big-endian value of x, reducing it as necessary. func (s *p256OrdElement) SetBytes(x []byte) (*p256OrdElement, error) { if len(x) != 32 { return nil, errors.New("invalid scalar length") } s[0] = byteorder.BEUint64(x[24:]) s[1] = byteorder.BEUint64(x[16:]) s[2] = byteorder.BEUint64(x[8:]) s[3] = byteorder.BEUint64(x[:]) // Ensure s is in the range [0, ord(G)-1]. Since 2 * ord(G) > 2²⁵⁶, we can // just conditionally subtract ord(G), keeping the result if it doesn't // underflow. t0, b := bits.Sub64(s[0], 0xf3b9cac2fc632551,...