import net.i2p.crypto.eddsa.Utils; //导入依赖的package包/类
/**
 * 根据ED25519算法生成的私钥进行加工，从而得到布比私钥
 * 1.将3字节前缀和1字节版本号0XDA379F01加到P前面，1字节压缩标志添加到P后面即 M=0XDA379F01 + P+0X00
 * 2.将M用SHA256计算两次取前4字节，即Checksum=SHA256(SHA256(M)) 的前4字节
 * 3.将Checksum的前四字节加到M后面，即S=M+Checksum
 * 4.对S进行Base58编码即得到布比私钥。privxxxxxxxxxxxxxxxxxxxxxxxx
 *
 * @param priKey
 * @return
 */
private static String generateBubiPriKey(EdDSAPrivateKey priKey){
    try {
        byte[] priKeyheadArr = Utils.hexToBytes("DA379F01");
        byte[] M = ArrayUtils.addAll(priKeyheadArr, priKey.getSeed());
        byte[] priKeyendArr = Utils.hexToBytes("00");
        M = ArrayUtils.addAll(M, priKeyendArr);
        MessageDigest md = MessageDigest.getInstance("SHA-256");
        md.update(M);
        byte[] m_256_1 = md.digest();
        md.update(m_256_1);
        byte[] m_256_2 = md.digest();
        byte[] M_check = new byte[M.length + 4];
        System.arraycopy(M, 0, M_check, 0, M.length);
        System.arraycopy(m_256_2, 0, M_check, M.length, 4);
        return Base58Utils.encode(M_check);
    } catch (NoSuchAlgorithmException e) {
        throw new RuntimeException("Error occured on generating BubiAddress!--" + e.getMessage(), e);
    }
}
 

import net.i2p.crypto.eddsa.Utils; //导入依赖的package包/类
/**
 * 根据公钥生成布比地址 1.对Q进行RIPEMD160算法得到20字节的N，即N = RIPEMD160（Q）
 * 2.在N前面加4字节前缀和1字节版本号。即M=0XE69A73FF01+N
 * 3.对M进行两次SHA256算法取前四字节，即Checksum=SHA256(SHA256(M))的前4字节
 * 4.将Checksum加到M后面，即S=M+Checksum 5.对S进行Base58编码即得到布比地址bubixxxxxxxxxxxx
 *
 * @param pubKey
 * @return 布比地址字符串
 */
private static String generateBubiAddress(EdDSAPublicKey pubKey){
    try {
        MessageDigest md = MessageDigest.getInstance("RIPEMD160");
        md.update(pubKey.getAbyte());
        byte[] N = md.digest();

        byte[] pubKeyheadArr = Utils.hexToBytes("E69A73FF01");
        byte[] M = ArrayUtils.addAll(pubKeyheadArr, N);
        md = MessageDigest.getInstance("SHA-256");
        md.update(M);
        byte[] M_256_1 = md.digest();
        md.update(M_256_1);
        byte[] M_256_2 = md.digest();
        byte[] S = new byte[M.length + 4];
        System.arraycopy(M, 0, S, 0, M.length);
        System.arraycopy(M_256_2, 0, S, M.length, 4);
        return Base58Utils.encode(S);
    } catch (NoSuchAlgorithmException e) {
        throw new RuntimeException("Error occured on generating BubiAddress!--" + e.getMessage(), e);
    }
}
 

import net.i2p.crypto.eddsa.Utils; //导入依赖的package包/类
/**
 * Look up 16^i r_i B in the precomputed table.
 * <p>
 * No secret array indices, no secret branching.
 * Constant time.
 * <p>
 * Must have previously precomputed.
 * <p>
 * Method is package private only so that tests run.
 *
 * @param pos = i/2 for i in {0, 2, 4,..., 62}
 * @param b   = r_i
 * @return the GroupElement
 */
GroupElement select(final int pos, final int b) {
    // Is r_i negative?
    final int bnegative = Utils.negative(b);
    // |r_i|
    final int babs = b - (((-bnegative) & b) << 1);

