From 5afb8c91ca959cacca84cb6c462a3debec8aa560 Mon Sep 17 00:00:00 2001
From: SI <si@local>
Date: Sun, 20 Aug 2023 01:20:23 +0000
Subject: [PATCH] implement a proper flag encoder tool as an HTML+JS app

---
 flag_encoder/bn.js                       | 3547 ++++++++++++++++++++++
 flag_encoder/index.html                  |   67 +
 flag_encoder/nano-ethereum-signer-mod.js | 2579 ++++++++++++++++
 3 files changed, 6193 insertions(+)
 create mode 100644 flag_encoder/bn.js
 create mode 100644 flag_encoder/index.html
 create mode 100644 flag_encoder/nano-ethereum-signer-mod.js

diff --git a/flag_encoder/bn.js b/flag_encoder/bn.js
new file mode 100644
index 0000000..adecc94
--- /dev/null
+++ b/flag_encoder/bn.js
@@ -0,0 +1,3547 @@
+(function (module, exports) {
+  'use strict';
+
+  // Utils
+  function assert (val, msg) {
+    if (!val) throw new Error(msg || 'Assertion failed');
+  }
+
+  // Could use `inherits` module, but don't want to move from single file
+  // architecture yet.
+  function inherits (ctor, superCtor) {
+    ctor.super_ = superCtor;
+    var TempCtor = function () {};
+    TempCtor.prototype = superCtor.prototype;
+    ctor.prototype = new TempCtor();
+    ctor.prototype.constructor = ctor;
+  }
+
+  // BN
+
+  function BN (number, base, endian) {
+    if (BN.isBN(number)) {
+      return number;
+    }
+
+    this.negative = 0;
+    this.words = null;
+    this.length = 0;
+
+    // Reduction context
+    this.red = null;
+
+    if (number !== null) {
+      if (base === 'le' || base === 'be') {
+        endian = base;
+        base = 10;
+      }
+
+      this._init(number || 0, base || 10, endian || 'be');
+    }
+  }
+  if (typeof module === 'object') {
+    module.exports = BN;
+  } else {
+    exports.BN = BN;
+  }
+
+  BN.BN = BN;
+  BN.wordSize = 26;
+
+  var Buffer;
+  try {
+    if (typeof window !== 'undefined' && typeof window.Buffer !== 'undefined') {
+      Buffer = window.Buffer;
+    } else {
+      Buffer = require('buffer').Buffer;
+    }
+  } catch (e) {
+  }
+
+  BN.isBN = function isBN (num) {
+    if (num instanceof BN) {
+      return true;
+    }
+
+    return num !== null && typeof num === 'object' &&
+      num.constructor.wordSize === BN.wordSize && Array.isArray(num.words);
+  };
+
+  BN.max = function max (left, right) {
+    if (left.cmp(right) > 0) return left;
+    return right;
+  };
+
+  BN.min = function min (left, right) {
+    if (left.cmp(right) < 0) return left;
+    return right;
+  };
+
+  BN.prototype._init = function init (number, base, endian) {
+    if (typeof number === 'number') {
+      return this._initNumber(number, base, endian);
+    }
+
+    if (typeof number === 'object') {
+      return this._initArray(number, base, endian);
+    }
+
+    if (base === 'hex') {
+      base = 16;
+    }
+    assert(base === (base | 0) && base >= 2 && base <= 36);
+
+    number = number.toString().replace(/\s+/g, '');
+    var start = 0;
+    if (number[0] === '-') {
+      start++;
+      this.negative = 1;
+    }
+
+    if (start < number.length) {
+      if (base === 16) {
+        this._parseHex(number, start, endian);
+      } else {
+        this._parseBase(number, base, start);
+        if (endian === 'le') {
+          this._initArray(this.toArray(), base, endian);
+        }
+      }
+    }
+  };
+
+  BN.prototype._initNumber = function _initNumber (number, base, endian) {
+    if (number < 0) {
+      this.negative = 1;
+      number = -number;
+    }
+    if (number < 0x4000000) {
+      this.words = [number & 0x3ffffff];
+      this.length = 1;
+    } else if (number < 0x10000000000000) {
+      this.words = [
+        number & 0x3ffffff,
+        (number / 0x4000000) & 0x3ffffff
+      ];
+      this.length = 2;
+    } else {
+      assert(number < 0x20000000000000); // 2 ^ 53 (unsafe)
+      this.words = [
+        number & 0x3ffffff,
+        (number / 0x4000000) & 0x3ffffff,
+        1
+      ];
+      this.length = 3;
+    }
+
+    if (endian !== 'le') return;
+
+    // Reverse the bytes
+    this._initArray(this.toArray(), base, endian);
+  };
+
+  BN.prototype._initArray = function _initArray (number, base, endian) {
+    // Perhaps a Uint8Array
+    assert(typeof number.length === 'number');
+    if (number.length <= 0) {
+      this.words = [0];
+      this.length = 1;
+      return this;
+    }
+
+    this.length = Math.ceil(number.length / 3);
+    this.words = new Array(this.length);
+    for (var i = 0; i < this.length; i++) {
+      this.words[i] = 0;
+    }
+
+    var j, w;
+    var off = 0;
+    if (endian === 'be') {
+      for (i = number.length - 1, j = 0; i >= 0; i -= 3) {
+        w = number[i] | (number[i - 1] << 8) | (number[i - 2] << 16);
+        this.words[j] |= (w << off) & 0x3ffffff;
+        this.words[j + 1] = (w >>> (26 - off)) & 0x3ffffff;
+        off += 24;
+        if (off >= 26) {
+          off -= 26;
+          j++;
+        }
+      }
+    } else if (endian === 'le') {
+      for (i = 0, j = 0; i < number.length; i += 3) {
+        w = number[i] | (number[i + 1] << 8) | (number[i + 2] << 16);
+        this.words[j] |= (w << off) & 0x3ffffff;
+        this.words[j + 1] = (w >>> (26 - off)) & 0x3ffffff;
+        off += 24;
+        if (off >= 26) {
+          off -= 26;
+          j++;
+        }
+      }
+    }
+    return this._strip();
+  };
+
+  function parseHex4Bits (string, index) {
+    var c = string.charCodeAt(index);
+    // '0' - '9'
+    if (c >= 48 && c <= 57) {
+      return c - 48;
+    // 'A' - 'F'
+    } else if (c >= 65 && c <= 70) {
+      return c - 55;
+    // 'a' - 'f'
+    } else if (c >= 97 && c <= 102) {
+      return c - 87;
+    } else {
+      assert(false, 'Invalid character in ' + string);
+    }
+  }
+
+  function parseHexByte (string, lowerBound, index) {
+    var r = parseHex4Bits(string, index);
+    if (index - 1 >= lowerBound) {
+      r |= parseHex4Bits(string, index - 1) << 4;
+    }
+    return r;
+  }
+
+  BN.prototype._parseHex = function _parseHex (number, start, endian) {
+    // Create possibly bigger array to ensure that it fits the number
+    this.length = Math.ceil((number.length - start) / 6);
+    this.words = new Array(this.length);
+    for (var i = 0; i < this.length; i++) {
+      this.words[i] = 0;
+    }
+
+    // 24-bits chunks
+    var off = 0;
+    var j = 0;
+
+    var w;
+    if (endian === 'be') {
+      for (i = number.length - 1; i >= start; i -= 2) {
+        w = parseHexByte(number, start, i) << off;
+        this.words[j] |= w & 0x3ffffff;
+        if (off >= 18) {
+          off -= 18;
+          j += 1;
+          this.words[j] |= w >>> 26;
+        } else {
+          off += 8;
+        }
+      }
+    } else {
+      var parseLength = number.length - start;
+      for (i = parseLength % 2 === 0 ? start + 1 : start; i < number.length; i += 2) {
+        w = parseHexByte(number, start, i) << off;
+        this.words[j] |= w & 0x3ffffff;
+        if (off >= 18) {
+          off -= 18;
+          j += 1;
+          this.words[j] |= w >>> 26;
+        } else {
+          off += 8;
+        }
+      }
+    }
+
+    this._strip();
+  };
+
+  function parseBase (str, start, end, mul) {
+    var r = 0;
+    var b = 0;
+    var len = Math.min(str.length, end);
+    for (var i = start; i < len; i++) {
+      var c = str.charCodeAt(i) - 48;
+
+      r *= mul;
+
+      // 'a'
+      if (c >= 49) {
+        b = c - 49 + 0xa;
+
+      // 'A'
+      } else if (c >= 17) {
+        b = c - 17 + 0xa;
+
+      // '0' - '9'
+      } else {
+        b = c;
+      }
+      assert(c >= 0 && b < mul, 'Invalid character');
+      r += b;
+    }
+    return r;
+  }
+
+  BN.prototype._parseBase = function _parseBase (number, base, start) {
+    // Initialize as zero
+    this.words = [0];
+    this.length = 1;
+
+    // Find length of limb in base
+    for (var limbLen = 0, limbPow = 1; limbPow <= 0x3ffffff; limbPow *= base) {
+      limbLen++;
+    }
+    limbLen--;
+    limbPow = (limbPow / base) | 0;
+
+    var total = number.length - start;
+    var mod = total % limbLen;
+    var end = Math.min(total, total - mod) + start;
+
+    var word = 0;
+    for (var i = start; i < end; i += limbLen) {
+      word = parseBase(number, i, i + limbLen, base);
+
+      this.imuln(limbPow);
+      if (this.words[0] + word < 0x4000000) {
+        this.words[0] += word;
+      } else {
+        this._iaddn(word);
+      }
+    }
+
+    if (mod !== 0) {
+      var pow = 1;
+      word = parseBase(number, i, number.length, base);
+
+      for (i = 0; i < mod; i++) {
+        pow *= base;
+      }
+
+      this.imuln(pow);
+      if (this.words[0] + word < 0x4000000) {
+        this.words[0] += word;
+      } else {
+        this._iaddn(word);
+      }
+    }
+
+    this._strip();
+  };
+
+  BN.prototype.copy = function copy (dest) {
+    dest.words = new Array(this.length);
+    for (var i = 0; i < this.length; i++) {
+      dest.words[i] = this.words[i];
+    }
+    dest.length = this.length;
+    dest.negative = this.negative;
+    dest.red = this.red;
+  };
+
+  function move (dest, src) {
+    dest.words = src.words;
+    dest.length = src.length;
+    dest.negative = src.negative;
+    dest.red = src.red;
+  }
+
+  BN.prototype._move = function _move (dest) {
+    move(dest, this);
+  };
+
+  BN.prototype.clone = function clone () {
+    var r = new BN(null);
+    this.copy(r);
+    return r;
+  };
+
+  BN.prototype._expand = function _expand (size) {
+    while (this.length < size) {
+      this.words[this.length++] = 0;
+    }
+    return this;
+  };
+
+  // Remove leading `0` from `this`
+  BN.prototype._strip = function strip () {
+    while (this.length > 1 && this.words[this.length - 1] === 0) {
+      this.length--;
+    }
+    return this._normSign();
+  };
+
+  BN.prototype._normSign = function _normSign () {
+    // -0 = 0
+    if (this.length === 1 && this.words[0] === 0) {
+      this.negative = 0;
+    }
+    return this;
+  };
+
+  // Check Symbol.for because not everywhere where Symbol defined
+  // See https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Symbol#Browser_compatibility
+  if (typeof Symbol !== 'undefined' && typeof Symbol.for === 'function') {
+    try {
+      BN.prototype[Symbol.for('nodejs.util.inspect.custom')] = inspect;
+    } catch (e) {
+      BN.prototype.inspect = inspect;
+    }
+  } else {
+    BN.prototype.inspect = inspect;
+  }
+
+  function inspect () {
+    return (this.red ? '<BN-R: ' : '<BN: ') + this.toString(16) + '>';
+  }
+
+  /*
+
+  var zeros = [];
+  var groupSizes = [];
+  var groupBases = [];
+
+  var s = '';
+  var i = -1;
+  while (++i < BN.wordSize) {
+    zeros[i] = s;
+    s += '0';
+  }
+  groupSizes[0] = 0;
+  groupSizes[1] = 0;
+  groupBases[0] = 0;
+  groupBases[1] = 0;
+  var base = 2 - 1;
+  while (++base < 36 + 1) {
+    var groupSize = 0;
+    var groupBase = 1;
+    while (groupBase < (1 << BN.wordSize) / base) {
+      groupBase *= base;
+      groupSize += 1;
+    }
+    groupSizes[base] = groupSize;
+    groupBases[base] = groupBase;
+  }
+
+  */
+
+  var zeros = [
+    '',
+    '0',
+    '00',
+    '000',
+    '0000',
+    '00000',
+    '000000',
+    '0000000',
+    '00000000',
+    '000000000',
+    '0000000000',
+    '00000000000',
+    '000000000000',
+    '0000000000000',
+    '00000000000000',
+    '000000000000000',
+    '0000000000000000',
+    '00000000000000000',
+    '000000000000000000',
+    '0000000000000000000',
+    '00000000000000000000',
+    '000000000000000000000',
+    '0000000000000000000000',
+    '00000000000000000000000',
+    '000000000000000000000000',
+    '0000000000000000000000000'
+  ];
+
+  var groupSizes = [
+    0, 0,
+    25, 16, 12, 11, 10, 9, 8,
+    8, 7, 7, 7, 7, 6, 6,
+    6, 6, 6, 6, 6, 5, 5,
+    5, 5, 5, 5, 5, 5, 5,
+    5, 5, 5, 5, 5, 5, 5
+  ];
+
+  var groupBases = [
+    0, 0,
+    33554432, 43046721, 16777216, 48828125, 60466176, 40353607, 16777216,
+    43046721, 10000000, 19487171, 35831808, 62748517, 7529536, 11390625,
+    16777216, 24137569, 34012224, 47045881, 64000000, 4084101, 5153632,
+    6436343, 7962624, 9765625, 11881376, 14348907, 17210368, 20511149,
+    24300000, 28629151, 33554432, 39135393, 45435424, 52521875, 60466176
+  ];
+
+  BN.prototype.toString = function toString (base, padding) {
+    base = base || 10;
+    padding = padding | 0 || 1;
+
+    var out;
+    if (base === 16 || base === 'hex') {
+      out = '';
+      var off = 0;
+      var carry = 0;
+      for (var i = 0; i < this.length; i++) {
+        var w = this.words[i];
+        var word = (((w << off) | carry) & 0xffffff).toString(16);
+        carry = (w >>> (24 - off)) & 0xffffff;
+        off += 2;
+        if (off >= 26) {
+          off -= 26;
+          i--;
+        }
+        if (carry !== 0 || i !== this.length - 1) {
+          out = zeros[6 - word.length] + word + out;
+        } else {
+          out = word + out;
+        }
+      }
+      if (carry !== 0) {
+        out = carry.toString(16) + out;
+      }
+      while (out.length % padding !== 0) {
+        out = '0' + out;
+      }
+      if (this.negative !== 0) {
+        out = '-' + out;
+      }
+      return out;
+    }
+
+    if (base === (base | 0) && base >= 2 && base <= 36) {
+      // var groupSize = Math.floor(BN.wordSize * Math.LN2 / Math.log(base));
+      var groupSize = groupSizes[base];
+      // var groupBase = Math.pow(base, groupSize);
+      var groupBase = groupBases[base];
+      out = '';
+      var c = this.clone();
+      c.negative = 0;
+      while (!c.isZero()) {
+        var r = c.modrn(groupBase).toString(base);
+        c = c.idivn(groupBase);
+
+        if (!c.isZero()) {
+          out = zeros[groupSize - r.length] + r + out;
+        } else {
+          out = r + out;
+        }
+      }
+      if (this.isZero()) {
+        out = '0' + out;
+      }
+      while (out.length % padding !== 0) {
+        out = '0' + out;
+      }
+      if (this.negative !== 0) {
+        out = '-' + out;
+      }
+      return out;
+    }
+
+    assert(false, 'Base should be between 2 and 36');
+  };
+
+  BN.prototype.toNumber = function toNumber () {
+    var ret = this.words[0];
+    if (this.length === 2) {
+      ret += this.words[1] * 0x4000000;
+    } else if (this.length === 3 && this.words[2] === 0x01) {
+      // NOTE: at this stage it is known that the top bit is set
+      ret += 0x10000000000000 + (this.words[1] * 0x4000000);
+    } else if (this.length > 2) {
+      assert(false, 'Number can only safely store up to 53 bits');
+    }
+    return (this.negative !== 0) ? -ret : ret;
+  };
+
+  BN.prototype.toJSON = function toJSON () {
+    return this.toString(16, 2);
+  };
+
+  if (Buffer) {
+    BN.prototype.toBuffer = function toBuffer (endian, length) {
+      return this.toArrayLike(Buffer, endian, length);
+    };
+  }
+
+  BN.prototype.toArray = function toArray (endian, length) {
+    return this.toArrayLike(Array, endian, length);
+  };
+
+  var allocate = function allocate (ArrayType, size) {
+    if (ArrayType.allocUnsafe) {
+      return ArrayType.allocUnsafe(size);
+    }
+    return new ArrayType(size);
+  };
+
+  BN.prototype.toArrayLike = function toArrayLike (ArrayType, endian, length) {
+    this._strip();
+
+    var byteLength = this.byteLength();
+    var reqLength = length || Math.max(1, byteLength);
+    assert(byteLength <= reqLength, 'byte array longer than desired length');
+    assert(reqLength > 0, 'Requested array length <= 0');
+
+    var res = allocate(ArrayType, reqLength);
+    var postfix = endian === 'le' ? 'LE' : 'BE';
+    this['_toArrayLike' + postfix](res, byteLength);
+    return res;
+  };
+
+  BN.prototype._toArrayLikeLE = function _toArrayLikeLE (res, byteLength) {
+    var position = 0;
+    var carry = 0;
+
+    for (var i = 0, shift = 0; i < this.length; i++) {
+      var word = (this.words[i] << shift) | carry;
+
+      res[position++] = word & 0xff;
+      if (position < res.length) {
+        res[position++] = (word >> 8) & 0xff;
+      }
+      if (position < res.length) {
+        res[position++] = (word >> 16) & 0xff;
+      }
+
+      if (shift === 6) {
+        if (position < res.length) {
+          res[position++] = (word >> 24) & 0xff;
+        }
+        carry = 0;
+        shift = 0;
+      } else {
+        carry = word >>> 24;
+        shift += 2;
+      }
+    }
+
+    if (position < res.length) {
+      res[position++] = carry;
+
+      while (position < res.length) {
+        res[position++] = 0;
+      }
+    }
+  };
+
+  BN.prototype._toArrayLikeBE = function _toArrayLikeBE (res, byteLength) {
+    var position = res.length - 1;
+    var carry = 0;
+
+    for (var i = 0, shift = 0; i < this.length; i++) {
+      var word = (this.words[i] << shift) | carry;
+
+      res[position--] = word & 0xff;
+      if (position >= 0) {
+        res[position--] = (word >> 8) & 0xff;
+      }
+      if (position >= 0) {
+        res[position--] = (word >> 16) & 0xff;
+      }
+
+      if (shift === 6) {
+        if (position >= 0) {
+          res[position--] = (word >> 24) & 0xff;
+        }
+        carry = 0;
+        shift = 0;
+      } else {
+        carry = word >>> 24;
+        shift += 2;
+      }
+    }
+
+    if (position >= 0) {
+      res[position--] = carry;
+
+      while (position >= 0) {
+        res[position--] = 0;
+      }
+    }
+  };
+
+  if (Math.clz32) {
+    BN.prototype._countBits = function _countBits (w) {
+      return 32 - Math.clz32(w);
+    };
+  } else {
+    BN.prototype._countBits = function _countBits (w) {
+      var t = w;
+      var r = 0;
+      if (t >= 0x1000) {
+        r += 13;
+        t >>>= 13;
+      }
+      if (t >= 0x40) {
+        r += 7;
+        t >>>= 7;
+      }
+      if (t >= 0x8) {
+        r += 4;
+        t >>>= 4;
+      }
+      if (t >= 0x02) {
+        r += 2;
+        t >>>= 2;
+      }
+      return r + t;
+    };
+  }
+
+  BN.prototype._zeroBits = function _zeroBits (w) {
+    // Short-cut
+    if (w === 0) return 26;
+
+    var t = w;
+    var r = 0;
+    if ((t & 0x1fff) === 0) {
+      r += 13;
+      t >>>= 13;
+    }
+    if ((t & 0x7f) === 0) {
+      r += 7;
+      t >>>= 7;
+    }
+    if ((t & 0xf) === 0) {
+      r += 4;
+      t >>>= 4;
+    }
+    if ((t & 0x3) === 0) {
+      r += 2;
+      t >>>= 2;
+    }
+    if ((t & 0x1) === 0) {
+      r++;
+    }
+    return r;
+  };
+
+  // Return number of used bits in a BN
+  BN.prototype.bitLength = function bitLength () {
+    var w = this.words[this.length - 1];
+    var hi = this._countBits(w);
+    return (this.length - 1) * 26 + hi;
+  };
+
+  function toBitArray (num) {
+    var w = new Array(num.bitLength());
+
+    for (var bit = 0; bit < w.length; bit++) {
+      var off = (bit / 26) | 0;
+      var wbit = bit % 26;
+
+      w[bit] = (num.words[off] >>> wbit) & 0x01;
+    }
+
+    return w;
+  }
+
+  // Number of trailing zero bits
+  BN.prototype.zeroBits = function zeroBits () {
+    if (this.isZero()) return 0;
+
+    var r = 0;
+    for (var i = 0; i < this.length; i++) {
+      var b = this._zeroBits(this.words[i]);
+      r += b;
+      if (b !== 26) break;
+    }
+    return r;
+  };
+
+  BN.prototype.byteLength = function byteLength () {
+    return Math.ceil(this.bitLength() / 8);
+  };
+
+  BN.prototype.toTwos = function toTwos (width) {
+    if (this.negative !== 0) {
+      return this.abs().inotn(width).iaddn(1);
+    }
+    return this.clone();
+  };
+
+  BN.prototype.fromTwos = function fromTwos (width) {
+    if (this.testn(width - 1)) {
+      return this.notn(width).iaddn(1).ineg();
+    }
+    return this.clone();
+  };
+
+  BN.prototype.isNeg = function isNeg () {
+    return this.negative !== 0;
+  };
+
+  // Return negative clone of `this`
+  BN.prototype.neg = function neg () {
+    return this.clone().ineg();
+  };
+
+  BN.prototype.ineg = function ineg () {
+    if (!this.isZero()) {
+      this.negative ^= 1;
+    }
+
+    return this;
+  };
+
+  // Or `num` with `this` in-place
+  BN.prototype.iuor = function iuor (num) {
+    while (this.length < num.length) {
+      this.words[this.length++] = 0;
+    }
+
+    for (var i = 0; i < num.length; i++) {
+      this.words[i] = this.words[i] | num.words[i];
+    }
+
+    return this._strip();
+  };
+
+  BN.prototype.ior = function ior (num) {
+    assert((this.negative | num.negative) === 0);
+    return this.iuor(num);
+  };
+
+  // Or `num` with `this`
+  BN.prototype.or = function or (num) {
+    if (this.length > num.length) return this.clone().ior(num);
+    return num.clone().ior(this);
+  };
+
+  BN.prototype.uor = function uor (num) {
+    if (this.length > num.length) return this.clone().iuor(num);
+    return num.clone().iuor(this);
+  };
+
+  // And `num` with `this` in-place
+  BN.prototype.iuand = function iuand (num) {
+    // b = min-length(num, this)
+    var b;
+    if (this.length > num.length) {
+      b = num;
+    } else {
+      b = this;
+    }
+
+    for (var i = 0; i < b.length; i++) {
+      this.words[i] = this.words[i] & num.words[i];
+    }
+
+    this.length = b.length;
+
+    return this._strip();
+  };
+
+  BN.prototype.iand = function iand (num) {
+    assert((this.negative | num.negative) === 0);
+    return this.iuand(num);
+  };
+
+  // And `num` with `this`
+  BN.prototype.and = function and (num) {
+    if (this.length > num.length) return this.clone().iand(num);
+    return num.clone().iand(this);
+  };
+
+  BN.prototype.uand = function uand (num) {
+    if (this.length > num.length) return this.clone().iuand(num);
+    return num.clone().iuand(this);
+  };
+
+  // Xor `num` with `this` in-place
+  BN.prototype.iuxor = function iuxor (num) {
+    // a.length > b.length
+    var a;
+    var b;
+    if (this.length > num.length) {
+      a = this;
+      b = num;
+    } else {
+      a = num;
+      b = this;
+    }
+
+    for (var i = 0; i < b.length; i++) {
+      this.words[i] = a.words[i] ^ b.words[i];
+    }
+
+    if (this !== a) {
+      for (; i < a.length; i++) {
+        this.words[i] = a.words[i];
+      }
+    }
+
+    this.length = a.length;
+
+    return this._strip();
+  };
+
+  BN.prototype.ixor = function ixor (num) {
+    assert((this.negative | num.negative) === 0);
+    return this.iuxor(num);
+  };
+
+  // Xor `num` with `this`
+  BN.prototype.xor = function xor (num) {
+    if (this.length > num.length) return this.clone().ixor(num);
+    return num.clone().ixor(this);
+  };
+
+  BN.prototype.uxor = function uxor (num) {
+    if (this.length > num.length) return this.clone().iuxor(num);
+    return num.clone().iuxor(this);
+  };
+
+  // Not ``this`` with ``width`` bitwidth
+  BN.prototype.inotn = function inotn (width) {
+    assert(typeof width === 'number' && width >= 0);
+
+    var bytesNeeded = Math.ceil(width / 26) | 0;
+    var bitsLeft = width % 26;
+
+    // Extend the buffer with leading zeroes
+    this._expand(bytesNeeded);
+
+    if (bitsLeft > 0) {
+      bytesNeeded--;
+    }
+
+    // Handle complete words
+    for (var i = 0; i < bytesNeeded; i++) {
+      this.words[i] = ~this.words[i] & 0x3ffffff;
+    }
+
+    // Handle the residue
+    if (bitsLeft > 0) {
+      this.words[i] = ~this.words[i] & (0x3ffffff >> (26 - bitsLeft));
+    }
+
+    // And remove leading zeroes
+    return this._strip();
+  };
+
+  BN.prototype.notn = function notn (width) {
+    return this.clone().inotn(width);
+  };
+
+  // Set `bit` of `this`
+  BN.prototype.setn = function setn (bit, val) {
+    assert(typeof bit === 'number' && bit >= 0);
+
+    var off = (bit / 26) | 0;
+    var wbit = bit % 26;
+
+    this._expand(off + 1);
+
+    if (val) {
+      this.words[off] = this.words[off] | (1 << wbit);
+    } else {
+      this.words[off] = this.words[off] & ~(1 << wbit);
+    }
+
+    return this._strip();
+  };
+
+  // Add `num` to `this` in-place
+  BN.prototype.iadd = function iadd (num) {
+    var r;
+
+    // negative + positive
+    if (this.negative !== 0 && num.negative === 0) {
+      this.negative = 0;
+      r = this.isub(num);
+      this.negative ^= 1;
+      return this._normSign();
+
+    // positive + negative
+    } else if (this.negative === 0 && num.negative !== 0) {
+      num.negative = 0;
+      r = this.isub(num);
+      num.negative = 1;
+      return r._normSign();
+    }
+
+    // a.length > b.length
+    var a, b;
+    if (this.length > num.length) {
+      a = this;
+      b = num;
+    } else {
+      a = num;
+      b = this;
+    }
+
+    var carry = 0;
+    for (var i = 0; i < b.length; i++) {
+      r = (a.words[i] | 0) + (b.words[i] | 0) + carry;
+      this.words[i] = r & 0x3ffffff;
+      carry = r >>> 26;
+    }
+    for (; carry !== 0 && i < a.length; i++) {
+      r = (a.words[i] | 0) + carry;
+      this.words[i] = r & 0x3ffffff;
+      carry = r >>> 26;
+    }
+
+    this.length = a.length;
+    if (carry !== 0) {
+      this.words[this.length] = carry;
+      this.length++;
+    // Copy the rest of the words
+    } else if (a !== this) {
+      for (; i < a.length; i++) {
+        this.words[i] = a.words[i];
+      }
+    }
+
+    return this;
+  };
+
+  // Add `num` to `this`
+  BN.prototype.add = function add (num) {
+    var res;
+    if (num.negative !== 0 && this.negative === 0) {
+      num.negative = 0;
+      res = this.sub(num);
+      num.negative ^= 1;
+      return res;
+    } else if (num.negative === 0 && this.negative !== 0) {
+      this.negative = 0;
+      res = num.sub(this);
+      this.negative = 1;
+      return res;
+    }
+
+    if (this.length > num.length) return this.clone().iadd(num);
+
+    return num.clone().iadd(this);
+  };
+
+  // Subtract `num` from `this` in-place
+  BN.prototype.isub = function isub (num) {
+    // this - (-num) = this + num
+    if (num.negative !== 0) {
+      num.negative = 0;
+      var r = this.iadd(num);
+      num.negative = 1;
+      return r._normSign();
+
+    // -this - num = -(this + num)
+    } else if (this.negative !== 0) {
+      this.negative = 0;
+      this.iadd(num);
+      this.negative = 1;
+      return this._normSign();
+    }
+
+    // At this point both numbers are positive
+    var cmp = this.cmp(num);
+
+    // Optimization - zeroify
+    if (cmp === 0) {
+      this.negative = 0;
+      this.length = 1;
+      this.words[0] = 0;
+      return this;
+    }
+
+    // a > b
+    var a, b;
+    if (cmp > 0) {
+      a = this;
+      b = num;
+    } else {
+      a = num;
+      b = this;
+    }
+
+    var carry = 0;
+    for (var i = 0; i < b.length; i++) {
+      r = (a.words[i] | 0) - (b.words[i] | 0) + carry;
+      carry = r >> 26;
+      this.words[i] = r & 0x3ffffff;
+    }
+    for (; carry !== 0 && i < a.length; i++) {
+      r = (a.words[i] | 0) + carry;
+      carry = r >> 26;
+      this.words[i] = r & 0x3ffffff;
+    }
+
+    // Copy rest of the words
+    if (carry === 0 && i < a.length && a !== this) {
+      for (; i < a.length; i++) {
+        this.words[i] = a.words[i];
+      }
+    }
+
+    this.length = Math.max(this.length, i);
+
+    if (a !== this) {
+      this.negative = 1;
+    }
+
+    return this._strip();
+  };
+
+  // Subtract `num` from `this`
+  BN.prototype.sub = function sub (num) {
+    return this.clone().isub(num);
+  };
+
+  function smallMulTo (self, num, out) {
+    out.negative = num.negative ^ self.negative;
+    var len = (self.length + num.length) | 0;
+    out.length = len;
+    len = (len - 1) | 0;
+
+    // Peel one iteration (compiler can't do it, because of code complexity)
+    var a = self.words[0] | 0;
+    var b = num.words[0] | 0;
+    var r = a * b;
+
+    var lo = r & 0x3ffffff;
+    var carry = (r / 0x4000000) | 0;
+    out.words[0] = lo;
+
+    for (var k = 1; k < len; k++) {
+      // Sum all words with the same `i + j = k` and accumulate `ncarry`,
+      // note that ncarry could be >= 0x3ffffff
+      var ncarry = carry >>> 26;
+      var rword = carry & 0x3ffffff;
+      var maxJ = Math.min(k, num.length - 1);
+      for (var j = Math.max(0, k - self.length + 1); j <= maxJ; j++) {
+        var i = (k - j) | 0;
+        a = self.words[i] | 0;
+        b = num.words[j] | 0;
+        r = a * b + rword;
+        ncarry += (r / 0x4000000) | 0;
+        rword = r & 0x3ffffff;
+      }
+      out.words[k] = rword | 0;
+      carry = ncarry | 0;
+    }
+    if (carry !== 0) {
+      out.words[k] = carry | 0;
+    } else {
+      out.length--;
+    }
+
+    return out._strip();
+  }
+
+  // TODO(indutny): it may be reasonable to omit it for users who don't need
+  // to work with 256-bit numbers, otherwise it gives 20% improvement for 256-bit
+  // multiplication (like elliptic secp256k1).
