From d4e1549114ad37da42d7b3c77cb4e7bcd767591a Mon Sep 17 00:00:00 2001
From: emanuele francioni <emanuele@dusk.network>
Date: Fri, 16 Aug 2019 22:28:34 +0200
Subject: [PATCH] extrapolated dependency to dusk-network/bn256

---
 bls/bls.go             |   2 +-
 bls/bls_test.go        |   2 +-
 bn256/LICENSE          |  27 --
 bn256/README.md        |  49 ----
 bn256/bn256.go         | 564 -----------------------------------------
 bn256/bn256_test.go    | 208 ---------------
 bn256/constants.go     |  56 ----
 bn256/curve.go         | 233 -----------------
 bn256/example_test.go  |  39 ---
 bn256/gfp.go           |  67 -----
 bn256/gfp12.go         | 191 --------------
 bn256/gfp2.go          | 150 -----------
 bn256/gfp6.go          | 213 ----------------
 bn256/gfp_amd64.s      | 129 ----------
 bn256/gfp_arm64.s      | 113 ---------
 bn256/gfp_decl.go      |  24 --
 bn256/gfp_generic.go   | 173 -------------
 bn256/mul_amd64.h      | 181 -------------
 bn256/mul_arm64.h      | 133 ----------
 bn256/mul_bmi2_amd64.h | 112 --------
 bn256/optate.go        | 268 --------------------
 bn256/twist.go         | 199 ---------------
 go.mod                 |   1 +
 go.sum                 |   2 +
 24 files changed, 5 insertions(+), 3131 deletions(-)
 delete mode 100644 bn256/LICENSE
 delete mode 100644 bn256/README.md
 delete mode 100644 bn256/bn256.go
 delete mode 100644 bn256/bn256_test.go
 delete mode 100644 bn256/constants.go
 delete mode 100644 bn256/curve.go
 delete mode 100644 bn256/example_test.go
 delete mode 100644 bn256/gfp.go
 delete mode 100644 bn256/gfp12.go
 delete mode 100644 bn256/gfp2.go
 delete mode 100644 bn256/gfp6.go
 delete mode 100644 bn256/gfp_amd64.s
 delete mode 100644 bn256/gfp_arm64.s
 delete mode 100644 bn256/gfp_decl.go
 delete mode 100644 bn256/gfp_generic.go
 delete mode 100644 bn256/mul_amd64.h
 delete mode 100644 bn256/mul_arm64.h
 delete mode 100644 bn256/mul_bmi2_amd64.h
 delete mode 100644 bn256/optate.go
 delete mode 100644 bn256/twist.go

diff --git a/bls/bls.go b/bls/bls.go
index 5a59aea..e1eb311 100644
--- a/bls/bls.go
+++ b/bls/bls.go
@@ -14,7 +14,7 @@ import (
 	"io"
 	"math/big"
 
-	"github.com/dusk-network/dusk-crypto/bn256"
+	"github.com/dusk-network/bn256"
 	"github.com/dusk-network/dusk-crypto/hash"
 
 	"github.com/pkg/errors"
diff --git a/bls/bls_test.go b/bls/bls_test.go
index 2c123ae..4389054 100644
--- a/bls/bls_test.go
+++ b/bls/bls_test.go
@@ -8,7 +8,7 @@ import (
 	"math/big"
 	"testing"
 
-	"github.com/dusk-network/dusk-crypto/bn256"
+	"github.com/dusk-network/bn256"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
diff --git a/bn256/LICENSE b/bn256/LICENSE
deleted file mode 100644
index 6a66aea..0000000
--- a/bn256/LICENSE
+++ /dev/null
@@ -1,27 +0,0 @@
-Copyright (c) 2009 The Go Authors. All rights reserved.
-
-Redistribution and use in source and binary forms, with or without
-modification, are permitted provided that the following conditions are
-met:
-
-   * Redistributions of source code must retain the above copyright
-notice, this list of conditions and the following disclaimer.
-   * Redistributions in binary form must reproduce the above
-copyright notice, this list of conditions and the following disclaimer
-in the documentation and/or other materials provided with the
-distribution.
-   * Neither the name of Google Inc. nor the names of its
-contributors may be used to endorse or promote products derived from
-this software without specific prior written permission.
-
-THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
-"AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
-LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
-A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
-OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
-SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
-LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
-DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
-THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
-OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
diff --git a/bn256/README.md b/bn256/README.md
deleted file mode 100644
index 1890fda..0000000
--- a/bn256/README.md
+++ /dev/null
@@ -1,49 +0,0 @@
-bn256
------
-
-Package bn256 implements a particular bilinear group at the 128-bit security
-level. It is a modification of the official version at
-https://golang.org/x/crypto/bn256 but all operations are ~10 times faster on
-amd64 and arm64. There is a `lattices` branch for non-commercial use where
-non-pairing operations are up to ~20 times faster.
-
-Bilinear groups are the basis of many of the new cryptographic protocols that
-have been proposed over the past decade. They consist of a triplet of groups
-(G₁, G₂ and GT) such that there exists a function e(g₁ˣ,g₂ʸ)=gTˣʸ (where gₓ is a
-generator of the respective group). That function is called a pairing function.
-
-This package specifically implements the Optimal Ate pairing over a 256-bit
-Barreto-Naehrig curve as described in
-http://cryptojedi.org/papers/dclxvi-20100714.pdf. Its output is compatible with
-the implementation described in that paper.
-
-It also includes functionalities for point compression and decompression into 
-a 33 byte representation. The additional byte includes information to resolve 
-the ambiguity of calculating the Y coordinate from X coordinate using the curve 
-equation
-
-### Benchmarks
-
-branch `master`:
-```
-BenchmarkG1-4        	   10000	    154995 ns/op
-BenchmarkG2-4        	    3000	    541503 ns/op
-BenchmarkGT-4        	    1000	   1267811 ns/op
-BenchmarkPairing-4   	    1000	   1630584 ns/op
-```
-
-branch `lattices`: *NB, this branch has not been migrated from original CF repo*
-```
-BenchmarkG1-4        	   20000	     92198 ns/op
-BenchmarkG2-4        	    5000	    340622 ns/op
-BenchmarkGT-4        	    2000	    635061 ns/op
-BenchmarkPairing-4   	    1000	   1629943 ns/op
-```
-
-official version:
-```
-BenchmarkG1-4        	    1000	   2268491 ns/op
-BenchmarkG2-4        	     300	   7227637 ns/op
-BenchmarkGT-4        	     100	  15121359 ns/op
-BenchmarkPairing-4   	      50	  20296164 ns/op
-```
diff --git a/bn256/bn256.go b/bn256/bn256.go
deleted file mode 100644
index a69b4ff..0000000
--- a/bn256/bn256.go
+++ /dev/null
@@ -1,564 +0,0 @@
-// Package bn256 implements a particular bilinear group at the 128-bit security
-// level.
-//
-// Bilinear groups are the basis of many of the new cryptographic protocols that
-// have been proposed over the past decade. They consist of a triplet of groups
-// (G₁, G₂ and GT) such that there exists a function e(g₁ˣ,g₂ʸ)=gTˣʸ (where gₓ
-// is a generator of the respective group). That function is called a pairing
-// function.
-//
-// This package specifically implements the Optimal Ate pairing over a 256-bit
-// Barreto-Naehrig curve as described in
-// http://cryptojedi.org/papers/dclxvi-20100714.pdf. Its output is compatible
-// with the implementation described in that paper.
-package bn256
-
-import (
-	"crypto/rand"
-	"errors"
-	"fmt"
-	"io"
-	"math/big"
-)
-
-func randomK(r io.Reader) (k *big.Int, err error) {
-	for {
-		k, err = rand.Int(r, Order)
-		if err != nil {
-			return nil, err
-		}
-
-		if k.Sign() > 0 {
-			return
-		}
-	}
-}
-
-// G1 is an abstract cyclic group. The zero value is suitable for use as the
-// output of an operation, but cannot be used as an input.
-type G1 struct {
-	p *curvePoint
-}
-
-// RandomG1 returns x and g₁ˣ where x is a random, non-zero number read from r.
-func RandomG1(r io.Reader) (*big.Int, *G1, error) {
-	k, err := randomK(r)
-	if err != nil {
-		return nil, nil, err
-	}
-
-	return k, new(G1).ScalarBaseMult(k), nil
-}
-
-func (g *G1) String() string {
-	return "bn256.G1" + g.p.String()
-}
-
-// ScalarBaseMult sets e to g*k where g is the generator of the group and then
-// returns e.
-func (e *G1) ScalarBaseMult(k *big.Int) *G1 {
-	if e.p == nil {
-		e.p = &curvePoint{}
-	}
-	e.p.Mul(curveGen, k)
-	return e
-}
-
-// ScalarMult sets e to a*k and then returns e.
-func (e *G1) ScalarMult(a *G1, k *big.Int) *G1 {
-	if e.p == nil {
-		e.p = &curvePoint{}
-	}
-	e.p.Mul(a.p, k)
-	return e
-}
-
-// Add sets e to a+b and then returns e.
-func (e *G1) Add(a, b *G1) *G1 {
-	if e.p == nil {
-		e.p = &curvePoint{}
-	}
-	e.p.Add(a.p, b.p)
-	return e
-}
-
-// Neg sets e to -a and then returns e.
-func (e *G1) Neg(a *G1) *G1 {
-	if e.p == nil {
-		e.p = &curvePoint{}
-	}
-	e.p.Neg(a.p)
-	return e
-}
-
-// Set sets e to a and then returns e.
-func (e *G1) Set(a *G1) *G1 {
-	if e.p == nil {
-		e.p = &curvePoint{}
-	}
-	e.p.Set(a.p)
-	return e
-}
-
-// Marshal converts e to a byte slice.
-func (e *G1) Marshal() []byte {
-	// Each value is a 256-bit number.
-	const numBytes = 256 / 8
-
-	e.p.MakeAffine()
-	ret := make([]byte, numBytes*2)
-	if e.p.IsInfinity() {
-		return ret
-	}
-	temp := &gfP{}
-
-	montDecode(temp, &e.p.x)
-	temp.Marshal(ret)
-	montDecode(temp, &e.p.y)
-	temp.Marshal(ret[numBytes:])
-
-	return ret
-}
-
-// Compress G1 by dropping the Y (but retaining its most significant non-zero byte). It returns a [33]byte
-func (e *G1) Compress() []byte {
-	eb := e.Marshal()
-	y := new(big.Int).SetBytes(eb[32:])
-
-	// calculating the other possible solution of y²=x³+3
-	y2 := new(big.Int).Sub(p, y)
-	// if the specular solution is a bigger nr. we encode 0x00
-	if y.Cmp(y2) < 0 {
-		eb[32] = 0x00
-	} else { // the specular solution is lower
-		eb[32] = 0x01
-	}
-
-	//appending to X the information about which nr to pick for Y
-	//if the smaller or the bigger
-	return eb[0:33]
-}
-
-func marshal(xb []byte, yi *big.Int) *G1 {
-	yb := yi.Bytes()
-
-	// padding the byte array
-	padding := make([]byte, 32-len(yb))
-	y := append(padding, yb...)
-	g := append(xb[0:32], y...)
-	g1 := new(G1)
-	g1.Unmarshal(g)
-	return g1
-}
-
-// xToY reconstructs Y from X using the curve equation.
-// it provides two solutions
-func xToY(xb []byte) (*big.Int, *big.Int, bool) {
-	xi := new(big.Int).SetBytes(xb[0:32])
-	x3 := new(big.Int).Mul(xi, xi)
-	x3.Mul(x3, xi)
-
-	t := new(big.Int).Add(x3, big.NewInt(B))
-	y1 := new(big.Int).ModSqrt(t, p)
-	if y1 == nil {
-		return nil, nil, false
-	}
-
-	y2 := new(big.Int).Sub(p, y1)
-	return y1, y2, true
-	// yp1, yp2, ok := cipolla(*t, *p)
-	// return &yp1, &yp2, ok
-}
-
-// Decompress unzip the Y coordinate using the curve. Y is always positive
-// TODO: use native gfP representation instead of big.Int
-func Decompress(xb []byte) (*G1, error) {
-	if len(xb) != 33 {
-		return nil, errors.New("bn256: not enough data on compressed point")
-	}
-
-	// TODO: we need to make sure that cipolla's results are always in the same order
-	y1, y2, ok := xToY(xb)
-
-	if !ok {
-		return nil, errors.New("bn256: Cannot decompress")
-	}
-
-	smaller := y1.Cmp(y2) < 0
-	if xb[32] == 0x00 && smaller {
-		return marshal(xb, y1), nil
-	}
-
-	if xb[32] == 0x01 && smaller {
-		return marshal(xb, y2), nil
-	}
-
-	if xb[32] == 0x00 {
-		return marshal(xb, y2), nil
-	}
-
-	return marshal(xb, y1), nil
-}
-
-// DecompressAmbiguous returns both solutions to the decompression function
-func DecompressAmbiguous(xb []byte) (*G1, *G1, error) {
-	if len(xb) != 33 {
-		return nil, nil, errors.New("bn256: not enough data on compressed point")
-	}
-
-	y1, y2, ok := xToY(xb)
-
-	if !ok {
-		return nil, nil, errors.New("bn256: Cannot decompress")
-	}
-
-	if y1 == nil && y2 == nil {
-		fmt.Printf("%v\n", new(big.Int).SetBytes(xb).String())
-	}
-
-	return marshal(xb, y1), marshal(xb, y2), nil
-}
-
-// Unmarshal sets e to the result of converting the output of Marshal back into
-// a group element and then returns e.
-func (e *G1) Unmarshal(m []byte) ([]byte, error) {
-	// Each value is a 256-bit number.
-	const numBytes = 256 / 8
-
-	if len(m) < 2*numBytes {
-		return nil, errors.New("bn256: not enough data")
-	}
-
-	if e.p == nil {
-		e.p = &curvePoint{}
-	} else {
-		e.p.x, e.p.y = gfP{0}, gfP{0}
-	}
-
-	e.p.x.Unmarshal(m)
-	e.p.y.Unmarshal(m[numBytes:])
-	montEncode(&e.p.x, &e.p.x)
-	montEncode(&e.p.y, &e.p.y)
-
-	zero := gfP{0}
-	if e.p.x == zero && e.p.y == zero {
-		// This is the point at infinity.
-		e.p.y = *newGFp(1)
-		e.p.z = gfP{0}
-		e.p.t = gfP{0}
-	} else {
-		e.p.z = *newGFp(1)
-		e.p.t = *newGFp(1)
-
-		if !e.p.IsOnCurve() {
-			return nil, errors.New("bn256: malformed point")
-		}
-	}
-
-	return m[2*numBytes:], nil
-}
-
-// G2 is an abstract cyclic group. The zero value is suitable for use as the
-// output of an operation, but cannot be used as an input.
-type G2 struct {
-	p *twistPoint
-}
-
-// RandomG2 returns x and g₂ˣ where x is a random, non-zero number read from r.
-func RandomG2(r io.Reader) (*big.Int, *G2, error) {
-	k, err := randomK(r)
-	if err != nil {
-		return nil, nil, err
-	}
-
-	return k, new(G2).ScalarBaseMult(k), nil
-}
-
-func (e *G2) String() string {
-	return "bn256.G2" + e.p.String()
-}
-
-// ScalarBaseMult sets e to g*k where g is the generator of the group and then
-// returns out.
-func (e *G2) ScalarBaseMult(k *big.Int) *G2 {
-	if e.p == nil {
-		e.p = &twistPoint{}
-	}
-	e.p.Mul(twistGen, k)
-	return e
-}
-
-// ScalarMult sets e to a*k and then returns e.
