simple bug fixes, and public api argument validation tests

3 files changed, 264 insertions, 111 deletions

diff --git a/src/noscrypt.c b/src/noscrypt.c
index 15d8da8..fb6dd4f 100644
--- a/src/noscrypt.c
+++ b/src/noscrypt.c
@@ -30,6 +30,16 @@
 #include <mbedtls/chacha20.h>
 #include <mbedtls/sha256.h>
 
+/* Non win platforms may need an inline override */
+#if !defined(_NC_IS_WINDOWS) && !defined(inline)
+	#define inline __inline__
+#endif // !IS_WINDOWS
+
+//NULL
+#ifndef NULL
+	#define NULL ((void*)0)
+#endif // !NULL
+
 #define CHACHA_NONCE_SIZE 12	//Size of 12 is set by the cipher spec
 #define CHACHA_KEY_SIZE 32		
 #define HMAC_KEY_SIZE 32		
@@ -47,14 +57,12 @@
 * Validation macros
 */
 
-#ifdef NC_INPUT_VALIDATION_OFF
-	#define CHECK_NULL_PTR(ptr) if(ptr == NULL) return E_NULL_PTR;
-	#define CHECK_INVALID_ARG(x) if(x == NULL) return E_INVALID_ARG;
+#ifndef NC_INPUT_VALIDATION_OFF
+	#define CHECK_INVALID_ARG(x, argPos) if(x == NULL) return NCResultWithArgPosition(E_INVALID_ARG, argPos);
 	#define CHECK_NULL_ARG(x, argPos) if(x == NULL) return NCResultWithArgPosition(E_NULL_PTR, argPos);
 	#define CHECK_ARG_RANGE(x, min, max, argPos) if(x < min || x > max) return NCResultWithArgPosition(E_ARGUMENT_OUT_OF_RANGE, argPos);
 #else
 	//empty macros 
-	#define CHECK_NULL_PTR(ptr)
 	#define CHECK_INVALID_ARG(x)
 	#define CHECK_NULL_ARG(x, argPos) 
 	#define CHECK_ARG_RANGE(x, min, max, argPos) 
@@ -461,8 +469,8 @@ NC_EXPORT NCResult NC_CC NCInitContext(
 	const uint8_t entropy[32]
 )
 {
-	CHECK_NULL_PTR(ctx)
-	CHECK_NULL_PTR(entropy)
+	CHECK_NULL_ARG(ctx, 0)
+	CHECK_NULL_ARG(entropy, 1)
 
 	ctx->secpCtx = secp256k1_context_create(SECP256K1_CONTEXT_NONE);
 
@@ -475,9 +483,9 @@ NC_EXPORT NCResult NC_CC NCReInitContext(
 	const uint8_t entropy[32]
 )
 {
-	CHECK_NULL_PTR(ctx)
-	CHECK_INVALID_ARG(ctx->secpCtx)
-	CHECK_INVALID_ARG(entropy)
+	CHECK_NULL_ARG(ctx, 0)
+	CHECK_INVALID_ARG(ctx->secpCtx, 0)
+	CHECK_NULL_ARG(entropy, 1)
 
 	//Only randomize again
 	return secp256k1_context_randomize(ctx->secpCtx, entropy) ? NC_SUCCESS : E_INVALID_ARG;
@@ -486,7 +494,7 @@ NC_EXPORT NCResult NC_CC NCReInitContext(
 NC_EXPORT NCResult NC_CC NCDestroyContext(NCContext* ctx)
 {
 	CHECK_NULL_ARG(ctx, 0);
-	CHECK_INVALID_ARG(ctx->secpCtx);
+	CHECK_INVALID_ARG(ctx->secpCtx, 0);
 
 	//Destroy secp256k1 context
 	secp256k1_context_destroy(ctx->secpCtx);
@@ -509,9 +517,9 @@ NC_EXPORT NCResult NC_CC NCGetPublicKey(
 	secp256k1_xonly_pubkey xonly;	
 
 	CHECK_NULL_ARG(ctx, 0)
+	CHECK_INVALID_ARG(ctx->secpCtx, 0)
 	CHECK_NULL_ARG(sk, 1)
 	CHECK_NULL_ARG(pk, 2)
-	CHECK_INVALID_ARG(ctx->secpCtx)
 
 	if (secp256k1_keypair_create(ctx->secpCtx, &keyPair, sk->key) != 1)
 	{
@@ -538,9 +546,9 @@ NC_EXPORT NCResult NC_CC NCValidateSecretKey(
 	const NCSecretKey* sk
 )
 {
-	CHECK_NULL_PTR(ctx)
-	CHECK_NULL_PTR(sk)
-	CHECK_INVALID_ARG(ctx->secpCtx)
+	CHECK_NULL_ARG(ctx, 0)
+	CHECK_NULL_ARG(sk, 1)
+	CHECK_INVALID_ARG(ctx->secpCtx, 0)
 
