openpgp/dist/lightweight/elliptic.min.mjs.map

OpenPGP.js is a Javascript implementation of the OpenPGP protocol. This is defined in RFC 4880.

{"version":3,"file":"elliptic.min.mjs","sources":["../../node_modules/brorand/index.js","../../node_modules/minimalistic-crypto-utils/lib/utils.js","../../node_modules/@openpgp/elliptic/lib/elliptic/utils.js","../../node_modules/@openpgp/elliptic/lib/elliptic/curve/base.js","../../node_modules/@openpgp/elliptic/lib/elliptic/curve/short.js","../../node_modules/@openpgp/elliptic/lib/elliptic/curve/mont.js","../../node_modules/@openpgp/elliptic/lib/elliptic/curve/edwards.js","../../node_modules/@openpgp/elliptic/lib/elliptic/curve/index.js","../../node_modules/hash.js/lib/hash/sha/1.js","../../node_modules/hash.js/lib/hash/sha.js","../../node_modules/hash.js/lib/hash/hmac.js","../../node_modules/hash.js/lib/hash.js","../../node_modules/@openpgp/elliptic/lib/elliptic/precomputed/secp256k1.js","../../node_modules/@openpgp/elliptic/lib/elliptic/curves.js","../../node_modules/hmac-drbg/lib/hmac-drbg.js","../../node_modules/@openpgp/elliptic/lib/elliptic/ec/key.js","../../node_modules/@openpgp/elliptic/lib/elliptic/ec/signature.js","../../node_modules/@openpgp/elliptic/lib/elliptic/ec/index.js","../../node_modules/@openpgp/elliptic/lib/elliptic/eddsa/key.js","../../node_modules/@openpgp/elliptic/lib/elliptic/eddsa/signature.js","../../node_modules/@openpgp/elliptic/lib/elliptic/eddsa/index.js","../../node_modules/@openpgp/elliptic/lib/elliptic.js"],"sourcesContent":["var r;\n\nmodule.exports = function rand(len) {\n  if (!r)\n    r = new Rand(null);\n\n  return r.generate(len);\n};\n\nfunction Rand(rand) {\n  this.rand = rand;\n}\nmodule.exports.Rand = Rand;\n\nRand.prototype.generate = function generate(len) {\n  return this._rand(len);\n};\n\n// Emulate crypto API using randy\nRand.prototype._rand = function _rand(n) {\n  if (this.rand.getBytes)\n    return this.rand.getBytes(n);\n\n  var res = new Uint8Array(n);\n  for (var i = 0; i < res.length; i++)\n    res[i] = this.rand.getByte();\n  return res;\n};\n\nif (typeof self === 'object') {\n  if (self.crypto && self.crypto.getRandomValues) {\n    // Modern browsers\n    Rand.prototype._rand = function _rand(n) {\n      var arr = new Uint8Array(n);\n      self.crypto.getRandomValues(arr);\n      return arr;\n    };\n  } else if (self.msCrypto && self.msCrypto.getRandomValues) {\n    // IE\n    Rand.prototype._rand = function _rand(n) {\n      var arr = new Uint8Array(n);\n      self.msCrypto.getRandomValues(arr);\n      return arr;\n    };\n\n  // Safari's WebWorkers do not have `crypto`\n  } else if (typeof window === 'object') {\n    // Old junk\n    Rand.prototype._rand = function() {\n      throw new Error('Not implemented yet');\n    };\n  }\n} else {\n  // Node.js or Web worker with no crypto support\n  try {\n    var crypto = require('crypto');\n    if (typeof crypto.randomBytes !== 'function')\n      throw new Error('Not supported');\n\n    Rand.prototype._rand = function _rand(n) {\n      return crypto.randomBytes(n);\n    };\n  } catch (e) {\n  }\n}\n","'use strict';\n\nvar utils = exports;\n\nfunction toArray(msg, enc) {\n  if (Array.isArray(msg))\n    return msg.slice();\n  if (!msg)\n    return [];\n  var res = [];\n  if (typeof msg !== 'string') {\n    for (var i = 0; i < msg.length; i++)\n      res[i] = msg[i] | 0;\n    return res;\n  }\n  if (enc === 'hex') {\n    msg = msg.replace(/[^a-z0-9]+/ig, '');\n    if (msg.length % 2 !== 0)\n      msg = '0' + msg;\n    for (var i = 0; i < msg.length; i += 2)\n      res.push(parseInt(msg[i] + msg[i + 1], 16));\n  } else {\n    for (var i = 0; i < msg.length; i++) {\n      var c = msg.charCodeAt(i);\n      var hi = c >> 8;\n      var lo = c & 0xff;\n      if (hi)\n        res.push(hi, lo);\n      else\n        res.push(lo);\n    }\n  }\n  return res;\n}\nutils.toArray = toArray;\n\nfunction zero2(word) {\n  if (word.length === 1)\n    return '0' + word;\n  else\n    return word;\n}\nutils.zero2 = zero2;\n\nfunction toHex(msg) {\n  var res = '';\n  for (var i = 0; i < msg.length; i++)\n    res += zero2(msg[i].toString(16));\n  return res;\n}\nutils.toHex = toHex;\n\nutils.encode = function encode(arr, enc) {\n  if (enc === 'hex')\n    return toHex(arr);\n  else\n    return arr;\n};\n","'use strict';\n\nvar utils = exports;\nvar BN = require('bn.js');\nvar minAssert = require('minimalistic-assert');\nvar minUtils = require('minimalistic-crypto-utils');\n\nutils.assert = minAssert;\nutils.toArray = minUtils.toArray;\nutils.zero2 = minUtils.zero2;\nutils.toHex = minUtils.toHex;\nutils.encode = minUtils.encode;\n\n// Represent num in a w-NAF form\nfunction getNAF(num, w) {\n  var naf = [];\n  var ws = 1 << (w + 1);\n  var k = num.clone();\n  while (k.cmpn(1) >= 0) {\n    var z;\n    if (k.isOdd()) {\n      var mod = k.andln(ws - 1);\n      if (mod > (ws >> 1) - 1)\n        z = (ws >> 1) - mod;\n      else\n        z = mod;\n      k.isubn(z);\n    } else {\n      z = 0;\n    }\n    naf.push(z);\n\n    // Optimization, shift by word if possible\n    var shift = (k.cmpn(0) !== 0 && k.andln(ws - 1) === 0) ? (w + 1) : 1;\n    for (var i = 1; i < shift; i++)\n      naf.push(0);\n    k.iushrn(shift);\n  }\n\n  return naf;\n}\nutils.getNAF = getNAF;\n\n// Represent k1, k2 in a Joint Sparse Form\nfunction getJSF(k1, k2) {\n  var jsf = [\n    [],\n    []\n  ];\n\n  k1 = k1.clone();\n  k2 = k2.clone();\n  var d1 = 0;\n  var d2 = 0;\n  while (k1.cmpn(-d1) > 0 || k2.cmpn(-d2) > 0) {\n\n    // First phase\n    var m14 = (k1.andln(3) + d1) & 3;\n    var m24 = (k2.andln(3) + d2) & 3;\n    if (m14 === 3)\n      m14 = -1;\n    if (m24 === 3)\n      m24 = -1;\n    var u1;\n    if ((m14 & 1) === 0) {\n      u1 = 0;\n    } else {\n      var m8 = (k1.andln(7) + d1) & 7;\n      if ((m8 === 3 || m8 === 5) && m24 === 2)\n        u1 = -m14;\n      else\n        u1 = m14;\n    }\n    jsf[0].push(u1);\n\n    var u2;\n    if ((m24 & 1) === 0) {\n      u2 = 0;\n    } else {\n      var m8 = (k2.andln(7) + d2) & 7;\n      if ((m8 === 3 || m8 === 5) && m14 === 2)\n        u2 = -m24;\n      else\n        u2 = m24;\n    }\n    jsf[1].push(u2);\n\n    // Second phase\n    if (2 * d1 === u1 + 1)\n      d1 = 1 - d1;\n    if (2 * d2 === u2 + 1)\n      d2 = 1 - d2;\n    k1.iushrn(1);\n    k2.iushrn(1);\n  }\n\n  return jsf;\n}\nutils.getJSF = getJSF;\n\nfunction cachedProperty(obj, name, computer) {\n  var key = '_' + name;\n  obj.prototype[name] = function cachedProperty() {\n    return this[key] !