private static BigInteger recoverX(BigInteger y) {
    // x^2 = (y^2 - 1) / (d * y^2 + 1) mod 2^255-19
    BigInteger xx =
        y.pow(2)
            .subtract(BigInteger.ONE)
            .multiply(D_BI.multiply(y.pow(2)).add(BigInteger.ONE).modInverse(P_BI));
    BigInteger x = xx.modPow(P_BI.add(BigInteger.valueOf(3)).divide(BigInteger.valueOf(8)), P_BI);
    if (!x.pow(2).subtract(xx).mod(P_BI).equals(BigInteger.ZERO)) {
      x = x.multiply(SQRTM1_BI).mod(P_BI);
    }
    if (x.testBit(0)) {
      x = P_BI.subtract(x);
    }
    return x;
  }
Base point for the Edwards twisted curve = (x, 4/5) and its exponentiations. B_TABLE[i][j] =
(j+1)*256^i*B for i in [0, 32) and j in [0, 8). Base point B = B_TABLE[0][0]

<p>See {@link Ed25519ConstantsGenerator}.
java_src/src/main/java/com/google/crypto/tink/internal/Ed25519Constants.java