Commit 97779442d0a551d96f2a0b1799e96944918af32e | zig

author	Frank Denis <124872+jedisct1@users.noreply.github.com> 2021-05-03 09:57:45+02:00
committer	GitHub <noreply@github.com> 2021-05-03 09:57:45+02:00
log	97779442d0a551d96f2a0b1799e96944918af32e
tree	7cefd333b1d8ceb28b49158920a6bc79cbe64954
parent	c47028cd025f4ce405a9395fa979ff14a3e6349a
signature	Signed by PGP key 4AEE18F83AFDEB23

Prepare std/crypto/pcurves for ecdsa and other curves (#8670)

Functions generated by Fiat-crypto are not prefixed by their description any more. This matches an upstream change.

We can now use a single type for different curves and implementations.

The field type is now generic, so we can properly handle the base field and scalars without code duplication.

5 files changed, 3005 insertions(+), 898 deletions(-)

lib
- std
  - crypto
    pcurves
    common.zig
    p256
    field.zig
    p256_64.zig
    p256_scalar_64.zig
    scalar.zig

lib/std/crypto/pcurves/common.zig created+284

...	...	@@ -0,0 +1,284 @@
	1	const std = @import("std");
	2	const builtin = std.builtin;
	3	const crypto = std.crypto;
	4	const debug = std.debug;
	5	const mem = std.mem;
	6	const meta = std.meta;
	7
	8	const NonCanonicalError = crypto.errors.NonCanonicalError;
	9	const NotSquareError = crypto.errors.NotSquareError;
	10
	11	/// Parameters to create a finite field type.
	12	pub const FieldParams = struct {
	13	fiat: type,
	14	field_order: comptime_int,
	15	field_bits: comptime_int,
	16	saturated_bits: comptime_int,
	17	encoded_length: comptime_int,
	18	};
	19
	20	/// A field element, internally stored in Montgomery domain.
	21	pub fn Field(comptime params: FieldParams) type {
	22	const fiat = params.fiat;
	23	const Limbs = fiat.Limbs;
	24
	25	return struct {
	26	const Fe = @This();
	27
	28	limbs: Limbs,
	29
	30	/// Field size.
	31	pub const field_order = params.field_order;
	32
	33	/// Number of bits to represent the set of all elements.
	34	pub const field_bits = params.field_bits;
	35
	36	/// Number of bits that can be saturated without overflowing.
	37	pub const saturated_bits = params.saturated_bits;
	38
	39	/// Number of bytes required to encode an element.
	40	pub const encoded_length = params.encoded_length;
	41
	42	/// Zero.
	43	pub const zero: Fe = Fe{ .limbs = mem.zeroes(Limbs) };
	44
	45	/// One.
	46	pub const one = comptime one: {
	47	var fe: Fe = undefined;
	48	fiat.setOne(&fe.limbs);
	49	break :one fe;
	50	};
	51
	52	/// Reject non-canonical encodings of an element.
	53	pub fn rejectNonCanonical(s_: [encoded_length]u8, endian: builtin.Endian) NonCanonicalError!void {
	54	var s = if (endian == .Little) s_ else orderSwap(s_);
	55	const field_order_s = comptime fos: {
	56	var fos: [encoded_length]u8 = undefined;
	57	mem.writeIntLittle(std.meta.Int(.unsigned, encoded_length * 8), &fos, field_order);
	58	break :fos fos;
	59	};
	60	if (crypto.utils.timingSafeCompare(u8, &s, &field_order_s, .Little) != .lt) {
	61	return error.NonCanonical;
	62	}
	63	}
	64
	65	/// Swap the endianness of an encoded element.
	66	pub fn orderSwap(s: [encoded_length]u8) [encoded_length]u8 {
	67	var t = s;
	68	for (s) \|x, i\| t[t.len - 1 - i] = x;
	69	return t;
	70	}
	71
	72	/// Unpack a field element.
	73	pub fn fromBytes(s_: [encoded_length]u8, endian: builtin.Endian) NonCanonicalError!Fe {
	74	var s = if (endian == .Little) s_ else orderSwap(s_);
	75	try rejectNonCanonical(s, .Little);
	76	var limbs_z: Limbs = undefined;
	77	fiat.fromBytes(&limbs_z, s);
	78	var limbs: Limbs = undefined;
	79	fiat.toMontgomery(&limbs, limbs_z);
	80	return Fe{ .limbs = limbs };
	81	}
	82
	83	/// Pack a field element.
	84	pub fn toBytes(fe: Fe, endian: builtin.Endian) [encoded_length]u8 {
	85	var limbs_z: Limbs = undefined;
	86	fiat.fromMontgomery(&limbs_z, fe.limbs);
	87	var s: [encoded_length]u8 = undefined;
	88	fiat.toBytes(&s, limbs_z);
	89	return if (endian == .Little) s else orderSwap(s);
	90	}
	91
	92	/// Element as an integer.
	93	pub const IntRepr = meta.Int(.unsigned, params.field_bits);
	94
	95	/// Create a field element from an integer.
	96	pub fn fromInt(comptime x: IntRepr) NonCanonicalError!Fe {
	97	var s: [encoded_length]u8 = undefined;
	98	mem.writeIntLittle(IntRepr, &s, x);
	99	return fromBytes(s, .Little);
	100	}
	101
	102	/// Return the field element as an integer.
	103	pub fn toInt(fe: Fe) IntRepr {
	104	const s = fe.toBytes(.Little);
	105	return mem.readIntLittle(IntRepr, &s);
	106	}
	107
	108	/// Return true if the field element is zero.
	109	pub fn isZero(fe: Fe) bool {
	110	var z: @TypeOf(fe.limbs[0]) = undefined;
	111	fiat.nonzero(&z, fe.limbs);
	112	return z == 0;
	113	}
	114
	115	/// Return true if both field elements are equivalent.
	116	pub fn equivalent(a: Fe, b: Fe) bool {
	117	return a.sub(b).isZero();
	118	}
	119
	120	/// Return true if the element is odd.
	121	pub fn isOdd(fe: Fe) bool {
	122	const s = fe.toBytes(.Little);
	123	return @truncate(u1, s[0]) != 0;
	124	}
	125
	126	/// Conditonally replace a field element with `a` if `c` is positive.
	127	pub fn cMov(fe: *Fe, a: Fe, c: u1) void {
	128	fiat.selectznz(&fe.limbs, c, fe.limbs, a.limbs);
	129	}
	130
	131	/// Add field elements.
	132	pub fn add(a: Fe, b: Fe) Fe {
	133	var fe: Fe = undefined;
	134	fiat.add(&fe.limbs, a.limbs, b.limbs);
	135	return fe;
	136	}
	137
	138	/// Subtract field elements.
	139	pub fn sub(a: Fe, b: Fe) Fe {
	140	var fe: Fe = undefined;
	141	fiat.sub(&fe.limbs, a.limbs, b.limbs);
	142	return fe;
	143	}
	144
	145	/// Double a field element.
	146	pub fn dbl(a: Fe) Fe {
	147	var fe: Fe = undefined;
	148	fiat.add(&fe.limbs, a.limbs, a.limbs);
	149	return fe;
	150	}
	151
	152	/// Multiply field elements.
	153	pub fn mul(a: Fe, b: Fe) Fe {
	154	var fe: Fe = undefined;
	155	fiat.mul(&fe.limbs, a.limbs, b.limbs);
	156	return fe;
	157	}
	158
	159	/// Square a field element.
	160	pub fn sq(a: Fe) Fe {
	161	var fe: Fe = undefined;
	162	fiat.square(&fe.limbs, a.limbs);
	163	return fe;
	164	}
	165
	166	/// Square a field element n times.
	167	fn sqn(a: Fe, comptime n: comptime_int) Fe {
	168	var i: usize = 0;
	169	var fe = a;
	170	while (i < n) : (i += 1) {
	171	fe = fe.sq();
	172	}
	173	return fe;
	174	}
	175
	176	/// Compute a^n.
	177	pub fn pow(a: Fe, comptime T: type, comptime n: T) Fe {
	178	var fe = one;
	179	var x: T = n;
	180	var t = a;
	181	while (true) {
	182	if (@truncate(u1, x) != 0) fe = fe.mul(t);
	183	x >>= 1;
	184	if (x == 0) break;
	185	t = t.sq();
	186	}
	187	return fe;
	188	}
	189
	190	/// Negate a field element.
	191	pub fn neg(a: Fe) Fe {
	192	var fe: Fe = undefined;
	193	fiat.opp(&fe.limbs, a.limbs);
	194	return fe;
	195	}
	196
	197	/// Return the inverse of a field element, or 0 if a=0.
	198	// Field inversion from https://eprint.iacr.org/2021/549.pdf
	199	pub fn invert(a: Fe) Fe {
	200	const iterations = (49 * field_bits + 57) / 17;
	201	const Word = @TypeOf(a.limbs[0]);
	202	const XLimbs = [a.limbs.len + 1]Word;
	203
	204	var d: Word = 1;
	205	var f: XLimbs = undefined;
	206	fiat.msat(&f);
	207
	208	var g: XLimbs = undefined;
	209	fiat.fromMontgomery(g[0..a.limbs.len], a.limbs);
	210	g[g.len - 1] = 0;
	211
	212	var r: Limbs = undefined;
	213	fiat.setOne(&r);
	214	var v = mem.zeroes(Limbs);
	215
	216	var precomp: Limbs = undefined;
	217	fiat.divstepPrecomp(&precomp);
	218
	219	var out1: Word = undefined;
	220	var out2: XLimbs = undefined;
	221	var out3: XLimbs = undefined;
	222	var out4: Limbs = undefined;
	223	var out5: Limbs = undefined;
	224
	225	var i: usize = 0;
	226	while (i < iterations - iterations % 2) : (i += 2) {
	227	fiat.divstep(&out1, &out2, &out3, &out4, &out5, d, f, g, v, r);
	228	fiat.divstep(&d, &f, &g, &v, &r, out1, out2, out3, out4, out5);
	229	}
	230	if (iterations % 2 != 0) {
	231	fiat.divstep(&out1, &out2, &out3, &out4, &out5, d, f, g, v, r);
	232	mem.copy(Word, &v, &out4);
	233	mem.copy(Word, &f, &out2);
	234	}
	235	var v_opp: Limbs = undefined;
	236	fiat.opp(&v_opp, v);
	237	fiat.selectznz(&v, @truncate(u1, f[f.len - 1] >> (meta.bitCount(Word) - 1)), v, v_opp);
	238	var fe: Fe = undefined;
	239	fiat.mul(&fe.limbs, v, precomp);
	240	return fe;
	241	}
	242
	243	/// Return true if the field element is a square.
	244	pub fn isSquare(x2: Fe) bool {
	245	if (field_order == 115792089210356248762697446949407573530086143415290314195533631308867097853951) {
	246	const t110 = x2.mul(x2.sq()).sq();
	247	const t111 = x2.mul(t110);
	248	const t111111 = t111.mul(x2.mul(t110).sqn(3));
	249	const x15 = t111111.sqn(6).mul(t111111).sqn(3).mul(t111);
	250	const x16 = x15.sq().mul(x2);
	251	const x53 = x16.sqn(16).mul(x16).sqn(15);
	252	const x47 = x15.mul(x53);
	253	const ls = x47.mul(((x53.sqn(17).mul(x2)).sqn(143).mul(x47)).sqn(47)).sq().mul(x2);
	254	return ls.equivalent(Fe.one);
	255	} else {
	256	const ls = x2.pow(std.meta.Int(.unsigned, field_bits), (field_order - 1) / 2); // Legendre symbol
	257	return ls.equivalent(Fe.one);
	258	}
	259	}
	260
	261	// x=x2^((field_order+1)/4) w/ field order=3 (mod 4).
	262	fn uncheckedSqrt(x2: Fe) Fe {
	263	comptime debug.assert(field_order % 4 == 3);
	264	if (field_order == 115792089210356248762697446949407573530086143415290314195533631308867097853951) {
	265	const t11 = x2.mul(x2.sq());
	266	const t1111 = t11.mul(t11.sqn(2));
	267	const t11111111 = t1111.mul(t1111.sqn(4));
	268	const x16 = t11111111.sqn(8).mul(t11111111);
	269	return x16.sqn(16).mul(x16).sqn(32).mul(x2).sqn(96).mul(x2).sqn(94);
	270	} else {
	271	return x2.pow(std.meta.Int(.unsigned, field_bits), (field_order + 1) / 4);
	272	}
	273	}
	274
	275	/// Compute the square root of `x2`, returning `error.NotSquare` if `x2` was not a square.
	276	pub fn sqrt(x2: Fe) NotSquareError!Fe {
	277	const x = x2.uncheckedSqrt();
	278	if (x.sq().equivalent(x2)) {
	279	return x;
	280	}
	281	return error.NotSquare;
	282	}
	283	};
	284	}

lib/std/crypto/pcurves/p256/field.zig+9-252

...	...	@@ -5,257 +5,14 @@
5	5	// and substantial portions of the software.
6	6
7	7	const std = @import("std");
8		const builtin = std.builtin;
9		const crypto = std.crypto;
10		const debug = std.debug;
11		const mem = std.mem;
12		const meta = std.meta;
	8	const common = @import("../common.zig");
13	9
14		const fiat = @import("p256_64.zig");
	10	const Field = common.Field;
15	11
16		const NonCanonicalError = crypto.errors.NonCanonicalError;
17		const NotSquareError = crypto.errors.NotSquareError;
18
19		const Limbs = fiat.Limbs;
20
21		/// A field element, internally stored in Montgomery domain.
22		pub const Fe = struct {
23		limbs: Limbs,
24
25		/// Field size.
26		pub const field_order = 115792089210356248762697446949407573530086143415290314195533631308867097853951;
27
28		/// Numer of bits that can be saturated without overflowing.
29		pub const saturated_bits = 255;
30
31		/// Zero.
32		pub const zero: Fe = Fe{ .limbs = mem.zeroes(Limbs) };
33
34		/// One.
35		pub const one = comptime one: {
36		var fe: Fe = undefined;
37		fiat.p256SetOne(&fe.limbs);
38		break :one fe;
39		};
40
41		/// Reject non-canonical encodings of an element.
42		pub fn rejectNonCanonical(s_: [32]u8, endian: builtin.Endian) NonCanonicalError!void {
43		var s = if (endian == .Little) s_ else orderSwap(s_);
44		const field_order_s = comptime fos: {
45		var fos: [32]u8 = undefined;
46		mem.writeIntLittle(u256, &fos, field_order);
47		break :fos fos;
48		};
49		if (crypto.utils.timingSafeCompare(u8, &s, &field_order_s, .Little) != .lt) {
50		return error.NonCanonical;
51		}
52		}
53
54		/// Swap the endianness of an encoded element.
55		pub fn orderSwap(s: [32]u8) [32]u8 {
56		var t = s;
57		for (s) \|x, i\| t[t.len - 1 - i] = x;
58		return t;
59		}
60
61		/// Unpack a field element.
62		pub fn fromBytes(s_: [32]u8, endian: builtin.Endian) NonCanonicalError!Fe {
63		var s = if (endian == .Little) s_ else orderSwap(s_);
64		try rejectNonCanonical(s, .Little);
65		var limbs_z: Limbs = undefined;
66		fiat.p256FromBytes(&limbs_z, s);
67		var limbs: Limbs = undefined;
68		fiat.p256ToMontgomery(&limbs, limbs_z);
69		return Fe{ .limbs = limbs };
70		}
71
72		/// Pack a field element.
73		pub fn toBytes(fe: Fe, endian: builtin.Endian) [32]u8 {
74		var limbs_z: Limbs = undefined;
75		fiat.p256FromMontgomery(&limbs_z, fe.limbs);
76		var s: [32]u8 = undefined;
77		fiat.p256ToBytes(&s, limbs_z);
78		return if (endian == .Little) s else orderSwap(s);
79		}
80
81		/// Create a field element from an integer.
82		pub fn fromInt(comptime x: u256) NonCanonicalError!Fe {
83		var s: [32]u8 = undefined;
84		mem.writeIntLittle(u256, &s, x);
85		return fromBytes(s, .Little);
86		}
87
88		/// Return the field element as an integer.
89		pub fn toInt(fe: Fe) u256 {
90		const s = fe.toBytes(.Little);
91		return mem.readIntLittle(u256, &s);
92		}
93
94		/// Return true if the field element is zero.
95		pub fn isZero(fe: Fe) bool {
96		var z: @TypeOf(fe.limbs[0]) = undefined;
97		fiat.p256Nonzero(&z, fe.limbs);
98		return z == 0;
99		}
100
101		/// Return true if both field elements are equivalent.
102		pub fn equivalent(a: Fe, b: Fe) bool {
103		return a.sub(b).isZero();
104		}
105
106		/// Return true if the element is odd.
107		pub fn isOdd(fe: Fe) bool {
108		const s = fe.toBytes(.Little);
109		return @truncate(u1, s[0]) != 0;
110		}
111
112		/// Conditonally replace a field element with `a` if `c` is positive.
113		pub fn cMov(fe: *Fe, a: Fe, c: u1) void {
114		fiat.p256Selectznz(&fe.limbs, c, fe.limbs, a.limbs);
115		}
116
117		/// Add field elements.
118		pub fn add(a: Fe, b: Fe) Fe {
119		var fe: Fe = undefined;
120		fiat.p256Add(&fe.limbs, a.limbs, b.limbs);
121		return fe;
122		}
123
124		/// Subtract field elements.
125		pub fn sub(a: Fe, b: Fe) Fe {
126		var fe: Fe = undefined;
127		fiat.p256Sub(&fe.limbs, a.limbs, b.limbs);
128		return fe;
129		}
130
131		/// Double a field element.
132		pub fn dbl(a: Fe) Fe {
133		var fe: Fe = undefined;
134		fiat.p256Add(&fe.limbs, a.limbs, a.limbs);
135		return fe;
136		}
137
138		/// Multiply field elements.
139		pub fn mul(a: Fe, b: Fe) Fe {
140		var fe: Fe = undefined;
141		fiat.p256Mul(&fe.limbs, a.limbs, b.limbs);
142		return fe;
143		}
144
145		/// Square a field element.
146		pub fn sq(a: Fe) Fe {
147		var fe: Fe = undefined;
148		fiat.p256Square(&fe.limbs, a.limbs);
149		return fe;
150		}
151
152		/// Square a field element n times.
153		fn sqn(a: Fe, comptime n: comptime_int) Fe {
154		var i: usize = 0;
155		var fe = a;
156		while (i < n) : (i += 1) {
157		fe = fe.sq();
158		}
159		return fe;
160		}
161
162		/// Compute a^n.
163		pub fn pow(a: Fe, comptime T: type, comptime n: T) Fe {
164		var fe = one;
165		var x: T = n;
166		var t = a;
167		while (true) {
168		if (@truncate(u1, x) != 0) fe = fe.mul(t);
169		x >>= 1;
170		if (x == 0) break;
171		t = t.sq();
172		}
173		return fe;
174		}
175
176		/// Negate a field element.
177		pub fn neg(a: Fe) Fe {
178		var fe: Fe = undefined;
179		fiat.p256Opp(&fe.limbs, a.limbs);
180		return fe;
181		}
182
183		/// Return the inverse of a field element, or 0 if a=0.
184		// Field inversion from https://eprint.iacr.org/2021/549.pdf
185		pub fn invert(a: Fe) Fe {
186		const len_prime = 256;
187		const iterations = (49 * len_prime + 57) / 17;
188		const Word = @TypeOf(a.limbs[0]);
189		const XLimbs = [a.limbs.len + 1]Word;
190
191		var d: Word = 1;
192		var f: XLimbs = undefined;
193		fiat.p256Msat(&f);
194
195		var g: XLimbs = undefined;
196		fiat.p256FromMontgomery(g[0..a.limbs.len], a.limbs);
197		g[g.len - 1] = 0;
198
199		var r: Limbs = undefined;
200		fiat.p256SetOne(&r);
201		var v = mem.zeroes(Limbs);
202
203		var precomp: Limbs = undefined;
204		fiat.p256DivstepPrecomp(&precomp);
205
206		var out1: Word = undefined;
207		var out2: XLimbs = undefined;
208		var out3: XLimbs = undefined;
209		var out4: Limbs = undefined;
210		var out5: Limbs = undefined;
211
212		var i: usize = 0;
213		while (i < iterations - iterations % 2) : (i += 2) {
214		fiat.p256Divstep(&out1, &out2, &out3, &out4, &out5, d, f, g, v, r);
215		fiat.p256Divstep(&d, &f, &g, &v, &r, out1, out2, out3, out4, out5);
216		}
217		if (iterations % 2 != 0) {
218		fiat.p256Divstep(&out1, &out2, &out3, &out4, &out5, d, f, g, v, r);
219		mem.copy(Word, &v, &out4);
220		mem.copy(Word, &f, &out2);
221		}
222		var v_opp: Limbs = undefined;
223		fiat.p256Opp(&v_opp, v);
224		fiat.p256Selectznz(&v, @truncate(u1, f[f.len - 1] >> (meta.bitCount(Word) - 1)), v, v_opp);
225		var fe: Fe = undefined;
226		fiat.p256Mul(&fe.limbs, v, precomp);
227		return fe;
228		}
229
230		/// Return true if the field element is a square.
231		pub fn isSquare(x2: Fe) bool {
232		const t110 = x2.mul(x2.sq()).sq();
233		const t111 = x2.mul(t110);
234		const t111111 = t111.mul(x2.mul(t110).sqn(3));
235		const x15 = t111111.sqn(6).mul(t111111).sqn(3).mul(t111);
236		const x16 = x15.sq().mul(x2);
237		const x53 = x16.sqn(16).mul(x16).sqn(15);
238		const x47 = x15.mul(x53);
239		const ls = x47.mul(((x53.sqn(17).mul(x2)).sqn(143).mul(x47)).sqn(47)).sq().mul(x2); // Legendre symbol, (p-1)/2
240		return ls.equivalent(Fe.one);
241		}
242
243		// x=x2^((field_order+1)/4) w/ field order=3 (mod 4).
244		fn uncheckedSqrt(x2: Fe) Fe {
245		comptime debug.assert(field_order % 4 == 3);
246		const t11 = x2.mul(x2.sq());
247		const t1111 = t11.mul(t11.sqn(2));
248		const t11111111 = t1111.mul(t1111.sqn(4));
249		const x16 = t11111111.sqn(8).mul(t11111111);
250		return x16.sqn(16).mul(x16).sqn(32).mul(x2).sqn(96).mul(x2).sqn(94);
251		}
252
253		/// Compute the square root of `x2`, returning `error.NotSquare` if `x2` was not a square.
254		pub fn sqrt(x2: Fe) NotSquareError!Fe {
255		const x = x2.uncheckedSqrt();
256		if (x.sq().equivalent(x2)) {
257		return x;
258		}
259		return error.NotSquare;
260		}
261		};
	12	pub const Fe = Field(.{
	13	.fiat = @import("p256_64.zig"),
	14	.field_order = 115792089210356248762697446949407573530086143415290314195533631308867097853951,
	15	.field_bits = 256,
	16	.saturated_bits = 255,
	17	.encoded_length = 32,
	18	});