-func (e *G2) ScalarMult(a *G2, k *big.Int) *G2 {
-	if e.p == nil {
-		e.p = &twistPoint{}
-	}
-	e.p.Mul(a.p, k)
-	return e
-}
-
-// Add sets e to a+b and then returns e.
-func (e *G2) Add(a, b *G2) *G2 {
-	if e.p == nil {
-		e.p = &twistPoint{}
-	}
-	e.p.Add(a.p, b.p)
-	return e
-}
-
-// Neg sets e to -a and then returns e.
-func (e *G2) Neg(a *G2) *G2 {
-	if e.p == nil {
-		e.p = &twistPoint{}
-	}
-	e.p.Neg(a.p)
-	return e
-}
-
-// Set sets e to a and then returns e.
-func (e *G2) Set(a *G2) *G2 {
-	if e.p == nil {
-		e.p = &twistPoint{}
-	}
-	e.p.Set(a.p)
-	return e
-}
-
-// Marshal converts e into a byte slice.
-func (e *G2) Marshal() []byte {
-	// Each value is a 256-bit number.
-	const numBytes = 256 / 8
-
-	if e.p == nil {
-		e.p = &twistPoint{}
-	}
-
-	e.p.MakeAffine()
-	if e.p.IsInfinity() {
-		return make([]byte, 1)
-	}
-
-	ret := make([]byte, 1+numBytes*4)
-	ret[0] = 0x01
-	temp := &gfP{}
-
-	montDecode(temp, &e.p.x.x)
-	temp.Marshal(ret[1:])
-	montDecode(temp, &e.p.x.y)
-	temp.Marshal(ret[1+numBytes:])
-	montDecode(temp, &e.p.y.x)
-	temp.Marshal(ret[1+2*numBytes:])
-	montDecode(temp, &e.p.y.y)
-	temp.Marshal(ret[1+3*numBytes:])
-
-	return ret
-}
-
-// Unmarshal sets e to the result of converting the output of Marshal back into
-// a group element and then returns e.
-func (e *G2) Unmarshal(m []byte) ([]byte, error) {
-	// Each value is a 256-bit number.
-	const numBytes = 256 / 8
-
-	if e.p == nil {
-		e.p = &twistPoint{}
-	}
-
-	if len(m) > 0 && m[0] == 0x00 {
-		e.p.SetInfinity()
-		return m[1:], nil
-	} else if len(m) > 0 && m[0] != 0x01 {
-		return nil, errors.New("bn256: malformed point")
-	} else if len(m) < 1+4*numBytes {
-		return nil, errors.New("bn256: not enough data")
-	}
-
-	e.p.x.x.Unmarshal(m[1:])
-	e.p.x.y.Unmarshal(m[1+numBytes:])
-	e.p.y.x.Unmarshal(m[1+2*numBytes:])
-	e.p.y.y.Unmarshal(m[1+3*numBytes:])
-	montEncode(&e.p.x.x, &e.p.x.x)
-	montEncode(&e.p.x.y, &e.p.x.y)
-	montEncode(&e.p.y.x, &e.p.y.x)
-	montEncode(&e.p.y.y, &e.p.y.y)
-
-	if e.p.x.IsZero() && e.p.y.IsZero() {
-		// This is the point at infinity.
-		e.p.y.SetOne()
-		e.p.z.SetZero()
-		e.p.t.SetZero()
-	} else {
-		e.p.z.SetOne()
-		e.p.t.SetOne()
-
-		if !e.p.IsOnCurve() {
-			return nil, errors.New("bn256: malformed point")
-		}
-	}
-
-	return m[1+4*numBytes:], nil
-}
-
-// GT is an abstract cyclic group. The zero value is suitable for use as the
-// output of an operation, but cannot be used as an input.
-type GT struct {
-	p *gfP12
-}
-
-// RandomGT returns x and e(g₁, g₂)ˣ where x is a random, non-zero number read
-// from r.
-func RandomGT(r io.Reader) (*big.Int, *GT, error) {
-	k, err := randomK(r)
-	if err != nil {
-		return nil, nil, err
-	}
-
-	return k, new(GT).ScalarBaseMult(k), nil
-}
-
-// Pair calculates an Optimal Ate pairing.
-func Pair(g1 *G1, g2 *G2) *GT {
-	return &GT{optimalAte(g2.p, g1.p)}
-}
-
-// Miller applies Miller's algorithm, which is a bilinear function from the
-// source groups to F_p^12. Miller(g1, g2).Finalize() is equivalent to Pair(g1,
-// g2).
-func Miller(g1 *G1, g2 *G2) *GT {
-	return &GT{miller(g2.p, g1.p)}
-}
-
-func (g *GT) String() string {
-	return "bn256.GT" + g.p.String()
-}
-
-// ScalarBaseMult sets e to g*k where g is the generator of the group and then
-// returns out.
-func (e *GT) ScalarBaseMult(k *big.Int) *GT {
-	if e.p == nil {
-		e.p = &gfP12{}
-	}
-	e.p.Exp(gfP12Gen, k)
-	return e
-}
-
-// ScalarMult sets e to a*k and then returns e.
-func (e *GT) ScalarMult(a *GT, k *big.Int) *GT {
-	if e.p == nil {
-		e.p = &gfP12{}
-	}
-	e.p.Exp(a.p, k)
-	return e
-}
-
-// Add sets e to a+b and then returns e.
-func (e *GT) Add(a, b *GT) *GT {
-	if e.p == nil {
-		e.p = &gfP12{}
-	}
-	e.p.Mul(a.p, b.p)
-	return e
-}
-
-// Neg sets e to -a and then returns e.
-func (e *GT) Neg(a *GT) *GT {
-	if e.p == nil {
-		e.p = &gfP12{}
-	}
-	e.p.Conjugate(a.p)
-	return e
-}
-
-// Set sets e to a and then returns e.
-func (e *GT) Set(a *GT) *GT {
-	if e.p == nil {
-		e.p = &gfP12{}
-	}
-	e.p.Set(a.p)
-	return e
-}
-
-// Finalize is a linear function from F_p^12 to GT.
-func (e *GT) Finalize() *GT {
-	ret := finalExponentiation(e.p)
-	e.p.Set(ret)
-	return e
-}
-
-// Marshal converts e into a byte slice.
-func (e *GT) Marshal() []byte {
-	// Each value is a 256-bit number.
-	const numBytes = 256 / 8
-
-	ret := make([]byte, numBytes*12)
-	temp := &gfP{}
-
-	montDecode(temp, &e.p.x.x.x)
-	temp.Marshal(ret)
-	montDecode(temp, &e.p.x.x.y)
-	temp.Marshal(ret[numBytes:])
-	montDecode(temp, &e.p.x.y.x)
-	temp.Marshal(ret[2*numBytes:])
-	montDecode(temp, &e.p.x.y.y)
-	temp.Marshal(ret[3*numBytes:])
-	montDecode(temp, &e.p.x.z.x)
-	temp.Marshal(ret[4*numBytes:])
-	montDecode(temp, &e.p.x.z.y)
-	temp.Marshal(ret[5*numBytes:])
-	montDecode(temp, &e.p.y.x.x)
-	temp.Marshal(ret[6*numBytes:])
-	montDecode(temp, &e.p.y.x.y)
-	temp.Marshal(ret[7*numBytes:])
-	montDecode(temp, &e.p.y.y.x)
-	temp.Marshal(ret[8*numBytes:])
-	montDecode(temp, &e.p.y.y.y)
-	temp.Marshal(ret[9*numBytes:])
-	montDecode(temp, &e.p.y.z.x)
-	temp.Marshal(ret[10*numBytes:])
-	montDecode(temp, &e.p.y.z.y)
-	temp.Marshal(ret[11*numBytes:])
-
-	return ret
-}
-
-// Unmarshal sets e to the result of converting the output of Marshal back into
-// a group element and then returns e.
-func (e *GT) Unmarshal(m []byte) ([]byte, error) {
-	// Each value is a 256-bit number.
-	const numBytes = 256 / 8
-
-	if len(m) < 12*numBytes {
-		return nil, errors.New("bn256: not enough data")
-	}
-
-	if e.p == nil {
-		e.p = &gfP12{}
-	}
-
-	e.p.x.x.x.Unmarshal(m)
-	e.p.x.x.y.Unmarshal(m[numBytes:])
-	e.p.x.y.x.Unmarshal(m[2*numBytes:])
-	e.p.x.y.y.Unmarshal(m[3*numBytes:])
-	e.p.x.z.x.Unmarshal(m[4*numBytes:])
-	e.p.x.z.y.Unmarshal(m[5*numBytes:])
-	e.p.y.x.x.Unmarshal(m[6*numBytes:])
-	e.p.y.x.y.Unmarshal(m[7*numBytes:])
-	e.p.y.y.x.Unmarshal(m[8*numBytes:])
-	e.p.y.y.y.Unmarshal(m[9*numBytes:])
-	e.p.y.z.x.Unmarshal(m[10*numBytes:])
-	e.p.y.z.y.Unmarshal(m[11*numBytes:])
-	montEncode(&e.p.x.x.x, &e.p.x.x.x)
-	montEncode(&e.p.x.x.y, &e.p.x.x.y)
-	montEncode(&e.p.x.y.x, &e.p.x.y.x)
-	montEncode(&e.p.x.y.y, &e.p.x.y.y)
-	montEncode(&e.p.x.z.x, &e.p.x.z.x)
-	montEncode(&e.p.x.z.y, &e.p.x.z.y)
-	montEncode(&e.p.y.x.x, &e.p.y.x.x)
-	montEncode(&e.p.y.x.y, &e.p.y.x.y)
-	montEncode(&e.p.y.y.x, &e.p.y.y.x)
-	montEncode(&e.p.y.y.y, &e.p.y.y.y)
-	montEncode(&e.p.y.z.x, &e.p.y.z.x)
-	montEncode(&e.p.y.z.y, &e.p.y.z.y)
-
-	return m[12*numBytes:], nil
-}
diff --git a/bn256/bn256_test.go b/bn256/bn256_test.go
deleted file mode 100644
index d8de7f9..0000000
--- a/bn256/bn256_test.go
+++ /dev/null
@@ -1,208 +0,0 @@
-package bn256
-
-import (
-	"bytes"
-	"crypto/rand"
-	"testing"
-
-	"golang.org/x/crypto/bn256"
-)
-
-func TestG1(t *testing.T) {
-	k, Ga, err := RandomG1(rand.Reader)
-	if err != nil {
-		t.Fatal(err)
-	}
-	ma := Ga.Marshal()
-
-	Gb := new(bn256.G1).ScalarBaseMult(k)
-	mb := Gb.Marshal()
-
-	if !bytes.Equal(ma, mb) {
-		t.Fatal("bytes are different")
-	}
-}
-
-func TestG1Marshal(t *testing.T) {
-	_, Ga, err := RandomG1(rand.Reader)
-	if err != nil {
-		t.Fatal(err)
-	}
-	ma := Ga.Marshal()
-
-	Gb := new(G1)
-	_, err = Gb.Unmarshal(ma)
-	if err != nil {
-		t.Fatal(err)
-	}
-	mb := Gb.Marshal()
-
-	if !bytes.Equal(ma, mb) {
-		t.Fatal("bytes are different")
-	}
-}
-
-func TestG2(t *testing.T) {
-	k, Ga, err := RandomG2(rand.Reader)
-	if err != nil {
-		t.Fatal(err)
-	}
-	ma := Ga.Marshal()
-
-	Gb := new(bn256.G2).ScalarBaseMult(k)
-	mb := Gb.Marshal()
-	mb = append([]byte{0x01}, mb...)
-
-	if !bytes.Equal(ma, mb) {
-		t.Fatal("bytes are different")
-	}
-}
-
-func TestG2Marshal(t *testing.T) {
-	_, Ga, err := RandomG2(rand.Reader)
-	if err != nil {
-		t.Fatal(err)
-	}
-	ma := Ga.Marshal()
-
-	Gb := new(G2)
-	_, err = Gb.Unmarshal(ma)
-	if err != nil {
-		t.Fatal(err)
-	}
-	mb := Gb.Marshal()
-
-	if !bytes.Equal(ma, mb) {
-		t.Fatal("bytes are different")
-	}
-}
-
-func TestGT(t *testing.T) {
-	k, Ga, err := RandomGT(rand.Reader)
-	if err != nil {
-		t.Fatal(err)
-	}
-	ma := Ga.Marshal()
-
-	Gb, ok := new(bn256.GT).Unmarshal((&GT{gfP12Gen}).Marshal())
-	if !ok {
-		t.Fatal("unmarshal not ok")
-	}
-	Gb.ScalarMult(Gb, k)
-	mb := Gb.Marshal()
-
-	if !bytes.Equal(ma, mb) {
-		t.Fatal("bytes are different")
-	}
-}
-
-func TestGTMarshal(t *testing.T) {
-	_, Ga, err := RandomGT(rand.Reader)
-	if err != nil {
-		t.Fatal(err)
-	}
-	ma := Ga.Marshal()
-
-	Gb := new(GT)
-	_, err = Gb.Unmarshal(ma)
-	if err != nil {
-		t.Fatal(err)
-	}
-	mb := Gb.Marshal()
-
-	if !bytes.Equal(ma, mb) {
-		t.Fatal("bytes are different")
-	}
-}
-
-func TestBilinearity(t *testing.T) {
-	for i := 0; i < 2; i++ {
-		a, p1, _ := RandomG1(rand.Reader)
-		b, p2, _ := RandomG2(rand.Reader)
-		e1 := Pair(p1, p2)
-
-		e2 := Pair(&G1{curveGen}, &G2{twistGen})
-		e2.ScalarMult(e2, a)
-		e2.ScalarMult(e2, b)
-
-		if *e1.p != *e2.p {
-			t.Fatalf("bad pairing result: %s", e1)
-		}
-	}
-}
-
-func TestTripartiteDiffieHellman(t *testing.T) {
-	a, _ := rand.Int(rand.Reader, Order)
-	b, _ := rand.Int(rand.Reader, Order)
-	c, _ := rand.Int(rand.Reader, Order)
-
-	pa, pb, pc := new(G1), new(G1), new(G1)
-	qa, qb, qc := new(G2), new(G2), new(G2)
-
-	pa.Unmarshal(new(G1).ScalarBaseMult(a).Marshal())
-	qa.Unmarshal(new(G2).ScalarBaseMult(a).Marshal())
-	pb.Unmarshal(new(G1).ScalarBaseMult(b).Marshal())
-	qb.Unmarshal(new(G2).ScalarBaseMult(b).Marshal())
-	pc.Unmarshal(new(G1).ScalarBaseMult(c).Marshal())
-	qc.Unmarshal(new(G2).ScalarBaseMult(c).Marshal())
-
-	k1 := Pair(pb, qc)
-	k1.ScalarMult(k1, a)
-	k1Bytes := k1.Marshal()
-
-	k2 := Pair(pc, qa)
-	k2.ScalarMult(k2, b)
-	k2Bytes := k2.Marshal()
-
-	k3 := Pair(pa, qb)
-	k3.ScalarMult(k3, c)
-	k3Bytes := k3.Marshal()
-
-	if !bytes.Equal(k1Bytes, k2Bytes) || !bytes.Equal(k2Bytes, k3Bytes) {
-		t.Errorf("keys didn't agree")
-	}
-}
-
-func BenchmarkG1(b *testing.B) {
-	x, _ := rand.Int(rand.Reader, Order)
-	b.ResetTimer()
-
-	for i := 0; i < b.N; i++ {
-		new(G1).ScalarBaseMult(x)
-	}
-}
-
-func BenchmarkG2(b *testing.B) {
-	x, _ := rand.Int(rand.Reader, Order)
-	b.ResetTimer()
-
-	for i := 0; i < b.N; i++ {
-		new(G2).ScalarBaseMult(x)
-	}
-}
-
-func BenchmarkGT(b *testing.B) {
-	x, _ := rand.Int(rand.Reader, Order)
-	b.ResetTimer()
-
-	for i := 0; i < b.N; i++ {
-		new(GT).ScalarBaseMult(x)
-	}
-}
-
-func BenchmarkPairing(b *testing.B) {
-	for i := 0; i < b.N; i++ {
-		Pair(&G1{curveGen}, &G2{twistGen})
-	}
-}
-
-/*
-func TestMarshalToInt(t *testing.T) {
-	v := int64(10)
-	gfp := newGFp(v)
-	bgfp := make([]byte, 64)
-	gfp.Marshal(bgfp)
-
-	igfp := new(big.Int).Set
-}
-*/
diff --git a/bn256/constants.go b/bn256/constants.go
deleted file mode 100644
index 943751a..0000000
--- a/bn256/constants.go
+++ /dev/null
@@ -1,56 +0,0 @@
-package bn256
-
-import (
-	"math/big"
-)
-
-func bigFromBase10(s string) *big.Int {
-	n, _ := new(big.Int).SetString(s, 10)
-	return n
-}
-
-// u is the BN parameter that determines the prime: 1868033³.
