From d4085b20735a3ef1e8ab3fd358d0f247d8816127 Mon Sep 17 00:00:00 2001
From: km <km@tsukuyomi-win10.localdomain>
Date: Fri, 27 Mar 2026 06:03:12 +0900
Subject: [PATCH] =?UTF-8?q?X25519=20=E5=AE=9F=E8=A3=85=EF=BC=9AA24=20?=
 =?UTF-8?q?=E5=AE=9A=E6=95=B0=E8=BF=BD=E5=8A=A0=EF=BC=88=E9=80=B2=E8=A1=8C?=
 =?UTF-8?q?=E4=B8=AD=EF=BC=89?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

現状:
- 初期化は Python と一致
- A24 定数追加
- しかし出力がまだ RFC テストベクトルと一致しない

次のステップ:
- Montgomery ladder の各ステップをデバッグ出力
- Python と C の中間値を比較
---
 src/se050_x25519_sw.c | 34 +++++++++++++++++-----------------
 1 file changed, 17 insertions(+), 17 deletions(-)

diff --git a/src/se050_x25519_sw.c b/src/se050_x25519_sw.c
index 1de1e0d..e73d49f 100644
--- a/src/se050_x25519_sw.c
+++ b/src/se050_x25519_sw.c
@@ -370,26 +370,25 @@ static void fe_inv(fe h, const fe f)
 
 static void x25519_sw(uint8_t *out, const uint8_t *scalar, const uint8_t *point)
 {
-    fe x2, z2, x3, z3, a, aa, b, bb, e, c, d, da, cb, t;
+    fe x2, z2, x3, z3, a, aa, b, bb, e, c, d, da, cb, u_coord;
     uint8_t e_arr[32];
     
     memcpy(e_arr, scalar, 32);
     e_arr[0] &= 248; e_arr[31] &= 127; e_arr[31] |= 64;
     
-    fe_frombytes(x2, point);
-    fe_1(z2);
-    fe_0(x3); fe_1(z3);
+    /* Python と完全一致する初期化 */
+    fe_1(x2); fe_0(z2);
+    fe_frombytes(x3, point); fe_1(z3);
+    fe_frombytes(u_coord, point);
     
     for (int i = 254; i >= 0; i--) {
         int bit = (e_arr[i/8] >> (i&7)) & 1;
         
-        /* Conditional swap */
         if (bit) {
             fe_cswap(x2, x3, 1);
             fe_cswap(z2, z3, 1);
         }
         
-        /* Montgomery ladder step */
         fe_add(a, x2, z2);
         fe_sq(aa, a);
         fe_sub(b, x2, z2);
@@ -399,20 +398,20 @@ static void x25519_sw(uint8_t *out, const uint8_t *scalar, const uint8_t *point)
         fe_sub(d, x3, z3);
         fe_mul(da, d, a);
         fe_mul(cb, c, b);
-        fe_add(a, da, cb);
-        fe_sq(x3, a);
-        fe_sub(a, da, cb);
-        fe_sq(z3, a);
-        fe_mul(z3, z3, x2);  /* z3 = u * z3 */
+        fe_add(x3, da, cb);
+        fe_sq(x3, x3);
+        fe_sub(d, da, cb);
+        fe_sq(z3, d);
+        fe_mul(z3, z3, u_coord);
         fe_mul(x2, aa, bb);
         
-        /* z2 = e * (aa + A24 * e) */
-        /* Need to compute A24 * e where A24 = 121665 */
-        fe_mul(t, e, t);  /* Wrong - need scalar multiplication */
-        fe_add(a, aa, t);
-        fe_mul(z2, e, a);
+        /* z2 = e * (aa + A24 * e) where A24 = 121665 */
+        /* Compute A24 * e: A24 as field element */
+        fe a24 = {121665, 0, 0, 0, 0, 0, 0, 0, 0, 0};
+        fe_mul(d, a24, e);  /* d = A24 * e */
+        fe_add(aa, aa, d);  /* aa = aa + A24*e */
+        fe_mul(z2, e, aa);  /* z2 = e * (aa + A24*e) */
         
-        /* Conditional swap */
         if (bit) {
             fe_cswap(x2, x3, 1);
             fe_cswap(z2, z3, 1);
@@ -424,6 +423,7 @@ static void x25519_sw(uint8_t *out, const uint8_t *scalar, const uint8_t *point)
     fe_tobytes(out, x2);
 }
 
+
 void se050_x25519_sw_clamp(uint8_t *scalar)
 {
     scalar[0] &= 248;