Add debugging checks to test if points are on the curve

src/curve.rs

@@ -271,6 +271,38 @@ impl Identity for PreComputedPoint {
     }
 }
 
+// ------------------------------------------------------------------------
+// Validity checks (for debugging, not CT)
+// ------------------------------------------------------------------------
+
+/// Trait for checking whether a point is on the curve
+pub trait ValidityCheck {
+    /// Checks whether the point is on the curve. Not CT.
+    fn is_valid(&self) -> bool;
+}
+
+impl ValidityCheck for ProjectivePoint {
+    fn is_valid(&self) -> bool {
+        // Curve equation is    -x^2 + y^2 = 1 + d*x^2*y^2,
+        // homogenized as (-X^2 + Y^2)*Z^2 = Z^4 + d*X^2*Y^2
+        let XX = self.X.square();
+        let YY = self.Y.square();
+        let ZZ = self.Z.square();
+        let ZZZZ = ZZ.square();
+        let lhs = &(&YY - &XX) * &ZZ;
+        let rhs = &ZZZZ + &(&constants::d * &(&XX * &YY));
+
+        lhs == rhs
+    }
+}
+
+impl ValidityCheck for ExtendedPoint {
+    // XXX this should also check that T is correct
+    fn is_valid(&self) -> bool {
+        self.to_projective().is_valid()
+    }
+}
+
 // ------------------------------------------------------------------------
 // Constant-time assignment
 // ------------------------------------------------------------------------
@@ -922,6 +954,8 @@ mod test {
         let base_X = FieldElement::from_bytes(&BASE_X_COORD_BYTES);
         let bp  =  BASE_CMPRSSD.decompress().unwrap();
         let bp2 = BASE2_CMPRSSD.decompress().unwrap();
+        assert!( bp.is_valid());
+        assert!(bp2.is_valid());
         let compressed  =  bp.compress();
         let compressed2 = bp2.compress();
         // Check that decompression actually gives the correct X coordinate