// Copyright (c) 2013-2016 The btcsuite developers
// Copyright (c) 2015-2022 The Decred developers
// Use of this source code is governed by an ISC
// license that can be found in the LICENSE file.

// TODO: change this test to use sha256 (tests are still valid only the
//  generated hash differs, of course)

package ecdsa

import (
	"errors"
	"math/rand"
	"testing"
	"time"

	"crypto.orly/ec/secp256k1"
	"encoders.orly/hex"
	"lol.mleku.dev/chk"
	"utils.orly"
)

// hexToBytes converts the passed hex string into bytes and will panic if there
// is an error.  This is only provided for the hard-coded constants so errors in
// the source code can be detected. It will only (and must only) be called with
// hard-coded values.
func hexToBytes(s string) []byte {
	b, err := hex.Dec(s)
	if err != nil {
		panic("invalid hex in source file: " + s)
	}
	return b
}

// TestSignatureParsing ensures that signatures are properly parsed according
// to DER rules.  The error paths are tested as well.
func TestSignatureParsing(t *testing.T) {
	tests := []struct {
		name string
		sig  []byte
		err  error
	}{
		{
			// signature from Decred blockchain tx
			// 76634e947f49dfc6228c3e8a09cd3e9e15893439fc06df7df0fc6f08d659856c:0
			name: "valid signature 1",
			sig: hexToBytes(
				"3045022100cd496f2ab4fe124f977ffe3caa09f7576d8a34156" +
					"b4e55d326b4dffc0399a094022013500a0510b5094bff220c74656879b8ca03" +
					"69d3da78004004c970790862fc03",
			),
			err: nil,
		}, {
			// signature from Decred blockchain tx
			// 76634e947f49dfc6228c3e8a09cd3e9e15893439fc06df7df0fc6f08d659856c:1
			name: "valid signature 2",
			sig: hexToBytes(
				"3044022036334e598e51879d10bf9ce3171666bc2d1bbba6164" +
					"cf46dd1d882896ba35d5d022056c39af9ea265c1b6d7eab5bc977f06f81e35c" +
					"dcac16f3ec0fd218e30f2bad2a",
			),
			err: nil,
		}, {
			name: "empty",
			sig:  nil,
			err:  ErrSigTooShort,
		}, {
			name: "too short",
			sig:  hexToBytes("30050201000200"),
			err:  ErrSigTooShort,
		}, {
			name: "too long",
			sig: hexToBytes(
				"3045022100f5353150d31a63f4a0d06d1f5a01ac65f7267a719e" +
					"49f2a1ac584fd546bef074022030e09575e7a1541aa018876a4003cefe1b061a" +
					"90556b5140c63e0ef8481352480101",
			),
			err: ErrSigTooLong,
		}, {
			name: "bad ASN.1 sequence id",
			sig: hexToBytes(
				"3145022100f5353150d31a63f4a0d06d1f5a01ac65f7267a719e" +
					"49f2a1ac584fd546bef074022030e09575e7a1541aa018876a4003cefe1b061a" +
					"90556b5140c63e0ef848135248",
			),
			err: ErrSigInvalidSeqID,
		}, {
			name: "mismatched data length (short one byte)",
			sig: hexToBytes(
				"3044022100f5353150d31a63f4a0d06d1f5a01ac65f7267a719e" +
					"49f2a1ac584fd546bef074022030e09575e7a1541aa018876a4003cefe1b061a" +
					"90556b5140c63e0ef848135248",
			),
			err: ErrSigInvalidDataLen,
		}, {
			name: "mismatched data length (long one byte)",
			sig: hexToBytes(
				"3046022100f5353150d31a63f4a0d06d1f5a01ac65f7267a719e" +
					"49f2a1ac584fd546bef074022030e09575e7a1541aa018876a4003cefe1b061a" +
					"90556b5140c63e0ef848135248",
			),
			err: ErrSigInvalidDataLen,
		}, {
			name: "bad R ASN.1 int marker",
			sig: hexToBytes(
				"304403204e45e16932b8af514961a1d3a1a25fdf3f4f7732e9d6" +
					"24c6c61548ab5fb8cd410220181522ec8eca07de4860a4acdd12909d831cc56c" +
					"bbac4622082221a8768d1d09",
			),
			err: ErrSigInvalidRIntID,
		}, {
			name: "zero R length",
			sig: hexToBytes(
				"30240200022030e09575e7a1541aa018876a4003cefe1b061a90" +
					"556b5140c63e0ef848135248",
			),
			err: ErrSigZeroRLen,
		}, {
			name: "negative R (too little padding)",
			sig: hexToBytes(
				"30440220b2ec8d34d473c3aa2ab5eb7cc4a0783977e5db8c8daf" +
					"777e0b6d7bfa6b6623f302207df6f09af2c40460da2c2c5778f636d3b2e27e20" +
					"d10d90f5a5afb45231454700",
			),
			err: ErrSigNegativeR,
		}, {
			name: "too much R padding",
			sig: hexToBytes(
				"304402200077f6e93de5ed43cf1dfddaa79fca4b766e1a8fc879" +
					"b0333d377f62538d7eb5022054fed940d227ed06d6ef08f320976503848ed1f5" +
					"2d0dd6d17f80c9c160b01d86",
			),
			err: ErrSigTooMuchRPadding,
		}, {
			name: "bad S ASN.1 int marker",
			sig: hexToBytes(
				"3045022100f5353150d31a63f4a0d06d1f5a01ac65f7267a719e" +
					"49f2a1ac584fd546bef074032030e09575e7a1541aa018876a4003cefe1b061a" +
					"90556b5140c63e0ef848135248",
			),
			err: ErrSigInvalidSIntID,
		}, {
			name: "missing S ASN.1 int marker",
			sig: hexToBytes(
				"3023022100f5353150d31a63f4a0d06d1f5a01ac65f7267a719e" +
					"49f2a1ac584fd546bef074",
			),
			err: ErrSigMissingSTypeID,
		}, {
			name: "S length missing",
			sig: hexToBytes(
				"3024022100f5353150d31a63f4a0d06d1f5a01ac65f7267a719e" +
					"49f2a1ac584fd546bef07402",
			),
			err: ErrSigMissingSLen,
		}, {
			name: "invalid S length (short one byte)",
			sig: hexToBytes(
				"3045022100f5353150d31a63f4a0d06d1f5a01ac65f7267a719e" +
					"49f2a1ac584fd546bef074021f30e09575e7a1541aa018876a4003cefe1b061a" +
					"90556b5140c63e0ef848135248",
			),
			err: ErrSigInvalidSLen,
		}, {
			name: "invalid S length (long one byte)",
			sig: hexToBytes(
				"3045022100f5353150d31a63f4a0d06d1f5a01ac65f7267a719e" +
					"49f2a1ac584fd546bef074022130e09575e7a1541aa018876a4003cefe1b061a" +
					"90556b5140c63e0ef848135248",
			),
			err: ErrSigInvalidSLen,
		}, {
			name: "zero S length",
			sig: hexToBytes(
				"3025022100f5353150d31a63f4a0d06d1f5a01ac65f7267a719e" +
					"49f2a1ac584fd546bef0740200",
			),
			err: ErrSigZeroSLen,
		}, {
			name: "negative S (too little padding)",
			sig: hexToBytes(
				"304402204fc10344934662ca0a93a84d14d650d8a21cf2ab91f6" +
					"08e8783d2999c955443202208441aacd6b17038ff3f6700b042934f9a6fea0ce" +
					"c2051b51dc709e52a5bb7d61",
			),
			err: ErrSigNegativeS,
		}, {
			name: "too much S padding",
			sig: hexToBytes(
				"304402206ad2fdaf8caba0f2cb2484e61b81ced77474b4c2aa06" +
					"9c852df1351b3314fe20022000695ad175b09a4a41cd9433f6b2e8e83253d6a7" +
					"402096ba313a7be1f086dde5",
			),
			err: ErrSigTooMuchSPadding,
		}, {
			name: "R == 0",
			sig: hexToBytes(
				"30250201000220181522ec8eca07de4860a4acdd12909d831cc5" +
					"6cbbac4622082221a8768d1d09",
			),
			err: ErrSigRIsZero,
		}, {
			name: "R == N",
			sig: hexToBytes(
				"3045022100fffffffffffffffffffffffffffffffebaaedce6af" +
					"48a03bbfd25e8cd03641410220181522ec8eca07de4860a4acdd12909d831cc5" +
					"6cbbac4622082221a8768d1d09",
			),
			err: ErrSigRTooBig,
		}, {
			name: "R > N (>32 bytes)",
			sig: hexToBytes(
				"3045022101cd496f2ab4fe124f977ffe3caa09f756283910fc1a" +
					"96f60ee6873e88d3cfe1d50220181522ec8eca07de4860a4acdd12909d831cc5" +
					"6cbbac4622082221a8768d1d09",
			),
			err: ErrSigRTooBig,
		}, {
			name: "R > N",
			sig: hexToBytes(
				"3045022100fffffffffffffffffffffffffffffffebaaedce6af" +
					"48a03bbfd25e8cd03641420220181522ec8eca07de4860a4acdd12909d831cc5" +
					"6cbbac4622082221a8768d1d09",
			),
			err: ErrSigRTooBig,
		}, {
			name: "S == 0",
			sig: hexToBytes(
				"302502204e45e16932b8af514961a1d3a1a25fdf3f4f7732e9d6" +
					"24c6c61548ab5fb8cd41020100",
			),
			err: ErrSigSIsZero,
		}, {
			name: "S == N",
			sig: hexToBytes(
				"304502204e45e16932b8af514961a1d3a1a25fdf3f4f7732e9d6" +
					"24c6c61548ab5fb8cd41022100fffffffffffffffffffffffffffffffebaaedc" +
					"e6af48a03bbfd25e8cd0364141",
			),
			err: ErrSigSTooBig,
		}, {
			name: "S > N (>32 bytes)",
			sig: hexToBytes(
				"304502204e45e16932b8af514961a1d3a1a25fdf3f4f7732e9d6" +
					"24c6c61548ab5fb8cd4102210113500a0510b5094bff220c74656879b784b246" +
					"ba89c0a07bc49bcf05d8993d44",
			),
			err: ErrSigSTooBig,
		}, {
			name: "S > N",
			sig: hexToBytes(
				"304502204e45e16932b8af514961a1d3a1a25fdf3f4f7732e9d6" +
					"24c6c61548ab5fb8cd41022100fffffffffffffffffffffffffffffffebaaedc" +
					"e6af48a03bbfd25e8cd0364142",
			),
			err: ErrSigSTooBig,
		},
	}
	for _, test := range tests {
		_, err := ParseDERSignature(test.sig)
		if !errors.Is(err, test.err) {
			t.Errorf(
				"%s mismatched err -- got %v, want %v", test.name, err,
				test.err,
			)
			continue
		}
	}
}

