{
  "section": "Section2",
  "vectors": {
    "V3-01": {
      "claim": "keygen seed is 128 B",
      "given": {
        "lengths": [
          128,
          96,
          127
        ],
        "seeds": {
          "128": "11111111111111111111111111111111111111111111111111111111111111113333333333333333333333333333333333333333333333333333333333333333e582b7d75e6c80b05ae392a1fc9f7153b12390fd99930368cc67a768baebc8a01cdacb8740c0b87c4a379575f187b367cbfa3b300bf591b109f79816e9cbe8f0",
          "96": "11111111111111111111111111111111111111111111111111111111111111113333333333333333333333333333333333333333333333333333333333333333e582b7d75e6c80b05ae392a1fc9f7153b12390fd99930368cc67a768baebc8a0",
          "127": "11111111111111111111111111111111111111111111111111111111111111113333333333333333333333333333333333333333333333333333333333333333e582b7d75e6c80b05ae392a1fc9f7153b12390fd99930368cc67a768baebc8a01cdacb8740c0b87c4a379575f187b367cbfa3b300bf591b109f79816e9cbe8"
        },
        "seeds_are": "V3-09's keygen seed, then its first 96 and its first 127 bytes"
      },
      "expect": {
        "outcome": "outputs, then errors for 96 and 127"
      },
      "wrong": {
        "note": "padding or truncating to 128 rather than rejecting; or accepting 96 bytes, which is a well-formed seed for a scheme with no EC half and is the likeliest port"
      }
    },
    "V3-02": {
      "claim": "keygen MUST reject a seed whose spending_seed equals viewing_ec_seed, d or z",
      "given": {
        "spending_seed": "1111111111111111111111111111111111111111111111111111111111111111",
        "delegated_objects_by_component": {
          "viewing_ec_seed": "111111111111111111111111111111111111111111111111111111111111111144444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444",
          "d": "444444444444444444444444444444444444444444444444444444444444444411111111111111111111111111111111111111111111111111111111111111114444444444444444444444444444444444444444444444444444444444444444",
          "z": "444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444441111111111111111111111111111111111111111111111111111111111111111"
        }
      },
      "expect": {
        "outcome": "error, all three"
      },
      "wrong": {
        "note": "comparing against viewing_ec_seed alone. That catches a port of ERC-5564's single-key meta-address and misses the same 32 bytes copied into the KEM seed, which a scanning service receives verbatim"
      }
    },
    "V3-02a": {
      "claim": "a keygen with no equal component is accepted",
      "given": {
        "spending_seed": "1111111111111111111111111111111111111111111111111111111111111111",
        "delegated": "444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444444"
      },
      "expect": {
        "outcome": "outputs, no error"
      },
      "wrong": {
        "note": "rejecting valid keygens -- the positive control, without which V3-02 passes on an implementation that rejects everything"
      }
    },
    "V3-03": {
      "claim": "meta is 1250 B and both points are validated",
      "given": {
        "spending_pk": "034f355bdcb7cc0af728ef3cceb9615d90684bb5b2ca5f859ab0f0b704075871aa",
        "viewing_pk_ec_compact_0x05": "053c72addb4fdf09af94f0c94d7fe92a386a7e70cf8a1d85916386bb2535c7b1b1",
        "meta_address": "034f355bdcb7cc0af728ef3cceb9615d90684bb5b2ca5f859ab0f0b704075871aa053c72addb4fdf09af94f0c94d7fe92a386a7e70cf8a1d85916386bb2535c7b1b128c793778741b80b02b4339f2aa4347255b099f17264e1b8cc0a2c7c2a1a79f7997b907fd0496c6e6c8ad7714f5f339d75f11f625591a869be1175ae47f05fd4313468232ba6957d7807b824f445ac99a0d568ab1ad54dca8249d1482e61275f52248c77f61a4248753188cd1794cd0a465ec0dc4b025985c461b74e76286e4c37e77405695cc9fd0654374b427a20343aec0ff1a187768273bfc4905472a1da387f14559d6ce87313f6a5b6138434539f9a13684055b177e543f8b40f432abd7cc49989a50a9084c660913f45a8593b17499bc4cf936c2bc1851421cb986808a0ef30afe97aab5b8b8eb3f0b3506a95b91563a0e57db7231044987ef141bdab3537c316ad16f17805a81f29329879a94e96157e4b7447f7d59603b21bd896cc47b7cd4e232322eb9c5d2215696bcffca3a04efcc4c5d9cc39ac9a6e8700d38c244b0169e7fa1fe81b4b10365e74e6a1f7f756d11acdc84043f81006d62995376c22535958feb53f78117ee0f61c4c862640d06dc57a2b8be62a41a642af3bc63f6bac98bbbbff70570f37b8f8d9572f2735657a6c98f96caf57a849868720b2640b8bb2732237a1f984c18872d10289ce43c952c9257e06529aeb76afd127b17596fd25c5216c9cabd9b18efc50e87bbb04568bb7d5c4e9288c006483af5912e19108573700bd10cd77224b80659ea75aa74270b33ac4008b738bfee271e78658c8742ff13c96ad0781a03c7576ca26dd58b52980ba58c0505e446afa140cdcea0490db1f9b18815d4314b2459cacc562441c91f4084e5426c88e632cf7482e79907911d06473260835d7b85e7856a829aea0381707b939ce86882cc09c4448c6ae94a9c303107c5667eefb8df7763cc21189a3c590c40aa51f491503a7935ec08f4fc300cbe607ed8c9100c29fbf45584b13c8d780069337aec76c36ceb70373e2ab6e7b934b466f53fb32eaf040055496b8540e23a2a277e534468608d5ec0f8d38cea5bbb806c1bf4f164f6ac826fe733f95461e29dcc11200c0aada1b8332023eab329718ce25cc0a09555903f3578bbc863b1752ca94365da556df54c3b7e05cbb7115fbc1b6c57a172c31b9906560c8fb54f3c563a2256cc073243b8179b4a28d60e086cf51082ee429272996f0aabe03ba0eafd3c8e7d954bd0933e2f60ed0c32cede7b820a28e48f3ca3c40913cccae2337abfc59843f08c9863325d65a4e9e15c1f46172b118b2b5eb0f1d5158a00134f27b085488c3a0621fe4e5678698250fb74ee5152e3e35a66544a05d279ea99131fbc15165060b90f88eeb7b20892a4de4cb1683495bd7da037966b47cc040f1764c5deb06b5499d4267391cebbb47f734d8539e39528436a1858182854bf20b1f93279afb706464c65ccc5ae099b37cc03556c26abf4c3f8b9ba3a936707211a49a59b268f5284f7970c77612719450377417428c4ba47c9ca115cf95304c4759c5d8859b44985c06a6c924689237ba320d610960d61c53e85431789e67a40113f167ff93429c264f6cabc95448c903437d39a6577be0cf0012852aa476351a9046a110a1a625a3d74c910b78bce9cfca735e4f91b8a4c57dbe489e849446098aacf73070aee638fcc8896473d3c159d3afb4b687b40dfbf371a9c2644b605187b71a14bc4c8678fe8247",
        "meta_address_is": "V3-09's meta-address with viewing_pk_ec's tag set to 0x05"
      },
      "expect": {
        "outcome": "error at decode"
      },
      "wrong": {
        "note": "validating only spending_pk, which is the natural port of a decoder for a meta-address that carries one point"
      }
    },
    "V3-04": {
      "claim": "ss_ec is the x-coordinate alone",
      "given": {
        "esk": "2222222222222222222222222222222222222222222222222222222222222222",
        "viewing_pk_ec": "023c72addb4fdf09af94f0c94d7fe92a386a7e70cf8a1d85916386bb2535c7b1b1"
      },
      "expect": {
        "ss_ec": "9110f8760a37d96052e3dcaf14862a147654f49f722cf213568ccef1eca2ec71",
        "length": 32
      },
      "wrong": {
        "uncompressed_65": "049110f8760a37d96052e3dcaf14862a147654f49f722cf213568ccef1eca2ec7134ebc7978f91470a8abcdd13332db0de3261055c06ac8ff92b75b272463c6adc",
        "compressed_33": "029110f8760a37d96052e3dcaf14862a147654f49f722cf213568ccef1eca2ec71",
        "note": "a different ss, silently"
      }
    },
    "V3-05": {
      "claim": "the domain separator is the FIRST input, neither appended nor length-prefixed",
      "provisional": true,
      "provisional_because": "NO OUTSIDE implementation has adopted it. This document's own implementation produces these bytes and an independent blinded re-derivation from the prose alone agreed on them, and neither is an outside party -- the constant is still a proposal",
      "given": {
        "domain_separator": "pq-stealth/hybrid-payment/v1",
        "ikm": "9110f8760a37d96052e3dcaf14862a147654f49f722cf213568ccef1eca2ec7179d74f6c6c2d916bec47bd828fd9b67295a37f54927fab1263c0d122f1c6f1ed02466d7fcae563e5cb09a0d1870bb580344804617879a14949cf22285f1bae3f270385e8044d17e2b96b3f50ed28c2502216322ac33f69d2ce34f0a11e9b3de339aebe98283a6010a34bdc98b0e5bbe142a38575da305066331d8d11d161f512b4b56b60fd049dfee3771473253a0310cd842c71cb7734474bfbdbbadd2b9b87c37804d8558b00d77b1f79f0fd2c94552a8d3b19fdd6a5511c4ebeea40aa839a489aec636b510bf51bf3782f24f53f752ee2db9fb4964e8379d0fa70603cb8c2c7293bc35a56b818257b65fbe6b2c98178b61d7ceb58c7e1a9100650a945c739e3603c188ba3c179823950c6d874d7fc8f8ddb7a9ee941f4a78a0f8a1eae080d4d77893aaefb0db452659b0275d171736390a1b23661c69058869a8c4d0bb46d1655858162012a057c7c067fd035d47d5d627e3cd27cd3ca021a34f8db6695c7e581ece67d898482d509e4df61dce5bbdfaac89465a9209c547b4263e9155940f8fcb1da3a4a7d25df2969f31644741a8c6fe8065d5f176214a4db8fe76bf41869b0f22e1f5cf5c34a5067b1d9f39f3ab4b0b9f6330d7cf6ec7477b53d9223fa70e4c680d49b32883d92b50c53cf9e61915437cf57eca49d6bbc88c64ccb222d4f20227cccd4f7e7c21f95ce74d6ab5dece17f600ad1715248648e4d1af6fe41a02023eb5cff871ec654756b7d156e601e82827e17dd0fe4f5357136120a810506a40f28a0b860c3ce75bf7796653327939b507043ab8be0175a9b312319818063ac40302eb42452da0b1cb9e3c2e43c49d740a03ac1b9057fb44eff830d548d12585f50dbaf7404c2dfa7f4403db8b7cee65df528f575c7f552d0632553fc6c90a3b09c1114492392c165e9b1b0a10e9556c72cde2bb23df6da784521249eec542012ec33599b97b95ff5234158a6d553b3bbae9704e630d64a66d658f74f27c8c30237e87686fb04551bb128d917305173e2788883352a0216fd8d0035d748c9b42a600073adba73f851bb5eca287ad325a3a3561769868c56e6d84fb661ed5a41649342ea342f82be528fd9bb4f492452c0a9426ed8677113ec6f1cac51233f0520425c3b27acfaa0d25a07bc2ca01115c90432ed14a1f4dda693c6e704a16bece8972d8218b62cec4f255058988b224d86f2bde4b221a3c672cb744ca8f9158a4e5c97d0c56af5dfc1c5f0191f64cb6d7ab86b14432eceb5a3ed77a8d3ea651a07c9a0cf95e631f41c2ab29191f66dd9a73271f47a455999c5fc8391550bbb346ca1bcad598a32a50cb52281156874f36de9d8ea5860d99703ea3f4907c640b47a75a285b4347845cd6c94407995f569fd8a4b12461d8236e4015ae000e2acaf2bd9f8d28377ec0d9e4cae714c481c5abae37448b3f84a291b84b4213c8fe1f6e0fdfa1a6d1a52c974f795c5947f667a8dbe162983ec0c71c0f0237e6ed8bcb7ac9e4c73b5a1ed85fd5e0fa2810c842d484d6f9dfcc8472f05683d9d1144ef6c36294bd06a019efec202fc46288eba2ade82aa3363faf32b9b027c75a7d615845cf2ec538141f1746009737600f697cc8d90c80c1e19f1ab2c08646c0e3958023c72addb4fdf09af94f0c94d7fe92a386a7e70cf8a1d85916386bb2535c7b1b19c6839354086919bc7b8a547ff18b523075fd1706856400952489e4cd13ed8b17a817a3076e0947b860ec9558bd9d3c94df5418a7a7301763999c09996715ce32aacfef767a44969925949cc9b8120cb78953bcf6fb8282427cb3f4cbbc50ab23274493a8ba7e5c09088160fda731b55980867912bac53125b27073bb502afac5e74973e0f3601dc50ce08cc7f3fa44ce331a43f9673be745295e693077264a8e238f0a912c0a59c44d561e2a8bd831541fe869b3110b051100db3517f87510ecad8651ce4998bb648002ba41a5351fa2a4ed94a58cb707214a59f8876176cf82fceb99364971c7c0896e8b62c0544463ff101983c2045981ccd9173eb33ba18483ed915bd11ea950db3a8787c105263242e3a64c748b8b1a5947880c5bf3896e08b4b9916a39fd70c2ff8bd041a2b18e251d16a276e38100a613ea96a86cb3652dcc83f2d31cd9f8b79e42541a66752d191436cf5b5d8350ee7835cdb122855392c1da5c33fda12ad1028f2806861a2ab9c63785fd11e220346322c250936ab819254734a8dc9241971ac90cda6696adb90d1e327dc977841aba38324c8fb2092784942003a0808e5546d034592f03bacc19e3138c9070ccea80a933d536c49e4771091af8a70207d474574c64b9f1c8e47224174061117e98c18897a7b1b3c4478c6558c321a89a84b6c508947cb61c89204fbca43bcaa1d688f768b02e50babebf0c5fb8962b2355973c4193fa92e0ce4b9f8473e154828c986bf63e1cd985c6f0462c9b4374594d226c5e99b8a844978db8dd2839e27138aacf75e917635cec4b407a54f184c22f62981b9f4552fb334ff2b7ff68b470fd61b993c32581cc0f39881a5a6a769a60297f4b0579acbf52a8abb143885886245ca2636e20498959e4f2857ab96706e6409c4164ba88c7193e568e4446120215a6d8499c6b4bc559628a9f481c7db51e2e10df1f4339a647b4ccc0405b79f70a90ca9a8ad07789222ba6e66c3aff42b61baa637af15126c88b2e210a7cad9cb08cbb5123a7f9bb4ad63daaea6b43f9aaba561212823cb898a676c967b2d64f4b6333439f8993bd7b19687248926e077a9700431a59157b9668ee022b6d31343f15c08f14488877dfb30a552c06f96a16f354b9a3f19090b32a043b43256ba5b1088b56a4125588c8746d4099ea21c4f33ad8c5c7c32286dee2ca76fc2651d57aee9d847824ac609b5bfd5c87316c2afe0e153d6326af89987ecb70cf0a0a77fa000e0e0acc2685e2317429c3a7513f42873cb98f669703ae9146919226db58d6c2b93b6f50c7cdab677b505945a0f2523886c1b82a6a7cc7eba9251096d88360d7ef6473acbcd359a0d20414b95c209b2413b1483a3a061386377b28e3896bcd8c5e2692681cc803e1694efb6ce353082ffca4079ea9bb7b2025bcb68990466ed2803ab11516d80325dc4cde3da9e020653e084c45f837c88711df3aa6075741c1283121c8b1c691013969a62b2563e556206cf0810848691c7c408d018617a7300ad943e189a9b44512ef13b669831392f1329e2ac7c623aa044223079139b7f1c213e93682ed86165468377d40884310163a5539f27745e667adf506896ba933b002e4d50b2497ecff09d0bbca4f7e6f9db9e10c643d23701bd6385e163cf71c1e919a6e20a"
      },
      "expect": {
        "ss": "7ae80633e684e840812f564d69fee6e33e61b213a7d48c83f52920b40745ccf6"
      },
      "wrong": {
        "appended": "0c84728fce490554a1857cb7dc7d08b38f91240bd1e0a3dd44749f833f94796c",
        "length_prefixed": "424379879ee5d3522ef05819257ae0acd2912826751405cba7bb250aee0dc7aa",
        "note": "a different ss, silently. This is the parameter that replaced the absent-salt requirement when the derivation became a direct hash"
      }
    },
    "V3-06": {
      "claim": "IKM is exactly ss_ec || ss_pq || epk || ct || viewing_pk_ec || ek",
      "provisional": true,
      "provisional_because": "NO OUTSIDE implementation has adopted it. This document's own implementation produces these bytes and an independent blinded re-derivation from the prose alone agreed on them, and neither is an outside party -- the constant is still a proposal",
