boolean isOnCurve() {
      long[] x2 = new long[Field25519.LIMB_CNT];
      Field25519.square(x2, x);
      long[] y2 = new long[Field25519.LIMB_CNT];
      Field25519.square(y2, y);
      long[] z2 = new long[Field25519.LIMB_CNT];
      Field25519.square(z2, z);
      long[] z4 = new long[Field25519.LIMB_CNT];
      Field25519.square(z4, z2);
      long[] lhs = new long[Field25519.LIMB_CNT];
      // lhs = y^2 - x^2
      Field25519.sub(lhs, y2, x2);
      // lhs = z^2 * (y2 - x2)
      Field25519.mult(lhs, lhs, z2);
      long[] rhs = new long[Field25519.LIMB_CNT];
      // rhs = x^2 * y^2
      Field25519.mult(rhs, x2, y2);
      // rhs = D * x^2 * y^2
      Field25519.mult(rhs, rhs, Ed25519Constants.D);
      // rhs = z^4 + D * x^2 * y^2
      Field25519.sum(rhs, z4);
      // Field25519.mult reduces its output, but Field25519.sum does not, so we have to manually
      // reduce it here.
      Field25519.reduce(rhs, rhs);
      // z^2 (y^2 - x^2) == z^4 + D * x^2 * y^2
      return Bytes.equal(Field25519.contract(lhs), Field25519.contract(rhs));
    }
Checks that the point is on curve
java_src/src/main/java/com/google/crypto/tink/internal/Ed25519.java