blob: 11eab81967c0ccc5d22f9c337c952a8a10410f71 [file] [log] [blame]
# Imported from Wycheproof's x25519_test.json.
# This file is generated by convert_wycheproof.go. Do not edit by hand.
#
# Algorithm: XDH
# Generator version: 0.8r12
[curve = curve25519]
# tcId = 1
# normal case
private = c8a9d5a91091ad851c668b0736c1c9a02936c0d3ad62670858088047ba057475
public = 504a36999f489cd2fdbc08baff3d88fa00569ba986cba22548ffde80f9806829
result = valid
shared = 436a2c040cf45fea9b29a0cb81b1f41458f863d0d61b453d0a982720d6d61320
# tcId = 2
# public key on twist
private = d85d8c061a50804ac488ad774ac716c3f5ba714b2712e048491379a500211958
public = 63aa40c6e38346c5caf23a6df0a5e6c80889a08647e551b3563449befcfc9733
result = acceptable
shared = 279df67a7c4611db4708a0e8282b195e5ac0ed6f4b2f292c6fbd0acac30d1332
# Public keys are either points on a given curve or points on its twist. The
# functions X25519 and X448 are defined for points on a twist with the goal that
# the output of computations do not leak private keys. Implementations may
# accept or reject points on a twist. If a point multiplication is performed
# then it is important that the result is correct, since otherwise attacks with
# invalid keys are possible.
# tcId = 3
# public key on twist
private = c8b45bfd32e55325d9fd648cb302848039000b390e44d521e58aab3b29a6964b
public = 0f83c36fded9d32fadf4efa3ae93a90bb5cfa66893bc412c43fa7287dbb99779
result = acceptable
shared = 4bc7e01e7d83d6cf67632bf90033487a5fc29eba5328890ea7b1026d23b9a45f
# Public keys are either points on a given curve or points on its twist. The
# functions X25519 and X448 are defined for points on a twist with the goal that
# the output of computations do not leak private keys. Implementations may
# accept or reject points on a twist. If a point multiplication is performed
# then it is important that the result is correct, since otherwise attacks with
# invalid keys are possible.
# tcId = 4
# public key on twist
private = f876e34bcbe1f47fbc0fddfd7c1e1aa53d57bfe0f66d243067b424bb6210be51
public = 0b8211a2b6049097f6871c6c052d3c5fc1ba17da9e32ae458403b05bb283092a
result = acceptable
shared = 119d37ed4b109cbd6418b1f28dea83c836c844715cdf98a3a8c362191debd514
# Public keys are either points on a given curve or points on its twist. The
# functions X25519 and X448 are defined for points on a twist with the goal that
# the output of computations do not leak private keys. Implementations may
# accept or reject points on a twist. If a point multiplication is performed
# then it is important that the result is correct, since otherwise attacks with
# invalid keys are possible.
# tcId = 5
# public key on twist
private = 006ac1f3a653a4cdb1d37bba94738f8b957a57beb24d646e994dc29a276aad45
public = 343ac20a3b9c6a27b1008176509ad30735856ec1c8d8fcae13912d08d152f46c
result = acceptable
shared = cc4873aed3fcee4b3aaea7f0d20716b4276359081f634b7bea4b705bfc8a4d3e
# Public keys are either points on a given curve or points on its twist. The
# functions X25519 and X448 are defined for points on a twist with the goal that
# the output of computations do not leak private keys. Implementations may
# accept or reject points on a twist. If a point multiplication is performed
# then it is important that the result is correct, since otherwise attacks with
# invalid keys are possible.
# tcId = 6
# public key on twist
private = 08da77b26d06dff9d9f7fd4c5b3769f8cdd5b30516a5ab806be324ff3eb69e60
public = fa695fc7be8d1be5bf704898f388c452bafdd3b8eae805f8681a8d15c2d4e142
result = acceptable
shared = b6f8e2fcb1affc79e2ff798319b2701139b95ad6dd07f05cbac78bd83edfd92e
# Public keys are either points on a given curve or points on its twist. The
# functions X25519 and X448 are defined for points on a twist with the goal that
# the output of computations do not leak private keys. Implementations may
# accept or reject points on a twist. If a point multiplication is performed
# then it is important that the result is correct, since otherwise attacks with
# invalid keys are possible.
# tcId = 7
# public key on twist
private = d03edde9f3e7b799045f9ac3793d4a9277dadeadc41bec0290f81f744f73775f
public = 0200000000000000000000000000000000000000000000000000000000000000
result = acceptable
shared = b87a1722cc6c1e2feecb54e97abd5a22acc27616f78f6e315fd2b73d9f221e57
# Public keys are either points on a given curve or points on its twist. The
# functions X25519 and X448 are defined for points on a twist with the goal that
# the output of computations do not leak private keys. Implementations may
# accept or reject points on a twist. If a point multiplication is performed
# then it is important that the result is correct, since otherwise attacks with
# invalid keys are possible.
# tcId = 8
# public key on twist
private = e09d57a914e3c29036fd9a442ba526b5cdcdf28216153e636c10677acab6bd6a
public = 0300000000000000000000000000000000000000000000000000000000000000
result = acceptable
shared = a29d8dad28d590cd3017aa97a4761f851bf1d3672b042a4256a45881e2ad9035
# Public keys are either points on a given curve or points on its twist. The
# functions X25519 and X448 are defined for points on a twist with the goal that
# the output of computations do not leak private keys. Implementations may
# accept or reject points on a twist. If a point multiplication is performed
# then it is important that the result is correct, since otherwise attacks with
# invalid keys are possible.
# tcId = 9
# public key on twist
private = e0ed78e6ee02f08bec1c15d66fbbe5b83ffc37ea14e1512cc1bd4b2ea6d8066f
public = ff00000000000000000000000000000000000000000000000000000000000000
result = acceptable
shared = e703bc8aa94b7d87ba34e2678353d12cdaaa1a97b5ca3e1b8c060c4636087f07
# Public keys are either points on a given curve or points on its twist. The
# functions X25519 and X448 are defined for points on a twist with the goal that
# the output of computations do not leak private keys. Implementations may
# accept or reject points on a twist. If a point multiplication is performed
# then it is important that the result is correct, since otherwise attacks with
# invalid keys are possible.
# tcId = 10
# public key on twist
private = a8a1a2ec9fa9915ae7aace6a37c68591d39e15995c4ef5ebd3561c02f72dda41
public = ffff000000000000000000000000000000000000000000000000000000000000
result = acceptable
shared = ff5cf041e924dbe1a64ac9bdba96bdcdfaf7d59d91c7e33e76ed0e4c8c836446
# Public keys are either points on a given curve or points on its twist. The
# functions X25519 and X448 are defined for points on a twist with the goal that
# the output of computations do not leak private keys. Implementations may
# accept or reject points on a twist. If a point multiplication is performed
# then it is important that the result is correct, since otherwise attacks with
# invalid keys are possible.
# tcId = 11
# public key on twist
private = a8c9df5820eb399d471dfa3215d96055b3c7d0f4ea49f8ab028d6a6e3194517b
public = 0000010000000000000000000000000000000000000000000000000000000000
result = acceptable
shared = a92a96fa029960f9530e6fe37e2429cd113be4d8f3f4431f8546e6c76351475d
# Public keys are either points on a given curve or points on its twist. The
# functions X25519 and X448 are defined for points on a twist with the goal that
# the output of computations do not leak private keys. Implementations may
# accept or reject points on a twist. If a point multiplication is performed
# then it is important that the result is correct, since otherwise attacks with
# invalid keys are possible.
# tcId = 12
# public key on twist
private = d0d31c491cbd39271859b4a63a316826507b1db8c701709fd0ffe3eb21c4467c
public = ffffff0f00000000000000000000000000000000000000000000000000000000
result = acceptable
shared = 9f8954868158ec62b6b586b8cae1d67d1b9f4c03d5b3ca0393cee71accc9ab65
# Public keys are either points on a given curve or points on its twist. The
# functions X25519 and X448 are defined for points on a twist with the goal that
# the output of computations do not leak private keys. Implementations may
# accept or reject points on a twist. If a point multiplication is performed
# then it is important that the result is correct, since otherwise attacks with
# invalid keys are possible.
# tcId = 13
# public key on twist
private = d053e7bf1902619cd61c9c739e09d54c4147f46d190720966f7de1d9cffbbd4e
public = ffffffff00000000000000000000000000000000000000000000000000000000
result = acceptable
shared = 6cbf1dc9af97bc148513a18be4a257de1a3b065584df94e8b43c1ab89720b110
# Public keys are either points on a given curve or points on its twist. The
# functions X25519 and X448 are defined for points on a twist with the goal that
# the output of computations do not leak private keys. Implementations may
# accept or reject points on a twist. If a point multiplication is performed
# then it is important that the result is correct, since otherwise attacks with
# invalid keys are possible.
# tcId = 14
# public key on twist
private = a021d75009a4596e5a33f12921c10f3670933bc80dde3bba22881b6120582144
public = 0000000000001000000000000000000000000000000000000000000000000000
result = acceptable
shared = 38284b7086095a9406028c1f800c071ea106039ad7a1d7f82fe00906fd90594b
# Public keys are either points on a given curve or points on its twist. The
# functions X25519 and X448 are defined for points on a twist with the goal that
# the output of computations do not leak private keys. Implementations may
# accept or reject points on a twist. If a point multiplication is performed
# then it is important that the result is correct, since otherwise attacks with
# invalid keys are possible.
# tcId = 15
# public key on twist
private = a89c6687f99bd569a01fd8bd438236160d15ce2c57c1d71ebaa3f2da88233863
public = 0000000000000001000000000000000000000000000000000000000000000000
result = acceptable
shared = c721041df0244071794a8db06b9f7eaeec690c257265343666f4416f4166840f
# Public keys are either points on a given curve or points on its twist. The
# functions X25519 and X448 are defined for points on a twist with the goal that
# the output of computations do not leak private keys. Implementations may
# accept or reject points on a twist. If a point multiplication is performed
# then it is important that the result is correct, since otherwise attacks with
# invalid keys are possible.
# tcId = 16
# public key on twist
private = 68964bca51465bf0f5ba524b1482ceff0e960a1ed9f48dcc30f1608d0e501a50
public = ffffffffffffffff000000000000000000000000000000000000000000000000
result = acceptable
shared = 25ff9a6631b143dbdbdc207b38e38f832ae079a52a618c534322e77345fd9049
# Public keys are either points on a given curve or points on its twist. The
# functions X25519 and X448 are defined for points on a twist with the goal that
# the output of computations do not leak private keys. Implementations may
# accept or reject points on a twist. If a point multiplication is performed
# then it is important that the result is correct, since otherwise attacks with
# invalid keys are possible.
# tcId = 17
# public key on twist
private = a8e56bb13a9f2b33b8e6750b4a6e6621dc26ae8c5c624a0992c8f0d5b910f170
public = 0000000000000000000000000000000000000000000000000100000000000000
result = acceptable
shared = f294e7922c6cea587aefe72911630d50f2456a2ba7f21207d57f1ecce04f6213
# Public keys are either points on a given curve or points on its twist. The
# functions X25519 and X448 are defined for points on a twist with the goal that
# the output of computations do not leak private keys. Implementations may
# accept or reject points on a twist. If a point multiplication is performed
# then it is important that the result is correct, since otherwise attacks with
# invalid keys are possible.
# tcId = 18
# public key on twist
private = e045f55c159451e97814d747050fd7769bd478434a01876a56e553f66384a74c
public = ffffffffffffffffffffffffffffffffffffffffffffffffffffffff00000000
result = acceptable
shared = ff4715bd8cf847b77c244ce2d9b008b19efaa8e845feb85ce4889b5b2c6a4b4d
# Public keys are either points on a given curve or points on its twist. The
# functions X25519 and X448 are defined for points on a twist with the goal that
# the output of computations do not leak private keys. Implementations may
# accept or reject points on a twist. If a point multiplication is performed
# then it is important that the result is correct, since otherwise attacks with
# invalid keys are possible.
# tcId = 19
# public key on twist
private = 105d621e1ef339c3d99245cfb77cd3a5bd0c4427a0e4d8752c3b51f045889b4f
public = ffffff030000f8ffff1f0000c0ffffff000000feffff070000f0ffff3f000000
result = acceptable
shared = 61eace52da5f5ecefafa4f199b077ff64f2e3d2a6ece6f8ec0497826b212ef5f
# Public keys are either points on a given curve or points on its twist. The
# functions X25519 and X448 are defined for points on a twist with the goal that
# the output of computations do not leak private keys. Implementations may
# accept or reject points on a twist. If a point multiplication is performed
# then it is important that the result is correct, since otherwise attacks with
# invalid keys are possible.
# tcId = 20
# public key on twist
private = d88a441e706f606ae7f630f8b21f3c2554739e3e549f804118c03771f608017b
public = ffffffffffffffffffffffffffffffffffffffffffffffffffffffffff7f0000
result = acceptable
shared = ff1b509a0a1a54726086f1e1c0acf040ab463a2a542e5d54e92c6df8126cf636
# Public keys are either points on a given curve or points on its twist. The
# functions X25519 and X448 are defined for points on a twist with the goal that
# the output of computations do not leak private keys. Implementations may
# accept or reject points on a twist. If a point multiplication is performed
# then it is important that the result is correct, since otherwise attacks with
# invalid keys are possible.
# tcId = 21
# public key on twist
private = 80bbad168222276200aafd36f7f25fdc025632d8bf9f6354bb762e06fb63e250
public = 0000000000000000000000000000000000000000000000000000000000800000
result = acceptable
shared = f134e6267bf93903085117b99932cc0c7ba26f25fca12102a26d7533d9c4272a
# Public keys are either points on a given curve or points on its twist. The
# functions X25519 and X448 are defined for points on a twist with the goal that
# the output of computations do not leak private keys. Implementations may
# accept or reject points on a twist. If a point multiplication is performed
# then it is important that the result is correct, since otherwise attacks with
# invalid keys are possible.
# tcId = 22
# public key on twist
private = 68e134092e94e622c8a0cd18aff55be23dabd994ebdee982d90601f6f0f4b369
public = ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff1f
result = acceptable
shared = 74bfc15e5597e9f5193f941e10a5c008fc89f051392723886a4a8fe5093a7354
# Public keys are either points on a given curve or points on its twist. The
# functions X25519 and X448 are defined for points on a twist with the goal that
# the output of computations do not leak private keys. Implementations may
# accept or reject points on a twist. If a point multiplication is performed
# then it is important that the result is correct, since otherwise attacks with
# invalid keys are possible.
# tcId = 23
# public key on twist
private = e8e43fc1ebac0bbc9b99c8035ee1ac59b90f19a16c42c0b90f96adfcc5fdee78
public = 0000000000000000000000000000000000000000000000000000000000000020
result = acceptable
shared = 0d41a5b3af770bf2fcd34ff7972243a0e2cf4d34f2046a144581ae1ec68df03b
# Public keys are either points on a given curve or points on its twist. The
# functions X25519 and X448 are defined for points on a twist with the goal that
# the output of computations do not leak private keys. Implementations may
# accept or reject points on a twist. If a point multiplication is performed
# then it is important that the result is correct, since otherwise attacks with
# invalid keys are possible.
# tcId = 24
# public key on twist
private = 18bffb16f92680a9e267473e43c464476d5372ddd1f664f3d0678efe7c98bc79
public = 000000fcffff070000e0ffff3f000000ffffff010000f8ffff0f0000c0ffff7f
result = acceptable
shared = 5894e0963583ae14a0b80420894167f4b759c8d2eb9b69cb675543f66510f646
# Public keys are either points on a given curve or points on its twist. The
# functions X25519 and X448 are defined for points on a twist with the goal that
# the output of computations do not leak private keys. Implementations may
# accept or reject points on a twist. If a point multiplication is performed
# then it is important that the result is correct, since otherwise attacks with
# invalid keys are possible.
# tcId = 25
# public key on twist
private = 300305eb002bf86c71fe9c0b311993727b9dc618d0ce7251d0dfd8552d17905d
public = ffffffffffffff00000000000000ffffffffffffff00000000000000ffffff7f
result = acceptable
shared = f8624d6e35e6c548ac47832f2e5d151a8e53b9290363b28d2ab8d84ab7cb6a72
# Public keys are either points on a given curve or points on its twist. The
# functions X25519 and X448 are defined for points on a twist with the goal that
# the output of computations do not leak private keys. Implementations may
# accept or reject points on a twist. If a point multiplication is performed
# then it is important that the result is correct, since otherwise attacks with
# invalid keys are possible.
# tcId = 26
# public key on twist
private = 80da9f02842247d4ade5ddbac51dbce55ea7dca2844e7f97ab8987ce7fd8bc71
public = 00000000ffffffff00000000ffffffff00000000ffffffff00000000ffffff7f
result = acceptable
shared = bfe183ba3d4157a7b53ef178613db619e27800f85359c0b39a9fd6e32152c208
# Public keys are either points on a given curve or points on its twist. The
# functions X25519 and X448 are defined for points on a twist with the goal that
# the output of computations do not leak private keys. Implementations may
# accept or reject points on a twist. If a point multiplication is performed
# then it is important that the result is correct, since otherwise attacks with
# invalid keys are possible.
# tcId = 27
# public key on twist
private = 806e7f26ca3246de8182946cbed09f52b95da626c823c7b50450001a47b7b252
public = edfffffffffffffffffffffffffffeffffffffffffffffffffffffffffffff7f
result = acceptable
shared = bca4a0724f5c1feb184078448c898c8620e7caf81f64cca746f557dff2498859
# Public keys are either points on a given curve or points on its twist. The
# functions X25519 and X448 are defined for points on a twist with the goal that
# the output of computations do not leak private keys. Implementations may
# accept or reject points on a twist. If a point multiplication is performed
# then it is important that the result is correct, since otherwise attacks with
# invalid keys are possible.
# tcId = 28
# public key on twist
private = 58354fd64bc022cba3a71b2ae64281e4ea7bf6d65fdbaead1440eeb18604fe62
public = edfffffffffffffeffffffffffffffffffffffffffffffffffffffffffffff7f
result = acceptable
shared = b3418a52464c15ab0cacbbd43887a1199206d59229ced49202300638d7a40f04
# Public keys are either points on a given curve or points on its twist. The
# functions X25519 and X448 are defined for points on a twist with the goal that
# the output of computations do not leak private keys. Implementations may
# accept or reject points on a twist. If a point multiplication is performed
# then it is important that the result is correct, since otherwise attacks with
# invalid keys are possible.
# tcId = 29
# public key on twist
private = f0019cf05159794cc8052b00c2e75b7f46fb6693c4b38c02b12a4fe272e8556a
public = edffffffffffefffffffffffffffffffffffffffffffffffffffffffffffff7f
result = acceptable
shared = fcde6e0a3d5fd5b63f10c2d3aad4efa05196f26bc0cb26fd6d9d3bd015eaa74f
# Public keys are either points on a given curve or points on its twist. The
# functions X25519 and X448 are defined for points on a twist with the goal that
# the output of computations do not leak private keys. Implementations may
# accept or reject points on a twist. If a point multiplication is performed
# then it is important that the result is correct, since otherwise attacks with
# invalid keys are possible.
# tcId = 30
# public key on twist
private = d0fca64cc5f3a0c8e75c824e8b09d1615aa79aeba139bb7302e2bb2fcbe54b40
