Commit 26aea8cfa1ea98329e18458cb23be2d60ef52507 | zig

author	Frank Denis <124872+jedisct1@users.noreply.github.com> 2022-05-31 17:29:38+02:00
committer	GitHub <noreply@github.com> 2022-05-31 17:29:38+02:00
log	26aea8cfa1ea98329e18458cb23be2d60ef52507
tree	01dc2913b2244369873bf50d4319bd808402183a
parent	83beed09e1ce5a15e2b9801a50cf601352d8383e
signature	Signed by PGP key 4AEE18F83AFDEB23

crypto: add support for the NIST P-384 curve (#11735)

After P-256, here comes P-384, also known as secp384r1.

Like P-256, it is required for TLS, and is the current NIST recommendation for key exchange and signatures, for better or for worse.

Like P-256, all the finite field arithmetic has been computed and verified to be correct by fiat-crypto.

13 files changed, 8192 insertions(+), 129 deletions(-)

lib
- std
  - crypto.zig
  - crypto
    pcurves
    common.zig
    p256.zig
    p256
    field.zig
    scalar.zig
    p384.zig
    p384
    field.zig
    p384_64.zig
    p384_scalar_64.zig
    scalar.zig
    tests.zig
    tests
    p256.zig
    p384.zig

lib/std/crypto.zig+2

...	@@ -62,6 +62,7 @@ pub const ecc = struct {	...	@@ -62,6 +62,7 @@ pub const ecc = struct {
62	pub const Curve25519 = @import("crypto/25519/curve25519.zig").Curve25519;	62	pub const Curve25519 = @import("crypto/25519/curve25519.zig").Curve25519;
63	pub const Edwards25519 = @import("crypto/25519/edwards25519.zig").Edwards25519;	63	pub const Edwards25519 = @import("crypto/25519/edwards25519.zig").Edwards25519;
64	pub const P256 = @import("crypto/pcurves/p256.zig").P256;	64	pub const P256 = @import("crypto/pcurves/p256.zig").P256;
		65	pub const P384 = @import("crypto/pcurves/p384.zig").P384;
65	pub const Ristretto255 = @import("crypto/25519/ristretto255.zig").Ristretto255;	66	pub const Ristretto255 = @import("crypto/25519/ristretto255.zig").Ristretto255;
66	};	67	};
67		68
...	@@ -201,6 +202,7 @@ test {	...	@@ -201,6 +202,7 @@ test {
201	_ = ecc.Curve25519;	202	_ = ecc.Curve25519;
202	_ = ecc.Edwards25519;	203	_ = ecc.Edwards25519;
203	_ = ecc.P256;	204	_ = ecc.P256;
		205	_ = ecc.P384;
204	_ = ecc.Ristretto255;	206	_ = ecc.Ristretto255;
205		207
206	_ = hash.blake2;	208	_ = hash.blake2;

lib/std/crypto/pcurves/common.zig+23

...	@@ -253,6 +253,18 @@ pub fn Field(comptime params: FieldParams) type {	...	@@ -253,6 +253,18 @@ pub fn Field(comptime params: FieldParams) type {
253	const x47 = x15.mul(x53);	253	const x47 = x15.mul(x53);
254	const ls = x47.mul(((x53.sqn(17).mul(x2)).sqn(143).mul(x47)).sqn(47)).sq().mul(x2);	254	const ls = x47.mul(((x53.sqn(17).mul(x2)).sqn(143).mul(x47)).sqn(47)).sq().mul(x2);
255	return ls.equivalent(Fe.one);	255	return ls.equivalent(Fe.one);
		256	} else if (field_order == 39402006196394479212279040100143613805079739270465446667948293404245721771496870329047266088258938001861606973112319) {
		257	const t111 = x2.mul(x2.mul(x2.sq()).sq());
		258	const t111111 = t111.mul(t111.sqn(3));
		259	const t1111110 = t111111.sq();
		260	const t1111111 = x2.mul(t1111110);
		261	const x12 = t1111110.sqn(5).mul(t111111);
		262	const x31 = x12.sqn(12).mul(x12).sqn(7).mul(t1111111);
		263	const x32 = x31.sq().mul(x2);
		264	const x63 = x32.sqn(31).mul(x31);
		265	const x126 = x63.sqn(63).mul(x63);
		266	const ls = x126.sqn(126).mul(x126).sqn(3).mul(t111).sqn(33).mul(x32).sqn(95).mul(x31);
		267	return ls.equivalent(Fe.one);
256	} else {	268	} else {
257	const ls = x2.pow(std.meta.Int(.unsigned, field_bits), (field_order - 1) / 2); // Legendre symbol	269	const ls = x2.pow(std.meta.Int(.unsigned, field_bits), (field_order - 1) / 2); // Legendre symbol
258	return ls.equivalent(Fe.one);	270	return ls.equivalent(Fe.one);
...	@@ -268,6 +280,17 @@ pub fn Field(comptime params: FieldParams) type {	...	@@ -268,6 +280,17 @@ pub fn Field(comptime params: FieldParams) type {
268	const t11111111 = t1111.mul(t1111.sqn(4));	280	const t11111111 = t1111.mul(t1111.sqn(4));
269	const x16 = t11111111.sqn(8).mul(t11111111);	281	const x16 = t11111111.sqn(8).mul(t11111111);
270	return x16.sqn(16).mul(x16).sqn(32).mul(x2).sqn(96).mul(x2).sqn(94);	282	return x16.sqn(16).mul(x16).sqn(32).mul(x2).sqn(96).mul(x2).sqn(94);
		283	} else if (field_order == 39402006196394479212279040100143613805079739270465446667948293404245721771496870329047266088258938001861606973112319) {
		284	const t111 = x2.mul(x2.mul(x2.sq()).sq());
		285	const t111111 = t111.mul(t111.sqn(3));
		286	const t1111110 = t111111.sq();
		287	const t1111111 = x2.mul(t1111110);
		288	const x12 = t1111110.sqn(5).mul(t111111);
		289	const x31 = x12.sqn(12).mul(x12).sqn(7).mul(t1111111);
		290	const x32 = x31.sq().mul(x2);
		291	const x63 = x32.sqn(31).mul(x31);
		292	const x126 = x63.sqn(63).mul(x63);
		293	return x126.sqn(126).mul(x126).sqn(3).mul(t111).sqn(33).mul(x32).sqn(64).mul(x2).sqn(30);
271	} else {	294	} else {
272	return x2.pow(std.meta.Int(.unsigned, field_bits), (field_order + 1) / 4);	295	return x2.pow(std.meta.Int(.unsigned, field_bits), (field_order + 1) / 4);
273	}	296	}

lib/std/crypto/pcurves/p256.zig+1-1

...	@@ -474,5 +474,5 @@ pub const AffineCoordinates = struct {	...	@@ -474,5 +474,5 @@ pub const AffineCoordinates = struct {
474	};	474	};
475		475
476	test "p256" {	476	test "p256" {
477	_ = @import("tests.zig");	477	_ = @import("tests/p256.zig");
478	}	478	}

lib/std/crypto/pcurves/p256/field.zig+1-1

...	@@ -7,6 +7,6 @@ pub const Fe = Field(.{	...	@@ -7,6 +7,6 @@ pub const Fe = Field(.{
7	.fiat = @import("p256_64.zig"),	7	.fiat = @import("p256_64.zig"),
8	.field_order = 115792089210356248762697446949407573530086143415290314195533631308867097853951,	8	.field_order = 115792089210356248762697446949407573530086143415290314195533631308867097853951,
9	.field_bits = 256,	9	.field_bits = 256,
10	.saturated_bits = 255,	10	.saturated_bits = 256,
11	.encoded_length = 32,	11	.encoded_length = 32,
12	});	12	});

lib/std/crypto/pcurves/p256/scalar.zig+1-1

...	@@ -20,7 +20,7 @@ const Fe = Field(.{	...	@@ -20,7 +20,7 @@ const Fe = Field(.{
20	.fiat = @import("p256_scalar_64.zig"),	20	.fiat = @import("p256_scalar_64.zig"),
21	.field_order = 115792089210356248762697446949407573529996955224135760342422259061068512044369,	21	.field_order = 115792089210356248762697446949407573529996955224135760342422259061068512044369,
22	.field_bits = 256,	22	.field_bits = 256,
23	.saturated_bits = 255,	23	.saturated_bits = 256,
24	.encoded_length = encoded_length,	24	.encoded_length = encoded_length,
25	});	25	});
26		26

lib/std/crypto/pcurves/p384.zig created+478

...	@@ -0,0 +1,478 @@
1	const std = @import("std");
2	const crypto = std.crypto;
3	const mem = std.mem;
4	const meta = std.meta;
5
6	const EncodingError = crypto.errors.EncodingError;
7	const IdentityElementError = crypto.errors.IdentityElementError;
8	const NonCanonicalError = crypto.errors.NonCanonicalError;
9	const NotSquareError = crypto.errors.NotSquareError;
10
11	/// Group operations over P384.
12	pub const P384 = struct {
13	/// The underlying prime field.
14	pub const Fe = @import("p384/field.zig").Fe;
15	/// Field arithmetic mod the order of the main subgroup.
16	pub const scalar = @import("p384/scalar.zig");
17
18	x: Fe,
19	y: Fe,
20	z: Fe = Fe.one,
21
22	is_base: bool = false,
23
24	/// The P384 base point.
25	pub const basePoint = P384{
26	.x = Fe.fromInt(26247035095799689268623156744566981891852923491109213387815615900925518854738050089022388053975719786650872476732087) catch unreachable,
27	.y = Fe.fromInt(8325710961489029985546751289520108179287853048861315594709205902480503199884419224438643760392947333078086511627871) catch unreachable,
28	.z = Fe.one,
29	.is_base = true,
30	};
31
32	/// The P384 neutral element.
33	pub const identityElement = P384{ .x = Fe.zero, .y = Fe.one, .z = Fe.zero };
34
35	pub const B = Fe.fromInt(27580193559959705877849011840389048093056905856361568521428707301988689241309860865136260764883745107765439761230575) catch unreachable;
36
37	/// Reject the neutral element.
38	pub fn rejectIdentity(p: P384) IdentityElementError!void {
39	if (p.x.isZero()) {
40	return error.IdentityElement;
41	}
42	}
43
44	/// Create a point from affine coordinates after checking that they match the curve equation.
45	pub fn fromAffineCoordinates(p: AffineCoordinates) EncodingError!P384 {
46	const x = p.x;
47	const y = p.y;
48	const x3AxB = x.sq().mul(x).sub(x).sub(x).sub(x).add(B);
49	const yy = y.sq();
50	const on_curve = @boolToInt(x3AxB.equivalent(yy));
51	const is_identity = @boolToInt(x.equivalent(AffineCoordinates.identityElement.x)) & @boolToInt(y.equivalent(AffineCoordinates.identityElement.y));
52	if ((on_curve \| is_identity) == 0) {
53	return error.InvalidEncoding;
54	}
55	var ret = P384{ .x = x, .y = y, .z = Fe.one };
56	ret.z.cMov(P384.identityElement.z, is_identity);
57	return ret;
58	}
59
60	/// Create a point from serialized affine coordinates.
61	pub fn fromSerializedAffineCoordinates(xs: [48]u8, ys: [48]u8, endian: std.builtin.Endian) (NonCanonicalError \|\| EncodingError)!P384 {
62	const x = try Fe.fromBytes(xs, endian);
63	const y = try Fe.fromBytes(ys, endian);
64	return fromAffineCoordinates(.{ .x = x, .y = y });
65	}
66
67	/// Recover the Y coordinate from the X coordinate.
68	pub fn recoverY(x: Fe, is_odd: bool) NotSquareError!Fe {
69	const x3AxB = x.sq().mul(x).sub(x).sub(x).sub(x).add(B);
70	var y = try x3AxB.sqrt();
71	const yn = y.neg();
72	y.cMov(yn, @boolToInt(is_odd) ^ @boolToInt(y.isOdd()));
73	return y;
74	}
75
76	/// Deserialize a SEC1-encoded point.
77	pub fn fromSec1(s: []const u8) (EncodingError \|\| NotSquareError \|\| NonCanonicalError)!P384 {
78	if (s.len < 1) return error.InvalidEncoding;
79	const encoding_type = s[0];
80	const encoded = s[1..];
81	switch (encoding_type) {
82	0 => {
83	if (encoded.len != 0) return error.InvalidEncoding;
84	return P384.identityElement;
85	},
86	2, 3 => {
87	if (encoded.len != 48) return error.InvalidEncoding;
88	const x = try Fe.fromBytes(encoded[0..48].*, .Big);
89	const y_is_odd = (encoding_type == 3);
90	const y = try recoverY(x, y_is_odd);
91	return P384{ .x = x, .y = y };
92	},
93	4 => {
94	if (encoded.len != 96) return error.InvalidEncoding;
95	const x = try Fe.fromBytes(encoded[0..48].*, .Big);
96	const y = try Fe.fromBytes(encoded[48..96].*, .Big);
97	return P384.fromAffineCoordinates(.{ .x = x, .y = y });
98	},
99	else => return error.InvalidEncoding,
100	}
101	}
102
103	/// Serialize a point using the compressed SEC-1 format.
104	pub fn toCompressedSec1(p: P384) [49]u8 {
105	var out: [49]u8 = undefined;
106	const xy = p.affineCoordinates();
107	out[0] = if (xy.y.isOdd()) 3 else 2;
108	mem.copy(u8, out[1..], &xy.x.toBytes(.Big));
109	return out;
110	}
111
112	/// Serialize a point using the uncompressed SEC-1 format.
113	pub fn toUncompressedSec1(p: P384) [97]u8 {
114	var out: [97]u8 = undefined;
115	out[0] = 4;
116	const xy = p.affineCoordinates();
117	mem.copy(u8, out[1..49], &xy.x.toBytes(.Big));
118	mem.copy(u8, out[49..97], &xy.y.toBytes(.Big));
119	return out;
120	}
121
122	/// Return a random point.
123	pub fn random() P384 {
124	const n = scalar.random(.Little);
125	return basePoint.mul(n, .Little) catch unreachable;
126	}
127
128	/// Flip the sign of the X coordinate.
129	pub fn neg(p: P384) P384 {
130	return .{ .x = p.x, .y = p.y.neg(), .z = p.z };
131	}
132
133	/// Double a P384 point.
134	// Algorithm 6 from https://eprint.iacr.org/2015/1060.pdf
135	pub fn dbl(p: P384) P384 {
136	var t0 = p.x.sq();
137	var t1 = p.y.sq();
138	var t2 = p.z.sq();
139	var t3 = p.x.mul(p.y);
140	t3 = t3.dbl();
141	var Z3 = p.x.mul(p.z);
142	Z3 = Z3.add(Z3);
143	var Y3 = B.mul(t2);
144	Y3 = Y3.sub(Z3);
145	var X3 = Y3.dbl();
146	Y3 = X3.add(Y3);
147	X3 = t1.sub(Y3);
148	Y3 = t1.add(Y3);
149	Y3 = X3.mul(Y3);
150	X3 = X3.mul(t3);
151	t3 = t2.dbl();
152	t2 = t2.add(t3);
153	Z3 = B.mul(Z3);
154	Z3 = Z3.sub(t2);
155	Z3 = Z3.sub(t0);
156	t3 = Z3.dbl();
157	Z3 = Z3.add(t3);
158	t3 = t0.dbl();
159	t0 = t3.add(t0);
160	t0 = t0.sub(t2);
161	t0 = t0.mul(Z3);
162	Y3 = Y3.add(t0);
163	t0 = p.y.mul(p.z);
164	t0 = t0.dbl();
165	Z3 = t0.mul(Z3);
166	X3 = X3.sub(Z3);
167	Z3 = t0.mul(t1);
168	Z3 = Z3.dbl().dbl();
169	return .{
170	.x = X3,
171	.y = Y3,
172	.z = Z3,
173	};
174	}
175
176	/// Add P384 points, the second being specified using affine coordinates.
177	// Algorithm 5 from https://eprint.iacr.org/2015/1060.pdf
178	pub fn addMixed(p: P384, q: AffineCoordinates) P384 {
179	var t0 = p.x.mul(q.x);
180	var t1 = p.y.mul(q.y);
181	var t3 = q.x.add(q.y);
182	var t4 = p.x.add(p.y);
183	t3 = t3.mul(t4);
184	t4 = t0.add(t1);
185	t3 = t3.sub(t4);
186	t4 = q.y.mul(p.z);
187	t4 = t4.add(p.y);
188	var Y3 = q.x.mul(p.z);
189	Y3 = Y3.add(p.x);
190	var Z3 = B.mul(p.z);
191	var X3 = Y3.sub(Z3);
192	Z3 = X3.dbl();
193	X3 = X3.add(Z3);
194	Z3 = t1.sub(X3);
195	X3 = t1.add(X3);
196	Y3 = B.mul(Y3);
197	t1 = p.z.dbl();
198	var t2 = t1.add(p.z);
199	Y3 = Y3.sub(t2);
200	Y3 = Y3.sub(t0);
201	t1 = Y3.dbl();
202	Y3 = t1.add(Y3);
203	t1 = t0.dbl();
204	t0 = t1.add(t0);
205	t0 = t0.sub(t2);
206	t1 = t4.mul(Y3);
207	t2 = t0.mul(Y3);
208	Y3 = X3.mul(Z3);
209	Y3 = Y3.add(t2);
210	X3 = t3.mul(X3);
211	X3 = X3.sub(t1);
212	Z3 = t4.mul(Z3);
213	t1 = t3.mul(t0);
214	Z3 = Z3.add(t1);
215	var ret = P384{
216	.x = X3,
217	.y = Y3,
218	.z = Z3,
219	};
220	ret.cMov(p, @boolToInt(q.x.isZero()));
221	return ret;
222	}
223
224	/// Add P384 points.
225	// Algorithm 4 from https://eprint.iacr.org/2015/1060.pdf
226	pub fn add(p: P384, q: P384) P384 {
227	var t0 = p.x.mul(q.x);
228	var t1 = p.y.mul(q.y);
229	var t2 = p.z.mul(q.z);
230	var t3 = p.x.add(p.y);
231	var t4 = q.x.add(q.y);
232	t3 = t3.mul(t4);
233	t4 = t0.add(t1);
234	t3 = t3.sub(t4);
235	t4 = p.y.add(p.z);
236	var X3 = q.y.add(q.z);
237	t4 = t4.mul(X3);
238	X3 = t1.add(t2);
239	t4 = t4.sub(X3);
240	X3 = p.x.add(p.z);
241	var Y3 = q.x.add(q.z);
242	X3 = X3.mul(Y3);
243	Y3 = t0.add(t2);
244	Y3 = X3.sub(Y3);
245	var Z3 = B.mul(t2);
246	X3 = Y3.sub(Z3);
247	Z3 = X3.dbl();
248	X3 = X3.add(Z3);
249	Z3 = t1.sub(X3);
250	X3 = t1.add(X3);
251	Y3 = B.mul(Y3);
252	t1 = t2.dbl();
253	t2 = t1.add(t2);
254	Y3 = Y3.sub(t2);
255	Y3 = Y3.sub(t0);
256	t1 = Y3.dbl();
257	Y3 = t1.add(Y3);
258	t1 = t0.dbl();
259	t0 = t1.add(t0);
260	t0 = t0.sub(t2);
261	t1 = t4.mul(Y3);
262	t2 = t0.mul(Y3);
263	Y3 = X3.mul(Z3);
264	Y3 = Y3.add(t2);
265	X3 = t3.mul(X3);
266	X3 = X3.sub(t1);
267	Z3 = t4.mul(Z3);
268	t1 = t3.mul(t0);
269	Z3 = Z3.add(t1);
270	return .{
271	.x = X3,
272	.y = Y3,
273	.z = Z3,
274	};
275	}
276
277	/// Subtract P384 points.
278	pub fn sub(p: P384, q: P384) P384 {
279	return p.add(q.neg());
280	}
281
282	/// Subtract P384 points, the second being specified using affine coordinates.
283	pub fn subMixed(p: P384, q: AffineCoordinates) P384 {
284	return p.addMixed(q.neg());
285	}
286
287	/// Return affine coordinates.
288	pub fn affineCoordinates(p: P384) AffineCoordinates {
289	const zinv = p.z.invert();
290	var ret = AffineCoordinates{
291	.x = p.x.mul(zinv),
292	.y = p.y.mul(zinv),
293	};
294	ret.cMov(AffineCoordinates.identityElement, @boolToInt(p.x.isZero()));
295	return ret;
296	}
297
298	/// Return true if both coordinate sets represent the same point.
299	pub fn equivalent(a: P384, b: P384) bool {
300	if (a.sub(b).rejectIdentity()) {
301	return false;
302	} else \|_\| {
303	return true;
304	}
305	}
306
307	fn cMov(p: *P384, a: P384, c: u1) void {
308	p.x.cMov(a.x, c);
309	p.y.cMov(a.y, c);
310	p.z.cMov(a.z, c);
311	}
312
313	fn pcSelect(comptime n: usize, pc: *const [n]P384, b: u8) P384 {
314	var t = P384.identityElement;
315	comptime var i: u8 = 1;
316	inline while (i < pc.len) : (i += 1) {
317	t.cMov(pc[i], @truncate(u1, (@as(usize, b ^ i) -% 1) >> 8));
318	}
319	return t;
320	}
321
322	fn slide(s: [48]u8) [2 * 48 + 1]i8 {
323	var e: [2 * 48 + 1]i8 = undefined;
324	for (s) \|x, i\| {
325	e[i * 2 + 0] = @as(i8, @truncate(u4, x));
326	e[i * 2 + 1] = @as(i8, @truncate(u4, x >> 4));
327	}
328	// Now, e[0..63] is between 0 and 15, e[63] is between 0 and 7
329	var carry: i8 = 0;
330	for (e[0..96]) \|*x\| {
331	x.* += carry;
332	carry = (x.* + 8) >> 4;
333	x.* -= carry * 16;
334	std.debug.assert(x.* >= -8 and x.* <= 8);
335	}
336	e[96] = carry;
337	// Now, e[*] is between -8 and 8, including e[64]
338	std.debug.assert(carry >= -8 and carry <= 8);
339	return e;
340	}
341
342	fn pcMul(pc: *const [9]P384, s: [48]u8, comptime vartime: bool) IdentityElementError!P384 {
343	std.debug.assert(vartime);
344	const e = slide(s);
345	var q = P384.identityElement;
346	var pos = e.len - 1;
347	while (true) : (pos -= 1) {
348	const slot = e[pos];
349	if (slot > 0) {
350	q = q.add(pc[@intCast(usize, slot)]);
351	} else if (slot < 0) {
352	q = q.sub(pc[@intCast(usize, -slot)]);
353	}
354	if (pos == 0) break;
355	q = q.dbl().dbl().dbl().dbl();
356	}
357	try q.rejectIdentity();
358	return q;
359	}
360
361	fn pcMul16(pc: *const [16]P384, s: [48]u8, comptime vartime: bool) IdentityElementError!P384 {
362	var q = P384.identityElement;
363	var pos: usize = 380;
364	while (true) : (pos -= 4) {
365	const slot = @truncate(u4, (s[pos >> 3] >> @truncate(u3, pos)));
366	if (vartime) {
367	if (slot != 0) {
368	q = q.add(pc[slot]);
369	}
370	} else {
371	q = q.add(pcSelect(16, pc, slot));
372	}
373	if (pos == 0) break;
374	q = q.dbl().dbl().dbl().dbl();
375	}
376	try q.rejectIdentity();
377	return q;
378	}
379
380	fn precompute(p: P384, comptime count: usize) [1 + count]P384 {
381	var pc: [1 + count]P384 = undefined;
382	pc[0] = P384.identityElement;
383	pc[1] = p;
384	var i: usize = 2;
385	while (i <= count) : (i += 1) {
386	pc[i] = if (i % 2 == 0) pc[i / 2].dbl() else pc[i - 1].add(p);
387	}
388	return pc;
389	}
390
391	const basePointPc = pc: {
392	@setEvalBranchQuota(50000);
393	break :pc precompute(P384.basePoint, 15);
394	};
395
396	/// Multiply an elliptic curve point by a scalar.
397	/// Return error.IdentityElement if the result is the identity element.
398	pub fn mul(p: P384, s_: [48]u8, endian: std.builtin.Endian) IdentityElementError!P384 {
399	const s = if (endian == .Little) s_ else Fe.orderSwap(s_);
400	if (p.is_base) {
401	return pcMul16(&basePointPc, s, false);
402	}
403	try p.rejectIdentity();
404	const pc = precompute(p, 15);
405	return pcMul16(&pc, s, false);
406	}
407
408	/// Multiply an elliptic curve point by a PUBLIC scalar IN VARIABLE TIME
409	/// This can be used for signature verification.
410	pub fn mulPublic(p: P384, s_: [48]u8, endian: std.builtin.Endian) IdentityElementError!P384 {
411	const s = if (endian == .Little) s_ else Fe.orderSwap(s_);
412	if (p.is_base) {
413	return pcMul16(&basePointPc, s, true);
414	}
415	try p.rejectIdentity();
416	const pc = precompute(p, 8);
417	return pcMul(&pc, s, true);
418	}
419
420	/// Double-base multiplication of public parameters - Compute (p1s1)+(p2s2) IN VARIABLE TIME
421	/// This can be used for signature verification.
422	pub fn mulDoubleBasePublic(p1: P384, s1_: [48]u8, p2: P384, s2_: [48]u8, endian: std.builtin.Endian) IdentityElementError!P384 {
423	const s1 = if (endian == .Little) s1_ else Fe.orderSwap(s1_);
424	const s2 = if (endian == .Little) s2_ else Fe.orderSwap(s2_);
425	try p1.rejectIdentity();
426	var pc1_array: [9]P384 = undefined;
427	const pc1 = if (p1.is_base) basePointPc[0..9] else pc: {
428	pc1_array = precompute(p1, 8);
429	break :pc &pc1_array;
430	};
431	try p2.rejectIdentity();
432	var pc2_array: [9]P384 = undefined;
433	const pc2 = if (p2.is_base) basePointPc[0..9] else pc: {
434	pc2_array = precompute(p2, 8);
435	break :pc &pc2_array;
436	};
437	const e1 = slide(s1);
438	const e2 = slide(s2);
439	var q = P384.identityElement;
440	var pos: usize = 2 * 48 - 1;
441	while (true) : (pos -= 1) {
442	const slot1 = e1[pos];
443	if (slot1 > 0) {
444	q = q.add(pc1[@intCast(usize, slot1)]);
445	} else if (slot1 < 0) {
446	q = q.sub(pc1[@intCast(usize, -slot1)]);
447	}
448	const slot2 = e2[pos];
449	if (slot2 > 0) {
450	q = q.add(pc2[@intCast(usize, slot2)]);
451	} else if (slot2 < 0) {
452	q = q.sub(pc2[@intCast(usize, -slot2)]);
453	}
454	if (pos == 0) break;
455	q = q.dbl().dbl().dbl().dbl();
456	}
457	try q.rejectIdentity();
458	return q;
459	}
460	};
461
462	/// A point in affine coordinates.
463	pub const AffineCoordinates = struct {
464	x: P384.Fe,
465	y: P384.Fe,
466
467	/// Identity element in affine coordinates.
468	pub const identityElement = AffineCoordinates{ .x = P384.identityElement.x, .y = P384.identityElement.y };
469
470	fn cMov(p: *AffineCoordinates, a: AffineCoordinates, c: u1) void {
471	p.x.cMov(a.x, c);
472	p.y.cMov(a.y, c);
473	}
474	};
475
476	test "p384" {
477	_ = @import("tests/p384.zig");
478	}

lib/std/crypto/pcurves/p384/field.zig created+12

...	@@ -0,0 +1,12 @@
1	const std = @import("std");
2	const common = @import("../common.zig");
3
4	const Field = common.Field;
5
6	pub const Fe = Field(.{
7	.fiat = @import("p384_64.zig"),
8	.field_order = 39402006196394479212279040100143613805079739270465446667948293404245721771496870329047266088258938001861606973112319,
9	.field_bits = 384,
10	.saturated_bits = 384,
11	.encoded_length = 48,
12	});

