^ q (where 11 is the smallest non-square) // GG[j] = g^(2^j) for j = 0 to n-1 p224GGOnce.Do(func() { p224GG = new([96]fiat.P224Element) for i := range p224GG { if i == 0 { p224GG[i].SetBytes([]byte{0x6a, 0x0f, 0xec, 0x67, 0x85, 0x98, 0xa7, 0x92, 0x0c, 0x55, 0xb2, 0xd4, 0x0b, 0x2d, 0x6f, 0xfb, 0xbe, 0xa3, 0xd8, 0xce, 0xf3, 0xfb, 0x36, 0x32, 0xdc, 0x69, 0x1b, 0x74}) } else { p224GG[i].Square(&p224GG[i-1]) } } }) // r <- x^((q+1)/2) = x^(2^127) // v <- x^q = x^(2^128-1) // Compute x^(2^127-1) first....

^ q (where 11 is the smallest non-square) // GG[j] = g^(2^j) for j = 0 to n-1 p224GGOnce.Do(func() { p224GG = new([96]fiat.P224Element) for i := range p224GG { if i == 0 { p224GG[i].SetBytes([]byte{0x6a, 0x0f, 0xec, 0x67, 0x85, 0x98, 0xa7, 0x92, 0x0c, 0x55, 0xb2, 0xd4, 0x0b, 0x2d, 0x6f, 0xfb, 0xbe, 0xa3, 0xd8, 0xce, 0xf3, 0xfb, 0x36, 0x32, 0xdc, 0x69, 0x1b, 0x74}) } else { p224GG[i].Square(&p224GG[i-1]) } } }) // r <- x^((q+1)/2) = x^(2^127) // v <- x^q = x^(2^128-1) // Compute x^(2^127-1) first....

			N: &n,
		}, nil
	case "EC":
		if key.Crv == "" || key.X == "" || key.Y == "" {
			return nil, errMalformedJWKECKey
		}

		var curve elliptic.Curve
		switch key.Crv {
		case "P-224":
			curve = elliptic.P224()
		case "P-256":
			curve = elliptic.P256()
		case "P-384":
			curve = elliptic.P384()
		case "P-521":
			curve = elliptic.P521()
		default:
			return nil, fmt.Errorf("Unknown curve type: %s", key.Crv)
		}

pkg crypto/elliptic, func GenerateKey(Curve, io.Reader) ([]uint8, *big.Int, *big.Int, error)
pkg crypto/elliptic, func Marshal(Curve, *big.Int, *big.Int) []uint8
pkg crypto/elliptic, func P224() Curve
pkg crypto/elliptic, func P256() Curve
pkg crypto/elliptic, func P384() Curve
pkg crypto/elliptic, func P521() Curve
pkg crypto/elliptic, func Unmarshal(Curve, []uint8) (*big.Int, *big.Int)