 1,

"registry": "pkg.usesigil.org",

"seq": 1,

"updated": "2026-07-30T08:04:54Z",

"keys": [

    {"id":"C45E1150D2D3F55A","algorithm":"minisign-ed25519","roles":["root"],"public-key":"RWRa9dPSUBFexBbLdzZIfuAmuCYL736UeHC7IbdAOIYpgGIyDmWRaQHY","status":"active"},

    {"id":"21CC9BE316C6E0FD","algorithm":"minisign-ed25519","roles":["index"],"public-key":"RWT94MYW45vMIbIdQurIMk46IDZQMiHzlP7VwYQPVNztxJwE23FkHuR1","status":"active"},

+10

    {"id":"7F92B426060F2F06","algorithm":"minisign-ed25519","roles":["toolchain"],"public-key":"RWQGLw8GJrSSfzudcy/vnMgUzoEUvVdmZxyzA20AJ6gSusjQk3eb3aBU","status":"active"},

+11

    {"id":"DB1A828BD034F595","algorithm":"minisign-ed25519","roles":["substitutes"],"public-key":"RWSV9TTQi4Ia2zvGgBaclHH8wIC4c/E1249XreikJ8g0U4/z+vsM77p2","status":"active"},

+12

    {"id":"989EF54F5E93C736","algorithm":"minisign-ed25519","roles":["channels"],"public-key":"RWQ2x5NeT/WemGsI3aV/G8gnrLevQftaIYIC2d06FPcoSV7n1hcan0j0","status":"active"}

+13

],

+14

"log": null,

+15

"reproducibility": null

+16

}

test/fixtures/minisign/registry.json.minisigadded

@@ -0,0 +1,4 @@

untrusted comment: signature from minisign secret key

RURa9dPSUBFexGJGC6m+fr4URX3C6/14b7cv85FbTgui4dCOAROj/xA0Vy4Sn5uXbBlsOW9PBYQNz+bZ2fvQPr4O5q//+bkLkQw=

trusted comment: registry=pkg.usesigil.org path=/v1/meta/registry.json seq=1 ts=2026-07-30T08:04:54Z

CL7XNWmV5Klo6bIHE8x2IXF18LwqHfZP2rynmoSPrRzDCLJtlGfw+MLx7cQGYSZo/Lk4cA2OGMFA/O1QzYBYCw==

test/test-ed25519-vectors.sgladded

@@ -0,0 +1,366 @@

;;; GENERATED by test/vectors/gen-ed25519-vectors.sh from

;;; test/vectors/ed25519-cases.txt. Do not edit by hand.

;;;

;;; Every case runs through ed25519-verify. A valid case must return #t;

;;; an invalid one must return #f, or raise when the key or signature has the

;;; wrong length (the API raises on wrong lengths; nothing else may raise).

(import (sigil test) (sigil crypto) (sigil math))

+10

(define (hex->bv s)

+11

(if (string=? s "-")

+12

(make-bytevector 0 0)

+13

(let* ((n (quotient (string-length s) 2))

+14

(bv (make-bytevector n 0)))

+15

(let loop ((i 0))

+16

(if (< i n)

+17

(begin

+18

(bytevector-u8-set! bv i (string->number (substring s (* 2 i) (+ 2 (* 2 i))) 16))

+19

(loop (+ i 1)))

+20

bv)))))

+21

+22

;; #t, #f, or the symbol raised when the call raises.

+23

(define (verdict pk sig msg)

+24

(guard (e (#t (quote raised)))

+25

(ed25519-verify (hex->bv pk) (hex->bv msg) (hex->bv sig))))

+26

+27

(test-group "ed25519 vectors"

+28

(test "rfc8032-1 valid"

+29

    (assert-eq #t (verdict "d75a980182b10ab7d54bfed3c964073a0ee172f3daa62325af021a68f707511a" "e5564300c360ac729086e2cc806e828a84877f1eb8e5d974d873e065224901555fb8821590a33bacc61e39701cf9b46bd25bf5f0595bbe24655141438e7a100b" "-")))

+30

(test "rfc8032-2 valid"

+31

    (assert-eq #t (verdict "3d4017c3e843895a92b70aa74d1b7ebc9c982ccf2ec4968cc0cd55f12af4660c" "92a009a9f0d4cab8720e820b5f642540a2b27b5416503f8fb3762223ebdb69da085ac1e43e15996e458f3613d0f11d8c387b2eaeb4302aeeb00d291612bb0c00" "72")))

+32

(test "rfc8032-3 valid"

+33

    (assert-eq #t (verdict "fc51cd8e6218a1a38da47ed00230f0580816ed13ba3303ac5deb911548908025" "6291d657deec24024827e69c3abe01a30ce548a284743a445e3680d7db5ac3ac18ff9b538d16f290ae67f760984dc6594a7c15e9716ed28dc027beceea1ec40a" "af82")))

+34

(test "rfc8032-1024 valid"

+35

    (assert-eq #t (verdict "278117fc144c72340f67d0f2316e8386ceffbf2b2428c9c51fef7c597f1d426e" "0aab4c900501b3e24d7cdf4663326a3a87df5e4843b2cbdb67cbf6e460fec350aa5371b1508f9f4528ecea23c436d94b5e8fcd4f681e30a6ac00a9704a188a03" "08b8b2b733424243760fe426a4b54908632110a66c2f6591eabd3345e3e4eb98fa6e264bf09efe12ee50f8f54e9f77b1e355f6c50544e23fb1433ddf73be84d879de7c0046dc4996d9e773f4bc9efe5738829adb26c81b37c93a1b270b20329d658675fc6ea534e0810a4432826bf58c941efb65d57a338bbd2e26640f89ffbc1a858efcb8550ee3a5e1998bd177e93a7363c344fe6b199ee5d02e82d522c4feba15452f80288a821a579116ec6dad2b3b310da903401aa62100ab5d1a36553e06203b33890cc9b832f79ef80560ccb9a39ce767967ed628c6ad573cb116dbefefd75499da96bd68a8a97b928a8bbc103b6621fcde2beca1231d206be6cd9ec7aff6f6c94fcd7204ed3455c68c83f4a41da4af2b74ef5c53f1d8ac70bdcb7ed185ce81bd84359d44254d95629e9855a94a7c1958d1f8ada5d0532ed8a5aa3fb2d17ba70eb6248e594e1a2297acbbb39d502f1a8c6eb6f1ce22b3de1a1f40cc24554119a831a9aad6079cad88425de6bde1a9187ebb6092cf67bf2b13fd65f27088d78b7e883c8759d2c4f5c65adb7553878ad575f9fad878e80a0c9ba63bcbcc2732e69485bbc9c90bfbd62481d9089beccf80cfe2df16a2cf65bd92dd597b0707e0917af48bbb75fed413d238f5555a7a569d80c3414a8d0859dc65a46128bab27af87a71314f318c782b23ebfe808b82b0ce26401d2e22f04d83d1255dc51addd3b75a2b1ae0784504df543af8969be3ea7082ff7fc9888c144da2af58429ec96031dbcad3dad9af0dcbaaaf268cb8fcffead94f3c7ca495e056a9b47acdb751fb73e666c6c655ade8297297d07ad1ba5e43f1bca32301651339e22904cc8c42f58c30c04aafdb038dda0847dd988dcda6f3bfd15c4b4c4525004aa06eeff8ca61783aacec57fb3d1f92b0fe2fd1a85f6724517b65e614ad6808d6f6ee34dff7310fdc82aebfd904b01e1dc54b2927094b2db68d6f903b68401adebf5a7e08d78ff4ef5d63653a65040cf9bfd4aca7984a74d37145986780fc0b16ac451649de6188a7dbdf191f64b5fc5e2ab47b57f7f7276cd419c17a3ca8e1b939ae49e488acba6b965610b5480109c8b17b80e1b7b750dfc7598d5d5011fd2dcc5600a32ef5b52a1ecc820e308aa342721aac0943bf6686b64b2579376504ccc493d97e6aed3fb0f9cd71a43dd497f01f17c0e2cb3797aa2a2f256656168e6c496afc5fb93246f6b1116398a346f1a641f3b041e989f7914f90cc2c7fff357876e506b50d334ba77c225bc307ba537152f3f1610e4eafe595f6d9d90d11faa933a15ef1369546868a7f3a45a96768d40fd9d03412c091c6315cf4fde7cb68606937380db2eaaa707b4c4185c32eddcdd306705e4dc1ffc872eeee475a64dfac86aba41c0618983f8741c5ef68d3a101e8a3b8cac60c905c15fc910840b94c00a0b9d0")))

+36

(test "rfc8032-SHAabc valid"

+37

    (assert-eq #t (verdict "ec172b93ad5e563bf4932c70e1245034c35467ef2efd4d64ebf819683467e2bf" "dc2a4459e7369633a52b1bf277839a00201009a3efbf3ecb69bea2186c26b58909351fc9ac90b3ecfdfbc7c66431e0303dca179c138ac17ad9bef1177331a704" "ddaf35a193617abacc417349ae20413112e6fa4e89a97ea20a9eeee64b55d39a2192992a274fc1a836ba3c23a3feebbd454d4423643ce80e2a9ac94fa54ca49f")))

+38

(test "wycheproof-1 valid"

+39

    (assert-eq #t (verdict "7d4d0e7f6153a69b6242b522abbee685fda4420f8834b108c3bdae369ef549fa" "d4fbdb52bfa726b44d1786a8c0d171c3e62ca83c9e5bbe63de0bb2483f8fd6cc1429ab72cafc41ab56af02ff8fcc43b99bfe4c7ae940f60f38ebaa9d311c4007" "-")))

+40

(test "wycheproof-2 valid"

+41

    (assert-eq #t (verdict "7d4d0e7f6153a69b6242b522abbee685fda4420f8834b108c3bdae369ef549fa" "d80737358ede548acb173ef7e0399f83392fe8125b2ce877de7975d8b726ef5b1e76632280ee38afad12125ea44b961bf92f1178c9fa819d020869975bcbe109" "78")))

+42

(test "wycheproof-3 valid"

+43

    (assert-eq #t (verdict "7d4d0e7f6153a69b6242b522abbee685fda4420f8834b108c3bdae369ef549fa" "7c38e026f29e14aabd059a0f2db8b0cd783040609a8be684db12f82a27774ab07a9155711ecfaf7f99f277bad0c6ae7e39d4eef676573336a5c51eb6f946b30d" "54657374")))

+44

(test "wycheproof-4 valid"

+45

    (assert-eq #t (verdict "7d4d0e7f6153a69b6242b522abbee685fda4420f8834b108c3bdae369ef549fa" "1c1ad976cbaae3b31dee07971cf92c928ce2091a85f5899f5e11ecec90fc9f8e93df18c5037ec9b29c07195ad284e63d548cd0a6fe358cc775bd6c1608d2c905" "48656c6c6f")))

+46

(test "wycheproof-5 valid"

+47

    (assert-eq #t (verdict "7d4d0e7f6153a69b6242b522abbee685fda4420f8834b108c3bdae369ef549fa" "657c1492402ab5ce03e2c3a7f0384d051b9cf3570f1207fc78c1bcc98c281c2bf0cf5b3a289976458a1be6277a5055545253b45b07dcc1abd96c8b989c00f301" "313233343030")))

+48

(test "wycheproof-6 valid"

+49

    (assert-eq #t (verdict "7d4d0e7f6153a69b6242b522abbee685fda4420f8834b108c3bdae369ef549fa" "d46543bfb892f84ec124dcdfc847034c19363bf3fc2fa89b1267833a14856e52e60736918783f950b6f1dd8d40dc343247cd43ce054c2d68ef974f7ed0f3c60f" "000000000000000000000000")))

+50

(test "wycheproof-7 valid"

+51

    (assert-eq #t (verdict "7d4d0e7f6153a69b6242b522abbee685fda4420f8834b108c3bdae369ef549fa" "879350045543bc14ed2c08939b68c30d22251d83e018cacbaf0c9d7a48db577e80bdf76ce99e5926762bc13b7b3483260a5ef63d07e34b58eb9c14621ac92f00" "6161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161")))

+52

(test "wycheproof-8 valid"

+53

    (assert-eq #t (verdict "7d4d0e7f6153a69b6242b522abbee685fda4420f8834b108c3bdae369ef549fa" "7bdc3f9919a05f1d5db4a3ada896094f6871c1f37afc75db82ec3147d84d6f237b7e5ecc26b59cfea0c7eaf1052dc427b0f724615be9c3d3e01356c65b9b5109" "202122232425262728292a2b2c2d2e2f303132333435363738393a3b3c3d3e3f404142434445464748494a4b4c4d4e4f505152535455565758595a5b5c5d5e5f60")))

+54

(test "wycheproof-9 valid"

+55

    (assert-eq #t (verdict "7d4d0e7f6153a69b6242b522abbee685fda4420f8834b108c3bdae369ef549fa" "5dbd7360e55aa38e855d6ad48c34bd35b7871628508906861a7c4776765ed7d1e13d910faabd689ec8618b78295c8ab8f0e19c8b4b43eb8685778499e943ae04" "ffffffffffffffffffffffffffffffff")))

+56

(test "wycheproof-10 invalid"

+57

    (assert-eq #f (verdict "7d4d0e7f6153a69b6242b522abbee685fda4420f8834b108c3bdae369ef549fa" "00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000" "3f")))

+58

(test "wycheproof-11 invalid"

+59

    (assert-eq #f (verdict "7d4d0e7f6153a69b6242b522abbee685fda4420f8834b108c3bdae369ef549fa" "00000000000000000000000000000000000000000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000" "3f")))

+60

(test "wycheproof-12 invalid"

+61

    (assert-eq #f (verdict "7d4d0e7f6153a69b6242b522abbee685fda4420f8834b108c3bdae369ef549fa" "0000000000000000000000000000000000000000000000000000000000000000ecd3f55c1a631258d69cf7a2def9de1400000000000000000000000000000010" "3f")))

+62

(test "wycheproof-13 invalid"

+63

    (assert-eq #f (verdict "7d4d0e7f6153a69b6242b522abbee685fda4420f8834b108c3bdae369ef549fa" "0000000000000000000000000000000000000000000000000000000000000000edd3f55c1a631258d69cf7a2def9de1400000000000000000000000000000010" "3f")))

+64

(test "wycheproof-14 invalid"

+65

    (assert-eq #f (verdict "7d4d0e7f6153a69b6242b522abbee685fda4420f8834b108c3bdae369ef549fa" "0000000000000000000000000000000000000000000000000000000000000000edffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff7f" "3f")))

+66

(test "wycheproof-15 invalid"

+67

    (assert-eq #f (verdict "7d4d0e7f6153a69b6242b522abbee685fda4420f8834b108c3bdae369ef549fa" "01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000" "3f")))

+68

(test "wycheproof-16 invalid"

+69

    (assert-eq #f (verdict "7d4d0e7f6153a69b6242b522abbee685fda4420f8834b108c3bdae369ef549fa" "01000000000000000000000000000000000000000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000" "3f")))

+70

(test "wycheproof-17 invalid"

+71

    (assert-eq #f (verdict "7d4d0e7f6153a69b6242b522abbee685fda4420f8834b108c3bdae369ef549fa" "0100000000000000000000000000000000000000000000000000000000000000ecd3f55c1a631258d69cf7a2def9de1400000000000000000000000000000010" "3f")))

+72

(test "wycheproof-18 invalid"

+73

    (assert-eq #f (verdict "7d4d0e7f6153a69b6242b522abbee685fda4420f8834b108c3bdae369ef549fa" "0100000000000000000000000000000000000000000000000000000000000000edd3f55c1a631258d69cf7a2def9de1400000000000000000000000000000010" "3f")))

+74

(test "wycheproof-19 invalid"

+75

    (assert-eq #f (verdict "7d4d0e7f6153a69b6242b522abbee685fda4420f8834b108c3bdae369ef549fa" "0100000000000000000000000000000000000000000000000000000000000000edffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff7f" "3f")))

+76

(test "wycheproof-20 invalid"

+77

    (assert-eq #f (verdict "7d4d0e7f6153a69b6242b522abbee685fda4420f8834b108c3bdae369ef549fa" "edd3f55c1a631258d69cf7a2def9de14000000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000000" "3f")))

+78

(test "wycheproof-21 invalid"

+79

    (assert-eq #f (verdict "7d4d0e7f6153a69b6242b522abbee685fda4420f8834b108c3bdae369ef549fa" "edd3f55c1a631258d69cf7a2def9de14000000000000000000000000000000100100000000000000000000000000000000000000000000000000000000000000" "3f")))

+80

(test "wycheproof-22 invalid"

+81

    (assert-eq #f (verdict "7d4d0e7f6153a69b6242b522abbee685fda4420f8834b108c3bdae369ef549fa" "edd3f55c1a631258d69cf7a2def9de1400000000000000000000000000000010ecd3f55c1a631258d69cf7a2def9de1400000000000000000000000000000010" "3f")))

+82

(test "wycheproof-23 invalid"

+83

    (assert-eq #f (verdict "7d4d0e7f6153a69b6242b522abbee685fda4420f8834b108c3bdae369ef549fa" "edd3f55c1a631258d69cf7a2def9de1400000000000000000000000000000010edd3f55c1a631258d69cf7a2def9de1400000000000000000000000000000010" "3f")))

+84

(test "wycheproof-24 invalid"

+85

    (assert-eq #f (verdict "7d4d0e7f6153a69b6242b522abbee685fda4420f8834b108c3bdae369ef549fa" "edd3f55c1a631258d69cf7a2def9de1400000000000000000000000000000010edffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff7f" "3f")))

+86

(test "wycheproof-25 invalid"

+87

    (assert-eq #f (verdict "7d4d0e7f6153a69b6242b522abbee685fda4420f8834b108c3bdae369ef549fa" "edffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff7f0000000000000000000000000000000000000000000000000000000000000000" "3f")))

+88

(test "wycheproof-26 invalid"

+89

    (assert-eq #f (verdict "7d4d0e7f6153a69b6242b522abbee685fda4420f8834b108c3bdae369ef549fa" "edffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff7f0100000000000000000000000000000000000000000000000000000000000000" "3f")))

+90

(test "wycheproof-27 invalid"

+91

    (assert-eq #f (verdict "7d4d0e7f6153a69b6242b522abbee685fda4420f8834b108c3bdae369ef549fa" "edffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff7fecd3f55c1a631258d69cf7a2def9de1400000000000000000000000000000010" "3f")))

+92

(test "wycheproof-28 invalid"

+93

    (assert-eq #f (verdict "7d4d0e7f6153a69b6242b522abbee685fda4420f8834b108c3bdae369ef549fa" "edffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff7fedd3f55c1a631258d69cf7a2def9de1400000000000000000000000000000010" "3f")))

+94

(test "wycheproof-29 invalid"

+95

    (assert-eq #f (verdict "7d4d0e7f6153a69b6242b522abbee685fda4420f8834b108c3bdae369ef549fa" "edffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff7fedffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff7f" "3f")))

+96

(test "wycheproof-30 "

+97

    (assert-eq (quote raised) (verdict "7d4d0e7f6153a69b6242b522abbee685fda4420f8834b108c3bdae369ef549fa" "54657374" "invalid")))

+98

(test "wycheproof-31 invalid"

+99

    (assert-eq (quote raised) (verdict "7d4d0e7f6153a69b6242b522abbee685fda4420f8834b108c3bdae369ef549fa" "7c38e026f29e14aabd059a0f2db8b0cd783040609a8be684db12f82a27774ab0" "54657374")))

+100

(test "wycheproof-32 invalid"

+101

    (assert-eq (quote raised) (verdict "7d4d0e7f6153a69b6242b522abbee685fda4420f8834b108c3bdae369ef549fa" "7c38e026f29e14aabd059a0f2db8b0cd783040609a8be684db12f82a27774ab07a9155711ecfaf7f99f277bad0c6ae7e39d4eef676573336a5c51eb6f946" "54657374")))

+102

(test "wycheproof-33 invalid"

+103

    (assert-eq (quote raised) (verdict "7d4d0e7f6153a69b6242b522abbee685fda4420f8834b108c3bdae369ef549fa" "7c38e026f29e14aabd059a0f2db8b0cd783040609a8be684db12f82a27774ab07a9155711ecfaf7f99f277bad0c6ae7e39d4eef676573336a5c51eb6f946b30d2020" "54657374")))

+104

(test "wycheproof-34 invalid"

+105

    (assert-eq (quote raised) (verdict "7d4d0e7f6153a69b6242b522abbee685fda4420f8834b108c3bdae369ef549fa" "7c38e026f29e14aabd059a0f2db8b0cd783040609a8be684db12f82a27774ab07a9155711ecfaf7f99f277bad0c6ae7e39d4eef676573336a5c51eb6f946b30d7d4d0e7f6153a69b6242b522abbee685fda4420f8834b108c3bdae369ef549fa" "54657374")))

+106

(test "wycheproof-35 invalid"

+107

    (assert-eq (quote raised) (verdict "7d4d0e7f6153a69b6242b522abbee685fda4420f8834b108c3bdae369ef549fa" "007c38e026f29e14aabd059a0f2db8b0cd783040609a8be684db12f82a27774ab07a9155711ecfaf7f99f277bad0c6ae7e39d4eef676573336a5c51eb6f946b30d" "54657374")))

+108

(test "wycheproof-36 invalid"

+109

    (assert-eq (quote raised) (verdict "7d4d0e7f6153a69b6242b522abbee685fda4420f8834b108c3bdae369ef549fa" "7c38e026f29e14aabd059a0f2db8b0cd783040609a8be684db12f82a27774ab0007a9155711ecfaf7f99f277bad0c6ae7e39d4eef676573336a5c51eb6f946b30d" "54657374")))

+110

(test "wycheproof-37 invalid"

+111

    (assert-eq (quote raised) (verdict "7d4d0e7f6153a69b6242b522abbee685fda4420f8834b108c3bdae369ef549fa" "7c38e026f29e14aabd059a0f2db8b0cd783040609a8be684db12f82a27774ab07a9155711ecfaf7f99f277bad0c6ae7e39d4eef676573336a5c51eb6f946b30d00" "54657374")))

+112

(test "wycheproof-38 invalid"

+113

    (assert-eq (quote raised) (verdict "7d4d0e7f6153a69b6242b522abbee685fda4420f8834b108c3bdae369ef549fa" "93de3ca252426c95f735cb9edd92e83321ac62372d5aa5b379786bae111ab6b17251330e8f9a7c30d6993137c596007d7b001409287535ac4804e662bc58a3" "546573743137")))

+114

(test "wycheproof-39 invalid"

+115

    (assert-eq (quote raised) (verdict "7d4d0e7f6153a69b6242b522abbee685fda4420f8834b108c3bdae369ef549fa" "dffed33a7f420b62bb1731cfd03be805affd18a281ec02b1067ba6e9d20826569e742347df59c88ae96db1f1969fb189b0ec34381d85633e1889da48d95e0e" "54657374313236")))

+116

(test "wycheproof-40 invalid"

+117

    (assert-eq (quote raised) (verdict "7d4d0e7f6153a69b6242b522abbee685fda4420f8834b108c3bdae369ef549fa" "6e170c719577c25e0e1e8b8aa7a6346f8b109f37385cc2e85dc3b4c0f46a9c6bcafd67f52324c5dbaf40a1b673fb29c4a56052d2d6999d0838a8337bccb502" "546573743530")))

+118

(test "wycheproof-41 invalid"

+119

    (assert-eq (quote raised) (verdict "7d4d0e7f6153a69b6242b522abbee685fda4420f8834b108c3bdae369ef549fa" "b0928b46e99fbbad3f5cb502d2cd309d94a7e86cfd4d84b1fcf4cea18075a9c36993c0582dba1e9e519fae5a8654f454201ae0c3cb397c37b8f4f8eef18400" "54657374333437")))

+120

(test "wycheproof-42 invalid"

+121

    (assert-eq #f (verdict "7d4d0e7f6153a69b6242b522abbee685fda4420f8834b108c3bdae369ef549fa" "647c1492402ab5ce03e2c3a7f0384d051b9cf3570f1207fc78c1bcc98c281c2b1d125e5538f38afbcc1c84e489521083041d24bc6240767029da063271a1ff0c" "313233343030")))

+122

(test "wycheproof-43 invalid"

+123

    (assert-eq #f (verdict "7d4d0e7f6153a69b6242b522abbee685fda4420f8834b108c3bdae369ef549fa" "677c1492402ab5ce03e2c3a7f0384d051b9cf3570f1207fc78c1bcc98c281c2bc108ca4b87a49c9ed2cf383aecad8f54a962b2899da891e12004d7993a627e01" "313233343030")))

+124

(test "wycheproof-44 invalid"

+125

    (assert-eq #f (verdict "7d4d0e7f6153a69b6242b522abbee685fda4420f8834b108c3bdae369ef549fa" "617c1492402ab5ce03e2c3a7f0384d051b9cf3570f1207fc78c1bcc98c281c2b9ce23fc6213ed5b87912e9bbf92f5e2c780eae26d15c50a112d1e97d2ea33c06" "313233343030")))

+126

(test "wycheproof-45 invalid"

+127

    (assert-eq #f (verdict "7d4d0e7f6153a69b6242b522abbee685fda4420f8834b108c3bdae369ef549fa" "e57c1492402ab5ce03e2c3a7f0384d051b9cf3570f1207fc78c1bcc98c281c2bbb3eb51cd98dddb235a5f46f2bded6af184a58d09cce928bda43f41d69118a03" "313233343030")))

+128

(test "wycheproof-46 invalid"

+129

    (assert-eq #f (verdict "7d4d0e7f6153a69b6242b522abbee685fda4420f8834b108c3bdae369ef549fa" "657d1492402ab5ce03e2c3a7f0384d051b9cf3570f1207fc78c1bcc98c281c2bcd237dda9a116501f67a5705a854b9adc304f34720803a91b324f2c13e0f5a09" "313233343030")))

+130

(test "wycheproof-47 invalid"

+131

    (assert-eq #f (verdict "7d4d0e7f6153a69b6242b522abbee685fda4420f8834b108c3bdae369ef549fa" "657c1592402ab5ce03e2c3a7f0384d051b9cf3570f1207fc78c1bcc98c281c2b6b167bbdc0d881cc04d28905552c1876f3709851abc5007376940cc8a435c300" "313233343030")))

+132

(test "wycheproof-48 invalid"

+133

    (assert-eq #f (verdict "7d4d0e7f6153a69b6242b522abbee685fda4420f8834b108c3bdae369ef549fa" "657c1412402ab5ce03e2c3a7f0384d051b9cf3570f1207fc78c1bcc98c281c2b7fd2ac7da14afffcceeb13f2a0d6b887941cb1a5eb57a52f3cb131a16cce7b0e" "313233343030")))

+134

(test "wycheproof-49 invalid"

+135

    (assert-eq #f (verdict "7d4d0e7f6153a69b6242b522abbee685fda4420f8834b108c3bdae369ef549fa" "657c1492412ab5ce03e2c3a7f0384d051b9cf3570f1207fc78c1bcc98c281c2b7373ba13ebbef99cd2a8ead55ce735c987d85a35320925a8e871702dc7c5c40d" "313233343030")))

+136

(test "wycheproof-50 invalid"

+137

    (assert-eq #f (verdict "7d4d0e7f6153a69b6242b522abbee685fda4420f8834b108c3bdae369ef549fa" "657c1492402ab54e03e2c3a7f0384d051b9cf3570f1207fc78c1bcc98c281c2bd35bd331c03f0855504ca1cab87b83c36a028425a3cf007ede4f4254c261cb00" "313233343030")))

+138

(test "wycheproof-51 invalid"

+139

    (assert-eq #f (verdict "7d4d0e7f6153a69b6242b522abbee685fda4420f8834b108c3bdae369ef549fa" "657c1492402ab5ce02e2c3a7f0384d051b9cf3570f1207fc78c1bcc98c281c2bcb35101f73cf467deac8c1a03b6c3dc35af544132734b7e57ab20c89b2e4750d" "313233343030")))

+140

(test "wycheproof-52 invalid"

+141

    (assert-eq #f (verdict "7d4d0e7f6153a69b6242b522abbee685fda4420f8834b108c3bdae369ef549fa" "657c1492402ab5ce03e2c3a7f2384d051b9cf3570f1207fc78c1bcc98c281c2bb58d2e8878290bff8d3355fdd4ea381924ee578752354eb6dee678ab4011c301" "313233343030")))

+142

(test "wycheproof-53 invalid"

+143

    (assert-eq #f (verdict "7d4d0e7f6153a69b6242b522abbee685fda4420f8834b108c3bdae369ef549fa" "657c1492402ab5ce03e2c3a7f0384d851b9cf3570f1207fc78c1bcc98c281c2bb978c866187ffb1cc7b29a0b4045aefc08768df65717194ff0c6e63f4dea0d02" "313233343030")))

+144

(test "wycheproof-54 invalid"

+145

    (assert-eq #f (verdict "7d4d0e7f6153a69b6242b522abbee685fda4420f8834b108c3bdae369ef549fa" "657c1492402ab5ce03e2c3a7f0384d051b9cf3570f1207fc78c1bcc98c281d2b0576ecf8eaf675f00f3dfbe19f75b83b7607a6c96414f6821af920a2498d0305" "313233343030")))

+146

(test "wycheproof-55 invalid"

+147

    (assert-eq #f (verdict "7d4d0e7f6153a69b6242b522abbee685fda4420f8834b108c3bdae369ef549fa" "657c1492402ab5ce03e2c3a7f0384d051b9cf3570f1207fc78c1bcc98c289c2be5241a345c7b5428054c74b7c382fa10d4a5f1e8f8b79a71d3fdea2254f1ff0e" "313233343030")))

+148

(test "wycheproof-56 invalid"

+149

    (assert-eq #f (verdict "7d4d0e7f6153a69b6242b522abbee685fda4420f8834b108c3bdae369ef549fa" "657c1492402ab5ce03e2c3a7f0384d051b9cf3570f1207fc78c1bcc98c281c2a63950c85cd6dc96364e768de50ff7732b538f8a0b1615d799190ab600849230e" "313233343030")))

+150

(test "wycheproof-57 invalid"

+151

    (assert-eq #f (verdict "7d4d0e7f6153a69b6242b522abbee685fda4420f8834b108c3bdae369ef549fa" "657c1492402ab5ce03e2c3a7f0384d051b9cf3570f1207fc78c1bcc98c281c0b543bd3da0a56a8c9c152f59c9fec12f31fa66434d48b817b30d90cb4efa8b501" "313233343030")))

+152

(test "wycheproof-58 invalid"

+153

    (assert-eq #f (verdict "7d4d0e7f6153a69b6242b522abbee685fda4420f8834b108c3bdae369ef549fa" "657c1492402ab5ce03e2c3a7f0384d051b9cf3570f1207fc78c1bcc98c281c6b8da07efd07a6dafb015ed6a32fe136319a972ffbc341f3a0beae97ccf8136505" "313233343030")))

+154

(test "wycheproof-59 invalid"

+155

    (assert-eq #f (verdict "7d4d0e7f6153a69b6242b522abbee685fda4420f8834b108c3bdae369ef549fa" "657c1492402ab5ce03e2c3a7f0384d051b9cf3570f1207fc78c1bcc98c281cab227aedf259f910f0f3a759a335062665217925d019173b88917eae294f75d40f" "313233343030")))

+156

(test "wycheproof-60 invalid"

+157

    (assert-eq #f (verdict "7d4d0e7f6153a69b6242b522abbee685fda4420f8834b108c3bdae369ef549fa" "0000000000000000000000000000000000000000000000000000000000000000e0b8e7770d51c7a36375d006c5bffd6af43ff54aaf47e4330dc118c71d61ec02" "313233343030")))

+158

(test "wycheproof-61 invalid"

