// File: msotoodeh[P]asymmetric-passwords/common/curve25519/ed25519_sign.c
// Function: ed25519_Blinding_Init
void *ed25519_Blinding_Init(
    void *context,                      /* IO: null or ptr blinding context */
    const unsigned char *seed,          /* IN: [size bytes] random blinding seed */
    size_t size)                        /* IN: size of blinding seed */
{
    struct {
        Ext_POINT T;
        U_WORD t[K_WORDS];
        SHA512_CTX H;
        U8 digest[SHA512_DIGEST_LENGTH];
    } d;

    EDP_BLINDING_CTX *ctx = (EDP_BLINDING_CTX*)context;

    if (ctx == 0)
    {
        ctx = (EDP_BLINDING_CTX*)mem_alloc(sizeof(EDP_BLINDING_CTX));
        if (ctx == 0) return 0;
    }

    /* Use edp_custom_blinding to protect generation of the new blinder */

    SHA512_Init(&d.H);
    SHA512_Update(&d.H, edp_custom_blinding.zr, 32);
    SHA512_Update(&d.H, seed, size);
    SHA512_Final(d.digest, &d.H);

    ecp_BytesToWords(ctx->zr, d.digest+32);
    ecp_BytesToWords(d.t, d.digest);
    eco_Mod(d.t);
    ecp_Sub(ctx->bl, _w_BPO, d.t);

    eco_AddReduce(d.t, d.t, edp_custom_blinding.bl);
    edp_BasePointMult(&d.T, d.t, edp_custom_blinding.zr);
    edp_AddPoint(&d.T, &d.T, &edp_custom_blinding.BP);

    edp_ExtPoint2PE(&ctx->BP, &d.T);

    /* clear potentially sensitive data */
    mem_clear (&d, sizeof(d));

    return ctx;
}

// Assembly:
subq $0x1e8, %rsp            # imm = 0x1E8
movq %rdi, 0x1d8(%rsp)
movq %rsi, 0x1d0(%rsp)
movq %rdx, 0x1c8(%rsp)
movq 0x1d8(%rsp), %rax
movq %rax, 0x8(%rsp)
cmpq $0x0, 0x8(%rsp)
jne 0x40a8de
movl $0xc0, %edi
callq 0x4edaa0
movq %rax, 0x8(%rsp)
cmpq $0x0, 0x8(%rsp)
jne 0x40a8dc
movq $0x0, 0x1e0(%rsp)
jmp 0x40aa4b
jmp 0x40a8de
leaq 0x10(%rsp), %rdi
addq $0xa0, %rdi
callq 0x40bc10
leaq 0x10(%rsp), %rdi
addq $0xa0, %rdi
movq $0x5f32b8, %rsi         # imm = 0x5F32B8
addq $0x20, %rsi
movl $0x20, %edx
callq 0x40f750
leaq 0x10(%rsp), %rdi
addq $0xa0, %rdi
movq 0x1d0(%rsp), %rsi
movq 0x1c8(%rsp), %rdx
callq 0x40f750
leaq 0x10(%rsp), %rdi
addq $0x178, %rdi            # imm = 0x178
leaq 0x10(%rsp), %rsi
addq $0xa0, %rsi
callq 0x40bcf0
movq 0x8(%rsp), %rdi
addq $0x20, %rdi
leaq 0x10(%rsp), %rsi
addq $0x178, %rsi            # imm = 0x178
addq $0x20, %rsi
callq 0x4118a0
leaq 0x10(%rsp), %rdi
addq $0x80, %rdi
leaq 0x10(%rsp), %rsi
addq $0x178, %rsi            # imm = 0x178
callq 0x4118a0
leaq 0x10(%rsp), %rdi
addq $0x80, %rdi
callq 0x411670
movq 0x8(%rsp), %rdi
leaq 0x10(%rsp), %rdx
addq $0x80, %rdx
movq $0x587c00, %rsi         # imm = 0x587C00
addq $0x20, %rsi
callq 0x40fd20
leaq 0x10(%rsp), %rdi
addq $0x80, %rdi
leaq 0x10(%rsp), %rsi
addq $0x80, %rsi
movq $0x5f32b8, %rdx         # imm = 0x5F32B8
callq 0x4116e0
leaq 0x10(%rsp), %rdi
leaq 0x10(%rsp), %rsi
addq $0x80, %rsi
movq $0x5f32b8, %rdx         # imm = 0x5F32B8
addq $0x20, %rdx
callq 0x40a5c0
leaq 0x10(%rsp), %rdi
leaq 0x10(%rsp), %rsi
movq $0x5f32b8, %rdx         # imm = 0x5F32B8
addq $0x40, %rdx
callq 0x40b1d0
movq 0x8(%rsp), %rdi
addq $0x40, %rdi
leaq 0x10(%rsp), %rsi
callq 0x40a7f0
leaq 0x10(%rsp), %rdi
xorl %esi, %esi
movl $0x1b8, %edx            # imm = 0x1B8
callq 0x401060
movq 0x8(%rsp), %rax
movq %rax, 0x1e0(%rsp)
movq 0x1e0(%rsp), %rax
addq $0x1e8, %rsp            # imm = 0x1E8
retq
nopl (%rax,%rax)