+  var comb10MulTo = function comb10MulTo (self, num, out) {
+    var a = self.words;
+    var b = num.words;
+    var o = out.words;
+    var c = 0;
+    var lo;
+    var mid;
+    var hi;
+    var a0 = a[0] | 0;
+    var al0 = a0 & 0x1fff;
+    var ah0 = a0 >>> 13;
+    var a1 = a[1] | 0;
+    var al1 = a1 & 0x1fff;
+    var ah1 = a1 >>> 13;
+    var a2 = a[2] | 0;
+    var al2 = a2 & 0x1fff;
+    var ah2 = a2 >>> 13;
+    var a3 = a[3] | 0;
+    var al3 = a3 & 0x1fff;
+    var ah3 = a3 >>> 13;
+    var a4 = a[4] | 0;
+    var al4 = a4 & 0x1fff;
+    var ah4 = a4 >>> 13;
+    var a5 = a[5] | 0;
+    var al5 = a5 & 0x1fff;
+    var ah5 = a5 >>> 13;
+    var a6 = a[6] | 0;
+    var al6 = a6 & 0x1fff;
+    var ah6 = a6 >>> 13;
+    var a7 = a[7] | 0;
+    var al7 = a7 & 0x1fff;
+    var ah7 = a7 >>> 13;
+    var a8 = a[8] | 0;
+    var al8 = a8 & 0x1fff;
+    var ah8 = a8 >>> 13;
+    var a9 = a[9] | 0;
+    var al9 = a9 & 0x1fff;
+    var ah9 = a9 >>> 13;
+    var b0 = b[0] | 0;
+    var bl0 = b0 & 0x1fff;
+    var bh0 = b0 >>> 13;
+    var b1 = b[1] | 0;
+    var bl1 = b1 & 0x1fff;
+    var bh1 = b1 >>> 13;
+    var b2 = b[2] | 0;
+    var bl2 = b2 & 0x1fff;
+    var bh2 = b2 >>> 13;
+    var b3 = b[3] | 0;
+    var bl3 = b3 & 0x1fff;
+    var bh3 = b3 >>> 13;
+    var b4 = b[4] | 0;
+    var bl4 = b4 & 0x1fff;
+    var bh4 = b4 >>> 13;
+    var b5 = b[5] | 0;
+    var bl5 = b5 & 0x1fff;
+    var bh5 = b5 >>> 13;
+    var b6 = b[6] | 0;
+    var bl6 = b6 & 0x1fff;
+    var bh6 = b6 >>> 13;
+    var b7 = b[7] | 0;
+    var bl7 = b7 & 0x1fff;
+    var bh7 = b7 >>> 13;
+    var b8 = b[8] | 0;
+    var bl8 = b8 & 0x1fff;
+    var bh8 = b8 >>> 13;
+    var b9 = b[9] | 0;
+    var bl9 = b9 & 0x1fff;
+    var bh9 = b9 >>> 13;
+
+    out.negative = self.negative ^ num.negative;
+    out.length = 19;
+    /* k = 0 */
+    lo = Math.imul(al0, bl0);
+    mid = Math.imul(al0, bh0);
+    mid = (mid + Math.imul(ah0, bl0)) | 0;
+    hi = Math.imul(ah0, bh0);
+    var w0 = (((c + lo) | 0) + ((mid & 0x1fff) << 13)) | 0;
+    c = (((hi + (mid >>> 13)) | 0) + (w0 >>> 26)) | 0;
+    w0 &= 0x3ffffff;
+    /* k = 1 */
+    lo = Math.imul(al1, bl0);
+    mid = Math.imul(al1, bh0);
+    mid = (mid + Math.imul(ah1, bl0)) | 0;
+    hi = Math.imul(ah1, bh0);
+    lo = (lo + Math.imul(al0, bl1)) | 0;
+    mid = (mid + Math.imul(al0, bh1)) | 0;
+    mid = (mid + Math.imul(ah0, bl1)) | 0;
+    hi = (hi + Math.imul(ah0, bh1)) | 0;
+    var w1 = (((c + lo) | 0) + ((mid & 0x1fff) << 13)) | 0;
+    c = (((hi + (mid >>> 13)) | 0) + (w1 >>> 26)) | 0;
+    w1 &= 0x3ffffff;
+    /* k = 2 */
+    lo = Math.imul(al2, bl0);
+    mid = Math.imul(al2, bh0);
+    mid = (mid + Math.imul(ah2, bl0)) | 0;
+    hi = Math.imul(ah2, bh0);
+    lo = (lo + Math.imul(al1, bl1)) | 0;
+    mid = (mid + Math.imul(al1, bh1)) | 0;
+    mid = (mid + Math.imul(ah1, bl1)) | 0;
+    hi = (hi + Math.imul(ah1, bh1)) | 0;
+    lo = (lo + Math.imul(al0, bl2)) | 0;
+    mid = (mid + Math.imul(al0, bh2)) | 0;
+    mid = (mid + Math.imul(ah0, bl2)) | 0;
+    hi = (hi + Math.imul(ah0, bh2)) | 0;
+    var w2 = (((c + lo) | 0) + ((mid & 0x1fff) << 13)) | 0;
+    c = (((hi + (mid >>> 13)) | 0) + (w2 >>> 26)) | 0;
+    w2 &= 0x3ffffff;
+    /* k = 3 */
+    lo = Math.imul(al3, bl0);
+    mid = Math.imul(al3, bh0);
+    mid = (mid + Math.imul(ah3, bl0)) | 0;
+    hi = Math.imul(ah3, bh0);
+    lo = (lo + Math.imul(al2, bl1)) | 0;
+    mid = (mid + Math.imul(al2, bh1)) | 0;
+    mid = (mid + Math.imul(ah2, bl1)) | 0;
+    hi = (hi + Math.imul(ah2, bh1)) | 0;
+    lo = (lo + Math.imul(al1, bl2)) | 0;
+    mid = (mid + Math.imul(al1, bh2)) | 0;
+    mid = (mid + Math.imul(ah1, bl2)) | 0;
+    hi = (hi + Math.imul(ah1, bh2)) | 0;
+    lo = (lo + Math.imul(al0, bl3)) | 0;
+    mid = (mid + Math.imul(al0, bh3)) | 0;
+    mid = (mid + Math.imul(ah0, bl3)) | 0;
+    hi = (hi + Math.imul(ah0, bh3)) | 0;
+    var w3 = (((c + lo) | 0) + ((mid & 0x1fff) << 13)) | 0;
+    c = (((hi + (mid >>> 13)) | 0) + (w3 >>> 26)) | 0;
+    w3 &= 0x3ffffff;
+    /* k = 4 */
+    lo = Math.imul(al4, bl0);
+    mid = Math.imul(al4, bh0);
+    mid = (mid + Math.imul(ah4, bl0)) | 0;
+    hi = Math.imul(ah4, bh0);
+    lo = (lo + Math.imul(al3, bl1)) | 0;
+    mid = (mid + Math.imul(al3, bh1)) | 0;
+    mid = (mid + Math.imul(ah3, bl1)) | 0;
+    hi = (hi + Math.imul(ah3, bh1)) | 0;
+    lo = (lo + Math.imul(al2, bl2)) | 0;
+    mid = (mid + Math.imul(al2, bh2)) | 0;
+    mid = (mid + Math.imul(ah2, bl2)) | 0;
+    hi = (hi + Math.imul(ah2, bh2)) | 0;
+    lo = (lo + Math.imul(al1, bl3)) | 0;
+    mid = (mid + Math.imul(al1, bh3)) | 0;
+    mid = (mid + Math.imul(ah1, bl3)) | 0;
+    hi = (hi + Math.imul(ah1, bh3)) | 0;
+    lo = (lo + Math.imul(al0, bl4)) | 0;
+    mid = (mid + Math.imul(al0, bh4)) | 0;
+    mid = (mid + Math.imul(ah0, bl4)) | 0;
+    hi = (hi + Math.imul(ah0, bh4)) | 0;
+    var w4 = (((c + lo) | 0) + ((mid & 0x1fff) << 13)) | 0;
+    c = (((hi + (mid >>> 13)) | 0) + (w4 >>> 26)) | 0;
+    w4 &= 0x3ffffff;
+    /* k = 5 */
+    lo = Math.imul(al5, bl0);
+    mid = Math.imul(al5, bh0);
+    mid = (mid + Math.imul(ah5, bl0)) | 0;
+    hi = Math.imul(ah5, bh0);
+    lo = (lo + Math.imul(al4, bl1)) | 0;
+    mid = (mid + Math.imul(al4, bh1)) | 0;
+    mid = (mid + Math.imul(ah4, bl1)) | 0;
+    hi = (hi + Math.imul(ah4, bh1)) | 0;
+    lo = (lo + Math.imul(al3, bl2)) | 0;
+    mid = (mid + Math.imul(al3, bh2)) | 0;
+    mid = (mid + Math.imul(ah3, bl2)) | 0;
+    hi = (hi + Math.imul(ah3, bh2)) | 0;
+    lo = (lo + Math.imul(al2, bl3)) | 0;
+    mid = (mid + Math.imul(al2, bh3)) | 0;
+    mid = (mid + Math.imul(ah2, bl3)) | 0;
+    hi = (hi + Math.imul(ah2, bh3)) | 0;
+    lo = (lo + Math.imul(al1, bl4)) | 0;
+    mid = (mid + Math.imul(al1, bh4)) | 0;
+    mid = (mid + Math.imul(ah1, bl4)) | 0;
+    hi = (hi + Math.imul(ah1, bh4)) | 0;
+    lo = (lo + Math.imul(al0, bl5)) | 0;
+    mid = (mid + Math.imul(al0, bh5)) | 0;
+    mid = (mid + Math.imul(ah0, bl5)) | 0;
+    hi = (hi + Math.imul(ah0, bh5)) | 0;
+    var w5 = (((c + lo) | 0) + ((mid & 0x1fff) << 13)) | 0;
+    c = (((hi + (mid >>> 13)) | 0) + (w5 >>> 26)) | 0;
+    w5 &= 0x3ffffff;
+    /* k = 6 */
+    lo = Math.imul(al6, bl0);
+    mid = Math.imul(al6, bh0);
+    mid = (mid + Math.imul(ah6, bl0)) | 0;
+    hi = Math.imul(ah6, bh0);
+    lo = (lo + Math.imul(al5, bl1)) | 0;
+    mid = (mid + Math.imul(al5, bh1)) | 0;
+    mid = (mid + Math.imul(ah5, bl1)) | 0;
+    hi = (hi + Math.imul(ah5, bh1)) | 0;
+    lo = (lo + Math.imul(al4, bl2)) | 0;
+    mid = (mid + Math.imul(al4, bh2)) | 0;
+    mid = (mid + Math.imul(ah4, bl2)) | 0;
+    hi = (hi + Math.imul(ah4, bh2)) | 0;
+    lo = (lo + Math.imul(al3, bl3)) | 0;
+    mid = (mid + Math.imul(al3, bh3)) | 0;
+    mid = (mid + Math.imul(ah3, bl3)) | 0;
+    hi = (hi + Math.imul(ah3, bh3)) | 0;
+    lo = (lo + Math.imul(al2, bl4)) | 0;
+    mid = (mid + Math.imul(al2, bh4)) | 0;
+    mid = (mid + Math.imul(ah2, bl4)) | 0;
+    hi = (hi + Math.imul(ah2, bh4)) | 0;
+    lo = (lo + Math.imul(al1, bl5)) | 0;
+    mid = (mid + Math.imul(al1, bh5)) | 0;
+    mid = (mid + Math.imul(ah1, bl5)) | 0;
+    hi = (hi + Math.imul(ah1, bh5)) | 0;
+    lo = (lo + Math.imul(al0, bl6)) | 0;
+    mid = (mid + Math.imul(al0, bh6)) | 0;
+    mid = (mid + Math.imul(ah0, bl6)) | 0;
+    hi = (hi + Math.imul(ah0, bh6)) | 0;
+    var w6 = (((c + lo) | 0) + ((mid & 0x1fff) << 13)) | 0;
+    c = (((hi + (mid >>> 13)) | 0) + (w6 >>> 26)) | 0;
+    w6 &= 0x3ffffff;
+    /* k = 7 */
+    lo = Math.imul(al7, bl0);
+    mid = Math.imul(al7, bh0);
+    mid = (mid + Math.imul(ah7, bl0)) | 0;
+    hi = Math.imul(ah7, bh0);
+    lo = (lo + Math.imul(al6, bl1)) | 0;
+    mid = (mid + Math.imul(al6, bh1)) | 0;
+    mid = (mid + Math.imul(ah6, bl1)) | 0;
+    hi = (hi + Math.imul(ah6, bh1)) | 0;
+    lo = (lo + Math.imul(al5, bl2)) | 0;
+    mid = (mid + Math.imul(al5, bh2)) | 0;
+    mid = (mid + Math.imul(ah5, bl2)) | 0;
+    hi = (hi + Math.imul(ah5, bh2)) | 0;
+    lo = (lo + Math.imul(al4, bl3)) | 0;
+    mid = (mid + Math.imul(al4, bh3)) | 0;
+    mid = (mid + Math.imul(ah4, bl3)) | 0;
+    hi = (hi + Math.imul(ah4, bh3)) | 0;
+    lo = (lo + Math.imul(al3, bl4)) | 0;
+    mid = (mid + Math.imul(al3, bh4)) | 0;
+    mid = (mid + Math.imul(ah3, bl4)) | 0;
+    hi = (hi + Math.imul(ah3, bh4)) | 0;
+    lo = (lo + Math.imul(al2, bl5)) | 0;
+    mid = (mid + Math.imul(al2, bh5)) | 0;
+    mid = (mid + Math.imul(ah2, bl5)) | 0;
+    hi = (hi + Math.imul(ah2, bh5)) | 0;
+    lo = (lo + Math.imul(al1, bl6)) | 0;
+    mid = (mid + Math.imul(al1, bh6)) | 0;
+    mid = (mid + Math.imul(ah1, bl6)) | 0;
+    hi = (hi + Math.imul(ah1, bh6)) | 0;
+    lo = (lo + Math.imul(al0, bl7)) | 0;
+    mid = (mid + Math.imul(al0, bh7)) | 0;
+    mid = (mid + Math.imul(ah0, bl7)) | 0;
+    hi = (hi + Math.imul(ah0, bh7)) | 0;
+    var w7 = (((c + lo) | 0) + ((mid & 0x1fff) << 13)) | 0;
+    c = (((hi + (mid >>> 13)) | 0) + (w7 >>> 26)) | 0;
+    w7 &= 0x3ffffff;
+    /* k = 8 */
+    lo = Math.imul(al8, bl0);
+    mid = Math.imul(al8, bh0);
+    mid = (mid + Math.imul(ah8, bl0)) | 0;
+    hi = Math.imul(ah8, bh0);
+    lo = (lo + Math.imul(al7, bl1)) | 0;
+    mid = (mid + Math.imul(al7, bh1)) | 0;
+    mid = (mid + Math.imul(ah7, bl1)) | 0;
+    hi = (hi + Math.imul(ah7, bh1)) | 0;
+    lo = (lo + Math.imul(al6, bl2)) | 0;
+    mid = (mid + Math.imul(al6, bh2)) | 0;
+    mid = (mid + Math.imul(ah6, bl2)) | 0;
+    hi = (hi + Math.imul(ah6, bh2)) | 0;
+    lo = (lo + Math.imul(al5, bl3)) | 0;
+    mid = (mid + Math.imul(al5, bh3)) | 0;
+    mid = (mid + Math.imul(ah5, bl3)) | 0;
+    hi = (hi + Math.imul(ah5, bh3)) | 0;
+    lo = (lo + Math.imul(al4, bl4)) | 0;
+    mid = (mid + Math.imul(al4, bh4)) | 0;
+    mid = (mid + Math.imul(ah4, bl4)) | 0;
+    hi = (hi + Math.imul(ah4, bh4)) | 0;
+    lo = (lo + Math.imul(al3, bl5)) | 0;
+    mid = (mid + Math.imul(al3, bh5)) | 0;
+    mid = (mid + Math.imul(ah3, bl5)) | 0;
+    hi = (hi + Math.imul(ah3, bh5)) | 0;
+    lo = (lo + Math.imul(al2, bl6)) | 0;
+    mid = (mid + Math.imul(al2, bh6)) | 0;
+    mid = (mid + Math.imul(ah2, bl6)) | 0;
+    hi = (hi + Math.imul(ah2, bh6)) | 0;
+    lo = (lo + Math.imul(al1, bl7)) | 0;
+    mid = (mid + Math.imul(al1, bh7)) | 0;
+    mid = (mid + Math.imul(ah1, bl7)) | 0;
+    hi = (hi + Math.imul(ah1, bh7)) | 0;
+    lo = (lo + Math.imul(al0, bl8)) | 0;
+    mid = (mid + Math.imul(al0, bh8)) | 0;
+    mid = (mid + Math.imul(ah0, bl8)) | 0;
+    hi = (hi + Math.imul(ah0, bh8)) | 0;
+    var w8 = (((c + lo) | 0) + ((mid & 0x1fff) << 13)) | 0;
+    c = (((hi + (mid >>> 13)) | 0) + (w8 >>> 26)) | 0;
+    w8 &= 0x3ffffff;
+    /* k = 9 */
+    lo = Math.imul(al9, bl0);
+    mid = Math.imul(al9, bh0);
+    mid = (mid + Math.imul(ah9, bl0)) | 0;
+    hi = Math.imul(ah9, bh0);
+    lo = (lo + Math.imul(al8, bl1)) | 0;
+    mid = (mid + Math.imul(al8, bh1)) | 0;
+    mid = (mid + Math.imul(ah8, bl1)) | 0;
+    hi = (hi + Math.imul(ah8, bh1)) | 0;
+    lo = (lo + Math.imul(al7, bl2)) | 0;
+    mid = (mid + Math.imul(al7, bh2)) | 0;
+    mid = (mid + Math.imul(ah7, bl2)) | 0;
+    hi = (hi + Math.imul(ah7, bh2)) | 0;
+    lo = (lo + Math.imul(al6, bl3)) | 0;
+    mid = (mid + Math.imul(al6, bh3)) | 0;
+    mid = (mid + Math.imul(ah6, bl3)) | 0;
+    hi = (hi + Math.imul(ah6, bh3)) | 0;
+    lo = (lo + Math.imul(al5, bl4)) | 0;
+    mid = (mid + Math.imul(al5, bh4)) | 0;
+    mid = (mid + Math.imul(ah5, bl4)) | 0;
+    hi = (hi + Math.imul(ah5, bh4)) | 0;
+    lo = (lo + Math.imul(al4, bl5)) | 0;
+    mid = (mid + Math.imul(al4, bh5)) | 0;
+    mid = (mid + Math.imul(ah4, bl5)) | 0;
+    hi = (hi + Math.imul(ah4, bh5)) | 0;
+    lo = (lo + Math.imul(al3, bl6)) | 0;
+    mid = (mid + Math.imul(al3, bh6)) | 0;
+    mid = (mid + Math.imul(ah3, bl6)) | 0;
+    hi = (hi + Math.imul(ah3, bh6)) | 0;
+    lo = (lo + Math.imul(al2, bl7)) | 0;
+    mid = (mid + Math.imul(al2, bh7)) | 0;
+    mid = (mid + Math.imul(ah2, bl7)) | 0;
+    hi = (hi + Math.imul(ah2, bh7)) | 0;
+    lo = (lo + Math.imul(al1, bl8)) | 0;
+    mid = (mid + Math.imul(al1, bh8)) | 0;
+    mid = (mid + Math.imul(ah1, bl8)) | 0;
+    hi = (hi + Math.imul(ah1, bh8)) | 0;
+    lo = (lo + Math.imul(al0, bl9)) | 0;
+    mid = (mid + Math.imul(al0, bh9)) | 0;
+    mid = (mid + Math.imul(ah0, bl9)) | 0;
+    hi = (hi + Math.imul(ah0, bh9)) | 0;
+    var w9 = (((c + lo) | 0) + ((mid & 0x1fff) << 13)) | 0;
+    c = (((hi + (mid >>> 13)) | 0) + (w9 >>> 26)) | 0;
+    w9 &= 0x3ffffff;
+    /* k = 10 */
+    lo = Math.imul(al9, bl1);
+    mid = Math.imul(al9, bh1);
+    mid = (mid + Math.imul(ah9, bl1)) | 0;
+    hi = Math.imul(ah9, bh1);
+    lo = (lo + Math.imul(al8, bl2)) | 0;
+    mid = (mid + Math.imul(al8, bh2)) | 0;
+    mid = (mid + Math.imul(ah8, bl2)) | 0;
+    hi = (hi + Math.imul(ah8, bh2)) | 0;
+    lo = (lo + Math.imul(al7, bl3)) | 0;
+    mid = (mid + Math.imul(al7, bh3)) | 0;
+    mid = (mid + Math.imul(ah7, bl3)) | 0;
+    hi = (hi + Math.imul(ah7, bh3)) | 0;
+    lo = (lo + Math.imul(al6, bl4)) | 0;
+    mid = (mid + Math.imul(al6, bh4)) | 0;
+    mid = (mid + Math.imul(ah6, bl4)) | 0;
+    hi = (hi + Math.imul(ah6, bh4)) | 0;
+    lo = (lo + Math.imul(al5, bl5)) | 0;
+    mid = (mid + Math.imul(al5, bh5)) | 0;
+    mid = (mid + Math.imul(ah5, bl5)) | 0;
+    hi = (hi + Math.imul(ah5, bh5)) | 0;
+    lo = (lo + Math.imul(al4, bl6)) | 0;
+    mid = (mid + Math.imul(al4, bh6)) | 0;
+    mid = (mid + Math.imul(ah4, bl6)) | 0;
+    hi = (hi + Math.imul(ah4, bh6)) | 0;
+    lo = (lo + Math.imul(al3, bl7)) | 0;
+    mid = (mid + Math.imul(al3, bh7)) | 0;
+    mid = (mid + Math.imul(ah3, bl7)) | 0;
+    hi = (hi + Math.imul(ah3, bh7)) | 0;
+    lo = (lo + Math.imul(al2, bl8)) | 0;
+    mid = (mid + Math.imul(al2, bh8)) | 0;
+    mid = (mid + Math.imul(ah2, bl8)) | 0;
+    hi = (hi + Math.imul(ah2, bh8)) | 0;
+    lo = (lo + Math.imul(al1, bl9)) | 0;
+    mid = (mid + Math.imul(al1, bh9)) | 0;
+    mid = (mid + Math.imul(ah1, bl9)) | 0;
+    hi = (hi + Math.imul(ah1, bh9)) | 0;
+    var w10 = (((c + lo) | 0) + ((mid & 0x1fff) << 13)) | 0;
+    c = (((hi + (mid >>> 13)) | 0) + (w10 >>> 26)) | 0;
+    w10 &= 0x3ffffff;
+    /* k = 11 */
+    lo = Math.imul(al9, bl2);
+    mid = Math.imul(al9, bh2);
+    mid = (mid + Math.imul(ah9, bl2)) | 0;
+    hi = Math.imul(ah9, bh2);
+    lo = (lo + Math.imul(al8, bl3)) | 0;
+    mid = (mid + Math.imul(al8, bh3)) | 0;
+    mid = (mid + Math.imul(ah8, bl3)) | 0;
+    hi = (hi + Math.imul(ah8, bh3)) | 0;
+    lo = (lo + Math.imul(al7, bl4)) | 0;
+    mid = (mid + Math.imul(al7, bh4)) | 0;
+    mid = (mid + Math.imul(ah7, bl4)) | 0;
+    hi = (hi + Math.imul(ah7, bh4)) | 0;
+    lo = (lo + Math.imul(al6, bl5)) | 0;
+    mid = (mid + Math.imul(al6, bh5)) | 0;
+    mid = (mid + Math.imul(ah6, bl5)) | 0;
+    hi = (hi + Math.imul(ah6, bh5)) | 0;
+    lo = (lo + Math.imul(al5, bl6)) | 0;
+    mid = (mid + Math.imul(al5, bh6)) | 0;
+    mid = (mid + Math.imul(ah5, bl6)) | 0;
+    hi = (hi + Math.imul(ah5, bh6)) | 0;
+    lo = (lo + Math.imul(al4, bl7)) | 0;
+    mid = (mid + Math.imul(al4, bh7)) | 0;
+    mid = (mid + Math.imul(ah4, bl7)) | 0;
+    hi = (hi + Math.imul(ah4, bh7)) | 0;
+    lo = (lo + Math.imul(al3, bl8)) | 0;
+    mid = (mid + Math.imul(al3, bh8)) | 0;
+    mid = (mid + Math.imul(ah3, bl8)) | 0;
+    hi = (hi + Math.imul(ah3, bh8)) | 0;
+    lo = (lo + Math.imul(al2, bl9)) | 0;
+    mid = (mid + Math.imul(al2, bh9)) | 0;
+    mid = (mid + Math.imul(ah2, bl9)) | 0;
+    hi = (hi + Math.imul(ah2, bh9)) | 0;
+    var w11 = (((c + lo) | 0) + ((mid & 0x1fff) << 13)) | 0;
+    c = (((hi + (mid >>> 13)) | 0) + (w11 >>> 26)) | 0;
+    w11 &= 0x3ffffff;
+    /* k = 12 */
+    lo = Math.imul(al9, bl3);
+    mid = Math.imul(al9, bh3);
+    mid = (mid + Math.imul(ah9, bl3)) | 0;
+    hi = Math.imul(ah9, bh3);
+    lo = (lo + Math.imul(al8, bl4)) | 0;
+    mid = (mid + Math.imul(al8, bh4)) | 0;
+    mid = (mid + Math.imul(ah8, bl4)) | 0;
+    hi = (hi + Math.imul(ah8, bh4)) | 0;
+    lo = (lo + Math.imul(al7, bl5)) | 0;
+    mid = (mid + Math.imul(al7, bh5)) | 0;
+    mid = (mid + Math.imul(ah7, bl5)) | 0;
+    hi = (hi + Math.imul(ah7, bh5)) | 0;
+    lo = (lo + Math.imul(al6, bl6)) | 0;
+    mid = (mid + Math.imul(al6, bh6)) | 0;
+    mid = (mid + Math.imul(ah6, bl6)) | 0;
+    hi = (hi + Math.imul(ah6, bh6)) | 0;
+    lo = (lo + Math.imul(al5, bl7)) | 0;
+    mid = (mid + Math.imul(al5, bh7)) | 0;
+    mid = (mid + Math.imul(ah5, bl7)) | 0;
+    hi = (hi + Math.imul(ah5, bh7)) | 0;
+    lo = (lo + Math.imul(al4, bl8)) | 0;
+    mid = (mid + Math.imul(al4, bh8)) | 0;
+    mid = (mid + Math.imul(ah4, bl8)) | 0;
+    hi = (hi + Math.imul(ah4, bh8)) | 0;
+    lo = (lo + Math.imul(al3, bl9)) | 0;
+    mid = (mid + Math.imul(al3, bh9)) | 0;
+    mid = (mid + Math.imul(ah3, bl9)) | 0;
+    hi = (hi + Math.imul(ah3, bh9)) | 0;
+    var w12 = (((c + lo) | 0) + ((mid & 0x1fff) << 13)) | 0;
