xref: /linux/lib/crypto/curve25519-selftest.c (revision c532de5a67a70f8533d495f8f2aaa9a0491c3ad0) 
1 // SPDX-License-Identifier: GPL-2.0 OR MIT
2 /*
3  * Copyright (C) 2015-2019 Jason A. Donenfeld <Jason@zx2c4.com>. All Rights Reserved.
4  */
5 
6 #include <crypto/curve25519.h>
7 
8 struct curve25519_test_vector {
9 	u8 private[CURVE25519_KEY_SIZE];
10 	u8 public[CURVE25519_KEY_SIZE];
11 	u8 result[CURVE25519_KEY_SIZE];
12 	bool valid;
13 };
14 static const struct curve25519_test_vector curve25519_test_vectors[] __initconst = {
15 	{
16 		.private = { 0x77, 0x07, 0x6d, 0x0a, 0x73, 0x18, 0xa5, 0x7d,
17 			     0x3c, 0x16, 0xc1, 0x72, 0x51, 0xb2, 0x66, 0x45,
18 			     0xdf, 0x4c, 0x2f, 0x87, 0xeb, 0xc0, 0x99, 0x2a,
19 			     0xb1, 0x77, 0xfb, 0xa5, 0x1d, 0xb9, 0x2c, 0x2a },
20 		.public = { 0xde, 0x9e, 0xdb, 0x7d, 0x7b, 0x7d, 0xc1, 0xb4,
21 			    0xd3, 0x5b, 0x61, 0xc2, 0xec, 0xe4, 0x35, 0x37,
22 			    0x3f, 0x83, 0x43, 0xc8, 0x5b, 0x78, 0x67, 0x4d,
23 			    0xad, 0xfc, 0x7e, 0x14, 0x6f, 0x88, 0x2b, 0x4f },
24 		.result = { 0x4a, 0x5d, 0x9d, 0x5b, 0xa4, 0xce, 0x2d, 0xe1,
25 			    0x72, 0x8e, 0x3b, 0xf4, 0x80, 0x35, 0x0f, 0x25,
26 			    0xe0, 0x7e, 0x21, 0xc9, 0x47, 0xd1, 0x9e, 0x33,
27 			    0x76, 0xf0, 0x9b, 0x3c, 0x1e, 0x16, 0x17, 0x42 },
28 		.valid = true
29 	},
30 	{
31 		.private = { 0x5d, 0xab, 0x08, 0x7e, 0x62, 0x4a, 0x8a, 0x4b,
32 			     0x79, 0xe1, 0x7f, 0x8b, 0x83, 0x80, 0x0e, 0xe6,
33 			     0x6f, 0x3b, 0xb1, 0x29, 0x26, 0x18, 0xb6, 0xfd,
34 			     0x1c, 0x2f, 0x8b, 0x27, 0xff, 0x88, 0xe0, 0xeb },
35 		.public = { 0x85, 0x20, 0xf0, 0x09, 0x89, 0x30, 0xa7, 0x54,
36 			    0x74, 0x8b, 0x7d, 0xdc, 0xb4, 0x3e, 0xf7, 0x5a,
37 			    0x0d, 0xbf, 0x3a, 0x0d, 0x26, 0x38, 0x1a, 0xf4,
38 			    0xeb, 0xa4, 0xa9, 0x8e, 0xaa, 0x9b, 0x4e, 0x6a },
39 		.result = { 0x4a, 0x5d, 0x9d, 0x5b, 0xa4, 0xce, 0x2d, 0xe1,
40 			    0x72, 0x8e, 0x3b, 0xf4, 0x80, 0x35, 0x0f, 0x25,
41 			    0xe0, 0x7e, 0x21, 0xc9, 0x47, 0xd1, 0x9e, 0x33,
42 			    0x76, 0xf0, 0x9b, 0x3c, 0x1e, 0x16, 0x17, 0x42 },
43 		.valid = true
44 	},
45 	{
46 		.private = { 1 },
47 		.public = { 0x25, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
48 			    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
49 			    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
50 			    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 },
51 		.result = { 0x3c, 0x77, 0x77, 0xca, 0xf9, 0x97, 0xb2, 0x64,
52 			    0x41, 0x60, 0x77, 0x66, 0x5b, 0x4e, 0x22, 0x9d,
53 			    0x0b, 0x95, 0x48, 0xdc, 0x0c, 0xd8, 0x19, 0x98,
54 			    0xdd, 0xcd, 0xc5, 0xc8, 0x53, 0x3c, 0x79, 0x7f },
55 		.valid = true
56 	},
57 	{
58 		.private = { 1 },
59 		.public = { 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
60 			    0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
61 			    0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
62 			    0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff },
63 		.result = { 0xb3, 0x2d, 0x13, 0x62, 0xc2, 0x48, 0xd6, 0x2f,
64 			    0xe6, 0x26, 0x19, 0xcf, 0xf0, 0x4d, 0xd4, 0x3d,
65 			    0xb7, 0x3f, 0xfc, 0x1b, 0x63, 0x08, 0xed, 0xe3,
66 			    0x0b, 0x78, 0xd8, 0x73, 0x80, 0xf1, 0xe8, 0x34 },
67 		.valid = true
68 	},
69 	{
70 		.private = { 0xa5, 0x46, 0xe3, 0x6b, 0xf0, 0x52, 0x7c, 0x9d,
71 			     0x3b, 0x16, 0x15, 0x4b, 0x82, 0x46, 0x5e, 0xdd,
72 			     0x62, 0x14, 0x4c, 0x0a, 0xc1, 0xfc, 0x5a, 0x18,
73 			     0x50, 0x6a, 0x22, 0x44, 0xba, 0x44, 0x9a, 0xc4 },
74 		.public = { 0xe6, 0xdb, 0x68, 0x67, 0x58, 0x30, 0x30, 0xdb,
75 			    0x35, 0x94, 0xc1, 0xa4, 0x24, 0xb1, 0x5f, 0x7c,
76 			    0x72, 0x66, 0x24, 0xec, 0x26, 0xb3, 0x35, 0x3b,
77 			    0x10, 0xa9, 0x03, 0xa6, 0xd0, 0xab, 0x1c, 0x4c },
78 		.result = { 0xc3, 0xda, 0x55, 0x37, 0x9d, 0xe9, 0xc6, 0x90,
79 			    0x8e, 0x94, 0xea, 0x4d, 0xf2, 0x8d, 0x08, 0x4f,
80 			    0x32, 0xec, 0xcf, 0x03, 0x49, 0x1c, 0x71, 0xf7,
81 			    0x54, 0xb4, 0x07, 0x55, 0x77, 0xa2, 0x85, 0x52 },
82 		.valid = true
83 	},
84 	{
85 		.private = { 1, 2, 3, 4 },
86 		.public = { 0 },
87 		.result = { 0 },
88 		.valid = false
89 	},
90 	{
91 		.private = { 2, 4, 6, 8 },
92 		.public = { 0xe0, 0xeb, 0x7a, 0x7c, 0x3b, 0x41, 0xb8, 0xae,
93 			    0x16, 0x56, 0xe3, 0xfa, 0xf1, 0x9f, 0xc4, 0x6a,
94 			    0xda, 0x09, 0x8d, 0xeb, 0x9c, 0x32, 0xb1, 0xfd,
95 			    0x86, 0x62, 0x05, 0x16, 0x5f, 0x49, 0xb8 },
96 		.result = { 0 },
97 		.valid = false
98 	},
99 	{
100 		.private = { 0xff, 0xff, 0xff, 0xff, 0x0a, 0xff, 0xff, 0xff,
101 			     0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
102 			     0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
103 			     0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff },
104 		.public = { 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
105 			    0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
106 			    0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
107 			    0xff, 0xff, 0xff, 0xff, 0x0a, 0x00, 0xfb, 0x9f },
108 		.result = { 0x77, 0x52, 0xb6, 0x18, 0xc1, 0x2d, 0x48, 0xd2,
109 			    0xc6, 0x93, 0x46, 0x83, 0x81, 0x7c, 0xc6, 0x57,
110 			    0xf3, 0x31, 0x03, 0x19, 0x49, 0x48, 0x20, 0x05,
111 			    0x42, 0x2b, 0x4e, 0xae, 0x8d, 0x1d, 0x43, 0x23 },
112 		.valid = true
113 	},
114 	{
115 		.private = { 0x8e, 0x0a, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
116 			     0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
117 			     0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
118 			     0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 },
119 		.public = { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
120 			    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
121 			    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
122 			    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x8e, 0x06 },
123 		.result = { 0x5a, 0xdf, 0xaa, 0x25, 0x86, 0x8e, 0x32, 0x3d,
124 			    0xae, 0x49, 0x62, 0xc1, 0x01, 0x5c, 0xb3, 0x12,
125 			    0xe1, 0xc5, 0xc7, 0x9e, 0x95, 0x3f, 0x03, 0x99,
126 			    0xb0, 0xba, 0x16, 0x22, 0xf3, 0xb6, 0xf7, 0x0c },
127 		.valid = true
128 	},
129 	/* wycheproof - normal case */
130 	{
131 		.private = { 0x48, 0x52, 0x83, 0x4d, 0x9d, 0x6b, 0x77, 0xda,
132 			     0xde, 0xab, 0xaa, 0xf2, 0xe1, 0x1d, 0xca, 0x66,
133 			     0xd1, 0x9f, 0xe7, 0x49, 0x93, 0xa7, 0xbe, 0xc3,
134 			     0x6c, 0x6e, 0x16, 0xa0, 0x98, 0x3f, 0xea, 0xba },
135 		.public = { 0x9c, 0x64, 0x7d, 0x9a, 0xe5, 0x89, 0xb9, 0xf5,
136 			    0x8f, 0xdc, 0x3c, 0xa4, 0x94, 0x7e, 0xfb, 0xc9,
137 			    0x15, 0xc4, 0xb2, 0xe0, 0x8e, 0x74, 0x4a, 0x0e,
138 			    0xdf, 0x46, 0x9d, 0xac, 0x59, 0xc8, 0xf8, 0x5a },
139 		.result = { 0x87, 0xb7, 0xf2, 0x12, 0xb6, 0x27, 0xf7, 0xa5,
140 			    0x4c, 0xa5, 0xe0, 0xbc, 0xda, 0xdd, 0xd5, 0x38,
141 			    0x9d, 0x9d, 0xe6, 0x15, 0x6c, 0xdb, 0xcf, 0x8e,
142 			    0xbe, 0x14, 0xff, 0xbc, 0xfb, 0x43, 0x65, 0x51 },
143 		.valid = true
144 	},
145 	/* wycheproof - public key on twist */
146 	{
147 		.private = { 0x58, 0x8c, 0x06, 0x1a, 0x50, 0x80, 0x4a, 0xc4,
148 			     0x88, 0xad, 0x77, 0x4a, 0xc7, 0x16, 0xc3, 0xf5,
149 			     0xba, 0x71, 0x4b, 0x27, 0x12, 0xe0, 0x48, 0x49,
150 			     0x13, 0x79, 0xa5, 0x00, 0x21, 0x19, 0x98, 0xa8 },
151 		.public = { 0x63, 0xaa, 0x40, 0xc6, 0xe3, 0x83, 0x46, 0xc5,
152 			    0xca, 0xf2, 0x3a, 0x6d, 0xf0, 0xa5, 0xe6, 0xc8,
153 			    0x08, 0x89, 0xa0, 0x86, 0x47, 0xe5, 0x51, 0xb3,
154 			    0x56, 0x34, 0x49, 0xbe, 0xfc, 0xfc, 0x97, 0x33 },
155 		.result = { 0xb1, 0xa7, 0x07, 0x51, 0x94, 0x95, 0xff, 0xff,
156 			    0xb2, 0x98, 0xff, 0x94, 0x17, 0x16, 0xb0, 0x6d,
157 			    0xfa, 0xb8, 0x7c, 0xf8, 0xd9, 0x11, 0x23, 0xfe,
158 			    0x2b, 0xe9, 0xa2, 0x33, 0xdd, 0xa2, 0x22, 0x12 },
159 		.valid = true
160 	},
161 	/* wycheproof - public key on twist */
162 	{
163 		.private = { 0xb0, 0x5b, 0xfd, 0x32, 0xe5, 0x53, 0x25, 0xd9,
164 			     0xfd, 0x64, 0x8c, 0xb3, 0x02, 0x84, 0x80, 0x39,
165 			     0x00, 0x0b, 0x39, 0x0e, 0x44, 0xd5, 0x21, 0xe5,
166 			     0x8a, 0xab, 0x3b, 0x29, 0xa6, 0x96, 0x0b, 0xa8 },
167 		.public = { 0x0f, 0x83, 0xc3, 0x6f, 0xde, 0xd9, 0xd3, 0x2f,
168 			    0xad, 0xf4, 0xef, 0xa3, 0xae, 0x93, 0xa9, 0x0b,
169 			    0xb5, 0xcf, 0xa6, 0x68, 0x93, 0xbc, 0x41, 0x2c,
170 			    0x43, 0xfa, 0x72, 0x87, 0xdb, 0xb9, 0x97, 0x79 },
171 		.result = { 0x67, 0xdd, 0x4a, 0x6e, 0x16, 0x55, 0x33, 0x53,
172 			    0x4c, 0x0e, 0x3f, 0x17, 0x2e, 0x4a, 0xb8, 0x57,
173 			    0x6b, 0xca, 0x92, 0x3a, 0x5f, 0x07, 0xb2, 0xc0,
174 			    0x69, 0xb4, 0xc3, 0x10, 0xff, 0x2e, 0x93, 0x5b },
175 		.valid = true
176 	},
177 	/* wycheproof - public key on twist */
178 	{
179 		.private = { 0x70, 0xe3, 0x4b, 0xcb, 0xe1, 0xf4, 0x7f, 0xbc,
