Commit fe8781357afc0fa763f6a60eb8959acd05f4dfa3 | zig

author	Frank Denis <124872+jedisct1@users.noreply.github.com> 2021-05-01 08:14:32+02:00
committer	GitHub <noreply@github.com> 2021-05-01 08:14:32+02:00
log	fe8781357afc0fa763f6a60eb8959acd05f4dfa3
tree	0347292a0a6372e063a09b3b511061b224d54365
parent	557eb414eee96201d1ae01b15ebf8955eca1da6d
signature	Signed by PGP key 4AEE18F83AFDEB23

std.crypto: add support for the NIST P-256 curve (#8627)

Uses verified code generated by fiat-crypto for field arithmetic, and complete formulas to avoid side channels.

There's still plenty of room for optimizations, especially with a fixed base. But this gives us a framework to easily add other similar curves.

6 files changed, 2770 insertions(+), 0 deletions(-)

lib
- std
  - crypto.zig
  - crypto
    pcurves
    p256.zig
    p256
    field.zig
    p256_64.zig
    scalar.zig
    tests.zig

lib/std/crypto.zig+1

...	...	@@ -67,6 +67,7 @@ pub const dh = struct {
67	67	pub const ecc = struct {
68	68	pub const Curve25519 = @import("crypto/25519/curve25519.zig").Curve25519;
69	69	pub const Edwards25519 = @import("crypto/25519/edwards25519.zig").Edwards25519;
	70	pub const P256 = @import("crypto/pcurves/p256.zig").P256;
70	71	pub const Ristretto255 = @import("crypto/25519/ristretto255.zig").Ristretto255;
71	72	};
72	73

lib/std/crypto/pcurves/p256.zig created+412

...	...	@@ -0,0 +1,412 @@
	1	// SPDX-License-Identifier: MIT
	2	// Copyright (c) 2015-2021 Zig Contributors
	3	// This file is part of [zig](https://ziglang.org/), which is MIT licensed.
	4	// The MIT license requires this copyright notice to be included in all copies
	5	// and substantial portions of the software.
	6
	7	const std = @import("std");
	8	const builtin = std.builtin;
	9	const crypto = std.crypto;
	10	const mem = std.mem;
	11	const meta = std.meta;
	12
	13	const EncodingError = crypto.errors.EncodingError;
	14	const IdentityElementError = crypto.errors.IdentityElementError;
	15	const NonCanonicalError = crypto.errors.NonCanonicalError;
	16	const NotSquareError = crypto.errors.NotSquareError;
	17
	18	/// Group operations over P256.
	19	pub const P256 = struct {
	20	/// The underlying prime field.
	21	pub const Fe = @import("p256/field.zig").Fe;
	22	/// Field arithmetic mod the order of the main subgroup.
	23	pub const scalar = @import("p256/scalar.zig");
	24
	25	x: Fe,
	26	y: Fe,
	27	z: Fe = Fe.one,
	28
	29	is_base: bool = false,
	30
	31	/// The P256 base point.
	32	pub const basePoint = P256{
	33	.x = try Fe.fromInt(48439561293906451759052585252797914202762949526041747995844080717082404635286),
	34	.y = try Fe.fromInt(36134250956749795798585127919587881956611106672985015071877198253568414405109),
	35	.z = Fe.one,
	36	.is_base = true,
	37	};
	38
	39	/// The P256 neutral element.
	40	pub const identityElement = P256{ .x = Fe.zero, .y = Fe.one, .z = Fe.zero };
	41
	42	pub const B = try Fe.fromInt(41058363725152142129326129780047268409114441015993725554835256314039467401291);
	43
	44	/// Reject the neutral element.
	45	pub fn rejectIdentity(p: P256) IdentityElementError!void {
	46	if (p.x.isZero()) {
	47	return error.IdentityElement;
	48	}
	49	}
	50
	51	/// Create a point from affine coordinates after checking that they match the curve equation.
	52	pub fn fromAffineCoordinates(x: Fe, y: Fe) EncodingError!P256 {
	53	const x3AxB = x.sq().mul(x).sub(x).sub(x).sub(x).add(B);
	54	const yy = y.sq();
	55	if (!x3AxB.equivalent(yy)) {
	56	return error.InvalidEncoding;
	57	}
	58	const p: P256 = .{ .x = x, .y = y, .z = Fe.one };
	59	return p;
	60	}
	61
	62	/// Create a point from serialized affine coordinates.
	63	pub fn fromSerializedAffineCoordinates(xs: [32]u8, ys: [32]u8, endian: builtin.Endian) (NonCanonicalError \|\| EncodingError)!P256 {
	64	const x = try Fe.fromBytes(xs, endian);
	65	const y = try Fe.fromBytes(ys, endian);
	66	return fromAffineCoordinates(x, y);
	67	}
	68
	69	/// Recover the Y coordinate from the X coordinate.
	70	pub fn recoverY(x: Fe, is_odd: bool) NotSquareError!Fe {
	71	const x3AxB = x.sq().mul(x).sub(x).sub(x).sub(x).add(B);
	72	var y = try x3AxB.sqrt();
	73	const yn = y.neg();
	74	y.cMov(yn, @boolToInt(is_odd) ^ @boolToInt(y.isOdd()));
	75	return y;
	76	}
	77
	78	/// Deserialize a SEC1-encoded point.
	79	pub fn fromSec1(s: []const u8) (EncodingError \|\| NotSquareError \|\| NonCanonicalError)!P256 {
	80	if (s.len < 1) return error.InvalidEncoding;
	81	const encoding_type = s[0];
	82	const encoded = s[1..];
	83	switch (encoding_type) {
	84	0 => {
	85	if (encoded.len != 0) return error.InvalidEncoding;
	86	return P256.identityElement;
	87	},
	88	2, 3 => {
	89	if (encoded.len != 32) return error.InvalidEncoding;
	90	const x = try Fe.fromBytes(encoded[0..32].*, .Big);
	91	const y_is_odd = (encoding_type == 3);
	92	const y = try recoverY(x, y_is_odd);
	93	return P256{ .x = x, .y = y };
	94	},
	95	4 => {
	96	if (encoded.len != 64) return error.InvalidEncoding;
	97	const x = try Fe.fromBytes(encoded[0..32].*, .Big);
	98	const y = try Fe.fromBytes(encoded[32..64].*, .Big);
	99	return P256.fromAffineCoordinates(x, y);
	100	},
	101	else => return error.InvalidEncoding,
	102	}
	103	}
	104
	105	/// Serialize a point using the compressed SEC-1 format.
	106	pub fn toCompressedSec1(p: P256) [33]u8 {
	107	var out: [33]u8 = undefined;
	108	const xy = p.affineCoordinates();
	109	out[0] = if (xy.y.isOdd()) 3 else 2;
	110	mem.copy(u8, out[1..], &xy.x.toBytes(.Big));
	111	return out;
	112	}
	113
	114	/// Serialize a point using the uncompressed SEC-1 format.
	115	pub fn toUncompressedSec1(p: P256) [65]u8 {
	116	var out: [65]u8 = undefined;
	117	out[0] = 4;
	118	const xy = p.affineCoordinates();
	119	mem.copy(u8, out[1..33], &xy.x.toBytes(.Big));
	120	mem.copy(u8, out[33..65], &xy.y.toBytes(.Big));
	121	return out;
	122	}
	123
	124	/// Return a random point.
	125	pub fn random() P256 {
	126	const n = scalar.random(.Little);
	127	return basePoint.mul(n, .Little) catch unreachable;
	128	}
	129
	130	/// Flip the sign of the X coordinate.
	131	pub fn neg(p: P256) P256 {
	132	return .{ .x = p.x, .y = p.y.neg(), .z = p.z };
	133	}
	134
	135	/// Double a P256 point.
	136	// Algorithm 6 from https://eprint.iacr.org/2015/1060.pdf
	137	pub fn dbl(p: P256) P256 {
	138	var t0 = p.x.sq();
	139	var t1 = p.y.sq();
	140	var t2 = p.z.sq();
	141	var t3 = p.x.mul(p.y);
	142	t3 = t3.dbl();
	143	var Z3 = p.x.mul(p.z);
	144	Z3 = Z3.add(Z3);
	145	var Y3 = B.mul(t2);
	146	Y3 = Y3.sub(Z3);
	147	var X3 = Y3.dbl();
	148	Y3 = X3.add(Y3);
	149	X3 = t1.sub(Y3);
	150	Y3 = t1.add(Y3);
	151	Y3 = X3.mul(Y3);
	152	X3 = X3.mul(t3);
	153	t3 = t2.dbl();
	154	t2 = t2.add(t3);
	155	Z3 = B.mul(Z3);
	156	Z3 = Z3.sub(t2);
	157	Z3 = Z3.sub(t0);
	158	t3 = Z3.dbl();
	159	Z3 = Z3.add(t3);
	160	t3 = t0.dbl();
	161	t0 = t3.add(t0);
	162	t0 = t0.sub(t2);
	163	t0 = t0.mul(Z3);
	164	Y3 = Y3.add(t0);
	165	t0 = p.y.mul(p.z);
	166	t0 = t0.dbl();
	167	Z3 = t0.mul(Z3);
	168	X3 = X3.sub(Z3);
	169	Z3 = t0.mul(t1);
	170	Z3 = Z3.dbl().dbl();
	171	return .{
	172	.x = X3,
	173	.y = Y3,
	174	.z = Z3,
	175	};
	176	}
	177
	178	/// Add P256 points, the second being specified using affine coordinates.
	179	// Algorithm 5 from https://eprint.iacr.org/2015/1060.pdf
	180	pub fn addMixed(p: P256, q: struct { x: Fe, y: Fe }) P256 {
	181	var t0 = p.x.mul(q.x);
	182	var t1 = p.y.mul(q.y);
	183	var t3 = q.x.add(q.y);
	184	var t4 = p.x.add(p.y);
	185	t3 = t3.mul(t4);
	186	t4 = t0.add(t1);
	187	t3 = t3.sub(t4);
	188	t4 = q.y.mul(p.z);
	189	t4 = t4.add(p.y);
	190	var Y3 = q.x.mul(p.z);
	191	Y3 = Y3.add(p.x);
	192	var Z3 = B.mul(p.z);
	193	var X3 = Y3.sub(Z3);
	194	Z3 = X3.dbl();
	195	X3 = X3.add(Z3);
	196	Z3 = t1.sub(X3);
	197	X3 = t1.dbl();
	198	Y3 = B.mul(Y3);
	199	t1 = p.z.add(p.z);
	200	var t2 = t1.add(p.z);
	201	Y3 = Y3.sub(t2);
	202	Y3 = Y3.sub(t0);
	203	t1 = Y3.dbl();
	204	Y3 = t1.add(Y3);
	205	t1 = t0.dbl();
	206	t0 = t1.add(t0);
	207	t0 = t0.sub(t2);
	208	t1 = t4.mul(Y3);
	209	t2 = t0.mul(Y3);
	210	Y3 = X3.mul(Z3);
	211	Y3 = Y3.add(t2);
	212	X3 = t3.mul(X3);
	213	X3 = X3.sub(t1);
	214	Z3 = t4.mul(Z3);
	215	t1 = t3.mul(t0);
	216	Z3 = Z3.add(t1);
	217	return .{
	218	.x = X3,
	219	.y = Y3,
	220	.z = Z3,
	221	};
	222	}
	223
	224	// Add P256 points.
	225	// Algorithm 4 from https://eprint.iacr.org/2015/1060.pdf
	226	pub fn add(p: P256, q: P256) P256 {
	227	var t0 = p.x.mul(q.x);
	228	var t1 = p.y.mul(q.y);
	229	var t2 = p.z.mul(q.z);
	230	var t3 = p.x.add(p.y);
	231	var t4 = q.x.add(q.y);
	232	t3 = t3.mul(t4);
	233	t4 = t0.add(t1);
	234	t3 = t3.sub(t4);
	235	t4 = p.y.add(p.z);
	236	var X3 = q.y.add(q.z);
	237	t4 = t4.mul(X3);
	238	X3 = t1.add(t2);
	239	t4 = t4.sub(X3);
	240	X3 = p.x.add(p.z);
	241	var Y3 = q.x.add(q.z);
	242	X3 = X3.mul(Y3);
	243	Y3 = t0.add(t2);
	244	Y3 = X3.sub(Y3);
	245	var Z3 = B.mul(t2);
	246	X3 = Y3.sub(Z3);
	247	Z3 = X3.dbl();
	248	X3 = X3.add(Z3);
	249	Z3 = t1.sub(X3);
	250	X3 = t1.add(X3);
	251	Y3 = B.mul(Y3);
	252	t1 = t2.dbl();
	253	t2 = t1.add(t2);
	254	Y3 = Y3.sub(t2);
	255	Y3 = Y3.sub(t0);
	256	t1 = Y3.dbl();
	257	Y3 = t1.add(Y3);
	258	t1 = t0.dbl();
	259	t0 = t1.add(t0);
	260	t0 = t0.sub(t2);
	261	t1 = t4.mul(Y3);
	262	t2 = t0.mul(Y3);
	263	Y3 = X3.mul(Z3);
	264	Y3 = Y3.add(t2);
	265	X3 = t3.mul(X3);
	266	X3 = X3.sub(t1);
	267	Z3 = t4.mul(Z3);
	268	t1 = t3.mul(t0);
	269	Z3 = Z3.add(t1);
	270	return .{
	271	.x = X3,
	272	.y = Y3,
	273	.z = Z3,
	274	};
	275	}
	276
	277	// Subtract P256 points.
	278	pub fn sub(p: P256, q: P256) P256 {
	279	return p.add(q.neg());
	280	}
	281
	282	/// Return affine coordinates.
	283	pub fn affineCoordinates(p: P256) struct { x: Fe, y: Fe } {
	284	const zinv = p.z.invert();
	285	const ret = .{
	286	.x = p.x.mul(zinv),
	287	.y = p.y.mul(zinv),
	288	};
	289	return ret;
	290	}
	291
	292	/// Return true if both coordinate sets represent the same point.
	293	pub fn equivalent(a: P256, b: P256) bool {
	294	if (a.sub(b).rejectIdentity()) {
	295	return false;
	296	} else \|_\| {
	297	return true;
	298	}
	299	}
	300
	301	fn cMov(p: *P256, a: P256, c: u1) void {
	302	p.x.cMov(a.x, c);
	303	p.y.cMov(a.y, c);
	304	p.z.cMov(a.z, c);
	305	}
	306
	307	fn pcSelect(comptime n: usize, pc: [n]P256, b: u8) P256 {
	308	var t = P256.identityElement;
	309	comptime var i: u8 = 1;
	310	inline while (i < pc.len) : (i += 1) {
	311	t.cMov(pc[i], @truncate(u1, (@as(usize, b ^ i) -% 1) >> 8));
	312	}
	313	return t;
	314	}
	315
	316	fn slide(s: [32]u8) [2 * 32 + 1]i8 {
	317	var e: [2 * 32 + 1]i8 = undefined;
	318	for (s) \|x, i\| {
	319	e[i * 2 + 0] = @as(i8, @truncate(u4, x));
	320	e[i * 2 + 1] = @as(i8, @truncate(u4, x >> 4));
	321	}
	322	// Now, e[0..63] is between 0 and 15, e[63] is between 0 and 7
	323	var carry: i8 = 0;
	324	for (e[0..64]) \|*x\| {
	325	x.* += carry;
	326	carry = (x.* + 8) >> 4;
	327	x.* -= carry * 16;
	328	std.debug.assert(x.* >= -8 and x.* <= 8);
	329	}
	330	e[64] = carry;
	331	// Now, e[*] is between -8 and 8, including e[64]
	332	std.debug.assert(carry >= -8 and carry <= 8);
	333	return e;
	334	}
	335
	336	fn pcMul(pc: [9]P256, s: [32]u8, comptime vartime: bool) IdentityElementError!P256 {
	337	std.debug.assert(vartime);
	338	const e = slide(s);
	339	var q = P256.identityElement;
	340	var pos = e.len - 1;
	341	while (true) : (pos -= 1) {
	342	const slot = e[pos];
	343	if (slot > 0) {
	344	q = q.add(pc[@intCast(usize, slot)]);
	345	} else if (slot < 0) {
	346	q = q.sub(pc[@intCast(usize, -slot)]);
	347	}
	348	if (pos == 0) break;
	349	q = q.dbl().dbl().dbl().dbl();
	350	}
	351	try q.rejectIdentity();
	352	return q;
	353	}
	354
	355	fn pcMul16(pc: [16]P256, s: [32]u8, comptime vartime: bool) IdentityElementError!P256 {
	356	var q = P256.identityElement;
	357	var pos: usize = 252;
	358	while (true) : (pos -= 4) {
	359	const slot = @truncate(u4, (s[pos >> 3] >> @truncate(u3, pos)));
	360	if (vartime) {
	361	if (slot != 0) {
	362	q = q.add(pc[slot]);
	363	}
	364	} else {
	365	q = q.add(pcSelect(16, pc, slot));
	366	}
	367	if (pos == 0) break;
	368	q = q.dbl().dbl().dbl().dbl();
	369	}
	370	try q.rejectIdentity();
	371	return q;
	372	}
	373
	374	fn precompute(p: P256, comptime count: usize) [1 + count]P256 {
	375	var pc: [1 + count]P256 = undefined;
	376	pc[0] = P256.identityElement;
	377	pc[1] = p;
	378	var i: usize = 2;
	379	while (i <= count) : (i += 1) {
	380	pc[i] = if (i % 2 == 0) pc[i / 2].dbl() else pc[i - 1].add(p);
	381	}
	382	return pc;
	383	}
	384
	385	/// Multiply an elliptic curve point by a scalar.
	386	/// Return error.IdentityElement if the result is the identity element.
	387	pub fn mul(p: P256, s_: [32]u8, endian: builtin.Endian) IdentityElementError!P256 {
	388	const s = if (endian == .Little) s_ else Fe.orderSwap(s_);
	389	const pc = if (p.is_base) precompute(P256.basePoint, 15) else pc: {
	390	try p.rejectIdentity();
	391	const xpc = precompute(p, 15);
	392	break :pc xpc;
	393	};
	394	return pcMul16(pc, s, false);
	395	}
	396
	397	/// Multiply an elliptic curve point by a PUBLIC scalar IN VARIABLE TIME
	398	/// This can be used for signature verification.
	399	pub fn mulPublic(p: P256, s_: [32]u8, endian: builtin.Endian) IdentityElementError!P256 {
	400	const s = if (endian == .Little) s_ else Fe.orderSwap(s_);
	401	const pc = if (p.is_base) precompute(P256.basePoint, 8) else pc: {
	402	try p.rejectIdentity();
	403	const xpc = precompute(p, 8);
	404	break :pc xpc;
	405	};
	406	return pcMul(pc, s, true);
	407	}
	408	};
	409
	410	test "p256" {
	411	_ = @import("tests.zig");
	412	}

