arcana/ecc/

ed448.rs

// SPDX-License-Identifier: Apache-2.0
// Copyright 2026 Cédric Mesnil <cslashm@pm.me>
// Index-based loops in this module deliberately mirror the reference
// algorithm (parallel-array access `a[i]`/`b[i]`, or a position-indexed
// packing/reduction state) and keep the constant-time data layout explicit;
// the `iter().enumerate()` rewrite would obscure it. Documented, single-lint
// allow per CLAUDE.md §6 (scoped to this module, not a blanket suppression).
#![allow(clippy::needless_range_loop)]

//! Ed448 (RFC 8032 §5.2) — EdDSA over edwards448 ("Goldilocks").
//!
//! Untwisted Edwards curve `x^2 + y^2 = 1 + d·x^2·y^2` with `d = -39081`
//! over `GF(2^448 - 2^224 - 1)`, cofactor 4, hash SHAKE256. Keys are 57
//! octets, signatures 114 octets.
//!
//! This module reuses the generic constant-time field arithmetic of
//! [`super::field`] (`FieldElement<7>` over [`super::field::CURVE448_P`],
//! the same prime X448 uses). Curve constants are taken verbatim from the
//! RFC 8032 reference code and were cross-checked by running the RFC's own
//! `[L+1]·B == B` self-test (see the commit message / `tests` below).
//!
//! # Side-channel posture
//!
//! - The secret scalar multiplication [`Ed448Point::scalar_mul`] is a
//!   fixed-length MSB→LSB double-and-add: every bit performs one `double`
//!   plus one `add` and a branchless [`Ed448Point::ct_select`], so the
//!   sequence of group operations is independent of the scalar. The
//!   underlying field ops are the CT primitives of [`super::field`]
//!   (mask-select shielded with `core::hint::black_box`).
//! - Scalar reduction modulo `L` ([`reduce_mod_l`]) is a fixed-iteration
//!   bit-serial long division (no secret-dependent branch or bound).
//! - `decode` operates on public data (public keys, the signature's `R`),
//!   so its `is_some`/sign branches are not secret-dependent.
//!
//! [CROSS-CHECK RECOMMENDED] `ct_select` is an inline mask-select mirroring
//! the existing `Fe25519::ct_select` in [`super::eddsa`]; a future pass may
//! route both through `silentops::ct` once it exposes a `[u64; N]` select.

use super::field::{
    CURVE448_P, FieldElement, field_add, field_inv, field_mul, field_neg, field_sqrt_p3mod4, field_sub,
};

mod consts;
use crate::Xof;
use crate::hash::sha3::Shake256;
use consts::{ED448_BX_BE, ED448_BY_BE, ED448_L};

/// Field element over `p = 2^448 - 2^224 - 1` (7 × u64 limbs, little-endian).
type Fe = FieldElement<7>;

const P: [u64; 7] = CURVE448_P;

// --- field helpers (thin wrappers binding the per-call prime P) --------------

#[inline]
fn fe_zero() -> Fe {
    Fe::ZERO
}
#[inline]
fn fe_one() -> Fe {
    Fe::one()
}
#[inline]
fn fe_u64(v: u64) -> Fe {
    let mut f = Fe::ZERO;
    f.limbs[0] = v;
    f
}
#[inline]
fn fe_add(a: &Fe, b: &Fe) -> Fe {
    field_add(a, b, &P)
}
#[inline]
fn fe_sub(a: &Fe, b: &Fe) -> Fe {
    field_sub(a, b, &P)
}
#[inline]
fn fe_mul(a: &Fe, b: &Fe) -> Fe {
    field_mul(a, b, &P)
}
#[inline]
fn fe_sqr(a: &Fe) -> Fe {
    field_mul(a, a, &P)
}
#[inline]
fn fe_neg(a: &Fe) -> Fe {
    field_neg(a, &P)
}
#[inline]
fn fe_inv(a: &Fe) -> Fe {
    field_inv(a, &P)
}

/// The curve constant `d = -39081 mod p`.
#[inline]
fn fe_d() -> Fe {
    fe_neg(&fe_u64(39081))
}

