switch curve.Params() {
	case elliptic.P224().Params():
		_, _, err := randomPoint(p224(), rand)
		return err
	case elliptic.P256().Params():
		_, _, err := randomPoint(p256(), rand)
		return err
	case elliptic.P384().Params():
		_, _, err := randomPoint(p384(), rand)
		return err
	case elliptic.P521().Params():
		_, _, err := randomPoint(p521(), rand)
		return err
	default:
		panic("unknown curve")
	}
}

	k, Q, err := randomPoint(c, rand)
	if err != nil {
		return nil, err
	}

	priv := new(PrivateKey)
	priv.PublicKey.Curve = c.curve
	priv.D = new(big.Int).SetBytes(k.Bytes(c.N))
	priv.PublicKey.X, priv.PublicKey.Y, err = c.pointToAffine(Q)
	if err != nil {
		return nil, err
	}
	return priv, nil
}

// randomPoint returns a random scalar and the corresponding point using the

// randFieldElement returns a random element of the order of the given
// curve using the procedure given in FIPS 186-4, Appendix B.5.2.
func randFieldElement(c elliptic.Curve, rand io.Reader) (k *big.Int, err error) {
	// See randomPoint for notes on the algorithm. This has to match, or s390x
	// signatures will come out different from other architectures, which will
	// break TLS recorded tests.
	for {
		N := c.Params().N