lib/std/crypto/pcurves/p256/field.zig created+261

...	...	@@ -0,0 +1,261 @@
	1	// SPDX-License-Identifier: MIT
	2	// Copyright (c) 2015-2021 Zig Contributors
	3	// This file is part of [zig](https://ziglang.org/), which is MIT licensed.
	4	// The MIT license requires this copyright notice to be included in all copies
	5	// and substantial portions of the software.
	6
	7	const std = @import("std");
	8	const builtin = std.builtin;
	9	const crypto = std.crypto;
	10	const debug = std.debug;
	11	const mem = std.mem;
	12	const meta = std.meta;
	13
	14	const fiat = @import("p256_64.zig");
	15
	16	const NonCanonicalError = crypto.errors.NonCanonicalError;
	17	const NotSquareError = crypto.errors.NotSquareError;
	18
	19	const Limbs = fiat.Limbs;
	20
	21	/// A field element, internally stored in Montgomery domain.
	22	pub const Fe = struct {
	23	limbs: Limbs,
	24
	25	/// Field size.
	26	pub const field_order = 115792089210356248762697446949407573530086143415290314195533631308867097853951;
	27
	28	/// Numer of bits that can be saturated without overflowing.
	29	pub const saturated_bits = 255;
	30
	31	/// Zero.
	32	pub const zero: Fe = Fe{ .limbs = mem.zeroes(Limbs) };
	33
	34	/// One.
	35	pub const one = comptime one: {
	36	var fe: Fe = undefined;
	37	fiat.p256SetOne(&fe.limbs);
	38	break :one fe;
	39	};
	40
	41	/// Reject non-canonical encodings of an element.
	42	pub fn rejectNonCanonical(s_: [32]u8, endian: builtin.Endian) NonCanonicalError!void {
	43	var s = if (endian == .Little) s_ else orderSwap(s_);
	44	const field_order_s = comptime fos: {
	45	var fos: [32]u8 = undefined;
	46	mem.writeIntLittle(u256, &fos, field_order);
	47	break :fos fos;
	48	};
	49	if (crypto.utils.timingSafeCompare(u8, &s, &field_order_s, .Little) != .lt) {
	50	return error.NonCanonical;
	51	}
	52	}
	53
	54	/// Swap the endianness of an encoded element.
	55	pub fn orderSwap(s: [32]u8) [32]u8 {
	56	var t = s;
	57	for (s) \|x, i\| t[t.len - 1 - i] = x;
	58	return t;
	59	}
	60
	61	/// Unpack a field element.
	62	pub fn fromBytes(s_: [32]u8, endian: builtin.Endian) NonCanonicalError!Fe {
	63	var s = if (endian == .Little) s_ else orderSwap(s_);
	64	try rejectNonCanonical(s, .Little);
	65	var limbs_z: Limbs = undefined;
	66	fiat.p256FromBytes(&limbs_z, s);
	67	var limbs: Limbs = undefined;
	68	fiat.p256ToMontgomery(&limbs, limbs_z);
	69	return Fe{ .limbs = limbs };
	70	}
	71
	72	/// Pack a field element.
	73	pub fn toBytes(fe: Fe, endian: builtin.Endian) [32]u8 {
	74	var limbs_z: Limbs = undefined;
	75	fiat.p256FromMontgomery(&limbs_z, fe.limbs);
	76	var s: [32]u8 = undefined;
	77	fiat.p256ToBytes(&s, limbs_z);
	78	return if (endian == .Little) s else orderSwap(s);
	79	}
	80
	81	/// Create a field element from an integer.
	82	pub fn fromInt(comptime x: u256) NonCanonicalError!Fe {
	83	var s: [32]u8 = undefined;
	84	mem.writeIntLittle(u256, &s, x);
	85	return fromBytes(s, .Little);
	86	}
	87
	88	/// Return the field element as an integer.
	89	pub fn toInt(fe: Fe) u256 {
	90	const s = fe.toBytes(.Little);
	91	return mem.readIntLittle(u256, &s);
	92	}
	93
	94	/// Return true if the field element is zero.
	95	pub fn isZero(fe: Fe) bool {
	96	var z: @TypeOf(fe.limbs[0]) = undefined;
	97	fiat.p256Nonzero(&z, fe.limbs);
	98	return z == 0;
	99	}
	100
	101	/// Return true if both field elements are equivalent.
	102	pub fn equivalent(a: Fe, b: Fe) bool {
	103	return a.sub(b).isZero();
	104	}
	105
	106	/// Return true if the element is odd.
	107	pub fn isOdd(fe: Fe) bool {
	108	const s = fe.toBytes(.Little);
	109	return @truncate(u1, s[0]) != 0;
	110	}
	111
	112	/// Conditonally replace a field element with `a` if `c` is positive.
	113	pub fn cMov(fe: *Fe, a: Fe, c: u1) void {
	114	fiat.p256Selectznz(&fe.limbs, c, fe.limbs, a.limbs);
	115	}
	116
	117	/// Add field elements.
	118	pub fn add(a: Fe, b: Fe) Fe {
	119	var fe: Fe = undefined;
	120	fiat.p256Add(&fe.limbs, a.limbs, b.limbs);
	121	return fe;
	122	}
	123
	124	/// Subtract field elements.
	125	pub fn sub(a: Fe, b: Fe) Fe {
	126	var fe: Fe = undefined;
	127	fiat.p256Sub(&fe.limbs, a.limbs, b.limbs);
	128	return fe;
	129	}
	130
	131	/// Double a field element.
	132	pub fn dbl(a: Fe) Fe {
	133	var fe: Fe = undefined;
	134	fiat.p256Add(&fe.limbs, a.limbs, a.limbs);
	135	return fe;
	136	}
	137
	138	/// Multiply field elements.
	139	pub fn mul(a: Fe, b: Fe) Fe {
	140	var fe: Fe = undefined;
	141	fiat.p256Mul(&fe.limbs, a.limbs, b.limbs);
	142	return fe;
	143	}
	144
	145	/// Square a field element.
	146	pub fn sq(a: Fe) Fe {
	147	var fe: Fe = undefined;
	148	fiat.p256Square(&fe.limbs, a.limbs);
	149	return fe;
	150	}
	151
	152	/// Square a field element n times.
	153	fn sqn(a: Fe, comptime n: comptime_int) Fe {
	154	var i: usize = 0;
	155	var fe = a;
	156	while (i < n) : (i += 1) {
	157	fe = fe.sq();
	158	}
	159	return fe;
	160	}
	161
	162	/// Compute a^n.
	163	pub fn pow(a: Fe, comptime T: type, comptime n: T) Fe {
	164	var fe = one;
	165	var x: T = n;
	166	var t = a;
	167	while (true) {
	168	if (@truncate(u1, x) != 0) fe = fe.mul(t);
	169	x >>= 1;
	170	if (x == 0) break;
	171	t = t.sq();
	172	}
	173	return fe;
	174	}
	175
	176	/// Negate a field element.
	177	pub fn neg(a: Fe) Fe {
	178	var fe: Fe = undefined;
	179	fiat.p256Opp(&fe.limbs, a.limbs);
	180	return fe;
	181	}
	182
	183	/// Return the inverse of a field element, or 0 if a=0.
	184	// Field inversion from https://eprint.iacr.org/2021/549.pdf
	185	pub fn invert(a: Fe) Fe {
	186	const len_prime = 256;
	187	const iterations = (49 * len_prime + 57) / 17;
	188	const Word = @TypeOf(a.limbs[0]);
	189	const XLimbs = [a.limbs.len + 1]Word;
	190
	191	var d: Word = 1;
	192	var f: XLimbs = undefined;
	193	fiat.p256Msat(&f);
	194
	195	var g: XLimbs = undefined;
	196	fiat.p256FromMontgomery(g[0..a.limbs.len], a.limbs);
	197	g[g.len - 1] = 0;
	198
	199	var r: Limbs = undefined;
	200	fiat.p256SetOne(&r);
	201	var v = mem.zeroes(Limbs);
	202
	203	var precomp: Limbs = undefined;
	204	fiat.p256DivstepPrecomp(&precomp);
	205
	206	var out1: Word = undefined;
	207	var out2: XLimbs = undefined;
	208	var out3: XLimbs = undefined;
	209	var out4: Limbs = undefined;
	210	var out5: Limbs = undefined;
	211
	212	var i: usize = 0;
	213	while (i < iterations - iterations % 2) : (i += 2) {
	214	fiat.p256Divstep(&out1, &out2, &out3, &out4, &out5, d, f, g, v, r);
	215	fiat.p256Divstep(&d, &f, &g, &v, &r, out1, out2, out3, out4, out5);
	216	}
	217	if (iterations % 2 != 0) {
	218	fiat.p256Divstep(&out1, &out2, &out3, &out4, &out5, d, f, g, v, r);
	219	mem.copy(Word, &v, &out4);
	220	mem.copy(Word, &f, &out2);
	221	}
	222	var v_opp: Limbs = undefined;
	223	fiat.p256Opp(&v_opp, v);
	224	fiat.p256Selectznz(&v, @truncate(u1, f[f.len - 1] >> (meta.bitCount(Word) - 1)), v, v_opp);
	225	var fe: Fe = undefined;
	226	fiat.p256Mul(&fe.limbs, v, precomp);
	227	return fe;
	228	}
	229
	230	/// Return true if the field element is a square.
	231	pub fn isSquare(x2: Fe) bool {
	232	const t110 = x2.mul(x2.sq()).sq();
	233	const t111 = x2.mul(t110);
	234	const t111111 = t111.mul(x2.mul(t110).sqn(3));
	235	const x15 = t111111.sqn(6).mul(t111111).sqn(3).mul(t111);
	236	const x16 = x15.sq().mul(x2);
	237	const x53 = x16.sqn(16).mul(x16).sqn(15);
	238	const x47 = x15.mul(x53);
	239	const ls = x47.mul(((x53.sqn(17).mul(x2)).sqn(143).mul(x47)).sqn(47)).sq().mul(x2); // Legendre symbol, (p-1)/2
	240	return ls.equivalent(Fe.one);
	241	}
	242
	243	// x=x2^((field_order+1)/4) w/ field order=3 (mod 4).
	244	fn uncheckedSqrt(x2: Fe) Fe {
	245	comptime debug.assert(field_order % 4 == 3);
	246	const t11 = x2.mul(x2.sq());
	247	const t1111 = t11.mul(t11.sqn(2));
	248	const t11111111 = t1111.mul(t1111.sqn(4));
	249	const x16 = t11111111.sqn(8).mul(t11111111);
	250	return x16.sqn(16).mul(x16).sqn(32).mul(x2).sqn(96).mul(x2).sqn(94);
	251	}
	252
	253	/// Compute the square root of `x2`, returning `error.NotSquare` if `x2` was not a square.
	254	pub fn sqrt(x2: Fe) NotSquareError!Fe {
	255	const x = x2.uncheckedSqrt();
	256	if (x.sq().equivalent(x2)) {
	257	return x;
	258	}
	259	return error.NotSquare;
	260	}
	261	};