-var u = bigFromBase10("6518589491078791937")
-
-// p is a prime over which we form a basic field: 36u⁴+36u³+24u²+6u+1.
-var p = bigFromBase10("65000549695646603732796438742359905742825358107623003571877145026864184071783")
-
-// Order is the number of elements in both G₁ and G₂: 36u⁴+36u³+18u²+6u+1.
-// order-1 = (2**5) * 3 * 5743 * 280941149 * 130979359433191 * 491513138693455212421542731357 * 6518589491078791937
-var Order = bigFromBase10("65000549695646603732796438742359905742570406053903786389881062969044166799969")
-
-// xiToPMinus1Over6 is ξ^((p-1)/6) where ξ = i+3.
-var xiToPMinus1Over6 = &gfP2{gfP{0x25af52988477cdb7, 0x3d81a455ddced86a, 0x227d012e872c2431, 0x179198d3ea65d05}, gfP{0x7407634dd9cca958, 0x36d5bd6c7afb8f26, 0xf4b1c32cebd880fa, 0x6aa7869306f455f}}
-
-// xiToPMinus1Over3 is ξ^((p-1)/3) where ξ = i+3.
-var xiToPMinus1Over3 = &gfP2{gfP{0x4f59e37c01832e57, 0xae6be39ac2bbbfe4, 0xe04ea1bb697512f8, 0x3097caa8fc40e10e}, gfP{0xf8606916d3816f2c, 0x1e5c0d7926de927e, 0xbc45f3946d81185e, 0x80752a25aa738091}}
-
-// xiToPMinus1Over2 is ξ^((p-1)/2) where ξ = i+3.
-var xiToPMinus1Over2 = &gfP2{gfP{0x19da71333653ee20, 0x7eaaf34fc6ed6019, 0xc4ba3a29a60cdd1d, 0x75281311bcc9df79}, gfP{0x18dbee03fb7708fa, 0x1e7601a602c843c7, 0x5dde0688cdb231cb, 0x86db5cf2c605a524}}
-
-// xiToPSquaredMinus1Over3 is ξ^((p²-1)/3) where ξ = i+3.
-var xiToPSquaredMinus1Over3 = &gfP{0x12d3cef5e1ada57d, 0xe2eca1463753babb, 0xca41e40ddccf750, 0x551337060397e04c}
-
-// xiTo2PSquaredMinus2Over3 is ξ^((2p²-2)/3) where ξ = i+3 (a cubic root of unity, mod p).
-var xiTo2PSquaredMinus2Over3 = &gfP{0x3642364f386c1db8, 0xe825f92d2acd661f, 0xf2aba7e846c19d14, 0x5a0bcea3dc52b7a0}
-
-// xiToPSquaredMinus1Over6 is ξ^((1p²-1)/6) where ξ = i+3 (a cubic root of -1, mod p).
-var xiToPSquaredMinus1Over6 = &gfP{0xe21a761d259c78af, 0x6358fa3f5e84f7e, 0xb7c444d01ac33f0d, 0x35a9333f6e50d058}
-
-// xiTo2PMinus2Over3 is ξ^((2p-2)/3) where ξ = i+3.
-var xiTo2PMinus2Over3 = &gfP2{gfP{0x51678e7469b3c52a, 0x4fb98f8b13319fc9, 0x29b2254db3f1df75, 0x1c044935a3d22fb2}, gfP{0x4d2ea218872f3d2c, 0x2fcb27fc4abe7b69, 0xd31d972f0e88ced9, 0x53adc04a00a73b15}}
-
-// p2 is p, represented as little-endian 64-bit words.
-var p2 = [4]uint64{0x185cac6c5e089667, 0xee5b88d120b5b59e, 0xaa6fecb86184dc21, 0x8fb501e34aa387f9}
-
-// np is the negative inverse of p, mod 2^256.
-var np = [4]uint64{0x2387f9007f17daa9, 0x734b3343ab8513c8, 0x2524282f48054c12, 0x38997ae661c3ef3c}
-
-// rN1 is R^-1 where R = 2^256 mod p.
-var rN1 = &gfP{0xcbb781e36236117d, 0xcc65f3bcec8c91b, 0x2eab68888ea1f515, 0x1fc5c0956f92f825}
-
-// r2 is R^2 where R = 2^256 mod p.
-var r2 = &gfP{0x9c21c3ff7e444f56, 0x409ed151b2efb0c2, 0xc6dc37b80fb1651, 0x7c36e0e62c2380b7}
-
-// r3 is R^3 where R = 2^256 mod p.
-var r3 = &gfP{0x2af2dfb9324a5bb8, 0x388f899054f538a4, 0xdf2ff66396b107a7, 0x24ebbbb3a2529292}
diff --git a/bn256/curve.go b/bn256/curve.go
deleted file mode 100644
index 0fdbc51..0000000
--- a/bn256/curve.go
+++ /dev/null
@@ -1,233 +0,0 @@
-package bn256
-
-import (
-	"math/big"
-)
-
-// B is constant of the curve
-const B = 3
-
-// curvePoint implements the elliptic curve y²=x³+3. Points are kept in Jacobian
-// form and t=z² when valid. G₁ is the set of points of this curve on GF(p).
-type curvePoint struct {
-	x, y, z, t gfP
-}
-
-var curveB = newGFp(B)
-
-// curveGen is the generator of G₁.
-var curveGen = &curvePoint{
-	x: *newGFp(1),
-	y: *newGFp(-2),
-	z: *newGFp(1),
-	t: *newGFp(1),
-}
-
-func (c *curvePoint) String() string {
-	c.MakeAffine()
-	x, y := &gfP{}, &gfP{}
-	montDecode(x, &c.x)
-	montDecode(y, &c.y)
-	return "(" + x.String() + ", " + y.String() + ")"
-}
-
-func (c *curvePoint) Set(a *curvePoint) {
-	c.x.Set(&a.x)
-	c.y.Set(&a.y)
-	c.z.Set(&a.z)
-	c.t.Set(&a.t)
-}
-
-// IsOnCurve returns true iff c is on the curve.
-func (c *curvePoint) IsOnCurve() bool {
-	c.MakeAffine()
-	if c.IsInfinity() {
-		return true
-	}
-
-	y2, x3 := &gfP{}, &gfP{}
-	gfpMul(y2, &c.y, &c.y)
-	gfpMul(x3, &c.x, &c.x)
-	gfpMul(x3, x3, &c.x)
-	gfpAdd(x3, x3, curveB)
-
-	return *y2 == *x3
-}
-
-func (c *curvePoint) SetInfinity() {
-	c.x = gfP{0}
-	c.y = *newGFp(1)
-	c.z = gfP{0}
-	c.t = gfP{0}
-}
-
-func (c *curvePoint) IsInfinity() bool {
-	return c.z == gfP{0}
-}
-
-func (c *curvePoint) Add(a, b *curvePoint) {
-	if a.IsInfinity() {
-		c.Set(b)
-		return
-	}
-	if b.IsInfinity() {
-		c.Set(a)
-		return
-	}
-
-	// See http://hyperelliptic.org/EFD/g1p/auto-code/shortw/jacobian-0/addition/add-2007-bl.op3
-
-	// Normalize the points by replacing a = [x1:y1:z1] and b = [x2:y2:z2]
-	// by [u1:s1:z1·z2] and [u2:s2:z1·z2]
-	// where u1 = x1·z2², s1 = y1·z2³ and u1 = x2·z1², s2 = y2·z1³
-	z12, z22 := &gfP{}, &gfP{}
-	gfpMul(z12, &a.z, &a.z)
-	gfpMul(z22, &b.z, &b.z)
-
-	u1, u2 := &gfP{}, &gfP{}
-	gfpMul(u1, &a.x, z22)
-	gfpMul(u2, &b.x, z12)
-
-	t, s1 := &gfP{}, &gfP{}
-	gfpMul(t, &b.z, z22)
-	gfpMul(s1, &a.y, t)
-
-	s2 := &gfP{}
-	gfpMul(t, &a.z, z12)
-	gfpMul(s2, &b.y, t)
-
-	// Compute x = (2h)²(s²-u1-u2)
-	// where s = (s2-s1)/(u2-u1) is the slope of the line through
-	// (u1,s1) and (u2,s2). The extra factor 2h = 2(u2-u1) comes from the value of z below.
-	// This is also:
-	// 4(s2-s1)² - 4h²(u1+u2) = 4(s2-s1)² - 4h³ - 4h²(2u1)
-	//                        = r² - j - 2v
-	// with the notations below.
-	h := &gfP{}
-	gfpSub(h, u2, u1)
-	xEqual := *h == gfP{0}
-
-	gfpAdd(t, h, h)
-	// i = 4h²
-	i := &gfP{}
-	gfpMul(i, t, t)
-	// j = 4h³
-	j := &gfP{}
-	gfpMul(j, h, i)
-
-	gfpSub(t, s2, s1)
-	yEqual := *t == gfP{0}
-	if xEqual && yEqual {
-		c.Double(a)
-		return
-	}
-	r := &gfP{}
-	gfpAdd(r, t, t)
-
-	v := &gfP{}
-	gfpMul(v, u1, i)
-
-	// t4 = 4(s2-s1)²
-	t4, t6 := &gfP{}, &gfP{}
-	gfpMul(t4, r, r)
-	gfpAdd(t, v, v)
-	gfpSub(t6, t4, j)
-
-	gfpSub(&c.x, t6, t)
-
-	// Set y = -(2h)³(s1 + s*(x/4h²-u1))
-	// This is also
-	// y = - 2·s1·j - (s2-s1)(2x - 2i·u1) = r(v-x) - 2·s1·j
-	gfpSub(t, v, &c.x) // t7
-	gfpMul(t4, s1, j)  // t8
-	gfpAdd(t6, t4, t4) // t9
-	gfpMul(t4, r, t)   // t10
-	gfpSub(&c.y, t4, t6)
-
-	// Set z = 2(u2-u1)·z1·z2 = 2h·z1·z2
-	gfpAdd(t, &a.z, &b.z) // t11
-	gfpMul(t4, t, t)      // t12
-	gfpSub(t, t4, z12)    // t13
-	gfpSub(t4, t, z22)    // t14
-	gfpMul(&c.z, t4, h)
-}
-
-func (c *curvePoint) Double(a *curvePoint) {
-	// See http://hyperelliptic.org/EFD/g1p/auto-code/shortw/jacobian-0/doubling/dbl-2009-l.op3
-	A, B, C := &gfP{}, &gfP{}, &gfP{}
-	gfpMul(A, &a.x, &a.x)
-	gfpMul(B, &a.y, &a.y)
-	gfpMul(C, B, B)
-
-	t, t2 := &gfP{}, &gfP{}
-	gfpAdd(t, &a.x, B)
-	gfpMul(t2, t, t)
-	gfpSub(t, t2, A)
-	gfpSub(t2, t, C)
-
-	d, e, f := &gfP{}, &gfP{}, &gfP{}
-	gfpAdd(d, t2, t2)
-	gfpAdd(t, A, A)
-	gfpAdd(e, t, A)
-	gfpMul(f, e, e)
-
-	gfpAdd(t, d, d)
-	gfpSub(&c.x, f, t)
-
-	gfpAdd(t, C, C)
-	gfpAdd(t2, t, t)
-	gfpAdd(t, t2, t2)
-	gfpSub(&c.y, d, &c.x)
-	gfpMul(t2, e, &c.y)
-	gfpSub(&c.y, t2, t)
-
-	gfpMul(t, &a.y, &a.z)
-	gfpAdd(&c.z, t, t)
-}
-
-func (c *curvePoint) Mul(a *curvePoint, scalar *big.Int) {
-	sum, t := &curvePoint{}, &curvePoint{}
-	sum.SetInfinity()
-
-	for i := scalar.BitLen(); i >= 0; i-- {
-		t.Double(sum)
-		if scalar.Bit(i) != 0 {
-			sum.Add(t, a)
-		} else {
-			sum.Set(t)
-		}
-	}
-
-	c.Set(sum)
-}
-
-func (c *curvePoint) MakeAffine() {
-	if c.z == *newGFp(1) {
-		return
-	} else if c.z == *newGFp(0) {
-		c.x = gfP{0}
-		c.y = *newGFp(1)
-		c.t = gfP{0}
-		return
-	}
-
-	zInv := &gfP{}
-	zInv.Invert(&c.z)
-
-	t, zInv2 := &gfP{}, &gfP{}
-	gfpMul(t, &c.y, zInv)
-	gfpMul(zInv2, zInv, zInv)
-
-	gfpMul(&c.x, &c.x, zInv2)
-	gfpMul(&c.y, t, zInv2)
-
-	c.z = *newGFp(1)
-	c.t = *newGFp(1)
-}
-
-func (c *curvePoint) Neg(a *curvePoint) {
-	c.x.Set(&a.x)
-	gfpNeg(&c.y, &a.y)
-	c.z.Set(&a.z)
-	c.t = gfP{0}
-}
diff --git a/bn256/example_test.go b/bn256/example_test.go
deleted file mode 100644
index 972e2ff..0000000
--- a/bn256/example_test.go
+++ /dev/null
@@ -1,39 +0,0 @@
-package bn256
-
-import (
-	"crypto/rand"
-)
-
-func ExamplePair() {
-	// This implements the tripartite Diffie-Hellman algorithm from "A One
-	// Round Protocol for Tripartite Diffie-Hellman", A. Joux.
-	// http://www.springerlink.com/content/cddc57yyva0hburb/fulltext.pdf
-
-	// Each of three parties, a, b and c, generate a private value.
-	a, _ := rand.Int(rand.Reader, Order)
-	b, _ := rand.Int(rand.Reader, Order)
-	c, _ := rand.Int(rand.Reader, Order)
-
-	// Then each party calculates g₁ and g₂ times their private value.
-	pa := new(G1).ScalarBaseMult(a)
-	qa := new(G2).ScalarBaseMult(a)
-
-	pb := new(G1).ScalarBaseMult(b)
-	qb := new(G2).ScalarBaseMult(b)
-
-	pc := new(G1).ScalarBaseMult(c)
-	qc := new(G2).ScalarBaseMult(c)
-
-	// Now each party exchanges its public values with the other two and
-	// all parties can calculate the shared key.
