nx_p256_field_mul_test.nx source

1// nx_p256_field_mul_test.nx -- KAT for P-256 field multiplication. 2// 3// Verifies: 4// - 0 * 0 = 0 5// - 0 * a = 0 6// - 1 * a = a (identity) 7// - 2 * 3 = 6 (small) 8// - 2 * (p+1)/2 = 1 (where (p+1)/2 is the modular inverse of 2) 9// - (p-1) * (p-1) = 1 (since -1 * -1 = 1 mod p) 10// - (p-1) * 2 = p-2 (no boundary cross) 11// - 2 * 2^255 = 2^256 = (p + 2^224 - 2^192 - 2^96 + 1) mod p = 12// 2^224 - 2^192 - 2^96 + 1 13// - associativity spot-check: (a*b)*c == a*(b*c) for 3 values 14// - commutativity: a*b == b*a 15// - distributivity: a*(b+c) == a*b + a*c 16// - sq matches mul-with-self 17// 18// expect_exit: 0 19// license_tier: ORIGINAL 20 21import "nx_syscalls.nx" 22import "nx_u256.nx" 23import "nx_p256_field.nx" 24import "nx_p256_field_mul.nx" 25 26func main() -> i64 { 27 let a: *i64 = u256_alloc() 28 let b: *i64 = u256_alloc() 29 let c: *i64 = u256_alloc() 30 let r: *i64 = u256_alloc() 31 let r2: *i64 = u256_alloc() 32 let tmp: *i64 = u256_alloc() 33 let p: *i64 = u256_alloc() 34 p256_field_load_p(p) 35 36 // ---- Test A: 0 * 0 = 0 ---- 37 p256_field_zero(a) 38 p256_field_zero(b) 39 p256_field_mul(r, a, b) 40 if u256_is_zero(r) != 1 { return 1 } 41 42 // ---- Test B: 0 * a = 0 ---- 43 p256_field_zero(a) 44 u256_zero(b); b[0] = 0x12345678; b[4] = 0xCAFEBABE 45 p256_field_mul(r, a, b) 46 if u256_is_zero(r) != 1 { return 2 } 47 48 // ---- Test C: 1 * a = a ---- 49 p256_field_one(a) 50 u256_zero(b); b[0] = 0xDEADBEEF; b[3] = 0x55555555; b[6] = 0x33333333 51 if u256_cmp(b, p) != (0 - 1) { return 3 } // canonical check 52 p256_field_mul(r, a, b) 53 if p256_field_eq(r, b) != 1 { return 4 } 54 55 // ---- Test D: 2 * 3 = 6 ---- 56 u256_zero(a); a[0] = 2 57 u256_zero(b); b[0] = 3 58 p256_field_mul(r, a, b) 59 if r[0] != 6 { return 5 } 60 var k: i64 = 1 61 while k < 8 { 62 if r[k] != 0 { return 6 } 63 k = k + 1 64 } 65 66 // ---- Test E: (p-1) * (p-1) = 1 (since (-1)*(-1) = 1) ---- 67 let p_minus_1: *i64 = u256_alloc() 68 u256_copy(p_minus_1, p) 69 p256_field_one(tmp) 70 p256_field_sub(p_minus_1, p_minus_1, tmp) 71 p256_field_mul(r, p_minus_1, p_minus_1) 72 p256_field_one(tmp) 73 if p256_field_eq(r, tmp) != 1 { return 10 } 74 75 // ---- Test F: (p-1) * 2 = p - 2 ---- 76 u256_zero(a); a[0] = 2 77 p256_field_mul(r, p_minus_1, a) 78 let p_minus_2: *i64 = u256_alloc() 79 u256_copy(p_minus_2, p) 80 u256_zero(tmp); tmp[0] = 2 81 p256_field_sub(p_minus_2, p_minus_2, tmp) 82 if p256_field_eq(r, p_minus_2) != 1 { return 20 } 83 84 // ---- Test G: (p-1) * 1 = p-1 ---- 85 p256_field_one(a) 86 p256_field_mul(r, p_minus_1, a) 87 if p256_field_eq(r, p_minus_1) != 1 { return 21 } 88 89 // ---- Test H: commutativity a*b == b*a ---- 90 u256_zero(a) 91 a[0] = 0x11111111; a[3] = 0x22222222; a[5] = 0x33333333 92 u256_zero(b) 93 b[0] = 0xABCDEF01; b[2] = 0x55555555; b[7] = 0x00FFFFFF 94 if u256_cmp(a, p) != (0 - 1) { return 30 } 95 if u256_cmp(b, p) != (0 - 1) { return 31 } 96 p256_field_mul(r, a, b) 97 p256_field_mul(r2, b, a) 98 if p256_field_eq(r, r2) != 1 { return 32 } 99 100 // ---- Test I: distributivity a*(b+c) == a*b + a*c ---- 101 u256_zero(c) 102 c[0] = 0x09876543; c[4] = 0x77777777 103 if u256_cmp(c, p) != (0 - 1) { return 40 } 104 // lhs = a * (b + c) 105 let bc_sum: *i64 = u256_alloc() 106 p256_field_add(bc_sum, b, c) 107 let lhs: *i64 = u256_alloc() 108 p256_field_mul(lhs, a, bc_sum) 109 // rhs = a*b + a*c 110 let ab: *i64 = u256_alloc() 111 let ac: *i64 = u256_alloc() 112 let rhs: *i64 = u256_alloc() 113 p256_field_mul(ab, a, b) 114 p256_field_mul(ac, a, c) 115 p256_field_add(rhs, ab, ac) 116 if p256_field_eq(lhs, rhs) != 1 { return 41 } 117 118 // ---- Test J: associativity (a*b)*c == a*(b*c) ---- 119 let abc1: *i64 = u256_alloc() 120 let abc2: *i64 = u256_alloc() 121 p256_field_mul(abc1, a, b) 122 p256_field_mul(abc1, abc1, c) 123 p256_field_mul(abc2, b, c) 124 p256_field_mul(abc2, a, abc2) 125 if p256_field_eq(abc1, abc2) != 1 { return 50 } 126 127 // ---- Test K: sq matches mul-with-self ---- 128 u256_zero(a) 129 a[0] = 0x12345678; a[5] = 0xCAFEBABE 130 if u256_cmp(a, p) != (0 - 1) { return 60 } 131 p256_field_sq(r, a) 132 p256_field_mul(r2, a, a) 133 if p256_field_eq(r, r2) != 1 { return 61 } 134 135 // ---- Test L: aliasing -- out == a ---- 136 u256_zero(a); a[0] = 5 137 u256_zero(b); b[0] = 7 138 p256_field_mul(a, a, b) // in-place a *= b 139 if a[0] != 35 { return 70 } 140 141 // ---- Test M: aliasing -- out == b ---- 142 u256_zero(a); a[0] = 11 143 u256_zero(b); b[0] = 13 144 p256_field_mul(b, a, b) // in-place b = a * b 145 if b[0] != 143 { return 71 } 146 147 // ---- Test N: output canonical (< p) ---- 148 u256_zero(a) 149 k = 0 150 while k < 8 { a[k] = 0xFFFFFFFF; k = k + 1 } 151 // a > p so this is intentionally non-canonical input -- skip 152 // testing this path (caller contract requires canonical inputs); 153 // instead test that LEGAL inputs produce canonical outputs. 154 u256_copy(a, p_minus_1) 155 u256_copy(b, p_minus_1) 156 p256_field_mul(r, a, b) 157 if u256_cmp(r, p) != (0 - 1) { return 80 } 158 159 // ---- Test O: u256_wide_shr_1 unit test ---- 160 let w: *i64 = u256_wide_alloc() 161 k = 0 162 while k < 16 { w[k] = 0; k = k + 1 } 163 w[15] = 0x80000000 // value = 2^511 164 u256_wide_shr_1(w) 165 if w[15] != 0x40000000 { return 90 } 166 // shift again -> 2^509 167 u256_wide_shr_1(w) 168 if w[15] != 0x20000000 { return 91 } 169 170 // Cross-limb shift carry: w = 0x...01 0x00000000 shift -> 0x...0 0x80000000 171 k = 0 172 while k < 16 { w[k] = 0; k = k + 1 } 173 w[5] = 1 174 u256_wide_shr_1(w) 175 if w[5] != 0 { return 92 } 176 if w[4] != 0x80000000 { return 93 } 177 178 // ---- Test P: u256_wide_sub unit test ---- 179 let wa: *i64 = u256_wide_alloc() 180 let wb: *i64 = u256_wide_alloc() 181 let wr: *i64 = u256_wide_alloc() 182 k = 0 183 while k < 16 { wa[k] = 0; wb[k] = 0; k = k + 1 } 184 wa[1] = 5 185 wb[0] = 1 186 // wa = 5 * 2^32, wb = 1. wa - wb = 5*2^32 - 1 = 0x4FFFFFFFF 187 let bo: i64 = u256_wide_sub(wr, wa, wb) 188 if bo != 0 { return 100 } 189 if wr[0] != 0xFFFFFFFF { return 101 } 190 if wr[1] != 4 { return 102 } 191 192 return 0 193}