lib/std/crypto/pcurves/p256/p256_64.zig created+1774

...	...	@@ -0,0 +1,1774 @@
	1	// SPDX-License-Identifier: MIT
	2	// Copyright (c) 2015-2021 Zig Contributors
	3	// This file is part of [zig](https://ziglang.org/), which is MIT licensed.
	4	// The MIT license requires this copyright notice to be included in all copies
	5	// and substantial portions of the software.
	6
	7	// Autogenerated: 'src/ExtractionOCaml/word_by_word_montgomery' --lang Zig --internal-static --public-function-case camelCase --private-function-case camelCase p256 64 '2^256 - 2^224 + 2^192 + 2^96 - 1' mul square add sub opp from_montgomery to_montgomery nonzero selectznz to_bytes from_bytes one msat divstep divstep_precomp
	8	// curve description: p256
	9	// machine_wordsize = 64 (from "64")
	10	// requested operations: mul, square, add, sub, opp, from_montgomery, to_montgomery, nonzero, selectznz, to_bytes, from_bytes, one, msat, divstep, divstep_precomp
	11	// m = 0xffffffff00000001000000000000000000000000ffffffffffffffffffffffff (from "2^256 - 2^224 + 2^192 + 2^96 - 1")
	12	//
	13	// NOTE: In addition to the bounds specified above each function, all
	14	// functions synthesized for this Montgomery arithmetic require the
	15	// input to be strictly less than the prime modulus (m), and also
	16	// require the input to be in the unique saturated representation.
	17	// All functions also ensure that these two properties are true of
	18	// return values.
	19	//
	20	// Computed values:
	21	// eval z = z[0] + (z[1] << 64) + (z[2] << 128) + (z[3] << 192)
	22	// bytes_eval z = z[0] + (z[1] << 8) + (z[2] << 16) + (z[3] << 24) + (z[4] << 32) + (z[5] << 40) + (z[6] << 48) + (z[7] << 56) + (z[8] << 64) + (z[9] << 72) + (z[10] << 80) + (z[11] << 88) + (z[12] << 96) + (z[13] << 104) + (z[14] << 112) + (z[15] << 120) + (z[16] << 128) + (z[17] << 136) + (z[18] << 144) + (z[19] << 152) + (z[20] << 160) + (z[21] << 168) + (z[22] << 176) + (z[23] << 184) + (z[24] << 192) + (z[25] << 200) + (z[26] << 208) + (z[27] << 216) + (z[28] << 224) + (z[29] << 232) + (z[30] << 240) + (z[31] << 248)
	23
	24	pub const Limbs = [4]u64;
	25
	26	/// The function p256AddcarryxU64 is an addition with carry.
	27	/// Postconditions:
	28	/// out1 = (arg1 + arg2 + arg3) mod 2^64
	29	/// out2 = ⌊(arg1 + arg2 + arg3) / 2^64⌋
	30	///
	31	/// Input Bounds:
	32	/// arg1: [0x0 ~> 0x1]
	33	/// arg2: [0x0 ~> 0xffffffffffffffff]
	34	/// arg3: [0x0 ~> 0xffffffffffffffff]
	35	/// Output Bounds:
	36	/// out1: [0x0 ~> 0xffffffffffffffff]
	37	/// out2: [0x0 ~> 0x1]
	38	fn p256AddcarryxU64(out1: u64, out2: u1, arg1: u1, arg2: u64, arg3: u64) callconv(.Inline) void {
	39	var t: u64 = undefined;
	40	const carry1 = @addWithOverflow(u64, arg2, arg3, &t);
	41	const carry2 = @addWithOverflow(u64, t, arg1, out1);
	42	out2.* = @boolToInt(carry1) \| @boolToInt(carry2);
	43	}
	44
	45	/// The function p256SubborrowxU64 is a subtraction with borrow.
	46	/// Postconditions:
	47	/// out1 = (-arg1 + arg2 + -arg3) mod 2^64
	48	/// out2 = -⌊(-arg1 + arg2 + -arg3) / 2^64⌋
	49	///
	50	/// Input Bounds:
	51	/// arg1: [0x0 ~> 0x1]
	52	/// arg2: [0x0 ~> 0xffffffffffffffff]
	53	/// arg3: [0x0 ~> 0xffffffffffffffff]
	54	/// Output Bounds:
	55	/// out1: [0x0 ~> 0xffffffffffffffff]
	56	/// out2: [0x0 ~> 0x1]
	57	fn p256SubborrowxU64(out1: u64, out2: u1, arg1: u1, arg2: u64, arg3: u64) callconv(.Inline) void {
	58	var t: u64 = undefined;
	59	const carry1 = @subWithOverflow(u64, arg2, arg3, &t);
	60	const carry2 = @subWithOverflow(u64, t, arg1, out1);
	61	out2.* = @boolToInt(carry1) \| @boolToInt(carry2);
	62	}
	63
	64	/// The function p256MulxU64 is a multiplication, returning the full double-width result.
	65	/// Postconditions:
	66	/// out1 = (arg1 * arg2) mod 2^64
	67	/// out2 = ⌊arg1 * arg2 / 2^64⌋
	68	///
	69	/// Input Bounds:
	70	/// arg1: [0x0 ~> 0xffffffffffffffff]
	71	/// arg2: [0x0 ~> 0xffffffffffffffff]
	72	/// Output Bounds:
	73	/// out1: [0x0 ~> 0xffffffffffffffff]
	74	/// out2: [0x0 ~> 0xffffffffffffffff]
	75	fn p256MulxU64(out1: u64, out2: u64, arg1: u64, arg2: u64) callconv(.Inline) void {
	76	const x = @as(u128, arg1) * @as(u128, arg2);
	77	out1.* = @truncate(u64, x);
	78	out2.* = @truncate(u64, x >> 64);
	79	}
	80
	81	/// The function p256CmovznzU64 is a single-word conditional move.
	82	/// Postconditions:
	83	/// out1 = (if arg1 = 0 then arg2 else arg3)
	84	///
	85	/// Input Bounds:
	86	/// arg1: [0x0 ~> 0x1]
	87	/// arg2: [0x0 ~> 0xffffffffffffffff]
	88	/// arg3: [0x0 ~> 0xffffffffffffffff]
	89	/// Output Bounds:
	90	/// out1: [0x0 ~> 0xffffffffffffffff]
	91	fn p256CmovznzU64(out1: *u64, arg1: u1, arg2: u64, arg3: u64) callconv(.Inline) void {
	92	const mask = 0 -% @as(u64, arg1);
	93	out1.* = (mask & arg3) \| ((~mask) & arg2);
	94	}
	95
	96	/// The function p256Mul multiplies two field elements in the Montgomery domain.
	97	/// Preconditions:
	98	/// 0 ≤ eval arg1 < m
	99	/// 0 ≤ eval arg2 < m
	100	/// Postconditions:
	101	/// eval (from_montgomery out1) mod m = (eval (from_montgomery arg1) * eval (from_montgomery arg2)) mod m
	102	/// 0 ≤ eval out1 < m
	103	///
	104	/// Input Bounds:
	105	/// arg1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
	106	/// arg2: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
	107	/// Output Bounds:
	108	/// out1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
	109	pub fn p256Mul(out1: *Limbs, arg1: Limbs, arg2: Limbs) void {
	110	const x1: u64 = (arg1[1]);
	111	const x2: u64 = (arg1[2]);
	112	const x3: u64 = (arg1[3]);
	113	const x4: u64 = (arg1[0]);
	114	var x5: u64 = undefined;
	115	var x6: u64 = undefined;
	116	p256MulxU64(&x5, &x6, x4, (arg2[3]));
	117	var x7: u64 = undefined;
	118	var x8: u64 = undefined;
	119	p256MulxU64(&x7, &x8, x4, (arg2[2]));
	120	var x9: u64 = undefined;
	121	var x10: u64 = undefined;
	122	p256MulxU64(&x9, &x10, x4, (arg2[1]));
	123	var x11: u64 = undefined;
	124	var x12: u64 = undefined;
	125	p256MulxU64(&x11, &x12, x4, (arg2[0]));
	126	var x13: u64 = undefined;
	127	var x14: u1 = undefined;
	128	p256AddcarryxU64(&x13, &x14, 0x0, x12, x9);
	129	var x15: u64 = undefined;
	130	var x16: u1 = undefined;
	131	p256AddcarryxU64(&x15, &x16, x14, x10, x7);
	132	var x17: u64 = undefined;
	133	var x18: u1 = undefined;
	134	p256AddcarryxU64(&x17, &x18, x16, x8, x5);
	135	const x19: u64 = (@intCast(u64, x18) + x6);
	136	var x20: u64 = undefined;
	137	var x21: u64 = undefined;
	138	p256MulxU64(&x20, &x21, x11, 0xffffffff00000001);
	139	var x22: u64 = undefined;
	140	var x23: u64 = undefined;
	141	p256MulxU64(&x22, &x23, x11, 0xffffffff);
	142	var x24: u64 = undefined;
	143	var x25: u64 = undefined;
	144	p256MulxU64(&x24, &x25, x11, 0xffffffffffffffff);
	145	var x26: u64 = undefined;
	146	var x27: u1 = undefined;
	147	p256AddcarryxU64(&x26, &x27, 0x0, x25, x22);
	148	const x28: u64 = (@intCast(u64, x27) + x23);
	149	var x29: u64 = undefined;
	150	var x30: u1 = undefined;
	151	p256AddcarryxU64(&x29, &x30, 0x0, x11, x24);
	152	var x31: u64 = undefined;
	153	var x32: u1 = undefined;
	154	p256AddcarryxU64(&x31, &x32, x30, x13, x26);
	155	var x33: u64 = undefined;
	156	var x34: u1 = undefined;
	157	p256AddcarryxU64(&x33, &x34, x32, x15, x28);
	158	var x35: u64 = undefined;
	159	var x36: u1 = undefined;
	160	p256AddcarryxU64(&x35, &x36, x34, x17, x20);
	161	var x37: u64 = undefined;
	162	var x38: u1 = undefined;
	163	p256AddcarryxU64(&x37, &x38, x36, x19, x21);
	164	var x39: u64 = undefined;
	165	var x40: u64 = undefined;
	166	p256MulxU64(&x39, &x40, x1, (arg2[3]));
	167	var x41: u64 = undefined;
	168	var x42: u64 = undefined;
	169	p256MulxU64(&x41, &x42, x1, (arg2[2]));
	170	var x43: u64 = undefined;
	171	var x44: u64 = undefined;
	172	p256MulxU64(&x43, &x44, x1, (arg2[1]));
	173	var x45: u64 = undefined;
	174	var x46: u64 = undefined;
	175	p256MulxU64(&x45, &x46, x1, (arg2[0]));
	176	var x47: u64 = undefined;
	177	var x48: u1 = undefined;
	178	p256AddcarryxU64(&x47, &x48, 0x0, x46, x43);
	179	var x49: u64 = undefined;
	180	var x50: u1 = undefined;
	181	p256AddcarryxU64(&x49, &x50, x48, x44, x41);
	182	var x51: u64 = undefined;
	183	var x52: u1 = undefined;
	184	p256AddcarryxU64(&x51, &x52, x50, x42, x39);
	185	const x53: u64 = (@intCast(u64, x52) + x40);
	186	var x54: u64 = undefined;
	187	var x55: u1 = undefined;
	188	p256AddcarryxU64(&x54, &x55, 0x0, x31, x45);
	189	var x56: u64 = undefined;
	190	var x57: u1 = undefined;
	191	p256AddcarryxU64(&x56, &x57, x55, x33, x47);
	192	var x58: u64 = undefined;
	193	var x59: u1 = undefined;
	194	p256AddcarryxU64(&x58, &x59, x57, x35, x49);
	195	var x60: u64 = undefined;
	196	var x61: u1 = undefined;
	197	p256AddcarryxU64(&x60, &x61, x59, x37, x51);
	198	var x62: u64 = undefined;
	199	var x63: u1 = undefined;
	200	p256AddcarryxU64(&x62, &x63, x61, @intCast(u64, x38), x53);
	201	var x64: u64 = undefined;
	202	var x65: u64 = undefined;
	203	p256MulxU64(&x64, &x65, x54, 0xffffffff00000001);
	204	var x66: u64 = undefined;
	205	var x67: u64 = undefined;
	206	p256MulxU64(&x66, &x67, x54, 0xffffffff);
	207	var x68: u64 = undefined;
	208	var x69: u64 = undefined;
	209	p256MulxU64(&x68, &x69, x54, 0xffffffffffffffff);
	210	var x70: u64 = undefined;
	211	var x71: u1 = undefined;
	212	p256AddcarryxU64(&x70, &x71, 0x0, x69, x66);
	213	const x72: u64 = (@intCast(u64, x71) + x67);
	214	var x73: u64 = undefined;
	215	var x74: u1 = undefined;
	216	p256AddcarryxU64(&x73, &x74, 0x0, x54, x68);
	217	var x75: u64 = undefined;
	218	var x76: u1 = undefined;
	219	p256AddcarryxU64(&x75, &x76, x74, x56, x70);
	220	var x77: u64 = undefined;
	221	var x78: u1 = undefined;
	222	p256AddcarryxU64(&x77, &x78, x76, x58, x72);
	223	var x79: u64 = undefined;
	224	var x80: u1 = undefined;
	225	p256AddcarryxU64(&x79, &x80, x78, x60, x64);
	226	var x81: u64 = undefined;
	227	var x82: u1 = undefined;
	228	p256AddcarryxU64(&x81, &x82, x80, x62, x65);
	229	const x83: u64 = (@intCast(u64, x82) + @intCast(u64, x63));
	230	var x84: u64 = undefined;
	231	var x85: u64 = undefined;
	232	p256MulxU64(&x84, &x85, x2, (arg2[3]));
	233	var x86: u64 = undefined;
	234	var x87: u64 = undefined;
	235	p256MulxU64(&x86, &x87, x2, (arg2[2]));
	236	var x88: u64 = undefined;
	237	var x89: u64 = undefined;
	238	p256MulxU64(&x88, &x89, x2, (arg2[1]));
	239	var x90: u64 = undefined;
	240	var x91: u64 = undefined;
	241	p256MulxU64(&x90, &x91, x2, (arg2[0]));
	242	var x92: u64 = undefined;
	243	var x93: u1 = undefined;
	244	p256AddcarryxU64(&x92, &x93, 0x0, x91, x88);
	245	var x94: u64 = undefined;
	246	var x95: u1 = undefined;
	247	p256AddcarryxU64(&x94, &x95, x93, x89, x86);
	248	var x96: u64 = undefined;
	249	var x97: u1 = undefined;
	250	p256AddcarryxU64(&x96, &x97, x95, x87, x84);
	251	const x98: u64 = (@intCast(u64, x97) + x85);
	252	var x99: u64 = undefined;
	253	var x100: u1 = undefined;
	254	p256AddcarryxU64(&x99, &x100, 0x0, x75, x90);
	255	var x101: u64 = undefined;
	256	var x102: u1 = undefined;
	257	p256AddcarryxU64(&x101, &x102, x100, x77, x92);
	258	var x103: u64 = undefined;
	259	var x104: u1 = undefined;
	260	p256AddcarryxU64(&x103, &x104, x102, x79, x94);
	261	var x105: u64 = undefined;
	262	var x106: u1 = undefined;
	263	p256AddcarryxU64(&x105, &x106, x104, x81, x96);
	264	var x107: u64 = undefined;
	265	var x108: u1 = undefined;
	266	p256AddcarryxU64(&x107, &x108, x106, x83, x98);
	267	var x109: u64 = undefined;
	268	var x110: u64 = undefined;
	269	p256MulxU64(&x109, &x110, x99, 0xffffffff00000001);
	270	var x111: u64 = undefined;
	271	var x112: u64 = undefined;
	272	p256MulxU64(&x111, &x112, x99, 0xffffffff);
	273	var x113: u64 = undefined;
	274	var x114: u64 = undefined;
	275	p256MulxU64(&x113, &x114, x99, 0xffffffffffffffff);
	276	var x115: u64 = undefined;
	277	var x116: u1 = undefined;
	278	p256AddcarryxU64(&x115, &x116, 0x0, x114, x111);
	279	const x117: u64 = (@intCast(u64, x116) + x112);
	280	var x118: u64 = undefined;
	281	var x119: u1 = undefined;
	282	p256AddcarryxU64(&x118, &x119, 0x0, x99, x113);
	283	var x120: u64 = undefined;
	284	var x121: u1 = undefined;
	285	p256AddcarryxU64(&x120, &x121, x119, x101, x115);
	286	var x122: u64 = undefined;
	287	var x123: u1 = undefined;
	288	p256AddcarryxU64(&x122, &x123, x121, x103, x117);
	289	var x124: u64 = undefined;
	290	var x125: u1 = undefined;
	291	p256AddcarryxU64(&x124, &x125, x123, x105, x109);
	292	var x126: u64 = undefined;
	293	var x127: u1 = undefined;
	294	p256AddcarryxU64(&x126, &x127, x125, x107, x110);
	295	const x128: u64 = (@intCast(u64, x127) + @intCast(u64, x108));
	296	var x129: u64 = undefined;
	297	var x130: u64 = undefined;
	298	p256MulxU64(&x129, &x130, x3, (arg2[3]));
	299	var x131: u64 = undefined;
	300	var x132: u64 = undefined;
	301	p256MulxU64(&x131, &x132, x3, (arg2[2]));
	302	var x133: u64 = undefined;
	303	var x134: u64 = undefined;
	304	p256MulxU64(&x133, &x134, x3, (arg2[1]));
	305	var x135: u64 = undefined;
	306	var x136: u64 = undefined;
	307	p256MulxU64(&x135, &x136, x3, (arg2[0]));
	308	var x137: u64 = undefined;
	309	var x138: u1 = undefined;
	310	p256AddcarryxU64(&x137, &x138, 0x0, x136, x133);
	311	var x139: u64 = undefined;
	312	var x140: u1 = undefined;
	313	p256AddcarryxU64(&x139, &x140, x138, x134, x131);
	314	var x141: u64 = undefined;
	315	var x142: u1 = undefined;
	316	p256AddcarryxU64(&x141, &x142, x140, x132, x129);
	317	const x143: u64 = (@intCast(u64, x142) + x130);
	318	var x144: u64 = undefined;
	319	var x145: u1 = undefined;
	320	p256AddcarryxU64(&x144, &x145, 0x0, x120, x135);
	321	var x146: u64 = undefined;
	322	var x147: u1 = undefined;
	323	p256AddcarryxU64(&x146, &x147, x145, x122, x137);
	324	var x148: u64 = undefined;
	325	var x149: u1 = undefined;
	326	p256AddcarryxU64(&x148, &x149, x147, x124, x139);
	327	var x150: u64 = undefined;
	328	var x151: u1 = undefined;
	329	p256AddcarryxU64(&x150, &x151, x149, x126, x141);
	330	var x152: u64 = undefined;
	331	var x153: u1 = undefined;
	332	p256AddcarryxU64(&x152, &x153, x151, x128, x143);
	333	var x154: u64 = undefined;
	334	var x155: u64 = undefined;
	335	p256MulxU64(&x154, &x155, x144, 0xffffffff00000001);
	336	var x156: u64 = undefined;
	337	var x157: u64 = undefined;
	338	p256MulxU64(&x156, &x157, x144, 0xffffffff);
	339	var x158: u64 = undefined;
	340	var x159: u64 = undefined;
	341	p256MulxU64(&x158, &x159, x144, 0xffffffffffffffff);
	342	var x160: u64 = undefined;
	343	var x161: u1 = undefined;
	344	p256AddcarryxU64(&x160, &x161, 0x0, x159, x156);
	345	const x162: u64 = (@intCast(u64, x161) + x157);
	346	var x163: u64 = undefined;
