Merge branch 'devel'

5 files changed, 817 insertions, 54 deletions

diff --git a/docs/CURVES.md b/docs/CURVES.md
index 4a80d49..a417035 100644
--- a/docs/CURVES.md
+++ b/docs/CURVES.md
@@ -1,47 +1,95 @@
 # Curves
+ECTester contains a collection of elliptic curve/point parameters, these parameters either come from standards or
+were generated manually or using [ecgen](https://github.com/J08nY/ecgen).
 
-## SECG
+These parameters can be found in the [cz.crcs.ectester.data](/src/cz/ectester/data/) package.
+
+
+## Standard
+
+### SECG
 SEC 2: Recommended Elliptic Curve Domain Parameters version 2.0  January 27, 2010
 
 [Source](http://www.secg.org/sec2-v2.pdf)
 
-## NIST
+### NIST
 RECOMMENDED ELLIPTIC CURVES FOR FEDERAL GOVERNMENT USE  July 1999
 
 [Source](http://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.186-4.pdf)
 
-## x962
+### x962
 ANSI X9.62 example curves.
 
-## Brainpool
+### Brainpool
 ECC Brainpool Standard Curves and Curve Generation v. 1.0  19.10.2005
 
 [Source](http://www.ecc-brainpool.org/download/Domain-parameters.pdf)
 
-## anssi
+### anssi
 Agence nationale de la sécurité des systèmes d'information: Publication d'un paramétrage de courbe elliptique visant des applications de passeport électronique et de l'administration électronique française. 21 November 2011
 
-## GOST
+### GOST
 GOST R 34.10-2001: RFC5832 curves.
 
 [Source](https://tools.ietf.org/html/rfc5832)
 
-## anomalous
+### Barreto-Naehrig
+Barreto-Naehrig curves from: A Family of Implementation-Friendly BN Elliptic Curves
+
+[Source](https://eprint.iacr.org/2010/429.pdf)
+
+### Other
+An assortment of some other curves. 
+Montgomery curves transformed into short Weierstrass form from <https://eprint.iacr.org/2013/647.pdf>
+
+Curve25519 transformed into short Weierstrass form.
+
+
+## Generated
+
+### anomalous
 These prime field curves have the same order as the field order, and are susceptible to attacks reducing ECDLP over a multiplicative group of the curve, to DLP over an additive group of the underlying field, which is easy (linear time).
 
 Some of these are from Atsuko Miyaji's [paper](https://dspace.jaist.ac.jp/dspace/bitstream/10119/4464/1/73-61.pdf), others were generated using [ecgen](htps://github.com/J08nY/ecgen).
 
-## invalid
+### invalid
 This category contains pre-generated invalid curves for a large subset of NIST, SECG and Brainpool curves. Invalid curves for a given curve, are short Weierstrass curves with all parameters equal to the given curve except the `b` parameter. These curves can be used to [attack some implementations](https://www.nds.rub.de/media/nds/veroeffentlichungen/2015/09/14/main-full.pdf).
 
-Generated using [ecgen](https://github.com/J08nY/ecgen)
+Generated using [ecgen](https://github.com/J08nY/ecgen).
 
-## composite
+### composite
 Contains curves of composite order, with small order points.
 
-Generated using [ecgen](https://github.com/J08nY/ecgen)
+Generated using [ecgen](https://github.com/J08nY/ecgen).
+
+### wrong
+Contains parameters that are not elliptic curves(over Fp and F2m), such as `p` parameter that is not prime or an irreducible polynomial that is not irreducible.
+
+Generated manually.
+
+### twist
+Contains pre-generated points on twists of known named curves from NIST, SECG.
+These points can be used to attack some implementations.
+
+Generated using [ecgen](https://github.com/J08nY/ecgen).
+
+### degenerate
+Contains pre-generated points on the line `Y: x = 0`. These points are constructed from elements of prime
+order in the multiplicative group F_p given a curve over it.
+
+Generate manually using [PARI/GP](http://pari.math.u-bordeaux.fr/).
+
+### cofactor
+Contains curves that are composite order, with points not on the subgroup generated by the generator.
+
+Generated using [ecgen](https://github.com/J08nY/ecgen).
+
+### supersingular
+Contains supersingular curves, over F_p with order equal to p + 1. These have embedding degree equal to 2.
+
+Generated using [ecgen](https://github.com/J08nY/ecgen).
 
-## wrong
-Contains parameters that are not elliptic curves(over Fp and F2m), such as `p` parameter that is not prime, irreducible polynomial that is not irreducible and similar.
+## Other
 
-Generated manually.
\ No newline at end of file
+### Wycheproof
+Contains some test vectors from the [google/Wycheproof](https://github.com/google/wycheproof) project.
\ No newline at end of file
diff --git a/docs/FORMAT.md b/docs/FORMAT.md
index 849a62c..bde2543 100644
--- a/docs/FORMAT.md
+++ b/docs/FORMAT.md
@@ -56,4 +56,8 @@ Output of the `-dsa/--ecdsa` option.
 
