2 files changed, 200 insertions, 35 deletions

diff --git a/test/ec/test_key_agreement.py b/test/ec/test_key_agreement.py
index 60e48f8..4afb2de 100644
--- a/test/ec/test_key_agreement.py
+++ b/test/ec/test_key_agreement.py
@@ -12,9 +12,16 @@ from pyecsca.ec.key_agreement import (
     ECDH_SHA256,
     ECDH_SHA384,
     ECDH_SHA512,
+    X25519,
+    X448,
 )
 from pyecsca.ec.mod import Mod, mod
-from pyecsca.ec.mult import LTRMultiplier
+from pyecsca.ec.mult import (
+    LTRMultiplier,
+    LadderMultiplier,
+    SwapLadderMultiplier,
+    DifferentialLadderMultiplier,
+)
 import test.data.ec
 from pyecsca.ec.params import get_params
 from pyecsca.ec.point import Point
@@ -43,7 +50,9 @@ def keypair_b(secp128r1, mult):
     return priv_b, pub_b
 
 
-@pytest.mark.parametrize("algo", [ECDH_NONE, ECDH_SHA1, ECDH_SHA224, ECDH_SHA256, ECDH_SHA384, ECDH_SHA512])
+@pytest.mark.parametrize(
+    "algo", [ECDH_NONE, ECDH_SHA1, ECDH_SHA224, ECDH_SHA256, ECDH_SHA384, ECDH_SHA512]
+)
 def test_ka(algo, mult, secp128r1, keypair_a, keypair_b):
     result_ab = algo(mult, secp128r1, keypair_a[1], keypair_b[0]).perform()
     result_ba = algo(mult, secp128r1, keypair_b[1], keypair_a[0]).perform()
@@ -59,14 +68,18 @@ def test_ka_secg():
     dbl = secp160r1.curve.coordinate_model.formulas["dbl-2015-rcb"]
     mult = LTRMultiplier(add, dbl)
     privA = mod(int(secg_data["keyA"]["priv"], 16), secp160r1.order)
-    pubA_affine = Point(affine_model,
-                        x=mod(int(secg_data["keyA"]["pub"]["x"], 16), secp160r1.curve.prime),
-                        y=mod(int(secg_data["keyA"]["pub"]["y"], 16), secp160r1.curve.prime))
+    pubA_affine = Point(
+        affine_model,
+        x=mod(int(secg_data["keyA"]["pub"]["x"], 16), secp160r1.curve.prime),
+        y=mod(int(secg_data["keyA"]["pub"]["y"], 16), secp160r1.curve.prime),
+    )
     pubA = pubA_affine.to_model(secp160r1.curve.coordinate_model, secp160r1.curve)
     privB = mod(int(secg_data["keyB"]["priv"], 16), secp160r1.order)
-    pubB_affine = Point(affine_model,
-                        x=mod(int(secg_data["keyB"]["pub"]["x"], 16), secp160r1.curve.prime),
-                        y=mod(int(secg_data["keyB"]["pub"]["y"], 16), secp160r1.curve.prime))
+    pubB_affine = Point(
+        affine_model,
+        x=mod(int(secg_data["keyB"]["pub"]["x"], 16), secp160r1.curve.prime),
+        y=mod(int(secg_data["keyB"]["pub"]["y"], 16), secp160r1.curve.prime),
+    )
     pubB = pubB_affine.to_model(secp160r1.curve.coordinate_model, secp160r1.curve)
 