	347	var x164: u1 = undefined;
	348	p256AddcarryxU64(&x163, &x164, 0x0, x144, x158);
	349	var x165: u64 = undefined;
	350	var x166: u1 = undefined;
	351	p256AddcarryxU64(&x165, &x166, x164, x146, x160);
	352	var x167: u64 = undefined;
	353	var x168: u1 = undefined;
	354	p256AddcarryxU64(&x167, &x168, x166, x148, x162);
	355	var x169: u64 = undefined;
	356	var x170: u1 = undefined;
	357	p256AddcarryxU64(&x169, &x170, x168, x150, x154);
	358	var x171: u64 = undefined;
	359	var x172: u1 = undefined;
	360	p256AddcarryxU64(&x171, &x172, x170, x152, x155);
	361	const x173: u64 = (@intCast(u64, x172) + @intCast(u64, x153));
	362	var x174: u64 = undefined;
	363	var x175: u1 = undefined;
	364	p256SubborrowxU64(&x174, &x175, 0x0, x165, 0xffffffffffffffff);
	365	var x176: u64 = undefined;
	366	var x177: u1 = undefined;
	367	p256SubborrowxU64(&x176, &x177, x175, x167, 0xffffffff);
	368	var x178: u64 = undefined;
	369	var x179: u1 = undefined;
	370	p256SubborrowxU64(&x178, &x179, x177, x169, @intCast(u64, 0x0));
	371	var x180: u64 = undefined;
	372	var x181: u1 = undefined;
	373	p256SubborrowxU64(&x180, &x181, x179, x171, 0xffffffff00000001);
	374	var x182: u64 = undefined;
	375	var x183: u1 = undefined;
	376	p256SubborrowxU64(&x182, &x183, x181, x173, @intCast(u64, 0x0));
	377	var x184: u64 = undefined;
	378	p256CmovznzU64(&x184, x183, x174, x165);
	379	var x185: u64 = undefined;
	380	p256CmovznzU64(&x185, x183, x176, x167);
	381	var x186: u64 = undefined;
	382	p256CmovznzU64(&x186, x183, x178, x169);
	383	var x187: u64 = undefined;
	384	p256CmovznzU64(&x187, x183, x180, x171);
	385	out1[0] = x184;
	386	out1[1] = x185;
	387	out1[2] = x186;
	388	out1[3] = x187;
	389	}
	390
	391	/// The function p256Square squares a field element in the Montgomery domain.
	392	/// Preconditions:
	393	/// 0 ≤ eval arg1 < m
	394	/// Postconditions:
	395	/// eval (from_montgomery out1) mod m = (eval (from_montgomery arg1) * eval (from_montgomery arg1)) mod m
	396	/// 0 ≤ eval out1 < m
	397	///
	398	/// Input Bounds:
	399	/// arg1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
	400	/// Output Bounds:
	401	/// out1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
	402	pub fn p256Square(out1: *Limbs, arg1: Limbs) void {
	403	const x1: u64 = (arg1[1]);
	404	const x2: u64 = (arg1[2]);
	405	const x3: u64 = (arg1[3]);
	406	const x4: u64 = (arg1[0]);
	407	var x5: u64 = undefined;
	408	var x6: u64 = undefined;
	409	p256MulxU64(&x5, &x6, x4, (arg1[3]));
	410	var x7: u64 = undefined;
	411	var x8: u64 = undefined;
	412	p256MulxU64(&x7, &x8, x4, (arg1[2]));
	413	var x9: u64 = undefined;
	414	var x10: u64 = undefined;
	415	p256MulxU64(&x9, &x10, x4, (arg1[1]));
	416	var x11: u64 = undefined;
	417	var x12: u64 = undefined;
	418	p256MulxU64(&x11, &x12, x4, (arg1[0]));
	419	var x13: u64 = undefined;
	420	var x14: u1 = undefined;
	421	p256AddcarryxU64(&x13, &x14, 0x0, x12, x9);
	422	var x15: u64 = undefined;
	423	var x16: u1 = undefined;
	424	p256AddcarryxU64(&x15, &x16, x14, x10, x7);
	425	var x17: u64 = undefined;
	426	var x18: u1 = undefined;
	427	p256AddcarryxU64(&x17, &x18, x16, x8, x5);
	428	const x19: u64 = (@intCast(u64, x18) + x6);
	429	var x20: u64 = undefined;
	430	var x21: u64 = undefined;
	431	p256MulxU64(&x20, &x21, x11, 0xffffffff00000001);
	432	var x22: u64 = undefined;
	433	var x23: u64 = undefined;
	434	p256MulxU64(&x22, &x23, x11, 0xffffffff);
	435	var x24: u64 = undefined;
	436	var x25: u64 = undefined;
	437	p256MulxU64(&x24, &x25, x11, 0xffffffffffffffff);
	438	var x26: u64 = undefined;
	439	var x27: u1 = undefined;
	440	p256AddcarryxU64(&x26, &x27, 0x0, x25, x22);
	441	const x28: u64 = (@intCast(u64, x27) + x23);
	442	var x29: u64 = undefined;
	443	var x30: u1 = undefined;
	444	p256AddcarryxU64(&x29, &x30, 0x0, x11, x24);
	445	var x31: u64 = undefined;
	446	var x32: u1 = undefined;
	447	p256AddcarryxU64(&x31, &x32, x30, x13, x26);
	448	var x33: u64 = undefined;
	449	var x34: u1 = undefined;
	450	p256AddcarryxU64(&x33, &x34, x32, x15, x28);
	451	var x35: u64 = undefined;
	452	var x36: u1 = undefined;
	453	p256AddcarryxU64(&x35, &x36, x34, x17, x20);
	454	var x37: u64 = undefined;
	455	var x38: u1 = undefined;
	456	p256AddcarryxU64(&x37, &x38, x36, x19, x21);
	457	var x39: u64 = undefined;
	458	var x40: u64 = undefined;
	459	p256MulxU64(&x39, &x40, x1, (arg1[3]));
	460	var x41: u64 = undefined;
	461	var x42: u64 = undefined;
	462	p256MulxU64(&x41, &x42, x1, (arg1[2]));
	463	var x43: u64 = undefined;
	464	var x44: u64 = undefined;
	465	p256MulxU64(&x43, &x44, x1, (arg1[1]));
	466	var x45: u64 = undefined;
	467	var x46: u64 = undefined;
	468	p256MulxU64(&x45, &x46, x1, (arg1[0]));
	469	var x47: u64 = undefined;
	470	var x48: u1 = undefined;
	471	p256AddcarryxU64(&x47, &x48, 0x0, x46, x43);
	472	var x49: u64 = undefined;
	473	var x50: u1 = undefined;
	474	p256AddcarryxU64(&x49, &x50, x48, x44, x41);
	475	var x51: u64 = undefined;
	476	var x52: u1 = undefined;
	477	p256AddcarryxU64(&x51, &x52, x50, x42, x39);
	478	const x53: u64 = (@intCast(u64, x52) + x40);
	479	var x54: u64 = undefined;
	480	var x55: u1 = undefined;
	481	p256AddcarryxU64(&x54, &x55, 0x0, x31, x45);
	482	var x56: u64 = undefined;
	483	var x57: u1 = undefined;
	484	p256AddcarryxU64(&x56, &x57, x55, x33, x47);
	485	var x58: u64 = undefined;
	486	var x59: u1 = undefined;
	487	p256AddcarryxU64(&x58, &x59, x57, x35, x49);
	488	var x60: u64 = undefined;
	489	var x61: u1 = undefined;
	490	p256AddcarryxU64(&x60, &x61, x59, x37, x51);
	491	var x62: u64 = undefined;
	492	var x63: u1 = undefined;
	493	p256AddcarryxU64(&x62, &x63, x61, @intCast(u64, x38), x53);
	494	var x64: u64 = undefined;
	495	var x65: u64 = undefined;
	496	p256MulxU64(&x64, &x65, x54, 0xffffffff00000001);
	497	var x66: u64 = undefined;
	498	var x67: u64 = undefined;
	499	p256MulxU64(&x66, &x67, x54, 0xffffffff);
	500	var x68: u64 = undefined;
	501	var x69: u64 = undefined;
	502	p256MulxU64(&x68, &x69, x54, 0xffffffffffffffff);
	503	var x70: u64 = undefined;
	504	var x71: u1 = undefined;
	505	p256AddcarryxU64(&x70, &x71, 0x0, x69, x66);
	506	const x72: u64 = (@intCast(u64, x71) + x67);
	507	var x73: u64 = undefined;
	508	var x74: u1 = undefined;
	509	p256AddcarryxU64(&x73, &x74, 0x0, x54, x68);
	510	var x75: u64 = undefined;
	511	var x76: u1 = undefined;
	512	p256AddcarryxU64(&x75, &x76, x74, x56, x70);
	513	var x77: u64 = undefined;
	514	var x78: u1 = undefined;
	515	p256AddcarryxU64(&x77, &x78, x76, x58, x72);
	516	var x79: u64 = undefined;
	517	var x80: u1 = undefined;
	518	p256AddcarryxU64(&x79, &x80, x78, x60, x64);
	519	var x81: u64 = undefined;
	520	var x82: u1 = undefined;
	521	p256AddcarryxU64(&x81, &x82, x80, x62, x65);
	522	const x83: u64 = (@intCast(u64, x82) + @intCast(u64, x63));
	523	var x84: u64 = undefined;
	524	var x85: u64 = undefined;
	525	p256MulxU64(&x84, &x85, x2, (arg1[3]));
	526	var x86: u64 = undefined;
	527	var x87: u64 = undefined;
	528	p256MulxU64(&x86, &x87, x2, (arg1[2]));
	529	var x88: u64 = undefined;
	530	var x89: u64 = undefined;
	531	p256MulxU64(&x88, &x89, x2, (arg1[1]));
	532	var x90: u64 = undefined;
	533	var x91: u64 = undefined;
	534	p256MulxU64(&x90, &x91, x2, (arg1[0]));
	535	var x92: u64 = undefined;
	536	var x93: u1 = undefined;
	537	p256AddcarryxU64(&x92, &x93, 0x0, x91, x88);
	538	var x94: u64 = undefined;
	539	var x95: u1 = undefined;
	540	p256AddcarryxU64(&x94, &x95, x93, x89, x86);
	541	var x96: u64 = undefined;
	542	var x97: u1 = undefined;
	543	p256AddcarryxU64(&x96, &x97, x95, x87, x84);
	544	const x98: u64 = (@intCast(u64, x97) + x85);
	545	var x99: u64 = undefined;
	546	var x100: u1 = undefined;
	547	p256AddcarryxU64(&x99, &x100, 0x0, x75, x90);
	548	var x101: u64 = undefined;
	549	var x102: u1 = undefined;
	550	p256AddcarryxU64(&x101, &x102, x100, x77, x92);
	551	var x103: u64 = undefined;
	552	var x104: u1 = undefined;
	553	p256AddcarryxU64(&x103, &x104, x102, x79, x94);
	554	var x105: u64 = undefined;
	555	var x106: u1 = undefined;
	556	p256AddcarryxU64(&x105, &x106, x104, x81, x96);
	557	var x107: u64 = undefined;
	558	var x108: u1 = undefined;
	559	p256AddcarryxU64(&x107, &x108, x106, x83, x98);
	560	var x109: u64 = undefined;
	561	var x110: u64 = undefined;
	562	p256MulxU64(&x109, &x110, x99, 0xffffffff00000001);
	563	var x111: u64 = undefined;
	564	var x112: u64 = undefined;
	565	p256MulxU64(&x111, &x112, x99, 0xffffffff);
	566	var x113: u64 = undefined;
	567	var x114: u64 = undefined;
	568	p256MulxU64(&x113, &x114, x99, 0xffffffffffffffff);
	569	var x115: u64 = undefined;
	570	var x116: u1 = undefined;
	571	p256AddcarryxU64(&x115, &x116, 0x0, x114, x111);
	572	const x117: u64 = (@intCast(u64, x116) + x112);
	573	var x118: u64 = undefined;
	574	var x119: u1 = undefined;
	575	p256AddcarryxU64(&x118, &x119, 0x0, x99, x113);
	576	var x120: u64 = undefined;
	577	var x121: u1 = undefined;
	578	p256AddcarryxU64(&x120, &x121, x119, x101, x115);
	579	var x122: u64 = undefined;
	580	var x123: u1 = undefined;
	581	p256AddcarryxU64(&x122, &x123, x121, x103, x117);
	582	var x124: u64 = undefined;
	583	var x125: u1 = undefined;
	584	p256AddcarryxU64(&x124, &x125, x123, x105, x109);
	585	var x126: u64 = undefined;
	586	var x127: u1 = undefined;
	587	p256AddcarryxU64(&x126, &x127, x125, x107, x110);
	588	const x128: u64 = (@intCast(u64, x127) + @intCast(u64, x108));
	589	var x129: u64 = undefined;
	590	var x130: u64 = undefined;
	591	p256MulxU64(&x129, &x130, x3, (arg1[3]));
	592	var x131: u64 = undefined;
	593	var x132: u64 = undefined;
	594	p256MulxU64(&x131, &x132, x3, (arg1[2]));
	595	var x133: u64 = undefined;
	596	var x134: u64 = undefined;
	597	p256MulxU64(&x133, &x134, x3, (arg1[1]));
	598	var x135: u64 = undefined;
	599	var x136: u64 = undefined;
	600	p256MulxU64(&x135, &x136, x3, (arg1[0]));
	601	var x137: u64 = undefined;
	602	var x138: u1 = undefined;
	603	p256AddcarryxU64(&x137, &x138, 0x0, x136, x133);
	604	var x139: u64 = undefined;
	605	var x140: u1 = undefined;
	606	p256AddcarryxU64(&x139, &x140, x138, x134, x131);
	607	var x141: u64 = undefined;
	608	var x142: u1 = undefined;
	609	p256AddcarryxU64(&x141, &x142, x140, x132, x129);
	610	const x143: u64 = (@intCast(u64, x142) + x130);
	611	var x144: u64 = undefined;
	612	var x145: u1 = undefined;
	613	p256AddcarryxU64(&x144, &x145, 0x0, x120, x135);
	614	var x146: u64 = undefined;
	615	var x147: u1 = undefined;
	616	p256AddcarryxU64(&x146, &x147, x145, x122, x137);
	617	var x148: u64 = undefined;
	618	var x149: u1 = undefined;
	619	p256AddcarryxU64(&x148, &x149, x147, x124, x139);
	620	var x150: u64 = undefined;
	621	var x151: u1 = undefined;
	622	p256AddcarryxU64(&x150, &x151, x149, x126, x141);
	623	var x152: u64 = undefined;
	624	var x153: u1 = undefined;
	625	p256AddcarryxU64(&x152, &x153, x151, x128, x143);
	626	var x154: u64 = undefined;
	627	var x155: u64 = undefined;
	628	p256MulxU64(&x154, &x155, x144, 0xffffffff00000001);
	629	var x156: u64 = undefined;
	630	var x157: u64 = undefined;
	631	p256MulxU64(&x156, &x157, x144, 0xffffffff);
	632	var x158: u64 = undefined;
	633	var x159: u64 = undefined;
	634	p256MulxU64(&x158, &x159, x144, 0xffffffffffffffff);
	635	var x160: u64 = undefined;
	636	var x161: u1 = undefined;
	637	p256AddcarryxU64(&x160, &x161, 0x0, x159, x156);
	638	const x162: u64 = (@intCast(u64, x161) + x157);
	639	var x163: u64 = undefined;
	640	var x164: u1 = undefined;
	641	p256AddcarryxU64(&x163, &x164, 0x0, x144, x158);
	642	var x165: u64 = undefined;
	643	var x166: u1 = undefined;
	644	p256AddcarryxU64(&x165, &x166, x164, x146, x160);
	645	var x167: u64 = undefined;
	646	var x168: u1 = undefined;
	647	p256AddcarryxU64(&x167, &x168, x166, x148, x162);
	648	var x169: u64 = undefined;
	649	var x170: u1 = undefined;
	650	p256AddcarryxU64(&x169, &x170, x168, x150, x154);
	651	var x171: u64 = undefined;
	652	var x172: u1 = undefined;
	653	p256AddcarryxU64(&x171, &x172, x170, x152, x155);
	654	const x173: u64 = (@intCast(u64, x172) + @intCast(u64, x153));
	655	var x174: u64 = undefined;
	656	var x175: u1 = undefined;
	657	p256SubborrowxU64(&x174, &x175, 0x0, x165, 0xffffffffffffffff);
	658	var x176: u64 = undefined;
	659	var x177: u1 = undefined;
	660	p256SubborrowxU64(&x176, &x177, x175, x167, 0xffffffff);
	661	var x178: u64 = undefined;
	662	var x179: u1 = undefined;
	663	p256SubborrowxU64(&x178, &x179, x177, x169, @intCast(u64, 0x0));
	664	var x180: u64 = undefined;
	665	var x181: u1 = undefined;
	666	p256SubborrowxU64(&x180, &x181, x179, x171, 0xffffffff00000001);
	667	var x182: u64 = undefined;
	668	var x183: u1 = undefined;
	669	p256SubborrowxU64(&x182, &x183, x181, x173, @intCast(u64, 0x0));
	670	var x184: u64 = undefined;
	671	p256CmovznzU64(&x184, x183, x174, x165);
	672	var x185: u64 = undefined;
	673	p256CmovznzU64(&x185, x183, x176, x167);
	674	var x186: u64 = undefined;
	675	p256CmovznzU64(&x186, x183, x178, x169);
	676	var x187: u64 = undefined;
	677	p256CmovznzU64(&x187, x183, x180, x171);
	678	out1[0] = x184;
	679	out1[1] = x185;
	680	out1[2] = x186;
	681	out1[3] = x187;
	682	}
	683
	684	/// The function p256Add adds two field elements in the Montgomery domain.
	685	/// Preconditions:
	686	/// 0 ≤ eval arg1 < m
	687	/// 0 ≤ eval arg2 < m
	688	/// Postconditions:
	689	/// eval (from_montgomery out1) mod m = (eval (from_montgomery arg1) + eval (from_montgomery arg2)) mod m
	690	/// 0 ≤ eval out1 < m
	691	///
	692	/// Input Bounds:
	693	/// arg1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
	694	/// arg2: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
	695	/// Output Bounds:
	696	/// out1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
	697	pub fn p256Add(out1: *Limbs, arg1: Limbs, arg2: Limbs) void {
	698	var x1: u64 = undefined;
	699	var x2: u1 = undefined;
	700	p256AddcarryxU64(&x1, &x2, 0x0, (arg1[0]), (arg2[0]));
	701	var x3: u64 = undefined;
	702	var x4: u1 = undefined;
	703	p256AddcarryxU64(&x3, &x4, x2, (arg1[1]), (arg2[1]));
	704	var x5: u64 = undefined;
	705	var x6: u1 = undefined;
	706	p256AddcarryxU64(&x5, &x6, x4, (arg1[2]), (arg2[2]));
	707	var x7: u64 = undefined;
	708	var x8: u1 = undefined;
	709	p256AddcarryxU64(&x7, &x8, x6, (arg1[3]), (arg2[3]));
	710	var x9: u64 = undefined;
	711	var x10: u1 = undefined;
	712	p256SubborrowxU64(&x9, &x10, 0x0, x1, 0xffffffffffffffff);
	713	var x11: u64 = undefined;
	714	var x12: u1 = undefined;
	715	p256SubborrowxU64(&x11, &x12, x10, x3, 0xffffffff);
	716	var x13: u64 = undefined;
	717	var x14: u1 = undefined;
	718	p256SubborrowxU64(&x13, &x14, x12, x5, @intCast(u64, 0x0));
