brine_ed25519/

lib.rs

#![no_std]

mod curve;
pub mod hasher;
mod scalar;

use crate::curve::multiscalar_multiply_edwards;
use crate::hasher::Hasher;
use crate::scalar::scalar_from_bytes_mod_order_wide_into;
pub use solana_address::Address;
use solana_program_error::ProgramError;

pub type Signature = [u8; 64];

/// Negated compressed base point (-G). Identical to G with the sign bit
/// (bit 7 of the last byte) flipped. Used so that the signature check
/// `R == sB - kA` can be rewritten as a single multiscalar multiplication:
/// `msm([s, k], [-G, A]) == -R`.
const NEG_G: [u8; 32] = [
    88, 102, 102, 102, 102, 102, 102, 102, 102, 102, 102, 102, 102, 102, 102, 102, 102, 102, 102,
    102, 102, 102, 102, 102, 102, 102, 102, 102, 102, 102, 102, 230,
];

/// The hash implementation used by [`verify`]: the `sol_sha512` syscall
/// (SIMD-0512) on Solana targets, the in-program `FastSha512` when the
/// `fast-sha512` feature opts out of the syscall, and the software `sha2`
/// implementation on host builds.
#[cfg(all(
    any(target_arch = "bpf", target_os = "solana"),
    not(feature = "fast-sha512")
))]
type DefaultHasher = crate::hasher::Sha512Syscall;
#[cfg(all(
    any(target_arch = "bpf", target_os = "solana"),
    feature = "fast-sha512"
))]
type DefaultHasher = crate::hasher::FastSha512;
#[cfg(not(any(target_arch = "bpf", target_os = "solana")))]
type DefaultHasher = crate::hasher::Sha512;

/// Verify an ed25519 signature over a vectored message.
///
/// Point encodings are validated according to RFC 8032. This uses the
/// RFC-permitted cofactorless verification equation, so canonical small-order
/// points are not rejected. Use [`verify_strict`] when that additional check
/// is required.
///
/// On Solana targets the challenge hash `H(R || A || M)` is computed via the
/// `sol_sha512` syscall
/// ([SIMD-0512](https://github.com/solana-foundation/solana-improvement-documents/blob/main/proposals/0512-sha512-syscall.md)),
/// which requires the `enable_sha512_syscall` feature gate
/// (`s512oDwgx8hjMnaQjXfqqrZroVj4HvC6TkN3iSSWXCh`) to be active on the
/// target cluster. On clusters without the gate (or other SVM runtimes
/// without the syscall), build with the `fast-sha512` feature to hash
/// in-program instead. Host builds always hash in software.
#[inline(always)]
pub fn verify(pubkey: &Address, sig: &Signature, messages: &[&[u8]]) -> Result<(), ProgramError> {
    verify_with_hasher::<DefaultHasher>(pubkey, sig, messages)
}

/// Strictly verify an ed25519 signature, rejecting small-order public keys and
/// `R` values. This matches the Solana ed25519 precompile's point checks.
#[inline(always)]
pub fn verify_strict(
    pubkey: &Address,
    sig: &Signature,
    messages: &[&[u8]],
) -> Result<(), ProgramError> {
    verify_with_hasher_strict::<DefaultHasher>(pubkey, sig, messages)
}

/// Verify a signature using the provided hash implementation and RFC 8032
/// point decoding rules, without additional small-order rejection.
#[inline(always)]
pub fn verify_with_hasher<H: Hasher>(
    pubkey: &Address,
    sig: &Signature,
    messages: &[&[u8]],
) -> Result<(), ProgramError> {
    // SAFETY: first 32 bytes of [u8; 64] is a valid [u8; 32].
    let sig_r: &[u8; 32] = unsafe { &*(sig.as_ptr() as *const [u8; 32]) };
    // SAFETY: Address is #[repr(transparent)] over [u8; 32].
    let pubkey_bytes: &[u8; 32] = unsafe { &*(pubkey as *const Address as *const [u8; 32]) };

    validate_point_encodings(pubkey_bytes, sig_r)?;

    let challenge = challenge::<H>(sig_r, pubkey, messages);

