boringssl / boringssl / 15cd8bf433750187d6c8babc83abec83f6215eb3 / . / third_party / wycheproof_testvectors / x25519_test.txt

# Imported from Wycheproof's x25519_test.json. | |

# This file is generated by convert_wycheproof.go. Do not edit by hand. | |

# | |

# Algorithm: XDH | |

# Generator version: 0.8r12 | |

[curve = curve25519] | |

# tcId = 1 | |

# normal case | |

private = c8a9d5a91091ad851c668b0736c1c9a02936c0d3ad62670858088047ba057475 | |

public = 504a36999f489cd2fdbc08baff3d88fa00569ba986cba22548ffde80f9806829 | |

result = valid | |

shared = 436a2c040cf45fea9b29a0cb81b1f41458f863d0d61b453d0a982720d6d61320 | |

# tcId = 2 | |

# public key on twist | |

private = d85d8c061a50804ac488ad774ac716c3f5ba714b2712e048491379a500211958 | |

public = 63aa40c6e38346c5caf23a6df0a5e6c80889a08647e551b3563449befcfc9733 | |

result = acceptable | |

shared = 279df67a7c4611db4708a0e8282b195e5ac0ed6f4b2f292c6fbd0acac30d1332 | |

# Public keys are either points on a given curve or points on its twist. The | |

# functions X25519 and X448 are defined for points on a twist with the goal that | |

# the output of computations do not leak private keys. Implementations may | |

# accept or reject points on a twist. If a point multiplication is performed | |

# then it is important that the result is correct, since otherwise attacks with | |

# invalid keys are possible. | |

# tcId = 3 | |

# public key on twist | |

private = c8b45bfd32e55325d9fd648cb302848039000b390e44d521e58aab3b29a6964b | |

public = 0f83c36fded9d32fadf4efa3ae93a90bb5cfa66893bc412c43fa7287dbb99779 | |

result = acceptable | |

shared = 4bc7e01e7d83d6cf67632bf90033487a5fc29eba5328890ea7b1026d23b9a45f | |

# Public keys are either points on a given curve or points on its twist. The | |

# functions X25519 and X448 are defined for points on a twist with the goal that | |

# the output of computations do not leak private keys. Implementations may | |

# accept or reject points on a twist. If a point multiplication is performed | |

# then it is important that the result is correct, since otherwise attacks with | |

# invalid keys are possible. | |

# tcId = 4 | |

# public key on twist | |

private = f876e34bcbe1f47fbc0fddfd7c1e1aa53d57bfe0f66d243067b424bb6210be51 | |

public = 0b8211a2b6049097f6871c6c052d3c5fc1ba17da9e32ae458403b05bb283092a | |

result = acceptable | |

shared = 119d37ed4b109cbd6418b1f28dea83c836c844715cdf98a3a8c362191debd514 | |

# Public keys are either points on a given curve or points on its twist. The | |

# functions X25519 and X448 are defined for points on a twist with the goal that | |

# the output of computations do not leak private keys. Implementations may | |

# accept or reject points on a twist. If a point multiplication is performed | |

# then it is important that the result is correct, since otherwise attacks with | |

# invalid keys are possible. | |

# tcId = 5 | |

# public key on twist | |

private = 006ac1f3a653a4cdb1d37bba94738f8b957a57beb24d646e994dc29a276aad45 | |

public = 343ac20a3b9c6a27b1008176509ad30735856ec1c8d8fcae13912d08d152f46c | |

result = acceptable | |

shared = cc4873aed3fcee4b3aaea7f0d20716b4276359081f634b7bea4b705bfc8a4d3e | |

# Public keys are either points on a given curve or points on its twist. The | |

# functions X25519 and X448 are defined for points on a twist with the goal that | |

# the output of computations do not leak private keys. Implementations may | |

# accept or reject points on a twist. If a point multiplication is performed | |

# then it is important that the result is correct, since otherwise attacks with | |

# invalid keys are possible. | |

# tcId = 6 | |

# public key on twist | |

private = 08da77b26d06dff9d9f7fd4c5b3769f8cdd5b30516a5ab806be324ff3eb69e60 | |

public = fa695fc7be8d1be5bf704898f388c452bafdd3b8eae805f8681a8d15c2d4e142 | |

result = acceptable | |

shared = b6f8e2fcb1affc79e2ff798319b2701139b95ad6dd07f05cbac78bd83edfd92e | |

# Public keys are either points on a given curve or points on its twist. The | |

# functions X25519 and X448 are defined for points on a twist with the goal that | |

# the output of computations do not leak private keys. Implementations may | |

# accept or reject points on a twist. If a point multiplication is performed | |

# then it is important that the result is correct, since otherwise attacks with | |

# invalid keys are possible. | |

# tcId = 7 | |

# public key on twist | |

private = d03edde9f3e7b799045f9ac3793d4a9277dadeadc41bec0290f81f744f73775f | |

public = 0200000000000000000000000000000000000000000000000000000000000000 | |

result = acceptable | |

shared = b87a1722cc6c1e2feecb54e97abd5a22acc27616f78f6e315fd2b73d9f221e57 | |

# Public keys are either points on a given curve or points on its twist. The | |

# functions X25519 and X448 are defined for points on a twist with the goal that | |

# the output of computations do not leak private keys. Implementations may | |

# accept or reject points on a twist. If a point multiplication is performed | |

# then it is important that the result is correct, since otherwise attacks with | |

# invalid keys are possible. | |

# tcId = 8 | |

# public key on twist | |

private = e09d57a914e3c29036fd9a442ba526b5cdcdf28216153e636c10677acab6bd6a | |

public = 0300000000000000000000000000000000000000000000000000000000000000 | |

result = acceptable | |

shared = a29d8dad28d590cd3017aa97a4761f851bf1d3672b042a4256a45881e2ad9035 | |

# Public keys are either points on a given curve or points on its twist. The | |

# functions X25519 and X448 are defined for points on a twist with the goal that | |

# the output of computations do not leak private keys. Implementations may | |

# accept or reject points on a twist. If a point multiplication is performed | |

# then it is important that the result is correct, since otherwise attacks with | |

# invalid keys are possible. | |

# tcId = 9 | |

# public key on twist | |

private = e0ed78e6ee02f08bec1c15d66fbbe5b83ffc37ea14e1512cc1bd4b2ea6d8066f | |

public = ff00000000000000000000000000000000000000000000000000000000000000 | |

result = acceptable | |

shared = e703bc8aa94b7d87ba34e2678353d12cdaaa1a97b5ca3e1b8c060c4636087f07 | |

# Public keys are either points on a given curve or points on its twist. The | |

# functions X25519 and X448 are defined for points on a twist with the goal that | |

# the output of computations do not leak private keys. Implementations may | |

# accept or reject points on a twist. If a point multiplication is performed | |

# then it is important that the result is correct, since otherwise attacks with | |

# invalid keys are possible. | |

# tcId = 10 | |

# public key on twist | |

private = a8a1a2ec9fa9915ae7aace6a37c68591d39e15995c4ef5ebd3561c02f72dda41 | |

public = ffff000000000000000000000000000000000000000000000000000000000000 | |

result = acceptable | |

shared = ff5cf041e924dbe1a64ac9bdba96bdcdfaf7d59d91c7e33e76ed0e4c8c836446 | |

# Public keys are either points on a given curve or points on its twist. The | |

# functions X25519 and X448 are defined for points on a twist with the goal that | |

# the output of computations do not leak private keys. Implementations may | |

# accept or reject points on a twist. If a point multiplication is performed | |

# then it is important that the result is correct, since otherwise attacks with | |

# invalid keys are possible. | |

# tcId = 11 | |

# public key on twist | |

private = a8c9df5820eb399d471dfa3215d96055b3c7d0f4ea49f8ab028d6a6e3194517b | |

public = 0000010000000000000000000000000000000000000000000000000000000000 | |

result = acceptable | |

shared = a92a96fa029960f9530e6fe37e2429cd113be4d8f3f4431f8546e6c76351475d | |

# Public keys are either points on a given curve or points on its twist. The | |

# functions X25519 and X448 are defined for points on a twist with the goal that | |

# the output of computations do not leak private keys. Implementations may | |

# accept or reject points on a twist. If a point multiplication is performed | |

# then it is important that the result is correct, since otherwise attacks with | |

# invalid keys are possible. | |

# tcId = 12 | |

# public key on twist | |

private = d0d31c491cbd39271859b4a63a316826507b1db8c701709fd0ffe3eb21c4467c | |

public = ffffff0f00000000000000000000000000000000000000000000000000000000 | |

result = acceptable | |

shared = 9f8954868158ec62b6b586b8cae1d67d1b9f4c03d5b3ca0393cee71accc9ab65 | |

# Public keys are either points on a given curve or points on its twist. The | |

# functions X25519 and X448 are defined for points on a twist with the goal that | |

# the output of computations do not leak private keys. Implementations may | |

# accept or reject points on a twist. If a point multiplication is performed | |

# then it is important that the result is correct, since otherwise attacks with | |

# invalid keys are possible. | |

# tcId = 13 | |

# public key on twist | |

private = d053e7bf1902619cd61c9c739e09d54c4147f46d190720966f7de1d9cffbbd4e | |

public = ffffffff00000000000000000000000000000000000000000000000000000000 | |

result = acceptable | |

shared = 6cbf1dc9af97bc148513a18be4a257de1a3b065584df94e8b43c1ab89720b110 | |

# Public keys are either points on a given curve or points on its twist. The | |

# functions X25519 and X448 are defined for points on a twist with the goal that | |

# the output of computations do not leak private keys. Implementations may | |

# accept or reject points on a twist. If a point multiplication is performed | |

# then it is important that the result is correct, since otherwise attacks with | |

# invalid keys are possible. | |

# tcId = 14 | |

# public key on twist | |

private = a021d75009a4596e5a33f12921c10f3670933bc80dde3bba22881b6120582144 | |

public = 0000000000001000000000000000000000000000000000000000000000000000 | |

result = acceptable | |

shared = 38284b7086095a9406028c1f800c071ea106039ad7a1d7f82fe00906fd90594b | |

# Public keys are either points on a given curve or points on its twist. The | |

# functions X25519 and X448 are defined for points on a twist with the goal that | |

# the output of computations do not leak private keys. Implementations may | |

# accept or reject points on a twist. If a point multiplication is performed | |

# then it is important that the result is correct, since otherwise attacks with | |

# invalid keys are possible. | |

# tcId = 15 | |

# public key on twist | |

private = a89c6687f99bd569a01fd8bd438236160d15ce2c57c1d71ebaa3f2da88233863 | |

public = 0000000000000001000000000000000000000000000000000000000000000000 | |

result = acceptable | |

shared = c721041df0244071794a8db06b9f7eaeec690c257265343666f4416f4166840f | |

# Public keys are either points on a given curve or points on its twist. The | |

# functions X25519 and X448 are defined for points on a twist with the goal that | |

# the output of computations do not leak private keys. Implementations may | |

# accept or reject points on a twist. If a point multiplication is performed | |

# then it is important that the result is correct, since otherwise attacks with | |

# invalid keys are possible. | |

# tcId = 16 | |

# public key on twist | |

private = 68964bca51465bf0f5ba524b1482ceff0e960a1ed9f48dcc30f1608d0e501a50 | |

public = ffffffffffffffff000000000000000000000000000000000000000000000000 | |

result = acceptable | |

shared = 25ff9a6631b143dbdbdc207b38e38f832ae079a52a618c534322e77345fd9049 | |

# Public keys are either points on a given curve or points on its twist. The | |

# functions X25519 and X448 are defined for points on a twist with the goal that | |

# the output of computations do not leak private keys. Implementations may | |

# accept or reject points on a twist. If a point multiplication is performed | |

# then it is important that the result is correct, since otherwise attacks with | |

# invalid keys are possible. | |

# tcId = 17 | |

# public key on twist | |

private = a8e56bb13a9f2b33b8e6750b4a6e6621dc26ae8c5c624a0992c8f0d5b910f170 | |

public = 0000000000000000000000000000000000000000000000000100000000000000 | |

result = acceptable | |

shared = f294e7922c6cea587aefe72911630d50f2456a2ba7f21207d57f1ecce04f6213 | |

# Public keys are either points on a given curve or points on its twist. The | |

# functions X25519 and X448 are defined for points on a twist with the goal that | |

# the output of computations do not leak private keys. Implementations may | |

# accept or reject points on a twist. If a point multiplication is performed | |

# then it is important that the result is correct, since otherwise attacks with | |

# invalid keys are possible. | |

# tcId = 18 | |

# public key on twist | |

private = e045f55c159451e97814d747050fd7769bd478434a01876a56e553f66384a74c | |

public = ffffffffffffffffffffffffffffffffffffffffffffffffffffffff00000000 | |

result = acceptable | |

shared = ff4715bd8cf847b77c244ce2d9b008b19efaa8e845feb85ce4889b5b2c6a4b4d | |

# Public keys are either points on a given curve or points on its twist. The | |

# functions X25519 and X448 are defined for points on a twist with the goal that | |

# the output of computations do not leak private keys. Implementations may | |

# accept or reject points on a twist. If a point multiplication is performed | |

# then it is important that the result is correct, since otherwise attacks with | |

# invalid keys are possible. | |

# tcId = 19 | |

# public key on twist | |

private = 105d621e1ef339c3d99245cfb77cd3a5bd0c4427a0e4d8752c3b51f045889b4f | |

public = ffffff030000f8ffff1f0000c0ffffff000000feffff070000f0ffff3f000000 | |

result = acceptable | |

shared = 61eace52da5f5ecefafa4f199b077ff64f2e3d2a6ece6f8ec0497826b212ef5f | |

# Public keys are either points on a given curve or points on its twist. The | |

# functions X25519 and X448 are defined for points on a twist with the goal that | |

# the output of computations do not leak private keys. Implementations may | |

# accept or reject points on a twist. If a point multiplication is performed | |

# then it is important that the result is correct, since otherwise attacks with | |

# invalid keys are possible. | |

# tcId = 20 | |

# public key on twist | |

private = d88a441e706f606ae7f630f8b21f3c2554739e3e549f804118c03771f608017b | |

public = ffffffffffffffffffffffffffffffffffffffffffffffffffffffffff7f0000 | |

result = acceptable | |

shared = ff1b509a0a1a54726086f1e1c0acf040ab463a2a542e5d54e92c6df8126cf636 | |

# Public keys are either points on a given curve or points on its twist. The | |

# functions X25519 and X448 are defined for points on a twist with the goal that | |

# the output of computations do not leak private keys. Implementations may | |

# accept or reject points on a twist. If a point multiplication is performed | |

# then it is important that the result is correct, since otherwise attacks with | |

# invalid keys are possible. | |

# tcId = 21 | |

# public key on twist | |

private = 80bbad168222276200aafd36f7f25fdc025632d8bf9f6354bb762e06fb63e250 | |

public = 0000000000000000000000000000000000000000000000000000000000800000 | |

result = acceptable | |

shared = f134e6267bf93903085117b99932cc0c7ba26f25fca12102a26d7533d9c4272a | |

# Public keys are either points on a given curve or points on its twist. The | |

# functions X25519 and X448 are defined for points on a twist with the goal that | |

# the output of computations do not leak private keys. Implementations may | |

# accept or reject points on a twist. If a point multiplication is performed | |

# then it is important that the result is correct, since otherwise attacks with | |

# invalid keys are possible. | |

# tcId = 22 | |

# public key on twist | |

private = 68e134092e94e622c8a0cd18aff55be23dabd994ebdee982d90601f6f0f4b369 | |

public = ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff1f | |

result = acceptable | |

shared = 74bfc15e5597e9f5193f941e10a5c008fc89f051392723886a4a8fe5093a7354 | |

# Public keys are either points on a given curve or points on its twist. The | |

# functions X25519 and X448 are defined for points on a twist with the goal that | |

# the output of computations do not leak private keys. Implementations may | |

# accept or reject points on a twist. If a point multiplication is performed | |

# then it is important that the result is correct, since otherwise attacks with | |

# invalid keys are possible. | |

# tcId = 23 | |

# public key on twist | |

private = e8e43fc1ebac0bbc9b99c8035ee1ac59b90f19a16c42c0b90f96adfcc5fdee78 | |

public = 0000000000000000000000000000000000000000000000000000000000000020 | |

result = acceptable | |

shared = 0d41a5b3af770bf2fcd34ff7972243a0e2cf4d34f2046a144581ae1ec68df03b | |

# Public keys are either points on a given curve or points on its twist. The | |

# functions X25519 and X448 are defined for points on a twist with the goal that | |

# the output of computations do not leak private keys. Implementations may | |

# accept or reject points on a twist. If a point multiplication is performed | |

# then it is important that the result is correct, since otherwise attacks with | |

# invalid keys are possible. | |

# tcId = 24 | |

# public key on twist | |

private = 18bffb16f92680a9e267473e43c464476d5372ddd1f664f3d0678efe7c98bc79 | |

public = 000000fcffff070000e0ffff3f000000ffffff010000f8ffff0f0000c0ffff7f | |

result = acceptable | |

shared = 5894e0963583ae14a0b80420894167f4b759c8d2eb9b69cb675543f66510f646 | |

# Public keys are either points on a given curve or points on its twist. The | |

# functions X25519 and X448 are defined for points on a twist with the goal that | |

# the output of computations do not leak private keys. Implementations may | |

# accept or reject points on a twist. If a point multiplication is performed | |

# then it is important that the result is correct, since otherwise attacks with | |

# invalid keys are possible. | |

# tcId = 25 | |

# public key on twist | |

private = 300305eb002bf86c71fe9c0b311993727b9dc618d0ce7251d0dfd8552d17905d | |

public = ffffffffffffff00000000000000ffffffffffffff00000000000000ffffff7f | |

result = acceptable | |

shared = f8624d6e35e6c548ac47832f2e5d151a8e53b9290363b28d2ab8d84ab7cb6a72 | |

# Public keys are either points on a given curve or points on its twist. The | |

# functions X25519 and X448 are defined for points on a twist with the goal that | |

# the output of computations do not leak private keys. Implementations may | |

# accept or reject points on a twist. If a point multiplication is performed | |

# then it is important that the result is correct, since otherwise attacks with | |

# invalid keys are possible. | |

# tcId = 26 | |

# public key on twist | |

private = 80da9f02842247d4ade5ddbac51dbce55ea7dca2844e7f97ab8987ce7fd8bc71 | |

public = 00000000ffffffff00000000ffffffff00000000ffffffff00000000ffffff7f | |

result = acceptable | |

shared = bfe183ba3d4157a7b53ef178613db619e27800f85359c0b39a9fd6e32152c208 | |

# Public keys are either points on a given curve or points on its twist. The | |

# functions X25519 and X448 are defined for points on a twist with the goal that | |

# the output of computations do not leak private keys. Implementations may | |

# accept or reject points on a twist. If a point multiplication is performed | |

# then it is important that the result is correct, since otherwise attacks with | |

# invalid keys are possible. | |

# tcId = 27 | |

# public key on twist | |

private = 806e7f26ca3246de8182946cbed09f52b95da626c823c7b50450001a47b7b252 | |

public = edfffffffffffffffffffffffffffeffffffffffffffffffffffffffffffff7f | |

result = acceptable | |

shared = bca4a0724f5c1feb184078448c898c8620e7caf81f64cca746f557dff2498859 | |

# Public keys are either points on a given curve or points on its twist. The | |

# functions X25519 and X448 are defined for points on a twist with the goal that | |

# the output of computations do not leak private keys. Implementations may | |

# accept or reject points on a twist. If a point multiplication is performed | |

# then it is important that the result is correct, since otherwise attacks with | |

# invalid keys are possible. | |

# tcId = 28 | |

# public key on twist | |

private = 58354fd64bc022cba3a71b2ae64281e4ea7bf6d65fdbaead1440eeb18604fe62 | |

public = edfffffffffffffeffffffffffffffffffffffffffffffffffffffffffffff7f | |

result = acceptable | |

shared = b3418a52464c15ab0cacbbd43887a1199206d59229ced49202300638d7a40f04 | |

# Public keys are either points on a given curve or points on its twist. The | |

# functions X25519 and X448 are defined for points on a twist with the goal that | |

# the output of computations do not leak private keys. Implementations may | |

# accept or reject points on a twist. If a point multiplication is performed | |

# then it is important that the result is correct, since otherwise attacks with | |

# invalid keys are possible. | |

# tcId = 29 | |

# public key on twist | |

private = f0019cf05159794cc8052b00c2e75b7f46fb6693c4b38c02b12a4fe272e8556a | |

public = edffffffffffefffffffffffffffffffffffffffffffffffffffffffffffff7f | |

result = acceptable | |

shared = fcde6e0a3d5fd5b63f10c2d3aad4efa05196f26bc0cb26fd6d9d3bd015eaa74f | |

# Public keys are either points on a given curve or points on its twist. The | |

# functions X25519 and X448 are defined for points on a twist with the goal that | |

# the output of computations do not leak private keys. Implementations may | |

# accept or reject points on a twist. If a point multiplication is performed | |

# then it is important that the result is correct, since otherwise attacks with | |

# invalid keys are possible. | |

# tcId = 30 | |

# public key on twist | |

private = d0fca64cc5f3a0c8e75c824e8b09d1615aa79aeba139bb7302e2bb2fcbe54b40 | |

