test_class.file: java_src/src/test/java/com/google/crypto/tink/subtle/Ed25519Test.java
test_class.identifier: Ed25519Test
test_case.body: @Test
    public void testScalarMultWithBase() throws Exception {
      byte[] scalar = Hex.decode("521784c403e6fb32d48e0da85969a82f5952856bde4471a42b3fa56fd8b96c0d");
      Ed25519.scalarMultWithBaseToBytes(scalar);
    }
test_case.class_method_signature: Ed25519Test.testScalarMultWithBase()
test_case.full_signature: @Test public void testScalarMultWithBase()
test_case.identifier: testScalarMultWithBase
test_case.invocations: decode scalarMultWithBaseToBytes
test_case.modifiers: @Test public
test_case.parameters: ()
test_case.return: void
test_case.signature: void testScalarMultWithBase()
focal_class.declarator: SECRET_KEY_LEN = FIELD_LEN
focal_class.modifier: public static final
focal_class.original_string: public static final int SECRET_KEY_LEN = FIELD_LEN;
focal_class.type: int
focal_class.var_name: SECRET_KEY_LEN
focal_class.declarator: PUBLIC_KEY_LEN = FIELD_LEN
focal_class.modifier: public static final
focal_class.original_string: public static final int PUBLIC_KEY_LEN = FIELD_LEN;
focal_class.type: int
focal_class.var_name: PUBLIC_KEY_LEN
focal_class.declarator: SIGNATURE_LEN = FIELD_LEN * 2
focal_class.modifier: public static final
focal_class.original_string: public static final int SIGNATURE_LEN = FIELD_LEN * 2;
focal_class.type: int
focal_class.var_name: SIGNATURE_LEN
focal_class.declarator: CACHED_NEUTRAL = new CachedXYT(
        new long[]{1, 0, 0, 0, 0, 0, 0, 0, 0, 0},
        new long[]{1, 0, 0, 0, 0, 0, 0, 0, 0, 0},
        new long[]{0, 0, 0, 0, 0, 0, 0, 0, 0, 0})
focal_class.modifier: private static final
focal_class.original_string: private static final CachedXYT CACHED_NEUTRAL = new CachedXYT(
        new long[]{1, 0, 0, 0, 0, 0, 0, 0, 0, 0},
        new long[]{1, 0, 0, 0, 0, 0, 0, 0, 0, 0},
        new long[]{0, 0, 0, 0, 0, 0, 0, 0, 0, 0});
focal_class.type: CachedXYT
focal_class.var_name: CACHED_NEUTRAL
focal_class.declarator: NEUTRAL = new PartialXYZT(
        new XYZ(new long[]{0, 0, 0, 0, 0, 0, 0, 0, 0, 0},
            new long[]{1, 0, 0, 0, 0, 0, 0, 0, 0, 0},
            new long[]{1, 0, 0, 0, 0, 0, 0, 0, 0, 0}),
        new long[]{1, 0, 0, 0, 0, 0, 0, 0, 0, 0})
focal_class.modifier: private static final
focal_class.original_string: private static final PartialXYZT NEUTRAL = new PartialXYZT(
        new XYZ(new long[]{0, 0, 0, 0, 0, 0, 0, 0, 0, 0},
            new long[]{1, 0, 0, 0, 0, 0, 0, 0, 0, 0},
            new long[]{1, 0, 0, 0, 0, 0, 0, 0, 0, 0}),
        new long[]{1, 0, 0, 0, 0, 0, 0, 0, 0, 0});
focal_class.type: PartialXYZT
focal_class.var_name: NEUTRAL
focal_class.declarator: GROUP_ORDER = new byte[] {
       (byte) 0xed, (byte) 0xd3, (byte) 0xf5, (byte) 0x5c,
       (byte) 0x1a, (byte) 0x63, (byte) 0x12, (byte) 0x58,
       (byte) 0xd6, (byte) 0x9c, (byte) 0xf7, (byte) 0xa2,
       (byte) 0xde, (byte) 0xf9, (byte) 0xde, (byte) 0x14,
       (byte) 0x00, (byte) 0x00, (byte) 0x00, (byte) 0x00,
       (byte) 0x00, (byte) 0x00, (byte) 0x00, (byte) 0x00,
       (byte) 0x00, (byte) 0x00, (byte) 0x00, (byte) 0x00,
       (byte) 0x00, (byte) 0x00, (byte) 0x00, (byte) 0x10}
focal_class.modifier: static final
focal_class.original_string: static final byte[] GROUP_ORDER = new byte[] {
       (byte) 0xed, (byte) 0xd3, (byte) 0xf5, (byte) 0x5c,
       (byte) 0x1a, (byte) 0x63, (byte) 0x12, (byte) 0x58,
       (byte) 0xd6, (byte) 0x9c, (byte) 0xf7, (byte) 0xa2,
       (byte) 0xde, (byte) 0xf9, (byte) 0xde, (byte) 0x14,
       (byte) 0x00, (byte) 0x00, (byte) 0x00, (byte) 0x00,
       (byte) 0x00, (byte) 0x00, (byte) 0x00, (byte) 0x00,
       (byte) 0x00, (byte) 0x00, (byte) 0x00, (byte) 0x00,
       (byte) 0x00, (byte) 0x00, (byte) 0x00, (byte) 0x10};
focal_class.type: byte[]
focal_class.var_name: GROUP_ORDER
focal_class.file: java_src/src/main/java/com/google/crypto/tink/subtle/Ed25519.java
