opaque-vx/src/tests/full_test.rs

// Copyright (c) Facebook, Inc. and its affiliates.
//
// This source code is licensed under both the MIT license found in the
// LICENSE-MIT file in the root directory of this source tree and the Apache
// License, Version 2.0 found in the LICENSE-APACHE file in the root directory
// of this source tree.

#![allow(unsafe_code)]

use core::ops::Add;
use std::string::String;
use std::vec::Vec;
use std::{format, println, ptr, vec};

use digest::core_api::{BlockSizeUser, CoreProxy};
use digest::{Output, OutputSizeUser};
use generic_array::typenum::{IsLess, IsLessOrEqual, Le, NonZero, Sum, Unsigned, U256};
use generic_array::ArrayLength;
use rand::rngs::OsRng;
use serde_json::Value;
use subtle::ConstantTimeEq;
use voprf::Group;

use crate::ciphersuite::{CipherSuite, OprfGroup, OprfHash};
use crate::envelope::EnvelopeLen;
use crate::errors::*;
use crate::hash::{Hash, OutputSize, ProxyHash};
use crate::key_exchange::group::KeGroup;
use crate::key_exchange::traits::{Ke1MessageLen, Ke1StateLen, Ke2MessageLen};
use crate::key_exchange::tripledh::{NonceLen, TripleDh};
use crate::keypair::SecretKey;
use crate::ksf::Identity;
use crate::messages::{
    CredentialRequestLen, CredentialResponseLen, CredentialResponseWithoutKeLen,
    RegistrationResponseLen, RegistrationUploadLen,
};
use crate::opaque::*;
use crate::tests::mock_rng::CycleRng;
use crate::*;

// Tests
// =====

#[cfg(feature = "ristretto255")]
struct Ristretto255;

#[cfg(feature = "ristretto255")]
impl CipherSuite for Ristretto255 {
    type OprfCs = crate::Ristretto255;
    type KeGroup = crate::Ristretto255;
    type KeyExchange = TripleDh;
    type Ksf = Identity;
}

#[cfg(feature = "ristretto255")]
struct Ristretto255P256;

#[cfg(feature = "ristretto255")]
impl CipherSuite for Ristretto255P256 {
    type OprfCs = p256::NistP256;
    type KeGroup = crate::Ristretto255;
    type KeyExchange = TripleDh;
    type Ksf = Identity;
}

#[cfg(feature = "ristretto255")]
struct Ristretto255P384;

#[cfg(feature = "ristretto255")]
impl CipherSuite for Ristretto255P384 {
    type OprfCs = p384::NistP384;
    type KeGroup = crate::Ristretto255;
    type KeyExchange = TripleDh;
    type Ksf = Identity;
}

struct P256;

impl CipherSuite for P256 {
    type OprfCs = p256::NistP256;
    type KeGroup = p256::NistP256;
    type KeyExchange = TripleDh;
    type Ksf = Identity;
}

struct P256P384;

impl CipherSuite for P256P384 {
    type OprfCs = p384::NistP384;
    type KeGroup = p256::NistP256;
    type KeyExchange = TripleDh;
    type Ksf = Identity;
}

#[cfg(feature = "ristretto255")]
struct P256Ristretto255;

#[cfg(feature = "ristretto255")]
impl CipherSuite for P256Ristretto255 {
    type OprfCs = crate::Ristretto255;
    type KeGroup = p256::NistP256;
    type KeyExchange = TripleDh;
    type Ksf = Identity;
}

struct P384;

impl CipherSuite for P384 {
    type OprfCs = p384::NistP384;
    type KeGroup = p384::NistP384;
    type KeyExchange = TripleDh;
    type Ksf = Identity;
}

struct P384P256;

impl CipherSuite for P384P256 {
    type OprfCs = p256::NistP256;
    type KeGroup = p384::NistP384;
    type KeyExchange = TripleDh;
    type Ksf = Identity;
}

#[cfg(feature = "ristretto255")]
struct P384Ristretto255;

#[cfg(feature = "ristretto255")]
impl CipherSuite for P384Ristretto255 {
    type OprfCs = crate::Ristretto255;
    type KeGroup = p384::NistP384;
    type KeyExchange = TripleDh;
    type Ksf = Identity;
}

#[cfg(all(feature = "curve25519", feature = "ristretto255"))]
struct Curve25519Ristretto255;

#[cfg(all(feature = "curve25519", feature = "ristretto255"))]
impl CipherSuite for Curve25519Ristretto255 {
    type OprfCs = crate::Ristretto255;
    type KeGroup = crate::Curve25519;
    type KeyExchange = TripleDh;
    type Ksf = Identity;
}

#[cfg(feature = "curve25519")]
struct Curve25519P256;

#[cfg(feature = "curve25519")]
impl CipherSuite for Curve25519P256 {
    type OprfCs = p256::NistP256;
    type KeGroup = crate::Curve25519;
    type KeyExchange = TripleDh;
    type Ksf = Identity;
}

#[cfg(feature = "curve25519")]
struct Curve25519P384;

#[cfg(feature = "curve25519")]
impl CipherSuite for Curve25519P384 {
    type OprfCs = p384::NistP384;
    type KeGroup = crate::Curve25519;
    type KeyExchange = TripleDh;
    type Ksf = Identity;
}

pub struct TestVectorParameters {
    pub client_s_pk: Vec<u8>,
    pub client_s_sk: Vec<u8>,
    pub client_e_pk: Vec<u8>,
    pub client_e_sk: Vec<u8>,
    pub server_s_pk: Vec<u8>,
    pub server_s_sk: Vec<u8>,
    pub server_e_pk: Vec<u8>,
    pub server_e_sk: Vec<u8>,
    pub fake_sk: Vec<u8>,
    pub credential_identifier: Vec<u8>,
    pub id_u: Vec<u8>,
    pub id_s: Vec<u8>,
    pub password: Vec<u8>,
    pub blinding_factor: Vec<u8>,
    pub oprf_seed: Vec<u8>,
    pub masking_nonce: Vec<u8>,
    pub envelope_nonce: Vec<u8>,
    pub client_nonce: Vec<u8>,
    pub server_nonce: Vec<u8>,
    pub context: Vec<u8>,
    pub registration_request: Vec<u8>,
    pub registration_response: Vec<u8>,
    pub registration_upload: Vec<u8>,
    pub credential_request: Vec<u8>,
    pub credential_response: Vec<u8>,
    pub credential_finalization: Vec<u8>,
    client_registration_state: Vec<u8>,
    client_login_state: Vec<u8>,
    server_login_state: Vec<u8>,
    pub password_file: Vec<u8>,
    pub export_key: Vec<u8>,
    pub session_key: Vec<u8>,
}

static STR_PASSWORD: &str = "password";
static STR_CREDENTIAL_IDENTIFIER: &str = "credential_identifier";

// To regenerate these test vectors, run:
// cargo test --features curve25519 -- --nocapture generate_test_vectors
#[cfg(feature = "ristretto255")]
static TEST_VECTOR_RISTRETTO255: &str = r#"
{
    "client_s_pk": "58f84ab1de6d6baed997b8622a7340470a2e321778cf15a6a349f57143181b6d",
    "client_s_sk": "ca1860c537f99dce6da9d0bf674f7c5c483c7e12c07487821d0fc60b78702a03",
    "client_e_pk": "5898671746f581bbaa9019ea3e5dc5809612960e38f3fd3569237e8d0cf14a23",
    "client_e_sk": "bd61a18173fe09b88529b4c04424637ce066fabc0f077985713ae12457d7b601",
    "server_s_pk": "32033f92bfd82242f7dc9b2574f6916a53aa4ef83ecab4f4d912aad9957d8027",
    "server_s_sk": "ab8f8598cb4166fb5ee1d437b6f5b563b59e4b699ded8e176c25ee77358bac01",
    "server_e_pk": "f4ac5c4ef8dfae76705ddc1dd6c64b916680f69975cad5733ba7a4570bdd5629",
    "server_e_sk": "7bf9ca648ab766269eeed497f640264cc248caaf94498b3aba2324395d061308",
    "fake_sk": "23c51f2bd15324bbc088313184ff2daf81454c24002887b8abd8dc1d78f35000",
    "credential_identifier": "637265644964656e746966696572",
    "id_u": "696455",
    "id_s": "696453",
    "password": "70617373776f7264",
    "blinding_factor": "16d9379d74dd857d97ed7470bc022290f0aed9d14c8de873c03139360d7c2203",
    "oprf_seed": "089519f6ab43cb90f6c37abe2f4d6ef7928106fd5920c9856d717c6db229d6887b98ea296e8c48f962065e8c224ee1d687b5e9ea9be5c9fd66a1d5edf4326aa3",
    "masking_nonce": "ff24215c44990ee27982e667ed57e1fefe21a38ecae3cf8dad951237ba6166cfef780945009e3cfc031f59552a8d7b84571c7c13722d88a52f2b7d279e27ff84",
    "envelope_nonce": "add2e39416fb5917d1328dd9987b9e8e2ee30c04eb4f4a8ae5c52e63b719846a",
    "client_nonce": "db1f9c4b2e3f4f307d35490a2d9ace7ccd2e124c5a08655bfb97597f24d5da55",
    "server_nonce": "00285d1b30f04f84f020dc60d702581cf36fc8f683b75b1efd21e01056a1a102",
    "context": "636f6e74657874",
    "registration_request": "3025151fce8a32a8961aaf77031402a3d0cf70370052b22b6131c78de82e8366",
    "registration_response": "1a566c5cb551027e996788ad999b14ecd8bc0f230348aef90674e733d946cd6332033f92bfd82242f7dc9b2574f6916a53aa4ef83ecab4f4d912aad9957d8027",
    "registration_upload": "90c46263e6709e038ffd12d5e97eca652800edc492b942a798951da8af74ef289e8fe0c9fef7a8f785445c82f6185f1e8682ae907197ce97ae0521c0f5ce4f636781ad5b5c3f9df7c4af0dfdd0f77ce98846d019cf4189b8f0a793cd59e2b42aca1860c537f99dce6da9d0bf674f7c5c483c7e12c07487821d0fc60b78702a039923ef46ae4f5b0240484250d690a6b1533bc8d5cd89e5b5bb78ebe4cb40d4439275e924b80683c6b8833cb503059bd3bcb083aa72bf70d1d2cb4e6d40cd61d7",
    "credential_request": "3025151fce8a32a8961aaf77031402a3d0cf70370052b22b6131c78de82e8366db1f9c4b2e3f4f307d35490a2d9ace7ccd2e124c5a08655bfb97597f24d5da555898671746f581bbaa9019ea3e5dc5809612960e38f3fd3569237e8d0cf14a23",
    "credential_response": "1a566c5cb551027e996788ad999b14ecd8bc0f230348aef90674e733d946cd63ff24215c44990ee27982e667ed57e1fefe21a38ecae3cf8dad951237ba6166cfd7635651e5f867c08c02e7564b86a03d1b1b198dec5b9b54f998d3bfba0f4fe956d3e795c672c275ac2fb0a5ce38920bc17f532348243f79db5aaf34db507ce41096d9a326ee453f02ab1d1c9b738507fbe87197b13c65720e4f16737f9da173613b90bd5b2ee6812c0462299a7c3b179e439e88af08abf607796e4e9d23e17f7bf9ca648ab766269eeed497f640264cc248caaf94498b3aba2324395d061308a0c9863142b43845b16e9bf9e1d236038a0cf8a470a7291c60e8579dae1e2128d7919f28f7a4ff9fdd915f00b42007aa1de6f9a0bded2cbbf297e923bcef57f42fb06bcfca035fbc66cf74300c54daec3738dbaca2ba470bb81330efab584256",
    "credential_finalization": "6a3f177d73886db031e081e116a1eb7c13ef763a60a0ae8b7477f4fcf6c7d22618651402f3ab7bd501f42442a010a185253c87bb051cca80686b54ceb5c410d3",
    "client_registration_state": "16d9379d74dd857d97ed7470bc022290f0aed9d14c8de873c03139360d7c22033025151fce8a32a8961aaf77031402a3d0cf70370052b22b6131c78de82e8366",
    "client_login_state": "16d9379d74dd857d97ed7470bc022290f0aed9d14c8de873c03139360d7c22033025151fce8a32a8961aaf77031402a3d0cf70370052b22b6131c78de82e8366db1f9c4b2e3f4f307d35490a2d9ace7ccd2e124c5a08655bfb97597f24d5da555898671746f581bbaa9019ea3e5dc5809612960e38f3fd3569237e8d0cf14a23bd61a18173fe09b88529b4c04424637ce066fabc0f077985713ae12457d7b601db1f9c4b2e3f4f307d35490a2d9ace7ccd2e124c5a08655bfb97597f24d5da55",
    "server_login_state": "01410c086ece65443dcbca42c6703d08bae0d293f4b9b78449df626f7f8b04d8cada3f693670e74683f4ec6f9df9d1773fa4212a6ddc52343874bcfb0a87dd82cd25afdbb29dd431c859b337de3123e325d9aa9c99e9a59fd98858c6835e8c34d0945a251261f456ffa67399c8745e478c7377a3774930a49f0b7c351ed654e38d62e93a5ec5cd0305521bcce9695b3ce23b4713a699bd9e1e102049652bc407fc6579cf4c7f8e5e3dcfaadb73a36c49bc2084b82246c01c630dde63a5bbfb40",
    "password_file": "90c46263e6709e038ffd12d5e97eca652800edc492b942a798951da8af74ef289e8fe0c9fef7a8f785445c82f6185f1e8682ae907197ce97ae0521c0f5ce4f636781ad5b5c3f9df7c4af0dfdd0f77ce98846d019cf4189b8f0a793cd59e2b42aca1860c537f99dce6da9d0bf674f7c5c483c7e12c07487821d0fc60b78702a039923ef46ae4f5b0240484250d690a6b1533bc8d5cd89e5b5bb78ebe4cb40d4439275e924b80683c6b8833cb503059bd3bcb083aa72bf70d1d2cb4e6d40cd61d7",
    "export_key": "55833fcf856af07df1ec4d98a2180ca90227edddf53bca6787cb86f40337290491dec6dbc95efd56e15e7f2bb9bea2c2e683b956b1f85b2f9abce2a87cf61e4b",
    "session_key": "8d62e93a5ec5cd0305521bcce9695b3ce23b4713a699bd9e1e102049652bc407fc6579cf4c7f8e5e3dcfaadb73a36c49bc2084b82246c01c630dde63a5bbfb40"
}
"#;

#[cfg(feature = "ristretto255")]
static TEST_VECTOR_RISTRETTO255_P256: &str = r#"
{
    "client_s_pk": "f88bd648ec3275a06d2f64f7f2e35f9b79cef7d6ead6ba05945b700658643e2f",
    "client_s_sk": "04e1b7f9448b6913ff7de5e0b4ccc2f6e88eb6ef80963c75f89db0f634cb000b",
    "client_e_pk": "907bd6c4d780c85415ce1b9e8cff2a6c10bec716d6eab80cf3f9646469033a3c",
    "client_e_sk": "8c0e7d7310db05a12a418c0616c8969855008946702d7d0e2b0b1f10dd24c402",
    "server_s_pk": "681525049da7bedd96b863b95f13859b616aa9729b752676dde32513acfb7611",
    "server_s_sk": "30aa1bf8df6bf6ed30e7c9579e3bda2804dad268ea2d3bc793173a35e895ad00",
    "server_e_pk": "68732765fd7a76511f7c2a50bf7df6efe54efa15b0bfce2ba162ee922c4e0452",
    "server_e_sk": "4961b6b17fef0eb216c13c97e5a2c28db78feddbbbdcfe9eaea937c6fb625d05",
    "fake_sk": "d3fd635217181a826cb07eaad0d6c722e73731a3c719f26322ccef9d2130990d",
    "credential_identifier": "637265644964656e746966696572",
    "id_u": "696455",
    "id_s": "696453",
    "password": "70617373776f7264",
    "blinding_factor": "ce2a220c656632c5bb630351bf2bc9258631acd226c5ecb1686aa82ea5baf308",
    "oprf_seed": "3d108c5667216961a69098fc9a94294cd8761aa4af76c51ea35df3a06f2139f6",
    "masking_nonce": "ef9aebb14f7f965ac8fcba0418a83340646747cb00d056b57f7ba2671945728ce3648bf46c6d2b21890ad09c25142e57360cea1300ed7d74dc0580e61fa5b5e7",
    "envelope_nonce": "23abd8c07fec3913673426fd49f4d2832c29855b5846fea5ffa6d91ede58f6ac",
    "client_nonce": "dff3b604d150842e692aa20fd0621ba8718581fd6fa4a3409108bba35d5f7bdc",
    "server_nonce": "e3d70b5657db6fa047f106843a746091c602d2c2e8280d9ac8994cf39bf93d30",
    "context": "636f6e74657874",
    "registration_request": "03ae0926f45e0b5efab9e15e6acddd7dd4bdbf15b1accccbae1927d5450532229a",
    "registration_response": "03f2a9e0737a10e41a5501f853d2401a89a7c8c626926e6899205357a7d971c238681525049da7bedd96b863b95f13859b616aa9729b752676dde32513acfb7611",
    "registration_upload": "7e7ea08bc8cceb5d89b7ceb8e91deadb721a2ad684272510e85570acb9563451ad667e253cfd587092cfc3a788aec8b0cf3e248d84cc7ff98e7d5488736deb3704e1b7f9448b6913ff7de5e0b4ccc2f6e88eb6ef80963c75f89db0f634cb000bfc47ba0ccf49efab4a706d72cf038a01c6f32fa4fa10a30c6ce94df37a86504f",
    "credential_request": "03ae0926f45e0b5efab9e15e6acddd7dd4bdbf15b1accccbae1927d5450532229adff3b604d150842e692aa20fd0621ba8718581fd6fa4a3409108bba35d5f7bdc907bd6c4d780c85415ce1b9e8cff2a6c10bec716d6eab80cf3f9646469033a3c",
    "credential_response": "03f2a9e0737a10e41a5501f853d2401a89a7c8c626926e6899205357a7d971c238ef9aebb14f7f965ac8fcba0418a83340646747cb00d056b57f7ba2671945728cb166cbc26eadb074abec8888288bb157ba6e995e4983277dde3a8b164e78efcf261a0a2ae4dcbb379a1e651b128bf356108a2be9e10f5e0d95f5e51c748b890b96e6304f8380ee71f623e3bfde447ee58bb60e40281e44f8496e5a799c24506f4961b6b17fef0eb216c13c97e5a2c28db78feddbbbdcfe9eaea937c6fb625d05c0b7b235a518f55c3026b2bc375841f35c3b2e1fc381c3963b721a97d34d887ea4dfb155d59da8ad912aac17df06e6a21b118cac0cfd15903f0c20658fa717b4",
    "credential_finalization": "10653ec75b594a7401ffcde895d463002c3eac839f0343ac779fa9210e4782dc",
    "client_registration_state": "ce2a220c656632c5bb630351bf2bc9258631acd226c5ecb1686aa82ea5baf30803ae0926f45e0b5efab9e15e6acddd7dd4bdbf15b1accccbae1927d5450532229a",
    "client_login_state": "ce2a220c656632c5bb630351bf2bc9258631acd226c5ecb1686aa82ea5baf30803ae0926f45e0b5efab9e15e6acddd7dd4bdbf15b1accccbae1927d5450532229adff3b604d150842e692aa20fd0621ba8718581fd6fa4a3409108bba35d5f7bdc907bd6c4d780c85415ce1b9e8cff2a6c10bec716d6eab80cf3f9646469033a3c8c0e7d7310db05a12a418c0616c8969855008946702d7d0e2b0b1f10dd24c402dff3b604d150842e692aa20fd0621ba8718581fd6fa4a3409108bba35d5f7bdc",
    "server_login_state": "2b6792d84ae19d64f39ae233b54ce79ab8793f9648c24f4bd22df7b4f9e4e6e77fe5ead3ce6faf1d05cbc64518cfe259cfe522b381eadc79019c0c81f613233d91910ea0c4c286eeec89dd2ceec93478f936454f4f41206c75407862150cdf3a",
    "password_file": "7e7ea08bc8cceb5d89b7ceb8e91deadb721a2ad684272510e85570acb9563451ad667e253cfd587092cfc3a788aec8b0cf3e248d84cc7ff98e7d5488736deb3704e1b7f9448b6913ff7de5e0b4ccc2f6e88eb6ef80963c75f89db0f634cb000bfc47ba0ccf49efab4a706d72cf038a01c6f32fa4fa10a30c6ce94df37a86504f",
    "export_key": "b776d68ad88a7534f571625727ce09a13ff203b9c26e16da9aaa1b7698cd1645",
    "session_key": "91910ea0c4c286eeec89dd2ceec93478f936454f4f41206c75407862150cdf3a"
}
"#;

