1--TEST--
2Check for libsodium core ristretto255
3--EXTENSIONS--
4sodium
5--SKIPIF--
6<?php
7if (!defined('SODIUM_CRYPTO_CORE_RISTRETTO255_HASHBYTES')) print "skip libsodium without Ristretto255";
8?>
9--FILE--
10<?php
11$badHex = array(
12    /* Non-canonical field encodings */
13    "00ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff",
14    "ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff7f",
15    "f3ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff7f",
16    "edffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff7f",
17    "0100000000000000000000000000000000000000000000000000000000000080",
18
19    /* Negative field elements */
20    "0100000000000000000000000000000000000000000000000000000000000000",
21    "01ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff7f",
22    "ed57ffd8c914fb201471d1c3d245ce3c746fcbe63a3679d51b6a516ebebe0e20",
23    "c34c4e1826e5d403b78e246e88aa051c36ccf0aafebffe137d148a2bf9104562",
24    "c940e5a4404157cfb1628b108db051a8d439e1a421394ec4ebccb9ec92a8ac78",
25    "47cfc5497c53dc8e61c91d17fd626ffb1c49e2bca94eed052281b510b1117a24",
26    "f1c6165d33367351b0da8f6e4511010c68174a03b6581212c71c0e1d026c3c72",
27    "87260f7a2f12495118360f02c26a470f450dadf34a413d21042b43b9d93e1309",
28
29    /* Non-square x^2 */
30    "26948d35ca62e643e26a83177332e6b6afeb9d08e4268b650f1f5bbd8d81d371",
31    "4eac077a713c57b4f4397629a4145982c661f48044dd3f96427d40b147d9742f",
32    "de6a7b00deadc788eb6b6c8d20c0ae96c2f2019078fa604fee5b87d6e989ad7b",
33    "bcab477be20861e01e4a0e295284146a510150d9817763caf1a6f4b422d67042",
34    "2a292df7e32cababbd9de088d1d1abec9fc0440f637ed2fba145094dc14bea08",
35    "f4a9e534fc0d216c44b218fa0c42d99635a0127ee2e53c712f70609649fdff22",
36    "8268436f8c4126196cf64b3c7ddbda90746a378625f9813dd9b8457077256731",
37    "2810e5cbc2cc4d4eece54f61c6f69758e289aa7ab440b3cbeaa21995c2f4232b",
38
39    /* Negative xy value */
40    "3eb858e78f5a7254d8c9731174a94f76755fd3941c0ac93735c07ba14579630e",
41    "a45fdc55c76448c049a1ab33f17023edfb2be3581e9c7aade8a6125215e04220",
42    "d483fe813c6ba647ebbfd3ec41adca1c6130c2beeee9d9bf065c8d151c5f396e",
43    "8a2e1d30050198c65a54483123960ccc38aef6848e1ec8f5f780e8523769ba32",
44    "32888462f8b486c68ad7dd9610be5192bbeaf3b443951ac1a8118419d9fa097b",
45    "227142501b9d4355ccba290404bde41575b037693cef1f438c47f8fbf35d1165",
46    "5c37cc491da847cfeb9281d407efc41e15144c876e0170b499a96a22ed31e01e",
47    "445425117cb8c90edcbc7c1cc0e74f747f2c1efa5630a967c64f287792a48a4b",
48
49    /* s = -1, which causes y = 0 */
50    "ecffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff7f"
51);
52
53// First 16 lines of output: non-canonical encodings are rejected
54for ($i = 0; $i < count($badHex); ++$i) {
55    $s = sodium_hex2bin($badHex[$i]);
56    var_dump(sodium_crypto_core_ristretto255_is_valid_point($s));
57}
58
59$inputHash = sodium_hex2bin(
60    "5d1be09e3d0c82fc538112490e35701979d99e06ca3e2b5b54bffe8b4dc772c1" .
61    "4d98b696a1bbfb5ca32c436cc61c16563790306c79eaca7705668b47dffe5bb6"
62);
63$outHash = sodium_crypto_core_ristretto255_from_hash($inputHash);
64var_dump(sodium_bin2hex($outHash));
65
66// Any random scalar should be valid, and so too should (r * basepoint)
67$r = sodium_crypto_core_ristretto255_scalar_random();
68$s0 = sodium_crypto_scalarmult_ristretto255_base($r);
69var_dump(sodium_crypto_core_ristretto255_is_valid_point($s0));
70
71// Test that multiplying by the order of the curve fails:
72$L = "\xed\xd3\xf5\x5c\x1a\x63\x12\x58" .
73     "\xd6\x9c\xf7\xa2\xde\xf9\xde\x14" .
74     "\x00\x00\x00\x00\x00\x00\x00\x00" .
75     "\x00\x00\x00\x00\x00\x00\x00\x10";
76
77$s = sodium_crypto_core_ristretto255_random();
78try {
79    $multL = sodium_crypto_scalarmult_ristretto255($s, $L);
80} catch (SodiumException $e) {
81    echo $e->getMessage(), "\n";
82}
83$s2 = sodium_crypto_scalarmult_ristretto255($r, $s);
84
85// _from_hash should produce a valid point
86$ru = random_bytes(64);
87$s3 = sodium_crypto_core_ristretto255_from_hash($ru);
88var_dump(sodium_crypto_core_ristretto255_is_valid_point($s3));
89
90// Modular inverse should be valid too (???)
91//$r_invert = sodium_crypto_core_ristretto255_scalar_invert($r);
92//var_dump(sodium_crypto_core_ristretto255_is_valid_point($r_invert));
93
94$s_plus = sodium_crypto_core_ristretto255_add($s, $s0);
95$s_minus = sodium_crypto_core_ristretto255_sub($s_plus, $s0);
96var_dump(hash_equals($s, $s_minus));
97?>
98--EXPECT--
99bool(false)
100bool(false)
101bool(false)
102bool(false)
103bool(false)
104bool(false)
105bool(false)
106bool(false)
107bool(false)
108bool(false)
109bool(false)
110bool(false)
111bool(false)
112bool(false)
113bool(false)
114bool(false)
115bool(false)
116bool(false)
117bool(false)
118bool(false)
119bool(false)
120bool(false)
121bool(false)
122bool(false)
123bool(false)
124bool(false)
125bool(false)
126bool(false)
127bool(false)
128bool(false)
129string(64) "3066f82a1a747d45120d1740f14358531a8f04bbffe6a819f86dfe50f44a0a46"
130bool(true)
131Result is identity element
132bool(true)
133bool(true)
134