public = edfeffffffffffffffffffffffffffffffffffffffffffffffffffffffffff7f
result = acceptable
shared = 7d62f189444c6231a48afab10a0af2eee4a52e431ea05ff781d616af2114672f
# Public keys are either points on a given curve or points on its twist. The
# functions X25519 and X448 are defined for points on a twist with the goal that
# the output of computations do not leak private keys. Implementations may
# accept or reject points on a twist. If a point multiplication is performed
# then it is important that the result is correct, since otherwise attacks with
# invalid keys are possible.
# tcId = 31
# public key on twist
private = d02456e456911d3c6cd054933199807732dfdc958642ad1aebe900c793bef24a
public = eaffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff7f
result = acceptable
shared = 07ba5fcbda21a9a17845c401492b10e6de0a168d5c94b606694c11bac39bea41
# Public keys are either points on a given curve or points on its twist. The
# functions X25519 and X448 are defined for points on a twist with the goal that
# the output of computations do not leak private keys. Implementations may
# accept or reject points on a twist. If a point multiplication is performed
# then it is important that the result is correct, since otherwise attacks with
# invalid keys are possible.
# tcId = 32
# public key = 0
private = 88227494038f2bb811d47805bcdf04a2ac585ada7f2f23389bfd4658f9ddd45e
public = 0000000000000000000000000000000000000000000000000000000000000000
result = acceptable
shared = 0000000000000000000000000000000000000000000000000000000000000000
# The public key is insecure and does not belong to a valid private key. Some
# libraries reject such keys.
# The curves and its twists contain some points of low order. This test vector
# contains a public key with such a point. While many libraries reject such
# public keys, doing so is not a strict requirement according to RFC 7748.
# Some libraries include a check that the shared secret is not all-zero. This
# check is described in Section 6.1 of RFC 7748.
# tcId = 33
# public key = 1
private = 48232e8972b61c7e61930eb9450b5070eae1c670475685541f0476217e48184f
public = 0100000000000000000000000000000000000000000000000000000000000000
result = acceptable
shared = 0000000000000000000000000000000000000000000000000000000000000000
# The public key is insecure and does not belong to a valid private key. Some
# libraries reject such keys.
# The curves and its twists contain some points of low order. This test vector
# contains a public key with such a point. While many libraries reject such
# public keys, doing so is not a strict requirement according to RFC 7748.
# Some libraries include a check that the shared secret is not all-zero. This
# check is described in Section 6.1 of RFC 7748.
# tcId = 34
# edge case public key
private = a8386f7f16c50731d64f82e6a170b142a4e34f31fd7768fcb8902925e7d1e25a
public = 0400000000000000000000000000000000000000000000000000000000000000
result = valid
shared = 34b7e4fa53264420d9f943d15513902342b386b172a0b0b7c8b8f2dd3d669f59
# tcId = 35
# edge case public key
private = d05abd08bf5e62538cb9a5ed105dbedd6de38d07940085072b4311c2678ed77d
public = 0001000000000000000000000000000000000000000000000000000000000000
result = valid
shared = 3aa227a30781ed746bd4b3365e5f61461b844d09410c70570abd0d75574dfc77
# tcId = 36
# edge case public key
private = f0b8b0998c8394364d7dcb25a3885e571374f91615275440db0645ee7c0a6f6b
public = 0000001000000000000000000000000000000000000000000000000000000000
result = valid
shared = 97755e7e775789184e176847ffbc2f8ef98799d46a709c6a1c0ffd29081d7039
# tcId = 37
# edge case public key
private = d00c35dc17460f360bfae7b94647bc4e9a7ad9ce82abeadb50a2f1a0736e2175
public = 0000000001000000000000000000000000000000000000000000000000000000
result = valid
shared = c212bfceb91f8588d46cd94684c2c9ee0734087796dc0a9f3404ff534012123d
# tcId = 38
# edge case public key
private = 385fc8058900a85021dd92425d2fb39a62d4e23aef1d5104c4c2d88712d39e4d
public = ffffffffffff0f00000000000000000000000000000000000000000000000000
result = valid
shared = 388faffb4a85d06702ba3e479c6b216a8f33efce0542979bf129d860f93b9f02
# tcId = 39
# edge case public key
private = e0614b0c408af24d9d24c0a72f9137fbd6b16f02ccc94797ea3971ab16073a7f
public = ffffffffffffff00000000000000000000000000000000000000000000000000
result = valid
shared = 877fec0669d8c1a5c866641420eea9f6bd1dfd38d36a5d55a8c0ab2bf3105c68
# tcId = 40
# edge case public key
private = f004b8fd05d9fffd853cdc6d2266389b737e8dfc296ad00b5a69b2a9dcf72956
public = 0000000000000000010000000000000000000000000000000000000000000000
result = valid
shared = 180373ea0f23ea73447e5a90398a97d490b541c69320719d7dd733fb80d5480f
# tcId = 41
# edge case public key
private = e80bf0e609bf3b035b552f9db7e9ecbc44a04b7910b1493661a524f46c3c2277
public = ffffffffffffffffffffffffffff000000000000000000000000000000000000
result = valid
shared = 208142350af938aba52a156dce19d3c27ab1628729683cf4ef2667c3dc60cf38
# tcId = 42
# edge case public key
private = 48890e95d1b03e603bcb51fdf6f296f1f1d10f5df10e00b8a25c9809f9aa1a54
public = 0000000000000000000000000000010000000000000000000000000000000000
result = valid
shared = 1c3263890f7a081cefe50cb92abd496582d90dcc2b9cb858bd286854aa6b0a7e
# tcId = 43
# edge case public key
private = a806f1e39b742615a7dde3b29415ed827c68f07d4a47a4d9595c40c7fccb9263
public = ffffffffffffffffffffffffffffffff00000000000000000000000000000000
result = valid
shared = 56128e78d7c66f48e863e7e6f2caa9c0988fd439deac11d4aac9664083087f7a
# tcId = 44
# edge case public key
private = 9899d5e265e1fc7c32345227d6699a6d6b5517cf33b43ab156ee20df4878794e
public = 0000000000000000000000000000000001000000000000000000000000000000
result = valid
shared = 30eca56f1f1c2e8ff780134e0e9382c5927d305d86b53477e9aeca79fc9ced05
# tcId = 45
# edge case public key
private = d842316e5476aeaee838204258a06f15de011ba40b9962705e7f6e889fe71f40
public = ffffffffffffffffffffffffffffffffffffffffffffffff0000000000000000
result = valid
shared = cb21b7aa3f992ecfc92954849154b3af6b96a01f17bf21c612da748db38eb364
# tcId = 46
# edge case public key
private = a0933ee30512b25ee4e900aaa07f73e507a8ec53b53a44626e0f589af4e0356c
public = ffffffff00000000ffffffff00000000ffffffff00000000ffffffff00000000
result = valid
shared = c5caf8cabc36f086deaf1ab226434098c222abdf8acd3ce75c75e9debb271524
# tcId = 47
# edge case public key
private = 38d6403e1377734cdce98285e820f256ad6b769d6b5612bcf42cf2b97945c073
public = 0000000000000000000000000000000000000000000000000000000001000000
result = valid
shared = 4d46052c7eabba215df8d91327e0c4610421d2d9129b1486d914c766cf104c27
# tcId = 48
# edge case public key
private = 182191b7052e9cd630ef08007fc6b43bc7652913be6774e2fd271b71b962a641
public = ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff03
result = valid
shared = a0e0315175788362d4ebe05e6ac76d52d40187bd687492af05abc7ba7c70197d
# tcId = 49
# edge case public key
private = 106221fe5694a710d6e147696c5d5b93d6887d584f24f228182ebe1b1d2db85d
public = ffffff0f000000ffffff0f000000ffffff0f000000ffffff0f000000ffffff0f
result = valid
shared = 5e64924b91873b499a5402fa64337c65d4b2ed54beeb3fa5d7347809e43aef1c
# tcId = 50
# edge case public key
private = d035de9456080d85a912083b2e3c7ddd7971f786f25a96c5e782cf6f4376e362
public = 000000fcffff030000e0ffff1f000000ffffff000000f8ffff070000c0ffff3f
result = valid
shared = c052466f9712d9ec4ef40f276bb7e6441c5434a83efd8e41d20ce83f2dbf5952
# tcId = 51
# edge case public key
private = a8f37318a4c760f3cb2d894822918735683cb1edacf3e666e15694154978fd6d
public = ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff3f
result = valid
shared = d151b97cba9c25d48e6d576338b97d53dd8b25e84f65f7a2091a17016317c553
# tcId = 52
# edge case public key
private = 20d4d624cf732f826f09e8088017742f13f2da98f4dcf4b40519adb790cebf64
public = edffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff5f
result = valid
shared = 5716296baf2b1a6b9cd15b23ba86829743d60b0396569be1d5b40014c06b477d
# tcId = 53
# edge case public key
private = d806a735d138efb3b404683c9d84485ab4af540d0af253b574323d8913003c66
public = edffffffffffffffffffffffffffffffffffffffffffffffffffffffff7fff7f
result = valid
shared = ddbd56d0454b794c1d1d4923f023a51f6f34ef3f4868e3d6659307c683c74126
# tcId = 54
# edge case public key
private = 184198c6228177f3ef41dc9a341258f8181ae365fe9ec98d93639b0bbee1467d
public = fffffffffeffff7ffffffffffeffff7ffffffffffeffff7ffffffffffeffff7f
result = valid
shared = 8039eebed1a4f3b811ea92102a6267d4da412370f3f0d6b70f1faaa2e8d5236d
# tcId = 55
# edge case public key
private = f0a46a7f4b989fe515edc441109346ba746ec1516896ec5b7e4f4d903064b463
public = edfffffffffffffffffffffffffffffffffffffffffffffffffffffffeffff7f
result = valid
shared = b69524e3955da23df6ad1a7cd38540047f50860f1c8fded9b1fdfcc9e812a035
# tcId = 56
# edge case public key
private = 881874fda3a99c0f0216e1172fbd07ab1c7df78602cc6b11264e57aab5f23a49
public = edfffffffffffffffffffffffffffffffffffffffffffffffeffffffffffff7f
result = valid
shared = e417bb8854f3b4f70ecea557454c5c4e5f3804ae537960a8097b9f338410d757
# tcId = 57
# edge case public key
private = b8d0f1ae05a5072831443150e202ac6db00322cdf341f467e9f296588b04db72
public = edfffffffffffffffffffffffffffffffeffffffffffffffffffffffffffff7f
result = valid
shared = afca72bb8ef727b60c530c937a2f7d06bb39c39b903a7f4435b3f5d8fc1ca810
# tcId = 58
# edge case public key
private = c8619ba988859db7d6f20fbf3ffb8b113418cc278065b4e8bb6d4e5b3e7cb569
public = edfffffffffffffffeffffffffffffffffffffffffffffffffffffffffffff7f
result = valid
shared = 7e41c2886fed4af04c1641a59af93802f25af0f9cba7a29ae72e2a92f35a1e5a
# tcId = 59
# edge case public key
private = f8d4ca1f37a30ec9acd6dbe5a6e150e5bc447d22b355d80ba002c5b05c26935d
public = edfffffffeffffffffffffffffffffffffffffffffffffffffffffffffffff7f
result = valid
shared = dd3abd4746bf4f2a0d93c02a7d19f76d921c090d07e6ea5abae7f28848355947
# tcId = 60
# edge case public key
private = 88037ac8e33c72c2c51037c7c8c5288bba9265c82fd8c31796dd7ea5df9aaa4a
public = edffffefffffffffffffffffffffffffffffffffffffffffffffffffffffff7f
result = valid
shared = 8c27b3bff8d3c1f6daf2d3b7b3479cf9ad2056e2002be247992a3b29de13a625
# tcId = 61
# edge case public key
private = 5034ee7bf83a13d9167df86b0640294f3620f4f4d9030e5e293f9190824ae562
public = edfffeffffffffffffffffffffffffffffffffffffffffffffffffffffffff7f
result = valid
shared = 8e1d2207b47432f881677448b9d426a30de1a1f3fd38cad6f4b23dbdfe8a2901
# tcId = 62
# edge case public key
private = 40bd4e1caf39d9def7663823502dad3e7d30eb6eb01e9b89516d4f2f45b7cd7f
public = ebffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff7f
result = valid
shared = 2cf6974b0c070e3707bf92e721d3ea9de3db6f61ed810e0a23d72d433365f631
# tcId = 63
# public key with low order
private = e0f978dfcd3a8f1a5093418de54136a584c20b7b349afdf6c0520886f95b1272
public = e0eb7a7c3b41b8ae1656e3faf19fc46ada098deb9c32b1fd866205165f49b800
result = acceptable
shared = 0000000000000000000000000000000000000000000000000000000000000000
# The curves and its twists contain some points of low order. This test vector
# contains a public key with such a point. While many libraries reject such
# public keys, doing so is not a strict requirement according to RFC 7748.
# Some libraries include a check that the shared secret is not all-zero. This
# check is described in Section 6.1 of RFC 7748.
# tcId = 64
# public key with low order
private = 387355d995616090503aafad49da01fb3dc3eda962704eaee6b86f9e20c92579
public = 5f9c95bca3508c24b1d0b1559c83ef5b04445cc4581c8e86d8224eddd09f1157
result = acceptable
shared = 0000000000000000000000000000000000000000000000000000000000000000
# The curves and its twists contain some points of low order. This test vector
# contains a public key with such a point. While many libraries reject such
# public keys, doing so is not a strict requirement according to RFC 7748.
# Some libraries include a check that the shared secret is not all-zero. This
# check is described in Section 6.1 of RFC 7748.
# tcId = 65
# public key with low order
private = c8fe0df92ae68a03023fc0c9adb9557d31be7feed0d3ab36c558143daf4dbb40
public = ecffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff7f
result = acceptable
shared = 0000000000000000000000000000000000000000000000000000000000000000
# The curves and its twists contain some points of low order. This test vector
# contains a public key with such a point. While many libraries reject such
# public keys, doing so is not a strict requirement according to RFC 7748.
# Public keys are either points on a given curve or points on its twist. The
# functions X25519 and X448 are defined for points on a twist with the goal that
# the output of computations do not leak private keys. Implementations may
# accept or reject points on a twist. If a point multiplication is performed
# then it is important that the result is correct, since otherwise attacks with
# invalid keys are possible.
# Some libraries include a check that the shared secret is not all-zero. This
# check is described in Section 6.1 of RFC 7748.
# tcId = 66
# public key with low order
private = c8d74acde5934e64b9895d5ff7afbffd7f704f7dfccff7ac28fa62a1e6410347
public = e0eb7a7c3b41b8ae1656e3faf19fc46ada098deb9c32b1fd866205165f49b880
result = acceptable
shared = 0000000000000000000000000000000000000000000000000000000000000000
# The curves and its twists contain some points of low order. This test vector
# contains a public key with such a point. While many libraries reject such
# public keys, doing so is not a strict requirement according to RFC 7748.
# The public key is in non-canonical form. RFC 7749, section 5 defines the value
# that this public key represents. Section 7 of the same RFC recommends
# accepting such keys. If a non-canonical key is accepted then it must follow
# the RFC.
# Public keys are either points on a given curve or points on its twist. The
# functions X25519 and X448 are defined for points on a twist with the goal that
# the output of computations do not leak private keys. Implementations may
# accept or reject points on a twist. If a point multiplication is performed
# then it is important that the result is correct, since otherwise attacks with
# invalid keys are possible.
# Some libraries include a check that the shared secret is not all-zero. This
# check is described in Section 6.1 of RFC 7748.
# tcId = 67
# public key with low order
private = b85649d5120e01e8ccaf7b2fb8d81b62e8ad6f3d5c0553fdde1906cb9d79c050
public = 5f9c95bca3508c24b1d0b1559c83ef5b04445cc4581c8e86d8224eddd09f11d7
result = acceptable
shared = 0000000000000000000000000000000000000000000000000000000000000000
# The curves and its twists contain some points of low order. This test vector
# contains a public key with such a point. While many libraries reject such
# public keys, doing so is not a strict requirement according to RFC 7748.
# The public key is in non-canonical form. RFC 7749, section 5 defines the value
# that this public key represents. Section 7 of the same RFC recommends
# accepting such keys. If a non-canonical key is accepted then it must follow
# the RFC.
# Public keys are either points on a given curve or points on its twist. The
# functions X25519 and X448 are defined for points on a twist with the goal that
# the output of computations do not leak private keys. Implementations may
# accept or reject points on a twist. If a point multiplication is performed
# then it is important that the result is correct, since otherwise attacks with
# invalid keys are possible.
# Some libraries include a check that the shared secret is not all-zero. This
# check is described in Section 6.1 of RFC 7748.
# tcId = 68
# public key with low order
private = 2064b2f4c9dc97ec7cf58932fdfa3265ba6ea4d11f0259b8efc8afb35db88c48
public = ecffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff
result = acceptable
shared = 0000000000000000000000000000000000000000000000000000000000000000
# The curves and its twists contain some points of low order. This test vector
# contains a public key with such a point. While many libraries reject such
# public keys, doing so is not a strict requirement according to RFC 7748.
# The public key is in non-canonical form. RFC 7749, section 5 defines the value
# that this public key represents. Section 7 of the same RFC recommends
# accepting such keys. If a non-canonical key is accepted then it must follow
# the RFC.
# Some libraries include a check that the shared secret is not all-zero. This
# check is described in Section 6.1 of RFC 7748.
# tcId = 69
# public key with low order
private = 786a33a4f7af297a20e7642925932bf509e7070fa1bc36986af1eb13f4f50b55
public = 0000000000000000000000000000000000000000000000000000000000000000
result = acceptable
shared = 0000000000000000000000000000000000000000000000000000000000000000
# The curves and its twists contain some points of low order. This test vector
# contains a public key with such a point. While many libraries reject such
# public keys, doing so is not a strict requirement according to RFC 7748.
# Some libraries include a check that the shared secret is not all-zero. This
# check is described in Section 6.1 of RFC 7748.
# tcId = 70
# public key with low order
private = 786a33a4f7af297a20e7642925932bf509e7070fa1bc36986af1eb13f4f50b55
public = 0100000000000000000000000000000000000000000000000000000000000000
result = acceptable
shared = 0000000000000000000000000000000000000000000000000000000000000000
# The curves and its twists contain some points of low order. This test vector
# contains a public key with such a point. While many libraries reject such
# public keys, doing so is not a strict requirement according to RFC 7748.
# Some libraries include a check that the shared secret is not all-zero. This
# check is described in Section 6.1 of RFC 7748.
# tcId = 71
# public key with low order
private = 786a33a4f7af297a20e7642925932bf509e7070fa1bc36986af1eb13f4f50b55
public = ecffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff7f
result = acceptable
shared = 0000000000000000000000000000000000000000000000000000000000000000
# The curves and its twists contain some points of low order. This test vector
# contains a public key with such a point. While many libraries reject such
# public keys, doing so is not a strict requirement according to RFC 7748.
# Some libraries include a check that the shared secret is not all-zero. This
# check is described in Section 6.1 of RFC 7748.
# tcId = 72
# public key with low order
private = 786a33a4f7af297a20e7642925932bf509e7070fa1bc36986af1eb13f4f50b55
public = 5f9c95bca3508c24b1d0b1559c83ef5b04445cc4581c8e86d8224eddd09f1157
result = acceptable
shared = 0000000000000000000000000000000000000000000000000000000000000000
# The curves and its twists contain some points of low order. This test vector
# contains a public key with such a point. While many libraries reject such
# public keys, doing so is not a strict requirement according to RFC 7748.
# Some libraries include a check that the shared secret is not all-zero. This
# check is described in Section 6.1 of RFC 7748.
# tcId = 73
# public key with low order
private = 786a33a4f7af297a20e7642925932bf509e7070fa1bc36986af1eb13f4f50b55
public = e0eb7a7c3b41b8ae1656e3faf19fc46ada098deb9c32b1fd866205165f49b800
result = acceptable
shared = 0000000000000000000000000000000000000000000000000000000000000000
# The curves and its twists contain some points of low order. This test vector
# contains a public key with such a point. While many libraries reject such
# public keys, doing so is not a strict requirement according to RFC 7748.
# Some libraries include a check that the shared secret is not all-zero. This
# check is described in Section 6.1 of RFC 7748.
# tcId = 74
# public key with low order
private = 786a33a4f7af297a20e7642925932bf509e7070fa1bc36986af1eb13f4f50b55
public = edffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff7f
result = acceptable
shared = 0000000000000000000000000000000000000000000000000000000000000000