#[cfg(feature = "ristretto255")]
static TEST_VECTOR_RISTRETTO255_P384: &str = r#"
{
    "client_s_pk": "86a1adb5a45e87b1cb92f082a5bf5890e9e21e2d78d4773ab7f0d021664b7b69",
    "client_s_sk": "950ac3b5fcca8fbcc740e24a9f0a0703bf06c1e345459cb662bed0ae91f10904",
    "client_e_pk": "d697f15ff9e34fd51a2a8980995503d17bd11cbb0407d51502138f384f908112",
    "client_e_sk": "c320ee0eb5eef9e6e00872cef1196e362d20712ae9da185e7466397324a72907",
    "server_s_pk": "d0433b254df7a9952f281f10b86d9c4cc14faef3a3c67943a01b208782da620e",
    "server_s_sk": "94985ed3d85392c7957c53b9f24ab138acbdbba80357c79eeccea19602434b0d",
    "server_e_pk": "00ea32a0e605deb301bc73b4df661100d7de331c6e4548b9e5dbf02872fe7529",
    "server_e_sk": "e4d2a0ea0adf9edb4a8d7e0d236ea9022bdcae7d7c24665928c7c9e765ffe700",
    "fake_sk": "26e8e0bf9739b54dafab24a3454cceef1b3c61b0b6e521dc5cba404722517101",
    "credential_identifier": "637265644964656e746966696572",
    "id_u": "696455",
    "id_s": "696453",
    "password": "70617373776f7264",
    "blinding_factor": "454092e5dcb20854d987421466835f4a270bcaffeae8e094a0cd1c4f636946b90bb5d8d0cc2bddfcde1bc97042021043",
    "oprf_seed": "e4d402280ebe5718f2b2887ef5595a6b2020f6fb983b5f117ab7db986e2fdca9675b4bc94ff4db6cd249810ff08bb760",
    "masking_nonce": "ed6dd7938ad35abd1088e892d55706ea3394d88351e18b6574b7b2931210e5b6320a60040a96d8a68f8ca197dc77c9072964e0a267eb4d51bf6327d40ec3091f",
    "envelope_nonce": "866f1e43f59ab3076f7ffa80e3d180d74dfe472a4399378477927ac88e99483c",
    "client_nonce": "c4eb516c8f385cabe449e30bd55975cb8c73b8cd4121e392202c95dc1ca58ff6",
    "server_nonce": "7eba5738ead262ae3288e908cc31126d8755b79471e34a0fed7bda22abdf830b",
    "context": "636f6e74657874",
    "registration_request": "031032c75bd6d20572956af17c27c8a628f493993903e8a2dbd4db1b069f2dacbf05767428f0e4c58150af7d6577c42cc1",
    "registration_response": "024fbffd6d812d62d98009ac0277c0740e3245e98bf3c62a8dda34152b350b8a74f34fb5677b848b45e982d663ee7ae522d0433b254df7a9952f281f10b86d9c4cc14faef3a3c67943a01b208782da620e",
    "registration_upload": "82961e5ba6f42e3dede98b0eb333668f768df6e28335896e1d1c764d45b26101937f31c8f82cda4be30080d8edeefdce8d43a11a8dc089111f48d173d9a057fa35dc0dfe0a59457a6bfec84298d5e4d8950ac3b5fcca8fbcc740e24a9f0a0703bf06c1e345459cb662bed0ae91f1090468008a29cf8f061e01bdc0940a04bee4a49391c2eb3a10552254f3904e2b374a2018fd6153e948d7bb74e47de4b3765e",
    "credential_request": "031032c75bd6d20572956af17c27c8a628f493993903e8a2dbd4db1b069f2dacbf05767428f0e4c58150af7d6577c42cc1c4eb516c8f385cabe449e30bd55975cb8c73b8cd4121e392202c95dc1ca58ff6d697f15ff9e34fd51a2a8980995503d17bd11cbb0407d51502138f384f908112",
    "credential_response": "024fbffd6d812d62d98009ac0277c0740e3245e98bf3c62a8dda34152b350b8a74f34fb5677b848b45e982d663ee7ae522ed6dd7938ad35abd1088e892d55706ea3394d88351e18b6574b7b2931210e5b631a1b6b837aa901a6016382e5174dc0afe05c4c382066c68a4712a9472382b22e0f41eec742cfb4fb44606388b40c4460b87996048768e54f2d130cabead02de5e564ca78adb2f72c45c966cf8feadeecbbefbdab76b21474a1513c098a61e2fb00c6b3e23b248d9d95740d44b81e54ae4d2a0ea0adf9edb4a8d7e0d236ea9022bdcae7d7c24665928c7c9e765ffe700bac9e8a7cec2359871b91d1f87d975888ff28262c2520d729a48f27e6c8f722b7b778392ded7de3648a63e312aaca0dfdac3177583b016d64ee3735f983e2b1dbe622fa1f92d9a38fe55550948416592",
    "credential_finalization": "17a0cf86d1021759062b89f802a798b5d2492f7373462e1b75d6197a21d599e1f16b0fafad97ba72b0ad69683e69a145",
    "client_registration_state": "454092e5dcb20854d987421466835f4a270bcaffeae8e094a0cd1c4f636946b90bb5d8d0cc2bddfcde1bc97042021043031032c75bd6d20572956af17c27c8a628f493993903e8a2dbd4db1b069f2dacbf05767428f0e4c58150af7d6577c42cc1",
    "client_login_state": "454092e5dcb20854d987421466835f4a270bcaffeae8e094a0cd1c4f636946b90bb5d8d0cc2bddfcde1bc97042021043031032c75bd6d20572956af17c27c8a628f493993903e8a2dbd4db1b069f2dacbf05767428f0e4c58150af7d6577c42cc1c4eb516c8f385cabe449e30bd55975cb8c73b8cd4121e392202c95dc1ca58ff6d697f15ff9e34fd51a2a8980995503d17bd11cbb0407d51502138f384f908112c320ee0eb5eef9e6e00872cef1196e362d20712ae9da185e7466397324a72907c4eb516c8f385cabe449e30bd55975cb8c73b8cd4121e392202c95dc1ca58ff6",
    "server_login_state": "1ac407a2442a2b126afd56a7790d790c1dcbd16b3d9d89963267f26c798a0266d896e8c1daa912d5933be902cfa301e42f1fe785b8429087cc492f9e8731139628530254e4524a0df9a6840748dc8bd12b65bf3141f09a696b55760bd4f65fc3e952e42d4d61618bd93459e43b4ee699eba8d9d3ed3c0c31bd605b654e9fc289a87799c43267570e7644c16436463fd0",
    "password_file": "82961e5ba6f42e3dede98b0eb333668f768df6e28335896e1d1c764d45b26101937f31c8f82cda4be30080d8edeefdce8d43a11a8dc089111f48d173d9a057fa35dc0dfe0a59457a6bfec84298d5e4d8950ac3b5fcca8fbcc740e24a9f0a0703bf06c1e345459cb662bed0ae91f1090468008a29cf8f061e01bdc0940a04bee4a49391c2eb3a10552254f3904e2b374a2018fd6153e948d7bb74e47de4b3765e",
    "export_key": "6507d9329bb8fb8468d7fbf89781f02e3d56e887aa8cd0e56b622bb9b2cf78e079000936c0cbacdf3acbae65b929f143",
    "session_key": "e952e42d4d61618bd93459e43b4ee699eba8d9d3ed3c0c31bd605b654e9fc289a87799c43267570e7644c16436463fd0"
}
"#;

static TEST_VECTOR_P256: &str = r#"
{
    "client_s_pk": "032d82f5e7db19c5f87db1cb296d5f847315e98aa4ae2f14cb94fe9fefae5b23a1",
    "client_s_sk": "4c2bd02fd037cfe6aa8aa243bbf0419c6f4196565470192554bdf3da966ae1d5",
    "client_e_pk": "03b2ee310f831c43b6ecf8683ab3a0f903f4c54d42b5851652667d24a051805e54",
    "client_e_sk": "11fd841fa4c27ed5849632ce256a242c526f1f828e170a68800fa4a7a9c93047",
    "server_s_pk": "022cc9aadeaed45bdae85464af1512614edde6adf97c1407d6721e5cd1a985734a",
    "server_s_sk": "e6334d73a9a34212886d4c4b7368df72f06a90b2887e5632f0eadad4cc8c9d3d",
    "server_e_pk": "03ca02f4d31f1e66624dc21864e410876f2dc8fdcfff031090f170736d73060a10",
    "server_e_sk": "6a6b22ac2bc7bd6401cc2e42f588a4550651cbd30d9529b69ebb88d7b073e6a2",
    "fake_sk": "8362d70183ab78942b21ae3cba95f1edb5d314fb2f2afa49a452222a02f6dcc4",
    "credential_identifier": "637265644964656e746966696572",
    "id_u": "696455",
    "id_s": "696453",
    "password": "70617373776f7264",
    "blinding_factor": "87700138241d25149a2ca6fd9a27e7f9d71a8e718fe1c411862a975cdb17a413",
    "oprf_seed": "8b10b0445efce9c59e6e5a39f89961722fba14a809068620b9d77433bafb254e",
    "masking_nonce": "52b2cf34ba108ffd2ef1e516585d845b90e34af198f379b6465744f5812274680c5dc1dca7e6a73a4dd48159cbd4b35913ff51bac2605a63563602e681aeb171",
    "envelope_nonce": "f97a0c9a7de14b073531d24ba6d7893191a2724fffa6fe242099c17c6640e210",
    "client_nonce": "4c5dbddfb063ecba7fd528c0caec52893ef206bf86362dafb27fe13d96e0b538",
    "server_nonce": "fab1f9fa3f0356fc5d9b766ea3bdd53884ab38bac8371842d047a3b815c79428",
    "context": "636f6e74657874",
    "registration_request": "030e9bc97e025d9b5eacf7e76b16ada9a568401c509d2d1c507914c56d820be7ea",
    "registration_response": "03dc5d4ba61011266879896966f26fde5e188a5d30df17deca56d5e227efbc8102022cc9aadeaed45bdae85464af1512614edde6adf97c1407d6721e5cd1a985734a",
    "registration_upload": "035153b60a0f66ddf3d45d00c6bf6506a0898e6d438f1f73fbec916d538f6b43b042eaa5fe4bb07b55cce02bdc53225886bff138edf3a57a7f28d256d52b1755c84c2bd02fd037cfe6aa8aa243bbf0419c6f4196565470192554bdf3da966ae1d5489d88b7908412724d6c28f209a1c45ff7d509cbdb67b017c08802a4532e04d5",
    "credential_request": "030e9bc97e025d9b5eacf7e76b16ada9a568401c509d2d1c507914c56d820be7ea4c5dbddfb063ecba7fd528c0caec52893ef206bf86362dafb27fe13d96e0b53803b2ee310f831c43b6ecf8683ab3a0f903f4c54d42b5851652667d24a051805e54",
    "credential_response": "03dc5d4ba61011266879896966f26fde5e188a5d30df17deca56d5e227efbc810252b2cf34ba108ffd2ef1e516585d845b90e34af198f379b6465744f5812274682cc3c3b734abf18e0ee058a9983f91017022b220d76a7bea6a99e7a7ca8bce9dfe0d670272cdfe25136f9bf00b4607a79133c37f367da3e8b9ead9059f40a2bca60b7d99ba5a2557de3be49de1b62e5771a2855d1fbce37ffbf403ca5fa3a37c3b6a6b22ac2bc7bd6401cc2e42f588a4550651cbd30d9529b69ebb88d7b073e6a203e0f0020d7d9a024e799db237b7dedc4faa8a4a8ce17e93ff490ea66ebc654ba67c17359620d1e627a528c40c961d55d77de2882a9c510ea920974f1ddc97f3c5",
    "credential_finalization": "a6836d9d17ed9a5e7c562002058f0a68e1c41925f7736e959965811b6e3e0783",
    "client_registration_state": "87700138241d25149a2ca6fd9a27e7f9d71a8e718fe1c411862a975cdb17a413030e9bc97e025d9b5eacf7e76b16ada9a568401c509d2d1c507914c56d820be7ea",
    "client_login_state": "87700138241d25149a2ca6fd9a27e7f9d71a8e718fe1c411862a975cdb17a413030e9bc97e025d9b5eacf7e76b16ada9a568401c509d2d1c507914c56d820be7ea4c5dbddfb063ecba7fd528c0caec52893ef206bf86362dafb27fe13d96e0b53803b2ee310f831c43b6ecf8683ab3a0f903f4c54d42b5851652667d24a051805e5411fd841fa4c27ed5849632ce256a242c526f1f828e170a68800fa4a7a9c930474c5dbddfb063ecba7fd528c0caec52893ef206bf86362dafb27fe13d96e0b538",
    "server_login_state": "f7954aa457f509c7695b9e3313a7a445086cb7c0340f75249544d638fe2faba161395f0bfaeb1f56bfb8c93b56b5cb77e5e63c15d328e7e5bb4310e92cb2cdd867e4fa4ba1fdae0282a7b8dadb9bb30081ff2fd351c3ff24dac160d46e3192cb",
    "password_file": "035153b60a0f66ddf3d45d00c6bf6506a0898e6d438f1f73fbec916d538f6b43b042eaa5fe4bb07b55cce02bdc53225886bff138edf3a57a7f28d256d52b1755c84c2bd02fd037cfe6aa8aa243bbf0419c6f4196565470192554bdf3da966ae1d5489d88b7908412724d6c28f209a1c45ff7d509cbdb67b017c08802a4532e04d5",
    "export_key": "dfaad05e13c091a4cd11d9342bbf361111bfd7ae0b09866175a6c76403afef15",
    "session_key": "67e4fa4ba1fdae0282a7b8dadb9bb30081ff2fd351c3ff24dac160d46e3192cb"
}
"#;

static TEST_VECTOR_P256_P384: &str = r#"
{
    "client_s_pk": "02ffaa7a9ad8d8fbdf51462333be3baf795e927626afc30a825299b2738be56e64",
    "client_s_sk": "867143397117121b3cf8bbbdbb577e7a3ec3de33a5d052e6ea5e736d8da5243a",
    "client_e_pk": "02d71ac13b7c461a0aff3ffcf6fb43961f3cc78d159a88190e11814cf8c1c47e63",
    "client_e_sk": "e48b752d3f498fbd8e605e95a076f342574b6d6717483fe11a8f8bb1f7f404a9",
    "server_s_pk": "03b0c19cb4a9c38a4f8dfd3108d346153612258eda0a918a66898ead514a087484",
    "server_s_sk": "799ec708dff22260a940b1daab1bf246f7dc0b3ef36edf5e325e4783ed580b15",
    "server_e_pk": "0266a3ee38dd097628288b9f12ddcd8ba2d581dd3f390bc82c88019fb6da84b4ab",
    "server_e_sk": "2d40040888e6eabc3ef1192abe45de7e72de591e88f9cb85624f6fe69a829abe",
    "fake_sk": "1f63b1381351cdee56bb69a649210a0e401946033210a1d1abb310ee84b057be",
    "credential_identifier": "637265644964656e746966696572",
    "id_u": "696455",
    "id_s": "696453",
    "password": "70617373776f7264",
    "blinding_factor": "898b728c633b5f335da29527ae279122049cc0a48adde3de699707f9008e58808383b39014554696359c1ff9198092cf",
    "oprf_seed": "a681bb60cbc5f65264fbdd29b487fb7eff1bc1b1fad69ba6dad7d802714251fcadd91cbddb9d203be691c99be04dd3a9",
    "masking_nonce": "596d13dbdaf0a67f38ab3560f1a8ad539f6879365d2499c35c61822ab457656b5d3102a21c019920324671b47f0c86e6d573179babcd8b87980804a0cec8655c",
    "envelope_nonce": "027b3fe224cd45ea4a88125341fb12f903c36665fcfd9f86e20e91b094e935b3",
    "client_nonce": "86c1a1f3bf1872e0f19ce42ca68f4e69c0c7fa2bcd0f9728af650b849f35995d",
    "server_nonce": "f649bf73c6e0625c8c204a300b6da5f9efcd182634df70175e6cfeb74bbde7ed",
    "context": "636f6e74657874",
    "registration_request": "03b9f9c8b76887dd8c74246c02bf77a29af14cb5ba2b02e13992db2c8c87f48068c040a9898dca0d4122e42ccf65219522",
    "registration_response": "038fe2c1e3b7d968e312b48077edd6545550fcabfdfa25b9420c78c8331dc413028fe973e15270b96673c101ce98c944c303b0c19cb4a9c38a4f8dfd3108d346153612258eda0a918a66898ead514a087484",
    "registration_upload": "02e07f9bd7377e8275dd95713f4a8de1a13699f61359b69095cfcada7efbb1ab72b8ff9db6b14b4f8bcb1bf6978cf1b02ce7c75af8d63433d6a75caa620ad851cde67df132e8e71a92c2f6cc137c09ddfd867143397117121b3cf8bbbdbb577e7a3ec3de33a5d052e6ea5e736d8da5243a4f30fd6be311843b3b8309d41a0a11f5f1d42eadc5539959457a6eed12d4adfb599fe45a546effd7dca5dcac5b5ff498",
    "credential_request": "03b9f9c8b76887dd8c74246c02bf77a29af14cb5ba2b02e13992db2c8c87f48068c040a9898dca0d4122e42ccf6521952286c1a1f3bf1872e0f19ce42ca68f4e69c0c7fa2bcd0f9728af650b849f35995d02d71ac13b7c461a0aff3ffcf6fb43961f3cc78d159a88190e11814cf8c1c47e63",
    "credential_response": "038fe2c1e3b7d968e312b48077edd6545550fcabfdfa25b9420c78c8331dc413028fe973e15270b96673c101ce98c944c3596d13dbdaf0a67f38ab3560f1a8ad539f6879365d2499c35c61822ab457656b967df0a08fb74ca0bbbb915587e55808699b877c9d9f7370e0ba290f3d95e175d66fb98adf8f3aff5b9c06a5dd2a7b5d20a2a76a4f2dc6ef5a67113461a85a03174b585c78445c7a6b1438edd882f75cb56e380f4447e3d366430ca3f2ef372e439b5bb7ac2e1f9dc5b3487232e60a1ddf2d40040888e6eabc3ef1192abe45de7e72de591e88f9cb85624f6fe69a829abe033f366e71bf3f7573a431bac0b35aa60db23b40d2003af7d8eb5f55940b75af3e62ea7b191b1f5b9fae34bb92f0c10b06b95918e784f4afb06c846c254113bdfb3a5b5ca81890dc601dfdb80fabb3865d",
    "credential_finalization": "188fe8130fab154ddf481a80349f50685d160e6e1db4d11acdff51e1b5d617032e8a62b39e43116f2ffc3651df61995b",
    "client_registration_state": "898b728c633b5f335da29527ae279122049cc0a48adde3de699707f9008e58808383b39014554696359c1ff9198092cf03b9f9c8b76887dd8c74246c02bf77a29af14cb5ba2b02e13992db2c8c87f48068c040a9898dca0d4122e42ccf65219522",
    "client_login_state": "898b728c633b5f335da29527ae279122049cc0a48adde3de699707f9008e58808383b39014554696359c1ff9198092cf03b9f9c8b76887dd8c74246c02bf77a29af14cb5ba2b02e13992db2c8c87f48068c040a9898dca0d4122e42ccf6521952286c1a1f3bf1872e0f19ce42ca68f4e69c0c7fa2bcd0f9728af650b849f35995d02d71ac13b7c461a0aff3ffcf6fb43961f3cc78d159a88190e11814cf8c1c47e63e48b752d3f498fbd8e605e95a076f342574b6d6717483fe11a8f8bb1f7f404a986c1a1f3bf1872e0f19ce42ca68f4e69c0c7fa2bcd0f9728af650b849f35995d",
    "server_login_state": "6c196b4c6cd855c215852c5c11fd1590038eb9d7c69adc062777e3fed1464526d6a8aafd04e9a5845b32bc92bab852520200c994e54b7c3a8844c75c7952d1c0d2cf5232bd3fe6fa24d7b74e6373ccf66d48ead98331257efc320a16864908f4fce34bf2c26ec5f73072d3522d3b42306dfde8ce0b6827dff1202bd1ca11e767d758b4237c30e30d8878db1ebd4bb595",
    "password_file": "02e07f9bd7377e8275dd95713f4a8de1a13699f61359b69095cfcada7efbb1ab72b8ff9db6b14b4f8bcb1bf6978cf1b02ce7c75af8d63433d6a75caa620ad851cde67df132e8e71a92c2f6cc137c09ddfd867143397117121b3cf8bbbdbb577e7a3ec3de33a5d052e6ea5e736d8da5243a4f30fd6be311843b3b8309d41a0a11f5f1d42eadc5539959457a6eed12d4adfb599fe45a546effd7dca5dcac5b5ff498",
    "export_key": "431c7293c534c3a555c36ac8b665130066c667b26f86403b3b3e1f06c5e941447f52976265a234fcb0edf4bdef99aaff",
    "session_key": "fce34bf2c26ec5f73072d3522d3b42306dfde8ce0b6827dff1202bd1ca11e767d758b4237c30e30d8878db1ebd4bb595"
}
"#;

#[cfg(feature = "ristretto255")]
static TEST_VECTOR_P256_RISTRETTO255: &str = r#"
{
    "client_s_pk": "027e83df2e0b7380bb430352afc9326a63cd53d6bf6955b60114ae56a9ada8a005",
    "client_s_sk": "125dee3f99fd11e6dfc10f3269010644abbe1676856c1fd28c3f1c11fb12e8a9",
    "client_e_pk": "02e1a67fc34629e5d0bc6c7d2873673e873514114e15a72a27e71fde337351ab79",
    "client_e_sk": "3ba3bfd9cf3b5970a7557260fbd9c1f5480ad2434f3ca788bf0e298e3adb1728",
    "server_s_pk": "0363418a22f5e2d041a3cc49ac195bb72c484fe2422756874eea2502b1f37265f2",
    "server_s_sk": "9ca7d0b89c84808c6a3a234383f2a400171d0362fd9cd66874a812b29309aea7",
    "server_e_pk": "02d3da0962e20af7c63624aff08fcf98f622cdc75d1c475bdec059064cb176da41",
    "server_e_sk": "7c7aea17291d0c297fc2685c2876b0b57a67b91dfa7d20edce1872341c86a74c",
    "fake_sk": "2fb1ab3f8edf772701cc7c2a4773ac7441fc17157c00132d0bc4df63703953c3",
    "credential_identifier": "637265644964656e746966696572",
    "id_u": "696455",
    "id_s": "696453",
    "password": "70617373776f7264",
    "blinding_factor": "5b4e8ccffa209c8df0ec71d0d1092de288ae05e472e71f9f95ff8d4b34a45a0f",
    "oprf_seed": "a519f2078900c38d7764481978296720f9b02b472e5aa5e08a32ec1d72c23dc2e3fbd680d367668ce032f45c214aa4efe76b4722f487732aed6c4063a5ab067b",
    "masking_nonce": "4e3843835669dac4e6875c1627391e2a5589d4f4a3cfb507f0956c16566feb62692db88b2fbaf002a729a31afecbc016e06b004b11c8f9f53d10430c51db1c9f",
    "envelope_nonce": "d9d3327bd827540d1e5f267605c222cd154c5da6dadd43845d8498c58420fc06",
    "client_nonce": "246142ff274fe7c3385f6268e7e9c0c1ae2804c664308cec59d2cd0e5af683a4",
    "server_nonce": "4f9277be8c0deeccb8c67c5312332ea8fc268360c9a46603c2f5f06f94e45f37",
    "context": "636f6e74657874",
    "registration_request": "0ca151ef38b3b82f1b2166b6627671943ae8371b207dadfc4c4ccbc93db0fc51",
    "registration_response": "ca2757e756faaed5e3956fff22ed9d7f5e7114856b11753b3f84f904831d8c290363418a22f5e2d041a3cc49ac195bb72c484fe2422756874eea2502b1f37265f2",
    "registration_upload": "0273a4a83ef4a4c014623a59d3188370e4592b0c1d2d695dda98a07339a1536e77c5aab89c3434cfb25289d087d3f35680d82a3eaf34b539317a82a219652e2bc1b151f423e945eab65a598624a9328265f91a8e69f5975c7517905db6091894b2125dee3f99fd11e6dfc10f3269010644abbe1676856c1fd28c3f1c11fb12e8a90944628ebe4b83026cca4f2b719ab0e836c01f42bc854a2262f7f0cfcf83b026426371c91a3a3f6ebc47225e092b76fb54636aec37618815f2ba0f9da6290def",
    "credential_request": "0ca151ef38b3b82f1b2166b6627671943ae8371b207dadfc4c4ccbc93db0fc51246142ff274fe7c3385f6268e7e9c0c1ae2804c664308cec59d2cd0e5af683a402e1a67fc34629e5d0bc6c7d2873673e873514114e15a72a27e71fde337351ab79",
    "credential_response": "ca2757e756faaed5e3956fff22ed9d7f5e7114856b11753b3f84f904831d8c294e3843835669dac4e6875c1627391e2a5589d4f4a3cfb507f0956c16566feb624c697ec15f81508a6d26927d6240ec09672cc5c6afefba3e6ad828b722c2f13ad1814ee338fbe739ce915c8c77e65a0c1c6baf42e96474997c9eaf8a3c828bf609f60be9d98b30e4d86b14717b16929839e77583d990205a05689ac46773e83e6b35f95770c9c5919484c4e9bed34a85d1ee7db3f9914329f9f559bbed677f8a457c7aea17291d0c297fc2685c2876b0b57a67b91dfa7d20edce1872341c86a74c02c44f9047c059de10dc36ce904b3f1754dbee6b1e0657a194d563db45348198b3448dc365a3112a25c17fd5d02837cb4cb342ca831ba383b61ca684f9afdad1dab235ecd48f3c093bce9ca95449a1b26f7f2cb51b882ee5757ab3b99a078e0670",
    "credential_finalization": "156511d3bed0e04bb931e21d4e01203ecb8035c8f2a13203a6d7c76156bd98c70161ec4dd434a0da576d7841483d2d6468e2d2df6b046a132a13a148be9f2ed9",
    "client_registration_state": "5b4e8ccffa209c8df0ec71d0d1092de288ae05e472e71f9f95ff8d4b34a45a0f0ca151ef38b3b82f1b2166b6627671943ae8371b207dadfc4c4ccbc93db0fc51",
    "client_login_state": "5b4e8ccffa209c8df0ec71d0d1092de288ae05e472e71f9f95ff8d4b34a45a0f0ca151ef38b3b82f1b2166b6627671943ae8371b207dadfc4c4ccbc93db0fc51246142ff274fe7c3385f6268e7e9c0c1ae2804c664308cec59d2cd0e5af683a402e1a67fc34629e5d0bc6c7d2873673e873514114e15a72a27e71fde337351ab793ba3bfd9cf3b5970a7557260fbd9c1f5480ad2434f3ca788bf0e298e3adb1728246142ff274fe7c3385f6268e7e9c0c1ae2804c664308cec59d2cd0e5af683a4",
    "server_login_state": "00f0c2c254202ccf13ae33839e39a895a23778a8063334ba699cc4157646951fac5da2dc3363fc5cf051157b5f092c1d662ebe258211b02a051335aed2372387e8de8436dcd35b59eed28f6ca2cd4a0e969456e435393fabd0aa6b5e437018c49697c130b7075c7bc3deedb60ead5dd3b4b1f1cd8a86586f26fb1fca907bf27c9c97cc96869f519d4139e5ed967f4b82cee172a06c72702699d194ee49424bf11f73bf6ea75fe40712b3e9c7ae85328a02dacb453f7a95820836026f20dd4815",
    "password_file": "0273a4a83ef4a4c014623a59d3188370e4592b0c1d2d695dda98a07339a1536e77c5aab89c3434cfb25289d087d3f35680d82a3eaf34b539317a82a219652e2bc1b151f423e945eab65a598624a9328265f91a8e69f5975c7517905db6091894b2125dee3f99fd11e6dfc10f3269010644abbe1676856c1fd28c3f1c11fb12e8a90944628ebe4b83026cca4f2b719ab0e836c01f42bc854a2262f7f0cfcf83b026426371c91a3a3f6ebc47225e092b76fb54636aec37618815f2ba0f9da6290def",
    "export_key": "47c8aeb7e4b5fcb65728f8b2b07e7d0112496c3e72e5ecb17f00794e90d00fb4e4a9f8f2dccfdd19df8302e3c38d2b7f819ff373c3c829e34705e54dd95fcb09",
    "session_key": "9c97cc96869f519d4139e5ed967f4b82cee172a06c72702699d194ee49424bf11f73bf6ea75fe40712b3e9c7ae85328a02dacb453f7a95820836026f20dd4815"
}
"#;