+    c = (((hi + (mid >>> 13)) | 0) + (w12 >>> 26)) | 0;
+    w12 &= 0x3ffffff;
+    /* k = 13 */
+    lo = Math.imul(al9, bl4);
+    mid = Math.imul(al9, bh4);
+    mid = (mid + Math.imul(ah9, bl4)) | 0;
+    hi = Math.imul(ah9, bh4);
+    lo = (lo + Math.imul(al8, bl5)) | 0;
+    mid = (mid + Math.imul(al8, bh5)) | 0;
+    mid = (mid + Math.imul(ah8, bl5)) | 0;
+    hi = (hi + Math.imul(ah8, bh5)) | 0;
+    lo = (lo + Math.imul(al7, bl6)) | 0;
+    mid = (mid + Math.imul(al7, bh6)) | 0;
+    mid = (mid + Math.imul(ah7, bl6)) | 0;
+    hi = (hi + Math.imul(ah7, bh6)) | 0;
+    lo = (lo + Math.imul(al6, bl7)) | 0;
+    mid = (mid + Math.imul(al6, bh7)) | 0;
+    mid = (mid + Math.imul(ah6, bl7)) | 0;
+    hi = (hi + Math.imul(ah6, bh7)) | 0;
+    lo = (lo + Math.imul(al5, bl8)) | 0;
+    mid = (mid + Math.imul(al5, bh8)) | 0;
+    mid = (mid + Math.imul(ah5, bl8)) | 0;
+    hi = (hi + Math.imul(ah5, bh8)) | 0;
+    lo = (lo + Math.imul(al4, bl9)) | 0;
+    mid = (mid + Math.imul(al4, bh9)) | 0;
+    mid = (mid + Math.imul(ah4, bl9)) | 0;
+    hi = (hi + Math.imul(ah4, bh9)) | 0;
+    var w13 = (((c + lo) | 0) + ((mid & 0x1fff) << 13)) | 0;
+    c = (((hi + (mid >>> 13)) | 0) + (w13 >>> 26)) | 0;
+    w13 &= 0x3ffffff;
+    /* k = 14 */
+    lo = Math.imul(al9, bl5);
+    mid = Math.imul(al9, bh5);
+    mid = (mid + Math.imul(ah9, bl5)) | 0;
+    hi = Math.imul(ah9, bh5);
+    lo = (lo + Math.imul(al8, bl6)) | 0;
+    mid = (mid + Math.imul(al8, bh6)) | 0;
+    mid = (mid + Math.imul(ah8, bl6)) | 0;
+    hi = (hi + Math.imul(ah8, bh6)) | 0;
+    lo = (lo + Math.imul(al7, bl7)) | 0;
+    mid = (mid + Math.imul(al7, bh7)) | 0;
+    mid = (mid + Math.imul(ah7, bl7)) | 0;
+    hi = (hi + Math.imul(ah7, bh7)) | 0;
+    lo = (lo + Math.imul(al6, bl8)) | 0;
+    mid = (mid + Math.imul(al6, bh8)) | 0;
+    mid = (mid + Math.imul(ah6, bl8)) | 0;
+    hi = (hi + Math.imul(ah6, bh8)) | 0;
+    lo = (lo + Math.imul(al5, bl9)) | 0;
+    mid = (mid + Math.imul(al5, bh9)) | 0;
+    mid = (mid + Math.imul(ah5, bl9)) | 0;
+    hi = (hi + Math.imul(ah5, bh9)) | 0;
+    var w14 = (((c + lo) | 0) + ((mid & 0x1fff) << 13)) | 0;
+    c = (((hi + (mid >>> 13)) | 0) + (w14 >>> 26)) | 0;
+    w14 &= 0x3ffffff;
+    /* k = 15 */
+    lo = Math.imul(al9, bl6);
+    mid = Math.imul(al9, bh6);
+    mid = (mid + Math.imul(ah9, bl6)) | 0;
+    hi = Math.imul(ah9, bh6);
+    lo = (lo + Math.imul(al8, bl7)) | 0;
+    mid = (mid + Math.imul(al8, bh7)) | 0;
+    mid = (mid + Math.imul(ah8, bl7)) | 0;
+    hi = (hi + Math.imul(ah8, bh7)) | 0;
+    lo = (lo + Math.imul(al7, bl8)) | 0;
+    mid = (mid + Math.imul(al7, bh8)) | 0;
+    mid = (mid + Math.imul(ah7, bl8)) | 0;
+    hi = (hi + Math.imul(ah7, bh8)) | 0;
+    lo = (lo + Math.imul(al6, bl9)) | 0;
+    mid = (mid + Math.imul(al6, bh9)) | 0;
+    mid = (mid + Math.imul(ah6, bl9)) | 0;
+    hi = (hi + Math.imul(ah6, bh9)) | 0;
+    var w15 = (((c + lo) | 0) + ((mid & 0x1fff) << 13)) | 0;
+    c = (((hi + (mid >>> 13)) | 0) + (w15 >>> 26)) | 0;
+    w15 &= 0x3ffffff;
+    /* k = 16 */
+    lo = Math.imul(al9, bl7);
+    mid = Math.imul(al9, bh7);
+    mid = (mid + Math.imul(ah9, bl7)) | 0;
+    hi = Math.imul(ah9, bh7);
+    lo = (lo + Math.imul(al8, bl8)) | 0;
+    mid = (mid + Math.imul(al8, bh8)) | 0;
+    mid = (mid + Math.imul(ah8, bl8)) | 0;
+    hi = (hi + Math.imul(ah8, bh8)) | 0;
+    lo = (lo + Math.imul(al7, bl9)) | 0;
+    mid = (mid + Math.imul(al7, bh9)) | 0;
+    mid = (mid + Math.imul(ah7, bl9)) | 0;
+    hi = (hi + Math.imul(ah7, bh9)) | 0;
+    var w16 = (((c + lo) | 0) + ((mid & 0x1fff) << 13)) | 0;
+    c = (((hi + (mid >>> 13)) | 0) + (w16 >>> 26)) | 0;
+    w16 &= 0x3ffffff;
+    /* k = 17 */
+    lo = Math.imul(al9, bl8);
+    mid = Math.imul(al9, bh8);
+    mid = (mid + Math.imul(ah9, bl8)) | 0;
+    hi = Math.imul(ah9, bh8);
+    lo = (lo + Math.imul(al8, bl9)) | 0;
+    mid = (mid + Math.imul(al8, bh9)) | 0;
+    mid = (mid + Math.imul(ah8, bl9)) | 0;
+    hi = (hi + Math.imul(ah8, bh9)) | 0;
+    var w17 = (((c + lo) | 0) + ((mid & 0x1fff) << 13)) | 0;
+    c = (((hi + (mid >>> 13)) | 0) + (w17 >>> 26)) | 0;
+    w17 &= 0x3ffffff;
+    /* k = 18 */
+    lo = Math.imul(al9, bl9);
+    mid = Math.imul(al9, bh9);
+    mid = (mid + Math.imul(ah9, bl9)) | 0;
+    hi = Math.imul(ah9, bh9);
+    var w18 = (((c + lo) | 0) + ((mid & 0x1fff) << 13)) | 0;
+    c = (((hi + (mid >>> 13)) | 0) + (w18 >>> 26)) | 0;
+    w18 &= 0x3ffffff;
+    o[0] = w0;
+    o[1] = w1;
+    o[2] = w2;
+    o[3] = w3;
+    o[4] = w4;
+    o[5] = w5;
+    o[6] = w6;
+    o[7] = w7;
+    o[8] = w8;
+    o[9] = w9;
+    o[10] = w10;
+    o[11] = w11;
+    o[12] = w12;
+    o[13] = w13;
+    o[14] = w14;
+    o[15] = w15;
+    o[16] = w16;
+    o[17] = w17;
+    o[18] = w18;
+    if (c !== 0) {
+      o[19] = c;
+      out.length++;
+    }
+    return out;
+  };
+
+  // Polyfill comb
+  if (!Math.imul) {
+    comb10MulTo = smallMulTo;
+  }
+
+  function bigMulTo (self, num, out) {
+    out.negative = num.negative ^ self.negative;
+    out.length = self.length + num.length;
+
+    var carry = 0;
+    var hncarry = 0;
+    for (var k = 0; k < out.length - 1; k++) {
+      // Sum all words with the same `i + j = k` and accumulate `ncarry`,
+      // note that ncarry could be >= 0x3ffffff
+      var ncarry = hncarry;
+      hncarry = 0;
+      var rword = carry & 0x3ffffff;
+      var maxJ = Math.min(k, num.length - 1);
+      for (var j = Math.max(0, k - self.length + 1); j <= maxJ; j++) {
+        var i = k - j;
+        var a = self.words[i] | 0;
+        var b = num.words[j] | 0;
+        var r = a * b;
+
+        var lo = r & 0x3ffffff;
+        ncarry = (ncarry + ((r / 0x4000000) | 0)) | 0;
+        lo = (lo + rword) | 0;
+        rword = lo & 0x3ffffff;
+        ncarry = (ncarry + (lo >>> 26)) | 0;
+
+        hncarry += ncarry >>> 26;
+        ncarry &= 0x3ffffff;
+      }
+      out.words[k] = rword;
+      carry = ncarry;
+      ncarry = hncarry;
+    }
+    if (carry !== 0) {
+      out.words[k] = carry;
+    } else {
+      out.length--;
+    }
+
+    return out._strip();
+  }
+
+  function jumboMulTo (self, num, out) {
+    // Temporary disable, see https://github.com/indutny/bn.js/issues/211
+    // var fftm = new FFTM();
+    // return fftm.mulp(self, num, out);
+    return bigMulTo(self, num, out);
+  }
+
+  BN.prototype.mulTo = function mulTo (num, out) {
+    var res;
+    var len = this.length + num.length;
+    if (this.length === 10 && num.length === 10) {
+      res = comb10MulTo(this, num, out);
+    } else if (len < 63) {
+      res = smallMulTo(this, num, out);
+    } else if (len < 1024) {
+      res = bigMulTo(this, num, out);
+    } else {
+      res = jumboMulTo(this, num, out);
+    }
+
+    return res;
+  };
+
+  // Cooley-Tukey algorithm for FFT
+  // slightly revisited to rely on looping instead of recursion
+
+  function FFTM (x, y) {
+    this.x = x;
+    this.y = y;
+  }
+
+  FFTM.prototype.makeRBT = function makeRBT (N) {
+    var t = new Array(N);
+    var l = BN.prototype._countBits(N) - 1;
+    for (var i = 0; i < N; i++) {
+      t[i] = this.revBin(i, l, N);
+    }
+
+    return t;
+  };
+
+  // Returns binary-reversed representation of `x`
+  FFTM.prototype.revBin = function revBin (x, l, N) {
+    if (x === 0 || x === N - 1) return x;
+
+    var rb = 0;
+    for (var i = 0; i < l; i++) {
+      rb |= (x & 1) << (l - i - 1);
+      x >>= 1;
+    }
+
+    return rb;
+  };
+
+  // Performs "tweedling" phase, therefore 'emulating'
+  // behaviour of the recursive algorithm
+  FFTM.prototype.permute = function permute (rbt, rws, iws, rtws, itws, N) {
+    for (var i = 0; i < N; i++) {
+      rtws[i] = rws[rbt[i]];
+      itws[i] = iws[rbt[i]];
+    }
+  };
+
+  FFTM.prototype.transform = function transform (rws, iws, rtws, itws, N, rbt) {
+    this.permute(rbt, rws, iws, rtws, itws, N);
+
+    for (var s = 1; s < N; s <<= 1) {
+      var l = s << 1;
+
+      var rtwdf = Math.cos(2 * Math.PI / l);
+      var itwdf = Math.sin(2 * Math.PI / l);
+
+      for (var p = 0; p < N; p += l) {
+        var rtwdf_ = rtwdf;
+        var itwdf_ = itwdf;
+
+        for (var j = 0; j < s; j++) {
+          var re = rtws[p + j];
+          var ie = itws[p + j];
+
+          var ro = rtws[p + j + s];
+          var io = itws[p + j + s];
+
+          var rx = rtwdf_ * ro - itwdf_ * io;
+
+          io = rtwdf_ * io + itwdf_ * ro;
+          ro = rx;
+
+          rtws[p + j] = re + ro;
+          itws[p + j] = ie + io;
+
+          rtws[p + j + s] = re - ro;
+          itws[p + j + s] = ie - io;
+
+          /* jshint maxdepth : false */
+          if (j !== l) {
+            rx = rtwdf * rtwdf_ - itwdf * itwdf_;
+
+            itwdf_ = rtwdf * itwdf_ + itwdf * rtwdf_;
+            rtwdf_ = rx;
+          }
+        }
+      }
+    }
+  };
+
+  FFTM.prototype.guessLen13b = function guessLen13b (n, m) {
+    var N = Math.max(m, n) | 1;
+    var odd = N & 1;
+    var i = 0;
+    for (N = N / 2 | 0; N; N = N >>> 1) {
+      i++;
+    }
+
+    return 1 << i + 1 + odd;
+  };
+
+  FFTM.prototype.conjugate = function conjugate (rws, iws, N) {
+    if (N <= 1) return;
+
+    for (var i = 0; i < N / 2; i++) {
+      var t = rws[i];
+
+      rws[i] = rws[N - i - 1];
+      rws[N - i - 1] = t;
+
+      t = iws[i];
+
+      iws[i] = -iws[N - i - 1];
+      iws[N - i - 1] = -t;
+    }
+  };
+
+  FFTM.prototype.normalize13b = function normalize13b (ws, N) {
+    var carry = 0;
+    for (var i = 0; i < N / 2; i++) {
+      var w = Math.round(ws[2 * i + 1] / N) * 0x2000 +
+        Math.round(ws[2 * i] / N) +
+        carry;
+
+      ws[i] = w & 0x3ffffff;
+
+      if (w < 0x4000000) {
+        carry = 0;
+      } else {
+        carry = w / 0x4000000 | 0;
+      }
+    }
+
+    return ws;
+  };
+
+  FFTM.prototype.convert13b = function convert13b (ws, len, rws, N) {
+    var carry = 0;
+    for (var i = 0; i < len; i++) {
+      carry = carry + (ws[i] | 0);
+
+      rws[2 * i] = carry & 0x1fff; carry = carry >>> 13;
+      rws[2 * i + 1] = carry & 0x1fff; carry = carry >>> 13;
+    }
+
+    // Pad with zeroes
+    for (i = 2 * len; i < N; ++i) {
+      rws[i] = 0;
+    }
+
+    assert(carry === 0);
+    assert((carry & ~0x1fff) === 0);
+  };
+
+  FFTM.prototype.stub = function stub (N) {
+    var ph = new Array(N);
+    for (var i = 0; i < N; i++) {
+      ph[i] = 0;
+    }
+
+    return ph;
+  };
+
+  FFTM.prototype.mulp = function mulp (x, y, out) {
+    var N = 2 * this.guessLen13b(x.length, y.length);
+
+    var rbt = this.makeRBT(N);
+
+    var _ = this.stub(N);
+
+    var rws = new Array(N);
+    var rwst = new Array(N);
+    var iwst = new Array(N);
+
+    var nrws = new Array(N);
+    var nrwst = new Array(N);
+    var niwst = new Array(N);
+
+    var rmws = out.words;
+    rmws.length = N;
+
+    this.convert13b(x.words, x.length, rws, N);
+    this.convert13b(y.words, y.length, nrws, N);
+
+    this.transform(rws, _, rwst, iwst, N, rbt);
+    this.transform(nrws, _, nrwst, niwst, N, rbt);
+
+    for (var i = 0; i < N; i++) {
+      var rx = rwst[i] * nrwst[i] - iwst[i] * niwst[i];
+      iwst[i] = rwst[i] * niwst[i] + iwst[i] * nrwst[i];
+      rwst[i] = rx;
+    }
+
+    this.conjugate(rwst, iwst, N);
+    this.transform(rwst, iwst, rmws, _, N, rbt);
+    this.conjugate(rmws, _, N);
+    this.normalize13b(rmws, N);
+
+    out.negative = x.negative ^ y.negative;
+    out.length = x.length + y.length;
+    return out._strip();
+  };
+
+  // Multiply `this` by `num`
+  BN.prototype.mul = function mul (num) {
+    var out = new BN(null);
+    out.words = new Array(this.length + num.length);
+    return this.mulTo(num, out);
+  };
+
+  // Multiply employing FFT
+  BN.prototype.mulf = function mulf (num) {
+    var out = new BN(null);
+    out.words = new Array(this.length + num.length);
+    return jumboMulTo(this, num, out);
+  };
+
+  // In-place Multiplication
+  BN.prototype.imul = function imul (num) {
+    return this.clone().mulTo(num, this);
+  };
+
+  BN.prototype.imuln = function imuln (num) {
+    var isNegNum = num < 0;
+    if (isNegNum) num = -num;
+
+    assert(typeof num === 'number');
+    assert(num < 0x4000000);
+
+    // Carry
+    var carry = 0;
+    for (var i = 0; i < this.length; i++) {
+      var w = (this.words[i] | 0) * num;
+      var lo = (w & 0x3ffffff) + (carry & 0x3ffffff);
+      carry >>= 26;
+      carry += (w / 0x4000000) | 0;
+      // NOTE: lo is 27bit maximum
+      carry += lo >>> 26;
+      this.words[i] = lo & 0x3ffffff;
+    }
+
+    if (carry !== 0) {
+      this.words[i] = carry;
+      this.length++;
+    }
+
+    return isNegNum ? this.ineg() : this;
+  };
+
+  BN.prototype.muln = function muln (num) {
+    return this.clone().imuln(num);
+  };
+
+  // `this` * `this`
+  BN.prototype.sqr = function sqr () {
+    return this.mul(this);
+  };
+
+  // `this` * `this` in-place
+  BN.prototype.isqr = function isqr () {
+    return this.imul(this.clone());
+  };
+
+  // Math.pow(`this`, `num`)
+  BN.prototype.pow = function pow (num) {
+    var w = toBitArray(num);
+    if (w.length === 0) return new BN(1);
+
+    // Skip leading zeroes
+    var res = this;
+    for (var i = 0; i < w.length; i++, res = res.sqr()) {
+      if (w[i] !== 0) break;
+    }
+
+    if (++i < w.length) {
+      for (var q = res.sqr(); i < w.length; i++, q = q.sqr()) {
+        if (w[i] === 0) continue;
+
+        res = res.mul(q);
+      }
+    }
+
+    return res;
+  };
+
+  // Shift-left in-place
+  BN.prototype.iushln = function iushln (bits) {
+    assert(typeof bits === 'number' && bits >= 0);
+    var r = bits % 26;
+    var s = (bits - r) / 26;
+    var carryMask = (0x3ffffff >>> (26 - r)) << (26 - r);
+    var i;
+
+    if (r !== 0) {
+      var carry = 0;
+
+      for (i = 0; i < this.length; i++) {
+        var newCarry = this.words[i] & carryMask;
+        var c = ((this.words[i] | 0) - newCarry) << r;
+        this.words[i] = c | carry;
+        carry = newCarry >>> (26 - r);
+      }
+
+      if (carry) {
+        this.words[i] = carry;
+        this.length++;
+      }
+    }
+
+    if (s !== 0) {
+      for (i = this.length - 1; i >= 0; i--) {
+        this.words[i + s] = this.words[i];
+      }
+
+      for (i = 0; i < s; i++) {
+        this.words[i] = 0;
+      }
+
+      this.length += s;
+    }
+
+    return this._strip();
+  };
+
+  BN.prototype.ishln = function ishln (bits) {
+    // TODO(indutny): implement me
+    assert(this.negative === 0);
+    return this.iushln(bits);
+  };
+
+  // Shift-right in-place
+  // NOTE: `hint` is a lowest bit before trailing zeroes
+  // NOTE: if `extended` is present - it will be filled with destroyed bits
+  BN.prototype.iushrn = function iushrn (bits, hint, extended) {
+    assert(typeof bits === 'number' && bits >= 0);
+    var h;
+    if (hint) {
+      h = (hint - (hint % 26)) / 26;
+    } else {
+      h = 0;
+    }
+
+    var r = bits % 26;
+    var s = Math.min((bits - r) / 26, this.length);
+    var mask = 0x3ffffff ^ ((0x3ffffff >>> r) << r);
+    var maskedWords = extended;
+
+    h -= s;
+    h = Math.max(0, h);
+
+    // Extended mode, copy masked part
+    if (maskedWords) {
+      for (var i = 0; i < s; i++) {
+        maskedWords.words[i] = this.words[i];
+      }
+      maskedWords.length = s;
+    }
+
+    if (s === 0) {
+      // No-op, we should not move anything at all
+    } else if (this.length > s) {
+      this.length -= s;
+      for (i = 0; i < this.length; i++) {
+        this.words[i] = this.words[i + s];
+      }
+    } else {
+      this.words[0] = 0;
+      this.length = 1;
+    }
+
+    var carry = 0;
+    for (i = this.length - 1; i >= 0 && (carry !== 0 || i >= h); i--) {
+      var word = this.words[i] | 0;
+      this.words[i] = (carry << (26 - r)) | (word >>> r);
+      carry = word & mask;
+    }
+
+    // Push carried bits as a mask
+    if (maskedWords && carry !== 0) {
+      maskedWords.words[maskedWords.length++] = carry;
+    }
+
+    if (this.length === 0) {
+      this.words[0] = 0;
+      this.length = 1;
+    }
+
+    return this._strip();
+  };
+
+  BN.prototype.ishrn = function ishrn (bits, hint, extended) {
+    // TODO(indutny): implement me
+    assert(this.negative === 0);
+    return this.iushrn(bits, hint, extended);
+  };
+
+  // Shift-left
+  BN.prototype.shln = function shln (bits) {
+    return this.clone().ishln(bits);
+  };
+
+  BN.prototype.ushln = function ushln (bits) {
+    return this.clone().iushln(bits);
+  };
+
+  // Shift-right
+  BN.prototype.shrn = function shrn (bits) {
+    return this.clone().ishrn(bits);
+  };
+
+  BN.prototype.ushrn = function ushrn (bits) {
+    return this.clone().iushrn(bits);
+  };
+
+  // Test if n bit is set
+  BN.prototype.testn = function testn (bit) {
+    assert(typeof bit === 'number' && bit >= 0);
+    var r = bit % 26;
+    var s = (bit - r) / 26;
+    var q = 1 << r;
+
+    // Fast case: bit is much higher than all existing words
+    if (this.length <= s) return false;