     algoAB = ECDH_SHA1(copy(mult), secp160r1, pubA, privB)
@@ -83,3 +96,121 @@ def test_ka_secg():
     n = (p.bit_length() + 7) // 8
     result = x.to_bytes(n, byteorder="big")
     assert result == bytes.fromhex(secg_data["raw"])
+
+
+@pytest.mark.parametrize(
+    "mult_args",
+    [
+        (LadderMultiplier, "ladd-1987-m", "dbl-1987-m", "scale"),
+        (SwapLadderMultiplier, "ladd-1987-m", "dbl-1987-m", "scale"),
+        (DifferentialLadderMultiplier, "dadd-1987-m", "dbl-1987-m", "scale"),
+    ],
+)
+@pytest.mark.parametrize("complete", [True, False])
+@pytest.mark.parametrize("short_circuit", [True, False])
+@pytest.mark.parametrize(
+    "scalar_hex,coord_hex,result_hex",
+    [
+        (
+            "A546E36BF0527C9D3B16154B82465EDD62144C0AC1FC5A18506A2244BA449AC4",
+            "E6DB6867583030DB3594C1A424B15F7C726624EC26B3353B10A903A6D0AB1C4C",
+            "C3DA55379DE9C6908E94EA4DF28D084F32ECCF03491C71F754B4075577A28552",
+        ),
+        (
+            "4b66e9d4d1b4673c5ad22691957d6af5c11b6421e0ea01d42ca4169e7918ba0d",
+            "e5210f12786811d3f4b7959d0538ae2c31dbe7106fc03c3efc4cd549c715a493",
+            "95cbde9476e8907d7aade45cb4b873f88b595a68799fa152e6f8f7647aac7957",
+        ),
+        (
+            "77076d0a7318a57d3c16c17251b26645df4c2f87ebc0992ab177fba51db92c2a",
+            "de9edb7d7b7dc1b4d35b61c2ece435373f8343c85b78674dadfc7e146f882b4f",
+            "4a5d9d5ba4ce2de1728e3bf480350f25e07e21c947d19e3376f09b3c1e161742",
+        ),
+        (
+            "5dab087e624a8a4b79e17f8b83800ee66f3bb1292618b6fd1c2f8b27ff88e0eb",
+            "8520f0098930a754748b7ddcb43ef75a0dbf3a0d26381af4eba4a98eaa9b4e6a",
+            "4a5d9d5ba4ce2de1728e3bf480350f25e07e21c947d19e3376f09b3c1e161742",
+        ),
+    ],
+    ids=["RFC7748tv1", "RFC7748tv2", "RFC7748dh1", "RFC7748dh2"],
+)
+def test_x25519(
+    curve25519, mult_args, complete, short_circuit, scalar_hex, coord_hex, result_hex
+):
+    mult_class = mult_args[0]
+    mult_formulas = list(
+        map(
+            lambda name: curve25519.curve.coordinate_model.formulas[name], mult_args[1:]
+        )
+    )
+    multiplier = mult_class(
+        *mult_formulas, complete=complete, short_circuit=short_circuit
+    )
+
+    scalar = int.from_bytes(bytes.fromhex(scalar_hex), "little")
+    coord = int.from_bytes(bytes.fromhex(coord_hex), "little")
+    result = bytes.fromhex(result_hex)
+    p = curve25519.curve.prime
+    coord &= (1 << 255) - 1
+    point = Point(curve25519.curve.coordinate_model, X=mod(coord, p), Z=mod(1, p))
+    xdh = X25519(multiplier, point, scalar)
+    res = xdh.perform()
+    assert res == result
+
+
+@pytest.mark.parametrize(
+    "mult_args",
+    [
+        (LadderMultiplier, "ladd-1987-m", "dbl-1987-m", "scale"),
+        (SwapLadderMultiplier, "ladd-1987-m", "dbl-1987-m", "scale"),
+        (DifferentialLadderMultiplier, "dadd-1987-m", "dbl-1987-m", "scale"),
+    ],
+)
+@pytest.mark.parametrize("complete", [True, False])
+@pytest.mark.parametrize("short_circuit", [True, False])
+@pytest.mark.parametrize(
+    "scalar_hex,coord_hex,result_hex",
+    [
+        (
+            "3d262fddf9ec8e88495266fea19a34d28882acef045104d0d1aae121700a779c984c24f8cdd78fbff44943eba368f54b29259a4f1c600ad3",
+            "06fce640fa3487bfda5f6cf2d5263f8aad88334cbd07437f020f08f9814dc031ddbdc38c19c6da2583fa5429db94ada18aa7a7fb4ef8a086",
+            "ce3e4ff95a60dc6697da1db1d85e6afbdf79b50a2412d7546d5f239fe14fbaadeb445fc66a01b0779d98223961111e21766282f73dd96b6f",
+        ),
+        (
+            "203d494428b8399352665ddca42f9de8fef600908e0d461cb021f8c538345dd77c3e4806e25f46d3315c44e0a5b4371282dd2c8d5be3095f",
+            "0fbcc2f993cd56d3305b0b7d9e55d4c1a8fb5dbb52f8e9a1e9b6201b165d015894e56c4d3570bee52fe205e28a78b91cdfbde71ce8d157db",
+            "884a02576239ff7a2f2f63b2db6a9ff37047ac13568e1e30fe63c4a7ad1b3ee3a5700df34321d62077e63633c575c1c954514e99da7c179d",
+        ),
+        (
+            "9a8f4925d1519f5775cf46b04b5800d4ee9ee8bae8bc5565d498c28dd9c9baf574a9419744897391006382a6f127ab1d9ac2d8c0a598726b",
+            "3eb7a829b0cd20f5bcfc0b599b6feccf6da4627107bdb0d4f345b43027d8b972fc3e34fb4232a13ca706dcb57aec3dae07bdc1c67bf33609",
+            "07fff4181ac6cc95ec1c16a94a0f74d12da232ce40a77552281d282bb60c0b56fd2464c335543936521c24403085d59a449a5037514a879d",
+        ),
+        (
+            "1c306a7ac2a0e2e0990b294470cba339e6453772b075811d8fad0d1d6927c120bb5ee8972b0d3e21374c9c921b09d1b0366f10b65173992d",
+            "9b08f7cc31b7e3e67d22d5aea121074a273bd2b83de09c63faa73d2c22c5d9bbc836647241d953d40c5b12da88120d53177f80e532c41fa0",
+            "07fff4181ac6cc95ec1c16a94a0f74d12da232ce40a77552281d282bb60c0b56fd2464c335543936521c24403085d59a449a5037514a879d",
+        ),
+    ],
+    ids=["RFC7748tv1", "RFC7748tv2", "RFC7748dh1", "RFC7748dh2"],
+)
+def test_x448(
+    curve448, mult_args, complete, short_circuit, scalar_hex, coord_hex, result_hex
+):
+    mult_class = mult_args[0]
+    mult_formulas = list(
+        map(lambda name: curve448.curve.coordinate_model.formulas[name], mult_args[1:])
+    )
+    multiplier = mult_class(
+        *mult_formulas, complete=complete, short_circuit=short_circuit
+    )
+
+    scalar = int.from_bytes(bytes.fromhex(scalar_hex), "little")
+    coord = int.from_bytes(bytes.fromhex(coord_hex), "little")
+    result = bytes.fromhex(result_hex)
+    p = curve448.curve.prime
+
+    point = Point(curve448.curve.coordinate_model, X=mod(coord, p), Z=mod(1, p))
+    xdh = X448(multiplier, point, scalar)
+    res = xdh.perform()
+    assert res == result
diff --git a/test/ec/test_mult.py b/test/ec/test_mult.py
index e477b07..e65dfdd 100644
--- a/test/ec/test_mult.py
+++ b/test/ec/test_mult.py
@@ -3,6 +3,7 @@ from typing import Sequence, List
 