# The curves and its twists contain some points of low order. This test vector
# contains a public key with such a point. While many libraries reject such
# public keys, doing so is not a strict requirement according to RFC 7748.
# Some libraries include a check that the shared secret is not all-zero. This
# check is described in Section 6.1 of RFC 7748.
# tcId = 75
# public key with low order
private = 786a33a4f7af297a20e7642925932bf509e7070fa1bc36986af1eb13f4f50b55
public = eeffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff7f
result = acceptable
shared = 0000000000000000000000000000000000000000000000000000000000000000
# The curves and its twists contain some points of low order. This test vector
# contains a public key with such a point. While many libraries reject such
# public keys, doing so is not a strict requirement according to RFC 7748.
# Some libraries include a check that the shared secret is not all-zero. This
# check is described in Section 6.1 of RFC 7748.
# tcId = 76
# public key with low order
private = 786a33a4f7af297a20e7642925932bf509e7070fa1bc36986af1eb13f4f50b55
public = 0000000000000000000000000000000000000000000000000000000000000080
result = acceptable
shared = 0000000000000000000000000000000000000000000000000000000000000000
# The curves and its twists contain some points of low order. This test vector
# contains a public key with such a point. While many libraries reject such
# public keys, doing so is not a strict requirement according to RFC 7748.
# Some libraries include a check that the shared secret is not all-zero. This
# check is described in Section 6.1 of RFC 7748.
# tcId = 77
# public key with low order
private = 786a33a4f7af297a20e7642925932bf509e7070fa1bc36986af1eb13f4f50b55
public = 0100000000000000000000000000000000000000000000000000000000000080
result = acceptable
shared = 0000000000000000000000000000000000000000000000000000000000000000
# The curves and its twists contain some points of low order. This test vector
# contains a public key with such a point. While many libraries reject such
# public keys, doing so is not a strict requirement according to RFC 7748.
# Some libraries include a check that the shared secret is not all-zero. This
# check is described in Section 6.1 of RFC 7748.
# tcId = 78
# public key with low order
private = 786a33a4f7af297a20e7642925932bf509e7070fa1bc36986af1eb13f4f50b55
public = ecffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff
result = acceptable
shared = 0000000000000000000000000000000000000000000000000000000000000000
# The curves and its twists contain some points of low order. This test vector
# contains a public key with such a point. While many libraries reject such
# public keys, doing so is not a strict requirement according to RFC 7748.
# Some libraries include a check that the shared secret is not all-zero. This
# check is described in Section 6.1 of RFC 7748.
# tcId = 79
# public key with low order
private = 786a33a4f7af297a20e7642925932bf509e7070fa1bc36986af1eb13f4f50b55
public = 5f9c95bca3508c24b1d0b1559c83ef5b04445cc4581c8e86d8224eddd09f11d7
result = acceptable
shared = 0000000000000000000000000000000000000000000000000000000000000000
# The curves and its twists contain some points of low order. This test vector
# contains a public key with such a point. While many libraries reject such
# public keys, doing so is not a strict requirement according to RFC 7748.
# Some libraries include a check that the shared secret is not all-zero. This
# check is described in Section 6.1 of RFC 7748.
# tcId = 80
# public key with low order
private = 786a33a4f7af297a20e7642925932bf509e7070fa1bc36986af1eb13f4f50b55
public = e0eb7a7c3b41b8ae1656e3faf19fc46ada098deb9c32b1fd866205165f49b880
result = acceptable
shared = 0000000000000000000000000000000000000000000000000000000000000000
# The curves and its twists contain some points of low order. This test vector
# contains a public key with such a point. While many libraries reject such
# public keys, doing so is not a strict requirement according to RFC 7748.
# Some libraries include a check that the shared secret is not all-zero. This
# check is described in Section 6.1 of RFC 7748.
# tcId = 81
# public key with low order
private = 786a33a4f7af297a20e7642925932bf509e7070fa1bc36986af1eb13f4f50b55
public = edffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff
result = acceptable
shared = 0000000000000000000000000000000000000000000000000000000000000000
# The curves and its twists contain some points of low order. This test vector
# contains a public key with such a point. While many libraries reject such
# public keys, doing so is not a strict requirement according to RFC 7748.
# Some libraries include a check that the shared secret is not all-zero. This
# check is described in Section 6.1 of RFC 7748.
# tcId = 82
# public key with low order
private = 786a33a4f7af297a20e7642925932bf509e7070fa1bc36986af1eb13f4f50b55
public = eeffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff
result = acceptable
shared = 0000000000000000000000000000000000000000000000000000000000000000
# The curves and its twists contain some points of low order. This test vector
# contains a public key with such a point. While many libraries reject such
# public keys, doing so is not a strict requirement according to RFC 7748.
# Some libraries include a check that the shared secret is not all-zero. This
# check is described in Section 6.1 of RFC 7748.
# tcId = 83
# public key =
# 57896044618658097711785492504343953926634992332820282019728792003956564819949
private = 40ff586e73d61f0960dc2d763ac19e98225f1194f6fe43d5dd97ad55b3d35961
public = edffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff7f
result = acceptable
shared = 0000000000000000000000000000000000000000000000000000000000000000
# The public key is insecure and does not belong to a valid private key. Some
# libraries reject such keys.
# The curves and its twists contain some points of low order. This test vector
# contains a public key with such a point. While many libraries reject such
# public keys, doing so is not a strict requirement according to RFC 7748.
# Some libraries include a check that the shared secret is not all-zero. This
# check is described in Section 6.1 of RFC 7748.
# tcId = 84
# public key =
# 57896044618658097711785492504343953926634992332820282019728792003956564819950
private = 584fceaebae944bfe93b2e0d0a575f706ce5ada1da2b1311c3b421f9186c7a6f
public = eeffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff7f
result = acceptable
shared = 0000000000000000000000000000000000000000000000000000000000000000
# The public key is insecure and does not belong to a valid private key. Some
# libraries reject such keys.
# The curves and its twists contain some points of low order. This test vector
# contains a public key with such a point. While many libraries reject such
# public keys, doing so is not a strict requirement according to RFC 7748.
# The public key is in non-canonical form. RFC 7749, section 5 defines the value
# that this public key represents. Section 7 of the same RFC recommends
# accepting such keys. If a non-canonical key is accepted then it must follow
# the RFC.
# Some libraries include a check that the shared secret is not all-zero. This
# check is described in Section 6.1 of RFC 7748.
# tcId = 85
# non-canonical public key
private = 0016b62af5cabde8c40938ebf2108e05d27fa0533ed85d70015ad4ad39762d54
public = efffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff7f
result = acceptable
shared = b4d10e832714972f96bd3382e4d082a21a8333a16315b3ffb536061d2482360d
# The public key is in non-canonical form. RFC 7749, section 5 defines the value
# that this public key represents. Section 7 of the same RFC recommends
# accepting such keys. If a non-canonical key is accepted then it must follow
# the RFC.
# Public keys are either points on a given curve or points on its twist. The
# functions X25519 and X448 are defined for points on a twist with the goal that
# the output of computations do not leak private keys. Implementations may
# accept or reject points on a twist. If a point multiplication is performed
# then it is important that the result is correct, since otherwise attacks with
# invalid keys are possible.
# tcId = 86
# non-canonical public key
private = d83650ba7cec115881916255e3fa5fa0d6b8dcf968731bd2c9d2aec3f561f649
public = f0ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff7f
result = acceptable
shared = 515eac8f1ed0b00c70762322c3ef86716cd2c51fe77cec3d31b6388bc6eea336
# The public key is in non-canonical form. RFC 7749, section 5 defines the value
# that this public key represents. Section 7 of the same RFC recommends
# accepting such keys. If a non-canonical key is accepted then it must follow
# the RFC.
# Public keys are either points on a given curve or points on its twist. The
# functions X25519 and X448 are defined for points on a twist with the goal that
# the output of computations do not leak private keys. Implementations may
# accept or reject points on a twist. If a point multiplication is performed
# then it is important that the result is correct, since otherwise attacks with
# invalid keys are possible.
# tcId = 87
# non-canonical public key
private = 88dd14e2711ebd0b0026c651264ca965e7e3da5082789fbab7e24425e7b4377e
public = f1ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff7f
result = acceptable
shared = 6919992d6a591e77b3f2bacbd74caf3aea4be4802b18b2bc07eb09ade3ad6662
# The public key is in non-canonical form. RFC 7749, section 5 defines the value
# that this public key represents. Section 7 of the same RFC recommends
# accepting such keys. If a non-canonical key is accepted then it must follow
# the RFC.
# tcId = 88
# non-canonical public key
private = 98c2b08cbac14e15953154e3b558d42bb1268a365b0ef2f22725129d8ac5cb7f
public = ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff7f
result = acceptable
shared = 9c034fcd8d3bf69964958c0105161fcb5d1ea5b8f8abb371491e42a7684c2322
# The public key is in non-canonical form. RFC 7749, section 5 defines the value
# that this public key represents. Section 7 of the same RFC recommends
# accepting such keys. If a non-canonical key is accepted then it must follow
# the RFC.
# tcId = 89
# non-canonical public key
private = c0697b6f05e0f3433b44ea352f20508eb0623098a7770853af5ca09727340c4e
public = 0200000000000000000000000000000000000000000000000000000000000080
result = acceptable
shared = ed18b06da512cab63f22d2d51d77d99facd3c4502e4abf4e97b094c20a9ddf10
# The public key is in non-canonical form. RFC 7749, section 5 defines the value
# that this public key represents. Section 7 of the same RFC recommends
# accepting such keys. If a non-canonical key is accepted then it must follow
# the RFC.
# Public keys are either points on a given curve or points on its twist. The
# functions X25519 and X448 are defined for points on a twist with the goal that
# the output of computations do not leak private keys. Implementations may
# accept or reject points on a twist. If a point multiplication is performed
# then it is important that the result is correct, since otherwise attacks with
# invalid keys are possible.
# tcId = 90
# non-canonical public key
private = 18422b58a18e0f4519b7a887b8cfb649e0bfe4b34d75963350a9944e5b7f5b7e
public = 0300000000000000000000000000000000000000000000000000000000000080
result = acceptable
shared = 448ce410fffc7e6149c5abec0ad5f3607dfde8a34e2ac3243c3009176168b432
# The public key is in non-canonical form. RFC 7749, section 5 defines the value
# that this public key represents. Section 7 of the same RFC recommends
# accepting such keys. If a non-canonical key is accepted then it must follow
# the RFC.
# Public keys are either points on a given curve or points on its twist. The
# functions X25519 and X448 are defined for points on a twist with the goal that
# the output of computations do not leak private keys. Implementations may
# accept or reject points on a twist. If a point multiplication is performed
# then it is important that the result is correct, since otherwise attacks with
# invalid keys are possible.
# tcId = 91
# non-canonical public key
private = 20620d82487707bedf9ee3549e95cb9390d2618f50cf6acba47ffaa103224a6f
public = 0400000000000000000000000000000000000000000000000000000000000080
result = acceptable
shared = 03a633df01480d0d5048d92f51b20dc1d11f73e9515c699429b90a4f6903122a
# The public key is in non-canonical form. RFC 7749, section 5 defines the value
# that this public key represents. Section 7 of the same RFC recommends
# accepting such keys. If a non-canonical key is accepted then it must follow
# the RFC.
# tcId = 92
# non-canonical public key
private = 285a6a7ceeb7122f2c78d99c53b2a902b490892f7dff326f89d12673c3101b53
public = daffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff
result = acceptable
shared = 9b01287717d72f4cfb583ec85f8f936849b17d978dbae7b837db56a62f100a68
# The public key is in non-canonical form. RFC 7749, section 5 defines the value
# that this public key represents. Section 7 of the same RFC recommends
# accepting such keys. If a non-canonical key is accepted then it must follow
# the RFC.
# tcId = 93
# non-canonical public key
private = c8e0330ae9dceeff887fba761225879a4bd2e0db08799244136e4721b2c88970
public = dbffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff
result = acceptable
shared = dfe60831c9f4f96c816e51048804dbdc27795d760eced75ef575cbe3b464054b
# The public key is in non-canonical form. RFC 7749, section 5 defines the value
# that this public key represents. Section 7 of the same RFC recommends
# accepting such keys. If a non-canonical key is accepted then it must follow
# the RFC.
# tcId = 94
# non-canonical public key
private = 10db6210fc1fb13382472fa1787b004b5d11868ab3a79510e0cee30f4a6df26b
public = dcffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff
result = acceptable
shared = 50bfa826ca77036dd2bbfd092c3f78e2e4a1f980d7c8e78f2f14dca3cce5cc3c
# The public key is in non-canonical form. RFC 7749, section 5 defines the value
# that this public key represents. Section 7 of the same RFC recommends
# accepting such keys. If a non-canonical key is accepted then it must follow
# the RFC.
# Public keys are either points on a given curve or points on its twist. The
# functions X25519 and X448 are defined for points on a twist with the goal that
# the output of computations do not leak private keys. Implementations may
# accept or reject points on a twist. If a point multiplication is performed
# then it is important that the result is correct, since otherwise attacks with
# invalid keys are possible.
# tcId = 95
# non-canonical public key
private = 9041c6e044a277df8466275ca8b5ee0da7bc028648054ade5c592add3057474e
public = eaffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff
result = acceptable
shared = 13da5695a4c206115409b5277a934782fe985fa050bc902cba5616f9156fe277
# The public key is in non-canonical form. RFC 7749, section 5 defines the value
# that this public key represents. Section 7 of the same RFC recommends
# accepting such keys. If a non-canonical key is accepted then it must follow
# the RFC.
# tcId = 96
# non-canonical public key
private = b8d499041a6713c0f6f876db7406587fdb44582f9542356ae89cfa958a34d266
public = ebffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff
result = acceptable
shared = 63483b5d69236c63cddbed33d8e22baecc2b0ccf886598e863c844d2bf256704
# The public key is in non-canonical form. RFC 7749, section 5 defines the value
# that this public key represents. Section 7 of the same RFC recommends
# accepting such keys. If a non-canonical key is accepted then it must follow
# the RFC.
# tcId = 97
# non-canonical public key
private = c85f08e60c845f82099141a66dc4583d2b1040462c544d33d0453b20b1a6377e
public = ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff
result = acceptable
shared = e9db74bc88d0d9bf046ddd13f943bccbe6dbb47d49323f8dfeedc4a694991a3c
# The public key is in non-canonical form. RFC 7749, section 5 defines the value
# that this public key represents. Section 7 of the same RFC recommends
# accepting such keys. If a non-canonical key is accepted then it must follow
# the RFC.
# tcId = 98
# public key =
# 57896044618658097711785492504343953926634992332820282019728792003956564819968
private = 7887889bac4c629a101d3724f2ed8b98d936fde79e1a1f77d86779626bf8f263
public = 0000000000000000000000000000000000000000000000000000000000000080
result = acceptable
shared = 0000000000000000000000000000000000000000000000000000000000000000
# The public key is insecure and does not belong to a valid private key. Some
# libraries reject such keys.
# The curves and its twists contain some points of low order. This test vector
# contains a public key with such a point. While many libraries reject such
# public keys, doing so is not a strict requirement according to RFC 7748.
# The public key is in non-canonical form. RFC 7749, section 5 defines the value
# that this public key represents. Section 7 of the same RFC recommends
# accepting such keys. If a non-canonical key is accepted then it must follow
# the RFC.
# Some libraries include a check that the shared secret is not all-zero. This
# check is described in Section 6.1 of RFC 7748.
# tcId = 99
# public key =
# 57896044618658097711785492504343953926634992332820282019728792003956564819969
private = e07971ee820e48b0b266d8be3cdbbb5e900a43f59ee8535c6572418615de4962
public = 0100000000000000000000000000000000000000000000000000000000000080
result = acceptable
shared = 0000000000000000000000000000000000000000000000000000000000000000
# The public key is insecure and does not belong to a valid private key. Some
# libraries reject such keys.
# The curves and its twists contain some points of low order. This test vector
# contains a public key with such a point. While many libraries reject such
# public keys, doing so is not a strict requirement according to RFC 7748.
# The public key is in non-canonical form. RFC 7749, section 5 defines the value
# that this public key represents. Section 7 of the same RFC recommends
# accepting such keys. If a non-canonical key is accepted then it must follow
# the RFC.
# Public keys are either points on a given curve or points on its twist. The
# functions X25519 and X448 are defined for points on a twist with the goal that
# the output of computations do not leak private keys. Implementations may
# accept or reject points on a twist. If a point multiplication is performed
# then it is important that the result is correct, since otherwise attacks with
# invalid keys are possible.
# Some libraries include a check that the shared secret is not all-zero. This
# check is described in Section 6.1 of RFC 7748.
# tcId = 100
# RFC 7748
private = a046e36bf0527c9d3b16154b82465edd62144c0ac1fc5a18506a2244ba449a44
public = e6db6867583030db3594c1a424b15f7c726624ec26b3353b10a903a6d0ab1c4c
result = valid
shared = c3da55379de9c6908e94ea4df28d084f32eccf03491c71f754b4075577a28552
# tcId = 101
# RFC 7748
private = 4866e9d4d1b4673c5ad22691957d6af5c11b6421e0ea01d42ca4169e7918ba4d
public = e5210f12786811d3f4b7959d0538ae2c31dbe7106fc03c3efc4cd549c715a413
result = valid
shared = 95cbde9476e8907d7aade45cb4b873f88b595a68799fa152e6f8f7647aac7957
# tcId = 102
# RFC 8037, Section A.6
private = 77076d0a7318a57d3c16c17251b26645df4c2f87ebc0992ab177fba51db92c2a
public = de9edb7d7b7dc1b4d35b61c2ece435373f8343c85b78674dadfc7e146f882b4f
result = valid
shared = 4a5d9d5ba4ce2de1728e3bf480350f25e07e21c947d19e3376f09b3c1e161742
# tcId = 103
# edge case for shared secret
private = 60a3a4f130b98a5be4b1cedb7cb85584a3520e142d474dc9ccb909a073a9767f
public = b7b6d39c765cb60c0c8542f4f3952ffb51d3002d4aeb9f8ff988b192043e6d0a
result = acceptable
shared = 0200000000000000000000000000000000000000000000000000000000000000
# Public keys are either points on a given curve or points on its twist. The
# functions X25519 and X448 are defined for points on a twist with the goal that
# the output of computations do not leak private keys. Implementations may
# accept or reject points on a twist. If a point multiplication is performed
# then it is important that the result is correct, since otherwise attacks with
# invalid keys are possible.
# tcId = 104
# edge case for shared secret
private = 60a3a4f130b98a5be4b1cedb7cb85584a3520e142d474dc9ccb909a073a9767f
