def recover(y):
p = (y*y - <NUM_LIT:1>) * inverse(D*y*y + <NUM_LIT:1>)<EOL>x = powmod(p, (PRIME+<NUM_LIT:3>) // <NUM_LIT:8>, PRIME)<EOL>if (x*x - p) % PRIME != <NUM_LIT:0>:<EOL><INDENT>i = powmod(<NUM_LIT:2>, (PRIME-<NUM_LIT:1>) // <NUM_LIT:4>, PRIME)<EOL>x = (x*i) % PRIME<EOL><DEDENT>if x % <NUM_LIT:2> != <NUM_LIT:0>:<EOL><INDENT>x = PRIME - x<EOL><DEDENT>return x<EOL>
given a value y, recover the preimage x