+159

    (assert-eq #f (verdict "7d4d0e7f6153a69b6242b522abbee685fda4420f8834b108c3bdae369ef549fa" "ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff463a1908382e7eb7693acef9884f7cf931a215e0791876be22c631a59881fd0e" "313233343030")))

+160

(test "wycheproof-62 invalid"

+161

    (assert-eq #f (verdict "7d4d0e7f6153a69b6242b522abbee685fda4420f8834b108c3bdae369ef549fa" "9a83eb6dbfd54a31fc1d3c580fc7b2fae4630ca8f0edf803873e433673d7e3d40e94254586cb6188c5386c3febed477cb9a6cb29e3979adc4cb27cf5278fb70a" "313233343030")))

+162

(test "wycheproof-63 invalid"

+163

    (assert-eq #f (verdict "7d4d0e7f6153a69b6242b522abbee685fda4420f8834b108c3bdae369ef549fa" "7c38e026f29e14aabd059a0f2db8b0cd783040609a8be684db12f82a27774ab067654bce3832c2d76f8f6f5dafc08d9339d4eef676573336a5c51eb6f946b31d" "54657374")))

+164

(test "wycheproof-64 invalid"

+165

    (assert-eq #f (verdict "7d4d0e7f6153a69b6242b522abbee685fda4420f8834b108c3bdae369ef549fa" "7c38e026f29e14aabd059a0f2db8b0cd783040609a8be684db12f82a27774ab05439412b5395d42f462c67008eba6ca839d4eef676573336a5c51eb6f946b32d" "54657374")))

+166

(test "wycheproof-65 invalid"

+167

    (assert-eq #f (verdict "7d4d0e7f6153a69b6242b522abbee685fda4420f8834b108c3bdae369ef549fa" "7c38e026f29e14aabd059a0f2db8b0cd783040609a8be684db12f82a27774ab02ee12ce5875bf9dff26556464bae2ad239d4eef676573336a5c51eb6f946b34d" "54657374")))

+168

(test "wycheproof-66 invalid"

+169

    (assert-eq #f (verdict "7d4d0e7f6153a69b6242b522abbee685fda4420f8834b108c3bdae369ef549fa" "7c38e026f29e14aabd059a0f2db8b0cd783040609a8be684db12f82a27774ab0e2300459f1e742404cd934d2c595a6253ad4eef676573336a5c51eb6f946b38d" "54657374")))

+170

(test "wycheproof-67 invalid"

+171

    (assert-eq #f (verdict "7d4d0e7f6153a69b6242b522abbee685fda4420f8834b108c3bdae369ef549fa" "7c38e026f29e14aabd059a0f2db8b0cd783040609a8be684db12f82a27774ab07a9155711ecfaf7f99f277bad0c6ae7e39d4eef676573336a5c51eb6f946b32d" "54657374")))

+172

(test "wycheproof-68 invalid"

+173

    (assert-eq #f (verdict "7d4d0e7f6153a69b6242b522abbee685fda4420f8834b108c3bdae369ef549fa" "7c38e026f29e14aabd059a0f2db8b0cd783040609a8be684db12f82a27774ab07a9155711ecfaf7f99f277bad0c6ae7e39d4eef676573336a5c51eb6f946b34d" "54657374")))

+174

(test "wycheproof-69 invalid"

+175

    (assert-eq #f (verdict "7d4d0e7f6153a69b6242b522abbee685fda4420f8834b108c3bdae369ef549fa" "7c38e026f29e14aabd059a0f2db8b0cd783040609a8be684db12f82a27774ab07a9155711ecfaf7f99f277bad0c6ae7e39d4eef676573336a5c51eb6f946b38d" "54657374")))

+176

(test "wycheproof-70 invalid"

+177

    (assert-eq #f (verdict "7d4d0e7f6153a69b6242b522abbee685fda4420f8834b108c3bdae369ef549fa" "7c38e026f29e14aabd059a0f2db8b0cd783040609a8be684db12f82a27774ab0679155711ecfaf7f99f277bad0c6ae7e39d4eef676573336a5c51eb6f946b38d" "54657374")))

+178

(test "wycheproof-71 valid"

+179

    (assert-eq #t (verdict "a12c2beb77265f2aac953b5009349d94155a03ada416aad451319480e983ca4c" "5056325d2ab440bf30bbf0f7173199aa8b4e6fbc091cf3eb6bc6cf87cd73d992ffc216c85e4ab5b8a0bbc7e9a6e9f8d33b7f6e5ac0ffdc22d9fcaf784af84302" "-")))

+180

(test "wycheproof-72 valid"

+181

    (assert-eq #t (verdict "a12c2beb77265f2aac953b5009349d94155a03ada416aad451319480e983ca4c" "481fafbf4364d7b682475282f517a3ac0538c9a6b6a562e99a3d8e5afb4f90a559b056b9f07af023905753b02d95eb329a35c77f154b79abbcd291615ce42f02" "78")))

+182

(test "wycheproof-73 valid"

+183

    (assert-eq #t (verdict "a12c2beb77265f2aac953b5009349d94155a03ada416aad451319480e983ca4c" "8a9bb4c465a3863abc9fd0dd35d80bb28f7d33d37d74679802d63f82b20da114b8d765a1206b3e9ad7cf2b2d8d778bb8651f1fa992db293c0039eacb6161480f" "54657374")))

+184

(test "wycheproof-74 valid"

+185

    (assert-eq #t (verdict "a12c2beb77265f2aac953b5009349d94155a03ada416aad451319480e983ca4c" "d839c20abfda1fd429531831c64f813f84b913e9928540310cf060b44c3dbf9457d44a7721fdc0d67724ff81cb450dd39b10cfb65db15dda4b8bf09d26bd3801" "48656c6c6f")))

+186

(test "wycheproof-75 valid"

+187

    (assert-eq #t (verdict "a12c2beb77265f2aac953b5009349d94155a03ada416aad451319480e983ca4c" "9bbb1052dcfa8ad2715c2eb716ae4f1902dea353d42ee09fd4c0b4fcb8b52b5219e2200016e1199d0061891c263e31b0bc3b55673c19610c4e0fa5408004160b" "313233343030")))

+188

(test "wycheproof-76 valid"

+189

    (assert-eq #t (verdict "a12c2beb77265f2aac953b5009349d94155a03ada416aad451319480e983ca4c" "f63b5c0667c7897fc283296416f7f60e84bbde9cbd832e56be463ed9f568069702b17a2f7c341ebf590706a6388ac76ac613c1675ec0f2c7118f2573422a500b" "000000000000000000000000")))

+190

(test "wycheproof-77 valid"

+191

    (assert-eq #t (verdict "a12c2beb77265f2aac953b5009349d94155a03ada416aad451319480e983ca4c" "1bc44d7001e6b5b9090fef34b2ca480f9786bbefa7d279353e5881e8dfb91b803ccd46500e270ef0109bfd741037558832120bc2a4f20fbe7b5fb3c3aaf23e08" "6161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161")))

+192

(test "wycheproof-78 valid"

+193

    (assert-eq #t (verdict "a12c2beb77265f2aac953b5009349d94155a03ada416aad451319480e983ca4c" "ea8e22143b02372e76e99aece3ed36aec529768a27e2bb49bdc135d44378061e1f62d1ac518f33ebf37b2ee8cc6dde68a4bd7d4a2f4d6cb77f015f71ca9fc30d" "202122232425262728292a2b2c2d2e2f303132333435363738393a3b3c3d3e3f404142434445464748494a4b4c4d4e4f505152535455565758595a5b5c5d5e5f60")))

+194

(test "wycheproof-79 valid"

+195

    (assert-eq #t (verdict "a12c2beb77265f2aac953b5009349d94155a03ada416aad451319480e983ca4c" "8acd679e1a914fc45d5fa83d3021f0509c805c8d271df54e52f43cfbd00cb6222bf81d58fe1de2de378df67ee9f453786626961fe50a9b05f12b6f0899ebdd0a" "ffffffffffffffffffffffffffffffff")))

+196

(test "wycheproof-80 valid"

+197

    (assert-eq #t (verdict "d75a980182b10ab7d54bfed3c964073a0ee172f3daa62325af021a68f707511a" "e5564300c360ac729086e2cc806e828a84877f1eb8e5d974d873e065224901555fb8821590a33bacc61e39701cf9b46bd25bf5f0595bbe24655141438e7a100b" "-")))

+198

(test "wycheproof-81 valid"

+199

    (assert-eq #t (verdict "3d4017c3e843895a92b70aa74d1b7ebc9c982ccf2ec4968cc0cd55f12af4660c" "92a009a9f0d4cab8720e820b5f642540a2b27b5416503f8fb3762223ebdb69da085ac1e43e15996e458f3613d0f11d8c387b2eaeb4302aeeb00d291612bb0c00" "72")))

+200

(test "wycheproof-82 valid"

+201

    (assert-eq #t (verdict "fc51cd8e6218a1a38da47ed00230f0580816ed13ba3303ac5deb911548908025" "6291d657deec24024827e69c3abe01a30ce548a284743a445e3680d7db5ac3ac18ff9b538d16f290ae67f760984dc6594a7c15e9716ed28dc027beceea1ec40a" "af82")))

+202

(test "wycheproof-83 valid"

+203

    (assert-eq #t (verdict "278117fc144c72340f67d0f2316e8386ceffbf2b2428c9c51fef7c597f1d426e" "0aab4c900501b3e24d7cdf4663326a3a87df5e4843b2cbdb67cbf6e460fec350aa5371b1508f9f4528ecea23c436d94b5e8fcd4f681e30a6ac00a9704a188a03" "08b8b2b733424243760fe426a4b54908632110a66c2f6591eabd3345e3e4eb98fa6e264bf09efe12ee50f8f54e9f77b1e355f6c50544e23fb1433ddf73be84d879de7c0046dc4996d9e773f4bc9efe5738829adb26c81b37c93a1b270b20329d658675fc6ea534e0810a4432826bf58c941efb65d57a338bbd2e26640f89ffbc1a858efcb8550ee3a5e1998bd177e93a7363c344fe6b199ee5d02e82d522c4feba15452f80288a821a579116ec6dad2b3b310da903401aa62100ab5d1a36553e06203b33890cc9b832f79ef80560ccb9a39ce767967ed628c6ad573cb116dbefefd75499da96bd68a8a97b928a8bbc103b6621fcde2beca1231d206be6cd9ec7aff6f6c94fcd7204ed3455c68c83f4a41da4af2b74ef5c53f1d8ac70bdcb7ed185ce81bd84359d44254d95629e9855a94a7c1958d1f8ada5d0532ed8a5aa3fb2d17ba70eb6248e594e1a2297acbbb39d502f1a8c6eb6f1ce22b3de1a1f40cc24554119a831a9aad6079cad88425de6bde1a9187ebb6092cf67bf2b13fd65f27088d78b7e883c8759d2c4f5c65adb7553878ad575f9fad878e80a0c9ba63bcbcc2732e69485bbc9c90bfbd62481d9089beccf80cfe2df16a2cf65bd92dd597b0707e0917af48bbb75fed413d238f5555a7a569d80c3414a8d0859dc65a46128bab27af87a71314f318c782b23ebfe808b82b0ce26401d2e22f04d83d1255dc51addd3b75a2b1ae0784504df543af8969be3ea7082ff7fc9888c144da2af58429ec96031dbcad3dad9af0dcbaaaf268cb8fcffead94f3c7ca495e056a9b47acdb751fb73e666c6c655ade8297297d07ad1ba5e43f1bca32301651339e22904cc8c42f58c30c04aafdb038dda0847dd988dcda6f3bfd15c4b4c4525004aa06eeff8ca61783aacec57fb3d1f92b0fe2fd1a85f6724517b65e614ad6808d6f6ee34dff7310fdc82aebfd904b01e1dc54b2927094b2db68d6f903b68401adebf5a7e08d78ff4ef5d63653a65040cf9bfd4aca7984a74d37145986780fc0b16ac451649de6188a7dbdf191f64b5fc5e2ab47b57f7f7276cd419c17a3ca8e1b939ae49e488acba6b965610b5480109c8b17b80e1b7b750dfc7598d5d5011fd2dcc5600a32ef5b52a1ecc820e308aa342721aac0943bf6686b64b2579376504ccc493d97e6aed3fb0f9cd71a43dd497f01f17c0e2cb3797aa2a2f256656168e6c496afc5fb93246f6b1116398a346f1a641f3b041e989f7914f90cc2c7fff357876e506b50d334ba77c225bc307ba537152f3f1610e4eafe595f6d9d90d11faa933a15ef1369546868a7f3a45a96768d40fd9d03412c091c6315cf4fde7cb68606937380db2eaaa707b4c4185c32eddcdd306705e4dc1ffc872eeee475a64dfac86aba41c0618983f8741c5ef68d3a101e8a3b8cac60c905c15fc910840b94c00a0b9d0")))

+204

(test "wycheproof-84 valid"

+205

    (assert-eq #t (verdict "100fdf47fb94f1536a4f7c3fda27383fa03375a8f527c537e6f1703c47f94f86" "dac119d6ca87fc59ae611c157048f4d4fc932a149dbe20ec6effd1436abf83ea05c7df0fef06147241259113909bc71bd3c53ba4464ffcad3c0968f2ffffff0f" "124e583f8b8eca58bb29c271b41d36986bbc45541f8e51f9cb0133eca447601e")))

+206

(test "wycheproof-85 invalid"

+207

    (assert-eq #f (verdict "100fdf47fb94f1536a4f7c3fda27383fa03375a8f527c537e6f1703c47f94f86" "0971f86d2c9c78582524a103cb9cf949522ae528f8054dc20107d999be673ff4e25ebf2f2928766b1248bec6e91697775f8446639ede46ad4df4053000000010" "6a0bc2b0057cedfc0fa2e3f7f7d39279b30f454a69dfd1117c758d86b19d85e0")))

+208

(test "wycheproof-86 valid"

+209

    (assert-eq #t (verdict "8fd659b77b558ed93882c1157438450ac86ec62d421d568e98ee236f3810295a" "7db17557ac470c0eda4eedaabce99197ab62565653cf911f632ee8be0e5ffcfc88fb94276b42e0798fd3aa2f0318be7fc6a29fae75f70c3dcdc414a0ad866601" "b0729a713593a92e46b56eaa66b9e435f7a09a8e7de03b078f6f282285276635f301e7aaafe42187c45d6f5b13f9f16b11195cc125c05b90d24dfe4c")))

+210

(test "wycheproof-87 valid"

+211

    (assert-eq #t (verdict "2a606bf67ac770c607038b004101b325edb569efd3413d2d1f2c3e6b4e6e3082" "67d84d4c3945aaf06e06d524be63acbfb5dbb1988c4aea96a5ee9f7a9b9eecc29df4f66b8aa1d9e8607a58fb1ef0c2ad69aac005b4f58e34103344a9c8871a09" "a8546e50ba31cae3234310d32672447be213fad91a227a19669c53d309b959782b0e6b71f8791fdb470043b58122003157d2d96a43a6cbd7d3a8d86bf4c97391883e268d50af80e1e6e12939c2bd50ca746cdadfad4edf1bda875299740724148efb1ebe73fb60088cda890317658627a5f7ab5a0c075d9d8f3f97b6492b35519e50ff6b38377432a7081f9176bb1c29a862deac1336ca20b097a47829cec10a6a7cec178eda2d12f6dc6c87f910454af0123555ba184e68804d9cced60fd5c8c90943e56599c8f0ba59a38491ba5e5a53460682474c07e40ca142983314fd762856bb1093f359da6eb0a756bd93a3160c10dd8feea6b97e7c6a17cb54bd5d7649c05c66d7bdee056671dfdaf689fa3945bb8e29a429f4bd5d355dce9687b06f01d5e33e3999f0e8")))

+212

(test "wycheproof-88 valid"

+213

    (assert-eq #t (verdict "c9c946cbc5544ac74eef491f07c5881c16faf7ec31ce4aa91bb60ae7b4539051" "24087d47f3e20af51b9668ae0a88ce76586802d0ec75d8c0f28fc30962b5e1d1a1d509571a1624ed125a8df92a6e963728d6b5de99200b8e285f70feb6f05207" "cd2212eddb0706f62c995cef958634f0cb7793444cbf4d30e81c27c41ebea6cb02607510131f9c015692dfd521b148841e9a2d3564d20ac401f6cb8e40f520fe0cafbeaa88840b83013369d879f013463fe52a13267aa0c8c59c45cde9399cd1e6be8cc64cf48315ac2eb31a1c567a4fb7d601746d1f63b5ac020712adbbe07519bded6f")))

+214

(test "wycheproof-89 valid"

+215

    (assert-eq #t (verdict "32ad026f693d0d2afe7f4388d91c4c964426fcb9e3665c3ebd8650009b815c8e" "d920d421a5956b69bfe1ba834c025e2babb6c7a6d78c97de1d9bb1116dfdd1185147b2887e34e15578172e150774275ea2aad9e02106f7e8ca1caa669a066f0c" "ec5c7cb078")))

+216

(test "wycheproof-90 valid"

+217

    (assert-eq #t (verdict "32ad026f693d0d2afe7f4388d91c4c964426fcb9e3665c3ebd8650009b815c8e" "4f62daf7f7c162038552ad7d306e195baa37ecf6ca7604142679d7d1128e1f8af52e4cb3545748c44ef1ff1c64e877e4f4d248259b7f6eb56e3ef72097dc8e0c" "4668c6a76f0e482190a7175b9f3806a5fe4314a004fa69f988373f7a")))

+218

(test "wycheproof-91 valid"

+219

    (assert-eq #t (verdict "c29ec1894e06d27b4e40486b4fa5063d66a746c7f9c323b12203c03b72b8b78a" "6669acf94667c5b541afe5307bde9476b13ae7e0e6058a772101ac8eb0a94331428eb4db0a2c68a9b6c1763b8624dab259b0876cdcfaeacc17b21a18e3fc010a" "0f325ffd87e58131ffa23c05ea4579513b287fdba87b44")))

+220

(test "wycheproof-92 valid"

+221

    (assert-eq #t (verdict "cfda5b899e35764c5229e59295fe1222b7ddce176643697c29e46ecbba10cf10" "30490c28f806298225df62103521dcee047153912c33ab8ab8bbdd1ffabd70fd4fdb360f05be535b067d1cf4e78c2cb432206bf280aab3bd21aaa1cb894c5b06" "ec5c7cb078")))

+222

(test "wycheproof-93 valid"

+223

    (assert-eq #t (verdict "32ad026f693d0d2afe7f4388d91c4c964426fcb9e3665c3ebd8650009b815c8e" "deecafb6f2ede73fec91a6f10e45b9c1c61c4b9bfbe6b6147e2de0b1df6938971f7896c3ab83851fb5d9e537037bff0fca0ccb4a3cc38f056f91f7d7a0557e08" "5dc9bb87eb11621a93f92abe53515697d2611b2eef73")))

+224

(test "wycheproof-94 valid"

+225

    (assert-eq #t (verdict "cfda5b899e35764c5229e59295fe1222b7ddce176643697c29e46ecbba10cf10" "4cd4f77ed473a6647387f3163541c67a1708a3c3bd1673247cb87f0cb68b3c56f04bfa72970c8a483efe659c87009ab4020b590b6641316b3deddb5450544e02" "67484059b2490b1a0a4f8dee77979e26")))

+226

(test "wycheproof-95 valid"

+227

    (assert-eq #t (verdict "32ad026f693d0d2afe7f4388d91c4c964426fcb9e3665c3ebd8650009b815c8e" "7f8663cf98cbd39d5ff553f00bcf3d0d520605794f8866ce75714d77cc51e66c91818b657d7b0dae430a68353506edc4a714c345f5ddb5c8b958ba3d035f7a01" "7dcfe60f881e1285676f35b68a1b2dbcdd7be6f719a288ababc28d36e3a42ac3010a1ca54b32760e74")))

+228

(test "wycheproof-96 valid"

+229

    (assert-eq #t (verdict "cfda5b899e35764c5229e59295fe1222b7ddce176643697c29e46ecbba10cf10" "1e41a24fe732bd7cab14c2a2f5134ee8c87fcbd2e987e60957ed9239e5c32404d56977e1b4282871896cb10625a1937468e4dc266e16a9c1b8e9891177eca802" "a020a4381dc9141f47ee508871ab7a8b5a3648727c4281ae9932376f23a8e1bcda0626b7129197d864178631ec89c4332dbb18")))

+230

(test "wycheproof-97 valid"

+231

    (assert-eq #t (verdict "32ad026f693d0d2afe7f4388d91c4c964426fcb9e3665c3ebd8650009b815c8e" "6aab49e5c0bc309b783378ee03ffda282f0185cdf94c847701ff307a6ee8d0865411c44e0a8206f6a5f606107451940c2593af790ce1860f4c14ab25b2deae08" "58e456064dff471109def4ca27fa8310a1df32739655b624f27e6418d34b7f007173f3faa5")))

+232

(test "wycheproof-98 valid"

+233

    (assert-eq #t (verdict "529919c9c780985a841c42ba6c180ff2d67a276ccfbe281080e47ab71a758f56" "01abfa4d6bbc726b196928ec84fd03f0c953a4fa2b228249562ff1442a4f63a7150b064f3712b51c2af768d2c2711a71aabf8d186833e941a0301b82f0502905" "e1cbf2d86827825613fb7a85811d")))

+234

(test "wycheproof-99 valid"

+235

    (assert-eq #t (verdict "cfda5b899e35764c5229e59295fe1222b7ddce176643697c29e46ecbba10cf10" "2a833aadecd9f28235cb5896bf3781521dc71f28af2e91dbe1735a61dce3e31ac15ca24b3fc47817a59d386bbbb2ce60a6adc0a2703bb2bdea8f70f91051f706" "a25176b3afea318b2ec11ddacb10caf7179c0b3f8eabbfa2895581138d3c1e0e")))

+236

(test "wycheproof-100 valid"

+237

    (assert-eq #t (verdict "32ad026f693d0d2afe7f4388d91c4c964426fcb9e3665c3ebd8650009b815c8e" "1a74ed2cbdc7d8f3827014e8e6ecf8fd2698ac8f86833acccdd400df710fe0d6b0543c9cfa00d52bf024ab7ce0d91981944097233ec134d5c7abbd44bfd32d0d" "a1")))

+238

(test "wycheproof-101 valid"

+239

    (assert-eq #t (verdict "2252b3d57c74cbf8bc460dc2e082847926bc022f09ab6ae95756362bfd1167c1" "af0fd9dda7e03e12313410d8d8844ebb6fe6b7f65141f22d7bcba5695a25414a9e54326fb44d59fb14707899a8aae70857b23d4080d7ab2c396ef3a36d45ce02" "975ef941710071a9e1e6325a0c860becd7c695b5117c3107b686e330e5")))

+240

(test "wycheproof-102 valid"

+241

    (assert-eq #t (verdict "c0a773110f975de3732355bb7ec7f0c41c091c0252966070205516693b992a4a" "0280427e713378f49d478df6373c6cac847b622b567daa2376c839e7ac10e22c380ab0fa8617c9dcfe76c4d9db5459b21dc1413726e46cc8f387d359e344f407" "-")))

+242

(test "wycheproof-103 valid"

+243

    (assert-eq #t (verdict "cfda5b899e35764c5229e59295fe1222b7ddce176643697c29e46ecbba10cf10" "c97e3190f83bae7729ba473ad46b420b8aad735f0808ea42c0f898ccfe6addd4fd9d9fa3355d5e67ee21ab7e1f805cd07f1fce980e307f4d7ad36cc924eef00c" "a9e6d94870a67a9fe1cf13b1e6f9150cdd407bf6480ec841ea586ae3935e9787163cf419c1")))

+244

(test "wycheproof-104 valid"

+245

    (assert-eq #t (verdict "32ad026f693d0d2afe7f4388d91c4c964426fcb9e3665c3ebd8650009b815c8e" "14ceb2eaf4688d995d482f44852d71ad878cd7c77b41e60b0065fd01a59b054ee74759224187dbde9e59a763a70277c960892ef89fba997aba2576b2c54ba608" "11cb1eafa4c42a8402c4193c4696f7b2e6d4585e4b42dcf1a8b67a80b2da80bc9d4b649fb2f35eaf1f56c426fd0b")))

+246

(test "wycheproof-105 valid"

+247

    (assert-eq #t (verdict "c9c946cbc5544ac74eef491f07c5881c16faf7ec31ce4aa91bb60ae7b4539051" "c2656951e2a0285585a51ff0eda7e9a23c2dfd2ffa273aee7808f4604e8f9a8c8ea49e9fce4eb2d8d75d36b7238fe6fc13b6c5d9427dd58f8c6615d033c0bd0f" "27d465bc632743522aefa23c")))

+248

(test "wycheproof-106 valid"

+249

    (assert-eq #t (verdict "c29ec1894e06d27b4e40486b4fa5063d66a746c7f9c323b12203c03b72b8b78a" "931e5152fcef078c22cc5d6a3a65f06e396289f6f5f2d1efa6340254a53526ef5dc6874eeddf35c3f50991c53cd02bf06313e37d93ee1f7022128ffa3b8f300b" "5ffa")))

+250

(test "wycheproof-107 valid"

+251

    (assert-eq #t (verdict "529919c9c780985a841c42ba6c180ff2d67a276ccfbe281080e47ab71a758f56" "e4ae21f7a8f4b3b325c161a8c6e53e2edd7005b9c2f8a2e3b0ac4ba94aa80be6f2ee22ac8d4a96b9a3eb73a825e7bb5aff4a3393bf5b4a38119e9c9b1b041106" "25")))

+252

(test "wycheproof-108 valid"

+253

    (assert-eq #t (verdict "2252b3d57c74cbf8bc460dc2e082847926bc022f09ab6ae95756362bfd1167c1" "e097e0bd0370bff5bde359175a11b728ee9639095d5df8eda496395565616edfe079977f7d4dc8c75d6113a83d6a55e6e1676408c0967a2906339b43337dcb01" "80fdd6218f29c8c8f6bd820945f9b0854e3a8824")))

+254

(test "wycheproof-109 valid"

+255

    (assert-eq #t (verdict "2a606bf67ac770c607038b004101b325edb569efd3413d2d1f2c3e6b4e6e3082" "28fafbb62b4d688fa79e1ac92851f46e319b161f801d4dc09acc21fdd6780a2c4292b8c1003c61c2bcebe7f3f88ccc4bb26d407387c5f27cb8c94cf6ce810405" "b477b0480bb84642608b908d29a51cf2fce63f24ee95")))

+256

(test "wycheproof-110 valid"

+257

    (assert-eq #t (verdict "32ad026f693d0d2afe7f4388d91c4c964426fcb9e3665c3ebd8650009b815c8e" "83c40ce13d483cc58ff65844875862d93df4bd367af77efa469ec06a8ed9e6d7905a04879535708ddf225567a815c9b941d405c98e918fd0c151165cea7fb101" "aa365b442d12b7f3c925")))

+258

(test "wycheproof-111 valid"

+259

    (assert-eq #t (verdict "54cda623245759ad6d43e620a606908befc633d60792bc7798447a0ef38e7311" "14d9b497c19b91d43481c55bb6f5056de252d9ecb637575c807e58e9b4c5eac8b284089d97e2192dc242014363208e2c9a3435edf8928fb1d893553e9be4c703" "27e792b28b2f1702")))

+260

(test "wycheproof-112 valid"

+261

    (assert-eq #t (verdict "2362bac514d5fad33802642e979a1e82de6eb6f1bcbf6a5b304f2bb02b9e57fe" "242ddb3a5d938d07af690b1b0ef0fa75842c5f9549bf39c8750f75614c712e7cbaf2e37cc0799db38b858d41aec5b9dd2fca6a3c8e082c10408e2cf3932b9d08" "eef3bb0f617c17d0420c115c21c28e3762edc7b7fb048529b84a9c2bc6")))

+262

(test "wycheproof-113 valid"

+263

    (assert-eq #t (verdict "32ad026f693d0d2afe7f4388d91c4c964426fcb9e3665c3ebd8650009b815c8e" "71a4a06a34075f2fd47bc3abf4714d46db7e97b08cb6180d3f1539ac50b18ce51f8af8ae95ed21d4fa0daab7235925631ecea1fd9d0d8a2ba7a7583fd04b900c" "475f")))

+264

(test "wycheproof-114 valid"

+265

    (assert-eq #t (verdict "037b55b427dc8daa0f80fcebaf0846902309f8a6cf18b465c0ce9b6539629ac8" "c964e100033ce8888b23466677da4f4aea29923f642ae508f9d0888d788150636ab9b2c3765e91bbb05153801114d9e52dc700df377212222bb766be4b8c020d" "01234567")))

+266

(test "wycheproof-115 valid"

+267

    (assert-eq #t (verdict "9c0007698f177998a7666c7cf7973e2b88e9c4946e33804a7bbe8968d2394b2e" "176065c6d64a136a2227687d77f61f3fca3b16122c966276fd9a8b14a1a2cea4c33b3533d11101717016684e3810efbea63bb23773f7cc480174199abd734f08" "9399a6db9433d2a28d2b0c11c8794ab7d108c95b")))

+268

(test "wycheproof-116 valid"

+269

    (assert-eq #t (verdict "ed3a6f9721dc9729c1f76635bcf080d7036e1c2f0228654ccbbe1e738c17b963" "7ca69331eec8610d38f00e2cdbd46966cb359dcde98a257ac6f362cc00c8f4fe85c02285fe4d66e31a44cadb2bf474e1a7957609eb4fe95a71473fe6699aa70d" "7af783afbbd44c1833ab7237ecaf63b94ffdd003")))

+270

(test "wycheproof-117 valid"

+271

    (assert-eq #t (verdict "4abfb535313705a6570018440cdec1a3ae33e51f352112fa6acbd0c6bc3ea859" "f296715e855d8aecccba782b670163dedc4458fe4eb509a856bcac450920fd2e95a3a3eb212d2d9ccaf948c39ae46a2548af125f8e2ad9b77bd18f92d59f9200" "321b5f663c19e30ee7bbb85e48ecf44db9d3f512")))

+272

(test "wycheproof-118 valid"

+273

    (assert-eq #t (verdict "4f2162e6bf03a712db0efa418b7e7006e23871d9d7ec555a313885c4afd96385" "367d07253a9d5a77d054b9c1a82d3c0a448a51905343320b3559325ef41839608aa45564978da1b2968c556cfb23b0c98a9be83e594d5e769d69d1156e1b1506" "c48890e92aeeb3af04858a8dc1d34f16a4347b91")))

+274

(test "wycheproof-119 valid"

+275

    (assert-eq #t (verdict "4abfb535313705a6570018440cdec1a3ae33e51f352112fa6acbd0c6bc3ea859" "f296715e855d8aecccba782b670163dedc4458fe4eb509a856bcac450920fd2e95a3a3eb212d2d9ccaf948c39ae46a2548af125f8e2ad9b77bd18f92d59f9200" "321b5f663c19e30ee7bbb85e48ecf44db9d3f512")))

+276

(test "wycheproof-120 valid"

+277

    (assert-eq #t (verdict "4f2162e6bf03a712db0efa418b7e7006e23871d9d7ec555a313885c4afd96385" "367d07253a9d5a77d054b9c1a82d3c0a448a51905343320b3559325ef41839608aa45564978da1b2968c556cfb23b0c98a9be83e594d5e769d69d1156e1b1506" "c48890e92aeeb3af04858a8dc1d34f16a4347b91")))

+278

(test "wycheproof-121 valid"

+279

    (assert-eq #t (verdict "0717d75ce27ea181ed5a30e6456c649b5cf453a6b4c12cd3f9fd16b31e0c25cd" "9588e02bc815649d359ce710cdc69814556dd8c8bab1c468f40a49ebefb7f0de7ed49725edfd1b708fa1bad277c35d6c1b9c5ec25990997645780f9203d7dd08" "26d5f0631f49106db58c4cfc903691134811b33c")))