    // 16^i |r_i| B
    final GroupElement t = this.curve.getZero(Representation.PRECOMP)
            .cmov(this.precmp[pos][0], Utils.equal(babs, 1))
            .cmov(this.precmp[pos][1], Utils.equal(babs, 2))
            .cmov(this.precmp[pos][2], Utils.equal(babs, 3))
            .cmov(this.precmp[pos][3], Utils.equal(babs, 4))
            .cmov(this.precmp[pos][4], Utils.equal(babs, 5))
            .cmov(this.precmp[pos][5], Utils.equal(babs, 6))
            .cmov(this.precmp[pos][6], Utils.equal(babs, 7))
            .cmov(this.precmp[pos][7], Utils.equal(babs, 8));
    // -16^i |r_i| B
    final GroupElement tminus = precomp(curve, t.Y, t.X, t.Z.negate());
    // 16^i r_i B
    return t.cmov(tminus, bnegative);
}
 

import net.i2p.crypto.eddsa.Utils; //导入依赖的package包/类
/**
 * Look up $16^i r_i B$ in the precomputed table.
 * <p>
 * No secret array indices, no secret branching.
 * Constant time.
 * <p>
 * Must have previously precomputed.
 * <p>
 * Method is package private only so that tests run.
 *
 * @param pos $= i/2$ for $i$ in $\{0, 2, 4,..., 62\}$
 * @param b $= r_i$
 * @return the GroupElement
 */
GroupElement select(final int pos, final int b) {
    // Is r_i negative?
    final int bnegative = Utils.negative(b);
    // |r_i|
    final int babs = b - (((-bnegative) & b) << 1);

    // 16^i |r_i| B
    final GroupElement t = this.curve.getZero(Representation.PRECOMP)
            .cmov(this.precmp[pos][0], Utils.equal(babs, 1))
            .cmov(this.precmp[pos][1], Utils.equal(babs, 2))
            .cmov(this.precmp[pos][2], Utils.equal(babs, 3))
            .cmov(this.precmp[pos][3], Utils.equal(babs, 4))
            .cmov(this.precmp[pos][4], Utils.equal(babs, 5))
            .cmov(this.precmp[pos][5], Utils.equal(babs, 6))
            .cmov(this.precmp[pos][6], Utils.equal(babs, 7))
            .cmov(this.precmp[pos][7], Utils.equal(babs, 8));
    // -16^i |r_i| B
    final GroupElement tminus = precomp(curve, t.Y, t.X, t.Z.negate());
    // 16^i r_i B
    return t.cmov(tminus, bnegative);
}
 

import net.i2p.crypto.eddsa.Utils; //导入依赖的package包/类
/**
 * Look up 16^i r_i B in the precomputed table.
 * <p>
 * No secret array indices, no secret branching.
 * Constant time.
 * <p>
 * Must have previously precomputed.
 * <p>
 * Method is package private only so that tests run.
 *
 * @param pos = i/2 for i in {0, 2, 4,..., 62}
 * @param b = r_i
 * @return the GroupElement
 */
GroupElement select(final int pos, final int b) {
    // Is r_i negative?
    final int bnegative = Utils.negative(b);
    // |r_i|
    final int babs = b - (((-bnegative) & b) << 1);

    // 16^i |r_i| B
    final GroupElement t = this.curve.getZero(Representation.PRECOMP)
            .cmov(this.precmp[pos][0], Utils.equal(babs, 1))
            .cmov(this.precmp[pos][1], Utils.equal(babs, 2))
            .cmov(this.precmp[pos][2], Utils.equal(babs, 3))
            .cmov(this.precmp[pos][3], Utils.equal(babs, 4))
            .cmov(this.precmp[pos][4], Utils.equal(babs, 5))
            .cmov(this.precmp[pos][5], Utils.equal(babs, 6))
            .cmov(this.precmp[pos][6], Utils.equal(babs, 7))
            .cmov(this.precmp[pos][7], Utils.equal(babs, 8));
    // -16^i |r_i| B
    final GroupElement tminus = precomp(curve, t.Y, t.X, t.Z.negate());
    // 16^i r_i B
    return t.cmov(tminus, bnegative);
}
 