-	k1 := Pair(pb, qc)
-	k1.ScalarMult(k1, a)
-
-	k2 := Pair(pc, qa)
-	k2.ScalarMult(k2, b)
-
-	k3 := Pair(pa, qb)
-	k3.ScalarMult(k3, c)
-
-	// k1, k2 and k3 will all be equal.
-}
diff --git a/bn256/gfp.go b/bn256/gfp.go
deleted file mode 100644
index 97afa78..0000000
--- a/bn256/gfp.go
+++ /dev/null
@@ -1,67 +0,0 @@
-package bn256
-
-import "fmt"
-
-type gfP [4]uint64
-
-func newGFp(x int64) (out *gfP) {
-	if x >= 0 {
-		out = &gfP{uint64(x)}
-	} else {
-		out = &gfP{uint64(-x)}
-		gfpNeg(out, out)
-	}
-
-	montEncode(out, out)
-	return out
-}
-
-func (e *gfP) String() string {
-	return fmt.Sprintf("%16.16x%16.16x%16.16x%16.16x", e[3], e[2], e[1], e[0])
-}
-
-func (e *gfP) Set(f *gfP) {
-	e[0] = f[0]
-	e[1] = f[1]
-	e[2] = f[2]
-	e[3] = f[3]
-}
-
-func (e *gfP) Invert(f *gfP) {
-	bits := [4]uint64{0x185cac6c5e089665, 0xee5b88d120b5b59e, 0xaa6fecb86184dc21, 0x8fb501e34aa387f9}
-
-	sum, power := &gfP{}, &gfP{}
-	sum.Set(rN1)
-	power.Set(f)
-
-	for word := 0; word < 4; word++ {
-		for bit := uint(0); bit < 64; bit++ {
-			if (bits[word]>>bit)&1 == 1 {
-				gfpMul(sum, sum, power)
-			}
-			gfpMul(power, power, power)
-		}
-	}
-
-	gfpMul(sum, sum, r3)
-	e.Set(sum)
-}
-
-func (e *gfP) Marshal(out []byte) {
-	for w := uint(0); w < 4; w++ {
-		for b := uint(0); b < 8; b++ {
-			out[8*w+b] = byte(e[3-w] >> (56 - 8*b))
-		}
-	}
-}
-
-func (e *gfP) Unmarshal(in []byte) {
-	for w := uint(0); w < 4; w++ {
-		for b := uint(0); b < 8; b++ {
-			e[3-w] += uint64(in[8*w+b]) << (56 - 8*b)
-		}
-	}
-}
-
-func montEncode(c, a *gfP) { gfpMul(c, a, r2) }
-func montDecode(c, a *gfP) { gfpMul(c, a, &gfP{1}) }
diff --git a/bn256/gfp12.go b/bn256/gfp12.go
deleted file mode 100644
index b9f9696..0000000
--- a/bn256/gfp12.go
+++ /dev/null
@@ -1,191 +0,0 @@
-package bn256
-
-// For details of the algorithms used, see "Multiplication and Squaring on
-// Pairing-Friendly Fields, Devegili et al.
-// http://eprint.iacr.org/2006/471.pdf.
-
-import (
-	"math/big"
-)
-
-// gfP12 implements the field of size p¹² as a quadratic extension of gfP6
-// where ω²=τ.
-type gfP12 struct {
-	x, y gfP6 // value is xω + y
-}
-
-var gfP12Gen *gfP12 = &gfP12{
-	x: gfP6{
-		x: gfP2{
-			x: gfP{0x62d608d6bb67a4fb, 0x9a66ec93f0c2032f, 0x5391628e924e1a34, 0x2162dbf7de801d0e},
-			y: gfP{0x3e0c1a72bf08eb4f, 0x4972ec05990a5ecc, 0xf7b9a407ead8007e, 0x3ca04c613572ce49},
-		},
-		y: gfP2{
-			x: gfP{0xace536a5607c910e, 0xda93774a941ddd40, 0x5de0e9853b7593ad, 0xe05bb926f513153},
-			y: gfP{0x3f4c99f8abaf1a22, 0x66d5f6121f86dc33, 0x8e0a82f68a50abba, 0x819927d1eebd0695},
-		},
-		z: gfP2{
-			x: gfP{0x7cdef49c5477faa, 0x40eb71ffedaa199d, 0xbc896661f17c9b8f, 0x3144462983c38c02},
-			y: gfP{0xcd09ee8dd8418013, 0xf8d050d05faa9b11, 0x589e90a555507ee1, 0x58e4ab25f9c49c15},
-		},
-	},
-	y: gfP6{
-		x: gfP2{
-			x: gfP{0x7e76809b142d020b, 0xd9949d1b2822e995, 0x3de93d974f84b076, 0x144523477028928d},
-			y: gfP{0x79952799f9ef4b0, 0x4102c47aa3df01c6, 0xfa82a633c53da2e1, 0x54c3f0392f9f7e0e},
-		},
-		y: gfP2{
-			x: gfP{0xd3432a335533272b, 0xa008fbbdc7d74f4a, 0x68e3c81eb7295ed9, 0x17fe34c21fdecef2},
-			y: gfP{0xfb0bc4c0ef6df55f, 0x8bdc585b70bc2120, 0x17d498d2cb720def, 0x2a368248319b899c},
-		},
-		z: gfP2{
-			x: gfP{0xf8487d81cb354c6c, 0x7421be69f1522caa, 0x6940c778b9fb2d54, 0x7da4b04e102bb621},
-			y: gfP{0x97b91989993e7be4, 0x8526545356eab684, 0xb050073022eb1892, 0x658b432ad09939c0},
-		},
-	},
-}
-
-func (e *gfP12) String() string {
-	return "(" + e.x.String() + "," + e.y.String() + ")"
-}
-
-func (e *gfP12) Set(a *gfP12) *gfP12 {
-	e.x.Set(&a.x)
-	e.y.Set(&a.y)
-	return e
-}
-
-func (e *gfP12) SetZero() *gfP12 {
-	e.x.SetZero()
-	e.y.SetZero()
-	return e
-}
-
-func (e *gfP12) SetOne() *gfP12 {
-	e.x.SetZero()
-	e.y.SetOne()
-	return e
-}
-
-func (e *gfP12) IsZero() bool {
-	return e.x.IsZero() && e.y.IsZero()
-}
-
-func (e *gfP12) IsOne() bool {
-	return e.x.IsZero() && e.y.IsOne()
-}
-
-func (e *gfP12) Conjugate(a *gfP12) *gfP12 {
-	e.x.Neg(&a.x)
-	e.y.Set(&a.y)
-	return e
-}
-
-func (e *gfP12) Neg(a *gfP12) *gfP12 {
-	e.x.Neg(&a.x)
-	e.y.Neg(&a.y)
-	return e
-}
-
-// Frobenius computes (xω+y)^p = x^p ω·ξ^((p-1)/6) + y^p
-func (e *gfP12) Frobenius(a *gfP12) *gfP12 {
-	e.x.Frobenius(&a.x)
-	e.y.Frobenius(&a.y)
-	e.x.MulScalar(&e.x, xiToPMinus1Over6)
-	return e
-}
-
-// FrobeniusP2 computes (xω+y)^p² = x^p² ω·ξ^((p²-1)/6) + y^p²
-func (e *gfP12) FrobeniusP2(a *gfP12) *gfP12 {
-	e.x.FrobeniusP2(&a.x)
-	e.x.MulGFP(&e.x, xiToPSquaredMinus1Over6)
-	e.y.FrobeniusP2(&a.y)
-	return e
-}
-
-func (e *gfP12) FrobeniusP4(a *gfP12) *gfP12 {
-	e.x.FrobeniusP4(&a.x)
-	e.x.MulGFP(&e.x, xiToPSquaredMinus1Over3)
-	e.y.FrobeniusP4(&a.y)
-	return e
-}
-
-func (e *gfP12) Add(a, b *gfP12) *gfP12 {
-	e.x.Add(&a.x, &b.x)
-	e.y.Add(&a.y, &b.y)
-	return e
-}
-
-func (e *gfP12) Sub(a, b *gfP12) *gfP12 {
-	e.x.Sub(&a.x, &b.x)
-	e.y.Sub(&a.y, &b.y)
-	return e
-}
-
-func (e *gfP12) Mul(a, b *gfP12) *gfP12 {
-	tx := (&gfP6{}).Mul(&a.x, &b.y)
-	t := (&gfP6{}).Mul(&b.x, &a.y)
-	tx.Add(tx, t)
-
-	ty := (&gfP6{}).Mul(&a.y, &b.y)
-	t.Mul(&a.x, &b.x).MulTau(t)
-
-	e.x.Set(tx)
-	e.y.Add(ty, t)
-	return e
-}
-
-func (e *gfP12) MulScalar(a *gfP12, b *gfP6) *gfP12 {
-	e.x.Mul(&e.x, b)
-	e.y.Mul(&e.y, b)
-	return e
-}
-
-func (c *gfP12) Exp(a *gfP12, power *big.Int) *gfP12 {
-	sum := (&gfP12{}).SetOne()
-	t := &gfP12{}
-
-	for i := power.BitLen() - 1; i >= 0; i-- {
-		t.Square(sum)
-		if power.Bit(i) != 0 {
-			sum.Mul(t, a)
-		} else {
-			sum.Set(t)
-		}
-	}
-
-	c.Set(sum)
-	return c
-}
-
-func (e *gfP12) Square(a *gfP12) *gfP12 {
-	// Complex squaring algorithm
-	v0 := (&gfP6{}).Mul(&a.x, &a.y)
-
-	t := (&gfP6{}).MulTau(&a.x)
-	t.Add(&a.y, t)
-	ty := (&gfP6{}).Add(&a.x, &a.y)
-	ty.Mul(ty, t).Sub(ty, v0)
-	t.MulTau(v0)
-	ty.Sub(ty, t)
-
-	e.x.Add(v0, v0)
-	e.y.Set(ty)
-	return e
-}
-
-func (e *gfP12) Invert(a *gfP12) *gfP12 {
-	// See "Implementing cryptographic pairings", M. Scott, section 3.2.
-	// ftp://136.206.11.249/pub/crypto/pairings.pdf
-	t1, t2 := &gfP6{}, &gfP6{}
-
-	t1.Square(&a.x)
-	t2.Square(&a.y)
-	t1.MulTau(t1).Sub(t2, t1)
-	t2.Invert(t1)
-
-	e.x.Neg(&a.x)
-	e.y.Set(&a.y)
-	e.MulScalar(e, t2)
-	return e
-}
diff --git a/bn256/gfp2.go b/bn256/gfp2.go
deleted file mode 100644
index d866a5c..0000000
--- a/bn256/gfp2.go
+++ /dev/null
@@ -1,150 +0,0 @@
-package bn256
-
-// For details of the algorithms used, see "Multiplication and Squaring on
-// Pairing-Friendly Fields, Devegili et al.
-// http://eprint.iacr.org/2006/471.pdf.
-
-// gfP2 implements a field of size p² as a quadratic extension of the base field
-// where i²=-1.
-type gfP2 struct {
-	x, y gfP // value is xi+y.
-}
-
-func gfP2Decode(in *gfP2) *gfP2 {
-	out := &gfP2{}
-	montDecode(&out.x, &in.x)
-	montDecode(&out.y, &in.y)
-	return out
-}
-
-func (e *gfP2) String() string {
-	return "(" + e.x.String() + ", " + e.y.String() + ")"
-}
-
-func (e *gfP2) Set(a *gfP2) *gfP2 {
-	e.x.Set(&a.x)
-	e.y.Set(&a.y)
-	return e
-}
-
-func (e *gfP2) SetZero() *gfP2 {
-	e.x = gfP{0}
-	e.y = gfP{0}
-	return e
-}
-
-func (e *gfP2) SetOne() *gfP2 {
-	e.x = gfP{0}
-	e.y = *newGFp(1)
-	return e
-}
-
-func (e *gfP2) IsZero() bool {
-	zero := gfP{0}
-	return e.x == zero && e.y == zero
-}
-
-func (e *gfP2) IsOne() bool {
-	zero, one := gfP{0}, *newGFp(1)
-	return e.x == zero && e.y == one
-}
-
-func (e *gfP2) Conjugate(a *gfP2) *gfP2 {
-	e.y.Set(&a.y)
-	gfpNeg(&e.x, &a.x)
-	return e
-}
-
-func (e *gfP2) Neg(a *gfP2) *gfP2 {
-	gfpNeg(&e.x, &a.x)
-	gfpNeg(&e.y, &a.y)
-	return e
-}
-
-func (e *gfP2) Add(a, b *gfP2) *gfP2 {
-	gfpAdd(&e.x, &a.x, &b.x)
-	gfpAdd(&e.y, &a.y, &b.y)
-	return e
-}
-
-func (e *gfP2) Sub(a, b *gfP2) *gfP2 {
-	gfpSub(&e.x, &a.x, &b.x)
-	gfpSub(&e.y, &a.y, &b.y)
-	return e
-}
-
-// See "Multiplication and Squaring in Pairing-Friendly Fields",
-// http://eprint.iacr.org/2006/471.pdf
-func (e *gfP2) Mul(a, b *gfP2) *gfP2 {
-	tx, t := &gfP{}, &gfP{}
-	gfpMul(tx, &a.x, &b.y)
-	gfpMul(t, &b.x, &a.y)
-	gfpAdd(tx, tx, t)
-
-	ty := &gfP{}
-	gfpMul(ty, &a.y, &b.y)
-	gfpMul(t, &a.x, &b.x)
-	gfpSub(ty, ty, t)
-
-	e.x.Set(tx)
-	e.y.Set(ty)
-	return e
-}
-
-func (e *gfP2) MulScalar(a *gfP2, b *gfP) *gfP2 {
-	gfpMul(&e.x, &a.x, b)
-	gfpMul(&e.y, &a.y, b)
-	return e
-}
-
-// MulXi sets e=ξa where ξ=i+3 and then returns e.
-func (e *gfP2) MulXi(a *gfP2) *gfP2 {
-	// (xi+y)(i+3) = (3x+y)i+(3y-x)
-	tx := &gfP{}
-	gfpAdd(tx, &a.x, &a.x)
-	gfpAdd(tx, tx, &a.x)
-	gfpAdd(tx, tx, &a.y)
-
-	ty := &gfP{}
-	gfpAdd(ty, &a.y, &a.y)
-	gfpAdd(ty, ty, &a.y)
-	gfpSub(ty, ty, &a.x)
-
-	e.x.Set(tx)
-	e.y.Set(ty)
-	return e
-}
-
-func (e *gfP2) Square(a *gfP2) *gfP2 {
-	// Complex squaring algorithm:
-	// (xi+y)² = (x+y)(y-x) + 2*i*x*y
-	tx, ty := &gfP{}, &gfP{}
-	gfpSub(tx, &a.y, &a.x)
-	gfpAdd(ty, &a.x, &a.y)
-	gfpMul(ty, tx, ty)
-
-	gfpMul(tx, &a.x, &a.y)
-	gfpAdd(tx, tx, tx)
-
-	e.x.Set(tx)
-	e.y.Set(ty)
-	return e
-}
-
-func (e *gfP2) Invert(a *gfP2) *gfP2 {
-	// See "Implementing cryptographic pairings", M. Scott, section 3.2.