public = edfeffffffffffffffffffffffffffffffffffffffffffffffffffffffffff7f | |

result = acceptable | |

shared = 7d62f189444c6231a48afab10a0af2eee4a52e431ea05ff781d616af2114672f | |

# Public keys are either points on a given curve or points on its twist. The | |

# functions X25519 and X448 are defined for points on a twist with the goal that | |

# the output of computations do not leak private keys. Implementations may | |

# accept or reject points on a twist. If a point multiplication is performed | |

# then it is important that the result is correct, since otherwise attacks with | |

# invalid keys are possible. | |

# tcId = 31 | |

# public key on twist | |

private = d02456e456911d3c6cd054933199807732dfdc958642ad1aebe900c793bef24a | |

public = eaffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff7f | |

result = acceptable | |

shared = 07ba5fcbda21a9a17845c401492b10e6de0a168d5c94b606694c11bac39bea41 | |

# Public keys are either points on a given curve or points on its twist. The | |

# functions X25519 and X448 are defined for points on a twist with the goal that | |

# the output of computations do not leak private keys. Implementations may | |

# accept or reject points on a twist. If a point multiplication is performed | |

# then it is important that the result is correct, since otherwise attacks with | |

# invalid keys are possible. | |

# tcId = 32 | |

# public key = 0 | |

private = 88227494038f2bb811d47805bcdf04a2ac585ada7f2f23389bfd4658f9ddd45e | |

public = 0000000000000000000000000000000000000000000000000000000000000000 | |

result = acceptable | |

shared = 0000000000000000000000000000000000000000000000000000000000000000 | |

# The public key is insecure and does not belong to a valid private key. Some | |

# libraries reject such keys. | |

# The curves and its twists contain some points of low order. This test vector | |

# contains a public key with such a point. While many libraries reject such | |

# public keys, doing so is not a strict requirement according to RFC 7748. | |

# Some libraries include a check that the shared secret is not all-zero. This | |

# check is described in Section 6.1 of RFC 7748. | |

# tcId = 33 | |

# public key = 1 | |

private = 48232e8972b61c7e61930eb9450b5070eae1c670475685541f0476217e48184f | |

public = 0100000000000000000000000000000000000000000000000000000000000000 | |

result = acceptable | |

shared = 0000000000000000000000000000000000000000000000000000000000000000 | |

# The public key is insecure and does not belong to a valid private key. Some | |

# libraries reject such keys. | |

# The curves and its twists contain some points of low order. This test vector | |

# contains a public key with such a point. While many libraries reject such | |

# public keys, doing so is not a strict requirement according to RFC 7748. | |

# Some libraries include a check that the shared secret is not all-zero. This | |

# check is described in Section 6.1 of RFC 7748. | |

# tcId = 34 | |

# edge case public key | |

private = a8386f7f16c50731d64f82e6a170b142a4e34f31fd7768fcb8902925e7d1e25a | |

public = 0400000000000000000000000000000000000000000000000000000000000000 | |

result = valid | |

shared = 34b7e4fa53264420d9f943d15513902342b386b172a0b0b7c8b8f2dd3d669f59 | |

# tcId = 35 | |

# edge case public key | |

private = d05abd08bf5e62538cb9a5ed105dbedd6de38d07940085072b4311c2678ed77d | |

public = 0001000000000000000000000000000000000000000000000000000000000000 | |

result = valid | |

shared = 3aa227a30781ed746bd4b3365e5f61461b844d09410c70570abd0d75574dfc77 | |

# tcId = 36 | |

# edge case public key | |

private = f0b8b0998c8394364d7dcb25a3885e571374f91615275440db0645ee7c0a6f6b | |

public = 0000001000000000000000000000000000000000000000000000000000000000 | |

result = valid | |

shared = 97755e7e775789184e176847ffbc2f8ef98799d46a709c6a1c0ffd29081d7039 | |

# tcId = 37 | |

# edge case public key | |

private = d00c35dc17460f360bfae7b94647bc4e9a7ad9ce82abeadb50a2f1a0736e2175 | |

public = 0000000001000000000000000000000000000000000000000000000000000000 | |

result = valid | |

shared = c212bfceb91f8588d46cd94684c2c9ee0734087796dc0a9f3404ff534012123d | |

# tcId = 38 | |

# edge case public key | |

private = 385fc8058900a85021dd92425d2fb39a62d4e23aef1d5104c4c2d88712d39e4d | |

public = ffffffffffff0f00000000000000000000000000000000000000000000000000 | |

result = valid | |

shared = 388faffb4a85d06702ba3e479c6b216a8f33efce0542979bf129d860f93b9f02 | |

# tcId = 39 | |

# edge case public key | |

private = e0614b0c408af24d9d24c0a72f9137fbd6b16f02ccc94797ea3971ab16073a7f | |

public = ffffffffffffff00000000000000000000000000000000000000000000000000 | |

result = valid | |

shared = 877fec0669d8c1a5c866641420eea9f6bd1dfd38d36a5d55a8c0ab2bf3105c68 | |

# tcId = 40 | |

# edge case public key | |

private = f004b8fd05d9fffd853cdc6d2266389b737e8dfc296ad00b5a69b2a9dcf72956 | |

public = 0000000000000000010000000000000000000000000000000000000000000000 | |

result = valid | |

shared = 180373ea0f23ea73447e5a90398a97d490b541c69320719d7dd733fb80d5480f | |

# tcId = 41 | |

# edge case public key | |

private = e80bf0e609bf3b035b552f9db7e9ecbc44a04b7910b1493661a524f46c3c2277 | |

public = ffffffffffffffffffffffffffff000000000000000000000000000000000000 | |

result = valid | |

shared = 208142350af938aba52a156dce19d3c27ab1628729683cf4ef2667c3dc60cf38 | |

# tcId = 42 | |

# edge case public key | |

private = 48890e95d1b03e603bcb51fdf6f296f1f1d10f5df10e00b8a25c9809f9aa1a54 | |

public = 0000000000000000000000000000010000000000000000000000000000000000 | |

result = valid | |

shared = 1c3263890f7a081cefe50cb92abd496582d90dcc2b9cb858bd286854aa6b0a7e | |

# tcId = 43 | |

# edge case public key | |

private = a806f1e39b742615a7dde3b29415ed827c68f07d4a47a4d9595c40c7fccb9263 | |

public = ffffffffffffffffffffffffffffffff00000000000000000000000000000000 | |

result = valid | |

shared = 56128e78d7c66f48e863e7e6f2caa9c0988fd439deac11d4aac9664083087f7a | |

# tcId = 44 | |

# edge case public key | |

private = 9899d5e265e1fc7c32345227d6699a6d6b5517cf33b43ab156ee20df4878794e | |

public = 0000000000000000000000000000000001000000000000000000000000000000 | |

result = valid | |

shared = 30eca56f1f1c2e8ff780134e0e9382c5927d305d86b53477e9aeca79fc9ced05 | |

# tcId = 45 | |

# edge case public key | |

private = d842316e5476aeaee838204258a06f15de011ba40b9962705e7f6e889fe71f40 | |

public = ffffffffffffffffffffffffffffffffffffffffffffffff0000000000000000 | |

result = valid | |

shared = cb21b7aa3f992ecfc92954849154b3af6b96a01f17bf21c612da748db38eb364 | |

# tcId = 46 | |

# edge case public key | |

private = a0933ee30512b25ee4e900aaa07f73e507a8ec53b53a44626e0f589af4e0356c | |

public = ffffffff00000000ffffffff00000000ffffffff00000000ffffffff00000000 | |

result = valid | |

shared = c5caf8cabc36f086deaf1ab226434098c222abdf8acd3ce75c75e9debb271524 | |

# tcId = 47 | |

# edge case public key | |

private = 38d6403e1377734cdce98285e820f256ad6b769d6b5612bcf42cf2b97945c073 | |

public = 0000000000000000000000000000000000000000000000000000000001000000 | |

result = valid | |

shared = 4d46052c7eabba215df8d91327e0c4610421d2d9129b1486d914c766cf104c27 | |

# tcId = 48 | |

# edge case public key | |

private = 182191b7052e9cd630ef08007fc6b43bc7652913be6774e2fd271b71b962a641 | |

public = ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff03 | |

result = valid | |

shared = a0e0315175788362d4ebe05e6ac76d52d40187bd687492af05abc7ba7c70197d | |

# tcId = 49 | |

# edge case public key | |

private = 106221fe5694a710d6e147696c5d5b93d6887d584f24f228182ebe1b1d2db85d | |

public = ffffff0f000000ffffff0f000000ffffff0f000000ffffff0f000000ffffff0f | |

result = valid | |

shared = 5e64924b91873b499a5402fa64337c65d4b2ed54beeb3fa5d7347809e43aef1c | |

# tcId = 50 | |

# edge case public key | |

private = d035de9456080d85a912083b2e3c7ddd7971f786f25a96c5e782cf6f4376e362 | |

public = 000000fcffff030000e0ffff1f000000ffffff000000f8ffff070000c0ffff3f | |

result = valid | |

shared = c052466f9712d9ec4ef40f276bb7e6441c5434a83efd8e41d20ce83f2dbf5952 | |

# tcId = 51 | |

# edge case public key | |

private = a8f37318a4c760f3cb2d894822918735683cb1edacf3e666e15694154978fd6d | |

public = ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff3f | |

result = valid | |

shared = d151b97cba9c25d48e6d576338b97d53dd8b25e84f65f7a2091a17016317c553 | |

# tcId = 52 | |

# edge case public key | |

private = 20d4d624cf732f826f09e8088017742f13f2da98f4dcf4b40519adb790cebf64 | |

public = edffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff5f | |

result = valid | |

shared = 5716296baf2b1a6b9cd15b23ba86829743d60b0396569be1d5b40014c06b477d | |

# tcId = 53 | |

# edge case public key | |

private = d806a735d138efb3b404683c9d84485ab4af540d0af253b574323d8913003c66 | |

public = edffffffffffffffffffffffffffffffffffffffffffffffffffffffff7fff7f | |

result = valid | |

shared = ddbd56d0454b794c1d1d4923f023a51f6f34ef3f4868e3d6659307c683c74126 | |

# tcId = 54 | |

# edge case public key | |

private = 184198c6228177f3ef41dc9a341258f8181ae365fe9ec98d93639b0bbee1467d | |

public = fffffffffeffff7ffffffffffeffff7ffffffffffeffff7ffffffffffeffff7f | |

result = valid | |

shared = 8039eebed1a4f3b811ea92102a6267d4da412370f3f0d6b70f1faaa2e8d5236d | |

# tcId = 55 | |

# edge case public key | |

private = f0a46a7f4b989fe515edc441109346ba746ec1516896ec5b7e4f4d903064b463 | |

public = edfffffffffffffffffffffffffffffffffffffffffffffffffffffffeffff7f | |

result = valid | |

shared = b69524e3955da23df6ad1a7cd38540047f50860f1c8fded9b1fdfcc9e812a035 | |

# tcId = 56 | |

# edge case public key | |

private = 881874fda3a99c0f0216e1172fbd07ab1c7df78602cc6b11264e57aab5f23a49 | |

public = edfffffffffffffffffffffffffffffffffffffffffffffffeffffffffffff7f | |

result = valid | |

shared = e417bb8854f3b4f70ecea557454c5c4e5f3804ae537960a8097b9f338410d757 | |

# tcId = 57 | |

# edge case public key | |

private = b8d0f1ae05a5072831443150e202ac6db00322cdf341f467e9f296588b04db72 | |

public = edfffffffffffffffffffffffffffffffeffffffffffffffffffffffffffff7f | |

result = valid | |

shared = afca72bb8ef727b60c530c937a2f7d06bb39c39b903a7f4435b3f5d8fc1ca810 | |

# tcId = 58 | |

# edge case public key | |

private = c8619ba988859db7d6f20fbf3ffb8b113418cc278065b4e8bb6d4e5b3e7cb569 | |

public = edfffffffffffffffeffffffffffffffffffffffffffffffffffffffffffff7f | |

result = valid | |

shared = 7e41c2886fed4af04c1641a59af93802f25af0f9cba7a29ae72e2a92f35a1e5a | |

# tcId = 59 | |

# edge case public key | |

private = f8d4ca1f37a30ec9acd6dbe5a6e150e5bc447d22b355d80ba002c5b05c26935d | |

public = edfffffffeffffffffffffffffffffffffffffffffffffffffffffffffffff7f | |

result = valid | |

shared = dd3abd4746bf4f2a0d93c02a7d19f76d921c090d07e6ea5abae7f28848355947 | |

# tcId = 60 | |

# edge case public key | |

private = 88037ac8e33c72c2c51037c7c8c5288bba9265c82fd8c31796dd7ea5df9aaa4a | |

public = edffffefffffffffffffffffffffffffffffffffffffffffffffffffffffff7f | |

result = valid | |

shared = 8c27b3bff8d3c1f6daf2d3b7b3479cf9ad2056e2002be247992a3b29de13a625 | |

# tcId = 61 | |

# edge case public key | |

private = 5034ee7bf83a13d9167df86b0640294f3620f4f4d9030e5e293f9190824ae562 | |

public = edfffeffffffffffffffffffffffffffffffffffffffffffffffffffffffff7f | |

result = valid | |

shared = 8e1d2207b47432f881677448b9d426a30de1a1f3fd38cad6f4b23dbdfe8a2901 | |

# tcId = 62 | |

# edge case public key | |

private = 40bd4e1caf39d9def7663823502dad3e7d30eb6eb01e9b89516d4f2f45b7cd7f | |

public = ebffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff7f | |

result = valid | |

shared = 2cf6974b0c070e3707bf92e721d3ea9de3db6f61ed810e0a23d72d433365f631 | |

# tcId = 63 | |

# public key with low order | |

private = e0f978dfcd3a8f1a5093418de54136a584c20b7b349afdf6c0520886f95b1272 | |

public = e0eb7a7c3b41b8ae1656e3faf19fc46ada098deb9c32b1fd866205165f49b800 | |

result = acceptable | |

shared = 0000000000000000000000000000000000000000000000000000000000000000 | |

# The curves and its twists contain some points of low order. This test vector | |

# contains a public key with such a point. While many libraries reject such | |

# public keys, doing so is not a strict requirement according to RFC 7748. | |

# Some libraries include a check that the shared secret is not all-zero. This | |

# check is described in Section 6.1 of RFC 7748. | |

# tcId = 64 | |

# public key with low order | |

private = 387355d995616090503aafad49da01fb3dc3eda962704eaee6b86f9e20c92579 | |

public = 5f9c95bca3508c24b1d0b1559c83ef5b04445cc4581c8e86d8224eddd09f1157 | |

result = acceptable | |

shared = 0000000000000000000000000000000000000000000000000000000000000000 | |

# The curves and its twists contain some points of low order. This test vector | |

# contains a public key with such a point. While many libraries reject such | |

# public keys, doing so is not a strict requirement according to RFC 7748. | |

# Some libraries include a check that the shared secret is not all-zero. This | |

# check is described in Section 6.1 of RFC 7748. | |

# tcId = 65 | |

# public key with low order | |

private = c8fe0df92ae68a03023fc0c9adb9557d31be7feed0d3ab36c558143daf4dbb40 | |

public = ecffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff7f | |

result = acceptable | |

shared = 0000000000000000000000000000000000000000000000000000000000000000 | |

# The curves and its twists contain some points of low order. This test vector | |

# contains a public key with such a point. While many libraries reject such | |

# public keys, doing so is not a strict requirement according to RFC 7748. | |

# Public keys are either points on a given curve or points on its twist. The | |

# functions X25519 and X448 are defined for points on a twist with the goal that | |

# the output of computations do not leak private keys. Implementations may | |

# accept or reject points on a twist. If a point multiplication is performed | |

# then it is important that the result is correct, since otherwise attacks with | |

# invalid keys are possible. | |

# Some libraries include a check that the shared secret is not all-zero. This | |

# check is described in Section 6.1 of RFC 7748. | |

# tcId = 66 | |

# public key with low order | |

private = c8d74acde5934e64b9895d5ff7afbffd7f704f7dfccff7ac28fa62a1e6410347 | |

public = e0eb7a7c3b41b8ae1656e3faf19fc46ada098deb9c32b1fd866205165f49b880 | |

result = acceptable | |

shared = 0000000000000000000000000000000000000000000000000000000000000000 | |

# The curves and its twists contain some points of low order. This test vector | |

# contains a public key with such a point. While many libraries reject such | |

# public keys, doing so is not a strict requirement according to RFC 7748. | |

# The public key is in non-canonical form. RFC 7749, section 5 defines the value | |

# that this public key represents. Section 7 of the same RFC recommends | |

# accepting such keys. If a non-canonical key is accepted then it must follow | |

# the RFC. | |

# Public keys are either points on a given curve or points on its twist. The | |

# functions X25519 and X448 are defined for points on a twist with the goal that | |

# the output of computations do not leak private keys. Implementations may | |

# accept or reject points on a twist. If a point multiplication is performed | |

# then it is important that the result is correct, since otherwise attacks with | |

# invalid keys are possible. | |

# Some libraries include a check that the shared secret is not all-zero. This | |

# check is described in Section 6.1 of RFC 7748. | |

# tcId = 67 | |

# public key with low order | |

private = b85649d5120e01e8ccaf7b2fb8d81b62e8ad6f3d5c0553fdde1906cb9d79c050 | |

public = 5f9c95bca3508c24b1d0b1559c83ef5b04445cc4581c8e86d8224eddd09f11d7 | |

result = acceptable | |

shared = 0000000000000000000000000000000000000000000000000000000000000000 | |

# The curves and its twists contain some points of low order. This test vector | |

# contains a public key with such a point. While many libraries reject such | |

# public keys, doing so is not a strict requirement according to RFC 7748. | |

# The public key is in non-canonical form. RFC 7749, section 5 defines the value | |

# that this public key represents. Section 7 of the same RFC recommends | |

# accepting such keys. If a non-canonical key is accepted then it must follow | |

# the RFC. | |

# Public keys are either points on a given curve or points on its twist. The | |

# functions X25519 and X448 are defined for points on a twist with the goal that | |

# the output of computations do not leak private keys. Implementations may | |

# accept or reject points on a twist. If a point multiplication is performed | |

# then it is important that the result is correct, since otherwise attacks with | |

# invalid keys are possible. | |

# Some libraries include a check that the shared secret is not all-zero. This | |

# check is described in Section 6.1 of RFC 7748. | |

# tcId = 68 | |

# public key with low order | |

private = 2064b2f4c9dc97ec7cf58932fdfa3265ba6ea4d11f0259b8efc8afb35db88c48 | |

public = ecffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff | |

result = acceptable | |

shared = 0000000000000000000000000000000000000000000000000000000000000000 | |

# The curves and its twists contain some points of low order. This test vector | |

# contains a public key with such a point. While many libraries reject such | |

# public keys, doing so is not a strict requirement according to RFC 7748. | |

# The public key is in non-canonical form. RFC 7749, section 5 defines the value | |

# that this public key represents. Section 7 of the same RFC recommends | |

# accepting such keys. If a non-canonical key is accepted then it must follow | |

# the RFC. | |

# Some libraries include a check that the shared secret is not all-zero. This | |

# check is described in Section 6.1 of RFC 7748. | |

# tcId = 69 | |

# public key with low order | |

private = 786a33a4f7af297a20e7642925932bf509e7070fa1bc36986af1eb13f4f50b55 | |

public = 0000000000000000000000000000000000000000000000000000000000000000 | |

result = acceptable | |

shared = 0000000000000000000000000000000000000000000000000000000000000000 | |

# The curves and its twists contain some points of low order. This test vector | |

# contains a public key with such a point. While many libraries reject such | |

# public keys, doing so is not a strict requirement according to RFC 7748. | |

# Some libraries include a check that the shared secret is not all-zero. This | |

# check is described in Section 6.1 of RFC 7748. | |

# tcId = 70 | |

# public key with low order | |

private = 786a33a4f7af297a20e7642925932bf509e7070fa1bc36986af1eb13f4f50b55 | |

public = 0100000000000000000000000000000000000000000000000000000000000000 | |

result = acceptable | |

shared = 0000000000000000000000000000000000000000000000000000000000000000 | |

# The curves and its twists contain some points of low order. This test vector | |

# contains a public key with such a point. While many libraries reject such | |

# public keys, doing so is not a strict requirement according to RFC 7748. | |

# Some libraries include a check that the shared secret is not all-zero. This | |

# check is described in Section 6.1 of RFC 7748. | |

# tcId = 71 | |

# public key with low order | |

private = 786a33a4f7af297a20e7642925932bf509e7070fa1bc36986af1eb13f4f50b55 | |

public = ecffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff7f | |

result = acceptable | |

shared = 0000000000000000000000000000000000000000000000000000000000000000 | |

# The curves and its twists contain some points of low order. This test vector | |

# contains a public key with such a point. While many libraries reject such | |

# public keys, doing so is not a strict requirement according to RFC 7748. | |

# Some libraries include a check that the shared secret is not all-zero. This | |

# check is described in Section 6.1 of RFC 7748. | |

# tcId = 72 | |

# public key with low order | |

private = 786a33a4f7af297a20e7642925932bf509e7070fa1bc36986af1eb13f4f50b55 | |

public = 5f9c95bca3508c24b1d0b1559c83ef5b04445cc4581c8e86d8224eddd09f1157 | |

result = acceptable | |

shared = 0000000000000000000000000000000000000000000000000000000000000000 | |

# The curves and its twists contain some points of low order. This test vector | |

# contains a public key with such a point. While many libraries reject such | |

# public keys, doing so is not a strict requirement according to RFC 7748. | |

# Some libraries include a check that the shared secret is not all-zero. This | |

# check is described in Section 6.1 of RFC 7748. | |

# tcId = 73 | |

# public key with low order | |

private = 786a33a4f7af297a20e7642925932bf509e7070fa1bc36986af1eb13f4f50b55 | |

public = e0eb7a7c3b41b8ae1656e3faf19fc46ada098deb9c32b1fd866205165f49b800 | |

result = acceptable | |

shared = 0000000000000000000000000000000000000000000000000000000000000000 | |

# The curves and its twists contain some points of low order. This test vector | |

# contains a public key with such a point. While many libraries reject such | |

# public keys, doing so is not a strict requirement according to RFC 7748. | |

# Some libraries include a check that the shared secret is not all-zero. This | |

# check is described in Section 6.1 of RFC 7748. | |

# tcId = 74 | |

# public key with low order | |

private = 786a33a4f7af297a20e7642925932bf509e7070fa1bc36986af1eb13f4f50b55 | |

public = edffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff7f | |

result = acceptable | |

shared = 0000000000000000000000000000000000000000000000000000000000000000 | |