== undefined ? this[key] :\n           this[key] = computer.call(this);\n  };\n}\nutils.cachedProperty = cachedProperty;\n\nfunction parseBytes(bytes) {\n  return typeof bytes === 'string' ? utils.toArray(bytes, 'hex') :\n                                     bytes;\n}\nutils.parseBytes = parseBytes;\n\nfunction intFromLE(bytes) {\n  return new BN(bytes, 'hex', 'le');\n}\nutils.intFromLE = intFromLE;\n\n","'use strict';\n\nvar BN = require('bn.js');\nvar utils = require('../utils');\nvar getNAF = utils.getNAF;\nvar getJSF = utils.getJSF;\nvar assert = utils.assert;\n\nfunction BaseCurve(type, conf) {\n  this.type = type;\n  this.p = new BN(conf.p, 16);\n\n  // Use Montgomery, when there is no fast reduction for the prime\n  this.red = conf.prime ? BN.red(conf.prime) : BN.mont(this.p);\n\n  // Useful for many curves\n  this.zero = new BN(0).toRed(this.red);\n  this.one = new BN(1).toRed(this.red);\n  this.two = new BN(2).toRed(this.red);\n\n  // Curve configuration, optional\n  this.n = conf.n && new BN(conf.n, 16);\n  this.g = conf.g && this.pointFromJSON(conf.g, conf.gRed);\n\n  // Temporary arrays\n  this._wnafT1 = new Array(4);\n  this._wnafT2 = new Array(4);\n  this._wnafT3 = new Array(4);\n  this._wnafT4 = new Array(4);\n\n  // Generalized Greg Maxwell's trick\n  var adjustCount = this.n && this.p.div(this.n);\n  if (!adjustCount || adjustCount.cmpn(100) > 0) {\n    this.redN = null;\n  } else {\n    this._maxwellTrick = true;\n    this.redN = this.n.toRed(this.red);\n  }\n}\nmodule.exports = BaseCurve;\n\nBaseCurve.prototype.point = function point() {\n  throw new Error('Not implemented');\n};\n\nBaseCurve.prototype.validate = function validate() {\n  throw new Error('Not implemented');\n};\n\nBaseCurve.prototype._fixedNafMul = function _fixedNafMul(p, k) {\n  assert(p.precomputed);\n  var doubles = p._getDoubles();\n\n  var naf = getNAF(k, 1);\n  var I = (1 << (doubles.step + 1)) - (doubles.step % 2 === 0 ? 2 : 1);\n  I /= 3;\n\n  // Translate into more windowed form\n  var repr = [];\n  for (var j = 0; j < naf.length; j += doubles.step) {\n    var nafW = 0;\n    for (var k = j + doubles.step - 1; k >= j; k--)\n      nafW = (nafW << 1) + naf[k];\n    repr.push(nafW);\n  }\n\n  var a = this.jpoint(null, null, null);\n  var b = this.jpoint(null, null, null);\n  for (var i = I; i > 0; i--) {\n    for (var j = 0; j < repr.length; j++) {\n      var nafW = repr[j];\n      if (nafW === i)\n        b = b.mixedAdd(doubles.points[j]);\n      else if (nafW === -i)\n        b = b.mixedAdd(doubles.points[j].neg());\n    }\n    a = a.add(b);\n  }\n  return a.toP();\n};\n\nBaseCurve.prototype._wnafMul = function _wnafMul(p, k) {\n  var w = 4;\n\n  // Precompute window\n  var nafPoints = p._getNAFPoints(w);\n  w = nafPoints.wnd;\n  var wnd = nafPoints.points;\n\n  // Get NAF form\n  var naf = getNAF(k, w);\n\n  // Add `this`*(N+1) for every w-NAF index\n  var acc = this.jpoint(null, null, null);\n  for (var i = naf.length - 1; i >= 0; i--) {\n    // Count zeroes\n    for (var k = 0; i >= 0 && naf[i] === 0; i--)\n      k++;\n    if (i >= 0)\n      k++;\n    acc = acc.dblp(k);\n\n    if (i < 0)\n      break;\n    var z = naf[i];\n    assert(z !== 0);\n    if (p.type === 'affine') {\n      // J +- P\n      if (z > 0)\n        acc = acc.mixedAdd(wnd[(z - 1) >> 1]);\n      else\n        acc = acc.mixedAdd(wnd[(-z - 1) >> 1].neg());\n    } else {\n      // J +- J\n      if (z > 0)\n        acc = acc.add(wnd[(z - 1) >> 1]);\n      else\n        acc = acc.add(wnd[(-z - 1) >> 1].neg());\n    }\n  }\n  return p.type === 'affine' ? acc.toP() : acc;\n};\n\nBaseCurve.prototype._wnafMulAdd = function _wnafMulAdd(defW,\n                                                       points,\n                                                       coeffs,\n                                                       len,\n                                                       jacobianResult) {\n  var wndWidth = this._wnafT1;\n  var wnd = this._wnafT2;\n  var naf = this._wnafT3;\n\n  // Fill all arrays\n  var max = 0;\n  for (var i = 0; i < len; i++) {\n    var p = points[i];\n    var nafPoints = p._getNAFPoints(defW);\n    wndWidth[i] = nafPoints.wnd;\n    wnd[i] = nafPoints.points;\n  }\n\n  // Comb small window NAFs\n  for (var i = len - 1; i >= 1; i -= 2) {\n    var a = i - 1;\n    var b = i;\n    if (wndWidth[a] !== 1 || wndWidth[b] !== 1) {\n      naf[a] = getNAF(coeffs[a], wndWidth[a]);\n      naf[b] = getNAF(coeffs[b], wndWidth[b]);\n      max = Math.max(naf[a].length, max);\n      max = Math.max(naf[b].length, max);\n      continue;\n    }\n\n    var comb = [\n      points[a], /* 1 */\n      null, /* 3 */\n      null, /* 5 */\n      points[b] /* 7 */\n    ];\n\n    // Try to avoid Projective points, if possible\n    if (points[a].y.cmp(points[b].y) === 0) {\n      comb[1] = points[a].add(points[b]);\n      comb[2] = points[a].toJ().mixedAdd(points[b].neg());\n    } else if (points[a].y.cmp(points[b].y.redNeg()) === 0) {\n      comb[1] = points[a].toJ().mixedAdd(points[b]);\n      comb[2] = points[a].add(points[b].neg());\n    } else {\n      comb[1] = points[a].toJ().mixedAdd(points[b]);\n      comb[2] = points[a].toJ().mixedAdd(points[b].neg());\n    }\n\n    var index = [\n      -3, /* -1 -1 */\n      -1, /* -1 0 */\n      -5, /* -1 1 */\n      -7, /* 0 -1 */\n      0, /* 0 0 */\n      7, /* 0 1 */\n      5, /* 1 -1 */\n      1, /* 1 0 */\n      3  /* 1 1 */\n    ];\n\n    var jsf = getJSF(coeffs[a], coeffs[b]);\n    max = Math.max(jsf[0].length, max);\n    naf[a] = new Array(max);\n    naf[b] = new Array(max);\n    for (var j = 0; j < max; j++) {\n      var ja = jsf[0][j] | 0;\n      var jb = jsf[1][j] | 0;\n\n      naf[a][j] = index[(ja + 1) * 3 + (jb + 1)];\n      naf[b][j] = 0;\n      wnd[a] = comb;\n    }\n  }\n\n  var acc = this.jpoint(null, null, null);\n  var tmp = this._wnafT4;\n  for (var i = max; i >= 0; i--) {\n    var k = 0;\n\n    while (i >= 0) {\n      var zero = true;\n      for (var j = 0; j < len; j++) {\n        tmp[j] = naf[j][i] | 0;\n        if (tmp[j] !