 	//Validate the secret key
 	return secp256k1_ec_seckey_verify(ctx->secpCtx, sk->key);
@@ -562,11 +570,11 @@ NC_EXPORT NCResult NC_CC NCSignDigest(
 
 	//Validate arguments
 	CHECK_NULL_ARG(ctx, 0)
+	CHECK_INVALID_ARG(ctx->secpCtx, 0)
 	CHECK_NULL_ARG(sk, 1)
 	CHECK_NULL_ARG(random32, 2)
 	CHECK_NULL_ARG(digest32, 3)
 	CHECK_NULL_ARG(sig64, 4)
-	CHECK_INVALID_ARG(ctx->secpCtx)
 
 	//Generate the keypair
 	if (secp256k1_keypair_create(ctx->secpCtx, &keyPair, sk->key) != 1)
@@ -603,8 +611,13 @@ NC_EXPORT NCResult NC_CC NCSignData(
 {
 	uint8_t digest[32];
 
-	CHECK_NULL_ARG(data, 2)
-	CHECK_ARG_RANGE(dataSize, 1, UINT32_MAX, 3)
+	//Double check is required because arg position differs
+	CHECK_NULL_ARG(ctx, 0)
+	CHECK_NULL_ARG(sk, 1)
+	CHECK_NULL_ARG(random32, 2)
+	CHECK_NULL_ARG(data, 3)
+	CHECK_ARG_RANGE(dataSize, 1, UINT32_MAX, 4)
+	CHECK_NULL_ARG(sig64, 5)
 
 	//Compute sha256 of the data before signing
 	if(_computeSha256Digest(data, dataSize, digest) != 0)
@@ -624,15 +637,13 @@ NC_EXPORT NCResult NC_CC NCVerifyDigest(
 )
 {
 	int result;
-	secp256k1_xonly_pubkey xonly;	
-
-	DEBUG_ASSERT(&xonly != NULL)
+	secp256k1_xonly_pubkey xonly;
 
 	CHECK_NULL_ARG(ctx, 0)
-	CHECK_NULL_ARG(sig64, 1)
+	CHECK_INVALID_ARG(ctx->secpCtx, 0)
+	CHECK_NULL_ARG(pk, 1)
 	CHECK_NULL_ARG(digest32, 2)
-	CHECK_NULL_ARG(pk, 3)
-	CHECK_INVALID_ARG(ctx->secpCtx)
+	CHECK_NULL_ARG(sig64, 3)	
 
 	//recover the x-only key from a compressed public key
 	if(_convertToXonly(ctx, pk, &xonly) != 1)
@@ -654,13 +665,16 @@ NC_EXPORT NCResult NC_CC NCVerifyData(
 	const NCPublicKey* pk,
 	const uint8_t* data,
 	const size_t dataSize,
-	uint8_t sig64[64]
+	const uint8_t sig64[64]
 )
 {
 	uint8_t digest[32];
 
+	CHECK_NULL_ARG(ctx, 0)
+	CHECK_NULL_ARG(pk, 1)
 	CHECK_NULL_ARG(data, 2)
 	CHECK_ARG_RANGE(dataSize, 1, UINT32_MAX, 3)
+	CHECK_NULL_ARG(sig64, 4)
 
 	//Compute sha256 of the data before verifying
 	if (_computeSha256Digest(data, dataSize, digest) != 0)
@@ -681,10 +695,10 @@ NC_EXPORT NCResult NC_CC NCGetSharedSecret(
 )
 {
 	CHECK_NULL_ARG(ctx, 0)
+	CHECK_INVALID_ARG(ctx->secpCtx, 0)
 	CHECK_NULL_ARG(sk, 1)
 	CHECK_NULL_ARG(otherPk, 2)
-	CHECK_NULL_ARG(sharedPoint, 3)
-	CHECK_INVALID_ARG(ctx->secpCtx)
+	CHECK_NULL_ARG(sharedPoint, 3)	
 
 	return _computeSharedSecret(
 		ctx, 
@@ -701,9 +715,9 @@ NC_EXPORT NCResult NC_CC NCGetConversationKeyEx(
 )
 {
 	CHECK_NULL_ARG(ctx, 0)
+	CHECK_INVALID_ARG(ctx->secpCtx, 0)
 	CHECK_NULL_ARG(sharedPoint, 1)
-	CHECK_NULL_ARG(conversationKey, 2)
-	CHECK_INVALID_ARG(ctx->secpCtx)
+	CHECK_NULL_ARG(conversationKey, 2)	
 
 	//Cast the shared point to the shared secret type
 	return _computeConversationKey(
@@ -726,10 +740,10 @@ NC_EXPORT NCResult NC_CC NCGetConversationKey(
 	const mbedtls_md_info_t* mdInfo;
 