+
+    // Check bit and return
+    var w = this.words[s];
+
+    return !!(w & q);
+  };
+
+  // Return only lowers bits of number (in-place)
+  BN.prototype.imaskn = function imaskn (bits) {
+    assert(typeof bits === 'number' && bits >= 0);
+    var r = bits % 26;
+    var s = (bits - r) / 26;
+
+    assert(this.negative === 0, 'imaskn works only with positive numbers');
+
+    if (this.length <= s) {
+      return this;
+    }
+
+    if (r !== 0) {
+      s++;
+    }
+    this.length = Math.min(s, this.length);
+
+    if (r !== 0) {
+      var mask = 0x3ffffff ^ ((0x3ffffff >>> r) << r);
+      this.words[this.length - 1] &= mask;
+    }
+
+    return this._strip();
+  };
+
+  // Return only lowers bits of number
+  BN.prototype.maskn = function maskn (bits) {
+    return this.clone().imaskn(bits);
+  };
+
+  // Add plain number `num` to `this`
+  BN.prototype.iaddn = function iaddn (num) {
+    assert(typeof num === 'number');
+    assert(num < 0x4000000);
+    if (num < 0) return this.isubn(-num);
+
+    // Possible sign change
+    if (this.negative !== 0) {
+      if (this.length === 1 && (this.words[0] | 0) <= num) {
+        this.words[0] = num - (this.words[0] | 0);
+        this.negative = 0;
+        return this;
+      }
+
+      this.negative = 0;
+      this.isubn(num);
+      this.negative = 1;
+      return this;
+    }
+
+    // Add without checks
+    return this._iaddn(num);
+  };
+
+  BN.prototype._iaddn = function _iaddn (num) {
+    this.words[0] += num;
+
+    // Carry
+    for (var i = 0; i < this.length && this.words[i] >= 0x4000000; i++) {
+      this.words[i] -= 0x4000000;
+      if (i === this.length - 1) {
+        this.words[i + 1] = 1;
+      } else {
+        this.words[i + 1]++;
+      }
+    }
+    this.length = Math.max(this.length, i + 1);
+
+    return this;
+  };
+
+  // Subtract plain number `num` from `this`
+  BN.prototype.isubn = function isubn (num) {
+    assert(typeof num === 'number');
+    assert(num < 0x4000000);
+    if (num < 0) return this.iaddn(-num);
+
+    if (this.negative !== 0) {
+      this.negative = 0;
+      this.iaddn(num);
+      this.negative = 1;
+      return this;
+    }
+
+    this.words[0] -= num;
+
+    if (this.length === 1 && this.words[0] < 0) {
+      this.words[0] = -this.words[0];
+      this.negative = 1;
+    } else {
+      // Carry
+      for (var i = 0; i < this.length && this.words[i] < 0; i++) {
+        this.words[i] += 0x4000000;
+        this.words[i + 1] -= 1;
+      }
+    }
+
+    return this._strip();
+  };
+
+  BN.prototype.addn = function addn (num) {
+    return this.clone().iaddn(num);
+  };
+
+  BN.prototype.subn = function subn (num) {
+    return this.clone().isubn(num);
+  };
+
+  BN.prototype.iabs = function iabs () {
+    this.negative = 0;
+
+    return this;
+  };
+
+  BN.prototype.abs = function abs () {
+    return this.clone().iabs();
+  };
+
+  BN.prototype._ishlnsubmul = function _ishlnsubmul (num, mul, shift) {
+    var len = num.length + shift;
+    var i;
+
+    this._expand(len);
+
+    var w;
+    var carry = 0;
+    for (i = 0; i < num.length; i++) {
+      w = (this.words[i + shift] | 0) + carry;
+      var right = (num.words[i] | 0) * mul;
+      w -= right & 0x3ffffff;
+      carry = (w >> 26) - ((right / 0x4000000) | 0);
+      this.words[i + shift] = w & 0x3ffffff;
+    }
+    for (; i < this.length - shift; i++) {
+      w = (this.words[i + shift] | 0) + carry;
+      carry = w >> 26;
+      this.words[i + shift] = w & 0x3ffffff;
+    }
+
+    if (carry === 0) return this._strip();
+
+    // Subtraction overflow
+    assert(carry === -1);
+    carry = 0;
+    for (i = 0; i < this.length; i++) {
+      w = -(this.words[i] | 0) + carry;
+      carry = w >> 26;
+      this.words[i] = w & 0x3ffffff;
+    }
+    this.negative = 1;
+
+    return this._strip();
+  };
+
+  BN.prototype._wordDiv = function _wordDiv (num, mode) {
+    var shift = this.length - num.length;
+
+    var a = this.clone();
+    var b = num;
+
+    // Normalize
+    var bhi = b.words[b.length - 1] | 0;
+    var bhiBits = this._countBits(bhi);
+    shift = 26 - bhiBits;
+    if (shift !== 0) {
+      b = b.ushln(shift);
+      a.iushln(shift);
+      bhi = b.words[b.length - 1] | 0;
+    }
+
+    // Initialize quotient
+    var m = a.length - b.length;
+    var q;
+
+    if (mode !== 'mod') {
+      q = new BN(null);
+      q.length = m + 1;
+      q.words = new Array(q.length);
+      for (var i = 0; i < q.length; i++) {
+        q.words[i] = 0;
+      }
+    }
+
+    var diff = a.clone()._ishlnsubmul(b, 1, m);
+    if (diff.negative === 0) {
+      a = diff;
+      if (q) {
+        q.words[m] = 1;
+      }
+    }
+
+    for (var j = m - 1; j >= 0; j--) {
+      var qj = (a.words[b.length + j] | 0) * 0x4000000 +
+        (a.words[b.length + j - 1] | 0);
+
+      // NOTE: (qj / bhi) is (0x3ffffff * 0x4000000 + 0x3ffffff) / 0x2000000 max
+      // (0x7ffffff)
+      qj = Math.min((qj / bhi) | 0, 0x3ffffff);
+
+      a._ishlnsubmul(b, qj, j);
+      while (a.negative !== 0) {
+        qj--;
+        a.negative = 0;
+        a._ishlnsubmul(b, 1, j);
+        if (!a.isZero()) {
+          a.negative ^= 1;
+        }
+      }
+      if (q) {
+        q.words[j] = qj;
+      }
+    }
+    if (q) {
+      q._strip();
+    }
+    a._strip();
+
+    // Denormalize
+    if (mode !== 'div' && shift !== 0) {
+      a.iushrn(shift);
+    }
+
+    return {
+      div: q || null,
+      mod: a
+    };
+  };
+
+  // NOTE: 1) `mode` can be set to `mod` to request mod only,
+  //       to `div` to request div only, or be absent to
+  //       request both div & mod
+  //       2) `positive` is true if unsigned mod is requested
+  BN.prototype.divmod = function divmod (num, mode, positive) {
+    assert(!num.isZero());
+
+    if (this.isZero()) {
+      return {
+        div: new BN(0),
+        mod: new BN(0)
+      };
+    }
+
+    var div, mod, res;
+    if (this.negative !== 0 && num.negative === 0) {
+      res = this.neg().divmod(num, mode);
+
+      if (mode !== 'mod') {
+        div = res.div.neg();
+      }
+
+      if (mode !== 'div') {
+        mod = res.mod.neg();
+        if (positive && mod.negative !== 0) {
+          mod.iadd(num);
+        }
+      }
+
+      return {
+        div: div,
+        mod: mod
+      };
+    }
+
+    if (this.negative === 0 && num.negative !== 0) {
+      res = this.divmod(num.neg(), mode);
+
+      if (mode !== 'mod') {
+        div = res.div.neg();
+      }
+
+      return {
+        div: div,
+        mod: res.mod
+      };
+    }
+
+    if ((this.negative & num.negative) !== 0) {
+      res = this.neg().divmod(num.neg(), mode);
+
+      if (mode !== 'div') {
+        mod = res.mod.neg();
+        if (positive && mod.negative !== 0) {
+          mod.isub(num);
+        }
+      }
+
+      return {
+        div: res.div,
+        mod: mod
+      };
+    }
+
+    // Both numbers are positive at this point
+
+    // Strip both numbers to approximate shift value
+    if (num.length > this.length || this.cmp(num) < 0) {
+      return {
+        div: new BN(0),
+        mod: this
+      };
+    }
+
+    // Very short reduction
+    if (num.length === 1) {
+      if (mode === 'div') {
+        return {
+          div: this.divn(num.words[0]),
+          mod: null
+        };
+      }
+
+      if (mode === 'mod') {
+        return {
+          div: null,
+          mod: new BN(this.modrn(num.words[0]))
+        };
+      }
+
+      return {
+        div: this.divn(num.words[0]),
+        mod: new BN(this.modrn(num.words[0]))
+      };
+    }
+
+    return this._wordDiv(num, mode);
+  };
+
+  // Find `this` / `num`
+  BN.prototype.div = function div (num) {
+    return this.divmod(num, 'div', false).div;
+  };
+
+  // Find `this` % `num`
+  BN.prototype.mod = function mod (num) {
+    return this.divmod(num, 'mod', false).mod;
+  };
+
+  BN.prototype.umod = function umod (num) {
+    return this.divmod(num, 'mod', true).mod;
+  };
+
+  // Find Round(`this` / `num`)
+  BN.prototype.divRound = function divRound (num) {
+    var dm = this.divmod(num);
+
+    // Fast case - exact division
+    if (dm.mod.isZero()) return dm.div;
+
+    var mod = dm.div.negative !== 0 ? dm.mod.isub(num) : dm.mod;
+
+    var half = num.ushrn(1);
+    var r2 = num.andln(1);
+    var cmp = mod.cmp(half);
+
+    // Round down
+    if (cmp < 0 || (r2 === 1 && cmp === 0)) return dm.div;
+
+    // Round up
+    return dm.div.negative !== 0 ? dm.div.isubn(1) : dm.div.iaddn(1);
+  };
+
+  BN.prototype.modrn = function modrn (num) {
+    var isNegNum = num < 0;
+    if (isNegNum) num = -num;
+
+    assert(num <= 0x3ffffff);
+    var p = (1 << 26) % num;
+
+    var acc = 0;
+    for (var i = this.length - 1; i >= 0; i--) {
+      acc = (p * acc + (this.words[i] | 0)) % num;
+    }
+
+    return isNegNum ? -acc : acc;
+  };
+
+  // WARNING: DEPRECATED
+  BN.prototype.modn = function modn (num) {
+    return this.modrn(num);
+  };
+
+  // In-place division by number
+  BN.prototype.idivn = function idivn (num) {
+    var isNegNum = num < 0;
+    if (isNegNum) num = -num;
+
+    assert(num <= 0x3ffffff);
+
+    var carry = 0;
+    for (var i = this.length - 1; i >= 0; i--) {
+      var w = (this.words[i] | 0) + carry * 0x4000000;
+      this.words[i] = (w / num) | 0;
+      carry = w % num;
+    }
+
+    this._strip();
+    return isNegNum ? this.ineg() : this;
+  };
+
+  BN.prototype.divn = function divn (num) {
+    return this.clone().idivn(num);
+  };
+
+  BN.prototype.egcd = function egcd (p) {
+    assert(p.negative === 0);
+    assert(!p.isZero());
+
+    var x = this;
+    var y = p.clone();
+
+    if (x.negative !== 0) {
+      x = x.umod(p);
+    } else {
+      x = x.clone();
+    }
+
+    // A * x + B * y = x
+    var A = new BN(1);
+    var B = new BN(0);
+
+    // C * x + D * y = y
+    var C = new BN(0);
+    var D = new BN(1);
+
+    var g = 0;
+
+    while (x.isEven() && y.isEven()) {
+      x.iushrn(1);
+      y.iushrn(1);
+      ++g;
+    }
+
+    var yp = y.clone();
+    var xp = x.clone();
+
+    while (!x.isZero()) {
+      for (var i = 0, im = 1; (x.words[0] & im) === 0 && i < 26; ++i, im <<= 1);
+      if (i > 0) {
+        x.iushrn(i);
+        while (i-- > 0) {
+          if (A.isOdd() || B.isOdd()) {
+            A.iadd(yp);
+            B.isub(xp);
+          }
+
+          A.iushrn(1);
+          B.iushrn(1);
+        }
+      }
+
+      for (var j = 0, jm = 1; (y.words[0] & jm) === 0 && j < 26; ++j, jm <<= 1);
+      if (j > 0) {
+        y.iushrn(j);
+        while (j-- > 0) {
+          if (C.isOdd() || D.isOdd()) {
+            C.iadd(yp);
+            D.isub(xp);
+          }
+
+          C.iushrn(1);
+          D.iushrn(1);
+        }
+      }
+
+      if (x.cmp(y) >= 0) {
+        x.isub(y);
+        A.isub(C);
+        B.isub(D);
+      } else {
+        y.isub(x);
+        C.isub(A);
+        D.isub(B);
+      }
+    }
+
+    return {
+      a: C,
+      b: D,
+      gcd: y.iushln(g)
+    };
+  };
+
+  // This is reduced incarnation of the binary EEA
+  // above, designated to invert members of the
+  // _prime_ fields F(p) at a maximal speed
+  BN.prototype._invmp = function _invmp (p) {
+    assert(p.negative === 0);
+    assert(!p.isZero());
+
+    var a = this;
+    var b = p.clone();
+
+    if (a.negative !== 0) {
+      a = a.umod(p);
+    } else {
+      a = a.clone();
+    }
+
+    var x1 = new BN(1);
+    var x2 = new BN(0);
+
+    var delta = b.clone();
+
+    while (a.cmpn(1) > 0 && b.cmpn(1) > 0) {
+      for (var i = 0, im = 1; (a.words[0] & im) === 0 && i < 26; ++i, im <<= 1);
+      if (i > 0) {
+        a.iushrn(i);
+        while (i-- > 0) {
+          if (x1.isOdd()) {
+            x1.iadd(delta);
+          }
+
+          x1.iushrn(1);
+        }
+      }
+
+      for (var j = 0, jm = 1; (b.words[0] & jm) === 0 && j < 26; ++j, jm <<= 1);
+      if (j > 0) {
+        b.iushrn(j);
+        while (j-- > 0) {
+          if (x2.isOdd()) {
+            x2.iadd(delta);
+          }
+
+          x2.iushrn(1);
+        }
+      }
+
+      if (a.cmp(b) >= 0) {
+        a.isub(b);
+        x1.isub(x2);
+      } else {
+        b.isub(a);
+        x2.isub(x1);
+      }
+    }
+
+    var res;
+    if (a.cmpn(1) === 0) {
+      res = x1;
+    } else {
+      res = x2;
+    }
+
+    if (res.cmpn(0) < 0) {
+      res.iadd(p);
+    }
+
+    return res;
+  };
+
+  BN.prototype.gcd = function gcd (num) {
+    if (this.isZero()) return num.abs();
+    if (num.isZero()) return this.abs();
+
+    var a = this.clone();
+    var b = num.clone();
+    a.negative = 0;
+    b.negative = 0;
+
+    // Remove common factor of two
+    for (var shift = 0; a.isEven() && b.isEven(); shift++) {
+      a.iushrn(1);
+      b.iushrn(1);
+    }
+
+    do {
+      while (a.isEven()) {
+        a.iushrn(1);
+      }
+      while (b.isEven()) {
+        b.iushrn(1);
+      }
+
+      var r = a.cmp(b);
+      if (r < 0) {
+        // Swap `a` and `b` to make `a` always bigger than `b`
+        var t = a;
+        a = b;
+        b = t;
+      } else if (r === 0 || b.cmpn(1) === 0) {
+        break;
+      }
+
+      a.isub(b);
+    } while (true);
+
+    return b.iushln(shift);
+  };
+
+  // Invert number in the field F(num)
+  BN.prototype.invm = function invm (num) {
+    return this.egcd(num).a.umod(num);
+  };
+
+  BN.prototype.isEven = function isEven () {
+    return (this.words[0] & 1) === 0;
+  };
+
+  BN.prototype.isOdd = function isOdd () {
+    return (this.words[0] & 1) === 1;
+  };
+
+  // And first word and num
+  BN.prototype.andln = function andln (num) {
+    return this.words[0] & num;
+  };
+
+  // Increment at the bit position in-line
+  BN.prototype.bincn = function bincn (bit) {
+    assert(typeof bit === 'number');
+    var r = bit % 26;
+    var s = (bit - r) / 26;
+    var q = 1 << r;
+
+    // Fast case: bit is much higher than all existing words
+    if (this.length <= s) {
+      this._expand(s + 1);
+      this.words[s] |= q;
+      return this;
+    }
+
+    // Add bit and propagate, if needed
+    var carry = q;
+    for (var i = s; carry !== 0 && i < this.length; i++) {
+      var w = this.words[i] | 0;
+      w += carry;
+      carry = w >>> 26;
+      w &= 0x3ffffff;
+      this.words[i] = w;
+    }
+    if (carry !== 0) {
+      this.words[i] = carry;
+      this.length++;
+    }
+    return this;
+  };
+
+  BN.prototype.isZero = function isZero () {
+    return this.length === 1 && this.words[0] === 0;
+  };
+
+  BN.prototype.cmpn = function cmpn (num) {
+    var negative = num < 0;
+
+    if (this.negative !== 0 && !negative) return -1;
+    if (this.negative === 0 && negative) return 1;
+
+    this._strip();
+
+    var res;
+    if (this.length > 1) {
+      res = 1;
+    } else {
+      if (negative) {
+        num = -num;
+      }
+
+      assert(num <= 0x3ffffff, 'Number is too big');
+
+      var w = this.words[0] | 0;
+      res = w === num ? 0 : w < num ? -1 : 1;
+    }
+    if (this.negative !== 0) return -res | 0;
+    return res;
+  };
+
+  // Compare two numbers and return:
+  // 1 - if `this` > `num`
+  // 0 - if `this` == `num`
+  // -1 - if `this` < `num`
+  BN.prototype.cmp = function cmp (num) {
+    if (this.negative !== 0 && num.negative === 0) return -1;
+    if (this.negative === 0 && num.negative !== 0) return 1;
+
+    var res = this.ucmp(num);
+    if (this.negative !== 0) return -res | 0;
+    return res;
+  };
+
+  // Unsigned comparison
+  BN.prototype.ucmp = function ucmp (num) {
+    // At this point both numbers have the same sign
+    if (this.length > num.length) return 1;
+    if (this.length < num.length) return -1;
+
+    var res = 0;
+    for (var i = this.length - 1; i >= 0; i--) {
+      var a = this.words[i] | 0;
+      var b = num.words[i] | 0;
+
+      if (a === b) continue;
+      if (a < b) {
+        res = -1;
+      } else if (a > b) {
+        res = 1;
+      }
+      break;
+    }
+    return res;
+  };
+
+  BN.prototype.gtn = function gtn (num) {
+    return this.cmpn(num) === 1;
+  };
+
+  BN.prototype.gt = function gt (num) {
+    return this.cmp(num) === 1;
+  };
+
+  BN.prototype.gten = function gten (num) {
+    return this.cmpn(num) >= 0;
+  };
+
+  BN.prototype.gte = function gte (num) {
+    return this.cmp(num) >= 0;
+  };
+
+  BN.prototype.ltn = function ltn (num) {
+    return this.cmpn(num) === -1;
+  };
+
+  BN.prototype.lt = function lt (num) {
+    return this.cmp(num) === -1;
+  };
+
+  BN.prototype.lten = function lten (num) {
+    return this.cmpn(num) <= 0;
+  };
+
+  BN.prototype.lte = function lte (num) {
+    return this.cmp(num) <= 0;
+  };
+
+  BN.prototype.eqn = function eqn (num) {
+    return this.cmpn(num) === 0;
+  };
+
+  BN.prototype.eq = function eq (num) {
+    return this.cmp(num) === 0;
+  };
+
+  //
+  // A reduce context, could be using montgomery or something better, depending
+  // on the `m` itself.