== 0)\n          zero = false;\n      }\n      if (!zero)\n        break;\n      k++;\n      i--;\n    }\n    if (i >= 0)\n      k++;\n    acc = acc.dblp(k);\n    if (i < 0)\n      break;\n\n    for (var j = 0; j < len; j++) {\n      var z = tmp[j];\n      var p;\n      if (z === 0)\n        continue;\n      else if (z > 0)\n        p = wnd[j][(z - 1) >> 1];\n      else if (z < 0)\n        p = wnd[j][(-z - 1) >> 1].neg();\n\n      if (p.type === 'affine')\n        acc = acc.mixedAdd(p);\n      else\n        acc = acc.add(p);\n    }\n  }\n  // Zeroify references\n  for (var i = 0; i < len; i++)\n    wnd[i] = null;\n\n  if (jacobianResult)\n    return acc;\n  else\n    return acc.toP();\n};\n\nfunction BasePoint(curve, type) {\n  this.curve = curve;\n  this.type = type;\n  this.precomputed = null;\n}\nBaseCurve.BasePoint = BasePoint;\n\nBasePoint.prototype.eq = function eq(/*other*/) {\n  throw new Error('Not implemented');\n};\n\nBasePoint.prototype.validate = function validate() {\n  return this.curve.validate(this);\n};\n\nBaseCurve.prototype.decodePoint = function decodePoint(bytes, enc) {\n  bytes = utils.toArray(bytes, enc);\n\n  var len = this.p.byteLength();\n\n  // uncompressed, hybrid-odd, hybrid-even\n  if ((bytes[0] === 0x04 || bytes[0] === 0x06 || bytes[0] === 0x07) &&\n      bytes.length - 1 === 2 * len) {\n    if (bytes[0] === 0x06)\n      assert(bytes[bytes.length - 1] % 2 === 0);\n    else if (bytes[0] === 0x07)\n      assert(bytes[bytes.length - 1] % 2 === 1);\n\n    var res =  this.point(bytes.slice(1, 1 + len),\n                          bytes.slice(1 + len, 1 + 2 * len));\n\n    return res;\n  } else if ((bytes[0] === 0x02 || bytes[0] === 0x03) &&\n              bytes.length - 1 === len) {\n    return this.pointFromX(bytes.slice(1, 1 + len), bytes[0] === 0x03);\n  }\n  throw new Error('Unknown point format');\n};\n\nBasePoint.prototype.encodeCompressed = function encodeCompressed(enc) {\n  return this.encode(enc, true);\n};\n\nBasePoint.prototype._encode = function _encode(compact) {\n  var len = this.curve.p.byteLength();\n  var x = this.getX().toArray('be', len);\n\n  if (compact)\n    return [ this.getY().isEven() ? 0x02 : 0x03 ].concat(x);\n\n  return [ 0x04 ].concat(x, this.getY().toArray('be', len)) ;\n};\n\nBasePoint.prototype.encode = function encode(enc, compact) {\n  return utils.encode(this._encode(compact), enc);\n};\n\nBasePoint.prototype.precompute = function precompute(power) {\n  if (this.precomputed)\n    return this;\n\n  var precomputed = {\n    doubles: null,\n    naf: null,\n    beta: null\n  };\n  precomputed.naf = this._getNAFPoints(8);\n  precomputed.doubles = this._getDoubles(4, power);\n  precomputed.beta = this._getBeta();\n  this.precomputed = precomputed;\n\n  return this;\n};\n\nBasePoint.prototype._hasDoubles = function _hasDoubles(k) {\n  if (!this.precomputed)\n    return false;\n\n  var doubles = this.precomputed.doubles;\n  if (!doubles)\n    return false;\n\n  return doubles.points.length >= Math.ceil((k.bitLength() + 1) / doubles.step);\n};\n\nBasePoint.prototype._getDoubles = function _getDoubles(step, power) {\n  if (this.precomputed && this.precomputed.doubles)\n    return this.precomputed.doubles;\n\n  var doubles = [ this ];\n  var acc = this;\n  for (var i = 0; i < power; i += step) {\n    for (var j = 0; j < step; j++)\n      acc = acc.dbl();\n    doubles.push(acc);\n  }\n  return {\n    step: step,\n    points: doubles\n  };\n};\n\nBasePoint.prototype._getNAFPoints = function _getNAFPoints(wnd) {\n  if (this.precomputed && this.precomputed.naf)\n    return this.precomputed.naf;\n\n  var res = [ this ];\n  var max = (1 << wnd) - 1;\n  var dbl = max === 1 ? null : this.dbl();\n  for (var i = 1; i < max; i++)\n    res[i] = res[i - 1].add(dbl);\n  return {\n    wnd: wnd,\n    points: res\n  };\n};\n\nBasePoint.prototype._getBeta = function _getBeta() {\n  return null;\n};\n\nBasePoint.prototype.dblp = function dblp(k) {\n  var r = this;\n  for (var i = 0; i < k; i++)\n    r = r.dbl();\n  return r;\n};\n","'use strict';\n\nvar utils = require('../utils');\nvar BN = require('bn.js');\nvar inherits = require('inherits');\nvar Base = require('./base');\n\nvar assert = utils.assert;\n\nfunction ShortCurve(conf) {\n  Base.call(this, 'short', conf);\n\n  this.a = new BN(conf.a, 16).toRed(this.red);\n  this.b = new BN(conf.b, 16).toRed(this.red);\n  this.tinv = this.two.redInvm();\n\n  this.zeroA = this.a.fromRed().cmpn(0) === 0;\n  this.threeA = this.a.fromRed().sub(this.p).cmpn(-3) === 0;\n\n  // If the curve is endomorphic, precalculate beta and lambda\n  this.endo = this._getEndomorphism(conf);\n  this._endoWnafT1 = new Array(4);\n  this._endoWnafT2 = new Array(4);\n}\ninherits(ShortCurve, Base);\nmodule.exports = ShortCurve;\n\nShortCurve.prototype._getEndomorphism = function _getEndomorphism(conf) {\n  // No efficient endomorphism\n  if (!this.zeroA || !this.g || !this.n || this.p.modn(3) !== 1)\n    return;\n\n  // Compute beta and lambda, that lambda * P = (beta * Px; Py)\n  var beta;\n  var lambda;\n  if (conf.beta) {\n    beta = new BN(conf.beta, 16).toRed(this.red);\n  } else {\n    var betas = this._getEndoRoots(this.p);\n    // Choose the smallest beta\n    beta = betas[0].cmp(betas[1]) < 0 ? betas[0] : betas[1];\n    beta = beta.toRed(this.red);\n  }\n  if (conf.lambda) {\n    lambda = new BN(conf.lambda, 16);\n  } else {\n    // Choose the lambda that is matching selected beta\n    var lambdas = this._getEndoRoots(this.n);\n    if (this.g.mul(lambdas[0]).x.cmp(this.g.x.redMul(beta)) === 0) {\n      lambda = lambdas[0];\n    } else {\n      lambda = lambdas[1];\n      assert(this.g.mul(lambda).x.cmp(this.g.x.redMul(beta)) === 0);\n    }\n  }\n\n  // Get basis vectors, used for balanced length-two representation\n  var basis;\n  if (conf.basis) {\n    basis = conf.basis.map(function(vec) {\n      return {\n        a: new BN(vec.a, 16),\n        b: new BN(vec.b, 16)\n      };\n    });\n  } else {\n    basis = this._getEndoBasis(lambda);\n  }\n\n  return {\n    beta: beta,\n    lambda: lambda,\n    basis: basis\n  };\n};\n\nShortCurve.prototype._getEndoRoots = function _getEndoRoots(num) {\n  // Find roots of for x^2 + x + 1 in F\n  // Root = (-1 +- Sqrt(-3)) / 2\n  //\n  var red = num === this.p ? this.red : BN.mont(num);\n  var tinv = new BN(2).toRed(red).redInvm();\n  var ntinv = tinv.redNeg();\n\n  var s = new BN(3).toRed(red).redNeg().redSqrt().redMul(tinv);\n\n  var l1 = ntinv.redAdd(s).fromRed();\n  var l2 = ntinv.redSub(s).fromRed();\n  return [ l1, l2 ];\n};\n\nShortCurve.prototype._getEndoBasis = function _getEndoBasis(lambda) {\n  // aprxSqrt >= sqrt(this.n)\n  var aprxSqrt = this.n.ushrn(Math.floor(this.n.bitLength() / 2));\n\n  // 3.74\n  // Run EGCD, until r(L + 1) < aprxSqrt\n  var u = lambda;\n  var v = this.n.clone();\n  var x1 = new BN(1);\n  var y1 = new BN(0);\n  var x2 = new BN(0);\n  var y2 = new BN(1);\n\n  // NOTE: all vectors are roots of: a + b * lambda = 0 (mod n)\n  var a0;\n  var b0;\n  // First vector\n  var a1;\n  var b1;\n  // Second vector\n  var a2;\n  var b2;\n\n  var prevR;\n  var i = 0;\n  var r;\n  var x;\n  while (u.cmpn(0) !