lib/std/crypto/pcurves/p256/p256_64.zig+673-635

...	...	@@ -1,11 +1,5 @@
1		// SPDX-License-Identifier: MIT
2		// Copyright (c) 2015-2021 Zig Contributors
3		// This file is part of [zig](https://ziglang.org/), which is MIT licensed.
4		// The MIT license requires this copyright notice to be included in all copies
5		// and substantial portions of the software.
6
7		// Autogenerated: 'src/ExtractionOCaml/word_by_word_montgomery' --lang Zig --internal-static --public-function-case camelCase --private-function-case camelCase p256 64 '2^256 - 2^224 + 2^192 + 2^96 - 1' mul square add sub opp from_montgomery to_montgomery nonzero selectznz to_bytes from_bytes one msat divstep divstep_precomp
8		// curve description: p256
	1	// Autogenerated: 'src/ExtractionOCaml/word_by_word_montgomery' --lang Zig --internal-static --public-function-case camelCase --private-function-case camelCase --no-prefix-fiat --package-name p256 '' 64 '2^256 - 2^224 + 2^192 + 2^96 - 1' mul square add sub opp from_montgomery to_montgomery nonzero selectznz to_bytes from_bytes one msat divstep divstep_precomp
	2	// curve description (via package name): p256
9	3	// machine_wordsize = 64 (from "64")
10	4	// requested operations: mul, square, add, sub, opp, from_montgomery, to_montgomery, nonzero, selectznz, to_bytes, from_bytes, one, msat, divstep, divstep_precomp
11	5	// m = 0xffffffff00000001000000000000000000000000ffffffffffffffffffffffff (from "2^256 - 2^224 + 2^192 + 2^96 - 1")
...	...	@@ -20,10 +14,16 @@
20	14	// Computed values:
21	15	// eval z = z[0] + (z[1] << 64) + (z[2] << 128) + (z[3] << 192)
22	16	// bytes_eval z = z[0] + (z[1] << 8) + (z[2] << 16) + (z[3] << 24) + (z[4] << 32) + (z[5] << 40) + (z[6] << 48) + (z[7] << 56) + (z[8] << 64) + (z[9] << 72) + (z[10] << 80) + (z[11] << 88) + (z[12] << 96) + (z[13] << 104) + (z[14] << 112) + (z[15] << 120) + (z[16] << 128) + (z[17] << 136) + (z[18] << 144) + (z[19] << 152) + (z[20] << 160) + (z[21] << 168) + (z[22] << 176) + (z[23] << 184) + (z[24] << 192) + (z[25] << 200) + (z[26] << 208) + (z[27] << 216) + (z[28] << 224) + (z[29] << 232) + (z[30] << 240) + (z[31] << 248)
	17	// twos_complement_eval z = let x1 := z[0] + (z[1] << 64) + (z[2] << 128) + (z[3] << 192) in
	18	// if x1 & (2^256-1) < 2^255 then x1 & (2^256-1) else (x1 & (2^256-1)) - 2^256
	19
	20	const std = @import("std");
	21	const cast = std.meta.cast;
	22	const mode = std.builtin.mode; // Checked arithmetic is disabled in non-debug modes to avoid side channels
23	23
24	24	pub const Limbs = [4]u64;
25	25
26		/// The function p256AddcarryxU64 is an addition with carry.
	26	/// The function addcarryxU64 is an addition with carry.
27	27	/// Postconditions:
28	28	/// out1 = (arg1 + arg2 + arg3) mod 2^64
29	29	/// out2 = ⌊(arg1 + arg2 + arg3) / 2^64⌋
...	...	@@ -35,14 +35,16 @@ pub const Limbs = [4]u64;
35	35	/// Output Bounds:
36	36	/// out1: [0x0 ~> 0xffffffffffffffff]
37	37	/// out2: [0x0 ~> 0x1]
38		fn p256AddcarryxU64(out1: u64, out2: u1, arg1: u1, arg2: u64, arg3: u64) callconv(.Inline) void {
	38	fn addcarryxU64(out1: u64, out2: u1, arg1: u1, arg2: u64, arg3: u64) callconv(.Inline) void {
	39	@setRuntimeSafety(mode == .Debug);
	40
39	41	var t: u64 = undefined;
40	42	const carry1 = @addWithOverflow(u64, arg2, arg3, &t);
41	43	const carry2 = @addWithOverflow(u64, t, arg1, out1);
42	44	out2.* = @boolToInt(carry1) \| @boolToInt(carry2);
43	45	}
44	46
45		/// The function p256SubborrowxU64 is a subtraction with borrow.
	47	/// The function subborrowxU64 is a subtraction with borrow.
46	48	/// Postconditions:
47	49	/// out1 = (-arg1 + arg2 + -arg3) mod 2^64
48	50	/// out2 = -⌊(-arg1 + arg2 + -arg3) / 2^64⌋
...	...	@@ -54,14 +56,16 @@ fn p256AddcarryxU64(out1: u64, out2: u1, arg1: u1, arg2: u64, arg3: u64) callc
54	56	/// Output Bounds:
55	57	/// out1: [0x0 ~> 0xffffffffffffffff]
56	58	/// out2: [0x0 ~> 0x1]
57		fn p256SubborrowxU64(out1: u64, out2: u1, arg1: u1, arg2: u64, arg3: u64) callconv(.Inline) void {
	59	fn subborrowxU64(out1: u64, out2: u1, arg1: u1, arg2: u64, arg3: u64) callconv(.Inline) void {
	60	@setRuntimeSafety(mode == .Debug);
	61
58	62	var t: u64 = undefined;
59	63	const carry1 = @subWithOverflow(u64, arg2, arg3, &t);
60	64	const carry2 = @subWithOverflow(u64, t, arg1, out1);
61	65	out2.* = @boolToInt(carry1) \| @boolToInt(carry2);
62	66	}
63	67
64		/// The function p256MulxU64 is a multiplication, returning the full double-width result.
	68	/// The function mulxU64 is a multiplication, returning the full double-width result.
65	69	/// Postconditions:
66	70	/// out1 = (arg1 * arg2) mod 2^64
67	71	/// out2 = ⌊arg1 * arg2 / 2^64⌋
...	...	@@ -72,13 +76,15 @@ fn p256SubborrowxU64(out1: u64, out2: u1, arg1: u1, arg2: u64, arg3: u64) call
72	76	/// Output Bounds:
73	77	/// out1: [0x0 ~> 0xffffffffffffffff]
74	78	/// out2: [0x0 ~> 0xffffffffffffffff]
75		fn p256MulxU64(out1: u64, out2: u64, arg1: u64, arg2: u64) callconv(.Inline) void {
	79	fn mulxU64(out1: u64, out2: u64, arg1: u64, arg2: u64) callconv(.Inline) void {
	80	@setRuntimeSafety(mode == .Debug);
	81
76	82	const x = @as(u128, arg1) * @as(u128, arg2);
77	83	out1.* = @truncate(u64, x);
78	84	out2.* = @truncate(u64, x >> 64);
79	85	}
80	86
81		/// The function p256CmovznzU64 is a single-word conditional move.
	87	/// The function cmovznzU64 is a single-word conditional move.
82	88	/// Postconditions:
83	89	/// out1 = (if arg1 = 0 then arg2 else arg3)
84	90	///
...	...	@@ -88,12 +94,14 @@ fn p256MulxU64(out1: u64, out2: u64, arg1: u64, arg2: u64) callconv(.Inline) v
88	94	/// arg3: [0x0 ~> 0xffffffffffffffff]
89	95	/// Output Bounds:
90	96	/// out1: [0x0 ~> 0xffffffffffffffff]
91		fn p256CmovznzU64(out1: *u64, arg1: u1, arg2: u64, arg3: u64) callconv(.Inline) void {
	97	fn cmovznzU64(out1: *u64, arg1: u1, arg2: u64, arg3: u64) callconv(.Inline) void {
	98	@setRuntimeSafety(mode == .Debug);
	99
92	100	const mask = 0 -% @as(u64, arg1);
93	101	out1.* = (mask & arg3) \| ((~mask) & arg2);
94	102	}
95	103
96		/// The function p256Mul multiplies two field elements in the Montgomery domain.
	104	/// The function mul multiplies two field elements in the Montgomery domain.
97	105	/// Preconditions:
98	106	/// 0 ≤ eval arg1 < m
99	107	/// 0 ≤ eval arg2 < m
...	...	@@ -106,289 +114,291 @@ fn p256CmovznzU64(out1: *u64, arg1: u1, arg2: u64, arg3: u64) callconv(.Inline)
106	114	/// arg2: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
107	115	/// Output Bounds:
108	116	/// out1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
109		pub fn p256Mul(out1: *Limbs, arg1: Limbs, arg2: Limbs) void {
110		const x1: u64 = (arg1[1]);
111		const x2: u64 = (arg1[2]);
112		const x3: u64 = (arg1[3]);
113		const x4: u64 = (arg1[0]);
	117	pub fn mul(out1: *[4]u64, arg1: [4]u64, arg2: [4]u64) void {
	118	@setRuntimeSafety(mode == .Debug);
	119
	120	const x1 = (arg1[1]);
	121	const x2 = (arg1[2]);
	122	const x3 = (arg1[3]);
	123	const x4 = (arg1[0]);
114	124	var x5: u64 = undefined;
115	125	var x6: u64 = undefined;
116		p256MulxU64(&x5, &x6, x4, (arg2[3]));
	126	mulxU64(&x5, &x6, x4, (arg2[3]));
117	127	var x7: u64 = undefined;
118	128	var x8: u64 = undefined;
119		p256MulxU64(&x7, &x8, x4, (arg2[2]));
	129	mulxU64(&x7, &x8, x4, (arg2[2]));
120	130	var x9: u64 = undefined;
121	131	var x10: u64 = undefined;
122		p256MulxU64(&x9, &x10, x4, (arg2[1]));
	132	mulxU64(&x9, &x10, x4, (arg2[1]));
123	133	var x11: u64 = undefined;
124	134	var x12: u64 = undefined;
125		p256MulxU64(&x11, &x12, x4, (arg2[0]));
	135	mulxU64(&x11, &x12, x4, (arg2[0]));
126	136	var x13: u64 = undefined;
127	137	var x14: u1 = undefined;
128		p256AddcarryxU64(&x13, &x14, 0x0, x12, x9);
	138	addcarryxU64(&x13, &x14, 0x0, x12, x9);
129	139	var x15: u64 = undefined;
130	140	var x16: u1 = undefined;
131		p256AddcarryxU64(&x15, &x16, x14, x10, x7);
	141	addcarryxU64(&x15, &x16, x14, x10, x7);
132	142	var x17: u64 = undefined;
133	143	var x18: u1 = undefined;
134		p256AddcarryxU64(&x17, &x18, x16, x8, x5);
135		const x19: u64 = (@intCast(u64, x18) + x6);
	144	addcarryxU64(&x17, &x18, x16, x8, x5);
	145	const x19 = (cast(u64, x18) + x6);
136	146	var x20: u64 = undefined;
137	147	var x21: u64 = undefined;
138		p256MulxU64(&x20, &x21, x11, 0xffffffff00000001);
	148	mulxU64(&x20, &x21, x11, 0xffffffff00000001);
139	149	var x22: u64 = undefined;
140	150	var x23: u64 = undefined;
141		p256MulxU64(&x22, &x23, x11, 0xffffffff);
	151	mulxU64(&x22, &x23, x11, 0xffffffff);
142	152	var x24: u64 = undefined;
143	153	var x25: u64 = undefined;
144		p256MulxU64(&x24, &x25, x11, 0xffffffffffffffff);
	154	mulxU64(&x24, &x25, x11, 0xffffffffffffffff);
145	155	var x26: u64 = undefined;
146	156	var x27: u1 = undefined;
147		p256AddcarryxU64(&x26, &x27, 0x0, x25, x22);
148		const x28: u64 = (@intCast(u64, x27) + x23);
	157	addcarryxU64(&x26, &x27, 0x0, x25, x22);
	158	const x28 = (cast(u64, x27) + x23);
149	159	var x29: u64 = undefined;
150	160	var x30: u1 = undefined;
151		p256AddcarryxU64(&x29, &x30, 0x0, x11, x24);
	161	addcarryxU64(&x29, &x30, 0x0, x11, x24);
152	162	var x31: u64 = undefined;
153	163	var x32: u1 = undefined;
154		p256AddcarryxU64(&x31, &x32, x30, x13, x26);
	164	addcarryxU64(&x31, &x32, x30, x13, x26);
155	165	var x33: u64 = undefined;
156	166	var x34: u1 = undefined;
157		p256AddcarryxU64(&x33, &x34, x32, x15, x28);
	167	addcarryxU64(&x33, &x34, x32, x15, x28);
158	168	var x35: u64 = undefined;
159	169	var x36: u1 = undefined;
160		p256AddcarryxU64(&x35, &x36, x34, x17, x20);
	170	addcarryxU64(&x35, &x36, x34, x17, x20);
161	171	var x37: u64 = undefined;
162	172	var x38: u1 = undefined;
163		p256AddcarryxU64(&x37, &x38, x36, x19, x21);
	173	addcarryxU64(&x37, &x38, x36, x19, x21);
164	174	var x39: u64 = undefined;
165	175	var x40: u64 = undefined;
166		p256MulxU64(&x39, &x40, x1, (arg2[3]));
	176	mulxU64(&x39, &x40, x1, (arg2[3]));
167	177	var x41: u64 = undefined;
168	178	var x42: u64 = undefined;
169		p256MulxU64(&x41, &x42, x1, (arg2[2]));
	179	mulxU64(&x41, &x42, x1, (arg2[2]));
170	180	var x43: u64 = undefined;
171	181	var x44: u64 = undefined;
172		p256MulxU64(&x43, &x44, x1, (arg2[1]));
	182	mulxU64(&x43, &x44, x1, (arg2[1]));
173	183	var x45: u64 = undefined;
174	184	var x46: u64 = undefined;
175		p256MulxU64(&x45, &x46, x1, (arg2[0]));
	185	mulxU64(&x45, &x46, x1, (arg2[0]));
176	186	var x47: u64 = undefined;
177	187	var x48: u1 = undefined;
178		p256AddcarryxU64(&x47, &x48, 0x0, x46, x43);
	188	addcarryxU64(&x47, &x48, 0x0, x46, x43);
179	189	var x49: u64 = undefined;
180	190	var x50: u1 = undefined;
181		p256AddcarryxU64(&x49, &x50, x48, x44, x41);
	191	addcarryxU64(&x49, &x50, x48, x44, x41);
182	192	var x51: u64 = undefined;
183	193	var x52: u1 = undefined;
184		p256AddcarryxU64(&x51, &x52, x50, x42, x39);
185		const x53: u64 = (@intCast(u64, x52) + x40);
	194	addcarryxU64(&x51, &x52, x50, x42, x39);
	195	const x53 = (cast(u64, x52) + x40);
186	196	var x54: u64 = undefined;
187	197	var x55: u1 = undefined;
188		p256AddcarryxU64(&x54, &x55, 0x0, x31, x45);
	198	addcarryxU64(&x54, &x55, 0x0, x31, x45);
189	199	var x56: u64 = undefined;
190	200	var x57: u1 = undefined;
191		p256AddcarryxU64(&x56, &x57, x55, x33, x47);
	201	addcarryxU64(&x56, &x57, x55, x33, x47);
192	202	var x58: u64 = undefined;
193	203	var x59: u1 = undefined;
194		p256AddcarryxU64(&x58, &x59, x57, x35, x49);
	204	addcarryxU64(&x58, &x59, x57, x35, x49);
195	205	var x60: u64 = undefined;
196	206	var x61: u1 = undefined;
197		p256AddcarryxU64(&x60, &x61, x59, x37, x51);
	207	addcarryxU64(&x60, &x61, x59, x37, x51);
198	208	var x62: u64 = undefined;
199	209	var x63: u1 = undefined;
200		p256AddcarryxU64(&x62, &x63, x61, @intCast(u64, x38), x53);
	210	addcarryxU64(&x62, &x63, x61, cast(u64, x38), x53);
201	211	var x64: u64 = undefined;
202	212	var x65: u64 = undefined;
203		p256MulxU64(&x64, &x65, x54, 0xffffffff00000001);
	213	mulxU64(&x64, &x65, x54, 0xffffffff00000001);
204	214	var x66: u64 = undefined;
205	215	var x67: u64 = undefined;
206		p256MulxU64(&x66, &x67, x54, 0xffffffff);
	216	mulxU64(&x66, &x67, x54, 0xffffffff);
207	217	var x68: u64 = undefined;
208	218	var x69: u64 = undefined;
209		p256MulxU64(&x68, &x69, x54, 0xffffffffffffffff);
	219	mulxU64(&x68, &x69, x54, 0xffffffffffffffff);
210	220	var x70: u64 = undefined;
211	221	var x71: u1 = undefined;
212		p256AddcarryxU64(&x70, &x71, 0x0, x69, x66);
213		const x72: u64 = (@intCast(u64, x71) + x67);
	222	addcarryxU64(&x70, &x71, 0x0, x69, x66);
	223	const x72 = (cast(u64, x71) + x67);
214	224	var x73: u64 = undefined;
215	225	var x74: u1 = undefined;
216		p256AddcarryxU64(&x73, &x74, 0x0, x54, x68);
	226	addcarryxU64(&x73, &x74, 0x0, x54, x68);
217	227	var x75: u64 = undefined;
218	228	var x76: u1 = undefined;
219		p256AddcarryxU64(&x75, &x76, x74, x56, x70);
	229	addcarryxU64(&x75, &x76, x74, x56, x70);
220	230	var x77: u64 = undefined;
221	231	var x78: u1 = undefined;
222		p256AddcarryxU64(&x77, &x78, x76, x58, x72);
	232	addcarryxU64(&x77, &x78, x76, x58, x72);
223	233	var x79: u64 = undefined;
224	234	var x80: u1 = undefined;
225		p256AddcarryxU64(&x79, &x80, x78, x60, x64);
	235	addcarryxU64(&x79, &x80, x78, x60, x64);
226	236	var x81: u64 = undefined;
227	237	var x82: u1 = undefined;
228		p256AddcarryxU64(&x81, &x82, x80, x62, x65);
229		const x83: u64 = (@intCast(u64, x82) + @intCast(u64, x63));
	238	addcarryxU64(&x81, &x82, x80, x62, x65);
	239	const x83 = (cast(u64, x82) + cast(u64, x63));
230	240	var x84: u64 = undefined;
231	241	var x85: u64 = undefined;
232		p256MulxU64(&x84, &x85, x2, (arg2[3]));
	242	mulxU64(&x84, &x85, x2, (arg2[3]));
233	243	var x86: u64 = undefined;
234	244	var x87: u64 = undefined;
235		p256MulxU64(&x86, &x87, x2, (arg2[2]));
	245	mulxU64(&x86, &x87, x2, (arg2[2]));
236	246	var x88: u64 = undefined;
237	247	var x89: u64 = undefined;
238		p256MulxU64(&x88, &x89, x2, (arg2[1]));
	248	mulxU64(&x88, &x89, x2, (arg2[1]));
239	249	var x90: u64 = undefined;
240	250	var x91: u64 = undefined;
241		p256MulxU64(&x90, &x91, x2, (arg2[0]));
	251	mulxU64(&x90, &x91, x2, (arg2[0]));
242	252	var x92: u64 = undefined;
243	253	var x93: u1 = undefined;
244		p256AddcarryxU64(&x92, &x93, 0x0, x91, x88);
	254	addcarryxU64(&x92, &x93, 0x0, x91, x88);
245	255	var x94: u64 = undefined;
246	256	var x95: u1 = undefined;
247		p256AddcarryxU64(&x94, &x95, x93, x89, x86);
	257	addcarryxU64(&x94, &x95, x93, x89, x86);
248	258	var x96: u64 = undefined;
249	259	var x97: u1 = undefined;
250		p256AddcarryxU64(&x96, &x97, x95, x87, x84);
251		const x98: u64 = (@intCast(u64, x97) + x85);
	260	addcarryxU64(&x96, &x97, x95, x87, x84);
	261	const x98 = (cast(u64, x97) + x85);
252	262	var x99: u64 = undefined;
253	263	var x100: u1 = undefined;
254		p256AddcarryxU64(&x99, &x100, 0x0, x75, x90);
	264	addcarryxU64(&x99, &x100, 0x0, x75, x90);
255	265	var x101: u64 = undefined;
256	266	var x102: u1 = undefined;
257		p256AddcarryxU64(&x101, &x102, x100, x77, x92);
	267	addcarryxU64(&x101, &x102, x100, x77, x92);
258	268	var x103: u64 = undefined;
259	269	var x104: u1 = undefined;
260		p256AddcarryxU64(&x103, &x104, x102, x79, x94);
	270	addcarryxU64(&x103, &x104, x102, x79, x94);
261	271	var x105: u64 = undefined;
262	272	var x106: u1 = undefined;
263		p256AddcarryxU64(&x105, &x106, x104, x81, x96);
	273	addcarryxU64(&x105, &x106, x104, x81, x96);
264	274	var x107: u64 = undefined;
265	275	var x108: u1 = undefined;
266		p256AddcarryxU64(&x107, &x108, x106, x83, x98);
	276	addcarryxU64(&x107, &x108, x106, x83, x98);
267	277	var x109: u64 = undefined;
268	278	var x110: u64 = undefined;
269		p256MulxU64(&x109, &x110, x99, 0xffffffff00000001);
	279	mulxU64(&x109, &x110, x99, 0xffffffff00000001);
270	280	var x111: u64 = undefined;
271	281	var x112: u64 = undefined;
272		p256MulxU64(&x111, &x112, x99, 0xffffffff);
	282	mulxU64(&x111, &x112, x99, 0xffffffff);
273	283	var x113: u64 = undefined;
274	284	var x114: u64 = undefined;
275		p256MulxU64(&x113, &x114, x99, 0xffffffffffffffff);
	285	mulxU64(&x113, &x114, x99, 0xffffffffffffffff);
276	286	var x115: u64 = undefined;
277	287	var x116: u1 = undefined;
278		p256AddcarryxU64(&x115, &x116, 0x0, x114, x111);
279		const x117: u64 = (@intCast(u64, x116) + x112);
	288	addcarryxU64(&x115, &x116, 0x0, x114, x111);
	289	const x117 = (cast(u64, x116) + x112);
280	290	var x118: u64 = undefined;
281	291	var x119: u1 = undefined;
282		p256AddcarryxU64(&x118, &x119, 0x0, x99, x113);
	292	addcarryxU64(&x118, &x119, 0x0, x99, x113);
283	293	var x120: u64 = undefined;
284	294	var x121: u1 = undefined;
285		p256AddcarryxU64(&x120, &x121, x119, x101, x115);
	295	addcarryxU64(&x120, &x121, x119, x101, x115);
286	296	var x122: u64 = undefined;
287	297	var x123: u1 = undefined;
288		p256AddcarryxU64(&x122, &x123, x121, x103, x117);
	298	addcarryxU64(&x122, &x123, x121, x103, x117);
289	299	var x124: u64 = undefined;
290	300	var x125: u1 = undefined;
291		p256AddcarryxU64(&x124, &x125, x123, x105, x109);
	301	addcarryxU64(&x124, &x125, x123, x105, x109);
292	302	var x126: u64 = undefined;
293	303	var x127: u1 = undefined;
294		p256AddcarryxU64(&x126, &x127, x125, x107, x110);
295		const x128: u64 = (@intCast(u64, x127) + @intCast(u64, x108));
	304	addcarryxU64(&x126, &x127, x125, x107, x110);
	305	const x128 = (cast(u64, x127) + cast(u64, x108));
296	306	var x129: u64 = undefined;
297	307	var x130: u64 = undefined;
298		p256MulxU64(&x129, &x130, x3, (arg2[3]));
	308	mulxU64(&x129, &x130, x3, (arg2[3]));
299	309	var x131: u64 = undefined;
300	310	var x132: u64 = undefined;
301		p256MulxU64(&x131, &x132, x3, (arg2[2]));
	311	mulxU64(&x131, &x132, x3, (arg2[2]));
302	312	var x133: u64 = undefined;
303	313	var x134: u64 = undefined;
304		p256MulxU64(&x133, &x134, x3, (arg2[1]));
	314	mulxU64(&x133, &x134, x3, (arg2[1]));
305	315	var x135: u64 = undefined;
306	316	var x136: u64 = undefined;
307		p256MulxU64(&x135, &x136, x3, (arg2[0]));
	317	mulxU64(&x135, &x136, x3, (arg2[0]));
308	318	var x137: u64 = undefined;
309	319	var x138: u1 = undefined;
310		p256AddcarryxU64(&x137, &x138, 0x0, x136, x133);
	320	addcarryxU64(&x137, &x138, 0x0, x136, x133);
311	321	var x139: u64 = undefined;
312	322	var x140: u1 = undefined;
313		p256AddcarryxU64(&x139, &x140, x138, x134, x131);
	323	addcarryxU64(&x139, &x140, x138, x134, x131);
314	324	var x141: u64 = undefined;
315	325	var x142: u1 = undefined;
316		p256AddcarryxU64(&x141, &x142, x140, x132, x129);
317		const x143: u64 = (@intCast(u64, x142) + x130);
	326	addcarryxU64(&x141, &x142, x140, x132, x129);
	327	const x143 = (cast(u64, x142) + x130);
318	328	var x144: u64 = undefined;
319	329	var x145: u1 = undefined;
320		p256AddcarryxU64(&x144, &x145, 0x0, x120, x135);
	330	addcarryxU64(&x144, &x145, 0x0, x120, x135);
321	331	var x146: u64 = undefined;
322	332	var x147: u1 = undefined;
323		p256AddcarryxU64(&x146, &x147, x145, x122, x137);
	333	addcarryxU64(&x146, &x147, x145, x122, x137);
324	334	var x148: u64 = undefined;
325	335	var x149: u1 = undefined;
326		p256AddcarryxU64(&x148, &x149, x147, x124, x139);
	336	addcarryxU64(&x148, &x149, x147, x124, x139);
327	337	var x150: u64 = undefined;
328	338	var x151: u1 = undefined;
329		p256AddcarryxU64(&x150, &x151, x149, x126, x141);
	339	addcarryxU64(&x150, &x151, x149, x126, x141);
330	340	var x152: u64 = undefined;
331	341	var x153: u1 = undefined;
332		p256AddcarryxU64(&x152, &x153, x151, x128, x143);
	342	addcarryxU64(&x152, &x153, x151, x128, x143);
333	343	var x154: u64 = undefined;
334	344	var x155: u64 = undefined;
335		p256MulxU64(&x154, &x155, x144, 0xffffffff00000001);
	345	mulxU64(&x154, &x155, x144, 0xffffffff00000001);
336	346	var x156: u64 = undefined;
337	347	var x157: u64 = undefined;
338		p256MulxU64(&x156, &x157, x144, 0xffffffff);
	348	mulxU64(&x156, &x157, x144, 0xffffffff);
339	349	var x158: u64 = undefined;
340	350	var x159: u64 = undefined;
341		p256MulxU64(&x158, &x159, x144, 0xffffffffffffffff);
	351	mulxU64(&x158, &x159, x144, 0xffffffffffffffff);
342	352	var x160: u64 = undefined;
343	353	var x161: u1 = undefined;
344		p256AddcarryxU64(&x160, &x161, 0x0, x159, x156);
345		const x162: u64 = (@intCast(u64, x161) + x157);
	354	addcarryxU64(&x160, &x161, 0x0, x159, x156);
	355	const x162 = (cast(u64, x161) + x157);
346	356	var x163: u64 = undefined;
347	357	var x164: u1 = undefined;
348		p256AddcarryxU64(&x163, &x164, 0x0, x144, x158);
	358	addcarryxU64(&x163, &x164, 0x0, x144, x158);
349	359	var x165: u64 = undefined;
350	360	var x166: u1 = undefined;
351		p256AddcarryxU64(&x165, &x166, x164, x146, x160);
	361	addcarryxU64(&x165, &x166, x164, x146, x160);
352	362	var x167: u64 = undefined;
353	363	var x168: u1 = undefined;
354		p256AddcarryxU64(&x167, &x168, x166, x148, x162);
	364	addcarryxU64(&x167, &x168, x166, x148, x162);
355	365	var x169: u64 = undefined;
356	366	var x170: u1 = undefined;
357		p256AddcarryxU64(&x169, &x170, x168, x150, x154);
	367	addcarryxU64(&x169, &x170, x168, x150, x154);
358	368	var x171: u64 = undefined;
359	369	var x172: u1 = undefined;
360		p256AddcarryxU64(&x171, &x172, x170, x152, x155);
361		const x173: u64 = (@intCast(u64, x172) + @intCast(u64, x153));
	370	addcarryxU64(&x171, &x172, x170, x152, x155);
	371	const x173 = (cast(u64, x172) + cast(u64, x153));
362	372	var x174: u64 = undefined;
363	373	var x175: u1 = undefined;
364		p256SubborrowxU64(&x174, &x175, 0x0, x165, 0xffffffffffffffff);
	374	subborrowxU64(&x174, &x175, 0x0, x165, 0xffffffffffffffff);
365	375	var x176: u64 = undefined;
366	376	var x177: u1 = undefined;
367		p256SubborrowxU64(&x176, &x177, x175, x167, 0xffffffff);
	377	subborrowxU64(&x176, &x177, x175, x167, 0xffffffff);
368	378	var x178: u64 = undefined;
369	379	var x179: u1 = undefined;
370		p256SubborrowxU64(&x178, &x179, x177, x169, @intCast(u64, 0x0));
	380	subborrowxU64(&x178, &x179, x177, x169, cast(u64, 0x0));
371	381	var x180: u64 = undefined;
372	382	var x181: u1 = undefined;
373		p256SubborrowxU64(&x180, &x181, x179, x171, 0xffffffff00000001);
	383	subborrowxU64(&x180, &x181, x179, x171, 0xffffffff00000001);
374	384	var x182: u64 = undefined;
375	385	var x183: u1 = undefined;
376		p256SubborrowxU64(&x182, &x183, x181, x173, @intCast(u64, 0x0));
	386	subborrowxU64(&x182, &x183, x181, x173, cast(u64, 0x0));
377	387	var x184: u64 = undefined;
378		p256CmovznzU64(&x184, x183, x174, x165);
	388	cmovznzU64(&x184, x183, x174, x165);
379	389	var x185: u64 = undefined;
380		p256CmovznzU64(&x185, x183, x176, x167);
	390	cmovznzU64(&x185, x183, x176, x167);
381	391	var x186: u64 = undefined;
382		p256CmovznzU64(&x186, x183, x178, x169);
	392	cmovznzU64(&x186, x183, x178, x169);
383	393	var x187: u64 = undefined;
384		p256CmovznzU64(&x187, x183, x180, x171);
	394	cmovznzU64(&x187, x183, x180, x171);
385	395	out1[0] = x184;
386	396	out1[1] = x185;
387	397	out1[2] = x186;
388	398	out1[3] = x187;
389	399	}
390	400
391		/// The function p256Square squares a field element in the Montgomery domain.
	401	/// The function square squares a field element in the Montgomery domain.
392	402	/// Preconditions:
393	403	/// 0 ≤ eval arg1 < m
394	404	/// Postconditions:
...	...	@@ -399,289 +409,291 @@ pub fn p256Mul(out1: *Limbs, arg1: Limbs, arg2: Limbs) void {
399	409	/// arg1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
400	410	/// Output Bounds:
401	411	/// out1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
402		pub fn p256Square(out1: *Limbs, arg1: Limbs) void {
403		const x1: u64 = (arg1[1]);
404		const x2: u64 = (arg1[2]);
405		const x3: u64 = (arg1[3]);
406		const x4: u64 = (arg1[0]);
	412	pub fn square(out1: *[4]u64, arg1: [4]u64) void {
	413	@setRuntimeSafety(mode == .Debug);
	414
	415	const x1 = (arg1[1]);
	416	const x2 = (arg1[2]);
	417	const x3 = (arg1[3]);
	418	const x4 = (arg1[0]);
407	419	var x5: u64 = undefined;
408	420	var x6: u64 = undefined;
409		p256MulxU64(&x5, &x6, x4, (arg1[3]));
	421	mulxU64(&x5, &x6, x4, (arg1[3]));
410	422	var x7: u64 = undefined;
411	423	var x8: u64 = undefined;
412		p256MulxU64(&x7, &x8, x4, (arg1[2]));
	424	mulxU64(&x7, &x8, x4, (arg1[2]));
413	425	var x9: u64 = undefined;
414	426	var x10: u64 = undefined;
415		p256MulxU64(&x9, &x10, x4, (arg1[1]));
	427	mulxU64(&x9, &x10, x4, (arg1[1]));
416	428	var x11: u64 = undefined;
417	429	var x12: u64 = undefined;
418		p256MulxU64(&x11, &x12, x4, (arg1[0]));
	430	mulxU64(&x11, &x12, x4, (arg1[0]));
419	431	var x13: u64 = undefined;
420	432	var x14: u1 = undefined;
421		p256AddcarryxU64(&x13, &x14, 0x0, x12, x9);
	433	addcarryxU64(&x13, &x14, 0x0, x12, x9);
422	434	var x15: u64 = undefined;
423	435	var x16: u1 = undefined;
424		p256AddcarryxU64(&x15, &x16, x14, x10, x7);
	436	addcarryxU64(&x15, &x16, x14, x10, x7);
425	437	var x17: u64 = undefined;
426	438	var x18: u1 = undefined;
427		p256AddcarryxU64(&x17, &x18, x16, x8, x5);
428		const x19: u64 = (@intCast(u64, x18) + x6);
	439	addcarryxU64(&x17, &x18, x16, x8, x5);
	440	const x19 = (cast(u64, x18) + x6);
429	441	var x20: u64 = undefined;
430	442	var x21: u64 = undefined;
431		p256MulxU64(&x20, &x21, x11, 0xffffffff00000001);
	443	mulxU64(&x20, &x21, x11, 0xffffffff00000001);
432	444	var x22: u64 = undefined;
433	445	var x23: u64 = undefined;
434		p256MulxU64(&x22, &x23, x11, 0xffffffff);
	446	mulxU64(&x22, &x23, x11, 0xffffffff);
435	447	var x24: u64 = undefined;
436	448	var x25: u64 = undefined;
437		p256MulxU64(&x24, &x25, x11, 0xffffffffffffffff);
	449	mulxU64(&x24, &x25, x11, 0xffffffffffffffff);
438	450	var x26: u64 = undefined;
439	451	var x27: u1 = undefined;
440		p256AddcarryxU64(&x26, &x27, 0x0, x25, x22);
441		const x28: u64 = (@intCast(u64, x27) + x23);
	452	addcarryxU64(&x26, &x27, 0x0, x25, x22);
	453	const x28 = (cast(u64, x27) + x23);
442	454	var x29: u64 = undefined;
443	455	var x30: u1 = undefined;
444		p256AddcarryxU64(&x29, &x30, 0x0, x11, x24);
	456	addcarryxU64(&x29, &x30, 0x0, x11, x24);
445	457	var x31: u64 = undefined;
446	458	var x32: u1 = undefined;
447		p256AddcarryxU64(&x31, &x32, x30, x13, x26);
	459	addcarryxU64(&x31, &x32, x30, x13, x26);
448	460	var x33: u64 = undefined;
449	461	var x34: u1 = undefined;
450		p256AddcarryxU64(&x33, &x34, x32, x15, x28);
	462	addcarryxU64(&x33, &x34, x32, x15, x28);
451	463	var x35: u64 = undefined;
452	464	var x36: u1 = undefined;
453		p256AddcarryxU64(&x35, &x36, x34, x17, x20);
	465	addcarryxU64(&x35, &x36, x34, x17, x20);