      "given": {
        "parts": {
          "ss_ec": "9110f8760a37d96052e3dcaf14862a147654f49f722cf213568ccef1eca2ec71",
          "ss_pq": "79d74f6c6c2d916bec47bd828fd9b67295a37f54927fab1263c0d122f1c6f1ed",
          "epk": "02466d7fcae563e5cb09a0d1870bb580344804617879a14949cf22285f1bae3f27",
          "ct": "0385e8044d17e2b96b3f50ed28c2502216322ac33f69d2ce34f0a11e9b3de339aebe98283a6010a34bdc98b0e5bbe142a38575da305066331d8d11d161f512b4b56b60fd049dfee3771473253a0310cd842c71cb7734474bfbdbbadd2b9b87c37804d8558b00d77b1f79f0fd2c94552a8d3b19fdd6a5511c4ebeea40aa839a489aec636b510bf51bf3782f24f53f752ee2db9fb4964e8379d0fa70603cb8c2c7293bc35a56b818257b65fbe6b2c98178b61d7ceb58c7e1a9100650a945c739e3603c188ba3c179823950c6d874d7fc8f8ddb7a9ee941f4a78a0f8a1eae080d4d77893aaefb0db452659b0275d171736390a1b23661c69058869a8c4d0bb46d1655858162012a057c7c067fd035d47d5d627e3cd27cd3ca021a34f8db6695c7e581ece67d898482d509e4df61dce5bbdfaac89465a9209c547b4263e9155940f8fcb1da3a4a7d25df2969f31644741a8c6fe8065d5f176214a4db8fe76bf41869b0f22e1f5cf5c34a5067b1d9f39f3ab4b0b9f6330d7cf6ec7477b53d9223fa70e4c680d49b32883d92b50c53cf9e61915437cf57eca49d6bbc88c64ccb222d4f20227cccd4f7e7c21f95ce74d6ab5dece17f600ad1715248648e4d1af6fe41a02023eb5cff871ec654756b7d156e601e82827e17dd0fe4f5357136120a810506a40f28a0b860c3ce75bf7796653327939b507043ab8be0175a9b312319818063ac40302eb42452da0b1cb9e3c2e43c49d740a03ac1b9057fb44eff830d548d12585f50dbaf7404c2dfa7f4403db8b7cee65df528f575c7f552d0632553fc6c90a3b09c1114492392c165e9b1b0a10e9556c72cde2bb23df6da784521249eec542012ec33599b97b95ff5234158a6d553b3bbae9704e630d64a66d658f74f27c8c30237e87686fb04551bb128d917305173e2788883352a0216fd8d0035d748c9b42a600073adba73f851bb5eca287ad325a3a3561769868c56e6d84fb661ed5a41649342ea342f82be528fd9bb4f492452c0a9426ed8677113ec6f1cac51233f0520425c3b27acfaa0d25a07bc2ca01115c90432ed14a1f4dda693c6e704a16bece8972d8218b62cec4f255058988b224d86f2bde4b221a3c672cb744ca8f9158a4e5c97d0c56af5dfc1c5f0191f64cb6d7ab86b14432eceb5a3ed77a8d3ea651a07c9a0cf95e631f41c2ab29191f66dd9a73271f47a455999c5fc8391550bbb346ca1bcad598a32a50cb52281156874f36de9d8ea5860d99703ea3f4907c640b47a75a285b4347845cd6c94407995f569fd8a4b12461d8236e4015ae000e2acaf2bd9f8d28377ec0d9e4cae714c481c5abae37448b3f84a291b84b4213c8fe1f6e0fdfa1a6d1a52c974f795c5947f667a8dbe162983ec0c71c0f0237e6ed8bcb7ac9e4c73b5a1ed85fd5e0fa2810c842d484d6f9dfcc8472f05683d9d1144ef6c36294bd06a019efec202fc46288eba2ade82aa3363faf32b9b027c75a7d615845cf2ec538141f1746009737600f697cc8d90c80c1e19f1ab2c08646c0e3958",
          "viewing_pk_ec": "023c72addb4fdf09af94f0c94d7fe92a386a7e70cf8a1d85916386bb2535c7b1b1",
          "ek": "9c6839354086919bc7b8a547ff18b523075fd1706856400952489e4cd13ed8b17a817a3076e0947b860ec9558bd9d3c94df5418a7a7301763999c09996715ce32aacfef767a44969925949cc9b8120cb78953bcf6fb8282427cb3f4cbbc50ab23274493a8ba7e5c09088160fda731b55980867912bac53125b27073bb502afac5e74973e0f3601dc50ce08cc7f3fa44ce331a43f9673be745295e693077264a8e238f0a912c0a59c44d561e2a8bd831541fe869b3110b051100db3517f87510ecad8651ce4998bb648002ba41a5351fa2a4ed94a58cb707214a59f8876176cf82fceb99364971c7c0896e8b62c0544463ff101983c2045981ccd9173eb33ba18483ed915bd11ea950db3a8787c105263242e3a64c748b8b1a5947880c5bf3896e08b4b9916a39fd70c2ff8bd041a2b18e251d16a276e38100a613ea96a86cb3652dcc83f2d31cd9f8b79e42541a66752d191436cf5b5d8350ee7835cdb122855392c1da5c33fda12ad1028f2806861a2ab9c63785fd11e220346322c250936ab819254734a8dc9241971ac90cda6696adb90d1e327dc977841aba38324c8fb2092784942003a0808e5546d034592f03bacc19e3138c9070ccea80a933d536c49e4771091af8a70207d474574c64b9f1c8e47224174061117e98c18897a7b1b3c4478c6558c321a89a84b6c508947cb61c89204fbca43bcaa1d688f768b02e50babebf0c5fb8962b2355973c4193fa92e0ce4b9f8473e154828c986bf63e1cd985c6f0462c9b4374594d226c5e99b8a844978db8dd2839e27138aacf75e917635cec4b407a54f184c22f62981b9f4552fb334ff2b7ff68b470fd61b993c32581cc0f39881a5a6a769a60297f4b0579acbf52a8abb143885886245ca2636e20498959e4f2857ab96706e6409c4164ba88c7193e568e4446120215a6d8499c6b4bc559628a9f481c7db51e2e10df1f4339a647b4ccc0405b79f70a90ca9a8ad07789222ba6e66c3aff42b61baa637af15126c88b2e210a7cad9cb08cbb5123a7f9bb4ad63daaea6b43f9aaba561212823cb898a676c967b2d64f4b6333439f8993bd7b19687248926e077a9700431a59157b9668ee022b6d31343f15c08f14488877dfb30a552c06f96a16f354b9a3f19090b32a043b43256ba5b1088b56a4125588c8746d4099ea21c4f33ad8c5c7c32286dee2ca76fc2651d57aee9d847824ac609b5bfd5c87316c2afe0e153d6326af89987ecb70cf0a0a77fa000e0e0acc2685e2317429c3a7513f42873cb98f669703ae9146919226db58d6c2b93b6f50c7cdab677b505945a0f2523886c1b82a6a7cc7eba9251096d88360d7ef6473acbcd359a0d20414b95c209b2413b1483a3a061386377b28e3896bcd8c5e2692681cc803e1694efb6ce353082ffca4079ea9bb7b2025bcb68990466ed2803ab11516d80325dc4cde3da9e020653e084c45f837c88711df3aa6075741c1283121c8b1c691013969a62b2563e556206cf0810848691c7c408d018617a7300ad943e189a9b44512ef13b669831392f1329e2ac7c623aa044223079139b7f1c213e93682ed86165468377d40884310163a5539f27745e667adf506896ba933b002e4d50b2497ecff09d0bbca4f7e6f9db9e10c643d23701bd6385e163cf71c1e919a6e20a"
        },
        "esk": "2222222222222222222222222222222222222222222222222222222222222222",
        "acvp_encapsulation_tcId": 26,
        "m": "4e77596168711e913965d8175ac3bd76aab08b7f9385a02ae883cf6c6e17dd81",
        "parts_are": "epk = esk*G and ss_ec = ECDH(esk, viewing_pk_ec).x as in V3-04, viewing_pk_ec being V3-09's; ek, ct and ss_pq are ACVP encapsulation tcId 26, (ct, ss_pq) = ML-KEM.Encaps_internal(ek, m)"
      },
      "expect": {
        "ss": "7ae80633e684e840812f564d69fee6e33e61b213a7d48c83f52920b40745ccf6"
      },
      "wrong": {
        "three_field_form": "3cec5653f17e1a9c2ddc85c49d19ab857b4695a10a8d1404dd7a3addbada7833",
        "note": "any other order, and any omission -> a different ss. The historical three-field form ss_ec || ss_pq || epk is the likeliest omission"
      }
    },
    "V3-06a": {
      "claim": "ct is bound in",
      "given": {
        "ct_a": "0385e8044d17e2b96b3f50ed28c2502216322ac33f69d2ce34f0a11e9b3de339aebe98283a6010a34bdc98b0e5bbe142a38575da305066331d8d11d161f512b4b56b60fd049dfee3771473253a0310cd842c71cb7734474bfbdbbadd2b9b87c37804d8558b00d77b1f79f0fd2c94552a8d3b19fdd6a5511c4ebeea40aa839a489aec636b510bf51bf3782f24f53f752ee2db9fb4964e8379d0fa70603cb8c2c7293bc35a56b818257b65fbe6b2c98178b61d7ceb58c7e1a9100650a945c739e3603c188ba3c179823950c6d874d7fc8f8ddb7a9ee941f4a78a0f8a1eae080d4d77893aaefb0db452659b0275d171736390a1b23661c69058869a8c4d0bb46d1655858162012a057c7c067fd035d47d5d627e3cd27cd3ca021a34f8db6695c7e581ece67d898482d509e4df61dce5bbdfaac89465a9209c547b4263e9155940f8fcb1da3a4a7d25df2969f31644741a8c6fe8065d5f176214a4db8fe76bf41869b0f22e1f5cf5c34a5067b1d9f39f3ab4b0b9f6330d7cf6ec7477b53d9223fa70e4c680d49b32883d92b50c53cf9e61915437cf57eca49d6bbc88c64ccb222d4f20227cccd4f7e7c21f95ce74d6ab5dece17f600ad1715248648e4d1af6fe41a02023eb5cff871ec654756b7d156e601e82827e17dd0fe4f5357136120a810506a40f28a0b860c3ce75bf7796653327939b507043ab8be0175a9b312319818063ac40302eb42452da0b1cb9e3c2e43c49d740a03ac1b9057fb44eff830d548d12585f50dbaf7404c2dfa7f4403db8b7cee65df528f575c7f552d0632553fc6c90a3b09c1114492392c165e9b1b0a10e9556c72cde2bb23df6da784521249eec542012ec33599b97b95ff5234158a6d553b3bbae9704e630d64a66d658f74f27c8c30237e87686fb04551bb128d917305173e2788883352a0216fd8d0035d748c9b42a600073adba73f851bb5eca287ad325a3a3561769868c56e6d84fb661ed5a41649342ea342f82be528fd9bb4f492452c0a9426ed8677113ec6f1cac51233f0520425c3b27acfaa0d25a07bc2ca01115c90432ed14a1f4dda693c6e704a16bece8972d8218b62cec4f255058988b224d86f2bde4b221a3c672cb744ca8f9158a4e5c97d0c56af5dfc1c5f0191f64cb6d7ab86b14432eceb5a3ed77a8d3ea651a07c9a0cf95e631f41c2ab29191f66dd9a73271f47a455999c5fc8391550bbb346ca1bcad598a32a50cb52281156874f36de9d8ea5860d99703ea3f4907c640b47a75a285b4347845cd6c94407995f569fd8a4b12461d8236e4015ae000e2acaf2bd9f8d28377ec0d9e4cae714c481c5abae37448b3f84a291b84b4213c8fe1f6e0fdfa1a6d1a52c974f795c5947f667a8dbe162983ec0c71c0f0237e6ed8bcb7ac9e4c73b5a1ed85fd5e0fa2810c842d484d6f9dfcc8472f05683d9d1144ef6c36294bd06a019efec202fc46288eba2ade82aa3363faf32b9b027c75a7d615845cf2ec538141f1746009737600f697cc8d90c80c1e19f1ab2c08646c0e3958",
        "ct_b": "05c7b5c57ad8e10248514c6d4d6052991332b23c1d27720a79b56f5bee064866dc93b02bbf8f77e6929758b9cdf03bf3845a523bbc7db1f729b8cfdaad7abd3183ed2f112b9a984610b253f08a1fd47eae9d15791e9f980f243b6298a787acf192143a1691f70b222821285935001a054cb441cad6247b5bfd348e4920d7b1684ea8fb7d6bde3583ac80f7fe4a798c11e67c76e85dd8b9d379ee1b9196fdc34e52a1c1e7fc3b2c598841da3756d58dbc21983bf37201b238898074ed6b55bcf69f5f19897c5897e290107f9711cdaffbd64bb09475b2a089ac0cb7c49913ddb73ca202865d2d24b98bfac396c268141e2c77b27636b95d2335b18d527ee9ce896c7d7b881cefc90a5ae26ac824fd077cf05c55a2befea1b63f859effd4f507b87ce41b1782a18e3cb6fac02e842deb5b8fef662a83db8c9f2a075198afb4ab59d4b88393b5820cdb64a714f5383018cbe2c98a50a893dcf742a81b67a47af14d0d9d8d1f5d542e7da540a626b8c49665670edf8b56af6bcc74ceabee0ef919acad766a6520a62cc2252efe958482c9ae904f26fdb02cf2e3afaeda5e7449c54eb1c06007d474f410e6fb28e06c235a2ec15105732f9bd22d67be1230a08f277d72fc7f86ead57bb38da2e85b6d69b565137a6ab8f8287d6082395083527c0fa47bf2058b2f2e9a1dee73c840dd5a14e78a791cf3d9e4d1b6f41871a5a87fe14a41f87e56bf312b153f41ee0a69742da9d21d1e92499afd94f03e8da2c5a83cdd7b3169259fdd5e90dfac8ebe21c95fe0552128fec46cb5dbd020f597d55f42f8eb4fc015e37af6646f78aac295c3c328c527b8fbba05d6257d60bf388a712b90a70d19f8b95380a94562246d74e67cde5b9f3ac2158f392674726de0e1d603b16fc5a8284cac9210d7581ec0691a4e8d2eadc308ba22e30fea73676569527c26dc93fe658282c98c4328157d7615e50e431e2e47dec95223a8ad5450c9cb60aa507d77815acd66221d46cd89256ae820b3421644088afe587bb3c039cff7eef878a966b8197ca934d47d90ff301b0463a2326b5dcf6e436581e04df7f9b8ab9ef53f1d0202b3a8fd1bc60067c4e997f90733674c188d04fd908df965b90c1f8f6c303bf20012a9c342c6cc0ced10cab964335de335de8edc3ff0b7b8acf50c0c6d872221d8c41665285ba7a83615c3558183ae78859ca70e00c92591d0b016aed87b264d0563eb6b20f1f360958c8f37670dc933e64ace2b2f2c6bf08a7e483bca8fb37ab5504e21d7d79dec81177c3375110a5ae42de5c843c3d9efb543ebba60c62816b7db3ec0a376c05d39a0daee2764febadfc5cb6aacfbfbb48a0c33ba050439270583611b52a604cc7a57c4b482543d7e9450dd763492fdded617e42c93e7f2d6295f21c92d91dbbfe81a521055149afa6c16bf46499092e53ce9f8b293bd772c31a55a43de043c8a9bdb040bc397360b36223a041749ebfbbf096ed35310aed1d3d9535326a3427fd91e5e73c9d042c8d4b52bc5723191e503f63283",
        "ct_b_is": "the c of ACVP encapsulation tcId 27",
        "everything_else": "V3-06's parts"
      },
      "expect": {
        "ss_a": "7ae80633e684e840812f564d69fee6e33e61b213a7d48c83f52920b40745ccf6",
        "ss_b": "5f825c941238cfc70aba54724d05c71a198d32f17d0b0ca52903ed819ab7c95b",
        "assertion": "different"
      },
      "wrong": {
        "note": "the same ss. Hashing both ciphertexts in is what lets the combiner stay IND-CCA when only one component KEM is (Giacon-Heuer-Poettering, PKC 2018; the KeyCombineCCA_H of SP 800-227 Section 4.6.3)"
      }
    },
    "V3-06b": {
      "claim": "viewing_pk_ec is bound in",
      "given": {
        "viewing_pk_ec_a": "023c72addb4fdf09af94f0c94d7fe92a386a7e70cf8a1d85916386bb2535c7b1b1",
        "viewing_pk_ec_b": "029ac20335eb38768d2052be1dbbc3c8f6178407458e51e6b4ad22f1d91758895b",
        "viewing_ec_b": "5555555555555555555555555555555555555555555555555555555555555555",
        "everything_else": "V3-06's parts"
      },
      "expect": {
        "ss_a": "7ae80633e684e840812f564d69fee6e33e61b213a7d48c83f52920b40745ccf6",
        "ss_b": "a3182b19675bbc01249142e1b97a1c4958dd8846f31d61e04106f320b2d18bf1",
        "assertion": "different"
      },
      "wrong": {
        "note": "the same ss, which is the identity binding absent from the old IKM"
      }
    },
    "V3-07": {
      "claim": "epk MUST be bound in",
      "given": {
        "epk": "02466d7fcae563e5cb09a0d1870bb580344804617879a14949cf22285f1bae3f27",
        "epk_parity_flipped": "03466d7fcae563e5cb09a0d1870bb580344804617879a14949cf22285f1bae3f27",
        "everything_else": "V3-06's parts"
      },
      "expect": {
        "ss_a": "7ae80633e684e840812f564d69fee6e33e61b213a7d48c83f52920b40745ccf6",
        "ss_b": "572b8a0ea44c38f6c454114cd17df24c7d0dd1c30163bedaa22b37b805c41d8e",
        "assertion": "different"
      },
      "wrong": {
        "note": "the same ss -- the flipped point has the same x-coordinate, so without epk in the IKM this is a replay with a different-looking announcement"
      }
    },
    "V3-08": {
      "claim": "wire shape",
      "given": {
        "epk": "02466d7fcae563e5cb09a0d1870bb580344804617879a14949cf22285f1bae3f27",
        "view_tag": "02",