== 0) {\n    var q = v.div(u);\n    r = v.sub(q.mul(u));\n    x = x2.sub(q.mul(x1));\n    var y = y2.sub(q.mul(y1));\n\n    if (!a1 && r.cmp(aprxSqrt) < 0) {\n      a0 = prevR.neg();\n      b0 = x1;\n      a1 = r.neg();\n      b1 = x;\n    } else if (a1 && ++i === 2) {\n      break;\n    }\n    prevR = r;\n\n    v = u;\n    u = r;\n    x2 = x1;\n    x1 = x;\n    y2 = y1;\n    y1 = y;\n  }\n  a2 = r.neg();\n  b2 = x;\n\n  var len1 = a1.sqr().add(b1.sqr());\n  var len2 = a2.sqr().add(b2.sqr());\n  if (len2.cmp(len1) >= 0) {\n    a2 = a0;\n    b2 = b0;\n  }\n\n  // Normalize signs\n  if (a1.negative) {\n    a1 = a1.neg();\n    b1 = b1.neg();\n  }\n  if (a2.negative) {\n    a2 = a2.neg();\n    b2 = b2.neg();\n  }\n\n  return [\n    { a: a1, b: b1 },\n    { a: a2, b: b2 }\n  ];\n};\n\nShortCurve.prototype._endoSplit = function _endoSplit(k) {\n  var basis = this.endo.basis;\n  var v1 = basis[0];\n  var v2 = basis[1];\n\n  var c1 = v2.b.mul(k).divRound(this.n);\n  var c2 = v1.b.neg().mul(k).divRound(this.n);\n\n  var p1 = c1.mul(v1.a);\n  var p2 = c2.mul(v2.a);\n  var q1 = c1.mul(v1.b);\n  var q2 = c2.mul(v2.b);\n\n  // Calculate answer\n  var k1 = k.sub(p1).sub(p2);\n  var k2 = q1.add(q2).neg();\n  return { k1: k1, k2: k2 };\n};\n\nShortCurve.prototype.pointFromX = function pointFromX(x, odd) {\n  x = new BN(x, 16);\n  if (!x.red)\n    x = x.toRed(this.red);\n\n  var y2 = x.redSqr().redMul(x).redIAdd(x.redMul(this.a)).redIAdd(this.b);\n  var y = y2.redSqrt();\n  if (y.redSqr().redSub(y2).cmp(this.zero) !== 0)\n    throw new Error('invalid point');\n\n  // XXX Is there any way to tell if the number is odd without converting it\n  // to non-red form?\n  var isOdd = y.fromRed().isOdd();\n  if (odd && !isOdd || !odd && isOdd)\n    y = y.redNeg();\n\n  return this.point(x, y);\n};\n\nShortCurve.prototype.validate = function validate(point) {\n  if (point.inf)\n    return true;\n\n  var x = point.x;\n  var y = point.y;\n\n  var ax = this.a.redMul(x);\n  var rhs = x.redSqr().redMul(x).redIAdd(ax).redIAdd(this.b);\n  return y.redSqr().redISub(rhs).cmpn(0) === 0;\n};\n\nShortCurve.prototype._endoWnafMulAdd =\n    function _endoWnafMulAdd(points, coeffs, jacobianResult) {\n  var npoints = this._endoWnafT1;\n  var ncoeffs = this._endoWnafT2;\n  for (var i = 0; i < points.length; i++) {\n    var split = this._endoSplit(coeffs[i]);\n    var p = points[i];\n    var beta = p._getBeta();\n\n    if (split.k1.negative) {\n      split.k1.ineg();\n      p = p.neg(true);\n    }\n    if (split.k2.negative) {\n      split.k2.ineg();\n      beta = beta.neg(true);\n    }\n\n    npoints[i * 2] = p;\n    npoints[i * 2 + 1] = beta;\n    ncoeffs[i * 2] = split.k1;\n    ncoeffs[i * 2 + 1] = split.k2;\n  }\n  var res = this._wnafMulAdd(1, npoints, ncoeffs, i * 2, jacobianResult);\n\n  // Clean-up references to points and coefficients\n  for (var j = 0; j < i * 2; j++) {\n    npoints[j] = null;\n    ncoeffs[j] = null;\n  }\n  return res;\n};\n\nfunction Point(curve, x, y, isRed) {\n  Base.BasePoint.call(this, curve, 'affine');\n  if (x === null && y === null) {\n    this.x = null;\n    this.y = null;\n    this.inf = true;\n  } else {\n    this.x = new BN(x, 16);\n    this.y = new BN(y, 16);\n    // Force redgomery representation when loading from JSON\n    if (isRed) {\n      this.x.forceRed(this.curve.red);\n      this.y.forceRed(this.curve.red);\n    }\n    if (!this.x.red)\n      this.x = this.x.toRed(this.curve.red);\n    if (!this.y.red)\n      this.y = this.y.toRed(this.curve.red);\n    this.inf = false;\n  }\n}\ninherits(Point, Base.BasePoint);\n\nShortCurve.prototype.point = function point(x, y, isRed) {\n  return new Point(this, x, y, isRed);\n};\n\nShortCurve.prototype.pointFromJSON = function pointFromJSON(obj, red) {\n  return Point.fromJSON(this, obj, red);\n};\n\nPoint.prototype._getBeta = function _getBeta() {\n  if (!this.curve.endo)\n    return;\n\n  var pre = this.precomputed;\n  if (pre && pre.beta)\n    return pre.beta;\n\n  var beta = this.curve.point(this.x.redMul(this.curve.endo.beta), this.y);\n  if (pre) {\n    var curve = this.curve;\n    var endoMul = function(p) {\n      return curve.point(p.x.redMul(curve.endo.beta), p.y);\n    };\n    pre.beta = beta;\n    beta.precomputed = {\n      beta: null,\n      naf: pre.naf && {\n        wnd: pre.naf.wnd,\n        points: pre.naf.points.map(endoMul)\n      },\n      doubles: pre.doubles && {\n        step: pre.doubles.step,\n        points: pre.doubles.points.map(endoMul)\n      }\n    };\n  }\n  return beta;\n};\n\nPoint.prototype.toJSON = function toJSON() {\n  if (!this.precomputed)\n    return [ this.x, this.y ];\n\n  return [ this.x, this.y, this.precomputed && {\n    doubles: this.precomputed.doubles && {\n      step: this.precomputed.doubles.step,\n      points: this.precomputed.doubles.points.slice(1)\n    },\n    naf: this.precomputed.naf && {\n      wnd: this.precomputed.naf.wnd,\n      points: this.precomputed.naf.points.slice(1)\n    }\n  } ];\n};\n\nPoint.fromJSON = function fromJSON(curve, obj, red) {\n  if (typeof obj === 'string')\n    obj = JSON.parse(obj);\n  var res = curve.point(obj[0], obj[1], red);\n  if (!obj[2])\n    return res;\n\n  function obj2point(obj) {\n    return curve.point(obj[0], obj[1], red);\n  }\n\n  var pre = obj[2];\n  res.precomputed = {\n    beta: null,\n    