+  //
+  BN.red = function red (num) {
+    return new Red(num);
+  };
+
+  BN.prototype.toRed = function toRed (ctx) {
+    assert(!this.red, 'Already a number in reduction context');
+    assert(this.negative === 0, 'red works only with positives');
+    return ctx.convertTo(this)._forceRed(ctx);
+  };
+
+  BN.prototype.fromRed = function fromRed () {
+    assert(this.red, 'fromRed works only with numbers in reduction context');
+    return this.red.convertFrom(this);
+  };
+
+  BN.prototype._forceRed = function _forceRed (ctx) {
+    this.red = ctx;
+    return this;
+  };
+
+  BN.prototype.forceRed = function forceRed (ctx) {
+    assert(!this.red, 'Already a number in reduction context');
+    return this._forceRed(ctx);
+  };
+
+  BN.prototype.redAdd = function redAdd (num) {
+    assert(this.red, 'redAdd works only with red numbers');
+    return this.red.add(this, num);
+  };
+
+  BN.prototype.redIAdd = function redIAdd (num) {
+    assert(this.red, 'redIAdd works only with red numbers');
+    return this.red.iadd(this, num);
+  };
+
+  BN.prototype.redSub = function redSub (num) {
+    assert(this.red, 'redSub works only with red numbers');
+    return this.red.sub(this, num);
+  };
+
+  BN.prototype.redISub = function redISub (num) {
+    assert(this.red, 'redISub works only with red numbers');
+    return this.red.isub(this, num);
+  };
+
+  BN.prototype.redShl = function redShl (num) {
+    assert(this.red, 'redShl works only with red numbers');
+    return this.red.shl(this, num);
+  };
+
+  BN.prototype.redMul = function redMul (num) {
+    assert(this.red, 'redMul works only with red numbers');
+    this.red._verify2(this, num);
+    return this.red.mul(this, num);
+  };
+
+  BN.prototype.redIMul = function redIMul (num) {
+    assert(this.red, 'redMul works only with red numbers');
+    this.red._verify2(this, num);
+    return this.red.imul(this, num);
+  };
+
+  BN.prototype.redSqr = function redSqr () {
+    assert(this.red, 'redSqr works only with red numbers');
+    this.red._verify1(this);
+    return this.red.sqr(this);
+  };
+
+  BN.prototype.redISqr = function redISqr () {
+    assert(this.red, 'redISqr works only with red numbers');
+    this.red._verify1(this);
+    return this.red.isqr(this);
+  };
+
+  // Square root over p
+  BN.prototype.redSqrt = function redSqrt () {
+    assert(this.red, 'redSqrt works only with red numbers');
+    this.red._verify1(this);
+    return this.red.sqrt(this);
+  };
+
+  BN.prototype.redInvm = function redInvm () {
+    assert(this.red, 'redInvm works only with red numbers');
+    this.red._verify1(this);
+    return this.red.invm(this);
+  };
+
+  // Return negative clone of `this` % `red modulo`
+  BN.prototype.redNeg = function redNeg () {
+    assert(this.red, 'redNeg works only with red numbers');
+    this.red._verify1(this);
+    return this.red.neg(this);
+  };
+
+  BN.prototype.redPow = function redPow (num) {
+    assert(this.red && !num.red, 'redPow(normalNum)');
+    this.red._verify1(this);
+    return this.red.pow(this, num);
+  };
+
+  // Prime numbers with efficient reduction
+  var primes = {
+    k256: null,
+    p224: null,
+    p192: null,
+    p25519: null
+  };
+
+  // Pseudo-Mersenne prime
+  function MPrime (name, p) {
+    // P = 2 ^ N - K
+    this.name = name;
+    this.p = new BN(p, 16);
+    this.n = this.p.bitLength();
+    this.k = new BN(1).iushln(this.n).isub(this.p);
+
+    this.tmp = this._tmp();
+  }
+
+  MPrime.prototype._tmp = function _tmp () {
+    var tmp = new BN(null);
+    tmp.words = new Array(Math.ceil(this.n / 13));
+    return tmp;
+  };
+
+  MPrime.prototype.ireduce = function ireduce (num) {
+    // Assumes that `num` is less than `P^2`
+    // num = HI * (2 ^ N - K) + HI * K + LO = HI * K + LO (mod P)
+    var r = num;
+    var rlen;
+
+    do {
+      this.split(r, this.tmp);
+      r = this.imulK(r);
+      r = r.iadd(this.tmp);
+      rlen = r.bitLength();
+    } while (rlen > this.n);
+
+    var cmp = rlen < this.n ? -1 : r.ucmp(this.p);
+    if (cmp === 0) {
+      r.words[0] = 0;
+      r.length = 1;
+    } else if (cmp > 0) {
+      r.isub(this.p);
+    } else {
+      if (r.strip !== undefined) {
+        // r is a BN v4 instance
+        r.strip();
+      } else {
+        // r is a BN v5 instance
+        r._strip();
+      }
+    }
+
+    return r;
+  };
+
+  MPrime.prototype.split = function split (input, out) {
+    input.iushrn(this.n, 0, out);
+  };
+
+  MPrime.prototype.imulK = function imulK (num) {
+    return num.imul(this.k);
+  };
+
+  function K256 () {
+    MPrime.call(
+      this,
+      'k256',
+      'ffffffff ffffffff ffffffff ffffffff ffffffff ffffffff fffffffe fffffc2f');
+  }
+  inherits(K256, MPrime);
+
+  K256.prototype.split = function split (input, output) {
+    // 256 = 9 * 26 + 22
+    var mask = 0x3fffff;
+
+    var outLen = Math.min(input.length, 9);
+    for (var i = 0; i < outLen; i++) {
+      output.words[i] = input.words[i];
+    }
+    output.length = outLen;
+
+    if (input.length <= 9) {
+      input.words[0] = 0;
+      input.length = 1;
+      return;
+    }
+
+    // Shift by 9 limbs
+    var prev = input.words[9];
+    output.words[output.length++] = prev & mask;
+
+    for (i = 10; i < input.length; i++) {
+      var next = input.words[i] | 0;
+      input.words[i - 10] = ((next & mask) << 4) | (prev >>> 22);
+      prev = next;
+    }
+    prev >>>= 22;
+    input.words[i - 10] = prev;
+    if (prev === 0 && input.length > 10) {
+      input.length -= 10;
+    } else {
+      input.length -= 9;
+    }
+  };
+
+  K256.prototype.imulK = function imulK (num) {
+    // K = 0x1000003d1 = [ 0x40, 0x3d1 ]
+    num.words[num.length] = 0;
+    num.words[num.length + 1] = 0;
+    num.length += 2;
+
+    // bounded at: 0x40 * 0x3ffffff + 0x3d0 = 0x100000390
+    var lo = 0;
+    for (var i = 0; i < num.length; i++) {
+      var w = num.words[i] | 0;
+      lo += w * 0x3d1;
+      num.words[i] = lo & 0x3ffffff;
+      lo = w * 0x40 + ((lo / 0x4000000) | 0);
+    }
+
+    // Fast length reduction
+    if (num.words[num.length - 1] === 0) {
+      num.length--;
+      if (num.words[num.length - 1] === 0) {
+        num.length--;
+      }
+    }
+    return num;
+  };
+
+  function P224 () {
+    MPrime.call(
+      this,
+      'p224',
+      'ffffffff ffffffff ffffffff ffffffff 00000000 00000000 00000001');
+  }
+  inherits(P224, MPrime);
+
+  function P192 () {
+    MPrime.call(
+      this,
+      'p192',
+      'ffffffff ffffffff ffffffff fffffffe ffffffff ffffffff');
+  }
+  inherits(P192, MPrime);
+
+  function P25519 () {
+    // 2 ^ 255 - 19
+    MPrime.call(
+      this,
+      '25519',
+      '7fffffffffffffff ffffffffffffffff ffffffffffffffff ffffffffffffffed');
+  }
+  inherits(P25519, MPrime);
+
+  P25519.prototype.imulK = function imulK (num) {
+    // K = 0x13
+    var carry = 0;
+    for (var i = 0; i < num.length; i++) {
+      var hi = (num.words[i] | 0) * 0x13 + carry;
+      var lo = hi & 0x3ffffff;
+      hi >>>= 26;
+
+      num.words[i] = lo;
+      carry = hi;
+    }
+    if (carry !== 0) {
+      num.words[num.length++] = carry;
+    }
+    return num;
+  };
+
+  // Exported mostly for testing purposes, use plain name instead
+  BN._prime = function prime (name) {
+    // Cached version of prime
+    if (primes[name]) return primes[name];
+
+    var prime;
+    if (name === 'k256') {
+      prime = new K256();
+    } else if (name === 'p224') {
+      prime = new P224();
+    } else if (name === 'p192') {
+      prime = new P192();
+    } else if (name === 'p25519') {
+      prime = new P25519();
+    } else {
+      throw new Error('Unknown prime ' + name);
+    }
+    primes[name] = prime;
+
+    return prime;
+  };
+
+  //
+  // Base reduction engine
+  //
+  function Red (m) {
+    if (typeof m === 'string') {
+      var prime = BN._prime(m);
+      this.m = prime.p;
+      this.prime = prime;
+    } else {
+      assert(m.gtn(1), 'modulus must be greater than 1');
+      this.m = m;
+      this.prime = null;
+    }
+  }
+
+  Red.prototype._verify1 = function _verify1 (a) {
+    assert(a.negative === 0, 'red works only with positives');
+    assert(a.red, 'red works only with red numbers');
+  };
+
+  Red.prototype._verify2 = function _verify2 (a, b) {
+    assert((a.negative | b.negative) === 0, 'red works only with positives');
+    assert(a.red && a.red === b.red,
+      'red works only with red numbers');
+  };
+
+  Red.prototype.imod = function imod (a) {
+    if (this.prime) return this.prime.ireduce(a)._forceRed(this);
+
+    move(a, a.umod(this.m)._forceRed(this));
+    return a;
+  };
+
+  Red.prototype.neg = function neg (a) {
+    if (a.isZero()) {
+      return a.clone();
+    }
+
+    return this.m.sub(a)._forceRed(this);
+  };
+
+  Red.prototype.add = function add (a, b) {
+    this._verify2(a, b);
+
+    var res = a.add(b);
+    if (res.cmp(this.m) >= 0) {
+      res.isub(this.m);
+    }
+    return res._forceRed(this);
+  };
+
+  Red.prototype.iadd = function iadd (a, b) {
+    this._verify2(a, b);
+
+    var res = a.iadd(b);
+    if (res.cmp(this.m) >= 0) {
+      res.isub(this.m);
+    }
+    return res;
+  };
+
+  Red.prototype.sub = function sub (a, b) {
+    this._verify2(a, b);
+
+    var res = a.sub(b);
+    if (res.cmpn(0) < 0) {
+      res.iadd(this.m);
+    }
+    return res._forceRed(this);
+  };
+
+  Red.prototype.isub = function isub (a, b) {
+    this._verify2(a, b);
+
+    var res = a.isub(b);
+    if (res.cmpn(0) < 0) {
+      res.iadd(this.m);
+    }
+    return res;
+  };
+
+  Red.prototype.shl = function shl (a, num) {
+    this._verify1(a);
+    return this.imod(a.ushln(num));
+  };
+
+  Red.prototype.imul = function imul (a, b) {
+    this._verify2(a, b);
+    return this.imod(a.imul(b));
+  };
+
+  Red.prototype.mul = function mul (a, b) {
+    this._verify2(a, b);
+    return this.imod(a.mul(b));
+  };
+
+  Red.prototype.isqr = function isqr (a) {
+    return this.imul(a, a.clone());
+  };
+
+  Red.prototype.sqr = function sqr (a) {
+    return this.mul(a, a);
+  };
+
+  Red.prototype.sqrt = function sqrt (a) {
+    if (a.isZero()) return a.clone();
+
+    var mod3 = this.m.andln(3);
+    assert(mod3 % 2 === 1);
+
+    // Fast case
+    if (mod3 === 3) {
+      var pow = this.m.add(new BN(1)).iushrn(2);
+      return this.pow(a, pow);
+    }
+
+    // Tonelli-Shanks algorithm (Totally unoptimized and slow)
+    //
+    // Find Q and S, that Q * 2 ^ S = (P - 1)
+    var q = this.m.subn(1);
+    var s = 0;
+    while (!q.isZero() && q.andln(1) === 0) {
+      s++;
+      q.iushrn(1);
+    }
+    assert(!q.isZero());
+
+    var one = new BN(1).toRed(this);
+    var nOne = one.redNeg();
+
+    // Find quadratic non-residue
+    // NOTE: Max is such because of generalized Riemann hypothesis.
+    var lpow = this.m.subn(1).iushrn(1);
+    var z = this.m.bitLength();
+    z = new BN(2 * z * z).toRed(this);
+
+    while (this.pow(z, lpow).cmp(nOne) !== 0) {
+      z.redIAdd(nOne);
+    }
+
+    var c = this.pow(z, q);
+    var r = this.pow(a, q.addn(1).iushrn(1));
+    var t = this.pow(a, q);
+    var m = s;
+    while (t.cmp(one) !== 0) {
+      var tmp = t;
+      for (var i = 0; tmp.cmp(one) !== 0; i++) {
+        tmp = tmp.redSqr();
+      }
+      assert(i < m);
+      var b = this.pow(c, new BN(1).iushln(m - i - 1));
+
+      r = r.redMul(b);
+      c = b.redSqr();
+      t = t.redMul(c);
+      m = i;
+    }
+
+    return r;
+  };
+
+  Red.prototype.invm = function invm (a) {
+    var inv = a._invmp(this.m);
+    if (inv.negative !== 0) {
+      inv.negative = 0;
+      return this.imod(inv).redNeg();
+    } else {
+      return this.imod(inv);
+    }
+  };
+
+  Red.prototype.pow = function pow (a, num) {
+    if (num.isZero()) return new BN(1).toRed(this);
+    if (num.cmpn(1) === 0) return a.clone();
+
+    var windowSize = 4;
+    var wnd = new Array(1 << windowSize);
+    wnd[0] = new BN(1).toRed(this);
+    wnd[1] = a;
+    for (var i = 2; i < wnd.length; i++) {
+      wnd[i] = this.mul(wnd[i - 1], a);
+    }
+
+    var res = wnd[0];
+    var current = 0;
+    var currentLen = 0;
+    var start = num.bitLength() % 26;
+    if (start === 0) {
+      start = 26;
+    }
+
+    for (i = num.length - 1; i >= 0; i--) {
+      var word = num.words[i];
+      for (var j = start - 1; j >= 0; j--) {
+        var bit = (word >> j) & 1;
+        if (res !== wnd[0]) {
+          res = this.sqr(res);
+        }
+
+        if (bit === 0 && current === 0) {
+          currentLen = 0;
+          continue;
+        }
+
+        current <<= 1;
+        current |= bit;
+        currentLen++;
+        if (currentLen !== windowSize && (i !== 0 || j !== 0)) continue;
+
+        res = this.mul(res, wnd[current]);
+        currentLen = 0;
+        current = 0;
+      }
+      start = 26;
+    }
+
+    return res;
+  };
+
+  Red.prototype.convertTo = function convertTo (num) {
+    var r = num.umod(this.m);
+
+    return r === num ? r.clone() : r;
+  };
+
+  Red.prototype.convertFrom = function convertFrom (num) {
+    var res = num.clone();
+    res.red = null;
+    return res;
+  };
+
+  //
+  // Montgomery method engine
+  //
+
+  BN.mont = function mont (num) {
+    return new Mont(num);
+  };
+
+  function Mont (m) {
+    Red.call(this, m);
+
+    this.shift = this.m.bitLength();
+    if (this.shift % 26 !== 0) {
+      this.shift += 26 - (this.shift % 26);
+    }
+
+    this.r = new BN(1).iushln(this.shift);
+    this.r2 = this.imod(this.r.sqr());
+    this.rinv = this.r._invmp(this.m);
+
+    this.minv = this.rinv.mul(this.r).isubn(1).div(this.m);
+    this.minv = this.minv.umod(this.r);
+    this.minv = this.r.sub(this.minv);
+  }
+  inherits(Mont, Red);
+
+  Mont.prototype.convertTo = function convertTo (num) {
+    return this.imod(num.ushln(this.shift));
+  };
+
+  Mont.prototype.convertFrom = function convertFrom (num) {
+    var r = this.imod(num.mul(this.rinv));
+    r.red = null;
+    return r;
+  };
+
+  Mont.prototype.imul = function imul (a, b) {
+    if (a.isZero() || b.isZero()) {
+      a.words[0] = 0;
+      a.length = 1;
+      return a;
+    }
+
+    var t = a.imul(b);
+    var c = t.maskn(this.shift).mul(this.minv).imaskn(this.shift).mul(this.m);
+    var u = t.isub(c).iushrn(this.shift);
+    var res = u;
+
+    if (u.cmp(this.m) >= 0) {
+      res = u.isub(this.m);
+    } else if (u.cmpn(0) < 0) {
+      res = u.iadd(this.m);
+    }
+
+    return res._forceRed(this);
+  };
+
+  Mont.prototype.mul = function mul (a, b) {
+    if (a.isZero() || b.isZero()) return new BN(0)._forceRed(this);
+
+    var t = a.mul(b);
+    var c = t.maskn(this.shift).mul(this.minv).imaskn(this.shift).mul(this.m);
+    var u = t.isub(c).iushrn(this.shift);
+    var res = u;
+    if (u.cmp(this.m) >= 0) {
+      res = u.isub(this.m);
+    } else if (u.cmpn(0) < 0) {
+      res = u.iadd(this.m);
+    }
+
+    return res._forceRed(this);
+  };
+
+  Mont.prototype.invm = function invm (a) {
+    // (AR)^-1 * R^2 = (A^-1 * R^-1) * R^2 = A^-1 * R
+    var res = this.imod(a._invmp(this.m).mul(this.r2));
+    return res._forceRed(this);
+  };
+})(typeof module === 'undefined' || module, this);
diff --git a/flag_encoder/index.html b/flag_encoder/index.html
new file mode 100644
index 0000000..1c6433e
--- /dev/null
+++ b/flag_encoder/index.html
@@ -0,0 +1,67 @@
+<!DOCTYPE html>
+<html>
+	<head>
+		<meta charset="utf-8"/>
+		<title>CryptoCTF zero-knowledge flag-submission encoder v0.1</title>
+		<script src="bn.js"></script>
+		<script src="nano-ethereum-signer-mod.js"></script>
+	</head>
+
+	<body>
+
+	<label for="inp-contestant-address">contestant's address:</label> <input id="inp-contestant-address" type="text" size="42" pattern="0x[0-9a-fA-F]{40}" required placeholder="0x0000000000000000000000000000000000000000" autocomplete="cryptocurrency address" title="The cryptocurrency address of the contestant who is submitting the flag. It will be used as the message that is signed using an ECDSA signature scheme. It is incorporated to prevent submission forgery and theft. The resulting signature will be accepted by the CCTF smart-contract from only this address."/><br/>
+	<label for="inp-flag">flag:</label> <input id="inp-flag" type="text" size="72" pattern="CCTF[{].*[}]" required placeholder="CCTF{…}" autocomplete="flag" title="The flag for the challenge in question: a piece of data that can be found through solving the problem. It can be an outstanding character sequence of the form CCTF{…} that can be stumbled upon; otherwise its location/calculation (e.g. the deciphered message) and its formatting (e.g. hexadecimal) are precisely specified, and formatting always includes enclosing by CCTF{…}. The flag will be used as the secret key for signing using an ECDSA signature scheme." accesskey="f"/> <label for="outp-obscured-flag">⇒ obscured flag: </label><input id="outp-obscured-flag" type="text" size="42" readonly title="The obscured flag: data to allow zero-knowledge verification of knowledge of the flag. It is the elliptic-curve public key related to the flag as the private key. It is the thing to be loaded into the CCTF smart-contract for the respective challenge."/><br />
+	<label for="outp-signature">⇒ signature: </label><input id="outp-signature" type="text" size="132" readonly title="The signature: a zero-knowledge proof of knowledge of the flag, bound to the given address. It's an ECDSA signature of the address as the message (hash) with the flag as the key. It is to be passed to the CCTF smart-contract's flag submission function."/><!--<br />
+	<label for="inp-contract-address">CCTF smart-contract address:</label> <input id="inp-contract-address" type="text" size="42" pattern="0x[0-9a-fA-F]{40}" placeholder="0x0000000000000000000000000000000000000000"/><br/>
+	<label for="inp-contest-id">contest ID:</label> <input id="inp-contest-id" type="text" size="66" pattern="0x[0-9a-fA-F]+|[0-9]+" placeholder="0x0000000000000000000000000000000000000000000000000000000000000000"/><br/>
+	<label for="inp-challenge-id">challenge ID:</label> <input id="inp-challenge-id" type="integer" size="4" placeholder="0" accesskey="c"/>-->
+
+	<script>
+		var inpContestantAddress = document.querySelector("#inp-contestant-address");
+		var inpFlag = document.querySelector("#inp-flag");
+		var outpObscuredFlag = document.querySelector("#outp-obscured-flag");
+		var outpSignature = document.querySelector("#outp-signature");
+
+		function displayObscuredFlag() {
+			var k = inpFlag.value;
+			var t = "0x";
+			for (i in k) {
+				t += k.charCodeAt(i).toString(16).padStart(2, "0");
+			}
+			try {
+				outpObscuredFlag.value = addressFromKey(t);
+			} catch {
+				outpObscuredFlag.value = "";
+			}
+		}
+		function displaySignature() {
+			var m = inpContestantAddress.value;
+			var k = inpFlag.value;
+			var t = "0x";
+			for (i in k) {
+				t += k.charCodeAt(i).toString(16).padStart(2, "0");
+			}
+			try {
+				outpSignature.value = signMessage(m, t);
+			} catch {
+				outpSignature.value = "";
+			}
+		}
+
+		function onContestantAddressChange(ev) {
+			displaySignature();
+		}
+		function onFlagChange(ev) {
+			displayObscuredFlag();
+			displaySignature();
+		}
+
+		inpContestantAddress.oninput = onContestantAddressChange;
+		inpFlag.oninput = onFlagChange;
+
+		displayObscuredFlag();
+		displaySignature();
+	</script>
+
+	</body>
+</html>
diff --git a/flag_encoder/nano-ethereum-signer-mod.js b/flag_encoder/nano-ethereum-signer-mod.js
new file mode 100644
index 0000000..6e13544
--- /dev/null
+++ b/flag_encoder/nano-ethereum-signer-mod.js
@@ -0,0 +1,2579 @@
+const lib = (fn) => {
+  var exports = null;
+  return () => {
+    exports = exports || fn();
+    return exports;
+  };
+};
+
+const lib_inherits = lib(() => {
+  return function inherits(ctor, superCtor) {
+    if (superCtor) {
+      ctor.super_ = superCtor
+      ctor.prototype = Object.create(superCtor.prototype, {
+        constructor: {
+          value: ctor,
+          enumerable: false,
+          writable: true,
+          configurable: true
+        }
+      })
+    }
+  };
+});
+
+const lib_buffer = lib(() => {
+  var exports = {};
+
+  exports.Buffer = Buffer
+  exports.INSPECT_MAX_BYTES = 50
+
+  /**
+  * If `Buffer.TYPED_ARRAY_SUPPORT`:
+  *   === true    Use Uint8Array implementation (fastest)
+  *   === false   Use Object implementation (most compatible, even IE6)
+  *
+  * Browsers that support typed arrays are IE 10+, Firefox 4+, Chrome 7+, Safari 5.1+,
+  * Opera 11.6+, iOS 4.2+.
+  *
+  * Due to various browser bugs, sometimes the Object implementation will be used even
+  * when the browser supports typed arrays.
+  *
+  * Note:
+  *
+  *   - Firefox 4-29 lacks support for adding new properties to `Uint8Array` instances,
+  *     See: https://bugzilla.mozilla.org/show_bug.cgi?id=695438.
+  *
+  *   - Chrome 9-10 is missing the `TypedArray.prototype.subarray` function.
+  *
+  *   - IE10 has a broken `TypedArray.prototype.subarray` function which returns arrays of
+  *     incorrect length in some situations.
+
+  * We detect these buggy browsers and set `Buffer.TYPED_ARRAY_SUPPORT` to `false` so they
+  * get the Object implementation, which is slower but behaves correctly.
+  */
+  Buffer.TYPED_ARRAY_SUPPORT = true;
+
+  /*
+  * Export kMaxLength after typed array support is determined.
+  */
+  exports.kMaxLength = kMaxLength()
+
+  function typedArraySupport () {
+    try {
+      var arr = new Uint8Array(1)
+      arr.__proto__ = {__proto__: Uint8Array.prototype, foo: function () { return 42 }}
+      return arr.foo() === 42 && // typed array instances can be augmented
+          typeof arr.subarray === 'function' && // chrome 9-10 lack `subarray`
+          arr.subarray(1, 1).byteLength === 0 // ie10 has broken `subarray`
+    } catch (e) {
+      return false
+    }
+  }
+
+  function kMaxLength () {
+    return Buffer.TYPED_ARRAY_SUPPORT
+      ? 0x7fffffff
+      : 0x3fffffff
+  }
+
+  function createBuffer (that, length) {
+    if (kMaxLength() < length) {
+      throw new RangeError('Invalid typed array length')
+    }
+    if (Buffer.TYPED_ARRAY_SUPPORT) {
+      // Return an augmented `Uint8Array` instance, for best performance
+      that = new Uint8Array(length)
+      that.__proto__ = Buffer.prototype
+    } else {
+      // Fallback: Return an object instance of the Buffer class
+      if (that === null) {
+        that = new Buffer(length)
+      }
+      that.length = length
+    }
+
+    return that
+  }
+
+  /**
+  * The Buffer constructor returns instances of `Uint8Array` that have their
+  * prototype changed to `Buffer.prototype`. Furthermore, `Buffer` is a subclass of
+  * `Uint8Array`, so the returned instances will have all the node `Buffer` methods
+  * and the `Uint8Array` methods. Square bracket notation works as expected -- it
+  * returns a single octet.
+  *
+  * The `Uint8Array` prototype remains unmodified.
+  */
+
+  function Buffer (arg, encodingOrOffset, length) {};
+
+  function from (that, value, encodingOrOffset, length) {
+    return fromString(that, value, encodingOrOffset)
+  }
+
+  /**
+  * Functionally equivalent to Buffer(arg, encoding) but throws a TypeError
+  * if value is a number.
+  * Buffer.from(str[, encoding])
+  * Buffer.from(array)
+  * Buffer.from(buffer)
+  * Buffer.from(arrayBuffer[, byteOffset[, length]])
+  **/
+  Buffer.from = function (value, encodingOrOffset, length) {
+    return from(null, value, encodingOrOffset, length)
+  }
+
+  if (Buffer.TYPED_ARRAY_SUPPORT) {
+    Buffer.prototype.__proto__ = Uint8Array.prototype
+    Buffer.__proto__ = Uint8Array
+    if (typeof Symbol !== 'undefined' && Symbol.species &&
+        Buffer[Symbol.species] === Buffer) {
+      // Fix subarray() in ES2016. See: https://github.com/feross/buffer/pull/97
+      Object.defineProperty(Buffer, Symbol.species, {
+        value: null,
+        configurable: true
+      })
+    }
+  }
+
+  function fromString (that, string, encoding) {
+    var length = byteLength(string, encoding) | 0
+    that = createBuffer(that, length)
+    var actual = that.write(string, encoding)
+    if (actual !== length) {
+      that = that.slice(0, actual)
+    }
+    return that
+  }
+
+  Buffer.isBuffer = function isBuffer (b) {
+    return !!(b != null && b._isBuffer)
+  }
+
+  function byteLength (string, encoding) {
+    return string.length >>> 1;
+  }
+  Buffer.byteLength = byteLength
+
+  // The property is used by `Buffer.isBuffer` and `is-buffer` (in Safari 5-7) to detect
+  // Buffer instances.