+280

(test "wycheproof-122 valid"

+281

    (assert-eq #t (verdict "db5b9eab7e84e5a13505865fa711c9c896c898609fc11fc9bc1e55028f9496df" "2217a0be57dd0d6c0090641496bcb65e37213f02a0df50aff0368ee2808e1376504f37b37494132dfc4d4887f58b9e86eff924040db3925ee4f8e1428c4c500e" "2a71f064af982a3a1103a75cef898732d7881981")))

+282

(test "wycheproof-123 valid"

+283

    (assert-eq #t (verdict "7bac18f6d2625d3915f233434cda38a577247a7332a5170b37142a34644145e0" "1fda6dd4519fdbefb515bfa39e8e5911f4a0a8aa65f40ef0c542b8b34b87f9c249dc57f320718ff457ed5915c4d0fc352affc1287724d3f3a9de1ff777a02e01" "bf26796cef4ddafcf5033c8d105057db0210b6ad")))

+284

(test "wycheproof-124 valid"

+285

    (assert-eq #t (verdict "7bac18f6d2625d3915f233434cda38a577247a7332a5170b37142a34644145e0" "1fda6dd4519fdbefb515bfa39e8e5911f4a0a8aa65f40ef0c542b8b34b87f9c249dc57f320718ff457ed5915c4d0fc352affc1287724d3f3a9de1ff777a02e01" "bf26796cef4ddafcf5033c8d105057db0210b6ad")))

+286

(test "wycheproof-125 valid"

+287

    (assert-eq #t (verdict "38ead304624abebf3e2b31e20e5629531e3fc659008887c9106f5e55adbbc62a" "068eafdc2f36b97f9bae7fbda88b530d16b0e35054d3a351e3a4c914b22854c711505e49682e1a447e10a69e3b04d0759c859897b64f71137acf355b63faf100" "ae03da6997e40cea67935020152d3a9a365cc055")))

+288

(test "wycheproof-126 valid"

+289

    (assert-eq #t (verdict "e9bc95049af7e4817b17c402269ba5e767b7348757ac8002fec9e08390c0a9cf" "43670abc9f09a8a415e76f4a21c6a46156f066b5a37b3c1e867cf67248c7b927e8d13a763e37abf936f5f27f7a8aa290539d21f740efd26b65fd5ad27085f400" "489d473f7fb83c7f6823baf65482517bccd8f4ea")))

+290

(test "wycheproof-127 valid"

+291

    (assert-eq #t (verdict "ee8155ca4e8fe7bc5bca5992044eab7f8c3c6a13db1176f42f46c29da5b064f4" "56388f2228893b14ce4f2a5e0cc626591061de3a57c50a5ecab7b9d5bb2caeea191560a1cf2344c75fdb4a085444aa68d727b39f498169eaa82cf64a31f59803" "1b704d6692d60a07ad1e1d047b65e105a80d3459")))

+292

(test "wycheproof-128 valid"

+293

    (assert-eq #t (verdict "db507bfcc9576393f7157bb360532b05c5fcf2e764b690cc6698a4a30d349095" "553e5845fc480a577da6544e602caadaa00ae3e5aa3dce9ef332b1541b6d5f21bdf1d01e98baf80b8435f9932f89b3eb70f02da24787aac8e77279e797d0bd0b" "dc87030862c4c32f56261e93a367caf458c6be27")))

+294

(test "wycheproof-129 valid"

+295

    (assert-eq #t (verdict "994eaf03309d6ad9d95a656bc1744e2886f029023a3750b34f35086b3c7227f8" "bc10f88081b7be1f2505b6e76c5c82e358cf21ec11b7df1f334fb587bada465b53d9f7b4d4fec964432ee91ead1bc32ed3c82f2167da1c834a37515df7fe130e" "7f41ef68508343ef18813cb2fb332445ec6480cd")))

+296

(test "wycheproof-130 valid"

+297

    (assert-eq #t (verdict "127d37e406e0d83e4b55a09e21e8f50fb88af47e4a43f018cdebffc1948757f0" "00c11e76b5866b7c37528b0670188c1a0473fb93c33b72ae604a8865a7d6e094ff722e8ede3cb18389685ff3c4086c29006047466f81e71a329711e0b9294709" "e1ce107971534bc46a42ac609a1a37b4ca65791d")))

+298

(test "wycheproof-131 valid"

+299

    (assert-eq #t (verdict "d83ba84edfb4bec49f29be31d80a64b7c0b5a502438cdb1d0dd1e0e3e55786de" "0a6f0ac47ea136cb3ff00f7a96638e4984048999ee2da0af6e5c86bffb0e70bb97406b6ad5a4b764f7c99ebb6ec0fd434b8efe253b0423ef876c037998e8ab07" "869a827397c585cf35acf88a8728833ab1c8c81e")))

+300

(test "wycheproof-132 valid"

+301

    (assert-eq #t (verdict "d3c9aa2f3d6ef217a166e8ae403ed436c37facbbe3beceb78df6eb439f8fa04a" "b7cbb942a6661e2312f79548224f3e44f5841c6e880c68340756a00ce94a914e8404858265985e6bb97ef01d2d7e5e41340309606bfc43c8c6a8f925126b3d09" "619d8c4f2c93104be01cd574a385ceca08c33a9e")))

+302

(test "wycheproof-133 valid"

+303

    (assert-eq #t (verdict "d53280367c1c0b95ac4112218b92c6a71c51fb6312ce668de196c7d52a136155" "27a4f24009e579173ff3064a6eff2a4d20224f8f85fdec982a9cf2e6a3b51537348a1d7851a3a932128a923a393ea84e6b35eb3473c32dceb9d7e9cab03a0f0d" "5257a0bae8326d259a6ce97420c65e6c2794afe2")))

+304

(test "wycheproof-134 valid"

+305

    (assert-eq #t (verdict "94ac2336ba97a476fb4c9f2b5563e4167ca292c6e99e422350a911ae3172c315" "985b605fe3f449f68081197a68c714da0bfbf6ac2ab9abb0508b6384ea4999cb8d79af98e86f589409e8d2609a8f8bd7e80aaa8d92a84e7737fbe8dcef41920a" "5acb6afc9b368f7acac0e71f6a4831c72d628405")))

+306

(test "wycheproof-135 valid"

+307

    (assert-eq #t (verdict "e1e7316d231f7f275bdf403360304da1509fdf1af1fd25ca214eaac0a289398f" "1c8fbda3d39e2b441f06da6071c13115cb4115c7c3341704cf6513324d4cf1ef4a1dd7678a048b0dde84e48994d080befcd70854079d44b6a0b0f9fa002d130c" "3c87b3453277b353941591fc7eaa7dd37604b42a")))

+308

(test "wycheproof-136 valid"

+309

    (assert-eq #t (verdict "fffbeea71215efaf9888fec2cc68edb3703ff11a66fd629b53cbda5eabc18750" "59097233eb141ed948b4f3c28a9496b9a7eca77454ecfe7e46737d1449a0b76b15aacf77cf48af27a668aa4434cfa26c504d75a2bcc4feac46465446234c0508" "0a68e27ef6847bfd9e398b328a0ded3679d4649d")))

+310

(test "wycheproof-137 valid"

+311

    (assert-eq #t (verdict "19ccc0527599cb032e0b4c4d74e60f13901768a99df041c3bc1bf6c0ef271169" "519105608508fe2f1b6da4cc8b23e39798b1d18d25972beed0404cec722e01ba1b6a0f85e99e092cca8076b101b60d4ac5035684357f4d0daacdc642da742a06" "4e9bef60737c7d4dd10bd52567e1473a36d3573d")))

+312

(test "wycheproof-138 valid"

+313

    (assert-eq #t (verdict "0e726e27047563aa0a1a9c2e085d8d26af2acba129d0869c65031e3e6cac329a" "d8b03ee579e73f16477527fc9dc37a72eaac0748a733772c483ba013944f01ef64fb4ec5e3a95021dc22f4ae282baff6e9b9cc8433c6b6710d82e7397d72ef04" "cc82b3163efda3ba7e9240e765112caa69113694")))

+314

(test "wycheproof-139 valid"

+315

    (assert-eq #t (verdict "e77717b54a2b5e5bce5bccb8f0c5fdb5fd7df77ac254020fc9120dc0d4df4178" "26da61fdfd38e6d01792813f27840c8b4766b0faaed39d0ee898cb450d94a5d5f57e58b6a003d7f9b56b20561954c6edcf66492d116b8b5e91f205a3a6449d0b" "923a5c9e7b5635bb6c32c5a408a4a15b652450eb")))

+316

(test "wycheproof-140 valid"

+317

    (assert-eq #t (verdict "6220972d3f7d150b36790d7d522384876d64d640cd9913186815e1629582ed36" "4adeaff7a58c5010a5a067feea0ae504d37b0c6a76c6c153e222f13409dff2df0fab69bc5059b97d925dc1b89e9851d7c627cb82d65585f9fd976124553f8902" "6f2f0245de4587062979d0422d349f93ccdc3af2")))

+318

(test "wycheproof-141 valid"

+319

    (assert-eq #t (verdict "7b64a28c50ec7678a90e3e1a21522e30ac9db7b5215aea2bfb33bea037eab987" "4204d620cde0c3008c0b2901f5d6b44f88f0e3cb4f4d62252bf6f3cb37c1fb150a9ccb296afe5e7c75f65b5c8edd13dc4910ffe1e1265b3707c59042cf9a5902" "6e911edb27a170b983d4dee1110554f804330f41")))

+320

(test "wycheproof-142 valid"

+321

    (assert-eq #t (verdict "724452210a9e4c994819229bf12bf84e95768a3a97c08d8d8f5f939a4cad34c5" "f8a69d3fd8c2ff0a9dec41e4c6b43675ce08366a35e220b1185ffc246c339e22c20ac661e866f52054015efd04f42eca2adcee6834c4df923b4a62576e4dff0e" "b8cf807eea809aaf739aa091f3b7a3f2fd39fb51")))

+322

(test "wycheproof-143 valid"

+323

    (assert-eq #t (verdict "bad265b294ed2f422cb6a141694086238fbfe987571aa765d8b4f3a24105aa01" "61792c9442bc6338ac41fd42a40bee9b02ec1836503d60ff725128c63d72808880c36e6190b7da525cbee5d12900aa043547dd14a2709ef9e49d628f37f6b70c" "01a2b5f7fee813b4e9bd7fc25137648004795010")))

+324

(test "wycheproof-144 valid"

+325

    (assert-eq #t (verdict "0aaee4b723db9b51ba7d22eb23eb8a76a5ac02f4fc9dd06f77bea42e1d37ec5a" "fa3cd41e3a8c00b19eecd404a63c3cb787cd30de0dfc936966cff2117f5aff18db6bef80fcfd8856f3fb2e9c3dc47593e9471103032af918feee638a33d40505" "0fbf5d47cb5d498feace8f98f1896208da38a885")))

+326

(test "wycheproof-145 valid"

+327

    (assert-eq #t (verdict "812344af15a91ba83c2c91e96f1727ac0f3c4c41385b9fa84efa399ada5168be" "97fbbcd7a1d0eb42d2f8c42448ef35a2c2472740556b645547865330d6c57068af377fced08aaf810c08cd3c43d296f1975710312e9334c98b485f831efa4103" "36e67c1939750bffb3e4ba6cb85562612275e862")))

+328

(test "wycheproof-146 valid"

+329

    (assert-eq #t (verdict "0ee5cb5597fbdf8dccc48b01485e39b33aa133b52d30d23740277267cfec3e3e" "d7dbaa337ffd2a5fd8d5fd8ad5aeccc0c0f83795c2c59fe62a40b87903b1ae62ed748a8df5af4d32f9f822a65d0e498b6f40eaf369a9342a1164ee7d08b58103" "13945c894c1d3fe8562e8b20e5f0efaa26ade8e3")))

+330

(test "wycheproof-147 valid"

+331

    (assert-eq #t (verdict "9fba1de92b60b5b4703089763d0d6f9125e4dd7efae41f08a22882aef96892c4" "09a2ed303a2fa7027a1dd7c3b0d25121eeed2b644a2fbc17aa0c8aea4524071ede7e7dd7a536d5497f8165d29e4e1b63200f74bbae39fbbbccb29889c62c1f09" "4de142af4b8402f80a47fa812df84f42e283cee7")))

+332

(test "wycheproof-148 valid"

+333

    (assert-eq #t (verdict "7582ab1b52e1316e5c13671f43b39ca36b28133cd0832831bcddd0b0f23398cb" "e6884a6e6b2e60a0b5862251c001e7c79d581d777d6fc11d218d0aecd79f26a30e2ca22cc7c4674f8b72655bc4ee5cb5494ca07c05177656142ac55cc9d33e02" "563357f41b8b23b1d83f19f5667177a67da20b18")))

+334

(test "wycheproof-149 valid"

+335

    (assert-eq #t (verdict "dd2d678bae222f3fb6e8278f08cc9e1a66339c926c29ac0a16f9717f5ee18cd8" "6124c206d864507ea5d984b363b4cf583314db6856a45ded5e61eebff4d5e337e0b4c82b445ae2e52d549d2d961eace2ea01f81158e09a9686baa040db65ad08" "931bbf9c877a6571cf7d4609fc3eb867edd43f51")))

+336

(test "wycheproof-150 valid"

+337

    (assert-eq #t (verdict "ccbe7cb2e4bc215cee2f885e1d22f7e0d582b2bbbd782c104e548b152d26fc69" "cfbd450a2c83cb8436c348822fe3ee347d4ee937b7f2ea11ed755cc52852407c9eec2c1fa30d2f9aef90e89b2cc3bcef2b1b9ca59f712110d19894a9cf6a2802" "44530b0b34f598767a7b875b0caee3c7b9c502d1")))

+338

(test "wycheproof-151 invalid"

+339

    (assert-eq #f (verdict "d75a980182b10ab7d54bfed3c964073a0ee172f3daa62325af021a68f707511a" "0100000000000000000000000000000000000000000000000000000000000080c803ee1f2342aa96ff698a393d1ab5e66f3eda101d6d120b394c3fd32c117d0a" "313233343030")))

+340

(test "speccheck-0 invalid"

+341

    (assert-eq #f (verdict "c7176a703d4dd84fba3c0b760d10670f2a2053fa2c39ccc64ec7fd7792ac03fa" "c7176a703d4dd84fba3c0b760d10670f2a2053fa2c39ccc64ec7fd7792ac037a0000000000000000000000000000000000000000000000000000000000000000" "8c93255d71dcab10e8f379c26200f3c7bd5f09d9bc3068d3ef4edeb4853022b6")))

+342

(test "speccheck-1 invalid"

+343

    (assert-eq #f (verdict "c7176a703d4dd84fba3c0b760d10670f2a2053fa2c39ccc64ec7fd7792ac03fa" "f7badec5b8abeaf699583992219b7b223f1df3fbbea919844e3f7c554a43dd43a5bb704786be79fc476f91d3f3f89b03984d8068dcf1bb7dfc6637b45450ac04" "9bd9f44f4dcc75bd531b56b2cd280b0bb38fc1cd6d1230e14861d861de092e79")))

+344

(test "speccheck-2 invalid"

+345

    (assert-eq #f (verdict "f7badec5b8abeaf699583992219b7b223f1df3fbbea919844e3f7c554a43dd43" "c7176a703d4dd84fba3c0b760d10670f2a2053fa2c39ccc64ec7fd7792ac03fa8c4bd45aecaca5b24fb97bc10ac27ac8751a7dfe1baff8b953ec9f5833ca260e" "aebf3f2601a0c8c5d39cc7d8911642f740b78168218da8471772b35f9d35b9ab")))

+346

(test "speccheck-3 valid"

+347

    (assert-eq #t (verdict "cdb267ce40c5cd45306fa5d2f29731459387dbf9eb933b7bd5aed9a765b88d4d" "9046a64750444938de19f227bb80485e92b83fdb4b6506c160484c016cc1852f87909e14428a7a1d62e9f22f3d3ad7802db02eb2e688b6c52fcd6648a98bd009" "9bd9f44f4dcc75bd531b56b2cd280b0bb38fc1cd6d1230e14861d861de092e79")))

+348

(test "speccheck-4 valid"

+349

    (assert-eq #t (verdict "cdb267ce40c5cd45306fa5d2f29731459387dbf9eb933b7bd5aed9a765b88d4d" "160a1cb0dc9c0258cd0a7d23e94d8fa878bcb1925f2c64246b2dee1796bed5125ec6bc982a269b723e0668e540911a9a6a58921d6925e434ab10aa7940551a09" "e47d62c63f830dc7a6851a0b1f33ae4bb2f507fb6cffec4011eaccd55b53f56c")))

+350

(test "speccheck-5 valid"

+351

    (assert-eq #t (verdict "cdb267ce40c5cd45306fa5d2f29731459387dbf9eb933b7bd5aed9a765b88d4d" "21122a84e0b5fca4052f5b1235c80a537878b38f3142356b2c2384ebad4668b7e40bc836dac0f71076f9abe3a53f9c03c1ceeeddb658d0030494ace586687405" "e47d62c63f830dc7a6851a0b1f33ae4bb2f507fb6cffec4011eaccd55b53f56c")))

+352

(test "speccheck-6 invalid"

+353

    (assert-eq #f (verdict "442aad9f089ad9e14647b1ef9099a1ff4798d78589e66f28eca69c11f582a623" "e96f66be976d82e60150baecff9906684aebb1ef181f67a7189ac78ea23b6c0e547f7690a0e2ddcd04d87dbc3490dc19b3b3052f7ff0538cb68afb369ba3a514" "85e241a07d148b41e47d62c63f830dc7a6851a0b1f33ae4bb2f507fb6cffec40")))

+354

(test "speccheck-7 invalid"

+355

    (assert-eq #f (verdict "442aad9f089ad9e14647b1ef9099a1ff4798d78589e66f28eca69c11f582a623" "8ce5b96c8f26d0ab6c47958c9e68b937104cd36e13c33566acd2fe8d38aa19427e71f98a473474f2f13f06f97c20d58cc3f54b8bd0d272f42b695dd7e89a8c22" "85e241a07d148b41e47d62c63f830dc7a6851a0b1f33ae4bb2f507fb6cffec40")))

+356

(test "speccheck-8 invalid"

+357

    (assert-eq #f (verdict "f7badec5b8abeaf699583992219b7b223f1df3fbbea919844e3f7c554a43dd43" "ecffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff03be9678ac102edcd92b0210bb34d7428d12ffc5df5f37e359941266a4e35f0f" "9bedc267423725d473888631ebf45988bad3db83851ee85c85e241a07d148b41")))

+358

(test "speccheck-9 invalid"

+359

    (assert-eq #f (verdict "f7badec5b8abeaf699583992219b7b223f1df3fbbea919844e3f7c554a43dd43" "ecffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffca8c5b64cd208982aa38d4936621a4775aa233aa0505711d8fdcfdaa943d4908" "9bedc267423725d473888631ebf45988bad3db83851ee85c85e241a07d148b41")))

+360

(test "speccheck-10 invalid"

+361

    (assert-eq #f (verdict "ecffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff" "a9d55260f765261eb9b84e106f665e00b867287a761990d7135963ee0a7d59dca5bb704786be79fc476f91d3f3f89b03984d8068dcf1bb7dfc6637b45450ac04" "e96b7021eb39c1a163b6da4e3093dcd3f21387da4cc4572be588fafae23c155b")))

+362

(test "speccheck-11 invalid"

+363

    (assert-eq #f (verdict "ecffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff" "a9d55260f765261eb9b84e106f665e00b867287a761990d7135963ee0a7d59dca5bb704786be79fc476f91d3f3f89b03984d8068dcf1bb7dfc6637b45450ac04" "39a591f5321bbe07fd5a23dc2f39d025d74526615746727ceefd6e82ae65c06f")))

+364

)

+365

+366

;;; 168 cases

test/test-ed25519.sgladded

@@ -0,0 +1,156 @@

;;; Ed25519 (RFC 8032) and BLAKE2b-512 in (sigil crypto).

;;;

;;; The bulk vector sets (RFC 8032, Wycheproof, ed25519-speccheck) are in

;;; test-ed25519-vectors.sgl. This file holds the RFC 8032 key derivation and

;;; signing checks, the negative cases built from a valid signature with one

;;; controlled change, and BLAKE2b-512.

(import (sigil test)

(sigil crypto)

+10

(sigil math))

+11

+12

(define (hex->bv s)

+13

(let* ((n (quotient (string-length s) 2))

+14

(bv (make-bytevector n 0)))

+15

(let loop ((i 0))

+16

(if (< i n)

+17

(begin

+18

(bytevector-u8-set! bv i (string->number (substring s (* 2 i) (+ 2 (* 2 i))) 16))

+19

(loop (+ i 1)))

+20

bv))))

+21

+22

(define (bv->hex bv)

+23

(let loop ((i 0) (acc '()))

+24

(if (< i (bytevector-length bv))

+25

(let* ((b (bytevector-u8-ref bv i))

+26

(h (number->string b 16)))

+27

(loop (+ i 1) (cons (if (< b 16) (string-append "0" h) h) acc)))

+28

(apply string-append (reverse acc)))))

+29

+30

;; A copy of bv with bit `bit` of byte `index` flipped.

+31

(define (flip-bit bv index bit)

+32

(let ((out (bytevector-copy bv)))

+33

(bytevector-u8-set! out index

+34

(bitwise-xor (bytevector-u8-ref out index)

+35

(arithmetic-shift 1 bit)))

+36

out))

+37

+38

;; RFC 8032 section 7.1, TEST 1 to TEST 3.

+39

(define t1-seed (hex->bv "9d61b19deffd5a60ba844af492ec2cc44449c5697b326919703bac031cae7f60"))

+40

(define t1-pk (hex->bv "d75a980182b10ab7d54bfed3c964073a0ee172f3daa62325af021a68f707511a"))

+41

(define t1-msg (make-bytevector 0 0))

+42

(define t1-sig (hex->bv "e5564300c360ac729086e2cc806e828a84877f1eb8e5d974d873e065224901555fb8821590a33bacc61e39701cf9b46bd25bf5f0595bbe24655141438e7a100b"))

+43

+44

(define t2-seed (hex->bv "4ccd089b28ff96da9db6c346ec114e0f5b8a319f35aba624da8cf6ed4fb8a6fb"))

+45

(define t2-pk (hex->bv "3d4017c3e843895a92b70aa74d1b7ebc9c982ccf2ec4968cc0cd55f12af4660c"))

+46

(define t2-msg (hex->bv "72"))

+47

(define t2-sig (hex->bv "92a009a9f0d4cab8720e820b5f642540a2b27b5416503f8fb3762223ebdb69da085ac1e43e15996e458f3613d0f11d8c387b2eaeb4302aeeb00d291612bb0c00"))

+48

+49

(define t3-seed (hex->bv "c5aa8df43f9f837bedb7442f31dcb7b166d38535076f094b85ce3a2e0b4458f7"))

+50

(define t3-pk (hex->bv "fc51cd8e6218a1a38da47ed00230f0580816ed13ba3303ac5deb911548908025"))

+51

(define t3-msg (hex->bv "af82"))

+52

(define t3-sig (hex->bv "6291d657deec24024827e69c3abe01a30ce548a284743a445e3680d7db5ac3ac18ff9b538d16f290ae67f760984dc6594a7c15e9716ed28dc027beceea1ec40a"))

+53

+54

;; TEST 1's signature with S replaced by S + L (L = 2^252 +

+55

;; 27742317777372353535851937790883648493, the group order), computed with

+56

;; Python integers. [S + L]B = [S]B, so this satisfies the verification

+57

;; equation; only the S < L range check can reject it.

+58

(define t1-sig-s-plus-l

+59

(hex->bv (string-append

+60

"e5564300c360ac729086e2cc806e828a84877f1eb8e5d974d873e06522490155"

+61

"4c8c7872aa064e049dbb3013fbf29380d25bf5f0595bbe24655141438e7a101b")))

+62

+63

(test-group "ed25519 RFC 8032 derivation and signing"

+64

(test "TEST 1 public key from seed"

+65

(assert-equal (bv->hex t1-pk) (bv->hex (ed25519-public-key t1-seed))))

+66

(test "TEST 2 public key from seed"

+67

(assert-equal (bv->hex t2-pk) (bv->hex (ed25519-public-key t2-seed))))

+68

(test "TEST 3 public key from seed"

+69

(assert-equal (bv->hex t3-pk) (bv->hex (ed25519-public-key t3-seed))))

+70

(test "TEST 1 signature is the RFC's"

+71

(assert-equal (bv->hex t1-sig) (bv->hex (ed25519-sign t1-seed t1-msg))))

+72

(test "TEST 2 signature is the RFC's"

+73

(assert-equal (bv->hex t2-sig) (bv->hex (ed25519-sign t2-seed t2-msg))))

+74

(test "TEST 3 signature is the RFC's"

+75

(assert-equal (bv->hex t3-sig) (bv->hex (ed25519-sign t3-seed t3-msg))))

+76

(test "the seed bytevector is not wiped by derivation or signing"

+77

(let ((seed (bytevector-copy t2-seed)))

+78

(ed25519-public-key seed)

+79

(ed25519-sign seed "x")

+80

(assert-equal (bv->hex t2-seed) (bv->hex seed))))

+81

(test "a string message signs its UTF-8 bytes"

+82

(assert-equal (bv->hex (ed25519-sign t2-seed (bytevector 104 105)))

+83

(bv->hex (ed25519-sign t2-seed "hi")))))

+84

+85

(test-group "ed25519 verify: controls"

+86

(test "TEST 1 verifies"

+87

(assert-eq #t (ed25519-verify t1-pk t1-msg t1-sig)))

+88

(test "TEST 2 verifies"

+89

(assert-eq #t (ed25519-verify t2-pk t2-msg t2-sig)))

+90

(test "TEST 3 verifies"

+91

(assert-eq #t (ed25519-verify t3-pk t3-msg t3-sig)))

+92

(test "a sign/verify round trip with a string message"

+93

(let ((sig (ed25519-sign t3-seed "round trip")))

+94

(assert-eq #t (ed25519-verify t3-pk "round trip" sig)))))

+95

+96

;; Each negative below changes ONE input of a signature the control group

+97

;; shows verifying, so the change is the only possible cause of the #f.

+98

(test-group "ed25519 verify: negatives"

+99

(test "every single-bit flip of TEST 2's message fails"

+100

(let loop ((bit 0))

+101

(when (< bit 8)

+102

(assert-eq #f (ed25519-verify t2-pk (flip-bit t2-msg 0 bit) t2-sig))

+103

(loop (+ bit 1)))))

+104

(test "a flipped bit in each byte of TEST 3's signature fails"

+105

(let loop ((i 0))

+106

(when (< i 64)

+107

(assert-eq #f (ed25519-verify t3-pk t3-msg (flip-bit t3-sig i (modulo i 8))))

+108

(loop (+ i 1)))))

+109

(test "a flipped bit in each byte of TEST 3's public key fails"

+110

(let loop ((i 0))

+111

(when (< i 32)

+112

(assert-eq #f (ed25519-verify (flip-bit t3-pk i (modulo i 8)) t3-msg t3-sig))

+113

(loop (+ i 1)))))

+114

(test "a signature under another key fails"

+115

(assert-eq #f (ed25519-verify t2-pk t3-msg t3-sig)))

+116

(test "an extra trailing message byte fails"

+117

(assert-eq #f (ed25519-verify t3-pk (hex->bv "af8200") t3-sig)))

+118

(test "S + L (non-canonical S) fails although the equation holds"

+119

(assert-eq #f (ed25519-verify t1-pk t1-msg t1-sig-s-plus-l)))

+120

(test "the all-zero signature fails"

+121

(assert-eq #f (ed25519-verify t1-pk t1-msg (make-bytevector 64 0))))

+122

(test "the identity public key fails for any signature"

+123

;; Identity (order 1) as A: [8](sB - hA - R) = [8](sB - R), so a

+124

;; cofactored check alone would accept R = [s]B for any message.

+125

;; With R = B (the base point) and S = 1: [8]([1]B - h*O - B) = O for

+126

;; every message, so only the small-order check on A can reject it.

+127

(let* ((identity (let ((b (make-bytevector 32 0))) (bytevector-u8-set! b 0 1) b))

+128

(base-point (hex->bv "5866666666666666666666666666666666666666666666666666666666666666"))

+129

(one (let ((b (make-bytevector 32 0))) (bytevector-u8-set! b 0 1) b))

+130

(forged (bytevector-append base-point one)))

+131

(assert-eq #f (ed25519-verify identity "anything" forged))

+132

(assert-eq #f (ed25519-verify identity "anything else" forged)))))

+133

+134

(test-group "ed25519 verify: argument checking"

+135

(test "a 31-byte public key raises"

+136

(assert-error (ed25519-verify (make-bytevector 31 0) "m" t1-sig)))

+137

(test "a 65-byte signature raises"

+138

(assert-error (ed25519-verify t1-pk "m" (make-bytevector 65 0))))

+139

(test "a string public key raises"

+140

(assert-error (ed25519-verify "not a key" "m" t1-sig)))

+141

(test "a 16-byte seed raises"

+142

(assert-error (ed25519-sign (make-bytevector 16 0) "m"))))

+143

+144

(test-group "blake2b-512"

+145

(test "RFC 7693 appendix A: abc"

+146

    (assert-equal "ba80a53f981c4d0d6a2797b69f12f6e94c212f14685ac4b74b12bb6fdbffa2d17d87c5392aab792dc252d5de4533cc9518d38aa8dbf1925ab92386edd4009923"

+147

(bv->hex (blake2b-512 "abc"))))

+148

(test "empty input (coreutils b2sum)"

+149

    (assert-equal "786a02f742015903c6c6fd852552d272912f4740e15847618a86e217f71f5419d25e1031afee585313896444934eb04b903a685b1448b755d56f701afe9be2ce"

+150

(bv->hex (blake2b-512 (make-bytevector 0 0)))))

+151

(test "1000 x 'a', more than one 128-byte block (coreutils b2sum)"

+152

    (assert-equal "d6a69459fe93fc6b9537ed4336e5099e0dcca3e97290a412500ed7a0daffb03d80cf3650a20e0591f748e10c3c534945ee83d5f2c9722f1a68d98b8c01af23fd"

+153

(bv->hex (blake2b-512 (make-bytevector 1000 97)))))

+154

(test "string and bytevector input agree"

+155

(assert-equal (bv->hex (blake2b-512 "abc"))

+156

(bv->hex (blake2b-512 (bytevector 97 98 99))))))

test/test-minisign.sgladded

@@ -0,0 +1,303 @@

;;; (sigil crypto minisign) against signatures made by the real minisign.

;;;

;;; Fixtures live in test/fixtures/minisign and were made by

;;; make-fixtures.sh with minisign 0.12, which also checked every one with

;;; `minisign -V` before keeping it. Two come from other people's keys:

;;; production registry.json under the Sigil registry root key, and the

;;; minisign 0.12 source tarball under the minisign author's key.

;;;

;;; Every negative asserts the reason `minisign-failure-reason` gives, so a test

+10

;;; cannot pass because verification failed for some other cause.

