From f451f3979b3e3376a93b265bc9abc8374c3ea795 Mon Sep 17 00:00:00 2001
From: Chris Duncan <chris@codecow.com>
Date: Thu, 1 Oct 2026 14:40:00 -0700
Subject: [PATCH] Straighten out cneg.

---
 src/assembly/ed25519/ge.ts | 30 +++++++++++++++++++++++-------
 1 file changed, 23 insertions(+), 7 deletions(-)

diff --git a/src/assembly/ed25519/ge.ts b/src/assembly/ed25519/ge.ts
index de3c2b7..a986d8b 100644
--- a/src/assembly/ed25519/ge.ts
+++ b/src/assembly/ed25519/ge.ts
@@ -101,8 +101,8 @@ const p_root_check: FieldElement = fe()
  * @returns {i32} 0 if `s` decodes to a valid point, else -1
  */
 export function ge_frombytes_negate_vartime (h: ge_p3, s: StaticArray<u8>): i32 {
-	fe_1(h.Z)
 	fe_frombytes(h.Y, s)
+	fe_1(h.Z)
 
 	// u = y²-1
 	// v = dy²+1
@@ -157,6 +157,11 @@ const ge_frombytes_m_root_check: FieldElement = fe()
 const ge_frombytes_p_root_check: FieldElement = fe()
 const ge_frombytes_negx: FieldElement = fe()
 const ge_frombytes_x_sqrtm1: FieldElement = fe()
+/**
+ * Constant-time point negation converted from byte representation.
+ *
+ * @returns {i32} 0 if `s` decodes to a valid point, else -1
+ */
 export function ge_frombytes (h: ge_p3, s: StaticArray<u8>): i32 {
 	const u = ge_frombytes_u
 	const v = ge_frombytes_v
@@ -170,22 +175,33 @@ export function ge_frombytes (h: ge_p3, s: StaticArray<u8>): i32 {
 
 	fe_frombytes(h.Y, s)
 	fe_1(h.Z)
+
+	// u = y²-1
+	// v = dy²+1
 	fe_sq(u, h.Y)
 	fe_mul(v, u, ed25519_d)
-	fe_sub(u, u, h.Z) /* u = y^2-1 */
-	fe_add(v, v, h.Z) /* v = dy^2+1 */
+	u[0] -= 1
+	v[0] += 1
 
+	/* x = u((uv)^((q-5)/8)) */
 	fe_mul(h.X, u, v)
 	fe_pow22523(h.X, h.X)
-	fe_mul(h.X, u, h.X) /* u((uv)^((q-5)/8)) */
+	fe_mul(h.X, u, h.X)
 
+	// vxx = vx²
 	fe_sq(vxx, h.X)
 	fe_mul(vxx, vxx, v)
-	fe_sub(m_root_check, vxx, u) /* vx^2-u */
-	fe_add(p_root_check, vxx, u) /* vx^2+u */
+
+	// m = vx²-u
+	fe_sub(m_root_check, vxx, u)
 	has_m_root = fe_iszero(m_root_check)
+
+	// p = vx²+u
+	fe_add(p_root_check, vxx, u)
 	has_p_root = fe_iszero(p_root_check)
-	fe_mul(x_sqrtm1, h.X, fe_sqrtm1) /* x*sqrt(-1) */
+
+	// x√-1
+	fe_mul(x_sqrtm1, h.X, fe_sqrtm1)
 	fe_cmov(h.X, x_sqrtm1, 1 - has_m_root)
 
 	fe_neg(negx, h.X)
-- 
2.52.0