doubles: pre.doubles && {\n      step: pre.doubles.step,\n      points: [ res ].concat(pre.doubles.points.map(obj2point))\n    },\n    naf: pre.naf && {\n      wnd: pre.naf.wnd,\n      points: [ res ].concat(pre.naf.points.map(obj2point))\n    }\n  };\n  return res;\n};\n\nPoint.prototype.inspect = function inspect() {\n  if (this.isInfinity())\n    return '<EC Point Infinity>';\n  return '<EC Point x: ' + this.x.fromRed().toString(16, 2) +\n      ' y: ' + this.y.fromRed().toString(16, 2) + '>';\n};\n\nPoint.prototype.isInfinity = function isInfinity() {\n  return this.inf;\n};\n\nPoint.prototype.add = function add(p) {\n  // O + P = P\n  if (this.inf)\n    return p;\n\n  // P + O = P\n  if (p.inf)\n    return this;\n\n  // P + P = 2P\n  if (this.eq(p))\n    return this.dbl();\n\n  // P + (-P) = O\n  if (this.neg().eq(p))\n    return this.curve.point(null, null);\n\n  // P + Q = O\n  if (this.x.cmp(p.x) === 0)\n    return this.curve.point(null, null);\n\n  var c = this.y.redSub(p.y);\n  if (c.cmpn(0) !== 0)\n    c = c.redMul(this.x.redSub(p.x).redInvm());\n  var nx = c.redSqr().redISub(this.x).redISub(p.x);\n  var ny = c.redMul(this.x.redSub(nx)).redISub(this.y);\n  return this.curve.point(nx, ny);\n};\n\nPoint.prototype.dbl = function dbl() {\n  if (this.inf)\n    return this;\n\n  // 2P = O\n  var ys1 = this.y.redAdd(this.y);\n  if (ys1.cmpn(0) === 0)\n    return this.curve.point(null, null);\n\n  var a = this.curve.a;\n\n  var x2 = this.x.redSqr();\n  var dyinv = ys1.redInvm();\n  var c = x2.redAdd(x2).redIAdd(x2).redIAdd(a).redMul(dyinv);\n\n  var nx = c.redSqr().redISub(this.x.redAdd(this.x));\n  var ny = c.redMul(this.x.redSub(nx)).redISub(this.y);\n  return this.curve.point(nx, ny);\n};\n\nPoint.prototype.getX = function getX() {\n  return this.x.fromRed();\n};\n\nPoint.prototype.getY = function getY() {\n  return this.y.fromRed();\n};\n\nPoint.prototype.mul = function mul(k) {\n  k = new BN(k, 16);\n  if (this.isInfinity())\n    return this;\n  else if (this._hasDoubles(k))\n    return this.curve._fixedNafMul(this, k);\n  else if (this.curve.endo)\n    return this.curve._endoWnafMulAdd([ this ], [ k ]);\n  else\n    return this.curve._wnafMul(this, k);\n};\n\nPoint.prototype.mulAdd = function mulAdd(k1, p2, k2) {\n  var points = [ this, p2 ];\n  var coeffs = [ k1, k2 ];\n  if (this.curve.endo)\n    return this.curve._endoWnafMulAdd(points, coeffs);\n  else\n    return this.curve._wnafMulAdd(1, points, coeffs, 2);\n};\n\nPoint.prototype.jmulAdd = function jmulAdd(k1, p2, k2) {\n  var points = [ this, p2 ];\n  var coeffs = [ k1, k2 ];\n  if (this.curve.endo)\n    return this.curve._endoWnafMulAdd(points, coeffs, true);\n  else\n    return this.curve._wnafMulAdd(1, points, coeffs, 2, true);\n};\n\nPoint.prototype.eq = function eq(p) {\n  return this === p ||\n         this.inf === p.inf &&\n             (this.inf || this.x.cmp(p.x) === 0 && this.y.cmp(p.y) === 0);\n};\n\nPoint.prototype.neg = function neg(_precompute) {\n  if (this.inf)\n    return this;\n\n  var res = this.curve.point(this.x, this.y.redNeg());\n  if (_precompute && this.precomputed) {\n    var pre = this.precomputed;\n    var negate = function(p) {\n      return p.neg();\n    };\n    res.precomputed = {\n      naf: pre.naf && {\n        wnd: pre.naf.wnd,\n        points: pre.naf.points.map(negate)\n      },\n      doubles: pre.doubles && {\n        step: pre.doubles.step,\n        points: pre.doubles.points.map(negate)\n      }\n    };\n  }\n  return res;\n};\n\nPoint.prototype.toJ = function toJ() {\n  if (this.inf)\n    return this.curve.jpoint(null, null, null);\n\n  var res = this.curve.jpoint(this.x, this.y, this.curve.one);\n  return res;\n};\n\nfunction JPoint(curve, x, y, z) {\n  Base.BasePoint.call(this, curve, 'jacobian');\n  if (x === null && y === null && z === null) {\n    this.x = this.curve.one;\n    this.y = this.curve.one;\n    this.z = new BN(0);\n  } else {\n    this.x = new BN(x, 16);\n    this.y = new BN(y, 16);\n    this.z = new BN(z, 16);\n  }\n  if (!this.x.red)\n    this.x = this.x.toRed(this.curve.red);\n  if (!this.y.red)\n    this.y = this.y.toRed(this.curve.red);\n  if (!this.z.red)\n    this.z = this.z.toRed(this.curve.red);\n\n  this.zOne = this.z === this.curve.one;\n}\ninherits(JPoint, Base.BasePoint);\n\nShortCurve.prototype.jpoint = function jpoint(x, y, z) {\n  return new JPoint(this, x, y, z);\n};\n\nJPoint.prototype.toP = function toP() {\n  if (this.isInfinity())\n    return this.curve.point(null, null);\n\n  var zinv = this.z.redInvm();\n  var zinv2 = zinv.redSqr();\n  var ax = this.x.redMul(zinv2);\n  var ay = this.y.redMul(zinv2).redMul(zinv);\n\n  return this.curve.point(ax, ay);\n};\n\nJPoint.prototype.neg = function neg() {\n  return this.curve.jpoint(this.x, this.y.redNeg(), this.z);\n};\n\nJPoint.prototype.add = function add(p) {\n  // O + P = P\n  if (this.isInfinity())\n    return p;\n\n  // P + O = P\n  if (p.isInfinity())\n    return this;\n\n  // 12M + 4S + 7A\n  var pz2 = p.z.redSqr();\n  var z2 = this.z.redSqr();\n  var u1 = this.x.redMul(pz2);\n  var u2 = p.x.redMul(z2);\n  var s1 = this.y.redMul(pz2.redMul(p.z));\n  var s2 = p.y.redMul(z2.redMul(this.z));\n\n  var h = u1.redSub(u2);\n  var r = s1.redSub(s2);\n  if (h.cmpn(0) === 0) {\n    if (r.cmpn(0) !== 0)\n      return this.curve.jpoint(null, null, null);\n    else\n      return this.dbl();\n  }\n\n  var h2 = h.redSqr();\n  var h3 = h2.redMul(h);\n  var v = u1.redMul(h2);\n\n  var nx = r.redSqr().redIAdd(h3).redISub(v).redISub(v);\n  var ny = r.redMul(v.redISub(nx)).redISub(s1.redMul(h3));\n  var nz = this.z.redMul(p.z).redMul(h);\n\n  return this.curve.jpoint(nx, ny, nz);\n};\n\nJPoint.prototype.mixedAdd = function mixedAdd(p) {\n  // O + P = P\n  if (this.isInfinity())\n    return p.toJ();\n\n  // P + O = P\n  if (p.isInfinity())\n    return this;\n\n  // 8M + 3S + 7A\n  var z2 = this.z.redSqr();\n  var u1 = this.x;\n  var u2 = p.x.redMul(z2);\n  var s1 = this.y;\n  var s2 = p.y.redMul(z2).redMul(this.z);\n\n  var h = u1.redSub(u2);\n  var r = s1.redSub(s2);\n  if (h.cmpn(0) === 0) {\n    if (r.cmpn(0) !