+11

+12

(import (sigil test)

+13

(sigil crypto)

+14

(sigil crypto minisign)

+15

(sigil fs)

+16

(sigil io)

+17

(sigil math)

+18

(sigil string))

+19

+20

(define fixture-dir "test/fixtures/minisign/")

+21

+22

(define (fixture name) (read-file-bytes (string-append fixture-dir name)))

+23

(define (fixture-text name) (utf8->string (fixture name)))

+24

(define (nth lst k) (if (= k 0) (car lst) (nth (cdr lst) (- k 1))))

+25

+26

(define root-key-line "RWRa9dPSUBFexBbLdzZIfuAmuCYL736UeHC7IbdAOIYpgGIyDmWRaQHY")

+27

(define minisign-author-key-line "RWQf6LRCGA9i53mlYecO4IzT51TGPpvWucNSCh1CBM0QTaLn73Y7GFO3")

+28

+29

(define key-a (minisign-parse-public-key (fixture "a.pub")))

+30

(define key-b (minisign-parse-public-key (fixture "b.pub")))

+31

(define root-key (minisign-parse-public-key root-key-line))

+32

(define author-key (minisign-parse-public-key minisign-author-key-line))

+33

+34

(define (sig name) (minisign-parse-signature (fixture name)))

+35

+36

;; The lines of a text fixture, and a way to rebuild it with one changed.

+37

(define (lines-of name) (string-split (fixture-text name) "\n"))

+38

(define (join-lines lines) (string-join lines "\n"))

+39

(define (with-line lines index new)

+40

(let loop ((i 0) (ls lines) (acc '()))

+41

(if (null? ls)

+42

(reverse acc)

+43

(loop (+ i 1) (cdr ls) (cons (if (= i index) new (car ls)) acc)))))

+44

+45

;; Replace the character at `index` of `s` with `c`.

+46

(define (string-with-char s index c)

+47

(string-append (substring s 0 index) (string c)

+48

(substring s (+ index 1) (string-length s))))

+49

+50

;; A different base64 alphabet character than `c`.

+51

(define (other-b64-char c) (if (char=? c #\A) #\B #\A))

+52

+53

(define (flip-byte bv index)

+54

(let ((out (bytevector-copy bv)))

+55

(bytevector-u8-set! out index (bitwise-xor (bytevector-u8-ref out index) 1))

+56

out))

+57

+58

;; Rebuild a signature file's second line with bytes [start, end) of the

+59

;; decoded signature replaced by `new-bytes`.

+60

(define (resign-line line start new-bytes)

+61

(let* ((raw (base64-decode line))

+62

(out (bytevector-copy raw)))

+63

(let loop ((i 0))

+64

(when (< i (bytevector-length new-bytes))

+65

(bytevector-u8-set! out (+ start i) (bytevector-u8-ref new-bytes i))

+66

(loop (+ i 1))))

+67

(base64-encode out)))

+68

+69

;; #t when thunk raises an error whose message contains `needle`.

+70

(define (raises-with? needle thunk)

+71

(guard (e (#t (and (error-object? e)

+72

(string-contains? (error-object-message e) needle))))

+73

(thunk)

+74

#f))

+75

+76

(define (raises? thunk)

+77

(guard (e (#t #t)) (thunk) #f))

+78

+79

(test-group "minisign fixtures are present"

+80

;; Presence probe with a positive answer: an empty or missing fixture

+81

;; directory must fail here, not quietly weaken the tests below.

+82

(test "hello.txt reads back"

+83

(assert-equal "hello, minisign\n" (fixture-text "hello.txt")))

+84

(test "binary.bin is all 1024 bytes"

+85

(assert-equal 1024 (bytevector-length (fixture "binary.bin")))))

+86

+87

(test-group "minisign public keys"

+88

(test "a .pub file parses and its id matches the file's comment"

+89

(let* ((first-line (car (lines-of "a.pub")))

+90

(id (substring first-line (- (string-length first-line) 16)

+91

(string-length first-line))))

+92

(assert-equal id (minisign-public-key-id key-a))))

+93

(test "the bare base64 line parses to the same key"

+94

(let ((bare (minisign-parse-public-key (cadr (lines-of "a.pub")))))

+95

(assert-equal (minisign-public-key-id key-a) (minisign-public-key-id bare))

+96

(assert-equal (minisign-public-key-bytes key-a) (minisign-public-key-bytes bare))))

+97

(test "the registry root key has the id registry.json lists"

+98

(assert-equal "C45E1150D2D3F55A" (minisign-public-key-id root-key)))

+99

(test "public key bytes are 32 bytes"

+100

(assert-equal 32 (bytevector-length (minisign-public-key-bytes key-a))))

+101

(test "a key line one character short raises (length)"

+102

(assert-true (raises-with? "wrong base64 length" (lambda () (minisign-parse-public-key

+103

(substring root-key-line 0 55))))))

+104

(test "a key line with a character outside base64 raises"

+105

(assert-true (raises-with? "character outside base64" (lambda () (minisign-parse-public-key

+106

(string-with-char root-key-line 20 #\!))))))

+107

(test "a key whose algorithm is not Ed raises"

+108

;; "RW" starts the base64 of "Ed"; "RX" makes the algorithm "Et".

+109

(assert-true (raises-with? "algorithm is not Ed" (lambda () (minisign-parse-public-key

+110

(string-with-char root-key-line 1 #\X))))))

+111

(test "three non-blank lines raise"

+112

(assert-true (raises-with? "must be one base64 line" (lambda () (minisign-parse-public-key

+113

(string-append (fixture-text "a.pub")

+114

root-key-line "\n"))))))

+115

(test "an empty string raises"

+116

(assert-true (raises-with? "must be one base64 line" (lambda () (minisign-parse-public-key ""))))))

+117

+118

(test-group "minisign signature parsing"

+119

(test "ED is prehashed"

+120

(assert-eq 'prehashed (minisign-signature-algorithm (sig "hello.txt.ED.minisig"))))

+121

(test "Ed is legacy"

+122

(assert-eq 'legacy (minisign-signature-algorithm (sig "hello.txt.Ed.minisig"))))

+123

(test "the signature names key a"

+124

(assert-equal (minisign-public-key-id key-a)

+125

(minisign-signature-key-id (sig "hello.txt.ED.minisig"))))

+126

(test "fewer than four lines raise"

+127

(let ((ls (lines-of "hello.txt.ED.minisig")))

+128

(assert-true (raises-with? "fewer than four lines" (lambda () (minisign-parse-signature

+129

(join-lines (list (car ls) (cadr ls) (caddr ls)))))))))

+130

(test "a first line without the untrusted prefix raises"

+131

(let ((ls (lines-of "hello.txt.ED.minisig")))

+132

(assert-true (raises-with? "first line must start with" (lambda () (minisign-parse-signature

+133

(join-lines (with-line ls 0 "comment: x"))))))))

+134

(test "a third line without the trusted prefix raises"

+135

(let ((ls (lines-of "hello.txt.ED.minisig")))

+136

(assert-true (raises-with? "third line must start with" (lambda () (minisign-parse-signature

+137

(join-lines (with-line ls 2 "trusted: x"))))))))

+138

(test "content after the global signature raises"

+139

(assert-true (raises-with? "content after the global signature" (lambda () (minisign-parse-signature

+140

(string-append (fixture-text "hello.txt.ED.minisig")

+141

"extra\n"))))))

+142

(test "a CR inside the trusted comment raises"

+143

(let ((ls (lines-of "hello.txt.ED.minisig")))

+144

(assert-true (raises-with? "trusted comment contains a CR or NUL" (lambda () (minisign-parse-signature

+145

                                         (join-lines (with-line ls 2 (string-append "trusted comment: a" (string #\return) "b")))))))))

+146

(test "an unsupported algorithm raises"

+147

;; "RU" starts the base64 of "ED"; "RV" makes

+148

;; the second byte T, so the algorithm reads "ET".

+149

(let* ((ls (lines-of "hello.txt.ED.minisig"))

+150

(line (cadr ls)))

+151

(assert-true (raises-with? "unsupported signature algorithm" (lambda () (minisign-parse-signature

+152

(join-lines (with-line ls 1 (string-with-char line 1 #\V)))))))))

+153

(test "non-zero base64 pad bits raise"

+154

;; The 74-byte signature ends in one '='; its last data character

+155

;; carries 2 pad bits. Setting them keeps the alphabet valid.

+156

(let* ((ls (lines-of "hello.txt.ED.minisig"))

+157

(line (cadr ls))

+158

(last-data (string-ref line 98))

+159

(bumped (integer->char (+ 1 (char->integer last-data)))))

+160

(assert-true (raises-with? "non-canonical base64 padding" (lambda () (minisign-parse-signature

+161

(join-lines (with-line ls 1 (string-with-char line 98 bumped))))))))))

+162

+163

(test-group "minisign verification: signatures made by minisign"

+164

(test "prehashed ED over a text file"

+165

(assert-equal "sigil-crypto fixture: prehashed"

+166

(minisign-verify key-a (sig "hello.txt.ED.minisig") (fixture "hello.txt"))))

+167

(test "legacy Ed over a text file"

+168

(assert-equal "sigil-crypto fixture: legacy"

+169

(minisign-verify key-a (sig "hello.txt.Ed.minisig") (fixture "hello.txt"))))

+170

(test "prehashed ED over an empty file"

+171

(assert-equal "sigil-crypto fixture: empty file"

+172

(minisign-verify key-a (sig "empty.txt.ED.minisig") (fixture "empty.txt"))))

+173

(test "prehashed ED over every byte value"

+174

(assert-equal "sigil-crypto fixture: binary"

+175

(minisign-verify key-a (sig "binary.bin.ED.minisig") (fixture "binary.bin"))))

+176

(test "legacy Ed over every byte value"

+177

(assert-equal "sigil-crypto fixture: binary legacy"

+178

(minisign-verify key-a (sig "binary.bin.Ed.minisig") (fixture "binary.bin"))))

+179

(test "a UTF-8 trusted comment comes back intact"

+180

(assert-equal "fixture ✓ unicode — trusted"

+181

(minisign-verify key-a (sig "hello.txt.unicode.minisig") (fixture "hello.txt"))))

+182

(test "a string message verifies like its bytes"

+183

(assert-equal "sigil-crypto fixture: prehashed"

+184

(minisign-verify key-a (sig "hello.txt.ED.minisig") "hello, minisign\n")))

+185

(test "a signature file with CRLF line endings verifies"

+186

(let ((crlf (string-join (lines-of "hello.txt.ED.minisig")

+187

(string #\return #\newline))))

+188

(assert-equal "sigil-crypto fixture: prehashed"

+189

(minisign-verify key-a (minisign-parse-signature crlf) (fixture "hello.txt")))))

+190

(test "minisign-verify-prehashed accepts ED"

+191

(assert-equal "sigil-crypto fixture: prehashed"

+192

(minisign-verify-prehashed key-a (sig "hello.txt.ED.minisig") (fixture "hello.txt")))))

+193

+194

(test-group "minisign verification: real published signatures"

+195

(test "production registry.json under the registry root key"

+196

(assert-equal "registry=pkg.usesigil.org path=/v1/meta/registry.json seq=1 ts=2026-07-30T08:04:54Z"

+197

(minisign-verify-prehashed root-key (sig "registry.json.minisig")

+198

(fixture "registry.json"))))

+199

(test "minisign 0.12's source tarball under the minisign author's key"

+200

(assert-true (string? (minisign-verify author-key (sig "minisign-0.12.tar.gz.minisig")

+201

(fixture "minisign-0.12.tar.gz")))))

+202

(test "a one-bit change to registry.json is a bad signature"

+203

(assert-eq 'bad-signature

+204

(minisign-failure-reason root-key (sig "registry.json.minisig")

+205

(flip-byte (fixture "registry.json") 100) #t)))

+206

(test "a one-bit change to the tarball is a bad signature"

+207

(assert-eq 'bad-signature

+208

(minisign-failure-reason author-key (sig "minisign-0.12.tar.gz.minisig")

+209

(flip-byte (fixture "minisign-0.12.tar.gz") 10000) #f)))

+210

(test "registry.json.minisig does not verify under a fixture key"

+211

(assert-eq 'key-id-mismatch

+212

(minisign-failure-reason key-a (sig "registry.json.minisig") (fixture "registry.json") #f))))

+213

+214

(test-group "minisign verification: negatives, each with its reason"

+215

(test "valid control: no failure reason"

+216

(assert-eq #f (minisign-failure-reason key-a (sig "hello.txt.ED.minisig") (fixture "hello.txt") #f)))

+217

(test "tampered message, prehashed"

+218

(assert-eq 'bad-signature

+219

(minisign-failure-reason key-a (sig "hello.txt.ED.minisig") "hello, minisigN\n" #f)))

+220

(test "tampered message, legacy"

+221

(assert-eq 'bad-signature

+222

(minisign-failure-reason key-a (sig "hello.txt.Ed.minisig") "hello, minisigN\n" #f)))

+223

(test "tampered binary message, every 64th byte"

+224

(let loop ((i 0))

+225

(when (< i 1024)

+226

(assert-eq 'bad-signature

+227

(minisign-failure-reason key-a (sig "binary.bin.ED.minisig")

+228

(flip-byte (fixture "binary.bin") i) #f))

+229

(loop (+ i 64)))))

+230

(test "a message with one extra byte"

+231

(assert-eq 'bad-signature

+232

(minisign-failure-reason key-a (sig "hello.txt.ED.minisig") "hello, minisign\n\n" #f)))

+233

(test "the right signature for a different file"

+234

(assert-eq 'bad-signature

+235

(minisign-failure-reason key-a (sig "empty.txt.ED.minisig") (fixture "hello.txt") #f)))

+236

(test "tampered trusted comment"

+237

(let ((ls (lines-of "hello.txt.ED.minisig")))

+238

(assert-eq 'bad-trusted-comment-signature

+239

(minisign-failure-reason key-a

+240

(minisign-parse-signature

+241

(join-lines (with-line ls 2 "trusted comment: sigil-crypto fixture: prehashed!")))

+242

(fixture "hello.txt") #f))))

+243

(test "a trusted comment moved from another valid signature"

+244

;; Both signatures are genuine; splicing one's comment onto the other

+245

;; must fail the global signature.

+246

(let ((ls (lines-of "hello.txt.ED.minisig"))

+247

(other (lines-of "empty.txt.ED.minisig")))

+248

(assert-eq 'bad-trusted-comment-signature

+249

(minisign-failure-reason key-a

+250

(minisign-parse-signature

+251

(join-lines (with-line (with-line ls 2 (caddr other)) 3 (nth other 3))))

+252

(fixture "hello.txt") #f))))

+253

(test "tampered signature bytes"

+254

(let* ((ls (lines-of "hello.txt.ED.minisig"))

+255

(line (cadr ls)))

+256

(assert-eq 'bad-signature

+257

(minisign-failure-reason key-a

+258

(minisign-parse-signature

+259

                                   (join-lines (with-line ls 1 (string-with-char line 50 (other-b64-char (string-ref line 50))))))

+260

(fixture "hello.txt") #f))))

+261

(test "tampered global signature bytes"

+262

(let* ((ls (lines-of "hello.txt.ED.minisig"))

+263

(line (nth ls 3)))

+264

(assert-eq 'bad-trusted-comment-signature

+265

(minisign-failure-reason key-a

+266

(minisign-parse-signature

+267

                                   (join-lines (with-line ls 3 (string-with-char line 40 (other-b64-char (string-ref line 40))))))

+268

(fixture "hello.txt") #f))))

+269

(test "a signature by key b checked with key a"

+270

(assert-eq 'key-id-mismatch

+271

(minisign-failure-reason key-a (sig "hello.txt.keyb.minisig") (fixture "hello.txt") #f)))

+272

(test "key b's signature relabelled with key a's id is still refused"

+273

;; The key id is not authentication: with the id matching, the

+274

;; Ed25519 check is what rejects it.

+275

(let* ((ls (lines-of "hello.txt.keyb.minisig"))

+276

(a-id (bytevector-copy (base64-decode (cadr (lines-of "hello.txt.ED.minisig"))) 2 10))

+277

(relabelled (resign-line (cadr ls) 2 a-id)))

+278

(assert-eq 'bad-signature

+279

(minisign-failure-reason key-a

+280

(minisign-parse-signature (join-lines (with-line ls 1 relabelled)))

+281

(fixture "hello.txt") #f))))

+282

(test "legacy refused when prehashed is required"

+283

(assert-eq 'legacy-refused

+284

(minisign-failure-reason key-a (sig "hello.txt.Ed.minisig") (fixture "hello.txt") #t)))

+285

(test "minisign-verify-prehashed returns #f for a valid legacy signature"

+286

(assert-false (minisign-verify-prehashed key-a (sig "hello.txt.Ed.minisig") (fixture "hello.txt"))))

+287

(test "a legacy signature relabelled as prehashed fails"

+288

;; Changing Ed to ED makes the verifier hash first, so the same

+289

;; Ed25519 signature no longer matches: the algorithm is bound.

+290

(let* ((ls (lines-of "hello.txt.Ed.minisig"))

+291

(relabelled (resign-line (cadr ls) 0 (bytevector 69 68))))

+292

(assert-eq 'bad-signature

+293

(minisign-failure-reason key-a

+294

(minisign-parse-signature (join-lines (with-line ls 1 relabelled)))

+295

(fixture "hello.txt") #f))))

+296

(test "minisign-verify returns #f, not a comment, on failure"

+297

(assert-false (minisign-verify key-a (sig "hello.txt.ED.minisig") "tampered"))))

+298

+299

(test-group "minisign argument checking"

+300

(test "minisign-failure-reason refuses an unparsed key"

+301

    (assert-true (raises-with? "not a parsed public key" (lambda () (minisign-failure-reason root-key-line (sig "hello.txt.ED.minisig") "x" #f)))))

+302

(test "minisign-failure-reason refuses an unparsed signature"

+303

    (assert-true (raises-with? "not a parsed signature" (lambda () (minisign-failure-reason key-a (fixture-text "hello.txt.ED.minisig") "x" #f))))))

test/vectors/ed25519-cases.txtadded

@@ -0,0 +1,168 @@

rfc8032-1 d75a980182b10ab7d54bfed3c964073a0ee172f3daa62325af021a68f707511a e5564300c360ac729086e2cc806e828a84877f1eb8e5d974d873e065224901555fb8821590a33bacc61e39701cf9b46bd25bf5f0595bbe24655141438e7a100b - valid

rfc8032-2 3d4017c3e843895a92b70aa74d1b7ebc9c982ccf2ec4968cc0cd55f12af4660c 92a009a9f0d4cab8720e820b5f642540a2b27b5416503f8fb3762223ebdb69da085ac1e43e15996e458f3613d0f11d8c387b2eaeb4302aeeb00d291612bb0c00 72 valid

rfc8032-3 fc51cd8e6218a1a38da47ed00230f0580816ed13ba3303ac5deb911548908025 6291d657deec24024827e69c3abe01a30ce548a284743a445e3680d7db5ac3ac18ff9b538d16f290ae67f760984dc6594a7c15e9716ed28dc027beceea1ec40a af82 valid

rfc8032-1024 278117fc144c72340f67d0f2316e8386ceffbf2b2428c9c51fef7c597f1d426e 0aab4c900501b3e24d7cdf4663326a3a87df5e4843b2cbdb67cbf6e460fec350aa5371b1508f9f4528ecea23c436d94b5e8fcd4f681e30a6ac00a9704a188a03 08b8b2b733424243760fe426a4b54908632110a66c2f6591eabd3345e3e4eb98fa6e264bf09efe12ee50f8f54e9f77b1e355f6c50544e23fb1433ddf73be84d879de7c0046dc4996d9e773f4bc9efe5738829adb26c81b37c93a1b270b20329d658675fc6ea534e0810a4432826bf58c941efb65d57a338bbd2e26640f89ffbc1a858efcb8550ee3a5e1998bd177e93a7363c344fe6b199ee5d02e82d522c4feba15452f80288a821a579116ec6dad2b3b310da903401aa62100ab5d1a36553e06203b33890cc9b832f79ef80560ccb9a39ce767967ed628c6ad573cb116dbefefd75499da96bd68a8a97b928a8bbc103b6621fcde2beca1231d206be6cd9ec7aff6f6c94fcd7204ed3455c68c83f4a41da4af2b74ef5c53f1d8ac70bdcb7ed185ce81bd84359d44254d95629e9855a94a7c1958d1f8ada5d0532ed8a5aa3fb2d17ba70eb6248e594e1a2297acbbb39d502f1a8c6eb6f1ce22b3de1a1f40cc24554119a831a9aad6079cad88425de6bde1a9187ebb6092cf67bf2b13fd65f27088d78b7e883c8759d2c4f5c65adb7553878ad575f9fad878e80a0c9ba63bcbcc2732e69485bbc9c90bfbd62481d9089beccf80cfe2df16a2cf65bd92dd597b0707e0917af48bbb75fed413d238f5555a7a569d80c3414a8d0859dc65a46128bab27af87a71314f318c782b23ebfe808b82b0ce26401d2e22f04d83d1255dc51addd3b75a2b1ae0784504df543af8969be3ea7082ff7fc9888c144da2af58429ec96031dbcad3dad9af0dcbaaaf268cb8fcffead94f3c7ca495e056a9b47acdb751fb73e666c6c655ade8297297d07ad1ba5e43f1bca32301651339e22904cc8c42f58c30c04aafdb038dda0847dd988dcda6f3bfd15c4b4c4525004aa06eeff8ca61783aacec57fb3d1f92b0fe2fd1a85f6724517b65e614ad6808d6f6ee34dff7310fdc82aebfd904b01e1dc54b2927094b2db68d6f903b68401adebf5a7e08d78ff4ef5d63653a65040cf9bfd4aca7984a74d37145986780fc0b16ac451649de6188a7dbdf191f64b5fc5e2ab47b57f7f7276cd419c17a3ca8e1b939ae49e488acba6b965610b5480109c8b17b80e1b7b750dfc7598d5d5011fd2dcc5600a32ef5b52a1ecc820e308aa342721aac0943bf6686b64b2579376504ccc493d97e6aed3fb0f9cd71a43dd497f01f17c0e2cb3797aa2a2f256656168e6c496afc5fb93246f6b1116398a346f1a641f3b041e989f7914f90cc2c7fff357876e506b50d334ba77c225bc307ba537152f3f1610e4eafe595f6d9d90d11faa933a15ef1369546868a7f3a45a96768d40fd9d03412c091c6315cf4fde7cb68606937380db2eaaa707b4c4185c32eddcdd306705e4dc1ffc872eeee475a64dfac86aba41c0618983f8741c5ef68d3a101e8a3b8cac60c905c15fc910840b94c00a0b9d0 valid

rfc8032-SHAabc ec172b93ad5e563bf4932c70e1245034c35467ef2efd4d64ebf819683467e2bf dc2a4459e7369633a52b1bf277839a00201009a3efbf3ecb69bea2186c26b58909351fc9ac90b3ecfdfbc7c66431e0303dca179c138ac17ad9bef1177331a704 ddaf35a193617abacc417349ae20413112e6fa4e89a97ea20a9eeee64b55d39a2192992a274fc1a836ba3c23a3feebbd454d4423643ce80e2a9ac94fa54ca49f valid

wycheproof-1 7d4d0e7f6153a69b6242b522abbee685fda4420f8834b108c3bdae369ef549fa d4fbdb52bfa726b44d1786a8c0d171c3e62ca83c9e5bbe63de0bb2483f8fd6cc1429ab72cafc41ab56af02ff8fcc43b99bfe4c7ae940f60f38ebaa9d311c4007 - valid

wycheproof-2 7d4d0e7f6153a69b6242b522abbee685fda4420f8834b108c3bdae369ef549fa d80737358ede548acb173ef7e0399f83392fe8125b2ce877de7975d8b726ef5b1e76632280ee38afad12125ea44b961bf92f1178c9fa819d020869975bcbe109 78 valid

wycheproof-3 7d4d0e7f6153a69b6242b522abbee685fda4420f8834b108c3bdae369ef549fa 7c38e026f29e14aabd059a0f2db8b0cd783040609a8be684db12f82a27774ab07a9155711ecfaf7f99f277bad0c6ae7e39d4eef676573336a5c51eb6f946b30d 54657374 valid

wycheproof-4 7d4d0e7f6153a69b6242b522abbee685fda4420f8834b108c3bdae369ef549fa 1c1ad976cbaae3b31dee07971cf92c928ce2091a85f5899f5e11ecec90fc9f8e93df18c5037ec9b29c07195ad284e63d548cd0a6fe358cc775bd6c1608d2c905 48656c6c6f valid

+10

wycheproof-5 7d4d0e7f6153a69b6242b522abbee685fda4420f8834b108c3bdae369ef549fa 657c1492402ab5ce03e2c3a7f0384d051b9cf3570f1207fc78c1bcc98c281c2bf0cf5b3a289976458a1be6277a5055545253b45b07dcc1abd96c8b989c00f301 313233343030 valid

+11

wycheproof-6 7d4d0e7f6153a69b6242b522abbee685fda4420f8834b108c3bdae369ef549fa d46543bfb892f84ec124dcdfc847034c19363bf3fc2fa89b1267833a14856e52e60736918783f950b6f1dd8d40dc343247cd43ce054c2d68ef974f7ed0f3c60f 000000000000000000000000 valid

+12

wycheproof-7 7d4d0e7f6153a69b6242b522abbee685fda4420f8834b108c3bdae369ef549fa 879350045543bc14ed2c08939b68c30d22251d83e018cacbaf0c9d7a48db577e80bdf76ce99e5926762bc13b7b3483260a5ef63d07e34b58eb9c14621ac92f00 6161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161 valid

+13

wycheproof-8 7d4d0e7f6153a69b6242b522abbee685fda4420f8834b108c3bdae369ef549fa 7bdc3f9919a05f1d5db4a3ada896094f6871c1f37afc75db82ec3147d84d6f237b7e5ecc26b59cfea0c7eaf1052dc427b0f724615be9c3d3e01356c65b9b5109 202122232425262728292a2b2c2d2e2f303132333435363738393a3b3c3d3e3f404142434445464748494a4b4c4d4e4f505152535455565758595a5b5c5d5e5f60 valid

+14

wycheproof-9 7d4d0e7f6153a69b6242b522abbee685fda4420f8834b108c3bdae369ef549fa 5dbd7360e55aa38e855d6ad48c34bd35b7871628508906861a7c4776765ed7d1e13d910faabd689ec8618b78295c8ab8f0e19c8b4b43eb8685778499e943ae04 ffffffffffffffffffffffffffffffff valid

+15

wycheproof-10 7d4d0e7f6153a69b6242b522abbee685fda4420f8834b108c3bdae369ef549fa 00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 3f invalid

+16

wycheproof-11 7d4d0e7f6153a69b6242b522abbee685fda4420f8834b108c3bdae369ef549fa 00000000000000000000000000000000000000000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000 3f invalid

+17

wycheproof-12 7d4d0e7f6153a69b6242b522abbee685fda4420f8834b108c3bdae369ef549fa 0000000000000000000000000000000000000000000000000000000000000000ecd3f55c1a631258d69cf7a2def9de1400000000000000000000000000000010 3f invalid

+18

wycheproof-13 7d4d0e7f6153a69b6242b522abbee685fda4420f8834b108c3bdae369ef549fa 0000000000000000000000000000000000000000000000000000000000000000edd3f55c1a631258d69cf7a2def9de1400000000000000000000000000000010 3f invalid

+19

wycheproof-14 7d4d0e7f6153a69b6242b522abbee685fda4420f8834b108c3bdae369ef549fa 0000000000000000000000000000000000000000000000000000000000000000edffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff7f 3f invalid

+20

wycheproof-15 7d4d0e7f6153a69b6242b522abbee685fda4420f8834b108c3bdae369ef549fa 01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 3f invalid

+21

wycheproof-16 7d4d0e7f6153a69b6242b522abbee685fda4420f8834b108c3bdae369ef549fa 01000000000000000000000000000000000000000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000 3f invalid

+22

wycheproof-17 7d4d0e7f6153a69b6242b522abbee685fda4420f8834b108c3bdae369ef549fa 0100000000000000000000000000000000000000000000000000000000000000ecd3f55c1a631258d69cf7a2def9de1400000000000000000000000000000010 3f invalid

+23

wycheproof-18 7d4d0e7f6153a69b6242b522abbee685fda4420f8834b108c3bdae369ef549fa 0100000000000000000000000000000000000000000000000000000000000000edd3f55c1a631258d69cf7a2def9de1400000000000000000000000000000010 3f invalid

+24

wycheproof-19 7d4d0e7f6153a69b6242b522abbee685fda4420f8834b108c3bdae369ef549fa 0100000000000000000000000000000000000000000000000000000000000000edffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff7f 3f invalid

+25

wycheproof-20 7d4d0e7f6153a69b6242b522abbee685fda4420f8834b108c3bdae369ef549fa edd3f55c1a631258d69cf7a2def9de14000000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000000 3f invalid

+26

wycheproof-21 7d4d0e7f6153a69b6242b522abbee685fda4420f8834b108c3bdae369ef549fa edd3f55c1a631258d69cf7a2def9de14000000000000000000000000000000100100000000000000000000000000000000000000000000000000000000000000 3f invalid

+27

wycheproof-22 7d4d0e7f6153a69b6242b522abbee685fda4420f8834b108c3bdae369ef549fa edd3f55c1a631258d69cf7a2def9de1400000000000000000000000000000010ecd3f55c1a631258d69cf7a2def9de1400000000000000000000000000000010 3f invalid

+28

wycheproof-23 7d4d0e7f6153a69b6242b522abbee685fda4420f8834b108c3bdae369ef549fa edd3f55c1a631258d69cf7a2def9de1400000000000000000000000000000010edd3f55c1a631258d69cf7a2def9de1400000000000000000000000000000010 3f invalid

+29

wycheproof-24 7d4d0e7f6153a69b6242b522abbee685fda4420f8834b108c3bdae369ef549fa edd3f55c1a631258d69cf7a2def9de1400000000000000000000000000000010edffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff7f 3f invalid

+30

wycheproof-25 7d4d0e7f6153a69b6242b522abbee685fda4420f8834b108c3bdae369ef549fa edffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff7f0000000000000000000000000000000000000000000000000000000000000000 3f invalid

+31

wycheproof-26 7d4d0e7f6153a69b6242b522abbee685fda4420f8834b108c3bdae369ef549fa edffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff7f0100000000000000000000000000000000000000000000000000000000000000 3f invalid

+32

wycheproof-27 7d4d0e7f6153a69b6242b522abbee685fda4420f8834b108c3bdae369ef549fa edffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff7fecd3f55c1a631258d69cf7a2def9de1400000000000000000000000000000010 3f invalid

+33

wycheproof-28 7d4d0e7f6153a69b6242b522abbee685fda4420f8834b108c3bdae369ef549fa edffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff7fedd3f55c1a631258d69cf7a2def9de1400000000000000000000000000000010 3f invalid

+34

wycheproof-29 7d4d0e7f6153a69b6242b522abbee685fda4420f8834b108c3bdae369ef549fa edffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff7fedffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff7f 3f invalid

+35

wycheproof-30 7d4d0e7f6153a69b6242b522abbee685fda4420f8834b108c3bdae369ef549fa 54657374 invalid

+36

wycheproof-31 7d4d0e7f6153a69b6242b522abbee685fda4420f8834b108c3bdae369ef549fa 7c38e026f29e14aabd059a0f2db8b0cd783040609a8be684db12f82a27774ab0 54657374 invalid

+37

wycheproof-32 7d4d0e7f6153a69b6242b522abbee685fda4420f8834b108c3bdae369ef549fa 7c38e026f29e14aabd059a0f2db8b0cd783040609a8be684db12f82a27774ab07a9155711ecfaf7f99f277bad0c6ae7e39d4eef676573336a5c51eb6f946 54657374 invalid

+38

wycheproof-33 7d4d0e7f6153a69b6242b522abbee685fda4420f8834b108c3bdae369ef549fa 7c38e026f29e14aabd059a0f2db8b0cd783040609a8be684db12f82a27774ab07a9155711ecfaf7f99f277bad0c6ae7e39d4eef676573336a5c51eb6f946b30d2020 54657374 invalid