	719	var x15: u64 = undefined;
	720	var x16: u1 = undefined;
	721	p256SubborrowxU64(&x15, &x16, x14, x7, 0xffffffff00000001);
	722	var x17: u64 = undefined;
	723	var x18: u1 = undefined;
	724	p256SubborrowxU64(&x17, &x18, x16, @intCast(u64, x8), @intCast(u64, 0x0));
	725	var x19: u64 = undefined;
	726	p256CmovznzU64(&x19, x18, x9, x1);
	727	var x20: u64 = undefined;
	728	p256CmovznzU64(&x20, x18, x11, x3);
	729	var x21: u64 = undefined;
	730	p256CmovznzU64(&x21, x18, x13, x5);
	731	var x22: u64 = undefined;
	732	p256CmovznzU64(&x22, x18, x15, x7);
	733	out1[0] = x19;
	734	out1[1] = x20;
	735	out1[2] = x21;
	736	out1[3] = x22;
	737	}
	738
	739	/// The function p256Sub subtracts two field elements in the Montgomery domain.
	740	/// Preconditions:
	741	/// 0 ≤ eval arg1 < m
	742	/// 0 ≤ eval arg2 < m
	743	/// Postconditions:
	744	/// eval (from_montgomery out1) mod m = (eval (from_montgomery arg1) - eval (from_montgomery arg2)) mod m
	745	/// 0 ≤ eval out1 < m
	746	///
	747	/// Input Bounds:
	748	/// arg1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
	749	/// arg2: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
	750	/// Output Bounds:
	751	/// out1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
	752	pub fn p256Sub(out1: *Limbs, arg1: Limbs, arg2: Limbs) void {
	753	var x1: u64 = undefined;
	754	var x2: u1 = undefined;
	755	p256SubborrowxU64(&x1, &x2, 0x0, (arg1[0]), (arg2[0]));
	756	var x3: u64 = undefined;
	757	var x4: u1 = undefined;
	758	p256SubborrowxU64(&x3, &x4, x2, (arg1[1]), (arg2[1]));
	759	var x5: u64 = undefined;
	760	var x6: u1 = undefined;
	761	p256SubborrowxU64(&x5, &x6, x4, (arg1[2]), (arg2[2]));
	762	var x7: u64 = undefined;
	763	var x8: u1 = undefined;
	764	p256SubborrowxU64(&x7, &x8, x6, (arg1[3]), (arg2[3]));
	765	var x9: u64 = undefined;
	766	p256CmovznzU64(&x9, x8, @intCast(u64, 0x0), 0xffffffffffffffff);
	767	var x10: u64 = undefined;
	768	var x11: u1 = undefined;
	769	p256AddcarryxU64(&x10, &x11, 0x0, x1, x9);
	770	var x12: u64 = undefined;
	771	var x13: u1 = undefined;
	772	p256AddcarryxU64(&x12, &x13, x11, x3, (x9 & 0xffffffff));
	773	var x14: u64 = undefined;
	774	var x15: u1 = undefined;
	775	p256AddcarryxU64(&x14, &x15, x13, x5, @intCast(u64, 0x0));
	776	var x16: u64 = undefined;
	777	var x17: u1 = undefined;
	778	p256AddcarryxU64(&x16, &x17, x15, x7, (x9 & 0xffffffff00000001));
	779	out1[0] = x10;
	780	out1[1] = x12;
	781	out1[2] = x14;
	782	out1[3] = x16;
	783	}
	784
	785	/// The function p256Opp negates a field element in the Montgomery domain.
	786	/// Preconditions:
	787	/// 0 ≤ eval arg1 < m
	788	/// Postconditions:
	789	/// eval (from_montgomery out1) mod m = -eval (from_montgomery arg1) mod m
	790	/// 0 ≤ eval out1 < m
	791	///
	792	/// Input Bounds:
	793	/// arg1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
	794	/// Output Bounds:
	795	/// out1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
	796	pub fn p256Opp(out1: *Limbs, arg1: Limbs) void {
	797	var x1: u64 = undefined;
	798	var x2: u1 = undefined;
	799	p256SubborrowxU64(&x1, &x2, 0x0, @intCast(u64, 0x0), (arg1[0]));
	800	var x3: u64 = undefined;
	801	var x4: u1 = undefined;
	802	p256SubborrowxU64(&x3, &x4, x2, @intCast(u64, 0x0), (arg1[1]));
	803	var x5: u64 = undefined;
	804	var x6: u1 = undefined;
	805	p256SubborrowxU64(&x5, &x6, x4, @intCast(u64, 0x0), (arg1[2]));
	806	var x7: u64 = undefined;
	807	var x8: u1 = undefined;
	808	p256SubborrowxU64(&x7, &x8, x6, @intCast(u64, 0x0), (arg1[3]));
	809	var x9: u64 = undefined;
	810	p256CmovznzU64(&x9, x8, @intCast(u64, 0x0), 0xffffffffffffffff);
	811	var x10: u64 = undefined;
	812	var x11: u1 = undefined;
	813	p256AddcarryxU64(&x10, &x11, 0x0, x1, x9);
	814	var x12: u64 = undefined;
	815	var x13: u1 = undefined;
	816	p256AddcarryxU64(&x12, &x13, x11, x3, (x9 & 0xffffffff));
	817	var x14: u64 = undefined;
	818	var x15: u1 = undefined;
	819	p256AddcarryxU64(&x14, &x15, x13, x5, @intCast(u64, 0x0));
	820	var x16: u64 = undefined;
	821	var x17: u1 = undefined;
	822	p256AddcarryxU64(&x16, &x17, x15, x7, (x9 & 0xffffffff00000001));
	823	out1[0] = x10;
	824	out1[1] = x12;
	825	out1[2] = x14;
	826	out1[3] = x16;
	827	}
	828
	829	/// The function p256FromMontgomery translates a field element out of the Montgomery domain.
	830	/// Preconditions:
	831	/// 0 ≤ eval arg1 < m
	832	/// Postconditions:
	833	/// eval out1 mod m = (eval arg1 * ((2^64)⁻¹ mod m)^4) mod m
	834	/// 0 ≤ eval out1 < m
	835	///
	836	/// Input Bounds:
	837	/// arg1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
	838	/// Output Bounds:
	839	/// out1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
	840	pub fn p256FromMontgomery(out1: *Limbs, arg1: Limbs) void {
	841	const x1: u64 = (arg1[0]);
	842	var x2: u64 = undefined;
	843	var x3: u64 = undefined;
	844	p256MulxU64(&x2, &x3, x1, 0xffffffff00000001);
	845	var x4: u64 = undefined;
	846	var x5: u64 = undefined;
	847	p256MulxU64(&x4, &x5, x1, 0xffffffff);
	848	var x6: u64 = undefined;
	849	var x7: u64 = undefined;
	850	p256MulxU64(&x6, &x7, x1, 0xffffffffffffffff);
	851	var x8: u64 = undefined;
	852	var x9: u1 = undefined;
	853	p256AddcarryxU64(&x8, &x9, 0x0, x7, x4);
	854	var x10: u64 = undefined;
	855	var x11: u1 = undefined;
	856	p256AddcarryxU64(&x10, &x11, 0x0, x1, x6);
	857	var x12: u64 = undefined;
	858	var x13: u1 = undefined;
	859	p256AddcarryxU64(&x12, &x13, x11, @intCast(u64, 0x0), x8);
	860	var x14: u64 = undefined;
	861	var x15: u1 = undefined;
	862	p256AddcarryxU64(&x14, &x15, 0x0, x12, (arg1[1]));
	863	var x16: u64 = undefined;
	864	var x17: u64 = undefined;
	865	p256MulxU64(&x16, &x17, x14, 0xffffffff00000001);
	866	var x18: u64 = undefined;
	867	var x19: u64 = undefined;
	868	p256MulxU64(&x18, &x19, x14, 0xffffffff);
	869	var x20: u64 = undefined;
	870	var x21: u64 = undefined;
	871	p256MulxU64(&x20, &x21, x14, 0xffffffffffffffff);
	872	var x22: u64 = undefined;
	873	var x23: u1 = undefined;
	874	p256AddcarryxU64(&x22, &x23, 0x0, x21, x18);
	875	var x24: u64 = undefined;
	876	var x25: u1 = undefined;
	877	p256AddcarryxU64(&x24, &x25, 0x0, x14, x20);
	878	var x26: u64 = undefined;
	879	var x27: u1 = undefined;
	880	p256AddcarryxU64(&x26, &x27, x25, (@intCast(u64, x15) + (@intCast(u64, x13) + (@intCast(u64, x9) + x5))), x22);
	881	var x28: u64 = undefined;
	882	var x29: u1 = undefined;
	883	p256AddcarryxU64(&x28, &x29, x27, x2, (@intCast(u64, x23) + x19));
	884	var x30: u64 = undefined;
	885	var x31: u1 = undefined;
	886	p256AddcarryxU64(&x30, &x31, x29, x3, x16);
	887	var x32: u64 = undefined;
	888	var x33: u1 = undefined;
	889	p256AddcarryxU64(&x32, &x33, 0x0, x26, (arg1[2]));
	890	var x34: u64 = undefined;
	891	var x35: u1 = undefined;
	892	p256AddcarryxU64(&x34, &x35, x33, x28, @intCast(u64, 0x0));
	893	var x36: u64 = undefined;
	894	var x37: u1 = undefined;
	895	p256AddcarryxU64(&x36, &x37, x35, x30, @intCast(u64, 0x0));
	896	var x38: u64 = undefined;
	897	var x39: u64 = undefined;
	898	p256MulxU64(&x38, &x39, x32, 0xffffffff00000001);
	899	var x40: u64 = undefined;
	900	var x41: u64 = undefined;
	901	p256MulxU64(&x40, &x41, x32, 0xffffffff);
	902	var x42: u64 = undefined;
	903	var x43: u64 = undefined;
	904	p256MulxU64(&x42, &x43, x32, 0xffffffffffffffff);
	905	var x44: u64 = undefined;
	906	var x45: u1 = undefined;
	907	p256AddcarryxU64(&x44, &x45, 0x0, x43, x40);
	908	var x46: u64 = undefined;
	909	var x47: u1 = undefined;
	910	p256AddcarryxU64(&x46, &x47, 0x0, x32, x42);
	911	var x48: u64 = undefined;
	912	var x49: u1 = undefined;
	913	p256AddcarryxU64(&x48, &x49, x47, x34, x44);
	914	var x50: u64 = undefined;
	915	var x51: u1 = undefined;
	916	p256AddcarryxU64(&x50, &x51, x49, x36, (@intCast(u64, x45) + x41));
	917	var x52: u64 = undefined;
	918	var x53: u1 = undefined;
	919	p256AddcarryxU64(&x52, &x53, x51, (@intCast(u64, x37) + (@intCast(u64, x31) + x17)), x38);
	920	var x54: u64 = undefined;
	921	var x55: u1 = undefined;
	922	p256AddcarryxU64(&x54, &x55, 0x0, x48, (arg1[3]));
	923	var x56: u64 = undefined;
	924	var x57: u1 = undefined;
	925	p256AddcarryxU64(&x56, &x57, x55, x50, @intCast(u64, 0x0));
	926	var x58: u64 = undefined;
	927	var x59: u1 = undefined;
	928	p256AddcarryxU64(&x58, &x59, x57, x52, @intCast(u64, 0x0));
	929	var x60: u64 = undefined;
	930	var x61: u64 = undefined;
	931	p256MulxU64(&x60, &x61, x54, 0xffffffff00000001);
	932	var x62: u64 = undefined;
	933	var x63: u64 = undefined;
	934	p256MulxU64(&x62, &x63, x54, 0xffffffff);
	935	var x64: u64 = undefined;
	936	var x65: u64 = undefined;
	937	p256MulxU64(&x64, &x65, x54, 0xffffffffffffffff);
	938	var x66: u64 = undefined;
	939	var x67: u1 = undefined;
	940	p256AddcarryxU64(&x66, &x67, 0x0, x65, x62);
	941	var x68: u64 = undefined;
	942	var x69: u1 = undefined;
	943	p256AddcarryxU64(&x68, &x69, 0x0, x54, x64);
	944	var x70: u64 = undefined;
	945	var x71: u1 = undefined;
	946	p256AddcarryxU64(&x70, &x71, x69, x56, x66);
	947	var x72: u64 = undefined;
	948	var x73: u1 = undefined;
	949	p256AddcarryxU64(&x72, &x73, x71, x58, (@intCast(u64, x67) + x63));
	950	var x74: u64 = undefined;
	951	var x75: u1 = undefined;
	952	p256AddcarryxU64(&x74, &x75, x73, (@intCast(u64, x59) + (@intCast(u64, x53) + x39)), x60);
	953	const x76: u64 = (@intCast(u64, x75) + x61);
	954	var x77: u64 = undefined;
	955	var x78: u1 = undefined;
	956	p256SubborrowxU64(&x77, &x78, 0x0, x70, 0xffffffffffffffff);
	957	var x79: u64 = undefined;
	958	var x80: u1 = undefined;
	959	p256SubborrowxU64(&x79, &x80, x78, x72, 0xffffffff);
	960	var x81: u64 = undefined;
	961	var x82: u1 = undefined;
	962	p256SubborrowxU64(&x81, &x82, x80, x74, @intCast(u64, 0x0));
	963	var x83: u64 = undefined;
	964	var x84: u1 = undefined;
	965	p256SubborrowxU64(&x83, &x84, x82, x76, 0xffffffff00000001);
	966	var x85: u64 = undefined;
	967	var x86: u1 = undefined;
	968	p256SubborrowxU64(&x85, &x86, x84, @intCast(u64, 0x0), @intCast(u64, 0x0));
	969	var x87: u64 = undefined;
	970	p256CmovznzU64(&x87, x86, x77, x70);
	971	var x88: u64 = undefined;
	972	p256CmovznzU64(&x88, x86, x79, x72);
	973	var x89: u64 = undefined;
	974	p256CmovznzU64(&x89, x86, x81, x74);
	975	var x90: u64 = undefined;
	976	p256CmovznzU64(&x90, x86, x83, x76);
	977	out1[0] = x87;
	978	out1[1] = x88;
	979	out1[2] = x89;
	980	out1[3] = x90;
	981	}
	982
	983	/// The function p256ToMontgomery translates a field element into the Montgomery domain.
	984	/// Preconditions:
	985	/// 0 ≤ eval arg1 < m
	986	/// Postconditions:
	987	/// eval (from_montgomery out1) mod m = eval arg1 mod m
	988	/// 0 ≤ eval out1 < m
	989	///
	990	/// Input Bounds:
	991	/// arg1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
	992	/// Output Bounds:
	993	/// out1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
	994	pub fn p256ToMontgomery(out1: *Limbs, arg1: Limbs) void {
	995	const x1: u64 = (arg1[1]);
	996	const x2: u64 = (arg1[2]);
	997	const x3: u64 = (arg1[3]);
	998	const x4: u64 = (arg1[0]);
	999	var x5: u64 = undefined;
	1000	var x6: u64 = undefined;
	1001	p256MulxU64(&x5, &x6, x4, 0x4fffffffd);
	1002	var x7: u64 = undefined;
	1003	var x8: u64 = undefined;
	1004	p256MulxU64(&x7, &x8, x4, 0xfffffffffffffffe);
	1005	var x9: u64 = undefined;
	1006	var x10: u64 = undefined;
	1007	p256MulxU64(&x9, &x10, x4, 0xfffffffbffffffff);
	1008	var x11: u64 = undefined;
	1009	var x12: u64 = undefined;
	1010	p256MulxU64(&x11, &x12, x4, 0x3);
	1011	var x13: u64 = undefined;
	1012	var x14: u1 = undefined;
	1013	p256AddcarryxU64(&x13, &x14, 0x0, x12, x9);
	1014	var x15: u64 = undefined;
	1015	var x16: u1 = undefined;
	1016	p256AddcarryxU64(&x15, &x16, x14, x10, x7);
	1017	var x17: u64 = undefined;
	1018	var x18: u1 = undefined;
	1019	p256AddcarryxU64(&x17, &x18, x16, x8, x5);
	1020	var x19: u64 = undefined;
	1021	var x20: u64 = undefined;
	1022	p256MulxU64(&x19, &x20, x11, 0xffffffff00000001);
	1023	var x21: u64 = undefined;
	1024	var x22: u64 = undefined;
	1025	p256MulxU64(&x21, &x22, x11, 0xffffffff);
	1026	var x23: u64 = undefined;
	1027	var x24: u64 = undefined;
	1028	p256MulxU64(&x23, &x24, x11, 0xffffffffffffffff);
	1029	var x25: u64 = undefined;
	1030	var x26: u1 = undefined;
	1031	p256AddcarryxU64(&x25, &x26, 0x0, x24, x21);
	1032	var x27: u64 = undefined;
	1033	var x28: u1 = undefined;
	1034	p256AddcarryxU64(&x27, &x28, 0x0, x11, x23);
	1035	var x29: u64 = undefined;
	1036	var x30: u1 = undefined;
	1037	p256AddcarryxU64(&x29, &x30, x28, x13, x25);
	1038	var x31: u64 = undefined;
	1039	var x32: u1 = undefined;
	1040	p256AddcarryxU64(&x31, &x32, x30, x15, (@intCast(u64, x26) + x22));
	1041	var x33: u64 = undefined;
	1042	var x34: u1 = undefined;
	1043	p256AddcarryxU64(&x33, &x34, x32, x17, x19);
	1044	var x35: u64 = undefined;
	1045	var x36: u1 = undefined;
	1046	p256AddcarryxU64(&x35, &x36, x34, (@intCast(u64, x18) + x6), x20);
	1047	var x37: u64 = undefined;
	1048	var x38: u64 = undefined;
	1049	p256MulxU64(&x37, &x38, x1, 0x4fffffffd);
	1050	var x39: u64 = undefined;
	1051	var x40: u64 = undefined;
	1052	p256MulxU64(&x39, &x40, x1, 0xfffffffffffffffe);
	1053	var x41: u64 = undefined;
	1054	var x42: u64 = undefined;
	1055	p256MulxU64(&x41, &x42, x1, 0xfffffffbffffffff);
	1056	var x43: u64 = undefined;
	1057	var x44: u64 = undefined;
	1058	p256MulxU64(&x43, &x44, x1, 0x3);
	1059	var x45: u64 = undefined;
	1060	var x46: u1 = undefined;
	1061	p256AddcarryxU64(&x45, &x46, 0x0, x44, x41);
	1062	var x47: u64 = undefined;
	1063	var x48: u1 = undefined;
	1064	p256AddcarryxU64(&x47, &x48, x46, x42, x39);
	1065	var x49: u64 = undefined;
	1066	var x50: u1 = undefined;
	1067	p256AddcarryxU64(&x49, &x50, x48, x40, x37);
	1068	var x51: u64 = undefined;
	1069	var x52: u1 = undefined;
	1070	p256AddcarryxU64(&x51, &x52, 0x0, x29, x43);
	1071	var x53: u64 = undefined;
	1072	var x54: u1 = undefined;
	1073	p256AddcarryxU64(&x53, &x54, x52, x31, x45);
	1074	var x55: u64 = undefined;
	1075	var x56: u1 = undefined;
	1076	p256AddcarryxU64(&x55, &x56, x54, x33, x47);
	1077	var x57: u64 = undefined;
	1078	var x58: u1 = undefined;
	1079	p256AddcarryxU64(&x57, &x58, x56, x35, x49);
	1080	var x59: u64 = undefined;
	1081	var x60: u64 = undefined;
	1082	p256MulxU64(&x59, &x60, x51, 0xffffffff00000001);
	1083	var x61: u64 = undefined;
	1084	var x62: u64 = undefined;
	1085	p256MulxU64(&x61, &x62, x51, 0xffffffff);
	1086	var x63: u64 = undefined;
	1087	var x64: u64 = undefined;
	1088	p256MulxU64(&x63, &x64, x51, 0xffffffffffffffff);
	1089	var x65: u64 = undefined;
	1090	var x66: u1 = undefined;
	1091	p256AddcarryxU64(&x65, &x66, 0x0, x64, x61);