# The curves and its twists contain some points of low order. This test vector | |

# contains a public key with such a point. While many libraries reject such | |

# public keys, doing so is not a strict requirement according to RFC 7748. | |

# Some libraries include a check that the shared secret is not all-zero. This | |

# check is described in Section 6.1 of RFC 7748. | |

# tcId = 75 | |

# public key with low order | |

private = 786a33a4f7af297a20e7642925932bf509e7070fa1bc36986af1eb13f4f50b55 | |

public = eeffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff7f | |

result = acceptable | |

shared = 0000000000000000000000000000000000000000000000000000000000000000 | |

# The curves and its twists contain some points of low order. This test vector | |

# contains a public key with such a point. While many libraries reject such | |

# public keys, doing so is not a strict requirement according to RFC 7748. | |

# Some libraries include a check that the shared secret is not all-zero. This | |

# check is described in Section 6.1 of RFC 7748. | |

# tcId = 76 | |

# public key with low order | |

private = 786a33a4f7af297a20e7642925932bf509e7070fa1bc36986af1eb13f4f50b55 | |

public = 0000000000000000000000000000000000000000000000000000000000000080 | |

result = acceptable | |

shared = 0000000000000000000000000000000000000000000000000000000000000000 | |

# The curves and its twists contain some points of low order. This test vector | |

# contains a public key with such a point. While many libraries reject such | |

# public keys, doing so is not a strict requirement according to RFC 7748. | |

# Some libraries include a check that the shared secret is not all-zero. This | |

# check is described in Section 6.1 of RFC 7748. | |

# tcId = 77 | |

# public key with low order | |

private = 786a33a4f7af297a20e7642925932bf509e7070fa1bc36986af1eb13f4f50b55 | |

public = 0100000000000000000000000000000000000000000000000000000000000080 | |

result = acceptable | |

shared = 0000000000000000000000000000000000000000000000000000000000000000 | |

# The curves and its twists contain some points of low order. This test vector | |

# contains a public key with such a point. While many libraries reject such | |

# public keys, doing so is not a strict requirement according to RFC 7748. | |

# Some libraries include a check that the shared secret is not all-zero. This | |

# check is described in Section 6.1 of RFC 7748. | |

# tcId = 78 | |

# public key with low order | |

private = 786a33a4f7af297a20e7642925932bf509e7070fa1bc36986af1eb13f4f50b55 | |

public = ecffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff | |

result = acceptable | |

shared = 0000000000000000000000000000000000000000000000000000000000000000 | |

# The curves and its twists contain some points of low order. This test vector | |

# contains a public key with such a point. While many libraries reject such | |

# public keys, doing so is not a strict requirement according to RFC 7748. | |

# Some libraries include a check that the shared secret is not all-zero. This | |

# check is described in Section 6.1 of RFC 7748. | |

# tcId = 79 | |

# public key with low order | |

private = 786a33a4f7af297a20e7642925932bf509e7070fa1bc36986af1eb13f4f50b55 | |

public = 5f9c95bca3508c24b1d0b1559c83ef5b04445cc4581c8e86d8224eddd09f11d7 | |

result = acceptable | |

shared = 0000000000000000000000000000000000000000000000000000000000000000 | |

# The curves and its twists contain some points of low order. This test vector | |

# contains a public key with such a point. While many libraries reject such | |

# public keys, doing so is not a strict requirement according to RFC 7748. | |

# Some libraries include a check that the shared secret is not all-zero. This | |

# check is described in Section 6.1 of RFC 7748. | |

# tcId = 80 | |

# public key with low order | |

private = 786a33a4f7af297a20e7642925932bf509e7070fa1bc36986af1eb13f4f50b55 | |

public = e0eb7a7c3b41b8ae1656e3faf19fc46ada098deb9c32b1fd866205165f49b880 | |

result = acceptable | |

shared = 0000000000000000000000000000000000000000000000000000000000000000 | |

# The curves and its twists contain some points of low order. This test vector | |

# contains a public key with such a point. While many libraries reject such | |

# public keys, doing so is not a strict requirement according to RFC 7748. | |

# Some libraries include a check that the shared secret is not all-zero. This | |

# check is described in Section 6.1 of RFC 7748. | |

# tcId = 81 | |

# public key with low order | |

private = 786a33a4f7af297a20e7642925932bf509e7070fa1bc36986af1eb13f4f50b55 | |

public = edffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff | |

result = acceptable | |

shared = 0000000000000000000000000000000000000000000000000000000000000000 | |

# The curves and its twists contain some points of low order. This test vector | |

# contains a public key with such a point. While many libraries reject such | |

# public keys, doing so is not a strict requirement according to RFC 7748. | |

# Some libraries include a check that the shared secret is not all-zero. This | |

# check is described in Section 6.1 of RFC 7748. | |

# tcId = 82 | |

# public key with low order | |

private = 786a33a4f7af297a20e7642925932bf509e7070fa1bc36986af1eb13f4f50b55 | |

public = eeffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff | |

result = acceptable | |

shared = 0000000000000000000000000000000000000000000000000000000000000000 | |

# The curves and its twists contain some points of low order. This test vector | |

# contains a public key with such a point. While many libraries reject such | |

# public keys, doing so is not a strict requirement according to RFC 7748. | |

# Some libraries include a check that the shared secret is not all-zero. This | |

# check is described in Section 6.1 of RFC 7748. | |

# tcId = 83 | |

# public key = | |

# 57896044618658097711785492504343953926634992332820282019728792003956564819949 | |

private = 40ff586e73d61f0960dc2d763ac19e98225f1194f6fe43d5dd97ad55b3d35961 | |

public = edffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff7f | |

result = acceptable | |

shared = 0000000000000000000000000000000000000000000000000000000000000000 | |

# The public key is insecure and does not belong to a valid private key. Some | |

# libraries reject such keys. | |

# The curves and its twists contain some points of low order. This test vector | |

# contains a public key with such a point. While many libraries reject such | |

# public keys, doing so is not a strict requirement according to RFC 7748. | |

# Some libraries include a check that the shared secret is not all-zero. This | |

# check is described in Section 6.1 of RFC 7748. | |

# tcId = 84 | |

# public key = | |

# 57896044618658097711785492504343953926634992332820282019728792003956564819950 | |

private = 584fceaebae944bfe93b2e0d0a575f706ce5ada1da2b1311c3b421f9186c7a6f | |

public = eeffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff7f | |

result = acceptable | |

shared = 0000000000000000000000000000000000000000000000000000000000000000 | |

# The public key is insecure and does not belong to a valid private key. Some | |

# libraries reject such keys. | |

# The curves and its twists contain some points of low order. This test vector | |

# contains a public key with such a point. While many libraries reject such | |

# public keys, doing so is not a strict requirement according to RFC 7748. | |

# The public key is in non-canonical form. RFC 7749, section 5 defines the value | |

# that this public key represents. Section 7 of the same RFC recommends | |

# accepting such keys. If a non-canonical key is accepted then it must follow | |

# the RFC. | |

# Some libraries include a check that the shared secret is not all-zero. This | |

# check is described in Section 6.1 of RFC 7748. | |

# tcId = 85 | |

# non-canonical public key | |

private = 0016b62af5cabde8c40938ebf2108e05d27fa0533ed85d70015ad4ad39762d54 | |

public = efffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff7f | |

result = acceptable | |

shared = b4d10e832714972f96bd3382e4d082a21a8333a16315b3ffb536061d2482360d | |

# The public key is in non-canonical form. RFC 7749, section 5 defines the value | |

# that this public key represents. Section 7 of the same RFC recommends | |

# accepting such keys. If a non-canonical key is accepted then it must follow | |

# the RFC. | |

# Public keys are either points on a given curve or points on its twist. The | |

# functions X25519 and X448 are defined for points on a twist with the goal that | |

# the output of computations do not leak private keys. Implementations may | |

# accept or reject points on a twist. If a point multiplication is performed | |

# then it is important that the result is correct, since otherwise attacks with | |

# invalid keys are possible. | |

# tcId = 86 | |

# non-canonical public key | |

private = d83650ba7cec115881916255e3fa5fa0d6b8dcf968731bd2c9d2aec3f561f649 | |

public = f0ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff7f | |

result = acceptable | |

shared = 515eac8f1ed0b00c70762322c3ef86716cd2c51fe77cec3d31b6388bc6eea336 | |

# The public key is in non-canonical form. RFC 7749, section 5 defines the value | |

# that this public key represents. Section 7 of the same RFC recommends | |

# accepting such keys. If a non-canonical key is accepted then it must follow | |

# the RFC. | |

# Public keys are either points on a given curve or points on its twist. The | |

# functions X25519 and X448 are defined for points on a twist with the goal that | |

# the output of computations do not leak private keys. Implementations may | |

# accept or reject points on a twist. If a point multiplication is performed | |

# then it is important that the result is correct, since otherwise attacks with | |

# invalid keys are possible. | |

# tcId = 87 | |

# non-canonical public key | |

private = 88dd14e2711ebd0b0026c651264ca965e7e3da5082789fbab7e24425e7b4377e | |

public = f1ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff7f | |

result = acceptable | |

shared = 6919992d6a591e77b3f2bacbd74caf3aea4be4802b18b2bc07eb09ade3ad6662 | |

# The public key is in non-canonical form. RFC 7749, section 5 defines the value | |

# that this public key represents. Section 7 of the same RFC recommends | |

# accepting such keys. If a non-canonical key is accepted then it must follow | |

# the RFC. | |

# tcId = 88 | |

# non-canonical public key | |

private = 98c2b08cbac14e15953154e3b558d42bb1268a365b0ef2f22725129d8ac5cb7f | |

public = ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff7f | |

result = acceptable | |

shared = 9c034fcd8d3bf69964958c0105161fcb5d1ea5b8f8abb371491e42a7684c2322 | |

# The public key is in non-canonical form. RFC 7749, section 5 defines the value | |

# that this public key represents. Section 7 of the same RFC recommends | |

# accepting such keys. If a non-canonical key is accepted then it must follow | |

# the RFC. | |

# tcId = 89 | |

# non-canonical public key | |

private = c0697b6f05e0f3433b44ea352f20508eb0623098a7770853af5ca09727340c4e | |

public = 0200000000000000000000000000000000000000000000000000000000000080 | |

result = acceptable | |

shared = ed18b06da512cab63f22d2d51d77d99facd3c4502e4abf4e97b094c20a9ddf10 | |

# The public key is in non-canonical form. RFC 7749, section 5 defines the value | |

# that this public key represents. Section 7 of the same RFC recommends | |

# accepting such keys. If a non-canonical key is accepted then it must follow | |

# the RFC. | |

# Public keys are either points on a given curve or points on its twist. The | |

# functions X25519 and X448 are defined for points on a twist with the goal that | |

# the output of computations do not leak private keys. Implementations may | |

# accept or reject points on a twist. If a point multiplication is performed | |

# then it is important that the result is correct, since otherwise attacks with | |

# invalid keys are possible. | |

# tcId = 90 | |

# non-canonical public key | |

private = 18422b58a18e0f4519b7a887b8cfb649e0bfe4b34d75963350a9944e5b7f5b7e | |

public = 0300000000000000000000000000000000000000000000000000000000000080 | |

result = acceptable | |

shared = 448ce410fffc7e6149c5abec0ad5f3607dfde8a34e2ac3243c3009176168b432 | |

# The public key is in non-canonical form. RFC 7749, section 5 defines the value | |

# that this public key represents. Section 7 of the same RFC recommends | |

# accepting such keys. If a non-canonical key is accepted then it must follow | |

# the RFC. | |

# Public keys are either points on a given curve or points on its twist. The | |

# functions X25519 and X448 are defined for points on a twist with the goal that | |

# the output of computations do not leak private keys. Implementations may | |

# accept or reject points on a twist. If a point multiplication is performed | |

# then it is important that the result is correct, since otherwise attacks with | |

# invalid keys are possible. | |

# tcId = 91 | |

# non-canonical public key | |

private = 20620d82487707bedf9ee3549e95cb9390d2618f50cf6acba47ffaa103224a6f | |

public = 0400000000000000000000000000000000000000000000000000000000000080 | |

result = acceptable | |

shared = 03a633df01480d0d5048d92f51b20dc1d11f73e9515c699429b90a4f6903122a | |

# The public key is in non-canonical form. RFC 7749, section 5 defines the value | |

# that this public key represents. Section 7 of the same RFC recommends | |

# accepting such keys. If a non-canonical key is accepted then it must follow | |

# the RFC. | |

# tcId = 92 | |

# non-canonical public key | |

private = 285a6a7ceeb7122f2c78d99c53b2a902b490892f7dff326f89d12673c3101b53 | |

public = daffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff | |

result = acceptable | |

shared = 9b01287717d72f4cfb583ec85f8f936849b17d978dbae7b837db56a62f100a68 | |

# The public key is in non-canonical form. RFC 7749, section 5 defines the value | |

# that this public key represents. Section 7 of the same RFC recommends | |

# accepting such keys. If a non-canonical key is accepted then it must follow | |

# the RFC. | |

# tcId = 93 | |

# non-canonical public key | |

private = c8e0330ae9dceeff887fba761225879a4bd2e0db08799244136e4721b2c88970 | |

public = dbffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff | |

result = acceptable | |

shared = dfe60831c9f4f96c816e51048804dbdc27795d760eced75ef575cbe3b464054b | |

# The public key is in non-canonical form. RFC 7749, section 5 defines the value | |

# that this public key represents. Section 7 of the same RFC recommends | |

# accepting such keys. If a non-canonical key is accepted then it must follow | |

# the RFC. | |

# tcId = 94 | |

# non-canonical public key | |

private = 10db6210fc1fb13382472fa1787b004b5d11868ab3a79510e0cee30f4a6df26b | |

public = dcffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff | |

result = acceptable | |

shared = 50bfa826ca77036dd2bbfd092c3f78e2e4a1f980d7c8e78f2f14dca3cce5cc3c | |

# The public key is in non-canonical form. RFC 7749, section 5 defines the value | |

# that this public key represents. Section 7 of the same RFC recommends | |

# accepting such keys. If a non-canonical key is accepted then it must follow | |

# the RFC. | |

# Public keys are either points on a given curve or points on its twist. The | |

# functions X25519 and X448 are defined for points on a twist with the goal that | |

# the output of computations do not leak private keys. Implementations may | |

# accept or reject points on a twist. If a point multiplication is performed | |

# then it is important that the result is correct, since otherwise attacks with | |

# invalid keys are possible. | |

# tcId = 95 | |

# non-canonical public key | |

private = 9041c6e044a277df8466275ca8b5ee0da7bc028648054ade5c592add3057474e | |

public = eaffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff | |

result = acceptable | |

shared = 13da5695a4c206115409b5277a934782fe985fa050bc902cba5616f9156fe277 | |

# The public key is in non-canonical form. RFC 7749, section 5 defines the value | |

# that this public key represents. Section 7 of the same RFC recommends | |

# accepting such keys. If a non-canonical key is accepted then it must follow | |

# the RFC. | |

# tcId = 96 | |

# non-canonical public key | |

private = b8d499041a6713c0f6f876db7406587fdb44582f9542356ae89cfa958a34d266 | |

public = ebffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff | |

result = acceptable | |

shared = 63483b5d69236c63cddbed33d8e22baecc2b0ccf886598e863c844d2bf256704 | |

# The public key is in non-canonical form. RFC 7749, section 5 defines the value | |

# that this public key represents. Section 7 of the same RFC recommends | |

# accepting such keys. If a non-canonical key is accepted then it must follow | |

# the RFC. | |

# tcId = 97 | |

# non-canonical public key | |

private = c85f08e60c845f82099141a66dc4583d2b1040462c544d33d0453b20b1a6377e | |

public = ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff | |

result = acceptable | |

shared = e9db74bc88d0d9bf046ddd13f943bccbe6dbb47d49323f8dfeedc4a694991a3c | |

# The public key is in non-canonical form. RFC 7749, section 5 defines the value | |

# that this public key represents. Section 7 of the same RFC recommends | |

# accepting such keys. If a non-canonical key is accepted then it must follow | |

# the RFC. | |

# tcId = 98 | |

# public key = | |

# 57896044618658097711785492504343953926634992332820282019728792003956564819968 | |

private = 7887889bac4c629a101d3724f2ed8b98d936fde79e1a1f77d86779626bf8f263 | |

public = 0000000000000000000000000000000000000000000000000000000000000080 | |

result = acceptable | |

shared = 0000000000000000000000000000000000000000000000000000000000000000 | |

# The public key is insecure and does not belong to a valid private key. Some | |

# libraries reject such keys. | |

# The curves and its twists contain some points of low order. This test vector | |

# contains a public key with such a point. While many libraries reject such | |

# public keys, doing so is not a strict requirement according to RFC 7748. | |

# The public key is in non-canonical form. RFC 7749, section 5 defines the value | |

# that this public key represents. Section 7 of the same RFC recommends | |

# accepting such keys. If a non-canonical key is accepted then it must follow | |

# the RFC. | |

# Some libraries include a check that the shared secret is not all-zero. This | |

# check is described in Section 6.1 of RFC 7748. | |

# tcId = 99 | |

# public key = | |

# 57896044618658097711785492504343953926634992332820282019728792003956564819969 | |

private = e07971ee820e48b0b266d8be3cdbbb5e900a43f59ee8535c6572418615de4962 | |

public = 0100000000000000000000000000000000000000000000000000000000000080 | |

result = acceptable | |

shared = 0000000000000000000000000000000000000000000000000000000000000000 | |

# The public key is insecure and does not belong to a valid private key. Some | |

# libraries reject such keys. | |

# The curves and its twists contain some points of low order. This test vector | |

# contains a public key with such a point. While many libraries reject such | |

# public keys, doing so is not a strict requirement according to RFC 7748. | |

# The public key is in non-canonical form. RFC 7749, section 5 defines the value | |

# that this public key represents. Section 7 of the same RFC recommends | |

# accepting such keys. If a non-canonical key is accepted then it must follow | |

# the RFC. | |

# Public keys are either points on a given curve or points on its twist. The | |

# functions X25519 and X448 are defined for points on a twist with the goal that | |

# the output of computations do not leak private keys. Implementations may | |

# accept or reject points on a twist. If a point multiplication is performed | |

# then it is important that the result is correct, since otherwise attacks with | |

# invalid keys are possible. | |

# Some libraries include a check that the shared secret is not all-zero. This | |

# check is described in Section 6.1 of RFC 7748. | |

# tcId = 100 | |

# RFC 7748 | |

private = a046e36bf0527c9d3b16154b82465edd62144c0ac1fc5a18506a2244ba449a44 | |

public = e6db6867583030db3594c1a424b15f7c726624ec26b3353b10a903a6d0ab1c4c | |

result = valid | |

shared = c3da55379de9c6908e94ea4df28d084f32eccf03491c71f754b4075577a28552 | |

# tcId = 101 | |

# RFC 7748 | |

private = 4866e9d4d1b4673c5ad22691957d6af5c11b6421e0ea01d42ca4169e7918ba4d | |

public = e5210f12786811d3f4b7959d0538ae2c31dbe7106fc03c3efc4cd549c715a413 | |

result = valid | |

shared = 95cbde9476e8907d7aade45cb4b873f88b595a68799fa152e6f8f7647aac7957 | |

# tcId = 102 | |

# RFC 8037, Section A.6 | |

private = 77076d0a7318a57d3c16c17251b26645df4c2f87ebc0992ab177fba51db92c2a | |

public = de9edb7d7b7dc1b4d35b61c2ece435373f8343c85b78674dadfc7e146f882b4f | |

result = valid | |

shared = 4a5d9d5ba4ce2de1728e3bf480350f25e07e21c947d19e3376f09b3c1e161742 | |

# tcId = 103 | |

# edge case for shared secret | |

private = 60a3a4f130b98a5be4b1cedb7cb85584a3520e142d474dc9ccb909a073a9767f | |

public = b7b6d39c765cb60c0c8542f4f3952ffb51d3002d4aeb9f8ff988b192043e6d0a | |

result = acceptable | |

shared = 0200000000000000000000000000000000000000000000000000000000000000 | |

# Public keys are either points on a given curve or points on its twist. The | |

# functions X25519 and X448 are defined for points on a twist with the goal that | |

# the output of computations do not leak private keys. Implementations may | |

# accept or reject points on a twist. If a point multiplication is performed | |

# then it is important that the result is correct, since otherwise attacks with | |

# invalid keys are possible. | |

# tcId = 104 | |

# edge case for shared secret | |

private = 60a3a4f130b98a5be4b1cedb7cb85584a3520e142d474dc9ccb909a073a9767f | |