454	466	var x37: u64 = undefined;
455	467	var x38: u1 = undefined;
456		p256AddcarryxU64(&x37, &x38, x36, x19, x21);
	468	addcarryxU64(&x37, &x38, x36, x19, x21);
457	469	var x39: u64 = undefined;
458	470	var x40: u64 = undefined;
459		p256MulxU64(&x39, &x40, x1, (arg1[3]));
	471	mulxU64(&x39, &x40, x1, (arg1[3]));
460	472	var x41: u64 = undefined;
461	473	var x42: u64 = undefined;
462		p256MulxU64(&x41, &x42, x1, (arg1[2]));
	474	mulxU64(&x41, &x42, x1, (arg1[2]));
463	475	var x43: u64 = undefined;
464	476	var x44: u64 = undefined;
465		p256MulxU64(&x43, &x44, x1, (arg1[1]));
	477	mulxU64(&x43, &x44, x1, (arg1[1]));
466	478	var x45: u64 = undefined;
467	479	var x46: u64 = undefined;
468		p256MulxU64(&x45, &x46, x1, (arg1[0]));
	480	mulxU64(&x45, &x46, x1, (arg1[0]));
469	481	var x47: u64 = undefined;
470	482	var x48: u1 = undefined;
471		p256AddcarryxU64(&x47, &x48, 0x0, x46, x43);
	483	addcarryxU64(&x47, &x48, 0x0, x46, x43);
472	484	var x49: u64 = undefined;
473	485	var x50: u1 = undefined;
474		p256AddcarryxU64(&x49, &x50, x48, x44, x41);
	486	addcarryxU64(&x49, &x50, x48, x44, x41);
475	487	var x51: u64 = undefined;
476	488	var x52: u1 = undefined;
477		p256AddcarryxU64(&x51, &x52, x50, x42, x39);
478		const x53: u64 = (@intCast(u64, x52) + x40);
	489	addcarryxU64(&x51, &x52, x50, x42, x39);
	490	const x53 = (cast(u64, x52) + x40);
479	491	var x54: u64 = undefined;
480	492	var x55: u1 = undefined;
481		p256AddcarryxU64(&x54, &x55, 0x0, x31, x45);
	493	addcarryxU64(&x54, &x55, 0x0, x31, x45);
482	494	var x56: u64 = undefined;
483	495	var x57: u1 = undefined;
484		p256AddcarryxU64(&x56, &x57, x55, x33, x47);
	496	addcarryxU64(&x56, &x57, x55, x33, x47);
485	497	var x58: u64 = undefined;
486	498	var x59: u1 = undefined;
487		p256AddcarryxU64(&x58, &x59, x57, x35, x49);
	499	addcarryxU64(&x58, &x59, x57, x35, x49);
488	500	var x60: u64 = undefined;
489	501	var x61: u1 = undefined;
490		p256AddcarryxU64(&x60, &x61, x59, x37, x51);
	502	addcarryxU64(&x60, &x61, x59, x37, x51);
491	503	var x62: u64 = undefined;
492	504	var x63: u1 = undefined;
493		p256AddcarryxU64(&x62, &x63, x61, @intCast(u64, x38), x53);
	505	addcarryxU64(&x62, &x63, x61, cast(u64, x38), x53);
494	506	var x64: u64 = undefined;
495	507	var x65: u64 = undefined;
496		p256MulxU64(&x64, &x65, x54, 0xffffffff00000001);
	508	mulxU64(&x64, &x65, x54, 0xffffffff00000001);
497	509	var x66: u64 = undefined;
498	510	var x67: u64 = undefined;
499		p256MulxU64(&x66, &x67, x54, 0xffffffff);
	511	mulxU64(&x66, &x67, x54, 0xffffffff);
500	512	var x68: u64 = undefined;
501	513	var x69: u64 = undefined;
502		p256MulxU64(&x68, &x69, x54, 0xffffffffffffffff);
	514	mulxU64(&x68, &x69, x54, 0xffffffffffffffff);
503	515	var x70: u64 = undefined;
504	516	var x71: u1 = undefined;
505		p256AddcarryxU64(&x70, &x71, 0x0, x69, x66);
506		const x72: u64 = (@intCast(u64, x71) + x67);
	517	addcarryxU64(&x70, &x71, 0x0, x69, x66);
	518	const x72 = (cast(u64, x71) + x67);
507	519	var x73: u64 = undefined;
508	520	var x74: u1 = undefined;
509		p256AddcarryxU64(&x73, &x74, 0x0, x54, x68);
	521	addcarryxU64(&x73, &x74, 0x0, x54, x68);
510	522	var x75: u64 = undefined;
511	523	var x76: u1 = undefined;
512		p256AddcarryxU64(&x75, &x76, x74, x56, x70);
	524	addcarryxU64(&x75, &x76, x74, x56, x70);
513	525	var x77: u64 = undefined;
514	526	var x78: u1 = undefined;
515		p256AddcarryxU64(&x77, &x78, x76, x58, x72);
	527	addcarryxU64(&x77, &x78, x76, x58, x72);
516	528	var x79: u64 = undefined;
517	529	var x80: u1 = undefined;
518		p256AddcarryxU64(&x79, &x80, x78, x60, x64);
	530	addcarryxU64(&x79, &x80, x78, x60, x64);
519	531	var x81: u64 = undefined;
520	532	var x82: u1 = undefined;
521		p256AddcarryxU64(&x81, &x82, x80, x62, x65);
522		const x83: u64 = (@intCast(u64, x82) + @intCast(u64, x63));
	533	addcarryxU64(&x81, &x82, x80, x62, x65);
	534	const x83 = (cast(u64, x82) + cast(u64, x63));
523	535	var x84: u64 = undefined;
524	536	var x85: u64 = undefined;
525		p256MulxU64(&x84, &x85, x2, (arg1[3]));
	537	mulxU64(&x84, &x85, x2, (arg1[3]));
526	538	var x86: u64 = undefined;
527	539	var x87: u64 = undefined;
528		p256MulxU64(&x86, &x87, x2, (arg1[2]));
	540	mulxU64(&x86, &x87, x2, (arg1[2]));
529	541	var x88: u64 = undefined;
530	542	var x89: u64 = undefined;
531		p256MulxU64(&x88, &x89, x2, (arg1[1]));
	543	mulxU64(&x88, &x89, x2, (arg1[1]));
532	544	var x90: u64 = undefined;
533	545	var x91: u64 = undefined;
534		p256MulxU64(&x90, &x91, x2, (arg1[0]));
	546	mulxU64(&x90, &x91, x2, (arg1[0]));
535	547	var x92: u64 = undefined;
536	548	var x93: u1 = undefined;
537		p256AddcarryxU64(&x92, &x93, 0x0, x91, x88);
	549	addcarryxU64(&x92, &x93, 0x0, x91, x88);
538	550	var x94: u64 = undefined;
539	551	var x95: u1 = undefined;
540		p256AddcarryxU64(&x94, &x95, x93, x89, x86);
	552	addcarryxU64(&x94, &x95, x93, x89, x86);
541	553	var x96: u64 = undefined;
542	554	var x97: u1 = undefined;
543		p256AddcarryxU64(&x96, &x97, x95, x87, x84);
544		const x98: u64 = (@intCast(u64, x97) + x85);
	555	addcarryxU64(&x96, &x97, x95, x87, x84);
	556	const x98 = (cast(u64, x97) + x85);
545	557	var x99: u64 = undefined;
546	558	var x100: u1 = undefined;
547		p256AddcarryxU64(&x99, &x100, 0x0, x75, x90);
	559	addcarryxU64(&x99, &x100, 0x0, x75, x90);
548	560	var x101: u64 = undefined;
549	561	var x102: u1 = undefined;
550		p256AddcarryxU64(&x101, &x102, x100, x77, x92);
	562	addcarryxU64(&x101, &x102, x100, x77, x92);
551	563	var x103: u64 = undefined;
552	564	var x104: u1 = undefined;
553		p256AddcarryxU64(&x103, &x104, x102, x79, x94);
	565	addcarryxU64(&x103, &x104, x102, x79, x94);
554	566	var x105: u64 = undefined;
555	567	var x106: u1 = undefined;
556		p256AddcarryxU64(&x105, &x106, x104, x81, x96);
	568	addcarryxU64(&x105, &x106, x104, x81, x96);
557	569	var x107: u64 = undefined;
558	570	var x108: u1 = undefined;
559		p256AddcarryxU64(&x107, &x108, x106, x83, x98);
	571	addcarryxU64(&x107, &x108, x106, x83, x98);
560	572	var x109: u64 = undefined;
561	573	var x110: u64 = undefined;
562		p256MulxU64(&x109, &x110, x99, 0xffffffff00000001);
	574	mulxU64(&x109, &x110, x99, 0xffffffff00000001);
563	575	var x111: u64 = undefined;
564	576	var x112: u64 = undefined;
565		p256MulxU64(&x111, &x112, x99, 0xffffffff);
	577	mulxU64(&x111, &x112, x99, 0xffffffff);
566	578	var x113: u64 = undefined;
567	579	var x114: u64 = undefined;
568		p256MulxU64(&x113, &x114, x99, 0xffffffffffffffff);
	580	mulxU64(&x113, &x114, x99, 0xffffffffffffffff);
569	581	var x115: u64 = undefined;
570	582	var x116: u1 = undefined;
571		p256AddcarryxU64(&x115, &x116, 0x0, x114, x111);
572		const x117: u64 = (@intCast(u64, x116) + x112);
	583	addcarryxU64(&x115, &x116, 0x0, x114, x111);
	584	const x117 = (cast(u64, x116) + x112);
573	585	var x118: u64 = undefined;
574	586	var x119: u1 = undefined;
575		p256AddcarryxU64(&x118, &x119, 0x0, x99, x113);
	587	addcarryxU64(&x118, &x119, 0x0, x99, x113);
576	588	var x120: u64 = undefined;
577	589	var x121: u1 = undefined;
578		p256AddcarryxU64(&x120, &x121, x119, x101, x115);
	590	addcarryxU64(&x120, &x121, x119, x101, x115);
579	591	var x122: u64 = undefined;
580	592	var x123: u1 = undefined;
581		p256AddcarryxU64(&x122, &x123, x121, x103, x117);
	593	addcarryxU64(&x122, &x123, x121, x103, x117);
582	594	var x124: u64 = undefined;
583	595	var x125: u1 = undefined;
584		p256AddcarryxU64(&x124, &x125, x123, x105, x109);
	596	addcarryxU64(&x124, &x125, x123, x105, x109);
585	597	var x126: u64 = undefined;
586	598	var x127: u1 = undefined;
587		p256AddcarryxU64(&x126, &x127, x125, x107, x110);
588		const x128: u64 = (@intCast(u64, x127) + @intCast(u64, x108));
	599	addcarryxU64(&x126, &x127, x125, x107, x110);
	600	const x128 = (cast(u64, x127) + cast(u64, x108));
589	601	var x129: u64 = undefined;
590	602	var x130: u64 = undefined;
591		p256MulxU64(&x129, &x130, x3, (arg1[3]));
	603	mulxU64(&x129, &x130, x3, (arg1[3]));
592	604	var x131: u64 = undefined;
593	605	var x132: u64 = undefined;
594		p256MulxU64(&x131, &x132, x3, (arg1[2]));
	606	mulxU64(&x131, &x132, x3, (arg1[2]));
595	607	var x133: u64 = undefined;
596	608	var x134: u64 = undefined;
597		p256MulxU64(&x133, &x134, x3, (arg1[1]));
	609	mulxU64(&x133, &x134, x3, (arg1[1]));
598	610	var x135: u64 = undefined;
599	611	var x136: u64 = undefined;
600		p256MulxU64(&x135, &x136, x3, (arg1[0]));
	612	mulxU64(&x135, &x136, x3, (arg1[0]));
601	613	var x137: u64 = undefined;
602	614	var x138: u1 = undefined;
603		p256AddcarryxU64(&x137, &x138, 0x0, x136, x133);
	615	addcarryxU64(&x137, &x138, 0x0, x136, x133);
604	616	var x139: u64 = undefined;
605	617	var x140: u1 = undefined;
606		p256AddcarryxU64(&x139, &x140, x138, x134, x131);
	618	addcarryxU64(&x139, &x140, x138, x134, x131);
607	619	var x141: u64 = undefined;
608	620	var x142: u1 = undefined;
609		p256AddcarryxU64(&x141, &x142, x140, x132, x129);
610		const x143: u64 = (@intCast(u64, x142) + x130);
	621	addcarryxU64(&x141, &x142, x140, x132, x129);
	622	const x143 = (cast(u64, x142) + x130);
611	623	var x144: u64 = undefined;
612	624	var x145: u1 = undefined;
613		p256AddcarryxU64(&x144, &x145, 0x0, x120, x135);
	625	addcarryxU64(&x144, &x145, 0x0, x120, x135);
614	626	var x146: u64 = undefined;
615	627	var x147: u1 = undefined;
616		p256AddcarryxU64(&x146, &x147, x145, x122, x137);
	628	addcarryxU64(&x146, &x147, x145, x122, x137);
617	629	var x148: u64 = undefined;
618	630	var x149: u1 = undefined;
619		p256AddcarryxU64(&x148, &x149, x147, x124, x139);
	631	addcarryxU64(&x148, &x149, x147, x124, x139);
620	632	var x150: u64 = undefined;
621	633	var x151: u1 = undefined;
622		p256AddcarryxU64(&x150, &x151, x149, x126, x141);
	634	addcarryxU64(&x150, &x151, x149, x126, x141);
623	635	var x152: u64 = undefined;
624	636	var x153: u1 = undefined;
625		p256AddcarryxU64(&x152, &x153, x151, x128, x143);
	637	addcarryxU64(&x152, &x153, x151, x128, x143);
626	638	var x154: u64 = undefined;
627	639	var x155: u64 = undefined;
628		p256MulxU64(&x154, &x155, x144, 0xffffffff00000001);
	640	mulxU64(&x154, &x155, x144, 0xffffffff00000001);
629	641	var x156: u64 = undefined;
630	642	var x157: u64 = undefined;
631		p256MulxU64(&x156, &x157, x144, 0xffffffff);
	643	mulxU64(&x156, &x157, x144, 0xffffffff);
632	644	var x158: u64 = undefined;
633	645	var x159: u64 = undefined;
634		p256MulxU64(&x158, &x159, x144, 0xffffffffffffffff);
	646	mulxU64(&x158, &x159, x144, 0xffffffffffffffff);
635	647	var x160: u64 = undefined;
636	648	var x161: u1 = undefined;
637		p256AddcarryxU64(&x160, &x161, 0x0, x159, x156);
638		const x162: u64 = (@intCast(u64, x161) + x157);
	649	addcarryxU64(&x160, &x161, 0x0, x159, x156);
	650	const x162 = (cast(u64, x161) + x157);
639	651	var x163: u64 = undefined;
640	652	var x164: u1 = undefined;
641		p256AddcarryxU64(&x163, &x164, 0x0, x144, x158);
	653	addcarryxU64(&x163, &x164, 0x0, x144, x158);
642	654	var x165: u64 = undefined;
643	655	var x166: u1 = undefined;
644		p256AddcarryxU64(&x165, &x166, x164, x146, x160);
	656	addcarryxU64(&x165, &x166, x164, x146, x160);
645	657	var x167: u64 = undefined;
646	658	var x168: u1 = undefined;
647		p256AddcarryxU64(&x167, &x168, x166, x148, x162);
	659	addcarryxU64(&x167, &x168, x166, x148, x162);
648	660	var x169: u64 = undefined;
649	661	var x170: u1 = undefined;
650		p256AddcarryxU64(&x169, &x170, x168, x150, x154);
	662	addcarryxU64(&x169, &x170, x168, x150, x154);
651	663	var x171: u64 = undefined;
652	664	var x172: u1 = undefined;
653		p256AddcarryxU64(&x171, &x172, x170, x152, x155);
654		const x173: u64 = (@intCast(u64, x172) + @intCast(u64, x153));
	665	addcarryxU64(&x171, &x172, x170, x152, x155);
	666	const x173 = (cast(u64, x172) + cast(u64, x153));
655	667	var x174: u64 = undefined;
656	668	var x175: u1 = undefined;
657		p256SubborrowxU64(&x174, &x175, 0x0, x165, 0xffffffffffffffff);
	669	subborrowxU64(&x174, &x175, 0x0, x165, 0xffffffffffffffff);
658	670	var x176: u64 = undefined;
659	671	var x177: u1 = undefined;
660		p256SubborrowxU64(&x176, &x177, x175, x167, 0xffffffff);
	672	subborrowxU64(&x176, &x177, x175, x167, 0xffffffff);
661	673	var x178: u64 = undefined;
662	674	var x179: u1 = undefined;
663		p256SubborrowxU64(&x178, &x179, x177, x169, @intCast(u64, 0x0));
	675	subborrowxU64(&x178, &x179, x177, x169, cast(u64, 0x0));
664	676	var x180: u64 = undefined;
665	677	var x181: u1 = undefined;
666		p256SubborrowxU64(&x180, &x181, x179, x171, 0xffffffff00000001);
	678	subborrowxU64(&x180, &x181, x179, x171, 0xffffffff00000001);
667	679	var x182: u64 = undefined;
668	680	var x183: u1 = undefined;
669		p256SubborrowxU64(&x182, &x183, x181, x173, @intCast(u64, 0x0));
	681	subborrowxU64(&x182, &x183, x181, x173, cast(u64, 0x0));
670	682	var x184: u64 = undefined;
671		p256CmovznzU64(&x184, x183, x174, x165);
	683	cmovznzU64(&x184, x183, x174, x165);
672	684	var x185: u64 = undefined;
673		p256CmovznzU64(&x185, x183, x176, x167);
	685	cmovznzU64(&x185, x183, x176, x167);
674	686	var x186: u64 = undefined;
675		p256CmovznzU64(&x186, x183, x178, x169);
	687	cmovznzU64(&x186, x183, x178, x169);
676	688	var x187: u64 = undefined;
677		p256CmovznzU64(&x187, x183, x180, x171);
	689	cmovznzU64(&x187, x183, x180, x171);
678	690	out1[0] = x184;
679	691	out1[1] = x185;
680	692	out1[2] = x186;
681	693	out1[3] = x187;
682	694	}
683	695
684		/// The function p256Add adds two field elements in the Montgomery domain.
	696	/// The function add adds two field elements in the Montgomery domain.
685	697	/// Preconditions:
686	698	/// 0 ≤ eval arg1 < m
687	699	/// 0 ≤ eval arg2 < m
...	...	@@ -694,49 +706,51 @@ pub fn p256Square(out1: *Limbs, arg1: Limbs) void {
694	706	/// arg2: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
695	707	/// Output Bounds:
696	708	/// out1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
697		pub fn p256Add(out1: *Limbs, arg1: Limbs, arg2: Limbs) void {
	709	pub fn add(out1: *[4]u64, arg1: [4]u64, arg2: [4]u64) void {
	710	@setRuntimeSafety(mode == .Debug);
	711
698	712	var x1: u64 = undefined;
699	713	var x2: u1 = undefined;
700		p256AddcarryxU64(&x1, &x2, 0x0, (arg1[0]), (arg2[0]));
	714	addcarryxU64(&x1, &x2, 0x0, (arg1[0]), (arg2[0]));
701	715	var x3: u64 = undefined;
702	716	var x4: u1 = undefined;
703		p256AddcarryxU64(&x3, &x4, x2, (arg1[1]), (arg2[1]));
	717	addcarryxU64(&x3, &x4, x2, (arg1[1]), (arg2[1]));
704	718	var x5: u64 = undefined;
705	719	var x6: u1 = undefined;
706		p256AddcarryxU64(&x5, &x6, x4, (arg1[2]), (arg2[2]));
	720	addcarryxU64(&x5, &x6, x4, (arg1[2]), (arg2[2]));
707	721	var x7: u64 = undefined;
708	722	var x8: u1 = undefined;
709		p256AddcarryxU64(&x7, &x8, x6, (arg1[3]), (arg2[3]));
	723	addcarryxU64(&x7, &x8, x6, (arg1[3]), (arg2[3]));
710	724	var x9: u64 = undefined;
711	725	var x10: u1 = undefined;
712		p256SubborrowxU64(&x9, &x10, 0x0, x1, 0xffffffffffffffff);
	726	subborrowxU64(&x9, &x10, 0x0, x1, 0xffffffffffffffff);
713	727	var x11: u64 = undefined;
714	728	var x12: u1 = undefined;
715		p256SubborrowxU64(&x11, &x12, x10, x3, 0xffffffff);
	729	subborrowxU64(&x11, &x12, x10, x3, 0xffffffff);
716	730	var x13: u64 = undefined;
717	731	var x14: u1 = undefined;
718		p256SubborrowxU64(&x13, &x14, x12, x5, @intCast(u64, 0x0));
	732	subborrowxU64(&x13, &x14, x12, x5, cast(u64, 0x0));
719	733	var x15: u64 = undefined;
720	734	var x16: u1 = undefined;
721		p256SubborrowxU64(&x15, &x16, x14, x7, 0xffffffff00000001);
	735	subborrowxU64(&x15, &x16, x14, x7, 0xffffffff00000001);
722	736	var x17: u64 = undefined;
723	737	var x18: u1 = undefined;
724		p256SubborrowxU64(&x17, &x18, x16, @intCast(u64, x8), @intCast(u64, 0x0));
	738	subborrowxU64(&x17, &x18, x16, cast(u64, x8), cast(u64, 0x0));
725	739	var x19: u64 = undefined;
726		p256CmovznzU64(&x19, x18, x9, x1);
	740	cmovznzU64(&x19, x18, x9, x1);
727	741	var x20: u64 = undefined;
728		p256CmovznzU64(&x20, x18, x11, x3);
	742	cmovznzU64(&x20, x18, x11, x3);
729	743	var x21: u64 = undefined;
730		p256CmovznzU64(&x21, x18, x13, x5);
	744	cmovznzU64(&x21, x18, x13, x5);
731	745	var x22: u64 = undefined;
732		p256CmovznzU64(&x22, x18, x15, x7);
	746	cmovznzU64(&x22, x18, x15, x7);
733	747	out1[0] = x19;
734	748	out1[1] = x20;
735	749	out1[2] = x21;
736	750	out1[3] = x22;
737	751	}
738	752
739		/// The function p256Sub subtracts two field elements in the Montgomery domain.
	753	/// The function sub subtracts two field elements in the Montgomery domain.
740	754	/// Preconditions:
741	755	/// 0 ≤ eval arg1 < m
742	756	/// 0 ≤ eval arg2 < m
...	...	@@ -749,40 +763,42 @@ pub fn p256Add(out1: *Limbs, arg1: Limbs, arg2: Limbs) void {
749	763	/// arg2: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
750	764	/// Output Bounds:
751	765	/// out1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
752		pub fn p256Sub(out1: *Limbs, arg1: Limbs, arg2: Limbs) void {
	766	pub fn sub(out1: *[4]u64, arg1: [4]u64, arg2: [4]u64) void {
	767	@setRuntimeSafety(mode == .Debug);
	768
753	769	var x1: u64 = undefined;
754	770	var x2: u1 = undefined;
755		p256SubborrowxU64(&x1, &x2, 0x0, (arg1[0]), (arg2[0]));
	771	subborrowxU64(&x1, &x2, 0x0, (arg1[0]), (arg2[0]));
756	772	var x3: u64 = undefined;
757	773	var x4: u1 = undefined;
758		p256SubborrowxU64(&x3, &x4, x2, (arg1[1]), (arg2[1]));
	774	subborrowxU64(&x3, &x4, x2, (arg1[1]), (arg2[1]));
759	775	var x5: u64 = undefined;
760	776	var x6: u1 = undefined;
761		p256SubborrowxU64(&x5, &x6, x4, (arg1[2]), (arg2[2]));
	777	subborrowxU64(&x5, &x6, x4, (arg1[2]), (arg2[2]));
762	778	var x7: u64 = undefined;
763	779	var x8: u1 = undefined;
764		p256SubborrowxU64(&x7, &x8, x6, (arg1[3]), (arg2[3]));
	780	subborrowxU64(&x7, &x8, x6, (arg1[3]), (arg2[3]));
765	781	var x9: u64 = undefined;
766		p256CmovznzU64(&x9, x8, @intCast(u64, 0x0), 0xffffffffffffffff);
	782	cmovznzU64(&x9, x8, cast(u64, 0x0), 0xffffffffffffffff);
767	783	var x10: u64 = undefined;
768	784	var x11: u1 = undefined;
769		p256AddcarryxU64(&x10, &x11, 0x0, x1, x9);
	785	addcarryxU64(&x10, &x11, 0x0, x1, x9);
770	786	var x12: u64 = undefined;
771	787	var x13: u1 = undefined;
772		p256AddcarryxU64(&x12, &x13, x11, x3, (x9 & 0xffffffff));
	788	addcarryxU64(&x12, &x13, x11, x3, (x9 & 0xffffffff));
773	789	var x14: u64 = undefined;
774	790	var x15: u1 = undefined;
775		p256AddcarryxU64(&x14, &x15, x13, x5, @intCast(u64, 0x0));
	791	addcarryxU64(&x14, &x15, x13, x5, cast(u64, 0x0));
776	792	var x16: u64 = undefined;
777	793	var x17: u1 = undefined;
778		p256AddcarryxU64(&x16, &x17, x15, x7, (x9 & 0xffffffff00000001));
	794	addcarryxU64(&x16, &x17, x15, x7, (x9 & 0xffffffff00000001));
779	795	out1[0] = x10;
780	796	out1[1] = x12;
781	797	out1[2] = x14;
782	798	out1[3] = x16;
783	799	}
784	800
785		/// The function p256Opp negates a field element in the Montgomery domain.
	801	/// The function opp negates a field element in the Montgomery domain.
786	802	/// Preconditions:
787	803	/// 0 ≤ eval arg1 < m
788	804	/// Postconditions:
...	...	@@ -793,40 +809,42 @@ pub fn p256Sub(out1: *Limbs, arg1: Limbs, arg2: Limbs) void {
793	809	/// arg1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
794	810	/// Output Bounds:
795	811	/// out1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
796		pub fn p256Opp(out1: *Limbs, arg1: Limbs) void {
	812	pub fn opp(out1: *[4]u64, arg1: [4]u64) void {
	813	@setRuntimeSafety(mode == .Debug);
	814
797	815	var x1: u64 = undefined;
798	816	var x2: u1 = undefined;
799		p256SubborrowxU64(&x1, &x2, 0x0, @intCast(u64, 0x0), (arg1[0]));
	817	subborrowxU64(&x1, &x2, 0x0, cast(u64, 0x0), (arg1[0]));
800	818	var x3: u64 = undefined;
801	819	var x4: u1 = undefined;
802		p256SubborrowxU64(&x3, &x4, x2, @intCast(u64, 0x0), (arg1[1]));
	820	subborrowxU64(&x3, &x4, x2, cast(u64, 0x0), (arg1[1]));
803	821	var x5: u64 = undefined;
804	822	var x6: u1 = undefined;
805		p256SubborrowxU64(&x5, &x6, x4, @intCast(u64, 0x0), (arg1[2]));
	823	subborrowxU64(&x5, &x6, x4, cast(u64, 0x0), (arg1[2]));
806	824	var x7: u64 = undefined;
807	825	var x8: u1 = undefined;
808		p256SubborrowxU64(&x7, &x8, x6, @intCast(u64, 0x0), (arg1[3]));
	826	subborrowxU64(&x7, &x8, x6, cast(u64, 0x0), (arg1[3]));
809	827	var x9: u64 = undefined;
810		p256CmovznzU64(&x9, x8, @intCast(u64, 0x0), 0xffffffffffffffff);
	828	cmovznzU64(&x9, x8, cast(u64, 0x0), 0xffffffffffffffff);
811	829	var x10: u64 = undefined;
812	830	var x11: u1 = undefined;
813		p256AddcarryxU64(&x10, &x11, 0x0, x1, x9);
	831	addcarryxU64(&x10, &x11, 0x0, x1, x9);
814	832	var x12: u64 = undefined;
815	833	var x13: u1 = undefined;
816		p256AddcarryxU64(&x12, &x13, x11, x3, (x9 & 0xffffffff));
	834	addcarryxU64(&x12, &x13, x11, x3, (x9 & 0xffffffff));
817	835	var x14: u64 = undefined;
818	836	var x15: u1 = undefined;
819		p256AddcarryxU64(&x14, &x15, x13, x5, @intCast(u64, 0x0));
	837	addcarryxU64(&x14, &x15, x13, x5, cast(u64, 0x0));
820	838	var x16: u64 = undefined;
821	839	var x17: u1 = undefined;
822		p256AddcarryxU64(&x16, &x17, x15, x7, (x9 & 0xffffffff00000001));
	840	addcarryxU64(&x16, &x17, x15, x7, (x9 & 0xffffffff00000001));
823	841	out1[0] = x10;
824	842	out1[1] = x12;
825	843	out1[2] = x14;
826	844	out1[3] = x16;
827	845	}
828	846
829		/// The function p256FromMontgomery translates a field element out of the Montgomery domain.
	847	/// The function fromMontgomery translates a field element out of the Montgomery domain.
830	848	/// Preconditions:
831	849	/// 0 ≤ eval arg1 < m
832	850	/// Postconditions:
...	...	@@ -837,150 +855,152 @@ pub fn p256Opp(out1: *Limbs, arg1: Limbs) void {
837	855	/// arg1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
838	856	/// Output Bounds:
839	857	/// out1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
840		pub fn p256FromMontgomery(out1: *Limbs, arg1: Limbs) void {
841		const x1: u64 = (arg1[0]);
	858	pub fn fromMontgomery(out1: *[4]u64, arg1: [4]u64) void {
	859	@setRuntimeSafety(mode == .Debug);
	860
	861	const x1 = (arg1[0]);
842	862	var x2: u64 = undefined;
843	863	var x3: u64 = undefined;
844		p256MulxU64(&x2, &x3, x1, 0xffffffff00000001);
	864	mulxU64(&x2, &x3, x1, 0xffffffff00000001);
845	865	var x4: u64 = undefined;
846	866	var x5: u64 = undefined;
847		p256MulxU64(&x4, &x5, x1, 0xffffffff);
	867	mulxU64(&x4, &x5, x1, 0xffffffff);
848	868	var x6: u64 = undefined;
849	869	var x7: u64 = undefined;
850		p256MulxU64(&x6, &x7, x1, 0xffffffffffffffff);
	870	mulxU64(&x6, &x7, x1, 0xffffffffffffffff);
851	871	var x8: u64 = undefined;
852	872	var x9: u1 = undefined;
853		p256AddcarryxU64(&x8, &x9, 0x0, x7, x4);
	873	addcarryxU64(&x8, &x9, 0x0, x7, x4);
854	874	var x10: u64 = undefined;
855	875	var x11: u1 = undefined;
856		p256AddcarryxU64(&x10, &x11, 0x0, x1, x6);
	876	addcarryxU64(&x10, &x11, 0x0, x1, x6);
857	877	var x12: u64 = undefined;
858	878	var x13: u1 = undefined;
859		p256AddcarryxU64(&x12, &x13, x11, @intCast(u64, 0x0), x8);
	879	addcarryxU64(&x12, &x13, x11, cast(u64, 0x0), x8);
860	880	var x14: u64 = undefined;
861	881	var x15: u1 = undefined;
862		p256AddcarryxU64(&x14, &x15, 0x0, x12, (arg1[1]));
	882	addcarryxU64(&x14, &x15, 0x0, x12, (arg1[1]));
863	883	var x16: u64 = undefined;
864	884	var x17: u64 = undefined;
865		p256MulxU64(&x16, &x17, x14, 0xffffffff00000001);
	885	mulxU64(&x16, &x17, x14, 0xffffffff00000001);
866	886	var x18: u64 = undefined;
867	887	var x19: u64 = undefined;
868		p256MulxU64(&x18, &x19, x14, 0xffffffff);
	888	mulxU64(&x18, &x19, x14, 0xffffffff);
869	889	var x20: u64 = undefined;
870	890	var x21: u64 = undefined;
871		p256MulxU64(&x20, &x21, x14, 0xffffffffffffffff);
	891	mulxU64(&x20, &x21, x14, 0xffffffffffffffff);
872	892	var x22: u64 = undefined;
873	893	var x23: u1 = undefined;
874		p256AddcarryxU64(&x22, &x23, 0x0, x21, x18);
	894	addcarryxU64(&x22, &x23, 0x0, x21, x18);
875	895	var x24: u64 = undefined;
876	896	var x25: u1 = undefined;
877		p256AddcarryxU64(&x24, &x25, 0x0, x14, x20);
	897	addcarryxU64(&x24, &x25, 0x0, x14, x20);
878	898	var x26: u64 = undefined;
879	899	var x27: u1 = undefined;
880		p256AddcarryxU64(&x26, &x27, x25, (@intCast(u64, x15) + (@intCast(u64, x13) + (@intCast(u64, x9) + x5))), x22);
	900	addcarryxU64(&x26, &x27, x25, (cast(u64, x15) + (cast(u64, x13) + (cast(u64, x9) + x5))), x22);
881	901	var x28: u64 = undefined;
882	902	var x29: u1 = undefined;
883		p256AddcarryxU64(&x28, &x29, x27, x2, (@intCast(u64, x23) + x19));
	903	addcarryxU64(&x28, &x29, x27, x2, (cast(u64, x23) + x19));
884	904	var x30: u64 = undefined;
885	905	var x31: u1 = undefined;
886		p256AddcarryxU64(&x30, &x31, x29, x3, x16);
	906	addcarryxU64(&x30, &x31, x29, x3, x16);
887	907	var x32: u64 = undefined;
888	908	var x33: u1 = undefined;
889		p256AddcarryxU64(&x32, &x33, 0x0, x26, (arg1[2]));
	909	addcarryxU64(&x32, &x33, 0x0, x26, (arg1[2]));
890	910	var x34: u64 = undefined;
891	911	var x35: u1 = undefined;
892		p256AddcarryxU64(&x34, &x35, x33, x28, @intCast(u64, 0x0));
	912	addcarryxU64(&x34, &x35, x33, x28, cast(u64, 0x0));
893	913	var x36: u64 = undefined;
894	914	var x37: u1 = undefined;
895		p256AddcarryxU64(&x36, &x37, x35, x30, @intCast(u64, 0x0));
	915	addcarryxU64(&x36, &x37, x35, x30, cast(u64, 0x0));
896	916	var x38: u64 = undefined;
897	917	var x39: u64 = undefined;
898		p256MulxU64(&x38, &x39, x32, 0xffffffff00000001);
	918	mulxU64(&x38, &x39, x32, 0xffffffff00000001);
899	919	var x40: u64 = undefined;
900	920	var x41: u64 = undefined;
901		p256MulxU64(&x40, &x41, x32, 0xffffffff);
	921	mulxU64(&x40, &x41, x32, 0xffffffff);
902	922	var x42: u64 = undefined;
903	923	var x43: u64 = undefined;
904		p256MulxU64(&x42, &x43, x32, 0xffffffffffffffff);
	924	mulxU64(&x42, &x43, x32, 0xffffffffffffffff);
905	925	var x44: u64 = undefined;
906	926	var x45: u1 = undefined;
907		p256AddcarryxU64(&x44, &x45, 0x0, x43, x40);
	927	addcarryxU64(&x44, &x45, 0x0, x43, x40);
908	928	var x46: u64 = undefined;
909	929	var x47: u1 = undefined;
910		p256AddcarryxU64(&x46, &x47, 0x0, x32, x42);
	930	addcarryxU64(&x46, &x47, 0x0, x32, x42);
911	931	var x48: u64 = undefined;
912	932	var x49: u1 = undefined;
913		p256AddcarryxU64(&x48, &x49, x47, x34, x44);
	933	addcarryxU64(&x48, &x49, x47, x34, x44);
914	934	var x50: u64 = undefined;
915	935	var x51: u1 = undefined;
916		p256AddcarryxU64(&x50, &x51, x49, x36, (@intCast(u64, x45) + x41));
	936	addcarryxU64(&x50, &x51, x49, x36, (cast(u64, x45) + x41));
917	937	var x52: u64 = undefined;
918	938	var x53: u1 = undefined;
