toAffine updates g with its affine representation.

transpose sets m to the transpose of a. Not aliasing safe

xDbl implements point doubling on a Montgomery curve E(x): x^3 + A*x^2 + x by using x-coordinate only arithmetic. x(Q) = [2]*x(P) It is correctly d

See FIPS 205 -- Section 6.1 -- Algorithm 9 -- Iterative version. This is a stack-based implementation that computes the tree leaves in order (from th

Add updates g=P+Q.

Add calculates z = x + y.

Sets p to a + b. Does not normalize coefficients.

Blind initializes the blind RSA protocol using an input message and source of randomness. This function fails if randomness was not provided.

Blind initializes the partially blind RSA protocol using an input message and source of randomness. The signature includes a randomly generated PSS sa

ByName returns the scheme with the given name and nil if it is not supported. Names are case insensitive.

Bytes serializes a G1 element in compressed form.

Writes Compress_q(p, 1) to m. Assumes p is normalized. m has to be of length at least PlaintextSize.

Writes Compress_q(p, d) to m. Assumes p is normalized and d is in {4, 5, 10, 11}.

Set p to Decompress_q(m, 1). Assumes d is in {4, 5, 10, 11}. p will be normalized.

Double updates g = 2g.

ExtractSize returns the size (in bytes) of the pseudorandom key produced by KDF.Extract.

[GenerateKey] returns a pair of keys using the parameter set specified. It returns an error if it fails reading from the random source.

InvTwoN calculates z = 1 / (2^n).

KeyGen obtains a public key given a secret key.

MarshalBinary encodes a value into a byte array in a format readable by UnmarshalBinary.

NewBigPublicKey creates a BigPublicKey from a rsa.PublicKey.

NewSigner creates a new Signer for the blind RSA protocol using an RSA private key.

NewSike503 instantiates SIKE/p503 KEM. Deprecated: not cryptographically secure.

OmegaNAF obtains the window-w Non-Adjacent Form of a positive number n and 1 < w < 32. The returned slice L holds n = sum( L[i]*2^i ). Reference: - A

Samples p uniformly with τ non-zero coefficients in {q-1,1}. The polynomial p will be normalized.

Samples p uniformly with τ non-zero coefficients in {q-1,1}. The polynomial p will be normalized.

Samples p uniformly with τ non-zero coefficients in {q-1,1}. The polynomial p will be normalized.

Samples p uniformly with τ non-zero coefficients in {q-1,1}. The polynomial p will be normalized.

Samples p uniformly with τ non-zero coefficients in {q-1,1}. The polynomial p will be normalized.

Samples p uniformly with τ non-zero coefficients in {q-1,1}. The polynomial p will be normalized.

Sample p uniformly with coefficients in (-γ₁,…,γK1s] using the given seed and nonce. p will be normalized.

Sample p uniformly with coefficients in (-γ₁,…,γK1s] using the given seed and nonce. p will be normalized.

Sample p uniformly with coefficients in (-γ₁,…,γK1s] using the given seed and nonce. p will be normalized.

For each i, sample ps[i] uniformly from the given seed for coordinates xs[i] and ys[i]. ps[i] may be nil and is ignored in that case. Can only be cal

Prove creates a DLEQ Proof that attests that the pairs (g,gx) and (h,hx) have the same discrete logarithm equal to x. Given g, h in Qn (the subgroup

ReadACVP reads the gzipped prompt and expectedResults files of the ACVP test vector directory dir.

Reset resets the ShakeHash to its initial state.

Result unmarshals the expected result of test case tcID into result.

ScalarBaseMult calculates P = k*G, where G is the generator point.

ScalarMul calculates z[i] = z[i] * x.

Scalarmul3Pt is a right-to-left point multiplication that given the x-coordinate of P, Q and P-Q calculates the x-coordinate of R=Q+[scalar]P. nbits m

Scalarmul3Pt is a right-to-left point multiplication that given the x-coordinate of P, Q and P-Q calculates the x-coordinate of R=Q+[scalar]P. nbits m

Scalarmul3Pt is a right-to-left point multiplication that given the x-coordinate of P, Q and P-Q calculates the x-coordinate of R=Q+[scalar]P. nbits m

ScalarMult calculates g = kP.

Set the element to x if x < Order().

Share creates n shares with an ID monotonically increasing from 1 to n.

SignTo signs the given message and writes the signature into signature. For Dilithium this is the top-level signing function. For ML-DSA this is ML-D

SignTo signs the given message and writes the signature into signature. For Dilithium this is the top-level signing function. For ML-DSA this is ML-D

SignTo signs the given message and writes the signature into signature. For Dilithium this is the top-level signing function. For ML-DSA this is ML-D

SplitBits sets the vector of elements corresponding to the bits of n. The receiving vector sets v[i] = SetUint64(n(i)), where n(i) is the i-th bit of

Sets p to a - b. Does not normalize coefficients.

Puts p into the right form to be used with (among others) InvNTT().

UnmarshalBinary reconstructs a Scalar from a slice that must have at least ScalarSize bytes and contain a number (in big-endian order) from 0 to Scala

Unpack unpacks pk to the public key encoded in buf.

Unpack unpacks pk to the public key encoded in buf.

Validate returns true if 'pub' is a valid cSIDH public key, otherwise false. More precisely, the function verifies that curve y^2 = x^3 + pub.a * x^

Validate explicitly determines if a public key is valid.

Verify returns true if the signature of a message is valid for the corresponding public key.

[Verify] returns true if the signature of the message with the specified context is valid.

Given any x, compute 0 ≤ y ≤ q with x = y (mod q). Beware: we might have barrettReduce(x) = q ≠ 0 for some x. In fact, this happens if and only if x

benchmarkHash tests the speed to hash num buffers of buflen each.

Constant time select. if pick == 0xFF..FF (out = in1) if pick == 0 (out = in2) else out is undefined.

double calculates 2P for curves with A=-1.

encapsulate creates a new ephemeral key and header that can be opened to it. This is the transformation of an Elgamal like scheme to a KEM.