Appendix A.4.2 makes us check x <= N - 2 and then return // x + 1. Note that it follows that 0 < x + 1 < N. Instead, SetBytes // checks that k < N, and we explicitly check 0 != k. Since k can't be // negative, this is strictly equivalent. None of this matters anyway // because the chance of selecting zero is cryptographically negligible. if k, err := bigmod.NewNat().SetBytes(b, c.N); err == nil && k.IsZero() == 0 { p, err := c.newPoint().ScalarBaseMult(k.Bytes(c.N)) return k, p, err } if testingOnlyRejection...

Appendix A.4.2 makes us check x <= N - 2 and then return // x + 1. Note that it follows that 0 < x + 1 < N. Instead, SetBytes // checks that k < N, and we explicitly check 0 != k. Since k can't be // negative, this is strictly equivalent. None of this matters anyway // because the chance of selecting zero is cryptographically negligible. if k, err := bigmod.NewNat().SetBytes(b, c.N); err == nil && k.IsZero() == 0 { p, err := c.newPoint().ScalarBaseMult(k.Bytes(c.N)) return k, p, err } if testingOnlyRejection...