919		p256AddcarryxU64(&x52, &x53, x51, (@intCast(u64, x37) + (@intCast(u64, x31) + x17)), x38);
	939	addcarryxU64(&x52, &x53, x51, (cast(u64, x37) + (cast(u64, x31) + x17)), x38);
920	940	var x54: u64 = undefined;
921	941	var x55: u1 = undefined;
922		p256AddcarryxU64(&x54, &x55, 0x0, x48, (arg1[3]));
	942	addcarryxU64(&x54, &x55, 0x0, x48, (arg1[3]));
923	943	var x56: u64 = undefined;
924	944	var x57: u1 = undefined;
925		p256AddcarryxU64(&x56, &x57, x55, x50, @intCast(u64, 0x0));
	945	addcarryxU64(&x56, &x57, x55, x50, cast(u64, 0x0));
926	946	var x58: u64 = undefined;
927	947	var x59: u1 = undefined;
928		p256AddcarryxU64(&x58, &x59, x57, x52, @intCast(u64, 0x0));
	948	addcarryxU64(&x58, &x59, x57, x52, cast(u64, 0x0));
929	949	var x60: u64 = undefined;
930	950	var x61: u64 = undefined;
931		p256MulxU64(&x60, &x61, x54, 0xffffffff00000001);
	951	mulxU64(&x60, &x61, x54, 0xffffffff00000001);
932	952	var x62: u64 = undefined;
933	953	var x63: u64 = undefined;
934		p256MulxU64(&x62, &x63, x54, 0xffffffff);
	954	mulxU64(&x62, &x63, x54, 0xffffffff);
935	955	var x64: u64 = undefined;
936	956	var x65: u64 = undefined;
937		p256MulxU64(&x64, &x65, x54, 0xffffffffffffffff);
	957	mulxU64(&x64, &x65, x54, 0xffffffffffffffff);
938	958	var x66: u64 = undefined;
939	959	var x67: u1 = undefined;
940		p256AddcarryxU64(&x66, &x67, 0x0, x65, x62);
	960	addcarryxU64(&x66, &x67, 0x0, x65, x62);
941	961	var x68: u64 = undefined;
942	962	var x69: u1 = undefined;
943		p256AddcarryxU64(&x68, &x69, 0x0, x54, x64);
	963	addcarryxU64(&x68, &x69, 0x0, x54, x64);
944	964	var x70: u64 = undefined;
945	965	var x71: u1 = undefined;
946		p256AddcarryxU64(&x70, &x71, x69, x56, x66);
	966	addcarryxU64(&x70, &x71, x69, x56, x66);
947	967	var x72: u64 = undefined;
948	968	var x73: u1 = undefined;
949		p256AddcarryxU64(&x72, &x73, x71, x58, (@intCast(u64, x67) + x63));
	969	addcarryxU64(&x72, &x73, x71, x58, (cast(u64, x67) + x63));
950	970	var x74: u64 = undefined;
951	971	var x75: u1 = undefined;
952		p256AddcarryxU64(&x74, &x75, x73, (@intCast(u64, x59) + (@intCast(u64, x53) + x39)), x60);
953		const x76: u64 = (@intCast(u64, x75) + x61);
	972	addcarryxU64(&x74, &x75, x73, (cast(u64, x59) + (cast(u64, x53) + x39)), x60);
	973	const x76 = (cast(u64, x75) + x61);
954	974	var x77: u64 = undefined;
955	975	var x78: u1 = undefined;
956		p256SubborrowxU64(&x77, &x78, 0x0, x70, 0xffffffffffffffff);
	976	subborrowxU64(&x77, &x78, 0x0, x70, 0xffffffffffffffff);
957	977	var x79: u64 = undefined;
958	978	var x80: u1 = undefined;
959		p256SubborrowxU64(&x79, &x80, x78, x72, 0xffffffff);
	979	subborrowxU64(&x79, &x80, x78, x72, 0xffffffff);
960	980	var x81: u64 = undefined;
961	981	var x82: u1 = undefined;
962		p256SubborrowxU64(&x81, &x82, x80, x74, @intCast(u64, 0x0));
	982	subborrowxU64(&x81, &x82, x80, x74, cast(u64, 0x0));
963	983	var x83: u64 = undefined;
964	984	var x84: u1 = undefined;
965		p256SubborrowxU64(&x83, &x84, x82, x76, 0xffffffff00000001);
	985	subborrowxU64(&x83, &x84, x82, x76, 0xffffffff00000001);
966	986	var x85: u64 = undefined;
967	987	var x86: u1 = undefined;
968		p256SubborrowxU64(&x85, &x86, x84, @intCast(u64, 0x0), @intCast(u64, 0x0));
	988	subborrowxU64(&x85, &x86, x84, cast(u64, 0x0), cast(u64, 0x0));
969	989	var x87: u64 = undefined;
970		p256CmovznzU64(&x87, x86, x77, x70);
	990	cmovznzU64(&x87, x86, x77, x70);
971	991	var x88: u64 = undefined;
972		p256CmovznzU64(&x88, x86, x79, x72);
	992	cmovznzU64(&x88, x86, x79, x72);
973	993	var x89: u64 = undefined;
974		p256CmovznzU64(&x89, x86, x81, x74);
	994	cmovznzU64(&x89, x86, x81, x74);
975	995	var x90: u64 = undefined;
976		p256CmovznzU64(&x90, x86, x83, x76);
	996	cmovznzU64(&x90, x86, x83, x76);
977	997	out1[0] = x87;
978	998	out1[1] = x88;
979	999	out1[2] = x89;
980	1000	out1[3] = x90;
981	1001	}
982	1002
983		/// The function p256ToMontgomery translates a field element into the Montgomery domain.
	1003	/// The function toMontgomery translates a field element into the Montgomery domain.
984	1004	/// Preconditions:
985	1005	/// 0 ≤ eval arg1 < m
986	1006	/// Postconditions:
...	...	@@ -991,269 +1011,271 @@ pub fn p256FromMontgomery(out1: *Limbs, arg1: Limbs) void {
991	1011	/// arg1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
992	1012	/// Output Bounds:
993	1013	/// out1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
994		pub fn p256ToMontgomery(out1: *Limbs, arg1: Limbs) void {
995		const x1: u64 = (arg1[1]);
996		const x2: u64 = (arg1[2]);
997		const x3: u64 = (arg1[3]);
998		const x4: u64 = (arg1[0]);
	1014	pub fn toMontgomery(out1: *[4]u64, arg1: [4]u64) void {
	1015	@setRuntimeSafety(mode == .Debug);
	1016
	1017	const x1 = (arg1[1]);
	1018	const x2 = (arg1[2]);
	1019	const x3 = (arg1[3]);
	1020	const x4 = (arg1[0]);
999	1021	var x5: u64 = undefined;
1000	1022	var x6: u64 = undefined;
1001		p256MulxU64(&x5, &x6, x4, 0x4fffffffd);
	1023	mulxU64(&x5, &x6, x4, 0x4fffffffd);
1002	1024	var x7: u64 = undefined;
1003	1025	var x8: u64 = undefined;
1004		p256MulxU64(&x7, &x8, x4, 0xfffffffffffffffe);
	1026	mulxU64(&x7, &x8, x4, 0xfffffffffffffffe);
1005	1027	var x9: u64 = undefined;
1006	1028	var x10: u64 = undefined;
1007		p256MulxU64(&x9, &x10, x4, 0xfffffffbffffffff);
	1029	mulxU64(&x9, &x10, x4, 0xfffffffbffffffff);
1008	1030	var x11: u64 = undefined;
1009	1031	var x12: u64 = undefined;
1010		p256MulxU64(&x11, &x12, x4, 0x3);
	1032	mulxU64(&x11, &x12, x4, 0x3);
1011	1033	var x13: u64 = undefined;
1012	1034	var x14: u1 = undefined;
1013		p256AddcarryxU64(&x13, &x14, 0x0, x12, x9);
	1035	addcarryxU64(&x13, &x14, 0x0, x12, x9);
1014	1036	var x15: u64 = undefined;
1015	1037	var x16: u1 = undefined;
1016		p256AddcarryxU64(&x15, &x16, x14, x10, x7);
	1038	addcarryxU64(&x15, &x16, x14, x10, x7);
1017	1039	var x17: u64 = undefined;
1018	1040	var x18: u1 = undefined;
1019		p256AddcarryxU64(&x17, &x18, x16, x8, x5);
	1041	addcarryxU64(&x17, &x18, x16, x8, x5);
1020	1042	var x19: u64 = undefined;
1021	1043	var x20: u64 = undefined;
1022		p256MulxU64(&x19, &x20, x11, 0xffffffff00000001);
	1044	mulxU64(&x19, &x20, x11, 0xffffffff00000001);
1023	1045	var x21: u64 = undefined;
1024	1046	var x22: u64 = undefined;
1025		p256MulxU64(&x21, &x22, x11, 0xffffffff);
	1047	mulxU64(&x21, &x22, x11, 0xffffffff);
1026	1048	var x23: u64 = undefined;
1027	1049	var x24: u64 = undefined;
1028		p256MulxU64(&x23, &x24, x11, 0xffffffffffffffff);
	1050	mulxU64(&x23, &x24, x11, 0xffffffffffffffff);
1029	1051	var x25: u64 = undefined;
1030	1052	var x26: u1 = undefined;
1031		p256AddcarryxU64(&x25, &x26, 0x0, x24, x21);
	1053	addcarryxU64(&x25, &x26, 0x0, x24, x21);
1032	1054	var x27: u64 = undefined;
1033	1055	var x28: u1 = undefined;
1034		p256AddcarryxU64(&x27, &x28, 0x0, x11, x23);
	1056	addcarryxU64(&x27, &x28, 0x0, x11, x23);
1035	1057	var x29: u64 = undefined;
1036	1058	var x30: u1 = undefined;
1037		p256AddcarryxU64(&x29, &x30, x28, x13, x25);
	1059	addcarryxU64(&x29, &x30, x28, x13, x25);
1038	1060	var x31: u64 = undefined;
1039	1061	var x32: u1 = undefined;
1040		p256AddcarryxU64(&x31, &x32, x30, x15, (@intCast(u64, x26) + x22));
	1062	addcarryxU64(&x31, &x32, x30, x15, (cast(u64, x26) + x22));
1041	1063	var x33: u64 = undefined;
1042	1064	var x34: u1 = undefined;
1043		p256AddcarryxU64(&x33, &x34, x32, x17, x19);
	1065	addcarryxU64(&x33, &x34, x32, x17, x19);
1044	1066	var x35: u64 = undefined;
1045	1067	var x36: u1 = undefined;
1046		p256AddcarryxU64(&x35, &x36, x34, (@intCast(u64, x18) + x6), x20);
	1068	addcarryxU64(&x35, &x36, x34, (cast(u64, x18) + x6), x20);
1047	1069	var x37: u64 = undefined;
1048	1070	var x38: u64 = undefined;
1049		p256MulxU64(&x37, &x38, x1, 0x4fffffffd);
	1071	mulxU64(&x37, &x38, x1, 0x4fffffffd);
1050	1072	var x39: u64 = undefined;
1051	1073	var x40: u64 = undefined;
1052		p256MulxU64(&x39, &x40, x1, 0xfffffffffffffffe);
	1074	mulxU64(&x39, &x40, x1, 0xfffffffffffffffe);
1053	1075	var x41: u64 = undefined;
1054	1076	var x42: u64 = undefined;
1055		p256MulxU64(&x41, &x42, x1, 0xfffffffbffffffff);
	1077	mulxU64(&x41, &x42, x1, 0xfffffffbffffffff);
1056	1078	var x43: u64 = undefined;
1057	1079	var x44: u64 = undefined;
1058		p256MulxU64(&x43, &x44, x1, 0x3);
	1080	mulxU64(&x43, &x44, x1, 0x3);
1059	1081	var x45: u64 = undefined;
1060	1082	var x46: u1 = undefined;
1061		p256AddcarryxU64(&x45, &x46, 0x0, x44, x41);
	1083	addcarryxU64(&x45, &x46, 0x0, x44, x41);
1062	1084	var x47: u64 = undefined;
1063	1085	var x48: u1 = undefined;
1064		p256AddcarryxU64(&x47, &x48, x46, x42, x39);
	1086	addcarryxU64(&x47, &x48, x46, x42, x39);
1065	1087	var x49: u64 = undefined;
1066	1088	var x50: u1 = undefined;
1067		p256AddcarryxU64(&x49, &x50, x48, x40, x37);
	1089	addcarryxU64(&x49, &x50, x48, x40, x37);
1068	1090	var x51: u64 = undefined;
1069	1091	var x52: u1 = undefined;
1070		p256AddcarryxU64(&x51, &x52, 0x0, x29, x43);
	1092	addcarryxU64(&x51, &x52, 0x0, x29, x43);
1071	1093	var x53: u64 = undefined;
1072	1094	var x54: u1 = undefined;
1073		p256AddcarryxU64(&x53, &x54, x52, x31, x45);
	1095	addcarryxU64(&x53, &x54, x52, x31, x45);
1074	1096	var x55: u64 = undefined;
1075	1097	var x56: u1 = undefined;
1076		p256AddcarryxU64(&x55, &x56, x54, x33, x47);
	1098	addcarryxU64(&x55, &x56, x54, x33, x47);
1077	1099	var x57: u64 = undefined;
1078	1100	var x58: u1 = undefined;
1079		p256AddcarryxU64(&x57, &x58, x56, x35, x49);
	1101	addcarryxU64(&x57, &x58, x56, x35, x49);
1080	1102	var x59: u64 = undefined;
1081	1103	var x60: u64 = undefined;
1082		p256MulxU64(&x59, &x60, x51, 0xffffffff00000001);
	1104	mulxU64(&x59, &x60, x51, 0xffffffff00000001);
1083	1105	var x61: u64 = undefined;
1084	1106	var x62: u64 = undefined;
1085		p256MulxU64(&x61, &x62, x51, 0xffffffff);
	1107	mulxU64(&x61, &x62, x51, 0xffffffff);
1086	1108	var x63: u64 = undefined;
1087	1109	var x64: u64 = undefined;
1088		p256MulxU64(&x63, &x64, x51, 0xffffffffffffffff);
	1110	mulxU64(&x63, &x64, x51, 0xffffffffffffffff);
1089	1111	var x65: u64 = undefined;
1090	1112	var x66: u1 = undefined;
1091		p256AddcarryxU64(&x65, &x66, 0x0, x64, x61);
	1113	addcarryxU64(&x65, &x66, 0x0, x64, x61);
1092	1114	var x67: u64 = undefined;
1093	1115	var x68: u1 = undefined;
1094		p256AddcarryxU64(&x67, &x68, 0x0, x51, x63);
	1116	addcarryxU64(&x67, &x68, 0x0, x51, x63);
1095	1117	var x69: u64 = undefined;
1096	1118	var x70: u1 = undefined;
1097		p256AddcarryxU64(&x69, &x70, x68, x53, x65);
	1119	addcarryxU64(&x69, &x70, x68, x53, x65);
1098	1120	var x71: u64 = undefined;
1099	1121	var x72: u1 = undefined;
1100		p256AddcarryxU64(&x71, &x72, x70, x55, (@intCast(u64, x66) + x62));
	1122	addcarryxU64(&x71, &x72, x70, x55, (cast(u64, x66) + x62));
1101	1123	var x73: u64 = undefined;
1102	1124	var x74: u1 = undefined;
1103		p256AddcarryxU64(&x73, &x74, x72, x57, x59);
	1125	addcarryxU64(&x73, &x74, x72, x57, x59);
1104	1126	var x75: u64 = undefined;
1105	1127	var x76: u1 = undefined;
1106		p256AddcarryxU64(&x75, &x76, x74, ((@intCast(u64, x58) + @intCast(u64, x36)) + (@intCast(u64, x50) + x38)), x60);
	1128	addcarryxU64(&x75, &x76, x74, ((cast(u64, x58) + cast(u64, x36)) + (cast(u64, x50) + x38)), x60);
1107	1129	var x77: u64 = undefined;
1108	1130	var x78: u64 = undefined;
1109		p256MulxU64(&x77, &x78, x2, 0x4fffffffd);
	1131	mulxU64(&x77, &x78, x2, 0x4fffffffd);
1110	1132	var x79: u64 = undefined;
1111	1133	var x80: u64 = undefined;
1112		p256MulxU64(&x79, &x80, x2, 0xfffffffffffffffe);
	1134	mulxU64(&x79, &x80, x2, 0xfffffffffffffffe);
1113	1135	var x81: u64 = undefined;
1114	1136	var x82: u64 = undefined;
1115		p256MulxU64(&x81, &x82, x2, 0xfffffffbffffffff);
	1137	mulxU64(&x81, &x82, x2, 0xfffffffbffffffff);
1116	1138	var x83: u64 = undefined;
1117	1139	var x84: u64 = undefined;
1118		p256MulxU64(&x83, &x84, x2, 0x3);
	1140	mulxU64(&x83, &x84, x2, 0x3);
1119	1141	var x85: u64 = undefined;
1120	1142	var x86: u1 = undefined;
1121		p256AddcarryxU64(&x85, &x86, 0x0, x84, x81);
	1143	addcarryxU64(&x85, &x86, 0x0, x84, x81);
1122	1144	var x87: u64 = undefined;
1123	1145	var x88: u1 = undefined;
1124		p256AddcarryxU64(&x87, &x88, x86, x82, x79);
	1146	addcarryxU64(&x87, &x88, x86, x82, x79);
1125	1147	var x89: u64 = undefined;
1126	1148	var x90: u1 = undefined;
1127		p256AddcarryxU64(&x89, &x90, x88, x80, x77);
	1149	addcarryxU64(&x89, &x90, x88, x80, x77);
1128	1150	var x91: u64 = undefined;
1129	1151	var x92: u1 = undefined;
1130		p256AddcarryxU64(&x91, &x92, 0x0, x69, x83);
	1152	addcarryxU64(&x91, &x92, 0x0, x69, x83);
1131	1153	var x93: u64 = undefined;
1132	1154	var x94: u1 = undefined;
1133		p256AddcarryxU64(&x93, &x94, x92, x71, x85);
	1155	addcarryxU64(&x93, &x94, x92, x71, x85);
1134	1156	var x95: u64 = undefined;
1135	1157	var x96: u1 = undefined;
1136		p256AddcarryxU64(&x95, &x96, x94, x73, x87);
	1158	addcarryxU64(&x95, &x96, x94, x73, x87);
1137	1159	var x97: u64 = undefined;
1138	1160	var x98: u1 = undefined;
1139		p256AddcarryxU64(&x97, &x98, x96, x75, x89);
	1161	addcarryxU64(&x97, &x98, x96, x75, x89);
1140	1162	var x99: u64 = undefined;
1141	1163	var x100: u64 = undefined;
1142		p256MulxU64(&x99, &x100, x91, 0xffffffff00000001);
	1164	mulxU64(&x99, &x100, x91, 0xffffffff00000001);
1143	1165	var x101: u64 = undefined;
1144	1166	var x102: u64 = undefined;
1145		p256MulxU64(&x101, &x102, x91, 0xffffffff);
	1167	mulxU64(&x101, &x102, x91, 0xffffffff);
1146	1168	var x103: u64 = undefined;
1147	1169	var x104: u64 = undefined;
1148		p256MulxU64(&x103, &x104, x91, 0xffffffffffffffff);
	1170	mulxU64(&x103, &x104, x91, 0xffffffffffffffff);
1149	1171	var x105: u64 = undefined;
1150	1172	var x106: u1 = undefined;
1151		p256AddcarryxU64(&x105, &x106, 0x0, x104, x101);
	1173	addcarryxU64(&x105, &x106, 0x0, x104, x101);
1152	1174	var x107: u64 = undefined;
1153	1175	var x108: u1 = undefined;
1154		p256AddcarryxU64(&x107, &x108, 0x0, x91, x103);
	1176	addcarryxU64(&x107, &x108, 0x0, x91, x103);
1155	1177	var x109: u64 = undefined;
1156	1178	var x110: u1 = undefined;
1157		p256AddcarryxU64(&x109, &x110, x108, x93, x105);
	1179	addcarryxU64(&x109, &x110, x108, x93, x105);
1158	1180	var x111: u64 = undefined;
1159	1181	var x112: u1 = undefined;
1160		p256AddcarryxU64(&x111, &x112, x110, x95, (@intCast(u64, x106) + x102));
	1182	addcarryxU64(&x111, &x112, x110, x95, (cast(u64, x106) + x102));
1161	1183	var x113: u64 = undefined;
1162	1184	var x114: u1 = undefined;
1163		p256AddcarryxU64(&x113, &x114, x112, x97, x99);
	1185	addcarryxU64(&x113, &x114, x112, x97, x99);
1164	1186	var x115: u64 = undefined;
1165	1187	var x116: u1 = undefined;
1166		p256AddcarryxU64(&x115, &x116, x114, ((@intCast(u64, x98) + @intCast(u64, x76)) + (@intCast(u64, x90) + x78)), x100);
	1188	addcarryxU64(&x115, &x116, x114, ((cast(u64, x98) + cast(u64, x76)) + (cast(u64, x90) + x78)), x100);
1167	1189	var x117: u64 = undefined;
1168	1190	var x118: u64 = undefined;
1169		p256MulxU64(&x117, &x118, x3, 0x4fffffffd);
	1191	mulxU64(&x117, &x118, x3, 0x4fffffffd);
1170	1192	var x119: u64 = undefined;
1171	1193	var x120: u64 = undefined;
1172		p256MulxU64(&x119, &x120, x3, 0xfffffffffffffffe);
	1194	mulxU64(&x119, &x120, x3, 0xfffffffffffffffe);
1173	1195	var x121: u64 = undefined;
1174	1196	var x122: u64 = undefined;
1175		p256MulxU64(&x121, &x122, x3, 0xfffffffbffffffff);
	1197	mulxU64(&x121, &x122, x3, 0xfffffffbffffffff);
1176	1198	var x123: u64 = undefined;
1177	1199	var x124: u64 = undefined;
1178		p256MulxU64(&x123, &x124, x3, 0x3);
	1200	mulxU64(&x123, &x124, x3, 0x3);
1179	1201	var x125: u64 = undefined;
1180	1202	var x126: u1 = undefined;
1181		p256AddcarryxU64(&x125, &x126, 0x0, x124, x121);
	1203	addcarryxU64(&x125, &x126, 0x0, x124, x121);
1182	1204	var x127: u64 = undefined;
1183	1205	var x128: u1 = undefined;
1184		p256AddcarryxU64(&x127, &x128, x126, x122, x119);
	1206	addcarryxU64(&x127, &x128, x126, x122, x119);
1185	1207	var x129: u64 = undefined;
1186	1208	var x130: u1 = undefined;
1187		p256AddcarryxU64(&x129, &x130, x128, x120, x117);
	1209	addcarryxU64(&x129, &x130, x128, x120, x117);
1188	1210	var x131: u64 = undefined;
1189	1211	var x132: u1 = undefined;
1190		p256AddcarryxU64(&x131, &x132, 0x0, x109, x123);
	1212	addcarryxU64(&x131, &x132, 0x0, x109, x123);
1191	1213	var x133: u64 = undefined;
1192	1214	var x134: u1 = undefined;
1193		p256AddcarryxU64(&x133, &x134, x132, x111, x125);
	1215	addcarryxU64(&x133, &x134, x132, x111, x125);
1194	1216	var x135: u64 = undefined;
1195	1217	var x136: u1 = undefined;
1196		p256AddcarryxU64(&x135, &x136, x134, x113, x127);
	1218	addcarryxU64(&x135, &x136, x134, x113, x127);
1197	1219	var x137: u64 = undefined;
1198	1220	var x138: u1 = undefined;
1199		p256AddcarryxU64(&x137, &x138, x136, x115, x129);
	1221	addcarryxU64(&x137, &x138, x136, x115, x129);
1200	1222	var x139: u64 = undefined;
1201	1223	var x140: u64 = undefined;
1202		p256MulxU64(&x139, &x140, x131, 0xffffffff00000001);
	1224	mulxU64(&x139, &x140, x131, 0xffffffff00000001);
1203	1225	var x141: u64 = undefined;
1204	1226	var x142: u64 = undefined;
1205		p256MulxU64(&x141, &x142, x131, 0xffffffff);
	1227	mulxU64(&x141, &x142, x131, 0xffffffff);
1206	1228	var x143: u64 = undefined;
1207	1229	var x144: u64 = undefined;
1208		p256MulxU64(&x143, &x144, x131, 0xffffffffffffffff);
	1230	mulxU64(&x143, &x144, x131, 0xffffffffffffffff);
1209	1231	var x145: u64 = undefined;
1210	1232	var x146: u1 = undefined;
1211		p256AddcarryxU64(&x145, &x146, 0x0, x144, x141);
	1233	addcarryxU64(&x145, &x146, 0x0, x144, x141);
1212	1234	var x147: u64 = undefined;
1213	1235	var x148: u1 = undefined;
1214		p256AddcarryxU64(&x147, &x148, 0x0, x131, x143);
	1236	addcarryxU64(&x147, &x148, 0x0, x131, x143);
1215	1237	var x149: u64 = undefined;
1216	1238	var x150: u1 = undefined;
1217		p256AddcarryxU64(&x149, &x150, x148, x133, x145);
	1239	addcarryxU64(&x149, &x150, x148, x133, x145);
1218	1240	var x151: u64 = undefined;
1219	1241	var x152: u1 = undefined;
1220		p256AddcarryxU64(&x151, &x152, x150, x135, (@intCast(u64, x146) + x142));
	1242	addcarryxU64(&x151, &x152, x150, x135, (cast(u64, x146) + x142));
1221	1243	var x153: u64 = undefined;
1222	1244	var x154: u1 = undefined;
1223		p256AddcarryxU64(&x153, &x154, x152, x137, x139);
	1245	addcarryxU64(&x153, &x154, x152, x137, x139);
1224	1246	var x155: u64 = undefined;
1225	1247	var x156: u1 = undefined;
1226		p256AddcarryxU64(&x155, &x156, x154, ((@intCast(u64, x138) + @intCast(u64, x116)) + (@intCast(u64, x130) + x118)), x140);
	1248	addcarryxU64(&x155, &x156, x154, ((cast(u64, x138) + cast(u64, x116)) + (cast(u64, x130) + x118)), x140);
1227	1249	var x157: u64 = undefined;
1228	1250	var x158: u1 = undefined;
1229		p256SubborrowxU64(&x157, &x158, 0x0, x149, 0xffffffffffffffff);
	1251	subborrowxU64(&x157, &x158, 0x0, x149, 0xffffffffffffffff);
1230	1252	var x159: u64 = undefined;
1231	1253	var x160: u1 = undefined;
1232		p256SubborrowxU64(&x159, &x160, x158, x151, 0xffffffff);
	1254	subborrowxU64(&x159, &x160, x158, x151, 0xffffffff);
1233	1255	var x161: u64 = undefined;
1234	1256	var x162: u1 = undefined;
1235		p256SubborrowxU64(&x161, &x162, x160, x153, @intCast(u64, 0x0));
	1257	subborrowxU64(&x161, &x162, x160, x153, cast(u64, 0x0));
1236	1258	var x163: u64 = undefined;
1237	1259	var x164: u1 = undefined;
1238		p256SubborrowxU64(&x163, &x164, x162, x155, 0xffffffff00000001);
	1260	subborrowxU64(&x163, &x164, x162, x155, 0xffffffff00000001);
1239	1261	var x165: u64 = undefined;
1240	1262	var x166: u1 = undefined;
1241		p256SubborrowxU64(&x165, &x166, x164, @intCast(u64, x156), @intCast(u64, 0x0));
	1263	subborrowxU64(&x165, &x166, x164, cast(u64, x156), cast(u64, 0x0));
1242	1264	var x167: u64 = undefined;
1243		p256CmovznzU64(&x167, x166, x157, x149);
	1265	cmovznzU64(&x167, x166, x157, x149);
1244	1266	var x168: u64 = undefined;
1245		p256CmovznzU64(&x168, x166, x159, x151);
	1267	cmovznzU64(&x168, x166, x159, x151);
1246	1268	var x169: u64 = undefined;
1247		p256CmovznzU64(&x169, x166, x161, x153);
	1269	cmovznzU64(&x169, x166, x161, x153);
1248	1270	var x170: u64 = undefined;
1249		p256CmovznzU64(&x170, x166, x163, x155);
	1271	cmovznzU64(&x170, x166, x163, x155);
1250	1272	out1[0] = x167;
1251	1273	out1[1] = x168;
1252	1274	out1[2] = x169;
1253	1275	out1[3] = x170;
1254	1276	}
1255	1277
1256		/// The function p256Nonzero outputs a single non-zero word if the input is non-zero and zero otherwise.
	1278	/// The function nonzero outputs a single non-zero word if the input is non-zero and zero otherwise.
1257	1279	/// Preconditions:
1258	1280	/// 0 ≤ eval arg1 < m
1259	1281	/// Postconditions:
...	...	@@ -1263,12 +1285,14 @@ pub fn p256ToMontgomery(out1: *Limbs, arg1: Limbs) void {
1263	1285	/// arg1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
1264	1286	/// Output Bounds:
1265	1287	/// out1: [0x0 ~> 0xffffffffffffffff]
1266		pub fn p256Nonzero(out1: *u64, arg1: Limbs) void {
1267		const x1: u64 = ((arg1[0]) \| ((arg1[1]) \| ((arg1[2]) \| (arg1[3]))));
	1288	pub fn nonzero(out1: *u64, arg1: [4]u64) void {
	1289	@setRuntimeSafety(mode == .Debug);
	1290
	1291	const x1 = ((arg1[0]) \| ((arg1[1]) \| ((arg1[2]) \| (arg1[3]))));
1268	1292	out1.* = x1;
1269	1293	}
1270	1294
1271		/// The function p256Selectznz is a multi-limb conditional select.
	1295	/// The function selectznz is a multi-limb conditional select.
1272	1296	/// Postconditions:
1273	1297	/// eval out1 = (if arg1 = 0 then eval arg2 else eval arg3)
1274	1298	///
...	...	@@ -1278,22 +1302,24 @@ pub fn p256Nonzero(out1: *u64, arg1: Limbs) void {
1278	1302	/// arg3: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
1279	1303	/// Output Bounds:
1280	1304	/// out1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
1281		pub fn p256Selectznz(out1: *Limbs, arg1: u1, arg2: Limbs, arg3: Limbs) void {
	1305	pub fn selectznz(out1: *[4]u64, arg1: u1, arg2: [4]u64, arg3: [4]u64) void {
	1306	@setRuntimeSafety(mode == .Debug);
	1307
1282	1308	var x1: u64 = undefined;
1283		p256CmovznzU64(&x1, arg1, (arg2[0]), (arg3[0]));
	1309	cmovznzU64(&x1, arg1, (arg2[0]), (arg3[0]));
1284	1310	var x2: u64 = undefined;
1285		p256CmovznzU64(&x2, arg1, (arg2[1]), (arg3[1]));
	1311	cmovznzU64(&x2, arg1, (arg2[1]), (arg3[1]));
1286	1312	var x3: u64 = undefined;
1287		p256CmovznzU64(&x3, arg1, (arg2[2]), (arg3[2]));
	1313	cmovznzU64(&x3, arg1, (arg2[2]), (arg3[2]));
1288	1314	var x4: u64 = undefined;
1289		p256CmovznzU64(&x4, arg1, (arg2[3]), (arg3[3]));
	1315	cmovznzU64(&x4, arg1, (arg2[3]), (arg3[3]));
1290	1316	out1[0] = x1;
1291	1317	out1[1] = x2;
1292	1318	out1[2] = x3;
1293	1319	out1[3] = x4;
1294	1320	}
1295	1321
1296		/// The function p256ToBytes serializes a field element NOT in the Montgomery domain to bytes in little-endian order.
	1322	/// The function toBytes serializes a field element NOT in the Montgomery domain to bytes in little-endian order.
1297	1323	/// Preconditions:
1298	1324	/// 0 ≤ eval arg1 < m
1299	1325	/// Postconditions:
...	...	@@ -1303,67 +1329,69 @@ pub fn p256Selectznz(out1: *Limbs, arg1: u1, arg2: Limbs, arg3: Limbs) void {
1303	1329	/// arg1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
1304	1330	/// Output Bounds:
1305	1331	/// out1: [[0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff]]
1306		pub fn p256ToBytes(out1: *[32]u8, arg1: Limbs) void {
1307		const x1: u64 = (arg1[3]);
1308		const x2: u64 = (arg1[2]);
1309		const x3: u64 = (arg1[1]);
1310		const x4: u64 = (arg1[0]);
1311		const x5: u8 = @intCast(u8, (x4 & @intCast(u64, 0xff)));
1312		const x6: u64 = (x4 >> 8);
1313		const x7: u8 = @intCast(u8, (x6 & @intCast(u64, 0xff)));
1314		const x8: u64 = (x6 >> 8);
1315		const x9: u8 = @intCast(u8, (x8 & @intCast(u64, 0xff)));
1316		const x10: u64 = (x8 >> 8);
1317		const x11: u8 = @intCast(u8, (x10 & @intCast(u64, 0xff)));
1318		const x12: u64 = (x10 >> 8);
1319		const x13: u8 = @intCast(u8, (x12 & @intCast(u64, 0xff)));
1320		const x14: u64 = (x12 >> 8);
1321		const x15: u8 = @intCast(u8, (x14 & @intCast(u64, 0xff)));
1322		const x16: u64 = (x14 >> 8);
1323		const x17: u8 = @intCast(u8, (x16 & @intCast(u64, 0xff)));
1324		const x18: u8 = @intCast(u8, (x16 >> 8));
1325		const x19: u8 = @intCast(u8, (x3 & @intCast(u64, 0xff)));
1326		const x20: u64 = (x3 >> 8);
1327		const x21: u8 = @intCast(u8, (x20 & @intCast(u64, 0xff)));
1328		const x22: u64 = (x20 >> 8);
1329		const x23: u8 = @intCast(u8, (x22 & @intCast(u64, 0xff)));
1330		const x24: u64 = (x22 >> 8);
1331		const x25: u8 = @intCast(u8, (x24 & @intCast(u64, 0xff)));
1332		const x26: u64 = (x24 >> 8);
1333		const x27: u8 = @intCast(u8, (x26 & @intCast(u64, 0xff)));
1334		const x28: u64 = (x26 >> 8);
1335		const x29: u8 = @intCast(u8, (x28 & @intCast(u64, 0xff)));
1336		const x30: u64 = (x28 >> 8);
1337		const x31: u8 = @intCast(u8, (x30 & @intCast(u64, 0xff)));
1338		const x32: u8 = @intCast(u8, (x30 >> 8));
1339		const x33: u8 = @intCast(u8, (x2 & @intCast(u64, 0xff)));
1340		const x34: u64 = (x2 >> 8);
1341		const x35: u8 = @intCast(u8, (x34 & @intCast(u64, 0xff)));
1342		const x36: u64 = (x34 >> 8);
1343		const x37: u8 = @intCast(u8, (x36 & @intCast(u64, 0xff)));
1344		const x38: u64 = (x36 >> 8);
1345		const x39: u8 = @intCast(u8, (x38 & @intCast(u64, 0xff)));
1346		const x40: u64 = (x38 >> 8);
1347		const x41: u8 = @intCast(u8, (x40 & @intCast(u64, 0xff)));
1348		const x42: u64 = (x40 >> 8);
1349		const x43: u8 = @intCast(u8, (x42 & @intCast(u64, 0xff)));
1350		const x44: u64 = (x42 >> 8);
1351		const x45: u8 = @intCast(u8, (x44 & @intCast(u64, 0xff)));
1352		const x46: u8 = @intCast(u8, (x44 >> 8));
1353		const x47: u8 = @intCast(u8, (x1 & @intCast(u64, 0xff)));
1354		const x48: u64 = (x1 >> 8);
1355		const x49: u8 = @intCast(u8, (x48 & @intCast(u64, 0xff)));
1356		const x50: u64 = (x48 >> 8);
1357		const x51: u8 = @intCast(u8, (x50 & @intCast(u64, 0xff)));
1358		const x52: u64 = (x50 >> 8);
1359		const x53: u8 = @intCast(u8, (x52 & @intCast(u64, 0xff)));
1360		const x54: u64 = (x52 >> 8);
1361		const x55: u8 = @intCast(u8, (x54 & @intCast(u64, 0xff)));
1362		const x56: u64 = (x54 >> 8);
1363		const x57: u8 = @intCast(u8, (x56 & @intCast(u64, 0xff)));
1364		const x58: u64 = (x56 >> 8);
1365		const x59: u8 = @intCast(u8, (x58 & @intCast(u64, 0xff)));
1366		const x60: u8 = @intCast(u8, (x58 >> 8));
	1332	pub fn toBytes(out1: *[32]u8, arg1: [4]u64) void {
	1333	@setRuntimeSafety(mode == .Debug);
	1334