import net.i2p.crypto.eddsa.Utils; //导入依赖的package包/类
/**
 * Test method for {@link net.i2p.crypto.eddsa.math.bigint.BigIntegerScalarOps#multiplyAndAdd(byte[], byte[], byte[])}.
 */
@Test
public void testMultiplyAndAdd() {
    ScalarOps sc = new BigIntegerScalarOps(ed25519Field,
            new BigInteger("5"));
    assertThat(sc.multiplyAndAdd(new byte[] {7}, new byte[] {2}, new byte[] {5}),
            is(equalTo(Utils.hexToBytes("0400000000000000000000000000000000000000000000000000000000000000"))));

    ScalarOps sc2 = new BigIntegerScalarOps(ed25519Field,
            new BigInteger("7237005577332262213973186563042994240857116359379907606001950938285454250989"));
    // Example from test case 1
    byte[] h = Utils.hexToBytes("86eabc8e4c96193d290504e7c600df6cf8d8256131ec2c138a3e7e162e525404");
    byte[] a = Utils.hexToBytes("307c83864f2833cb427a2ef1c00a013cfdff2768d980c0a3a520f006904de94f");
    byte[] r = Utils.hexToBytes("f38907308c893deaf244787db4af53682249107418afc2edc58f75ac58a07404");
    byte[] S = Utils.hexToBytes("5fb8821590a33bacc61e39701cf9b46bd25bf5f0595bbe24655141438e7a100b");
    assertThat(sc2.multiplyAndAdd(h, a, r), is(equalTo(S)));
}
 

