nx_ed25519_signature_test.nx source
↩ module page · 112 lines · 5057 B
1// nx_ed25519_signature_test.nx -- RFC 8032 ยง7.1 TEST 1 KAT.
2//
3// Vector:
4// priv: 9d61b19deffd5a60ba844af492ec2cc44449c5697b326919703bac031cae7f60
5// pub : d75a980182b10ab7d54bfed3c964073a0ee172f3daa62325af021a68f707511a
6// msg : (empty)
7// sig : e5564300c360ac729086e2cc806e828a84877f1eb8e5d974d873e065224901555f
8// b8821590a33bacc61e39701cf9b46bd25bf5f0595bbe24655141438e7a100b
9//
10// Tests:
11// A. ed25519_sign(priv, empty) produces sig byte-exact
12// B. ed25519_verify_full(pub, empty, sig) == OK
13// C. ed25519_verify_full(pub, empty, sig_with_tampered_byte) == BAD
14// D. ed25519_verify_full(pub, 1-byte msg, sig) == BAD (wrong message)
15// E. ed25519_verify_full(other_pub, empty, sig) == BAD (wrong pubkey)
16//
17// expect_exit: 0
18// license_tier: ORIGINAL
19
20import "nx_syscalls.nx"
21import "nx_x25519.nx"
22import "nx_ed25519_field.nx"
23import "nx_ed25519_point.nx"
24import "nx_ed25519_arith.nx"
25import "nx_ed25519_scalar.nx"
26import "nx_ed25519_signature.nx"
27
28func main() -> i64 {
29 // ---- Inputs ----
30 let priv: *u8 = sys_mmap(64)
31 priv[0]=0x9d; priv[1]=0x61; priv[2]=0xb1; priv[3]=0x9d
32 priv[4]=0xef; priv[5]=0xfd; priv[6]=0x5a; priv[7]=0x60
33 priv[8]=0xba; priv[9]=0x84; priv[10]=0x4a; priv[11]=0xf4
34 priv[12]=0x92; priv[13]=0xec; priv[14]=0x2c; priv[15]=0xc4
35 priv[16]=0x44; priv[17]=0x49; priv[18]=0xc5; priv[19]=0x69
36 priv[20]=0x7b; priv[21]=0x32; priv[22]=0x69; priv[23]=0x19
37 priv[24]=0x70; priv[25]=0x3b; priv[26]=0xac; priv[27]=0x03
38 priv[28]=0x1c; priv[29]=0xae; priv[30]=0x7f; priv[31]=0x60
39
40 let pub: *u8 = sys_mmap(64)
41 pub[0]=0xd7; pub[1]=0x5a; pub[2]=0x98; pub[3]=0x01
42 pub[4]=0x82; pub[5]=0xb1; pub[6]=0x0a; pub[7]=0xb7
43 pub[8]=0xd5; pub[9]=0x4b; pub[10]=0xfe; pub[11]=0xd3
44 pub[12]=0xc9; pub[13]=0x64; pub[14]=0x07; pub[15]=0x3a
45 pub[16]=0x0e; pub[17]=0xe1; pub[18]=0x72; pub[19]=0xf3
46 pub[20]=0xda; pub[21]=0xa6; pub[22]=0x23; pub[23]=0x25
47 pub[24]=0xaf; pub[25]=0x02; pub[26]=0x1a; pub[27]=0x68
48 pub[28]=0xf7; pub[29]=0x07; pub[30]=0x51; pub[31]=0x1a
49
50 let expected_sig: *u8 = sys_mmap(128)
51 expected_sig[0]=0xe5; expected_sig[1]=0x56; expected_sig[2]=0x43; expected_sig[3]=0x00
52 expected_sig[4]=0xc3; expected_sig[5]=0x60; expected_sig[6]=0xac; expected_sig[7]=0x72
53 expected_sig[8]=0x90; expected_sig[9]=0x86; expected_sig[10]=0xe2; expected_sig[11]=0xcc
54 expected_sig[12]=0x80; expected_sig[13]=0x6e; expected_sig[14]=0x82; expected_sig[15]=0x8a