	1092	var x67: u64 = undefined;
	1093	var x68: u1 = undefined;
	1094	p256AddcarryxU64(&x67, &x68, 0x0, x51, x63);
	1095	var x69: u64 = undefined;
	1096	var x70: u1 = undefined;
	1097	p256AddcarryxU64(&x69, &x70, x68, x53, x65);
	1098	var x71: u64 = undefined;
	1099	var x72: u1 = undefined;
	1100	p256AddcarryxU64(&x71, &x72, x70, x55, (@intCast(u64, x66) + x62));
	1101	var x73: u64 = undefined;
	1102	var x74: u1 = undefined;
	1103	p256AddcarryxU64(&x73, &x74, x72, x57, x59);
	1104	var x75: u64 = undefined;
	1105	var x76: u1 = undefined;
	1106	p256AddcarryxU64(&x75, &x76, x74, ((@intCast(u64, x58) + @intCast(u64, x36)) + (@intCast(u64, x50) + x38)), x60);
	1107	var x77: u64 = undefined;
	1108	var x78: u64 = undefined;
	1109	p256MulxU64(&x77, &x78, x2, 0x4fffffffd);
	1110	var x79: u64 = undefined;
	1111	var x80: u64 = undefined;
	1112	p256MulxU64(&x79, &x80, x2, 0xfffffffffffffffe);
	1113	var x81: u64 = undefined;
	1114	var x82: u64 = undefined;
	1115	p256MulxU64(&x81, &x82, x2, 0xfffffffbffffffff);
	1116	var x83: u64 = undefined;
	1117	var x84: u64 = undefined;
	1118	p256MulxU64(&x83, &x84, x2, 0x3);
	1119	var x85: u64 = undefined;
	1120	var x86: u1 = undefined;
	1121	p256AddcarryxU64(&x85, &x86, 0x0, x84, x81);
	1122	var x87: u64 = undefined;
	1123	var x88: u1 = undefined;
	1124	p256AddcarryxU64(&x87, &x88, x86, x82, x79);
	1125	var x89: u64 = undefined;
	1126	var x90: u1 = undefined;
	1127	p256AddcarryxU64(&x89, &x90, x88, x80, x77);
	1128	var x91: u64 = undefined;
	1129	var x92: u1 = undefined;
	1130	p256AddcarryxU64(&x91, &x92, 0x0, x69, x83);
	1131	var x93: u64 = undefined;
	1132	var x94: u1 = undefined;
	1133	p256AddcarryxU64(&x93, &x94, x92, x71, x85);
	1134	var x95: u64 = undefined;
	1135	var x96: u1 = undefined;
	1136	p256AddcarryxU64(&x95, &x96, x94, x73, x87);
	1137	var x97: u64 = undefined;
	1138	var x98: u1 = undefined;
	1139	p256AddcarryxU64(&x97, &x98, x96, x75, x89);
	1140	var x99: u64 = undefined;
	1141	var x100: u64 = undefined;
	1142	p256MulxU64(&x99, &x100, x91, 0xffffffff00000001);
	1143	var x101: u64 = undefined;
	1144	var x102: u64 = undefined;
	1145	p256MulxU64(&x101, &x102, x91, 0xffffffff);
	1146	var x103: u64 = undefined;
	1147	var x104: u64 = undefined;
	1148	p256MulxU64(&x103, &x104, x91, 0xffffffffffffffff);
	1149	var x105: u64 = undefined;
	1150	var x106: u1 = undefined;
	1151	p256AddcarryxU64(&x105, &x106, 0x0, x104, x101);
	1152	var x107: u64 = undefined;
	1153	var x108: u1 = undefined;
	1154	p256AddcarryxU64(&x107, &x108, 0x0, x91, x103);
	1155	var x109: u64 = undefined;
	1156	var x110: u1 = undefined;
	1157	p256AddcarryxU64(&x109, &x110, x108, x93, x105);
	1158	var x111: u64 = undefined;
	1159	var x112: u1 = undefined;
	1160	p256AddcarryxU64(&x111, &x112, x110, x95, (@intCast(u64, x106) + x102));
	1161	var x113: u64 = undefined;
	1162	var x114: u1 = undefined;
	1163	p256AddcarryxU64(&x113, &x114, x112, x97, x99);
	1164	var x115: u64 = undefined;
	1165	var x116: u1 = undefined;
	1166	p256AddcarryxU64(&x115, &x116, x114, ((@intCast(u64, x98) + @intCast(u64, x76)) + (@intCast(u64, x90) + x78)), x100);
	1167	var x117: u64 = undefined;
	1168	var x118: u64 = undefined;
	1169	p256MulxU64(&x117, &x118, x3, 0x4fffffffd);
	1170	var x119: u64 = undefined;
	1171	var x120: u64 = undefined;
	1172	p256MulxU64(&x119, &x120, x3, 0xfffffffffffffffe);
	1173	var x121: u64 = undefined;
	1174	var x122: u64 = undefined;
	1175	p256MulxU64(&x121, &x122, x3, 0xfffffffbffffffff);
	1176	var x123: u64 = undefined;
	1177	var x124: u64 = undefined;
	1178	p256MulxU64(&x123, &x124, x3, 0x3);
	1179	var x125: u64 = undefined;
	1180	var x126: u1 = undefined;
	1181	p256AddcarryxU64(&x125, &x126, 0x0, x124, x121);
	1182	var x127: u64 = undefined;
	1183	var x128: u1 = undefined;
	1184	p256AddcarryxU64(&x127, &x128, x126, x122, x119);
	1185	var x129: u64 = undefined;
	1186	var x130: u1 = undefined;
	1187	p256AddcarryxU64(&x129, &x130, x128, x120, x117);
	1188	var x131: u64 = undefined;
	1189	var x132: u1 = undefined;
	1190	p256AddcarryxU64(&x131, &x132, 0x0, x109, x123);
	1191	var x133: u64 = undefined;
	1192	var x134: u1 = undefined;
	1193	p256AddcarryxU64(&x133, &x134, x132, x111, x125);
	1194	var x135: u64 = undefined;
	1195	var x136: u1 = undefined;
	1196	p256AddcarryxU64(&x135, &x136, x134, x113, x127);
	1197	var x137: u64 = undefined;
	1198	var x138: u1 = undefined;
	1199	p256AddcarryxU64(&x137, &x138, x136, x115, x129);
	1200	var x139: u64 = undefined;
	1201	var x140: u64 = undefined;
	1202	p256MulxU64(&x139, &x140, x131, 0xffffffff00000001);
	1203	var x141: u64 = undefined;
	1204	var x142: u64 = undefined;
	1205	p256MulxU64(&x141, &x142, x131, 0xffffffff);
	1206	var x143: u64 = undefined;
	1207	var x144: u64 = undefined;
	1208	p256MulxU64(&x143, &x144, x131, 0xffffffffffffffff);
	1209	var x145: u64 = undefined;
	1210	var x146: u1 = undefined;
	1211	p256AddcarryxU64(&x145, &x146, 0x0, x144, x141);
	1212	var x147: u64 = undefined;
	1213	var x148: u1 = undefined;
	1214	p256AddcarryxU64(&x147, &x148, 0x0, x131, x143);
	1215	var x149: u64 = undefined;
	1216	var x150: u1 = undefined;
	1217	p256AddcarryxU64(&x149, &x150, x148, x133, x145);
	1218	var x151: u64 = undefined;
	1219	var x152: u1 = undefined;
	1220	p256AddcarryxU64(&x151, &x152, x150, x135, (@intCast(u64, x146) + x142));
	1221	var x153: u64 = undefined;
	1222	var x154: u1 = undefined;
	1223	p256AddcarryxU64(&x153, &x154, x152, x137, x139);
	1224	var x155: u64 = undefined;
	1225	var x156: u1 = undefined;
	1226	p256AddcarryxU64(&x155, &x156, x154, ((@intCast(u64, x138) + @intCast(u64, x116)) + (@intCast(u64, x130) + x118)), x140);
	1227	var x157: u64 = undefined;
	1228	var x158: u1 = undefined;
	1229	p256SubborrowxU64(&x157, &x158, 0x0, x149, 0xffffffffffffffff);
	1230	var x159: u64 = undefined;
	1231	var x160: u1 = undefined;
	1232	p256SubborrowxU64(&x159, &x160, x158, x151, 0xffffffff);
	1233	var x161: u64 = undefined;
	1234	var x162: u1 = undefined;
	1235	p256SubborrowxU64(&x161, &x162, x160, x153, @intCast(u64, 0x0));
	1236	var x163: u64 = undefined;
	1237	var x164: u1 = undefined;
	1238	p256SubborrowxU64(&x163, &x164, x162, x155, 0xffffffff00000001);
	1239	var x165: u64 = undefined;
	1240	var x166: u1 = undefined;
	1241	p256SubborrowxU64(&x165, &x166, x164, @intCast(u64, x156), @intCast(u64, 0x0));
	1242	var x167: u64 = undefined;
	1243	p256CmovznzU64(&x167, x166, x157, x149);
	1244	var x168: u64 = undefined;
	1245	p256CmovznzU64(&x168, x166, x159, x151);
	1246	var x169: u64 = undefined;
	1247	p256CmovznzU64(&x169, x166, x161, x153);
	1248	var x170: u64 = undefined;
	1249	p256CmovznzU64(&x170, x166, x163, x155);
	1250	out1[0] = x167;
	1251	out1[1] = x168;
	1252	out1[2] = x169;
	1253	out1[3] = x170;
	1254	}
	1255
	1256	/// The function p256Nonzero outputs a single non-zero word if the input is non-zero and zero otherwise.
	1257	/// Preconditions:
	1258	/// 0 ≤ eval arg1 < m
	1259	/// Postconditions:
	1260	/// out1 = 0 ↔ eval (from_montgomery arg1) mod m = 0
	1261	///
	1262	/// Input Bounds:
	1263	/// arg1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
	1264	/// Output Bounds:
	1265	/// out1: [0x0 ~> 0xffffffffffffffff]
	1266	pub fn p256Nonzero(out1: *u64, arg1: Limbs) void {
	1267	const x1: u64 = ((arg1[0]) \| ((arg1[1]) \| ((arg1[2]) \| (arg1[3]))));
	1268	out1.* = x1;
	1269	}
	1270
	1271	/// The function p256Selectznz is a multi-limb conditional select.
	1272	/// Postconditions:
	1273	/// eval out1 = (if arg1 = 0 then eval arg2 else eval arg3)
	1274	///
	1275	/// Input Bounds:
	1276	/// arg1: [0x0 ~> 0x1]
	1277	/// arg2: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
	1278	/// arg3: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
	1279	/// Output Bounds:
	1280	/// out1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
	1281	pub fn p256Selectznz(out1: *Limbs, arg1: u1, arg2: Limbs, arg3: Limbs) void {
	1282	var x1: u64 = undefined;
	1283	p256CmovznzU64(&x1, arg1, (arg2[0]), (arg3[0]));
	1284	var x2: u64 = undefined;
	1285	p256CmovznzU64(&x2, arg1, (arg2[1]), (arg3[1]));
	1286	var x3: u64 = undefined;
	1287	p256CmovznzU64(&x3, arg1, (arg2[2]), (arg3[2]));
	1288	var x4: u64 = undefined;
	1289	p256CmovznzU64(&x4, arg1, (arg2[3]), (arg3[3]));
	1290	out1[0] = x1;
	1291	out1[1] = x2;
	1292	out1[2] = x3;
	1293	out1[3] = x4;
	1294	}
	1295
	1296	/// The function p256ToBytes serializes a field element NOT in the Montgomery domain to bytes in little-endian order.
	1297	/// Preconditions:
	1298	/// 0 ≤ eval arg1 < m
	1299	/// Postconditions:
	1300	/// out1 = map (λ x, ⌊((eval arg1 mod m) mod 2^(8 * (x + 1))) / 2^(8 * x)⌋) [0..31]
	1301	///
	1302	/// Input Bounds:
	1303	/// arg1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
	1304	/// Output Bounds:
	1305	/// out1: [[0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff]]
	1306	pub fn p256ToBytes(out1: *[32]u8, arg1: Limbs) void {
	1307	const x1: u64 = (arg1[3]);
	1308	const x2: u64 = (arg1[2]);
	1309	const x3: u64 = (arg1[1]);
	1310	const x4: u64 = (arg1[0]);
	1311	const x5: u8 = @intCast(u8, (x4 & @intCast(u64, 0xff)));
	1312	const x6: u64 = (x4 >> 8);
	1313	const x7: u8 = @intCast(u8, (x6 & @intCast(u64, 0xff)));
	1314	const x8: u64 = (x6 >> 8);
	1315	const x9: u8 = @intCast(u8, (x8 & @intCast(u64, 0xff)));
	1316	const x10: u64 = (x8 >> 8);
	1317	const x11: u8 = @intCast(u8, (x10 & @intCast(u64, 0xff)));
	1318	const x12: u64 = (x10 >> 8);
	1319	const x13: u8 = @intCast(u8, (x12 & @intCast(u64, 0xff)));
	1320	const x14: u64 = (x12 >> 8);
	1321	const x15: u8 = @intCast(u8, (x14 & @intCast(u64, 0xff)));
	1322	const x16: u64 = (x14 >> 8);
	1323	const x17: u8 = @intCast(u8, (x16 & @intCast(u64, 0xff)));
	1324	const x18: u8 = @intCast(u8, (x16 >> 8));
	1325	const x19: u8 = @intCast(u8, (x3 & @intCast(u64, 0xff)));
	1326	const x20: u64 = (x3 >> 8);
	1327	const x21: u8 = @intCast(u8, (x20 & @intCast(u64, 0xff)));
	1328	const x22: u64 = (x20 >> 8);
	1329	const x23: u8 = @intCast(u8, (x22 & @intCast(u64, 0xff)));
	1330	const x24: u64 = (x22 >> 8);
	1331	const x25: u8 = @intCast(u8, (x24 & @intCast(u64, 0xff)));
	1332	const x26: u64 = (x24 >> 8);
	1333	const x27: u8 = @intCast(u8, (x26 & @intCast(u64, 0xff)));
	1334	const x28: u64 = (x26 >> 8);
	1335	const x29: u8 = @intCast(u8, (x28 & @intCast(u64, 0xff)));
	1336	const x30: u64 = (x28 >> 8);
	1337	const x31: u8 = @intCast(u8, (x30 & @intCast(u64, 0xff)));
	1338	const x32: u8 = @intCast(u8, (x30 >> 8));
	1339	const x33: u8 = @intCast(u8, (x2 & @intCast(u64, 0xff)));
	1340	const x34: u64 = (x2 >> 8);
	1341	const x35: u8 = @intCast(u8, (x34 & @intCast(u64, 0xff)));
	1342	const x36: u64 = (x34 >> 8);
	1343	const x37: u8 = @intCast(u8, (x36 & @intCast(u64, 0xff)));
	1344	const x38: u64 = (x36 >> 8);
	1345	const x39: u8 = @intCast(u8, (x38 & @intCast(u64, 0xff)));
	1346	const x40: u64 = (x38 >> 8);
	1347	const x41: u8 = @intCast(u8, (x40 & @intCast(u64, 0xff)));
	1348	const x42: u64 = (x40 >> 8);
	1349	const x43: u8 = @intCast(u8, (x42 & @intCast(u64, 0xff)));
	1350	const x44: u64 = (x42 >> 8);
	1351	const x45: u8 = @intCast(u8, (x44 & @intCast(u64, 0xff)));
	1352	const x46: u8 = @intCast(u8, (x44 >> 8));
	1353	const x47: u8 = @intCast(u8, (x1 & @intCast(u64, 0xff)));
	1354	const x48: u64 = (x1 >> 8);
	1355	const x49: u8 = @intCast(u8, (x48 & @intCast(u64, 0xff)));
	1356	const x50: u64 = (x48 >> 8);
	1357	const x51: u8 = @intCast(u8, (x50 & @intCast(u64, 0xff)));
	1358	const x52: u64 = (x50 >> 8);
	1359	const x53: u8 = @intCast(u8, (x52 & @intCast(u64, 0xff)));
	1360	const x54: u64 = (x52 >> 8);
	1361	const x55: u8 = @intCast(u8, (x54 & @intCast(u64, 0xff)));
	1362	const x56: u64 = (x54 >> 8);
	1363	const x57: u8 = @intCast(u8, (x56 & @intCast(u64, 0xff)));
	1364	const x58: u64 = (x56 >> 8);
	1365	const x59: u8 = @intCast(u8, (x58 & @intCast(u64, 0xff)));
	1366	const x60: u8 = @intCast(u8, (x58 >> 8));
	1367	out1[0] = x5;
	1368	out1[1] = x7;
	1369	out1[2] = x9;
	1370	out1[3] = x11;
	1371	out1[4] = x13;
	1372	out1[5] = x15;
	1373	out1[6] = x17;
	1374	out1[7] = x18;
	1375	out1[8] = x19;
	1376	out1[9] = x21;
	1377	out1[10] = x23;
	1378	out1[11] = x25;
	1379	out1[12] = x27;
	1380	out1[13] = x29;
	1381	out1[14] = x31;
	1382	out1[15] = x32;
	1383	out1[16] = x33;
	1384	out1[17] = x35;
	1385	out1[18] = x37;
	1386	out1[19] = x39;
	1387	out1[20] = x41;
	1388	out1[21] = x43;
	1389	out1[22] = x45;
	1390	out1[23] = x46;
	1391	out1[24] = x47;
	1392	out1[25] = x49;
	1393	out1[26] = x51;
	1394	out1[27] = x53;
	1395	out1[28] = x55;
	1396	out1[29] = x57;
	1397	out1[30] = x59;
	1398	out1[31] = x60;
	1399	}
	1400
	1401	/// The function p256FromBytes deserializes a field element NOT in the Montgomery domain from bytes in little-endian order.
	1402	/// Preconditions:
	1403	/// 0 ≤ bytes_eval arg1 < m
	1404	/// Postconditions:
	1405	/// eval out1 mod m = bytes_eval arg1 mod m
	1406	/// 0 ≤ eval out1 < m
	1407	///
	1408	/// Input Bounds:
	1409	/// arg1: [[0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff]]
	1410	/// Output Bounds:
	1411	/// out1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
	1412	pub fn p256FromBytes(out1: *Limbs, arg1: [32]u8) void {
	1413	const x1: u64 = (@intCast(u64, (arg1[31])) << 56);
	1414	const x2: u64 = (@intCast(u64, (arg1[30])) << 48);
	1415	const x3: u64 = (@intCast(u64, (arg1[29])) << 40);
	1416	const x4: u64 = (@intCast(u64, (arg1[28])) << 32);
	1417	const x5: u64 = (@intCast(u64, (arg1[27])) << 24);
	1418	const x6: u64 = (@intCast(u64, (arg1[26])) << 16);
	1419	const x7: u64 = (@intCast(u64, (arg1[25])) << 8);
	1420	const x8: u8 = (arg1[24]);
	1421	const x9: u64 = (@intCast(u64, (arg1[23])) << 56);
	1422	const x10: u64 = (@intCast(u64, (arg1[22])) << 48);
	1423	const x11: u64 = (@intCast(u64, (arg1[21])) << 40);
	1424	const x12: u64 = (@intCast(u64, (arg1[20])) << 32);
	1425	const x13: u64 = (@intCast(u64, (arg1[19])) << 24);
	1426	const x14: u64 = (@intCast(u64, (arg1[18])) << 16);
	1427	const x15: u64 = (@intCast(u64, (arg1[17])) << 8);
	1428	const x16: u8 = (arg1[16]);
	1429	const x17: u64 = (@intCast(u64, (arg1[15])) << 56);
	1430	const x18: u64 = (@intCast(u64, (arg1[14])) << 48);
	1431	const x19: u64 = (@intCast(u64, (arg1[13])) << 40);
	1432	const x20: u64 = (@intCast(u64, (arg1[12])) << 32);
	1433	const x21: u64 = (@intCast(u64, (arg1[11])) << 24);
	1434	const x22: u64 = (@intCast(u64, (arg1[10])) << 16);
	1435	const x23: u64 = (@intCast(u64, (arg1[9])) << 8);
	1436	const x24: u8 = (arg1[8]);
	1437	const x25: u64 = (@intCast(u64, (arg1[7])) << 56);
	1438	const x26: u64 = (@intCast(u64, (arg1[6])) << 48);