        "ct": "0385e8044d17e2b96b3f50ed28c2502216322ac33f69d2ce34f0a11e9b3de339aebe98283a6010a34bdc98b0e5bbe142a38575da305066331d8d11d161f512b4b56b60fd049dfee3771473253a0310cd842c71cb7734474bfbdbbadd2b9b87c37804d8558b00d77b1f79f0fd2c94552a8d3b19fdd6a5511c4ebeea40aa839a489aec636b510bf51bf3782f24f53f752ee2db9fb4964e8379d0fa70603cb8c2c7293bc35a56b818257b65fbe6b2c98178b61d7ceb58c7e1a9100650a945c739e3603c188ba3c179823950c6d874d7fc8f8ddb7a9ee941f4a78a0f8a1eae080d4d77893aaefb0db452659b0275d171736390a1b23661c69058869a8c4d0bb46d1655858162012a057c7c067fd035d47d5d627e3cd27cd3ca021a34f8db6695c7e581ece67d898482d509e4df61dce5bbdfaac89465a9209c547b4263e9155940f8fcb1da3a4a7d25df2969f31644741a8c6fe8065d5f176214a4db8fe76bf41869b0f22e1f5cf5c34a5067b1d9f39f3ab4b0b9f6330d7cf6ec7477b53d9223fa70e4c680d49b32883d92b50c53cf9e61915437cf57eca49d6bbc88c64ccb222d4f20227cccd4f7e7c21f95ce74d6ab5dece17f600ad1715248648e4d1af6fe41a02023eb5cff871ec654756b7d156e601e82827e17dd0fe4f5357136120a810506a40f28a0b860c3ce75bf7796653327939b507043ab8be0175a9b312319818063ac40302eb42452da0b1cb9e3c2e43c49d740a03ac1b9057fb44eff830d548d12585f50dbaf7404c2dfa7f4403db8b7cee65df528f575c7f552d0632553fc6c90a3b09c1114492392c165e9b1b0a10e9556c72cde2bb23df6da784521249eec542012ec33599b97b95ff5234158a6d553b3bbae9704e630d64a66d658f74f27c8c30237e87686fb04551bb128d917305173e2788883352a0216fd8d0035d748c9b42a600073adba73f851bb5eca287ad325a3a3561769868c56e6d84fb661ed5a41649342ea342f82be528fd9bb4f492452c0a9426ed8677113ec6f1cac51233f0520425c3b27acfaa0d25a07bc2ca01115c90432ed14a1f4dda693c6e704a16bece8972d8218b62cec4f255058988b224d86f2bde4b221a3c672cb744ca8f9158a4e5c97d0c56af5dfc1c5f0191f64cb6d7ab86b14432eceb5a3ed77a8d3ea651a07c9a0cf95e631f41c2ab29191f66dd9a73271f47a455999c5fc8391550bbb346ca1bcad598a32a50cb52281156874f36de9d8ea5860d99703ea3f4907c640b47a75a285b4347845cd6c94407995f569fd8a4b12461d8236e4015ae000e2acaf2bd9f8d28377ec0d9e4cae714c481c5abae37448b3f84a291b84b4213c8fe1f6e0fdfa1a6d1a52c974f795c5947f667a8dbe162983ec0c71c0f0237e6ed8bcb7ac9e4c73b5a1ed85fd5e0fa2810c842d484d6f9dfcc8472f05683d9d1144ef6c36294bd06a019efec202fc46288eba2ade82aa3363faf32b9b027c75a7d615845cf2ec538141f1746009737600f697cc8d90c80c1e19f1ab2c08646c0e3958"
      },
      "expect": {
        "ephemeralPubKey": "02466d7fcae563e5cb09a0d1870bb580344804617879a14949cf22285f1bae3f270385e8044d17e2b96b3f50ed28c2502216322ac33f69d2ce34f0a11e9b3de339aebe98283a6010a34bdc98b0e5bbe142a38575da305066331d8d11d161f512b4b56b60fd049dfee3771473253a0310cd842c71cb7734474bfbdbbadd2b9b87c37804d8558b00d77b1f79f0fd2c94552a8d3b19fdd6a5511c4ebeea40aa839a489aec636b510bf51bf3782f24f53f752ee2db9fb4964e8379d0fa70603cb8c2c7293bc35a56b818257b65fbe6b2c98178b61d7ceb58c7e1a9100650a945c739e3603c188ba3c179823950c6d874d7fc8f8ddb7a9ee941f4a78a0f8a1eae080d4d77893aaefb0db452659b0275d171736390a1b23661c69058869a8c4d0bb46d1655858162012a057c7c067fd035d47d5d627e3cd27cd3ca021a34f8db6695c7e581ece67d898482d509e4df61dce5bbdfaac89465a9209c547b4263e9155940f8fcb1da3a4a7d25df2969f31644741a8c6fe8065d5f176214a4db8fe76bf41869b0f22e1f5cf5c34a5067b1d9f39f3ab4b0b9f6330d7cf6ec7477b53d9223fa70e4c680d49b32883d92b50c53cf9e61915437cf57eca49d6bbc88c64ccb222d4f20227cccd4f7e7c21f95ce74d6ab5dece17f600ad1715248648e4d1af6fe41a02023eb5cff871ec654756b7d156e601e82827e17dd0fe4f5357136120a810506a40f28a0b860c3ce75bf7796653327939b507043ab8be0175a9b312319818063ac40302eb42452da0b1cb9e3c2e43c49d740a03ac1b9057fb44eff830d548d12585f50dbaf7404c2dfa7f4403db8b7cee65df528f575c7f552d0632553fc6c90a3b09c1114492392c165e9b1b0a10e9556c72cde2bb23df6da784521249eec542012ec33599b97b95ff5234158a6d553b3bbae9704e630d64a66d658f74f27c8c30237e87686fb04551bb128d917305173e2788883352a0216fd8d0035d748c9b42a600073adba73f851bb5eca287ad325a3a3561769868c56e6d84fb661ed5a41649342ea342f82be528fd9bb4f492452c0a9426ed8677113ec6f1cac51233f0520425c3b27acfaa0d25a07bc2ca01115c90432ed14a1f4dda693c6e704a16bece8972d8218b62cec4f255058988b224d86f2bde4b221a3c672cb744ca8f9158a4e5c97d0c56af5dfc1c5f0191f64cb6d7ab86b14432eceb5a3ed77a8d3ea651a07c9a0cf95e631f41c2ab29191f66dd9a73271f47a455999c5fc8391550bbb346ca1bcad598a32a50cb52281156874f36de9d8ea5860d99703ea3f4907c640b47a75a285b4347845cd6c94407995f569fd8a4b12461d8236e4015ae000e2acaf2bd9f8d28377ec0d9e4cae714c481c5abae37448b3f84a291b84b4213c8fe1f6e0fdfa1a6d1a52c974f795c5947f667a8dbe162983ec0c71c0f0237e6ed8bcb7ac9e4c73b5a1ed85fd5e0fa2810c842d484d6f9dfcc8472f05683d9d1144ef6c36294bd06a019efec202fc46288eba2ade82aa3363faf32b9b027c75a7d615845cf2ec538141f1746009737600f697cc8d90c80c1e19f1ab2c08646c0e3958",
        "metadata": "02",
        "ephemeralPubKey_bytes": 1121,
        "payload_bytes": 1122
      },
      "wrong": {
        "ct_then_epk": "0385e8044d17e2b96b3f50ed28c2502216322ac33f69d2ce34f0a11e9b3de339aebe98283a6010a34bdc98b0e5bbe142a38575da305066331d8d11d161f512b4b56b60fd049dfee3771473253a0310cd842c71cb7734474bfbdbbadd2b9b87c37804d8558b00d77b1f79f0fd2c94552a8d3b19fdd6a5511c4ebeea40aa839a489aec636b510bf51bf3782f24f53f752ee2db9fb4964e8379d0fa70603cb8c2c7293bc35a56b818257b65fbe6b2c98178b61d7ceb58c7e1a9100650a945c739e3603c188ba3c179823950c6d874d7fc8f8ddb7a9ee941f4a78a0f8a1eae080d4d77893aaefb0db452659b0275d171736390a1b23661c69058869a8c4d0bb46d1655858162012a057c7c067fd035d47d5d627e3cd27cd3ca021a34f8db6695c7e581ece67d898482d509e4df61dce5bbdfaac89465a9209c547b4263e9155940f8fcb1da3a4a7d25df2969f31644741a8c6fe8065d5f176214a4db8fe76bf41869b0f22e1f5cf5c34a5067b1d9f39f3ab4b0b9f6330d7cf6ec7477b53d9223fa70e4c680d49b32883d92b50c53cf9e61915437cf57eca49d6bbc88c64ccb222d4f20227cccd4f7e7c21f95ce74d6ab5dece17f600ad1715248648e4d1af6fe41a02023eb5cff871ec654756b7d156e601e82827e17dd0fe4f5357136120a810506a40f28a0b860c3ce75bf7796653327939b507043ab8be0175a9b312319818063ac40302eb42452da0b1cb9e3c2e43c49d740a03ac1b9057fb44eff830d548d12585f50dbaf7404c2dfa7f4403db8b7cee65df528f575c7f552d0632553fc6c90a3b09c1114492392c165e9b1b0a10e9556c72cde2bb23df6da784521249eec542012ec33599b97b95ff5234158a6d553b3bbae9704e630d64a66d658f74f27c8c30237e87686fb04551bb128d917305173e2788883352a0216fd8d0035d748c9b42a600073adba73f851bb5eca287ad325a3a3561769868c56e6d84fb661ed5a41649342ea342f82be528fd9bb4f492452c0a9426ed8677113ec6f1cac51233f0520425c3b27acfaa0d25a07bc2ca01115c90432ed14a1f4dda693c6e704a16bece8972d8218b62cec4f255058988b224d86f2bde4b221a3c672cb744ca8f9158a4e5c97d0c56af5dfc1c5f0191f64cb6d7ab86b14432eceb5a3ed77a8d3ea651a07c9a0cf95e631f41c2ab29191f66dd9a73271f47a455999c5fc8391550bbb346ca1bcad598a32a50cb52281156874f36de9d8ea5860d99703ea3f4907c640b47a75a285b4347845cd6c94407995f569fd8a4b12461d8236e4015ae000e2acaf2bd9f8d28377ec0d9e4cae714c481c5abae37448b3f84a291b84b4213c8fe1f6e0fdfa1a6d1a52c974f795c5947f667a8dbe162983ec0c71c0f0237e6ed8bcb7ac9e4c73b5a1ed85fd5e0fa2810c842d484d6f9dfcc8472f05683d9d1144ef6c36294bd06a019efec202fc46288eba2ade82aa3363faf32b9b027c75a7d615845cf2ec538141f1746009737600f697cc8d90c80c1e19f1ab2c08646c0e395802466d7fcae563e5cb09a0d1870bb580344804617879a14949cf22285f1bae3f27",
        "superseded": {
          "ephemeralPubKey": "02466d7fcae563e5cb09a0d1870bb580344804617879a14949cf22285f1bae3f27",
          "metadata": "020385e8044d17e2b96b3f50ed28c2502216322ac33f69d2ce34f0a11e9b3de339aebe98283a6010a34bdc98b0e5bbe142a38575da305066331d8d11d161f512b4b56b60fd049dfee3771473253a0310cd842c71cb7734474bfbdbbadd2b9b87c37804d8558b00d77b1f79f0fd2c94552a8d3b19fdd6a5511c4ebeea40aa839a489aec636b510bf51bf3782f24f53f752ee2db9fb4964e8379d0fa70603cb8c2c7293bc35a56b818257b65fbe6b2c98178b61d7ceb58c7e1a9100650a945c739e3603c188ba3c179823950c6d874d7fc8f8ddb7a9ee941f4a78a0f8a1eae080d4d77893aaefb0db452659b0275d171736390a1b23661c69058869a8c4d0bb46d1655858162012a057c7c067fd035d47d5d627e3cd27cd3ca021a34f8db6695c7e581ece67d898482d509e4df61dce5bbdfaac89465a9209c547b4263e9155940f8fcb1da3a4a7d25df2969f31644741a8c6fe8065d5f176214a4db8fe76bf41869b0f22e1f5cf5c34a5067b1d9f39f3ab4b0b9f6330d7cf6ec7477b53d9223fa70e4c680d49b32883d92b50c53cf9e61915437cf57eca49d6bbc88c64ccb222d4f20227cccd4f7e7c21f95ce74d6ab5dece17f600ad1715248648e4d1af6fe41a02023eb5cff871ec654756b7d156e601e82827e17dd0fe4f5357136120a810506a40f28a0b860c3ce75bf7796653327939b507043ab8be0175a9b312319818063ac40302eb42452da0b1cb9e3c2e43c49d740a03ac1b9057fb44eff830d548d12585f50dbaf7404c2dfa7f4403db8b7cee65df528f575c7f552d0632553fc6c90a3b09c1114492392c165e9b1b0a10e9556c72cde2bb23df6da784521249eec542012ec33599b97b95ff5234158a6d553b3bbae9704e630d64a66d658f74f27c8c30237e87686fb04551bb128d917305173e2788883352a0216fd8d0035d748c9b42a600073adba73f851bb5eca287ad325a3a3561769868c56e6d84fb661ed5a41649342ea342f82be528fd9bb4f492452c0a9426ed8677113ec6f1cac51233f0520425c3b27acfaa0d25a07bc2ca01115c90432ed14a1f4dda693c6e704a16bece8972d8218b62cec4f255058988b224d86f2bde4b221a3c672cb744ca8f9158a4e5c97d0c56af5dfc1c5f0191f64cb6d7ab86b14432eceb5a3ed77a8d3ea651a07c9a0cf95e631f41c2ab29191f66dd9a73271f47a455999c5fc8391550bbb346ca1bcad598a32a50cb52281156874f36de9d8ea5860d99703ea3f4907c640b47a75a285b4347845cd6c94407995f569fd8a4b12461d8236e4015ae000e2acaf2bd9f8d28377ec0d9e4cae714c481c5abae37448b3f84a291b84b4213c8fe1f6e0fdfa1a6d1a52c974f795c5947f667a8dbe162983ec0c71c0f0237e6ed8bcb7ac9e4c73b5a1ed85fd5e0fa2810c842d484d6f9dfcc8472f05683d9d1144ef6c36294bd06a019efec202fc46288eba2ade82aa3363faf32b9b027c75a7d615845cf2ec538141f1746009737600f697cc8d90c80c1e19f1ab2c08646c0e3958"
        },
        "note": "ct || epk in ephemeralPubKey, which is the same length as the right answer, so no length check distinguishes it; and the superseded layout with ct in metadata, which a conforming scanner skips on the ephemeralPubKey length"
      }
    },
    "V3-08a": {
      "claim": "the view tag is metadata[0], and any later bytes are ignored",
      "given": {
        "ephemeralPubKey": "02466d7fcae563e5cb09a0d1870bb580344804617879a14949cf22285f1bae3f270385e8044d17e2b96b3f50ed28c2502216322ac33f69d2ce34f0a11e9b3de339aebe98283a6010a34bdc98b0e5bbe142a38575da305066331d8d11d161f512b4b56b60fd049dfee3771473253a0310cd842c71cb7734474bfbdbbadd2b9b87c37804d8558b00d77b1f79f0fd2c94552a8d3b19fdd6a5511c4ebeea40aa839a489aec636b510bf51bf3782f24f53f752ee2db9fb4964e8379d0fa70603cb8c2c7293bc35a56b818257b65fbe6b2c98178b61d7ceb58c7e1a9100650a945c739e3603c188ba3c179823950c6d874d7fc8f8ddb7a9ee941f4a78a0f8a1eae080d4d77893aaefb0db452659b0275d171736390a1b23661c69058869a8c4d0bb46d1655858162012a057c7c067fd035d47d5d627e3cd27cd3ca021a34f8db6695c7e581ece67d898482d509e4df61dce5bbdfaac89465a9209c547b4263e9155940f8fcb1da3a4a7d25df2969f31644741a8c6fe8065d5f176214a4db8fe76bf41869b0f22e1f5cf5c34a5067b1d9f39f3ab4b0b9f6330d7cf6ec7477b53d9223fa70e4c680d49b32883d92b50c53cf9e61915437cf57eca49d6bbc88c64ccb222d4f20227cccd4f7e7c21f95ce74d6ab5dece17f600ad1715248648e4d1af6fe41a02023eb5cff871ec654756b7d156e601e82827e17dd0fe4f5357136120a810506a40f28a0b860c3ce75bf7796653327939b507043ab8be0175a9b312319818063ac40302eb42452da0b1cb9e3c2e43c49d740a03ac1b9057fb44eff830d548d12585f50dbaf7404c2dfa7f4403db8b7cee65df528f575c7f552d0632553fc6c90a3b09c1114492392c165e9b1b0a10e9556c72cde2bb23df6da784521249eec542012ec33599b97b95ff5234158a6d553b3bbae9704e630d64a66d658f74f27c8c30237e87686fb04551bb128d917305173e2788883352a0216fd8d0035d748c9b42a600073adba73f851bb5eca287ad325a3a3561769868c56e6d84fb661ed5a41649342ea342f82be528fd9bb4f492452c0a9426ed8677113ec6f1cac51233f0520425c3b27acfaa0d25a07bc2ca01115c90432ed14a1f4dda693c6e704a16bece8972d8218b62cec4f255058988b224d86f2bde4b221a3c672cb744ca8f9158a4e5c97d0c56af5dfc1c5f0191f64cb6d7ab86b14432eceb5a3ed77a8d3ea651a07c9a0cf95e631f41c2ab29191f66dd9a73271f47a455999c5fc8391550bbb346ca1bcad598a32a50cb52281156874f36de9d8ea5860d99703ea3f4907c640b47a75a285b4347845cd6c94407995f569fd8a4b12461d8236e4015ae000e2acaf2bd9f8d28377ec0d9e4cae714c481c5abae37448b3f84a291b84b4213c8fe1f6e0fdfa1a6d1a52c974f795c5947f667a8dbe162983ec0c71c0f0237e6ed8bcb7ac9e4c73b5a1ed85fd5e0fa2810c842d484d6f9dfcc8472f05683d9d1144ef6c36294bd06a019efec202fc46288eba2ade82aa3363faf32b9b027c75a7d615845cf2ec538141f1746009737600f697cc8d90c80c1e19f1ab2c08646c0e3958",
        "metadata_view_tag_only": "02",
        "metadata_with_token_block": "02eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee0000000000000000000000000000000000000000000000000de0b6b3a7640000"
      },
      "expect": {
        "view_tag_at_index_0": "02",
        "outcome": "both metadata values parse, to the same view tag"
      },
      "wrong": {
        "last_byte_of_metadata": "00",
        "note": "requiring metadata to be exactly one byte, which skips every payment from a sender that follows ERC-5564's token-metadata recommendation; or reading the tag off the end of metadata, which is the amount's low byte once the token block is present"
      }
    },
    "V3-09": {
      "claim": "keygen MUST be deterministic in the seed -- the same 128 bytes produce the same three outputs",
      "given": {
        "keygen_seed": "11111111111111111111111111111111111111111111111111111111111111113333333333333333333333333333333333333333333333333333333333333333e582b7d75e6c80b05ae392a1fc9f7153b12390fd99930368cc67a768baebc8a01cdacb8740c0b87c4a379575f187b367cbfa3b300bf591b109f79816e9cbe8f0",
        "kem_seed_source": "ML-KEM (d, z) of ACVP keygen tcId 26, so the ek below is NIST's value and not this generator's"
      },
      "expect": {