static TEST_VECTOR_P384: &str = r#"
{
    "client_s_pk": "02d30caa7523fe782794a4dafdc34b236b3ef01a887ed6f705ff4644cb06df4140cfeaeeeb123d8a4394c485cf6c930fab",
    "client_s_sk": "26f4f688d5c314da59d08a7672d444ff48c3580fd02ed9998a3906d507c506bf7059f166bec930032afc7fa59fdc6455",
    "client_e_pk": "022d5b9d95e3686a8274435bf61414a0a371bd1351760fed07da6b281a419aef32c1b9b1eab59222111198d30ed63c7cbd",
    "client_e_sk": "319076296bb7ce07bd9d383d7bfc6544222b99938e0ec627e7e284391f55e6a98b076a7843f383cbe802a907584fd271",
    "server_s_pk": "03801a686045ee201b54f8367fc5a3ce577a5310b6431eadbf4abbf2f87213cf8b3853875f7f7badb10d029fe0c6f1cad4",
    "server_s_sk": "209af74445ade701f4a99011c8e7304e3914ef9101fd92ea8b62d8ae6220a446cf544ca0eaf22552a21b149fc5e12008",
    "server_e_pk": "021fdb138cd5b99a905285673be1b62085de588b4921ea35f3188aa6d4a57159d072ebda60a163996641473cd82e917633",
    "server_e_sk": "061bc6ed455e852e8ad7eaf6836bbf061642043e48aef18416575071dc976577296eca9902af72c0d59e324e96abf34e",
    "fake_sk": "3232e916073a895b65040efcec1a4038bf2fc4c41f8ae2e66bbccc5cf9ce8e31ca84e609b29af7207556452a4ebcf023",
    "credential_identifier": "637265644964656e746966696572",
    "id_u": "696455",
    "id_s": "696453",
    "password": "70617373776f7264",
    "blinding_factor": "6522c4e1432f30cdf2d3ad20ddb2677ef444a9447ccb643992a545ed1c9a8c255af28ec952ff87046256a0d942c4be48",
    "oprf_seed": "0b2ab841c8c79a53710e424a768939d9a36fc5baffc4fad5e8731736c831b3750f61010140ef62708b58dbc0734c4228",
    "masking_nonce": "3df9ef31bbf2e58364690728a86862b5bb9b6cfb874631006b3fc8da98e13c4a196cf0ae225742a918be575c1f98c5c54ccaa679c55693834d2d7e0ad7374f29",
    "envelope_nonce": "b358bd034c790212f83b8b9d2f1373a5067314392e244606292856afc9020405",
    "client_nonce": "c14909f325841eed32aae25899d84c7044c2223e58a18f715977df310e2c2e7d",
    "server_nonce": "8c4e71dab0435f22238d5e1ae8686d694ca8f6f0131ad5e106b6a909a53de050",
    "context": "636f6e74657874",
    "registration_request": "03182483430a1dcccd138466a63f05f523e44f2d0078fd9f21d0c3e145137437ca75f187d38d0d2b806b0c1f21fde2207f",
    "registration_response": "0256a3f872e6307d2b7c93aee4573a3d18a61ac0cff31d5e2de354f36728663d4f491a040d1b88f2abd7594f2e5cd130fa03801a686045ee201b54f8367fc5a3ce577a5310b6431eadbf4abbf2f87213cf8b3853875f7f7badb10d029fe0c6f1cad4",
    "registration_upload": "03c8c502f79257e6d92cbfe79767b539fd4e0dbec4fc6543bf9191587986a6e205b899f38ee12a383420488a69d6ce104478ee84a8c4031e77d13a8a8d42041d78ff48e67a970e399d4333812ae0579fa18b2eebcdf6c6fd3f1d180bca053c941726f4f688d5c314da59d08a7672d444ff48c3580fd02ed9998a3906d507c506bf915bdbf6215beb014ea81a290fa38804957f72f2b7473bf33d7e7cecf84f3edf5c67aeebae6b538c6a629a9046719966",
    "credential_request": "03182483430a1dcccd138466a63f05f523e44f2d0078fd9f21d0c3e145137437ca75f187d38d0d2b806b0c1f21fde2207fc14909f325841eed32aae25899d84c7044c2223e58a18f715977df310e2c2e7d022d5b9d95e3686a8274435bf61414a0a371bd1351760fed07da6b281a419aef32c1b9b1eab59222111198d30ed63c7cbd",
    "credential_response": "0256a3f872e6307d2b7c93aee4573a3d18a61ac0cff31d5e2de354f36728663d4f491a040d1b88f2abd7594f2e5cd130fa3df9ef31bbf2e58364690728a86862b5bb9b6cfb874631006b3fc8da98e13c4a42035f0afefe847d522d37a6a7e40965f1c81ebfda02b4632df08d7f8136ed222dcf9c723cefa9deb7fb60a4df1682bf9ff2906db5af47728b8ca3815ce820c4677787e631a39e6912ba7705a634c251bf420771a9cac8436a2b53b524b60f9e0047d97bad37d741e5abaf710b9c81bff8ed6d84a319c62dcbab952221e0e9d9511642043e48aef18416575071dc976577296eca9902af72c0d59e324e96abf34e025a82f2ecec7de30ae500fe0efc1b9b6bf925d0ec00b2e21e8a446acc37f063f5f77703d6cc87c3c688f4430fd8c6875a8abe86e344e263b4a450dd7a4684f26052c244defcec09768c6d305b73e09d8e9135228d98c8b84cc586d8cff97bb675",
    "credential_finalization": "8c0e0cf31d1490a4678994bc4f47e8a5e1b4380d770881d000370ad8c5ef3ffd2e8d7f6101e9411e453a367a65ff146d",
    "client_registration_state": "6522c4e1432f30cdf2d3ad20ddb2677ef444a9447ccb643992a545ed1c9a8c255af28ec952ff87046256a0d942c4be4803182483430a1dcccd138466a63f05f523e44f2d0078fd9f21d0c3e145137437ca75f187d38d0d2b806b0c1f21fde2207f",
    "client_login_state": "6522c4e1432f30cdf2d3ad20ddb2677ef444a9447ccb643992a545ed1c9a8c255af28ec952ff87046256a0d942c4be4803182483430a1dcccd138466a63f05f523e44f2d0078fd9f21d0c3e145137437ca75f187d38d0d2b806b0c1f21fde2207fc14909f325841eed32aae25899d84c7044c2223e58a18f715977df310e2c2e7d022d5b9d95e3686a8274435bf61414a0a371bd1351760fed07da6b281a419aef32c1b9b1eab59222111198d30ed63c7cbd319076296bb7ce07bd9d383d7bfc6544222b99938e0ec627e7e284391f55e6a98b076a7843f383cbe802a907584fd271c14909f325841eed32aae25899d84c7044c2223e58a18f715977df310e2c2e7d",
    "server_login_state": "79814d2b3ba60f503d5ac2a71cf10e66ef8f0d3af2cfcb20898415721147c48458b752bbd88d86c3399addfe7e1adca52f32055b893d59fb1b4c16b8bca49a6c425cb713061ea35d73472b9a70059f9007e0e881d934ae2d2f8b2cfd2a2ea2607aa2592bc9b387e4776df01efd287465a729a66b17550afd9a540536c437e89084d101d66afbf0be092f4b0ab1167ac4",
    "password_file": "03c8c502f79257e6d92cbfe79767b539fd4e0dbec4fc6543bf9191587986a6e205b899f38ee12a383420488a69d6ce104478ee84a8c4031e77d13a8a8d42041d78ff48e67a970e399d4333812ae0579fa18b2eebcdf6c6fd3f1d180bca053c941726f4f688d5c314da59d08a7672d444ff48c3580fd02ed9998a3906d507c506bf915bdbf6215beb014ea81a290fa38804957f72f2b7473bf33d7e7cecf84f3edf5c67aeebae6b538c6a629a9046719966",
    "export_key": "b05096e7ff9666fb3845c8ef552b69332b96d3ee63ad46c3da497d0ea85bbe8ee866f7fd606f958ecd08a2100adaa8fa",
    "session_key": "7aa2592bc9b387e4776df01efd287465a729a66b17550afd9a540536c437e89084d101d66afbf0be092f4b0ab1167ac4"
}
"#;

static TEST_VECTOR_P384_P256: &str = r#"
{
    "client_s_pk": "0254911f1d17aee72f5b891cfaeb8d0b0e68e9db9fb25f2dc42d672382f45b01e559639dc93a21a294461318be76144819",
    "client_s_sk": "526e10a69a7f9c7ae685defcd8dc4f23f2b668f63cf558c9d76cdb83bbb5b216ef9e91763fa2e015c66ec827316131cc",
    "client_e_pk": "03a01066dccb456e0e4a238d7afd1dcc788283154f0f7936295b950b316c66d0f52376b26e64585da98308c1ceea732c93",
    "client_e_sk": "6de338c62147b2f5cd9579109b40584768e7dc1ae451f7d566fb28011bc13c180f3f1001a700c59488716b45011ad5e6",
    "server_s_pk": "03df5ea7a932ff02124130743543236f3b8de290a1f27c8b9d518112beb72c527a8818a13914cf27c2375f75f832a23093",
    "server_s_sk": "fd59eb004849e24eb70cd7d6e1ddcd87afae0743b82f2921c0bfe093831db2f17d031c4d63af482c778002394e3cb9ae",
    "server_e_pk": "033b51d2ec7c6d8db890b5dbc0eaf13298ff25eb516249c2f367d84cb45d1717ed55f1b46f8b142ca899d480cc8a493e86",
    "server_e_sk": "81443e69a1cc93d7a779235de18be512a0bfc4a2288b16e5323092e54ef4139dac21ed831d34e78e7d03dff908cae373",
    "fake_sk": "05ef5e97565fa9fc1f485e4aad8516ad9104533397b2bac011aec371c2e98938a9b09b66fed328d4c9ca7bd1c941792c",
    "credential_identifier": "637265644964656e746966696572",
    "id_u": "696455",
    "id_s": "696453",
    "password": "70617373776f7264",
    "blinding_factor": "3f3ff410cb7927e1ffe1d1c0f0d2360f49ef04effc2242782f155c858b50c4d6",
    "oprf_seed": "9c98df8aaf13048694099325ff6bea1ddee273bf632e192c25fdf4a748d95a91",
    "masking_nonce": "e4315a82379378b7d190c95a24d62871ec68b6b47f206d03a9ae0c27e6397556f50ecae65da56ee71155638cfdc932e8ec1997c16a96be1f55631977618c0b09",
    "envelope_nonce": "26c52be641cd24569f0b566bb6fc3a8f6490229bac9ffef3345170be8d1135e4",
    "client_nonce": "0f0f56edf27a8591093e280f79f6b304a003a4aab3565a59d4c4f6ea1e27e76b",
    "server_nonce": "42679ba32e3301bab082c2d9580ea367cd8b737f422315329213c8b0dd5c2254",
    "context": "636f6e74657874",
    "registration_request": "030d2425e25d95ca6380beac64813feb5b127681fc2d3d37814a453f3815fb28dd",
    "registration_response": "02c4610c2be8d4e308b8a31d9f4ea07686631b8237adfd7bbebd8c8c3be951d7d603df5ea7a932ff02124130743543236f3b8de290a1f27c8b9d518112beb72c527a8818a13914cf27c2375f75f832a23093",
    "registration_upload": "02120a5aada0251e2a005bddd90a69003b97b8343467a25010e5a5f444c3cfb74ad562c4b4dcb66dc4083a81516e99cf0f4b77b4a187e359ada76ffcc29ba6e895aa3e2b1386be6eed16ad865b92d4f130526e10a69a7f9c7ae685defcd8dc4f23f2b668f63cf558c9d76cdb83bbb5b2162335ec8cc8815e9d4e604a48e1248be2bd92015103fe0396a167d7f5e031c640",
    "credential_request": "030d2425e25d95ca6380beac64813feb5b127681fc2d3d37814a453f3815fb28dd0f0f56edf27a8591093e280f79f6b304a003a4aab3565a59d4c4f6ea1e27e76b03a01066dccb456e0e4a238d7afd1dcc788283154f0f7936295b950b316c66d0f52376b26e64585da98308c1ceea732c93",
    "credential_response": "02c4610c2be8d4e308b8a31d9f4ea07686631b8237adfd7bbebd8c8c3be951d7d6e4315a82379378b7d190c95a24d62871ec68b6b47f206d03a9ae0c27e6397556e9aa0bfbbab92e92dd3a8e20799eba9ca690e2a7178256c394d413e9ea29321322ca32d89b4988835bc56366def8916684bdf2a06198f9535f898e35736ac1679925faffb6584c2ddf7d38185a095c5a471073142df269826c8a7baadf69ed8a3923d7b2a7073dfb2aeb780b75ab8cc991a0bfc4a2288b16e5323092e54ef4139dac21ed831d34e78e7d03dff908cae3730304fd477b4439cd862643630c4c141dccb9794d02228624d7fe1394c388fbdcdcfc6d522119b53354745e51e114f9ea1d25057b52c5403716ccf21ff0c3c22a946d65d3272add1236b8c8c0d01f801282",
    "credential_finalization": "aad107b4b6396ef9ce3233c46992276908c3490026164817aec4b3ee301821a6",
    "client_registration_state": "3f3ff410cb7927e1ffe1d1c0f0d2360f49ef04effc2242782f155c858b50c4d6030d2425e25d95ca6380beac64813feb5b127681fc2d3d37814a453f3815fb28dd",
    "client_login_state": "3f3ff410cb7927e1ffe1d1c0f0d2360f49ef04effc2242782f155c858b50c4d6030d2425e25d95ca6380beac64813feb5b127681fc2d3d37814a453f3815fb28dd0f0f56edf27a8591093e280f79f6b304a003a4aab3565a59d4c4f6ea1e27e76b03a01066dccb456e0e4a238d7afd1dcc788283154f0f7936295b950b316c66d0f52376b26e64585da98308c1ceea732c936de338c62147b2f5cd9579109b40584768e7dc1ae451f7d566fb28011bc13c180f3f1001a700c59488716b45011ad5e60f0f56edf27a8591093e280f79f6b304a003a4aab3565a59d4c4f6ea1e27e76b",
    "server_login_state": "2bee3adc9a7db1e964fd11f6b0a4cc87286762fa7548ab5d3393966f19da7cc5ca72928b4ad955a857ead83fe4a375afb7bb050f8c09c755823d7062e52c37bca3853ad81a963f92049b08f96b940e17cd5f2a8767714c5e28be1c5fa95a8d26",
    "password_file": "02120a5aada0251e2a005bddd90a69003b97b8343467a25010e5a5f444c3cfb74ad562c4b4dcb66dc4083a81516e99cf0f4b77b4a187e359ada76ffcc29ba6e895aa3e2b1386be6eed16ad865b92d4f130526e10a69a7f9c7ae685defcd8dc4f23f2b668f63cf558c9d76cdb83bbb5b2162335ec8cc8815e9d4e604a48e1248be2bd92015103fe0396a167d7f5e031c640",
    "export_key": "3cf2a36cb8f9df152f797718fbdead0dac400eb45300e6c93fa40c0b42713795",
    "session_key": "a3853ad81a963f92049b08f96b940e17cd5f2a8767714c5e28be1c5fa95a8d26"
}
"#;

