Ed448: Testvector Question

[smuellerDD]

I am currently adding Wycheproof testing to the library [1]. During the addition, all test cases work with the exception of the following Ed448 tests:

• tests 63, 64, 65: The data currently passes the signature verification algorithm of the library. But when toggling the respective bits stated in the comment line, the signature verification fails. Therefore, could it be that for these three vectors, the test data did not toggle the bits and actually contain passing vectors even though it should contain failing ones?

• test 76 fails without a clear indication why - could I kindly ask for a hint what this test vector changes to expect a failure?

Thank you very much - and thanks for the valuable set of test vectors.

[1] https://github.com/smuellerDD/leancrypto

[2] smuellerDD/leancrypto@69ace0c

[smuellerDD]

Issue further discussed at bleichenbacher-daniel/Rooterberg#6 at the request of Daniel Bleichenbacher.

[cpu]

Hi @smuellerDD, thanks for opening an issue. This is the correct place to discuss Wycheproof updates and we would be happy to work with you to identify what changes to the schema or vector data would make the most sense to clarify this issue (or any others you encounter w.r.t missing fields, uncertainty in the data).

Some of the original test generation code is available in a tag and might be one way to retroactively attempt to identify whether there was an issue with the initial generation.

I'll try to spend some time investigating this & suggesting some updates soon but wanted to reply with some additional information in the meantime.

[smuellerDD]

I see multiple eddsa Python scripts - which of those would have generated the suggested failing vector? Besides, Daniel mentioned that a new set of vectors are available, albeit with a different format. What about starting to import those?

[cpu]

I see multiple eddsa Python scripts - which of those would have generated the suggested failing vector?

Unfortunately I think determining that is part of the archaeology that's required to figure out the right path forward.

a new set of vectors are available, albeit with a different format. What about starting to import those?

It would be ideal if we could find a way to generate the required vectors in a schema format that's close to the existing ones, but if a divergent schema design was truly required we could evaluate it as a one-off without committing to changing the format of the other vectors. Happy to review a PR (and we've encouraged as much in the past).

Putting aside the format divergence issue I don't believe straight importing them from the repository in question is viable since AFAIK those are not made available under any explicit license.