-	// ftp://136.206.11.249/pub/crypto/pairings.pdf
-	t1, t2 := &gfP{}, &gfP{}
-	gfpMul(t1, &a.x, &a.x)
-	gfpMul(t2, &a.y, &a.y)
-	gfpAdd(t1, t1, t2)
-
-	inv := &gfP{}
-	inv.Invert(t1)
-
-	gfpNeg(t1, &a.x)
-
-	gfpMul(&e.x, t1, inv)
-	gfpMul(&e.y, &a.y, inv)
-	return e
-}
diff --git a/bn256/gfp6.go b/bn256/gfp6.go
deleted file mode 100644
index 83d61b7..0000000
--- a/bn256/gfp6.go
+++ /dev/null
@@ -1,213 +0,0 @@
-package bn256
-
-// For details of the algorithms used, see "Multiplication and Squaring on
-// Pairing-Friendly Fields, Devegili et al.
-// http://eprint.iacr.org/2006/471.pdf.
-
-// gfP6 implements the field of size p⁶ as a cubic extension of gfP2 where τ³=ξ
-// and ξ=i+3.
-type gfP6 struct {
-	x, y, z gfP2 // value is xτ² + yτ + z
-}
-
-func (e *gfP6) String() string {
-	return "(" + e.x.String() + ", " + e.y.String() + ", " + e.z.String() + ")"
-}
-
-func (e *gfP6) Set(a *gfP6) *gfP6 {
-	e.x.Set(&a.x)
-	e.y.Set(&a.y)
-	e.z.Set(&a.z)
-	return e
-}
-
-func (e *gfP6) SetZero() *gfP6 {
-	e.x.SetZero()
-	e.y.SetZero()
-	e.z.SetZero()
-	return e
-}
-
-func (e *gfP6) SetOne() *gfP6 {
-	e.x.SetZero()
-	e.y.SetZero()
-	e.z.SetOne()
-	return e
-}
-
-func (e *gfP6) IsZero() bool {
-	return e.x.IsZero() && e.y.IsZero() && e.z.IsZero()
-}
-
-func (e *gfP6) IsOne() bool {
-	return e.x.IsZero() && e.y.IsZero() && e.z.IsOne()
-}
-
-func (e *gfP6) Neg(a *gfP6) *gfP6 {
-	e.x.Neg(&a.x)
-	e.y.Neg(&a.y)
-	e.z.Neg(&a.z)
-	return e
-}
-
-func (e *gfP6) Frobenius(a *gfP6) *gfP6 {
-	e.x.Conjugate(&a.x)
-	e.y.Conjugate(&a.y)
-	e.z.Conjugate(&a.z)
-
-	e.x.Mul(&e.x, xiTo2PMinus2Over3)
-	e.y.Mul(&e.y, xiToPMinus1Over3)
-	return e
-}
-
-// FrobeniusP2 computes (xτ²+yτ+z)^(p²) = xτ^(2p²) + yτ^(p²) + z
-func (e *gfP6) FrobeniusP2(a *gfP6) *gfP6 {
-	// τ^(2p²) = τ²τ^(2p²-2) = τ²ξ^((2p²-2)/3)
-	e.x.MulScalar(&a.x, xiTo2PSquaredMinus2Over3)
-	// τ^(p²) = ττ^(p²-1) = τξ^((p²-1)/3)
-	e.y.MulScalar(&a.y, xiToPSquaredMinus1Over3)
-	e.z.Set(&a.z)
-	return e
-}
-
-func (e *gfP6) FrobeniusP4(a *gfP6) *gfP6 {
-	e.x.MulScalar(&a.x, xiToPSquaredMinus1Over3)
-	e.y.MulScalar(&a.y, xiTo2PSquaredMinus2Over3)
-	e.z.Set(&a.z)
-	return e
-}
-
-func (e *gfP6) Add(a, b *gfP6) *gfP6 {
-	e.x.Add(&a.x, &b.x)
-	e.y.Add(&a.y, &b.y)
-	e.z.Add(&a.z, &b.z)
-	return e
-}
-
-func (e *gfP6) Sub(a, b *gfP6) *gfP6 {
-	e.x.Sub(&a.x, &b.x)
-	e.y.Sub(&a.y, &b.y)
-	e.z.Sub(&a.z, &b.z)
-	return e
-}
-
-func (e *gfP6) Mul(a, b *gfP6) *gfP6 {
-	// "Multiplication and Squaring on Pairing-Friendly Fields"
-	// Section 4, Karatsuba method.
-	// http://eprint.iacr.org/2006/471.pdf
-	v0 := (&gfP2{}).Mul(&a.z, &b.z)
-	v1 := (&gfP2{}).Mul(&a.y, &b.y)
-	v2 := (&gfP2{}).Mul(&a.x, &b.x)
-
-	t0 := (&gfP2{}).Add(&a.x, &a.y)
-	t1 := (&gfP2{}).Add(&b.x, &b.y)
-	tz := (&gfP2{}).Mul(t0, t1)
-	tz.Sub(tz, v1).Sub(tz, v2).MulXi(tz).Add(tz, v0)
-
-	t0.Add(&a.y, &a.z)
-	t1.Add(&b.y, &b.z)
-	ty := (&gfP2{}).Mul(t0, t1)
-	t0.MulXi(v2)
-	ty.Sub(ty, v0).Sub(ty, v1).Add(ty, t0)
-
-	t0.Add(&a.x, &a.z)
-	t1.Add(&b.x, &b.z)
-	tx := (&gfP2{}).Mul(t0, t1)
-	tx.Sub(tx, v0).Add(tx, v1).Sub(tx, v2)
-
-	e.x.Set(tx)
-	e.y.Set(ty)
-	e.z.Set(tz)
-	return e
-}
-
-func (e *gfP6) MulScalar(a *gfP6, b *gfP2) *gfP6 {
-	e.x.Mul(&a.x, b)
-	e.y.Mul(&a.y, b)
-	e.z.Mul(&a.z, b)
-	return e
-}
-
-func (e *gfP6) MulGFP(a *gfP6, b *gfP) *gfP6 {
-	e.x.MulScalar(&a.x, b)
-	e.y.MulScalar(&a.y, b)
-	e.z.MulScalar(&a.z, b)
-	return e
-}
-
-// MulTau computes τ·(aτ²+bτ+c) = bτ²+cτ+aξ
-func (e *gfP6) MulTau(a *gfP6) *gfP6 {
-	tz := (&gfP2{}).MulXi(&a.x)
-	ty := (&gfP2{}).Set(&a.y)
-
-	e.y.Set(&a.z)
-	e.x.Set(ty)
-	e.z.Set(tz)
-	return e
-}
-
-func (e *gfP6) Square(a *gfP6) *gfP6 {
-	v0 := (&gfP2{}).Square(&a.z)
-	v1 := (&gfP2{}).Square(&a.y)
-	v2 := (&gfP2{}).Square(&a.x)
-
-	c0 := (&gfP2{}).Add(&a.x, &a.y)
-	c0.Square(c0).Sub(c0, v1).Sub(c0, v2).MulXi(c0).Add(c0, v0)
-
-	c1 := (&gfP2{}).Add(&a.y, &a.z)
-	c1.Square(c1).Sub(c1, v0).Sub(c1, v1)
-	xiV2 := (&gfP2{}).MulXi(v2)
-	c1.Add(c1, xiV2)
-
-	c2 := (&gfP2{}).Add(&a.x, &a.z)
-	c2.Square(c2).Sub(c2, v0).Add(c2, v1).Sub(c2, v2)
-
-	e.x.Set(c2)
-	e.y.Set(c1)
-	e.z.Set(c0)
-	return e
-}
-
-func (e *gfP6) Invert(a *gfP6) *gfP6 {
-	// See "Implementing cryptographic pairings", M. Scott, section 3.2.
-	// ftp://136.206.11.249/pub/crypto/pairings.pdf
-
-	// Here we can give a short explanation of how it works: let j be a cubic root of
-	// unity in GF(p²) so that 1+j+j²=0.
-	// Then (xτ² + yτ + z)(xj²τ² + yjτ + z)(xjτ² + yj²τ + z)
-	// = (xτ² + yτ + z)(Cτ²+Bτ+A)
-	// = (x³ξ²+y³ξ+z³-3ξxyz) = F is an element of the base field (the norm).
-	//
-	// On the other hand (xj²τ² + yjτ + z)(xjτ² + yj²τ + z)
-	// = τ²(y²-ξxz) + τ(ξx²-yz) + (z²-ξxy)
-	//
-	// So that's why A = (z²-ξxy), B = (ξx²-yz), C = (y²-ξxz)
-	t1 := (&gfP2{}).Mul(&a.x, &a.y)
-	t1.MulXi(t1)
-
-	A := (&gfP2{}).Square(&a.z)
-	A.Sub(A, t1)
-
-	B := (&gfP2{}).Square(&a.x)
-	B.MulXi(B)
-	t1.Mul(&a.y, &a.z)
-	B.Sub(B, t1)
-
-	C := (&gfP2{}).Square(&a.y)
-	t1.Mul(&a.x, &a.z)
-	C.Sub(C, t1)
-
-	F := (&gfP2{}).Mul(C, &a.y)
-	F.MulXi(F)
-	t1.Mul(A, &a.z)
-	F.Add(F, t1)
-	t1.Mul(B, &a.x).MulXi(t1)
-	F.Add(F, t1)
-
-	F.Invert(F)
-
-	e.x.Mul(C, F)
-	e.y.Mul(B, F)
-	e.z.Mul(A, F)
-	return e
-}
diff --git a/bn256/gfp_amd64.s b/bn256/gfp_amd64.s
deleted file mode 100644
index bdb4ffb..0000000
--- a/bn256/gfp_amd64.s
+++ /dev/null
@@ -1,129 +0,0 @@
-// +build amd64,!generic
-
-#define storeBlock(a0,a1,a2,a3, r) \
-	MOVQ a0,  0+r \
-	MOVQ a1,  8+r \
-	MOVQ a2, 16+r \
-	MOVQ a3, 24+r
-
-#define loadBlock(r, a0,a1,a2,a3) \
-	MOVQ  0+r, a0 \
-	MOVQ  8+r, a1 \
-	MOVQ 16+r, a2 \
-	MOVQ 24+r, a3
-
-#define gfpCarry(a0,a1,a2,a3,a4, b0,b1,b2,b3,b4) \
-	\ // b = a-p
-	MOVQ a0, b0 \
-	MOVQ a1, b1 \
-	MOVQ a2, b2 \
-	MOVQ a3, b3 \
-	MOVQ a4, b4 \
-	\
-	SUBQ ·p2+0(SB), b0 \
-	SBBQ ·p2+8(SB), b1 \
-	SBBQ ·p2+16(SB), b2 \
-	SBBQ ·p2+24(SB), b3 \
-	SBBQ $0, b4 \
-	\
-	\ // if b is negative then return a
-	\ // else return b
-	CMOVQCC b0, a0 \
-	CMOVQCC b1, a1 \
-	CMOVQCC b2, a2 \
-	CMOVQCC b3, a3
-
-#include "mul_amd64.h"
-#include "mul_bmi2_amd64.h"
-
-TEXT ·gfpNeg(SB),0,$0-16
-	MOVQ ·p2+0(SB), R8
-	MOVQ ·p2+8(SB), R9
-	MOVQ ·p2+16(SB), R10
-	MOVQ ·p2+24(SB), R11
-
-	MOVQ a+8(FP), DI
-	SUBQ 0(DI), R8
-	SBBQ 8(DI), R9
-	SBBQ 16(DI), R10
-	SBBQ 24(DI), R11
-
-	MOVQ $0, AX
-	gfpCarry(R8,R9,R10,R11,AX, R12,R13,R14,R15,BX)
-
-	MOVQ c+0(FP), DI
-	storeBlock(R8,R9,R10,R11, 0(DI))
-	RET
-
-TEXT ·gfpAdd(SB),0,$0-24
-	MOVQ a+8(FP), DI
-	MOVQ b+16(FP), SI
-
-	loadBlock(0(DI), R8,R9,R10,R11)
-	MOVQ $0, R12
-
-	ADDQ  0(SI), R8
-	ADCQ  8(SI), R9
-	ADCQ 16(SI), R10
-	ADCQ 24(SI), R11
-	ADCQ $0, R12
-
-	gfpCarry(R8,R9,R10,R11,R12, R13,R14,R15,AX,BX)
-
-	MOVQ c+0(FP), DI
-	storeBlock(R8,R9,R10,R11, 0(DI))
-	RET
-
-TEXT ·gfpSub(SB),0,$0-24
-	MOVQ a+8(FP), DI
-	MOVQ b+16(FP), SI
-
-	loadBlock(0(DI), R8,R9,R10,R11)
-
-	MOVQ ·p2+0(SB), R12
-	MOVQ ·p2+8(SB), R13
-	MOVQ ·p2+16(SB), R14
-	MOVQ ·p2+24(SB), R15
-	MOVQ $0, AX
-
-	SUBQ  0(SI), R8
-	SBBQ  8(SI), R9
-	SBBQ 16(SI), R10
-	SBBQ 24(SI), R11
-
-	CMOVQCC AX, R12
-	CMOVQCC AX, R13
-	CMOVQCC AX, R14
-	CMOVQCC AX, R15
-
-	ADDQ R12, R8
-	ADCQ R13, R9
-	ADCQ R14, R10
-	ADCQ R15, R11
-
-	MOVQ c+0(FP), DI
-	storeBlock(R8,R9,R10,R11, 0(DI))
-	RET
-
-TEXT ·gfpMul(SB),0,$160-24
-	MOVQ a+8(FP), DI
-	MOVQ b+16(FP), SI
-
-	// Jump to a slightly different implementation if MULX isn't supported.