	1439	const x27: u64 = (@intCast(u64, (arg1[5])) << 40);
	1440	const x28: u64 = (@intCast(u64, (arg1[4])) << 32);
	1441	const x29: u64 = (@intCast(u64, (arg1[3])) << 24);
	1442	const x30: u64 = (@intCast(u64, (arg1[2])) << 16);
	1443	const x31: u64 = (@intCast(u64, (arg1[1])) << 8);
	1444	const x32: u8 = (arg1[0]);
	1445	const x33: u64 = (x31 + @intCast(u64, x32));
	1446	const x34: u64 = (x30 + x33);
	1447	const x35: u64 = (x29 + x34);
	1448	const x36: u64 = (x28 + x35);
	1449	const x37: u64 = (x27 + x36);
	1450	const x38: u64 = (x26 + x37);
	1451	const x39: u64 = (x25 + x38);
	1452	const x40: u64 = (x23 + @intCast(u64, x24));
	1453	const x41: u64 = (x22 + x40);
	1454	const x42: u64 = (x21 + x41);
	1455	const x43: u64 = (x20 + x42);
	1456	const x44: u64 = (x19 + x43);
	1457	const x45: u64 = (x18 + x44);
	1458	const x46: u64 = (x17 + x45);
	1459	const x47: u64 = (x15 + @intCast(u64, x16));
	1460	const x48: u64 = (x14 + x47);
	1461	const x49: u64 = (x13 + x48);
	1462	const x50: u64 = (x12 + x49);
	1463	const x51: u64 = (x11 + x50);
	1464	const x52: u64 = (x10 + x51);
	1465	const x53: u64 = (x9 + x52);
	1466	const x54: u64 = (x7 + @intCast(u64, x8));
	1467	const x55: u64 = (x6 + x54);
	1468	const x56: u64 = (x5 + x55);
	1469	const x57: u64 = (x4 + x56);
	1470	const x58: u64 = (x3 + x57);
	1471	const x59: u64 = (x2 + x58);
	1472	const x60: u64 = (x1 + x59);
	1473	out1[0] = x39;
	1474	out1[1] = x46;
	1475	out1[2] = x53;
	1476	out1[3] = x60;
	1477	}
	1478
	1479	/// The function p256SetOne returns the field element one in the Montgomery domain.
	1480	/// Postconditions:
	1481	/// eval (from_montgomery out1) mod m = 1 mod m
	1482	/// 0 ≤ eval out1 < m
	1483	///
	1484	/// Input Bounds:
	1485	/// Output Bounds:
	1486	/// out1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
	1487	pub fn p256SetOne(out1: *Limbs) void {
	1488	out1[0] = @intCast(u64, 0x1);
	1489	out1[1] = 0xffffffff00000000;
	1490	out1[2] = 0xffffffffffffffff;
	1491	out1[3] = 0xfffffffe;
	1492	}
	1493
	1494	/// The function p256Msat returns the saturated representation of the prime modulus.
	1495	/// Postconditions:
	1496	/// twos_complement_eval out1 = m
	1497	/// 0 ≤ eval out1 < m
	1498	///
	1499	/// Input Bounds:
	1500	/// Output Bounds:
	1501	/// out1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
	1502	pub fn p256Msat(out1: *[5]u64) void {
	1503	out1[0] = 0xffffffffffffffff;
	1504	out1[1] = 0xffffffff;
	1505	out1[2] = @intCast(u64, 0x0);
	1506	out1[3] = 0xffffffff00000001;
	1507	out1[4] = @intCast(u64, 0x0);
	1508	}
	1509
	1510	/// The function p256Divstep computes a divstep.
	1511	/// Preconditions:
	1512	/// 0 ≤ eval arg4 < m
	1513	/// 0 ≤ eval arg5 < m
	1514	/// Postconditions:
	1515	/// out1 = (if 0 < arg1 ∧ (twos_complement_eval arg3) is odd then 1 - arg1 else 1 + arg1)
	1516	/// twos_complement_eval out2 = (if 0 < arg1 ∧ (twos_complement_eval arg3) is odd then twos_complement_eval arg3 else twos_complement_eval arg2)
	1517	/// twos_complement_eval out3 = (if 0 < arg1 ∧ (twos_complement_eval arg3) is odd then ⌊(twos_complement_eval arg3 - twos_complement_eval arg2) / 2⌋ else ⌊(twos_complement_eval arg3 + (twos_complement_eval arg3 mod 2) * twos_complement_eval arg2) / 2⌋)
	1518	/// eval (from_montgomery out4) mod m = (if 0 < arg1 ∧ (twos_complement_eval arg3) is odd then (2 * eval (from_montgomery arg5)) mod m else (2 * eval (from_montgomery arg4)) mod m)
	1519	/// eval (from_montgomery out5) mod m = (if 0 < arg1 ∧ (twos_complement_eval arg3) is odd then (eval (from_montgomery arg4) - eval (from_montgomery arg4)) mod m else (eval (from_montgomery arg5) + (twos_complement_eval arg3 mod 2) * eval (from_montgomery arg4)) mod m)
	1520	/// 0 ≤ eval out5 < m
	1521	/// 0 ≤ eval out5 < m
	1522	/// 0 ≤ eval out2 < m
	1523	/// 0 ≤ eval out3 < m
	1524	///
	1525	/// Input Bounds:
	1526	/// arg1: [0x0 ~> 0xffffffffffffffff]
	1527	/// arg2: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
	1528	/// arg3: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
	1529	/// arg4: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
	1530	/// arg5: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
	1531	/// Output Bounds:
	1532	/// out1: [0x0 ~> 0xffffffffffffffff]
	1533	/// out2: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
	1534	/// out3: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
	1535	/// out4: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
	1536	/// out5: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
	1537	pub fn p256Divstep(out1: u64, out2: [5]u64, out3: [5]u64, out4: Limbs, out5: *Limbs, arg1: u64, arg2: [5]u64, arg3: [5]u64, arg4: Limbs, arg5: Limbs) void {
	1538	var x1: u64 = undefined;
	1539	var x2: u1 = undefined;
	1540	p256AddcarryxU64(&x1, &x2, 0x0, (~arg1), @intCast(u64, 0x1));
	1541	const x3: u1 = (@intCast(u1, (x1 >> 63)) & @intCast(u1, ((arg3[0]) & @intCast(u64, 0x1))));
	1542	var x4: u64 = undefined;
	1543	var x5: u1 = undefined;
	1544	p256AddcarryxU64(&x4, &x5, 0x0, (~arg1), @intCast(u64, 0x1));
	1545	var x6: u64 = undefined;
	1546	p256CmovznzU64(&x6, x3, arg1, x4);
	1547	var x7: u64 = undefined;
	1548	p256CmovznzU64(&x7, x3, (arg2[0]), (arg3[0]));
	1549	var x8: u64 = undefined;
	1550	p256CmovznzU64(&x8, x3, (arg2[1]), (arg3[1]));
	1551	var x9: u64 = undefined;
	1552	p256CmovznzU64(&x9, x3, (arg2[2]), (arg3[2]));
	1553	var x10: u64 = undefined;
	1554	p256CmovznzU64(&x10, x3, (arg2[3]), (arg3[3]));
	1555	var x11: u64 = undefined;
	1556	p256CmovznzU64(&x11, x3, (arg2[4]), (arg3[4]));
	1557	var x12: u64 = undefined;
	1558	var x13: u1 = undefined;
	1559	p256AddcarryxU64(&x12, &x13, 0x0, @intCast(u64, 0x1), (~(arg2[0])));
	1560	var x14: u64 = undefined;
	1561	var x15: u1 = undefined;
	1562	p256AddcarryxU64(&x14, &x15, x13, @intCast(u64, 0x0), (~(arg2[1])));
	1563	var x16: u64 = undefined;
	1564	var x17: u1 = undefined;
	1565	p256AddcarryxU64(&x16, &x17, x15, @intCast(u64, 0x0), (~(arg2[2])));
	1566	var x18: u64 = undefined;
	1567	var x19: u1 = undefined;
	1568	p256AddcarryxU64(&x18, &x19, x17, @intCast(u64, 0x0), (~(arg2[3])));
	1569	var x20: u64 = undefined;
	1570	var x21: u1 = undefined;
	1571	p256AddcarryxU64(&x20, &x21, x19, @intCast(u64, 0x0), (~(arg2[4])));
	1572	var x22: u64 = undefined;
	1573	p256CmovznzU64(&x22, x3, (arg3[0]), x12);
	1574	var x23: u64 = undefined;
	1575	p256CmovznzU64(&x23, x3, (arg3[1]), x14);
	1576	var x24: u64 = undefined;
	1577	p256CmovznzU64(&x24, x3, (arg3[2]), x16);
	1578	var x25: u64 = undefined;
	1579	p256CmovznzU64(&x25, x3, (arg3[3]), x18);
	1580	var x26: u64 = undefined;
	1581	p256CmovznzU64(&x26, x3, (arg3[4]), x20);
	1582	var x27: u64 = undefined;
	1583	p256CmovznzU64(&x27, x3, (arg4[0]), (arg5[0]));
	1584	var x28: u64 = undefined;
	1585	p256CmovznzU64(&x28, x3, (arg4[1]), (arg5[1]));
	1586	var x29: u64 = undefined;
	1587	p256CmovznzU64(&x29, x3, (arg4[2]), (arg5[2]));
	1588	var x30: u64 = undefined;
	1589	p256CmovznzU64(&x30, x3, (arg4[3]), (arg5[3]));
	1590	var x31: u64 = undefined;
	1591	var x32: u1 = undefined;
	1592	p256AddcarryxU64(&x31, &x32, 0x0, x27, x27);
	1593	var x33: u64 = undefined;
	1594	var x34: u1 = undefined;
	1595	p256AddcarryxU64(&x33, &x34, x32, x28, x28);
	1596	var x35: u64 = undefined;
	1597	var x36: u1 = undefined;
	1598	p256AddcarryxU64(&x35, &x36, x34, x29, x29);
	1599	var x37: u64 = undefined;
	1600	var x38: u1 = undefined;
	1601	p256AddcarryxU64(&x37, &x38, x36, x30, x30);
	1602	var x39: u64 = undefined;
	1603	var x40: u1 = undefined;
	1604	p256SubborrowxU64(&x39, &x40, 0x0, x31, 0xffffffffffffffff);
	1605	var x41: u64 = undefined;
	1606	var x42: u1 = undefined;
	1607	p256SubborrowxU64(&x41, &x42, x40, x33, 0xffffffff);
	1608	var x43: u64 = undefined;
	1609	var x44: u1 = undefined;
	1610	p256SubborrowxU64(&x43, &x44, x42, x35, @intCast(u64, 0x0));
	1611	var x45: u64 = undefined;
	1612	var x46: u1 = undefined;
	1613	p256SubborrowxU64(&x45, &x46, x44, x37, 0xffffffff00000001);
	1614	var x47: u64 = undefined;
	1615	var x48: u1 = undefined;
	1616	p256SubborrowxU64(&x47, &x48, x46, @intCast(u64, x38), @intCast(u64, 0x0));
	1617	const x49: u64 = (arg4[3]);
	1618	const x50: u64 = (arg4[2]);
	1619	const x51: u64 = (arg4[1]);
	1620	const x52: u64 = (arg4[0]);
	1621	var x53: u64 = undefined;
	1622	var x54: u1 = undefined;
	1623	p256SubborrowxU64(&x53, &x54, 0x0, @intCast(u64, 0x0), x52);
	1624	var x55: u64 = undefined;
	1625	var x56: u1 = undefined;
	1626	p256SubborrowxU64(&x55, &x56, x54, @intCast(u64, 0x0), x51);
	1627	var x57: u64 = undefined;
	1628	var x58: u1 = undefined;
	1629	p256SubborrowxU64(&x57, &x58, x56, @intCast(u64, 0x0), x50);
	1630	var x59: u64 = undefined;
	1631	var x60: u1 = undefined;
	1632	p256SubborrowxU64(&x59, &x60, x58, @intCast(u64, 0x0), x49);
	1633	var x61: u64 = undefined;
	1634	p256CmovznzU64(&x61, x60, @intCast(u64, 0x0), 0xffffffffffffffff);
	1635	var x62: u64 = undefined;
	1636	var x63: u1 = undefined;
	1637	p256AddcarryxU64(&x62, &x63, 0x0, x53, x61);
	1638	var x64: u64 = undefined;
	1639	var x65: u1 = undefined;
	1640	p256AddcarryxU64(&x64, &x65, x63, x55, (x61 & 0xffffffff));
	1641	var x66: u64 = undefined;
	1642	var x67: u1 = undefined;
	1643	p256AddcarryxU64(&x66, &x67, x65, x57, @intCast(u64, 0x0));
	1644	var x68: u64 = undefined;
	1645	var x69: u1 = undefined;
	1646	p256AddcarryxU64(&x68, &x69, x67, x59, (x61 & 0xffffffff00000001));
	1647	var x70: u64 = undefined;
	1648	p256CmovznzU64(&x70, x3, (arg5[0]), x62);
	1649	var x71: u64 = undefined;
	1650	p256CmovznzU64(&x71, x3, (arg5[1]), x64);
	1651	var x72: u64 = undefined;
	1652	p256CmovznzU64(&x72, x3, (arg5[2]), x66);
	1653	var x73: u64 = undefined;
	1654	p256CmovznzU64(&x73, x3, (arg5[3]), x68);
	1655	const x74: u1 = @intCast(u1, (x22 & @intCast(u64, 0x1)));
	1656	var x75: u64 = undefined;
	1657	p256CmovznzU64(&x75, x74, @intCast(u64, 0x0), x7);
	1658	var x76: u64 = undefined;
	1659	p256CmovznzU64(&x76, x74, @intCast(u64, 0x0), x8);
	1660	var x77: u64 = undefined;
	1661	p256CmovznzU64(&x77, x74, @intCast(u64, 0x0), x9);
	1662	var x78: u64 = undefined;
	1663	p256CmovznzU64(&x78, x74, @intCast(u64, 0x0), x10);
	1664	var x79: u64 = undefined;
	1665	p256CmovznzU64(&x79, x74, @intCast(u64, 0x0), x11);
	1666	var x80: u64 = undefined;
	1667	var x81: u1 = undefined;
	1668	p256AddcarryxU64(&x80, &x81, 0x0, x22, x75);
	1669	var x82: u64 = undefined;
	1670	var x83: u1 = undefined;
	1671	p256AddcarryxU64(&x82, &x83, x81, x23, x76);
	1672	var x84: u64 = undefined;
	1673	var x85: u1 = undefined;
	1674	p256AddcarryxU64(&x84, &x85, x83, x24, x77);
	1675	var x86: u64 = undefined;
	1676	var x87: u1 = undefined;
	1677	p256AddcarryxU64(&x86, &x87, x85, x25, x78);
	1678	var x88: u64 = undefined;
	1679	var x89: u1 = undefined;
	1680	p256AddcarryxU64(&x88, &x89, x87, x26, x79);
	1681	var x90: u64 = undefined;
	1682	p256CmovznzU64(&x90, x74, @intCast(u64, 0x0), x27);
	1683	var x91: u64 = undefined;
	1684	p256CmovznzU64(&x91, x74, @intCast(u64, 0x0), x28);
	1685	var x92: u64 = undefined;
	1686	p256CmovznzU64(&x92, x74, @intCast(u64, 0x0), x29);
	1687	var x93: u64 = undefined;
	1688	p256CmovznzU64(&x93, x74, @intCast(u64, 0x0), x30);
	1689	var x94: u64 = undefined;
	1690	var x95: u1 = undefined;
	1691	p256AddcarryxU64(&x94, &x95, 0x0, x70, x90);
	1692	var x96: u64 = undefined;
	1693	var x97: u1 = undefined;
	1694	p256AddcarryxU64(&x96, &x97, x95, x71, x91);
	1695	var x98: u64 = undefined;
	1696	var x99: u1 = undefined;
	1697	p256AddcarryxU64(&x98, &x99, x97, x72, x92);
	1698	var x100: u64 = undefined;
	1699	var x101: u1 = undefined;
	1700	p256AddcarryxU64(&x100, &x101, x99, x73, x93);
	1701	var x102: u64 = undefined;
	1702	var x103: u1 = undefined;
	1703	p256SubborrowxU64(&x102, &x103, 0x0, x94, 0xffffffffffffffff);
	1704	var x104: u64 = undefined;
	1705	var x105: u1 = undefined;
	1706	p256SubborrowxU64(&x104, &x105, x103, x96, 0xffffffff);
	1707	var x106: u64 = undefined;
	1708	var x107: u1 = undefined;
	1709	p256SubborrowxU64(&x106, &x107, x105, x98, @intCast(u64, 0x0));
	1710	var x108: u64 = undefined;
	1711	var x109: u1 = undefined;
	1712	p256SubborrowxU64(&x108, &x109, x107, x100, 0xffffffff00000001);
	1713	var x110: u64 = undefined;
	1714	var x111: u1 = undefined;
	1715	p256SubborrowxU64(&x110, &x111, x109, @intCast(u64, x101), @intCast(u64, 0x0));
	1716	var x112: u64 = undefined;
	1717	var x113: u1 = undefined;
	1718	p256AddcarryxU64(&x112, &x113, 0x0, x6, @intCast(u64, 0x1));
	1719	const x114: u64 = ((x80 >> 1) \| ((x82 << 63) & 0xffffffffffffffff));
	1720	const x115: u64 = ((x82 >> 1) \| ((x84 << 63) & 0xffffffffffffffff));
	1721	const x116: u64 = ((x84 >> 1) \| ((x86 << 63) & 0xffffffffffffffff));
	1722	const x117: u64 = ((x86 >> 1) \| ((x88 << 63) & 0xffffffffffffffff));
	1723	const x118: u64 = ((x88 & 0x8000000000000000) \| (x88 >> 1));
	1724	var x119: u64 = undefined;
	1725	p256CmovznzU64(&x119, x48, x39, x31);
	1726	var x120: u64 = undefined;
	1727	p256CmovznzU64(&x120, x48, x41, x33);
	1728	var x121: u64 = undefined;
	1729	p256CmovznzU64(&x121, x48, x43, x35);
	1730	var x122: u64 = undefined;
	1731	p256CmovznzU64(&x122, x48, x45, x37);
	1732	var x123: u64 = undefined;
	1733	p256CmovznzU64(&x123, x111, x102, x94);
	1734	var x124: u64 = undefined;
	1735	p256CmovznzU64(&x124, x111, x104, x96);
	1736	var x125: u64 = undefined;
	1737	p256CmovznzU64(&x125, x111, x106, x98);
	1738	var x126: u64 = undefined;
	1739	p256CmovznzU64(&x126, x111, x108, x100);
	1740	out1.* = x112;
	1741	out2[0] = x7;
	1742	out2[1] = x8;
	1743	out2[2] = x9;
	1744	out2[3] = x10;
	1745	out2[4] = x11;
	1746	out3[0] = x114;
	1747	out3[1] = x115;
	1748	out3[2] = x116;
	1749	out3[3] = x117;
	1750	out3[4] = x118;
	1751	out4[0] = x119;
	1752	out4[1] = x120;
	1753	out4[2] = x121;
	1754	out4[3] = x122;
	1755	out5[0] = x123;
	1756	out5[1] = x124;
	1757	out5[2] = x125;
	1758	out5[3] = x126;
	1759	}
	1760
	1761	/// The function p256DivstepPrecomp returns the precomputed value for Bernstein-Yang-inversion (in montgomery form).
	1762	/// Postconditions:
	1763	/// eval (from_montgomery out1) = ⌊(m - 1) / 2⌋^(if (log2 m) + 1 < 46 then ⌊(49 * ((log2 m) + 1) + 80) / 17⌋ else ⌊(49 * ((log2 m) + 1) + 57) / 17⌋)
	1764	/// 0 ≤ eval out1 < m
	1765	///
	1766	/// Input Bounds:
	1767	/// Output Bounds:
	1768	/// out1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
	1769	pub fn p256DivstepPrecomp(out1: *Limbs) void {
	1770	out1[0] = 0x67ffffffb8000000;
	1771	out1[1] = 0xc000000038000000;
	1772	out1[2] = 0xd80000007fffffff;
	1773	out1[3] = 0x2fffffffffffffff;
	1774	}