 ## Test runs
 By default test runs are output in a human readable format, however YAML and XML is also supported and can be selected
-by using the `-o/--output` option.
+by using the `--format` option. Also, prefixing the output file name when using the `-o/--output` option allows to output 
+the same test run in different formats to different files.
+
+For example:
+`--format yaml -o default_output.yaml -o xml:output_file.xml -o text:readable_text_file.txt `
diff --git a/docs/IMPLEMENTATIONS.md b/docs/IMPLEMENTATIONS.md
new file mode 100644
index 0000000..b4a4ea8
--- /dev/null
+++ b/docs/IMPLEMENTATIONS.md
@@ -0,0 +1,552 @@
+# Implementations
+
+This document contains information about possible implementation choices and algorithms when implementing elliptic curve cryptography. It is mainly concerned with curve models, coordinate systems, addition formulas and scalar multiplication algorithms. Also, only curves over \( \mathbb{F}_p \) are analyzed.
+
+---
+
+## Curve models
+
+### Weierstrass (full)
+
+#### Affine
+$$ y^2 + a_1xy + a_3y = x^3 + a_2x^2 + a_4x + a_6 $$
+
+#### Projective
+$$ Y^2Z + a_1XYZ + a_3YZ^2 = X^3 + a_2X^2Z + a_4XZ^2 + a_6Z^3 $$
+
+
+### Weierstrass (short)
+
+[EFD entry](https://www.hyperelliptic.org/EFD/g1p/auto-shortw.html)
+
+    toweierstrass weierx = x
+    toweierstrass weiery = y
+    a0 = 1
+    a1 = 0
+    a2 = 0
+    a3 = 0
+    a4 = a
+    a6 = b
+    fromweierstrass x = weierx
+    fromweierstrass y = weiery
+
+#### Affine
+$$ y^2 = x^3 + a x + b $$
+
+#### Projective
+$$ Y^2Z = X^3 + aXZ^2 + bZ^3 $$
+
+#### Jacobian
+$$ Y^2 = X^3 + aXZ^4 + bZ^6 $$
+
+
+### Montgomery
+
+[EFD entry](https://www.hyperelliptic.org/EFD/g1p/auto-montgom.html)
+
+    toweierstrass weierx = x
+    toweierstrass weiery = y
+    a0 = b
+    a1 = 0
+    a2 = a
+    a3 = 0
+    a4 = 1
+    a6 = 0
+    fromweierstrass x = weierx
+    fromweierstrass y = weiery
+
+#### Affine
+$$ By^2 = x^3 + Ax^2 + x $$
+
+
+### Edwards
+
+[EFD entry](https://www.hyperelliptic.org/EFD/g1p/auto-edwards.html)
+
+    toweierstrass u = (c+y)/(c-y)
+    toweierstrass v = 2 c (c+y)/(x(c-y))
+    a0 = 1/(1-d c^4)
+    a1 = 0
+    a2 = 4/(1-d c^4)-2
+    a3 = 0
+    a4 = 1
+    a6 = 0
+    fromweierstrass x = 2 c u/v
+    fromweierstrass y = c(u-1)/(u+1)
+
+#### Affine
+$$ x^2 + y^2 = c^2 (1 + dx^2y^2) $$
+
+
+### Twisted Edwards
+
+[EFD entry](https://www.hyperelliptic.org/EFD/g1p/auto-twisted.html)
+
+    toweierstrass u = (1+y)/(1-y)
+    toweierstrass v = 2 (1+y)/(x(1-y))
+    a0 = 1/(a-d)
+    a1 = 0
+    a2 = 4 a/(a-d)-2
+    a3 = 0
+    a4 = 1
+    a6 = 0
+    fromweierstrass x = 2 u/v
+    fromweierstrass y = (u-1)/(u+1)
+
+#### Affine
+$$ ax^2 + y^2=1 + dx^2y^2 $$
+
+
+### Hessian
+
+[EFD entry](https://www.hyperelliptic.org/EFD/g1p/auto-hessian.html)
+
+    toweierstrass u = 12(d^3-1)/(d+x+y)-9 d^2
+    toweierstrass v = 36(y-x)(d^3-1)/(d+x+y)
+    a0 = 1
+    a1 = 0
+    a2 = 0
+    a3 = 0
+    a4 = -27 d(d^3+8)
+    a6 = 54(d^6-20 d^3-8)
+    fromweierstrass x = (36(d^3-1)-v)/(6(u+9 d^2))-d/2
+    fromweierstrass y = (v+36(d^3-1))/(6(u+9 d^2))-d/2
+
+#### Affine
+$$ x^3+y^3+1=3dxy $$
+
+#### Projective
+$$ X^3 + Y^3 + Z^3 = 3dXYZ $$
+
+
+---
+
+## Coordinates
+
+### Affine
+
+$$ [x, y] \in \mathbb{K}^2 $$
+
+*(Weierstrass)* infinity is special cased, sometimes represented as \( [0] \).
+
+*(Weierstrass)* negation: \(-[x, y] = [x, -y] \)
+
+ - To Projective: \( [x, y] \rightarrow (x : y : 1) \)
+ - To Jacobian: \( [x, y] \rightarrow (x : y : 1) \)
+ - To Chudnovsky: \( [x, y] \rightarrow (x : y : 1 : 1 : 1) \)
+
+### Projective
+\begin{align*}
+[X, Y, Z] &\in \mathbb{K}^3 \\
+[X_1, Y_1, Z_1] &\sim [X_2, Y_2, Z_2] \\
+\text{if}\ X_1 &= λ X_2, \\
+   Y_1 &= λ Y_2, \\
+   Z_1 &= λ Z_2 \\
+\text{for some}\ λ &\in \mathbb{K}^* \\
+(X : Y : Z) &= \{(λ X, λ Y, λ Z) | λ \in \mathbb{K}^* \}
+\end{align*}
+
+*(Weierstrass)* infinity is \((0 : 1 : 0)\).
