function elligator()

in src/ristretto255.js [615:670]

• 51 lines of code
• 1 McCabe index (conditional complexity)

function elligator(p, t) {
  const c = lowlevel.gf();
  const n = lowlevel.gf();
  const one = lowlevel.gf();
  const r = lowlevel.gf();
  const rpd = lowlevel.gf();
  const s = lowlevel.gf();
  const sPrime = lowlevel.gf();
  const ss = lowlevel.gf();
  const u = lowlevel.gf();
  const v = lowlevel.gf();
  const w0 = lowlevel.gf();
  const w1 = lowlevel.gf();
  const w2 = lowlevel.gf();
  const w3 = lowlevel.gf();

  lowlevel.set25519(one, gf1); /* one = 1 */
  lowlevel.S(r, t); /* r = t^2 */
  lowlevel.M(r, sqrtm1, r); /* r = sqrt(-1)*t^2 */
  lowlevel.A(u, r, one); /* u = r+1 = sqrt(-1)*t^2 + 1 */
  lowlevel.M(
    u,
    u,
    onemsqd
  ); /* u = (r+1)*(1-d^2) =  (sqrt(-1)*t^2 + 1) * (1-d^2) */
  lowlevel.set25519(c, gf1); /* c = 1 */
  neg25519(c, c); /* c = -1 */
  lowlevel.A(rpd, r, lowlevel.D); /* rpd = r*d */
  lowlevel.M(v, r, lowlevel.D); /* v = r*d */
  lowlevel.Z(v, c, v); /* v = c-r*d */
  lowlevel.M(v, v, rpd); /* v = (c-r*d)*(r+d) */

  const wasntSquare = 1 - sqrtRatioM1(s, u, v);
  lowlevel.M(sPrime, s, t);
  abs25519(sPrime, sPrime);
  neg25519(sPrime, sPrime); /* s_prime = -|s*t| */
  cmov25519(s, sPrime, wasntSquare);
  cmov25519(c, r, wasntSquare);

  lowlevel.Z(n, r, one); /* n = r-1 */
  lowlevel.M(n, n, c); /* n = c*(r-1) */
  lowlevel.M(n, n, sqdmone); /* n = c*(r-1)*(d-1)^2 */
  lowlevel.Z(n, n, v); /* n =  c*(r-1)*(d-1)^2-v */

  lowlevel.A(w0, s, s); /* w0 = 2s */
  lowlevel.M(w0, w0, v); /* w0 = 2s*v */
  lowlevel.M(w1, n, sqrtadm1); /* w1 = n*sqrt(ad-1) */
  lowlevel.S(ss, s); /* ss = s^2 */
  lowlevel.Z(w2, one, ss); /* w2 = 1-s^2 */
  lowlevel.A(w3, one, ss); /* w3 = 1+s^2 */

  lowlevel.M(p[0], w0, w3);
  lowlevel.M(p[1], w2, w1);
  lowlevel.M(p[2], w1, w3);
  lowlevel.M(p[3], w0, w2);
}