public = 3b18df1e50b899ebd588c3161cbd3bf98ebcc2c1f7df53b811bd0e91b4d5153d | |

result = valid | |

shared = 0900000000000000000000000000000000000000000000000000000000000000 | |

# tcId = 105 | |

# edge case for shared secret | |

private = 60a3a4f130b98a5be4b1cedb7cb85584a3520e142d474dc9ccb909a073a9767f | |

public = cab6f9e7d8ce00dfcea9bbd8f069ef7fb2ac504abf83b87db601b5ae0a7f7615 | |

result = valid | |

shared = 1000000000000000000000000000000000000000000000000000000000000000 | |

# tcId = 106 | |

# edge case for shared secret | |

private = 60a3a4f130b98a5be4b1cedb7cb85584a3520e142d474dc9ccb909a073a9767f | |

public = 4977d0d897e1ba566590f60f2eb0db6f7b24c13d436918ccfd32708dfad7e247 | |

result = acceptable | |

shared = feffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff3f | |

# Public keys are either points on a given curve or points on its twist. The | |

# functions X25519 and X448 are defined for points on a twist with the goal that | |

# the output of computations do not leak private keys. Implementations may | |

# accept or reject points on a twist. If a point multiplication is performed | |

# then it is important that the result is correct, since otherwise attacks with | |

# invalid keys are possible. | |

# tcId = 107 | |

# edge case for shared secret | |

private = 60a3a4f130b98a5be4b1cedb7cb85584a3520e142d474dc9ccb909a073a9767f | |

public = 98730bc03e29e8b057fb1d20ef8c0bffc822485d3db7f45f4e3cc2c3c6d1d14c | |

result = valid | |

shared = fcffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff3f | |

# tcId = 108 | |

# edge case for shared secret | |

private = 60a3a4f130b98a5be4b1cedb7cb85584a3520e142d474dc9ccb909a073a9767f | |

public = 97b4fff682df7f096cd1756569e252db482d45406a3198a1aff282a5da474c49 | |

result = acceptable | |

shared = f9ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff3f | |

# Public keys are either points on a given curve or points on its twist. The | |

# functions X25519 and X448 are defined for points on a twist with the goal that | |

# the output of computations do not leak private keys. Implementations may | |

# accept or reject points on a twist. If a point multiplication is performed | |

# then it is important that the result is correct, since otherwise attacks with | |

# invalid keys are possible. | |

# tcId = 109 | |

# edge case for shared secret | |

private = 60a3a4f130b98a5be4b1cedb7cb85584a3520e142d474dc9ccb909a073a9767f | |

public = 317781b0163bae74accc06c0d44ef9a911a22b0d37faf7726621591f9343ea2f | |

result = valid | |

shared = f3ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff3f | |

# tcId = 110 | |

# edge case for shared secret | |

private = 60a3a4f130b98a5be4b1cedb7cb85584a3520e142d474dc9ccb909a073a9767f | |

public = 7e26f8f24cb590027f9d1bc49b0e1a242c7d8f43624d3e8fab28ee08e02cb45e | |

result = valid | |

shared = ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff03 | |

# tcId = 111 | |

# edge case for shared secret | |

private = 60a3a4f130b98a5be4b1cedb7cb85584a3520e142d474dc9ccb909a073a9767f | |

public = e96d2780e5469a74620ab5aa2f62151d140c473320dbe1b028f1a48f8e76f95f | |

result = acceptable | |

shared = e5ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff7f | |

# Public keys are either points on a given curve or points on its twist. The | |

# functions X25519 and X448 are defined for points on a twist with the goal that | |

# the output of computations do not leak private keys. Implementations may | |

# accept or reject points on a twist. If a point multiplication is performed | |

# then it is important that the result is correct, since otherwise attacks with | |

# invalid keys are possible. | |

# tcId = 112 | |

# edge case for shared secret | |

private = 60a3a4f130b98a5be4b1cedb7cb85584a3520e142d474dc9ccb909a073a9767f | |

public = 8d612c5831aa64b057300e7e310f3aa332af34066fefcab2b089c9592878f832 | |

result = acceptable | |

shared = e3ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff7f | |

# Public keys are either points on a given curve or points on its twist. The | |

# functions X25519 and X448 are defined for points on a twist with the goal that | |

# the output of computations do not leak private keys. Implementations may | |

# accept or reject points on a twist. If a point multiplication is performed | |

# then it is important that the result is correct, since otherwise attacks with | |

# invalid keys are possible. | |

# tcId = 113 | |

# edge case for shared secret | |

private = 60a3a4f130b98a5be4b1cedb7cb85584a3520e142d474dc9ccb909a073a9767f | |

public = 8d44108d05d940d3dfe5647ea7a87be24d0d036c9f0a95a2386b839e7b7bf145 | |

result = valid | |

shared = ddffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff7f | |

# tcId = 114 | |

# edge case for shared secret | |

private = 60a3a4f130b98a5be4b1cedb7cb85584a3520e142d474dc9ccb909a073a9767f | |

public = 21a35d5db1b6237c739b56345a930aeee373cdcfb4701266782a8ac594913b29 | |

result = acceptable | |

shared = dbffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff7f | |

# Public keys are either points on a given curve or points on its twist. The | |

# functions X25519 and X448 are defined for points on a twist with the goal that | |

# the output of computations do not leak private keys. Implementations may | |

# accept or reject points on a twist. If a point multiplication is performed | |

# then it is important that the result is correct, since otherwise attacks with | |

# invalid keys are possible. | |

# tcId = 115 | |

# edge case for shared secret | |

private = 60a3a4f130b98a5be4b1cedb7cb85584a3520e142d474dc9ccb909a073a9767f | |

public = 3e5efb63c352ce942762482bc9337a5d35ba55664743ac5e93d11f957336cb10 | |

result = acceptable | |

shared = 0000000000000000000000000000000000000000000000000000000000000002 | |

# Public keys are either points on a given curve or points on its twist. The | |

# functions X25519 and X448 are defined for points on a twist with the goal that | |

# the output of computations do not leak private keys. Implementations may | |

# accept or reject points on a twist. If a point multiplication is performed | |

# then it is important that the result is correct, since otherwise attacks with | |

# invalid keys are possible. | |

# tcId = 116 | |

# edge case for shared secret | |

private = 60a3a4f130b98a5be4b1cedb7cb85584a3520e142d474dc9ccb909a073a9767f | |

public = 8e41f05ea3c76572be104ad8788e970863c6e2ca3daae64d1c2f46decfffa571 | |

result = acceptable | |

shared = 0000000000000000000000000000000000000000000000000000000000008000 | |

# Public keys are either points on a given curve or points on its twist. The | |

# functions X25519 and X448 are defined for points on a twist with the goal that | |

# the output of computations do not leak private keys. Implementations may | |

# accept or reject points on a twist. If a point multiplication is performed | |

# then it is important that the result is correct, since otherwise attacks with | |

# invalid keys are possible. | |

# tcId = 117 | |

# special case public key | |

private = c8d07c46bbfb827753b92c70e49583ce8bfa44641a7382258ea903d6a832c96b | |

public = 0000000000000000000000000000000000000000000000000000000000000000 | |

result = acceptable | |

shared = 0000000000000000000000000000000000000000000000000000000000000000 | |

# The public key is insecure and does not belong to a valid private key. Some | |

# libraries reject such keys. | |

# The curves and its twists contain some points of low order. This test vector | |

# contains a public key with such a point. While many libraries reject such | |

# public keys, doing so is not a strict requirement according to RFC 7748. | |

# Some libraries include a check that the shared secret is not all-zero. This | |

# check is described in Section 6.1 of RFC 7748. | |

# tcId = 118 | |

# special case public key | |

private = 90b7ef237a055f348dcb4c4364a59d7d31edc7ab78f2ca254e2c810975c3f543 | |

public = 0100000000000000000000000000000000000000000000000000000000000000 | |

result = acceptable | |

shared = 0000000000000000000000000000000000000000000000000000000000000000 | |

# The public key is insecure and does not belong to a valid private key. Some | |

# libraries reject such keys. | |

# The curves and its twists contain some points of low order. This test vector | |

# contains a public key with such a point. While many libraries reject such | |

# public keys, doing so is not a strict requirement according to RFC 7748. | |

# Some libraries include a check that the shared secret is not all-zero. This | |

# check is described in Section 6.1 of RFC 7748. | |

# tcId = 119 | |

# special case public key | |

private = e0a8be63315c4f0f0a3fee607f44d30a55be63f09561d9af93e0a1c9cf0ed751 | |

public = 0200000000000000000000000000000000000000000000000000000000000000 | |

result = acceptable | |

shared = 0c50ac2bfb6815b47d0734c5981379882a24a2de6166853c735329d978baee4d | |

# Public keys are either points on a given curve or points on its twist. The | |

# functions X25519 and X448 are defined for points on a twist with the goal that | |

# the output of computations do not leak private keys. Implementations may | |

# accept or reject points on a twist. If a point multiplication is performed | |

# then it is important that the result is correct, since otherwise attacks with | |

# invalid keys are possible. | |

# tcId = 120 | |

# special case public key | |

private = 0840a8af5bc4c48da8850e973d7e14220f45c192cea4020d377eecd25c7c3643 | |

public = 1200000000000000000000000000000000000000000000000000000000000000 | |

result = valid | |

shared = 77557137a2a2a651c49627a9b239ac1f2bf78b8a3e72168ccecc10a51fc5ae66 | |

# tcId = 121 | |

# special case public key | |

private = 0092229c753a71284d0853909470ad847ab62f439ea51482fb41d30cc3b44743 | |

public = 1400000000000000000000000000000000000000000000000000000000000000 | |

result = acceptable | |

shared = c88e719ae5c2248b5f90da346a92ae214f44a5d129fd4e9c26cf6a0da1efe077 | |

# Public keys are either points on a given curve or points on its twist. The | |

# functions X25519 and X448 are defined for points on a twist with the goal that | |

# the output of computations do not leak private keys. Implementations may | |

# accept or reject points on a twist. If a point multiplication is performed | |

# then it is important that the result is correct, since otherwise attacks with | |

# invalid keys are possible. | |

# tcId = 122 | |

# special case public key | |

private = b8da2bd2d7cf25a3e54e5f87ee15911effb9ff86baec4076d56c8e953670bf5b | |

public = 0000000000000000000000000080000000000000000000000000000000000000 | |

result = valid | |

shared = 4bf6789c7ea036f973cde0af02d6fdb9b64a0b957022111439570fad7d7a453f | |

# tcId = 123 | |

# special case public key | |

private = 684cd420af41abb3d10c61e773238cf729c2155f941ac27e15f4c37f49b29576 | |

public = ffffffffffffffffffffffffffff000000000000000000000000000000000000 | |

result = valid | |

shared = bcac235ae15cc7148372e11f9315e3bc76ceb904b3d2a8246bd9d9be2082bb62 | |

# tcId = 124 | |

# special case public key | |

private = 38cfacaa4460796b4de434bdd6739f0d043671f97fa829517511e6b47aa93474 | |

public = 0100000000000000000000000000010000000000000000000000000000000000 | |

result = acceptable | |

shared = 5dd7d16fff25cc5fdf9e03c3157cb0a235cea17d618f36e6f13461567edeb943 | |

# Public keys are either points on a given curve or points on its twist. The | |

# functions X25519 and X448 are defined for points on a twist with the goal that | |

# the output of computations do not leak private keys. Implementations may | |

# accept or reject points on a twist. If a point multiplication is performed | |

# then it is important that the result is correct, since otherwise attacks with | |

# invalid keys are possible. | |

# tcId = 125 | |

# special case public key | |

private = 30832e8cb627ac195f77b1105258e4bb18b99a5ed944404bfacb3a039fbdb14b | |

public = 0000000000000000000000000000000000000000000000000000004000000000 | |

result = valid | |

shared = 2816fd031d51d6750f9225ede950625cca47441ca97e43092650396991afcb6d | |

# tcId = 126 | |

# special case public key | |

private = d818fd6971e546447f361d33d3dbb3eadcf02fb28f246f1d5107b9073a93cd4f | |

public = 0000000000000000000000000000000000000000000000000000008000000000 | |

result = acceptable | |

shared = 7ed8f2d5424e7ebb3edbdf4abe455447e5a48b658e64abd06c218f33bd151f64 | |

# Public keys are either points on a given curve or points on its twist. The | |

# functions X25519 and X448 are defined for points on a twist with the goal that | |

# the output of computations do not leak private keys. Implementations may | |

# accept or reject points on a twist. If a point multiplication is performed | |

# then it is important that the result is correct, since otherwise attacks with | |

# invalid keys are possible. | |

# tcId = 127 | |

# special case public key | |

private = 1021cd8682bdc3f5da9100adff5b2230b3acd836b3a455db8352a2c27e69d17e | |

public = ffffffffffffffffffffffffffffffffffffffffffffffffffffffff00000000 | |

result = acceptable | |

shared = e8620ed5ca89c72c5ea5503e6dcd01131cd5e875c30e13d5dc619ce28ec7d559 | |

# Public keys are either points on a given curve or points on its twist. The | |

# functions X25519 and X448 are defined for points on a twist with the goal that | |

# the output of computations do not leak private keys. Implementations may | |

# accept or reject points on a twist. If a point multiplication is performed | |

# then it is important that the result is correct, since otherwise attacks with | |

# invalid keys are possible. | |

# tcId = 128 | |

# special case public key | |

private = 20e4c9247102292655d6765d7d84c6fce5309b8004045daea6d7d7dcad462871 | |

public = 0100000000000000000000000000000000000000000000000000000001000000 | |

result = valid | |

shared = ceadb264379dcadd6e3bb8ad24dd653d2a609dd703d41da6caf3ad00f001862c | |

# tcId = 129 | |

# special case public key | |

private = 90b150d462de512056d5bd55173074969b496f262fb6916b733f6263a8078971 | |

public = a8b9c7372118a53a9de9eaf0868e3b1a3d88e81cb2e407ff7125e9f5c5088715 | |

result = acceptable | |

shared = f86cc7bf1be49574fc97a074282e9bb5cd238e002bc8e9a7b8552b2d60eccb52 | |

# Public keys are either points on a given curve or points on its twist. The | |

# functions X25519 and X448 are defined for points on a twist with the goal that | |

# the output of computations do not leak private keys. Implementations may | |

# accept or reject points on a twist. If a point multiplication is performed | |

# then it is important that the result is correct, since otherwise attacks with | |

# invalid keys are possible. | |

# tcId = 130 | |

# special case public key | |

private = 9887286b3261c8d857a16f6db21277f75d88d4e861b3ebe7596699047e816668 | |

public = aab9c7372118a53a9de9eaf0868e3b1a3d88e81cb2e407ff7125e9f5c5088715 | |

result = acceptable | |

shared = ccbb8fd9dee165a398b2dbd7c8396f81736c1b3da36b35fbec8f326f38f92767 | |

# Public keys are either points on a given curve or points on its twist. The | |

# functions X25519 and X448 are defined for points on a twist with the goal that | |

# the output of computations do not leak private keys. Implementations may | |

# accept or reject points on a twist. If a point multiplication is performed | |

# then it is important that the result is correct, since otherwise attacks with | |

# invalid keys are possible. | |

# tcId = 131 | |

# special case public key | |

private = 20ca2c85cc8762e96b7047bf15c71c050ffe0ed1616040a953ae32a1297ad871 | |

public = 585007a5930d77623cf29756038ca197d3ebfd9e4c80a69585efe0274092c115 | |

result = valid | |

shared = 46add6f48ffff461777d4f89b6fdf1155aa051a96387d45f3e5e371a236b6e52 | |

# tcId = 132 | |

# special case public key | |

private = d027656605b10bf18dea28bc52546f9f1f08cef06cafd200fc84f87dbb4ebe46 | |

public = fbffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff1f | |

result = valid | |

shared = 1adbe32207e21f71e1af53884d2a2276481e298e557f4dacb3720f2458e3082d | |

# tcId = 133 | |

# special case public key | |

private = 4867a83ee9d01b7510840867db1af6a6049bdbb056b74443f70c358e162c8867 | |

public = 0000000000000000000000000000000000000000000000000000000000000020 | |

result = acceptable | |

shared = e12cc58fbeb70a5e35c861c33710be6516a6a92e52376060211b2487db542b4f | |

# Public keys are either points on a given curve or points on its twist. The | |

# functions X25519 and X448 are defined for points on a twist with the goal that | |

# the output of computations do not leak private keys. Implementations may | |

# accept or reject points on a twist. If a point multiplication is performed | |

# then it is important that the result is correct, since otherwise attacks with | |

# invalid keys are possible. | |

# tcId = 134 | |

# special case public key | |

private = a015970a8add940fca5b1b5d23875397d547d8d494fcb314f2045a67a2d12c4b | |

public = afa00e4a271beec478e42fad0618432fa7d7fb3d99004d2b0bdfc14f8024832b | |

result = valid | |

shared = 421bed1b26da1e9adbeada1f32b91a0fb4ced0f1110e0a4a88e735a19ee4571e | |

# tcId = 135 | |

# special case public key | |

private = 4058cb6b9aaba02a338aaa392dbc10039e26e9e444117e758e24c5d8b232ea5e | |

public = b1a00e4a271beec478e42fad0618432fa7d7fb3d99004d2b0bdfc14f8024832b | |

result = valid | |

shared = d7b47463e2f4ca9a1a7deea098da8e74ac3b4a109083d997259b12992e7e7e06 | |

# tcId = 136 | |

# special case public key | |

private = b876b05daff0530b139d9e11250563418077178246c5fa7005ba00e9b6647763 | |

public = fbffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff2f | |

result = acceptable | |

shared = 686eb910a937211b9147c8a051a1197906818fdc626668eb5f5d394afd86d41b | |

# Public keys are either points on a given curve or points on its twist. The | |

# functions X25519 and X448 are defined for points on a twist with the goal that | |

# the output of computations do not leak private keys. Implementations may | |

# accept or reject points on a twist. If a point multiplication is performed | |

# then it is important that the result is correct, since otherwise attacks with | |

# invalid keys are possible. | |

# tcId = 137 | |

# special case public key | |

private = d87fd6aa5d8deef6dee9619a56846a0829620590f2da40835d8e251597e39078 | |

public = 22231c64ef73ad62318b8a87bc38e272e1bb8bf1a60d7c00476d0b059d7b3c35 | |

result = valid | |

shared = 09559733b35bcc6bb8ac574b5abe3a4d8841deff051c294a07487e3eec3c5558 | |

# tcId = 138 | |

# special case public key | |

private = 90036321b63751f7622aa93da34d85e59ce81009ac5b9a068921d83bc4715b57 | |

public = f6ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff3f | |

result = valid | |

shared = f7d5cbcf39eb722b01ed20c85563ebb81d076511aead4ccc429027866b9fd270 | |

# tcId = 139 | |

# special case public key | |

private = a06781fd4c4a0874e00e72ba131b9dd87a83b2904e294de176e8a9af1f695d67 | |

public = f7ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff3f | |

result = acceptable | |

shared = e995ad6a1ec6c5ab32922cff9d204721704673143c4a11deaa203f3c81989b3f | |

# Public keys are either points on a given curve or points on its twist. The | |

# functions X25519 and X448 are defined for points on a twist with the goal that | |

# the output of computations do not leak private keys. Implementations may | |

# accept or reject points on a twist. If a point multiplication is performed | |

# then it is important that the result is correct, since otherwise attacks with | |

# invalid keys are possible. | |

# tcId = 140 | |

# special case public key | |

private = b822d72d8b68bdb4fbf67e56a61d672b2c7747e94479fe5ae4072d0accdd6571 | |

public = feffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff3f | |

result = acceptable | |

shared = 32b6dabe01d13867f3b5b0892fefd80dca666f2edc5afb43cd0baf703c3e6926 | |

# Public keys are either points on a given curve or points on its twist. The | |

# functions X25519 and X448 are defined for points on a twist with the goal that | |

# the output of computations do not leak private keys. Implementations may | |

# accept or reject points on a twist. If a point multiplication is performed | |

# then it is important that the result is correct, since otherwise attacks with | |

# invalid keys are possible. | |

# tcId = 141 | |

# special case public key | |

private = d08ce1237e248d02cdf619d20bea5848ade4f6ffd171b8dee8793fc67c459640 | |

public = 0000000000000000000000000000000000000000000000000000000000000040 | |

result = valid | |

shared = a93d83fc9ea0f6cb0cc8b631da600019b76cbb2ec57222f2e42dd540e3da850b | |

# tcId = 142 | |

# special case public key | |

private = 180ae3c928514cfb9edd06e7dc1d5d066160e967445a5c58e4463b69ed205e6d | |

public = cbdce39b108c529dce74757843c71d8d1e44740e59f283ffb892f4fa6284c34a | |

result = valid | |

shared = 017cbfa2b38e9ef3297a339ecce1a917bdcf7e910036086a41d1e22d04241870 | |

# tcId = 143 | |

# special case public key | |

private = e881d806a110560cd8fee899d59c0249f1233a4322c41aa369c7a2a99f5b5962 | |

public = 3c5ff1b5d8e4113b871bd052f9e7bcd0582804c266ffb2d4f4203eb07fdb7c54 | |

result = valid | |

shared = 71133905b8a57ea8c38de0ecf213699a75b096c2df21f07f7e9eb03e9fa53f5c | |

# tcId = 144 | |

# special case public key | |

private = 08e410e1d7e8b9411236af4a35d6b62a5d8931478e4c62197cfafb491467b162 | |

public = 3e5ff1b5d8e4113b871bd052f9e7bcd0582804c266ffb2d4f4203eb07fdb7c54 | |

result = valid | |

shared = 3dc7b70e110766b2bf525252ebed98a100b2e532dc69544464da1bbab8625f6d | |

# tcId = 145 | |

# special case public key | |

private = e02fdf7e0ee3d55b4440f01432dd253c949793bc04da44ddece83e54c8c39b40 | |