+
+*(Weierstrass)* negation: \( -(X : Y : Z) = (X : -Y : Z) \)
+
+ - To Affine: \( (X : Y : Z) \rightarrow [X/Z, Y/Z] \)
+ - To Jacobian: \( (X : Y : Z) \rightarrow (X/Z : Y/Z : 1) \) ?
+ - To Chudnovsky: \( (X : Y : Z) \rightarrow (X/Z : Y/Z : 1 : 1 : 1) \) ?
+
+### Jacobian
+\begin{align*}
+[X, Y, Z] &\in \mathbb{K}^3 \\
+[X_1, Y_1, Z_1] &\sim [X_2, Y_2, Z_2] \\
+\text{if}\ X_1 &= λ^2 X_2, \\
+   Y_1 &= λ^3 Y_2, \\
+   Z_1 &= λ Z_2 \\
+\text{for some}\ λ &\in \mathbb{K}^* \\
+(X : Y : Z) &= \{(λ^2 X, λ^3 Y, λ Z) | λ \in \mathbb{K}^* \}
+\end{align*}
+
+*(Weierstrass)* infinity is \( (1 : 1 : 0) \).
+
+*(Weierstrass)* negation: \( -(X : Y : Z) = (X : -Y : Z) \)
+
+ - To Affine: \( (X : Y : Z) \rightarrow [X/Z^2, Y/Z^3] \)
+ - To Projective: \( (X : Y : Z) \rightarrow (X/Z^2 : Y/Z^3 : 1) \) ?
+ - To Chudnovsky: \( (X : Y : Z) \rightarrow (X : Y : Z : Z^2 : Z^3) \)
+
+### Chudnovsky
+\begin{align*}
+[X, Y, Z, Z^2, Z^3] &\in \mathbb{K}^5 \\
+(X : Y : Z : Z^2 : Z^3 ) &= \{(λ^2 X, λ^3 Y, λ Z, λ^2 Z^2, λ^3 Z^3) | λ \in \mathbb{K}^* \}
+\end{align*}
+
+*(Weierstrass)* infinity is \( (1 : 1 : 0 : 0 : 0) \). ?
+
+*(Weierstrass)* negation: \( -(X : Y : Z : Z^2 : Z^3) = (X : -Y : Z : Z^2 : Z^3) \)
+
+ - To Affine: \( (X : Y : Z : Z^2 : Z^3) \rightarrow [X/Z^2, Y/Z^3] \)
+ - To Projective: \( (X : Y : Z : Z^2 : Z^3) \rightarrow (X/Z^2 : Y/Z^3 : 1) \) ?
+ - To Jacobian: \( (X : Y : Z : Z^2 : Z^3) \rightarrow (X : Y : Z) \)
+
+
+---
+
+## Formulas
+
+ - Addition
+ - Doubling
+ - Tripling
+ - Differential addition
+ - Differential addition and doubling
+ - Scaling
+
+See EFD[^3].
+
+---
+
+## Scalar multiplication
+
+See TAOCP volume 2, section 4.6.3 for introduction to multiplication/exponentiation and addition/multiplication chains.[^5]
+
+Scalar multiplication on elliptic curves is very similar to usual multiplication/exponentiation in general additive/multiplicative groups, respectively, with some additional structure:
+
+ - \(A + B\) when \(A \ne B\) might be a different operation from \(A + A = [2]A\), and also sometimes takes different time.
+ - negation \(-A\) is easy/fast.
+ - \(0\) sometimes has a special representation and thus requires special casing.
+ - sometimes, there exists a fast operation of \(\phi: E(\mathbb{F}_p) \rightarrow E(\mathbb{F}_p) \) with \( \phi(P) = [k]P \) for some \(k \in \mathbb{K}\) computable using some endomorphism on the curve.
+
+Some links:
+
+ - [wiki/Addition_chain](https://en.wikipedia.org/wiki/Addition_chain)
+ - [wiki/Addition-subtraction_chain](https://en.wikipedia.org/wiki/Addition-subtraction_chain)
+ - [wiki/Exponentiation_by_squaring](https://en.wikipedia.org/wiki/Exponentiation_by_squaring)
+ - [wiki/Addition-chain_exponentiation](https://en.wikipedia.org/wiki/Addition-chain_exponentiation)
+
+We define:
+
+ - \( \lambda(k) = \lfloor \log_2 k \rfloor \) , the size of k
+ - \( k_i \) , the *i*-th bit of *k*
+ - \( \nu(k) = \vert \{ i \vert 0 \le i \le \lambda(k), k_i = 1\} \vert \) , the number of nonzero bits in *k*
+ - \( l(k) \) , the length of NAF of *k*
+ - \( \sigma(k) = \vert \{ i \vert 0 \le i \le l(k), NAF(k)_i \ne 0 \} \vert \) , the number of nonzero values in the NAF of *k*
+ - \( C_2 \) , the cost of doubling a point
+ - \( C_+ \) , the cost of point addition
+ - \( C_{algo}(k) \) , the cost of scalar multiplication by *k* of the algorithm *algo*
+ - *Addition chain* of *n*, is a sequence of integers:
+\( 1 = a_0, a_1, \ldots, a_r = n\),
+where \(a_i = a_j + a_k\) for some \( k \le j < i, \forall i \in \{ 1, 2, \ldots, r \} \)
+ - *Addition-subtraction chain* of *n*, is a sequence of integers:
+\( 1 = a_0, a_1, \ldots, a_r = n\),
+where \(a_i = \pm a_j \pm a_k\) for some \( k \le j < i, \forall i \in \{ 1, 2, \ldots, r \} \)
+ - *Addition sequence* for \( r_1, r_2, \ldots, r_t \) is an addition chain: \( 1 = a_1, a_2, \ldots, a_l \) which contains \( r_1, r_2, \ldots, r_t \). Useful when operating with one element and many powers \( g^{r_1}, g^{r_2}, \ldots \)