public = 3b18df1e50b899ebd588c3161cbd3bf98ebcc2c1f7df53b811bd0e91b4d5153d
result = valid
shared = 0900000000000000000000000000000000000000000000000000000000000000
# tcId = 105
# edge case for shared secret
private = 60a3a4f130b98a5be4b1cedb7cb85584a3520e142d474dc9ccb909a073a9767f
public = cab6f9e7d8ce00dfcea9bbd8f069ef7fb2ac504abf83b87db601b5ae0a7f7615
result = valid
shared = 1000000000000000000000000000000000000000000000000000000000000000
# tcId = 106
# edge case for shared secret
private = 60a3a4f130b98a5be4b1cedb7cb85584a3520e142d474dc9ccb909a073a9767f
public = 4977d0d897e1ba566590f60f2eb0db6f7b24c13d436918ccfd32708dfad7e247
result = acceptable
shared = feffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff3f
# Public keys are either points on a given curve or points on its twist. The
# functions X25519 and X448 are defined for points on a twist with the goal that
# the output of computations do not leak private keys. Implementations may
# accept or reject points on a twist. If a point multiplication is performed
# then it is important that the result is correct, since otherwise attacks with
# invalid keys are possible.
# tcId = 107
# edge case for shared secret
private = 60a3a4f130b98a5be4b1cedb7cb85584a3520e142d474dc9ccb909a073a9767f
public = 98730bc03e29e8b057fb1d20ef8c0bffc822485d3db7f45f4e3cc2c3c6d1d14c
result = valid
shared = fcffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff3f
# tcId = 108
# edge case for shared secret
private = 60a3a4f130b98a5be4b1cedb7cb85584a3520e142d474dc9ccb909a073a9767f
public = 97b4fff682df7f096cd1756569e252db482d45406a3198a1aff282a5da474c49
result = acceptable
shared = f9ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff3f
# Public keys are either points on a given curve or points on its twist. The
# functions X25519 and X448 are defined for points on a twist with the goal that
# the output of computations do not leak private keys. Implementations may
# accept or reject points on a twist. If a point multiplication is performed
# then it is important that the result is correct, since otherwise attacks with
# invalid keys are possible.
# tcId = 109
# edge case for shared secret
private = 60a3a4f130b98a5be4b1cedb7cb85584a3520e142d474dc9ccb909a073a9767f
public = 317781b0163bae74accc06c0d44ef9a911a22b0d37faf7726621591f9343ea2f
result = valid
shared = f3ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff3f
# tcId = 110
# edge case for shared secret
private = 60a3a4f130b98a5be4b1cedb7cb85584a3520e142d474dc9ccb909a073a9767f
public = 7e26f8f24cb590027f9d1bc49b0e1a242c7d8f43624d3e8fab28ee08e02cb45e
result = valid
shared = ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff03
# tcId = 111
# edge case for shared secret
private = 60a3a4f130b98a5be4b1cedb7cb85584a3520e142d474dc9ccb909a073a9767f
public = e96d2780e5469a74620ab5aa2f62151d140c473320dbe1b028f1a48f8e76f95f
result = acceptable
shared = e5ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff7f
# Public keys are either points on a given curve or points on its twist. The
# functions X25519 and X448 are defined for points on a twist with the goal that
# the output of computations do not leak private keys. Implementations may
# accept or reject points on a twist. If a point multiplication is performed
# then it is important that the result is correct, since otherwise attacks with
# invalid keys are possible.
# tcId = 112
# edge case for shared secret
private = 60a3a4f130b98a5be4b1cedb7cb85584a3520e142d474dc9ccb909a073a9767f
public = 8d612c5831aa64b057300e7e310f3aa332af34066fefcab2b089c9592878f832
result = acceptable
shared = e3ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff7f
# Public keys are either points on a given curve or points on its twist. The
# functions X25519 and X448 are defined for points on a twist with the goal that
# the output of computations do not leak private keys. Implementations may
# accept or reject points on a twist. If a point multiplication is performed
# then it is important that the result is correct, since otherwise attacks with
# invalid keys are possible.
# tcId = 113
# edge case for shared secret
private = 60a3a4f130b98a5be4b1cedb7cb85584a3520e142d474dc9ccb909a073a9767f
public = 8d44108d05d940d3dfe5647ea7a87be24d0d036c9f0a95a2386b839e7b7bf145
result = valid
shared = ddffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff7f
# tcId = 114
# edge case for shared secret
private = 60a3a4f130b98a5be4b1cedb7cb85584a3520e142d474dc9ccb909a073a9767f
public = 21a35d5db1b6237c739b56345a930aeee373cdcfb4701266782a8ac594913b29
result = acceptable
shared = dbffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff7f
# Public keys are either points on a given curve or points on its twist. The
# functions X25519 and X448 are defined for points on a twist with the goal that
# the output of computations do not leak private keys. Implementations may
# accept or reject points on a twist. If a point multiplication is performed
# then it is important that the result is correct, since otherwise attacks with
# invalid keys are possible.
# tcId = 115
# edge case for shared secret
private = 60a3a4f130b98a5be4b1cedb7cb85584a3520e142d474dc9ccb909a073a9767f
public = 3e5efb63c352ce942762482bc9337a5d35ba55664743ac5e93d11f957336cb10
result = acceptable
shared = 0000000000000000000000000000000000000000000000000000000000000002
# Public keys are either points on a given curve or points on its twist. The
# functions X25519 and X448 are defined for points on a twist with the goal that
# the output of computations do not leak private keys. Implementations may
# accept or reject points on a twist. If a point multiplication is performed
# then it is important that the result is correct, since otherwise attacks with
# invalid keys are possible.
# tcId = 116
# edge case for shared secret
private = 60a3a4f130b98a5be4b1cedb7cb85584a3520e142d474dc9ccb909a073a9767f
public = 8e41f05ea3c76572be104ad8788e970863c6e2ca3daae64d1c2f46decfffa571
result = acceptable
shared = 0000000000000000000000000000000000000000000000000000000000008000
# Public keys are either points on a given curve or points on its twist. The
# functions X25519 and X448 are defined for points on a twist with the goal that
# the output of computations do not leak private keys. Implementations may
# accept or reject points on a twist. If a point multiplication is performed
# then it is important that the result is correct, since otherwise attacks with
# invalid keys are possible.
# tcId = 117
# special case public key
private = c8d07c46bbfb827753b92c70e49583ce8bfa44641a7382258ea903d6a832c96b
public = 0000000000000000000000000000000000000000000000000000000000000000
result = acceptable
shared = 0000000000000000000000000000000000000000000000000000000000000000
# The public key is insecure and does not belong to a valid private key. Some
# libraries reject such keys.
# The curves and its twists contain some points of low order. This test vector
# contains a public key with such a point. While many libraries reject such
# public keys, doing so is not a strict requirement according to RFC 7748.
# Some libraries include a check that the shared secret is not all-zero. This
# check is described in Section 6.1 of RFC 7748.
# tcId = 118
# special case public key
private = 90b7ef237a055f348dcb4c4364a59d7d31edc7ab78f2ca254e2c810975c3f543
public = 0100000000000000000000000000000000000000000000000000000000000000
result = acceptable
shared = 0000000000000000000000000000000000000000000000000000000000000000
# The public key is insecure and does not belong to a valid private key. Some
# libraries reject such keys.
# The curves and its twists contain some points of low order. This test vector
# contains a public key with such a point. While many libraries reject such
# public keys, doing so is not a strict requirement according to RFC 7748.
# Some libraries include a check that the shared secret is not all-zero. This
# check is described in Section 6.1 of RFC 7748.
# tcId = 119
# special case public key
private = e0a8be63315c4f0f0a3fee607f44d30a55be63f09561d9af93e0a1c9cf0ed751
public = 0200000000000000000000000000000000000000000000000000000000000000
result = acceptable
shared = 0c50ac2bfb6815b47d0734c5981379882a24a2de6166853c735329d978baee4d
# Public keys are either points on a given curve or points on its twist. The
# functions X25519 and X448 are defined for points on a twist with the goal that
# the output of computations do not leak private keys. Implementations may
# accept or reject points on a twist. If a point multiplication is performed
# then it is important that the result is correct, since otherwise attacks with
# invalid keys are possible.
# tcId = 120
# special case public key
private = 0840a8af5bc4c48da8850e973d7e14220f45c192cea4020d377eecd25c7c3643
public = 1200000000000000000000000000000000000000000000000000000000000000
result = valid
shared = 77557137a2a2a651c49627a9b239ac1f2bf78b8a3e72168ccecc10a51fc5ae66
# tcId = 121
# special case public key
private = 0092229c753a71284d0853909470ad847ab62f439ea51482fb41d30cc3b44743
public = 1400000000000000000000000000000000000000000000000000000000000000
result = acceptable
shared = c88e719ae5c2248b5f90da346a92ae214f44a5d129fd4e9c26cf6a0da1efe077
# Public keys are either points on a given curve or points on its twist. The
# functions X25519 and X448 are defined for points on a twist with the goal that
# the output of computations do not leak private keys. Implementations may
# accept or reject points on a twist. If a point multiplication is performed
# then it is important that the result is correct, since otherwise attacks with
# invalid keys are possible.
# tcId = 122
# special case public key
private = b8da2bd2d7cf25a3e54e5f87ee15911effb9ff86baec4076d56c8e953670bf5b
public = 0000000000000000000000000080000000000000000000000000000000000000
result = valid
shared = 4bf6789c7ea036f973cde0af02d6fdb9b64a0b957022111439570fad7d7a453f
# tcId = 123
# special case public key
private = 684cd420af41abb3d10c61e773238cf729c2155f941ac27e15f4c37f49b29576
public = ffffffffffffffffffffffffffff000000000000000000000000000000000000
result = valid
shared = bcac235ae15cc7148372e11f9315e3bc76ceb904b3d2a8246bd9d9be2082bb62
# tcId = 124
# special case public key
private = 38cfacaa4460796b4de434bdd6739f0d043671f97fa829517511e6b47aa93474
public = 0100000000000000000000000000010000000000000000000000000000000000
result = acceptable
shared = 5dd7d16fff25cc5fdf9e03c3157cb0a235cea17d618f36e6f13461567edeb943
# Public keys are either points on a given curve or points on its twist. The
# functions X25519 and X448 are defined for points on a twist with the goal that
# the output of computations do not leak private keys. Implementations may
# accept or reject points on a twist. If a point multiplication is performed
# then it is important that the result is correct, since otherwise attacks with
# invalid keys are possible.
# tcId = 125
# special case public key
private = 30832e8cb627ac195f77b1105258e4bb18b99a5ed944404bfacb3a039fbdb14b
public = 0000000000000000000000000000000000000000000000000000004000000000
result = valid
shared = 2816fd031d51d6750f9225ede950625cca47441ca97e43092650396991afcb6d
# tcId = 126
# special case public key
private = d818fd6971e546447f361d33d3dbb3eadcf02fb28f246f1d5107b9073a93cd4f
public = 0000000000000000000000000000000000000000000000000000008000000000
result = acceptable
shared = 7ed8f2d5424e7ebb3edbdf4abe455447e5a48b658e64abd06c218f33bd151f64
# Public keys are either points on a given curve or points on its twist. The
# functions X25519 and X448 are defined for points on a twist with the goal that
# the output of computations do not leak private keys. Implementations may
# accept or reject points on a twist. If a point multiplication is performed
# then it is important that the result is correct, since otherwise attacks with
# invalid keys are possible.
# tcId = 127
# special case public key
private = 1021cd8682bdc3f5da9100adff5b2230b3acd836b3a455db8352a2c27e69d17e
public = ffffffffffffffffffffffffffffffffffffffffffffffffffffffff00000000
result = acceptable
shared = e8620ed5ca89c72c5ea5503e6dcd01131cd5e875c30e13d5dc619ce28ec7d559
# Public keys are either points on a given curve or points on its twist. The
# functions X25519 and X448 are defined for points on a twist with the goal that
# the output of computations do not leak private keys. Implementations may
# accept or reject points on a twist. If a point multiplication is performed
# then it is important that the result is correct, since otherwise attacks with
# invalid keys are possible.
# tcId = 128
# special case public key
private = 20e4c9247102292655d6765d7d84c6fce5309b8004045daea6d7d7dcad462871
public = 0100000000000000000000000000000000000000000000000000000001000000
result = valid
shared = ceadb264379dcadd6e3bb8ad24dd653d2a609dd703d41da6caf3ad00f001862c
# tcId = 129
# special case public key
private = 90b150d462de512056d5bd55173074969b496f262fb6916b733f6263a8078971
public = a8b9c7372118a53a9de9eaf0868e3b1a3d88e81cb2e407ff7125e9f5c5088715
result = acceptable
shared = f86cc7bf1be49574fc97a074282e9bb5cd238e002bc8e9a7b8552b2d60eccb52
# Public keys are either points on a given curve or points on its twist. The
# functions X25519 and X448 are defined for points on a twist with the goal that
# the output of computations do not leak private keys. Implementations may
# accept or reject points on a twist. If a point multiplication is performed
# then it is important that the result is correct, since otherwise attacks with
# invalid keys are possible.
# tcId = 130
# special case public key
private = 9887286b3261c8d857a16f6db21277f75d88d4e861b3ebe7596699047e816668
public = aab9c7372118a53a9de9eaf0868e3b1a3d88e81cb2e407ff7125e9f5c5088715
result = acceptable
shared = ccbb8fd9dee165a398b2dbd7c8396f81736c1b3da36b35fbec8f326f38f92767
# Public keys are either points on a given curve or points on its twist. The
# functions X25519 and X448 are defined for points on a twist with the goal that
# the output of computations do not leak private keys. Implementations may
# accept or reject points on a twist. If a point multiplication is performed
# then it is important that the result is correct, since otherwise attacks with
# invalid keys are possible.
# tcId = 131
# special case public key
private = 20ca2c85cc8762e96b7047bf15c71c050ffe0ed1616040a953ae32a1297ad871
public = 585007a5930d77623cf29756038ca197d3ebfd9e4c80a69585efe0274092c115
result = valid
shared = 46add6f48ffff461777d4f89b6fdf1155aa051a96387d45f3e5e371a236b6e52
# tcId = 132
# special case public key
private = d027656605b10bf18dea28bc52546f9f1f08cef06cafd200fc84f87dbb4ebe46
public = fbffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff1f
result = valid
shared = 1adbe32207e21f71e1af53884d2a2276481e298e557f4dacb3720f2458e3082d
# tcId = 133
# special case public key
private = 4867a83ee9d01b7510840867db1af6a6049bdbb056b74443f70c358e162c8867
public = 0000000000000000000000000000000000000000000000000000000000000020
result = acceptable
shared = e12cc58fbeb70a5e35c861c33710be6516a6a92e52376060211b2487db542b4f
# Public keys are either points on a given curve or points on its twist. The
# functions X25519 and X448 are defined for points on a twist with the goal that
# the output of computations do not leak private keys. Implementations may
# accept or reject points on a twist. If a point multiplication is performed
# then it is important that the result is correct, since otherwise attacks with
# invalid keys are possible.
# tcId = 134
# special case public key
private = a015970a8add940fca5b1b5d23875397d547d8d494fcb314f2045a67a2d12c4b
public = afa00e4a271beec478e42fad0618432fa7d7fb3d99004d2b0bdfc14f8024832b
result = valid
shared = 421bed1b26da1e9adbeada1f32b91a0fb4ced0f1110e0a4a88e735a19ee4571e
# tcId = 135
# special case public key
private = 4058cb6b9aaba02a338aaa392dbc10039e26e9e444117e758e24c5d8b232ea5e
public = b1a00e4a271beec478e42fad0618432fa7d7fb3d99004d2b0bdfc14f8024832b
result = valid
shared = d7b47463e2f4ca9a1a7deea098da8e74ac3b4a109083d997259b12992e7e7e06
# tcId = 136
# special case public key
private = b876b05daff0530b139d9e11250563418077178246c5fa7005ba00e9b6647763
public = fbffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff2f
result = acceptable
shared = 686eb910a937211b9147c8a051a1197906818fdc626668eb5f5d394afd86d41b
# Public keys are either points on a given curve or points on its twist. The
# functions X25519 and X448 are defined for points on a twist with the goal that
# the output of computations do not leak private keys. Implementations may
# accept or reject points on a twist. If a point multiplication is performed
# then it is important that the result is correct, since otherwise attacks with
# invalid keys are possible.
# tcId = 137
# special case public key
private = d87fd6aa5d8deef6dee9619a56846a0829620590f2da40835d8e251597e39078
public = 22231c64ef73ad62318b8a87bc38e272e1bb8bf1a60d7c00476d0b059d7b3c35
result = valid
shared = 09559733b35bcc6bb8ac574b5abe3a4d8841deff051c294a07487e3eec3c5558
# tcId = 138
# special case public key
private = 90036321b63751f7622aa93da34d85e59ce81009ac5b9a068921d83bc4715b57
public = f6ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff3f
result = valid
shared = f7d5cbcf39eb722b01ed20c85563ebb81d076511aead4ccc429027866b9fd270
# tcId = 139
# special case public key
private = a06781fd4c4a0874e00e72ba131b9dd87a83b2904e294de176e8a9af1f695d67
public = f7ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff3f
result = acceptable
shared = e995ad6a1ec6c5ab32922cff9d204721704673143c4a11deaa203f3c81989b3f
# Public keys are either points on a given curve or points on its twist. The
# functions X25519 and X448 are defined for points on a twist with the goal that
# the output of computations do not leak private keys. Implementations may
# accept or reject points on a twist. If a point multiplication is performed
# then it is important that the result is correct, since otherwise attacks with
# invalid keys are possible.
# tcId = 140
# special case public key
private = b822d72d8b68bdb4fbf67e56a61d672b2c7747e94479fe5ae4072d0accdd6571
public = feffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff3f
result = acceptable
shared = 32b6dabe01d13867f3b5b0892fefd80dca666f2edc5afb43cd0baf703c3e6926
# Public keys are either points on a given curve or points on its twist. The
# functions X25519 and X448 are defined for points on a twist with the goal that
# the output of computations do not leak private keys. Implementations may
# accept or reject points on a twist. If a point multiplication is performed
# then it is important that the result is correct, since otherwise attacks with
# invalid keys are possible.
# tcId = 141
# special case public key
private = d08ce1237e248d02cdf619d20bea5848ade4f6ffd171b8dee8793fc67c459640
public = 0000000000000000000000000000000000000000000000000000000000000040
result = valid
shared = a93d83fc9ea0f6cb0cc8b631da600019b76cbb2ec57222f2e42dd540e3da850b
# tcId = 142
# special case public key
private = 180ae3c928514cfb9edd06e7dc1d5d066160e967445a5c58e4463b69ed205e6d
public = cbdce39b108c529dce74757843c71d8d1e44740e59f283ffb892f4fa6284c34a
result = valid
shared = 017cbfa2b38e9ef3297a339ecce1a917bdcf7e910036086a41d1e22d04241870
# tcId = 143
# special case public key
private = e881d806a110560cd8fee899d59c0249f1233a4322c41aa369c7a2a99f5b5962
public = 3c5ff1b5d8e4113b871bd052f9e7bcd0582804c266ffb2d4f4203eb07fdb7c54
result = valid
shared = 71133905b8a57ea8c38de0ecf213699a75b096c2df21f07f7e9eb03e9fa53f5c
# tcId = 144
# special case public key
private = 08e410e1d7e8b9411236af4a35d6b62a5d8931478e4c62197cfafb491467b162
public = 3e5ff1b5d8e4113b871bd052f9e7bcd0582804c266ffb2d4f4203eb07fdb7c54
result = valid
shared = 3dc7b70e110766b2bf525252ebed98a100b2e532dc69544464da1bbab8625f6d
# tcId = 145
# special case public key
private = e02fdf7e0ee3d55b4440f01432dd253c949793bc04da44ddece83e54c8c39b40
public = f2ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff5f