#[cfg(feature = "ristretto255")]
static TEST_VECTOR_P384_RISTRETTO255: &str = r#"
{
    "client_s_pk": "02cc4db2cf4cd01a188ad2d24f37c13d542253202a15c1967fbc01ff3c67ec3976a09d950be6e61fd331ceee6c73afe071",
    "client_s_sk": "90a2c638013427e671591d125152921d0d18a84a6de44fd7b2b58e139b295628c137d26fc8e4b31e3d23e0a886aa70e2",
    "client_e_pk": "031c9d7101bd543a64537944c7ffbef579852d03e109386d1cb7d40438a494a3f466daf8ce56866ff94cca71e4c8a4baf4",
    "client_e_sk": "6e84980c5aaa6d78d3d634668b9a8427219ebf3da0dbc364d41cf29549c8dbecdcf55c91794b1147ed1f80b3f21aab9a",
    "server_s_pk": "0330a19238b845ed798b626d991645d5454b35bdf78c1aaaa8370ca1ee90839bdfeb3022f0967103a9bf7dd65f0bd764e7",
    "server_s_sk": "c947228ef3e8f98e14dcf8d44209508133425fa3ecd5b5dea57271b34619ec78503954df1c0d8a17067fdea51568feb0",
    "server_e_pk": "035ec4661b6d7d838d34438a683e2260be53e49adf362f7e68e366d4eada87a475c98898f57b38f89777f470f33056a5f5",
    "server_e_sk": "91d5f270837a3109f011a0fb1dc05fb26cb6c312dbaf5258d9c731a581e9398134cb0c5cadad0b09aeb1bbb1856973ac",
    "fake_sk": "440fc2ef4f616072e5cc984cb49a0a6100d8ba22a002b4a7e88baf000da81acf26399e0cb1277cd55e4cbf0d595714d6",
    "credential_identifier": "637265644964656e746966696572",
    "id_u": "696455",
    "id_s": "696453",
    "password": "70617373776f7264",
    "blinding_factor": "18b3146671040f5e23f8df4e40411af98c64f356f34d4abdf8e7023c173a130e",
    "oprf_seed": "d79e4976efa4866928d3e4fe7e463ec9e1ed756b67a2b156a991ce8c08b7a5d351d42f6e79416d30cae9032afbdedd4e46a360d3a67a2c088cc4f17f23cf548a",
    "masking_nonce": "f28da85667feea48ee90660484e463b5a3e9c26d78ee966919413e28e5e3298314a233fe33720e72f2086e9adafa8f3ed4b994271e764a836572492e0706b6c5",
    "envelope_nonce": "b33217f0bfca84df0f5c0e06944d7099ae657138e093e8b8fbd06886ca704f1b",
    "client_nonce": "6d6547ddbb040af90fd6fcd961e605ed2eec4c2dee24ae729f5145eaab8c3867",
    "server_nonce": "90901fa0e77d2e184ea1cde30eecd25e7c076245fb9ed40dcf2e64249d58c0be",
    "context": "636f6e74657874",
    "registration_request": "b4ab9b7315e3a66face7d81f24d8e2d538e6a09acb929fa3990d8fe3f5cdc665",
    "registration_response": "aa9159f5472d0f32d06205095eeca6cf2bfb402e2174120b1bb2d42719c5f93b0330a19238b845ed798b626d991645d5454b35bdf78c1aaaa8370ca1ee90839bdfeb3022f0967103a9bf7dd65f0bd764e7",
    "registration_upload": "02c1c9a0f2a01152ca24c81449e4d86c9d88f2709fc5e8c03c368b8952eae9ef9485a9dc65cf9cee71991266a9c339122601b02d1deee0df0ae3d4cd90cd0ee7b775cecaf73519fa7b1744344dd8f667f566c7fff174152c539fa0e276135862cb2581154db6ce754b594f13c4cdc7649d90a2c638013427e671591d125152921d0d18a84a6de44fd7b2b58e139b2956288a1c235698eb9f64a9b3ff2392a2f927c724a4bd9eac605f445d744614ccd15ed9222d0d0c6a4ba5c3edfa58b2ba386b9cfdb23229c2baf9cd01d30cc6a4267d",
    "credential_request": "b4ab9b7315e3a66face7d81f24d8e2d538e6a09acb929fa3990d8fe3f5cdc6656d6547ddbb040af90fd6fcd961e605ed2eec4c2dee24ae729f5145eaab8c3867031c9d7101bd543a64537944c7ffbef579852d03e109386d1cb7d40438a494a3f466daf8ce56866ff94cca71e4c8a4baf4",
    "credential_response": "aa9159f5472d0f32d06205095eeca6cf2bfb402e2174120b1bb2d42719c5f93bf28da85667feea48ee90660484e463b5a3e9c26d78ee966919413e28e5e329838f55cc8db1b7a3159515f4f8659424bec2003f52ddc1cacf3375ebc99ce25796776206afc2336e9eac2526801f3dc865ea4f41312342de7f0380a3dbf19d07fca963efbd55279d227397bdd4061f0d6018f8e921568a13a48ead1841adb79e6fccca36e58c831e08ba390d374b54d2ea57872867e522510a5b5acd6e8db6eea17728d8193047d15a92c6b7ccc21f731a286cb6c312dbaf5258d9c731a581e9398134cb0c5cadad0b09aeb1bbb1856973ac02a333fd1a99cd9efdc223198828ceb73535ad7583f8b2d1a660e9111fb90e7d59699c6a59b7222ffef86be508701cfb16327891268981272101c472e0018e8f685976e9fc02a760a05c4260477400092cfb9e57f91c487194cbb6eee9abe2d99957151a0f11bcfee0fe3862012119847c",
    "credential_finalization": "4a6ecd34b51d45a77f34f8a959dbac7e507c749ec869eb936d6c591691f74c13c8906a9e02071768eb28f6f0244e9a673c42bdbf326319c5ae93a8837fad2a5b",
    "client_registration_state": "18b3146671040f5e23f8df4e40411af98c64f356f34d4abdf8e7023c173a130eb4ab9b7315e3a66face7d81f24d8e2d538e6a09acb929fa3990d8fe3f5cdc665",
    "client_login_state": "18b3146671040f5e23f8df4e40411af98c64f356f34d4abdf8e7023c173a130eb4ab9b7315e3a66face7d81f24d8e2d538e6a09acb929fa3990d8fe3f5cdc6656d6547ddbb040af90fd6fcd961e605ed2eec4c2dee24ae729f5145eaab8c3867031c9d7101bd543a64537944c7ffbef579852d03e109386d1cb7d40438a494a3f466daf8ce56866ff94cca71e4c8a4baf46e84980c5aaa6d78d3d634668b9a8427219ebf3da0dbc364d41cf29549c8dbecdcf55c91794b1147ed1f80b3f21aab9a6d6547ddbb040af90fd6fcd961e605ed2eec4c2dee24ae729f5145eaab8c3867",
    "server_login_state": "2e28f843e78b3a64e90d4fe4e69e6c905a6f0dc88ec4da004cc6aa83709f5f62631c0359489957187f9bbc1e188a9577cd839e20210ae14da99c921d779a7e7b05542f09b2fa76e5ab43a73b14f3b4be10d14c56271eb1a5a1ee01ef781d220321ca21deaf632855aa442d91f32b6f4d89c5b87cadaf158b93cf71c0c84b7f7ec26fc66b9419dbf492de4a2e9874ef8002c792726b7dc1db770453a5eb1dc94fe245885e7d3aa33ed6e262db3b9344624a5d92b97521a169c78f837d8e5a4f7b",
    "password_file": "02c1c9a0f2a01152ca24c81449e4d86c9d88f2709fc5e8c03c368b8952eae9ef9485a9dc65cf9cee71991266a9c339122601b02d1deee0df0ae3d4cd90cd0ee7b775cecaf73519fa7b1744344dd8f667f566c7fff174152c539fa0e276135862cb2581154db6ce754b594f13c4cdc7649d90a2c638013427e671591d125152921d0d18a84a6de44fd7b2b58e139b2956288a1c235698eb9f64a9b3ff2392a2f927c724a4bd9eac605f445d744614ccd15ed9222d0d0c6a4ba5c3edfa58b2ba386b9cfdb23229c2baf9cd01d30cc6a4267d",
    "export_key": "d22fbb27898c9d010471f75d5c914cc96543a381e895660e9650f718bbd410c3d1fdee25d251af597cd21bd1b4165861e19bc424dc9cd9c9381cc278fa812b38",
    "session_key": "c26fc66b9419dbf492de4a2e9874ef8002c792726b7dc1db770453a5eb1dc94fe245885e7d3aa33ed6e262db3b9344624a5d92b97521a169c78f837d8e5a4f7b"
}
"#;

#[cfg(feature = "curve25519")]
static TEST_VECTOR_CURVE25519_P256: &str = r#"
{
    "client_s_pk": "69ed76a73e8ea5e916b69acc1e4e0afa5cdba3f81ea6dfb699fe86ee92a74666",
    "client_s_sk": "5e82508b626cbb47668722477adac4eb3bb73f2f2e3eddab756c49374dd4d500",
    "client_e_pk": "cda917dd1ed9c3cd6f0eaadcae788f3020a17e6c28901212cf142dc0d98f043b",
    "client_e_sk": "4824a46e04261c514c698c1c614a75c7e6f9ff83d24221d8f8d9ee980ab93d0b",
    "server_s_pk": "8008812d4b13c79df164a3ea848f5d74769f4897bbd4e7eb61b2386271ed3852",
    "server_s_sk": "a4f987b8dc2d2fe1844fb7c204a217354332562145bd4d97d2b3a3a4c7620806",
    "server_e_pk": "145283edcc8a938cb055a101ae70d0c02e809c806dccbd72b3f02f858898d76e",
    "server_e_sk": "2eb55ba2a40a448e1a1ad2cbba84b2f0e0af5487286b3b60c013662a1684e507",
    "fake_sk": "3550ed59a267c5a5844c08e1aecd01eac985756d6abeb8879b3aff1fff14cd05",
    "credential_identifier": "637265644964656e746966696572",
    "id_u": "696455",
    "id_s": "696453",
    "password": "70617373776f7264",
    "blinding_factor": "f5cffca6a1adc8fc3ccfdad0be1fe9ed584ba0375a7f8d0d4e0a66b68c9bca0a",
    "oprf_seed": "0be066c853e54cb56e6df6026ff4a935989f3c8060453f410f19dc6949fe929a",
    "masking_nonce": "db49cc5073b8e0a2aeaebfa54701561d186fce1c74ec517cab5988e500c5b63c1d390a5056830cceea8ad0236b320ce719fbbfebbfa5aa9f911935326d27f378",
    "envelope_nonce": "95b05ff76c53bee8de8b561ef7fde3e40c10f879792081011940ae2aac7a623c",
    "client_nonce": "2a98b15c271c8d52116650c7b490635bc79b23b8ed9b23d550015808a15e9867",
    "server_nonce": "2e71ec9dd06a8e6db234da612669bc9ac17afa4b16a2593951592c7936538938",
    "context": "636f6e74657874",
    "registration_request": "0330ee3076f2b0087fc6e97734fd6a15fb8a428672ecbe122ce154ed0119b34d0f",
    "registration_response": "03b6c765c7b2416a30d2278e095195c8a5bd9f4ebb5ae5c19d5c2bf66c4a72abe38008812d4b13c79df164a3ea848f5d74769f4897bbd4e7eb61b2386271ed3852",
    "registration_upload": "5229aae7151510d1c3f74a22feb06ea4c285a25dbaff68be39f07a011711de610b2004db6b44786aa1221747f6469bd0611b97dfcb77c0f048820d976f3372465e82508b626cbb47668722477adac4eb3bb73f2f2e3eddab756c49374dd4d500361476577ea22e5abea82926a0f63e39d2677305de5f148dac7cf5a729d1748a",
    "credential_request": "0330ee3076f2b0087fc6e97734fd6a15fb8a428672ecbe122ce154ed0119b34d0ff5cffca6a1adc8fc3ccfdad0be1fe9ed584ba0375a7f8d0d4e0a66b68c9bca0a95bc1257ac1517d07a6803a279bbd1701879ec5778581bf425eaff863d1f5a69",
    "credential_response": "03b6c765c7b2416a30d2278e095195c8a5bd9f4ebb5ae5c19d5c2bf66c4a72abe3db49cc5073b8e0a2aeaebfa54701561d186fce1c74ec517cab5988e500c5b63c1f2aa4a06a3e29a3db080b36676f704c00d9ab9a631a7f5a02a0d9e310a49d719ea9d4b6e3dabbf41a5fda497be1086038cf184e92b08b3c81c5b7eeb59dd58aba37ddd1ad1e5574e28c1b1b381074be7d57c26bf646640e5129090604ac78982e71ec9dd06a8e6db234da612669bc9ac17afa4b16a2593951592c79365389380520386dadb6647eee03d638d0335b58208784b516b9500bc0ecfeef287bfb6ed8b1dc49fd245b6f10d9f029a32bcbbc3cbdbb4667f5927d05b0cf956bce1a40",
    "credential_finalization": "17f80bc4647799102a0514c4e529bb2f75142f186270f4ecf909b8b86b3512b4",
    "client_registration_state": "f5cffca6a1adc8fc3ccfdad0be1fe9ed584ba0375a7f8d0d4e0a66b68c9bca0a0330ee3076f2b0087fc6e97734fd6a15fb8a428672ecbe122ce154ed0119b34d0f",
    "client_login_state": "f5cffca6a1adc8fc3ccfdad0be1fe9ed584ba0375a7f8d0d4e0a66b68c9bca0a0330ee3076f2b0087fc6e97734fd6a15fb8a428672ecbe122ce154ed0119b34d0ff5cffca6a1adc8fc3ccfdad0be1fe9ed584ba0375a7f8d0d4e0a66b68c9bca0a95bc1257ac1517d07a6803a279bbd1701879ec5778581bf425eaff863d1f5a691bb3b820ad232af99bb59252cb6d384c1c14584ae61a3b316632b64b78bb0301f5cffca6a1adc8fc3ccfdad0be1fe9ed584ba0375a7f8d0d4e0a66b68c9bca0a",
    "server_login_state": "a25294f501e4d072ce9eaf533a058342341b5fbbe3a4b634f6a75e7b472cea48893146600bead24ed784b5d1dacb4052fad1c346647388292ed2e003622536832fc7d8269cecbb5e4e35d692a5dfbb9c7b0bc4d6de5df8284006563b90033122",
    "password_file": "5229aae7151510d1c3f74a22feb06ea4c285a25dbaff68be39f07a011711de610b2004db6b44786aa1221747f6469bd0611b97dfcb77c0f048820d976f3372465e82508b626cbb47668722477adac4eb3bb73f2f2e3eddab756c49374dd4d500361476577ea22e5abea82926a0f63e39d2677305de5f148dac7cf5a729d1748a",
    "export_key": "bbf3e4488d69ade22fa6c799633f3719a19624d2f91e217295cb54e7be1d0161",
    "session_key": "2fc7d8269cecbb5e4e35d692a5dfbb9c7b0bc4d6de5df8284006563b90033122"
}
"#;

#[cfg(feature = "curve25519")]
static TEST_VECTOR_CURVE25519_P384: &str = r#"
{
    "client_s_pk": "2b9f0f954c3de559cbcb62080b83ece704a0ed3483210af87accea63da3dbf07",
    "client_s_sk": "41f6de16ddb0c830acc051fab8347a091a8dea09235a33efce6ef8b74f2e0606",
    "client_e_pk": "aaffa1e339b2889ae79e17aa6182f0c3a2b6978c6815804154d50684fbcc7a1f",
    "client_e_sk": "f36d354b03a9e4bfad55282a50f83c2e847f2cca355119f763e1f6355622020d",
    "server_s_pk": "8305087c15191b88261b4d9d758d2989e3c9db173af3a9afec50e894d208974b",
    "server_s_sk": "d51fc8cab005d03f715d9a10dd96f4fc26f8b8ac0730f1009bb3bed0d943b806",
    "server_e_pk": "36d6599df3721f0f48c0dfef90d559be4c480ed9a64a944daee1e084e481ca7f",
    "server_e_sk": "07bb627db23b616e4db6400cdbfe64bcd2f8bdeac75d6c1b3986abec53db0507",
    "fake_sk": "3ff9c80e135aaaa4b659bfc7aae930df48b850584081b1785941731a917bed03",
    "credential_identifier": "637265644964656e746966696572",
    "id_u": "696455",
    "id_s": "696453",
    "password": "70617373776f7264",
    "blinding_factor": "3b2613f0fd19417836768e52e0fa8b10ba72c7d73295fe05fe3f2760ac9f5634866ffe7ce82a3bf7331fe69aa3b012eb",
    "oprf_seed": "6a37fc383dc9b4603df4cbf145d6921e80c8fda01fa29881575b8a39715acbc1ad7d2a3d9b4e6393aef845a2dfd8ab2a",
    "masking_nonce": "691c753a5a2de16b8e5a39d80f92f59e20c7bdf4f541b89ae931b601f98b9443c6cdf44de136cebb8d73c341bd383d5307c54a34ead807befba2728a7544c9c7",
    "envelope_nonce": "4f4a4a91c9ae4ccb46ac6fe2e8e03a9ce5361341cb5ca8c5416092f9f7f9db92",
    "client_nonce": "b3c6c95ff54e295b657ab1bd9a0baab8ebd8e1d8e066f60ab2902345d6aef8a7",
    "server_nonce": "d29f696f00f3db18aeca7e6f9d8a588f93a3d8740fa61080a202aa68f5612eb0",
    "context": "636f6e74657874",
    "registration_request": "03a0069896a068b38e870bfea488861af330a6d0aadb6308f18008c47f3cb296fa26658e8aaf720f7007a85895f386445b",
    "registration_response": "0359cc30b4847552e7ceaccc4c9e1d10741d1410f6c4f89a3861d999bc4d0377ffe4e06e54759ca1803530c67c7509b1128305087c15191b88261b4d9d758d2989e3c9db173af3a9afec50e894d208974b",
    "registration_upload": "6b062577189bbb1bc882bf3f47312c660938d218ff5ab92301a4dc1518d2bd2b8c61ddca8e0adffca028c40d603d2ef192453e71a24fdfcf90cd4d960db0641b8ace898e125b2f2f414e04c12829f80241f6de16ddb0c830acc051fab8347a091a8dea09235a33efce6ef8b74f2e060670fcc24972ff7946b119e8f2836b032eea9243ed3a55480ca1bc4ae1f5c4362ab1d258c80ac805bd51d5b176f1ab6d5a",
    "credential_request": "03a0069896a068b38e870bfea488861af330a6d0aadb6308f18008c47f3cb296fa26658e8aaf720f7007a85895f386445b3b2613f0fd19417836768e52e0fa8b10ba72c7d73295fe05fe3f2760ac9f56348f3bbbf19a30d072fddd1a0faa3f560904a635a20360c12bf85c5ee2f1d98952",
    "credential_response": "0359cc30b4847552e7ceaccc4c9e1d10741d1410f6c4f89a3861d999bc4d0377ffe4e06e54759ca1803530c67c7509b112691c753a5a2de16b8e5a39d80f92f59e20c7bdf4f541b89ae931b601f98b9443b3ec87b09e29174bf0b02f765aea2a95bedf4cac2aba3b11ea67ff8e4101d6c2787b2837c53f00686f5cf7702da632d2dfb6347f4b778486dfebdc068c586be74bd661ce1cbac7c09aed4d164bfd2bfbc3337486edc4072728207b9b7474bdd5d5044d7551c53edd0df3af6095a692cfd29f696f00f3db18aeca7e6f9d8a588f93a3d8740fa61080a202aa68f5612eb0b801faec75954a61b8b3d94beb2682c5f78103da1f1e577741db6b2bcfe4e60bfc16b1af016923f3668151ad8c66caff5e23e68e583340df67b520c42d1660bbd82e848651de383c1cbbe385538b9441",
    "credential_finalization": "0001d2ea15799e41464afce25b78741c894a51fb1ea8e1eccef3aebc98131782c76e21c949c97cf31d20defab16a5756",
    "client_registration_state": "3b2613f0fd19417836768e52e0fa8b10ba72c7d73295fe05fe3f2760ac9f5634866ffe7ce82a3bf7331fe69aa3b012eb03a0069896a068b38e870bfea488861af330a6d0aadb6308f18008c47f3cb296fa26658e8aaf720f7007a85895f386445b",
    "client_login_state": "3b2613f0fd19417836768e52e0fa8b10ba72c7d73295fe05fe3f2760ac9f5634866ffe7ce82a3bf7331fe69aa3b012eb03a0069896a068b38e870bfea488861af330a6d0aadb6308f18008c47f3cb296fa26658e8aaf720f7007a85895f386445b3b2613f0fd19417836768e52e0fa8b10ba72c7d73295fe05fe3f2760ac9f56348f3bbbf19a30d072fddd1a0faa3f560904a635a20360c12bf85c5ee2f1d98952244453214d35510dfef82e676f335cc04025ede506f059fed843116d3840ab003b2613f0fd19417836768e52e0fa8b10ba72c7d73295fe05fe3f2760ac9f5634",
    "server_login_state": "f00e2773cadcbb3de4d739ffb6e4e120337daa6d11ba69f9bca1bd374681c355dd8b5132aaacb1f77c6486898b81114250cd096b06362a915367cd41c9ab4387630cbf19b264cc85e53973f0b00895c81327132383d7c8fc8bc9e00692e7349b607bf25dbef56cc296e3649301c2eef0a85c600906019adaa5c24b3baae6ee24665abe16daca22fabda03c9759b8f6b2",
    "password_file": "6b062577189bbb1bc882bf3f47312c660938d218ff5ab92301a4dc1518d2bd2b8c61ddca8e0adffca028c40d603d2ef192453e71a24fdfcf90cd4d960db0641b8ace898e125b2f2f414e04c12829f80241f6de16ddb0c830acc051fab8347a091a8dea09235a33efce6ef8b74f2e060670fcc24972ff7946b119e8f2836b032eea9243ed3a55480ca1bc4ae1f5c4362ab1d258c80ac805bd51d5b176f1ab6d5a",
    "export_key": "cdf7f3110e45cc681bdd4244b0a0f0a14479fa8e4ddbf44b85729127887cb26ddd0d886852c9a500583c0b7abc3a94ec",
    "session_key": "607bf25dbef56cc296e3649301c2eef0a85c600906019adaa5c24b3baae6ee24665abe16daca22fabda03c9759b8f6b2"
}
"#;

#[cfg(all(feature = "curve25519", feature = "ristretto255"))]
static TEST_VECTOR_CURVE25519_RISTRETTO255: &str = r#"
{
    "client_s_pk": "6d34d8019596453f74f6cb7e19518f18c59007bf391c27e628ede13399c55926",
    "client_s_sk": "12fb7611a1d2750132a1a7dc1dec9a6661d76219cf36da56c740e562d4f4e903",
    "client_e_pk": "3d5f9259f557807b564983284b24b8215fc5bd7b3a0f8bc34009f1cd952a0169",
    "client_e_sk": "d9951ecf26494ec47d14201a20d8c1ffaea23a77a517bf5e0a989dc43c250305",
    "server_s_pk": "4289e6432b1aab39b48e7aaa1f5df5469557a02e88890e65abca69a8c20ea628",
    "server_s_sk": "303fb01ec84103188c0d36d38141374e6a926fbb87d3cee44d91d4fad2c46007",
    "server_e_pk": "9caa20ec8b9211dd813d50d1ca6a58ee33a973d0653d51e6491978cd0947ac3c",
    "server_e_sk": "5af7853127d11fa5ef474b299a555b6646e1f4c99d3a28b66a4c0cb845e6700c",
    "fake_sk": "456a7f74f53bec33901e9d0baae516274fb61897febbe70f6cf24a0db26bd90a",
    "credential_identifier": "637265644964656e746966696572",
    "id_u": "696455",
    "id_s": "696453",
    "password": "70617373776f7264",
    "blinding_factor": "59b12e9ad422cf4a8df17bf618ec359bbd2fc445a6aeb1456bc3ac66c2a2a209",
    "oprf_seed": "5613715923e625b9ad4f9cf1020489badf36d5e1b69d269ab1f9ea6bf958cd90141e26c4184fae38b8147b7ffae552480009783009f469ac996082cbf3ef08df",
    "masking_nonce": "ae7b75049b66fee73f8473e93151e88f526ce3552efff099ef5309990a77692b900f195b54ea5c5009265a2824a67ff59438f012c48eed75c5183fc8e1a8f194",
    "envelope_nonce": "97a68221ec1b0221b0d6b7926725692ebf5a1afb1bf99b07bdb18c7b3da11b5e",
    "client_nonce": "d3c3ea320a38ab0e4cb16ac0be440d98ceda8eb9bdb9501f514ebd6dc3b15f22",
    "server_nonce": "7bbd7b539f0234343795758fac2b92a621f32a7df93729a043c66f23820f9955",
    "context": "636f6e74657874",
    "registration_request": "6237782184147685be0a8b918a185ee99802843d61a61ca46638912607d13443",
    "registration_response": "10fc453b29cd35dabe1fe44bb2d88c17f4246231e2226cdead9359a0af24ab794289e6432b1aab39b48e7aaa1f5df5469557a02e88890e65abca69a8c20ea628",
    "registration_upload": "ce6867cd81ae2d0d886f1a29e12056ddc7a6a2a91be7d2dfcd312f2c39a38315da43e121023f254420fdd065cdc874afdfdb87051ad466a499a0bdd85b47f88a6bebfa99ab12e050ea429edf3a1434e84282e25b54204fcd699632c0a8d57af212fb7611a1d2750132a1a7dc1dec9a6661d76219cf36da56c740e562d4f4e9038343767a8c365ccd2a4de1f9f5c566c2a8997da0fb5613ebe13eec395a79755ebbdf53cbfe4dbd36e2d7e34c37f92bc4b0e1abb38ad57a3c2efd820bee87a298",
    "credential_request": "6237782184147685be0a8b918a185ee99802843d61a61ca46638912607d1344359b12e9ad422cf4a8df17bf618ec359bbd2fc445a6aeb1456bc3ac66c2a2a209b8971a309718d5a516b9e8b90eb675faeb977a2b9b6db8f7e6fbdeace0dbfb08",
    "credential_response": "10fc453b29cd35dabe1fe44bb2d88c17f4246231e2226cdead9359a0af24ab79ae7b75049b66fee73f8473e93151e88f526ce3552efff099ef5309990a77692bacea3237a61667305c089852b2c0e65394a19104b67881e310c14892c2043291f9e0a6c2f595d1414f446dee9a959bab717337cd4cedbf7689e5031e8017549641d8d7cb49d2deda605c1bb0a5234403f8fd331c912942583da3d386acfb84a1d6fc6c65c43d3a0f53af7134aefd32861bd702203cb067a517817598118450667bbd7b539f0234343795758fac2b92a621f32a7df93729a043c66f23820f99558df623d1eaf64ae2ff70a8964c0e244725575aa7fbb3a0a2590b0b763d8e6c67f1b3dd73198035b65fc9447680d05d7e82dfc22e8e3d0d0beb9a86df6d625382bd090f1711d585cfd9f623457d0ceb0606d682893be399e258f371a3863f82d1",
    "credential_finalization": "a639983ef8826f6180e70677a81aaeeae7b85d10aa1e1a32b452bf126febc6d8c7aeeb7dd28de7e2f2efa820bd16db22897d6613820f3c60f8789dde1a096332",
    "client_registration_state": "59b12e9ad422cf4a8df17bf618ec359bbd2fc445a6aeb1456bc3ac66c2a2a2096237782184147685be0a8b918a185ee99802843d61a61ca46638912607d13443",
    "client_login_state": "59b12e9ad422cf4a8df17bf618ec359bbd2fc445a6aeb1456bc3ac66c2a2a2096237782184147685be0a8b918a185ee99802843d61a61ca46638912607d1344359b12e9ad422cf4a8df17bf618ec359bbd2fc445a6aeb1456bc3ac66c2a2a209b8971a309718d5a516b9e8b90eb675faeb977a2b9b6db8f7e6fbdeace0dbfb0812612ac1580fe55bc8c0b20ab0ae6a3910a3d91c79a4b736754c2ad3df3c620859b12e9ad422cf4a8df17bf618ec359bbd2fc445a6aeb1456bc3ac66c2a2a209",
    "server_login_state": "fc2e26ba4d3bd654d52fd02d6eb09186c50ae295a36c669065971943f0c0eafa4b423c1cff4dff8fed7699d5d0a5f481a1d93423c5bba6d945a9bf5899fa8ab7efeccdd5551aaa1f7fbedcf75f7df5c7eb14ed5130b71f064ef9a546260a1f27849133bff708279af47d15959832bf22591b0f1d5775a2e1c9c121a83b1d6f71f4f4481e08a77a1a3e781cf3ed28162190c578a1f3d811482cc1fcc99e76e9bfa3a9c5be230007fc37fd073003f8c77a96a168c557967ab4bae73c5852d9ba43",
    "password_file": "ce6867cd81ae2d0d886f1a29e12056ddc7a6a2a91be7d2dfcd312f2c39a38315da43e121023f254420fdd065cdc874afdfdb87051ad466a499a0bdd85b47f88a6bebfa99ab12e050ea429edf3a1434e84282e25b54204fcd699632c0a8d57af212fb7611a1d2750132a1a7dc1dec9a6661d76219cf36da56c740e562d4f4e9038343767a8c365ccd2a4de1f9f5c566c2a8997da0fb5613ebe13eec395a79755ebbdf53cbfe4dbd36e2d7e34c37f92bc4b0e1abb38ad57a3c2efd820bee87a298",
    "export_key": "c5a83c54eaf05404a79c2b6fd0e4a25f5a8204cd5ea32971e9a29b57e568b301dbf2b17ef7941a89fd2289d53610a594c08970eabaa39257525bb6384796e931",
    "session_key": "f4f4481e08a77a1a3e781cf3ed28162190c578a1f3d811482cc1fcc99e76e9bfa3a9c5be230007fc37fd073003f8c77a96a168c557967ab4bae73c5852d9ba43"
}
"#;