// TestSignatureSerialize ensures that serializing signatures works as expected.
func TestSignatureSerialize(t *testing.T) {
	tests := []struct {
		name     string
		ecsig    *Signature
		expected []byte
	}{
		{
			// signature from bitcoin blockchain tx
			// 0437cd7f8525ceed2324359c2d0ba26006d92d85
			"valid 1 - r and s most significant bits are zero",
			&Signature{
				r: *hexToModNScalar("4e45e16932b8af514961a1d3a1a25fdf3f4f7732e9d624c6c61548ab5fb8cd41"),
				s: *hexToModNScalar("181522ec8eca07de4860a4acdd12909d831cc56cbbac4622082221a8768d1d09"),
			},
			hexToBytes(
				"304402204e45e16932b8af514961a1d3a1a25fdf3f4f7732e9d62" +
					"4c6c61548ab5fb8cd410220181522ec8eca07de4860a4acdd12909d831cc" +
					"56cbbac4622082221a8768d1d09",
			),
		}, {
			// signature from bitcoin blockchain tx
			// cb00f8a0573b18faa8c4f467b049f5d202bf1101d9ef2633bc611be70376a4b4
			"valid 2 - r most significant bit is one",
			&Signature{
				r: *hexToModNScalar("82235e21a2300022738dabb8e1bbd9d19cfb1e7ab8c30a23b0afbb8d178abcf3"),
				s: *hexToModNScalar("24bf68e256c534ddfaf966bf908deb944305596f7bdcc38d69acad7f9c868724"),
			},
			hexToBytes(
				"304502210082235e21a2300022738dabb8e1bbd9d19cfb1e7ab8c" +
					"30a23b0afbb8d178abcf3022024bf68e256c534ddfaf966bf908deb94430" +
					"5596f7bdcc38d69acad7f9c868724",
			),
		}, {
			// signature from bitcoin blockchain tx
			// fda204502a3345e08afd6af27377c052e77f1fefeaeb31bdd45f1e1237ca5470
			//
			// Note that signatures with an S component that is > half the group
			// order are neither allowed nor produced in Decred, so this has been
			// modified to expect the equally valid low S signature variant.
			"valid 3 - s most significant bit is one",
			&Signature{
				r: *hexToModNScalar("1cadddc2838598fee7dc35a12b340c6bde8b389f7bfd19a1252a17c4b5ed2d71"),
				s: *hexToModNScalar("c1a251bbecb14b058a8bd77f65de87e51c47e95904f4c0e9d52eddc21c1415ac"),
			},
			hexToBytes(
				"304402201cadddc2838598fee7dc35a12b340c6bde8b389f7bfd1" +
					"9a1252a17c4b5ed2d7102203e5dae44134eb4fa757428809a2178199e66f" +
					"38daa53df51eaa380cab4222b95",
			),
		}, {
			"zero signature",
			&Signature{
				r: *new(secp256k1.ModNScalar).SetInt(0),
				s: *new(secp256k1.ModNScalar).SetInt(0),
			},
			hexToBytes("3006020100020100"),
		},
	}
	for i, test := range tests {
		result := test.ecsig.Serialize()
		if !utils.FastEqual(result, test.expected) {
			t.Errorf(
				"Serialize #%d (%s) unexpected result:\n"+
					"got:  %x\nwant: %x", i, test.name, result,
				test.expected,
			)
		}
	}
}

