Sets v to w + u. Does not normalize.

Sets v to w + u. Does not normalize.

Sets v to w + u. Does not normalize.

Sets v to w + u. Does not normalize.

Sets v to w + u. Does not normalize.

Sets v to w + u. Does not normalize.

Sets p to a + b. Does not normalize polynomials.

BigInt2Uint64Le stores a positive big.Int number x into a little-endian slice z. The slice is modified if the bitlength of x <= 8*len(z) (padding with

Bytes packs the public key.

Bytes packs the public key.

BytesBe2Uint64Le converts a big-endian slice x to a little-endian slice of uint64.

CSelect sets the receiver to x if b=1; sets the receiver to y if b=0; otherwise panics if b is not 0 or 1. In all the cases, it returns the receiver.

Helper function for RightToLeftLadder(). Returns A+2C / 4.

Helper function for RightToLeftLadder(). Returns A+2C / 4.

Helper function for RightToLeftLadder(). Returns A+2C / 4.

Returns size of resulting ciphertext.

CombinedMult returns mG+nP, where G is the generator point. This function is non-constant time. Like ScalarMult, the result equals [m]G+[n]P only whe

ConvertHashFunction converts a crypto.Hash function to an equivalent hash.Hash type.

DecapsulateTo computes the shared key which is encapsulated in ct for the private key. Panics if ct or ss are not of length CiphertextSize and Shared

DecryptAndCheck checks that the private key operation is consistent (fault attack detection).

Expands the given seed to the corresponding matrix A or its transpose Aᵀ.

Expands the given seed to the corresponding matrix A or its transpose Aᵀ.

Expands the given seed to the corresponding matrix A or its transpose Aᵀ.

DeriveKey generates a private key from a 32-byte seed and an optional info string.

Samples v[i] from a centered binomial distribution with given η, seed and nonce+i. Essentially CBD_η(PRF(seed, nonce+i)) from the specification.

Samples v[i] from a centered binomial distribution with given η, seed and nonce+i. Essentially CBD_η(PRF(seed, nonce+i)) from the specification.

Samples v[i] from a centered binomial distribution with given η, seed and nonce+i. Essentially CBD_η(PRF(seed, nonce+i)) from the specification.

Digit returns the (v,e)-th digit and its sign.

DotProduct calculates z[i] = z[i] * x[i].

EncapsulateTo generates a shared key and ciphertext that contains it for the public key using randomness from seed and writes the shared key to ss and

EncapsulateTo generates a shared key and ciphertext that contains it for the public key using randomness from seed and writes the shared key to ss and

EncapsulateTo generates a shared key and ciphertext that contains it for the public key using randomness from seed and writes the shared key to ss and

EncapsulateTo generates a shared key and a ciphertext containing said key from the public key and the randomness from seed and writes the shared key t

EncapsulateTo generates a shared key and ciphertext that contains it for the public key using randomness from seed and writes the shared key to ss and

EncapsulateTo generates a shared key and ciphertext that contains it for the public key using randomness from seed and writes the shared key to ss and

EncapsulateTo generates a shared key and ciphertext that contains it for the public key using randomness from seed and writes the shared key to ss and

EncapsulateTo generates a shared key and ciphertext that contains it for the public key using randomness from seed and writes the shared key to ss and

EncodeMessageEMSAPSS hashes the input message and then encodes it using PSS encoding.

Checks whether the "supnorm" (see sec 2.1 of the spec) of p is equal or greater than the given bound. Requires the coefficients of p to be normalized

Exp calculates z=x^n, where n is the exponent in big-endian order.

ExpVarTime calculates z=x^n, where n is the exponent in big-endian order.

ExpVarTime calculates z=x^n, where n is the exponent in big-endian order.

Assumes key is exported as encoded in Montgomery domain.

Exports currently stored key. In case structure hasn't been filled with key data returned byte string is filled with zeros.

Extract derives a pseudorandom key from a high-entropy, secret input and a salt. The size of the output is determined by KDF.ExtractSize.

FixedBlind initializes the partially blind RSA protocol using an input message, metadata, and randomness values.

GenerateBlindingFactor generates a blinding factor and its multiplicative inverse to use for RSA blinding.

GenerateKey generates a public/private key pair using entropy from rand. If rand is nil, crypto/rand.Reader will be used.

GenerateKey generates a public/private key pair using entropy from rand. If rand is nil, crypto/rand.Reader will be used.

GenerateKeyPair generates public and private keys using entropy from rand. If rand is nil, crypto/rand.Reader will be used.

Deprecated: not cryptographically secure.

Deprecated: not cryptographically secure.

Deprecated: not cryptographically secure.

Deprecated: not cryptographically secure.

Generator returns the generator point.

GetParams returns the complementary parameters of the encoding.

Hash produces an element of G1 from the hash of an input byte string and an optional domain separation tag. This function is safe to use when a random

See FIPS-205, Section 11.1 and Section 11.2.

Identity returns the identity point.

Identity returns the identity point.

Inv calculates z = 1/x mod p.

Inv calculates z = 1/x mod p.

Execute an in-place inverse NTT and multiply by Montgomery factor R Assumes the coefficients are in Montgomery representation and bounded by 2*Q. Th

InvSqrt calculates z = sqrt(x/y) iff x/y is a quadratic-residue, which is indicated by returning isQR = true. Otherwise, when x/y is a quadratic non-r

InvSqrt calculates z = sqrt(x/y) iff x/y is a quadratic-residue. If so, isQR = true; otherwise, isQR = false, since x/y is a quadratic non-residue, an

IsEnabledX2 returns true if the architecture supports a two-way SIMD implementation provided in this package.

IsOnCurve reports whether the given (x,y) lies on the curve.

IsSafePrime reports whether p is (probably) a safe prime. The prime p=2*q+1 is safe prime if both p and q are primes. Note that ProbablyPrime is not s

IsValid returns true if the parameter set is supported.

IsValid returns true if the KEM identifier is supported by the HPKE package.

IsZero returns true if x is equal to 0.

IsZero returns true if x is equal to 0.