        "meta_address": "034f355bdcb7cc0af728ef3cceb9615d90684bb5b2ca5f859ab0f0b704075871aa023c72addb4fdf09af94f0c94d7fe92a386a7e70cf8a1d85916386bb2535c7b1b128c793778741b80b02b4339f2aa4347255b099f17264e1b8cc0a2c7c2a1a79f7997b907fd0496c6e6c8ad7714f5f339d75f11f625591a869be1175ae47f05fd4313468232ba6957d7807b824f445ac99a0d568ab1ad54dca8249d1482e61275f52248c77f61a4248753188cd1794cd0a465ec0dc4b025985c461b74e76286e4c37e77405695cc9fd0654374b427a20343aec0ff1a187768273bfc4905472a1da387f14559d6ce87313f6a5b6138434539f9a13684055b177e543f8b40f432abd7cc49989a50a9084c660913f45a8593b17499bc4cf936c2bc1851421cb986808a0ef30afe97aab5b8b8eb3f0b3506a95b91563a0e57db7231044987ef141bdab3537c316ad16f17805a81f29329879a94e96157e4b7447f7d59603b21bd896cc47b7cd4e232322eb9c5d2215696bcffca3a04efcc4c5d9cc39ac9a6e8700d38c244b0169e7fa1fe81b4b10365e74e6a1f7f756d11acdc84043f81006d62995376c22535958feb53f78117ee0f61c4c862640d06dc57a2b8be62a41a642af3bc63f6bac98bbbbff70570f37b8f8d9572f2735657a6c98f96caf57a849868720b2640b8bb2732237a1f984c18872d10289ce43c952c9257e06529aeb76afd127b17596fd25c5216c9cabd9b18efc50e87bbb04568bb7d5c4e9288c006483af5912e19108573700bd10cd77224b80659ea75aa74270b33ac4008b738bfee271e78658c8742ff13c96ad0781a03c7576ca26dd58b52980ba58c0505e446afa140cdcea0490db1f9b18815d4314b2459cacc562441c91f4084e5426c88e632cf7482e79907911d06473260835d7b85e7856a829aea0381707b939ce86882cc09c4448c6ae94a9c303107c5667eefb8df7763cc21189a3c590c40aa51f491503a7935ec08f4fc300cbe607ed8c9100c29fbf45584b13c8d780069337aec76c36ceb70373e2ab6e7b934b466f53fb32eaf040055496b8540e23a2a277e534468608d5ec0f8d38cea5bbb806c1bf4f164f6ac826fe733f95461e29dcc11200c0aada1b8332023eab329718ce25cc0a09555903f3578bbc863b1752ca94365da556df54c3b7e05cbb7115fbc1b6c57a172c31b9906560c8fb54f3c563a2256cc073243b8179b4a28d60e086cf51082ee429272996f0aabe03ba0eafd3c8e7d954bd0933e2f60ed0c32cede7b820a28e48f3ca3c40913cccae2337abfc59843f08c9863325d65a4e9e15c1f46172b118b2b5eb0f1d5158a00134f27b085488c3a0621fe4e5678698250fb74ee5152e3e35a66544a05d279ea99131fbc15165060b90f88eeb7b20892a4de4cb1683495bd7da037966b47cc040f1764c5deb06b5499d4267391cebbb47f734d8539e39528436a1858182854bf20b1f93279afb706464c65ccc5ae099b37cc03556c26abf4c3f8b9ba3a936707211a49a59b268f5284f7970c77612719450377417428c4ba47c9ca115cf95304c4759c5d8859b44985c06a6c924689237ba320d610960d61c53e85431789e67a40113f167ff93429c264f6cabc95448c903437d39a6577be0cf0012852aa476351a9046a110a1a625a3d74c910b78bce9cfca735e4f91b8a4c57dbe489e849446098aacf73070aee638fcc8896473d3c159d3afb4b687b40dfbf371a9c2644b605187b71a14bc4c8678fe8247",
        "meta_address_bytes": 1250,
        "spending_pk": "034f355bdcb7cc0af728ef3cceb9615d90684bb5b2ca5f859ab0f0b704075871aa",
        "viewing_pk_ec": "023c72addb4fdf09af94f0c94d7fe92a386a7e70cf8a1d85916386bb2535c7b1b1",
        "ek_at": "meta_address[66:1250]",
        "tracking": "3333333333333333333333333333333333333333333333333333333333333333e582b7d75e6c80b05ae392a1fc9f7153b12390fd99930368cc67a768baebc8a01cdacb8740c0b87c4a379575f187b367cbfa3b300bf591b109f79816e9cbe8f0",
        "tracking_bytes": 96,
        "master": "1111111111111111111111111111111111111111111111111111111111111111"
      },
      "wrong": {
        "note": "calling the KEM's randomness-taking keygen and ignoring kem_seed -- the entry point most ML-KEM APIs offer first. The meta-address is still well formed and registration still succeeds, so nothing fails until the owner restores from the seed, gets a different dk, and can decapsulate no payment ever made to the registered ek. Undetectable at keygen and total afterwards"
      }
    },
    "V3-10": {
      "claim": "spending_seed and viewing_ec_seed MUST each be a valid secp256k1 scalar -- error at keygen, per Section2.7",
      "given": {
        "seeds": {
          "spending_seed_0": "00000000000000000000000000000000000000000000000000000000000000003333333333333333333333333333333333333333333333333333333333333333e582b7d75e6c80b05ae392a1fc9f7153b12390fd99930368cc67a768baebc8a01cdacb8740c0b87c4a379575f187b367cbfa3b300bf591b109f79816e9cbe8f0",
          "spending_seed_n": "fffffffffffffffffffffffffffffffebaaedce6af48a03bbfd25e8cd03641413333333333333333333333333333333333333333333333333333333333333333e582b7d75e6c80b05ae392a1fc9f7153b12390fd99930368cc67a768baebc8a01cdacb8740c0b87c4a379575f187b367cbfa3b300bf591b109f79816e9cbe8f0",
          "spending_seed_n_minus_1": "fffffffffffffffffffffffffffffffebaaedce6af48a03bbfd25e8cd03641403333333333333333333333333333333333333333333333333333333333333333e582b7d75e6c80b05ae392a1fc9f7153b12390fd99930368cc67a768baebc8a01cdacb8740c0b87c4a379575f187b367cbfa3b300bf591b109f79816e9cbe8f0",
          "viewing_ec_seed_0": "11111111111111111111111111111111111111111111111111111111111111110000000000000000000000000000000000000000000000000000000000000000e582b7d75e6c80b05ae392a1fc9f7153b12390fd99930368cc67a768baebc8a01cdacb8740c0b87c4a379575f187b367cbfa3b300bf591b109f79816e9cbe8f0"
        },
        "seeds_are": "V3-09's keygen seed with the named 32-byte half replaced"
      },
      "expect": {
        "outcome": "error, error, accepted, error"
      },
      "wrong": {
        "note": "reducing the seed mod n instead of rejecting it as Section 2.1 requires: a library that reduces silently turns spending_seed = n into spending_seed = 0, and every payment to the resulting meta-address is spendable by anyone. n - 1 is the positive control -- an off-by-one in the bound rejects a legitimate seed"
      }
    },
    "V3-11": {
      "claim": "decoding MUST reject a meta-address length other than 1250",
      "given": {
        "lengths": [
          1249,
          1250,
          1251
        ],
        "meta_addresses": {
          "1249": "034f355bdcb7cc0af728ef3cceb9615d90684bb5b2ca5f859ab0f0b704075871aa023c72addb4fdf09af94f0c94d7fe92a386a7e70cf8a1d85916386bb2535c7b1b128c793778741b80b02b4339f2aa4347255b099f17264e1b8cc0a2c7c2a1a79f7997b907fd0496c6e6c8ad7714f5f339d75f11f625591a869be1175ae47f05fd4313468232ba6957d7807b824f445ac99a0d568ab1ad54dca8249d1482e61275f52248c77f61a4248753188cd1794cd0a465ec0dc4b025985c461b74e76286e4c37e77405695cc9fd0654374b427a20343aec0ff1a187768273bfc4905472a1da387f14559d6ce87313f6a5b6138434539f9a13684055b177e543f8b40f432abd7cc49989a50a9084c660913f45a8593b17499bc4cf936c2bc1851421cb986808a0ef30afe97aab5b8b8eb3f0b3506a95b91563a0e57db7231044987ef141bdab3537c316ad16f17805a81f29329879a94e96157e4b7447f7d59603b21bd896cc47b7cd4e232322eb9c5d2215696bcffca3a04efcc4c5d9cc39ac9a6e8700d38c244b0169e7fa1fe81b4b10365e74e6a1f7f756d11acdc84043f81006d62995376c22535958feb53f78117ee0f61c4c862640d06dc57a2b8be62a41a642af3bc63f6bac98bbbbff70570f37b8f8d9572f2735657a6c98f96caf57a849868720b2640b8bb2732237a1f984c18872d10289ce43c952c9257e06529aeb76afd127b17596fd25c5216c9cabd9b18efc50e87bbb04568bb7d5c4e9288c006483af5912e19108573700bd10cd77224b80659ea75aa74270b33ac4008b738bfee271e78658c8742ff13c96ad0781a03c7576ca26dd58b52980ba58c0505e446afa140cdcea0490db1f9b18815d4314b2459cacc562441c91f4084e5426c88e632cf7482e79907911d06473260835d7b85e7856a829aea0381707b939ce86882cc09c4448c6ae94a9c303107c5667eefb8df7763cc21189a3c590c40aa51f491503a7935ec08f4fc300cbe607ed8c9100c29fbf45584b13c8d780069337aec76c36ceb70373e2ab6e7b934b466f53fb32eaf040055496b8540e23a2a277e534468608d5ec0f8d38cea5bbb806c1bf4f164f6ac826fe733f95461e29dcc11200c0aada1b8332023eab329718ce25cc0a09555903f3578bbc863b1752ca94365da556df54c3b7e05cbb7115fbc1b6c57a172c31b9906560c8fb54f3c563a2256cc073243b8179b4a28d60e086cf51082ee429272996f0aabe03ba0eafd3c8e7d954bd0933e2f60ed0c32cede7b820a28e48f3ca3c40913cccae2337abfc59843f08c9863325d65a4e9e15c1f46172b118b2b5eb0f1d5158a00134f27b085488c3a0621fe4e5678698250fb74ee5152e3e35a66544a05d279ea99131fbc15165060b90f88eeb7b20892a4de4cb1683495bd7da037966b47cc040f1764c5deb06b5499d4267391cebbb47f734d8539e39528436a1858182854bf20b1f93279afb706464c65ccc5ae099b37cc03556c26abf4c3f8b9ba3a936707211a49a59b268f5284f7970c77612719450377417428c4ba47c9ca115cf95304c4759c5d8859b44985c06a6c924689237ba320d610960d61c53e85431789e67a40113f167ff93429c264f6cabc95448c903437d39a6577be0cf0012852aa476351a9046a110a1a625a3d74c910b78bce9cfca735e4f91b8a4c57dbe489e849446098aacf73070aee638fcc8896473d3c159d3afb4b687b40dfbf371a9c2644b605187b71a14bc4c8678fe82",
          "1250": "034f355bdcb7cc0af728ef3cceb9615d90684bb5b2ca5f859ab0f0b704075871aa023c72addb4fdf09af94f0c94d7fe92a386a7e70cf8a1d85916386bb2535c7b1b128c793778741b80b02b4339f2aa4347255b099f17264e1b8cc0a2c7c2a1a79f7997b907fd0496c6e6c8ad7714f5f339d75f11f625591a869be1175ae47f05fd4313468232ba6957d7807b824f445ac99a0d568ab1ad54dca8249d1482e61275f52248c77f61a4248753188cd1794cd0a465ec0dc4b025985c461b74e76286e4c37e77405695cc9fd0654374b427a20343aec0ff1a187768273bfc4905472a1da387f14559d6ce87313f6a5b6138434539f9a13684055b177e543f8b40f432abd7cc49989a50a9084c660913f45a8593b17499bc4cf936c2bc1851421cb986808a0ef30afe97aab5b8b8eb3f0b3506a95b91563a0e57db7231044987ef141bdab3537c316ad16f17805a81f29329879a94e96157e4b7447f7d59603b21bd896cc47b7cd4e232322eb9c5d2215696bcffca3a04efcc4c5d9cc39ac9a6e8700d38c244b0169e7fa1fe81b4b10365e74e6a1f7f756d11acdc84043f81006d62995376c22535958feb53f78117ee0f61c4c862640d06dc57a2b8be62a41a642af3bc63f6bac98bbbbff70570f37b8f8d9572f2735657a6c98f96caf57a849868720b2640b8bb2732237a1f984c18872d10289ce43c952c9257e06529aeb76afd127b17596fd25c5216c9cabd9b18efc50e87bbb04568bb7d5c4e9288c006483af5912e19108573700bd10cd77224b80659ea75aa74270b33ac4008b738bfee271e78658c8742ff13c96ad0781a03c7576ca26dd58b52980ba58c0505e446afa140cdcea0490db1f9b18815d4314b2459cacc562441c91f4084e5426c88e632cf7482e79907911d06473260835d7b85e7856a829aea0381707b939ce86882cc09c4448c6ae94a9c303107c5667eefb8df7763cc21189a3c590c40aa51f491503a7935ec08f4fc300cbe607ed8c9100c29fbf45584b13c8d780069337aec76c36ceb70373e2ab6e7b934b466f53fb32eaf040055496b8540e23a2a277e534468608d5ec0f8d38cea5bbb806c1bf4f164f6ac826fe733f95461e29dcc11200c0aada1b8332023eab329718ce25cc0a09555903f3578bbc863b1752ca94365da556df54c3b7e05cbb7115fbc1b6c57a172c31b9906560c8fb54f3c563a2256cc073243b8179b4a28d60e086cf51082ee429272996f0aabe03ba0eafd3c8e7d954bd0933e2f60ed0c32cede7b820a28e48f3ca3c40913cccae2337abfc59843f08c9863325d65a4e9e15c1f46172b118b2b5eb0f1d5158a00134f27b085488c3a0621fe4e5678698250fb74ee5152e3e35a66544a05d279ea99131fbc15165060b90f88eeb7b20892a4de4cb1683495bd7da037966b47cc040f1764c5deb06b5499d4267391cebbb47f734d8539e39528436a1858182854bf20b1f93279afb706464c65ccc5ae099b37cc03556c26abf4c3f8b9ba3a936707211a49a59b268f5284f7970c77612719450377417428c4ba47c9ca115cf95304c4759c5d8859b44985c06a6c924689237ba320d610960d61c53e85431789e67a40113f167ff93429c264f6cabc95448c903437d39a6577be0cf0012852aa476351a9046a110a1a625a3d74c910b78bce9cfca735e4f91b8a4c57dbe489e849446098aacf73070aee638fcc8896473d3c159d3afb4b687b40dfbf371a9c2644b605187b71a14bc4c8678fe8247",
          "1251": "034f355bdcb7cc0af728ef3cceb9615d90684bb5b2ca5f859ab0f0b704075871aa023c72addb4fdf09af94f0c94d7fe92a386a7e70cf8a1d85916386bb2535c7b1b128c793778741b80b02b4339f2aa4347255b099f17264e1b8cc0a2c7c2a1a79f7997b907fd0496c6e6c8ad7714f5f339d75f11f625591a869be1175ae47f05fd4313468232ba6957d7807b824f445ac99a0d568ab1ad54dca8249d1482e61275f52248c77f61a4248753188cd1794cd0a465ec0dc4b025985c461b74e76286e4c37e77405695cc9fd0654374b427a20343aec0ff1a187768273bfc4905472a1da387f14559d6ce87313f6a5b6138434539f9a13684055b177e543f8b40f432abd7cc49989a50a9084c660913f45a8593b17499bc4cf936c2bc1851421cb986808a0ef30afe97aab5b8b8eb3f0b3506a95b91563a0e57db7231044987ef141bdab3537c316ad16f17805a81f29329879a94e96157e4b7447f7d59603b21bd896cc47b7cd4e232322eb9c5d2215696bcffca3a04efcc4c5d9cc39ac9a6e8700d38c244b0169e7fa1fe81b4b10365e74e6a1f7f756d11acdc84043f81006d62995376c22535958feb53f78117ee0f61c4c862640d06dc57a2b8be62a41a642af3bc63f6bac98bbbbff70570f37b8f8d9572f2735657a6c98f96caf57a849868720b2640b8bb2732237a1f984c18872d10289ce43c952c9257e06529aeb76afd127b17596fd25c5216c9cabd9b18efc50e87bbb04568bb7d5c4e9288c006483af5912e19108573700bd10cd77224b80659ea75aa74270b33ac4008b738bfee271e78658c8742ff13c96ad0781a03c7576ca26dd58b52980ba58c0505e446afa140cdcea0490db1f9b18815d4314b2459cacc562441c91f4084e5426c88e632cf7482e79907911d06473260835d7b85e7856a829aea0381707b939ce86882cc09c4448c6ae94a9c303107c5667eefb8df7763cc21189a3c590c40aa51f491503a7935ec08f4fc300cbe607ed8c9100c29fbf45584b13c8d780069337aec76c36ceb70373e2ab6e7b934b466f53fb32eaf040055496b8540e23a2a277e534468608d5ec0f8d38cea5bbb806c1bf4f164f6ac826fe733f95461e29dcc11200c0aada1b8332023eab329718ce25cc0a09555903f3578bbc863b1752ca94365da556df54c3b7e05cbb7115fbc1b6c57a172c31b9906560c8fb54f3c563a2256cc073243b8179b4a28d60e086cf51082ee429272996f0aabe03ba0eafd3c8e7d954bd0933e2f60ed0c32cede7b820a28e48f3ca3c40913cccae2337abfc59843f08c9863325d65a4e9e15c1f46172b118b2b5eb0f1d5158a00134f27b085488c3a0621fe4e5678698250fb74ee5152e3e35a66544a05d279ea99131fbc15165060b90f88eeb7b20892a4de4cb1683495bd7da037966b47cc040f1764c5deb06b5499d4267391cebbb47f734d8539e39528436a1858182854bf20b1f93279afb706464c65ccc5ae099b37cc03556c26abf4c3f8b9ba3a936707211a49a59b268f5284f7970c77612719450377417428c4ba47c9ca115cf95304c4759c5d8859b44985c06a6c924689237ba320d610960d61c53e85431789e67a40113f167ff93429c264f6cabc95448c903437d39a6577be0cf0012852aa476351a9046a110a1a625a3d74c910b78bce9cfca735e4f91b8a4c57dbe489e849446098aacf73070aee638fcc8896473d3c159d3afb4b687b40dfbf371a9c2644b605187b71a14bc4c8678fe824700"
        },
