@amritk/nish-aarch64-linux 0.14.0 → 0.15.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (16) hide show
  1. package/bin/nish +0 -0
  2. package/package.json +1 -1
  3. package/runtime/nish.d.ts +91 -0
  4. package/runtime/nish.h +58 -0
  5. package/runtime/nish.mjs +23 -0
  6. package/runtime/runtime-net.c +528 -0
  7. package/runtime/shim.mjs +15 -0
  8. package/scripts/build.sh +8 -7
  9. package/std/README.md +54 -14
  10. package/std/crypto/LICENSE-bearssl +21 -0
  11. package/std/crypto/LICENSE-fiat-crypto +21 -0
  12. package/std/crypto/aes.ts +899 -0
  13. package/std/crypto/chacha20poly1305.ts +698 -0
  14. package/std/crypto/p256.ts +4337 -0
  15. package/std/crypto/x25519.ts +22 -7
  16. package/std/crypto/x509.ts +1214 -0
package/std/crypto/p256.ts ADDED
@@ -0,0 +1,4337 @@
1
+ /**
2
+ * `nish/crypto/p256` — ECDSA over NIST P-256 (secp256r1), with the
3
+ * deterministic nonces of RFC 6979.
4
+ *
5
+ * import { p256PublicKey, p256SignSha256, p256VerifySha256 } from "nish/crypto/p256";
6
+ *
7
+ * const pub: u8[] | null = p256PublicKey(priv); // 65 bytes, 0x04 || X || Y
8
+ * const sig: u8[] | null = p256SignSha256(priv, message); // 64 bytes, r || s
9
+ * const ok: boolean = p256VerifySha256(pub, message, sig);
10
+ *
11
+ * A private key is 32 big-endian bytes holding a scalar in [1, n); a public
12
+ * key is the uncompressed SEC1 encoding of SEC 1 §2.3.3; a signature is `r`
13
+ * and `s` as 32 big-endian bytes each. DER, which X.509 and TLS wrap a
14
+ * signature in, is not this module's business. Anything of the wrong length,
15
+ * a private key of 0 or n or more, a public key that is not on the curve, and
16
+ * an `r` or `s` of 0 or n or more answer `null` from the signing side and
17
+ * `false` from the verifying side, never a panic.
18
+ *
19
+ * Ported from fiat-crypto (https://github.com/mit-plv/fiat-crypto), fiat-c/src/p256_32.c and fiat-c/src/p256_scalar_32.c. Copyright (c) 2015-2020 the fiat-crypto authors (see the AUTHORS file). Used under the MIT licence; see std/crypto/LICENSE-fiat-crypto.
20
+ *
21
+ * **What is ported and what is not.** The `p256Fiat*` functions are
22
+ * fiat-crypto's generated, formally verified Montgomery arithmetic on eight
23
+ * `u32` limbs with `u64` products — `mul`, `square`, `add`, `sub`,
24
+ * `selectznz`, `nonzero` and `set_one` mod p, and `mul`, `add` and `set_one`
25
+ * mod n — statement for statement, with fiat's variable names. Three things
26
+ * change in the translation and nothing else does. C's out-pointers become a
27
+ * `u64` answer: each of fiat's `addcarryx`, `subborrowx` and `mulx` helpers
28
+ * here answers its two outputs packed, the first in the low 32 bits and the
29
+ * second above them, and the caller splits them, declaring only the halves
30
+ * fiat goes on to read. And each function opens with
31
+ * a length guard, so that the literal indices after it compile with no bounds
32
+ * check. And `square` reads its input's eight limbs into locals first, which
33
+ * changes no arithmetic; it kept the input's pointer from being spilled in a
34
+ * way the aarch64 disassembly check once misread (#334). The
35
+ * scalar functions use the field's four helpers, which fiat generates
36
+ * identically for both. Everything else in this file — the curve, the encodings, the
37
+ * inversions and ECDSA — is written for this module from the documents it
38
+ * names.
39
+ *
40
+ * **The curve** is `y^2 = x^3 - 3x + b` over GF(p), p = 2^256 - 2^224 + 2^192
41
+ * + 2^96 - 1, with the base point G and its order n from SEC 2 §2.4.2 (FIPS
42
+ * 186-4 §D.1.2.3). Points are projective (X : Y : Z), Z = 0 the identity, and
43
+ * are added and doubled with the complete formulas of J. Renes, C. Costello and
44
+ * L. Batina, "Complete addition formulas for prime order elliptic curves"
45
+ * (EUROCRYPT 2016), Algorithms 4 and 6 for a = -3. Complete means no input is
46
+ * exceptional: P + P, P + (-P) and P + O all come out of the same straight line
47
+ * of field operations, so there is no case to branch on.
48
+ *
49
+ * **Constant time where a secret is involved.** A private key and a nonce are
50
+ * only ever multiplied by `p256ScalarMult`, a fixed 4-bit window: sixteen
51
+ * multiples of the point in a table, then 64 windows of four doublings, a
52
+ * table read and an addition, whatever the scalar. The read loads all sixteen
53
+ * entries and keeps one with fiat's conditional move, steered by `ctEq` on the
54
+ * window's digit, so neither a branch nor an address depends on the scalar.
55
+ * The inversions raise to the public exponents p - 2 and n - 2, so their
56
+ * branches follow a constant. The branches that remain are on public facts: a
57
+ * length, a limb or bit position, whether a received key or signature is in
58
+ * range, and — once in about 2^32 signatures — RFC 6979's retry when a
59
+ * candidate nonce is not below n.
60
+ *
61
+ * **What is verified by disassembly and what is discipline.**
62
+ * `tests/cases/ct_asm_p256` holds copies of fiat's field multiply, square, add
63
+ * and subtract, its scalar multiply and its conditional move, the table read
64
+ * by a secret digit, the complete doubling and addition, and one window step
65
+ * of `p256ScalarMult` to the check of `tests/ct-asm.js`, which refuses any
66
+ * branch, call it cannot follow or secret-indexed access in them on x86-64 and
67
+ * aarch64, following each call into the field functions. The copies of the
68
+ * point functions take coordinate arrays rather than points, and the table
69
+ * read's loop is written out there, as that fixture's header says; its `main`
70
+ * runs RFC 6979 A.2.5 through them. The 64-window loop, the table build, the
71
+ * inversions, the encodings and the nonce derivation are constant time by
72
+ * construction rather than by that proof.
73
+ *
74
+ * Verification multiplies only public values, and uses the same routine.
75
+ *
76
+ * Private names carry the `p256` prefix because a `std/` module's private
77
+ * functions share the importing program's flat symbol namespace
78
+ * (`docs/wp26-stdlib.md` §3e).
79
+ */
80
+ import { HmacSha256, hmacSha256 } from "nish/crypto/hmac"
81
+ import { sha256 } from "nish/crypto/sha256"
82
+ import { timingSafeEqual } from "nish/crypto/ct"
83
+
84
+ /** The length in bytes of a private key: one scalar, big-endian. */
85
+ export const P256_SCALAR_SIZE: i32 = 32
86
+
87
+ /** The length in bytes of a public key: 0x04, then X and Y big-endian (SEC 1 §2.3.3). */
88
+ export const P256_POINT_SIZE: i32 = 65
89
+
90
+ /** The length in bytes of a signature: `r` then `s`, 32 big-endian bytes each. */
91
+ export const P256_SIGNATURE_SIZE: i32 = 64
92
+
93
+ /** A typed zero for the offsets below: a bare literal is an `f64` under `--number-mode f64`. */
94
+ const P256_FROM: i32 = 0
95
+
96
+ /**
97
+ * fiat's `addcarryx_u32`: `arg1 + arg2 + arg3` with `arg1` a carry of 0 or 1.
98
+ * The sum is below 2^33, so its low 32 bits are fiat's `out1` and bit 32 its
99
+ * `out2`.
100
+ */
101
+ const p256FiatAddcarryxU32 = (arg1: u32, arg2: u32, arg3: u32): u64 => toU64(arg1) + toU64(arg2) + toU64(arg3)
102
+
103
+ /**
104
+ * fiat's `subborrowx_u32`: `arg2 - arg1 - arg3` with `arg1` a borrow of 0 or 1.
105
+ * The difference wraps modulo 2^64, so a negative one has every bit from 32 up
106
+ * set; bit 32 alone is kept, which puts fiat's `out2` (1 on a borrow) where
107
+ * `p256FiatAddcarryxU32` puts its carry.
108
+ */
109
+ const p256FiatSubborrowxU32 = (arg1: u32, arg2: u32, arg3: u32): u64 =>
110
+ (toU64(arg2) - toU64(arg1) - toU64(arg3)) & 0x1ffffffff
111
+
112
+ /** fiat's `mulx_u32`: the full 64-bit product, `out1` the low half and `out2` the high. */
113
+ const p256FiatMulxU32 = (arg1: u32, arg2: u32): u64 => toU64(arg1) * toU64(arg2)
114
+
115
+ /**
116
+ * fiat's `cmovznz_u32`: `arg2` when `arg1` is zero and `arg3` otherwise. fiat
117
+ * builds the mask from `!!arg1` behind a value barrier; `ctEq` builds it behind
118
+ * the same kind of barrier, and `ctSelect` blends with it.
119
+ */
120
+ const p256FiatCmovznzU32 = (arg1: u32, arg2: u32, arg3: u32): u32 => ctSelect(ctEq(arg1, 0), arg2, arg3)
121
+
122
+ /** fiat's `fiat_p256_mul`: multiplies two field elements in the Montgomery domain. */
123
+ const p256FiatMul = (out1: u32[], arg1: u32[], arg2: u32[]): void => {
124
+ if (toI32(out1.length) < 8 || toI32(arg1.length) < 8 || toI32(arg2.length) < 8) {
125
+ return
126
+ }
127
+ const x1: u32 = arg1[1]
128
+ const x2: u32 = arg1[2]
129
+ const x3: u32 = arg1[3]
130
+ const x4: u32 = arg1[4]
131
+ const x5: u32 = arg1[5]
132
+ const x6: u32 = arg1[6]
133
+ const x7: u32 = arg1[7]
134
+ const x8: u32 = arg1[0]
135
+ const w9: u64 = p256FiatMulxU32(x8, arg2[7])
136
+ const x9: u32 = toU32(w9)
137
+ const x10: u32 = toU32(w9 >> 32)
138
+ const w11: u64 = p256FiatMulxU32(x8, arg2[6])
139
+ const x11: u32 = toU32(w11)
140
+ const x12: u32 = toU32(w11 >> 32)
141
+ const w13: u64 = p256FiatMulxU32(x8, arg2[5])
142
+ const x13: u32 = toU32(w13)
143
+ const x14: u32 = toU32(w13 >> 32)
144
+ const w15: u64 = p256FiatMulxU32(x8, arg2[4])
145
+ const x15: u32 = toU32(w15)
146
+ const x16: u32 = toU32(w15 >> 32)
147
+ const w17: u64 = p256FiatMulxU32(x8, arg2[3])
148
+ const x17: u32 = toU32(w17)
149
+ const x18: u32 = toU32(w17 >> 32)
150
+ const w19: u64 = p256FiatMulxU32(x8, arg2[2])
151
+ const x19: u32 = toU32(w19)
152
+ const x20: u32 = toU32(w19 >> 32)
153
+ const w21: u64 = p256FiatMulxU32(x8, arg2[1])
154
+ const x21: u32 = toU32(w21)
155
+ const x22: u32 = toU32(w21 >> 32)
156
+ const w23: u64 = p256FiatMulxU32(x8, arg2[0])
157
+ const x23: u32 = toU32(w23)
158
+ const x24: u32 = toU32(w23 >> 32)
159
+ const w25: u64 = p256FiatAddcarryxU32(0x0, x24, x21)
160
+ const x25: u32 = toU32(w25)
161
+ const x26: u32 = toU32(w25 >> 32)
162
+ const w27: u64 = p256FiatAddcarryxU32(x26, x22, x19)
163
+ const x27: u32 = toU32(w27)
164
+ const x28: u32 = toU32(w27 >> 32)
165
+ const w29: u64 = p256FiatAddcarryxU32(x28, x20, x17)
166
+ const x29: u32 = toU32(w29)
167
+ const x30: u32 = toU32(w29 >> 32)
168
+ const w31: u64 = p256FiatAddcarryxU32(x30, x18, x15)
169
+ const x31: u32 = toU32(w31)
170
+ const x32: u32 = toU32(w31 >> 32)
171
+ const w33: u64 = p256FiatAddcarryxU32(x32, x16, x13)
172
+ const x33: u32 = toU32(w33)
173
+ const x34: u32 = toU32(w33 >> 32)
174
+ const w35: u64 = p256FiatAddcarryxU32(x34, x14, x11)
175
+ const x35: u32 = toU32(w35)
176
+ const x36: u32 = toU32(w35 >> 32)
177
+ const w37: u64 = p256FiatAddcarryxU32(x36, x12, x9)
178
+ const x37: u32 = toU32(w37)
179
+ const x38: u32 = toU32(w37 >> 32)
180
+ const x39: u32 = x38 + x10
181
+ const w40: u64 = p256FiatMulxU32(x23, 0xffffffff)
182
+ const x40: u32 = toU32(w40)
183
+ const x41: u32 = toU32(w40 >> 32)
184
+ const w42: u64 = p256FiatMulxU32(x23, 0xffffffff)
185
+ const x42: u32 = toU32(w42)
186
+ const x43: u32 = toU32(w42 >> 32)
187
+ const w44: u64 = p256FiatMulxU32(x23, 0xffffffff)
188
+ const x44: u32 = toU32(w44)
189
+ const x45: u32 = toU32(w44 >> 32)
190
+ const w46: u64 = p256FiatMulxU32(x23, 0xffffffff)
191
+ const x46: u32 = toU32(w46)
192
+ const x47: u32 = toU32(w46 >> 32)
193
+ const w48: u64 = p256FiatAddcarryxU32(0x0, x47, x44)
194
+ const x48: u32 = toU32(w48)
195
+ const x49: u32 = toU32(w48 >> 32)
196
+ const w50: u64 = p256FiatAddcarryxU32(x49, x45, x42)
197
+ const x50: u32 = toU32(w50)
198
+ const x51: u32 = toU32(w50 >> 32)
199
+ const x52: u32 = x51 + x43
200
+ const w53: u64 = p256FiatAddcarryxU32(0x0, x23, x46)
201
+ const x54: u32 = toU32(w53 >> 32)
202
+ const w55: u64 = p256FiatAddcarryxU32(x54, x25, x48)
203
+ const x55: u32 = toU32(w55)
204
+ const x56: u32 = toU32(w55 >> 32)
205
+ const w57: u64 = p256FiatAddcarryxU32(x56, x27, x50)
206
+ const x57: u32 = toU32(w57)
207
+ const x58: u32 = toU32(w57 >> 32)
208
+ const w59: u64 = p256FiatAddcarryxU32(x58, x29, x52)
209
+ const x59: u32 = toU32(w59)
210
+ const x60: u32 = toU32(w59 >> 32)
211
+ const w61: u64 = p256FiatAddcarryxU32(x60, x31, 0x0)
212
+ const x61: u32 = toU32(w61)
213
+ const x62: u32 = toU32(w61 >> 32)
214
+ const w63: u64 = p256FiatAddcarryxU32(x62, x33, 0x0)
215
+ const x63: u32 = toU32(w63)
216
+ const x64: u32 = toU32(w63 >> 32)
217
+ const w65: u64 = p256FiatAddcarryxU32(x64, x35, x23)
218
+ const x65: u32 = toU32(w65)
219
+ const x66: u32 = toU32(w65 >> 32)
220
+ const w67: u64 = p256FiatAddcarryxU32(x66, x37, x40)
221
+ const x67: u32 = toU32(w67)
222
+ const x68: u32 = toU32(w67 >> 32)
223
+ const w69: u64 = p256FiatAddcarryxU32(x68, x39, x41)
224
+ const x69: u32 = toU32(w69)
225
+ const x70: u32 = toU32(w69 >> 32)
226
+ const w71: u64 = p256FiatMulxU32(x1, arg2[7])
227
+ const x71: u32 = toU32(w71)
228
+ const x72: u32 = toU32(w71 >> 32)
229
+ const w73: u64 = p256FiatMulxU32(x1, arg2[6])
230
+ const x73: u32 = toU32(w73)
231
+ const x74: u32 = toU32(w73 >> 32)
232
+ const w75: u64 = p256FiatMulxU32(x1, arg2[5])
233
+ const x75: u32 = toU32(w75)
234
+ const x76: u32 = toU32(w75 >> 32)
235
+ const w77: u64 = p256FiatMulxU32(x1, arg2[4])
236
+ const x77: u32 = toU32(w77)
237
+ const x78: u32 = toU32(w77 >> 32)
238
+ const w79: u64 = p256FiatMulxU32(x1, arg2[3])
239
+ const x79: u32 = toU32(w79)
240
+ const x80: u32 = toU32(w79 >> 32)
241
+ const w81: u64 = p256FiatMulxU32(x1, arg2[2])
242
+ const x81: u32 = toU32(w81)
243
+ const x82: u32 = toU32(w81 >> 32)
244
+ const w83: u64 = p256FiatMulxU32(x1, arg2[1])
245
+ const x83: u32 = toU32(w83)
246
+ const x84: u32 = toU32(w83 >> 32)
247
+ const w85: u64 = p256FiatMulxU32(x1, arg2[0])
248
+ const x85: u32 = toU32(w85)
249
+ const x86: u32 = toU32(w85 >> 32)
250
+ const w87: u64 = p256FiatAddcarryxU32(0x0, x86, x83)
251
+ const x87: u32 = toU32(w87)
252
+ const x88: u32 = toU32(w87 >> 32)
253
+ const w89: u64 = p256FiatAddcarryxU32(x88, x84, x81)
254
+ const x89: u32 = toU32(w89)
255
+ const x90: u32 = toU32(w89 >> 32)
256
+ const w91: u64 = p256FiatAddcarryxU32(x90, x82, x79)
257
+ const x91: u32 = toU32(w91)
258
+ const x92: u32 = toU32(w91 >> 32)
259
+ const w93: u64 = p256FiatAddcarryxU32(x92, x80, x77)
260
+ const x93: u32 = toU32(w93)
261
+ const x94: u32 = toU32(w93 >> 32)
262
+ const w95: u64 = p256FiatAddcarryxU32(x94, x78, x75)
263
+ const x95: u32 = toU32(w95)
264
+ const x96: u32 = toU32(w95 >> 32)
265
+ const w97: u64 = p256FiatAddcarryxU32(x96, x76, x73)
266
+ const x97: u32 = toU32(w97)
267
+ const x98: u32 = toU32(w97 >> 32)
268
+ const w99: u64 = p256FiatAddcarryxU32(x98, x74, x71)
269
+ const x99: u32 = toU32(w99)
270
+ const x100: u32 = toU32(w99 >> 32)
271
+ const x101: u32 = x100 + x72
272
+ const w102: u64 = p256FiatAddcarryxU32(0x0, x55, x85)
273
+ const x102: u32 = toU32(w102)
274
+ const x103: u32 = toU32(w102 >> 32)
275
+ const w104: u64 = p256FiatAddcarryxU32(x103, x57, x87)
276
+ const x104: u32 = toU32(w104)
277
+ const x105: u32 = toU32(w104 >> 32)
278
+ const w106: u64 = p256FiatAddcarryxU32(x105, x59, x89)
279
+ const x106: u32 = toU32(w106)
280
+ const x107: u32 = toU32(w106 >> 32)
281
+ const w108: u64 = p256FiatAddcarryxU32(x107, x61, x91)
282
+ const x108: u32 = toU32(w108)
283
+ const x109: u32 = toU32(w108 >> 32)
284
+ const w110: u64 = p256FiatAddcarryxU32(x109, x63, x93)
285
+ const x110: u32 = toU32(w110)
286
+ const x111: u32 = toU32(w110 >> 32)
287
+ const w112: u64 = p256FiatAddcarryxU32(x111, x65, x95)
288
+ const x112: u32 = toU32(w112)
289
+ const x113: u32 = toU32(w112 >> 32)
290
+ const w114: u64 = p256FiatAddcarryxU32(x113, x67, x97)
291
+ const x114: u32 = toU32(w114)
292
+ const x115: u32 = toU32(w114 >> 32)
293
+ const w116: u64 = p256FiatAddcarryxU32(x115, x69, x99)
294
+ const x116: u32 = toU32(w116)
295
+ const x117: u32 = toU32(w116 >> 32)
296
+ const w118: u64 = p256FiatAddcarryxU32(x117, x70, x101)
297
+ const x118: u32 = toU32(w118)
298
+ const x119: u32 = toU32(w118 >> 32)
299
+ const w120: u64 = p256FiatMulxU32(x102, 0xffffffff)
300
+ const x120: u32 = toU32(w120)
301
+ const x121: u32 = toU32(w120 >> 32)
302
+ const w122: u64 = p256FiatMulxU32(x102, 0xffffffff)
303
+ const x122: u32 = toU32(w122)
304
+ const x123: u32 = toU32(w122 >> 32)
305
+ const w124: u64 = p256FiatMulxU32(x102, 0xffffffff)
306
+ const x124: u32 = toU32(w124)
307
+ const x125: u32 = toU32(w124 >> 32)
308
+ const w126: u64 = p256FiatMulxU32(x102, 0xffffffff)
309
+ const x126: u32 = toU32(w126)
310
+ const x127: u32 = toU32(w126 >> 32)
311
+ const w128: u64 = p256FiatAddcarryxU32(0x0, x127, x124)
312
+ const x128: u32 = toU32(w128)
313
+ const x129: u32 = toU32(w128 >> 32)
314
+ const w130: u64 = p256FiatAddcarryxU32(x129, x125, x122)
315
+ const x130: u32 = toU32(w130)
316
+ const x131: u32 = toU32(w130 >> 32)
317
+ const x132: u32 = x131 + x123
318
+ const w133: u64 = p256FiatAddcarryxU32(0x0, x102, x126)
319
+ const x134: u32 = toU32(w133 >> 32)
320
+ const w135: u64 = p256FiatAddcarryxU32(x134, x104, x128)
321
+ const x135: u32 = toU32(w135)
322
+ const x136: u32 = toU32(w135 >> 32)
323
+ const w137: u64 = p256FiatAddcarryxU32(x136, x106, x130)
324
+ const x137: u32 = toU32(w137)
325
+ const x138: u32 = toU32(w137 >> 32)
326
+ const w139: u64 = p256FiatAddcarryxU32(x138, x108, x132)
327
+ const x139: u32 = toU32(w139)
328
+ const x140: u32 = toU32(w139 >> 32)
329
+ const w141: u64 = p256FiatAddcarryxU32(x140, x110, 0x0)
330
+ const x141: u32 = toU32(w141)
331
+ const x142: u32 = toU32(w141 >> 32)
332
+ const w143: u64 = p256FiatAddcarryxU32(x142, x112, 0x0)
333
+ const x143: u32 = toU32(w143)
334
+ const x144: u32 = toU32(w143 >> 32)
335
+ const w145: u64 = p256FiatAddcarryxU32(x144, x114, x102)
336
+ const x145: u32 = toU32(w145)
337
+ const x146: u32 = toU32(w145 >> 32)
338
+ const w147: u64 = p256FiatAddcarryxU32(x146, x116, x120)
339
+ const x147: u32 = toU32(w147)
