Clean the Monero lib for auditing (#577)

* Remove unsafe creation of dalek_ff_group::EdwardsPoint in BP+

* Rename Bulletproofs to Bulletproof, since they are a single Bulletproof

Also bifurcates prove with prove_plus, and adds a few documentation items.

* Make CLSAG signing private

Also adds a bit more documentation and does a bit more tidying.

* Remove the distribution cache

It's a notable bandwidth/performance improvement, yet it's not ready. We need a
dedicated Distribution struct which is managed by the wallet and passed in.
While we can do that now, it's not currently worth the effort.

* Tidy Borromean/MLSAG a tad

* Remove experimental feature from monero-serai

* Move amount_decryption into EncryptedAmount::decrypt

* Various RingCT doc comments

* Begin crate smashing

* Further documentation, start shoring up API boundaries of existing crates

* Document and clean clsag

* Add a dedicated send/recv CLSAG mask struct

Abstracts the types used internally.

Also moves the tests from monero-serai to monero-clsag.

* Smash out monero-bulletproofs

Removes usage of dalek-ff-group/multiexp for curve25519-dalek.

Makes compiling in the generators an optional feature.

Adds a structured batch verifier which should be notably more performant.

Documentation and clean up still necessary.

* Correct no-std builds for monero-clsag and monero-bulletproofs

* Tidy and document monero-bulletproofs

I still don't like the impl of the original Bulletproofs...

* Error if missing documentation

* Smash out MLSAG

* Smash out Borromean

* Tidy up monero-serai as a meta crate

* Smash out RPC, wallet

* Document the RPC

* Improve docs a bit

* Move Protocol to monero-wallet

* Incomplete work on using Option to remove panic cases

* Finish documenting monero-serai

* Remove TODO on reading pseudo_outs for AggregateMlsagBorromean

* Only read transactions with one Input::Gen or all Input::ToKey

Also adds a helper to fetch a transaction's prefix.

* Smash out polyseed

* Smash out seed

* Get the repo to compile again

* Smash out Monero addresses

* Document cargo features

Credit to @hinto-janai for adding such sections to their work on documenting
monero-serai in #568.

* Fix deserializing v2 miner transactions

* Rewrite monero-wallet's send code

I have yet to redo the multisig code and the builder. This should be much
cleaner, albeit slower due to redoing work.

This compiles with clippy --all-features. I have to finish the multisig/builder
for --all-targets to work (and start updating the rest of Serai).

* Add SignableTransaction Read/Write

* Restore Monero multisig TX code

* Correct invalid RPC type def in monero-rpc

* Update monero-wallet tests to compile

Some are _consistently_ failing due to the inputs we attempt to spend being too
young. I'm unsure what's up with that. Most seem to pass _consistently_,
implying it's not a random issue yet some configuration/env aspect.

* Clean and document monero-address

* Sync rest of repo with monero-serai changes

* Represent height/block number as a u32

* Diversify ViewPair/Scanner into ViewPair/GuaranteedViewPair and Scanner/GuaranteedScanner

Also cleans the Scanner impl.

* Remove non-small-order view key bound

Guaranteed addresses are in fact guaranteed even with this due to prefixing key
images causing zeroing the ECDH to not zero the shared key.

* Finish documenting monero-serai

* Correct imports for no-std

* Remove possible panic in monero-serai on systems < 32 bits

This was done by requiring the system's usize can represent a certain number.

* Restore the reserialize chain binary

* fmt, machete, GH CI

* Correct misc TODOs in monero-serai

* Have Monero test runner evaluate an Eventuality for all signed TXs

* Fix a pair of bugs in the decoy tests

Unfortunately, this test is still failing.