/// Constant-time field select: returns `b` if `choice == 1`, else `a`.
/// `choice` must be 0 or 1.
#[inline]
fn fe_ct_select(a: &Fe, b: &Fe, choice: u8) -> Fe {
    let mask = core::hint::black_box(0u64.wrapping_sub(choice as u64));
    let inv = !mask;
    let mut out = Fe::ZERO;
    for i in 0..7 {
        out.limbs[i] = (b.limbs[i] & mask) | (a.limbs[i] & inv);
    }
    out
}

/// Returns 1 if the (fully reduced) field element is odd, else 0.
#[inline]
fn fe_is_odd(a: &Fe) -> u8 {
    (a.limbs[0] & 1) as u8
}

/// Returns `true` if `v < p` (canonical-range check for a decoded `y`).
fn fe_is_canonical(v: &Fe) -> bool {
    // v < p  iff  (v - p) borrows.
    let mut borrow: u64 = 0;
    for i in 0..7 {
        let diff = (v.limbs[i] as u128)
            .wrapping_sub(P[i] as u128)
            .wrapping_sub(borrow as u128);
        borrow = ((diff >> 64) as u64) & 1;
    }
    borrow == 1
}

// --- Ed448 point (projective coordinates X:Y:Z, x = X/Z, y = Y/Z) ------------

/// A point on edwards448 in projective coordinates `(X : Y : Z)`.
///
/// Affine `(x, y) = (X/Z, Y/Z)`. The neutral element is `(0 : 1 : 1)`.
/// Addition and doubling use the unified projective formulas from the
/// RFC 8032 reference code (originally from the EFD), valid for the
/// untwisted Edwards curve `a = 1, d = -39081`.
#[derive(Clone)]
pub struct Ed448Point {
    x: Fe,
    y: Fe,
    z: Fe,
}

impl Ed448Point {
    /// The neutral element `(0 : 1 : 1)`.
    pub fn identity() -> Self {
        Ed448Point {
            x: fe_zero(),
            y: fe_one(),
            z: fe_one(),
        }
    }

    /// The standard base point `B` (RFC 8032 §5.2).
    pub fn base() -> Self {
        Ed448Point {
            x: Fe::from_bytes_be(&ED448_BX_BE),
            y: Fe::from_bytes_be(&ED448_BY_BE),
            z: fe_one(),
        }
    }

    /// Point addition (unified projective formula, RFC 8032 ref code).
    pub fn add(&self, q: &Ed448Point) -> Ed448Point {
        let xcp = fe_mul(&self.x, &q.x);
        let ycp = fe_mul(&self.y, &q.y);
        let zcp = fe_mul(&self.z, &q.z);
        let b = fe_sqr(&zcp);
        let e = fe_mul(&fe_d(), &fe_mul(&xcp, &ycp));
        let f = fe_sub(&b, &e);
        let g = fe_add(&b, &e);
        // (x1+y1)*(x2+y2) - xcp - ycp
        let sum = fe_mul(&fe_add(&self.x, &self.y), &fe_add(&q.x, &q.y));
        let inner = fe_sub(&fe_sub(&sum, &xcp), &ycp);
        let x3 = fe_mul(&fe_mul(&zcp, &f), &inner);
        let y3 = fe_mul(&fe_mul(&zcp, &g), &fe_sub(&ycp, &xcp));
        let z3 = fe_mul(&f, &g);
        Ed448Point { x: x3, y: y3, z: z3 }
    }

    /// Point doubling (projective formula, RFC 8032 ref code).
    pub fn double(&self) -> Ed448Point {
        let x1s = fe_sqr(&self.x);
        let y1s = fe_sqr(&self.y);
        let z1s = fe_sqr(&self.z);
        let xys = fe_add(&self.x, &self.y);
        let f = fe_add(&x1s, &y1s);
        let j = fe_sub(&f, &fe_add(&z1s, &z1s));
        let x3 = fe_mul(&fe_sub(&fe_sub(&fe_sqr(&xys), &x1s), &y1s), &j);
        let y3 = fe_mul(&f, &fe_sub(&x1s, &y1s));
        let z3 = fe_mul(&f, &j);
        Ed448Point { x: x3, y: y3, z: z3 }
    }