340
+ const x148: u32 = toU32(w147 >> 32)
341
+ const w149: u64 = p256FiatAddcarryxU32(x148, x118, x121)
342
+ const x149: u32 = toU32(w149)
343
+ const x150: u32 = toU32(w149 >> 32)
344
+ const x151: u32 = x150 + x119
345
+ const w152: u64 = p256FiatMulxU32(x2, arg2[7])
346
+ const x152: u32 = toU32(w152)
347
+ const x153: u32 = toU32(w152 >> 32)
348
+ const w154: u64 = p256FiatMulxU32(x2, arg2[6])
349
+ const x154: u32 = toU32(w154)
350
+ const x155: u32 = toU32(w154 >> 32)
351
+ const w156: u64 = p256FiatMulxU32(x2, arg2[5])
352
+ const x156: u32 = toU32(w156)
353
+ const x157: u32 = toU32(w156 >> 32)
354
+ const w158: u64 = p256FiatMulxU32(x2, arg2[4])
355
+ const x158: u32 = toU32(w158)
356
+ const x159: u32 = toU32(w158 >> 32)
357
+ const w160: u64 = p256FiatMulxU32(x2, arg2[3])
358
+ const x160: u32 = toU32(w160)
359
+ const x161: u32 = toU32(w160 >> 32)
360
+ const w162: u64 = p256FiatMulxU32(x2, arg2[2])
361
+ const x162: u32 = toU32(w162)
362
+ const x163: u32 = toU32(w162 >> 32)
363
+ const w164: u64 = p256FiatMulxU32(x2, arg2[1])
364
+ const x164: u32 = toU32(w164)
365
+ const x165: u32 = toU32(w164 >> 32)
366
+ const w166: u64 = p256FiatMulxU32(x2, arg2[0])
367
+ const x166: u32 = toU32(w166)
368
+ const x167: u32 = toU32(w166 >> 32)
369
+ const w168: u64 = p256FiatAddcarryxU32(0x0, x167, x164)
370
+ const x168: u32 = toU32(w168)
371
+ const x169: u32 = toU32(w168 >> 32)
372
+ const w170: u64 = p256FiatAddcarryxU32(x169, x165, x162)
373
+ const x170: u32 = toU32(w170)
374
+ const x171: u32 = toU32(w170 >> 32)
375
+ const w172: u64 = p256FiatAddcarryxU32(x171, x163, x160)
376
+ const x172: u32 = toU32(w172)
377
+ const x173: u32 = toU32(w172 >> 32)
378
+ const w174: u64 = p256FiatAddcarryxU32(x173, x161, x158)
379
+ const x174: u32 = toU32(w174)
380
+ const x175: u32 = toU32(w174 >> 32)
381
+ const w176: u64 = p256FiatAddcarryxU32(x175, x159, x156)
382
+ const x176: u32 = toU32(w176)
383
+ const x177: u32 = toU32(w176 >> 32)
384
+ const w178: u64 = p256FiatAddcarryxU32(x177, x157, x154)
385
+ const x178: u32 = toU32(w178)
386
+ const x179: u32 = toU32(w178 >> 32)
387
+ const w180: u64 = p256FiatAddcarryxU32(x179, x155, x152)
388
+ const x180: u32 = toU32(w180)
389
+ const x181: u32 = toU32(w180 >> 32)
390
+ const x182: u32 = x181 + x153
391
+ const w183: u64 = p256FiatAddcarryxU32(0x0, x135, x166)
392
+ const x183: u32 = toU32(w183)
393
+ const x184: u32 = toU32(w183 >> 32)
394
+ const w185: u64 = p256FiatAddcarryxU32(x184, x137, x168)
395
+ const x185: u32 = toU32(w185)
396
+ const x186: u32 = toU32(w185 >> 32)
397
+ const w187: u64 = p256FiatAddcarryxU32(x186, x139, x170)
398
+ const x187: u32 = toU32(w187)
399
+ const x188: u32 = toU32(w187 >> 32)
400
+ const w189: u64 = p256FiatAddcarryxU32(x188, x141, x172)
401
+ const x189: u32 = toU32(w189)
402
+ const x190: u32 = toU32(w189 >> 32)
403
+ const w191: u64 = p256FiatAddcarryxU32(x190, x143, x174)
404
+ const x191: u32 = toU32(w191)
405
+ const x192: u32 = toU32(w191 >> 32)
406
+ const w193: u64 = p256FiatAddcarryxU32(x192, x145, x176)
407
+ const x193: u32 = toU32(w193)
408
+ const x194: u32 = toU32(w193 >> 32)
409
+ const w195: u64 = p256FiatAddcarryxU32(x194, x147, x178)
410
+ const x195: u32 = toU32(w195)
411
+ const x196: u32 = toU32(w195 >> 32)
412
+ const w197: u64 = p256FiatAddcarryxU32(x196, x149, x180)
413
+ const x197: u32 = toU32(w197)
414
+ const x198: u32 = toU32(w197 >> 32)
415
+ const w199: u64 = p256FiatAddcarryxU32(x198, x151, x182)
416
+ const x199: u32 = toU32(w199)
417
+ const x200: u32 = toU32(w199 >> 32)
418
+ const w201: u64 = p256FiatMulxU32(x183, 0xffffffff)
419
+ const x201: u32 = toU32(w201)
420
+ const x202: u32 = toU32(w201 >> 32)
421
+ const w203: u64 = p256FiatMulxU32(x183, 0xffffffff)
422
+ const x203: u32 = toU32(w203)
423
+ const x204: u32 = toU32(w203 >> 32)
424
+ const w205: u64 = p256FiatMulxU32(x183, 0xffffffff)
425
+ const x205: u32 = toU32(w205)
426
+ const x206: u32 = toU32(w205 >> 32)
427
+ const w207: u64 = p256FiatMulxU32(x183, 0xffffffff)
428
+ const x207: u32 = toU32(w207)
429
+ const x208: u32 = toU32(w207 >> 32)
430
+ const w209: u64 = p256FiatAddcarryxU32(0x0, x208, x205)
431
+ const x209: u32 = toU32(w209)
432
+ const x210: u32 = toU32(w209 >> 32)
433
+ const w211: u64 = p256FiatAddcarryxU32(x210, x206, x203)
434
+ const x211: u32 = toU32(w211)
435
+ const x212: u32 = toU32(w211 >> 32)
436
+ const x213: u32 = x212 + x204
437
+ const w214: u64 = p256FiatAddcarryxU32(0x0, x183, x207)
438
+ const x215: u32 = toU32(w214 >> 32)
439
+ const w216: u64 = p256FiatAddcarryxU32(x215, x185, x209)
440
+ const x216: u32 = toU32(w216)
441
+ const x217: u32 = toU32(w216 >> 32)
442
+ const w218: u64 = p256FiatAddcarryxU32(x217, x187, x211)
443
+ const x218: u32 = toU32(w218)
444
+ const x219: u32 = toU32(w218 >> 32)
445
+ const w220: u64 = p256FiatAddcarryxU32(x219, x189, x213)
446
+ const x220: u32 = toU32(w220)
447
+ const x221: u32 = toU32(w220 >> 32)
448
+ const w222: u64 = p256FiatAddcarryxU32(x221, x191, 0x0)
449
+ const x222: u32 = toU32(w222)
450
+ const x223: u32 = toU32(w222 >> 32)
451
+ const w224: u64 = p256FiatAddcarryxU32(x223, x193, 0x0)
452
+ const x224: u32 = toU32(w224)
453
+ const x225: u32 = toU32(w224 >> 32)
454
+ const w226: u64 = p256FiatAddcarryxU32(x225, x195, x183)
455
+ const x226: u32 = toU32(w226)
456
+ const x227: u32 = toU32(w226 >> 32)
457
+ const w228: u64 = p256FiatAddcarryxU32(x227, x197, x201)
458
+ const x228: u32 = toU32(w228)
459
+ const x229: u32 = toU32(w228 >> 32)
460
+ const w230: u64 = p256FiatAddcarryxU32(x229, x199, x202)
461
+ const x230: u32 = toU32(w230)
462
+ const x231: u32 = toU32(w230 >> 32)
463
+ const x232: u32 = x231 + x200
464
+ const w233: u64 = p256FiatMulxU32(x3, arg2[7])
465
+ const x233: u32 = toU32(w233)
466
+ const x234: u32 = toU32(w233 >> 32)
467
+ const w235: u64 = p256FiatMulxU32(x3, arg2[6])
468
+ const x235: u32 = toU32(w235)
469
+ const x236: u32 = toU32(w235 >> 32)
470
+ const w237: u64 = p256FiatMulxU32(x3, arg2[5])
471
+ const x237: u32 = toU32(w237)
472
+ const x238: u32 = toU32(w237 >> 32)
473
+ const w239: u64 = p256FiatMulxU32(x3, arg2[4])
474
+ const x239: u32 = toU32(w239)
475
+ const x240: u32 = toU32(w239 >> 32)
476
+ const w241: u64 = p256FiatMulxU32(x3, arg2[3])
477
+ const x241: u32 = toU32(w241)
478
+ const x242: u32 = toU32(w241 >> 32)
479
+ const w243: u64 = p256FiatMulxU32(x3, arg2[2])
480
+ const x243: u32 = toU32(w243)
481
+ const x244: u32 = toU32(w243 >> 32)
482
+ const w245: u64 = p256FiatMulxU32(x3, arg2[1])
483
+ const x245: u32 = toU32(w245)
484
+ const x246: u32 = toU32(w245 >> 32)
485
+ const w247: u64 = p256FiatMulxU32(x3, arg2[0])
486
+ const x247: u32 = toU32(w247)
487
+ const x248: u32 = toU32(w247 >> 32)
488
+ const w249: u64 = p256FiatAddcarryxU32(0x0, x248, x245)
489
+ const x249: u32 = toU32(w249)
490
+ const x250: u32 = toU32(w249 >> 32)
491
+ const w251: u64 = p256FiatAddcarryxU32(x250, x246, x243)
492
+ const x251: u32 = toU32(w251)
493
+ const x252: u32 = toU32(w251 >> 32)
494
+ const w253: u64 = p256FiatAddcarryxU32(x252, x244, x241)
495
+ const x253: u32 = toU32(w253)
496
+ const x254: u32 = toU32(w253 >> 32)
497
+ const w255: u64 = p256FiatAddcarryxU32(x254, x242, x239)
498
+ const x255: u32 = toU32(w255)
499
+ const x256: u32 = toU32(w255 >> 32)
500
+ const w257: u64 = p256FiatAddcarryxU32(x256, x240, x237)
501
+ const x257: u32 = toU32(w257)
502
+ const x258: u32 = toU32(w257 >> 32)
503
+ const w259: u64 = p256FiatAddcarryxU32(x258, x238, x235)
504
+ const x259: u32 = toU32(w259)
505
+ const x260: u32 = toU32(w259 >> 32)
506
+ const w261: u64 = p256FiatAddcarryxU32(x260, x236, x233)
507
+ const x261: u32 = toU32(w261)
508
+ const x262: u32 = toU32(w261 >> 32)
509
+ const x263: u32 = x262 + x234
510
+ const w264: u64 = p256FiatAddcarryxU32(0x0, x216, x247)
511
+ const x264: u32 = toU32(w264)
512
+ const x265: u32 = toU32(w264 >> 32)
513
+ const w266: u64 = p256FiatAddcarryxU32(x265, x218, x249)
514
+ const x266: u32 = toU32(w266)
515
+ const x267: u32 = toU32(w266 >> 32)
516
+ const w268: u64 = p256FiatAddcarryxU32(x267, x220, x251)
517
+ const x268: u32 = toU32(w268)
518
+ const x269: u32 = toU32(w268 >> 32)
519
+ const w270: u64 = p256FiatAddcarryxU32(x269, x222, x253)
520
+ const x270: u32 = toU32(w270)
521
+ const x271: u32 = toU32(w270 >> 32)
522
+ const w272: u64 = p256FiatAddcarryxU32(x271, x224, x255)
523
+ const x272: u32 = toU32(w272)
524
+ const x273: u32 = toU32(w272 >> 32)
525
+ const w274: u64 = p256FiatAddcarryxU32(x273, x226, x257)
526
+ const x274: u32 = toU32(w274)
527
+ const x275: u32 = toU32(w274 >> 32)
528
+ const w276: u64 = p256FiatAddcarryxU32(x275, x228, x259)
529
+ const x276: u32 = toU32(w276)
530
+ const x277: u32 = toU32(w276 >> 32)
531
+ const w278: u64 = p256FiatAddcarryxU32(x277, x230, x261)
532
+ const x278: u32 = toU32(w278)
533
+ const x279: u32 = toU32(w278 >> 32)
534
+ const w280: u64 = p256FiatAddcarryxU32(x279, x232, x263)
535
+ const x280: u32 = toU32(w280)
536
+ const x281: u32 = toU32(w280 >> 32)
537
+ const w282: u64 = p256FiatMulxU32(x264, 0xffffffff)
538
+ const x282: u32 = toU32(w282)
539
+ const x283: u32 = toU32(w282 >> 32)
540
+ const w284: u64 = p256FiatMulxU32(x264, 0xffffffff)
541
+ const x284: u32 = toU32(w284)
542
+ const x285: u32 = toU32(w284 >> 32)
543
+ const w286: u64 = p256FiatMulxU32(x264, 0xffffffff)
544
+ const x286: u32 = toU32(w286)
545
+ const x287: u32 = toU32(w286 >> 32)
546
+ const w288: u64 = p256FiatMulxU32(x264, 0xffffffff)
547
+ const x288: u32 = toU32(w288)
548
+ const x289: u32 = toU32(w288 >> 32)
549
+ const w290: u64 = p256FiatAddcarryxU32(0x0, x289, x286)
550
+ const x290: u32 = toU32(w290)
551
+ const x291: u32 = toU32(w290 >> 32)
552
+ const w292: u64 = p256FiatAddcarryxU32(x291, x287, x284)
553
+ const x292: u32 = toU32(w292)
554
+ const x293: u32 = toU32(w292 >> 32)
555
+ const x294: u32 = x293 + x285
556
+ const w295: u64 = p256FiatAddcarryxU32(0x0, x264, x288)
557
+ const x296: u32 = toU32(w295 >> 32)
558
+ const w297: u64 = p256FiatAddcarryxU32(x296, x266, x290)
559
+ const x297: u32 = toU32(w297)
560
+ const x298: u32 = toU32(w297 >> 32)
561
+ const w299: u64 = p256FiatAddcarryxU32(x298, x268, x292)
562
+ const x299: u32 = toU32(w299)
563
+ const x300: u32 = toU32(w299 >> 32)
564
+ const w301: u64 = p256FiatAddcarryxU32(x300, x270, x294)
565
+ const x301: u32 = toU32(w301)
566
+ const x302: u32 = toU32(w301 >> 32)
567
+ const w303: u64 = p256FiatAddcarryxU32(x302, x272, 0x0)
568
+ const x303: u32 = toU32(w303)
569
+ const x304: u32 = toU32(w303 >> 32)
570
+ const w305: u64 = p256FiatAddcarryxU32(x304, x274, 0x0)
571
+ const x305: u32 = toU32(w305)
572
+ const x306: u32 = toU32(w305 >> 32)
573
+ const w307: u64 = p256FiatAddcarryxU32(x306, x276, x264)
574
+ const x307: u32 = toU32(w307)
575
+ const x308: u32 = toU32(w307 >> 32)
576
+ const w309: u64 = p256FiatAddcarryxU32(x308, x278, x282)
577
+ const x309: u32 = toU32(w309)
578
+ const x310: u32 = toU32(w309 >> 32)
579
+ const w311: u64 = p256FiatAddcarryxU32(x310, x280, x283)
580
+ const x311: u32 = toU32(w311)
581
+ const x312: u32 = toU32(w311 >> 32)
582
+ const x313: u32 = x312 + x281
583
+ const w314: u64 = p256FiatMulxU32(x4, arg2[7])
584
+ const x314: u32 = toU32(w314)
585
+ const x315: u32 = toU32(w314 >> 32)
586
+ const w316: u64 = p256FiatMulxU32(x4, arg2[6])
587
+ const x316: u32 = toU32(w316)
588
+ const x317: u32 = toU32(w316 >> 32)
589
+ const w318: u64 = p256FiatMulxU32(x4, arg2[5])
590
+ const x318: u32 = toU32(w318)
591
+ const x319: u32 = toU32(w318 >> 32)
592
+ const w320: u64 = p256FiatMulxU32(x4, arg2[4])
593
+ const x320: u32 = toU32(w320)
594
+ const x321: u32 = toU32(w320 >> 32)
595
+ const w322: u64 = p256FiatMulxU32(x4, arg2[3])
596
+ const x322: u32 = toU32(w322)
597
+ const x323: u32 = toU32(w322 >> 32)
598
+ const w324: u64 = p256FiatMulxU32(x4, arg2[2])
599
+ const x324: u32 = toU32(w324)
600
+ const x325: u32 = toU32(w324 >> 32)
601
+ const w326: u64 = p256FiatMulxU32(x4, arg2[1])
602
+ const x326: u32 = toU32(w326)
603
+ const x327: u32 = toU32(w326 >> 32)
604
+ const w328: u64 = p256FiatMulxU32(x4, arg2[0])
605
+ const x328: u32 = toU32(w328)
606
+ const x329: u32 = toU32(w328 >> 32)
607
+ const w330: u64 = p256FiatAddcarryxU32(0x0, x329, x326)
608
+ const x330: u32 = toU32(w330)
609
+ const x331: u32 = toU32(w330 >> 32)
610
+ const w332: u64 = p256FiatAddcarryxU32(x331, x327, x324)
611
+ const x332: u32 = toU32(w332)
612
+ const x333: u32 = toU32(w332 >> 32)
613
+ const w334: u64 = p256FiatAddcarryxU32(x333, x325, x322)
614
+ const x334: u32 = toU32(w334)
615
+ const x335: u32 = toU32(w334 >> 32)
616
+ const w336: u64 = p256FiatAddcarryxU32(x335, x323, x320)
617
+ const x336: u32 = toU32(w336)
618
+ const x337: u32 = toU32(w336 >> 32)
619
+ const w338: u64 = p256FiatAddcarryxU32(x337, x321, x318)
620
+ const x338: u32 = toU32(w338)
621
+ const x339: u32 = toU32(w338 >> 32)
622
+ const w340: u64 = p256FiatAddcarryxU32(x339, x319, x316)
623
+ const x340: u32 = toU32(w340)
624
+ const x341: u32 = toU32(w340 >> 32)
625
+ const w342: u64 = p256FiatAddcarryxU32(x341, x317, x314)
626
+ const x342: u32 = toU32(w342)
627
+ const x343: u32 = toU32(w342 >> 32)
628
+ const x344: u32 = x343 + x315
629
+ const w345: u64 = p256FiatAddcarryxU32(0x0, x297, x328)
630
+ const x345: u32 = toU32(w345)
631
+ const x346: u32 = toU32(w345 >> 32)
632
+ const w347: u64 = p256FiatAddcarryxU32(x346, x299, x330)
633
+ const x347: u32 = toU32(w347)
634
+ const x348: u32 = toU32(w347 >> 32)
635
+ const w349: u64 = p256FiatAddcarryxU32(x348, x301, x332)
636
+ const x349: u32 = toU32(w349)
637
+ const x350: u32 = toU32(w349 >> 32)
638
+ const w351: u64 = p256FiatAddcarryxU32(x350, x303, x334)
639
+ const x351: u32 = toU32(w351)
640
+ const x352: u32 = toU32(w351 >> 32)
641
+ const w353: u64 = p256FiatAddcarryxU32(x352, x305, x336)
642
+ const x353: u32 = toU32(w353)
643
+ const x354: u32 = toU32(w353 >> 32)
644
+ const w355: u64 = p256FiatAddcarryxU32(x354, x307, x338)
645
+ const x355: u32 = toU32(w355)
646
+ const x356: u32 = toU32(w355 >> 32)
647
+ const w357: u64 = p256FiatAddcarryxU32(x356, x309, x340)
648
+ const x357: u32 = toU32(w357)
649
+ const x358: u32 = toU32(w357 >> 32)
650
+ const w359: u64 = p256FiatAddcarryxU32(x358, x311, x342)
651
+ const x359: u32 = toU32(w359)
652
+ const x360: u32 = toU32(w359 >> 32)
653
+ const w361: u64 = p256FiatAddcarryxU32(x360, x313, x344)
654
+ const x361: u32 = toU32(w361)
655
+ const x362: u32 = toU32(w361 >> 32)
656
+ const w363: u64 = p256FiatMulxU32(x345, 0xffffffff)
657
+ const x363: u32 = toU32(w363)
658
+ const x364: u32 = toU32(w363 >> 32)
659
+ const w365: u64 = p256FiatMulxU32(x345, 0xffffffff)
660
+ const x365: u32 = toU32(w365)
661
+ const x366: u32 = toU32(w365 >> 32)
662
+ const w367: u64 = p256FiatMulxU32(x345, 0xffffffff)
663
+ const x367: u32 = toU32(w367)
664
+ const x368: u32 = toU32(w367 >> 32)
665
+ const w369: u64 = p256FiatMulxU32(x345, 0xffffffff)
666
+ const x369: u32 = toU32(w369)
667
+ const x370: u32 = toU32(w369 >> 32)
668
+ const w371: u64 = p256FiatAddcarryxU32(0x0, x370, x367)
669
+ const x371: u32 = toU32(w371)
670
+ const x372: u32 = toU32(w371 >> 32)
671
+ const w373: u64 = p256FiatAddcarryxU32(x372, x368, x365)
672
+ const x373: u32 = toU32(w373)
673
+ const x374: u32 = toU32(w373 >> 32)
674
+ const x375: u32 = x374 + x366
675
+ const w376: u64 = p256FiatAddcarryxU32(0x0, x345, x369)
676
+ const x377: u32 = toU32(w376 >> 32)
677
+ const w378: u64 = p256FiatAddcarryxU32(x377, x347, x371)
678
+ const x378: u32 = toU32(w378)
679
+ const x379: u32 = toU32(w378 >> 32)
680
+ const w380: u64 = p256FiatAddcarryxU32(x379, x349, x373)
681
+ const x380: u32 = toU32(w380)
682
+ const x381: u32 = toU32(w380 >> 32)
683
+ const w382: u64 = p256FiatAddcarryxU32(x381, x351, x375)
684
+ const x382: u32 = toU32(w382)
685
+ const x383: u32 = toU32(w382 >> 32)
686
+ const w384: u64 = p256FiatAddcarryxU32(x383, x353, 0x0)
687
+ const x384: u32 = toU32(w384)
688
+ const x385: u32 = toU32(w384 >> 32)
689
+ const w386: u64 = p256FiatAddcarryxU32(x385, x355, 0x0)
690
+ const x386: u32 = toU32(w386)
691
+ const x387: u32 = toU32(w386 >> 32)
692
+ const w388: u64 = p256FiatAddcarryxU32(x387, x357, x345)
693
+ const x388: u32 = toU32(w388)
694
+ const x389: u32 = toU32(w388 >> 32)
695
+ const w390: u64 = p256FiatAddcarryxU32(x389, x359, x363)
696
+ const x390: u32 = toU32(w390)
697
+ const x391: u32 = toU32(w390 >> 32)
698
+ const w392: u64 = p256FiatAddcarryxU32(x391, x361, x364)
699
+ const x392: u32 = toU32(w392)
700
+ const x393: u32 = toU32(w392 >> 32)
701
+ const x394: u32 = x393 + x362
702
+ const w395: u64 = p256FiatMulxU32(x5, arg2[7])
703
+ const x395: u32 = toU32(w395)
704
+ const x396: u32 = toU32(w395 >> 32)
705
+ const w397: u64 = p256FiatMulxU32(x5, arg2[6])
706
+ const x397: u32 = toU32(w397)
707
+ const x398: u32 = toU32(w397 >> 32)
708
+ const w399: u64 = p256FiatMulxU32(x5, arg2[5])
709
+ const x399: u32 = toU32(w399)
710
+ const x400: u32 = toU32(w399 >> 32)
711
+ const w401: u64 = p256FiatMulxU32(x5, arg2[4])
712
+ const x401: u32 = toU32(w401)
713
+ const x402: u32 = toU32(w401 >> 32)
714
+ const w403: u64 = p256FiatMulxU32(x5, arg2[3])
715
+ const x403: u32 = toU32(w403)
716
+ const x404: u32 = toU32(w403 >> 32)
717
+ const w405: u64 = p256FiatMulxU32(x5, arg2[2])
718
+ const x405: u32 = toU32(w405)
719
+ const x406: u32 = toU32(w405 >> 32)
720
+ const w407: u64 = p256FiatMulxU32(x5, arg2[1])
721
+ const x407: u32 = toU32(w407)
722
+ const x408: u32 = toU32(w407 >> 32)
723
+ const w409: u64 = p256FiatMulxU32(x5, arg2[0])
724
+ const x409: u32 = toU32(w409)
725
+ const x410: u32 = toU32(w409 >> 32)
726
+ const w411: u64 = p256FiatAddcarryxU32(0x0, x410, x407)
727
+ const x411: u32 = toU32(w411)
728