 import pytest
 
+from pyecsca.ec.context import local, DefaultContext
 from pyecsca.ec.mod import Mod, mod
 from pyecsca.ec.mult import (
     DoubleAndAddMultiplier,
@@ -22,9 +23,11 @@ from pyecsca.ec.mult import (
     BGMWMultiplier,
     CombMultiplier,
     WindowBoothMultiplier,
+    SwapLadderMultiplier,
 )
 from pyecsca.ec.mult.fixed import FullPrecompMultiplier
 from pyecsca.ec.point import InfinityPoint, Point
+from pyecsca.sca import MultipleContext
 
 
 def get_formulas(coords, *names):
@@ -54,7 +57,7 @@ def do_basic_test(mult_class, params, base, add, dbl, scale, neg=None, **kwargs)
     except NotImplementedError:
         pass
     mult.init(params, base)
-    assert InfinityPoint(params.curve.coordinate_model) == mult.multiply(0)
+    assert params.curve.neutral == mult.multiply(0)
     return res
 
 
@@ -186,7 +189,7 @@ def test_ladder(curve25519):
             29893438142586401087946310744922998080771935139441267052026283852717044358472,
             48084050389777770101701157326923977117307187144965043058462938058489685090437,
             40694087602335028385342029955981451169449898924211721351135404099078471497195,
-        )
+        ),
     ],
 )
 def test_ladder_full(curve25519, scalar, x, res):
@@ -194,24 +197,19 @@ def test_ladder_full(curve25519, scalar, x, res):
     point = Point(curve25519.curve.coordinate_model, X=mod(x, p), Z=mod(1, p))
     result = Point(curve25519.curve.coordinate_model, X=mod(res, p), Z=mod(1, p))
 
-    mult = LadderMultiplier(
-        curve25519.curve.coordinate_model.formulas["ladd-1987-m"],
-        curve25519.curve.coordinate_model.formulas["dbl-1987-m"],
-        # complete=False
-    )
-    fixed = int(mod(scalar, curve25519.order))
-
-    mult.init(curve25519, point)
-    computed = mult.multiply(fixed)
+    for complete in (True, False):
+        mult = LadderMultiplier(
+            curve25519.curve.coordinate_model.formulas["ladd-1987-m"],
+            curve25519.curve.coordinate_model.formulas["dbl-1987-m"],
+            complete=complete,
+        )
 
