feat(tests): add test case with invalid P256 with x1 above N (#2217)

Add new test case with invalid P256 signature with `x1 >= N`.
These input values are hard to find because requires very small `r`.
Produce the test case by modifying an existing valid signature
with `x1 >= N`.

Author: chfast

tests/osaka/eip7951_p256verify_precompiles/spec.py

@@ -115,6 +115,15 @@ class Spec:
     X0 = X(0x2927B10512BAE3EDDCFE467828128BAD2903269919F7086069C8C4DF6C732838)
     Y0 = Y(0xC7787964EAAC00E5921FB1498A60F4606766B3D9685001558D1A974E7341513E)
 
+    # Test constants from:
+    # https://github.com/C2SP/wycheproof/blob/4a6c2bf5dc4c0b67c770233ad33961ee653996a0/testvectors/ecdsa_webcrypto_test.json#L1064
+    # k*G has a large x-coordinate which also gives very small r.
+    H1 = H(0x532EAABD9574880DBF76B9B8CC00832C20A6EC113D682299550D7A6E0F345E25)
+    R1 = R(0x000000000000000000000000000000004319055358E8617B0C46353D039CDAAB)
+    S1 = S(0xFFFFFFFF00000000FFFFFFFFFFFFFFFFBCE6FAADA7179E84F3B9CAC2FC63254E)
+    X1 = X(0xD705D16F80987E2D9B1A6957D29CE22FEBF7D10FA515153182415C8361BAACA4)
+    Y1 = Y(0xB1FC105EE5CE80D514EC1238BEAE2037A6F83625593620D460819E8682160926)
+
     @staticmethod
     def delegation_designation(address: Address) -> Bytes:
         """Return delegation designation for the given address."""

tests/osaka/eip7951_p256verify_precompiles/test_p256verify.py

@@ -715,7 +715,25 @@ def test_precompile_will_return_success_with_tx_value(
             + X(0x0AD99500288D466940031D72A9F5445A4D43784640855BF0A69874D2DE5FE103)
             + Y(0xC5011E6EF2C42DCD50D5D3D29F99AE6EBA2C80C9244F4C5422F0979FF0C3BA5E),
             Spec.SUCCESS_RETURN_VALUE,
-            id="modular_comparison_x_coordinate_exceeds_n",
+            id="x_coordinate_exceeds_n",
+        ),
+        pytest.param(
+            Spec.H1 + Spec.R1 + Spec.S1 + Spec.X1 + Spec.Y1,
+            Spec.SUCCESS_RETURN_VALUE,
+            id="x_coordinate_exceeds_n_v2",
+        ),
+        # Test cases where compute x-coordinate exceeds curve order N,
+        # but the signature is invalid.
+        # This is a modification of the above test by taking -h, -r, -s
+        # what gives the same u1 and u2 and in the result the same point R.
+        pytest.param(
+            H(Spec.N - Spec.H1.value)
+            + R(Spec.N - Spec.R1.value)
+            + S(Spec.N - Spec.S1.value)
+            + Spec.X1
+            + Spec.Y1,
+            Spec.INVALID_RETURN_VALUE,
+            id="invalid_x_coordinate_exceeds_n",
         ),
         pytest.param(
             Spec.H0