result = valid
shared = e317e5cc438b5f79ead5533ac7c45519a117b31033cc2140b19edf8572011240
# tcId = 146
# special case public key
private = f05d18f68ef7a5865c14db3a9c255fdf2dabea2aa36581e94f68b727b582867b
public = f6ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff5f
result = valid
shared = d86810516aeddc18061036f599a9eb84d1c6146b0f543652dd4526743ba42c04
# tcId = 147
# special case public key
private = 00c103578d5c079d7bcc22c1c31e787c1b15c57fcb493fdafefa20371cfc746b
public = 95aff85a6cf2889dc30d68a9fc735e682c140261b37f596a7a101fd8bf6d3e6a
result = acceptable
shared = dfa988a477003be125b95ccbf2223d97729577d25e1d6e89e3da0afabdd0ae71
# Public keys are either points on a given curve or points on its twist. The
# functions X25519 and X448 are defined for points on a twist with the goal that
# the output of computations do not leak private keys. Implementations may
# accept or reject points on a twist. If a point multiplication is performed
# then it is important that the result is correct, since otherwise attacks with
# invalid keys are possible.
# tcId = 148
# special case public key
private = 7005bb927485c435642b424a3dde014bcf76345e5be64ae6e9b24db39e1cdb51
public = 434638c8dee75ac56216150f7971c4e5c27717e34d1bf8008eda160a3af7786a
result = acceptable
shared = d450af45b8ed5fe140cc5263ffb7b52e66736899a8b872b6e28552129819b25b
# Public keys are either points on a given curve or points on its twist. The
# functions X25519 and X448 are defined for points on a twist with the goal that
# the output of computations do not leak private keys. Implementations may
# accept or reject points on a twist. If a point multiplication is performed
# then it is important that the result is correct, since otherwise attacks with
# invalid keys are possible.
# tcId = 149
# special case public key
private = 0822039a5dc13c40fcccf346e2a7769b4fd272052d43260ad626468a50d44162
public = 454638c8dee75ac56216150f7971c4e5c27717e34d1bf8008eda160a3af7786a
result = valid
shared = 58002c89bf8bc32ae6fc205b796acd13ef7f8476f6492ae4b2be47f1095e8a4f
# tcId = 150
# special case public key
private = 40a6349c03f0dc0a42358f6353ca67632af687b14c9dff626c54e211e8fc355a
public = ecfffffffffffffffffffffffffffeffffffffffffffffffffffffffffffff7f
result = valid
shared = 7773aad6e72eb1735b65ad51f7dad258c11d7bfff53094424cb103cd6bfb4368
# tcId = 151
# special case public key
private = 50696d4d05209971d6ba0676ea274262ba639aac74fa75e5df4570768ad8ae74
public = eefffffffffffffffffffffffffffeffffffffffffffffffffffffffffffff7f
result = valid
shared = c118ddf6462fbea80f14ef1f2972a1ab12cafa511d1323d4d22d0d426d651b5b
# tcId = 152
# special case public key
private = 68bb680c853f4e4daa47c586dc886cf4568d7b0383770f6df439a53be4a3236d
public = edffffffffffffffffffffffff7fffffffffffffffffffffffffffffffffff7f
result = valid
shared = cc0775bfd970a2706b11c7222a4436a3d17160382c83b76f89b66192c81b4408
# tcId = 153
# special case public key
private = b0f6c28dbdc647068a76d71805ef770f087cf76b82afdc0d26c45b71ace49768
public = ebffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff7f
result = valid
shared = f0097fa0ba70d019126277ab15c56ecc170ca88180b2bf9d80fcda3d7d74552a
# tcId = 154
# special case public key
private = 18630f93598637c35da623a74559cf944374a559114c7937811041fc8605564a
public = ecffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff7f
result = acceptable
shared = 0000000000000000000000000000000000000000000000000000000000000000
# The curves and its twists contain some points of low order. This test vector
# contains a public key with such a point. While many libraries reject such
# public keys, doing so is not a strict requirement according to RFC 7748.
# Public keys are either points on a given curve or points on its twist. The
# functions X25519 and X448 are defined for points on a twist with the goal that
# the output of computations do not leak private keys. Implementations may
# accept or reject points on a twist. If a point multiplication is performed
# then it is important that the result is correct, since otherwise attacks with
# invalid keys are possible.
# Some libraries include a check that the shared secret is not all-zero. This
# check is described in Section 6.1 of RFC 7748.
# tcId = 155
# special case for E in multiplication by 2
private = 581ecbda5a4a228044fefd6e03df234558c3c79152c6e2c5e60b142c4f26a851
public = 0000000000000000000008000000000000000000000000000000000000000000
result = acceptable
shared = 59e7b1e6f47065a48bd34913d910176b6792a1372aad22e73cd7df45fcf91a0e
# Public keys are either points on a given curve or points on its twist. The
# functions X25519 and X448 are defined for points on a twist with the goal that
# the output of computations do not leak private keys. Implementations may
# accept or reject points on a twist. If a point multiplication is performed
# then it is important that the result is correct, since otherwise attacks with
# invalid keys are possible.
# tcId = 156
# special case for E in multiplication by 2
private = b0561a38000795b7cb537b55e975ea452c2118506295d5eb15fd9c83b67f7a50
public = 77af0d3897a715dfe25df5d538cf133bc9ab7ad52df6bd922a2fb75621d59901
result = valid
shared = 179f6b020748acba349133eaa4518f1bd8bab7bfc4fb05fd4c24e7553da1e960
# tcId = 157
# special case for E in multiplication by 2
private = b00f7df2d47128441c7270b9a87eee45b6056fc64236a57bdf81dbcccf5f5d42
public = 4e39866127b6a12a54914e106aab86464af55631f3cb61766d5999aa8d2e070e
result = valid
shared = 43c5ee1451f213ef7624729e595a0fee7c9af7ee5d27eb03278ee9f94c202352
# tcId = 158
# special case for E in multiplication by 2
private = c8f7a0c0bfb1e9c72576c534f86854fbe4af521d4fa807f67e2440e100ec8852
public = adc6799ed8495ed5ab6eb1ef955479b9b50aa9ce0c349e8992a6665572d1f811
result = valid
shared = 2f350bcf0b40784d1d756c9ca3e38ec9dd68ba80faf1f9847de50779c0d4902a
# tcId = 159
# special case for E in multiplication by 2
private = 58181f581aa37022ff71c56c6e68e6175d967c5c995a249885f66565074ded4d
public = 770f4218ef234f5e185466e32442c302bbec21bbb6cd28c979e783fe5013333f
result = acceptable
shared = d5d650dc621072eca952e4344efc7320b2b1459aba48f5e2480db881c50cc650
# Public keys are either points on a given curve or points on its twist. The
# functions X25519 and X448 are defined for points on a twist with the goal that
# the output of computations do not leak private keys. Implementations may
# accept or reject points on a twist. If a point multiplication is performed
# then it is important that the result is correct, since otherwise attacks with
# invalid keys are possible.
# tcId = 160
# special case for E in multiplication by 2
private = 301c935cae4357070b0adaf9cd6192830b2c989c153729eed99f589eb45f884b
public = 5c6118c4c74cfb842d9a87449f9d8db8b992d46c5a9093ce2fcb7a49b535c451
result = acceptable
shared = 909cc57275d54f20c67b45f9af9484fd67581afb7d887bee1db5461f303ef257
# Public keys are either points on a given curve or points on its twist. The
# functions X25519 and X448 are defined for points on a twist with the goal that
# the output of computations do not leak private keys. Implementations may
# accept or reject points on a twist. If a point multiplication is performed
# then it is important that the result is correct, since otherwise attacks with
# invalid keys are possible.
# tcId = 161
# special case for E in multiplication by 2
private = d002292d4359a3d42bc8767f1380009332e7a0df2f3379011ab78f789f6baa54
public = 4039866127b6a12a54914e106aab86464af55631f3cb61766d5999aa8d2e076e
result = valid
shared = 4a7e2c5caf1d8180eb1c4f22692f29a14b4cdc9b193bd1d16e2f27438eef1448
# tcId = 162
# special case for E in multiplication by 2
private = d0c2c49e644ab738270707ff9917065942687e2f12886d961161db46c05b565f
public = 078fa523498fb51cba1112d83b20af448b8009d8eea14368564d01b8f9b6086f
result = acceptable
shared = c0ee59d3685fc2c3c803608b5ee39a7f8da30b48e4293ae011f0ea1e5aeb7173
# Public keys are either points on a given curve or points on its twist. The
# functions X25519 and X448 are defined for points on a twist with the goal that
# the output of computations do not leak private keys. Implementations may
# accept or reject points on a twist. If a point multiplication is performed
# then it is important that the result is correct, since otherwise attacks with
# invalid keys are possible.
# tcId = 163
# special case for E in multiplication by 2
private = f087d38b274c1dad1bce6eaa36b48e2190b90b9bf8ca59669cc5e00464534342
public = 9fc6799ed8495ed5ab6eb1ef955479b9b50aa9ce0c349e8992a6665572d1f871
result = valid
shared = b252bc8eabfaa68c56e54d61b99061a35d11e3a7b9bda417d90f69b1119bcf45
# tcId = 164
# special case for E in multiplication by 2
private = 48dbcc5a695f1514bbbaa6ad00842b69d9ae5216b1963add07fb2947c97b8447
public = 7650f2c76858ea201da2022ac730ecc43654852ad209426dd5d048a9de2a667e
result = valid
shared = fbda33bc930c08df837208e19afdc1cfe3fd0f8f0e3976be34775e58a4a7771f
# tcId = 165
# D = 0 in multiplication by 2
private = 5891c9272cf9a197735b701e5715268d36d7436b7e351a3e997a0862e4807d4d
public = e0eb7a7c3b41b8ae1656e3faf19fc46ada098deb9c32b1fd866205165f49b800
result = acceptable
shared = 0000000000000000000000000000000000000000000000000000000000000000
# The curves and its twists contain some points of low order. This test vector
# contains a public key with such a point. While many libraries reject such
# public keys, doing so is not a strict requirement according to RFC 7748.
# Some libraries include a check that the shared secret is not all-zero. This
# check is described in Section 6.1 of RFC 7748.
# tcId = 166
# D = 0 in multiplication by 2
private = c0f9c60aea73731d92ab5ed9f4cea122f9a6eb2577bda72f94948fea4d4cc65d
public = 5f9c95bca3508c24b1d0b1559c83ef5b04445cc4581c8e86d8224eddd09f1157
result = acceptable
shared = 0000000000000000000000000000000000000000000000000000000000000000
# The curves and its twists contain some points of low order. This test vector
# contains a public key with such a point. While many libraries reject such
# public keys, doing so is not a strict requirement according to RFC 7748.
# Some libraries include a check that the shared secret is not all-zero. This
# check is described in Section 6.1 of RFC 7748.
# tcId = 167
# special case for DA - CB in multiplication by 2
private = 0066dd7674fe51f9326c1e239b875f8ac0701aae69a804c25fe43595e8660b45
public = b0224e7134cf92d40a31515f2f0e89c2a2777e8ac2fe741db0dc39399fdf2702
result = acceptable
shared = 8dacfe7beaaa62b94bf6e50ee5214d99ad7cda5a431ea0c62f2b20a89d73c62e
# Public keys are either points on a given curve or points on its twist. The
# functions X25519 and X448 are defined for points on a twist with the goal that
# the output of computations do not leak private keys. Implementations may
# accept or reject points on a twist. If a point multiplication is performed
# then it is important that the result is correct, since otherwise attacks with
# invalid keys are possible.
# tcId = 168
# special case for DA - CB in multiplication by 2
private = 80067f30f40d61318b420c859fce128c9017ab81b47b76028a57bc30d5856846
public = 601e3febb848ec3e57fce64588aad82afc9c2af99bbcdffcc4cd58d4b3d15c07
result = valid
shared = 20f1d3fe90e08bc6f152bf5dacc3ed35899785333f1470e6a62c3b8cbe28d260
# tcId = 169
# special case for DA - CB in multiplication by 2
private = 584577669d21ce0ae3e30b02c9783ffe97709cbfe396889aa31e8ee43352dc52
public = 82a3807bbdec2fa9938fb4141e27dc57456606301f78ff7133cf24f3d13ee117
result = acceptable
shared = 2b28cc5140b816add5ad3a77a81b1c073d67bf51bf95bda2064a14eb12d5f766
# Public keys are either points on a given curve or points on its twist. The
# functions X25519 and X448 are defined for points on a twist with the goal that
# the output of computations do not leak private keys. Implementations may
# accept or reject points on a twist. If a point multiplication is performed
# then it is important that the result is correct, since otherwise attacks with
# invalid keys are possible.
# tcId = 170
# special case for DA - CB in multiplication by 2
private = 18e597a4e2ccdb5e8052d57c9009938c2d4c43d6d8c9f93c98727b7311035953
public = f329ab2376462e5f3128a2682086253c19222ac1e2bca45692f0c3b528f4c428
result = valid
shared = 8392160083b9af9e0ef44fcfce53ba8ff7282ee7a6c71ab66f8843a55d09cd68
# tcId = 171
# special case for DA in multiplication by 2
private = 88281cc51d5512d8814ea5249b879dcbad0323d38512dafbdc7ba85bba8c8d5d
public = 4fce3bb6c8aaf022dbd100e3cde3941b37d543f00401dba7da9bc143dfc55709
result = valid
shared = 42184e22c535530c457bd3b4f1084cbf5e297f502fe136b8d1daecf5334cc96c
# tcId = 172
# special case for DA in multiplication by 2
private = d0e795450df0a813c6573496ec5793ca02e1bdbad10ed08df83fdaed68b3385f
public = 15c68851c1db844b5a1ef3456a659f188854b1a75fbdb2f68f514c9289ce711f
result = valid
shared = f654d78e5945b24bc63e3e6d790e0ae986e53937764068b1bce920e1d79b756f
# tcId = 173
# special case for DA in multiplication by 2
private = 30b69a1cc1eb2d0b83ea213846e90a2c922088bdf294a6995bf6e6e77c646c41
public = 4200a242434337b8914f49345301ed782b13594f9ede089c41fb1e7ea82c9053
result = valid
shared = cd8a09b04795edcc7061867373981aa748651ebdce5ec218a335b878cefe4872
# tcId = 174
# special case for DA in multiplication by 2
private = 78b30bb63cd8ade71b7a77d426f4419d05f199ffef349e89faa9d9a5f21f6654
public = baabf0174aaaea4de48cc83adfb0401461a741903ea6fb130d7d64b7bf03a966
result = valid
shared = c9f8258f237db1c80702c5c4d9048dfba9dfe259da4aeee90dc2945526961275
# tcId = 175
# special case for x_2 in multiplication by 2
private = c0b386f4ef0d4698686404977e7b60cb6c1f8b6012a22e29d6224c5947439041
public = f12f18bd59c126348f6a7a9f4a5fdd9fcaf581345073a851fba098e5d64b4a0c
result = valid
shared = 6600cbe900616a770a126b8b19156d5e27e1174bd538d0944eb3c0be4899c758
# tcId = 176
# special case for x_2 in multiplication by 2
private = 9886602e719bacafea092bb75b51ae7258abe1a364c176857f3dc188c03e6759
public = bee386527b772490aeb96fc4d23b9304037cb4430f64b228f3d8b3b498319f22
result = acceptable
shared = 3fe710d6344ff0cb342e52349e1c5b57b7a271f2a133bb5249bbe40dc86e1b40
# Public keys are either points on a given curve or points on its twist. The
# functions X25519 and X448 are defined for points on a twist with the goal that
# the output of computations do not leak private keys. Implementations may
# accept or reject points on a twist. If a point multiplication is performed
# then it is important that the result is correct, since otherwise attacks with
# invalid keys are possible.
# tcId = 177
# special case for x_2 in multiplication by 2
private = b83960f5d0613cdaac6dda690351666e9f277bba6bd406b0e27a1886bb2d3e46
public = cf911ac91b0d944049cec66ae5ef0c4549d1e612e107c68e87263a2fbcf8323f
result = valid
shared = 71373ebe67f39a2c230027c7db4b3b74bab80ed212b232679785ee10f47c304e
# tcId = 178
# special case for x_2 in multiplication by 2
private = d03b75f09ac807dfd2ee352c04a1f25984720f785ffaa0af88bc5db6ff9c3453
public = 1e6ee536e4f26bbfb63139951a10f3bab62e19ed1ef8397178d9c5d04307cd40
result = valid
shared = 238eef43c589822e1d3de41c1cc46dcfec7a93febf37c8546b6625e1a123815d
# tcId = 179
# special case for x_2 in multiplication by 2
private = d036948c0ec223f0ee577e390dbf87222358ed199f2823345ad154bbc4cbcc47
public = 2f1c79ad8488db6f5146903b2dc46cfbfc834bbcf09b4dd70c274c4b67ce605d
result = valid
shared = 87a79c9c231d3b9526b49bf3d683bf38c3c319af7c7c5d1456487398da535010
# tcId = 180
# special case for x_2 in multiplication by 2
private = d054ded613febf2950ac5c927fcb120c387de0ba61b331cd33024c8b6e737048
public = fccfe742a63ed9cb70958560b5a02260350a7ecbaf8c57ae045f671a29b4b573
result = valid
shared = d683ca6194452d878c12d7da35f22833f99728bba89931a51274f61210336a5f
# tcId = 181
# special case for AA in multiplication by 2
private = e82c480631fb153ba2211fe603032b3e71b162dbd3c11bec03208ffcd510655f
public = cb3d4a90f86b3011da3369d9988597c7fff1499273b4a04f84d0e26ed1683c0d
result = acceptable
shared = dbf6203516635840cf69a02db87cf0d95dae315da7fc1ec7ce2b29e1f2db6666
# Public keys are either points on a given curve or points on its twist. The
# functions X25519 and X448 are defined for points on a twist with the goal that
# the output of computations do not leak private keys. Implementations may
# accept or reject points on a twist. If a point multiplication is performed
# then it is important that the result is correct, since otherwise attacks with
# invalid keys are possible.
# tcId = 182
# special case for AA in multiplication by 2
private = c0c01d28c1cab01f59700aca5f18d2697658b37fdd54a339ff391c0a1a1b1645
public = 101e13f7bc0570fa2638caa20a67c6e0c21dab132f4b456191590264c493d018
result = acceptable
shared = 1fe314744390d525278b1f5fbf108101b8ded587081375ed4ac4ac690d92414f
# Public keys are either points on a given curve or points on its twist. The
# functions X25519 and X448 are defined for points on a twist with the goal that
# the output of computations do not leak private keys. Implementations may
# accept or reject points on a twist. If a point multiplication is performed
# then it is important that the result is correct, since otherwise attacks with
# invalid keys are possible.
# tcId = 183
# special case for AA in multiplication by 2
private = c82bde72df36479688c485a8bf442f4a34412e429c02db97704f03daf4dfd542
public = dce1ec0843fa8f05d9c7355df598391f3de254ecd0b4ba9e6ea6fd9b3b6c2f67
result = acceptable
shared = ad454395ee392be677be7b9cb914038d57d2d87ec56cc98678dd84f19920912b
# Public keys are either points on a given curve or points on its twist. The
# functions X25519 and X448 are defined for points on a twist with the goal that
# the output of computations do not leak private keys. Implementations may
# accept or reject points on a twist. If a point multiplication is performed
# then it is important that the result is correct, since otherwise attacks with
# invalid keys are possible.
# tcId = 184
# special case for AA in multiplication by 2
private = 503f697617fb02a7b8ef00ba34e7fc8ce93f9ec3e1cbfe4bf2c05bcee0cb9757
public = 21c2b56f0794cfee25cc9626677a6838000eb66d8c4b5fb07b2f1d912e97c372
result = valid
shared = c6d6499255133398f9dd7f32525db977a538118800bfaf3aad8bcd26f02c3863
# tcId = 185
# special case for BB in multiplication by 2
private = 58cd4ca1e4331188de2b2889419ce20ec5ef88a0e93af092099065551b904e41
public = cc3d4a90f86b3011da3369d9988597c7fff1499273b4a04f84d0e26ed1683c0d
result = valid
shared = 0d74214da1344b111d59dfad3713eb56effe7c560c59cbbb99ec313962dbba58
# tcId = 186
# special case for BB in multiplication by 2
private = 004ea3448b84ca509efec5fcc24c63ee984def63b29deb9037894709709c0957
public = 111e13f7bc0570fa2638caa20a67c6e0c21dab132f4b456191590264c493d018
result = acceptable
shared = 7b9dbf8d6c6d65898b518167bf4011d54ddc265d953c0743d7868e22d9909e67
# Public keys are either points on a given curve or points on its twist. The
# functions X25519 and X448 are defined for points on a twist with the goal that
# the output of computations do not leak private keys. Implementations may
# accept or reject points on a twist. If a point multiplication is performed
# then it is important that the result is correct, since otherwise attacks with
# invalid keys are possible.
# tcId = 187
# special case for BB in multiplication by 2
private = c8a6eb00a4d74bbdff239522c3c891ed7ce1904be2a329cd0ae0061a253c9542
public = dde1ec0843fa8f05d9c7355df598391f3de254ecd0b4ba9e6ea6fd9b3b6c2f67
result = valid
shared = fb0e0209c5b9d51b401183d7e56a59081d37a62ab1e05753a0667eebd377fd39
# tcId = 188
# special case for BB in multiplication by 2
private = 50322ff0d0dcdd6b14f307c04dfecefe5b7cdeaf92bffb919e9d62ed27079040
public = 22c2b56f0794cfee25cc9626677a6838000eb66d8c4b5fb07b2f1d912e97c372
result = valid
shared = dbe7a1fe3b337c9720123e6fcc02cf96953a17dc9b395a2206cb1bf91d41756e
# tcId = 189
# special case for D in multiplication by 2
private = e0328c7d188d98faf2ac72d728b7d14f2bbbd7a94d0fbd8e8f79abe0b1fe1055
public = e58baccede32bcf33b3b6e3d69c02af8284a9631de74b6af3f046a9369df040f
result = valid
shared = 97bd42093e0d48f973f059dd7ab9f97d13d5b0d5eedffdf6da3c3c432872c549
# tcId = 190
# special case for D in multiplication by 2
private = 5017679a17bd23adf95ad47e310fc6526f4ba9ca3b0839b53bd0d92839eb5b4f