fn decode(values: &Value, key: &str) -> Option<Vec<u8>> {
    values[key].as_str().and_then(|s| hex::decode(s).ok())
}

fn populate_test_vectors(values: &Value) -> TestVectorParameters {
    TestVectorParameters {
        client_s_pk: decode(values, "client_s_pk").unwrap(),
        client_s_sk: decode(values, "client_s_sk").unwrap(),
        client_e_pk: decode(values, "client_e_pk").unwrap(),
        client_e_sk: decode(values, "client_e_sk").unwrap(),
        server_s_pk: decode(values, "server_s_pk").unwrap(),
        server_s_sk: decode(values, "server_s_sk").unwrap(),
        server_e_pk: decode(values, "server_e_pk").unwrap(),
        server_e_sk: decode(values, "server_e_sk").unwrap(),
        fake_sk: decode(values, "fake_sk").unwrap(),
        credential_identifier: decode(values, "credential_identifier").unwrap(),
        id_u: decode(values, "id_u").unwrap(),
        id_s: decode(values, "id_s").unwrap(),
        password: decode(values, "password").unwrap(),
        blinding_factor: decode(values, "blinding_factor").unwrap(),
        oprf_seed: decode(values, "oprf_seed").unwrap(),
        masking_nonce: decode(values, "masking_nonce").unwrap(),
        envelope_nonce: decode(values, "envelope_nonce").unwrap(),
        client_nonce: decode(values, "client_nonce").unwrap(),
        server_nonce: decode(values, "server_nonce").unwrap(),
        context: decode(values, "context").unwrap(),
        registration_request: decode(values, "registration_request").unwrap(),
        registration_response: decode(values, "registration_response").unwrap(),
        registration_upload: decode(values, "registration_upload").unwrap(),
        credential_request: decode(values, "credential_request").unwrap(),
        credential_response: decode(values, "credential_response").unwrap(),
        credential_finalization: decode(values, "credential_finalization").unwrap(),
        client_registration_state: decode(values, "client_registration_state").unwrap(),
        client_login_state: decode(values, "client_login_state").unwrap(),
        server_login_state: decode(values, "server_login_state").unwrap(),
        password_file: decode(values, "password_file").unwrap(),
        export_key: decode(values, "export_key").unwrap(),
        session_key: decode(values, "session_key").unwrap(),
    }
}

fn stringify_test_vectors(p: &TestVectorParameters) -> String {
    let mut s = String::new();
    s.push_str("{\n");
    s.push_str(format!("\"client_s_pk\": \"{}\",\n", hex::encode(&p.client_s_pk)).as_str());
    s.push_str(format!("\"client_s_sk\": \"{}\",\n", hex::encode(&p.client_s_sk)).as_str());
    s.push_str(format!("\"client_e_pk\": \"{}\",\n", hex::encode(&p.client_e_pk)).as_str());
    s.push_str(format!("\"client_e_sk\": \"{}\",\n", hex::encode(&p.client_e_sk)).as_str());
    s.push_str(format!("\"server_s_pk\": \"{}\",\n", hex::encode(&p.server_s_pk)).as_str());
    s.push_str(format!("\"server_s_sk\": \"{}\",\n", hex::encode(&p.server_s_sk)).as_str());
    s.push_str(format!("\"server_e_pk\": \"{}\",\n", hex::encode(&p.server_e_pk)).as_str());
    s.push_str(format!("\"server_e_sk\": \"{}\",\n", hex::encode(&p.server_e_sk)).as_str());
    s.push_str(format!("\"fake_sk\": \"{}\",\n", hex::encode(&p.fake_sk)).as_str());
    s.push_str(
        format!(
            "\"credential_identifier\": \"{}\",\n",
            hex::encode(&p.credential_identifier)
        )
        .as_str(),
    );
    s.push_str(format!("\"id_u\": \"{}\",\n", hex::encode(&p.id_u)).as_str());
    s.push_str(format!("\"id_s\": \"{}\",\n", hex::encode(&p.id_s)).as_str());
    s.push_str(format!("\"password\": \"{}\",\n", hex::encode(&p.password)).as_str());
    s.push_str(
        format!(
            "\"blinding_factor\": \"{}\",\n",
            hex::encode(&p.blinding_factor)
        )
        .as_str(),
    );
    s.push_str(format!("\"oprf_seed\": \"{}\",\n", hex::encode(&p.oprf_seed)).as_str());
    s.push_str(
        format!(
            "\"masking_nonce\": \"{}\",\n",
            hex::encode(&p.masking_nonce)
        )
        .as_str(),
    );
    s.push_str(
        format!(
            "\"envelope_nonce\": \"{}\",\n",
            hex::encode(&p.envelope_nonce)
        )
        .as_str(),
    );
    s.push_str(format!("\"client_nonce\": \"{}\",\n", hex::encode(&p.client_nonce)).as_str());
    s.push_str(format!("\"server_nonce\": \"{}\",\n", hex::encode(&p.server_nonce)).as_str());
    s.push_str(format!("\"context\": \"{}\",\n", hex::encode(&p.context)).as_str());
    s.push_str(
        format!(
            "\"registration_request\": \"{}\",\n",
            hex::encode(&p.registration_request)
        )
        .as_str(),
    );
    s.push_str(
        format!(
            "\"registration_response\": \"{}\",\n",
            hex::encode(&p.registration_response)
        )
        .as_str(),
    );
    s.push_str(
        format!(
            "\"registration_upload\": \"{}\",\n",
            hex::encode(&p.registration_upload)
        )
        .as_str(),
    );
    s.push_str(
        format!(
            "\"credential_request\": \"{}\",\n",
            hex::encode(&p.credential_request)
        )
        .as_str(),
    );
    s.push_str(
        format!(
            "\"credential_response\": \"{}\",\n",
            hex::encode(&p.credential_response)
        )
        .as_str(),
    );
    s.push_str(
        format!(
            "\"credential_finalization\": \"{}\",\n",
            hex::encode(&p.credential_finalization)
        )
        .as_str(),
    );
    s.push_str(
        format!(
            "\"client_registration_state\": \"{}\",\n",
            hex::encode(&p.client_registration_state)
        )
        .as_str(),
    );
    s.push_str(
        format!(
            "\"client_login_state\": \"{}\",\n",
            hex::encode(&p.client_login_state)
        )
        .as_str(),
    );
    s.push_str(
        format!(
            "\"server_login_state\": \"{}\",\n",
            hex::encode(&p.server_login_state)
        )
        .as_str(),
    );
    s.push_str(
        format!(
            "\"password_file\": \"{}\",\n",
            hex::encode(&p.password_file)
        )
        .as_str(),
    );
    s.push_str(format!("\"export_key\": \"{}\",\n", hex::encode(&p.export_key)).as_str());
    s.push_str(format!("\"session_key\": \"{}\"\n", hex::encode(&p.session_key)).as_str());
    s.push_str("}\n");
    s
}

fn generate_parameters<CS: CipherSuite>() -> Result<TestVectorParameters, ProtocolError>
where
    <OprfHash<CS> as OutputSizeUser>::OutputSize:
        IsLess<U256> + IsLessOrEqual<<OprfHash<CS> as BlockSizeUser>::BlockSize>,
    OprfHash<CS>: Hash,
    <OprfHash<CS> as CoreProxy>::Core: ProxyHash,
    <<OprfHash<CS> as CoreProxy>::Core as BlockSizeUser>::BlockSize: IsLess<U256>,
    Le<<<OprfHash<CS> as CoreProxy>::Core as BlockSizeUser>::BlockSize, U256>: NonZero,
    // ClientRegistration: KgSk + KgPk
    <OprfGroup<CS> as Group>::ScalarLen: Add<<OprfGroup<CS> as Group>::ElemLen>,
    ClientRegistrationLen<CS>: ArrayLength<u8>,
    // RegistrationResponse: KgPk + KePk
    <OprfGroup<CS> as Group>::ElemLen: Add<<CS::KeGroup as KeGroup>::PkLen>,
    RegistrationResponseLen<CS>: ArrayLength<u8>,
    // Envelope: Nonce + Hash
    NonceLen: Add<OutputSize<OprfHash<CS>>>,
    EnvelopeLen<CS>: ArrayLength<u8>,
    // RegistrationUpload: (KePk + Hash) + Envelope
    <CS::KeGroup as KeGroup>::PkLen: Add<OutputSize<OprfHash<CS>>>,
    Sum<<CS::KeGroup as KeGroup>::PkLen, OutputSize<OprfHash<CS>>>:
        ArrayLength<u8> + Add<EnvelopeLen<CS>>,
    RegistrationUploadLen<CS>: ArrayLength<u8>,
    // ServerRegistration = RegistrationUpload
    // Ke1Message: Nonce + KePk
    NonceLen: Add<<CS::KeGroup as KeGroup>::PkLen>,
    Ke1MessageLen<CS>: ArrayLength<u8>,
    // CredentialRequest: KgPk + Ke1Message
    <OprfGroup<CS> as Group>::ElemLen: Add<Ke1MessageLen<CS>>,
    CredentialRequestLen<CS>: ArrayLength<u8>,
    // ClientLogin: KgSk + CredentialRequest + Ke1State
    <OprfGroup<CS> as Group>::ScalarLen: Add<CredentialRequestLen<CS>>,
    Sum<<OprfGroup<CS> as Group>::ScalarLen, CredentialRequestLen<CS>>:
        ArrayLength<u8> + Add<Ke1StateLen<CS>>,
    ClientLoginLen<CS>: ArrayLength<u8>,
    // MaskedResponse: (Nonce + Hash) + KePk
    NonceLen: Add<OutputSize<OprfHash<CS>>>,
    Sum<NonceLen, OutputSize<OprfHash<CS>>>: ArrayLength<u8> + Add<<CS::KeGroup as KeGroup>::PkLen>,
    MaskedResponseLen<CS>: ArrayLength<u8>,
    // CredentialResponseWithoutKeLen: (KgPk + Nonce) + MaskedResponse
    <OprfGroup<CS> as Group>::ElemLen: Add<NonceLen>,
    Sum<<OprfGroup<CS> as Group>::ElemLen, NonceLen>: ArrayLength<u8> + Add<MaskedResponseLen<CS>>,
    CredentialResponseWithoutKeLen<CS>: ArrayLength<u8>,
    // Ke2Message: (Nonce + KePk) + Hash
    NonceLen: Add<<CS::KeGroup as KeGroup>::PkLen>,
    Sum<NonceLen, <CS::KeGroup as KeGroup>::PkLen>: ArrayLength<u8> + Add<OutputSize<OprfHash<CS>>>,
    Ke2MessageLen<CS>: ArrayLength<u8>,
    // CredentialResponse: CredentialResponseWithoutKeLen + Ke2Message
    CredentialResponseWithoutKeLen<CS>: Add<Ke2MessageLen<CS>>,
    CredentialResponseLen<CS>: ArrayLength<u8>,
{
    use rand::RngCore;

    use crate::keypair::KeyPair;

    let mut rng = OsRng;

    // Inputs
    let server_s_kp = KeyPair::<CS::KeGroup>::generate_random(&mut rng);
    let server_e_kp = KeyPair::<CS::KeGroup>::generate_random(&mut rng);
    let client_s_kp = KeyPair::<CS::KeGroup>::generate_random(&mut rng);
    let client_e_kp = KeyPair::<CS::KeGroup>::generate_random(&mut rng);
    let fake_kp = KeyPair::<CS::KeGroup>::generate_random(&mut rng);
    let credential_identifier = b"credIdentifier";
    let id_u = b"idU";
    let id_s = b"idS";
    let password = b"password";
    let context = b"context";
    let mut oprf_seed = Output::<OprfHash<CS>>::default();
    rng.fill_bytes(&mut oprf_seed);
    let mut masking_nonce = [0u8; 64];
    rng.fill_bytes(&mut masking_nonce);
    let mut envelope_nonce = [0u8; 32];
    rng.fill_bytes(&mut envelope_nonce);
    let mut client_nonce = [0u8; NonceLen::USIZE];
    rng.fill_bytes(&mut client_nonce);
    let mut server_nonce = [0u8; NonceLen::USIZE];
    rng.fill_bytes(&mut server_nonce);

    let fake_sk: Vec<u8> = fake_kp.private().serialize().to_vec();
    let server_setup = ServerSetup::<CS>::deserialize(
        &[
            oprf_seed.as_ref(),
            &server_s_kp.private().serialize(),
            &fake_sk,
        ]
        .concat(),
    )
    .unwrap();

    let blinding_factor = <OprfGroup<CS> as Group>::random_scalar(&mut rng);
    let blinding_factor_bytes = OprfGroup::<CS>::serialize_scalar(blinding_factor);

    let mut blinding_factor_registration_rng = CycleRng::new(blinding_factor_bytes.to_vec());
    let client_registration_start_result =
        ClientRegistration::<CS>::start(&mut blinding_factor_registration_rng, password).unwrap();
    let blinding_factor_bytes_returned = OprfGroup::<CS>::serialize_scalar(
        client_registration_start_result
            .state
            .oprf_client
            .get_blind(),
    );
    assert_eq!(
        hex::encode(&blinding_factor_bytes),
        hex::encode(&blinding_factor_bytes_returned)
    );

    let registration_request_bytes = client_registration_start_result.message.serialize();
    let client_registration_state = client_registration_start_result.state.serialize();

    let server_registration_start_result = ServerRegistration::<CS>::start(
        &server_setup,
        client_registration_start_result.message,
        credential_identifier,
    )
    .unwrap();
    let registration_response_bytes = server_registration_start_result.message.serialize();

    let mut client_s_sk_and_nonce: Vec<u8> = Vec::new();
    client_s_sk_and_nonce.extend_from_slice(&client_s_kp.private().serialize());
    client_s_sk_and_nonce.extend_from_slice(&envelope_nonce);

    let mut finish_registration_rng = CycleRng::new(client_s_sk_and_nonce);
    let client_registration_finish_result = client_registration_start_result
        .state
        .finish(
            &mut finish_registration_rng,
            password,
            server_registration_start_result.message,
            ClientRegistrationFinishParameters::new(
                Identifiers {
                    client: Some(id_u),
                    server: Some(id_s),
                },
                None,
            ),
        )
        .unwrap();
    let registration_upload_bytes = client_registration_finish_result.message.serialize();

    let password_file = ServerRegistration::finish(client_registration_finish_result.message);
    let password_file_bytes = password_file.serialize();

    let mut client_login_start: Vec<u8> = Vec::new();
    client_login_start.extend_from_slice(&blinding_factor_bytes);
    client_login_start.extend_from_slice(&client_e_kp.private().serialize());
    client_login_start.extend_from_slice(&client_nonce);

    let mut client_login_start_rng = CycleRng::new(client_login_start);
    let client_login_start_result =
        ClientLogin::<CS>::start(&mut client_login_start_rng, password).unwrap();
    let credential_request_bytes = client_login_start_result.message.serialize();
    let client_login_state = client_login_start_result.state.serialize().to_vec();

    let mut server_e_sk_and_nonce_rng = CycleRng::new(
        [
            masking_nonce.to_vec(),
            server_e_kp.private().serialize().to_vec(),
            server_nonce.to_vec(),
        ]
        .concat(),
    );
    let server_login_start_result = ServerLogin::<CS>::start(
        &mut server_e_sk_and_nonce_rng,
        &server_setup,
        Some(password_file),
        client_login_start_result.message,
        credential_identifier,
        ServerLoginStartParameters {
            context: Some(context),
            identifiers: Identifiers {
                client: Some(id_u),
                server: Some(id_s),
            },
        },
    )
    .unwrap();
    let credential_response_bytes = server_login_start_result.message.serialize();
    let server_login_state = server_login_start_result.state.serialize();

    let client_login_finish_result = client_login_start_result
        .state
        .finish(
            password,
            server_login_start_result.message,
            ClientLoginFinishParameters::new(
                Some(context),
                Identifiers {
                    client: Some(id_u),
                    server: Some(id_s),
                },
                None,
            ),
        )
        .unwrap();
    let credential_finalization_bytes = client_login_finish_result.message.serialize();

    Ok(TestVectorParameters {
        client_s_pk: client_s_kp.public().serialize().to_vec(),
        client_s_sk: client_s_kp.private().serialize().to_vec(),
        client_e_pk: client_e_kp.public().serialize().to_vec(),
        client_e_sk: client_e_kp.private().serialize().to_vec(),
        server_s_pk: server_s_kp.public().serialize().to_vec(),
        server_s_sk: server_s_kp.private().serialize().to_vec(),
        server_e_pk: server_e_kp.public().serialize().to_vec(),
        server_e_sk: server_e_kp.private().serialize().to_vec(),
        fake_sk,
        credential_identifier: credential_identifier.to_vec(),
        id_u: id_u.to_vec(),
        id_s: id_s.to_vec(),
        password: password.to_vec(),
        blinding_factor: blinding_factor_bytes.to_vec(),
        oprf_seed: oprf_seed.to_vec(),
        masking_nonce: masking_nonce.to_vec(),
        envelope_nonce: envelope_nonce.to_vec(),
        client_nonce: client_nonce.to_vec(),
        server_nonce: server_nonce.to_vec(),
        context: context.to_vec(),
        registration_request: registration_request_bytes.to_vec(),
        registration_response: registration_response_bytes.to_vec(),
        registration_upload: registration_upload_bytes.to_vec(),
        credential_request: credential_request_bytes.to_vec(),
        credential_response: credential_response_bytes.to_vec(),
        credential_finalization: credential_finalization_bytes.to_vec(),
        password_file: password_file_bytes.to_vec(),
        client_registration_state: client_registration_state.to_vec(),
        client_login_state,
        server_login_state: server_login_state.to_vec(),
        session_key: client_login_finish_result.session_key.to_vec(),
        export_key: client_registration_finish_result.export_key.to_vec(),
    })
}

#[test]
fn generate_test_vectors() -> Result<(), ProtocolError> {
    #[cfg(feature = "ristretto255")]
    {
        let parameters = generate_parameters::<Ristretto255>()?;
        println!("Ristretto255: {}", stringify_test_vectors(&parameters));

        let parameters = generate_parameters::<Ristretto255P256>()?;
        println!(
            "Ristretto255 P-256: {}",
            stringify_test_vectors(&parameters)
        );

        let parameters = generate_parameters::<Ristretto255P384>()?;
        println!(
            "Ristretto255 P-384: {}",
            stringify_test_vectors(&parameters)
        );
    }

    let parameters = generate_parameters::<P256>()?;
    println!("P-256: {}", stringify_test_vectors(&parameters));

    let parameters = generate_parameters::<P256P384>()?;
    println!("P-256 P-384: {}", stringify_test_vectors(&parameters));

    #[cfg(feature = "ristretto255")]
    {
        let parameters = generate_parameters::<P256Ristretto255>()?;
        println!(
            "P-256 Ristretto255: {}",
            stringify_test_vectors(&parameters)
        );
    }

    let parameters = generate_parameters::<P384>()?;
    println!("P-384: {}", stringify_test_vectors(&parameters));

    let parameters = generate_parameters::<P384P256>()?;
    println!("P-384 P-256: {}", stringify_test_vectors(&parameters));

    #[cfg(feature = "ristretto255")]
    {
        let parameters = generate_parameters::<P384Ristretto255>()?;
        println!(
            "P-384 Ristretto255: {}",
            stringify_test_vectors(&parameters)
        );
    }

    #[cfg(feature = "curve25519")]
    {
        let parameters = generate_parameters::<Curve25519P256>()?;
        println!("Curve25519 P-256: {}", stringify_test_vectors(&parameters));

        let parameters = generate_parameters::<Curve25519P384>()?;
        println!("Curve25519 P-384: {}", stringify_test_vectors(&parameters));
    }

    #[cfg(all(feature = "curve25519", feature = "ristretto255"))]
    {
        let parameters = generate_parameters::<Curve25519Ristretto255>()?;
        println!(
            "Curve25519 Ristretto255: {}",
            stringify_test_vectors(&parameters)
        );
    }