public = f2ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff5f | |

result = valid | |

shared = e317e5cc438b5f79ead5533ac7c45519a117b31033cc2140b19edf8572011240 | |

# tcId = 146 | |

# special case public key | |

private = f05d18f68ef7a5865c14db3a9c255fdf2dabea2aa36581e94f68b727b582867b | |

public = f6ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff5f | |

result = valid | |

shared = d86810516aeddc18061036f599a9eb84d1c6146b0f543652dd4526743ba42c04 | |

# tcId = 147 | |

# special case public key | |

private = 00c103578d5c079d7bcc22c1c31e787c1b15c57fcb493fdafefa20371cfc746b | |

public = 95aff85a6cf2889dc30d68a9fc735e682c140261b37f596a7a101fd8bf6d3e6a | |

result = acceptable | |

shared = dfa988a477003be125b95ccbf2223d97729577d25e1d6e89e3da0afabdd0ae71 | |

# Public keys are either points on a given curve or points on its twist. The | |

# functions X25519 and X448 are defined for points on a twist with the goal that | |

# the output of computations do not leak private keys. Implementations may | |

# accept or reject points on a twist. If a point multiplication is performed | |

# then it is important that the result is correct, since otherwise attacks with | |

# invalid keys are possible. | |

# tcId = 148 | |

# special case public key | |

private = 7005bb927485c435642b424a3dde014bcf76345e5be64ae6e9b24db39e1cdb51 | |

public = 434638c8dee75ac56216150f7971c4e5c27717e34d1bf8008eda160a3af7786a | |

result = acceptable | |

shared = d450af45b8ed5fe140cc5263ffb7b52e66736899a8b872b6e28552129819b25b | |

# Public keys are either points on a given curve or points on its twist. The | |

# functions X25519 and X448 are defined for points on a twist with the goal that | |

# the output of computations do not leak private keys. Implementations may | |

# accept or reject points on a twist. If a point multiplication is performed | |

# then it is important that the result is correct, since otherwise attacks with | |

# invalid keys are possible. | |

# tcId = 149 | |

# special case public key | |

private = 0822039a5dc13c40fcccf346e2a7769b4fd272052d43260ad626468a50d44162 | |

public = 454638c8dee75ac56216150f7971c4e5c27717e34d1bf8008eda160a3af7786a | |

result = valid | |

shared = 58002c89bf8bc32ae6fc205b796acd13ef7f8476f6492ae4b2be47f1095e8a4f | |

# tcId = 150 | |

# special case public key | |

private = 40a6349c03f0dc0a42358f6353ca67632af687b14c9dff626c54e211e8fc355a | |

public = ecfffffffffffffffffffffffffffeffffffffffffffffffffffffffffffff7f | |

result = valid | |

shared = 7773aad6e72eb1735b65ad51f7dad258c11d7bfff53094424cb103cd6bfb4368 | |

# tcId = 151 | |

# special case public key | |

private = 50696d4d05209971d6ba0676ea274262ba639aac74fa75e5df4570768ad8ae74 | |

public = eefffffffffffffffffffffffffffeffffffffffffffffffffffffffffffff7f | |

result = valid | |

shared = c118ddf6462fbea80f14ef1f2972a1ab12cafa511d1323d4d22d0d426d651b5b | |

# tcId = 152 | |

# special case public key | |

private = 68bb680c853f4e4daa47c586dc886cf4568d7b0383770f6df439a53be4a3236d | |

public = edffffffffffffffffffffffff7fffffffffffffffffffffffffffffffffff7f | |

result = valid | |

shared = cc0775bfd970a2706b11c7222a4436a3d17160382c83b76f89b66192c81b4408 | |

# tcId = 153 | |

# special case public key | |

private = b0f6c28dbdc647068a76d71805ef770f087cf76b82afdc0d26c45b71ace49768 | |

public = ebffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff7f | |

result = valid | |

shared = f0097fa0ba70d019126277ab15c56ecc170ca88180b2bf9d80fcda3d7d74552a | |

# tcId = 154 | |

# special case public key | |

private = 18630f93598637c35da623a74559cf944374a559114c7937811041fc8605564a | |

public = ecffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff7f | |

result = acceptable | |

shared = 0000000000000000000000000000000000000000000000000000000000000000 | |

# The curves and its twists contain some points of low order. This test vector | |

# contains a public key with such a point. While many libraries reject such | |

# public keys, doing so is not a strict requirement according to RFC 7748. | |

# Public keys are either points on a given curve or points on its twist. The | |

# functions X25519 and X448 are defined for points on a twist with the goal that | |

# the output of computations do not leak private keys. Implementations may | |

# accept or reject points on a twist. If a point multiplication is performed | |

# then it is important that the result is correct, since otherwise attacks with | |

# invalid keys are possible. | |

# Some libraries include a check that the shared secret is not all-zero. This | |

# check is described in Section 6.1 of RFC 7748. | |

# tcId = 155 | |

# special case for E in multiplication by 2 | |

private = 581ecbda5a4a228044fefd6e03df234558c3c79152c6e2c5e60b142c4f26a851 | |

public = 0000000000000000000008000000000000000000000000000000000000000000 | |

result = acceptable | |

shared = 59e7b1e6f47065a48bd34913d910176b6792a1372aad22e73cd7df45fcf91a0e | |

# Public keys are either points on a given curve or points on its twist. The | |

# functions X25519 and X448 are defined for points on a twist with the goal that | |

# the output of computations do not leak private keys. Implementations may | |

# accept or reject points on a twist. If a point multiplication is performed | |

# then it is important that the result is correct, since otherwise attacks with | |

# invalid keys are possible. | |

# tcId = 156 | |

# special case for E in multiplication by 2 | |

private = b0561a38000795b7cb537b55e975ea452c2118506295d5eb15fd9c83b67f7a50 | |

public = 77af0d3897a715dfe25df5d538cf133bc9ab7ad52df6bd922a2fb75621d59901 | |

result = valid | |

shared = 179f6b020748acba349133eaa4518f1bd8bab7bfc4fb05fd4c24e7553da1e960 | |

# tcId = 157 | |

# special case for E in multiplication by 2 | |

private = b00f7df2d47128441c7270b9a87eee45b6056fc64236a57bdf81dbcccf5f5d42 | |

public = 4e39866127b6a12a54914e106aab86464af55631f3cb61766d5999aa8d2e070e | |

result = valid | |

shared = 43c5ee1451f213ef7624729e595a0fee7c9af7ee5d27eb03278ee9f94c202352 | |

# tcId = 158 | |

# special case for E in multiplication by 2 | |

private = c8f7a0c0bfb1e9c72576c534f86854fbe4af521d4fa807f67e2440e100ec8852 | |

public = adc6799ed8495ed5ab6eb1ef955479b9b50aa9ce0c349e8992a6665572d1f811 | |

result = valid | |

shared = 2f350bcf0b40784d1d756c9ca3e38ec9dd68ba80faf1f9847de50779c0d4902a | |

# tcId = 159 | |

# special case for E in multiplication by 2 | |

private = 58181f581aa37022ff71c56c6e68e6175d967c5c995a249885f66565074ded4d | |

public = 770f4218ef234f5e185466e32442c302bbec21bbb6cd28c979e783fe5013333f | |

result = acceptable | |

shared = d5d650dc621072eca952e4344efc7320b2b1459aba48f5e2480db881c50cc650 | |

# Public keys are either points on a given curve or points on its twist. The | |

# functions X25519 and X448 are defined for points on a twist with the goal that | |

# the output of computations do not leak private keys. Implementations may | |

# accept or reject points on a twist. If a point multiplication is performed | |

# then it is important that the result is correct, since otherwise attacks with | |

# invalid keys are possible. | |

# tcId = 160 | |

# special case for E in multiplication by 2 | |

private = 301c935cae4357070b0adaf9cd6192830b2c989c153729eed99f589eb45f884b | |

public = 5c6118c4c74cfb842d9a87449f9d8db8b992d46c5a9093ce2fcb7a49b535c451 | |

result = acceptable | |

shared = 909cc57275d54f20c67b45f9af9484fd67581afb7d887bee1db5461f303ef257 | |

# Public keys are either points on a given curve or points on its twist. The | |

# functions X25519 and X448 are defined for points on a twist with the goal that | |

# the output of computations do not leak private keys. Implementations may | |

# accept or reject points on a twist. If a point multiplication is performed | |

# then it is important that the result is correct, since otherwise attacks with | |

# invalid keys are possible. | |

# tcId = 161 | |

# special case for E in multiplication by 2 | |

private = d002292d4359a3d42bc8767f1380009332e7a0df2f3379011ab78f789f6baa54 | |

public = 4039866127b6a12a54914e106aab86464af55631f3cb61766d5999aa8d2e076e | |

result = valid | |

shared = 4a7e2c5caf1d8180eb1c4f22692f29a14b4cdc9b193bd1d16e2f27438eef1448 | |

# tcId = 162 | |

# special case for E in multiplication by 2 | |

private = d0c2c49e644ab738270707ff9917065942687e2f12886d961161db46c05b565f | |

public = 078fa523498fb51cba1112d83b20af448b8009d8eea14368564d01b8f9b6086f | |

result = acceptable | |

shared = c0ee59d3685fc2c3c803608b5ee39a7f8da30b48e4293ae011f0ea1e5aeb7173 | |

# Public keys are either points on a given curve or points on its twist. The | |

# functions X25519 and X448 are defined for points on a twist with the goal that | |

# the output of computations do not leak private keys. Implementations may | |

# accept or reject points on a twist. If a point multiplication is performed | |

# then it is important that the result is correct, since otherwise attacks with | |

# invalid keys are possible. | |

# tcId = 163 | |

# special case for E in multiplication by 2 | |

private = f087d38b274c1dad1bce6eaa36b48e2190b90b9bf8ca59669cc5e00464534342 | |

public = 9fc6799ed8495ed5ab6eb1ef955479b9b50aa9ce0c349e8992a6665572d1f871 | |

result = valid | |

shared = b252bc8eabfaa68c56e54d61b99061a35d11e3a7b9bda417d90f69b1119bcf45 | |

# tcId = 164 | |

# special case for E in multiplication by 2 | |

private = 48dbcc5a695f1514bbbaa6ad00842b69d9ae5216b1963add07fb2947c97b8447 | |

public = 7650f2c76858ea201da2022ac730ecc43654852ad209426dd5d048a9de2a667e | |

result = valid | |

shared = fbda33bc930c08df837208e19afdc1cfe3fd0f8f0e3976be34775e58a4a7771f | |

# tcId = 165 | |

# D = 0 in multiplication by 2 | |

private = 5891c9272cf9a197735b701e5715268d36d7436b7e351a3e997a0862e4807d4d | |

public = e0eb7a7c3b41b8ae1656e3faf19fc46ada098deb9c32b1fd866205165f49b800 | |

result = acceptable | |

shared = 0000000000000000000000000000000000000000000000000000000000000000 | |

# The curves and its twists contain some points of low order. This test vector | |

# contains a public key with such a point. While many libraries reject such | |

# public keys, doing so is not a strict requirement according to RFC 7748. | |

# Some libraries include a check that the shared secret is not all-zero. This | |

# check is described in Section 6.1 of RFC 7748. | |

# tcId = 166 | |

# D = 0 in multiplication by 2 | |

private = c0f9c60aea73731d92ab5ed9f4cea122f9a6eb2577bda72f94948fea4d4cc65d | |

public = 5f9c95bca3508c24b1d0b1559c83ef5b04445cc4581c8e86d8224eddd09f1157 | |

result = acceptable | |

shared = 0000000000000000000000000000000000000000000000000000000000000000 | |

# The curves and its twists contain some points of low order. This test vector | |

# contains a public key with such a point. While many libraries reject such | |

# public keys, doing so is not a strict requirement according to RFC 7748. | |

# Some libraries include a check that the shared secret is not all-zero. This | |

# check is described in Section 6.1 of RFC 7748. | |

# tcId = 167 | |

# special case for DA - CB in multiplication by 2 | |

private = 0066dd7674fe51f9326c1e239b875f8ac0701aae69a804c25fe43595e8660b45 | |

public = b0224e7134cf92d40a31515f2f0e89c2a2777e8ac2fe741db0dc39399fdf2702 | |

result = acceptable | |

shared = 8dacfe7beaaa62b94bf6e50ee5214d99ad7cda5a431ea0c62f2b20a89d73c62e | |

# Public keys are either points on a given curve or points on its twist. The | |

# functions X25519 and X448 are defined for points on a twist with the goal that | |

# the output of computations do not leak private keys. Implementations may | |

# accept or reject points on a twist. If a point multiplication is performed | |

# then it is important that the result is correct, since otherwise attacks with | |

# invalid keys are possible. | |

# tcId = 168 | |

# special case for DA - CB in multiplication by 2 | |

private = 80067f30f40d61318b420c859fce128c9017ab81b47b76028a57bc30d5856846 | |

public = 601e3febb848ec3e57fce64588aad82afc9c2af99bbcdffcc4cd58d4b3d15c07 | |

result = valid | |

shared = 20f1d3fe90e08bc6f152bf5dacc3ed35899785333f1470e6a62c3b8cbe28d260 | |

# tcId = 169 | |

# special case for DA - CB in multiplication by 2 | |

private = 584577669d21ce0ae3e30b02c9783ffe97709cbfe396889aa31e8ee43352dc52 | |

public = 82a3807bbdec2fa9938fb4141e27dc57456606301f78ff7133cf24f3d13ee117 | |

result = acceptable | |

shared = 2b28cc5140b816add5ad3a77a81b1c073d67bf51bf95bda2064a14eb12d5f766 | |

# Public keys are either points on a given curve or points on its twist. The | |

# functions X25519 and X448 are defined for points on a twist with the goal that | |

# the output of computations do not leak private keys. Implementations may | |

# accept or reject points on a twist. If a point multiplication is performed | |

# then it is important that the result is correct, since otherwise attacks with | |

# invalid keys are possible. | |

# tcId = 170 | |

# special case for DA - CB in multiplication by 2 | |

private = 18e597a4e2ccdb5e8052d57c9009938c2d4c43d6d8c9f93c98727b7311035953 | |

public = f329ab2376462e5f3128a2682086253c19222ac1e2bca45692f0c3b528f4c428 | |

result = valid | |

shared = 8392160083b9af9e0ef44fcfce53ba8ff7282ee7a6c71ab66f8843a55d09cd68 | |

# tcId = 171 | |

# special case for DA in multiplication by 2 | |

private = 88281cc51d5512d8814ea5249b879dcbad0323d38512dafbdc7ba85bba8c8d5d | |

public = 4fce3bb6c8aaf022dbd100e3cde3941b37d543f00401dba7da9bc143dfc55709 | |

result = valid | |

shared = 42184e22c535530c457bd3b4f1084cbf5e297f502fe136b8d1daecf5334cc96c | |

# tcId = 172 | |

# special case for DA in multiplication by 2 | |

private = d0e795450df0a813c6573496ec5793ca02e1bdbad10ed08df83fdaed68b3385f | |

public = 15c68851c1db844b5a1ef3456a659f188854b1a75fbdb2f68f514c9289ce711f | |

result = valid | |

shared = f654d78e5945b24bc63e3e6d790e0ae986e53937764068b1bce920e1d79b756f | |

# tcId = 173 | |

# special case for DA in multiplication by 2 | |

private = 30b69a1cc1eb2d0b83ea213846e90a2c922088bdf294a6995bf6e6e77c646c41 | |

public = 4200a242434337b8914f49345301ed782b13594f9ede089c41fb1e7ea82c9053 | |

result = valid | |

shared = cd8a09b04795edcc7061867373981aa748651ebdce5ec218a335b878cefe4872 | |

# tcId = 174 | |

# special case for DA in multiplication by 2 | |

private = 78b30bb63cd8ade71b7a77d426f4419d05f199ffef349e89faa9d9a5f21f6654 | |

public = baabf0174aaaea4de48cc83adfb0401461a741903ea6fb130d7d64b7bf03a966 | |

result = valid | |

shared = c9f8258f237db1c80702c5c4d9048dfba9dfe259da4aeee90dc2945526961275 | |

# tcId = 175 | |

# special case for x_2 in multiplication by 2 | |

private = c0b386f4ef0d4698686404977e7b60cb6c1f8b6012a22e29d6224c5947439041 | |

public = f12f18bd59c126348f6a7a9f4a5fdd9fcaf581345073a851fba098e5d64b4a0c | |

result = valid | |

shared = 6600cbe900616a770a126b8b19156d5e27e1174bd538d0944eb3c0be4899c758 | |

# tcId = 176 | |

# special case for x_2 in multiplication by 2 | |

private = 9886602e719bacafea092bb75b51ae7258abe1a364c176857f3dc188c03e6759 | |

public = bee386527b772490aeb96fc4d23b9304037cb4430f64b228f3d8b3b498319f22 | |

result = acceptable | |

shared = 3fe710d6344ff0cb342e52349e1c5b57b7a271f2a133bb5249bbe40dc86e1b40 | |

# Public keys are either points on a given curve or points on its twist. The | |

# functions X25519 and X448 are defined for points on a twist with the goal that | |

# the output of computations do not leak private keys. Implementations may | |

# accept or reject points on a twist. If a point multiplication is performed | |

# then it is important that the result is correct, since otherwise attacks with | |

# invalid keys are possible. | |

# tcId = 177 | |

# special case for x_2 in multiplication by 2 | |

private = b83960f5d0613cdaac6dda690351666e9f277bba6bd406b0e27a1886bb2d3e46 | |

public = cf911ac91b0d944049cec66ae5ef0c4549d1e612e107c68e87263a2fbcf8323f | |

result = valid | |

shared = 71373ebe67f39a2c230027c7db4b3b74bab80ed212b232679785ee10f47c304e | |

# tcId = 178 | |

# special case for x_2 in multiplication by 2 | |

private = d03b75f09ac807dfd2ee352c04a1f25984720f785ffaa0af88bc5db6ff9c3453 | |

public = 1e6ee536e4f26bbfb63139951a10f3bab62e19ed1ef8397178d9c5d04307cd40 | |

result = valid | |

shared = 238eef43c589822e1d3de41c1cc46dcfec7a93febf37c8546b6625e1a123815d | |

# tcId = 179 | |

# special case for x_2 in multiplication by 2 | |

private = d036948c0ec223f0ee577e390dbf87222358ed199f2823345ad154bbc4cbcc47 | |

public = 2f1c79ad8488db6f5146903b2dc46cfbfc834bbcf09b4dd70c274c4b67ce605d | |

result = valid | |

shared = 87a79c9c231d3b9526b49bf3d683bf38c3c319af7c7c5d1456487398da535010 | |

# tcId = 180 | |

# special case for x_2 in multiplication by 2 | |

private = d054ded613febf2950ac5c927fcb120c387de0ba61b331cd33024c8b6e737048 | |

public = fccfe742a63ed9cb70958560b5a02260350a7ecbaf8c57ae045f671a29b4b573 | |

result = valid | |

shared = d683ca6194452d878c12d7da35f22833f99728bba89931a51274f61210336a5f | |

# tcId = 181 | |

# special case for AA in multiplication by 2 | |

private = e82c480631fb153ba2211fe603032b3e71b162dbd3c11bec03208ffcd510655f | |

public = cb3d4a90f86b3011da3369d9988597c7fff1499273b4a04f84d0e26ed1683c0d | |

result = acceptable | |

shared = dbf6203516635840cf69a02db87cf0d95dae315da7fc1ec7ce2b29e1f2db6666 | |

# Public keys are either points on a given curve or points on its twist. The | |

# functions X25519 and X448 are defined for points on a twist with the goal that | |

# the output of computations do not leak private keys. Implementations may | |

# accept or reject points on a twist. If a point multiplication is performed | |

# then it is important that the result is correct, since otherwise attacks with | |

# invalid keys are possible. | |

# tcId = 182 | |

# special case for AA in multiplication by 2 | |

private = c0c01d28c1cab01f59700aca5f18d2697658b37fdd54a339ff391c0a1a1b1645 | |

public = 101e13f7bc0570fa2638caa20a67c6e0c21dab132f4b456191590264c493d018 | |

result = acceptable | |

shared = 1fe314744390d525278b1f5fbf108101b8ded587081375ed4ac4ac690d92414f | |

# Public keys are either points on a given curve or points on its twist. The | |

# functions X25519 and X448 are defined for points on a twist with the goal that | |

# the output of computations do not leak private keys. Implementations may | |

# accept or reject points on a twist. If a point multiplication is performed | |

# then it is important that the result is correct, since otherwise attacks with | |

# invalid keys are possible. | |

# tcId = 183 | |

# special case for AA in multiplication by 2 | |

private = c82bde72df36479688c485a8bf442f4a34412e429c02db97704f03daf4dfd542 | |

public = dce1ec0843fa8f05d9c7355df598391f3de254ecd0b4ba9e6ea6fd9b3b6c2f67 | |

result = acceptable | |

shared = ad454395ee392be677be7b9cb914038d57d2d87ec56cc98678dd84f19920912b | |

# Public keys are either points on a given curve or points on its twist. The | |

# functions X25519 and X448 are defined for points on a twist with the goal that | |

# the output of computations do not leak private keys. Implementations may | |

# accept or reject points on a twist. If a point multiplication is performed | |

# then it is important that the result is correct, since otherwise attacks with | |

# invalid keys are possible. | |

# tcId = 184 | |

# special case for AA in multiplication by 2 | |

private = 503f697617fb02a7b8ef00ba34e7fc8ce93f9ec3e1cbfe4bf2c05bcee0cb9757 | |

public = 21c2b56f0794cfee25cc9626677a6838000eb66d8c4b5fb07b2f1d912e97c372 | |

result = valid | |

shared = c6d6499255133398f9dd7f32525db977a538118800bfaf3aad8bcd26f02c3863 | |

# tcId = 185 | |

# special case for BB in multiplication by 2 | |

private = 58cd4ca1e4331188de2b2889419ce20ec5ef88a0e93af092099065551b904e41 | |

public = cc3d4a90f86b3011da3369d9988597c7fff1499273b4a04f84d0e26ed1683c0d | |

result = valid | |

shared = 0d74214da1344b111d59dfad3713eb56effe7c560c59cbbb99ec313962dbba58 | |

# tcId = 186 | |

# special case for BB in multiplication by 2 | |

private = 004ea3448b84ca509efec5fcc24c63ee984def63b29deb9037894709709c0957 | |

public = 111e13f7bc0570fa2638caa20a67c6e0c21dab132f4b456191590264c493d018 | |

result = acceptable | |

shared = 7b9dbf8d6c6d65898b518167bf4011d54ddc265d953c0743d7868e22d9909e67 | |

# Public keys are either points on a given curve or points on its twist. The | |

# functions X25519 and X448 are defined for points on a twist with the goal that | |

# the output of computations do not leak private keys. Implementations may | |

# accept or reject points on a twist. If a point multiplication is performed | |

# then it is important that the result is correct, since otherwise attacks with | |

# invalid keys are possible. | |

# tcId = 187 | |

# special case for BB in multiplication by 2 | |

private = c8a6eb00a4d74bbdff239522c3c891ed7ce1904be2a329cd0ae0061a253c9542 | |

public = dde1ec0843fa8f05d9c7355df598391f3de254ecd0b4ba9e6ea6fd9b3b6c2f67 | |

result = valid | |

shared = fb0e0209c5b9d51b401183d7e56a59081d37a62ab1e05753a0667eebd377fd39 | |

# tcId = 188 | |

# special case for BB in multiplication by 2 | |

private = 50322ff0d0dcdd6b14f307c04dfecefe5b7cdeaf92bffb919e9d62ed27079040 | |

public = 22c2b56f0794cfee25cc9626677a6838000eb66d8c4b5fb07b2f1d912e97c372 | |

result = valid | |

shared = dbe7a1fe3b337c9720123e6fcc02cf96953a17dc9b395a2206cb1bf91d41756e | |

# tcId = 189 | |

# special case for D in multiplication by 2 | |

private = e0328c7d188d98faf2ac72d728b7d14f2bbbd7a94d0fbd8e8f79abe0b1fe1055 | |

public = e58baccede32bcf33b3b6e3d69c02af8284a9631de74b6af3f046a9369df040f | |

result = valid | |

shared = 97bd42093e0d48f973f059dd7ab9f97d13d5b0d5eedffdf6da3c3c432872c549 | |

