Anyone aware of test vectors (preferably with intermediate values) for the XEdDSA algorithm?
Open Whisper Systems' own
curve25519-java repository has a few test vectors in the code in
xeddsa_fast_test(), you get this test vector in particular:
- Private key is all zeroes except byte 8, which is set to 189, and then clamped and the private key generated from there
- The message is 200 bytes of zeroes
- The random bytes are 64 bytes of zeroes
- The resulting signature of this should be the byte sequence 11c7f3e6c4df9e8a5150e1db3b30f92de3a3b3aa438656545fa7390f4bcc7bb26c431d9e90643e4f0eaa0e9c557766fa69ada576d63dcaf2ac326c11d0b97702.
Incidentally, XEdDSA as specified has been found not to mitigate sufficiently well against differential power analysis. If the only reason why you're interested in XEdDSA is only mitigation of power-analysis attacks, you may want to look into the Internet Draft draft-mattsson-cfrg-det-sigs-with-noise-02 instead, which took into account the aforementioned findings.