+ const x412: u32 = toU32(w411 >> 32)
729
+ const w413: u64 = p256FiatAddcarryxU32(x412, x408, x405)
730
+ const x413: u32 = toU32(w413)
731
+ const x414: u32 = toU32(w413 >> 32)
732
+ const w415: u64 = p256FiatAddcarryxU32(x414, x406, x403)
733
+ const x415: u32 = toU32(w415)
734
+ const x416: u32 = toU32(w415 >> 32)
735
+ const w417: u64 = p256FiatAddcarryxU32(x416, x404, x401)
736
+ const x417: u32 = toU32(w417)
737
+ const x418: u32 = toU32(w417 >> 32)
738
+ const w419: u64 = p256FiatAddcarryxU32(x418, x402, x399)
739
+ const x419: u32 = toU32(w419)
740
+ const x420: u32 = toU32(w419 >> 32)
741
+ const w421: u64 = p256FiatAddcarryxU32(x420, x400, x397)
742
+ const x421: u32 = toU32(w421)
743
+ const x422: u32 = toU32(w421 >> 32)
744
+ const w423: u64 = p256FiatAddcarryxU32(x422, x398, x395)
745
+ const x423: u32 = toU32(w423)
746
+ const x424: u32 = toU32(w423 >> 32)
747
+ const x425: u32 = x424 + x396
748
+ const w426: u64 = p256FiatAddcarryxU32(0x0, x378, x409)
749
+ const x426: u32 = toU32(w426)
750
+ const x427: u32 = toU32(w426 >> 32)
751
+ const w428: u64 = p256FiatAddcarryxU32(x427, x380, x411)
752
+ const x428: u32 = toU32(w428)
753
+ const x429: u32 = toU32(w428 >> 32)
754
+ const w430: u64 = p256FiatAddcarryxU32(x429, x382, x413)
755
+ const x430: u32 = toU32(w430)
756
+ const x431: u32 = toU32(w430 >> 32)
757
+ const w432: u64 = p256FiatAddcarryxU32(x431, x384, x415)
758
+ const x432: u32 = toU32(w432)
759
+ const x433: u32 = toU32(w432 >> 32)
760
+ const w434: u64 = p256FiatAddcarryxU32(x433, x386, x417)
761
+ const x434: u32 = toU32(w434)
762
+ const x435: u32 = toU32(w434 >> 32)
763
+ const w436: u64 = p256FiatAddcarryxU32(x435, x388, x419)
764
+ const x436: u32 = toU32(w436)
765
+ const x437: u32 = toU32(w436 >> 32)
766
+ const w438: u64 = p256FiatAddcarryxU32(x437, x390, x421)
767
+ const x438: u32 = toU32(w438)
768
+ const x439: u32 = toU32(w438 >> 32)
769
+ const w440: u64 = p256FiatAddcarryxU32(x439, x392, x423)
770
+ const x440: u32 = toU32(w440)
771
+ const x441: u32 = toU32(w440 >> 32)
772
+ const w442: u64 = p256FiatAddcarryxU32(x441, x394, x425)
773
+ const x442: u32 = toU32(w442)
774
+ const x443: u32 = toU32(w442 >> 32)
775
+ const w444: u64 = p256FiatMulxU32(x426, 0xffffffff)
776
+ const x444: u32 = toU32(w444)
777
+ const x445: u32 = toU32(w444 >> 32)
778
+ const w446: u64 = p256FiatMulxU32(x426, 0xffffffff)
779
+ const x446: u32 = toU32(w446)
780
+ const x447: u32 = toU32(w446 >> 32)
781
+ const w448: u64 = p256FiatMulxU32(x426, 0xffffffff)
782
+ const x448: u32 = toU32(w448)
783
+ const x449: u32 = toU32(w448 >> 32)
784
+ const w450: u64 = p256FiatMulxU32(x426, 0xffffffff)
785
+ const x450: u32 = toU32(w450)
786
+ const x451: u32 = toU32(w450 >> 32)
787
+ const w452: u64 = p256FiatAddcarryxU32(0x0, x451, x448)
788
+ const x452: u32 = toU32(w452)
789
+ const x453: u32 = toU32(w452 >> 32)
790
+ const w454: u64 = p256FiatAddcarryxU32(x453, x449, x446)
791
+ const x454: u32 = toU32(w454)
792
+ const x455: u32 = toU32(w454 >> 32)
793
+ const x456: u32 = x455 + x447
794
+ const w457: u64 = p256FiatAddcarryxU32(0x0, x426, x450)
795
+ const x458: u32 = toU32(w457 >> 32)
796
+ const w459: u64 = p256FiatAddcarryxU32(x458, x428, x452)
797
+ const x459: u32 = toU32(w459)
798
+ const x460: u32 = toU32(w459 >> 32)
799
+ const w461: u64 = p256FiatAddcarryxU32(x460, x430, x454)
800
+ const x461: u32 = toU32(w461)
801
+ const x462: u32 = toU32(w461 >> 32)
802
+ const w463: u64 = p256FiatAddcarryxU32(x462, x432, x456)
803
+ const x463: u32 = toU32(w463)
804
+ const x464: u32 = toU32(w463 >> 32)
805
+ const w465: u64 = p256FiatAddcarryxU32(x464, x434, 0x0)
806
+ const x465: u32 = toU32(w465)
807
+ const x466: u32 = toU32(w465 >> 32)
808
+ const w467: u64 = p256FiatAddcarryxU32(x466, x436, 0x0)
809
+ const x467: u32 = toU32(w467)
810
+ const x468: u32 = toU32(w467 >> 32)
811
+ const w469: u64 = p256FiatAddcarryxU32(x468, x438, x426)
812
+ const x469: u32 = toU32(w469)
813
+ const x470: u32 = toU32(w469 >> 32)
814
+ const w471: u64 = p256FiatAddcarryxU32(x470, x440, x444)
815
+ const x471: u32 = toU32(w471)
816
+ const x472: u32 = toU32(w471 >> 32)
817
+ const w473: u64 = p256FiatAddcarryxU32(x472, x442, x445)
818
+ const x473: u32 = toU32(w473)
819
+ const x474: u32 = toU32(w473 >> 32)
820
+ const x475: u32 = x474 + x443
821
+ const w476: u64 = p256FiatMulxU32(x6, arg2[7])
822
+ const x476: u32 = toU32(w476)
823
+ const x477: u32 = toU32(w476 >> 32)
824
+ const w478: u64 = p256FiatMulxU32(x6, arg2[6])
825
+ const x478: u32 = toU32(w478)
826
+ const x479: u32 = toU32(w478 >> 32)
827
+ const w480: u64 = p256FiatMulxU32(x6, arg2[5])
828
+ const x480: u32 = toU32(w480)
829
+ const x481: u32 = toU32(w480 >> 32)
830
+ const w482: u64 = p256FiatMulxU32(x6, arg2[4])
831
+ const x482: u32 = toU32(w482)
832
+ const x483: u32 = toU32(w482 >> 32)
833
+ const w484: u64 = p256FiatMulxU32(x6, arg2[3])
834
+ const x484: u32 = toU32(w484)
835
+ const x485: u32 = toU32(w484 >> 32)
836
+ const w486: u64 = p256FiatMulxU32(x6, arg2[2])
837
+ const x486: u32 = toU32(w486)
838
+ const x487: u32 = toU32(w486 >> 32)
839
+ const w488: u64 = p256FiatMulxU32(x6, arg2[1])
840
+ const x488: u32 = toU32(w488)
841
+ const x489: u32 = toU32(w488 >> 32)
842
+ const w490: u64 = p256FiatMulxU32(x6, arg2[0])
843
+ const x490: u32 = toU32(w490)
844
+ const x491: u32 = toU32(w490 >> 32)
845
+ const w492: u64 = p256FiatAddcarryxU32(0x0, x491, x488)
846
+ const x492: u32 = toU32(w492)
847
+ const x493: u32 = toU32(w492 >> 32)
848
+ const w494: u64 = p256FiatAddcarryxU32(x493, x489, x486)
849
+ const x494: u32 = toU32(w494)
850
+ const x495: u32 = toU32(w494 >> 32)
851
+ const w496: u64 = p256FiatAddcarryxU32(x495, x487, x484)
852
+ const x496: u32 = toU32(w496)
853
+ const x497: u32 = toU32(w496 >> 32)
854
+ const w498: u64 = p256FiatAddcarryxU32(x497, x485, x482)
855
+ const x498: u32 = toU32(w498)
856
+ const x499: u32 = toU32(w498 >> 32)
857
+ const w500: u64 = p256FiatAddcarryxU32(x499, x483, x480)
858
+ const x500: u32 = toU32(w500)
859
+ const x501: u32 = toU32(w500 >> 32)
860
+ const w502: u64 = p256FiatAddcarryxU32(x501, x481, x478)
861
+ const x502: u32 = toU32(w502)
862
+ const x503: u32 = toU32(w502 >> 32)
863
+ const w504: u64 = p256FiatAddcarryxU32(x503, x479, x476)
864
+ const x504: u32 = toU32(w504)
865
+ const x505: u32 = toU32(w504 >> 32)
866
+ const x506: u32 = x505 + x477
867
+ const w507: u64 = p256FiatAddcarryxU32(0x0, x459, x490)
868
+ const x507: u32 = toU32(w507)
869
+ const x508: u32 = toU32(w507 >> 32)
870
+ const w509: u64 = p256FiatAddcarryxU32(x508, x461, x492)
871
+ const x509: u32 = toU32(w509)
872
+ const x510: u32 = toU32(w509 >> 32)
873
+ const w511: u64 = p256FiatAddcarryxU32(x510, x463, x494)
874
+ const x511: u32 = toU32(w511)
875
+ const x512: u32 = toU32(w511 >> 32)
876
+ const w513: u64 = p256FiatAddcarryxU32(x512, x465, x496)
877
+ const x513: u32 = toU32(w513)
878
+ const x514: u32 = toU32(w513 >> 32)
879
+ const w515: u64 = p256FiatAddcarryxU32(x514, x467, x498)
880
+ const x515: u32 = toU32(w515)
881
+ const x516: u32 = toU32(w515 >> 32)
882
+ const w517: u64 = p256FiatAddcarryxU32(x516, x469, x500)
883
+ const x517: u32 = toU32(w517)
884
+ const x518: u32 = toU32(w517 >> 32)
885
+ const w519: u64 = p256FiatAddcarryxU32(x518, x471, x502)
886
+ const x519: u32 = toU32(w519)
887
+ const x520: u32 = toU32(w519 >> 32)
888
+ const w521: u64 = p256FiatAddcarryxU32(x520, x473, x504)
889
+ const x521: u32 = toU32(w521)
890
+ const x522: u32 = toU32(w521 >> 32)
891
+ const w523: u64 = p256FiatAddcarryxU32(x522, x475, x506)
892
+ const x523: u32 = toU32(w523)
893
+ const x524: u32 = toU32(w523 >> 32)
894
+ const w525: u64 = p256FiatMulxU32(x507, 0xffffffff)
895
+ const x525: u32 = toU32(w525)
896
+ const x526: u32 = toU32(w525 >> 32)
897
+ const w527: u64 = p256FiatMulxU32(x507, 0xffffffff)
898
+ const x527: u32 = toU32(w527)
899
+ const x528: u32 = toU32(w527 >> 32)
900
+ const w529: u64 = p256FiatMulxU32(x507, 0xffffffff)
901
+ const x529: u32 = toU32(w529)
902
+ const x530: u32 = toU32(w529 >> 32)
903
+ const w531: u64 = p256FiatMulxU32(x507, 0xffffffff)
904
+ const x531: u32 = toU32(w531)
905
+ const x532: u32 = toU32(w531 >> 32)
906
+ const w533: u64 = p256FiatAddcarryxU32(0x0, x532, x529)
907
+ const x533: u32 = toU32(w533)
908
+ const x534: u32 = toU32(w533 >> 32)
909
+ const w535: u64 = p256FiatAddcarryxU32(x534, x530, x527)
910
+ const x535: u32 = toU32(w535)
911
+ const x536: u32 = toU32(w535 >> 32)
912
+ const x537: u32 = x536 + x528
913
+ const w538: u64 = p256FiatAddcarryxU32(0x0, x507, x531)
914
+ const x539: u32 = toU32(w538 >> 32)
915
+ const w540: u64 = p256FiatAddcarryxU32(x539, x509, x533)
916
+ const x540: u32 = toU32(w540)
917
+ const x541: u32 = toU32(w540 >> 32)
918
+ const w542: u64 = p256FiatAddcarryxU32(x541, x511, x535)
919
+ const x542: u32 = toU32(w542)
920
+ const x543: u32 = toU32(w542 >> 32)
921
+ const w544: u64 = p256FiatAddcarryxU32(x543, x513, x537)
922
+ const x544: u32 = toU32(w544)
923
+ const x545: u32 = toU32(w544 >> 32)
924
+ const w546: u64 = p256FiatAddcarryxU32(x545, x515, 0x0)
925
+ const x546: u32 = toU32(w546)
926
+ const x547: u32 = toU32(w546 >> 32)
927
+ const w548: u64 = p256FiatAddcarryxU32(x547, x517, 0x0)
928
+ const x548: u32 = toU32(w548)
929
+ const x549: u32 = toU32(w548 >> 32)
930
+ const w550: u64 = p256FiatAddcarryxU32(x549, x519, x507)
931
+ const x550: u32 = toU32(w550)
932
+ const x551: u32 = toU32(w550 >> 32)
933
+ const w552: u64 = p256FiatAddcarryxU32(x551, x521, x525)
934
+ const x552: u32 = toU32(w552)
935
+ const x553: u32 = toU32(w552 >> 32)
936
+ const w554: u64 = p256FiatAddcarryxU32(x553, x523, x526)
937
+ const x554: u32 = toU32(w554)
938
+ const x555: u32 = toU32(w554 >> 32)
939
+ const x556: u32 = x555 + x524
940
+ const w557: u64 = p256FiatMulxU32(x7, arg2[7])
941
+ const x557: u32 = toU32(w557)
942
+ const x558: u32 = toU32(w557 >> 32)
943
+ const w559: u64 = p256FiatMulxU32(x7, arg2[6])
944
+ const x559: u32 = toU32(w559)
945
+ const x560: u32 = toU32(w559 >> 32)
946
+ const w561: u64 = p256FiatMulxU32(x7, arg2[5])
947
+ const x561: u32 = toU32(w561)
948
+ const x562: u32 = toU32(w561 >> 32)
949
+ const w563: u64 = p256FiatMulxU32(x7, arg2[4])
950
+ const x563: u32 = toU32(w563)
951
+ const x564: u32 = toU32(w563 >> 32)
952
+ const w565: u64 = p256FiatMulxU32(x7, arg2[3])
953
+ const x565: u32 = toU32(w565)
954
+ const x566: u32 = toU32(w565 >> 32)
955
+ const w567: u64 = p256FiatMulxU32(x7, arg2[2])
956
+ const x567: u32 = toU32(w567)
957
+ const x568: u32 = toU32(w567 >> 32)
958
+ const w569: u64 = p256FiatMulxU32(x7, arg2[1])
959
+ const x569: u32 = toU32(w569)
960
+ const x570: u32 = toU32(w569 >> 32)
961
+ const w571: u64 = p256FiatMulxU32(x7, arg2[0])
962
+ const x571: u32 = toU32(w571)
963
+ const x572: u32 = toU32(w571 >> 32)
964
+ const w573: u64 = p256FiatAddcarryxU32(0x0, x572, x569)
965
+ const x573: u32 = toU32(w573)
966
+ const x574: u32 = toU32(w573 >> 32)
967
+ const w575: u64 = p256FiatAddcarryxU32(x574, x570, x567)
968
+ const x575: u32 = toU32(w575)
969
+ const x576: u32 = toU32(w575 >> 32)
970
+ const w577: u64 = p256FiatAddcarryxU32(x576, x568, x565)
971
+ const x577: u32 = toU32(w577)
972
+ const x578: u32 = toU32(w577 >> 32)
973
+ const w579: u64 = p256FiatAddcarryxU32(x578, x566, x563)
974
+ const x579: u32 = toU32(w579)
975
+ const x580: u32 = toU32(w579 >> 32)
976
+ const w581: u64 = p256FiatAddcarryxU32(x580, x564, x561)
977
+ const x581: u32 = toU32(w581)
978
+ const x582: u32 = toU32(w581 >> 32)
979
+ const w583: u64 = p256FiatAddcarryxU32(x582, x562, x559)
980
+ const x583: u32 = toU32(w583)
981
+ const x584: u32 = toU32(w583 >> 32)
982
+ const w585: u64 = p256FiatAddcarryxU32(x584, x560, x557)
983
+ const x585: u32 = toU32(w585)
984
+ const x586: u32 = toU32(w585 >> 32)
985
+ const x587: u32 = x586 + x558
986
+ const w588: u64 = p256FiatAddcarryxU32(0x0, x540, x571)
987
+ const x588: u32 = toU32(w588)
988
+ const x589: u32 = toU32(w588 >> 32)
989
+ const w590: u64 = p256FiatAddcarryxU32(x589, x542, x573)
990
+ const x590: u32 = toU32(w590)
991
+ const x591: u32 = toU32(w590 >> 32)
992
+ const w592: u64 = p256FiatAddcarryxU32(x591, x544, x575)
993
+ const x592: u32 = toU32(w592)
994
+ const x593: u32 = toU32(w592 >> 32)
995
+ const w594: u64 = p256FiatAddcarryxU32(x593, x546, x577)
996
+ const x594: u32 = toU32(w594)
997
+ const x595: u32 = toU32(w594 >> 32)
998
+ const w596: u64 = p256FiatAddcarryxU32(x595, x548, x579)
999
+ const x596: u32 = toU32(w596)
1000
+ const x597: u32 = toU32(w596 >> 32)
1001
+ const w598: u64 = p256FiatAddcarryxU32(x597, x550, x581)
1002
+ const x598: u32 = toU32(w598)
1003
+ const x599: u32 = toU32(w598 >> 32)
1004
+ const w600: u64 = p256FiatAddcarryxU32(x599, x552, x583)
1005
+ const x600: u32 = toU32(w600)
1006
+ const x601: u32 = toU32(w600 >> 32)
1007
+ const w602: u64 = p256FiatAddcarryxU32(x601, x554, x585)
1008
+ const x602: u32 = toU32(w602)
1009
+ const x603: u32 = toU32(w602 >> 32)
1010
+ const w604: u64 = p256FiatAddcarryxU32(x603, x556, x587)
1011
+ const x604: u32 = toU32(w604)
1012
+ const x605: u32 = toU32(w604 >> 32)
1013
+ const w606: u64 = p256FiatMulxU32(x588, 0xffffffff)
1014
+ const x606: u32 = toU32(w606)
1015
+ const x607: u32 = toU32(w606 >> 32)
1016
+ const w608: u64 = p256FiatMulxU32(x588, 0xffffffff)
1017
+ const x608: u32 = toU32(w608)
1018
+ const x609: u32 = toU32(w608 >> 32)
1019
+ const w610: u64 = p256FiatMulxU32(x588, 0xffffffff)
1020
+ const x610: u32 = toU32(w610)
1021
+ const x611: u32 = toU32(w610 >> 32)
1022
+ const w612: u64 = p256FiatMulxU32(x588, 0xffffffff)
1023
+ const x612: u32 = toU32(w612)
1024
+ const x613: u32 = toU32(w612 >> 32)
1025
+ const w614: u64 = p256FiatAddcarryxU32(0x0, x613, x610)
1026
+ const x614: u32 = toU32(w614)
1027
+ const x615: u32 = toU32(w614 >> 32)
1028
+ const w616: u64 = p256FiatAddcarryxU32(x615, x611, x608)
1029
+ const x616: u32 = toU32(w616)
1030
+ const x617: u32 = toU32(w616 >> 32)
1031
+ const x618: u32 = x617 + x609
1032
+ const w619: u64 = p256FiatAddcarryxU32(0x0, x588, x612)
1033
+ const x620: u32 = toU32(w619 >> 32)
1034
+ const w621: u64 = p256FiatAddcarryxU32(x620, x590, x614)
1035
+ const x621: u32 = toU32(w621)
1036
+ const x622: u32 = toU32(w621 >> 32)
1037
+ const w623: u64 = p256FiatAddcarryxU32(x622, x592, x616)
1038
+ const x623: u32 = toU32(w623)
1039
+ const x624: u32 = toU32(w623 >> 32)
1040
+ const w625: u64 = p256FiatAddcarryxU32(x624, x594, x618)
1041
+ const x625: u32 = toU32(w625)
1042
+ const x626: u32 = toU32(w625 >> 32)
1043
+ const w627: u64 = p256FiatAddcarryxU32(x626, x596, 0x0)
1044
+ const x627: u32 = toU32(w627)
1045
+ const x628: u32 = toU32(w627 >> 32)
1046
+ const w629: u64 = p256FiatAddcarryxU32(x628, x598, 0x0)
1047
+ const x629: u32 = toU32(w629)
1048
+ const x630: u32 = toU32(w629 >> 32)
1049
+ const w631: u64 = p256FiatAddcarryxU32(x630, x600, x588)
1050
+ const x631: u32 = toU32(w631)
1051
+ const x632: u32 = toU32(w631 >> 32)
1052
+ const w633: u64 = p256FiatAddcarryxU32(x632, x602, x606)
1053
+ const x633: u32 = toU32(w633)
1054
+ const x634: u32 = toU32(w633 >> 32)
1055
+ const w635: u64 = p256FiatAddcarryxU32(x634, x604, x607)
1056
+ const x635: u32 = toU32(w635)
1057
+ const x636: u32 = toU32(w635 >> 32)
1058
+ const x637: u32 = x636 + x605
1059
+ const w638: u64 = p256FiatSubborrowxU32(0x0, x621, 0xffffffff)
1060
+ const x638: u32 = toU32(w638)
1061
+ const x639: u32 = toU32(w638 >> 32)
1062
+ const w640: u64 = p256FiatSubborrowxU32(x639, x623, 0xffffffff)
1063
+ const x640: u32 = toU32(w640)
1064
+ const x641: u32 = toU32(w640 >> 32)
1065
+ const w642: u64 = p256FiatSubborrowxU32(x641, x625, 0xffffffff)
1066
+ const x642: u32 = toU32(w642)
1067
+ const x643: u32 = toU32(w642 >> 32)
1068
+ const w644: u64 = p256FiatSubborrowxU32(x643, x627, 0x0)
1069
+ const x644: u32 = toU32(w644)
1070
+ const x645: u32 = toU32(w644 >> 32)
1071
+ const w646: u64 = p256FiatSubborrowxU32(x645, x629, 0x0)
1072
+ const x646: u32 = toU32(w646)
1073
+ const x647: u32 = toU32(w646 >> 32)
1074
+ const w648: u64 = p256FiatSubborrowxU32(x647, x631, 0x0)
1075
+ const x648: u32 = toU32(w648)
1076
+ const x649: u32 = toU32(w648 >> 32)
1077
+ const w650: u64 = p256FiatSubborrowxU32(x649, x633, 0x1)
1078
+ const x650: u32 = toU32(w650)
1079
+ const x651: u32 = toU32(w650 >> 32)
1080
+ const w652: u64 = p256FiatSubborrowxU32(x651, x635, 0xffffffff)
1081
+ const x652: u32 = toU32(w652)
1082
+ const x653: u32 = toU32(w652 >> 32)
1083
+ const w654: u64 = p256FiatSubborrowxU32(x653, x637, 0x0)
1084
+ const x655: u32 = toU32(w654 >> 32)
1085
+ const x656: u32 = p256FiatCmovznzU32(x655, x638, x621)
1086
+ const x657: u32 = p256FiatCmovznzU32(x655, x640, x623)
1087
+ const x658: u32 = p256FiatCmovznzU32(x655, x642, x625)
1088
+ const x659: u32 = p256FiatCmovznzU32(x655, x644, x627)
1089
+ const x660: u32 = p256FiatCmovznzU32(x655, x646, x629)
1090
+ const x661: u32 = p256FiatCmovznzU32(x655, x648, x631)
1091
+ const x662: u32 = p256FiatCmovznzU32(x655, x650, x633)
1092
+ const x663: u32 = p256FiatCmovznzU32(x655, x652, x635)
1093
+ out1[0] = x656
1094
+ out1[1] = x657
1095
+ out1[2] = x658
1096
+ out1[3] = x659
1097
+ out1[4] = x660
1098
+ out1[5] = x661
1099
+ out1[6] = x662
1100
+ out1[7] = x663
1101
+ }
1102
+
1103
+ /** fiat's `fiat_p256_square`: squares a field element in the Montgomery domain. */
1104
+ const p256FiatSquare = (out1: u32[], arg1: u32[]): void => {
1105
+ if (toI32(out1.length) < 8 || toI32(arg1.length) < 8) {
1106
+ return
1107
+ }
1108
+ const arg1Limb0: u32 = arg1[0]
1109
+ const arg1Limb1: u32 = arg1[1]
1110
+ const arg1Limb2: u32 = arg1[2]
1111
+ const arg1Limb3: u32 = arg1[3]
1112
+ const arg1Limb4: u32 = arg1[4]
1113
+ const arg1Limb5: u32 = arg1[5]
1114
+ const arg1Limb6: u32 = arg1[6]
1115