* Fix remaining bugs in monero-wallet tests

* Reject torsioned spend keys to ensure we can spend the outputs we scan

* Tidy inlined epee code in the RPC

* Correct the accidental swap of stagenet/testnet address bytes

* Remove unused dep from processor

* Handle Monero fee logic properly in the processor

* Document v2 TX/RCT output relation assumed when scanning

* Adjust how we mine the initial blocks due to some CI test failures

* Fix weight estimation for RctType::ClsagBulletproof TXs

* Again increase the amount of blocks we mine prior to running tests

* Correct the if check about when to mine blocks on start

Finally fixes the lack of decoy candidates failures in CI.

* Run Monero on Debian, even for internal testnets

Change made due to a segfault incurred when locally testing.

https://github.com/monero-project/monero/issues/9141 for the upstream.

* Don't attempt running tests on the verify-chain binary

Adds a minimum XMR fee to the processor and runs fmt.

* Increase minimum Monero fee in processor

I'm truly unsure why this is required right now.

* Distinguish fee from necessary_fee in monero-wallet

If there's no change, the fee is difference of the inputs to the outputs. The
prior code wouldn't check that amount is greater than or equal to the necessary
fee, and returning the would-be change amount as the fee isn't necessarily
helpful.

Now the fee is validated in such cases and the necessary fee is returned,
enabling operating off of that.