lib/std/crypto/pcurves/p256/scalar.zig created+219

...	...	@@ -0,0 +1,219 @@
	1	// SPDX-License-Identifier: MIT
	2	// Copyright (c) 2015-2021 Zig Contributors
	3	// This file is part of [zig](https://ziglang.org/), which is MIT licensed.
	4	// The MIT license requires this copyright notice to be included in all copies
	5	// and substantial portions of the software.
	6
	7	const std = @import("std");
	8	const builtin = std.builtin;
	9	const crypto = std.crypto;
	10	const debug = std.debug;
	11	const math = std.math;
	12	const mem = std.mem;
	13
	14	const Fe = @import("field.zig").Fe;
	15
	16	const NonCanonicalError = std.crypto.errors.NonCanonicalError;
	17	const NotSquareError = std.crypto.errors.NotSquareError;
	18
	19	/// A compressed scalar, in canonical form.
	20	pub const CompressedScalar = [32]u8;
	21
	22	/// Reject a scalar whose encoding is not canonical.
	23	pub fn rejectNonCanonical(s: CompressedScalar) NonCanonicalError!void {
	24	return Fe.rejectNonCanonical(s);
	25	}
	26
	27	/// Reduce a 48-bytes scalar to the field size.
	28	pub fn reduce48(s: [48]u8) CompressedScalar {
	29	return Scalar.fromBytes48(s).toBytes();
	30	}
	31
	32	/// Reduce a 64-bytes scalar to the field size.
	33	pub fn reduce64(s: [64]u8) CompressedScalar {
	34	return ScalarDouble.fromBytes64(s).toBytes();
	35	}
	36
	37	/// Return a*b (mod L)
	38	pub fn mul(a: CompressedScalar, b: CompressedScalar, endian: builtin.Endian) NonCanonicalError!CompressedScalar {
	39	return (try Scalar.fromBytes(a, endian)).mul(try Scalar.fromBytes(b, endian)).toBytes(endian);
	40	}
	41
	42	/// Return a*b+c (mod L)
	43	pub fn mulAdd(a: CompressedScalar, b: CompressedScalar, c: CompressedScalar, endian: builtin.Endian) NonCanonicalError!CompressedScalar {
	44	return (try Scalar.fromBytes(a, endian)).mul(try Scalar.fromBytes(b, endian)).add(try Scalar.fromBytes(c, endian)).toBytes(endian);
	45	}
	46
	47	/// Return a+b (mod L)
	48	pub fn add(a: CompressedScalar, b: CompressedScalar, endian: builtin.Endian) NonCanonicalError!CompressedScalar {
	49	return (try Scalar.fromBytes(a, endian)).add(try Scalar.fromBytes(b, endian)).toBytes(endian);
	50	}
	51
	52	/// Return -s (mod L)
	53	pub fn neg(s: CompressedScalar, endian: builtin.Endian) NonCanonicalError!CompressedScalar {
	54	return (try Scalar.fromBytes(a, endian)).neg().toBytes(endian);
	55	}
	56
	57	/// Return (a-b) (mod L)
	58	pub fn sub(a: CompressedScalar, b: CompressedScalar, endian: builtin.Endian) NonCanonicalError!CompressedScalar {
	59	return (try Scalar.fromBytes(a, endian)).sub(try Scalar.fromBytes(b.endian)).toBytes(endian);
	60	}
	61
	62	/// Return a random scalar
	63	pub fn random(endian: builtin.Endian) CompressedScalar {
	64	return Scalar.random().toBytes(endian);
	65	}
	66
	67	/// A scalar in unpacked representation.
	68	pub const Scalar = struct {
	69	fe: Fe,
	70
	71	/// Zero.
	72	pub const zero = Scalar{ .fe = Fe.zero };
	73
	74	/// One.
	75	pub const one = Scalar{ .fe = Fe.one };
	76
	77	/// Unpack a serialized representation of a scalar.
	78	pub fn fromBytes(s: CompressedScalar, endian: builtin.Endian) NonCanonicalError!Scalar {
	79	return Scalar{ .fe = try Fe.fromBytes(s, endian) };
	80	}
	81
	82	/// Reduce a 384 bit input to the field size.
	83	pub fn fromBytes48(s: [48]u8, endian: builtin.Endian) Scalar {
	84	const t = ScalarDouble.fromBytes(384, s, endian);
	85	return t.reduce(384);
	86	}
	87
	88	/// Reduce a 512 bit input to the field size.
	89	pub fn fromBytes64(s: [64]u8, endian: builtin.Endian) Scalar {
	90	const t = ScalarDouble.fromBytes(512, s, endian);
	91	return t.reduce(512);
	92	}
	93
	94	/// Pack a scalar into bytes.
	95	pub fn toBytes(n: Scalar, endian: builtin.Endian) CompressedScalar {
	96	return n.fe.toBytes(endian);
	97	}
	98
	99	/// Return true if the scalar is zero..
	100	pub fn isZero(n: Scalar) bool {
	101	return n.fe.isZero();
	102	}
	103
	104	/// Return true if a and b are equivalent.
	105	pub fn equivalent(a: Scalar, b: Scalar) bool {
	106	return a.fe.equivalent(b.fe);
	107	}
	108
	109	/// Compute x+y (mod L)
	110	pub fn add(x: Scalar, y: Scalar) Scalar {
	111	return Scalar{ .fe = x.fe().add(y.fe) };
	112	}
	113
	114	/// Compute x-y (mod L)
	115	pub fn sub(x: Scalar, y: Scalar) Scalar {
	116	return Scalar{ .fe = x.fe().sub(y.fe) };
	117	}
	118
	119	/// Compute 2n (mod L)
	120	pub fn dbl(n: Scalar) Scalar {
	121	return Scalar{ .fe = n.fe.dbl() };
	122	}
	123
	124	/// Compute x*y (mod L)
	125	pub fn mul(x: Scalar, y: Scalar) Scalar {
	126	return Scalar{ .fe = x.fe().mul(y.fe) };
	127	}
	128
	129	/// Compute x^2 (mod L)
	130	pub fn sq(n: Scalar) Scalar {
	131	return Scalar{ .fe = n.fe.sq() };
	132	}
	133
	134	/// Compute x^n (mod L)
	135	pub fn pow(a: Scalar, comptime T: type, comptime n: T) Scalar {
	136	return Scalar{ .fe = a.fe.pow(n) };
	137	}
	138
	139	/// Compute -x (mod L)
	140	pub fn neg(n: Scalar) Scalar {
	141	return Scalar{ .fe = n.fe.neg() };
	142	}
	143
	144	/// Compute x^-1 (mod L)
	145	pub fn invert(n: Scalar) Scalar {
	146	return Scalar{ .fe = n.fe.invert() };
	147	}
	148
	149	/// Return true if n is a quadratic residue mod L.
	150	pub fn isSquare(n: Scalar) Scalar {
	151	return n.fe.isSquare();
	152	}
	153
	154	/// Return the square root of L, or NotSquare if there isn't any solutions.
	155	pub fn sqrt(n: Scalar) NotSquareError!Scalar {
	156	return Scalar{ .fe = try n.fe.sqrt() };
	157	}
	158
	159	/// Return a random scalar < L.
	160	pub fn random() Scalar {
	161	var s: [48]u8 = undefined;
	162	while (true) {
	163	crypto.random.bytes(&s);
	164	const n = Scalar.fromBytes48(s, .Little);
	165	if (!n.isZero()) {
	166	return n;
	167	}
	168	}
	169	}
	170	};
	171
	172	const ScalarDouble = struct {
	173	x1: Fe,
	174	x2: Fe,
	175	x3: Fe,
	176
	177	fn fromBytes(comptime bits: usize, s_: [bits / 8]u8, endian: builtin.Endian) ScalarDouble {
	178	debug.assert(bits > 0 and bits <= 512 and bits >= Fe.saturated_bits and bits <= Fe.saturated_bits * 3);
	179
	180	var s = s_;
	181	if (endian == .Big) {
	182	for (s_) \|x, i\| s[s.len - 1 - i] = x;
	183	}
	184	var t = ScalarDouble{ .x1 = undefined, .x2 = Fe.zero, .x3 = Fe.zero };
	185	{
	186	var b = [_]u8{0} ** 32;
	187	const len = math.min(s.len, 24);
	188	mem.copy(u8, b[0..len], s[0..len]);
	189	t.x1 = Fe.fromBytes(b, .Little) catch unreachable;
	190	}
	191	if (s_.len >= 24) {
	192	var b = [_]u8{0} ** 32;
	193	const len = math.min(s.len - 24, 24);
	194	mem.copy(u8, b[0..len], s[24..][0..len]);
	195	t.x2 = Fe.fromBytes(b, .Little) catch unreachable;
	196	}
	197	if (s_.len >= 48) {
	198	var b = [_]u8{0} ** 32;
	199	const len = s.len - 48;
	200	mem.copy(u8, b[0..len], s[48..][0..len]);
	201	t.x3 = Fe.fromBytes(b, .Little) catch unreachable;
	202	}
	203	return t;
	204	}
	205
	206	fn reduce(expanded: ScalarDouble, comptime bits: usize) Scalar {
	207	debug.assert(bits > 0 and bits <= Fe.saturated_bits * 3 and bits <= 512);
	208	var fe = expanded.x1;
	209	if (bits >= 192) {
	210	const st1 = Fe.fromInt(1 << 192) catch unreachable;
	211	fe = fe.add(expanded.x2.mul(st1));
	212	if (bits >= 384) {
	213	const st2 = st1.sq();
	214	fe = fe.add(expanded.x3.mul(st2));
	215	}
	216	}
	217	return Scalar{ .fe = fe };
	218	}
	219	};

lib/std/crypto/pcurves/tests.zig created+103

...	...	@@ -0,0 +1,103 @@
	1	// SPDX-License-Identifier: MIT
	2	// Copyright (c) 2015-2021 Zig Contributors
	3	// This file is part of [zig](https://ziglang.org/), which is MIT licensed.
	4	// The MIT license requires this copyright notice to be included in all copies
	5	// and substantial portions of the software.
	6
	7	const std = @import("std");
	8	const fmt = std.fmt;
	9	const testing = std.testing;
	10
	11	const P256 = @import("p256.zig").P256;
	12
	13	test "p256 ECDH key exchange" {
	14	const dha = P256.scalar.random(.Little);
	15	const dhb = P256.scalar.random(.Little);
	16	const dhA = try P256.basePoint.mul(dha, .Little);
	17	const dhB = try P256.basePoint.mul(dhb, .Little);
	18	const shareda = try dhA.mul(dhb, .Little);
	19	const sharedb = try dhB.mul(dha, .Little);
	20	testing.expect(shareda.equivalent(sharedb));
	21	}
	22
	23	test "p256 point from affine coordinates" {
	24	const xh = "6B17D1F2E12C4247F8BCE6E563A440F277037D812DEB33A0F4A13945D898C296";
	25	const yh = "4FE342E2FE1A7F9B8EE7EB4A7C0F9E162BCE33576B315ECECBB6406837BF51F5";
	26	var xs: [32]u8 = undefined;
	27	_ = try fmt.hexToBytes(&xs, xh);
	28	var ys: [32]u8 = undefined;
	29	_ = try fmt.hexToBytes(&ys, yh);
	30	var p = try P256.fromSerializedAffineCoordinates(xs, ys, .Big);
	31	testing.expect(p.equivalent(P256.basePoint));
	32	}
	33
	34	test "p256 test vectors" {
	35	const expected = [_][]const u8{
	36	"0000000000000000000000000000000000000000000000000000000000000000",
	37	"6b17d1f2e12c4247f8bce6e563a440f277037d812deb33a0f4a13945d898c296",
	38	"7cf27b188d034f7e8a52380304b51ac3c08969e277f21b35a60b48fc47669978",
	39	"5ecbe4d1a6330a44c8f7ef951d4bf165e6c6b721efada985fb41661bc6e7fd6c",
	40	"e2534a3532d08fbba02dde659ee62bd0031fe2db785596ef509302446b030852",
	41	"51590b7a515140d2d784c85608668fdfef8c82fd1f5be52421554a0dc3d033ed",
	42	"b01a172a76a4602c92d3242cb897dde3024c740debb215b4c6b0aae93c2291a9",
	43	"8e533b6fa0bf7b4625bb30667c01fb607ef9f8b8a80fef5b300628703187b2a3",
	44	"62d9779dbee9b0534042742d3ab54cadc1d238980fce97dbb4dd9dc1db6fb393",
	45	"ea68d7b6fedf0b71878938d51d71f8729e0acb8c2c6df8b3d79e8a4b90949ee0",
	46	};
	47	var p = P256.identityElement;
	48	for (expected) \|xh\| {
	49	const x = p.affineCoordinates().x;
	50	p = p.add(P256.basePoint);
	51	var xs: [32]u8 = undefined;
	52	_ = try fmt.hexToBytes(&xs, xh);
	53	testing.expectEqualSlices(u8, &x.toBytes(.Big), &xs);
	54	}
	55	}
	56
	57	test "p256 test vectors - doubling" {
	58	const expected = [_][]const u8{
	59	"6b17d1f2e12c4247f8bce6e563a440f277037d812deb33a0f4a13945d898c296",
	60	"7cf27b188d034f7e8a52380304b51ac3c08969e277f21b35a60b48fc47669978",
	61	"e2534a3532d08fbba02dde659ee62bd0031fe2db785596ef509302446b030852",
	62	"62d9779dbee9b0534042742d3ab54cadc1d238980fce97dbb4dd9dc1db6fb393",
	63	};
	64	var p = P256.basePoint;
	65	for (expected) \|xh\| {
	66	const x = p.affineCoordinates().x;
	67	p = p.dbl();
	68	var xs: [32]u8 = undefined;
	69	_ = try fmt.hexToBytes(&xs, xh);
	70	testing.expectEqualSlices(u8, &x.toBytes(.Big), &xs);
	71	}
	72	}
	73
	74	test "p256 compressed sec1 encoding/decoding" {
	75	const p = P256.random();
	76	const s = p.toCompressedSec1();
	77	const q = try P256.fromSec1(&s);
	78	testing.expect(p.equivalent(q));
	79	}
	80
	81	test "p256 uncompressed sec1 encoding/decoding" {
	82	const p = P256.random();
	83	const s = p.toUncompressedSec1();
	84	const q = try P256.fromSec1(&s);
	85	testing.expect(p.equivalent(q));
	86	}
	87
	88	test "p256 public key is the neutral element" {
	89	const n = P256.scalar.Scalar.zero.toBytes(.Little);
	90	const p = P256.random();
	91	testing.expectError(error.IdentityElement, p.mul(n, .Little));
	92	}
	93
	94	test "p256 public key is the neutral element (public verification)" {
	95	const n = P256.scalar.Scalar.zero.toBytes(.Little);
	96	const p = P256.random();
	97	testing.expectError(error.IdentityElement, p.mulPublic(n, .Little));
	98	}
	99
	100	test "p256 field element non-canonical encoding" {
	101	const s = [_]u8{0xff} ** 32;
	102	testing.expectError(error.NonCanonical, P256.Fe.fromBytes(s, .Little));
	103	}