180 			     0x0f, 0xdd, 0xfd, 0x7c, 0x1e, 0x1a, 0xa5, 0x3d,
181 			     0x57, 0xbf, 0xe0, 0xf6, 0x6d, 0x24, 0x30, 0x67,
182 			     0xb4, 0x24, 0xbb, 0x62, 0x10, 0xbe, 0xd1, 0x9c },
183 		.public = { 0x0b, 0x82, 0x11, 0xa2, 0xb6, 0x04, 0x90, 0x97,
184 			    0xf6, 0x87, 0x1c, 0x6c, 0x05, 0x2d, 0x3c, 0x5f,
185 			    0xc1, 0xba, 0x17, 0xda, 0x9e, 0x32, 0xae, 0x45,
186 			    0x84, 0x03, 0xb0, 0x5b, 0xb2, 0x83, 0x09, 0x2a },
187 		.result = { 0x4a, 0x06, 0x38, 0xcf, 0xaa, 0x9e, 0xf1, 0x93,
188 			    0x3b, 0x47, 0xf8, 0x93, 0x92, 0x96, 0xa6, 0xb2,
189 			    0x5b, 0xe5, 0x41, 0xef, 0x7f, 0x70, 0xe8, 0x44,
190 			    0xc0, 0xbc, 0xc0, 0x0b, 0x13, 0x4d, 0xe6, 0x4a },
191 		.valid = true
192 	},
193 	/* wycheproof - public key on twist */
194 	{
195 		.private = { 0x68, 0xc1, 0xf3, 0xa6, 0x53, 0xa4, 0xcd, 0xb1,
196 			     0xd3, 0x7b, 0xba, 0x94, 0x73, 0x8f, 0x8b, 0x95,
197 			     0x7a, 0x57, 0xbe, 0xb2, 0x4d, 0x64, 0x6e, 0x99,
198 			     0x4d, 0xc2, 0x9a, 0x27, 0x6a, 0xad, 0x45, 0x8d },
199 		.public = { 0x34, 0x3a, 0xc2, 0x0a, 0x3b, 0x9c, 0x6a, 0x27,
200 			    0xb1, 0x00, 0x81, 0x76, 0x50, 0x9a, 0xd3, 0x07,
201 			    0x35, 0x85, 0x6e, 0xc1, 0xc8, 0xd8, 0xfc, 0xae,
202 			    0x13, 0x91, 0x2d, 0x08, 0xd1, 0x52, 0xf4, 0x6c },
203 		.result = { 0x39, 0x94, 0x91, 0xfc, 0xe8, 0xdf, 0xab, 0x73,
204 			    0xb4, 0xf9, 0xf6, 0x11, 0xde, 0x8e, 0xa0, 0xb2,
205 			    0x7b, 0x28, 0xf8, 0x59, 0x94, 0x25, 0x0b, 0x0f,
206 			    0x47, 0x5d, 0x58, 0x5d, 0x04, 0x2a, 0xc2, 0x07 },
207 		.valid = true
208 	},
209 	/* wycheproof - public key on twist */
210 	{
211 		.private = { 0xd8, 0x77, 0xb2, 0x6d, 0x06, 0xdf, 0xf9, 0xd9,
212 			     0xf7, 0xfd, 0x4c, 0x5b, 0x37, 0x69, 0xf8, 0xcd,
213 			     0xd5, 0xb3, 0x05, 0x16, 0xa5, 0xab, 0x80, 0x6b,
214 			     0xe3, 0x24, 0xff, 0x3e, 0xb6, 0x9e, 0xa0, 0xb2 },
215 		.public = { 0xfa, 0x69, 0x5f, 0xc7, 0xbe, 0x8d, 0x1b, 0xe5,
216 			    0xbf, 0x70, 0x48, 0x98, 0xf3, 0x88, 0xc4, 0x52,
217 			    0xba, 0xfd, 0xd3, 0xb8, 0xea, 0xe8, 0x05, 0xf8,
218 			    0x68, 0x1a, 0x8d, 0x15, 0xc2, 0xd4, 0xe1, 0x42 },
219 		.result = { 0x2c, 0x4f, 0xe1, 0x1d, 0x49, 0x0a, 0x53, 0x86,
220 			    0x17, 0x76, 0xb1, 0x3b, 0x43, 0x54, 0xab, 0xd4,
221 			    0xcf, 0x5a, 0x97, 0x69, 0x9d, 0xb6, 0xe6, 0xc6,
222 			    0x8c, 0x16, 0x26, 0xd0, 0x76, 0x62, 0xf7, 0x58 },
223 		.valid = true
224 	},
225 	/* wycheproof - public key = 0 */
226 	{
227 		.private = { 0x20, 0x74, 0x94, 0x03, 0x8f, 0x2b, 0xb8, 0x11,
228 			     0xd4, 0x78, 0x05, 0xbc, 0xdf, 0x04, 0xa2, 0xac,
229 			     0x58, 0x5a, 0xda, 0x7f, 0x2f, 0x23, 0x38, 0x9b,
230 			     0xfd, 0x46, 0x58, 0xf9, 0xdd, 0xd4, 0xde, 0xbc },
231 		.public = { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
232 			    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
233 			    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
234 			    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 },
235 		.result = { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
236 			    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
237 			    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
238 			    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 },
239 		.valid = false
240 	},
241 	/* wycheproof - public key = 1 */
242 	{
243 		.private = { 0x20, 0x2e, 0x89, 0x72, 0xb6, 0x1c, 0x7e, 0x61,
244 			     0x93, 0x0e, 0xb9, 0x45, 0x0b, 0x50, 0x70, 0xea,
245 			     0xe1, 0xc6, 0x70, 0x47, 0x56, 0x85, 0x54, 0x1f,
246 			     0x04, 0x76, 0x21, 0x7e, 0x48, 0x18, 0xcf, 0xab },
247 		.public = { 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
248 			    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
249 			    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
250 			    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 },
251 		.result = { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
252 			    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
253 			    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
254 			    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 },
255 		.valid = false
256 	},
257 	/* wycheproof - edge case on twist */
258 	{
259 		.private = { 0x38, 0xdd, 0xe9, 0xf3, 0xe7, 0xb7, 0x99, 0x04,
260 			     0x5f, 0x9a, 0xc3, 0x79, 0x3d, 0x4a, 0x92, 0x77,
261 			     0xda, 0xde, 0xad, 0xc4, 0x1b, 0xec, 0x02, 0x90,
262 			     0xf8, 0x1f, 0x74, 0x4f, 0x73, 0x77, 0x5f, 0x84 },
263 		.public = { 0x02, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
264 			    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
265 			    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
266 			    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 },
267 		.result = { 0x9a, 0x2c, 0xfe, 0x84, 0xff, 0x9c, 0x4a, 0x97,
268 			    0x39, 0x62, 0x5c, 0xae, 0x4a, 0x3b, 0x82, 0xa9,
269 			    0x06, 0x87, 0x7a, 0x44, 0x19, 0x46, 0xf8, 0xd7,
270 			    0xb3, 0xd7, 0x95, 0xfe, 0x8f, 0x5d, 0x16, 0x39 },
271 		.valid = true
272 	},
273 	/* wycheproof - edge case on twist */
274 	{
275 		.private = { 0x98, 0x57, 0xa9, 0x14, 0xe3, 0xc2, 0x90, 0x36,
276 			     0xfd, 0x9a, 0x44, 0x2b, 0xa5, 0x26, 0xb5, 0xcd,
277 			     0xcd, 0xf2, 0x82, 0x16, 0x15, 0x3e, 0x63, 0x6c,
278 			     0x10, 0x67, 0x7a, 0xca, 0xb6, 0xbd, 0x6a, 0xa5 },
279 		.public = { 0x03, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
280 			    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
281 			    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
282 			    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 },
283 		.result = { 0x4d, 0xa4, 0xe0, 0xaa, 0x07, 0x2c, 0x23, 0x2e,
284 			    0xe2, 0xf0, 0xfa, 0x4e, 0x51, 0x9a, 0xe5, 0x0b,
285 			    0x52, 0xc1, 0xed, 0xd0, 0x8a, 0x53, 0x4d, 0x4e,
286 			    0xf3, 0x46, 0xc2, 0xe1, 0x06, 0xd2, 0x1d, 0x60 },
287 		.valid = true
288 	},
289 	/* wycheproof - edge case on twist */
290 	{
291 		.private = { 0x48, 0xe2, 0x13, 0x0d, 0x72, 0x33, 0x05, 0xed,
292 			     0x05, 0xe6, 0xe5, 0x89, 0x4d, 0x39, 0x8a, 0x5e,
293 			     0x33, 0x36, 0x7a, 0x8c, 0x6a, 0xac, 0x8f, 0xcd,
294 			     0xf0, 0xa8, 0x8e, 0x4b, 0x42, 0x82, 0x0d, 0xb7 },
295 		.public = { 0xff, 0xff, 0xff, 0x03, 0x00, 0x00, 0xf8, 0xff,
296 			    0xff, 0x1f, 0x00, 0x00, 0xc0, 0xff, 0xff, 0xff,
297 			    0x00, 0x00, 0x00, 0xfe, 0xff, 0xff, 0x07, 0x00,
298 			    0x00, 0xf0, 0xff, 0xff, 0x3f, 0x00, 0x00, 0x00 },
299 		.result = { 0x9e, 0xd1, 0x0c, 0x53, 0x74, 0x7f, 0x64, 0x7f,
300 			    0x82, 0xf4, 0x51, 0x25, 0xd3, 0xde, 0x15, 0xa1,
301 			    0xe6, 0xb8, 0x24, 0x49, 0x6a, 0xb4, 0x04, 0x10,
302 			    0xff, 0xcc, 0x3c, 0xfe, 0x95, 0x76, 0x0f, 0x3b },
303 		.valid = true
304 	},
305 	/* wycheproof - edge case on twist */
306 	{
307 		.private = { 0x28, 0xf4, 0x10, 0x11, 0x69, 0x18, 0x51, 0xb3,
308 			     0xa6, 0x2b, 0x64, 0x15, 0x53, 0xb3, 0x0d, 0x0d,
309 			     0xfd, 0xdc, 0xb8, 0xff, 0xfc, 0xf5, 0x37, 0x00,
310 			     0xa7, 0xbe, 0x2f, 0x6a, 0x87, 0x2e, 0x9f, 0xb0 },
311 		.public = { 0x00, 0x00, 0x00, 0xfc, 0xff, 0xff, 0x07, 0x00,
312 			    0x00, 0xe0, 0xff, 0xff, 0x3f, 0x00, 0x00, 0x00,
313 			    0xff, 0xff, 0xff, 0x01, 0x00, 0x00, 0xf8, 0xff,
314 			    0xff, 0x0f, 0x00, 0x00, 0xc0, 0xff, 0xff, 0x7f },
315 		.result = { 0xcf, 0x72, 0xb4, 0xaa, 0x6a, 0xa1, 0xc9, 0xf8,
316 			    0x94, 0xf4, 0x16, 0x5b, 0x86, 0x10, 0x9a, 0xa4,
317 			    0x68, 0x51, 0x76, 0x48, 0xe1, 0xf0, 0xcc, 0x70,
318 			    0xe1, 0xab, 0x08, 0x46, 0x01, 0x76, 0x50, 0x6b },
319 		.valid = true
320 	},
321 	/* wycheproof - edge case on twist */
322 	{
323 		.private = { 0x18, 0xa9, 0x3b, 0x64, 0x99, 0xb9, 0xf6, 0xb3,
324 			     0x22, 0x5c, 0xa0, 0x2f, 0xef, 0x41, 0x0e, 0x0a,
325 			     0xde, 0xc2, 0x35, 0x32, 0x32, 0x1d, 0x2d, 0x8e,
326 			     0xf1, 0xa6, 0xd6, 0x02, 0xa8, 0xc6, 0x5b, 0x83 },
327 		.public = { 0x00, 0x00, 0x00, 0x00, 0xff, 0xff, 0xff, 0xff,
328 			    0x00, 0x00, 0x00, 0x00, 0xff, 0xff, 0xff, 0xff,
329 			    0x00, 0x00, 0x00, 0x00, 0xff, 0xff, 0xff, 0xff,
330 			    0x00, 0x00, 0x00, 0x00, 0xff, 0xff, 0xff, 0x7f },
331 		.result = { 0x5d, 0x50, 0xb6, 0x28, 0x36, 0xbb, 0x69, 0x57,
332 			    0x94, 0x10, 0x38, 0x6c, 0xf7, 0xbb, 0x81, 0x1c,
333 			    0x14, 0xbf, 0x85, 0xb1, 0xc7, 0xb1, 0x7e, 0x59,
334 			    0x24, 0xc7, 0xff, 0xea, 0x91, 0xef, 0x9e, 0x12 },
335 		.valid = true
336 	},
337 	/* wycheproof - edge case on twist */
338 	{
339 		.private = { 0xc0, 0x1d, 0x13, 0x05, 0xa1, 0x33, 0x8a, 0x1f,
340 			     0xca, 0xc2, 0xba, 0x7e, 0x2e, 0x03, 0x2b, 0x42,
341 			     0x7e, 0x0b, 0x04, 0x90, 0x31, 0x65, 0xac, 0xa9,
342 			     0x57, 0xd8, 0xd0, 0x55, 0x3d, 0x87, 0x17, 0xb0 },
343 		.public = { 0xea, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