focal_class.identifier: Ed25519
focal_class.class_method_signature: Ed25519.add(PartialXYZT partialXYZT, XYZT extended, CachedXYT cached)
focal_class.full_signature: private static void add(PartialXYZT partialXYZT, XYZT extended, CachedXYT cached)
focal_class.identifier: add
focal_class.modifiers: private static
focal_class.parameters: (PartialXYZT partialXYZT, XYZT extended, CachedXYT cached)
focal_class.return: void
focal_class.signature: void add(PartialXYZT partialXYZT, XYZT extended, CachedXYT cached)
focal_class.class_method_signature: Ed25519.sub(PartialXYZT partialXYZT, XYZT extended, CachedXYT cached)
focal_class.full_signature: private static void sub(PartialXYZT partialXYZT, XYZT extended, CachedXYT cached)
focal_class.identifier: sub
focal_class.modifiers: private static
focal_class.parameters: (PartialXYZT partialXYZT, XYZT extended, CachedXYT cached)
focal_class.return: void
focal_class.signature: void sub(PartialXYZT partialXYZT, XYZT extended, CachedXYT cached)
focal_class.class_method_signature: Ed25519.doubleXYZ(PartialXYZT partialXYZT, XYZ p)
focal_class.full_signature: private static void doubleXYZ(PartialXYZT partialXYZT, XYZ p)
focal_class.identifier: doubleXYZ
focal_class.modifiers: private static
focal_class.parameters: (PartialXYZT partialXYZT, XYZ p)
focal_class.return: void
focal_class.signature: void doubleXYZ(PartialXYZT partialXYZT, XYZ p)
focal_class.class_method_signature: Ed25519.doubleXYZT(PartialXYZT partialXYZT, XYZT p)
focal_class.full_signature: private static void doubleXYZT(PartialXYZT partialXYZT, XYZT p)
focal_class.identifier: doubleXYZT
focal_class.modifiers: private static
focal_class.parameters: (PartialXYZT partialXYZT, XYZT p)
focal_class.return: void
focal_class.signature: void doubleXYZT(PartialXYZT partialXYZT, XYZT p)
focal_class.class_method_signature: Ed25519.eq(int a, int b)
focal_class.full_signature: private static int eq(int a, int b)
focal_class.identifier: eq
focal_class.modifiers: private static
focal_class.parameters: (int a, int b)
focal_class.return: int
focal_class.signature: int eq(int a, int b)
focal_class.class_method_signature: Ed25519.select(CachedXYT t, int pos, byte b)
focal_class.full_signature: private static void select(CachedXYT t, int pos, byte b)
focal_class.identifier: select
focal_class.modifiers: private static
focal_class.parameters: (CachedXYT t, int pos, byte b)
focal_class.return: void
focal_class.signature: void select(CachedXYT t, int pos, byte b)
focal_class.class_method_signature: Ed25519.scalarMultWithBase(byte[] a)
focal_class.full_signature: @SuppressWarnings("NarrowingCompoundAssignment") private static XYZ scalarMultWithBase(byte[] a)
focal_class.identifier: scalarMultWithBase
focal_class.modifiers: @SuppressWarnings("NarrowingCompoundAssignment") private static
focal_class.parameters: (byte[] a)
focal_class.return: XYZ
focal_class.signature: XYZ scalarMultWithBase(byte[] a)
focal_class.class_method_signature: Ed25519.scalarMultWithBaseToBytes(byte[] a)
focal_class.full_signature: static byte[] scalarMultWithBaseToBytes(byte[] a)
focal_class.identifier: scalarMultWithBaseToBytes
focal_class.modifiers: static
focal_class.parameters: (byte[] a)
focal_class.return: byte[]
focal_class.signature: byte[] scalarMultWithBaseToBytes(byte[] a)
focal_class.class_method_signature: Ed25519.slide(byte[] a)
focal_class.full_signature: @SuppressWarnings("NarrowingCompoundAssignment") private static byte[] slide(byte[] a)
focal_class.identifier: slide
focal_class.modifiers: @SuppressWarnings("NarrowingCompoundAssignment") private static
focal_class.parameters: (byte[] a)
focal_class.return: byte[]
focal_class.signature: byte[] slide(byte[] a)
focal_class.class_method_signature: Ed25519.doubleScalarMultVarTime(byte[] a, XYZT pointA, byte[] b)
focal_class.full_signature: private static XYZ doubleScalarMultVarTime(byte[] a, XYZT pointA, byte[] b)
focal_class.identifier: doubleScalarMultVarTime
