| 1422 | return smlen; |
| 1423 | } |
| 1424 | function unpackneg(r, p) { |
| 1425 | var t = gf(), chk = gf(), num = gf(), den = gf(), den2 = gf(), den4 = gf(), den6 = gf(); |
| 1426 | set25519(r[2], gf1); |
| 1427 | unpack25519(r[1], p); |
| 1428 | S(num, r[1]); |
| 1429 | M(den, num, D); |
| 1430 | Z(num, num, r[2]); |
| 1431 | A(den, r[2], den); |
| 1432 | S(den2, den); |
| 1433 | S(den4, den2); |
| 1434 | M(den6, den4, den2); |
| 1435 | M(t, den6, num); |
| 1436 | M(t, t, den); |
| 1437 | pow2523(t, t); |
| 1438 | M(t, t, num); |
| 1439 | M(t, t, den); |
| 1440 | M(t, t, den); |
| 1441 | M(r[0], t, den); |
| 1442 | S(chk, r[0]); |
| 1443 | M(chk, chk, den); |
| 1444 | if (neq25519(chk, num)) |
| 1445 | M(r[0], r[0], I); |
| 1446 | S(chk, r[0]); |
| 1447 | M(chk, chk, den); |
| 1448 | if (neq25519(chk, num)) |
| 1449 | return -1; |
| 1450 | if (par25519(r[0]) === p[31] >> 7) |
| 1451 | Z(r[0], gf0, r[0]); |
| 1452 | M(r[3], r[0], r[1]); |
| 1453 | return 0; |
| 1454 | } |
| 1455 | function crypto_sign_open(m, sm, n, pk) { |
| 1456 | var i, mlen; |
| 1457 | var t = new Uint8Array(32), h = new Uint8Array(64); |