More explanation on : rCbf76acbf0da6: ecc: Add input validation for X25519.
points B1, B2:
there are two of this y and -y
point C1, C2 (not on the curve):
x=0x7fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffec (== -1 mod p) order=4 there are two of this y and -y.
x=0x00b8495f16056286fdb1329ceb8d09da6ac49ff1fae35616aeb8413b7c7aebe0 order=8 there are two of this y and -y.
point E1, E2:
x=0x57119fd0dd4e22d8868e1c58c45c44045bef839c55b1d0b1248c50a3bc959c5f order =8 there are two of this y and -y.
subgroup (1): O
subgroup (2): O, A
subgroup (4): O, A, B1, B2
subgroup (4): O, A, C1, C2 (C1, C2 are not on the curve)
subgroup (8): O, A, B1, B2, D1, D2, E1, E2
subgroup (p): O, G, G^2, ..., G^(p-1)
subgroup (2p): O, AG, AG^2, ..., AG^(p-1)
subgroup (4p): O, BxG, BxG^2, ..., BxG^(p-1)
subgroup (8p): O, Dx(or Ex)G, ..., (Dx(or Ex)G^(p-1)
I'll merge T3358: Curve specific field computation routines into libgcrypto 1.9.
I'll work for OpenPGPcard v3.3, this week.