From 8dd6ecfd2095c8f6162dd8959eea09f2f4b58b47 Mon Sep 17 00:00:00 2001
From: Karel Miko <karel.miko@gmail.com>
Date: Wed, 29 Apr 2026 17:09:11 +0200
Subject: [PATCH] ed448/x448 - failing wycheproof tests

---
 tests/ed448_test.c | 46 ++++++++++++++++++++++++++++++++++++++++++++++
 tests/x448_test.c  | 18 ++++++++++++++++++
 2 files changed, 64 insertions(+)

diff --git a/tests/ed448_test.c b/tests/ed448_test.c
index 68ca17ad..e8e61062 100644
--- a/tests/ed448_test.c
+++ b/tests/ed448_test.c
@@ -382,6 +382,51 @@ static int s_rfc_8032_5_2_6_ph_test(void)
    return CRYPT_OK;
 }
 
+/* Wycheproof ed448_test.json tcId=63/64/65 signature malleability vectors */
+static int s_signature_malleability_test(void)
+{
+   static const struct {
+      int tc_id;
+      const char *sig;
+   } test_cases[] = {
+      { 63,
+        "5db94c53101f521f6c1f43b60ea4d7e06fbd49c2e8afaf4fcc289e645e0880a87b8e55858df4cf2291a7303ffda446b82a117b4dd408cff2811adf92201088e0"
+        "51ee48b57aecf46edfc68e5baeed5ae4910ba5681d370f75ab593811e18293ef0808581c254196bcbf2b4c454136a6711b00"
+      },
+      { 64,
+        "5db94c53101f521f6c1f43b60ea4d7e06fbd49c2e8afaf4fcc289e645e0880a87b8e55858df4cf2291a7303ffda446b82a117b4dd408cff2825e06c3999e8308"
+        "be439c40940b0075d3e4f65147c1608cbe6e9c432e33bed6686f9393ae2568f0ad60febcb4b6179c0d90d034e7c3c4681000"
+      },
+      { 65,
+        "5db94c53101f521f6c1f43b60ea4d7e06fbd49c2e8afaf4fcc289e645e0880a87b8e55858df4cf2291a7303ffda446b82a117b4dd408cff2c02456bbd141df04"
+        "8dbf1843be6d5fef402483314c2af547b361a09f3319489eaede43404df9faf634c1298d678b5261c808b0be3726013e3900"
+      },
+   };
+   const char *public_key = "419610a534af127f583b04818cdb7f0ff300b025f2e01682bcae33fd691cee039511df0cddc690ee978426e8b38e50ce5af7dcfba50f704c00";
+   const char *message = "313233343030";
+   unsigned long n, mlen, plen, siglen;
+   unsigned char msg[8], pub[57], sig[114];
+   curve448_key key;
+   int ret;
+   const int should = 0;
+
+   plen = sizeof(pub);
+   DO(base16_decode(public_key, XSTRLEN(public_key), pub, &plen));
+   mlen = sizeof(msg);
+   DO(base16_decode(message, XSTRLEN(message), msg, &mlen));
+   DO(ed448_import_raw(pub, plen, PK_PUBLIC, &key));
+
+   for (n = 0; n < LTC_ARRAY_SIZE(test_cases); ++n) {
+      siglen = sizeof(sig);
+      DO(base16_decode(test_cases[n].sig, XSTRLEN(test_cases[n].sig), sig, &siglen));
+      DO(ed448_verify(msg, mlen, sig, siglen, &ret, &key));
+      COMPARE_TESTVECTOR(&ret, sizeof(ret), &should, sizeof(should), "Ed448 malleability rejection", test_cases[n].tc_id);
+   }
+
+   zeromem(&key, sizeof(key));
+   return CRYPT_OK;
+}
+
 /* Export/import round-trip for Ed448 (requires MPI for DER/PKCS8) */
 static int s_ed448_compat_test(void)
 {
@@ -423,6 +468,7 @@ int ed448_test(void)
    DO(s_rfc_8032_5_2_6_pure_test());
    DO(s_rfc_8032_5_2_6_ctx_test());
    DO(s_rfc_8032_5_2_6_ph_test());
+   DO(s_signature_malleability_test());
    if (ltc_mp.name != NULL) {
       DO(s_ed448_compat_test());
    }
diff --git a/tests/x448_test.c b/tests/x448_test.c
index aae4e0eb..31e89293 100644
--- a/tests/x448_test.c
+++ b/tests/x448_test.c
@@ -175,6 +175,23 @@ static int s_x448_keygen_dh_test(void)
    return CRYPT_OK;
 }
 
+/* Wycheproof x448_test.json tcId=22 (Twist + SpecialPublicKey) */
+static int s_x448_wycheproof_special_test(void)
+{
+   const char *priv_hex = "8c37fb35eac1dbda6a3b5bf492c1f642c761be3adf0ab7617a66002576c45bba8202970bae6c5e05f645f5439ca2f42b89dacace1a5d0e82";
+   const char *pub_hex  = "0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000040";
+   const char *exp_hex  = "60c468df97e2e4427f27420cc6bc9eebaa2bceb827eb55a187fc5c29555e72a663243f6af4095641d72caeacb369720ea18cadd6efdbece6";
+   unsigned char priv[56], pub[56], expected[56], out[56];
+   unsigned long len;
+
+   len = sizeof(priv);     DO(base16_decode(priv_hex, XSTRLEN(priv_hex), priv, &len));
+   len = sizeof(pub);      DO(base16_decode(pub_hex,  XSTRLEN(pub_hex),  pub,  &len));
+   len = sizeof(expected); DO(base16_decode(exp_hex,  XSTRLEN(exp_hex),  expected, &len));
+   ec448_scalarmult_internal(out, priv, pub);
+   COMPARE_TESTVECTOR(out, 56, expected, 56, "X448 Wycheproof tcId=22", 22);
+   return CRYPT_OK;
+}
+
 /* Export/import round-trip (requires MPI for DER/PKCS8) */
 static int s_x448_compat_test(void)
 {
@@ -215,6 +232,7 @@ int x448_test(void)
    DO(s_x448_rfc7748_scalarmult_test());
    DO(s_x448_rfc7748_iter_test());
    DO(s_x448_keygen_dh_test());
+   DO(s_x448_wycheproof_special_test());
    if (ltc_mp.name != NULL) {
       DO(s_x448_compat_test());
    }