#
# Empty messages (inspired from RFC 8439)
#
0000000000000000000000000000000000000000000000000000000000000000:
:
00000000000000000000000000000000:

36e5f6b5c5e06070f0efca96227a863e00000000000000000000000000000000:
:
00000000000000000000000000000000:

0000000000000000000000000000000036e5f6b5c5e06070f0efca96227a863e:
:
36e5f6b5c5e06070f0efca96227a863e:

79207375626d697373696f6e20746f2036e5f6b5c5e06070f0efca96227a863e:
:
36e5f6b5c5e06070f0efca96227a863e:

#
# No idea where I got this one from.
# The key looks random, and the message reads
# "Cryptographic Forum Research Group"
#
85d6be7857556d337f4452fe42d506a80103808afb0db2fd4abff6af4149f51b:
43727970746f6772617068696320466f72756d2052657365617263682047726f7570:
a8061dc1305136c6c22b8baf0c0127a9:


##################################
### Test vectors from RFC 8439 ###
##################################

# Notice how, in test vector #2, r is equal to zero.  The part of the
# Poly1305 algorithm where the accumulator is multiplied by r means
# that with r equal zero, the tag will be equal to s regardless of the
# content of the text.  Fortunately, all the proposed methods of
# generating r are such that getting this particular weak key is very
# unlikely.

# Test Vector #1:
# ==============
0000000000000000000000000000000000000000000000000000000000000000:
00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000:
00000000000000000000000000000000:

# Test Vector #2:
# ==============
0000000000000000000000000000000036e5f6b5c5e06070f0efca96227a863e:
416e79207375626d697373696f6e20746f20746865204945544620696e74656e6465642062792074686520436f6e7472696275746f7220666f72207075626c69636174696f6e20617320616c6c206f722070617274206f6620616e204945544620496e7465726e65742d4472616674206f722052464320616e6420616e792073746174656d656e74206d6164652077697468696e2074686520636f6e74657874206f6620616e204945544620616374697669747920697320636f6e7369646572656420616e20224945544620436f6e747269627574696f6e222e20537563682073746174656d656e747320696e636c756465206f72616c2073746174656d656e747320696e20494554462073657373696f6e732c2061732077656c6c206173207772697474656e20616e6420656c656374726f6e696320636f6d6d756e69636174696f6e73206d61646520617420616e792074696d65206f7220706c6163652c207768696368206172652061646472657373656420746f:
36e5f6b5c5e06070f0efca96227a863e:

# Test Vector #3:
# ==============
36e5f6b5c5e06070f0efca96227a863e00000000000000000000000000000000:
416e79207375626d697373696f6e20746f20746865204945544620696e74656e6465642062792074686520436f6e7472696275746f7220666f72207075626c69636174696f6e20617320616c6c206f722070617274206f6620616e204945544620496e7465726e65742d4472616674206f722052464320616e6420616e792073746174656d656e74206d6164652077697468696e2074686520636f6e74657874206f6620616e204945544620616374697669747920697320636f6e7369646572656420616e20224945544620436f6e747269627574696f6e222e20537563682073746174656d656e747320696e636c756465206f72616c2073746174656d656e747320696e20494554462073657373696f6e732c2061732077656c6c206173207772697474656e20616e6420656c656374726f6e696320636f6d6d756e69636174696f6e73206d61646520617420616e792074696d65206f7220706c6163652c207768696368206172652061646472657373656420746f:
f3477e7cd95417af89a6b8794c310cf0:

# Test Vector #4:
# ==============
1c9240a5eb55d38af333888604f6b5f0473917c1402b80099dca5cbc207075c0:
2754776173206272696c6c69672c20616e642074686520736c6974687920746f7665730a446964206779726520616e642067696d626c6520696e2074686520776162653a0a416c6c206d696d737920776572652074686520626f726f676f7665732c0a416e6420746865206d6f6d65207261746873206f757467726162652e:
4541669a7eaaee61e708dc7cbcc5eb62:

# Test Vector #5: If one uses 130-bit partial reduction, does the code
# handle the case where partially reduced final result is not fully
# reduced?
0200000000000000000000000000000000000000000000000000000000000000:
FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF:
03000000000000000000000000000000:

# Test Vector #6: What happens if addition of s overflows modulo 2^128?
02000000000000000000000000000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF:
02000000000000000000000000000000:
03000000000000000000000000000000:

# Test Vector #7: What happens if data limb is all ones and there is
# carry from lower limb?
0100000000000000000000000000000000000000000000000000000000000000:
FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF0FFFFFFFFFFFFFFFFFFFFFFFFFFFFFF11000000000000000000000000000000:
05000000000000000000000000000000:

# Test Vector #8: What happens if final result from polynomial part is
# exactly 2^130-5?
0100000000000000000000000000000000000000000000000000000000000000:
FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFBFEFEFEFEFEFEFEFEFEFEFEFEFEFEFE01010101010101010101010101010101:
00000000000000000000000000000000:

# Test Vector #9: What happens if final result from polynomial part is
# exactly 2^130-6?
0200000000000000000000000000000000000000000000000000000000000000:
FDFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF:
FAFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF:

# Test Vector #10: What happens if 5*H+L-type reduction produces
# 131-bit intermediate result?
0100000000000000040000000000000000000000000000000000000000000000:
E33594D7505E43B900000000000000003394D7505E4379CD01000000000000000000000000000000000000000000000001000000000000000000000000000000:
14000000000000005500000000000000:

# Test Vector #11: What happens if 5*H+L-type reduction produces
# 131-bit final result?
0100000000000000040000000000000000000000000000000000000000000000:
E33594D7505E43B900000000000000003394D7505E4379CD010000000000000000000000000000000000000000000000:
13000000000000000000000000000000: