generate(b); err != nil { return nil, nil, err } // Take only the leftmost bits of the generated random value. This is // both necessary to increase the chance of the random value being in // the correct range and to match the specification. It's unfortunate // that we need to do a shift instead of a mask, but see the comment on // rightShift. // // These are the most dangerous lines in the package and maybe in the // library: a single bit of bias in the selection of nonces would likely // lead to key...