    /// Branchless point select: returns `b` if `choice == 1`, else `a`.
    pub fn ct_select(a: &Ed448Point, b: &Ed448Point, choice: u8) -> Ed448Point {
        Ed448Point {
            x: fe_ct_select(&a.x, &b.x, choice),
            y: fe_ct_select(&a.y, &b.y, choice),
            z: fe_ct_select(&a.z, &b.z, choice),
        }
    }

    /// Scalar multiplication `[k]·self`, constant-time in `k`.
    ///
    /// `scalar_le` is the little-endian byte encoding of `k`; every bit
    /// (MSB→LSB) performs one `double` and one masked `add`, so the
    /// operation sequence is independent of the scalar value.
    pub fn scalar_mul(&self, scalar_le: &[u8]) -> Ed448Point {
        let mut r = Ed448Point::identity();
        let nbits = scalar_le.len() * 8;
        for i in (0..nbits).rev() {
            r = r.double();
            let bit = (scalar_le[i / 8] >> (i % 8)) & 1;
            let r_plus = r.add(self);
            r = Ed448Point::ct_select(&r, &r_plus, bit);
        }
        r
    }

    /// Projective equality: `self == q` iff `X1·Z2 == X2·Z1 && Y1·Z2 == Y2·Z1`.
    pub fn equals(&self, q: &Ed448Point) -> bool {
        fe_mul(&self.x, &q.z) == fe_mul(&q.x, &self.z) && fe_mul(&self.y, &q.z) == fe_mul(&q.y, &self.z)
    }

    /// `true` if this is the neutral element `(0 : 1 : 1)` (projectively).
    pub fn is_identity(&self) -> bool {
        self.x.is_zero() && self.y == self.z
    }

    /// Encode to the 57-octet RFC 8032 representation: little-endian `y`
    /// (448 bits) with the sign bit of `x` in bit 455 (MSB of octet 56).
    pub fn encode(&self) -> [u8; 57] {
        let zinv = fe_inv(&self.z);
        let xp = fe_mul(&self.x, &zinv);
        let yp = fe_mul(&self.y, &zinv);
        let yb = yp.to_bytes_le(); // 56 bytes
        let mut out = [0u8; 57];
        out[..56].copy_from_slice(&yb);
        out[56] = fe_is_odd(&xp) << 7;
        out
    }

    /// Decode a 57-octet RFC 8032 point encoding. Returns `None` if the
    /// encoding is non-canonical or `x` cannot be recovered.
    ///
    /// Operates on public data (public key / signature `R`).
    pub fn decode(s: &[u8; 57]) -> Option<Ed448Point> {
        let sign = (s[56] >> 7) & 1;
        // bits 448..454 of the encoding must be zero (only bit 455 is the sign).
        if s[56] & 0x7f != 0 {
            return None;
        }
        let y = Fe::from_bytes_le(&s[..56]);
        if !fe_is_canonical(&y) {
            return None;
        }
        // x^2 = (y^2 - 1) / (d·y^2 - 1)
        let y2 = fe_sqr(&y);
        let num = fe_sub(&y2, &fe_one());
        let den = fe_sub(&fe_mul(&fe_d(), &y2), &fe_one());
        let x2 = fe_mul(&num, &fe_inv(&den));
        // p ≡ 3 (mod 4): candidate root via a^((p+1)/4); verify it squares back.
        let mut x = field_sqrt_p3mod4(&x2, &P);
        if fe_sqr(&x) != x2 {
            return None; // not a quadratic residue → invalid point
        }
        // x == 0 with sign bit set is invalid.
        if x.is_zero() && sign == 1 {
            return None;
        }
        // Flip x to match the requested sign bit.
        if fe_is_odd(&x) != sign {
            x = fe_neg(&x);
        }
        Some(Ed448Point { x, y, z: fe_one() })
    }
}