+39

wycheproof-34 7d4d0e7f6153a69b6242b522abbee685fda4420f8834b108c3bdae369ef549fa 7c38e026f29e14aabd059a0f2db8b0cd783040609a8be684db12f82a27774ab07a9155711ecfaf7f99f277bad0c6ae7e39d4eef676573336a5c51eb6f946b30d7d4d0e7f6153a69b6242b522abbee685fda4420f8834b108c3bdae369ef549fa 54657374 invalid

+40

wycheproof-35 7d4d0e7f6153a69b6242b522abbee685fda4420f8834b108c3bdae369ef549fa 007c38e026f29e14aabd059a0f2db8b0cd783040609a8be684db12f82a27774ab07a9155711ecfaf7f99f277bad0c6ae7e39d4eef676573336a5c51eb6f946b30d 54657374 invalid

+41

wycheproof-36 7d4d0e7f6153a69b6242b522abbee685fda4420f8834b108c3bdae369ef549fa 7c38e026f29e14aabd059a0f2db8b0cd783040609a8be684db12f82a27774ab0007a9155711ecfaf7f99f277bad0c6ae7e39d4eef676573336a5c51eb6f946b30d 54657374 invalid

+42

wycheproof-37 7d4d0e7f6153a69b6242b522abbee685fda4420f8834b108c3bdae369ef549fa 7c38e026f29e14aabd059a0f2db8b0cd783040609a8be684db12f82a27774ab07a9155711ecfaf7f99f277bad0c6ae7e39d4eef676573336a5c51eb6f946b30d00 54657374 invalid

+43

wycheproof-38 7d4d0e7f6153a69b6242b522abbee685fda4420f8834b108c3bdae369ef549fa 93de3ca252426c95f735cb9edd92e83321ac62372d5aa5b379786bae111ab6b17251330e8f9a7c30d6993137c596007d7b001409287535ac4804e662bc58a3 546573743137 invalid

+44

wycheproof-39 7d4d0e7f6153a69b6242b522abbee685fda4420f8834b108c3bdae369ef549fa dffed33a7f420b62bb1731cfd03be805affd18a281ec02b1067ba6e9d20826569e742347df59c88ae96db1f1969fb189b0ec34381d85633e1889da48d95e0e 54657374313236 invalid

+45

wycheproof-40 7d4d0e7f6153a69b6242b522abbee685fda4420f8834b108c3bdae369ef549fa 6e170c719577c25e0e1e8b8aa7a6346f8b109f37385cc2e85dc3b4c0f46a9c6bcafd67f52324c5dbaf40a1b673fb29c4a56052d2d6999d0838a8337bccb502 546573743530 invalid

+46

wycheproof-41 7d4d0e7f6153a69b6242b522abbee685fda4420f8834b108c3bdae369ef549fa b0928b46e99fbbad3f5cb502d2cd309d94a7e86cfd4d84b1fcf4cea18075a9c36993c0582dba1e9e519fae5a8654f454201ae0c3cb397c37b8f4f8eef18400 54657374333437 invalid

+47

wycheproof-42 7d4d0e7f6153a69b6242b522abbee685fda4420f8834b108c3bdae369ef549fa 647c1492402ab5ce03e2c3a7f0384d051b9cf3570f1207fc78c1bcc98c281c2b1d125e5538f38afbcc1c84e489521083041d24bc6240767029da063271a1ff0c 313233343030 invalid

+48

wycheproof-43 7d4d0e7f6153a69b6242b522abbee685fda4420f8834b108c3bdae369ef549fa 677c1492402ab5ce03e2c3a7f0384d051b9cf3570f1207fc78c1bcc98c281c2bc108ca4b87a49c9ed2cf383aecad8f54a962b2899da891e12004d7993a627e01 313233343030 invalid

+49

wycheproof-44 7d4d0e7f6153a69b6242b522abbee685fda4420f8834b108c3bdae369ef549fa 617c1492402ab5ce03e2c3a7f0384d051b9cf3570f1207fc78c1bcc98c281c2b9ce23fc6213ed5b87912e9bbf92f5e2c780eae26d15c50a112d1e97d2ea33c06 313233343030 invalid

+50

wycheproof-45 7d4d0e7f6153a69b6242b522abbee685fda4420f8834b108c3bdae369ef549fa e57c1492402ab5ce03e2c3a7f0384d051b9cf3570f1207fc78c1bcc98c281c2bbb3eb51cd98dddb235a5f46f2bded6af184a58d09cce928bda43f41d69118a03 313233343030 invalid

+51

wycheproof-46 7d4d0e7f6153a69b6242b522abbee685fda4420f8834b108c3bdae369ef549fa 657d1492402ab5ce03e2c3a7f0384d051b9cf3570f1207fc78c1bcc98c281c2bcd237dda9a116501f67a5705a854b9adc304f34720803a91b324f2c13e0f5a09 313233343030 invalid

+52

wycheproof-47 7d4d0e7f6153a69b6242b522abbee685fda4420f8834b108c3bdae369ef549fa 657c1592402ab5ce03e2c3a7f0384d051b9cf3570f1207fc78c1bcc98c281c2b6b167bbdc0d881cc04d28905552c1876f3709851abc5007376940cc8a435c300 313233343030 invalid

+53

wycheproof-48 7d4d0e7f6153a69b6242b522abbee685fda4420f8834b108c3bdae369ef549fa 657c1412402ab5ce03e2c3a7f0384d051b9cf3570f1207fc78c1bcc98c281c2b7fd2ac7da14afffcceeb13f2a0d6b887941cb1a5eb57a52f3cb131a16cce7b0e 313233343030 invalid

+54

wycheproof-49 7d4d0e7f6153a69b6242b522abbee685fda4420f8834b108c3bdae369ef549fa 657c1492412ab5ce03e2c3a7f0384d051b9cf3570f1207fc78c1bcc98c281c2b7373ba13ebbef99cd2a8ead55ce735c987d85a35320925a8e871702dc7c5c40d 313233343030 invalid

+55

wycheproof-50 7d4d0e7f6153a69b6242b522abbee685fda4420f8834b108c3bdae369ef549fa 657c1492402ab54e03e2c3a7f0384d051b9cf3570f1207fc78c1bcc98c281c2bd35bd331c03f0855504ca1cab87b83c36a028425a3cf007ede4f4254c261cb00 313233343030 invalid

+56

wycheproof-51 7d4d0e7f6153a69b6242b522abbee685fda4420f8834b108c3bdae369ef549fa 657c1492402ab5ce02e2c3a7f0384d051b9cf3570f1207fc78c1bcc98c281c2bcb35101f73cf467deac8c1a03b6c3dc35af544132734b7e57ab20c89b2e4750d 313233343030 invalid

+57

wycheproof-52 7d4d0e7f6153a69b6242b522abbee685fda4420f8834b108c3bdae369ef549fa 657c1492402ab5ce03e2c3a7f2384d051b9cf3570f1207fc78c1bcc98c281c2bb58d2e8878290bff8d3355fdd4ea381924ee578752354eb6dee678ab4011c301 313233343030 invalid

+58

wycheproof-53 7d4d0e7f6153a69b6242b522abbee685fda4420f8834b108c3bdae369ef549fa 657c1492402ab5ce03e2c3a7f0384d851b9cf3570f1207fc78c1bcc98c281c2bb978c866187ffb1cc7b29a0b4045aefc08768df65717194ff0c6e63f4dea0d02 313233343030 invalid

+59

wycheproof-54 7d4d0e7f6153a69b6242b522abbee685fda4420f8834b108c3bdae369ef549fa 657c1492402ab5ce03e2c3a7f0384d051b9cf3570f1207fc78c1bcc98c281d2b0576ecf8eaf675f00f3dfbe19f75b83b7607a6c96414f6821af920a2498d0305 313233343030 invalid

+60

wycheproof-55 7d4d0e7f6153a69b6242b522abbee685fda4420f8834b108c3bdae369ef549fa 657c1492402ab5ce03e2c3a7f0384d051b9cf3570f1207fc78c1bcc98c289c2be5241a345c7b5428054c74b7c382fa10d4a5f1e8f8b79a71d3fdea2254f1ff0e 313233343030 invalid

+61

wycheproof-56 7d4d0e7f6153a69b6242b522abbee685fda4420f8834b108c3bdae369ef549fa 657c1492402ab5ce03e2c3a7f0384d051b9cf3570f1207fc78c1bcc98c281c2a63950c85cd6dc96364e768de50ff7732b538f8a0b1615d799190ab600849230e 313233343030 invalid

+62

wycheproof-57 7d4d0e7f6153a69b6242b522abbee685fda4420f8834b108c3bdae369ef549fa 657c1492402ab5ce03e2c3a7f0384d051b9cf3570f1207fc78c1bcc98c281c0b543bd3da0a56a8c9c152f59c9fec12f31fa66434d48b817b30d90cb4efa8b501 313233343030 invalid

+63

wycheproof-58 7d4d0e7f6153a69b6242b522abbee685fda4420f8834b108c3bdae369ef549fa 657c1492402ab5ce03e2c3a7f0384d051b9cf3570f1207fc78c1bcc98c281c6b8da07efd07a6dafb015ed6a32fe136319a972ffbc341f3a0beae97ccf8136505 313233343030 invalid

+64

wycheproof-59 7d4d0e7f6153a69b6242b522abbee685fda4420f8834b108c3bdae369ef549fa 657c1492402ab5ce03e2c3a7f0384d051b9cf3570f1207fc78c1bcc98c281cab227aedf259f910f0f3a759a335062665217925d019173b88917eae294f75d40f 313233343030 invalid

+65

wycheproof-60 7d4d0e7f6153a69b6242b522abbee685fda4420f8834b108c3bdae369ef549fa 0000000000000000000000000000000000000000000000000000000000000000e0b8e7770d51c7a36375d006c5bffd6af43ff54aaf47e4330dc118c71d61ec02 313233343030 invalid

+66

wycheproof-61 7d4d0e7f6153a69b6242b522abbee685fda4420f8834b108c3bdae369ef549fa ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff463a1908382e7eb7693acef9884f7cf931a215e0791876be22c631a59881fd0e 313233343030 invalid

+67

wycheproof-62 7d4d0e7f6153a69b6242b522abbee685fda4420f8834b108c3bdae369ef549fa 9a83eb6dbfd54a31fc1d3c580fc7b2fae4630ca8f0edf803873e433673d7e3d40e94254586cb6188c5386c3febed477cb9a6cb29e3979adc4cb27cf5278fb70a 313233343030 invalid

+68

wycheproof-63 7d4d0e7f6153a69b6242b522abbee685fda4420f8834b108c3bdae369ef549fa 7c38e026f29e14aabd059a0f2db8b0cd783040609a8be684db12f82a27774ab067654bce3832c2d76f8f6f5dafc08d9339d4eef676573336a5c51eb6f946b31d 54657374 invalid

+69

wycheproof-64 7d4d0e7f6153a69b6242b522abbee685fda4420f8834b108c3bdae369ef549fa 7c38e026f29e14aabd059a0f2db8b0cd783040609a8be684db12f82a27774ab05439412b5395d42f462c67008eba6ca839d4eef676573336a5c51eb6f946b32d 54657374 invalid

+70

wycheproof-65 7d4d0e7f6153a69b6242b522abbee685fda4420f8834b108c3bdae369ef549fa 7c38e026f29e14aabd059a0f2db8b0cd783040609a8be684db12f82a27774ab02ee12ce5875bf9dff26556464bae2ad239d4eef676573336a5c51eb6f946b34d 54657374 invalid

+71

wycheproof-66 7d4d0e7f6153a69b6242b522abbee685fda4420f8834b108c3bdae369ef549fa 7c38e026f29e14aabd059a0f2db8b0cd783040609a8be684db12f82a27774ab0e2300459f1e742404cd934d2c595a6253ad4eef676573336a5c51eb6f946b38d 54657374 invalid

+72

wycheproof-67 7d4d0e7f6153a69b6242b522abbee685fda4420f8834b108c3bdae369ef549fa 7c38e026f29e14aabd059a0f2db8b0cd783040609a8be684db12f82a27774ab07a9155711ecfaf7f99f277bad0c6ae7e39d4eef676573336a5c51eb6f946b32d 54657374 invalid

+73

wycheproof-68 7d4d0e7f6153a69b6242b522abbee685fda4420f8834b108c3bdae369ef549fa 7c38e026f29e14aabd059a0f2db8b0cd783040609a8be684db12f82a27774ab07a9155711ecfaf7f99f277bad0c6ae7e39d4eef676573336a5c51eb6f946b34d 54657374 invalid

+74

wycheproof-69 7d4d0e7f6153a69b6242b522abbee685fda4420f8834b108c3bdae369ef549fa 7c38e026f29e14aabd059a0f2db8b0cd783040609a8be684db12f82a27774ab07a9155711ecfaf7f99f277bad0c6ae7e39d4eef676573336a5c51eb6f946b38d 54657374 invalid

+75

wycheproof-70 7d4d0e7f6153a69b6242b522abbee685fda4420f8834b108c3bdae369ef549fa 7c38e026f29e14aabd059a0f2db8b0cd783040609a8be684db12f82a27774ab0679155711ecfaf7f99f277bad0c6ae7e39d4eef676573336a5c51eb6f946b38d 54657374 invalid

+76

wycheproof-71 a12c2beb77265f2aac953b5009349d94155a03ada416aad451319480e983ca4c 5056325d2ab440bf30bbf0f7173199aa8b4e6fbc091cf3eb6bc6cf87cd73d992ffc216c85e4ab5b8a0bbc7e9a6e9f8d33b7f6e5ac0ffdc22d9fcaf784af84302 - valid

+77

wycheproof-72 a12c2beb77265f2aac953b5009349d94155a03ada416aad451319480e983ca4c 481fafbf4364d7b682475282f517a3ac0538c9a6b6a562e99a3d8e5afb4f90a559b056b9f07af023905753b02d95eb329a35c77f154b79abbcd291615ce42f02 78 valid

+78

wycheproof-73 a12c2beb77265f2aac953b5009349d94155a03ada416aad451319480e983ca4c 8a9bb4c465a3863abc9fd0dd35d80bb28f7d33d37d74679802d63f82b20da114b8d765a1206b3e9ad7cf2b2d8d778bb8651f1fa992db293c0039eacb6161480f 54657374 valid

+79

wycheproof-74 a12c2beb77265f2aac953b5009349d94155a03ada416aad451319480e983ca4c d839c20abfda1fd429531831c64f813f84b913e9928540310cf060b44c3dbf9457d44a7721fdc0d67724ff81cb450dd39b10cfb65db15dda4b8bf09d26bd3801 48656c6c6f valid

+80

wycheproof-75 a12c2beb77265f2aac953b5009349d94155a03ada416aad451319480e983ca4c 9bbb1052dcfa8ad2715c2eb716ae4f1902dea353d42ee09fd4c0b4fcb8b52b5219e2200016e1199d0061891c263e31b0bc3b55673c19610c4e0fa5408004160b 313233343030 valid

+81

wycheproof-76 a12c2beb77265f2aac953b5009349d94155a03ada416aad451319480e983ca4c f63b5c0667c7897fc283296416f7f60e84bbde9cbd832e56be463ed9f568069702b17a2f7c341ebf590706a6388ac76ac613c1675ec0f2c7118f2573422a500b 000000000000000000000000 valid

+82

wycheproof-77 a12c2beb77265f2aac953b5009349d94155a03ada416aad451319480e983ca4c 1bc44d7001e6b5b9090fef34b2ca480f9786bbefa7d279353e5881e8dfb91b803ccd46500e270ef0109bfd741037558832120bc2a4f20fbe7b5fb3c3aaf23e08 6161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161 valid

+83

wycheproof-78 a12c2beb77265f2aac953b5009349d94155a03ada416aad451319480e983ca4c ea8e22143b02372e76e99aece3ed36aec529768a27e2bb49bdc135d44378061e1f62d1ac518f33ebf37b2ee8cc6dde68a4bd7d4a2f4d6cb77f015f71ca9fc30d 202122232425262728292a2b2c2d2e2f303132333435363738393a3b3c3d3e3f404142434445464748494a4b4c4d4e4f505152535455565758595a5b5c5d5e5f60 valid

+84

wycheproof-79 a12c2beb77265f2aac953b5009349d94155a03ada416aad451319480e983ca4c 8acd679e1a914fc45d5fa83d3021f0509c805c8d271df54e52f43cfbd00cb6222bf81d58fe1de2de378df67ee9f453786626961fe50a9b05f12b6f0899ebdd0a ffffffffffffffffffffffffffffffff valid

+85

wycheproof-80 d75a980182b10ab7d54bfed3c964073a0ee172f3daa62325af021a68f707511a e5564300c360ac729086e2cc806e828a84877f1eb8e5d974d873e065224901555fb8821590a33bacc61e39701cf9b46bd25bf5f0595bbe24655141438e7a100b - valid

+86

wycheproof-81 3d4017c3e843895a92b70aa74d1b7ebc9c982ccf2ec4968cc0cd55f12af4660c 92a009a9f0d4cab8720e820b5f642540a2b27b5416503f8fb3762223ebdb69da085ac1e43e15996e458f3613d0f11d8c387b2eaeb4302aeeb00d291612bb0c00 72 valid

+87

wycheproof-82 fc51cd8e6218a1a38da47ed00230f0580816ed13ba3303ac5deb911548908025 6291d657deec24024827e69c3abe01a30ce548a284743a445e3680d7db5ac3ac18ff9b538d16f290ae67f760984dc6594a7c15e9716ed28dc027beceea1ec40a af82 valid

+88

wycheproof-83 278117fc144c72340f67d0f2316e8386ceffbf2b2428c9c51fef7c597f1d426e 0aab4c900501b3e24d7cdf4663326a3a87df5e4843b2cbdb67cbf6e460fec350aa5371b1508f9f4528ecea23c436d94b5e8fcd4f681e30a6ac00a9704a188a03 08b8b2b733424243760fe426a4b54908632110a66c2f6591eabd3345e3e4eb98fa6e264bf09efe12ee50f8f54e9f77b1e355f6c50544e23fb1433ddf73be84d879de7c0046dc4996d9e773f4bc9efe5738829adb26c81b37c93a1b270b20329d658675fc6ea534e0810a4432826bf58c941efb65d57a338bbd2e26640f89ffbc1a858efcb8550ee3a5e1998bd177e93a7363c344fe6b199ee5d02e82d522c4feba15452f80288a821a579116ec6dad2b3b310da903401aa62100ab5d1a36553e06203b33890cc9b832f79ef80560ccb9a39ce767967ed628c6ad573cb116dbefefd75499da96bd68a8a97b928a8bbc103b6621fcde2beca1231d206be6cd9ec7aff6f6c94fcd7204ed3455c68c83f4a41da4af2b74ef5c53f1d8ac70bdcb7ed185ce81bd84359d44254d95629e9855a94a7c1958d1f8ada5d0532ed8a5aa3fb2d17ba70eb6248e594e1a2297acbbb39d502f1a8c6eb6f1ce22b3de1a1f40cc24554119a831a9aad6079cad88425de6bde1a9187ebb6092cf67bf2b13fd65f27088d78b7e883c8759d2c4f5c65adb7553878ad575f9fad878e80a0c9ba63bcbcc2732e69485bbc9c90bfbd62481d9089beccf80cfe2df16a2cf65bd92dd597b0707e0917af48bbb75fed413d238f5555a7a569d80c3414a8d0859dc65a46128bab27af87a71314f318c782b23ebfe808b82b0ce26401d2e22f04d83d1255dc51addd3b75a2b1ae0784504df543af8969be3ea7082ff7fc9888c144da2af58429ec96031dbcad3dad9af0dcbaaaf268cb8fcffead94f3c7ca495e056a9b47acdb751fb73e666c6c655ade8297297d07ad1ba5e43f1bca32301651339e22904cc8c42f58c30c04aafdb038dda0847dd988dcda6f3bfd15c4b4c4525004aa06eeff8ca61783aacec57fb3d1f92b0fe2fd1a85f6724517b65e614ad6808d6f6ee34dff7310fdc82aebfd904b01e1dc54b2927094b2db68d6f903b68401adebf5a7e08d78ff4ef5d63653a65040cf9bfd4aca7984a74d37145986780fc0b16ac451649de6188a7dbdf191f64b5fc5e2ab47b57f7f7276cd419c17a3ca8e1b939ae49e488acba6b965610b5480109c8b17b80e1b7b750dfc7598d5d5011fd2dcc5600a32ef5b52a1ecc820e308aa342721aac0943bf6686b64b2579376504ccc493d97e6aed3fb0f9cd71a43dd497f01f17c0e2cb3797aa2a2f256656168e6c496afc5fb93246f6b1116398a346f1a641f3b041e989f7914f90cc2c7fff357876e506b50d334ba77c225bc307ba537152f3f1610e4eafe595f6d9d90d11faa933a15ef1369546868a7f3a45a96768d40fd9d03412c091c6315cf4fde7cb68606937380db2eaaa707b4c4185c32eddcdd306705e4dc1ffc872eeee475a64dfac86aba41c0618983f8741c5ef68d3a101e8a3b8cac60c905c15fc910840b94c00a0b9d0 valid

+89

wycheproof-84 100fdf47fb94f1536a4f7c3fda27383fa03375a8f527c537e6f1703c47f94f86 dac119d6ca87fc59ae611c157048f4d4fc932a149dbe20ec6effd1436abf83ea05c7df0fef06147241259113909bc71bd3c53ba4464ffcad3c0968f2ffffff0f 124e583f8b8eca58bb29c271b41d36986bbc45541f8e51f9cb0133eca447601e valid

+90

wycheproof-85 100fdf47fb94f1536a4f7c3fda27383fa03375a8f527c537e6f1703c47f94f86 0971f86d2c9c78582524a103cb9cf949522ae528f8054dc20107d999be673ff4e25ebf2f2928766b1248bec6e91697775f8446639ede46ad4df4053000000010 6a0bc2b0057cedfc0fa2e3f7f7d39279b30f454a69dfd1117c758d86b19d85e0 invalid

+91

wycheproof-86 8fd659b77b558ed93882c1157438450ac86ec62d421d568e98ee236f3810295a 7db17557ac470c0eda4eedaabce99197ab62565653cf911f632ee8be0e5ffcfc88fb94276b42e0798fd3aa2f0318be7fc6a29fae75f70c3dcdc414a0ad866601 b0729a713593a92e46b56eaa66b9e435f7a09a8e7de03b078f6f282285276635f301e7aaafe42187c45d6f5b13f9f16b11195cc125c05b90d24dfe4c valid

+92

wycheproof-87 2a606bf67ac770c607038b004101b325edb569efd3413d2d1f2c3e6b4e6e3082 67d84d4c3945aaf06e06d524be63acbfb5dbb1988c4aea96a5ee9f7a9b9eecc29df4f66b8aa1d9e8607a58fb1ef0c2ad69aac005b4f58e34103344a9c8871a09 a8546e50ba31cae3234310d32672447be213fad91a227a19669c53d309b959782b0e6b71f8791fdb470043b58122003157d2d96a43a6cbd7d3a8d86bf4c97391883e268d50af80e1e6e12939c2bd50ca746cdadfad4edf1bda875299740724148efb1ebe73fb60088cda890317658627a5f7ab5a0c075d9d8f3f97b6492b35519e50ff6b38377432a7081f9176bb1c29a862deac1336ca20b097a47829cec10a6a7cec178eda2d12f6dc6c87f910454af0123555ba184e68804d9cced60fd5c8c90943e56599c8f0ba59a38491ba5e5a53460682474c07e40ca142983314fd762856bb1093f359da6eb0a756bd93a3160c10dd8feea6b97e7c6a17cb54bd5d7649c05c66d7bdee056671dfdaf689fa3945bb8e29a429f4bd5d355dce9687b06f01d5e33e3999f0e8 valid

+93

wycheproof-88 c9c946cbc5544ac74eef491f07c5881c16faf7ec31ce4aa91bb60ae7b4539051 24087d47f3e20af51b9668ae0a88ce76586802d0ec75d8c0f28fc30962b5e1d1a1d509571a1624ed125a8df92a6e963728d6b5de99200b8e285f70feb6f05207 cd2212eddb0706f62c995cef958634f0cb7793444cbf4d30e81c27c41ebea6cb02607510131f9c015692dfd521b148841e9a2d3564d20ac401f6cb8e40f520fe0cafbeaa88840b83013369d879f013463fe52a13267aa0c8c59c45cde9399cd1e6be8cc64cf48315ac2eb31a1c567a4fb7d601746d1f63b5ac020712adbbe07519bded6f valid

+94

wycheproof-89 32ad026f693d0d2afe7f4388d91c4c964426fcb9e3665c3ebd8650009b815c8e d920d421a5956b69bfe1ba834c025e2babb6c7a6d78c97de1d9bb1116dfdd1185147b2887e34e15578172e150774275ea2aad9e02106f7e8ca1caa669a066f0c ec5c7cb078 valid

+95

wycheproof-90 32ad026f693d0d2afe7f4388d91c4c964426fcb9e3665c3ebd8650009b815c8e 4f62daf7f7c162038552ad7d306e195baa37ecf6ca7604142679d7d1128e1f8af52e4cb3545748c44ef1ff1c64e877e4f4d248259b7f6eb56e3ef72097dc8e0c 4668c6a76f0e482190a7175b9f3806a5fe4314a004fa69f988373f7a valid

+96

wycheproof-91 c29ec1894e06d27b4e40486b4fa5063d66a746c7f9c323b12203c03b72b8b78a 6669acf94667c5b541afe5307bde9476b13ae7e0e6058a772101ac8eb0a94331428eb4db0a2c68a9b6c1763b8624dab259b0876cdcfaeacc17b21a18e3fc010a 0f325ffd87e58131ffa23c05ea4579513b287fdba87b44 valid

+97

wycheproof-92 cfda5b899e35764c5229e59295fe1222b7ddce176643697c29e46ecbba10cf10 30490c28f806298225df62103521dcee047153912c33ab8ab8bbdd1ffabd70fd4fdb360f05be535b067d1cf4e78c2cb432206bf280aab3bd21aaa1cb894c5b06 ec5c7cb078 valid

+98

wycheproof-93 32ad026f693d0d2afe7f4388d91c4c964426fcb9e3665c3ebd8650009b815c8e deecafb6f2ede73fec91a6f10e45b9c1c61c4b9bfbe6b6147e2de0b1df6938971f7896c3ab83851fb5d9e537037bff0fca0ccb4a3cc38f056f91f7d7a0557e08 5dc9bb87eb11621a93f92abe53515697d2611b2eef73 valid

+99

wycheproof-94 cfda5b899e35764c5229e59295fe1222b7ddce176643697c29e46ecbba10cf10 4cd4f77ed473a6647387f3163541c67a1708a3c3bd1673247cb87f0cb68b3c56f04bfa72970c8a483efe659c87009ab4020b590b6641316b3deddb5450544e02 67484059b2490b1a0a4f8dee77979e26 valid

+100

wycheproof-95 32ad026f693d0d2afe7f4388d91c4c964426fcb9e3665c3ebd8650009b815c8e 7f8663cf98cbd39d5ff553f00bcf3d0d520605794f8866ce75714d77cc51e66c91818b657d7b0dae430a68353506edc4a714c345f5ddb5c8b958ba3d035f7a01 7dcfe60f881e1285676f35b68a1b2dbcdd7be6f719a288ababc28d36e3a42ac3010a1ca54b32760e74 valid

+101

wycheproof-96 cfda5b899e35764c5229e59295fe1222b7ddce176643697c29e46ecbba10cf10 1e41a24fe732bd7cab14c2a2f5134ee8c87fcbd2e987e60957ed9239e5c32404d56977e1b4282871896cb10625a1937468e4dc266e16a9c1b8e9891177eca802 a020a4381dc9141f47ee508871ab7a8b5a3648727c4281ae9932376f23a8e1bcda0626b7129197d864178631ec89c4332dbb18 valid

+102

wycheproof-97 32ad026f693d0d2afe7f4388d91c4c964426fcb9e3665c3ebd8650009b815c8e 6aab49e5c0bc309b783378ee03ffda282f0185cdf94c847701ff307a6ee8d0865411c44e0a8206f6a5f606107451940c2593af790ce1860f4c14ab25b2deae08 58e456064dff471109def4ca27fa8310a1df32739655b624f27e6418d34b7f007173f3faa5 valid

+103

wycheproof-98 529919c9c780985a841c42ba6c180ff2d67a276ccfbe281080e47ab71a758f56 01abfa4d6bbc726b196928ec84fd03f0c953a4fa2b228249562ff1442a4f63a7150b064f3712b51c2af768d2c2711a71aabf8d186833e941a0301b82f0502905 e1cbf2d86827825613fb7a85811d valid

+104

wycheproof-99 cfda5b899e35764c5229e59295fe1222b7ddce176643697c29e46ecbba10cf10 2a833aadecd9f28235cb5896bf3781521dc71f28af2e91dbe1735a61dce3e31ac15ca24b3fc47817a59d386bbbb2ce60a6adc0a2703bb2bdea8f70f91051f706 a25176b3afea318b2ec11ddacb10caf7179c0b3f8eabbfa2895581138d3c1e0e valid

+105

wycheproof-100 32ad026f693d0d2afe7f4388d91c4c964426fcb9e3665c3ebd8650009b815c8e 1a74ed2cbdc7d8f3827014e8e6ecf8fd2698ac8f86833acccdd400df710fe0d6b0543c9cfa00d52bf024ab7ce0d91981944097233ec134d5c7abbd44bfd32d0d a1 valid

+106

wycheproof-101 2252b3d57c74cbf8bc460dc2e082847926bc022f09ab6ae95756362bfd1167c1 af0fd9dda7e03e12313410d8d8844ebb6fe6b7f65141f22d7bcba5695a25414a9e54326fb44d59fb14707899a8aae70857b23d4080d7ab2c396ef3a36d45ce02 975ef941710071a9e1e6325a0c860becd7c695b5117c3107b686e330e5 valid

+107

wycheproof-102 c0a773110f975de3732355bb7ec7f0c41c091c0252966070205516693b992a4a 0280427e713378f49d478df6373c6cac847b622b567daa2376c839e7ac10e22c380ab0fa8617c9dcfe76c4d9db5459b21dc1413726e46cc8f387d359e344f407 - valid

+108

wycheproof-103 cfda5b899e35764c5229e59295fe1222b7ddce176643697c29e46ecbba10cf10 c97e3190f83bae7729ba473ad46b420b8aad735f0808ea42c0f898ccfe6addd4fd9d9fa3355d5e67ee21ab7e1f805cd07f1fce980e307f4d7ad36cc924eef00c a9e6d94870a67a9fe1cf13b1e6f9150cdd407bf6480ec841ea586ae3935e9787163cf419c1 valid

+109

wycheproof-104 32ad026f693d0d2afe7f4388d91c4c964426fcb9e3665c3ebd8650009b815c8e 14ceb2eaf4688d995d482f44852d71ad878cd7c77b41e60b0065fd01a59b054ee74759224187dbde9e59a763a70277c960892ef89fba997aba2576b2c54ba608 11cb1eafa4c42a8402c4193c4696f7b2e6d4585e4b42dcf1a8b67a80b2da80bc9d4b649fb2f35eaf1f56c426fd0b valid

+110

wycheproof-105 c9c946cbc5544ac74eef491f07c5881c16faf7ec31ce4aa91bb60ae7b4539051 c2656951e2a0285585a51ff0eda7e9a23c2dfd2ffa273aee7808f4604e8f9a8c8ea49e9fce4eb2d8d75d36b7238fe6fc13b6c5d9427dd58f8c6615d033c0bd0f 27d465bc632743522aefa23c valid

+111

wycheproof-106 c29ec1894e06d27b4e40486b4fa5063d66a746c7f9c323b12203c03b72b8b78a 931e5152fcef078c22cc5d6a3a65f06e396289f6f5f2d1efa6340254a53526ef5dc6874eeddf35c3f50991c53cd02bf06313e37d93ee1f7022128ffa3b8f300b 5ffa valid