    verify_prehashed_unchecked(pubkey, sig, &challenge)
}

/// Strictly verify a signature using the provided hash implementation.
#[inline(always)]
pub fn verify_with_hasher_strict<H: Hasher>(
    pubkey: &Address,
    sig: &Signature,
    messages: &[&[u8]],
) -> Result<(), ProgramError> {
    // SAFETY: first 32 bytes of [u8; 64] is a valid [u8; 32].
    let sig_r: &[u8; 32] = unsafe { &*(sig.as_ptr() as *const [u8; 32]) };
    // SAFETY: Address is #[repr(transparent)] over [u8; 32].
    let pubkey_bytes: &[u8; 32] = unsafe { &*(pubkey as *const Address as *const [u8; 32]) };

    validate_points_strict(pubkey_bytes, sig_r)?;

    let challenge = challenge::<H>(sig_r, pubkey, messages);

    verify_prehashed_unchecked(pubkey, sig, &challenge)
}

/// Verify an ed25519 signature using a precomputed challenge hash `H(R || A || M)`.
/// This is useful in cases where the challenge hash needs to be computed off-chain
/// or pre-computed on-chain for efficiency reasons.
/// Point encodings are validated according to RFC 8032. Use
/// [`verify_prehashed_strict`] when canonical small-order points must also be
/// rejected.
///
/// # Safety (validation delegated to the MSM syscall)
///
/// The following checks are intentionally omitted because the Solana
/// `sol_curve_multiscalar_mul` syscall already performs them internally
/// (see `agave/curves/curve25519/src/edwards.rs` and `scalar.rs`):
///
/// - **Point decompression / on-curve check** for both `pubkey` and the
///   constant `-G`: the syscall calls `CompressedEdwardsY::decompress()`
///   on every point and returns failure if decompression fails.
/// - **Scalar canonicality** of `s` (the upper half of the signature):
///   the syscall calls `Scalar::from_canonical_bytes()` on every scalar
///   and returns failure if the scalar is non-canonical.
///
/// If any of those checks fail the MSM returns `None`, which we map to
/// `ProgramError::InvalidArgument`.
#[inline(always)]
#[allow(non_snake_case)]
pub fn verify_prehashed(
    pubkey: &Address,
    sig: &Signature,
    challenge: &[u8; 64],
) -> Result<(), ProgramError> {
    // SAFETY: first 32 bytes of [u8; 64] is a valid [u8; 32].
    let sig_r: &[u8; 32] = unsafe { &*(sig.as_ptr() as *const [u8; 32]) };
    // SAFETY: Address is #[repr(transparent)] over [u8; 32].
    let pubkey_bytes: &[u8; 32] = unsafe { &*(pubkey as *const Address as *const [u8; 32]) };

    validate_point_encodings(pubkey_bytes, sig_r)?;
    verify_prehashed_unchecked(pubkey, sig, challenge)
}

#[inline(always)]
#[allow(non_snake_case)]
fn verify_prehashed_unchecked(
    pubkey: &Address,
    sig: &Signature,
    challenge: &[u8; 64],
) -> Result<(), ProgramError> {
    // SAFETY: [u8; 64] has the same layout as [[u8; 32]; 2].
    let (sig_r, sig_s): &([u8; 32], [u8; 32]) = unsafe { &*(sig as *const [u8; 64] as *const _) };

    // SAFETY: Address is #[repr(transparent)] over [u8; 32].
    let pubkey_bytes: &[u8; 32] = unsafe { &*(pubkey as *const Address as *const [u8; 32]) };

    // Build the [[u8; 32]; 2] scalar array in place so that the reduced `k`
    // limbs can be written straight into the MSM input slot instead of
    // materializing through a separate 32-byte stack temporary.
    let mut scalars: [[u8; 32]; 2] = [*sig_s, [0u8; 32]];
    scalar_from_bytes_mod_order_wide_into(challenge, &mut scalars[1]);

    let points = [NEG_G, *pubkey_bytes];

    // msm([s, k], [-G, A]) = s*(-G) + k*A = k*A - s*G = -(s*G - k*A) = -R
    let neg_R =
        multiscalar_multiply_edwards(&scalars, &points).ok_or(ProgramError::InvalidArgument)?;

