ParagonIE_Sodium_Core_Ristretto255::ristretto255_frombytes( string $s, bool $skipCanonicalCheck = false ): array{h:

142    public static function ristretto255_frombytes($s, $skipCanonicalCheck = false)143    {144        if (!$skipCanonicalCheck) {145            if (!self::ristretto255_point_is_canonical($s)) {146                throw new SodiumException('S is not canonical');147            }148        }149 150        $s_ = self::fe_frombytes($s);151        $ss = self::fe_sq($s_); /* ss = s^2 */152 153        $u1 = self::fe_sub(self::fe_1(), $ss); /* u1 = 1-ss */154        $u1u1 = self::fe_sq($u1); /* u1u1 = u1^2 */155 156        $u2 = self::fe_add(self::fe_1(), $ss); /* u2 = 1+ss */157        $u2u2 = self::fe_sq($u2); /* u2u2 = u2^2 */158 159        $v = self::fe_mul(160            ParagonIE_Sodium_Core_Curve25519_Fe::fromArray(self::$d),161            $u1u1162        ); /* v = d*u1^2 */163        $v = self::fe_neg($v); /* v = -d*u1^2 */164        $v = self::fe_sub($v, $u2u2); /* v = -(d*u1^2)-u2^2 */165        $v_u2u2 = self::fe_mul($v, $u2u2); /* v_u2u2 = v*u2^2 */166 167        // fe25519_1(one);168        // notsquare = ristretto255_sqrt_ratio_m1(inv_sqrt, one, v_u2u2);169        $one = self::fe_1();170        $result = self::ristretto255_sqrt_ratio_m1($one, $v_u2u2);171        $inv_sqrt = $result['x'];172        $notsquare = $result['nonsquare'];173 174        $h = new ParagonIE_Sodium_Core_Curve25519_Ge_P3();175 176        $h->X = self::fe_mul($inv_sqrt, $u2);177        $h->Y = self::fe_mul(self::fe_mul($inv_sqrt, $h->X), $v);178 179        $h->X = self::fe_mul($h->X, $s_);180        $h->X = self::fe_abs(181            self::fe_add($h->X, $h->X)182        );183        $h->Y = self::fe_mul($u1, $h->Y);184        $h->Z = self::fe_1();185        $h->T = self::fe_mul($h->X, $h->Y);186 187        $res = - ((1 - $notsquare) | self::fe_isnegative($h->T) | self::fe_iszero($h->Y));188        return array('h' => $h, 'res' => $res);189    }