// File: msotoodeh[P]asymmetric-passwords/common/curve25519/ed25519_sign.c
// Function: ed25519_SignMessage
void ed25519_SignMessage(
    unsigned char *signature,           /* OUT: [64 bytes] signature (R,S) */
    const unsigned char *privKey,       /*  IN: [64 bytes] private key (sk,pk) */
    const void *blinding,               /*  IN: [optional] null or blinding context */
    const unsigned char *msg,           /*  IN: [msg_size bytes] message to sign */
    size_t msg_size)
{
    SHA512_CTX H;
    Affine_POINT R;
    U_WORD a[K_WORDS], t[K_WORDS], r[K_WORDS];
    U8 md[SHA512_DIGEST_LENGTH];

    /* [a:b] = H(sk) */
    SHA512_Init(&H);
    SHA512_Update(&H, privKey, 32);
    SHA512_Final(md, &H);
    ecp_TrimSecretKey(md);              /* a = first 32 bytes */
    ecp_BytesToWords(a, md);

    /* r = H(b + m) mod BPO */
    SHA512_Init(&H);
    SHA512_Update(&H, md+32, 32);
    SHA512_Update(&H, msg, msg_size);
    SHA512_Final(md, &H);
    eco_DigestToWords(r, md);
    eco_Mod(r);                         /* r mod BPO */

    /* R = r*P */
    edp_BasePointMultiply(&R, r, blinding);
    ed25519_PackPoint(signature, R.y, R.x[0]); /* R part of signature */

    /* S = r + H(encoded(R) + pk + m) * a  mod BPO */
    SHA512_Init(&H);
    SHA512_Update(&H, signature, 32);   /* encoded(R) */
    SHA512_Update(&H, privKey+32, 32);  /* pk */
    SHA512_Update(&H, msg, msg_size);   /* m */
    SHA512_Final(md, &H);
    eco_DigestToWords(t, md);

    eco_MulReduce(t, t, a);             /* h()*a */
    eco_AddReduce(t, t, r);
    eco_Mod(t);
    ecp_WordsToBytes(signature+32, t);  /* S part of signature */

    /* Clear sensitive data */
    ecp_SetValue(a, 0);
    ecp_SetValue(r, 0);
}

// Assembly:
subq $0x1e8, %rsp            # imm = 0x1E8
movq %rdi, 0x1e0(%rsp)
movq %rsi, 0x1d8(%rsp)
movq %rdx, 0x1d0(%rsp)
movq %rcx, 0x1c8(%rsp)
movq %r8, 0x1c0(%rsp)
leaq 0xe8(%rsp), %rdi
callq 0x40bc10
movq 0x1d8(%rsp), %rsi
leaq 0xe8(%rsp), %rdi
movl $0x20, %edx
callq 0x40f750
movq %rsp, %rdi
leaq 0xe8(%rsp), %rsi
callq 0x40bcf0
movq %rsp, %rdi
callq 0x411820
leaq 0x80(%rsp), %rdi
movq %rsp, %rsi
callq 0x4118a0
leaq 0xe8(%rsp), %rdi
callq 0x40bc10
movq %rsp, %rsi
addq $0x20, %rsi
leaq 0xe8(%rsp), %rdi
movl $0x20, %edx
callq 0x40f750
movq 0x1c8(%rsp), %rsi
movq 0x1c0(%rsp), %rdx
leaq 0xe8(%rsp), %rdi
callq 0x40f750
movq %rsp, %rdi
leaq 0xe8(%rsp), %rsi
callq 0x40bcf0
leaq 0x40(%rsp), %rdi
movq %rsp, %rsi
callq 0x411730
leaq 0x40(%rsp), %rdi
callq 0x411670
leaq 0x40(%rsp), %rsi
movq 0x1d0(%rsp), %rdx
leaq 0xa8(%rsp), %rdi
callq 0x40a700
movq 0x1e0(%rsp), %rdi
leaq 0xa8(%rsp), %rsi
addq $0x20, %rsi
movl 0xa8(%rsp), %eax
andl $0x1, %eax
movzbl %al, %edx
callq 0x4119f0
leaq 0xe8(%rsp), %rdi
callq 0x40bc10
movq 0x1e0(%rsp), %rsi
leaq 0xe8(%rsp), %rdi
movl $0x20, %edx
callq 0x40f750
movq 0x1d8(%rsp), %rsi
addq $0x20, %rsi
leaq 0xe8(%rsp), %rdi
movl $0x20, %edx
callq 0x40f750
movq 0x1c8(%rsp), %rsi
movq 0x1c0(%rsp), %rdx
leaq 0xe8(%rsp), %rdi
callq 0x40f750
movq %rsp, %rdi
leaq 0xe8(%rsp), %rsi
callq 0x40bcf0
leaq 0x60(%rsp), %rdi
movq %rsp, %rsi
callq 0x411730
leaq 0x60(%rsp), %rdi
leaq 0x60(%rsp), %rsi
leaq 0x80(%rsp), %rdx
callq 0x411590
leaq 0x60(%rsp), %rdi
leaq 0x60(%rsp), %rsi
leaq 0x40(%rsp), %rdx
callq 0x4116e0
leaq 0x60(%rsp), %rdi
callq 0x411670
movq 0x1e0(%rsp), %rdi
addq $0x20, %rdi
leaq 0x60(%rsp), %rsi
callq 0x411940
leaq 0x80(%rsp), %rdi
xorl %esi, %esi
callq 0x40fba0
leaq 0x40(%rsp), %rdi
xorl %esi, %esi
callq 0x40fba0
addq $0x1e8, %rsp            # imm = 0x1E8
retq
nopw %cs:(%rax,%rax)
nop