Appendix A.4.2 makes us check x <= N - 2 and then return // x + 1. Note that it follows that 0 < x + 1 < N. Instead, SetBytes // checks that k < N, and we explicitly check 0 != k. Since k can't be // negative, this is strictly equivalent. None of this matters anyway // because the chance of selecting zero is cryptographically negligible. if k, err := bigmod.NewNat().SetBytes(b, c.N); err == nil && k.IsZero() == 0 { p, err := c.newPoint().ScalarBaseMult(k.Bytes(c.N)) return k, p, err } if testingOnlyRejection...

all hash functions. It is a copy // of [hash.Hash] from the standard library, to avoid depending on security // definitions from outside of the module. type Hash interface { // Write (via the embedded io.Writer interface) adds more data to the // running hash. It never returns an error. io.Writer // Sum appends the current hash to b and returns the resulting slice. // It does not change the underlying hash state. Sum(b []byte) []byte // Reset resets the Hash to its initial state. Reset() // Size returns...