        "meta_addresses_are": "V3-09's meta-address without its last byte, as it is, and with 0x00 appended"
      },
      "expect": {
        "outcome": "error, accepted, error"
      },
      "wrong": {
        "note": "slicing [0:33], [33:66], [66:] with no length check. 1251 then decodes with a trailing byte ignored and 1249 yields a 1183-byte ek that the KEM rejects much later, so the failure surfaces at the first payment rather than at decode"
      }
    },
    "V3-12": {
      "claim": "33 bytes of the right length can still be a non-point -- both points MUST be validated before the meta-address is used",
      "given": {
        "viewing_pk_ec_nonpoint": "020000000000000000000000000000000000000000000000000000000000000005",
        "why": "x = 5 is the smallest positive x for which x^3 + 7 is not a square mod p, so no y exists and this is 33 well-formed bytes that are not a point",
        "viewing_pk_ec_valid": "023c72addb4fdf09af94f0c94d7fe92a386a7e70cf8a1d85916386bb2535c7b1b1",
        "meta_address_nonpoint": "034f355bdcb7cc0af728ef3cceb9615d90684bb5b2ca5f859ab0f0b704075871aa02000000000000000000000000000000000000000000000000000000000000000528c793778741b80b02b4339f2aa4347255b099f17264e1b8cc0a2c7c2a1a79f7997b907fd0496c6e6c8ad7714f5f339d75f11f625591a869be1175ae47f05fd4313468232ba6957d7807b824f445ac99a0d568ab1ad54dca8249d1482e61275f52248c77f61a4248753188cd1794cd0a465ec0dc4b025985c461b74e76286e4c37e77405695cc9fd0654374b427a20343aec0ff1a187768273bfc4905472a1da387f14559d6ce87313f6a5b6138434539f9a13684055b177e543f8b40f432abd7cc49989a50a9084c660913f45a8593b17499bc4cf936c2bc1851421cb986808a0ef30afe97aab5b8b8eb3f0b3506a95b91563a0e57db7231044987ef141bdab3537c316ad16f17805a81f29329879a94e96157e4b7447f7d59603b21bd896cc47b7cd4e232322eb9c5d2215696bcffca3a04efcc4c5d9cc39ac9a6e8700d38c244b0169e7fa1fe81b4b10365e74e6a1f7f756d11acdc84043f81006d62995376c22535958feb53f78117ee0f61c4c862640d06dc57a2b8be62a41a642af3bc63f6bac98bbbbff70570f37b8f8d9572f2735657a6c98f96caf57a849868720b2640b8bb2732237a1f984c18872d10289ce43c952c9257e06529aeb76afd127b17596fd25c5216c9cabd9b18efc50e87bbb04568bb7d5c4e9288c006483af5912e19108573700bd10cd77224b80659ea75aa74270b33ac4008b738bfee271e78658c8742ff13c96ad0781a03c7576ca26dd58b52980ba58c0505e446afa140cdcea0490db1f9b18815d4314b2459cacc562441c91f4084e5426c88e632cf7482e79907911d06473260835d7b85e7856a829aea0381707b939ce86882cc09c4448c6ae94a9c303107c5667eefb8df7763cc21189a3c590c40aa51f491503a7935ec08f4fc300cbe607ed8c9100c29fbf45584b13c8d780069337aec76c36ceb70373e2ab6e7b934b466f53fb32eaf040055496b8540e23a2a277e534468608d5ec0f8d38cea5bbb806c1bf4f164f6ac826fe733f95461e29dcc11200c0aada1b8332023eab329718ce25cc0a09555903f3578bbc863b1752ca94365da556df54c3b7e05cbb7115fbc1b6c57a172c31b9906560c8fb54f3c563a2256cc073243b8179b4a28d60e086cf51082ee429272996f0aabe03ba0eafd3c8e7d954bd0933e2f60ed0c32cede7b820a28e48f3ca3c40913cccae2337abfc59843f08c9863325d65a4e9e15c1f46172b118b2b5eb0f1d5158a00134f27b085488c3a0621fe4e5678698250fb74ee5152e3e35a66544a05d279ea99131fbc15165060b90f88eeb7b20892a4de4cb1683495bd7da037966b47cc040f1764c5deb06b5499d4267391cebbb47f734d8539e39528436a1858182854bf20b1f93279afb706464c65ccc5ae099b37cc03556c26abf4c3f8b9ba3a936707211a49a59b268f5284f7970c77612719450377417428c4ba47c9ca115cf95304c4759c5d8859b44985c06a6c924689237ba320d610960d61c53e85431789e67a40113f167ff93429c264f6cabc95448c903437d39a6577be0cf0012852aa476351a9046a110a1a625a3d74c910b78bce9cfca735e4f91b8a4c57dbe489e849446098aacf73070aee638fcc8896473d3c159d3afb4b687b40dfbf371a9c2644b605187b71a14bc4c8678fe8247",
        "meta_address_valid": "034f355bdcb7cc0af728ef3cceb9615d90684bb5b2ca5f859ab0f0b704075871aa023c72addb4fdf09af94f0c94d7fe92a386a7e70cf8a1d85916386bb2535c7b1b128c793778741b80b02b4339f2aa4347255b099f17264e1b8cc0a2c7c2a1a79f7997b907fd0496c6e6c8ad7714f5f339d75f11f625591a869be1175ae47f05fd4313468232ba6957d7807b824f445ac99a0d568ab1ad54dca8249d1482e61275f52248c77f61a4248753188cd1794cd0a465ec0dc4b025985c461b74e76286e4c37e77405695cc9fd0654374b427a20343aec0ff1a187768273bfc4905472a1da387f14559d6ce87313f6a5b6138434539f9a13684055b177e543f8b40f432abd7cc49989a50a9084c660913f45a8593b17499bc4cf936c2bc1851421cb986808a0ef30afe97aab5b8b8eb3f0b3506a95b91563a0e57db7231044987ef141bdab3537c316ad16f17805a81f29329879a94e96157e4b7447f7d59603b21bd896cc47b7cd4e232322eb9c5d2215696bcffca3a04efcc4c5d9cc39ac9a6e8700d38c244b0169e7fa1fe81b4b10365e74e6a1f7f756d11acdc84043f81006d62995376c22535958feb53f78117ee0f61c4c862640d06dc57a2b8be62a41a642af3bc63f6bac98bbbbff70570f37b8f8d9572f2735657a6c98f96caf57a849868720b2640b8bb2732237a1f984c18872d10289ce43c952c9257e06529aeb76afd127b17596fd25c5216c9cabd9b18efc50e87bbb04568bb7d5c4e9288c006483af5912e19108573700bd10cd77224b80659ea75aa74270b33ac4008b738bfee271e78658c8742ff13c96ad0781a03c7576ca26dd58b52980ba58c0505e446afa140cdcea0490db1f9b18815d4314b2459cacc562441c91f4084e5426c88e632cf7482e79907911d06473260835d7b85e7856a829aea0381707b939ce86882cc09c4448c6ae94a9c303107c5667eefb8df7763cc21189a3c590c40aa51f491503a7935ec08f4fc300cbe607ed8c9100c29fbf45584b13c8d780069337aec76c36ceb70373e2ab6e7b934b466f53fb32eaf040055496b8540e23a2a277e534468608d5ec0f8d38cea5bbb806c1bf4f164f6ac826fe733f95461e29dcc11200c0aada1b8332023eab329718ce25cc0a09555903f3578bbc863b1752ca94365da556df54c3b7e05cbb7115fbc1b6c57a172c31b9906560c8fb54f3c563a2256cc073243b8179b4a28d60e086cf51082ee429272996f0aabe03ba0eafd3c8e7d954bd0933e2f60ed0c32cede7b820a28e48f3ca3c40913cccae2337abfc59843f08c9863325d65a4e9e15c1f46172b118b2b5eb0f1d5158a00134f27b085488c3a0621fe4e5678698250fb74ee5152e3e35a66544a05d279ea99131fbc15165060b90f88eeb7b20892a4de4cb1683495bd7da037966b47cc040f1764c5deb06b5499d4267391cebbb47f734d8539e39528436a1858182854bf20b1f93279afb706464c65ccc5ae099b37cc03556c26abf4c3f8b9ba3a936707211a49a59b268f5284f7970c77612719450377417428c4ba47c9ca115cf95304c4759c5d8859b44985c06a6c924689237ba320d610960d61c53e85431789e67a40113f167ff93429c264f6cabc95448c903437d39a6577be0cf0012852aa476351a9046a110a1a625a3d74c910b78bce9cfca735e4f91b8a4c57dbe489e849446098aacf73070aee638fcc8896473d3c159d3afb4b687b40dfbf371a9c2644b605187b71a14bc4c8678fe8247",
        "meta_addresses_are": "V3-09's meta-address with viewing_pk_ec replaced by each"
      },
      "expect": {
        "outcome": "error at decode, then accepted"
      },
      "wrong": {
        "note": "checking the length and the 0x02/0x03 tag byte and storing the bytes. The ECDH that follows either throws from inside a curve library, far from the meta-address that caused it, or -- in a library that does not validate -- returns a value on the wrong curve"
      }
    },
    "V3-13": {
      "claim": "address = keccak256(uncompressed(stealth_pk) without its 0x04 prefix)[12..32]",
      "given": {
        "stealth_pk_compressed": "029941deafc792c5eb388cc67340915f641ab29bff4c4ca0858254d14035e613f5",
        "stealth_pk_uncompressed": "049941deafc792c5eb388cc67340915f641ab29bff4c4ca0858254d14035e613f58b23892ee88f15989458410af6a706ca87c1571f3e368160aab09ccbf809dee8",
        "stealth_pk_from": {
          "row": "V3-16",
          "spending_pk": "034f355bdcb7cc0af728ef3cceb9615d90684bb5b2ca5f859ab0f0b704075871aa",
          "ss": "7ae80633e684e840812f564d69fee6e33e61b213a7d48c83f52920b40745ccf6"
        }
      },
      "expect": {
        "address": "1c41f46a98415cd7d6db5d3dc110f658ab04ef22",
        "eip55": "0x1c41F46a98415CD7d6dB5d3dc110F658AB04ef22"
      },
      "wrong": {
        "keccak_of_compressed": "d96510564cf18fba5c4c1a1e49f85ad8086e626a",
        "keccak_with_0x04_prefix": "7c8e035e07a9d98e7324e93c38b80c089a78e15a",
        "first_20_bytes_not_last_20": "aecfe5ebe11bd192d5dd0f6e1c41f46a98415cd7",
        "note": "each is 20 well-formed bytes and each is a different address. The sender pays one of them and the recipient derives another; the payment is not lost to an error, it is lost to a chain address nobody holds a key for"
      }
    },
    "V3-14": {
      "claim": "a view-tag mismatch is a skip -- and decapsulation does not fail",
      "given": {
        "acvp_decapsulation_tcId": 88,
        "acvp_reason": "modified ciphertext",
        "dk": "the expanded dk of NIST ACVP ML-KEM-encapDecap-FIPS203, decapsulation tcId 88",
        "ek": "8c6a9c67a137342bba5a1a7191c17411a649e9b9b47f0c3522264c38f66437438c7b75588787bb03b1c073d668b355239e7502840a7183e9c9e49270a1339941e17733792d4beabe4dc50a2351a3f1aa11323490511bb00371ad9ae72f4589bd5da732ea52892d8a6f98386e67d3b8cc97af61ca9c15c23a97725ba5c820452786cccc34751ccf13f72d2af1a0b7f81f698b5b8ff9a2cd5b076d23a6219ca9457338236c743360cf9e8a19dc83cea7f5be17d084835b8ed700cb0a1c9d7cdcc4f5526b63c34d623749c9992a19957aa5c0894a623821acc3cca0b9410c0f8cd59757c53899c1a0d327733c0b7f1961b0c74b9ddbac662c166c5f787141f81d19b907e8a042fd2b01794b8968486e69fa02fd136ded53c6a633899a368442acca49f66eb4766a16247128c38b7e0287d3bbb1594324d6b1c9c80a368c5903a0080ebdf6c72a27aa10286859382349d39f9c91acb06800152b9edc9cb965a5ac9e7c8a6f1439b18b2fe1942c9b9943ee830a7adb5eec6501f593361e0c95625b7497a02a30173faf47c74dcc4e99a436864a5110130b2b6c8007015d1ebb15c232bf91ab19dca7711ed97d98637e051a1e686b21f9eaac8652129b69102eb4a4ca0906ec9489daea054dbb7afbcca5c4c8c511b753e8847224f95a3fc8b12a65614c8c04ef58a56ebc1170a48886f04e24976411e88e44220f1ce13bba414775e463e9826572b6a879625b348aabc7a6445e95052c77b13db39f1c719ff597b688a73a23d7912c3ac06b6b8324153e3b2b4c63b361be77267573c5f2a88477a25971778151a96b1c8c3033d0a43c7378736a2caf73143e3cc348fa239f74a3ddd51cf10acfd78735f1136576c97718d7822635b2bdb159ca2701493489f4fc8ba27a5c891abf9d73316c7583248956bffcbb790c3519b010018887fc891d98b33aa62582f0d9cd790626afe183269834c742589497155c5545706c0e397b25909b18ec3c734b824a6095c2b0843a0a165a88729dfc1bc0319797946ba4e3d85e3d20b1e0cb1eab0547ea30c41056835d3c78a7487f6cb774b9d68f7e613f5668717bf81498617fcbc730f93377656c9a6033347a4ac0749374ba8807e2440758788cf7056f9480936524608704281499a7b04a46fb595c7bd274568b2c7007442059bff1851795739568334b2dd3517092632d839961f7a2b23b33cc3831217ab6ded0a413118f369b859507ad1eea019d0c82b1341146b58da521535e55904ac7145bdc7174c82e5bc877dafa993049ceb9d3ac2a81955c5508cedc1331a28bce2827d127a0109a8512fb78bbac2cfeb31a997a091af60414e637597a3824684213588386055e64a515da5a5c670a81ac972b2f6cc6e82abff1150bf5901fb0f0186f4ab76ee22a3638a0018c8dfa04777357cdc5c667f0f81e1b6a833e67529c71854bb32d206b39ab3247db61ac2874344d82a8b818178c8589e5419d558414f3fc53b72823357b0b50138d4c80864db3685944732793467f5989f283589178994aa63b01a68d2ac8cad2f3b3b62c6f5aa7ad4bc2cabaf306dc37cf46428855f23e6988bd2b21349bc1223a819b54473f397c60f6d4777dd1775e3685ead34b9a162c0625e876dd243debe6b4d6e1a2829abdf70d120c02c34ce876bec17a72",
        "ek_source": "dk[1152:2336] per FIPS 203's expanded key layout, checked against the H(ek) at dk[2336:2368]",
        "viewing_ec": "3333333333333333333333333333333333333333333333333333333333333333",
        "viewing_pk_ec": "023c72addb4fdf09af94f0c94d7fe92a386a7e70cf8a1d85916386bb2535c7b1b1",
        "spending_pk": "034f355bdcb7cc0af728ef3cceb9615d90684bb5b2ca5f859ab0f0b704075871aa",
        "recipient_is": "V3-09's viewing key with the KEM key of ACVP decapsulation tcId 88. ACVP gives that key only in expanded form, so an implementation that holds keys as (d, z) seeds starts from the ss_pq given here",
        "announcement": {
          "stealthAddress": "66bb3f50a0799f6b2e780c39190b59e79454e7f9",
          "ephemeralPubKey": "02466d7fcae563e5cb09a0d1870bb580344804617879a14949cf22285f1bae3f27c4ff0334ee9e01b04014ca57fd3c1f02f6b4fa91490864fe7be3f3601a0ba87791c73ac5a54097fbf4c21a8c5051a5ea8a32150ac7f4dda59280afcf938b6b5e7a023235c2aa330cdc0a976c5387bf1e92ae9c9d195436904cc9a4f9d7f2fc90317957b9744a6f4278bc48094bfe26c9aa09cafe0d7d8e1fc04416ad27c37e950dbcfb696a6f9bb96325f99d7143770e9f45c1e011bf6b9e550f28e8dc151d561a0b3048b1fcc07b2ebe0790a589a16c7bc75fff4cdc90dfb571bcd0dce00dcae5495b54f66881548a0fdbd1b90e529ad7fa2921874088c96af8fb99c7f621560ecc6691c69a8d02322d671f67d67c663bba9b0ba451798eefb2c148324961c145737325731fd6b8383137400409478737e792f072a0ed2e7f43768cd132eccdbbb393ac435934d1fb8adc17551d3c2a1d9db4c205888f58b630c80f2c98eda00b7e6f2e3e0c6d4124866964c98bd086daa126215a98293957c6ad68724b2bd0e4cf55a45fec8c03622b3b358d3fb45b619d3286e5d7bc429d9e06342b38485767bca1898691208b4786a3258be2e9a6bb5ab2ec7b8cf3752bdc0e4e6767f5e46d7221bc8e8bd69f36f1b14c6f4b15272b780c18fa118aac52a390a28e8862773789113371cdcefdc4b45547be5f26a9bc3151fcb87fd9c50a99cf4338562023a15b13860aff9daac05a2409834c0b68ee3a635261053546407e8cfa75046f55978ad9b2afecc8a79d35b8349e0a33f90f23ad6648761f400228d83fa22366f0d2613814b505c29069fa8f3cb0b6143de9baf4e9dfdaf2b606cc577d06d2b32794c41199f06517a475313fc9f9d433099fc7b310c99fbaa132082b05c332b00cb3871d2dcc60fa33f8956074b87a2c1e4ea6609670f0e81dfd75ad8b68ddc91217127930659c6a29e07a9e5102908e218f101d5feec11f9c3e759e381e74379f648c29f7033bb58afca6590f0f84fee54510a78ed12528c960a93a691ff1667e319d641f97c16cf1d45399daa03bd5ea15c806f19d4e759d641fe1071449cf4e13c70d1c58d2265d53eb07a5cbe012cf9fd6768221d27e69d727af657e2151593207909d1ca11a8c96e2ccca095c3bb811c87ebe14e995ffb7f763b47ed0eeb604a0cccd74ab0c29dfcfe3b4620f5e8eb3ffd74ae9bc7a6b48ae4651d430871d4651e64c2b2fbe5701e2c64e20f5279157b55e3e9d166caf03fbaef2472e960d1a0160a92f42d1834b5d493e52e9d0897dbfaa373208eadc16fcff3ce8ae40226a469abc60b9a1b67244c5aeebf1abaecfe9dd9f9c1183f125d3b6172afb2c6cc29125a9f8c3a8b31fa880fc447719c5e58c50c4199e17ef9a061eab483bbfe370f277b9ca09b3e3e6ff39e97ae392c0ef0b623f9be056db4d21e7704b5127d42f7fea27fea8f9186044e49d2c2d51758329c8cab35b00df58c91a5e2f6fc6faafcd2037ba982052f02f204508c9b2c7d6ef53955372010fb3505c8c8e27677ef37ef07bd619342aa3fa6de31eb7e6089ef5f0bf9c4aeb024f9161897906c643",