    // Negate sig_R (flip sign bit) to compare against -R.
    let mut neg_sig_R = *sig_r;
    neg_sig_R[31] ^= 0x80;

    if neg_R == neg_sig_R {
        Ok(())
    } else {
        Err(ProgramError::InvalidArgument)
    }
}

/// Strictly verify a signature using a precomputed challenge hash.
#[inline(always)]
#[allow(non_snake_case)]
pub fn verify_prehashed_strict(
    pubkey: &Address,
    sig: &Signature,
    challenge: &[u8; 64],
) -> Result<(), ProgramError> {
    // SAFETY: first 32 bytes of [u8; 64] is a valid [u8; 32].
    let sig_r: &[u8; 32] = unsafe { &*(sig.as_ptr() as *const [u8; 32]) };
    // SAFETY: Address is #[repr(transparent)] over [u8; 32].
    let pubkey_bytes: &[u8; 32] = unsafe { &*(pubkey as *const Address as *const [u8; 32]) };

    validate_points_strict(pubkey_bytes, sig_r)?;
    verify_prehashed_unchecked(pubkey, sig, challenge)
}

#[inline(always)]
fn challenge<H: Hasher>(sig_r: &[u8; 32], pubkey: &Address, messagev: &[&[u8]]) -> [u8; 64] {
    let mut hasher = H::new();
    hasher.update(sig_r);
    hasher.update(pubkey.as_ref());

    for message in messagev {
        hasher.update(message);
    }

    hasher.finalize()
}

#[cfg(test)]
const G: [u8; 32] = [
    88, 102, 102, 102, 102, 102, 102, 102, 102, 102, 102, 102, 102, 102, 102, 102, 102, 102, 102,
    102, 102, 102, 102, 102, 102, 102, 102, 102, 102, 102, 102, 102,
];

/// Canonical encodings of the eight small-order points.
const EIGHT_TORSION: [[u8; 32]; 8] = [
    [
        0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
        0x00, 0x00,
    ],
    [
        0xc7, 0x17, 0x6a, 0x70, 0x3d, 0x4d, 0xd8, 0x4f, 0xba, 0x3c, 0x0b, 0x76, 0x0d, 0x10, 0x67,
        0x0f, 0x2a, 0x20, 0x53, 0xfa, 0x2c, 0x39, 0xcc, 0xc6, 0x4e, 0xc7, 0xfd, 0x77, 0x92, 0xac,
        0x03, 0x7a,
    ],
    [
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
        0x00, 0x80,
    ],
    [
        0x26, 0xe8, 0x95, 0x8f, 0xc2, 0xb2, 0x27, 0xb0, 0x45, 0xc3, 0xf4, 0x89, 0xf2, 0xef, 0x98,
        0xf0, 0xd5, 0xdf, 0xac, 0x05, 0xd3, 0xc6, 0x33, 0x39, 0xb1, 0x38, 0x02, 0x88, 0x6d, 0x53,
        0xfc, 0x05,
    ],
    [
        0xec, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
        0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
        0xff, 0x7f,
    ],
    [
        0x26, 0xe8, 0x95, 0x8f, 0xc2, 0xb2, 0x27, 0xb0, 0x45, 0xc3, 0xf4, 0x89, 0xf2, 0xef, 0x98,
        0xf0, 0xd5, 0xdf, 0xac, 0x05, 0xd3, 0xc6, 0x33, 0x39, 0xb1, 0x38, 0x02, 0x88, 0x6d, 0x53,
        0xfc, 0x85,
    ],
    [
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
        0x00, 0x00,
    ],
    [
        0xc7, 0x17, 0x6a, 0x70, 0x3d, 0x4d, 0xd8, 0x4f, 0xba, 0x3c, 0x0b, 0x76, 0x0d, 0x10, 0x67,
        0x0f, 0x2a, 0x20, 0x53, 0xfa, 0x2c, 0x39, 0xcc, 0xc6, 0x4e, 0xc7, 0xfd, 0x77, 0x92, 0xac,
        0x03, 0xfa,
    ],
];

#[inline(always)]
fn is_canonical_small_order(point: &[u8; 32]) -> bool {
    EIGHT_TORSION.contains(point)
}