public = c6d5c693fc0a4e2df6b290026860566a166b6d7aebe3c98828d492745c8df936
result = valid
shared = 99bcbc7b9aa5e25580f92bf589e95dae874b83e420225d8a93e18e96dac00b63
# tcId = 191
# special case for D in multiplication by 2
private = 2864aaf61c146df06cc256b065f66b34985cc015da5b1d647a6ed4e2c76bfc43
public = d15f4bf2ef5c7bda4ee95196f3c0df710df5d3d206360fc3174ea75c3aa3a743
result = valid
shared = afa2adb52a670aa9c3ec3020d5fda285474ede5c4f4c30e9238b884a77969443
# tcId = 192
# special case for D in multiplication by 2
private = 184a6cfbabcbd1507a2ea41f52796583dbdb851b88a85781ee8e3c28782c3349
public = 6dffb0a25888bf23cf1ac701bfbdede8a18e323b9d4d3d31e516a05fce7ce872
result = acceptable
shared = e6a2fc8ed93ce3530178fef94bb0056f43118e5be3a6eabee7d2ed384a73800c
# Public keys are either points on a given curve or points on its twist. The
# functions X25519 and X448 are defined for points on a twist with the goal that
# the output of computations do not leak private keys. Implementations may
# accept or reject points on a twist. If a point multiplication is performed
# then it is important that the result is correct, since otherwise attacks with
# invalid keys are possible.
# tcId = 193
# special case for D in multiplication by 2
private = c85f954b85bc102aca799671793452176538d077862ee45e0b253619767dff42
public = 21f86d123c923a92aaf2563df94b5b5c93874f5b7ab9954aaa53e3d72f0ff67e
result = acceptable
shared = 7fc28781631410c5a6f25c9cfd91ec0a848adb7a9eb40bc5b495d0f4753f2260
# Public keys are either points on a given curve or points on its twist. The
# functions X25519 and X448 are defined for points on a twist with the goal that
# the output of computations do not leak private keys. Implementations may
# accept or reject points on a twist. If a point multiplication is performed
# then it is important that the result is correct, since otherwise attacks with
# invalid keys are possible.
# tcId = 194
# special case for D in multiplication by 2
private = 50e3e5a9a19be2ee3548b0964672fb5e3134cb0d2f7adf000e4556d0ffa37643
public = 587c347c8cb249564ab77383de358cc2a19fe7370a8476d43091123598941c7f
result = valid
shared = 314d8a2b5c76cc7ee1217df2283b7e6724436e273aeb80628dce0600ab478a63
# tcId = 195
# special case for DA + CB in multiplication by 2
private = 08ece580bb6ddf96559b81d7a97dd4531def6cc78d448a70cebabdd26caab146
public = f5c6311a1dd1b9e0f8cfd034ac6d01bf28d9d0f962a1934ae2cb97cb173dd810
result = valid
shared = 2bfd8e5308c34498eb2b4daf9ed51cf623da3beaeb0efd3d687f2b8becbf3101
# tcId = 196
# special case for DA + CB in multiplication by 2
private = a886033e9dc2b6a913fffbc2bd402e8c11ec34d49c0dc0fa1429329b694a285f
public = 9316c06d27b24abc673ffb5105c5b9a89bdfaa79e81cdbb89556074377c70320
result = acceptable
shared = d53c3d6f538c126b9336785d1d4e6935dc8b21f3d7e9c25bc240a03e39023363
# Public keys are either points on a given curve or points on its twist. The
# functions X25519 and X448 are defined for points on a twist with the goal that
# the output of computations do not leak private keys. Implementations may
# accept or reject points on a twist. If a point multiplication is performed
# then it is important that the result is correct, since otherwise attacks with
# invalid keys are possible.
# tcId = 197
# special case for DA + CB in multiplication by 2
private = 98b1cc2020a8ec575d5c46c76024cf7c7ad7628eb909730bc4f460aaf0e6da4b
public = 8a4179807b07649e04f711bf9473a79993f84293e4a8b9afee44a22ef1000b21
result = acceptable
shared = 4531881ad9cf011693ddf02842fbdab86d71e27680e9b4b3f93b4cf15e737e50
# Public keys are either points on a given curve or points on its twist. The
# functions X25519 and X448 are defined for points on a twist with the goal that
# the output of computations do not leak private keys. Implementations may
# accept or reject points on a twist. If a point multiplication is performed
# then it is important that the result is correct, since otherwise attacks with
# invalid keys are possible.
# tcId = 198
# special case for DA + CB in multiplication by 2
private = c8e193de162aa349a3432c7a0c0521d92cbc5e3bf82615e42955dd67ec12345f
public = a773277ae1029f854749137b0f3a02b5b3560b9c4ca4dbdeb3125ec896b81841
result = acceptable
shared = 7ba4d3de697aa11addf3911e93c94b7e943beff3e3b1b56b7de4461f9e48be6b
# Public keys are either points on a given curve or points on its twist. The
# functions X25519 and X448 are defined for points on a twist with the goal that
# the output of computations do not leak private keys. Implementations may
# accept or reject points on a twist. If a point multiplication is performed
# then it is important that the result is correct, since otherwise attacks with
# invalid keys are possible.
# tcId = 199
# special case for DA + CB in multiplication by 2
private = 88e01237b336014075676082afbde51d595d47e1fa5214b51a351abbf6491442
public = 1eceb2b3763231bc3c99dc62266a09ab5d3661c756524cddc5aabcedee92da61
result = acceptable
shared = bcf0884052f912a63bbab8c5c674b91c4989ae051fa07fcf30cb5317fb1f2e72
# Public keys are either points on a given curve or points on its twist. The
# functions X25519 and X448 are defined for points on a twist with the goal that
# the output of computations do not leak private keys. Implementations may
# accept or reject points on a twist. If a point multiplication is performed
# then it is important that the result is correct, since otherwise attacks with
# invalid keys are possible.
# tcId = 200
# special case for DA + CB in multiplication by 2
private = e82313e451a198dce4ae95c6832a8281d847fc87b28db00fe43757c16cc49c4a
public = 9a2acbb3b5a386a6102e3728be3a97de03981d5c71fd2d954604bee3d3d0ce62
result = acceptable
shared = e5772a92b103ee696a999705cf07110c460f0545682db3fac5d875d69648bc68
# Public keys are either points on a given curve or points on its twist. The
# functions X25519 and X448 are defined for points on a twist with the goal that
# the output of computations do not leak private keys. Implementations may
# accept or reject points on a twist. If a point multiplication is performed
# then it is important that the result is correct, since otherwise attacks with
# invalid keys are possible.
# tcId = 201
# special case for DA + CB in multiplication by 2
private = 2828594d16768e586df39601ecc86d3fad6389d872b53fca3edcaf6fb958f653
public = 27430e1c2d3089708bca56d7a5ad03792828d47685b6131e023dd0808716b863
result = acceptable
shared = 378c29e3be97a21b9f81afca0d0f5c242fd4f896114f77a77155d06ce5fbfa5e
# Public keys are either points on a given curve or points on its twist. The
# functions X25519 and X448 are defined for points on a twist with the goal that
# the output of computations do not leak private keys. Implementations may
# accept or reject points on a twist. If a point multiplication is performed
# then it is important that the result is correct, since otherwise attacks with
# invalid keys are possible.
# tcId = 202
# special case for z_2 in multiplication by 2
private = a84f488e193139f986b0e5b249635b137d385e420342aef1f194fcde1fe5e850
public = 4ef367901aac8ba90a50e0cf86ca4e4a3ff164fb121605be346e2e48d04ac912
result = valid
shared = 7eb48a60b14fb9ea5728f6410aef627d1522fad481b934af64e2c483b64d585f
# tcId = 203
# special case for z_2 in multiplication by 2
private = 30fd2a781e095c34a483907b3dd2d8bd2736e279617bfa6b8b4e0e1cf90fbd46
public = d1de303c4ddd05d57c29df92ad172dd8c8f424e63ec93445beaea44f9d124b17
result = valid
shared = b71bdbed78023a06deed1c182e14c98f7cf46bc627a4a2c102ad23c41cf32454
# tcId = 204
# special case for z_2 in multiplication by 2
private = 28312e17b47dd32d90561168245187963c7469a31c881e4a5c94384262b71959
public = 5bccd739fd7517d9344bf6b2b0f19a1e0c38d9349a25ad1f94af4a2cdcf5e837
result = valid
shared = 5bb56877caf2cdac98611b60367fbb74265984614e5e73996e8ea1bd6f749f1a
# tcId = 205
# special case for z_2 in multiplication by 2
private = a87640cf8237b473c638b3e9df08644e8607e563b5964363ccc42133b2996742
public = 8a7a939310df7ea768454df51bcd0dfbd7be4fcbb2ffc98429d913ec6911f337
result = acceptable
shared = b568ed46d04f6291f8c176dca8aff6d221de4c9cce4b404d5401fbe70a324501
# Public keys are either points on a given curve or points on its twist. The
# functions X25519 and X448 are defined for points on a twist with the goal that
# the output of computations do not leak private keys. Implementations may
# accept or reject points on a twist. If a point multiplication is performed
# then it is important that the result is correct, since otherwise attacks with
# invalid keys are possible.
# tcId = 206
# special case for z_2 in multiplication by 2
private = 780c5b882720d85e5ddfaf1033e9a1385df9e21689eeda4dcc7444ad28330a50
public = fe3590fc382da7a82e28d07fafe40d4afc91183a4536e3e6b550fee84a4b7b4b
result = acceptable
shared = 11fb44e810bce8536a957eaa56e02d04dd866700298f13b04ebeb48e20d93647
# Public keys are either points on a given curve or points on its twist. The
# functions X25519 and X448 are defined for points on a twist with the goal that
# the output of computations do not leak private keys. Implementations may
# accept or reject points on a twist. If a point multiplication is performed
# then it is important that the result is correct, since otherwise attacks with
# invalid keys are possible.
# tcId = 207
# special case for z_2 in multiplication by 2
private = 209e5e0ae1994bd859ce8992b62ec3a66df2eb50232bcc3a3d27b6614f6b014d
public = fad9ab3e803b49fc81b27ee69db6fc9fdb82e35453b59ef8fab2a3beb5e1134c
result = acceptable
shared = 85d9db8f182bc68db67de3471f786b45b1619aec0f32b108ace30ee7b2624305
# Public keys are either points on a given curve or points on its twist. The
# functions X25519 and X448 are defined for points on a twist with the goal that
# the output of computations do not leak private keys. Implementations may
# accept or reject points on a twist. If a point multiplication is performed
# then it is important that the result is correct, since otherwise attacks with
# invalid keys are possible.
# tcId = 208
# special case for z_2 in multiplication by 2
private = 806d1dee5ff6aea84a848916991a89ef3625583e1bd4ae0b3dd25c2524a4ff46
public = 98bed955f1516c7a442751ac590046d7d52ca64f76df82be09d32e5d33b49073
result = valid
shared = 61d4ef71cbe7be3128be829ab26ed3463eb4ab25937c309788e876b23412aa7c
# tcId = 209
# special case for z_2 in multiplication by 2
private = 00f98b02ae0df5274cc899f526eb1b877289e0963440a57dd97e414cdd2f7c51
public = e59be4917b3f05b6fc8748c9b90f1b910273c9c6e17ff96ef415ff3d927d987e
result = valid
shared = 5ba4394ed1a664811b01557944becf7585652a8acbdbf806742911207bd79346
# tcId = 210
# special case for A in multiplication by 2
private = d86c18f2be396b3bb72f22e6ece22e273af6e1506a1c09ad4d01bdd2f439f843
public = 8c9885a26cb334054700a270f7a5f4aac06bad8263b651ebf0712eca1ebb6416
result = acceptable
shared = a5952588613eb7a5cd49dd526f1f20a4f0ffe9423e82cea302c2dd90ce559955
# Public keys are either points on a given curve or points on its twist. The
# functions X25519 and X448 are defined for points on a twist with the goal that
# the output of computations do not leak private keys. Implementations may
# accept or reject points on a twist. If a point multiplication is performed
# then it is important that the result is correct, since otherwise attacks with
# invalid keys are possible.
# tcId = 211
# special case for A in multiplication by 2
private = f81aadb9053eb698996d0f781d9cda67f82ddefa3987d276ff5a94ffdf5d255f
public = f6135fe9741c2c9de7dcf7627ef08832f351cb325dbb3a26f93a2b48620e1727
result = acceptable
shared = cb6fb623084b6197443ec9ba1050c0923332e5e829ae0194269cfaf920a43601
# Public keys are either points on a given curve or points on its twist. The
# functions X25519 and X448 are defined for points on a twist with the goal that
# the output of computations do not leak private keys. Implementations may
# accept or reject points on a twist. If a point multiplication is performed
# then it is important that the result is correct, since otherwise attacks with
# invalid keys are possible.
# tcId = 212
# special case for A in multiplication by 2
private = 305b4db4321b4923fc559bf91df677d0e12c3a31b16ec655cb708b759d7c114d
public = f6ffffffffffffffffffffffffffffbfffffffffffffffffffffffffffffff3f
result = valid
shared = 9e526079c2fcf12426ae6c2a54b5ffb70f2ec662e29ea5ce0c8385c3b21cd162
# tcId = 213
# special case for A in multiplication by 2
private = 900638d1979802db9b52e4dd84fa19579f61cd7bef3c0b62fcccaeaa15fa484d
public = f6ffffffffffffffffffffffffffff3f00000000000000000000000000000040
result = valid
shared = 6329c7dc2318ec36153ef4f6f91bc6e7d1e008f5293065d9586ab88abb58f241
# tcId = 214
# special case for A in multiplication by 2
private = 38575cf7c8691ecc79cd5f8d7d4703aa48592ff6e7f64731c2d98a19aeae514f
public = f6eba0168be3d3621823089d810f77cd0cae34cda244c5d906c5d4b79df1e858
result = valid
shared = 603f4fc410081f880944e0e13d56fc542a430eec813fad302b7c5ac380576f1c
# tcId = 215
# special case for A in multiplication by 2
private = e88bd02c7016547a24f428bc2a9dcccad6c6f880c17bffcf66fc68459627af4e
public = 60677a5d934ccbfab8ff5d8f085a0b553f94527d9c49ae140f8ed135e1449b69
result = acceptable
shared = 834bbad5470e1498c4b0148782dfe630e8bfadff1997de802ac8ce302a1bda28
# Public keys are either points on a given curve or points on its twist. The
# functions X25519 and X448 are defined for points on a twist with the goal that
# the output of computations do not leak private keys. Implementations may
# accept or reject points on a twist. If a point multiplication is performed
# then it is important that the result is correct, since otherwise attacks with
# invalid keys are possible.
# tcId = 216
# special case for B in multiplication by 2
private = 9036ed7d68f7448ac440dc51216b49840dcabd3d5e32e3b4ffc32a5fe9e96742
public = 8d9885a26cb334054700a270f7a5f4aac06bad8263b651ebf0712eca1ebb6416
result = acceptable
shared = ec9070ad3491a5ff50d7d0db6c9c844783dde1c6fbd4fe163e9ade1ce9cd041d
# Public keys are either points on a given curve or points on its twist. The
# functions X25519 and X448 are defined for points on a twist with the goal that
# the output of computations do not leak private keys. Implementations may
# accept or reject points on a twist. If a point multiplication is performed
# then it is important that the result is correct, since otherwise attacks with
# invalid keys are possible.
# tcId = 217
# special case for B in multiplication by 2
private = 90c55e77aa0fe4afb1287109fd010f526364dea18d88e2fd870ac01b66e3fa4e
public = f7135fe9741c2c9de7dcf7627ef08832f351cb325dbb3a26f93a2b48620e1727
result = acceptable
shared = dc6d05b92edcdb5dc334b1fc3dff58fe5b24a5c5f0b2d4311555d0fc945d7759
# Public keys are either points on a given curve or points on its twist. The
# functions X25519 and X448 are defined for points on a twist with the goal that
# the output of computations do not leak private keys. Implementations may
# accept or reject points on a twist. If a point multiplication is performed
# then it is important that the result is correct, since otherwise attacks with
# invalid keys are possible.
# tcId = 218
# special case for B in multiplication by 2
private = a021ba2fd4e3ad57bcbf204d6f6c3e8018d8978552633b6dff1b7447bf529459
public = f7ffffffffffffffffffffffffffffbfffffffffffffffffffffffffffffff3f
result = valid
shared = 1b174b189981d81bc6887932083e8488df8bbbed57f9214c9cfa59d59b572359
# tcId = 219
# special case for B in multiplication by 2
private = 3035083e984837587f6b7346af871bf3fc9581c50eb55c83aefabeed68cee349
public = f7ffffffffffffffffffffffffffff3f00000000000000000000000000000040
result = valid
shared = 15a052148abaad1b0f2e7481a34edb61403589439b5bd5e5646cecebe2a1be2b
# tcId = 220
# special case for B in multiplication by 2
private = 30435ce187f2723f9a3bdea0eef892207e152e4cee8985fa72d2db4147bd2a53
public = f7eba0168be3d3621823089d810f77cd0cae34cda244c5d906c5d4b79df1e858
result = valid
shared = 1d048cbe2f8df07c233a8f93706f307d17130c2497fb752eeaa31fe3edfc725a
# tcId = 221
# special case for B in multiplication by 2
private = 580f0a9bba7281a30fb033490e0f429f22e3f267852caeacefa3e5291f0e614e
public = 61677a5d934ccbfab8ff5d8f085a0b553f94527d9c49ae140f8ed135e1449b69
result = acceptable
shared = cb92a98b6aa99ac9e3c5750cea6f0846b0181faa5992845b798923d419e82756
# Public keys are either points on a given curve or points on its twist. The
# functions X25519 and X448 are defined for points on a twist with the goal that
# the output of computations do not leak private keys. Implementations may
# accept or reject points on a twist. If a point multiplication is performed
# then it is important that the result is correct, since otherwise attacks with
# invalid keys are possible.
# tcId = 222
# special case for C in multiplication by 2
private = 709098feb2e25c67b4bfd3be0a01af409adb6da52b3fbe3d970642dd2c983856
public = c8239b710136fe431fb4d98436157e47c9e78a10f09ff92e98baff159926061c
result = acceptable
shared = f1bd12d9d32c6f4c5b2dcb3a5c52d9fd454d52ca704c2c137956ec8ad9aef107
# Public keys are either points on a given curve or points on its twist. The
# functions X25519 and X448 are defined for points on a twist with the goal that
# the output of computations do not leak private keys. Implementations may
# accept or reject points on a twist. If a point multiplication is performed
# then it is important that the result is correct, since otherwise attacks with
# invalid keys are possible.
# tcId = 223
# special case for C in multiplication by 2
private = 185ac62e729f88528950926c0de7c481c924bf9cf26a122f443b861e8b6af640
public = b7a2f79e0de9b58147691b5546d9ec463da8325e1440e58bb20aa129d1b97327
result = valid
shared = e6f1c494c9e4bd2325c17183e82d31ab0bbee6c847d4b0e4a99c7c6891117c3f
# tcId = 224
# special case for C in multiplication by 2
private = f03743eead7c2f7719794324f271072817d1a04cbda42b232f3bee43f397cc40
public = 2dc624e1663f42a7b9336350f277541b50b8ddc7ee0d86133ad53273aed4e62e
result = valid
shared = aa2a12edf752d279bdb000fb1405a5df8c5f1d41309b4f2bd41aed7ac1ed0149
# tcId = 225
# special case for C in multiplication by 2
private = a8fbb4f90da45794981405d59ef310621e3c3b6b7760b5e30308c7822c88ae5f
public = 0e5eceee9104a64f82c9093b9bf7b4076ee5bc70815af7ee9f942ef015756176
result = valid
shared = 74d5606ba0b6ad1d8ba36ae6f264d6315f479b3984de573e9b001e0555247c32
# tcId = 226
# special case for CB in multiplication by 2
private = c887886fd07107c7221f6d9dd36c305ec779ceca132ac933ff77dab2beac6345
public = 737d45477e2beb77a6c38b98e2a19b05c395df7da998cb91f6dfab5819614f27
result = acceptable
shared = 8cf4538ae5f445cc6d273df4ad300a45d7bb2f6e373a562440f1b37773904e32
# Public keys are either points on a given curve or points on its twist. The
# functions X25519 and X448 are defined for points on a twist with the goal that
# the output of computations do not leak private keys. Implementations may
# accept or reject points on a twist. If a point multiplication is performed
# then it is important that the result is correct, since otherwise attacks with
# invalid keys are possible.
# tcId = 227
# special case for CB in multiplication by 2
private = 58096ee29361978f630ad1fb00c1267c5a901f99c502f9569b933ad0dcce0f50
public = 873f8b260ea9d9ddac08b7b030727bf0072315ab54075ecc393a37a975882b7e
result = valid
shared = d5766753211d9968de4ac2559998f22ef44e8aa879f3328cbc46aa858dcb433c
# tcId = 228
# special case for CB in multiplication by 2
private = 0829a49046dce2c07ab28440dbad146453e128960e85dd2e6a69a1512873dd44
public = 75e1587c5eefc83715d71020aa6be5347bb9ec9d91ce5b28a9bbb74c92ef407e
result = valid
shared = 761d8cecf13f93b379a772e5fac5b9ffe996cad9af06152580afe87ff9651c71
# tcId = 229
# special case for x_2 in multiplication by 3
private = 587ac36b9a23594632679adea1a826f2f62d79738220fb487464039f36ca2372
public = f85a06065ea2527238fc5ec1b75ead9262e6b1aed61feff83b91230aeb4b7d01
result = acceptable
shared = f12acd36f6299a4d192c03aa4efeea7df51e2d15d763172e68accf7bc6f5c230
# Public keys are either points on a given curve or points on its twist. The
# functions X25519 and X448 are defined for points on a twist with the goal that
# the output of computations do not leak private keys. Implementations may
# accept or reject points on a twist. If a point multiplication is performed
# then it is important that the result is correct, since otherwise attacks with
# invalid keys are possible.
# tcId = 230
# special case for x_2 in multiplication by 3
private = a8a442b7c0a99227b4cb5c75fb9e5a72cea25eba8a0bdf07271bb4a93c2b6665
