EasyExponentiation calculates g = f^(p^6-1)(p^2+1), where g becomes an element of the 6-th cyclotomic group.

Encode returns a vector of MeasurementLength() elements representing a measurement of type [Measurement].

EvalPoly is evaluates the circuit over the polynomial ring of the field.

Given a 3-isogeny phi and a point pB = x(PB), compute x(QB), the x-coordinate of the image QB = phi(PB) of PB under phi : E_(A:C) -> E_(A':C'). The o

Given a 4-isogeny phi and a point xP = x(P), compute x(Q), the x-coordinate of the image Q = phi(P) of P under phi : E_(A:C) -> E_(A':C'). Input: Iso

Given a 3-isogeny phi and a point pB = x(PB), compute x(QB), the x-coordinate of the image QB = phi(PB) of PB under phi : E_(A:C) -> E_(A':C'). The o

Given a 4-isogeny phi and a point xP = x(P), compute x(Q), the x-coordinate of the image Q = phi(P) of P under phi : E_(A:C) -> E_(A':C'). Input: Iso

Given a 3-isogeny phi and a point pB = x(PB), compute x(QB), the x-coordinate of the image QB = phi(PB) of PB under phi : E_(A:C) -> E_(A':C'). The o

Given a 4-isogeny phi and a point xP = x(P), compute x(Q), the x-coordinate of the image Q = phi(P) of P under phi : E_(A:C) -> E_(A':C'). Input: Iso

Checks whether any of the coefficients exceeds the given bound in supnorm Requires the vector to be normalized.

Checks whether any of the coefficients exceeds the given bound in supnorm Requires the vector to be normalized.

Checks whether any of the coefficients exceeds the given bound in supnorm Requires the vector to be normalized.

Checks whether any of the coefficients exceeds the given bound in supnorm Requires the vector to be normalized.

Checks whether any of the coefficients exceeds the given bound in supnorm Requires the vector to be normalized.

Checks whether any of the coefficients exceeds the given bound in supnorm Requires the vector to be normalized.

randombytes.

Set (y1, y2, y3) = (1/x1, 1/x2, 1/x3). All xi, yi must be distinct.

Set (y1, y2, y3) = (1/x1, 1/x2, 1/x3). All xi, yi must be distinct.

Set (y1, y2, y3) = (1/x1, 1/x2, 1/x3). All xi, yi must be distinct.

FpOrder is the order of the base field for towering returned as a big-endian slice. FpOrder = 0x1a0111ea397fe69a4b1ba7b6434bacd764774b84f38512bf6730

FromBytes returns a point from the input buffer.

HardExponentiation calculates u = g^(Cy_6(p)/r), where u is a root of unity.

HashToElement hashes a message (msg) using a domain separation string (dst) producing a group element with uniform distribution.

HashToField generates a set of elements {u1,..., uN} = Hash(b) where each u in GF(p) and L is the security parameter.

[IDByName] returns the [ID] that corresponds to the given name, or an error if no parameter set was found. See [ID] documentation for the specific nam

PrivateKey operations

Returns true if the element is the neutral multiplicative element.

Computes j-invariant for a curve y2=x3+A/Cx+x with A,C in F_(p^2). Result is returned in jBytes buffer, encoded in little-endian format. Caller provid

Computes j-invariant for a curve y2=x3+A/Cx+x with A,C in F_(p^2). Result is returned in jBytes buffer, encoded in little-endian format. Caller provid

Computes j-invariant for a curve y2=x3+A/Cx+x with A,C in F_(p^2). Result is returned in jBytes buffer, encoded in little-endian format. Caller provid

KeySize returns the size in bytes of the keys used by the AEAD cipher.

Marshal encodes the public key exponent (e).

MarshalBinary returns a slice of ScalarSize bytes that contains the minimal residue of z such that 0 <= z < ScalarOrder (in big-endian order).

MarshalBinary encodes a KeyShare into a byte array in a format readable by UnmarshalBinary. Note: Only Index's up to math.MaxUint16 are supported

MarshalBinary returns a slice with the compressed representation of the underlying element in G1 or G2.

Mul calculates z = x*y mod p.

Applies in-place forward NTT(). See Poly.NTT() for assumptions.

Applies in-place forward NTT(). See Poly.NTT() for assumptions.

Applies in-place forward NTT(). See Poly.NTT() for assumptions.

Neg sets the receiver to -x, and returns the receiver.

New produces an encoder of the MLSBSet algorithm.

randombyte_init(seed, NULL, 256).

NewDraft10 creates a new instance of Kangaroo12 draft version -10.

NewExpanderXOF returns an Expander based on an extendable output function. The kSecLevel parameter is the target security level in bits, and dst is a

NewKeyFromSeed derives a public/private keypair deterministically from the given seed. Panics if seed is not of length KeySeedSize.