	1335	const x1 = (arg1[3]);
	1336	const x2 = (arg1[2]);
	1337	const x3 = (arg1[1]);
	1338	const x4 = (arg1[0]);
	1339	const x5 = cast(u8, (x4 & cast(u64, 0xff)));
	1340	const x6 = (x4 >> 8);
	1341	const x7 = cast(u8, (x6 & cast(u64, 0xff)));
	1342	const x8 = (x6 >> 8);
	1343	const x9 = cast(u8, (x8 & cast(u64, 0xff)));
	1344	const x10 = (x8 >> 8);
	1345	const x11 = cast(u8, (x10 & cast(u64, 0xff)));
	1346	const x12 = (x10 >> 8);
	1347	const x13 = cast(u8, (x12 & cast(u64, 0xff)));
	1348	const x14 = (x12 >> 8);
	1349	const x15 = cast(u8, (x14 & cast(u64, 0xff)));
	1350	const x16 = (x14 >> 8);
	1351	const x17 = cast(u8, (x16 & cast(u64, 0xff)));
	1352	const x18 = cast(u8, (x16 >> 8));
	1353	const x19 = cast(u8, (x3 & cast(u64, 0xff)));
	1354	const x20 = (x3 >> 8);
	1355	const x21 = cast(u8, (x20 & cast(u64, 0xff)));
	1356	const x22 = (x20 >> 8);
	1357	const x23 = cast(u8, (x22 & cast(u64, 0xff)));
	1358	const x24 = (x22 >> 8);
	1359	const x25 = cast(u8, (x24 & cast(u64, 0xff)));
	1360	const x26 = (x24 >> 8);
	1361	const x27 = cast(u8, (x26 & cast(u64, 0xff)));
	1362	const x28 = (x26 >> 8);
	1363	const x29 = cast(u8, (x28 & cast(u64, 0xff)));
	1364	const x30 = (x28 >> 8);
	1365	const x31 = cast(u8, (x30 & cast(u64, 0xff)));
	1366	const x32 = cast(u8, (x30 >> 8));
	1367	const x33 = cast(u8, (x2 & cast(u64, 0xff)));
	1368	const x34 = (x2 >> 8);
	1369	const x35 = cast(u8, (x34 & cast(u64, 0xff)));
	1370	const x36 = (x34 >> 8);
	1371	const x37 = cast(u8, (x36 & cast(u64, 0xff)));
	1372	const x38 = (x36 >> 8);
	1373	const x39 = cast(u8, (x38 & cast(u64, 0xff)));
	1374	const x40 = (x38 >> 8);
	1375	const x41 = cast(u8, (x40 & cast(u64, 0xff)));
	1376	const x42 = (x40 >> 8);
	1377	const x43 = cast(u8, (x42 & cast(u64, 0xff)));
	1378	const x44 = (x42 >> 8);
	1379	const x45 = cast(u8, (x44 & cast(u64, 0xff)));
	1380	const x46 = cast(u8, (x44 >> 8));
	1381	const x47 = cast(u8, (x1 & cast(u64, 0xff)));
	1382	const x48 = (x1 >> 8);
	1383	const x49 = cast(u8, (x48 & cast(u64, 0xff)));
	1384	const x50 = (x48 >> 8);
	1385	const x51 = cast(u8, (x50 & cast(u64, 0xff)));
	1386	const x52 = (x50 >> 8);
	1387	const x53 = cast(u8, (x52 & cast(u64, 0xff)));
	1388	const x54 = (x52 >> 8);
	1389	const x55 = cast(u8, (x54 & cast(u64, 0xff)));
	1390	const x56 = (x54 >> 8);
	1391	const x57 = cast(u8, (x56 & cast(u64, 0xff)));
	1392	const x58 = (x56 >> 8);
	1393	const x59 = cast(u8, (x58 & cast(u64, 0xff)));
	1394	const x60 = cast(u8, (x58 >> 8));
1367	1395	out1[0] = x5;
1368	1396	out1[1] = x7;
1369	1397	out1[2] = x9;
...	...	@@ -1398,7 +1426,7 @@ pub fn p256ToBytes(out1: *[32]u8, arg1: Limbs) void {
1398	1426	out1[31] = x60;
1399	1427	}
1400	1428
1401		/// The function p256FromBytes deserializes a field element NOT in the Montgomery domain from bytes in little-endian order.
	1429	/// The function fromBytes deserializes a field element NOT in the Montgomery domain from bytes in little-endian order.
1402	1430	/// Preconditions:
1403	1431	/// 0 ≤ bytes_eval arg1 < m
1404	1432	/// Postconditions:
...	...	@@ -1409,74 +1437,76 @@ pub fn p256ToBytes(out1: *[32]u8, arg1: Limbs) void {
1409	1437	/// arg1: [[0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff]]
1410	1438	/// Output Bounds:
1411	1439	/// out1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
1412		pub fn p256FromBytes(out1: *Limbs, arg1: [32]u8) void {
1413		const x1: u64 = (@intCast(u64, (arg1[31])) << 56);
1414		const x2: u64 = (@intCast(u64, (arg1[30])) << 48);
1415		const x3: u64 = (@intCast(u64, (arg1[29])) << 40);
1416		const x4: u64 = (@intCast(u64, (arg1[28])) << 32);
1417		const x5: u64 = (@intCast(u64, (arg1[27])) << 24);
1418		const x6: u64 = (@intCast(u64, (arg1[26])) << 16);
1419		const x7: u64 = (@intCast(u64, (arg1[25])) << 8);
1420		const x8: u8 = (arg1[24]);
1421		const x9: u64 = (@intCast(u64, (arg1[23])) << 56);
1422		const x10: u64 = (@intCast(u64, (arg1[22])) << 48);
1423		const x11: u64 = (@intCast(u64, (arg1[21])) << 40);
1424		const x12: u64 = (@intCast(u64, (arg1[20])) << 32);
1425		const x13: u64 = (@intCast(u64, (arg1[19])) << 24);
1426		const x14: u64 = (@intCast(u64, (arg1[18])) << 16);
1427		const x15: u64 = (@intCast(u64, (arg1[17])) << 8);
1428		const x16: u8 = (arg1[16]);
1429		const x17: u64 = (@intCast(u64, (arg1[15])) << 56);
1430		const x18: u64 = (@intCast(u64, (arg1[14])) << 48);
1431		const x19: u64 = (@intCast(u64, (arg1[13])) << 40);
1432		const x20: u64 = (@intCast(u64, (arg1[12])) << 32);
1433		const x21: u64 = (@intCast(u64, (arg1[11])) << 24);
1434		const x22: u64 = (@intCast(u64, (arg1[10])) << 16);
1435		const x23: u64 = (@intCast(u64, (arg1[9])) << 8);
1436		const x24: u8 = (arg1[8]);
1437		const x25: u64 = (@intCast(u64, (arg1[7])) << 56);
1438		const x26: u64 = (@intCast(u64, (arg1[6])) << 48);
1439		const x27: u64 = (@intCast(u64, (arg1[5])) << 40);
1440		const x28: u64 = (@intCast(u64, (arg1[4])) << 32);
1441		const x29: u64 = (@intCast(u64, (arg1[3])) << 24);
1442		const x30: u64 = (@intCast(u64, (arg1[2])) << 16);
1443		const x31: u64 = (@intCast(u64, (arg1[1])) << 8);
1444		const x32: u8 = (arg1[0]);
1445		const x33: u64 = (x31 + @intCast(u64, x32));
1446		const x34: u64 = (x30 + x33);
1447		const x35: u64 = (x29 + x34);
1448		const x36: u64 = (x28 + x35);
1449		const x37: u64 = (x27 + x36);
1450		const x38: u64 = (x26 + x37);
1451		const x39: u64 = (x25 + x38);
1452		const x40: u64 = (x23 + @intCast(u64, x24));
1453		const x41: u64 = (x22 + x40);
1454		const x42: u64 = (x21 + x41);
1455		const x43: u64 = (x20 + x42);
1456		const x44: u64 = (x19 + x43);
1457		const x45: u64 = (x18 + x44);
1458		const x46: u64 = (x17 + x45);
1459		const x47: u64 = (x15 + @intCast(u64, x16));
1460		const x48: u64 = (x14 + x47);
1461		const x49: u64 = (x13 + x48);
1462		const x50: u64 = (x12 + x49);
1463		const x51: u64 = (x11 + x50);
1464		const x52: u64 = (x10 + x51);
1465		const x53: u64 = (x9 + x52);
1466		const x54: u64 = (x7 + @intCast(u64, x8));
1467		const x55: u64 = (x6 + x54);
1468		const x56: u64 = (x5 + x55);
1469		const x57: u64 = (x4 + x56);
1470		const x58: u64 = (x3 + x57);
1471		const x59: u64 = (x2 + x58);
1472		const x60: u64 = (x1 + x59);
	1440	pub fn fromBytes(out1: *[4]u64, arg1: [32]u8) void {
	1441	@setRuntimeSafety(mode == .Debug);
	1442
	1443	const x1 = (cast(u64, (arg1[31])) << 56);
	1444	const x2 = (cast(u64, (arg1[30])) << 48);
	1445	const x3 = (cast(u64, (arg1[29])) << 40);
	1446	const x4 = (cast(u64, (arg1[28])) << 32);
	1447	const x5 = (cast(u64, (arg1[27])) << 24);
	1448	const x6 = (cast(u64, (arg1[26])) << 16);
	1449	const x7 = (cast(u64, (arg1[25])) << 8);
	1450	const x8 = (arg1[24]);
	1451	const x9 = (cast(u64, (arg1[23])) << 56);
	1452	const x10 = (cast(u64, (arg1[22])) << 48);
	1453	const x11 = (cast(u64, (arg1[21])) << 40);
	1454	const x12 = (cast(u64, (arg1[20])) << 32);
	1455	const x13 = (cast(u64, (arg1[19])) << 24);
	1456	const x14 = (cast(u64, (arg1[18])) << 16);
	1457	const x15 = (cast(u64, (arg1[17])) << 8);
	1458	const x16 = (arg1[16]);
	1459	const x17 = (cast(u64, (arg1[15])) << 56);
	1460	const x18 = (cast(u64, (arg1[14])) << 48);
	1461	const x19 = (cast(u64, (arg1[13])) << 40);
	1462	const x20 = (cast(u64, (arg1[12])) << 32);
	1463	const x21 = (cast(u64, (arg1[11])) << 24);
	1464	const x22 = (cast(u64, (arg1[10])) << 16);
	1465	const x23 = (cast(u64, (arg1[9])) << 8);
	1466	const x24 = (arg1[8]);
	1467	const x25 = (cast(u64, (arg1[7])) << 56);
	1468	const x26 = (cast(u64, (arg1[6])) << 48);
	1469	const x27 = (cast(u64, (arg1[5])) << 40);
	1470	const x28 = (cast(u64, (arg1[4])) << 32);
	1471	const x29 = (cast(u64, (arg1[3])) << 24);
	1472	const x30 = (cast(u64, (arg1[2])) << 16);
	1473	const x31 = (cast(u64, (arg1[1])) << 8);
	1474	const x32 = (arg1[0]);
	1475	const x33 = (x31 + cast(u64, x32));
	1476	const x34 = (x30 + x33);
	1477	const x35 = (x29 + x34);
	1478	const x36 = (x28 + x35);
	1479	const x37 = (x27 + x36);
	1480	const x38 = (x26 + x37);
	1481	const x39 = (x25 + x38);
	1482	const x40 = (x23 + cast(u64, x24));
	1483	const x41 = (x22 + x40);
	1484	const x42 = (x21 + x41);
	1485	const x43 = (x20 + x42);
	1486	const x44 = (x19 + x43);
	1487	const x45 = (x18 + x44);
	1488	const x46 = (x17 + x45);
	1489	const x47 = (x15 + cast(u64, x16));
	1490	const x48 = (x14 + x47);
	1491	const x49 = (x13 + x48);
	1492	const x50 = (x12 + x49);
	1493	const x51 = (x11 + x50);
	1494	const x52 = (x10 + x51);
	1495	const x53 = (x9 + x52);
	1496	const x54 = (x7 + cast(u64, x8));
	1497	const x55 = (x6 + x54);
	1498	const x56 = (x5 + x55);
	1499	const x57 = (x4 + x56);
	1500	const x58 = (x3 + x57);
	1501	const x59 = (x2 + x58);
	1502	const x60 = (x1 + x59);
1473	1503	out1[0] = x39;
1474	1504	out1[1] = x46;
1475	1505	out1[2] = x53;
1476	1506	out1[3] = x60;
1477	1507	}
1478	1508
1479		/// The function p256SetOne returns the field element one in the Montgomery domain.
	1509	/// The function setOne returns the field element one in the Montgomery domain.
1480	1510	/// Postconditions:
1481	1511	/// eval (from_montgomery out1) mod m = 1 mod m
1482	1512	/// 0 ≤ eval out1 < m
...	...	@@ -1484,14 +1514,16 @@ pub fn p256FromBytes(out1: *Limbs, arg1: [32]u8) void {
1484	1514	/// Input Bounds:
1485	1515	/// Output Bounds:
1486	1516	/// out1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
1487		pub fn p256SetOne(out1: *Limbs) void {
1488		out1[0] = @intCast(u64, 0x1);
	1517	pub fn setOne(out1: *[4]u64) void {
	1518	@setRuntimeSafety(mode == .Debug);
	1519
	1520	out1[0] = cast(u64, 0x1);
1489	1521	out1[1] = 0xffffffff00000000;
1490	1522	out1[2] = 0xffffffffffffffff;
1491	1523	out1[3] = 0xfffffffe;
1492	1524	}
1493	1525
1494		/// The function p256Msat returns the saturated representation of the prime modulus.
	1526	/// The function msat returns the saturated representation of the prime modulus.
1495	1527	/// Postconditions:
1496	1528	/// twos_complement_eval out1 = m
1497	1529	/// 0 ≤ eval out1 < m
...	...	@@ -1499,15 +1531,17 @@ pub fn p256SetOne(out1: *Limbs) void {
1499	1531	/// Input Bounds:
1500	1532	/// Output Bounds:
1501	1533	/// out1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
1502		pub fn p256Msat(out1: *[5]u64) void {
	1534	pub fn msat(out1: *[5]u64) void {
	1535	@setRuntimeSafety(mode == .Debug);
	1536
1503	1537	out1[0] = 0xffffffffffffffff;
1504	1538	out1[1] = 0xffffffff;
1505		out1[2] = @intCast(u64, 0x0);
	1539	out1[2] = cast(u64, 0x0);
1506	1540	out1[3] = 0xffffffff00000001;
1507		out1[4] = @intCast(u64, 0x0);
	1541	out1[4] = cast(u64, 0x0);
1508	1542	}
1509	1543
1510		/// The function p256Divstep computes a divstep.
	1544	/// The function divstep computes a divstep.
1511	1545	/// Preconditions:
1512	1546	/// 0 ≤ eval arg4 < m
1513	1547	/// 0 ≤ eval arg5 < m
...	...	@@ -1534,209 +1568,211 @@ pub fn p256Msat(out1: *[5]u64) void {
1534	1568	/// out3: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
1535	1569	/// out4: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
1536	1570	/// out5: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
1537		pub fn p256Divstep(out1: u64, out2: [5]u64, out3: [5]u64, out4: Limbs, out5: *Limbs, arg1: u64, arg2: [5]u64, arg3: [5]u64, arg4: Limbs, arg5: Limbs) void {
	1571	pub fn divstep(out1: u64, out2: [5]u64, out3: [5]u64, out4: [4]u64, out5: *[4]u64, arg1: u64, arg2: [5]u64, arg3: [5]u64, arg4: [4]u64, arg5: [4]u64) void {
	1572	@setRuntimeSafety(mode == .Debug);
	1573
1538	1574	var x1: u64 = undefined;
1539	1575	var x2: u1 = undefined;
1540		p256AddcarryxU64(&x1, &x2, 0x0, (~arg1), @intCast(u64, 0x1));
1541		const x3: u1 = (@intCast(u1, (x1 >> 63)) & @intCast(u1, ((arg3[0]) & @intCast(u64, 0x1))));
	1576	addcarryxU64(&x1, &x2, 0x0, (~arg1), cast(u64, 0x1));
	1577	const x3 = (cast(u1, (x1 >> 63)) & cast(u1, ((arg3[0]) & cast(u64, 0x1))));
1542	1578	var x4: u64 = undefined;
1543	1579	var x5: u1 = undefined;
1544		p256AddcarryxU64(&x4, &x5, 0x0, (~arg1), @intCast(u64, 0x1));
	1580	addcarryxU64(&x4, &x5, 0x0, (~arg1), cast(u64, 0x1));
1545	1581	var x6: u64 = undefined;
1546		p256CmovznzU64(&x6, x3, arg1, x4);
	1582	cmovznzU64(&x6, x3, arg1, x4);
1547	1583	var x7: u64 = undefined;
1548		p256CmovznzU64(&x7, x3, (arg2[0]), (arg3[0]));
	1584	cmovznzU64(&x7, x3, (arg2[0]), (arg3[0]));
1549	1585	var x8: u64 = undefined;
1550		p256CmovznzU64(&x8, x3, (arg2[1]), (arg3[1]));
	1586	cmovznzU64(&x8, x3, (arg2[1]), (arg3[1]));
1551	1587	var x9: u64 = undefined;
1552		p256CmovznzU64(&x9, x3, (arg2[2]), (arg3[2]));
	1588	cmovznzU64(&x9, x3, (arg2[2]), (arg3[2]));
1553	1589	var x10: u64 = undefined;
1554		p256CmovznzU64(&x10, x3, (arg2[3]), (arg3[3]));
	1590	cmovznzU64(&x10, x3, (arg2[3]), (arg3[3]));
1555	1591	var x11: u64 = undefined;
1556		p256CmovznzU64(&x11, x3, (arg2[4]), (arg3[4]));
	1592	cmovznzU64(&x11, x3, (arg2[4]), (arg3[4]));
1557	1593	var x12: u64 = undefined;
1558	1594	var x13: u1 = undefined;
1559		p256AddcarryxU64(&x12, &x13, 0x0, @intCast(u64, 0x1), (~(arg2[0])));
	1595	addcarryxU64(&x12, &x13, 0x0, cast(u64, 0x1), (~(arg2[0])));
1560	1596	var x14: u64 = undefined;
1561	1597	var x15: u1 = undefined;
1562		p256AddcarryxU64(&x14, &x15, x13, @intCast(u64, 0x0), (~(arg2[1])));
	1598	addcarryxU64(&x14, &x15, x13, cast(u64, 0x0), (~(arg2[1])));
1563	1599	var x16: u64 = undefined;
1564	1600	var x17: u1 = undefined;
1565		p256AddcarryxU64(&x16, &x17, x15, @intCast(u64, 0x0), (~(arg2[2])));
	1601	addcarryxU64(&x16, &x17, x15, cast(u64, 0x0), (~(arg2[2])));
1566	1602	var x18: u64 = undefined;
1567	1603	var x19: u1 = undefined;
1568		p256AddcarryxU64(&x18, &x19, x17, @intCast(u64, 0x0), (~(arg2[3])));
	1604	addcarryxU64(&x18, &x19, x17, cast(u64, 0x0), (~(arg2[3])));
1569	1605	var x20: u64 = undefined;
1570	1606	var x21: u1 = undefined;
1571		p256AddcarryxU64(&x20, &x21, x19, @intCast(u64, 0x0), (~(arg2[4])));
	1607	addcarryxU64(&x20, &x21, x19, cast(u64, 0x0), (~(arg2[4])));
1572	1608	var x22: u64 = undefined;
1573		p256CmovznzU64(&x22, x3, (arg3[0]), x12);
	1609	cmovznzU64(&x22, x3, (arg3[0]), x12);
1574	1610	var x23: u64 = undefined;
1575		p256CmovznzU64(&x23, x3, (arg3[1]), x14);
	1611	cmovznzU64(&x23, x3, (arg3[1]), x14);
1576	1612	var x24: u64 = undefined;
1577		p256CmovznzU64(&x24, x3, (arg3[2]), x16);
	1613	cmovznzU64(&x24, x3, (arg3[2]), x16);
1578	1614	var x25: u64 = undefined;
1579		p256CmovznzU64(&x25, x3, (arg3[3]), x18);
	1615	cmovznzU64(&x25, x3, (arg3[3]), x18);
1580	1616	var x26: u64 = undefined;
1581		p256CmovznzU64(&x26, x3, (arg3[4]), x20);
	1617	cmovznzU64(&x26, x3, (arg3[4]), x20);
1582	1618	var x27: u64 = undefined;
1583		p256CmovznzU64(&x27, x3, (arg4[0]), (arg5[0]));
	1619	cmovznzU64(&x27, x3, (arg4[0]), (arg5[0]));
1584	1620	var x28: u64 = undefined;
1585		p256CmovznzU64(&x28, x3, (arg4[1]), (arg5[1]));
	1621	cmovznzU64(&x28, x3, (arg4[1]), (arg5[1]));
1586	1622	var x29: u64 = undefined;
1587		p256CmovznzU64(&x29, x3, (arg4[2]), (arg5[2]));
	1623	cmovznzU64(&x29, x3, (arg4[2]), (arg5[2]));
1588	1624	var x30: u64 = undefined;
1589		p256CmovznzU64(&x30, x3, (arg4[3]), (arg5[3]));
	1625	cmovznzU64(&x30, x3, (arg4[3]), (arg5[3]));
1590	1626	var x31: u64 = undefined;
1591	1627	var x32: u1 = undefined;
1592		p256AddcarryxU64(&x31, &x32, 0x0, x27, x27);
	1628	addcarryxU64(&x31, &x32, 0x0, x27, x27);
1593	1629	var x33: u64 = undefined;
1594	1630	var x34: u1 = undefined;
1595		p256AddcarryxU64(&x33, &x34, x32, x28, x28);
	1631	addcarryxU64(&x33, &x34, x32, x28, x28);
1596	1632	var x35: u64 = undefined;
1597	1633	var x36: u1 = undefined;
1598		p256AddcarryxU64(&x35, &x36, x34, x29, x29);
	1634	addcarryxU64(&x35, &x36, x34, x29, x29);
1599	1635	var x37: u64 = undefined;
1600	1636	var x38: u1 = undefined;
1601		p256AddcarryxU64(&x37, &x38, x36, x30, x30);
	1637	addcarryxU64(&x37, &x38, x36, x30, x30);
1602	1638	var x39: u64 = undefined;
1603	1639	var x40: u1 = undefined;
1604		p256SubborrowxU64(&x39, &x40, 0x0, x31, 0xffffffffffffffff);
	1640	subborrowxU64(&x39, &x40, 0x0, x31, 0xffffffffffffffff);
1605	1641	var x41: u64 = undefined;
1606	1642	var x42: u1 = undefined;
1607		p256SubborrowxU64(&x41, &x42, x40, x33, 0xffffffff);
	1643	subborrowxU64(&x41, &x42, x40, x33, 0xffffffff);
1608	1644	var x43: u64 = undefined;
1609	1645	var x44: u1 = undefined;
1610		p256SubborrowxU64(&x43, &x44, x42, x35, @intCast(u64, 0x0));
	1646	subborrowxU64(&x43, &x44, x42, x35, cast(u64, 0x0));
1611	1647	var x45: u64 = undefined;
1612	1648	var x46: u1 = undefined;
1613		p256SubborrowxU64(&x45, &x46, x44, x37, 0xffffffff00000001);
	1649	subborrowxU64(&x45, &x46, x44, x37, 0xffffffff00000001);
1614	1650	var x47: u64 = undefined;
1615	1651	var x48: u1 = undefined;
1616		p256SubborrowxU64(&x47, &x48, x46, @intCast(u64, x38), @intCast(u64, 0x0));
1617		const x49: u64 = (arg4[3]);
1618		const x50: u64 = (arg4[2]);
1619		const x51: u64 = (arg4[1]);
1620		const x52: u64 = (arg4[0]);
	1652	subborrowxU64(&x47, &x48, x46, cast(u64, x38), cast(u64, 0x0));
	1653	const x49 = (arg4[3]);
	1654	const x50 = (arg4[2]);
	1655	const x51 = (arg4[1]);
	1656	const x52 = (arg4[0]);
1621	1657	var x53: u64 = undefined;
1622	1658	var x54: u1 = undefined;
1623		p256SubborrowxU64(&x53, &x54, 0x0, @intCast(u64, 0x0), x52);
	1659	subborrowxU64(&x53, &x54, 0x0, cast(u64, 0x0), x52);
1624	1660	var x55: u64 = undefined;
1625	1661	var x56: u1 = undefined;
1626		p256SubborrowxU64(&x55, &x56, x54, @intCast(u64, 0x0), x51);
	1662	subborrowxU64(&x55, &x56, x54, cast(u64, 0x0), x51);
1627	1663	var x57: u64 = undefined;
1628	1664	var x58: u1 = undefined;
1629		p256SubborrowxU64(&x57, &x58, x56, @intCast(u64, 0x0), x50);
	1665	subborrowxU64(&x57, &x58, x56, cast(u64, 0x0), x50);
1630	1666	var x59: u64 = undefined;
1631	1667	var x60: u1 = undefined;
1632		p256SubborrowxU64(&x59, &x60, x58, @intCast(u64, 0x0), x49);
	1668	subborrowxU64(&x59, &x60, x58, cast(u64, 0x0), x49);
1633	1669	var x61: u64 = undefined;
1634		p256CmovznzU64(&x61, x60, @intCast(u64, 0x0), 0xffffffffffffffff);
	1670	cmovznzU64(&x61, x60, cast(u64, 0x0), 0xffffffffffffffff);
1635	1671	var x62: u64 = undefined;
1636	1672	var x63: u1 = undefined;
1637		p256AddcarryxU64(&x62, &x63, 0x0, x53, x61);
	1673	addcarryxU64(&x62, &x63, 0x0, x53, x61);
1638	1674	var x64: u64 = undefined;
1639	1675	var x65: u1 = undefined;
1640		p256AddcarryxU64(&x64, &x65, x63, x55, (x61 & 0xffffffff));
	1676	addcarryxU64(&x64, &x65, x63, x55, (x61 & 0xffffffff));
1641	1677	var x66: u64 = undefined;
1642	1678	var x67: u1 = undefined;
1643		p256AddcarryxU64(&x66, &x67, x65, x57, @intCast(u64, 0x0));
	1679	addcarryxU64(&x66, &x67, x65, x57, cast(u64, 0x0));
1644	1680	var x68: u64 = undefined;
1645	1681	var x69: u1 = undefined;
1646		p256AddcarryxU64(&x68, &x69, x67, x59, (x61 & 0xffffffff00000001));
	1682	addcarryxU64(&x68, &x69, x67, x59, (x61 & 0xffffffff00000001));
1647	1683	var x70: u64 = undefined;
1648		p256CmovznzU64(&x70, x3, (arg5[0]), x62);
	1684	cmovznzU64(&x70, x3, (arg5[0]), x62);
1649	1685	var x71: u64 = undefined;
1650		p256CmovznzU64(&x71, x3, (arg5[1]), x64);
	1686	cmovznzU64(&x71, x3, (arg5[1]), x64);
1651	1687	var x72: u64 = undefined;
1652		p256CmovznzU64(&x72, x3, (arg5[2]), x66);
	1688	cmovznzU64(&x72, x3, (arg5[2]), x66);
1653	1689	var x73: u64 = undefined;
1654		p256CmovznzU64(&x73, x3, (arg5[3]), x68);
1655		const x74: u1 = @intCast(u1, (x22 & @intCast(u64, 0x1)));
	1690	cmovznzU64(&x73, x3, (arg5[3]), x68);
	1691	const x74 = cast(u1, (x22 & cast(u64, 0x1)));
1656	1692	var x75: u64 = undefined;
1657		p256CmovznzU64(&x75, x74, @intCast(u64, 0x0), x7);
	1693	cmovznzU64(&x75, x74, cast(u64, 0x0), x7);
1658	1694	var x76: u64 = undefined;
1659		p256CmovznzU64(&x76, x74, @intCast(u64, 0x0), x8);
	1695	cmovznzU64(&x76, x74, cast(u64, 0x0), x8);
1660	1696	var x77: u64 = undefined;
1661		p256CmovznzU64(&x77, x74, @intCast(u64, 0x0), x9);
	1697	cmovznzU64(&x77, x74, cast(u64, 0x0), x9);
1662	1698	var x78: u64 = undefined;
1663		p256CmovznzU64(&x78, x74, @intCast(u64, 0x0), x10);
	1699	cmovznzU64(&x78, x74, cast(u64, 0x0), x10);
1664	1700	var x79: u64 = undefined;
1665		p256CmovznzU64(&x79, x74, @intCast(u64, 0x0), x11);
	1701	cmovznzU64(&x79, x74, cast(u64, 0x0), x11);
1666	1702	var x80: u64 = undefined;
1667	1703	var x81: u1 = undefined;
1668		p256AddcarryxU64(&x80, &x81, 0x0, x22, x75);
	1704	addcarryxU64(&x80, &x81, 0x0, x22, x75);
1669	1705	var x82: u64 = undefined;
1670	1706	var x83: u1 = undefined;
1671		p256AddcarryxU64(&x82, &x83, x81, x23, x76);
	1707	addcarryxU64(&x82, &x83, x81, x23, x76);
1672	1708	var x84: u64 = undefined;
1673	1709	var x85: u1 = undefined;
1674		p256AddcarryxU64(&x84, &x85, x83, x24, x77);
	1710	addcarryxU64(&x84, &x85, x83, x24, x77);
1675	1711	var x86: u64 = undefined;
1676	1712	var x87: u1 = undefined;
1677		p256AddcarryxU64(&x86, &x87, x85, x25, x78);
	1713	addcarryxU64(&x86, &x87, x85, x25, x78);
1678	1714	var x88: u64 = undefined;
1679	1715	var x89: u1 = undefined;
1680		p256AddcarryxU64(&x88, &x89, x87, x26, x79);
	1716	addcarryxU64(&x88, &x89, x87, x26, x79);
1681	1717	var x90: u64 = undefined;
1682		p256CmovznzU64(&x90, x74, @intCast(u64, 0x0), x27);
	1718	cmovznzU64(&x90, x74, cast(u64, 0x0), x27);
1683	1719	var x91: u64 = undefined;
1684		p256CmovznzU64(&x91, x74, @intCast(u64, 0x0), x28);
	1720	cmovznzU64(&x91, x74, cast(u64, 0x0), x28);
1685	1721	var x92: u64 = undefined;
1686		p256CmovznzU64(&x92, x74, @intCast(u64, 0x0), x29);
	1722	cmovznzU64(&x92, x74, cast(u64, 0x0), x29);
1687	1723	var x93: u64 = undefined;
1688		p256CmovznzU64(&x93, x74, @intCast(u64, 0x0), x30);
	1724	cmovznzU64(&x93, x74, cast(u64, 0x0), x30);
1689	1725	var x94: u64 = undefined;
1690	1726	var x95: u1 = undefined;
1691		p256AddcarryxU64(&x94, &x95, 0x0, x70, x90);
	1727	addcarryxU64(&x94, &x95, 0x0, x70, x90);
1692	1728	var x96: u64 = undefined;
1693	1729	var x97: u1 = undefined;
1694		p256AddcarryxU64(&x96, &x97, x95, x71, x91);
	1730	addcarryxU64(&x96, &x97, x95, x71, x91);
1695	1731	var x98: u64 = undefined;
1696	1732	var x99: u1 = undefined;
1697		p256AddcarryxU64(&x98, &x99, x97, x72, x92);
	1733	addcarryxU64(&x98, &x99, x97, x72, x92);
1698	1734	var x100: u64 = undefined;
1699	1735	var x101: u1 = undefined;
1700		p256AddcarryxU64(&x100, &x101, x99, x73, x93);
	1736	addcarryxU64(&x100, &x101, x99, x73, x93);
1701	1737	var x102: u64 = undefined;
1702	1738	var x103: u1 = undefined;
1703		p256SubborrowxU64(&x102, &x103, 0x0, x94, 0xffffffffffffffff);
	1739	subborrowxU64(&x102, &x103, 0x0, x94, 0xffffffffffffffff);
1704	1740	var x104: u64 = undefined;
1705	1741	var x105: u1 = undefined;
1706		p256SubborrowxU64(&x104, &x105, x103, x96, 0xffffffff);
	1742	subborrowxU64(&x104, &x105, x103, x96, 0xffffffff);
1707	1743	var x106: u64 = undefined;
1708	1744	var x107: u1 = undefined;
1709		p256SubborrowxU64(&x106, &x107, x105, x98, @intCast(u64, 0x0));
	1745	subborrowxU64(&x106, &x107, x105, x98, cast(u64, 0x0));
1710	1746	var x108: u64 = undefined;
1711	1747	var x109: u1 = undefined;
1712		p256SubborrowxU64(&x108, &x109, x107, x100, 0xffffffff00000001);
	1748	subborrowxU64(&x108, &x109, x107, x100, 0xffffffff00000001);
1713	1749	var x110: u64 = undefined;
1714	1750	var x111: u1 = undefined;
1715		p256SubborrowxU64(&x110, &x111, x109, @intCast(u64, x101), @intCast(u64, 0x0));
	1751	subborrowxU64(&x110, &x111, x109, cast(u64, x101), cast(u64, 0x0));
1716	1752	var x112: u64 = undefined;
1717	1753	var x113: u1 = undefined;
1718		p256AddcarryxU64(&x112, &x113, 0x0, x6, @intCast(u64, 0x1));
1719		const x114: u64 = ((x80 >> 1) \| ((x82 << 63) & 0xffffffffffffffff));
1720		const x115: u64 = ((x82 >> 1) \| ((x84 << 63) & 0xffffffffffffffff));
1721		const x116: u64 = ((x84 >> 1) \| ((x86 << 63) & 0xffffffffffffffff));
1722		const x117: u64 = ((x86 >> 1) \| ((x88 << 63) & 0xffffffffffffffff));
1723		const x118: u64 = ((x88 & 0x8000000000000000) \| (x88 >> 1));
	1754	addcarryxU64(&x112, &x113, 0x0, x6, cast(u64, 0x1));
	1755	const x114 = ((x80 >> 1) \| ((x82 << 63) & 0xffffffffffffffff));
	1756	const x115 = ((x82 >> 1) \| ((x84 << 63) & 0xffffffffffffffff));
	1757	const x116 = ((x84 >> 1) \| ((x86 << 63) & 0xffffffffffffffff));
	1758	const x117 = ((x86 >> 1) \| ((x88 << 63) & 0xffffffffffffffff));
	1759	const x118 = ((x88 & 0x8000000000000000) \| (x88 >> 1));
1724	1760	var x119: u64 = undefined;
1725		p256CmovznzU64(&x119, x48, x39, x31);
	1761	cmovznzU64(&x119, x48, x39, x31);
1726	1762	var x120: u64 = undefined;
1727		p256CmovznzU64(&x120, x48, x41, x33);
	1763	cmovznzU64(&x120, x48, x41, x33);
1728	1764	var x121: u64 = undefined;
1729		p256CmovznzU64(&x121, x48, x43, x35);
	1765	cmovznzU64(&x121, x48, x43, x35);
1730	1766	var x122: u64 = undefined;
1731		p256CmovznzU64(&x122, x48, x45, x37);
	1767	cmovznzU64(&x122, x48, x45, x37);
1732	1768	var x123: u64 = undefined;
1733		p256CmovznzU64(&x123, x111, x102, x94);
	1769	cmovznzU64(&x123, x111, x102, x94);
1734	1770	var x124: u64 = undefined;
1735		p256CmovznzU64(&x124, x111, x104, x96);
	1771	cmovznzU64(&x124, x111, x104, x96);
1736	1772	var x125: u64 = undefined;
1737		p256CmovznzU64(&x125, x111, x106, x98);
	1773	cmovznzU64(&x125, x111, x106, x98);
1738	1774	var x126: u64 = undefined;
1739		p256CmovznzU64(&x126, x111, x108, x100);
	1775	cmovznzU64(&x126, x111, x108, x100);
1740	1776	out1.* = x112;
1741	1777	out2[0] = x7;
1742	1778	out2[1] = x8;
...	...	@@ -1758,7 +1794,7 @@ pub fn p256Divstep(out1: u64, out2: [5]u64, out3: [5]u64, out4: Limbs, out5:
1758	1794	out5[3] = x126;
1759	1795	}
1760	1796
1761		/// The function p256DivstepPrecomp returns the precomputed value for Bernstein-Yang-inversion (in montgomery form).
	1797	/// The function divstepPrecomp returns the precomputed value for Bernstein-Yang-inversion (in montgomery form).
1762	1798	/// Postconditions:
1763	1799	/// eval (from_montgomery out1) = ⌊(m - 1) / 2⌋^(if (log2 m) + 1 < 46 then ⌊(49 * ((log2 m) + 1) + 80) / 17⌋ else ⌊(49 * ((log2 m) + 1) + 57) / 17⌋)
1764	1800	/// 0 ≤ eval out1 < m
...	...	@@ -1766,7 +1802,9 @@ pub fn p256Divstep(out1: u64, out2: [5]u64, out3: [5]u64, out4: Limbs, out5:
1766	1802	/// Input Bounds:
1767	1803	/// Output Bounds:
1768	1804	/// out1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
1769		pub fn p256DivstepPrecomp(out1: *Limbs) void {
	1805	pub fn divstepPrecomp(out1: *[4]u64) void {
	1806	@setRuntimeSafety(mode == .Debug);
	1807
1770	1808	out1[0] = 0x67ffffffb8000000;
1771	1809	out1[1] = 0xc000000038000000;
1772	1810	out1[2] = 0xd80000007fffffff;