/// Apply the RFC 8032 point-encoding checks not provided by dalek's field
/// decoding: the encoded y-coordinate must be less than p = 2^255 - 19, and
/// x = 0 may not be encoded with its sign bit set.
#[inline(always)]
fn is_canonical_point_encoding(point: &[u8; 32]) -> bool {
    const TOP: u64 = 0x7fff_ffff_ffff_ffff;
    const LOW_P: u64 = 0xffff_ffff_ffff_ffed;

    // Almost every valid encoding is decided by the final byte alone. Only
    // y values near zero or p need the remaining limbs.
    let final_byte = point[31];
    match final_byte & 0x7f {
        0x00 if final_byte & 0x80 != 0 => {
            // The only invalid encoding in this range is negative zero at
            // y = 1. Check it only when its top byte makes it possible.
            point[0] != 1 || point[1..31].iter().any(|&byte| byte != 0)
        }
        0x7f => {
            // Parse little-endian limbs only at the field boundary. The byte
            // array need not be u64-aligned.
            let src = point.as_ptr() as *const u64;
            // SAFETY: point covers four possibly unaligned u64-sized slots.
            let encoded_top = u64::from_le(unsafe { core::ptr::read_unaligned(src.add(3)) });
            let top = encoded_top & TOP;
            if top != TOP {
                return true;
            }

            let middle_high = u64::from_le(unsafe { core::ptr::read_unaligned(src.add(2)) });
            if middle_high != u64::MAX {
                return true;
            }

            let middle_low = u64::from_le(unsafe { core::ptr::read_unaligned(src.add(1)) });
            if middle_low != u64::MAX {
                return true;
            }

            let low = u64::from_le(unsafe { core::ptr::read_unaligned(src) });
            low < LOW_P && !(final_byte & 0x80 != 0 && low == LOW_P - 1)
        }
        _ => true,
    }
}

#[inline(always)]
fn is_negative_zero(point: &[u8; 32]) -> bool {
    // RFC 8032 also rejects x = 0 with the x-sign bit set. On edwards25519,
    // x = 0 occurs at y = 1 and y = p - 1.
    if point[31] & 0x80 == 0 {
        return false;
    }

    match point[31] & 0x7f {
        0x00 => point[0] == 1 && point[1..31].iter().all(|&byte| byte == 0),
        0x7f => point[0] == 0xec && point[1..31].iter().all(|&byte| byte == 0xff),
        _ => false,
    }
}

#[inline(always)]
fn validate_point_encodings(pubkey: &[u8; 32], sig_r: &[u8; 32]) -> Result<(), ProgramError> {
    // The public key is decompressed by the curve implementation, whose field
    // decoder accepts non-canonical y values, so enforce the full RFC encoding
    // rules here. R is compared byte-for-byte with the canonical MSM output;
    // that comparison already rejects y >= p, leaving only negative zero to
    // reject explicitly.
    if !is_canonical_point_encoding(pubkey) || is_negative_zero(sig_r) {
        Err(ProgramError::InvalidArgument)
    } else {
        Ok(())
    }
}

#[inline(always)]
fn validate_points_strict(pubkey: &[u8; 32], sig_r: &[u8; 32]) -> Result<(), ProgramError> {
    validate_point_encodings(pubkey, sig_r)?;

    if is_canonical_small_order(pubkey) || is_canonical_small_order(sig_r) {
        Err(ProgramError::InvalidArgument)
    } else {
        Ok(())
    }
}

#[cfg(test)]
mod tests {
    use super::*;
    use crate::hasher::{Hasher, Sha512};
    use curve25519_dalek::constants;

    fn plus_p(y: u8, sign: u8) -> [u8; 32] {
        let mut bytes = [0xffu8; 32];
        bytes[0] = 0xed + y;
        bytes[31] = 0x7f | sign;
        bytes
    }

    fn forged_signature() -> [u8; 64] {
        let mut sig = [0u8; 64];
        sig[..32].copy_from_slice(&G);
        sig[32] = 1;
        sig
    }

    #[test]
    fn test_small_order() {
        assert!(!is_canonical_small_order(&G));
        for (expected, point) in EIGHT_TORSION.iter().zip(constants::EIGHT_TORSION) {
            assert_eq!(*expected, point.compress().to_bytes());
            assert!(is_canonical_small_order(expected));
        }
    }

