Module params 

Hard-coded safe primes and Gold exponents for pilot parameter sets.

Provenance (256-bit set)

• Generation: openssl prime -generate -safe -bits 255 (OpenSSL 3.x), decimal output 50427571419144900628919267453863926315743253667527897108380512375229288045819.
• Independent check: SymPy isprime(p) and isprime((p-1)//2) both True (Miller-Rabin internally; deterministic for this size class).
• Bit length: 255 bits (p < 2^256, fits crypto_bigint::U256).
• Encoding below: big-endian hex (same integer as OpenSSL decimal).

Provenance (512-bit set)

• Generation: openssl prime -generate -safe -bits 511, decimal 5846462199204458696044836418989331885058164550456003028279732171283212220247560926277230464259799968087668834545163644537944481399188821346081377725974863.
• Independent check: SymPy isprime(p) and isprime((p-1)//2) both True.
• Bit length: 511 bits (fits crypto_bigint::U512).

Gold exponent

For each safe prime p = 2q + 1 with q prime, p - 1 = 2^1 · q. The pilot Gold exponent is g = q = (p-1)/2, an odd divisor of p-1 suitable for the power-residue PRF construction.

Structs

GoldPrfParams256

Parameters for the Gold (power-residue) PRF: odd divisor g of p-1 and modulus p.

GoldPrfParams512

Gold PRF parameters at 512-bit pilot modulus.

LegendrePrfParams256

Parameters for the Legendre PRF over (\mathbb{F}_p) with p a safe prime.

LegendrePrfParams512

Parameters for the Legendre PRF at the 512-bit pilot modulus.

Constants

P256_BE_HEX

256-bit pilot: p (255-bit safe prime), big-endian hex.

P512_BE_HEX

512-bit pilot: p (511-bit safe prime), big-endian hex.

Functions

u256_from_le_bytes

Parse a little-endian field element; must be < p for valid keys.

u256_to_le_bytes

Encode a field element as fixed little-endian bytes (for wire formats / digests).

u512_from_le_bytes

Parse U512 from little-endian bytes.

u512_to_le_bytes

Encode a U512 as little-endian bytes.