+ - *Vector addition chain* for \(r \in \mathbb{N}^t \) is a sequence of elements \( v_i \) of \( \mathbb{N}^t \) such that \( v_i = e_i \) for \( 1 \le i \le t \) and  \( v_i = v_j + v_k \) for \(j \le k < i \). Useful when powering many elements to many powers \( g_1^{r_1}, g_2^{r_2}, \ldots \)
+
+### Double and Add (binary exponentiation)
+
+Uses binary addition chain.
+
+<u>Algorithm 3.26</u> (right-to-left) in GECC[^1]
+
+    INPUT: k = (k_{t-1}, ..., k_1, k_0)_2, P ∈ E(F_q).
+    OUTPUT: [k]P.
+    1. Q ← ∞.
+    2. For i from t - 1 downto 0 do
+    2.1 If k_i = 1 then Q ← Q + P.
+    2.2 P ← 2P.
+    3. Return(Q).
+
+<u>Algorithm 3.27</u> (left-to-right) in GECC[^1]
+
+    INPUT: k = (k_{t-1}, ..., k_1, k_0)_2, P ∈ E(F_q).
+    OUTPUT: [k]P.
+    1. Q ← ∞.
+    2. For i from t - 1 downto 0 do
+    2.1 Q ← 2Q.
+    2.2 If k_i = 1 then Q ← Q + P.
+    3. Return(Q).
+
+Cost: \( C_{binexp}(k) = \lambda(k)C_2 + (\nu(k) - k_0)C_+\)[^7]
+
+### Double and Add Always (binary exponentiation - constant time)
+
+Uses binary addition chain, but does all the additions/multiplications.
+
+(right-to-left)
+
+    INPUT: k = (k_{t-1}, ..., k_1, k_0)_2, P ∈ E(F_q).
+    OUTPUT: [k]P.
+    1. Q ← ∞.
+    2. For i from t - 1 downto 0 do
+    2.1 If k_i = 1 then Q ← Q + P else Dummy ← Q + P.
+    2.2 P ← 2P.
+    3. Return(Q).
+
+(left-to-right)
+
+    INPUT: k = (k_{t-1}, ..., k_1, k_0)_2, P ∈ E(F_q).
+    OUTPUT: [k]P.
+    1. Q ← ∞.
+    2. For i from t - 1 downto 0 do
+    2.1 Q ← 2Q.
+    2.2 If k_i = 1 then Q ← Q + P else Dummy ← Q + P.
+    3. Return(Q).
+
+Cost: \( C_{const\_binexp}(k) = \lambda(k) (C_2 + C_+) \) ?
+
+
+### Binary NAF multiplication (signed binary exponentiation)
+
+**Definition 3.28**[^1] A *non-adjacent form (NAF)* of a positive integer *k* is an expression \( k = \Sigma_{i=0}^{l - 1} k_i 2^i \) where \(k_i \in \{0, ±1\}, k_{l−1} \ne 0\), and no two consecutive digits \( k_i \) are nonzero. The length of the NAF is *l*.
+
+<u>Algorithm 3.30</u> Computing the NAF of a positive integer[^1]
+
+    INPUT: A positive integer k.
+    OUTPUT: NAF(k).
+    1. i ← 0.
+    2. While k ≥ 1 do
+    2.1 If k is odd then:
+            k_i ← 2 − (k mod 4), k ← k − k_i ;
+    2.2 Else:
+            k_i ← 0.
+    2.3 k ← k/2, i ← i + 1.
+    3. Return(k_{i−1}, k_{i−2}, ..., k_1, k_0).
+
+<u>Algorithm 3.31</u> Binary NAF multiplication (left-to-right)[^1]
+
+    INPUT: Positive integer k, P ∈ E(F_q).
+    OUTPUT: [k]P.
+    1. Use Algorithm 3.30 to compute NAF(k).
+    2. Q ← ∞.
+    3. For i from l - 1 downto 0 do
+    3.1 Q ← 2Q.
+    3.2 If k_i = 1 then Q ← Q + P.
+    3.3 If k_i = -1 then Q ← Q - P.
+    4. Return(Q).
+
+Can be made constant time.
+
+Cost: \( C_{bin\_NAF} = l(k)C_2 + \sigma(k)C_+ + \text{NAF computation cost}\) ?
+
+### \(m\)-ary method
+
+Like binary double-and-add but uses a different base *m*.[^6]
+
+    INPUT: k = (k_{t-1}, ..., k_1, k_0)_m, P ∈ E(F_q).
+    OUTPUT: [k]P
+    1. Compute P_i = [i]P for i ∈ {1, 2, ..., m - 1}.
+    2. Q ← ∞.
+    3. For i from l downto 0 do
+    3.1 Q ← [m]Q.
+    3.2 Q ← Q + P_{k_i}.
+    4. Return(Q).
+
+### \( 2^r \) method
+
+Like \(m\)-ary method, with \( m = 2^r \), means that `[m]Q` is doable with only doubling.[^6]
+
+### Sliding window
+
+<u>Algorithm 13.6</u> Sliding window in HEHCC[^2]
+
+    INPUT: Window width w, k = (k_{t-1}, ..., k_1, k_0)_2, P ∈ E(F_q).
+    OUTPUT: [k]P
+    1. Compute P_i = [i]P for i ∈ {3, 5, ..., 2^w - 1}. //precomputation for fixed P
+    2. Q ← ∞, i ← t - 1.
+    3. While i ≥ 0 do
+    3.1 If k_i = 0 then:
+            Q ← [2]Q, i ← i - 1.
+    3.2 Else:
+    3.2.1   s ← max(i - k + 1, 0).
+    3.2.2   While k_s = 0 do
+                s ← s + 1.
+    3.2.3   For h from 1 to i - s + 1 do
+                Q ← [2]Q.
+    3.2.4   u ← (k_i, ..., k_s)_2.