lib/std/crypto/pcurves/p256/p256_scalar_64.zig created+2016

...	...	@@ -0,0 +1,2016 @@
	1	// Autogenerated: './src/ExtractionOCaml/word_by_word_montgomery' --lang Zig --internal-static --public-function-case camelCase --private-function-case camelCase --no-prefix-fiat --package-name p256-scalar '' 64 115792089210356248762697446949407573529996955224135760342422259061068512044369
	2	// curve description (via package name): p256-scalar
	3	// machine_wordsize = 64 (from "64")
	4	// requested operations: (all)
	5	// m = 0xffffffff00000000ffffffffffffffffbce6faada7179e84f3b9cac2fc632551 (from "115792089210356248762697446949407573529996955224135760342422259061068512044369")
	6	//
	7	// NOTE: In addition to the bounds specified above each function, all
	8	// functions synthesized for this Montgomery arithmetic require the
	9	// input to be strictly less than the prime modulus (m), and also
	10	// require the input to be in the unique saturated representation.
	11	// All functions also ensure that these two properties are true of
	12	// return values.
	13	//
	14	// Computed values:
	15	// eval z = z[0] + (z[1] << 64) + (z[2] << 128) + (z[3] << 192)
	16	// bytes_eval z = z[0] + (z[1] << 8) + (z[2] << 16) + (z[3] << 24) + (z[4] << 32) + (z[5] << 40) + (z[6] << 48) + (z[7] << 56) + (z[8] << 64) + (z[9] << 72) + (z[10] << 80) + (z[11] << 88) + (z[12] << 96) + (z[13] << 104) + (z[14] << 112) + (z[15] << 120) + (z[16] << 128) + (z[17] << 136) + (z[18] << 144) + (z[19] << 152) + (z[20] << 160) + (z[21] << 168) + (z[22] << 176) + (z[23] << 184) + (z[24] << 192) + (z[25] << 200) + (z[26] << 208) + (z[27] << 216) + (z[28] << 224) + (z[29] << 232) + (z[30] << 240) + (z[31] << 248)
	17	// twos_complement_eval z = let x1 := z[0] + (z[1] << 64) + (z[2] << 128) + (z[3] << 192) in
	18	// if x1 & (2^256-1) < 2^255 then x1 & (2^256-1) else (x1 & (2^256-1)) - 2^256
	19
	20	const std = @import("std");
	21	const cast = std.meta.cast;
	22	const mode = std.builtin.mode; // Checked arithmetic is disabled in non-debug modes to avoid side channels
	23
	24	pub const Limbs = [4]u64;
	25
	26	/// The function addcarryxU64 is an addition with carry.
	27	/// Postconditions:
	28	/// out1 = (arg1 + arg2 + arg3) mod 2^64
	29	/// out2 = ⌊(arg1 + arg2 + arg3) / 2^64⌋
	30	///
	31	/// Input Bounds:
	32	/// arg1: [0x0 ~> 0x1]
	33	/// arg2: [0x0 ~> 0xffffffffffffffff]
	34	/// arg3: [0x0 ~> 0xffffffffffffffff]
	35	/// Output Bounds:
	36	/// out1: [0x0 ~> 0xffffffffffffffff]
	37	/// out2: [0x0 ~> 0x1]
	38	fn addcarryxU64(out1: u64, out2: u1, arg1: u1, arg2: u64, arg3: u64) callconv(.Inline) void {
	39	@setRuntimeSafety(mode == .Debug);
	40
	41	var t: u64 = undefined;
	42	const carry1 = @addWithOverflow(u64, arg2, arg3, &t);
	43	const carry2 = @addWithOverflow(u64, t, arg1, out1);
	44	out2.* = @boolToInt(carry1) \| @boolToInt(carry2);
	45	}
	46
	47	/// The function subborrowxU64 is a subtraction with borrow.
	48	/// Postconditions:
	49	/// out1 = (-arg1 + arg2 + -arg3) mod 2^64
	50	/// out2 = -⌊(-arg1 + arg2 + -arg3) / 2^64⌋
	51	///
	52	/// Input Bounds:
	53	/// arg1: [0x0 ~> 0x1]
	54	/// arg2: [0x0 ~> 0xffffffffffffffff]
	55	/// arg3: [0x0 ~> 0xffffffffffffffff]
	56	/// Output Bounds:
	57	/// out1: [0x0 ~> 0xffffffffffffffff]
	58	/// out2: [0x0 ~> 0x1]
	59	fn subborrowxU64(out1: u64, out2: u1, arg1: u1, arg2: u64, arg3: u64) callconv(.Inline) void {
	60	@setRuntimeSafety(mode == .Debug);
	61
	62	var t: u64 = undefined;
	63	const carry1 = @subWithOverflow(u64, arg2, arg3, &t);
	64	const carry2 = @subWithOverflow(u64, t, arg1, out1);
	65	out2.* = @boolToInt(carry1) \| @boolToInt(carry2);
	66	}
	67
	68	/// The function mulxU64 is a multiplication, returning the full double-width result.
	69	/// Postconditions:
	70	/// out1 = (arg1 * arg2) mod 2^64
	71	/// out2 = ⌊arg1 * arg2 / 2^64⌋
	72	///
	73	/// Input Bounds:
	74	/// arg1: [0x0 ~> 0xffffffffffffffff]
	75	/// arg2: [0x0 ~> 0xffffffffffffffff]
	76	/// Output Bounds:
	77	/// out1: [0x0 ~> 0xffffffffffffffff]
	78	/// out2: [0x0 ~> 0xffffffffffffffff]
	79	fn mulxU64(out1: u64, out2: u64, arg1: u64, arg2: u64) callconv(.Inline) void {
	80	@setRuntimeSafety(mode == .Debug);
	81
	82	const x = @as(u128, arg1) * @as(u128, arg2);
	83	out1.* = @truncate(u64, x);
	84	out2.* = @truncate(u64, x >> 64);
	85	}
	86
	87	/// The function cmovznzU64 is a single-word conditional move.
	88	/// Postconditions:
	89	/// out1 = (if arg1 = 0 then arg2 else arg3)
	90	///
	91	/// Input Bounds:
	92	/// arg1: [0x0 ~> 0x1]
	93	/// arg2: [0x0 ~> 0xffffffffffffffff]
	94	/// arg3: [0x0 ~> 0xffffffffffffffff]
	95	/// Output Bounds:
	96	/// out1: [0x0 ~> 0xffffffffffffffff]
	97	fn cmovznzU64(out1: *u64, arg1: u1, arg2: u64, arg3: u64) callconv(.Inline) void {
	98	@setRuntimeSafety(mode == .Debug);
	99
	100	const mask = 0 -% @as(u64, arg1);
	101	out1.* = (mask & arg3) \| ((~mask) & arg2);
	102	}
	103
	104	/// The function mul multiplies two field elements in the Montgomery domain.
	105	/// Preconditions:
	106	/// 0 ≤ eval arg1 < m
	107	/// 0 ≤ eval arg2 < m
	108	/// Postconditions:
	109	/// eval (from_montgomery out1) mod m = (eval (from_montgomery arg1) * eval (from_montgomery arg2)) mod m
	110	/// 0 ≤ eval out1 < m
	111	///
	112	/// Input Bounds:
	113	/// arg1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
	114	/// arg2: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
	115	/// Output Bounds:
	116	/// out1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
	117	pub fn mul(out1: *[4]u64, arg1: [4]u64, arg2: [4]u64) void {
	118	@setRuntimeSafety(mode == .Debug);
	119
	120	const x1 = (arg1[1]);
	121	const x2 = (arg1[2]);
	122	const x3 = (arg1[3]);
	123	const x4 = (arg1[0]);
	124	var x5: u64 = undefined;
	125	var x6: u64 = undefined;
	126	mulxU64(&x5, &x6, x4, (arg2[3]));
	127	var x7: u64 = undefined;
	128	var x8: u64 = undefined;
	129	mulxU64(&x7, &x8, x4, (arg2[2]));
	130	var x9: u64 = undefined;
	131	var x10: u64 = undefined;
	132	mulxU64(&x9, &x10, x4, (arg2[1]));
	133	var x11: u64 = undefined;
	134	var x12: u64 = undefined;
	135	mulxU64(&x11, &x12, x4, (arg2[0]));
	136	var x13: u64 = undefined;
	137	var x14: u1 = undefined;
	138	addcarryxU64(&x13, &x14, 0x0, x12, x9);
	139	var x15: u64 = undefined;
	140	var x16: u1 = undefined;
	141	addcarryxU64(&x15, &x16, x14, x10, x7);
	142	var x17: u64 = undefined;
	143	var x18: u1 = undefined;
	144	addcarryxU64(&x17, &x18, x16, x8, x5);
	145	const x19 = (cast(u64, x18) + x6);
	146	var x20: u64 = undefined;
	147	var x21: u64 = undefined;
	148	mulxU64(&x20, &x21, x11, 0xccd1c8aaee00bc4f);
	149	var x22: u64 = undefined;
	150	var x23: u64 = undefined;
	151	mulxU64(&x22, &x23, x20, 0xffffffff00000000);
	152	var x24: u64 = undefined;
	153	var x25: u64 = undefined;
	154	mulxU64(&x24, &x25, x20, 0xffffffffffffffff);
	155	var x26: u64 = undefined;
	156	var x27: u64 = undefined;
	157	mulxU64(&x26, &x27, x20, 0xbce6faada7179e84);
	158	var x28: u64 = undefined;
	159	var x29: u64 = undefined;
	160	mulxU64(&x28, &x29, x20, 0xf3b9cac2fc632551);
	161	var x30: u64 = undefined;
	162	var x31: u1 = undefined;
	163	addcarryxU64(&x30, &x31, 0x0, x29, x26);
	164	var x32: u64 = undefined;
	165	var x33: u1 = undefined;
	166	addcarryxU64(&x32, &x33, x31, x27, x24);
	167	var x34: u64 = undefined;
	168	var x35: u1 = undefined;
	169	addcarryxU64(&x34, &x35, x33, x25, x22);
	170	const x36 = (cast(u64, x35) + x23);
	171	var x37: u64 = undefined;
	172	var x38: u1 = undefined;
	173	addcarryxU64(&x37, &x38, 0x0, x11, x28);
	174	var x39: u64 = undefined;
	175	var x40: u1 = undefined;
	176	addcarryxU64(&x39, &x40, x38, x13, x30);
	177	var x41: u64 = undefined;
	178	var x42: u1 = undefined;
	179	addcarryxU64(&x41, &x42, x40, x15, x32);
	180	var x43: u64 = undefined;
	181	var x44: u1 = undefined;
	182	addcarryxU64(&x43, &x44, x42, x17, x34);
	183	var x45: u64 = undefined;
	184	var x46: u1 = undefined;
	185	addcarryxU64(&x45, &x46, x44, x19, x36);
	186	var x47: u64 = undefined;
	187	var x48: u64 = undefined;
	188	mulxU64(&x47, &x48, x1, (arg2[3]));
	189	var x49: u64 = undefined;
	190	var x50: u64 = undefined;
	191	mulxU64(&x49, &x50, x1, (arg2[2]));
	192	var x51: u64 = undefined;
	193	var x52: u64 = undefined;
	194	mulxU64(&x51, &x52, x1, (arg2[1]));
	195	var x53: u64 = undefined;
	196	var x54: u64 = undefined;
	197	mulxU64(&x53, &x54, x1, (arg2[0]));
	198	var x55: u64 = undefined;
	199	var x56: u1 = undefined;
	200	addcarryxU64(&x55, &x56, 0x0, x54, x51);
	201	var x57: u64 = undefined;
	202	var x58: u1 = undefined;
	203	addcarryxU64(&x57, &x58, x56, x52, x49);
	204	var x59: u64 = undefined;
	205	var x60: u1 = undefined;
	206	addcarryxU64(&x59, &x60, x58, x50, x47);
	207	const x61 = (cast(u64, x60) + x48);
	208	var x62: u64 = undefined;
	209	var x63: u1 = undefined;
	210	addcarryxU64(&x62, &x63, 0x0, x39, x53);
	211	var x64: u64 = undefined;
	212	var x65: u1 = undefined;
	213	addcarryxU64(&x64, &x65, x63, x41, x55);
	214	var x66: u64 = undefined;
	215	var x67: u1 = undefined;
	216	addcarryxU64(&x66, &x67, x65, x43, x57);
	217	var x68: u64 = undefined;
	218	var x69: u1 = undefined;
	219	addcarryxU64(&x68, &x69, x67, x45, x59);
	220	var x70: u64 = undefined;
	221	var x71: u1 = undefined;
	222	addcarryxU64(&x70, &x71, x69, cast(u64, x46), x61);
	223	var x72: u64 = undefined;
	224	var x73: u64 = undefined;
	225	mulxU64(&x72, &x73, x62, 0xccd1c8aaee00bc4f);
	226	var x74: u64 = undefined;
	227	var x75: u64 = undefined;
	228	mulxU64(&x74, &x75, x72, 0xffffffff00000000);
	229	var x76: u64 = undefined;
	230	var x77: u64 = undefined;
	231	mulxU64(&x76, &x77, x72, 0xffffffffffffffff);
	232	var x78: u64 = undefined;
	233	var x79: u64 = undefined;
	234	mulxU64(&x78, &x79, x72, 0xbce6faada7179e84);
	235	var x80: u64 = undefined;
	236	var x81: u64 = undefined;
	237	mulxU64(&x80, &x81, x72, 0xf3b9cac2fc632551);
	238	var x82: u64 = undefined;
	239	var x83: u1 = undefined;
	240	addcarryxU64(&x82, &x83, 0x0, x81, x78);
	241	var x84: u64 = undefined;
	242	var x85: u1 = undefined;
	243	addcarryxU64(&x84, &x85, x83, x79, x76);
	244	var x86: u64 = undefined;
	245	var x87: u1 = undefined;
	246	addcarryxU64(&x86, &x87, x85, x77, x74);
	247	const x88 = (cast(u64, x87) + x75);
	248	var x89: u64 = undefined;
	249	var x90: u1 = undefined;
	250	addcarryxU64(&x89, &x90, 0x0, x62, x80);
	251	var x91: u64 = undefined;
	252	var x92: u1 = undefined;
	253	addcarryxU64(&x91, &x92, x90, x64, x82);
	254	var x93: u64 = undefined;
	255	var x94: u1 = undefined;
	256	addcarryxU64(&x93, &x94, x92, x66, x84);
	257	var x95: u64 = undefined;
	258	var x96: u1 = undefined;
	259	addcarryxU64(&x95, &x96, x94, x68, x86);
	260	var x97: u64 = undefined;
	261	var x98: u1 = undefined;
	262	addcarryxU64(&x97, &x98, x96, x70, x88);
	263	const x99 = (cast(u64, x98) + cast(u64, x71));
	264	var x100: u64 = undefined;
	265	var x101: u64 = undefined;
	266	mulxU64(&x100, &x101, x2, (arg2[3]));
	267	var x102: u64 = undefined;
	268	var x103: u64 = undefined;
	269	mulxU64(&x102, &x103, x2, (arg2[2]));
	270	var x104: u64 = undefined;
	271	var x105: u64 = undefined;
	272	mulxU64(&x104, &x105, x2, (arg2[1]));
	273	var x106: u64 = undefined;
	274	var x107: u64 = undefined;
	275	mulxU64(&x106, &x107, x2, (arg2[0]));
	276	var x108: u64 = undefined;
	277	var x109: u1 = undefined;
	278	addcarryxU64(&x108, &x109, 0x0, x107, x104);
	279	var x110: u64 = undefined;
	280	var x111: u1 = undefined;
	281	addcarryxU64(&x110, &x111, x109, x105, x102);
	282	var x112: u64 = undefined;
	283	var x113: u1 = undefined;
	284	addcarryxU64(&x112, &x113, x111, x103, x100);
	285	const x114 = (cast(u64, x113) + x101);
	286	var x115: u64 = undefined;
	287	var x116: u1 = undefined;
	288	addcarryxU64(&x115, &x116, 0x0, x91, x106);
	289	var x117: u64 = undefined;
	290	var x118: u1 = undefined;
	291	addcarryxU64(&x117, &x118, x116, x93, x108);
	292	var x119: u64 = undefined;
	293	var x120: u1 = undefined;
	294	addcarryxU64(&x119, &x120, x118, x95, x110);
	295	var x121: u64 = undefined;
	296	var x122: u1 = undefined;
	297	addcarryxU64(&x121, &x122, x120, x97, x112);
	298	var x123: u64 = undefined;
	299	var x124: u1 = undefined;
	300	addcarryxU64(&x123, &x124, x122, x99, x114);
	301	var x125: u64 = undefined;
	302	var x126: u64 = undefined;
	303	mulxU64(&x125, &x126, x115, 0xccd1c8aaee00bc4f);
	304	var x127: u64 = undefined;
	305	var x128: u64 = undefined;
	306	mulxU64(&x127, &x128, x125, 0xffffffff00000000);
	307	var x129: u64 = undefined;
	308	var x130: u64 = undefined;
	309	mulxU64(&x129, &x130, x125, 0xffffffffffffffff);
	310	var x131: u64 = undefined;
	311	var x132: u64 = undefined;
	312	mulxU64(&x131, &x132, x125, 0xbce6faada7179e84);
	313	var x133: u64 = undefined;
	314	var x134: u64 = undefined;
	315	mulxU64(&x133, &x134, x125, 0xf3b9cac2fc632551);
	316	var x135: u64 = undefined;
	317	var x136: u1 = undefined;
	318	addcarryxU64(&x135, &x136, 0x0, x134, x131);
	319	var x137: u64 = undefined;
	320	var x138: u1 = undefined;
	321	addcarryxU64(&x137, &x138, x136, x132, x129);
	322	var x139: u64 = undefined;
	323	var x140: u1 = undefined;
	324	addcarryxU64(&x139, &x140, x138, x130, x127);
	325	const x141 = (cast(u64, x140) + x128);
	326	var x142: u64 = undefined;
	327	var x143: u1 = undefined;
	328	addcarryxU64(&x142, &x143, 0x0, x115, x133);
	329	var x144: u64 = undefined;
	330	var x145: u1 = undefined;
	331	addcarryxU64(&x144, &x145, x143, x117, x135);
	332	var x146: u64 = undefined;
	333	var x147: u1 = undefined;
	334	addcarryxU64(&x146, &x147, x145, x119, x137);
	335	var x148: u64 = undefined;
	336	var x149: u1 = undefined;
	337	addcarryxU64(&x148, &x149, x147, x121, x139);
	338	var x150: u64 = undefined;
	339	var x151: u1 = undefined;
	340	addcarryxU64(&x150, &x151, x149, x123, x141);
	341	const x152 = (cast(u64, x151) + cast(u64, x124));
	342	var x153: u64 = undefined;
	343	var x154: u64 = undefined;
	344	mulxU64(&x153, &x154, x3, (arg2[3]));
	345	var x155: u64 = undefined;
	346	var x156: u64 = undefined;
	347	mulxU64(&x155, &x156, x3, (arg2[2]));
	348	var x157: u64 = undefined;
	349	var x158: u64 = undefined;
	350	mulxU64(&x157, &x158, x3, (arg2[1]));
	351	var x159: u64 = undefined;
	352	var x160: u64 = undefined;
	353	mulxU64(&x159, &x160, x3, (arg2[0]));
	354	var x161: u64 = undefined;
	355	var x162: u1 = undefined;
	356	addcarryxU64(&x161, &x162, 0x0, x160, x157);
	357	var x163: u64 = undefined;
	358	var x164: u1 = undefined;
	359	addcarryxU64(&x163, &x164, x162, x158, x155);
	360	var x165: u64 = undefined;
	361	var x166: u1 = undefined;
	362	addcarryxU64(&x165, &x166, x164, x156, x153);
	363	const x167 = (cast(u64, x166) + x154);
	364	var x168: u64 = undefined;
	365	var x169: u1 = undefined;
	366	addcarryxU64(&x168, &x169, 0x0, x144, x159);
	367	var x170: u64 = undefined;
	368	var x171: u1 = undefined;
	369	addcarryxU64(&x170, &x171, x169, x146, x161);
	370	var x172: u64 = undefined;
	371	var x173: u1 = undefined;
	372	addcarryxU64(&x172, &x173, x171, x148, x163);
	373	var x174: u64 = undefined;
	374	var x175: u1 = undefined;
	375	addcarryxU64(&x174, &x175, x173, x150, x165);
	376	var x176: u64 = undefined;
	377	var x177: u1 = undefined;
	378	addcarryxU64(&x176, &x177, x175, x152, x167);
	379	var x178: u64 = undefined;
	380	var x179: u64 = undefined;
	381	mulxU64(&x178, &x179, x168, 0xccd1c8aaee00bc4f);
	382	var x180: u64 = undefined;
	383	var x181: u64 = undefined;
	384	mulxU64(&x180, &x181, x178, 0xffffffff00000000);
	385	var x182: u64 = undefined;
	386	var x183: u64 = undefined;
	387	mulxU64(&x182, &x183, x178, 0xffffffffffffffff);
	388	var x184: u64 = undefined;
	389	var x185: u64 = undefined;
	390	mulxU64(&x184, &x185, x178, 0xbce6faada7179e84);
	391	var x186: u64 = undefined;
	392	var x187: u64 = undefined;
	393	mulxU64(&x186, &x187, x178, 0xf3b9cac2fc632551);
	394	var x188: u64 = undefined;
	395	var x189: u1 = undefined;
	396	addcarryxU64(&x188, &x189, 0x0, x187, x184);
	397	var x190: u64 = undefined;
	398	var x191: u1 = undefined;
	399	addcarryxU64(&x190, &x191, x189, x185, x182);
	400	var x192: u64 = undefined;
	401	var x193: u1 = undefined;
	402	addcarryxU64(&x192, &x193, x191, x183, x180);
	403	const x194 = (cast(u64, x193) + x181);
	404	var x195: u64 = undefined;
	405	var x196: u1 = undefined;
	406	addcarryxU64(&x195, &x196, 0x0, x168, x186);
	407	var x197: u64 = undefined;
	408	var x198: u1 = undefined;
	409	addcarryxU64(&x197, &x198, x196, x170, x188);
	410	var x199: u64 = undefined;
	411	var x200: u1 = undefined;
	412	addcarryxU64(&x199, &x200, x198, x172, x190);
	413	var x201: u64 = undefined;
	414	var x202: u1 = undefined;
	415	addcarryxU64(&x201, &x202, x200, x174, x192);
	416	var x203: u64 = undefined;
	417	var x204: u1 = undefined;
	418	addcarryxU64(&x203, &x204, x202, x176, x194);
	419	const x205 = (cast(u64, x204) + cast(u64, x177));
	420	var x206: u64 = undefined;
	421	var x207: u1 = undefined;
	422	subborrowxU64(&x206, &x207, 0x0, x197, 0xf3b9cac2fc632551);
	423	var x208: u64 = undefined;
	424	var x209: u1 = undefined;
	425	subborrowxU64(&x208, &x209, x207, x199, 0xbce6faada7179e84);
	426	var x210: u64 = undefined;
	427	var x211: u1 = undefined;
	428	subborrowxU64(&x210, &x211, x209, x201, 0xffffffffffffffff);
	429	var x212: u64 = undefined;
	430	var x213: u1 = undefined;
	431	subborrowxU64(&x212, &x213, x211, x203, 0xffffffff00000000);
	432	var x214: u64 = undefined;
	433	var x215: u1 = undefined;
	434	subborrowxU64(&x214, &x215, x213, x205, cast(u64, 0x0));
	435	var x216: u64 = undefined;
	436	cmovznzU64(&x216, x215, x206, x197);
	437	var x217: u64 = undefined;
	438	cmovznzU64(&x217, x215, x208, x199);
	439	var x218: u64 = undefined;
	440	cmovznzU64(&x218, x215, x210, x201);
	441	var x219: u64 = undefined;
	442	cmovznzU64(&x219, x215, x212, x203);
	443	out1[0] = x216;
	444	out1[1] = x217;
	445	out1[2] = x218;
	446	out1[3] = x219;
	447	}
	448
	449	/// The function square squares a field element in the Montgomery domain.
	450	/// Preconditions:
	451	/// 0 ≤ eval arg1 < m
	452	/// Postconditions:
	453	/// eval (from_montgomery out1) mod m = (eval (from_montgomery arg1) * eval (from_montgomery arg1)) mod m
	454	/// 0 ≤ eval out1 < m
	455	///
	456	/// Input Bounds:
	457	/// arg1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
	458	/// Output Bounds:
	459	/// out1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
	460	pub fn square(out1: *[4]u64, arg1: [4]u64) void {
	461	@setRuntimeSafety(mode == .Debug);
	462
	463	const x1 = (arg1[1]);
	464	const x2 = (arg1[2]);
	465	const x3 = (arg1[3]);
	466	const x4 = (arg1[0]);
	467	var x5: u64 = undefined;
	468	var x6: u64 = undefined;
	469	mulxU64(&x5, &x6, x4, (arg1[3]));
	470	var x7: u64 = undefined;
	471	var x8: u64 = undefined;
	472	mulxU64(&x7, &x8, x4, (arg1[2]));
	473	var x9: u64 = undefined;
	474	var x10: u64 = undefined;
	475	mulxU64(&x9, &x10, x4, (arg1[1]));
	476	var x11: u64 = undefined;
	477	var x12: u64 = undefined;
	478	mulxU64(&x11, &x12, x4, (arg1[0]));
	479	var x13: u64 = undefined;
	480	var x14: u1 = undefined;
	481	addcarryxU64(&x13, &x14, 0x0, x12, x9);
	482	var x15: u64 = undefined;
	483	var x16: u1 = undefined;
	484	addcarryxU64(&x15, &x16, x14, x10, x7);
	485	var x17: u64 = undefined;
	486	var x18: u1 = undefined;
	487	addcarryxU64(&x17, &x18, x16, x8, x5);
	488	const x19 = (cast(u64, x18) + x6);
	489	var x20: u64 = undefined;
	490	var x21: u64 = undefined;
	491	mulxU64(&x20, &x21, x11, 0xccd1c8aaee00bc4f);
	492	var x22: u64 = undefined;
	493	var x23: u64 = undefined;
	494	mulxU64(&x22, &x23, x20, 0xffffffff00000000);
	495	var x24: u64 = undefined;
	496	var x25: u64 = undefined;
	497	mulxU64(&x24, &x25, x20, 0xffffffffffffffff);
	498	var x26: u64 = undefined;
	499	var x27: u64 = undefined;
	500	mulxU64(&x26, &x27, x20, 0xbce6faada7179e84);
	501	var x28: u64 = undefined;
	502	var x29: u64 = undefined;
	503	mulxU64(&x28, &x29, x20, 0xf3b9cac2fc632551);
	504	var x30: u64 = undefined;
	505	var x31: u1 = undefined;
	506	addcarryxU64(&x30, &x31, 0x0, x29, x26);
	507	var x32: u64 = undefined;
	508	var x33: u1 = undefined;
	509	addcarryxU64(&x32, &x33, x31, x27, x24);
	510	var x34: u64 = undefined;
	511	var x35: u1 = undefined;
	512	addcarryxU64(&x34, &x35, x33, x25, x22);
	513	const x36 = (cast(u64, x35) + x23);
	514	var x37: u64 = undefined;
	515	var x38: u1 = undefined;
	516	addcarryxU64(&x37, &x38, 0x0, x11, x28);
	517	var x39: u64 = undefined;
	518	var x40: u1 = undefined;
	519	addcarryxU64(&x39, &x40, x38, x13, x30);
	520	var x41: u64 = undefined;
	521	var x42: u1 = undefined;
	522	addcarryxU64(&x41, &x42, x40, x15, x32);
	523	var x43: u64 = undefined;
	524	var x44: u1 = undefined;
	525	addcarryxU64(&x43, &x44, x42, x17, x34);
	526	var x45: u64 = undefined;
	527	var x46: u1 = undefined;
	528	addcarryxU64(&x45, &x46, x44, x19, x36);
	529	var x47: u64 = undefined;
	530	var x48: u64 = undefined;
	531	mulxU64(&x47, &x48, x1, (arg1[3]));
	532	var x49: u64 = undefined;
	533	var x50: u64 = undefined;
	534	mulxU64(&x49, &x50, x1, (arg1[2]));
	535	var x51: u64 = undefined;
	536	var x52: u64 = undefined;
	537	mulxU64(&x51, &x52, x1, (arg1[1]));
	538	var x53: u64 = undefined;
	539	var x54: u64 = undefined;
	540	mulxU64(&x53, &x54, x1, (arg1[0]));
	541	var x55: u64 = undefined;
	542	var x56: u1 = undefined;
	543	addcarryxU64(&x55, &x56, 0x0, x54, x51);
	544	var x57: u64 = undefined;
	545	var x58: u1 = undefined;
	546	addcarryxU64(&x57, &x58, x56, x52, x49);
	547	var x59: u64 = undefined;
	548	var x60: u1 = undefined;
	549	addcarryxU64(&x59, &x60, x58, x50, x47);
	550	const x61 = (cast(u64, x60) + x48);
	551	var x62: u64 = undefined;
	552	var x63: u1 = undefined;
	553	addcarryxU64(&x62, &x63, 0x0, x39, x53);
	554	var x64: u64 = undefined;
	555	var x65: u1 = undefined;
	556	addcarryxU64(&x64, &x65, x63, x41, x55);
	557	var x66: u64 = undefined;
	558	var x67: u1 = undefined;
	559	addcarryxU64(&x66, &x67, x65, x43, x57);
	560	var x68: u64 = undefined;
	561	var x69: u1 = undefined;
	562	addcarryxU64(&x68, &x69, x67, x45, x59);
	563	var x70: u64 = undefined;
	564	var x71: u1 = undefined;
	565	addcarryxU64(&x70, &x71, x69, cast(u64, x46), x61);
	566	var x72: u64 = undefined;
	567	var x73: u64 = undefined;
	568	mulxU64(&x72, &x73, x62, 0xccd1c8aaee00bc4f);
	569	var x74: u64 = undefined;
	570	var x75: u64 = undefined;
	571	mulxU64(&x74, &x75, x72, 0xffffffff00000000);
	572	var x76: u64 = undefined;
	573	var x77: u64 = undefined;
	574	mulxU64(&x76, &x77, x72, 0xffffffffffffffff);
	575	var x78: u64 = undefined;
	576	var x79: u64 = undefined;
	577	mulxU64(&x78, &x79, x72, 0xbce6faada7179e84);
	578	var x80: u64 = undefined;
	579	var x81: u64 = undefined;
	580	mulxU64(&x80, &x81, x72, 0xf3b9cac2fc632551);
	581	var x82: u64 = undefined;
	582	var x83: u1 = undefined;
	583	addcarryxU64(&x82, &x83, 0x0, x81, x78);
	584	var x84: u64 = undefined;
	585	var x85: u1 = undefined;
	586	addcarryxU64(&x84, &x85, x83, x79, x76);
	587	var x86: u64 = undefined;
	588	var x87: u1 = undefined;
	589	addcarryxU64(&x86, &x87, x85, x77, x74);
	590	const x88 = (cast(u64, x87) + x75);
	591	var x89: u64 = undefined;
	592	var x90: u1 = undefined;
	593	addcarryxU64(&x89, &x90, 0x0, x62, x80);
	594	var x91: u64 = undefined;
	595	var x92: u1 = undefined;
	596	addcarryxU64(&x91, &x92, x90, x64, x82);
	597	var x93: u64 = undefined;
	598	var x94: u1 = undefined;
	599	addcarryxU64(&x93, &x94, x92, x66, x84);
	600	var x95: u64 = undefined;
	601	var x96: u1 = undefined;
	602	addcarryxU64(&x95, &x96, x94, x68, x86);
	603	var x97: u64 = undefined;
	604	var x98: u1 = undefined;
	605	addcarryxU64(&x97, &x98, x96, x70, x88);
	606	const x99 = (cast(u64, x98) + cast(u64, x71));
	607	var x100: u64 = undefined;
	608	var x101: u64 = undefined;
	609	mulxU64(&x100, &x101, x2, (arg1[3]));
	610	var x102: u64 = undefined;
	611	var x103: u64 = undefined;
	612	mulxU64(&x102, &x103, x2, (arg1[2]));
	613	var x104: u64 = undefined;
	614	var x105: u64 = undefined;
	615	mulxU64(&x104, &x105, x2, (arg1[1]));
	616	var x106: u64 = undefined;
	617	var x107: u64 = undefined;
	618	mulxU64(&x106, &x107, x2, (arg1[0]));
	619	var x108: u64 = undefined;
	620	var x109: u1 = undefined;
	621	addcarryxU64(&x108, &x109, 0x0, x107, x104);
	622	var x110: u64 = undefined;
	623	var x111: u1 = undefined;
	624	addcarryxU64(&x110, &x111, x109, x105, x102);
	625	var x112: u64 = undefined;
	626	var x113: u1 = undefined;
	627	addcarryxU64(&x112, &x113, x111, x103, x100);
	628	const x114 = (cast(u64, x113) + x101);
	629	var x115: u64 = undefined;
	630	var x116: u1 = undefined;
	631	addcarryxU64(&x115, &x116, 0x0, x91, x106);
	632	var x117: u64 = undefined;
	633	var x118: u1 = undefined;
	634	addcarryxU64(&x117, &x118, x116, x93, x108);
	635	var x119: u64 = undefined;
	636	var x120: u1 = undefined;
	637	addcarryxU64(&x119, &x120, x118, x95, x110);
	638	var x121: u64 = undefined;
	639	var x122: u1 = undefined;
	640	addcarryxU64(&x121, &x122, x120, x97, x112);
	641	var x123: u64 = undefined;
	642	var x124: u1 = undefined;
	643	addcarryxU64(&x123, &x124, x122, x99, x114);
	644	var x125: u64 = undefined;
	645	var x126: u64 = undefined;
	646	mulxU64(&x125, &x126, x115, 0xccd1c8aaee00bc4f);
	647	var x127: u64 = undefined;
	648	var x128: u64 = undefined;
	649	mulxU64(&x127, &x128, x125, 0xffffffff00000000);
	650	var x129: u64 = undefined;
	651	var x130: u64 = undefined;
	652	mulxU64(&x129, &x130, x125, 0xffffffffffffffff);
	653	var x131: u64 = undefined;
	654	var x132: u64 = undefined;
	655	mulxU64(&x131, &x132, x125, 0xbce6faada7179e84);
	656	var x133: u64 = undefined;
	657	var x134: u64 = undefined;
	658	mulxU64(&x133, &x134, x125, 0xf3b9cac2fc632551);
	659	var x135: u64 = undefined;
	660	var x136: u1 = undefined;
	661	addcarryxU64(&x135, &x136, 0x0, x134, x131);
	662	var x137: u64 = undefined;
	663	var x138: u1 = undefined;
	664	addcarryxU64(&x137, &x138, x136, x132, x129);
	665	var x139: u64 = undefined;
	666	var x140: u1 = undefined;
	667	addcarryxU64(&x139, &x140, x138, x130, x127);
	668	const x141 = (cast(u64, x140) + x128);
	669	var x142: u64 = undefined;
	670	var x143: u1 = undefined;
	671	addcarryxU64(&x142, &x143, 0x0, x115, x133);
	672	var x144: u64 = undefined;
	673	var x145: u1 = undefined;
	674	addcarryxU64(&x144, &x145, x143, x117, x135);
	675	var x146: u64 = undefined;
	676	var x147: u1 = undefined;
	677	addcarryxU64(&x146, &x147, x145, x119, x137);
	678	var x148: u64 = undefined;
	679	var x149: u1 = undefined;
	680	addcarryxU64(&x148, &x149, x147, x121, x139);
	681	var x150: u64 = undefined;
	682	var x151: u1 = undefined;
	683	addcarryxU64(&x150, &x151, x149, x123, x141);
	684	const x152 = (cast(u64, x151) + cast(u64, x124));
	685	var x153: u64 = undefined;
	686	var x154: u64 = undefined;
	687	mulxU64(&x153, &x154, x3, (arg1[3]));
	688	var x155: u64 = undefined;
	689	var x156: u64 = undefined;
	690	mulxU64(&x155, &x156, x3, (arg1[2]));
	691	var x157: u64 = undefined;
	692	var x158: u64 = undefined;
	693	mulxU64(&x157, &x158, x3, (arg1[1]));
	694	var x159: u64 = undefined;
	695	var x160: u64 = undefined;
	696	mulxU64(&x159, &x160, x3, (arg1[0]));
	697	var x161: u64 = undefined;
	698	var x162: u1 = undefined;
	699	addcarryxU64(&x161, &x162, 0x0, x160, x157);
	700	var x163: u64 = undefined;
	701	var x164: u1 = undefined;
	702	addcarryxU64(&x163, &x164, x162, x158, x155);
	703	var x165: u64 = undefined;
	704	var x166: u1 = undefined;
	705	addcarryxU64(&x165, &x166, x164, x156, x153);
	706	const x167 = (cast(u64, x166) + x154);
	707	var x168: u64 = undefined;
	708	var x169: u1 = undefined;
	709	addcarryxU64(&x168, &x169, 0x0, x144, x159);
	710	var x170: u64 = undefined;
	711	var x171: u1 = undefined;
	712	addcarryxU64(&x170, &x171, x169, x146, x161);
	713	var x172: u64 = undefined;
	714	var x173: u1 = undefined;
	715	addcarryxU64(&x172, &x173, x171, x148, x163);
	716	var x174: u64 = undefined;
	717	var x175: u1 = undefined;
	718	addcarryxU64(&x174, &x175, x173, x150, x165);
	719	var x176: u64 = undefined;
	720	var x177: u1 = undefined;
	721	addcarryxU64(&x176, &x177, x175, x152, x167);
	722	var x178: u64 = undefined;
	723	var x179: u64 = undefined;
	724	mulxU64(&x178, &x179, x168, 0xccd1c8aaee00bc4f);
	725	var x180: u64 = undefined;
	726	var x181: u64 = undefined;
	727	mulxU64(&x180, &x181, x178, 0xffffffff00000000);
	728	var x182: u64 = undefined;
	729	var x183: u64 = undefined;
	730	mulxU64(&x182, &x183, x178, 0xffffffffffffffff);
	731	var x184: u64 = undefined;
	732	var x185: u64 = undefined;
	733	mulxU64(&x184, &x185, x178, 0xbce6faada7179e84);
	734	var x186: u64 = undefined;
	735	var x187: u64 = undefined;
	736	mulxU64(&x186, &x187, x178, 0xf3b9cac2fc632551);
	737	var x188: u64 = undefined;
	738	var x189: u1 = undefined;
	739	addcarryxU64(&x188, &x189, 0x0, x187, x184);
	740	var x190: u64 = undefined;
	741	var x191: u1 = undefined;
	742	addcarryxU64(&x190, &x191, x189, x185, x182);
	743	var x192: u64 = undefined;
	744	var x193: u1 = undefined;
	745	addcarryxU64(&x192, &x193, x191, x183, x180);
	746	const x194 = (cast(u64, x193) + x181);
	747	var x195: u64 = undefined;
	748	var x196: u1 = undefined;
	749	addcarryxU64(&x195, &x196, 0x0, x168, x186);
	750	var x197: u64 = undefined;
	751	var x198: u1 = undefined;
	752	addcarryxU64(&x197, &x198, x196, x170, x188);
	753	var x199: u64 = undefined;
	754	var x200: u1 = undefined;
	755	addcarryxU64(&x199, &x200, x198, x172, x190);
	756	var x201: u64 = undefined;
	757	var x202: u1 = undefined;
	758	addcarryxU64(&x201, &x202, x200, x174, x192);
	759	var x203: u64 = undefined;
	760	var x204: u1 = undefined;
	761	addcarryxU64(&x203, &x204, x202, x176, x194);
	762	const x205 = (cast(u64, x204) + cast(u64, x177));
	763	var x206: u64 = undefined;
	764	var x207: u1 = undefined;
	765	subborrowxU64(&x206, &x207, 0x0, x197, 0xf3b9cac2fc632551);
	766	var x208: u64 = undefined;
	767	var x209: u1 = undefined;
	768	subborrowxU64(&x208, &x209, x207, x199, 0xbce6faada7179e84);
	769	var x210: u64 = undefined;
	770	var x211: u1 = undefined;
	771	subborrowxU64(&x210, &x211, x209, x201, 0xffffffffffffffff);
	772	var x212: u64 = undefined;
	773	var x213: u1 = undefined;
	774	subborrowxU64(&x212, &x213, x211, x203, 0xffffffff00000000);
	775	var x214: u64 = undefined;
	776	var x215: u1 = undefined;
	777	subborrowxU64(&x214, &x215, x213, x205, cast(u64, 0x0));
	778	var x216: u64 = undefined;
	779	cmovznzU64(&x216, x215, x206, x197);
	780	var x217: u64 = undefined;
	781	cmovznzU64(&x217, x215, x208, x199);
	782	var x218: u64 = undefined;
	783	cmovznzU64(&x218, x215, x210, x201);
	784	var x219: u64 = undefined;
	785	cmovznzU64(&x219, x215, x212, x203);
	786	out1[0] = x216;
	787	out1[1] = x217;
	788	out1[2] = x218;
	789	out1[3] = x219;
	790	}
	791
	792	/// The function add adds two field elements in the Montgomery domain.
	793	/// Preconditions:
	794	/// 0 ≤ eval arg1 < m
	795	/// 0 ≤ eval arg2 < m
	796	/// Postconditions:
	797	/// eval (from_montgomery out1) mod m = (eval (from_montgomery arg1) + eval (from_montgomery arg2)) mod m
	798	/// 0 ≤ eval out1 < m
	799	///
	800	/// Input Bounds:
	801	/// arg1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
	802	/// arg2: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
	803	/// Output Bounds:
	804	/// out1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
	805	pub fn add(out1: *[4]u64, arg1: [4]u64, arg2: [4]u64) void {
	806	@setRuntimeSafety(mode == .Debug);
	807
	808	var x1: u64 = undefined;
	809	var x2: u1 = undefined;
	810	addcarryxU64(&x1, &x2, 0x0, (arg1[0]), (arg2[0]));
	811	var x3: u64 = undefined;
	812	var x4: u1 = undefined;
	813	addcarryxU64(&x3, &x4, x2, (arg1[1]), (arg2[1]));
	814	var x5: u64 = undefined;
	815	var x6: u1 = undefined;
	816	addcarryxU64(&x5, &x6, x4, (arg1[2]), (arg2[2]));
	817	var x7: u64 = undefined;
	818	var x8: u1 = undefined;
	819	addcarryxU64(&x7, &x8, x6, (arg1[3]), (arg2[3]));
	820	var x9: u64 = undefined;
	821	var x10: u1 = undefined;
	822	subborrowxU64(&x9, &x10, 0x0, x1, 0xf3b9cac2fc632551);
	823	var x11: u64 = undefined;
	824	var x12: u1 = undefined;
	825	subborrowxU64(&x11, &x12, x10, x3, 0xbce6faada7179e84);
	826	var x13: u64 = undefined;
	827	var x14: u1 = undefined;
	828	subborrowxU64(&x13, &x14, x12, x5, 0xffffffffffffffff);
	829	var x15: u64 = undefined;
	830	var x16: u1 = undefined;
	831	subborrowxU64(&x15, &x16, x14, x7, 0xffffffff00000000);
	832	var x17: u64 = undefined;
	833	var x18: u1 = undefined;
	834	subborrowxU64(&x17, &x18, x16, cast(u64, x8), cast(u64, 0x0));
	835	var x19: u64 = undefined;
	836	cmovznzU64(&x19, x18, x9, x1);
	837	var x20: u64 = undefined;
	838	cmovznzU64(&x20, x18, x11, x3);
	839	var x21: u64 = undefined;
	840	cmovznzU64(&x21, x18, x13, x5);
	841	var x22: u64 = undefined;
	842	cmovznzU64(&x22, x18, x15, x7);
	843	out1[0] = x19;
	844	out1[1] = x20;
	845	out1[2] = x21;
	846	out1[3] = x22;
	847	}
	848
	849	/// The function sub subtracts two field elements in the Montgomery domain.
	850	/// Preconditions:
	851	/// 0 ≤ eval arg1 < m
	852	/// 0 ≤ eval arg2 < m
	853	/// Postconditions:
	854	/// eval (from_montgomery out1) mod m = (eval (from_montgomery arg1) - eval (from_montgomery arg2)) mod m
	855	/// 0 ≤ eval out1 < m
	856	///
	857	/// Input Bounds:
	858	/// arg1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
	859	/// arg2: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
	860	/// Output Bounds:
	861	/// out1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
	862	pub fn sub(out1: *[4]u64, arg1: [4]u64, arg2: [4]u64) void {
	863	@setRuntimeSafety(mode == .Debug);
	864
	865	var x1: u64 = undefined;
	866	var x2: u1 = undefined;
	867	subborrowxU64(&x1, &x2, 0x0, (arg1[0]), (arg2[0]));
	868	var x3: u64 = undefined;
	869	var x4: u1 = undefined;
	870	subborrowxU64(&x3, &x4, x2, (arg1[1]), (arg2[1]));
	871	var x5: u64 = undefined;
	872	var x6: u1 = undefined;
	873	subborrowxU64(&x5, &x6, x4, (arg1[2]), (arg2[2]));
	874	var x7: u64 = undefined;
	875	var x8: u1 = undefined;
	876	subborrowxU64(&x7, &x8, x6, (arg1[3]), (arg2[3]));
	877	var x9: u64 = undefined;
	878	cmovznzU64(&x9, x8, cast(u64, 0x0), 0xffffffffffffffff);
	879	var x10: u64 = undefined;
	880	var x11: u1 = undefined;
	881	addcarryxU64(&x10, &x11, 0x0, x1, (x9 & 0xf3b9cac2fc632551));
	882	var x12: u64 = undefined;
	883	var x13: u1 = undefined;
	884	addcarryxU64(&x12, &x13, x11, x3, (x9 & 0xbce6faada7179e84));
	885	var x14: u64 = undefined;
	886	var x15: u1 = undefined;
	887	addcarryxU64(&x14, &x15, x13, x5, x9);
	888	var x16: u64 = undefined;
	889	var x17: u1 = undefined;
	890	addcarryxU64(&x16, &x17, x15, x7, (x9 & 0xffffffff00000000));
	891	out1[0] = x10;
	892	out1[1] = x12;
	893	out1[2] = x14;
	894	out1[3] = x16;
	895	}
	896
	897	/// The function opp negates a field element in the Montgomery domain.
	898	/// Preconditions:
	899	/// 0 ≤ eval arg1 < m
	900	/// Postconditions:
	901	/// eval (from_montgomery out1) mod m = -eval (from_montgomery arg1) mod m
	902	/// 0 ≤ eval out1 < m
	903	///
	904	/// Input Bounds:
	905	/// arg1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
	906	/// Output Bounds:
	907	/// out1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
	908	pub fn opp(out1: *[4]u64, arg1: [4]u64) void {
	909	@setRuntimeSafety(mode == .Debug);
	910
	911	var x1: u64 = undefined;
	912	var x2: u1 = undefined;
	913	subborrowxU64(&x1, &x2, 0x0, cast(u64, 0x0), (arg1[0]));
	914	var x3: u64 = undefined;
	915	var x4: u1 = undefined;
	916	subborrowxU64(&x3, &x4, x2, cast(u64, 0x0), (arg1[1]));
	917	var x5: u64 = undefined;
	918	var x6: u1 = undefined;
	919	subborrowxU64(&x5, &x6, x4, cast(u64, 0x0), (arg1[2]));
	920	var x7: u64 = undefined;
	921	var x8: u1 = undefined;
	922	subborrowxU64(&x7, &x8, x6, cast(u64, 0x0), (arg1[3]));
	923	var x9: u64 = undefined;
	924	cmovznzU64(&x9, x8, cast(u64, 0x0), 0xffffffffffffffff);
	925	var x10: u64 = undefined;
	926	var x11: u1 = undefined;
	927	addcarryxU64(&x10, &x11, 0x0, x1, (x9 & 0xf3b9cac2fc632551));
	928	var x12: u64 = undefined;
	929	var x13: u1 = undefined;
	930	addcarryxU64(&x12, &x13, x11, x3, (x9 & 0xbce6faada7179e84));
	931	var x14: u64 = undefined;
	932	var x15: u1 = undefined;
	933	addcarryxU64(&x14, &x15, x13, x5, x9);
	934	var x16: u64 = undefined;
	935	var x17: u1 = undefined;
	936	addcarryxU64(&x16, &x17, x15, x7, (x9 & 0xffffffff00000000));
	937	out1[0] = x10;
	938	out1[1] = x12;
	939	out1[2] = x14;
	940	out1[3] = x16;
	941	}
	942
	943	/// The function fromMontgomery translates a field element out of the Montgomery domain.
	944	/// Preconditions:
	945	/// 0 ≤ eval arg1 < m
	946	/// Postconditions:
	947	/// eval out1 mod m = (eval arg1 * ((2^64)⁻¹ mod m)^4) mod m
	948	/// 0 ≤ eval out1 < m
	949	///
	950	/// Input Bounds:
	951	/// arg1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
	952	/// Output Bounds:
	953	/// out1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
	954	pub fn fromMontgomery(out1: *[4]u64, arg1: [4]u64) void {
	955	@setRuntimeSafety(mode == .Debug);
	956
	957	const x1 = (arg1[0]);
	958	var x2: u64 = undefined;
	959	var x3: u64 = undefined;
	960	mulxU64(&x2, &x3, x1, 0xccd1c8aaee00bc4f);
	961	var x4: u64 = undefined;
	962	var x5: u64 = undefined;
	963	mulxU64(&x4, &x5, x2, 0xffffffff00000000);
	964	var x6: u64 = undefined;
	965	var x7: u64 = undefined;
	966	mulxU64(&x6, &x7, x2, 0xffffffffffffffff);
	967	var x8: u64 = undefined;
	968	var x9: u64 = undefined;
	969	mulxU64(&x8, &x9, x2, 0xbce6faada7179e84);
	970	var x10: u64 = undefined;
	971	var x11: u64 = undefined;
	972	mulxU64(&x10, &x11, x2, 0xf3b9cac2fc632551);
	973	var x12: u64 = undefined;
	974	var x13: u1 = undefined;
	975	addcarryxU64(&x12, &x13, 0x0, x11, x8);
	976	var x14: u64 = undefined;
	977	var x15: u1 = undefined;
	978	addcarryxU64(&x14, &x15, x13, x9, x6);
	979	var x16: u64 = undefined;
	980	var x17: u1 = undefined;
	981	addcarryxU64(&x16, &x17, x15, x7, x4);
	982	var x18: u64 = undefined;
	983	var x19: u1 = undefined;
	984	addcarryxU64(&x18, &x19, 0x0, x1, x10);
	985	var x20: u64 = undefined;
	986	var x21: u1 = undefined;
	987	addcarryxU64(&x20, &x21, x19, cast(u64, 0x0), x12);
	988	var x22: u64 = undefined;
	989	var x23: u1 = undefined;
	990	addcarryxU64(&x22, &x23, x21, cast(u64, 0x0), x14);
	991	var x24: u64 = undefined;
	992	var x25: u1 = undefined;
	993	addcarryxU64(&x24, &x25, x23, cast(u64, 0x0), x16);
	994	var x26: u64 = undefined;
	995	var x27: u1 = undefined;
	996	addcarryxU64(&x26, &x27, 0x0, x20, (arg1[1]));
	997	var x28: u64 = undefined;
	998	var x29: u1 = undefined;
	999	addcarryxU64(&x28, &x29, x27, x22, cast(u64, 0x0));
	1000	var x30: u64 = undefined;
	1001	var x31: u1 = undefined;
	1002	addcarryxU64(&x30, &x31, x29, x24, cast(u64, 0x0));
	1003	var x32: u64 = undefined;
	1004	var x33: u64 = undefined;
	1005	mulxU64(&x32, &x33, x26, 0xccd1c8aaee00bc4f);
	1006	var x34: u64 = undefined;
	1007	var x35: u64 = undefined;
	1008	mulxU64(&x34, &x35, x32, 0xffffffff00000000);
	1009	var x36: u64 = undefined;
	1010	var x37: u64 = undefined;
	1011	mulxU64(&x36, &x37, x32, 0xffffffffffffffff);
	1012	var x38: u64 = undefined;
	1013	var x39: u64 = undefined;
	1014	mulxU64(&x38, &x39, x32, 0xbce6faada7179e84);
	1015	var x40: u64 = undefined;
	1016	var x41: u64 = undefined;
	1017	mulxU64(&x40, &x41, x32, 0xf3b9cac2fc632551);
	1018	var x42: u64 = undefined;
	1019	var x43: u1 = undefined;
	1020	addcarryxU64(&x42, &x43, 0x0, x41, x38);
	1021	var x44: u64 = undefined;
	1022	var x45: u1 = undefined;