import net.i2p.crypto.eddsa.Utils; //导入依赖的package包/类
@Test
    public void testCreateRsaShaFullfillmentFromSecrets() {
        String privateKey  = "-----BEGIN RSA PRIVATE KEY-----\n"
            + "MIIEpAIBAAKCAQEA4e+LJNb3awnIHtd1KqJi8ETwSodNQ4CdMc6mEvmbDJeotDdB\n" + "U+Pu89ZmFoQ+DkHCkyZLcbYXPbHPDWzVWMWGV3Bvzwl/cExIPlnL/f1bPue8gNdA\n"
            + "xeDwR/PoX8DXWBV3am8/I8XcXnlxOaaILjgzakpfs2E3Yg/zZj264yhHKAGGL3Ly\n" + "+HsgK5yJrdfNWwoHb3xT41A59n7RfsgV5bQwXMYxlwaNXm5Xm6beX04+V99eTgcv\n"
            + "8s5MZutFIzlzh1J1ljnwJXv1fb1cRD+1FYzOCj02rce6AfM6C7bbsr+YnWBxEvI0\n" + "TZk+d+VjwdNh3t9X2pbvLPxoXwArY4JGpbMJuQIDAQABAoIBAAF1UVmYhZpMQt1o\n"
            + "GJqA19CjMUXZ37bK0rjqk4nV0JlhNTaMkMBg3T73qEsG6XugEwhuG9iNC1NbnXGB\n" + "vVLIW5ie4inc7tSjuWelnrpx8y/RwRa3zPQ6AnMEcQCFNx6bbNzkAO1TLpvxfriX\n"
            + "iZN6y2IpPrriqr/YSILlbRpgPS1V6hLre0wewFyyX6/REtutApRiEe2oiklYvznz\n" + "8Zf4wCvtrv6K1+r0Eeq6VgjcgGgi1xWOI8TXyCwWGAOQ9TKVOSw6/jpo6pELRWYS\n"
            + "pVwsR8U/0L4ZeyYm/w5AGwmQKrlI/uL9vauGKRg55Bj7DjzXOgcRuTuTFZSM/+w/\n" + "z1XpdPECgYEA/ZJGAD61SplbvSsfmI3KxupBnT5c0vxdVpLpc6JXpeHJmnJZvIpN\n"
            + "dssuTjJlD+LgTb03DSGmVWTpyvAS6L7Xx0OgB0YQbiQHjcLJpbrREv9XAohH1+Al\n" + "W11Cx7ukKpA9tmPM76BBKInhZqfrG0ihfbBBG5i5PNdd97WstjQOdRUCgYEA5BmC\n"
            + "wVcYdHfIvKj+AE0GNWOM1RGaeJisVF7BQOCBXxmjEUHSqjf+ddDsTODvrSnNTg6P\n" + "Lu56Q1fIhx1hY7kYLlnDZBcC192+AvM2QHw8rDJ851ZiruluujhXdZpjRnCO9Mqa\n"
            + "4d53yXC/Z7G4VSyn15DDylIahyLRueILErr/cxUCgYBVPqdpzasEuSmuHqEwl/pj\n" + "hL0qL5zlERIP2LPCvADbM1yjH24rhBMmrIeUojx3ar4dZE7tizJv4sz1/F9e/0lr\n"
            + "I8DYsSU04cfoUGOZ44QF7vFBWK9OU3w7is64dsxpwrP8bPCoXieJiVDNQgY31eL0\n" + "bhx1OpKLcZuVeu3lEvsJQQKBgQCAHqAmDtCqopl69oTtEFZ7aHYzO5cDQ+YP4cU0\n"
            + "tqWUECdayxkUCS2BaZ9As1uMbR1nSaA9ITBFYSo+Uk9gnxeo+TxZnN849tECgS+o\n" + "2t+NbTJhElGNo4pRSNI/OT+n0hNKBf8m/TlVSWIJUXaTSOjhmOuQWbuSygj5GrFT\n"
            + "jPts3QKBgQCnjsKTyZmtRPz0PeJniSsp22njYM7EuE69OtItGxq/N7SA/zxowo3z\n" + "zcAXbOIsnmoLCKGoIB9Cw7wO5OWSkB3fkaT6zUHzxpxBGtlROWtLAsflX0amCp4f\n"
            + "7CKh5blJ1yGJtNc+Q5qyUbyntoIzFGCibva+xz3UqhJt5Q4TlCy+5Q==\n"
            + "-----END RSA PRIVATE KEY-----\n";
        byte[] message = "aaa".getBytes();
        byte[] salt = new byte[32];  // Java specs warranties it is initialized to zeros.
        byte[] modulus = Utils.hexToBytes(
            "e1ef8b24d6f76b09c81ed7752aa262f044f04a874d43809d31cea612f99b0c97a8b4374153e3eef3d66616843e0e41c293264b71b6173db1cf0d6cd558c58657706fcf097f704c483e59cbfdfd5b3ee7bc80d740c5e0f047f3e85fc0d75815776a6f3f23c5dc5e797139a6882e38336a4a5fb36137620ff3663dbae328472801862f72f2f87b202b9c89add7cd5b0a076f7c53e35039f67ed17ec815e5b4305cc63197068d5e6e579ba6de5f4e3e57df5e4e072ff2ce4c66eb452339738752759639f0257bf57dbd5c443fb5158cce0a3d36adc7ba01f33a0bb6dbb2bf989d607112f2344d993e77e563c1d361dedf57da96ef2cfc685f002b638246a5b309b9");
        // Note: With PSS padding the generated signature will be different each new run, not deterministic. Next one is just a "random" one
        //     for a given random PSS padding
//        String signature = 
//            "48e8945efe007556d5bf4d5f249e4808f7307e29511d3262daef61d88098f9aa4a8bc0623a8c975738f65d6bf459d543f289d73cbc7af4ea3a33fbf3ec4440447911d72294091e561833628e49a772ed608de6c44595a91e3e17d6cf5ec3b2528d63d2add6463989b12eec577df6470960df6832a9d84c360d1c217ad64c8625bdb594fb0ada086cdecbbde580d424bf9746d2f0c312826dbbb00ad68b52c4cb7d47156ba35e3a981c973863792cc80d04a180210a52415865b64b3a61774b1d3975d78a98b0821ee55ca0f86305d42529e10eb015cefd402fb59b2abb8deee52a6f2447d2284603d219cd4e8cf9cffdd5498889c3780b59dd6a57ef7d732620";
        String FF_KO = "cf:3:ggEA4e-LJNb3awnIHtd1KqJi8ETwSodNQ4CdMc6mEvmbDJeotDdBU-Pu89ZmFoQ-DkHCkyZLcbYXPbHPDWzVWMWGV3Bvzwl_cExIPlnL_f1bPue8gNdAxeDwR_PoX8DXWBV3am8_I8XcXnlxOaaILjgzakpfs2E3Yg_zZj264yhHKAGGL3Ly-HsgK5yJrdfNWwoHb3xT41A59n7RfsgV5bQwXMYxlwaNXm5Xm6beX04-V99eTgcv8s5MZutFIzlzh1J1ljnwJXv1fb1cRD-1FYzOCj02rce6AfM6C7bbsr-YnWBxEvI0TZk-d-VjwdNh3t9X2pbvLPxoXwArY4JGpbMJuYIBAEjolF7-AHVW1b9NXySeSAj3MH4pUR0yYtrvYdiAmPmqSovAYjqMl1c49l1r9FnVQ_KJ1zy8evTqOjP78-xEQER5EdcilAkeVhgzYo5Jp3LtYI3mxEWVqR4-F9bPXsOyUo1j0q3WRjmJsS7sV332Rwlg32gyqdhMNg0cIXrWTIYlvbWU-wraCGzey73lgNQkv5dG0vDDEoJtu7AK1otSxMt9RxVro146mByXOGN5LMgNBKGAIQpSQVhltks6YXdLHTl114qYsIIe5Vyg-GMF1CUp4Q6wFc79QC-1myq7je7lKm8kR9IoRgPSGc1OjPnP_dVJiInDeAtZ3WpX731zJiA";
//        String CC_OK = "cc:3:11:uKkFs6dhGZCwD51c69vVvHYSp25cRi9IlvXfFaxhMjo:518";
        