+ const arg1Limb7: u32 = arg1[7]
1116
+ const x1: u32 = arg1Limb1
1117
+ const x2: u32 = arg1Limb2
1118
+ const x3: u32 = arg1Limb3
1119
+ const x4: u32 = arg1Limb4
1120
+ const x5: u32 = arg1Limb5
1121
+ const x6: u32 = arg1Limb6
1122
+ const x7: u32 = arg1Limb7
1123
+ const x8: u32 = arg1Limb0
1124
+ const w9: u64 = p256FiatMulxU32(x8, arg1Limb7)
1125
+ const x9: u32 = toU32(w9)
1126
+ const x10: u32 = toU32(w9 >> 32)
1127
+ const w11: u64 = p256FiatMulxU32(x8, arg1Limb6)
1128
+ const x11: u32 = toU32(w11)
1129
+ const x12: u32 = toU32(w11 >> 32)
1130
+ const w13: u64 = p256FiatMulxU32(x8, arg1Limb5)
1131
+ const x13: u32 = toU32(w13)
1132
+ const x14: u32 = toU32(w13 >> 32)
1133
+ const w15: u64 = p256FiatMulxU32(x8, arg1Limb4)
1134
+ const x15: u32 = toU32(w15)
1135
+ const x16: u32 = toU32(w15 >> 32)
1136
+ const w17: u64 = p256FiatMulxU32(x8, arg1Limb3)
1137
+ const x17: u32 = toU32(w17)
1138
+ const x18: u32 = toU32(w17 >> 32)
1139
+ const w19: u64 = p256FiatMulxU32(x8, arg1Limb2)
1140
+ const x19: u32 = toU32(w19)
1141
+ const x20: u32 = toU32(w19 >> 32)
1142
+ const w21: u64 = p256FiatMulxU32(x8, arg1Limb1)
1143
+ const x21: u32 = toU32(w21)
1144
+ const x22: u32 = toU32(w21 >> 32)
1145
+ const w23: u64 = p256FiatMulxU32(x8, arg1Limb0)
1146
+ const x23: u32 = toU32(w23)
1147
+ const x24: u32 = toU32(w23 >> 32)
1148
+ const w25: u64 = p256FiatAddcarryxU32(0x0, x24, x21)
1149
+ const x25: u32 = toU32(w25)
1150
+ const x26: u32 = toU32(w25 >> 32)
1151
+ const w27: u64 = p256FiatAddcarryxU32(x26, x22, x19)
1152
+ const x27: u32 = toU32(w27)
1153
+ const x28: u32 = toU32(w27 >> 32)
1154
+ const w29: u64 = p256FiatAddcarryxU32(x28, x20, x17)
1155
+ const x29: u32 = toU32(w29)
1156
+ const x30: u32 = toU32(w29 >> 32)
1157
+ const w31: u64 = p256FiatAddcarryxU32(x30, x18, x15)
1158
+ const x31: u32 = toU32(w31)
1159
+ const x32: u32 = toU32(w31 >> 32)
1160
+ const w33: u64 = p256FiatAddcarryxU32(x32, x16, x13)
1161
+ const x33: u32 = toU32(w33)
1162
+ const x34: u32 = toU32(w33 >> 32)
1163
+ const w35: u64 = p256FiatAddcarryxU32(x34, x14, x11)
1164
+ const x35: u32 = toU32(w35)
1165
+ const x36: u32 = toU32(w35 >> 32)
1166
+ const w37: u64 = p256FiatAddcarryxU32(x36, x12, x9)
1167
+ const x37: u32 = toU32(w37)
1168
+ const x38: u32 = toU32(w37 >> 32)
1169
+ const x39: u32 = x38 + x10
1170
+ const w40: u64 = p256FiatMulxU32(x23, 0xffffffff)
1171
+ const x40: u32 = toU32(w40)
1172
+ const x41: u32 = toU32(w40 >> 32)
1173
+ const w42: u64 = p256FiatMulxU32(x23, 0xffffffff)
1174
+ const x42: u32 = toU32(w42)
1175
+ const x43: u32 = toU32(w42 >> 32)
1176
+ const w44: u64 = p256FiatMulxU32(x23, 0xffffffff)
1177
+ const x44: u32 = toU32(w44)
1178
+ const x45: u32 = toU32(w44 >> 32)
1179
+ const w46: u64 = p256FiatMulxU32(x23, 0xffffffff)
1180
+ const x46: u32 = toU32(w46)
1181
+ const x47: u32 = toU32(w46 >> 32)
1182
+ const w48: u64 = p256FiatAddcarryxU32(0x0, x47, x44)
1183
+ const x48: u32 = toU32(w48)
1184
+ const x49: u32 = toU32(w48 >> 32)
1185
+ const w50: u64 = p256FiatAddcarryxU32(x49, x45, x42)
1186
+ const x50: u32 = toU32(w50)
1187
+ const x51: u32 = toU32(w50 >> 32)
1188
+ const x52: u32 = x51 + x43
1189
+ const w53: u64 = p256FiatAddcarryxU32(0x0, x23, x46)
1190
+ const x54: u32 = toU32(w53 >> 32)
1191
+ const w55: u64 = p256FiatAddcarryxU32(x54, x25, x48)
1192
+ const x55: u32 = toU32(w55)
1193
+ const x56: u32 = toU32(w55 >> 32)
1194
+ const w57: u64 = p256FiatAddcarryxU32(x56, x27, x50)
1195
+ const x57: u32 = toU32(w57)
1196
+ const x58: u32 = toU32(w57 >> 32)
1197
+ const w59: u64 = p256FiatAddcarryxU32(x58, x29, x52)
1198
+ const x59: u32 = toU32(w59)
1199
+ const x60: u32 = toU32(w59 >> 32)
1200
+ const w61: u64 = p256FiatAddcarryxU32(x60, x31, 0x0)
1201
+ const x61: u32 = toU32(w61)
1202
+ const x62: u32 = toU32(w61 >> 32)
1203
+ const w63: u64 = p256FiatAddcarryxU32(x62, x33, 0x0)
1204
+ const x63: u32 = toU32(w63)
1205
+ const x64: u32 = toU32(w63 >> 32)
1206
+ const w65: u64 = p256FiatAddcarryxU32(x64, x35, x23)
1207
+ const x65: u32 = toU32(w65)
1208
+ const x66: u32 = toU32(w65 >> 32)
1209
+ const w67: u64 = p256FiatAddcarryxU32(x66, x37, x40)
1210
+ const x67: u32 = toU32(w67)
1211
+ const x68: u32 = toU32(w67 >> 32)
1212
+ const w69: u64 = p256FiatAddcarryxU32(x68, x39, x41)
1213
+ const x69: u32 = toU32(w69)
1214
+ const x70: u32 = toU32(w69 >> 32)
1215
+ const w71: u64 = p256FiatMulxU32(x1, arg1Limb7)
1216
+ const x71: u32 = toU32(w71)
1217
+ const x72: u32 = toU32(w71 >> 32)
1218
+ const w73: u64 = p256FiatMulxU32(x1, arg1Limb6)
1219
+ const x73: u32 = toU32(w73)
1220
+ const x74: u32 = toU32(w73 >> 32)
1221
+ const w75: u64 = p256FiatMulxU32(x1, arg1Limb5)
1222
+ const x75: u32 = toU32(w75)
1223
+ const x76: u32 = toU32(w75 >> 32)
1224
+ const w77: u64 = p256FiatMulxU32(x1, arg1Limb4)
1225
+ const x77: u32 = toU32(w77)
1226
+ const x78: u32 = toU32(w77 >> 32)
1227
+ const w79: u64 = p256FiatMulxU32(x1, arg1Limb3)
1228
+ const x79: u32 = toU32(w79)
1229
+ const x80: u32 = toU32(w79 >> 32)
1230
+ const w81: u64 = p256FiatMulxU32(x1, arg1Limb2)
1231
+ const x81: u32 = toU32(w81)
1232
+ const x82: u32 = toU32(w81 >> 32)
1233
+ const w83: u64 = p256FiatMulxU32(x1, arg1Limb1)
1234
+ const x83: u32 = toU32(w83)
1235
+ const x84: u32 = toU32(w83 >> 32)
1236
+ const w85: u64 = p256FiatMulxU32(x1, arg1Limb0)
1237
+ const x85: u32 = toU32(w85)
1238
+ const x86: u32 = toU32(w85 >> 32)
1239
+ const w87: u64 = p256FiatAddcarryxU32(0x0, x86, x83)
1240
+ const x87: u32 = toU32(w87)
1241
+ const x88: u32 = toU32(w87 >> 32)
1242
+ const w89: u64 = p256FiatAddcarryxU32(x88, x84, x81)
1243
+ const x89: u32 = toU32(w89)
1244
+ const x90: u32 = toU32(w89 >> 32)
1245
+ const w91: u64 = p256FiatAddcarryxU32(x90, x82, x79)
1246
+ const x91: u32 = toU32(w91)
1247
+ const x92: u32 = toU32(w91 >> 32)
1248
+ const w93: u64 = p256FiatAddcarryxU32(x92, x80, x77)
1249
+ const x93: u32 = toU32(w93)
1250
+ const x94: u32 = toU32(w93 >> 32)
1251
+ const w95: u64 = p256FiatAddcarryxU32(x94, x78, x75)
1252
+ const x95: u32 = toU32(w95)
1253
+ const x96: u32 = toU32(w95 >> 32)
1254
+ const w97: u64 = p256FiatAddcarryxU32(x96, x76, x73)
1255
+ const x97: u32 = toU32(w97)
1256
+ const x98: u32 = toU32(w97 >> 32)
1257
+ const w99: u64 = p256FiatAddcarryxU32(x98, x74, x71)
1258
+ const x99: u32 = toU32(w99)
1259
+ const x100: u32 = toU32(w99 >> 32)
1260
+ const x101: u32 = x100 + x72
1261
+ const w102: u64 = p256FiatAddcarryxU32(0x0, x55, x85)
1262
+ const x102: u32 = toU32(w102)
1263
+ const x103: u32 = toU32(w102 >> 32)
1264
+ const w104: u64 = p256FiatAddcarryxU32(x103, x57, x87)
1265
+ const x104: u32 = toU32(w104)
1266
+ const x105: u32 = toU32(w104 >> 32)
1267
+ const w106: u64 = p256FiatAddcarryxU32(x105, x59, x89)
1268
+ const x106: u32 = toU32(w106)
1269
+ const x107: u32 = toU32(w106 >> 32)
1270
+ const w108: u64 = p256FiatAddcarryxU32(x107, x61, x91)
1271
+ const x108: u32 = toU32(w108)
1272
+ const x109: u32 = toU32(w108 >> 32)
1273
+ const w110: u64 = p256FiatAddcarryxU32(x109, x63, x93)
1274
+ const x110: u32 = toU32(w110)
1275
+ const x111: u32 = toU32(w110 >> 32)
1276
+ const w112: u64 = p256FiatAddcarryxU32(x111, x65, x95)
1277
+ const x112: u32 = toU32(w112)
1278
+ const x113: u32 = toU32(w112 >> 32)
1279
+ const w114: u64 = p256FiatAddcarryxU32(x113, x67, x97)
1280
+ const x114: u32 = toU32(w114)
1281
+ const x115: u32 = toU32(w114 >> 32)
1282
+ const w116: u64 = p256FiatAddcarryxU32(x115, x69, x99)
1283
+ const x116: u32 = toU32(w116)
1284
+ const x117: u32 = toU32(w116 >> 32)
1285
+ const w118: u64 = p256FiatAddcarryxU32(x117, x70, x101)
1286
+ const x118: u32 = toU32(w118)
1287
+ const x119: u32 = toU32(w118 >> 32)
1288
+ const w120: u64 = p256FiatMulxU32(x102, 0xffffffff)
1289
+ const x120: u32 = toU32(w120)
1290
+ const x121: u32 = toU32(w120 >> 32)
1291
+ const w122: u64 = p256FiatMulxU32(x102, 0xffffffff)
1292
+ const x122: u32 = toU32(w122)
1293
+ const x123: u32 = toU32(w122 >> 32)
1294
+ const w124: u64 = p256FiatMulxU32(x102, 0xffffffff)
1295
+ const x124: u32 = toU32(w124)
1296
+ const x125: u32 = toU32(w124 >> 32)
1297
+ const w126: u64 = p256FiatMulxU32(x102, 0xffffffff)
1298
+ const x126: u32 = toU32(w126)
1299
+ const x127: u32 = toU32(w126 >> 32)
1300
+ const w128: u64 = p256FiatAddcarryxU32(0x0, x127, x124)
1301
+ const x128: u32 = toU32(w128)
1302
+ const x129: u32 = toU32(w128 >> 32)
1303
+ const w130: u64 = p256FiatAddcarryxU32(x129, x125, x122)
1304
+ const x130: u32 = toU32(w130)
1305
+ const x131: u32 = toU32(w130 >> 32)
1306
+ const x132: u32 = x131 + x123
1307
+ const w133: u64 = p256FiatAddcarryxU32(0x0, x102, x126)
1308
+ const x134: u32 = toU32(w133 >> 32)
1309
+ const w135: u64 = p256FiatAddcarryxU32(x134, x104, x128)
1310
+ const x135: u32 = toU32(w135)
1311
+ const x136: u32 = toU32(w135 >> 32)
1312
+ const w137: u64 = p256FiatAddcarryxU32(x136, x106, x130)
1313
+ const x137: u32 = toU32(w137)
1314
+ const x138: u32 = toU32(w137 >> 32)
1315
+ const w139: u64 = p256FiatAddcarryxU32(x138, x108, x132)
1316
+ const x139: u32 = toU32(w139)
1317
+ const x140: u32 = toU32(w139 >> 32)
1318
+ const w141: u64 = p256FiatAddcarryxU32(x140, x110, 0x0)
1319
+ const x141: u32 = toU32(w141)
1320
+ const x142: u32 = toU32(w141 >> 32)
1321
+ const w143: u64 = p256FiatAddcarryxU32(x142, x112, 0x0)
1322
+ const x143: u32 = toU32(w143)
1323
+ const x144: u32 = toU32(w143 >> 32)
1324
+ const w145: u64 = p256FiatAddcarryxU32(x144, x114, x102)
1325
+ const x145: u32 = toU32(w145)
1326
+ const x146: u32 = toU32(w145 >> 32)
1327
+ const w147: u64 = p256FiatAddcarryxU32(x146, x116, x120)
1328
+ const x147: u32 = toU32(w147)
1329
+ const x148: u32 = toU32(w147 >> 32)
1330
+ const w149: u64 = p256FiatAddcarryxU32(x148, x118, x121)
1331
+ const x149: u32 = toU32(w149)
1332
+ const x150: u32 = toU32(w149 >> 32)
1333
+ const x151: u32 = x150 + x119
1334
+ const w152: u64 = p256FiatMulxU32(x2, arg1Limb7)
1335
+ const x152: u32 = toU32(w152)
1336
+ const x153: u32 = toU32(w152 >> 32)
1337
+ const w154: u64 = p256FiatMulxU32(x2, arg1Limb6)
1338
+ const x154: u32 = toU32(w154)
1339
+ const x155: u32 = toU32(w154 >> 32)
1340
+ const w156: u64 = p256FiatMulxU32(x2, arg1Limb5)
1341
+ const x156: u32 = toU32(w156)
1342
+ const x157: u32 = toU32(w156 >> 32)
1343
+ const w158: u64 = p256FiatMulxU32(x2, arg1Limb4)
1344
+ const x158: u32 = toU32(w158)
1345
+ const x159: u32 = toU32(w158 >> 32)
1346
+ const w160: u64 = p256FiatMulxU32(x2, arg1Limb3)
1347
+ const x160: u32 = toU32(w160)
1348
+ const x161: u32 = toU32(w160 >> 32)
1349
+ const w162: u64 = p256FiatMulxU32(x2, arg1Limb2)
1350
+ const x162: u32 = toU32(w162)
1351
+ const x163: u32 = toU32(w162 >> 32)
1352
+ const w164: u64 = p256FiatMulxU32(x2, arg1Limb1)
1353
+ const x164: u32 = toU32(w164)
1354
+ const x165: u32 = toU32(w164 >> 32)
1355
+ const w166: u64 = p256FiatMulxU32(x2, arg1Limb0)
1356
+ const x166: u32 = toU32(w166)
1357
+ const x167: u32 = toU32(w166 >> 32)
1358
+ const w168: u64 = p256FiatAddcarryxU32(0x0, x167, x164)
1359
+ const x168: u32 = toU32(w168)
1360
+ const x169: u32 = toU32(w168 >> 32)
1361
+ const w170: u64 = p256FiatAddcarryxU32(x169, x165, x162)
1362
+ const x170: u32 = toU32(w170)
1363
+ const x171: u32 = toU32(w170 >> 32)
1364
+ const w172: u64 = p256FiatAddcarryxU32(x171, x163, x160)
1365
+ const x172: u32 = toU32(w172)
1366
+ const x173: u32 = toU32(w172 >> 32)
1367
+ const w174: u64 = p256FiatAddcarryxU32(x173, x161, x158)
1368
+ const x174: u32 = toU32(w174)
1369
+ const x175: u32 = toU32(w174 >> 32)
1370
+ const w176: u64 = p256FiatAddcarryxU32(x175, x159, x156)
1371
+ const x176: u32 = toU32(w176)
1372
+ const x177: u32 = toU32(w176 >> 32)
1373
+ const w178: u64 = p256FiatAddcarryxU32(x177, x157, x154)
1374
+ const x178: u32 = toU32(w178)
1375
+ const x179: u32 = toU32(w178 >> 32)
1376
+ const w180: u64 = p256FiatAddcarryxU32(x179, x155, x152)
1377
+ const x180: u32 = toU32(w180)
1378
+ const x181: u32 = toU32(w180 >> 32)
1379
+ const x182: u32 = x181 + x153
1380
+ const w183: u64 = p256FiatAddcarryxU32(0x0, x135, x166)
1381
+ const x183: u32 = toU32(w183)
1382
+ const x184: u32 = toU32(w183 >> 32)
1383
+ const w185: u64 = p256FiatAddcarryxU32(x184, x137, x168)
1384
+ const x185: u32 = toU32(w185)
1385
+ const x186: u32 = toU32(w185 >> 32)
1386
+ const w187: u64 = p256FiatAddcarryxU32(x186, x139, x170)
1387
+ const x187: u32 = toU32(w187)
1388
+ const x188: u32 = toU32(w187 >> 32)
1389
+ const w189: u64 = p256FiatAddcarryxU32(x188, x141, x172)
1390
+ const x189: u32 = toU32(w189)
1391
+ const x190: u32 = toU32(w189 >> 32)
1392
+ const w191: u64 = p256FiatAddcarryxU32(x190, x143, x174)
1393
+ const x191: u32 = toU32(w191)
1394
+ const x192: u32 = toU32(w191 >> 32)
1395
+ const w193: u64 = p256FiatAddcarryxU32(x192, x145, x176)
1396
+ const x193: u32 = toU32(w193)
1397
+ const x194: u32 = toU32(w193 >> 32)
1398
+ const w195: u64 = p256FiatAddcarryxU32(x194, x147, x178)
1399
+ const x195: u32 = toU32(w195)
1400
+ const x196: u32 = toU32(w195 >> 32)
1401
+ const w197: u64 = p256FiatAddcarryxU32(x196, x149, x180)
1402
+ const x197: u32 = toU32(w197)
1403
+ const x198: u32 = toU32(w197 >> 32)
1404
+ const w199: u64 = p256FiatAddcarryxU32(x198, x151, x182)
1405
+ const x199: u32 = toU32(w199)
1406
+ const x200: u32 = toU32(w199 >> 32)
1407
+ const w201: u64 = p256FiatMulxU32(x183, 0xffffffff)
1408
+ const x201: u32 = toU32(w201)
1409
+ const x202: u32 = toU32(w201 >> 32)
1410
+ const w203: u64 = p256FiatMulxU32(x183, 0xffffffff)
1411
+ const x203: u32 = toU32(w203)
1412
+ const x204: u32 = toU32(w203 >> 32)
1413
+ const w205: u64 = p256FiatMulxU32(x183, 0xffffffff)
1414
+ const x205: u32 = toU32(w205)
1415
+ const x206: u32 = toU32(w205 >> 32)
1416
+ const w207: u64 = p256FiatMulxU32(x183, 0xffffffff)
1417
+ const x207: u32 = toU32(w207)
1418
+ const x208: u32 = toU32(w207 >> 32)
1419
+ const w209: u64 = p256FiatAddcarryxU32(0x0, x208, x205)
1420
+ const x209: u32 = toU32(w209)
1421
+ const x210: u32 = toU32(w209 >> 32)
1422
+ const w211: u64 = p256FiatAddcarryxU32(x210, x206, x203)
1423
+ const x211: u32 = toU32(w211)
1424
+ const x212: u32 = toU32(w211 >> 32)
1425
+ const x213: u32 = x212 + x204
1426
+ const w214: u64 = p256FiatAddcarryxU32(0x0, x183, x207)
1427
+ const x215: u32 = toU32(w214 >> 32)
1428
+ const w216: u64 = p256FiatAddcarryxU32(x215, x185, x209)
1429
+ const x216: u32 = toU32(w216)
1430
+ const x217: u32 = toU32(w216 >> 32)
1431
+ const w218: u64 = p256FiatAddcarryxU32(x217, x187, x211)
1432
+ const x218: u32 = toU32(w218)
1433
+ const x219: u32 = toU32(w218 >> 32)
1434
+ const w220: u64 = p256FiatAddcarryxU32(x219, x189, x213)
1435
+ const x220: u32 = toU32(w220)
1436
+ const x221: u32 = toU32(w220 >> 32)
1437
+ const w222: u64 = p256FiatAddcarryxU32(x221, x191, 0x0)
1438
+ const x222: u32 = toU32(w222)
1439
+ const x223: u32 = toU32(w222 >> 32)
1440
+ const w224: u64 = p256FiatAddcarryxU32(x223, x193, 0x0)
1441
+ const x224: u32 = toU32(w224)
1442
+ const x225: u32 = toU32(w224 >> 32)
1443
+ const w226: u64 = p256FiatAddcarryxU32(x225, x195, x183)
1444
+ const x226: u32 = toU32(w226)
1445
+ const x227: u32 = toU32(w226 >> 32)
1446
+ const w228: u64 = p256FiatAddcarryxU32(x227, x197, x201)
1447
+ const x228: u32 = toU32(w228)
1448
+ const x229: u32 = toU32(w228 >> 32)
1449
+ const w230: u64 = p256FiatAddcarryxU32(x229, x199, x202)
1450
+ const x230: u32 = toU32(w230)
1451
+ const x231: u32 = toU32(w230 >> 32)
1452
+ const x232: u32 = x231 + x200
1453
+ const w233: u64 = p256FiatMulxU32(x3, arg1Limb7)
1454
+ const x233: u32 = toU32(w233)
1455
+ const x234: u32 = toU32(w233 >> 32)
1456
+ const w235: u64 = p256FiatMulxU32(x3, arg1Limb6)
1457
+ const x235: u32 = toU32(w235)
1458
+ const x236: u32 = toU32(w235 >> 32)
1459
+ const w237: u64 = p256FiatMulxU32(x3, arg1Limb5)
1460
+ const x237: u32 = toU32(w237)
1461
+ const x238: u32 = toU32(w237 >> 32)
1462
+ const w239: u64 = p256FiatMulxU32(x3, arg1Limb4)
1463
+ const x239: u32 = toU32(w239)
1464
+ const x240: u32 = toU32(w239 >> 32)
1465
+ const w241: u64 = p256FiatMulxU32(x3, arg1Limb3)
1466
+ const x241: u32 = toU32(w241)
1467
+ const x242: u32 = toU32(w241 >> 32)
1468
+ const w243: u64 = p256FiatMulxU32(x3, arg1Limb2)
1469
+ const x243: u32 = toU32(w243)
1470
+ const x244: u32 = toU32(w243 >> 32)
1471
+ const w245: u64 = p256FiatMulxU32(x3, arg1Limb1)
1472
+ const x245: u32 = toU32(w245)
1473
+ const x246: u32 = toU32(w245 >> 32)
1474
+ const w247: u64 = p256FiatMulxU32(x3, arg1Limb0)
1475
+ const x247: u32 = toU32(w247)
1476
+ const x248: u32 = toU32(w247 >> 32)
1477
+ const w249: u64 = p256FiatAddcarryxU32(0x0, x248, x245)
1478
+ const x249: u32 = toU32(w249)
1479
+ const x250: u32 = toU32(w249 >> 32)
1480
+ const w251: u64 = p256FiatAddcarryxU32(x250, x246, x243)
1481
+ const x251: u32 = toU32(w251)
1482
+ const x252: u32 = toU32(w251 >> 32)
1483
+ const w253: u64 = p256FiatAddcarryxU32(x252, x244, x241)
1484
+ const x253: u32 = toU32(w253)
1485
+ const x254: u32 = toU32(w253 >> 32)
1486
+ const w255: u64 = p256FiatAddcarryxU32(x254, x242, x239)
1487
+ const x255: u32 = toU32(w255)
1488
+ const x256: u32 = toU32(w255 >> 32)
1489
+ const w257: u64 = p256FiatAddcarryxU32(x256, x240, x237)
1490
+ const x257: u32 = toU32(w257)
1491
+ const x258: u32 = toU32(w257 >> 32)
1492
+ const w259: u64 = p256FiatAddcarryxU32(x258, x238, x235)
1493
+ const x259: u32 = toU32(w259)
1494
+ const x260: u32 = toU32(w259 >> 32)
1495
+ const w261: u64 = p256FiatAddcarryxU32(x260, x236, x233)
1496
+ const x261: u32 = toU32(w261)
1497
+ const x262: u32 = toU32(w261 >> 32)
1498
+ const x263: u32 = x262 + x234
1499
+ const w264: u64 = p256FiatAddcarryxU32(0x0, x216, x247)
1500
+ const x264: u32 = toU32(w264)
1501
+ const x265: u32 = toU32(w264 >> 32)
1502
+ const w266: u64 = p256FiatAddcarryxU32(x265, x218, x249)
1503
+ const x266: u32 = toU32(w266)