          "metadata": "1b"
        }
      },
      "expect": {
        "decapsulation": "returns 32 bytes and does NOT fail",
        "ss_ec": "9110f8760a37d96052e3dcaf14862a147654f49f722cf213568ccef1eca2ec71",
        "ss_pq": "2cfb695710a6c4377f46c20c13480aef7ac56030d47a0ab5af07ddd6062c28f4",
        "ss": "ae2a96babff39ac65256532fd1a335a2ecf80b89b2b02d87457e2f4b5738ff72",
        "derived_view_tag": "1a",
        "outcome": "skip",
        "outcome_with_derived_view_tag": "match"
      },
      "wrong": {
        "note": "scanning on whether Decaps errored. It never does -- ML-KEM rejects implicitly, which is what this NIST case shows: a ciphertext not produced for this key returns a pseudorandom secret and no error. An implementation that treats decapsulation as the ownership test matches every announcement ever published. Raising on the tag mismatch is the other error: announce() is permissionless, so an error path there is a scanner denial of service (Section2.7)"
      }
    },
    "V3-15": {
      "claim": "a malformed announcement is a skip at the entry point, not an error",
      "given": {
        "ephemeralPubKey_lengths": [
          33,
          1120,
          1121,
          1122
        ],
        "metadata_lengths": [
          0,
          1,
          57
        ],
        "ephemeralPubKeys": {
          "33": "02466d7fcae563e5cb09a0d1870bb580344804617879a14949cf22285f1bae3f27",
          "1120": "02466d7fcae563e5cb09a0d1870bb580344804617879a14949cf22285f1bae3f270385e8044d17e2b96b3f50ed28c2502216322ac33f69d2ce34f0a11e9b3de339aebe98283a6010a34bdc98b0e5bbe142a38575da305066331d8d11d161f512b4b56b60fd049dfee3771473253a0310cd842c71cb7734474bfbdbbadd2b9b87c37804d8558b00d77b1f79f0fd2c94552a8d3b19fdd6a5511c4ebeea40aa839a489aec636b510bf51bf3782f24f53f752ee2db9fb4964e8379d0fa70603cb8c2c7293bc35a56b818257b65fbe6b2c98178b61d7ceb58c7e1a9100650a945c739e3603c188ba3c179823950c6d874d7fc8f8ddb7a9ee941f4a78a0f8a1eae080d4d77893aaefb0db452659b0275d171736390a1b23661c69058869a8c4d0bb46d1655858162012a057c7c067fd035d47d5d627e3cd27cd3ca021a34f8db6695c7e581ece67d898482d509e4df61dce5bbdfaac89465a9209c547b4263e9155940f8fcb1da3a4a7d25df2969f31644741a8c6fe8065d5f176214a4db8fe76bf41869b0f22e1f5cf5c34a5067b1d9f39f3ab4b0b9f6330d7cf6ec7477b53d9223fa70e4c680d49b32883d92b50c53cf9e61915437cf57eca49d6bbc88c64ccb222d4f20227cccd4f7e7c21f95ce74d6ab5dece17f600ad1715248648e4d1af6fe41a02023eb5cff871ec654756b7d156e601e82827e17dd0fe4f5357136120a810506a40f28a0b860c3ce75bf7796653327939b507043ab8be0175a9b312319818063ac40302eb42452da0b1cb9e3c2e43c49d740a03ac1b9057fb44eff830d548d12585f50dbaf7404c2dfa7f4403db8b7cee65df528f575c7f552d0632553fc6c90a3b09c1114492392c165e9b1b0a10e9556c72cde2bb23df6da784521249eec542012ec33599b97b95ff5234158a6d553b3bbae9704e630d64a66d658f74f27c8c30237e87686fb04551bb128d917305173e2788883352a0216fd8d0035d748c9b42a600073adba73f851bb5eca287ad325a3a3561769868c56e6d84fb661ed5a41649342ea342f82be528fd9bb4f492452c0a9426ed8677113ec6f1cac51233f0520425c3b27acfaa0d25a07bc2ca01115c90432ed14a1f4dda693c6e704a16bece8972d8218b62cec4f255058988b224d86f2bde4b221a3c672cb744ca8f9158a4e5c97d0c56af5dfc1c5f0191f64cb6d7ab86b14432eceb5a3ed77a8d3ea651a07c9a0cf95e631f41c2ab29191f66dd9a73271f47a455999c5fc8391550bbb346ca1bcad598a32a50cb52281156874f36de9d8ea5860d99703ea3f4907c640b47a75a285b4347845cd6c94407995f569fd8a4b12461d8236e4015ae000e2acaf2bd9f8d28377ec0d9e4cae714c481c5abae37448b3f84a291b84b4213c8fe1f6e0fdfa1a6d1a52c974f795c5947f667a8dbe162983ec0c71c0f0237e6ed8bcb7ac9e4c73b5a1ed85fd5e0fa2810c842d484d6f9dfcc8472f05683d9d1144ef6c36294bd06a019efec202fc46288eba2ade82aa3363faf32b9b027c75a7d615845cf2ec538141f1746009737600f697cc8d90c80c1e19f1ab2c08646c0e39",
          "1121": "02466d7fcae563e5cb09a0d1870bb580344804617879a14949cf22285f1bae3f270385e8044d17e2b96b3f50ed28c2502216322ac33f69d2ce34f0a11e9b3de339aebe98283a6010a34bdc98b0e5bbe142a38575da305066331d8d11d161f512b4b56b60fd049dfee3771473253a0310cd842c71cb7734474bfbdbbadd2b9b87c37804d8558b00d77b1f79f0fd2c94552a8d3b19fdd6a5511c4ebeea40aa839a489aec636b510bf51bf3782f24f53f752ee2db9fb4964e8379d0fa70603cb8c2c7293bc35a56b818257b65fbe6b2c98178b61d7ceb58c7e1a9100650a945c739e3603c188ba3c179823950c6d874d7fc8f8ddb7a9ee941f4a78a0f8a1eae080d4d77893aaefb0db452659b0275d171736390a1b23661c69058869a8c4d0bb46d1655858162012a057c7c067fd035d47d5d627e3cd27cd3ca021a34f8db6695c7e581ece67d898482d509e4df61dce5bbdfaac89465a9209c547b4263e9155940f8fcb1da3a4a7d25df2969f31644741a8c6fe8065d5f176214a4db8fe76bf41869b0f22e1f5cf5c34a5067b1d9f39f3ab4b0b9f6330d7cf6ec7477b53d9223fa70e4c680d49b32883d92b50c53cf9e61915437cf57eca49d6bbc88c64ccb222d4f20227cccd4f7e7c21f95ce74d6ab5dece17f600ad1715248648e4d1af6fe41a02023eb5cff871ec654756b7d156e601e82827e17dd0fe4f5357136120a810506a40f28a0b860c3ce75bf7796653327939b507043ab8be0175a9b312319818063ac40302eb42452da0b1cb9e3c2e43c49d740a03ac1b9057fb44eff830d548d12585f50dbaf7404c2dfa7f4403db8b7cee65df528f575c7f552d0632553fc6c90a3b09c1114492392c165e9b1b0a10e9556c72cde2bb23df6da784521249eec542012ec33599b97b95ff5234158a6d553b3bbae9704e630d64a66d658f74f27c8c30237e87686fb04551bb128d917305173e2788883352a0216fd8d0035d748c9b42a600073adba73f851bb5eca287ad325a3a3561769868c56e6d84fb661ed5a41649342ea342f82be528fd9bb4f492452c0a9426ed8677113ec6f1cac51233f0520425c3b27acfaa0d25a07bc2ca01115c90432ed14a1f4dda693c6e704a16bece8972d8218b62cec4f255058988b224d86f2bde4b221a3c672cb744ca8f9158a4e5c97d0c56af5dfc1c5f0191f64cb6d7ab86b14432eceb5a3ed77a8d3ea651a07c9a0cf95e631f41c2ab29191f66dd9a73271f47a455999c5fc8391550bbb346ca1bcad598a32a50cb52281156874f36de9d8ea5860d99703ea3f4907c640b47a75a285b4347845cd6c94407995f569fd8a4b12461d8236e4015ae000e2acaf2bd9f8d28377ec0d9e4cae714c481c5abae37448b3f84a291b84b4213c8fe1f6e0fdfa1a6d1a52c974f795c5947f667a8dbe162983ec0c71c0f0237e6ed8bcb7ac9e4c73b5a1ed85fd5e0fa2810c842d484d6f9dfcc8472f05683d9d1144ef6c36294bd06a019efec202fc46288eba2ade82aa3363faf32b9b027c75a7d615845cf2ec538141f1746009737600f697cc8d90c80c1e19f1ab2c08646c0e3958",
          "1122": "02466d7fcae563e5cb09a0d1870bb580344804617879a14949cf22285f1bae3f270385e8044d17e2b96b3f50ed28c2502216322ac33f69d2ce34f0a11e9b3de339aebe98283a6010a34bdc98b0e5bbe142a38575da305066331d8d11d161f512b4b56b60fd049dfee3771473253a0310cd842c71cb7734474bfbdbbadd2b9b87c37804d8558b00d77b1f79f0fd2c94552a8d3b19fdd6a5511c4ebeea40aa839a489aec636b510bf51bf3782f24f53f752ee2db9fb4964e8379d0fa70603cb8c2c7293bc35a56b818257b65fbe6b2c98178b61d7ceb58c7e1a9100650a945c739e3603c188ba3c179823950c6d874d7fc8f8ddb7a9ee941f4a78a0f8a1eae080d4d77893aaefb0db452659b0275d171736390a1b23661c69058869a8c4d0bb46d1655858162012a057c7c067fd035d47d5d627e3cd27cd3ca021a34f8db6695c7e581ece67d898482d509e4df61dce5bbdfaac89465a9209c547b4263e9155940f8fcb1da3a4a7d25df2969f31644741a8c6fe8065d5f176214a4db8fe76bf41869b0f22e1f5cf5c34a5067b1d9f39f3ab4b0b9f6330d7cf6ec7477b53d9223fa70e4c680d49b32883d92b50c53cf9e61915437cf57eca49d6bbc88c64ccb222d4f20227cccd4f7e7c21f95ce74d6ab5dece17f600ad1715248648e4d1af6fe41a02023eb5cff871ec654756b7d156e601e82827e17dd0fe4f5357136120a810506a40f28a0b860c3ce75bf7796653327939b507043ab8be0175a9b312319818063ac40302eb42452da0b1cb9e3c2e43c49d740a03ac1b9057fb44eff830d548d12585f50dbaf7404c2dfa7f4403db8b7cee65df528f575c7f552d0632553fc6c90a3b09c1114492392c165e9b1b0a10e9556c72cde2bb23df6da784521249eec542012ec33599b97b95ff5234158a6d553b3bbae9704e630d64a66d658f74f27c8c30237e87686fb04551bb128d917305173e2788883352a0216fd8d0035d748c9b42a600073adba73f851bb5eca287ad325a3a3561769868c56e6d84fb661ed5a41649342ea342f82be528fd9bb4f492452c0a9426ed8677113ec6f1cac51233f0520425c3b27acfaa0d25a07bc2ca01115c90432ed14a1f4dda693c6e704a16bece8972d8218b62cec4f255058988b224d86f2bde4b221a3c672cb744ca8f9158a4e5c97d0c56af5dfc1c5f0191f64cb6d7ab86b14432eceb5a3ed77a8d3ea651a07c9a0cf95e631f41c2ab29191f66dd9a73271f47a455999c5fc8391550bbb346ca1bcad598a32a50cb52281156874f36de9d8ea5860d99703ea3f4907c640b47a75a285b4347845cd6c94407995f569fd8a4b12461d8236e4015ae000e2acaf2bd9f8d28377ec0d9e4cae714c481c5abae37448b3f84a291b84b4213c8fe1f6e0fdfa1a6d1a52c974f795c5947f667a8dbe162983ec0c71c0f0237e6ed8bcb7ac9e4c73b5a1ed85fd5e0fa2810c842d484d6f9dfcc8472f05683d9d1144ef6c36294bd06a019efec202fc46288eba2ade82aa3363faf32b9b027c75a7d615845cf2ec538141f1746009737600f697cc8d90c80c1e19f1ab2c08646c0e395811"
        },
        "metadatas": {
          "0": "",
          "1": "02",
          "57": "021111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111"
        },
        "fields_are": "V3-08's ephemeralPubKey and metadata, cut to each length or padded to it with 0x11 bytes"
      },
      "expect": {
        "outcome": "skip unless ephemeralPubKey is 1121 bytes and metadata is at least 1 byte; 1121 / 1 and 1121 / 57 are processed"
      },
      "wrong": {
        "note": "raising, or propagating a library exception. Anyone can call announce() with any bytes, so a scanner that errors on shape stops at the first announcement an attacker publishes -- and it costs the attacker one transaction. 33 is the superseded epk-only field. 1121 / 1 and 1121 / 57 are the positive controls"
      }
    },
    "V3-16": {
      "claim": "stealth_pk = spending_pk + H(ss)*G and stealth_sk = (spending_sk + H(ss)) mod n, and the two are one key pair",
      "given": {
        "ss": "7ae80633e684e840812f564d69fee6e33e61b213a7d48c83f52920b40745ccf6",
        "ss_from": "V3-05",
        "spending_sk": "1111111111111111111111111111111111111111111111111111111111111111",
        "spending_pk": "034f355bdcb7cc0af728ef3cceb9615d90684bb5b2ca5f859ab0f0b704075871aa",
        "spending_sk_near_n": "fffffffffffffffffffffffffffffffebaaedce6af48a03bbfd25e8cd0364140"
      },
      "expect": {
        "H_ss": "c501747dcccfa828e8054d1a984a5532b811b637de79935b74a499eb353a1c4f",
        "stealth_pk": "029941deafc792c5eb388cc67340915f641ab29bff4c4ca0858254d14035e613f5",
        "stealth_sk": "d612858edde0b939f9165e2ba95b6643c922c748ef8aa46c85b5aafc464b2d60",
        "address": "1c41f46a98415cd7d6db5d3dc110f658ab04ef22",
        "near_n": {
          "stealth_pk": "0355f5b492e9e4027df3f060d250eb4c08cbef171d74c319ce436c6171a3a8d527",
          "stealth_sk": "c501747dcccfa828e8054d1a984a5532b811b637de79935b74a499eb353a1c4e"
        }
      },
      "wrong": {
        "multiplicative_stealth_pk": "03f9524449aabf47c8d77ae81c51dc162fe0cadb90727bb12ac94b6f508a2bf3fa",
        "multiplicative_stealth_sk": "cb257436824755ea7957b47fae73538293820705b1918cef2e1902c0a9fe71e8",
        "ss_as_offset_stealth_pk": "02b11f79a5837ecbf208212ed1510092e8c4c37b934236a73d547c8cbdb2688a8c",
        "near_n_reduced_mod_2_256": "c501747dcccfa828e8054d1a984a553172c0931e8dc233973476f87805705d8f",
        "note": "the tweak is additive, as in ERC-5564. A multiplicative tweak, H(ss)*spending_pk with spending_sk*H(ss), is also one key pair, so a sender and a recipient built on it agree with each other and with nobody else; using ss itself as the offset skips Section 1's hash and range check. With spending_sk = n - 1 the sum passes n, and reducing it mod 2^256 instead of mod n gives the key of a different address"
      }
    },
    "V3-17": {
      "claim": "the announced stealthAddress decides: a view-tag match with a different stealthAddress is a skip",
      "given": {
        "acvp_decapsulation_tcId": 86,
        "acvp_reason": "valid decapsulation",
        "dk": "the expanded dk of NIST ACVP ML-KEM-encapDecap-FIPS203, decapsulation tcId 86",
