Package curves: Field implementation IS NOT constant time as it leverages math/big for big number operations.

Add (modular addition): z = x+y (modulo m).

AnyNil determines if any of values are nil.

Commit to a given message.

ComputeHMAC computes HMAC(hash_fn, msg, key) Takes in a hash function to use for HMAC.

ConstantTimeEq determines if a, b have identical byte serialization and uses the crypto/subtle package to get a constant time comparison over byte representations.

ConstantTimeEqByte determines if a, b have identical byte serialization and signs.

Exp (modular exponentiation): z = x^y (modulo m).

fiatShamir computes the HKDF over many values iteratively such that each value is hashed separately and based on preceding values The first value is computed as okm_0 = KDF(f || value) where f is a byte slice of 32 0xFF salt is zero-filled byte slice with length equal to the hash output length info is the protocol name okm is the 32 byte output The each subsequent iteration is computed by as okm_i = KDF(f_i || value || okm_{i-1}) where f_i = 2^b - 1 - i such that there are 0xFF bytes prior to the value.

GenerateSafePrime creates a prime number `p` where (`p`-1)/2 is also prime with at least `bits`.

In determines ring membership before modular reduction: x ∈ Z_m returns nil if 0 ≤ x < m.

Inv (modular inverse): returns y such that xy = 1 (modulo m).

Mul (modular multiplication): z = x*y (modulo m).

Neg (modular negation): z = -x (modulo m).

Open a commitment and return true if the commitment/decommitment pair are valid.

Rand generates a cryptographically secure random integer in the range: 1 < r < m.

Size of random values and hash outputs are determined by our hash function.

One is the multiplicative identity in the set of integers.

Two is the odd prime.

Zero is additive identity in the set of integers.