setting scalar failed") } S, err := edwards25519.NewScalar().SetCanonicalBytes(sig[32:]) if err != nil { return errors.New("ed25519: invalid signature") } // [S]B = R + [k]A --> [k](-A) + [S]B = R minusA := (&edwards25519.Point{}).Negate(&pub.a) R := (&edwards25519.Point{}).VarTimeDoubleScalarB(k, minusA, S) if !bytes.Equal(sig[:32], R.Bytes()) { return errors.New("ed25519: invalid signature") } return nil } golang.org/fips140@v1.0.0/fips140/v1.0.0/edwards25519/doc.go // Copyright (c) 2021 The Go...