-	CMPB ·hasBMI2(SB), $0
-	JE   nobmi2Mul
-
-	mulBMI2(0(DI),8(DI),16(DI),24(DI), 0(SI))
-	storeBlock( R8, R9,R10,R11,  0(SP))
-	storeBlock(R12,R13,R14,R15, 32(SP))
-	gfpReduceBMI2()
-	JMP end
-
-nobmi2Mul:
-	mul(0(DI),8(DI),16(DI),24(DI), 0(SI), 0(SP))
-	gfpReduce(0(SP))
-
-end:
-	MOVQ c+0(FP), DI
-	storeBlock(R12,R13,R14,R15, 0(DI))
-	RET
diff --git a/bn256/gfp_arm64.s b/bn256/gfp_arm64.s
deleted file mode 100644
index c65e801..0000000
--- a/bn256/gfp_arm64.s
+++ /dev/null
@@ -1,113 +0,0 @@
-// +build arm64,!generic
-
-#define storeBlock(a0,a1,a2,a3, r) \
-	MOVD a0,  0+r \
-	MOVD a1,  8+r \
-	MOVD a2, 16+r \
-	MOVD a3, 24+r
-
-#define loadBlock(r, a0,a1,a2,a3) \
-	MOVD  0+r, a0 \
-	MOVD  8+r, a1 \
-	MOVD 16+r, a2 \
-	MOVD 24+r, a3
-
-#define loadModulus(p0,p1,p2,p3) \
-	MOVD ·p2+0(SB), p0 \
-	MOVD ·p2+8(SB), p1 \
-	MOVD ·p2+16(SB), p2 \
-	MOVD ·p2+24(SB), p3
-
-#include "mul_arm64.h"
-
-TEXT ·gfpNeg(SB),0,$0-16
-	MOVD a+8(FP), R0
-	loadBlock(0(R0), R1,R2,R3,R4)
-	loadModulus(R5,R6,R7,R8)
-
-	SUBS R1, R5, R1
-	SBCS R2, R6, R2
-	SBCS R3, R7, R3
-	SBCS R4, R8, R4
-
-	SUBS R5, R1, R5
-	SBCS R6, R2, R6
-	SBCS R7, R3, R7
-	SBCS R8, R4, R8
-
-	CSEL CS, R5, R1, R1
-	CSEL CS, R6, R2, R2
-	CSEL CS, R7, R3, R3
-	CSEL CS, R8, R4, R4
-
-	MOVD c+0(FP), R0
-	storeBlock(R1,R2,R3,R4, 0(R0))
-	RET
-
-TEXT ·gfpAdd(SB),0,$0-24
-	MOVD a+8(FP), R0
-	loadBlock(0(R0), R1,R2,R3,R4)
-	MOVD b+16(FP), R0
-	loadBlock(0(R0), R5,R6,R7,R8)
-	loadModulus(R9,R10,R11,R12)
-	MOVD ZR, R0
-
-	ADDS R5, R1
-	ADCS R6, R2
-	ADCS R7, R3
-	ADCS R8, R4
-	ADCS ZR, R0
-
-	SUBS  R9, R1, R5
-	SBCS R10, R2, R6
-	SBCS R11, R3, R7
-	SBCS R12, R4, R8
-	SBCS  ZR, R0, R0
-
-	CSEL CS, R5, R1, R1
-	CSEL CS, R6, R2, R2
-	CSEL CS, R7, R3, R3
-	CSEL CS, R8, R4, R4
-
-	MOVD c+0(FP), R0
-	storeBlock(R1,R2,R3,R4, 0(R0))
-	RET
-
-TEXT ·gfpSub(SB),0,$0-24
-	MOVD a+8(FP), R0
-	loadBlock(0(R0), R1,R2,R3,R4)
-	MOVD b+16(FP), R0
-	loadBlock(0(R0), R5,R6,R7,R8)
-	loadModulus(R9,R10,R11,R12)
-
-	SUBS R5, R1
-	SBCS R6, R2
-	SBCS R7, R3
-	SBCS R8, R4
-
-	CSEL CS, ZR,  R9,  R9
-	CSEL CS, ZR, R10, R10
-	CSEL CS, ZR, R11, R11
-	CSEL CS, ZR, R12, R12
-
-	ADDS  R9, R1
-	ADCS R10, R2
-	ADCS R11, R3
-	ADCS R12, R4
-
-	MOVD c+0(FP), R0
-	storeBlock(R1,R2,R3,R4, 0(R0))
-	RET
-
-TEXT ·gfpMul(SB),0,$0-24
-	MOVD a+8(FP), R0
-	loadBlock(0(R0), R1,R2,R3,R4)
-	MOVD b+16(FP), R0
-	loadBlock(0(R0), R5,R6,R7,R8)
-
-	mul(R9,R10,R11,R12,R13,R14,R15,R16)
-	gfpReduce()
-
-	MOVD c+0(FP), R0
-	storeBlock(R1,R2,R3,R4, 0(R0))
-	RET
diff --git a/bn256/gfp_decl.go b/bn256/gfp_decl.go
deleted file mode 100644
index be1b809..0000000
--- a/bn256/gfp_decl.go
+++ /dev/null
@@ -1,24 +0,0 @@
-// +build amd64,!generic arm64,!generic
-
-package bn256
-
-// This file contains forward declarations for the architecture-specific
-// assembly implementations of these functions, provided that they exist.
-
-import (
-	"golang.org/x/sys/cpu"
-)
-
-var hasBMI2 = cpu.X86.HasBMI2
-
-// go:noescape
-func gfpNeg(c, a *gfP)
-
-//go:noescape
-func gfpAdd(c, a, b *gfP)
-
-//go:noescape
-func gfpSub(c, a, b *gfP)
-
-//go:noescape
-func gfpMul(c, a, b *gfP)
diff --git a/bn256/gfp_generic.go b/bn256/gfp_generic.go
deleted file mode 100644
index 8e6be95..0000000
--- a/bn256/gfp_generic.go
+++ /dev/null
@@ -1,173 +0,0 @@
-// +build !amd64,!arm64 generic
-
-package bn256
-
-func gfpCarry(a *gfP, head uint64) {
-	b := &gfP{}
-
-	var carry uint64
-	for i, pi := range p2 {
-		ai := a[i]
-		bi := ai - pi - carry
-		b[i] = bi
-		carry = (pi&^ai | (pi|^ai)&bi) >> 63
-	}
-	carry = carry &^ head
-
-	// If b is negative, then return a.
-	// Else return b.
-	carry = -carry
-	ncarry := ^carry
-	for i := 0; i < 4; i++ {
-		a[i] = (a[i] & carry) | (b[i] & ncarry)
-	}
-}
-
-func gfpNeg(c, a *gfP) {
-	var carry uint64
-	for i, pi := range p2 {
-		ai := a[i]
-		ci := pi - ai - carry
-		c[i] = ci
-		carry = (ai&^pi | (ai|^pi)&ci) >> 63
-	}
-	gfpCarry(c, 0)
-}
-
-func gfpAdd(c, a, b *gfP) {
-	var carry uint64
-	for i, ai := range a {
-		bi := b[i]
-		ci := ai + bi + carry
-		c[i] = ci
-		carry = (ai&bi | (ai|bi)&^ci) >> 63
-	}
-	gfpCarry(c, carry)
-}
-
-func gfpSub(c, a, b *gfP) {
-	t := &gfP{}
-
-	var carry uint64
-	for i, pi := range p2 {
-		bi := b[i]
-		ti := pi - bi - carry
-		t[i] = ti
-		carry = (bi&^pi | (bi|^pi)&ti) >> 63
-	}
-
-	carry = 0
-	for i, ai := range a {
-		ti := t[i]
-		ci := ai + ti + carry
-		c[i] = ci
-		carry = (ai&ti | (ai|ti)&^ci) >> 63
-	}
-	gfpCarry(c, carry)
-}
-
-func mul(a, b [4]uint64) [8]uint64 {
-	const (
-		mask16 uint64 = 0x0000ffff
-		mask32 uint64 = 0xffffffff
-	)
-
-	var buff [32]uint64
-	for i, ai := range a {
-		a0, a1, a2, a3 := ai&mask16, (ai>>16)&mask16, (ai>>32)&mask16, ai>>48
-
-		for j, bj := range b {
-			b0, b2 := bj&mask32, bj>>32
-
-			off := 4 * (i + j)
-			buff[off+0] += a0 * b0
-			buff[off+1] += a1 * b0
-			buff[off+2] += a2*b0 + a0*b2
-			buff[off+3] += a3*b0 + a1*b2
-			buff[off+4] += a2 * b2
-			buff[off+5] += a3 * b2
-		}
-	}
-
-	for i := uint(1); i < 4; i++ {
-		shift := 16 * i
-
-		var head, carry uint64
-		for j := uint(0); j < 8; j++ {
-			block := 4 * j
-
-			xi := buff[block]
-			yi := (buff[block+i] << shift) + head
-			zi := xi + yi + carry
-			buff[block] = zi
-			carry = (xi&yi | (xi|yi)&^zi) >> 63
-
-			head = buff[block+i] >> (64 - shift)
-		}
-	}
-
-	return [8]uint64{buff[0], buff[4], buff[8], buff[12], buff[16], buff[20], buff[24], buff[28]}
-}
-
-func halfMul(a, b [4]uint64) [4]uint64 {
-	const (
-		mask16 uint64 = 0x0000ffff
-		mask32 uint64 = 0xffffffff
-	)
-
-	var buff [18]uint64
-	for i, ai := range a {
-		a0, a1, a2, a3 := ai&mask16, (ai>>16)&mask16, (ai>>32)&mask16, ai>>48
-
-		for j, bj := range b {
-			if i+j > 3 {
-				break
-			}
-			b0, b2 := bj&mask32, bj>>32
-
-			off := 4 * (i + j)
-			buff[off+0] += a0 * b0
-			buff[off+1] += a1 * b0
-			buff[off+2] += a2*b0 + a0*b2
-			buff[off+3] += a3*b0 + a1*b2
-			buff[off+4] += a2 * b2
-			buff[off+5] += a3 * b2
-		}
-	}
-
-	for i := uint(1); i < 4; i++ {
-		shift := 16 * i
-
-		var head, carry uint64
-		for j := uint(0); j < 4; j++ {
-			block := 4 * j
-
-			xi := buff[block]
-			yi := (buff[block+i] << shift) + head
-			zi := xi + yi + carry
-			buff[block] = zi
-			carry = (xi&yi | (xi|yi)&^zi) >> 63
-
-			head = buff[block+i] >> (64 - shift)
-		}
-	}
-
-	return [4]uint64{buff[0], buff[4], buff[8], buff[12]}
-}
-
-func gfpMul(c, a, b *gfP) {
-	T := mul(*a, *b)
-	m := halfMul([4]uint64{T[0], T[1], T[2], T[3]}, np)
-	t := mul([4]uint64{m[0], m[1], m[2], m[3]}, p2)
-
-	var carry uint64
-	for i, Ti := range T {
-		ti := t[i]
-		zi := Ti + ti + carry
-		T[i] = zi
-		carry = (Ti&ti | (Ti|ti)&^zi) >> 63
-	}
-
-	*c = gfP{T[4], T[5], T[6], T[7]}
-	gfpCarry(c, carry)
-}
diff --git a/bn256/mul_amd64.h b/bn256/mul_amd64.h
deleted file mode 100644
index bab5da8..0000000
--- a/bn256/mul_amd64.h
+++ /dev/null
@@ -1,181 +0,0 @@
-#define mul(a0,a1,a2,a3, rb, stack) \
-	MOVQ a0, AX \
-	MULQ 0+rb \
-	MOVQ AX, R8 \
-	MOVQ DX, R9 \
-	MOVQ a0, AX \
-	MULQ 8+rb \
-	ADDQ AX, R9 \
-	ADCQ $0, DX \
-	MOVQ DX, R10 \
-	MOVQ a0, AX \
-	MULQ 16+rb \
-	ADDQ AX, R10 \
-	ADCQ $0, DX \
-	MOVQ DX, R11 \
-	MOVQ a0, AX \
-	MULQ 24+rb \
-	ADDQ AX, R11 \
-	ADCQ $0, DX \
-	MOVQ DX, R12 \
-	\
-	storeBlock(R8,R9,R10,R11, 0+stack) \
-	MOVQ R12, 32+stack \
-	\
-	MOVQ a1, AX \
-	MULQ 0+rb \
-	MOVQ AX, R8 \
-	MOVQ DX, R9 \
-	MOVQ a1, AX \
-	MULQ 8+rb \
-	ADDQ AX, R9 \
-	ADCQ $0, DX \
-	MOVQ DX, R10 \
-	MOVQ a1, AX \
-	MULQ 16+rb \
-	ADDQ AX, R10 \
-	ADCQ $0, DX \
-	MOVQ DX, R11 \
-	MOVQ a1, AX \
-	MULQ 24+rb \
-	ADDQ AX, R11 \
-	ADCQ $0, DX \
-	MOVQ DX, R12 \
-	\
-	ADDQ 8+stack, R8 \
-	ADCQ 16+stack, R9 \
-	ADCQ 24+stack, R10 \
-	ADCQ 32+stack, R11 \
-	ADCQ $0, R12 \
-	storeBlock(R8,R9,R10,R11, 8+stack) \
-	MOVQ R12, 40+stack \
-	\
-	MOVQ a2, AX \
-	MULQ 0+rb \
-	MOVQ AX, R8 \
-	MOVQ DX, R9 \
-	MOVQ a2, AX \
-	MULQ 8+rb \
-	ADDQ AX, R9 \
-	ADCQ $0, DX \
-	MOVQ DX, R10 \
-	MOVQ a2, AX \
-	MULQ 16+rb \
-	ADDQ AX, R10 \
-	ADCQ $0, DX \
-	MOVQ DX, R11 \
-	MOVQ a2, AX \
-	MULQ 24+rb \
-	ADDQ AX, R11 \
-	ADCQ $0, DX \
-	MOVQ DX, R12 \
-	\
-	ADDQ 16+stack, R8 \
-	ADCQ 24+stack, R9 \
-	ADCQ 32+stack, R10 \
-	ADCQ 40+stack, R11 \
-	ADCQ $0, R12 \
-	storeBlock(R8,R9,R10,R11, 16+stack) \
-	MOVQ R12, 48+stack \
-	\
-	MOVQ a3, AX \
-	MULQ 0+rb \
-	MOVQ AX, R8 \
-	MOVQ DX, R9 \
-	MOVQ a3, AX \
-	MULQ 8+rb \
-	ADDQ AX, R9 \
-	ADCQ $0, DX \
-	MOVQ DX, R10 \
-	MOVQ a3, AX \
-	MULQ 16+rb \
-	ADDQ AX, R10 \
-	ADCQ $0, DX \
-	MOVQ DX, R11 \
-	MOVQ a3, AX \
-	MULQ 24+rb \
-	ADDQ AX, R11 \
-	ADCQ $0, DX \
-	MOVQ DX, R12 \
-	\
-	ADDQ 24+stack, R8 \
-	ADCQ 32+stack, R9 \
-	ADCQ 40+stack, R10 \
-	ADCQ 48+stack, R11 \
-	ADCQ $0, R12 \
-	storeBlock(R8,R9,R10,R11, 24+stack) \
-	MOVQ R12, 56+stack
-
-#define gfpReduce(stack) \
-	\ // m = (T * N') mod R, store m in R8:R9:R10:R11
-	MOVQ ·np+0(SB), AX \
-	MULQ 0+stack \
-	MOVQ AX, R8 \
-	MOVQ DX, R9 \
-	MOVQ ·np+0(SB), AX \
-	MULQ 8+stack \
-	ADDQ AX, R9 \
-	ADCQ $0, DX \
-	MOVQ DX, R10 \
-	MOVQ ·np+0(SB), AX \
-	MULQ 16+stack \
-	ADDQ AX, R10 \
-	ADCQ $0, DX \
-	MOVQ DX, R11 \
-	MOVQ ·np+0(SB), AX \
-	MULQ 24+stack \
-	ADDQ AX, R11 \
-	\
-	MOVQ ·np+8(SB), AX \