	1023	addcarryxU64(&x44, &x45, x43, x39, x36);
	1024	var x46: u64 = undefined;
	1025	var x47: u1 = undefined;
	1026	addcarryxU64(&x46, &x47, x45, x37, x34);
	1027	var x48: u64 = undefined;
	1028	var x49: u1 = undefined;
	1029	addcarryxU64(&x48, &x49, 0x0, x26, x40);
	1030	var x50: u64 = undefined;
	1031	var x51: u1 = undefined;
	1032	addcarryxU64(&x50, &x51, x49, x28, x42);
	1033	var x52: u64 = undefined;
	1034	var x53: u1 = undefined;
	1035	addcarryxU64(&x52, &x53, x51, x30, x44);
	1036	var x54: u64 = undefined;
	1037	var x55: u1 = undefined;
	1038	addcarryxU64(&x54, &x55, x53, (cast(u64, x31) + (cast(u64, x25) + (cast(u64, x17) + x5))), x46);
	1039	var x56: u64 = undefined;
	1040	var x57: u1 = undefined;
	1041	addcarryxU64(&x56, &x57, 0x0, x50, (arg1[2]));
	1042	var x58: u64 = undefined;
	1043	var x59: u1 = undefined;
	1044	addcarryxU64(&x58, &x59, x57, x52, cast(u64, 0x0));
	1045	var x60: u64 = undefined;
	1046	var x61: u1 = undefined;
	1047	addcarryxU64(&x60, &x61, x59, x54, cast(u64, 0x0));
	1048	var x62: u64 = undefined;
	1049	var x63: u64 = undefined;
	1050	mulxU64(&x62, &x63, x56, 0xccd1c8aaee00bc4f);
	1051	var x64: u64 = undefined;
	1052	var x65: u64 = undefined;
	1053	mulxU64(&x64, &x65, x62, 0xffffffff00000000);
	1054	var x66: u64 = undefined;
	1055	var x67: u64 = undefined;
	1056	mulxU64(&x66, &x67, x62, 0xffffffffffffffff);
	1057	var x68: u64 = undefined;
	1058	var x69: u64 = undefined;
	1059	mulxU64(&x68, &x69, x62, 0xbce6faada7179e84);
	1060	var x70: u64 = undefined;
	1061	var x71: u64 = undefined;
	1062	mulxU64(&x70, &x71, x62, 0xf3b9cac2fc632551);
	1063	var x72: u64 = undefined;
	1064	var x73: u1 = undefined;
	1065	addcarryxU64(&x72, &x73, 0x0, x71, x68);
	1066	var x74: u64 = undefined;
	1067	var x75: u1 = undefined;
	1068	addcarryxU64(&x74, &x75, x73, x69, x66);
	1069	var x76: u64 = undefined;
	1070	var x77: u1 = undefined;
	1071	addcarryxU64(&x76, &x77, x75, x67, x64);
	1072	var x78: u64 = undefined;
	1073	var x79: u1 = undefined;
	1074	addcarryxU64(&x78, &x79, 0x0, x56, x70);
	1075	var x80: u64 = undefined;
	1076	var x81: u1 = undefined;
	1077	addcarryxU64(&x80, &x81, x79, x58, x72);
	1078	var x82: u64 = undefined;
	1079	var x83: u1 = undefined;
	1080	addcarryxU64(&x82, &x83, x81, x60, x74);
	1081	var x84: u64 = undefined;
	1082	var x85: u1 = undefined;
	1083	addcarryxU64(&x84, &x85, x83, (cast(u64, x61) + (cast(u64, x55) + (cast(u64, x47) + x35))), x76);
	1084	var x86: u64 = undefined;
	1085	var x87: u1 = undefined;
	1086	addcarryxU64(&x86, &x87, 0x0, x80, (arg1[3]));
	1087	var x88: u64 = undefined;
	1088	var x89: u1 = undefined;
	1089	addcarryxU64(&x88, &x89, x87, x82, cast(u64, 0x0));
	1090	var x90: u64 = undefined;
	1091	var x91: u1 = undefined;
	1092	addcarryxU64(&x90, &x91, x89, x84, cast(u64, 0x0));
	1093	var x92: u64 = undefined;
	1094	var x93: u64 = undefined;
	1095	mulxU64(&x92, &x93, x86, 0xccd1c8aaee00bc4f);
	1096	var x94: u64 = undefined;
	1097	var x95: u64 = undefined;
	1098	mulxU64(&x94, &x95, x92, 0xffffffff00000000);
	1099	var x96: u64 = undefined;
	1100	var x97: u64 = undefined;
	1101	mulxU64(&x96, &x97, x92, 0xffffffffffffffff);
	1102	var x98: u64 = undefined;
	1103	var x99: u64 = undefined;
	1104	mulxU64(&x98, &x99, x92, 0xbce6faada7179e84);
	1105	var x100: u64 = undefined;
	1106	var x101: u64 = undefined;
	1107	mulxU64(&x100, &x101, x92, 0xf3b9cac2fc632551);
	1108	var x102: u64 = undefined;
	1109	var x103: u1 = undefined;
	1110	addcarryxU64(&x102, &x103, 0x0, x101, x98);
	1111	var x104: u64 = undefined;
	1112	var x105: u1 = undefined;
	1113	addcarryxU64(&x104, &x105, x103, x99, x96);
	1114	var x106: u64 = undefined;
	1115	var x107: u1 = undefined;
	1116	addcarryxU64(&x106, &x107, x105, x97, x94);
	1117	var x108: u64 = undefined;
	1118	var x109: u1 = undefined;
	1119	addcarryxU64(&x108, &x109, 0x0, x86, x100);
	1120	var x110: u64 = undefined;
	1121	var x111: u1 = undefined;
	1122	addcarryxU64(&x110, &x111, x109, x88, x102);
	1123	var x112: u64 = undefined;
	1124	var x113: u1 = undefined;
	1125	addcarryxU64(&x112, &x113, x111, x90, x104);
	1126	var x114: u64 = undefined;
	1127	var x115: u1 = undefined;
	1128	addcarryxU64(&x114, &x115, x113, (cast(u64, x91) + (cast(u64, x85) + (cast(u64, x77) + x65))), x106);
	1129	const x116 = (cast(u64, x115) + (cast(u64, x107) + x95));
	1130	var x117: u64 = undefined;
	1131	var x118: u1 = undefined;
	1132	subborrowxU64(&x117, &x118, 0x0, x110, 0xf3b9cac2fc632551);
	1133	var x119: u64 = undefined;
	1134	var x120: u1 = undefined;
	1135	subborrowxU64(&x119, &x120, x118, x112, 0xbce6faada7179e84);
	1136	var x121: u64 = undefined;
	1137	var x122: u1 = undefined;
	1138	subborrowxU64(&x121, &x122, x120, x114, 0xffffffffffffffff);
	1139	var x123: u64 = undefined;
	1140	var x124: u1 = undefined;
	1141	subborrowxU64(&x123, &x124, x122, x116, 0xffffffff00000000);
	1142	var x125: u64 = undefined;
	1143	var x126: u1 = undefined;
	1144	subborrowxU64(&x125, &x126, x124, cast(u64, 0x0), cast(u64, 0x0));
	1145	var x127: u64 = undefined;
	1146	cmovznzU64(&x127, x126, x117, x110);
	1147	var x128: u64 = undefined;
	1148	cmovznzU64(&x128, x126, x119, x112);
	1149	var x129: u64 = undefined;
	1150	cmovznzU64(&x129, x126, x121, x114);
	1151	var x130: u64 = undefined;
	1152	cmovznzU64(&x130, x126, x123, x116);
	1153	out1[0] = x127;
	1154	out1[1] = x128;
	1155	out1[2] = x129;
	1156	out1[3] = x130;
	1157	}
	1158
	1159	/// The function toMontgomery translates a field element into the Montgomery domain.
	1160	/// Preconditions:
	1161	/// 0 ≤ eval arg1 < m
	1162	/// Postconditions:
	1163	/// eval (from_montgomery out1) mod m = eval arg1 mod m
	1164	/// 0 ≤ eval out1 < m
	1165	///
	1166	/// Input Bounds:
	1167	/// arg1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
	1168	/// Output Bounds:
	1169	/// out1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
	1170	pub fn toMontgomery(out1: *[4]u64, arg1: [4]u64) void {
	1171	@setRuntimeSafety(mode == .Debug);
	1172
	1173	const x1 = (arg1[1]);
	1174	const x2 = (arg1[2]);
	1175	const x3 = (arg1[3]);
	1176	const x4 = (arg1[0]);
	1177	var x5: u64 = undefined;
	1178	var x6: u64 = undefined;
	1179	mulxU64(&x5, &x6, x4, 0x66e12d94f3d95620);
	1180	var x7: u64 = undefined;
	1181	var x8: u64 = undefined;
	1182	mulxU64(&x7, &x8, x4, 0x2845b2392b6bec59);
	1183	var x9: u64 = undefined;
	1184	var x10: u64 = undefined;
	1185	mulxU64(&x9, &x10, x4, 0x4699799c49bd6fa6);
	1186	var x11: u64 = undefined;
	1187	var x12: u64 = undefined;
	1188	mulxU64(&x11, &x12, x4, 0x83244c95be79eea2);
	1189	var x13: u64 = undefined;
	1190	var x14: u1 = undefined;
	1191	addcarryxU64(&x13, &x14, 0x0, x12, x9);
	1192	var x15: u64 = undefined;
	1193	var x16: u1 = undefined;
	1194	addcarryxU64(&x15, &x16, x14, x10, x7);
	1195	var x17: u64 = undefined;
	1196	var x18: u1 = undefined;
	1197	addcarryxU64(&x17, &x18, x16, x8, x5);
	1198	var x19: u64 = undefined;
	1199	var x20: u64 = undefined;
	1200	mulxU64(&x19, &x20, x11, 0xccd1c8aaee00bc4f);
	1201	var x21: u64 = undefined;
	1202	var x22: u64 = undefined;
	1203	mulxU64(&x21, &x22, x19, 0xffffffff00000000);
	1204	var x23: u64 = undefined;
	1205	var x24: u64 = undefined;
	1206	mulxU64(&x23, &x24, x19, 0xffffffffffffffff);
	1207	var x25: u64 = undefined;
	1208	var x26: u64 = undefined;
	1209	mulxU64(&x25, &x26, x19, 0xbce6faada7179e84);
	1210	var x27: u64 = undefined;
	1211	var x28: u64 = undefined;
	1212	mulxU64(&x27, &x28, x19, 0xf3b9cac2fc632551);
	1213	var x29: u64 = undefined;
	1214	var x30: u1 = undefined;
	1215	addcarryxU64(&x29, &x30, 0x0, x28, x25);
	1216	var x31: u64 = undefined;
	1217	var x32: u1 = undefined;
	1218	addcarryxU64(&x31, &x32, x30, x26, x23);
	1219	var x33: u64 = undefined;
	1220	var x34: u1 = undefined;
	1221	addcarryxU64(&x33, &x34, x32, x24, x21);
	1222	var x35: u64 = undefined;
	1223	var x36: u1 = undefined;
	1224	addcarryxU64(&x35, &x36, 0x0, x11, x27);
	1225	var x37: u64 = undefined;
	1226	var x38: u1 = undefined;
	1227	addcarryxU64(&x37, &x38, x36, x13, x29);
	1228	var x39: u64 = undefined;
	1229	var x40: u1 = undefined;
	1230	addcarryxU64(&x39, &x40, x38, x15, x31);
	1231	var x41: u64 = undefined;
	1232	var x42: u1 = undefined;
	1233	addcarryxU64(&x41, &x42, x40, x17, x33);
	1234	var x43: u64 = undefined;
	1235	var x44: u1 = undefined;
	1236	addcarryxU64(&x43, &x44, x42, (cast(u64, x18) + x6), (cast(u64, x34) + x22));
	1237	var x45: u64 = undefined;
	1238	var x46: u64 = undefined;
	1239	mulxU64(&x45, &x46, x1, 0x66e12d94f3d95620);
	1240	var x47: u64 = undefined;
	1241	var x48: u64 = undefined;
	1242	mulxU64(&x47, &x48, x1, 0x2845b2392b6bec59);
	1243	var x49: u64 = undefined;
	1244	var x50: u64 = undefined;
	1245	mulxU64(&x49, &x50, x1, 0x4699799c49bd6fa6);
	1246	var x51: u64 = undefined;
	1247	var x52: u64 = undefined;
	1248	mulxU64(&x51, &x52, x1, 0x83244c95be79eea2);
	1249	var x53: u64 = undefined;
	1250	var x54: u1 = undefined;
	1251	addcarryxU64(&x53, &x54, 0x0, x52, x49);
	1252	var x55: u64 = undefined;
	1253	var x56: u1 = undefined;
	1254	addcarryxU64(&x55, &x56, x54, x50, x47);
	1255	var x57: u64 = undefined;
	1256	var x58: u1 = undefined;
	1257	addcarryxU64(&x57, &x58, x56, x48, x45);
	1258	var x59: u64 = undefined;
	1259	var x60: u1 = undefined;
	1260	addcarryxU64(&x59, &x60, 0x0, x37, x51);
	1261	var x61: u64 = undefined;
	1262	var x62: u1 = undefined;
	1263	addcarryxU64(&x61, &x62, x60, x39, x53);
	1264	var x63: u64 = undefined;
	1265	var x64: u1 = undefined;
	1266	addcarryxU64(&x63, &x64, x62, x41, x55);
	1267	var x65: u64 = undefined;
	1268	var x66: u1 = undefined;
	1269	addcarryxU64(&x65, &x66, x64, x43, x57);
	1270	var x67: u64 = undefined;
	1271	var x68: u64 = undefined;
	1272	mulxU64(&x67, &x68, x59, 0xccd1c8aaee00bc4f);
	1273	var x69: u64 = undefined;
	1274	var x70: u64 = undefined;
	1275	mulxU64(&x69, &x70, x67, 0xffffffff00000000);
	1276	var x71: u64 = undefined;
	1277	var x72: u64 = undefined;
	1278	mulxU64(&x71, &x72, x67, 0xffffffffffffffff);
	1279	var x73: u64 = undefined;
	1280	var x74: u64 = undefined;
	1281	mulxU64(&x73, &x74, x67, 0xbce6faada7179e84);
	1282	var x75: u64 = undefined;
	1283	var x76: u64 = undefined;
	1284	mulxU64(&x75, &x76, x67, 0xf3b9cac2fc632551);
	1285	var x77: u64 = undefined;
	1286	var x78: u1 = undefined;
	1287	addcarryxU64(&x77, &x78, 0x0, x76, x73);
	1288	var x79: u64 = undefined;
	1289	var x80: u1 = undefined;
	1290	addcarryxU64(&x79, &x80, x78, x74, x71);
	1291	var x81: u64 = undefined;
	1292	var x82: u1 = undefined;
	1293	addcarryxU64(&x81, &x82, x80, x72, x69);
	1294	var x83: u64 = undefined;
	1295	var x84: u1 = undefined;
	1296	addcarryxU64(&x83, &x84, 0x0, x59, x75);
	1297	var x85: u64 = undefined;
	1298	var x86: u1 = undefined;
	1299	addcarryxU64(&x85, &x86, x84, x61, x77);
	1300	var x87: u64 = undefined;
	1301	var x88: u1 = undefined;
	1302	addcarryxU64(&x87, &x88, x86, x63, x79);
	1303	var x89: u64 = undefined;
	1304	var x90: u1 = undefined;
	1305	addcarryxU64(&x89, &x90, x88, x65, x81);
	1306	var x91: u64 = undefined;
	1307	var x92: u1 = undefined;
	1308	addcarryxU64(&x91, &x92, x90, ((cast(u64, x66) + cast(u64, x44)) + (cast(u64, x58) + x46)), (cast(u64, x82) + x70));
	1309	var x93: u64 = undefined;
	1310	var x94: u64 = undefined;
	1311	mulxU64(&x93, &x94, x2, 0x66e12d94f3d95620);
	1312	var x95: u64 = undefined;
	1313	var x96: u64 = undefined;
	1314	mulxU64(&x95, &x96, x2, 0x2845b2392b6bec59);
	1315	var x97: u64 = undefined;
	1316	var x98: u64 = undefined;
	1317	mulxU64(&x97, &x98, x2, 0x4699799c49bd6fa6);
	1318	var x99: u64 = undefined;
	1319	var x100: u64 = undefined;
	1320	mulxU64(&x99, &x100, x2, 0x83244c95be79eea2);
	1321	var x101: u64 = undefined;
	1322	var x102: u1 = undefined;
	1323	addcarryxU64(&x101, &x102, 0x0, x100, x97);
	1324	var x103: u64 = undefined;
	1325	var x104: u1 = undefined;
	1326	addcarryxU64(&x103, &x104, x102, x98, x95);
	1327	var x105: u64 = undefined;
	1328	var x106: u1 = undefined;
	1329	addcarryxU64(&x105, &x106, x104, x96, x93);
	1330	var x107: u64 = undefined;
	1331	var x108: u1 = undefined;
	1332	addcarryxU64(&x107, &x108, 0x0, x85, x99);
	1333	var x109: u64 = undefined;
	1334	var x110: u1 = undefined;
	1335	addcarryxU64(&x109, &x110, x108, x87, x101);
	1336	var x111: u64 = undefined;
	1337	var x112: u1 = undefined;
	1338	addcarryxU64(&x111, &x112, x110, x89, x103);
	1339	var x113: u64 = undefined;
	1340	var x114: u1 = undefined;
	1341	addcarryxU64(&x113, &x114, x112, x91, x105);
	1342	var x115: u64 = undefined;
	1343	var x116: u64 = undefined;
	1344	mulxU64(&x115, &x116, x107, 0xccd1c8aaee00bc4f);
	1345	var x117: u64 = undefined;
	1346	var x118: u64 = undefined;
	1347	mulxU64(&x117, &x118, x115, 0xffffffff00000000);
	1348	var x119: u64 = undefined;
	1349	var x120: u64 = undefined;
	1350	mulxU64(&x119, &x120, x115, 0xffffffffffffffff);
	1351	var x121: u64 = undefined;
	1352	var x122: u64 = undefined;
	1353	mulxU64(&x121, &x122, x115, 0xbce6faada7179e84);
	1354	var x123: u64 = undefined;
	1355	var x124: u64 = undefined;
	1356	mulxU64(&x123, &x124, x115, 0xf3b9cac2fc632551);
	1357	var x125: u64 = undefined;
	1358	var x126: u1 = undefined;
	1359	addcarryxU64(&x125, &x126, 0x0, x124, x121);
	1360	var x127: u64 = undefined;
	1361	var x128: u1 = undefined;
	1362	addcarryxU64(&x127, &x128, x126, x122, x119);
	1363	var x129: u64 = undefined;
	1364	var x130: u1 = undefined;
	1365	addcarryxU64(&x129, &x130, x128, x120, x117);
	1366	var x131: u64 = undefined;
	1367	var x132: u1 = undefined;
	1368	addcarryxU64(&x131, &x132, 0x0, x107, x123);
	1369	var x133: u64 = undefined;
	1370	var x134: u1 = undefined;
	1371	addcarryxU64(&x133, &x134, x132, x109, x125);
	1372	var x135: u64 = undefined;
	1373	var x136: u1 = undefined;
	1374	addcarryxU64(&x135, &x136, x134, x111, x127);
	1375	var x137: u64 = undefined;
	1376	var x138: u1 = undefined;
	1377	addcarryxU64(&x137, &x138, x136, x113, x129);
	1378	var x139: u64 = undefined;
	1379	var x140: u1 = undefined;
	1380	addcarryxU64(&x139, &x140, x138, ((cast(u64, x114) + cast(u64, x92)) + (cast(u64, x106) + x94)), (cast(u64, x130) + x118));
	1381	var x141: u64 = undefined;
	1382	var x142: u64 = undefined;
	1383	mulxU64(&x141, &x142, x3, 0x66e12d94f3d95620);
	1384	var x143: u64 = undefined;
	1385	var x144: u64 = undefined;
	1386	mulxU64(&x143, &x144, x3, 0x2845b2392b6bec59);
	1387	var x145: u64 = undefined;
	1388	var x146: u64 = undefined;
	1389	mulxU64(&x145, &x146, x3, 0x4699799c49bd6fa6);
	1390	var x147: u64 = undefined;
	1391	var x148: u64 = undefined;
	1392	mulxU64(&x147, &x148, x3, 0x83244c95be79eea2);
	1393	var x149: u64 = undefined;
	1394	var x150: u1 = undefined;
	1395	addcarryxU64(&x149, &x150, 0x0, x148, x145);
	1396	var x151: u64 = undefined;
	1397	var x152: u1 = undefined;
	1398	addcarryxU64(&x151, &x152, x150, x146, x143);
	1399	var x153: u64 = undefined;
	1400	var x154: u1 = undefined;
	1401	addcarryxU64(&x153, &x154, x152, x144, x141);
	1402	var x155: u64 = undefined;
	1403	var x156: u1 = undefined;
	1404	addcarryxU64(&x155, &x156, 0x0, x133, x147);
	1405	var x157: u64 = undefined;
	1406	var x158: u1 = undefined;
	1407	addcarryxU64(&x157, &x158, x156, x135, x149);
	1408	var x159: u64 = undefined;
	1409	var x160: u1 = undefined;
	1410	addcarryxU64(&x159, &x160, x158, x137, x151);
	1411	var x161: u64 = undefined;
	1412	var x162: u1 = undefined;
	1413	addcarryxU64(&x161, &x162, x160, x139, x153);
	1414	var x163: u64 = undefined;
	1415	var x164: u64 = undefined;
	1416	mulxU64(&x163, &x164, x155, 0xccd1c8aaee00bc4f);
	1417	var x165: u64 = undefined;
	1418	var x166: u64 = undefined;
	1419	mulxU64(&x165, &x166, x163, 0xffffffff00000000);
	1420	var x167: u64 = undefined;
	1421	var x168: u64 = undefined;
	1422	mulxU64(&x167, &x168, x163, 0xffffffffffffffff);
	1423	var x169: u64 = undefined;
	1424	var x170: u64 = undefined;
	1425	mulxU64(&x169, &x170, x163, 0xbce6faada7179e84);
	1426	var x171: u64 = undefined;
	1427	var x172: u64 = undefined;
	1428	mulxU64(&x171, &x172, x163, 0xf3b9cac2fc632551);
	1429	var x173: u64 = undefined;
	1430	var x174: u1 = undefined;
	1431	addcarryxU64(&x173, &x174, 0x0, x172, x169);
	1432	var x175: u64 = undefined;
	1433	var x176: u1 = undefined;
	1434	addcarryxU64(&x175, &x176, x174, x170, x167);
	1435	var x177: u64 = undefined;
	1436	var x178: u1 = undefined;
	1437	addcarryxU64(&x177, &x178, x176, x168, x165);
	1438	var x179: u64 = undefined;
	1439	var x180: u1 = undefined;
	1440	addcarryxU64(&x179, &x180, 0x0, x155, x171);
	1441	var x181: u64 = undefined;
	1442	var x182: u1 = undefined;
	1443	addcarryxU64(&x181, &x182, x180, x157, x173);
	1444	var x183: u64 = undefined;
	1445	var x184: u1 = undefined;
	1446	addcarryxU64(&x183, &x184, x182, x159, x175);
	1447	var x185: u64 = undefined;
	1448	var x186: u1 = undefined;
	1449	addcarryxU64(&x185, &x186, x184, x161, x177);
	1450	var x187: u64 = undefined;
	1451	var x188: u1 = undefined;
	1452	addcarryxU64(&x187, &x188, x186, ((cast(u64, x162) + cast(u64, x140)) + (cast(u64, x154) + x142)), (cast(u64, x178) + x166));
	1453	var x189: u64 = undefined;
	1454	var x190: u1 = undefined;
	1455	subborrowxU64(&x189, &x190, 0x0, x181, 0xf3b9cac2fc632551);
	1456	var x191: u64 = undefined;
	1457	var x192: u1 = undefined;
	1458	subborrowxU64(&x191, &x192, x190, x183, 0xbce6faada7179e84);
	1459	var x193: u64 = undefined;
	1460	var x194: u1 = undefined;
	1461	subborrowxU64(&x193, &x194, x192, x185, 0xffffffffffffffff);
	1462	var x195: u64 = undefined;
	1463	var x196: u1 = undefined;
	1464	subborrowxU64(&x195, &x196, x194, x187, 0xffffffff00000000);
	1465	var x197: u64 = undefined;
	1466	var x198: u1 = undefined;
	1467	subborrowxU64(&x197, &x198, x196, cast(u64, x188), cast(u64, 0x0));
	1468	var x199: u64 = undefined;
	1469	cmovznzU64(&x199, x198, x189, x181);
	1470	var x200: u64 = undefined;
	1471	cmovznzU64(&x200, x198, x191, x183);
	1472	var x201: u64 = undefined;
	1473	cmovznzU64(&x201, x198, x193, x185);
	1474	var x202: u64 = undefined;
	1475	cmovznzU64(&x202, x198, x195, x187);
	1476	out1[0] = x199;
	1477	out1[1] = x200;
	1478	out1[2] = x201;
	1479	out1[3] = x202;
	1480	}
	1481
	1482	/// The function nonzero outputs a single non-zero word if the input is non-zero and zero otherwise.
	1483	/// Preconditions:
	1484	/// 0 ≤ eval arg1 < m
	1485	/// Postconditions:
	1486	/// out1 = 0 ↔ eval (from_montgomery arg1) mod m = 0
	1487	///
	1488	/// Input Bounds:
	1489	/// arg1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
	1490	/// Output Bounds:
	1491	/// out1: [0x0 ~> 0xffffffffffffffff]
	1492	pub fn nonzero(out1: *u64, arg1: [4]u64) void {
	1493	@setRuntimeSafety(mode == .Debug);
	1494
	1495	const x1 = ((arg1[0]) \| ((arg1[1]) \| ((arg1[2]) \| (arg1[3]))));
	1496	out1.* = x1;
	1497	}
	1498
	1499	/// The function selectznz is a multi-limb conditional select.
	1500	/// Postconditions:
	1501	/// eval out1 = (if arg1 = 0 then eval arg2 else eval arg3)
	1502	///
	1503	/// Input Bounds:
	1504	/// arg1: [0x0 ~> 0x1]
	1505	/// arg2: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
	1506	/// arg3: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
	1507	/// Output Bounds:
	1508	/// out1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
	1509	pub fn selectznz(out1: *[4]u64, arg1: u1, arg2: [4]u64, arg3: [4]u64) void {
	1510	@setRuntimeSafety(mode == .Debug);
	1511
	1512	var x1: u64 = undefined;
	1513	cmovznzU64(&x1, arg1, (arg2[0]), (arg3[0]));
	1514	var x2: u64 = undefined;
	1515	cmovznzU64(&x2, arg1, (arg2[1]), (arg3[1]));
	1516	var x3: u64 = undefined;
	1517	cmovznzU64(&x3, arg1, (arg2[2]), (arg3[2]));
	1518	var x4: u64 = undefined;
	1519	cmovznzU64(&x4, arg1, (arg2[3]), (arg3[3]));
	1520	out1[0] = x1;
	1521	out1[1] = x2;
	1522	out1[2] = x3;
	1523	out1[3] = x4;
	1524	}
	1525
	1526	/// The function toBytes serializes a field element NOT in the Montgomery domain to bytes in little-endian order.
	1527	/// Preconditions:
	1528	/// 0 ≤ eval arg1 < m
	1529	/// Postconditions:
	1530	/// out1 = map (λ x, ⌊((eval arg1 mod m) mod 2^(8 * (x + 1))) / 2^(8 * x)⌋) [0..31]
	1531	///
	1532	/// Input Bounds:
	1533	/// arg1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
	1534	/// Output Bounds:
	1535	/// out1: [[0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff]]
	1536	pub fn toBytes(out1: *[32]u8, arg1: [4]u64) void {
	1537	@setRuntimeSafety(mode == .Debug);
	1538
	1539	const x1 = (arg1[3]);
	1540	const x2 = (arg1[2]);
	1541	const x3 = (arg1[1]);
	1542	const x4 = (arg1[0]);
	1543	const x5 = cast(u8, (x4 & cast(u64, 0xff)));
	1544	const x6 = (x4 >> 8);
	1545	const x7 = cast(u8, (x6 & cast(u64, 0xff)));
	1546	const x8 = (x6 >> 8);
	1547	const x9 = cast(u8, (x8 & cast(u64, 0xff)));
	1548	const x10 = (x8 >> 8);
	1549	const x11 = cast(u8, (x10 & cast(u64, 0xff)));
	1550	const x12 = (x10 >> 8);
	1551	const x13 = cast(u8, (x12 & cast(u64, 0xff)));
	1552	const x14 = (x12 >> 8);
	1553	const x15 = cast(u8, (x14 & cast(u64, 0xff)));
	1554	const x16 = (x14 >> 8);
	1555	const x17 = cast(u8, (x16 & cast(u64, 0xff)));
	1556	const x18 = cast(u8, (x16 >> 8));
	1557	const x19 = cast(u8, (x3 & cast(u64, 0xff)));
	1558	const x20 = (x3 >> 8);
	1559	const x21 = cast(u8, (x20 & cast(u64, 0xff)));
	1560	const x22 = (x20 >> 8);
	1561	const x23 = cast(u8, (x22 & cast(u64, 0xff)));
	1562	const x24 = (x22 >> 8);
	1563	const x25 = cast(u8, (x24 & cast(u64, 0xff)));
	1564	const x26 = (x24 >> 8);
	1565	const x27 = cast(u8, (x26 & cast(u64, 0xff)));
	1566	const x28 = (x26 >> 8);
	1567	const x29 = cast(u8, (x28 & cast(u64, 0xff)));
	1568	const x30 = (x28 >> 8);
	1569	const x31 = cast(u8, (x30 & cast(u64, 0xff)));
	1570	const x32 = cast(u8, (x30 >> 8));
	1571	const x33 = cast(u8, (x2 & cast(u64, 0xff)));
	1572	const x34 = (x2 >> 8);
	1573	const x35 = cast(u8, (x34 & cast(u64, 0xff)));
	1574	const x36 = (x34 >> 8);
	1575	const x37 = cast(u8, (x36 & cast(u64, 0xff)));
	1576	const x38 = (x36 >> 8);
	1577	const x39 = cast(u8, (x38 & cast(u64, 0xff)));
	1578	const x40 = (x38 >> 8);
	1579	const x41 = cast(u8, (x40 & cast(u64, 0xff)));
	1580	const x42 = (x40 >> 8);
	1581	const x43 = cast(u8, (x42 & cast(u64, 0xff)));
	1582	const x44 = (x42 >> 8);
	1583	const x45 = cast(u8, (x44 & cast(u64, 0xff)));
	1584	const x46 = cast(u8, (x44 >> 8));
	1585	const x47 = cast(u8, (x1 & cast(u64, 0xff)));
	1586	const x48 = (x1 >> 8);
	1587	const x49 = cast(u8, (x48 & cast(u64, 0xff)));
	1588	const x50 = (x48 >> 8);
	1589	const x51 = cast(u8, (x50 & cast(u64, 0xff)));
	1590	const x52 = (x50 >> 8);
	1591	const x53 = cast(u8, (x52 & cast(u64, 0xff)));
	1592	const x54 = (x52 >> 8);
	1593	const x55 = cast(u8, (x54 & cast(u64, 0xff)));
	1594	const x56 = (x54 >> 8);
	1595	const x57 = cast(u8, (x56 & cast(u64, 0xff)));
	1596	const x58 = (x56 >> 8);
	1597	const x59 = cast(u8, (x58 & cast(u64, 0xff)));
	1598	const x60 = cast(u8, (x58 >> 8));
	1599	out1[0] = x5;
	1600	out1[1] = x7;
	1601	out1[2] = x9;
	1602	out1[3] = x11;
	1603	out1[4] = x13;
	1604	out1[5] = x15;
	1605	out1[6] = x17;
	1606	out1[7] = x18;
	1607	out1[8] = x19;
	1608	out1[9] = x21;
	1609	out1[10] = x23;
	1610	out1[11] = x25;
	1611	out1[12] = x27;
	1612	out1[13] = x29;
	1613	out1[14] = x31;
	1614	out1[15] = x32;
	1615	out1[16] = x33;
	1616	out1[17] = x35;
	1617	out1[18] = x37;
	1618	out1[19] = x39;
	1619	out1[20] = x41;
	1620	out1[21] = x43;
	1621	out1[22] = x45;
	1622	out1[23] = x46;
	1623	out1[24] = x47;
	1624	out1[25] = x49;
	1625	out1[26] = x51;
	1626	out1[27] = x53;
	1627	out1[28] = x55;
	1628	out1[29] = x57;
	1629	out1[30] = x59;
	1630	out1[31] = x60;
	1631	}
	1632
	1633	/// The function fromBytes deserializes a field element NOT in the Montgomery domain from bytes in little-endian order.
	1634	/// Preconditions:
	1635	/// 0 ≤ bytes_eval arg1 < m
	1636	/// Postconditions:
	1637	/// eval out1 mod m = bytes_eval arg1 mod m
	1638	/// 0 ≤ eval out1 < m
	1639	///
	1640	/// Input Bounds:
	1641	/// arg1: [[0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff]]
	1642	/// Output Bounds:
	1643	/// out1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
	1644	pub fn fromBytes(out1: *[4]u64, arg1: [32]u8) void {
	1645	@setRuntimeSafety(mode == .Debug);
	1646
	1647	const x1 = (cast(u64, (arg1[31])) << 56);
	1648	const x2 = (cast(u64, (arg1[30])) << 48);
	1649	const x3 = (cast(u64, (arg1[29])) << 40);
	1650	const x4 = (cast(u64, (arg1[28])) << 32);
	1651	const x5 = (cast(u64, (arg1[27])) << 24);
	1652	const x6 = (cast(u64, (arg1[26])) << 16);
	1653	const x7 = (cast(u64, (arg1[25])) << 8);
	1654	const x8 = (arg1[24]);
	1655	const x9 = (cast(u64, (arg1[23])) << 56);
	1656	const x10 = (cast(u64, (arg1[22])) << 48);
	1657	const x11 = (cast(u64, (arg1[21])) << 40);
	1658	const x12 = (cast(u64, (arg1[20])) << 32);
	1659	const x13 = (cast(u64, (arg1[19])) << 24);
	1660	const x14 = (cast(u64, (arg1[18])) << 16);
	1661	const x15 = (cast(u64, (arg1[17])) << 8);
	1662	const x16 = (arg1[16]);
	1663	const x17 = (cast(u64, (arg1[15])) << 56);
	1664	const x18 = (cast(u64, (arg1[14])) << 48);
	1665	const x19 = (cast(u64, (arg1[13])) << 40);
	1666	const x20 = (cast(u64, (arg1[12])) << 32);
	1667	const x21 = (cast(u64, (arg1[11])) << 24);
	1668	const x22 = (cast(u64, (arg1[10])) << 16);
	1669	const x23 = (cast(u64, (arg1[9])) << 8);
	1670	const x24 = (arg1[8]);
	1671	const x25 = (cast(u64, (arg1[7])) << 56);
	1672	const x26 = (cast(u64, (arg1[6])) << 48);
	1673	const x27 = (cast(u64, (arg1[5])) << 40);
	1674	const x28 = (cast(u64, (arg1[4])) << 32);
	1675	const x29 = (cast(u64, (arg1[3])) << 24);
	1676	const x30 = (cast(u64, (arg1[2])) << 16);
	1677	const x31 = (cast(u64, (arg1[1])) << 8);
	1678	const x32 = (arg1[0]);
	1679	const x33 = (x31 + cast(u64, x32));
	1680	const x34 = (x30 + x33);
	1681	const x35 = (x29 + x34);
	1682	const x36 = (x28 + x35);
	1683	const x37 = (x27 + x36);
	1684	const x38 = (x26 + x37);
	1685	const x39 = (x25 + x38);
	1686	const x40 = (x23 + cast(u64, x24));
	1687	const x41 = (x22 + x40);
	1688	const x42 = (x21 + x41);
	1689	const x43 = (x20 + x42);
	1690	const x44 = (x19 + x43);
	1691	const x45 = (x18 + x44);
	1692	const x46 = (x17 + x45);
	1693	const x47 = (x15 + cast(u64, x16));
	1694	const x48 = (x14 + x47);
	1695	const x49 = (x13 + x48);
	1696	const x50 = (x12 + x49);
	1697	const x51 = (x11 + x50);
	1698	const x52 = (x10 + x51);
	1699	const x53 = (x9 + x52);
	1700	const x54 = (x7 + cast(u64, x8));
	1701	const x55 = (x6 + x54);
	1702	const x56 = (x5 + x55);
	1703	const x57 = (x4 + x56);
	1704	const x58 = (x3 + x57);
	1705	const x59 = (x2 + x58);
	1706	const x60 = (x1 + x59);
	1707	out1[0] = x39;
	1708	out1[1] = x46;
	1709	out1[2] = x53;
	1710	out1[3] = x60;
	1711	}
	1712
	1713	/// The function setOne returns the field element one in the Montgomery domain.
	1714	/// Postconditions:
	1715	/// eval (from_montgomery out1) mod m = 1 mod m
	1716	/// 0 ≤ eval out1 < m
	1717	///
	1718	/// Input Bounds:
	1719	/// Output Bounds:
	1720	/// out1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
	1721	pub fn setOne(out1: *[4]u64) void {
	1722	@setRuntimeSafety(mode == .Debug);
	1723
	1724	out1[0] = 0xc46353d039cdaaf;
	1725	out1[1] = 0x4319055258e8617b;
	1726	out1[2] = cast(u64, 0x0);
	1727	out1[3] = 0xffffffff;
	1728	}
	1729
	1730	/// The function msat returns the saturated representation of the prime modulus.
	1731	/// Postconditions:
	1732	/// twos_complement_eval out1 = m
	1733	/// 0 ≤ eval out1 < m
	1734	///
	1735	/// Input Bounds:
	1736	/// Output Bounds:
	1737	/// out1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
	1738	pub fn msat(out1: *[5]u64) void {
	1739	@setRuntimeSafety(mode == .Debug);
	1740
	1741	out1[0] = 0xf3b9cac2fc632551;
	1742	out1[1] = 0xbce6faada7179e84;
	1743	out1[2] = 0xffffffffffffffff;
	1744	out1[3] = 0xffffffff00000000;
	1745	out1[4] = cast(u64, 0x0);
	1746	}
	1747
	1748	/// The function divstepPrecomp returns the precomputed value for Bernstein-Yang-inversion (in montgomery form).
	1749	/// Postconditions:
	1750	/// eval (from_montgomery out1) = ⌊(m - 1) / 2⌋^(if (log2 m) + 1 < 46 then ⌊(49 * ((log2 m) + 1) + 80) / 17⌋ else ⌊(49 * ((log2 m) + 1) + 57) / 17⌋)
	1751	/// 0 ≤ eval out1 < m
	1752	///
	1753	/// Input Bounds:
	1754	/// Output Bounds:
	1755	/// out1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
	1756	pub fn divstepPrecomp(out1: *[4]u64) void {
	1757	@setRuntimeSafety(mode == .Debug);
	1758
	1759	out1[0] = 0xd739262fb7fcfbb5;
	1760	out1[1] = 0x8ac6f75d20074414;
	1761	out1[2] = 0xc67428bfb5e3c256;
	1762	out1[3] = 0x444962f2eda7aedf;
	1763	}
	1764
	1765	/// The function divstep computes a divstep.
	1766	/// Preconditions:
	1767	/// 0 ≤ eval arg4 < m
	1768	/// 0 ≤ eval arg5 < m
	1769	/// Postconditions:
	1770	/// out1 = (if 0 < arg1 ∧ (twos_complement_eval arg3) is odd then 1 - arg1 else 1 + arg1)
	1771	/// twos_complement_eval out2 = (if 0 < arg1 ∧ (twos_complement_eval arg3) is odd then twos_complement_eval arg3 else twos_complement_eval arg2)
	1772	/// twos_complement_eval out3 = (if 0 < arg1 ∧ (twos_complement_eval arg3) is odd then ⌊(twos_complement_eval arg3 - twos_complement_eval arg2) / 2⌋ else ⌊(twos_complement_eval arg3 + (twos_complement_eval arg3 mod 2) * twos_complement_eval arg2) / 2⌋)
	1773	/// eval (from_montgomery out4) mod m = (if 0 < arg1 ∧ (twos_complement_eval arg3) is odd then (2 * eval (from_montgomery arg5)) mod m else (2 * eval (from_montgomery arg4)) mod m)
	1774	/// eval (from_montgomery out5) mod m = (if 0 < arg1 ∧ (twos_complement_eval arg3) is odd then (eval (from_montgomery arg4) - eval (from_montgomery arg4)) mod m else (eval (from_montgomery arg5) + (twos_complement_eval arg3 mod 2) * eval (from_montgomery arg4)) mod m)
	1775	/// 0 ≤ eval out5 < m
	1776	/// 0 ≤ eval out5 < m
	1777	/// 0 ≤ eval out2 < m
	1778	/// 0 ≤ eval out3 < m
	1779	///
	1780	/// Input Bounds:
	1781	/// arg1: [0x0 ~> 0xffffffffffffffff]
	1782	/// arg2: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
	1783	/// arg3: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
	1784	/// arg4: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
	1785	/// arg5: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
	1786	/// Output Bounds:
	1787	/// out1: [0x0 ~> 0xffffffffffffffff]
	1788	/// out2: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
	1789	/// out3: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
	1790	/// out4: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
	1791	/// out5: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
	1792	pub fn divstep(out1: u64, out2: [5]u64, out3: [5]u64, out4: [4]u64, out5: *[4]u64, arg1: u64, arg2: [5]u64, arg3: [5]u64, arg4: [4]u64, arg5: [4]u64) void {
	1793	@setRuntimeSafety(mode == .Debug);
	1794
	1795	var x1: u64 = undefined;
	1796	var x2: u1 = undefined;
	1797	addcarryxU64(&x1, &x2, 0x0, (~arg1), cast(u64, 0x1));
	1798	const x3 = (cast(u1, (x1 >> 63)) & cast(u1, ((arg3[0]) & cast(u64, 0x1))));
	1799	var x4: u64 = undefined;
	1800	var x5: u1 = undefined;
	1801	addcarryxU64(&x4, &x5, 0x0, (~arg1), cast(u64, 0x1));
	1802	var x6: u64 = undefined;
	1803	cmovznzU64(&x6, x3, arg1, x4);
	1804	var x7: u64 = undefined;
	1805	cmovznzU64(&x7, x3, (arg2[0]), (arg3[0]));
	1806	var x8: u64 = undefined;
	1807	cmovznzU64(&x8, x3, (arg2[1]), (arg3[1]));
	1808	var x9: u64 = undefined;
	1809	cmovznzU64(&x9, x3, (arg2[2]), (arg3[2]));
	1810	var x10: u64 = undefined;
	1811	cmovznzU64(&x10, x3, (arg2[3]), (arg3[3]));
	1812	var x11: u64 = undefined;
	1813	cmovznzU64(&x11, x3, (arg2[4]), (arg3[4]));
	1814	var x12: u64 = undefined;
	1815	var x13: u1 = undefined;
	1816	addcarryxU64(&x12, &x13, 0x0, cast(u64, 0x1), (~(arg2[0])));
	1817	var x14: u64 = undefined;
	1818	var x15: u1 = undefined;
	1819	addcarryxU64(&x14, &x15, x13, cast(u64, 0x0), (~(arg2[1])));
	1820	var x16: u64 = undefined;
	1821	var x17: u1 = undefined;
	1822	addcarryxU64(&x16, &x17, x15, cast(u64, 0x0), (~(arg2[2])));
	1823	var x18: u64 = undefined;
	1824	var x19: u1 = undefined;
	1825	addcarryxU64(&x18, &x19, x17, cast(u64, 0x0), (~(arg2[3])));
	1826	var x20: u64 = undefined;
	1827	var x21: u1 = undefined;
	1828	addcarryxU64(&x20, &x21, x19, cast(u64, 0x0), (~(arg2[4])));
	1829	var x22: u64 = undefined;
	1830	cmovznzU64(&x22, x3, (arg3[0]), x12);
	1831	var x23: u64 = undefined;
	1832	cmovznzU64(&x23, x3, (arg3[1]), x14);
	1833	var x24: u64 = undefined;
	1834	cmovznzU64(&x24, x3, (arg3[2]), x16);
	1835	var x25: u64 = undefined;
	1836	cmovznzU64(&x25, x3, (arg3[3]), x18);
	1837	var x26: u64 = undefined;
	1838	cmovznzU64(&x26, x3, (arg3[4]), x20);
	1839	var x27: u64 = undefined;
	1840	cmovznzU64(&x27, x3, (arg4[0]), (arg5[0]));
	1841	var x28: u64 = undefined;
	1842	cmovznzU64(&x28, x3, (arg4[1]), (arg5[1]));
	1843	var x29: u64 = undefined;
	1844	cmovznzU64(&x29, x3, (arg4[2]), (arg5[2]));
	1845	var x30: u64 = undefined;
	1846	cmovznzU64(&x30, x3, (arg4[3]), (arg5[3]));
	1847	var x31: u64 = undefined;
	1848	var x32: u1 = undefined;
	1849	addcarryxU64(&x31, &x32, 0x0, x27, x27);
	1850	var x33: u64 = undefined;
	1851	var x34: u1 = undefined;
	1852	addcarryxU64(&x33, &x34, x32, x28, x28);
	1853	var x35: u64 = undefined;
	1854	var x36: u1 = undefined;
	1855	addcarryxU64(&x35, &x36, x34, x29, x29);
	1856	var x37: u64 = undefined;
	1857	var x38: u1 = undefined;
	1858	addcarryxU64(&x37, &x38, x36, x30, x30);
	1859	var x39: u64 = undefined;
	1860	var x40: u1 = undefined;
	1861	subborrowxU64(&x39, &x40, 0x0, x31, 0xf3b9cac2fc632551);
	1862	var x41: u64 = undefined;
	1863	var x42: u1 = undefined;
	1864	subborrowxU64(&x41, &x42, x40, x33, 0xbce6faada7179e84);
	1865	var x43: u64 = undefined;
	1866	var x44: u1 = undefined;
	1867	subborrowxU64(&x43, &x44, x42, x35, 0xffffffffffffffff);
	1868	var x45: u64 = undefined;
	1869	var x46: u1 = undefined;
	1870	subborrowxU64(&x45, &x46, x44, x37, 0xffffffff00000000);
	1871	var x47: u64 = undefined;
	1872	var x48: u1 = undefined;
	1873	subborrowxU64(&x47, &x48, x46, cast(u64, x38), cast(u64, 0x0));
	1874	const x49 = (arg4[3]);
	1875	const x50 = (arg4[2]);
	1876	const x51 = (arg4[1]);
	1877	const x52 = (arg4[0]);
	1878	var x53: u64 = undefined;
	1879	var x54: u1 = undefined;
	1880	subborrowxU64(&x53, &x54, 0x0, cast(u64, 0x0), x52);
	1881	var x55: u64 = undefined;
	1882	var x56: u1 = undefined;
	1883	subborrowxU64(&x55, &x56, x54, cast(u64, 0x0), x51);
	1884	var x57: u64 = undefined;
	1885	var x58: u1 = undefined;
	1886	subborrowxU64(&x57, &x58, x56, cast(u64, 0x0), x50);
	1887	var x59: u64 = undefined;
	1888	var x60: u1 = undefined;
	1889	subborrowxU64(&x59, &x60, x58, cast(u64, 0x0), x49);
	1890	var x61: u64 = undefined;
	1891	cmovznzU64(&x61, x60, cast(u64, 0x0), 0xffffffffffffffff);
	1892	var x62: u64 = undefined;
	1893	var x63: u1 = undefined;
	1894	addcarryxU64(&x62, &x63, 0x0, x53, (x61 & 0xf3b9cac2fc632551));
	1895	var x64: u64 = undefined;
	1896	var x65: u1 = undefined;
	1897	addcarryxU64(&x64, &x65, x63, x55, (x61 & 0xbce6faada7179e84));
	1898	var x66: u64 = undefined;
	1899	var x67: u1 = undefined;
	1900	addcarryxU64(&x66, &x67, x65, x57, x61);
	1901	var x68: u64 = undefined;
	1902	var x69: u1 = undefined;
	1903	addcarryxU64(&x68, &x69, x67, x59, (x61 & 0xffffffff00000000));
	1904	var x70: u64 = undefined;
	1905	cmovznzU64(&x70, x3, (arg5[0]), x62);
	1906	var x71: u64 = undefined;
	1907	cmovznzU64(&x71, x3, (arg5[1]), x64);
	1908	var x72: u64 = undefined;
	1909	cmovznzU64(&x72, x3, (arg5[2]), x66);
	1910	var x73: u64 = undefined;
	1911	cmovznzU64(&x73, x3, (arg5[3]), x68);
	1912	const x74 = cast(u1, (x22 & cast(u64, 0x1)));
	1913	var x75: u64 = undefined;
	1914	cmovznzU64(&x75, x74, cast(u64, 0x0), x7);
	1915	var x76: u64 = undefined;
	1916	cmovznzU64(&x76, x74, cast(u64, 0x0), x8);
	1917	var x77: u64 = undefined;
	1918	cmovznzU64(&x77, x74, cast(u64, 0x0), x9);
	1919	var x78: u64 = undefined;
	1920	cmovznzU64(&x78, x74, cast(u64, 0x0), x10);
	1921	var x79: u64 = undefined;
	1922	cmovznzU64(&x79, x74, cast(u64, 0x0), x11);
	1923	var x80: u64 = undefined;
	1924	var x81: u1 = undefined;
	1925	addcarryxU64(&x80, &x81, 0x0, x22, x75);
	1926	var x82: u64 = undefined;
	1927	var x83: u1 = undefined;
	1928	addcarryxU64(&x82, &x83, x81, x23, x76);
	1929	var x84: u64 = undefined;
	1930	var x85: u1 = undefined;
	1931	addcarryxU64(&x84, &x85, x83, x24, x77);
	1932	var x86: u64 = undefined;
	1933	var x87: u1 = undefined;
	1934	addcarryxU64(&x86, &x87, x85, x25, x78);
	1935	var x88: u64 = undefined;
	1936	var x89: u1 = undefined;
	1937	addcarryxU64(&x88, &x89, x87, x26, x79);
	1938	var x90: u64 = undefined;
	1939	cmovznzU64(&x90, x74, cast(u64, 0x0), x27);
	1940	var x91: u64 = undefined;
	1941	cmovznzU64(&x91, x74, cast(u64, 0x0), x28);
	1942	var x92: u64 = undefined;
	1943	cmovznzU64(&x92, x74, cast(u64, 0x0), x29);
	1944	var x93: u64 = undefined;
	1945	cmovznzU64(&x93, x74, cast(u64, 0x0), x30);
	1946	var x94: u64 = undefined;
	1947	var x95: u1 = undefined;
	1948	addcarryxU64(&x94, &x95, 0x0, x70, x90);
	1949	var x96: u64 = undefined;
	1950	var x97: u1 = undefined;
	1951	addcarryxU64(&x96, &x97, x95, x71, x91);
	1952	var x98: u64 = undefined;
	1953	var x99: u1 = undefined;
	1954	addcarryxU64(&x98, &x99, x97, x72, x92);
	1955	var x100: u64 = undefined;
	1956	var x101: u1 = undefined;
	1957	addcarryxU64(&x100, &x101, x99, x73, x93);
	1958	var x102: u64 = undefined;
	1959	var x103: u1 = undefined;
	1960	subborrowxU64(&x102, &x103, 0x0, x94, 0xf3b9cac2fc632551);
	1961	var x104: u64 = undefined;
	1962	var x105: u1 = undefined;
	1963	subborrowxU64(&x104, &x105, x103, x96, 0xbce6faada7179e84);
	1964	var x106: u64 = undefined;
	1965	var x107: u1 = undefined;
	1966	subborrowxU64(&x106, &x107, x105, x98, 0xffffffffffffffff);
	1967	var x108: u64 = undefined;
	1968	var x109: u1 = undefined;
	1969	subborrowxU64(&x108, &x109, x107, x100, 0xffffffff00000000);
	1970	var x110: u64 = undefined;
	1971	var x111: u1 = undefined;
	1972	subborrowxU64(&x110, &x111, x109, cast(u64, x101), cast(u64, 0x0));
	1973	var x112: u64 = undefined;
	1974	var x113: u1 = undefined;
	1975	addcarryxU64(&x112, &x113, 0x0, x6, cast(u64, 0x1));
	1976	const x114 = ((x80 >> 1) \| ((x82 << 63) & 0xffffffffffffffff));
	1977	const x115 = ((x82 >> 1) \| ((x84 << 63) & 0xffffffffffffffff));
	1978	const x116 = ((x84 >> 1) \| ((x86 << 63) & 0xffffffffffffffff));
	1979	const x117 = ((x86 >> 1) \| ((x88 << 63) & 0xffffffffffffffff));
	1980	const x118 = ((x88 & 0x8000000000000000) \| (x88 >> 1));
	1981	var x119: u64 = undefined;
	1982	cmovznzU64(&x119, x48, x39, x31);
	1983	var x120: u64 = undefined;
	1984	cmovznzU64(&x120, x48, x41, x33);
	1985	var x121: u64 = undefined;
	1986	cmovznzU64(&x121, x48, x43, x35);
	1987	var x122: u64 = undefined;
	1988	cmovznzU64(&x122, x48, x45, x37);
	1989	var x123: u64 = undefined;
	1990	cmovznzU64(&x123, x111, x102, x94);
	1991	var x124: u64 = undefined;
	1992	cmovznzU64(&x124, x111, x104, x96);
	1993	var x125: u64 = undefined;
	1994	cmovznzU64(&x125, x111, x106, x98);
	1995	var x126: u64 = undefined;
	1996	cmovznzU64(&x126, x111, x108, x100);
	1997	out1.* = x112;
	1998	out2[0] = x7;
	1999	out2[1] = x8;
	2000	out2[2] = x9;
	2001	out2[3] = x10;
	2002	out2[4] = x11;
	2003	out3[0] = x114;
	2004	out3[1] = x115;
	2005	out3[2] = x116;
	2006	out3[3] = x117;
	2007	out3[4] = x118;
	2008	out4[0] = x119;
	2009	out4[1] = x120;
	2010	out4[2] = x121;
	2011	out4[3] = x122;
	2012	out5[0] = x123;
	2013	out5[1] = x124;
	2014	out5[2] = x125;
	2015	out5[3] = x126;
	2016	}