* Restore minimum Monero fee from develop

coins/monero/wallet/seed/src/lib.rs

@@ -0,0 +1,357 @@
+#![cfg_attr(docsrs, feature(doc_auto_cfg))]
+#![doc = include_str!("../README.md")]
+#![deny(missing_docs)]
+#![cfg_attr(not(feature = "std"), no_std)]
+
+use core::{ops::Deref, fmt};
+use std_shims::{
+  sync::OnceLock,
+  vec,
+  vec::Vec,
+  string::{String, ToString},
+  collections::HashMap,
+};
+
+use zeroize::{Zeroize, Zeroizing};
+use rand_core::{RngCore, CryptoRng};
+
+use curve25519_dalek::scalar::Scalar;
+
+#[cfg(test)]
+mod tests;
+
+// The amount of words in a seed without a checksum.
+const SEED_LENGTH: usize = 24;
+// The amount of words in a seed with a checksum.
+const SEED_LENGTH_WITH_CHECKSUM: usize = 25;
+
+/// An error when working with a seed.
+#[derive(Clone, Copy, PartialEq, Eq, Debug)]
+#[cfg_attr(feature = "std", derive(thiserror::Error))]
+pub enum SeedError {
+  #[cfg_attr(feature = "std", error("invalid seed"))]
+  /// The seed was invalid.
+  InvalidSeed,
+  /// The checksum did not match the data.
+  #[cfg_attr(feature = "std", error("invalid checksum"))]
+  InvalidChecksum,
+  /// The deprecated English language option was used with a checksum.
+  ///
+  /// The deprecated English language option did not include a checksum.
+  #[cfg_attr(feature = "std", error("deprecated English language option included a checksum"))]
+  DeprecatedEnglishWithChecksum,
+}
+
+/// Language options.
+#[derive(Clone, Copy, PartialEq, Eq, Debug, Hash, Zeroize)]
+pub enum Language {
+  /// Chinese language option.
+  Chinese,
+  /// English language option.
+  English,
+  /// Dutch language option.
+  Dutch,
+  /// French language option.
+  French,
+  /// Spanish language option.
+  Spanish,
+  /// German language option.
+  German,
+  /// Italian language option.
+  Italian,
+  /// Portuguese language option.
+  Portuguese,
+  /// Japanese language option.
+  Japanese,
+  /// Russian language option.
+  Russian,
+  /// Esperanto language option.
+  Esperanto,
+  /// Lojban language option.
+  Lojban,
+  /// The original, and deprecated, English language.
+  DeprecatedEnglish,
+}
+
+fn trim(word: &str, len: usize) -> Zeroizing<String> {
+  Zeroizing::new(word.chars().take(len).collect())
+}
+
+struct WordList {
+  word_list: &'static [&'static str],
+  word_map: HashMap<&'static str, usize>,
+  trimmed_word_map: HashMap<String, usize>,
+  unique_prefix_length: usize,
+}
+
+impl WordList {
+  fn new(word_list: &'static [&'static str], prefix_length: usize) -> WordList {
+    let mut lang = WordList {
+      word_list,
+      word_map: HashMap::new(),
+      trimmed_word_map: HashMap::new(),
+      unique_prefix_length: prefix_length,
+    };
+
+    for (i, word) in lang.word_list.iter().enumerate() {
+      lang.word_map.insert(word, i);
+      lang.trimmed_word_map.insert(trim(word, lang.unique_prefix_length).deref().clone(), i);
+    }
+
+    lang
+  }
+}
+
+static LANGUAGES_CELL: OnceLock<HashMap<Language, WordList>> = OnceLock::new();
+#[allow(non_snake_case)]
+fn LANGUAGES() -> &'static HashMap<Language, WordList> {
+  LANGUAGES_CELL.get_or_init(|| {
+    HashMap::from([
+      (Language::Chinese, WordList::new(include!("./words/zh.rs"), 1)),
+      (Language::English, WordList::new(include!("./words/en.rs"), 3)),
+      (Language::Dutch, WordList::new(include!("./words/nl.rs"), 4)),
+      (Language::French, WordList::new(include!("./words/fr.rs"), 4)),
+      (Language::Spanish, WordList::new(include!("./words/es.rs"), 4)),
+      (Language::German, WordList::new(include!("./words/de.rs"), 4)),
+      (Language::Italian, WordList::new(include!("./words/it.rs"), 4)),
+      (Language::Portuguese, WordList::new(include!("./words/pt.rs"), 4)),
+      (Language::Japanese, WordList::new(include!("./words/ja.rs"), 3)),
