Skip to content

test(ed25519-verify): add mixed-order strict-parity regression vectors #9

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
zz-sol merged 2 commits into from
Aug 26, 2026
Merged

test(ed25519-verify): add mixed-order strict-parity regression vectors #9

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
06928b6
test(ed25519-verify): add mixed-order strict-parity regression vectors
latent-9 Aug 22, 2026
10c23fc
Merge main (post-#11 refactor) into strict-parity vectors
latent-9 Aug 26, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
39 changes: 39 additions & 0 deletions ed25519-verify/tests/verify_instruction.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,6 +22,35 @@ const NON_CANONICAL_SMALL_ORDER_COMPRESSED: [u8; PUBKEY_SERIALIZED_SIZE] = [
0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x7f,
];

/// Mixed-order verification vectors: an honest prime-order key with a low-order
/// torsion point folded in, so the encoding is neither prime-order nor
/// small-order and slips past the small-order gate into the cofactorless
/// equation. The `A` key carries an order-2 component and the `A4` key an
/// order-4 component. Both signatures are valid ZIP-215 signatures over
/// `MIXED_ORDER_MESSAGE`, so `dalek_verify_strict` and this preset must return
/// the same verdict on them.
const MIXED_ORDER_MESSAGE: &[u8] = b"mixed order strict parity";
const MIXED_ORDER_A_PUBLIC_KEY: [u8; PUBKEY_SERIALIZED_SIZE] = [
0x25, 0x0b, 0x30, 0x28, 0x13, 0x63, 0x7e, 0x1e, 0x93, 0x88, 0xeb, 0xb5, 0xb2, 0xe3, 0x1f, 0x23,
0x5f, 0xcc, 0x69, 0x9e, 0x20, 0xce, 0xc3, 0x31, 0x46, 0xdf, 0xce, 0xec, 0xb9, 0x70, 0x49, 0xf7,
];
const MIXED_ORDER_A_SIGNATURE: [u8; SIGNATURE_SERIALIZED_SIZE] = [
0x4f, 0xaa, 0x93, 0x76, 0x3d, 0x07, 0x02, 0x31, 0x6d, 0xde, 0xf0, 0x5a, 0x79, 0x21, 0xb3, 0x0b,
0x30, 0xe8, 0x15, 0x30, 0xb4, 0x4c, 0xf9, 0xf3, 0x57, 0x73, 0xff, 0xee, 0x16, 0xf6, 0x86, 0x38,
0x84, 0x46, 0xf8, 0x41, 0x77, 0xd7, 0xd8, 0x4e, 0x9d, 0x68, 0xf3, 0xc8, 0xdc, 0x2d, 0x57, 0xe6,
0x75, 0x5e, 0xe3, 0xa1, 0xa3, 0x6a, 0x07, 0x49, 0x0b, 0xb0, 0xf0, 0x16, 0x76, 0xa7, 0x4e, 0x0e,
];
const MIXED_ORDER_A4_PUBLIC_KEY: [u8; PUBKEY_SERIALIZED_SIZE] = [
0x8c, 0x7e, 0xe4, 0xbc, 0x55, 0x23, 0x75, 0xef, 0xb8, 0xd8, 0x78, 0x97, 0x68, 0xe4, 0x23, 0xeb,
0xde, 0xfd, 0x6c, 0x40, 0xdd, 0xe6, 0x34, 0x49, 0x78, 0xc2, 0x87, 0x10, 0x54, 0xaa, 0xf0, 0x35,
];
const MIXED_ORDER_A4_SIGNATURE: [u8; SIGNATURE_SERIALIZED_SIZE] = [
0x4f, 0xaa, 0x93, 0x76, 0x3d, 0x07, 0x02, 0x31, 0x6d, 0xde, 0xf0, 0x5a, 0x79, 0x21, 0xb3, 0x0b,
0x30, 0xe8, 0x15, 0x30, 0xb4, 0x4c, 0xf9, 0xf3, 0x57, 0x73, 0xff, 0xee, 0x16, 0xf6, 0x86, 0x38,
0xe4, 0xe0, 0xd9, 0xdf, 0x0e, 0x38, 0x15, 0xec, 0x36, 0x74, 0xe3, 0x4a, 0x33, 0x1b, 0x54, 0x99,
0x22, 0x89, 0x02, 0x7c, 0x81, 0xe8, 0x6d, 0x7f, 0x11, 0xbf, 0x33, 0xb1, 0xba, 0x5b, 0x07, 0x0f,
];

fn signed_payload(
message: &[u8],
) -> (
Expand Down Expand Up @@ -435,6 +464,16 @@ fn dalek_verify_strict_preset_matches_dalek() {
&SMALL_ORDER_PUBLIC_KEY_COMPRESSED,
good_message,
),
(
&MIXED_ORDER_A_SIGNATURE,
&MIXED_ORDER_A_PUBLIC_KEY,
MIXED_ORDER_MESSAGE,
),
(
&MIXED_ORDER_A4_SIGNATURE,
&MIXED_ORDER_A4_PUBLIC_KEY,
MIXED_ORDER_MESSAGE,
),
];

for (index, (signature, public_key, message)) in cases.iter().enumerate() {
Expand Down
Loading