+112

wycheproof-107 529919c9c780985a841c42ba6c180ff2d67a276ccfbe281080e47ab71a758f56 e4ae21f7a8f4b3b325c161a8c6e53e2edd7005b9c2f8a2e3b0ac4ba94aa80be6f2ee22ac8d4a96b9a3eb73a825e7bb5aff4a3393bf5b4a38119e9c9b1b041106 25 valid

+113

wycheproof-108 2252b3d57c74cbf8bc460dc2e082847926bc022f09ab6ae95756362bfd1167c1 e097e0bd0370bff5bde359175a11b728ee9639095d5df8eda496395565616edfe079977f7d4dc8c75d6113a83d6a55e6e1676408c0967a2906339b43337dcb01 80fdd6218f29c8c8f6bd820945f9b0854e3a8824 valid

+114

wycheproof-109 2a606bf67ac770c607038b004101b325edb569efd3413d2d1f2c3e6b4e6e3082 28fafbb62b4d688fa79e1ac92851f46e319b161f801d4dc09acc21fdd6780a2c4292b8c1003c61c2bcebe7f3f88ccc4bb26d407387c5f27cb8c94cf6ce810405 b477b0480bb84642608b908d29a51cf2fce63f24ee95 valid

+115

wycheproof-110 32ad026f693d0d2afe7f4388d91c4c964426fcb9e3665c3ebd8650009b815c8e 83c40ce13d483cc58ff65844875862d93df4bd367af77efa469ec06a8ed9e6d7905a04879535708ddf225567a815c9b941d405c98e918fd0c151165cea7fb101 aa365b442d12b7f3c925 valid

+116

wycheproof-111 54cda623245759ad6d43e620a606908befc633d60792bc7798447a0ef38e7311 14d9b497c19b91d43481c55bb6f5056de252d9ecb637575c807e58e9b4c5eac8b284089d97e2192dc242014363208e2c9a3435edf8928fb1d893553e9be4c703 27e792b28b2f1702 valid

+117

wycheproof-112 2362bac514d5fad33802642e979a1e82de6eb6f1bcbf6a5b304f2bb02b9e57fe 242ddb3a5d938d07af690b1b0ef0fa75842c5f9549bf39c8750f75614c712e7cbaf2e37cc0799db38b858d41aec5b9dd2fca6a3c8e082c10408e2cf3932b9d08 eef3bb0f617c17d0420c115c21c28e3762edc7b7fb048529b84a9c2bc6 valid

+118

wycheproof-113 32ad026f693d0d2afe7f4388d91c4c964426fcb9e3665c3ebd8650009b815c8e 71a4a06a34075f2fd47bc3abf4714d46db7e97b08cb6180d3f1539ac50b18ce51f8af8ae95ed21d4fa0daab7235925631ecea1fd9d0d8a2ba7a7583fd04b900c 475f valid

+119

wycheproof-114 037b55b427dc8daa0f80fcebaf0846902309f8a6cf18b465c0ce9b6539629ac8 c964e100033ce8888b23466677da4f4aea29923f642ae508f9d0888d788150636ab9b2c3765e91bbb05153801114d9e52dc700df377212222bb766be4b8c020d 01234567 valid

+120

wycheproof-115 9c0007698f177998a7666c7cf7973e2b88e9c4946e33804a7bbe8968d2394b2e 176065c6d64a136a2227687d77f61f3fca3b16122c966276fd9a8b14a1a2cea4c33b3533d11101717016684e3810efbea63bb23773f7cc480174199abd734f08 9399a6db9433d2a28d2b0c11c8794ab7d108c95b valid

+121

wycheproof-116 ed3a6f9721dc9729c1f76635bcf080d7036e1c2f0228654ccbbe1e738c17b963 7ca69331eec8610d38f00e2cdbd46966cb359dcde98a257ac6f362cc00c8f4fe85c02285fe4d66e31a44cadb2bf474e1a7957609eb4fe95a71473fe6699aa70d 7af783afbbd44c1833ab7237ecaf63b94ffdd003 valid

+122

wycheproof-117 4abfb535313705a6570018440cdec1a3ae33e51f352112fa6acbd0c6bc3ea859 f296715e855d8aecccba782b670163dedc4458fe4eb509a856bcac450920fd2e95a3a3eb212d2d9ccaf948c39ae46a2548af125f8e2ad9b77bd18f92d59f9200 321b5f663c19e30ee7bbb85e48ecf44db9d3f512 valid

+123

wycheproof-118 4f2162e6bf03a712db0efa418b7e7006e23871d9d7ec555a313885c4afd96385 367d07253a9d5a77d054b9c1a82d3c0a448a51905343320b3559325ef41839608aa45564978da1b2968c556cfb23b0c98a9be83e594d5e769d69d1156e1b1506 c48890e92aeeb3af04858a8dc1d34f16a4347b91 valid

+124

wycheproof-119 4abfb535313705a6570018440cdec1a3ae33e51f352112fa6acbd0c6bc3ea859 f296715e855d8aecccba782b670163dedc4458fe4eb509a856bcac450920fd2e95a3a3eb212d2d9ccaf948c39ae46a2548af125f8e2ad9b77bd18f92d59f9200 321b5f663c19e30ee7bbb85e48ecf44db9d3f512 valid

+125

wycheproof-120 4f2162e6bf03a712db0efa418b7e7006e23871d9d7ec555a313885c4afd96385 367d07253a9d5a77d054b9c1a82d3c0a448a51905343320b3559325ef41839608aa45564978da1b2968c556cfb23b0c98a9be83e594d5e769d69d1156e1b1506 c48890e92aeeb3af04858a8dc1d34f16a4347b91 valid

+126

wycheproof-121 0717d75ce27ea181ed5a30e6456c649b5cf453a6b4c12cd3f9fd16b31e0c25cd 9588e02bc815649d359ce710cdc69814556dd8c8bab1c468f40a49ebefb7f0de7ed49725edfd1b708fa1bad277c35d6c1b9c5ec25990997645780f9203d7dd08 26d5f0631f49106db58c4cfc903691134811b33c valid

+127

wycheproof-122 db5b9eab7e84e5a13505865fa711c9c896c898609fc11fc9bc1e55028f9496df 2217a0be57dd0d6c0090641496bcb65e37213f02a0df50aff0368ee2808e1376504f37b37494132dfc4d4887f58b9e86eff924040db3925ee4f8e1428c4c500e 2a71f064af982a3a1103a75cef898732d7881981 valid

+128

wycheproof-123 7bac18f6d2625d3915f233434cda38a577247a7332a5170b37142a34644145e0 1fda6dd4519fdbefb515bfa39e8e5911f4a0a8aa65f40ef0c542b8b34b87f9c249dc57f320718ff457ed5915c4d0fc352affc1287724d3f3a9de1ff777a02e01 bf26796cef4ddafcf5033c8d105057db0210b6ad valid

+129

wycheproof-124 7bac18f6d2625d3915f233434cda38a577247a7332a5170b37142a34644145e0 1fda6dd4519fdbefb515bfa39e8e5911f4a0a8aa65f40ef0c542b8b34b87f9c249dc57f320718ff457ed5915c4d0fc352affc1287724d3f3a9de1ff777a02e01 bf26796cef4ddafcf5033c8d105057db0210b6ad valid

+130

wycheproof-125 38ead304624abebf3e2b31e20e5629531e3fc659008887c9106f5e55adbbc62a 068eafdc2f36b97f9bae7fbda88b530d16b0e35054d3a351e3a4c914b22854c711505e49682e1a447e10a69e3b04d0759c859897b64f71137acf355b63faf100 ae03da6997e40cea67935020152d3a9a365cc055 valid

+131

wycheproof-126 e9bc95049af7e4817b17c402269ba5e767b7348757ac8002fec9e08390c0a9cf 43670abc9f09a8a415e76f4a21c6a46156f066b5a37b3c1e867cf67248c7b927e8d13a763e37abf936f5f27f7a8aa290539d21f740efd26b65fd5ad27085f400 489d473f7fb83c7f6823baf65482517bccd8f4ea valid

+132

wycheproof-127 ee8155ca4e8fe7bc5bca5992044eab7f8c3c6a13db1176f42f46c29da5b064f4 56388f2228893b14ce4f2a5e0cc626591061de3a57c50a5ecab7b9d5bb2caeea191560a1cf2344c75fdb4a085444aa68d727b39f498169eaa82cf64a31f59803 1b704d6692d60a07ad1e1d047b65e105a80d3459 valid

+133

wycheproof-128 db507bfcc9576393f7157bb360532b05c5fcf2e764b690cc6698a4a30d349095 553e5845fc480a577da6544e602caadaa00ae3e5aa3dce9ef332b1541b6d5f21bdf1d01e98baf80b8435f9932f89b3eb70f02da24787aac8e77279e797d0bd0b dc87030862c4c32f56261e93a367caf458c6be27 valid

+134

wycheproof-129 994eaf03309d6ad9d95a656bc1744e2886f029023a3750b34f35086b3c7227f8 bc10f88081b7be1f2505b6e76c5c82e358cf21ec11b7df1f334fb587bada465b53d9f7b4d4fec964432ee91ead1bc32ed3c82f2167da1c834a37515df7fe130e 7f41ef68508343ef18813cb2fb332445ec6480cd valid

+135

wycheproof-130 127d37e406e0d83e4b55a09e21e8f50fb88af47e4a43f018cdebffc1948757f0 00c11e76b5866b7c37528b0670188c1a0473fb93c33b72ae604a8865a7d6e094ff722e8ede3cb18389685ff3c4086c29006047466f81e71a329711e0b9294709 e1ce107971534bc46a42ac609a1a37b4ca65791d valid

+136

wycheproof-131 d83ba84edfb4bec49f29be31d80a64b7c0b5a502438cdb1d0dd1e0e3e55786de 0a6f0ac47ea136cb3ff00f7a96638e4984048999ee2da0af6e5c86bffb0e70bb97406b6ad5a4b764f7c99ebb6ec0fd434b8efe253b0423ef876c037998e8ab07 869a827397c585cf35acf88a8728833ab1c8c81e valid

+137

wycheproof-132 d3c9aa2f3d6ef217a166e8ae403ed436c37facbbe3beceb78df6eb439f8fa04a b7cbb942a6661e2312f79548224f3e44f5841c6e880c68340756a00ce94a914e8404858265985e6bb97ef01d2d7e5e41340309606bfc43c8c6a8f925126b3d09 619d8c4f2c93104be01cd574a385ceca08c33a9e valid

+138

wycheproof-133 d53280367c1c0b95ac4112218b92c6a71c51fb6312ce668de196c7d52a136155 27a4f24009e579173ff3064a6eff2a4d20224f8f85fdec982a9cf2e6a3b51537348a1d7851a3a932128a923a393ea84e6b35eb3473c32dceb9d7e9cab03a0f0d 5257a0bae8326d259a6ce97420c65e6c2794afe2 valid

+139

wycheproof-134 94ac2336ba97a476fb4c9f2b5563e4167ca292c6e99e422350a911ae3172c315 985b605fe3f449f68081197a68c714da0bfbf6ac2ab9abb0508b6384ea4999cb8d79af98e86f589409e8d2609a8f8bd7e80aaa8d92a84e7737fbe8dcef41920a 5acb6afc9b368f7acac0e71f6a4831c72d628405 valid

+140

wycheproof-135 e1e7316d231f7f275bdf403360304da1509fdf1af1fd25ca214eaac0a289398f 1c8fbda3d39e2b441f06da6071c13115cb4115c7c3341704cf6513324d4cf1ef4a1dd7678a048b0dde84e48994d080befcd70854079d44b6a0b0f9fa002d130c 3c87b3453277b353941591fc7eaa7dd37604b42a valid

+141

wycheproof-136 fffbeea71215efaf9888fec2cc68edb3703ff11a66fd629b53cbda5eabc18750 59097233eb141ed948b4f3c28a9496b9a7eca77454ecfe7e46737d1449a0b76b15aacf77cf48af27a668aa4434cfa26c504d75a2bcc4feac46465446234c0508 0a68e27ef6847bfd9e398b328a0ded3679d4649d valid

+142

wycheproof-137 19ccc0527599cb032e0b4c4d74e60f13901768a99df041c3bc1bf6c0ef271169 519105608508fe2f1b6da4cc8b23e39798b1d18d25972beed0404cec722e01ba1b6a0f85e99e092cca8076b101b60d4ac5035684357f4d0daacdc642da742a06 4e9bef60737c7d4dd10bd52567e1473a36d3573d valid

+143

wycheproof-138 0e726e27047563aa0a1a9c2e085d8d26af2acba129d0869c65031e3e6cac329a d8b03ee579e73f16477527fc9dc37a72eaac0748a733772c483ba013944f01ef64fb4ec5e3a95021dc22f4ae282baff6e9b9cc8433c6b6710d82e7397d72ef04 cc82b3163efda3ba7e9240e765112caa69113694 valid

+144

wycheproof-139 e77717b54a2b5e5bce5bccb8f0c5fdb5fd7df77ac254020fc9120dc0d4df4178 26da61fdfd38e6d01792813f27840c8b4766b0faaed39d0ee898cb450d94a5d5f57e58b6a003d7f9b56b20561954c6edcf66492d116b8b5e91f205a3a6449d0b 923a5c9e7b5635bb6c32c5a408a4a15b652450eb valid

+145

wycheproof-140 6220972d3f7d150b36790d7d522384876d64d640cd9913186815e1629582ed36 4adeaff7a58c5010a5a067feea0ae504d37b0c6a76c6c153e222f13409dff2df0fab69bc5059b97d925dc1b89e9851d7c627cb82d65585f9fd976124553f8902 6f2f0245de4587062979d0422d349f93ccdc3af2 valid

+146

wycheproof-141 7b64a28c50ec7678a90e3e1a21522e30ac9db7b5215aea2bfb33bea037eab987 4204d620cde0c3008c0b2901f5d6b44f88f0e3cb4f4d62252bf6f3cb37c1fb150a9ccb296afe5e7c75f65b5c8edd13dc4910ffe1e1265b3707c59042cf9a5902 6e911edb27a170b983d4dee1110554f804330f41 valid

+147

wycheproof-142 724452210a9e4c994819229bf12bf84e95768a3a97c08d8d8f5f939a4cad34c5 f8a69d3fd8c2ff0a9dec41e4c6b43675ce08366a35e220b1185ffc246c339e22c20ac661e866f52054015efd04f42eca2adcee6834c4df923b4a62576e4dff0e b8cf807eea809aaf739aa091f3b7a3f2fd39fb51 valid

+148

wycheproof-143 bad265b294ed2f422cb6a141694086238fbfe987571aa765d8b4f3a24105aa01 61792c9442bc6338ac41fd42a40bee9b02ec1836503d60ff725128c63d72808880c36e6190b7da525cbee5d12900aa043547dd14a2709ef9e49d628f37f6b70c 01a2b5f7fee813b4e9bd7fc25137648004795010 valid

+149

wycheproof-144 0aaee4b723db9b51ba7d22eb23eb8a76a5ac02f4fc9dd06f77bea42e1d37ec5a fa3cd41e3a8c00b19eecd404a63c3cb787cd30de0dfc936966cff2117f5aff18db6bef80fcfd8856f3fb2e9c3dc47593e9471103032af918feee638a33d40505 0fbf5d47cb5d498feace8f98f1896208da38a885 valid

+150

wycheproof-145 812344af15a91ba83c2c91e96f1727ac0f3c4c41385b9fa84efa399ada5168be 97fbbcd7a1d0eb42d2f8c42448ef35a2c2472740556b645547865330d6c57068af377fced08aaf810c08cd3c43d296f1975710312e9334c98b485f831efa4103 36e67c1939750bffb3e4ba6cb85562612275e862 valid

+151

wycheproof-146 0ee5cb5597fbdf8dccc48b01485e39b33aa133b52d30d23740277267cfec3e3e d7dbaa337ffd2a5fd8d5fd8ad5aeccc0c0f83795c2c59fe62a40b87903b1ae62ed748a8df5af4d32f9f822a65d0e498b6f40eaf369a9342a1164ee7d08b58103 13945c894c1d3fe8562e8b20e5f0efaa26ade8e3 valid

+152

wycheproof-147 9fba1de92b60b5b4703089763d0d6f9125e4dd7efae41f08a22882aef96892c4 09a2ed303a2fa7027a1dd7c3b0d25121eeed2b644a2fbc17aa0c8aea4524071ede7e7dd7a536d5497f8165d29e4e1b63200f74bbae39fbbbccb29889c62c1f09 4de142af4b8402f80a47fa812df84f42e283cee7 valid

+153

wycheproof-148 7582ab1b52e1316e5c13671f43b39ca36b28133cd0832831bcddd0b0f23398cb e6884a6e6b2e60a0b5862251c001e7c79d581d777d6fc11d218d0aecd79f26a30e2ca22cc7c4674f8b72655bc4ee5cb5494ca07c05177656142ac55cc9d33e02 563357f41b8b23b1d83f19f5667177a67da20b18 valid

+154

wycheproof-149 dd2d678bae222f3fb6e8278f08cc9e1a66339c926c29ac0a16f9717f5ee18cd8 6124c206d864507ea5d984b363b4cf583314db6856a45ded5e61eebff4d5e337e0b4c82b445ae2e52d549d2d961eace2ea01f81158e09a9686baa040db65ad08 931bbf9c877a6571cf7d4609fc3eb867edd43f51 valid

+155

wycheproof-150 ccbe7cb2e4bc215cee2f885e1d22f7e0d582b2bbbd782c104e548b152d26fc69 cfbd450a2c83cb8436c348822fe3ee347d4ee937b7f2ea11ed755cc52852407c9eec2c1fa30d2f9aef90e89b2cc3bcef2b1b9ca59f712110d19894a9cf6a2802 44530b0b34f598767a7b875b0caee3c7b9c502d1 valid

+156

wycheproof-151 d75a980182b10ab7d54bfed3c964073a0ee172f3daa62325af021a68f707511a 0100000000000000000000000000000000000000000000000000000000000080c803ee1f2342aa96ff698a393d1ab5e66f3eda101d6d120b394c3fd32c117d0a 313233343030 invalid

+157

speccheck-0 c7176a703d4dd84fba3c0b760d10670f2a2053fa2c39ccc64ec7fd7792ac03fa c7176a703d4dd84fba3c0b760d10670f2a2053fa2c39ccc64ec7fd7792ac037a0000000000000000000000000000000000000000000000000000000000000000 8c93255d71dcab10e8f379c26200f3c7bd5f09d9bc3068d3ef4edeb4853022b6 ?

+158

speccheck-1 c7176a703d4dd84fba3c0b760d10670f2a2053fa2c39ccc64ec7fd7792ac03fa f7badec5b8abeaf699583992219b7b223f1df3fbbea919844e3f7c554a43dd43a5bb704786be79fc476f91d3f3f89b03984d8068dcf1bb7dfc6637b45450ac04 9bd9f44f4dcc75bd531b56b2cd280b0bb38fc1cd6d1230e14861d861de092e79 ?

+159

speccheck-2 f7badec5b8abeaf699583992219b7b223f1df3fbbea919844e3f7c554a43dd43 c7176a703d4dd84fba3c0b760d10670f2a2053fa2c39ccc64ec7fd7792ac03fa8c4bd45aecaca5b24fb97bc10ac27ac8751a7dfe1baff8b953ec9f5833ca260e aebf3f2601a0c8c5d39cc7d8911642f740b78168218da8471772b35f9d35b9ab ?

+160

speccheck-3 cdb267ce40c5cd45306fa5d2f29731459387dbf9eb933b7bd5aed9a765b88d4d 9046a64750444938de19f227bb80485e92b83fdb4b6506c160484c016cc1852f87909e14428a7a1d62e9f22f3d3ad7802db02eb2e688b6c52fcd6648a98bd009 9bd9f44f4dcc75bd531b56b2cd280b0bb38fc1cd6d1230e14861d861de092e79 ?

+161

speccheck-4 cdb267ce40c5cd45306fa5d2f29731459387dbf9eb933b7bd5aed9a765b88d4d 160a1cb0dc9c0258cd0a7d23e94d8fa878bcb1925f2c64246b2dee1796bed5125ec6bc982a269b723e0668e540911a9a6a58921d6925e434ab10aa7940551a09 e47d62c63f830dc7a6851a0b1f33ae4bb2f507fb6cffec4011eaccd55b53f56c ?

+162

speccheck-5 cdb267ce40c5cd45306fa5d2f29731459387dbf9eb933b7bd5aed9a765b88d4d 21122a84e0b5fca4052f5b1235c80a537878b38f3142356b2c2384ebad4668b7e40bc836dac0f71076f9abe3a53f9c03c1ceeeddb658d0030494ace586687405 e47d62c63f830dc7a6851a0b1f33ae4bb2f507fb6cffec4011eaccd55b53f56c ?

+163

speccheck-6 442aad9f089ad9e14647b1ef9099a1ff4798d78589e66f28eca69c11f582a623 e96f66be976d82e60150baecff9906684aebb1ef181f67a7189ac78ea23b6c0e547f7690a0e2ddcd04d87dbc3490dc19b3b3052f7ff0538cb68afb369ba3a514 85e241a07d148b41e47d62c63f830dc7a6851a0b1f33ae4bb2f507fb6cffec40 ?

+164

speccheck-7 442aad9f089ad9e14647b1ef9099a1ff4798d78589e66f28eca69c11f582a623 8ce5b96c8f26d0ab6c47958c9e68b937104cd36e13c33566acd2fe8d38aa19427e71f98a473474f2f13f06f97c20d58cc3f54b8bd0d272f42b695dd7e89a8c22 85e241a07d148b41e47d62c63f830dc7a6851a0b1f33ae4bb2f507fb6cffec40 ?

+165

speccheck-8 f7badec5b8abeaf699583992219b7b223f1df3fbbea919844e3f7c554a43dd43 ecffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff03be9678ac102edcd92b0210bb34d7428d12ffc5df5f37e359941266a4e35f0f 9bedc267423725d473888631ebf45988bad3db83851ee85c85e241a07d148b41 ?

+166

speccheck-9 f7badec5b8abeaf699583992219b7b223f1df3fbbea919844e3f7c554a43dd43 ecffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffca8c5b64cd208982aa38d4936621a4775aa233aa0505711d8fdcfdaa943d4908 9bedc267423725d473888631ebf45988bad3db83851ee85c85e241a07d148b41 ?

+167

speccheck-10 ecffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff a9d55260f765261eb9b84e106f665e00b867287a761990d7135963ee0a7d59dca5bb704786be79fc476f91d3f3f89b03984d8068dcf1bb7dfc6637b45450ac04 e96b7021eb39c1a163b6da4e3093dcd3f21387da4cc4572be588fafae23c155b ?

+168

speccheck-11 ecffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff a9d55260f765261eb9b84e106f665e00b867287a761990d7135963ee0a7d59dca5bb704786be79fc476f91d3f3f89b03984d8068dcf1bb7dfc6637b45450ac04 39a591f5321bbe07fd5a23dc2f39d025d74526615746727ceefd6e82ae65c06f ?

test/vectors/gen-ed25519-vectors.shadded

@@ -0,0 +1,65 @@

#!/bin/sh

# Generate test/test-ed25519-vectors.sgl from test/vectors/ed25519-cases.txt.

#

# ed25519-cases.txt lines: "<label> <pk-hex> <sig-hex> <msg-hex|-> <expected>"

# rfc8032-* RFC 8032 section 7.1 (Ed25519), expected valid

# wycheproof-* C2SP/wycheproof testvectors_v1/ed25519_test.json

# (commit 5722833ca004983abd1a91bcb6c24596d50ac0f9)

# speccheck-* novifinancial/ed25519-speccheck cases.json

# (commit 5e4bfc4542293286e9ad3cb2b805badee00503de), whose

+10

# expected column is "?": filled in below.

+11

#

+12

# speccheck expectations are libsodium's (what the minisign tool uses):

+13

# reject 0-2 (small-order A or R), accept 3, reject 6-7 (S >= L) and 8-11

+14

# (non-canonical R or A). Cases 4 and 5 are the documented divergence:

+15

# they need a public key with a small-order component and pass the

+16

# cofactored equation (RFC 8032 section 5.1.7), which sigil-crypto checks,

+17

# but fail libsodium's cofactorless one. Measured by test/differential/run.sh.

+18

set -eu

+19

DIR=$(cd "$(dirname "$0")" && pwd)

+20

OUT="$DIR/../test-ed25519-vectors.sgl"

+21

awk '

+22

BEGIN {

+23

spec["0"]="invalid"; spec["1"]="invalid"; spec["2"]="invalid"; spec["3"]="valid";

+24

spec["4"]="valid"; spec["5"]="valid"; spec["6"]="invalid"; spec["7"]="invalid";

+25

spec["8"]="invalid"; spec["9"]="invalid"; spec["10"]="invalid"; spec["11"]="invalid";

+26

print ";;; GENERATED by test/vectors/gen-ed25519-vectors.sh from"

+27

print ";;; test/vectors/ed25519-cases.txt. Do not edit by hand."

+28

print ";;;"

+29

print ";;; Every case runs through ed25519-verify. A valid case must return #t;"

+30

print ";;; an invalid one must return #f, or raise when the key or signature has the"

+31

print ";;; wrong length (the API raises on wrong lengths; nothing else may raise)."

+32

print ""

+33

print "(import (sigil test) (sigil crypto) (sigil math))"

+34

print ""

+35

print "(define (hex->bv s)"

+36

print " (if (string=? s \"-\")"

+37

print " (make-bytevector 0 0)"

+38

print " (let* ((n (quotient (string-length s) 2))"

+39

print " (bv (make-bytevector n 0)))"

+40

print " (let loop ((i 0))"

+41

print " (if (< i n)"

+42

print " (begin"

+43

print " (bytevector-u8-set! bv i (string->number (substring s (* 2 i) (+ 2 (* 2 i))) 16))"

+44

print " (loop (+ i 1)))"

+45

print " bv)))))"

+46

print ""

+47

print ";; #t, #f, or the symbol raised when the call raises."

+48

print "(define (verdict pk sig msg)"

+49

print " (guard (e (#t (quote raised)))"

+50

print " (ed25519-verify (hex->bv pk) (hex->bv msg) (hex->bv sig))))"

+51

print ""

+52

print "(test-group \"ed25519 vectors\""

+53

}

+54

{

+55

label=$1; pk=$2; sig=$3; msg=$4; want_result=$5

+56

if (label ~ /^speccheck-/) { k=label; sub(/^speccheck-/, "", k); want_result=spec[k] }

+57

if (want_result == "valid") want="(assert-eq #t (verdict \"" pk "\" \"" sig "\" \"" msg "\"))"

+58

else if (length(pk) == 64 && length(sig) == 128) want="(assert-eq #f (verdict \"" pk "\" \"" sig "\" \"" msg "\"))"

+59

else want="(assert-eq (quote raised) (verdict \"" pk "\" \"" sig "\" \"" msg "\"))"

+60

printf " (test \"%s %s\"\n %s)\n", label, want_result, want

+61

n++

+62

}

+63

END { print " )"; print ""; printf ";;; %d cases\n", n }

+64

' "$DIR/ed25519-cases.txt" > "$OUT"

+65

echo "wrote $OUT"

test/vectors/speccheck-cases.jsonadded

@@ -0,0 +1 @@

[{"message":"8c93255d71dcab10e8f379c26200f3c7bd5f09d9bc3068d3ef4edeb4853022b6","pub_key":"c7176a703d4dd84fba3c0b760d10670f2a2053fa2c39ccc64ec7fd7792ac03fa","signature":"c7176a703d4dd84fba3c0b760d10670f2a2053fa2c39ccc64ec7fd7792ac037a0000000000000000000000000000000000000000000000000000000000000000"},{"message":"9bd9f44f4dcc75bd531b56b2cd280b0bb38fc1cd6d1230e14861d861de092e79","pub_key":"c7176a703d4dd84fba3c0b760d10670f2a2053fa2c39ccc64ec7fd7792ac03fa","signature":"f7badec5b8abeaf699583992219b7b223f1df3fbbea919844e3f7c554a43dd43a5bb704786be79fc476f91d3f3f89b03984d8068dcf1bb7dfc6637b45450ac04"},{"message":"aebf3f2601a0c8c5d39cc7d8911642f740b78168218da8471772b35f9d35b9ab","pub_key":"f7badec5b8abeaf699583992219b7b223f1df3fbbea919844e3f7c554a43dd43","signature":"c7176a703d4dd84fba3c0b760d10670f2a2053fa2c39ccc64ec7fd7792ac03fa8c4bd45aecaca5b24fb97bc10ac27ac8751a7dfe1baff8b953ec9f5833ca260e"},{"message":"9bd9f44f4dcc75bd531b56b2cd280b0bb38fc1cd6d1230e14861d861de092e79","pub_key":"cdb267ce40c5cd45306fa5d2f29731459387dbf9eb933b7bd5aed9a765b88d4d","signature":"9046a64750444938de19f227bb80485e92b83fdb4b6506c160484c016cc1852f87909e14428a7a1d62e9f22f3d3ad7802db02eb2e688b6c52fcd6648a98bd009"},{"message":"e47d62c63f830dc7a6851a0b1f33ae4bb2f507fb6cffec4011eaccd55b53f56c","pub_key":"cdb267ce40c5cd45306fa5d2f29731459387dbf9eb933b7bd5aed9a765b88d4d","signature":"160a1cb0dc9c0258cd0a7d23e94d8fa878bcb1925f2c64246b2dee1796bed5125ec6bc982a269b723e0668e540911a9a6a58921d6925e434ab10aa7940551a09"},{"message":"e47d62c63f830dc7a6851a0b1f33ae4bb2f507fb6cffec4011eaccd55b53f56c","pub_key":"cdb267ce40c5cd45306fa5d2f29731459387dbf9eb933b7bd5aed9a765b88d4d","signature":"21122a84e0b5fca4052f5b1235c80a537878b38f3142356b2c2384ebad4668b7e40bc836dac0f71076f9abe3a53f9c03c1ceeeddb658d0030494ace586687405"},{"message":"85e241a07d148b41e47d62c63f830dc7a6851a0b1f33ae4bb2f507fb6cffec40","pub_key":"442aad9f089ad9e14647b1ef9099a1ff4798d78589e66f28eca69c11f582a623","signature":"e96f66be976d82e60150baecff9906684aebb1ef181f67a7189ac78ea23b6c0e547f7690a0e2ddcd04d87dbc3490dc19b3b3052f7ff0538cb68afb369ba3a514"},{"message":"85e241a07d148b41e47d62c63f830dc7a6851a0b1f33ae4bb2f507fb6cffec40","pub_key":"442aad9f089ad9e14647b1ef9099a1ff4798d78589e66f28eca69c11f582a623","signature":"8ce5b96c8f26d0ab6c47958c9e68b937104cd36e13c33566acd2fe8d38aa19427e71f98a473474f2f13f06f97c20d58cc3f54b8bd0d272f42b695dd7e89a8c22"},{"message":"9bedc267423725d473888631ebf45988bad3db83851ee85c85e241a07d148b41","pub_key":"f7badec5b8abeaf699583992219b7b223f1df3fbbea919844e3f7c554a43dd43","signature":"ecffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff03be9678ac102edcd92b0210bb34d7428d12ffc5df5f37e359941266a4e35f0f"},{"message":"9bedc267423725d473888631ebf45988bad3db83851ee85c85e241a07d148b41","pub_key":"f7badec5b8abeaf699583992219b7b223f1df3fbbea919844e3f7c554a43dd43","signature":"ecffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffca8c5b64cd208982aa38d4936621a4775aa233aa0505711d8fdcfdaa943d4908"},{"message":"e96b7021eb39c1a163b6da4e3093dcd3f21387da4cc4572be588fafae23c155b","pub_key":"ecffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff","signature":"a9d55260f765261eb9b84e106f665e00b867287a761990d7135963ee0a7d59dca5bb704786be79fc476f91d3f3f89b03984d8068dcf1bb7dfc6637b45450ac04"},{"message":"39a591f5321bbe07fd5a23dc2f39d025d74526615746727ceefd6e82ae65c06f","pub_key":"ecffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff","signature":"a9d55260f765261eb9b84e106f665e00b867287a761990d7135963ee0a7d59dca5bb704786be79fc476f91d3f3f89b03984d8068dcf1bb7dfc6637b45450ac04"}]

No newline at end of file

test/vectors/wycheproof-ed25519_test.jsonadded

@@ -0,0 +1,3360 @@

{

"algorithm": "EDDSA",

"schema": "eddsa_verify_schema_v1.json",

"numberOfTests": 151,

"header": [

"Test vectors of type EddsaVerify are intended for testing"

],

"notes": {

"CompressedSignature": {

+10

"bugType": "CAN_OF_WORMS",

+11

      "description": "The test vector contains a signature where r and s overlap or where 0 bytes were cut from the signature. This signature was specifically generated.",

+12

      "effect": "The effect of the bug is unclear without further analysis. It could be rather benign and just allow signature malleability in some cases or it could hide a more severe flaw."