+    3.2.5   Q ← P_u.                // u is odd.
+    3.2.6   i ← s - 1.
+    4. Return(Q).
+
+<u>Algorithm 3.38</u> Sliding window with NAF(signed sliding window) in GECC[^1]
+
+    INPUT: Window width w, positive integer k, P ∈ E(F_q).
+    OUTPUT: [k]P.
+    1. Use Algorithm 3.30 to compute NAF(k).
+    2. Compute P_i = [i]P for i ∈ {1, 3, ..., 2(2^w - (-1)^w)/3 - 1}. //precomputation for fixed P
+    3. Q ← ∞, i ← l - 1.
+    4. While i ≥ 0 do
+    4.1 If k_i = 0 then:
+            t ← 1, u ← 0.
+    4.2 Else:
+            find the largest t ≤ w such that u ← (k_i , ..., k_{i-t+1}) is odd.
+    4.3 Q ← [2^t]Q.
+    4.4 If u > 0 then:
+            Q ← Q + P_u.
+    4.5 Else:
+            if u < 0 then Q ← Q - P_{-u}.
+    4.6 i ← i - t.
+    5. Return(Q).
+
+### Window NAF multiplication
+
+**Definition 3.32**[^1] Let \( w \ge 2 \) be a positive integer. A *width-w NAF* of a positive integer *k* is an expression \( k = \Sigma_{i=0}^{l - 1} k_i 2^i \) where each nonzero coefficient \( k_i \) is odd, \( \vert k_i \vert < 2^{w - 1}, k_{l-1} \ne 0 \), and at most one of any *w* consecutive digits is nonzero. The length of the width-w NAF is *l*.
+
+
+<u>Algorithm 3.35</u> Computing the width-w NAF of a positive integer[^1]
+
+    INPUT : Window width w, positive integer k.
+    OUTPUT : NAF-w(k).
+    1. i ← 0.
+    2. While k ≥ 1 do
+    2.1 If k is odd then:
+            k_i ← k mods 2^w , k ← k − k_i; // k mods 2^w is an integer u, -2^{w-1} ≤ u < 2^{w-1}, u ≡ k mod 2^w
+    2.2 Else:
+            k_i ← 0.
+    2.3 k ← k/2, i ← i + 1.
+    3. Return(k_{i−1}, k_{i−2}, ..., k_1, k_0).
+
+<u>Algorithm 3.36</u> in GECC[^1]
+
+    INPUT: Window width w, positive integer k, P ∈ E(F_q).
+    OUTPUT: [k]P.
+    1. Use Algorithm 3.35 to compute NAF-w(k).
+    2. Compute P_i = [i]P for i ∈ {1, 3, 5, ..., 2^{w-1} - 1}. //precomputation for fixed P
+    3. Q ← ∞.
+    4. For i from l - 1 downto 0 do
+    4.1 Q ← 2Q.
+    4.2 If k_i != 0 then:
+            If k_i > 0 then:
+                Q ← Q + P_{k_i} ;
+            Else:
+                Q ← Q - P_{-k_i} .
+    5. Return(Q).
+
+### Fractional window
+
+[^10] and [^11]
+
+### Montgomery ladder
+
+The same name, Montgomery ladder, is used both for the general ladder idea of exponentiation/scalar-multiplication and the concrete *x*-coordinate only addition formulas and scalar multiplication algorithm on Montgomery curves.
+
+<u>Algorithm 13.35</u> in [^2] (general Montgomery ladder)
+
+    INPUT: k = (k_{t-1}, ..., k_1, k_0)_2, P ∈ E(F_q).
+    OUTPUT: [k]P .
+    1. P_1 ← P and P_2 ← [2]P
+    2. For i = t − 2 downto 0 do
+    2.1 If k_i = 0 then
+             P_1 ← [2]P_1; P_2 ← P_1 + P_2.
+        Else
+             P_1 ← P_1 + P_2; P_2 ← [2]P_2.
+    3. Return(P_1).
+
+<u>Algorithm 3.</u> in [^8] (general Montgomery ladder)
+
+    INPUT: G ∈ E(F_q), k = (1, k_{t−2}, ..., k_0)2
+    OUTPUT: Y = kG
+    R0 ← G; R1 ← [2]G
+    for j = t − 2 downto 0 do
+        if (k_j = 0) then
+            R1 ← R0 + R1; R0 ← [2]R0
+        else [if (kj = 1)]
+            R0 ← R0 + R1; R1 ← [2]R1
+    return R0
+
+Montgomery addition formulas (Projective coordinates/XZ coordinates):[^2]
+
+ - Addition (\( n \ne m \)):
+\begin{align*}
+X_{m+n} &= Z_{m-n}((X_m - Z_m)(X_n + Z_n) + (X_m + Z_m)(X_n - Z_n))^2 \\
+Z_{m+n} &= X_{m-n}((X_m - Z_m)(X_n + Z_n) - (X_m + Z_m)(X_n - Z_n))^2
+\end{align*}
+
+ - Doubling:
+\begin{align*}
+4X_nZ_n &= (X_n + Z_n)^2 - (X_n - Z_n)^2 \\
+X_{2n} &= (X_n + Z_n)^2 (X_n - Z_n)^2 \\
+Z_{2n} &= 4X_nZ_n((X_n - Z_n)^2 + ((A + 2)/4)(4X_nZ_n))
+\end{align*}
+
+ - \( Y \) recovery:
+\begin{align*}
+x_n &= X_n / Z_n; \qquad x_{n+1} = X_{n+1} / Z_{n+1} \\
+y_n &= \frac{(x_1x_n + 1) (x_1 + x_n + 2A) - 2A - (x_1 - x_n)^2x_{n+1}}{2By_1}
+\end{align*}
+
+### Brier-Joye (+ Lopez-Dahab) ladder
+