    #[test]
    fn test_canonical_point_encoding_boundaries() {
        assert!(is_canonical_point_encoding(&G));
        assert!(is_canonical_point_encoding(&NEG_G));

        // p - 1 is the largest field element, with a canonical zero sign.
        assert!(is_canonical_point_encoding(&EIGHT_TORSION[4]));

        // Every y from p through 2^255 - 1 is non-canonical, independently
        // of the x-sign bit.
        for offset in 0..19 {
            for sign in [0x00u8, 0x80] {
                assert!(!is_canonical_point_encoding(&plus_p(offset, sign)));
            }
        }

        // x = 0 cannot carry a set sign bit. Its two possible y-coordinates
        // are 1 and p - 1.
        for i in [0, 4] {
            let mut negative_zero = EIGHT_TORSION[i];
            negative_zero[31] |= 0x80;
            assert!(!is_canonical_point_encoding(&negative_zero));
        }
    }

    #[test]
    fn test_noncanonical_alias_rejected() {
        let sig = forged_signature();
        let pubkey = Address::from(plus_p(1, 0));

        assert_eq!(
            verify(&pubkey, &sig, &[b"anything"]),
            Err(ProgramError::InvalidArgument)
        );
        assert_eq!(
            verify_strict(&pubkey, &sig, &[b"anything"]),
            Err(ProgramError::InvalidArgument)
        );
    }

    #[test]
    fn test_noncanonical_r_rejected_by_canonical_result_comparison() {
        let pubkey = Address::from(G);
        let challenge = [0u8; 64];

        for offset in 0..19 {
            for sign in [0x00u8, 0x80] {
                let mut sig = [0u8; 64];
                sig[..32].copy_from_slice(&plus_p(offset, sign));

                assert_eq!(
                    verify_prehashed(&pubkey, &sig, &challenge),
                    Err(ProgramError::InvalidArgument),
                    "offset={offset}, sign={sign:#x}"
                );
            }
        }
    }

    #[test]
    fn test_strict_rejects_canonical_small_order_key() {
        let sig = forged_signature();
        let pubkey = Address::from(EIGHT_TORSION[0]);

        // RFC 8032 permits the cofactorless equation used by verify(), which
        // this canonical identity key and forged signature satisfy.
        assert!(verify(&pubkey, &sig, &[b"anything"]).is_ok());
        assert_eq!(
            verify_strict(&pubkey, &sig, &[b"anything"]),
            Err(ProgramError::InvalidArgument)
        );
    }

    #[test]
    fn test_negative_zero_r_rejected() {
        let pubkey = Address::from(G);
        let mut r = EIGHT_TORSION[0];
        r[31] |= 0x80;
        let mut sig = [0u8; 64];
        sig[..32].copy_from_slice(&r);
        sig[32] = 1;
        let mut challenge = [0u8; 64];
        challenge[0] = 1;

        assert_eq!(
            verify_prehashed(&pubkey, &sig, &challenge),
            Err(ProgramError::InvalidArgument)
        );
        assert_eq!(
            verify_prehashed_strict(&pubkey, &sig, &challenge),
            Err(ProgramError::InvalidArgument)
        );
    }

    #[test]
    fn test_base_point() {
        let base_point = constants::ED25519_BASEPOINT_POINT;
        let compressed = base_point.compress();
        let bytes = compressed.to_bytes();
        assert_eq!(bytes, G);
    }

    #[test]
    fn test_hello_world() {
        let pubkey = Address::from([
            73, 73, 170, 112, 75, 235, 154, 81, 203, 8, 44, 245, 233, 18, 204, 136, 162, 9, 233,
            49, 154, 201, 171, 175, 47, 6, 223, 101, 105, 80, 95, 166,
        ]);
        let sig: [u8; 64] = [
            164, 121, 89, 242, 88, 29, 80, 177, 104, 20, 102, 176, 48, 133, 68, 8, 105, 33, 58, 86,
            28, 108, 198, 140, 160, 219, 62, 184, 154, 181, 140, 33, 35, 102, 183, 203, 111, 33,
            55, 170, 180, 138, 92, 196, 185, 201, 122, 167, 15, 112, 9, 228, 226, 112, 111, 10,
            142, 73, 85, 43, 81, 152, 204, 13,
        ];

        assert!(verify(&pubkey, &sig, &[b"hello world"]).is_ok());
        assert!(verify(&pubkey, &sig, &[b"not the right message"]).is_err());
    }

