) s2 := byteorder.LEUint64(s[16:24]) s3 := byteorder.LEUint64(s[24:]) l0 := byteorder.LEUint64(scalarMinusOneBytes[:8]) l1 := byteorder.LEUint64(scalarMinusOneBytes[8:16]) l2 := byteorder.LEUint64(scalarMinusOneBytes[16:24]) l3 := byteorder.LEUint64(scalarMinusOneBytes[24:]) // Do a constant time subtraction chain scalarMinusOneBytes - s. If there is // a borrow at the end, then s > scalarMinusOneBytes. _, b := bits.Sub64(l0, s0, 0) _, b = bits.Sub64(l1, s1, b) _, b = bits.Sub64(l2, s2, b) _, b =...

length") } if !isReduced(x) { return nil, errors.New("invalid scalar encoding") } fiatScalarFromBytes((*[4]uint64)(&s.s), (*[32]byte)(x)) fiatScalarToMontgome(&s.s, (*fiatScalarNonMontgom)(&s.s)) return s, nil } // scalarMinusOneBytes is l - 1 in little endian. var scalarMinusOneBytes = [32]byte{236, 211, 245, 92, 26, 99, 18, 88, 214, 156, 247, 162, 222, 249, 222, 20, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 16} // isReduced returns whether the given scalar in 32-byte little endian encoded //...