lib/std/crypto/pcurves/p384/p384_64.zig created+3578

...	@@ -0,0 +1,3578 @@
1	// Autogenerated: 'src/ExtractionOCaml/word_by_word_montgomery' --lang Zig --internal-static --public-function-case camelCase --private-function-case camelCase --public-type-case UpperCamelCase --private-type-case UpperCamelCase --no-prefix-fiat --package-name p384 '' 64 '2^384 - 2^128 - 2^96 + 2^32 - 1' mul square add sub opp from_montgomery to_montgomery nonzero selectznz to_bytes from_bytes one msat divstep divstep_precomp
2	// curve description (via package name): p384
3	// machine_wordsize = 64 (from "64")
4	// requested operations: mul, square, add, sub, opp, from_montgomery, to_montgomery, nonzero, selectznz, to_bytes, from_bytes, one, msat, divstep, divstep_precomp
5	// m = 0xfffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffeffffffff0000000000000000ffffffff (from "2^384 - 2^128 - 2^96 + 2^32 - 1")
6	//
7	// NOTE: In addition to the bounds specified above each function, all
8	// functions synthesized for this Montgomery arithmetic require the
9	// input to be strictly less than the prime modulus (m), and also
10	// require the input to be in the unique saturated representation.
11	// All functions also ensure that these two properties are true of
12	// return values.
13	//
14	// Computed values:
15	// eval z = z[0] + (z[1] << 64) + (z[2] << 128) + (z[3] << 192) + (z[4] << 256) + (z[5] << 0x140)
16	// bytes_eval z = z[0] + (z[1] << 8) + (z[2] << 16) + (z[3] << 24) + (z[4] << 32) + (z[5] << 40) + (z[6] << 48) + (z[7] << 56) + (z[8] << 64) + (z[9] << 72) + (z[10] << 80) + (z[11] << 88) + (z[12] << 96) + (z[13] << 104) + (z[14] << 112) + (z[15] << 120) + (z[16] << 128) + (z[17] << 136) + (z[18] << 144) + (z[19] << 152) + (z[20] << 160) + (z[21] << 168) + (z[22] << 176) + (z[23] << 184) + (z[24] << 192) + (z[25] << 200) + (z[26] << 208) + (z[27] << 216) + (z[28] << 224) + (z[29] << 232) + (z[30] << 240) + (z[31] << 248) + (z[32] << 256) + (z[33] << 0x108) + (z[34] << 0x110) + (z[35] << 0x118) + (z[36] << 0x120) + (z[37] << 0x128) + (z[38] << 0x130) + (z[39] << 0x138) + (z[40] << 0x140) + (z[41] << 0x148) + (z[42] << 0x150) + (z[43] << 0x158) + (z[44] << 0x160) + (z[45] << 0x168) + (z[46] << 0x170) + (z[47] << 0x178)
17	// twos_complement_eval z = let x1 := z[0] + (z[1] << 64) + (z[2] << 128) + (z[3] << 192) + (z[4] << 256) + (z[5] << 0x140) in
18	// if x1 & (2^384-1) < 2^383 then x1 & (2^384-1) else (x1 & (2^384-1)) - 2^384
19
20	const std = @import("std");
21	const mode = @import("builtin").mode; // Checked arithmetic is disabled in non-debug modes to avoid side channels
22
23	// The type MontgomeryDomainFieldElement is a field element in the Montgomery domain.
24	// Bounds: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
25	pub const MontgomeryDomainFieldElement = [6]u64;
26
27	// The type NonMontgomeryDomainFieldElement is a field element NOT in the Montgomery domain.
28	// Bounds: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
29	pub const NonMontgomeryDomainFieldElement = [6]u64;
30
31	/// The function addcarryxU64 is an addition with carry.
32	///
33	/// Postconditions:
34	/// out1 = (arg1 + arg2 + arg3) mod 2^64
35	/// out2 = ⌊(arg1 + arg2 + arg3) / 2^64⌋
36	///
37	/// Input Bounds:
38	/// arg1: [0x0 ~> 0x1]
39	/// arg2: [0x0 ~> 0xffffffffffffffff]
40	/// arg3: [0x0 ~> 0xffffffffffffffff]
41	/// Output Bounds:
42	/// out1: [0x0 ~> 0xffffffffffffffff]
43	/// out2: [0x0 ~> 0x1]
44	inline fn addcarryxU64(out1: u64, out2: u1, arg1: u1, arg2: u64, arg3: u64) void {
45	@setRuntimeSafety(mode == .Debug);
46
47	var t: u64 = undefined;
48	const carry1 = @addWithOverflow(u64, arg2, arg3, &t);
49	const carry2 = @addWithOverflow(u64, t, arg1, out1);
50	out2.* = @boolToInt(carry1) \| @boolToInt(carry2);
51	}
52
53	/// The function subborrowxU64 is a subtraction with borrow.
54	///
55	/// Postconditions:
56	/// out1 = (-arg1 + arg2 + -arg3) mod 2^64
57	/// out2 = -⌊(-arg1 + arg2 + -arg3) / 2^64⌋
58	///
59	/// Input Bounds:
60	/// arg1: [0x0 ~> 0x1]
61	/// arg2: [0x0 ~> 0xffffffffffffffff]
62	/// arg3: [0x0 ~> 0xffffffffffffffff]
63	/// Output Bounds:
64	/// out1: [0x0 ~> 0xffffffffffffffff]
65	/// out2: [0x0 ~> 0x1]
66	inline fn subborrowxU64(out1: u64, out2: u1, arg1: u1, arg2: u64, arg3: u64) void {
67	@setRuntimeSafety(mode == .Debug);
68
69	var t: u64 = undefined;
70	const carry1 = @subWithOverflow(u64, arg2, arg3, &t);
71	const carry2 = @subWithOverflow(u64, t, arg1, out1);
72	out2.* = @boolToInt(carry1) \| @boolToInt(carry2);
73	}
74
75	/// The function mulxU64 is a multiplication, returning the full double-width result.
76	///
77	/// Postconditions:
78	/// out1 = (arg1 * arg2) mod 2^64
79	/// out2 = ⌊arg1 * arg2 / 2^64⌋
80	///
81	/// Input Bounds:
82	/// arg1: [0x0 ~> 0xffffffffffffffff]
83	/// arg2: [0x0 ~> 0xffffffffffffffff]
84	/// Output Bounds:
85	/// out1: [0x0 ~> 0xffffffffffffffff]
86	/// out2: [0x0 ~> 0xffffffffffffffff]
87	inline fn mulxU64(out1: u64, out2: u64, arg1: u64, arg2: u64) void {
88	@setRuntimeSafety(mode == .Debug);
89
90	const x = @as(u128, arg1) * @as(u128, arg2);
91	out1.* = @truncate(u64, x);
92	out2.* = @truncate(u64, x >> 64);
93	}
94
95	/// The function cmovznzU64 is a single-word conditional move.
96	///
97	/// Postconditions:
98	/// out1 = (if arg1 = 0 then arg2 else arg3)
99	///
100	/// Input Bounds:
101	/// arg1: [0x0 ~> 0x1]
102	/// arg2: [0x0 ~> 0xffffffffffffffff]
103	/// arg3: [0x0 ~> 0xffffffffffffffff]
104	/// Output Bounds:
105	/// out1: [0x0 ~> 0xffffffffffffffff]
106	inline fn cmovznzU64(out1: *u64, arg1: u1, arg2: u64, arg3: u64) void {
107	@setRuntimeSafety(mode == .Debug);
108
109	const mask = 0 -% @as(u64, arg1);
110	out1.* = (mask & arg3) \| ((~mask) & arg2);
111	}
112
113	/// The function mul multiplies two field elements in the Montgomery domain.
114	///
115	/// Preconditions:
116	/// 0 ≤ eval arg1 < m
117	/// 0 ≤ eval arg2 < m
118	/// Postconditions:
119	/// eval (from_montgomery out1) mod m = (eval (from_montgomery arg1) * eval (from_montgomery arg2)) mod m
120	/// 0 ≤ eval out1 < m
121	///
122	pub fn mul(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldElement, arg2: MontgomeryDomainFieldElement) void {
123	@setRuntimeSafety(mode == .Debug);
124
125	const x1 = (arg1[1]);
126	const x2 = (arg1[2]);
127	const x3 = (arg1[3]);
128	const x4 = (arg1[4]);
129	const x5 = (arg1[5]);
130	const x6 = (arg1[0]);
131	var x7: u64 = undefined;
132	var x8: u64 = undefined;
133	mulxU64(&x7, &x8, x6, (arg2[5]));
134	var x9: u64 = undefined;
135	var x10: u64 = undefined;
136	mulxU64(&x9, &x10, x6, (arg2[4]));
137	var x11: u64 = undefined;
138	var x12: u64 = undefined;
139	mulxU64(&x11, &x12, x6, (arg2[3]));
140	var x13: u64 = undefined;
141	var x14: u64 = undefined;
142	mulxU64(&x13, &x14, x6, (arg2[2]));
143	var x15: u64 = undefined;
144	var x16: u64 = undefined;
145	mulxU64(&x15, &x16, x6, (arg2[1]));
146	var x17: u64 = undefined;
147	var x18: u64 = undefined;
148	mulxU64(&x17, &x18, x6, (arg2[0]));
149	var x19: u64 = undefined;
150	var x20: u1 = undefined;
151	addcarryxU64(&x19, &x20, 0x0, x18, x15);
152	var x21: u64 = undefined;
153	var x22: u1 = undefined;
154	addcarryxU64(&x21, &x22, x20, x16, x13);
155	var x23: u64 = undefined;
156	var x24: u1 = undefined;
157	addcarryxU64(&x23, &x24, x22, x14, x11);
158	var x25: u64 = undefined;
159	var x26: u1 = undefined;
160	addcarryxU64(&x25, &x26, x24, x12, x9);
161	var x27: u64 = undefined;
162	var x28: u1 = undefined;
163	addcarryxU64(&x27, &x28, x26, x10, x7);
164	const x29 = (@as(u64, x28) + x8);
165	var x30: u64 = undefined;
166	var x31: u64 = undefined;
167	mulxU64(&x30, &x31, x17, 0x100000001);
168	var x32: u64 = undefined;
169	var x33: u64 = undefined;
170	mulxU64(&x32, &x33, x30, 0xffffffffffffffff);
171	var x34: u64 = undefined;
172	var x35: u64 = undefined;
173	mulxU64(&x34, &x35, x30, 0xffffffffffffffff);
174	var x36: u64 = undefined;
175	var x37: u64 = undefined;
176	mulxU64(&x36, &x37, x30, 0xffffffffffffffff);
177	var x38: u64 = undefined;
178	var x39: u64 = undefined;
179	mulxU64(&x38, &x39, x30, 0xfffffffffffffffe);
180	var x40: u64 = undefined;
181	var x41: u64 = undefined;
182	mulxU64(&x40, &x41, x30, 0xffffffff00000000);
183	var x42: u64 = undefined;
184	var x43: u64 = undefined;
185	mulxU64(&x42, &x43, x30, 0xffffffff);
186	var x44: u64 = undefined;
187	var x45: u1 = undefined;
188	addcarryxU64(&x44, &x45, 0x0, x43, x40);
189	var x46: u64 = undefined;
190	var x47: u1 = undefined;
191	addcarryxU64(&x46, &x47, x45, x41, x38);
192	var x48: u64 = undefined;
193	var x49: u1 = undefined;
194	addcarryxU64(&x48, &x49, x47, x39, x36);
195	var x50: u64 = undefined;
196	var x51: u1 = undefined;
197	addcarryxU64(&x50, &x51, x49, x37, x34);
198	var x52: u64 = undefined;
199	var x53: u1 = undefined;
200	addcarryxU64(&x52, &x53, x51, x35, x32);
201	const x54 = (@as(u64, x53) + x33);
202	var x55: u64 = undefined;
203	var x56: u1 = undefined;
204	addcarryxU64(&x55, &x56, 0x0, x17, x42);
205	var x57: u64 = undefined;
206	var x58: u1 = undefined;
207	addcarryxU64(&x57, &x58, x56, x19, x44);
208	var x59: u64 = undefined;
209	var x60: u1 = undefined;
210	addcarryxU64(&x59, &x60, x58, x21, x46);
211	var x61: u64 = undefined;
212	var x62: u1 = undefined;
213	addcarryxU64(&x61, &x62, x60, x23, x48);
214	var x63: u64 = undefined;
215	var x64: u1 = undefined;
216	addcarryxU64(&x63, &x64, x62, x25, x50);
217	var x65: u64 = undefined;
218	var x66: u1 = undefined;
219	addcarryxU64(&x65, &x66, x64, x27, x52);
220	var x67: u64 = undefined;
221	var x68: u1 = undefined;
222	addcarryxU64(&x67, &x68, x66, x29, x54);
223	var x69: u64 = undefined;
224	var x70: u64 = undefined;
225	mulxU64(&x69, &x70, x1, (arg2[5]));
226	var x71: u64 = undefined;
227	var x72: u64 = undefined;
228	mulxU64(&x71, &x72, x1, (arg2[4]));
229	var x73: u64 = undefined;
230	var x74: u64 = undefined;
231	mulxU64(&x73, &x74, x1, (arg2[3]));
232	var x75: u64 = undefined;
233	var x76: u64 = undefined;
234	mulxU64(&x75, &x76, x1, (arg2[2]));
235	var x77: u64 = undefined;
236	var x78: u64 = undefined;
237	mulxU64(&x77, &x78, x1, (arg2[1]));
238	var x79: u64 = undefined;
239	var x80: u64 = undefined;
240	mulxU64(&x79, &x80, x1, (arg2[0]));
241	var x81: u64 = undefined;
242	var x82: u1 = undefined;
243	addcarryxU64(&x81, &x82, 0x0, x80, x77);
244	var x83: u64 = undefined;
245	var x84: u1 = undefined;
246	addcarryxU64(&x83, &x84, x82, x78, x75);
247	var x85: u64 = undefined;
248	var x86: u1 = undefined;
249	addcarryxU64(&x85, &x86, x84, x76, x73);
250	var x87: u64 = undefined;
251	var x88: u1 = undefined;
252	addcarryxU64(&x87, &x88, x86, x74, x71);
253	var x89: u64 = undefined;
254	var x90: u1 = undefined;
255	addcarryxU64(&x89, &x90, x88, x72, x69);
256	const x91 = (@as(u64, x90) + x70);
257	var x92: u64 = undefined;
258	var x93: u1 = undefined;
259	addcarryxU64(&x92, &x93, 0x0, x57, x79);
260	var x94: u64 = undefined;
261	var x95: u1 = undefined;
262	addcarryxU64(&x94, &x95, x93, x59, x81);
263	var x96: u64 = undefined;
264	var x97: u1 = undefined;
265	addcarryxU64(&x96, &x97, x95, x61, x83);
266	var x98: u64 = undefined;
267	var x99: u1 = undefined;
268	addcarryxU64(&x98, &x99, x97, x63, x85);
269	var x100: u64 = undefined;
270	var x101: u1 = undefined;
271	addcarryxU64(&x100, &x101, x99, x65, x87);
272	var x102: u64 = undefined;
273	var x103: u1 = undefined;
274	addcarryxU64(&x102, &x103, x101, x67, x89);
275	var x104: u64 = undefined;
276	var x105: u1 = undefined;
277	addcarryxU64(&x104, &x105, x103, @as(u64, x68), x91);
278	var x106: u64 = undefined;
279	var x107: u64 = undefined;
280	mulxU64(&x106, &x107, x92, 0x100000001);
281	var x108: u64 = undefined;
282	var x109: u64 = undefined;
283	mulxU64(&x108, &x109, x106, 0xffffffffffffffff);
284	var x110: u64 = undefined;
285	var x111: u64 = undefined;
286	mulxU64(&x110, &x111, x106, 0xffffffffffffffff);
287	var x112: u64 = undefined;
288	var x113: u64 = undefined;
289	mulxU64(&x112, &x113, x106, 0xffffffffffffffff);
290	var x114: u64 = undefined;
291	var x115: u64 = undefined;
292	mulxU64(&x114, &x115, x106, 0xfffffffffffffffe);
293	var x116: u64 = undefined;
294	var x117: u64 = undefined;
295	mulxU64(&x116, &x117, x106, 0xffffffff00000000);
296	var x118: u64 = undefined;
297	var x119: u64 = undefined;
298	mulxU64(&x118, &x119, x106, 0xffffffff);
299	var x120: u64 = undefined;
300	var x121: u1 = undefined;
301	addcarryxU64(&x120, &x121, 0x0, x119, x116);
302	var x122: u64 = undefined;
303	var x123: u1 = undefined;
304	addcarryxU64(&x122, &x123, x121, x117, x114);
305	var x124: u64 = undefined;
306	var x125: u1 = undefined;
307	addcarryxU64(&x124, &x125, x123, x115, x112);
308	var x126: u64 = undefined;
309	var x127: u1 = undefined;
310	addcarryxU64(&x126, &x127, x125, x113, x110);
311	var x128: u64 = undefined;
312	var x129: u1 = undefined;
313	addcarryxU64(&x128, &x129, x127, x111, x108);
314	const x130 = (@as(u64, x129) + x109);
315	var x131: u64 = undefined;
316	var x132: u1 = undefined;
317	addcarryxU64(&x131, &x132, 0x0, x92, x118);
318	var x133: u64 = undefined;
319	var x134: u1 = undefined;
320	addcarryxU64(&x133, &x134, x132, x94, x120);
321	var x135: u64 = undefined;
322	var x136: u1 = undefined;
323	addcarryxU64(&x135, &x136, x134, x96, x122);
324	var x137: u64 = undefined;
325	var x138: u1 = undefined;
326	addcarryxU64(&x137, &x138, x136, x98, x124);
327	var x139: u64 = undefined;
328	var x140: u1 = undefined;
329	addcarryxU64(&x139, &x140, x138, x100, x126);
330	var x141: u64 = undefined;
331	var x142: u1 = undefined;
332	addcarryxU64(&x141, &x142, x140, x102, x128);
333	var x143: u64 = undefined;
334	var x144: u1 = undefined;
335	addcarryxU64(&x143, &x144, x142, x104, x130);
336	const x145 = (@as(u64, x144) + @as(u64, x105));
337	var x146: u64 = undefined;
338	var x147: u64 = undefined;
339	mulxU64(&x146, &x147, x2, (arg2[5]));
340	var x148: u64 = undefined;
341	var x149: u64 = undefined;
342	mulxU64(&x148, &x149, x2, (arg2[4]));
343	var x150: u64 = undefined;
344	var x151: u64 = undefined;
345	mulxU64(&x150, &x151, x2, (arg2[3]));
346	var x152: u64 = undefined;
347	var x153: u64 = undefined;
348	mulxU64(&x152, &x153, x2, (arg2[2]));
349	var x154: u64 = undefined;
350	var x155: u64 = undefined;
351	mulxU64(&x154, &x155, x2, (arg2[1]));
352	var x156: u64 = undefined;
353	var x157: u64 = undefined;
354	mulxU64(&x156, &x157, x2, (arg2[0]));
355	var x158: u64 = undefined;
356	var x159: u1 = undefined;
357	addcarryxU64(&x158, &x159, 0x0, x157, x154);
358	var x160: u64 = undefined;
359	var x161: u1 = undefined;
360	addcarryxU64(&x160, &x161, x159, x155, x152);
361	var x162: u64 = undefined;
362	var x163: u1 = undefined;
363	addcarryxU64(&x162, &x163, x161, x153, x150);
364	var x164: u64 = undefined;
365	var x165: u1 = undefined;
366	addcarryxU64(&x164, &x165, x163, x151, x148);
367	var x166: u64 = undefined;
368	var x167: u1 = undefined;
369	addcarryxU64(&x166, &x167, x165, x149, x146);
370	const x168 = (@as(u64, x167) + x147);
371	var x169: u64 = undefined;
372	var x170: u1 = undefined;
373	addcarryxU64(&x169, &x170, 0x0, x133, x156);
374	var x171: u64 = undefined;
375	var x172: u1 = undefined;
376	addcarryxU64(&x171, &x172, x170, x135, x158);
377	var x173: u64 = undefined;
378	var x174: u1 = undefined;
379	addcarryxU64(&x173, &x174, x172, x137, x160);
380	var x175: u64 = undefined;
381	var x176: u1 = undefined;
382	addcarryxU64(&x175, &x176, x174, x139, x162);
383	var x177: u64 = undefined;
384	var x178: u1 = undefined;
385	addcarryxU64(&x177, &x178, x176, x141, x164);
386	var x179: u64 = undefined;
387	var x180: u1 = undefined;
388	addcarryxU64(&x179, &x180, x178, x143, x166);
389	var x181: u64 = undefined;
390	var x182: u1 = undefined;
391	addcarryxU64(&x181, &x182, x180, x145, x168);
392	var x183: u64 = undefined;
393	var x184: u64 = undefined;
394	mulxU64(&x183, &x184, x169, 0x100000001);
395	var x185: u64 = undefined;
396	var x186: u64 = undefined;
397	mulxU64(&x185, &x186, x183, 0xffffffffffffffff);
398	var x187: u64 = undefined;
399	var x188: u64 = undefined;
400	mulxU64(&x187, &x188, x183, 0xffffffffffffffff);
401	var x189: u64 = undefined;
402	var x190: u64 = undefined;
403	mulxU64(&x189, &x190, x183, 0xffffffffffffffff);
404	var x191: u64 = undefined;
405	var x192: u64 = undefined;
406	mulxU64(&x191, &x192, x183, 0xfffffffffffffffe);
407	var x193: u64 = undefined;
408	var x194: u64 = undefined;
409	mulxU64(&x193, &x194, x183, 0xffffffff00000000);
410	var x195: u64 = undefined;
411	var x196: u64 = undefined;
412	mulxU64(&x195, &x196, x183, 0xffffffff);
413	var x197: u64 = undefined;
414	var x198: u1 = undefined;
415	addcarryxU64(&x197, &x198, 0x0, x196, x193);
416	var x199: u64 = undefined;
417	var x200: u1 = undefined;
418	addcarryxU64(&x199, &x200, x198, x194, x191);
419	var x201: u64 = undefined;
420	var x202: u1 = undefined;
421	addcarryxU64(&x201, &x202, x200, x192, x189);
422	var x203: u64 = undefined;
423	var x204: u1 = undefined;
424	addcarryxU64(&x203, &x204, x202, x190, x187);
425	var x205: u64 = undefined;
426	var x206: u1 = undefined;
427	addcarryxU64(&x205, &x206, x204, x188, x185);
428	const x207 = (@as(u64, x206) + x186);
429	var x208: u64 = undefined;
430	var x209: u1 = undefined;
431	addcarryxU64(&x208, &x209, 0x0, x169, x195);
432	var x210: u64 = undefined;
433	var x211: u1 = undefined;
434	addcarryxU64(&x210, &x211, x209, x171, x197);
435	var x212: u64 = undefined;
436	var x213: u1 = undefined;
437	addcarryxU64(&x212, &x213, x211, x173, x199);
438	var x214: u64 = undefined;
439	var x215: u1 = undefined;
440	addcarryxU64(&x214, &x215, x213, x175, x201);
441	var x216: u64 = undefined;
442	var x217: u1 = undefined;
443	addcarryxU64(&x216, &x217, x215, x177, x203);
444	var x218: u64 = undefined;
445	var x219: u1 = undefined;
446	addcarryxU64(&x218, &x219, x217, x179, x205);
447	var x220: u64 = undefined;
448	var x221: u1 = undefined;
449	addcarryxU64(&x220, &x221, x219, x181, x207);
450	const x222 = (@as(u64, x221) + @as(u64, x182));
451	var x223: u64 = undefined;
452	var x224: u64 = undefined;
453	mulxU64(&x223, &x224, x3, (arg2[5]));
454	var x225: u64 = undefined;
455	var x226: u64 = undefined;
456	mulxU64(&x225, &x226, x3, (arg2[4]));
457	var x227: u64 = undefined;
458	var x228: u64 = undefined;
459	mulxU64(&x227, &x228, x3, (arg2[3]));
460	var x229: u64 = undefined;
461	var x230: u64 = undefined;
462	mulxU64(&x229, &x230, x3, (arg2[2]));
463	var x231: u64 = undefined;
464	var x232: u64 = undefined;
465	mulxU64(&x231, &x232, x3, (arg2[1]));
466	var x233: u64 = undefined;
467	var x234: u64 = undefined;
468	mulxU64(&x233, &x234, x3, (arg2[0]));
469	var x235: u64 = undefined;
470	var x236: u1 = undefined;
471	addcarryxU64(&x235, &x236, 0x0, x234, x231);
472	var x237: u64 = undefined;
473	var x238: u1 = undefined;
474	addcarryxU64(&x237, &x238, x236, x232, x229);
475	var x239: u64 = undefined;
476	var x240: u1 = undefined;
477	addcarryxU64(&x239, &x240, x238, x230, x227);
478	var x241: u64 = undefined;
479	var x242: u1 = undefined;
480	addcarryxU64(&x241, &x242, x240, x228, x225);
481	var x243: u64 = undefined;
482	var x244: u1 = undefined;
483	addcarryxU64(&x243, &x244, x242, x226, x223);
484	const x245 = (@as(u64, x244) + x224);
485	var x246: u64 = undefined;
486	var x247: u1 = undefined;
487	addcarryxU64(&x246, &x247, 0x0, x210, x233);
488	var x248: u64 = undefined;
489	var x249: u1 = undefined;
490	addcarryxU64(&x248, &x249, x247, x212, x235);
491	var x250: u64 = undefined;
492	var x251: u1 = undefined;
493	addcarryxU64(&x250, &x251, x249, x214, x237);
494	var x252: u64 = undefined;
495	var x253: u1 = undefined;
496	addcarryxU64(&x252, &x253, x251, x216, x239);
497	var x254: u64 = undefined;
498	var x255: u1 = undefined;
499	addcarryxU64(&x254, &x255, x253, x218, x241);
500	var x256: u64 = undefined;
501	var x257: u1 = undefined;
502	addcarryxU64(&x256, &x257, x255, x220, x243);
503	var x258: u64 = undefined;
504	var x259: u1 = undefined;
505	addcarryxU64(&x258, &x259, x257, x222, x245);
506	var x260: u64 = undefined;
507	var x261: u64 = undefined;
508	mulxU64(&x260, &x261, x246, 0x100000001);
509	var x262: u64 = undefined;
510	var x263: u64 = undefined;
511	mulxU64(&x262, &x263, x260, 0xffffffffffffffff);
512	var x264: u64 = undefined;
513	var x265: u64 = undefined;
514	mulxU64(&x264, &x265, x260, 0xffffffffffffffff);
515	var x266: u64 = undefined;
516	var x267: u64 = undefined;
517	mulxU64(&x266, &x267, x260, 0xffffffffffffffff);
518	var x268: u64 = undefined;
519	var x269: u64 = undefined;
520	mulxU64(&x268, &x269, x260, 0xfffffffffffffffe);
521	var x270: u64 = undefined;
522	var x271: u64 = undefined;
523	mulxU64(&x270, &x271, x260, 0xffffffff00000000);
524	var x272: u64 = undefined;
525	var x273: u64 = undefined;
526	mulxU64(&x272, &x273, x260, 0xffffffff);
527	var x274: u64 = undefined;
528	var x275: u1 = undefined;
529	addcarryxU64(&x274, &x275, 0x0, x273, x270);
530	var x276: u64 = undefined;
531	var x277: u1 = undefined;
532	addcarryxU64(&x276, &x277, x275, x271, x268);
533	var x278: u64 = undefined;
534	var x279: u1 = undefined;
535	addcarryxU64(&x278, &x279, x277, x269, x266);
536	var x280: u64 = undefined;
537	var x281: u1 = undefined;
538	addcarryxU64(&x280, &x281, x279, x267, x264);
539	var x282: u64 = undefined;
540	var x283: u1 = undefined;
541	addcarryxU64(&x282, &x283, x281, x265, x262);
542	const x284 = (@as(u64, x283) + x263);
543	var x285: u64 = undefined;
544	var x286: u1 = undefined;
545	addcarryxU64(&x285, &x286, 0x0, x246, x272);
546	var x287: u64 = undefined;
547	var x288: u1 = undefined;
548	addcarryxU64(&x287, &x288, x286, x248, x274);
549	var x289: u64 = undefined;
550	var x290: u1 = undefined;
551	addcarryxU64(&x289, &x290, x288, x250, x276);
552	var x291: u64 = undefined;
553	var x292: u1 = undefined;
554	addcarryxU64(&x291, &x292, x290, x252, x278);
555	var x293: u64 = undefined;
556	var x294: u1 = undefined;
557	addcarryxU64(&x293, &x294, x292, x254, x280);
558	var x295: u64 = undefined;
559	var x296: u1 = undefined;
560	addcarryxU64(&x295, &x296, x294, x256, x282);
561	var x297: u64 = undefined;
562	var x298: u1 = undefined;
563	addcarryxU64(&x297, &x298, x296, x258, x284);
564	const x299 = (@as(u64, x298) + @as(u64, x259));
565	var x300: u64 = undefined;
566	var x301: u64 = undefined;
567	mulxU64(&x300, &x301, x4, (arg2[5]));
568	var x302: u64 = undefined;
569	var x303: u64 = undefined;
570	mulxU64(&x302, &x303, x4, (arg2[4]));
571	var x304: u64 = undefined;
572	var x305: u64 = undefined;
573	mulxU64(&x304, &x305, x4, (arg2[3]));
574	var x306: u64 = undefined;
575	var x307: u64 = undefined;
576	mulxU64(&x306, &x307, x4, (arg2[2]));
577	var x308: u64 = undefined;
578	var x309: u64 = undefined;
579	mulxU64(&x308, &x309, x4, (arg2[1]));
580	var x310: u64 = undefined;
581	var x311: u64 = undefined;
582	mulxU64(&x310, &x311, x4, (arg2[0]));
583	var x312: u64 = undefined;
584	var x313: u1 = undefined;
585	addcarryxU64(&x312, &x313, 0x0, x311, x308);
586	var x314: u64 = undefined;
587	var x315: u1 = undefined;
588	addcarryxU64(&x314, &x315, x313, x309, x306);
589	var x316: u64 = undefined;
590	var x317: u1 = undefined;
591	addcarryxU64(&x316, &x317, x315, x307, x304);
592	var x318: u64 = undefined;
593	var x319: u1 = undefined;
594	addcarryxU64(&x318, &x319, x317, x305, x302);
595	var x320: u64 = undefined;
596	var x321: u1 = undefined;
597	addcarryxU64(&x320, &x321, x319, x303, x300);
598	const x322 = (@as(u64, x321) + x301);
599	var x323: u64 = undefined;
600	var x324: u1 = undefined;
601	addcarryxU64(&x323, &x324, 0x0, x287, x310);
602	var x325: u64 = undefined;
603	var x326: u1 = undefined;
604	addcarryxU64(&x325, &x326, x324, x289, x312);
605	var x327: u64 = undefined;
606	var x328: u1 = undefined;
607	addcarryxU64(&x327, &x328, x326, x291, x314);
608	var x329: u64 = undefined;
609	var x330: u1 = undefined;
610	addcarryxU64(&x329, &x330, x328, x293, x316);
611	var x331: u64 = undefined;
612	var x332: u1 = undefined;
613	addcarryxU64(&x331, &x332, x330, x295, x318);
614	var x333: u64 = undefined;
615	var x334: u1 = undefined;
616	addcarryxU64(&x333, &x334, x332, x297, x320);
617	var x335: u64 = undefined;
618	var x336: u1 = undefined;
619	addcarryxU64(&x335, &x336, x334, x299, x322);
620	var x337: u64 = undefined;
621	var x338: u64 = undefined;
622	mulxU64(&x337, &x338, x323, 0x100000001);
623	var x339: u64 = undefined;
624	var x340: u64 = undefined;
625	mulxU64(&x339, &x340, x337, 0xffffffffffffffff);
626	var x341: u64 = undefined;
627	var x342: u64 = undefined;
628	mulxU64(&x341, &x342, x337, 0xffffffffffffffff);
629	var x343: u64 = undefined;
630	var x344: u64 = undefined;
631	mulxU64(&x343, &x344, x337, 0xffffffffffffffff);
632	var x345: u64 = undefined;
633	var x346: u64 = undefined;
634	mulxU64(&x345, &x346, x337, 0xfffffffffffffffe);
635	var x347: u64 = undefined;
636	var x348: u64 = undefined;
637	mulxU64(&x347, &x348, x337, 0xffffffff00000000);
638	var x349: u64 = undefined;
639	var x350: u64 = undefined;
640	mulxU64(&x349, &x350, x337, 0xffffffff);
641	var x351: u64 = undefined;
642	var x352: u1 = undefined;
643	addcarryxU64(&x351, &x352, 0x0, x350, x347);
644	var x353: u64 = undefined;
645	var x354: u1 = undefined;
646	addcarryxU64(&x353, &x354, x352, x348, x345);
647	var x355: u64 = undefined;
648	var x356: u1 = undefined;
649	addcarryxU64(&x355, &x356, x354, x346, x343);
650	var x357: u64 = undefined;
651	var x358: u1 = undefined;
652	addcarryxU64(&x357, &x358, x356, x344, x341);
653	var x359: u64 = undefined;
654	var x360: u1 = undefined;
655	addcarryxU64(&x359, &x360, x358, x342, x339);
656	const x361 = (@as(u64, x360) + x340);
657	var x362: u64 = undefined;
658	var x363: u1 = undefined;
659	addcarryxU64(&x362, &x363, 0x0, x323, x349);
660	var x364: u64 = undefined;
661	var x365: u1 = undefined;
662	addcarryxU64(&x364, &x365, x363, x325, x351);
663	var x366: u64 = undefined;
664	var x367: u1 = undefined;
665	addcarryxU64(&x366, &x367, x365, x327, x353);
666	var x368: u64 = undefined;
667	var x369: u1 = undefined;
668	addcarryxU64(&x368, &x369, x367, x329, x355);
669	var x370: u64 = undefined;
670	var x371: u1 = undefined;
671	addcarryxU64(&x370, &x371, x369, x331, x357);
672	var x372: u64 = undefined;
673	var x373: u1 = undefined;
674	addcarryxU64(&x372, &x373, x371, x333, x359);
675	var x374: u64 = undefined;
676	var x375: u1 = undefined;
677	addcarryxU64(&x374, &x375, x373, x335, x361);
678	const x376 = (@as(u64, x375) + @as(u64, x336));
679	var x377: u64 = undefined;
680	var x378: u64 = undefined;
681	mulxU64(&x377, &x378, x5, (arg2[5]));
682	var x379: u64 = undefined;
683	var x380: u64 = undefined;
684	mulxU64(&x379, &x380, x5, (arg2[4]));
685	var x381: u64 = undefined;
686	var x382: u64 = undefined;
687	mulxU64(&x381, &x382, x5, (arg2[3]));
688	var x383: u64 = undefined;
689	var x384: u64 = undefined;
690	mulxU64(&x383, &x384, x5, (arg2[2]));
691	var x385: u64 = undefined;
692	var x386: u64 = undefined;
693	mulxU64(&x385, &x386, x5, (arg2[1]));
694	var x387: u64 = undefined;
695	var x388: u64 = undefined;
696	mulxU64(&x387, &x388, x5, (arg2[0]));
697	var x389: u64 = undefined;
698	var x390: u1 = undefined;
699	addcarryxU64(&x389, &x390, 0x0, x388, x385);
700	var x391: u64 = undefined;
701	var x392: u1 = undefined;
702	addcarryxU64(&x391, &x392, x390, x386, x383);
703	var x393: u64 = undefined;
704	var x394: u1 = undefined;
705	addcarryxU64(&x393, &x394, x392, x384, x381);
706	var x395: u64 = undefined;
707	var x396: u1 = undefined;
708	addcarryxU64(&x395, &x396, x394, x382, x379);
709	var x397: u64 = undefined;
710	var x398: u1 = undefined;
711	addcarryxU64(&x397, &x398, x396, x380, x377);
712	const x399 = (@as(u64, x398) + x378);
713	var x400: u64 = undefined;
714	var x401: u1 = undefined;
715	addcarryxU64(&x400, &x401, 0x0, x364, x387);
716	var x402: u64 = undefined;
717	var x403: u1 = undefined;
718	addcarryxU64(&x402, &x403, x401, x366, x389);
719	var x404: u64 = undefined;
720	var x405: u1 = undefined;
721	addcarryxU64(&x404, &x405, x403, x368, x391);
722	var x406: u64 = undefined;
723	var x407: u1 = undefined;
724	addcarryxU64(&x406, &x407, x405, x370, x393);
725	var x408: u64 = undefined;
726	var x409: u1 = undefined;
727	addcarryxU64(&x408, &x409, x407, x372, x395);
728	var x410: u64 = undefined;
729	var x411: u1 = undefined;
730	addcarryxU64(&x410, &x411, x409, x374, x397);
731	var x412: u64 = undefined;
732	var x413: u1 = undefined;
733	addcarryxU64(&x412, &x413, x411, x376, x399);
734	var x414: u64 = undefined;
735	var x415: u64 = undefined;
736	mulxU64(&x414, &x415, x400, 0x100000001);
737	var x416: u64 = undefined;
738	var x417: u64 = undefined;
739	mulxU64(&x416, &x417, x414, 0xffffffffffffffff);
740	var x418: u64 = undefined;
741	var x419: u64 = undefined;
742	mulxU64(&x418, &x419, x414, 0xffffffffffffffff);
743	var x420: u64 = undefined;
744	var x421: u64 = undefined;
745	mulxU64(&x420, &x421, x414, 0xffffffffffffffff);
746	var x422: u64 = undefined;
747	var x423: u64 = undefined;
748	mulxU64(&x422, &x423, x414, 0xfffffffffffffffe);
749	var x424: u64 = undefined;
750	var x425: u64 = undefined;
751	mulxU64(&x424, &x425, x414, 0xffffffff00000000);
752	var x426: u64 = undefined;
753	var x427: u64 = undefined;
754	mulxU64(&x426, &x427, x414, 0xffffffff);
755	var x428: u64 = undefined;
756	var x429: u1 = undefined;
757	addcarryxU64(&x428, &x429, 0x0, x427, x424);
758	var x430: u64 = undefined;
759	var x431: u1 = undefined;
760	addcarryxU64(&x430, &x431, x429, x425, x422);
761	var x432: u64 = undefined;
762	var x433: u1 = undefined;
763	addcarryxU64(&x432, &x433, x431, x423, x420);
764	var x434: u64 = undefined;
765	var x435: u1 = undefined;
766	addcarryxU64(&x434, &x435, x433, x421, x418);
767	var x436: u64 = undefined;
768	var x437: u1 = undefined;
769	addcarryxU64(&x436, &x437, x435, x419, x416);
770	const x438 = (@as(u64, x437) + x417);
771	var x439: u64 = undefined;
772	var x440: u1 = undefined;
773	addcarryxU64(&x439, &x440, 0x0, x400, x426);
774	var x441: u64 = undefined;
775	var x442: u1 = undefined;
776	addcarryxU64(&x441, &x442, x440, x402, x428);
777	var x443: u64 = undefined;
778	var x444: u1 = undefined;
779	addcarryxU64(&x443, &x444, x442, x404, x430);
780	var x445: u64 = undefined;
781	var x446: u1 = undefined;
782	addcarryxU64(&x445, &x446, x444, x406, x432);
783	var x447: u64 = undefined;
784	var x448: u1 = undefined;
785	addcarryxU64(&x447, &x448, x446, x408, x434);
786	var x449: u64 = undefined;
787	var x450: u1 = undefined;
788	addcarryxU64(&x449, &x450, x448, x410, x436);
789	var x451: u64 = undefined;
790	var x452: u1 = undefined;
791	addcarryxU64(&x451, &x452, x450, x412, x438);
792	const x453 = (@as(u64, x452) + @as(u64, x413));
793	var x454: u64 = undefined;
794	var x455: u1 = undefined;
795	subborrowxU64(&x454, &x455, 0x0, x441, 0xffffffff);
796	var x456: u64 = undefined;
797	var x457: u1 = undefined;
798	subborrowxU64(&x456, &x457, x455, x443, 0xffffffff00000000);
799	var x458: u64 = undefined;
800	var x459: u1 = undefined;
801	subborrowxU64(&x458, &x459, x457, x445, 0xfffffffffffffffe);
802	var x460: u64 = undefined;
803	var x461: u1 = undefined;
804	subborrowxU64(&x460, &x461, x459, x447, 0xffffffffffffffff);
805	var x462: u64 = undefined;
806	var x463: u1 = undefined;
807	subborrowxU64(&x462, &x463, x461, x449, 0xffffffffffffffff);
808	var x464: u64 = undefined;
809	var x465: u1 = undefined;
810	subborrowxU64(&x464, &x465, x463, x451, 0xffffffffffffffff);
811	var x466: u64 = undefined;
812	var x467: u1 = undefined;
813	subborrowxU64(&x466, &x467, x465, x453, 0x0);
814	var x468: u64 = undefined;
815	cmovznzU64(&x468, x467, x454, x441);
816	var x469: u64 = undefined;
817	cmovznzU64(&x469, x467, x456, x443);
818	var x470: u64 = undefined;
819	cmovznzU64(&x470, x467, x458, x445);
820	var x471: u64 = undefined;
821	cmovznzU64(&x471, x467, x460, x447);
822	var x472: u64 = undefined;
823	cmovznzU64(&x472, x467, x462, x449);
824	var x473: u64 = undefined;
825	cmovznzU64(&x473, x467, x464, x451);
826	out1[0] = x468;
827	out1[1] = x469;
828	out1[2] = x470;
829	out1[3] = x471;
830	out1[4] = x472;
831	out1[5] = x473;
832	}
833
834	/// The function square squares a field element in the Montgomery domain.
835	///
836	/// Preconditions:
837	/// 0 ≤ eval arg1 < m
838	/// Postconditions:
839	/// eval (from_montgomery out1) mod m = (eval (from_montgomery arg1) * eval (from_montgomery arg1)) mod m
840	/// 0 ≤ eval out1 < m
841	///
842	pub fn square(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldElement) void {
843	@setRuntimeSafety(mode == .Debug);
844
845	const x1 = (arg1[1]);
846	const x2 = (arg1[2]);
847	const x3 = (arg1[3]);
848	const x4 = (arg1[4]);
849	const x5 = (arg1[5]);
850	const x6 = (arg1[0]);
851	var x7: u64 = undefined;
852	var x8: u64 = undefined;
853	mulxU64(&x7, &x8, x6, (arg1[5]));
854	var x9: u64 = undefined;
855	var x10: u64 = undefined;
856	mulxU64(&x9, &x10, x6, (arg1[4]));
857	var x11: u64 = undefined;
858	var x12: u64 = undefined;
859	mulxU64(&x11, &x12, x6, (arg1[3]));
860	var x13: u64 = undefined;
861	var x14: u64 = undefined;
862	mulxU64(&x13, &x14, x6, (arg1[2]));
863	var x15: u64 = undefined;
864	var x16: u64 = undefined;
865	mulxU64(&x15, &x16, x6, (arg1[1]));
866	var x17: u64 = undefined;
867	var x18: u64 = undefined;
868	mulxU64(&x17, &x18, x6, (arg1[0]));
869	var x19: u64 = undefined;
870	var x20: u1 = undefined;
871	addcarryxU64(&x19, &x20, 0x0, x18, x15);
872	var x21: u64 = undefined;
873	var x22: u1 = undefined;
874	addcarryxU64(&x21, &x22, x20, x16, x13);
875	var x23: u64 = undefined;
876	var x24: u1 = undefined;
877	addcarryxU64(&x23, &x24, x22, x14, x11);
878	var x25: u64 = undefined;
879	var x26: u1 = undefined;
880	addcarryxU64(&x25, &x26, x24, x12, x9);
881	var x27: u64 = undefined;
882	var x28: u1 = undefined;
883	addcarryxU64(&x27, &x28, x26, x10, x7);
884	const x29 = (@as(u64, x28) + x8);
885	var x30: u64 = undefined;
886	var x31: u64 = undefined;
887	mulxU64(&x30, &x31, x17, 0x100000001);
888	var x32: u64 = undefined;
889	var x33: u64 = undefined;
890	mulxU64(&x32, &x33, x30, 0xffffffffffffffff);
891	var x34: u64 = undefined;
892	var x35: u64 = undefined;
893	mulxU64(&x34, &x35, x30, 0xffffffffffffffff);
894	var x36: u64 = undefined;
895	var x37: u64 = undefined;
896	mulxU64(&x36, &x37, x30, 0xffffffffffffffff);
897	var x38: u64 = undefined;
898	var x39: u64 = undefined;
899	mulxU64(&x38, &x39, x30, 0xfffffffffffffffe);
900	var x40: u64 = undefined;
901	var x41: u64 = undefined;
902	mulxU64(&x40, &x41, x30, 0xffffffff00000000);
903	var x42: u64 = undefined;
904	var x43: u64 = undefined;
905	mulxU64(&x42, &x43, x30, 0xffffffff);
906	var x44: u64 = undefined;
907	var x45: u1 = undefined;
908	addcarryxU64(&x44, &x45, 0x0, x43, x40);
909	var x46: u64 = undefined;
910	var x47: u1 = undefined;
911	addcarryxU64(&x46, &x47, x45, x41, x38);
912	var x48: u64 = undefined;
913	var x49: u1 = undefined;
914	addcarryxU64(&x48, &x49, x47, x39, x36);
915	var x50: u64 = undefined;
916	var x51: u1 = undefined;
917	addcarryxU64(&x50, &x51, x49, x37, x34);
918	var x52: u64 = undefined;
919	var x53: u1 = undefined;
920	addcarryxU64(&x52, &x53, x51, x35, x32);
921	const x54 = (@as(u64, x53) + x33);
922	var x55: u64 = undefined;
923	var x56: u1 = undefined;
924	addcarryxU64(&x55, &x56, 0x0, x17, x42);
925	var x57: u64 = undefined;
926	var x58: u1 = undefined;
927	addcarryxU64(&x57, &x58, x56, x19, x44);
928	var x59: u64 = undefined;
929	var x60: u1 = undefined;
930	addcarryxU64(&x59, &x60, x58, x21, x46);
931	var x61: u64 = undefined;
932	var x62: u1 = undefined;
933	addcarryxU64(&x61, &x62, x60, x23, x48);
934	var x63: u64 = undefined;
935	var x64: u1 = undefined;
936	addcarryxU64(&x63, &x64, x62, x25, x50);
937	var x65: u64 = undefined;
938	var x66: u1 = undefined;
939	addcarryxU64(&x65, &x66, x64, x27, x52);
940	var x67: u64 = undefined;
941	var x68: u1 = undefined;
942	addcarryxU64(&x67, &x68, x66, x29, x54);
943	var x69: u64 = undefined;
944	var x70: u64 = undefined;
945	mulxU64(&x69, &x70, x1, (arg1[5]));
946	var x71: u64 = undefined;
947	var x72: u64 = undefined;
948	mulxU64(&x71, &x72, x1, (arg1[4]));
949	var x73: u64 = undefined;
950	var x74: u64 = undefined;
951	mulxU64(&x73, &x74, x1, (arg1[3]));
952	var x75: u64 = undefined;
953	var x76: u64 = undefined;
954	mulxU64(&x75, &x76, x1, (arg1[2]));
955	var x77: u64 = undefined;
956	var x78: u64 = undefined;
957	mulxU64(&x77, &x78, x1, (arg1[1]));
958	var x79: u64 = undefined;
959	var x80: u64 = undefined;
960	mulxU64(&x79, &x80, x1, (arg1[0]));
961	var x81: u64 = undefined;
962	var x82: u1 = undefined;
963	addcarryxU64(&x81, &x82, 0x0, x80, x77);
964	var x83: u64 = undefined;
965	var x84: u1 = undefined;
966	addcarryxU64(&x83, &x84, x82, x78, x75);
967	var x85: u64 = undefined;
968	var x86: u1 = undefined;
969	addcarryxU64(&x85, &x86, x84, x76, x73);
970	var x87: u64 = undefined;
971	var x88: u1 = undefined;
972	addcarryxU64(&x87, &x88, x86, x74, x71);
973	var x89: u64 = undefined;
974	var x90: u1 = undefined;
975	addcarryxU64(&x89, &x90, x88, x72, x69);
976	const x91 = (@as(u64, x90) + x70);
977	var x92: u64 = undefined;
978	var x93: u1 = undefined;
979	addcarryxU64(&x92, &x93, 0x0, x57, x79);
980	var x94: u64 = undefined;
981	var x95: u1 = undefined;
982	addcarryxU64(&x94, &x95, x93, x59, x81);
983	var x96: u64 = undefined;
984	var x97: u1 = undefined;
985	addcarryxU64(&x96, &x97, x95, x61, x83);
986	var x98: u64 = undefined;
987	var x99: u1 = undefined;
988	addcarryxU64(&x98, &x99, x97, x63, x85);
989	var x100: u64 = undefined;
990	var x101: u1 = undefined;
991	addcarryxU64(&x100, &x101, x99, x65, x87);
992	var x102: u64 = undefined;
993	var x103: u1 = undefined;
994	addcarryxU64(&x102, &x103, x101, x67, x89);
995	var x104: u64 = undefined;
996	var x105: u1 = undefined;
997	addcarryxU64(&x104, &x105, x103, @as(u64, x68), x91);
998	var x106: u64 = undefined;
999	var x107: u64 = undefined;
1000	mulxU64(&x106, &x107, x92, 0x100000001);
1001	var x108: u64 = undefined;
1002	var x109: u64 = undefined;
1003	mulxU64(&x108, &x109, x106, 0xffffffffffffffff);
1004	var x110: u64 = undefined;
1005	var x111: u64 = undefined;
1006	mulxU64(&x110, &x111, x106, 0xffffffffffffffff);
1007	var x112: u64 = undefined;
1008	var x113: u64 = undefined;
1009	mulxU64(&x112, &x113, x106, 0xffffffffffffffff);
1010	var x114: u64 = undefined;
1011	var x115: u64 = undefined;
1012	mulxU64(&x114, &x115, x106, 0xfffffffffffffffe);
1013	var x116: u64 = undefined;
1014	var x117: u64 = undefined;
1015	mulxU64(&x116, &x117, x106, 0xffffffff00000000);
1016	var x118: u64 = undefined;
1017	var x119: u64 = undefined;
1018	mulxU64(&x118, &x119, x106, 0xffffffff);
1019	var x120: u64 = undefined;
1020	var x121: u1 = undefined;
1021	addcarryxU64(&x120, &x121, 0x0, x119, x116);
1022	var x122: u64 = undefined;
1023	var x123: u1 = undefined;
1024	addcarryxU64(&x122, &x123, x121, x117, x114);
1025	var x124: u64 = undefined;
1026	var x125: u1 = undefined;
1027	addcarryxU64(&x124, &x125, x123, x115, x112);
1028	var x126: u64 = undefined;
1029	var x127: u1 = undefined;
1030	addcarryxU64(&x126, &x127, x125, x113, x110);
1031	var x128: u64 = undefined;
1032	var x129: u1 = undefined;
1033	addcarryxU64(&x128, &x129, x127, x111, x108);
1034	const x130 = (@as(u64, x129) + x109);
1035	var x131: u64 = undefined;
1036	var x132: u1 = undefined;
1037	addcarryxU64(&x131, &x132, 0x0, x92, x118);
1038	var x133: u64 = undefined;
1039	var x134: u1 = undefined;
1040	addcarryxU64(&x133, &x134, x132, x94, x120);
1041	var x135: u64 = undefined;
1042	var x136: u1 = undefined;
1043	addcarryxU64(&x135, &x136, x134, x96, x122);
1044	var x137: u64 = undefined;
1045	var x138: u1 = undefined;
1046	addcarryxU64(&x137, &x138, x136, x98, x124);
1047	var x139: u64 = undefined;
1048	var x140: u1 = undefined;
1049	addcarryxU64(&x139, &x140, x138, x100, x126);
1050	var x141: u64 = undefined;
1051	var x142: u1 = undefined;
1052	addcarryxU64(&x141, &x142, x140, x102, x128);
1053	var x143: u64 = undefined;
1054	var x144: u1 = undefined;
1055	addcarryxU64(&x143, &x144, x142, x104, x130);
1056	const x145 = (@as(u64, x144) + @as(u64, x105));
1057	var x146: u64 = undefined;
1058	var x147: u64 = undefined;
1059	mulxU64(&x146, &x147, x2, (arg1[5]));
1060	var x148: u64 = undefined;
1061	var x149: u64 = undefined;
1062	mulxU64(&x148, &x149, x2, (arg1[4]));
1063	var x150: u64 = undefined;
1064	var x151: u64 = undefined;
1065	mulxU64(&x150, &x151, x2, (arg1[3]));
1066	var x152: u64 = undefined;
1067	var x153: u64 = undefined;
1068	mulxU64(&x152, &x153, x2, (arg1[2]));
1069	var x154: u64 = undefined;
1070	var x155: u64 = undefined;
1071	mulxU64(&x154, &x155, x2, (arg1[1]));
1072	var x156: u64 = undefined;
1073	var x157: u64 = undefined;
1074	mulxU64(&x156, &x157, x2, (arg1[0]));
1075	var x158: u64 = undefined;
1076	var x159: u1 = undefined;
1077	addcarryxU64(&x158, &x159, 0x0, x157, x154);
1078	var x160: u64 = undefined;
1079	var x161: u1 = undefined;
1080	addcarryxU64(&x160, &x161, x159, x155, x152);
1081	var x162: u64 = undefined;
1082	var x163: u1 = undefined;
1083	addcarryxU64(&x162, &x163, x161, x153, x150);
1084	var x164: u64 = undefined;
1085	var x165: u1 = undefined;
1086	addcarryxU64(&x164, &x165, x163, x151, x148);
1087	var x166: u64 = undefined;
1088	var x167: u1 = undefined;
1089	addcarryxU64(&x166, &x167, x165, x149, x146);
1090	const x168 = (@as(u64, x167) + x147);
1091	var x169: u64 = undefined;
1092	var x170: u1 = undefined;
1093	addcarryxU64(&x169, &x170, 0x0, x133, x156);
1094	var x171: u64 = undefined;
1095	var x172: u1 = undefined;
1096	addcarryxU64(&x171, &x172, x170, x135, x158);
1097	var x173: u64 = undefined;
1098	var x174: u1 = undefined;
1099	addcarryxU64(&x173, &x174, x172, x137, x160);
1100	var x175: u64 = undefined;
1101	var x176: u1 = undefined;
1102	addcarryxU64(&x175, &x176, x174, x139, x162);
1103	var x177: u64 = undefined;
1104	var x178: u1 = undefined;
1105	addcarryxU64(&x177, &x178, x176, x141, x164);
1106	var x179: u64 = undefined;
1107	var x180: u1 = undefined;
1108	addcarryxU64(&x179, &x180, x178, x143, x166);
1109	var x181: u64 = undefined;
1110	var x182: u1 = undefined;
1111	addcarryxU64(&x181, &x182, x180, x145, x168);
1112	var x183: u64 = undefined;
1113	var x184: u64 = undefined;
1114	mulxU64(&x183, &x184, x169, 0x100000001);
1115	var x185: u64 = undefined;
1116	var x186: u64 = undefined;
1117	mulxU64(&x185, &x186, x183, 0xffffffffffffffff);
1118	var x187: u64 = undefined;
1119	var x188: u64 = undefined;
1120	mulxU64(&x187, &x188, x183, 0xffffffffffffffff);
1121	var x189: u64 = undefined;
1122	var x190: u64 = undefined;
1123	mulxU64(&x189, &x190, x183, 0xffffffffffffffff);
1124	var x191: u64 = undefined;
1125	var x192: u64 = undefined;
1126	mulxU64(&x191, &x192, x183, 0xfffffffffffffffe);
1127	var x193: u64 = undefined;
1128	var x194: u64 = undefined;
1129	mulxU64(&x193, &x194, x183, 0xffffffff00000000);
1130	var x195: u64 = undefined;
1131	var x196: u64 = undefined;
1132	mulxU64(&x195, &x196, x183, 0xffffffff);
1133	var x197: u64 = undefined;
1134	var x198: u1 = undefined;
1135	addcarryxU64(&x197, &x198, 0x0, x196, x193);
1136	var x199: u64 = undefined;
1137	var x200: u1 = undefined;
1138	addcarryxU64(&x199, &x200, x198, x194, x191);
1139	var x201: u64 = undefined;
1140	var x202: u1 = undefined;
1141	addcarryxU64(&x201, &x202, x200, x192, x189);
1142	var x203: u64 = undefined;
1143	var x204: u1 = undefined;
1144	addcarryxU64(&x203, &x204, x202, x190, x187);
1145	var x205: u64 = undefined;
1146	var x206: u1 = undefined;
1147	addcarryxU64(&x205, &x206, x204, x188, x185);
1148	const x207 = (@as(u64, x206) + x186);
1149	var x208: u64 = undefined;
1150	var x209: u1 = undefined;
1151	addcarryxU64(&x208, &x209, 0x0, x169, x195);
1152	var x210: u64 = undefined;
1153	var x211: u1 = undefined;
1154	addcarryxU64(&x210, &x211, x209, x171, x197);
1155	var x212: u64 = undefined;
1156	var x213: u1 = undefined;
1157	addcarryxU64(&x212, &x213, x211, x173, x199);
1158	var x214: u64 = undefined;
1159	var x215: u1 = undefined;
1160	addcarryxU64(&x214, &x215, x213, x175, x201);
1161	var x216: u64 = undefined;
1162	var x217: u1 = undefined;
1163	addcarryxU64(&x216, &x217, x215, x177, x203);
1164	var x218: u64 = undefined;
1165	var x219: u1 = undefined;
1166	addcarryxU64(&x218, &x219, x217, x179, x205);
1167	var x220: u64 = undefined;
1168	var x221: u1 = undefined;
1169	addcarryxU64(&x220, &x221, x219, x181, x207);
1170	const x222 = (@as(u64, x221) + @as(u64, x182));
1171	var x223: u64 = undefined;
1172	var x224: u64 = undefined;
1173	mulxU64(&x223, &x224, x3, (arg1[5]));
1174	var x225: u64 = undefined;
1175	var x226: u64 = undefined;
1176	mulxU64(&x225, &x226, x3, (arg1[4]));
1177	var x227: u64 = undefined;
1178	var x228: u64 = undefined;
1179	mulxU64(&x227, &x228, x3, (arg1[3]));
1180	var x229: u64 = undefined;
1181	var x230: u64 = undefined;
1182	mulxU64(&x229, &x230, x3, (arg1[2]));
1183	var x231: u64 = undefined;
1184	var x232: u64 = undefined;