// --- scalar reduction modulo L ----------------------------------------------

/// The group order `L` as little-endian bytes (56 octets; `L < 2^446`).
/// Test-only helper: `scalar_mul` takes the raw little-endian scalar, and
/// the sign/verify paths use `reduce_mod_l` + `ED448_L` directly.
#[cfg(test)]
fn l_bytes_le() -> [u8; 56] {
    let mut out = [0u8; 56];
    for (i, limb) in ED448_L.iter().enumerate() {
        out[i * 8..i * 8 + 8].copy_from_slice(&limb.to_le_bytes());
    }
    out
}

/// Reduce an arbitrary little-endian integer modulo `L`, returning the
/// 57-octet little-endian residue (the high octet is always 0; sized to
/// match the signature's `S` field). Fixed-iteration bit-serial long
/// division — constant-time in the number of input bits.
pub fn reduce_mod_l(input_le: &[u8]) -> [u8; 57] {
    let l = ED448_L; // [u64; 7], little-endian
    let mut rem = [0u64; 7];

    let total_bits = input_le.len() * 8;
    for i in (0..total_bits).rev() {
        // rem <<= 1
        let mut carry = 0u64;
        for limb in rem.iter_mut() {
            let new_carry = *limb >> 63;
            *limb = (*limb << 1) | carry;
            carry = new_carry;
        }
        // bring down bit i
        rem[0] |= ((input_le[i / 8] >> (i % 8)) & 1) as u64;

        // if rem >= L, subtract L (branchless trial-subtract)
        let mut borrow: u64 = 0;
        let mut trial = [0u64; 7];
        for j in 0..7 {
            let diff = (rem[j] as u128).wrapping_sub(l[j] as u128).wrapping_sub(borrow as u128);
            trial[j] = diff as u64;
            borrow = ((diff >> 64) as u64) & 1;
        }
        // need_sub = (carry from the shift) | !borrow  (rem >= L)
        let need_sub = carry | (1u64.wrapping_sub(borrow));
        let mask = core::hint::black_box(0u64.wrapping_sub(need_sub));
        let inv = !mask;
        for j in 0..7 {
            rem[j] = (trial[j] & mask) | (rem[j] & inv);
        }
    }

    let mut out = [0u8; 57];
    for (i, limb) in rem.iter().enumerate() {
        out[i * 8..i * 8 + 8].copy_from_slice(&limb.to_le_bytes());
    }
    out
}

// --- hashing helpers (SHAKE256) ---------------------------------------------

/// `SHAKE256(data, 114)` — Ed448 secret-key expansion (no dom4 prefix).
fn shake256_114(data: &[u8]) -> [u8; 114] {
    let mut x = Shake256::new();
    x.update(data);
    let mut out = [0u8; 114];
    x.squeeze(&mut out);
    out
}

/// `SHAKE256(data, 64)` — the Ed448ph pre-hash `PH(M)` (RFC 8032 §5.2).
fn shake256_64(data: &[u8]) -> [u8; 64] {
    let mut x = Shake256::new();
    x.update(data);
    let mut out = [0u8; 64];
    x.squeeze(&mut out);
    out
}

/// The Ed448 hash `H = SHAKE256(dom4(hflag, ctx) || parts.., 114)`, where
/// `dom4(x, y) = "SigEd448" || octet(x) || octet(len(y)) || y` (RFC 8032).
fn hash_dom4(hflag: u8, ctx: &[u8], parts: &[&[u8]]) -> [u8; 114] {
    let mut x = Shake256::new();
    x.update(b"SigEd448");
    x.update(&[hflag, ctx.len() as u8]);
    x.update(ctx);
    for p in parts {
        x.update(p);
    }
    let mut out = [0u8; 114];
    x.squeeze(&mut out);
    out
}

/// Clamp the 57-octet secret scalar per RFC 8032 §5.2.5: clear the two
/// least-significant bits, set bit 447, clear the whole final octet.
fn clamp(mut a: [u8; 57]) -> [u8; 57] {
    a[0] &= 0xFC;
    a[55] |= 0x80;
    a[56] = 0;
    a
}