// signTest describes tests for producing and verifying ECDSA signatures for a
// selected set of secret keys, messages, and nonces that have been verified
// independently with the Sage computer algebra system.  It is defined
// separately since it is intended for use in both normal and compact signature
// tests.
type signTest struct {
	name     string // test description
	key      string // hex encoded secret key
	msg      string // hex encoded message to sign before hashing
	hash     string // hex encoded hash of the message to sign
	nonce    string // hex encoded nonce to use in the signature calculation
	rfc6979  bool   // whether the nonce is an RFC6979 nonce
	wantSigR string // hex encoded expected signature R
	wantSigS string // hex encoded expected signature S
	wantCode byte   // expected public key recovery code
}

// // signTests returns several tests for ECDSA signatures that use a selected set
// // of secret keys, messages, and nonces that have been verified independently
// // with the Sage computer algebra system.  It is defined here versus inside a
// // specific test function scope so it can be shared for both normal and compact
// // signature tests.
// func signTests(t *testing.T) []signTest {
// 	t.Helper()
//
// 	tests := []signTest{{
// 		name:     "key 0x1, blake256(0x01020304), rfc6979 nonce",
// 		key:      "0000000000000000000000000000000000000000000000000000000000000001",
// 		msg:      "01020304",
// 		hash:     "c301ba9de5d6053caad9f5eb46523f007702add2c62fa39de03146a36b8026b7",
// 		nonce:    "4154324ecd4158938f1df8b5b659aeb639c7fbc36005934096e514af7d64bcc2",
// 		rfc6979:  true,
// 		wantSigR: "c6c4137b0e5fbfc88ae3f293d7e80c8566c43ae20340075d44f75b009c943d09",
// 		wantSigS: "00ba213513572e35943d5acdd17215561b03f11663192a7252196cc8b2a99560",
// 		wantCode: 0,
// 	}, {
// 		name:     "key 0x1, blake256(0x01020304), random nonce",
// 		key:      "0000000000000000000000000000000000000000000000000000000000000001",
// 		msg:      "01020304",
// 		hash:     "c301ba9de5d6053caad9f5eb46523f007702add2c62fa39de03146a36b8026b7",
// 		nonce:    "a6df66500afeb7711d4c8e2220960855d940a5ed57260d2c98fbf6066cca283e",
// 		rfc6979:  false,
// 		wantSigR: "b073759a96a835b09b79e7b93c37fdbe48fb82b000c4a0e1404ba5d1fbc15d0a",
// 		wantSigS: "7e34928a3e3832ec21e7711644d9388f7deb6340ead661d7056b0665974b87f3",
// 		wantCode: pubKeyRecoveryCodeOddnessBit,
// 	}, {
// 		name:     "key 0x2, blake256(0x01020304), rfc6979 nonce",
// 		key:      "0000000000000000000000000000000000000000000000000000000000000002",
// 		msg:      "01020304",
// 		hash:     "c301ba9de5d6053caad9f5eb46523f007702add2c62fa39de03146a36b8026b7",
// 		nonce:    "55f96f24cf7531f527edfe3b9222eca12d575367c32a7f593a828dc3651acf49",
// 		rfc6979:  true,
// 		wantSigR: "e6f137b52377250760cc702e19b7aee3c63b0e7d95a91939b14ab3b5c4771e59",
// 		wantSigS: "44b9bc4620afa158b7efdfea5234ff2d5f2f78b42886f02cf581827ee55318ea",
// 		wantCode: pubKeyRecoveryCodeOddnessBit,
// 	}, {
// 		name:     "key 0x2, blake256(0x01020304), random nonce",
// 		key:      "0000000000000000000000000000000000000000000000000000000000000002",
// 		msg:      "01020304",
// 		hash:     "c301ba9de5d6053caad9f5eb46523f007702add2c62fa39de03146a36b8026b7",
// 		nonce:    "679a6d36e7fe6c02d7668af86d78186e8f9ccc04371ac1c8c37939d1f5cae07a",
// 		rfc6979:  false,
// 		wantSigR: "4a090d82f48ca12d9e7aa24b5dcc187ee0db2920496f671d63e86036aaa7997e",
// 		wantSigS: "261ffe8ba45007fc5fbbba6b4c6ed41beafb48b09fa8af1d6a3fbc6ccefbad",
// 		wantCode: 0,
// 	}, {
// 		name:     "key 0x1, blake256(0x0102030405), rfc6979 nonce",
// 		key:      "0000000000000000000000000000000000000000000000000000000000000001",
// 		msg:      "0102030405",
// 		hash:     "dc063eba3c8d52a159e725c1a161506f6cb6b53478ad5ef3f08d534efa871d9f",
// 		nonce:    "aa87a543c68f2568bb107c9946afa5233bf94fb6a7a063544505282621021629",
// 		rfc6979:  true,
// 		wantSigR: "dda8308cdbda2edf51ccf598b42b42b19597e102eb2ed4a04a16dd57084d3b40",
// 		wantSigS: "0b6d67bab4929624e28f690407a15efc551354544fdc179970ff401eec2e5dc9",
// 		wantCode: pubKeyRecoveryCodeOddnessBit,
// 	}, {
// 		name:     "key 0x1, blake256(0x0102030405), random nonce",
// 		key:      "0000000000000000000000000000000000000000000000000000000000000001",
// 		msg:      "0102030405",
// 		hash:     "dc063eba3c8d52a159e725c1a161506f6cb6b53478ad5ef3f08d534efa871d9f",
// 		nonce:    "65f880c892fdb6e7f74f76b18c7c942cfd037ef9cf97c39c36e08bbc36b41616",
// 		rfc6979:  false,
// 		wantSigR: "72e5666f4e9d1099447b825cf737ee32112f17a67e2ca7017ae098da31dfbb8b",
// 		wantSigS: "1a7326da661a62f66358dcf53300afdc8e8407939dae1192b5b0899b0254311b",
// 		wantCode: pubKeyRecoveryCodeOddnessBit,
// 	}, {
// 		name:     "key 0x2, blake256(0x0102030405), rfc6979 nonce",
// 		key:      "0000000000000000000000000000000000000000000000000000000000000002",
// 		msg:      "0102030405",
// 		hash:     "dc063eba3c8d52a159e725c1a161506f6cb6b53478ad5ef3f08d534efa871d9f",
// 		nonce:    "a13d652abd54b6e862548e5d12716df14dc192d93f3fa13536fdf4e56c54f233",
// 		rfc6979:  true,
// 		wantSigR: "122663fd29e41a132d3c8329cf05d61ebcca9351074cc277dcd868faba58d87d",
// 		wantSigS: "353a44f2d949c04981e4e4d9c1f93a9e0644e63a5eaa188288c5ad68fd288d40",
// 		wantCode: 0,
// 	}, {
// 		name:     "key 0x2, blake256(0x0102030405), random nonce",
// 		key:      "0000000000000000000000000000000000000000000000000000000000000002",
// 		msg:      "0102030405",
// 		hash:     "dc063eba3c8d52a159e725c1a161506f6cb6b53478ad5ef3f08d534efa871d9f",
// 		nonce:    "026ece4cfb704733dd5eef7898e44c33bd5a0d749eb043f48705e40fa9e9afa0",
// 		rfc6979:  false,
// 		wantSigR: "3c4c5a2f217ea758113fd4e89eb756314dfad101a300f48e5bd764d3b6e0f8bf",
// 		wantSigS: "6513e82442f133cb892514926ed9158328ead488ff1b027a31827603a65009df",
// 		wantCode: pubKeyRecoveryCodeOddnessBit,
// 	}, {
// 		name:     "random key 1, blake256(0x01), rfc6979 nonce",
// 		key:      "a1becef2069444a9dc6331c3247e113c3ee142edda683db8643f9cb0af7cbe33",
// 		msg:      "01",
// 		hash:     "4a6c419a1e25c85327115c4ace586decddfe2990ed8f3d4d801871158338501d",
// 		nonce:    "edb3a01063a0c6ccfc0d77295077cbd322cf364bfa64b7eeea3b20305135d444",
// 		rfc6979:  true,
// 		wantSigR: "ef392791d87afca8256c4c9c68d981248ee34a09069f50fa8dfc19ae34cd92ce",