1185	mulxU64(&x231, &x232, x3, (arg1[1]));
1186	var x233: u64 = undefined;
1187	var x234: u64 = undefined;
1188	mulxU64(&x233, &x234, x3, (arg1[0]));
1189	var x235: u64 = undefined;
1190	var x236: u1 = undefined;
1191	addcarryxU64(&x235, &x236, 0x0, x234, x231);
1192	var x237: u64 = undefined;
1193	var x238: u1 = undefined;
1194	addcarryxU64(&x237, &x238, x236, x232, x229);
1195	var x239: u64 = undefined;
1196	var x240: u1 = undefined;
1197	addcarryxU64(&x239, &x240, x238, x230, x227);
1198	var x241: u64 = undefined;
1199	var x242: u1 = undefined;
1200	addcarryxU64(&x241, &x242, x240, x228, x225);
1201	var x243: u64 = undefined;
1202	var x244: u1 = undefined;
1203	addcarryxU64(&x243, &x244, x242, x226, x223);
1204	const x245 = (@as(u64, x244) + x224);
1205	var x246: u64 = undefined;
1206	var x247: u1 = undefined;
1207	addcarryxU64(&x246, &x247, 0x0, x210, x233);
1208	var x248: u64 = undefined;
1209	var x249: u1 = undefined;
1210	addcarryxU64(&x248, &x249, x247, x212, x235);
1211	var x250: u64 = undefined;
1212	var x251: u1 = undefined;
1213	addcarryxU64(&x250, &x251, x249, x214, x237);
1214	var x252: u64 = undefined;
1215	var x253: u1 = undefined;
1216	addcarryxU64(&x252, &x253, x251, x216, x239);
1217	var x254: u64 = undefined;
1218	var x255: u1 = undefined;
1219	addcarryxU64(&x254, &x255, x253, x218, x241);
1220	var x256: u64 = undefined;
1221	var x257: u1 = undefined;
1222	addcarryxU64(&x256, &x257, x255, x220, x243);
1223	var x258: u64 = undefined;
1224	var x259: u1 = undefined;
1225	addcarryxU64(&x258, &x259, x257, x222, x245);
1226	var x260: u64 = undefined;
1227	var x261: u64 = undefined;
1228	mulxU64(&x260, &x261, x246, 0x100000001);
1229	var x262: u64 = undefined;
1230	var x263: u64 = undefined;
1231	mulxU64(&x262, &x263, x260, 0xffffffffffffffff);
1232	var x264: u64 = undefined;
1233	var x265: u64 = undefined;
1234	mulxU64(&x264, &x265, x260, 0xffffffffffffffff);
1235	var x266: u64 = undefined;
1236	var x267: u64 = undefined;
1237	mulxU64(&x266, &x267, x260, 0xffffffffffffffff);
1238	var x268: u64 = undefined;
1239	var x269: u64 = undefined;
1240	mulxU64(&x268, &x269, x260, 0xfffffffffffffffe);
1241	var x270: u64 = undefined;
1242	var x271: u64 = undefined;
1243	mulxU64(&x270, &x271, x260, 0xffffffff00000000);
1244	var x272: u64 = undefined;
1245	var x273: u64 = undefined;
1246	mulxU64(&x272, &x273, x260, 0xffffffff);
1247	var x274: u64 = undefined;
1248	var x275: u1 = undefined;
1249	addcarryxU64(&x274, &x275, 0x0, x273, x270);
1250	var x276: u64 = undefined;
1251	var x277: u1 = undefined;
1252	addcarryxU64(&x276, &x277, x275, x271, x268);
1253	var x278: u64 = undefined;
1254	var x279: u1 = undefined;
1255	addcarryxU64(&x278, &x279, x277, x269, x266);
1256	var x280: u64 = undefined;
1257	var x281: u1 = undefined;
1258	addcarryxU64(&x280, &x281, x279, x267, x264);
1259	var x282: u64 = undefined;
1260	var x283: u1 = undefined;
1261	addcarryxU64(&x282, &x283, x281, x265, x262);
1262	const x284 = (@as(u64, x283) + x263);
1263	var x285: u64 = undefined;
1264	var x286: u1 = undefined;
1265	addcarryxU64(&x285, &x286, 0x0, x246, x272);
1266	var x287: u64 = undefined;
1267	var x288: u1 = undefined;
1268	addcarryxU64(&x287, &x288, x286, x248, x274);
1269	var x289: u64 = undefined;
1270	var x290: u1 = undefined;
1271	addcarryxU64(&x289, &x290, x288, x250, x276);
1272	var x291: u64 = undefined;
1273	var x292: u1 = undefined;
1274	addcarryxU64(&x291, &x292, x290, x252, x278);
1275	var x293: u64 = undefined;
1276	var x294: u1 = undefined;
1277	addcarryxU64(&x293, &x294, x292, x254, x280);
1278	var x295: u64 = undefined;
1279	var x296: u1 = undefined;
1280	addcarryxU64(&x295, &x296, x294, x256, x282);
1281	var x297: u64 = undefined;
1282	var x298: u1 = undefined;
1283	addcarryxU64(&x297, &x298, x296, x258, x284);
1284	const x299 = (@as(u64, x298) + @as(u64, x259));
1285	var x300: u64 = undefined;
1286	var x301: u64 = undefined;
1287	mulxU64(&x300, &x301, x4, (arg1[5]));
1288	var x302: u64 = undefined;
1289	var x303: u64 = undefined;
1290	mulxU64(&x302, &x303, x4, (arg1[4]));
1291	var x304: u64 = undefined;
1292	var x305: u64 = undefined;
1293	mulxU64(&x304, &x305, x4, (arg1[3]));
1294	var x306: u64 = undefined;
1295	var x307: u64 = undefined;
1296	mulxU64(&x306, &x307, x4, (arg1[2]));
1297	var x308: u64 = undefined;
1298	var x309: u64 = undefined;
1299	mulxU64(&x308, &x309, x4, (arg1[1]));
1300	var x310: u64 = undefined;
1301	var x311: u64 = undefined;
1302	mulxU64(&x310, &x311, x4, (arg1[0]));
1303	var x312: u64 = undefined;
1304	var x313: u1 = undefined;
1305	addcarryxU64(&x312, &x313, 0x0, x311, x308);
1306	var x314: u64 = undefined;
1307	var x315: u1 = undefined;
1308	addcarryxU64(&x314, &x315, x313, x309, x306);
1309	var x316: u64 = undefined;
1310	var x317: u1 = undefined;
1311	addcarryxU64(&x316, &x317, x315, x307, x304);
1312	var x318: u64 = undefined;
1313	var x319: u1 = undefined;
1314	addcarryxU64(&x318, &x319, x317, x305, x302);
1315	var x320: u64 = undefined;
1316	var x321: u1 = undefined;
1317	addcarryxU64(&x320, &x321, x319, x303, x300);
1318	const x322 = (@as(u64, x321) + x301);
1319	var x323: u64 = undefined;
1320	var x324: u1 = undefined;
1321	addcarryxU64(&x323, &x324, 0x0, x287, x310);
1322	var x325: u64 = undefined;
1323	var x326: u1 = undefined;
1324	addcarryxU64(&x325, &x326, x324, x289, x312);
1325	var x327: u64 = undefined;
1326	var x328: u1 = undefined;
1327	addcarryxU64(&x327, &x328, x326, x291, x314);
1328	var x329: u64 = undefined;
1329	var x330: u1 = undefined;
1330	addcarryxU64(&x329, &x330, x328, x293, x316);
1331	var x331: u64 = undefined;
1332	var x332: u1 = undefined;
1333	addcarryxU64(&x331, &x332, x330, x295, x318);
1334	var x333: u64 = undefined;
1335	var x334: u1 = undefined;
1336	addcarryxU64(&x333, &x334, x332, x297, x320);
1337	var x335: u64 = undefined;
1338	var x336: u1 = undefined;
1339	addcarryxU64(&x335, &x336, x334, x299, x322);
1340	var x337: u64 = undefined;
1341	var x338: u64 = undefined;
1342	mulxU64(&x337, &x338, x323, 0x100000001);
1343	var x339: u64 = undefined;
1344	var x340: u64 = undefined;
1345	mulxU64(&x339, &x340, x337, 0xffffffffffffffff);
1346	var x341: u64 = undefined;
1347	var x342: u64 = undefined;
1348	mulxU64(&x341, &x342, x337, 0xffffffffffffffff);
1349	var x343: u64 = undefined;
1350	var x344: u64 = undefined;
1351	mulxU64(&x343, &x344, x337, 0xffffffffffffffff);
1352	var x345: u64 = undefined;
1353	var x346: u64 = undefined;
1354	mulxU64(&x345, &x346, x337, 0xfffffffffffffffe);
1355	var x347: u64 = undefined;
1356	var x348: u64 = undefined;
1357	mulxU64(&x347, &x348, x337, 0xffffffff00000000);
1358	var x349: u64 = undefined;
1359	var x350: u64 = undefined;
1360	mulxU64(&x349, &x350, x337, 0xffffffff);
1361	var x351: u64 = undefined;
1362	var x352: u1 = undefined;
1363	addcarryxU64(&x351, &x352, 0x0, x350, x347);
1364	var x353: u64 = undefined;
1365	var x354: u1 = undefined;
1366	addcarryxU64(&x353, &x354, x352, x348, x345);
1367	var x355: u64 = undefined;
1368	var x356: u1 = undefined;
1369	addcarryxU64(&x355, &x356, x354, x346, x343);
1370	var x357: u64 = undefined;
1371	var x358: u1 = undefined;
1372	addcarryxU64(&x357, &x358, x356, x344, x341);
1373	var x359: u64 = undefined;
1374	var x360: u1 = undefined;
1375	addcarryxU64(&x359, &x360, x358, x342, x339);
1376	const x361 = (@as(u64, x360) + x340);
1377	var x362: u64 = undefined;
1378	var x363: u1 = undefined;
1379	addcarryxU64(&x362, &x363, 0x0, x323, x349);
1380	var x364: u64 = undefined;
1381	var x365: u1 = undefined;
1382	addcarryxU64(&x364, &x365, x363, x325, x351);
1383	var x366: u64 = undefined;
1384	var x367: u1 = undefined;
1385	addcarryxU64(&x366, &x367, x365, x327, x353);
1386	var x368: u64 = undefined;
1387	var x369: u1 = undefined;
1388	addcarryxU64(&x368, &x369, x367, x329, x355);
1389	var x370: u64 = undefined;
1390	var x371: u1 = undefined;
1391	addcarryxU64(&x370, &x371, x369, x331, x357);
1392	var x372: u64 = undefined;
1393	var x373: u1 = undefined;
1394	addcarryxU64(&x372, &x373, x371, x333, x359);
1395	var x374: u64 = undefined;
1396	var x375: u1 = undefined;
1397	addcarryxU64(&x374, &x375, x373, x335, x361);
1398	const x376 = (@as(u64, x375) + @as(u64, x336));
1399	var x377: u64 = undefined;
1400	var x378: u64 = undefined;
1401	mulxU64(&x377, &x378, x5, (arg1[5]));
1402	var x379: u64 = undefined;
1403	var x380: u64 = undefined;
1404	mulxU64(&x379, &x380, x5, (arg1[4]));
1405	var x381: u64 = undefined;
1406	var x382: u64 = undefined;
1407	mulxU64(&x381, &x382, x5, (arg1[3]));
1408	var x383: u64 = undefined;
1409	var x384: u64 = undefined;
1410	mulxU64(&x383, &x384, x5, (arg1[2]));
1411	var x385: u64 = undefined;
1412	var x386: u64 = undefined;
1413	mulxU64(&x385, &x386, x5, (arg1[1]));
1414	var x387: u64 = undefined;
1415	var x388: u64 = undefined;
1416	mulxU64(&x387, &x388, x5, (arg1[0]));
1417	var x389: u64 = undefined;
1418	var x390: u1 = undefined;
1419	addcarryxU64(&x389, &x390, 0x0, x388, x385);
1420	var x391: u64 = undefined;
1421	var x392: u1 = undefined;
1422	addcarryxU64(&x391, &x392, x390, x386, x383);
1423	var x393: u64 = undefined;
1424	var x394: u1 = undefined;
1425	addcarryxU64(&x393, &x394, x392, x384, x381);
1426	var x395: u64 = undefined;
1427	var x396: u1 = undefined;
1428	addcarryxU64(&x395, &x396, x394, x382, x379);
1429	var x397: u64 = undefined;
1430	var x398: u1 = undefined;
1431	addcarryxU64(&x397, &x398, x396, x380, x377);
1432	const x399 = (@as(u64, x398) + x378);
1433	var x400: u64 = undefined;
1434	var x401: u1 = undefined;
1435	addcarryxU64(&x400, &x401, 0x0, x364, x387);
1436	var x402: u64 = undefined;
1437	var x403: u1 = undefined;
1438	addcarryxU64(&x402, &x403, x401, x366, x389);
1439	var x404: u64 = undefined;
1440	var x405: u1 = undefined;
1441	addcarryxU64(&x404, &x405, x403, x368, x391);
1442	var x406: u64 = undefined;
1443	var x407: u1 = undefined;
1444	addcarryxU64(&x406, &x407, x405, x370, x393);
1445	var x408: u64 = undefined;
1446	var x409: u1 = undefined;
1447	addcarryxU64(&x408, &x409, x407, x372, x395);
1448	var x410: u64 = undefined;
1449	var x411: u1 = undefined;
1450	addcarryxU64(&x410, &x411, x409, x374, x397);
1451	var x412: u64 = undefined;
1452	var x413: u1 = undefined;
1453	addcarryxU64(&x412, &x413, x411, x376, x399);
1454	var x414: u64 = undefined;
1455	var x415: u64 = undefined;
1456	mulxU64(&x414, &x415, x400, 0x100000001);
1457	var x416: u64 = undefined;
1458	var x417: u64 = undefined;
1459	mulxU64(&x416, &x417, x414, 0xffffffffffffffff);
1460	var x418: u64 = undefined;
1461	var x419: u64 = undefined;
1462	mulxU64(&x418, &x419, x414, 0xffffffffffffffff);
1463	var x420: u64 = undefined;
1464	var x421: u64 = undefined;
1465	mulxU64(&x420, &x421, x414, 0xffffffffffffffff);
1466	var x422: u64 = undefined;
1467	var x423: u64 = undefined;
1468	mulxU64(&x422, &x423, x414, 0xfffffffffffffffe);
1469	var x424: u64 = undefined;
1470	var x425: u64 = undefined;
1471	mulxU64(&x424, &x425, x414, 0xffffffff00000000);
1472	var x426: u64 = undefined;
1473	var x427: u64 = undefined;
1474	mulxU64(&x426, &x427, x414, 0xffffffff);
1475	var x428: u64 = undefined;
1476	var x429: u1 = undefined;
1477	addcarryxU64(&x428, &x429, 0x0, x427, x424);
1478	var x430: u64 = undefined;
1479	var x431: u1 = undefined;
1480	addcarryxU64(&x430, &x431, x429, x425, x422);
1481	var x432: u64 = undefined;
1482	var x433: u1 = undefined;
1483	addcarryxU64(&x432, &x433, x431, x423, x420);
1484	var x434: u64 = undefined;
1485	var x435: u1 = undefined;
1486	addcarryxU64(&x434, &x435, x433, x421, x418);
1487	var x436: u64 = undefined;
1488	var x437: u1 = undefined;
1489	addcarryxU64(&x436, &x437, x435, x419, x416);
1490	const x438 = (@as(u64, x437) + x417);
1491	var x439: u64 = undefined;
1492	var x440: u1 = undefined;
1493	addcarryxU64(&x439, &x440, 0x0, x400, x426);
1494	var x441: u64 = undefined;
1495	var x442: u1 = undefined;
1496	addcarryxU64(&x441, &x442, x440, x402, x428);
1497	var x443: u64 = undefined;
1498	var x444: u1 = undefined;
1499	addcarryxU64(&x443, &x444, x442, x404, x430);
1500	var x445: u64 = undefined;
1501	var x446: u1 = undefined;
1502	addcarryxU64(&x445, &x446, x444, x406, x432);
1503	var x447: u64 = undefined;
1504	var x448: u1 = undefined;
1505	addcarryxU64(&x447, &x448, x446, x408, x434);
1506	var x449: u64 = undefined;
1507	var x450: u1 = undefined;
1508	addcarryxU64(&x449, &x450, x448, x410, x436);
1509	var x451: u64 = undefined;
1510	var x452: u1 = undefined;
1511	addcarryxU64(&x451, &x452, x450, x412, x438);
1512	const x453 = (@as(u64, x452) + @as(u64, x413));
1513	var x454: u64 = undefined;
1514	var x455: u1 = undefined;
1515	subborrowxU64(&x454, &x455, 0x0, x441, 0xffffffff);
1516	var x456: u64 = undefined;
1517	var x457: u1 = undefined;
1518	subborrowxU64(&x456, &x457, x455, x443, 0xffffffff00000000);
1519	var x458: u64 = undefined;
1520	var x459: u1 = undefined;
1521	subborrowxU64(&x458, &x459, x457, x445, 0xfffffffffffffffe);
1522	var x460: u64 = undefined;
1523	var x461: u1 = undefined;
1524	subborrowxU64(&x460, &x461, x459, x447, 0xffffffffffffffff);
1525	var x462: u64 = undefined;
1526	var x463: u1 = undefined;
1527	subborrowxU64(&x462, &x463, x461, x449, 0xffffffffffffffff);
1528	var x464: u64 = undefined;
1529	var x465: u1 = undefined;
1530	subborrowxU64(&x464, &x465, x463, x451, 0xffffffffffffffff);
1531	var x466: u64 = undefined;
1532	var x467: u1 = undefined;
1533	subborrowxU64(&x466, &x467, x465, x453, 0x0);
1534	var x468: u64 = undefined;
1535	cmovznzU64(&x468, x467, x454, x441);
1536	var x469: u64 = undefined;
1537	cmovznzU64(&x469, x467, x456, x443);
1538	var x470: u64 = undefined;
1539	cmovznzU64(&x470, x467, x458, x445);
1540	var x471: u64 = undefined;
1541	cmovznzU64(&x471, x467, x460, x447);
1542	var x472: u64 = undefined;
1543	cmovznzU64(&x472, x467, x462, x449);
1544	var x473: u64 = undefined;
1545	cmovznzU64(&x473, x467, x464, x451);
1546	out1[0] = x468;
1547	out1[1] = x469;
1548	out1[2] = x470;
1549	out1[3] = x471;
1550	out1[4] = x472;
1551	out1[5] = x473;
1552	}
1553
1554	/// The function add adds two field elements in the Montgomery domain.
1555	///
1556	/// Preconditions:
1557	/// 0 ≤ eval arg1 < m
1558	/// 0 ≤ eval arg2 < m
1559	/// Postconditions:
1560	/// eval (from_montgomery out1) mod m = (eval (from_montgomery arg1) + eval (from_montgomery arg2)) mod m
1561	/// 0 ≤ eval out1 < m
1562	///
1563	pub fn add(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldElement, arg2: MontgomeryDomainFieldElement) void {
1564	@setRuntimeSafety(mode == .Debug);
1565
1566	var x1: u64 = undefined;
1567	var x2: u1 = undefined;
1568	addcarryxU64(&x1, &x2, 0x0, (arg1[0]), (arg2[0]));
1569	var x3: u64 = undefined;
1570	var x4: u1 = undefined;
1571	addcarryxU64(&x3, &x4, x2, (arg1[1]), (arg2[1]));
1572	var x5: u64 = undefined;
1573	var x6: u1 = undefined;
1574	addcarryxU64(&x5, &x6, x4, (arg1[2]), (arg2[2]));
1575	var x7: u64 = undefined;
1576	var x8: u1 = undefined;
1577	addcarryxU64(&x7, &x8, x6, (arg1[3]), (arg2[3]));
1578	var x9: u64 = undefined;
1579	var x10: u1 = undefined;
1580	addcarryxU64(&x9, &x10, x8, (arg1[4]), (arg2[4]));
1581	var x11: u64 = undefined;
1582	var x12: u1 = undefined;
1583	addcarryxU64(&x11, &x12, x10, (arg1[5]), (arg2[5]));
1584	var x13: u64 = undefined;
1585	var x14: u1 = undefined;
1586	subborrowxU64(&x13, &x14, 0x0, x1, 0xffffffff);
1587	var x15: u64 = undefined;
1588	var x16: u1 = undefined;
1589	subborrowxU64(&x15, &x16, x14, x3, 0xffffffff00000000);
1590	var x17: u64 = undefined;
1591	var x18: u1 = undefined;
1592	subborrowxU64(&x17, &x18, x16, x5, 0xfffffffffffffffe);
1593	var x19: u64 = undefined;
1594	var x20: u1 = undefined;
1595	subborrowxU64(&x19, &x20, x18, x7, 0xffffffffffffffff);
1596	var x21: u64 = undefined;
1597	var x22: u1 = undefined;
1598	subborrowxU64(&x21, &x22, x20, x9, 0xffffffffffffffff);
1599	var x23: u64 = undefined;
1600	var x24: u1 = undefined;
1601	subborrowxU64(&x23, &x24, x22, x11, 0xffffffffffffffff);
1602	var x25: u64 = undefined;
1603	var x26: u1 = undefined;
1604	subborrowxU64(&x25, &x26, x24, @as(u64, x12), 0x0);
1605	var x27: u64 = undefined;
1606	cmovznzU64(&x27, x26, x13, x1);
1607	var x28: u64 = undefined;
1608	cmovznzU64(&x28, x26, x15, x3);
1609	var x29: u64 = undefined;
1610	cmovznzU64(&x29, x26, x17, x5);
1611	var x30: u64 = undefined;
1612	cmovznzU64(&x30, x26, x19, x7);
1613	var x31: u64 = undefined;
1614	cmovznzU64(&x31, x26, x21, x9);
1615	var x32: u64 = undefined;
1616	cmovznzU64(&x32, x26, x23, x11);
1617	out1[0] = x27;
1618	out1[1] = x28;
1619	out1[2] = x29;
1620	out1[3] = x30;
1621	out1[4] = x31;
1622	out1[5] = x32;
1623	}
1624
1625	/// The function sub subtracts two field elements in the Montgomery domain.
1626	///
1627	/// Preconditions:
1628	/// 0 ≤ eval arg1 < m
1629	/// 0 ≤ eval arg2 < m
1630	/// Postconditions:
1631	/// eval (from_montgomery out1) mod m = (eval (from_montgomery arg1) - eval (from_montgomery arg2)) mod m
1632	/// 0 ≤ eval out1 < m
1633	///
1634	pub fn sub(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldElement, arg2: MontgomeryDomainFieldElement) void {
1635	@setRuntimeSafety(mode == .Debug);
1636
1637	var x1: u64 = undefined;
1638	var x2: u1 = undefined;
1639	subborrowxU64(&x1, &x2, 0x0, (arg1[0]), (arg2[0]));
1640	var x3: u64 = undefined;
1641	var x4: u1 = undefined;
1642	subborrowxU64(&x3, &x4, x2, (arg1[1]), (arg2[1]));
1643	var x5: u64 = undefined;
1644	var x6: u1 = undefined;
1645	subborrowxU64(&x5, &x6, x4, (arg1[2]), (arg2[2]));
1646	var x7: u64 = undefined;
1647	var x8: u1 = undefined;
1648	subborrowxU64(&x7, &x8, x6, (arg1[3]), (arg2[3]));
1649	var x9: u64 = undefined;
1650	var x10: u1 = undefined;
1651	subborrowxU64(&x9, &x10, x8, (arg1[4]), (arg2[4]));
1652	var x11: u64 = undefined;
1653	var x12: u1 = undefined;
1654	subborrowxU64(&x11, &x12, x10, (arg1[5]), (arg2[5]));
1655	var x13: u64 = undefined;
1656	cmovznzU64(&x13, x12, 0x0, 0xffffffffffffffff);
1657	var x14: u64 = undefined;
1658	var x15: u1 = undefined;
1659	addcarryxU64(&x14, &x15, 0x0, x1, (x13 & 0xffffffff));
1660	var x16: u64 = undefined;
1661	var x17: u1 = undefined;
1662	addcarryxU64(&x16, &x17, x15, x3, (x13 & 0xffffffff00000000));
1663	var x18: u64 = undefined;
1664	var x19: u1 = undefined;
1665	addcarryxU64(&x18, &x19, x17, x5, (x13 & 0xfffffffffffffffe));
1666	var x20: u64 = undefined;
1667	var x21: u1 = undefined;
1668	addcarryxU64(&x20, &x21, x19, x7, x13);
1669	var x22: u64 = undefined;
1670	var x23: u1 = undefined;
1671	addcarryxU64(&x22, &x23, x21, x9, x13);
1672	var x24: u64 = undefined;
1673	var x25: u1 = undefined;
1674	addcarryxU64(&x24, &x25, x23, x11, x13);
1675	out1[0] = x14;
1676	out1[1] = x16;
1677	out1[2] = x18;
1678	out1[3] = x20;
1679	out1[4] = x22;
1680	out1[5] = x24;
1681	}
1682
1683	/// The function opp negates a field element in the Montgomery domain.
1684	///
1685	/// Preconditions:
1686	/// 0 ≤ eval arg1 < m
1687	/// Postconditions:
1688	/// eval (from_montgomery out1) mod m = -eval (from_montgomery arg1) mod m
1689	/// 0 ≤ eval out1 < m
1690	///
1691	pub fn opp(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldElement) void {
1692	@setRuntimeSafety(mode == .Debug);
1693
1694	var x1: u64 = undefined;
1695	var x2: u1 = undefined;
1696	subborrowxU64(&x1, &x2, 0x0, 0x0, (arg1[0]));
1697	var x3: u64 = undefined;
1698	var x4: u1 = undefined;
1699	subborrowxU64(&x3, &x4, x2, 0x0, (arg1[1]));
1700	var x5: u64 = undefined;
1701	var x6: u1 = undefined;
1702	subborrowxU64(&x5, &x6, x4, 0x0, (arg1[2]));
1703	var x7: u64 = undefined;
1704	var x8: u1 = undefined;
1705	subborrowxU64(&x7, &x8, x6, 0x0, (arg1[3]));
1706	var x9: u64 = undefined;
1707	var x10: u1 = undefined;
1708	subborrowxU64(&x9, &x10, x8, 0x0, (arg1[4]));
1709	var x11: u64 = undefined;
1710	var x12: u1 = undefined;
1711	subborrowxU64(&x11, &x12, x10, 0x0, (arg1[5]));
1712	var x13: u64 = undefined;
1713	cmovznzU64(&x13, x12, 0x0, 0xffffffffffffffff);
1714	var x14: u64 = undefined;
1715	var x15: u1 = undefined;
1716	addcarryxU64(&x14, &x15, 0x0, x1, (x13 & 0xffffffff));
1717	var x16: u64 = undefined;
1718	var x17: u1 = undefined;
1719	addcarryxU64(&x16, &x17, x15, x3, (x13 & 0xffffffff00000000));
1720	var x18: u64 = undefined;
1721	var x19: u1 = undefined;
1722	addcarryxU64(&x18, &x19, x17, x5, (x13 & 0xfffffffffffffffe));
1723	var x20: u64 = undefined;
1724	var x21: u1 = undefined;
1725	addcarryxU64(&x20, &x21, x19, x7, x13);
1726	var x22: u64 = undefined;
1727	var x23: u1 = undefined;
1728	addcarryxU64(&x22, &x23, x21, x9, x13);
1729	var x24: u64 = undefined;
1730	var x25: u1 = undefined;
1731	addcarryxU64(&x24, &x25, x23, x11, x13);
1732	out1[0] = x14;
1733	out1[1] = x16;
1734	out1[2] = x18;
1735	out1[3] = x20;
1736	out1[4] = x22;
1737	out1[5] = x24;
1738	}
1739
1740	/// The function fromMontgomery translates a field element out of the Montgomery domain.
1741	///
1742	/// Preconditions:
1743	/// 0 ≤ eval arg1 < m
1744	/// Postconditions:
1745	/// eval out1 mod m = (eval arg1 * ((2^64)⁻¹ mod m)^6) mod m
1746	/// 0 ≤ eval out1 < m
1747	///
1748	pub fn fromMontgomery(out1: *NonMontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldElement) void {
1749	@setRuntimeSafety(mode == .Debug);
1750
1751	const x1 = (arg1[0]);
1752	var x2: u64 = undefined;
1753	var x3: u64 = undefined;
1754	mulxU64(&x2, &x3, x1, 0x100000001);
1755	var x4: u64 = undefined;
1756	var x5: u64 = undefined;
1757	mulxU64(&x4, &x5, x2, 0xffffffffffffffff);
1758	var x6: u64 = undefined;
1759	var x7: u64 = undefined;
1760	mulxU64(&x6, &x7, x2, 0xffffffffffffffff);
1761	var x8: u64 = undefined;
1762	var x9: u64 = undefined;
1763	mulxU64(&x8, &x9, x2, 0xffffffffffffffff);
1764	var x10: u64 = undefined;
1765	var x11: u64 = undefined;
1766	mulxU64(&x10, &x11, x2, 0xfffffffffffffffe);
1767	var x12: u64 = undefined;
1768	var x13: u64 = undefined;
1769	mulxU64(&x12, &x13, x2, 0xffffffff00000000);
1770	var x14: u64 = undefined;
1771	var x15: u64 = undefined;
1772	mulxU64(&x14, &x15, x2, 0xffffffff);
1773	var x16: u64 = undefined;
1774	var x17: u1 = undefined;
1775	addcarryxU64(&x16, &x17, 0x0, x15, x12);
1776	var x18: u64 = undefined;
1777	var x19: u1 = undefined;
1778	addcarryxU64(&x18, &x19, x17, x13, x10);
1779	var x20: u64 = undefined;
1780	var x21: u1 = undefined;
1781	addcarryxU64(&x20, &x21, x19, x11, x8);
1782	var x22: u64 = undefined;
1783	var x23: u1 = undefined;
1784	addcarryxU64(&x22, &x23, x21, x9, x6);
1785	var x24: u64 = undefined;
1786	var x25: u1 = undefined;
1787	addcarryxU64(&x24, &x25, x23, x7, x4);
1788	var x26: u64 = undefined;
1789	var x27: u1 = undefined;
1790	addcarryxU64(&x26, &x27, 0x0, x1, x14);
1791	var x28: u64 = undefined;
1792	var x29: u1 = undefined;
1793	addcarryxU64(&x28, &x29, x27, 0x0, x16);
1794	var x30: u64 = undefined;
1795	var x31: u1 = undefined;
1796	addcarryxU64(&x30, &x31, x29, 0x0, x18);
1797	var x32: u64 = undefined;
1798	var x33: u1 = undefined;
1799	addcarryxU64(&x32, &x33, x31, 0x0, x20);
1800	var x34: u64 = undefined;
1801	var x35: u1 = undefined;
1802	addcarryxU64(&x34, &x35, x33, 0x0, x22);
1803	var x36: u64 = undefined;
1804	var x37: u1 = undefined;
1805	addcarryxU64(&x36, &x37, x35, 0x0, x24);
1806	var x38: u64 = undefined;
1807	var x39: u1 = undefined;
1808	addcarryxU64(&x38, &x39, x37, 0x0, (@as(u64, x25) + x5));
1809	var x40: u64 = undefined;
1810	var x41: u1 = undefined;
1811	addcarryxU64(&x40, &x41, 0x0, x28, (arg1[1]));
1812	var x42: u64 = undefined;
1813	var x43: u1 = undefined;
1814	addcarryxU64(&x42, &x43, x41, x30, 0x0);
1815	var x44: u64 = undefined;
1816	var x45: u1 = undefined;
1817	addcarryxU64(&x44, &x45, x43, x32, 0x0);
1818	var x46: u64 = undefined;
1819	var x47: u1 = undefined;
1820	addcarryxU64(&x46, &x47, x45, x34, 0x0);
1821	var x48: u64 = undefined;
1822	var x49: u1 = undefined;
1823	addcarryxU64(&x48, &x49, x47, x36, 0x0);
1824	var x50: u64 = undefined;
1825	var x51: u1 = undefined;
1826	addcarryxU64(&x50, &x51, x49, x38, 0x0);
1827	var x52: u64 = undefined;
1828	var x53: u64 = undefined;
1829	mulxU64(&x52, &x53, x40, 0x100000001);
1830	var x54: u64 = undefined;
1831	var x55: u64 = undefined;
1832	mulxU64(&x54, &x55, x52, 0xffffffffffffffff);
1833	var x56: u64 = undefined;
1834	var x57: u64 = undefined;
1835	mulxU64(&x56, &x57, x52, 0xffffffffffffffff);
1836	var x58: u64 = undefined;
1837	var x59: u64 = undefined;
1838	mulxU64(&x58, &x59, x52, 0xffffffffffffffff);
1839	var x60: u64 = undefined;
1840	var x61: u64 = undefined;
1841	mulxU64(&x60, &x61, x52, 0xfffffffffffffffe);
1842	var x62: u64 = undefined;
1843	var x63: u64 = undefined;
1844	mulxU64(&x62, &x63, x52, 0xffffffff00000000);
1845	var x64: u64 = undefined;
1846	var x65: u64 = undefined;
1847	mulxU64(&x64, &x65, x52, 0xffffffff);
1848	var x66: u64 = undefined;
1849	var x67: u1 = undefined;
1850	addcarryxU64(&x66, &x67, 0x0, x65, x62);
1851	var x68: u64 = undefined;
1852	var x69: u1 = undefined;
1853	addcarryxU64(&x68, &x69, x67, x63, x60);
1854	var x70: u64 = undefined;
1855	var x71: u1 = undefined;
1856	addcarryxU64(&x70, &x71, x69, x61, x58);
1857	var x72: u64 = undefined;
1858	var x73: u1 = undefined;
1859	addcarryxU64(&x72, &x73, x71, x59, x56);
1860	var x74: u64 = undefined;
1861	var x75: u1 = undefined;
1862	addcarryxU64(&x74, &x75, x73, x57, x54);
1863	var x76: u64 = undefined;
1864	var x77: u1 = undefined;
1865	addcarryxU64(&x76, &x77, 0x0, x40, x64);
1866	var x78: u64 = undefined;
1867	var x79: u1 = undefined;
1868	addcarryxU64(&x78, &x79, x77, x42, x66);
1869	var x80: u64 = undefined;
1870	var x81: u1 = undefined;
1871	addcarryxU64(&x80, &x81, x79, x44, x68);
1872	var x82: u64 = undefined;
1873	var x83: u1 = undefined;
1874	addcarryxU64(&x82, &x83, x81, x46, x70);
1875	var x84: u64 = undefined;
1876	var x85: u1 = undefined;
1877	addcarryxU64(&x84, &x85, x83, x48, x72);
1878	var x86: u64 = undefined;
1879	var x87: u1 = undefined;
1880	addcarryxU64(&x86, &x87, x85, x50, x74);
1881	var x88: u64 = undefined;
1882	var x89: u1 = undefined;
1883	addcarryxU64(&x88, &x89, x87, (@as(u64, x51) + @as(u64, x39)), (@as(u64, x75) + x55));
1884	var x90: u64 = undefined;
1885	var x91: u1 = undefined;
1886	addcarryxU64(&x90, &x91, 0x0, x78, (arg1[2]));
1887	var x92: u64 = undefined;
1888	var x93: u1 = undefined;
1889	addcarryxU64(&x92, &x93, x91, x80, 0x0);
1890	var x94: u64 = undefined;
1891	var x95: u1 = undefined;
1892	addcarryxU64(&x94, &x95, x93, x82, 0x0);
1893	var x96: u64 = undefined;
1894	var x97: u1 = undefined;
1895	addcarryxU64(&x96, &x97, x95, x84, 0x0);
1896	var x98: u64 = undefined;
1897	var x99: u1 = undefined;
1898	addcarryxU64(&x98, &x99, x97, x86, 0x0);
1899	var x100: u64 = undefined;
1900	var x101: u1 = undefined;
1901	addcarryxU64(&x100, &x101, x99, x88, 0x0);
1902	var x102: u64 = undefined;
1903	var x103: u64 = undefined;
1904	mulxU64(&x102, &x103, x90, 0x100000001);
1905	var x104: u64 = undefined;
1906	var x105: u64 = undefined;
1907	mulxU64(&x104, &x105, x102, 0xffffffffffffffff);
1908	var x106: u64 = undefined;
1909	var x107: u64 = undefined;
1910	mulxU64(&x106, &x107, x102, 0xffffffffffffffff);
1911	var x108: u64 = undefined;
1912	var x109: u64 = undefined;
1913	mulxU64(&x108, &x109, x102, 0xffffffffffffffff);
1914	var x110: u64 = undefined;
1915	var x111: u64 = undefined;
1916	mulxU64(&x110, &x111, x102, 0xfffffffffffffffe);
1917	var x112: u64 = undefined;
1918	var x113: u64 = undefined;
1919	mulxU64(&x112, &x113, x102, 0xffffffff00000000);
1920	var x114: u64 = undefined;
1921	var x115: u64 = undefined;
1922	mulxU64(&x114, &x115, x102, 0xffffffff);
1923	var x116: u64 = undefined;
1924	var x117: u1 = undefined;
1925	addcarryxU64(&x116, &x117, 0x0, x115, x112);
1926	var x118: u64 = undefined;
1927	var x119: u1 = undefined;
1928	addcarryxU64(&x118, &x119, x117, x113, x110);
1929	var x120: u64 = undefined;
1930	var x121: u1 = undefined;
1931	addcarryxU64(&x120, &x121, x119, x111, x108);
1932	var x122: u64 = undefined;
1933	var x123: u1 = undefined;
1934	addcarryxU64(&x122, &x123, x121, x109, x106);
1935	var x124: u64 = undefined;
1936	var x125: u1 = undefined;
1937	addcarryxU64(&x124, &x125, x123, x107, x104);
1938	var x126: u64 = undefined;
1939	var x127: u1 = undefined;
1940	addcarryxU64(&x126, &x127, 0x0, x90, x114);
1941	var x128: u64 = undefined;
1942	var x129: u1 = undefined;
1943	addcarryxU64(&x128, &x129, x127, x92, x116);
1944	var x130: u64 = undefined;
1945	var x131: u1 = undefined;
1946	addcarryxU64(&x130, &x131, x129, x94, x118);
1947	var x132: u64 = undefined;
1948	var x133: u1 = undefined;
1949	addcarryxU64(&x132, &x133, x131, x96, x120);
1950	var x134: u64 = undefined;
1951	var x135: u1 = undefined;
1952	addcarryxU64(&x134, &x135, x133, x98, x122);
1953	var x136: u64 = undefined;
1954	var x137: u1 = undefined;
1955	addcarryxU64(&x136, &x137, x135, x100, x124);
1956	var x138: u64 = undefined;
1957	var x139: u1 = undefined;
1958	addcarryxU64(&x138, &x139, x137, (@as(u64, x101) + @as(u64, x89)), (@as(u64, x125) + x105));
1959	var x140: u64 = undefined;
1960	var x141: u1 = undefined;
1961	addcarryxU64(&x140, &x141, 0x0, x128, (arg1[3]));
1962	var x142: u64 = undefined;
1963	var x143: u1 = undefined;
1964	addcarryxU64(&x142, &x143, x141, x130, 0x0);
1965	var x144: u64 = undefined;
1966	var x145: u1 = undefined;
1967	addcarryxU64(&x144, &x145, x143, x132, 0x0);
1968	var x146: u64 = undefined;
1969	var x147: u1 = undefined;
1970	addcarryxU64(&x146, &x147, x145, x134, 0x0);
1971	var x148: u64 = undefined;
1972	var x149: u1 = undefined;
1973	addcarryxU64(&x148, &x149, x147, x136, 0x0);
1974	var x150: u64 = undefined;
1975	var x151: u1 = undefined;
1976	addcarryxU64(&x150, &x151, x149, x138, 0x0);
1977	var x152: u64 = undefined;
1978	var x153: u64 = undefined;
1979	mulxU64(&x152, &x153, x140, 0x100000001);
1980	var x154: u64 = undefined;
1981	var x155: u64 = undefined;
1982	mulxU64(&x154, &x155, x152, 0xffffffffffffffff);
1983	var x156: u64 = undefined;
1984	var x157: u64 = undefined;
1985	mulxU64(&x156, &x157, x152, 0xffffffffffffffff);
1986	var x158: u64 = undefined;
1987	var x159: u64 = undefined;
1988	mulxU64(&x158, &x159, x152, 0xffffffffffffffff);
1989	var x160: u64 = undefined;
1990	var x161: u64 = undefined;
1991	mulxU64(&x160, &x161, x152, 0xfffffffffffffffe);
1992	var x162: u64 = undefined;
1993	var x163: u64 = undefined;
1994	mulxU64(&x162, &x163, x152, 0xffffffff00000000);
1995	var x164: u64 = undefined;
1996	var x165: u64 = undefined;
1997	mulxU64(&x164, &x165, x152, 0xffffffff);
1998	var x166: u64 = undefined;
1999	var x167: u1 = undefined;
2000	addcarryxU64(&x166, &x167, 0x0, x165, x162);
2001	var x168: u64 = undefined;
2002	var x169: u1 = undefined;
2003	addcarryxU64(&x168, &x169, x167, x163, x160);
2004	var x170: u64 = undefined;
2005	var x171: u1 = undefined;
2006	addcarryxU64(&x170, &x171, x169, x161, x158);
2007	var x172: u64 = undefined;
2008	var x173: u1 = undefined;
2009	addcarryxU64(&x172, &x173, x171, x159, x156);
2010	var x174: u64 = undefined;
2011	var x175: u1 = undefined;
2012	addcarryxU64(&x174, &x175, x173, x157, x154);
2013	var x176: u64 = undefined;
2014	var x177: u1 = undefined;
2015	addcarryxU64(&x176, &x177, 0x0, x140, x164);
2016	var x178: u64 = undefined;
2017	var x179: u1 = undefined;
2018	addcarryxU64(&x178, &x179, x177, x142, x166);
2019	var x180: u64 = undefined;
2020	var x181: u1 = undefined;
2021	addcarryxU64(&x180, &x181, x179, x144, x168);
2022	var x182: u64 = undefined;
2023	var x183: u1 = undefined;
2024	addcarryxU64(&x182, &x183, x181, x146, x170);
2025	var x184: u64 = undefined;
2026	var x185: u1 = undefined;
2027	addcarryxU64(&x184, &x185, x183, x148, x172);
2028	var x186: u64 = undefined;
2029	var x187: u1 = undefined;
2030	addcarryxU64(&x186, &x187, x185, x150, x174);
2031	var x188: u64 = undefined;
2032	var x189: u1 = undefined;
2033	addcarryxU64(&x188, &x189, x187, (@as(u64, x151) + @as(u64, x139)), (@as(u64, x175) + x155));
2034	var x190: u64 = undefined;
2035	var x191: u1 = undefined;
2036	addcarryxU64(&x190, &x191, 0x0, x178, (arg1[4]));
2037	var x192: u64 = undefined;
2038	var x193: u1 = undefined;
2039	addcarryxU64(&x192, &x193, x191, x180, 0x0);
2040	var x194: u64 = undefined;
2041	var x195: u1 = undefined;
2042	addcarryxU64(&x194, &x195, x193, x182, 0x0);
2043	var x196: u64 = undefined;
2044	var x197: u1 = undefined;
2045	addcarryxU64(&x196, &x197, x195, x184, 0x0);
2046	var x198: u64 = undefined;
2047	var x199: u1 = undefined;
2048	addcarryxU64(&x198, &x199, x197, x186, 0x0);
2049	var x200: u64 = undefined;
2050	var x201: u1 = undefined;
2051	addcarryxU64(&x200, &x201, x199, x188, 0x0);
2052	var x202: u64 = undefined;
2053	var x203: u64 = undefined;
2054	mulxU64(&x202, &x203, x190, 0x100000001);
2055	var x204: u64 = undefined;
2056	var x205: u64 = undefined;
2057	mulxU64(&x204, &x205, x202, 0xffffffffffffffff);
2058	var x206: u64 = undefined;
2059	var x207: u64 = undefined;
2060	mulxU64(&x206, &x207, x202, 0xffffffffffffffff);
2061	var x208: u64 = undefined;
2062	var x209: u64 = undefined;
2063	mulxU64(&x208, &x209, x202, 0xffffffffffffffff);
2064	var x210: u64 = undefined;
2065	var x211: u64 = undefined;
2066	mulxU64(&x210, &x211, x202, 0xfffffffffffffffe);
2067	var x212: u64 = undefined;
2068	var x213: u64 = undefined;
2069	mulxU64(&x212, &x213, x202, 0xffffffff00000000);
2070	var x214: u64 = undefined;
2071	var x215: u64 = undefined;
2072	mulxU64(&x214, &x215, x202, 0xffffffff);
2073	var x216: u64 = undefined;
2074	var x217: u1 = undefined;
2075	addcarryxU64(&x216, &x217, 0x0, x215, x212);
2076	var x218: u64 = undefined;
2077	var x219: u1 = undefined;
2078	addcarryxU64(&x218, &x219, x217, x213, x210);
2079	var x220: u64 = undefined;
2080	var x221: u1 = undefined;
2081	addcarryxU64(&x220, &x221, x219, x211, x208);
2082	var x222: u64 = undefined;
2083	var x223: u1 = undefined;
2084	addcarryxU64(&x222, &x223, x221, x209, x206);
2085	var x224: u64 = undefined;
2086	var x225: u1 = undefined;
2087	addcarryxU64(&x224, &x225, x223, x207, x204);
2088	var x226: u64 = undefined;
2089	var x227: u1 = undefined;
2090	addcarryxU64(&x226, &x227, 0x0, x190, x214);
2091	var x228: u64 = undefined;
2092	var x229: u1 = undefined;
2093	addcarryxU64(&x228, &x229, x227, x192, x216);
2094	var x230: u64 = undefined;
2095	var x231: u1 = undefined;
2096	addcarryxU64(&x230, &x231, x229, x194, x218);
2097	var x232: u64 = undefined;
2098	var x233: u1 = undefined;
2099	addcarryxU64(&x232, &x233, x231, x196, x220);
2100	var x234: u64 = undefined;
2101	var x235: u1 = undefined;
2102	addcarryxU64(&x234, &x235, x233, x198, x222);
2103	var x236: u64 = undefined;
2104	var x237: u1 = undefined;
2105	addcarryxU64(&x236, &x237, x235, x200, x224);
2106	var x238: u64 = undefined;
2107	var x239: u1 = undefined;
2108	addcarryxU64(&x238, &x239, x237, (@as(u64, x201) + @as(u64, x189)), (@as(u64, x225) + x205));
2109	var x240: u64 = undefined;
2110	var x241: u1 = undefined;
2111	addcarryxU64(&x240, &x241, 0x0, x228, (arg1[5]));
2112	var x242: u64 = undefined;
2113	var x243: u1 = undefined;
2114	addcarryxU64(&x242, &x243, x241, x230, 0x0);
2115	var x244: u64 = undefined;
2116	var x245: u1 = undefined;
2117	addcarryxU64(&x244, &x245, x243, x232, 0x0);
2118	var x246: u64 = undefined;
2119	var x247: u1 = undefined;
2120	addcarryxU64(&x246, &x247, x245, x234, 0x0);
2121	var x248: u64 = undefined;
2122	var x249: u1 = undefined;
2123	addcarryxU64(&x248, &x249, x247, x236, 0x0);
2124	var x250: u64 = undefined;
2125	var x251: u1 = undefined;
2126	addcarryxU64(&x250, &x251, x249, x238, 0x0);
2127	var x252: u64 = undefined;
2128	var x253: u64 = undefined;
2129	mulxU64(&x252, &x253, x240, 0x100000001);
2130	var x254: u64 = undefined;
2131	var x255: u64 = undefined;
2132	mulxU64(&x254, &x255, x252, 0xffffffffffffffff);
2133	var x256: u64 = undefined;
2134	var x257: u64 = undefined;
2135	mulxU64(&x256, &x257, x252, 0xffffffffffffffff);
2136	var x258: u64 = undefined;
2137	var x259: u64 = undefined;
2138	mulxU64(&x258, &x259, x252, 0xffffffffffffffff);
2139	var x260: u64 = undefined;
2140	var x261: u64 = undefined;
2141	mulxU64(&x260, &x261, x252, 0xfffffffffffffffe);
2142	var x262: u64 = undefined;
2143	var x263: u64 = undefined;
2144	mulxU64(&x262, &x263, x252, 0xffffffff00000000);
2145	var x264: u64 = undefined;
2146	var x265: u64 = undefined;
2147	mulxU64(&x264, &x265, x252, 0xffffffff);
2148	var x266: u64 = undefined;
2149	var x267: u1 = undefined;
2150	addcarryxU64(&x266, &x267, 0x0, x265, x262);
2151	var x268: u64 = undefined;
2152	var x269: u1 = undefined;
2153	addcarryxU64(&x268, &x269, x267, x263, x260);
2154	var x270: u64 = undefined;
2155	var x271: u1 = undefined;
2156	addcarryxU64(&x270, &x271, x269, x261, x258);
2157	var x272: u64 = undefined;
2158	var x273: u1 = undefined;
2159	addcarryxU64(&x272, &x273, x271, x259, x256);
2160	var x274: u64 = undefined;
2161	var x275: u1 = undefined;
2162	addcarryxU64(&x274, &x275, x273, x257, x254);
2163	var x276: u64 = undefined;
2164	var x277: u1 = undefined;
2165	addcarryxU64(&x276, &x277, 0x0, x240, x264);
2166	var x278: u64 = undefined;
2167	var x279: u1 = undefined;
2168	addcarryxU64(&x278, &x279, x277, x242, x266);
2169	var x280: u64 = undefined;
2170	var x281: u1 = undefined;
2171	addcarryxU64(&x280, &x281, x279, x244, x268);
2172	var x282: u64 = undefined;
2173	var x283: u1 = undefined;
2174	addcarryxU64(&x282, &x283, x281, x246, x270);
2175	var x284: u64 = undefined;
2176	var x285: u1 = undefined;
2177	addcarryxU64(&x284, &x285, x283, x248, x272);
2178	var x286: u64 = undefined;
2179	var x287: u1 = undefined;
2180	addcarryxU64(&x286, &x287, x285, x250, x274);
2181	var x288: u64 = undefined;
2182	var x289: u1 = undefined;
2183	addcarryxU64(&x288, &x289, x287, (@as(u64, x251) + @as(u64, x239)), (@as(u64, x275) + x255));
2184	var x290: u64 = undefined;
2185	var x291: u1 = undefined;
2186	subborrowxU64(&x290, &x291, 0x0, x278, 0xffffffff);
2187	var x292: u64 = undefined;
2188	var x293: u1 = undefined;
2189	subborrowxU64(&x292, &x293, x291, x280, 0xffffffff00000000);
2190	var x294: u64 = undefined;
2191	var x295: u1 = undefined;
2192	subborrowxU64(&x294, &x295, x293, x282, 0xfffffffffffffffe);
2193	var x296: u64 = undefined;
2194	var x297: u1 = undefined;
2195	subborrowxU64(&x296, &x297, x295, x284, 0xffffffffffffffff);
2196	var x298: u64 = undefined;
2197	var x299: u1 = undefined;
2198	subborrowxU64(&x298, &x299, x297, x286, 0xffffffffffffffff);
2199	var x300: u64 = undefined;
2200	var x301: u1 = undefined;
2201	subborrowxU64(&x300, &x301, x299, x288, 0xffffffffffffffff);
2202	var x302: u64 = undefined;
2203	var x303: u1 = undefined;
2204	subborrowxU64(&x302, &x303, x301, @as(u64, x289), 0x0);
2205	var x304: u64 = undefined;
2206	cmovznzU64(&x304, x303, x290, x278);
2207	var x305: u64 = undefined;
2208	cmovznzU64(&x305, x303, x292, x280);
2209	var x306: u64 = undefined;
2210	cmovznzU64(&x306, x303, x294, x282);
2211	var x307: u64 = undefined;
2212	cmovznzU64(&x307, x303, x296, x284);
2213	var x308: u64 = undefined;
2214	cmovznzU64(&x308, x303, x298, x286);
2215	var x309: u64 = undefined;
2216	cmovznzU64(&x309, x303, x300, x288);
2217	out1[0] = x304;
2218	out1[1] = x305;
2219	out1[2] = x306;
2220	out1[3] = x307;
2221	out1[4] = x308;
2222	out1[5] = x309;
2223	}
2224
2225	/// The function toMontgomery translates a field element into the Montgomery domain.
2226	///
2227	/// Preconditions:
2228	/// 0 ≤ eval arg1 < m
2229	/// Postconditions:
2230	/// eval (from_montgomery out1) mod m = eval arg1 mod m
2231	/// 0 ≤ eval out1 < m
2232	///
2233	pub fn toMontgomery(out1: *MontgomeryDomainFieldElement, arg1: NonMontgomeryDomainFieldElement) void {
2234	@setRuntimeSafety(mode == .Debug);
2235
2236	const x1 = (arg1[1]);
2237	const x2 = (arg1[2]);
2238	const x3 = (arg1[3]);
2239	const x4 = (arg1[4]);
2240	const x5 = (arg1[5]);
2241	const x6 = (arg1[0]);
2242	var x7: u64 = undefined;
2243	var x8: u64 = undefined;
2244	mulxU64(&x7, &x8, x6, 0x200000000);
2245	var x9: u64 = undefined;
2246	var x10: u64 = undefined;
2247	mulxU64(&x9, &x10, x6, 0xfffffffe00000000);
2248	var x11: u64 = undefined;
2249	var x12: u64 = undefined;
2250	mulxU64(&x11, &x12, x6, 0x200000000);
2251	var x13: u64 = undefined;
2252	var x14: u64 = undefined;
2253	mulxU64(&x13, &x14, x6, 0xfffffffe00000001);
2254	var x15: u64 = undefined;
2255	var x16: u1 = undefined;
2256	addcarryxU64(&x15, &x16, 0x0, x14, x11);
2257	var x17: u64 = undefined;
2258	var x18: u1 = undefined;
2259	addcarryxU64(&x17, &x18, x16, x12, x9);
2260	var x19: u64 = undefined;
2261	var x20: u1 = undefined;
2262	addcarryxU64(&x19, &x20, x18, x10, x7);
2263	var x21: u64 = undefined;
2264	var x22: u1 = undefined;
2265	addcarryxU64(&x21, &x22, x20, x8, x6);
2266	var x23: u64 = undefined;
2267	var x24: u64 = undefined;
2268	mulxU64(&x23, &x24, x13, 0x100000001);
2269	var x25: u64 = undefined;
2270	var x26: u64 = undefined;
2271	mulxU64(&x25, &x26, x23, 0xffffffffffffffff);
2272	var x27: u64 = undefined;
2273	var x28: u64 = undefined;
2274	mulxU64(&x27, &x28, x23, 0xffffffffffffffff);
2275	var x29: u64 = undefined;
2276	var x30: u64 = undefined;
2277	mulxU64(&x29, &x30, x23, 0xffffffffffffffff);
2278	var x31: u64 = undefined;
2279	var x32: u64 = undefined;
2280	mulxU64(&x31, &x32, x23, 0xfffffffffffffffe);
2281	var x33: u64 = undefined;
2282	var x34: u64 = undefined;
2283	mulxU64(&x33, &x34, x23, 0xffffffff00000000);
2284	var x35: u64 = undefined;
2285	var x36: u64 = undefined;
2286	mulxU64(&x35, &x36, x23, 0xffffffff);
2287	var x37: u64 = undefined;
2288	var x38: u1 = undefined;
2289	addcarryxU64(&x37, &x38, 0x0, x36, x33);
2290	var x39: u64 = undefined;
2291	var x40: u1 = undefined;
2292	addcarryxU64(&x39, &x40, x38, x34, x31);
2293	var x41: u64 = undefined;
2294	var x42: u1 = undefined;
2295	addcarryxU64(&x41, &x42, x40, x32, x29);
2296	var x43: u64 = undefined;
2297	var x44: u1 = undefined;
2298	addcarryxU64(&x43, &x44, x42, x30, x27);
2299	var x45: u64 = undefined;
2300	var x46: u1 = undefined;
2301	addcarryxU64(&x45, &x46, x44, x28, x25);
2302	var x47: u64 = undefined;
2303	var x48: u1 = undefined;
2304	addcarryxU64(&x47, &x48, 0x0, x13, x35);
2305	var x49: u64 = undefined;
2306	var x50: u1 = undefined;
2307	addcarryxU64(&x49, &x50, x48, x15, x37);
2308	var x51: u64 = undefined;
2309	var x52: u1 = undefined;
2310	addcarryxU64(&x51, &x52, x50, x17, x39);
2311	var x53: u64 = undefined;
2312	var x54: u1 = undefined;
2313	addcarryxU64(&x53, &x54, x52, x19, x41);
2314	var x55: u64 = undefined;
2315	var x56: u1 = undefined;
2316	addcarryxU64(&x55, &x56, x54, x21, x43);
2317	var x57: u64 = undefined;
2318	var x58: u1 = undefined;
2319	addcarryxU64(&x57, &x58, x56, @as(u64, x22), x45);
2320	var x59: u64 = undefined;
2321	var x60: u1 = undefined;
2322	addcarryxU64(&x59, &x60, x58, 0x0, (@as(u64, x46) + x26));
2323	var x61: u64 = undefined;
2324	var x62: u64 = undefined;
2325	mulxU64(&x61, &x62, x1, 0x200000000);
2326	var x63: u64 = undefined;
2327	var x64: u64 = undefined;
2328	mulxU64(&x63, &x64, x1, 0xfffffffe00000000);
2329	var x65: u64 = undefined;
2330	var x66: u64 = undefined;
2331	mulxU64(&x65, &x66, x1, 0x200000000);
2332	var x67: u64 = undefined;
2333	var x68: u64 = undefined;
2334	mulxU64(&x67, &x68, x1, 0xfffffffe00000001);
2335	var x69: u64 = undefined;
2336	var x70: u1 = undefined;
2337	addcarryxU64(&x69, &x70, 0x0, x68, x65);
2338	var x71: u64 = undefined;
2339	var x72: u1 = undefined;
2340	addcarryxU64(&x71, &x72, x70, x66, x63);
2341	var x73: u64 = undefined;
2342	var x74: u1 = undefined;
2343	addcarryxU64(&x73, &x74, x72, x64, x61);
2344	var x75: u64 = undefined;
2345	var x76: u1 = undefined;
2346	addcarryxU64(&x75, &x76, x74, x62, x1);
2347	var x77: u64 = undefined;
2348	var x78: u1 = undefined;
2349	addcarryxU64(&x77, &x78, 0x0, x49, x67);
2350	var x79: u64 = undefined;
2351	var x80: u1 = undefined;
2352	addcarryxU64(&x79, &x80, x78, x51, x69);
2353	var x81: u64 = undefined;
2354	var x82: u1 = undefined;
2355	addcarryxU64(&x81, &x82, x80, x53, x71);
2356	var x83: u64 = undefined;
2357	var x84: u1 = undefined;
2358	addcarryxU64(&x83, &x84, x82, x55, x73);
2359	var x85: u64 = undefined;
2360	var x86: u1 = undefined;
2361	addcarryxU64(&x85, &x86, x84, x57, x75);
2362	var x87: u64 = undefined;
2363	var x88: u1 = undefined;
2364	addcarryxU64(&x87, &x88, x86, x59, @as(u64, x76));
2365	var x89: u64 = undefined;
2366	var x90: u64 = undefined;
2367	mulxU64(&x89, &x90, x77, 0x100000001);
2368	var x91: u64 = undefined;
2369	var x92: u64 = undefined;
2370	mulxU64(&x91, &x92, x89, 0xffffffffffffffff);
2371	var x93: u64 = undefined;
2372	var x94: u64 = undefined;
2373	mulxU64(&x93, &x94, x89, 0xffffffffffffffff);
2374	var x95: u64 = undefined;
2375	var x96: u64 = undefined;
2376	mulxU64(&x95, &x96, x89, 0xffffffffffffffff);
2377	var x97: u64 = undefined;
2378	var x98: u64 = undefined;
2379	mulxU64(&x97, &x98, x89, 0xfffffffffffffffe);
2380	var x99: u64 = undefined;
2381	var x100: u64 = undefined;
2382	mulxU64(&x99, &x100, x89, 0xffffffff00000000);
2383	var x101: u64 = undefined;
2384	var x102: u64 = undefined;