-    point_aff = list(curve25519.curve.affine_lift_x(mod(x, p)))[0]
-    result_aff = list(curve25519.curve.affine_lift_x(mod(res, p)))[0]
-    computed_aff = curve25519.curve.affine_multiply(point_aff, scalar)
+        mult.init(curve25519, point)
+        computed = mult.multiply(scalar)
 
-    scale = curve25519.curve.coordinate_model.formulas["scale"]
-    converted = scale(p, computed, **curve25519.curve.parameters)[0]
-    assert computed_aff.x == result_aff.x
-    assert converted.X == result.X
+        scale = curve25519.curve.coordinate_model.formulas["scale"]
+        converted = scale(p, computed, **curve25519.curve.parameters)[0]
+        assert converted.X == result.X
 
 
 @pytest.mark.parametrize(
@@ -229,35 +227,71 @@ def test_simple_ladder(secp128r1, add, dbl, scale):
 
 
 @pytest.mark.parametrize(
-    "num,complete",
+    "num",
+    [
+        15,
+        2355498743,
+        325385790209017329644351321912443757746,
+        0x1000000000000000000000000000000014DEF9DEA2F79CD65812631A5CF5D3ED - 1,
+    ],
+)
+@pytest.mark.parametrize("complete", [True, False])
+@pytest.mark.parametrize("short_circuit", [True, False])
+def test_ladder_swap(curve25519, num, complete, short_circuit):
+    ladder = LadderMultiplier(
+        curve25519.curve.coordinate_model.formulas["ladd-1987-m"],
+        curve25519.curve.coordinate_model.formulas["dbl-1987-m"],
+        curve25519.curve.coordinate_model.formulas["scale"],
+        complete=complete,
+        short_circuit=short_circuit,
+    )
+    swap = SwapLadderMultiplier(
+        curve25519.curve.coordinate_model.formulas["ladd-1987-m"],
+        curve25519.curve.coordinate_model.formulas["dbl-1987-m"],
+        curve25519.curve.coordinate_model.formulas["scale"],
+        complete=complete,
+        short_circuit=short_circuit,
+    )
+    ladder.init(curve25519, curve25519.generator)
+    res_ladder = ladder.multiply(num)
+    swap.init(curve25519, curve25519.generator)
+    res_swap = swap.multiply(num)
+    assert res_ladder == res_swap
+    assert curve25519.curve.neutral == swap.multiply(0)
+
+
+@pytest.mark.parametrize(
+    "num",
     [
-        (15, True),
-        (15, False),
-        (2355498743, True),
-        (2355498743, False),
-        (325385790209017329644351321912443757746, True),
-        (325385790209017329644351321912443757746, False),
+        15,
+        2355498743,
+        325385790209017329644351321912443757746,
+        0x1000000000000000000000000000000014DEF9DEA2F79CD65812631A5CF5D3ED - 1,
     ],
 )
-def test_ladder_differential(curve25519, num, complete):
+@pytest.mark.parametrize("complete", [True, False])
+@pytest.mark.parametrize("short_circuit", [True, False])
+def test_ladder_differential(curve25519, num, complete, short_circuit):
     ladder = LadderMultiplier(
         curve25519.curve.coordinate_model.formulas["ladd-1987-m"],
         curve25519.curve.coordinate_model.formulas["dbl-1987-m"],
         curve25519.curve.coordinate_model.formulas["scale"],
         complete=complete,
+        short_circuit=short_circuit,
     )
     differential = DifferentialLadderMultiplier(
         curve25519.curve.coordinate_model.formulas["dadd-1987-m"],
         curve25519.curve.coordinate_model.formulas["dbl-1987-m"],
         curve25519.curve.coordinate_model.formulas["scale"],
         complete=complete,
+        short_circuit=short_circuit,
     )
     ladder.init(curve25519, curve25519.generator)
     res_ladder = ladder.multiply(num)
     differential.init(curve25519, curve25519.generator)
     res_differential = differential.multiply(num)
     assert res_ladder == res_differential
-    assert InfinityPoint(curve25519.curve.coordinate_model) == differential.multiply(0)
+    assert curve25519.curve.neutral == differential.multiply(0)
 
 
 @pytest.mark.parametrize(