# tcId = 190 | |

# special case for D in multiplication by 2 | |

private = 5017679a17bd23adf95ad47e310fc6526f4ba9ca3b0839b53bd0d92839eb5b4f | |

public = c6d5c693fc0a4e2df6b290026860566a166b6d7aebe3c98828d492745c8df936 | |

result = valid | |

shared = 99bcbc7b9aa5e25580f92bf589e95dae874b83e420225d8a93e18e96dac00b63 | |

# tcId = 191 | |

# special case for D in multiplication by 2 | |

private = 2864aaf61c146df06cc256b065f66b34985cc015da5b1d647a6ed4e2c76bfc43 | |

public = d15f4bf2ef5c7bda4ee95196f3c0df710df5d3d206360fc3174ea75c3aa3a743 | |

result = valid | |

shared = afa2adb52a670aa9c3ec3020d5fda285474ede5c4f4c30e9238b884a77969443 | |

# tcId = 192 | |

# special case for D in multiplication by 2 | |

private = 184a6cfbabcbd1507a2ea41f52796583dbdb851b88a85781ee8e3c28782c3349 | |

public = 6dffb0a25888bf23cf1ac701bfbdede8a18e323b9d4d3d31e516a05fce7ce872 | |

result = acceptable | |

shared = e6a2fc8ed93ce3530178fef94bb0056f43118e5be3a6eabee7d2ed384a73800c | |

# Public keys are either points on a given curve or points on its twist. The | |

# functions X25519 and X448 are defined for points on a twist with the goal that | |

# the output of computations do not leak private keys. Implementations may | |

# accept or reject points on a twist. If a point multiplication is performed | |

# then it is important that the result is correct, since otherwise attacks with | |

# invalid keys are possible. | |

# tcId = 193 | |

# special case for D in multiplication by 2 | |

private = c85f954b85bc102aca799671793452176538d077862ee45e0b253619767dff42 | |

public = 21f86d123c923a92aaf2563df94b5b5c93874f5b7ab9954aaa53e3d72f0ff67e | |

result = acceptable | |

shared = 7fc28781631410c5a6f25c9cfd91ec0a848adb7a9eb40bc5b495d0f4753f2260 | |

# Public keys are either points on a given curve or points on its twist. The | |

# functions X25519 and X448 are defined for points on a twist with the goal that | |

# the output of computations do not leak private keys. Implementations may | |

# accept or reject points on a twist. If a point multiplication is performed | |

# then it is important that the result is correct, since otherwise attacks with | |

# invalid keys are possible. | |

# tcId = 194 | |

# special case for D in multiplication by 2 | |

private = 50e3e5a9a19be2ee3548b0964672fb5e3134cb0d2f7adf000e4556d0ffa37643 | |

public = 587c347c8cb249564ab77383de358cc2a19fe7370a8476d43091123598941c7f | |

result = valid | |

shared = 314d8a2b5c76cc7ee1217df2283b7e6724436e273aeb80628dce0600ab478a63 | |

# tcId = 195 | |

# special case for DA + CB in multiplication by 2 | |

private = 08ece580bb6ddf96559b81d7a97dd4531def6cc78d448a70cebabdd26caab146 | |

public = f5c6311a1dd1b9e0f8cfd034ac6d01bf28d9d0f962a1934ae2cb97cb173dd810 | |

result = valid | |

shared = 2bfd8e5308c34498eb2b4daf9ed51cf623da3beaeb0efd3d687f2b8becbf3101 | |

# tcId = 196 | |

# special case for DA + CB in multiplication by 2 | |

private = a886033e9dc2b6a913fffbc2bd402e8c11ec34d49c0dc0fa1429329b694a285f | |

public = 9316c06d27b24abc673ffb5105c5b9a89bdfaa79e81cdbb89556074377c70320 | |

result = acceptable | |

shared = d53c3d6f538c126b9336785d1d4e6935dc8b21f3d7e9c25bc240a03e39023363 | |

# Public keys are either points on a given curve or points on its twist. The | |

# functions X25519 and X448 are defined for points on a twist with the goal that | |

# the output of computations do not leak private keys. Implementations may | |

# accept or reject points on a twist. If a point multiplication is performed | |

# then it is important that the result is correct, since otherwise attacks with | |

# invalid keys are possible. | |

# tcId = 197 | |

# special case for DA + CB in multiplication by 2 | |

private = 98b1cc2020a8ec575d5c46c76024cf7c7ad7628eb909730bc4f460aaf0e6da4b | |

public = 8a4179807b07649e04f711bf9473a79993f84293e4a8b9afee44a22ef1000b21 | |

result = acceptable | |

shared = 4531881ad9cf011693ddf02842fbdab86d71e27680e9b4b3f93b4cf15e737e50 | |

# Public keys are either points on a given curve or points on its twist. The | |

# functions X25519 and X448 are defined for points on a twist with the goal that | |

# the output of computations do not leak private keys. Implementations may | |

# accept or reject points on a twist. If a point multiplication is performed | |

# then it is important that the result is correct, since otherwise attacks with | |

# invalid keys are possible. | |

# tcId = 198 | |

# special case for DA + CB in multiplication by 2 | |

private = c8e193de162aa349a3432c7a0c0521d92cbc5e3bf82615e42955dd67ec12345f | |

public = a773277ae1029f854749137b0f3a02b5b3560b9c4ca4dbdeb3125ec896b81841 | |

result = acceptable | |

shared = 7ba4d3de697aa11addf3911e93c94b7e943beff3e3b1b56b7de4461f9e48be6b | |

# Public keys are either points on a given curve or points on its twist. The | |

# functions X25519 and X448 are defined for points on a twist with the goal that | |

# the output of computations do not leak private keys. Implementations may | |

# accept or reject points on a twist. If a point multiplication is performed | |

# then it is important that the result is correct, since otherwise attacks with | |

# invalid keys are possible. | |

# tcId = 199 | |

# special case for DA + CB in multiplication by 2 | |

private = 88e01237b336014075676082afbde51d595d47e1fa5214b51a351abbf6491442 | |

public = 1eceb2b3763231bc3c99dc62266a09ab5d3661c756524cddc5aabcedee92da61 | |

result = acceptable | |

shared = bcf0884052f912a63bbab8c5c674b91c4989ae051fa07fcf30cb5317fb1f2e72 | |

# Public keys are either points on a given curve or points on its twist. The | |

# functions X25519 and X448 are defined for points on a twist with the goal that | |

# the output of computations do not leak private keys. Implementations may | |

# accept or reject points on a twist. If a point multiplication is performed | |

# then it is important that the result is correct, since otherwise attacks with | |

# invalid keys are possible. | |

# tcId = 200 | |

# special case for DA + CB in multiplication by 2 | |

private = e82313e451a198dce4ae95c6832a8281d847fc87b28db00fe43757c16cc49c4a | |

public = 9a2acbb3b5a386a6102e3728be3a97de03981d5c71fd2d954604bee3d3d0ce62 | |

result = acceptable | |

shared = e5772a92b103ee696a999705cf07110c460f0545682db3fac5d875d69648bc68 | |

# Public keys are either points on a given curve or points on its twist. The | |

# functions X25519 and X448 are defined for points on a twist with the goal that | |

# the output of computations do not leak private keys. Implementations may | |

# accept or reject points on a twist. If a point multiplication is performed | |

# then it is important that the result is correct, since otherwise attacks with | |

# invalid keys are possible. | |

# tcId = 201 | |

# special case for DA + CB in multiplication by 2 | |

private = 2828594d16768e586df39601ecc86d3fad6389d872b53fca3edcaf6fb958f653 | |

public = 27430e1c2d3089708bca56d7a5ad03792828d47685b6131e023dd0808716b863 | |

result = acceptable | |

shared = 378c29e3be97a21b9f81afca0d0f5c242fd4f896114f77a77155d06ce5fbfa5e | |

# Public keys are either points on a given curve or points on its twist. The | |

# functions X25519 and X448 are defined for points on a twist with the goal that | |

# the output of computations do not leak private keys. Implementations may | |

# accept or reject points on a twist. If a point multiplication is performed | |

# then it is important that the result is correct, since otherwise attacks with | |

# invalid keys are possible. | |

# tcId = 202 | |

# special case for z_2 in multiplication by 2 | |

private = a84f488e193139f986b0e5b249635b137d385e420342aef1f194fcde1fe5e850 | |

public = 4ef367901aac8ba90a50e0cf86ca4e4a3ff164fb121605be346e2e48d04ac912 | |

result = valid | |

shared = 7eb48a60b14fb9ea5728f6410aef627d1522fad481b934af64e2c483b64d585f | |

# tcId = 203 | |

# special case for z_2 in multiplication by 2 | |

private = 30fd2a781e095c34a483907b3dd2d8bd2736e279617bfa6b8b4e0e1cf90fbd46 | |

public = d1de303c4ddd05d57c29df92ad172dd8c8f424e63ec93445beaea44f9d124b17 | |

result = valid | |

shared = b71bdbed78023a06deed1c182e14c98f7cf46bc627a4a2c102ad23c41cf32454 | |

# tcId = 204 | |

# special case for z_2 in multiplication by 2 | |

private = 28312e17b47dd32d90561168245187963c7469a31c881e4a5c94384262b71959 | |

public = 5bccd739fd7517d9344bf6b2b0f19a1e0c38d9349a25ad1f94af4a2cdcf5e837 | |

result = valid | |

shared = 5bb56877caf2cdac98611b60367fbb74265984614e5e73996e8ea1bd6f749f1a | |

# tcId = 205 | |

# special case for z_2 in multiplication by 2 | |

private = a87640cf8237b473c638b3e9df08644e8607e563b5964363ccc42133b2996742 | |

public = 8a7a939310df7ea768454df51bcd0dfbd7be4fcbb2ffc98429d913ec6911f337 | |

result = acceptable | |

shared = b568ed46d04f6291f8c176dca8aff6d221de4c9cce4b404d5401fbe70a324501 | |

# Public keys are either points on a given curve or points on its twist. The | |

# functions X25519 and X448 are defined for points on a twist with the goal that | |

# the output of computations do not leak private keys. Implementations may | |

# accept or reject points on a twist. If a point multiplication is performed | |

# then it is important that the result is correct, since otherwise attacks with | |

# invalid keys are possible. | |

# tcId = 206 | |

# special case for z_2 in multiplication by 2 | |

private = 780c5b882720d85e5ddfaf1033e9a1385df9e21689eeda4dcc7444ad28330a50 | |

public = fe3590fc382da7a82e28d07fafe40d4afc91183a4536e3e6b550fee84a4b7b4b | |

result = acceptable | |

shared = 11fb44e810bce8536a957eaa56e02d04dd866700298f13b04ebeb48e20d93647 | |

# Public keys are either points on a given curve or points on its twist. The | |

# functions X25519 and X448 are defined for points on a twist with the goal that | |

# the output of computations do not leak private keys. Implementations may | |

# accept or reject points on a twist. If a point multiplication is performed | |

# then it is important that the result is correct, since otherwise attacks with | |

# invalid keys are possible. | |

# tcId = 207 | |

# special case for z_2 in multiplication by 2 | |

private = 209e5e0ae1994bd859ce8992b62ec3a66df2eb50232bcc3a3d27b6614f6b014d | |

public = fad9ab3e803b49fc81b27ee69db6fc9fdb82e35453b59ef8fab2a3beb5e1134c | |

result = acceptable | |

shared = 85d9db8f182bc68db67de3471f786b45b1619aec0f32b108ace30ee7b2624305 | |

# Public keys are either points on a given curve or points on its twist. The | |

# functions X25519 and X448 are defined for points on a twist with the goal that | |

# the output of computations do not leak private keys. Implementations may | |

# accept or reject points on a twist. If a point multiplication is performed | |

# then it is important that the result is correct, since otherwise attacks with | |

# invalid keys are possible. | |

# tcId = 208 | |

# special case for z_2 in multiplication by 2 | |

private = 806d1dee5ff6aea84a848916991a89ef3625583e1bd4ae0b3dd25c2524a4ff46 | |

public = 98bed955f1516c7a442751ac590046d7d52ca64f76df82be09d32e5d33b49073 | |

result = valid | |

shared = 61d4ef71cbe7be3128be829ab26ed3463eb4ab25937c309788e876b23412aa7c | |

# tcId = 209 | |

# special case for z_2 in multiplication by 2 | |

private = 00f98b02ae0df5274cc899f526eb1b877289e0963440a57dd97e414cdd2f7c51 | |

public = e59be4917b3f05b6fc8748c9b90f1b910273c9c6e17ff96ef415ff3d927d987e | |

result = valid | |

shared = 5ba4394ed1a664811b01557944becf7585652a8acbdbf806742911207bd79346 | |

# tcId = 210 | |

# special case for A in multiplication by 2 | |

private = d86c18f2be396b3bb72f22e6ece22e273af6e1506a1c09ad4d01bdd2f439f843 | |

public = 8c9885a26cb334054700a270f7a5f4aac06bad8263b651ebf0712eca1ebb6416 | |

result = acceptable | |

shared = a5952588613eb7a5cd49dd526f1f20a4f0ffe9423e82cea302c2dd90ce559955 | |

# Public keys are either points on a given curve or points on its twist. The | |

# functions X25519 and X448 are defined for points on a twist with the goal that | |

# the output of computations do not leak private keys. Implementations may | |

# accept or reject points on a twist. If a point multiplication is performed | |

# then it is important that the result is correct, since otherwise attacks with | |

# invalid keys are possible. | |

# tcId = 211 | |

# special case for A in multiplication by 2 | |

private = f81aadb9053eb698996d0f781d9cda67f82ddefa3987d276ff5a94ffdf5d255f | |

public = f6135fe9741c2c9de7dcf7627ef08832f351cb325dbb3a26f93a2b48620e1727 | |

result = acceptable | |

shared = cb6fb623084b6197443ec9ba1050c0923332e5e829ae0194269cfaf920a43601 | |

# Public keys are either points on a given curve or points on its twist. The | |

# functions X25519 and X448 are defined for points on a twist with the goal that | |

# the output of computations do not leak private keys. Implementations may | |

# accept or reject points on a twist. If a point multiplication is performed | |

# then it is important that the result is correct, since otherwise attacks with | |

# invalid keys are possible. | |

# tcId = 212 | |

# special case for A in multiplication by 2 | |

private = 305b4db4321b4923fc559bf91df677d0e12c3a31b16ec655cb708b759d7c114d | |

public = f6ffffffffffffffffffffffffffffbfffffffffffffffffffffffffffffff3f | |

result = valid | |

shared = 9e526079c2fcf12426ae6c2a54b5ffb70f2ec662e29ea5ce0c8385c3b21cd162 | |

# tcId = 213 | |

# special case for A in multiplication by 2 | |

private = 900638d1979802db9b52e4dd84fa19579f61cd7bef3c0b62fcccaeaa15fa484d | |

public = f6ffffffffffffffffffffffffffff3f00000000000000000000000000000040 | |

result = valid | |

shared = 6329c7dc2318ec36153ef4f6f91bc6e7d1e008f5293065d9586ab88abb58f241 | |

# tcId = 214 | |

# special case for A in multiplication by 2 | |

private = 38575cf7c8691ecc79cd5f8d7d4703aa48592ff6e7f64731c2d98a19aeae514f | |

public = f6eba0168be3d3621823089d810f77cd0cae34cda244c5d906c5d4b79df1e858 | |

result = valid | |

shared = 603f4fc410081f880944e0e13d56fc542a430eec813fad302b7c5ac380576f1c | |

# tcId = 215 | |

# special case for A in multiplication by 2 | |

private = e88bd02c7016547a24f428bc2a9dcccad6c6f880c17bffcf66fc68459627af4e | |

public = 60677a5d934ccbfab8ff5d8f085a0b553f94527d9c49ae140f8ed135e1449b69 | |

result = acceptable | |

shared = 834bbad5470e1498c4b0148782dfe630e8bfadff1997de802ac8ce302a1bda28 | |

# Public keys are either points on a given curve or points on its twist. The | |

# functions X25519 and X448 are defined for points on a twist with the goal that | |

# the output of computations do not leak private keys. Implementations may | |

# accept or reject points on a twist. If a point multiplication is performed | |

# then it is important that the result is correct, since otherwise attacks with | |

# invalid keys are possible. | |

# tcId = 216 | |

# special case for B in multiplication by 2 | |

private = 9036ed7d68f7448ac440dc51216b49840dcabd3d5e32e3b4ffc32a5fe9e96742 | |

public = 8d9885a26cb334054700a270f7a5f4aac06bad8263b651ebf0712eca1ebb6416 | |

result = acceptable | |

shared = ec9070ad3491a5ff50d7d0db6c9c844783dde1c6fbd4fe163e9ade1ce9cd041d | |

# Public keys are either points on a given curve or points on its twist. The | |

# functions X25519 and X448 are defined for points on a twist with the goal that | |

# the output of computations do not leak private keys. Implementations may | |

# accept or reject points on a twist. If a point multiplication is performed | |

# then it is important that the result is correct, since otherwise attacks with | |

# invalid keys are possible. | |

# tcId = 217 | |

# special case for B in multiplication by 2 | |

private = 90c55e77aa0fe4afb1287109fd010f526364dea18d88e2fd870ac01b66e3fa4e | |

public = f7135fe9741c2c9de7dcf7627ef08832f351cb325dbb3a26f93a2b48620e1727 | |

result = acceptable | |

shared = dc6d05b92edcdb5dc334b1fc3dff58fe5b24a5c5f0b2d4311555d0fc945d7759 | |

# Public keys are either points on a given curve or points on its twist. The | |

# functions X25519 and X448 are defined for points on a twist with the goal that | |

# the output of computations do not leak private keys. Implementations may | |

# accept or reject points on a twist. If a point multiplication is performed | |

# then it is important that the result is correct, since otherwise attacks with | |

# invalid keys are possible. | |

# tcId = 218 | |

# special case for B in multiplication by 2 | |

private = a021ba2fd4e3ad57bcbf204d6f6c3e8018d8978552633b6dff1b7447bf529459 | |

public = f7ffffffffffffffffffffffffffffbfffffffffffffffffffffffffffffff3f | |

result = valid | |

shared = 1b174b189981d81bc6887932083e8488df8bbbed57f9214c9cfa59d59b572359 | |

# tcId = 219 | |

# special case for B in multiplication by 2 | |

private = 3035083e984837587f6b7346af871bf3fc9581c50eb55c83aefabeed68cee349 | |

public = f7ffffffffffffffffffffffffffff3f00000000000000000000000000000040 | |

result = valid | |

shared = 15a052148abaad1b0f2e7481a34edb61403589439b5bd5e5646cecebe2a1be2b | |

# tcId = 220 | |

# special case for B in multiplication by 2 | |

private = 30435ce187f2723f9a3bdea0eef892207e152e4cee8985fa72d2db4147bd2a53 | |

public = f7eba0168be3d3621823089d810f77cd0cae34cda244c5d906c5d4b79df1e858 | |

result = valid | |

shared = 1d048cbe2f8df07c233a8f93706f307d17130c2497fb752eeaa31fe3edfc725a | |

# tcId = 221 | |

# special case for B in multiplication by 2 | |

private = 580f0a9bba7281a30fb033490e0f429f22e3f267852caeacefa3e5291f0e614e | |

public = 61677a5d934ccbfab8ff5d8f085a0b553f94527d9c49ae140f8ed135e1449b69 | |

result = acceptable | |

shared = cb92a98b6aa99ac9e3c5750cea6f0846b0181faa5992845b798923d419e82756 | |

# Public keys are either points on a given curve or points on its twist. The | |

# functions X25519 and X448 are defined for points on a twist with the goal that | |

# the output of computations do not leak private keys. Implementations may | |

# accept or reject points on a twist. If a point multiplication is performed | |

# then it is important that the result is correct, since otherwise attacks with | |

# invalid keys are possible. | |

# tcId = 222 | |

# special case for C in multiplication by 2 | |

private = 709098feb2e25c67b4bfd3be0a01af409adb6da52b3fbe3d970642dd2c983856 | |

public = c8239b710136fe431fb4d98436157e47c9e78a10f09ff92e98baff159926061c | |

result = acceptable | |

shared = f1bd12d9d32c6f4c5b2dcb3a5c52d9fd454d52ca704c2c137956ec8ad9aef107 | |

# Public keys are either points on a given curve or points on its twist. The | |

# functions X25519 and X448 are defined for points on a twist with the goal that | |

# the output of computations do not leak private keys. Implementations may | |

# accept or reject points on a twist. If a point multiplication is performed | |

# then it is important that the result is correct, since otherwise attacks with | |

# invalid keys are possible. | |

# tcId = 223 | |

# special case for C in multiplication by 2 | |

private = 185ac62e729f88528950926c0de7c481c924bf9cf26a122f443b861e8b6af640 | |

public = b7a2f79e0de9b58147691b5546d9ec463da8325e1440e58bb20aa129d1b97327 | |

result = valid | |

shared = e6f1c494c9e4bd2325c17183e82d31ab0bbee6c847d4b0e4a99c7c6891117c3f | |

# tcId = 224 | |

# special case for C in multiplication by 2 | |

private = f03743eead7c2f7719794324f271072817d1a04cbda42b232f3bee43f397cc40 | |

public = 2dc624e1663f42a7b9336350f277541b50b8ddc7ee0d86133ad53273aed4e62e | |

result = valid | |

shared = aa2a12edf752d279bdb000fb1405a5df8c5f1d41309b4f2bd41aed7ac1ed0149 | |

# tcId = 225 | |

# special case for C in multiplication by 2 | |

private = a8fbb4f90da45794981405d59ef310621e3c3b6b7760b5e30308c7822c88ae5f | |

public = 0e5eceee9104a64f82c9093b9bf7b4076ee5bc70815af7ee9f942ef015756176 | |

result = valid | |

shared = 74d5606ba0b6ad1d8ba36ae6f264d6315f479b3984de573e9b001e0555247c32 | |

# tcId = 226 | |

# special case for CB in multiplication by 2 | |

private = c887886fd07107c7221f6d9dd36c305ec779ceca132ac933ff77dab2beac6345 | |

public = 737d45477e2beb77a6c38b98e2a19b05c395df7da998cb91f6dfab5819614f27 | |

result = acceptable | |

shared = 8cf4538ae5f445cc6d273df4ad300a45d7bb2f6e373a562440f1b37773904e32 | |

# Public keys are either points on a given curve or points on its twist. The | |

# functions X25519 and X448 are defined for points on a twist with the goal that | |

# the output of computations do not leak private keys. Implementations may | |

# accept or reject points on a twist. If a point multiplication is performed | |

# then it is important that the result is correct, since otherwise attacks with | |

# invalid keys are possible. | |

# tcId = 227 | |

# special case for CB in multiplication by 2 | |

private = 58096ee29361978f630ad1fb00c1267c5a901f99c502f9569b933ad0dcce0f50 | |

public = 873f8b260ea9d9ddac08b7b030727bf0072315ab54075ecc393a37a975882b7e | |

result = valid | |

shared = d5766753211d9968de4ac2559998f22ef44e8aa879f3328cbc46aa858dcb433c | |

# tcId = 228 | |

# special case for CB in multiplication by 2 | |

private = 0829a49046dce2c07ab28440dbad146453e128960e85dd2e6a69a1512873dd44 | |

public = 75e1587c5eefc83715d71020aa6be5347bb9ec9d91ce5b28a9bbb74c92ef407e | |

result = valid | |

shared = 761d8cecf13f93b379a772e5fac5b9ffe996cad9af06152580afe87ff9651c71 | |

# tcId = 229 | |

# special case for x_2 in multiplication by 3 | |

private = 587ac36b9a23594632679adea1a826f2f62d79738220fb487464039f36ca2372 | |

public = f85a06065ea2527238fc5ec1b75ead9262e6b1aed61feff83b91230aeb4b7d01 | |

result = acceptable | |

shared = f12acd36f6299a4d192c03aa4efeea7df51e2d15d763172e68accf7bc6f5c230 | |