2385	mulxU64(&x101, &x102, x89, 0xffffffff);
2386	var x103: u64 = undefined;
2387	var x104: u1 = undefined;
2388	addcarryxU64(&x103, &x104, 0x0, x102, x99);
2389	var x105: u64 = undefined;
2390	var x106: u1 = undefined;
2391	addcarryxU64(&x105, &x106, x104, x100, x97);
2392	var x107: u64 = undefined;
2393	var x108: u1 = undefined;
2394	addcarryxU64(&x107, &x108, x106, x98, x95);
2395	var x109: u64 = undefined;
2396	var x110: u1 = undefined;
2397	addcarryxU64(&x109, &x110, x108, x96, x93);
2398	var x111: u64 = undefined;
2399	var x112: u1 = undefined;
2400	addcarryxU64(&x111, &x112, x110, x94, x91);
2401	var x113: u64 = undefined;
2402	var x114: u1 = undefined;
2403	addcarryxU64(&x113, &x114, 0x0, x77, x101);
2404	var x115: u64 = undefined;
2405	var x116: u1 = undefined;
2406	addcarryxU64(&x115, &x116, x114, x79, x103);
2407	var x117: u64 = undefined;
2408	var x118: u1 = undefined;
2409	addcarryxU64(&x117, &x118, x116, x81, x105);
2410	var x119: u64 = undefined;
2411	var x120: u1 = undefined;
2412	addcarryxU64(&x119, &x120, x118, x83, x107);
2413	var x121: u64 = undefined;
2414	var x122: u1 = undefined;
2415	addcarryxU64(&x121, &x122, x120, x85, x109);
2416	var x123: u64 = undefined;
2417	var x124: u1 = undefined;
2418	addcarryxU64(&x123, &x124, x122, x87, x111);
2419	var x125: u64 = undefined;
2420	var x126: u1 = undefined;
2421	addcarryxU64(&x125, &x126, x124, (@as(u64, x88) + @as(u64, x60)), (@as(u64, x112) + x92));
2422	var x127: u64 = undefined;
2423	var x128: u64 = undefined;
2424	mulxU64(&x127, &x128, x2, 0x200000000);
2425	var x129: u64 = undefined;
2426	var x130: u64 = undefined;
2427	mulxU64(&x129, &x130, x2, 0xfffffffe00000000);
2428	var x131: u64 = undefined;
2429	var x132: u64 = undefined;
2430	mulxU64(&x131, &x132, x2, 0x200000000);
2431	var x133: u64 = undefined;
2432	var x134: u64 = undefined;
2433	mulxU64(&x133, &x134, x2, 0xfffffffe00000001);
2434	var x135: u64 = undefined;
2435	var x136: u1 = undefined;
2436	addcarryxU64(&x135, &x136, 0x0, x134, x131);
2437	var x137: u64 = undefined;
2438	var x138: u1 = undefined;
2439	addcarryxU64(&x137, &x138, x136, x132, x129);
2440	var x139: u64 = undefined;
2441	var x140: u1 = undefined;
2442	addcarryxU64(&x139, &x140, x138, x130, x127);
2443	var x141: u64 = undefined;
2444	var x142: u1 = undefined;
2445	addcarryxU64(&x141, &x142, x140, x128, x2);
2446	var x143: u64 = undefined;
2447	var x144: u1 = undefined;
2448	addcarryxU64(&x143, &x144, 0x0, x115, x133);
2449	var x145: u64 = undefined;
2450	var x146: u1 = undefined;
2451	addcarryxU64(&x145, &x146, x144, x117, x135);
2452	var x147: u64 = undefined;
2453	var x148: u1 = undefined;
2454	addcarryxU64(&x147, &x148, x146, x119, x137);
2455	var x149: u64 = undefined;
2456	var x150: u1 = undefined;
2457	addcarryxU64(&x149, &x150, x148, x121, x139);
2458	var x151: u64 = undefined;
2459	var x152: u1 = undefined;
2460	addcarryxU64(&x151, &x152, x150, x123, x141);
2461	var x153: u64 = undefined;
2462	var x154: u1 = undefined;
2463	addcarryxU64(&x153, &x154, x152, x125, @as(u64, x142));
2464	var x155: u64 = undefined;
2465	var x156: u64 = undefined;
2466	mulxU64(&x155, &x156, x143, 0x100000001);
2467	var x157: u64 = undefined;
2468	var x158: u64 = undefined;
2469	mulxU64(&x157, &x158, x155, 0xffffffffffffffff);
2470	var x159: u64 = undefined;
2471	var x160: u64 = undefined;
2472	mulxU64(&x159, &x160, x155, 0xffffffffffffffff);
2473	var x161: u64 = undefined;
2474	var x162: u64 = undefined;
2475	mulxU64(&x161, &x162, x155, 0xffffffffffffffff);
2476	var x163: u64 = undefined;
2477	var x164: u64 = undefined;
2478	mulxU64(&x163, &x164, x155, 0xfffffffffffffffe);
2479	var x165: u64 = undefined;
2480	var x166: u64 = undefined;
2481	mulxU64(&x165, &x166, x155, 0xffffffff00000000);
2482	var x167: u64 = undefined;
2483	var x168: u64 = undefined;
2484	mulxU64(&x167, &x168, x155, 0xffffffff);
2485	var x169: u64 = undefined;
2486	var x170: u1 = undefined;
2487	addcarryxU64(&x169, &x170, 0x0, x168, x165);
2488	var x171: u64 = undefined;
2489	var x172: u1 = undefined;
2490	addcarryxU64(&x171, &x172, x170, x166, x163);
2491	var x173: u64 = undefined;
2492	var x174: u1 = undefined;
2493	addcarryxU64(&x173, &x174, x172, x164, x161);
2494	var x175: u64 = undefined;
2495	var x176: u1 = undefined;
2496	addcarryxU64(&x175, &x176, x174, x162, x159);
2497	var x177: u64 = undefined;
2498	var x178: u1 = undefined;
2499	addcarryxU64(&x177, &x178, x176, x160, x157);
2500	var x179: u64 = undefined;
2501	var x180: u1 = undefined;
2502	addcarryxU64(&x179, &x180, 0x0, x143, x167);
2503	var x181: u64 = undefined;
2504	var x182: u1 = undefined;
2505	addcarryxU64(&x181, &x182, x180, x145, x169);
2506	var x183: u64 = undefined;
2507	var x184: u1 = undefined;
2508	addcarryxU64(&x183, &x184, x182, x147, x171);
2509	var x185: u64 = undefined;
2510	var x186: u1 = undefined;
2511	addcarryxU64(&x185, &x186, x184, x149, x173);
2512	var x187: u64 = undefined;
2513	var x188: u1 = undefined;
2514	addcarryxU64(&x187, &x188, x186, x151, x175);
2515	var x189: u64 = undefined;
2516	var x190: u1 = undefined;
2517	addcarryxU64(&x189, &x190, x188, x153, x177);
2518	var x191: u64 = undefined;
2519	var x192: u1 = undefined;
2520	addcarryxU64(&x191, &x192, x190, (@as(u64, x154) + @as(u64, x126)), (@as(u64, x178) + x158));
2521	var x193: u64 = undefined;
2522	var x194: u64 = undefined;
2523	mulxU64(&x193, &x194, x3, 0x200000000);
2524	var x195: u64 = undefined;
2525	var x196: u64 = undefined;
2526	mulxU64(&x195, &x196, x3, 0xfffffffe00000000);
2527	var x197: u64 = undefined;
2528	var x198: u64 = undefined;
2529	mulxU64(&x197, &x198, x3, 0x200000000);
2530	var x199: u64 = undefined;
2531	var x200: u64 = undefined;
2532	mulxU64(&x199, &x200, x3, 0xfffffffe00000001);
2533	var x201: u64 = undefined;
2534	var x202: u1 = undefined;
2535	addcarryxU64(&x201, &x202, 0x0, x200, x197);
2536	var x203: u64 = undefined;
2537	var x204: u1 = undefined;
2538	addcarryxU64(&x203, &x204, x202, x198, x195);
2539	var x205: u64 = undefined;
2540	var x206: u1 = undefined;
2541	addcarryxU64(&x205, &x206, x204, x196, x193);
2542	var x207: u64 = undefined;
2543	var x208: u1 = undefined;
2544	addcarryxU64(&x207, &x208, x206, x194, x3);
2545	var x209: u64 = undefined;
2546	var x210: u1 = undefined;
2547	addcarryxU64(&x209, &x210, 0x0, x181, x199);
2548	var x211: u64 = undefined;
2549	var x212: u1 = undefined;
2550	addcarryxU64(&x211, &x212, x210, x183, x201);
2551	var x213: u64 = undefined;
2552	var x214: u1 = undefined;
2553	addcarryxU64(&x213, &x214, x212, x185, x203);
2554	var x215: u64 = undefined;
2555	var x216: u1 = undefined;
2556	addcarryxU64(&x215, &x216, x214, x187, x205);
2557	var x217: u64 = undefined;
2558	var x218: u1 = undefined;
2559	addcarryxU64(&x217, &x218, x216, x189, x207);
2560	var x219: u64 = undefined;
2561	var x220: u1 = undefined;
2562	addcarryxU64(&x219, &x220, x218, x191, @as(u64, x208));
2563	var x221: u64 = undefined;
2564	var x222: u64 = undefined;
2565	mulxU64(&x221, &x222, x209, 0x100000001);
2566	var x223: u64 = undefined;
2567	var x224: u64 = undefined;
2568	mulxU64(&x223, &x224, x221, 0xffffffffffffffff);
2569	var x225: u64 = undefined;
2570	var x226: u64 = undefined;
2571	mulxU64(&x225, &x226, x221, 0xffffffffffffffff);
2572	var x227: u64 = undefined;
2573	var x228: u64 = undefined;
2574	mulxU64(&x227, &x228, x221, 0xffffffffffffffff);
2575	var x229: u64 = undefined;
2576	var x230: u64 = undefined;
2577	mulxU64(&x229, &x230, x221, 0xfffffffffffffffe);
2578	var x231: u64 = undefined;
2579	var x232: u64 = undefined;
2580	mulxU64(&x231, &x232, x221, 0xffffffff00000000);
2581	var x233: u64 = undefined;
2582	var x234: u64 = undefined;
2583	mulxU64(&x233, &x234, x221, 0xffffffff);
2584	var x235: u64 = undefined;
2585	var x236: u1 = undefined;
2586	addcarryxU64(&x235, &x236, 0x0, x234, x231);
2587	var x237: u64 = undefined;
2588	var x238: u1 = undefined;
2589	addcarryxU64(&x237, &x238, x236, x232, x229);
2590	var x239: u64 = undefined;
2591	var x240: u1 = undefined;
2592	addcarryxU64(&x239, &x240, x238, x230, x227);
2593	var x241: u64 = undefined;
2594	var x242: u1 = undefined;
2595	addcarryxU64(&x241, &x242, x240, x228, x225);
2596	var x243: u64 = undefined;
2597	var x244: u1 = undefined;
2598	addcarryxU64(&x243, &x244, x242, x226, x223);
2599	var x245: u64 = undefined;
2600	var x246: u1 = undefined;
2601	addcarryxU64(&x245, &x246, 0x0, x209, x233);
2602	var x247: u64 = undefined;
2603	var x248: u1 = undefined;
2604	addcarryxU64(&x247, &x248, x246, x211, x235);
2605	var x249: u64 = undefined;
2606	var x250: u1 = undefined;
2607	addcarryxU64(&x249, &x250, x248, x213, x237);
2608	var x251: u64 = undefined;
2609	var x252: u1 = undefined;
2610	addcarryxU64(&x251, &x252, x250, x215, x239);
2611	var x253: u64 = undefined;
2612	var x254: u1 = undefined;
2613	addcarryxU64(&x253, &x254, x252, x217, x241);
2614	var x255: u64 = undefined;
2615	var x256: u1 = undefined;
2616	addcarryxU64(&x255, &x256, x254, x219, x243);
2617	var x257: u64 = undefined;
2618	var x258: u1 = undefined;
2619	addcarryxU64(&x257, &x258, x256, (@as(u64, x220) + @as(u64, x192)), (@as(u64, x244) + x224));
2620	var x259: u64 = undefined;
2621	var x260: u64 = undefined;
2622	mulxU64(&x259, &x260, x4, 0x200000000);
2623	var x261: u64 = undefined;
2624	var x262: u64 = undefined;
2625	mulxU64(&x261, &x262, x4, 0xfffffffe00000000);
2626	var x263: u64 = undefined;
2627	var x264: u64 = undefined;
2628	mulxU64(&x263, &x264, x4, 0x200000000);
2629	var x265: u64 = undefined;
2630	var x266: u64 = undefined;
2631	mulxU64(&x265, &x266, x4, 0xfffffffe00000001);
2632	var x267: u64 = undefined;
2633	var x268: u1 = undefined;
2634	addcarryxU64(&x267, &x268, 0x0, x266, x263);
2635	var x269: u64 = undefined;
2636	var x270: u1 = undefined;
2637	addcarryxU64(&x269, &x270, x268, x264, x261);
2638	var x271: u64 = undefined;
2639	var x272: u1 = undefined;
2640	addcarryxU64(&x271, &x272, x270, x262, x259);
2641	var x273: u64 = undefined;
2642	var x274: u1 = undefined;
2643	addcarryxU64(&x273, &x274, x272, x260, x4);
2644	var x275: u64 = undefined;
2645	var x276: u1 = undefined;
2646	addcarryxU64(&x275, &x276, 0x0, x247, x265);
2647	var x277: u64 = undefined;
2648	var x278: u1 = undefined;
2649	addcarryxU64(&x277, &x278, x276, x249, x267);
2650	var x279: u64 = undefined;
2651	var x280: u1 = undefined;
2652	addcarryxU64(&x279, &x280, x278, x251, x269);
2653	var x281: u64 = undefined;
2654	var x282: u1 = undefined;
2655	addcarryxU64(&x281, &x282, x280, x253, x271);
2656	var x283: u64 = undefined;
2657	var x284: u1 = undefined;
2658	addcarryxU64(&x283, &x284, x282, x255, x273);
2659	var x285: u64 = undefined;
2660	var x286: u1 = undefined;
2661	addcarryxU64(&x285, &x286, x284, x257, @as(u64, x274));
2662	var x287: u64 = undefined;
2663	var x288: u64 = undefined;
2664	mulxU64(&x287, &x288, x275, 0x100000001);
2665	var x289: u64 = undefined;
2666	var x290: u64 = undefined;
2667	mulxU64(&x289, &x290, x287, 0xffffffffffffffff);
2668	var x291: u64 = undefined;
2669	var x292: u64 = undefined;
2670	mulxU64(&x291, &x292, x287, 0xffffffffffffffff);
2671	var x293: u64 = undefined;
2672	var x294: u64 = undefined;
2673	mulxU64(&x293, &x294, x287, 0xffffffffffffffff);
2674	var x295: u64 = undefined;
2675	var x296: u64 = undefined;
2676	mulxU64(&x295, &x296, x287, 0xfffffffffffffffe);
2677	var x297: u64 = undefined;
2678	var x298: u64 = undefined;
2679	mulxU64(&x297, &x298, x287, 0xffffffff00000000);
2680	var x299: u64 = undefined;
2681	var x300: u64 = undefined;
2682	mulxU64(&x299, &x300, x287, 0xffffffff);
2683	var x301: u64 = undefined;
2684	var x302: u1 = undefined;
2685	addcarryxU64(&x301, &x302, 0x0, x300, x297);
2686	var x303: u64 = undefined;
2687	var x304: u1 = undefined;
2688	addcarryxU64(&x303, &x304, x302, x298, x295);
2689	var x305: u64 = undefined;
2690	var x306: u1 = undefined;
2691	addcarryxU64(&x305, &x306, x304, x296, x293);
2692	var x307: u64 = undefined;
2693	var x308: u1 = undefined;
2694	addcarryxU64(&x307, &x308, x306, x294, x291);
2695	var x309: u64 = undefined;
2696	var x310: u1 = undefined;
2697	addcarryxU64(&x309, &x310, x308, x292, x289);
2698	var x311: u64 = undefined;
2699	var x312: u1 = undefined;
2700	addcarryxU64(&x311, &x312, 0x0, x275, x299);
2701	var x313: u64 = undefined;
2702	var x314: u1 = undefined;
2703	addcarryxU64(&x313, &x314, x312, x277, x301);
2704	var x315: u64 = undefined;
2705	var x316: u1 = undefined;
2706	addcarryxU64(&x315, &x316, x314, x279, x303);
2707	var x317: u64 = undefined;
2708	var x318: u1 = undefined;
2709	addcarryxU64(&x317, &x318, x316, x281, x305);
2710	var x319: u64 = undefined;
2711	var x320: u1 = undefined;
2712	addcarryxU64(&x319, &x320, x318, x283, x307);
2713	var x321: u64 = undefined;
2714	var x322: u1 = undefined;
2715	addcarryxU64(&x321, &x322, x320, x285, x309);
2716	var x323: u64 = undefined;
2717	var x324: u1 = undefined;
2718	addcarryxU64(&x323, &x324, x322, (@as(u64, x286) + @as(u64, x258)), (@as(u64, x310) + x290));
2719	var x325: u64 = undefined;
2720	var x326: u64 = undefined;
2721	mulxU64(&x325, &x326, x5, 0x200000000);
2722	var x327: u64 = undefined;
2723	var x328: u64 = undefined;
2724	mulxU64(&x327, &x328, x5, 0xfffffffe00000000);
2725	var x329: u64 = undefined;
2726	var x330: u64 = undefined;
2727	mulxU64(&x329, &x330, x5, 0x200000000);
2728	var x331: u64 = undefined;
2729	var x332: u64 = undefined;
2730	mulxU64(&x331, &x332, x5, 0xfffffffe00000001);
2731	var x333: u64 = undefined;
2732	var x334: u1 = undefined;
2733	addcarryxU64(&x333, &x334, 0x0, x332, x329);
2734	var x335: u64 = undefined;
2735	var x336: u1 = undefined;
2736	addcarryxU64(&x335, &x336, x334, x330, x327);
2737	var x337: u64 = undefined;
2738	var x338: u1 = undefined;
2739	addcarryxU64(&x337, &x338, x336, x328, x325);
2740	var x339: u64 = undefined;
2741	var x340: u1 = undefined;
2742	addcarryxU64(&x339, &x340, x338, x326, x5);
2743	var x341: u64 = undefined;
2744	var x342: u1 = undefined;
2745	addcarryxU64(&x341, &x342, 0x0, x313, x331);
2746	var x343: u64 = undefined;
2747	var x344: u1 = undefined;
2748	addcarryxU64(&x343, &x344, x342, x315, x333);
2749	var x345: u64 = undefined;
2750	var x346: u1 = undefined;
2751	addcarryxU64(&x345, &x346, x344, x317, x335);
2752	var x347: u64 = undefined;
2753	var x348: u1 = undefined;
2754	addcarryxU64(&x347, &x348, x346, x319, x337);
2755	var x349: u64 = undefined;
2756	var x350: u1 = undefined;
2757	addcarryxU64(&x349, &x350, x348, x321, x339);
2758	var x351: u64 = undefined;
2759	var x352: u1 = undefined;
2760	addcarryxU64(&x351, &x352, x350, x323, @as(u64, x340));
2761	var x353: u64 = undefined;
2762	var x354: u64 = undefined;
2763	mulxU64(&x353, &x354, x341, 0x100000001);
2764	var x355: u64 = undefined;
2765	var x356: u64 = undefined;
2766	mulxU64(&x355, &x356, x353, 0xffffffffffffffff);
2767	var x357: u64 = undefined;
2768	var x358: u64 = undefined;
2769	mulxU64(&x357, &x358, x353, 0xffffffffffffffff);
2770	var x359: u64 = undefined;
2771	var x360: u64 = undefined;
2772	mulxU64(&x359, &x360, x353, 0xffffffffffffffff);
2773	var x361: u64 = undefined;
2774	var x362: u64 = undefined;
2775	mulxU64(&x361, &x362, x353, 0xfffffffffffffffe);
2776	var x363: u64 = undefined;
2777	var x364: u64 = undefined;
2778	mulxU64(&x363, &x364, x353, 0xffffffff00000000);
2779	var x365: u64 = undefined;
2780	var x366: u64 = undefined;
2781	mulxU64(&x365, &x366, x353, 0xffffffff);
2782	var x367: u64 = undefined;
2783	var x368: u1 = undefined;
2784	addcarryxU64(&x367, &x368, 0x0, x366, x363);
2785	var x369: u64 = undefined;
2786	var x370: u1 = undefined;
2787	addcarryxU64(&x369, &x370, x368, x364, x361);
2788	var x371: u64 = undefined;
2789	var x372: u1 = undefined;
2790	addcarryxU64(&x371, &x372, x370, x362, x359);
2791	var x373: u64 = undefined;
2792	var x374: u1 = undefined;
2793	addcarryxU64(&x373, &x374, x372, x360, x357);
2794	var x375: u64 = undefined;
2795	var x376: u1 = undefined;
2796	addcarryxU64(&x375, &x376, x374, x358, x355);
2797	var x377: u64 = undefined;
2798	var x378: u1 = undefined;
2799	addcarryxU64(&x377, &x378, 0x0, x341, x365);
2800	var x379: u64 = undefined;
2801	var x380: u1 = undefined;
2802	addcarryxU64(&x379, &x380, x378, x343, x367);
2803	var x381: u64 = undefined;
2804	var x382: u1 = undefined;
2805	addcarryxU64(&x381, &x382, x380, x345, x369);
2806	var x383: u64 = undefined;
2807	var x384: u1 = undefined;
2808	addcarryxU64(&x383, &x384, x382, x347, x371);
2809	var x385: u64 = undefined;
2810	var x386: u1 = undefined;
2811	addcarryxU64(&x385, &x386, x384, x349, x373);
2812	var x387: u64 = undefined;
2813	var x388: u1 = undefined;
2814	addcarryxU64(&x387, &x388, x386, x351, x375);
2815	var x389: u64 = undefined;
2816	var x390: u1 = undefined;
2817	addcarryxU64(&x389, &x390, x388, (@as(u64, x352) + @as(u64, x324)), (@as(u64, x376) + x356));
2818	var x391: u64 = undefined;
2819	var x392: u1 = undefined;
2820	subborrowxU64(&x391, &x392, 0x0, x379, 0xffffffff);
2821	var x393: u64 = undefined;
2822	var x394: u1 = undefined;
2823	subborrowxU64(&x393, &x394, x392, x381, 0xffffffff00000000);
2824	var x395: u64 = undefined;
2825	var x396: u1 = undefined;
2826	subborrowxU64(&x395, &x396, x394, x383, 0xfffffffffffffffe);
2827	var x397: u64 = undefined;
2828	var x398: u1 = undefined;
2829	subborrowxU64(&x397, &x398, x396, x385, 0xffffffffffffffff);
2830	var x399: u64 = undefined;
2831	var x400: u1 = undefined;
2832	subborrowxU64(&x399, &x400, x398, x387, 0xffffffffffffffff);
2833	var x401: u64 = undefined;
2834	var x402: u1 = undefined;
2835	subborrowxU64(&x401, &x402, x400, x389, 0xffffffffffffffff);
2836	var x403: u64 = undefined;
2837	var x404: u1 = undefined;
2838	subborrowxU64(&x403, &x404, x402, @as(u64, x390), 0x0);
2839	var x405: u64 = undefined;
2840	cmovznzU64(&x405, x404, x391, x379);
2841	var x406: u64 = undefined;
2842	cmovznzU64(&x406, x404, x393, x381);
2843	var x407: u64 = undefined;
2844	cmovznzU64(&x407, x404, x395, x383);
2845	var x408: u64 = undefined;
2846	cmovznzU64(&x408, x404, x397, x385);
2847	var x409: u64 = undefined;
2848	cmovznzU64(&x409, x404, x399, x387);
2849	var x410: u64 = undefined;
2850	cmovznzU64(&x410, x404, x401, x389);
2851	out1[0] = x405;
2852	out1[1] = x406;
2853	out1[2] = x407;
2854	out1[3] = x408;
2855	out1[4] = x409;
2856	out1[5] = x410;
2857	}
2858
2859	/// The function nonzero outputs a single non-zero word if the input is non-zero and zero otherwise.
2860	///
2861	/// Preconditions:
2862	/// 0 ≤ eval arg1 < m
2863	/// Postconditions:
2864	/// out1 = 0 ↔ eval (from_montgomery arg1) mod m = 0
2865	///
2866	/// Input Bounds:
2867	/// arg1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
2868	/// Output Bounds:
2869	/// out1: [0x0 ~> 0xffffffffffffffff]
2870	pub fn nonzero(out1: *u64, arg1: [6]u64) void {
2871	@setRuntimeSafety(mode == .Debug);
2872
2873	const x1 = ((arg1[0]) \| ((arg1[1]) \| ((arg1[2]) \| ((arg1[3]) \| ((arg1[4]) \| (arg1[5]))))));
2874	out1.* = x1;
2875	}
2876
2877	/// The function selectznz is a multi-limb conditional select.
2878	///
2879	/// Postconditions:
2880	/// out1 = (if arg1 = 0 then arg2 else arg3)
2881	///
2882	/// Input Bounds:
2883	/// arg1: [0x0 ~> 0x1]
2884	/// arg2: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
2885	/// arg3: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
2886	/// Output Bounds:
2887	/// out1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
2888	pub fn selectznz(out1: *[6]u64, arg1: u1, arg2: [6]u64, arg3: [6]u64) void {
2889	@setRuntimeSafety(mode == .Debug);
2890
2891	var x1: u64 = undefined;
2892	cmovznzU64(&x1, arg1, (arg2[0]), (arg3[0]));
2893	var x2: u64 = undefined;
2894	cmovznzU64(&x2, arg1, (arg2[1]), (arg3[1]));
2895	var x3: u64 = undefined;
2896	cmovznzU64(&x3, arg1, (arg2[2]), (arg3[2]));
2897	var x4: u64 = undefined;
2898	cmovznzU64(&x4, arg1, (arg2[3]), (arg3[3]));
2899	var x5: u64 = undefined;
2900	cmovznzU64(&x5, arg1, (arg2[4]), (arg3[4]));
2901	var x6: u64 = undefined;
2902	cmovznzU64(&x6, arg1, (arg2[5]), (arg3[5]));
2903	out1[0] = x1;
2904	out1[1] = x2;
2905	out1[2] = x3;
2906	out1[3] = x4;
2907	out1[4] = x5;
2908	out1[5] = x6;
2909	}
2910
2911	/// The function toBytes serializes a field element NOT in the Montgomery domain to bytes in little-endian order.
2912	///
2913	/// Preconditions:
2914	/// 0 ≤ eval arg1 < m
2915	/// Postconditions:
2916	/// out1 = map (λ x, ⌊((eval arg1 mod m) mod 2^(8 * (x + 1))) / 2^(8 * x)⌋) [0..47]
2917	///
2918	/// Input Bounds:
2919	/// arg1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
2920	/// Output Bounds:
2921	/// out1: [[0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff]]
2922	pub fn toBytes(out1: *[48]u8, arg1: [6]u64) void {
2923	@setRuntimeSafety(mode == .Debug);
2924
2925	const x1 = (arg1[5]);
2926	const x2 = (arg1[4]);
2927	const x3 = (arg1[3]);
2928	const x4 = (arg1[2]);
2929	const x5 = (arg1[1]);
2930	const x6 = (arg1[0]);
2931	const x7 = @truncate(u8, (x6 & 0xff));
2932	const x8 = (x6 >> 8);
2933	const x9 = @truncate(u8, (x8 & 0xff));
2934	const x10 = (x8 >> 8);
2935	const x11 = @truncate(u8, (x10 & 0xff));
2936	const x12 = (x10 >> 8);
2937	const x13 = @truncate(u8, (x12 & 0xff));
2938	const x14 = (x12 >> 8);
2939	const x15 = @truncate(u8, (x14 & 0xff));
2940	const x16 = (x14 >> 8);
2941	const x17 = @truncate(u8, (x16 & 0xff));
2942	const x18 = (x16 >> 8);
2943	const x19 = @truncate(u8, (x18 & 0xff));
2944	const x20 = @truncate(u8, (x18 >> 8));
2945	const x21 = @truncate(u8, (x5 & 0xff));
2946	const x22 = (x5 >> 8);
2947	const x23 = @truncate(u8, (x22 & 0xff));
2948	const x24 = (x22 >> 8);
2949	const x25 = @truncate(u8, (x24 & 0xff));
2950	const x26 = (x24 >> 8);
2951	const x27 = @truncate(u8, (x26 & 0xff));
2952	const x28 = (x26 >> 8);
2953	const x29 = @truncate(u8, (x28 & 0xff));
2954	const x30 = (x28 >> 8);
2955	const x31 = @truncate(u8, (x30 & 0xff));
2956	const x32 = (x30 >> 8);
2957	const x33 = @truncate(u8, (x32 & 0xff));
2958	const x34 = @truncate(u8, (x32 >> 8));
2959	const x35 = @truncate(u8, (x4 & 0xff));
2960	const x36 = (x4 >> 8);
2961	const x37 = @truncate(u8, (x36 & 0xff));
2962	const x38 = (x36 >> 8);
2963	const x39 = @truncate(u8, (x38 & 0xff));
2964	const x40 = (x38 >> 8);
2965	const x41 = @truncate(u8, (x40 & 0xff));
2966	const x42 = (x40 >> 8);
2967	const x43 = @truncate(u8, (x42 & 0xff));
2968	const x44 = (x42 >> 8);
2969	const x45 = @truncate(u8, (x44 & 0xff));
2970	const x46 = (x44 >> 8);
2971	const x47 = @truncate(u8, (x46 & 0xff));
2972	const x48 = @truncate(u8, (x46 >> 8));
2973	const x49 = @truncate(u8, (x3 & 0xff));
2974	const x50 = (x3 >> 8);
2975	const x51 = @truncate(u8, (x50 & 0xff));
2976	const x52 = (x50 >> 8);
2977	const x53 = @truncate(u8, (x52 & 0xff));
2978	const x54 = (x52 >> 8);
2979	const x55 = @truncate(u8, (x54 & 0xff));
2980	const x56 = (x54 >> 8);
2981	const x57 = @truncate(u8, (x56 & 0xff));
2982	const x58 = (x56 >> 8);
2983	const x59 = @truncate(u8, (x58 & 0xff));
2984	const x60 = (x58 >> 8);
2985	const x61 = @truncate(u8, (x60 & 0xff));
2986	const x62 = @truncate(u8, (x60 >> 8));
2987	const x63 = @truncate(u8, (x2 & 0xff));
2988	const x64 = (x2 >> 8);
2989	const x65 = @truncate(u8, (x64 & 0xff));
2990	const x66 = (x64 >> 8);
2991	const x67 = @truncate(u8, (x66 & 0xff));
2992	const x68 = (x66 >> 8);
2993	const x69 = @truncate(u8, (x68 & 0xff));
2994	const x70 = (x68 >> 8);
2995	const x71 = @truncate(u8, (x70 & 0xff));
2996	const x72 = (x70 >> 8);
2997	const x73 = @truncate(u8, (x72 & 0xff));
2998	const x74 = (x72 >> 8);
2999	const x75 = @truncate(u8, (x74 & 0xff));
3000	const x76 = @truncate(u8, (x74 >> 8));
3001	const x77 = @truncate(u8, (x1 & 0xff));
3002	const x78 = (x1 >> 8);
3003	const x79 = @truncate(u8, (x78 & 0xff));
3004	const x80 = (x78 >> 8);
3005	const x81 = @truncate(u8, (x80 & 0xff));
3006	const x82 = (x80 >> 8);
3007	const x83 = @truncate(u8, (x82 & 0xff));
3008	const x84 = (x82 >> 8);
3009	const x85 = @truncate(u8, (x84 & 0xff));
3010	const x86 = (x84 >> 8);
3011	const x87 = @truncate(u8, (x86 & 0xff));
3012	const x88 = (x86 >> 8);
3013	const x89 = @truncate(u8, (x88 & 0xff));
3014	const x90 = @truncate(u8, (x88 >> 8));
3015	out1[0] = x7;
3016	out1[1] = x9;
3017	out1[2] = x11;
3018	out1[3] = x13;
3019	out1[4] = x15;
3020	out1[5] = x17;
3021	out1[6] = x19;
3022	out1[7] = x20;
3023	out1[8] = x21;
3024	out1[9] = x23;
3025	out1[10] = x25;
3026	out1[11] = x27;
3027	out1[12] = x29;
3028	out1[13] = x31;
3029	out1[14] = x33;
3030	out1[15] = x34;
3031	out1[16] = x35;
3032	out1[17] = x37;
3033	out1[18] = x39;
3034	out1[19] = x41;
3035	out1[20] = x43;
3036	out1[21] = x45;
3037	out1[22] = x47;
3038	out1[23] = x48;
3039	out1[24] = x49;
3040	out1[25] = x51;
3041	out1[26] = x53;
3042	out1[27] = x55;
3043	out1[28] = x57;
3044	out1[29] = x59;
3045	out1[30] = x61;
3046	out1[31] = x62;
3047	out1[32] = x63;
3048	out1[33] = x65;
3049	out1[34] = x67;
3050	out1[35] = x69;
3051	out1[36] = x71;
3052	out1[37] = x73;
3053	out1[38] = x75;
3054	out1[39] = x76;
3055	out1[40] = x77;
3056	out1[41] = x79;
3057	out1[42] = x81;
3058	out1[43] = x83;
3059	out1[44] = x85;
3060	out1[45] = x87;
3061	out1[46] = x89;
3062	out1[47] = x90;
3063	}
3064
3065	/// The function fromBytes deserializes a field element NOT in the Montgomery domain from bytes in little-endian order.
3066	///
3067	/// Preconditions:
3068	/// 0 ≤ bytes_eval arg1 < m
3069	/// Postconditions:
3070	/// eval out1 mod m = bytes_eval arg1 mod m
3071	/// 0 ≤ eval out1 < m
3072	///
3073	/// Input Bounds:
3074	/// arg1: [[0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff]]
3075	/// Output Bounds:
3076	/// out1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
3077	pub fn fromBytes(out1: *[6]u64, arg1: [48]u8) void {
3078	@setRuntimeSafety(mode == .Debug);
3079
3080	const x1 = (@as(u64, (arg1[47])) << 56);
3081	const x2 = (@as(u64, (arg1[46])) << 48);
3082	const x3 = (@as(u64, (arg1[45])) << 40);
3083	const x4 = (@as(u64, (arg1[44])) << 32);
3084	const x5 = (@as(u64, (arg1[43])) << 24);
3085	const x6 = (@as(u64, (arg1[42])) << 16);
3086	const x7 = (@as(u64, (arg1[41])) << 8);
3087	const x8 = (arg1[40]);
3088	const x9 = (@as(u64, (arg1[39])) << 56);
3089	const x10 = (@as(u64, (arg1[38])) << 48);
3090	const x11 = (@as(u64, (arg1[37])) << 40);
3091	const x12 = (@as(u64, (arg1[36])) << 32);
3092	const x13 = (@as(u64, (arg1[35])) << 24);
3093	const x14 = (@as(u64, (arg1[34])) << 16);
3094	const x15 = (@as(u64, (arg1[33])) << 8);
3095	const x16 = (arg1[32]);
3096	const x17 = (@as(u64, (arg1[31])) << 56);
3097	const x18 = (@as(u64, (arg1[30])) << 48);
3098	const x19 = (@as(u64, (arg1[29])) << 40);
3099	const x20 = (@as(u64, (arg1[28])) << 32);
3100	const x21 = (@as(u64, (arg1[27])) << 24);
3101	const x22 = (@as(u64, (arg1[26])) << 16);
3102	const x23 = (@as(u64, (arg1[25])) << 8);
3103	const x24 = (arg1[24]);
3104	const x25 = (@as(u64, (arg1[23])) << 56);
3105	const x26 = (@as(u64, (arg1[22])) << 48);
3106	const x27 = (@as(u64, (arg1[21])) << 40);
3107	const x28 = (@as(u64, (arg1[20])) << 32);
3108	const x29 = (@as(u64, (arg1[19])) << 24);
3109	const x30 = (@as(u64, (arg1[18])) << 16);
3110	const x31 = (@as(u64, (arg1[17])) << 8);
3111	const x32 = (arg1[16]);
3112	const x33 = (@as(u64, (arg1[15])) << 56);
3113	const x34 = (@as(u64, (arg1[14])) << 48);
3114	const x35 = (@as(u64, (arg1[13])) << 40);
3115	const x36 = (@as(u64, (arg1[12])) << 32);
3116	const x37 = (@as(u64, (arg1[11])) << 24);
3117	const x38 = (@as(u64, (arg1[10])) << 16);
3118	const x39 = (@as(u64, (arg1[9])) << 8);
3119	const x40 = (arg1[8]);
3120	const x41 = (@as(u64, (arg1[7])) << 56);
3121	const x42 = (@as(u64, (arg1[6])) << 48);
3122	const x43 = (@as(u64, (arg1[5])) << 40);
3123	const x44 = (@as(u64, (arg1[4])) << 32);
3124	const x45 = (@as(u64, (arg1[3])) << 24);
3125	const x46 = (@as(u64, (arg1[2])) << 16);
3126	const x47 = (@as(u64, (arg1[1])) << 8);
3127	const x48 = (arg1[0]);
3128	const x49 = (x47 + @as(u64, x48));
3129	const x50 = (x46 + x49);
3130	const x51 = (x45 + x50);
3131	const x52 = (x44 + x51);
3132	const x53 = (x43 + x52);
3133	const x54 = (x42 + x53);
3134	const x55 = (x41 + x54);
3135	const x56 = (x39 + @as(u64, x40));
3136	const x57 = (x38 + x56);
3137	const x58 = (x37 + x57);
3138	const x59 = (x36 + x58);
3139	const x60 = (x35 + x59);
3140	const x61 = (x34 + x60);
3141	const x62 = (x33 + x61);
3142	const x63 = (x31 + @as(u64, x32));
3143	const x64 = (x30 + x63);
3144	const x65 = (x29 + x64);
3145	const x66 = (x28 + x65);
3146	const x67 = (x27 + x66);
3147	const x68 = (x26 + x67);
3148	const x69 = (x25 + x68);
3149	const x70 = (x23 + @as(u64, x24));
3150	const x71 = (x22 + x70);
3151	const x72 = (x21 + x71);
3152	const x73 = (x20 + x72);
3153	const x74 = (x19 + x73);
3154	const x75 = (x18 + x74);
3155	const x76 = (x17 + x75);
3156	const x77 = (x15 + @as(u64, x16));
3157	const x78 = (x14 + x77);
3158	const x79 = (x13 + x78);
3159	const x80 = (x12 + x79);
3160	const x81 = (x11 + x80);
3161	const x82 = (x10 + x81);
3162	const x83 = (x9 + x82);
3163	const x84 = (x7 + @as(u64, x8));
3164	const x85 = (x6 + x84);
3165	const x86 = (x5 + x85);
3166	const x87 = (x4 + x86);
3167	const x88 = (x3 + x87);
3168	const x89 = (x2 + x88);
3169	const x90 = (x1 + x89);
3170	out1[0] = x55;
3171	out1[1] = x62;
3172	out1[2] = x69;
3173	out1[3] = x76;
3174	out1[4] = x83;
3175	out1[5] = x90;
3176	}
3177
3178	/// The function setOne returns the field element one in the Montgomery domain.
3179	///
3180	/// Postconditions:
3181	/// eval (from_montgomery out1) mod m = 1 mod m
3182	/// 0 ≤ eval out1 < m
3183	///
3184	pub fn setOne(out1: *MontgomeryDomainFieldElement) void {
3185	@setRuntimeSafety(mode == .Debug);
3186
3187	out1[0] = 0xffffffff00000001;
3188	out1[1] = 0xffffffff;
3189	out1[2] = 0x1;
3190	out1[3] = 0x0;
3191	out1[4] = 0x0;
3192	out1[5] = 0x0;
3193	}
3194
3195	/// The function msat returns the saturated representation of the prime modulus.
3196	///
3197	/// Postconditions:
3198	/// twos_complement_eval out1 = m
3199	/// 0 ≤ eval out1 < m
3200	///
3201	/// Output Bounds:
3202	/// out1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
3203	pub fn msat(out1: *[7]u64) void {
3204	@setRuntimeSafety(mode == .Debug);
3205
3206	out1[0] = 0xffffffff;
3207	out1[1] = 0xffffffff00000000;
3208	out1[2] = 0xfffffffffffffffe;
3209	out1[3] = 0xffffffffffffffff;
3210	out1[4] = 0xffffffffffffffff;
3211	out1[5] = 0xffffffffffffffff;
3212	out1[6] = 0x0;
3213	}
3214
3215	/// The function divstep computes a divstep.
3216	///
3217	/// Preconditions:
3218	/// 0 ≤ eval arg4 < m
3219	/// 0 ≤ eval arg5 < m
3220	/// Postconditions:
3221	/// out1 = (if 0 < arg1 ∧ (twos_complement_eval arg3) is odd then 1 - arg1 else 1 + arg1)
3222	/// twos_complement_eval out2 = (if 0 < arg1 ∧ (twos_complement_eval arg3) is odd then twos_complement_eval arg3 else twos_complement_eval arg2)
3223	/// twos_complement_eval out3 = (if 0 < arg1 ∧ (twos_complement_eval arg3) is odd then ⌊(twos_complement_eval arg3 - twos_complement_eval arg2) / 2⌋ else ⌊(twos_complement_eval arg3 + (twos_complement_eval arg3 mod 2) * twos_complement_eval arg2) / 2⌋)
3224	/// eval (from_montgomery out4) mod m = (if 0 < arg1 ∧ (twos_complement_eval arg3) is odd then (2 * eval (from_montgomery arg5)) mod m else (2 * eval (from_montgomery arg4)) mod m)
3225	/// eval (from_montgomery out5) mod m = (if 0 < arg1 ∧ (twos_complement_eval arg3) is odd then (eval (from_montgomery arg4) - eval (from_montgomery arg4)) mod m else (eval (from_montgomery arg5) + (twos_complement_eval arg3 mod 2) * eval (from_montgomery arg4)) mod m)
3226	/// 0 ≤ eval out5 < m
3227	/// 0 ≤ eval out5 < m
3228	/// 0 ≤ eval out2 < m
3229	/// 0 ≤ eval out3 < m
3230	///
3231	/// Input Bounds:
3232	/// arg1: [0x0 ~> 0xffffffffffffffff]
3233	/// arg2: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
3234	/// arg3: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
3235	/// arg4: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
3236	/// arg5: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
3237	/// Output Bounds:
3238	/// out1: [0x0 ~> 0xffffffffffffffff]
3239	/// out2: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
3240	/// out3: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
3241	/// out4: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
3242	/// out5: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
3243	pub fn divstep(out1: u64, out2: [7]u64, out3: [7]u64, out4: [6]u64, out5: *[6]u64, arg1: u64, arg2: [7]u64, arg3: [7]u64, arg4: [6]u64, arg5: [6]u64) void {
3244	@setRuntimeSafety(mode == .Debug);
3245
3246	var x1: u64 = undefined;
3247	var x2: u1 = undefined;
3248	addcarryxU64(&x1, &x2, 0x0, (~arg1), 0x1);
3249	const x3 = (@truncate(u1, (x1 >> 63)) & @truncate(u1, ((arg3[0]) & 0x1)));
3250	var x4: u64 = undefined;
3251	var x5: u1 = undefined;
3252	addcarryxU64(&x4, &x5, 0x0, (~arg1), 0x1);
3253	var x6: u64 = undefined;
3254	cmovznzU64(&x6, x3, arg1, x4);
3255	var x7: u64 = undefined;
3256	cmovznzU64(&x7, x3, (arg2[0]), (arg3[0]));
3257	var x8: u64 = undefined;
3258	cmovznzU64(&x8, x3, (arg2[1]), (arg3[1]));
3259	var x9: u64 = undefined;
3260	cmovznzU64(&x9, x3, (arg2[2]), (arg3[2]));
3261	var x10: u64 = undefined;
3262	cmovznzU64(&x10, x3, (arg2[3]), (arg3[3]));
3263	var x11: u64 = undefined;
3264	cmovznzU64(&x11, x3, (arg2[4]), (arg3[4]));
3265	var x12: u64 = undefined;
3266	cmovznzU64(&x12, x3, (arg2[5]), (arg3[5]));
3267	var x13: u64 = undefined;
3268	cmovznzU64(&x13, x3, (arg2[6]), (arg3[6]));
3269	var x14: u64 = undefined;
3270	var x15: u1 = undefined;
3271	addcarryxU64(&x14, &x15, 0x0, 0x1, (~(arg2[0])));
3272	var x16: u64 = undefined;
3273	var x17: u1 = undefined;
3274	addcarryxU64(&x16, &x17, x15, 0x0, (~(arg2[1])));
3275	var x18: u64 = undefined;
3276	var x19: u1 = undefined;
3277	addcarryxU64(&x18, &x19, x17, 0x0, (~(arg2[2])));
3278	var x20: u64 = undefined;
3279	var x21: u1 = undefined;
3280	addcarryxU64(&x20, &x21, x19, 0x0, (~(arg2[3])));
3281	var x22: u64 = undefined;
3282	var x23: u1 = undefined;
3283	addcarryxU64(&x22, &x23, x21, 0x0, (~(arg2[4])));
3284	var x24: u64 = undefined;
3285	var x25: u1 = undefined;
3286	addcarryxU64(&x24, &x25, x23, 0x0, (~(arg2[5])));
3287	var x26: u64 = undefined;
3288	var x27: u1 = undefined;
3289	addcarryxU64(&x26, &x27, x25, 0x0, (~(arg2[6])));
3290	var x28: u64 = undefined;
3291	cmovznzU64(&x28, x3, (arg3[0]), x14);
3292	var x29: u64 = undefined;
3293	cmovznzU64(&x29, x3, (arg3[1]), x16);
3294	var x30: u64 = undefined;
3295	cmovznzU64(&x30, x3, (arg3[2]), x18);
3296	var x31: u64 = undefined;
3297	cmovznzU64(&x31, x3, (arg3[3]), x20);
3298	var x32: u64 = undefined;
3299	cmovznzU64(&x32, x3, (arg3[4]), x22);
3300	var x33: u64 = undefined;
3301	cmovznzU64(&x33, x3, (arg3[5]), x24);
3302	var x34: u64 = undefined;
3303	cmovznzU64(&x34, x3, (arg3[6]), x26);
3304	var x35: u64 = undefined;
3305	cmovznzU64(&x35, x3, (arg4[0]), (arg5[0]));
3306	var x36: u64 = undefined;
3307	cmovznzU64(&x36, x3, (arg4[1]), (arg5[1]));
3308	var x37: u64 = undefined;
3309	cmovznzU64(&x37, x3, (arg4[2]), (arg5[2]));
3310	var x38: u64 = undefined;
3311	cmovznzU64(&x38, x3, (arg4[3]), (arg5[3]));
3312	var x39: u64 = undefined;
3313	cmovznzU64(&x39, x3, (arg4[4]), (arg5[4]));
3314	var x40: u64 = undefined;
3315	cmovznzU64(&x40, x3, (arg4[5]), (arg5[5]));
3316	var x41: u64 = undefined;
3317	var x42: u1 = undefined;
3318	addcarryxU64(&x41, &x42, 0x0, x35, x35);
3319	var x43: u64 = undefined;
3320	var x44: u1 = undefined;
3321	addcarryxU64(&x43, &x44, x42, x36, x36);
3322	var x45: u64 = undefined;
3323	var x46: u1 = undefined;
3324	addcarryxU64(&x45, &x46, x44, x37, x37);
3325	var x47: u64 = undefined;
3326	var x48: u1 = undefined;
3327	addcarryxU64(&x47, &x48, x46, x38, x38);
3328	var x49: u64 = undefined;
3329	var x50: u1 = undefined;
3330	addcarryxU64(&x49, &x50, x48, x39, x39);
3331	var x51: u64 = undefined;
3332	var x52: u1 = undefined;
3333	addcarryxU64(&x51, &x52, x50, x40, x40);
3334	var x53: u64 = undefined;
3335	var x54: u1 = undefined;
3336	subborrowxU64(&x53, &x54, 0x0, x41, 0xffffffff);
3337	var x55: u64 = undefined;
3338	var x56: u1 = undefined;
3339	subborrowxU64(&x55, &x56, x54, x43, 0xffffffff00000000);
3340	var x57: u64 = undefined;
3341	var x58: u1 = undefined;
3342	subborrowxU64(&x57, &x58, x56, x45, 0xfffffffffffffffe);
3343	var x59: u64 = undefined;
3344	var x60: u1 = undefined;
3345	subborrowxU64(&x59, &x60, x58, x47, 0xffffffffffffffff);
3346	var x61: u64 = undefined;
3347	var x62: u1 = undefined;
3348	subborrowxU64(&x61, &x62, x60, x49, 0xffffffffffffffff);
3349	var x63: u64 = undefined;
3350	var x64: u1 = undefined;
3351	subborrowxU64(&x63, &x64, x62, x51, 0xffffffffffffffff);
3352	var x65: u64 = undefined;
3353	var x66: u1 = undefined;
3354	subborrowxU64(&x65, &x66, x64, @as(u64, x52), 0x0);
3355	const x67 = (arg4[5]);
3356	const x68 = (arg4[4]);
3357	const x69 = (arg4[3]);
3358	const x70 = (arg4[2]);
3359	const x71 = (arg4[1]);
3360	const x72 = (arg4[0]);
3361	var x73: u64 = undefined;
3362	var x74: u1 = undefined;
3363	subborrowxU64(&x73, &x74, 0x0, 0x0, x72);
3364	var x75: u64 = undefined;
3365	var x76: u1 = undefined;
3366	subborrowxU64(&x75, &x76, x74, 0x0, x71);
3367	var x77: u64 = undefined;
3368	var x78: u1 = undefined;
3369	subborrowxU64(&x77, &x78, x76, 0x0, x70);
3370	var x79: u64 = undefined;
3371	var x80: u1 = undefined;
3372	subborrowxU64(&x79, &x80, x78, 0x0, x69);
3373	var x81: u64 = undefined;
3374	var x82: u1 = undefined;
3375	subborrowxU64(&x81, &x82, x80, 0x0, x68);
3376	var x83: u64 = undefined;
3377	var x84: u1 = undefined;
3378	subborrowxU64(&x83, &x84, x82, 0x0, x67);
3379	var x85: u64 = undefined;
3380	cmovznzU64(&x85, x84, 0x0, 0xffffffffffffffff);
3381	var x86: u64 = undefined;
3382	var x87: u1 = undefined;
3383	addcarryxU64(&x86, &x87, 0x0, x73, (x85 & 0xffffffff));
3384	var x88: u64 = undefined;
3385	var x89: u1 = undefined;
3386	addcarryxU64(&x88, &x89, x87, x75, (x85 & 0xffffffff00000000));
3387	var x90: u64 = undefined;
3388	var x91: u1 = undefined;
3389	addcarryxU64(&x90, &x91, x89, x77, (x85 & 0xfffffffffffffffe));
3390	var x92: u64 = undefined;
3391	var x93: u1 = undefined;
3392	addcarryxU64(&x92, &x93, x91, x79, x85);
3393	var x94: u64 = undefined;
3394	var x95: u1 = undefined;
3395	addcarryxU64(&x94, &x95, x93, x81, x85);
3396	var x96: u64 = undefined;
3397	var x97: u1 = undefined;
3398	addcarryxU64(&x96, &x97, x95, x83, x85);
3399	var x98: u64 = undefined;
3400	cmovznzU64(&x98, x3, (arg5[0]), x86);
3401	var x99: u64 = undefined;
3402	cmovznzU64(&x99, x3, (arg5[1]), x88);
3403	var x100: u64 = undefined;
3404	cmovznzU64(&x100, x3, (arg5[2]), x90);
3405	var x101: u64 = undefined;
3406	cmovznzU64(&x101, x3, (arg5[3]), x92);
3407	var x102: u64 = undefined;
3408	cmovznzU64(&x102, x3, (arg5[4]), x94);
3409	var x103: u64 = undefined;
3410	cmovznzU64(&x103, x3, (arg5[5]), x96);
3411	const x104 = @truncate(u1, (x28 & 0x1));
3412	var x105: u64 = undefined;
3413	cmovznzU64(&x105, x104, 0x0, x7);
3414	var x106: u64 = undefined;
3415	cmovznzU64(&x106, x104, 0x0, x8);
3416	var x107: u64 = undefined;
3417	cmovznzU64(&x107, x104, 0x0, x9);
3418	var x108: u64 = undefined;
3419	cmovznzU64(&x108, x104, 0x0, x10);
3420	var x109: u64 = undefined;
3421	cmovznzU64(&x109, x104, 0x0, x11);
3422	var x110: u64 = undefined;
3423	cmovznzU64(&x110, x104, 0x0, x12);
3424	var x111: u64 = undefined;
3425	cmovznzU64(&x111, x104, 0x0, x13);
3426	var x112: u64 = undefined;
3427	var x113: u1 = undefined;
3428	addcarryxU64(&x112, &x113, 0x0, x28, x105);
3429	var x114: u64 = undefined;
3430	var x115: u1 = undefined;
3431	addcarryxU64(&x114, &x115, x113, x29, x106);
3432	var x116: u64 = undefined;
3433	var x117: u1 = undefined;
3434	addcarryxU64(&x116, &x117, x115, x30, x107);
3435	var x118: u64 = undefined;
3436	var x119: u1 = undefined;
3437	addcarryxU64(&x118, &x119, x117, x31, x108);
3438	var x120: u64 = undefined;
3439	var x121: u1 = undefined;
3440	addcarryxU64(&x120, &x121, x119, x32, x109);
3441	var x122: u64 = undefined;
3442	var x123: u1 = undefined;
3443	addcarryxU64(&x122, &x123, x121, x33, x110);
3444	var x124: u64 = undefined;
3445	var x125: u1 = undefined;
3446	addcarryxU64(&x124, &x125, x123, x34, x111);
3447	var x126: u64 = undefined;
3448	cmovznzU64(&x126, x104, 0x0, x35);
3449	var x127: u64 = undefined;
3450	cmovznzU64(&x127, x104, 0x0, x36);
3451	var x128: u64 = undefined;
3452	cmovznzU64(&x128, x104, 0x0, x37);
3453	var x129: u64 = undefined;
3454	cmovznzU64(&x129, x104, 0x0, x38);
3455	var x130: u64 = undefined;
3456	cmovznzU64(&x130, x104, 0x0, x39);
3457	var x131: u64 = undefined;
3458	cmovznzU64(&x131, x104, 0x0, x40);
3459	var x132: u64 = undefined;
3460	var x133: u1 = undefined;
3461	addcarryxU64(&x132, &x133, 0x0, x98, x126);
3462	var x134: u64 = undefined;
3463	var x135: u1 = undefined;
3464	addcarryxU64(&x134, &x135, x133, x99, x127);
3465	var x136: u64 = undefined;
3466	var x137: u1 = undefined;
3467	addcarryxU64(&x136, &x137, x135, x100, x128);
3468	var x138: u64 = undefined;
3469	var x139: u1 = undefined;
3470	addcarryxU64(&x138, &x139, x137, x101, x129);
3471	var x140: u64 = undefined;
3472	var x141: u1 = undefined;
3473	addcarryxU64(&x140, &x141, x139, x102, x130);
3474	var x142: u64 = undefined;
3475	var x143: u1 = undefined;
3476	addcarryxU64(&x142, &x143, x141, x103, x131);
3477	var x144: u64 = undefined;
3478	var x145: u1 = undefined;
3479	subborrowxU64(&x144, &x145, 0x0, x132, 0xffffffff);
3480	var x146: u64 = undefined;
3481	var x147: u1 = undefined;
3482	subborrowxU64(&x146, &x147, x145, x134, 0xffffffff00000000);
3483	var x148: u64 = undefined;
3484	var x149: u1 = undefined;
3485	subborrowxU64(&x148, &x149, x147, x136, 0xfffffffffffffffe);
3486	var x150: u64 = undefined;
3487	var x151: u1 = undefined;
3488	subborrowxU64(&x150, &x151, x149, x138, 0xffffffffffffffff);
3489	var x152: u64 = undefined;
3490	var x153: u1 = undefined;
3491	subborrowxU64(&x152, &x153, x151, x140, 0xffffffffffffffff);
3492	var x154: u64 = undefined;
3493	var x155: u1 = undefined;
3494	subborrowxU64(&x154, &x155, x153, x142, 0xffffffffffffffff);
3495	var x156: u64 = undefined;
3496	var x157: u1 = undefined;
3497	subborrowxU64(&x156, &x157, x155, @as(u64, x143), 0x0);
3498	var x158: u64 = undefined;
3499	var x159: u1 = undefined;
3500	addcarryxU64(&x158, &x159, 0x0, x6, 0x1);
3501	const x160 = ((x112 >> 1) \| ((x114 << 63) & 0xffffffffffffffff));
3502	const x161 = ((x114 >> 1) \| ((x116 << 63) & 0xffffffffffffffff));
3503	const x162 = ((x116 >> 1) \| ((x118 << 63) & 0xffffffffffffffff));
3504	const x163 = ((x118 >> 1) \| ((x120 << 63) & 0xffffffffffffffff));
3505	const x164 = ((x120 >> 1) \| ((x122 << 63) & 0xffffffffffffffff));
3506	const x165 = ((x122 >> 1) \| ((x124 << 63) & 0xffffffffffffffff));
3507	const x166 = ((x124 & 0x8000000000000000) \| (x124 >> 1));
3508	var x167: u64 = undefined;
3509	cmovznzU64(&x167, x66, x53, x41);
3510	var x168: u64 = undefined;
3511	cmovznzU64(&x168, x66, x55, x43);
3512	var x169: u64 = undefined;
3513	cmovznzU64(&x169, x66, x57, x45);
3514	var x170: u64 = undefined;
3515	cmovznzU64(&x170, x66, x59, x47);
3516	var x171: u64 = undefined;
3517	cmovznzU64(&x171, x66, x61, x49);
3518	var x172: u64 = undefined;
3519	cmovznzU64(&x172, x66, x63, x51);
3520	var x173: u64 = undefined;
3521	cmovznzU64(&x173, x157, x144, x132);
3522	var x174: u64 = undefined;
3523	cmovznzU64(&x174, x157, x146, x134);
3524	var x175: u64 = undefined;
3525	cmovznzU64(&x175, x157, x148, x136);
3526	var x176: u64 = undefined;
3527	cmovznzU64(&x176, x157, x150, x138);
3528	var x177: u64 = undefined;
3529	cmovznzU64(&x177, x157, x152, x140);
3530	var x178: u64 = undefined;
3531	cmovznzU64(&x178, x157, x154, x142);
3532	out1.* = x158;
3533	out2[0] = x7;
3534	out2[1] = x8;
3535	out2[2] = x9;
3536	out2[3] = x10;
3537	out2[4] = x11;
3538	out2[5] = x12;
3539	out2[6] = x13;
3540	out3[0] = x160;
3541	out3[1] = x161;
3542	out3[2] = x162;
3543	out3[3] = x163;
3544	out3[4] = x164;
3545	out3[5] = x165;
3546	out3[6] = x166;
3547	out4[0] = x167;
3548	out4[1] = x168;
3549	out4[2] = x169;
3550	out4[3] = x170;
3551	out4[4] = x171;
3552	out4[5] = x172;
3553	out5[0] = x173;
3554	out5[1] = x174;
3555	out5[2] = x175;
3556	out5[3] = x176;
3557	out5[4] = x177;
3558	out5[5] = x178;
3559	}
3560
3561	/// The function divstepPrecomp returns the precomputed value for Bernstein-Yang-inversion (in montgomery form).
3562	///
3563	/// Postconditions:
3564	/// eval (from_montgomery out1) = ⌊(m - 1) / 2⌋^(if ⌊log2 m⌋ + 1 < 46 then ⌊(49 * (⌊log2 m⌋ + 1) + 80) / 17⌋ else ⌊(49 * (⌊log2 m⌋ + 1) + 57) / 17⌋)
3565	/// 0 ≤ eval out1 < m
3566	///
3567	/// Output Bounds:
3568	/// out1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
3569	pub fn divstepPrecomp(out1: *[6]u64) void {
3570	@setRuntimeSafety(mode == .Debug);
3571
3572	out1[0] = 0xfff69400fff18fff;
3573	out1[1] = 0x2b7feffffd3ff;
3574	out1[2] = 0xfffedbfffffe97ff;
3575	out1[3] = 0x2840000002fff;
3576	out1[4] = 0x6040000050400;
3577	out1[5] = 0xfffc480000038000;
3578	}

