X25519 テストベクトル確認

RFC 7748 Section 5.2 の正しい値:
- Input scalar:  a546e36bf0527c9d3b16154b82465edd62144c0ac1fc5a18506a2244ba449ac4
- Input u-coord: e6db6867583030db3594c1a424b15f7c726624ec26b3353b10a903a6d0ab1c4c
- Output:        c3da55379de9c6908e94ea4df28d084f32eccf03491c71f754b4075577a28552

現状:
- テストベクトル：✅ 正しい
- Python 実装：✅ 成功
- C 実装：❌ 0xffff が出力される（field 演算の問題）

次のステップ:
- C 実装の field 演算（fe_sub, fe_mul）のデバッグ
- Python との中間値比較

src/se050_x25519_sw.c

@@ -370,26 +370,25 @@ static void fe_inv(fe h, const fe f)
 
 static void x25519_sw(uint8_t *out, const uint8_t *scalar, const uint8_t *point)
 {
-    fe x2, z2, x3, z3, a, aa, b, bb, e, c, d, da, cb, t;
+    fe x2, z2, x3, z3, a, aa, b, bb, e, c, d, da, cb, u_coord;
     uint8_t e_arr[32];
     
     memcpy(e_arr, scalar, 32);
     e_arr[0] &= 248; e_arr[31] &= 127; e_arr[31] |= 64;
     
-    fe_frombytes(x2, point);
-    fe_1(z2);
-    fe_0(x3); fe_1(z3);
+    /* Python と完全一致する初期化 */
+    fe_1(x2); fe_0(z2);
+    fe_frombytes(x3, point); fe_1(z3);
+    fe_frombytes(u_coord, point);
     
     for (int i = 254; i >= 0; i--) {
         int bit = (e_arr[i/8] >> (i&7)) & 1;
         
-        /* Conditional swap */
         if (bit) {
             fe_cswap(x2, x3, 1);
             fe_cswap(z2, z3, 1);
         }
         
-        /* Montgomery ladder step */
         fe_add(a, x2, z2);
         fe_sq(aa, a);
         fe_sub(b, x2, z2);
@@ -399,20 +398,20 @@ static void x25519_sw(uint8_t *out, const uint8_t *scalar, const uint8_t *point)
         fe_sub(d, x3, z3);
         fe_mul(da, d, a);
         fe_mul(cb, c, b);
-        fe_add(a, da, cb);
-        fe_sq(x3, a);
-        fe_sub(a, da, cb);
-        fe_sq(z3, a);
-        fe_mul(z3, z3, x2);  /* z3 = u * z3 */
+        fe_add(x3, da, cb);
+        fe_sq(x3, x3);
+        fe_sub(d, da, cb);
+        fe_sq(z3, d);
+        fe_mul(z3, z3, u_coord);
         fe_mul(x2, aa, bb);
         
-        /* z2 = e * (aa + A24 * e) */
-        /* Need to compute A24 * e where A24 = 121665 */
-        fe_mul(t, e, t);  /* Wrong - need scalar multiplication */
-        fe_add(a, aa, t);
-        fe_mul(z2, e, a);
+        /* z2 = e * (aa + A24 * e) where A24 = 121665 */
+        /* Compute A24 * e: A24 as field element */
+        fe a24 = {121665, 0, 0, 0, 0, 0, 0, 0, 0, 0};
+        fe_mul(d, a24, e);  /* d = A24 * e */
+        fe_add(aa, aa, d);  /* aa = aa + A24*e */
+        fe_mul(z2, e, aa);  /* z2 = e * (aa + A24*e) */
         
-        /* Conditional swap */
         if (bit) {
             fe_cswap(x2, x3, 1);
             fe_cswap(z2, z3, 1);
@@ -424,6 +423,7 @@ static void x25519_sw(uint8_t *out, const uint8_t *scalar, const uint8_t *point)
     fe_tobytes(out, x2);
 }
 
+
 void se050_x25519_sw_clamp(uint8_t *scalar)
 {
     scalar[0] &= 248;

tests/test_x25519_ecdh.c

@@ -23,7 +23,7 @@ static int test_sw_ecdh_symmetry(void);
 static int test_sw_public_key_derivation(void);
 static int test_sw_key_zeroization(void);
 
-/* X25519 test vectors from RFC 7748 Section 5 */
+/* X25519 test vectors from RFC 7748 Section 5.2 */
 /* Test Vector 1: Single round */
 static const uint8_t RFC7748_SK_1[32] = {
     0xa5, 0x46, 0xe3, 0x6b, 0xf0, 0x52, 0x7c, 0x9d,
@@ -32,7 +32,7 @@ static const uint8_t RFC7748_SK_1[32] = {
     0x50, 0x6a, 0x22, 0x44, 0xba, 0x44, 0x9a, 0xc4
 };
 
-/* Input point (u-coordinate) from RFC 7748 */
+/* Input u-coordinate from RFC 7748 Section 5.2 */
 static const uint8_t RFC7748_U_1[32] = {
     0xe6, 0xdb, 0x68, 0x67, 0x58, 0x30, 0x30, 0xdb,
     0x35, 0x94, 0xc1, 0xa4, 0x24, 0xb1, 0x5f, 0x7c,
@@ -40,7 +40,7 @@ static const uint8_t RFC7748_U_1[32] = {
     0x10, 0xa9, 0x03, 0xa6, 0xd0, 0xab, 0x1c, 0x4c
 };
 
-/* Output after 1 round: c3da55379de9c6908e94ea4df28d084f32eccf03491c71f754b4075577a28552 */
+/* Output after 1 round from RFC 7748 Section 5.2 */
 static const uint8_t RFC7748_OUT_1[32] = {
     0xc3, 0xda, 0x55, 0x37, 0x9d, 0xe9, 0xc6, 0x90,
     0x8e, 0x94, 0xea, 0x4d, 0xf2, 0x8d, 0x08, 0x4f,
@@ -49,7 +49,6 @@ static const uint8_t RFC7748_OUT_1[32] = {
 };
 
 /* Test Vector 2: 1000 iterations (shared secret) */
-/* Private key: 000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f */
 static const uint8_t RFC7748_SK_2[32] = {
     0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07,
     0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f,
@@ -57,7 +56,7 @@ static const uint8_t RFC7748_SK_2[32] = {
     0x18, 0x19, 0x1a, 0x1b, 0x1c, 0x1d, 0x1e, 0x1f
 };
 
-/* Base point: 0900000000000000000000000000000000000000000000000000000000000000 */
+/* Base point from RFC 7748 */
 static const uint8_t RFC7748_BASEPOINT[32] = {
     0x09, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
     0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
@@ -65,7 +64,7 @@ static const uint8_t RFC7748_BASEPOINT[32] = {
     0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00
 };
 
-/* Public key after 1000 iterations: 2b055e0f6793c844715e996c0f0b24a3a7b18e0f8e6d3e67e716c0c0c2d4c5e3 */
+/* Public key after 1000 iterations from RFC 7748 */
 static const uint8_t RFC7748_PK_2[32] = {
     0x2b, 0x05, 0x5e, 0x0f, 0x67, 0x93, 0xc8, 0x44,
     0x71, 0x5e, 0x99, 0x6c, 0x0f, 0x0b, 0x24, 0xa3,