internal

type Decoder interface {
	// Decode sets the receiver to a decoding of the input data, and returns an error on failure.
	Decode(data []byte) error

	// DecodeHex sets the receiver to the decoding of the hex encoded input.
	DecodeHex(h string) error

	// BinaryUnmarshaler implementation.
	encoding.BinaryUnmarshaler
}

type Element interface {
	// Group returns the group's Identifier.
	Group() byte

	// Base sets the element to the group's base point a.k.a. canonical generator.
	Base() Element

	// Identity sets the element to the point at infinity of the Group's underlying curve.
	Identity() Element

	// Add sets the receiver to the sum of the input and the receiver, and returns the receiver.
	Add(e Element) Element

	// Double sets the receiver to its double, and returns it.
	Double() Element

	// Negate sets the receiver to its negation, and returns it.
	Negate() Element

	// Subtract subtracts the input from the receiver, and returns the receiver.
	Subtract(e Element) Element

	// Multiply sets the receiver to the scalar multiplication of the receiver with the given Scalar, and returns it.
	Multiply(s Scalar) Element

	// Equal returns 1 if the elements are equivalent, and 0 otherwise.
	Equal(e Element) int

	// IsIdentity returns whether the Element is the point at infinity of the Group's underlying curve.
	IsIdentity() bool

	// Set sets the receiver to the value of the argument, and returns the receiver.
	Set(e Element) Element

	// Copy returns a copy of the receiver.
	Copy() Element

	// Encode returns the compressed byte encoding of the element.
	Encode() []byte

	// XCoordinate returns the encoded x coordinate of the element.
	XCoordinate() []byte

	// Decode sets the receiver to a decoding of the input data, and returns an error on failure.
	Decode(data []byte) error

	// Hex returns the fixed-sized hexadecimal encoding of e.
	Hex() string

	// DecodeHex sets e to the decoding of the hex encoded element.
	DecodeHex(data string) error
}

type Encoder interface {
	// Encode returns the compressed byte encoding.
	Encode() []byte

	// Hex returns the fixed-sized hexadecimal encoding.
	Hex() string

	// BinaryMarshaler implementation.
	encoding.BinaryMarshaler
}

type Group interface {
	// NewScalar returns a new scalar set to 0.
	NewScalar() Scalar

	// NewElement returns the identity element (point at infinity).
	NewElement() Element

	// Base returns the group's base point a.k.a. canonical generator.
	Base() Element

	// HashFunc returns the RFC9380 associated hash function of the group.
	HashFunc() crypto.Hash

	// HashToScalar returns a safe mapping of the arbitrary input to a Scalar.
	// The DST must not be empty or nil, and is recommended to be longer than 16 bytes.
	HashToScalar(input, dst []byte) (Scalar, error)

	// HashToGroup returns a safe mapping of the arbitrary input to an Element in the Group.
	// The DST must not be empty or nil, and is recommended to be longer than 16 bytes.
	HashToGroup(input, dst []byte) (Element, error)

	// EncodeToGroup returns a non-uniform mapping of the arbitrary input to an Element in the Group.
	// The DST must not be empty or nil, and is recommended to be longer than 16 bytes.
	EncodeToGroup(input, dst []byte) (Element, error)

	// Ciphersuite returns the hash-to-curve ciphersuite identifier.
	Ciphersuite() string

	// ScalarLength returns the byte size of an encoded scalar.
	ScalarLength() int

	// ElementLength returns the byte size of an encoded element.
	ElementLength() int

	// Order returns the order of the canonical group of scalars.
	Order() []byte
}

type Scalar interface {
	// Group returns the group's Identifier.
	Group() byte

	// Zero sets the scalar to 0, and returns it.
	Zero() Scalar

	// One sets the scalar to 1, and returns it.
	One() Scalar

	// MinusOne sets the scalar to order-1, and returns it.
	MinusOne() Scalar

	// Random sets the current scalar to a new random scalar and returns it.
	// The random source is crypto/rand, and this functions is guaranteed to return a non-zero scalar.
	Random() Scalar

	// Add sets the receiver to the sum of the input and the receiver, and returns the receiver.
	Add(s Scalar) Scalar

	// Subtract subtracts the input from the receiver, and returns the receiver.
	Subtract(s Scalar) Scalar

	// Multiply multiplies the receiver with the input, and returns the receiver.
	Multiply(s Scalar) Scalar

	// Pow sets s to s**scalar modulo the group order, and returns s. If scalar is nil, it returns 1.
	Pow(s Scalar) Scalar

	// Invert sets the receiver to the scalar's modular inverse ( 1 / scalar ), and returns it.
	Invert() Scalar

	// Equal returns 1 if the scalars are equal, and 0 otherwise.
	Equal(s Scalar) int

	// LessOrEqual returns 1 if s <= scalar, and 0 otherwise.
	LessOrEqual(s Scalar) int

	// IsZero returns whether the scalar is 0.
	IsZero() bool

	// Set sets the receiver to the value of the argument scalar, and returns the receiver.
	Set(s Scalar) Scalar

	// SetUInt64 sets s to i modulo the field order, and returns an error if one occurs.
	SetUInt64(i uint64) Scalar

	// UInt64 returns the uint64 representation of the scalar,
	// or an error if its value is higher than the authorized limit for uint64.
	UInt64() (uint64, error)

	// Copy returns a copy of the receiver.
	Copy() Scalar

	// Encode returns the compressed byte encoding of the scalar.
	Encode() []byte

	// Decode sets s to a big-endian byte decoding of x.
	// If x is not a canonical encoding of s, Decode returns an error.
	Decode(data []byte) error

	// DecodeWithReduction sets s to x modulo the group order. If x is nil or
	// not of the correct input length, DecodeWithReduction returns an error.
	DecodeWithReduction(x []byte) error

	// Hex returns the fixed-sized hexadecimal encoding of s.
	Hex() string

	// DecodeHex sets s to the decoding of the hex encoded scalar.
	DecodeHex(data string) error
}