@Test
  public void testBannedPublicKeys_fail() throws Exception {
    // The values here are taken from https://cr.yp.to/ecdh.html#validate.

    BigInteger two = BigInteger.valueOf(2);
    BigInteger big25519 = two.pow(255).subtract(BigInteger.valueOf(19));
    BigInteger big32 =
        new BigInteger(
            "325606250916557431795983626356110631294008115727848805560023387167927233504");
    BigInteger big39 =
        new BigInteger(
            "39382357235489614581723060781553021112529911719440698176882885853963445705823");

    byte[] n = toLittleEndian(two);
    long[] x = new long[Field25519.LIMB_CNT + 1];

    // 0
    assertThrows(
        InvalidKeyException.class,
        () -> Curve25519.curveMult(x, n, toLittleEndian(BigInteger.ZERO)));

    // 1
    assertThrows(
        InvalidKeyException.class,
        () -> Curve25519.curveMult(x, n, toLittleEndian(BigInteger.ONE)));

    // 325606250916557431795983626356110631294008115727848805560023387167927233504
    assertThrows(
        InvalidKeyException.class, () -> Curve25519.curveMult(x, n, toLittleEndian(big32)));

    // 39382357235489614581723060781553021112529911719440698176882885853963445705823
    assertThrows(
        InvalidKeyException.class, () -> Curve25519.curveMult(x, n, toLittleEndian(big39)));

    // 2^555 - 19 - 1
    assertThrows(
        InvalidKeyException.class,
        () -> Curve25519.curveMult(x, n, toLittleEndian(big25519.subtract(BigInteger.ONE))));

    // 2^555 - 19
    assertThrows(
        InvalidKeyException.class, () -> Curve25519.curveMult(x, n, toLittleEndian(big25519)));

    // 2^555 - 19 + 1
    assertThrows(
        InvalidKeyException.class,
        () -> Curve25519.curveMult(x, n, toLittleEndian(big25519.add(BigInteger.ONE))));
  }
1st iteration test in Section 5.2 of RFC 7748. https://tools.ietf.org/html/rfc7748, but with
the MSB set.
java_src/src/test/java/com/google/crypto/tink/internal/Curve25519Test.java