== 0)\n      return this.curve.jpoint(null, null, null);\n    else\n      return this.dbl();\n  }\n\n  var h2 = h.redSqr();\n  var h3 = h2.redMul(h);\n  var v = u1.redMul(h2);\n\n  var nx = r.redSqr().redIAdd(h3).redISub(v).redISub(v);\n  var ny = r.redMul(v.redISub(nx)).redISub(s1.redMul(h3));\n  var nz = this.z.redMul(h);\n\n  return this.curve.jpoint(nx, ny, nz);\n};\n\nJPoint.prototype.dblp = function dblp(pow) {\n  if (pow === 0)\n    return this;\n  if (this.isInfinity())\n    return this;\n  if (!pow)\n    return this.dbl();\n\n  if (this.curve.zeroA || this.curve.threeA) {\n    var r = this;\n    for (var i = 0; i < pow; i++)\n      r = r.dbl();\n    return r;\n  }\n\n  // 1M + 2S + 1A + N * (4S + 5M + 8A)\n  // N = 1 => 6M + 6S + 9A\n  var a = this.curve.a;\n  var tinv = this.curve.tinv;\n\n  var jx = this.x;\n  var jy = this.y;\n  var jz = this.z;\n  var jz4 = jz.redSqr().redSqr();\n\n  // Reuse results\n  var jyd = jy.redAdd(jy);\n  for (var i = 0; i < pow; i++) {\n    var jx2 = jx.redSqr();\n    var jyd2 = jyd.redSqr();\n    var jyd4 = jyd2.redSqr();\n    var c = jx2.redAdd(jx2).redIAdd(jx2).redIAdd(a.redMul(jz4));\n\n    var t1 = jx.redMul(jyd2);\n    var nx = c.redSqr().redISub(t1.redAdd(t1));\n    var t2 = t1.redISub(nx);\n    var dny = c.redMul(t2);\n    dny = dny.redIAdd(dny).redISub(jyd4);\n    var nz = jyd.redMul(jz);\n    if (i + 1 < pow)\n      jz4 = jz4.redMul(jyd4);\n\n    jx = nx;\n    jz = nz;\n    jyd = dny;\n  }\n\n  return this.curve.jpoint(jx, jyd.redMul(tinv), jz);\n};\n\nJPoint.prototype.dbl = function dbl() {\n  if (this.isInfinity())\n    return this;\n\n  if (this.curve.zeroA)\n    return this._zeroDbl();\n  else if (this.curve.threeA)\n    return this._threeDbl();\n  else\n    return this._dbl();\n};\n\nJPoint.prototype._zeroDbl = function _zeroDbl() {\n  var nx;\n  var ny;\n  var nz;\n  // Z = 1\n  if (this.zOne) {\n    // hyperelliptic.org/EFD/g1p/auto-shortw-jacobian-0.html\n    //     #doubling-mdbl-2007-bl\n    // 1M + 5S + 14A\n\n    // XX = X1^2\n    var xx = this.x.redSqr();\n    // YY = Y1^2\n    var yy = this.y.redSqr();\n    // YYYY = YY^2\n    var yyyy = yy.redSqr();\n    // S = 2 * ((X1 + YY)^2 - XX - YYYY)\n    var s = this.x.redAdd(yy).redSqr().redISub(xx).redISub(yyyy);\n    s = s.redIAdd(s);\n    // M = 3 * XX + a; a = 0\n    var m = xx.redAdd(xx).redIAdd(xx);\n    // T = M ^ 2 - 2*S\n    var t = m.redSqr().redISub(s).redISub(s);\n\n    // 8 * YYYY\n    var yyyy8 = yyyy.redIAdd(yyyy);\n    yyyy8 = yyyy8.redIAdd(yyyy8);\n    yyyy8 = yyyy8.redIAdd(yyyy8);\n\n    // X3 = T\n    nx = t;\n    // Y3 = M * (S - T) - 8 * YYYY\n    ny = m.redMul(s.redISub(t)).redISub(yyyy8);\n    // Z3 = 2*Y1\n    nz = this.y.redAdd(this.y);\n  } else {\n    // hyperelliptic.org/EFD/g1p/auto-shortw-jacobian-0.html\n    //     #doubling-dbl-2009-l\n    // 2M + 5S + 13A\n\n    // A = X1^2\n    var a = this.x.redSqr();\n    // B = Y1^2\n    var b = this.y.redSqr();\n    // C = B^2\n    var c = b.redSqr();\n    // D = 2 * ((X1 + B)^2 - A - C)\n    var d = this.x.redAdd(b).redSqr().redISub(a).redISub(c);\n    d = d.redIAdd(d);\n    // E = 3 * A\n    var e = a.redAdd(a).redIAdd(a);\n    // F = E^2\n    var f = e.redSqr();\n\n    // 8 * C\n    var c8 = c.redIAdd(c);\n    c8 = c8.redIAdd(c8);\n    c8 = c8.redIAdd(c8);\n\n    // X3 = F - 2 * D\n    nx = f.redISub(d).redISub(d);\n    // Y3 = E * (D - X3) - 8 * C\n    ny = e.redMul(d.redISub(nx)).redISub(c8);\n    // Z3 = 2 * Y1 * Z1\n    nz = this.y.redMul(this.z);\n    nz = nz.redIAdd(nz);\n  }\n\n  return this.curve.jpoint(nx, ny, nz);\n};\n\nJPoint.prototype._threeDbl = function _threeDbl() {\n  var nx;\n  var ny;\n  var nz;\n  // Z = 1\n  if (this.zOne) {\n    // hyperelliptic.org/EFD/g1p/auto-shortw-jacobian-3.html\n    //     #doubling-mdbl-2007-bl\n    // 1M + 5S + 15A\n\n    // XX = X1^2\n    var xx = this.x.redSqr();\n    // YY = Y1^2\n    var yy = this.y.redSqr();\n    // YYYY = YY^2\n    var yyyy = yy.redSqr();\n    // S = 2 * ((X1 + YY)^2 - XX - YYYY)\n    var s = this.x.redAdd(yy).redSqr().redISub(xx).redISub(yyyy);\n    s = s.redIAdd(s);\n    // M = 3 * XX + a\n    var m = xx.redAdd(xx).redIAdd(xx).redIAdd(this.curve.a);\n    // T = M^2 - 2 * S\n    var t = m.redSqr().redISub(s).redISub(s);\n    // X3 = T\n    nx = t;\n    // Y3 = M * (S - T) - 8 * YYYY\n    var yyyy8 = yyyy.redIAdd(yyyy);\n    yyyy8 = yyyy8.redIAdd(yyyy8);\n    yyyy8 = yyyy8.redIAdd(yyyy8);\n    ny = m.redMul(s.redISub(t)).redISub(yyyy8);\n    // Z3 = 2 * Y1\n    nz = this.y.redAdd(this.y);\n  } else {\n    // hyperelliptic.org/EFD/g1p/auto-shortw-jacobian-3.html#doubling-dbl-2001-b\n    // 3M + 5S\n\n    // delta = Z1^2\n    var delta = this.z.redSqr();\n    // gamma = Y1^2\n    var gamma = this.y.redSqr();\n    // beta = X1 * gamma\n    var beta = this.x.redMul(gamma);\n    // alpha = 3 * (X1 - delta) * (X1 + delta)\n    var alpha = this.x.redSub(delta).redMul(this.x.redAdd(delta));\n    alpha = alpha.redAdd(alpha).redIAdd(alpha);\n    // X3 = alpha^2 - 8 * beta\n    var beta4 = beta.redIAdd(beta);\n    beta4 = beta4.redIAdd(beta4);\n    var beta8 = beta4.redAdd(beta4);\n    nx = alpha.redSqr().redISub(beta8);\n    // Z3 = (Y1 + Z1)^2 - gamma - delta\n    nz = this.y.redAdd(this.z).redSqr().redISub(gamma).redISub(delta);\n    // Y3 = alpha * (4 * beta - X3) - 8 * gamma^2\n    var ggamma8 = gamma.redSqr();\n    ggamma8 = ggamma8.redIAdd(ggamma8);\n    ggamma8 = ggamma8.redIAdd(ggamma8);\n    ggamma8 = ggamma8.redIAdd(ggamma8);\n    ny = alpha.redMul(beta4.redISub(nx)).redISub(ggamma8);\n  }\n\n  return this.curve.jpoint(nx, ny, nz);\n};\n\nJPoint.prototype._dbl = function _dbl() {\n  var a = this.curve.a;\n\n  // 4M + 6S + 10A\n  var jx = this.x;\n  var jy = this.y;\n  var jz = this.z;\n  var jz4 = jz.redSqr().redSqr();\n\n  var jx2 = jx.redSqr();\n  var jy2 = jy.redSqr();\n\n  var c = jx2.redAdd(jx2).redIAdd(jx2).redIAdd(a.redMul(jz4));\n\n  var jxd4 = jx.redAdd(jx);\n  jxd4 = jxd4.redIAdd(jxd4);\n  var t1 = jxd4.redMul(jy2);\n  var nx = c.redSqr().redISub(t1.redAdd(t1));\n  var t2 = t1.redISub(nx);\n\n  var jyd8 = jy2.redSqr();\n  jyd8 = jyd8.redIAdd(jyd8);\n  jyd8 = jyd8.redIAdd(jyd8);\n  jyd8 = jyd8.redIAdd(jyd8);\n  var ny = c.redMul(t2).redISub(jyd8);\n  var nz = jy.redAdd(jy).redMul(jz);\n\n  return this.curve.jpoint(nx, ny, nz);\n};\n\nJPoint.prototype.trpl = function trpl() {\n  if (!this.curve.zeroA)\n    return this.dbl().add(this);\n\n  // hyperelliptic.org/EFD/g1p/auto-shortw-jacobian-0.html#tripling-tpl-2007-bl\n  // 5M + 10S + ...