+13

},

+14

"InvalidEncoding": {

+15

"bugType": "CAN_OF_WORMS",

+16

      "description": "The test vector contains a signature with an invalid encoding of the values. The vector checks that invalid encodings are not accepted. For the vectors that modify the encoding of R, S has been recomputed so that the hash matches the modified R and the R recovered from S and the hash equals the original R. Such vectors are accepted only by verifiers that decode R leniently or that compare R to the recovered R incompletely.",

+17

      "effect": "Accepting such signatures means the encoding of a signature is not unique. A holder of the private key can generate multiple distinct signatures for the same message, and different verifiers can disagree about which signatures are valid."

+18

},

+19

"InvalidKtv": {

+20

"bugType": "UNKNOWN",

+21

"description": "The test vector contains a known invalid signature."

+22

},

+23

"InvalidSignature": {

+24

"bugType": "AUTH_BYPASS",

+25

"description": "The test vector contains a signature with edge case values such as 0 or the order of the group.",

+26

      "effect": "The effect of accepting such signatures probably indicates that signatures can be forged without even knowing the message itself."

+27

},

+28

"Ktv": {

+29

"bugType": "BASIC",

+30

"description": "The test vector contains a known valid signature."

+31

},

+32

"SignatureMalleability": {

+33

"bugType": "SIGNATURE_MALLEABILITY",

+34

      "description": "EdDSA signatures are non-malleable, if implemented correctly. If an implementation fails to check the range of S then it may be possible to modify a signature in such a way that it still verifies. See RFC 8032, Section 5.1.7 and Section 8.4."

+35

},

+36

"SignatureWithGarbage": {

+37

"bugType": "SIGNATURE_MALLEABILITY",

+38

      "description": "The test vector contains a signature with additional content. EdDSA signature are expected to be non-malleable. Signatures of the wrong length should be rejected. See RFC 8032, Section 5.1.7 and Section 8.4."

+39

},

+40

"TinkOverflow": {

+41

"bugType": "KNOWN_BUG",

+42

"description": "The test vector contains a signature that caused an arithmetic overflow in tink."

+43

},

+44

"TruncatedSignature": {

+45

"bugType": "AUTH_BYPASS",

+46

"description": "The test vector contains a signature that was truncated.",

+47

"effect": "Accepting such signatures likely means that signatures can be forged."

+48

},

+49

"Valid": {

+50

"bugType": "BASIC",

+51

"description": "The test vector is an ordinary valid signature."

+52

}

+53

},

+54

"testGroups": [

+55

{

+56

"type": "EddsaVerify",

+57

"source": {

+58

"name": "google-wycheproof",

+59

"version": "0.9rc5"

+60

},

+61

"publicKey": {

+62

"type": "EDDSAPublicKey",

+63

"curve": "edwards25519",

+64

"keySize": 255,

+65

"pk": "7d4d0e7f6153a69b6242b522abbee685fda4420f8834b108c3bdae369ef549fa"

+66

},

+67

"publicKeyDer": "302a300506032b65700321007d4d0e7f6153a69b6242b522abbee685fda4420f8834b108c3bdae369ef549fa",

+68

      "publicKeyPem": "-----BEGIN PUBLIC KEY-----\nMCowBQYDK2VwAyEAfU0Of2FTpptiQrUiq77mhf2kQg+INLEIw72uNp71Sfo=\n-----END PUBLIC KEY-----\n",

+69

"publicKeyJwk": {

+70

"kty": "OKP",

+71

"crv": "Ed25519",

+72

"kid": "none",

+73

"x": "fU0Of2FTpptiQrUiq77mhf2kQg-INLEIw72uNp71Sfo"

+74

},

+75

"tests": [

+76

{

+77

"tcId": 1,

+78

"comment": "",

+79

"flags": [

+80

"Valid"

+81

],

+82

"msg": "",

+83

          "sig": "d4fbdb52bfa726b44d1786a8c0d171c3e62ca83c9e5bbe63de0bb2483f8fd6cc1429ab72cafc41ab56af02ff8fcc43b99bfe4c7ae940f60f38ebaa9d311c4007",

+84

"result": "valid"

+85

},

+86

{

+87

"tcId": 2,

+88

"comment": "",

+89

"flags": [

+90

"Valid"

+91

],

+92

"msg": "78",

+93

          "sig": "d80737358ede548acb173ef7e0399f83392fe8125b2ce877de7975d8b726ef5b1e76632280ee38afad12125ea44b961bf92f1178c9fa819d020869975bcbe109",

+94

"result": "valid"

+95

},

+96

{

+97

"tcId": 3,

+98

"comment": "",

+99

"flags": [

+100

"Valid"

+101

],

+102

"msg": "54657374",

+103

          "sig": "7c38e026f29e14aabd059a0f2db8b0cd783040609a8be684db12f82a27774ab07a9155711ecfaf7f99f277bad0c6ae7e39d4eef676573336a5c51eb6f946b30d",

+104

"result": "valid"

+105

},

+106

{

+107

"tcId": 4,

+108

"comment": "",

+109

"flags": [

+110

"Valid"

+111

],

+112

"msg": "48656c6c6f",

+113

          "sig": "1c1ad976cbaae3b31dee07971cf92c928ce2091a85f5899f5e11ecec90fc9f8e93df18c5037ec9b29c07195ad284e63d548cd0a6fe358cc775bd6c1608d2c905",

+114

"result": "valid"

+115

},

+116

{

+117

"tcId": 5,

+118

"comment": "",

+119

"flags": [

+120

"Valid"

+121

],

+122

"msg": "313233343030",

+123

          "sig": "657c1492402ab5ce03e2c3a7f0384d051b9cf3570f1207fc78c1bcc98c281c2bf0cf5b3a289976458a1be6277a5055545253b45b07dcc1abd96c8b989c00f301",

+124

"result": "valid"

+125

},

+126

{

+127

"tcId": 6,

+128

"comment": "",

+129

"flags": [

+130

"Valid"

+131

],

+132

"msg": "000000000000000000000000",

+133

          "sig": "d46543bfb892f84ec124dcdfc847034c19363bf3fc2fa89b1267833a14856e52e60736918783f950b6f1dd8d40dc343247cd43ce054c2d68ef974f7ed0f3c60f",

+134

"result": "valid"

+135

},

+136

{

+137

"tcId": 7,

+138

"comment": "",

+139

"flags": [

+140

"Valid"

+141

],

+142

          "msg": "6161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161",

+143

          "sig": "879350045543bc14ed2c08939b68c30d22251d83e018cacbaf0c9d7a48db577e80bdf76ce99e5926762bc13b7b3483260a5ef63d07e34b58eb9c14621ac92f00",

+144

"result": "valid"

+145

},

+146

{

+147

"tcId": 8,

+148

"comment": "",

+149

"flags": [

+150

"Valid"

+151

],

+152

          "msg": "202122232425262728292a2b2c2d2e2f303132333435363738393a3b3c3d3e3f404142434445464748494a4b4c4d4e4f505152535455565758595a5b5c5d5e5f60",

+153

          "sig": "7bdc3f9919a05f1d5db4a3ada896094f6871c1f37afc75db82ec3147d84d6f237b7e5ecc26b59cfea0c7eaf1052dc427b0f724615be9c3d3e01356c65b9b5109",

+154

"result": "valid"

+155

},

+156

{

+157

"tcId": 9,

+158

"comment": "",

+159

"flags": [

+160

"Valid"

+161

],

+162

"msg": "ffffffffffffffffffffffffffffffff",

+163

          "sig": "5dbd7360e55aa38e855d6ad48c34bd35b7871628508906861a7c4776765ed7d1e13d910faabd689ec8618b78295c8ab8f0e19c8b4b43eb8685778499e943ae04",

+164

"result": "valid"

+165

}

+166

]

+167

},

+168

{

+169

"type": "EddsaVerify",

+170

"source": {

+171

"name": "google-wycheproof",

+172

"version": "0.9rc5"

+173

},

+174

"publicKey": {

+175

"type": "EDDSAPublicKey",

+176

"curve": "edwards25519",

+177

"keySize": 255,

+178

"pk": "7d4d0e7f6153a69b6242b522abbee685fda4420f8834b108c3bdae369ef549fa"

+179

},

+180

"publicKeyDer": "302a300506032b65700321007d4d0e7f6153a69b6242b522abbee685fda4420f8834b108c3bdae369ef549fa",

+181

      "publicKeyPem": "-----BEGIN PUBLIC KEY-----\nMCowBQYDK2VwAyEAfU0Of2FTpptiQrUiq77mhf2kQg+INLEIw72uNp71Sfo=\n-----END PUBLIC KEY-----\n",

+182

"publicKeyJwk": {

+183

"kty": "OKP",

+184

"crv": "Ed25519",

+185

"kid": "none",

+186

"x": "fU0Of2FTpptiQrUiq77mhf2kQg-INLEIw72uNp71Sfo"

+187

},

+188

"tests": [

+189

{

+190

"tcId": 10,

+191

"comment": "special values for r and s",

+192

"flags": [

+193

"InvalidSignature"

+194

],

+195

"msg": "3f",

+196

          "sig": "00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000",

+197

"result": "invalid"

+198

},

+199

{

+200

"tcId": 11,

+201

"comment": "special values for r and s",

+202

"flags": [

+203

"InvalidSignature"

+204

],

+205

"msg": "3f",

+206

          "sig": "00000000000000000000000000000000000000000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000",

+207

"result": "invalid"

+208

},

+209

{

+210

"tcId": 12,

+211

"comment": "special values for r and s",

+212

"flags": [

+213

"InvalidSignature"

+214

],

+215

"msg": "3f",

+216

          "sig": "0000000000000000000000000000000000000000000000000000000000000000ecd3f55c1a631258d69cf7a2def9de1400000000000000000000000000000010",

+217

"result": "invalid"

+218

},

+219

{

+220

"tcId": 13,

+221

"comment": "special values for r and s",

+222

"flags": [

+223

"InvalidSignature"

+224

],

+225

"msg": "3f",

+226

          "sig": "0000000000000000000000000000000000000000000000000000000000000000edd3f55c1a631258d69cf7a2def9de1400000000000000000000000000000010",

+227

"result": "invalid"

+228

},

+229

{

+230

"tcId": 14,

+231

"comment": "special values for r and s",

+232

"flags": [

+233

"InvalidSignature"

+234

],

+235

"msg": "3f",

+236

          "sig": "0000000000000000000000000000000000000000000000000000000000000000edffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff7f",

+237

"result": "invalid"

+238

},

+239

{

+240

"tcId": 15,

+241

"comment": "special values for r and s",

+242

"flags": [

+243

"InvalidSignature"

+244

],

+245

"msg": "3f",

+246

          "sig": "01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000",

+247

"result": "invalid"

+248

},

+249

{

+250

"tcId": 16,

+251

"comment": "special values for r and s",

+252

"flags": [

+253

"InvalidSignature"

+254

],

+255

"msg": "3f",

+256

          "sig": "01000000000000000000000000000000000000000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000",

+257

"result": "invalid"

+258

},

+259

{

+260

"tcId": 17,

+261

"comment": "special values for r and s",

+262

"flags": [

+263

"InvalidSignature"

+264

],

+265

"msg": "3f",

+266

          "sig": "0100000000000000000000000000000000000000000000000000000000000000ecd3f55c1a631258d69cf7a2def9de1400000000000000000000000000000010",

+267

"result": "invalid"

+268

},

+269

{

+270

"tcId": 18,

+271

"comment": "special values for r and s",

+272

"flags": [

+273

"InvalidSignature"

+274

],

+275

"msg": "3f",

+276

          "sig": "0100000000000000000000000000000000000000000000000000000000000000edd3f55c1a631258d69cf7a2def9de1400000000000000000000000000000010",

+277

"result": "invalid"

+278

},

+279

{

+280

"tcId": 19,

+281

"comment": "special values for r and s",

+282

"flags": [

+283

"InvalidSignature"

+284

],

+285

"msg": "3f",

+286

          "sig": "0100000000000000000000000000000000000000000000000000000000000000edffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff7f",

+287

"result": "invalid"

+288

},

+289

{

+290

"tcId": 20,

+291

"comment": "special values for r and s",

+292

"flags": [

+293

"InvalidSignature"

+294

],

+295

"msg": "3f",

+296

          "sig": "edd3f55c1a631258d69cf7a2def9de14000000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000000",

+297

"result": "invalid"

+298

},

+299

{

+300

"tcId": 21,

+301

"comment": "special values for r and s",

+302

"flags": [

+303

"InvalidSignature"

+304

],

+305

"msg": "3f",

+306

          "sig": "edd3f55c1a631258d69cf7a2def9de14000000000000000000000000000000100100000000000000000000000000000000000000000000000000000000000000",

+307

"result": "invalid"

+308

},

+309

{

+310

"tcId": 22,

+311

"comment": "special values for r and s",

+312

"flags": [

+313

"InvalidSignature"

+314

],

+315

"msg": "3f",

+316

          "sig": "edd3f55c1a631258d69cf7a2def9de1400000000000000000000000000000010ecd3f55c1a631258d69cf7a2def9de1400000000000000000000000000000010",

+317

"result": "invalid"

+318

},

+319

{

+320

"tcId": 23,

+321

"comment": "special values for r and s",

+322

"flags": [

+323

"InvalidSignature"

+324

],

+325

"msg": "3f",

+326

          "sig": "edd3f55c1a631258d69cf7a2def9de1400000000000000000000000000000010edd3f55c1a631258d69cf7a2def9de1400000000000000000000000000000010",

+327

"result": "invalid"

+328

},

+329

{

+330

"tcId": 24,

+331

"comment": "special values for r and s",

+332

"flags": [

+333

"InvalidSignature"

+334

],

+335

"msg": "3f",

+336

          "sig": "edd3f55c1a631258d69cf7a2def9de1400000000000000000000000000000010edffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff7f",

+337

"result": "invalid"

+338

},

+339

{

+340

"tcId": 25,

+341

"comment": "special values for r and s",

+342

"flags": [

+343

"InvalidSignature"

+344

],

+345

"msg": "3f",

+346

          "sig": "edffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff7f0000000000000000000000000000000000000000000000000000000000000000",

+347

"result": "invalid"

+348

},

+349

{

+350

"tcId": 26,

+351

"comment": "special values for r and s",

+352

"flags": [

+353

"InvalidSignature"

+354

],

+355

"msg": "3f",

+356

          "sig": "edffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff7f0100000000000000000000000000000000000000000000000000000000000000",

+357

"result": "invalid"

+358

},

+359

{

+360

"tcId": 27,

+361

"comment": "special values for r and s",

+362

"flags": [

+363

"InvalidSignature"

+364

],

+365

"msg": "3f",

+366

          "sig": "edffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff7fecd3f55c1a631258d69cf7a2def9de1400000000000000000000000000000010",

+367

"result": "invalid"

+368

},

+369

{

+370

"tcId": 28,

+371

"comment": "special values for r and s",

+372

"flags": [

+373

"InvalidSignature"

+374

],

+375

"msg": "3f",

+376

          "sig": "edffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff7fedd3f55c1a631258d69cf7a2def9de1400000000000000000000000000000010",

+377

"result": "invalid"

+378

},

+379

{

+380

"tcId": 29,

+381

"comment": "special values for r and s",

+382

"flags": [

+383

"InvalidSignature"

+384

],

+385

"msg": "3f",

+386

          "sig": "edffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff7fedffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff7f",

+387

"result": "invalid"

+388

}

+389

]

+390

},

+391

{

+392

"type": "EddsaVerify",

+393

"source": {

+394

"name": "google-wycheproof",

+395

"version": "0.9rc5"

+396

},

+397

"publicKey": {

+398

"type": "EDDSAPublicKey",

+399

"curve": "edwards25519",

+400

"keySize": 255,

+401

"pk": "7d4d0e7f6153a69b6242b522abbee685fda4420f8834b108c3bdae369ef549fa"

+402

},

+403

"publicKeyDer": "302a300506032b65700321007d4d0e7f6153a69b6242b522abbee685fda4420f8834b108c3bdae369ef549fa",

+404

      "publicKeyPem": "-----BEGIN PUBLIC KEY-----\nMCowBQYDK2VwAyEAfU0Of2FTpptiQrUiq77mhf2kQg+INLEIw72uNp71Sfo=\n-----END PUBLIC KEY-----\n",

+405

"publicKeyJwk": {

+406

"kty": "OKP",

+407

"crv": "Ed25519",

+408

"kid": "none",

+409

"x": "fU0Of2FTpptiQrUiq77mhf2kQg-INLEIw72uNp71Sfo"

+410

},

+411

"tests": [

+412

{

+413

"tcId": 30,

+414

"comment": "empty signature",

+415

"flags": [

+416

"TruncatedSignature"

+417

],

+418

"msg": "54657374",

+419

"sig": "",

+420

"result": "invalid"

+421

},

+422

{

+423

"tcId": 31,

+424

"comment": "s missing",

+425

"flags": [

+426

"TruncatedSignature"

+427

],

+428

"msg": "54657374",

+429

"sig": "7c38e026f29e14aabd059a0f2db8b0cd783040609a8be684db12f82a27774ab0",

+430

"result": "invalid"

+431

},

+432

{

+433

"tcId": 32,

+434

"comment": "signature too short",

+435

"flags": [

+436

"TruncatedSignature"

+437

],

+438

"msg": "54657374",

+439

          "sig": "7c38e026f29e14aabd059a0f2db8b0cd783040609a8be684db12f82a27774ab07a9155711ecfaf7f99f277bad0c6ae7e39d4eef676573336a5c51eb6f946",

+440

"result": "invalid"

+441

},

+442

{

+443

"tcId": 33,

+444

"comment": "signature too long",

+445

"flags": [

+446

"SignatureWithGarbage"

+447

],

+448

"msg": "54657374",

+449

          "sig": "7c38e026f29e14aabd059a0f2db8b0cd783040609a8be684db12f82a27774ab07a9155711ecfaf7f99f277bad0c6ae7e39d4eef676573336a5c51eb6f946b30d2020",

+450

"result": "invalid"

+451

},

+452

{

+453

"tcId": 34,

+454

"comment": "include pk in signature",

+455

"flags": [

+456

"SignatureWithGarbage"

+457

],

+458

"msg": "54657374",

+459

          "sig": "7c38e026f29e14aabd059a0f2db8b0cd783040609a8be684db12f82a27774ab07a9155711ecfaf7f99f277bad0c6ae7e39d4eef676573336a5c51eb6f946b30d7d4d0e7f6153a69b6242b522abbee685fda4420f8834b108c3bdae369ef549fa",

+460

"result": "invalid"

+461

},

+462

{

+463

"tcId": 35,

+464

"comment": "prepending 0 byte to signature",

+465

"flags": [

+466

"SignatureWithGarbage"

+467

],

+468

"msg": "54657374",

+469

          "sig": "007c38e026f29e14aabd059a0f2db8b0cd783040609a8be684db12f82a27774ab07a9155711ecfaf7f99f277bad0c6ae7e39d4eef676573336a5c51eb6f946b30d",

+470

"result": "invalid"

+471

},

+472

{

+473

"tcId": 36,

+474

"comment": "prepending 0 byte to s",

+475

"flags": [

+476

"SignatureWithGarbage"

+477

],

+478

"msg": "54657374",

+479

          "sig": "7c38e026f29e14aabd059a0f2db8b0cd783040609a8be684db12f82a27774ab0007a9155711ecfaf7f99f277bad0c6ae7e39d4eef676573336a5c51eb6f946b30d",

+480

"result": "invalid"

+481

},

+482

{

+483

"tcId": 37,

+484

"comment": "appending 0 byte to signature",

+485

"flags": [

+486

"SignatureWithGarbage"

+487

],

+488

"msg": "54657374",

+489

          "sig": "7c38e026f29e14aabd059a0f2db8b0cd783040609a8be684db12f82a27774ab07a9155711ecfaf7f99f277bad0c6ae7e39d4eef676573336a5c51eb6f946b30d00",

+490

"result": "invalid"

+491

},

+492

{

+493

"tcId": 38,

+494

"comment": "removing 0 byte from signature",

+495

"flags": [

+496

"CompressedSignature"

+497

],

+498

"msg": "546573743137",

+499

          "sig": "93de3ca252426c95f735cb9edd92e83321ac62372d5aa5b379786bae111ab6b17251330e8f9a7c30d6993137c596007d7b001409287535ac4804e662bc58a3",

Showing the first 500 of 3361 diff lines for this file. This diff is INCOMPLETE; read the file or clone the repository for the rest.

test/wasm/.gitignoreadded

@@ -0,0 +1,4 @@

# The probe resolves sigil-crypto from ../.. and its lock would record the

# local HEAD sha, which goes stale on every commit. run-wasm-test.mjs prints

# the resolved versions instead.

sigil.lock

test/wasm/gen-fixtures.shadded

@@ -0,0 +1,41 @@

#!/bin/sh

# Embed the minisign fixtures into test/wasm/src/crypto-probe/fixtures.sgl as

# hex, so the probe can run where there is no filesystem (wasm in Node).

set -eu

HERE=$(cd "$(dirname "$0")" && pwd)

FIX="$HERE/../fixtures/minisign"

OUT="$HERE/src/crypto-probe/fixtures.sgl"

hex() { od -An -tx1 -v "$1" | tr -d ' \n'; }

{

+10

echo ";;; GENERATED by test/wasm/gen-fixtures.sh from test/fixtures/minisign."

+11

echo ";;; Do not edit by hand."

+12

echo "(define-library (crypto-probe fixtures)"

+13

echo " (export fixture)"

+14

echo " (import (sigil core) (sigil math))"

+15

echo " (begin"

+16

echo " (define (hex->bv s)"

+17

echo " (let* ((n (quotient (string-length s) 2))"

+18

echo " (bv (make-bytevector n 0)))"

+19

echo " (let loop ((i 0))"

+20

echo " (if (< i n)"

+21

echo " (begin"

+22

echo " (bytevector-u8-set! bv i (string->number (substring s (* 2 i) (+ 2 (* 2 i))) 16))"

+23

echo " (loop (+ i 1)))"

+24

echo " bv))))"

+25

echo " (define fixtures"

+26

echo " (list"

+27

for f in a.pub b.pub hello.txt hello.txt.ED.minisig hello.txt.Ed.minisig \

+28

hello.txt.keyb.minisig binary.bin binary.bin.ED.minisig \

+29

registry.json registry.json.minisig; do

+30

[ -s "$FIX/$f" ] || { echo "REFUSING: missing or empty fixture $f" >&2; exit 1; }

+31

printf ' (cons "%s" "%s")\n' "$f" "$(hex "$FIX/$f")"

+32

done

+33

echo " ))"

+34

echo " ;; The fixture's bytes; raises for an unknown name."

+35

echo " (define (fixture name)"

+36

echo " (let ((entry (assoc name fixtures)))"

+37

echo " (if entry"

+38

echo " (hex->bv (cdr entry))"

+39

echo " (error (string-append \"no such fixture: \" name)))))))"

+40

} > "$OUT"

+41

echo "wrote $OUT ($(wc -c < "$OUT") bytes)"

test/wasm/package.sgladded

@@ -0,0 +1,69 @@

;;; sigil-crypto wasm probe: builds the same checks for the host and for

;;; wasm32-wasi so test/wasm/run-wasm-test.mjs can compare them. Not

;;; published; it exists to prove the narrow wasm build (Ed25519, BLAKE2b,

;;; minisign) works and that the Mbed TLS procedures fail clearly there.

;;;

;;; cd test/wasm && sigil deps install

;;; node run-wasm-test.mjs (builds both configs, runs, compares)

(package

name: "sigil-crypto-wasm-probe"

+10

version: "0.1.0"

+11

sigil: "0.22"

+12

description: "wasm and host differential probe for sigil-crypto"

+13

license: "BSD-3-Clause"

+14

entry: '(crypto-probe main)

+15

+16

configs: (list

+17

;; Host build: the reference output.

+18

(config

+19

name: 'host

+20

output-dir: "build/host"

+21

debug?: #f

+22

optimize: 2

+23

bundle?: #t)

+24

;; Static musl build: the release-binary shape.

+25

(config

+26

name: 'static

+27

output-dir: "build/static"

+28

toolchain: 'zig

+29

target: "x86_64-linux-musl"

+30

static?: #t

+31

debug?: #f

+32

optimize: 2

+33

bundle?: #t)

+34

;; Browser-shaped build: wasm32-wasi through zig with native codegen,

+35

;; the shape Crash The Stack ships. The eval ABI is force-exported so

+36

;; the Node harness can call the gated procedures by name.

+37

(config

+38

name: 'web

+39

output-dir: "build/web"

+40

toolchain: 'zig

+41

target: "wasm32-wasi"

+42

backend: 'native

+43

debug?: #f

+44

optimize: 2

+45

c-flags: (with-sigil-c-flags '("-std=c99" "-D_GNU_SOURCE" "-D__SIGIL_WASM__" "-Wall" "-O2"))

+46

link-flags: '("-Wl,--export=sigil_wasm_init"

+47

"-Wl,--export=sigil_wasm_start"

+48

"-Wl,--export=sigil_wasm_eval_string_length"

+49

"-Wl,--export=sigil_wasm_last_result_length"

+50

"-Wl,--export=sigil_wasm_copy_result"

+51

"-Wl,--export=malloc"

+52

"-Wl,--export=free"

+53

"-lc")

+54

features: '(web wasm)))

+55

+56

dependencies: (list

+57

(from-path dir: "../.." package: "sigil-crypto")

+58

(from-git url: "codeberg:sigil/sigil" package: "sigil-lib" version: ">=0.22")

+59

(from-git url: "codeberg:sigil/sigil" package: "sigil-stdlib" version: ">=0.22")

+60

(from-git url: "codeberg:sigil/sigil" package: "sigil-wasm-runtime" version: ">=0.22"))

+61

+62

tasks: (list

+63

(task

+64

name: 'build

+65

configs: '(web)

+66

description: "Build the wasm probe"

+67

steps: (list

+68

(compile-sigil-modules sources: "src/**/*.sgl")

+69

(link-web-application name: "sigil-crypto-wasm-probe")))))

test/wasm/run-wasm-test.mjsadded

@@ -0,0 +1,346 @@

#!/usr/bin/env node

//

// sigil-crypto wasm differential test.

//

// 1. Builds test/wasm for the host ('host), static musl ('static) and wasm32-wasi with

// native codegen ('web config), unless SIGIL_PROBE_SKIP_BUILD=1.

// 2. Runs the host bundle and the wasm module (in Node with a minimal WASI

// shim) and requires their outputs to match line for line, except lines

// starting "target:", which must show the Mbed TLS procedures working on

+10

// the host and refusing with "not available on wasm" on wasm.

+11

// 3. Checks every line against its expected value, so two identical wrong

+12

// outputs cannot pass.

+13

// 4. Drift gate: reads native/crypto.c, requires the wasm stub list to name

+14

// exactly the Mbed TLS natives the host registers, then calls each one

+15

// in the wasm module through the eval ABI and requires the refusal.

+16

//

+17

// Run from anywhere: node test/wasm/run-wasm-test.mjs

+18

// Needs: sigil on PATH, guix (for binaryen), node.

+19

// Exit 0 only on PASS. SETUP-FAILED (exit 2) when something could not be

+20

// built or found, so nothing was tested.

+21

+22

import { spawnSync } from "node:child_process";

+23

import fs from "node:fs";

+24

import path from "node:path";

+25

import { fileURLToPath } from "node:url";

+26

+27

const probeDir = path.dirname(fileURLToPath(import.meta.url));

+28

const repoRoot = path.resolve(probeDir, "../..");

+29

const hostBin = path.join(probeDir, "build/host/bin/sigil-crypto-wasm-probe");

+30

const wasmPath = path.join(probeDir, "build/web/sigil-crypto-wasm-probe.wasm");

+31

const staticBin = path.join(probeDir, "build/static/bin/sigil-crypto-wasm-probe");

+32

const cryptoC = path.join(repoRoot, "native/crypto.c");

+33

+34

let failures = 0;

+35

function fail(msg) {

+36

console.error(`FAIL: ${msg}`);

+37

failures += 1;

+38

}

+39

function setupFailed(msg) {

+40

console.error(`SETUP-FAILED: ${msg}`);

+41

process.exit(2);

+42

}

+43

+44

// Every non-target line and its expected value. A missing line fails.

+45

const EXPECTED = {

+46

"blake2b-512 abc":

+47

    "ba80a53f981c4d0d6a2797b69f12f6e94c212f14685ac4b74b12bb6fdbffa2d17d87c5392aab792dc252d5de4533cc9518d38aa8dbf1925ab92386edd4009923",

+48

"blake2b-512 binary.bin": null, // checked against coreutils b2sum below

+49

"ed25519 rfc8032 test 2 verifies": "#t",

+50

"ed25519 rfc8032 test 3 verifies": "#t",

+51

"ed25519 test 2 flipped message": "#f",

+52

"ed25519 test 3 flipped signature": "#f",

+53

"ed25519 test 3 flipped key": "#f",

+54

"ed25519 test 2 public key": "3d4017c3e843895a92b70aa74d1b7ebc9c982ccf2ec4968cc0cd55f12af4660c",

+55

"ed25519 test 2 signature":

+56

    "92a009a9f0d4cab8720e820b5f642540a2b27b5416503f8fb3762223ebdb69da085ac1e43e15996e458f3613d0f11d8c387b2eaeb4302aeeb00d291612bb0c00",

+57

"ed25519 31-byte key": "ed25519-verify: public key must be 32 bytes",

+58

"minisign key a id": null, // checked against a.pub's comment line below

+59

"minisign hello ED": "sigil-crypto fixture: prehashed",

+60

"minisign hello Ed": "sigil-crypto fixture: legacy",

+61

"minisign binary ED": "sigil-crypto fixture: binary",

+62

"minisign registry root":

+63

"registry=pkg.usesigil.org path=/v1/meta/registry.json seq=1 ts=2026-07-30T08:04:54Z",

+64

"minisign registry tampered": "bad-signature",

+65

"minisign hello tampered": "bad-signature",

+66

"minisign key mismatch": "key-id-mismatch",

+67

"minisign key b": "#f",

+68

"minisign legacy refused": "legacy-refused",

+69

"minisign bad key line": "minisign: public key has the wrong base64 length",

+70

"timing-safe-equal?": "#t",

+71

};

+72

const TARGET_LINES = ["target: sha256", "target: base64url-encode"];

+73

const WASM_REFUSAL = "not available on wasm";

+74

+75

function run(cmd, args, opts = {}) {

+76

const r = spawnSync(cmd, args, { encoding: "utf8", ...opts });

+77

return { status: r.status, out: (r.stdout || "") + (r.stderr || ""), error: r.error };

+78

}

+79

+80

function build() {

+81

// cwd is the probe directory: sigil resolves the project and its

+82

// dependencies from cwd, not from the location of any file.