    Ok(())
}

#[test]
fn test_registration_request() -> Result<(), ProtocolError> {
    fn inner<CS: CipherSuite>(test_vector: &str) -> Result<(), ProtocolError>
    where
        <OprfHash<CS> as OutputSizeUser>::OutputSize:
            IsLess<U256> + IsLessOrEqual<<OprfHash<CS> as BlockSizeUser>::BlockSize>,
        OprfHash<CS>: Hash,
        <OprfHash<CS> as CoreProxy>::Core: ProxyHash,
        <<OprfHash<CS> as CoreProxy>::Core as BlockSizeUser>::BlockSize: IsLess<U256>,
        Le<<<OprfHash<CS> as CoreProxy>::Core as BlockSizeUser>::BlockSize, U256>: NonZero,
        // ClientRegistration: KgSk + KgPk
        <OprfGroup<CS> as Group>::ScalarLen: Add<<OprfGroup<CS> as Group>::ElemLen>,
        ClientRegistrationLen<CS>: ArrayLength<u8>,
    {
        let parameters = populate_test_vectors(&serde_json::from_str(test_vector).unwrap());
        let mut rng = CycleRng::new(parameters.blinding_factor.to_vec());
        let client_registration_start_result =
            ClientRegistration::<CS>::start(&mut rng, &parameters.password)?;
        assert_eq!(
            hex::encode(&parameters.registration_request),
            hex::encode(client_registration_start_result.message.serialize())
        );
        assert_eq!(
            hex::encode(&parameters.client_registration_state),
            hex::encode(client_registration_start_result.state.serialize())
        );
        Ok(())
    }

    #[cfg(feature = "ristretto255")]
    inner::<Ristretto255>(TEST_VECTOR_RISTRETTO255)?;
    #[cfg(feature = "ristretto255")]
    inner::<Ristretto255P256>(TEST_VECTOR_RISTRETTO255_P256)?;
    #[cfg(feature = "ristretto255")]
    inner::<Ristretto255P384>(TEST_VECTOR_RISTRETTO255_P384)?;
    inner::<P256>(TEST_VECTOR_P256)?;
    inner::<P256P384>(TEST_VECTOR_P256_P384)?;
    #[cfg(feature = "ristretto255")]
    inner::<P256Ristretto255>(TEST_VECTOR_P256_RISTRETTO255)?;
    inner::<P384>(TEST_VECTOR_P384)?;
    inner::<P384P256>(TEST_VECTOR_P384_P256)?;
    #[cfg(feature = "ristretto255")]
    inner::<P384Ristretto255>(TEST_VECTOR_P384_RISTRETTO255)?;
    #[cfg(feature = "curve25519")]
    inner::<Curve25519P256>(TEST_VECTOR_CURVE25519_P256)?;
    #[cfg(feature = "curve25519")]
    inner::<Curve25519P384>(TEST_VECTOR_CURVE25519_P384)?;
    #[cfg(all(feature = "curve25519", feature = "ristretto255"))]
    inner::<Curve25519Ristretto255>(TEST_VECTOR_CURVE25519_RISTRETTO255)?;

    Ok(())
}

#[cfg(feature = "serde")]
#[test]
fn test_serialization() -> Result<(), ProtocolError> {
    fn inner<CS: CipherSuite>(test_vector: &str) -> Result<(), ProtocolError>
    where
        <OprfHash<CS> as OutputSizeUser>::OutputSize:
            IsLess<U256> + IsLessOrEqual<<OprfHash<CS> as BlockSizeUser>::BlockSize>,
        OprfHash<CS>: Hash,
        <OprfHash<CS> as CoreProxy>::Core: ProxyHash,
        <<OprfHash<CS> as CoreProxy>::Core as BlockSizeUser>::BlockSize: IsLess<U256>,
        Le<<<OprfHash<CS> as CoreProxy>::Core as BlockSizeUser>::BlockSize, U256>: NonZero,
    {
        let parameters = populate_test_vectors(&serde_json::from_str(test_vector).unwrap());
        let mut rng = CycleRng::new(parameters.blinding_factor.to_vec());
        let client_registration_start_result =
            ClientRegistration::<CS>::start(&mut rng, &parameters.password)?;

        // Test the bincode serialization (binary).
        let registration_request =
            bincode::serialize(&client_registration_start_result.message).unwrap();
        assert_eq!(
            registration_request.len(),
            RegistrationRequestLen::<CS>::USIZE
        );
        let registration_request: RegistrationRequest<CS> =
            bincode::deserialize(&registration_request).unwrap();
        assert_eq!(
            hex::encode(client_registration_start_result.message.serialize()),
            hex::encode(registration_request.serialize()),
        );

        Ok(())
    }

    #[cfg(feature = "ristretto255")]
    inner::<Ristretto255>(TEST_VECTOR_RISTRETTO255)?;
    #[cfg(feature = "ristretto255")]
    inner::<Ristretto255P256>(TEST_VECTOR_RISTRETTO255_P256)?;
    #[cfg(feature = "ristretto255")]
    inner::<Ristretto255P384>(TEST_VECTOR_RISTRETTO255_P384)?;
    inner::<P256>(TEST_VECTOR_P256)?;
    inner::<P256P384>(TEST_VECTOR_P256_P384)?;
    #[cfg(feature = "ristretto255")]
    inner::<P256Ristretto255>(TEST_VECTOR_P256_RISTRETTO255)?;
    inner::<P384>(TEST_VECTOR_P384)?;
    inner::<P384P256>(TEST_VECTOR_P384_P256)?;
    #[cfg(feature = "ristretto255")]
    inner::<P384Ristretto255>(TEST_VECTOR_P384_RISTRETTO255)?;
    #[cfg(feature = "curve25519")]
    inner::<Curve25519P256>(TEST_VECTOR_CURVE25519_P256)?;
    #[cfg(feature = "curve25519")]
    inner::<Curve25519P384>(TEST_VECTOR_CURVE25519_P384)?;
    #[cfg(all(feature = "curve25519", feature = "ristretto255"))]
    inner::<Curve25519Ristretto255>(TEST_VECTOR_CURVE25519_RISTRETTO255)?;

    Ok(())
}

#[test]
fn test_registration_response() -> Result<(), ProtocolError> {
    fn inner<CS: CipherSuite>(test_vector: &str) -> Result<(), ProtocolError>
    where
        <OprfHash<CS> as OutputSizeUser>::OutputSize:
            IsLess<U256> + IsLessOrEqual<<OprfHash<CS> as BlockSizeUser>::BlockSize>,
        OprfHash<CS>: Hash,
        <OprfHash<CS> as CoreProxy>::Core: ProxyHash,
        <<OprfHash<CS> as CoreProxy>::Core as BlockSizeUser>::BlockSize: IsLess<U256>,
        Le<<<OprfHash<CS> as CoreProxy>::Core as BlockSizeUser>::BlockSize, U256>: NonZero,
        // RegistrationResponse: KgPk + KePk
        <OprfGroup<CS> as Group>::ElemLen: Add<<CS::KeGroup as KeGroup>::PkLen>,
        RegistrationResponseLen<CS>: ArrayLength<u8>,
    {
        let parameters = populate_test_vectors(
            &serde_json::from_str(test_vector).map_err(|_| ProtocolError::SerializationError)?,
        );

        let server_setup = ServerSetup::<CS>::deserialize(
            &[
                parameters.oprf_seed,
                parameters.server_s_sk,
                parameters.fake_sk,
            ]
            .concat(),
        )?;

        let server_registration_start_result = ServerRegistration::<CS>::start(
            &server_setup,
            RegistrationRequest::deserialize(&parameters.registration_request)?,
            &parameters.credential_identifier,
        )?;
        assert_eq!(
            hex::encode(parameters.registration_response),
            hex::encode(server_registration_start_result.message.serialize())
        );
        Ok(())
    }

    #[cfg(feature = "ristretto255")]
    inner::<Ristretto255>(TEST_VECTOR_RISTRETTO255)?;
    #[cfg(feature = "ristretto255")]
    inner::<Ristretto255P256>(TEST_VECTOR_RISTRETTO255_P256)?;
    #[cfg(feature = "ristretto255")]
    inner::<Ristretto255P384>(TEST_VECTOR_RISTRETTO255_P384)?;
    inner::<P256>(TEST_VECTOR_P256)?;
    inner::<P256P384>(TEST_VECTOR_P256_P384)?;
    #[cfg(feature = "ristretto255")]
    inner::<P256Ristretto255>(TEST_VECTOR_P256_RISTRETTO255)?;
    inner::<P384>(TEST_VECTOR_P384)?;
    inner::<P384P256>(TEST_VECTOR_P384_P256)?;
    #[cfg(feature = "ristretto255")]
    inner::<P384Ristretto255>(TEST_VECTOR_P384_RISTRETTO255)?;
    #[cfg(feature = "curve25519")]
    inner::<Curve25519P256>(TEST_VECTOR_CURVE25519_P256)?;
    #[cfg(feature = "curve25519")]
    inner::<Curve25519P384>(TEST_VECTOR_CURVE25519_P384)?;
    #[cfg(all(feature = "curve25519", feature = "ristretto255"))]
    inner::<Curve25519Ristretto255>(TEST_VECTOR_CURVE25519_RISTRETTO255)?;

    Ok(())
}

#[test]
fn test_registration_upload() -> Result<(), ProtocolError> {
    fn inner<CS: CipherSuite>(test_vector: &str) -> Result<(), ProtocolError>
    where
        <OprfHash<CS> as OutputSizeUser>::OutputSize:
            IsLess<U256> + IsLessOrEqual<<OprfHash<CS> as BlockSizeUser>::BlockSize>,
        OprfHash<CS>: Hash,
        <OprfHash<CS> as CoreProxy>::Core: ProxyHash,
        <<OprfHash<CS> as CoreProxy>::Core as BlockSizeUser>::BlockSize: IsLess<U256>,
        Le<<<OprfHash<CS> as CoreProxy>::Core as BlockSizeUser>::BlockSize, U256>: NonZero,
        // Envelope: Nonce + Hash
        NonceLen: Add<OutputSize<OprfHash<CS>>>,
        EnvelopeLen<CS>: ArrayLength<u8>,
        // RegistrationUpload: (KePk + Hash) + Envelope
        <CS::KeGroup as KeGroup>::PkLen: Add<OutputSize<OprfHash<CS>>>,
        Sum<<CS::KeGroup as KeGroup>::PkLen, OutputSize<OprfHash<CS>>>:
            ArrayLength<u8> + Add<EnvelopeLen<CS>>,
        RegistrationUploadLen<CS>: ArrayLength<u8>,
    {
        let parameters = populate_test_vectors(
            &serde_json::from_str(test_vector).map_err(|_| ProtocolError::SerializationError)?,
        );

        let client_s_sk_and_nonce: Vec<u8> =
            [parameters.client_s_sk, parameters.envelope_nonce].concat();
        let mut finish_registration_rng = CycleRng::new(client_s_sk_and_nonce);
        let result = ClientRegistration::<CS>::deserialize(&parameters.client_registration_state)?
            .finish(
                &mut finish_registration_rng,
                &parameters.password,
                RegistrationResponse::deserialize(&parameters.registration_response)?,
                ClientRegistrationFinishParameters::new(
                    Identifiers {
                        client: Some(&parameters.id_u),
                        server: Some(&parameters.id_s),
                    },
                    None,
                ),
            )?;

        assert_eq!(
            hex::encode(parameters.registration_upload),
            hex::encode(result.message.serialize())
        );
        assert_eq!(
            hex::encode(parameters.export_key),
            hex::encode(result.export_key)
        );

        Ok(())
    }

    #[cfg(feature = "ristretto255")]
    inner::<Ristretto255>(TEST_VECTOR_RISTRETTO255)?;
    #[cfg(feature = "ristretto255")]
    inner::<Ristretto255P256>(TEST_VECTOR_RISTRETTO255_P256)?;
    #[cfg(feature = "ristretto255")]
    inner::<Ristretto255P384>(TEST_VECTOR_RISTRETTO255_P384)?;
    inner::<P256>(TEST_VECTOR_P256)?;
    inner::<P256P384>(TEST_VECTOR_P256_P384)?;
    #[cfg(feature = "ristretto255")]
    inner::<P256Ristretto255>(TEST_VECTOR_P256_RISTRETTO255)?;
    inner::<P384>(TEST_VECTOR_P384)?;
    inner::<P384P256>(TEST_VECTOR_P384_P256)?;
    #[cfg(feature = "ristretto255")]
    inner::<P384Ristretto255>(TEST_VECTOR_P384_RISTRETTO255)?;
    #[cfg(feature = "curve25519")]
    inner::<Curve25519P256>(TEST_VECTOR_CURVE25519_P256)?;
    #[cfg(feature = "curve25519")]
    inner::<Curve25519P384>(TEST_VECTOR_CURVE25519_P384)?;
    #[cfg(all(feature = "curve25519", feature = "ristretto255"))]
    inner::<Curve25519Ristretto255>(TEST_VECTOR_CURVE25519_RISTRETTO255)?;

    Ok(())
}

#[test]
fn test_password_file() -> Result<(), ProtocolError> {
    fn inner<CS: CipherSuite>(test_vector: &str) -> Result<(), ProtocolError>
    where
        <OprfHash<CS> as OutputSizeUser>::OutputSize:
            IsLess<U256> + IsLessOrEqual<<OprfHash<CS> as BlockSizeUser>::BlockSize>,
        OprfHash<CS>: Hash,
        <OprfHash<CS> as CoreProxy>::Core: ProxyHash,
        <<OprfHash<CS> as CoreProxy>::Core as BlockSizeUser>::BlockSize: IsLess<U256>,
        Le<<<OprfHash<CS> as CoreProxy>::Core as BlockSizeUser>::BlockSize, U256>: NonZero,
        // Envelope: Nonce + Hash
        NonceLen: Add<OutputSize<OprfHash<CS>>>,
        EnvelopeLen<CS>: ArrayLength<u8>,
        // RegistrationUpload: (KePk + Hash) + Envelope
        <CS::KeGroup as KeGroup>::PkLen: Add<OutputSize<OprfHash<CS>>>,
        Sum<<CS::KeGroup as KeGroup>::PkLen, OutputSize<OprfHash<CS>>>:
            ArrayLength<u8> + Add<EnvelopeLen<CS>>,
        RegistrationUploadLen<CS>: ArrayLength<u8>,
        // ServerRegistration = RegistrationUpload
    {
        let parameters = populate_test_vectors(&serde_json::from_str(test_vector).unwrap());

        let password_file = ServerRegistration::finish(RegistrationUpload::<CS>::deserialize(
            &parameters.registration_upload,
        )?);

        assert_eq!(
            hex::encode(parameters.password_file),
            hex::encode(password_file.serialize())
        );
        Ok(())
    }

    #[cfg(feature = "ristretto255")]
    inner::<Ristretto255>(TEST_VECTOR_RISTRETTO255)?;
    #[cfg(feature = "ristretto255")]
    inner::<Ristretto255P256>(TEST_VECTOR_RISTRETTO255_P256)?;
    #[cfg(feature = "ristretto255")]
    inner::<Ristretto255P384>(TEST_VECTOR_RISTRETTO255_P384)?;
    inner::<P256>(TEST_VECTOR_P256)?;
    inner::<P256P384>(TEST_VECTOR_P256_P384)?;
    #[cfg(feature = "ristretto255")]
    inner::<P256Ristretto255>(TEST_VECTOR_P256_RISTRETTO255)?;
    inner::<P384>(TEST_VECTOR_P384)?;
    inner::<P384P256>(TEST_VECTOR_P384_P256)?;
    #[cfg(feature = "ristretto255")]
    inner::<P384Ristretto255>(TEST_VECTOR_P384_RISTRETTO255)?;
    #[cfg(feature = "curve25519")]
    inner::<Curve25519P256>(TEST_VECTOR_CURVE25519_P256)?;
    #[cfg(feature = "curve25519")]
    inner::<Curve25519P384>(TEST_VECTOR_CURVE25519_P384)?;
    #[cfg(all(feature = "curve25519", feature = "ristretto255"))]
    inner::<Curve25519Ristretto255>(TEST_VECTOR_CURVE25519_RISTRETTO255)?;

    Ok(())
}

#[test]
fn test_credential_request() -> Result<(), ProtocolError> {
    fn inner<CS: CipherSuite>(test_vector: &str) -> Result<(), ProtocolError>
    where
        <OprfHash<CS> as OutputSizeUser>::OutputSize:
            IsLess<U256> + IsLessOrEqual<<OprfHash<CS> as BlockSizeUser>::BlockSize>,
        OprfHash<CS>: Hash,
        <OprfHash<CS> as CoreProxy>::Core: ProxyHash,
        <<OprfHash<CS> as CoreProxy>::Core as BlockSizeUser>::BlockSize: IsLess<U256>,
        Le<<<OprfHash<CS> as CoreProxy>::Core as BlockSizeUser>::BlockSize, U256>: NonZero,
        // CredentialRequest: KgPk + Ke1Message
        <OprfGroup<CS> as Group>::ElemLen: Add<Ke1MessageLen<CS>>,
        CredentialRequestLen<CS>: ArrayLength<u8>,
        // ClientLogin: KgSk + CredentialRequest + Ke1State
        <OprfGroup<CS> as Group>::ScalarLen: Add<CredentialRequestLen<CS>>,
        Sum<<OprfGroup<CS> as Group>::ScalarLen, CredentialRequestLen<CS>>:
            ArrayLength<u8> + Add<Ke1StateLen<CS>>,
        ClientLoginLen<CS>: ArrayLength<u8>,
    {
        let parameters = populate_test_vectors(&serde_json::from_str(test_vector).unwrap());

        let client_login_start_rng = [
            parameters.blinding_factor,
            parameters.client_e_sk,
            parameters.client_nonce,
        ]
        .concat();
        let mut client_login_start_rng = CycleRng::new(client_login_start_rng);
        let client_login_start_result =
            ClientLogin::<CS>::start(&mut client_login_start_rng, &parameters.password)?;
        assert_eq!(
            hex::encode(&parameters.credential_request),
            hex::encode(client_login_start_result.message.serialize())
        );
        assert_eq!(
            hex::encode(&parameters.client_login_state),
            hex::encode(client_login_start_result.state.serialize())
        );
        Ok(())
    }

    #[cfg(feature = "ristretto255")]
    inner::<Ristretto255>(TEST_VECTOR_RISTRETTO255)?;
    #[cfg(feature = "ristretto255")]
    inner::<Ristretto255P256>(TEST_VECTOR_RISTRETTO255_P256)?;
    #[cfg(feature = "ristretto255")]
    inner::<Ristretto255P384>(TEST_VECTOR_RISTRETTO255_P384)?;
    inner::<P256>(TEST_VECTOR_P256)?;
    inner::<P256P384>(TEST_VECTOR_P256_P384)?;
    #[cfg(feature = "ristretto255")]
    inner::<P256Ristretto255>(TEST_VECTOR_P256_RISTRETTO255)?;
    inner::<P384>(TEST_VECTOR_P384)?;
    inner::<P384P256>(TEST_VECTOR_P384_P256)?;
    #[cfg(feature = "ristretto255")]
    inner::<P384Ristretto255>(TEST_VECTOR_P384_RISTRETTO255)?;
    #[cfg(feature = "curve25519")]
    inner::<Curve25519P256>(TEST_VECTOR_CURVE25519_P256)?;
    #[cfg(feature = "curve25519")]
    inner::<Curve25519P384>(TEST_VECTOR_CURVE25519_P384)?;
    #[cfg(all(feature = "curve25519", feature = "ristretto255"))]
    inner::<Curve25519Ristretto255>(TEST_VECTOR_CURVE25519_RISTRETTO255)?;

    Ok(())
}

#[test]
fn test_credential_response() -> Result<(), ProtocolError> {
    fn inner<CS: CipherSuite>(test_vector: &str) -> Result<(), ProtocolError>
    where
        <OprfHash<CS> as OutputSizeUser>::OutputSize:
            IsLess<U256> + IsLessOrEqual<<OprfHash<CS> as BlockSizeUser>::BlockSize>,
        OprfHash<CS>: Hash,
        <OprfHash<CS> as CoreProxy>::Core: ProxyHash,
        <<OprfHash<CS> as CoreProxy>::Core as BlockSizeUser>::BlockSize: IsLess<U256>,
        Le<<<OprfHash<CS> as CoreProxy>::Core as BlockSizeUser>::BlockSize, U256>: NonZero,
        // MaskedResponse: (Nonce + Hash) + KePk
        NonceLen: Add<OutputSize<OprfHash<CS>>>,
        Sum<NonceLen, OutputSize<OprfHash<CS>>>:
            ArrayLength<u8> + Add<<CS::KeGroup as KeGroup>::PkLen>,
        MaskedResponseLen<CS>: ArrayLength<u8>,
        // CredentialResponseWithoutKeLen: (KgPk + Nonce) + MaskedResponse
        <OprfGroup<CS> as Group>::ElemLen: Add<NonceLen>,
        Sum<<OprfGroup<CS> as Group>::ElemLen, NonceLen>:
            ArrayLength<u8> + Add<MaskedResponseLen<CS>>,
        CredentialResponseWithoutKeLen<CS>: ArrayLength<u8>,
        // CredentialResponse: CredentialResponseWithoutKeLen + Ke2Message
        CredentialResponseWithoutKeLen<CS>: Add<Ke2MessageLen<CS>>,
        CredentialResponseLen<CS>: ArrayLength<u8>,
    {
        let parameters = populate_test_vectors(&serde_json::from_str(test_vector).unwrap());

        let server_setup = ServerSetup::<CS>::deserialize(
            &[
                parameters.oprf_seed,
                parameters.server_s_sk,
                parameters.fake_sk,
            ]
            .concat(),
        )?;

        let mut server_e_sk_and_nonce_rng = CycleRng::new(
            [
                parameters.masking_nonce,
                parameters.server_e_sk,
                parameters.server_nonce,
            ]
            .concat(),
        );
        let server_login_start_result = ServerLogin::<CS>::start(
            &mut server_e_sk_and_nonce_rng,
            &server_setup,
            Some(ServerRegistration::deserialize(&parameters.password_file)?),
            CredentialRequest::<CS>::deserialize(&parameters.credential_request)?,
            &parameters.credential_identifier,
            ServerLoginStartParameters {
                context: Some(&parameters.context),
                identifiers: Identifiers {
                    client: Some(&parameters.id_u),
                    server: Some(&parameters.id_s),
                },
            },
        )?;
        assert_eq!(
            hex::encode(&parameters.credential_response),
            hex::encode(server_login_start_result.message.serialize())
        );
        assert_eq!(
            hex::encode(&parameters.server_login_state),
            hex::encode(server_login_start_result.state.serialize())
        );
        Ok(())
    }