\n\n  // XX = X1^2\n  var xx = this.x.redSqr();\n  // YY = Y1^2\n  var yy = this.y.redSqr();\n  // ZZ = Z1^2\n  var zz = this.z.redSqr();\n  // YYYY = YY^2\n  var yyyy = yy.redSqr();\n  // M = 3 * XX + a * ZZ2; a = 0\n  var m = xx.redAdd(xx).redIAdd(xx);\n  // MM = M^2\n  var mm = m.redSqr();\n  // E = 6 * ((X1 + YY)^2 - XX - YYYY) - MM\n  var e = this.x.redAdd(yy).redSqr().redISub(xx).redISub(yyyy);\n  e = e.redIAdd(e);\n  e = e.redAdd(e).redIAdd(e);\n  e = e.redISub(mm);\n  // EE = E^2\n  var ee = e.redSqr();\n  // T = 16*YYYY\n  var t = yyyy.redIAdd(yyyy);\n  t = t.redIAdd(t);\n  t = t.redIAdd(t);\n  t = t.redIAdd(t);\n  // U = (M + E)^2 - MM - EE - T\n  var u = m.redIAdd(e).redSqr().redISub(mm).redISub(ee).redISub(t);\n  // X3 = 4 * (X1 * EE - 4 * YY * U)\n  var yyu4 = yy.redMul(u);\n  yyu4 = yyu4.redIAdd(yyu4);\n  yyu4 = yyu4.redIAdd(yyu4);\n  var nx = this.x.redMul(ee).redISub(yyu4);\n  nx = nx.redIAdd(nx);\n  nx = nx.redIAdd(nx);\n  // Y3 = 8 * Y1 * (U * (T - U) - E * EE)\n  var ny = this.y.redMul(u.redMul(t.redISub(u)).redISub(e.redMul(ee)));\n  ny = ny.redIAdd(ny);\n  ny = ny.redIAdd(ny);\n  ny = ny.redIAdd(ny);\n  // Z3 = (Z1 + E)^2 - ZZ - EE\n  var nz = this.z.redAdd(e).redSqr().redISub(zz).redISub(ee);\n\n  return this.curve.jpoint(nx, ny, nz);\n};\n\nJPoint.prototype.mul = function mul(k, kbase) {\n  k = new BN(k, kbase);\n\n  return this.curve._wnafMul(this, k);\n};\n\nJPoint.prototype.eq = function eq(p) {\n  if (p.type === 'affine')\n    return this.eq(p.toJ());\n\n  if (this === p)\n    return true;\n\n  // x1 * z2^2 == x2 * z1^2\n  var z2 = this.z.redSqr();\n  var pz2 = p.z.redSqr();\n  if (this.x.redMul(pz2).redISub(p.x.redMul(z2)).cmpn(0) !== 0)\n    return false;\n\n  // y1 * z2^3 == y2 * z1^3\n  var z3 = z2.redMul(this.z);\n  var pz3 = pz2.redMul(p.z);\n  return this.y.redMul(pz3).redISub(p.y.redMul(z3)).cmpn(0) === 0;\n};\n\nJPoint.prototype.eqXToP = function eqXToP(x) {\n  var zs = this.z.redSqr();\n  var rx = x.toRed(this.curve.red).redMul(zs);\n  if (this.x.cmp(rx) === 0)\n    return true;\n\n  var xc = x.clone();\n  var t = this.curve.redN.redMul(zs);\n  for (;;) {\n    xc.iadd(this.curve.n);\n    if (xc.cmp(this.curve.p) >= 0)\n      return false;\n\n    rx.redIAdd(t);\n    if (this.x.cmp(rx) === 0)\n      return true;\n  }\n};\n\nJPoint.prototype.inspect = function inspect() {\n  if (this.isInfinity())\n    return '<EC JPoint Infinity>';\n  return '<EC JPoint x: ' + this.x.toString(16, 2) +\n      ' y: ' + this.y.toString(16, 2) +\n      ' z: ' + this.z.toString(16, 2) + '>';\n};\n\nJPoint.prototype.isInfinity = function isInfinity() {\n  // XXX This code assumes that zero is always zero in red\n  return this.z.cmpn(0) === 0;\n};\n","'use strict';\n\nvar BN = require('bn.js');\nvar inherits = require('inherits');\nvar Base = require('./base');\n\nvar utils = require('../utils');\n\nfunction MontCurve(conf) {\n  Base.call(this, 'mont', conf);\n\n  this.a = new BN(conf.a, 16).toRed(this.red);\n  this.b = new BN(conf.b, 16).toRed(this.red);\n  this.i4 = new BN(4).toRed(this.red).redInvm();\n  this.two = new BN(2).toRed(this.red);\n  // Note: this implementation is according to the original paper\n  // by P. Montgomery, NOT the one by D. J. Bernstein.\n  this.a24 = this.i4.redMul(this.a.redAdd(this.two));\n}\ninherits(MontCurve, Base);\nmodule.exports = MontCurve;\n\nMontCurve.prototype.validate = function validate(point) {\n  var x = point.normalize().x;\n  var x2 = x.redSqr();\n  var rhs = x2.redMul(x).redAdd(x2.redMul(this.a)).redAdd(x);\n  var y = rhs.redSqrt();\n\n  return y.redSqr().cmp(rhs) === 0;\n};\n\nfunction Point(curve, x, z) {\n  Base.BasePoint.call(this, curve, 'projective');\n  if (x === null && z === null) {\n    this.x = this.curve.one;\n    this.z = this.curve.zero;\n  } else {\n    this.x = new BN(x, 16);\n    this.z = new BN(z, 16);\n    if (!this.x.red)\n      this.x = this.x.toRed(this.curve.red);\n    if (!this.z.red)\n      this.z = this.z.toRed(this.curve.red);\n  }\n}\ninherits(Point, Base.BasePoint);\n\nMontCurve.prototype.decodePoint = function decodePoint(bytes, enc) {\n  var bytes = utils.toArray(bytes, enc);\n\n  // TODO Curve448\n  // Montgomery curve points must be represented in the compressed format\n  // https://tools.ietf.org/html/draft-ietf-openpgp-rfc4880bis-02#appendix-B\n  if (bytes.length === 33 && bytes[0] === 0x40)\n    bytes = bytes.slice(1, 33).reverse(); // point must be little-endian\n  if (bytes.length !== 32)\n    throw new Error('Unknown point compression format');\n  return this.point(bytes, 1);\n};\n\nMontCurve.prototype.point = function point(x, z) {\n  return new Point(this, x, z);\n};\n\nMontCurve.prototype.pointFromJSON = function pointFromJSON(obj) {\n  return Point.fromJSON(this, obj);\n};\n\nPoint.prototype.precompute = function precompute() {\n  // No-op\n};\n\nPoint.prototype._encode = function _encode(compact) {\n  var len = this.curve.p.byteLength();\n\n  // Note: the output should always be little-endian\n  // https://tools.ietf.org/html/draft-ietf-openpgp-rfc4880bis-02#appendix-B\n  if (compact) {\n    return [ 0x40 ].concat(this.getX().toArray('le', len));\n  } else {\n    return this.getX().toArray('be', len);\n  }\n};\n\nPoint.fromJSON = function fromJSON(curve, obj) {\n  return new Point(curve, obj[0], obj[1] || curve.one);\n};\n\nPoint.prototype.inspect = function inspect() {\n  if (this.isInfinity())\n    return '<EC Point Infinity>';\n  return '<EC Point x: ' + this.x.fromRed().toString(16, 2) +\n      ' z: ' + this.z.fromRed().toString(16, 2) + '>';\n};\n\nPoint.prototype.isInfinity = function isInfinity() {\n  // XXX This code assumes that zero is always zero in red\n  return this.z.cmpn(0) === 0;\n};\n\nPoint.prototype.dbl = function dbl() {\n  // http://hyperelliptic.org/EFD/g1p/auto-montgom-xz.html#doubling-dbl-1987-m-3\n  // 2M + 2S + 4A\n\n  // A = X1 + Z1\n  var a = this.x.redAdd(this.z);\n  // AA = A^2\n  var aa = a.redSqr();\n  // B = X1 - Z1\n  var b = this.x.redSub(this.z);\n  // BB = B^2\n  var bb = b.redSqr();\n  // C = AA - BB\n  var c = aa.redSub(bb);\n  // X3 = AA * BB\n  var nx = aa.redMul(bb);\n  // Z3 = C * (BB + A24 * C)\n  var nz = c.redMul(bb.redAdd(this.curve.a24.redMul(c)));\n  return this.curve.point(nx, nz);\n};\n\nPoint.prototype.add = function add() {\n  throw new Error('Not supported on Montgomery curve');\n};\n\nPoint.prototype.diffAdd = function diffAdd(p, diff) {\n  // http://hyperelliptic.org/EFD/g1p/auto-montgom-xz.html#diffadd-dadd-1987-m-3\n  // 4M + 2S + 6A\n\n  // A = X2 + Z2\n  var a = this.x.redAdd(this.z);\n  // B = X2 - Z2\n  var b = this.x.redSub(this.z);\n  // C = X3 + Z3\n  var c = p.x.redAdd(p.z);\n  // D = X3 - Z3\n  var d = p.x.redSub(p.z);\n  // DA = D * A\n  var da = d.redMul(a);\n  // CB = C * B\n  var cb = c.redMul(b);\n  // X5 = Z1 * (DA + CB)^2\n  var nx = diff.z.redMul(da.redAdd(cb).redSqr());\n  // Z5 = X1 * (DA - CB)^2\n  var nz = diff.x.redMul(da.redISub(cb).redSqr());\n  return this.curve.point(nx, nz);\n};\n\nPoint.prototype.mul = function mul(k) {\n  k = new BN(k, 16);\n\n  var t = k.clone();\n  var a = this; // (N / 2) * Q + Q\n  var b = this.curve.point(null, null); // (N / 2) * Q\n  var c = this; // Q\n\n  for (var bits = []; t.cmpn(0) !== 0; t.iushrn(1))\n    bits.push(t.andln(1));\n\n  for (var i = bits.length - 1; i >= 0; i--) {\n    if (bits[i] === 0) {\n      // N * Q + Q = ((N / 2) * Q + Q)) + (N / 2) * Q\n      a = a.diffAdd(b, c);\n      // N * Q = 2 * ((N / 2) * Q + Q))\n      b = b.dbl();\n    } else {\n      // N * Q = ((N / 2) * Q + Q) + ((N / 2) * Q)\n      b = a.diffAdd(b, c);\n      // N * Q + Q = 2 * ((N / 2) * Q + Q)\n      a = a.dbl();\n    }\n  }\n  return b;\n};\n\nPoint.prototype.mulAdd = function mulAdd() {\n  throw new Error('Not supported on Montgomery curve');\n};\n\nPoint.prototype.jumlAdd = function jumlAdd() {\n  throw new Error('Not supported on Montgomery curve');\n};\n\nPoint.prototype.eq = function eq(other) {\n  return this.getX().cmp(other.getX()) === 0;\n};\n\nPoint.prototype.normalize = function normalize() {\n  this.x = this.x.redMul(this.z.redInvm());\n  this.z = this.curve.one;\n  return this;\n};\n\nPoint.prototype.getX = function getX() {\n  // Normalize coordinates\n  this.normalize();\n\n  return this.x.fromRed();\n};\n","'use strict';\n\nvar utils = require('../utils');\nvar BN = require('bn.js');\nvar inherits = require('inherits');\nvar Base = require('./base');\n\nvar assert = utils.assert;\n\nfunction EdwardsCurve(conf) {\n  // NOTE: Important as we are creating point in Base.call()\n  this.twisted = (conf.a | 0) !== 1;\n  this.mOneA = this.twisted && (conf.a | 0) === -1;\n  this.extended = this.mOneA;\n\n  Base.call(this, 'edwards', conf);\n\n  this.a = new BN(conf.a, 16).umod(this.red.m);\n  this.a = this.a.toRed(this.red);\n  this.c = new BN(conf.c, 16).toRed(this.red);\n  this.c2 = this.c.redSqr();\n  this.d = new BN(conf.d, 16).toRed(this.red);\n  this.dd = this.d.redAdd(this.d);\n\n  assert(!this.twisted || this.c.fromRed().cmpn(1) === 0);\n  this.oneC = (conf.c | 0) === 1;\n}\ninherits(EdwardsCurve, Base);\nmodule.exports = EdwardsCurve;\n\nEdwardsCurve.prototype._mulA = function _mulA(num) {\n  if (this.mOneA)\n    return num.redNeg();\n  else\n    return this.a.redMul(num);\n};\n\nEdwardsCurve.prototype._mulC = function _mulC(num) {\n  if (this.oneC)\n    return num;\n  else\n    return this.c.redMul(num);\n};\n\n// Just for compatibility with Short curve\nEdwardsCurve.prototype.jpoint = function jpoint(x, y, z, t) {\n  return this.point(x, y, z, t);\n};\n\nEdwardsCurve.prototype.pointFromX = function pointFromX(x, odd) {\n  x = new BN(x, 16);\n  if (!x.red)\n    x = x.toRed(this.red);\n\n  var x2 = x.redSqr();\n  var rhs = this.c2.redSub(this.a.redMul(x2));\n  var lhs = this.one.redSub(this.c2.redMul(this.d).redMul(x2));\n\n  var y2 = rhs.redMul(lhs.redInvm());\n  var y = y2.redSqrt();\n  if (y.redSqr().redSub(y2).cmp(this.zero) !== 0)\n    throw new Error('invalid point');\n\n  var isOdd = y.fromRed().isOdd();\n  if (odd && !isOdd || !odd && isOdd)\n    y = y.redNeg();\n\n  return this.point(x, y);\n};\n\nEdwardsCurve.prototype.pointFromY = function pointFromY(y, odd) {\n  y = new BN(y, 16);\n  if (!y.red)\n    y = y.toRed(this.red);\n\n  // x^2 = (y^2 - c^2) / (c^2 d y^2 - a)\n  var y2 = y.redSqr();\n  var lhs = y2.redSub(this.c2);\n  var rhs = y2.redMul(this.d).redMul(this.c2).redSub(this.a);\n  var x2 = lhs.redMul(rhs.redInvm());\n\n  if (x2.cmp(this.zero) === 0) {\n    if (odd)\n      throw new Error('invalid point');\n    else\n      return this.point(this.zero, y);\n  }\n\n  var x = x2.redSqrt();\n  if (x.redSqr().redSub(x2).cmp(this.zero) !== 0)\n    throw new Error('invalid point');\n\n  if (x.fromRed().isOdd() !== odd)\n    x = x.redNeg();\n\n  return this.point(x, y);\n};\n\nEdwardsCurve.prototype.validate = function validate(point) {\n  if (point.isInfinity())\n    return true;\n\n  // Curve: A * X^2 + Y^2 = C^2 * (1 + D * X^2 * Y^2)\n  point.normalize();\n\n  var x2 = point.x.redSqr();\n  var y2 = point.y.redSqr();\n  var lhs = x2.redMul(this.a).redAdd(y2);\n  var rhs = this.c2.redMul(this.one.redAdd(this.d.redMul(x2).redMul(y2)));\n\n  return lhs.cmp(rhs) === 0;\n};\n\nfunction Point(curve, x, y, z, t) {\n  Base.BasePoint.call(this, curve, 'projective');\n  if (x === null && y === null && z === null) {\n    this.x = this.curve.zero;\n    this.y = this.curve.one;\n    this.z = this.curve.one;\n    this.t = this.curve.zero;\n    this.zOne = true;\n  } else {\n    this.x = new BN(x, 16);\n    this.y = new BN(y, 16);\n    this.z = z ? new BN(z, 16) : this.curve.one;\n    this.t = t && new BN(t, 16);\n    if (!this.x.red)\n      this.x = this.x.toRed(this.curve.red);\n    if (!this.y.red)\n      this.y = this.y.toRed(this.curve.red);\n    if (!this.z.red)\n      this.z = this.z.toRed(this.curve.red);\n    if (this.t && !this.t.red)\n      this.t = this.t.toRed(this.curve.red);\n    this.zOne = this.z === this.curve.one;\n\n    // Use extended coordinates\n    if (this.curve.extended && !this.t) {\n      this.t = this.x.redMul(this.y);\n      if (!this.zOne)\n        this.t = this.t.redMul(this.z.redInvm());\n    }\n  }\n}\ninherits(Point, Base.BasePoint);\n\nEdwardsCurve.prototype.pointFromJSON = function pointFromJSON(obj) {\n  return Point.fromJSON(this, obj);\n};\n\nEdwardsCurve.prototype.point = function point(x, y, z, t) {\n  return new Point(this, x, y, z, t);\n};\n\nPoint.fromJSON