Represents an element from a base field

Represents a point on the curve in affine coordinates

Returns a Plompiler representation of a point

is_on_curve p checks whether a point p is on the curve

from_coordinates x y constructs a point p = (x, y) from coordinates x and y. The function also checks whether the point is on the curve (but not necessarily in the subgroup)

unsafe_from_coordinates x y is similar to from_coordinates but does not verify the point is on the curve. It can be used to build a variable of type point without adding any constraint

get_x_coordinate p returns a first coordinate x of a point p

get_y_coordinate p returns a second coordinate y of a point p

Returns the point at infinity of the curve (additive identity)

Returns the base point of the curve (a fixed generator)

add p q computes a point addition p + q

negate p computes a point negation -p

cond_add p q b returns p + b * q, i.e., either a point addition p and q or a point p based on the value b

double p computes a point doubling p + p

scalar_mul s p computes a point multiplication p by a scalar s. The scalar s is encoded in little-endian order

multi_scalar_mul ls lp computes the multi-scalar multiplication s₁·p₁ + s₂·p₂ + … + sₖ·pₖ

Returns the order of the prime-order subgroup of the elliptic curve group

Returns the prime number defining the underlying field

to_compressed_bytes p returns the compressed representation of a point p = (x, y) in little-endian bytes pow2 255 * (x % 2) + y