+  Buffer.prototype._isBuffer = true
+
+  function hexWrite (buf, string, offset, length) {
+    offset = Number(offset) || 0
+    var remaining = buf.length - offset
+    if (!length) {
+      length = remaining
+    } else {
+      length = Number(length)
+      if (length > remaining) {
+        length = remaining
+      }
+    }
+
+    // must be an even number of digits
+    var strLen = string.length
+    if (strLen % 2 !== 0) throw new TypeError('Invalid hex string')
+
+    if (length > strLen / 2) {
+      length = strLen / 2
+    }
+    for (var i = 0; i < length; ++i) {
+      var parsed = parseInt(string.substr(i * 2, 2), 16)
+      if (isNaN(parsed)) return i
+      buf[offset + i] = parsed
+    }
+    return i
+  }
+
+  Buffer.prototype.write = function write (string, offset, length, encoding) {
+    return hexWrite(this, string, 0, this.length);
+  }
+
+  return exports;
+});
+
+const lib_assert = lib(() => {
+  var exports = {};
+
+  exports = assert;
+
+  function assert(val, msg) {
+    if (!val)
+      throw new Error(msg || 'Assertion failed');
+  }
+
+  assert.equal = function assertEqual(l, r, msg) {/*NOTUSED*/};
+
+  return exports;
+});
+
+const lib_utils_a = lib(() => {
+  "use strict";
+
+  var exports = {};
+
+  var utils = exports;
+  var minAssert = lib_assert();
+  var minUtils = lib_utils_c();
+
+  utils.assert = minAssert;
+  utils.toArray = minUtils.toArray;
+  utils.zero2 = minUtils.zero2;
+  utils.toHex = minUtils.toHex;
+  utils.encode = minUtils.encode;
+
+  // Represent num in a w-NAF form
+  function getNAF(num, w, bits) {
+    var naf = new Array(Math.max(num.bitLength(), bits) + 1);
+    naf.fill(0);
+
+    var ws = 1 << (w + 1);
+    var k = num.clone();
+
+    for (var i = 0; i < naf.length; i++) {
+      var z;
+      var mod = k.andln(ws - 1);
+      if (k.isOdd()) {
+        if (mod > (ws >> 1) - 1)
+          z = (ws >> 1) - mod;
+        else
+          z = mod;
+        k.isubn(z);
+      } else {
+        z = 0;
+      }
+
+      naf[i] = z;
+      k.iushrn(1);
+    }
+
+    return naf;
+  }
+  utils.getNAF = getNAF;
+
+  // Represent k1, k2 in a Joint Sparse Form
+  function getJSF(k1, k2) {
+    var jsf = [
+      [],
+      []
+    ];
+
+    k1 = k1.clone();
+    k2 = k2.clone();
+    var d1 = 0;
+    var d2 = 0;
+    while (k1.cmpn(-d1) > 0 || k2.cmpn(-d2) > 0) {
+
+      // First phase
+      var m14 = (k1.andln(3) + d1) & 3;
+      var m24 = (k2.andln(3) + d2) & 3;
+      if (m14 === 3)
+        m14 = -1;
+      if (m24 === 3)
+        m24 = -1;
+      var u1;
+      if ((m14 & 1) === 0) {
+        u1 = 0;
+      } else {
+        var m8 = (k1.andln(7) + d1) & 7;
+        if ((m8 === 3 || m8 === 5) && m24 === 2)
+          u1 = -m14;
+        else
+          u1 = m14;
+      }
+      jsf[0].push(u1);
+
+      var u2;
+      if ((m24 & 1) === 0) {
+        u2 = 0;
+      } else {
+        var m8 = (k2.andln(7) + d2) & 7;
+        if ((m8 === 3 || m8 === 5) && m14 === 2)
+          u2 = -m24;
+        else
+          u2 = m24;
+      }
+      jsf[1].push(u2);
+
+      // Second phase
+      if (2 * d1 === u1 + 1)
+        d1 = 1 - d1;
+      if (2 * d2 === u2 + 1)
+        d2 = 1 - d2;
+      k1.iushrn(1);
+      k2.iushrn(1);
+    }
+
+    return jsf;
+  }
+  utils.getJSF = getJSF;
+
+  function parseBytes(bytes) {/*NOTUSED*/}
+  utils.parseBytes = parseBytes;
+
+  function intFromLE(bytes) {/*NOTUSED*/}
+  utils.intFromLE = intFromLE;
+
+  return exports;
+});
+
+const lib_utils_b = lib(() => {
+  "use strict";
+
+  var exports = {};
+
+  var assert = lib_assert();
+  var inherits = lib_inherits();
+
+  exports.inherits = inherits;
+
+  function isSurrogatePair(msg, i) {/*NOTUSED*/}
+
+  function toArray(msg, enc) {
+    if (Array.isArray(msg))
+      return msg.slice();
+    if (!msg)
+      return [];
+    var res = [];
+    if (typeof msg === 'string') {
+      if (!enc) {
+        // Inspired by stringToUtf8ByteArray() in closure-library by Google
+        // https://github.com/google/closure-library/blob/8598d87242af59aac233270742c8984e2b2bdbe0/closure/goog/crypt/crypt.js#L117-L143
+        // Apache License 2.0
+        // https://github.com/google/closure-library/blob/master/LICENSE
+        var p = 0;
+        for (var i = 0; i < msg.length; i++) {
+          var c = msg.charCodeAt(i);
+          if (c < 128) {
+            res[p++] = c;
+          } else if (c < 2048) {
+            res[p++] = (c >> 6) | 192;
+            res[p++] = (c & 63) | 128;
+          } else if (isSurrogatePair(msg, i)) {
+            c = 0x10000 + ((c & 0x03FF) << 10) + (msg.charCodeAt(++i) & 0x03FF);
+            res[p++] = (c >> 18) | 240;
+            res[p++] = ((c >> 12) & 63) | 128;
+            res[p++] = ((c >> 6) & 63) | 128;
+            res[p++] = (c & 63) | 128;
+          } else {
+            res[p++] = (c >> 12) | 224;
+            res[p++] = ((c >> 6) & 63) | 128;
+            res[p++] = (c & 63) | 128;
+          }
+        }
+      } else if (enc === 'hex') {
+        msg = msg.replace(/[^a-z0-9]+/ig, '');
+        if (msg.length % 2 !== 0)
+          msg = '0' + msg;
+        for (i = 0; i < msg.length; i += 2)
+          res.push(parseInt(msg[i] + msg[i + 1], 16));
+      }
+    } else {
+      for (i = 0; i < msg.length; i++)
+        res[i] = msg[i] | 0;
+    }
+    return res;
+  }
+  exports.toArray = toArray;
+
+  function join32(msg, start, end, endian) {
+    var len = end - start;
+    assert(len % 4 === 0);
+    var res = new Array(len / 4);
+    for (var i = 0, k = start; i < res.length; i++, k += 4) {
+      var w;
+      if (endian === 'big')
+        w = (msg[k] << 24) | (msg[k + 1] << 16) | (msg[k + 2] << 8) | msg[k + 3];
+      else
+        w = (msg[k + 3] << 24) | (msg[k + 2] << 16) | (msg[k + 1] << 8) | msg[k];
+      res[i] = w >>> 0;
+    }
+    return res;
+  }
+  exports.join32 = join32;
+
+  function split32(msg, endian) {
+    var res = new Array(msg.length * 4);
+    for (var i = 0, k = 0; i < msg.length; i++, k += 4) {
+      var m = msg[i];
+      if (endian === 'big') {
+        res[k] = m >>> 24;
+        res[k + 1] = (m >>> 16) & 0xff;
+        res[k + 2] = (m >>> 8) & 0xff;
+        res[k + 3] = m & 0xff;
+      } else {
+        res[k + 3] = m >>> 24;
+        res[k + 2] = (m >>> 16) & 0xff;
+        res[k + 1] = (m >>> 8) & 0xff;
+        res[k] = m & 0xff;
+      }
+    }
+    return res;
+  }
+  exports.split32 = split32;
+
+  function rotr32(w, b) {
+    return (w >>> b) | (w << (32 - b));
+  }
+  exports.rotr32 = rotr32;
+
+  function sum32(a, b) {
+    return (a + b) >>> 0;
+  }
+  exports.sum32 = sum32;
+
+  function sum32_4(a, b, c, d) {
+    return (a + b + c + d) >>> 0;
+  }
+  exports.sum32_4 = sum32_4;
+
+  function sum32_5(a, b, c, d, e) {
+    return (a + b + c + d + e) >>> 0;
+  }
+  exports.sum32_5 = sum32_5;
+
+  return exports;
+});
+
+const lib_bytes = lib(() => {
+  var exports = {};
+
+  const length = a => (a.length - 2) / 2;
+
+  const flatten = a => "0x" + a.reduce((r, s) => r + s.slice(2), "");
+
+  const slice = (i, j, bs) => "0x" + bs.slice(i * 2 + 2, j * 2 + 2);
+
+  const pad = (l, hex) => hex.length === l * 2 + 2 ? hex : pad(l, "0x" + "0" + hex.slice(2));
+
+  const fromNumber = num => {
+    let hex = num.toString(16);
+    return hex.length % 2 === 0 ? "0x" + hex : "0x0" + hex;
+  };
+
+  const toNumber = hex => parseInt(hex.slice(2), 16);
+
+  const concat = (a, b) => a.concat(b.slice(2));
+
+  const fromNat = bn => bn === "0x0" ? "0x" : bn.length % 2 === 0 ? bn : "0x0" + bn.slice(2);
+
+  const toNat = bn => bn[2] === "0" ? "0x" + bn.slice(3) : bn;
+
+  exports = {
+    length,
+    flatten,
+    slice,
+    pad,
+    fromNumber,
+    toNumber,
+    fromNat,
+    toNat,
+  };
+
+  return exports;
+});
+
+const lib_hash_common = lib(() => {
+  "use strict";
+
+  var exports = {};
+
+  var utils = lib_utils_b();
+  var assert = lib_assert();
+
+  function BlockHash() {
+    this.pending = null;
+    this.pendingTotal = 0;
+    this.blockSize = this.constructor.blockSize;
+    this.outSize = this.constructor.outSize;
+    this.hmacStrength = this.constructor.hmacStrength;
+    this.padLength = this.constructor.padLength / 8;
+    this.endian = 'big';
+
+    this._delta8 = this.blockSize / 8;
+    this._delta32 = this.blockSize / 32;
+  }
+  exports.BlockHash = BlockHash;
+
+  BlockHash.prototype.update = function update(msg, enc) {
+    // Convert message to array, pad it, and join into 32bit blocks
+    msg = utils.toArray(msg, enc);
+    if (!this.pending)
+      this.pending = msg;
+    else
+      this.pending = this.pending.concat(msg);
+    this.pendingTotal += msg.length;
+
+    // Enough data, try updating
+    if (this.pending.length >= this._delta8) {
+      msg = this.pending;
+
+      // Process pending data in blocks
+      var r = msg.length % this._delta8;
+      this.pending = msg.slice(msg.length - r, msg.length);
+      if (this.pending.length === 0)
+        this.pending = null;
+
+      msg = utils.join32(msg, 0, msg.length - r, this.endian);
+      for (var i = 0; i < msg.length; i += this._delta32)
+        this._update(msg, i, i + this._delta32);
+    }
+
+    return this;
+  };
+
+  BlockHash.prototype.digest = function digest(enc) {
+    this.update(this._pad());
+    assert(this.pending === null);
+
+    return this._digest(enc);
+  };
+
+  BlockHash.prototype._pad = function pad() {
+    var len = this.pendingTotal;
+    var bytes = this._delta8;
+    var k = bytes - ((len + this.padLength) % bytes);
+    var res = new Array(k + this.padLength);
+    res[0] = 0x80;
+    for (var i = 1; i < k; i++)
+      res[i] = 0;
+
+    // Append length
+    len <<= 3;
+    if (this.endian === 'big') {
+      for (var t = 8; t < this.padLength; t++)
+        res[i++] = 0;
+
+      res[i++] = 0;
+      res[i++] = 0;
+      res[i++] = 0;
+      res[i++] = 0;
+      res[i++] = (len >>> 24) & 0xff;
+      res[i++] = (len >>> 16) & 0xff;
+      res[i++] = (len >>> 8) & 0xff;
+      res[i++] = len & 0xff;
+    } else {
+      res[i++] = len & 0xff;
+      res[i++] = (len >>> 8) & 0xff;
+      res[i++] = (len >>> 16) & 0xff;
+      res[i++] = (len >>> 24) & 0xff;
+      res[i++] = 0;
+      res[i++] = 0;
+      res[i++] = 0;
+      res[i++] = 0;
+
+      for (t = 8; t < this.padLength; t++)
+        res[i++] = 0;
+    }
+
+    return res;
+  };
+
+
+  return exports;
+});
+
+const lib_keccak = lib(() => {
+  var exports = {};
+
+  const HEX_CHARS = '0123456789abcdef'.split('');
+  const KECCAK_PADDING = [1, 256, 65536, 16777216];
+  const SHIFT = [0, 8, 16, 24];
+  const RC = [1, 0, 32898, 0, 32906, 2147483648, 2147516416, 2147483648, 32907, 0, 2147483649, 0, 2147516545, 2147483648, 32777, 2147483648, 138, 0, 136, 0, 2147516425, 0, 2147483658, 0, 2147516555, 0, 139, 2147483648, 32905, 2147483648, 32771, 2147483648, 32770, 2147483648, 128, 2147483648, 32778, 0, 2147483658, 2147483648, 2147516545, 2147483648, 32896, 2147483648, 2147483649, 0, 2147516424, 2147483648];
+  const Keccak = bits => ({
+    blocks: [],
+    reset: true,
+    block: 0,
+    start: 0,
+    blockCount: 1600 - (bits << 1) >> 5,
+    outputBlocks: bits >> 5,
+    s: (s => [].concat(s, s, s, s, s))([0, 0, 0, 0, 0, 0, 0, 0, 0, 0])
+  });
+  const update = (state, message) => {
+    var length = message.length,
+        blocks = state.blocks,
+        byteCount = state.blockCount << 2,
+        blockCount = state.blockCount,
+        outputBlocks = state.outputBlocks,
+        s = state.s,
+        index = 0,
+        i,
+        code;
+
+    // update
+    while (index < length) {
+      if (state.reset) {
+        state.reset = false;
+        blocks[0] = state.block;
+        for (i = 1; i < blockCount + 1; ++i) {
+          blocks[i] = 0;
+        }
+      }
+      if (typeof message !== "string") {
+        for (i = state.start; index < length && i < byteCount; ++index) {
+          blocks[i >> 2] |= message[index] << SHIFT[i++ & 3];
+        }
+      } else {
+        for (i = state.start; index < length && i < byteCount; ++index) {
+          code = message.charCodeAt(index);
+          if (code < 0x80) {
+            blocks[i >> 2] |= code << SHIFT[i++ & 3];
+          } else if (code < 0x800) {
+            blocks[i >> 2] |= (0xc0 | code >> 6) << SHIFT[i++ & 3];
+            blocks[i >> 2] |= (0x80 | code & 0x3f) << SHIFT[i++ & 3];
+          } else if (code < 0xd800 || code >= 0xe000) {
+            blocks[i >> 2] |= (0xe0 | code >> 12) << SHIFT[i++ & 3];
+            blocks[i >> 2] |= (0x80 | code >> 6 & 0x3f) << SHIFT[i++ & 3];
+            blocks[i >> 2] |= (0x80 | code & 0x3f) << SHIFT[i++ & 3];
+          } else {
+            code = 0x10000 + ((code & 0x3ff) << 10 | message.charCodeAt(++index) & 0x3ff);
+            blocks[i >> 2] |= (0xf0 | code >> 18) << SHIFT[i++ & 3];
+            blocks[i >> 2] |= (0x80 | code >> 12 & 0x3f) << SHIFT[i++ & 3];
+            blocks[i >> 2] |= (0x80 | code >> 6 & 0x3f) << SHIFT[i++ & 3];
+            blocks[i >> 2] |= (0x80 | code & 0x3f) << SHIFT[i++ & 3];
+          }
+        }
+      }
+      state.lastByteIndex = i;
+      if (i >= byteCount) {
+        state.start = i - byteCount;
+        state.block = blocks[blockCount];
+        for (i = 0; i < blockCount; ++i) {
+          s[i] ^= blocks[i];
+        }
+        f(s);
+        state.reset = true;
+      } else {
+        state.start = i;
+      }
+    }
+
+    // finalize
+    i = state.lastByteIndex;
+    blocks[i >> 2] |= KECCAK_PADDING[i & 3];
+    if (state.lastByteIndex === byteCount) {
+      blocks[0] = blocks[blockCount];
+      for (i = 1; i < blockCount + 1; ++i) {
+        blocks[i] = 0;
+      }
+    }
+    blocks[blockCount - 1] |= 0x80000000;
+    for (i = 0; i < blockCount; ++i) {
+      s[i] ^= blocks[i];
+    }
+    f(s);
+
+    // toString
+    var hex = '', j = 0, block;
+    i = 0;
+    while (j < outputBlocks) {
+      for (i = 0; i < blockCount && j < outputBlocks; ++i, ++j) {
+        block = s[i];
+        hex += HEX_CHARS[block >> 4 & 0x0F] + HEX_CHARS[block & 0x0F] + HEX_CHARS[block >> 12 & 0x0F] + HEX_CHARS[block >> 8 & 0x0F] + HEX_CHARS[block >> 20 & 0x0F] + HEX_CHARS[block >> 16 & 0x0F] + HEX_CHARS[block >> 28 & 0x0F] + HEX_CHARS[block >> 24 & 0x0F];
+      }
+      if (j % blockCount === 0) {
+        f(s);
+        i = 0;
+      }
+    }
+    return "0x" + hex;
+  };
+
+  const f = s => {
+    var h, l, n, c0, c1, c2, c3, c4, c5, c6, c7, c8, c9, b0, b1, b2, b3, b4, b5, b6, b7, b8, b9, b10, b11, b12, b13, b14, b15, b16, b17, b18, b19, b20, b21, b22, b23, b24, b25, b26, b27, b28, b29, b30, b31, b32, b33, b34, b35, b36, b37, b38, b39, b40, b41, b42, b43, b44, b45, b46, b47, b48, b49;
+
+    for (n = 0; n < 48; n += 2) {
+      c0 = s[0] ^ s[10] ^ s[20] ^ s[30] ^ s[40];
+      c1 = s[1] ^ s[11] ^ s[21] ^ s[31] ^ s[41];
+      c2 = s[2] ^ s[12] ^ s[22] ^ s[32] ^ s[42];
+      c3 = s[3] ^ s[13] ^ s[23] ^ s[33] ^ s[43];
+      c4 = s[4] ^ s[14] ^ s[24] ^ s[34] ^ s[44];
+      c5 = s[5] ^ s[15] ^ s[25] ^ s[35] ^ s[45];
+      c6 = s[6] ^ s[16] ^ s[26] ^ s[36] ^ s[46];
+      c7 = s[7] ^ s[17] ^ s[27] ^ s[37] ^ s[47];
+      c8 = s[8] ^ s[18] ^ s[28] ^ s[38] ^ s[48];
+      c9 = s[9] ^ s[19] ^ s[29] ^ s[39] ^ s[49];
+
+      h = c8 ^ (c2 << 1 | c3 >>> 31);
+      l = c9 ^ (c3 << 1 | c2 >>> 31);
+      s[0] ^= h;
+      s[1] ^= l;
+      s[10] ^= h;
+      s[11] ^= l;
+      s[20] ^= h;
+      s[21] ^= l;
+      s[30] ^= h;
+      s[31] ^= l;
+      s[40] ^= h;
+      s[41] ^= l;
+      h = c0 ^ (c4 << 1 | c5 >>> 31);
+      l = c1 ^ (c5 << 1 | c4 >>> 31);
+      s[2] ^= h;
+      s[3] ^= l;
+      s[12] ^= h;
+      s[13] ^= l;
+      s[22] ^= h;
+      s[23] ^= l;
+      s[32] ^= h;
+      s[33] ^= l;
+      s[42] ^= h;
+      s[43] ^= l;
+      h = c2 ^ (c6 << 1 | c7 >>> 31);
+      l = c3 ^ (c7 << 1 | c6 >>> 31);
+      s[4] ^= h;
+      s[5] ^= l;
+      s[14] ^= h;
+      s[15] ^= l;
+      s[24] ^= h;
+      s[25] ^= l;
+      s[34] ^= h;
+      s[35] ^= l;
+      s[44] ^= h;
+      s[45] ^= l;
+      h = c4 ^ (c8 << 1 | c9 >>> 31);
+      l = c5 ^ (c9 << 1 | c8 >>> 31);
+      s[6] ^= h;
+      s[7] ^= l;
+      s[16] ^= h;
+      s[17] ^= l;
+      s[26] ^= h;
+      s[27] ^= l;
+      s[36] ^= h;
+      s[37] ^= l;
+      s[46] ^= h;
+      s[47] ^= l;
+      h = c6 ^ (c0 << 1 | c1 >>> 31);
+      l = c7 ^ (c1 << 1 | c0 >>> 31);
+      s[8] ^= h;
+      s[9] ^= l;
+      s[18] ^= h;
+      s[19] ^= l;
+      s[28] ^= h;
+      s[29] ^= l;
+      s[38] ^= h;
+      s[39] ^= l;
+      s[48] ^= h;
+      s[49] ^= l;
+
+      b0 = s[0];
+      b1 = s[1];
+      b32 = s[11] << 4 | s[10] >>> 28;
+      b33 = s[10] << 4 | s[11] >>> 28;
+      b14 = s[20] << 3 | s[21] >>> 29;
+      b15 = s[21] << 3 | s[20] >>> 29;
+      b46 = s[31] << 9 | s[30] >>> 23;
+      b47 = s[30] << 9 | s[31] >>> 23;
+      b28 = s[40] << 18 | s[41] >>> 14;
+      b29 = s[41] << 18 | s[40] >>> 14;
+      b20 = s[2] << 1 | s[3] >>> 31;
+      b21 = s[3] << 1 | s[2] >>> 31;
+      b2 = s[13] << 12 | s[12] >>> 20;
+      b3 = s[12] << 12 | s[13] >>> 20;
+      b34 = s[22] << 10 | s[23] >>> 22;
+      b35 = s[23] << 10 | s[22] >>> 22;
+      b16 = s[33] << 13 | s[32] >>> 19;
+      b17 = s[32] << 13 | s[33] >>> 19;
+      b48 = s[42] << 2 | s[43] >>> 30;
+      b49 = s[43] << 2 | s[42] >>> 30;
+      b40 = s[5] << 30 | s[4] >>> 2;
+      b41 = s[4] << 30 | s[5] >>> 2;
+      b22 = s[14] << 6 | s[15] >>> 26;
+      b23 = s[15] << 6 | s[14] >>> 26;
+      b4 = s[25] << 11 | s[24] >>> 21;
+      b5 = s[24] << 11 | s[25] >>> 21;
+      b36 = s[34] << 15 | s[35] >>> 17;
+      b37 = s[35] << 15 | s[34] >>> 17;
+      b18 = s[45] << 29 | s[44] >>> 3;
+      b19 = s[44] << 29 | s[45] >>> 3;
+      b10 = s[6] << 28 | s[7] >>> 4;
+      b11 = s[7] << 28 | s[6] >>> 4;
+      b42 = s[17] << 23 | s[16] >>> 9;
+      b43 = s[16] << 23 | s[17] >>> 9;
+      b24 = s[26] << 25 | s[27] >>> 7;
+      b25 = s[27] << 25 | s[26] >>> 7;
+      b6 = s[36] << 21 | s[37] >>> 11;
+      b7 = s[37] << 21 | s[36] >>> 11;
+      b38 = s[47] << 24 | s[46] >>> 8;
+      b39 = s[46] << 24 | s[47] >>> 8;
+      b30 = s[8] << 27 | s[9] >>> 5;
+      b31 = s[9] << 27 | s[8] >>> 5;
+      b12 = s[18] << 20 | s[19] >>> 12;
+      b13 = s[19] << 20 | s[18] >>> 12;
+      b44 = s[29] << 7 | s[28] >>> 25;
+      b45 = s[28] << 7 | s[29] >>> 25;
+      b26 = s[38] << 8 | s[39] >>> 24;
+      b27 = s[39] << 8 | s[38] >>> 24;
+      b8 = s[48] << 14 | s[49] >>> 18;
+      b9 = s[49] << 14 | s[48] >>> 18;
+
+      s[0] = b0 ^ ~b2 & b4;
+      s[1] = b1 ^ ~b3 & b5;
+      s[10] = b10 ^ ~b12 & b14;
+      s[11] = b11 ^ ~b13 & b15;
+      s[20] = b20 ^ ~b22 & b24;
+      s[21] = b21 ^ ~b23 & b25;
+      s[30] = b30 ^ ~b32 & b34;
+      s[31] = b31 ^ ~b33 & b35;
+      s[40] = b40 ^ ~b42 & b44;
+      s[41] = b41 ^ ~b43 & b45;
+      s[2] = b2 ^ ~b4 & b6;
+      s[3] = b3 ^ ~b5 & b7;
+      s[12] = b12 ^ ~b14 & b16;
+      s[13] = b13 ^ ~b15 & b17;
+      s[22] = b22 ^ ~b24 & b26;
+      s[23] = b23 ^ ~b25 & b27;
+      s[32] = b32 ^ ~b34 & b36;
+      s[33] = b33 ^ ~b35 & b37;
+      s[42] = b42 ^ ~b44 & b46;
+      s[43] = b43 ^ ~b45 & b47;
+      s[4] = b4 ^ ~b6 & b8;
+      s[5] = b5 ^ ~b7 & b9;
+      s[14] = b14 ^ ~b16 & b18;
+      s[15] = b15 ^ ~b17 & b19;
+      s[24] = b24 ^ ~b26 & b28;
+      s[25] = b25 ^ ~b27 & b29;
+      s[34] = b34 ^ ~b36 & b38;
+      s[35] = b35 ^ ~b37 & b39;
+      s[44] = b44 ^ ~b46 & b48;
+      s[45] = b45 ^ ~b47 & b49;
+      s[6] = b6 ^ ~b8 & b0;
+      s[7] = b7 ^ ~b9 & b1;
+      s[16] = b16 ^ ~b18 & b10;
+      s[17] = b17 ^ ~b19 & b11;
+      s[26] = b26 ^ ~b28 & b20;
+      s[27] = b27 ^ ~b29 & b21;
+      s[36] = b36 ^ ~b38 & b30;
+      s[37] = b37 ^ ~b39 & b31;
+      s[46] = b46 ^ ~b48 & b40;
+      s[47] = b47 ^ ~b49 & b41;
+      s[8] = b8 ^ ~b0 & b2;
+      s[9] = b9 ^ ~b1 & b3;
+      s[18] = b18 ^ ~b10 & b12;
+      s[19] = b19 ^ ~b11 & b13;
+      s[28] = b28 ^ ~b20 & b22;
+      s[29] = b29 ^ ~b21 & b23;
+      s[38] = b38 ^ ~b30 & b32;
+      s[39] = b39 ^ ~b31 & b33;
+      s[48] = b48 ^ ~b40 & b42;
+      s[49] = b49 ^ ~b41 & b43;
+
+      s[0] ^= RC[n];
+      s[1] ^= RC[n + 1];
+    }
+  };
+
+  const keccak = bits => (str, force_utf8 = false) => {
+    var msg;
+    if (str.slice(0, 2) === "0x" && !force_utf8) {
+      msg = [];
+      for (var i = 2, l = str.length; i < l; i += 2) msg.push(parseInt(str.slice(i, i + 2), 16));
+    } else {
+      msg = str;
+    }
+    return update(Keccak(bits, bits), msg);
+  };
+
+  exports = {keccak256: keccak(256)};
+
+  return exports;
+});
+
+const lib_elliptic = lib(() => {
+  "use strict";
+
+  var exports = {};
+
+  var elliptic = exports;
+
+  elliptic.utils = lib_utils_a();
+  elliptic.curves = lib_curves();
+
+  // Protocols
+  elliptic.ec = lib_elliptic_ec();
+
+  return exports;
+});
+
+const lib_base = lib(() => {
+  "use strict";
+
+  var exports = {};
+
+  var utils = lib_utils_a();
+  var getNAF = utils.getNAF;
+  var getJSF = utils.getJSF;
