ChaCha8 applies the ChaCha8 stream cipher to `in` using the 32-byte key `key` and the 8-byte nonce `nonce`.

ComputeKeyImage computes the key image for a given spend key.

FeDivPowM1 sets u = z / y * (z / y)^((p-5)/8) in the field GF(2^255 - 19), following the "ref10" formula: t1 = 1 / y t0 = z * t1 // t0 = z / y t0 = t0^((2^255) - 21) // Pow22523(t0) t0 = t0 * z // multiply by z u = t0 * t1 // multiply by (1 / y) Note: Pow22523 implements raising the argument to the power (2^255 - 21), which is used in various places (e.g.

FeToBytes marshals h to s.

HashToPoint is the Go equivalent of the C++ hash_to_point function.

hashToScalar is a helper that does: scalar = keccak256( data ) mod l.

d.

2 * d.

sqrt(-2 * A * (A + 2)).

sqrt(2 * A * (A + 2)).

sqrt(-sqrt(-1) * A * (A + 2)).

sqrt(sqrt(-1) * A * (A + 2)).

-A.

-A^2.

sqrt(-1).

// Cannot set a scalar to L because that is the maximum value + 1 ScL = initSc([32]byte{ 0xed, 0xd3, 0xf5, 0x5c, 0x1a, 0x63, 0x12, 0x58, 0xd6, 0x9c, 0xf7, 0xa2, 0xde, 0xf9, 0xde, 0x14, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x10, })*/.