test(ed25519-verify): add mixed-order strict-parity regression vectors - #9
Open
latent-9 wants to merge 1 commit into
Open
test(ed25519-verify): add mixed-order strict-parity regression vectors#9latent-9 wants to merge 1 commit into
latent-9 wants to merge 1 commit into
Conversation
Author
|
FYI: PR #11 refactors scalar.rs and verifier.rs, the same files this fix touches. Happy to rebase once it lands, or adapt the fix to the refactored code if that helps. Flagging it so the parity fix does not get lost in the refactor. |
Fold order-2 and order-4 torsion into prime-order public keys and assert the cofactorless strict preset agrees with ed25519-dalek's verify_strict on them. These vectors fail on the code before the runtime scalar negation was removed (PR solana-program#10) and pass on main. The maintainer fix replaces scalar::negate with a negated basepoint constant; these vectors lock in that parity behavior.
latent-9
force-pushed
the
fix-cofactorless-verify-strict-torsion
branch
from
August 22, 2026 01:44
a09654c to
06928b6
Compare
latent-9
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
While fuzzing this crate against ed25519-dalek I found that the cofactorless strict preset disagreed with dalek's
verify_stricton signatures where a low-order torsion component is folded into a prime-order public key. The root cause was the runtime scalar negation (L - H): the group orderLis odd, so(L - H)*Adiffers from-(H*A)byL*A, which is only the identity whenAhas prime order. On a mixed-order key it leaves a non-identityL*Ttorsion component, so cofactorless verification returned the wrong verdict.That fix has since landed in main as part of #10, which removes the runtime scalar negation. This PR adds the regression vectors that prove that fix:
verify_strictaccepts.dalek_verify_strict_preset_matches_dalek, which asserts the preset returns the same verdict as dalek.On the code before #10 the preset rejects these signatures (the bug), and on main it accepts them (fixed). No production code changes.