More explanation on : rCbf76acbf0da6: ecc: Add input validation for X25519.

point A:
x=0x0000000000000000000000000000000000000000000000000000000000000000
y=0
order=2

points B1, B2:

x=0x0000000000000000000000000000000000000000000000000000000000000001

order=4
there are two of this y and -y

point C1, C2 (not on the curve):

x=0x7fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffec (== -1 mod p)
order=4
there are two of this y and -y.

point D1, D2:

x=0x00b8495f16056286fdb1329ceb8d09da6ac49ff1fae35616aeb8413b7c7aebe0
order=8
there are two of this y and -y.

point E1, E2:

x=0x57119fd0dd4e22d8868e1c58c45c44045bef839c55b1d0b1248c50a3bc959c5f
order =8
there are two of this y and -y.

subgroup (1): O
subgroup (2): O, A
subgroup (4): O, A, B1, B2
subgroup (4): O, A, C1, C2 (C1, C2 are not on the curve)
subgroup (8): O, A, B1, B2, D1, D2, E1, E2
subgroup (p): O, G, G^2, ..., G^(p-1)
subgroup (2p): O, AG, AG^2, ..., AG^(p-1)
subgroup (4p): O, BxG, BxG^2, ..., BxG^(p-1)
subgroup (8p): O, Dx(or Ex)G, ..., (Dx(or Ex)G^(p-1)

I'll merge T3358: Curve specific field computation routines into libgcrypto 1.9.
I'll work for OpenPGPcard v3.3, this week.