 	CHECK_NULL_ARG(ctx, 0)
+	CHECK_INVALID_ARG(ctx->secpCtx, 0)
 	CHECK_NULL_ARG(sk, 1)
 	CHECK_NULL_ARG(pk, 2)
-	CHECK_NULL_ARG(conversationKey, 3)
-	CHECK_INVALID_ARG(ctx->secpCtx)	
+	CHECK_NULL_ARG(conversationKey, 3)	
 	
 	mdInfo = _getSha256MdInfo();
 
@@ -760,16 +774,14 @@ NC_EXPORT NCResult NC_CC NCEncryptEx(
 )
 {
 	CHECK_NULL_ARG(ctx, 0)
+	CHECK_INVALID_ARG(ctx->secpCtx, 0)
 	CHECK_NULL_ARG(conversationKey, 1)
 	CHECK_NULL_ARG(args, 2)
 
-	//Validate the context
-	CHECK_INVALID_ARG(ctx->secpCtx)
-
 	//Validte ciphertext/plaintext
-	CHECK_INVALID_ARG(args->inputData)
-	CHECK_INVALID_ARG(args->outputData)
-	CHECK_ARG_RANGE(args->dataSize, NIP44_MIN_ENC_MESSAGE_SIZE, NIP44_MAX_ENC_MESSAGE_SIZE, 3)	
+	CHECK_INVALID_ARG(args->inputData, 2)
+	CHECK_INVALID_ARG(args->outputData, 2)
+	CHECK_ARG_RANGE(args->dataSize, NIP44_MIN_ENC_MESSAGE_SIZE, NIP44_MAX_ENC_MESSAGE_SIZE, 2)	
 
 	return _encryptEx(
 		ctx, 
@@ -789,19 +801,17 @@ NC_EXPORT NCResult NC_CC NCEncrypt(
 	NCResult result;
 	const mbedtls_md_info_t* mdInfo;
 	struct shared_secret sharedSecret;
-	struct conversation_key ck;	
+	struct conversation_key conversationKey;	
 
 	CHECK_NULL_ARG(ctx, 0)
+	CHECK_INVALID_ARG(ctx->secpCtx, 0)
 	CHECK_NULL_ARG(sk, 1)
 	CHECK_NULL_ARG(pk, 2)
 	CHECK_NULL_ARG(args, 3)
 
-	//Validate the context
-	CHECK_INVALID_ARG(ctx->secpCtx)
-
 	//Validate input/output data
-	CHECK_INVALID_ARG(args->inputData)
-	CHECK_INVALID_ARG(args->outputData)
+	CHECK_INVALID_ARG(args->inputData, 3)
+	CHECK_INVALID_ARG(args->outputData, 3)
 	CHECK_ARG_RANGE(args->dataSize, NIP44_MIN_ENC_MESSAGE_SIZE, NIP44_MAX_ENC_MESSAGE_SIZE, 3)
 
 	mdInfo = _getSha256MdInfo();
@@ -813,17 +823,17 @@ NC_EXPORT NCResult NC_CC NCEncrypt(
 	}
 	
 	//Compute the conversation key from secret and pubkic keys
-	if ((result = _computeConversationKey(ctx, mdInfo, &sharedSecret, &ck)) != NC_SUCCESS)
+	if ((result = _computeConversationKey(ctx, mdInfo, &sharedSecret, &conversationKey)) != NC_SUCCESS)
 	{
 		goto Cleanup;
 	}
 
-	result = _encryptEx(ctx, mdInfo, &ck, args);
+	result = _encryptEx(ctx, mdInfo, &conversationKey, args);
 
 Cleanup:
 	//Clean up sensitive data
 	ZERO_FILL(&sharedSecret, sizeof(sharedSecret));
-	ZERO_FILL(&ck, sizeof(ck));
+	ZERO_FILL(&conversationKey, sizeof(conversationKey));
 
 	return result;
 }
@@ -836,15 +846,13 @@ NC_EXPORT NCResult NC_CC NCDecryptEx(
 )
 {
 	CHECK_NULL_ARG(ctx, 0)
+	CHECK_INVALID_ARG(ctx->secpCtx, 0)
 	CHECK_NULL_ARG(conversationKey, 1)
 	CHECK_NULL_ARG(args, 2)
 
-	//Validate the context
-	CHECK_INVALID_ARG(ctx->secpCtx)
-
 	//Validte ciphertext/plaintext
-	CHECK_INVALID_ARG(args->inputData)
-	CHECK_INVALID_ARG(args->outputData)
+	CHECK_INVALID_ARG(args->inputData, 2)
+	CHECK_INVALID_ARG(args->outputData, 2)
 	CHECK_ARG_RANGE(args->dataSize, NIP44_MIN_DEC_MESSAGE_SIZE, NIP44_MAX_DEC_MESSAGE_SIZE, 3)
 
 	return _decryptEx(
@@ -869,16 +877,14 @@ NC_EXPORT NCResult NC_CC NCDecrypt(
 	const mbedtls_md_info_t* mdInfo;
 
