372 		ret = fp_init(&y1, in->y.ctx); EG(ret, err1);  in eddsa_encode_point()
373 		ret = fp_copy(&tmp_x, &(in->x)); EG(ret, err1);  in eddsa_encode_point()
374 		ret = fp_sqr(&tmp_x, &tmp_x); EG(ret, err1);  in eddsa_encode_point()
375 		ret = fp_copy(&tmp_y, &(in->y)); EG(ret, err1);  in eddsa_encode_point()
376 		ret = fp_sqr(&tmp_y, &tmp_y); EG(ret, err1);  in eddsa_encode_point()
377 		ret = fp_sub(&tmp_y, &tmp_y, &tmp_x); EG(ret, err1);  in eddsa_encode_point()
379 		ret = fp_inv(&tmp_y, &tmp_y); EG(ret, err1);  in eddsa_encode_point()
380 		ret = fp_set_word_value(&tmp_x, WORD(4)); EG(ret, err1);  in eddsa_encode_point()
381 		ret = fp_mul(&tmp_x, &tmp_x, &(in->x)); EG(ret, err1);  in eddsa_encode_point()
382 		ret = fp_mul(&tmp_x, &tmp_x, &(in->y)); EG(ret, err1);  in eddsa_encode_point()
383 		ret = fp_mul(&tmp_x, &tmp_x, &tmp_y); EG(ret, err1);  in eddsa_encode_point()
384 		ret = fp_inv(&tmp_y, alpha_edwards); EG(ret, err1);  in eddsa_encode_point()
385 		ret = fp_mul(&tmp_x, &tmp_x, &tmp_y); EG(ret, err1);  in eddsa_encode_point()
386 		ret = nn_getbit(&(tmp_x.fp_val), 0, &lsb); EG(ret, err1);  in eddsa_encode_point()
388 		ret = fp_copy(&tmp_x, &(in->x)); EG(ret, err1);  in eddsa_encode_point()
389 		ret = fp_sqr(&tmp_x, &tmp_x); EG(ret, err1);  in eddsa_encode_point()
390 		ret = fp_copy(&tmp_y, &(in->y)); EG(ret, err1);  in eddsa_encode_point()
391 		ret = fp_sqr(&tmp_y, &tmp_y); EG(ret, err1);  in eddsa_encode_point()
392 		ret = fp_set_word_value(&y1, WORD(2)); EG(ret, err1);  in eddsa_encode_point()
393 		ret = fp_sub(&y1, &y1, &tmp_x); EG(ret, err1);  in eddsa_encode_point()
394 		ret = fp_sub(&y1, &y1, &tmp_y); EG(ret, err1);  in eddsa_encode_point()
395 		ret = fp_add(&tmp_x, &tmp_x, &tmp_y); EG(ret, err1);  in eddsa_encode_point()
397 		ret = fp_inv(&tmp_x, &tmp_x); EG(ret, err1);  in eddsa_encode_point()
398 		ret = fp_mul(&y1, &y1, &tmp_x); EG(ret, err1);  in eddsa_encode_point()
400 err1:  in eddsa_encode_point()
937 		ret = nn_init(&tmp, 0); EG(ret, err1);
938 		ret = nn_modinv_word(&tmp, WORD(4), gen_order); EG(ret, err1);
939 		ret = prj_pt_mul(&(pub_key->y), &tmp, pub_key_y); EG(ret, err1);
940 err1:
1399 		ret = nn_init(&r_tmp, 0); EG(ret, err1);
1400 		ret = nn_modinv_word(&r_tmp, WORD(4), q); EG(ret, err1);
1401 		ret = nn_mod_mul(&r_tmp, &r_tmp, &r, q); EG(ret, err1);
1405 		ret = nn_mod_mul(&r_tmp, &r_tmp, &binv, q); EG(ret, err1);
1410 err1:
1747 		ret = nn_init(&r_tmp, 0); EG(ret, err1);
1748 		ret = nn_modinv_word(&r_tmp, WORD(4), q); EG(ret, err1);
1749 		ret = nn_mod_mul(&r_tmp, &r_tmp, &r, q); EG(ret, err1);
1753 		ret = nn_mod_mul(&r_tmp, &r_tmp, &binv, q); EG(ret, err1);
1758 err1: