anchor.diff:        (setf x (- +ed448-q+ x)))
       x))
   
  -(defun ed448-edwards-add (p q)
  -  "Point addition on ed448 curve."
  -  (declare (type ed448-point p q)
  -           (optimize (speed 3) (safety 0) (space 0) (debug 0)))
  -  (let* ((x1 (aref p 0))
  -         (y1 (aref p 1))
  -         (z1 (aref p 2))
  -         (x2 (aref q 0))
  -         (y2 (aref q 1))
  -         (z2 (aref q 2))
  -         (a (mod (* z1 z2) +ed448-q+))
  -         (b (mod (* a a) +ed448-q+))
  -         (c (mod (* x1 x2) +ed448-q+))
  -         (d (mod (* y1 y2) +ed448-q+))
  -         (k (mod (* c d) +ed448-q+))
  -         (e (mod (* +ed448-d+ k) +ed448-q+))
  -         (f (mod (- b e) +ed448-q+))
  -         (g (mod (+ b e) +ed448-q+))
  -         (h (mod (* (+ x1 y1) (+ x2 y2)) +ed448-q+))
  -         (i (mod (* a f) +ed448-q+))
  -         (j (mod (* a g) +ed448-q+))
  -         (x3 (mod (* i (- h c d)) +ed448-q+))
  -         (y3 (mod (* j (- d c)) +ed448-q+))
  -         (z3 (mod (* f g) +ed448-q+)))
  -    (declare (type integer x1 y1 z1 x2 y2 z2 a b c d e f g h i j k x3 y3 z3))
  -    (vector x3 y3 z3)))
  -
  -(defun ed448-edwards-double (p)
  -  "Point doubling on ed448 curve."
  -  (declare (type ed448-point p)
  -           (optimize (speed 3) (safety 0) (space 0) (debug 0)))
  -  (let* ((x1 (aref p 0))
  -         (y1 (aref p 1))
  -         (z1 (aref p 2))
  -         (a (mod (+ x1 y1) +ed448-q+))
  -         (b (mod (* a a) +ed448-q+))
  -         (c (mod (* x1 x1) +ed448-q+))
  -         (d (mod (* y1 y1) +ed448-q+))
  -         (e (mod (+ c d) +ed448-q+))
  -         (f (mod (* z1 z1) +ed448-q+))
  -         (g (mod (- e (* 2 f)) +ed448-q+))
  -         (x2 (mod (* (- b e) g) +ed448-q+))
  -         (y2 (mod (* (- c d) e) +ed448-q+))
  -         (z2 (mod (* e g) +ed448-q+)))
  -    (declare (type integer x1 y1 z1 x2 y2 z2 a b c d e f g x2 y2 z2))
  -    (vector x2 y2 z2)))
  -
  -(defun ed448-scalar-mult (p e)
  -  "Point multiplication on ed448 curve using the Montgomery ladder."
  +(defmethod ec-add ((p ed448-point) (q ed448-point))
  +  (declare (optimize (speed 3) (safety 0) (space 0) (debug 0)))
  +  (with-slots ((x1 x) (y1 y) (z1 z)) p
  +    (declare (type integer x1 y1 z1))
  +    (with-slots ((x2 x) (y2 y) (z2 z)) q
  +      (declare (type integer x2 y2 z2))
  +      (let* ((a (mod (* z1 z2) +ed448-q+))
  +             (b (mod (* a a) +ed448-q+))
  +             (c (mod (* x1 x2) +ed448-q+))
  +             (d (mod (* y1 y2) +ed448-q+))
  +             (k (mod (* c d) +ed448-q+))
  +             (e (mod (* +ed448-d+ k) +ed448-q+))
  +             (f (mod (- b e) +ed448-q+))
  +             (g (mod (+ b e) +ed448-q+))
  +             (h (mod (* (+ x1 y1) (+ x2 y2)) +ed448-q+))
  +             (i (mod (* a f) +ed448-q+))
  +             (j (mod (* a g) +ed448-q+))
  +             (x3 (mod (* i (- h c d)) +ed448-q+))
  +             (y3 (mod (* j (- d c)) +ed448-q+))
  +             (z3 (mod (* f g) +ed448-q+)))
  +        (declare (type integer a b c d e f g h i j k x3 y3 z3))
  +        (make-instance 'ed448-point :x x3 :y y3 :z z3)))))
  +
  +(defmethod ec-double ((p ed448-point))
  +  (declare (optimize (speed 3) (safety 0) (space 0) (debug 0)))
  +  (with-slots ((x1 x) (y1 y) (z1 z)) p
  +    (declare (type integer x1 y1 z1))
  +    (let* ((a (mod (+ x1 y1) +ed448-q+))
  +           (b (mod (* a a) +ed448-q+))
  +           (c (mod (* x1 x1) +ed448-q+))
  +           (d (mod (* y1 y1) +ed448-q+))
  +           (e (mod (+ c d) +ed448-q+))
  +           (f (mod (* z1 z1) +ed448-q+))
  +           (g (mod (- e (* 2 f)) +ed448-q+))
  +           (x2 (mod (* (- b e) g) +ed448-q+))
  +           (y2 (mod (* (- c d) e) +ed448-q+))
  +           (z2 (mod (* e g) +ed448-q+)))
  +      (declare (type integer a b c d e f g x2 y2 z2))