    #[test]
    fn test_hello_world_with_hasher() {
        let pubkey = Address::from([
            73, 73, 170, 112, 75, 235, 154, 81, 203, 8, 44, 245, 233, 18, 204, 136, 162, 9, 233,
            49, 154, 201, 171, 175, 47, 6, 223, 101, 105, 80, 95, 166,
        ]);
        let sig: [u8; 64] = [
            164, 121, 89, 242, 88, 29, 80, 177, 104, 20, 102, 176, 48, 133, 68, 8, 105, 33, 58, 86,
            28, 108, 198, 140, 160, 219, 62, 184, 154, 181, 140, 33, 35, 102, 183, 203, 111, 33,
            55, 170, 180, 138, 92, 196, 185, 201, 122, 167, 15, 112, 9, 228, 226, 112, 111, 10,
            142, 73, 85, 43, 81, 152, 204, 13,
        ];

        assert!(verify_with_hasher::<Sha512>(&pubkey, &sig, &[b"hello world"]).is_ok());
        assert!(verify_with_hasher::<Sha512>(&pubkey, &sig, &[b"not the right message"]).is_err());
    }

    #[test]
    fn test_error_invalid_public_key() {
        let pubkey = Address::from(EIGHT_TORSION[0]);
        let sig: [u8; 64] = [
            164, 121, 89, 242, 88, 29, 80, 177, 104, 20, 102, 176, 48, 133, 68, 8, 105, 33, 58, 86,
            28, 108, 198, 140, 160, 219, 62, 184, 154, 181, 140, 33, 35, 102, 183, 203, 111, 33,
            55, 170, 180, 138, 92, 196, 185, 201, 122, 167, 15, 112, 9, 228, 226, 112, 111, 10,
            142, 73, 85, 43, 81, 152, 204, 13,
        ];

        assert_eq!(
            verify_strict(&pubkey, &sig, &[b"hello world"]),
            Err(ProgramError::InvalidArgument)
        );
    }

    #[test]
    fn test_error_invalid_signature() {
        let pubkey = Address::from([
            73, 73, 170, 112, 75, 235, 154, 81, 203, 8, 44, 245, 233, 18, 204, 136, 162, 9, 233,
            49, 154, 201, 171, 175, 47, 6, 223, 101, 105, 80, 95, 166,
        ]);
        let sig: [u8; 64] = [
            164, 121, 89, 242, 88, 29, 80, 177, 104, 20, 102, 176, 48, 133, 68, 8, 105, 33, 58, 86,
            28, 108, 198, 140, 160, 219, 62, 184, 154, 181, 140, 33, 35, 102, 183, 203, 111, 33,
            55, 170, 180, 138, 92, 196, 185, 201, 122, 167, 15, 112, 9, 228, 226, 112, 111, 10,
            142, 73, 85, 43, 81, 152, 204, 13,
        ];

        assert_eq!(
            verify(&pubkey, &sig, &[b"not the right message"]),
            Err(ProgramError::InvalidArgument)
        );
    }

    #[test]
    fn test_hello_worldv() {
        let pubkey = Address::from([
            73, 73, 170, 112, 75, 235, 154, 81, 203, 8, 44, 245, 233, 18, 204, 136, 162, 9, 233,
            49, 154, 201, 171, 175, 47, 6, 223, 101, 105, 80, 95, 166,
        ]);
        let sig: [u8; 64] = [
            164, 121, 89, 242, 88, 29, 80, 177, 104, 20, 102, 176, 48, 133, 68, 8, 105, 33, 58, 86,
            28, 108, 198, 140, 160, 219, 62, 184, 154, 181, 140, 33, 35, 102, 183, 203, 111, 33,
            55, 170, 180, 138, 92, 196, 185, 201, 122, 167, 15, 112, 9, 228, 226, 112, 111, 10,
            142, 73, 85, 43, 81, 152, 204, 13,
        ];

        let messagev: &[&[u8]] = &[b"hello", b" ", b"world"];
        let bad_messagev: &[&[u8]] = &[b"hello", b" ", b"there"];

        assert!(verify(&pubkey, &sig, messagev).is_ok());
        assert!(verify(&pubkey, &sig, bad_messagev).is_err());
    }