+      (Language::Russian, WordList::new(include!("./words/ru.rs"), 4)),
+      (Language::Esperanto, WordList::new(include!("./words/eo.rs"), 4)),
+      (Language::Lojban, WordList::new(include!("./words/jbo.rs"), 4)),
+      (Language::DeprecatedEnglish, WordList::new(include!("./words/ang.rs"), 4)),
+    ])
+  })
+}
+
+fn checksum_index(words: &[Zeroizing<String>], lang: &WordList) -> usize {
+  let mut trimmed_words = Zeroizing::new(String::new());
+  for w in words {
+    *trimmed_words += &trim(w, lang.unique_prefix_length);
+  }
+
+  const fn crc32_table() -> [u32; 256] {
+    let poly = 0xedb88320u32;
+
+    let mut res = [0; 256];
+    let mut i = 0;
+    while i < 256 {
+      let mut entry = i;
+      let mut b = 0;
+      while b < 8 {
+        let trigger = entry & 1;
+        entry >>= 1;
+        if trigger == 1 {
+          entry ^= poly;
+        }
+        b += 1;
+      }
+      res[i as usize] = entry;
+      i += 1;
+    }
+
+    res
+  }
+  const CRC32_TABLE: [u32; 256] = crc32_table();
+
+  let trimmed_words = trimmed_words.as_bytes();
+  let mut checksum = u32::MAX;
+  for i in 0 .. trimmed_words.len() {
+    checksum = CRC32_TABLE[usize::from(u8::try_from(checksum % 256).unwrap() ^ trimmed_words[i])] ^
+      (checksum >> 8);
+  }
+
+  usize::try_from(!checksum).unwrap() % words.len()
+}
+
+// Convert a private key to a seed
+#[allow(clippy::needless_pass_by_value)]
+fn key_to_seed(lang: Language, key: Zeroizing<Scalar>) -> Seed {
+  let bytes = Zeroizing::new(key.to_bytes());
+
+  // get the language words
+  let words = &LANGUAGES()[&lang].word_list;
+  let list_len = u64::try_from(words.len()).unwrap();
+
+  // To store the found words & add the checksum word later.
+  let mut seed = Vec::with_capacity(25);
+
+  // convert to words
+  // 4 bytes -> 3 words. 8 digits base 16 -> 3 digits base 1626
+  let mut segment = [0; 4];
+  let mut indices = [0; 4];
+  for i in 0 .. 8 {
+    // convert first 4 byte to u32 & get the word indices
+    let start = i * 4;
+    // convert 4 byte to u32
+    segment.copy_from_slice(&bytes[start .. (start + 4)]);
+    // Actually convert to a u64 so we can add without overflowing
+    indices[0] = u64::from(u32::from_le_bytes(segment));
+    indices[1] = indices[0];
+    indices[0] /= list_len;
+    indices[2] = indices[0] + indices[1];
+    indices[0] /= list_len;
+    indices[3] = indices[0] + indices[2];
+
+    // append words to seed
+    for i in indices.iter().skip(1) {
+      let word = usize::try_from(i % list_len).unwrap();
+      seed.push(Zeroizing::new(words[word].to_string()));
+    }
+  }
+  segment.zeroize();
+  indices.zeroize();
+
+  // create a checksum word for all languages except old english
+  if lang != Language::DeprecatedEnglish {
+    let checksum = seed[checksum_index(&seed, &LANGUAGES()[&lang])].clone();
+    seed.push(checksum);
+  }
+
+  let mut res = Zeroizing::new(String::new());
+  for (i, word) in seed.iter().enumerate() {
+    if i != 0 {
+      *res += " ";
+    }
+    *res += word;
+  }
+  Seed(lang, res)
+}
+
+// Convert a seed to bytes
+fn seed_to_bytes(lang: Language, words: &str) -> Result<Zeroizing<[u8; 32]>, SeedError> {
+  // get seed words
+  let words = words.split_whitespace().map(|w| Zeroizing::new(w.to_string())).collect::<Vec<_>>();
+  if (words.len() != SEED_LENGTH) && (words.len() != SEED_LENGTH_WITH_CHECKSUM) {
+    panic!("invalid seed passed to seed_to_bytes");
+  }
+
+  let has_checksum = words.len() == SEED_LENGTH_WITH_CHECKSUM;
+  if has_checksum && lang == Language::DeprecatedEnglish {
+    Err(SeedError::DeprecatedEnglishWithChecksum)?;
+  }
+
+  // Validate words are in the language word list
+  let lang_word_list: &WordList = &LANGUAGES()[&lang];
+  let matched_indices = (|| {
+    let has_checksum = words.len() == SEED_LENGTH_WITH_CHECKSUM;