        "ek": "51344bc40a6b203083918c40aa459ea2e20892514749556294534cb3e3b948f1c0f7a941fde49874c609973a4e845b112456974b3aaf9877b3159b7ed0c4c423889c8a8b1c5b33409a8c6b26f573a6668a5fe0c74ad0ca28304d1c7a498a93bc08921d3943042f986438abcc61a358c6482839a524845b04ffca16cb741f7db5b0afd7b9874b6b53d156b3e036b3d41e963b27ac0c87b411436471591001635e6440903a0b38302a92c8777f264de5290dd1e511bc7c0a68e3266882cedd30aca8928596b7affb28b94d8711e31a8c9e5ac2a9567b55630d5ff8627e52386408a1bb3bc2d6b90a7c33c04aaa60e9046e10d89b41fbb8e3e26cbc27c1c062411436cc22d637dd021cb93b6972cb7aee5c98ad64006b0cd070b0ad99d467158c85852b88666ba1de29cfa3047396a5bddc76b1afaba62d622e17f846e17487a167ca9b45070309526ee08791647cee81b7aff21ca97c7d09a7b0a2880db0110461f168a8f5bafa045864373217b05ed1223fd0b00a1d7810e341c15ce69567e8265110918b857f2546beb5761de3849fde971e2cc649c363c0ef296e2dc94b07499869851ba3032248e4a628294d626c6f38c42530a07952d6b44b650112f77c8df5c5939102090c8188db61f3713e93c4a22a61c91fea79ea06bb1344a5ccd63812f540a8907ffcf62fbdd7344a744095bc5df65047dcf8362a38bff92b5b6098893ae96286f4199f857dc5351b962204807b9421602a0f00222a82b6f4785daf303354f9c097cb74a0723cbfda0553c4b0b4454e1ed11c6926396be9ad5cd16011d333a1a880e123934243542776a0848b0ccc442bcb117c24982c42d10510683e7d534ac47c6631acb187039d098b7de551b868a28ffc42112253aef0f86f4c358c778017b30c0c3510254e6abf50664fb54c197bacbb790c32a935783093c88927b65c5c696c695cab4a845b262219c639c4f07dcf663914094b1db58dd04105d7c6bc32b6392d481bf954abacac7570cb30bdf265e955ac1df3a356ab59c89b0cc6db7ecf4185f81ba9af7ba8ca47bf69a278681c1c8216cabb4887a366204118764669209d502be63bc8f21429e7434b381b55c95c53da864e333c13e7818644788a381215a4954cf3a038dae27ca4684b130268436cc22fa100ebd843d6d9a20dd0b8c4bc8d56899fd3e4272ca1301ac9429986977a9a4910a785990629dffc7ef2093aaa646741825e53ac6c43b962b5624a4d31a5e054436a2b7b880460a52062e4c5c9b2e72225dc2355d44dd6b22a18ca6a05094bf8d3b2a0c58c13777bbe448fd0182b876a596e595ad4e79db6f0c1b4e1435507802e2b539edc25820b23e7127655e11b34a5aaff25c11a7b617ed7083650c9030462a79ab77be63780a45f8ca96dcb15358e56aedc31360b2030010282ca67cde5169993fa808ee475bda0af49c216af9506330c9b0384bd2c3c51b814cff09b3c530ca754e67966c22e44f68650b7117f78235d8425929816526b0a46f647a85a7929b49d677a38418368091590fd1276ee9629e63944db4770b7c22e30b2cffba5b6d46a9a1217b7fa44b54b8266f07554b3ea970cc30d1e92c03f41ce2a2093f58a831a4353e02393cb8969a582d55545ec39a61104ba2e5bf082d0d9573988cc26089b2227",
        "ek_source": "dk[1152:2336] per FIPS 203's expanded key layout, checked against the H(ek) at dk[2336:2368]",
        "viewing_ec": "3333333333333333333333333333333333333333333333333333333333333333",
        "viewing_pk_ec": "023c72addb4fdf09af94f0c94d7fe92a386a7e70cf8a1d85916386bb2535c7b1b1",
        "spending_pk": "034f355bdcb7cc0af728ef3cceb9615d90684bb5b2ca5f859ab0f0b704075871aa",
        "recipient_is": "V3-09's viewing key with the KEM key of ACVP decapsulation tcId 86. ACVP gives that key only in expanded form, so an implementation that holds keys as (d, z) seeds starts from the ss_pq given here",
        "announcement": {
          "ephemeralPubKey": "02466d7fcae563e5cb09a0d1870bb580344804617879a14949cf22285f1bae3f27f8ffae03ca26e156af3aa562e6f84159596d3a985ae42da4e45171ba7c8a1cfee2549efddc414b27ff697920bfc8a006be1651b0ecd18f91c91f1df9e6332178c3ba45407099c0c5c223e9c88d4bed9742d8a3e1251c6af4b03cf79f2671d8746e7c86eb270f0c54b3362f691387539f5e7b16680ab51c1f93d098d40cb8698827ae9eb1a85f52199589d561a0fb1140fad888ab0b03fce03a9d1d1069f0ffe274362f3f1b656e402e3075efc29cfdcd3d3a4163f74ce6b1566cf4626d14544a2a33ddf5860612af5d337c6b55a7eae01422ca01882baa591f9edda6976e2bfdf945277b4c145cdbea5f22b636dd9761f8edc518c33223fd46d771e39756b26dfd35798d3aa071f90d2250220d4869c59b3cad020b1e786eb8c856d2ab33ffa1605fb61cb91c64de695fcc1d61ba06941b5336cb67e648b4197af2b297f4eed2df996e213d63e0bfb54a86c47b286a9d5059580dad4007e4dc6fb944a53717f325d94eb6a514c13efc445f8e4ebffde3d7b00b955aebce826e4e9568c5e4eb69e0f3be52c7b441cb7f09ee441bc01058183accde0a9473881bf09c992a86c6511319ee5af76fa80079de11ea7c8b9d0947c308345a6586a8eda5d00aa7a26346c3e2c90c1709e52ee7ca292e89e1c22b5447449ae508ba0fe2c801e3a0f6d12e22c93bd98d19ce199aa055d209431fddc46beab5db20fad6b53b93e1e723785ebc29d486fb240d6a4813683e2e71ff05b4f53eb57c068c2c35f0b0ddabd8e17b48f8477747d1d97aff5434d1f09ce1dd325dc2bb5f79523dd4185dd38d3629b6e83f76257bbbdcd6963b1edffbdf4456c6a6d2641f035d08a7ee3a7f1c046cd3be550ab93853fc689913e0e136a83ba15f948d8f229cfd6e12d19c2fddc9f17dfde4b28a7eac09043f1d4f37ddd4923151e837d7c9c9fc4dc9de1576686b50f6934474402d53439d45a015ba6558c3032571e1b3263bc7e6cad549d1050fdd49f9b5cb2024cf543b6fb706b636106b54e938f8ea664d9cbd75ff7042ed9d81546bda255d177d7335a7df06b5d0edc98c6678318f7131ed7564d5344df54802241144502eedcb057be3ca1d3ff8c65fa7487521dc9d4db49265dff8158b4ce2a1893399bcb4bbfcd2c3f7d9c2286eedcd76518026d6586f10a79e02477efd8ff93931b01210c6ad0f75d23a62f68044200597dd277cebab9b5c21c74c5cd74b63a8b6d59789f5c50cace6676c93990db2f7b4f39e00f455ac002c12367d7bfd0cb0327ef077c45382f0454255b2e11a942254608bc41b890172be38e3edd20ed028c37006aa6ed5907c78614748e53b7ee3242a7c1000552eddb67a5436fe8808d53699e9bb3c190f5b966a1fdbb1da68e8fc630d841c63f5fbe7161baa0670bf970c3e617aaac12c83ff3c1d19761b7421685f1f6c9c93eb35900e54f10744d90f4d444e06c45e2a9faef1a96f0b752d4df1df86a9503d8d99cdf8a62622184a919e19df8230e7017d5f411a89da304b67e63cc3e3d901f998f563ca9bd4c9be",
          "metadata": "7c"
        },
        "stealthAddress_honest": "ed80a9a400c7748dbfde1143791e12f89a4a3bb0",
        "stealthAddress_lie": "24ae37f14858f293822c7fcc3fb78eb93bd9b1aa"
      },
      "expect": {
        "ss_ec": "9110f8760a37d96052e3dcaf14862a147654f49f722cf213568ccef1eca2ec71",
        "ss_pq": "34cfae7f2ca3b0b9c3e06afeed554c053f6e51d875d3bd3ff0eda2086ee79f3a",
        "ss": "ae3ad7fc5a4ca198f2865aa5fcd3fd126861a3e491e262e8007848badbb47acf",
        "view_tag": "7c",
        "stealth_pk": "0254ec0d7c3715d48463a4c1f3f1fe24837ef0a6a2c53aa51d9743171c3a02f92f",
        "address": "ed80a9a400c7748dbfde1143791e12f89a4a3bb0",
        "honest": "match, with this address and ss",
        "lie": "skip"
      },
      "wrong": {
        "note": "deciding on the view tag. It matches in both, since it is a function of ss and the lie changes only stealthAddress, so such a scanner reports a payment at an address the announcement does not name. The lie is what a sender that hashed the 0x04 prefix (V3-13) announces, and its funds went to an address nobody holds a key for. Raising on it instead is a scanner denial of service (Section 2.7)"
      }
    },
    "V3-18": {
      "claim": "a 1121-byte ephemeralPubKey whose epk is not a valid compressed point is a skip, not an error",
      "given": {
        "ephemeralPubKeys": {
          "tag_0x05_compact": "05466d7fcae563e5cb09a0d1870bb580344804617879a14949cf22285f1bae3f270385e8044d17e2b96b3f50ed28c2502216322ac33f69d2ce34f0a11e9b3de339aebe98283a6010a34bdc98b0e5bbe142a38575da305066331d8d11d161f512b4b56b60fd049dfee3771473253a0310cd842c71cb7734474bfbdbbadd2b9b87c37804d8558b00d77b1f79f0fd2c94552a8d3b19fdd6a5511c4ebeea40aa839a489aec636b510bf51bf3782f24f53f752ee2db9fb4964e8379d0fa70603cb8c2c7293bc35a56b818257b65fbe6b2c98178b61d7ceb58c7e1a9100650a945c739e3603c188ba3c179823950c6d874d7fc8f8ddb7a9ee941f4a78a0f8a1eae080d4d77893aaefb0db452659b0275d171736390a1b23661c69058869a8c4d0bb46d1655858162012a057c7c067fd035d47d5d627e3cd27cd3ca021a34f8db6695c7e581ece67d898482d509e4df61dce5bbdfaac89465a9209c547b4263e9155940f8fcb1da3a4a7d25df2969f31644741a8c6fe8065d5f176214a4db8fe76bf41869b0f22e1f5cf5c34a5067b1d9f39f3ab4b0b9f6330d7cf6ec7477b53d9223fa70e4c680d49b32883d92b50c53cf9e61915437cf57eca49d6bbc88c64ccb222d4f20227cccd4f7e7c21f95ce74d6ab5dece17f600ad1715248648e4d1af6fe41a02023eb5cff871ec654756b7d156e601e82827e17dd0fe4f5357136120a810506a40f28a0b860c3ce75bf7796653327939b507043ab8be0175a9b312319818063ac40302eb42452da0b1cb9e3c2e43c49d740a03ac1b9057fb44eff830d548d12585f50dbaf7404c2dfa7f4403db8b7cee65df528f575c7f552d0632553fc6c90a3b09c1114492392c165e9b1b0a10e9556c72cde2bb23df6da784521249eec542012ec33599b97b95ff5234158a6d553b3bbae9704e630d64a66d658f74f27c8c30237e87686fb04551bb128d917305173e2788883352a0216fd8d0035d748c9b42a600073adba73f851bb5eca287ad325a3a3561769868c56e6d84fb661ed5a41649342ea342f82be528fd9bb4f492452c0a9426ed8677113ec6f1cac51233f0520425c3b27acfaa0d25a07bc2ca01115c90432ed14a1f4dda693c6e704a16bece8972d8218b62cec4f255058988b224d86f2bde4b221a3c672cb744ca8f9158a4e5c97d0c56af5dfc1c5f0191f64cb6d7ab86b14432eceb5a3ed77a8d3ea651a07c9a0cf95e631f41c2ab29191f66dd9a73271f47a455999c5fc8391550bbb346ca1bcad598a32a50cb52281156874f36de9d8ea5860d99703ea3f4907c640b47a75a285b4347845cd6c94407995f569fd8a4b12461d8236e4015ae000e2acaf2bd9f8d28377ec0d9e4cae714c481c5abae37448b3f84a291b84b4213c8fe1f6e0fdfa1a6d1a52c974f795c5947f667a8dbe162983ec0c71c0f0237e6ed8bcb7ac9e4c73b5a1ed85fd5e0fa2810c842d484d6f9dfcc8472f05683d9d1144ef6c36294bd06a019efec202fc46288eba2ade82aa3363faf32b9b027c75a7d615845cf2ec538141f1746009737600f697cc8d90c80c1e19f1ab2c08646c0e3958",
          "tag_0x04": "04466d7fcae563e5cb09a0d1870bb580344804617879a14949cf22285f1bae3f270385e8044d17e2b96b3f50ed28c2502216322ac33f69d2ce34f0a11e9b3de339aebe98283a6010a34bdc98b0e5bbe142a38575da305066331d8d11d161f512b4b56b60fd049dfee3771473253a0310cd842c71cb7734474bfbdbbadd2b9b87c37804d8558b00d77b1f79f0fd2c94552a8d3b19fdd6a5511c4ebeea40aa839a489aec636b510bf51bf3782f24f53f752ee2db9fb4964e8379d0fa70603cb8c2c7293bc35a56b818257b65fbe6b2c98178b61d7ceb58c7e1a9100650a945c739e3603c188ba3c179823950c6d874d7fc8f8ddb7a9ee941f4a78a0f8a1eae080d4d77893aaefb0db452659b0275d171736390a1b23661c69058869a8c4d0bb46d1655858162012a057c7c067fd035d47d5d627e3cd27cd3ca021a34f8db6695c7e581ece67d898482d509e4df61dce5bbdfaac89465a9209c547b4263e9155940f8fcb1da3a4a7d25df2969f31644741a8c6fe8065d5f176214a4db8fe76bf41869b0f22e1f5cf5c34a5067b1d9f39f3ab4b0b9f6330d7cf6ec7477b53d9223fa70e4c680d49b32883d92b50c53cf9e61915437cf57eca49d6bbc88c64ccb222d4f20227cccd4f7e7c21f95ce74d6ab5dece17f600ad1715248648e4d1af6fe41a02023eb5cff871ec654756b7d156e601e82827e17dd0fe4f5357136120a810506a40f28a0b860c3ce75bf7796653327939b507043ab8be0175a9b312319818063ac40302eb42452da0b1cb9e3c2e43c49d740a03ac1b9057fb44eff830d548d12585f50dbaf7404c2dfa7f4403db8b7cee65df528f575c7f552d0632553fc6c90a3b09c1114492392c165e9b1b0a10e9556c72cde2bb23df6da784521249eec542012ec33599b97b95ff5234158a6d553b3bbae9704e630d64a66d658f74f27c8c30237e87686fb04551bb128d917305173e2788883352a0216fd8d0035d748c9b42a600073adba73f851bb5eca287ad325a3a3561769868c56e6d84fb661ed5a41649342ea342f82be528fd9bb4f492452c0a9426ed8677113ec6f1cac51233f0520425c3b27acfaa0d25a07bc2ca01115c90432ed14a1f4dda693c6e704a16bece8972d8218b62cec4f255058988b224d86f2bde4b221a3c672cb744ca8f9158a4e5c97d0c56af5dfc1c5f0191f64cb6d7ab86b14432eceb5a3ed77a8d3ea651a07c9a0cf95e631f41c2ab29191f66dd9a73271f47a455999c5fc8391550bbb346ca1bcad598a32a50cb52281156874f36de9d8ea5860d99703ea3f4907c640b47a75a285b4347845cd6c94407995f569fd8a4b12461d8236e4015ae000e2acaf2bd9f8d28377ec0d9e4cae714c481c5abae37448b3f84a291b84b4213c8fe1f6e0fdfa1a6d1a52c974f795c5947f667a8dbe162983ec0c71c0f0237e6ed8bcb7ac9e4c73b5a1ed85fd5e0fa2810c842d484d6f9dfcc8472f05683d9d1144ef6c36294bd06a019efec202fc46288eba2ade82aa3363faf32b9b027c75a7d615845cf2ec538141f1746009737600f697cc8d90c80c1e19f1ab2c08646c0e3958",
          "tag_0x00": "00466d7fcae563e5cb09a0d1870bb580344804617879a14949cf22285f1bae3f270385e8044d17e2b96b3f50ed28c2502216322ac33f69d2ce34f0a11e9b3de339aebe98283a6010a34bdc98b0e5bbe142a38575da305066331d8d11d161f512b4b56b60fd049dfee3771473253a0310cd842c71cb7734474bfbdbbadd2b9b87c37804d8558b00d77b1f79f0fd2c94552a8d3b19fdd6a5511c4ebeea40aa839a489aec636b510bf51bf3782f24f53f752ee2db9fb4964e8379d0fa70603cb8c2c7293bc35a56b818257b65fbe6b2c98178b61d7ceb58c7e1a9100650a945c739e3603c188ba3c179823950c6d874d7fc8f8ddb7a9ee941f4a78a0f8a1eae080d4d77893aaefb0db452659b0275d171736390a1b23661c69058869a8c4d0bb46d1655858162012a057c7c067fd035d47d5d627e3cd27cd3ca021a34f8db6695c7e581ece67d898482d509e4df61dce5bbdfaac89465a9209c547b4263e9155940f8fcb1da3a4a7d25df2969f31644741a8c6fe8065d5f176214a4db8fe76bf41869b0f22e1f5cf5c34a5067b1d9f39f3ab4b0b9f6330d7cf6ec7477b53d9223fa70e4c680d49b32883d92b50c53cf9e61915437cf57eca49d6bbc88c64ccb222d4f20227cccd4f7e7c21f95ce74d6ab5dece17f600ad1715248648e4d1af6fe41a02023eb5cff871ec654756b7d156e601e82827e17dd0fe4f5357136120a810506a40f28a0b860c3ce75bf7796653327939b507043ab8be0175a9b312319818063ac40302eb42452da0b1cb9e3c2e43c49d740a03ac1b9057fb44eff830d548d12585f50dbaf7404c2dfa7f4403db8b7cee65df528f575c7f552d0632553fc6c90a3b09c1114492392c165e9b1b0a10e9556c72cde2bb23df6da784521249eec542012ec33599b97b95ff5234158a6d553b3bbae9704e630d64a66d658f74f27c8c30237e87686fb04551bb128d917305173e2788883352a0216fd8d0035d748c9b42a600073adba73f851bb5eca287ad325a3a3561769868c56e6d84fb661ed5a41649342ea342f82be528fd9bb4f492452c0a9426ed8677113ec6f1cac51233f0520425c3b27acfaa0d25a07bc2ca01115c90432ed14a1f4dda693c6e704a16bece8972d8218b62cec4f255058988b224d86f2bde4b221a3c672cb744ca8f9158a4e5c97d0c56af5dfc1c5f0191f64cb6d7ab86b14432eceb5a3ed77a8d3ea651a07c9a0cf95e631f41c2ab29191f66dd9a73271f47a455999c5fc8391550bbb346ca1bcad598a32a50cb52281156874f36de9d8ea5860d99703ea3f4907c640b47a75a285b4347845cd6c94407995f569fd8a4b12461d8236e4015ae000e2acaf2bd9f8d28377ec0d9e4cae714c481c5abae37448b3f84a291b84b4213c8fe1f6e0fdfa1a6d1a52c974f795c5947f667a8dbe162983ec0c71c0f0237e6ed8bcb7ac9e4c73b5a1ed85fd5e0fa2810c842d484d6f9dfcc8472f05683d9d1144ef6c36294bd06a019efec202fc46288eba2ade82aa3363faf32b9b027c75a7d615845cf2ec538141f1746009737600f697cc8d90c80c1e19f1ab2c08646c0e3958",