/// `true` iff the 57-octet little-endian scalar `s` satisfies `s < L`.
fn scalar_lt_l(s: &[u8; 57]) -> bool {
    if s[56] != 0 {
        return false; // s >= 2^448 > L
    }
    let v = Fe::from_bytes_le(&s[..56]);
    let mut borrow: u64 = 0;
    for i in 0..7 {
        let diff = (v.limbs[i] as u128)
            .wrapping_sub(ED448_L[i] as u128)
            .wrapping_sub(borrow as u128);
        borrow = ((diff >> 64) as u64) & 1;
    }
    borrow == 1
}

// --- keys, signatures, and the EdDSA scheme ---------------------------------

/// An Ed448 public key: the 57-octet encoding of `[a]B`.
#[derive(Clone, Copy, Debug, PartialEq, Eq)]
pub struct Ed448PublicKey(pub [u8; 57]);

/// An Ed448 secret key (the 57-octet seed).
#[derive(Clone, Copy)]
pub struct Ed448SecretKey(pub [u8; 57]);

/// An Ed448 signature: `R || S`, 114 octets.
#[derive(Clone, Copy, Debug, PartialEq, Eq)]
pub struct Ed448Signature(pub [u8; 114]);

/// Derive the public key `[a]B` from a 57-octet secret seed (RFC 8032 §5.2).
pub fn ed448_keygen(secret: &[u8; 57]) -> (Ed448PublicKey, Ed448SecretKey) {
    let khash = shake256_114(secret);
    let mut a = [0u8; 57];
    a.copy_from_slice(&khash[..57]);
    let a = clamp(a);
    let pk = Ed448Point::base().scalar_mul(&a).encode();
    (Ed448PublicKey(pk), Ed448SecretKey(*secret))
}

/// Core Ed448 signing (RFC 8032 §5.2.6). `hflag` is 0 for Ed448, 1 for
/// Ed448ph; `ctx` is the context string (caller guarantees `len ≤ 255`).
///
/// Deterministic by construction (no per-signature randomness). The secret
/// scalar `a` and the prefix derive from `SHAKE256(sk)`; all operations on
/// them are constant-time (see the module-level side-channel posture).
fn ed448_sign_internal(sk: &Ed448SecretKey, msg: &[u8], ctx: &[u8], hflag: u8) -> [u8; 114] {
    let khash = shake256_114(&sk.0);
    let mut a = [0u8; 57];
    a.copy_from_slice(&khash[..57]);
    let a = clamp(a);
    let prefix = &khash[57..]; // 57-octet signing prefix

    let pk = Ed448Point::base().scalar_mul(&a).encode();

    // r = H(dom4 || prefix || M) mod L ; R = [r]B
    let r = reduce_mod_l(&hash_dom4(hflag, ctx, &[prefix, msg]));
    let rr = Ed448Point::base().scalar_mul(&r).encode();

    // h = H(dom4 || R || A || M) mod L
    let h = reduce_mod_l(&hash_dom4(hflag, ctx, &[&rr, &pk, msg]));

    // S = (r + h*a) mod L. Reduce a mod L first: the clamped a (~2^447)
    // can exceed L, which would break field_mul's input < L^2 assumption.
    let a_red = reduce_mod_l(&a);
    let r_fe = Fe::from_bytes_le(&r[..56]);
    let h_fe = Fe::from_bytes_le(&h[..56]);
    let a_fe = Fe::from_bytes_le(&a_red[..56]);
    let s_fe = field_add(&r_fe, &field_mul(&h_fe, &a_fe, &ED448_L), &ED448_L);
    let s_bytes = s_fe.to_bytes_le(); // 56 octets; S's high octet stays 0

    let mut sig = [0u8; 114];
    sig[..57].copy_from_slice(&rr);
    sig[57..113].copy_from_slice(&s_bytes);
    sig
}

