void
ED25519_FN(curved25519_scalarmult_basepoint) (curved25519_key pk, const curved25519_key e) {
curved25519_key ec;
bignum256modm s;
bignum25519 MM16 yplusz, zminusy;
ge25519 MM16 p;
size_t i;
/* clamp */
for (i = 0; i < 32; i++) ec[i] = e[i];
ec[0] &= 248;
ec[31] &= 127;
ec[31] |= 64;
expand_raw256_modm(s, ec);
/* scalar * basepoint */
ge25519_scalarmult_base_niels(&p, ge25519_niels_base_multiples, s);
/* u = (y + z) / (z - y) */
curve25519_add(yplusz, p.y, p.z);
curve25519_sub(zminusy, p.z, p.y);
curve25519_recip(zminusy, zminusy);
curve25519_mul(yplusz, yplusz, zminusy);
curve25519_contract(pk, yplusz);
}
int
ed25519_donna_pubkey_from_curve25519_pubkey(unsigned char *out,
const unsigned char *inp, int signbit)
{
static const bignum25519 ALIGN(16) one = { 1 };
bignum25519 ALIGN(16) u, uminus1, uplus1, inv_uplus1, y;
/* Prop228: y = (u-1)/(u+1) */
curve25519_expand(u, inp);
curve25519_sub(uminus1, u, one);
curve25519_add(uplus1, u, one);
curve25519_recip(inv_uplus1, uplus1);
curve25519_mul(y, uminus1, inv_uplus1);
curve25519_contract(out, y);
/* Propagate sign. */
out[31] |= (!!signbit) << 7;
return 0;
}