+Not really a scalar-multiplication algorithm. Generalization of the stricter Montgomery ladder(the *x*-coordinate only scalar-mult algo and addition formulas on Montgomery curves) to short Weierstrass elliptic curves over fields of \( \text{char}\ \mathbb{K} \ne 2, 3 \) by Brier & Joye. Furthermore the *x*-coordinate only addition formulas were generalized to curves over \( \mathbb{F}_{2^m} \) by Lopez & Dahab.
+
+Brier-Joye addition formulas (Projective coordinates/XZ coordinates):[^2]
+
+ - Addition (\( n \ne m \)):
+\begin{align*}
+X_{m+n} &= Z_{m-n}(-4a_6Z_mZ_n(X_mZ_n + X_nZ_m) + (X_mX_n - a_4 Z_mZ_n)^2) \\
+Z_{m+n} &= X_{m-n}(X_mZ_n - X_nZ_m)^2
+\end{align*}
+
+ - Doubling:
+\begin{align*}
+X_{2n} &= (X_n^2 - a_4Z_n^2)^2 - 8 a_6X_nZ_n^3 \\
+Z_{2n} &= 4Z_n(X_n(X_n^2 + a_4 Z_n^2) + a_6Z_n^3)
+\end{align*}
+
+ - \( Y \) recovery:
+\begin{align*}
+x_n &= X_n / Z_n; \qquad x_{n+1} = X_{n+1} / Z_{n+1} \\
+y_n &= \frac{2a_6 +(x_1x_n + a_4) (x_1 + x_n) - (x_1 - x_n)^2x_{n+1}}{2y_1}
+\end{align*}
+
+Lopez-Dahab addition formulas on \( E(\mathbb{F}_{2^m}) \)(Projective coordinates/XZ coordinates):[^2]
+
+ - Addition (\( n \ne m \)):
+\begin{align*}
+Z_{m+n} &= (X_mZ_n)^2 + (X_nZ_m)^2 \\
+X_{m+n} &= Z_{m+n}X_{m-n} + X_mZ_nX_nZ_m
+\end{align*}
+
+ - Doubling:
+\begin{align*}
+X_{2n} &= X_n^4 + a_6Z_n^4 = (X_n^2 + \sqrt{a_6}Z_n^2)^2 \\
+Z_{2n} &= X_n^2Z_n^2
+\end{align*}
+
+ - \( Y \) recovery:
+\begin{align*}
+x_n &= X_n / Z_n; \qquad x_{n+1} = X_{n+1} / Z_{n+1} \\
+y_n &= \frac{(x_n + x_1)((x_n + x_1)(x_{n+1} + x_1) + x_1^2 + y_1)}{x_1} + y_1
+\end{align*}
+
+### GLV scalar multiplication
+
+[^13]
+
+### Fixed-base windowing (BGMW)
+
+<u>Algorithm 3.41</u> and <u>Algorithm 3.42</u> in GECC[^1]
+
+
+### Fixed-base comb
+
+<u>Algorithm 3.44</u> and <u>Algorithm 3.45</u> in GECC[^1]
+
+### Möller-1
+
+> The method may fail in some cases in that an addition step may turn out to be a point doubling or may involve the point at infinity (which both requires special treatment and is potentially clearly visible through side channels). However, we will show that the probability of this happening is negligible if multipliers are appropriately selected: Randomly chosen e is safe.[^9]
+
+## References
+
+[^1]: HANKERSON, Darrel; MENEZES, Alfred J.; VANSTONE, Scott. Guide to Elliptic Curve Cryptography. New York, USA: Springer, 2004. ISBN 9780387218465. Available from DOI: [10.1007/b97644](https://dx.doi.org/10.1007/b97644).
+[^2]: COHEN, Henri; FREY, Gerhard; AVANZI, Roberto M.; DOCHE, Christophe; LANGE,
+Tanja; NGUYEN, Kim; VERCAUTEREN, Frederik. Handbook of Elliptic and Hyper-
+elliptic Curve Cryptography. CRC Press, 2005-07-19. Discrete Mathematics and It’s Applications, no. 34. ISBN 9781584885184.
+[^3]: BERNSTEIN, Daniel J.; LANGE, Tanja. Explicit Formulas Database, <https://www.hyperelliptic.org/EFD/>
+[^4]: <http://point-at-infinity.org/ecc/>
+[^5]: KNUTH, Donald: The Art of Computer Programming, Volume 2: Seminumerical algorithms
+[^6]: GORDON, Daniel M.: A survey of fast exponentiation methods.
+[^7]: MORAIN, Francois; OLIVOS, Jorge: Speeding up the computations on an elliptic curve using addition-subtraction chains.
+[^8]: JOYE, Marc; YEN, Sung-Ming: The Montgomery Powering Ladder.
+[^9]: MOLLER, Bodo: Securing Elliptic Curve Point Multiplication against Side-Channel Attacks.
+[^10]: MOLLER, Bodo: Improved Techniques for Fast Exponentiation.
+[^11]: MOLLER, Bodo: Fractional Windows Revisited: Improved Signed-Digit Representations for Efficient Exponentiation.
+[^12]: KOYAMA, Kenji; TSURUOKA, Yukio: Speeding up Elliptic Cryptosystems by Using a Signed Binary Window Method.
+[^13]: GALLANT, Robert P.; LAMBERT, Robert J.; VANSTONE, Scott A.: Faster point multiplication on elliptic curves with efficient endomorphisms.
\ No newline at end of file
diff --git a/docs/LIBS.md b/docs/LIBS.md
index 4fac57b..d1a68d0 100644
--- a/docs/LIBS.md
+++ b/docs/LIBS.md
@@ -1,31 +1,89 @@
-# Libraries with ECC
+# Libraries with ECC support
 