// 		wantSigS: "0a2b9cb69fd794f7f204c272293b8585a294916a21a11fd94ec04acae2dc6d21",
// 		wantCode: 0,
// 	}, {
// 		name:     "random key 2, blake256(0x02), rfc6979 nonce",
// 		key:      "59930b76d4b15767ec0e8c8e5812aa2e57db30c6af7963e2a6295ba02af5416b",
// 		msg:      "02",
// 		hash:     "49af37ab5270015fe25276ea5a3bb159d852943df23919522a202205fb7d175c",
// 		nonce:    "af2a59085976494567ef0fc2ecede587b2d1d8e9898cc46e72d7f3e33156e057",
// 		rfc6979:  true,
// 		wantSigR: "886c9cccb356b3e1deafef2c276a4f8717ab73c1244c3f673cfbff5897de0e06",
// 		wantSigS: "609394185495f978ae84b69be90c69947e5dd8dcb4726da604fcbd139d81fc55",
// 		wantCode: 0,
// 	}, {
// 		name:     "random key 3, blake256(0x03), rfc6979 nonce",
// 		key:      "c5b205c36bb7497d242e96ec19a2a4f086d8daa919135cf490d2b7c0230f0e91",
// 		msg:      "03",
// 		hash:     "b706d561742ad3671703c247eb927ee8a386369c79644131cdeb2c5c26bf6c5d",
// 		nonce:    "82d82b696a386d6d7a111c4cb943bfd39de8e5f6195e7eed9d3edb40fe1419fa",
// 		rfc6979:  true,
// 		wantSigR: "6589d5950cec1fe2e7e20593b5ffa3556de20c176720a1796aa77a0cec1ec5a7",
// 		wantSigS: "2a26deba3241de852e786f5b4e2b98d3efb958d91fe9773b331dbcca9e8be800",
// 		wantCode: 0,
// 	}, {
// 		name:     "random key 4, blake256(0x04), rfc6979 nonce",
// 		key:      "65b46d4eb001c649a86309286aaf94b18386effe62c2e1586d9b1898ccf0099b",
// 		msg:      "04",
// 		hash:     "4c6eb9e38415034f4c93d3304d10bef38bf0ad420eefd0f72f940f11c5857786",
// 		nonce:    "7afd696a9e770961d2b2eaec77ab7c22c734886fa57bc4a50a9f1946168cd06f",
// 		rfc6979:  true,
// 		wantSigR: "81db1d6dca08819ad936d3284a359091e57c036648d477b96af9d8326965a7d1",
// 		wantSigS: "1bdf719c4be69351ba7617a187ac246912101aea4b5a7d6dfc234478622b43c6",
// 		wantCode: pubKeyRecoveryCodeOddnessBit,
// 	}, {
// 		name:     "random key 5, blake256(0x05), rfc6979 nonce",
// 		key:      "915cb9ba4675de06a182088b182abcf79fa8ac989328212c6b866fa3ec2338f9",
// 		msg:      "05",
// 		hash:     "bdd15db13448905791a70b68137445e607cca06cc71c7a58b9b2e84a06c54d08",
// 		nonce:    "2a6ae70ea5cf1b932331901d640ece54551f5f33bf9484d5f95c676b5612b527",
// 		rfc6979:  true,
// 		wantSigR: "47fd51aecbc743477cb59aa29d18d11d75fb206ae1cdd044216e4f294e33d5b6",
// 		wantSigS: "3d50edc03066584d50b8d19d681865a23960b37502ede5bf452bdca56744334a",
// 		wantCode: pubKeyRecoveryCodeOddnessBit,
// 	}, {
// 		name:     "random key 6, blake256(0x06), rfc6979 nonce",
// 		key:      "93e9d81d818f08ba1f850c6dfb82256b035b42f7d43c1fe090804fb009aca441",
// 		msg:      "06",
// 		hash:     "19b7506ad9c189a9f8b063d2aee15953d335f5c88480f8515d7d848e7771c4ae",
// 		nonce:    "0b847a0ae0cbe84dfca66621f04f04b0f2ec190dce10d43ba8c3915c0fcd90ed",
// 		rfc6979:  true,
// 		wantSigR: "c99800bc7ac7ea11afe5d7a264f4c26edd63ae9c7ecd6d0d19992980bcda1d34",
// 		wantSigS: "2844d4c9020ddf9e96b86c1a04788e0f371bd562291fd17ee017db46259d04fb",
// 		wantCode: pubKeyRecoveryCodeOddnessBit,
// 	}, {
// 		name:     "random key 7, blake256(0x07), rfc6979 nonce",
// 		key:      "c249bbd5f533672b7dcd514eb1256854783531c2b85fe60bf4ce6ea1f26afc2b",
// 		msg:      "07",
// 		hash:     "53d661e71e47a0a7e416591200175122d83f8af31be6a70af7417ad6f54d0038",
// 		nonce:    "0f8e20694fe766d7b79e5ac141e3542f2f3c3d2cc6d0f60e0ec263a46dbe6d49",
// 		rfc6979:  true,
// 		wantSigR: "7a57a5222fb7d615eaa0041193f682262cebfa9b448f9c519d3644d0a3348521",
// 		wantSigS: "574923b7b5aec66b62f1589002db29342c9f5ed56d5e80f5361c0307ff1561fa",
// 		wantCode: 0,
// 	}, {
// 		name:     "random key 8, blake256(0x08), rfc6979 nonce",
// 		key:      "ec0be92fcec66cf1f97b5c39f83dfd4ddcad0dad468d3685b5eec556c6290bcc",
// 		msg:      "08",
// 		hash:     "9bff7982eab6f7883322edf7bdc86a23c87ca1c07906fbb1584f57b197dc6253",
// 		nonce:    "ab7df49257d18f5f1b730cc7448f46bd82eb43e6e220f521fa7d23802310e24d",
// 		rfc6979:  true,
// 		wantSigR: "64f90b09c8b1763a3eeefd156e5d312f80a98c24017811c0163b1c0b01323668",
// 		wantSigS: "7d7bf4ff295ecfc9578eadc8378b0eea0c0362ad083b0fd1c9b3c06f4537f6ff",
// 		wantCode: pubKeyRecoveryCodeOddnessBit,
// 	}, {
// 		name:     "random key 9, blake256(0x09), rfc6979 nonce",
// 		key:      "6847b071a7cba6a85099b26a9c3e57a964e4990620e1e1c346fecc4472c4d834",
// 		msg:      "09",
// 		hash:     "4c2231813064f8500edae05b40195416bd543fd3e76c16d6efb10c816d92e8b6",
// 		nonce:    "48ea6c907e1cda596048d812439ccf416eece9a7de400c8a0e40bd48eb7e613a",
// 		rfc6979:  true,
// 		wantSigR: "81fc600775d3cdcaa14f8629537299b8226a0c8bfce9320ce64a8d14e3f95bae",
// 		wantSigS: "3607997d36b48bce957ae9b3d450e0969f6269554312a82bf9499efc8280ea6d",
// 		wantCode: 0,
// 	}, {
// 		name:     "random key 10, blake256(0x0a), rfc6979 nonce",
// 		key:      "b7548540f52fe20c161a0d623097f827608c56023f50442cc00cc50ad674f6b5",
// 		msg:      "0a",
// 		hash:     "e81db4f0d76e02805155441f50c861a8f86374f3ae34c7a3ff4111d3a634ecb1",
// 		nonce:    "95c07e315cd5457e84270ca01019563c8eeaffb18ab4f23e88a44a0ff01c5f6f",
// 		rfc6979:  true,
// 		wantSigR: "0d4cbf2da84f7448b083fce9b9c4e1834b5e2e98defcec7ec87e87c739f5fe78",
// 		wantSigS: "0997db60683e12b4494702347fc7ae7f599e5a95c629c146e0fc615a1a2acac5",
// 		wantCode: pubKeyRecoveryCodeOddnessBit,
// 	}}
//
// 	// Ensure the test data is sane by comparing the provided hashed message and
// 	// nonce, in the case RFC6979 was used, to their calculated values.  These
// 	// values could just be calculated instead of specified in the test data,
// 	// but it's nice to have all of the calculated values available in the test
// 	// data for cross implementation testing and verification.
// 	for _, test := range tests {
// 		msg := hexToBytes(test.msg)
// 		hash := hexToBytes(test.hash)
//
// 		calcHash := blake256.Sum256(msg)
// 		if !equals(calcHash[:], hash) {
// 			t.Errorf("%s: mismatched test hash -- expected: %x, given: %x",
// 				test.name, calcHash[:], hash)
// 			continue
// 		}
// 		if test.rfc6979 {
// 			secKeyBytes := hexToBytes(test.key)
// 			nonceBytes := hexToBytes(test.nonce)
// 			calcNonce := secp256k1.NonceRFC6979(secKeyBytes, hash, nil, nil, 0)
// 			calcNonceBytes := calcNonce.Bytes()
// 			if !equals(calcNonceBytes[:], nonceBytes) {
// 				t.Errorf("%s: mismatched test nonce -- expected: %x, given: %x",
// 					test.name, calcNonceBytes, nonceBytes)
// 				continue
// 			}
// 		}
// 	}
//
// 	return tests
// }