+83

const host = run("nice", ["-n", "19", "sigil", "build", "--config", "host"], { cwd: probeDir });

+84

if (host.status !== 0) {

+85

process.stdout.write(host.out);

+86

setupFailed(`host build failed (exit ${host.status})`);

+87

}

+88

const stat = run("nice", ["-n", "19", "sigil", "build", "--config", "static"], { cwd: probeDir });

+89

if (stat.status !== 0) {

+90

process.stdout.write(stat.out);

+91

setupFailed(`static musl build failed (exit ${stat.status})`);

+92

}

+93

const web = run(

+94

"guix",

+95

["shell", "binaryen", "--", "sh", "-c", "command -v wasm-opt >/dev/null && nice -n 19 sigil build --config web"],

+96

{ cwd: probeDir },

+97

);

+98

if (web.status !== 0) {

+99

process.stdout.write(web.out);

+100

setupFailed(`web build failed (exit ${web.status})`);

+101

}

+102

if (/vendor\/mbedtls\/library/.test(web.out)) {

+103

fail("the web build compiled Mbed TLS sources; the wasm build must skip them");

+104

}

+105

}

+106

+107

function describe(file) {

+108

if (!fs.existsSync(file)) setupFailed(`missing artifact ${file}`);

+109

const st = fs.statSync(file);

+110

console.log(`artifact ${file} ${st.size} bytes, mtime ${st.mtime.toISOString()}`);

+111

}

+112

+113

// Minimal WASI preview1 shim, after sigil's test-native-facade-reexport.mjs.

+114

function makeWasi(module, output) {

+115

let instance = null;

+116

const decoder = new TextDecoder();

+117

const view = () => new DataView(instance.exports.memory.buffer);

+118

const u8 = () => new Uint8Array(instance.exports.memory.buffer);

+119

const known = {

+120

fd_write(fd, iovsPtr, iovsLen, nwrittenPtr) {

+121

let written = 0;

+122

let text = "";

+123

for (let i = 0; i < iovsLen; i += 1) {

+124

const ptr = view().getUint32(iovsPtr + i * 8, true);

+125

const len = view().getUint32(iovsPtr + i * 8 + 4, true);

+126

text += decoder.decode(u8().subarray(ptr, ptr + len));

+127

written += len;

+128

}

+129

if (fd === 1 || fd === 2) output.push(text);

+130

if (nwrittenPtr) view().setUint32(nwrittenPtr, written, true);

+131

return 0;

+132

},

+133

proc_exit(code) {

+134

throw new Error(`WASI proc_exit(${code})`);

+135

},

+136

args_sizes_get(argcPtr, argvBufSizePtr) {

+137

view().setUint32(argcPtr, 0, true);

+138

view().setUint32(argvBufSizePtr, 0, true);

+139

return 0;

+140

},

+141

environ_sizes_get(countPtr, bufSizePtr) {

+142

view().setUint32(countPtr, 0, true);

+143

view().setUint32(bufSizePtr, 0, true);

+144

return 0;

+145

},

+146

clock_time_get(_id, _precision, timePtr) {

+147

view().setBigUint64(timePtr, BigInt(Date.now()) * 1000000n, true);

+148

return 0;

+149

},

+150

// Ed25519 verification needs no entropy. The runtime may still ask

+151

// (hash seeds); this shim answers from Math.random, which is fine for

+152

// a test and would not be for anything that generates keys.

+153

random_get(ptr, len) {

+154

const bytes = u8();

+155

for (let i = 0; i < len; i += 1) bytes[ptr + i] = (Math.random() * 256) | 0;

+156

return 0;

+157

},

+158

fd_fdstat_get(_fd, statPtr) {

+159

u8().fill(0, statPtr, statPtr + 24);

+160

view().setUint8(statPtr, 2);

+161

return 0;

+162

},

+163

fd_fdstat_set_flags() { return 0; },

+164

fd_filestat_get(_fd, statPtr) {

+165

u8().fill(0, statPtr, statPtr + 64);

+166

view().setUint8(statPtr + 16, 2);

+167

return 0;

+168

},

+169

fd_close() { return 0; },

+170

fd_seek() { return 0; },

+171

fd_fdstat_set_rights() { return 0; },

+172

fd_prestat_get() { return 8; },

+173

fd_prestat_dir_name() { return 8; },

+174

path_open() { return 44; },

+175

};

+176

const wasi = {};

+177

for (const entry of WebAssembly.Module.imports(module)) {

+178

if (entry.module === "wasi_snapshot_preview1") {

+179

wasi[entry.name] = known[entry.name] || (() => 0);

+180

}

+181

}

+182

return {

+183

imports: { wasi_snapshot_preview1: wasi },

+184

setInstance(value) { instance = value; },

+185

};

+186

}

+187

+188

function parseLines(text) {

+189

const map = new Map();

+190

const order = [];

+191

for (const line of text.split("\n")) {

+192

const i = line.indexOf(": ");

+193

if (i < 0) continue;

+194

const key = line.startsWith("target: ") ? line.slice(0, line.indexOf(": ", 8)) : line.slice(0, i);

+195

const value = line.slice(key.length + 2);

+196

map.set(key, value);

+197

order.push(key);

+198

}

+199

return { map, order };

+200

}

+201

+202

async function runWasm() {

+203

const output = [];

+204

const module = await WebAssembly.compile(fs.readFileSync(wasmPath));

+205

const wasi = makeWasi(module, output);

+206

const extra = {};

+207

for (const entry of WebAssembly.Module.imports(module)) {

+208

if (entry.module === "wasi_snapshot_preview1") continue;

+209

extra[entry.module] ??= {};

+210

if (entry.kind === "function") extra[entry.module][entry.name] = () => 0;

+211

}

+212

const instance = await WebAssembly.instantiate(module, { ...wasi.imports, ...extra });

+213

wasi.setInstance(instance);

+214

const ex = instance.exports;

+215

for (const sym of ["sigil_wasm_init", "sigil_wasm_start", "sigil_wasm_eval_string_length", "malloc"]) {

+216

if (typeof ex[sym] !== "function") setupFailed(`wasm module does not export ${sym}`);

+217

}

+218

if (ex.sigil_wasm_init() !== 0) setupFailed("sigil_wasm_init failed");

+219

const startRc = ex.sigil_wasm_start();

+220

const compiled = output.join("");

+221

output.length = 0;

+222

+223

const encoder = new TextEncoder();

+224

const evalStr = (expr) => {

+225

const bytes = encoder.encode(expr);

+226

const ptr = ex.malloc(bytes.length + 1);

+227

const mem = new Uint8Array(ex.memory.buffer);

+228

mem.set(bytes, ptr);

+229

mem[ptr + bytes.length] = 0;

+230

const rc = ex.sigil_wasm_eval_string_length(ptr);

+231

ex.free(ptr);

+232

if (rc < 0) return { rc, result: output.splice(0).join("") };

+233

const len = ex.sigil_wasm_last_result_length();

+234

const dest = ex.malloc(Math.max(len, 1));

+235

const n = ex.sigil_wasm_copy_result(dest, len);

+236

const text = new TextDecoder().decode(new Uint8Array(ex.memory.buffer, dest, n));

+237

ex.free(dest);

+238

return { rc, result: text.replace(/^"|"$/g, "") };

+239

};

+240

return { compiled, startRc, evalStr };

+241

}

+242

+243

function checkExpected(label, lines) {

+244

for (const [key, want] of Object.entries(EXPECTED)) {

+245

if (!lines.map.has(key)) {

+246

fail(`${label}: line "${key}" missing`);

+247

} else if (want !== null && lines.map.get(key) !== want) {

+248

fail(`${label}: "${key}" = ${JSON.stringify(lines.map.get(key))}, want ${JSON.stringify(want)}`);

+249

}

+250

}

+251

}

+252

+253

async function main() {

+254

if (process.env.SIGIL_PROBE_SKIP_BUILD !== "1") build();

+255

const lock = path.join(probeDir, "sigil.lock");

+256

if (fs.existsSync(lock)) {

+257

    const entries = [...fs.readFileSync(lock, "utf8").matchAll(/name: "([^"]+)"[\s\S]*?sha: "([^"]*)"[\s\S]*?version: "([^"]+)"/g)];

+258

for (const [, name, sha, version] of entries) {

+259

if (name === "sigil-crypto") continue; // from ../..; its lock sha is stale by design

+260

console.log(`input ${name} ${version} ${sha.slice(0, 12)}`);

+261

}

+262

}

+263

{

+264

const head = run("git", ["-C", repoRoot, "rev-parse", "HEAD"]).out.trim();

+265

    const dirty = run("git", ["-C", repoRoot, "status", "--porcelain", "--", ".", ":!test/wasm/sigil.lock"]).out.trim() !== "";

+266

console.log(`input sigil-crypto (from ../..) ${head.slice(0, 12)}${dirty ? " +uncommitted changes" : ""}`);

+267

}

+268

describe(hostBin);

+269

describe(wasmPath);

+270

describe(staticBin);

+271

+272

// Host run. cwd is the probe dir, for the same reason as the build.

+273

const host = run(hostBin, [], { cwd: probeDir });

+274

if (host.status !== 0 || !host.out.includes("REACHED-END")) {

+275

process.stdout.write(host.out);

+276

setupFailed(`host probe did not complete (exit ${host.status})`);

+277

}

+278

// Static musl build: must print exactly what the host prints, target

+279

// lines included (Mbed TLS is built there).

+280

const stat = run(staticBin, [], { cwd: probeDir });

+281

if (stat.status !== 0 || stat.out !== host.out) fail(`static musl output differs from host (exit ${stat.status})`);

+282

else console.log(`static musl: output identical to host (${host.out.trim().split("\n").length} lines)`);

+283

const wasm = await runWasm();

+284

process.stdout.write(`=== wasm (sigil_wasm_start -> ${wasm.startRc}) ===\n${wasm.compiled}`);

+285

if (!wasm.compiled.includes("REACHED-END")) fail("wasm probe did not reach the end");

+286

+287

const h = parseLines(host.out);

+288

const w = parseLines(wasm.compiled);

+289

+290

// Independent values for the two lines EXPECTED leaves open.

+291

const b2 = run("b2sum", [path.join(repoRoot, "test/fixtures/minisign/binary.bin")]);

+292

if (b2.status !== 0) setupFailed("b2sum did not run");

+293

EXPECTED["blake2b-512 binary.bin"] = b2.out.split(" ")[0];

+294

const pubComment = fs.readFileSync(path.join(repoRoot, "test/fixtures/minisign/a.pub"), "utf8").split("\n")[0];

+295

EXPECTED["minisign key a id"] = pubComment.slice(-16);

+296

+297

checkExpected("host", h);

+298

checkExpected("wasm", w);

+299

+300

// Line-for-line agreement outside the target lines.

+301

const hOrder = h.order.filter((k) => !k.startsWith("target: "));

+302

const wOrder = w.order.filter((k) => !k.startsWith("target: "));

+303

if (JSON.stringify(hOrder) !== JSON.stringify(wOrder)) fail("host and wasm print different line sequences");

+304

let agreed = 0;

+305

for (const key of hOrder) {

+306

if (h.map.get(key) === w.map.get(key)) agreed += 1;

+307

else fail(`differential: "${key}" host=${JSON.stringify(h.map.get(key))} wasm=${JSON.stringify(w.map.get(key))}`);

+308

}

+309

console.log(`differential: ${agreed}/${hOrder.length} lines agree`);

+310

+311

for (const key of TARGET_LINES) {

+312

if (h.map.get(key) !== "no-error") fail(`host ${key}: ${JSON.stringify(h.map.get(key))}, want no-error`);

+313

    if (!(w.map.get(key) || "").includes(WASM_REFUSAL)) fail(`wasm ${key}: ${JSON.stringify(w.map.get(key))}, want the refusal`);

+314

}

+315

+316

// Drift gate: the stub list in crypto.c against the host registrations.

+317

const src = fs.readFileSync(cryptoC, "utf8");

+318

const stubBlock = src.match(/mbedtls_only_natives\[\] = \{([\s\S]*?)NULL/);

+319

if (!stubBlock) setupFailed("could not find mbedtls_only_natives in crypto.c");

+320

const stubs = [...stubBlock[1].matchAll(/"([^"]+)"/g)].map((m) => m[1]).sort();

+321

const registered = [...src.matchAll(/REGISTER_AND_EXPORT\("([^"]+)"/g)].map((m) => m[1]).sort();

+322

if (registered.length < 20) setupFailed(`found only ${registered.length} REGISTER_AND_EXPORT names`);

+323

if (JSON.stringify(stubs) !== JSON.stringify(registered)) {

+324

    fail(`wasm stub list != host Mbed TLS registrations\n  stubs only: ${stubs.filter((s) => !registered.includes(s))}\n  host only: ${registered.filter((s) => !stubs.includes(s))}`);

+325

}

+326

let refused = 0;

+327

for (const name of registered) {

+328

const { rc, result } = wasm.evalStr(

+329

      `(begin (import (sigil crypto)) (guard (e (#t (if (error-object? e) (error-object-message e) "non-error raise"))) (${name}) "no-error"))`,

+330

);

+331

if (rc >= 0 && result.includes(WASM_REFUSAL)) refused += 1;

+332

else fail(`wasm eval (${name}): rc=${rc} ${JSON.stringify(result)}`);

+333

}

+334

console.log(`drift gate: ${registered.length} Mbed TLS natives, ${refused} refuse on wasm`);

+335

// Positive control for the eval path itself: it must be able to succeed.

+336

  const control = wasm.evalStr(`(begin (import (sigil crypto)) (number->string (bytevector-length (blake2b-512 "abc"))))`);

+337

  if (control.rc < 0 || control.result !== "64") fail(`eval positive control: rc=${control.rc} ${JSON.stringify(control.result)}`);

+338

+339

if (failures) {

+340

console.error(`FAIL: ${failures} check(s) failed`);

+341

process.exit(1);

+342

}

+343

console.log("PASS: sigil-crypto wasm build matches the host; Mbed TLS procedures refuse on wasm");

+344

}

+345

+346

await main();

test/wasm/src/crypto-probe/fixtures.sgladded

@@ -0,0 +1,34 @@

;;; GENERATED by test/wasm/gen-fixtures.sh from test/fixtures/minisign.

;;; Do not edit by hand.

(define-library (crypto-probe fixtures)

(export fixture)

(import (sigil core) (sigil math))

(begin

(define (hex->bv s)

(let* ((n (quotient (string-length s) 2))

(bv (make-bytevector n 0)))

+10

(let loop ((i 0))

+11

(if (< i n)

+12

(begin

+13

(bytevector-u8-set! bv i (string->number (substring s (* 2 i) (+ 2 (* 2 i))) 16))

+14

(loop (+ i 1)))

+15

bv))))

+16

(define fixtures

+17

(list

+18

        (cons "a.pub" "756e7472757374656420636f6d6d656e743a206d696e697369676e207075626c6963206b657920313445423346423239304239363230340a5257514559726d51736a2f72464f49547836574f666b314a56754f736c4a56377a777668366d4d334e43444a48687359666c6c634153414d0a")

+19

        (cons "b.pub" "756e7472757374656420636f6d6d656e743a206d696e697369676e207075626c6963206b657920433138413242433839433131313645340a5257546b466847637943754b77636161794b67714268463474584262784c6c596435597a7752414a6945312b55424e2f566a734f36656d740a")

+20

(cons "hello.txt" "68656c6c6f2c206d696e697369676e0a")

+21

        (cons "hello.txt.ED.minisig" "756e7472757374656420636f6d6d656e743a207369676e61747572652066726f6d206d696e697369676e20736563726574206b65790a5255514559726d51736a2f724647417954744b512b34785a4b2b30673366544d78727764775678375a6a6a393948413777746b494c704270354b4a4b633630513647622f2b5945424f464d47644f2f69457a507345315374456c59744b536c6664674d3d0a7472757374656420636f6d6d656e743a20736967696c2d63727970746f20666978747572653a207072656861736865640a6757456d34687931356a54394a4e517154716c6c6335387742647075316d3462444a79636d677162504b6b722f5a622b51752f522b523561534879336b4c3351377679344c5a74414253644750344f595075546241673d3d0a")

+22

        (cons "hello.txt.Ed.minisig" "756e7472757374656420636f6d6d656e743a207369676e61747572652066726f6d206d696e697369676e20736563726574206b65790a5257514559726d51736a2f724642796b59426163384f654b69624a53594b63642b7672564d513434426e6d70624269626732524d6937356143347a4a4b6e506232713459776d554566616e665563634a344e6e39756a476d6b7875692f4d73316351383d0a7472757374656420636f6d6d656e743a20736967696c2d63727970746f20666978747572653a206c65676163790a6e3346334b6255765a454e5a4d72674d656b38634d343872526174476257306e3552684b505237594b637577416277396262304e6351706f3633355042775134516a6f47356d4f584162557a317453687a314a7741673d3d0a")

+23

        (cons "hello.txt.keyb.minisig" "756e7472757374656420636f6d6d656e743a207369676e61747572652066726f6d206d696e697369676e20736563726574206b65790a5255546b466847637943754b7759544d556f345838636465433363334c664731725344667a304d6e6341344a55363062353152656155533533544f4b307a6a6e594873354a5773686374457a554d414c73493069776d2b364d563264416f72305a676f3d0a7472757374656420636f6d6d656e743a20736967696c2d63727970746f20666978747572653a206b657920620a32667a314277766f35386777676b6554483443587a79484133634f365969423975325a656a6e47346d495a47305a374b7158763153544d6f6e5a307931354259356e3535476e512b3937647866612b6c52704f6c41673d3d0a")

+24

        (cons "binary.bin" "000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f202122232425262728292a2b2c2d2e2f303132333435363738393a3b3c3d3e3f404142434445464748494a4b4c4d4e4f505152535455565758595a5b5c5d5e5f606162636465666768696a6b6c6d6e6f707172737475767778797a7b7c7d7e7f808182838485868788898a8b8c8d8e8f909192939495969798999a9b9c9d9e9fa0a1a2a3a4a5a6a7a8a9aaabacadaeafb0b1b2b3b4b5b6b7b8b9babbbcbdbebfc0c1c2c3c4c5c6c7c8c9cacbcccdcecfd0d1d2d3d4d5d6d7d8d9dadbdcdddedfe0e1e2e3e4e5e6e7e8e9eaebecedeeeff0f1f2f3f4f5f6f7f8f9fafbfcfdfeff000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f202122232425262728292a2b2c2d2e2f303132333435363738393a3b3c3d3e3f404142434445464748494a4b4c4d4e4f505152535455565758595a5b5c5d5e5f606162636465666768696a6b6c6d6e6f707172737475767778797a7b7c7d7e7f808182838485868788898a8b8c8d8e8f909192939495969798999a9b9c9d9e9fa0a1a2a3a4a5a6a7a8a9aaabacadaeafb0b1b2b3b4b5b6b7b8b9babbbcbdbebfc0c1c2c3c4c5c6c7c8c9cacbcccdcecfd0d1d2d3d4d5d6d7d8d9dadbdcdddedfe0e1e2e3e4e5e6e7e8e9eaebecedeeeff0f1f2f3f4f5f6f7f8f9fafbfcfdfeff000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f202122232425262728292a2b2c2d2e2f303132333435363738393a3b3c3d3e3f404142434445464748494a4b4c4d4e4f505152535455565758595a5b5c5d5e5f606162636465666768696a6b6c6d6e6f707172737475767778797a7b7c7d7e7f808182838485868788898a8b8c8d8e8f909192939495969798999a9b9c9d9e9fa0a1a2a3a4a5a6a7a8a9aaabacadaeafb0b1b2b3b4b5b6b7b8b9babbbcbdbebfc0c1c2c3c4c5c6c7c8c9cacbcccdcecfd0d1d2d3d4d5d6d7d8d9dadbdcdddedfe0e1e2e3e4e5e6e7e8e9eaebecedeeeff0f1f2f3f4f5f6f7f8f9fafbfcfdfeff000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f202122232425262728292a2b2c2d2e2f303132333435363738393a3b3c3d3e3f404142434445464748494a4b4c4d4e4f505152535455565758595a5b5c5d5e5f606162636465666768696a6b6c6d6e6f707172737475767778797a7b7c7d7e7f808182838485868788898a8b8c8d8e8f909192939495969798999a9b9c9d9e9fa0a1a2a3a4a5a6a7a8a9aaabacadaeafb0b1b2b3b4b5b6b7b8b9babbbcbdbebfc0c1c2c3c4c5c6c7c8c9cacbcccdcecfd0d1d2d3d4d5d6d7d8d9dadbdcdddedfe0e1e2e3e4e5e6e7e8e9eaebecedeeeff0f1f2f3f4f5f6f7f8f9fafbfcfdfeff")

+25

        (cons "binary.bin.ED.minisig" "756e7472757374656420636f6d6d656e743a207369676e61747572652066726f6d206d696e697369676e20736563726574206b65790a5255514559726d51736a2f72464c5637755a7575444f5a6e64626c434731743768765341702b377376636d35436f38496d556e555232362f4664307a44614f2b55702b304e5253654c446c5a7a376f32694b466d6d324b534f5069682f5969692b51633d0a7472757374656420636f6d6d656e743a20736967696c2d63727970746f20666978747572653a2062696e6172790a7832334f395961554a63626d41414f6f5266357a536f52476a3867766c33666a4556356e4d746c43717a38694775443263304e6556622b74636f733930764d496b6a4f763748496c44446c7253332b4d6730696143413d3d0a")

+26

        (cons "registry.json" "7b0a202022736368656d61223a20312c0a20202270726f746f636f6c223a20312c0a2020227265676973747279223a2022706b672e757365736967696c2e6f7267222c0a202022736571223a20312c0a20202275706461746564223a2022323032362d30372d33305430383a30343a35345a222c0a2020226b657973223a205b0a202020207b226964223a2243343545313135304432443346353541222c22616c676f726974686d223a226d696e697369676e2d65643235353139222c22726f6c6573223a5b22726f6f74225d2c227075626c69632d6b6579223a225257526139645053554246657842624c647a5a496675416d7543594c3733365565484337496264414f49597067474979446d575261514859222c22737461747573223a22616374697665227d2c0a202020207b226964223a2232314343394245333136433645304644222c22616c676f726974686d223a226d696e697369676e2d65643235353139222c22726f6c6573223a5b22696e646578225d2c227075626c69632d6b6579223a2252575439344d59573435764d49624964517572494d6b343649445a514d69487a6c50375677595150564e7a74784a77453233466b48755231222c22737461747573223a22616374697665227d2c0a202020207b226964223a2237463932423432363036304632463036222c22616c676f726974686d223a226d696e697369676e2d65643235353139222c22726f6c6573223a5b22746f6f6c636861696e225d2c227075626c69632d6b6579223a22525751474c7738474a725353667a756463792f766e4d67557a6f45557656646d5a78797a413230414a36675375736a516b33656233614255222c22737461747573223a22616374697665227d2c0a202020207b226964223a2244423141383238424430333446353935222c22616c676f726974686d223a226d696e697369676e2d65643235353139222c22726f6c6573223a5b227375627374697475746573225d2c227075626c69632d6b6579223a22525753563954545169344961327a7647674261636c48483877494334632f4531323439587265696b4a38673055342f7a2b76734d37377032222c22737461747573223a22616374697665227d2c0a202020207b226964223a2239383945463534463545393343373336222c22616c676f726974686d223a226d696e697369676e2d65643235353139222c22726f6c6573223a5b226368616e6e656c73225d2c227075626c69632d6b6579223a225257513278354e65542f57656d4773493361562f4738676e724c65765166746149594943326430364650636f5356376e316863616e306a30222c22737461747573223a22616374697665227d0a20205d2c0a2020226c6f67223a206e756c6c2c0a202022726570726f6475636962696c697479223a206e756c6c0a7d0a")

+27

        (cons "registry.json.minisig" "756e7472757374656420636f6d6d656e743a207369676e61747572652066726f6d206d696e697369676e20736563726574206b65790a52555261396450535542466578474a4743366d2b6672345552583343362f31346237637638354662546775693464434f41524f6a2f784130567934536e35755862426c734f5739504259514e7a2b625a326676515072344f35712f2f2b626b4c6b51773d0a7472757374656420636f6d6d656e743a2072656769737472793d706b672e757365736967696c2e6f726720706174683d2f76312f6d6574612f72656769737472792e6a736f6e207365713d312074733d323032362d30372d33305430383a30343a35345a0a434c37584e576d56354b6c6f366249484538783249584631384c777148665a503272796e6d6f535072527a44434c4a746c4766772b4d4c783763514759535a6f2f4c6b346341324f474d46412f4f31517a59425943773d3d0a")

+28

))

+29

;; The fixture's bytes; raises for an unknown name.

+30

(define (fixture name)

+31

(let ((entry (assoc name fixtures)))

+32

(if entry

+33

(hex->bv (cdr entry))

+34

(error (string-append "no such fixture: " name)))))))

test/wasm/src/crypto-probe/main.sgladded

@@ -0,0 +1,88 @@

;;; The sigil-crypto wasm probe: one line per check, printed identically on

;;; every target. test/wasm/run-wasm-test.mjs builds this for the host and

;;; for wasm32-wasi, runs both, and requires the two outputs to match line

;;; for line (except lines starting "target:", which say what the target

;;; is expected to differ on), and each line to have its expected value.

(define-library (crypto-probe main)

(import (sigil core)

(sigil io)

(sigil math)

+10

(sigil crypto)

+11

(sigil crypto minisign)

+12

(crypto-probe fixtures))

+13

(export main)

+14

(begin

+15

(define (hex->bv s)

+16

(let* ((n (quotient (string-length s) 2))

+17

(bv (make-bytevector n 0)))

+18

(let loop ((i 0))

+19

(if (< i n)

+20

(begin

+21

(bytevector-u8-set! bv i (string->number (substring s (* 2 i) (+ 2 (* 2 i))) 16))

+22

(loop (+ i 1)))

+23

bv))))

+24

+25

(define (bv->hex bv)

+26

(let loop ((i 0) (acc '()))

+27

(if (< i (bytevector-length bv))

+28

(let* ((b (bytevector-u8-ref bv i))

+29

(h (number->string b 16)))

+30

(loop (+ i 1) (cons (if (< b 16) (string-append "0" h) h) acc)))

+31

(apply string-append (reverse acc)))))

+32

+33

(define (flip-byte bv index)

+34

(let ((out (bytevector-copy bv)))

+35

(bytevector-u8-set! out index (bitwise-xor (bytevector-u8-ref out index) 1))

+36

out))

+37

+38

;; The message of whatever `thunk` raises, or "no-error".

+39

(define (raised-message thunk)

+40

(guard (e (#t (if (error-object? e) (error-object-message e) "non-error raise")))

+41

(thunk)

+42

"no-error"))

+43

+44

(define (show label value) (println "~a: ~a" label value))

+45

+46

;; RFC 8032 section 7.1 TEST 2 and TEST 3.

+47

(define t2-seed (hex->bv "4ccd089b28ff96da9db6c346ec114e0f5b8a319f35aba624da8cf6ed4fb8a6fb"))

+48

(define t2-pk (hex->bv "3d4017c3e843895a92b70aa74d1b7ebc9c982ccf2ec4968cc0cd55f12af4660c"))

+49

(define t2-msg (hex->bv "72"))

+50

    (define t2-sig (hex->bv "92a009a9f0d4cab8720e820b5f642540a2b27b5416503f8fb3762223ebdb69da085ac1e43e15996e458f3613d0f11d8c387b2eaeb4302aeeb00d291612bb0c00"))

+51

(define t3-pk (hex->bv "fc51cd8e6218a1a38da47ed00230f0580816ed13ba3303ac5deb911548908025"))

+52

(define t3-msg (hex->bv "af82"))

+53

    (define t3-sig (hex->bv "6291d657deec24024827e69c3abe01a30ce548a284743a445e3680d7db5ac3ac18ff9b538d16f290ae67f760984dc6594a7c15e9716ed28dc027beceea1ec40a"))

+54

+55

(define (main . args)

+56

(let ((key-a (minisign-parse-public-key (fixture "a.pub")))

+57

(key-b (minisign-parse-public-key (fixture "b.pub")))

+58

(root (minisign-parse-public-key

+59

"RWRa9dPSUBFexBbLdzZIfuAmuCYL736UeHC7IbdAOIYpgGIyDmWRaQHY"))

+60

(hello (fixture "hello.txt"))

+61

(sig (lambda (name) (minisign-parse-signature (fixture name)))))

+62

(show "blake2b-512 abc" (bv->hex (blake2b-512 "abc")))

+63

(show "blake2b-512 binary.bin" (bv->hex (blake2b-512 (fixture "binary.bin"))))

+64

(show "ed25519 rfc8032 test 2 verifies" (ed25519-verify t2-pk t2-msg t2-sig))

+65

(show "ed25519 rfc8032 test 3 verifies" (ed25519-verify t3-pk t3-msg t3-sig))

+66

(show "ed25519 test 2 flipped message" (ed25519-verify t2-pk (flip-byte t2-msg 0) t2-sig))

+67

(show "ed25519 test 3 flipped signature" (ed25519-verify t3-pk t3-msg (flip-byte t3-sig 5)))

+68

(show "ed25519 test 3 flipped key" (ed25519-verify (flip-byte t3-pk 7) t3-msg t3-sig))

+69

(show "ed25519 test 2 public key" (bv->hex (ed25519-public-key t2-seed)))

+70

(show "ed25519 test 2 signature" (bv->hex (ed25519-sign t2-seed t2-msg)))

+71

(show "ed25519 31-byte key" (raised-message (lambda () (ed25519-verify (make-bytevector 31 0) "m" t2-sig))))

+72

(show "minisign key a id" (minisign-public-key-id key-a))

+73

(show "minisign hello ED" (minisign-verify key-a (sig "hello.txt.ED.minisig") hello))

+74

(show "minisign hello Ed" (minisign-verify key-a (sig "hello.txt.Ed.minisig") hello))

+75

(show "minisign binary ED" (minisign-verify key-a (sig "binary.bin.ED.minisig") (fixture "binary.bin")))

+76

        (show "minisign registry root" (minisign-verify-prehashed root (sig "registry.json.minisig") (fixture "registry.json")))

+77

        (show "minisign registry tampered" (minisign-failure-reason root (sig "registry.json.minisig") (flip-byte (fixture "registry.json") 100) #t))

+78

        (show "minisign hello tampered" (minisign-failure-reason key-a (sig "hello.txt.ED.minisig") (flip-byte hello 0) #f))

+79

(show "minisign key mismatch" (minisign-failure-reason key-a (sig "hello.txt.keyb.minisig") hello #f))

+80

(show "minisign key b" (minisign-failure-reason key-b (sig "hello.txt.keyb.minisig") hello #f))

+81

(show "minisign legacy refused" (minisign-failure-reason key-a (sig "hello.txt.Ed.minisig") hello #t))

+82

(show "minisign bad key line" (raised-message (lambda () (minisign-parse-public-key "RWQ"))))

+83

(show "timing-safe-equal?" (timing-safe-equal? "abc" "abc"))

+84

;; Differs by design: Mbed TLS is not built for wasm.

+85

(show "target: sha256" (raised-message (lambda () (sha256 "abc"))))

+86

(show "target: base64url-encode" (raised-message (lambda () (base64url-encode "abc"))))

+87

(println "REACHED-END")

+88

0))))