    #[test]
    fn test_vector_1() {
        let pubkey = Address::from([
            0xd7, 0x5a, 0x98, 0x01, 0x82, 0xb1, 0x0a, 0xb7, 0xd5, 0x4b, 0xfe, 0xd3, 0xc9, 0x64,
            0x07, 0x3a, 0x0e, 0xe1, 0x72, 0xf3, 0xda, 0xa6, 0x23, 0x25, 0xaf, 0x02, 0x1a, 0x68,
            0xf7, 0x07, 0x51, 0x1a,
        ]);

        let sig: [u8; 64] = [
            0xe5, 0x56, 0x43, 0x00, 0xc3, 0x60, 0xac, 0x72, 0x90, 0x86, 0xe2, 0xcc, 0x80, 0x6e,
            0x82, 0x8a, 0x84, 0x87, 0x7f, 0x1e, 0xb8, 0xe5, 0xd9, 0x74, 0xd8, 0x73, 0xe0, 0x65,
            0x22, 0x49, 0x01, 0x55, 0x5f, 0xb8, 0x82, 0x15, 0x90, 0xa3, 0x3b, 0xac, 0xc6, 0x1e,
            0x39, 0x70, 0x1c, 0xf9, 0xb4, 0x6b, 0xd2, 0x5b, 0xf5, 0xf0, 0x59, 0x5b, 0xbe, 0x24,
            0x65, 0x51, 0x41, 0x43, 0x8e, 0x7a, 0x10, 0x0b,
        ];

        assert!(verify(&pubkey, &sig, &[b""]).is_ok());
        assert!(verify(&pubkey, &sig, &[b"not the right message"]).is_err());
    }

    #[test]
    fn test_vector_2() {
        let pubkey = Address::from([
            0x3d, 0x40, 0x17, 0xc3, 0xe8, 0x43, 0x89, 0x5a, 0x92, 0xb7, 0x0a, 0xa7, 0x4d, 0x1b,
            0x7e, 0xbc, 0x9c, 0x98, 0x2c, 0xcf, 0x2e, 0xc4, 0x96, 0x8c, 0xc0, 0xcd, 0x55, 0xf1,
            0x2a, 0xf4, 0x66, 0x0c,
        ]);

        let sig: [u8; 64] = [
            0x92, 0xa0, 0x09, 0xa9, 0xf0, 0xd4, 0xca, 0xb8, 0x72, 0x0e, 0x82, 0x0b, 0x5f, 0x64,
            0x25, 0x40, 0xa2, 0xb2, 0x7b, 0x54, 0x16, 0x50, 0x3f, 0x8f, 0xb3, 0x76, 0x22, 0x23,
            0xeb, 0xdb, 0x69, 0xda, 0x08, 0x5a, 0xc1, 0xe4, 0x3e, 0x15, 0x99, 0x6e, 0x45, 0x8f,
            0x36, 0x13, 0xd0, 0xf1, 0x1d, 0x8c, 0x38, 0x7b, 0x2e, 0xae, 0xb4, 0x30, 0x2a, 0xee,
            0xb0, 0x0d, 0x29, 0x16, 0x12, 0xbb, 0x0c, 0x00,
        ];

        assert!(verify(&pubkey, &sig, &[b"r"]).is_ok());
        assert!(verify(&pubkey, &sig, &[b"not the right message"]).is_err());
    }