1504
+ const x267: u32 = toU32(w266 >> 32)
1505
+ const w268: u64 = p256FiatAddcarryxU32(x267, x220, x251)
1506
+ const x268: u32 = toU32(w268)
1507
+ const x269: u32 = toU32(w268 >> 32)
1508
+ const w270: u64 = p256FiatAddcarryxU32(x269, x222, x253)
1509
+ const x270: u32 = toU32(w270)
1510
+ const x271: u32 = toU32(w270 >> 32)
1511
+ const w272: u64 = p256FiatAddcarryxU32(x271, x224, x255)
1512
+ const x272: u32 = toU32(w272)
1513
+ const x273: u32 = toU32(w272 >> 32)
1514
+ const w274: u64 = p256FiatAddcarryxU32(x273, x226, x257)
1515
+ const x274: u32 = toU32(w274)
1516
+ const x275: u32 = toU32(w274 >> 32)
1517
+ const w276: u64 = p256FiatAddcarryxU32(x275, x228, x259)
1518
+ const x276: u32 = toU32(w276)
1519
+ const x277: u32 = toU32(w276 >> 32)
1520
+ const w278: u64 = p256FiatAddcarryxU32(x277, x230, x261)
1521
+ const x278: u32 = toU32(w278)
1522
+ const x279: u32 = toU32(w278 >> 32)
1523
+ const w280: u64 = p256FiatAddcarryxU32(x279, x232, x263)
1524
+ const x280: u32 = toU32(w280)
1525
+ const x281: u32 = toU32(w280 >> 32)
1526
+ const w282: u64 = p256FiatMulxU32(x264, 0xffffffff)
1527
+ const x282: u32 = toU32(w282)
1528
+ const x283: u32 = toU32(w282 >> 32)
1529
+ const w284: u64 = p256FiatMulxU32(x264, 0xffffffff)
1530
+ const x284: u32 = toU32(w284)
1531
+ const x285: u32 = toU32(w284 >> 32)
1532
+ const w286: u64 = p256FiatMulxU32(x264, 0xffffffff)
1533
+ const x286: u32 = toU32(w286)
1534
+ const x287: u32 = toU32(w286 >> 32)
1535
+ const w288: u64 = p256FiatMulxU32(x264, 0xffffffff)
1536
+ const x288: u32 = toU32(w288)
1537
+ const x289: u32 = toU32(w288 >> 32)
1538
+ const w290: u64 = p256FiatAddcarryxU32(0x0, x289, x286)
1539
+ const x290: u32 = toU32(w290)
1540
+ const x291: u32 = toU32(w290 >> 32)
1541
+ const w292: u64 = p256FiatAddcarryxU32(x291, x287, x284)
1542
+ const x292: u32 = toU32(w292)
1543
+ const x293: u32 = toU32(w292 >> 32)
1544
+ const x294: u32 = x293 + x285
1545
+ const w295: u64 = p256FiatAddcarryxU32(0x0, x264, x288)
1546
+ const x296: u32 = toU32(w295 >> 32)
1547
+ const w297: u64 = p256FiatAddcarryxU32(x296, x266, x290)
1548
+ const x297: u32 = toU32(w297)
1549
+ const x298: u32 = toU32(w297 >> 32)
1550
+ const w299: u64 = p256FiatAddcarryxU32(x298, x268, x292)
1551
+ const x299: u32 = toU32(w299)
1552
+ const x300: u32 = toU32(w299 >> 32)
1553
+ const w301: u64 = p256FiatAddcarryxU32(x300, x270, x294)
1554
+ const x301: u32 = toU32(w301)
1555
+ const x302: u32 = toU32(w301 >> 32)
1556
+ const w303: u64 = p256FiatAddcarryxU32(x302, x272, 0x0)
1557
+ const x303: u32 = toU32(w303)
1558
+ const x304: u32 = toU32(w303 >> 32)
1559
+ const w305: u64 = p256FiatAddcarryxU32(x304, x274, 0x0)
1560
+ const x305: u32 = toU32(w305)
1561
+ const x306: u32 = toU32(w305 >> 32)
1562
+ const w307: u64 = p256FiatAddcarryxU32(x306, x276, x264)
1563
+ const x307: u32 = toU32(w307)
1564
+ const x308: u32 = toU32(w307 >> 32)
1565
+ const w309: u64 = p256FiatAddcarryxU32(x308, x278, x282)
1566
+ const x309: u32 = toU32(w309)
1567
+ const x310: u32 = toU32(w309 >> 32)
1568
+ const w311: u64 = p256FiatAddcarryxU32(x310, x280, x283)
1569
+ const x311: u32 = toU32(w311)
1570
+ const x312: u32 = toU32(w311 >> 32)
1571
+ const x313: u32 = x312 + x281
1572
+ const w314: u64 = p256FiatMulxU32(x4, arg1Limb7)
1573
+ const x314: u32 = toU32(w314)
1574
+ const x315: u32 = toU32(w314 >> 32)
1575
+ const w316: u64 = p256FiatMulxU32(x4, arg1Limb6)
1576
+ const x316: u32 = toU32(w316)
1577
+ const x317: u32 = toU32(w316 >> 32)
1578
+ const w318: u64 = p256FiatMulxU32(x4, arg1Limb5)
1579
+ const x318: u32 = toU32(w318)
1580
+ const x319: u32 = toU32(w318 >> 32)
1581
+ const w320: u64 = p256FiatMulxU32(x4, arg1Limb4)
1582
+ const x320: u32 = toU32(w320)
1583
+ const x321: u32 = toU32(w320 >> 32)
1584
+ const w322: u64 = p256FiatMulxU32(x4, arg1Limb3)
1585
+ const x322: u32 = toU32(w322)
1586
+ const x323: u32 = toU32(w322 >> 32)
1587
+ const w324: u64 = p256FiatMulxU32(x4, arg1Limb2)
1588
+ const x324: u32 = toU32(w324)
1589
+ const x325: u32 = toU32(w324 >> 32)
1590
+ const w326: u64 = p256FiatMulxU32(x4, arg1Limb1)
1591
+ const x326: u32 = toU32(w326)
1592
+ const x327: u32 = toU32(w326 >> 32)
1593
+ const w328: u64 = p256FiatMulxU32(x4, arg1Limb0)
1594
+ const x328: u32 = toU32(w328)
1595
+ const x329: u32 = toU32(w328 >> 32)
1596
+ const w330: u64 = p256FiatAddcarryxU32(0x0, x329, x326)
1597
+ const x330: u32 = toU32(w330)
1598
+ const x331: u32 = toU32(w330 >> 32)
1599
+ const w332: u64 = p256FiatAddcarryxU32(x331, x327, x324)
1600
+ const x332: u32 = toU32(w332)
1601
+ const x333: u32 = toU32(w332 >> 32)
1602
+ const w334: u64 = p256FiatAddcarryxU32(x333, x325, x322)
1603
+ const x334: u32 = toU32(w334)
1604
+ const x335: u32 = toU32(w334 >> 32)
1605
+ const w336: u64 = p256FiatAddcarryxU32(x335, x323, x320)
1606
+ const x336: u32 = toU32(w336)
1607
+ const x337: u32 = toU32(w336 >> 32)
1608
+ const w338: u64 = p256FiatAddcarryxU32(x337, x321, x318)
1609
+ const x338: u32 = toU32(w338)
1610
+ const x339: u32 = toU32(w338 >> 32)
1611
+ const w340: u64 = p256FiatAddcarryxU32(x339, x319, x316)
1612
+ const x340: u32 = toU32(w340)
1613
+ const x341: u32 = toU32(w340 >> 32)
1614
+ const w342: u64 = p256FiatAddcarryxU32(x341, x317, x314)
1615
+ const x342: u32 = toU32(w342)
1616
+ const x343: u32 = toU32(w342 >> 32)
1617
+ const x344: u32 = x343 + x315
1618
+ const w345: u64 = p256FiatAddcarryxU32(0x0, x297, x328)
1619
+ const x345: u32 = toU32(w345)
1620
+ const x346: u32 = toU32(w345 >> 32)
1621
+ const w347: u64 = p256FiatAddcarryxU32(x346, x299, x330)
1622
+ const x347: u32 = toU32(w347)
1623
+ const x348: u32 = toU32(w347 >> 32)
1624
+ const w349: u64 = p256FiatAddcarryxU32(x348, x301, x332)
1625
+ const x349: u32 = toU32(w349)
1626
+ const x350: u32 = toU32(w349 >> 32)
1627
+ const w351: u64 = p256FiatAddcarryxU32(x350, x303, x334)
1628
+ const x351: u32 = toU32(w351)
1629
+ const x352: u32 = toU32(w351 >> 32)
1630
+ const w353: u64 = p256FiatAddcarryxU32(x352, x305, x336)
1631
+ const x353: u32 = toU32(w353)
1632
+ const x354: u32 = toU32(w353 >> 32)
1633
+ const w355: u64 = p256FiatAddcarryxU32(x354, x307, x338)
1634
+ const x355: u32 = toU32(w355)
1635
+ const x356: u32 = toU32(w355 >> 32)
1636
+ const w357: u64 = p256FiatAddcarryxU32(x356, x309, x340)
1637
+ const x357: u32 = toU32(w357)
1638
+ const x358: u32 = toU32(w357 >> 32)
1639
+ const w359: u64 = p256FiatAddcarryxU32(x358, x311, x342)
1640
+ const x359: u32 = toU32(w359)
1641
+ const x360: u32 = toU32(w359 >> 32)
1642
+ const w361: u64 = p256FiatAddcarryxU32(x360, x313, x344)
1643
+ const x361: u32 = toU32(w361)
1644
+ const x362: u32 = toU32(w361 >> 32)
1645
+ const w363: u64 = p256FiatMulxU32(x345, 0xffffffff)
1646
+ const x363: u32 = toU32(w363)
1647
+ const x364: u32 = toU32(w363 >> 32)
1648
+ const w365: u64 = p256FiatMulxU32(x345, 0xffffffff)
1649
+ const x365: u32 = toU32(w365)
1650
+ const x366: u32 = toU32(w365 >> 32)
1651
+ const w367: u64 = p256FiatMulxU32(x345, 0xffffffff)
1652
+ const x367: u32 = toU32(w367)
1653
+ const x368: u32 = toU32(w367 >> 32)
1654
+ const w369: u64 = p256FiatMulxU32(x345, 0xffffffff)
1655
+ const x369: u32 = toU32(w369)
1656
+ const x370: u32 = toU32(w369 >> 32)
1657
+ const w371: u64 = p256FiatAddcarryxU32(0x0, x370, x367)
1658
+ const x371: u32 = toU32(w371)
1659
+ const x372: u32 = toU32(w371 >> 32)
1660
+ const w373: u64 = p256FiatAddcarryxU32(x372, x368, x365)
1661
+ const x373: u32 = toU32(w373)
1662
+ const x374: u32 = toU32(w373 >> 32)
1663
+ const x375: u32 = x374 + x366
1664
+ const w376: u64 = p256FiatAddcarryxU32(0x0, x345, x369)
1665
+ const x377: u32 = toU32(w376 >> 32)
1666
+ const w378: u64 = p256FiatAddcarryxU32(x377, x347, x371)
1667
+ const x378: u32 = toU32(w378)
1668
+ const x379: u32 = toU32(w378 >> 32)
1669
+ const w380: u64 = p256FiatAddcarryxU32(x379, x349, x373)
1670
+ const x380: u32 = toU32(w380)
1671
+ const x381: u32 = toU32(w380 >> 32)
1672
+ const w382: u64 = p256FiatAddcarryxU32(x381, x351, x375)
1673
+ const x382: u32 = toU32(w382)
1674
+ const x383: u32 = toU32(w382 >> 32)
1675
+ const w384: u64 = p256FiatAddcarryxU32(x383, x353, 0x0)
1676
+ const x384: u32 = toU32(w384)
1677
+ const x385: u32 = toU32(w384 >> 32)
1678
+ const w386: u64 = p256FiatAddcarryxU32(x385, x355, 0x0)
1679
+ const x386: u32 = toU32(w386)
1680
+ const x387: u32 = toU32(w386 >> 32)
1681
+ const w388: u64 = p256FiatAddcarryxU32(x387, x357, x345)
1682
+ const x388: u32 = toU32(w388)
1683
+ const x389: u32 = toU32(w388 >> 32)
1684
+ const w390: u64 = p256FiatAddcarryxU32(x389, x359, x363)
1685
+ const x390: u32 = toU32(w390)
1686
+ const x391: u32 = toU32(w390 >> 32)
1687
+ const w392: u64 = p256FiatAddcarryxU32(x391, x361, x364)
1688
+ const x392: u32 = toU32(w392)
1689
+ const x393: u32 = toU32(w392 >> 32)
1690
+ const x394: u32 = x393 + x362
1691
+ const w395: u64 = p256FiatMulxU32(x5, arg1Limb7)
1692
+ const x395: u32 = toU32(w395)
1693
+ const x396: u32 = toU32(w395 >> 32)
1694
+ const w397: u64 = p256FiatMulxU32(x5, arg1Limb6)
1695
+ const x397: u32 = toU32(w397)
1696
+ const x398: u32 = toU32(w397 >> 32)
1697
+ const w399: u64 = p256FiatMulxU32(x5, arg1Limb5)
1698
+ const x399: u32 = toU32(w399)
1699
+ const x400: u32 = toU32(w399 >> 32)
1700
+ const w401: u64 = p256FiatMulxU32(x5, arg1Limb4)
1701
+ const x401: u32 = toU32(w401)
1702
+ const x402: u32 = toU32(w401 >> 32)
1703
+ const w403: u64 = p256FiatMulxU32(x5, arg1Limb3)
1704
+ const x403: u32 = toU32(w403)
1705
+ const x404: u32 = toU32(w403 >> 32)
1706
+ const w405: u64 = p256FiatMulxU32(x5, arg1Limb2)
1707
+ const x405: u32 = toU32(w405)
1708
+ const x406: u32 = toU32(w405 >> 32)
1709
+ const w407: u64 = p256FiatMulxU32(x5, arg1Limb1)
1710
+ const x407: u32 = toU32(w407)
1711
+ const x408: u32 = toU32(w407 >> 32)
1712
+ const w409: u64 = p256FiatMulxU32(x5, arg1Limb0)
1713
+ const x409: u32 = toU32(w409)
1714
+ const x410: u32 = toU32(w409 >> 32)
1715
+ const w411: u64 = p256FiatAddcarryxU32(0x0, x410, x407)
1716
+ const x411: u32 = toU32(w411)
1717
+ const x412: u32 = toU32(w411 >> 32)
1718
+ const w413: u64 = p256FiatAddcarryxU32(x412, x408, x405)
1719
+ const x413: u32 = toU32(w413)
1720
+ const x414: u32 = toU32(w413 >> 32)
1721
+ const w415: u64 = p256FiatAddcarryxU32(x414, x406, x403)
1722
+ const x415: u32 = toU32(w415)
1723
+ const x416: u32 = toU32(w415 >> 32)
1724
+ const w417: u64 = p256FiatAddcarryxU32(x416, x404, x401)
1725
+ const x417: u32 = toU32(w417)
1726
+ const x418: u32 = toU32(w417 >> 32)
1727
+ const w419: u64 = p256FiatAddcarryxU32(x418, x402, x399)
1728
+ const x419: u32 = toU32(w419)
1729
+ const x420: u32 = toU32(w419 >> 32)
1730
+ const w421: u64 = p256FiatAddcarryxU32(x420, x400, x397)
1731
+ const x421: u32 = toU32(w421)
1732
+ const x422: u32 = toU32(w421 >> 32)
1733
+ const w423: u64 = p256FiatAddcarryxU32(x422, x398, x395)
1734
+ const x423: u32 = toU32(w423)
1735
+ const x424: u32 = toU32(w423 >> 32)
1736
+ const x425: u32 = x424 + x396
1737
+ const w426: u64 = p256FiatAddcarryxU32(0x0, x378, x409)
1738
+ const x426: u32 = toU32(w426)
1739
+ const x427: u32 = toU32(w426 >> 32)
1740
+ const w428: u64 = p256FiatAddcarryxU32(x427, x380, x411)
1741
+ const x428: u32 = toU32(w428)
1742
+ const x429: u32 = toU32(w428 >> 32)
1743
+ const w430: u64 = p256FiatAddcarryxU32(x429, x382, x413)
1744
+ const x430: u32 = toU32(w430)
1745
+ const x431: u32 = toU32(w430 >> 32)
1746
+ const w432: u64 = p256FiatAddcarryxU32(x431, x384, x415)
1747
+ const x432: u32 = toU32(w432)
1748
+ const x433: u32 = toU32(w432 >> 32)
1749
+ const w434: u64 = p256FiatAddcarryxU32(x433, x386, x417)
1750
+ const x434: u32 = toU32(w434)
1751
+ const x435: u32 = toU32(w434 >> 32)
1752
+ const w436: u64 = p256FiatAddcarryxU32(x435, x388, x419)
1753
+ const x436: u32 = toU32(w436)
1754
+ const x437: u32 = toU32(w436 >> 32)
1755
+ const w438: u64 = p256FiatAddcarryxU32(x437, x390, x421)
1756
+ const x438: u32 = toU32(w438)
1757
+ const x439: u32 = toU32(w438 >> 32)
1758
+ const w440: u64 = p256FiatAddcarryxU32(x439, x392, x423)
1759
+ const x440: u32 = toU32(w440)
1760
+ const x441: u32 = toU32(w440 >> 32)
1761
+ const w442: u64 = p256FiatAddcarryxU32(x441, x394, x425)
1762
+ const x442: u32 = toU32(w442)
1763
+ const x443: u32 = toU32(w442 >> 32)
1764
+ const w444: u64 = p256FiatMulxU32(x426, 0xffffffff)
1765
+ const x444: u32 = toU32(w444)
1766
+ const x445: u32 = toU32(w444 >> 32)
1767
+ const w446: u64 = p256FiatMulxU32(x426, 0xffffffff)
1768
+ const x446: u32 = toU32(w446)
1769
+ const x447: u32 = toU32(w446 >> 32)
1770
+ const w448: u64 = p256FiatMulxU32(x426, 0xffffffff)
1771
+ const x448: u32 = toU32(w448)
1772
+ const x449: u32 = toU32(w448 >> 32)
1773
+ const w450: u64 = p256FiatMulxU32(x426, 0xffffffff)
1774
+ const x450: u32 = toU32(w450)
1775
+ const x451: u32 = toU32(w450 >> 32)
1776
+ const w452: u64 = p256FiatAddcarryxU32(0x0, x451, x448)
1777
+ const x452: u32 = toU32(w452)
1778
+ const x453: u32 = toU32(w452 >> 32)
1779
+ const w454: u64 = p256FiatAddcarryxU32(x453, x449, x446)
1780
+ const x454: u32 = toU32(w454)
1781
+ const x455: u32 = toU32(w454 >> 32)
1782
+ const x456: u32 = x455 + x447
1783
+ const w457: u64 = p256FiatAddcarryxU32(0x0, x426, x450)
1784
+ const x458: u32 = toU32(w457 >> 32)
1785
+ const w459: u64 = p256FiatAddcarryxU32(x458, x428, x452)
1786
+ const x459: u32 = toU32(w459)
1787
+ const x460: u32 = toU32(w459 >> 32)
1788
+ const w461: u64 = p256FiatAddcarryxU32(x460, x430, x454)
1789
+ const x461: u32 = toU32(w461)
1790
+ const x462: u32 = toU32(w461 >> 32)
1791
+ const w463: u64 = p256FiatAddcarryxU32(x462, x432, x456)
1792
+ const x463: u32 = toU32(w463)
1793
+ const x464: u32 = toU32(w463 >> 32)
1794
+ const w465: u64 = p256FiatAddcarryxU32(x464, x434, 0x0)
1795
+ const x465: u32 = toU32(w465)
1796
+ const x466: u32 = toU32(w465 >> 32)
1797
+ const w467: u64 = p256FiatAddcarryxU32(x466, x436, 0x0)
1798
+ const x467: u32 = toU32(w467)
1799
+ const x468: u32 = toU32(w467 >> 32)
1800
+ const w469: u64 = p256FiatAddcarryxU32(x468, x438, x426)
1801
+ const x469: u32 = toU32(w469)
1802
+ const x470: u32 = toU32(w469 >> 32)
1803
+ const w471: u64 = p256FiatAddcarryxU32(x470, x440, x444)
1804
+ const x471: u32 = toU32(w471)
1805
+ const x472: u32 = toU32(w471 >> 32)
1806
+ const w473: u64 = p256FiatAddcarryxU32(x472, x442, x445)
1807
+ const x473: u32 = toU32(w473)
1808
+ const x474: u32 = toU32(w473 >> 32)
1809
+ const x475: u32 = x474 + x443
1810
+ const w476: u64 = p256FiatMulxU32(x6, arg1Limb7)
1811
+ const x476: u32 = toU32(w476)
1812
+ const x477: u32 = toU32(w476 >> 32)
1813
+ const w478: u64 = p256FiatMulxU32(x6, arg1Limb6)
1814
+ const x478: u32 = toU32(w478)
1815
+ const x479: u32 = toU32(w478 >> 32)
1816
+ const w480: u64 = p256FiatMulxU32(x6, arg1Limb5)
1817
+ const x480: u32 = toU32(w480)
1818
+ const x481: u32 = toU32(w480 >> 32)
1819
+ const w482: u64 = p256FiatMulxU32(x6, arg1Limb4)
1820
+ const x482: u32 = toU32(w482)
1821
+ const x483: u32 = toU32(w482 >> 32)
1822
+ const w484: u64 = p256FiatMulxU32(x6, arg1Limb3)
1823
+ const x484: u32 = toU32(w484)
1824
+ const x485: u32 = toU32(w484 >> 32)
1825
+ const w486: u64 = p256FiatMulxU32(x6, arg1Limb2)
1826
+ const x486: u32 = toU32(w486)
1827
+ const x487: u32 = toU32(w486 >> 32)
1828
+ const w488: u64 = p256FiatMulxU32(x6, arg1Limb1)
1829
+ const x488: u32 = toU32(w488)
1830
+ const x489: u32 = toU32(w488 >> 32)
1831
+ const w490: u64 = p256FiatMulxU32(x6, arg1Limb0)
1832
+ const x490: u32 = toU32(w490)
1833
+ const x491: u32 = toU32(w490 >> 32)
1834
+ const w492: u64 = p256FiatAddcarryxU32(0x0, x491, x488)
1835
+ const x492: u32 = toU32(w492)
1836
+ const x493: u32 = toU32(w492 >> 32)
1837
+ const w494: u64 = p256FiatAddcarryxU32(x493, x489, x486)
1838
+ const x494: u32 = toU32(w494)
1839
+ const x495: u32 = toU32(w494 >> 32)
1840
+ const w496: u64 = p256FiatAddcarryxU32(x495, x487, x484)
1841
+ const x496: u32 = toU32(w496)
1842
+ const x497: u32 = toU32(w496 >> 32)
1843
+ const w498: u64 = p256FiatAddcarryxU32(x497, x485, x482)
1844
+ const x498: u32 = toU32(w498)
1845
+ const x499: u32 = toU32(w498 >> 32)
1846
+ const w500: u64 = p256FiatAddcarryxU32(x499, x483, x480)
1847
+ const x500: u32 = toU32(w500)
1848
+ const x501: u32 = toU32(w500 >> 32)
1849
+ const w502: u64 = p256FiatAddcarryxU32(x501, x481, x478)
1850
+ const x502: u32 = toU32(w502)
1851
+ const x503: u32 = toU32(w502 >> 32)
1852
+ const w504: u64 = p256FiatAddcarryxU32(x503, x479, x476)
1853
+ const x504: u32 = toU32(w504)
1854
+ const x505: u32 = toU32(w504 >> 32)
1855
+ const x506: u32 = x505 + x477
1856
+ const w507: u64 = p256FiatAddcarryxU32(0x0, x459, x490)
1857
+ const x507: u32 = toU32(w507)
1858
+ const x508: u32 = toU32(w507 >> 32)
1859
+ const w509: u64 = p256FiatAddcarryxU32(x508, x461, x492)
1860
+ const x509: u32 = toU32(w509)
1861
+ const x510: u32 = toU32(w509 >> 32)
1862
+ const w511: u64 = p256FiatAddcarryxU32(x510, x463, x494)
1863
+ const x511: u32 = toU32(w511)
1864
+ const x512: u32 = toU32(w511 >> 32)
1865
+ const w513: u64 = p256FiatAddcarryxU32(x512, x465, x496)
1866
+ const x513: u32 = toU32(w513)
1867
+ const x514: u32 = toU32(w513 >> 32)
1868
+ const w515: u64 = p256FiatAddcarryxU32(x514, x467, x498)
1869
+ const x515: u32 = toU32(w515)
1870
+ const x516: u32 = toU32(w515 >> 32)
1871
+ const w517: u64 = p256FiatAddcarryxU32(x516, x469, x500)
1872
+ const x517: u32 = toU32(w517)
1873
+ const x518: u32 = toU32(w517 >> 32)
1874
+ const w519: u64 = p256FiatAddcarryxU32(x518, x471, x502)
1875
+ const x519: u32 = toU32(w519)
1876
+ const x520: u32 = toU32(w519 >> 32)
1877
+ const w521: u64 = p256FiatAddcarryxU32(x520, x473, x504)
1878
+ const x521: u32 = toU32(w521)
1879
+ const x522: u32 = toU32(w521 >> 32)
1880
+ const w523: u64 = p256FiatAddcarryxU32(x522, x475, x506)
1881