344 			    0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
345 			    0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
346 			    0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x7f },
347 		.result = { 0x19, 0x23, 0x0e, 0xb1, 0x48, 0xd5, 0xd6, 0x7c,
348 			    0x3c, 0x22, 0xab, 0x1d, 0xae, 0xff, 0x80, 0xa5,
349 			    0x7e, 0xae, 0x42, 0x65, 0xce, 0x28, 0x72, 0x65,
350 			    0x7b, 0x2c, 0x80, 0x99, 0xfc, 0x69, 0x8e, 0x50 },
351 		.valid = true
352 	},
353 	/* wycheproof - edge case for public key */
354 	{
355 		.private = { 0x38, 0x6f, 0x7f, 0x16, 0xc5, 0x07, 0x31, 0xd6,
356 			     0x4f, 0x82, 0xe6, 0xa1, 0x70, 0xb1, 0x42, 0xa4,
357 			     0xe3, 0x4f, 0x31, 0xfd, 0x77, 0x68, 0xfc, 0xb8,
358 			     0x90, 0x29, 0x25, 0xe7, 0xd1, 0xe2, 0x1a, 0xbe },
359 		.public = { 0x04, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
360 			    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
361 			    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
362 			    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 },
363 		.result = { 0x0f, 0xca, 0xb5, 0xd8, 0x42, 0xa0, 0x78, 0xd7,
364 			    0xa7, 0x1f, 0xc5, 0x9b, 0x57, 0xbf, 0xb4, 0xca,
365 			    0x0b, 0xe6, 0x87, 0x3b, 0x49, 0xdc, 0xdb, 0x9f,
366 			    0x44, 0xe1, 0x4a, 0xe8, 0xfb, 0xdf, 0xa5, 0x42 },
367 		.valid = true
368 	},
369 	/* wycheproof - edge case for public key */
370 	{
371 		.private = { 0xe0, 0x23, 0xa2, 0x89, 0xbd, 0x5e, 0x90, 0xfa,
372 			     0x28, 0x04, 0xdd, 0xc0, 0x19, 0xa0, 0x5e, 0xf3,
373 			     0xe7, 0x9d, 0x43, 0x4b, 0xb6, 0xea, 0x2f, 0x52,
374 			     0x2e, 0xcb, 0x64, 0x3a, 0x75, 0x29, 0x6e, 0x95 },
375 		.public = { 0xff, 0xff, 0xff, 0xff, 0x00, 0x00, 0x00, 0x00,
376 			    0xff, 0xff, 0xff, 0xff, 0x00, 0x00, 0x00, 0x00,
377 			    0xff, 0xff, 0xff, 0xff, 0x00, 0x00, 0x00, 0x00,
378 			    0xff, 0xff, 0xff, 0xff, 0x00, 0x00, 0x00, 0x00 },
379 		.result = { 0x54, 0xce, 0x8f, 0x22, 0x75, 0xc0, 0x77, 0xe3,
380 			    0xb1, 0x30, 0x6a, 0x39, 0x39, 0xc5, 0xe0, 0x3e,
381 			    0xef, 0x6b, 0xbb, 0x88, 0x06, 0x05, 0x44, 0x75,
382 			    0x8d, 0x9f, 0xef, 0x59, 0xb0, 0xbc, 0x3e, 0x4f },
383 		.valid = true
384 	},
385 	/* wycheproof - edge case for public key */
386 	{
387 		.private = { 0x68, 0xf0, 0x10, 0xd6, 0x2e, 0xe8, 0xd9, 0x26,
388 			     0x05, 0x3a, 0x36, 0x1c, 0x3a, 0x75, 0xc6, 0xea,
389 			     0x4e, 0xbd, 0xc8, 0x60, 0x6a, 0xb2, 0x85, 0x00,
390 			     0x3a, 0x6f, 0x8f, 0x40, 0x76, 0xb0, 0x1e, 0x83 },
391 		.public = { 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
392 			    0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
393 			    0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
394 			    0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x03 },
395 		.result = { 0xf1, 0x36, 0x77, 0x5c, 0x5b, 0xeb, 0x0a, 0xf8,
396 			    0x11, 0x0a, 0xf1, 0x0b, 0x20, 0x37, 0x23, 0x32,
397 			    0x04, 0x3c, 0xab, 0x75, 0x24, 0x19, 0x67, 0x87,
398 			    0x75, 0xa2, 0x23, 0xdf, 0x57, 0xc9, 0xd3, 0x0d },
399 		.valid = true
400 	},
401 	/* wycheproof - edge case for public key */
402 	{
403 		.private = { 0x58, 0xeb, 0xcb, 0x35, 0xb0, 0xf8, 0x84, 0x5c,
404 			     0xaf, 0x1e, 0xc6, 0x30, 0xf9, 0x65, 0x76, 0xb6,
405 			     0x2c, 0x4b, 0x7b, 0x6c, 0x36, 0xb2, 0x9d, 0xeb,
406 			     0x2c, 0xb0, 0x08, 0x46, 0x51, 0x75, 0x5c, 0x96 },
407 		.public = { 0xff, 0xff, 0xff, 0xfb, 0xff, 0xff, 0xfb, 0xff,
408 			    0xff, 0xdf, 0xff, 0xff, 0xdf, 0xff, 0xff, 0xff,
409 			    0xfe, 0xff, 0xff, 0xfe, 0xff, 0xff, 0xf7, 0xff,
410 			    0xff, 0xf7, 0xff, 0xff, 0xbf, 0xff, 0xff, 0x3f },
411 		.result = { 0xbf, 0x9a, 0xff, 0xd0, 0x6b, 0x84, 0x40, 0x85,
412 			    0x58, 0x64, 0x60, 0x96, 0x2e, 0xf2, 0x14, 0x6f,
413 			    0xf3, 0xd4, 0x53, 0x3d, 0x94, 0x44, 0xaa, 0xb0,
414 			    0x06, 0xeb, 0x88, 0xcc, 0x30, 0x54, 0x40, 0x7d },
415 		.valid = true
416 	},
417 	/* wycheproof - edge case for public key */
418 	{
419 		.private = { 0x18, 0x8c, 0x4b, 0xc5, 0xb9, 0xc4, 0x4b, 0x38,
420 			     0xbb, 0x65, 0x8b, 0x9b, 0x2a, 0xe8, 0x2d, 0x5b,
421 			     0x01, 0x01, 0x5e, 0x09, 0x31, 0x84, 0xb1, 0x7c,
422 			     0xb7, 0x86, 0x35, 0x03, 0xa7, 0x83, 0xe1, 0xbb },
423 		.public = { 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
424 			    0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
425 			    0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
426 			    0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x3f },
427 		.result = { 0xd4, 0x80, 0xde, 0x04, 0xf6, 0x99, 0xcb, 0x3b,
428 			    0xe0, 0x68, 0x4a, 0x9c, 0xc2, 0xe3, 0x12, 0x81,
429 			    0xea, 0x0b, 0xc5, 0xa9, 0xdc, 0xc1, 0x57, 0xd3,
430 			    0xd2, 0x01, 0x58, 0xd4, 0x6c, 0xa5, 0x24, 0x6d },
431 		.valid = true
432 	},
433 	/* wycheproof - edge case for public key */
434 	{
435 		.private = { 0xe0, 0x6c, 0x11, 0xbb, 0x2e, 0x13, 0xce, 0x3d,
436 			     0xc7, 0x67, 0x3f, 0x67, 0xf5, 0x48, 0x22, 0x42,
437 			     0x90, 0x94, 0x23, 0xa9, 0xae, 0x95, 0xee, 0x98,
438 			     0x6a, 0x98, 0x8d, 0x98, 0xfa, 0xee, 0x23, 0xa2 },
439 		.public = { 0xff, 0xff, 0xff, 0xff, 0xfe, 0xff, 0xff, 0x7f,
440 			    0xff, 0xff, 0xff, 0xff, 0xfe, 0xff, 0xff, 0x7f,
441 			    0xff, 0xff, 0xff, 0xff, 0xfe, 0xff, 0xff, 0x7f,
442 			    0xff, 0xff, 0xff, 0xff, 0xfe, 0xff, 0xff, 0x7f },
443 		.result = { 0x4c, 0x44, 0x01, 0xcc, 0xe6, 0xb5, 0x1e, 0x4c,
444 			    0xb1, 0x8f, 0x27, 0x90, 0x24, 0x6c, 0x9b, 0xf9,
445 			    0x14, 0xdb, 0x66, 0x77, 0x50, 0xa1, 0xcb, 0x89,
446 			    0x06, 0x90, 0x92, 0xaf, 0x07, 0x29, 0x22, 0x76 },
447 		.valid = true
448 	},
449 	/* wycheproof - edge case for public key */
450 	{
451 		.private = { 0xc0, 0x65, 0x8c, 0x46, 0xdd, 0xe1, 0x81, 0x29,
452 			     0x29, 0x38, 0x77, 0x53, 0x5b, 0x11, 0x62, 0xb6,
453 			     0xf9, 0xf5, 0x41, 0x4a, 0x23, 0xcf, 0x4d, 0x2c,
454 			     0xbc, 0x14, 0x0a, 0x4d, 0x99, 0xda, 0x2b, 0x8f },
455 		.public = { 0xeb, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
456 			    0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
457 			    0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
458 			    0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x7f },
459 		.result = { 0x57, 0x8b, 0xa8, 0xcc, 0x2d, 0xbd, 0xc5, 0x75,
460 			    0xaf, 0xcf, 0x9d, 0xf2, 0xb3, 0xee, 0x61, 0x89,
461 			    0xf5, 0x33, 0x7d, 0x68, 0x54, 0xc7, 0x9b, 0x4c,
462 			    0xe1, 0x65, 0xea, 0x12, 0x29, 0x3b, 0x3a, 0x0f },
463 		.valid = true
464 	},
465 	/* wycheproof - public key with low order */
466 	{
467 		.private = { 0x10, 0x25, 0x5c, 0x92, 0x30, 0xa9, 0x7a, 0x30,
468 			     0xa4, 0x58, 0xca, 0x28, 0x4a, 0x62, 0x96, 0x69,
469 			     0x29, 0x3a, 0x31, 0x89, 0x0c, 0xda, 0x9d, 0x14,
470 			     0x7f, 0xeb, 0xc7, 0xd1, 0xe2, 0x2d, 0x6b, 0xb1 },
471 		.public = { 0xe0, 0xeb, 0x7a, 0x7c, 0x3b, 0x41, 0xb8, 0xae,
472 			    0x16, 0x56, 0xe3, 0xfa, 0xf1, 0x9f, 0xc4, 0x6a,
473 			    0xda, 0x09, 0x8d, 0xeb, 0x9c, 0x32, 0xb1, 0xfd,
474 			    0x86, 0x62, 0x05, 0x16, 0x5f, 0x49, 0xb8, 0x00 },
475 		.result = { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
476 			    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
477 			    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
478 			    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 },
479 		.valid = false
480 	},
481 	/* wycheproof - public key with low order */
482 	{
483 		.private = { 0x78, 0xf1, 0xe8, 0xed, 0xf1, 0x44, 0x81, 0xb3,
484 			     0x89, 0x44, 0x8d, 0xac, 0x8f, 0x59, 0xc7, 0x0b,
485 			     0x03, 0x8e, 0x7c, 0xf9, 0x2e, 0xf2, 0xc7, 0xef,
486 			     0xf5, 0x7a, 0x72, 0x46, 0x6e, 0x11, 0x52, 0x96 },
487 		.public = { 0x5f, 0x9c, 0x95, 0xbc, 0xa3, 0x50, 0x8c, 0x24,
488 			    0xb1, 0xd0, 0xb1, 0x55, 0x9c, 0x83, 0xef, 0x5b,
489 			    0x04, 0x44, 0x5c, 0xc4, 0x58, 0x1c, 0x8e, 0x86,
490 			    0xd8, 0x22, 0x4e, 0xdd, 0xd0, 0x9f, 0x11, 0x57 },
491 		.result = { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
492 			    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
493 			    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
494 			    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 },
495 		.valid = false
496 	},
497 	/* wycheproof - public key with low order */
498 	{
499 		.private = { 0xa0, 0xa0, 0x5a, 0x3e, 0x8f, 0x9f, 0x44, 0x20,
500 			     0x4d, 0x5f, 0x80, 0x59, 0xa9, 0x4a, 0xc7, 0xdf,
501 			     0xc3, 0x9a, 0x49, 0xac, 0x01, 0x6d, 0xd7, 0x43,
502 			     0xdb, 0xfa, 0x43, 0xc5, 0xd6, 0x71, 0xfd, 0x88 },
503 		.public = { 0xec, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
504 			    0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
505 			    0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
506 			    0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x7f },
507 		.result = { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
508 			    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
509 			    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
510 			    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 },
511 		.valid = false
512 	},
513 	/* wycheproof - public key with low order */
514 	{
515 		.private = { 0xd0, 0xdb, 0xb3, 0xed, 0x19, 0x06, 0x66, 0x3f,
516 			     0x15, 0x42, 0x0a, 0xf3, 0x1f, 0x4e, 0xaf, 0x65,
517 			     0x09, 0xd9, 0xa9, 0x94, 0x97, 0x23, 0x50, 0x06,
518 			     0x05, 0xad, 0x7c, 0x1c, 0x6e, 0x74, 0x50, 0xa9 },
519 		.public = { 0xed, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
520 			    0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
521 			    0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
522 			    0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x7f },
523 		.result = { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
524 			    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
525 			    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
526 			    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 },
527 		.valid = false
528 	},
529 	/* wycheproof - public key with low order */
530 	{
531 		.private = { 0xc0, 0xb1, 0xd0, 0xeb, 0x22, 0xb2, 0x44, 0xfe,
532 			     0x32, 0x91, 0x14, 0x00, 0x72, 0xcd, 0xd9, 0xd9,
533 			     0x89, 0xb5, 0xf0, 0xec, 0xd9, 0x6c, 0x10, 0x0f,
534 			     0xeb, 0x5b, 0xca, 0x24, 0x1c, 0x1d, 0x9f, 0x8f },
535 		.public = { 0xee, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
536 			    0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
537 			    0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
538 			    0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x7f },
539 		.result = { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
540 			    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
541 			    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
542 			    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 },
543 		.valid = false
544 	},
545 	/* wycheproof - public key with low order */
546 	{
547 		.private = { 0x48, 0x0b, 0xf4, 0x5f, 0x59, 0x49, 0x42, 0xa8,
548 			     0xbc, 0x0f, 0x33, 0x53, 0xc6, 0xe8, 0xb8, 0x85,
549 			     0x3d, 0x77, 0xf3, 0x51, 0xf1, 0xc2, 0xca, 0x6c,
550 			     0x2d, 0x1a, 0xbf, 0x8a, 0x00, 0xb4, 0x22, 0x9c },
551 		.public = { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
552 			    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
553 			    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
554 			    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x80 },
555 		.result = { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
556 			    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
557 			    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
558 			    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 },
559 		.valid = false
560 	},
561 	/* wycheproof - public key with low order */
562 	{
563 		.private = { 0x30, 0xf9, 0x93, 0xfc, 0xf8, 0x51, 0x4f, 0xc8,
564 			     0x9b, 0xd8, 0xdb, 0x14, 0xcd, 0x43, 0xba, 0x0d,
565 			     0x4b, 0x25, 0x30, 0xe7, 0x3c, 0x42, 0x76, 0xa0,
566 			     0x5e, 0x1b, 0x14, 0x5d, 0x42, 0x0c, 0xed, 0xb4 },
567 		.public = { 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
568 			    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
569 			    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
570 			    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x80 },
571 		.result = { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
572 			    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
573 			    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
574 			    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 },
575 		.valid = false
576 	},
577 	/* wycheproof - public key with low order */
578 	{
579 		.private = { 0xc0, 0x49, 0x74, 0xb7, 0x58, 0x38, 0x0e, 0x2a,
580 			     0x5b, 0x5d, 0xf6, 0xeb, 0x09, 0xbb, 0x2f, 0x6b,
581 			     0x34, 0x34, 0xf9, 0x82, 0x72, 0x2a, 0x8e, 0x67,
582 			     0x6d, 0x3d, 0xa2, 0x51, 0xd1, 0xb3, 0xde, 0x83 },
583 		.public = { 0xe0, 0xeb, 0x7a, 0x7c, 0x3b, 0x41, 0xb8, 0xae,
584 			    0x16, 0x56, 0xe3, 0xfa, 0xf1, 0x9f, 0xc4, 0x6a,
585 			    0xda, 0x09, 0x8d, 0xeb, 0x9c, 0x32, 0xb1, 0xfd,
586 			    0x86, 0x62, 0x05, 0x16, 0x5f, 0x49, 0xb8, 0x80 },
587 		.result = { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
588 			    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
589 			    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
590 			    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 },
591 		.valid = false
592 	},
593 	/* wycheproof - public key with low order */
594 	{
595 		.private = { 0x50, 0x2a, 0x31, 0x37, 0x3d, 0xb3, 0x24, 0x46,
596 			     0x84, 0x2f, 0xe5, 0xad, 0xd3, 0xe0, 0x24, 0x02,
597 			     0x2e, 0xa5, 0x4f, 0x27, 0x41, 0x82, 0xaf, 0xc3,
598 			     0xd9, 0xf1, 0xbb, 0x3d, 0x39, 0x53, 0x4e, 0xb5 },
599 		.public = { 0x5f, 0x9c, 0x95, 0xbc, 0xa3, 0x50, 0x8c, 0x24,
600 			    0xb1, 0xd0, 0xb1, 0x55, 0x9c, 0x83, 0xef, 0x5b,
601 			    0x04, 0x44, 0x5c, 0xc4, 0x58, 0x1c, 0x8e, 0x86,
602 			    0xd8, 0x22, 0x4e, 0xdd, 0xd0, 0x9f, 0x11, 0xd7 },
603 		.result = { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
604 			    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
605 			    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
606 			    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 },
607 		.valid = false
608 	},
609 	/* wycheproof - public key with low order */
610 	{
611 		.private = { 0x90, 0xfa, 0x64, 0x17, 0xb0, 0xe3, 0x70, 0x30,
612 			     0xfd, 0x6e, 0x43, 0xef, 0xf2, 0xab, 0xae, 0xf1,
613 			     0x4c, 0x67, 0x93, 0x11, 0x7a, 0x03, 0x9c, 0xf6,
614 			     0x21, 0x31, 0x8b, 0xa9, 0x0f, 0x4e, 0x98, 0xbe },
615 		.public = { 0xec, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
616 			    0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
617 			    0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
618 			    0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff },
619 		.result = { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
620 			    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
621 			    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
622 			    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 },
623 		.valid = false
624 	},
625 	/* wycheproof - public key with low order */
626 	{
627 		.private = { 0x78, 0xad, 0x3f, 0x26, 0x02, 0x7f, 0x1c, 0x9f,
628 			     0xdd, 0x97, 0x5a, 0x16, 0x13, 0xb9, 0x47, 0x77,
629 			     0x9b, 0xad, 0x2c, 0xf2, 0xb7, 0x41, 0xad, 0xe0,
630 			     0x18, 0x40, 0x88, 0x5a, 0x30, 0xbb, 0x97, 0x9c },
631 		.public = { 0xed, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
632 			    0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
633 			    0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
634 			    0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff },
635 		.result = { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
636 			    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
637 			    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
638 			    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 },
639 		.valid = false
640 	},
641 	/* wycheproof - public key with low order */
642 	{
643 		.private = { 0x98, 0xe2, 0x3d, 0xe7, 0xb1, 0xe0, 0x92, 0x6e,
644 			     0xd9, 0xc8, 0x7e, 0x7b, 0x14, 0xba, 0xf5, 0x5f,
645 			     0x49, 0x7a, 0x1d, 0x70, 0x96, 0xf9, 0x39, 0x77,
646 			     0x68, 0x0e, 0x44, 0xdc, 0x1c, 0x7b, 0x7b, 0x8b },
647 		.public = { 0xee, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
648 			    0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
649 			    0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
650 			    0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff },
651 		.result = { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
652 			    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
653 			    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
654 			    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 },
655 		.valid = false
656 	},
657 	/* wycheproof - public key >= p */
658 	{
659 		.private = { 0xf0, 0x1e, 0x48, 0xda, 0xfa, 0xc9, 0xd7, 0xbc,
660 			     0xf5, 0x89, 0xcb, 0xc3, 0x82, 0xc8, 0x78, 0xd1,
661 			     0x8b, 0xda, 0x35, 0x50, 0x58, 0x9f, 0xfb, 0x5d,
662 			     0x50, 0xb5, 0x23, 0xbe, 0xbe, 0x32, 0x9d, 0xae },
663 		.public = { 0xef, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