        SecureRandom saltRandom = new SecureRandom(salt);
        // Build from secrets.
        RsaSha256Fulfillment ffFromSecrets = RsaSha256Fulfillment.BuildFromSecrets(privateKey, message, saltRandom);
        BigInteger expectedModulus = new BigInteger(1, modulus);
        assertTrue(ffFromSecrets.getModulus().compareTo(expectedModulus) == 0);
        assertTrue(ffFromSecrets.validate(new MessagePayload(message)));

        Fulfillment ffFromURI = FulfillmentFactory.getFulfillmentFromURI(FF_KO);
        ffFromURI.validate(new MessagePayload(message));


    }
 

import net.i2p.crypto.eddsa.Utils; //导入依赖的package包/类
@Override
public boolean equals(Object obj) {
    if (!(obj instanceof net.i2p.crypto.eddsa.math.ed25519.Ed25519FieldElement))
        return false;
    net.i2p.crypto.eddsa.math.ed25519.Ed25519FieldElement fe = (net.i2p.crypto.eddsa.math.ed25519.Ed25519FieldElement) obj;
    return 1 == Utils.equal(toByteArray(), fe.toByteArray());
}
 

import net.i2p.crypto.eddsa.Utils; //导入依赖的package包/类
@Override
public boolean equals(Object obj) {
    if (!(obj instanceof Ed25519FieldElement))
        return false;
    Ed25519FieldElement fe = (Ed25519FieldElement) obj;
    return 1==Utils.equal(toByteArray(), fe.toByteArray());
}
 