+ const x523: u32 = toU32(w523)
1882
+ const x524: u32 = toU32(w523 >> 32)
1883
+ const w525: u64 = p256FiatMulxU32(x507, 0xffffffff)
1884
+ const x525: u32 = toU32(w525)
1885
+ const x526: u32 = toU32(w525 >> 32)
1886
+ const w527: u64 = p256FiatMulxU32(x507, 0xffffffff)
1887
+ const x527: u32 = toU32(w527)
1888
+ const x528: u32 = toU32(w527 >> 32)
1889
+ const w529: u64 = p256FiatMulxU32(x507, 0xffffffff)
1890
+ const x529: u32 = toU32(w529)
1891
+ const x530: u32 = toU32(w529 >> 32)
1892
+ const w531: u64 = p256FiatMulxU32(x507, 0xffffffff)
1893
+ const x531: u32 = toU32(w531)
1894
+ const x532: u32 = toU32(w531 >> 32)
1895
+ const w533: u64 = p256FiatAddcarryxU32(0x0, x532, x529)
1896
+ const x533: u32 = toU32(w533)
1897
+ const x534: u32 = toU32(w533 >> 32)
1898
+ const w535: u64 = p256FiatAddcarryxU32(x534, x530, x527)
1899
+ const x535: u32 = toU32(w535)
1900
+ const x536: u32 = toU32(w535 >> 32)
1901
+ const x537: u32 = x536 + x528
1902
+ const w538: u64 = p256FiatAddcarryxU32(0x0, x507, x531)
1903
+ const x539: u32 = toU32(w538 >> 32)
1904
+ const w540: u64 = p256FiatAddcarryxU32(x539, x509, x533)
1905
+ const x540: u32 = toU32(w540)
1906
+ const x541: u32 = toU32(w540 >> 32)
1907
+ const w542: u64 = p256FiatAddcarryxU32(x541, x511, x535)
1908
+ const x542: u32 = toU32(w542)
1909
+ const x543: u32 = toU32(w542 >> 32)
1910
+ const w544: u64 = p256FiatAddcarryxU32(x543, x513, x537)
1911
+ const x544: u32 = toU32(w544)
1912
+ const x545: u32 = toU32(w544 >> 32)
1913
+ const w546: u64 = p256FiatAddcarryxU32(x545, x515, 0x0)
1914
+ const x546: u32 = toU32(w546)
1915
+ const x547: u32 = toU32(w546 >> 32)
1916
+ const w548: u64 = p256FiatAddcarryxU32(x547, x517, 0x0)
1917
+ const x548: u32 = toU32(w548)
1918
+ const x549: u32 = toU32(w548 >> 32)
1919
+ const w550: u64 = p256FiatAddcarryxU32(x549, x519, x507)
1920
+ const x550: u32 = toU32(w550)
1921
+ const x551: u32 = toU32(w550 >> 32)
1922
+ const w552: u64 = p256FiatAddcarryxU32(x551, x521, x525)
1923
+ const x552: u32 = toU32(w552)
1924
+ const x553: u32 = toU32(w552 >> 32)
1925
+ const w554: u64 = p256FiatAddcarryxU32(x553, x523, x526)
1926
+ const x554: u32 = toU32(w554)
1927
+ const x555: u32 = toU32(w554 >> 32)
1928
+ const x556: u32 = x555 + x524
1929
+ const w557: u64 = p256FiatMulxU32(x7, arg1Limb7)
1930
+ const x557: u32 = toU32(w557)
1931
+ const x558: u32 = toU32(w557 >> 32)
1932
+ const w559: u64 = p256FiatMulxU32(x7, arg1Limb6)
1933
+ const x559: u32 = toU32(w559)
1934
+ const x560: u32 = toU32(w559 >> 32)
1935
+ const w561: u64 = p256FiatMulxU32(x7, arg1Limb5)
1936
+ const x561: u32 = toU32(w561)
1937
+ const x562: u32 = toU32(w561 >> 32)
1938
+ const w563: u64 = p256FiatMulxU32(x7, arg1Limb4)
1939
+ const x563: u32 = toU32(w563)
1940
+ const x564: u32 = toU32(w563 >> 32)
1941
+ const w565: u64 = p256FiatMulxU32(x7, arg1Limb3)
1942
+ const x565: u32 = toU32(w565)
1943
+ const x566: u32 = toU32(w565 >> 32)
1944
+ const w567: u64 = p256FiatMulxU32(x7, arg1Limb2)
1945
+ const x567: u32 = toU32(w567)
1946
+ const x568: u32 = toU32(w567 >> 32)
1947
+ const w569: u64 = p256FiatMulxU32(x7, arg1Limb1)
1948
+ const x569: u32 = toU32(w569)
1949
+ const x570: u32 = toU32(w569 >> 32)
1950
+ const w571: u64 = p256FiatMulxU32(x7, arg1Limb0)
1951
+ const x571: u32 = toU32(w571)
1952
+ const x572: u32 = toU32(w571 >> 32)
1953
+ const w573: u64 = p256FiatAddcarryxU32(0x0, x572, x569)
1954
+ const x573: u32 = toU32(w573)
1955
+ const x574: u32 = toU32(w573 >> 32)
1956
+ const w575: u64 = p256FiatAddcarryxU32(x574, x570, x567)
1957
+ const x575: u32 = toU32(w575)
1958
+ const x576: u32 = toU32(w575 >> 32)
1959
+ const w577: u64 = p256FiatAddcarryxU32(x576, x568, x565)
1960
+ const x577: u32 = toU32(w577)
1961
+ const x578: u32 = toU32(w577 >> 32)
1962
+ const w579: u64 = p256FiatAddcarryxU32(x578, x566, x563)
1963
+ const x579: u32 = toU32(w579)
1964
+ const x580: u32 = toU32(w579 >> 32)
1965
+ const w581: u64 = p256FiatAddcarryxU32(x580, x564, x561)
1966
+ const x581: u32 = toU32(w581)
1967
+ const x582: u32 = toU32(w581 >> 32)
1968
+ const w583: u64 = p256FiatAddcarryxU32(x582, x562, x559)
1969
+ const x583: u32 = toU32(w583)
1970
+ const x584: u32 = toU32(w583 >> 32)
1971
+ const w585: u64 = p256FiatAddcarryxU32(x584, x560, x557)
1972
+ const x585: u32 = toU32(w585)
1973
+ const x586: u32 = toU32(w585 >> 32)
1974
+ const x587: u32 = x586 + x558
1975
+ const w588: u64 = p256FiatAddcarryxU32(0x0, x540, x571)
1976
+ const x588: u32 = toU32(w588)
1977
+ const x589: u32 = toU32(w588 >> 32)
1978
+ const w590: u64 = p256FiatAddcarryxU32(x589, x542, x573)
1979
+ const x590: u32 = toU32(w590)
1980
+ const x591: u32 = toU32(w590 >> 32)
1981
+ const w592: u64 = p256FiatAddcarryxU32(x591, x544, x575)
1982
+ const x592: u32 = toU32(w592)
1983
+ const x593: u32 = toU32(w592 >> 32)
1984
+ const w594: u64 = p256FiatAddcarryxU32(x593, x546, x577)
1985
+ const x594: u32 = toU32(w594)
1986
+ const x595: u32 = toU32(w594 >> 32)
1987
+ const w596: u64 = p256FiatAddcarryxU32(x595, x548, x579)
1988
+ const x596: u32 = toU32(w596)
1989
+ const x597: u32 = toU32(w596 >> 32)
1990
+ const w598: u64 = p256FiatAddcarryxU32(x597, x550, x581)
1991
+ const x598: u32 = toU32(w598)
1992
+ const x599: u32 = toU32(w598 >> 32)
1993
+ const w600: u64 = p256FiatAddcarryxU32(x599, x552, x583)
1994
+ const x600: u32 = toU32(w600)
1995
+ const x601: u32 = toU32(w600 >> 32)
1996
+ const w602: u64 = p256FiatAddcarryxU32(x601, x554, x585)
1997
+ const x602: u32 = toU32(w602)
1998
+ const x603: u32 = toU32(w602 >> 32)
1999
+ const w604: u64 = p256FiatAddcarryxU32(x603, x556, x587)
2000
+ const x604: u32 = toU32(w604)
2001
+ const x605: u32 = toU32(w604 >> 32)
2002
+ const w606: u64 = p256FiatMulxU32(x588, 0xffffffff)
2003
+ const x606: u32 = toU32(w606)
2004
+ const x607: u32 = toU32(w606 >> 32)
2005
+ const w608: u64 = p256FiatMulxU32(x588, 0xffffffff)
2006
+ const x608: u32 = toU32(w608)
2007
+ const x609: u32 = toU32(w608 >> 32)
2008
+ const w610: u64 = p256FiatMulxU32(x588, 0xffffffff)
2009
+ const x610: u32 = toU32(w610)
2010
+ const x611: u32 = toU32(w610 >> 32)
2011
+ const w612: u64 = p256FiatMulxU32(x588, 0xffffffff)
2012
+ const x612: u32 = toU32(w612)
2013
+ const x613: u32 = toU32(w612 >> 32)
2014
+ const w614: u64 = p256FiatAddcarryxU32(0x0, x613, x610)
2015
+ const x614: u32 = toU32(w614)
2016
+ const x615: u32 = toU32(w614 >> 32)
2017
+ const w616: u64 = p256FiatAddcarryxU32(x615, x611, x608)
2018
+ const x616: u32 = toU32(w616)
2019
+ const x617: u32 = toU32(w616 >> 32)
2020
+ const x618: u32 = x617 + x609
2021
+ const w619: u64 = p256FiatAddcarryxU32(0x0, x588, x612)
2022
+ const x620: u32 = toU32(w619 >> 32)
2023
+ const w621: u64 = p256FiatAddcarryxU32(x620, x590, x614)
2024
+ const x621: u32 = toU32(w621)
2025
+ const x622: u32 = toU32(w621 >> 32)
2026
+ const w623: u64 = p256FiatAddcarryxU32(x622, x592, x616)
2027
+ const x623: u32 = toU32(w623)
2028
+ const x624: u32 = toU32(w623 >> 32)
2029
+ const w625: u64 = p256FiatAddcarryxU32(x624, x594, x618)
2030
+ const x625: u32 = toU32(w625)
2031
+ const x626: u32 = toU32(w625 >> 32)
2032
+ const w627: u64 = p256FiatAddcarryxU32(x626, x596, 0x0)
2033
+ const x627: u32 = toU32(w627)
2034
+ const x628: u32 = toU32(w627 >> 32)
2035
+ const w629: u64 = p256FiatAddcarryxU32(x628, x598, 0x0)
2036
+ const x629: u32 = toU32(w629)
2037
+ const x630: u32 = toU32(w629 >> 32)
2038
+ const w631: u64 = p256FiatAddcarryxU32(x630, x600, x588)
2039
+ const x631: u32 = toU32(w631)
2040
+ const x632: u32 = toU32(w631 >> 32)
2041
+ const w633: u64 = p256FiatAddcarryxU32(x632, x602, x606)
2042
+ const x633: u32 = toU32(w633)
2043
+ const x634: u32 = toU32(w633 >> 32)
2044
+ const w635: u64 = p256FiatAddcarryxU32(x634, x604, x607)
2045
+ const x635: u32 = toU32(w635)
2046
+ const x636: u32 = toU32(w635 >> 32)
2047
+ const x637: u32 = x636 + x605
2048
+ const w638: u64 = p256FiatSubborrowxU32(0x0, x621, 0xffffffff)
2049
+ const x638: u32 = toU32(w638)
2050
+ const x639: u32 = toU32(w638 >> 32)
2051
+ const w640: u64 = p256FiatSubborrowxU32(x639, x623, 0xffffffff)
2052
+ const x640: u32 = toU32(w640)
2053
+ const x641: u32 = toU32(w640 >> 32)
2054
+ const w642: u64 = p256FiatSubborrowxU32(x641, x625, 0xffffffff)
2055
+ const x642: u32 = toU32(w642)
2056
+ const x643: u32 = toU32(w642 >> 32)
2057
+ const w644: u64 = p256FiatSubborrowxU32(x643, x627, 0x0)
2058
+ const x644: u32 = toU32(w644)
2059
+ const x645: u32 = toU32(w644 >> 32)
2060
+ const w646: u64 = p256FiatSubborrowxU32(x645, x629, 0x0)
2061
+ const x646: u32 = toU32(w646)
2062
+ const x647: u32 = toU32(w646 >> 32)
2063
+ const w648: u64 = p256FiatSubborrowxU32(x647, x631, 0x0)
2064
+ const x648: u32 = toU32(w648)
2065
+ const x649: u32 = toU32(w648 >> 32)
2066
+ const w650: u64 = p256FiatSubborrowxU32(x649, x633, 0x1)
2067
+ const x650: u32 = toU32(w650)
2068
+ const x651: u32 = toU32(w650 >> 32)
2069
+ const w652: u64 = p256FiatSubborrowxU32(x651, x635, 0xffffffff)
2070
+ const x652: u32 = toU32(w652)
2071
+ const x653: u32 = toU32(w652 >> 32)
2072
+ const w654: u64 = p256FiatSubborrowxU32(x653, x637, 0x0)
2073
+ const x655: u32 = toU32(w654 >> 32)
2074
+ const x656: u32 = p256FiatCmovznzU32(x655, x638, x621)
2075
+ const x657: u32 = p256FiatCmovznzU32(x655, x640, x623)
2076
+ const x658: u32 = p256FiatCmovznzU32(x655, x642, x625)
2077
+ const x659: u32 = p256FiatCmovznzU32(x655, x644, x627)
2078
+ const x660: u32 = p256FiatCmovznzU32(x655, x646, x629)
2079
+ const x661: u32 = p256FiatCmovznzU32(x655, x648, x631)
2080
+ const x662: u32 = p256FiatCmovznzU32(x655, x650, x633)
2081
+ const x663: u32 = p256FiatCmovznzU32(x655, x652, x635)
2082
+ out1[0] = x656
2083
+ out1[1] = x657
2084
+ out1[2] = x658
2085
+ out1[3] = x659
2086
+ out1[4] = x660
2087
+ out1[5] = x661
2088
+ out1[6] = x662
2089
+ out1[7] = x663
2090
+ }
2091
+
2092
+ /** fiat's `fiat_p256_add`: adds two field elements in the Montgomery domain. */
2093
+ const p256FiatAdd = (out1: u32[], arg1: u32[], arg2: u32[]): void => {
2094
+ if (toI32(out1.length) < 8 || toI32(arg1.length) < 8 || toI32(arg2.length) < 8) {
2095
+ return
2096
+ }
2097
+ const w1: u64 = p256FiatAddcarryxU32(0x0, arg1[0], arg2[0])
2098
+ const x1: u32 = toU32(w1)
2099
+ const x2: u32 = toU32(w1 >> 32)
2100
+ const w3: u64 = p256FiatAddcarryxU32(x2, arg1[1], arg2[1])
2101
+ const x3: u32 = toU32(w3)
2102
+ const x4: u32 = toU32(w3 >> 32)
2103
+ const w5: u64 = p256FiatAddcarryxU32(x4, arg1[2], arg2[2])
2104
+ const x5: u32 = toU32(w5)
2105
+ const x6: u32 = toU32(w5 >> 32)
2106
+ const w7: u64 = p256FiatAddcarryxU32(x6, arg1[3], arg2[3])
2107
+ const x7: u32 = toU32(w7)
2108
+ const x8: u32 = toU32(w7 >> 32)
2109
+ const w9: u64 = p256FiatAddcarryxU32(x8, arg1[4], arg2[4])
2110
+ const x9: u32 = toU32(w9)
2111
+ const x10: u32 = toU32(w9 >> 32)
2112
+ const w11: u64 = p256FiatAddcarryxU32(x10, arg1[5], arg2[5])
2113
+ const x11: u32 = toU32(w11)
2114
+ const x12: u32 = toU32(w11 >> 32)
2115
+ const w13: u64 = p256FiatAddcarryxU32(x12, arg1[6], arg2[6])
2116
+ const x13: u32 = toU32(w13)
2117
+ const x14: u32 = toU32(w13 >> 32)
2118
+ const w15: u64 = p256FiatAddcarryxU32(x14, arg1[7], arg2[7])
2119
+ const x15: u32 = toU32(w15)
2120
+ const x16: u32 = toU32(w15 >> 32)
2121
+ const w17: u64 = p256FiatSubborrowxU32(0x0, x1, 0xffffffff)
2122
+ const x17: u32 = toU32(w17)
2123
+ const x18: u32 = toU32(w17 >> 32)
2124
+ const w19: u64 = p256FiatSubborrowxU32(x18, x3, 0xffffffff)
2125
+ const x19: u32 = toU32(w19)
2126
+ const x20: u32 = toU32(w19 >> 32)
2127
+ const w21: u64 = p256FiatSubborrowxU32(x20, x5, 0xffffffff)
2128
+ const x21: u32 = toU32(w21)
2129
+ const x22: u32 = toU32(w21 >> 32)
2130
+ const w23: u64 = p256FiatSubborrowxU32(x22, x7, 0x0)
2131
+ const x23: u32 = toU32(w23)
2132
+ const x24: u32 = toU32(w23 >> 32)
2133
+ const w25: u64 = p256FiatSubborrowxU32(x24, x9, 0x0)
2134
+ const x25: u32 = toU32(w25)
2135
+ const x26: u32 = toU32(w25 >> 32)
2136
+ const w27: u64 = p256FiatSubborrowxU32(x26, x11, 0x0)
2137
+ const x27: u32 = toU32(w27)
2138
+ const x28: u32 = toU32(w27 >> 32)
2139
+ const w29: u64 = p256FiatSubborrowxU32(x28, x13, 0x1)
2140
+ const x29: u32 = toU32(w29)
2141
+ const x30: u32 = toU32(w29 >> 32)
2142
+ const w31: u64 = p256FiatSubborrowxU32(x30, x15, 0xffffffff)
2143
+ const x31: u32 = toU32(w31)
2144
+ const x32: u32 = toU32(w31 >> 32)
2145
+ const w33: u64 = p256FiatSubborrowxU32(x32, x16, 0x0)
2146
+ const x34: u32 = toU32(w33 >> 32)
2147
+ const x35: u32 = p256FiatCmovznzU32(x34, x17, x1)
2148
+ const x36: u32 = p256FiatCmovznzU32(x34, x19, x3)
2149
+ const x37: u32 = p256FiatCmovznzU32(x34, x21, x5)
2150
+ const x38: u32 = p256FiatCmovznzU32(x34, x23, x7)
2151
+ const x39: u32 = p256FiatCmovznzU32(x34, x25, x9)
2152
+ const x40: u32 = p256FiatCmovznzU32(x34, x27, x11)
2153
+ const x41: u32 = p256FiatCmovznzU32(x34, x29, x13)
2154
+ const x42: u32 = p256FiatCmovznzU32(x34, x31, x15)
2155
+ out1[0] = x35
2156
+ out1[1] = x36
2157
+ out1[2] = x37
2158
+ out1[3] = x38
2159
+ out1[4] = x39
2160
+ out1[5] = x40
2161
+ out1[6] = x41
2162
+ out1[7] = x42
2163
+ }
2164
+
2165
+ /** fiat's `fiat_p256_sub`: subtracts two field elements in the Montgomery domain. */
2166
+ const p256FiatSub = (out1: u32[], arg1: u32[], arg2: u32[]): void => {
2167
+ if (toI32(out1.length) < 8 || toI32(arg1.length) < 8 || toI32(arg2.length) < 8) {
2168
+ return
2169
+ }
2170
+ const w1: u64 = p256FiatSubborrowxU32(0x0, arg1[0], arg2[0])
2171
+ const x1: u32 = toU32(w1)
2172
+ const x2: u32 = toU32(w1 >> 32)
2173
+ const w3: u64 = p256FiatSubborrowxU32(x2, arg1[1], arg2[1])
2174
+ const x3: u32 = toU32(w3)
2175
+ const x4: u32 = toU32(w3 >> 32)
2176
+ const w5: u64 = p256FiatSubborrowxU32(x4, arg1[2], arg2[2])
2177
+ const x5: u32 = toU32(w5)
2178
+ const x6: u32 = toU32(w5 >> 32)
2179
+ const w7: u64 = p256FiatSubborrowxU32(x6, arg1[3], arg2[3])
2180
+ const x7: u32 = toU32(w7)
2181
+ const x8: u32 = toU32(w7 >> 32)
2182
+ const w9: u64 = p256FiatSubborrowxU32(x8, arg1[4], arg2[4])
2183
+ const x9: u32 = toU32(w9)
2184
+ const x10: u32 = toU32(w9 >> 32)
2185
+ const w11: u64 = p256FiatSubborrowxU32(x10, arg1[5], arg2[5])
2186
+ const x11: u32 = toU32(w11)
2187
+ const x12: u32 = toU32(w11 >> 32)
2188
+ const w13: u64 = p256FiatSubborrowxU32(x12, arg1[6], arg2[6])
2189
+ const x13: u32 = toU32(w13)
2190
+ const x14: u32 = toU32(w13 >> 32)
2191
+ const w15: u64 = p256FiatSubborrowxU32(x14, arg1[7], arg2[7])
2192
+ const x15: u32 = toU32(w15)
2193
+ const x16: u32 = toU32(w15 >> 32)
2194
+ const x17: u32 = p256FiatCmovznzU32(x16, 0x0, 0xffffffff)
2195
+ const w18: u64 = p256FiatAddcarryxU32(0x0, x1, x17)
2196
+ const x18: u32 = toU32(w18)
2197
+ const x19: u32 = toU32(w18 >> 32)
2198
+ const w20: u64 = p256FiatAddcarryxU32(x19, x3, x17)
2199
+ const x20: u32 = toU32(w20)
2200
+ const x21: u32 = toU32(w20 >> 32)
2201
+ const w22: u64 = p256FiatAddcarryxU32(x21, x5, x17)
2202
+ const x22: u32 = toU32(w22)
2203
+ const x23: u32 = toU32(w22 >> 32)
2204
+ const w24: u64 = p256FiatAddcarryxU32(x23, x7, 0x0)
2205
+ const x24: u32 = toU32(w24)
2206
+ const x25: u32 = toU32(w24 >> 32)
2207
+ const w26: u64 = p256FiatAddcarryxU32(x25, x9, 0x0)
2208
+ const x26: u32 = toU32(w26)
2209
+ const x27: u32 = toU32(w26 >> 32)
2210
+ const w28: u64 = p256FiatAddcarryxU32(x27, x11, 0x0)
2211
+ const x28: u32 = toU32(w28)
2212
+ const x29: u32 = toU32(w28 >> 32)
2213
+ const w30: u64 = p256FiatAddcarryxU32(x29, x13, x17 & 0x1)
2214
+ const x30: u32 = toU32(w30)
2215
+ const x31: u32 = toU32(w30 >> 32)
2216
+ const w32: u64 = p256FiatAddcarryxU32(x31, x15, x17)
2217
+ const x32: u32 = toU32(w32)
2218
+ out1[0] = x18
2219
+ out1[1] = x20
2220
+ out1[2] = x22
2221
+ out1[3] = x24
2222
+ out1[4] = x26
2223
+ out1[5] = x28
2224
+ out1[6] = x30
2225
+ out1[7] = x32
2226
+ }
2227
+
2228
+ /** fiat's `fiat_p256_nonzero`: outputs a single non-zero word if the input is non-zero and zero otherwise. */
2229
+ const p256FiatNonzero = (arg1: u32[]): u32 => {
2230
+ if (toI32(arg1.length) < 8) {
2231
+ return 0
2232
+ }
2233
+ const x1: u32 = arg1[0] | (arg1[1] | (arg1[2] | (arg1[3] | (arg1[4] | (arg1[5] | (arg1[6] | arg1[7]))))))
2234
+ return x1
2235
+ }
2236
+
2237
+ /** fiat's `fiat_p256_selectznz`: is a multi-limb conditional select. */
2238
+ const p256FiatSelectznz = (out1: u32[], arg1: u32, arg2: u32[], arg3: u32[]): void => {
2239
+ if (toI32(out1.length) < 8 || toI32(arg2.length) < 8 || toI32(arg3.length) < 8) {
2240
+ return
2241
+ }
2242
+ const x1: u32 = p256FiatCmovznzU32(arg1, arg2[0], arg3[0])
2243
+ const x2: u32 = p256FiatCmovznzU32(arg1, arg2[1], arg3[1])
2244
+ const x3: u32 = p256FiatCmovznzU32(arg1, arg2[2], arg3[2])
2245
+ const x4: u32 = p256FiatCmovznzU32(arg1, arg2[3], arg3[3])
2246
+ const x5: u32 = p256FiatCmovznzU32(arg1, arg2[4], arg3[4])
2247
+ const x6: u32 = p256FiatCmovznzU32(arg1, arg2[5], arg3[5])
2248
+ const x7: u32 = p256FiatCmovznzU32(arg1, arg2[6], arg3[6])
2249
+ const x8: u32 = p256FiatCmovznzU32(arg1, arg2[7], arg3[7])
2250
+ out1[0] = x1
2251
+ out1[1] = x2
2252
+ out1[2] = x3
2253
+ out1[3] = x4
2254
+ out1[4] = x5
2255
+ out1[5] = x6
2256
+ out1[6] = x7
2257
+ out1[7] = x8
2258
+ }
2259
+
2260
+ /** fiat's `fiat_p256_set_one`: returns the field element one in the Montgomery domain. */
2261
+ const p256FiatSetOne = (out1: u32[]): void => {
2262
+ if (toI32(out1.length) < 8) {
2263
+ return
2264
+ }
2265
+ out1[0] = 0x1
2266
+ out1[1] = 0x0
2267
+ out1[2] = 0x0
2268
+ out1[3] = 0xffffffff
2269
+ out1[4] = 0xffffffff
2270
+ out1[5] = 0xffffffff
2271
+ out1[6] = 0xfffffffe
2272
+ out1[7] = 0x0
2273
+ }
2274
+ /** fiat's `fiat_p256_scalar_mul`: multiplies two field elements in the Montgomery domain. */
2275
+ const p256FiatScalarMul = (out1: u32[], arg1: u32[], arg2: u32[]): void => {
2276