664 			    0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
665 			    0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
666 			    0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x7f },
667 		.result = { 0xbd, 0x36, 0xa0, 0x79, 0x0e, 0xb8, 0x83, 0x09,
668 			    0x8c, 0x98, 0x8b, 0x21, 0x78, 0x67, 0x73, 0xde,
669 			    0x0b, 0x3a, 0x4d, 0xf1, 0x62, 0x28, 0x2c, 0xf1,
670 			    0x10, 0xde, 0x18, 0xdd, 0x48, 0x4c, 0xe7, 0x4b },
671 		.valid = true
672 	},
673 	/* wycheproof - public key >= p */
674 	{
675 		.private = { 0x28, 0x87, 0x96, 0xbc, 0x5a, 0xff, 0x4b, 0x81,
676 			     0xa3, 0x75, 0x01, 0x75, 0x7b, 0xc0, 0x75, 0x3a,
677 			     0x3c, 0x21, 0x96, 0x47, 0x90, 0xd3, 0x86, 0x99,
678 			     0x30, 0x8d, 0xeb, 0xc1, 0x7a, 0x6e, 0xaf, 0x8d },
679 		.public = { 0xf0, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
680 			    0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
681 			    0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
682 			    0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x7f },
683 		.result = { 0xb4, 0xe0, 0xdd, 0x76, 0xda, 0x7b, 0x07, 0x17,
684 			    0x28, 0xb6, 0x1f, 0x85, 0x67, 0x71, 0xaa, 0x35,
685 			    0x6e, 0x57, 0xed, 0xa7, 0x8a, 0x5b, 0x16, 0x55,
686 			    0xcc, 0x38, 0x20, 0xfb, 0x5f, 0x85, 0x4c, 0x5c },
687 		.valid = true
688 	},
689 	/* wycheproof - public key >= p */
690 	{
691 		.private = { 0x98, 0xdf, 0x84, 0x5f, 0x66, 0x51, 0xbf, 0x11,
692 			     0x38, 0x22, 0x1f, 0x11, 0x90, 0x41, 0xf7, 0x2b,
693 			     0x6d, 0xbc, 0x3c, 0x4a, 0xce, 0x71, 0x43, 0xd9,
694 			     0x9f, 0xd5, 0x5a, 0xd8, 0x67, 0x48, 0x0d, 0xa8 },
695 		.public = { 0xf1, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
696 			    0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
697 			    0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
698 			    0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x7f },
699 		.result = { 0x6f, 0xdf, 0x6c, 0x37, 0x61, 0x1d, 0xbd, 0x53,
700 			    0x04, 0xdc, 0x0f, 0x2e, 0xb7, 0xc9, 0x51, 0x7e,
701 			    0xb3, 0xc5, 0x0e, 0x12, 0xfd, 0x05, 0x0a, 0xc6,
702 			    0xde, 0xc2, 0x70, 0x71, 0xd4, 0xbf, 0xc0, 0x34 },
703 		.valid = true
704 	},
705 	/* wycheproof - public key >= p */
706 	{
707 		.private = { 0xf0, 0x94, 0x98, 0xe4, 0x6f, 0x02, 0xf8, 0x78,
708 			     0x82, 0x9e, 0x78, 0xb8, 0x03, 0xd3, 0x16, 0xa2,
709 			     0xed, 0x69, 0x5d, 0x04, 0x98, 0xa0, 0x8a, 0xbd,
710 			     0xf8, 0x27, 0x69, 0x30, 0xe2, 0x4e, 0xdc, 0xb0 },
711 		.public = { 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
712 			    0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
713 			    0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
714 			    0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x7f },
715 		.result = { 0x4c, 0x8f, 0xc4, 0xb1, 0xc6, 0xab, 0x88, 0xfb,
716 			    0x21, 0xf1, 0x8f, 0x6d, 0x4c, 0x81, 0x02, 0x40,
717 			    0xd4, 0xe9, 0x46, 0x51, 0xba, 0x44, 0xf7, 0xa2,
718 			    0xc8, 0x63, 0xce, 0xc7, 0xdc, 0x56, 0x60, 0x2d },
719 		.valid = true
720 	},
721 	/* wycheproof - public key >= p */
722 	{
723 		.private = { 0x18, 0x13, 0xc1, 0x0a, 0x5c, 0x7f, 0x21, 0xf9,
724 			     0x6e, 0x17, 0xf2, 0x88, 0xc0, 0xcc, 0x37, 0x60,
725 			     0x7c, 0x04, 0xc5, 0xf5, 0xae, 0xa2, 0xdb, 0x13,
726 			     0x4f, 0x9e, 0x2f, 0xfc, 0x66, 0xbd, 0x9d, 0xb8 },
727 		.public = { 0x02, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
728 			    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
729 			    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
730 			    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x80 },
731 		.result = { 0x1c, 0xd0, 0xb2, 0x82, 0x67, 0xdc, 0x54, 0x1c,
732 			    0x64, 0x2d, 0x6d, 0x7d, 0xca, 0x44, 0xa8, 0xb3,
733 			    0x8a, 0x63, 0x73, 0x6e, 0xef, 0x5c, 0x4e, 0x65,
734 			    0x01, 0xff, 0xbb, 0xb1, 0x78, 0x0c, 0x03, 0x3c },
735 		.valid = true
736 	},
737 	/* wycheproof - public key >= p */
738 	{
739 		.private = { 0x78, 0x57, 0xfb, 0x80, 0x86, 0x53, 0x64, 0x5a,
740 			     0x0b, 0xeb, 0x13, 0x8a, 0x64, 0xf5, 0xf4, 0xd7,
741 			     0x33, 0xa4, 0x5e, 0xa8, 0x4c, 0x3c, 0xda, 0x11,
742 			     0xa9, 0xc0, 0x6f, 0x7e, 0x71, 0x39, 0x14, 0x9e },
743 		.public = { 0x03, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
744 			    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
745 			    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
746 			    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x80 },
747 		.result = { 0x87, 0x55, 0xbe, 0x01, 0xc6, 0x0a, 0x7e, 0x82,
748 			    0x5c, 0xff, 0x3e, 0x0e, 0x78, 0xcb, 0x3a, 0xa4,
749 			    0x33, 0x38, 0x61, 0x51, 0x6a, 0xa5, 0x9b, 0x1c,
750 			    0x51, 0xa8, 0xb2, 0xa5, 0x43, 0xdf, 0xa8, 0x22 },
751 		.valid = true
752 	},
753 	/* wycheproof - public key >= p */
754 	{
755 		.private = { 0xe0, 0x3a, 0xa8, 0x42, 0xe2, 0xab, 0xc5, 0x6e,
756 			     0x81, 0xe8, 0x7b, 0x8b, 0x9f, 0x41, 0x7b, 0x2a,
757 			     0x1e, 0x59, 0x13, 0xc7, 0x23, 0xee, 0xd2, 0x8d,
758 			     0x75, 0x2f, 0x8d, 0x47, 0xa5, 0x9f, 0x49, 0x8f },
759 		.public = { 0x04, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
760 			    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
761 			    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
762 			    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x80 },
763 		.result = { 0x54, 0xc9, 0xa1, 0xed, 0x95, 0xe5, 0x46, 0xd2,
764 			    0x78, 0x22, 0xa3, 0x60, 0x93, 0x1d, 0xda, 0x60,
765 			    0xa1, 0xdf, 0x04, 0x9d, 0xa6, 0xf9, 0x04, 0x25,
766 			    0x3c, 0x06, 0x12, 0xbb, 0xdc, 0x08, 0x74, 0x76 },
767 		.valid = true
768 	},
769 	/* wycheproof - public key >= p */
770 	{
771 		.private = { 0xf8, 0xf7, 0x07, 0xb7, 0x99, 0x9b, 0x18, 0xcb,
772 			     0x0d, 0x6b, 0x96, 0x12, 0x4f, 0x20, 0x45, 0x97,
773 			     0x2c, 0xa2, 0x74, 0xbf, 0xc1, 0x54, 0xad, 0x0c,
774 			     0x87, 0x03, 0x8c, 0x24, 0xc6, 0xd0, 0xd4, 0xb2 },
775 		.public = { 0xda, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
776 			    0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
777 			    0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
778 			    0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff },
779 		.result = { 0xcc, 0x1f, 0x40, 0xd7, 0x43, 0xcd, 0xc2, 0x23,
780 			    0x0e, 0x10, 0x43, 0xda, 0xba, 0x8b, 0x75, 0xe8,
781 			    0x10, 0xf1, 0xfb, 0xab, 0x7f, 0x25, 0x52, 0x69,
782 			    0xbd, 0x9e, 0xbb, 0x29, 0xe6, 0xbf, 0x49, 0x4f },
783 		.valid = true
784 	},
785 	/* wycheproof - public key >= p */
786 	{
787 		.private = { 0xa0, 0x34, 0xf6, 0x84, 0xfa, 0x63, 0x1e, 0x1a,
788 			     0x34, 0x81, 0x18, 0xc1, 0xce, 0x4c, 0x98, 0x23,
789 			     0x1f, 0x2d, 0x9e, 0xec, 0x9b, 0xa5, 0x36, 0x5b,
790 			     0x4a, 0x05, 0xd6, 0x9a, 0x78, 0x5b, 0x07, 0x96 },
791 		.public = { 0xdb, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
792 			    0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
793 			    0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
794 			    0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff },
795 		.result = { 0x54, 0x99, 0x8e, 0xe4, 0x3a, 0x5b, 0x00, 0x7b,
796 			    0xf4, 0x99, 0xf0, 0x78, 0xe7, 0x36, 0x52, 0x44,
797 			    0x00, 0xa8, 0xb5, 0xc7, 0xe9, 0xb9, 0xb4, 0x37,
798 			    0x71, 0x74, 0x8c, 0x7c, 0xdf, 0x88, 0x04, 0x12 },
799 		.valid = true
800 	},
801 	/* wycheproof - public key >= p */
802 	{
803 		.private = { 0x30, 0xb6, 0xc6, 0xa0, 0xf2, 0xff, 0xa6, 0x80,
804 			     0x76, 0x8f, 0x99, 0x2b, 0xa8, 0x9e, 0x15, 0x2d,
805 			     0x5b, 0xc9, 0x89, 0x3d, 0x38, 0xc9, 0x11, 0x9b,
806 			     0xe4, 0xf7, 0x67, 0xbf, 0xab, 0x6e, 0x0c, 0xa5 },
807 		.public = { 0xdc, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
808 			    0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
809 			    0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
810 			    0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff },
811 		.result = { 0xea, 0xd9, 0xb3, 0x8e, 0xfd, 0xd7, 0x23, 0x63,
812 			    0x79, 0x34, 0xe5, 0x5a, 0xb7, 0x17, 0xa7, 0xae,
813 			    0x09, 0xeb, 0x86, 0xa2, 0x1d, 0xc3, 0x6a, 0x3f,
814 			    0xee, 0xb8, 0x8b, 0x75, 0x9e, 0x39, 0x1e, 0x09 },
815 		.valid = true
816 	},
817 	/* wycheproof - public key >= p */
818 	{
819 		.private = { 0x90, 0x1b, 0x9d, 0xcf, 0x88, 0x1e, 0x01, 0xe0,
820 			     0x27, 0x57, 0x50, 0x35, 0xd4, 0x0b, 0x43, 0xbd,
821 			     0xc1, 0xc5, 0x24, 0x2e, 0x03, 0x08, 0x47, 0x49,
822 			     0x5b, 0x0c, 0x72, 0x86, 0x46, 0x9b, 0x65, 0x91 },
823 		.public = { 0xea, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
824 			    0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
