eddsa: add vectors for x = 0 with the sign bit set

RFC 8032 point decoding rejects an encoding whose x is zero when the
sign bit of x is set (Section 5.1.3 and Section 5.2.3, step 4). Neither
file exercised this check. Add one vector per curve where R encodes
y = 1 with the sign bit of x set.

Author: cpu

testvectors_v1/ed25519_test.json

@@ -1,7 +1,7 @@
 {
   "algorithm": "EDDSA",
   "schema": "eddsa_verify_schema_v1.json",
-  "numberOfTests": 150,
+  "numberOfTests": 151,
   "header": [
     "Test vectors of type EddsaVerify are intended for testing"
   ],
@@ -3322,6 +3322,39 @@
           "result": "valid"
         }
       ]
+    },
+    {
+      "type": "EddsaVerify",
+      "source": {
+        "name": "github/cpu/eddsazerosigngen",
+        "version": "1.0"
+      },
+      "publicKey": {
+        "type": "EDDSAPublicKey",
+        "curve": "edwards25519",
+        "keySize": 255,
+        "pk": "d75a980182b10ab7d54bfed3c964073a0ee172f3daa62325af021a68f707511a"
+      },
+      "publicKeyDer": "302a300506032b6570032100d75a980182b10ab7d54bfed3c964073a0ee172f3daa62325af021a68f707511a",
+      "publicKeyPem": "-----BEGIN PUBLIC KEY-----\nMCowBQYDK2VwAyEA11qYAYKxCrfVS/7TyWQHOg7hcvPapiMlrwIaaPcHURo=\n-----END PUBLIC KEY-----\n",
+      "publicKeyJwk": {
+        "kty": "OKP",
+        "crv": "Ed25519",
+        "kid": "none",
+        "x": "11qYAYKxCrfVS_7TyWQHOg7hcvPapiMlrwIaaPcHURo"
+      },
+      "tests": [
+        {
+          "tcId": 151,
+          "comment": "R encodes y = 1 with the sign bit of x set. The only point with y = 1 has x = 0, so decoding must fail (RFC 8032, Section 5.1.3). Accepted only by verifiers that ignore the sign of x.",
+          "flags": [
+            "InvalidEncoding"
+          ],
+          "msg": "313233343030",
+          "sig": "0100000000000000000000000000000000000000000000000000000000000080c803ee1f2342aa96ff698a393d1ab5e66f3eda101d6d120b394c3fd32c117d0a",
+          "result": "invalid"
+        }
+      ]
     }
   ]
 }

testvectors_v1/ed448_test.json

@@ -1,7 +1,7 @@
 {
   "algorithm": "EDDSA",
   "schema": "eddsa_verify_schema_v1.json",
-  "numberOfTests": 86,
+  "numberOfTests": 87,
   "header": [
     "Test vectors of type EddsaVerify are intended for testing"
   ],
@@ -1229,6 +1229,39 @@
           "result": "valid"
         }
       ]
+    },
+    {
+      "type": "EddsaVerify",
+      "source": {
+        "name": "github/cpu/eddsazerosigngen",
+        "version": "1.0"
+      },
+      "publicKey": {
+        "type": "EDDSAPublicKey",
+        "curve": "edwards448",
+        "keySize": 448,
+        "pk": "5fd7449b59b461fd2ce787ec616ad46a1da1342485a70e1f8a0ea75d80e96778edf124769b46c7061bd6783df1e50f6cd1fa1abeafe8256180"
+      },
+      "publicKeyDer": "3043300506032b6571033a005fd7449b59b461fd2ce787ec616ad46a1da1342485a70e1f8a0ea75d80e96778edf124769b46c7061bd6783df1e50f6cd1fa1abeafe8256180",
+      "publicKeyPem": "-----BEGIN PUBLIC KEY-----\nMEMwBQYDK2VxAzoAX9dEm1m0Yf0s54fsYWrUah2hNCSFpw4fig6nXYDpZ3jt8SR2\nm0bHBhvWeD3x5Q9s0foavq/oJWGA\n-----END PUBLIC KEY-----\n",
+      "publicKeyJwk": {
+        "kty": "OKP",
+        "crv": "Ed448",
+        "kid": "none",
+        "x": "X9dEm1m0Yf0s54fsYWrUah2hNCSFpw4fig6nXYDpZ3jt8SR2m0bHBhvWeD3x5Q9s0foavq_oJWGA"
+      },
+      "tests": [
+        {
+          "tcId": 87,
+          "comment": "R encodes y = 1 with the sign bit of x set. The only point with y = 1 has x = 0, so decoding must fail (RFC 8032, Section 5.2.3). Accepted only by verifiers that ignore the sign of x.",
+          "flags": [
+            "InvalidEncoding"
+          ],
+          "msg": "313233343030",
+          "sig": "01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000008091f5b9d3cd6099f02315ceb7c46200fd14cc3a15d40ab348932f9b7765a96c2f0833cc81f90c8c48a13d7df4298301067e5f5f850467f81600",
+          "result": "invalid"
+        }
+      ]
     }
   ]
 }