Add tests for bad scalar inputs in ellswift XDH
What the developer wrote
Authored by gzJx0DuTRHytnHe7P5RmMbPf3wKy2BztweVGXTf
Add tests for bad scalar inputs in ellswift XDH
What changed, and why it matters
This commit only adds new test cases to verify that the ellswift XDH function correctly rejects invalid secret scalar values (zero, the curve order, and values above the curve order) while accepting a value just below the curve order. It does not change any production code, so it does not introduce or fix a live security vulnerability on its own.
No action required; treat as routine test-coverage improvement. If reviewing a release, confirm the underlying `secp256k1_ellswift_xdh` implementation already rejects these bad scalars (the tests imply it does).
Security signals we found
Tests added for previously untested invalid scalar edge cases in XDH
No production code changes
No bug fix or behavior change in cryptographic implementation
Evidence from the diff
The diff adds ellswift_xdh_bad_scalar_tests() in src/modules/ellswift/tests_impl.h and registers it in the ellswift test table. The new test checks that secp256k1_ellswift_xdh returns 0 for a zero scalar, for the exact group order, and for group order plus one, and returns 1 for group order minus one. This is purely a test-coverage addition; no implementation logic is modified.
Changed components
src/modules/ellswift/tests_impl.hInspect captured patch +28 / −0
diff --git a/src/modules/ellswift/tests_impl.h b/src/modules/ellswift/tests_impl.h
index 4cc7f4b..e309041 100644
--- a/src/modules/ellswift/tests_impl.h
+++ b/src/modules/ellswift/tests_impl.h
@@ -460,6 +460,33 @@ void ellswift_hash_init_tests(void) {
test_sha256_tag_midstate(&sha_optimized, bip324_tag, sizeof(bip324_tag));
}
+void ellswift_xdh_bad_scalar_tests(void) {
+ unsigned char s_zero[32] = { 0 };
+ unsigned char s_overflow_minus1[32] = { 0 };
+ unsigned char s_overflow_plus1[32] = { 0 };
+ unsigned char s_good[32] = { 0 };
+ unsigned char ell_a64[64], ell_b64[64];
+ unsigned char output[32];
+ secp256k1_scalar rand_scalar;
+
+ testutil_random_scalar_order(&rand_scalar);
+ secp256k1_scalar_get_b32(s_good, &rand_scalar);
+
+ CHECK(secp256k1_ellswift_create(CTX, ell_a64, s_good, NULL) == 1);
+
+ testrand256_test(ell_b64);
+ testrand256_test(ell_b64 + 32);
+
+ memcpy(s_overflow_minus1, secp256k1_group_order_bytes, 32);
+ s_overflow_minus1[31] -= 1;
+ memcpy(s_overflow_plus1, secp256k1_group_order_bytes, 32);
+ s_overflow_plus1[31] += 1;
+ CHECK(secp256k1_ellswift_xdh(CTX, output, ell_a64, ell_b64, s_zero, 0, &ellswift_xdh_hash_x32, NULL) == 0);
+ CHECK(secp256k1_ellswift_xdh(CTX, output, ell_a64, ell_b64, secp256k1_group_order_bytes, 0, &ellswift_xdh_hash_x32, NULL) == 0);
+ CHECK(secp256k1_ellswift_xdh(CTX, output, ell_a64, ell_b64, s_overflow_plus1, 0, &ellswift_xdh_hash_x32, NULL) == 0);
+ CHECK(secp256k1_ellswift_xdh(CTX, output, ell_a64, ell_b64, s_overflow_minus1, 0, &ellswift_xdh_hash_x32, NULL) == 1);
+}
+
/* --- Test registry --- */
static const struct tf_test_entry tests_ellswift[] = {
CASE1(ellswift_encoding_test_vectors_tests),
@@ -470,6 +497,7 @@ static const struct tf_test_entry tests_ellswift[] = {
CASE1(ellswift_compute_shared_secret_tests),
CASE1(ellswift_xdh_correctness_tests),
CASE1(ellswift_hash_init_tests),
+ CASE1(ellswift_xdh_bad_scalar_tests),
};
#endif
Why this scored 12/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.