  +      (make-instance 'ed448-point :x x2 :y y2 :z z2))))
  +
  +(defmethod ec-scalar-mult ((p ed448-point) e)
  +  ;; Point multiplication on ed448 curve using the Montgomery ladder.
     (declare (optimize (speed 3) (safety 0) (space 0) (debug 0))
  -           (type ed448-point p)
              (type integer e))
  -  (do ((r0 (vector 0 1 1))
  +  (do ((r0 +ed448-point-at-infinity+)
          (r1 p)
          (i 447 (1- i)))
         ((minusp i) r0)
       (declare (type ed448-point r0 r1)
                (type fixnum i))
       (if (logbitp i e)
  -        (setf r0 (ed448-edwards-add r0 r1)
  -              r1 (ed448-edwards-double r1))
  -        (setf r1 (ed448-edwards-add r0 r1)
  -              r0 (ed448-edwards-double r0)))))
  -
  -(defun ed448-on-curve-p (p)
  -  "Check if the point P is on ed448 curve."
  -  (declare (type ed448-point p)
  -           (optimize (speed 3) (safety 0) (space 0) (debug 0)))
  -  (let* ((x (aref p 0))
  -         (y (aref p 1))
  -         (z (aref p 2))
  -         (xx (mod (* x x) +ed448-q+))
  -         (yy (mod (* y y) +ed448-q+))
  -         (zz (mod (* z z) +ed448-q+))
  -         (zzzz (mod (* zz zz) +ed448-q+))
  -         (a (mod (* zz (+ yy xx)) +ed448-q+))
  -         (b (mod (+ zzzz (* +ed448-d+ xx yy)) +ed448-q+)))
  -    (declare (type integer x y z xx yy zz zzzz a b))
  -    (zerop (mod (- a b) +ed448-q+))))
  -
  -(defun ed448-point-equal (p q)
  -  "Check whether P and Q represent the same point."
  -  (declare (type ed448-point p q)
  -           (optimize (speed 3) (safety 0) (space 0) (debug 0)))
  -  (let ((x1 (aref p 0))
  -        (y1 (aref p 1))
  -        (z1 (aref p 2))
  -        (x2 (aref q 0))
  -        (y2 (aref q 1))
  -        (z2 (aref q 2)))
  -    (declare (type integer x1 y1 z1 x2 y2 z2))
  -    (and (zerop (mod (- (* x1 z2) (* x2 z1)) +ed448-q+))
  -         (zerop (mod (- (* y1 z2) (* y2 z1)) +ed448-q+)))))
  -
  -(defun ed448-encode-int (y)
  -  "Encode an integer as a byte array (little-endian)."
  -  (declare (optimize (speed 3) (safety 0) (space 0) (debug 0)))
  -  (integer-to-octets y :n-bits +ed448-bits+ :big-endian nil))
  -
  -(defun ed448-decode-int (octets)
  -  "Decode a byte array to an integer (little-endian)."
  -  (declare (type (simple-array (unsigned-byte 8) (*)) octets)
  -           (optimize (speed 3) (safety 0) (space 0) (debug 0)))
  +        (setf r0 (ec-add r0 r1)
  +              r1 (ec-double r1))
  +        (setf r1 (ec-add r0 r1)
  +              r0 (ec-double r0)))))
  +
  +(defmethod ec-point-on-curve-p ((p ed448-point))
  +  (declare (optimize (speed 3) (safety 0) (space 0) (debug 0)))
  +  (with-slots (x y z) p
  +    (declare (type integer x y z))
  +    (let* ((xx (mod (* x x) +ed448-q+))
  +           (yy (mod (* y y) +ed448-q+))
  +           (zz (mod (* z z) +ed448-q+))
  +           (zzzz (mod (* zz zz) +ed448-q+))
  +           (a (mod (* zz (+ yy xx)) +ed448-q+))
  +           (b (mod (+ zzzz (* +ed448-d+ xx yy)) +ed448-q+)))
  +      (declare (type integer xx yy zz zzzz a b))
  +      (zerop (mod (- a b) +ed448-q+)))))
  +
  +(defmethod ec-point-equal ((p ed448-point) (q ed448-point))
  +  (declare (optimize (speed 3) (safety 0) (space 0) (debug 0)))
  +  (with-slots ((x1 x) (y1 y) (z1 z)) p
  +    (declare (type integer x1 y1 z1))
  +    (with-slots ((x2 x) (y2 y) (z2 z)) q
  +      (declare (type integer x2 y2 z2))
  +      (and (zerop (mod (- (* x1 z2) (* x2 z1)) +ed448-q+))
  +           (zerop (mod (- (* y1 z2) (* y2 z1)) +ed448-q+))))))
  +
  +(defmethod ec-encode-scalar ((kind (eql :ed448)) n)
  +  (integer-to-octets n :n-bits +ed448-bits+ :big-endian nil))
  +
  +(defmethod ec-decode-scalar ((kind (eql :ed448)) octets)
     (octets-to-integer octets :big-endian nil))
   