 	CHECK_NULL_ARG(ctx, 0)
+	CHECK_INVALID_ARG(ctx->secpCtx, 0)
 	CHECK_NULL_ARG(sk, 1)
 	CHECK_NULL_ARG(pk, 2)
 	CHECK_NULL_ARG(args, 3)
 
-	//Validate the context
-	CHECK_INVALID_ARG(ctx->secpCtx)
-
 	//Validte ciphertext/plaintext
-	CHECK_INVALID_ARG(args->inputData)
-	CHECK_INVALID_ARG(args->outputData)
+	CHECK_INVALID_ARG(args->inputData, 3)
+	CHECK_INVALID_ARG(args->outputData, 3)
 	CHECK_ARG_RANGE(args->dataSize, NIP44_MIN_DEC_MESSAGE_SIZE, NIP44_MAX_DEC_MESSAGE_SIZE, 3)
 
 	mdInfo = _getSha256MdInfo();
diff --git a/src/noscrypt.h b/src/noscrypt.h
index 34e119d..f6bfe76 100644
--- a/src/noscrypt.h
+++ b/src/noscrypt.h
@@ -33,12 +33,12 @@
 #include <stddef.h>
 
 #if defined(_MSC_VER) || defined(WIN32) || defined(_WIN32)
-	#define IS_WINDOWS
+	#define _NC_IS_WINDOWS
 #endif
 
 //Set api export calling convention (allow used to override)
 #ifndef NC_CC
-	#ifdef IS_WINDOWS
+	#ifdef _NC_IS_WINDOWS
 		//STD for importing to other languages such as .NET
 		#define NC_CC __stdcall
 	#else
@@ -48,32 +48,20 @@
 
 #ifndef NC_EXPORT	//Allow users to disable the export/impoty macro if using source code directly
 	#ifdef NOSCRYPT_EXPORTING
-		#ifdef IS_WINDOWS
+		#ifdef _NC_IS_WINDOWS
 			#define NC_EXPORT __declspec(dllexport)
 		#else
 			#define NC_EXPORT __attribute__((visibility("default")))
-		#endif // IS_WINDOWS
+		#endif // _NC_IS_WINDOWS
 	#else
-		#ifdef IS_WINDOWS
+		#ifdef _NC_IS_WINDOWS
 			#define NC_EXPORT __declspec(dllimport)
 		#else
 			#define NC_EXPORT
-		#endif // IS_WINDOWS
+		#endif // _NC_IS_WINDOWS
 	#endif // !NOSCRYPT_EXPORTING
 #endif // !NC_EXPORT
 
-
-#ifndef IS_WINDOWS
-	#ifndef inline
-		#define inline __inline__
-	#endif // !inline
-#endif // !IS_WINDOWS
-
-//NULL
-#ifndef NULL
-	#define NULL ((void*)0)
-#endif // !NULL
-
 /*
 * CONSTANTS
 */
@@ -112,7 +100,7 @@ static const uint8_t Nip44ConstantSalt[8] = { 0x6e, 0x69, 0x70, 0x34, 0x34, 0x2d
 * operations that return a value count.
 */
 
-#define ARG_POSITION_OFFSET 8
+#define NC_ARG_POSITION_OFFSET 8
 #define NC_ERROR_CODE_MASK 0xFF
 
 #define NC_SUCCESS 0
@@ -196,8 +184,7 @@ static inline NCPublicKey* NCToPubKey(uint8_t key[NC_PUBKEY_SIZE])
 
 static inline NCResult NCResultWithArgPosition(NCResult err, uint8_t argPosition) 
 {
-	//Store the error code in the lower 8 bits and the argument position in the upper 24 bits
-	return (err & NC_ERROR_CODE_MASK) | (((uint32_t)argPosition) << ARG_POSITION_OFFSET);
+	return -(((NCResult)argPosition << NC_ARG_POSITION_OFFSET) | -err);
 }
 
 /*
@@ -207,11 +194,14 @@ that caused the error.
 * @param code A pointer to the error code to write to
 * @param argPosition A pointer to the argument position to write to
 */
-NC_EXPORT void NC_CC NCParseErrorCode(NCResult result, int* code, int* argPosition)
+NC_EXPORT void NC_CC NCParseErrorCode(NCResult result, int* code, uint8_t* argPosition)
 {
+	//convert result to a positive value
+	NCResult asPositive = -result;
+
 	//Get the error code from the lower 8 bits and the argument position from the upper 8 bits
-	*code = result & NC_ERROR_CODE_MASK;
-	*argPosition = (result >> ARG_POSITION_OFFSET) & 0xFF;
+	*code = -(asPositive & NC_ERROR_CODE_MASK);
+	*argPosition = (asPositive >> NC_ARG_POSITION_OFFSET) & 0xFF;
 }
 
