ScalarMult returns (Qx,Qy)=k*(Px,Py) where k is a number in big-endian form. It is not fully constant time.

Size of seed used in DeriveKey

SetIdentity assigns g to the identity element.

Shared calculates Alice's shared key from Alice's secret key and Bob's public key returning true on success. A failure case happens when the public ke

Sign computes a signature of a message using a key (defined in G1 or G1).

Sqr calculates z = x^2 mod p.

Verify verifies the input (message, metadata, signature) triple using the public key augmented with metadata, and produces an error upon failure.

nolint: unparam

XXX align Poly on 16 bytes such that we can use aligned moves XXX ensure Zetas and InvZetas are 16 byte aligned.

fp384Sub requires a reduced b. go:noescape

go:noescape

Given -2¹⁵ q ≤ x < 2¹⁵ q, returns -q < y < q with x 2⁻¹⁶ = y (mod q).

Computes z = x * y. go:noescape

Computes z = x * y. go:noescape

Computes z = x * y. go:noescape

Interface to "testing" * ------------------------------------------------------------------------- Wrappers for 'testing' SIDH -----------------

Returns projective coordinate X of normalized EC 'point' (point.x / point.z).

Carry Out the augmentation under the BK transform

Add updates g=P+Q.

Add sets the receiver to x + y, and returns the receiver.

All returns all KEM schemes supported.

BlindSign blindly computes the RSA operation using the Signer's private key on the blinded message input, if it's of valid length, and returns an erro

BytesLe2Hex returns an hexadecimal string of a number stored in a little-endian order slice x.

Computes equivalence (A:C) ~ (A+2C : A-2C)

Computes equivalence (A:C) ~ (A+2C : A-2C)

Computes equivalence (A:C) ~ (A+2C : A-2C)

Decode returns an aggregate result of type [AggResult]. This computation may depend on the number of outputs aggregated.

DecryptTo decrypts message ct for the private key and writes the plaintext to pt. This function panics if the lengths of ct and pt are not Ciphertext

Degree is the arithmetic degree of the gadget circuit.

Sample p uniformly from the given seed and x and y coordinates. Coefficients are reduced and will be in "tangled" order. See Tangle().

Double returns 2P.

Eval is evaluates the gadget over the given inputs.

Converts in.A and in.B from Montgomery domain and stores in 'out' out.A = in.A mod p out.B = in.B mod p After returning from the call 'in' is not mod

Converts in.A and in.B from Montgomery domain and stores in 'out' out.A = in.A mod p out.B = in.B mod p After returning from the call 'in' is not mod

Converts in.A and in.B from Montgomery domain and stores in 'out' out.A = in.A mod p out.B = in.B mod p After returning from the call 'in' is not mod

GenerateKey generates a private key compatible with the suite.

HashToScalar hashes a message (msg) using a domain separation string (dst) producing a group scalar with uniform distribution.

InvUint64 calculates z = 1 / x.

JoinBits calculates the element sum( 2^i * z[i] ).

KeccakF1600 applies the Keccak permutation to a 1600b-wide state represented as a slice of 25 uint64s. If turbo is true, applies the 12-round variant

MarshalBinary returns a slice of FpSize bytes that contains the minimal residue of z such that 0 <= z < FpOrder (in big-endian order).

MarshalBinaryLen encodes a value into an array of n bytes in a format readable by UnmarshalBinary.

Sets p to the "pointwise" multiplication of a and b. That is: InvNTT(p) = InvNTT(a) * InvNTT(b). Assumes a and b are in Montgomery form. Products b

New returns a Cipher struct implementing the crypto/cipher.AEAD interface. The key must be Mode.KeySize() bytes long, and the mode is one of Ascon128,

New returns a SecretSharing providing a (t,n) Shamir's secret sharing. It allows splitting a secret into n shares, such that the secret is only recove

NewReceiver creates a Receiver with knowledge of a private key.

NewVerifier creates a new PBRSAVerifier using the corresponding Signer parameters. This corresponds to the RSAPBSSA-SHA384-PSS-Deterministic variant.

Writes p whose coefficients are in (-2ᵈ⁻¹, 2ᵈ⁻¹] into buf which has to be of length at least PolyT0Size. Assumes that the coefficients are not normal

Writes p whose coefficients are less than 1024 into buf, which must be of size at least PolyT1Size . Assumes coefficients of p are normalized.

Given the curve parameters, xP = x(P), and k >= 0, compute xP = x([3^k]P). Safe to overlap xP, xR.

Given the curve parameters, xP = x(P), and k >= 0, compute xP = x([3^k]P). Safe to overlap xP, xR.

Given the curve parameters, xP = x(P), and k >= 0, compute xP = x([3^k]P). Safe to overlap xP, xR.

Prepare is the process by which the message to be signed and verified is prepared for input to the blind signing protocol.

RandomNonZeroScalar creates a scalar chosen at random (using randomness from rnd) from the set of group scalars. Use crypto/rand.Reader as a cryptogra

Recover returns a secret provided more than t different shares are given. Returns an error if the number of shares is not above the threshold t, or if

SetBytes assigns to z the number modulo ScalarOrder stored in the slice (in big-endian order).

SignTo signs the given message and writes the signature into signature. It will panic if signature is not of length at least SignatureSize.

SignTo signs the given message and writes the signature into signature. It will panic if signature is not of length at least SignatureSize.

Sub calculates z = x-y mod p.

Sets p to the polynomial packed into buf by PackT0. The coefficients of p will not be normalized, but will lie in (-2ᵈ⁻¹, 2ᵈ⁻¹].

Sets p to the polynomial whose coefficients are less than 1024 encoded into buf (which must be of size PolyT1Size). p will be normalized.

Almost normalizes coefficients. Ensures each coefficient is in {0, …, q}.

benchmarkShake is specialized to the Shake instances, which don't require a copy on reading output.

fp384Add requires at least one of a and b to be reduced, and c may itself be non-reduced, as only a single p is conditionally subtracted. go:noescape

nolint go:noescape

returns random value in a range (0,p).

resize only changes the matrix if we have to

resize sets up m to be r x c

r = x - y mod p.