Packs pk to buf. Panics if buf is not of size PublicKeySize.

Packs pk to buf. Panics if buf is not of size PublicKeySize.

Params returns the parameters for the curve. Note: The value returned by this function fallbacks to the stdlib implementation of elliptic curve operat

Splits each of the coefficients of p using decompose.

Splits each of the coefficients of p using decompose.

Splits each of the coefficients of p using decompose.

Splits each of the coefficients of p using decompose.

Splits each of the coefficients of p using decompose.

Splits each of the coefficients of p using decompose.

Sample p uniformly with coefficients in (-γ₁,…,γK1s] using the given seed and nonce. p will be normalized.

Sample p uniformly with coefficients in (-γ₁,…,γK1s] using the given seed and nonce. p will be normalized.

Sample p uniformly with coefficients in (-γ₁,…,γK1s] using the given seed and nonce. p will be normalized.

Sample p uniformly with coefficients of norm less than or equal η, using the given seed and nonce. p will not be normalized, but will have coefficien

Sample p uniformly with coefficients of norm less than or equal η, using the given seed and nonce. p will not be normalized, but will have coefficien

Sample p uniformly with coefficients of norm less than or equal η, using the given seed and nonce. p will not be normalized, but will have coefficien

Sets p to the polynomial packed into buf by PolyPackLeGamma1. p will be normalized.

Sets p to the polynomial packed into buf by PolyPackLeGamma1. p will be normalized.

Sets p to the polynomial packed into buf by PolyPackLeGamma1. p will be normalized.

Sets p to the polynomial packed into buf by PolyPackLeGamma1. p will be normalized.

Sets p to the polynomial packed into buf by PolyPackLeGamma1. p will be normalized.

Sets p to the polynomial packed into buf by PolyPackLeGamma1. p will be normalized.

Given the curve parameters, xP = x(P), computes xP = x([2^k]P) Safe to overlap xP, x2P.

Given the curve parameters, xP = x(P), computes xP = x([2^k]P) Safe to overlap xP, x2P.

Given the curve parameters, xP = x(P), computes xP = x([2^k]P) Safe to overlap xP, x2P.

ProdPair calculates the product of pairings: e = \Prod_i pair(Pi, Qi)^ni = \Prod_i pair(ni*Pi, Qi) = \Prod_i pair(Pi, ni*Qi) For efficiency,

Applies Poly.ReduceLe2Q() componentwise.

Applies Poly.ReduceLe2Q() componentwise.

Applies Poly.ReduceLe2Q() componentwise.

Applies Poly.ReduceLe2Q() componentwise.

Applies Poly.ReduceLe2Q() componentwise.

Applies Poly.ReduceLe2Q() componentwise.

Reduces each of the coefficients to <2q.

Round 1 ---- sender should send A to receiver ---- Input: myGroup, the group we operate in Input: choice, the receiver choice bit Input: index, the in

Round 2 ---- receiver should send B to sender ---- Input: B from the receiver Output: e0, e1, encryption of m0 and m1 under key k0, k1 Round2Sender mu

SampleQn returns an element of Qn (the subgroup of squares in (Z/nZ)*). SampleQn will return error for any error returned by crypto/rand.Int.

ScalarBaseMult returns kG where G is the generator point. This function runs in constant time.

scalarMult calculates P = k*Q.

ScalarOrder is the order of the scalar field of the pairing groups, order is returned as a big-endian slice. ScalarOrder = 0x73eda753299d7d483339d80

Set the element to the principal root of unity of order 2^n.

Setup generates a new HPKE context used for Base Mode encryption. Setup takes an encapsulated key and returns an Opener.

Shared calculates a shared key k from Alice's secret and Bob's public key. Returns true on success. The public key is decoded leniently (see fourq.Po

SignPh creates a signature of a message with private key and context. This function supports the signature variant defined in RFC-8032: Ed25519ph, mea

SignPh creates a signature of a message given a keypair. This function supports the signature variant defined in RFC-8032: Ed448ph, meaning it interna

[SignRandomized] returns a random signature of the message with the specified context. It returns an error if it fails reading from the random source.

SignTo signs the given message and writes the signature into signature. For Dilithium this is the top-level signing function. For ML-DSA this is ML-D

SignTo signs the given message and writes the signature into signature. For Dilithium this is the top-level signing function. For ML-DSA this is ML-D

SignTo signs the given message and writes the signature into signature. For Dilithium this is the top-level signing function. For ML-DSA this is ML-D

SignWithCtx creates a signature of a message with private key and context. This function supports the signature variant defined in RFC-8032: Ed25519ct

Size of signatures.

ToAffine returns the x,y affine coordinates of P.

Uint64Le2Hex returns an hexadecimal string of a number stored in a little-endian order slice x.

Unmarshal retrieves a point P from the input buffer. On success, returns true. Decoding is lenient; distinct byte strings decode to the same point. C

UnmarshalBinary converts a byte array outputted from Marshall into a SignShare or returns an error if the value is invalid

Sets pk to the public key encoded in buf.

Sets pk to the public key encoded in buf.

Sets pk to the public key encoded in buf.

Sets pk to the public key encoded in buf.

Sets pk to the public key encoded in buf.

Sets pk to the public key encoded in buf.

Unpack sets sk to the private key encoded in buf.

Unpack sets sk to the private key encoded in buf.

Verify checks whether the given signature by pk on msg is valid. For Dilithium this is the top-level verification function. In ML-DSA, this is ML-DSA

Verify checks whether the given signature by pk on msg is valid. For Dilithium this is the top-level verification function. In ML-DSA, this is ML-DSA

Verify checks whether the given signature by pk on msg is valid. For Dilithium this is the top-level verification function. In ML-DSA, this is ML-DSA

Verify checks whether the given signature by pk on msg is valid.

Verify checks whether the given signature by pk on msg is valid.

VerifyAggregate returns true if the aggregated signature is valid for the list of messages and public keys provided. The slices must have equal size a

VerifyPh returns true if the signature is valid. Failure cases are invalid signature, or when the public key cannot be decoded. This function supports

VerifyPh returns true if the signature is valid. Failure cases are invalid signature, or when the public key cannot be decoded. This function supports

VerifyWithCtx returns true if the signature is valid. Failure cases are invalid signature, or when the public key cannot be decoded, or when context i

add calculates P=Q+R such that Q and R are different than the identity point. This function can be used for doublings.

Sets p to a + b. Does not normalize coefficients.

Sets p to a + b. Does not normalize polynomials.

affinize converts an entire slice to affine at once handling the points at the infinity.

For each lane in a that has a 1 on ith bit of its index, swap it with the corresponding lane in b where this 1 has been replaced by a 0. For instance

blockSize = 8 for Ascon128 and Ascon80pq, or 16 for Ascon128a.

add calculates P=Q+R using complete addition formula for prime groups.

⌈(256 d)/8⌉

⌈(256 d)/8⌉

⌈(256 d)/8⌉

ctUint64Eq returns 1 if the two slices have equal contents and 0 otherwise.

Decapsulate decapsulates

Splits 0 ≤ a < q into a₀ and a₁ with a = a₁*α + a₀ with -α/2 < a₀ ≤ α/2, except for when we would have a₁ = (q-1)/α in which case a₁=0 is taken and -α

Splits 0 ≤ a < q into a₀ and a₁ with a = a₁*α + a₀ with -α/2 < a₀ ≤ α/2, except for when we would have a₁ = (q-1)/α in which case a₁=0 is taken and -α