/// Core Ed448 verification (RFC 8032 §5.2.7), cofactored: checks
/// `[4]([S]B) == [4](R + [h]A)`. Operates entirely on public data.
fn ed448_verify_internal(pk: &Ed448PublicKey, msg: &[u8], sig: &[u8; 114], ctx: &[u8], hflag: u8) -> bool {
    let mut rr = [0u8; 57];
    rr.copy_from_slice(&sig[..57]);
    let mut s = [0u8; 57];
    s.copy_from_slice(&sig[57..]);

    if !scalar_lt_l(&s) {
        return false;
    }
    let r_point = match Ed448Point::decode(&rr) {
        Some(p) => p,
        None => return false,
    };
    let a_point = match Ed448Point::decode(&pk.0) {
        Some(p) => p,
        None => return false,
    };

    let h = reduce_mod_l(&hash_dom4(hflag, ctx, &[&rr, &pk.0, msg]));

    let lhs = Ed448Point::base().scalar_mul(&s).double().double();
    let rhs = r_point.add(&a_point.scalar_mul(&h)).double().double();
    lhs.equals(&rhs)
}

// --- public API (mirrors the Ed25519 surface) -------------------------------

/// Sign `msg` with Ed448 (pure, empty context).
pub fn ed448_sign(sk: &Ed448SecretKey, msg: &[u8]) -> Ed448Signature {
    Ed448Signature(ed448_sign_internal(sk, msg, b"", 0))
}

/// Verify an Ed448 (pure, empty context) signature.
pub fn ed448_verify(pk: &Ed448PublicKey, msg: &[u8], sig: &Ed448Signature) -> bool {
    ed448_verify_internal(pk, msg, &sig.0, b"", 0)
}

/// Sign `msg` with Ed448 and an explicit context string (`len ≤ 255`).
pub fn ed448ctx_sign(sk: &Ed448SecretKey, msg: &[u8], context: &[u8]) -> Option<Ed448Signature> {
    if context.len() > 255 {
        return None;
    }
    Some(Ed448Signature(ed448_sign_internal(sk, msg, context, 0)))
}

/// Verify an Ed448 signature made with an explicit context string.
pub fn ed448ctx_verify(pk: &Ed448PublicKey, msg: &[u8], context: &[u8], sig: &Ed448Signature) -> bool {
    if context.len() > 255 {
        return false;
    }
    ed448_verify_internal(pk, msg, &sig.0, context, 0)
}

/// Sign `msg` with Ed448ph: signs `SHAKE256(msg, 64)` with `hflag = 1`.
pub fn ed448ph_sign(sk: &Ed448SecretKey, msg: &[u8], context: &[u8]) -> Option<Ed448Signature> {
    if context.len() > 255 {
        return None;
    }
    let ph = shake256_64(msg);
    Some(Ed448Signature(ed448_sign_internal(sk, &ph, context, 1)))
}

/// Verify an Ed448ph signature over `msg` (re-hashes `msg` with SHAKE256).
pub fn ed448ph_verify(pk: &Ed448PublicKey, msg: &[u8], context: &[u8], sig: &Ed448Signature) -> bool {
    if context.len() > 255 {
        return false;
    }
    let ph = shake256_64(msg);
    ed448_verify_internal(pk, &ph, &sig.0, context, 1)
}

/// Sign an already-computed 64-octet pre-hash with Ed448ph.
pub fn ed448ph_sign_prehashed(sk: &Ed448SecretKey, prehashed: &[u8], context: &[u8]) -> Option<Ed448Signature> {
    if prehashed.len() != 64 || context.len() > 255 {
        return None;
    }
    Some(Ed448Signature(ed448_sign_internal(sk, prehashed, context, 1)))
}

/// Verify an Ed448ph signature against an already-computed 64-octet pre-hash.
pub fn ed448ph_verify_prehashed(pk: &Ed448PublicKey, prehashed: &[u8], context: &[u8], sig: &Ed448Signature) -> bool {
    if prehashed.len() != 64 || context.len() > 255 {
        return false;
    }
    ed448_verify_internal(pk, prehashed, &sig.0, context, 1)
}