    #[test]
    fn test_vector_3() {
        let pubkey = Address::from([
            0xfc, 0x51, 0xcd, 0x8e, 0x62, 0x18, 0xa1, 0xa3, 0x8d, 0xa4, 0x7e, 0xd0, 0x02, 0x30,
            0xf0, 0x58, 0x08, 0x16, 0xed, 0x13, 0xba, 0x33, 0x03, 0xac, 0x5d, 0xeb, 0x91, 0x15,
            0x48, 0x90, 0x80, 0x25,
        ]);

        let sig: [u8; 64] = [
            0x62, 0x91, 0xd6, 0x57, 0xde, 0xec, 0x24, 0x02, 0x48, 0x27, 0xe6, 0x9c, 0x3a, 0xbe,
            0x01, 0xa3, 0x0c, 0xe5, 0x48, 0xa2, 0x84, 0x74, 0x3a, 0x44, 0x5e, 0x36, 0x80, 0xd7,
            0xdb, 0x5a, 0xc3, 0xac, 0x18, 0xff, 0x9b, 0x53, 0x8d, 0x16, 0xf2, 0x90, 0xae, 0x67,
            0xf7, 0x60, 0x98, 0x4d, 0xc6, 0x59, 0x4a, 0x7c, 0x15, 0xe9, 0x71, 0x6e, 0xd2, 0x8d,
            0xc0, 0x27, 0xbe, 0xce, 0xea, 0x1e, 0xc4, 0x0a,
        ];

        let message: &[u8] = &[0xaf, 0x82];

        assert!(verify(&pubkey, &sig, &[message]).is_ok());
        assert!(verify(&pubkey, &sig, &[b"not the right message"]).is_err());
    }

    #[test]
    fn test_prehashed() {
        let pubkey = Address::from([
            0xfc, 0x51, 0xcd, 0x8e, 0x62, 0x18, 0xa1, 0xa3, 0x8d, 0xa4, 0x7e, 0xd0, 0x02, 0x30,
            0xf0, 0x58, 0x08, 0x16, 0xed, 0x13, 0xba, 0x33, 0x03, 0xac, 0x5d, 0xeb, 0x91, 0x15,
            0x48, 0x90, 0x80, 0x25,
        ]);

        let sig: [u8; 64] = [
            0x62, 0x91, 0xd6, 0x57, 0xde, 0xec, 0x24, 0x02, 0x48, 0x27, 0xe6, 0x9c, 0x3a, 0xbe,
            0x01, 0xa3, 0x0c, 0xe5, 0x48, 0xa2, 0x84, 0x74, 0x3a, 0x44, 0x5e, 0x36, 0x80, 0xd7,
            0xdb, 0x5a, 0xc3, 0xac, 0x18, 0xff, 0x9b, 0x53, 0x8d, 0x16, 0xf2, 0x90, 0xae, 0x67,
            0xf7, 0x60, 0x98, 0x4d, 0xc6, 0x59, 0x4a, 0x7c, 0x15, 0xe9, 0x71, 0x6e, 0xd2, 0x8d,
            0xc0, 0x27, 0xbe, 0xce, 0xea, 0x1e, 0xc4, 0x0a,
        ];

        let message = &[0xaf, 0x82];
        let challenge = Sha512::hashv(&[sig[..32].as_ref(), pubkey.as_ref(), message.as_ref()]);
        let wrong_challenge = [0u8; 64];

        assert!(verify_prehashed(&pubkey, &sig, &challenge).is_ok());
        assert!(verify_prehashed(&pubkey, &sig, &wrong_challenge).is_err());
    }

    #[test]
    fn test_challenge_hashv() {
        let sig_r: [u8; 32] = [
            164, 121, 89, 242, 88, 29, 80, 177, 104, 20, 102, 176, 48, 133, 68, 8, 105, 33, 58, 86,
            28, 108, 198, 140, 160, 219, 62, 184, 154, 181, 140, 33,
        ];
        let pubkey = Address::from([
            73, 73, 170, 112, 75, 235, 154, 81, 203, 8, 44, 245, 233, 18, 204, 136, 162, 9, 233,
            49, 154, 201, 171, 175, 47, 6, 223, 101, 105, 80, 95, 166,
        ]);
        let messagev: &[&[u8]] = &[b"hello", b" ", b"world"];

        let expected = Sha512::hashv(&[sig_r.as_ref(), pubkey.as_ref(), b"hello", b" ", b"world"]);

        assert_eq!(challenge::<Sha512>(&sig_r, &pubkey, messagev), expected);
    }
}