Module curve 

ECgFp5 elliptic curve and its scalar field, as used by the Lighter signer.

• Point is a curve point on ECgFp5, with addition, doubling, scalar multiplication, and the canonical Fp5 encode/decode pair.
• Scalar is the prime-order scalar field modulo the group order n, with Montgomery-form multiplication and a signed-window recoding helper used by the variable-time scalar multiplication.

Both modules sit on top of the field layer and contain no unsafe. Vector tests under test_data/ cross-check against the upstream Go reference.

Structs

AffinePoint

A point on the curve in affine (x, u) coordinates. Used as window entries in scalar multiplication; the affine form skips the Z and T denominators.

Point

A point on the ECgFp5 curve in fractional (x, u) = (X/Z, U/T) coordinates.

Scalar

A scalar in the ECgFp5 curve’s scalar field, stored in non-Montgomery form as five 64-bit little-endian limbs.

Constants

LIMBS

Number of 64-bit limbs in a scalar.

ORDER

Group order n of the ECgFp5 curve, a 319-bit prime.

SCALAR_BYTES

Canonical 40-byte little-endian encoding length for a scalar.

Functions

batch_to_affine

Convert a slice of projective points to affine (x, u) form using Montgomery’s trick: a single Fp5 inversion services all entries.

lookup

Window lookup: returns the affine point matching the signed digit k.

lookup_ct

Constant-time window lookup. Same semantics as lookup but every per-entry assignment and the final u negation route through Fp5::ct_select, so neither the table walk nor the sign branch leaks the secret digit. Used by Point::scalar_mul_ct.

lookup_var_time

Variable-time window lookup. Same semantics as lookup but with explicit short-circuit branches; only suitable for public-input scalar multiplication.

recode_signed_from_limbs

Recode an arbitrary little-endian limb sequence into signed window digits. Standalone helper exposed mainly for testing parity with the upstream code.