// // TestSignAndVerify ensures the ECDSA signing function produces the expected
// // signatures for a selected set of secret keys, messages, and nonces that have
// // been verified independently with the Sage computer algebra system.  It also
// // ensures verifying the signature works as expected.
// func TestSignAndVerify(t *testing.T) {
// 	t.Parallel()
//
// 	tests := signTests(t)
// 	for _, test := range tests {
// 		secKey := secp256k1.NewSecretKey(hexToModNScalar(test.key))
// 		hash := hexToBytes(test.hash)
// 		nonce := hexToModNScalar(test.nonce)
// 		wantSigR := hexToModNScalar(test.wantSigR)
// 		wantSigS := hexToModNScalar(test.wantSigS)
// 		wantSig := NewSignature(wantSigR, wantSigS).Serialize()
//
// 		// Sign the hash of the message with the given secret key and nonce.
// 		gotSig, recoveryCode, success := sign(&secKey.Key, nonce, hash)
// 		if !success {
// 			t.Errorf("%s: unexpected error when signing", test.name)
// 			continue
// 		}
//
// 		// Ensure the generated signature is the expected value.
// 		gotSigBytes := gotSig.Serialize()
// 		if !equals(gotSigBytes, wantSig) {
// 			t.Errorf("%s: unexpected signature -- got %x, want %x", test.name,
// 				gotSigBytes, wantSig)
// 			continue
// 		}
//
// 		// Ensure the generated public key recovery code is the expected value.
// 		if recoveryCode != test.wantCode {
// 			t.Errorf("%s: unexpected recovery code -- got %x, want %x",
// 				test.name, recoveryCode, test.wantCode)
// 			continue
// 		}
//
// 		// Ensure the produced signature verifies.
// 		pubKey := secKey.Pubkey()
// 		if !gotSig.Verify(hash, pubKey) {
// 			t.Errorf("%s: signature failed to verify", test.name)
// 			continue
// 		}
//
// 		// Ensure the signature generated by the exported method is the expected
// 		// value as well in the case RFC6979 was used.
// 		if test.rfc6979 {
// 			gotSig = Sign(secKey, hash)
// 			gotSigBytes := gotSig.Serialize()
// 			if !equals(gotSigBytes, wantSig) {
// 				t.Errorf("%s: unexpected signature -- got %x, want %x",
// 					test.name, gotSigBytes, wantSig)
// 				continue
// 			}
// 		}
// 	}
// }

// TestSignAndVerifyRandom ensures ECDSA signing and verification work as
// expected for randomly-generated secret keys and messages.  It also ensures
// invalid signatures are not improperly verified by mutating the valid
// signature and changing the message the signature covers.
func TestSignAndVerifyRandom(t *testing.T) {
	t.Parallel()

	// Use a unique random seed each test instance and log it if the tests fail.
	seed := time.Now().Unix()
	rng := rand.New(rand.NewSource(seed))
	defer func(t *testing.T, seed int64) {
		if t.Failed() {
			t.Logf("random seed: %d", seed)
		}
	}(t, seed)
	for i := 0; i < 100; i++ {
		// Generate a random secret key.
		var buf [32]byte
		if _, err := rng.Read(buf[:]); chk.T(err) {
			t.Fatalf("failed to read random secret key: %v", err)
		}
		var secKeyScalar secp256k1.ModNScalar
		secKeyScalar.SetBytes(&buf)
		secKey := secp256k1.NewSecretKey(&secKeyScalar)
		// Generate a random hash to sign.
		var hash [32]byte
		if _, err := rng.Read(hash[:]); chk.T(err) {
			t.Fatalf("failed to read random hash: %v", err)
		}
		// Sign the hash with the secret key and then ensure the produced
		// signature is valid for the hash and public key associated with the
		// secret key.
		sig := Sign(secKey, hash[:])
		pubKey := secKey.PubKey()
		if !sig.Verify(hash[:], pubKey) {
			t.Fatalf(
				"failed to verify signature\nsig: %x\nhash: %x\n"+
					"secret key: %x\npublic key: %x", sig.Serialize(), hash,
				secKey.Serialize(), pubKey.SerializeCompressed(),
			)
		}
		// Change a random bit in the signature and ensure the bad signature
		// fails to verify the original message.
		badSig := *sig
		randByte := rng.Intn(32)
		randBit := rng.Intn(7)
		if randComponent := rng.Intn(2); randComponent == 0 {
			badSigBytes := badSig.r.Bytes()
			badSigBytes[randByte] ^= 1 << randBit
			badSig.r.SetBytes(&badSigBytes)
		} else {
			badSigBytes := badSig.s.Bytes()
			badSigBytes[randByte] ^= 1 << randBit
			badSig.s.SetBytes(&badSigBytes)
		}
		if badSig.Verify(hash[:], pubKey) {
			t.Fatalf(
				"verified bad signature\nsig: %x\nhash: %x\n"+
					"secret key: %x\npublic key: %x", badSig.Serialize(), hash,
				secKey.Serialize(), pubKey.SerializeCompressed(),
			)
		}
		// Change a random bit in the hash that was originally signed and ensure
		// the original good signature fails to verify the new bad message.
		badHash := make([]byte, len(hash))
		copy(badHash, hash[:])
		randByte = rng.Intn(len(badHash))
		randBit = rng.Intn(7)
		badHash[randByte] ^= 1 << randBit
		if sig.Verify(badHash[:], pubKey) {
			t.Fatalf(
				"verified signature for bad hash\nsig: %x\nhash: %x\n"+
					"pubkey: %x", sig.Serialize(), badHash,
				pubKey.SerializeCompressed(),
			)
		}
	}
}

// TestSignFailures ensures the internal ECDSA signing function returns an
// unsuccessful result when particular combinations of values are unable to
// produce a valid signature.
func TestSignFailures(t *testing.T) {
	t.Parallel()
	tests := []struct {
		name  string // test description
		key   string // hex encoded secret key
		hash  string // hex encoded hash of the message to sign
		nonce string // hex encoded nonce to use in the signature calculation
	}{
		{
			name:  "zero R is invalid (forced by using zero nonce)",
			key:   "0000000000000000000000000000000000000000000000000000000000000001",
			hash:  "c301ba9de5d6053caad9f5eb46523f007702add2c62fa39de03146a36b8026b7",
			nonce: "0000000000000000000000000000000000000000000000000000000000000000",
		}, {
			name:  "zero S is invalid (forced by key/hash/nonce choice)",
			key:   "0000000000000000000000000000000000000000000000000000000000000001",
			hash:  "393bec84f1a04037751c0d6c2817f37953eaa204ac0898de7adb038c33a20438",
			nonce: "4154324ecd4158938f1df8b5b659aeb639c7fbc36005934096e514af7d64bcc2",
		},
	}
	for _, test := range tests {
		secKey := hexToModNScalar(test.key)
		hash := hexToBytes(test.hash)
		nonce := hexToModNScalar(test.nonce)
		// Ensure the signing is NOT successful.
		sig, _, success := sign(secKey, nonce, hash[:])
		if success {
			t.Errorf(
				"%s: unexpected success -- got sig %x", test.name,
				sig.Serialize(),
			)
			continue
		}
	}
}

// TestVerifyFailures ensures the ECDSA verification function returns an
// unsuccessful result for edge conditions.
func TestVerifyFailures(t *testing.T) {
	t.Parallel()

	tests := []struct {
		name string // test description
		key  string // hex encoded secret key
		hash string // hex encoded hash of the message to sign
		r, s string // hex encoded r and s components of signature to verify
	}{
		{
			name: "signature R is 0",
			key:  "0000000000000000000000000000000000000000000000000000000000000001",
			hash: "c301ba9de5d6053caad9f5eb46523f007702add2c62fa39de03146a36b8026b7",
			r:    "0000000000000000000000000000000000000000000000000000000000000000",
			s:    "00ba213513572e35943d5acdd17215561b03f11663192a7252196cc8b2a99560",
		}, {
			name: "signature S is 0",
			key:  "0000000000000000000000000000000000000000000000000000000000000001",
			hash: "c301ba9de5d6053caad9f5eb46523f007702add2c62fa39de03146a36b8026b7",
			r:    "c6c4137b0e5fbfc88ae3f293d7e80c8566c43ae20340075d44f75b009c943d09",
			s:    "0000000000000000000000000000000000000000000000000000000000000000",
		}, {
			name: "u1G + u2Q is the point at infinity",
			key:  "0000000000000000000000000000000000000000000000000000000000000001",
			hash: "c301ba9de5d6053caad9f5eb46523f007702add2c62fa39de03146a36b8026b7",
			r:    "3cfe45621a29fac355260a14b9adc0fe43ac2f13e918fc9ddfa117e964b61a8a",
			s:    "00ba213513572e35943d5acdd17215561b03f11663192a7252196cc8b2a99560",
		}, {
			name: "signature R < P-N, but invalid",
			key:  "0000000000000000000000000000000000000000000000000000000000000001",
			hash: "c301ba9de5d6053caad9f5eb46523f007702add2c62fa39de03146a36b8026b7",
			r:    "000000000000000000000000000000014551231950b75fc4402da1722fc9baed",
			s:    "00ba213513572e35943d5acdd17215561b03f11663192a7252196cc8b2a99560",
		},
	}
	for _, test := range tests {
		secKey := hexToModNScalar(test.key)
		hash := hexToBytes(test.hash)
		r := hexToModNScalar(test.r)
		s := hexToModNScalar(test.s)
		sig := NewSignature(r, s)
		// Ensure the verification is NOT successful.
		pubKey := secp256k1.NewSecretKey(secKey).PubKey()
		if sig.Verify(hash, pubKey) {
			t.Errorf(
				"%s: unexpected success for invalid signature: %x",
				test.name, sig.Serialize(),
			)
			continue
		}
	}
}

// TestSignatureIsEqual ensures that equality testing between two signatures
// works as expected.
func TestSignatureIsEqual(t *testing.T) {
	sig1 := &Signature{
		r: *hexToModNScalar("82235e21a2300022738dabb8e1bbd9d19cfb1e7ab8c30a23b0afbb8d178abcf3"),
		s: *hexToModNScalar("24bf68e256c534ddfaf966bf908deb944305596f7bdcc38d69acad7f9c868724"),
	}
	sig1Copy := &Signature{
		r: *hexToModNScalar("82235e21a2300022738dabb8e1bbd9d19cfb1e7ab8c30a23b0afbb8d178abcf3"),
		s: *hexToModNScalar("24bf68e256c534ddfaf966bf908deb944305596f7bdcc38d69acad7f9c868724"),
	}
	sig2 := &Signature{
		r: *hexToModNScalar("4e45e16932b8af514961a1d3a1a25fdf3f4f7732e9d624c6c61548ab5fb8cd41"),
		s: *hexToModNScalar("181522ec8eca07de4860a4acdd12909d831cc56cbbac4622082221a8768d1d09"),
	}
	if !sig1.IsEqual(sig1) {
		t.Fatalf("bad self signature equality check: %v == %v", sig1, sig1Copy)
	}
	if !sig1.IsEqual(sig1Copy) {
		t.Fatalf("bad signature equality check: %v == %v", sig1, sig1Copy)
	}

	if sig1.IsEqual(sig2) {
		t.Fatalf("bad signature equality check: %v != %v", sig1, sig2)
	}
}

