eye returns the k by k identity matrix.

The function fiatFpMontMul multiplies two field elements in the Montgomery domain. Preconditions: 0 ≤ eval arg1 < m 0 ≤ eval arg2 < m Postconditi

The function fiatScMontMul multiplies two field elements in the Montgomery domain. Preconditions: 0 ≤ eval arg1 < m 0 ≤ eval arg2 < m Postconditi

See FIPS 205 -- Section 8.2 -- Algorithm 15 -- Iterative version. This is a stack-based implementation that computes the tree leaves in order (from t

See FIPS 205 -- Section 8.3 -- Algorithm 16.

See FIPS 205 -- Section 8.1 -- Algorithm 14.

go:noescape

go:noescape

fpInv sets z to a^(-1) mod p.

go:noescape

fqSqrt calculates c = sqrt(u/v) such that sgn(c)=s.

inverse sets m to the inverse of a. If a is not invertible, the result is undefined and an error is returned. Aliasing safe

isValidProjective returns true if the point is not a projective point.

isZero returns false in case v is equal to 0, otherwise true. Constant time.

mixAdd calculates P= P+Q, where Q is a precomputed point with Z_Q != 1.

Reduce a field element in [0, 2*p) to one in [0,p). go:noescape

Reduce a field element in [0, 2*p) to one in [0,p). go:noescape

Reduce a field element in [0, 2*p) to one in [0,p). go:noescape

For x R ≤ q 2³², find y ≤ 2q with y = x mod q.

* ------------------------------------------------------------------------- Generate invalid public key points / ciphertext for test TestKEMInvalid

* ------------------------------------------------------------------------- Generate invalid public key points / ciphertext for test TestKEMInvalid

* ------------------------------------------------------------------------- Generate invalid public key points / ciphertext for test TestKEMInvalid

Executes the permutation (a[1] b[0]) (a[3] b[2]) when considering only the even positions of a and b seen as [8]uint32.

oracle generates 3x2 matrices via the random oracle

permB = 6 for Ascon128 and Ascon80pq, or 8 for Ascon128a.

permute applies the KeccakF-1600 permutation. It handles any input-output buffering.

psi is the Galbraith-Scott endomorphism. See https://eprint.iacr.org/2008/117.

sequentialBytes produces a buffer of size consecutive bytes 0x00, 0x01, ..., used for testing. The alignment of each slice is intentionally randomize

set sets m to a.

set sets m to a.

share distributes an input into shares for a secret sharing system for the formula: the original vector can be recovered from shares that satisfy the

sswu implements the Simplified Shallue-van de Woestijne-Ulas method for mapping a field element to a point on the isogenous curve.

Executes the permutation (a[2] b[0]) (a[3] b[1]) when considering only the even positions of a and b seen as [8]uint32.

Utility function used for testing Mul implementations. Tests caller provided mulFunc against mul()

Utility function used for testing Mul implementations. Tests caller provided mulFunc against mul()

Utility function used for testing REDC implementations. Tests caller provided redcFunc against redc()

Utility function used for testing REDC implementations. Tests caller provided redcFunc against redc()

toAffine updates g with its affine representation.

Converts dst to Montgomery if "toMont==true" or from Montgomery domain otherwise.

Sort the Gates so that Inputs are set before outputs.

See FIPS 205 -- Section 5.3 -- Algorithm 8.

See FIPS 205 -- Section 5.2 -- Algorithm 7.

xDblAdd implements combined doubling of point P and addition of points P and Q on a Montgomery curve E(x): x^3 + A*x^2 + x by using x-coordinate only

See FIPS 205 -- Section 6.2 -- Algorithm 10.

Add calculates z = x+y mod p.