 /*--------------------------------------
@@ -317,7 +307,7 @@ NC_EXPORT NCResult NC_CC NCVerifyData(
 	const NCPublicKey* pk,
 	const uint8_t* data,
 	const size_t dataSize,
-	uint8_t sig64[64]
+	const uint8_t sig64[64]
 );
 
 /*--------------------------------------
diff --git a/tests/test.c b/tests/test.c
index a210212..d8fa89c 100644
--- a/tests/test.c
+++ b/tests/test.c
@@ -38,31 +38,61 @@
 #endif
 
 #ifdef IS_WINDOWS
-
-    //Prints a string literal to the console
-	#define PRINTL(x) printf(x); printf("\r\n");
-    #define TEST(x) printf("\tTesting %s\n", #x); if(!(x)) { printf("TEST FAILED!\n"); return 1; } else { printf("\tTest passed\n\n"); }
+    /*Asserts that an internal test condition is true, otherwise aborts the test process*/
     #define TASSERT(x) if(!(x)) { printf("ERROR! Internal test assumption failed: %s.\n Aborting tests...\n", #x); ExitProcess(1); }
-    #define ENSURE(x) if(!(x)) { printf("Assumption failed! %s\n", #x); return 1; } 
 #else
-
-    //Prints a string literal to the console
-	#define PRINTL(x) printf(x); printf("\n");
-	#define TEST(x) printf("\tTesting %s\n", #x); if(!(x)) { printf("TEST FAILED!\n"); return 1; } else { printf("\tTest passed\n\n"); }
+    /*Asserts that an internal test condition is true, otherwise aborts the test process*/
 	#define TASSERT(x) if(!(x)) { printf("Internal assumption failed: %s\n", #x); exit(1); }
-    #define ENSURE(x) if(!(x)) { printf("Assumption failed!\n"); return 1; } 
 #endif
 
+/*Prints a string literal to the console*/
+#define PRINTL(x) printf(x); printf("\n");
+#define ENSURE(x) if(!(x)) { printf("Assumption failed!\n"); return 1; } 
+#define TEST(x, expected) printf("\tTesting %s\n", #x); if(((long)x) != ((long)expected)) \
+{ printf("FAILED: Expected %ld but got %ld @ callsite %s. Line: %d \n", ((long)expected), ((long)x), #x, __LINE__); return 1; }
+
+
 #ifdef IS_WINDOWS
     #define ZERO_FILL(x, size) SecureZeroMemory(x, size)
 #else
 	#define ZERO_FILL(x, size) memset(x, 0, size)
 #endif
 
+//Pre-computed constants for argument errors
+#define ARG_ERROR_POS_0 E_NULL_PTR
+#define ARG_ERROR_POS_1 NCResultWithArgPosition(E_NULL_PTR, 0x01)
+#define ARG_ERROR_POS_2 NCResultWithArgPosition(E_NULL_PTR, 0x02)
+#define ARG_ERROR_POS_3 NCResultWithArgPosition(E_NULL_PTR, 0x03)
+#define ARG_ERROR_POS_4 NCResultWithArgPosition(E_NULL_PTR, 0x04)
+#define ARG_ERROR_POS_5 NCResultWithArgPosition(E_NULL_PTR, 0x05)
+#define ARG_ERROR_POS_6 NCResultWithArgPosition(E_NULL_PTR, 0x06)
+
+#define ARG_RAMGE_ERROR_POS_0 E_ARGUMENT_OUT_OF_RANGE
+#define ARG_RAMGE_ERROR_POS_1 NCResultWithArgPosition(E_ARGUMENT_OUT_OF_RANGE, 0x01)
+#define ARG_RAMGE_ERROR_POS_2 NCResultWithArgPosition(E_ARGUMENT_OUT_OF_RANGE, 0x02)
+#define ARG_RAMGE_ERROR_POS_3 NCResultWithArgPosition(E_ARGUMENT_OUT_OF_RANGE, 0x03)
+#define ARG_RAMGE_ERROR_POS_4 NCResultWithArgPosition(E_ARGUMENT_OUT_OF_RANGE, 0x04)
+#define ARG_RAMGE_ERROR_POS_5 NCResultWithArgPosition(E_ARGUMENT_OUT_OF_RANGE, 0x05)
+#define ARG_RAMGE_ERROR_POS_6 NCResultWithArgPosition(E_ARGUMENT_OUT_OF_RANGE, 0x06)
+
+#define ARG_INVALID_ERROR_POS_0 E_INVALID_ARG
+#define ARG_INVALID_ERROR_POS_1 NCResultWithArgPosition(E_INVALID_ARG, 0x01)
+#define ARG_INVALID_ERROR_POS_2 NCResultWithArgPosition(E_INVALID_ARG, 0x02)
+#define ARG_INVALID_ERROR_POS_3 NCResultWithArgPosition(E_INVALID_ARG, 0x03)
+#define ARG_INVALID_ERROR_POS_4 NCResultWithArgPosition(E_INVALID_ARG, 0x04)
+#define ARG_INVALID_ERROR_POS_5 NCResultWithArgPosition(E_INVALID_ARG, 0x05)
+#define ARG_INVALID_ERROR_POS_6 NCResultWithArgPosition(E_INVALID_ARG, 0x06)
+
+
+
 static void FillRandomData(void* pbBuffer, size_t length);
 static int TestEcdsa(NCContext* context, NCSecretKey* secKey, NCPublicKey* pubKey);
 static int InitKepair(NCContext* context, NCSecretKey* secKey, NCPublicKey* pubKey);
 