lib/std/crypto/pcurves/p256/scalar.zig+23-11

...	...	@@ -6,32 +6,44 @@
6	6
7	7	const std = @import("std");
8	8	const builtin = std.builtin;
	9	const common = @import("../common.zig");
9	10	const crypto = std.crypto;
10	11	const debug = std.debug;
11	12	const math = std.math;
12	13	const mem = std.mem;
13	14
14		const Fe = @import("field.zig").Fe;
	15	const Field = common.Field;
15	16
16	17	const NonCanonicalError = std.crypto.errors.NonCanonicalError;
17	18	const NotSquareError = std.crypto.errors.NotSquareError;
18	19
	20	/// Number of bytes required to encode a scalar.
	21	pub const encoded_length = 32;
	22
19	23	/// A compressed scalar, in canonical form.
20		pub const CompressedScalar = [32]u8;
	24	pub const CompressedScalar = [encoded_length]u8;
	25
	26	const Fe = Field(.{
	27	.fiat = @import("p256_scalar_64.zig"),
	28	.field_order = 115792089210356248762697446949407573529996955224135760342422259061068512044369,
	29	.field_bits = 256,
	30	.saturated_bits = 255,
	31	.encoded_length = encoded_length,
	32	});
21	33
22	34	/// Reject a scalar whose encoding is not canonical.
23		pub fn rejectNonCanonical(s: CompressedScalar) NonCanonicalError!void {
24		return Fe.rejectNonCanonical(s);
	35	pub fn rejectNonCanonical(s: CompressedScalar, endian: builtin.Endian) NonCanonicalError!void {
	36	return Fe.rejectNonCanonical(s, endian);
25	37	}
26	38
27	39	/// Reduce a 48-bytes scalar to the field size.
28		pub fn reduce48(s: [48]u8) CompressedScalar {
29		return Scalar.fromBytes48(s).toBytes();
	40	pub fn reduce48(s: [48]u8, endian: builtin.Endian) CompressedScalar {
	41	return Scalar.fromBytes48(s, endian).toBytes(endian);
30	42	}
31	43
32	44	/// Reduce a 64-bytes scalar to the field size.
33		pub fn reduce64(s: [64]u8) CompressedScalar {
34		return ScalarDouble.fromBytes64(s).toBytes();
	45	pub fn reduce64(s: [64]u8, endian: builtin.Endian) CompressedScalar {
	46	return ScalarDouble.fromBytes64(s, endian).toBytes(endian);
35	47	}
36	48
37	49	/// Return a*b (mod L)
...	...	@@ -183,19 +195,19 @@ const ScalarDouble = struct {
183	195	}
184	196	var t = ScalarDouble{ .x1 = undefined, .x2 = Fe.zero, .x3 = Fe.zero };
185	197	{
186		var b = [_]u8{0} ** 32;
	198	var b = [_]u8{0} ** encoded_length;
187	199	const len = math.min(s.len, 24);
188	200	mem.copy(u8, b[0..len], s[0..len]);
189	201	t.x1 = Fe.fromBytes(b, .Little) catch unreachable;
190	202	}
191	203	if (s_.len >= 24) {
192		var b = [_]u8{0} ** 32;
	204	var b = [_]u8{0} ** encoded_length;
193	205	const len = math.min(s.len - 24, 24);
194	206	mem.copy(u8, b[0..len], s[24..][0..len]);
195	207	t.x2 = Fe.fromBytes(b, .Little) catch unreachable;
196	208	}
197	209	if (s_.len >= 48) {
198		var b = [_]u8{0} ** 32;
	210	var b = [_]u8{0} ** encoded_length;
199	211	const len = s.len - 48;
200	212	mem.copy(u8, b[0..len], s[48..][0..len]);
201	213	t.x3 = Fe.fromBytes(b, .Little) catch unreachable;