Method ScMulAdd

crypto/ed25519/ecmath/point.go:56–70

ScMulAdd computes xa+yB, where B is the ed25519 base point, and places the result in z, returning that.

(a *Point, x, y *Scalar)

// ScMulAdd computes xa+yB, where B is the ed25519 base point, and
// places the result in z, returning that.
func (z *Point) ScMulAdd(a *Point, x, y *Scalar) *Point {
	// TODO: replace with constant-time implementation to avoid
	// sidechannel attacks

	var p edwards25519.ProjectiveGroupElement
	edwards25519.GeDoubleScalarMultVartime(&p, (*[32]byte)(x), (*edwards25519.ExtendedGroupElement)(a), (*[32]byte)(y))

	var buf [32]byte
	p.ToBytes(&buf)
	// TODO(bobg): double-check that it's OK to ignore the return value
	// from ExtendedGroupElement.FromBytes here. (It's a bool indicating
	// that its input represented a legal value.)
	(*edwards25519.ExtendedGroupElement)(z).FromBytes(&buf)
	return z
}

// ScMulCofactor computes 8*p, where p is the ed25519 point and 8 is a cofactor,
// and places the result in z, returning that.