-Libraries with at least some ECC support:
+Popular libraries with at least some ECC support:
 
- - [Crypto++](https://cryptopp.com/)
  - [libgcrypt](https://www.gnupg.org/related_software/libgcrypt/)
-
  - [mbedTLS](https://tls.mbed.org/)
  - [Nettle](http://www.lysator.liu.se/~nisse/nettle/)
- - [OpenSSL](https://www.openssl.org/)
  - [OpenSSL (FIPS mode)](https://www.openssl.org/docs/fipsnotes.html)
-
- - [Microsoft CNG](https://msdn.microsoft.com/en-us/library/windows/desktop/aa376210(v=vs.85).aspx)
+ - BoringSSL
  - [Microsoft .NET crypto](https://docs.microsoft.com/en-us/dotnet/standard/security/cryptography-model)
- 
+
 # Supported libraries
 
  - [BouncyCastle](https://bouncycastle.org/java.html)
     - Java
+    - Works with the short Weierstrass curve model.
+    - Works with coordinates:
+        - Affine
+        - Projective(Homogenous)
+        - Jacobian
+        - Jacobian-Chudnovsky
+        - Jacobian-Modified
+        - Lambda-Affine?
+        - Lambda-Projective?
+        - Skewed?
+    - Multiple scalar multiplication algorithms implemented and used:
+        - Double-and-add always (DoubleAddMultiplier)
+        - Fixed point comb (FixedPointCombMultiplier)
+        - GLV (Gallant-Lambert-Vanstone) using endomorphisms (GLVMultiplier): Faster point multiplication on elliptic curves with efficient endomorphisms. <-- default, if available
+        - Binary NAF right-to-left multiplication(mixed coordinates) (MixedNafR2LMultiplier)
+        - Montgomery ladder (MontgomeryLadderMultiplier)
+        - Binary NAF right-to-left multiplication (NafR2LMultiplier)
+        - Binary NAF left-to-right multiplication (NafL2RMultiplier)
+        - Double-and-add reference implementation (ReferenceMultiplier)
+        - Window NAF left-to-right multiplication (WNafL2RMultiplier) <-- default
+        - Window Tau-NAF multiplication (WTauNafMultiplier): Improved Algorithms for Arithmetic on Anomalous Binary Curves
+        - Zeroless signed digit binary right-to-left multiplication (ZSignedDigitR2LMultiplier)
+        - Zeroless signed digit binary left-to-right multiplication (ZSignedDigitL2RMultiplier)
+    - Has custom field and point arithmetic for:
+        - Curve25519 (transformed into short Weierstrass model)
+        - SMP2 curves
+        - SECG curves
  - [Sun EC](https://docs.oracle.com/javase/7/docs/technotes/guides/security/SunProviders.html#SunEC)
     - Java + C
- - [Botan](https://botan.randombit.net/), since 2.4.0 (unreleased)
+    - Uses the short Weierstrass curve model.
+    - For prime field curves:
+        - Uses 5-bit window NAF, Uses mixed Modified-Jacobian coordinates
+        for doubling and Chudnovsky Jacobian coordinates for additions (ecp_jm.c). From:
+        Brown, Hankerson, Lopez, Menezes: Software Implementation of the NIST Elliptic Curves Over Prime Fields.
+        - Contains an implementation of scalar multiplication with 4-bit sliding window, using Jacobian coordinates (ecp_jac.c)
+        - Contains an implementation of IEEE P1363 algorithm A.10.3 using affine coordinates (ecp_aff.c)
+    - For binary field curves:
+        - Uses Lopez-Dahab (Montgomery) ladder, XZ coordinates (ec2_mont.c): Fast multiplication on elliptic curves over GF(2^m) without precomputation (Algorithm 2P)
+        - Contains an implementation of IEEE P1363 algorithm A.10.3 using affine coordinates (ec2_aff.c)
+    - Has some custom arithmetic for some of the NIST primes.
+ - [OpenSSL](https://www.openssl.org/)
+    - C
+    - For prime field curves:
+        - Uses Jacobian coordinates, and Montgomery ladder, also uses wNAF-based interleaving multi-exponentiation method(ec_mult.c): http://www.bmoeller.de/pdf/TI-01-08.multiexp.pdf
+        - Also uses multiplication with precomputation by wNAF splitting(ec_mult.c)
+    - For binary field curves:
+        - Uses Jacobian coordinates, and Lopez-Dahab ladder, also uses wNAF-based interleaving multi-exponentiation method(ec2_smpl.c)
+ - [Botan](https://botan.randombit.net/)
     - C++
     - Uses blinded(randomized) Montgomery ladder.
-    - https://hyperelliptic.org/EFD/g1p/auto-shortw-jacobian-3.html#addition-add-1998-cmo-2
-    - https://hyperelliptic.org/EFD/g1p/auto-shortw-jacobian-3.html#doubling-dbl-1986-cc
-    - https://eprint.iacr.org/2015/657
+    - <https://hyperelliptic.org/EFD/g1p/auto-shortw-jacobian-3.html#addition-add-1998-cmo-2>
+    - <https://hyperelliptic.org/EFD/g1p/auto-shortw-jacobian-3.html#doubling-dbl-1986-cc>
+    - <https://eprint.iacr.org/2015/657>
+    - ECTester supports v2.4.0 and up.
  - [libtomcrypt](http://www.libtom.net/LibTomCrypt/)
     - C
     - Uses Jacobian coordinates.
-    - Sliding window scalar multiplication algorithm.
\ No newline at end of file
+    - Sliding window scalar multiplication algorithm.
+ - [Crypto++](https://cryptopp.com/)
+    - C++
+    - For prime field curves:
+        - Uses projective coordinates and sliding window scalar multiplication algorithm.
+    - For binary field curves:
+        - Uses affine coordinates and sliding window scalar multiplication algorithm.
+ - [Microsoft CNG](https://msdn.microsoft.com/en-us/library/windows/desktop/aa376210(v=vs.85).aspx)
+    - C API.
+    - Closed source.
+	- For prime field curves(only supports):
+	   - Uses Short Weierstrass model.
+	   - Uses Twisted Edwards model.
+	   - Uses Montgomery model.
+	   - Uses fixed window scalar multiplication.
+	   - Uses Wnaf multi-scalar multiplication with interleaving.
+	   - Uses Montgomery ladder.
\ No newline at end of file
diff --git a/docs/TESTS.md b/docs/TESTS.md
index c4f38dc..5811577 100644
--- a/docs/TESTS.md
+++ b/docs/TESTS.md
@@ -1,12 +1,18 @@
-# Tests
+# Test suites
 