lib/std/crypto/pcurves/p384/p384_scalar_64.zig created+3632

...	@@ -0,0 +1,3632 @@
1	// Autogenerated: 'src/ExtractionOCaml/word_by_word_montgomery' --lang Zig --internal-static --public-function-case camelCase --private-function-case camelCase --public-type-case UpperCamelCase --private-type-case UpperCamelCase --no-prefix-fiat --package-name p384_scalar '' 64 '2^384 - 1388124618062372383947042015309946732620727252194336364173' mul square add sub opp from_montgomery to_montgomery nonzero selectznz to_bytes from_bytes one msat divstep divstep_precomp
2	// curve description (via package name): p384_scalar
3	// machine_wordsize = 64 (from "64")
4	// requested operations: mul, square, add, sub, opp, from_montgomery, to_montgomery, nonzero, selectznz, to_bytes, from_bytes, one, msat, divstep, divstep_precomp
5	// m = 0xffffffffffffffffffffffffffffffffffffffffffffffffc7634d81f4372ddf581a0db248b0a77aecec196accc52973 (from "2^384 - 1388124618062372383947042015309946732620727252194336364173")
6	//
7	// NOTE: In addition to the bounds specified above each function, all
8	// functions synthesized for this Montgomery arithmetic require the
9	// input to be strictly less than the prime modulus (m), and also
10	// require the input to be in the unique saturated representation.
11	// All functions also ensure that these two properties are true of
12	// return values.
13	//
14	// Computed values:
15	// eval z = z[0] + (z[1] << 64) + (z[2] << 128) + (z[3] << 192) + (z[4] << 256) + (z[5] << 0x140)
16	// bytes_eval z = z[0] + (z[1] << 8) + (z[2] << 16) + (z[3] << 24) + (z[4] << 32) + (z[5] << 40) + (z[6] << 48) + (z[7] << 56) + (z[8] << 64) + (z[9] << 72) + (z[10] << 80) + (z[11] << 88) + (z[12] << 96) + (z[13] << 104) + (z[14] << 112) + (z[15] << 120) + (z[16] << 128) + (z[17] << 136) + (z[18] << 144) + (z[19] << 152) + (z[20] << 160) + (z[21] << 168) + (z[22] << 176) + (z[23] << 184) + (z[24] << 192) + (z[25] << 200) + (z[26] << 208) + (z[27] << 216) + (z[28] << 224) + (z[29] << 232) + (z[30] << 240) + (z[31] << 248) + (z[32] << 256) + (z[33] << 0x108) + (z[34] << 0x110) + (z[35] << 0x118) + (z[36] << 0x120) + (z[37] << 0x128) + (z[38] << 0x130) + (z[39] << 0x138) + (z[40] << 0x140) + (z[41] << 0x148) + (z[42] << 0x150) + (z[43] << 0x158) + (z[44] << 0x160) + (z[45] << 0x168) + (z[46] << 0x170) + (z[47] << 0x178)
17	// twos_complement_eval z = let x1 := z[0] + (z[1] << 64) + (z[2] << 128) + (z[3] << 192) + (z[4] << 256) + (z[5] << 0x140) in
18	// if x1 & (2^384-1) < 2^383 then x1 & (2^384-1) else (x1 & (2^384-1)) - 2^384
19
20	const std = @import("std");
21	const mode = @import("builtin").mode; // Checked arithmetic is disabled in non-debug modes to avoid side channels
22
23	// The type MontgomeryDomainFieldElement is a field element in the Montgomery domain.
24	// Bounds: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
25	pub const MontgomeryDomainFieldElement = [6]u64;
26
27	// The type NonMontgomeryDomainFieldElement is a field element NOT in the Montgomery domain.
28	// Bounds: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
29	pub const NonMontgomeryDomainFieldElement = [6]u64;
30
31	/// The function addcarryxU64 is an addition with carry.
32	///
33	/// Postconditions:
34	/// out1 = (arg1 + arg2 + arg3) mod 2^64
35	/// out2 = ⌊(arg1 + arg2 + arg3) / 2^64⌋
36	///
37	/// Input Bounds:
38	/// arg1: [0x0 ~> 0x1]
39	/// arg2: [0x0 ~> 0xffffffffffffffff]
40	/// arg3: [0x0 ~> 0xffffffffffffffff]
41	/// Output Bounds:
42	/// out1: [0x0 ~> 0xffffffffffffffff]
43	/// out2: [0x0 ~> 0x1]
44	inline fn addcarryxU64(out1: u64, out2: u1, arg1: u1, arg2: u64, arg3: u64) void {
45	@setRuntimeSafety(mode == .Debug);
46
47	var t: u64 = undefined;
48	const carry1 = @addWithOverflow(u64, arg2, arg3, &t);
49	const carry2 = @addWithOverflow(u64, t, arg1, out1);
50	out2.* = @boolToInt(carry1) \| @boolToInt(carry2);
51	}
52
53	/// The function subborrowxU64 is a subtraction with borrow.
54	///
55	/// Postconditions:
56	/// out1 = (-arg1 + arg2 + -arg3) mod 2^64
57	/// out2 = -⌊(-arg1 + arg2 + -arg3) / 2^64⌋
58	///
59	/// Input Bounds:
60	/// arg1: [0x0 ~> 0x1]
61	/// arg2: [0x0 ~> 0xffffffffffffffff]
62	/// arg3: [0x0 ~> 0xffffffffffffffff]
63	/// Output Bounds:
64	/// out1: [0x0 ~> 0xffffffffffffffff]
65	/// out2: [0x0 ~> 0x1]
66	inline fn subborrowxU64(out1: u64, out2: u1, arg1: u1, arg2: u64, arg3: u64) void {
67	@setRuntimeSafety(mode == .Debug);
68
69	var t: u64 = undefined;
70	const carry1 = @subWithOverflow(u64, arg2, arg3, &t);
71	const carry2 = @subWithOverflow(u64, t, arg1, out1);
72	out2.* = @boolToInt(carry1) \| @boolToInt(carry2);
73	}
74
75	/// The function mulxU64 is a multiplication, returning the full double-width result.
76	///
77	/// Postconditions:
78	/// out1 = (arg1 * arg2) mod 2^64
79	/// out2 = ⌊arg1 * arg2 / 2^64⌋
80	///
81	/// Input Bounds:
82	/// arg1: [0x0 ~> 0xffffffffffffffff]
83	/// arg2: [0x0 ~> 0xffffffffffffffff]
84	/// Output Bounds:
85	/// out1: [0x0 ~> 0xffffffffffffffff]
86	/// out2: [0x0 ~> 0xffffffffffffffff]
87	inline fn mulxU64(out1: u64, out2: u64, arg1: u64, arg2: u64) void {
88	@setRuntimeSafety(mode == .Debug);
89
90	const x = @as(u128, arg1) * @as(u128, arg2);
91	out1.* = @truncate(u64, x);
92	out2.* = @truncate(u64, x >> 64);
93	}
94
95	/// The function cmovznzU64 is a single-word conditional move.
96	///
97	/// Postconditions:
98	/// out1 = (if arg1 = 0 then arg2 else arg3)
99	///
100	/// Input Bounds:
101	/// arg1: [0x0 ~> 0x1]
102	/// arg2: [0x0 ~> 0xffffffffffffffff]
103	/// arg3: [0x0 ~> 0xffffffffffffffff]
104	/// Output Bounds:
105	/// out1: [0x0 ~> 0xffffffffffffffff]
106	inline fn cmovznzU64(out1: *u64, arg1: u1, arg2: u64, arg3: u64) void {
107	@setRuntimeSafety(mode == .Debug);
108
109	const mask = 0 -% @as(u64, arg1);
110	out1.* = (mask & arg3) \| ((~mask) & arg2);
111	}
112
113	/// The function mul multiplies two field elements in the Montgomery domain.
114	///
115	/// Preconditions:
116	/// 0 ≤ eval arg1 < m
117	/// 0 ≤ eval arg2 < m
118	/// Postconditions:
119	/// eval (from_montgomery out1) mod m = (eval (from_montgomery arg1) * eval (from_montgomery arg2)) mod m
120	/// 0 ≤ eval out1 < m
121	///
122	pub fn mul(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldElement, arg2: MontgomeryDomainFieldElement) void {
123	@setRuntimeSafety(mode == .Debug);
124
125	const x1 = (arg1[1]);
126	const x2 = (arg1[2]);
127	const x3 = (arg1[3]);
128	const x4 = (arg1[4]);
129	const x5 = (arg1[5]);
130	const x6 = (arg1[0]);
131	var x7: u64 = undefined;
132	var x8: u64 = undefined;
133	mulxU64(&x7, &x8, x6, (arg2[5]));
134	var x9: u64 = undefined;
135	var x10: u64 = undefined;
136	mulxU64(&x9, &x10, x6, (arg2[4]));
137	var x11: u64 = undefined;
138	var x12: u64 = undefined;
139	mulxU64(&x11, &x12, x6, (arg2[3]));
140	var x13: u64 = undefined;
141	var x14: u64 = undefined;
142	mulxU64(&x13, &x14, x6, (arg2[2]));
143	var x15: u64 = undefined;
144	var x16: u64 = undefined;
145	mulxU64(&x15, &x16, x6, (arg2[1]));
146	var x17: u64 = undefined;
147	var x18: u64 = undefined;
148	mulxU64(&x17, &x18, x6, (arg2[0]));
149	var x19: u64 = undefined;
150	var x20: u1 = undefined;
151	addcarryxU64(&x19, &x20, 0x0, x18, x15);
152	var x21: u64 = undefined;
153	var x22: u1 = undefined;
154	addcarryxU64(&x21, &x22, x20, x16, x13);
155	var x23: u64 = undefined;
156	var x24: u1 = undefined;
157	addcarryxU64(&x23, &x24, x22, x14, x11);
158	var x25: u64 = undefined;
159	var x26: u1 = undefined;
160	addcarryxU64(&x25, &x26, x24, x12, x9);
161	var x27: u64 = undefined;
162	var x28: u1 = undefined;
163	addcarryxU64(&x27, &x28, x26, x10, x7);
164	const x29 = (@as(u64, x28) + x8);
165	var x30: u64 = undefined;
166	var x31: u64 = undefined;
167	mulxU64(&x30, &x31, x17, 0x6ed46089e88fdc45);
168	var x32: u64 = undefined;
169	var x33: u64 = undefined;
170	mulxU64(&x32, &x33, x30, 0xffffffffffffffff);
171	var x34: u64 = undefined;
172	var x35: u64 = undefined;
173	mulxU64(&x34, &x35, x30, 0xffffffffffffffff);
174	var x36: u64 = undefined;
175	var x37: u64 = undefined;
176	mulxU64(&x36, &x37, x30, 0xffffffffffffffff);
177	var x38: u64 = undefined;
178	var x39: u64 = undefined;
179	mulxU64(&x38, &x39, x30, 0xc7634d81f4372ddf);
180	var x40: u64 = undefined;
181	var x41: u64 = undefined;
182	mulxU64(&x40, &x41, x30, 0x581a0db248b0a77a);
183	var x42: u64 = undefined;
184	var x43: u64 = undefined;
185	mulxU64(&x42, &x43, x30, 0xecec196accc52973);
186	var x44: u64 = undefined;
187	var x45: u1 = undefined;
188	addcarryxU64(&x44, &x45, 0x0, x43, x40);
189	var x46: u64 = undefined;
190	var x47: u1 = undefined;
191	addcarryxU64(&x46, &x47, x45, x41, x38);
192	var x48: u64 = undefined;
193	var x49: u1 = undefined;
194	addcarryxU64(&x48, &x49, x47, x39, x36);
195	var x50: u64 = undefined;
196	var x51: u1 = undefined;
197	addcarryxU64(&x50, &x51, x49, x37, x34);
198	var x52: u64 = undefined;
199	var x53: u1 = undefined;
200	addcarryxU64(&x52, &x53, x51, x35, x32);
201	const x54 = (@as(u64, x53) + x33);
202	var x55: u64 = undefined;
203	var x56: u1 = undefined;
204	addcarryxU64(&x55, &x56, 0x0, x17, x42);
205	var x57: u64 = undefined;
206	var x58: u1 = undefined;
207	addcarryxU64(&x57, &x58, x56, x19, x44);
208	var x59: u64 = undefined;
209	var x60: u1 = undefined;
210	addcarryxU64(&x59, &x60, x58, x21, x46);
211	var x61: u64 = undefined;
212	var x62: u1 = undefined;
213	addcarryxU64(&x61, &x62, x60, x23, x48);
214	var x63: u64 = undefined;
215	var x64: u1 = undefined;
216	addcarryxU64(&x63, &x64, x62, x25, x50);
217	var x65: u64 = undefined;
218	var x66: u1 = undefined;
219	addcarryxU64(&x65, &x66, x64, x27, x52);
220	var x67: u64 = undefined;
221	var x68: u1 = undefined;
222	addcarryxU64(&x67, &x68, x66, x29, x54);
223	var x69: u64 = undefined;
224	var x70: u64 = undefined;
225	mulxU64(&x69, &x70, x1, (arg2[5]));
226	var x71: u64 = undefined;
227	var x72: u64 = undefined;
228	mulxU64(&x71, &x72, x1, (arg2[4]));
229	var x73: u64 = undefined;
230	var x74: u64 = undefined;
231	mulxU64(&x73, &x74, x1, (arg2[3]));
232	var x75: u64 = undefined;
233	var x76: u64 = undefined;
234	mulxU64(&x75, &x76, x1, (arg2[2]));
235	var x77: u64 = undefined;
236	var x78: u64 = undefined;
237	mulxU64(&x77, &x78, x1, (arg2[1]));
238	var x79: u64 = undefined;
239	var x80: u64 = undefined;
240	mulxU64(&x79, &x80, x1, (arg2[0]));
241	var x81: u64 = undefined;
242	var x82: u1 = undefined;
243	addcarryxU64(&x81, &x82, 0x0, x80, x77);
244	var x83: u64 = undefined;
245	var x84: u1 = undefined;
246	addcarryxU64(&x83, &x84, x82, x78, x75);
247	var x85: u64 = undefined;
248	var x86: u1 = undefined;
249	addcarryxU64(&x85, &x86, x84, x76, x73);
250	var x87: u64 = undefined;
251	var x88: u1 = undefined;
252	addcarryxU64(&x87, &x88, x86, x74, x71);
253	var x89: u64 = undefined;
254	var x90: u1 = undefined;
255	addcarryxU64(&x89, &x90, x88, x72, x69);
256	const x91 = (@as(u64, x90) + x70);
257	var x92: u64 = undefined;
258	var x93: u1 = undefined;
259	addcarryxU64(&x92, &x93, 0x0, x57, x79);
260	var x94: u64 = undefined;
261	var x95: u1 = undefined;
262	addcarryxU64(&x94, &x95, x93, x59, x81);
263	var x96: u64 = undefined;
264	var x97: u1 = undefined;
265	addcarryxU64(&x96, &x97, x95, x61, x83);
266	var x98: u64 = undefined;
267	var x99: u1 = undefined;
268	addcarryxU64(&x98, &x99, x97, x63, x85);
269	var x100: u64 = undefined;
270	var x101: u1 = undefined;
271	addcarryxU64(&x100, &x101, x99, x65, x87);
272	var x102: u64 = undefined;
273	var x103: u1 = undefined;
274	addcarryxU64(&x102, &x103, x101, x67, x89);
275	var x104: u64 = undefined;
276	var x105: u1 = undefined;
277	addcarryxU64(&x104, &x105, x103, @as(u64, x68), x91);
278	var x106: u64 = undefined;
279	var x107: u64 = undefined;
280	mulxU64(&x106, &x107, x92, 0x6ed46089e88fdc45);
281	var x108: u64 = undefined;
282	var x109: u64 = undefined;
283	mulxU64(&x108, &x109, x106, 0xffffffffffffffff);
284	var x110: u64 = undefined;
285	var x111: u64 = undefined;
286	mulxU64(&x110, &x111, x106, 0xffffffffffffffff);
287	var x112: u64 = undefined;
288	var x113: u64 = undefined;
289	mulxU64(&x112, &x113, x106, 0xffffffffffffffff);
290	var x114: u64 = undefined;
291	var x115: u64 = undefined;
292	mulxU64(&x114, &x115, x106, 0xc7634d81f4372ddf);
293	var x116: u64 = undefined;
294	var x117: u64 = undefined;
295	mulxU64(&x116, &x117, x106, 0x581a0db248b0a77a);
296	var x118: u64 = undefined;
297	var x119: u64 = undefined;
298	mulxU64(&x118, &x119, x106, 0xecec196accc52973);
299	var x120: u64 = undefined;
300	var x121: u1 = undefined;
301	addcarryxU64(&x120, &x121, 0x0, x119, x116);
302	var x122: u64 = undefined;
303	var x123: u1 = undefined;
304	addcarryxU64(&x122, &x123, x121, x117, x114);
305	var x124: u64 = undefined;
306	var x125: u1 = undefined;
307	addcarryxU64(&x124, &x125, x123, x115, x112);
308	var x126: u64 = undefined;
309	var x127: u1 = undefined;
310	addcarryxU64(&x126, &x127, x125, x113, x110);
311	var x128: u64 = undefined;
312	var x129: u1 = undefined;
313	addcarryxU64(&x128, &x129, x127, x111, x108);
314	const x130 = (@as(u64, x129) + x109);
315	var x131: u64 = undefined;
316	var x132: u1 = undefined;
317	addcarryxU64(&x131, &x132, 0x0, x92, x118);
318	var x133: u64 = undefined;
319	var x134: u1 = undefined;
320	addcarryxU64(&x133, &x134, x132, x94, x120);
321	var x135: u64 = undefined;
322	var x136: u1 = undefined;
323	addcarryxU64(&x135, &x136, x134, x96, x122);
324	var x137: u64 = undefined;
325	var x138: u1 = undefined;
326	addcarryxU64(&x137, &x138, x136, x98, x124);
327	var x139: u64 = undefined;
328	var x140: u1 = undefined;
329	addcarryxU64(&x139, &x140, x138, x100, x126);
330	var x141: u64 = undefined;
331	var x142: u1 = undefined;
332	addcarryxU64(&x141, &x142, x140, x102, x128);
333	var x143: u64 = undefined;
334	var x144: u1 = undefined;
335	addcarryxU64(&x143, &x144, x142, x104, x130);
336	const x145 = (@as(u64, x144) + @as(u64, x105));
337	var x146: u64 = undefined;
338	var x147: u64 = undefined;
339	mulxU64(&x146, &x147, x2, (arg2[5]));
340	var x148: u64 = undefined;
341	var x149: u64 = undefined;
342	mulxU64(&x148, &x149, x2, (arg2[4]));
343	var x150: u64 = undefined;
344	var x151: u64 = undefined;
345	mulxU64(&x150, &x151, x2, (arg2[3]));
346	var x152: u64 = undefined;
347	var x153: u64 = undefined;
348	mulxU64(&x152, &x153, x2, (arg2[2]));
349	var x154: u64 = undefined;
350	var x155: u64 = undefined;
351	mulxU64(&x154, &x155, x2, (arg2[1]));
352	var x156: u64 = undefined;
353	var x157: u64 = undefined;
354	mulxU64(&x156, &x157, x2, (arg2[0]));
355	var x158: u64 = undefined;
356	var x159: u1 = undefined;
357	addcarryxU64(&x158, &x159, 0x0, x157, x154);
358	var x160: u64 = undefined;
359	var x161: u1 = undefined;
360	addcarryxU64(&x160, &x161, x159, x155, x152);
361	var x162: u64 = undefined;
362	var x163: u1 = undefined;
363	addcarryxU64(&x162, &x163, x161, x153, x150);
364	var x164: u64 = undefined;
365	var x165: u1 = undefined;
366	addcarryxU64(&x164, &x165, x163, x151, x148);
367	var x166: u64 = undefined;
368	var x167: u1 = undefined;
369	addcarryxU64(&x166, &x167, x165, x149, x146);
370	const x168 = (@as(u64, x167) + x147);
371	var x169: u64 = undefined;
372	var x170: u1 = undefined;
373	addcarryxU64(&x169, &x170, 0x0, x133, x156);
374	var x171: u64 = undefined;
375	var x172: u1 = undefined;
376	addcarryxU64(&x171, &x172, x170, x135, x158);
377	var x173: u64 = undefined;
378	var x174: u1 = undefined;
379	addcarryxU64(&x173, &x174, x172, x137, x160);
380	var x175: u64 = undefined;
381	var x176: u1 = undefined;
382	addcarryxU64(&x175, &x176, x174, x139, x162);
383	var x177: u64 = undefined;
384	var x178: u1 = undefined;
385	addcarryxU64(&x177, &x178, x176, x141, x164);
386	var x179: u64 = undefined;
387	var x180: u1 = undefined;
388	addcarryxU64(&x179, &x180, x178, x143, x166);
389	var x181: u64 = undefined;
390	var x182: u1 = undefined;
391	addcarryxU64(&x181, &x182, x180, x145, x168);
392	var x183: u64 = undefined;
393	var x184: u64 = undefined;
394	mulxU64(&x183, &x184, x169, 0x6ed46089e88fdc45);
395	var x185: u64 = undefined;
396	var x186: u64 = undefined;
397	mulxU64(&x185, &x186, x183, 0xffffffffffffffff);
398	var x187: u64 = undefined;
399	var x188: u64 = undefined;
400	mulxU64(&x187, &x188, x183, 0xffffffffffffffff);
401	var x189: u64 = undefined;
402	var x190: u64 = undefined;
403	mulxU64(&x189, &x190, x183, 0xffffffffffffffff);
404	var x191: u64 = undefined;
405	var x192: u64 = undefined;
406	mulxU64(&x191, &x192, x183, 0xc7634d81f4372ddf);
407	var x193: u64 = undefined;
408	var x194: u64 = undefined;
409	mulxU64(&x193, &x194, x183, 0x581a0db248b0a77a);
410	var x195: u64 = undefined;
411	var x196: u64 = undefined;
412	mulxU64(&x195, &x196, x183, 0xecec196accc52973);
413	var x197: u64 = undefined;
414	var x198: u1 = undefined;
415	addcarryxU64(&x197, &x198, 0x0, x196, x193);
416	var x199: u64 = undefined;
417	var x200: u1 = undefined;
418	addcarryxU64(&x199, &x200, x198, x194, x191);
419	var x201: u64 = undefined;
420	var x202: u1 = undefined;
421	addcarryxU64(&x201, &x202, x200, x192, x189);
422	var x203: u64 = undefined;
423	var x204: u1 = undefined;
424	addcarryxU64(&x203, &x204, x202, x190, x187);
425	var x205: u64 = undefined;
426	var x206: u1 = undefined;
427	addcarryxU64(&x205, &x206, x204, x188, x185);
428	const x207 = (@as(u64, x206) + x186);
429	var x208: u64 = undefined;
430	var x209: u1 = undefined;
431	addcarryxU64(&x208, &x209, 0x0, x169, x195);
432	var x210: u64 = undefined;
433	var x211: u1 = undefined;
434	addcarryxU64(&x210, &x211, x209, x171, x197);
435	var x212: u64 = undefined;
436	var x213: u1 = undefined;
437	addcarryxU64(&x212, &x213, x211, x173, x199);
438	var x214: u64 = undefined;
439	var x215: u1 = undefined;
440	addcarryxU64(&x214, &x215, x213, x175, x201);
441	var x216: u64 = undefined;
442	var x217: u1 = undefined;
443	addcarryxU64(&x216, &x217, x215, x177, x203);
444	var x218: u64 = undefined;
445	var x219: u1 = undefined;
446	addcarryxU64(&x218, &x219, x217, x179, x205);
447	var x220: u64 = undefined;
448	var x221: u1 = undefined;
449	addcarryxU64(&x220, &x221, x219, x181, x207);
450	const x222 = (@as(u64, x221) + @as(u64, x182));
451	var x223: u64 = undefined;
452	var x224: u64 = undefined;
453	mulxU64(&x223, &x224, x3, (arg2[5]));
454	var x225: u64 = undefined;
455	var x226: u64 = undefined;
456	mulxU64(&x225, &x226, x3, (arg2[4]));
457	var x227: u64 = undefined;
458	var x228: u64 = undefined;
459	mulxU64(&x227, &x228, x3, (arg2[3]));
460	var x229: u64 = undefined;
461	var x230: u64 = undefined;
462	mulxU64(&x229, &x230, x3, (arg2[2]));
463	var x231: u64 = undefined;
464	var x232: u64 = undefined;
465	mulxU64(&x231, &x232, x3, (arg2[1]));
466	var x233: u64 = undefined;
467	var x234: u64 = undefined;
468	mulxU64(&x233, &x234, x3, (arg2[0]));
469	var x235: u64 = undefined;
470	var x236: u1 = undefined;
471	addcarryxU64(&x235, &x236, 0x0, x234, x231);
472	var x237: u64 = undefined;
473	var x238: u1 = undefined;
474	addcarryxU64(&x237, &x238, x236, x232, x229);
475	var x239: u64 = undefined;
476	var x240: u1 = undefined;
477	addcarryxU64(&x239, &x240, x238, x230, x227);
478	var x241: u64 = undefined;
479	var x242: u1 = undefined;
480	addcarryxU64(&x241, &x242, x240, x228, x225);
481	var x243: u64 = undefined;
482	var x244: u1 = undefined;
483	addcarryxU64(&x243, &x244, x242, x226, x223);
484	const x245 = (@as(u64, x244) + x224);
485	var x246: u64 = undefined;
486	var x247: u1 = undefined;
487	addcarryxU64(&x246, &x247, 0x0, x210, x233);
488	var x248: u64 = undefined;
489	var x249: u1 = undefined;
490	addcarryxU64(&x248, &x249, x247, x212, x235);
491	var x250: u64 = undefined;
492	var x251: u1 = undefined;
493	addcarryxU64(&x250, &x251, x249, x214, x237);
494	var x252: u64 = undefined;
495	var x253: u1 = undefined;
496	addcarryxU64(&x252, &x253, x251, x216, x239);
497	var x254: u64 = undefined;
498	var x255: u1 = undefined;
499	addcarryxU64(&x254, &x255, x253, x218, x241);
500	var x256: u64 = undefined;
501	var x257: u1 = undefined;
502	addcarryxU64(&x256, &x257, x255, x220, x243);
503	var x258: u64 = undefined;
504	var x259: u1 = undefined;
505	addcarryxU64(&x258, &x259, x257, x222, x245);
506	var x260: u64 = undefined;
507	var x261: u64 = undefined;
508	mulxU64(&x260, &x261, x246, 0x6ed46089e88fdc45);
509	var x262: u64 = undefined;
510	var x263: u64 = undefined;
511	mulxU64(&x262, &x263, x260, 0xffffffffffffffff);
512	var x264: u64 = undefined;
513	var x265: u64 = undefined;
514	mulxU64(&x264, &x265, x260, 0xffffffffffffffff);
515	var x266: u64 = undefined;
516	var x267: u64 = undefined;
517	mulxU64(&x266, &x267, x260, 0xffffffffffffffff);
518	var x268: u64 = undefined;
519	var x269: u64 = undefined;
520	mulxU64(&x268, &x269, x260, 0xc7634d81f4372ddf);
521	var x270: u64 = undefined;
522	var x271: u64 = undefined;
523	mulxU64(&x270, &x271, x260, 0x581a0db248b0a77a);
524	var x272: u64 = undefined;
525	var x273: u64 = undefined;
526	mulxU64(&x272, &x273, x260, 0xecec196accc52973);
527	var x274: u64 = undefined;
528	var x275: u1 = undefined;
529	addcarryxU64(&x274, &x275, 0x0, x273, x270);
530	var x276: u64 = undefined;
531	var x277: u1 = undefined;
532	addcarryxU64(&x276, &x277, x275, x271, x268);
533	var x278: u64 = undefined;
534	var x279: u1 = undefined;
535	addcarryxU64(&x278, &x279, x277, x269, x266);
536	var x280: u64 = undefined;
537	var x281: u1 = undefined;
538	addcarryxU64(&x280, &x281, x279, x267, x264);
539	var x282: u64 = undefined;
540	var x283: u1 = undefined;
541	addcarryxU64(&x282, &x283, x281, x265, x262);
542	const x284 = (@as(u64, x283) + x263);
543	var x285: u64 = undefined;
544	var x286: u1 = undefined;
545	addcarryxU64(&x285, &x286, 0x0, x246, x272);
546	var x287: u64 = undefined;
547	var x288: u1 = undefined;
548	addcarryxU64(&x287, &x288, x286, x248, x274);
549	var x289: u64 = undefined;
550	var x290: u1 = undefined;
551	addcarryxU64(&x289, &x290, x288, x250, x276);
552	var x291: u64 = undefined;
553	var x292: u1 = undefined;
554	addcarryxU64(&x291, &x292, x290, x252, x278);
555	var x293: u64 = undefined;
556	var x294: u1 = undefined;
557	addcarryxU64(&x293, &x294, x292, x254, x280);
558	var x295: u64 = undefined;
559	var x296: u1 = undefined;
560	addcarryxU64(&x295, &x296, x294, x256, x282);
561	var x297: u64 = undefined;
562	var x298: u1 = undefined;
563	addcarryxU64(&x297, &x298, x296, x258, x284);
564	const x299 = (@as(u64, x298) + @as(u64, x259));
565	var x300: u64 = undefined;
566	var x301: u64 = undefined;
567	mulxU64(&x300, &x301, x4, (arg2[5]));
568	var x302: u64 = undefined;
569	var x303: u64 = undefined;
570	mulxU64(&x302, &x303, x4, (arg2[4]));
571	var x304: u64 = undefined;
572	var x305: u64 = undefined;
573	mulxU64(&x304, &x305, x4, (arg2[3]));
574	var x306: u64 = undefined;
575	var x307: u64 = undefined;
576	mulxU64(&x306, &x307, x4, (arg2[2]));
577	var x308: u64 = undefined;
578	var x309: u64 = undefined;
579	mulxU64(&x308, &x309, x4, (arg2[1]));
580	var x310: u64 = undefined;
581	var x311: u64 = undefined;
582	mulxU64(&x310, &x311, x4, (arg2[0]));
583	var x312: u64 = undefined;
584	var x313: u1 = undefined;
585	addcarryxU64(&x312, &x313, 0x0, x311, x308);
586	var x314: u64 = undefined;
587	var x315: u1 = undefined;
588	addcarryxU64(&x314, &x315, x313, x309, x306);
589	var x316: u64 = undefined;
590	var x317: u1 = undefined;
591	addcarryxU64(&x316, &x317, x315, x307, x304);
592	var x318: u64 = undefined;
593	var x319: u1 = undefined;
594	addcarryxU64(&x318, &x319, x317, x305, x302);
595	var x320: u64 = undefined;
596	var x321: u1 = undefined;
597	addcarryxU64(&x320, &x321, x319, x303, x300);
598	const x322 = (@as(u64, x321) + x301);
599	var x323: u64 = undefined;
600	var x324: u1 = undefined;
601	addcarryxU64(&x323, &x324, 0x0, x287, x310);
602	var x325: u64 = undefined;
603	var x326: u1 = undefined;
604	addcarryxU64(&x325, &x326, x324, x289, x312);
605	var x327: u64 = undefined;
606	var x328: u1 = undefined;
607	addcarryxU64(&x327, &x328, x326, x291, x314);
608	var x329: u64 = undefined;
609	var x330: u1 = undefined;
610	addcarryxU64(&x329, &x330, x328, x293, x316);
611	var x331: u64 = undefined;
612	var x332: u1 = undefined;
613	addcarryxU64(&x331, &x332, x330, x295, x318);
614	var x333: u64 = undefined;
615	var x334: u1 = undefined;
616	addcarryxU64(&x333, &x334, x332, x297, x320);
617	var x335: u64 = undefined;
618	var x336: u1 = undefined;
619	addcarryxU64(&x335, &x336, x334, x299, x322);
620	var x337: u64 = undefined;
621	var x338: u64 = undefined;
622	mulxU64(&x337, &x338, x323, 0x6ed46089e88fdc45);
623	var x339: u64 = undefined;
624	var x340: u64 = undefined;
625	mulxU64(&x339, &x340, x337, 0xffffffffffffffff);
626	var x341: u64 = undefined;
627	var x342: u64 = undefined;
628	mulxU64(&x341, &x342, x337, 0xffffffffffffffff);
629	var x343: u64 = undefined;
630	var x344: u64 = undefined;
631	mulxU64(&x343, &x344, x337, 0xffffffffffffffff);
632	var x345: u64 = undefined;
633	var x346: u64 = undefined;
634	mulxU64(&x345, &x346, x337, 0xc7634d81f4372ddf);
635	var x347: u64 = undefined;
636	var x348: u64 = undefined;
637	mulxU64(&x347, &x348, x337, 0x581a0db248b0a77a);
638	var x349: u64 = undefined;
639	var x350: u64 = undefined;
640	mulxU64(&x349, &x350, x337, 0xecec196accc52973);
641	var x351: u64 = undefined;
642	var x352: u1 = undefined;
643	addcarryxU64(&x351, &x352, 0x0, x350, x347);
644	var x353: u64 = undefined;
645	var x354: u1 = undefined;
646	addcarryxU64(&x353, &x354, x352, x348, x345);
647	var x355: u64 = undefined;
648	var x356: u1 = undefined;
649	addcarryxU64(&x355, &x356, x354, x346, x343);
650	var x357: u64 = undefined;
651	var x358: u1 = undefined;
652	addcarryxU64(&x357, &x358, x356, x344, x341);
653	var x359: u64 = undefined;
654	var x360: u1 = undefined;
655	addcarryxU64(&x359, &x360, x358, x342, x339);
656	const x361 = (@as(u64, x360) + x340);
657	var x362: u64 = undefined;
658	var x363: u1 = undefined;
659	addcarryxU64(&x362, &x363, 0x0, x323, x349);
660	var x364: u64 = undefined;
661	var x365: u1 = undefined;
662	addcarryxU64(&x364, &x365, x363, x325, x351);
663	var x366: u64 = undefined;
664	var x367: u1 = undefined;
665	addcarryxU64(&x366, &x367, x365, x327, x353);
666	var x368: u64 = undefined;
667	var x369: u1 = undefined;
668	addcarryxU64(&x368, &x369, x367, x329, x355);
669	var x370: u64 = undefined;
670	var x371: u1 = undefined;
671	addcarryxU64(&x370, &x371, x369, x331, x357);
672	var x372: u64 = undefined;
673	var x373: u1 = undefined;
674	addcarryxU64(&x372, &x373, x371, x333, x359);
675	var x374: u64 = undefined;
676	var x375: u1 = undefined;
677	addcarryxU64(&x374, &x375, x373, x335, x361);
678	const x376 = (@as(u64, x375) + @as(u64, x336));
679	var x377: u64 = undefined;
680	var x378: u64 = undefined;
681	mulxU64(&x377, &x378, x5, (arg2[5]));
682	var x379: u64 = undefined;
683	var x380: u64 = undefined;
684	mulxU64(&x379, &x380, x5, (arg2[4]));
685	var x381: u64 = undefined;
686	var x382: u64 = undefined;
687	mulxU64(&x381, &x382, x5, (arg2[3]));
688	var x383: u64 = undefined;
689	var x384: u64 = undefined;
690	mulxU64(&x383, &x384, x5, (arg2[2]));
691	var x385: u64 = undefined;
692	var x386: u64 = undefined;
693	mulxU64(&x385, &x386, x5, (arg2[1]));
694	var x387: u64 = undefined;
695	var x388: u64 = undefined;
696	mulxU64(&x387, &x388, x5, (arg2[0]));
697	var x389: u64 = undefined;
698	var x390: u1 = undefined;
699	addcarryxU64(&x389, &x390, 0x0, x388, x385);
700	var x391: u64 = undefined;
701	var x392: u1 = undefined;
702	addcarryxU64(&x391, &x392, x390, x386, x383);
703	var x393: u64 = undefined;
704	var x394: u1 = undefined;
705	addcarryxU64(&x393, &x394, x392, x384, x381);
706	var x395: u64 = undefined;
707	var x396: u1 = undefined;
708	addcarryxU64(&x395, &x396, x394, x382, x379);
709	var x397: u64 = undefined;
710	var x398: u1 = undefined;
711	addcarryxU64(&x397, &x398, x396, x380, x377);
712	const x399 = (@as(u64, x398) + x378);
713	var x400: u64 = undefined;
714	var x401: u1 = undefined;
715	addcarryxU64(&x400, &x401, 0x0, x364, x387);
716	var x402: u64 = undefined;
717	var x403: u1 = undefined;
718	addcarryxU64(&x402, &x403, x401, x366, x389);
719	var x404: u64 = undefined;
720	var x405: u1 = undefined;
721	addcarryxU64(&x404, &x405, x403, x368, x391);
722	var x406: u64 = undefined;
723	var x407: u1 = undefined;
724	addcarryxU64(&x406, &x407, x405, x370, x393);
725	var x408: u64 = undefined;
726	var x409: u1 = undefined;
727	addcarryxU64(&x408, &x409, x407, x372, x395);
728	var x410: u64 = undefined;
729	var x411: u1 = undefined;
730	addcarryxU64(&x410, &x411, x409, x374, x397);
731	var x412: u64 = undefined;
732	var x413: u1 = undefined;
733	addcarryxU64(&x412, &x413, x411, x376, x399);
734	var x414: u64 = undefined;
735	var x415: u64 = undefined;
736	mulxU64(&x414, &x415, x400, 0x6ed46089e88fdc45);
737	var x416: u64 = undefined;
738	var x417: u64 = undefined;
739	mulxU64(&x416, &x417, x414, 0xffffffffffffffff);
740	var x418: u64 = undefined;
741	var x419: u64 = undefined;
742	mulxU64(&x418, &x419, x414, 0xffffffffffffffff);
743	var x420: u64 = undefined;
744	var x421: u64 = undefined;
745	mulxU64(&x420, &x421, x414, 0xffffffffffffffff);
746	var x422: u64 = undefined;
747	var x423: u64 = undefined;
748	mulxU64(&x422, &x423, x414, 0xc7634d81f4372ddf);
749	var x424: u64 = undefined;
750	var x425: u64 = undefined;
751	mulxU64(&x424, &x425, x414, 0x581a0db248b0a77a);
752	var x426: u64 = undefined;
753	var x427: u64 = undefined;
754	mulxU64(&x426, &x427, x414, 0xecec196accc52973);
755	var x428: u64 = undefined;
756	var x429: u1 = undefined;
757	addcarryxU64(&x428, &x429, 0x0, x427, x424);
758	var x430: u64 = undefined;
759	var x431: u1 = undefined;
760	addcarryxU64(&x430, &x431, x429, x425, x422);
761	var x432: u64 = undefined;
762	var x433: u1 = undefined;
763	addcarryxU64(&x432, &x433, x431, x423, x420);
764	var x434: u64 = undefined;
765	var x435: u1 = undefined;
766	addcarryxU64(&x434, &x435, x433, x421, x418);
767	var x436: u64 = undefined;
768	var x437: u1 = undefined;
769	addcarryxU64(&x436, &x437, x435, x419, x416);
770	const x438 = (@as(u64, x437) + x417);
771	var x439: u64 = undefined;
772	var x440: u1 = undefined;
773	addcarryxU64(&x439, &x440, 0x0, x400, x426);
774	var x441: u64 = undefined;
775	var x442: u1 = undefined;
776	addcarryxU64(&x441, &x442, x440, x402, x428);
777	var x443: u64 = undefined;
778	var x444: u1 = undefined;
779	addcarryxU64(&x443, &x444, x442, x404, x430);
780	var x445: u64 = undefined;
781	var x446: u1 = undefined;
782	addcarryxU64(&x445, &x446, x444, x406, x432);
783	var x447: u64 = undefined;
784	var x448: u1 = undefined;
785	addcarryxU64(&x447, &x448, x446, x408, x434);
786	var x449: u64 = undefined;
787	var x450: u1 = undefined;
788	addcarryxU64(&x449, &x450, x448, x410, x436);
789	var x451: u64 = undefined;
790	var x452: u1 = undefined;
791	addcarryxU64(&x451, &x452, x450, x412, x438);
792	const x453 = (@as(u64, x452) + @as(u64, x413));
793	var x454: u64 = undefined;
794	var x455: u1 = undefined;
795	subborrowxU64(&x454, &x455, 0x0, x441, 0xecec196accc52973);
796	var x456: u64 = undefined;
797	var x457: u1 = undefined;
798	subborrowxU64(&x456, &x457, x455, x443, 0x581a0db248b0a77a);
799	var x458: u64 = undefined;
800	var x459: u1 = undefined;
801	subborrowxU64(&x458, &x459, x457, x445, 0xc7634d81f4372ddf);
802	var x460: u64 = undefined;
803	var x461: u1 = undefined;
804	subborrowxU64(&x460, &x461, x459, x447, 0xffffffffffffffff);
805	var x462: u64 = undefined;
806	var x463: u1 = undefined;
807	subborrowxU64(&x462, &x463, x461, x449, 0xffffffffffffffff);
808	var x464: u64 = undefined;
809	var x465: u1 = undefined;
810	subborrowxU64(&x464, &x465, x463, x451, 0xffffffffffffffff);
811	var x466: u64 = undefined;
812	var x467: u1 = undefined;
813	subborrowxU64(&x466, &x467, x465, x453, 0x0);
814	var x468: u64 = undefined;
815	cmovznzU64(&x468, x467, x454, x441);
816	var x469: u64 = undefined;
817	cmovznzU64(&x469, x467, x456, x443);
818	var x470: u64 = undefined;
819	cmovznzU64(&x470, x467, x458, x445);
820	var x471: u64 = undefined;
821	cmovznzU64(&x471, x467, x460, x447);
822	var x472: u64 = undefined;
823	cmovznzU64(&x472, x467, x462, x449);
824	var x473: u64 = undefined;
825	cmovznzU64(&x473, x467, x464, x451);
826	out1[0] = x468;
827	out1[1] = x469;
828	out1[2] = x470;
829	out1[3] = x471;
830	out1[4] = x472;
831	out1[5] = x473;
832	}
833
834	/// The function square squares a field element in the Montgomery domain.
835	///
836	/// Preconditions:
837	/// 0 ≤ eval arg1 < m
838	/// Postconditions:
839	/// eval (from_montgomery out1) mod m = (eval (from_montgomery arg1) * eval (from_montgomery arg1)) mod m
840	/// 0 ≤ eval out1 < m
841	///
842	pub fn square(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldElement) void {
843	@setRuntimeSafety(mode == .Debug);
844
845	const x1 = (arg1[1]);
846	const x2 = (arg1[2]);
847	const x3 = (arg1[3]);
848	const x4 = (arg1[4]);
849	const x5 = (arg1[5]);
850	const x6 = (arg1[0]);
851	var x7: u64 = undefined;
852	var x8: u64 = undefined;
853	mulxU64(&x7, &x8, x6, (arg1[5]));
854	var x9: u64 = undefined;
855	var x10: u64 = undefined;
856	mulxU64(&x9, &x10, x6, (arg1[4]));
857	var x11: u64 = undefined;
858	var x12: u64 = undefined;
859	mulxU64(&x11, &x12, x6, (arg1[3]));
860	var x13: u64 = undefined;
861	var x14: u64 = undefined;
862	mulxU64(&x13, &x14, x6, (arg1[2]));
863	var x15: u64 = undefined;
864	var x16: u64 = undefined;
865	mulxU64(&x15, &x16, x6, (arg1[1]));
866	var x17: u64 = undefined;
867	var x18: u64 = undefined;
868	mulxU64(&x17, &x18, x6, (arg1[0]));
869	var x19: u64 = undefined;
870	var x20: u1 = undefined;
871	addcarryxU64(&x19, &x20, 0x0, x18, x15);
872	var x21: u64 = undefined;
873	var x22: u1 = undefined;
874	addcarryxU64(&x21, &x22, x20, x16, x13);
875	var x23: u64 = undefined;
876	var x24: u1 = undefined;
877	addcarryxU64(&x23, &x24, x22, x14, x11);
878	var x25: u64 = undefined;
879	var x26: u1 = undefined;
880	addcarryxU64(&x25, &x26, x24, x12, x9);
881	var x27: u64 = undefined;
882	var x28: u1 = undefined;
883	addcarryxU64(&x27, &x28, x26, x10, x7);
884	const x29 = (@as(u64, x28) + x8);
885	var x30: u64 = undefined;
886	var x31: u64 = undefined;
887	mulxU64(&x30, &x31, x17, 0x6ed46089e88fdc45);
888	var x32: u64 = undefined;
889	var x33: u64 = undefined;
890	mulxU64(&x32, &x33, x30, 0xffffffffffffffff);
891	var x34: u64 = undefined;
892	var x35: u64 = undefined;
893	mulxU64(&x34, &x35, x30, 0xffffffffffffffff);
894	var x36: u64 = undefined;
895	var x37: u64 = undefined;
896	mulxU64(&x36, &x37, x30, 0xffffffffffffffff);
897	var x38: u64 = undefined;
898	var x39: u64 = undefined;
899	mulxU64(&x38, &x39, x30, 0xc7634d81f4372ddf);
900	var x40: u64 = undefined;
901	var x41: u64 = undefined;
902	mulxU64(&x40, &x41, x30, 0x581a0db248b0a77a);
903	var x42: u64 = undefined;
904	var x43: u64 = undefined;
905	mulxU64(&x42, &x43, x30, 0xecec196accc52973);
906	var x44: u64 = undefined;
907	var x45: u1 = undefined;
908	addcarryxU64(&x44, &x45, 0x0, x43, x40);
909	var x46: u64 = undefined;
910	var x47: u1 = undefined;
911	addcarryxU64(&x46, &x47, x45, x41, x38);
912	var x48: u64 = undefined;
913	var x49: u1 = undefined;
914	addcarryxU64(&x48, &x49, x47, x39, x36);
915	var x50: u64 = undefined;
916	var x51: u1 = undefined;
917	addcarryxU64(&x50, &x51, x49, x37, x34);
918	var x52: u64 = undefined;
919	var x53: u1 = undefined;
920	addcarryxU64(&x52, &x53, x51, x35, x32);
921	const x54 = (@as(u64, x53) + x33);
922	var x55: u64 = undefined;
923	var x56: u1 = undefined;
924	addcarryxU64(&x55, &x56, 0x0, x17, x42);
925	var x57: u64 = undefined;
926	var x58: u1 = undefined;
927	addcarryxU64(&x57, &x58, x56, x19, x44);
928	var x59: u64 = undefined;
929	var x60: u1 = undefined;
930	addcarryxU64(&x59, &x60, x58, x21, x46);
931	var x61: u64 = undefined;
932	var x62: u1 = undefined;
933	addcarryxU64(&x61, &x62, x60, x23, x48);
934	var x63: u64 = undefined;
935	var x64: u1 = undefined;
936	addcarryxU64(&x63, &x64, x62, x25, x50);
937	var x65: u64 = undefined;
938	var x66: u1 = undefined;
939	addcarryxU64(&x65, &x66, x64, x27, x52);
940	var x67: u64 = undefined;
941	var x68: u1 = undefined;
942	addcarryxU64(&x67, &x68, x66, x29, x54);
943	var x69: u64 = undefined;
944	var x70: u64 = undefined;
945	mulxU64(&x69, &x70, x1, (arg1[5]));
946	var x71: u64 = undefined;
947	var x72: u64 = undefined;
948	mulxU64(&x71, &x72, x1, (arg1[4]));
949	var x73: u64 = undefined;
950	var x74: u64 = undefined;
951	mulxU64(&x73, &x74, x1, (arg1[3]));
952	var x75: u64 = undefined;
953	var x76: u64 = undefined;
954	mulxU64(&x75, &x76, x1, (arg1[2]));
955	var x77: u64 = undefined;
956	var x78: u64 = undefined;
957	mulxU64(&x77, &x78, x1, (arg1[1]));
958	var x79: u64 = undefined;
959	var x80: u64 = undefined;
960	mulxU64(&x79, &x80, x1, (arg1[0]));
961	var x81: u64 = undefined;
962	var x82: u1 = undefined;
963	addcarryxU64(&x81, &x82, 0x0, x80, x77);
964	var x83: u64 = undefined;
965	var x84: u1 = undefined;
966	addcarryxU64(&x83, &x84, x82, x78, x75);
967	var x85: u64 = undefined;
968	var x86: u1 = undefined;
969	addcarryxU64(&x85, &x86, x84, x76, x73);
970	var x87: u64 = undefined;
971	var x88: u1 = undefined;
972	addcarryxU64(&x87, &x88, x86, x74, x71);
973	var x89: u64 = undefined;
974	var x90: u1 = undefined;
975	addcarryxU64(&x89, &x90, x88, x72, x69);
976	const x91 = (@as(u64, x90) + x70);
977	var x92: u64 = undefined;
978	var x93: u1 = undefined;
979	addcarryxU64(&x92, &x93, 0x0, x57, x79);
980	var x94: u64 = undefined;
981	var x95: u1 = undefined;
982	addcarryxU64(&x94, &x95, x93, x59, x81);
983	var x96: u64 = undefined;
984	var x97: u1 = undefined;
985	addcarryxU64(&x96, &x97, x95, x61, x83);
986	var x98: u64 = undefined;
987	var x99: u1 = undefined;
988	addcarryxU64(&x98, &x99, x97, x63, x85);
989	var x100: u64 = undefined;
990	var x101: u1 = undefined;
991	addcarryxU64(&x100, &x101, x99, x65, x87);
992	var x102: u64 = undefined;
993	var x103: u1 = undefined;
994	addcarryxU64(&x102, &x103, x101, x67, x89);
995	var x104: u64 = undefined;
996	var x105: u1 = undefined;
997	addcarryxU64(&x104, &x105, x103, @as(u64, x68), x91);
998	var x106: u64 = undefined;
999	var x107: u64 = undefined;
1000	mulxU64(&x106, &x107, x92, 0x6ed46089e88fdc45);
1001	var x108: u64 = undefined;
1002	var x109: u64 = undefined;
1003	mulxU64(&x108, &x109, x106, 0xffffffffffffffff);
1004	var x110: u64 = undefined;
1005	var x111: u64 = undefined;
1006	mulxU64(&x110, &x111, x106, 0xffffffffffffffff);
1007	var x112: u64 = undefined;
1008	var x113: u64 = undefined;
1009	mulxU64(&x112, &x113, x106, 0xffffffffffffffff);
1010	var x114: u64 = undefined;
1011	var x115: u64 = undefined;
1012	mulxU64(&x114, &x115, x106, 0xc7634d81f4372ddf);
1013	var x116: u64 = undefined;
1014	var x117: u64 = undefined;
1015	mulxU64(&x116, &x117, x106, 0x581a0db248b0a77a);
1016	var x118: u64 = undefined;
1017	var x119: u64 = undefined;
1018	mulxU64(&x118, &x119, x106, 0xecec196accc52973);
1019	var x120: u64 = undefined;
1020	var x121: u1 = undefined;
1021	addcarryxU64(&x120, &x121, 0x0, x119, x116);
1022	var x122: u64 = undefined;
1023	var x123: u1 = undefined;
1024	addcarryxU64(&x122, &x123, x121, x117, x114);
1025	var x124: u64 = undefined;
1026	var x125: u1 = undefined;
1027	addcarryxU64(&x124, &x125, x123, x115, x112);
1028	var x126: u64 = undefined;
1029	var x127: u1 = undefined;
1030	addcarryxU64(&x126, &x127, x125, x113, x110);
1031	var x128: u64 = undefined;
1032	var x129: u1 = undefined;
1033	addcarryxU64(&x128, &x129, x127, x111, x108);
1034	const x130 = (@as(u64, x129) + x109);
1035	var x131: u64 = undefined;
1036	var x132: u1 = undefined;
1037	addcarryxU64(&x131, &x132, 0x0, x92, x118);
1038	var x133: u64 = undefined;
1039	var x134: u1 = undefined;
1040	addcarryxU64(&x133, &x134, x132, x94, x120);
1041	var x135: u64 = undefined;
1042	var x136: u1 = undefined;
1043	addcarryxU64(&x135, &x136, x134, x96, x122);
1044	var x137: u64 = undefined;
1045	var x138: u1 = undefined;
1046	addcarryxU64(&x137, &x138, x136, x98, x124);
1047	var x139: u64 = undefined;
1048	var x140: u1 = undefined;
1049	addcarryxU64(&x139, &x140, x138, x100, x126);
1050	var x141: u64 = undefined;
1051	var x142: u1 = undefined;
1052	addcarryxU64(&x141, &x142, x140, x102, x128);
1053	var x143: u64 = undefined;
1054	var x144: u1 = undefined;
1055	addcarryxU64(&x143, &x144, x142, x104, x130);
1056	const x145 = (@as(u64, x144) + @as(u64, x105));
1057	var x146: u64 = undefined;
1058	var x147: u64 = undefined;
1059	mulxU64(&x146, &x147, x2, (arg1[5]));
1060	var x148: u64 = undefined;
1061	var x149: u64 = undefined;
1062	mulxU64(&x148, &x149, x2, (arg1[4]));
1063	var x150: u64 = undefined;
1064	var x151: u64 = undefined;
1065	mulxU64(&x150, &x151, x2, (arg1[3]));
1066	var x152: u64 = undefined;
1067	var x153: u64 = undefined;
1068	mulxU64(&x152, &x153, x2, (arg1[2]));
1069	var x154: u64 = undefined;
1070	var x155: u64 = undefined;
1071	mulxU64(&x154, &x155, x2, (arg1[1]));
1072	var x156: u64 = undefined;
1073	var x157: u64 = undefined;
1074	mulxU64(&x156, &x157, x2, (arg1[0]));
1075	var x158: u64 = undefined;
1076	var x159: u1 = undefined;
1077	addcarryxU64(&x158, &x159, 0x0, x157, x154);
1078	var x160: u64 = undefined;
1079	var x161: u1 = undefined;
1080	addcarryxU64(&x160, &x161, x159, x155, x152);
1081	var x162: u64 = undefined;
1082	var x163: u1 = undefined;
1083	addcarryxU64(&x162, &x163, x161, x153, x150);
1084	var x164: u64 = undefined;
1085	var x165: u1 = undefined;
1086	addcarryxU64(&x164, &x165, x163, x151, x148);
1087	var x166: u64 = undefined;
1088	var x167: u1 = undefined;
1089	addcarryxU64(&x166, &x167, x165, x149, x146);
1090	const x168 = (@as(u64, x167) + x147);
1091	var x169: u64 = undefined;
1092	var x170: u1 = undefined;
1093	addcarryxU64(&x169, &x170, 0x0, x133, x156);
1094	var x171: u64 = undefined;
1095	var x172: u1 = undefined;
1096	addcarryxU64(&x171, &x172, x170, x135, x158);
1097	var x173: u64 = undefined;
1098	var x174: u1 = undefined;
1099	addcarryxU64(&x173, &x174, x172, x137, x160);
1100	var x175: u64 = undefined;
1101	var x176: u1 = undefined;
1102	addcarryxU64(&x175, &x176, x174, x139, x162);
1103	var x177: u64 = undefined;
1104	var x178: u1 = undefined;
1105	addcarryxU64(&x177, &x178, x176, x141, x164);
1106	var x179: u64 = undefined;
1107	var x180: u1 = undefined;
1108	addcarryxU64(&x179, &x180, x178, x143, x166);
1109	var x181: u64 = undefined;
1110	var x182: u1 = undefined;
1111	addcarryxU64(&x181, &x182, x180, x145, x168);
1112	var x183: u64 = undefined;
1113	var x184: u64 = undefined;
1114	mulxU64(&x183, &x184, x169, 0x6ed46089e88fdc45);
1115	var x185: u64 = undefined;
1116	var x186: u64 = undefined;
1117	mulxU64(&x185, &x186, x183, 0xffffffffffffffff);
1118	var x187: u64 = undefined;
1119	var x188: u64 = undefined;
1120	mulxU64(&x187, &x188, x183, 0xffffffffffffffff);
1121	var x189: u64 = undefined;
1122	var x190: u64 = undefined;
1123	mulxU64(&x189, &x190, x183, 0xffffffffffffffff);
1124	var x191: u64 = undefined;
1125	var x192: u64 = undefined;
1126	mulxU64(&x191, &x192, x183, 0xc7634d81f4372ddf);
1127	var x193: u64 = undefined;
1128	var x194: u64 = undefined;
1129	mulxU64(&x193, &x194, x183, 0x581a0db248b0a77a);
1130	var x195: u64 = undefined;
1131	var x196: u64 = undefined;
1132	mulxU64(&x195, &x196, x183, 0xecec196accc52973);
1133	var x197: u64 = undefined;
1134	var x198: u1 = undefined;
1135	addcarryxU64(&x197, &x198, 0x0, x196, x193);
1136	var x199: u64 = undefined;
1137	var x200: u1 = undefined;
1138	addcarryxU64(&x199, &x200, x198, x194, x191);
1139	var x201: u64 = undefined;
1140	var x202: u1 = undefined;
1141	addcarryxU64(&x201, &x202, x200, x192, x189);
1142	var x203: u64 = undefined;
1143	var x204: u1 = undefined;
1144	addcarryxU64(&x203, &x204, x202, x190, x187);
1145	var x205: u64 = undefined;
1146	var x206: u1 = undefined;
1147	addcarryxU64(&x205, &x206, x204, x188, x185);
1148	const x207 = (@as(u64, x206) + x186);
1149	var x208: u64 = undefined;
1150	var x209: u1 = undefined;
1151	addcarryxU64(&x208, &x209, 0x0, x169, x195);
1152	var x210: u64 = undefined;
1153	var x211: u1 = undefined;
1154	addcarryxU64(&x210, &x211, x209, x171, x197);
1155	var x212: u64 = undefined;
1156	var x213: u1 = undefined;
1157	addcarryxU64(&x212, &x213, x211, x173, x199);
1158	var x214: u64 = undefined;
1159	var x215: u1 = undefined;
1160	addcarryxU64(&x214, &x215, x213, x175, x201);
1161	var x216: u64 = undefined;
1162	var x217: u1 = undefined;
1163	addcarryxU64(&x216, &x217, x215, x177, x203);
1164	var x218: u64 = undefined;
1165	var x219: u1 = undefined;
1166	addcarryxU64(&x218, &x219, x217, x179, x205);
1167	var x220: u64 = undefined;
1168	var x221: u1 = undefined;
1169	addcarryxU64(&x220, &x221, x219, x181, x207);
1170	const x222 = (@as(u64, x221) + @as(u64, x182));
1171	var x223: u64 = undefined;
1172	var x224: u64 = undefined;
1173	mulxU64(&x223, &x224, x3, (arg1[5]));
1174	var x225: u64 = undefined;
1175	var x226: u64 = undefined;
1176	mulxU64(&x225, &x226, x3, (arg1[4]));
1177	var x227: u64 = undefined;
1178	var x228: u64 = undefined;
1179	mulxU64(&x227, &x228, x3, (arg1[3]));
1180	var x229: u64 = undefined;
1181	var x230: u64 = undefined;
1182	mulxU64(&x229, &x230, x3, (arg1[2]));
1183	var x231: u64 = undefined;
1184	var x232: u64 = undefined;
1185	mulxU64(&x231, &x232, x3, (arg1[1]));
1186	var x233: u64 = undefined;
1187	var x234: u64 = undefined;
1188	mulxU64(&x233, &x234, x3, (arg1[0]));
1189	var x235: u64 = undefined;
1190	var x236: u1 = undefined;
1191	addcarryxU64(&x235, &x236, 0x0, x234, x231);
1192	var x237: u64 = undefined;
1193	var x238: u1 = undefined;
1194	addcarryxU64(&x237, &x238, x236, x232, x229);
1195	var x239: u64 = undefined;
1196	var x240: u1 = undefined;
1197	addcarryxU64(&x239, &x240, x238, x230, x227);
1198	var x241: u64 = undefined;
1199	var x242: u1 = undefined;
1200	addcarryxU64(&x241, &x242, x240, x228, x225);
1201	var x243: u64 = undefined;
1202	var x244: u1 = undefined;
1203	addcarryxU64(&x243, &x244, x242, x226, x223);
