Struct Point 

pub struct Point {
    pub x: Fp5,
    pub z: Fp5,
    pub u: Fp5,
    pub t: Fp5,
}

A point on the ECgFp5 curve in fractional (x, u) = (X/Z, U/T) coordinates.

The neutral element is encoded as (0, 1, 0, 1). Two values are equal in the group whenever u1 * t2 == u2 * t1; the Self::eq_point helper performs that cross-multiplication without an inversion. PartialEq is deliberately not derived because numerically distinct (X, Z, U, T) tuples can represent the same group element.

Fields

x: Fp5

X coordinate of the projective (X, Z) representation.

z: Fp5

Z denominator of the (X, Z) representation.

u: Fp5

U coordinate of the projective (U, T) representation.

t: Fp5

T denominator of the (U, T) representation.

Implementations

impl Point

pub const NEUTRAL: Self

Neutral element N = (0, 0) in projective (X, Z, U, T) = (0, 1, 0, 1).

pub const GENERATOR: Self

Canonical generator of the prime-order subgroup, w = 4.

pub fn eq_point(self, rhs: Self) -> bool

Group equality: returns true when self and rhs denote the same curve point. Implemented as u1 * t2 == u2 * t1 to avoid inversion.

pub fn is_neutral(self) -> bool

Test whether the point is the neutral element N. The neutral has u == 0 in the fractional encoding.

pub fn encode(self) -> Fp5

Encode the point to its canonical 40-byte little-endian Fp5 representation w = t / u. The neutral encodes to 0.

pub fn decode(w: Fp5) -> Option<Self>

Decode a curve point from its canonical w = y/x encoding.

Returns Some(point) for any element of the prime-order group (the zero encoding maps to Self::NEUTRAL). Returns None for encodings that do not correspond to a valid group element. Decoding succeeds iff w == 0 or (w^2 - a)^2 - 4*b is a quadratic residue in Fp5.

pub fn add_point(self, rhs: Self) -> Self

Group addition self ⊕ rhs via the complete 10M formulas of Pornin’s paper. Handles all combinations including the neutral.

pub fn add_affine(self, rhs: AffinePoint) -> Self

Add an affine (x, u) point. Cost: 8M (two fewer multiplies than the general add since z2 == t2 == 1).

pub fn double(self) -> Self

Group doubling 2 * self. Cost: 4M + 5S.

pub fn set_double(&mut self)

In-place doubling. Splitting Self::double into a setter saves a struct copy in the inner loop of mdouble.

pub fn mdouble(self, n: u32) -> Self

n-fold doubling, returning a new point. For n >= 2, uses a share-the-doubling formulation that avoids reconstructing the intermediate (X, Z, U, T) tuple between rounds.

pub fn set_mdouble(&mut self, n: u32)

In-place n-fold doubling. Cost: n * (2M + 5S) + 2M + 1S.

pub fn make_window_affine(self) -> Vec<AffinePoint>

Build a WINDOW-bit window of affine multiples [1*P, 2*P, ..., 2^(WINDOW-1) * P] for the supplied base point.

pub fn scalar_mul(self, s: Scalar) -> Self

Variable-time scalar multiplication s * self.

Builds a windowed table of (x, u) affine multiples and performs a signed-digit double-and-add. This routine MUST NOT be called on secret scalars: the top-window lookup_var_time step short-circuits on the digit, and the per-window lookup still branches on each entry’s match (see its doc). Use Self::scalar_mul_ct for the secret-scalar path that the Schnorr signer follows.

pub fn scalar_mul_ct(self, s: Scalar) -> Self

Constant-time scalar multiplication s * self.

Same algorithm as Self::scalar_mul but routes every window lookup through lookup_ct, which uses Fp5::ct_select in place of the data-dependent assignment in lookup. The window-prep, recoding, mdouble, and add_affine steps execute as straight-line fixed-shape sequences over the secret scalar’s limbs, so the routine leaks no timing information about s. The base point self is treated as public; this is the form Schnorr uses (k * G, sk * G).

pub fn mulgen_ct(s: Scalar) -> Self

Constant-time scalar multiplication on the canonical generator s * G, using a precomputed affine window cached for the process lifetime.

Functionally identical to Point::GENERATOR.scalar_mul_ct(s) but skips the per-call Self::make_window_affine step. The Schnorr signer’s r = k * G and pk = sk * G derivations both route through here.

pub fn mulgen(s: Scalar) -> Self

Variable-time scalar multiplication on the canonical generator s * G.

Companion to Self::mulgen_ct for verification’s s * G term, where the scalar is public. Reuses the same precomputed affine window.

Trait Implementations

impl Add for Point

type Output = Point

The resulting type after applying the + operator.

fn add(self, rhs: Self) -> Self

Performs the + operation.

impl AddAssign for Point

fn add_assign(&mut self, rhs: Self)

Performs the += operation.

impl Clone for Point

fn clone(&self) -> Point

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Copy for Point

impl Debug for Point

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Mul<Point> for Scalar

type Output = Point

The resulting type after applying the * operator.

fn mul(self, rhs: Point) -> Point

Performs the * operation.

impl Mul<Scalar> for Point

type Output = Point

The resulting type after applying the * operator.

fn mul(self, rhs: Scalar) -> Self

Performs the * operation.