  - `default`
  - `test-vectors`
- - `wrong`
- - `composite`
- - `invalid`
+ - `compression`
+ - `miscellaneous`
+ - `wrong`*
+ - `composite`*
+ - `invalid`*
+ - `twist`*
+ - `degenerate`*
+ - `cofactor`*
+ - `edge-cases`*
  
-**NOTE: The `wrong`, `composite` and `invalid` test suites caused temporary DoS of some cards. These test suites prompt you for
+**\*NOTE: The `wrong`, `composite`, `invalid`,`twist`, `cofactor`, `edge-cases` and `degenerate` test suites caused temporary/permanent DoS of some cards. These test suites prompt you for
 confirmation before running, be cautious.**
 
 ## Default
@@ -18,14 +24,10 @@ This test suite is run if no argument is provided to `-t / --test`.
 
 For example:
 ```bash
-java -jar ECTester.jar -a -fp -t
+java -jar ECTester.jar -t
 ```
-tests all(`-a`), prime field(`-fp`), using the default test suite.
+tests prime field and binary field curves, using the default test suite.
 
-```bash
-java -jar ECTester.jar-a -f2m -t
-```
-tests all(`-a`), binary field(`-f2m`), curves.
 
 ## Test-Vectors
 Tests using known test vectors provided by NIST/SECG/Brainpool:
@@ -40,43 +42,142 @@ Tests using known test vectors provided by NIST/SECG/Brainpool:
 
 For example:
 ```bash
-java -jar ECTester.jar -t test-vectors -nc nist -a -f2m
+java -jar ECTester.jar -t test-vectors
 ```
-tests all(`-a`), binary field(`-f2m`) NIST curves for which test-vectors are provided. Although this test suite is better for general testing:
+tests all curves for which test-vectors are provided.
+
+## Compression
+Tests support for compression of public points in ECDH as specified in ANSI X9.62. Tests ECDH with points in compressed
+and hybrid form. Also tests card response to a hybrid point with wrong `y` coordinate and to the point at infinity(as public key in ECDH).
+
+For example:
 ```bash
-java -jar ECTester.jar -t test-vectors -a
+java -jar ECTester.jar -t compression
 ```
+
 ## Wrong
-Tests using the default tests on a category of wrong curves. These curves are not really curves as they have:
+Tests on a category of wrong curves. These curves are not really curves as they have:
  - non-prime field in the prime-field case
  - reducible polynomial as the field polynomial in the binary case
 
-These tests should fail generally. They are equivalent with `java -jar ECTester.jar -nc wrong -t`, the default tests over the `wrong` category
-of curves.
- 
+This test suite also does some additional tests with corrupting the parameters:
+ - Fp:
+   - p = 0
+   - p = 1
+   - p = q^2; q prime
+   - p = q * s; q and s prime
+   - G = random point not on curve
+   - G = random data
+   - G = infinity
+   - r = 0
+   - r = 1
+   - r = some prime larger than original r (and \[r\]G != infinity)
+   - r = some prime smaller than original r (and \[r\]G != infninity)
+   - r = some composite number (and \[r\]G != infinity)
+   - k = 0xff
+   - k = 0
+ - F2m:
+   - e1 = e2 = e3 = 0
+   - m < e1 < e2 < e3
+
+These tests should fail generally.
+
 For example:
 ```bash
-java -jar ECTester.jar -t wrong -b 521 -fp
+java -jar ECTester.jar -t wrong
 ```
-tests a 521 bit(`-b`), prime-field(`-fp`) wrong curve.
+does all wrong curve tests.
+
 
 ## Composite
 Tests using curves that don't have a prime order/nearly prime order.
-These tests should generally fail, a success here implies the card **WILL** use a non-secure curve if such curve is set
+These tests should generally fail, a success here implies the card will use a non-secure curve if such curve is set
 by the applet. Operations over such curves are susceptible to small-subgroup attacks.
 
+   - r = quite a smooth number, many small factors, r = |G|
+   - r = small prime(of increasing bit lengths), r = |G|
+   - r = p * q = |G|
+   - r = G = Carmichael number = p * q * s
+   - \[r\]G = infinity but r != |G|, so |G| divides r
+   
 For example:
 ```bash
-java -jar ECTester.jar -t composite -b 160 -fp
+java -jar ECTester.jar -t composite
 ```
 
+
 ## Invalid
-Tests using known named curves from several categories(SECG/NIST/Brainpool) against pregenerated *invalid* public keys.
-These tests should definitely fail, a success here implies the card is susceptible to invalid curve attacks.
+Tests using known named curves from several categories(SECG/NIST/Brainpool) against pre-generated *invalid* public keys.
+ECDH should definitely fail, a success here implies the card is susceptible to invalid curve attacks.
 
+See [Practical Invalid Curve Attacks on TLS-ECDH](https://www.nds.rub.de/media/nds/veroeffentlichungen/2015/09/14/main-full.pdf) for more information.
 
 For example:
 ```bash
-java -jar ECTester.jar -t invalid -nc nist -a -fp
+java -jar ECTester.jar -t invalid
 ```
-tests using all(`-a`), prime-field(`-fp`) NIST curves and pregenerated *invalid* public keys for these curves.
\ No newline at end of file
+tests using all curves with pregenerated *invalid* public keys for these curves.
+
+
+## Twist
+Tests using known named curves froms several categories(SECG/NIST) against pre-generated points on twists of said curves.
+ECDH should fail, a success here implies the card is not twist secure, if a curve with an unsecure twist is used,
+the card might compute on the twist, if a point on the twist is supplied.
+
+See [SafeCurves on twist security](https://safecurves.cr.yp.to/twist.html) for more information.
+
+For example:
+```bash
+java -jar ECTester.jar -t twist
+```
+
+## Degenerate
+Tests using known named curves froms several categories(SECG/NIST) against pre-generated points on the degenerate line
+`Y: x = 0`. ECDH should fail, a success here might mean the card does not check that the point lies on the correct curve
+and uses a curve model vulnerable to such degenerate points.
+
+See [Degenerate Curve Attacks - Extending Invalid Curve Attacks to Edwards Curves and Other Models](https://eprint.iacr.org/2015/1233.pdf) for more information.
+
+For example:
+```bash
+java -jar ECTester.jar -t degenerate
+```
+
+## Cofactor
+Tests whether the card correctly rejects points that lie on the curve but not on the subgroup generated by the specified generator
+during ECDH. Does this with curves where the cofactor subgroup has small order, then with curves that have order equal to the product
+of two large primes, sets the generator with order of one prime and tries points on the subgroup of the other prime order.
+
+For example:
+```bash
+java -jar ECTester.jar -t cofactor
+```
+
+## Edge-Cases
+Tests various inputs to ECDH which may cause an implementation to achieve a certain edge-case state during ECDH. 
+Some of the data is from the google/Wycheproof project. Tests include [CVE-2017-10176](https://nvd.nist.gov/vuln/detail/CVE-2017-10176) and [CVE-2017-8932](https://nvd.nist.gov/vuln/detail/CVE-2017-8932).
+Various custom edge private key values are also tested.
+
+CVE-2017-10176 was in implementation issue in the SunEC Java library that caused the implementation to reach the point at infinity during ECDH computation.
+
+CVE-2017-8932 was an implementation issue in the Go standard library, in particular its scalar multiplication algorithm on the
+P-256 curve which leaked information about the private key.
+
+Custom private key values over SECG curves are tested:
+   - s = 0, s = 1
+   - s < r, s = r, s > r
+   - s = r - 1, s = r + 1
+   - s = k\*r - 1, s = k\*r, s = k\*r + 1 
+
+For example:
+```bash
+java -jar ECTester.jar -t edge-cases
+```
+
+## Miscellaneous
+Some miscellaneous tests, tries ECDH and ECDSA over supersingular curves and Barreto-Naehrig curves with small embedding degree and CM discriminant.
+
+For example:
+```bash
+java -jar ECTester.jar -t miscellaneous
+```
\ No newline at end of file