+  var assert = utils.assert;
+
+  function BaseCurve(type, conf) {
+    this.type = type;
+    this.p = new BN(conf.p, 16);
+
+    // Use Montgomery, when there is no fast reduction for the prime
+    this.red = conf.prime ? BN.red(conf.prime) : BN.mont(this.p);
+
+    // Useful for many curves
+    this.zero = new BN(0).toRed(this.red);
+    this.one = new BN(1).toRed(this.red);
+    this.two = new BN(2).toRed(this.red);
+
+    // Curve configuration, optional
+    this.n = conf.n && new BN(conf.n, 16);
+    this.g = conf.g && this.pointFromJSON(conf.g, conf.gRed);
+
+    // Temporary arrays
+    this._wnafT1 = new Array(4);
+    this._wnafT2 = new Array(4);
+    this._wnafT3 = new Array(4);
+    this._wnafT4 = new Array(4);
+
+    this._bitLength = this.n ? this.n.bitLength() : 0;
+
+    // Generalized Greg Maxwell's trick
+    var adjustCount = this.n && this.p.div(this.n);
+    if (!adjustCount || adjustCount.cmpn(100) > 0) {
+      this.redN = null;
+    } else {
+      this._maxwellTrick = true;
+      this.redN = this.n.toRed(this.red);
+    }
+  }
+  exports = BaseCurve;
+
+  BaseCurve.prototype._fixedNafMul = function _fixedNafMul(p, k) {
+    assert(p.precomputed);
+    var doubles = p._getDoubles();
+
+    var naf = getNAF(k, 1, this._bitLength);
+    var I = (1 << (doubles.step + 1)) - (doubles.step % 2 === 0 ? 2 : 1);
+    I /= 3;
+
+    // Translate into more windowed form
+    var repr = [];
+    for (var j = 0; j < naf.length; j += doubles.step) {
+      var nafW = 0;
+      for (var K = j + doubles.step - 1; k >= j; k--)
+        nafW = (nafW << 1) + naf[K];
+      repr.push(nafW);
+    }
+
+    var a = this.jpoint(null, null, null);
+    var b = this.jpoint(null, null, null);
+    for (var i = I; i > 0; i--) {
+      for (var j = 0; j < repr.length; j++) {
+        var nafW = repr[j];
+        if (nafW === i)
+          b = b.mixedAdd(doubles.points[j]);
+        else if (nafW === -i)
+          b = b.mixedAdd(doubles.points[j].neg());
+      }
+      a = a.add(b);
+    }
+    return a.toP();
+  };
+
+  BaseCurve.prototype._wnafMulAdd = function _wnafMulAdd(defW, points, coeffs, len, jacobianResult) {
+    var wndWidth = this._wnafT1;
+    var wnd = this._wnafT2;
+    var naf = this._wnafT3;
+
+    // Fill all arrays
+    var max = 0;
+    for (var i = 0; i < len; i++) {
+      var p = points[i];
+      var nafPoints = p._getNAFPoints(defW);
+      wndWidth[i] = nafPoints.wnd;
+      wnd[i] = nafPoints.points;
+    }
+
+    // Comb small window NAFs
+    for (var i = len - 1; i >= 1; i -= 2) {
+      var a = i - 1;
+      var b = i;
+      if (wndWidth[a] !== 1 || wndWidth[b] !== 1) {
+        naf[a] = getNAF(coeffs[a], wndWidth[a], this._bitLength);
+        naf[b] = getNAF(coeffs[b], wndWidth[b], this._bitLength);
+        max = Math.max(naf[a].length, max);
+        max = Math.max(naf[b].length, max);
+        continue;
+      }
+
+      var comb = [
+        points[a], /* 1 */
+        null, /* 3 */
+        null, /* 5 */
+        points[b] /* 7 */
+      ];
+
+      // Try to avoid Projective points, if possible
+      if (points[a].y.cmp(points[b].y) === 0) {
+        comb[1] = points[a].add(points[b]);
+        comb[2] = points[a].toJ().mixedAdd(points[b].neg());
+      } else if (points[a].y.cmp(points[b].y.redNeg()) === 0) {
+        comb[1] = points[a].toJ().mixedAdd(points[b]);
+        comb[2] = points[a].add(points[b].neg());
+      } else {
+        comb[1] = points[a].toJ().mixedAdd(points[b]);
+        comb[2] = points[a].toJ().mixedAdd(points[b].neg());
+      }
+
+      var index = [
+        -3, /* -1 -1 */
+        -1, /* -1 0 */
+        -5, /* -1 1 */
+        -7, /* 0 -1 */
+        0, /* 0 0 */
+        7, /* 0 1 */
+        5, /* 1 -1 */
+        1, /* 1 0 */
+        3  /* 1 1 */
+      ];
+
+      var jsf = getJSF(coeffs[a], coeffs[b]);
+      max = Math.max(jsf[0].length, max);
+      naf[a] = new Array(max);
+      naf[b] = new Array(max);
+      for (var j = 0; j < max; j++) {
+        var ja = jsf[0][j] | 0;
+        var jb = jsf[1][j] | 0;
+
+        naf[a][j] = index[(ja + 1) * 3 + (jb + 1)];
+        naf[b][j] = 0;
+        wnd[a] = comb;
+      }
+    }
+
+    var acc = this.jpoint(null, null, null);
+    var tmp = this._wnafT4;
+    for (var i = max; i >= 0; i--) {
+      var k = 0;
+
+      while (i >= 0) {
+        var zero = true;
+        for (var j = 0; j < len; j++) {
+          tmp[j] = naf[j][i] | 0;
+          if (tmp[j] !== 0)
+            zero = false;
+        }
+        if (!zero)
+          break;
+        k++;
+        i--;
+      }
+      if (i >= 0)
+        k++;
+      acc = acc.dblp(k);
+      if (i < 0)
+        break;
+
+      for (var j = 0; j < len; j++) {
+        var z = tmp[j];
+        var p;
+        if (z === 0)
+          continue;
+        else if (z > 0)
+          p = wnd[j][(z - 1) >> 1];
+        else if (z < 0)
+          p = wnd[j][(-z - 1) >> 1].neg();
+
+        if (p.type === 'affine')
+          acc = acc.mixedAdd(p);
+        else
+          acc = acc.add(p);
+      }
+    }
+    // Zeroify references
+    for (var i = 0; i < len; i++)
+      wnd[i] = null;
+
+    if (jacobianResult)
+      return acc;
+    else
+      return acc.toP();
+  };
+
+  function BasePoint(curve, type) {
+    this.curve = curve;
+    this.type = type;
+    this.precomputed = null;
+  }
+  BaseCurve.BasePoint = BasePoint;
+
+  BasePoint.prototype.validate = function validate() {
+    return this.curve.validate(this);
+  };
+
+  BasePoint.prototype._encode = function _encode(compact) {
+    var len = this.curve.p.byteLength();
+    var x = this.getX().toArray('be', len);
+
+    if (compact)
+      return [ this.getY().isEven() ? 0x02 : 0x03 ].concat(x);
+
+    return [ 0x04 ].concat(x, this.getY().toArray('be', len)) ;
+  };
+
+  BasePoint.prototype.encode = function encode(enc, compact) {
+    return utils.encode(this._encode(compact), enc);
+  };
+
+  BasePoint.prototype.precompute = function precompute(power) {
+    if (this.precomputed)
+      return this;
+
+    var precomputed = {
+      doubles: null,
+      naf: null,
+      beta: null
+    };
+    precomputed.naf = this._getNAFPoints(8);
+    precomputed.doubles = this._getDoubles(4, power);
+    precomputed.beta = this._getBeta();
+    this.precomputed = precomputed;
+
+    return this;
+  };
+
+  BasePoint.prototype._hasDoubles = function _hasDoubles(k) {
+    if (!this.precomputed)
+      return false;
+
+    var doubles = this.precomputed.doubles;
+    if (!doubles)
+      return false;
+
+    return doubles.points.length >= Math.ceil((k.bitLength() + 1) / doubles.step);
+  };
+
+  BasePoint.prototype._getDoubles = function _getDoubles(step, power) {
+    if (this.precomputed && this.precomputed.doubles)
+      return this.precomputed.doubles;
+
+    var doubles = [ this ];
+    var acc = this;
+    for (var i = 0; i < power; i += step) {
+      for (var j = 0; j < step; j++)
+        acc = acc.dbl();
+      doubles.push(acc);
+    }
+    return {
+      step: step,
+      points: doubles
+    };
+  };
+
+  BasePoint.prototype._getNAFPoints = function _getNAFPoints(wnd) {
+    if (this.precomputed && this.precomputed.naf)
+      return this.precomputed.naf;
+
+    var res = [ this ];
+    var max = (1 << wnd) - 1;
+    var dbl = max === 1 ? null : this.dbl();
+    for (var i = 1; i < max; i++)
+      res[i] = res[i - 1].add(dbl);
+    return {
+      wnd: wnd,
+      points: res
+    };
+  };
+
+  return exports;
+});
+
+const lib_curves = lib(() => {
+  "use strict";
+
+  var exports = {};
+
+  var curves = exports;
+
+  var hash = lib_hash();
+  var utils = lib_utils_a();
+
+  var assert = utils.assert;
+
+  function PresetCurve(options) {
+    var curve = lib_curve();
+    this.curve = new curve(options);
+    this.g = this.curve.g;
+    this.n = this.curve.n;
+    this.hash = options.hash;
+    assert(this.g.validate(), 'Invalid curve');
+    assert(this.g.mul(this.n).isInfinity(), 'Invalid curve, G*N != O');
+  }
+  curves.PresetCurve = PresetCurve;
+
+  function defineCurve(name, options) {
+    Object.defineProperty(curves, name, {
+      configurable: true,
+      enumerable: true,
+      get: function() {
+        var curve = new PresetCurve(options);
+        Object.defineProperty(curves, name, {
+          configurable: true,
+          enumerable: true,
+          value: curve
+        });
+        return curve;
+      }
+    });
+  }
+
+  defineCurve('secp256k1', {
+    type: 'short',
+    prime: 'k256',
+    p: 'ffffffff ffffffff ffffffff ffffffff ffffffff ffffffff fffffffe fffffc2f',
+    a: '0',
+    b: '7',
+    n: 'ffffffff ffffffff ffffffff fffffffe baaedce6 af48a03b bfd25e8c d0364141',
+    h: '1',
+    hash: hash.sha256,
+
+    // Precomputed endomorphism
+    beta: '7ae96a2b657c07106e64479eac3434e99cf0497512f58995c1396c28719501ee',
+    lambda: '5363ad4cc05c30e0a5261c028812645a122e22ea20816678df02967c1b23bd72',
+    basis: [
+      {
+        a: '3086d221a7d46bcde86c90e49284eb15',
+        b: '-e4437ed6010e88286f547fa90abfe4c3'
+      },
+      {
+        a: '114ca50f7a8e2f3f657c1108d9d44cfd8',
+        b: '3086d221a7d46bcde86c90e49284eb15'
+      }
+    ],
+
+    gRed: false,
+    g: [
+      '79be667ef9dcbbac55a06295ce870b07029bfcdb2dce28d959f2815b16f81798',
+      '483ada7726a3c4655da4fbfc0e1108a8fd17b448a68554199c47d08ffb10d4b8',
+      {}
+    ]
+  });
+
+  return exports;
+});
+
+const lib_hash = lib(() => {
+  var exports = {};
+
+  var hash = exports;
+  hash.utils = lib_utils_b();
+  hash.common = lib_hash_common();
+  hash.sha = {sha256: lib_sha()};
+  hash.hmac = lib_hmac();
+  hash.sha256 = hash.sha.sha256;
+
+  return exports;
+});
+
+
+const lib_account = lib(() => {
+  var exports = {};
+
+  /* WEBPACK VAR INJECTION */(function(Buffer) {
+  const Bytes = lib_bytes();
+  const elliptic = lib_elliptic();
+  const secp256k1 = new elliptic.ec("secp256k1"); // eslint-disable-line
+  const { keccak256 } = lib_keccak();
+
+  const Nat = {
+    fromString: str => {
+      const bn = "0x" + (str.slice(0, 2) === "0x"
+        ? new BN(str.slice(2), 16)
+        : new BN(str, 10)).toString("hex");
+      return bn === "0x0" ? "0x" : bn;
+    }
+  };
+
+  const addressChecksum = address => {
+    const addressHash = keccak256(address.slice(2).toLowerCase());
+    let checksumAddress = "0x";
+    for (let i = 0; i < 40; i++) checksumAddress += parseInt(addressHash[i + 2], 16) > 7 ? address[i + 2].toUpperCase() : address[i + 2].toLowerCase();
+    return checksumAddress;
+  };
+
+  const addressFromKey = privateKey => {
+    const buffer = Buffer.from(privateKey.slice(2), "hex");
+    const ecKey = secp256k1.keyFromPrivate(buffer);
+    const publicKey = "0x" + ecKey.getPublic(false, 'hex').slice(2);
+    const publicHash = keccak256(publicKey);
+    const address = addressChecksum("0x" + publicHash.slice(-40));
+    return address;
+  };
+
+  const encodeSignature = ([v, r, s]) => Bytes.flatten([r, s, v]);
+
+  const decodeSignature = hex => [Bytes.slice(64, Bytes.length(hex), hex), Bytes.slice(0, 32, hex), Bytes.slice(32, 64, hex)];
+
+  const signMessage = (hash, privateKey, addToV = 27) => {
+    const signature = secp256k1.keyFromPrivate(Buffer.from(privateKey.slice(2), "hex")).sign(Buffer.from(hash.slice(2), "hex"), { canonical: true });
+    return encodeSignature([Nat.fromString(Bytes.fromNumber(addToV + signature.recoveryParam)), Bytes.pad(32, Bytes.fromNat("0x" + signature.r.toString(16))), Bytes.pad(32, Bytes.fromNat("0x" + signature.s.toString(16)))]);
+  };
+
+  const signerAddress = (hash, signature) => {
+    const vals = decodeSignature(signature);
+    const vrs = { v: Bytes.toNumber(vals[0]), r: vals[1].slice(2), s: vals[2].slice(2) };
+    const ecPublicKey = secp256k1.recoverPubKey(Buffer.from(hash.slice(2), "hex"), vrs, vrs.v < 2 ? vrs.v : 1 - vrs.v % 2); // because odd vals mean v=0... sadly that means v=0 means v=1... I hate that
+    const publicKey = "0x" + ecPublicKey.encode("hex", false).slice(2);
+    const publicHash = keccak256(publicKey);
+    const address = addressChecksum("0x" + publicHash.slice(-40));
+    return address;
+  };
+
+  exports = {
+    addressChecksum,
+    addressFromKey,
+    signMessage,
+    signerAddress,
+  };
+  /* WEBPACK VAR INJECTION */}.call(this, lib_buffer().Buffer))
+
+  return exports;
+});
+
+const lib_utils_c = lib(() => {
+  "use strict";
+
+  var exports = {};
+
+  var utils = exports;
+
+  function toArray(msg, enc) {
+    if (Array.isArray(msg))
+      return msg.slice();
+    if (!msg)
+      return [];
+    var res = [];
+    if (typeof msg !== 'string') {
+      for (var i = 0; i < msg.length; i++)
+        res[i] = msg[i] | 0;
+      return res;
+    }
+    if (enc === 'hex') {
+      msg = msg.replace(/[^a-z0-9]+/ig, '');
+      if (msg.length % 2 !== 0)
+        msg = '0' + msg;
+      for (var i = 0; i < msg.length; i += 2)
+        res.push(parseInt(msg[i] + msg[i + 1], 16));
+    } else {
+      for (var i = 0; i < msg.length; i++) {
+        var c = msg.charCodeAt(i);
+        var hi = c >> 8;
+        var lo = c & 0xff;
+        if (hi)
+          res.push(hi, lo);
+        else
+          res.push(lo);
+      }
+    }
+    return res;
+  }
+  utils.toArray = toArray;
+
+  function zero2(word) {
+    if (word.length === 1)
+      return '0' + word;
+    else
+      return word;
+  }
+  utils.zero2 = zero2;
+
+  function toHex(msg) {
+    var res = '';
+    for (var i = 0; i < msg.length; i++)
+      res += zero2(msg[i].toString(16));
+    return res;
+  }
+  utils.toHex = toHex;
+
+  utils.encode = function encode(arr, enc) {
+    if (enc === 'hex')
+      return toHex(arr);
+    else
+      return arr;
+  };
+
+  return exports;
+});
+
+const lib_sha_common = lib(() => {
+  "use strict";
+
+  var exports = {};
+
+  var utils = lib_utils_b();
+  var rotr32 = utils.rotr32;
+
+  function ft_1(s, x, y, z) {/*NOTUSED*/}
+  exports.ft_1 = ft_1;
+
+  function ch32(x, y, z) {
+    return (x & y) ^ ((~x) & z);
+  }
+  exports.ch32 = ch32;
+
+  function maj32(x, y, z) {
+    return (x & y) ^ (x & z) ^ (y & z);
+  }
+  exports.maj32 = maj32;
+
+  function p32(x, y, z) {/*NOTUSED*/}
+  exports.p32 = p32;
+
+  function s0_256(x) {
+    return rotr32(x, 2) ^ rotr32(x, 13) ^ rotr32(x, 22);
+  }
+  exports.s0_256 = s0_256;
+
+  function s1_256(x) {
+    return rotr32(x, 6) ^ rotr32(x, 11) ^ rotr32(x, 25);
+  }
+  exports.s1_256 = s1_256;
+
+  function g0_256(x) {
+    return rotr32(x, 7) ^ rotr32(x, 18) ^ (x >>> 3);
+  }
+  exports.g0_256 = g0_256;
+
+  function g1_256(x) {
+    return rotr32(x, 17) ^ rotr32(x, 19) ^ (x >>> 10);
+  }
+  exports.g1_256 = g1_256;
+
+  return exports;
+});
+
+const lib_sha = lib(() => {
+  "use strict";
+
+  var exports = {};
+
+  var utils = lib_utils_b();
+  var common = lib_hash_common();
+  var shaCommon = lib_sha_common();
+  var assert = lib_assert();
+
+  var sum32 = utils.sum32;
+  var sum32_4 = utils.sum32_4;
+  var sum32_5 = utils.sum32_5;
+  var ch32 = shaCommon.ch32;
+  var maj32 = shaCommon.maj32;
+  var s0_256 = shaCommon.s0_256;
+  var s1_256 = shaCommon.s1_256;
+  var g0_256 = shaCommon.g0_256;
+  var g1_256 = shaCommon.g1_256;
+
+  var BlockHash = common.BlockHash;
+
+  var sha256_K = [
+    0x428a2f98, 0x71374491, 0xb5c0fbcf, 0xe9b5dba5,
+    0x3956c25b, 0x59f111f1, 0x923f82a4, 0xab1c5ed5,
+    0xd807aa98, 0x12835b01, 0x243185be, 0x550c7dc3,
+    0x72be5d74, 0x80deb1fe, 0x9bdc06a7, 0xc19bf174,
+    0xe49b69c1, 0xefbe4786, 0x0fc19dc6, 0x240ca1cc,
+    0x2de92c6f, 0x4a7484aa, 0x5cb0a9dc, 0x76f988da,
+    0x983e5152, 0xa831c66d, 0xb00327c8, 0xbf597fc7,
+    0xc6e00bf3, 0xd5a79147, 0x06ca6351, 0x14292967,
+    0x27b70a85, 0x2e1b2138, 0x4d2c6dfc, 0x53380d13,
+    0x650a7354, 0x766a0abb, 0x81c2c92e, 0x92722c85,
+    0xa2bfe8a1, 0xa81a664b, 0xc24b8b70, 0xc76c51a3,
+    0xd192e819, 0xd6990624, 0xf40e3585, 0x106aa070,
+    0x19a4c116, 0x1e376c08, 0x2748774c, 0x34b0bcb5,
+    0x391c0cb3, 0x4ed8aa4a, 0x5b9cca4f, 0x682e6ff3,
+    0x748f82ee, 0x78a5636f, 0x84c87814, 0x8cc70208,
+    0x90befffa, 0xa4506ceb, 0xbef9a3f7, 0xc67178f2
+  ];
+
+  function SHA256() {
+    if (!(this instanceof SHA256))
+      return new SHA256();
+
+    BlockHash.call(this);
+    this.h = [
+      0x6a09e667, 0xbb67ae85, 0x3c6ef372, 0xa54ff53a,
+      0x510e527f, 0x9b05688c, 0x1f83d9ab, 0x5be0cd19
+    ];
+    this.k = sha256_K;
+    this.W = new Array(64);
+  }
+  utils.inherits(SHA256, BlockHash);
+  exports = SHA256;
+
+  SHA256.blockSize = 512;
+  SHA256.outSize = 256;
+  SHA256.hmacStrength = 192;
+  SHA256.padLength = 64;
+
+  SHA256.prototype._update = function _update(msg, start) {
+    var W = this.W;
+
+    for (var i = 0; i < 16; i++)
+      W[i] = msg[start + i];
+    for (; i < W.length; i++)
+      W[i] = sum32_4(g1_256(W[i - 2]), W[i - 7], g0_256(W[i - 15]), W[i - 16]);
+
+    var a = this.h[0];
+    var b = this.h[1];
+    var c = this.h[2];
+    var d = this.h[3];
+    var e = this.h[4];
+    var f = this.h[5];
+    var g = this.h[6];
+    var h = this.h[7];
+
+    assert(this.k.length === W.length);
+    for (i = 0; i < W.length; i++) {
+      var T1 = sum32_5(h, s1_256(e), ch32(e, f, g), this.k[i], W[i]);
+      var T2 = sum32(s0_256(a), maj32(a, b, c));
+      h = g;
+      g = f;
+      f = e;
+      e = sum32(d, T1);
+      d = c;
+      c = b;
+      b = a;
+      a = sum32(T1, T2);
+    }
+
+    this.h[0] = sum32(this.h[0], a);
+    this.h[1] = sum32(this.h[1], b);
+    this.h[2] = sum32(this.h[2], c);
+    this.h[3] = sum32(this.h[3], d);
+    this.h[4] = sum32(this.h[4], e);
+    this.h[5] = sum32(this.h[5], f);
+    this.h[6] = sum32(this.h[6], g);
+    this.h[7] = sum32(this.h[7], h);
+  };
+
+  SHA256.prototype._digest = function digest(enc) {
+    if (enc === 'hex')
+      return utils.toHex32(this.h, 'big');
+    else
+      return utils.split32(this.h, 'big');
+  };
+
+  return exports;
+});
+
+const lib_curve = lib(() => {
+  "use strict";
+
+  var exports = {};
+
+  var utils = lib_utils_a();
+  var inherits = lib_inherits();
+  var Base = lib_base();
+
+  var assert = utils.assert;
+
+  function ShortCurve(conf) {
+    Base.call(this, 'short', conf);
+
+    this.a = new BN(conf.a, 16).toRed(this.red);
+    this.b = new BN(conf.b, 16).toRed(this.red);
+    this.tinv = this.two.redInvm();
+
+    this.zeroA = this.a.fromRed().cmpn(0) === 0;
+    this.threeA = this.a.fromRed().sub(this.p).cmpn(-3) === 0;
+
+    // If the curve is endomorphic, precalculate beta and lambda
+    this.endo = this._getEndomorphism(conf);
+    this._endoWnafT1 = new Array(4);
+    this._endoWnafT2 = new Array(4);
+  }
+  inherits(ShortCurve, Base);
+  exports = ShortCurve;
+
+  ShortCurve.prototype._getEndomorphism = function _getEndomorphism(conf) {
+    // No efficient endomorphism
+    if (!this.zeroA || !this.g || !this.n || this.p.modn(3) !== 1)
+      return;
+
+    // Compute beta and lambda, that lambda * P = (beta * Px; Py)
+    var beta;
+    var lambda;
+    if (conf.beta) {
+      beta = new BN(conf.beta, 16).toRed(this.red);
+    } else {
+      var betas = this._getEndoRoots(this.p);
+      // Choose the smallest beta
+      beta = betas[0].cmp(betas[1]) < 0 ? betas[0] : betas[1];
+      beta = beta.toRed(this.red);
+    }
+    if (conf.lambda) {
+      lambda = new BN(conf.lambda, 16);
+    } else {
+      // Choose the lambda that is matching selected beta
+      var lambdas = this._getEndoRoots(this.n);
+      if (this.g.mul(lambdas[0]).x.cmp(this.g.x.redMul(beta)) === 0) {
+        lambda = lambdas[0];
+      } else {
+        lambda = lambdas[1];
+        assert(this.g.mul(lambda).x.cmp(this.g.x.redMul(beta)) === 0);
+      }
+    }
+
+    // Get basis vectors, used for balanced length-two representation
+    var basis;
+    if (conf.basis) {
+      basis = conf.basis.map(function(vec) {
+        return {
+          a: new BN(vec.a, 16),
+          b: new BN(vec.b, 16)
+        };
+      });
+    } else {
+      basis = this._getEndoBasis(lambda);
+    }
+
+    return {
+      beta: beta,
+      lambda: lambda,
+      basis: basis
+    };
+  };
+
+  ShortCurve.prototype._endoSplit = function _endoSplit(k) {
+    var basis = this.endo.basis;
+    var v1 = basis[0];
+    var v2 = basis[1];
+
+    var c1 = v2.b.mul(k).divRound(this.n);
+    var c2 = v1.b.neg().mul(k).divRound(this.n);
+
+    var p1 = c1.mul(v1.a);
+    var p2 = c2.mul(v2.a);
+    var q1 = c1.mul(v1.b);
+    var q2 = c2.mul(v2.b);
+
+    // Calculate answer
+    var k1 = k.sub(p1).sub(p2);
+    var k2 = q1.add(q2).neg();
+    return { k1: k1, k2: k2 };
+  };
+
+  ShortCurve.prototype.pointFromX = function pointFromX(x, odd) {
+    x = new BN(x, 16);
+    if (!x.red)
+      x = x.toRed(this.red);
+
+    var y2 = x.redSqr().redMul(x).redIAdd(x.redMul(this.a)).redIAdd(this.b);
+    var y = y2.redSqrt();
+    if (y.redSqr().redSub(y2).cmp(this.zero) !== 0)
+      throw new Error('invalid point');
+
+    // XXX Is there any way to tell if the number is odd without converting it
+    // to non-red form?
