GroupElement subtraction using the twisted Edwards addition law with extended coordinates (Hisil2008). <p> this must be in $P^3$ representation and $q

Look up $16^i r_i B$ in the precomputed table. <p> No secret array indices, no secret branching. Constant time. <p> Must have previously precomputed.

Calculates a sliding-windows base 2 representation for a given value $a$. To learn more about it see [6] page 8. <p> Output: $r$ which satisfies $a =

$h = f f$ <p> Can overlap $h$ with $f$. <p> Preconditions: </p><ul> <li>$|f|$ bounded by $1.65 2^{26},1.65 2^{25},1.65 2^{26},1.65 2^{25},$ etc. </ul>

Ensure a serialized key meets the requirements

Get the i'th bit of a byte array. @param h the byte array. @param i the bit index. @return 0 or 1, the value of the i'th bit in h

Converts bytes to a hex string. @param raw the byte[] to be converted. @return the hex representation as a string.

Create an EdDSANamedCurveSpec from the provided curve name. The current implementation fetches the pre-created curve spec from a table. @param curveNa

Extracts the public key bytes from the provided encoding. <p> This will decode data conforming to the current spec at https://tools.ietf.org/html/draf

Extracts the private key bytes from the provided encoding. <p> This will decode data conforming to the current spec at https://tools.ietf.org/html/dra

Decode a FieldElement from its $(b-1)$-bit encoding. The highest bit is masked out. @param in the $(b-1)$-bit encoding of a FieldElement. @return the

$r = a A + b B$ where $a = a[0]+256 a[1]+\dots+256^{31} a[31]$, $b = b[0]+256 b[1]+\dots+256^{31} b[31]$ and $B$ is this point. <p> $A$ must have been

Encode a FieldElement in its $(b-1)$-bit encoding. @param x the FieldElement to encode @return the $(b-1)$-bit encoding of this FieldElement.

Encodes a given field element in its 32 byte representation. This is done in two steps: <ol> <li>Reduce the value of the field element modulo $p$. <li

Returns the public key in its canonical encoding. <p> This implements the following specs: <ul><li> General encoding: https://tools.ietf.org/html/draf

$r = (a b + c) \bmod l$ @param a a scalar @param b a scalar @param c a scalar @return $(a b + c) \bmod l$

Negates this group element by subtracting it from the neutral group element. <p> TODO-CR BR: why not simply negate the coordinates $X$ and $T$? @retu

Constant-time determine if byte is negative. @param b the byte to check. @return 1 if the byte is negative, 0 otherwise.

Perform a self-test to ensure the selected provider is working

GroupElement subtraction using the twisted Edwards addition law with extended coordinates (Hisil2008). <p> $r = p - q$ <p> Negating $q$ means negating

Convert a to radix 16. <p> Method is package private only so that tests run. @param a $= a[0]+256 a[1]+...+256^{31} a[31]$ @return 64 bytes, each bet

Return a bytestring representation of this signing key @return [String] signing key converted to a bytestring

Creates a field element. @param f The underlying field, must be the finite field with $p = 2^{255} - 19$ elements @param t The $2^{25.5}$ bit represe

No specific EdDSA-internal hash requested, allows any EdDSA key.

@param curve the curve @param hashAlgo the JCA string for the hash algorithm @param sc the parameter L represented as ScalarOps @param B the parameter

@param seed the private key @param spec the parameter specification for this key @throws IllegalArgumentException if seed length is wrong or hash al

@param pk the public key @param spec the parameter specification for this key @throws IllegalArgumentException if key length is wrong

Creates a group element for a curve. @param curve The curve. @param repr The representation used to represent the group element. @param X The $X$ coo

$h = f + g$ <p> TODO-CR BR: $h$ is allocated via new, probably not a good idea. Do we need the copying into temp variables if we do that? <p> Precondi

Constant-time conditional move. Well, actually it is a conditional copy. Logic is inspired by the SUPERCOP implementation at: https://github.com/flo