-	MULQ 0+stack \
-	MOVQ AX, R12 \
-	MOVQ DX, R13 \
-	MOVQ ·np+8(SB), AX \
-	MULQ 8+stack \
-	ADDQ AX, R13 \
-	ADCQ $0, DX \
-	MOVQ DX, R14 \
-	MOVQ ·np+8(SB), AX \
-	MULQ 16+stack \
-	ADDQ AX, R14 \
-	\
-	ADDQ R12, R9 \
-	ADCQ R13, R10 \
-	ADCQ R14, R11 \
-	\
-	MOVQ ·np+16(SB), AX \
-	MULQ 0+stack \
-	MOVQ AX, R12 \
-	MOVQ DX, R13 \
-	MOVQ ·np+16(SB), AX \
-	MULQ 8+stack \
-	ADDQ AX, R13 \
-	\
-	ADDQ R12, R10 \
-	ADCQ R13, R11 \
-	\
-	MOVQ ·np+24(SB), AX \
-	MULQ 0+stack \
-	ADDQ AX, R11 \
-	\
-	storeBlock(R8,R9,R10,R11, 64+stack) \
-	\
-	\ // m * N
-	mul(·p2+0(SB),·p2+8(SB),·p2+16(SB),·p2+24(SB), 64+stack, 96+stack) \
-	\
-	\ // Add the 512-bit intermediate to m*N
-	loadBlock(96+stack, R8,R9,R10,R11) \
-	loadBlock(128+stack, R12,R13,R14,R15) \
-	\
-	MOVQ $0, AX \
-	ADDQ 0+stack, R8 \
-	ADCQ 8+stack, R9 \
-	ADCQ 16+stack, R10 \
-	ADCQ 24+stack, R11 \
-	ADCQ 32+stack, R12 \
-	ADCQ 40+stack, R13 \
-	ADCQ 48+stack, R14 \
-	ADCQ 56+stack, R15 \
-	ADCQ $0, AX \
-	\
-	gfpCarry(R12,R13,R14,R15,AX, R8,R9,R10,R11,BX)
diff --git a/bn256/mul_arm64.h b/bn256/mul_arm64.h
deleted file mode 100644
index d405eb8..0000000
--- a/bn256/mul_arm64.h
+++ /dev/null
@@ -1,133 +0,0 @@
-#define mul(c0,c1,c2,c3,c4,c5,c6,c7) \
-	MUL R1, R5, c0 \
-	UMULH R1, R5, c1 \
-	MUL R1, R6, R0 \
-	ADDS R0, c1 \
-	UMULH R1, R6, c2 \
-	MUL R1, R7, R0 \
-	ADCS R0, c2 \
-	UMULH R1, R7, c3 \
-	MUL R1, R8, R0 \
-	ADCS R0, c3 \
-	UMULH R1, R8, c4 \
-	ADCS ZR, c4 \
-	\
-	MUL R2, R5, R1 \
-	UMULH R2, R5, R26 \
-	MUL R2, R6, R0 \
-	ADDS R0, R26 \
-	UMULH R2, R6, R27 \
-	MUL R2, R7, R0 \
-	ADCS R0, R27 \
-	UMULH R2, R7, R29 \
-	MUL R2, R8, R0 \
-	ADCS R0, R29 \
-	UMULH R2, R8, c5 \
-	ADCS ZR, c5 \
-	ADDS R1, c1 \
-	ADCS R26, c2 \
-	ADCS R27, c3 \
-	ADCS R29, c4 \
-	ADCS  ZR, c5 \
-	\
-	MUL R3, R5, R1 \
-	UMULH R3, R5, R26 \
-	MUL R3, R6, R0 \
-	ADDS R0, R26 \
-	UMULH R3, R6, R27 \
-	MUL R3, R7, R0 \
-	ADCS R0, R27 \
-	UMULH R3, R7, R29 \
-	MUL R3, R8, R0 \
-	ADCS R0, R29 \
-	UMULH R3, R8, c6 \
-	ADCS ZR, c6 \
-	ADDS R1, c2 \
-	ADCS R26, c3 \
-	ADCS R27, c4 \
-	ADCS R29, c5 \
-	ADCS  ZR, c6 \
-	\
-	MUL R4, R5, R1 \
-	UMULH R4, R5, R26 \
-	MUL R4, R6, R0 \
-	ADDS R0, R26 \
-	UMULH R4, R6, R27 \
-	MUL R4, R7, R0 \
-	ADCS R0, R27 \
-	UMULH R4, R7, R29 \
-	MUL R4, R8, R0 \
-	ADCS R0, R29 \
-	UMULH R4, R8, c7 \
-	ADCS ZR, c7 \
-	ADDS R1, c3 \
-	ADCS R26, c4 \
-	ADCS R27, c5 \
-	ADCS R29, c6 \
-	ADCS  ZR, c7
-
-#define gfpReduce() \
-	\ // m = (T * N') mod R, store m in R1:R2:R3:R4
-	MOVD ·np+0(SB), R17 \
-	MOVD ·np+8(SB), R25 \
-	MOVD ·np+16(SB), R19 \
-	MOVD ·np+24(SB), R20 \
-	\
-	MUL R9, R17, R1 \
-	UMULH R9, R17, R2 \
-	MUL R9, R25, R0 \
-	ADDS R0, R2 \
-	UMULH R9, R25, R3 \
-	MUL R9, R19, R0 \
-	ADCS R0, R3 \
-	UMULH R9, R19, R4 \
-	MUL R9, R20, R0 \
-	ADCS R0, R4 \
-	\
-	MUL R10, R17, R21 \
-	UMULH R10, R17, R22 \
-	MUL R10, R25, R0 \
-	ADDS R0, R22 \
-	UMULH R10, R25, R23 \
-	MUL R10, R19, R0 \
-	ADCS R0, R23 \
-	ADDS R21, R2 \
-	ADCS R22, R3 \
-	ADCS R23, R4 \
-	\
-	MUL R11, R17, R21 \
-	UMULH R11, R17, R22 \
-	MUL R11, R25, R0 \
-	ADDS R0, R22 \
-	ADDS R21, R3 \
-	ADCS R22, R4 \
-	\
-	MUL R12, R17, R21 \
-	ADDS R21, R4 \
-	\
-	\ // m * N
-	loadModulus(R5,R6,R7,R8) \
-	mul(R17,R25,R19,R20,R21,R22,R23,R24) \
-	\
-	\ // Add the 512-bit intermediate to m*N
-	MOVD  ZR, R0 \
-	ADDS  R9, R17 \
-	ADCS R10, R25 \
-	ADCS R11, R19 \
-	ADCS R12, R20 \
-	ADCS R13, R21 \
-	ADCS R14, R22 \
-	ADCS R15, R23 \
-	ADCS R16, R24 \
-	ADCS  ZR, R0 \
-	\
-	\ // Our output is R21:R22:R23:R24. Reduce mod p if necessary.
-	SUBS R5, R21, R10 \
-	SBCS R6, R22, R11 \
-	SBCS R7, R23, R12 \
-	SBCS R8, R24, R13 \
-	\
-	CSEL CS, R10, R21, R1 \
-	CSEL CS, R11, R22, R2 \
-	CSEL CS, R12, R23, R3 \
-	CSEL CS, R13, R24, R4
diff --git a/bn256/mul_bmi2_amd64.h b/bn256/mul_bmi2_amd64.h
deleted file mode 100644
index 71ad049..0000000
--- a/bn256/mul_bmi2_amd64.h
+++ /dev/null
@@ -1,112 +0,0 @@
-#define mulBMI2(a0,a1,a2,a3, rb) \
-	MOVQ a0, DX \
-	MOVQ $0, R13 \
-	MULXQ 0+rb, R8, R9 \
-	MULXQ 8+rb, AX, R10 \
-	ADDQ AX, R9 \
-	MULXQ 16+rb, AX, R11 \
-	ADCQ AX, R10 \
-	MULXQ 24+rb, AX, R12 \
-	ADCQ AX, R11 \
-	ADCQ $0, R12 \
-	ADCQ $0, R13 \
-	\
-	MOVQ a1, DX \
-	MOVQ $0, R14 \
-	MULXQ 0+rb, AX, BX \
-	ADDQ AX, R9 \
-	ADCQ BX, R10 \
-	MULXQ 16+rb, AX, BX \
-	ADCQ AX, R11 \
-	ADCQ BX, R12 \
-	ADCQ $0, R13 \
-	MULXQ 8+rb, AX, BX \
-	ADDQ AX, R10 \
-	ADCQ BX, R11 \
-	MULXQ 24+rb, AX, BX \
-	ADCQ AX, R12 \
-	ADCQ BX, R13 \
-	ADCQ $0, R14 \
-	\
-	MOVQ a2, DX \
-	MOVQ $0, R15 \
-	MULXQ 0+rb, AX, BX \
-	ADDQ AX, R10 \
-	ADCQ BX, R11 \
-	MULXQ 16+rb, AX, BX \
-	ADCQ AX, R12 \
-	ADCQ BX, R13 \
-	ADCQ $0, R14 \
-	MULXQ 8+rb, AX, BX \
-	ADDQ AX, R11 \
-	ADCQ BX, R12 \
-	MULXQ 24+rb, AX, BX \
-	ADCQ AX, R13 \
-	ADCQ BX, R14 \
-	ADCQ $0, R15 \
-	\
-	MOVQ a3, DX \
-	MULXQ 0+rb, AX, BX \
-	ADDQ AX, R11 \
-	ADCQ BX, R12 \
-	MULXQ 16+rb, AX, BX \
-	ADCQ AX, R13 \
-	ADCQ BX, R14 \
-	ADCQ $0, R15 \
-	MULXQ 8+rb, AX, BX \
-	ADDQ AX, R12 \
-	ADCQ BX, R13 \
-	MULXQ 24+rb, AX, BX \
-	ADCQ AX, R14 \
-	ADCQ BX, R15
-
-#define gfpReduceBMI2() \
-	\ // m = (T * N') mod R, store m in R8:R9:R10:R11
-	MOVQ ·np+0(SB), DX \
-	MULXQ 0(SP), R8, R9 \
-	MULXQ 8(SP), AX, R10 \
-	ADDQ AX, R9 \
-	MULXQ 16(SP), AX, R11 \
-	ADCQ AX, R10 \
-	MULXQ 24(SP), AX, BX \
-	ADCQ AX, R11 \
-	\
-	MOVQ ·np+8(SB), DX \
-	MULXQ 0(SP), AX, BX \
-	ADDQ AX, R9 \
-	ADCQ BX, R10 \
-	MULXQ 16(SP), AX, BX \
-	ADCQ AX, R11 \
-	MULXQ 8(SP), AX, BX \
-	ADDQ AX, R10 \
-	ADCQ BX, R11 \
-	\
-	MOVQ ·np+16(SB), DX \
-	MULXQ 0(SP), AX, BX \
-	ADDQ AX, R10 \
-	ADCQ BX, R11 \
-	MULXQ 8(SP), AX, BX \
-	ADDQ AX, R11 \
-	\
-	MOVQ ·np+24(SB), DX \
-	MULXQ 0(SP), AX, BX \
-	ADDQ AX, R11 \
-	\
-	storeBlock(R8,R9,R10,R11, 64(SP)) \
-	\
-	\ // m * N
-	mulBMI2(·p2+0(SB),·p2+8(SB),·p2+16(SB),·p2+24(SB), 64(SP)) \
-	\
-	\ // Add the 512-bit intermediate to m*N
-	MOVQ $0, AX \
-	ADDQ 0(SP), R8 \
-	ADCQ 8(SP), R9 \
-	ADCQ 16(SP), R10 \
-	ADCQ 24(SP), R11 \
-	ADCQ 32(SP), R12 \
-	ADCQ 40(SP), R13 \
-	ADCQ 48(SP), R14 \
-	ADCQ 56(SP), R15 \
-	ADCQ $0, AX \
-	\
-	gfpCarry(R12,R13,R14,R15,AX, R8,R9,R10,R11,BX)
diff --git a/bn256/optate.go b/bn256/optate.go
deleted file mode 100644
index 126c64c..0000000
--- a/bn256/optate.go
+++ /dev/null
@@ -1,268 +0,0 @@
-package bn256
-
-func lineFunctionAdd(r, p *twistPoint, q *curvePoint, r2 *gfP2) (a, b, c *gfP2, rOut *twistPoint) {
-	// See the mixed addition algorithm from "Faster Computation of the
-	// Tate Pairing", http://arxiv.org/pdf/0904.0854v3.pdf
-	B := (&gfP2{}).Mul(&p.x, &r.t)
-
-	D := (&gfP2{}).Add(&p.y, &r.z)
-	D.Square(D).Sub(D, r2).Sub(D, &r.t).Mul(D, &r.t)
-
-	H := (&gfP2{}).Sub(B, &r.x)
-	I := (&gfP2{}).Square(H)
-
-	E := (&gfP2{}).Add(I, I)
-	E.Add(E, E)
-
-	J := (&gfP2{}).Mul(H, E)
-
-	L1 := (&gfP2{}).Sub(D, &r.y)
-	L1.Sub(L1, &r.y)
-
-	V := (&gfP2{}).Mul(&r.x, E)
-
-	rOut = &twistPoint{}
-	rOut.x.Square(L1).Sub(&rOut.x, J).Sub(&rOut.x, V).Sub(&rOut.x, V)
-
-	rOut.z.Add(&r.z, H).Square(&rOut.z).Sub(&rOut.z, &r.t).Sub(&rOut.z, I)
-
-	t := (&gfP2{}).Sub(V, &rOut.x)
-	t.Mul(t, L1)
-	t2 := (&gfP2{}).Mul(&r.y, J)
-	t2.Add(t2, t2)
-	rOut.y.Sub(t, t2)
-
-	rOut.t.Square(&rOut.z)
-
-	t.Add(&p.y, &rOut.z).Square(t).Sub(t, r2).Sub(t, &rOut.t)
-
-	t2.Mul(L1, &p.x)
-	t2.Add(t2, t2)
-	a = (&gfP2{}).Sub(t2, t)
-
-	c = (&gfP2{}).MulScalar(&rOut.z, &q.y)
-	c.Add(c, c)
-
-	b = (&gfP2{}).Neg(L1)
-	b.MulScalar(b, &q.x).Add(b, b)
-
-	return
-}
-
-func lineFunctionDouble(r *twistPoint, q *curvePoint) (a, b, c *gfP2, rOut *twistPoint) {
-	// See the doubling algorithm for a=0 from "Faster Computation of the
-	// Tate Pairing", http://arxiv.org/pdf/0904.0854v3.pdf
-	A := (&gfP2{}).Square(&r.x)
-	B := (&gfP2{}).Square(&r.y)
-	C := (&gfP2{}).Square(B)
-
-	D := (&gfP2{}).Add(&r.x, B)
-	D.Square(D).Sub(D, A).Sub(D, C).Add(D, D)
-
-	E := (&gfP2{}).Add(A, A)
-	E.Add(E, A)
-
-	G := (&gfP2{}).Square(E)
-
-	rOut = &twistPoint{}
-	rOut.x.Sub(G, D).Sub(&rOut.x, D)
-
-	rOut.z.Add(&r.y, &r.z).Square(&rOut.z).Sub(&rOut.z, B).Sub(&rOut.z, &r.t)
-
-	rOut.y.Sub(D, &rOut.x).Mul(&rOut.y, E)
-	t := (&gfP2{}).Add(C, C)
-	t.Add(t, t).Add(t, t)
-	rOut.y.Sub(&rOut.y, t)
-
-	rOut.t.Square(&rOut.z)
-
-	t.Mul(E, &r.t).Add(t, t)
-	b = (&gfP2{}).Neg(t)
-	b.MulScalar(b, &q.x)
-
-	a = (&gfP2{}).Add(&r.x, E)
-	a.Square(a).Sub(a, A).Sub(a, G)
-	t.Add(B, B).Add(t, t)
-	a.Sub(a, t)
-
-	c = (&gfP2{}).Mul(&rOut.z, &r.t)
-	c.Add(c, c).MulScalar(c, &q.y)
-
-	return
-}
-
-func mulLine(ret *gfP12, a, b, c *gfP2) {
-	a2 := &gfP6{}
-	a2.y.Set(a)
-	a2.z.Set(b)
-	a2.Mul(a2, &ret.x)
-	t3 := (&gfP6{}).MulScalar(&ret.y, c)
-
-	t := (&gfP2{}).Add(b, c)
-	t2 := &gfP6{}
-	t2.y.Set(a)
-	t2.z.Set(t)
-	ret.x.Add(&ret.x, &ret.y)
-
-	ret.y.Set(t3)
-
-	ret.x.Mul(&ret.x, t2).Sub(&ret.x, a2).Sub(&ret.x, &ret.y)
-	a2.MulTau(a2)
-	ret.y.Add(&ret.y, a2)
-}
-
-// sixuPlus2NAF is 6u+2 in non-adjacent form.
-var sixuPlus2NAF = []int8{0, 0, 0, 1, 0, 0, 0, 0, 0, 1, 0, 0, 1, 0, 0, 0, -1, 0, 1, 0, 1, 0, 0, 0, 0, 1, 0, 1, 0, 0, 0, -1, 0, 1, 0, 0, 0, 1, 0, -1, 0, 0, 0, -1, 0, 1, 0, 0, 0, 0, 0, 1, 0, 0, -1, 0, -1, 0, 0, 0, 0, 1, 0, 0, 0, 1}
-
-// miller implements the Miller loop for calculating the Optimal Ate pairing.