#[cfg(test)]
mod tests {
    use super::*;

    fn hex_to_vec(h: &str) -> Vec<u8> {
        (0..h.len())
            .step_by(2)
            .map(|i| u8::from_str_radix(&h[i..i + 2], 16).unwrap())
            .collect()
    }
    fn hex57(h: &str) -> [u8; 57] {
        let mut a = [0u8; 57];
        a.copy_from_slice(&hex_to_vec(h));
        a
    }
    fn hex114(h: &str) -> [u8; 114] {
        let mut a = [0u8; 114];
        a.copy_from_slice(&hex_to_vec(h));
        a
    }

    /// RFC 8032 §7.4 "Blank" vector: Ed448 pure, empty message + context.
    /// Validates keygen, deterministic sign (byte-exact), and verify.
    #[test]
    fn rfc8032_blank_vector() {
        let sk = hex57(
            "6c82a562cb808d10d632be89c8513ebf6c929f34ddfa8c9f63c9960ef6e348a3\
             528c8a3fcc2f044e39a3fc5b94492f8f032e7549a20098f95b",
        );
        let pk_expected = hex57(
            "5fd7449b59b461fd2ce787ec616ad46a1da1342485a70e1f8a0ea75d80e96778\
             edf124769b46c7061bd6783df1e50f6cd1fa1abeafe8256180",
        );
        let sig_expected = hex114(
            "533a37f6bbe457251f023c0d88f976ae2dfb504a843e34d2074fd823d41a591f\
             2b233f034f628281f2fd7a22ddd47d7828c59bd0a21bfd3980ff0d2028d4b18a\
             9df63e006c5d1c2d345b925d8dc00b4104852db99ac5c7cdda8530a113a0f4db\
             b61149f05a7363268c71d95808ff2e652600",
        );
        let (pk, sk2) = ed448_keygen(&sk);
        assert_eq!(pk.0, pk_expected, "keygen public key mismatch");
        let sig = ed448_sign(&sk2, b"");
        assert_eq!(sig.0, sig_expected, "signature mismatch (not RFC-conformant)");
        assert!(ed448_verify(&pk, b"", &sig), "verify rejected a valid signature");
        let mut bad = sig;
        bad.0[0] ^= 1;
        assert!(!ed448_verify(&pk, b"", &bad), "verify accepted a tampered signature");
    }

    /// RFC 8032 §7.4 "1 octet (with context)" vector: Ed448 + context "foo".
    #[test]
    fn rfc8032_ctx_vector() {
        let sk = hex57(
            "c4eab05d357007c632f3dbb48489924d552b08fe0c353a0d4a1f00acda2c463a\
             fbea67c5e8d2877c5e3bc397a659949ef8021e954e0a12274e",
        );
        let pk_exp = hex57(
            "43ba28f430cdff456ae531545f7ecd0ac834a55d9358c0372bfa0c6c6798c086\
             6aea01eb00742802b8438ea4cb82169c235160627b4c3a9480",
        );
        let sig_exp = hex114(
            "d4f8f6131770dd46f40867d6fd5d5055de43541f8c5e35abbcd001b32a89f7d2\
             151f7647f11d8ca2ae279fb842d607217fce6e042f6815ea000c85741de5c8da\
             1144a6a1aba7f96de42505d7a7298524fda538fccbbb754f578c1cad10d54d0d\
             5428407e85dcbc98a49155c13764e66c3c00",
        );
        let msg = [0x03u8];
        let ctx = [0x66u8, 0x6f, 0x6f]; // "foo"
        let (pk, sk2) = ed448_keygen(&sk);
        assert_eq!(pk.0, pk_exp);
        let sig = ed448ctx_sign(&sk2, &msg, &ctx).expect("ctx <= 255");
        assert_eq!(sig.0, sig_exp, "ctx signature not RFC-conformant");
        assert!(ed448ctx_verify(&pk, &msg, &ctx, &sig));
        // wrong context must fail
        assert!(!ed448ctx_verify(&pk, &msg, b"bar", &sig));
    }