focal_class.modifiers: private static
focal_class.parameters: (byte[] a, XYZT pointA, byte[] b)
focal_class.return: XYZ
focal_class.signature: XYZ doubleScalarMultVarTime(byte[] a, XYZT pointA, byte[] b)
focal_class.class_method_signature: Ed25519.isNonZeroVarTime(long[] in)
focal_class.full_signature: private static boolean isNonZeroVarTime(long[] in)
focal_class.identifier: isNonZeroVarTime
focal_class.modifiers: private static
focal_class.parameters: (long[] in)
focal_class.return: boolean
focal_class.signature: boolean isNonZeroVarTime(long[] in)
focal_class.class_method_signature: Ed25519.getLsb(long[] in)
focal_class.full_signature: private static int getLsb(long[] in)
focal_class.identifier: getLsb
focal_class.modifiers: private static
focal_class.parameters: (long[] in)
focal_class.return: int
focal_class.signature: int getLsb(long[] in)
focal_class.class_method_signature: Ed25519.neg(long[] out, long[] in)
focal_class.full_signature: private static void neg(long[] out, long[] in)
focal_class.identifier: neg
focal_class.modifiers: private static
focal_class.parameters: (long[] out, long[] in)
focal_class.return: void
focal_class.signature: void neg(long[] out, long[] in)
focal_class.class_method_signature: Ed25519.pow2252m3(long[] out, long[] in)
focal_class.full_signature: private static void pow2252m3(long[] out, long[] in)
focal_class.identifier: pow2252m3
focal_class.modifiers: private static
focal_class.parameters: (long[] out, long[] in)
focal_class.return: void
focal_class.signature: void pow2252m3(long[] out, long[] in)
focal_class.class_method_signature: Ed25519.load3(byte[] in, int idx)
focal_class.full_signature: private static long load3(byte[] in, int idx)
focal_class.identifier: load3
focal_class.modifiers: private static
focal_class.parameters: (byte[] in, int idx)
focal_class.return: long
focal_class.signature: long load3(byte[] in, int idx)
focal_class.class_method_signature: Ed25519.load4(byte[] in, int idx)
focal_class.full_signature: private static long load4(byte[] in, int idx)
focal_class.identifier: load4
focal_class.modifiers: private static
focal_class.parameters: (byte[] in, int idx)
focal_class.return: long
focal_class.signature: long load4(byte[] in, int idx)
focal_class.class_method_signature: Ed25519.reduce(byte[] s)
focal_class.full_signature: private static void reduce(byte[] s)
focal_class.identifier: reduce
focal_class.modifiers: private static
focal_class.parameters: (byte[] s)
focal_class.return: void
focal_class.signature: void reduce(byte[] s)
focal_class.class_method_signature: Ed25519.mulAdd(byte[] s, byte[] a, byte[] b, byte[] c)
focal_class.full_signature: private static void mulAdd(byte[] s, byte[] a, byte[] b, byte[] c)
focal_class.identifier: mulAdd
focal_class.modifiers: private static
focal_class.parameters: (byte[] s, byte[] a, byte[] b, byte[] c)
focal_class.return: void
focal_class.signature: void mulAdd(byte[] s, byte[] a, byte[] b, byte[] c)
focal_class.class_method_signature: Ed25519.getHashedScalar(final byte[] privateKey)
focal_class.full_signature: static byte[] getHashedScalar(final byte[] privateKey)
focal_class.identifier: getHashedScalar
focal_class.modifiers: static
focal_class.parameters: (final byte[] privateKey)
focal_class.return: byte[]
focal_class.signature: byte[] getHashedScalar(final byte[] privateKey)
focal_class.class_method_signature: Ed25519.sign(final byte[] message, final byte[] publicKey, final byte[] hashedPrivateKey)
focal_class.full_signature: static byte[] sign(final byte[] message, final byte[] publicKey, final byte[] hashedPrivateKey)
focal_class.identifier: sign
focal_class.modifiers: static
focal_class.parameters: (final byte[] message, final byte[] publicKey, final byte[] hashedPrivateKey)
focal_class.return: byte[]
focal_class.signature: byte[] sign(final byte[] message, final byte[] publicKey, final byte[] hashedPrivateKey)
focal_class.class_method_signature: Ed25519.isSmallerThanGroupOrder(byte[] s)