+    var isOdd = y.fromRed().isOdd();
+    if (odd && !isOdd || !odd && isOdd)
+      y = y.redNeg();
+
+    return this.point(x, y);
+  };
+
+  ShortCurve.prototype.validate = function validate(point) {
+    if (point.inf)
+      return true;
+
+    var x = point.x;
+    var y = point.y;
+
+    var ax = this.a.redMul(x);
+    var rhs = x.redSqr().redMul(x).redIAdd(ax).redIAdd(this.b);
+    return y.redSqr().redISub(rhs).cmpn(0) === 0;
+  };
+
+  ShortCurve.prototype._endoWnafMulAdd =
+      function _endoWnafMulAdd(points, coeffs, jacobianResult) {
+    var npoints = this._endoWnafT1;
+    var ncoeffs = this._endoWnafT2;
+    for (var i = 0; i < points.length; i++) {
+      var split = this._endoSplit(coeffs[i]);
+      var p = points[i];
+      var beta = p._getBeta();
+
+      if (split.k1.negative) {
+        split.k1.ineg();
+        p = p.neg(true);
+      }
+      if (split.k2.negative) {
+        split.k2.ineg();
+        beta = beta.neg(true);
+      }
+
+      npoints[i * 2] = p;
+      npoints[i * 2 + 1] = beta;
+      ncoeffs[i * 2] = split.k1;
+      ncoeffs[i * 2 + 1] = split.k2;
+    }
+    var res = this._wnafMulAdd(1, npoints, ncoeffs, i * 2, jacobianResult);
+
+    // Clean-up references to points and coefficients
+    for (var j = 0; j < i * 2; j++) {
+      npoints[j] = null;
+      ncoeffs[j] = null;
+    }
+    return res;
+  };
+
+  function Point(curve, x, y, isRed) {
+    Base.BasePoint.call(this, curve, 'affine');
+    if (x === null && y === null) {
+      this.x = null;
+      this.y = null;
+      this.inf = true;
+    } else {
+      this.x = new BN(x, 16);
+      this.y = new BN(y, 16);
+      // Force redgomery representation when loading from JSON
+      if (isRed) {
+        this.x.forceRed(this.curve.red);
+        this.y.forceRed(this.curve.red);
+      }
+      if (!this.x.red)
+        this.x = this.x.toRed(this.curve.red);
+      if (!this.y.red)
+        this.y = this.y.toRed(this.curve.red);
+      this.inf = false;
+    }
+  }
+  inherits(Point, Base.BasePoint);
+
+  ShortCurve.prototype.point = function point(x, y, isRed) {
+    return new Point(this, x, y, isRed);
+  };
+
+  ShortCurve.prototype.pointFromJSON = function pointFromJSON(obj, red) {
+    return Point.fromJSON(this, obj, red);
+  };
+
+  Point.prototype._getBeta = function _getBeta() {
+    if (!this.curve.endo)
+      return;
+
+    var pre = this.precomputed;
+    if (pre && pre.beta)
+      return pre.beta;
+
+    var beta = this.curve.point(this.x.redMul(this.curve.endo.beta), this.y);
+    if (pre) {
+      var curve = this.curve;
+      var endoMul = function(p) {
+        return curve.point(p.x.redMul(curve.endo.beta), p.y);
+      };
+      pre.beta = beta;
+      beta.precomputed = {
+        beta: null,
+        naf: pre.naf && {
+          wnd: pre.naf.wnd,
+          points: pre.naf.points.map(endoMul)
+        },
+        doubles: pre.doubles && {
+          step: pre.doubles.step,
+          points: pre.doubles.points.map(endoMul)
+        }
+      };
+    }
+    return beta;
+  };
+
+  Point.prototype.toJSON = function toJSON() {/*NOTUSED*/};
+
+  Point.fromJSON = function fromJSON(curve, obj, red) {
+    if (typeof obj === 'string')
+      obj = JSON.parse(obj);
+    var res = curve.point(obj[0], obj[1], red);
+    if (!obj[2])
+      return res;
+
+    function obj2point(obj) {
+      return curve.point(obj[0], obj[1], red);
+    }
+
+    var pre = obj[2];
+    res.precomputed = {
+      beta: null,
+      doubles: pre.doubles && {
+        step: pre.doubles.step,
+        points: [ res ].concat(pre.doubles.points.map(obj2point))
+      },
+      naf: pre.naf && {
+        wnd: pre.naf.wnd,
+        points: [ res ].concat(pre.naf.points.map(obj2point))
+      }
+    };
+    return res;
+  };
+
+  Point.prototype.isInfinity = function isInfinity() {
+    return this.inf;
+  };
+
+  Point.prototype.add = function add(p) {
+    // O + P = P
+    if (this.inf)
+      return p;
+
+    // P + O = P
+    if (p.inf)
+      return this;
+
+    // P + P = 2P
+    if (this.eq(p))
+      return this.dbl();
+
+    // P + (-P) = O
+    if (this.neg().eq(p))
+      return this.curve.point(null, null);
+
+    // P + Q = O
+    if (this.x.cmp(p.x) === 0)
+      return this.curve.point(null, null);
+
+    var c = this.y.redSub(p.y);
+    if (c.cmpn(0) !== 0)
+      c = c.redMul(this.x.redSub(p.x).redInvm());
+    var nx = c.redSqr().redISub(this.x).redISub(p.x);
+    var ny = c.redMul(this.x.redSub(nx)).redISub(this.y);
+    return this.curve.point(nx, ny);
+  };
+
+  Point.prototype.getX = function getX() {
+    return this.x.fromRed();
+  };
+
+  Point.prototype.getY = function getY() {
+    return this.y.fromRed();
+  };
+
+  Point.prototype.mul = function mul(k) {
+    k = new BN(k, 16);
+    if (this.isInfinity())
+      return this;
+    else if (this._hasDoubles(k))
+      return this.curve._fixedNafMul(this, k);
+    else if (this.curve.endo)
+      return this.curve._endoWnafMulAdd([ this ], [ k ]);
+    else
+      return this.curve._wnafMul(this, k);
+  };
+
+  Point.prototype.mulAdd = function mulAdd(k1, p2, k2) {
+    var points = [ this, p2 ];
+    var coeffs = [ k1, k2 ];
+    if (this.curve.endo)
+      return this.curve._endoWnafMulAdd(points, coeffs);
+    else
+      return this.curve._wnafMulAdd(1, points, coeffs, 2);
+  };
+
+  Point.prototype.eq = function eq(p) {
+    return this === p ||
+          this.inf === p.inf &&
+              (this.inf || this.x.cmp(p.x) === 0 && this.y.cmp(p.y) === 0);
+  };
+
+  Point.prototype.neg = function neg(_precompute) {
+    if (this.inf)
+      return this;
+
+    var res = this.curve.point(this.x, this.y.redNeg());
+    if (_precompute && this.precomputed) {
+      var pre = this.precomputed;
+      var negate = function(p) {
+        return p.neg();
+      };
+      res.precomputed = {
+        naf: pre.naf && {
+          wnd: pre.naf.wnd,
+          points: pre.naf.points.map(negate)
+        },
+        doubles: pre.doubles && {
+          step: pre.doubles.step,
+          points: pre.doubles.points.map(negate)
+        }
+      };
+    }
+    return res;
+  };
+
+  Point.prototype.toJ = function toJ() {
+    if (this.inf)
+      return this.curve.jpoint(null, null, null);
+
+    var res = this.curve.jpoint(this.x, this.y, this.curve.one);
+    return res;
+  };
+
+  function JPoint(curve, x, y, z) {
+    Base.BasePoint.call(this, curve, 'jacobian');
+    if (x === null && y === null && z === null) {
+      this.x = this.curve.one;
+      this.y = this.curve.one;
+      this.z = new BN(0);
+    } else {
+      this.x = new BN(x, 16);
+      this.y = new BN(y, 16);
+      this.z = new BN(z, 16);
+    }
+    if (!this.x.red)
+      this.x = this.x.toRed(this.curve.red);
+    if (!this.y.red)
+      this.y = this.y.toRed(this.curve.red);
+    if (!this.z.red)
+      this.z = this.z.toRed(this.curve.red);
+
+    this.zOne = this.z === this.curve.one;
+  }
+  inherits(JPoint, Base.BasePoint);
+
+  ShortCurve.prototype.jpoint = function jpoint(x, y, z) {
+    return new JPoint(this, x, y, z);
+  };
+
+  JPoint.prototype.toP = function toP() {
+    if (this.isInfinity())
+      return this.curve.point(null, null);
+
+    var zinv = this.z.redInvm();
+    var zinv2 = zinv.redSqr();
+    var ax = this.x.redMul(zinv2);
+    var ay = this.y.redMul(zinv2).redMul(zinv);
+
+    return this.curve.point(ax, ay);
+  };
+
+  JPoint.prototype.neg = function neg() {
+    return this.curve.jpoint(this.x, this.y.redNeg(), this.z);
+  };
+
+  JPoint.prototype.add = function add(p) {
+    // O + P = P
+    if (this.isInfinity())
+      return p;
+
+    // P + O = P
+    if (p.isInfinity())
+      return this;
+
+    // 12M + 4S + 7A
+    var pz2 = p.z.redSqr();
+    var z2 = this.z.redSqr();
+    var u1 = this.x.redMul(pz2);
+    var u2 = p.x.redMul(z2);
+    var s1 = this.y.redMul(pz2.redMul(p.z));
+    var s2 = p.y.redMul(z2.redMul(this.z));
+
+    var h = u1.redSub(u2);
+    var r = s1.redSub(s2);
+    if (h.cmpn(0) === 0) {
+      if (r.cmpn(0) !== 0)
+        return this.curve.jpoint(null, null, null);
+      else
+        return this.dbl();
+    }
+
+    var h2 = h.redSqr();
+    var h3 = h2.redMul(h);
+    var v = u1.redMul(h2);
+
+    var nx = r.redSqr().redIAdd(h3).redISub(v).redISub(v);
+    var ny = r.redMul(v.redISub(nx)).redISub(s1.redMul(h3));
+    var nz = this.z.redMul(p.z).redMul(h);
+
+    return this.curve.jpoint(nx, ny, nz);
+  };
+
+  JPoint.prototype.mixedAdd = function mixedAdd(p) {
+    // O + P = P
+    if (this.isInfinity())
+      return p.toJ();
+
+    // P + O = P
+    if (p.isInfinity())
+      return this;
+
+    // 8M + 3S + 7A
+    var z2 = this.z.redSqr();
+    var u1 = this.x;
+    var u2 = p.x.redMul(z2);
+    var s1 = this.y;
+    var s2 = p.y.redMul(z2).redMul(this.z);
+
+    var h = u1.redSub(u2);
+    var r = s1.redSub(s2);
+    if (h.cmpn(0) === 0) {
+      if (r.cmpn(0) !== 0)
+        return this.curve.jpoint(null, null, null);
+      else
+        return this.dbl();
+    }
+
+    var h2 = h.redSqr();
+    var h3 = h2.redMul(h);
+    var v = u1.redMul(h2);
+
+    var nx = r.redSqr().redIAdd(h3).redISub(v).redISub(v);
+    var ny = r.redMul(v.redISub(nx)).redISub(s1.redMul(h3));
+    var nz = this.z.redMul(h);
+
+    return this.curve.jpoint(nx, ny, nz);
+  };
+
+  JPoint.prototype.dblp = function dblp(pow) {
+    if (pow === 0)
+      return this;
+    if (this.isInfinity())
+      return this;
+    if (!pow)
+      return this.dbl();
+
+    if (this.curve.zeroA || this.curve.threeA) {
+      var r = this;
+      for (var i = 0; i < pow; i++)
+        r = r.dbl();
+      return r;
+    }
+
+    // 1M + 2S + 1A + N * (4S + 5M + 8A)
+    // N = 1 => 6M + 6S + 9A
+    var a = this.curve.a;
+    var tinv = this.curve.tinv;
+
+    var jx = this.x;
+    var jy = this.y;
+    var jz = this.z;
+    var jz4 = jz.redSqr().redSqr();
+
+    // Reuse results
+    var jyd = jy.redAdd(jy);
+    for (var i = 0; i < pow; i++) {
+      var jx2 = jx.redSqr();
+      var jyd2 = jyd.redSqr();
+      var jyd4 = jyd2.redSqr();
+      var c = jx2.redAdd(jx2).redIAdd(jx2).redIAdd(a.redMul(jz4));
+
+      var t1 = jx.redMul(jyd2);
+      var nx = c.redSqr().redISub(t1.redAdd(t1));
+      var t2 = t1.redISub(nx);
+      var dny = c.redMul(t2);
+      dny = dny.redIAdd(dny).redISub(jyd4);
+      var nz = jyd.redMul(jz);
+      if (i + 1 < pow)
+        jz4 = jz4.redMul(jyd4);
+
+      jx = nx;
+      jz = nz;
+      jyd = dny;
+    }
+
+    return this.curve.jpoint(jx, jyd.redMul(tinv), jz);
+  };
+
+  JPoint.prototype.dbl = function dbl() {
+    if (this.isInfinity())
+      return this;
+
+    if (this.curve.zeroA)
+      return this._zeroDbl();
+    else if (this.curve.threeA)
+      return this._threeDbl();
+    else
+      return this._dbl();
+  };
+
+  JPoint.prototype._zeroDbl = function _zeroDbl() {
+    var nx;
+    var ny;
+    var nz;
+    // Z = 1
+    if (this.zOne) {
+      // hyperelliptic.org/EFD/g1p/auto-shortw-jacobian-0.html
+      //     #doubling-mdbl-2007-bl
+      // 1M + 5S + 14A
+
+      // XX = X1^2
+      var xx = this.x.redSqr();
+      // YY = Y1^2
+      var yy = this.y.redSqr();
+      // YYYY = YY^2
+      var yyyy = yy.redSqr();
+      // S = 2 * ((X1 + YY)^2 - XX - YYYY)
+      var s = this.x.redAdd(yy).redSqr().redISub(xx).redISub(yyyy);
+      s = s.redIAdd(s);
+      // M = 3 * XX + a; a = 0
+      var m = xx.redAdd(xx).redIAdd(xx);
+      // T = M ^ 2 - 2*S
+      var t = m.redSqr().redISub(s).redISub(s);
+
+      // 8 * YYYY
+      var yyyy8 = yyyy.redIAdd(yyyy);
+      yyyy8 = yyyy8.redIAdd(yyyy8);
+      yyyy8 = yyyy8.redIAdd(yyyy8);
+
+      // X3 = T
+      nx = t;
+      // Y3 = M * (S - T) - 8 * YYYY
+      ny = m.redMul(s.redISub(t)).redISub(yyyy8);
+      // Z3 = 2*Y1
+      nz = this.y.redAdd(this.y);
+    } else {
+      // hyperelliptic.org/EFD/g1p/auto-shortw-jacobian-0.html
+      //     #doubling-dbl-2009-l
+      // 2M + 5S + 13A
+
+      // A = X1^2
+      var a = this.x.redSqr();
+      // B = Y1^2
+      var b = this.y.redSqr();
+      // C = B^2
+      var c = b.redSqr();
+      // D = 2 * ((X1 + B)^2 - A - C)
+      var d = this.x.redAdd(b).redSqr().redISub(a).redISub(c);
+      d = d.redIAdd(d);
+      // E = 3 * A
+      var e = a.redAdd(a).redIAdd(a);
+      // F = E^2
+      var f = e.redSqr();
+
+      // 8 * C
+      var c8 = c.redIAdd(c);
+      c8 = c8.redIAdd(c8);
+      c8 = c8.redIAdd(c8);
+
+      // X3 = F - 2 * D
+      nx = f.redISub(d).redISub(d);
+      // Y3 = E * (D - X3) - 8 * C
+      ny = e.redMul(d.redISub(nx)).redISub(c8);
+      // Z3 = 2 * Y1 * Z1
+      nz = this.y.redMul(this.z);
+      nz = nz.redIAdd(nz);
+    }
+
+    return this.curve.jpoint(nx, ny, nz);
+  };
+
+  JPoint.prototype.isInfinity = function isInfinity() {
+    // XXX This code assumes that zero is always zero in red
+    return this.z.cmpn(0) === 0;
+  };
+
+  return exports;
+});
+
+const lib_hmac = lib(() => {
+  "use strict";
+
+  var exports = {};
+
+  var utils = lib_utils_b();
+  var assert = lib_assert();
+
+  function Hmac(hash, key, enc) {
+    if (!(this instanceof Hmac))
+      return new Hmac(hash, key, enc);
+    this.Hash = hash;
+    this.blockSize = hash.blockSize / 8;
+    this.outSize = hash.outSize / 8;
+    this.inner = null;
+    this.outer = null;
+
+    this._init(utils.toArray(key, enc));
+  }
+  exports = Hmac;
+
+  Hmac.prototype._init = function init(key) {
+    // Shorten key, if needed
+    if (key.length > this.blockSize)
+      key = new this.Hash().update(key).digest();
+    assert(key.length <= this.blockSize);
+
+    // Add padding to key
+    for (var i = key.length; i < this.blockSize; i++)
+      key.push(0);
+
+    for (i = 0; i < key.length; i++)
+      key[i] ^= 0x36;
+    this.inner = new this.Hash().update(key);
+
+    // 0x36 ^ 0x5c = 0x6a
+    for (i = 0; i < key.length; i++)
+      key[i] ^= 0x6a;
+    this.outer = new this.Hash().update(key);
+  };
+
+  Hmac.prototype.update = function update(msg, enc) {
+    this.inner.update(msg, enc);
+    return this;
+  };
+
+  Hmac.prototype.digest = function digest(enc) {
+    this.outer.update(this.inner.digest());
+    return this.outer.digest(enc);
+  };
+
+  return exports;
+});
+
+const lib_elliptic_ec = lib(() => {
+  "use strict";
+
+  var exports = {};
+
+  var HmacDRBG = lib_hmac_drgb();
+  var utils = lib_utils_a();
+  var curves = lib_curves();
+  var assert = utils.assert;
+
+  var KeyPair = lib_keypair();
+  var Signature = lib_signature();
+
+  function EC(options) {
+    if (!(this instanceof EC))
+      return new EC(options);
+
+    // Shortcut `elliptic.ec(curve-name)`
+    if (typeof options === 'string') {
+      assert(curves.hasOwnProperty(options), 'Unknown curve ' + options);
+
+      options = curves[options];
+    }
+
+    // Shortcut for `elliptic.ec(elliptic.curves.curveName)`
+    if (options instanceof curves.PresetCurve)
+      options = { curve: options };
+
+    this.curve = options.curve.curve;
+    this.n = this.curve.n;
+    this.nh = this.n.ushrn(1);
+    this.g = this.curve.g;
+
+    // Point on curve
+    this.g = options.curve.g;
+    this.g.precompute(options.curve.n.bitLength() + 1);
+
+    // Hash for function for DRBG
+    this.hash = options.hash || options.curve.hash;
+  }
+  exports = EC;
+
+  EC.prototype.keyFromPrivate = function keyFromPrivate(priv, enc) {
+    return KeyPair.fromPrivate(this, priv, enc);
+  };
+
+  EC.prototype._truncateToN = function truncateToN(msg, truncOnly) {
+    var delta = msg.byteLength() * 8 - this.n.bitLength();
+    if (delta > 0)
+      msg = msg.ushrn(delta);
+    if (!truncOnly && msg.cmp(this.n) >= 0)
+      return msg.sub(this.n);
+    else
+      return msg;
+  };
+
+  EC.prototype.sign = function sign(msg, key, enc, options) {
+    if (typeof enc === 'object') {
+      options = enc;
+      enc = null;
+    }
+    if (!options)
+      options = {};
+
+    key = this.keyFromPrivate(key, enc);
+    msg = this._truncateToN(new BN(msg, 16));
+
+    // Zero-extend key to provide enough entropy
+    var bytes = this.n.byteLength();
+    var bkey = key.getPrivate().toArray('be', bytes);
+
+    // Zero-extend nonce to have the same byte size as N
+    var nonce = msg.toArray('be', bytes);
+
+    // Instantiate Hmac_DRBG
+    var drbg = new HmacDRBG({
+      hash: this.hash,
+      entropy: bkey,
+      nonce: nonce,
+      pers: options.pers,
+      persEnc: options.persEnc || 'utf8'
+    });
+
+    // Number of bytes to generate
+    var ns1 = this.n.sub(new BN(1));
+
+    for (var iter = 0; true; iter++) {
+      var k = options.k ?
+          options.k(iter) :
+          new BN(drbg.generate(this.n.byteLength()));
+      k = this._truncateToN(k, true);
+      if (k.cmpn(1) <= 0 || k.cmp(ns1) >= 0)
+        continue;
+
+      var kp = this.g.mul(k);
+      if (kp.isInfinity())
+        continue;
+
+      var kpX = kp.getX();
+      var r = kpX.umod(this.n);
+      if (r.cmpn(0) === 0)
+        continue;
+
+      var s = k.invm(this.n).mul(r.mul(key.getPrivate()).iadd(msg));
+      s = s.umod(this.n);
+      if (s.cmpn(0) === 0)
+        continue;
+
+      var recoveryParam = (kp.getY().isOdd() ? 1 : 0) |
+                          (kpX.cmp(r) !== 0 ? 2 : 0);
+
+      // Use complement of `s`, if it is > `n / 2`
+      if (options.canonical && s.cmp(this.nh) > 0) {
+        s = this.n.sub(s);
+        recoveryParam ^= 1;
+      }
+
+      return new Signature({ r: r, s: s, recoveryParam: recoveryParam });
+    }
+  };
+
+  EC.prototype.recoverPubKey = function(msg, signature, j, enc) {
+    assert((3 & j) === j, 'The recovery param is more than two bits');
+    signature = new Signature(signature, enc);
+
+    var n = this.n;
+    var e = new BN(msg);
+    var r = signature.r;
+    var s = signature.s;
+
+    // A set LSB signifies that the y-coordinate is odd
+    var isYOdd = j & 1;
+    var isSecondKey = j >> 1;
+    if (r.cmp(this.curve.p.umod(this.curve.n)) >= 0 && isSecondKey)
+      throw new Error('Unable to find sencond key candinate');
+
+    // 1.1. Let x = r + jn.
+    if (isSecondKey)
+      r = this.curve.pointFromX(r.add(this.curve.n), isYOdd);
+    else
+      r = this.curve.pointFromX(r, isYOdd);
+
+    var rInv = signature.r.invm(n);
+    var s1 = n.sub(e).mul(rInv).umod(n);
+    var s2 = s.mul(rInv).umod(n);
+
+    // 1.6.1 Compute Q = r^-1 (sR -  eG)
+    //               Q = r^-1 (sR + -eG)
+    return this.g.mulAdd(s1, r, s2);
+  };
+
+  return exports;
+});
+
+const lib_hmac_drgb = lib(() => {
+  "use strict";
+
+  var exports = {};
+  var hash = lib_hash();
+  var utils = lib_utils_c();
+  var assert = lib_assert();
+
+  function HmacDRBG(options) {
+    if (!(this instanceof HmacDRBG))
+      return new HmacDRBG(options);
+    this.hash = options.hash;
+    this.predResist = !!options.predResist;
+
+    this.outLen = this.hash.outSize;
+    this.minEntropy = options.minEntropy || this.hash.hmacStrength;
+
+    this._reseed = null;
+    this.reseedInterval = null;
+    this.K = null;
+    this.V = null;
+
+    var entropy = utils.toArray(options.entropy, options.entropyEnc || 'hex');
+    var nonce = utils.toArray(options.nonce, options.nonceEnc || 'hex');
+    var pers = utils.toArray(options.pers, options.persEnc || 'hex');
+    assert(entropy.length >= (this.minEntropy / 8),
+          'Not enough entropy. Minimum is: ' + this.minEntropy + ' bits');
+    this._init(entropy, nonce, pers);
+  }
+  exports = HmacDRBG;
+
+  HmacDRBG.prototype._init = function init(entropy, nonce, pers) {
+    var seed = entropy.concat(nonce).concat(pers);
+
+    this.K = new Array(this.outLen / 8);
+    this.V = new Array(this.outLen / 8);
+    for (var i = 0; i < this.V.length; i++) {
+      this.K[i] = 0x00;
+      this.V[i] = 0x01;
+    }
+
+    this._update(seed);
+    this._reseed = 1;
+    this.reseedInterval = 0x1000000000000;  // 2^48
+  };
+
+  HmacDRBG.prototype._hmac = function hmac() {
+    return new hash.hmac(this.hash, this.K);
+  };
+
+  HmacDRBG.prototype._update = function update(seed) {
+    var kmac = this._hmac()
+                  .update(this.V)
+                  .update([ 0x00 ]);
+    if (seed)
+      kmac = kmac.update(seed);
+    this.K = kmac.digest();
+    this.V = this._hmac().update(this.V).digest();
+    if (!seed)
+      return;
+
+    this.K = this._hmac()
+                .update(this.V)
+                .update([ 0x01 ])
+                .update(seed)
+                .digest();
+    this.V = this._hmac().update(this.V).digest();
+  };
+
+  HmacDRBG.prototype.generate = function generate(len, enc, add, addEnc) {
+    if (this._reseed > this.reseedInterval)
+      throw new Error('Reseed is required');
+
+    // Optional encoding
+    if (typeof enc !== 'string') {
+      addEnc = add;
+      add = enc;
+      enc = null;
+    }
+
+    // Optional additional data
+    if (add) {
+      add = utils.toArray(add, addEnc || 'hex');
+      this._update(add);
+    }
+
+    var temp = [];
+    while (temp.length < len) {
+      this.V = this._hmac().update(this.V).digest();
+      temp = temp.concat(this.V);
+    }
+
+    var res = temp.slice(0, len);
+    this._update(add);
+    this._reseed++;
+    return utils.encode(res, enc);
+  };
+
+  return exports;
+});
+
+const lib_keypair = lib(() => {
+  "use strict";
+
+  var exports = {};
+
+  var utils = lib_utils_a();
+  var assert = utils.assert;
+
+  function KeyPair(ec, options) {
+    this.ec = ec;
+    this.priv = null;
+    this.pub = null;
+
+    // KeyPair(ec, { priv: ..., pub: ... })
+    if (options.priv)
+      this._importPrivate(options.priv, options.privEnc);
+    if (options.pub)
+      this._importPublic(options.pub, options.pubEnc);
+  }
+  exports = KeyPair;
+
+  KeyPair.fromPrivate = function fromPrivate(ec, priv, enc) {
+    if (priv instanceof KeyPair)
+      return priv;
+
+    return new KeyPair(ec, {
+      priv: priv,
+      privEnc: enc
+    });
+  };
+
+  KeyPair.prototype.getPublic = function getPublic(compact, enc) {
+    // compact is optional argument
+    if (typeof compact === 'string') {
+      enc = compact;
+      compact = null;
+    }
+
+    if (!this.pub)
+      this.pub = this.ec.g.mul(this.priv);
+
+    if (!enc)
+      return this.pub;
+
+    return this.pub.encode(enc, compact);
+  };
+
+  KeyPair.prototype.getPrivate = function getPrivate(enc) {
+    if (enc === 'hex')
+      return this.priv.toString(16, 2);
+    else
+      return this.priv;
+  };
+
+  KeyPair.prototype._importPrivate = function _importPrivate(key, enc) {
+    this.priv = new BN(key, enc || 16);
+
+    // Ensure that the priv won't be bigger than n, otherwise we may fail
+    // in fixed multiplication method
+    this.priv = this.priv.umod(this.ec.curve.n);
+  };
+
+  // ECDSA
+  KeyPair.prototype.sign = function sign(msg, enc, options) {
+    return this.ec.sign(msg, this, enc, options);
+  };
+
+  return exports;
+});
+
+const lib_signature = lib(() => {
+  "use strict";
+
+  var exports = {};
+
+  var utils = lib_utils_a();
+  var assert = utils.assert;
+
+  function Signature(options, enc) {
+    if (options instanceof Signature)
+      return options;
+
+    assert(options.r && options.s, 'Signature without r or s');
+    this.r = new BN(options.r, 16);
+    this.s = new BN(options.s, 16);
+    if (options.recoveryParam === undefined)
+      this.recoveryParam = null;
+    else
+      this.recoveryParam = options.recoveryParam;
+  }
+  exports = Signature;
+
+  function Position() {
+    this.place = 0;
+  }
+
+  return exports;
+});
+
+var acc = lib_account();
+var addressChecksum = acc.addressChecksum;
+var addressFromKey = acc.addressFromKey;
+var signMessage = acc.signMessage;
+var signerAddress = acc.signerAddress;
+var keccak256 = lib_keccak().keccak256;