ParagonIE_Sodium_Core_Ristretto255::ristretto255_elligator( ParagonIE_Sodium_Core_Curve25519_Fe $t ): ParagonIE_Sodium_Core_Curve25519_Ge_P3

257    public static function ristretto255_elligator(ParagonIE_Sodium_Core_Curve25519_Fe $t)258    {259        $sqrtm1   = ParagonIE_Sodium_Core_Curve25519_Fe::fromArray(self::$sqrtm1);260        $onemsqd  = ParagonIE_Sodium_Core_Curve25519_Fe::fromArray(self::$onemsqd);261        $d        = ParagonIE_Sodium_Core_Curve25519_Fe::fromArray(self::$d);262        $sqdmone  = ParagonIE_Sodium_Core_Curve25519_Fe::fromArray(self::$sqdmone);263        $sqrtadm1 = ParagonIE_Sodium_Core_Curve25519_Fe::fromArray(self::$sqrtadm1);264 265        $one = self::fe_1();266        $r   = self::fe_mul($sqrtm1, self::fe_sq($t));         /* r = sqrt(-1)*t^2 */267        $u   = self::fe_mul(self::fe_add($r, $one), $onemsqd); /* u = (r+1)*(1-d^2) */268        $c   = self::fe_neg(self::fe_1());                     /* c = -1 */269        $rpd = self::fe_add($r, $d);                           /* rpd = r+d */270 271        $v = self::fe_mul(272            self::fe_sub(273                $c,274                self::fe_mul($r, $d)275            ),276            $rpd277        ); /* v = (c-r*d)*(r+d) */278 279        $result = self::ristretto255_sqrt_ratio_m1($u, $v);280        $s = $result['x'];281        $wasnt_square = 1 - $result['nonsquare'];282 283        $s_prime = self::fe_neg(284            self::fe_abs(285                self::fe_mul($s, $t)286            )287        ); /* s_prime = -|s*t| */288        $s = self::fe_cmov($s, $s_prime, $wasnt_square);289        $c = self::fe_cmov($c, $r, $wasnt_square);290 291        // fe25519_sub(n, r, one);            /* n = r-1 */292        // fe25519_mul(n, n, c);              /* n = c*(r-1) */293        // fe25519_mul(n, n, ed25519_sqdmone); /* n = c*(r-1)*(d-1)^2 */294        // fe25519_sub(n, n, v);              /* n =  c*(r-1)*(d-1)^2-v */295        $n = self::fe_sub(296            self::fe_mul(297                self::fe_mul(298                    self::fe_sub($r, $one),299                    $c300                ),301                $sqdmone302            ),303            $v304        ); /* n =  c*(r-1)*(d-1)^2-v */305 306        $w0 = self::fe_mul(307            self::fe_add($s, $s),308            $v309        ); /* w0 = 2s*v */310 311        $w1 = self::fe_mul($n, $sqrtadm1); /* w1 = n*sqrt(ad-1) */312        $ss = self::fe_sq($s); /* ss = s^2 */313        $w2 = self::fe_sub($one, $ss); /* w2 = 1-s^2 */314        $w3 = self::fe_add($one, $ss); /* w3 = 1+s^2 */315 316        return new ParagonIE_Sodium_Core_Curve25519_Ge_P3(317            self::fe_mul($w0, $w3),318            self::fe_mul($w2, $w1),319            self::fe_mul($w1, $w3),320            self::fe_mul($w0, $w2)321        );322    }