43 /* Scalar clamping/decoding
45  * NOTE: the scalar encoding is mainly here to ensure that it is of the form
50  * as setting the scalar MSB to avoid timing/SCA attacks on scalar multiplication.
53 ATTRIBUTE_WARN_UNUSED_RET static int decode_scalar(u8 *scalar_decoded, const u8 *scalar, u8 len)  in decode_scalar()  argument
59         MUST_HAVE((scalar != scalar_decoded), ret, err);  in decode_scalar()
65                 scalar_decoded[len - 1 - i] = scalar[i];  in decode_scalar()
149 	/* Note: our local variables holding scalar and coordinate have the maximum size  in x25519_448_core()
164 	nn scalar;  in x25519_448_core()  local
170 	scalar.magic = WORD(0);  in x25519_448_core()
177 	/* First of all, we clamp and decode the scalar and u */  in x25519_448_core()
262 	/* Import the scalar as big number NN value */  in x25519_448_core()
263 	ret = nn_init_from_buf(&scalar, k_, len); EG(ret, err);  in x25519_448_core()
264 	/* Now proceed with the scalar multiplication */  in x25519_448_core()
266 	ret = prj_pt_mul_blind(&Q, &scalar, &Q); EG(ret, err);  in x25519_448_core()
268 	ret = prj_pt_mul(&Q, &scalar, &Q); EG(ret, err);  in x25519_448_core()
288 	nn_uninit(&scalar);  in x25519_448_core()
332 	 * cost is not so expensive as the core scalar multiplication will take most of the  in x25519_448_init_pub_key()