table.SelectInto(&tmp1, 9)
	table.SelectInto(&tmp2, 11)
	table.SelectInto(&tmp3, 7)
	table.SelectInto(&tmp4, 13)
	// Expect T1 + T2 = T3 + T4

	var accP1xP1 projP1xP1
	lhs := NewIdentityPoint()
	rhs := NewIdentityPoint()

	accP1xP1.Add(lhs, &tmp1)
	lhs.fromP1xP1(&accP1xP1)
	accP1xP1.Add(lhs, &tmp2)
	lhs.fromP1xP1(&accP1xP1)

	accP1xP1.Add(rhs, &tmp3)
	rhs.fromP1xP1(&accP1xP1)
	accP1xP1.Add(rhs, &tmp4)

	// and do four doublings to multiply by 16.
	digits := x.signedRadix16()

	multiple := &affineCached{}
	tmp1 := &projP1xP1{}
	tmp2 := &projP2{}

	// Accumulate the odd components first
	v.Set(NewIdentityPoint())
	for i := 1; i < 64; i += 2 {
		basepointTable[i/2].SelectInto(multiple, digits[i])
		tmp1.AddAffine(v, multiple)
		v.fromP1xP1(tmp1)
	}

	// Multiply by 16

package edwards25519

import (
	"crypto/internal/edwards25519/field"
	"encoding/hex"
	"internal/testenv"
	"reflect"
	"testing"
)

var B = NewGeneratorPoint()
var I = NewIdentityPoint()

func checkOnCurve(t *testing.T, points ...*Point) {
	t.Helper()
	for i, p := range points {
		var XX, YY, ZZ, ZZZZ field.Element
		XX.Square(&p.x)
		YY.Square(&p.y)
		ZZ.Square(&p.z)
		ZZZZ.Square(&ZZ)

// identity is the point at infinity.
var identity, _ = new(Point).SetBytes([]byte{
	1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
	0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0})

// NewIdentityPoint returns a new Point set to the identity.
func NewIdentityPoint() *Point {
	return new(Point).Set(identity)
}

// generator is the canonical curve basepoint. See TestGenerator for the
// correspondence of this encoding with the values in RFC 8032.