# Public keys are either points on a given curve or points on its twist. The | |

# functions X25519 and X448 are defined for points on a twist with the goal that | |

# the output of computations do not leak private keys. Implementations may | |

# accept or reject points on a twist. If a point multiplication is performed | |

# then it is important that the result is correct, since otherwise attacks with | |

# invalid keys are possible. | |

# tcId = 230 | |

# special case for x_2 in multiplication by 3 | |

private = a8a442b7c0a99227b4cb5c75fb9e5a72cea25eba8a0bdf07271bb4a93c2b6665 | |

public = 6e0f1d00b1099d2a71f7be86655feb8988bba5577b02f964043a49f00c749613 | |

result = valid | |

shared = b2bbbd173f41d952d329251da973a9500300628177ad0fb79d01e2e263905b38 | |

# tcId = 231 | |

# special case for x_2 in multiplication by 3 | |

private = d8f7233e9612c00c9dca2c751ec1d3f5f67bad77c2e714a20e71eb3f220a6671 | |

public = 696757ced3097fa960c8390a09e8bd6d390dbde8d1fa170261f3422edc192929 | |

result = acceptable | |

shared = 45ecfa275f1daa25d3fadf33cdf89a152afea25eae37e68e00b30c367789887a | |

# Public keys are either points on a given curve or points on its twist. The | |

# functions X25519 and X448 are defined for points on a twist with the goal that | |

# the output of computations do not leak private keys. Implementations may | |

# accept or reject points on a twist. If a point multiplication is performed | |

# then it is important that the result is correct, since otherwise attacks with | |

# invalid keys are possible. | |

# tcId = 232 | |

# special case for x_2 in multiplication by 3 | |

private = d80c7c7557c9907e1b11e844bf1369cba669bc38e9b7b253e51f239bda322374 | |

public = fd84b3f2fbfa16aebf40c27f46e18d77bafa0c7971bedde4909212e771bd3c35 | |

result = acceptable | |

shared = 595e144e07bbe65b38e0e4163d02ad75a65e422e74067db35c90dfa6e055d456 | |

# Public keys are either points on a given curve or points on its twist. The | |

# functions X25519 and X448 are defined for points on a twist with the goal that | |

# the output of computations do not leak private keys. Implementations may | |

# accept or reject points on a twist. If a point multiplication is performed | |

# then it is important that the result is correct, since otherwise attacks with | |

# invalid keys are possible. | |

# tcId = 233 | |

# special case for x_2 in multiplication by 3 | |

private = 8002a85115ad7b41c50f84f35fac750ee8e19734807102830ff6a306beed4464 | |

public = 805485703ccfc4a221ef281267f52b61cebc879f0f13b1e5f521c17352a0784f | |

result = acceptable | |

shared = 226e16a279ac81e268437eb3e09e07406324cb72a9d4ee58e4cf009147497201 | |

# Public keys are either points on a given curve or points on its twist. The | |

# functions X25519 and X448 are defined for points on a twist with the goal that | |

# the output of computations do not leak private keys. Implementations may | |

# accept or reject points on a twist. If a point multiplication is performed | |

# then it is important that the result is correct, since otherwise attacks with | |

# invalid keys are possible. | |

# tcId = 234 | |

# special case for x_2 in multiplication by 3 | |

private = 782db0c8e3e68f106fe0c56415e0bd13d812dea0e94cbd18bdf6761295613a6d | |

public = 80642a3279da6bf5fc13db14a569c7089db014225cfcae7dff5a0d25ecc9235b | |

result = acceptable | |

shared = 790d09b1726d210957ce8f65869ca1ec8fa0b2b06b6bcf9483b3eb55e49e9272 | |

# Public keys are either points on a given curve or points on its twist. The | |

# functions X25519 and X448 are defined for points on a twist with the goal that | |

# the output of computations do not leak private keys. Implementations may | |

# accept or reject points on a twist. If a point multiplication is performed | |

# then it is important that the result is correct, since otherwise attacks with | |

# invalid keys are possible. | |

# tcId = 235 | |

# special case for z_2 in multiplication by 3 | |

private = 909fb0bdbf53a69a2fe39c8b2497abd4fa57d2d54e046b5f514595e2c0f33d63 | |

public = 84e827f78cae0cf063e4340198f788c284e07430b3a94a3873df38b1f872ce02 | |

result = valid | |

shared = 684cc83af806bcd9cd251e1858f3c10f0166e0a0cd2be154339a886b13e7c76f | |

# tcId = 236 | |

# special case for z_2 in multiplication by 3 | |

private = 78a67909757248665f79371eb014825ab6bd4af3571f140389c636e004bcf46b | |

public = d445e1df0083bb6b8e886e6632251807171d4e88c41816fc684373c09d7e5d6e | |

result = valid | |

shared = e426e4a3c54d3e77f4f157301e0ac7d9e12337a2b58df16780041cf6d6198c5a | |

# tcId = 237 | |

# special case for z_2 in multiplication by 3 | |

private = 286a302d5b076d2aba7c2a4daf9e7cc9d8539b7c0391307db65a2f4220d30f70 | |

public = f26aa6151a4b22390176f6233e742f40f2ecd5137166fb2e1ec9b2f2454ac277 | |

result = acceptable | |

shared = 862df92e25277bd94f9af2e1dda51f905a6e2a3f6068a92fabfc6c53da21ec11 | |

# Public keys are either points on a given curve or points on its twist. The | |

# functions X25519 and X448 are defined for points on a twist with the goal that | |

# the output of computations do not leak private keys. Implementations may | |

# accept or reject points on a twist. If a point multiplication is performed | |

# then it is important that the result is correct, since otherwise attacks with | |

# invalid keys are possible. | |

# tcId = 238 | |

# special case for DA - CB in multiplication by 3 | |

private = a838b70d17161cb38222f7bc69a3c8576032d580275b3b7d63fba08908cb4879 | |

public = 2b02db3c82477fe21aa7a94d85df379f571c8449b43cbd0605d0acc53c472f05 | |

result = valid | |

shared = 3f438dbf03947995c99fd4cb366ca7e00e8cfbce64c3039c26d9fad00fa49c70 | |

# tcId = 239 | |

# special case for DA - CB in multiplication by 3 | |

private = b0733b4203267ab3c94c506acadb949a76cc600486fcd601478fcdef79c29d6c | |

public = d71dd7db122330c9bbaab5da6cf1f6e1c25345ee6a66b17512b1804ace287359 | |

result = acceptable | |

shared = 95f3f1849b0a070184e6077c92ae36ba3324bf1441168b89bb4b9167edd67308 | |

# Public keys are either points on a given curve or points on its twist. The | |

# functions X25519 and X448 are defined for points on a twist with the goal that | |

# the output of computations do not leak private keys. Implementations may | |

# accept or reject points on a twist. If a point multiplication is performed | |

# then it is important that the result is correct, since otherwise attacks with | |

# invalid keys are possible. | |

# tcId = 240 | |

# special case for BB in multiplication by 3 | |

private = d844a36b58aefdb08b981796029a2766101884b348f70eed947c2541064caf6a | |

public = 737bc07de0729bbcfbee3a08e696f97f3770577e4b01ec108f59caf46406d205 | |

result = acceptable | |

shared = 6a969af6d236aba08fa83160f699e9ed76fb6355f0662f03dbc5915a3c23063e | |

# Public keys are either points on a given curve or points on its twist. The | |

# functions X25519 and X448 are defined for points on a twist with the goal that | |

# the output of computations do not leak private keys. Implementations may | |

# accept or reject points on a twist. If a point multiplication is performed | |

# then it is important that the result is correct, since otherwise attacks with | |

# invalid keys are possible. | |

# tcId = 241 | |

# special case for BB in multiplication by 3 | |

private = a0b7d312d9b832e124d1bc8cb21db545440e3cf14e7473ee9ccbe9b682f2156c | |

public = 9758061a7b3e2c02fb5c20875ae6b55b11fb6795990a0f4fdcd1147be5521607 | |

result = valid | |

shared = ab39db4aa29ac4017c7446f1ad0c7daa9a37f1b6b4f2e9d2902ccefb84839d28 | |

# tcId = 242 | |

# special case for BB in multiplication by 3 | |

private = 787f1ddd78cc6473d3e63949409ad3f35bfe0ce0738f255dee682f2bfbc80f7f | |

public = 37cd65d33036205f3449e8655a50d4b0c86fec02100b4f2db7da92dcf5e3aa0a | |

result = acceptable | |

shared = 13de41659e3e308d6e26c94282fcc3e0364ddf0809ddee6c8e7abb5091b02b00 | |

# Public keys are either points on a given curve or points on its twist. The | |

# functions X25519 and X448 are defined for points on a twist with the goal that | |

# the output of computations do not leak private keys. Implementations may | |

# accept or reject points on a twist. If a point multiplication is performed | |

# then it is important that the result is correct, since otherwise attacks with | |

# invalid keys are possible. | |

# tcId = 243 | |

# special case for BB in multiplication by 3 | |

private = 4080ae60a85c1fa95aad9beabd98b405e7f28141bf08f2c9a4fdbde1c5680265 | |

public = a9b6e8081460383adc587c8f91a02c59a7a35576ca62436ccd1b5fef1b92545d | |

result = acceptable | |

shared = 69ed8a0a27812ae6741474bd5c6a4e683a126649f7245aa0f91a3a384bcde25a | |

# Public keys are either points on a given curve or points on its twist. The | |

# functions X25519 and X448 are defined for points on a twist with the goal that | |

# the output of computations do not leak private keys. Implementations may | |

# accept or reject points on a twist. If a point multiplication is performed | |

# then it is important that the result is correct, since otherwise attacks with | |

# invalid keys are possible. | |

# tcId = 244 | |

# special case for E in multiplication by 3 | |

private = 08f9f4a4fac4db413315f74a59818b2452fc7b7685592e26556775f9b86d907f | |

public = fd1a2cd17a93f850deb8c45a2d34539232dfd8a558304209781c6cb58229870e | |

result = valid | |

shared = 010218bd67b1b92fee3e7fa4578c13617d73195de10279747e53ba01a254525a | |

# tcId = 245 | |

# special case for E in multiplication by 3 | |

private = 1888cfae3085867657b09435c42b74cc762457839451a3659db218d4214fdd63 | |

public = b88119e5ae6d9e6b912d52524739e612ef19ab7e5dd3d946cb9bc003c378f81f | |

result = valid | |

shared = e6b298de9cb6358fbbb00f11890f5714a3858e8f05a2a8d1cf39fe78cc55dd4e | |

# tcId = 246 | |

# special case for E in multiplication by 3 | |

private = 789ce13ed007818d7a5181e629eed944a20a058cfe39669c9831bfa5215a1269 | |

public = 7b70e29dce0479cde4a36c7f9786582f104bc0788f046b48af495e67bdb88f36 | |

result = valid | |

shared = 967bbe298494b4a5f95853cfde9dc85970b2a4b5dd2c92782901e853957f5809 | |

# tcId = 247 | |

# special case for E in multiplication by 3 | |

private = 00022b43775ab2f4b91bc1cb54c97f78026289eaaf02abeed04ca84f736c686c | |

public = 2a209e2ace0e3d6973ffbf7403f9857ff97a5fdcd27f2c7098b444fc3c166738 | |

result = acceptable | |

shared = 9f66848681d534e52b659946ea2c92d2fabed43fe6e69032c11153db43dca75b | |

# Public keys are either points on a given curve or points on its twist. The | |

# functions X25519 and X448 are defined for points on a twist with the goal that | |

# the output of computations do not leak private keys. Implementations may | |

# accept or reject points on a twist. If a point multiplication is performed | |

# then it is important that the result is correct, since otherwise attacks with | |

# invalid keys are possible. | |

# tcId = 248 | |

# special case for E in multiplication by 3 | |

private = 8097a52fc562e8a516682f5363cc5e7c88e9c78e308df0deef40497b35cc127d | |

public = f50709aca7f314e8d05b5ff97a427e427bd5e85c4e86712125076a771be21448 | |

result = valid | |

shared = ea7572e27a9120de1f13b85710ba69a3471b7b3f5d12bc430c12c4bbf8aa3957 | |

# tcId = 249 | |

# special case for E in multiplication by 3 | |

private = 4028802030d8a8221a7160eebbf1846116c1c253abc467d6e43cb850f1459860 | |

public = 0f13955978b93d7b9f9a2e70d96df922850a8ffd8412e236fb074aef99d37d54 | |

result = valid | |

shared = e23d63a46be67c7443c07b9371ff6a06afcd7a5794bf2537926074b88190307a | |

# tcId = 250 | |

# special case for E in multiplication by 3 | |

private = d8515d45c7ab2b9529816543150068b8e4bb614cf2b68a8a99363975af503d74 | |

public = 18ffe992a729ce70c3b7cdc55bab55f2210d279134b3082a9f682d3a0b131273 | |

result = valid | |

shared = 33ccaf24e1e26290ed7e462093e9f77607ef52a0626b2cd2511c41cd24c13849 | |

# tcId = 251 | |

# special case for AA in multiplication by 3 | |

private = d8815bd144518fa526befdd373f5f9cff254d5d3c4660e8a90ef2a22c6876a74 | |

public = c3ba28057728d0533965ec34979fe7bd93cf6cb644e8da038baa87997b8dc20e | |

result = acceptable | |

shared = 74f95b4700f0185f33c5b5528ed5012a3363f8bbd6f6a840aa1f0f3bdb7c9650 | |

# Public keys are either points on a given curve or points on its twist. The | |

# functions X25519 and X448 are defined for points on a twist with the goal that | |

# the output of computations do not leak private keys. Implementations may | |

# accept or reject points on a twist. If a point multiplication is performed | |

# then it is important that the result is correct, since otherwise attacks with | |

# invalid keys are possible. | |

# tcId = 252 | |

# special case for AA in multiplication by 3 | |

private = a82d996093eefdaf283f4049bba4f5af6ecc2e64894f325ee1f9ca1e156d0567 | |

public = 4eb095a86d1e781bb182233075ebf1db109d57135bf91d54fdb18eb371427640 | |

result = valid | |

shared = e9677b854851c41cc489e03981ae78690be6cbf0054ea9834759de3e27bcf03e | |

# tcId = 253 | |

# special case for AA in multiplication by 3 | |

private = c02609df3d5436c123dcd7ee11f23f1da321666c09f379d37914203340510861 | |

public = 83f67d7c92b11c8fb072484642a01f43deb022b54d94a4015e39849a2e2e9555 | |

result = acceptable | |

shared = f148716ebe7269a7076f0cf1f22b6978d3c7e3607b0bcc87a8c7a85b9fd20c2f | |

# Public keys are either points on a given curve or points on its twist. The | |

# functions X25519 and X448 are defined for points on a twist with the goal that | |

# the output of computations do not leak private keys. Implementations may | |

# accept or reject points on a twist. If a point multiplication is performed | |

# then it is important that the result is correct, since otherwise attacks with | |

# invalid keys are possible. | |

# tcId = 254 | |

# special case for AA in multiplication by 3 | |

private = a0e3b78c0f3be2a760b2c916f244df219624fdda2e9e31b15328f4a77690296a | |

public = 20cc75d376d8453b9d049c84f58eafcf61126c08a03661e735f0a8be228fd466 | |

result = valid | |

shared = 1d5c123e88e9dc7a3b16ec90b60578dfca7e11eab9b88c6eca7bc33d91fde83b | |

# tcId = 255 | |

# special case for AA in multiplication by 3 | |

private = 701f130a290584cb28c7d6539506a1a054f926a17ef7c568ae43047c05e10f60 | |

public = ef31b43d19c0a5434deb56129c16298a394a7032a2e52cb997476bdeca325b73 | |

result = valid | |

shared = 2fc065ba8f5040a0a659f6f7330554bd1b9d7c893b91e316e0af90c37af4f135 | |

# tcId = 256 | |

# special case for AA in multiplication by 3 | |

private = d0e67f68183a4c1aed9c56864b36278bb7bb75d57a78321bc7c24ff61636607a | |

public = d8c8e2c6f33a98525df3767d1d04430dab0bda41f1f904c95bc61cc122caca74 | |

result = acceptable | |

shared = ef7612c156078dae3a81e50ef33951cab661fb07731d8f419bc0105c4d6d6050 | |

# Public keys are either points on a given curve or points on its twist. The | |

# functions X25519 and X448 are defined for points on a twist with the goal that | |

# the output of computations do not leak private keys. Implementations may | |

# accept or reject points on a twist. If a point multiplication is performed | |

# then it is important that the result is correct, since otherwise attacks with | |

# invalid keys are possible. | |

# tcId = 257 | |

# special case for AA in multiplication by 3 | |

private = 88eb7775dacc32b045ceb35f261b3616315efa98b780e08c79d544edadb5467d | |

public = 1833619516b80db0c05b225509e6698df028d83b66ed6bac6f0f6308970d2c7d | |

result = acceptable | |

shared = a3cf3d81ec56896a68fca0da6335171d0c622568738c0db26fe117033726a049 | |

# Public keys are either points on a given curve or points on its twist. The | |

# functions X25519 and X448 are defined for points on a twist with the goal that | |

# the output of computations do not leak private keys. Implementations may | |

# accept or reject points on a twist. If a point multiplication is performed | |

# then it is important that the result is correct, since otherwise attacks with | |

# invalid keys are possible. | |

# tcId = 258 | |

# special case for AA in multiplication by 3 | |

private = 7055b1c0576e7ab6c89fcc1ce49e79c8c371bf9fc2b22b8f8396a9b64c5ae26d | |

public = e2e989aad2397fc34b6cbe2db27d5ab69b28048383c91d9e8226d548253fab7e | |

result = valid | |

shared = e7f45823a45b6a46192b37d73e8609b5bda68cd7cfbdccaa49082080993e640f | |

# tcId = 259 | |

# special case for D in multiplication by 4 | |

private = 906a9bfcfd71014d18967680d4509eaa41c666424af98bf9ff7ff49eb1baba41 | |

public = b9bd793624d6a7e808486110058853edb25e136bd4d6a795d6d2ef53b25e3804 | |

result = acceptable | |

shared = 7c6148134c9e8b2ba5daeca41e6a1f3a82d8f75d0b292b23c40fe7f5ce0a2b7a | |

# Public keys are either points on a given curve or points on its twist. The | |

# functions X25519 and X448 are defined for points on a twist with the goal that | |

# the output of computations do not leak private keys. Implementations may | |

# accept or reject points on a twist. If a point multiplication is performed | |

# then it is important that the result is correct, since otherwise attacks with | |

# invalid keys are possible. | |

# tcId = 260 | |

# special case for D in multiplication by 4 | |

private = 28392b1b035a8465aa22aabb571061c6effeed40cc2530b628e4fd40395ae04a | |

public = e3f444e208da9043f3f74c20e28d7f404bb687a346709abcd555156f88607820 | |

result = acceptable | |

shared = ea5e772bac4693ce69ea3ac761011fa7674037653a433c7f05456e7291cd3c4e | |

# Public keys are either points on a given curve or points on its twist. The | |

# functions X25519 and X448 are defined for points on a twist with the goal that | |

# the output of computations do not leak private keys. Implementations may | |

# accept or reject points on a twist. If a point multiplication is performed | |

# then it is important that the result is correct, since otherwise attacks with | |

# invalid keys are possible. | |

# tcId = 261 | |

# special case for D in multiplication by 4 | |

private = 78cbb35204cc88676c14e0ff18171392e998411b23d905d4c4dceab70511f442 | |

public = 87b43f90f76d12fb3a469fa8687c27e369d4a82f95cf95e8dc3970de8f86d92b | |

result = acceptable | |

shared = 81c395aed5cc5f5e2a206a8a4cacecd501df5b81e49433835ad8a3779edffb30 | |

# Public keys are either points on a given curve or points on its twist. The | |

# functions X25519 and X448 are defined for points on a twist with the goal that | |

# the output of computations do not leak private keys. Implementations may | |

# accept or reject points on a twist. If a point multiplication is performed | |

# then it is important that the result is correct, since otherwise attacks with | |

# invalid keys are possible. | |

# tcId = 262 | |

# special case for D in multiplication by 4 | |

private = a8225b49ef7b7330e3de787cbc40479644db7ab126370295c94189673430d745 | |

public = 86441ea06c5cd2a34c6b51261e93a2f30ea7db0f74e14c42f0fc443c6735973c | |

result = acceptable | |

shared = 513eba5870dc5187e2552fe3ba8292b516d2af9ecb9a9bdc51eac2ce2de40112 | |

# Public keys are either points on a given curve or points on its twist. The | |

# functions X25519 and X448 are defined for points on a twist with the goal that | |

# the output of computations do not leak private keys. Implementations may | |

# accept or reject points on a twist. If a point multiplication is performed | |

# then it is important that the result is correct, since otherwise attacks with | |

# invalid keys are possible. | |

# tcId = 263 | |

# special case for D in multiplication by 4 | |

private = 0841e1a5c7420b94b6cc6991316ebdd608626339c09d0f67b24088588b9d0d49 | |

public = 4624aa4ae9d12725bf92b85f93e3e8cea16b7bd83fda0eb18fab2dbe0e8bf742 | |

result = acceptable | |

shared = 983b7e236ffaddb4b759b7353fe87846f59fb6f28a3ed65c256176b6609b7c6e | |

# Public keys are either points on a given curve or points on its twist. The | |

# functions X25519 and X448 are defined for points on a twist with the goal that | |

# the output of computations do not leak private keys. Implementations may | |

# accept or reject points on a twist. If a point multiplication is performed | |

# then it is important that the result is correct, since otherwise attacks with | |

# invalid keys are possible. | |

# tcId = 264 | |

# special case for D in multiplication by 4 | |

private = 08ecf76e31a23039ea8a15ee474b6251a9d725bff1a5751eb5ecde9d7d4e2f49 | |

public = a625a5b7a04cea462d123b485c39ea44a8079aa223c59e9ca97abcd30b500e4b | |

result = valid | |

shared = c941369b085c7465d50d23ceaf6717ab06e24638f217a7b8055ce8ebd3ca1225 | |

# tcId = 265 | |

# special case for D in multiplication by 4 | |

private = 6038fb0a830d1001ca8ea74a613ea98f6ab8512644e55e8d45a29071bd4bef45 | |

public = 8a5f2063f259f3317ae3e0b459f82c4677666e49a2eb9bf0369aee663631265b | |

result = acceptable | |

shared = a3f7e169db44d0d179c242e66347364ab92744dc6ad80e4775aef7f4ff9d5f34 | |

# Public keys are either points on a given curve or points on its twist. The | |

# functions X25519 and X448 are defined for points on a twist with the goal that | |

# the output of computations do not leak private keys. Implementations may | |

# accept or reject points on a twist. If a point multiplication is performed | |

# then it is important that the result is correct, since otherwise attacks with | |

# invalid keys are possible. | |

# tcId = 266 | |

# special case for D in multiplication by 4 | |

private = c04cf129f0b33332e2654f8e45225c042d7fa6cbc793c88bd4c731985289b045 | |

public = 54cfb6ad0d03e3115acafee12606397f2bb46a8c5f326a255c494118aead3b62 | |

result = acceptable | |

shared = 401aabfbb73fe6694c446ecfffb43006427a9d4756e049a1ffc79578d62f1660 | |

# Public keys are either points on a given curve or points on its twist. The | |

# functions X25519 and X448 are defined for points on a twist with the goal that | |

# the output of computations do not leak private keys. Implementations may | |

# accept or reject points on a twist. If a point multiplication is performed | |

# then it is important that the result is correct, since otherwise attacks with | |

# invalid keys are possible. | |

# tcId = 267 | |

# special case for E in multiplication by 4 | |

private = 3806b036c92d7bc0771998d24dbda2945b601d42449bd3ec4bbf3757d01b894d | |

