%v", err) } if strings.Contains(t.Name(), "/Path/") { // For path coverage tests, check that we hit all rejection paths. reached := map[string]bool{"z": false, "r0": false, "ct0": false, "h": false} // The ct0 rejection is only reachable for ML-DSA-44. if priv.PublicKey().Parameters() != "ML-DSA-44" { delete(reached, "ct0") } testingOnlyRejection = func(reason string) { t.Log(reason, "rejection") reached[reason] = true } t.Cleanup(func() { testingOnlyRejection = nil }) defer func() { for reason, hit...

fipsPCT(c, priv) return priv, nil } // randomPoint returns a random scalar and the corresponding point using a // procedure equivalent to FIPS 186-5, Appendix A.2.2 (ECDSA Key Pair Generation // by Rejection Sampling) and to Appendix A.3.2 (Per-Message Secret Number // Generation of Private Keys by Rejection Sampling) or Appendix A.3.3 // (Per-Message Secret Number Generation for Deterministic ECDSA) followed by // Step 5 of Section 6.4.1. func randomPoint[P Point[P]](c *Curve[P], generate func([]byte)...