+#ifndef NC_INPUT_VALIDATION_OFF
+static int TestPublicApiArgumentValidation(void);
+#endif
+
 static const uint8_t zero32[32] = { 0 };
 static const uint8_t zero64[64] = { 0 };
 
@@ -78,9 +108,8 @@ int main(void)
     FillRandomData(ctxRandom, 32);
 
     //Context struct size should aways match the size of the struct returned by NCGetContextStructSize
-    TEST(NCGetContextStructSize() == sizeof(NCContext))  
-
-    TEST(NCInitContext(&ctx, ctxRandom) == NC_SUCCESS)
+    TEST(NCGetContextStructSize(), sizeof(NCContext))
+    TEST(NCInitContext(&ctx, ctxRandom), NC_SUCCESS)
 
     if (InitKepair(&ctx, &secKey, &pubKey) != 0)
 	{
@@ -92,9 +121,16 @@ int main(void)
         return 1;
     }
 
+#ifndef NC_INPUT_VALIDATION_OFF
+    if(TestPublicApiArgumentValidation() != 0)
+	{
+		return 1;
+	}
+#endif
+
     PRINTL("ECDSA tests passed\n")
 
-    TEST(NCDestroyContext(&ctx) == NC_SUCCESS)
+    TEST(NCDestroyContext(&ctx), NC_SUCCESS)
 
 	return 0;
 }
@@ -113,7 +149,7 @@ static const char* message = "Test message to sign";
 
 static int InitKepair(NCContext* context, NCSecretKey* secKey, NCPublicKey* pubKey)
 {
-    PRINTL("TEST: Keypair")
+    PRINTL("TEST: Keypair\n")
 
     //Get random private key
     FillRandomData(secKey, sizeof(NCSecretKey));
@@ -121,11 +157,13 @@ static int InitKepair(NCContext* context, NCSecretKey* secKey, NCPublicKey* pubK
     //Ensure not empty
     ENSURE(memcmp(zero32, secKey, 32) != 0);
 
-    //Ensure the key is valid
-    TEST(NCValidateSecretKey(context, secKey) == NC_SUCCESS);
+    //Ensure the key is valid, result should be 1 on success
+    TEST(NCValidateSecretKey(context, secKey), 1);
 
     //Generate a public key from the secret key
-    TEST(NCGetPublicKey(context, secKey, pubKey) == NC_SUCCESS);
+    TEST(NCGetPublicKey(context, secKey, pubKey), NC_SUCCESS);
+
+    PRINTL("\nPASSED: Keypair tests completed\n")
 
     return 0;
 }
@@ -136,7 +174,7 @@ static int TestEcdsa(NCContext* context, NCSecretKey* secKey, NCPublicKey* pubKe
     uint8_t sigEntropy[32];
     uint8_t invalidSig[64];
 
-    PRINTL("TEST: Ecdsa")
+    PRINTL("TEST: Ecdsa\n")
 
     //Init a new secret key with random data
     FillRandomData(invalidSig, sizeof(invalidSig));
@@ -145,21 +183,21 @@ static int TestEcdsa(NCContext* context, NCSecretKey* secKey, NCPublicKey* pubKe
     //compute sha256 of the test string
     _sha256((uint8_t*)message, strlen(message), digestToSign);
 
-    //Sign and verify digest
+    //Sign and verify sig64
     {
 		uint8_t sig[64];
-        TEST(NCSignDigest(context, secKey, sigEntropy, digestToSign, sig) == NC_SUCCESS);
-		TEST(NCVerifyDigest(context, pubKey, digestToSign, sig) == NC_SUCCESS);
+        TEST(NCSignDigest(context, secKey, sigEntropy, digestToSign, sig), NC_SUCCESS);
+        TEST(NCVerifyDigest(context, pubKey, digestToSign, sig), NC_SUCCESS);
     }
     