public = 6e0f1d00b1099d2a71f7be86655feb8988bba5577b02f964043a49f00c749613
result = valid
shared = b2bbbd173f41d952d329251da973a9500300628177ad0fb79d01e2e263905b38
# tcId = 231
# special case for x_2 in multiplication by 3
private = d8f7233e9612c00c9dca2c751ec1d3f5f67bad77c2e714a20e71eb3f220a6671
public = 696757ced3097fa960c8390a09e8bd6d390dbde8d1fa170261f3422edc192929
result = acceptable
shared = 45ecfa275f1daa25d3fadf33cdf89a152afea25eae37e68e00b30c367789887a
# Public keys are either points on a given curve or points on its twist. The
# functions X25519 and X448 are defined for points on a twist with the goal that
# the output of computations do not leak private keys. Implementations may
# accept or reject points on a twist. If a point multiplication is performed
# then it is important that the result is correct, since otherwise attacks with
# invalid keys are possible.
# tcId = 232
# special case for x_2 in multiplication by 3
private = d80c7c7557c9907e1b11e844bf1369cba669bc38e9b7b253e51f239bda322374
public = fd84b3f2fbfa16aebf40c27f46e18d77bafa0c7971bedde4909212e771bd3c35
result = acceptable
shared = 595e144e07bbe65b38e0e4163d02ad75a65e422e74067db35c90dfa6e055d456
# Public keys are either points on a given curve or points on its twist. The
# functions X25519 and X448 are defined for points on a twist with the goal that
# the output of computations do not leak private keys. Implementations may
# accept or reject points on a twist. If a point multiplication is performed
# then it is important that the result is correct, since otherwise attacks with
# invalid keys are possible.
# tcId = 233
# special case for x_2 in multiplication by 3
private = 8002a85115ad7b41c50f84f35fac750ee8e19734807102830ff6a306beed4464
public = 805485703ccfc4a221ef281267f52b61cebc879f0f13b1e5f521c17352a0784f
result = acceptable
shared = 226e16a279ac81e268437eb3e09e07406324cb72a9d4ee58e4cf009147497201
# Public keys are either points on a given curve or points on its twist. The
# functions X25519 and X448 are defined for points on a twist with the goal that
# the output of computations do not leak private keys. Implementations may
# accept or reject points on a twist. If a point multiplication is performed
# then it is important that the result is correct, since otherwise attacks with
# invalid keys are possible.
# tcId = 234
# special case for x_2 in multiplication by 3
private = 782db0c8e3e68f106fe0c56415e0bd13d812dea0e94cbd18bdf6761295613a6d
public = 80642a3279da6bf5fc13db14a569c7089db014225cfcae7dff5a0d25ecc9235b
result = acceptable
shared = 790d09b1726d210957ce8f65869ca1ec8fa0b2b06b6bcf9483b3eb55e49e9272
# Public keys are either points on a given curve or points on its twist. The
# functions X25519 and X448 are defined for points on a twist with the goal that
# the output of computations do not leak private keys. Implementations may
# accept or reject points on a twist. If a point multiplication is performed
# then it is important that the result is correct, since otherwise attacks with
# invalid keys are possible.
# tcId = 235
# special case for z_2 in multiplication by 3
private = 909fb0bdbf53a69a2fe39c8b2497abd4fa57d2d54e046b5f514595e2c0f33d63
public = 84e827f78cae0cf063e4340198f788c284e07430b3a94a3873df38b1f872ce02
result = valid
shared = 684cc83af806bcd9cd251e1858f3c10f0166e0a0cd2be154339a886b13e7c76f
# tcId = 236
# special case for z_2 in multiplication by 3
private = 78a67909757248665f79371eb014825ab6bd4af3571f140389c636e004bcf46b
public = d445e1df0083bb6b8e886e6632251807171d4e88c41816fc684373c09d7e5d6e
result = valid
shared = e426e4a3c54d3e77f4f157301e0ac7d9e12337a2b58df16780041cf6d6198c5a
# tcId = 237
# special case for z_2 in multiplication by 3
private = 286a302d5b076d2aba7c2a4daf9e7cc9d8539b7c0391307db65a2f4220d30f70
public = f26aa6151a4b22390176f6233e742f40f2ecd5137166fb2e1ec9b2f2454ac277
result = acceptable
shared = 862df92e25277bd94f9af2e1dda51f905a6e2a3f6068a92fabfc6c53da21ec11
# Public keys are either points on a given curve or points on its twist. The
# functions X25519 and X448 are defined for points on a twist with the goal that
# the output of computations do not leak private keys. Implementations may
# accept or reject points on a twist. If a point multiplication is performed
# then it is important that the result is correct, since otherwise attacks with
# invalid keys are possible.
# tcId = 238
# special case for DA - CB in multiplication by 3
private = a838b70d17161cb38222f7bc69a3c8576032d580275b3b7d63fba08908cb4879
public = 2b02db3c82477fe21aa7a94d85df379f571c8449b43cbd0605d0acc53c472f05
result = valid
shared = 3f438dbf03947995c99fd4cb366ca7e00e8cfbce64c3039c26d9fad00fa49c70
# tcId = 239
# special case for DA - CB in multiplication by 3
private = b0733b4203267ab3c94c506acadb949a76cc600486fcd601478fcdef79c29d6c
public = d71dd7db122330c9bbaab5da6cf1f6e1c25345ee6a66b17512b1804ace287359
result = acceptable
shared = 95f3f1849b0a070184e6077c92ae36ba3324bf1441168b89bb4b9167edd67308
# Public keys are either points on a given curve or points on its twist. The
# functions X25519 and X448 are defined for points on a twist with the goal that
# the output of computations do not leak private keys. Implementations may
# accept or reject points on a twist. If a point multiplication is performed
# then it is important that the result is correct, since otherwise attacks with
# invalid keys are possible.
# tcId = 240
# special case for BB in multiplication by 3
private = d844a36b58aefdb08b981796029a2766101884b348f70eed947c2541064caf6a
public = 737bc07de0729bbcfbee3a08e696f97f3770577e4b01ec108f59caf46406d205
result = acceptable
shared = 6a969af6d236aba08fa83160f699e9ed76fb6355f0662f03dbc5915a3c23063e
# Public keys are either points on a given curve or points on its twist. The
# functions X25519 and X448 are defined for points on a twist with the goal that
# the output of computations do not leak private keys. Implementations may
# accept or reject points on a twist. If a point multiplication is performed
# then it is important that the result is correct, since otherwise attacks with
# invalid keys are possible.
# tcId = 241
# special case for BB in multiplication by 3
private = a0b7d312d9b832e124d1bc8cb21db545440e3cf14e7473ee9ccbe9b682f2156c
public = 9758061a7b3e2c02fb5c20875ae6b55b11fb6795990a0f4fdcd1147be5521607
result = valid
shared = ab39db4aa29ac4017c7446f1ad0c7daa9a37f1b6b4f2e9d2902ccefb84839d28
# tcId = 242
# special case for BB in multiplication by 3
private = 787f1ddd78cc6473d3e63949409ad3f35bfe0ce0738f255dee682f2bfbc80f7f
public = 37cd65d33036205f3449e8655a50d4b0c86fec02100b4f2db7da92dcf5e3aa0a
result = acceptable
shared = 13de41659e3e308d6e26c94282fcc3e0364ddf0809ddee6c8e7abb5091b02b00
# Public keys are either points on a given curve or points on its twist. The
# functions X25519 and X448 are defined for points on a twist with the goal that
# the output of computations do not leak private keys. Implementations may
# accept or reject points on a twist. If a point multiplication is performed
# then it is important that the result is correct, since otherwise attacks with
# invalid keys are possible.
# tcId = 243
# special case for BB in multiplication by 3
private = 4080ae60a85c1fa95aad9beabd98b405e7f28141bf08f2c9a4fdbde1c5680265
public = a9b6e8081460383adc587c8f91a02c59a7a35576ca62436ccd1b5fef1b92545d
result = acceptable
shared = 69ed8a0a27812ae6741474bd5c6a4e683a126649f7245aa0f91a3a384bcde25a
# Public keys are either points on a given curve or points on its twist. The
# functions X25519 and X448 are defined for points on a twist with the goal that
# the output of computations do not leak private keys. Implementations may
# accept or reject points on a twist. If a point multiplication is performed
# then it is important that the result is correct, since otherwise attacks with
# invalid keys are possible.
# tcId = 244
# special case for E in multiplication by 3
private = 08f9f4a4fac4db413315f74a59818b2452fc7b7685592e26556775f9b86d907f
public = fd1a2cd17a93f850deb8c45a2d34539232dfd8a558304209781c6cb58229870e
result = valid
shared = 010218bd67b1b92fee3e7fa4578c13617d73195de10279747e53ba01a254525a
# tcId = 245
# special case for E in multiplication by 3
private = 1888cfae3085867657b09435c42b74cc762457839451a3659db218d4214fdd63
public = b88119e5ae6d9e6b912d52524739e612ef19ab7e5dd3d946cb9bc003c378f81f
result = valid
shared = e6b298de9cb6358fbbb00f11890f5714a3858e8f05a2a8d1cf39fe78cc55dd4e
# tcId = 246
# special case for E in multiplication by 3
private = 789ce13ed007818d7a5181e629eed944a20a058cfe39669c9831bfa5215a1269
public = 7b70e29dce0479cde4a36c7f9786582f104bc0788f046b48af495e67bdb88f36
result = valid
shared = 967bbe298494b4a5f95853cfde9dc85970b2a4b5dd2c92782901e853957f5809
# tcId = 247
# special case for E in multiplication by 3
private = 00022b43775ab2f4b91bc1cb54c97f78026289eaaf02abeed04ca84f736c686c
public = 2a209e2ace0e3d6973ffbf7403f9857ff97a5fdcd27f2c7098b444fc3c166738
result = acceptable
shared = 9f66848681d534e52b659946ea2c92d2fabed43fe6e69032c11153db43dca75b
# Public keys are either points on a given curve or points on its twist. The
# functions X25519 and X448 are defined for points on a twist with the goal that
# the output of computations do not leak private keys. Implementations may
# accept or reject points on a twist. If a point multiplication is performed
# then it is important that the result is correct, since otherwise attacks with
# invalid keys are possible.
# tcId = 248
# special case for E in multiplication by 3
private = 8097a52fc562e8a516682f5363cc5e7c88e9c78e308df0deef40497b35cc127d
public = f50709aca7f314e8d05b5ff97a427e427bd5e85c4e86712125076a771be21448
result = valid
shared = ea7572e27a9120de1f13b85710ba69a3471b7b3f5d12bc430c12c4bbf8aa3957
# tcId = 249
# special case for E in multiplication by 3
private = 4028802030d8a8221a7160eebbf1846116c1c253abc467d6e43cb850f1459860
public = 0f13955978b93d7b9f9a2e70d96df922850a8ffd8412e236fb074aef99d37d54
result = valid
shared = e23d63a46be67c7443c07b9371ff6a06afcd7a5794bf2537926074b88190307a
# tcId = 250
# special case for E in multiplication by 3
private = d8515d45c7ab2b9529816543150068b8e4bb614cf2b68a8a99363975af503d74
public = 18ffe992a729ce70c3b7cdc55bab55f2210d279134b3082a9f682d3a0b131273
result = valid
shared = 33ccaf24e1e26290ed7e462093e9f77607ef52a0626b2cd2511c41cd24c13849
# tcId = 251
# special case for AA in multiplication by 3
private = d8815bd144518fa526befdd373f5f9cff254d5d3c4660e8a90ef2a22c6876a74
public = c3ba28057728d0533965ec34979fe7bd93cf6cb644e8da038baa87997b8dc20e
result = acceptable
shared = 74f95b4700f0185f33c5b5528ed5012a3363f8bbd6f6a840aa1f0f3bdb7c9650
# Public keys are either points on a given curve or points on its twist. The
# functions X25519 and X448 are defined for points on a twist with the goal that
# the output of computations do not leak private keys. Implementations may
# accept or reject points on a twist. If a point multiplication is performed
# then it is important that the result is correct, since otherwise attacks with
# invalid keys are possible.
# tcId = 252
# special case for AA in multiplication by 3
private = a82d996093eefdaf283f4049bba4f5af6ecc2e64894f325ee1f9ca1e156d0567
public = 4eb095a86d1e781bb182233075ebf1db109d57135bf91d54fdb18eb371427640
result = valid
shared = e9677b854851c41cc489e03981ae78690be6cbf0054ea9834759de3e27bcf03e
# tcId = 253
# special case for AA in multiplication by 3
private = c02609df3d5436c123dcd7ee11f23f1da321666c09f379d37914203340510861
public = 83f67d7c92b11c8fb072484642a01f43deb022b54d94a4015e39849a2e2e9555
result = acceptable
shared = f148716ebe7269a7076f0cf1f22b6978d3c7e3607b0bcc87a8c7a85b9fd20c2f
# Public keys are either points on a given curve or points on its twist. The
# functions X25519 and X448 are defined for points on a twist with the goal that
# the output of computations do not leak private keys. Implementations may
# accept or reject points on a twist. If a point multiplication is performed
# then it is important that the result is correct, since otherwise attacks with
# invalid keys are possible.
# tcId = 254
# special case for AA in multiplication by 3
private = a0e3b78c0f3be2a760b2c916f244df219624fdda2e9e31b15328f4a77690296a
public = 20cc75d376d8453b9d049c84f58eafcf61126c08a03661e735f0a8be228fd466
result = valid
shared = 1d5c123e88e9dc7a3b16ec90b60578dfca7e11eab9b88c6eca7bc33d91fde83b
# tcId = 255
# special case for AA in multiplication by 3
private = 701f130a290584cb28c7d6539506a1a054f926a17ef7c568ae43047c05e10f60
public = ef31b43d19c0a5434deb56129c16298a394a7032a2e52cb997476bdeca325b73
result = valid
shared = 2fc065ba8f5040a0a659f6f7330554bd1b9d7c893b91e316e0af90c37af4f135
# tcId = 256
# special case for AA in multiplication by 3
private = d0e67f68183a4c1aed9c56864b36278bb7bb75d57a78321bc7c24ff61636607a
public = d8c8e2c6f33a98525df3767d1d04430dab0bda41f1f904c95bc61cc122caca74
result = acceptable
shared = ef7612c156078dae3a81e50ef33951cab661fb07731d8f419bc0105c4d6d6050
# Public keys are either points on a given curve or points on its twist. The
# functions X25519 and X448 are defined for points on a twist with the goal that
# the output of computations do not leak private keys. Implementations may
# accept or reject points on a twist. If a point multiplication is performed
# then it is important that the result is correct, since otherwise attacks with
# invalid keys are possible.
# tcId = 257
# special case for AA in multiplication by 3
private = 88eb7775dacc32b045ceb35f261b3616315efa98b780e08c79d544edadb5467d
public = 1833619516b80db0c05b225509e6698df028d83b66ed6bac6f0f6308970d2c7d
result = acceptable
shared = a3cf3d81ec56896a68fca0da6335171d0c622568738c0db26fe117033726a049
# Public keys are either points on a given curve or points on its twist. The
# functions X25519 and X448 are defined for points on a twist with the goal that
# the output of computations do not leak private keys. Implementations may
# accept or reject points on a twist. If a point multiplication is performed
# then it is important that the result is correct, since otherwise attacks with
# invalid keys are possible.
# tcId = 258
# special case for AA in multiplication by 3
private = 7055b1c0576e7ab6c89fcc1ce49e79c8c371bf9fc2b22b8f8396a9b64c5ae26d
public = e2e989aad2397fc34b6cbe2db27d5ab69b28048383c91d9e8226d548253fab7e
result = valid
shared = e7f45823a45b6a46192b37d73e8609b5bda68cd7cfbdccaa49082080993e640f
# tcId = 259
# special case for D in multiplication by 4
private = 906a9bfcfd71014d18967680d4509eaa41c666424af98bf9ff7ff49eb1baba41
public = b9bd793624d6a7e808486110058853edb25e136bd4d6a795d6d2ef53b25e3804
result = acceptable
shared = 7c6148134c9e8b2ba5daeca41e6a1f3a82d8f75d0b292b23c40fe7f5ce0a2b7a
# Public keys are either points on a given curve or points on its twist. The
# functions X25519 and X448 are defined for points on a twist with the goal that
# the output of computations do not leak private keys. Implementations may
# accept or reject points on a twist. If a point multiplication is performed
# then it is important that the result is correct, since otherwise attacks with
# invalid keys are possible.
# tcId = 260
# special case for D in multiplication by 4
private = 28392b1b035a8465aa22aabb571061c6effeed40cc2530b628e4fd40395ae04a
public = e3f444e208da9043f3f74c20e28d7f404bb687a346709abcd555156f88607820
result = acceptable
shared = ea5e772bac4693ce69ea3ac761011fa7674037653a433c7f05456e7291cd3c4e
# Public keys are either points on a given curve or points on its twist. The
# functions X25519 and X448 are defined for points on a twist with the goal that
# the output of computations do not leak private keys. Implementations may
# accept or reject points on a twist. If a point multiplication is performed
# then it is important that the result is correct, since otherwise attacks with
# invalid keys are possible.
# tcId = 261
# special case for D in multiplication by 4
private = 78cbb35204cc88676c14e0ff18171392e998411b23d905d4c4dceab70511f442
public = 87b43f90f76d12fb3a469fa8687c27e369d4a82f95cf95e8dc3970de8f86d92b
result = acceptable
shared = 81c395aed5cc5f5e2a206a8a4cacecd501df5b81e49433835ad8a3779edffb30
# Public keys are either points on a given curve or points on its twist. The
# functions X25519 and X448 are defined for points on a twist with the goal that
# the output of computations do not leak private keys. Implementations may
# accept or reject points on a twist. If a point multiplication is performed
# then it is important that the result is correct, since otherwise attacks with
# invalid keys are possible.
# tcId = 262
# special case for D in multiplication by 4
private = a8225b49ef7b7330e3de787cbc40479644db7ab126370295c94189673430d745
public = 86441ea06c5cd2a34c6b51261e93a2f30ea7db0f74e14c42f0fc443c6735973c
result = acceptable
shared = 513eba5870dc5187e2552fe3ba8292b516d2af9ecb9a9bdc51eac2ce2de40112
# Public keys are either points on a given curve or points on its twist. The
# functions X25519 and X448 are defined for points on a twist with the goal that
# the output of computations do not leak private keys. Implementations may
# accept or reject points on a twist. If a point multiplication is performed
# then it is important that the result is correct, since otherwise attacks with
# invalid keys are possible.
# tcId = 263
# special case for D in multiplication by 4
private = 0841e1a5c7420b94b6cc6991316ebdd608626339c09d0f67b24088588b9d0d49
public = 4624aa4ae9d12725bf92b85f93e3e8cea16b7bd83fda0eb18fab2dbe0e8bf742
result = acceptable
shared = 983b7e236ffaddb4b759b7353fe87846f59fb6f28a3ed65c256176b6609b7c6e
# Public keys are either points on a given curve or points on its twist. The
# functions X25519 and X448 are defined for points on a twist with the goal that
# the output of computations do not leak private keys. Implementations may
# accept or reject points on a twist. If a point multiplication is performed
# then it is important that the result is correct, since otherwise attacks with
# invalid keys are possible.
# tcId = 264
# special case for D in multiplication by 4
private = 08ecf76e31a23039ea8a15ee474b6251a9d725bff1a5751eb5ecde9d7d4e2f49
public = a625a5b7a04cea462d123b485c39ea44a8079aa223c59e9ca97abcd30b500e4b
result = valid
shared = c941369b085c7465d50d23ceaf6717ab06e24638f217a7b8055ce8ebd3ca1225
# tcId = 265
# special case for D in multiplication by 4
private = 6038fb0a830d1001ca8ea74a613ea98f6ab8512644e55e8d45a29071bd4bef45
public = 8a5f2063f259f3317ae3e0b459f82c4677666e49a2eb9bf0369aee663631265b
result = acceptable
shared = a3f7e169db44d0d179c242e66347364ab92744dc6ad80e4775aef7f4ff9d5f34
# Public keys are either points on a given curve or points on its twist. The
# functions X25519 and X448 are defined for points on a twist with the goal that
# the output of computations do not leak private keys. Implementations may
# accept or reject points on a twist. If a point multiplication is performed
# then it is important that the result is correct, since otherwise attacks with
# invalid keys are possible.
# tcId = 266
# special case for D in multiplication by 4
private = c04cf129f0b33332e2654f8e45225c042d7fa6cbc793c88bd4c731985289b045
public = 54cfb6ad0d03e3115acafee12606397f2bb46a8c5f326a255c494118aead3b62
result = acceptable
shared = 401aabfbb73fe6694c446ecfffb43006427a9d4756e049a1ffc79578d62f1660
# Public keys are either points on a given curve or points on its twist. The
# functions X25519 and X448 are defined for points on a twist with the goal that
# the output of computations do not leak private keys. Implementations may
# accept or reject points on a twist. If a point multiplication is performed
# then it is important that the result is correct, since otherwise attacks with
# invalid keys are possible.
# tcId = 267
# special case for E in multiplication by 4
private = 3806b036c92d7bc0771998d24dbda2945b601d42449bd3ec4bbf3757d01b894d
