Function decode_candidate 

pub fn decode_candidate() -> Program

Key loading, step 1: square-root candidate for a point with y in input 0. Outputs x (0), x * sqrt(-1) (1), v * x^2 (2) and u (3) with u = y^2 - 1, v = d y^2 + 1. The controller takes x if v x^2 = u, x sqrt(-1) if v x^2 = -u, and rejects the point otherwise, then applies the sign bit; the program never branches.

The candidate is the RFC 8032 one, x = u v^3 (u v^7)^((p-5)/8), which computes a root of u / v without a separate inversion.