NewKeyFromSeed derives a public/private keypair deterministically from the given seed. Panics if seed is not of length KeySeedSize.

[NewPreHashWithHash] is used to prehash messages using either the SHA2 or SHA3 hash functions. Returns [ErrPreHash] if the function is not supported.

Normalize the polynomials in this vector.

Normalize the polynomials in this vector.

Normalize the polynomials in this vector.

Normalize the polynomials in this vector.

Normalize the polynomials in this vector.

Normalize the polynomials in this vector.

Return the appropriate OIDs for this instance. It is implicitly assumed that the encoding is simple: e.g. uses the same OID for signature and public

Packs pk to buf. Panics if buf is not of size PublicKeySize.

Packs pk to buf. Panics if buf is not of size PublicKeySize.

Packs pk to buf. Panics if buf is not of size PublicKeySize.

Packs pk to buf. Panics if buf is not of size PublicKeySize.

Packs pk to buf. Panics if buf is not of size PublicKeySize.

Packs pk to buf. Panics if buf is not of size PublicKeySize.

Sample p uniformly with coefficients of norm less than or equal η, using the given seed and nonce. p will not be normalized, but will have coefficien

Sample p uniformly with coefficients of norm less than or equal η, using the given seed and nonce. p will not be normalized, but will have coefficien

Sample p uniformly with coefficients of norm less than or equal η, using the given seed and nonce. p will not be normalized, but will have coefficien

For each i, sample ps[i] uniformly from the given seed and nonces[i]. ps[i] may be nil and is ignored in that case. Can only be called when DeriveX4A

For each i, sample ps[i] uniformly from the given seed and nonces[i]. ps[i] may be nil and is ignored in that case. Can only be called when DeriveX4A

For each i, sample ps[i] uniformly from the given seed and nonces[i]. ps[i] may be nil and is ignored in that case. Can only be called when DeriveX4A

For each i, sample ps[i] uniformly from the given seed and nonces[i]. ps[i] may be nil and is ignored in that case. Can only be called when DeriveX4A

For each i, sample ps[i] uniformly from the given seed and nonces[i]. ps[i] may be nil and is ignored in that case. Can only be called when DeriveX4A

For each i, sample ps[i] uniformly from the given seed and nonces[i]. ps[i] may be nil and is ignored in that case. Can only be called when DeriveX4A

Sets p to the inner product of a and b using "pointwise" multiplication. See MulHat() and NTT() for a description of the multiplication. Assumes a an

Sets p to the inner product of a and b using "pointwise" multiplication. See MulHat() and NTT() for a description of the multiplication. Assumes a an

Sets p to the inner product of a and b using "pointwise" multiplication. See MulHat() and NTT() for a description of the multiplication. Assumes a an

Set p to the inner product of a and b using pointwise multiplication. Assumes a and b are in Montgomery form and their coefficients are pairwise suff

Set p to the inner product of a and b using pointwise multiplication. Assumes a and b are in Montgomery form and their coefficients are pairwise suff

Set p to the inner product of a and b using pointwise multiplication. Assumes a and b are in Montgomery form and their coefficients are pairwise suff

Set p to the inner product of a and b using pointwise multiplication. Assumes a and b are in Montgomery form and their coefficients are pairwise suff

Set p to the inner product of a and b using pointwise multiplication. Assumes a and b are in Montgomery form and their coefficients are pairwise suff

Set p to the inner product of a and b using pointwise multiplication. Assumes a and b are in Montgomery form and their coefficients are pairwise suff

Writes p with norm less than or equal η into buf, which must be of size PolyLeqEtaSize. Assumes coefficients of p are not normalized, but in [q-η,q+η

Writes p with norm less than or equal η into buf, which must be of size PolyLeqEtaSize. Assumes coefficients of p are not normalized, but in [q-η,q+η

Writes p with norm less than or equal η into buf, which must be of size PolyLeqEtaSize. Assumes coefficients of p are not normalized, but in [q-η,q+η

Writes p with norm less than or equal η into buf, which must be of size PolyLeqEtaSize. Assumes coefficients of p are not normalized, but in [q-η,q+η

Writes p with norm less than or equal η into buf, which must be of size PolyLeqEtaSize. Assumes coefficients of p are not normalized, but in [q-η,q+η

Writes p with norm less than or equal η into buf, which must be of size PolyLeqEtaSize. Assumes coefficients of p are not normalized, but in [q-η,q+η

Sets p to the polynomial of norm less than or equal η encoded in the given buffer of size PolyLeqEtaSize. Output coefficients of p are not normalized

Sets p to the polynomial of norm less than or equal η encoded in the given buffer of size PolyLeqEtaSize. Output coefficients of p are not normalized