tree a65020d6936e5034cf11c23a37ad8821a1f688da
parent 41a14304d7e0cfcb8afa82ee8735f0bd6763e415
author David Benjamin <davidben@google.com> 1606941647 -0500
committer CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org> 1606944224 +0000

Get closer to Ed25519 boundary conditions.

If I perturb kOrder in the malleability check, our and Wycheproof's
tests don't easily notice. This adds some tests with s above and below
the order. EdDSA hashes the public key with the message, which
frustrates constructing actual boundary cases. Instead, these inputs
were found by generating many signatures.

This isn't ideal, but it is sensitive to the most significant 32 bits.

Change-Id: I7fc03758ab97650d0e94478f355ea7085ae0559a
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/44346
Commit-Queue: David Benjamin <davidben@google.com>
Commit-Queue: Adam Langley <agl@google.com>
Reviewed-by: Adam Langley <agl@google.com>