@@ -57,6 +57,7 @@ void random_group_element_test(secp256k1_ge_t *ge) {
57
57
do {
58
58
random_field_element_test (& fe );
59
59
if (secp256k1_ge_set_xo_var (ge , & fe , secp256k1_rand32 () & 1 )) {
60
+ secp256k1_fe_normalize (& ge -> y );
60
61
break ;
61
62
}
62
63
} while (1 );
@@ -914,7 +915,7 @@ void ge_equals_ge(const secp256k1_ge_t *a, const secp256k1_ge_t *b) {
914
915
return ;
915
916
}
916
917
CHECK (secp256k1_fe_equal_var (& a -> x , & b -> x ));
917
- CHECK (secp256k1_fe_equal_var (& b -> y , & b -> y ));
918
+ CHECK (secp256k1_fe_equal_var (& a -> y , & b -> y ));
918
919
}
919
920
920
921
/* This compares jacobian points including their Z, not just their geometric meaning. */
@@ -1291,6 +1292,8 @@ void test_point_times_order(const secp256k1_gej_t *point) {
1291
1292
/* X * (point + G) + (order-X) * (pointer + G) = 0 */
1292
1293
secp256k1_scalar_t x ;
1293
1294
secp256k1_scalar_t nx ;
1295
+ secp256k1_scalar_t zero = SECP256K1_SCALAR_CONST (0 , 0 , 0 , 0 , 0 , 0 , 0 , 0 );
1296
+ secp256k1_scalar_t one = SECP256K1_SCALAR_CONST (0 , 0 , 0 , 0 , 0 , 0 , 0 , 1 );
1294
1297
secp256k1_gej_t res1 , res2 ;
1295
1298
secp256k1_ge_t res3 ;
1296
1299
unsigned char pub [65 ];
@@ -1308,6 +1311,16 @@ void test_point_times_order(const secp256k1_gej_t *point) {
1308
1311
CHECK (secp256k1_eckey_pubkey_serialize (& res3 , pub , & psize , 0 ) == 0 );
1309
1312
psize = 65 ;
1310
1313
CHECK (secp256k1_eckey_pubkey_serialize (& res3 , pub , & psize , 1 ) == 0 );
1314
+ /* check zero/one edge cases */
1315
+ secp256k1_ecmult (& ctx -> ecmult_ctx , & res1 , point , & zero , & zero );
1316
+ secp256k1_ge_set_gej (& res3 , & res1 );
1317
+ CHECK (secp256k1_ge_is_infinity (& res3 ));
1318
+ secp256k1_ecmult (& ctx -> ecmult_ctx , & res1 , point , & one , & zero );
1319
+ secp256k1_ge_set_gej (& res3 , & res1 );
1320
+ ge_equals_gej (& res3 , point );
1321
+ secp256k1_ecmult (& ctx -> ecmult_ctx , & res1 , point , & zero , & one );
1322
+ secp256k1_ge_set_gej (& res3 , & res1 );
1323
+ ge_equals_ge (& res3 , & secp256k1_ge_const_g );
1311
1324
}
1312
1325
1313
1326
void run_point_times_order (void ) {
@@ -1455,6 +1468,35 @@ void run_ecmult_gen_blind(void) {
1455
1468
}
1456
1469
}
1457
1470
1471
+ #ifdef USE_ENDOMORPHISM
1472
+ /***** ENDOMORPHISH TESTS *****/
1473
+ void test_scalar_split (void ) {
1474
+ secp256k1_scalar_t full ;
1475
+ secp256k1_scalar_t s1 , slam ;
1476
+ const unsigned char zero [32 ] = {0 };
1477
+ unsigned char tmp [32 ];
1478
+
1479
+ random_scalar_order_test (& full );
1480
+ secp256k1_scalar_split_lambda_var (& s1 , & slam , & full );
1481
+ CHECK (!secp256k1_scalar_is_zero (& s1 ));
1482
+ CHECK (!secp256k1_scalar_is_zero (& slam ));
1483
+
1484
+ /* check that both are <= 128 bits in size */
1485
+ if (secp256k1_scalar_is_high (& s1 ))
1486
+ secp256k1_scalar_negate (& s1 , & s1 );
1487
+ if (secp256k1_scalar_is_high (& slam ))
1488
+ secp256k1_scalar_negate (& slam , & slam );
1489
+
1490
+ secp256k1_scalar_get_b32 (tmp , & s1 );
1491
+ CHECK (memcmp (zero , tmp , 16 ) == 0 );
1492
+ secp256k1_scalar_get_b32 (tmp , & slam );
1493
+ CHECK (memcmp (zero , tmp , 16 ) == 0 );
1494
+ }
1495
+
1496
+ void run_endomorphism_tests (void ) {
1497
+ test_scalar_split ();
1498
+ }
1499
+ #endif
1458
1500
1459
1501
void random_sign (secp256k1_ecdsa_sig_t * sig , const secp256k1_scalar_t * key , const secp256k1_scalar_t * msg , int * recid ) {
1460
1502
secp256k1_scalar_t nonce ;
@@ -2214,6 +2256,11 @@ int main(int argc, char **argv) {
2214
2256
run_ecmult_constants ();
2215
2257
run_ecmult_gen_blind ();
2216
2258
2259
+ /* endomorphism tests */
2260
+ #ifdef USE_ENDOMORPHISM
2261
+ run_endomorphism_tests ();
2262
+ #endif
2263
+
2217
2264
/* ecdsa tests */
2218
2265
run_random_pubkeys ();
2219
2266
run_ecdsa_sign_verify ();
0 commit comments