-// See algorithm 1 from http://cryptojedi.org/papers/dclxvi-20100714.pdf
-func miller(q *twistPoint, p *curvePoint) *gfP12 {
-	ret := (&gfP12{}).SetOne()
-
-	aAffine := &twistPoint{}
-	aAffine.Set(q)
-	aAffine.MakeAffine()
-
-	bAffine := &curvePoint{}
-	bAffine.Set(p)
-	bAffine.MakeAffine()
-
-	minusA := &twistPoint{}
-	minusA.Neg(aAffine)
-
-	r := &twistPoint{}
-	r.Set(aAffine)
-
-	r2 := (&gfP2{}).Square(&aAffine.y)
-
-	for i := len(sixuPlus2NAF) - 1; i > 0; i-- {
-		a, b, c, newR := lineFunctionDouble(r, bAffine)
-		if i != len(sixuPlus2NAF)-1 {
-			ret.Square(ret)
-		}
-
-		mulLine(ret, a, b, c)
-		r = newR
-
-		switch sixuPlus2NAF[i-1] {
-		case 1:
-			a, b, c, newR = lineFunctionAdd(r, aAffine, bAffine, r2)
-		case -1:
-			a, b, c, newR = lineFunctionAdd(r, minusA, bAffine, r2)
-		default:
-			continue
-		}
-
-		mulLine(ret, a, b, c)
-		r = newR
-	}
-
-	// In order to calculate Q1 we have to convert q from the sextic twist
-	// to the full GF(p^12) group, apply the Frobenius there, and convert
-	// back.
-	//
-	// The twist isomorphism is (x', y') -> (xω², yω³). If we consider just
-	// x for a moment, then after applying the Frobenius, we have x̄ω^(2p)
-	// where x̄ is the conjugate of x. If we are going to apply the inverse
-	// isomorphism we need a value with a single coefficient of ω² so we
-	// rewrite this as x̄ω^(2p-2)ω². ξ⁶ = ω and, due to the construction of
-	// p, 2p-2 is a multiple of six. Therefore we can rewrite as
-	// x̄ξ^((p-1)/3)ω² and applying the inverse isomorphism eliminates the
-	// ω².
-	//
-	// A similar argument can be made for the y value.
-
-	q1 := &twistPoint{}
-	q1.x.Conjugate(&aAffine.x).Mul(&q1.x, xiToPMinus1Over3)
-	q1.y.Conjugate(&aAffine.y).Mul(&q1.y, xiToPMinus1Over2)
-	q1.z.SetOne()
-	q1.t.SetOne()
-
-	// For Q2 we are applying the p² Frobenius. The two conjugations cancel
-	// out and we are left only with the factors from the isomorphism. In
-	// the case of x, we end up with a pure number which is why
-	// xiToPSquaredMinus1Over3 is ∈ GF(p). With y we get a factor of -1. We
-	// ignore this to end up with -Q2.
-
-	minusQ2 := &twistPoint{}
-	minusQ2.x.MulScalar(&aAffine.x, xiToPSquaredMinus1Over3)
-	minusQ2.y.Set(&aAffine.y)
-	minusQ2.z.SetOne()
-	minusQ2.t.SetOne()
-
-	r2.Square(&q1.y)
-	a, b, c, newR := lineFunctionAdd(r, q1, bAffine, r2)
-	mulLine(ret, a, b, c)
-	r = newR
-
-	r2.Square(&minusQ2.y)
-	a, b, c, newR = lineFunctionAdd(r, minusQ2, bAffine, r2)
-	mulLine(ret, a, b, c)
-	r = newR
-
-	return ret
-}
-
-// finalExponentiation computes the (p¹²-1)/Order-th power of an element of
-// GF(p¹²) to obtain an element of GT (steps 13-15 of algorithm 1 from
-// http://cryptojedi.org/papers/dclxvi-20100714.pdf)
-func finalExponentiation(in *gfP12) *gfP12 {
-	t1 := &gfP12{}
-
-	// This is the p^6-Frobenius
-	t1.x.Neg(&in.x)
-	t1.y.Set(&in.y)
-
-	inv := &gfP12{}
-	inv.Invert(in)
-	t1.Mul(t1, inv)
-
-	t2 := (&gfP12{}).FrobeniusP2(t1)
-	t1.Mul(t1, t2)
-
-	fp := (&gfP12{}).Frobenius(t1)
-	fp2 := (&gfP12{}).FrobeniusP2(t1)
-	fp3 := (&gfP12{}).Frobenius(fp2)
-
-	fu := (&gfP12{}).Exp(t1, u)
-	fu2 := (&gfP12{}).Exp(fu, u)
-	fu3 := (&gfP12{}).Exp(fu2, u)
-
-	y3 := (&gfP12{}).Frobenius(fu)
-	fu2p := (&gfP12{}).Frobenius(fu2)
-	fu3p := (&gfP12{}).Frobenius(fu3)
-	y2 := (&gfP12{}).FrobeniusP2(fu2)
-
-	y0 := &gfP12{}
-	y0.Mul(fp, fp2).Mul(y0, fp3)
-
-	y1 := (&gfP12{}).Conjugate(t1)
-	y5 := (&gfP12{}).Conjugate(fu2)
-	y3.Conjugate(y3)
-	y4 := (&gfP12{}).Mul(fu, fu2p)
-	y4.Conjugate(y4)
-
-	y6 := (&gfP12{}).Mul(fu3, fu3p)
-	y6.Conjugate(y6)
-
-	t0 := (&gfP12{}).Square(y6)
-	t0.Mul(t0, y4).Mul(t0, y5)
-	t1.Mul(y3, y5).Mul(t1, t0)
-	t0.Mul(t0, y2)
-	t1.Square(t1).Mul(t1, t0).Square(t1)
-	t0.Mul(t1, y1)
-	t1.Mul(t1, y0)
-	t0.Square(t0).Mul(t0, t1)
-
-	return t0
-}
-
-func optimalAte(a *twistPoint, b *curvePoint) *gfP12 {
-	e := miller(a, b)
-	ret := finalExponentiation(e)
-
-	if a.IsInfinity() || b.IsInfinity() {
-		ret.SetOne()
-	}
-	return ret
-}
diff --git a/bn256/twist.go b/bn256/twist.go
deleted file mode 100644
index 65542fd..0000000
--- a/bn256/twist.go
+++ /dev/null
@@ -1,199 +0,0 @@
-package bn256
-
-import (
-	"math/big"
-)
-
-// twistPoint implements the elliptic curve y²=x³+3/ξ over GF(p²). Points are
-// kept in Jacobian form and t=z² when valid. The group G₂ is the set of
-// n-torsion points of this curve over GF(p²) (where n = Order)
-type twistPoint struct {
-	x, y, z, t gfP2
-}
-
-var twistB = &gfP2{
-	gfP{0x75046774386b8d71, 0x5bd0854a46d36cf8, 0x664327a1d41c8414, 0x96c9abb932eeb2f},
-	gfP{0xb94f760fb4c5ee14, 0xdae9f8f24c3b6eb4, 0x77a675d2e52f4fe4, 0x736f31b09116c66b},
-}
-
-// twistGen is the generator of group G₂.
-var twistGen = &twistPoint{
-	gfP2{
-		gfP{0x402c4ab7139e1404, 0xce1c368a183d85a4, 0xd67cf9a6cb8d3983, 0x3cf246bbc2a9fbe8},
-		gfP{0x88f9f11da7cdc184, 0x18293f95d69509d3, 0xb5ce0c55a735d5a1, 0x15134189bfd45a0},
-	},
-	gfP2{
-		gfP{0xbfac7d731e9e87a2, 0xa50bb8007962e441, 0xafe910a4e8270556, 0x5075c5429d69159a},
-		gfP{0xc2e07c1463ea9e56, 0xee4442052072ebd2, 0x561a519486036937, 0x5bd9394cc0d2cce},
-	},
-	gfP2{*newGFp(0), *newGFp(1)},
-	gfP2{*newGFp(0), *newGFp(1)},
-}
-
-func (c *twistPoint) String() string {
-	c.MakeAffine()
-	x, y := gfP2Decode(&c.x), gfP2Decode(&c.y)
-	return "(" + x.String() + ", " + y.String() + ")"
-}
-
-func (c *twistPoint) Set(a *twistPoint) {
-	c.x.Set(&a.x)
-	c.y.Set(&a.y)
-	c.z.Set(&a.z)
-	c.t.Set(&a.t)
-}
-
-// IsOnCurve returns true iff c is on the curve.
-func (c *twistPoint) IsOnCurve() bool {
-	c.MakeAffine()
-	if c.IsInfinity() {
-		return true
-	}
-
-	y2, x3 := &gfP2{}, &gfP2{}
-	y2.Square(&c.y)
-	x3.Square(&c.x).Mul(x3, &c.x).Add(x3, twistB)
-
-	return *y2 == *x3
-}
-
-func (c *twistPoint) SetInfinity() {
-	c.x.SetZero()
-	c.y.SetOne()
-	c.z.SetZero()
-	c.t.SetZero()
-}
-
-func (c *twistPoint) IsInfinity() bool {
-	return c.z.IsZero()
-}
-
-func (c *twistPoint) Add(a, b *twistPoint) {
-	// For additional comments, see the same function in curve.go.
-
-	if a.IsInfinity() {
-		c.Set(b)
-		return
-	}
-	if b.IsInfinity() {
-		c.Set(a)
-		return
-	}
-
-	// See http://hyperelliptic.org/EFD/g1p/auto-code/shortw/jacobian-0/addition/add-2007-bl.op3
-	z12 := (&gfP2{}).Square(&a.z)
-	z22 := (&gfP2{}).Square(&b.z)
-	u1 := (&gfP2{}).Mul(&a.x, z22)
-	u2 := (&gfP2{}).Mul(&b.x, z12)
-
-	t := (&gfP2{}).Mul(&b.z, z22)
-	s1 := (&gfP2{}).Mul(&a.y, t)
-
-	t.Mul(&a.z, z12)
-	s2 := (&gfP2{}).Mul(&b.y, t)
-
-	h := (&gfP2{}).Sub(u2, u1)
-	xEqual := h.IsZero()
-
-	t.Add(h, h)
-	i := (&gfP2{}).Square(t)
-	j := (&gfP2{}).Mul(h, i)
-
-	t.Sub(s2, s1)
-	yEqual := t.IsZero()
-	if xEqual && yEqual {
-		c.Double(a)
-		return
-	}
-	r := (&gfP2{}).Add(t, t)
-
-	v := (&gfP2{}).Mul(u1, i)
-
-	t4 := (&gfP2{}).Square(r)
-	t.Add(v, v)
-	t6 := (&gfP2{}).Sub(t4, j)
-	c.x.Sub(t6, t)
-
-	t.Sub(v, &c.x) // t7
-	t4.Mul(s1, j)  // t8
-	t6.Add(t4, t4) // t9
-	t4.Mul(r, t)   // t10
-	c.y.Sub(t4, t6)
-
-	t.Add(&a.z, &b.z) // t11
-	t4.Square(t)      // t12
-	t.Sub(t4, z12)    // t13
-	t4.Sub(t, z22)    // t14
-	c.z.Mul(t4, h)
-}
-
-func (c *twistPoint) Double(a *twistPoint) {
-	// See http://hyperelliptic.org/EFD/g1p/auto-code/shortw/jacobian-0/doubling/dbl-2009-l.op3
-	A := (&gfP2{}).Square(&a.x)
-	B := (&gfP2{}).Square(&a.y)
-	C := (&gfP2{}).Square(B)
-
-	t := (&gfP2{}).Add(&a.x, B)
-	t2 := (&gfP2{}).Square(t)
-	t.Sub(t2, A)
-	t2.Sub(t, C)
-	d := (&gfP2{}).Add(t2, t2)
-	t.Add(A, A)
-	e := (&gfP2{}).Add(t, A)
-	f := (&gfP2{}).Square(e)
-
-	t.Add(d, d)
-	c.x.Sub(f, t)
-
-	t.Add(C, C)
-	t2.Add(t, t)
-	t.Add(t2, t2)
-	c.y.Sub(d, &c.x)
-	t2.Mul(e, &c.y)
-	c.y.Sub(t2, t)
-
-	t.Mul(&a.y, &a.z)
-	c.z.Add(t, t)
-}
-
-func (c *twistPoint) Mul(a *twistPoint, scalar *big.Int) {
-	sum, t := &twistPoint{}, &twistPoint{}
-
-	for i := scalar.BitLen(); i >= 0; i-- {
-		t.Double(sum)
-		if scalar.Bit(i) != 0 {
-			sum.Add(t, a)
-		} else {
-			sum.Set(t)
-		}
-	}
-
-	c.Set(sum)
-}
-
-func (c *twistPoint) MakeAffine() {
-	if c.z.IsOne() {
-		return
-	} else if c.z.IsZero() {
-		c.x.SetZero()
-		c.y.SetOne()
-		c.t.SetZero()
-		return
-	}
-
-	zInv := (&gfP2{}).Invert(&c.z)
-	t := (&gfP2{}).Mul(&c.y, zInv)
-	zInv2 := (&gfP2{}).Square(zInv)
-	c.y.Mul(t, zInv2)
-	t.Mul(&c.x, zInv2)
-	c.x.Set(t)
-	c.z.SetOne()
-	c.t.SetOne()
-}
-
-func (c *twistPoint) Neg(a *twistPoint) {
-	c.x.Set(&a.x)
-	c.y.Neg(&a.y)
-	c.z.Set(&a.z)
-	c.t.SetZero()
-}
diff --git a/go.mod b/go.mod
index 40e6e3a..305edc3 100644
--- a/go.mod
+++ b/go.mod
@@ -5,6 +5,7 @@ go 1.12
 require (
 	github.com/OneOfOne/xxhash v1.2.5
 	github.com/bwesterb/go-ristretto v1.1.0
+	github.com/dusk-network/bn256 v0.0.0-20190123110933-f166bf1226b0
 	github.com/pkg/errors v0.8.1
 	github.com/stretchr/testify v1.4.0
 	golang.org/x/crypto v0.0.0-20190701094942-4def268fd1a4
diff --git a/go.sum b/go.sum
index 677be4a..d722231 100644
--- a/go.sum
+++ b/go.sum
@@ -4,6 +4,8 @@ github.com/bwesterb/go-ristretto v1.1.0 h1:KiOn1eqKcCe5X4Y6OPGS4u3XyVmxUnh/WAHU7
 github.com/bwesterb/go-ristretto v1.1.0/go.mod h1:N/KzfPHVf0cM6so9lbr2hamEhlH9xev3NIj+B6p+Eyc=
 github.com/davecgh/go-spew v1.1.0 h1:ZDRjVQ15GmhC3fiQ8ni8+OwkZQO4DARzQgrnXU1Liz8=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/dusk-network/bn256 v0.0.0-20190123110933-f166bf1226b0 h1:gbJaLVN42ahIwwmnVoVLlg2Z81LLgn9LmpFtkM5X9RU=
+github.com/dusk-network/bn256 v0.0.0-20190123110933-f166bf1226b0/go.mod h1:KGkfDyf8GXeworEpuKRRfPGQa/CzezrYUGaaABueUhg=
 github.com/pkg/errors v0.8.1 h1:iURUrRGxPUNPdy5/HRSm+Yj6okJ6UtLINN0Q9M4+h3I=
 github.com/pkg/errors v0.8.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=