     //Sign and verify raw data
     {
         uint8_t sig[64];
-		TEST(NCSignData(context, secKey, sigEntropy, (uint8_t*)message, strlen(message), sig) == NC_SUCCESS);
-        TEST(NCVerifyData(context, pubKey, (uint8_t*)message, strlen(message), sig) == NC_SUCCESS);
+        TEST(NCSignData(context, secKey, sigEntropy, (uint8_t*)message, strlen(message), sig), NC_SUCCESS);
+        TEST(NCVerifyData(context, pubKey, (uint8_t*)message, strlen(message), sig), NC_SUCCESS);
     }
 
-    //ensure the signature is the same for signing data and digest
+    //ensure the signature is the same for signing data and sig64
 	{
 		uint8_t sig1[64];
 		uint8_t sig2[64];
@@ -169,32 +207,151 @@ static int TestEcdsa(NCContext* context, NCSecretKey* secKey, NCPublicKey* pubKe
         ENSURE(NCSignDigest(context, secKey, sigEntropy, digestToSign, sig2) == NC_SUCCESS);
 		
         //Perform test
-        TEST(memcmp(sig1, sig2, 64) == 0);
+        TEST(memcmp(sig1, sig2, 64), 0);
 	}
 
-    //Try signing data then veriyfing the digest
+    //Try signing data then veriyfing the sig64
     {
         uint8_t sig[64];
 		
         ENSURE(NCSignData(context, secKey, sigEntropy, (uint8_t*)message, strlen(message), sig) == NC_SUCCESS);
-        TEST(NCVerifyDigest(context, pubKey, digestToSign, sig) == NC_SUCCESS);
+        TEST(NCVerifyDigest(context, pubKey, digestToSign, sig), NC_SUCCESS);
 
         //Now invert test, zero signature to ensure its overwritten
         ZERO_FILL(sig, sizeof(sig));
 
         ENSURE(NCSignDigest(context, secKey, sigEntropy, digestToSign, sig) == NC_SUCCESS);
-        TEST(NCVerifyData(context, pubKey, (uint8_t*)message, strlen(message), sig) == NC_SUCCESS);
+        TEST(NCVerifyData(context, pubKey, (uint8_t*)message, strlen(message), sig), NC_SUCCESS);
 	}
 
     //test verification of invalid signature
     {
-
-        TEST(NCVerifyDigest(context, pubKey, digestToSign, invalidSig) == E_INVALID_ARG);
+        TEST(NCVerifyDigest(context, pubKey, digestToSign, invalidSig), E_INVALID_ARG);
     }
 