  -(defun ed448-encode-point (p)
  -  "Encode a point on ed448 curve as a byte array."
  -  (declare (type ed448-point p)
  -           (optimize (speed 3) (safety 0) (space 0) (debug 0)))
  -  (let* ((z (aref p 2))
  -         (invz (ed448-inv z))
  -         (x (mod (* (aref p 0) invz) +ed448-q+))
  -         (y (mod (* (aref p 1) invz) +ed448-q+)))
  -    (setf (ldb (byte 1 (- +ed448-bits+ 1)) y) (ldb (byte 1 0) x))
  -    (ed448-encode-int y)))
  -
  -(defun ed448-decode-point (octets)
  -  "Decode a byte array to a point on ed448 curve."
  -  (declare (type (simple-array (unsigned-byte 8) (*)) octets)
  -           (optimize (speed 3) (safety 0) (space 0) (debug 0)))
  -  (let* ((y (ed448-decode-int octets))
  +(defmethod ec-encode-point ((p ed448-point))
  +  (declare (optimize (speed 3) (safety 0) (space 0) (debug 0)))
  +  (with-slots (x y z) p
  +    (declare (type integer x y z))
  +    (let* ((invz (ec-scalar-inv :ed448 z))
  +           (x (mod (* x invz) +ed448-q+))
  +           (y (mod (* y invz) +ed448-q+)))
  +      (declare (type integer x y))
  +      (setf (ldb (byte 1 (- +ed448-bits+ 1)) y) (ldb (byte 1 0) x))
  +      (ec-encode-scalar :ed448 y))))
  +
  +(defmethod ec-decode-point ((kind (eql :ed448)) octets)
  +  (declare (optimize (speed 3) (safety 0) (space 0) (debug 0)))
  +  (let* ((y (ec-decode-scalar :ed448 octets))
            (b (ldb (byte 1 (- +ed448-bits+ 1)) y)))
       (setf (ldb (byte 1 (- +ed448-bits+ 1)) y) 0)
       (let ((x (ed448-recover-x y)))
  +      (declare (type integer x))
         (unless (= (ldb (byte 1 0) x) b)
           (setf x (- +ed448-q+ x)))
  -      (let ((p (vector x y 1)))
  -        (unless (ed448-on-curve-p p)
  -          (error 'invalid-curve-point :kind 'ed448))
  -        p))))
  +      (let ((p (make-instance 'ed448-point :x x :y y :z 1)))
  +        (if (ec-point-on-curve-p p)
  +            p
  +            (error 'invalid-curve-point :kind 'ed448))))))
   
   (defun ed448-hash (&rest messages)
     (declare (optimize (speed 3) (safety 0) (space 0) (debug 0)))
  
positive.code:     (setf (ldb (byte 2 0) (elt h 0)) 0)
      (setf (ldb (byte 1 7) (elt h (- (ceiling +ed448-bits+ 8) 2))) 1)
      (setf (elt h (- (ceiling +ed448-bits+ 8) 1)) 0)
      (let ((a (ed448-decode-int h)))
        (ed448-encode-point (ed448-scalar-mult +ed448-b+ a)))))
  
  (defmethod make-signature ((kind (eql :ed448)) &key r s &allow-other-keys)
    (unless r
  
negative.code: (defconstant +ed448-l+ 181709681073901722637330951972001133588410340171829515070372549795146003961539585716195755291692375963310293709091662304773755859649779)
  (defconstant +ed448-d+ -39081)
  
  (defconst +ed448-b+
    (make-instance 'ed448-point
                   :x 224580040295924300187604334099896036246789641632564134246125461686950415467406032909029192869357953282578032075146446173674602635247710
                   :y 298819210078481492676017930443930673437544040154080242095928241372331506189835876003536878655418784733982303233503462500531545062832660
                   :z 1))
  (defconst +ed448-point-at-infinity+
    (make-instance 'ed448-point :x 0 :y 1 :z 1))
  
  
  (eval-when (:compile-toplevel :load-toplevel :execute)
  