1204	const x245 = (@as(u64, x244) + x224);
1205	var x246: u64 = undefined;
1206	var x247: u1 = undefined;
1207	addcarryxU64(&x246, &x247, 0x0, x210, x233);
1208	var x248: u64 = undefined;
1209	var x249: u1 = undefined;
1210	addcarryxU64(&x248, &x249, x247, x212, x235);
1211	var x250: u64 = undefined;
1212	var x251: u1 = undefined;
1213	addcarryxU64(&x250, &x251, x249, x214, x237);
1214	var x252: u64 = undefined;
1215	var x253: u1 = undefined;
1216	addcarryxU64(&x252, &x253, x251, x216, x239);
1217	var x254: u64 = undefined;
1218	var x255: u1 = undefined;
1219	addcarryxU64(&x254, &x255, x253, x218, x241);
1220	var x256: u64 = undefined;
1221	var x257: u1 = undefined;
1222	addcarryxU64(&x256, &x257, x255, x220, x243);
1223	var x258: u64 = undefined;
1224	var x259: u1 = undefined;
1225	addcarryxU64(&x258, &x259, x257, x222, x245);
1226	var x260: u64 = undefined;
1227	var x261: u64 = undefined;
1228	mulxU64(&x260, &x261, x246, 0x6ed46089e88fdc45);
1229	var x262: u64 = undefined;
1230	var x263: u64 = undefined;
1231	mulxU64(&x262, &x263, x260, 0xffffffffffffffff);
1232	var x264: u64 = undefined;
1233	var x265: u64 = undefined;
1234	mulxU64(&x264, &x265, x260, 0xffffffffffffffff);
1235	var x266: u64 = undefined;
1236	var x267: u64 = undefined;
1237	mulxU64(&x266, &x267, x260, 0xffffffffffffffff);
1238	var x268: u64 = undefined;
1239	var x269: u64 = undefined;
1240	mulxU64(&x268, &x269, x260, 0xc7634d81f4372ddf);
1241	var x270: u64 = undefined;
1242	var x271: u64 = undefined;
1243	mulxU64(&x270, &x271, x260, 0x581a0db248b0a77a);
1244	var x272: u64 = undefined;
1245	var x273: u64 = undefined;
1246	mulxU64(&x272, &x273, x260, 0xecec196accc52973);
1247	var x274: u64 = undefined;
1248	var x275: u1 = undefined;
1249	addcarryxU64(&x274, &x275, 0x0, x273, x270);
1250	var x276: u64 = undefined;
1251	var x277: u1 = undefined;
1252	addcarryxU64(&x276, &x277, x275, x271, x268);
1253	var x278: u64 = undefined;
1254	var x279: u1 = undefined;
1255	addcarryxU64(&x278, &x279, x277, x269, x266);
1256	var x280: u64 = undefined;
1257	var x281: u1 = undefined;
1258	addcarryxU64(&x280, &x281, x279, x267, x264);
1259	var x282: u64 = undefined;
1260	var x283: u1 = undefined;
1261	addcarryxU64(&x282, &x283, x281, x265, x262);
1262	const x284 = (@as(u64, x283) + x263);
1263	var x285: u64 = undefined;
1264	var x286: u1 = undefined;
1265	addcarryxU64(&x285, &x286, 0x0, x246, x272);
1266	var x287: u64 = undefined;
1267	var x288: u1 = undefined;
1268	addcarryxU64(&x287, &x288, x286, x248, x274);
1269	var x289: u64 = undefined;
1270	var x290: u1 = undefined;
1271	addcarryxU64(&x289, &x290, x288, x250, x276);
1272	var x291: u64 = undefined;
1273	var x292: u1 = undefined;
1274	addcarryxU64(&x291, &x292, x290, x252, x278);
1275	var x293: u64 = undefined;
1276	var x294: u1 = undefined;
1277	addcarryxU64(&x293, &x294, x292, x254, x280);
1278	var x295: u64 = undefined;
1279	var x296: u1 = undefined;
1280	addcarryxU64(&x295, &x296, x294, x256, x282);
1281	var x297: u64 = undefined;
1282	var x298: u1 = undefined;
1283	addcarryxU64(&x297, &x298, x296, x258, x284);
1284	const x299 = (@as(u64, x298) + @as(u64, x259));
1285	var x300: u64 = undefined;
1286	var x301: u64 = undefined;
1287	mulxU64(&x300, &x301, x4, (arg1[5]));
1288	var x302: u64 = undefined;
1289	var x303: u64 = undefined;
1290	mulxU64(&x302, &x303, x4, (arg1[4]));
1291	var x304: u64 = undefined;
1292	var x305: u64 = undefined;
1293	mulxU64(&x304, &x305, x4, (arg1[3]));
1294	var x306: u64 = undefined;
1295	var x307: u64 = undefined;
1296	mulxU64(&x306, &x307, x4, (arg1[2]));
1297	var x308: u64 = undefined;
1298	var x309: u64 = undefined;
1299	mulxU64(&x308, &x309, x4, (arg1[1]));
1300	var x310: u64 = undefined;
1301	var x311: u64 = undefined;
1302	mulxU64(&x310, &x311, x4, (arg1[0]));
1303	var x312: u64 = undefined;
1304	var x313: u1 = undefined;
1305	addcarryxU64(&x312, &x313, 0x0, x311, x308);
1306	var x314: u64 = undefined;
1307	var x315: u1 = undefined;
1308	addcarryxU64(&x314, &x315, x313, x309, x306);
1309	var x316: u64 = undefined;
1310	var x317: u1 = undefined;
1311	addcarryxU64(&x316, &x317, x315, x307, x304);
1312	var x318: u64 = undefined;
1313	var x319: u1 = undefined;
1314	addcarryxU64(&x318, &x319, x317, x305, x302);
1315	var x320: u64 = undefined;
1316	var x321: u1 = undefined;
1317	addcarryxU64(&x320, &x321, x319, x303, x300);
1318	const x322 = (@as(u64, x321) + x301);
1319	var x323: u64 = undefined;
1320	var x324: u1 = undefined;
1321	addcarryxU64(&x323, &x324, 0x0, x287, x310);
1322	var x325: u64 = undefined;
1323	var x326: u1 = undefined;
1324	addcarryxU64(&x325, &x326, x324, x289, x312);
1325	var x327: u64 = undefined;
1326	var x328: u1 = undefined;
1327	addcarryxU64(&x327, &x328, x326, x291, x314);
1328	var x329: u64 = undefined;
1329	var x330: u1 = undefined;
1330	addcarryxU64(&x329, &x330, x328, x293, x316);
1331	var x331: u64 = undefined;
1332	var x332: u1 = undefined;
1333	addcarryxU64(&x331, &x332, x330, x295, x318);
1334	var x333: u64 = undefined;
1335	var x334: u1 = undefined;
1336	addcarryxU64(&x333, &x334, x332, x297, x320);
1337	var x335: u64 = undefined;
1338	var x336: u1 = undefined;
1339	addcarryxU64(&x335, &x336, x334, x299, x322);
1340	var x337: u64 = undefined;
1341	var x338: u64 = undefined;
1342	mulxU64(&x337, &x338, x323, 0x6ed46089e88fdc45);
1343	var x339: u64 = undefined;
1344	var x340: u64 = undefined;
1345	mulxU64(&x339, &x340, x337, 0xffffffffffffffff);
1346	var x341: u64 = undefined;
1347	var x342: u64 = undefined;
1348	mulxU64(&x341, &x342, x337, 0xffffffffffffffff);
1349	var x343: u64 = undefined;
1350	var x344: u64 = undefined;
1351	mulxU64(&x343, &x344, x337, 0xffffffffffffffff);
1352	var x345: u64 = undefined;
1353	var x346: u64 = undefined;
1354	mulxU64(&x345, &x346, x337, 0xc7634d81f4372ddf);
1355	var x347: u64 = undefined;
1356	var x348: u64 = undefined;
1357	mulxU64(&x347, &x348, x337, 0x581a0db248b0a77a);
1358	var x349: u64 = undefined;
1359	var x350: u64 = undefined;
1360	mulxU64(&x349, &x350, x337, 0xecec196accc52973);
1361	var x351: u64 = undefined;
1362	var x352: u1 = undefined;
1363	addcarryxU64(&x351, &x352, 0x0, x350, x347);
1364	var x353: u64 = undefined;
1365	var x354: u1 = undefined;
1366	addcarryxU64(&x353, &x354, x352, x348, x345);
1367	var x355: u64 = undefined;
1368	var x356: u1 = undefined;
1369	addcarryxU64(&x355, &x356, x354, x346, x343);
1370	var x357: u64 = undefined;
1371	var x358: u1 = undefined;
1372	addcarryxU64(&x357, &x358, x356, x344, x341);
1373	var x359: u64 = undefined;
1374	var x360: u1 = undefined;
1375	addcarryxU64(&x359, &x360, x358, x342, x339);
1376	const x361 = (@as(u64, x360) + x340);
1377	var x362: u64 = undefined;
1378	var x363: u1 = undefined;
1379	addcarryxU64(&x362, &x363, 0x0, x323, x349);
1380	var x364: u64 = undefined;
1381	var x365: u1 = undefined;
1382	addcarryxU64(&x364, &x365, x363, x325, x351);
1383	var x366: u64 = undefined;
1384	var x367: u1 = undefined;
1385	addcarryxU64(&x366, &x367, x365, x327, x353);
1386	var x368: u64 = undefined;
1387	var x369: u1 = undefined;
1388	addcarryxU64(&x368, &x369, x367, x329, x355);
1389	var x370: u64 = undefined;
1390	var x371: u1 = undefined;
1391	addcarryxU64(&x370, &x371, x369, x331, x357);
1392	var x372: u64 = undefined;
1393	var x373: u1 = undefined;
1394	addcarryxU64(&x372, &x373, x371, x333, x359);
1395	var x374: u64 = undefined;
1396	var x375: u1 = undefined;
1397	addcarryxU64(&x374, &x375, x373, x335, x361);
1398	const x376 = (@as(u64, x375) + @as(u64, x336));
1399	var x377: u64 = undefined;
1400	var x378: u64 = undefined;
1401	mulxU64(&x377, &x378, x5, (arg1[5]));
1402	var x379: u64 = undefined;
1403	var x380: u64 = undefined;
1404	mulxU64(&x379, &x380, x5, (arg1[4]));
1405	var x381: u64 = undefined;
1406	var x382: u64 = undefined;
1407	mulxU64(&x381, &x382, x5, (arg1[3]));
1408	var x383: u64 = undefined;
1409	var x384: u64 = undefined;
1410	mulxU64(&x383, &x384, x5, (arg1[2]));
1411	var x385: u64 = undefined;
1412	var x386: u64 = undefined;
1413	mulxU64(&x385, &x386, x5, (arg1[1]));
1414	var x387: u64 = undefined;
1415	var x388: u64 = undefined;
1416	mulxU64(&x387, &x388, x5, (arg1[0]));
1417	var x389: u64 = undefined;
1418	var x390: u1 = undefined;
1419	addcarryxU64(&x389, &x390, 0x0, x388, x385);
1420	var x391: u64 = undefined;
1421	var x392: u1 = undefined;
1422	addcarryxU64(&x391, &x392, x390, x386, x383);
1423	var x393: u64 = undefined;
1424	var x394: u1 = undefined;
1425	addcarryxU64(&x393, &x394, x392, x384, x381);
1426	var x395: u64 = undefined;
1427	var x396: u1 = undefined;
1428	addcarryxU64(&x395, &x396, x394, x382, x379);
1429	var x397: u64 = undefined;
1430	var x398: u1 = undefined;
1431	addcarryxU64(&x397, &x398, x396, x380, x377);
1432	const x399 = (@as(u64, x398) + x378);
1433	var x400: u64 = undefined;
1434	var x401: u1 = undefined;
1435	addcarryxU64(&x400, &x401, 0x0, x364, x387);
1436	var x402: u64 = undefined;
1437	var x403: u1 = undefined;
1438	addcarryxU64(&x402, &x403, x401, x366, x389);
1439	var x404: u64 = undefined;
1440	var x405: u1 = undefined;
1441	addcarryxU64(&x404, &x405, x403, x368, x391);
1442	var x406: u64 = undefined;
1443	var x407: u1 = undefined;
1444	addcarryxU64(&x406, &x407, x405, x370, x393);
1445	var x408: u64 = undefined;
1446	var x409: u1 = undefined;
1447	addcarryxU64(&x408, &x409, x407, x372, x395);
1448	var x410: u64 = undefined;
1449	var x411: u1 = undefined;
1450	addcarryxU64(&x410, &x411, x409, x374, x397);
1451	var x412: u64 = undefined;
1452	var x413: u1 = undefined;
1453	addcarryxU64(&x412, &x413, x411, x376, x399);
1454	var x414: u64 = undefined;
1455	var x415: u64 = undefined;
1456	mulxU64(&x414, &x415, x400, 0x6ed46089e88fdc45);
1457	var x416: u64 = undefined;
1458	var x417: u64 = undefined;
1459	mulxU64(&x416, &x417, x414, 0xffffffffffffffff);
1460	var x418: u64 = undefined;
1461	var x419: u64 = undefined;
1462	mulxU64(&x418, &x419, x414, 0xffffffffffffffff);
1463	var x420: u64 = undefined;
1464	var x421: u64 = undefined;
1465	mulxU64(&x420, &x421, x414, 0xffffffffffffffff);
1466	var x422: u64 = undefined;
1467	var x423: u64 = undefined;
1468	mulxU64(&x422, &x423, x414, 0xc7634d81f4372ddf);
1469	var x424: u64 = undefined;
1470	var x425: u64 = undefined;
1471	mulxU64(&x424, &x425, x414, 0x581a0db248b0a77a);
1472	var x426: u64 = undefined;
1473	var x427: u64 = undefined;
1474	mulxU64(&x426, &x427, x414, 0xecec196accc52973);
1475	var x428: u64 = undefined;
1476	var x429: u1 = undefined;
1477	addcarryxU64(&x428, &x429, 0x0, x427, x424);
1478	var x430: u64 = undefined;
1479	var x431: u1 = undefined;
1480	addcarryxU64(&x430, &x431, x429, x425, x422);
1481	var x432: u64 = undefined;
1482	var x433: u1 = undefined;
1483	addcarryxU64(&x432, &x433, x431, x423, x420);
1484	var x434: u64 = undefined;
1485	var x435: u1 = undefined;
1486	addcarryxU64(&x434, &x435, x433, x421, x418);
1487	var x436: u64 = undefined;
1488	var x437: u1 = undefined;
1489	addcarryxU64(&x436, &x437, x435, x419, x416);
1490	const x438 = (@as(u64, x437) + x417);
1491	var x439: u64 = undefined;
1492	var x440: u1 = undefined;
1493	addcarryxU64(&x439, &x440, 0x0, x400, x426);
1494	var x441: u64 = undefined;
1495	var x442: u1 = undefined;
1496	addcarryxU64(&x441, &x442, x440, x402, x428);
1497	var x443: u64 = undefined;
1498	var x444: u1 = undefined;
1499	addcarryxU64(&x443, &x444, x442, x404, x430);
1500	var x445: u64 = undefined;
1501	var x446: u1 = undefined;
1502	addcarryxU64(&x445, &x446, x444, x406, x432);
1503	var x447: u64 = undefined;
1504	var x448: u1 = undefined;
1505	addcarryxU64(&x447, &x448, x446, x408, x434);
1506	var x449: u64 = undefined;
1507	var x450: u1 = undefined;
1508	addcarryxU64(&x449, &x450, x448, x410, x436);
1509	var x451: u64 = undefined;
1510	var x452: u1 = undefined;
1511	addcarryxU64(&x451, &x452, x450, x412, x438);
1512	const x453 = (@as(u64, x452) + @as(u64, x413));
1513	var x454: u64 = undefined;
1514	var x455: u1 = undefined;
1515	subborrowxU64(&x454, &x455, 0x0, x441, 0xecec196accc52973);
1516	var x456: u64 = undefined;
1517	var x457: u1 = undefined;
1518	subborrowxU64(&x456, &x457, x455, x443, 0x581a0db248b0a77a);
1519	var x458: u64 = undefined;
1520	var x459: u1 = undefined;
1521	subborrowxU64(&x458, &x459, x457, x445, 0xc7634d81f4372ddf);
1522	var x460: u64 = undefined;
1523	var x461: u1 = undefined;
1524	subborrowxU64(&x460, &x461, x459, x447, 0xffffffffffffffff);
1525	var x462: u64 = undefined;
1526	var x463: u1 = undefined;
1527	subborrowxU64(&x462, &x463, x461, x449, 0xffffffffffffffff);
1528	var x464: u64 = undefined;
1529	var x465: u1 = undefined;
1530	subborrowxU64(&x464, &x465, x463, x451, 0xffffffffffffffff);
1531	var x466: u64 = undefined;
1532	var x467: u1 = undefined;
1533	subborrowxU64(&x466, &x467, x465, x453, 0x0);
1534	var x468: u64 = undefined;
1535	cmovznzU64(&x468, x467, x454, x441);
1536	var x469: u64 = undefined;
1537	cmovznzU64(&x469, x467, x456, x443);
1538	var x470: u64 = undefined;
1539	cmovznzU64(&x470, x467, x458, x445);
1540	var x471: u64 = undefined;
1541	cmovznzU64(&x471, x467, x460, x447);
1542	var x472: u64 = undefined;
1543	cmovznzU64(&x472, x467, x462, x449);
1544	var x473: u64 = undefined;
1545	cmovznzU64(&x473, x467, x464, x451);
1546	out1[0] = x468;
1547	out1[1] = x469;
1548	out1[2] = x470;
1549	out1[3] = x471;
1550	out1[4] = x472;
1551	out1[5] = x473;
1552	}
1553
1554	/// The function add adds two field elements in the Montgomery domain.
1555	///
1556	/// Preconditions:
1557	/// 0 ≤ eval arg1 < m
1558	/// 0 ≤ eval arg2 < m
1559	/// Postconditions:
1560	/// eval (from_montgomery out1) mod m = (eval (from_montgomery arg1) + eval (from_montgomery arg2)) mod m
1561	/// 0 ≤ eval out1 < m
1562	///
1563	pub fn add(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldElement, arg2: MontgomeryDomainFieldElement) void {
1564	@setRuntimeSafety(mode == .Debug);
1565
1566	var x1: u64 = undefined;
1567	var x2: u1 = undefined;
1568	addcarryxU64(&x1, &x2, 0x0, (arg1[0]), (arg2[0]));
1569	var x3: u64 = undefined;
1570	var x4: u1 = undefined;
1571	addcarryxU64(&x3, &x4, x2, (arg1[1]), (arg2[1]));
1572	var x5: u64 = undefined;
1573	var x6: u1 = undefined;
1574	addcarryxU64(&x5, &x6, x4, (arg1[2]), (arg2[2]));
1575	var x7: u64 = undefined;
1576	var x8: u1 = undefined;
1577	addcarryxU64(&x7, &x8, x6, (arg1[3]), (arg2[3]));
1578	var x9: u64 = undefined;
1579	var x10: u1 = undefined;
1580	addcarryxU64(&x9, &x10, x8, (arg1[4]), (arg2[4]));
1581	var x11: u64 = undefined;
1582	var x12: u1 = undefined;
1583	addcarryxU64(&x11, &x12, x10, (arg1[5]), (arg2[5]));
1584	var x13: u64 = undefined;
1585	var x14: u1 = undefined;
1586	subborrowxU64(&x13, &x14, 0x0, x1, 0xecec196accc52973);
1587	var x15: u64 = undefined;
1588	var x16: u1 = undefined;
1589	subborrowxU64(&x15, &x16, x14, x3, 0x581a0db248b0a77a);
1590	var x17: u64 = undefined;
1591	var x18: u1 = undefined;
1592	subborrowxU64(&x17, &x18, x16, x5, 0xc7634d81f4372ddf);
1593	var x19: u64 = undefined;
1594	var x20: u1 = undefined;
1595	subborrowxU64(&x19, &x20, x18, x7, 0xffffffffffffffff);
1596	var x21: u64 = undefined;
1597	var x22: u1 = undefined;
1598	subborrowxU64(&x21, &x22, x20, x9, 0xffffffffffffffff);
1599	var x23: u64 = undefined;
1600	var x24: u1 = undefined;
1601	subborrowxU64(&x23, &x24, x22, x11, 0xffffffffffffffff);
1602	var x25: u64 = undefined;
1603	var x26: u1 = undefined;
1604	subborrowxU64(&x25, &x26, x24, @as(u64, x12), 0x0);
1605	var x27: u64 = undefined;
1606	cmovznzU64(&x27, x26, x13, x1);
1607	var x28: u64 = undefined;
1608	cmovznzU64(&x28, x26, x15, x3);
1609	var x29: u64 = undefined;
1610	cmovznzU64(&x29, x26, x17, x5);
1611	var x30: u64 = undefined;
1612	cmovznzU64(&x30, x26, x19, x7);
1613	var x31: u64 = undefined;
1614	cmovznzU64(&x31, x26, x21, x9);
1615	var x32: u64 = undefined;
1616	cmovznzU64(&x32, x26, x23, x11);
1617	out1[0] = x27;
1618	out1[1] = x28;
1619	out1[2] = x29;
1620	out1[3] = x30;
1621	out1[4] = x31;
1622	out1[5] = x32;
1623	}
1624
1625	/// The function sub subtracts two field elements in the Montgomery domain.
1626	///
1627	/// Preconditions:
1628	/// 0 ≤ eval arg1 < m
1629	/// 0 ≤ eval arg2 < m
1630	/// Postconditions:
1631	/// eval (from_montgomery out1) mod m = (eval (from_montgomery arg1) - eval (from_montgomery arg2)) mod m
1632	/// 0 ≤ eval out1 < m
1633	///
1634	pub fn sub(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldElement, arg2: MontgomeryDomainFieldElement) void {
1635	@setRuntimeSafety(mode == .Debug);
1636
1637	var x1: u64 = undefined;
1638	var x2: u1 = undefined;
1639	subborrowxU64(&x1, &x2, 0x0, (arg1[0]), (arg2[0]));
1640	var x3: u64 = undefined;
1641	var x4: u1 = undefined;
1642	subborrowxU64(&x3, &x4, x2, (arg1[1]), (arg2[1]));
1643	var x5: u64 = undefined;
1644	var x6: u1 = undefined;
1645	subborrowxU64(&x5, &x6, x4, (arg1[2]), (arg2[2]));
1646	var x7: u64 = undefined;
1647	var x8: u1 = undefined;
1648	subborrowxU64(&x7, &x8, x6, (arg1[3]), (arg2[3]));
1649	var x9: u64 = undefined;
1650	var x10: u1 = undefined;
1651	subborrowxU64(&x9, &x10, x8, (arg1[4]), (arg2[4]));
1652	var x11: u64 = undefined;
1653	var x12: u1 = undefined;
1654	subborrowxU64(&x11, &x12, x10, (arg1[5]), (arg2[5]));
1655	var x13: u64 = undefined;
1656	cmovznzU64(&x13, x12, 0x0, 0xffffffffffffffff);
1657	var x14: u64 = undefined;
1658	var x15: u1 = undefined;
1659	addcarryxU64(&x14, &x15, 0x0, x1, (x13 & 0xecec196accc52973));
1660	var x16: u64 = undefined;
1661	var x17: u1 = undefined;
1662	addcarryxU64(&x16, &x17, x15, x3, (x13 & 0x581a0db248b0a77a));
1663	var x18: u64 = undefined;
1664	var x19: u1 = undefined;
1665	addcarryxU64(&x18, &x19, x17, x5, (x13 & 0xc7634d81f4372ddf));
1666	var x20: u64 = undefined;
1667	var x21: u1 = undefined;
1668	addcarryxU64(&x20, &x21, x19, x7, x13);
1669	var x22: u64 = undefined;
1670	var x23: u1 = undefined;
1671	addcarryxU64(&x22, &x23, x21, x9, x13);
1672	var x24: u64 = undefined;
1673	var x25: u1 = undefined;
1674	addcarryxU64(&x24, &x25, x23, x11, x13);
1675	out1[0] = x14;
1676	out1[1] = x16;
1677	out1[2] = x18;
1678	out1[3] = x20;
1679	out1[4] = x22;
1680	out1[5] = x24;
1681	}
1682
1683	/// The function opp negates a field element in the Montgomery domain.
1684	///
1685	/// Preconditions:
1686	/// 0 ≤ eval arg1 < m
1687	/// Postconditions:
1688	/// eval (from_montgomery out1) mod m = -eval (from_montgomery arg1) mod m
1689	/// 0 ≤ eval out1 < m
1690	///
1691	pub fn opp(out1: *MontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldElement) void {
1692	@setRuntimeSafety(mode == .Debug);
1693
1694	var x1: u64 = undefined;
1695	var x2: u1 = undefined;
1696	subborrowxU64(&x1, &x2, 0x0, 0x0, (arg1[0]));
1697	var x3: u64 = undefined;
1698	var x4: u1 = undefined;
1699	subborrowxU64(&x3, &x4, x2, 0x0, (arg1[1]));
1700	var x5: u64 = undefined;
1701	var x6: u1 = undefined;
1702	subborrowxU64(&x5, &x6, x4, 0x0, (arg1[2]));
1703	var x7: u64 = undefined;
1704	var x8: u1 = undefined;
1705	subborrowxU64(&x7, &x8, x6, 0x0, (arg1[3]));
1706	var x9: u64 = undefined;
1707	var x10: u1 = undefined;
1708	subborrowxU64(&x9, &x10, x8, 0x0, (arg1[4]));
1709	var x11: u64 = undefined;
1710	var x12: u1 = undefined;
1711	subborrowxU64(&x11, &x12, x10, 0x0, (arg1[5]));
1712	var x13: u64 = undefined;
1713	cmovznzU64(&x13, x12, 0x0, 0xffffffffffffffff);
1714	var x14: u64 = undefined;
1715	var x15: u1 = undefined;
1716	addcarryxU64(&x14, &x15, 0x0, x1, (x13 & 0xecec196accc52973));
1717	var x16: u64 = undefined;
1718	var x17: u1 = undefined;
1719	addcarryxU64(&x16, &x17, x15, x3, (x13 & 0x581a0db248b0a77a));
1720	var x18: u64 = undefined;
1721	var x19: u1 = undefined;
1722	addcarryxU64(&x18, &x19, x17, x5, (x13 & 0xc7634d81f4372ddf));
1723	var x20: u64 = undefined;
1724	var x21: u1 = undefined;
1725	addcarryxU64(&x20, &x21, x19, x7, x13);
1726	var x22: u64 = undefined;
1727	var x23: u1 = undefined;
1728	addcarryxU64(&x22, &x23, x21, x9, x13);
1729	var x24: u64 = undefined;
1730	var x25: u1 = undefined;
1731	addcarryxU64(&x24, &x25, x23, x11, x13);
1732	out1[0] = x14;
1733	out1[1] = x16;
1734	out1[2] = x18;
1735	out1[3] = x20;
1736	out1[4] = x22;
1737	out1[5] = x24;
1738	}
1739
1740	/// The function fromMontgomery translates a field element out of the Montgomery domain.
1741	///
1742	/// Preconditions:
1743	/// 0 ≤ eval arg1 < m
1744	/// Postconditions:
1745	/// eval out1 mod m = (eval arg1 * ((2^64)⁻¹ mod m)^6) mod m
1746	/// 0 ≤ eval out1 < m
1747	///
1748	pub fn fromMontgomery(out1: *NonMontgomeryDomainFieldElement, arg1: MontgomeryDomainFieldElement) void {
1749	@setRuntimeSafety(mode == .Debug);
1750
1751	const x1 = (arg1[0]);
1752	var x2: u64 = undefined;
1753	var x3: u64 = undefined;
1754	mulxU64(&x2, &x3, x1, 0x6ed46089e88fdc45);
1755	var x4: u64 = undefined;
1756	var x5: u64 = undefined;
1757	mulxU64(&x4, &x5, x2, 0xffffffffffffffff);
1758	var x6: u64 = undefined;
1759	var x7: u64 = undefined;
1760	mulxU64(&x6, &x7, x2, 0xffffffffffffffff);
1761	var x8: u64 = undefined;
1762	var x9: u64 = undefined;
1763	mulxU64(&x8, &x9, x2, 0xffffffffffffffff);
1764	var x10: u64 = undefined;
1765	var x11: u64 = undefined;
1766	mulxU64(&x10, &x11, x2, 0xc7634d81f4372ddf);
1767	var x12: u64 = undefined;
1768	var x13: u64 = undefined;
1769	mulxU64(&x12, &x13, x2, 0x581a0db248b0a77a);
1770	var x14: u64 = undefined;
1771	var x15: u64 = undefined;
1772	mulxU64(&x14, &x15, x2, 0xecec196accc52973);
1773	var x16: u64 = undefined;
1774	var x17: u1 = undefined;
1775	addcarryxU64(&x16, &x17, 0x0, x15, x12);
1776	var x18: u64 = undefined;
1777	var x19: u1 = undefined;
1778	addcarryxU64(&x18, &x19, x17, x13, x10);
1779	var x20: u64 = undefined;
1780	var x21: u1 = undefined;
1781	addcarryxU64(&x20, &x21, x19, x11, x8);
1782	var x22: u64 = undefined;
1783	var x23: u1 = undefined;
1784	addcarryxU64(&x22, &x23, x21, x9, x6);
1785	var x24: u64 = undefined;
1786	var x25: u1 = undefined;
1787	addcarryxU64(&x24, &x25, x23, x7, x4);
1788	var x26: u64 = undefined;
1789	var x27: u1 = undefined;
1790	addcarryxU64(&x26, &x27, 0x0, x1, x14);
1791	var x28: u64 = undefined;
1792	var x29: u1 = undefined;
1793	addcarryxU64(&x28, &x29, x27, 0x0, x16);
1794	var x30: u64 = undefined;
1795	var x31: u1 = undefined;
1796	addcarryxU64(&x30, &x31, x29, 0x0, x18);
1797	var x32: u64 = undefined;
1798	var x33: u1 = undefined;
1799	addcarryxU64(&x32, &x33, x31, 0x0, x20);
1800	var x34: u64 = undefined;
1801	var x35: u1 = undefined;
1802	addcarryxU64(&x34, &x35, x33, 0x0, x22);
1803	var x36: u64 = undefined;
1804	var x37: u1 = undefined;
1805	addcarryxU64(&x36, &x37, x35, 0x0, x24);
1806	var x38: u64 = undefined;
1807	var x39: u1 = undefined;
1808	addcarryxU64(&x38, &x39, x37, 0x0, (@as(u64, x25) + x5));
1809	var x40: u64 = undefined;
1810	var x41: u1 = undefined;
1811	addcarryxU64(&x40, &x41, 0x0, x28, (arg1[1]));
1812	var x42: u64 = undefined;
1813	var x43: u1 = undefined;
1814	addcarryxU64(&x42, &x43, x41, x30, 0x0);
1815	var x44: u64 = undefined;
1816	var x45: u1 = undefined;
1817	addcarryxU64(&x44, &x45, x43, x32, 0x0);
1818	var x46: u64 = undefined;
1819	var x47: u1 = undefined;
1820	addcarryxU64(&x46, &x47, x45, x34, 0x0);
1821	var x48: u64 = undefined;
1822	var x49: u1 = undefined;
1823	addcarryxU64(&x48, &x49, x47, x36, 0x0);
1824	var x50: u64 = undefined;
1825	var x51: u1 = undefined;
1826	addcarryxU64(&x50, &x51, x49, x38, 0x0);
1827	var x52: u64 = undefined;
1828	var x53: u64 = undefined;
1829	mulxU64(&x52, &x53, x40, 0x6ed46089e88fdc45);
1830	var x54: u64 = undefined;
1831	var x55: u64 = undefined;
1832	mulxU64(&x54, &x55, x52, 0xffffffffffffffff);
1833	var x56: u64 = undefined;
1834	var x57: u64 = undefined;
1835	mulxU64(&x56, &x57, x52, 0xffffffffffffffff);
1836	var x58: u64 = undefined;
1837	var x59: u64 = undefined;
1838	mulxU64(&x58, &x59, x52, 0xffffffffffffffff);
1839	var x60: u64 = undefined;
1840	var x61: u64 = undefined;
1841	mulxU64(&x60, &x61, x52, 0xc7634d81f4372ddf);
1842	var x62: u64 = undefined;
1843	var x63: u64 = undefined;
1844	mulxU64(&x62, &x63, x52, 0x581a0db248b0a77a);
1845	var x64: u64 = undefined;
1846	var x65: u64 = undefined;
1847	mulxU64(&x64, &x65, x52, 0xecec196accc52973);
1848	var x66: u64 = undefined;
1849	var x67: u1 = undefined;
1850	addcarryxU64(&x66, &x67, 0x0, x65, x62);
1851	var x68: u64 = undefined;
1852	var x69: u1 = undefined;
1853	addcarryxU64(&x68, &x69, x67, x63, x60);
1854	var x70: u64 = undefined;
1855	var x71: u1 = undefined;
1856	addcarryxU64(&x70, &x71, x69, x61, x58);
1857	var x72: u64 = undefined;
1858	var x73: u1 = undefined;
1859	addcarryxU64(&x72, &x73, x71, x59, x56);
1860	var x74: u64 = undefined;
1861	var x75: u1 = undefined;
1862	addcarryxU64(&x74, &x75, x73, x57, x54);
1863	var x76: u64 = undefined;
1864	var x77: u1 = undefined;
1865	addcarryxU64(&x76, &x77, 0x0, x40, x64);
1866	var x78: u64 = undefined;
1867	var x79: u1 = undefined;
1868	addcarryxU64(&x78, &x79, x77, x42, x66);
1869	var x80: u64 = undefined;
1870	var x81: u1 = undefined;
1871	addcarryxU64(&x80, &x81, x79, x44, x68);
1872	var x82: u64 = undefined;
1873	var x83: u1 = undefined;
1874	addcarryxU64(&x82, &x83, x81, x46, x70);
1875	var x84: u64 = undefined;
1876	var x85: u1 = undefined;
1877	addcarryxU64(&x84, &x85, x83, x48, x72);
1878	var x86: u64 = undefined;
1879	var x87: u1 = undefined;
1880	addcarryxU64(&x86, &x87, x85, x50, x74);
1881	var x88: u64 = undefined;
1882	var x89: u1 = undefined;
1883	addcarryxU64(&x88, &x89, x87, (@as(u64, x51) + @as(u64, x39)), (@as(u64, x75) + x55));
1884	var x90: u64 = undefined;
1885	var x91: u1 = undefined;
1886	addcarryxU64(&x90, &x91, 0x0, x78, (arg1[2]));
1887	var x92: u64 = undefined;
1888	var x93: u1 = undefined;
1889	addcarryxU64(&x92, &x93, x91, x80, 0x0);
1890	var x94: u64 = undefined;
1891	var x95: u1 = undefined;
1892	addcarryxU64(&x94, &x95, x93, x82, 0x0);
1893	var x96: u64 = undefined;
1894	var x97: u1 = undefined;
1895	addcarryxU64(&x96, &x97, x95, x84, 0x0);
1896	var x98: u64 = undefined;
1897	var x99: u1 = undefined;
1898	addcarryxU64(&x98, &x99, x97, x86, 0x0);
1899	var x100: u64 = undefined;
1900	var x101: u1 = undefined;
1901	addcarryxU64(&x100, &x101, x99, x88, 0x0);
1902	var x102: u64 = undefined;
1903	var x103: u64 = undefined;
1904	mulxU64(&x102, &x103, x90, 0x6ed46089e88fdc45);
1905	var x104: u64 = undefined;
1906	var x105: u64 = undefined;
1907	mulxU64(&x104, &x105, x102, 0xffffffffffffffff);
1908	var x106: u64 = undefined;
1909	var x107: u64 = undefined;
1910	mulxU64(&x106, &x107, x102, 0xffffffffffffffff);
1911	var x108: u64 = undefined;
1912	var x109: u64 = undefined;
1913	mulxU64(&x108, &x109, x102, 0xffffffffffffffff);
1914	var x110: u64 = undefined;
1915	var x111: u64 = undefined;
1916	mulxU64(&x110, &x111, x102, 0xc7634d81f4372ddf);
1917	var x112: u64 = undefined;
1918	var x113: u64 = undefined;
1919	mulxU64(&x112, &x113, x102, 0x581a0db248b0a77a);
1920	var x114: u64 = undefined;
1921	var x115: u64 = undefined;
1922	mulxU64(&x114, &x115, x102, 0xecec196accc52973);
1923	var x116: u64 = undefined;
1924	var x117: u1 = undefined;
1925	addcarryxU64(&x116, &x117, 0x0, x115, x112);
1926	var x118: u64 = undefined;
1927	var x119: u1 = undefined;
1928	addcarryxU64(&x118, &x119, x117, x113, x110);
1929	var x120: u64 = undefined;
1930	var x121: u1 = undefined;
1931	addcarryxU64(&x120, &x121, x119, x111, x108);
1932	var x122: u64 = undefined;
1933	var x123: u1 = undefined;
1934	addcarryxU64(&x122, &x123, x121, x109, x106);
1935	var x124: u64 = undefined;
1936	var x125: u1 = undefined;
1937	addcarryxU64(&x124, &x125, x123, x107, x104);
1938	var x126: u64 = undefined;
1939	var x127: u1 = undefined;
1940	addcarryxU64(&x126, &x127, 0x0, x90, x114);
1941	var x128: u64 = undefined;
1942	var x129: u1 = undefined;
1943	addcarryxU64(&x128, &x129, x127, x92, x116);
1944	var x130: u64 = undefined;
1945	var x131: u1 = undefined;
1946	addcarryxU64(&x130, &x131, x129, x94, x118);
1947	var x132: u64 = undefined;
1948	var x133: u1 = undefined;
1949	addcarryxU64(&x132, &x133, x131, x96, x120);
1950	var x134: u64 = undefined;
1951	var x135: u1 = undefined;
1952	addcarryxU64(&x134, &x135, x133, x98, x122);
1953	var x136: u64 = undefined;
1954	var x137: u1 = undefined;
1955	addcarryxU64(&x136, &x137, x135, x100, x124);
1956	var x138: u64 = undefined;
1957	var x139: u1 = undefined;
1958	addcarryxU64(&x138, &x139, x137, (@as(u64, x101) + @as(u64, x89)), (@as(u64, x125) + x105));
1959	var x140: u64 = undefined;
1960	var x141: u1 = undefined;
1961	addcarryxU64(&x140, &x141, 0x0, x128, (arg1[3]));
1962	var x142: u64 = undefined;
1963	var x143: u1 = undefined;
1964	addcarryxU64(&x142, &x143, x141, x130, 0x0);
1965	var x144: u64 = undefined;
1966	var x145: u1 = undefined;
1967	addcarryxU64(&x144, &x145, x143, x132, 0x0);
1968	var x146: u64 = undefined;
1969	var x147: u1 = undefined;
1970	addcarryxU64(&x146, &x147, x145, x134, 0x0);
1971	var x148: u64 = undefined;
1972	var x149: u1 = undefined;
1973	addcarryxU64(&x148, &x149, x147, x136, 0x0);
1974	var x150: u64 = undefined;
1975	var x151: u1 = undefined;
1976	addcarryxU64(&x150, &x151, x149, x138, 0x0);
1977	var x152: u64 = undefined;
1978	var x153: u64 = undefined;
1979	mulxU64(&x152, &x153, x140, 0x6ed46089e88fdc45);
1980	var x154: u64 = undefined;
1981	var x155: u64 = undefined;
1982	mulxU64(&x154, &x155, x152, 0xffffffffffffffff);
1983	var x156: u64 = undefined;
1984	var x157: u64 = undefined;
1985	mulxU64(&x156, &x157, x152, 0xffffffffffffffff);
1986	var x158: u64 = undefined;
1987	var x159: u64 = undefined;
1988	mulxU64(&x158, &x159, x152, 0xffffffffffffffff);
1989	var x160: u64 = undefined;
1990	var x161: u64 = undefined;
1991	mulxU64(&x160, &x161, x152, 0xc7634d81f4372ddf);
1992	var x162: u64 = undefined;
1993	var x163: u64 = undefined;
1994	mulxU64(&x162, &x163, x152, 0x581a0db248b0a77a);
1995	var x164: u64 = undefined;
1996	var x165: u64 = undefined;
1997	mulxU64(&x164, &x165, x152, 0xecec196accc52973);
1998	var x166: u64 = undefined;
1999	var x167: u1 = undefined;
2000	addcarryxU64(&x166, &x167, 0x0, x165, x162);
2001	var x168: u64 = undefined;
2002	var x169: u1 = undefined;
2003	addcarryxU64(&x168, &x169, x167, x163, x160);
2004	var x170: u64 = undefined;
2005	var x171: u1 = undefined;
2006	addcarryxU64(&x170, &x171, x169, x161, x158);
2007	var x172: u64 = undefined;
2008	var x173: u1 = undefined;
2009	addcarryxU64(&x172, &x173, x171, x159, x156);
2010	var x174: u64 = undefined;
2011	var x175: u1 = undefined;
2012	addcarryxU64(&x174, &x175, x173, x157, x154);
2013	var x176: u64 = undefined;
2014	var x177: u1 = undefined;
2015	addcarryxU64(&x176, &x177, 0x0, x140, x164);
2016	var x178: u64 = undefined;
2017	var x179: u1 = undefined;
2018	addcarryxU64(&x178, &x179, x177, x142, x166);
2019	var x180: u64 = undefined;
2020	var x181: u1 = undefined;
2021	addcarryxU64(&x180, &x181, x179, x144, x168);
2022	var x182: u64 = undefined;
2023	var x183: u1 = undefined;
2024	addcarryxU64(&x182, &x183, x181, x146, x170);
2025	var x184: u64 = undefined;
2026	var x185: u1 = undefined;
2027	addcarryxU64(&x184, &x185, x183, x148, x172);
2028	var x186: u64 = undefined;
2029	var x187: u1 = undefined;
2030	addcarryxU64(&x186, &x187, x185, x150, x174);
2031	var x188: u64 = undefined;
2032	var x189: u1 = undefined;
2033	addcarryxU64(&x188, &x189, x187, (@as(u64, x151) + @as(u64, x139)), (@as(u64, x175) + x155));
2034	var x190: u64 = undefined;
2035	var x191: u1 = undefined;
2036	addcarryxU64(&x190, &x191, 0x0, x178, (arg1[4]));
2037	var x192: u64 = undefined;
2038	var x193: u1 = undefined;
2039	addcarryxU64(&x192, &x193, x191, x180, 0x0);
2040	var x194: u64 = undefined;
2041	var x195: u1 = undefined;
2042	addcarryxU64(&x194, &x195, x193, x182, 0x0);
2043	var x196: u64 = undefined;
2044	var x197: u1 = undefined;
2045	addcarryxU64(&x196, &x197, x195, x184, 0x0);
2046	var x198: u64 = undefined;
2047	var x199: u1 = undefined;
2048	addcarryxU64(&x198, &x199, x197, x186, 0x0);
2049	var x200: u64 = undefined;
2050	var x201: u1 = undefined;
2051	addcarryxU64(&x200, &x201, x199, x188, 0x0);
2052	var x202: u64 = undefined;
2053	var x203: u64 = undefined;
2054	mulxU64(&x202, &x203, x190, 0x6ed46089e88fdc45);
2055	var x204: u64 = undefined;
2056	var x205: u64 = undefined;
2057	mulxU64(&x204, &x205, x202, 0xffffffffffffffff);
2058	var x206: u64 = undefined;
2059	var x207: u64 = undefined;
2060	mulxU64(&x206, &x207, x202, 0xffffffffffffffff);
2061	var x208: u64 = undefined;
2062	var x209: u64 = undefined;
2063	mulxU64(&x208, &x209, x202, 0xffffffffffffffff);
2064	var x210: u64 = undefined;
2065	var x211: u64 = undefined;
2066	mulxU64(&x210, &x211, x202, 0xc7634d81f4372ddf);
2067	var x212: u64 = undefined;
2068	var x213: u64 = undefined;
2069	mulxU64(&x212, &x213, x202, 0x581a0db248b0a77a);
2070	var x214: u64 = undefined;
2071	var x215: u64 = undefined;
2072	mulxU64(&x214, &x215, x202, 0xecec196accc52973);
2073	var x216: u64 = undefined;
2074	var x217: u1 = undefined;
2075	addcarryxU64(&x216, &x217, 0x0, x215, x212);
2076	var x218: u64 = undefined;
2077	var x219: u1 = undefined;
2078	addcarryxU64(&x218, &x219, x217, x213, x210);
2079	var x220: u64 = undefined;
2080	var x221: u1 = undefined;
2081	addcarryxU64(&x220, &x221, x219, x211, x208);
2082	var x222: u64 = undefined;
2083	var x223: u1 = undefined;
2084	addcarryxU64(&x222, &x223, x221, x209, x206);
2085	var x224: u64 = undefined;
2086	var x225: u1 = undefined;
2087	addcarryxU64(&x224, &x225, x223, x207, x204);
2088	var x226: u64 = undefined;
2089	var x227: u1 = undefined;
2090	addcarryxU64(&x226, &x227, 0x0, x190, x214);
2091	var x228: u64 = undefined;
2092	var x229: u1 = undefined;
2093	addcarryxU64(&x228, &x229, x227, x192, x216);
2094	var x230: u64 = undefined;
2095	var x231: u1 = undefined;
2096	addcarryxU64(&x230, &x231, x229, x194, x218);
2097	var x232: u64 = undefined;
2098	var x233: u1 = undefined;
2099	addcarryxU64(&x232, &x233, x231, x196, x220);
2100	var x234: u64 = undefined;
2101	var x235: u1 = undefined;
2102	addcarryxU64(&x234, &x235, x233, x198, x222);
2103	var x236: u64 = undefined;
2104	var x237: u1 = undefined;
2105	addcarryxU64(&x236, &x237, x235, x200, x224);
2106	var x238: u64 = undefined;
2107	var x239: u1 = undefined;
2108	addcarryxU64(&x238, &x239, x237, (@as(u64, x201) + @as(u64, x189)), (@as(u64, x225) + x205));
2109	var x240: u64 = undefined;
2110	var x241: u1 = undefined;
2111	addcarryxU64(&x240, &x241, 0x0, x228, (arg1[5]));
2112	var x242: u64 = undefined;
2113	var x243: u1 = undefined;
2114	addcarryxU64(&x242, &x243, x241, x230, 0x0);
2115	var x244: u64 = undefined;
2116	var x245: u1 = undefined;
2117	addcarryxU64(&x244, &x245, x243, x232, 0x0);
2118	var x246: u64 = undefined;
2119	var x247: u1 = undefined;
2120	addcarryxU64(&x246, &x247, x245, x234, 0x0);
2121	var x248: u64 = undefined;
2122	var x249: u1 = undefined;
2123	addcarryxU64(&x248, &x249, x247, x236, 0x0);
2124	var x250: u64 = undefined;
2125	var x251: u1 = undefined;
2126	addcarryxU64(&x250, &x251, x249, x238, 0x0);
2127	var x252: u64 = undefined;
2128	var x253: u64 = undefined;
2129	mulxU64(&x252, &x253, x240, 0x6ed46089e88fdc45);
2130	var x254: u64 = undefined;
2131	var x255: u64 = undefined;
2132	mulxU64(&x254, &x255, x252, 0xffffffffffffffff);
2133	var x256: u64 = undefined;
2134	var x257: u64 = undefined;
2135	mulxU64(&x256, &x257, x252, 0xffffffffffffffff);
2136	var x258: u64 = undefined;
2137	var x259: u64 = undefined;
2138	mulxU64(&x258, &x259, x252, 0xffffffffffffffff);
2139	var x260: u64 = undefined;
2140	var x261: u64 = undefined;
2141	mulxU64(&x260, &x261, x252, 0xc7634d81f4372ddf);
2142	var x262: u64 = undefined;
2143	var x263: u64 = undefined;
2144	mulxU64(&x262, &x263, x252, 0x581a0db248b0a77a);
2145	var x264: u64 = undefined;
2146	var x265: u64 = undefined;
2147	mulxU64(&x264, &x265, x252, 0xecec196accc52973);
2148	var x266: u64 = undefined;
2149	var x267: u1 = undefined;
2150	addcarryxU64(&x266, &x267, 0x0, x265, x262);
2151	var x268: u64 = undefined;
2152	var x269: u1 = undefined;
2153	addcarryxU64(&x268, &x269, x267, x263, x260);
2154	var x270: u64 = undefined;
2155	var x271: u1 = undefined;
2156	addcarryxU64(&x270, &x271, x269, x261, x258);
2157	var x272: u64 = undefined;
2158	var x273: u1 = undefined;
2159	addcarryxU64(&x272, &x273, x271, x259, x256);
2160	var x274: u64 = undefined;
2161	var x275: u1 = undefined;
2162	addcarryxU64(&x274, &x275, x273, x257, x254);
2163	var x276: u64 = undefined;
2164	var x277: u1 = undefined;
2165	addcarryxU64(&x276, &x277, 0x0, x240, x264);
2166	var x278: u64 = undefined;
2167	var x279: u1 = undefined;
2168	addcarryxU64(&x278, &x279, x277, x242, x266);
2169	var x280: u64 = undefined;
2170	var x281: u1 = undefined;
2171	addcarryxU64(&x280, &x281, x279, x244, x268);
2172	var x282: u64 = undefined;
2173	var x283: u1 = undefined;
2174	addcarryxU64(&x282, &x283, x281, x246, x270);
2175	var x284: u64 = undefined;
2176	var x285: u1 = undefined;
2177	addcarryxU64(&x284, &x285, x283, x248, x272);
2178	var x286: u64 = undefined;
2179	var x287: u1 = undefined;
2180	addcarryxU64(&x286, &x287, x285, x250, x274);
2181	var x288: u64 = undefined;
2182	var x289: u1 = undefined;
2183	addcarryxU64(&x288, &x289, x287, (@as(u64, x251) + @as(u64, x239)), (@as(u64, x275) + x255));
2184	var x290: u64 = undefined;
2185	var x291: u1 = undefined;
2186	subborrowxU64(&x290, &x291, 0x0, x278, 0xecec196accc52973);
2187	var x292: u64 = undefined;
2188	var x293: u1 = undefined;
2189	subborrowxU64(&x292, &x293, x291, x280, 0x581a0db248b0a77a);
2190	var x294: u64 = undefined;
2191	var x295: u1 = undefined;
2192	subborrowxU64(&x294, &x295, x293, x282, 0xc7634d81f4372ddf);
2193	var x296: u64 = undefined;
2194	var x297: u1 = undefined;
2195	subborrowxU64(&x296, &x297, x295, x284, 0xffffffffffffffff);
2196	var x298: u64 = undefined;
2197	var x299: u1 = undefined;
2198	subborrowxU64(&x298, &x299, x297, x286, 0xffffffffffffffff);
2199	var x300: u64 = undefined;
2200	var x301: u1 = undefined;
2201	subborrowxU64(&x300, &x301, x299, x288, 0xffffffffffffffff);
2202	var x302: u64 = undefined;
2203	var x303: u1 = undefined;
2204	subborrowxU64(&x302, &x303, x301, @as(u64, x289), 0x0);
2205	var x304: u64 = undefined;
2206	cmovznzU64(&x304, x303, x290, x278);
2207	var x305: u64 = undefined;
2208	cmovznzU64(&x305, x303, x292, x280);
2209	var x306: u64 = undefined;
2210	cmovznzU64(&x306, x303, x294, x282);
2211	var x307: u64 = undefined;
2212	cmovznzU64(&x307, x303, x296, x284);
2213	var x308: u64 = undefined;
2214	cmovznzU64(&x308, x303, x298, x286);
2215	var x309: u64 = undefined;
2216	cmovznzU64(&x309, x303, x300, x288);
2217	out1[0] = x304;
2218	out1[1] = x305;
2219	out1[2] = x306;
2220	out1[3] = x307;
2221	out1[4] = x308;
2222	out1[5] = x309;
2223	}
2224
2225	/// The function toMontgomery translates a field element into the Montgomery domain.
2226	///
2227	/// Preconditions:
2228	/// 0 ≤ eval arg1 < m
2229	/// Postconditions:
2230	/// eval (from_montgomery out1) mod m = eval arg1 mod m
2231	/// 0 ≤ eval out1 < m
2232	///
2233	pub fn toMontgomery(out1: *MontgomeryDomainFieldElement, arg1: NonMontgomeryDomainFieldElement) void {
2234	@setRuntimeSafety(mode == .Debug);
2235
2236	const x1 = (arg1[1]);
2237	const x2 = (arg1[2]);
2238	const x3 = (arg1[3]);
2239	const x4 = (arg1[4]);
2240	const x5 = (arg1[5]);
2241	const x6 = (arg1[0]);
2242	var x7: u64 = undefined;
2243	var x8: u64 = undefined;
2244	mulxU64(&x7, &x8, x6, 0xc84ee012b39bf21);
2245	var x9: u64 = undefined;
2246	var x10: u64 = undefined;
2247	mulxU64(&x9, &x10, x6, 0x3fb05b7a28266895);
2248	var x11: u64 = undefined;
2249	var x12: u64 = undefined;
2250	mulxU64(&x11, &x12, x6, 0xd40d49174aab1cc5);
2251	var x13: u64 = undefined;
2252	var x14: u64 = undefined;
2253	mulxU64(&x13, &x14, x6, 0xbc3e483afcb82947);
2254	var x15: u64 = undefined;
2255	var x16: u64 = undefined;
2256	mulxU64(&x15, &x16, x6, 0xff3d81e5df1aa419);
2257	var x17: u64 = undefined;
2258	var x18: u64 = undefined;
2259	mulxU64(&x17, &x18, x6, 0x2d319b2419b409a9);
2260	var x19: u64 = undefined;
2261	var x20: u1 = undefined;
2262	addcarryxU64(&x19, &x20, 0x0, x18, x15);
2263	var x21: u64 = undefined;
2264	var x22: u1 = undefined;
2265	addcarryxU64(&x21, &x22, x20, x16, x13);
2266	var x23: u64 = undefined;
2267	var x24: u1 = undefined;
2268	addcarryxU64(&x23, &x24, x22, x14, x11);
2269	var x25: u64 = undefined;
2270	var x26: u1 = undefined;
2271	addcarryxU64(&x25, &x26, x24, x12, x9);
2272	var x27: u64 = undefined;
2273	var x28: u1 = undefined;
2274	addcarryxU64(&x27, &x28, x26, x10, x7);
2275	var x29: u64 = undefined;
2276	var x30: u64 = undefined;
2277	mulxU64(&x29, &x30, x17, 0x6ed46089e88fdc45);
2278	var x31: u64 = undefined;
2279	var x32: u64 = undefined;
2280	mulxU64(&x31, &x32, x29, 0xffffffffffffffff);
2281	var x33: u64 = undefined;
2282	var x34: u64 = undefined;
2283	mulxU64(&x33, &x34, x29, 0xffffffffffffffff);
2284	var x35: u64 = undefined;
2285	var x36: u64 = undefined;
2286	mulxU64(&x35, &x36, x29, 0xffffffffffffffff);
2287	var x37: u64 = undefined;
2288	var x38: u64 = undefined;
2289	mulxU64(&x37, &x38, x29, 0xc7634d81f4372ddf);
2290	var x39: u64 = undefined;
2291	var x40: u64 = undefined;
2292	mulxU64(&x39, &x40, x29, 0x581a0db248b0a77a);
2293	var x41: u64 = undefined;
2294	var x42: u64 = undefined;
2295	mulxU64(&x41, &x42, x29, 0xecec196accc52973);
2296	var x43: u64 = undefined;
2297	var x44: u1 = undefined;
2298	addcarryxU64(&x43, &x44, 0x0, x42, x39);
2299	var x45: u64 = undefined;
2300	var x46: u1 = undefined;
2301	addcarryxU64(&x45, &x46, x44, x40, x37);
2302	var x47: u64 = undefined;
2303	var x48: u1 = undefined;
2304	addcarryxU64(&x47, &x48, x46, x38, x35);
2305	var x49: u64 = undefined;
2306	var x50: u1 = undefined;
2307	addcarryxU64(&x49, &x50, x48, x36, x33);
2308	var x51: u64 = undefined;
2309	var x52: u1 = undefined;
2310	addcarryxU64(&x51, &x52, x50, x34, x31);
2311	var x53: u64 = undefined;
2312	var x54: u1 = undefined;
2313	addcarryxU64(&x53, &x54, 0x0, x17, x41);
2314	var x55: u64 = undefined;
2315	var x56: u1 = undefined;
2316	addcarryxU64(&x55, &x56, x54, x19, x43);
2317	var x57: u64 = undefined;
2318	var x58: u1 = undefined;
2319	addcarryxU64(&x57, &x58, x56, x21, x45);
2320	var x59: u64 = undefined;
2321	var x60: u1 = undefined;
2322	addcarryxU64(&x59, &x60, x58, x23, x47);
2323	var x61: u64 = undefined;
2324	var x62: u1 = undefined;
2325	addcarryxU64(&x61, &x62, x60, x25, x49);
2326	var x63: u64 = undefined;
2327	var x64: u1 = undefined;
2328	addcarryxU64(&x63, &x64, x62, x27, x51);
2329	var x65: u64 = undefined;
2330	var x66: u1 = undefined;
2331	addcarryxU64(&x65, &x66, x64, (@as(u64, x28) + x8), (@as(u64, x52) + x32));
2332	var x67: u64 = undefined;
2333	var x68: u64 = undefined;
2334	mulxU64(&x67, &x68, x1, 0xc84ee012b39bf21);
2335	var x69: u64 = undefined;
2336	var x70: u64 = undefined;
2337	mulxU64(&x69, &x70, x1, 0x3fb05b7a28266895);
2338	var x71: u64 = undefined;
2339	var x72: u64 = undefined;
2340	mulxU64(&x71, &x72, x1, 0xd40d49174aab1cc5);
2341	var x73: u64 = undefined;
2342	var x74: u64 = undefined;
2343	mulxU64(&x73, &x74, x1, 0xbc3e483afcb82947);
2344	var x75: u64 = undefined;
2345	var x76: u64 = undefined;
2346	mulxU64(&x75, &x76, x1, 0xff3d81e5df1aa419);
2347	var x77: u64 = undefined;
2348	var x78: u64 = undefined;
2349	mulxU64(&x77, &x78, x1, 0x2d319b2419b409a9);
2350	var x79: u64 = undefined;
2351	var x80: u1 = undefined;
2352	addcarryxU64(&x79, &x80, 0x0, x78, x75);
2353	var x81: u64 = undefined;
2354	var x82: u1 = undefined;
2355	addcarryxU64(&x81, &x82, x80, x76, x73);
2356	var x83: u64 = undefined;
2357	var x84: u1 = undefined;
2358	addcarryxU64(&x83, &x84, x82, x74, x71);
2359	var x85: u64 = undefined;
2360	var x86: u1 = undefined;
2361	addcarryxU64(&x85, &x86, x84, x72, x69);
2362	var x87: u64 = undefined;
2363	var x88: u1 = undefined;
2364	addcarryxU64(&x87, &x88, x86, x70, x67);
2365	var x89: u64 = undefined;
2366	var x90: u1 = undefined;
2367	addcarryxU64(&x89, &x90, 0x0, x55, x77);
2368	var x91: u64 = undefined;
2369	var x92: u1 = undefined;
2370	addcarryxU64(&x91, &x92, x90, x57, x79);
2371	var x93: u64 = undefined;
2372	var x94: u1 = undefined;
2373	addcarryxU64(&x93, &x94, x92, x59, x81);
2374	var x95: u64 = undefined;
2375	var x96: u1 = undefined;
2376	addcarryxU64(&x95, &x96, x94, x61, x83);
2377	var x97: u64 = undefined;
2378	var x98: u1 = undefined;
2379	addcarryxU64(&x97, &x98, x96, x63, x85);
2380	var x99: u64 = undefined;
2381	var x100: u1 = undefined;
2382	addcarryxU64(&x99, &x100, x98, x65, x87);
2383	var x101: u64 = undefined;
2384	var x102: u64 = undefined;
2385	mulxU64(&x101, &x102, x89, 0x6ed46089e88fdc45);
2386	var x103: u64 = undefined;
2387	var x104: u64 = undefined;
2388	mulxU64(&x103, &x104, x101, 0xffffffffffffffff);
2389	var x105: u64 = undefined;
2390	var x106: u64 = undefined;
2391	mulxU64(&x105, &x106, x101, 0xffffffffffffffff);
2392	var x107: u64 = undefined;
2393	var x108: u64 = undefined;
2394	mulxU64(&x107, &x108, x101, 0xffffffffffffffff);
2395	var x109: u64 = undefined;
2396	var x110: u64 = undefined;
2397	mulxU64(&x109, &x110, x101, 0xc7634d81f4372ddf);
2398	var x111: u64 = undefined;
2399	var x112: u64 = undefined;
2400	mulxU64(&x111, &x112, x101, 0x581a0db248b0a77a);
2401	var x113: u64 = undefined;
2402	var x114: u64 = undefined;
2403	mulxU64(&x113, &x114, x101, 0xecec196accc52973);
2404	var x115: u64 = undefined;
2405	var x116: u1 = undefined;
2406	addcarryxU64(&x115, &x116, 0x0, x114, x111);
2407	var x117: u64 = undefined;
2408	var x118: u1 = undefined;
2409	addcarryxU64(&x117, &x118, x116, x112, x109);
2410	var x119: u64 = undefined;
2411	var x120: u1 = undefined;
2412	addcarryxU64(&x119, &x120, x118, x110, x107);
2413	var x121: u64 = undefined;
2414	var x122: u1 = undefined;
2415	addcarryxU64(&x121, &x122, x120, x108, x105);
2416	var x123: u64 = undefined;
2417	var x124: u1 = undefined;
2418	addcarryxU64(&x123, &x124, x122, x106, x103);
2419	var x125: u64 = undefined;
2420	var x126: u1 = undefined;
2421	addcarryxU64(&x125, &x126, 0x0, x89, x113);
2422	var x127: u64 = undefined;
