GenerateKey generates a public/private key pair using entropy from rand. If rand is nil, crypto/rand.Reader will be used.

Creates an element of the group set to the generator of the group.

Returns the integer representative of the element if x < 2^64.

MarshalBinaryCompress returns a byte representation of an element in a compact form whenever the group supports it; otherwise, returns the same byte r

NextPow2 finds the next power of two (N=2^k, k>=0) greater than n. If n is already a power of two, then this function returns n, and log2(n).

Pair calculates the ate-pairing of P and Q.

Sign signs the message with privateKey and returns a signature. This function supports the signature variant defined in RFC-8032: Ed25519, also known

Sign signs the message with privateKey and returns a signature. This function supports the signature variant defined in RFC-8032: Ed448, also known as

We adopt the interface that math.Big uses Receivers get set to the results of operations, and return themselves. All aliases are allowed. Now recall t

Converts string to fp element in Montgomery domain of cSIDH-512.

CMov sets the receiver to x if b=1; the receiver is unmodified if b=0; otherwise panics if b is not 0 or 1. In all the cases, it returns the receiver.

NewKeyFromSeed derives a public/private key pair using the given seed.

NewKeyFromSeed derives a public/private key pair using the given seed.

NewKeyFromSeed derives a public/private key pair using the given seed.

NewKeyFromSeed derives a public/private key pair using the given seed.

NewKeyFromSeed derives a public/private key pair using the given seed.

NewKeyFromSeed derives a public/private key pair using the given seed.

NewKeyFromSeed derives a public/private key pair using the given seed.

NewKeyFromSeed derives a public/private key pair using the given seed.

NewSuite builds a Suite from a specified set of algorithms. Panics if an algorithm identifier is not valid.

Writes p whose coefficients are in [0, 16) to buf, which must be of length N/2.

Params returns domain parameters corresponding to finite field and identified by `id` provided by the caller. Function panics in case `id` wasn't regi

Read squeezes an arbitrary number of bytes from the sponge.

Setup generates a new HPKE context used for Base Mode encryption. Returns the Sealer and corresponding encapsulated key.

Sub calculates z = x - y.

Verify returns true if the signature is valid. Failure cases are invalid signature, or when the public key cannot be decoded. This function supports t

return x==y for fp.

exp computes the naive matrix exponential of a with respect to the basepoint.

go:noescape

Computes the Montgomery reduction z = x R^{-1} (mod 2*p). On return value of x may be changed. z=x not allowed. go:noescape

Computes the Montgomery reduction z = x R^{-1} (mod 2*p). On return value of x may be changed. z=x not allowed. go:noescape

Computes the Montgomery reduction z = x R^{-1} (mod 2*p). On return value of x may be changed. z=x not allowed. go:noescape

All returns all signature schemes supported.

Deal takes in an existing RSA private key generated elsewhere. If cache is true, cached values are stored in KeyShare taking up more memory by reducin

EncapsulateDeterministically generates a shared key ss for the public key deterministically from the given seed and encapsulates it into a ciphertext

IsOnG1 returns true if the point is in the group G1.

KeyGen obtains a public key given a secret key.

Mul calculates z = x*y mod p.

New instantiates an AEAD cipher from the identifier, returns an error if the identifier is not known.

For pure signatures, use [NewMessage] to pass the message to be signed. For pre-hashed signatures, use [PreHash] to hash the message first, and then u

NewSender creates a Sender with knowledge of the receiver's public-key.

NewTurboShake128 creates a new TurboSHAKE128 variable-output-length ShakeHash. Its generic security strength is 128 bits against all attacks if at lea

NonceSize returns the size in bytes of the nonce used by the AEAD cipher.

P384 returns a Curve which implements P-384 (see FIPS 186-3, section D.2.4).

Sample p uniformly from the given seed and nonce. p will be normalized.

Sample p uniformly from the given seed and nonce. p will be normalized.

Sample p uniformly from the given seed and nonce. p will be normalized.

Sample p uniformly from the given seed and nonce. p will be normalized.

Sample p uniformly from the given seed and nonce. p will be normalized.

Sample p uniformly from the given seed and nonce. p will be normalized.

Splits p into p1 and p0 such that [i]p1 * 2ᴰ + [i]p0 = [i]p with -2ᴰ⁻¹ < [i]p0 ≤ 2ᴰ⁻¹. Returns p0 + Q and p1. Requires the coefficients of p to be n

PublicKeyValidation preforms public key/ciphertext validation using the CLN test. CLN test: Check that P and Q are both of order 3^e3 and they generat

PublicKeyValidation preforms public key/ciphertext validation using the CLN test. CLN test: Check that P and Q are both of order 3^e3 and they generat

PublicKeyValidation preforms public key/ciphertext validation using the CLN test. CLN test: Check that P and Q are both of order 3^e3 and they generat

ScalarBaseMult returns k*G, where G is the base point of the group and k is an integer in big-endian form. It is not fully constant time.