// // TestSignAndRecoverCompact ensures compact (recoverable public key) ECDSA
// // signing and public key recovery works as expected for a selected set of
// // secret keys, messages, and nonces that have been verified independently with
// // the Sage computer algebra system.
// func TestSignAndRecoverCompact(t *testing.T) {
// 	t.Parallel()
//
// 	tests := signTests(t)
// 	for _, test := range tests {
// 		// Skip tests using nonces that are not RFC6979.
// 		if !test.rfc6979 {
// 			continue
// 		}
//
// 		// Parse test data.
// 		secKey := secp256k1.NewSecretKey(hexToModNScalar(test.key))
// 		pubKey := secKey.Pubkey()
// 		hash := hexToBytes(test.hash)
// 		wantSig := hexToBytes("00" + test.wantSigR + test.wantSigS)
//
// 		// Test compact signatures for both the compressed and uncompressed
// 		// versions of the public key.
// 		for _, compressed := range []bool{true, false} {
// 			// Populate the expected compact signature recovery code.
// 			wantRecoveryCode := compactSigMagicOffset + test.wantCode
// 			if compressed {
// 				wantRecoveryCode += compactSigCompPubKey
// 			}
// 			wantSig[0] = wantRecoveryCode
//
// 			// Sign the hash of the message with the given secret key and
// 			// ensure the generated signature is the expected value per the
// 			// specified compressed flag.
// 			gotSig := SignCompact(secKey, hash, compressed)
// 			if !equals(gotSig, wantSig) {
// 				t.Errorf("%s: unexpected signature -- got %x, want %x",
// 					test.name, gotSig, wantSig)
// 				continue
// 			}
//
// 			// Ensure the recovered public key and flag that indicates whether
// 			// or not the signature was for a compressed public key are the
// 			// expected values.
// 			gotPubKey, gotCompressed, err := RecoverCompact(gotSig, hash)
// 			if err != nil {
// 				t.Errorf("%s: unexpected error when recovering: %v", test.name,
// 					err)
// 				continue
// 			}
// 			if gotCompressed != compressed {
// 				t.Errorf("%s: unexpected compressed flag -- got %v, want %v",
// 					test.name, gotCompressed, compressed)
// 				continue
// 			}
// 			if !gotPubKey.IsEqual(pubKey) {
// 				t.Errorf("%s: unexpected public key -- got %x, want %x",
// 					test.name, gotPubKey.SerializeUncompressed(),
// 					pubKey.SerializeUncompressed())
// 				continue
// 			}
// 		}
// 	}
// }

// TestRecoverCompactErrors ensures several error paths in compact signature recovery are
// detected as expected. When possible, the signatures are otherwise valid, except the specific
// failure to ensure it's robust against things like fault attacks.
func TestRecoverCompactErrors(t *testing.T) {
	t.Parallel()

	tests := []struct {
		name string // test description
		sig  string // hex encoded signature to recover pubkey from
		hash string // hex encoded hash of message
		err  error  // expected error
	}{
		{
			name: "empty signature",
			sig:  "",
			hash: "c301ba9de5d6053caad9f5eb46523f007702add2c62fa39de03146a36b8026b7",
			err:  ErrSigInvalidLen,
		}, {
			// Signature created from secret key 0x02, blake256(0x01020304).
			name: "no compact sig recovery code (otherwise valid sig)",
			sig: "e6f137b52377250760cc702e19b7aee3c63b0e7d95a91939b14ab3b5c4771e59" +
				"44b9bc4620afa158b7efdfea5234ff2d5f2f78b42886f02cf581827ee55318ea",
			hash: "c301ba9de5d6053caad9f5eb46523f007702add2c62fa39de03146a36b8026b7",
			err:  ErrSigInvalidLen,
		}, {
			// Signature created from secret key 0x02, blake256(0x01020304).
			name: "signature one byte too long (S padded with leading zero)",
			sig: "1f" +
				"e6f137b52377250760cc702e19b7aee3c63b0e7d95a91939b14ab3b5c4771e59" +
				"0044b9bc4620afa158b7efdfea5234ff2d5f2f78b42886f02cf581827ee55318ea",
			hash: "c301ba9de5d6053caad9f5eb46523f007702add2c62fa39de03146a36b8026b7",
			err:  ErrSigInvalidLen,
		}, {
			// Signature created from secret key 0x02, blake256(0x01020304).
			name: "compact sig recovery code too low (otherwise valid sig)",
			sig: "1a" +
				"e6f137b52377250760cc702e19b7aee3c63b0e7d95a91939b14ab3b5c4771e59" +
				"44b9bc4620afa158b7efdfea5234ff2d5f2f78b42886f02cf581827ee55318ea",
			hash: "c301ba9de5d6053caad9f5eb46523f007702add2c62fa39de03146a36b8026b7",
			err:  ErrSigInvalidRecoveryCode,
		}, {
			// Signature created from secret key 0x02, blake256(0x01020304).
			name: "compact sig recovery code too high (otherwise valid sig)",
			sig: "23" +
				"e6f137b52377250760cc702e19b7aee3c63b0e7d95a91939b14ab3b5c4771e59" +
				"44b9bc4620afa158b7efdfea5234ff2d5f2f78b42886f02cf581827ee55318ea",
			hash: "c301ba9de5d6053caad9f5eb46523f007702add2c62fa39de03146a36b8026b7",
			err:  ErrSigInvalidRecoveryCode,
		}, {
			// Signature invented since finding a signature with an r value that is
			// exactly the group order prior to the modular reduction is not
			// calculable without breaking the underlying crypto.
			name: "R == group order",
			sig: "1f" +
				"fffffffffffffffffffffffffffffffebaaedce6af48a03bbfd25e8cd0364141" +
				"44b9bc4620afa158b7efdfea5234ff2d5f2f78b42886f02cf581827ee55318ea",
			hash: "c301ba9de5d6053caad9f5eb46523f007702add2c62fa39de03146a36b8026b7",
			err:  ErrSigRTooBig,
		}, {
			// Signature invented since finding a signature with an r value that
			// would be valid modulo the group order and is still 32 bytes is not
			// calculable without breaking the underlying crypto.
			name: "R > group order and still 32 bytes (order + 1)",
			sig: "1f" +
				"fffffffffffffffffffffffffffffffebaaedce6af48a03bbfd25e8cd0364142" +
				"44b9bc4620afa158b7efdfea5234ff2d5f2f78b42886f02cf581827ee55318ea",
			hash: "c301ba9de5d6053caad9f5eb46523f007702add2c62fa39de03146a36b8026b7",
			err:  ErrSigRTooBig,
		}, {
			// Signature invented since the only way a signature could have an r
			// value of zero is if the nonce were zero which is invalid.
			name: "R == 0",
			sig: "1f" +
				"0000000000000000000000000000000000000000000000000000000000000000" +
				"44b9bc4620afa158b7efdfea5234ff2d5f2f78b42886f02cf581827ee55318ea",
			hash: "c301ba9de5d6053caad9f5eb46523f007702add2c62fa39de03146a36b8026b7",
			err:  ErrSigRIsZero,
		}, {
			// Signature invented since finding a signature with an s value that is
			// exactly the group order prior to the modular reduction is not
			// calculable without breaking the underlying crypto.
			name: "S == group order",
			sig: "1f" +
				"e6f137b52377250760cc702e19b7aee3c63b0e7d95a91939b14ab3b5c4771e59" +
				"fffffffffffffffffffffffffffffffebaaedce6af48a03bbfd25e8cd0364141",
			hash: "c301ba9de5d6053caad9f5eb46523f007702add2c62fa39de03146a36b8026b7",
			err:  ErrSigSTooBig,
		}, {
			// Signature invented since finding a signature with an s value that
			// would be valid modulo the group order and is still 32 bytes is not
			// calculable without breaking the underlying crypto.
			name: "S > group order and still 32 bytes (order + 1)",
			sig: "1f" +
				"e6f137b52377250760cc702e19b7aee3c63b0e7d95a91939b14ab3b5c4771e59" +
				"fffffffffffffffffffffffffffffffebaaedce6af48a03bbfd25e8cd0364142",
			hash: "c301ba9de5d6053caad9f5eb46523f007702add2c62fa39de03146a36b8026b7",
			err:  ErrSigSTooBig,
		}, {
			// Signature created by forcing the key/hash/nonce choices such that s
			// is zero and is therefore invalid.  The signing code will not produce
			// such a signature in practice.
			name: "S == 0",
			sig: "1f" +
				"e6f137b52377250760cc702e19b7aee3c63b0e7d95a91939b14ab3b5c4771e59" +
				"0000000000000000000000000000000000000000000000000000000000000000",
			hash: "393bec84f1a04037751c0d6c2817f37953eaa204ac0898de7adb038c33a20438",
			err:  ErrSigSIsZero,
		}, {
			// Signature invented since finding a secret key needed to create a
			// valid signature with an r value that is >= group order prior to the
			// modular reduction is not possible without breaking the underlying
			// crypto.
			name: "R >= field prime minus group order with overflow bit",
			sig: "21" +
				"000000000000000000000000000000014551231950b75fc4402da1722fc9baee" +
				"44b9bc4620afa158b7efdfea5234ff2d5f2f78b42886f02cf581827ee55318ea",
			hash: "c301ba9de5d6053caad9f5eb46523f007702add2c62fa39de03146a36b8026b7",
			err:  ErrSigOverflowsPrime,
		}, {
			// Signature created from secret key 0x01, blake256(0x0102030407) over
			// the secp256r1 curve (note the r1 instead of k1).
			name: "pubkey not on the curve, signature valid for secp256r1 instead",
			sig: "1f" +
				"2a81d1b3facc22185267d3f8832c5104902591bc471253f1cfc5eb25f4f740f2" +
				"72e65d019f9b09d769149e2be0b55de9b0224d34095bddc6a5dba90bfda33c45",
			hash: "9165e957708bc95cf62d020769c150b2d7b08e7ab7981860815b1eaabd41d695",
			err:  ErrPointNotOnCurve,
		}, {
			// Signature created from secret key 0x01, blake256(0x01020304) and
			// manually setting s = -e*k^-1.
			name: "calculated pubkey point at infinity",
			sig: "1f" +
				"c6c4137b0e5fbfc88ae3f293d7e80c8566c43ae20340075d44f75b009c943d09" +
				"1281d8d90a5774045abd57b453c7eadbc830dbadec89ae8dd7639b9cc55641d0",
			hash: "c301ba9de5d6053caad9f5eb46523f007702add2c62fa39de03146a36b8026b7",
			err:  ErrPointNotOnCurve,
		},
	}
	for _, test := range tests {
		// Parse test data.
		hash := hexToBytes(test.hash)
		sig := hexToBytes(test.sig)
		// Ensure the expected error is hit.
		_, _, err := RecoverCompact(sig, hash)
		if !errors.Is(err, test.err) {
			t.Errorf(
				"%s: mismatched err -- got %v, want %v", test.name, err,
				test.err,
			)
			continue
		}
	}
}