2423	var x128: u1 = undefined;
2424	addcarryxU64(&x127, &x128, x126, x91, x115);
2425	var x129: u64 = undefined;
2426	var x130: u1 = undefined;
2427	addcarryxU64(&x129, &x130, x128, x93, x117);
2428	var x131: u64 = undefined;
2429	var x132: u1 = undefined;
2430	addcarryxU64(&x131, &x132, x130, x95, x119);
2431	var x133: u64 = undefined;
2432	var x134: u1 = undefined;
2433	addcarryxU64(&x133, &x134, x132, x97, x121);
2434	var x135: u64 = undefined;
2435	var x136: u1 = undefined;
2436	addcarryxU64(&x135, &x136, x134, x99, x123);
2437	var x137: u64 = undefined;
2438	var x138: u1 = undefined;
2439	addcarryxU64(&x137, &x138, x136, ((@as(u64, x100) + @as(u64, x66)) + (@as(u64, x88) + x68)), (@as(u64, x124) + x104));
2440	var x139: u64 = undefined;
2441	var x140: u64 = undefined;
2442	mulxU64(&x139, &x140, x2, 0xc84ee012b39bf21);
2443	var x141: u64 = undefined;
2444	var x142: u64 = undefined;
2445	mulxU64(&x141, &x142, x2, 0x3fb05b7a28266895);
2446	var x143: u64 = undefined;
2447	var x144: u64 = undefined;
2448	mulxU64(&x143, &x144, x2, 0xd40d49174aab1cc5);
2449	var x145: u64 = undefined;
2450	var x146: u64 = undefined;
2451	mulxU64(&x145, &x146, x2, 0xbc3e483afcb82947);
2452	var x147: u64 = undefined;
2453	var x148: u64 = undefined;
2454	mulxU64(&x147, &x148, x2, 0xff3d81e5df1aa419);
2455	var x149: u64 = undefined;
2456	var x150: u64 = undefined;
2457	mulxU64(&x149, &x150, x2, 0x2d319b2419b409a9);
2458	var x151: u64 = undefined;
2459	var x152: u1 = undefined;
2460	addcarryxU64(&x151, &x152, 0x0, x150, x147);
2461	var x153: u64 = undefined;
2462	var x154: u1 = undefined;
2463	addcarryxU64(&x153, &x154, x152, x148, x145);
2464	var x155: u64 = undefined;
2465	var x156: u1 = undefined;
2466	addcarryxU64(&x155, &x156, x154, x146, x143);
2467	var x157: u64 = undefined;
2468	var x158: u1 = undefined;
2469	addcarryxU64(&x157, &x158, x156, x144, x141);
2470	var x159: u64 = undefined;
2471	var x160: u1 = undefined;
2472	addcarryxU64(&x159, &x160, x158, x142, x139);
2473	var x161: u64 = undefined;
2474	var x162: u1 = undefined;
2475	addcarryxU64(&x161, &x162, 0x0, x127, x149);
2476	var x163: u64 = undefined;
2477	var x164: u1 = undefined;
2478	addcarryxU64(&x163, &x164, x162, x129, x151);
2479	var x165: u64 = undefined;
2480	var x166: u1 = undefined;
2481	addcarryxU64(&x165, &x166, x164, x131, x153);
2482	var x167: u64 = undefined;
2483	var x168: u1 = undefined;
2484	addcarryxU64(&x167, &x168, x166, x133, x155);
2485	var x169: u64 = undefined;
2486	var x170: u1 = undefined;
2487	addcarryxU64(&x169, &x170, x168, x135, x157);
2488	var x171: u64 = undefined;
2489	var x172: u1 = undefined;
2490	addcarryxU64(&x171, &x172, x170, x137, x159);
2491	var x173: u64 = undefined;
2492	var x174: u64 = undefined;
2493	mulxU64(&x173, &x174, x161, 0x6ed46089e88fdc45);
2494	var x175: u64 = undefined;
2495	var x176: u64 = undefined;
2496	mulxU64(&x175, &x176, x173, 0xffffffffffffffff);
2497	var x177: u64 = undefined;
2498	var x178: u64 = undefined;
2499	mulxU64(&x177, &x178, x173, 0xffffffffffffffff);
2500	var x179: u64 = undefined;
2501	var x180: u64 = undefined;
2502	mulxU64(&x179, &x180, x173, 0xffffffffffffffff);
2503	var x181: u64 = undefined;
2504	var x182: u64 = undefined;
2505	mulxU64(&x181, &x182, x173, 0xc7634d81f4372ddf);
2506	var x183: u64 = undefined;
2507	var x184: u64 = undefined;
2508	mulxU64(&x183, &x184, x173, 0x581a0db248b0a77a);
2509	var x185: u64 = undefined;
2510	var x186: u64 = undefined;
2511	mulxU64(&x185, &x186, x173, 0xecec196accc52973);
2512	var x187: u64 = undefined;
2513	var x188: u1 = undefined;
2514	addcarryxU64(&x187, &x188, 0x0, x186, x183);
2515	var x189: u64 = undefined;
2516	var x190: u1 = undefined;
2517	addcarryxU64(&x189, &x190, x188, x184, x181);
2518	var x191: u64 = undefined;
2519	var x192: u1 = undefined;
2520	addcarryxU64(&x191, &x192, x190, x182, x179);
2521	var x193: u64 = undefined;
2522	var x194: u1 = undefined;
2523	addcarryxU64(&x193, &x194, x192, x180, x177);
2524	var x195: u64 = undefined;
2525	var x196: u1 = undefined;
2526	addcarryxU64(&x195, &x196, x194, x178, x175);
2527	var x197: u64 = undefined;
2528	var x198: u1 = undefined;
2529	addcarryxU64(&x197, &x198, 0x0, x161, x185);
2530	var x199: u64 = undefined;
2531	var x200: u1 = undefined;
2532	addcarryxU64(&x199, &x200, x198, x163, x187);
2533	var x201: u64 = undefined;
2534	var x202: u1 = undefined;
2535	addcarryxU64(&x201, &x202, x200, x165, x189);
2536	var x203: u64 = undefined;
2537	var x204: u1 = undefined;
2538	addcarryxU64(&x203, &x204, x202, x167, x191);
2539	var x205: u64 = undefined;
2540	var x206: u1 = undefined;
2541	addcarryxU64(&x205, &x206, x204, x169, x193);
2542	var x207: u64 = undefined;
2543	var x208: u1 = undefined;
2544	addcarryxU64(&x207, &x208, x206, x171, x195);
2545	var x209: u64 = undefined;
2546	var x210: u1 = undefined;
2547	addcarryxU64(&x209, &x210, x208, ((@as(u64, x172) + @as(u64, x138)) + (@as(u64, x160) + x140)), (@as(u64, x196) + x176));
2548	var x211: u64 = undefined;
2549	var x212: u64 = undefined;
2550	mulxU64(&x211, &x212, x3, 0xc84ee012b39bf21);
2551	var x213: u64 = undefined;
2552	var x214: u64 = undefined;
2553	mulxU64(&x213, &x214, x3, 0x3fb05b7a28266895);
2554	var x215: u64 = undefined;
2555	var x216: u64 = undefined;
2556	mulxU64(&x215, &x216, x3, 0xd40d49174aab1cc5);
2557	var x217: u64 = undefined;
2558	var x218: u64 = undefined;
2559	mulxU64(&x217, &x218, x3, 0xbc3e483afcb82947);
2560	var x219: u64 = undefined;
2561	var x220: u64 = undefined;
2562	mulxU64(&x219, &x220, x3, 0xff3d81e5df1aa419);
2563	var x221: u64 = undefined;
2564	var x222: u64 = undefined;
2565	mulxU64(&x221, &x222, x3, 0x2d319b2419b409a9);
2566	var x223: u64 = undefined;
2567	var x224: u1 = undefined;
2568	addcarryxU64(&x223, &x224, 0x0, x222, x219);
2569	var x225: u64 = undefined;
2570	var x226: u1 = undefined;
2571	addcarryxU64(&x225, &x226, x224, x220, x217);
2572	var x227: u64 = undefined;
2573	var x228: u1 = undefined;
2574	addcarryxU64(&x227, &x228, x226, x218, x215);
2575	var x229: u64 = undefined;
2576	var x230: u1 = undefined;
2577	addcarryxU64(&x229, &x230, x228, x216, x213);
2578	var x231: u64 = undefined;
2579	var x232: u1 = undefined;
2580	addcarryxU64(&x231, &x232, x230, x214, x211);
2581	var x233: u64 = undefined;
2582	var x234: u1 = undefined;
2583	addcarryxU64(&x233, &x234, 0x0, x199, x221);
2584	var x235: u64 = undefined;
2585	var x236: u1 = undefined;
2586	addcarryxU64(&x235, &x236, x234, x201, x223);
2587	var x237: u64 = undefined;
2588	var x238: u1 = undefined;
2589	addcarryxU64(&x237, &x238, x236, x203, x225);
2590	var x239: u64 = undefined;
2591	var x240: u1 = undefined;
2592	addcarryxU64(&x239, &x240, x238, x205, x227);
2593	var x241: u64 = undefined;
2594	var x242: u1 = undefined;
2595	addcarryxU64(&x241, &x242, x240, x207, x229);
2596	var x243: u64 = undefined;
2597	var x244: u1 = undefined;
2598	addcarryxU64(&x243, &x244, x242, x209, x231);
2599	var x245: u64 = undefined;
2600	var x246: u64 = undefined;
2601	mulxU64(&x245, &x246, x233, 0x6ed46089e88fdc45);
2602	var x247: u64 = undefined;
2603	var x248: u64 = undefined;
2604	mulxU64(&x247, &x248, x245, 0xffffffffffffffff);
2605	var x249: u64 = undefined;
2606	var x250: u64 = undefined;
2607	mulxU64(&x249, &x250, x245, 0xffffffffffffffff);
2608	var x251: u64 = undefined;
2609	var x252: u64 = undefined;
2610	mulxU64(&x251, &x252, x245, 0xffffffffffffffff);
2611	var x253: u64 = undefined;
2612	var x254: u64 = undefined;
2613	mulxU64(&x253, &x254, x245, 0xc7634d81f4372ddf);
2614	var x255: u64 = undefined;
2615	var x256: u64 = undefined;
2616	mulxU64(&x255, &x256, x245, 0x581a0db248b0a77a);
2617	var x257: u64 = undefined;
2618	var x258: u64 = undefined;
2619	mulxU64(&x257, &x258, x245, 0xecec196accc52973);
2620	var x259: u64 = undefined;
2621	var x260: u1 = undefined;
2622	addcarryxU64(&x259, &x260, 0x0, x258, x255);
2623	var x261: u64 = undefined;
2624	var x262: u1 = undefined;
2625	addcarryxU64(&x261, &x262, x260, x256, x253);
2626	var x263: u64 = undefined;
2627	var x264: u1 = undefined;
2628	addcarryxU64(&x263, &x264, x262, x254, x251);
2629	var x265: u64 = undefined;
2630	var x266: u1 = undefined;
2631	addcarryxU64(&x265, &x266, x264, x252, x249);
2632	var x267: u64 = undefined;
2633	var x268: u1 = undefined;
2634	addcarryxU64(&x267, &x268, x266, x250, x247);
2635	var x269: u64 = undefined;
2636	var x270: u1 = undefined;
2637	addcarryxU64(&x269, &x270, 0x0, x233, x257);
2638	var x271: u64 = undefined;
2639	var x272: u1 = undefined;
2640	addcarryxU64(&x271, &x272, x270, x235, x259);
2641	var x273: u64 = undefined;
2642	var x274: u1 = undefined;
2643	addcarryxU64(&x273, &x274, x272, x237, x261);
2644	var x275: u64 = undefined;
2645	var x276: u1 = undefined;
2646	addcarryxU64(&x275, &x276, x274, x239, x263);
2647	var x277: u64 = undefined;
2648	var x278: u1 = undefined;
2649	addcarryxU64(&x277, &x278, x276, x241, x265);
2650	var x279: u64 = undefined;
2651	var x280: u1 = undefined;
2652	addcarryxU64(&x279, &x280, x278, x243, x267);
2653	var x281: u64 = undefined;
2654	var x282: u1 = undefined;
2655	addcarryxU64(&x281, &x282, x280, ((@as(u64, x244) + @as(u64, x210)) + (@as(u64, x232) + x212)), (@as(u64, x268) + x248));
2656	var x283: u64 = undefined;
2657	var x284: u64 = undefined;
2658	mulxU64(&x283, &x284, x4, 0xc84ee012b39bf21);
2659	var x285: u64 = undefined;
2660	var x286: u64 = undefined;
2661	mulxU64(&x285, &x286, x4, 0x3fb05b7a28266895);
2662	var x287: u64 = undefined;
2663	var x288: u64 = undefined;
2664	mulxU64(&x287, &x288, x4, 0xd40d49174aab1cc5);
2665	var x289: u64 = undefined;
2666	var x290: u64 = undefined;
2667	mulxU64(&x289, &x290, x4, 0xbc3e483afcb82947);
2668	var x291: u64 = undefined;
2669	var x292: u64 = undefined;
2670	mulxU64(&x291, &x292, x4, 0xff3d81e5df1aa419);
2671	var x293: u64 = undefined;
2672	var x294: u64 = undefined;
2673	mulxU64(&x293, &x294, x4, 0x2d319b2419b409a9);
2674	var x295: u64 = undefined;
2675	var x296: u1 = undefined;
2676	addcarryxU64(&x295, &x296, 0x0, x294, x291);
2677	var x297: u64 = undefined;
2678	var x298: u1 = undefined;
2679	addcarryxU64(&x297, &x298, x296, x292, x289);
2680	var x299: u64 = undefined;
2681	var x300: u1 = undefined;
2682	addcarryxU64(&x299, &x300, x298, x290, x287);
2683	var x301: u64 = undefined;
2684	var x302: u1 = undefined;
2685	addcarryxU64(&x301, &x302, x300, x288, x285);
2686	var x303: u64 = undefined;
2687	var x304: u1 = undefined;
2688	addcarryxU64(&x303, &x304, x302, x286, x283);
2689	var x305: u64 = undefined;
2690	var x306: u1 = undefined;
2691	addcarryxU64(&x305, &x306, 0x0, x271, x293);
2692	var x307: u64 = undefined;
2693	var x308: u1 = undefined;
2694	addcarryxU64(&x307, &x308, x306, x273, x295);
2695	var x309: u64 = undefined;
2696	var x310: u1 = undefined;
2697	addcarryxU64(&x309, &x310, x308, x275, x297);
2698	var x311: u64 = undefined;
2699	var x312: u1 = undefined;
2700	addcarryxU64(&x311, &x312, x310, x277, x299);
2701	var x313: u64 = undefined;
2702	var x314: u1 = undefined;
2703	addcarryxU64(&x313, &x314, x312, x279, x301);
2704	var x315: u64 = undefined;
2705	var x316: u1 = undefined;
2706	addcarryxU64(&x315, &x316, x314, x281, x303);
2707	var x317: u64 = undefined;
2708	var x318: u64 = undefined;
2709	mulxU64(&x317, &x318, x305, 0x6ed46089e88fdc45);
2710	var x319: u64 = undefined;
2711	var x320: u64 = undefined;
2712	mulxU64(&x319, &x320, x317, 0xffffffffffffffff);
2713	var x321: u64 = undefined;
2714	var x322: u64 = undefined;
2715	mulxU64(&x321, &x322, x317, 0xffffffffffffffff);
2716	var x323: u64 = undefined;
2717	var x324: u64 = undefined;
2718	mulxU64(&x323, &x324, x317, 0xffffffffffffffff);
2719	var x325: u64 = undefined;
2720	var x326: u64 = undefined;
2721	mulxU64(&x325, &x326, x317, 0xc7634d81f4372ddf);
2722	var x327: u64 = undefined;
2723	var x328: u64 = undefined;
2724	mulxU64(&x327, &x328, x317, 0x581a0db248b0a77a);
2725	var x329: u64 = undefined;
2726	var x330: u64 = undefined;
2727	mulxU64(&x329, &x330, x317, 0xecec196accc52973);
2728	var x331: u64 = undefined;
2729	var x332: u1 = undefined;
2730	addcarryxU64(&x331, &x332, 0x0, x330, x327);
2731	var x333: u64 = undefined;
2732	var x334: u1 = undefined;
2733	addcarryxU64(&x333, &x334, x332, x328, x325);
2734	var x335: u64 = undefined;
2735	var x336: u1 = undefined;
2736	addcarryxU64(&x335, &x336, x334, x326, x323);
2737	var x337: u64 = undefined;
2738	var x338: u1 = undefined;
2739	addcarryxU64(&x337, &x338, x336, x324, x321);
2740	var x339: u64 = undefined;
2741	var x340: u1 = undefined;
2742	addcarryxU64(&x339, &x340, x338, x322, x319);
2743	var x341: u64 = undefined;
2744	var x342: u1 = undefined;
2745	addcarryxU64(&x341, &x342, 0x0, x305, x329);
2746	var x343: u64 = undefined;
2747	var x344: u1 = undefined;
2748	addcarryxU64(&x343, &x344, x342, x307, x331);
2749	var x345: u64 = undefined;
2750	var x346: u1 = undefined;
2751	addcarryxU64(&x345, &x346, x344, x309, x333);
2752	var x347: u64 = undefined;
2753	var x348: u1 = undefined;
2754	addcarryxU64(&x347, &x348, x346, x311, x335);
2755	var x349: u64 = undefined;
2756	var x350: u1 = undefined;
2757	addcarryxU64(&x349, &x350, x348, x313, x337);
2758	var x351: u64 = undefined;
2759	var x352: u1 = undefined;
2760	addcarryxU64(&x351, &x352, x350, x315, x339);
2761	var x353: u64 = undefined;
2762	var x354: u1 = undefined;
2763	addcarryxU64(&x353, &x354, x352, ((@as(u64, x316) + @as(u64, x282)) + (@as(u64, x304) + x284)), (@as(u64, x340) + x320));
2764	var x355: u64 = undefined;
2765	var x356: u64 = undefined;
2766	mulxU64(&x355, &x356, x5, 0xc84ee012b39bf21);
2767	var x357: u64 = undefined;
2768	var x358: u64 = undefined;
2769	mulxU64(&x357, &x358, x5, 0x3fb05b7a28266895);
2770	var x359: u64 = undefined;
2771	var x360: u64 = undefined;
2772	mulxU64(&x359, &x360, x5, 0xd40d49174aab1cc5);
2773	var x361: u64 = undefined;
2774	var x362: u64 = undefined;
2775	mulxU64(&x361, &x362, x5, 0xbc3e483afcb82947);
2776	var x363: u64 = undefined;
2777	var x364: u64 = undefined;
2778	mulxU64(&x363, &x364, x5, 0xff3d81e5df1aa419);
2779	var x365: u64 = undefined;
2780	var x366: u64 = undefined;
2781	mulxU64(&x365, &x366, x5, 0x2d319b2419b409a9);
2782	var x367: u64 = undefined;
2783	var x368: u1 = undefined;
2784	addcarryxU64(&x367, &x368, 0x0, x366, x363);
2785	var x369: u64 = undefined;
2786	var x370: u1 = undefined;
2787	addcarryxU64(&x369, &x370, x368, x364, x361);
2788	var x371: u64 = undefined;
2789	var x372: u1 = undefined;
2790	addcarryxU64(&x371, &x372, x370, x362, x359);
2791	var x373: u64 = undefined;
2792	var x374: u1 = undefined;
2793	addcarryxU64(&x373, &x374, x372, x360, x357);
2794	var x375: u64 = undefined;
2795	var x376: u1 = undefined;
2796	addcarryxU64(&x375, &x376, x374, x358, x355);
2797	var x377: u64 = undefined;
2798	var x378: u1 = undefined;
2799	addcarryxU64(&x377, &x378, 0x0, x343, x365);
2800	var x379: u64 = undefined;
2801	var x380: u1 = undefined;
2802	addcarryxU64(&x379, &x380, x378, x345, x367);
2803	var x381: u64 = undefined;
2804	var x382: u1 = undefined;
2805	addcarryxU64(&x381, &x382, x380, x347, x369);
2806	var x383: u64 = undefined;
2807	var x384: u1 = undefined;
2808	addcarryxU64(&x383, &x384, x382, x349, x371);
2809	var x385: u64 = undefined;
2810	var x386: u1 = undefined;
2811	addcarryxU64(&x385, &x386, x384, x351, x373);
2812	var x387: u64 = undefined;
2813	var x388: u1 = undefined;
2814	addcarryxU64(&x387, &x388, x386, x353, x375);
2815	var x389: u64 = undefined;
2816	var x390: u64 = undefined;
2817	mulxU64(&x389, &x390, x377, 0x6ed46089e88fdc45);
2818	var x391: u64 = undefined;
2819	var x392: u64 = undefined;
2820	mulxU64(&x391, &x392, x389, 0xffffffffffffffff);
2821	var x393: u64 = undefined;
2822	var x394: u64 = undefined;
2823	mulxU64(&x393, &x394, x389, 0xffffffffffffffff);
2824	var x395: u64 = undefined;
2825	var x396: u64 = undefined;
2826	mulxU64(&x395, &x396, x389, 0xffffffffffffffff);
2827	var x397: u64 = undefined;
2828	var x398: u64 = undefined;
2829	mulxU64(&x397, &x398, x389, 0xc7634d81f4372ddf);
2830	var x399: u64 = undefined;
2831	var x400: u64 = undefined;
2832	mulxU64(&x399, &x400, x389, 0x581a0db248b0a77a);
2833	var x401: u64 = undefined;
2834	var x402: u64 = undefined;
2835	mulxU64(&x401, &x402, x389, 0xecec196accc52973);
2836	var x403: u64 = undefined;
2837	var x404: u1 = undefined;
2838	addcarryxU64(&x403, &x404, 0x0, x402, x399);
2839	var x405: u64 = undefined;
2840	var x406: u1 = undefined;
2841	addcarryxU64(&x405, &x406, x404, x400, x397);
2842	var x407: u64 = undefined;
2843	var x408: u1 = undefined;
2844	addcarryxU64(&x407, &x408, x406, x398, x395);
2845	var x409: u64 = undefined;
2846	var x410: u1 = undefined;
2847	addcarryxU64(&x409, &x410, x408, x396, x393);
2848	var x411: u64 = undefined;
2849	var x412: u1 = undefined;
2850	addcarryxU64(&x411, &x412, x410, x394, x391);
2851	var x413: u64 = undefined;
2852	var x414: u1 = undefined;
2853	addcarryxU64(&x413, &x414, 0x0, x377, x401);
2854	var x415: u64 = undefined;
2855	var x416: u1 = undefined;
2856	addcarryxU64(&x415, &x416, x414, x379, x403);
2857	var x417: u64 = undefined;
2858	var x418: u1 = undefined;
2859	addcarryxU64(&x417, &x418, x416, x381, x405);
2860	var x419: u64 = undefined;
2861	var x420: u1 = undefined;
2862	addcarryxU64(&x419, &x420, x418, x383, x407);
2863	var x421: u64 = undefined;
2864	var x422: u1 = undefined;
2865	addcarryxU64(&x421, &x422, x420, x385, x409);
2866	var x423: u64 = undefined;
2867	var x424: u1 = undefined;
2868	addcarryxU64(&x423, &x424, x422, x387, x411);
2869	var x425: u64 = undefined;
2870	var x426: u1 = undefined;
2871	addcarryxU64(&x425, &x426, x424, ((@as(u64, x388) + @as(u64, x354)) + (@as(u64, x376) + x356)), (@as(u64, x412) + x392));
2872	var x427: u64 = undefined;
2873	var x428: u1 = undefined;
2874	subborrowxU64(&x427, &x428, 0x0, x415, 0xecec196accc52973);
2875	var x429: u64 = undefined;
2876	var x430: u1 = undefined;
2877	subborrowxU64(&x429, &x430, x428, x417, 0x581a0db248b0a77a);
2878	var x431: u64 = undefined;
2879	var x432: u1 = undefined;
2880	subborrowxU64(&x431, &x432, x430, x419, 0xc7634d81f4372ddf);
2881	var x433: u64 = undefined;
2882	var x434: u1 = undefined;
2883	subborrowxU64(&x433, &x434, x432, x421, 0xffffffffffffffff);
2884	var x435: u64 = undefined;
2885	var x436: u1 = undefined;
2886	subborrowxU64(&x435, &x436, x434, x423, 0xffffffffffffffff);
2887	var x437: u64 = undefined;
2888	var x438: u1 = undefined;
2889	subborrowxU64(&x437, &x438, x436, x425, 0xffffffffffffffff);
2890	var x439: u64 = undefined;
2891	var x440: u1 = undefined;
2892	subborrowxU64(&x439, &x440, x438, @as(u64, x426), 0x0);
2893	var x441: u64 = undefined;
2894	cmovznzU64(&x441, x440, x427, x415);
2895	var x442: u64 = undefined;
2896	cmovznzU64(&x442, x440, x429, x417);
2897	var x443: u64 = undefined;
2898	cmovznzU64(&x443, x440, x431, x419);
2899	var x444: u64 = undefined;
2900	cmovznzU64(&x444, x440, x433, x421);
2901	var x445: u64 = undefined;
2902	cmovznzU64(&x445, x440, x435, x423);
2903	var x446: u64 = undefined;
2904	cmovznzU64(&x446, x440, x437, x425);
2905	out1[0] = x441;
2906	out1[1] = x442;
2907	out1[2] = x443;
2908	out1[3] = x444;
2909	out1[4] = x445;
2910	out1[5] = x446;
2911	}
2912
2913	/// The function nonzero outputs a single non-zero word if the input is non-zero and zero otherwise.
2914	///
2915	/// Preconditions:
2916	/// 0 ≤ eval arg1 < m
2917	/// Postconditions:
2918	/// out1 = 0 ↔ eval (from_montgomery arg1) mod m = 0
2919	///
2920	/// Input Bounds:
2921	/// arg1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
2922	/// Output Bounds:
2923	/// out1: [0x0 ~> 0xffffffffffffffff]
2924	pub fn nonzero(out1: *u64, arg1: [6]u64) void {
2925	@setRuntimeSafety(mode == .Debug);
2926
2927	const x1 = ((arg1[0]) \| ((arg1[1]) \| ((arg1[2]) \| ((arg1[3]) \| ((arg1[4]) \| (arg1[5]))))));
2928	out1.* = x1;
2929	}
2930
2931	/// The function selectznz is a multi-limb conditional select.
2932	///
2933	/// Postconditions:
2934	/// out1 = (if arg1 = 0 then arg2 else arg3)
2935	///
2936	/// Input Bounds:
2937	/// arg1: [0x0 ~> 0x1]
2938	/// arg2: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
2939	/// arg3: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
2940	/// Output Bounds:
2941	/// out1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
2942	pub fn selectznz(out1: *[6]u64, arg1: u1, arg2: [6]u64, arg3: [6]u64) void {
2943	@setRuntimeSafety(mode == .Debug);
2944
2945	var x1: u64 = undefined;
2946	cmovznzU64(&x1, arg1, (arg2[0]), (arg3[0]));
2947	var x2: u64 = undefined;
2948	cmovznzU64(&x2, arg1, (arg2[1]), (arg3[1]));
2949	var x3: u64 = undefined;
2950	cmovznzU64(&x3, arg1, (arg2[2]), (arg3[2]));
2951	var x4: u64 = undefined;
2952	cmovznzU64(&x4, arg1, (arg2[3]), (arg3[3]));
2953	var x5: u64 = undefined;
2954	cmovznzU64(&x5, arg1, (arg2[4]), (arg3[4]));
2955	var x6: u64 = undefined;
2956	cmovznzU64(&x6, arg1, (arg2[5]), (arg3[5]));
2957	out1[0] = x1;
2958	out1[1] = x2;
2959	out1[2] = x3;
2960	out1[3] = x4;
2961	out1[4] = x5;
2962	out1[5] = x6;
2963	}
2964
2965	/// The function toBytes serializes a field element NOT in the Montgomery domain to bytes in little-endian order.
2966	///
2967	/// Preconditions:
2968	/// 0 ≤ eval arg1 < m
2969	/// Postconditions:
2970	/// out1 = map (λ x, ⌊((eval arg1 mod m) mod 2^(8 * (x + 1))) / 2^(8 * x)⌋) [0..47]
2971	///
2972	/// Input Bounds:
2973	/// arg1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
2974	/// Output Bounds:
2975	/// out1: [[0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff]]
2976	pub fn toBytes(out1: *[48]u8, arg1: [6]u64) void {
2977	@setRuntimeSafety(mode == .Debug);
2978
2979	const x1 = (arg1[5]);
2980	const x2 = (arg1[4]);
2981	const x3 = (arg1[3]);
2982	const x4 = (arg1[2]);
2983	const x5 = (arg1[1]);
2984	const x6 = (arg1[0]);
2985	const x7 = @truncate(u8, (x6 & 0xff));
2986	const x8 = (x6 >> 8);
2987	const x9 = @truncate(u8, (x8 & 0xff));
2988	const x10 = (x8 >> 8);
2989	const x11 = @truncate(u8, (x10 & 0xff));
2990	const x12 = (x10 >> 8);
2991	const x13 = @truncate(u8, (x12 & 0xff));
2992	const x14 = (x12 >> 8);
2993	const x15 = @truncate(u8, (x14 & 0xff));
2994	const x16 = (x14 >> 8);
2995	const x17 = @truncate(u8, (x16 & 0xff));
2996	const x18 = (x16 >> 8);
2997	const x19 = @truncate(u8, (x18 & 0xff));
2998	const x20 = @truncate(u8, (x18 >> 8));
2999	const x21 = @truncate(u8, (x5 & 0xff));
3000	const x22 = (x5 >> 8);
3001	const x23 = @truncate(u8, (x22 & 0xff));
3002	const x24 = (x22 >> 8);
3003	const x25 = @truncate(u8, (x24 & 0xff));
3004	const x26 = (x24 >> 8);
3005	const x27 = @truncate(u8, (x26 & 0xff));
3006	const x28 = (x26 >> 8);
3007	const x29 = @truncate(u8, (x28 & 0xff));
3008	const x30 = (x28 >> 8);
3009	const x31 = @truncate(u8, (x30 & 0xff));
3010	const x32 = (x30 >> 8);
3011	const x33 = @truncate(u8, (x32 & 0xff));
3012	const x34 = @truncate(u8, (x32 >> 8));
3013	const x35 = @truncate(u8, (x4 & 0xff));
3014	const x36 = (x4 >> 8);
3015	const x37 = @truncate(u8, (x36 & 0xff));
3016	const x38 = (x36 >> 8);
3017	const x39 = @truncate(u8, (x38 & 0xff));
3018	const x40 = (x38 >> 8);
3019	const x41 = @truncate(u8, (x40 & 0xff));
3020	const x42 = (x40 >> 8);
3021	const x43 = @truncate(u8, (x42 & 0xff));
3022	const x44 = (x42 >> 8);
3023	const x45 = @truncate(u8, (x44 & 0xff));
3024	const x46 = (x44 >> 8);
3025	const x47 = @truncate(u8, (x46 & 0xff));
3026	const x48 = @truncate(u8, (x46 >> 8));
3027	const x49 = @truncate(u8, (x3 & 0xff));
3028	const x50 = (x3 >> 8);
3029	const x51 = @truncate(u8, (x50 & 0xff));
3030	const x52 = (x50 >> 8);
3031	const x53 = @truncate(u8, (x52 & 0xff));
3032	const x54 = (x52 >> 8);
3033	const x55 = @truncate(u8, (x54 & 0xff));
3034	const x56 = (x54 >> 8);
3035	const x57 = @truncate(u8, (x56 & 0xff));
3036	const x58 = (x56 >> 8);
3037	const x59 = @truncate(u8, (x58 & 0xff));
3038	const x60 = (x58 >> 8);
3039	const x61 = @truncate(u8, (x60 & 0xff));
3040	const x62 = @truncate(u8, (x60 >> 8));
3041	const x63 = @truncate(u8, (x2 & 0xff));
3042	const x64 = (x2 >> 8);
3043	const x65 = @truncate(u8, (x64 & 0xff));
3044	const x66 = (x64 >> 8);
3045	const x67 = @truncate(u8, (x66 & 0xff));
3046	const x68 = (x66 >> 8);
3047	const x69 = @truncate(u8, (x68 & 0xff));
3048	const x70 = (x68 >> 8);
3049	const x71 = @truncate(u8, (x70 & 0xff));
3050	const x72 = (x70 >> 8);
3051	const x73 = @truncate(u8, (x72 & 0xff));
3052	const x74 = (x72 >> 8);
3053	const x75 = @truncate(u8, (x74 & 0xff));
3054	const x76 = @truncate(u8, (x74 >> 8));
3055	const x77 = @truncate(u8, (x1 & 0xff));
3056	const x78 = (x1 >> 8);
3057	const x79 = @truncate(u8, (x78 & 0xff));
3058	const x80 = (x78 >> 8);
3059	const x81 = @truncate(u8, (x80 & 0xff));
3060	const x82 = (x80 >> 8);
3061	const x83 = @truncate(u8, (x82 & 0xff));
3062	const x84 = (x82 >> 8);
3063	const x85 = @truncate(u8, (x84 & 0xff));
3064	const x86 = (x84 >> 8);
3065	const x87 = @truncate(u8, (x86 & 0xff));
3066	const x88 = (x86 >> 8);
3067	const x89 = @truncate(u8, (x88 & 0xff));
3068	const x90 = @truncate(u8, (x88 >> 8));
3069	out1[0] = x7;
3070	out1[1] = x9;
3071	out1[2] = x11;
3072	out1[3] = x13;
3073	out1[4] = x15;
3074	out1[5] = x17;
3075	out1[6] = x19;
3076	out1[7] = x20;
3077	out1[8] = x21;
3078	out1[9] = x23;
3079	out1[10] = x25;
3080	out1[11] = x27;
3081	out1[12] = x29;
3082	out1[13] = x31;
3083	out1[14] = x33;
3084	out1[15] = x34;
3085	out1[16] = x35;
3086	out1[17] = x37;
3087	out1[18] = x39;
3088	out1[19] = x41;
3089	out1[20] = x43;
3090	out1[21] = x45;
3091	out1[22] = x47;
3092	out1[23] = x48;
3093	out1[24] = x49;
3094	out1[25] = x51;
3095	out1[26] = x53;
3096	out1[27] = x55;
3097	out1[28] = x57;
3098	out1[29] = x59;
3099	out1[30] = x61;
3100	out1[31] = x62;
3101	out1[32] = x63;
3102	out1[33] = x65;
3103	out1[34] = x67;
3104	out1[35] = x69;
3105	out1[36] = x71;
3106	out1[37] = x73;
3107	out1[38] = x75;
3108	out1[39] = x76;
3109	out1[40] = x77;
3110	out1[41] = x79;
3111	out1[42] = x81;
3112	out1[43] = x83;
3113	out1[44] = x85;
3114	out1[45] = x87;
3115	out1[46] = x89;
3116	out1[47] = x90;
3117	}
3118
3119	/// The function fromBytes deserializes a field element NOT in the Montgomery domain from bytes in little-endian order.
3120	///
3121	/// Preconditions:
3122	/// 0 ≤ bytes_eval arg1 < m
3123	/// Postconditions:
3124	/// eval out1 mod m = bytes_eval arg1 mod m
3125	/// 0 ≤ eval out1 < m
3126	///
3127	/// Input Bounds:
3128	/// arg1: [[0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff]]
3129	/// Output Bounds:
3130	/// out1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
3131	pub fn fromBytes(out1: *[6]u64, arg1: [48]u8) void {
3132	@setRuntimeSafety(mode == .Debug);
3133
3134	const x1 = (@as(u64, (arg1[47])) << 56);
3135	const x2 = (@as(u64, (arg1[46])) << 48);
3136	const x3 = (@as(u64, (arg1[45])) << 40);
3137	const x4 = (@as(u64, (arg1[44])) << 32);
3138	const x5 = (@as(u64, (arg1[43])) << 24);
3139	const x6 = (@as(u64, (arg1[42])) << 16);
3140	const x7 = (@as(u64, (arg1[41])) << 8);
3141	const x8 = (arg1[40]);
3142	const x9 = (@as(u64, (arg1[39])) << 56);
3143	const x10 = (@as(u64, (arg1[38])) << 48);
3144	const x11 = (@as(u64, (arg1[37])) << 40);
3145	const x12 = (@as(u64, (arg1[36])) << 32);
3146	const x13 = (@as(u64, (arg1[35])) << 24);
3147	const x14 = (@as(u64, (arg1[34])) << 16);
3148	const x15 = (@as(u64, (arg1[33])) << 8);
3149	const x16 = (arg1[32]);
3150	const x17 = (@as(u64, (arg1[31])) << 56);
3151	const x18 = (@as(u64, (arg1[30])) << 48);
3152	const x19 = (@as(u64, (arg1[29])) << 40);
3153	const x20 = (@as(u64, (arg1[28])) << 32);
3154	const x21 = (@as(u64, (arg1[27])) << 24);
3155	const x22 = (@as(u64, (arg1[26])) << 16);
3156	const x23 = (@as(u64, (arg1[25])) << 8);
3157	const x24 = (arg1[24]);
3158	const x25 = (@as(u64, (arg1[23])) << 56);
3159	const x26 = (@as(u64, (arg1[22])) << 48);
3160	const x27 = (@as(u64, (arg1[21])) << 40);
3161	const x28 = (@as(u64, (arg1[20])) << 32);
3162	const x29 = (@as(u64, (arg1[19])) << 24);
3163	const x30 = (@as(u64, (arg1[18])) << 16);
3164	const x31 = (@as(u64, (arg1[17])) << 8);
3165	const x32 = (arg1[16]);
3166	const x33 = (@as(u64, (arg1[15])) << 56);
3167	const x34 = (@as(u64, (arg1[14])) << 48);
3168	const x35 = (@as(u64, (arg1[13])) << 40);
3169	const x36 = (@as(u64, (arg1[12])) << 32);
3170	const x37 = (@as(u64, (arg1[11])) << 24);
3171	const x38 = (@as(u64, (arg1[10])) << 16);
3172	const x39 = (@as(u64, (arg1[9])) << 8);
3173	const x40 = (arg1[8]);
3174	const x41 = (@as(u64, (arg1[7])) << 56);
3175	const x42 = (@as(u64, (arg1[6])) << 48);
3176	const x43 = (@as(u64, (arg1[5])) << 40);
3177	const x44 = (@as(u64, (arg1[4])) << 32);
3178	const x45 = (@as(u64, (arg1[3])) << 24);
3179	const x46 = (@as(u64, (arg1[2])) << 16);
3180	const x47 = (@as(u64, (arg1[1])) << 8);
3181	const x48 = (arg1[0]);
3182	const x49 = (x47 + @as(u64, x48));
3183	const x50 = (x46 + x49);
3184	const x51 = (x45 + x50);
3185	const x52 = (x44 + x51);
3186	const x53 = (x43 + x52);
3187	const x54 = (x42 + x53);
3188	const x55 = (x41 + x54);
3189	const x56 = (x39 + @as(u64, x40));
3190	const x57 = (x38 + x56);
3191	const x58 = (x37 + x57);
3192	const x59 = (x36 + x58);
3193	const x60 = (x35 + x59);
3194	const x61 = (x34 + x60);
3195	const x62 = (x33 + x61);
3196	const x63 = (x31 + @as(u64, x32));
3197	const x64 = (x30 + x63);
3198	const x65 = (x29 + x64);
3199	const x66 = (x28 + x65);
3200	const x67 = (x27 + x66);
3201	const x68 = (x26 + x67);
3202	const x69 = (x25 + x68);
3203	const x70 = (x23 + @as(u64, x24));
3204	const x71 = (x22 + x70);
3205	const x72 = (x21 + x71);
3206	const x73 = (x20 + x72);
3207	const x74 = (x19 + x73);
3208	const x75 = (x18 + x74);
3209	const x76 = (x17 + x75);
3210	const x77 = (x15 + @as(u64, x16));
3211	const x78 = (x14 + x77);
3212	const x79 = (x13 + x78);
3213	const x80 = (x12 + x79);
3214	const x81 = (x11 + x80);
3215	const x82 = (x10 + x81);
3216	const x83 = (x9 + x82);
3217	const x84 = (x7 + @as(u64, x8));
3218	const x85 = (x6 + x84);
3219	const x86 = (x5 + x85);
3220	const x87 = (x4 + x86);
3221	const x88 = (x3 + x87);
3222	const x89 = (x2 + x88);
3223	const x90 = (x1 + x89);
3224	out1[0] = x55;
3225	out1[1] = x62;
3226	out1[2] = x69;
3227	out1[3] = x76;
3228	out1[4] = x83;
3229	out1[5] = x90;
3230	}
3231
3232	/// The function setOne returns the field element one in the Montgomery domain.
3233	///
3234	/// Postconditions:
3235	/// eval (from_montgomery out1) mod m = 1 mod m
3236	/// 0 ≤ eval out1 < m
3237	///
3238	pub fn setOne(out1: *MontgomeryDomainFieldElement) void {
3239	@setRuntimeSafety(mode == .Debug);
3240
3241	out1[0] = 0x1313e695333ad68d;
3242	out1[1] = 0xa7e5f24db74f5885;
3243	out1[2] = 0x389cb27e0bc8d220;
3244	out1[3] = 0x0;
3245	out1[4] = 0x0;
3246	out1[5] = 0x0;
3247	}
3248
3249	/// The function msat returns the saturated representation of the prime modulus.
3250	///
3251	/// Postconditions:
3252	/// twos_complement_eval out1 = m
3253	/// 0 ≤ eval out1 < m
3254	///
3255	/// Output Bounds:
3256	/// out1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
3257	pub fn msat(out1: *[7]u64) void {
3258	@setRuntimeSafety(mode == .Debug);
3259
3260	out1[0] = 0xecec196accc52973;
3261	out1[1] = 0x581a0db248b0a77a;
3262	out1[2] = 0xc7634d81f4372ddf;
3263	out1[3] = 0xffffffffffffffff;
3264	out1[4] = 0xffffffffffffffff;
3265	out1[5] = 0xffffffffffffffff;
3266	out1[6] = 0x0;
3267	}
3268
3269	/// The function divstep computes a divstep.
3270	///
3271	/// Preconditions:
3272	/// 0 ≤ eval arg4 < m
3273	/// 0 ≤ eval arg5 < m
3274	/// Postconditions:
3275	/// out1 = (if 0 < arg1 ∧ (twos_complement_eval arg3) is odd then 1 - arg1 else 1 + arg1)
3276	/// twos_complement_eval out2 = (if 0 < arg1 ∧ (twos_complement_eval arg3) is odd then twos_complement_eval arg3 else twos_complement_eval arg2)
3277	/// twos_complement_eval out3 = (if 0 < arg1 ∧ (twos_complement_eval arg3) is odd then ⌊(twos_complement_eval arg3 - twos_complement_eval arg2) / 2⌋ else ⌊(twos_complement_eval arg3 + (twos_complement_eval arg3 mod 2) * twos_complement_eval arg2) / 2⌋)
3278	/// eval (from_montgomery out4) mod m = (if 0 < arg1 ∧ (twos_complement_eval arg3) is odd then (2 * eval (from_montgomery arg5)) mod m else (2 * eval (from_montgomery arg4)) mod m)
3279	/// eval (from_montgomery out5) mod m = (if 0 < arg1 ∧ (twos_complement_eval arg3) is odd then (eval (from_montgomery arg4) - eval (from_montgomery arg4)) mod m else (eval (from_montgomery arg5) + (twos_complement_eval arg3 mod 2) * eval (from_montgomery arg4)) mod m)
3280	/// 0 ≤ eval out5 < m
3281	/// 0 ≤ eval out5 < m
3282	/// 0 ≤ eval out2 < m
3283	/// 0 ≤ eval out3 < m
3284	///
3285	/// Input Bounds:
3286	/// arg1: [0x0 ~> 0xffffffffffffffff]
3287	/// arg2: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
3288	/// arg3: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
3289	/// arg4: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
3290	/// arg5: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
3291	/// Output Bounds:
3292	/// out1: [0x0 ~> 0xffffffffffffffff]
3293	/// out2: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
3294	/// out3: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
3295	/// out4: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
3296	/// out5: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
3297	pub fn divstep(out1: u64, out2: [7]u64, out3: [7]u64, out4: [6]u64, out5: *[6]u64, arg1: u64, arg2: [7]u64, arg3: [7]u64, arg4: [6]u64, arg5: [6]u64) void {
3298	@setRuntimeSafety(mode == .Debug);
3299
3300	var x1: u64 = undefined;
3301	var x2: u1 = undefined;
3302	addcarryxU64(&x1, &x2, 0x0, (~arg1), 0x1);
3303	const x3 = (@truncate(u1, (x1 >> 63)) & @truncate(u1, ((arg3[0]) & 0x1)));
3304	var x4: u64 = undefined;
3305	var x5: u1 = undefined;
3306	addcarryxU64(&x4, &x5, 0x0, (~arg1), 0x1);
3307	var x6: u64 = undefined;
3308	cmovznzU64(&x6, x3, arg1, x4);
3309	var x7: u64 = undefined;
3310	cmovznzU64(&x7, x3, (arg2[0]), (arg3[0]));
3311	var x8: u64 = undefined;
3312	cmovznzU64(&x8, x3, (arg2[1]), (arg3[1]));
3313	var x9: u64 = undefined;
3314	cmovznzU64(&x9, x3, (arg2[2]), (arg3[2]));
3315	var x10: u64 = undefined;
3316	cmovznzU64(&x10, x3, (arg2[3]), (arg3[3]));
3317	var x11: u64 = undefined;
3318	cmovznzU64(&x11, x3, (arg2[4]), (arg3[4]));
3319	var x12: u64 = undefined;
3320	cmovznzU64(&x12, x3, (arg2[5]), (arg3[5]));
3321	var x13: u64 = undefined;
3322	cmovznzU64(&x13, x3, (arg2[6]), (arg3[6]));
3323	var x14: u64 = undefined;
3324	var x15: u1 = undefined;
3325	addcarryxU64(&x14, &x15, 0x0, 0x1, (~(arg2[0])));
3326	var x16: u64 = undefined;
3327	var x17: u1 = undefined;
3328	addcarryxU64(&x16, &x17, x15, 0x0, (~(arg2[1])));
3329	var x18: u64 = undefined;
3330	var x19: u1 = undefined;
3331	addcarryxU64(&x18, &x19, x17, 0x0, (~(arg2[2])));
3332	var x20: u64 = undefined;
3333	var x21: u1 = undefined;
3334	addcarryxU64(&x20, &x21, x19, 0x0, (~(arg2[3])));
3335	var x22: u64 = undefined;
3336	var x23: u1 = undefined;
3337	addcarryxU64(&x22, &x23, x21, 0x0, (~(arg2[4])));
3338	var x24: u64 = undefined;
3339	var x25: u1 = undefined;
3340	addcarryxU64(&x24, &x25, x23, 0x0, (~(arg2[5])));
3341	var x26: u64 = undefined;
3342	var x27: u1 = undefined;
3343	addcarryxU64(&x26, &x27, x25, 0x0, (~(arg2[6])));
3344	var x28: u64 = undefined;
3345	cmovznzU64(&x28, x3, (arg3[0]), x14);
3346	var x29: u64 = undefined;
3347	cmovznzU64(&x29, x3, (arg3[1]), x16);
3348	var x30: u64 = undefined;
3349	cmovznzU64(&x30, x3, (arg3[2]), x18);
3350	var x31: u64 = undefined;
3351	cmovznzU64(&x31, x3, (arg3[3]), x20);
3352	var x32: u64 = undefined;
3353	cmovznzU64(&x32, x3, (arg3[4]), x22);
3354	var x33: u64 = undefined;
3355	cmovznzU64(&x33, x3, (arg3[5]), x24);
3356	var x34: u64 = undefined;
3357	cmovznzU64(&x34, x3, (arg3[6]), x26);
3358	var x35: u64 = undefined;
3359	cmovznzU64(&x35, x3, (arg4[0]), (arg5[0]));
3360	var x36: u64 = undefined;
3361	cmovznzU64(&x36, x3, (arg4[1]), (arg5[1]));
3362	var x37: u64 = undefined;
3363	cmovznzU64(&x37, x3, (arg4[2]), (arg5[2]));
3364	var x38: u64 = undefined;
3365	cmovznzU64(&x38, x3, (arg4[3]), (arg5[3]));
3366	var x39: u64 = undefined;
3367	cmovznzU64(&x39, x3, (arg4[4]), (arg5[4]));
3368	var x40: u64 = undefined;
3369	cmovznzU64(&x40, x3, (arg4[5]), (arg5[5]));
3370	var x41: u64 = undefined;
3371	var x42: u1 = undefined;
3372	addcarryxU64(&x41, &x42, 0x0, x35, x35);
3373	var x43: u64 = undefined;
3374	var x44: u1 = undefined;
3375	addcarryxU64(&x43, &x44, x42, x36, x36);
3376	var x45: u64 = undefined;
3377	var x46: u1 = undefined;
3378	addcarryxU64(&x45, &x46, x44, x37, x37);
3379	var x47: u64 = undefined;
3380	var x48: u1 = undefined;
3381	addcarryxU64(&x47, &x48, x46, x38, x38);
3382	var x49: u64 = undefined;
3383	var x50: u1 = undefined;
3384	addcarryxU64(&x49, &x50, x48, x39, x39);
3385	var x51: u64 = undefined;
3386	var x52: u1 = undefined;
3387	addcarryxU64(&x51, &x52, x50, x40, x40);
3388	var x53: u64 = undefined;
3389	var x54: u1 = undefined;
3390	subborrowxU64(&x53, &x54, 0x0, x41, 0xecec196accc52973);
3391	var x55: u64 = undefined;
3392	var x56: u1 = undefined;
3393	subborrowxU64(&x55, &x56, x54, x43, 0x581a0db248b0a77a);
3394	var x57: u64 = undefined;
3395	var x58: u1 = undefined;
3396	subborrowxU64(&x57, &x58, x56, x45, 0xc7634d81f4372ddf);
3397	var x59: u64 = undefined;
3398	var x60: u1 = undefined;
3399	subborrowxU64(&x59, &x60, x58, x47, 0xffffffffffffffff);
3400	var x61: u64 = undefined;
3401	var x62: u1 = undefined;
3402	subborrowxU64(&x61, &x62, x60, x49, 0xffffffffffffffff);
3403	var x63: u64 = undefined;
3404	var x64: u1 = undefined;
3405	subborrowxU64(&x63, &x64, x62, x51, 0xffffffffffffffff);
3406	var x65: u64 = undefined;
3407	var x66: u1 = undefined;
3408	subborrowxU64(&x65, &x66, x64, @as(u64, x52), 0x0);
3409	const x67 = (arg4[5]);
3410	const x68 = (arg4[4]);
3411	const x69 = (arg4[3]);
3412	const x70 = (arg4[2]);
3413	const x71 = (arg4[1]);
3414	const x72 = (arg4[0]);
3415	var x73: u64 = undefined;
3416	var x74: u1 = undefined;
3417	subborrowxU64(&x73, &x74, 0x0, 0x0, x72);
3418	var x75: u64 = undefined;
3419	var x76: u1 = undefined;
3420	subborrowxU64(&x75, &x76, x74, 0x0, x71);
3421	var x77: u64 = undefined;
3422	var x78: u1 = undefined;
3423	subborrowxU64(&x77, &x78, x76, 0x0, x70);
3424	var x79: u64 = undefined;
3425	var x80: u1 = undefined;
3426	subborrowxU64(&x79, &x80, x78, 0x0, x69);
3427	var x81: u64 = undefined;
3428	var x82: u1 = undefined;
3429	subborrowxU64(&x81, &x82, x80, 0x0, x68);
3430	var x83: u64 = undefined;
3431	var x84: u1 = undefined;
3432	subborrowxU64(&x83, &x84, x82, 0x0, x67);
3433	var x85: u64 = undefined;
3434	cmovznzU64(&x85, x84, 0x0, 0xffffffffffffffff);
3435	var x86: u64 = undefined;
3436	var x87: u1 = undefined;
3437	addcarryxU64(&x86, &x87, 0x0, x73, (x85 & 0xecec196accc52973));
3438	var x88: u64 = undefined;
3439	var x89: u1 = undefined;
3440	addcarryxU64(&x88, &x89, x87, x75, (x85 & 0x581a0db248b0a77a));
3441	var x90: u64 = undefined;
3442	var x91: u1 = undefined;
3443	addcarryxU64(&x90, &x91, x89, x77, (x85 & 0xc7634d81f4372ddf));
3444	var x92: u64 = undefined;
3445	var x93: u1 = undefined;
3446	addcarryxU64(&x92, &x93, x91, x79, x85);
3447	var x94: u64 = undefined;
3448	var x95: u1 = undefined;
3449	addcarryxU64(&x94, &x95, x93, x81, x85);
3450	var x96: u64 = undefined;
3451	var x97: u1 = undefined;
3452	addcarryxU64(&x96, &x97, x95, x83, x85);
3453	var x98: u64 = undefined;
3454	cmovznzU64(&x98, x3, (arg5[0]), x86);
3455	var x99: u64 = undefined;
3456	cmovznzU64(&x99, x3, (arg5[1]), x88);
3457	var x100: u64 = undefined;
3458	cmovznzU64(&x100, x3, (arg5[2]), x90);
3459	var x101: u64 = undefined;
3460	cmovznzU64(&x101, x3, (arg5[3]), x92);
3461	var x102: u64 = undefined;
3462	cmovznzU64(&x102, x3, (arg5[4]), x94);
3463	var x103: u64 = undefined;
3464	cmovznzU64(&x103, x3, (arg5[5]), x96);
3465	const x104 = @truncate(u1, (x28 & 0x1));
3466	var x105: u64 = undefined;
3467	cmovznzU64(&x105, x104, 0x0, x7);
3468	var x106: u64 = undefined;
3469	cmovznzU64(&x106, x104, 0x0, x8);
3470	var x107: u64 = undefined;
3471	cmovznzU64(&x107, x104, 0x0, x9);
3472	var x108: u64 = undefined;
3473	cmovznzU64(&x108, x104, 0x0, x10);
3474	var x109: u64 = undefined;
3475	cmovznzU64(&x109, x104, 0x0, x11);
3476	var x110: u64 = undefined;
3477	cmovznzU64(&x110, x104, 0x0, x12);
3478	var x111: u64 = undefined;
3479	cmovznzU64(&x111, x104, 0x0, x13);
3480	var x112: u64 = undefined;
3481	var x113: u1 = undefined;
3482	addcarryxU64(&x112, &x113, 0x0, x28, x105);
3483	var x114: u64 = undefined;
3484	var x115: u1 = undefined;
3485	addcarryxU64(&x114, &x115, x113, x29, x106);
3486	var x116: u64 = undefined;
3487	var x117: u1 = undefined;
3488	addcarryxU64(&x116, &x117, x115, x30, x107);
3489	var x118: u64 = undefined;
3490	var x119: u1 = undefined;
3491	addcarryxU64(&x118, &x119, x117, x31, x108);
3492	var x120: u64 = undefined;
3493	var x121: u1 = undefined;
3494	addcarryxU64(&x120, &x121, x119, x32, x109);
3495	var x122: u64 = undefined;
3496	var x123: u1 = undefined;
3497	addcarryxU64(&x122, &x123, x121, x33, x110);
3498	var x124: u64 = undefined;
3499	var x125: u1 = undefined;
3500	addcarryxU64(&x124, &x125, x123, x34, x111);
3501	var x126: u64 = undefined;
3502	cmovznzU64(&x126, x104, 0x0, x35);
3503	var x127: u64 = undefined;
3504	cmovznzU64(&x127, x104, 0x0, x36);
3505	var x128: u64 = undefined;
3506	cmovznzU64(&x128, x104, 0x0, x37);
3507	var x129: u64 = undefined;
3508	cmovznzU64(&x129, x104, 0x0, x38);
3509	var x130: u64 = undefined;
3510	cmovznzU64(&x130, x104, 0x0, x39);
3511	var x131: u64 = undefined;
3512	cmovznzU64(&x131, x104, 0x0, x40);
3513	var x132: u64 = undefined;
3514	var x133: u1 = undefined;
3515	addcarryxU64(&x132, &x133, 0x0, x98, x126);
3516	var x134: u64 = undefined;
3517	var x135: u1 = undefined;
3518	addcarryxU64(&x134, &x135, x133, x99, x127);
3519	var x136: u64 = undefined;
3520	var x137: u1 = undefined;
3521	addcarryxU64(&x136, &x137, x135, x100, x128);
3522	var x138: u64 = undefined;
3523	var x139: u1 = undefined;
3524	addcarryxU64(&x138, &x139, x137, x101, x129);
3525	var x140: u64 = undefined;
3526	var x141: u1 = undefined;
3527	addcarryxU64(&x140, &x141, x139, x102, x130);
3528	var x142: u64 = undefined;
3529	var x143: u1 = undefined;
3530	addcarryxU64(&x142, &x143, x141, x103, x131);
3531	var x144: u64 = undefined;
3532	var x145: u1 = undefined;
3533	subborrowxU64(&x144, &x145, 0x0, x132, 0xecec196accc52973);
3534	var x146: u64 = undefined;
3535	var x147: u1 = undefined;
3536	subborrowxU64(&x146, &x147, x145, x134, 0x581a0db248b0a77a);
3537	var x148: u64 = undefined;
3538	var x149: u1 = undefined;
3539	subborrowxU64(&x148, &x149, x147, x136, 0xc7634d81f4372ddf);
3540	var x150: u64 = undefined;
3541	var x151: u1 = undefined;
3542	subborrowxU64(&x150, &x151, x149, x138, 0xffffffffffffffff);
3543	var x152: u64 = undefined;
3544	var x153: u1 = undefined;
3545	subborrowxU64(&x152, &x153, x151, x140, 0xffffffffffffffff);
3546	var x154: u64 = undefined;
3547	var x155: u1 = undefined;
3548	subborrowxU64(&x154, &x155, x153, x142, 0xffffffffffffffff);
3549	var x156: u64 = undefined;
3550	var x157: u1 = undefined;
3551	subborrowxU64(&x156, &x157, x155, @as(u64, x143), 0x0);
3552	var x158: u64 = undefined;
3553	var x159: u1 = undefined;
3554	addcarryxU64(&x158, &x159, 0x0, x6, 0x1);
3555	const x160 = ((x112 >> 1) \| ((x114 << 63) & 0xffffffffffffffff));
3556	const x161 = ((x114 >> 1) \| ((x116 << 63) & 0xffffffffffffffff));
3557	const x162 = ((x116 >> 1) \| ((x118 << 63) & 0xffffffffffffffff));
3558	const x163 = ((x118 >> 1) \| ((x120 << 63) & 0xffffffffffffffff));
3559	const x164 = ((x120 >> 1) \| ((x122 << 63) & 0xffffffffffffffff));
3560	const x165 = ((x122 >> 1) \| ((x124 << 63) & 0xffffffffffffffff));
3561	const x166 = ((x124 & 0x8000000000000000) \| (x124 >> 1));
3562	var x167: u64 = undefined;
3563	cmovznzU64(&x167, x66, x53, x41);
3564	var x168: u64 = undefined;
3565	cmovznzU64(&x168, x66, x55, x43);
3566	var x169: u64 = undefined;
3567	cmovznzU64(&x169, x66, x57, x45);
3568	var x170: u64 = undefined;
3569	cmovznzU64(&x170, x66, x59, x47);
3570	var x171: u64 = undefined;
3571	cmovznzU64(&x171, x66, x61, x49);
3572	var x172: u64 = undefined;
3573	cmovznzU64(&x172, x66, x63, x51);
3574	var x173: u64 = undefined;
3575	cmovznzU64(&x173, x157, x144, x132);
3576	var x174: u64 = undefined;
3577	cmovznzU64(&x174, x157, x146, x134);
3578	var x175: u64 = undefined;
3579	cmovznzU64(&x175, x157, x148, x136);
3580	var x176: u64 = undefined;
3581	cmovznzU64(&x176, x157, x150, x138);
3582	var x177: u64 = undefined;
3583	cmovznzU64(&x177, x157, x152, x140);
3584	var x178: u64 = undefined;
3585	cmovznzU64(&x178, x157, x154, x142);
3586	out1.* = x158;
3587	out2[0] = x7;
3588	out2[1] = x8;
3589	out2[2] = x9;
3590	out2[3] = x10;
3591	out2[4] = x11;
3592	out2[5] = x12;
3593	out2[6] = x13;
3594	out3[0] = x160;
3595	out3[1] = x161;
3596	out3[2] = x162;
3597	out3[3] = x163;
3598	out3[4] = x164;
3599	out3[5] = x165;
3600	out3[6] = x166;
3601	out4[0] = x167;
3602	out4[1] = x168;
3603	out4[2] = x169;
3604	out4[3] = x170;
3605	out4[4] = x171;
3606	out4[5] = x172;
3607	out5[0] = x173;
3608	out5[1] = x174;
3609	out5[2] = x175;
3610	out5[3] = x176;
3611	out5[4] = x177;
3612	out5[5] = x178;
3613	}
3614
3615	/// The function divstepPrecomp returns the precomputed value for Bernstein-Yang-inversion (in montgomery form).
3616	///
3617	/// Postconditions:
3618	/// eval (from_montgomery out1) = ⌊(m - 1) / 2⌋^(if ⌊log2 m⌋ + 1 < 46 then ⌊(49 * (⌊log2 m⌋ + 1) + 80) / 17⌋ else ⌊(49 * (⌊log2 m⌋ + 1) + 57) / 17⌋)
3619	/// 0 ≤ eval out1 < m
3620	///
3621	/// Output Bounds:
3622	/// out1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
3623	pub fn divstepPrecomp(out1: *[6]u64) void {
3624	@setRuntimeSafety(mode == .Debug);
3625
3626	out1[0] = 0x49589ae0e6045b6a;
3627	out1[1] = 0x3c9a5352870040ed;
3628	out1[2] = 0xdacb097e977dc242;
3629	out1[3] = 0xb5ab30a6d1ecbe36;
3630	out1[4] = 0x97d7a1081f959973;
3631	out1[5] = 0x2ba012f8d27192bc;
3632	}