public = 0ee3bee8cb3a0afcec22fa2233706e8ec29ccf1af212c0a674745ebba34f9d08
result = valid
shared = 20322dd024fb5a40f327cf7c00da203734c2a279b9666a9ff7d8527c927b675e
# tcId = 268
# special case for E in multiplication by 4
private = 380d9056b5a2f4b3dffb30e6ceb722ac4684245f1befafb5661bc8c7a9ad4c43
public = 797ec7512afbf0ad918d0e4947903be95234f3abf36750a8f854888d117b774e
result = valid
shared = 46152d59c2d2f3ecf03ce652d2b6978d401d5ede4570a6c911771bdcfb37cd41
# tcId = 269
# special case for E in multiplication by 4
private = 384929a42c8d8df146db9508e2f21a4e8cd4d99c1b1338df17a457e88afb0043
public = d570c7810f69e502b355253afa7c667bfa5060d90dc86e358ab445f6381e415d
result = valid
shared = 37567f7ec0449c7b823cf7b0e219e9dd880e56a1464d0417a9e67eff42332866
# tcId = 270
# special case for E in multiplication by 4
private = 48a986825b2680e2f2547ba75a9599b04ed57f8ed18d98e7099c544efbdf284b
public = 2c611cb94448f1c7822425a4cf5356236b90a555b1ed4747820ba7f739c8f57d
result = valid
shared = fbf6587ec181116cf1ace7dcd548029d69c130e50fcf6ad5dfcd25c23ee9f939
# tcId = 271
# special case for B in multiplication by 4
private = 98452ad7df4e26bc4b3d403f9ebf72bb2d7b6b7d5860dbf6fb9a4f78dc02704a
public = e559c417da7fd5851352f508b90031d49b5d2d0aac88a9c8b5fb6e80165ac10b
result = acceptable
shared = c7c6f6d7ce1e4f54c727e5900686c34e6a6953254bd470bbbf0c7c18bbddad73
# Public keys are either points on a given curve or points on its twist. The
# functions X25519 and X448 are defined for points on a twist with the goal that
# the output of computations do not leak private keys. Implementations may
# accept or reject points on a twist. If a point multiplication is performed
# then it is important that the result is correct, since otherwise attacks with
# invalid keys are possible.
# tcId = 272
# special case for B in multiplication by 4
private = a8dbc9be5034ed7fe7f469264f2135e9c67cd30f525570d2d841e4bdeac52349
public = 746d97e7774292a3d703f604e79d8764c99a6a2fe280eaa9811115f5e038f21a
result = acceptable
shared = cf7d2a66ea4dfed94469b2d343533ff302a576f8402ed2187904437038e54665
# Public keys are either points on a given curve or points on its twist. The
# functions X25519 and X448 are defined for points on a twist with the goal that
# the output of computations do not leak private keys. Implementations may
# accept or reject points on a twist. If a point multiplication is performed
# then it is important that the result is correct, since otherwise attacks with
# invalid keys are possible.
# tcId = 273
# special case for B in multiplication by 4
private = f8d26878dff25ced02d3b27ce74002695bb879b3c4328930934315ecae842b47
public = 1f354aa8ffc4eae2b40dad2ebf830db3feb07e2a1a2da39e55df87c8c613de1d
result = valid
shared = b204d3bbcbdc624f9f1a743fa3daa8f4c8785ed088d37d08cd13c601170a461b
# tcId = 274
# special case for B in multiplication by 4
private = d0f5e9c43c95b1ffc36f832b943601d5e17647f7d78e2e7710ace63ff274d447
public = 9c3f0023e1a4832586af2483bbec64ce9f06f3ea806d4019a5e4abb1b5627029
result = acceptable
shared = b9f21465615f39dddcc37520ce9b956f7de9883ac93a870d74e388b8e1775463
# Public keys are either points on a given curve or points on its twist. The
# functions X25519 and X448 are defined for points on a twist with the goal that
# the output of computations do not leak private keys. Implementations may
# accept or reject points on a twist. If a point multiplication is performed
# then it is important that the result is correct, since otherwise attacks with
# invalid keys are possible.
# tcId = 275
# special case for B in multiplication by 4
private = 700679e8c24df828f2e5212a3263d5e93ea61679988298bab3b480f46f961a48
public = d05656aa014d476022dfc55e8d3b4884ed0bdf85209be8b55351394d52be684b
result = valid
shared = 20f1fc613874495f20562c10b7a8be47bfc12c168d829d6321aa2de17060e40d
# tcId = 276
# special case for B in multiplication by 4
private = d0d077c9461f747e5660be85cc620428b4cefe805de0fd254adaa465ea5e784f
public = c4a19b8686e18c29359aa548427f06a368d55a8737483d4893523adac6795a4c
result = acceptable
shared = 652b18ffd41cfb7d1f0b6dc79baa3b2a392ef1617f5cf6259b5b4ff065916a16
# Public keys are either points on a given curve or points on its twist. The
# functions X25519 and X448 are defined for points on a twist with the goal that
# the output of computations do not leak private keys. Implementations may
# accept or reject points on a twist. If a point multiplication is performed
# then it is important that the result is correct, since otherwise attacks with
# invalid keys are possible.
# tcId = 277
# special case for B in multiplication by 4
private = 00711ac08ef88c3d43a3cbda67b6fe5f34f54723dbe6d725c8a3569070ab9a4e
public = 4989de79853ff35be8c9f92fc94674feef38a0e65788471c521f8e259adf015d
result = valid
shared = 679825c259392d86f8edb15328d4faf52300779d979a503a76e27be3d7a85e03
# tcId = 278
# special case for B in multiplication by 4
private = 989a75b40451139ec36ca6aa043765c61a18be323a5987fcb025c2dad8d4bd40
public = a981483cb0ea4385ffbb552826c3dd110d4ae89ff52ed0cd6018f99d3387987b
result = valid
shared = 9cadc14ac153fa383ef66d1833f589100dff90523272e32b06e2c6f1f4424040
# tcId = 279
# special case for BB in multiplication by 4
private = 90c3cfedd919a2ccd51fb455649e3ad2da1ef0ff619b59a7f9c55a68a8219645
public = 1df3dfdab74ff38177dac294b2da2f49a348bc3b3bc6ce9312bea5ef3ecdd30b
result = acceptable
shared = bcc95fb4890ed311f3fb4f44c2b60866cdddec97db820a7f79f475337e16284a
# Public keys are either points on a given curve or points on its twist. The
# functions X25519 and X448 are defined for points on a twist with the goal that
# the output of computations do not leak private keys. Implementations may
# accept or reject points on a twist. If a point multiplication is performed
# then it is important that the result is correct, since otherwise attacks with
# invalid keys are possible.
# tcId = 280
# special case for BB in multiplication by 4
private = e8fef5c9b60f84984e8836d535acb372096ba8159824a0b49a17eccda843bd41
public = fc6b718ba8b47d24b1cfd6b5d0dd8b20fd920960fabc302dbe4f93bd2a06e933
result = valid
shared = 06f1b495b04a0010845c9d39b13bf2784ade860d9632c8847618c0b34297c249
# tcId = 281
# special case for BB in multiplication by 4
private = c0e05bde7727db4e352b5e7f035327b4d86a42d513ca116e22d64a4ede56434a
public = b279b6c065f95c7040f148bcb4a3d310e34bdb005931a879be469573deedd041
result = acceptable
shared = cce7bb644df94501421db49d15e821c7b0aaabecdf8837ab989b1f23bac08f35
# Public keys are either points on a given curve or points on its twist. The
# functions X25519 and X448 are defined for points on a twist with the goal that
# the output of computations do not leak private keys. Implementations may
# accept or reject points on a twist. If a point multiplication is performed
# then it is important that the result is correct, since otherwise attacks with
# invalid keys are possible.
# tcId = 282
# special case for BB in multiplication by 4
private = d87308bf753573f596ac8330b204014b2152dbdfc9881a0d9975058582bdf646
public = 98e2cd4c10554e41b0a3e41082c8b6b61b55447d26c0aa97f9a06baeeb54b55b
result = valid
shared = 71fdd3405c30805701ae4dfad98c493aecfcf2e3b563e7068373c1b19137c268
# tcId = 283
# special case for BB in multiplication by 4
private = d80059a8a387e16f6ded6e7e980e806d1f78b470bb61103d0ca70623ccee8b4f
public = 872897f1bd1885da08b9d03e46811044fbb04186ba30c806f38b94ebdc27186a
result = acceptable
shared = bf280aeecb74ab34e1310aa6fe8dc972f94dc40c7f88b72137ccfe34ed343c13
# Public keys are either points on a given curve or points on its twist. The
# functions X25519 and X448 are defined for points on a twist with the goal that
# the output of computations do not leak private keys. Implementations may
# accept or reject points on a twist. If a point multiplication is performed
# then it is important that the result is correct, since otherwise attacks with
# invalid keys are possible.
# tcId = 284
# special case for x_2 in multiplication by 4
private = b0a4fe63515169bd82639b515ff7e5c4ac85bba0a53bbaca80477eb3b4250d44
public = c08f72760d9cb4a542aad6e2af777920c44563bd90356168c3608c6b9af2ef0f
result = acceptable
shared = 72566a91ccd2bcf38cf639e4a5fcb296f0b67de192c6091242a62fae467fb635
# Public keys are either points on a given curve or points on its twist. The
# functions X25519 and X448 are defined for points on a twist with the goal that
# the output of computations do not leak private keys. Implementations may
# accept or reject points on a twist. If a point multiplication is performed
# then it is important that the result is correct, since otherwise attacks with
# invalid keys are possible.
# tcId = 285
# special case for x_2 in multiplication by 4
private = 984256b12ef154ff6c2e1d030826164cba3614e3df7688d82b59e16201c9114d
public = 4f03849c24d584534d74302220cfdc90e1bc360bb5e297c0fd0fd5f8d799e416
result = valid
shared = 24acb4afa63919621df795206c3929b599ec9d253693895d51a0555072e89a34
# tcId = 286
# special case for x_2 in multiplication by 4
private = 6847141d5d4377af96a2a647c642ee81600fe48d3467e3a70f3ee312bb621742
public = 4959771a931e242d5713d5cb76f33310c6a283df16645604289553809cda6518
result = acceptable
shared = 5ba2112a41b5bb381f202446fa9f23c54d2de149f9ad233753417263840ea432
# Public keys are either points on a given curve or points on its twist. The
# functions X25519 and X448 are defined for points on a twist with the goal that
# the output of computations do not leak private keys. Implementations may
# accept or reject points on a twist. If a point multiplication is performed
# then it is important that the result is correct, since otherwise attacks with
# invalid keys are possible.
# tcId = 287
# special case for x_2 in multiplication by 4
private = e85f1164e2ab6faf62667c74b03ce529b49a0e2041b1ac0fa242e522d2b7694c
public = f6fe690cf547049635bb3a7785537b4379c9ee06b46120493b8bdb152e09c81d
result = acceptable
shared = a87c9fdf40c409b9edab481b2cc69687ee1ab92e340c3db0107d40b5de6e7a20
# Public keys are either points on a given curve or points on its twist. The
# functions X25519 and X448 are defined for points on a twist with the goal that
# the output of computations do not leak private keys. Implementations may
# accept or reject points on a twist. If a point multiplication is performed
# then it is important that the result is correct, since otherwise attacks with
# invalid keys are possible.
# tcId = 288
# special case for x_2 in multiplication by 4
private = 281e1bbfa711de69921a64c5d2183c338db5504606ce2b6b4ce1cdd54b41e14a
public = b468681a1275850c11d37ec736af939a75a7098514e04cfc1c6ca78239a88426
result = acceptable
shared = 3be98798f01e71639f3cb8fd4a17bf273e10c67f8974dd9802eed59d847d4020
# Public keys are either points on a given curve or points on its twist. The
# functions X25519 and X448 are defined for points on a twist with the goal that
# the output of computations do not leak private keys. Implementations may
# accept or reject points on a twist. If a point multiplication is performed
# then it is important that the result is correct, since otherwise attacks with
# invalid keys are possible.
# tcId = 289
# special case for x_2 in multiplication by 4
private = 20aacf1902b3cd609d7ee15cc96453cc22e2899d7d17852680f2a728bac6dc4a
public = 2d71e8457099e3f445f9e2a14f18b0f5914bb35f482f9c069b64bf63710d4228
result = valid
shared = 338c9917dbf11a0cabe8ad4a65959229bc00f99c211e752b20b8b49b87756d0b
# tcId = 290
# special case for x_2 in multiplication by 4
private = 009e8e9fa993804dce94cecb96b1de2568245a97059e4d7ae116ecdb1badd141
public = fa8f24e944de5d003746d4630350c0f4f6175a3269c19184824105398fbdd329
result = acceptable
shared = 56e2bfc7f6ab7da8fc734afc515e57d0794d002434f9bc8e18bd0b72c0df3c4a
# Public keys are either points on a given curve or points on its twist. The
# functions X25519 and X448 are defined for points on a twist with the goal that
# the output of computations do not leak private keys. Implementations may
# accept or reject points on a twist. If a point multiplication is performed
# then it is important that the result is correct, since otherwise attacks with
# invalid keys are possible.
# tcId = 291
# special case for x_2 in multiplication by 4
private = f01574643f231ffac055bd235ee74dd416b94c8e55a2ab2b4d13a8b788d90148
public = ae4e37ef53c79e25e8275a60f2fc1dfc277ebc5d3b88428c6432c3f98494212c
result = acceptable
shared = 17fa1276d9fd5025172736449a1c0ae33512e5037014a18db5903e47bb3bc950
# Public keys are either points on a given curve or points on its twist. The
# functions X25519 and X448 are defined for points on a twist with the goal that
# the output of computations do not leak private keys. Implementations may
# accept or reject points on a twist. If a point multiplication is performed
# then it is important that the result is correct, since otherwise attacks with
# invalid keys are possible.
# tcId = 292
# special case for x_2 in multiplication by 4
private = 3800a42659954281ca266d7cf1ea9db6d79891a406a70f9e84c3570a6a12d24e
public = 95e56a830792478f7c42504043a9cab8e2eebff5fd90983709e29e03c0a41b64
result = valid
shared = 167a3b2fdce9413c89ee892daf9f839a2eea80ea8044924035db1724a5b0217c
# tcId = 293
# special case for x_2 in multiplication by 4
private = 70a826b186962218dbafca113319daefb5ddf3cf14e15fe3faadc4c0a2e46648
public = 5f16aa7ccabf4da6b686bd28c7460e106bb1b97a823792527765c29a9ad8fc71
result = acceptable
shared = 30a4ba793f2dffe1700c61428b4d84b5fcd0aa99a23b903f84a48eca5cc9fb0a
# Public keys are either points on a given curve or points on its twist. The
# functions X25519 and X448 are defined for points on a twist with the goal that
# the output of computations do not leak private keys. Implementations may
# accept or reject points on a twist. If a point multiplication is performed
# then it is important that the result is correct, since otherwise attacks with
# invalid keys are possible.
# tcId = 294
# special case for DA + CB in multiplication by 4
private = a85a5eda0a269500b3ab0b58495fc254c2691028ac533494b5f86d44e9dc654c
public = 47fb78111805a11982a3d6c5d83e8e189e7fcc462c9abf805d3625be7a6eac11
result = valid
shared = 2bf9ab750bd58ff6f877b783eda45a71a65cc9b7c037fcfef4cb5f4c8842f529
# tcId = 295
# special case for DA + CB in multiplication by 4
private = 183f28ec867624ef5eca4827ed0714a5525ef21d5e35038b24d307a3391a2846
public = 03b8ca5efd1777d6d625a945db52b81f11214daf015d09fdc9df7d47b9850e31
result = valid
shared = 35e9289234bd5e531da65d161a065a14f785076088d741c9a2d886efd7d17921
# tcId = 296
# special case for DA + CB in multiplication by 4
private = 888c6444ff5eb482b2b10bd4e8a01bdccb65f32934d8026106f16a91349f484c
public = 4eca5f8731b0fa0c106acf578b83a350fa8173a290f1eba803956de34eeb7671
result = acceptable
shared = 833afb867054b8b9ac70d6013c163e8b7676fd45ae49a1325f3acb75975d8c13
# Public keys are either points on a given curve or points on its twist. The
# functions X25519 and X448 are defined for points on a twist with the goal that
# the output of computations do not leak private keys. Implementations may
# accept or reject points on a twist. If a point multiplication is performed
# then it is important that the result is correct, since otherwise attacks with
# invalid keys are possible.
# tcId = 297
# special case for A in multiplication by 4
private = c8a85d140ba150f5c6a8d3cb363bcbcb75365e51c61640e974a0725b5e9d5940
public = a5562b4ba86b464dff4c2cfae85b384be211771efe8a9697e51d84de47f1eb14
result = valid
shared = 8a914760129575c8ab3270d04b0465fc2f327acaf1676463113803bbb2ec8021
# tcId = 298
# special case for A in multiplication by 4
private = 90a3aeb1417c3d61c1efef1ac052218fb55d3a59c4fe930b5a33cc5183b48547
public = 88ae1631cd08ab54c24a31e1fec860391fe29bc50db23eb66709362ec4264929
result = acceptable
shared = c1988b6e1f020151ec913b4fb2695bae2c21cc553d0f91cf0c668623a3e5a43d
# Public keys are either points on a given curve or points on its twist. The
# functions X25519 and X448 are defined for points on a twist with the goal that
# the output of computations do not leak private keys. Implementations may
# accept or reject points on a twist. If a point multiplication is performed
# then it is important that the result is correct, since otherwise attacks with
# invalid keys are possible.
# tcId = 299
# special case for A in multiplication by 4
private = b858d7414bd9ab9a3ebea79064ab87bc050e74407f4d4748f62fa4d9d203b640
public = cbc4d55d5bfddd0bc5c5edbe3a04836b2c701d25195b26221cbea19311e55a3d
result = valid
shared = bb24817bd9fff423dc0972908e2c03fddf4dbe100016b459f28fe9594adb3714
# tcId = 300
# special case for A in multiplication by 4
private = f825edf1f79eddd715a72b3ac267d6b2e97e18bb13bcafdac5940370b85ba64b
public = d66a2f9f7577e2df4a56cb51962b3056ff5cc0494c60f39511782e79923edd41
result = acceptable
shared = b3b4513f8a3102e1ae782fbc69888177f2c24c569303a5d01ab1c3c5e285524a
# Public keys are either points on a given curve or points on its twist. The
# functions X25519 and X448 are defined for points on a twist with the goal that
# the output of computations do not leak private keys. Implementations may
# accept or reject points on a twist. If a point multiplication is performed
# then it is important that the result is correct, since otherwise attacks with
# invalid keys are possible.
# tcId = 301
# special case for DA - CB in multiplication by 4
private = b0a710b470e324bb56a7d8ff8788d05eb327616129b84972482425ea4ad4f34b
public = de0fed2fab6e01492675bc75cbe45d7b45b0306cec8dc67611699811c9aaef16
result = valid
shared = 471ba91a99634f9acf34fd7fd58f72682be97ee1c821486d62ba4e448cbc0417
# tcId = 302
# special case for DA - CB in multiplication by 4
private = b898f0329794747d33269a3989b67e43a7ab5a55fa1210b0e5dba193f4fa094e
public = 6418d49fe440a755c9ff1a3582d35dc9b44c818498f15782c95284fe868a914c
result = acceptable
shared = cdb3ca02d5fdb536dbc7395bab12bdcfd55b1ae771a4176dedb55eb4d755c752
# Public keys are either points on a given curve or points on its twist. The
# functions X25519 and X448 are defined for points on a twist with the goal that
# the output of computations do not leak private keys. Implementations may
# accept or reject points on a twist. If a point multiplication is performed
# then it is important that the result is correct, since otherwise attacks with
# invalid keys are possible.
# tcId = 303
# special case for DA - CB in multiplication by 4
private = a0528ed9a8ec22ebe9cc2e32fafc3f467500a9a22f5377382df6604edcdf4f44
public = a89bcfa236bbccf07c434b59f8655fb085b6cbe5ed6376281df813afba22b752
result = valid
shared = cd3245403fd9edfcf91c9581ebb2eb7c77ad6837fca372479e78de9faf60a34a
# tcId = 304
# special case for DA - CB in multiplication by 4
private = f06888bde75d689d056874f6436000497d22d8ad9b95a1c67de1dda4ada3164d
public = cdb1f95f6eacc24b6d029c6ed976666dc51794db8e4aa966ba850fd7f5048965
result = valid
shared = ab7c47ecb0c0167156f44f66a527264b958fc992c21ce98cef3ae214d66bd82d
# tcId = 305
# special case for DA - CB in multiplication by 4
private = e034fcaa3ae40603f9b22af159fd67ef009380946de92cb1d83cc489e8b35041
public = 9491a82744f1cb6105b76b0442e54e605ac67f47a1b2b3b552d486f75bd98e6a
result = valid
shared = 1bfa264a7c7229147a20dd021211891e61f5d8c76cd83f0be24bc70e466a815b
# tcId = 306
# special case for C in multiplication by 4
private = 702a7448c0ed58e1f4e0e332d096a36360beca2f6955c815bc120b3a691d7742
public = 4d19e156e084fe582a0eb79b2f12b61d0b03f3f229227e798a933eea5a1b6129
result = acceptable
shared = c46057fcf63088b3a80e0be5ce24c8026dfadd341b5d8215b8afcb2a5a02bb2b
# Public keys are either points on a given curve or points on its twist. The
# functions X25519 and X448 are defined for points on a twist with the goal that
# the output of computations do not leak private keys. Implementations may
# accept or reject points on a twist. If a point multiplication is performed
# then it is important that the result is correct, since otherwise attacks with
# invalid keys are possible.
# tcId = 307
# special case for C in multiplication by 4
private = 50025cb508ad4faa06fafd0f4a33b747ccf1b3573885d3426500d51b56300144
public = cc4729c4eae292e431ec3a5cf5020e19f9bea50ef3218d9a790034526c3ee14a
result = acceptable
shared = d4361e26127adfbe37c2ed8f42cce4ebab8ab74ed9e74f14c3435d612c1a992a