Merge pull request #7634 from hugpoint-tech/fix/p256r1-fe-sqrt

Fix P-256 `fe_sqrt` addition chain, unblocking compressed SEC1 point decoding

core/crypto/_fiat/field_p256r1/field.odin

@@ -235,7 +235,7 @@ fe_sqrt :: proc "contextless" (out1, arg1: ^Montgomery_Domain_Field_Element) ->
 	fe_mul(out1, &xx, out1)
 
 	// Step 4: t0 = x^0xc
-	fe_pow2k(&t0, &xx, 2)
+	fe_pow2k(&t0, out1, 2)
 
 	// Step 5: z = x^0xf
 	fe_mul(out1, out1, &t0)

tests/core/crypto/test_core_crypto_weierstrass.odin

@@ -919,6 +919,42 @@ test_p256_s11n_sec_generator :: proc(t: ^testing.T) {
 	testing.expect(t, ec.pt_equal(&g, &p) == 1)
 }
 
+@(test)
+test_p256_fe_sqrt_quadratic_residue :: proc(t: ^testing.T) {
+	for xv in u64(1) ..= u64(1024) {
+		xb: [32]byte
+		xb[30] = byte(xv >> 8)
+		xb[31] = byte(xv)
+
+		x, yy, root, check: ec.Field_Element_p256r1
+		ok := ec.fe_set_bytes(&x, xb[:])
+		testing.expect(t, ok)
+
+		ec.fe_square(&yy, &x)
+		root_ok := ec.fe_sqrt(&root, &yy)
+		testing.expectf(t, root_ok == 1, "fe_sqrt failed for x = %v", xv)
+
+		ec.fe_square(&check, &root)
+		testing.expectf(t, ec.fe_equal(&check, &yy) == 1, "root^2 != x^2 for x = %v", xv)
+	}
+}
+
+@(test)
+test_p256_s11n_sec_compressed_generator :: proc(t: ^testing.T) {
+	p, g: ec.Point_p256r1
+
+	ec.pt_generator(&g)
+
+	b: [33]byte
+	ok := ec.pt_sec_bytes(b[:], &g, true)
+	testing.expect(t, ok)
+	testing.expect(t, b[0] == 0x03)
+
+	ok = ec.pt_set_sec_bytes(&p, b[:])
+	testing.expect(t, ok)
+	testing.expect(t, ec.pt_equal(&g, &p) == 1)
+}
+
 @(test)
 test_p256_sc_inv :: proc(t: ^testing.T) {
 	if crypto.HAS_RAND_BYTES == false {