import net.i2p.crypto.eddsa.Utils; //导入依赖的package包/类
/**
 * Test method for {@link net.i2p.crypto.eddsa.math.bigint.BigIntegerScalarOps#reduce(byte[])}.
 */
@Test
public void testReduce() {
    // Example from test case 1
    byte[] r = Utils.hexToBytes("b6b19cd8e0426f5983fa112d89a143aa97dab8bc5deb8d5b6253c928b65272f4044098c2a990039cde5b6a4818df0bfb6e40dc5dee54248032962323e701352d");
    assertThat(scalarOps.reduce(r), is(equalTo(Utils.hexToBytes("f38907308c893deaf244787db4af53682249107418afc2edc58f75ac58a07404"))));
}
 

import net.i2p.crypto.eddsa.Utils; //导入依赖的package包/类
/**
 * Test method for {@link net.i2p.crypto.eddsa.math.bigint.BigIntegerScalarOps#multiplyAndAdd(byte[], byte[], byte[])}.
 */
@Test
public void testMultiplyAndAdd() {
     // Example from test case 1
    byte[] h = Utils.hexToBytes("86eabc8e4c96193d290504e7c600df6cf8d8256131ec2c138a3e7e162e525404");
    byte[] a = Utils.hexToBytes("307c83864f2833cb427a2ef1c00a013cfdff2768d980c0a3a520f006904de94f");
    byte[] r = Utils.hexToBytes("f38907308c893deaf244787db4af53682249107418afc2edc58f75ac58a07404");
    byte[] S = Utils.hexToBytes("5fb8821590a33bacc61e39701cf9b46bd25bf5f0595bbe24655141438e7a100b");
    assertThat(scalarOps.multiplyAndAdd(h, a, r), is(equalTo(S)));
}
 

import net.i2p.crypto.eddsa.Utils; //导入依赖的package包/类
/**
 * Test method for {@link net.i2p.crypto.eddsa.math.bigint.BigIntegerScalarOps#reduce(byte[])}.
 */
@Test
public void testReduce() {
    ScalarOps sc = new BigIntegerScalarOps(ed25519Field,
            new BigInteger("5"));
    assertThat(sc.reduce(new byte[] {7}),
            is(equalTo(Utils.hexToBytes("0200000000000000000000000000000000000000000000000000000000000000"))));

    ScalarOps sc2 = new BigIntegerScalarOps(ed25519Field,
            new BigInteger("7237005577332262213973186563042994240857116359379907606001950938285454250989"));
    // Example from test case 1
    byte[] r = Utils.hexToBytes("b6b19cd8e0426f5983fa112d89a143aa97dab8bc5deb8d5b6253c928b65272f4044098c2a990039cde5b6a4818df0bfb6e40dc5dee54248032962323e701352d");
    assertThat(sc2.reduce(r), is(equalTo(Utils.hexToBytes("f38907308c893deaf244787db4af53682249107418afc2edc58f75ac58a07404"))));
}
 

import net.i2p.crypto.eddsa.Utils; //导入依赖的package包/类
/**
 * Gets the underlying finite field with q=2^255 - 19 elements.
 *
 * @return The finite field.
 */
public static Field getField() {
    return new Field(
            256, // b
            Utils.hexToBytes("edffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff7f"), // q
            new Ed25519LittleEndianEncoding());
}
 

import net.i2p.crypto.eddsa.Utils; //导入依赖的package包/类
/**
 * Scalar multiply the group element by the field element.
 *
 * @param g The group element.
 * @param f The field element.
 * @return The resulting group element.
 */
public static GroupElement scalarMultiplyGroupElement(final GroupElement g, final FieldElement f) {
    final byte[] bytes = f.toByteArray();
    GroupElement h = curve.getZero(GroupElement.Representation.P3);
    for (int i=254; i>=0; i--) {
        h = doubleGroupElement(h);
        if (Utils.bit(bytes, i) == 1) {
            h = addGroupElements(h, g);
        }
    }

