p256FromMont(yy, &r.y) cond := int(yy[0]&1) ^ int(b[0]&1) p256NegCond(&r.y, cond) r.z = p256One return p.Set(&r), nil default: return nil, errors.New("invalid P256 point encoding") } } // p256Polynomial sets y2 to x³ - 3x + b, and returns y2. func p256Polynomial(y2, x *p256Element) *p256Element { x3 := new(p256Element) p256Sqr(x3, x, 1) p256Mul(x3, x3, x) threeX := new(p256Element) p256Add(threeX, x, x) p256Add(threeX, threeX, x) p256NegCond(threeX, 1) p256B := &p256Element{0xd89cdf6229c4bddf, 0xacf005cd78843090,...