    /// RFC 8032 §7.5 "TEST abc" vector: Ed448ph (pre-hash), empty context.
    #[test]
    fn rfc8032_ph_vector() {
        let sk = hex57(
            "833fe62409237b9d62ec77587520911e9a759cec1d19755b7da901b96dca3d42\
             ef7822e0d5104127dc05d6dbefde69e3ab2cec7c867c6e2c49",
        );
        let pk_exp = hex57(
            "259b71c19f83ef77a7abd26524cbdb3161b590a48f7d17de3ee0ba9c52beb743\
             c09428a131d6b1b57303d90d8132c276d5ed3d5d01c0f53880",
        );
        let sig_exp = hex114(
            "822f6901f7480f3d5f562c592994d9693602875614483256505600bbc281ae38\
             1f54d6bce2ea911574932f52a4e6cadd78769375ec3ffd1b801a0d9b3f4030cd\
             433964b6457ea39476511214f97469b57dd32dbc560a9a94d00bff07620464a3\
             ad203df7dc7ce360c3cd3696d9d9fab90f00",
        );
        let msg = [0x61u8, 0x62, 0x63]; // "abc"
        let (pk, sk2) = ed448_keygen(&sk);
        assert_eq!(pk.0, pk_exp);
        let sig = ed448ph_sign(&sk2, &msg, b"").expect("ctx <= 255");
        assert_eq!(sig.0, sig_exp, "ph signature not RFC-conformant");
        assert!(ed448ph_verify(&pk, &msg, b"", &sig));
        // the prehashed entry point must agree with the all-in-one path
        let ph = shake256_64(&msg);
        let sig2 = ed448ph_sign_prehashed(&sk2, &ph, b"").expect("64-byte prehash");
        assert_eq!(sig2.0, sig.0, "prehashed path disagrees with ed448ph_sign");
    }

    #[test]
    fn base_point_on_curve() {
        // x^2 + y^2 == 1 + d·x^2·y^2  (affine, z = 1)
        let b = Ed448Point::base();
        let x2 = fe_sqr(&b.x);
        let y2 = fe_sqr(&b.y);
        let lhs = fe_add(&x2, &y2);
        let rhs = fe_add(&fe_one(), &fe_mul(&fe_d(), &fe_mul(&x2, &y2)));
        assert_eq!(lhs, rhs, "base point not on edwards448");
    }

    #[test]
    fn order_of_base_point() {
        // [L]·B must be the neutral element.
        let lb = Ed448Point::base().scalar_mul(&l_bytes_le());
        assert!(lb.is_identity(), "[L]·B != identity (wrong base point or order)");
    }

    #[test]
    fn encode_decode_roundtrip_base() {
        let b = Ed448Point::base();
        let enc = b.encode();
        let dec = Ed448Point::decode(&enc).expect("base point must decode");
        assert!(b.equals(&dec), "decode(encode(B)) != B");
        // re-encode must be byte-identical (canonical).
        assert_eq!(dec.encode(), enc);
    }

    #[test]
    fn scalar_mul_distributive_small() {
        // [3]B == B + B + B
        let b = Ed448Point::base();
        let three = {
            let mut s = [0u8; 56];
            s[0] = 3;
            s
        };
        let lhs = b.scalar_mul(&three);
        let rhs = b.add(&b).add(&b);
        assert!(lhs.equals(&rhs), "[3]B != B+B+B");
    }

    #[test]
    fn reduce_mod_l_known() {
        // L reduces to 0; (L-1) reduces to itself; (L+1) reduces to 1.
        let l = l_bytes_le();
        let red_l = reduce_mod_l(&l);
        assert!(red_l.iter().all(|&b| b == 0), "L mod L != 0");

        let mut lp1 = l;
        // L's low byte is 0xf3; +1 won't carry past it.
        lp1[0] = lp1[0].wrapping_add(1);
        let red = reduce_mod_l(&lp1);
        assert_eq!(red[0], 1);
        assert!(red[1..].iter().all(|&b| b == 0), "(L+1) mod L != 1");
    }
}