focal_class.full_signature: private static boolean isSmallerThanGroupOrder(byte[] s)
focal_class.identifier: isSmallerThanGroupOrder
focal_class.modifiers: private static
focal_class.parameters: (byte[] s)
focal_class.return: boolean
focal_class.signature: boolean isSmallerThanGroupOrder(byte[] s)
focal_class.class_method_signature: Ed25519.verify(final byte[] message, final byte[] signature,
        final byte[] publicKey)
focal_class.full_signature: static boolean verify(final byte[] message, final byte[] signature,
        final byte[] publicKey)
focal_class.identifier: verify
focal_class.modifiers: static
focal_class.parameters: (final byte[] message, final byte[] signature,
        final byte[] publicKey)
focal_class.return: boolean
focal_class.signature: boolean verify(final byte[] message, final byte[] signature,
        final byte[] publicKey)
focal_method.body: @SuppressWarnings("NarrowingCompoundAssignment")
    private static XYZ scalarMultWithBase(byte[] a) {
      byte[] e = new byte[2 * FIELD_LEN];
      for (int i = 0; i < FIELD_LEN; i++) {
        e[2 * i + 0] = (byte) (((a[i] & 0xff) >> 0) & 0xf);
        e[2 * i + 1] = (byte) (((a[i] & 0xff) >> 4) & 0xf);
      }
      // each e[i] is between 0 and 15
      // e[63] is between 0 and 7
  
      // Rewrite e in a way that each e[i] is in [-8, 8].
      // This can be done since a[63] is in [0, 7], the carry-over onto the most significant byte
      // a[63] can be at most 1.
      int carry = 0;
      for (int i = 0; i < e.length - 1; i++) {
        e[i] += carry;
        carry = e[i] + 8;
        carry >>= 4;
        e[i] -= carry << 4;
      }
      e[e.length - 1] += carry;
  
      PartialXYZT ret = new PartialXYZT(NEUTRAL);
      XYZT xyzt = new XYZT();
      // Although B_TABLE's i can be at most 31 (stores only 32 4bit multiples of B) and we have 64
      // 4bit values in e array, the below for loop adds cached values by iterating e by two in odd
      // indices. After the result, we can double the result point 4 times to shift the multiplication
      // scalar by 4 bits.
      for (int i = 1; i < e.length; i += 2) {
        CachedXYT t = new CachedXYT(CACHED_NEUTRAL);
        select(t, i / 2, e[i]);
        add(ret, XYZT.fromPartialXYZT(xyzt, ret), t);
      }
  
      // Doubles the result 4 times to shift the multiplication scalar 4 bits to get the actual result
      // for the odd indices in e.
      XYZ xyz = new XYZ();
      doubleXYZ(ret, XYZ.fromPartialXYZT(xyz, ret));
      doubleXYZ(ret, XYZ.fromPartialXYZT(xyz, ret));
      doubleXYZ(ret, XYZ.fromPartialXYZT(xyz, ret));
      doubleXYZ(ret, XYZ.fromPartialXYZT(xyz, ret));
  
      // Add multiples of B for even indices of e.
      for (int i = 0; i < e.length; i += 2) {
        CachedXYT t = new CachedXYT(CACHED_NEUTRAL);
        select(t, i / 2, e[i]);
        add(ret, XYZT.fromPartialXYZT(xyzt, ret), t);
      }
  
      // This check is to protect against flaws, i.e. if there is a computation error through a
      // faulty CPU or if the implementation contains a bug.
      XYZ result = new XYZ(ret);
      if (!result.isOnCurve()) {
        throw new IllegalStateException("arithmetic error in scalar multiplication");
      }
      return result;
    }
focal_method.class_method_signature: Ed25519.scalarMultWithBase(byte[] a)
focal_method.full_signature: @SuppressWarnings("NarrowingCompoundAssignment") private static XYZ scalarMultWithBase(byte[] a)
focal_method.identifier: scalarMultWithBase
focal_method.invocations: select add fromPartialXYZT doubleXYZ fromPartialXYZT doubleXYZ fromPartialXYZT doubleXYZ fromPartialXYZT doubleXYZ fromPartialXYZT select add fromPartialXYZT isOnCurve
focal_method.modifiers: @SuppressWarnings("NarrowingCompoundAssignment") private static
focal_method.parameters: (byte[] a)
focal_method.return: XYZ
focal_method.signature: XYZ scalarMultWithBase(byte[] a)