+    let mut matched_indices = Zeroizing::new(vec![]);
+
+    // Iterate through all the words and see if they're all present
+    for word in &words {
+      let trimmed = trim(word, lang_word_list.unique_prefix_length);
+      let word = if has_checksum { &trimmed } else { word };
+
+      if let Some(index) = if has_checksum {
+        lang_word_list.trimmed_word_map.get(word.deref())
+      } else {
+        lang_word_list.word_map.get(&word.as_str())
+      } {
+        matched_indices.push(*index);
+      } else {
+        Err(SeedError::InvalidSeed)?;
+      }
+    }
+
+    if has_checksum {
+      // exclude the last word when calculating a checksum.
+      let last_word = words.last().unwrap().clone();
+      let checksum = words[checksum_index(&words[.. words.len() - 1], lang_word_list)].clone();
+
+      // check the trimmed checksum and trimmed last word line up
+      if trim(&checksum, lang_word_list.unique_prefix_length) !=
+        trim(&last_word, lang_word_list.unique_prefix_length)
+      {
+        Err(SeedError::InvalidChecksum)?;
+      }
+    }
+
+    Ok(matched_indices)
+  })()?;
+
+  // convert to bytes
+  let mut res = Zeroizing::new([0; 32]);
+  let mut indices = Zeroizing::new([0; 4]);
+  for i in 0 .. 8 {
+    // read 3 indices at a time
+    let i3 = i * 3;
+    indices[1] = matched_indices[i3];
+    indices[2] = matched_indices[i3 + 1];
+    indices[3] = matched_indices[i3 + 2];
+
+    let inner = |i| {
+      let mut base = (lang_word_list.word_list.len() - indices[i] + indices[i + 1]) %
+        lang_word_list.word_list.len();
+      // Shift the index over
+      for _ in 0 .. i {
+        base *= lang_word_list.word_list.len();
+      }
+      base
+    };
+    // set the last index
+    indices[0] = indices[1] + inner(1) + inner(2);
+    if (indices[0] % lang_word_list.word_list.len()) != indices[1] {
+      Err(SeedError::InvalidSeed)?;
+    }
+
+    let pos = i * 4;
+    let mut bytes = u32::try_from(indices[0]).unwrap().to_le_bytes();
+    res[pos .. (pos + 4)].copy_from_slice(&bytes);
+    bytes.zeroize();
+  }
+
+  Ok(res)
+}
+
+/// A Monero seed.
+#[derive(Clone, PartialEq, Eq, Zeroize)]
+pub struct Seed(Language, Zeroizing<String>);
+
+impl fmt::Debug for Seed {
+  fn fmt(&self, f: &mut fmt::Formatter) -> fmt::Result {
+    f.debug_struct("Seed").finish_non_exhaustive()
+  }
+}
+
+impl Seed {
+  /// Create a new seed.
+  pub fn new<R: RngCore + CryptoRng>(rng: &mut R, lang: Language) -> Seed {
+    let mut scalar_bytes = Zeroizing::new([0; 64]);
+    rng.fill_bytes(scalar_bytes.as_mut());
+    key_to_seed(lang, Zeroizing::new(Scalar::from_bytes_mod_order_wide(scalar_bytes.deref())))
+  }
+
+  /// Parse a seed from a string.
+  #[allow(clippy::needless_pass_by_value)]
+  pub fn from_string(lang: Language, words: Zeroizing<String>) -> Result<Seed, SeedError> {
+    let entropy = seed_to_bytes(lang, &words)?;
+
+    // Make sure this is a valid scalar
+    let scalar = Scalar::from_canonical_bytes(*entropy);
+    if scalar.is_none().into() {
+      Err(SeedError::InvalidSeed)?;
+    }
+    let mut scalar = scalar.unwrap();
+    scalar.zeroize();
+
+    // Call from_entropy so a trimmed seed becomes a full seed
+    Ok(Self::from_entropy(lang, entropy).unwrap())
+  }
+
+  /// Create a seed from entropy.
+  #[allow(clippy::needless_pass_by_value)]
+  pub fn from_entropy(lang: Language, entropy: Zeroizing<[u8; 32]>) -> Option<Seed> {
+    Option::from(Scalar::from_canonical_bytes(*entropy))
+      .map(|scalar| key_to_seed(lang, Zeroizing::new(scalar)))
+  }
+
+  /// Convert a seed to a string.
+  pub fn to_string(&self) -> Zeroizing<String> {
+    self.1.clone()
+  }
+
+  /// Return the entropy underlying this seed.
+  pub fn entropy(&self) -> Zeroizing<[u8; 32]> {
+    seed_to_bytes(self.0, &self.1).unwrap()
+  }
+}