825 			    0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
826 			    0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff },
827 		.result = { 0x60, 0x2f, 0xf4, 0x07, 0x89, 0xb5, 0x4b, 0x41,
828 			    0x80, 0x59, 0x15, 0xfe, 0x2a, 0x62, 0x21, 0xf0,
829 			    0x7a, 0x50, 0xff, 0xc2, 0xc3, 0xfc, 0x94, 0xcf,
830 			    0x61, 0xf1, 0x3d, 0x79, 0x04, 0xe8, 0x8e, 0x0e },
831 		.valid = true
832 	},
833 	/* wycheproof - public key >= p */
834 	{
835 		.private = { 0x80, 0x46, 0x67, 0x7c, 0x28, 0xfd, 0x82, 0xc9,
836 			     0xa1, 0xbd, 0xb7, 0x1a, 0x1a, 0x1a, 0x34, 0xfa,
837 			     0xba, 0x12, 0x25, 0xe2, 0x50, 0x7f, 0xe3, 0xf5,
838 			     0x4d, 0x10, 0xbd, 0x5b, 0x0d, 0x86, 0x5f, 0x8e },
839 		.public = { 0xeb, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
840 			    0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
841 			    0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
842 			    0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff },
843 		.result = { 0xe0, 0x0a, 0xe8, 0xb1, 0x43, 0x47, 0x12, 0x47,
844 			    0xba, 0x24, 0xf1, 0x2c, 0x88, 0x55, 0x36, 0xc3,
845 			    0xcb, 0x98, 0x1b, 0x58, 0xe1, 0xe5, 0x6b, 0x2b,
846 			    0xaf, 0x35, 0xc1, 0x2a, 0xe1, 0xf7, 0x9c, 0x26 },
847 		.valid = true
848 	},
849 	/* wycheproof - public key >= p */
850 	{
851 		.private = { 0x60, 0x2f, 0x7e, 0x2f, 0x68, 0xa8, 0x46, 0xb8,
852 			     0x2c, 0xc2, 0x69, 0xb1, 0xd4, 0x8e, 0x93, 0x98,
853 			     0x86, 0xae, 0x54, 0xfd, 0x63, 0x6c, 0x1f, 0xe0,
854 			     0x74, 0xd7, 0x10, 0x12, 0x7d, 0x47, 0x24, 0x91 },
855 		.public = { 0xef, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
856 			    0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
857 			    0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
858 			    0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff },
859 		.result = { 0x98, 0xcb, 0x9b, 0x50, 0xdd, 0x3f, 0xc2, 0xb0,
860 			    0xd4, 0xf2, 0xd2, 0xbf, 0x7c, 0x5c, 0xfd, 0xd1,
861 			    0x0c, 0x8f, 0xcd, 0x31, 0xfc, 0x40, 0xaf, 0x1a,
862 			    0xd4, 0x4f, 0x47, 0xc1, 0x31, 0x37, 0x63, 0x62 },
863 		.valid = true
864 	},
865 	/* wycheproof - public key >= p */
866 	{
867 		.private = { 0x60, 0x88, 0x7b, 0x3d, 0xc7, 0x24, 0x43, 0x02,
868 			     0x6e, 0xbe, 0xdb, 0xbb, 0xb7, 0x06, 0x65, 0xf4,
869 			     0x2b, 0x87, 0xad, 0xd1, 0x44, 0x0e, 0x77, 0x68,
870 			     0xfb, 0xd7, 0xe8, 0xe2, 0xce, 0x5f, 0x63, 0x9d },
871 		.public = { 0xf0, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
872 			    0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
873 			    0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
874 			    0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff },
875 		.result = { 0x38, 0xd6, 0x30, 0x4c, 0x4a, 0x7e, 0x6d, 0x9f,
876 			    0x79, 0x59, 0x33, 0x4f, 0xb5, 0x24, 0x5b, 0xd2,
877 			    0xc7, 0x54, 0x52, 0x5d, 0x4c, 0x91, 0xdb, 0x95,
878 			    0x02, 0x06, 0x92, 0x62, 0x34, 0xc1, 0xf6, 0x33 },
879 		.valid = true
880 	},
881 	/* wycheproof - public key >= p */
882 	{
883 		.private = { 0x78, 0xd3, 0x1d, 0xfa, 0x85, 0x44, 0x97, 0xd7,
884 			     0x2d, 0x8d, 0xef, 0x8a, 0x1b, 0x7f, 0xb0, 0x06,
885 			     0xce, 0xc2, 0xd8, 0xc4, 0x92, 0x46, 0x47, 0xc9,
886 			     0x38, 0x14, 0xae, 0x56, 0xfa, 0xed, 0xa4, 0x95 },
887 		.public = { 0xf1, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
888 			    0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
889 			    0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
890 			    0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff },
891 		.result = { 0x78, 0x6c, 0xd5, 0x49, 0x96, 0xf0, 0x14, 0xa5,
892 			    0xa0, 0x31, 0xec, 0x14, 0xdb, 0x81, 0x2e, 0xd0,
893 			    0x83, 0x55, 0x06, 0x1f, 0xdb, 0x5d, 0xe6, 0x80,
894 			    0xa8, 0x00, 0xac, 0x52, 0x1f, 0x31, 0x8e, 0x23 },
895 		.valid = true
896 	},
897 	/* wycheproof - public key >= p */
898 	{
899 		.private = { 0xc0, 0x4c, 0x5b, 0xae, 0xfa, 0x83, 0x02, 0xdd,
900 			     0xde, 0xd6, 0xa4, 0xbb, 0x95, 0x77, 0x61, 0xb4,
901 			     0xeb, 0x97, 0xae, 0xfa, 0x4f, 0xc3, 0xb8, 0x04,
902 			     0x30, 0x85, 0xf9, 0x6a, 0x56, 0x59, 0xb3, 0xa5 },
903 		.public = { 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
904 			    0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
905 			    0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
906 			    0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff },
907 		.result = { 0x29, 0xae, 0x8b, 0xc7, 0x3e, 0x9b, 0x10, 0xa0,
908 			    0x8b, 0x4f, 0x68, 0x1c, 0x43, 0xc3, 0xe0, 0xac,
909 			    0x1a, 0x17, 0x1d, 0x31, 0xb3, 0x8f, 0x1a, 0x48,
910 			    0xef, 0xba, 0x29, 0xae, 0x63, 0x9e, 0xa1, 0x34 },
911 		.valid = true
912 	},
913 	/* wycheproof - RFC 7748 */
914 	{
915 		.private = { 0xa0, 0x46, 0xe3, 0x6b, 0xf0, 0x52, 0x7c, 0x9d,
916 			     0x3b, 0x16, 0x15, 0x4b, 0x82, 0x46, 0x5e, 0xdd,
917 			     0x62, 0x14, 0x4c, 0x0a, 0xc1, 0xfc, 0x5a, 0x18,
918 			     0x50, 0x6a, 0x22, 0x44, 0xba, 0x44, 0x9a, 0x44 },
919 		.public = { 0xe6, 0xdb, 0x68, 0x67, 0x58, 0x30, 0x30, 0xdb,
920 			    0x35, 0x94, 0xc1, 0xa4, 0x24, 0xb1, 0x5f, 0x7c,
921 			    0x72, 0x66, 0x24, 0xec, 0x26, 0xb3, 0x35, 0x3b,
922 			    0x10, 0xa9, 0x03, 0xa6, 0xd0, 0xab, 0x1c, 0x4c },
923 		.result = { 0xc3, 0xda, 0x55, 0x37, 0x9d, 0xe9, 0xc6, 0x90,
924 			    0x8e, 0x94, 0xea, 0x4d, 0xf2, 0x8d, 0x08, 0x4f,
925 			    0x32, 0xec, 0xcf, 0x03, 0x49, 0x1c, 0x71, 0xf7,
926 			    0x54, 0xb4, 0x07, 0x55, 0x77, 0xa2, 0x85, 0x52 },
927 		.valid = true
928 	},
929 	/* wycheproof - RFC 7748 */
930 	{
931 		.private = { 0x48, 0x66, 0xe9, 0xd4, 0xd1, 0xb4, 0x67, 0x3c,
932 			     0x5a, 0xd2, 0x26, 0x91, 0x95, 0x7d, 0x6a, 0xf5,
933 			     0xc1, 0x1b, 0x64, 0x21, 0xe0, 0xea, 0x01, 0xd4,
934 			     0x2c, 0xa4, 0x16, 0x9e, 0x79, 0x18, 0xba, 0x4d },
935 		.public = { 0xe5, 0x21, 0x0f, 0x12, 0x78, 0x68, 0x11, 0xd3,
936 			    0xf4, 0xb7, 0x95, 0x9d, 0x05, 0x38, 0xae, 0x2c,
937 			    0x31, 0xdb, 0xe7, 0x10, 0x6f, 0xc0, 0x3c, 0x3e,
938 			    0xfc, 0x4c, 0xd5, 0x49, 0xc7, 0x15, 0xa4, 0x13 },
939 		.result = { 0x95, 0xcb, 0xde, 0x94, 0x76, 0xe8, 0x90, 0x7d,
940 			    0x7a, 0xad, 0xe4, 0x5c, 0xb4, 0xb8, 0x73, 0xf8,
941 			    0x8b, 0x59, 0x5a, 0x68, 0x79, 0x9f, 0xa1, 0x52,
942 			    0xe6, 0xf8, 0xf7, 0x64, 0x7a, 0xac, 0x79, 0x57 },
943 		.valid = true
944 	},
945 	/* wycheproof - edge case for shared secret */
946 	{
947 		.private = { 0xa0, 0xa4, 0xf1, 0x30, 0xb9, 0x8a, 0x5b, 0xe4,
948 			     0xb1, 0xce, 0xdb, 0x7c, 0xb8, 0x55, 0x84, 0xa3,
949 			     0x52, 0x0e, 0x14, 0x2d, 0x47, 0x4d, 0xc9, 0xcc,
950 			     0xb9, 0x09, 0xa0, 0x73, 0xa9, 0x76, 0xbf, 0x63 },
951 		.public = { 0x0a, 0xb4, 0xe7, 0x63, 0x80, 0xd8, 0x4d, 0xde,
952 			    0x4f, 0x68, 0x33, 0xc5, 0x8f, 0x2a, 0x9f, 0xb8,
953 			    0xf8, 0x3b, 0xb0, 0x16, 0x9b, 0x17, 0x2b, 0xe4,
954 			    0xb6, 0xe0, 0x59, 0x28, 0x87, 0x74, 0x1a, 0x36 },
955 		.result = { 0x02, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
956 			    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
957 			    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
958 			    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 },
959 		.valid = true
960 	},
961 	/* wycheproof - edge case for shared secret */
962 	{
963 		.private = { 0xa0, 0xa4, 0xf1, 0x30, 0xb9, 0x8a, 0x5b, 0xe4,
964 			     0xb1, 0xce, 0xdb, 0x7c, 0xb8, 0x55, 0x84, 0xa3,
965 			     0x52, 0x0e, 0x14, 0x2d, 0x47, 0x4d, 0xc9, 0xcc,
966 			     0xb9, 0x09, 0xa0, 0x73, 0xa9, 0x76, 0xbf, 0x63 },
967 		.public = { 0x89, 0xe1, 0x0d, 0x57, 0x01, 0xb4, 0x33, 0x7d,
968 			    0x2d, 0x03, 0x21, 0x81, 0x53, 0x8b, 0x10, 0x64,
969 			    0xbd, 0x40, 0x84, 0x40, 0x1c, 0xec, 0xa1, 0xfd,
970 			    0x12, 0x66, 0x3a, 0x19, 0x59, 0x38, 0x80, 0x00 },
971 		.result = { 0x09, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
972 			    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
973 			    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
974 			    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 },
975 		.valid = true
976 	},
977 	/* wycheproof - edge case for shared secret */
978 	{
979 		.private = { 0xa0, 0xa4, 0xf1, 0x30, 0xb9, 0x8a, 0x5b, 0xe4,
980 			     0xb1, 0xce, 0xdb, 0x7c, 0xb8, 0x55, 0x84, 0xa3,
981 			     0x52, 0x0e, 0x14, 0x2d, 0x47, 0x4d, 0xc9, 0xcc,
982 			     0xb9, 0x09, 0xa0, 0x73, 0xa9, 0x76, 0xbf, 0x63 },
983 		.public = { 0x2b, 0x55, 0xd3, 0xaa, 0x4a, 0x8f, 0x80, 0xc8,
984 			    0xc0, 0xb2, 0xae, 0x5f, 0x93, 0x3e, 0x85, 0xaf,
985 			    0x49, 0xbe, 0xac, 0x36, 0xc2, 0xfa, 0x73, 0x94,
986 			    0xba, 0xb7, 0x6c, 0x89, 0x33, 0xf8, 0xf8, 0x1d },
987 		.result = { 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