+ if (toI32(out1.length) < 8 || toI32(arg1.length) < 8 || toI32(arg2.length) < 8) {
2277
+ return
2278
+ }
2279
+ const x1: u32 = arg1[1]
2280
+ const x2: u32 = arg1[2]
2281
+ const x3: u32 = arg1[3]
2282
+ const x4: u32 = arg1[4]
2283
+ const x5: u32 = arg1[5]
2284
+ const x6: u32 = arg1[6]
2285
+ const x7: u32 = arg1[7]
2286
+ const x8: u32 = arg1[0]
2287
+ const w9: u64 = p256FiatMulxU32(x8, arg2[7])
2288
+ const x9: u32 = toU32(w9)
2289
+ const x10: u32 = toU32(w9 >> 32)
2290
+ const w11: u64 = p256FiatMulxU32(x8, arg2[6])
2291
+ const x11: u32 = toU32(w11)
2292
+ const x12: u32 = toU32(w11 >> 32)
2293
+ const w13: u64 = p256FiatMulxU32(x8, arg2[5])
2294
+ const x13: u32 = toU32(w13)
2295
+ const x14: u32 = toU32(w13 >> 32)
2296
+ const w15: u64 = p256FiatMulxU32(x8, arg2[4])
2297
+ const x15: u32 = toU32(w15)
2298
+ const x16: u32 = toU32(w15 >> 32)
2299
+ const w17: u64 = p256FiatMulxU32(x8, arg2[3])
2300
+ const x17: u32 = toU32(w17)
2301
+ const x18: u32 = toU32(w17 >> 32)
2302
+ const w19: u64 = p256FiatMulxU32(x8, arg2[2])
2303
+ const x19: u32 = toU32(w19)
2304
+ const x20: u32 = toU32(w19 >> 32)
2305
+ const w21: u64 = p256FiatMulxU32(x8, arg2[1])
2306
+ const x21: u32 = toU32(w21)
2307
+ const x22: u32 = toU32(w21 >> 32)
2308
+ const w23: u64 = p256FiatMulxU32(x8, arg2[0])
2309
+ const x23: u32 = toU32(w23)
2310
+ const x24: u32 = toU32(w23 >> 32)
2311
+ const w25: u64 = p256FiatAddcarryxU32(0x0, x24, x21)
2312
+ const x25: u32 = toU32(w25)
2313
+ const x26: u32 = toU32(w25 >> 32)
2314
+ const w27: u64 = p256FiatAddcarryxU32(x26, x22, x19)
2315
+ const x27: u32 = toU32(w27)
2316
+ const x28: u32 = toU32(w27 >> 32)
2317
+ const w29: u64 = p256FiatAddcarryxU32(x28, x20, x17)
2318
+ const x29: u32 = toU32(w29)
2319
+ const x30: u32 = toU32(w29 >> 32)
2320
+ const w31: u64 = p256FiatAddcarryxU32(x30, x18, x15)
2321
+ const x31: u32 = toU32(w31)
2322
+ const x32: u32 = toU32(w31 >> 32)
2323
+ const w33: u64 = p256FiatAddcarryxU32(x32, x16, x13)
2324
+ const x33: u32 = toU32(w33)
2325
+ const x34: u32 = toU32(w33 >> 32)
2326
+ const w35: u64 = p256FiatAddcarryxU32(x34, x14, x11)
2327
+ const x35: u32 = toU32(w35)
2328
+ const x36: u32 = toU32(w35 >> 32)
2329
+ const w37: u64 = p256FiatAddcarryxU32(x36, x12, x9)
2330
+ const x37: u32 = toU32(w37)
2331
+ const x38: u32 = toU32(w37 >> 32)
2332
+ const x39: u32 = x38 + x10
2333
+ const w40: u64 = p256FiatMulxU32(x23, 0xee00bc4f)
2334
+ const x40: u32 = toU32(w40)
2335
+ const w42: u64 = p256FiatMulxU32(x40, 0xffffffff)
2336
+ const x42: u32 = toU32(w42)
2337
+ const x43: u32 = toU32(w42 >> 32)
2338
+ const w44: u64 = p256FiatMulxU32(x40, 0xffffffff)
2339
+ const x44: u32 = toU32(w44)
2340
+ const x45: u32 = toU32(w44 >> 32)
2341
+ const w46: u64 = p256FiatMulxU32(x40, 0xffffffff)
2342
+ const x46: u32 = toU32(w46)
2343
+ const x47: u32 = toU32(w46 >> 32)
2344
+ const w48: u64 = p256FiatMulxU32(x40, 0xbce6faad)
2345
+ const x48: u32 = toU32(w48)
2346
+ const x49: u32 = toU32(w48 >> 32)
2347
+ const w50: u64 = p256FiatMulxU32(x40, 0xa7179e84)
2348
+ const x50: u32 = toU32(w50)
2349
+ const x51: u32 = toU32(w50 >> 32)
2350
+ const w52: u64 = p256FiatMulxU32(x40, 0xf3b9cac2)
2351
+ const x52: u32 = toU32(w52)
2352
+ const x53: u32 = toU32(w52 >> 32)
2353
+ const w54: u64 = p256FiatMulxU32(x40, 0xfc632551)
2354
+ const x54: u32 = toU32(w54)
2355
+ const x55: u32 = toU32(w54 >> 32)
2356
+ const w56: u64 = p256FiatAddcarryxU32(0x0, x55, x52)
2357
+ const x56: u32 = toU32(w56)
2358
+ const x57: u32 = toU32(w56 >> 32)
2359
+ const w58: u64 = p256FiatAddcarryxU32(x57, x53, x50)
2360
+ const x58: u32 = toU32(w58)
2361
+ const x59: u32 = toU32(w58 >> 32)
2362
+ const w60: u64 = p256FiatAddcarryxU32(x59, x51, x48)
2363
+ const x60: u32 = toU32(w60)
2364
+ const x61: u32 = toU32(w60 >> 32)
2365
+ const w62: u64 = p256FiatAddcarryxU32(x61, x49, x46)
2366
+ const x62: u32 = toU32(w62)
2367
+ const x63: u32 = toU32(w62 >> 32)
2368
+ const w64: u64 = p256FiatAddcarryxU32(x63, x47, x44)
2369
+ const x64: u32 = toU32(w64)
2370
+ const x65: u32 = toU32(w64 >> 32)
2371
+ const x66: u32 = x65 + x45
2372
+ const w67: u64 = p256FiatAddcarryxU32(0x0, x23, x54)
2373
+ const x68: u32 = toU32(w67 >> 32)
2374
+ const w69: u64 = p256FiatAddcarryxU32(x68, x25, x56)
2375
+ const x69: u32 = toU32(w69)
2376
+ const x70: u32 = toU32(w69 >> 32)
2377
+ const w71: u64 = p256FiatAddcarryxU32(x70, x27, x58)
2378
+ const x71: u32 = toU32(w71)
2379
+ const x72: u32 = toU32(w71 >> 32)
2380
+ const w73: u64 = p256FiatAddcarryxU32(x72, x29, x60)
2381
+ const x73: u32 = toU32(w73)
2382
+ const x74: u32 = toU32(w73 >> 32)
2383
+ const w75: u64 = p256FiatAddcarryxU32(x74, x31, x62)
2384
+ const x75: u32 = toU32(w75)
2385
+ const x76: u32 = toU32(w75 >> 32)
2386
+ const w77: u64 = p256FiatAddcarryxU32(x76, x33, x64)
2387
+ const x77: u32 = toU32(w77)
2388
+ const x78: u32 = toU32(w77 >> 32)
2389
+ const w79: u64 = p256FiatAddcarryxU32(x78, x35, x66)
2390
+ const x79: u32 = toU32(w79)
2391
+ const x80: u32 = toU32(w79 >> 32)
2392
+ const w81: u64 = p256FiatAddcarryxU32(x80, x37, x42)
2393
+ const x81: u32 = toU32(w81)
2394
+ const x82: u32 = toU32(w81 >> 32)
2395
+ const w83: u64 = p256FiatAddcarryxU32(x82, x39, x43)
2396
+ const x83: u32 = toU32(w83)
2397
+ const x84: u32 = toU32(w83 >> 32)
2398
+ const w85: u64 = p256FiatMulxU32(x1, arg2[7])
2399
+ const x85: u32 = toU32(w85)
2400
+ const x86: u32 = toU32(w85 >> 32)
2401
+ const w87: u64 = p256FiatMulxU32(x1, arg2[6])
2402
+ const x87: u32 = toU32(w87)
2403
+ const x88: u32 = toU32(w87 >> 32)
2404
+ const w89: u64 = p256FiatMulxU32(x1, arg2[5])
2405
+ const x89: u32 = toU32(w89)
2406
+ const x90: u32 = toU32(w89 >> 32)
2407
+ const w91: u64 = p256FiatMulxU32(x1, arg2[4])
2408
+ const x91: u32 = toU32(w91)
2409
+ const x92: u32 = toU32(w91 >> 32)
2410
+ const w93: u64 = p256FiatMulxU32(x1, arg2[3])
2411
+ const x93: u32 = toU32(w93)
2412
+ const x94: u32 = toU32(w93 >> 32)
2413
+ const w95: u64 = p256FiatMulxU32(x1, arg2[2])
2414
+ const x95: u32 = toU32(w95)
2415
+ const x96: u32 = toU32(w95 >> 32)
2416
+ const w97: u64 = p256FiatMulxU32(x1, arg2[1])
2417
+ const x97: u32 = toU32(w97)
2418
+ const x98: u32 = toU32(w97 >> 32)
2419
+ const w99: u64 = p256FiatMulxU32(x1, arg2[0])
2420
+ const x99: u32 = toU32(w99)
2421
+ const x100: u32 = toU32(w99 >> 32)
2422
+ const w101: u64 = p256FiatAddcarryxU32(0x0, x100, x97)
2423
+ const x101: u32 = toU32(w101)
2424
+ const x102: u32 = toU32(w101 >> 32)
2425
+ const w103: u64 = p256FiatAddcarryxU32(x102, x98, x95)
2426
+ const x103: u32 = toU32(w103)
2427
+ const x104: u32 = toU32(w103 >> 32)
2428
+ const w105: u64 = p256FiatAddcarryxU32(x104, x96, x93)
2429
+ const x105: u32 = toU32(w105)
2430
+ const x106: u32 = toU32(w105 >> 32)
2431
+ const w107: u64 = p256FiatAddcarryxU32(x106, x94, x91)
2432
+ const x107: u32 = toU32(w107)
2433
+ const x108: u32 = toU32(w107 >> 32)
2434
+ const w109: u64 = p256FiatAddcarryxU32(x108, x92, x89)
2435
+ const x109: u32 = toU32(w109)
2436
+ const x110: u32 = toU32(w109 >> 32)
2437
+ const w111: u64 = p256FiatAddcarryxU32(x110, x90, x87)
2438
+ const x111: u32 = toU32(w111)
2439
+ const x112: u32 = toU32(w111 >> 32)
2440
+ const w113: u64 = p256FiatAddcarryxU32(x112, x88, x85)
2441
+ const x113: u32 = toU32(w113)
2442
+ const x114: u32 = toU32(w113 >> 32)
2443
+ const x115: u32 = x114 + x86
2444
+ const w116: u64 = p256FiatAddcarryxU32(0x0, x69, x99)
2445
+ const x116: u32 = toU32(w116)
2446
+ const x117: u32 = toU32(w116 >> 32)
2447
+ const w118: u64 = p256FiatAddcarryxU32(x117, x71, x101)
2448
+ const x118: u32 = toU32(w118)
2449
+ const x119: u32 = toU32(w118 >> 32)
2450
+ const w120: u64 = p256FiatAddcarryxU32(x119, x73, x103)
2451
+ const x120: u32 = toU32(w120)
2452
+ const x121: u32 = toU32(w120 >> 32)
2453
+ const w122: u64 = p256FiatAddcarryxU32(x121, x75, x105)
2454
+ const x122: u32 = toU32(w122)
2455
+ const x123: u32 = toU32(w122 >> 32)
2456
+ const w124: u64 = p256FiatAddcarryxU32(x123, x77, x107)
2457
+ const x124: u32 = toU32(w124)
2458
+ const x125: u32 = toU32(w124 >> 32)
2459
+ const w126: u64 = p256FiatAddcarryxU32(x125, x79, x109)
2460
+ const x126: u32 = toU32(w126)
2461
+ const x127: u32 = toU32(w126 >> 32)
2462
+ const w128: u64 = p256FiatAddcarryxU32(x127, x81, x111)
2463
+ const x128: u32 = toU32(w128)
2464
+ const x129: u32 = toU32(w128 >> 32)
2465
+ const w130: u64 = p256FiatAddcarryxU32(x129, x83, x113)
2466
+ const x130: u32 = toU32(w130)
2467
+ const x131: u32 = toU32(w130 >> 32)
2468
+ const w132: u64 = p256FiatAddcarryxU32(x131, x84, x115)
2469
+ const x132: u32 = toU32(w132)
2470
+ const x133: u32 = toU32(w132 >> 32)
2471
+ const w134: u64 = p256FiatMulxU32(x116, 0xee00bc4f)
2472
+ const x134: u32 = toU32(w134)
2473
+ const w136: u64 = p256FiatMulxU32(x134, 0xffffffff)
2474
+ const x136: u32 = toU32(w136)
2475
+ const x137: u32 = toU32(w136 >> 32)
2476
+ const w138: u64 = p256FiatMulxU32(x134, 0xffffffff)
2477
+ const x138: u32 = toU32(w138)
2478
+ const x139: u32 = toU32(w138 >> 32)
2479
+ const w140: u64 = p256FiatMulxU32(x134, 0xffffffff)
2480
+ const x140: u32 = toU32(w140)
2481
+ const x141: u32 = toU32(w140 >> 32)
2482
+ const w142: u64 = p256FiatMulxU32(x134, 0xbce6faad)
2483
+ const x142: u32 = toU32(w142)
2484
+ const x143: u32 = toU32(w142 >> 32)
2485
+ const w144: u64 = p256FiatMulxU32(x134, 0xa7179e84)
2486
+ const x144: u32 = toU32(w144)
2487
+ const x145: u32 = toU32(w144 >> 32)
2488
+ const w146: u64 = p256FiatMulxU32(x134, 0xf3b9cac2)
2489
+ const x146: u32 = toU32(w146)
2490
+ const x147: u32 = toU32(w146 >> 32)
2491
+ const w148: u64 = p256FiatMulxU32(x134, 0xfc632551)
2492
+ const x148: u32 = toU32(w148)
2493
+ const x149: u32 = toU32(w148 >> 32)
2494
+ const w150: u64 = p256FiatAddcarryxU32(0x0, x149, x146)
2495
+ const x150: u32 = toU32(w150)
2496
+ const x151: u32 = toU32(w150 >> 32)
2497
+ const w152: u64 = p256FiatAddcarryxU32(x151, x147, x144)
2498
+ const x152: u32 = toU32(w152)
2499
+ const x153: u32 = toU32(w152 >> 32)
2500
+ const w154: u64 = p256FiatAddcarryxU32(x153, x145, x142)
2501
+ const x154: u32 = toU32(w154)
2502
+ const x155: u32 = toU32(w154 >> 32)
2503
+ const w156: u64 = p256FiatAddcarryxU32(x155, x143, x140)
2504
+ const x156: u32 = toU32(w156)
2505
+ const x157: u32 = toU32(w156 >> 32)
2506
+ const w158: u64 = p256FiatAddcarryxU32(x157, x141, x138)
2507
+ const x158: u32 = toU32(w158)
2508
+ const x159: u32 = toU32(w158 >> 32)
2509
+ const x160: u32 = x159 + x139
2510
+ const w161: u64 = p256FiatAddcarryxU32(0x0, x116, x148)
2511
+ const x162: u32 = toU32(w161 >> 32)
2512
+ const w163: u64 = p256FiatAddcarryxU32(x162, x118, x150)
2513
+ const x163: u32 = toU32(w163)
2514
+ const x164: u32 = toU32(w163 >> 32)
2515
+ const w165: u64 = p256FiatAddcarryxU32(x164, x120, x152)
2516
+ const x165: u32 = toU32(w165)
2517
+ const x166: u32 = toU32(w165 >> 32)
2518
+ const w167: u64 = p256FiatAddcarryxU32(x166, x122, x154)
2519
+ const x167: u32 = toU32(w167)
2520
+ const x168: u32 = toU32(w167 >> 32)
2521
+ const w169: u64 = p256FiatAddcarryxU32(x168, x124, x156)
2522
+ const x169: u32 = toU32(w169)
2523
+ const x170: u32 = toU32(w169 >> 32)
2524
+ const w171: u64 = p256FiatAddcarryxU32(x170, x126, x158)
2525
+ const x171: u32 = toU32(w171)
2526
+ const x172: u32 = toU32(w171 >> 32)
2527
+ const w173: u64 = p256FiatAddcarryxU32(x172, x128, x160)
2528
+ const x173: u32 = toU32(w173)
2529
+ const x174: u32 = toU32(w173 >> 32)
2530
+ const w175: u64 = p256FiatAddcarryxU32(x174, x130, x136)
2531
+ const x175: u32 = toU32(w175)
2532
+ const x176: u32 = toU32(w175 >> 32)
2533
+ const w177: u64 = p256FiatAddcarryxU32(x176, x132, x137)
2534
+ const x177: u32 = toU32(w177)
2535
+ const x178: u32 = toU32(w177 >> 32)
2536
+ const x179: u32 = x178 + x133
2537
+ const w180: u64 = p256FiatMulxU32(x2, arg2[7])
2538
+ const x180: u32 = toU32(w180)
2539
+ const x181: u32 = toU32(w180 >> 32)
2540
+ const w182: u64 = p256FiatMulxU32(x2, arg2[6])
2541
+ const x182: u32 = toU32(w182)
2542
+ const x183: u32 = toU32(w182 >> 32)
2543
+ const w184: u64 = p256FiatMulxU32(x2, arg2[5])
2544
+ const x184: u32 = toU32(w184)
2545
+ const x185: u32 = toU32(w184 >> 32)
2546
+ const w186: u64 = p256FiatMulxU32(x2, arg2[4])
2547
+ const x186: u32 = toU32(w186)
2548
+ const x187: u32 = toU32(w186 >> 32)
2549
+ const w188: u64 = p256FiatMulxU32(x2, arg2[3])
2550
+ const x188: u32 = toU32(w188)
2551
+ const x189: u32 = toU32(w188 >> 32)
2552
+ const w190: u64 = p256FiatMulxU32(x2, arg2[2])
2553
+ const x190: u32 = toU32(w190)
2554
+ const x191: u32 = toU32(w190 >> 32)
2555
+ const w192: u64 = p256FiatMulxU32(x2, arg2[1])
2556
+ const x192: u32 = toU32(w192)
2557
+ const x193: u32 = toU32(w192 >> 32)
2558
+ const w194: u64 = p256FiatMulxU32(x2, arg2[0])
2559
+ const x194: u32 = toU32(w194)
2560
+ const x195: u32 = toU32(w194 >> 32)
2561
+ const w196: u64 = p256FiatAddcarryxU32(0x0, x195, x192)
2562
+ const x196: u32 = toU32(w196)
2563
+ const x197: u32 = toU32(w196 >> 32)
2564
+ const w198: u64 = p256FiatAddcarryxU32(x197, x193, x190)
2565
+ const x198: u32 = toU32(w198)
2566
+ const x199: u32 = toU32(w198 >> 32)
2567
+ const w200: u64 = p256FiatAddcarryxU32(x199, x191, x188)
2568
+ const x200: u32 = toU32(w200)
2569
+ const x201: u32 = toU32(w200 >> 32)
2570
+ const w202: u64 = p256FiatAddcarryxU32(x201, x189, x186)
2571
+ const x202: u32 = toU32(w202)
2572
+ const x203: u32 = toU32(w202 >> 32)
2573
+ const w204: u64 = p256FiatAddcarryxU32(x203, x187, x184)
2574
+ const x204: u32 = toU32(w204)
2575
+ const x205: u32 = toU32(w204 >> 32)
2576
+ const w206: u64 = p256FiatAddcarryxU32(x205, x185, x182)
2577
+ const x206: u32 = toU32(w206)
2578
+ const x207: u32 = toU32(w206 >> 32)
2579
+ const w208: u64 = p256FiatAddcarryxU32(x207, x183, x180)
2580
+ const x208: u32 = toU32(w208)
2581
+ const x209: u32 = toU32(w208 >> 32)
2582
+ const x210: u32 = x209 + x181
2583
+ const w211: u64 = p256FiatAddcarryxU32(0x0, x163, x194)
2584
+ const x211: u32 = toU32(w211)
2585
+ const x212: u32 = toU32(w211 >> 32)
2586
+ const w213: u64 = p256FiatAddcarryxU32(x212, x165, x196)
2587
+ const x213: u32 = toU32(w213)
2588
+ const x214: u32 = toU32(w213 >> 32)
2589
+ const w215: u64 = p256FiatAddcarryxU32(x214, x167, x198)
2590
+ const x215: u32 = toU32(w215)
2591
+ const x216: u32 = toU32(w215 >> 32)
2592
+ const w217: u64 = p256FiatAddcarryxU32(x216, x169, x200)
2593
+ const x217: u32 = toU32(w217)
2594
+ const x218: u32 = toU32(w217 >> 32)
2595
+ const w219: u64 = p256FiatAddcarryxU32(x218, x171, x202)
2596
+ const x219: u32 = toU32(w219)
2597
+ const x220: u32 = toU32(w219 >> 32)
2598
+ const w221: u64 = p256FiatAddcarryxU32(x220, x173, x204)
2599
+ const x221: u32 = toU32(w221)
2600
+ const x222: u32 = toU32(w221 >> 32)
2601
+ const w223: u64 = p256FiatAddcarryxU32(x222, x175, x206)
2602
+ const x223: u32 = toU32(w223)
2603
+ const x224: u32 = toU32(w223 >> 32)
2604
+ const w225: u64 = p256FiatAddcarryxU32(x224, x177, x208)
2605
+ const x225: u32 = toU32(w225)
2606
+ const x226: u32 = toU32(w225 >> 32)
2607
+ const w227: u64 = p256FiatAddcarryxU32(x226, x179, x210)
2608
+ const x227: u32 = toU32(w227)
2609
+ const x228: u32 = toU32(w227 >> 32)
2610
+ const w229: u64 = p256FiatMulxU32(x211, 0xee00bc4f)
2611
+ const x229: u32 = toU32(w229)
2612
+ const w231: u64 = p256FiatMulxU32(x229, 0xffffffff)
2613
+ const x231: u32 = toU32(w231)
2614
+ const x232: u32 = toU32(w231 >> 32)
2615
+ const w233: u64 = p256FiatMulxU32(x229, 0xffffffff)
2616
+ const x233: u32 = toU32(w233)
2617
+ const x234: u32 = toU32(w233 >> 32)
2618
+ const w235: u64 = p256FiatMulxU32(x229, 0xffffffff)
2619
+ const x235: u32 = toU32(w235)
2620
+ const x236: u32 = toU32(w235 >> 32)
2621
+ const w237: u64 = p256FiatMulxU32(x229, 0xbce6faad)
2622
+ const x237: u32 = toU32(w237)
2623
+ const x238: u32 = toU32(w237 >> 32)
2624
+ const w239: u64 = p256FiatMulxU32(x229, 0xa7179e84)
2625
+ const x239: u32 = toU32(w239)
2626
+ const x240: u32 = toU32(w239 >> 32)
2627
+ const w241: u64 = p256FiatMulxU32(x229, 0xf3b9cac2)
2628
+ const x241: u32 = toU32(w241)
2629
+ const x242: u32 = toU32(w241 >> 32)
2630
+ const w243: u64 = p256FiatMulxU32(x229, 0xfc632551)
2631
+ const x243: u32 = toU32(w243)
2632
+ const x244: u32 = toU32(w243 >> 32)
2633
+ const w245: u64 = p256FiatAddcarryxU32(0x0, x244, x241)
2634
+ const x245: u32 = toU32(w245)
2635
+ const x246: u32 = toU32(w245 >> 32)
2636
+ const w247: u64 = p256FiatAddcarryxU32(x246, x242, x239)
2637
+ const x247: u32 = toU32(w247)
2638
+ const x248: u32 = toU32(w247 >> 32)
2639
+ const w249: u64 = p256FiatAddcarryxU32(x248, x240, x237)
2640
+ const x249: u32 = toU32(w249)
2641
+ const x250: u32 = toU32(w249 >> 32)
2642
+ const w251: u64 = p256FiatAddcarryxU32(x250, x238, x235)
2643
+ const x251: u32 = toU32(w251)
2644
+ const x252: u32 = toU32(w251 >> 32)
2645
+ const w253: u64 = p256FiatAddcarryxU32(x252, x236, x233)
2646
+ const x253: u32 = toU32(w253)
2647
+ const x254: u32 = toU32(w253 >> 32)
2648
+ const x255: u32 = x254 + x234
2649
+ const w256: u64 = p256FiatAddcarryxU32(0x0, x211, x243)
2650
+ const x257: u32 = toU32(w256 >> 32)
2651
+ const w258: u64 = p256FiatAddcarryxU32(x257, x213, x245)
2652
+ const x258: u32 = toU32(w258)
2653
+ const x259: u32 = toU32(w258 >> 32)
2654
+ const w260: u64 = p256FiatAddcarryxU32(x259, x215, x247)
2655
+ const x260: u32 = toU32(w260)
2656
+ const x261: u32 = toU32(w260 >> 32)
2657
+ const w262: u64 = p256FiatAddcarryxU32(x261, x217, x249)
2658
+ const x262: u32 = toU32(w262)
2659
+ const x263: u32 = toU32(w262 >> 32)
2660
+ const w264: u64 = p256FiatAddcarryxU32(x263, x219, x251)
2661
+ const x264: u32 = toU32(w264)
2662
+ const x265: u32 = toU32(w264 >> 32)
2663
+ const w266: u64 = p256FiatAddcarryxU32(x265, x221, x253)
2664
+ const x266: u32 = toU32(w266)
2665
+ const x267: u32 = toU32(w266 >> 32)
