FIPS 186-5, Section 6.4.1 k, R, err := randomPoint(c, func(b []byte) error { drbg.Generate(b) return nil }) if err != nil { return nil, err } // kInv = k⁻¹ kInv := bigmod.NewNat() inverse(c, kInv, k) Rx, err := R.BytesX() if err != nil { return nil, err } r, err := bigmod.NewNat().SetOverflowingBytes(Rx, c.N) if err != nil { return nil, err } // The spec wants us to retry here, but the chance of hitting this condition // on a large prime-order group like the NIST curves we support is // cryptographically...