    return h;
}
 

import net.i2p.crypto.eddsa.Utils; //导入依赖的package包/类
@Override
public String toString() {
    return "[Ed25519FieldElement val=" + Utils.bytesToHex(toByteArray()) + "]";
}
 

import net.i2p.crypto.eddsa.Utils; //导入依赖的package包/类
/**
 * Creates a group element for a curve from a given encoded point.
 * <p>
 * A point (x,y) is encoded by storing y in bit 0 to bit 254 and the sign of x in bit 255.
 * x is recovered in the following way:
 * <p><ul>
 * <li>x = sign(x) * sqrt((y^2 - 1) / (d * y^2 + 1)) = sign(x) * sqrt(u / v) with u = y^2 - 1 and v = d * y^2 + 1.
 * <li>Setting β = (u * v^3) * (u * v^7)^((q - 5) / 8) one has β^2 = +-(u / v).
 * <li>If v * β = -u multiply β with i=sqrt(-1).
 * <li>Set x := β.
 * <li>If sign(x) != bit 255 of s then negate x.
 *
 * @param curve The curve.
 * @param s     The encoded point.
 */
public GroupElement(final Curve curve, final byte[] s) {
    FieldElement x, y, yy, u, v, v3, vxx, check;
    y = curve.getField().fromByteArray(s);
    yy = y.square();

    // u = y^2-1
    u = yy.subtractOne();

    // v = dy^2+1
    v = yy.multiply(curve.getD()).addOne();

    // v3 = v^3
    v3 = v.square().multiply(v);

    // x = (v3^2)vu, aka x = uv^7
    x = v3.square().multiply(v).multiply(u);

    //  x = (uv^7)^((q-5)/8)
    x = x.pow22523();

    // x = uv^3(uv^7)^((q-5)/8)
    x = v3.multiply(u).multiply(x);

    vxx = x.square().multiply(v);
    check = vxx.subtract(u);            // vx^2-u
    if (check.isNonZero()) {
        check = vxx.add(u);             // vx^2+u

        if (check.isNonZero())
            throw new IllegalArgumentException("not a valid GroupElement");
        x = x.multiply(curve.getI());
    }

    if ((x.isNegative() ? 1 : 0) != Utils.bit(s, curve.getField().getb() - 1)) {
        x = x.negate();
    }

    this.curve = curve;
    this.repr = Representation.P3;
    this.X = x;
    this.Y = y;
    this.Z = curve.getField().ONE;
    this.T = this.X.multiply(this.Y);
}
 

import net.i2p.crypto.eddsa.Utils; //导入依赖的package包/类
@Override
public String toString() {
    return "[Ed25519FieldElement val="+Utils.bytesToHex(toByteArray())+"]";
}
 

import net.i2p.crypto.eddsa.Utils; //导入依赖的package包/类
/**
 * Creates a group element for a curve from a given encoded point.
 * <p>
 * A point $(x,y)$ is encoded by storing $y$ in bit 0 to bit 254 and the sign of $x$ in bit 255.
 * $x$ is recovered in the following way:
 * </p><ul>
 * <li>$x = sign(x) * \sqrt{(y^2 - 1) / (d * y^2 + 1)} = sign(x) * \sqrt{u / v}$ with $u = y^2 - 1$ and $v = d * y^2 + 1$.
 * <li>Setting $β = (u * v^3) * (u * v^7)^{((q - 5) / 8)}$ one has $β^2 = \pm(u / v)$.
 * <li>If $v * β = -u$ multiply $β$ with $i=\sqrt{-1}$.
 * <li>Set $x := β$.
 * <li>If $sign(x) \ne$ bit 255 of $s$ then negate $x$.
 * </ul>
 *
 * @param curve The curve.
 * @param s The encoded point.
 */
public GroupElement(final Curve curve, final byte[] s) {
    FieldElement x, y, yy, u, v, v3, vxx, check;
    y = curve.getField().fromByteArray(s);
    yy = y.square();