    #[cfg(feature = "ristretto255")]
    inner::<Ristretto255>(TEST_VECTOR_RISTRETTO255)?;
    #[cfg(feature = "ristretto255")]
    inner::<Ristretto255P256>(TEST_VECTOR_RISTRETTO255_P256)?;
    #[cfg(feature = "ristretto255")]
    inner::<Ristretto255P384>(TEST_VECTOR_RISTRETTO255_P384)?;
    inner::<P256>(TEST_VECTOR_P256)?;
    inner::<P256P384>(TEST_VECTOR_P256_P384)?;
    #[cfg(feature = "ristretto255")]
    inner::<P256Ristretto255>(TEST_VECTOR_P256_RISTRETTO255)?;
    inner::<P384>(TEST_VECTOR_P384)?;
    inner::<P384P256>(TEST_VECTOR_P384_P256)?;
    #[cfg(feature = "ristretto255")]
    inner::<P384Ristretto255>(TEST_VECTOR_P384_RISTRETTO255)?;
    #[cfg(feature = "curve25519")]
    inner::<Curve25519P256>(TEST_VECTOR_CURVE25519_P256)?;
    #[cfg(feature = "curve25519")]
    inner::<Curve25519P384>(TEST_VECTOR_CURVE25519_P384)?;
    #[cfg(all(feature = "curve25519", feature = "ristretto255"))]
    inner::<Curve25519Ristretto255>(TEST_VECTOR_CURVE25519_RISTRETTO255)?;

    Ok(())
}

#[test]
fn test_credential_finalization() -> Result<(), ProtocolError> {
    fn inner<CS: CipherSuite>(test_vector: &str) -> Result<(), ProtocolError>
    where
        <OprfHash<CS> as OutputSizeUser>::OutputSize:
            IsLess<U256> + IsLessOrEqual<<OprfHash<CS> as BlockSizeUser>::BlockSize>,
        OprfHash<CS>: Hash,
        <OprfHash<CS> as CoreProxy>::Core: ProxyHash,
        <<OprfHash<CS> as CoreProxy>::Core as BlockSizeUser>::BlockSize: IsLess<U256>,
        Le<<<OprfHash<CS> as CoreProxy>::Core as BlockSizeUser>::BlockSize, U256>: NonZero,
        // MaskedResponse: (Nonce + Hash) + KePk
        NonceLen: Add<OutputSize<OprfHash<CS>>>,
        Sum<NonceLen, OutputSize<OprfHash<CS>>>:
            ArrayLength<u8> + Add<<CS::KeGroup as KeGroup>::PkLen>,
        MaskedResponseLen<CS>: ArrayLength<u8>,
    {
        let parameters = populate_test_vectors(&serde_json::from_str(test_vector).unwrap());

        let client_login_finish_result =
            ClientLogin::<CS>::deserialize(&parameters.client_login_state)?.finish(
                &parameters.password,
                CredentialResponse::<CS>::deserialize(&parameters.credential_response)?,
                ClientLoginFinishParameters::new(
                    Some(&parameters.context),
                    Identifiers {
                        client: Some(&parameters.id_u),
                        server: Some(&parameters.id_s),
                    },
                    None,
                ),
            )?;

        assert_eq!(
            hex::encode(&parameters.server_s_pk),
            hex::encode(&client_login_finish_result.server_s_pk.serialize())
        );
        assert_eq!(
            hex::encode(&parameters.session_key),
            hex::encode(&client_login_finish_result.session_key)
        );
        assert_eq!(
            hex::encode(&parameters.credential_finalization),
            hex::encode(client_login_finish_result.message.serialize())
        );
        assert_eq!(
            hex::encode(&parameters.export_key),
            hex::encode(client_login_finish_result.export_key)
        );

        Ok(())
    }

    #[cfg(feature = "ristretto255")]
    inner::<Ristretto255>(TEST_VECTOR_RISTRETTO255)?;
    #[cfg(feature = "ristretto255")]
    inner::<Ristretto255P256>(TEST_VECTOR_RISTRETTO255_P256)?;
    #[cfg(feature = "ristretto255")]
    inner::<Ristretto255P384>(TEST_VECTOR_RISTRETTO255_P384)?;
    inner::<P256>(TEST_VECTOR_P256)?;
    inner::<P256P384>(TEST_VECTOR_P256_P384)?;
    #[cfg(feature = "ristretto255")]
    inner::<P256Ristretto255>(TEST_VECTOR_P256_RISTRETTO255)?;
    inner::<P384>(TEST_VECTOR_P384)?;
    inner::<P384P256>(TEST_VECTOR_P384_P256)?;
    #[cfg(feature = "ristretto255")]
    inner::<P384Ristretto255>(TEST_VECTOR_P384_RISTRETTO255)?;
    #[cfg(feature = "curve25519")]
    inner::<Curve25519P256>(TEST_VECTOR_CURVE25519_P256)?;
    #[cfg(feature = "curve25519")]
    inner::<Curve25519P384>(TEST_VECTOR_CURVE25519_P384)?;
    #[cfg(all(feature = "curve25519", feature = "ristretto255"))]
    inner::<Curve25519Ristretto255>(TEST_VECTOR_CURVE25519_RISTRETTO255)?;

    Ok(())
}

#[test]
fn test_server_login_finish() -> Result<(), ProtocolError> {
    fn inner<CS: CipherSuite>(test_vector: &str) -> Result<(), ProtocolError>
    where
        <OprfHash<CS> as OutputSizeUser>::OutputSize:
            IsLess<U256> + IsLessOrEqual<<OprfHash<CS> as BlockSizeUser>::BlockSize>,
        OprfHash<CS>: Hash,
        <OprfHash<CS> as CoreProxy>::Core: ProxyHash,
        <<OprfHash<CS> as CoreProxy>::Core as BlockSizeUser>::BlockSize: IsLess<U256>,
        Le<<<OprfHash<CS> as CoreProxy>::Core as BlockSizeUser>::BlockSize, U256>: NonZero,
    {
        let parameters = populate_test_vectors(&serde_json::from_str(test_vector).unwrap());

        let server_login_result = ServerLogin::<CS>::deserialize(&parameters.server_login_state)?
            .finish(CredentialFinalization::deserialize(
            &parameters.credential_finalization,
        )?)?;

        assert_eq!(
            hex::encode(parameters.session_key),
            hex::encode(&server_login_result.session_key)
        );

        Ok(())
    }

    #[cfg(feature = "ristretto255")]
    inner::<Ristretto255>(TEST_VECTOR_RISTRETTO255)?;
    #[cfg(feature = "ristretto255")]
    inner::<Ristretto255P256>(TEST_VECTOR_RISTRETTO255_P256)?;
    #[cfg(feature = "ristretto255")]
    inner::<Ristretto255P384>(TEST_VECTOR_RISTRETTO255_P384)?;
    inner::<P256>(TEST_VECTOR_P256)?;
    inner::<P256P384>(TEST_VECTOR_P256_P384)?;
    #[cfg(feature = "ristretto255")]
    inner::<P256Ristretto255>(TEST_VECTOR_P256_RISTRETTO255)?;
    inner::<P384>(TEST_VECTOR_P384)?;
    inner::<P384P256>(TEST_VECTOR_P384_P256)?;
    #[cfg(feature = "ristretto255")]
    inner::<P384Ristretto255>(TEST_VECTOR_P384_RISTRETTO255)?;
    #[cfg(feature = "curve25519")]
    inner::<Curve25519P256>(TEST_VECTOR_CURVE25519_P256)?;
    #[cfg(feature = "curve25519")]
    inner::<Curve25519P384>(TEST_VECTOR_CURVE25519_P384)?;
    #[cfg(all(feature = "curve25519", feature = "ristretto255"))]
    inner::<Curve25519Ristretto255>(TEST_VECTOR_CURVE25519_RISTRETTO255)?;

    Ok(())
}

fn test_complete_flow<CS: CipherSuite>(
    registration_password: &[u8],
    login_password: &[u8],
) -> Result<(), ProtocolError>
where
    <OprfHash<CS> as OutputSizeUser>::OutputSize:
        IsLess<U256> + IsLessOrEqual<<OprfHash<CS> as BlockSizeUser>::BlockSize>,
    OprfHash<CS>: Hash,
    <OprfHash<CS> as CoreProxy>::Core: ProxyHash,
    <<OprfHash<CS> as CoreProxy>::Core as BlockSizeUser>::BlockSize: IsLess<U256>,
    Le<<<OprfHash<CS> as CoreProxy>::Core as BlockSizeUser>::BlockSize, U256>: NonZero,
    // MaskedResponse: (Nonce + Hash) + KePk
    NonceLen: Add<OutputSize<OprfHash<CS>>>,
    Sum<NonceLen, OutputSize<OprfHash<CS>>>: ArrayLength<u8> + Add<<CS::KeGroup as KeGroup>::PkLen>,
    MaskedResponseLen<CS>: ArrayLength<u8>,
{
    let credential_identifier = b"credentialIdentifier";
    let mut client_rng = OsRng;
    let mut server_rng = OsRng;
    let server_setup = ServerSetup::<CS>::new(&mut server_rng);
    let client_registration_start_result =
        ClientRegistration::<CS>::start(&mut client_rng, registration_password)?;
    let server_registration_start_result = ServerRegistration::<CS>::start(
        &server_setup,
        client_registration_start_result.message,
        credential_identifier,
    )?;
    let client_registration_finish_result = client_registration_start_result.state.finish(
        &mut client_rng,
        registration_password,
        server_registration_start_result.message,
        ClientRegistrationFinishParameters::default(),
    )?;
    let p_file = ServerRegistration::finish(client_registration_finish_result.message);
    let client_login_start_result = ClientLogin::<CS>::start(&mut client_rng, login_password)?;
    let server_login_start_result = ServerLogin::<CS>::start(
        &mut server_rng,
        &server_setup,
        Some(p_file),
        client_login_start_result.message,
        credential_identifier,
        ServerLoginStartParameters::default(),
    )?;

    let client_login_result = client_login_start_result.state.finish(
        login_password,
        server_login_start_result.message,
        ClientLoginFinishParameters::default(),
    );

    if hex::encode(registration_password) == hex::encode(login_password) {
        let client_login_finish_result = client_login_result?;
        let server_login_finish_result = server_login_start_result
            .state
            .finish(client_login_finish_result.message)?;

        assert_eq!(
            hex::encode(&server_login_finish_result.session_key),
            hex::encode(&client_login_finish_result.session_key)
        );
        assert_eq!(
            hex::encode(client_registration_finish_result.export_key),
            hex::encode(client_login_finish_result.export_key)
        );
    } else {
        assert!(matches!(
            client_login_result,
            Err(ProtocolError::InvalidLoginError)
        ));
    }

    Ok(())
}

#[test]
fn test_complete_flow_success() -> Result<(), ProtocolError> {
    #[cfg(feature = "ristretto255")]
    test_complete_flow::<Ristretto255>(b"good password", b"good password")?;
    #[cfg(feature = "ristretto255")]
    test_complete_flow::<Ristretto255P256>(b"good password", b"good password")?;
    #[cfg(feature = "ristretto255")]
    test_complete_flow::<Ristretto255P384>(b"good password", b"good password")?;
    test_complete_flow::<P256>(b"good password", b"good password")?;
    test_complete_flow::<P256P384>(b"good password", b"good password")?;
    #[cfg(feature = "ristretto255")]
    test_complete_flow::<P256Ristretto255>(b"good password", b"good password")?;
    test_complete_flow::<P384>(b"good password", b"good password")?;
    test_complete_flow::<P384P256>(b"good password", b"good password")?;
    #[cfg(feature = "ristretto255")]
    test_complete_flow::<P384Ristretto255>(b"good password", b"good password")?;
    #[cfg(feature = "curve25519")]
    test_complete_flow::<Curve25519P256>(b"good password", b"good password")?;
    #[cfg(feature = "curve25519")]
    test_complete_flow::<Curve25519P384>(b"good password", b"good password")?;
    #[cfg(all(feature = "curve25519", feature = "ristretto255"))]
    test_complete_flow::<Curve25519Ristretto255>(b"good password", b"good password")?;

    Ok(())
}

#[test]
fn test_complete_flow_fail() -> Result<(), ProtocolError> {
    #[cfg(feature = "ristretto255")]
    test_complete_flow::<Ristretto255>(b"good password", b"bad password")?;
    #[cfg(feature = "ristretto255")]
    test_complete_flow::<Ristretto255P256>(b"good password", b"bad password")?;
    #[cfg(feature = "ristretto255")]
    test_complete_flow::<Ristretto255P384>(b"good password", b"bad password")?;
    test_complete_flow::<P256>(b"good password", b"bad password")?;
    test_complete_flow::<P256P384>(b"good password", b"bad password")?;
    #[cfg(feature = "ristretto255")]
    test_complete_flow::<P256Ristretto255>(b"good password", b"bad password")?;
    test_complete_flow::<P384>(b"good password", b"bad password")?;
    test_complete_flow::<P384P256>(b"good password", b"bad password")?;
    #[cfg(feature = "ristretto255")]
    test_complete_flow::<P384Ristretto255>(b"good password", b"bad password")?;
    #[cfg(feature = "curve25519")]
    test_complete_flow::<Curve25519P256>(b"good password", b"bad password")?;
    #[cfg(feature = "curve25519")]
    test_complete_flow::<Curve25519P384>(b"good password", b"bad password")?;
    #[cfg(all(feature = "curve25519", feature = "ristretto255"))]
    test_complete_flow::<Curve25519Ristretto255>(b"good password", b"bad password")?;

    Ok(())
}

// Zeroize tests

#[test]
fn test_zeroize_client_registration_start() -> Result<(), ProtocolError> {
    fn inner<CS: CipherSuite>() -> Result<(), ProtocolError>
    where
        <OprfHash<CS> as OutputSizeUser>::OutputSize:
            IsLess<U256> + IsLessOrEqual<<OprfHash<CS> as BlockSizeUser>::BlockSize>,
        OprfHash<CS>: Hash,
        <OprfHash<CS> as CoreProxy>::Core: ProxyHash,
        <<OprfHash<CS> as CoreProxy>::Core as BlockSizeUser>::BlockSize: IsLess<U256>,
        Le<<<OprfHash<CS> as CoreProxy>::Core as BlockSizeUser>::BlockSize, U256>: NonZero,
    {
        let mut client_rng = OsRng;
        let client_registration_start_result =
            ClientRegistration::<CS>::start(&mut client_rng, STR_PASSWORD.as_bytes())?;

        let mut state = client_registration_start_result.state;
        unsafe { ptr::drop_in_place(&mut state) };
        for byte in state.to_vec() {
            assert_eq!(byte, 0);
        }

        Ok(())
    }

    #[cfg(feature = "ristretto255")]
    inner::<Ristretto255>()?;
    #[cfg(feature = "ristretto255")]
    inner::<Ristretto255P256>()?;
    #[cfg(feature = "ristretto255")]
    inner::<Ristretto255P384>()?;
    inner::<P256>()?;
    inner::<P256P384>()?;
    #[cfg(feature = "ristretto255")]
    inner::<P256Ristretto255>()?;
    inner::<P384>()?;
    inner::<P384P256>()?;
    #[cfg(feature = "ristretto255")]
    inner::<P384Ristretto255>()?;
    #[cfg(feature = "curve25519")]
    inner::<Curve25519P256>()?;
    #[cfg(feature = "curve25519")]
    inner::<Curve25519P384>()?;
    #[cfg(all(feature = "curve25519", feature = "ristretto255"))]
    inner::<Curve25519Ristretto255>()?;

    Ok(())
}

#[test]
fn test_zeroize_client_registration_finish() -> Result<(), ProtocolError> {
    fn inner<CS: CipherSuite>() -> Result<(), ProtocolError>
    where
        <OprfHash<CS> as OutputSizeUser>::OutputSize:
            IsLess<U256> + IsLessOrEqual<<OprfHash<CS> as BlockSizeUser>::BlockSize>,
        OprfHash<CS>: Hash,
        <OprfHash<CS> as CoreProxy>::Core: ProxyHash,
        <<OprfHash<CS> as CoreProxy>::Core as BlockSizeUser>::BlockSize: IsLess<U256>,
        Le<<<OprfHash<CS> as CoreProxy>::Core as BlockSizeUser>::BlockSize, U256>: NonZero,
    {
        let mut client_rng = OsRng;
        let mut server_rng = OsRng;
        let server_setup = ServerSetup::<CS>::new(&mut server_rng);
        let client_registration_start_result =
            ClientRegistration::<CS>::start(&mut client_rng, STR_PASSWORD.as_bytes())?;
        let server_registration_start_result = ServerRegistration::<CS>::start(
            &server_setup,
            client_registration_start_result.message,
            STR_CREDENTIAL_IDENTIFIER.as_bytes(),
        )?;
        let client_registration_finish_result = client_registration_start_result.state.finish(
            &mut client_rng,
            STR_PASSWORD.as_bytes(),
            server_registration_start_result.message,
            ClientRegistrationFinishParameters::default(),
        )?;

        let mut state = client_registration_finish_result.state;
        unsafe { ptr::drop_in_place(&mut state) };
        for byte in state.to_vec() {
            assert_eq!(byte, 0);
        }

        Ok(())
    }

    #[cfg(feature = "ristretto255")]
    inner::<Ristretto255>()?;
    #[cfg(feature = "ristretto255")]
    inner::<Ristretto255P256>()?;
    #[cfg(feature = "ristretto255")]
    inner::<Ristretto255P384>()?;
    inner::<P256>()?;
    inner::<P256P384>()?;
    #[cfg(feature = "ristretto255")]
    inner::<P256Ristretto255>()?;
    inner::<P384>()?;
    inner::<P384P256>()?;
    #[cfg(feature = "ristretto255")]
    inner::<P384Ristretto255>()?;
    #[cfg(feature = "curve25519")]
    inner::<Curve25519P256>()?;
    #[cfg(feature = "curve25519")]
    inner::<Curve25519P384>()?;
    #[cfg(all(feature = "curve25519", feature = "ristretto255"))]
    inner::<Curve25519Ristretto255>()?;

    Ok(())
}

#[test]
fn test_zeroize_server_registration_finish() -> Result<(), ProtocolError> {
    fn inner<CS: CipherSuite>() -> Result<(), ProtocolError>
    where
        <OprfHash<CS> as OutputSizeUser>::OutputSize:
            IsLess<U256> + IsLessOrEqual<<OprfHash<CS> as BlockSizeUser>::BlockSize>,
        OprfHash<CS>: Hash,
        <OprfHash<CS> as CoreProxy>::Core: ProxyHash,
        <<OprfHash<CS> as CoreProxy>::Core as BlockSizeUser>::BlockSize: IsLess<U256>,
        Le<<<OprfHash<CS> as CoreProxy>::Core as BlockSizeUser>::BlockSize, U256>: NonZero,
        // Envelope: Nonce + Hash
        NonceLen: Add<OutputSize<OprfHash<CS>>>,
        EnvelopeLen<CS>: ArrayLength<u8>,
        // RegistrationUpload: (KePk + Hash) + Envelope
        <CS::KeGroup as KeGroup>::PkLen: Add<OutputSize<OprfHash<CS>>>,
        Sum<<CS::KeGroup as KeGroup>::PkLen, OutputSize<OprfHash<CS>>>:
            ArrayLength<u8> + Add<EnvelopeLen<CS>>,
        RegistrationUploadLen<CS>: ArrayLength<u8>,
        // ServerRegistration = RegistrationUpload
    {
        let mut client_rng = OsRng;
        let mut server_rng = OsRng;
        let server_setup = ServerSetup::<CS>::new(&mut server_rng);
        let client_registration_start_result =
            ClientRegistration::<CS>::start(&mut client_rng, STR_PASSWORD.as_bytes())?;
        let server_registration_start_result = ServerRegistration::<CS>::start(
            &server_setup,
            client_registration_start_result.message,
            STR_CREDENTIAL_IDENTIFIER.as_bytes(),
        )?;
        let client_registration_finish_result = client_registration_start_result.state.finish(
            &mut client_rng,
            STR_PASSWORD.as_bytes(),
            server_registration_start_result.message,
            ClientRegistrationFinishParameters::default(),
        )?;
        let p_file = ServerRegistration::finish(client_registration_finish_result.message);

        let mut state = p_file;
        util::drop_manually(&mut state);
        util::test_zeroized(&mut state.0.envelope.mode);
        util::test_zeroized(&mut state.0.masking_key);

        Ok(())
    }

    #[cfg(feature = "ristretto255")]
    inner::<Ristretto255>()?;
    #[cfg(feature = "ristretto255")]
    inner::<Ristretto255P256>()?;
    #[cfg(feature = "ristretto255")]
    inner::<Ristretto255P384>()?;
    inner::<P256>()?;
    inner::<P256P384>()?;
    #[cfg(feature = "ristretto255")]
    inner::<P256Ristretto255>()?;
    inner::<P384>()?;
    inner::<P384P256>()?;
    #[cfg(feature = "ristretto255")]
    inner::<P384Ristretto255>()?;
    #[cfg(feature = "curve25519")]
    inner::<Curve25519P256>()?;
    #[cfg(feature = "curve25519")]
    inner::<Curve25519P384>()?;
    #[cfg(all(feature = "curve25519", feature = "ristretto255"))]
    inner::<Curve25519Ristretto255>()?;

    Ok(())
}

#[test]
fn test_zeroize_client_login_start() -> Result<(), ProtocolError> {
    fn inner<CS: CipherSuite<KeyExchange = TripleDh>>() -> Result<(), ProtocolError>
    where
        <OprfHash<CS> as OutputSizeUser>::OutputSize:
            IsLess<U256> + IsLessOrEqual<<OprfHash<CS> as BlockSizeUser>::BlockSize>,
        OprfHash<CS>: Hash,
        <OprfHash<CS> as CoreProxy>::Core: ProxyHash,
        <<OprfHash<CS> as CoreProxy>::Core as BlockSizeUser>::BlockSize: IsLess<U256>,
        Le<<<OprfHash<CS> as CoreProxy>::Core as BlockSizeUser>::BlockSize, U256>: NonZero,
        // CredentialRequest: KgPk + Ke1Message
        <OprfGroup<CS> as Group>::ElemLen: Add<Sum<NonceLen, <CS::KeGroup as KeGroup>::PkLen>>,
        CredentialRequestLen<CS>: ArrayLength<u8>,
        // Ke1State: KeSk + Nonce
        <CS::KeGroup as KeGroup>::SkLen: Add<NonceLen>,
        Sum<<CS::KeGroup as KeGroup>::SkLen, NonceLen>: ArrayLength<u8>,
        // Ke1Message: Nonce + KePk
        NonceLen: Add<<CS::KeGroup as KeGroup>::PkLen>,
        Sum<NonceLen, <CS::KeGroup as KeGroup>::PkLen>: ArrayLength<u8>,
        // Ke2State: (Hash + Hash) + Hash
        OutputSize<OprfHash<CS>>: Add<OutputSize<OprfHash<CS>>>,
        Sum<OutputSize<OprfHash<CS>>, OutputSize<OprfHash<CS>>>:
            ArrayLength<u8> + Add<OutputSize<OprfHash<CS>>>,
        Sum<Sum<OutputSize<OprfHash<CS>>, OutputSize<OprfHash<CS>>>, OutputSize<OprfHash<CS>>>:
            ArrayLength<u8>,
        // Ke2Message: (Nonce + KePk) + Hash
        NonceLen: Add<<CS::KeGroup as KeGroup>::PkLen>,
        Sum<NonceLen, <CS::KeGroup as KeGroup>::PkLen>:
            ArrayLength<u8> + Add<OutputSize<OprfHash<CS>>>,
        Sum<Sum<NonceLen, <CS::KeGroup as KeGroup>::PkLen>, OutputSize<OprfHash<CS>>>:
            ArrayLength<u8>,
    {
        let mut client_rng = OsRng;
        let client_login_start_result =
            ClientLogin::<CS>::start(&mut client_rng, STR_PASSWORD.as_bytes())?;

        let mut state = client_login_start_result.state;
        util::drop_manually(&mut state);
        util::test_zeroized(&mut state.oprf_client);
        util::test_zeroized(&mut state.ke1_state);
        util::test_zeroized(&mut state.credential_request.ke1_message.client_nonce);

