Accumulate another set of line functions for n-pairing */.

Accumulate another set of line functions for n-pairing, assuming precomputation on G2 */.

Optimal R-ate pairing */.

Optimal R-ate double pairing e(P,Q).e(R,S) */.

convert from byte array to BIG */.

Compare a and b, return 0 if a==b, -1 if a<b, +1 if a>b.

convert from byte array to BIG */.

IEEE1363 ECIES decryption.

IEEE1363 ECIES encryption.

IEEE ECDSA Signature, C and D are signature on F using private key S */.

IEEE-1363 Diffie-Hellman online calculation Z=S.WD */ type = 0 is just x coordinate output type = 1 for standard compressed output type = 2 for standard uncompress output 04|x|y.

IEEE1363 ECDSA Signature Verification.

return true if S is in ranger 0 < S < order , else return false */.

Calculate a public/private EC GF(p) key pair W,S where W=S.G mod EC(p), * where S is the secret key and W is the public key * and G is fixed generator.

validate public key */.

convert from byte array to point */.

Hunt and Peck a BIG to a curve point */.

Constant time Map to Point */.

Generic multi-multiplication, fixed 4-bit window, P=Sigma e_i*X_i.

convert from byte array to point */.

Hunt and Peck a BIG to a curve point */.

Constant time Map to Point */.

Map octet string to curve point */.

final exponentiation - keep separate for multi-pairings and to avoid thrashing stack */.

Two for the price of one - See Hamburg https://eprint.iacr.org/2012/309.pdf Calculate inverse of i and square root of s, return QR.

convert from byte array to FP12 */.

test G1 group membership */.

Multiply P by e in group G1 */.

test G2 group membership */.

Multiply P by e in group G2 */.

Check that m is in cyclotomic sub-group */ Check that m!=1, conj(m)*m==1, and m.m^{p^4}=m^{p^2} */.

test for full GT membership */.

f=f^e */ Note that this method requires a lot of RAM! Better to use compressed XTR method, see FP4.java */.

prepare for multi-pairing */.

Calculate a public/private EC GF(p) key pair.

generate key pair, private key S, public key W */.

basic Miller loop */.

return a+b mod m */.

return a*b mod m */.

return -a mod m */.

return a^2 mod m */.

Implement step 1 on client side of MPin protocol */.

Implement step 2 on client side of MPin protocol */.

Extract Server Secret SST=S*Q where Q is fixed generator in G2 and S is master secret */.

create random secret S */.

Implement step 2 of MPin protocol on server side */.

Constructors */.

construct this from x - but set to O if not on curve */.

construct this from (x,y) - but set to O if not on curve */.

set from x - calculate y from curve equation */.

set (x,y) from BIG and a bit */.

set (x,y) from two BIGs */.

Constructors */.

Constructors */.

Constructors */.

Constructors */.

get 8*MODBYTES size random number */.

Create random BIG in portable way, one bit at a time */.

Transform a point multiplier to RFC7748 form.

Calculate RHS of curve equation */.

Calculate RHS of twisted curve equation x^3+B/i */.

Generate a signature using key pair (D,Q) on message M Set ph=true if message has already been pre-hashed if ph=false, then context should be NULL for ed25519.

Set word size */.

Pairing Twist type.

const INVALID int = -4.

Sparsity.

PIN less than this */.

Number of bits in Modulus */.

BIG length in bytes and number base.

NOT_SPECIAL.

BIG lengths and Masks.

Pairing Friendly?.

Modulus types.

Modulus Masks.

Number of bits in PIN */.

Modulus mod 8 */.

Pairing x parameter sign.

Fp2 QNR.

hash-to-point Z */.

G2 hash-to-point Z */.

G2 hash-to-point Z */.

Number of active bits in top word.

Tower type.

Curve types.

Base Bits= 56.