Analysis of P256 test vectors based on evmone implementation

[chfast]

Intro

Analyze EEST test coverage of the evmone's implementation of p256_verify to find and contribute missing test cases.

Issues discovered

• 1. "invalid_curve_attack" vectors are ineffective. Fixed in feat(tests): add correct P256 precompile tests for invalid point #2179.
• 2. The final check R.x == r mod n has missing MC/DC coverage. Fixed in feat(tests): add test case with invalid P256 with x1 above N #2217.
• 3. Ineffective tests for checks of r != 0 and s != 0. Fixed in feat(tests): add test cases for P256 with zero h, r, s #2216.
• 4. Ineffective tests for checks of r < N and s < N. Fixed in feat(tests): add test cases for P256 for r,s above N #2230.
• 5. Missing test cases for boundary values of valid s (note that this is impractical to create a valid signature for arbitrary r). Fixed in feat(tests): add test cases for P256 input s special values #2215.
• 6. Missing test cases for boundary and "special" hash values. Fixed in feat(tests): add test cases for P256 input hash special values #2203.
• 7. Missing test case for point doubling in u1*G + u2*Q. Fixed in feat(tests): add test case for point doubling in P256 #2218.
• 8. Inefficient tests for x >= P and y >= P. Fixed in feat(tests): add tests for P256 with x,y out of range #2237.
• 9. Inefficient test for Q == 0. Fixed in feat(tests): add test case for P256 with Q at infinity #2235.
• 10. Missing positive test with Q with x-coordinate being 0. Fixed in feat(tests): add test case for P256 where Q.x is zero #2221.
• 11. Missing test case with r==2**256-1 (just for completeness). Fixed in feat(tests): add test case for P256 with r max value #2229.
• 12. Add test case for R==0, see example. Fixed in feat(tests): add more tests for P256 where R is at infinity #2238.

[kclowes]

Thanks for flagging! Could you clarify a few points:

3. Ineffective tests for initial checks of r and s (at least r!=0)

What do you mean by initial checks?

4. Missing test cases for boundary values of valid r and s.

We have test cases that expect valid results for large r and s values and small r and s values. Are there other boundary conditions that you think we should add here? If so, which ones?

5. Missing test cases for "special" hash values

What qualifies as a "special" hash value?

[chfast]

I should've clarified that this is my WIP report so expect updates. Sorry.

Thanks for flagging! Could you clarify a few points:

3. Ineffective tests for initial checks of r and s (at least r!=0)

What do you mean by initial checks?

I mean range checks that r and s are in [1,N-1]. You have to think how to produce an incorrectly valid signature for an implementation where such check is missing.

4. Missing test cases for boundary values of valid r and s.

We have test cases that expect valid results for large r and s values and small r and s values. Are there other boundary conditions that you think we should add here? If so, which ones?

2**256-1.

5. Missing test cases for "special" hash values

What qualifies as a "special" hash value?

See #2203.