55 expected_sig[16]=0x84; expected_sig[17]=0x87; expected_sig[18]=0x7f; expected_sig[19]=0x1e
56 expected_sig[20]=0xb8; expected_sig[21]=0xe5; expected_sig[22]=0xd9; expected_sig[23]=0x74
57 expected_sig[24]=0xd8; expected_sig[25]=0x73; expected_sig[26]=0xe0; expected_sig[27]=0x65
58 expected_sig[28]=0x22; expected_sig[29]=0x49; expected_sig[30]=0x01; expected_sig[31]=0x55
59 expected_sig[32]=0x5f; expected_sig[33]=0xb8; expected_sig[34]=0x82; expected_sig[35]=0x15
60 expected_sig[36]=0x90; expected_sig[37]=0xa3; expected_sig[38]=0x3b; expected_sig[39]=0xac
61 expected_sig[40]=0xc6; expected_sig[41]=0x1e; expected_sig[42]=0x39; expected_sig[43]=0x70
62 expected_sig[44]=0x1c; expected_sig[45]=0xf9; expected_sig[46]=0xb4; expected_sig[47]=0x6b
63 expected_sig[48]=0xd2; expected_sig[49]=0x5b; expected_sig[50]=0xf5; expected_sig[51]=0xf0
64 expected_sig[52]=0x59; expected_sig[53]=0x5b; expected_sig[54]=0xbe; expected_sig[55]=0x24
65 expected_sig[56]=0x65; expected_sig[57]=0x51; expected_sig[58]=0x41; expected_sig[59]=0x43
66 expected_sig[60]=0x8e; expected_sig[61]=0x7a; expected_sig[62]=0x10; expected_sig[63]=0x0b
67
68 let empty_msg: *u8 = sys_mmap(8)
69
70 // ---- Test A: sign produces expected sig byte-exact ----
71 let sig: *u8 = sys_mmap(128)
72 ed25519_sign_full(priv, empty_msg, 0, sig)
73 var i: i64 = 0
74 while i < 64 {
75 if (sig[i] & 0xff) != (expected_sig[i] & 0xff) { return 1 + i }
76 i = i + 1
77 }
78
79 // ---- Test B: verify accepts the produced (= expected) sig ----
80 let v1: i64 = ed25519_verify_full(pub, empty_msg, 0, sig)
81 if v1 != NX_ED25519_SIG_OK { return 100 }
82
83 // ---- Test C: tampered sig rejected ----
84 let bad_sig: *u8 = sys_mmap(128)
85 var bi: i64 = 0
86 while bi < 64 {
87 bad_sig[bi] = sig[bi]
88 bi = bi + 1
89 }
90 bad_sig[30] = bad_sig[30] ^ 0x40
91 let v2: i64 = ed25519_verify_full(pub, empty_msg, 0, bad_sig)
92 if v2 != NX_ED25519_SIG_BAD { return 101 }
93
94 // ---- Test D: verify with wrong msg (1-byte 0x72) rejected ----
95 let wrong_msg: *u8 = sys_mmap(8)
96 wrong_msg[0] = 0x72
97 let v3: i64 = ed25519_verify_full(pub, wrong_msg, 1, sig)
98 if v3 != NX_ED25519_SIG_BAD { return 102 }
99
100 // ---- Test E: verify with different pubkey rejected ----
101 let other_pub: *u8 = sys_mmap(64)
102 bi = 0
103 while bi < 32 {
104 other_pub[bi] = pub[bi]
105 bi = bi + 1
106 }
107 other_pub[15] = other_pub[15] ^ 0x01
108 let v4: i64 = ed25519_verify_full(other_pub, empty_msg, 0, sig)
109 if v4 != NX_ED25519_SIG_BAD { return 103 }
110
111 return 0
112}