    // u = y^2-1
    u = yy.subtractOne();

    // v = dy^2+1
    v = yy.multiply(curve.getD()).addOne();

    // v3 = v^3
    v3 = v.square().multiply(v);

    // x = (v3^2)vu, aka x = uv^7
    x = v3.square().multiply(v).multiply(u);

    //  x = (uv^7)^((q-5)/8)
    x = x.pow22523();

    // x = uv^3(uv^7)^((q-5)/8)
    x = v3.multiply(u).multiply(x);

    vxx = x.square().multiply(v);
    check = vxx.subtract(u);            // vx^2-u
    if (check.isNonZero()) {
        check = vxx.add(u);             // vx^2+u

        if (check.isNonZero())
            throw new IllegalArgumentException("not a valid GroupElement");
        x = x.multiply(curve.getI());
    }

    if ((x.isNegative() ? 1 : 0) != Utils.bit(s, curve.getField().getb()-1)) {
        x = x.negate();
    }

    this.curve = curve;
    this.repr = Representation.P3;
    this.X = x;
    this.Y = y;
    this.Z = curve.getField().ONE;
    this.T = this.X.multiply(this.Y);
}
 

import net.i2p.crypto.eddsa.Utils; //导入依赖的package包/类
/**
 * Creates a group element for a curve from a given encoded point.
 * <p>
 * A point (x,y) is encoded by storing y in bit 0 to bit 254 and the sign of x in bit 255.
 * x is recovered in the following way:
 * <p><ul>
 * <li>x = sign(x) * sqrt((y^2 - 1) / (d * y^2 + 1)) = sign(x) * sqrt(u / v) with u = y^2 - 1 and v = d * y^2 + 1.
 * <li>Setting β = (u * v^3) * (u * v^7)^((q - 5) / 8) one has β^2 = +-(u / v).
 * <li>If v * β = -u multiply β with i=sqrt(-1).
 * <li>Set x := β.
 * <li>If sign(x) != bit 255 of s then negate x.
 *
 * @param curve The curve.
 * @param s The encoded point.
 */
public GroupElement(final Curve curve, final byte[] s) {
    FieldElement x, y, yy, u, v, v3, vxx, check;
    y = curve.getField().fromByteArray(s);
    yy = y.square();

    // u = y^2-1    
    u = yy.subtractOne();

    // v = dy^2+1
    v = yy.multiply(curve.getD()).addOne();

    // v3 = v^3
    v3 = v.square().multiply(v);

    // x = (v3^2)vu, aka x = uv^7
    x = v3.square().multiply(v).multiply(u);    

    //  x = (uv^7)^((q-5)/8)
    x = x.pow22523();

    // x = uv^3(uv^7)^((q-5)/8)
    x = v3.multiply(u).multiply(x);

    vxx = x.square().multiply(v);
    check = vxx.subtract(u);            // vx^2-u
    if (check.isNonZero()) {
        check = vxx.add(u);             // vx^2+u

        if (check.isNonZero())
            throw new IllegalArgumentException("not a valid GroupElement");
        x = x.multiply(curve.getI());
    }

    if ((x.isNegative() ? 1 : 0) != Utils.bit(s, curve.getField().getb()-1)) {
        x = x.negate();
    }

    this.curve = curve;
    this.repr = Representation.P3;
    this.X = x;
    this.Y = y;
    this.Z = curve.getField().ONE;
    this.T = this.X.multiply(this.Y);
}
 

import net.i2p.crypto.eddsa.Utils; //导入依赖的package包/类
/**
 * Gets a value indicating whether or not the field element is non-zero.
 *
 * @return 1 if it is non-zero, 0 otherwise.
 */
public boolean isNonZero() {
    final byte[] s = toByteArray();
    return Utils.equal(s, ZERO) == 0;
}