988 			    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
989 			    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
990 			    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 },
991 		.valid = true
992 	},
993 	/* wycheproof - edge case for shared secret */
994 	{
995 		.private = { 0xa0, 0xa4, 0xf1, 0x30, 0xb9, 0x8a, 0x5b, 0xe4,
996 			     0xb1, 0xce, 0xdb, 0x7c, 0xb8, 0x55, 0x84, 0xa3,
997 			     0x52, 0x0e, 0x14, 0x2d, 0x47, 0x4d, 0xc9, 0xcc,
998 			     0xb9, 0x09, 0xa0, 0x73, 0xa9, 0x76, 0xbf, 0x63 },
999 		.public = { 0x63, 0xe5, 0xb1, 0xfe, 0x96, 0x01, 0xfe, 0x84,
1000 			    0x38, 0x5d, 0x88, 0x66, 0xb0, 0x42, 0x12, 0x62,
1001 			    0xf7, 0x8f, 0xbf, 0xa5, 0xaf, 0xf9, 0x58, 0x5e,
1002 			    0x62, 0x66, 0x79, 0xb1, 0x85, 0x47, 0xd9, 0x59 },
1003 		.result = { 0xfe, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
1004 			    0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
1005 			    0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
1006 			    0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x3f },
1007 		.valid = true
1008 	},
1009 	/* wycheproof - edge case for shared secret */
1010 	{
1011 		.private = { 0xa0, 0xa4, 0xf1, 0x30, 0xb9, 0x8a, 0x5b, 0xe4,
1012 			     0xb1, 0xce, 0xdb, 0x7c, 0xb8, 0x55, 0x84, 0xa3,
1013 			     0x52, 0x0e, 0x14, 0x2d, 0x47, 0x4d, 0xc9, 0xcc,
1014 			     0xb9, 0x09, 0xa0, 0x73, 0xa9, 0x76, 0xbf, 0x63 },
1015 		.public = { 0xe4, 0x28, 0xf3, 0xda, 0xc1, 0x78, 0x09, 0xf8,
1016 			    0x27, 0xa5, 0x22, 0xce, 0x32, 0x35, 0x50, 0x58,
1017 			    0xd0, 0x73, 0x69, 0x36, 0x4a, 0xa7, 0x89, 0x02,
1018 			    0xee, 0x10, 0x13, 0x9b, 0x9f, 0x9d, 0xd6, 0x53 },
1019 		.result = { 0xfc, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
1020 			    0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
1021 			    0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
1022 			    0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x3f },
1023 		.valid = true
1024 	},
1025 	/* wycheproof - edge case for shared secret */
1026 	{
1027 		.private = { 0xa0, 0xa4, 0xf1, 0x30, 0xb9, 0x8a, 0x5b, 0xe4,
1028 			     0xb1, 0xce, 0xdb, 0x7c, 0xb8, 0x55, 0x84, 0xa3,
1029 			     0x52, 0x0e, 0x14, 0x2d, 0x47, 0x4d, 0xc9, 0xcc,
1030 			     0xb9, 0x09, 0xa0, 0x73, 0xa9, 0x76, 0xbf, 0x63 },
1031 		.public = { 0xb3, 0xb5, 0x0e, 0x3e, 0xd3, 0xa4, 0x07, 0xb9,
1032 			    0x5d, 0xe9, 0x42, 0xef, 0x74, 0x57, 0x5b, 0x5a,
1033 			    0xb8, 0xa1, 0x0c, 0x09, 0xee, 0x10, 0x35, 0x44,
1034 			    0xd6, 0x0b, 0xdf, 0xed, 0x81, 0x38, 0xab, 0x2b },
1035 		.result = { 0xf9, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
1036 			    0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
1037 			    0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
1038 			    0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x3f },
1039 		.valid = true
1040 	},
1041 	/* wycheproof - edge case for shared secret */
1042 	{
1043 		.private = { 0xa0, 0xa4, 0xf1, 0x30, 0xb9, 0x8a, 0x5b, 0xe4,
1044 			     0xb1, 0xce, 0xdb, 0x7c, 0xb8, 0x55, 0x84, 0xa3,
1045 			     0x52, 0x0e, 0x14, 0x2d, 0x47, 0x4d, 0xc9, 0xcc,
1046 			     0xb9, 0x09, 0xa0, 0x73, 0xa9, 0x76, 0xbf, 0x63 },
1047 		.public = { 0x21, 0x3f, 0xff, 0xe9, 0x3d, 0x5e, 0xa8, 0xcd,
1048 			    0x24, 0x2e, 0x46, 0x28, 0x44, 0x02, 0x99, 0x22,
1049 			    0xc4, 0x3c, 0x77, 0xc9, 0xe3, 0xe4, 0x2f, 0x56,
1050 			    0x2f, 0x48, 0x5d, 0x24, 0xc5, 0x01, 0xa2, 0x0b },
1051 		.result = { 0xf3, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
1052 			    0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
1053 			    0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
1054 			    0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x3f },
1055 		.valid = true
1056 	},
1057 	/* wycheproof - edge case for shared secret */
1058 	{
1059 		.private = { 0xa0, 0xa4, 0xf1, 0x30, 0xb9, 0x8a, 0x5b, 0xe4,
1060 			     0xb1, 0xce, 0xdb, 0x7c, 0xb8, 0x55, 0x84, 0xa3,
1061 			     0x52, 0x0e, 0x14, 0x2d, 0x47, 0x4d, 0xc9, 0xcc,
1062 			     0xb9, 0x09, 0xa0, 0x73, 0xa9, 0x76, 0xbf, 0x63 },
1063 		.public = { 0x91, 0xb2, 0x32, 0xa1, 0x78, 0xb3, 0xcd, 0x53,
1064 			    0x09, 0x32, 0x44, 0x1e, 0x61, 0x39, 0x41, 0x8f,
1065 			    0x72, 0x17, 0x22, 0x92, 0xf1, 0xda, 0x4c, 0x18,
1066 			    0x34, 0xfc, 0x5e, 0xbf, 0xef, 0xb5, 0x1e, 0x3f },
1067 		.result = { 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
1068 			    0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
1069 			    0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
1070 			    0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x03 },
1071 		.valid = true
1072 	},
1073 	/* wycheproof - edge case for shared secret */
1074 	{
1075 		.private = { 0xa0, 0xa4, 0xf1, 0x30, 0xb9, 0x8a, 0x5b, 0xe4,
1076 			     0xb1, 0xce, 0xdb, 0x7c, 0xb8, 0x55, 0x84, 0xa3,
1077 			     0x52, 0x0e, 0x14, 0x2d, 0x47, 0x4d, 0xc9, 0xcc,
1078 			     0xb9, 0x09, 0xa0, 0x73, 0xa9, 0x76, 0xbf, 0x63 },
1079 		.public = { 0x04, 0x5c, 0x6e, 0x11, 0xc5, 0xd3, 0x32, 0x55,
1080 			    0x6c, 0x78, 0x22, 0xfe, 0x94, 0xeb, 0xf8, 0x9b,
1081 			    0x56, 0xa3, 0x87, 0x8d, 0xc2, 0x7c, 0xa0, 0x79,
1082 			    0x10, 0x30, 0x58, 0x84, 0x9f, 0xab, 0xcb, 0x4f },
1083 		.result = { 0xe5, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
1084 			    0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
1085 			    0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
1086 			    0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x7f },
1087 		.valid = true
1088 	},
1089 	/* wycheproof - edge case for shared secret */
1090 	{
1091 		.private = { 0xa0, 0xa4, 0xf1, 0x30, 0xb9, 0x8a, 0x5b, 0xe4,
1092 			     0xb1, 0xce, 0xdb, 0x7c, 0xb8, 0x55, 0x84, 0xa3,
1093 			     0x52, 0x0e, 0x14, 0x2d, 0x47, 0x4d, 0xc9, 0xcc,
1094 			     0xb9, 0x09, 0xa0, 0x73, 0xa9, 0x76, 0xbf, 0x63 },
1095 		.public = { 0x1c, 0xa2, 0x19, 0x0b, 0x71, 0x16, 0x35, 0x39,
1096 			    0x06, 0x3c, 0x35, 0x77, 0x3b, 0xda, 0x0c, 0x9c,
1097 			    0x92, 0x8e, 0x91, 0x36, 0xf0, 0x62, 0x0a, 0xeb,
1098 			    0x09, 0x3f, 0x09, 0x91, 0x97, 0xb7, 0xf7, 0x4e },
1099 		.result = { 0xe3, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
1100 			    0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
1101 			    0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
1102 			    0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x7f },
1103 		.valid = true
1104 	},
1105 	/* wycheproof - edge case for shared secret */
1106 	{
1107 		.private = { 0xa0, 0xa4, 0xf1, 0x30, 0xb9, 0x8a, 0x5b, 0xe4,
1108 			     0xb1, 0xce, 0xdb, 0x7c, 0xb8, 0x55, 0x84, 0xa3,
1109 			     0x52, 0x0e, 0x14, 0x2d, 0x47, 0x4d, 0xc9, 0xcc,
1110 			     0xb9, 0x09, 0xa0, 0x73, 0xa9, 0x76, 0xbf, 0x63 },
1111 		.public = { 0xf7, 0x6e, 0x90, 0x10, 0xac, 0x33, 0xc5, 0x04,
1112 			    0x3b, 0x2d, 0x3b, 0x76, 0xa8, 0x42, 0x17, 0x10,
1113 			    0x00, 0xc4, 0x91, 0x62, 0x22, 0xe9, 0xe8, 0x58,
1114 			    0x97, 0xa0, 0xae, 0xc7, 0xf6, 0x35, 0x0b, 0x3c },
1115 		.result = { 0xdd, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
1116 			    0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
1117 			    0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
1118 			    0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x7f },
1119 		.valid = true
1120 	},
1121 	/* wycheproof - edge case for shared secret */
1122 	{
1123 		.private = { 0xa0, 0xa4, 0xf1, 0x30, 0xb9, 0x8a, 0x5b, 0xe4,
1124 			     0xb1, 0xce, 0xdb, 0x7c, 0xb8, 0x55, 0x84, 0xa3,
1125 			     0x52, 0x0e, 0x14, 0x2d, 0x47, 0x4d, 0xc9, 0xcc,
1126 			     0xb9, 0x09, 0xa0, 0x73, 0xa9, 0x76, 0xbf, 0x63 },
1127 		.public = { 0xbb, 0x72, 0x68, 0x8d, 0x8f, 0x8a, 0xa7, 0xa3,
1128 			    0x9c, 0xd6, 0x06, 0x0c, 0xd5, 0xc8, 0x09, 0x3c,
1129 			    0xde, 0xc6, 0xfe, 0x34, 0x19, 0x37, 0xc3, 0x88,
1130 			    0x6a, 0x99, 0x34, 0x6c, 0xd0, 0x7f, 0xaa, 0x55 },
1131 		.result = { 0xdb, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
1132 			    0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
1133 			    0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
1134 			    0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x7f },
1135 		.valid = true
1136 	},
1137 	/* wycheproof - edge case for shared secret */
1138 	{
1139 		.private = { 0xa0, 0xa4, 0xf1, 0x30, 0xb9, 0x8a, 0x5b, 0xe4,
1140 			     0xb1, 0xce, 0xdb, 0x7c, 0xb8, 0x55, 0x84, 0xa3,
1141 			     0x52, 0x0e, 0x14, 0x2d, 0x47, 0x4d, 0xc9, 0xcc,
1142 			     0xb9, 0x09, 0xa0, 0x73, 0xa9, 0x76, 0xbf, 0x63 },
1143 		.public = { 0x88, 0xfd, 0xde, 0xa1, 0x93, 0x39, 0x1c, 0x6a,
1144 			    0x59, 0x33, 0xef, 0x9b, 0x71, 0x90, 0x15, 0x49,
1145 			    0x44, 0x72, 0x05, 0xaa, 0xe9, 0xda, 0x92, 0x8a,
1146 			    0x6b, 0x91, 0xa3, 0x52, 0xba, 0x10, 0xf4, 0x1f },
1147 		.result = { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
1148 			    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
1149 			    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
1150 			    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02 },
1151 		.valid = true
1152 	},
1153 	/* wycheproof - edge case for shared secret */
1154 	{
1155 		.private = { 0xa0, 0xa4, 0xf1, 0x30, 0xb9, 0x8a, 0x5b, 0xe4,
1156 			     0xb1, 0xce, 0xdb, 0x7c, 0xb8, 0x55, 0x84, 0xa3,
1157 			     0x52, 0x0e, 0x14, 0x2d, 0x47, 0x4d, 0xc9, 0xcc,
1158 			     0xb9, 0x09, 0xa0, 0x73, 0xa9, 0x76, 0xbf, 0x63 },
1159 		.public = { 0x30, 0x3b, 0x39, 0x2f, 0x15, 0x31, 0x16, 0xca,
1160 			    0xd9, 0xcc, 0x68, 0x2a, 0x00, 0xcc, 0xc4, 0x4c,
1161 			    0x95, 0xff, 0x0d, 0x3b, 0xbe, 0x56, 0x8b, 0xeb,
1162 			    0x6c, 0x4e, 0x73, 0x9b, 0xaf, 0xdc, 0x2c, 0x68 },
1163 		.result = { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
1164 			    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
1165 			    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
1166 			    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x80, 0x00 },
1167 		.valid = true
1168 	},
1169 	/* wycheproof - checking for overflow */
1170 	{
1171 		.private = { 0xc8, 0x17, 0x24, 0x70, 0x40, 0x00, 0xb2, 0x6d,
1172 			     0x31, 0x70, 0x3c, 0xc9, 0x7e, 0x3a, 0x37, 0x8d,
1173 			     0x56, 0xfa, 0xd8, 0x21, 0x93, 0x61, 0xc8, 0x8c,
1174 			     0xca, 0x8b, 0xd7, 0xc5, 0x71, 0x9b, 0x12, 0xb2 },
1175 		.public = { 0xfd, 0x30, 0x0a, 0xeb, 0x40, 0xe1, 0xfa, 0x58,
1176 			    0x25, 0x18, 0x41, 0x2b, 0x49, 0xb2, 0x08, 0xa7,
1177 			    0x84, 0x2b, 0x1e, 0x1f, 0x05, 0x6a, 0x04, 0x01,
1178 			    0x78, 0xea, 0x41, 0x41, 0x53, 0x4f, 0x65, 0x2d },
1179 		.result = { 0xb7, 0x34, 0x10, 0x5d, 0xc2, 0x57, 0x58, 0x5d,
1180 			    0x73, 0xb5, 0x66, 0xcc, 0xb7, 0x6f, 0x06, 0x27,
1181 			    0x95, 0xcc, 0xbe, 0xc8, 0x91, 0x28, 0xe5, 0x2b,
1182 			    0x02, 0xf3, 0xe5, 0x96, 0x39, 0xf1, 0x3c, 0x46 },
1183 		.valid = true
1184 	},
1185 	/* wycheproof - checking for overflow */
1186 	{
1187 		.private = { 0xc8, 0x17, 0x24, 0x70, 0x40, 0x00, 0xb2, 0x6d,
1188 			     0x31, 0x70, 0x3c, 0xc9, 0x7e, 0x3a, 0x37, 0x8d,
1189 			     0x56, 0xfa, 0xd8, 0x21, 0x93, 0x61, 0xc8, 0x8c,
1190 			     0xca, 0x8b, 0xd7, 0xc5, 0x71, 0x9b, 0x12, 0xb2 },
1191 		.public = { 0xc8, 0xef, 0x79, 0xb5, 0x14, 0xd7, 0x68, 0x26,
1192 			    0x77, 0xbc, 0x79, 0x31, 0xe0, 0x6e, 0xe5, 0xc2,
1193 			    0x7c, 0x9b, 0x39, 0x2b, 0x4a, 0xe9, 0x48, 0x44,
1194 			    0x73, 0xf5, 0x54, 0xe6, 0x67, 0x8e, 0xcc, 0x2e },
1195 		.result = { 0x64, 0x7a, 0x46, 0xb6, 0xfc, 0x3f, 0x40, 0xd6,
1196 			    0x21, 0x41, 0xee, 0x3c, 0xee, 0x70, 0x6b, 0x4d,
1197 			    0x7a, 0x92, 0x71, 0x59, 0x3a, 0x7b, 0x14, 0x3e,
1198 			    0x8e, 0x2e, 0x22, 0x79, 0x88, 0x3e, 0x45, 0x50 },
1199 		.valid = true
1200 	},
1201 	/* wycheproof - checking for overflow */
1202 	{
1203 		.private = { 0xc8, 0x17, 0x24, 0x70, 0x40, 0x00, 0xb2, 0x6d,
1204 			     0x31, 0x70, 0x3c, 0xc9, 0x7e, 0x3a, 0x37, 0x8d,
1205 			     0x56, 0xfa, 0xd8, 0x21, 0x93, 0x61, 0xc8, 0x8c,
1206 			     0xca, 0x8b, 0xd7, 0xc5, 0x71, 0x9b, 0x12, 0xb2 },
1207 		.public = { 0x64, 0xae, 0xac, 0x25, 0x04, 0x14, 0x48, 0x61,
1208 			    0x53, 0x2b, 0x7b, 0xbc, 0xb6, 0xc8, 0x7d, 0x67,
1209 			    0xdd, 0x4c, 0x1f, 0x07, 0xeb, 0xc2, 0xe0, 0x6e,
1210 			    0xff, 0xb9, 0x5a, 0xec, 0xc6, 0x17, 0x0b, 0x2c },
1211 		.result = { 0x4f, 0xf0, 0x3d, 0x5f, 0xb4, 0x3c, 0xd8, 0x65,
1212 			    0x7a, 0x3c, 0xf3, 0x7c, 0x13, 0x8c, 0xad, 0xce,
1213 			    0xcc, 0xe5, 0x09, 0xe4, 0xeb, 0xa0, 0x89, 0xd0,
1214 			    0xef, 0x40, 0xb4, 0xe4, 0xfb, 0x94, 0x61, 0x55 },
1215 		.valid = true
1216 	},
1217 	/* wycheproof - checking for overflow */
1218 	{
1219 		.private = { 0xc8, 0x17, 0x24, 0x70, 0x40, 0x00, 0xb2, 0x6d,
1220 			     0x31, 0x70, 0x3c, 0xc9, 0x7e, 0x3a, 0x37, 0x8d,
1221 			     0x56, 0xfa, 0xd8, 0x21, 0x93, 0x61, 0xc8, 0x8c,
1222 			     0xca, 0x8b, 0xd7, 0xc5, 0x71, 0x9b, 0x12, 0xb2 },
1223 		.public = { 0xbf, 0x68, 0xe3, 0x5e, 0x9b, 0xdb, 0x7e, 0xee,
1224 			    0x1b, 0x50, 0x57, 0x02, 0x21, 0x86, 0x0f, 0x5d,
1225 			    0xcd, 0xad, 0x8a, 0xcb, 0xab, 0x03, 0x1b, 0x14,
1226 			    0x97, 0x4c, 0xc4, 0x90, 0x13, 0xc4, 0x98, 0x31 },
1227 		.result = { 0x21, 0xce, 0xe5, 0x2e, 0xfd, 0xbc, 0x81, 0x2e,
1228 			    0x1d, 0x02, 0x1a, 0x4a, 0xf1, 0xe1, 0xd8, 0xbc,
1229 			    0x4d, 0xb3, 0xc4, 0x00, 0xe4, 0xd2, 0xa2, 0xc5,
1230 			    0x6a, 0x39, 0x26, 0xdb, 0x4d, 0x99, 0xc6, 0x5b },
1231 		.valid = true
1232 	},
1233 	/* wycheproof - checking for overflow */
1234 	{
1235 		.private = { 0xc8, 0x17, 0x24, 0x70, 0x40, 0x00, 0xb2, 0x6d,
1236 			     0x31, 0x70, 0x3c, 0xc9, 0x7e, 0x3a, 0x37, 0x8d,
1237 			     0x56, 0xfa, 0xd8, 0x21, 0x93, 0x61, 0xc8, 0x8c,
1238 			     0xca, 0x8b, 0xd7, 0xc5, 0x71, 0x9b, 0x12, 0xb2 },
1239 		.public = { 0x53, 0x47, 0xc4, 0x91, 0x33, 0x1a, 0x64, 0xb4,
1240 			    0x3d, 0xdc, 0x68, 0x30, 0x34, 0xe6, 0x77, 0xf5,
1241 			    0x3d, 0xc3, 0x2b, 0x52, 0xa5, 0x2a, 0x57, 0x7c,
1242 			    0x15, 0xa8, 0x3b, 0xf2, 0x98, 0xe9, 0x9f, 0x19 },
1243 		.result = { 0x18, 0xcb, 0x89, 0xe4, 0xe2, 0x0c, 0x0c, 0x2b,
1244 			    0xd3, 0x24, 0x30, 0x52, 0x45, 0x26, 0x6c, 0x93,
1245 			    0x27, 0x69, 0x0b, 0xbe, 0x79, 0xac, 0xb8, 0x8f,
1246 			    0x5b, 0x8f, 0xb3, 0xf7, 0x4e, 0xca, 0x3e, 0x52 },
1247 		.valid = true
1248 	},
1249 	/* wycheproof - private key == -1 (mod order) */
1250 	{
1251 		.private = { 0xa0, 0x23, 0xcd, 0xd0, 0x83, 0xef, 0x5b, 0xb8,
1252 			     0x2f, 0x10, 0xd6, 0x2e, 0x59, 0xe1, 0x5a, 0x68,
1253 			     0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
1254 			     0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x50 },
1255 		.public = { 0x25, 0x8e, 0x04, 0x52, 0x3b, 0x8d, 0x25, 0x3e,
1256 			    0xe6, 0x57, 0x19, 0xfc, 0x69, 0x06, 0xc6, 0x57,
1257 			    0x19, 0x2d, 0x80, 0x71, 0x7e, 0xdc, 0x82, 0x8f,
1258 			    0xa0, 0xaf, 0x21, 0x68, 0x6e, 0x2f, 0xaa, 0x75 },
1259 		.result = { 0x25, 0x8e, 0x04, 0x52, 0x3b, 0x8d, 0x25, 0x3e,
1260 			    0xe6, 0x57, 0x19, 0xfc, 0x69, 0x06, 0xc6, 0x57,
1261 			    0x19, 0x2d, 0x80, 0x71, 0x7e, 0xdc, 0x82, 0x8f,
1262 			    0xa0, 0xaf, 0x21, 0x68, 0x6e, 0x2f, 0xaa, 0x75 },
1263 		.valid = true
1264 	},
1265 	/* wycheproof - private key == 1 (mod order) on twist */
1266 	{
1267 		.private = { 0x58, 0x08, 0x3d, 0xd2, 0x61, 0xad, 0x91, 0xef,
1268 			     0xf9, 0x52, 0x32, 0x2e, 0xc8, 0x24, 0xc6, 0x82,
1269 			     0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
1270 			     0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x5f },
1271 		.public = { 0x2e, 0xae, 0x5e, 0xc3, 0xdd, 0x49, 0x4e, 0x9f,
1272 			    0x2d, 0x37, 0xd2, 0x58, 0xf8, 0x73, 0xa8, 0xe6,
1273 			    0xe9, 0xd0, 0xdb, 0xd1, 0xe3, 0x83, 0xef, 0x64,
1274 			    0xd9, 0x8b, 0xb9, 0x1b, 0x3e, 0x0b, 0xe0, 0x35 },
1275 		.result = { 0x2e, 0xae, 0x5e, 0xc3, 0xdd, 0x49, 0x4e, 0x9f,
1276 			    0x2d, 0x37, 0xd2, 0x58, 0xf8, 0x73, 0xa8, 0xe6,
1277 			    0xe9, 0xd0, 0xdb, 0xd1, 0xe3, 0x83, 0xef, 0x64,
1278 			    0xd9, 0x8b, 0xb9, 0x1b, 0x3e, 0x0b, 0xe0, 0x35 },
1279 		.valid = true
1280 	}
1281 };
1282 
1283 bool __init curve25519_selftest(void)
1284 {
1285 	bool success = true, ret, ret2;
1286 	size_t i = 0, j;
1287 	u8 in[CURVE25519_KEY_SIZE];
1288 	u8 out[CURVE25519_KEY_SIZE], out2[CURVE25519_KEY_SIZE],
1289 	   out3[CURVE25519_KEY_SIZE];
1290 
1291 	for (i = 0; i < ARRAY_SIZE(curve25519_test_vectors); ++i) {
1292 		memset(out, 0, CURVE25519_KEY_SIZE);
1293 		ret = curve25519(out, curve25519_test_vectors[i].private,
1294 				 curve25519_test_vectors[i].public);
1295 		if (ret != curve25519_test_vectors[i].valid ||
1296 		    memcmp(out, curve25519_test_vectors[i].result,
1297 			   CURVE25519_KEY_SIZE)) {
1298 			pr_err("curve25519 self-test %zu: FAIL\n", i + 1);
1299 			success = false;
1300 		}
1301 	}
1302 
1303 	for (i = 0; i < 5; ++i) {
1304 		get_random_bytes(in, sizeof(in));
1305 		ret = curve25519_generate_public(out, in);
1306 		ret2 = curve25519(out2, in, (u8[CURVE25519_KEY_SIZE]){ 9 });
1307 		curve25519_generic(out3, in, (u8[CURVE25519_KEY_SIZE]){ 9 });
1308 		if (ret != ret2 ||
1309 		    memcmp(out, out2, CURVE25519_KEY_SIZE) ||
1310 		    memcmp(out, out3, CURVE25519_KEY_SIZE)) {
1311 			pr_err("curve25519 basepoint self-test %zu: FAIL: input - 0x",
1312 			       i + 1);
1313 			for (j = CURVE25519_KEY_SIZE; j-- > 0;)
1314 				printk(KERN_CONT "%02x", in[j]);
1315 			printk(KERN_CONT "\n");
1316 			success = false;
1317 		}
1318 	}
1319 
1320 	return success;
1321 }
1322