// TestSignAndRecoverCompactRandom ensures compact (recoverable public key)
// ECDSA signing and recovery work as expected for randomly-generated secret
// keys and messages.  It also ensures mutated signatures and messages do not
// improperly recover the original public key.
func TestSignAndRecoverCompactRandom(t *testing.T) {
	t.Parallel()
	// Use a unique random seed each test instance and log it if the tests fail.
	seed := time.Now().Unix()
	rng := rand.New(rand.NewSource(seed))
	defer func(t *testing.T, seed int64) {
		if t.Failed() {
			t.Logf("random seed: %d", seed)
		}
	}(t, seed)
	for i := 0; i < 100; i++ {
		// Generate a random secret key.
		var buf [32]byte
		if _, err := rng.Read(buf[:]); chk.T(err) {
			t.Fatalf("failed to read random secret key: %v", err)
		}
		var secKeyScalar secp256k1.ModNScalar
		secKeyScalar.SetBytes(&buf)
		secKey := secp256k1.NewSecretKey(&secKeyScalar)
		wantPubKey := secKey.PubKey()
		// Generate a random hash to sign.
		var hash [32]byte
		if _, err := rng.Read(hash[:]); chk.T(err) {
			t.Fatalf("failed to read random hash: %v", err)
		}
		// Test compact signatures for both the compressed and uncompressed
		// versions of the public key.
		for _, compressed := range []bool{true, false} {
			// Sign the hash with the secret key and then ensure the original
			// public key and compressed flag is recovered from the produced
			// signature.
			gotSig := SignCompact(secKey, hash[:], compressed)

			gotPubKey, gotCompressed, err := RecoverCompact(gotSig, hash[:])
			if err != nil {
				t.Fatalf(
					"unexpected err: %v\nsig: %x\nhash: %x\nsecret key: %x",
					err, gotSig, hash, secKey.Serialize(),
				)
			}
			if gotCompressed != compressed {
				t.Fatalf(
					"unexpected compressed flag: %v\nsig: %x\nhash: %x\n"+
						"secret key: %x", gotCompressed, gotSig, hash,
					secKey.Serialize(),
				)
			}
			if !gotPubKey.IsEqual(wantPubKey) {
				t.Fatalf(
					"unexpected recovered public key: %x\nsig: %x\nhash: "+
						"%x\nsecret key: %x", gotPubKey.SerializeUncompressed(),
					gotSig, hash, secKey.Serialize(),
				)
			}
			// Change a random bit in the signature and ensure the bad signature
			// fails to recover the original public key.
			badSig := make([]byte, len(gotSig))
			copy(badSig, gotSig)
			randByte := rng.Intn(len(badSig)-1) + 1
			randBit := rng.Intn(7)
			badSig[randByte] ^= 1 << randBit
			badPubKey, _, err := RecoverCompact(badSig, hash[:])
			if err == nil && badPubKey.IsEqual(wantPubKey) {
				t.Fatalf(
					"recovered public key for bad sig: %x\nhash: %x\n"+
						"secret key: %x", badSig, hash, secKey.Serialize(),
				)
			}
			// Change a random bit in the hash that was originally signed and
			// ensure the original good signature fails to recover the original
			// public key.
			badHash := make([]byte, len(hash))
			copy(badHash, hash[:])
			randByte = rng.Intn(len(badHash))
			randBit = rng.Intn(7)
			badHash[randByte] ^= 1 << randBit
			badPubKey, _, err = RecoverCompact(gotSig, badHash[:])
			if err == nil && badPubKey.IsEqual(wantPubKey) {
				t.Fatalf(
					"recovered public key for bad hash: %x\nsig: %x\n"+
						"secret key: %x", badHash, gotSig, secKey.Serialize(),
				)
			}
		}
	}
}