Elligator 2 test vectors

Test vector files look like the following:

bd568cb3a2d38a12:
176daa5925e7975e:
4e3ec9a72c828900:

8b5f64295c8ec02f:
aea6d1e57cacf85e:
4527a25db227f764:

...

Each line is either empty, or contain a number represented in hexadecimal (in Little Endian) followed by a colon (:).

The non-empty lines describe the input and outputs of test cases. The empty lines separate the different test cases.

We have 3 types of tests:

Direct map: Each test have 3 vectors:
1. (input) The representative r of the point.
2. (output) The u coordinate of the point.
3. (output) The v coordinate of the point.
Inverse map: Each test have 4 vectors:
1. (input) The u coordinate of the point.
2. (input) The sign of the v coordinate ("00:" if positive, "01:" if negative)
3. (output) Whether the map should succeed ("00:") or fail ("ff:")
4. (output) The representative of the point, or just ":" if the inverse map is supposed to fail.
Scalar multiplication: Each test have 2 vectors:
1. (input) The private key (the scalar s).
2. (output) The public key (s . K).

A couple caveats to keep in mind:

The representatives are not properly serialised. They are all positive, and all padding bits are set to zero. Real implementations should make sure that the inverse map makes all bits look random, and the direct map can correctly handle out of range inputs (ignore padding bits and/or correctly read negative representatives).
The scalar multiplications described by the test vectors here produce keys that are compatible with X25519 and X448 respectively, But they're certainly not identical. Do not use regular X25519 or X448 public key generations for keys you intend to hide with the inverse map. Use one of the special procedures we describe instead.

Here are the test vectors, for Curve25519 and Curve448 respectively:

They are generated with these scripts (also available in html).