coins/monero/wallet/seed/src/tests.rs

@@ -0,0 +1,234 @@
+use zeroize::Zeroizing;
+use rand_core::OsRng;
+
+use curve25519_dalek::scalar::Scalar;
+
+use monero_primitives::keccak256;
+
+use crate::*;
+
+#[test]
+fn test_original_seed() {
+  struct Vector {
+    language: Language,
+    seed: String,
+    spend: String,
+    view: String,
+  }
+
+  let vectors = [
+    Vector {
+      language: Language::Chinese,
+      seed: "摇 曲 艺 武 滴 然 效 似 赏 式 祥 歌 买 疑 小 碧 堆 博 键 房 鲜 悲 付 喷 武".into(),
+      spend: "a5e4fff1706ef9212993a69f246f5c95ad6d84371692d63e9bb0ea112a58340d".into(),
+      view: "1176c43ce541477ea2f3ef0b49b25112b084e26b8a843e1304ac4677b74cdf02".into(),
+    },
+    Vector {
+      language: Language::English,
+      seed: "washing thirsty occur lectures tuesday fainted toxic adapt \
+               abnormal memoir nylon mostly building shrugged online ember northern \
+               ruby woes dauntless boil family illness inroads northern"
+        .into(),
+      spend: "c0af65c0dd837e666b9d0dfed62745f4df35aed7ea619b2798a709f0fe545403".into(),
+      view: "513ba91c538a5a9069e0094de90e927c0cd147fa10428ce3ac1afd49f63e3b01".into(),
+    },
+    Vector {
+      language: Language::Dutch,
+      seed: "setwinst riphagen vimmetje extase blief tuitelig fuiven meifeest \
+               ponywagen zesmaal ripdeal matverf codetaal leut ivoor rotten \
+               wisgerhof winzucht typograaf atrium rein zilt traktaat verzaagd setwinst"
+        .into(),
+      spend: "e2d2873085c447c2bc7664222ac8f7d240df3aeac137f5ff2022eaa629e5b10a".into(),
+      view: "eac30b69477e3f68093d131c7fd961564458401b07f8c87ff8f6030c1a0c7301".into(),
+    },
+    Vector {
+      language: Language::French,
+      seed: "poids vaseux tarte bazar poivre effet entier nuance \
+               sensuel ennui pacte osselet poudre battre alibi mouton \
+               stade paquet pliage gibier type question position projet pliage"
+        .into(),
+      spend: "2dd39ff1a4628a94b5c2ec3e42fb3dfe15c2b2f010154dc3b3de6791e805b904".into(),
+      view: "6725b32230400a1032f31d622b44c3a227f88258939b14a7c72e00939e7bdf0e".into(),
+    },
+    Vector {
+      language: Language::Spanish,
+      seed: "minero ocupar mirar evadir octubre cal logro miope \
+               opaco disco ancla litio clase cuello nasal clase \
+               fiar avance deseo mente grumo negro cordón croqueta clase"
+        .into(),
+      spend: "ae2c9bebdddac067d73ec0180147fc92bdf9ac7337f1bcafbbe57dd13558eb02".into(),
+      view: "18deafb34d55b7a43cae2c1c1c206a3c80c12cc9d1f84640b484b95b7fec3e05".into(),
+    },
+    Vector {
+      language: Language::German,
+      seed: "Kaliber Gabelung Tapir Liveband Favorit Specht Enklave Nabel \
+               Jupiter Foliant Chronik nisten löten Vase Aussage Rekord \
+               Yeti Gesetz Eleganz Alraune Künstler Almweide Jahr Kastanie Almweide"
+        .into(),
+      spend: "79801b7a1b9796856e2397d862a113862e1fdc289a205e79d8d70995b276db06".into(),
+      view: "99f0ec556643bd9c038a4ed86edcb9c6c16032c4622ed2e000299d527a792701".into(),
+    },
+    Vector {
+      language: Language::Italian,
+      seed: "cavo pancetta auto fulmine alleanza filmato diavolo prato \
+               forzare meritare litigare lezione segreto evasione votare buio \
+               licenza cliente dorso natale crescere vento tutelare vetta evasione"
+        .into(),
+      spend: "5e7fd774eb00fa5877e2a8b4dc9c7ffe111008a3891220b56a6e49ac816d650a".into(),
+      view: "698a1dce6018aef5516e82ca0cb3e3ec7778d17dfb41a137567bfa2e55e63a03".into(),
+    },
+    Vector {
