github.com/bwesterb/go-ristretto (go): Pure Go implementation of the Ristretto prime-order group built from the Edwards curve Edwards25519.  Many cryptographic schemes need a group of prime order.  Popular and efficient elliptic curves like (Edwards25519 of `ed25519` fame) are rarely of prime order.  There is, however, a convenient method to construct a prime order group from such curves, using a method called Ristretto proposed by Mike Hamburg.  This package implements the Ristretto group constructed from Edwards25519. The Point type represents a group element.  The API mimics that of the math/big package.  For instance, to set c to a+b, one writes  Warning: contrary to math.Big's interface, an uninitialized  Point is not the same thing as the zero (neutral element) of the group:  Most methods return the receiver, so that function can be chained:  The order of the Ristretto group is l = 2^252 + 27742317777372353535851937790883648493 = 7237005577332262213973186563042994240857116359379907606001950938285454250989. The Scalar type implement the numbers modulo l and also has an API similar to math/big.
Keywords: curve25519|edwards25519|elligator|golang|prime-order-group|ristretto