        Ok(())
    }

    #[cfg(feature = "ristretto255")]
    inner::<Ristretto255>()?;
    #[cfg(feature = "ristretto255")]
    inner::<Ristretto255P256>()?;
    #[cfg(feature = "ristretto255")]
    inner::<Ristretto255P384>()?;
    inner::<P256>()?;
    inner::<P256P384>()?;
    #[cfg(feature = "ristretto255")]
    inner::<P256Ristretto255>()?;
    inner::<P384>()?;
    inner::<P384P256>()?;
    #[cfg(feature = "ristretto255")]
    inner::<P384Ristretto255>()?;
    #[cfg(feature = "curve25519")]
    inner::<Curve25519P256>()?;
    #[cfg(feature = "curve25519")]
    inner::<Curve25519P384>()?;
    #[cfg(all(feature = "curve25519", feature = "ristretto255"))]
    inner::<Curve25519Ristretto255>()?;

    Ok(())
}

#[test]
fn test_zeroize_server_login_start() -> Result<(), ProtocolError> {
    fn inner<CS: CipherSuite>() -> Result<(), ProtocolError>
    where
        <OprfHash<CS> as OutputSizeUser>::OutputSize:
            IsLess<U256> + IsLessOrEqual<<OprfHash<CS> as BlockSizeUser>::BlockSize>,
        OprfHash<CS>: Hash,
        <OprfHash<CS> as CoreProxy>::Core: ProxyHash,
        <<OprfHash<CS> as CoreProxy>::Core as BlockSizeUser>::BlockSize: IsLess<U256>,
        Le<<<OprfHash<CS> as CoreProxy>::Core as BlockSizeUser>::BlockSize, U256>: NonZero,
        // MaskedResponse: (Nonce + Hash) + KePk
        NonceLen: Add<OutputSize<OprfHash<CS>>>,
        Sum<NonceLen, OutputSize<OprfHash<CS>>>:
            ArrayLength<u8> + Add<<CS::KeGroup as KeGroup>::PkLen>,
        MaskedResponseLen<CS>: ArrayLength<u8>,
    {
        let mut client_rng = OsRng;
        let mut server_rng = OsRng;
        let server_setup = ServerSetup::<CS>::new(&mut server_rng);
        let client_registration_start_result =
            ClientRegistration::<CS>::start(&mut client_rng, STR_PASSWORD.as_bytes())?;
        let server_registration_start_result = ServerRegistration::<CS>::start(
            &server_setup,
            client_registration_start_result.message,
            STR_CREDENTIAL_IDENTIFIER.as_bytes(),
        )?;
        let client_registration_finish_result = client_registration_start_result.state.finish(
            &mut client_rng,
            STR_PASSWORD.as_bytes(),
            server_registration_start_result.message,
            ClientRegistrationFinishParameters::default(),
        )?;
        let p_file = ServerRegistration::finish(client_registration_finish_result.message);
        let client_login_start_result =
            ClientLogin::<CS>::start(&mut client_rng, STR_PASSWORD.as_bytes())?;
        let server_login_start_result = ServerLogin::<CS>::start(
            &mut server_rng,
            &server_setup,
            Some(p_file),
            client_login_start_result.message,
            STR_CREDENTIAL_IDENTIFIER.as_bytes(),
            ServerLoginStartParameters::default(),
        )?;

        let mut state = server_login_start_result.state;
        unsafe { ptr::drop_in_place(&mut state) };
        for byte in state.serialize() {
            assert_eq!(byte, 0);
        }

        Ok(())
    }

    #[cfg(feature = "ristretto255")]
    inner::<Ristretto255>()?;
    #[cfg(feature = "ristretto255")]
    inner::<Ristretto255P256>()?;
    #[cfg(feature = "ristretto255")]
    inner::<Ristretto255P384>()?;
    inner::<P256>()?;
    inner::<P256P384>()?;
    #[cfg(feature = "ristretto255")]
    inner::<P256Ristretto255>()?;
    inner::<P384>()?;
    inner::<P384P256>()?;
    #[cfg(feature = "ristretto255")]
    inner::<P384Ristretto255>()?;
    #[cfg(feature = "curve25519")]
    inner::<Curve25519P256>()?;
    #[cfg(feature = "curve25519")]
    inner::<Curve25519P384>()?;
    #[cfg(all(feature = "curve25519", feature = "ristretto255"))]
    inner::<Curve25519Ristretto255>()?;

    Ok(())
}

#[test]
fn test_zeroize_client_login_finish() -> Result<(), ProtocolError> {
    fn inner<CS: CipherSuite<KeyExchange = TripleDh>>() -> Result<(), ProtocolError>
    where
        <OprfHash<CS> as OutputSizeUser>::OutputSize:
            IsLess<U256> + IsLessOrEqual<<OprfHash<CS> as BlockSizeUser>::BlockSize>,
        OprfHash<CS>: Hash,
        <OprfHash<CS> as CoreProxy>::Core: ProxyHash,
        <<OprfHash<CS> as CoreProxy>::Core as BlockSizeUser>::BlockSize: IsLess<U256>,
        Le<<<OprfHash<CS> as CoreProxy>::Core as BlockSizeUser>::BlockSize, U256>: NonZero,
        // MaskedResponse: (Nonce + Hash) + KePk
        NonceLen: Add<OutputSize<OprfHash<CS>>>,
        Sum<NonceLen, OutputSize<OprfHash<CS>>>:
            ArrayLength<u8> + Add<<CS::KeGroup as KeGroup>::PkLen>,
        MaskedResponseLen<CS>: ArrayLength<u8>,
        // CredentialRequest: KgPk + Ke1Message
        <OprfGroup<CS> as Group>::ElemLen: Add<Sum<NonceLen, <CS::KeGroup as KeGroup>::PkLen>>,
        CredentialRequestLen<CS>: ArrayLength<u8>,
        // Ke1State: KeSk + Nonce
        <CS::KeGroup as KeGroup>::SkLen: Add<NonceLen>,
        Sum<<CS::KeGroup as KeGroup>::SkLen, NonceLen>: ArrayLength<u8>,
        // Ke1Message: Nonce + KePk
        NonceLen: Add<<CS::KeGroup as KeGroup>::PkLen>,
        Sum<NonceLen, <CS::KeGroup as KeGroup>::PkLen>: ArrayLength<u8>,
        // Ke2State: (Hash + Hash) + Hash
        OutputSize<OprfHash<CS>>: Add<OutputSize<OprfHash<CS>>>,
        Sum<OutputSize<OprfHash<CS>>, OutputSize<OprfHash<CS>>>:
            ArrayLength<u8> + Add<OutputSize<OprfHash<CS>>>,
        Sum<Sum<OutputSize<OprfHash<CS>>, OutputSize<OprfHash<CS>>>, OutputSize<OprfHash<CS>>>:
            ArrayLength<u8>,
        // Ke2Message: (Nonce + KePk) + Hash
        NonceLen: Add<<CS::KeGroup as KeGroup>::PkLen>,
        Sum<NonceLen, <CS::KeGroup as KeGroup>::PkLen>:
            ArrayLength<u8> + Add<OutputSize<OprfHash<CS>>>,
        Sum<Sum<NonceLen, <CS::KeGroup as KeGroup>::PkLen>, OutputSize<OprfHash<CS>>>:
            ArrayLength<u8>,
    {
        let mut client_rng = OsRng;
        let mut server_rng = OsRng;
        let server_setup = ServerSetup::<CS>::new(&mut server_rng);
        let client_registration_start_result =
            ClientRegistration::<CS>::start(&mut client_rng, STR_PASSWORD.as_bytes())?;
        let server_registration_start_result = ServerRegistration::<CS>::start(
            &server_setup,
            client_registration_start_result.message,
            STR_CREDENTIAL_IDENTIFIER.as_bytes(),
        )?;
        let client_registration_finish_result = client_registration_start_result.state.finish(
            &mut client_rng,
            STR_PASSWORD.as_bytes(),
            server_registration_start_result.message,
            ClientRegistrationFinishParameters::default(),
        )?;
        let p_file = ServerRegistration::finish(client_registration_finish_result.message);
        let client_login_start_result =
            ClientLogin::<CS>::start(&mut client_rng, STR_PASSWORD.as_bytes())?;
        let server_login_start_result = ServerLogin::<CS>::start(
            &mut server_rng,
            &server_setup,
            Some(p_file),
            client_login_start_result.message,
            STR_CREDENTIAL_IDENTIFIER.as_bytes(),
            ServerLoginStartParameters::default(),
        )?;
        let client_login_finish_result = client_login_start_result.state.finish(
            STR_PASSWORD.as_bytes(),
            server_login_start_result.message,
            ClientLoginFinishParameters::default(),
        )?;

        let mut state = client_login_finish_result.state;
        util::drop_manually(&mut state);
        util::test_zeroized(&mut state.oprf_client);
        util::test_zeroized(&mut state.ke1_state);
        util::test_zeroized(&mut state.credential_request.ke1_message.client_nonce);

        Ok(())
    }

    #[cfg(feature = "ristretto255")]
    inner::<Ristretto255>()?;
    #[cfg(feature = "ristretto255")]
    inner::<Ristretto255P256>()?;
    #[cfg(feature = "ristretto255")]
    inner::<Ristretto255P384>()?;
    inner::<P256>()?;
    inner::<P256P384>()?;
    #[cfg(feature = "ristretto255")]
    inner::<P256Ristretto255>()?;
    inner::<P384>()?;
    inner::<P384P256>()?;
    #[cfg(feature = "ristretto255")]
    inner::<P384Ristretto255>()?;
    #[cfg(feature = "curve25519")]
    inner::<Curve25519P256>()?;
    #[cfg(feature = "curve25519")]
    inner::<Curve25519P384>()?;
    #[cfg(all(feature = "curve25519", feature = "ristretto255"))]
    inner::<Curve25519Ristretto255>()?;

    Ok(())
}

#[test]
fn test_zeroize_server_login_finish() -> Result<(), ProtocolError> {
    fn inner<CS: CipherSuite>() -> Result<(), ProtocolError>
    where
        <OprfHash<CS> as OutputSizeUser>::OutputSize:
            IsLess<U256> + IsLessOrEqual<<OprfHash<CS> as BlockSizeUser>::BlockSize>,
        OprfHash<CS>: Hash,
        <OprfHash<CS> as CoreProxy>::Core: ProxyHash,
        <<OprfHash<CS> as CoreProxy>::Core as BlockSizeUser>::BlockSize: IsLess<U256>,
        Le<<<OprfHash<CS> as CoreProxy>::Core as BlockSizeUser>::BlockSize, U256>: NonZero,
        // MaskedResponse: (Nonce + Hash) + KePk
        NonceLen: Add<OutputSize<OprfHash<CS>>>,
        Sum<NonceLen, OutputSize<OprfHash<CS>>>:
            ArrayLength<u8> + Add<<CS::KeGroup as KeGroup>::PkLen>,
        MaskedResponseLen<CS>: ArrayLength<u8>,
    {
        let mut client_rng = OsRng;
        let mut server_rng = OsRng;
        let server_setup = ServerSetup::<CS>::new(&mut server_rng);
        let client_registration_start_result =
            ClientRegistration::<CS>::start(&mut client_rng, STR_PASSWORD.as_bytes())?;
        let server_registration_start_result = ServerRegistration::<CS>::start(
            &server_setup,
            client_registration_start_result.message,
            STR_CREDENTIAL_IDENTIFIER.as_bytes(),
        )?;
        let client_registration_finish_result = client_registration_start_result.state.finish(
            &mut client_rng,
            STR_PASSWORD.as_bytes(),
            server_registration_start_result.message,
            ClientRegistrationFinishParameters::default(),
        )?;
        let p_file = ServerRegistration::finish(client_registration_finish_result.message);
        let client_login_start_result =
            ClientLogin::<CS>::start(&mut client_rng, STR_PASSWORD.as_bytes())?;
        let server_login_start_result = ServerLogin::<CS>::start(
            &mut server_rng,
            &server_setup,
            Some(p_file),
            client_login_start_result.message,
            STR_CREDENTIAL_IDENTIFIER.as_bytes(),
            ServerLoginStartParameters::default(),
        )?;
        let client_login_finish_result = client_login_start_result.state.finish(
            STR_PASSWORD.as_bytes(),
            server_login_start_result.message,
            ClientLoginFinishParameters::default(),
        )?;
        let server_login_finish_result = server_login_start_result
            .state
            .finish(client_login_finish_result.message)?;

        let mut state = server_login_finish_result.state;
        unsafe { ptr::drop_in_place(&mut state) };
        for byte in state.serialize() {
            assert_eq!(byte, 0);
        }

        Ok(())
    }

    #[cfg(feature = "ristretto255")]
    inner::<Ristretto255>()?;
    #[cfg(feature = "ristretto255")]
    inner::<Ristretto255P256>()?;
    #[cfg(feature = "ristretto255")]
    inner::<Ristretto255P384>()?;
    inner::<P256>()?;
    inner::<P256P384>()?;
    #[cfg(feature = "ristretto255")]
    inner::<P256Ristretto255>()?;
    inner::<P384>()?;
    inner::<P384P256>()?;
    #[cfg(feature = "ristretto255")]
    inner::<P384Ristretto255>()?;
    #[cfg(feature = "curve25519")]
    inner::<Curve25519P256>()?;
    #[cfg(feature = "curve25519")]
    inner::<Curve25519P384>()?;
    #[cfg(all(feature = "curve25519", feature = "ristretto255"))]
    inner::<Curve25519Ristretto255>()?;

    Ok(())
}

#[test]
fn test_scalar_always_nonzero() -> Result<(), ProtocolError> {
    fn inner<CS: CipherSuite>() -> Result<(), ProtocolError>
    where
        <OprfHash<CS> as OutputSizeUser>::OutputSize:
            IsLess<U256> + IsLessOrEqual<<OprfHash<CS> as BlockSizeUser>::BlockSize>,
        OprfHash<CS>: Hash,
        <OprfHash<CS> as CoreProxy>::Core: ProxyHash,
        <<OprfHash<CS> as CoreProxy>::Core as BlockSizeUser>::BlockSize: IsLess<U256>,
        Le<<<OprfHash<CS> as CoreProxy>::Core as BlockSizeUser>::BlockSize, U256>: NonZero,
    {
        // Start out with a bunch of zeros to force resampling of scalar
        let mut client_registration_rng = CycleRng::new([vec![0u8; 128], vec![1u8; 128]].concat());
        let client_registration_start_result =
            ClientRegistration::<CS>::start(&mut client_registration_rng, STR_PASSWORD.as_bytes())?;

        assert!(!bool::from(
            OprfGroup::<CS>::identity_elem().ct_eq(
                &client_registration_start_result
                    .message
                    .get_blinded_element_for_testing()
                    .value(),
            )
        ));

        // Start out with a bunch of zeros to force resampling of scalar
        let mut client_login_rng = CycleRng::new([vec![0u8; 128], vec![1u8; 128]].concat());
        let client_login_start_result =
            ClientLogin::<CS>::start(&mut client_login_rng, STR_PASSWORD.as_bytes())?;

        assert!(!bool::from(
            OprfGroup::<CS>::identity_elem().ct_eq(
                &client_login_start_result
                    .message
                    .get_blinded_element_for_testing()
                    .value(),
            )
        ));

        Ok(())
    }

    #[cfg(feature = "ristretto255")]
    inner::<Ristretto255>()?;
    #[cfg(feature = "ristretto255")]
    inner::<Ristretto255P256>()?;
    #[cfg(feature = "ristretto255")]
    inner::<Ristretto255P384>()?;
    inner::<P256>()?;
    inner::<P256P384>()?;
    #[cfg(feature = "ristretto255")]
    inner::<P256Ristretto255>()?;
    inner::<P384>()?;
    inner::<P384P256>()?;
    #[cfg(feature = "ristretto255")]
    inner::<P384Ristretto255>()?;
    #[cfg(feature = "curve25519")]
    inner::<Curve25519P256>()?;
    #[cfg(feature = "curve25519")]
    inner::<Curve25519P384>()?;
    #[cfg(all(feature = "curve25519", feature = "ristretto255"))]
    inner::<Curve25519Ristretto255>()?;

    Ok(())
}

#[test]
fn test_reflected_value_error_registration() -> Result<(), ProtocolError> {
    fn inner<CS: CipherSuite>() -> Result<(), ProtocolError>
    where
        <OprfHash<CS> as OutputSizeUser>::OutputSize:
            IsLess<U256> + IsLessOrEqual<<OprfHash<CS> as BlockSizeUser>::BlockSize>,
        OprfHash<CS>: Hash,
        <OprfHash<CS> as CoreProxy>::Core: ProxyHash,
        <<OprfHash<CS> as CoreProxy>::Core as BlockSizeUser>::BlockSize: IsLess<U256>,
        Le<<<OprfHash<CS> as CoreProxy>::Core as BlockSizeUser>::BlockSize, U256>: NonZero,
    {
        let credential_identifier = b"credentialIdentifier";
        let password = b"password";
        let mut client_rng = OsRng;
        let mut server_rng = OsRng;
        let server_setup = ServerSetup::<CS>::new(&mut server_rng);
        let client_registration_start_result =
            ClientRegistration::<CS>::start(&mut client_rng, password)?;
        let alpha = client_registration_start_result
            .message
            .get_blinded_element_for_testing()
            .value();
        let server_registration_start_result = ServerRegistration::<CS>::start(
            &server_setup,
            client_registration_start_result.message,
            credential_identifier,
        )?;

        let reflected_registration_response = server_registration_start_result
            .message
            .set_evaluation_element_for_testing(alpha);

        let client_registration_finish_result = client_registration_start_result.state.finish(
            &mut client_rng,
            password,
            reflected_registration_response,
            ClientRegistrationFinishParameters::default(),
        );

        assert!(matches!(
            client_registration_finish_result,
            Err(ProtocolError::ReflectedValueError)
        ));

        Ok(())
    }

    #[cfg(feature = "ristretto255")]
    inner::<Ristretto255>()?;
    #[cfg(feature = "ristretto255")]
    inner::<Ristretto255P256>()?;
    #[cfg(feature = "ristretto255")]
    inner::<Ristretto255P384>()?;
    inner::<P256>()?;
    inner::<P256P384>()?;
    #[cfg(feature = "ristretto255")]
    inner::<P256Ristretto255>()?;
    inner::<P384>()?;
    inner::<P384P256>()?;
    #[cfg(feature = "ristretto255")]
    inner::<P384Ristretto255>()?;
    #[cfg(feature = "curve25519")]
    inner::<Curve25519P256>()?;
    #[cfg(feature = "curve25519")]
    inner::<Curve25519P384>()?;
    #[cfg(all(feature = "curve25519", feature = "ristretto255"))]
    inner::<Curve25519Ristretto255>()?;

    Ok(())
}

#[test]
fn test_reflected_value_error_login() -> Result<(), ProtocolError> {
    fn inner<CS: CipherSuite>() -> Result<(), ProtocolError>
    where
        <OprfHash<CS> as OutputSizeUser>::OutputSize:
            IsLess<U256> + IsLessOrEqual<<OprfHash<CS> as BlockSizeUser>::BlockSize>,
        OprfHash<CS>: Hash,
        <OprfHash<CS> as CoreProxy>::Core: ProxyHash,
        <<OprfHash<CS> as CoreProxy>::Core as BlockSizeUser>::BlockSize: IsLess<U256>,
        Le<<<OprfHash<CS> as CoreProxy>::Core as BlockSizeUser>::BlockSize, U256>: NonZero,
        // MaskedResponse: (Nonce + Hash) + KePk
        NonceLen: Add<OutputSize<OprfHash<CS>>>,
        Sum<NonceLen, OutputSize<OprfHash<CS>>>:
            ArrayLength<u8> + Add<<CS::KeGroup as KeGroup>::PkLen>,
        MaskedResponseLen<CS>: ArrayLength<u8>,
    {
        let credential_identifier = b"credentialIdentifier";
        let password = b"password";
        let mut client_rng = OsRng;
        let mut server_rng = OsRng;
        let server_setup = ServerSetup::<CS>::new(&mut server_rng);
        let client_registration_start_result =
            ClientRegistration::<CS>::start(&mut client_rng, password)?;
        let server_registration_start_result = ServerRegistration::<CS>::start(
            &server_setup,
            client_registration_start_result.message,
            credential_identifier,
        )?;
        let client_registration_finish_result = client_registration_start_result.state.finish(
            &mut client_rng,
            password,
            server_registration_start_result.message,
            ClientRegistrationFinishParameters::default(),
        )?;
        let p_file = ServerRegistration::finish(client_registration_finish_result.message);
        let client_login_start_result = ClientLogin::<CS>::start(&mut client_rng, password)?;
        let alpha = client_login_start_result
            .message
            .get_blinded_element_for_testing()
            .value();
        let server_login_start_result = ServerLogin::<CS>::start(
            &mut server_rng,
            &server_setup,
            Some(p_file),
            client_login_start_result.message,
            credential_identifier,
            ServerLoginStartParameters::default(),
        )?;

        let reflected_credential_response = server_login_start_result
            .message
            .set_evaluation_element_for_testing(alpha);

        let client_login_result = client_login_start_result.state.finish(
            password,
            reflected_credential_response,
            ClientLoginFinishParameters::default(),
        );

        assert!(matches!(
            client_login_result,
            Err(ProtocolError::ReflectedValueError)
        ));
        Ok(())
    }

    #[cfg(feature = "ristretto255")]
    inner::<Ristretto255>()?;
    #[cfg(feature = "ristretto255")]
    inner::<Ristretto255P256>()?;
    #[cfg(feature = "ristretto255")]
    inner::<Ristretto255P384>()?;
    inner::<P256>()?;
    inner::<P256P384>()?;
    #[cfg(feature = "ristretto255")]
    inner::<P256Ristretto255>()?;
    inner::<P384>()?;
    inner::<P384P256>()?;
    #[cfg(feature = "ristretto255")]
    inner::<P384Ristretto255>()?;
    #[cfg(feature = "curve25519")]
    inner::<Curve25519P256>()?;
    #[cfg(feature = "curve25519")]
    inner::<Curve25519P384>()?;
    #[cfg(all(feature = "curve25519", feature = "ristretto255"))]
    inner::<Curve25519Ristretto255>()?;

    Ok(())
}