+      language: Language::Portuguese,
+      seed: "agito eventualidade onus itrio holograma sodomizar objetos dobro \
+               iugoslavo bcrepuscular odalisca abjeto iuane darwinista eczema acetona \
+               cibernetico hoquei gleba driver buffer azoto megera nogueira agito"
+        .into(),
+      spend: "13b3115f37e35c6aa1db97428b897e584698670c1b27854568d678e729200c0f".into(),
+      view: "ad1b4fd35270f5f36c4da7166672b347e75c3f4d41346ec2a06d1d0193632801".into(),
+    },
+    Vector {
+      language: Language::Japanese,
+      seed: "ぜんぶ どうぐ おたがい せんきょ おうじ そんちょう じゅしん いろえんぴつ \
+               かほう つかれる えらぶ にちじょう くのう にちようび ぬまえび さんきゃく \
+               おおや ちぬき うすめる いがく せつでん さうな すいえい せつだん おおや"
+        .into(),
+      spend: "c56e895cdb13007eda8399222974cdbab493640663804b93cbef3d8c3df80b0b".into(),
+      view: "6c3634a313ec2ee979d565c33888fd7c3502d696ce0134a8bc1a2698c7f2c508".into(),
+    },
+    Vector {
+      language: Language::Russian,
+      seed: "шатер икра нация ехать получать инерция доза реальный \
+               рыжий таможня лопата душа веселый клетка атлас лекция \
+               обгонять паек наивный лыжный дурак стать ежик задача паек"
+        .into(),
+      spend: "7cb5492df5eb2db4c84af20766391cd3e3662ab1a241c70fc881f3d02c381f05".into(),
+      view: "fcd53e41ec0df995ab43927f7c44bc3359c93523d5009fb3f5ba87431d545a03".into(),
+    },
+    Vector {
+      language: Language::Esperanto,
+      seed: "ukazo klini peco etikedo fabriko imitado onklino urino \
+               pudro incidento kumuluso ikono smirgi hirundo uretro krii \
+               sparkado super speciala pupo alpinisto cvana vokegi zombio fabriko"
+        .into(),
+      spend: "82ebf0336d3b152701964ed41df6b6e9a035e57fc98b84039ed0bd4611c58904".into(),
+      view: "cd4d120e1ea34360af528f6a3e6156063312d9cefc9aa6b5218d366c0ed6a201".into(),
+    },
+    Vector {
+      language: Language::Lojban,
+      seed: "jetnu vensa julne xrotu xamsi julne cutci dakli \
+               mlatu xedja muvgau palpi xindo sfubu ciste cinri \
+               blabi darno dembi janli blabi fenki bukpu burcu blabi"
+        .into(),
+      spend: "e4f8c6819ab6cf792cebb858caabac9307fd646901d72123e0367ebc0a79c200".into(),
+      view: "c806ce62bafaa7b2d597f1a1e2dbe4a2f96bfd804bf6f8420fc7f4a6bd700c00".into(),
+    },
+    Vector {
+      language: Language::DeprecatedEnglish,
+      seed: "glorious especially puff son moment add youth nowhere \
+               throw glide grip wrong rhythm consume very swear \
+               bitter heavy eventually begin reason flirt type unable"
+        .into(),
+      spend: "647f4765b66b636ff07170ab6280a9a6804dfbaf19db2ad37d23be024a18730b".into(),
+      view: "045da65316a906a8c30046053119c18020b07a7a3a6ef5c01ab2a8755416bd02".into(),
+    },
+    // The following seeds require the language specification in order to calculate
+    // a single valid checksum
+    Vector {
+      language: Language::Spanish,
+      seed: "pluma laico atraer pintor peor cerca balde buscar \
+               lancha batir nulo reloj resto gemelo nevera poder columna gol \
+               oveja latir amplio bolero feliz fuerza nevera"
+        .into(),
+      spend: "30303983fc8d215dd020cc6b8223793318d55c466a86e4390954f373fdc7200a".into(),
+      view: "97c649143f3c147ba59aa5506cc09c7992c5c219bb26964442142bf97980800e".into(),
+    },
+    Vector {
+      language: Language::Spanish,
+      seed: "pluma pluma pluma pluma pluma pluma pluma pluma \
+               pluma pluma pluma pluma pluma pluma pluma pluma \
+               pluma pluma pluma pluma pluma pluma pluma pluma pluma"