public = 0ee3bee8cb3a0afcec22fa2233706e8ec29ccf1af212c0a674745ebba34f9d08 | |

result = valid | |

shared = 20322dd024fb5a40f327cf7c00da203734c2a279b9666a9ff7d8527c927b675e | |

# tcId = 268 | |

# special case for E in multiplication by 4 | |

private = 380d9056b5a2f4b3dffb30e6ceb722ac4684245f1befafb5661bc8c7a9ad4c43 | |

public = 797ec7512afbf0ad918d0e4947903be95234f3abf36750a8f854888d117b774e | |

result = valid | |

shared = 46152d59c2d2f3ecf03ce652d2b6978d401d5ede4570a6c911771bdcfb37cd41 | |

# tcId = 269 | |

# special case for E in multiplication by 4 | |

private = 384929a42c8d8df146db9508e2f21a4e8cd4d99c1b1338df17a457e88afb0043 | |

public = d570c7810f69e502b355253afa7c667bfa5060d90dc86e358ab445f6381e415d | |

result = valid | |

shared = 37567f7ec0449c7b823cf7b0e219e9dd880e56a1464d0417a9e67eff42332866 | |

# tcId = 270 | |

# special case for E in multiplication by 4 | |

private = 48a986825b2680e2f2547ba75a9599b04ed57f8ed18d98e7099c544efbdf284b | |

public = 2c611cb94448f1c7822425a4cf5356236b90a555b1ed4747820ba7f739c8f57d | |

result = valid | |

shared = fbf6587ec181116cf1ace7dcd548029d69c130e50fcf6ad5dfcd25c23ee9f939 | |

# tcId = 271 | |

# special case for B in multiplication by 4 | |

private = 98452ad7df4e26bc4b3d403f9ebf72bb2d7b6b7d5860dbf6fb9a4f78dc02704a | |

public = e559c417da7fd5851352f508b90031d49b5d2d0aac88a9c8b5fb6e80165ac10b | |

result = acceptable | |

shared = c7c6f6d7ce1e4f54c727e5900686c34e6a6953254bd470bbbf0c7c18bbddad73 | |

# Public keys are either points on a given curve or points on its twist. The | |

# functions X25519 and X448 are defined for points on a twist with the goal that | |

# the output of computations do not leak private keys. Implementations may | |

# accept or reject points on a twist. If a point multiplication is performed | |

# then it is important that the result is correct, since otherwise attacks with | |

# invalid keys are possible. | |

# tcId = 272 | |

# special case for B in multiplication by 4 | |

private = a8dbc9be5034ed7fe7f469264f2135e9c67cd30f525570d2d841e4bdeac52349 | |

public = 746d97e7774292a3d703f604e79d8764c99a6a2fe280eaa9811115f5e038f21a | |

result = acceptable | |

shared = cf7d2a66ea4dfed94469b2d343533ff302a576f8402ed2187904437038e54665 | |

# Public keys are either points on a given curve or points on its twist. The | |

# functions X25519 and X448 are defined for points on a twist with the goal that | |

# the output of computations do not leak private keys. Implementations may | |

# accept or reject points on a twist. If a point multiplication is performed | |

# then it is important that the result is correct, since otherwise attacks with | |

# invalid keys are possible. | |

# tcId = 273 | |

# special case for B in multiplication by 4 | |

private = f8d26878dff25ced02d3b27ce74002695bb879b3c4328930934315ecae842b47 | |

public = 1f354aa8ffc4eae2b40dad2ebf830db3feb07e2a1a2da39e55df87c8c613de1d | |

result = valid | |

shared = b204d3bbcbdc624f9f1a743fa3daa8f4c8785ed088d37d08cd13c601170a461b | |

# tcId = 274 | |

# special case for B in multiplication by 4 | |

private = d0f5e9c43c95b1ffc36f832b943601d5e17647f7d78e2e7710ace63ff274d447 | |

public = 9c3f0023e1a4832586af2483bbec64ce9f06f3ea806d4019a5e4abb1b5627029 | |

result = acceptable | |

shared = b9f21465615f39dddcc37520ce9b956f7de9883ac93a870d74e388b8e1775463 | |

# Public keys are either points on a given curve or points on its twist. The | |

# functions X25519 and X448 are defined for points on a twist with the goal that | |

# the output of computations do not leak private keys. Implementations may | |

# accept or reject points on a twist. If a point multiplication is performed | |

# then it is important that the result is correct, since otherwise attacks with | |

# invalid keys are possible. | |

# tcId = 275 | |

# special case for B in multiplication by 4 | |

private = 700679e8c24df828f2e5212a3263d5e93ea61679988298bab3b480f46f961a48 | |

public = d05656aa014d476022dfc55e8d3b4884ed0bdf85209be8b55351394d52be684b | |

result = valid | |

shared = 20f1fc613874495f20562c10b7a8be47bfc12c168d829d6321aa2de17060e40d | |

# tcId = 276 | |

# special case for B in multiplication by 4 | |

private = d0d077c9461f747e5660be85cc620428b4cefe805de0fd254adaa465ea5e784f | |

public = c4a19b8686e18c29359aa548427f06a368d55a8737483d4893523adac6795a4c | |

result = acceptable | |

shared = 652b18ffd41cfb7d1f0b6dc79baa3b2a392ef1617f5cf6259b5b4ff065916a16 | |

# Public keys are either points on a given curve or points on its twist. The | |

# functions X25519 and X448 are defined for points on a twist with the goal that | |

# the output of computations do not leak private keys. Implementations may | |

# accept or reject points on a twist. If a point multiplication is performed | |

# then it is important that the result is correct, since otherwise attacks with | |

# invalid keys are possible. | |

# tcId = 277 | |

# special case for B in multiplication by 4 | |

private = 00711ac08ef88c3d43a3cbda67b6fe5f34f54723dbe6d725c8a3569070ab9a4e | |

public = 4989de79853ff35be8c9f92fc94674feef38a0e65788471c521f8e259adf015d | |

result = valid | |

shared = 679825c259392d86f8edb15328d4faf52300779d979a503a76e27be3d7a85e03 | |

# tcId = 278 | |

# special case for B in multiplication by 4 | |

private = 989a75b40451139ec36ca6aa043765c61a18be323a5987fcb025c2dad8d4bd40 | |

public = a981483cb0ea4385ffbb552826c3dd110d4ae89ff52ed0cd6018f99d3387987b | |

result = valid | |

shared = 9cadc14ac153fa383ef66d1833f589100dff90523272e32b06e2c6f1f4424040 | |

# tcId = 279 | |

# special case for BB in multiplication by 4 | |

private = 90c3cfedd919a2ccd51fb455649e3ad2da1ef0ff619b59a7f9c55a68a8219645 | |

public = 1df3dfdab74ff38177dac294b2da2f49a348bc3b3bc6ce9312bea5ef3ecdd30b | |

result = acceptable | |

shared = bcc95fb4890ed311f3fb4f44c2b60866cdddec97db820a7f79f475337e16284a | |

# Public keys are either points on a given curve or points on its twist. The | |

# functions X25519 and X448 are defined for points on a twist with the goal that | |

# the output of computations do not leak private keys. Implementations may | |

# accept or reject points on a twist. If a point multiplication is performed | |

# then it is important that the result is correct, since otherwise attacks with | |

# invalid keys are possible. | |

# tcId = 280 | |

# special case for BB in multiplication by 4 | |

private = e8fef5c9b60f84984e8836d535acb372096ba8159824a0b49a17eccda843bd41 | |

public = fc6b718ba8b47d24b1cfd6b5d0dd8b20fd920960fabc302dbe4f93bd2a06e933 | |

result = valid | |

shared = 06f1b495b04a0010845c9d39b13bf2784ade860d9632c8847618c0b34297c249 | |

# tcId = 281 | |

# special case for BB in multiplication by 4 | |

private = c0e05bde7727db4e352b5e7f035327b4d86a42d513ca116e22d64a4ede56434a | |

public = b279b6c065f95c7040f148bcb4a3d310e34bdb005931a879be469573deedd041 | |

result = acceptable | |

shared = cce7bb644df94501421db49d15e821c7b0aaabecdf8837ab989b1f23bac08f35 | |

# Public keys are either points on a given curve or points on its twist. The | |

# functions X25519 and X448 are defined for points on a twist with the goal that | |

# the output of computations do not leak private keys. Implementations may | |

# accept or reject points on a twist. If a point multiplication is performed | |

# then it is important that the result is correct, since otherwise attacks with | |

# invalid keys are possible. | |

# tcId = 282 | |

# special case for BB in multiplication by 4 | |

private = d87308bf753573f596ac8330b204014b2152dbdfc9881a0d9975058582bdf646 | |

public = 98e2cd4c10554e41b0a3e41082c8b6b61b55447d26c0aa97f9a06baeeb54b55b | |

result = valid | |

shared = 71fdd3405c30805701ae4dfad98c493aecfcf2e3b563e7068373c1b19137c268 | |

# tcId = 283 | |

# special case for BB in multiplication by 4 | |

private = d80059a8a387e16f6ded6e7e980e806d1f78b470bb61103d0ca70623ccee8b4f | |

public = 872897f1bd1885da08b9d03e46811044fbb04186ba30c806f38b94ebdc27186a | |

result = acceptable | |

shared = bf280aeecb74ab34e1310aa6fe8dc972f94dc40c7f88b72137ccfe34ed343c13 | |

# Public keys are either points on a given curve or points on its twist. The | |

# functions X25519 and X448 are defined for points on a twist with the goal that | |

# the output of computations do not leak private keys. Implementations may | |

# accept or reject points on a twist. If a point multiplication is performed | |

# then it is important that the result is correct, since otherwise attacks with | |

# invalid keys are possible. | |

# tcId = 284 | |

# special case for x_2 in multiplication by 4 | |

private = b0a4fe63515169bd82639b515ff7e5c4ac85bba0a53bbaca80477eb3b4250d44 | |

public = c08f72760d9cb4a542aad6e2af777920c44563bd90356168c3608c6b9af2ef0f | |

result = acceptable | |

shared = 72566a91ccd2bcf38cf639e4a5fcb296f0b67de192c6091242a62fae467fb635 | |

# Public keys are either points on a given curve or points on its twist. The | |

# functions X25519 and X448 are defined for points on a twist with the goal that | |

# the output of computations do not leak private keys. Implementations may | |

# accept or reject points on a twist. If a point multiplication is performed | |

# then it is important that the result is correct, since otherwise attacks with | |

# invalid keys are possible. | |

# tcId = 285 | |

# special case for x_2 in multiplication by 4 | |

private = 984256b12ef154ff6c2e1d030826164cba3614e3df7688d82b59e16201c9114d | |

public = 4f03849c24d584534d74302220cfdc90e1bc360bb5e297c0fd0fd5f8d799e416 | |

result = valid | |

shared = 24acb4afa63919621df795206c3929b599ec9d253693895d51a0555072e89a34 | |

# tcId = 286 | |

# special case for x_2 in multiplication by 4 | |

private = 6847141d5d4377af96a2a647c642ee81600fe48d3467e3a70f3ee312bb621742 | |

public = 4959771a931e242d5713d5cb76f33310c6a283df16645604289553809cda6518 | |

result = acceptable | |

shared = 5ba2112a41b5bb381f202446fa9f23c54d2de149f9ad233753417263840ea432 | |

# Public keys are either points on a given curve or points on its twist. The | |

# functions X25519 and X448 are defined for points on a twist with the goal that | |

# the output of computations do not leak private keys. Implementations may | |

# accept or reject points on a twist. If a point multiplication is performed | |

# then it is important that the result is correct, since otherwise attacks with | |

# invalid keys are possible. | |

# tcId = 287 | |

# special case for x_2 in multiplication by 4 | |

private = e85f1164e2ab6faf62667c74b03ce529b49a0e2041b1ac0fa242e522d2b7694c | |

public = f6fe690cf547049635bb3a7785537b4379c9ee06b46120493b8bdb152e09c81d | |

result = acceptable | |

shared = a87c9fdf40c409b9edab481b2cc69687ee1ab92e340c3db0107d40b5de6e7a20 | |

# Public keys are either points on a given curve or points on its twist. The | |

# functions X25519 and X448 are defined for points on a twist with the goal that | |

# the output of computations do not leak private keys. Implementations may | |

# accept or reject points on a twist. If a point multiplication is performed | |

# then it is important that the result is correct, since otherwise attacks with | |

# invalid keys are possible. | |

# tcId = 288 | |

# special case for x_2 in multiplication by 4 | |

private = 281e1bbfa711de69921a64c5d2183c338db5504606ce2b6b4ce1cdd54b41e14a | |

public = b468681a1275850c11d37ec736af939a75a7098514e04cfc1c6ca78239a88426 | |

result = acceptable | |

shared = 3be98798f01e71639f3cb8fd4a17bf273e10c67f8974dd9802eed59d847d4020 | |

# Public keys are either points on a given curve or points on its twist. The | |

# functions X25519 and X448 are defined for points on a twist with the goal that | |

# the output of computations do not leak private keys. Implementations may | |

# accept or reject points on a twist. If a point multiplication is performed | |

# then it is important that the result is correct, since otherwise attacks with | |

# invalid keys are possible. | |

# tcId = 289 | |

# special case for x_2 in multiplication by 4 | |

private = 20aacf1902b3cd609d7ee15cc96453cc22e2899d7d17852680f2a728bac6dc4a | |

public = 2d71e8457099e3f445f9e2a14f18b0f5914bb35f482f9c069b64bf63710d4228 | |

result = valid | |

shared = 338c9917dbf11a0cabe8ad4a65959229bc00f99c211e752b20b8b49b87756d0b | |

# tcId = 290 | |

# special case for x_2 in multiplication by 4 | |

private = 009e8e9fa993804dce94cecb96b1de2568245a97059e4d7ae116ecdb1badd141 | |

public = fa8f24e944de5d003746d4630350c0f4f6175a3269c19184824105398fbdd329 | |

result = acceptable | |

shared = 56e2bfc7f6ab7da8fc734afc515e57d0794d002434f9bc8e18bd0b72c0df3c4a | |

# Public keys are either points on a given curve or points on its twist. The | |

# functions X25519 and X448 are defined for points on a twist with the goal that | |

# the output of computations do not leak private keys. Implementations may | |

# accept or reject points on a twist. If a point multiplication is performed | |

# then it is important that the result is correct, since otherwise attacks with | |

# invalid keys are possible. | |

# tcId = 291 | |

# special case for x_2 in multiplication by 4 | |

private = f01574643f231ffac055bd235ee74dd416b94c8e55a2ab2b4d13a8b788d90148 | |

public = ae4e37ef53c79e25e8275a60f2fc1dfc277ebc5d3b88428c6432c3f98494212c | |

result = acceptable | |

shared = 17fa1276d9fd5025172736449a1c0ae33512e5037014a18db5903e47bb3bc950 | |

# Public keys are either points on a given curve or points on its twist. The | |

# functions X25519 and X448 are defined for points on a twist with the goal that | |

# the output of computations do not leak private keys. Implementations may | |

# accept or reject points on a twist. If a point multiplication is performed | |

# then it is important that the result is correct, since otherwise attacks with | |

# invalid keys are possible. | |

# tcId = 292 | |

# special case for x_2 in multiplication by 4 | |

private = 3800a42659954281ca266d7cf1ea9db6d79891a406a70f9e84c3570a6a12d24e | |

public = 95e56a830792478f7c42504043a9cab8e2eebff5fd90983709e29e03c0a41b64 | |

result = valid | |

shared = 167a3b2fdce9413c89ee892daf9f839a2eea80ea8044924035db1724a5b0217c | |

# tcId = 293 | |

# special case for x_2 in multiplication by 4 | |

private = 70a826b186962218dbafca113319daefb5ddf3cf14e15fe3faadc4c0a2e46648 | |

public = 5f16aa7ccabf4da6b686bd28c7460e106bb1b97a823792527765c29a9ad8fc71 | |

result = acceptable | |

shared = 30a4ba793f2dffe1700c61428b4d84b5fcd0aa99a23b903f84a48eca5cc9fb0a | |

# Public keys are either points on a given curve or points on its twist. The | |

# functions X25519 and X448 are defined for points on a twist with the goal that | |

# the output of computations do not leak private keys. Implementations may | |

# accept or reject points on a twist. If a point multiplication is performed | |

# then it is important that the result is correct, since otherwise attacks with | |

# invalid keys are possible. | |

# tcId = 294 | |

# special case for DA + CB in multiplication by 4 | |

private = a85a5eda0a269500b3ab0b58495fc254c2691028ac533494b5f86d44e9dc654c | |

public = 47fb78111805a11982a3d6c5d83e8e189e7fcc462c9abf805d3625be7a6eac11 | |

result = valid | |

shared = 2bf9ab750bd58ff6f877b783eda45a71a65cc9b7c037fcfef4cb5f4c8842f529 | |

# tcId = 295 | |

# special case for DA + CB in multiplication by 4 | |

private = 183f28ec867624ef5eca4827ed0714a5525ef21d5e35038b24d307a3391a2846 | |

public = 03b8ca5efd1777d6d625a945db52b81f11214daf015d09fdc9df7d47b9850e31 | |

result = valid | |

shared = 35e9289234bd5e531da65d161a065a14f785076088d741c9a2d886efd7d17921 | |

# tcId = 296 | |

# special case for DA + CB in multiplication by 4 | |

private = 888c6444ff5eb482b2b10bd4e8a01bdccb65f32934d8026106f16a91349f484c | |

public = 4eca5f8731b0fa0c106acf578b83a350fa8173a290f1eba803956de34eeb7671 | |

result = acceptable | |

shared = 833afb867054b8b9ac70d6013c163e8b7676fd45ae49a1325f3acb75975d8c13 | |

# Public keys are either points on a given curve or points on its twist. The | |

# functions X25519 and X448 are defined for points on a twist with the goal that | |

# the output of computations do not leak private keys. Implementations may | |

# accept or reject points on a twist. If a point multiplication is performed | |

# then it is important that the result is correct, since otherwise attacks with | |

# invalid keys are possible. | |

# tcId = 297 | |

# special case for A in multiplication by 4 | |

private = c8a85d140ba150f5c6a8d3cb363bcbcb75365e51c61640e974a0725b5e9d5940 | |

public = a5562b4ba86b464dff4c2cfae85b384be211771efe8a9697e51d84de47f1eb14 | |

result = valid | |

shared = 8a914760129575c8ab3270d04b0465fc2f327acaf1676463113803bbb2ec8021 | |

# tcId = 298 | |

# special case for A in multiplication by 4 | |

private = 90a3aeb1417c3d61c1efef1ac052218fb55d3a59c4fe930b5a33cc5183b48547 | |

public = 88ae1631cd08ab54c24a31e1fec860391fe29bc50db23eb66709362ec4264929 | |

result = acceptable | |

shared = c1988b6e1f020151ec913b4fb2695bae2c21cc553d0f91cf0c668623a3e5a43d | |

# Public keys are either points on a given curve or points on its twist. The | |

# functions X25519 and X448 are defined for points on a twist with the goal that | |

# the output of computations do not leak private keys. Implementations may | |

# accept or reject points on a twist. If a point multiplication is performed | |

# then it is important that the result is correct, since otherwise attacks with | |

# invalid keys are possible. | |

# tcId = 299 | |

# special case for A in multiplication by 4 | |

private = b858d7414bd9ab9a3ebea79064ab87bc050e74407f4d4748f62fa4d9d203b640 | |

public = cbc4d55d5bfddd0bc5c5edbe3a04836b2c701d25195b26221cbea19311e55a3d | |

result = valid | |

shared = bb24817bd9fff423dc0972908e2c03fddf4dbe100016b459f28fe9594adb3714 | |

# tcId = 300 | |

# special case for A in multiplication by 4 | |

private = f825edf1f79eddd715a72b3ac267d6b2e97e18bb13bcafdac5940370b85ba64b | |

public = d66a2f9f7577e2df4a56cb51962b3056ff5cc0494c60f39511782e79923edd41 | |

result = acceptable | |

shared = b3b4513f8a3102e1ae782fbc69888177f2c24c569303a5d01ab1c3c5e285524a | |

# Public keys are either points on a given curve or points on its twist. The | |

# functions X25519 and X448 are defined for points on a twist with the goal that | |

# the output of computations do not leak private keys. Implementations may | |

# accept or reject points on a twist. If a point multiplication is performed | |

# then it is important that the result is correct, since otherwise attacks with | |

# invalid keys are possible. | |

# tcId = 301 | |

# special case for DA - CB in multiplication by 4 | |

private = b0a710b470e324bb56a7d8ff8788d05eb327616129b84972482425ea4ad4f34b | |

public = de0fed2fab6e01492675bc75cbe45d7b45b0306cec8dc67611699811c9aaef16 | |

result = valid | |

shared = 471ba91a99634f9acf34fd7fd58f72682be97ee1c821486d62ba4e448cbc0417 | |

# tcId = 302 | |

# special case for DA - CB in multiplication by 4 | |

private = b898f0329794747d33269a3989b67e43a7ab5a55fa1210b0e5dba193f4fa094e | |

public = 6418d49fe440a755c9ff1a3582d35dc9b44c818498f15782c95284fe868a914c | |

result = acceptable | |

shared = cdb3ca02d5fdb536dbc7395bab12bdcfd55b1ae771a4176dedb55eb4d755c752 | |

# Public keys are either points on a given curve or points on its twist. The | |

# functions X25519 and X448 are defined for points on a twist with the goal that | |

# the output of computations do not leak private keys. Implementations may | |

# accept or reject points on a twist. If a point multiplication is performed | |

# then it is important that the result is correct, since otherwise attacks with | |

# invalid keys are possible. | |

# tcId = 303 | |

# special case for DA - CB in multiplication by 4 | |

private = a0528ed9a8ec22ebe9cc2e32fafc3f467500a9a22f5377382df6604edcdf4f44 | |

public = a89bcfa236bbccf07c434b59f8655fb085b6cbe5ed6376281df813afba22b752 | |

result = valid | |

shared = cd3245403fd9edfcf91c9581ebb2eb7c77ad6837fca372479e78de9faf60a34a | |

# tcId = 304 | |

# special case for DA - CB in multiplication by 4 | |

private = f06888bde75d689d056874f6436000497d22d8ad9b95a1c67de1dda4ada3164d | |

public = cdb1f95f6eacc24b6d029c6ed976666dc51794db8e4aa966ba850fd7f5048965 | |

result = valid | |

shared = ab7c47ecb0c0167156f44f66a527264b958fc992c21ce98cef3ae214d66bd82d | |

# tcId = 305 | |

# special case for DA - CB in multiplication by 4 | |

private = e034fcaa3ae40603f9b22af159fd67ef009380946de92cb1d83cc489e8b35041 | |

public = 9491a82744f1cb6105b76b0442e54e605ac67f47a1b2b3b552d486f75bd98e6a | |

result = valid | |

shared = 1bfa264a7c7229147a20dd021211891e61f5d8c76cd83f0be24bc70e466a815b | |

# tcId = 306 | |

# special case for C in multiplication by 4 | |

private = 702a7448c0ed58e1f4e0e332d096a36360beca2f6955c815bc120b3a691d7742 | |

public = 4d19e156e084fe582a0eb79b2f12b61d0b03f3f229227e798a933eea5a1b6129 | |

result = acceptable | |

shared = c46057fcf63088b3a80e0be5ce24c8026dfadd341b5d8215b8afcb2a5a02bb2b | |

# Public keys are either points on a given curve or points on its twist. The | |

# functions X25519 and X448 are defined for points on a twist with the goal that | |

# the output of computations do not leak private keys. Implementations may | |

# accept or reject points on a twist. If a point multiplication is performed | |

# then it is important that the result is correct, since otherwise attacks with | |

# invalid keys are possible. | |

# tcId = 307 | |

# special case for C in multiplication by 4 | |

private = 50025cb508ad4faa06fafd0f4a33b747ccf1b3573885d3426500d51b56300144 | |

public = cc4729c4eae292e431ec3a5cf5020e19f9bea50ef3218d9a790034526c3ee14a | |

result = acceptable | |

shared = d4361e26127adfbe37c2ed8f42cce4ebab8ab74ed9e74f14c3435d612c1a992a | |