+    PRINTL("\nPASSED: Ecdsa tests completed\n")
 	return 0;
 }
 
+#ifndef NC_INPUT_VALIDATION_OFF
+
+static int TestPublicApiArgumentValidation(void)
+{
+    NCContext ctx;
+    uint8_t ctxRandom[32];
+    uint8_t sig64[64];
+    NCSecretKey secKey;
+    NCPublicKey pubKey;
+    NCCryptoData cryptoData;
+
+    PRINTL("TEST: Public API argument validation tests\n")
+
+    FillRandomData(ctxRandom, 32);
+
+    //Test null context
+    TEST(NCInitContext(NULL, ctxRandom), ARG_ERROR_POS_0)
+    TEST(NCInitContext(&ctx, NULL), ARG_ERROR_POS_1)
+
+    //Test null context
+    TEST(NCDestroyContext(NULL), ARG_ERROR_POS_0)
+
+    //reinit
+    TEST(NCReInitContext(NULL, ctxRandom), ARG_ERROR_POS_0)
+    TEST(NCReInitContext(&ctx, NULL), ARG_ERROR_POS_1)
+
+    //Test null secret key
+    TEST(NCGetPublicKey(&ctx, NULL, &pubKey), ARG_ERROR_POS_1)
+    TEST(NCGetPublicKey(&ctx, &secKey, NULL), ARG_ERROR_POS_2)
+
+    //Test null secret key
+    TEST(NCValidateSecretKey(NULL, &secKey), ARG_ERROR_POS_0)
+    TEST(NCValidateSecretKey(&ctx, NULL), ARG_ERROR_POS_1)
+
+    //Verify sig64 args test
+    TEST(NCVerifyDigest(NULL, &pubKey, zero32, sig64), ARG_ERROR_POS_0)
+    TEST(NCVerifyDigest(&ctx, NULL, zero32, sig64), ARG_ERROR_POS_1)
+    TEST(NCVerifyDigest(&ctx, &pubKey, NULL, sig64), ARG_ERROR_POS_2)
+    TEST(NCVerifyDigest(&ctx, &pubKey, zero32, NULL), ARG_ERROR_POS_3)
+
+    //Test verify data args
+    TEST(NCVerifyData(NULL, &pubKey, zero32, 32, sig64), ARG_ERROR_POS_0)
+    TEST(NCVerifyData(&ctx, NULL, zero32, 32, sig64), ARG_ERROR_POS_1)
+    TEST(NCVerifyData(&ctx, &pubKey, NULL, 32, sig64), ARG_ERROR_POS_2)
+    TEST(NCVerifyData(&ctx, &pubKey, zero32, 0, sig64), ARG_RAMGE_ERROR_POS_3)
+    TEST(NCVerifyData(&ctx, &pubKey, zero32, 32, NULL), ARG_ERROR_POS_4)
+
+    //Test null sign data args
+    TEST(NCSignData(NULL, &secKey, zero32, zero32, 32, sig64), ARG_ERROR_POS_0)
+    TEST(NCSignData(&ctx, NULL, zero32, zero32, 32, sig64), ARG_ERROR_POS_1)
+    TEST(NCSignData(&ctx, &secKey, NULL, zero32, 32, sig64), ARG_ERROR_POS_2)
+    TEST(NCSignData(&ctx, &secKey, zero32, NULL, 32, sig64), ARG_ERROR_POS_3)
+    TEST(NCSignData(&ctx, &secKey, zero32, zero32, 0, sig64), ARG_RAMGE_ERROR_POS_4)
+    TEST(NCSignData(&ctx, &secKey, zero32, zero32, 32, NULL), ARG_ERROR_POS_5)
+   
+    //Test null sign digest args
+    TEST(NCSignDigest(NULL, &secKey, zero32, zero32, sig64), ARG_ERROR_POS_0)
+    TEST(NCSignDigest(&ctx, NULL, zero32, zero32, sig64), ARG_ERROR_POS_1)
+    TEST(NCSignDigest(&ctx, &secKey, NULL, zero32, sig64), ARG_ERROR_POS_2)
+	TEST(NCSignDigest(&ctx, &secKey, zero32, NULL, sig64), ARG_ERROR_POS_3)
+    TEST(NCSignDigest(&ctx, &secKey, zero32, zero32, NULL), ARG_ERROR_POS_4)
+
+
+    //Encrypt
+    cryptoData.dataSize = 32;
+    cryptoData.inputData = zero32;
+    cryptoData.outputData = sig64;
+    FillRandomData(&cryptoData.nonce, 32);
+
+    TEST(NCEncrypt(NULL, &secKey, &pubKey, &cryptoData), ARG_ERROR_POS_0)
+    TEST(NCEncrypt(&ctx, NULL, &pubKey, &cryptoData), ARG_ERROR_POS_1)
+	TEST(NCEncrypt(&ctx, &secKey, NULL, &cryptoData), ARG_ERROR_POS_2)
+    TEST(NCEncrypt(&ctx, &secKey, &pubKey, NULL), ARG_ERROR_POS_3)
+
+    //Test invalid data size
+    cryptoData.dataSize = 0;
+    TEST(NCEncrypt(&ctx, &secKey, &pubKey, &cryptoData), ARG_RAMGE_ERROR_POS_3)
+    
+    //Test null input data
+    cryptoData.dataSize = 32;
+    cryptoData.inputData = NULL;
+	TEST(NCEncrypt(&ctx, &secKey, &pubKey, &cryptoData), ARG_INVALID_ERROR_POS_3)
+
+    //Test null output data
+	cryptoData.inputData = zero32;
+    cryptoData.outputData = NULL;
+	TEST(NCEncrypt(&ctx, &secKey, &pubKey, &cryptoData), ARG_INVALID_ERROR_POS_3)
+
+    //Decrypt
+    cryptoData.dataSize = 32;
+    cryptoData.inputData = zero32;
+    cryptoData.outputData = sig64;
+
+    TEST(NCDecrypt(NULL, &secKey, &pubKey, &cryptoData), ARG_ERROR_POS_0)
+    TEST(NCDecrypt(&ctx, NULL, &pubKey, &cryptoData), ARG_ERROR_POS_1)
+	TEST(NCDecrypt(&ctx, &secKey, NULL, &cryptoData), ARG_ERROR_POS_2)
+    TEST(NCDecrypt(&ctx, &secKey, &pubKey, NULL), ARG_ERROR_POS_3)
+
+    //Test invalid data size
+	cryptoData.dataSize = 0;
+    TEST(NCDecrypt(&ctx, &secKey, &pubKey, &cryptoData), ARG_RAMGE_ERROR_POS_3)
+
+    //Test null input data
+	cryptoData.dataSize = 32;
+    cryptoData.inputData = NULL;
+	TEST(NCDecrypt(&ctx, &secKey, &pubKey, &cryptoData), ARG_INVALID_ERROR_POS_3)
+
+    //Test null output data
+    cryptoData.inputData = zero32;
+    cryptoData.outputData = NULL;
+	TEST(NCDecrypt(&ctx, &secKey, &pubKey, &cryptoData), ARG_INVALID_ERROR_POS_3)
+
+    PRINTL("\nPASSED: Public API argument validation tests completed\n")
+
+    return 0;
+}
+
+#endif
+
 static void FillRandomData(void* pbBuffer, size_t length)
 {