+        .into(),
+      spend: "b4050000b4050000b4050000b4050000b4050000b4050000b4050000b4050000".into(),
+      view: "d73534f7912b395eb70ef911791a2814eb6df7ce56528eaaa83ff2b72d9f5e0f".into(),
+    },
+    Vector {
+      language: Language::English,
+      seed: "plus plus plus plus plus plus plus plus \
+               plus plus plus plus plus plus plus plus \
+               plus plus plus plus plus plus plus plus plus"
+        .into(),
+      spend: "3b0400003b0400003b0400003b0400003b0400003b0400003b0400003b040000".into(),
+      view: "43a8a7715eed11eff145a2024ddcc39740255156da7bbd736ee66a0838053a02".into(),
+    },
+    Vector {
+      language: Language::Spanish,
+      seed: "audio audio audio audio audio audio audio audio \
+               audio audio audio audio audio audio audio audio \
+               audio audio audio audio audio audio audio audio audio"
+        .into(),
+      spend: "ba000000ba000000ba000000ba000000ba000000ba000000ba000000ba000000".into(),
+      view: "1437256da2c85d029b293d8c6b1d625d9374969301869b12f37186e3f906c708".into(),
+    },
+    Vector {
+      language: Language::English,
+      seed: "audio audio audio audio audio audio audio audio \
+               audio audio audio audio audio audio audio audio \
+               audio audio audio audio audio audio audio audio audio"
+        .into(),
+      spend: "7900000079000000790000007900000079000000790000007900000079000000".into(),
+      view: "20bec797ab96780ae6a045dd816676ca7ed1d7c6773f7022d03ad234b581d600".into(),
+    },
+  ];
+
+  for vector in vectors {
+    fn trim_by_lang(word: &str, lang: Language) -> String {
+      if lang != Language::DeprecatedEnglish {
+        word.chars().take(LANGUAGES()[&lang].unique_prefix_length).collect()
+      } else {
+        word.to_string()
+      }
+    }
+
+    let trim_seed = |seed: &str| {
+      seed
+        .split_whitespace()
+        .map(|word| trim_by_lang(word, vector.language))
+        .collect::<Vec<_>>()
+        .join(" ")
+    };
+
+    // Test against Monero
+    {
+      println!("{}. language: {:?}, seed: {}", line!(), vector.language, vector.seed.clone());
+      let seed = Seed::from_string(vector.language, Zeroizing::new(vector.seed.clone())).unwrap();
+      let trim = trim_seed(&vector.seed);
+      assert_eq!(seed, Seed::from_string(vector.language, Zeroizing::new(trim)).unwrap());
+
+      let spend: [u8; 32] = hex::decode(vector.spend).unwrap().try_into().unwrap();
+      // For originalal seeds, Monero directly uses the entropy as a spend key
+      assert_eq!(
+        Option::<Scalar>::from(Scalar::from_canonical_bytes(*seed.entropy())),
+        Option::<Scalar>::from(Scalar::from_canonical_bytes(spend)),
+      );
+
+      let view: [u8; 32] = hex::decode(vector.view).unwrap().try_into().unwrap();
+      // Monero then derives the view key as H(spend)
+      assert_eq!(
+        Scalar::from_bytes_mod_order(keccak256(spend)),
+        Scalar::from_canonical_bytes(view).unwrap()
+      );
+
+      assert_eq!(Seed::from_entropy(vector.language, Zeroizing::new(spend)).unwrap(), seed);
+    }
+
+    // Test against ourselves
+    {
+      let seed = Seed::new(&mut OsRng, vector.language);
+      println!("{}. seed: {}", line!(), *seed.to_string());
+      let trim = trim_seed(&seed.to_string());
+      assert_eq!(seed, Seed::from_string(vector.language, Zeroizing::new(trim)).unwrap());
+      assert_eq!(seed, Seed::from_entropy(vector.language, seed.entropy()).unwrap());
+      assert_eq!(seed, Seed::from_string(vector.language, seed.to_string()).unwrap());
+    }
+  }
+}