Module host 

Host-side reference arithmetic for the scalable datapath.

These functions run on the build/test host, never in hardware. They generate ROM contents (the fixed-base table and constants) and give the microcode interpreter bit-exact semantics: every field value is canonical, strictly below p = 2^255 - 19, exactly as the RHDL multiplier and add/subtract units produce.

The module also holds the reference curve model (Ext, Niels), point encoding and strict decoding, the small-order encoding list, and the mixed-radix scalar recoding (recode) with its digit layout (DIGITS, digit_offset, table_row). None of it is constant time; it only computes reference values.

Structs

Ext

Extended twisted-Edwards point (X:Y:Z:T).

Fp

Canonical field element modulo 2^255 - 19, four little-endian words.

Niels

Affine Niels coordinates (y+x, y-x, 2dxy).

Constants

DIGITS

Digits of the fixed-base recoding (one table per digit).

L_BYTES

Ed25519 group order l = 2^252 + 27742317777372353535851937790883648493, little endian.

TABLE_ROWS

Table rows (entry pairs) over all digits: 39 * 8 + 15 * 4 = 372.

WIDE_DIGITS

The low WIDE_DIGITS digits are signed radix 32, the rest radix 16.

Functions

basepoint_table

table[i][e-1] = e * 2^offset(i) * B in affine Niels form.

canonical_y

Whether a 32-byte encoding has a canonical y (below p, sign bit ignored).

decode_point

Strict point decoding: canonical y, a square root exists, and not the x = 0 encoding with the sign bit set. Same rules as the strict verifier of rhdl_ed25519_fast_core.

digit_entries

Table entries of digit i (magnitudes 1..=entries).

digit_offset

Bit offset of digit i: the sum of the widths of digits 0..i.

digit_width

Bit width of digit i: 5 for radix 32, 4 for radix 16.

edwards_d

Edwards curve constant d = -121665/121666.

edwards_d2

2d, the constant the addition formulas and the Niels form use.

point_table

table[i][e-1] = e * 2^offset(i) * P in affine Niels form: the fixed-base table of any point (the base point, or a verification key).

recode

Signed mixed-radix recoding into DIGITS digits (the rest of the array is zero): digit i lies in [-2^(w-1), 2^(w-1)] for its width w.

small_order_encoding

The eight encodings of low-order points that strict verification rejects (the list rhdl_ed25519_fast_core checks).

sqrt_m1

sqrt(-1), i.e. 2^((p-1)/4).

table_row

First table row (entry pair) of digit i.