          "x_not_on_curve": "0200000000000000000000000000000000000000000000000000000000000000050385e8044d17e2b96b3f50ed28c2502216322ac33f69d2ce34f0a11e9b3de339aebe98283a6010a34bdc98b0e5bbe142a38575da305066331d8d11d161f512b4b56b60fd049dfee3771473253a0310cd842c71cb7734474bfbdbbadd2b9b87c37804d8558b00d77b1f79f0fd2c94552a8d3b19fdd6a5511c4ebeea40aa839a489aec636b510bf51bf3782f24f53f752ee2db9fb4964e8379d0fa70603cb8c2c7293bc35a56b818257b65fbe6b2c98178b61d7ceb58c7e1a9100650a945c739e3603c188ba3c179823950c6d874d7fc8f8ddb7a9ee941f4a78a0f8a1eae080d4d77893aaefb0db452659b0275d171736390a1b23661c69058869a8c4d0bb46d1655858162012a057c7c067fd035d47d5d627e3cd27cd3ca021a34f8db6695c7e581ece67d898482d509e4df61dce5bbdfaac89465a9209c547b4263e9155940f8fcb1da3a4a7d25df2969f31644741a8c6fe8065d5f176214a4db8fe76bf41869b0f22e1f5cf5c34a5067b1d9f39f3ab4b0b9f6330d7cf6ec7477b53d9223fa70e4c680d49b32883d92b50c53cf9e61915437cf57eca49d6bbc88c64ccb222d4f20227cccd4f7e7c21f95ce74d6ab5dece17f600ad1715248648e4d1af6fe41a02023eb5cff871ec654756b7d156e601e82827e17dd0fe4f5357136120a810506a40f28a0b860c3ce75bf7796653327939b507043ab8be0175a9b312319818063ac40302eb42452da0b1cb9e3c2e43c49d740a03ac1b9057fb44eff830d548d12585f50dbaf7404c2dfa7f4403db8b7cee65df528f575c7f552d0632553fc6c90a3b09c1114492392c165e9b1b0a10e9556c72cde2bb23df6da784521249eec542012ec33599b97b95ff5234158a6d553b3bbae9704e630d64a66d658f74f27c8c30237e87686fb04551bb128d917305173e2788883352a0216fd8d0035d748c9b42a600073adba73f851bb5eca287ad325a3a3561769868c56e6d84fb661ed5a41649342ea342f82be528fd9bb4f492452c0a9426ed8677113ec6f1cac51233f0520425c3b27acfaa0d25a07bc2ca01115c90432ed14a1f4dda693c6e704a16bece8972d8218b62cec4f255058988b224d86f2bde4b221a3c672cb744ca8f9158a4e5c97d0c56af5dfc1c5f0191f64cb6d7ab86b14432eceb5a3ed77a8d3ea651a07c9a0cf95e631f41c2ab29191f66dd9a73271f47a455999c5fc8391550bbb346ca1bcad598a32a50cb52281156874f36de9d8ea5860d99703ea3f4907c640b47a75a285b4347845cd6c94407995f569fd8a4b12461d8236e4015ae000e2acaf2bd9f8d28377ec0d9e4cae714c481c5abae37448b3f84a291b84b4213c8fe1f6e0fdfa1a6d1a52c974f795c5947f667a8dbe162983ec0c71c0f0237e6ed8bcb7ac9e4c73b5a1ed85fd5e0fa2810c842d484d6f9dfcc8472f05683d9d1144ef6c36294bd06a019efec202fc46288eba2ade82aa3363faf32b9b027c75a7d615845cf2ec538141f1746009737600f697cc8d90c80c1e19f1ab2c08646c0e3958",
          "x_p_plus_1": "02fffffffffffffffffffffffffffffffffffffffffffffffffffffffefffffc300385e8044d17e2b96b3f50ed28c2502216322ac33f69d2ce34f0a11e9b3de339aebe98283a6010a34bdc98b0e5bbe142a38575da305066331d8d11d161f512b4b56b60fd049dfee3771473253a0310cd842c71cb7734474bfbdbbadd2b9b87c37804d8558b00d77b1f79f0fd2c94552a8d3b19fdd6a5511c4ebeea40aa839a489aec636b510bf51bf3782f24f53f752ee2db9fb4964e8379d0fa70603cb8c2c7293bc35a56b818257b65fbe6b2c98178b61d7ceb58c7e1a9100650a945c739e3603c188ba3c179823950c6d874d7fc8f8ddb7a9ee941f4a78a0f8a1eae080d4d77893aaefb0db452659b0275d171736390a1b23661c69058869a8c4d0bb46d1655858162012a057c7c067fd035d47d5d627e3cd27cd3ca021a34f8db6695c7e581ece67d898482d509e4df61dce5bbdfaac89465a9209c547b4263e9155940f8fcb1da3a4a7d25df2969f31644741a8c6fe8065d5f176214a4db8fe76bf41869b0f22e1f5cf5c34a5067b1d9f39f3ab4b0b9f6330d7cf6ec7477b53d9223fa70e4c680d49b32883d92b50c53cf9e61915437cf57eca49d6bbc88c64ccb222d4f20227cccd4f7e7c21f95ce74d6ab5dece17f600ad1715248648e4d1af6fe41a02023eb5cff871ec654756b7d156e601e82827e17dd0fe4f5357136120a810506a40f28a0b860c3ce75bf7796653327939b507043ab8be0175a9b312319818063ac40302eb42452da0b1cb9e3c2e43c49d740a03ac1b9057fb44eff830d548d12585f50dbaf7404c2dfa7f4403db8b7cee65df528f575c7f552d0632553fc6c90a3b09c1114492392c165e9b1b0a10e9556c72cde2bb23df6da784521249eec542012ec33599b97b95ff5234158a6d553b3bbae9704e630d64a66d658f74f27c8c30237e87686fb04551bb128d917305173e2788883352a0216fd8d0035d748c9b42a600073adba73f851bb5eca287ad325a3a3561769868c56e6d84fb661ed5a41649342ea342f82be528fd9bb4f492452c0a9426ed8677113ec6f1cac51233f0520425c3b27acfaa0d25a07bc2ca01115c90432ed14a1f4dda693c6e704a16bece8972d8218b62cec4f255058988b224d86f2bde4b221a3c672cb744ca8f9158a4e5c97d0c56af5dfc1c5f0191f64cb6d7ab86b14432eceb5a3ed77a8d3ea651a07c9a0cf95e631f41c2ab29191f66dd9a73271f47a455999c5fc8391550bbb346ca1bcad598a32a50cb52281156874f36de9d8ea5860d99703ea3f4907c640b47a75a285b4347845cd6c94407995f569fd8a4b12461d8236e4015ae000e2acaf2bd9f8d28377ec0d9e4cae714c481c5abae37448b3f84a291b84b4213c8fe1f6e0fdfa1a6d1a52c974f795c5947f667a8dbe162983ec0c71c0f0237e6ed8bcb7ac9e4c73b5a1ed85fd5e0fa2810c842d484d6f9dfcc8472f05683d9d1144ef6c36294bd06a019efec202fc46288eba2ade82aa3363faf32b9b027c75a7d615845cf2ec538141f1746009737600f697cc8d90c80c1e19f1ab2c08646c0e3958"
        },
        "honest_ephemeralPubKey": "02466d7fcae563e5cb09a0d1870bb580344804617879a14949cf22285f1bae3f270385e8044d17e2b96b3f50ed28c2502216322ac33f69d2ce34f0a11e9b3de339aebe98283a6010a34bdc98b0e5bbe142a38575da305066331d8d11d161f512b4b56b60fd049dfee3771473253a0310cd842c71cb7734474bfbdbbadd2b9b87c37804d8558b00d77b1f79f0fd2c94552a8d3b19fdd6a5511c4ebeea40aa839a489aec636b510bf51bf3782f24f53f752ee2db9fb4964e8379d0fa70603cb8c2c7293bc35a56b818257b65fbe6b2c98178b61d7ceb58c7e1a9100650a945c739e3603c188ba3c179823950c6d874d7fc8f8ddb7a9ee941f4a78a0f8a1eae080d4d77893aaefb0db452659b0275d171736390a1b23661c69058869a8c4d0bb46d1655858162012a057c7c067fd035d47d5d627e3cd27cd3ca021a34f8db6695c7e581ece67d898482d509e4df61dce5bbdfaac89465a9209c547b4263e9155940f8fcb1da3a4a7d25df2969f31644741a8c6fe8065d5f176214a4db8fe76bf41869b0f22e1f5cf5c34a5067b1d9f39f3ab4b0b9f6330d7cf6ec7477b53d9223fa70e4c680d49b32883d92b50c53cf9e61915437cf57eca49d6bbc88c64ccb222d4f20227cccd4f7e7c21f95ce74d6ab5dece17f600ad1715248648e4d1af6fe41a02023eb5cff871ec654756b7d156e601e82827e17dd0fe4f5357136120a810506a40f28a0b860c3ce75bf7796653327939b507043ab8be0175a9b312319818063ac40302eb42452da0b1cb9e3c2e43c49d740a03ac1b9057fb44eff830d548d12585f50dbaf7404c2dfa7f4403db8b7cee65df528f575c7f552d0632553fc6c90a3b09c1114492392c165e9b1b0a10e9556c72cde2bb23df6da784521249eec542012ec33599b97b95ff5234158a6d553b3bbae9704e630d64a66d658f74f27c8c30237e87686fb04551bb128d917305173e2788883352a0216fd8d0035d748c9b42a600073adba73f851bb5eca287ad325a3a3561769868c56e6d84fb661ed5a41649342ea342f82be528fd9bb4f492452c0a9426ed8677113ec6f1cac51233f0520425c3b27acfaa0d25a07bc2ca01115c90432ed14a1f4dda693c6e704a16bece8972d8218b62cec4f255058988b224d86f2bde4b221a3c672cb744ca8f9158a4e5c97d0c56af5dfc1c5f0191f64cb6d7ab86b14432eceb5a3ed77a8d3ea651a07c9a0cf95e631f41c2ab29191f66dd9a73271f47a455999c5fc8391550bbb346ca1bcad598a32a50cb52281156874f36de9d8ea5860d99703ea3f4907c640b47a75a285b4347845cd6c94407995f569fd8a4b12461d8236e4015ae000e2acaf2bd9f8d28377ec0d9e4cae714c481c5abae37448b3f84a291b84b4213c8fe1f6e0fdfa1a6d1a52c974f795c5947f667a8dbe162983ec0c71c0f0237e6ed8bcb7ac9e4c73b5a1ed85fd5e0fa2810c842d484d6f9dfcc8472f05683d9d1144ef6c36294bd06a019efec202fc46288eba2ade82aa3363faf32b9b027c75a7d615845cf2ec538141f1746009737600f697cc8d90c80c1e19f1ab2c08646c0e3958",
        "metadata": "02",
        "fields_are": "each epk followed by V3-08's ct; metadata is V3-08's view tag"
      },
      "expect": {
        "outcome": "skip for every ephemeralPubKeys entry; the honest one is processed"
      },
      "wrong": {
        "note": "raising, or propagating the curve library's exception. The length check passes, so the failure surfaces in point decoding, and an error there is a scanner denial of service (Section 2.7). Accepting a non-canonical encoding is the other mistake: a decoder that canonicalises 0x05 to 0x03, or reduces x mod p and so reads x = p + 1 as the point with x = 1, gives one point several encodings"
      }
    },
    "V3-19": {
      "claim": "an ek that fails FIPS 203's encapsulation key check is an error, and no announcement is made to it",
      "given": {
        "acvp_encapsulationKeyCheck_tcId_invalid": 137,
        "acvp_reason_invalid": "noisy linear system values too large",
        "acvp_encapsulationKeyCheck_tcId_valid": 136,
        "meta_address_invalid_ek": "034f355bdcb7cc0af728ef3cceb9615d90684bb5b2ca5f859ab0f0b704075871aa023c72addb4fdf09af94f0c94d7fe92a386a7e70cf8a1d85916386bb2535c7b1b1026dbca9319a20dcbd8aa0ae721344710493091c20de43273a821043b0ca062a37af3a4dbe33b503d01375ba11f06a4f10c7a961746f68456b013449f3e416d0e63a40740a1123c5c1051ffdc8ac8bf9c5ea1246ca16a9f7fc1c8e750cd0c40f18584a473a0719591f1040c2d7db72add962ac278a96b4836c1b6f2c33b6acc30e4865487b1cb2ea609cef60cd7715715ecc1d0a541a7286962c26adbad87f216c5c6073c579153371a767172784f5eabae70773102b0728d422b1a8b51e09ac56f8a11f4b40f70b9d7e7380130c977563c6f50ba07641c3633363d102a11d3956cb363ecdfac9e82467715319de73bd82931803b09b9e52315f3b9e90d634e7b43a097b020f20613fe42ad941a88e7461d831cce093cdb88331e8283cc0e18be0c40f89523ebf09ad35c5c4c44708d4e028e6269bbd7721c8f5c2dfc5570f6cb9721b6d9bc303d7c525646539a809200bf3cc30f902eac04471fb79744cb82beacc31d97eec934caa13bd607717c811241e4379762464713630d4fcadc9e890a6a96450a786b5849108602951960ac9da84f10a97b04b66e7304cf234804edaab8c9355bf05af2c6346a694c87a90013779904e183d8cf7bda6950b58fa4a78195bcc7659bb040e6a642741b90e4e27292340a7224b2cd6d53f21311a497516030606eb206ee9625fb0db621ba10efc604f2f696d11e667efb24319193e16c45e317ba0e7120a0012cdd33a62356135f3e18af837ca868294e7a92f2670492c0996538360b375294e47313af78418aa262c96cc2986332f7107afd50c53443c97161858363bb821625ba209dd40aac3bc48f4c8069a2535040436f799421da205f5b729f31a7e1469883d07bac1b62a6cbc7811646b51134cf27b307fa3a61cf9cc0b6393c0859f91abc734ec9aa573375674134de65bfedb39f5e546cbf0cd98fc5c16b36408ec058a5142035abae46594bb2a5fb1bacfb648515b6672ad04a88239bcfe4c4dcab768ab9294cda37716e62fc08c4e0c1aba58565919e19b17b795f3a37a3475a499131fee57b7aaf8b7fae64207d4b2e32632e4632920278edb864d61d4b1e8c62a2bd42dc980475e1ccf9061c64b573bad7ba2f799c5a37054ef3586be94056a49712ce94743c3236937053974c9b8e274f6d7a0b0d427f565a37c9aacb0242e7c2c86d01630c8627373ea951325476c1a617a845749582e93c724b4c032b8106fe4f101d99baa5e4b9f3dfa8205279c2927834b6412b73c84e9f3a5e398aa5f0456de89a10f381d840c19ef92b4ffd96da90566c51ab5e8eb7adc5444a76b59a61cbfde1b889e744d1e389b90eb5bf1888e7c42accf28c5c34a63e0e36e64e99636b07ae6255f1bf980a887cd65f2467eab30071533f4d0b1f454811c3303176a9e8d4140f57b538d89b794d7c069050637f9a7ed6badb2a910064b21cdda813fd4cf2cdccdf58cbad33c3777a930eb9aa4a2bb1cd22c7b3ba17b6905a8fe96875de00c34757202581823250133915acc659559215e5490263975225f29ac8aca24cc6888a4d77927687a69344a57ac819e7780a7aba782ba0af0886826d20040b537719c87d99aa4b4601acfa7cfa61bba07ecc9c3a75ce3b01e0a163f1b8ed4d9ad2ae714111a25290cdd167d42f6f56b767583f78cac",
        "meta_address_valid_ek": "034f355bdcb7cc0af728ef3cceb9615d90684bb5b2ca5f859ab0f0b704075871aa023c72addb4fdf09af94f0c94d7fe92a386a7e70cf8a1d85916386bb2535c7b1b10616cac3a41e537c5b0ae0a6113215a0aa8d2b12855107232d532c4a494f0661c3ac0a417db950f0f38b47912eff36615f2311cb3438b825426ee20d2624759ae95d54155eb11cb41ac81ead028c1ebaa6297a208e9c0418f3954bc981e84080967145a67922764964bfa413c359c398f12889c0429477647b53be55268e40ea76fae5aa92720083ec7117c2b14d4a986d9948af818e67144148dcc85f5704c3924b6640365f5076efb1aeec692dd0c57ee2493df0cb3ac7341cad495b71553487a868d7e3a26eba81b93c1867840e7d6064d77b20f08303e3533466446bec697996b2ca973720e50a3b09daac1cd06d5b73077cd803181692abf80a8ffc415f5089ceab51bdd60375955fa46caf282b9e240b3faa998b5e84a9f5d935214c5de1a97bf45619cf632ed9ea0ed2e09c6151aa211aa381b57f1537b8802c41f3e5085a4a6d191386a6f6a6506105021c878c4803728228071c3b11e571db15cf709518c79286d835b462eb7ccbb00e420142dd44c7ceb201df83343ba28357b9313ffbc21523182c6443c2dab19f0903c14cc3816787a15c06076a8535536b15e44a00b8b76a0bb2597959c503b1b7753837c9a15a415636f1012404c61e2979f2e3b26cc8294de779bdfb3c985970f0d64343f0104061c23844b0b81b7f26c895587164a59469087b80f373a882002c8c73b901d61e529682abc86f87a33e6af985c0c43adfa0364f8290c2a923cf7b60d072af8c94495f439520eb81e4576485002415079ab705cb4c5b3f652b605f915daba81d71ec667b03c0a7f77f3c7ab188641f3a334c3e8030977bb52fd4c54f39baa4153e49c832f836940eb3caeae0bdae634241718671d43e57ca24cbe6081ed28fcb180a419297138a4e90a49269a502a940b3f2cb5efe1261f17b376f839805951413e3100c84c17a576f731c6ffdda02c69652ffa40e324804c916cf3d511905626a1ad4cf25b52cac5b0f919bbf19dc37431365f15c6b523540f81321f8a9c02109cafbc4b7e0c19fc89b9080aac952306f6632866efa5cb0d0c53c49921f5996516a7bd95149890a4fd7bb7382033dfd2b5b5d010d859cc79c9a68e41855744832ce2b5916f301b7a5a627e3858b9512cbe4afbd9049a229972520673efc9adbea700334725f7cc256fc0b74eaaf0cf1bad802bfd57a737b52748c009f46db4a74611da8f8a549d6baaec6ac51a14422c1834d199e30d210fde062402b7ed2a46de6a54075d1c15e8082a11cce4fe19289a85a309a371f620398e169c75b7e4405623a5901a7f94de7b1c240713688e36ed81c971bcb50a5e17b053b37a2d79e724cbbc2eb856fb66b997cc94d8b17c4a9729338022e1636e63ba7dd66ba288793ac72bf1ef36cb9439b19f9a2861340db711909eba6dd4c2219347cd68435c6b634101c4f52ca08dc3c939d509fc5382dd5512210609d51246f2d832dec00bdf4c1ad89b45333e14403ab5a2c51ccc353427eec746284b8acb963ac765290417e7cf9ce9849940d1189ad55a12e3c90de718f1fa0621f7389360b2f5b6923f841b0d58a9a5ca0cf8af4be7bb689e2039141fa7e67938630b55bd65c0630f1405e6c760d890ec64752dba36b23f483770ba563b368a916cfda68fda5d35991b632af5c8d8f2caca112f926b6",
        "meta_addresses_are": "V3-09's spending_pk and viewing_pk_ec, then the ek of each ACVP case"
      },
      "expect": {
        "first_coefficient_at_least_q": {
          "index": 0,
          "value": 3330,
          "q": 3329
        },
        "outcome": "the invalid one is an error, at decode or at encapsulation, and no announcement is made; the valid one encapsulates"
      },
      "wrong": {
        "note": "encapsulating anyway. A library that reduces each coefficient mod q on decoding encapsulates to a different key from the one registered, ss binds the registered bytes, and no decapsulation key exists for either: the payment goes to a stealth address nobody can find"
      }
    }
  }
}