Derivation of b unclear

[jhoyla]

In section {#random-scalar} the text reads:

As an optimization, if the group order is very close to a power of 2, it is acceptable to omit the rejection test completely. In particular, if the group order is p, and there is an integer b such that |p - 2b| is less than 2^(b/2), then RandomScalar can simply return a uniformly random integer of at most b bits.

This just reads like magic. It's not obvious how to choose b, or that any value of b satisfying the requirements is valid.

[chris-wood]

The salient point is that there exists an integer b such that the condition holds. We could add more explanation about why this is sufficient, but I'm inclined to not burden the reader with that.

[armfazh]

does it help to mention that p is a b-bit integer?