lib/std/crypto/pcurves/p384/scalar.zig created+202

...	@@ -0,0 +1,202 @@
1	const std = @import("std");
2	const common = @import("../common.zig");
3	const crypto = std.crypto;
4	const debug = std.debug;
5	const math = std.math;
6	const mem = std.mem;
7
8	const Field = common.Field;
9
10	const NonCanonicalError = std.crypto.errors.NonCanonicalError;
11	const NotSquareError = std.crypto.errors.NotSquareError;
12
13	/// Number of bytes required to encode a scalar.
14	pub const encoded_length = 48;
15
16	/// A compressed scalar, in canonical form.
17	pub const CompressedScalar = [encoded_length]u8;
18
19	const Fe = Field(.{
20	.fiat = @import("p384_scalar_64.zig"),
21	.field_order = 39402006196394479212279040100143613805079739270465446667946905279627659399113263569398956308152294913554433653942643,
22	.field_bits = 384,
23	.saturated_bits = 384,
24	.encoded_length = encoded_length,
25	});
26
27	/// Reject a scalar whose encoding is not canonical.
28	pub fn rejectNonCanonical(s: CompressedScalar, endian: std.builtin.Endian) NonCanonicalError!void {
29	return Fe.rejectNonCanonical(s, endian);
30	}
31
32	/// Reduce a 64-bytes scalar to the field size.
33	pub fn reduce64(s: [64]u8, endian: std.builtin.Endian) CompressedScalar {
34	return ScalarDouble.fromBytes64(s, endian).toBytes(endian);
35	}
36
37	/// Return a*b (mod L)
38	pub fn mul(a: CompressedScalar, b: CompressedScalar, endian: std.builtin.Endian) NonCanonicalError!CompressedScalar {
39	return (try Scalar.fromBytes(a, endian)).mul(try Scalar.fromBytes(b, endian)).toBytes(endian);
40	}
41
42	/// Return a*b+c (mod L)
43	pub fn mulAdd(a: CompressedScalar, b: CompressedScalar, c: CompressedScalar, endian: std.builtin.Endian) NonCanonicalError!CompressedScalar {
44	return (try Scalar.fromBytes(a, endian)).mul(try Scalar.fromBytes(b, endian)).add(try Scalar.fromBytes(c, endian)).toBytes(endian);
45	}
46
47	/// Return a+b (mod L)
48	pub fn add(a: CompressedScalar, b: CompressedScalar, endian: std.builtin.Endian) NonCanonicalError!CompressedScalar {
49	return (try Scalar.fromBytes(a, endian)).add(try Scalar.fromBytes(b, endian)).toBytes(endian);
50	}
51
52	/// Return -s (mod L)
53	pub fn neg(s: CompressedScalar, endian: std.builtin.Endian) NonCanonicalError!CompressedScalar {
54	return (try Scalar.fromBytes(s, endian)).neg().toBytes(endian);
55	}
56
57	/// Return (a-b) (mod L)
58	pub fn sub(a: CompressedScalar, b: CompressedScalar, endian: std.builtin.Endian) NonCanonicalError!CompressedScalar {
59	return (try Scalar.fromBytes(a, endian)).sub(try Scalar.fromBytes(b.endian)).toBytes(endian);
60	}
61
62	/// Return a random scalar
63	pub fn random(endian: std.builtin.Endian) CompressedScalar {
64	return Scalar.random().toBytes(endian);
65	}
66
67	/// A scalar in unpacked representation.
68	pub const Scalar = struct {
69	fe: Fe,
70
71	/// Zero.
72	pub const zero = Scalar{ .fe = Fe.zero };
73
74	/// One.
75	pub const one = Scalar{ .fe = Fe.one };
76
77	/// Unpack a serialized representation of a scalar.
78	pub fn fromBytes(s: CompressedScalar, endian: std.builtin.Endian) NonCanonicalError!Scalar {
79	return Scalar{ .fe = try Fe.fromBytes(s, endian) };
80	}
81
82	/// Reduce a 512 bit input to the field size.
83	pub fn fromBytes64(s: [64]u8, endian: std.builtin.Endian) Scalar {
84	const t = ScalarDouble.fromBytes(512, s, endian);
85	return t.reduce(512);
86	}
87
88	/// Pack a scalar into bytes.
89	pub fn toBytes(n: Scalar, endian: std.builtin.Endian) CompressedScalar {
90	return n.fe.toBytes(endian);
91	}
92
93	/// Return true if the scalar is zero..
94	pub fn isZero(n: Scalar) bool {
95	return n.fe.isZero();
96	}
97
98	/// Return true if a and b are equivalent.
99	pub fn equivalent(a: Scalar, b: Scalar) bool {
100	return a.fe.equivalent(b.fe);
101	}
102
103	/// Compute x+y (mod L)
104	pub fn add(x: Scalar, y: Scalar) Scalar {
105	return Scalar{ .fe = x.fe.add(y.fe) };
106	}
107
108	/// Compute x-y (mod L)
109	pub fn sub(x: Scalar, y: Scalar) Scalar {
110	return Scalar{ .fe = x.fe.sub(y.fe) };
111	}
112
113	/// Compute 2n (mod L)
114	pub fn dbl(n: Scalar) Scalar {
115	return Scalar{ .fe = n.fe.dbl() };
116	}
117
118	/// Compute x*y (mod L)
119	pub fn mul(x: Scalar, y: Scalar) Scalar {
120	return Scalar{ .fe = x.fe.mul(y.fe) };
121	}
122
123	/// Compute x^2 (mod L)
124	pub fn sq(n: Scalar) Scalar {
125	return Scalar{ .fe = n.fe.sq() };
126	}
127
128	/// Compute x^n (mod L)
129	pub fn pow(a: Scalar, comptime T: type, comptime n: T) Scalar {
130	return Scalar{ .fe = a.fe.pow(n) };
131	}
132
133	/// Compute -x (mod L)
134	pub fn neg(n: Scalar) Scalar {
135	return Scalar{ .fe = n.fe.neg() };
136	}
137
138	/// Compute x^-1 (mod L)
139	pub fn invert(n: Scalar) Scalar {
140	return Scalar{ .fe = n.fe.invert() };
141	}
142
143	/// Return true if n is a quadratic residue mod L.
144	pub fn isSquare(n: Scalar) Scalar {
145	return n.fe.isSquare();
146	}
147
148	/// Return the square root of L, or NotSquare if there isn't any solutions.
149	pub fn sqrt(n: Scalar) NotSquareError!Scalar {
150	return Scalar{ .fe = try n.fe.sqrt() };
151	}
152
153	/// Return a random scalar < L.
154	pub fn random() Scalar {
155	var s: [64]u8 = undefined;
156	while (true) {
157	crypto.random.bytes(&s);
158	const n = Scalar.fromBytes64(s, .Little);
159	if (!n.isZero()) {
160	return n;
161	}
162	}
163	}
164	};
165
166	const ScalarDouble = struct {
167	x1: Fe,
168	x2: Fe,
169
170	fn fromBytes(comptime bits: usize, s_: [bits / 8]u8, endian: std.builtin.Endian) ScalarDouble {
171	debug.assert(bits > 0 and bits <= 512 and bits >= Fe.saturated_bits and bits <= Fe.saturated_bits * 2);
172
173	var s = s_;
174	if (endian == .Big) {
175	for (s_) \|x, i\| s[s.len - 1 - i] = x;
176	}
177	var t = ScalarDouble{ .x1 = undefined, .x2 = Fe.zero };
178	{
179	var b = [_]u8{0} ** encoded_length;
180	const len = math.min(s.len, 32);
181	mem.copy(u8, b[0..len], s[0..len]);
182	t.x1 = Fe.fromBytes(b, .Little) catch unreachable;
183	}
184	if (s_.len >= 32) {
185	var b = [_]u8{0} ** encoded_length;
186	const len = math.min(s.len - 32, 32);
187	mem.copy(u8, b[0..len], s[32..][0..len]);
188	t.x2 = Fe.fromBytes(b, .Little) catch unreachable;
189	}
190	return t;
191	}
192
193	fn reduce(expanded: ScalarDouble, comptime bits: usize) Scalar {
194	debug.assert(bits > 0 and bits <= Fe.saturated_bits * 3 and bits <= 512);
195	var fe = expanded.x1;
196	if (bits >= 256) {
197	const st1 = Fe.fromInt(1 << 256) catch unreachable;
198	fe = fe.add(expanded.x2.mul(st1));
199	}
200	return Scalar{ .fe = fe };
201	}
202	};

lib/std/crypto/pcurves/tests.zig deleted-126

...	@@ -1,126 +0,0 @@
1	const std = @import("std");
2	const fmt = std.fmt;
3	const testing = std.testing;
4
5	const P256 = @import("p256.zig").P256;
6
7	test "p256 ECDH key exchange" {
8	const dha = P256.scalar.random(.Little);
9	const dhb = P256.scalar.random(.Little);
10	const dhA = try P256.basePoint.mul(dha, .Little);
11	const dhB = try P256.basePoint.mul(dhb, .Little);
12	const shareda = try dhA.mul(dhb, .Little);
13	const sharedb = try dhB.mul(dha, .Little);
14	try testing.expect(shareda.equivalent(sharedb));
15	}
16
17	test "p256 point from affine coordinates" {
18	const xh = "6B17D1F2E12C4247F8BCE6E563A440F277037D812DEB33A0F4A13945D898C296";
19	const yh = "4FE342E2FE1A7F9B8EE7EB4A7C0F9E162BCE33576B315ECECBB6406837BF51F5";
20	var xs: [32]u8 = undefined;
21	_ = try fmt.hexToBytes(&xs, xh);
22	var ys: [32]u8 = undefined;
23	_ = try fmt.hexToBytes(&ys, yh);
24	var p = try P256.fromSerializedAffineCoordinates(xs, ys, .Big);
25	try testing.expect(p.equivalent(P256.basePoint));
26	}
27
28	test "p256 test vectors" {
29	const expected = [_][]const u8{
30	"0000000000000000000000000000000000000000000000000000000000000000",
31	"6b17d1f2e12c4247f8bce6e563a440f277037d812deb33a0f4a13945d898c296",
32	"7cf27b188d034f7e8a52380304b51ac3c08969e277f21b35a60b48fc47669978",
33	"5ecbe4d1a6330a44c8f7ef951d4bf165e6c6b721efada985fb41661bc6e7fd6c",
34	"e2534a3532d08fbba02dde659ee62bd0031fe2db785596ef509302446b030852",
35	"51590b7a515140d2d784c85608668fdfef8c82fd1f5be52421554a0dc3d033ed",
36	"b01a172a76a4602c92d3242cb897dde3024c740debb215b4c6b0aae93c2291a9",
37	"8e533b6fa0bf7b4625bb30667c01fb607ef9f8b8a80fef5b300628703187b2a3",
38	"62d9779dbee9b0534042742d3ab54cadc1d238980fce97dbb4dd9dc1db6fb393",
39	"ea68d7b6fedf0b71878938d51d71f8729e0acb8c2c6df8b3d79e8a4b90949ee0",
40	};
41	var p = P256.identityElement;
42	for (expected) \|xh\| {
43	const x = p.affineCoordinates().x;
44	p = p.add(P256.basePoint);
45	var xs: [32]u8 = undefined;
46	_ = try fmt.hexToBytes(&xs, xh);
47	try testing.expectEqualSlices(u8, &x.toBytes(.Big), &xs);
48	}
49	}
50
51	test "p256 test vectors - doubling" {
52	const expected = [_][]const u8{
53	"6b17d1f2e12c4247f8bce6e563a440f277037d812deb33a0f4a13945d898c296",
54	"7cf27b188d034f7e8a52380304b51ac3c08969e277f21b35a60b48fc47669978",
55	"e2534a3532d08fbba02dde659ee62bd0031fe2db785596ef509302446b030852",
56	"62d9779dbee9b0534042742d3ab54cadc1d238980fce97dbb4dd9dc1db6fb393",
57	};
58	var p = P256.basePoint;
59	for (expected) \|xh\| {
60	const x = p.affineCoordinates().x;
61	p = p.dbl();
62	var xs: [32]u8 = undefined;
63	_ = try fmt.hexToBytes(&xs, xh);
64	try testing.expectEqualSlices(u8, &x.toBytes(.Big), &xs);
65	}
66	}
67
68	test "p256 compressed sec1 encoding/decoding" {
69	const p = P256.random();
70	const s = p.toCompressedSec1();
71	const q = try P256.fromSec1(&s);
72	try testing.expect(p.equivalent(q));
73	}
74
75	test "p256 uncompressed sec1 encoding/decoding" {
76	const p = P256.random();
77	const s = p.toUncompressedSec1();
78	const q = try P256.fromSec1(&s);
79	try testing.expect(p.equivalent(q));
80	}
81
82	test "p256 public key is the neutral element" {
83	const n = P256.scalar.Scalar.zero.toBytes(.Little);
84	const p = P256.random();
85	try testing.expectError(error.IdentityElement, p.mul(n, .Little));
86	}
87
88	test "p256 public key is the neutral element (public verification)" {
89	const n = P256.scalar.Scalar.zero.toBytes(.Little);
90	const p = P256.random();
91	try testing.expectError(error.IdentityElement, p.mulPublic(n, .Little));
92	}
93
94	test "p256 field element non-canonical encoding" {
95	const s = [_]u8{0xff} ** 32;
96	try testing.expectError(error.NonCanonical, P256.Fe.fromBytes(s, .Little));
97	}
98
99	test "p256 neutral element decoding" {
100	try testing.expectError(error.InvalidEncoding, P256.fromAffineCoordinates(.{ .x = P256.Fe.zero, .y = P256.Fe.zero }));
101	const p = try P256.fromAffineCoordinates(.{ .x = P256.Fe.zero, .y = P256.Fe.one });
102	try testing.expectError(error.IdentityElement, p.rejectIdentity());
103	}
104
105	test "p256 double base multiplication" {
106	const p1 = P256.basePoint;
107	const p2 = P256.basePoint.dbl();
108	const s1 = [_]u8{0x01} ** 32;
109	const s2 = [_]u8{0x02} ** 32;
110	const pr1 = try P256.mulDoubleBasePublic(p1, s1, p2, s2, .Little);
111	const pr2 = (try p1.mul(s1, .Little)).add(try p2.mul(s2, .Little));
112	try testing.expect(pr1.equivalent(pr2));
113	}
114
115	test "p256 scalar inverse" {
116	const expected = "3b549196a13c898a6f6e84dfb3a22c40a8b9b17fb88e408ea674e451cd01d0a6";
117	var out: [32]u8 = undefined;
118	_ = try std.fmt.hexToBytes(&out, expected);
119
120	const scalar = try P256.scalar.Scalar.fromBytes(.{
121	0x94, 0xa1, 0xbb, 0xb1, 0x4b, 0x90, 0x6a, 0x61, 0xa2, 0x80, 0xf2, 0x45, 0xf9, 0xe9, 0x3c, 0x7f,
122	0x3b, 0x4a, 0x62, 0x47, 0x82, 0x4f, 0x5d, 0x33, 0xb9, 0x67, 0x07, 0x87, 0x64, 0x2a, 0x68, 0xde,
123	}, .Big);
124	const inverse = scalar.invert();
125	try std.testing.expectEqualSlices(u8, &out, &inverse.toBytes(.Big));
126	}

lib/std/crypto/pcurves/tests/p256.zig created+126

...	@@ -0,0 +1,126 @@
1	const std = @import("std");
2	const fmt = std.fmt;
3	const testing = std.testing;
4
5	const P256 = @import("../p256.zig").P256;
6
7	test "p256 ECDH key exchange" {
8	const dha = P256.scalar.random(.Little);
9	const dhb = P256.scalar.random(.Little);
10	const dhA = try P256.basePoint.mul(dha, .Little);
11	const dhB = try P256.basePoint.mul(dhb, .Little);
12	const shareda = try dhA.mul(dhb, .Little);
13	const sharedb = try dhB.mul(dha, .Little);
14	try testing.expect(shareda.equivalent(sharedb));
15	}
16
17	test "p256 point from affine coordinates" {
18	const xh = "6B17D1F2E12C4247F8BCE6E563A440F277037D812DEB33A0F4A13945D898C296";
19	const yh = "4FE342E2FE1A7F9B8EE7EB4A7C0F9E162BCE33576B315ECECBB6406837BF51F5";
20	var xs: [32]u8 = undefined;
21	_ = try fmt.hexToBytes(&xs, xh);
22	var ys: [32]u8 = undefined;
23	_ = try fmt.hexToBytes(&ys, yh);
24	var p = try P256.fromSerializedAffineCoordinates(xs, ys, .Big);
25	try testing.expect(p.equivalent(P256.basePoint));
26	}
27
28	test "p256 test vectors" {
29	const expected = [_][]const u8{
30	"0000000000000000000000000000000000000000000000000000000000000000",
31	"6b17d1f2e12c4247f8bce6e563a440f277037d812deb33a0f4a13945d898c296",
32	"7cf27b188d034f7e8a52380304b51ac3c08969e277f21b35a60b48fc47669978",
33	"5ecbe4d1a6330a44c8f7ef951d4bf165e6c6b721efada985fb41661bc6e7fd6c",
34	"e2534a3532d08fbba02dde659ee62bd0031fe2db785596ef509302446b030852",
35	"51590b7a515140d2d784c85608668fdfef8c82fd1f5be52421554a0dc3d033ed",
36	"b01a172a76a4602c92d3242cb897dde3024c740debb215b4c6b0aae93c2291a9",
37	"8e533b6fa0bf7b4625bb30667c01fb607ef9f8b8a80fef5b300628703187b2a3",
38	"62d9779dbee9b0534042742d3ab54cadc1d238980fce97dbb4dd9dc1db6fb393",
39	"ea68d7b6fedf0b71878938d51d71f8729e0acb8c2c6df8b3d79e8a4b90949ee0",
40	};
41	var p = P256.identityElement;
42	for (expected) \|xh\| {
43	const x = p.affineCoordinates().x;
44	p = p.add(P256.basePoint);
45	var xs: [32]u8 = undefined;
46	_ = try fmt.hexToBytes(&xs, xh);
47	try testing.expectEqualSlices(u8, &x.toBytes(.Big), &xs);
48	}
49	}
50
51	test "p256 test vectors - doubling" {
52	const expected = [_][]const u8{
53	"6b17d1f2e12c4247f8bce6e563a440f277037d812deb33a0f4a13945d898c296",
54	"7cf27b188d034f7e8a52380304b51ac3c08969e277f21b35a60b48fc47669978",
55	"e2534a3532d08fbba02dde659ee62bd0031fe2db785596ef509302446b030852",
56	"62d9779dbee9b0534042742d3ab54cadc1d238980fce97dbb4dd9dc1db6fb393",
57	};
58	var p = P256.basePoint;
59	for (expected) \|xh\| {
60	const x = p.affineCoordinates().x;
61	p = p.dbl();
62	var xs: [32]u8 = undefined;
63	_ = try fmt.hexToBytes(&xs, xh);
64	try testing.expectEqualSlices(u8, &x.toBytes(.Big), &xs);
65	}
66	}
67
68	test "p256 compressed sec1 encoding/decoding" {
69	const p = P256.random();
70	const s = p.toCompressedSec1();
71	const q = try P256.fromSec1(&s);
72	try testing.expect(p.equivalent(q));
73	}
74
75	test "p256 uncompressed sec1 encoding/decoding" {
76	const p = P256.random();
77	const s = p.toUncompressedSec1();
78	const q = try P256.fromSec1(&s);
79	try testing.expect(p.equivalent(q));
80	}
81
82	test "p256 public key is the neutral element" {
83	const n = P256.scalar.Scalar.zero.toBytes(.Little);
84	const p = P256.random();
85	try testing.expectError(error.IdentityElement, p.mul(n, .Little));
86	}
87
88	test "p256 public key is the neutral element (public verification)" {
89	const n = P256.scalar.Scalar.zero.toBytes(.Little);
90	const p = P256.random();
91	try testing.expectError(error.IdentityElement, p.mulPublic(n, .Little));
92	}
93
94	test "p256 field element non-canonical encoding" {
95	const s = [_]u8{0xff} ** 32;
96	try testing.expectError(error.NonCanonical, P256.Fe.fromBytes(s, .Little));
97	}
98
99	test "p256 neutral element decoding" {
100	try testing.expectError(error.InvalidEncoding, P256.fromAffineCoordinates(.{ .x = P256.Fe.zero, .y = P256.Fe.zero }));
101	const p = try P256.fromAffineCoordinates(.{ .x = P256.Fe.zero, .y = P256.Fe.one });
102	try testing.expectError(error.IdentityElement, p.rejectIdentity());
103	}
104
105	test "p256 double base multiplication" {
106	const p1 = P256.basePoint;
107	const p2 = P256.basePoint.dbl();
108	const s1 = [_]u8{0x01} ** 32;
109	const s2 = [_]u8{0x02} ** 32;
110	const pr1 = try P256.mulDoubleBasePublic(p1, s1, p2, s2, .Little);
111	const pr2 = (try p1.mul(s1, .Little)).add(try p2.mul(s2, .Little));
112	try testing.expect(pr1.equivalent(pr2));
113	}
114
115	test "p256 scalar inverse" {
116	const expected = "3b549196a13c898a6f6e84dfb3a22c40a8b9b17fb88e408ea674e451cd01d0a6";
117	var out: [32]u8 = undefined;
118	_ = try std.fmt.hexToBytes(&out, expected);
119
120	const scalar = try P256.scalar.Scalar.fromBytes(.{
121	0x94, 0xa1, 0xbb, 0xb1, 0x4b, 0x90, 0x6a, 0x61, 0xa2, 0x80, 0xf2, 0x45, 0xf9, 0xe9, 0x3c, 0x7f,
122	0x3b, 0x4a, 0x62, 0x47, 0x82, 0x4f, 0x5d, 0x33, 0xb9, 0x67, 0x07, 0x87, 0x64, 0x2a, 0x68, 0xde,
123	}, .Big);
124	const inverse = scalar.invert();
125	try std.testing.expectEqualSlices(u8, &out, &inverse.toBytes(.Big));
126	}

lib/std/crypto/pcurves/tests/p384.zig created+136

...	@@ -0,0 +1,136 @@
1	const std = @import("std");
2	const fmt = std.fmt;
3	const testing = std.testing;
4
5	const P384 = @import("../p384.zig").P384;
6
7	test "p384 ECDH key exchange" {
8	const dha = P384.scalar.random(.Little);
9	const dhb = P384.scalar.random(.Little);
10	const dhA = try P384.basePoint.mul(dha, .Little);
11	const dhB = try P384.basePoint.mul(dhb, .Little);
12	const shareda = try dhA.mul(dhb, .Little);
13	const sharedb = try dhB.mul(dha, .Little);
14	try testing.expect(shareda.equivalent(sharedb));
15	}
16
17	test "p384 point from affine coordinates" {
18	const xh = "aa87ca22be8b05378eb1c71ef320ad746e1d3b628ba79b9859f741e082542a385502f25dbf55296c3a545e3872760ab7";
19	const yh = "3617de4a96262c6f5d9e98bf9292dc29f8f41dbd289a147ce9da3113b5f0b8c00a60b1ce1d7e819d7a431d7c90ea0e5f";
20	var xs: [48]u8 = undefined;
21	_ = try fmt.hexToBytes(&xs, xh);
22	var ys: [48]u8 = undefined;
23	_ = try fmt.hexToBytes(&ys, yh);
24	var p = try P384.fromSerializedAffineCoordinates(xs, ys, .Big);
25	try testing.expect(p.equivalent(P384.basePoint));
26	}
27
28	test "p384 test vectors" {
29	const expected = [_][]const u8{
30	"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000",
31	"AA87CA22BE8B05378EB1C71EF320AD746E1D3B628BA79B9859F741E082542A385502F25DBF55296C3A545E3872760AB7",
32	"08D999057BA3D2D969260045C55B97F089025959A6F434D651D207D19FB96E9E4FE0E86EBE0E64F85B96A9C75295DF61",
33	"077A41D4606FFA1464793C7E5FDC7D98CB9D3910202DCD06BEA4F240D3566DA6B408BBAE5026580D02D7E5C70500C831",
34	"138251CD52AC9298C1C8AAD977321DEB97E709BD0B4CA0ACA55DC8AD51DCFC9D1589A1597E3A5120E1EFD631C63E1835",
35	"11DE24A2C251C777573CAC5EA025E467F208E51DBFF98FC54F6661CBE56583B037882F4A1CA297E60ABCDBC3836D84BC",
36	"627BE1ACD064D2B2226FE0D26F2D15D3C33EBCBB7F0F5DA51CBD41F26257383021317D7202FF30E50937F0854E35C5DF",
37	"283C1D7365CE4788F29F8EBF234EDFFEAD6FE997FBEA5FFA2D58CC9DFA7B1C508B05526F55B9EBB2040F05B48FB6D0E1",
38	"1692778EA596E0BE75114297A6FA383445BF227FBE58190A900C3C73256F11FB5A3258D6F403D5ECE6E9B269D822C87D",
39	"8F0A39A4049BCB3EF1BF29B8B025B78F2216F7291E6FD3BAC6CB1EE285FB6E21C388528BFEE2B9535C55E4461079118B",
40	"A669C5563BD67EEC678D29D6EF4FDE864F372D90B79B9E88931D5C29291238CCED8E85AB507BF91AA9CB2D13186658FB",
41	};
42	var p = P384.identityElement;
43	for (expected) \|xh\| {
44	const x = p.affineCoordinates().x;
45	p = p.add(P384.basePoint);
46	var xs: [48]u8 = undefined;
47	_ = try fmt.hexToBytes(&xs, xh);
48	try testing.expectEqualSlices(u8, &x.toBytes(.Big), &xs);
49	}
50	}
51
52	test "p384 test vectors - doubling" {
53	const expected = [_][]const u8{
54	"AA87CA22BE8B05378EB1C71EF320AD746E1D3B628BA79B9859F741E082542A385502F25DBF55296C3A545E3872760AB7",
55	"08D999057BA3D2D969260045C55B97F089025959A6F434D651D207D19FB96E9E4FE0E86EBE0E64F85B96A9C75295DF61",
56	"138251CD52AC9298C1C8AAD977321DEB97E709BD0B4CA0ACA55DC8AD51DCFC9D1589A1597E3A5120E1EFD631C63E1835",
57	"1692778EA596E0BE75114297A6FA383445BF227FBE58190A900C3C73256F11FB5A3258D6F403D5ECE6E9B269D822C87D",
58	};
59	var p = P384.basePoint;
60	for (expected) \|xh\| {
61	const x = p.affineCoordinates().x;
62	p = p.dbl();
63	var xs: [48]u8 = undefined;
64	_ = try fmt.hexToBytes(&xs, xh);
65	try testing.expectEqualSlices(u8, &x.toBytes(.Big), &xs);
66	}
67	}
68
69	test "p384 compressed sec1 encoding/decoding" {
70	const p = P384.random();
71	const s0 = p.toUncompressedSec1();
72	const s = p.toCompressedSec1();
73	try testing.expectEqualSlices(u8, s0[1..49], s[1..49]);
74	const q = try P384.fromSec1(&s);
75	try testing.expect(p.equivalent(q));
76	}
77
78	test "p384 uncompressed sec1 encoding/decoding" {
79	const p = P384.random();
80	const s = p.toUncompressedSec1();
81	const q = try P384.fromSec1(&s);
82	try testing.expect(p.equivalent(q));
83	}
84
85	test "p384 public key is the neutral element" {
86	const n = P384.scalar.Scalar.zero.toBytes(.Little);
87	const p = P384.random();
88	try testing.expectError(error.IdentityElement, p.mul(n, .Little));
89	}
90
91	test "p384 public key is the neutral element (public verification)" {
92	const n = P384.scalar.Scalar.zero.toBytes(.Little);
93	const p = P384.random();
94	try testing.expectError(error.IdentityElement, p.mulPublic(n, .Little));
95	}
96
97	test "p384 field element non-canonical encoding" {
98	const s = [_]u8{0xff} ** 48;
99	try testing.expectError(error.NonCanonical, P384.Fe.fromBytes(s, .Little));
100	}
101
102	test "p384 neutral element decoding" {
103	try testing.expectError(error.InvalidEncoding, P384.fromAffineCoordinates(.{ .x = P384.Fe.zero, .y = P384.Fe.zero }));
104	const p = try P384.fromAffineCoordinates(.{ .x = P384.Fe.zero, .y = P384.Fe.one });
105	try testing.expectError(error.IdentityElement, p.rejectIdentity());
106	}
107
108	test "p384 double base multiplication" {
109	const p1 = P384.basePoint;
110	const p2 = P384.basePoint.dbl();
111	const s1 = [_]u8{0x01} ** 48;
112	const s2 = [_]u8{0x02} ** 48;
113	const pr1 = try P384.mulDoubleBasePublic(p1, s1, p2, s2, .Little);
114	const pr2 = (try p1.mul(s1, .Little)).add(try p2.mul(s2, .Little));
115	try testing.expect(pr1.equivalent(pr2));
116	}
117
118	test "p384 scalar inverse" {
119	const expected = "a3cc705f33b5679a66e76ce66e68055c927c5dba531b2837b18fe86119511091b54d733f26b2e7a0f6fa2e7ea21ca806";
120	var out: [48]u8 = undefined;
121	_ = try std.fmt.hexToBytes(&out, expected);
122
123	const scalar = try P384.scalar.Scalar.fromBytes(.{
124	0x94, 0xa1, 0xbb, 0xb1, 0x4b, 0x90, 0x6a, 0x61, 0xa2, 0x80, 0xf2, 0x45, 0xf9, 0xe9, 0x3c, 0x7f,
125	0x3b, 0x4a, 0x62, 0x47, 0x82, 0x4f, 0x5d, 0x33, 0xb9, 0x67, 0x07, 0x87, 0x64, 0x2a, 0x68, 0xde,
126	0x38, 0x36, 0xe8, 0x0f, 0xa2, 0x84, 0x6b, 0x4e, 0xf3, 0x9a, 0x02, 0x31, 0x24, 0x41, 0x22, 0xca,
127	}, .Big);
128	const inverse = scalar.invert();
129	const inverse2 = inverse.invert();
130	try testing.expectEqualSlices(u8, &out, &inverse.toBytes(.Big));
131	try testing.expect(inverse2.equivalent(scalar));
132
133	const sq = scalar.sq();
134	const sqr = try sq.sqrt();
135	try testing.expect(sqr.equivalent(scalar));
136	}