2666
+ const w268: u64 = p256FiatAddcarryxU32(x267, x223, x255)
2667
+ const x268: u32 = toU32(w268)
2668
+ const x269: u32 = toU32(w268 >> 32)
2669
+ const w270: u64 = p256FiatAddcarryxU32(x269, x225, x231)
2670
+ const x270: u32 = toU32(w270)
2671
+ const x271: u32 = toU32(w270 >> 32)
2672
+ const w272: u64 = p256FiatAddcarryxU32(x271, x227, x232)
2673
+ const x272: u32 = toU32(w272)
2674
+ const x273: u32 = toU32(w272 >> 32)
2675
+ const x274: u32 = x273 + x228
2676
+ const w275: u64 = p256FiatMulxU32(x3, arg2[7])
2677
+ const x275: u32 = toU32(w275)
2678
+ const x276: u32 = toU32(w275 >> 32)
2679
+ const w277: u64 = p256FiatMulxU32(x3, arg2[6])
2680
+ const x277: u32 = toU32(w277)
2681
+ const x278: u32 = toU32(w277 >> 32)
2682
+ const w279: u64 = p256FiatMulxU32(x3, arg2[5])
2683
+ const x279: u32 = toU32(w279)
2684
+ const x280: u32 = toU32(w279 >> 32)
2685
+ const w281: u64 = p256FiatMulxU32(x3, arg2[4])
2686
+ const x281: u32 = toU32(w281)
2687
+ const x282: u32 = toU32(w281 >> 32)
2688
+ const w283: u64 = p256FiatMulxU32(x3, arg2[3])
2689
+ const x283: u32 = toU32(w283)
2690
+ const x284: u32 = toU32(w283 >> 32)
2691
+ const w285: u64 = p256FiatMulxU32(x3, arg2[2])
2692
+ const x285: u32 = toU32(w285)
2693
+ const x286: u32 = toU32(w285 >> 32)
2694
+ const w287: u64 = p256FiatMulxU32(x3, arg2[1])
2695
+ const x287: u32 = toU32(w287)
2696
+ const x288: u32 = toU32(w287 >> 32)
2697
+ const w289: u64 = p256FiatMulxU32(x3, arg2[0])
2698
+ const x289: u32 = toU32(w289)
2699
+ const x290: u32 = toU32(w289 >> 32)
2700
+ const w291: u64 = p256FiatAddcarryxU32(0x0, x290, x287)
2701
+ const x291: u32 = toU32(w291)
2702
+ const x292: u32 = toU32(w291 >> 32)
2703
+ const w293: u64 = p256FiatAddcarryxU32(x292, x288, x285)
2704
+ const x293: u32 = toU32(w293)
2705
+ const x294: u32 = toU32(w293 >> 32)
2706
+ const w295: u64 = p256FiatAddcarryxU32(x294, x286, x283)
2707
+ const x295: u32 = toU32(w295)
2708
+ const x296: u32 = toU32(w295 >> 32)
2709
+ const w297: u64 = p256FiatAddcarryxU32(x296, x284, x281)
2710
+ const x297: u32 = toU32(w297)
2711
+ const x298: u32 = toU32(w297 >> 32)
2712
+ const w299: u64 = p256FiatAddcarryxU32(x298, x282, x279)
2713
+ const x299: u32 = toU32(w299)
2714
+ const x300: u32 = toU32(w299 >> 32)
2715
+ const w301: u64 = p256FiatAddcarryxU32(x300, x280, x277)
2716
+ const x301: u32 = toU32(w301)
2717
+ const x302: u32 = toU32(w301 >> 32)
2718
+ const w303: u64 = p256FiatAddcarryxU32(x302, x278, x275)
2719
+ const x303: u32 = toU32(w303)
2720
+ const x304: u32 = toU32(w303 >> 32)
2721
+ const x305: u32 = x304 + x276
2722
+ const w306: u64 = p256FiatAddcarryxU32(0x0, x258, x289)
2723
+ const x306: u32 = toU32(w306)
2724
+ const x307: u32 = toU32(w306 >> 32)
2725
+ const w308: u64 = p256FiatAddcarryxU32(x307, x260, x291)
2726
+ const x308: u32 = toU32(w308)
2727
+ const x309: u32 = toU32(w308 >> 32)
2728
+ const w310: u64 = p256FiatAddcarryxU32(x309, x262, x293)
2729
+ const x310: u32 = toU32(w310)
2730
+ const x311: u32 = toU32(w310 >> 32)
2731
+ const w312: u64 = p256FiatAddcarryxU32(x311, x264, x295)
2732
+ const x312: u32 = toU32(w312)
2733
+ const x313: u32 = toU32(w312 >> 32)
2734
+ const w314: u64 = p256FiatAddcarryxU32(x313, x266, x297)
2735
+ const x314: u32 = toU32(w314)
2736
+ const x315: u32 = toU32(w314 >> 32)
2737
+ const w316: u64 = p256FiatAddcarryxU32(x315, x268, x299)
2738
+ const x316: u32 = toU32(w316)
2739
+ const x317: u32 = toU32(w316 >> 32)
2740
+ const w318: u64 = p256FiatAddcarryxU32(x317, x270, x301)
2741
+ const x318: u32 = toU32(w318)
2742
+ const x319: u32 = toU32(w318 >> 32)
2743
+ const w320: u64 = p256FiatAddcarryxU32(x319, x272, x303)
2744
+ const x320: u32 = toU32(w320)
2745
+ const x321: u32 = toU32(w320 >> 32)
2746
+ const w322: u64 = p256FiatAddcarryxU32(x321, x274, x305)
2747
+ const x322: u32 = toU32(w322)
2748
+ const x323: u32 = toU32(w322 >> 32)
2749
+ const w324: u64 = p256FiatMulxU32(x306, 0xee00bc4f)
2750
+ const x324: u32 = toU32(w324)
2751
+ const w326: u64 = p256FiatMulxU32(x324, 0xffffffff)
2752
+ const x326: u32 = toU32(w326)
2753
+ const x327: u32 = toU32(w326 >> 32)
2754
+ const w328: u64 = p256FiatMulxU32(x324, 0xffffffff)
2755
+ const x328: u32 = toU32(w328)
2756
+ const x329: u32 = toU32(w328 >> 32)
2757
+ const w330: u64 = p256FiatMulxU32(x324, 0xffffffff)
2758
+ const x330: u32 = toU32(w330)
2759
+ const x331: u32 = toU32(w330 >> 32)
2760
+ const w332: u64 = p256FiatMulxU32(x324, 0xbce6faad)
2761
+ const x332: u32 = toU32(w332)
2762
+ const x333: u32 = toU32(w332 >> 32)
2763
+ const w334: u64 = p256FiatMulxU32(x324, 0xa7179e84)
2764
+ const x334: u32 = toU32(w334)
2765
+ const x335: u32 = toU32(w334 >> 32)
2766
+ const w336: u64 = p256FiatMulxU32(x324, 0xf3b9cac2)
2767
+ const x336: u32 = toU32(w336)
2768
+ const x337: u32 = toU32(w336 >> 32)
2769
+ const w338: u64 = p256FiatMulxU32(x324, 0xfc632551)
2770
+ const x338: u32 = toU32(w338)
2771
+ const x339: u32 = toU32(w338 >> 32)
2772
+ const w340: u64 = p256FiatAddcarryxU32(0x0, x339, x336)
2773
+ const x340: u32 = toU32(w340)
2774
+ const x341: u32 = toU32(w340 >> 32)
2775
+ const w342: u64 = p256FiatAddcarryxU32(x341, x337, x334)
2776
+ const x342: u32 = toU32(w342)
2777
+ const x343: u32 = toU32(w342 >> 32)
2778
+ const w344: u64 = p256FiatAddcarryxU32(x343, x335, x332)
2779
+ const x344: u32 = toU32(w344)
2780
+ const x345: u32 = toU32(w344 >> 32)
2781
+ const w346: u64 = p256FiatAddcarryxU32(x345, x333, x330)
2782
+ const x346: u32 = toU32(w346)
2783
+ const x347: u32 = toU32(w346 >> 32)
2784
+ const w348: u64 = p256FiatAddcarryxU32(x347, x331, x328)
2785
+ const x348: u32 = toU32(w348)
2786
+ const x349: u32 = toU32(w348 >> 32)
2787
+ const x350: u32 = x349 + x329
2788
+ const w351: u64 = p256FiatAddcarryxU32(0x0, x306, x338)
2789
+ const x352: u32 = toU32(w351 >> 32)
2790
+ const w353: u64 = p256FiatAddcarryxU32(x352, x308, x340)
2791
+ const x353: u32 = toU32(w353)
2792
+ const x354: u32 = toU32(w353 >> 32)
2793
+ const w355: u64 = p256FiatAddcarryxU32(x354, x310, x342)
2794
+ const x355: u32 = toU32(w355)
2795
+ const x356: u32 = toU32(w355 >> 32)
2796
+ const w357: u64 = p256FiatAddcarryxU32(x356, x312, x344)
2797
+ const x357: u32 = toU32(w357)
2798
+ const x358: u32 = toU32(w357 >> 32)
2799
+ const w359: u64 = p256FiatAddcarryxU32(x358, x314, x346)
2800
+ const x359: u32 = toU32(w359)
2801
+ const x360: u32 = toU32(w359 >> 32)
2802
+ const w361: u64 = p256FiatAddcarryxU32(x360, x316, x348)
2803
+ const x361: u32 = toU32(w361)
2804
+ const x362: u32 = toU32(w361 >> 32)
2805
+ const w363: u64 = p256FiatAddcarryxU32(x362, x318, x350)
2806
+ const x363: u32 = toU32(w363)
2807
+ const x364: u32 = toU32(w363 >> 32)
2808
+ const w365: u64 = p256FiatAddcarryxU32(x364, x320, x326)
2809
+ const x365: u32 = toU32(w365)
2810
+ const x366: u32 = toU32(w365 >> 32)
2811
+ const w367: u64 = p256FiatAddcarryxU32(x366, x322, x327)
2812
+ const x367: u32 = toU32(w367)
2813
+ const x368: u32 = toU32(w367 >> 32)
2814
+ const x369: u32 = x368 + x323
2815
+ const w370: u64 = p256FiatMulxU32(x4, arg2[7])
2816
+ const x370: u32 = toU32(w370)
2817
+ const x371: u32 = toU32(w370 >> 32)
2818
+ const w372: u64 = p256FiatMulxU32(x4, arg2[6])
2819
+ const x372: u32 = toU32(w372)
2820
+ const x373: u32 = toU32(w372 >> 32)
2821
+ const w374: u64 = p256FiatMulxU32(x4, arg2[5])
2822
+ const x374: u32 = toU32(w374)
2823
+ const x375: u32 = toU32(w374 >> 32)
2824
+ const w376: u64 = p256FiatMulxU32(x4, arg2[4])
2825
+ const x376: u32 = toU32(w376)
2826
+ const x377: u32 = toU32(w376 >> 32)
2827
+ const w378: u64 = p256FiatMulxU32(x4, arg2[3])
2828
+ const x378: u32 = toU32(w378)
2829
+ const x379: u32 = toU32(w378 >> 32)
2830
+ const w380: u64 = p256FiatMulxU32(x4, arg2[2])
2831
+ const x380: u32 = toU32(w380)
2832
+ const x381: u32 = toU32(w380 >> 32)
2833
+ const w382: u64 = p256FiatMulxU32(x4, arg2[1])
2834
+ const x382: u32 = toU32(w382)
2835
+ const x383: u32 = toU32(w382 >> 32)
2836
+ const w384: u64 = p256FiatMulxU32(x4, arg2[0])
2837
+ const x384: u32 = toU32(w384)
2838
+ const x385: u32 = toU32(w384 >> 32)
2839
+ const w386: u64 = p256FiatAddcarryxU32(0x0, x385, x382)
2840
+ const x386: u32 = toU32(w386)
2841
+ const x387: u32 = toU32(w386 >> 32)
2842
+ const w388: u64 = p256FiatAddcarryxU32(x387, x383, x380)
2843
+ const x388: u32 = toU32(w388)
2844
+ const x389: u32 = toU32(w388 >> 32)
2845
+ const w390: u64 = p256FiatAddcarryxU32(x389, x381, x378)
2846
+ const x390: u32 = toU32(w390)
2847
+ const x391: u32 = toU32(w390 >> 32)
2848
+ const w392: u64 = p256FiatAddcarryxU32(x391, x379, x376)
2849
+ const x392: u32 = toU32(w392)
2850
+ const x393: u32 = toU32(w392 >> 32)
2851
+ const w394: u64 = p256FiatAddcarryxU32(x393, x377, x374)
2852
+ const x394: u32 = toU32(w394)
2853
+ const x395: u32 = toU32(w394 >> 32)
2854
+ const w396: u64 = p256FiatAddcarryxU32(x395, x375, x372)
2855
+ const x396: u32 = toU32(w396)
2856
+ const x397: u32 = toU32(w396 >> 32)
2857
+ const w398: u64 = p256FiatAddcarryxU32(x397, x373, x370)
2858
+ const x398: u32 = toU32(w398)
2859
+ const x399: u32 = toU32(w398 >> 32)
2860
+ const x400: u32 = x399 + x371
2861
+ const w401: u64 = p256FiatAddcarryxU32(0x0, x353, x384)
2862
+ const x401: u32 = toU32(w401)
2863
+ const x402: u32 = toU32(w401 >> 32)
2864
+ const w403: u64 = p256FiatAddcarryxU32(x402, x355, x386)
2865
+ const x403: u32 = toU32(w403)
2866
+ const x404: u32 = toU32(w403 >> 32)
2867
+ const w405: u64 = p256FiatAddcarryxU32(x404, x357, x388)
2868
+ const x405: u32 = toU32(w405)
2869
+ const x406: u32 = toU32(w405 >> 32)
2870
+ const w407: u64 = p256FiatAddcarryxU32(x406, x359, x390)
2871
+ const x407: u32 = toU32(w407)
2872
+ const x408: u32 = toU32(w407 >> 32)
2873
+ const w409: u64 = p256FiatAddcarryxU32(x408, x361, x392)
2874
+ const x409: u32 = toU32(w409)
2875
+ const x410: u32 = toU32(w409 >> 32)
2876
+ const w411: u64 = p256FiatAddcarryxU32(x410, x363, x394)
2877
+ const x411: u32 = toU32(w411)
2878
+ const x412: u32 = toU32(w411 >> 32)
2879
+ const w413: u64 = p256FiatAddcarryxU32(x412, x365, x396)
2880
+ const x413: u32 = toU32(w413)
2881
+ const x414: u32 = toU32(w413 >> 32)
2882
+ const w415: u64 = p256FiatAddcarryxU32(x414, x367, x398)
2883
+ const x415: u32 = toU32(w415)
2884
+ const x416: u32 = toU32(w415 >> 32)
2885
+ const w417: u64 = p256FiatAddcarryxU32(x416, x369, x400)
2886
+ const x417: u32 = toU32(w417)
2887
+ const x418: u32 = toU32(w417 >> 32)
2888
+ const w419: u64 = p256FiatMulxU32(x401, 0xee00bc4f)
2889
+ const x419: u32 = toU32(w419)
2890
+ const w421: u64 = p256FiatMulxU32(x419, 0xffffffff)
2891
+ const x421: u32 = toU32(w421)
2892
+ const x422: u32 = toU32(w421 >> 32)
2893
+ const w423: u64 = p256FiatMulxU32(x419, 0xffffffff)
2894
+ const x423: u32 = toU32(w423)
2895
+ const x424: u32 = toU32(w423 >> 32)
2896
+ const w425: u64 = p256FiatMulxU32(x419, 0xffffffff)
2897
+ const x425: u32 = toU32(w425)
2898
+ const x426: u32 = toU32(w425 >> 32)
2899
+ const w427: u64 = p256FiatMulxU32(x419, 0xbce6faad)
2900
+ const x427: u32 = toU32(w427)
2901
+ const x428: u32 = toU32(w427 >> 32)
2902
+ const w429: u64 = p256FiatMulxU32(x419, 0xa7179e84)
2903
+ const x429: u32 = toU32(w429)
2904
+ const x430: u32 = toU32(w429 >> 32)
2905
+ const w431: u64 = p256FiatMulxU32(x419, 0xf3b9cac2)
2906
+ const x431: u32 = toU32(w431)
2907
+ const x432: u32 = toU32(w431 >> 32)
2908
+ const w433: u64 = p256FiatMulxU32(x419, 0xfc632551)
2909
+ const x433: u32 = toU32(w433)
2910
+ const x434: u32 = toU32(w433 >> 32)
2911
+ const w435: u64 = p256FiatAddcarryxU32(0x0, x434, x431)
2912
+ const x435: u32 = toU32(w435)
2913
+ const x436: u32 = toU32(w435 >> 32)
2914
+ const w437: u64 = p256FiatAddcarryxU32(x436, x432, x429)
2915
+ const x437: u32 = toU32(w437)
2916
+ const x438: u32 = toU32(w437 >> 32)
2917
+ const w439: u64 = p256FiatAddcarryxU32(x438, x430, x427)
2918
+ const x439: u32 = toU32(w439)
2919
+ const x440: u32 = toU32(w439 >> 32)
2920
+ const w441: u64 = p256FiatAddcarryxU32(x440, x428, x425)
2921
+ const x441: u32 = toU32(w441)
2922
+ const x442: u32 = toU32(w441 >> 32)
2923
+ const w443: u64 = p256FiatAddcarryxU32(x442, x426, x423)
2924
+ const x443: u32 = toU32(w443)
2925
+ const x444: u32 = toU32(w443 >> 32)
2926
+ const x445: u32 = x444 + x424
2927
+ const w446: u64 = p256FiatAddcarryxU32(0x0, x401, x433)
2928
+ const x447: u32 = toU32(w446 >> 32)
2929
+ const w448: u64 = p256FiatAddcarryxU32(x447, x403, x435)
2930
+ const x448: u32 = toU32(w448)
2931
+ const x449: u32 = toU32(w448 >> 32)
2932
+ const w450: u64 = p256FiatAddcarryxU32(x449, x405, x437)
2933
+ const x450: u32 = toU32(w450)
2934
+ const x451: u32 = toU32(w450 >> 32)
2935
+ const w452: u64 = p256FiatAddcarryxU32(x451, x407, x439)
2936
+ const x452: u32 = toU32(w452)
2937
+ const x453: u32 = toU32(w452 >> 32)
2938
+ const w454: u64 = p256FiatAddcarryxU32(x453, x409, x441)
2939
+ const x454: u32 = toU32(w454)
2940
+ const x455: u32 = toU32(w454 >> 32)
2941
+ const w456: u64 = p256FiatAddcarryxU32(x455, x411, x443)
2942
+ const x456: u32 = toU32(w456)
2943
+ const x457: u32 = toU32(w456 >> 32)
2944
+ const w458: u64 = p256FiatAddcarryxU32(x457, x413, x445)
2945
+ const x458: u32 = toU32(w458)
2946
+ const x459: u32 = toU32(w458 >> 32)
2947
+ const w460: u64 = p256FiatAddcarryxU32(x459, x415, x421)
2948
+ const x460: u32 = toU32(w460)
2949
+ const x461: u32 = toU32(w460 >> 32)
2950
+ const w462: u64 = p256FiatAddcarryxU32(x461, x417, x422)
2951
+ const x462: u32 = toU32(w462)
2952
+ const x463: u32 = toU32(w462 >> 32)
2953
+ const x464: u32 = x463 + x418
2954
+ const w465: u64 = p256FiatMulxU32(x5, arg2[7])
2955
+ const x465: u32 = toU32(w465)
2956
+ const x466: u32 = toU32(w465 >> 32)
2957
+ const w467: u64 = p256FiatMulxU32(x5, arg2[6])
2958
+ const x467: u32 = toU32(w467)
2959
+ const x468: u32 = toU32(w467 >> 32)
2960
+ const w469: u64 = p256FiatMulxU32(x5, arg2[5])
2961
+ const x469: u32 = toU32(w469)
2962
+ const x470: u32 = toU32(w469 >> 32)
2963
+ const w471: u64 = p256FiatMulxU32(x5, arg2[4])
2964
+ const x471: u32 = toU32(w471)
2965
+ const x472: u32 = toU32(w471 >> 32)
2966
+ const w473: u64 = p256FiatMulxU32(x5, arg2[3])
2967
+ const x473: u32 = toU32(w473)
2968
+ const x474: u32 = toU32(w473 >> 32)
2969
+ const w475: u64 = p256FiatMulxU32(x5, arg2[2])
2970
+ const x475: u32 = toU32(w475)
2971
+ const x476: u32 = toU32(w475 >> 32)
2972
+ const w477: u64 = p256FiatMulxU32(x5, arg2[1])
2973
+ const x477: u32 = toU32(w477)
2974
+ const x478: u32 = toU32(w477 >> 32)
2975
+ const w479: u64 = p256FiatMulxU32(x5, arg2[0])
2976
+ const x479: u32 = toU32(w479)
2977
+ const x480: u32 = toU32(w479 >> 32)
2978
+ const w481: u64 = p256FiatAddcarryxU32(0x0, x480, x477)
2979
+ const x481: u32 = toU32(w481)
2980
+ const x482: u32 = toU32(w481 >> 32)
2981
+ const w483: u64 = p256FiatAddcarryxU32(x482, x478, x475)
2982
+ const x483: u32 = toU32(w483)
2983
+ const x484: u32 = toU32(w483 >> 32)
2984
+ const w485: u64 = p256FiatAddcarryxU32(x484, x476, x473)
2985
+ const x485: u32 = toU32(w485)
2986
+ const x486: u32 = toU32(w485 >> 32)
2987
+ const w487: u64 = p256FiatAddcarryxU32(x486, x474, x471)
2988
+ const x487: u32 = toU32(w487)
2989
+ const x488: u32 = toU32(w487 >> 32)
2990
+ const w489: u64 = p256FiatAddcarryxU32(x488, x472, x469)
2991
+ const x489: u32 = toU32(w489)
2992
+ const x490: u32 = toU32(w489 >> 32)
2993
+ const w491: u64 = p256FiatAddcarryxU32(x490, x470, x467)
2994
+ const x491: u32 = toU32(w491)
2995
+ const x492: u32 = toU32(w491 >> 32)
2996
+ const w493: u64 = p256FiatAddcarryxU32(x492, x468, x465)
2997
+ const x493: u32 = toU32(w493)
2998
+ const x494: u32 = toU32(w493 >> 32)
2999
+ const x495: u32 = x494 + x466
3000
+ const w496: u64 = p256FiatAddcarryxU32(0x0, x448, x479)
3001
+ const x496: u32 = toU32(w496)
3002
+ const x497: u32 = toU32(w496 >> 32)
3003
+ const w498: u64 = p256FiatAddcarryxU32(x497, x450, x481)
3004
+ const x498: u32 = toU32(w498)
3005
+ const x499: u32 = toU32(w498 >> 32)
3006
+ const w500: u64 = p256FiatAddcarryxU32(x499, x452, x483)
3007
+ const x500: u32 = toU32(w500)
3008
+ const x501: u32 = toU32(w500 >> 32)
3009
+ const w502: u64 = p256FiatAddcarryxU32(x501, x454, x485)
3010
+ const x502: u32 = toU32(w502)
3011
+ const x503: u32 = toU32(w502 >> 32)
3012
+ const w504: u64 = p256FiatAddcarryxU32(x503, x456, x487)
3013
+ const x504: u32 = toU32(w504)
3014
+ const x505: u32 = toU32(w504 >> 32)
3015
+ const w506: u64 = p256FiatAddcarryxU32(x505, x458, x489)
3016
+ const x506: u32 = toU32(w506)
3017
+ const x507: u32 = toU32(w506 >> 32)
3018
+ const w508: u64 = p256FiatAddcarryxU32(x507, x460, x491)
3019
+ const x508: u32 = toU32(w508)
3020
+ const x509: u32 = toU32(w508 >> 32)
3021
+ const w510: u64 = p256FiatAddcarryxU32(x509, x462, x493)
3022
+ const x510: u32 = toU32(w510)
3023
+ const x511: u32 = toU32(w510 >> 32)
3024
+ const w512: u64 = p256FiatAddcarryxU32(x511, x464, x495)
3025
+ const x512: u32 = toU32(w512)
3026
+ const x513: u32 = toU32(w512 >> 32)
3027
+ const w514: u64 = p256FiatMulxU32(x496, 0xee00bc4f)
3028
+ const x514: u32 = toU32(w514)
3029
+ const w516: u64 = p256FiatMulxU32(x514, 0xffffffff)
3030
+ const x516: u32 = toU32(w516)
3031
+ const x517: u32 = toU32(w516 >> 32)
3032
+ const w518: u64 = p256FiatMulxU32(x514, 0xffffffff)
3033
+ const x518: u32 = toU32(w518)
3034
+ const x519: u32 = toU32(w518 >> 32)
3035
+ const w520: u64 = p256FiatMulxU32(x514, 0xffffffff)
3036
+ const x520: u32 = toU32(w520)
3037
+ const x521: u32 = toU32(w520 >> 32)
3038
+ const w522: u64 = p256FiatMulxU32(x514, 0xbce6faad)
3039
+ const x522: u32 = toU32(w522)
3040
+ const x523: u32 = toU32(w522 >> 32)
3041
+ const w524: u64 = p256FiatMulxU32(x514, 0xa7179e84)
3042
+ const x524: u32 = toU32(w524)
3043
+ const x525: u32 = toU32(w524 >> 32)
3044
+ const w526: u64 = p256FiatMulxU32(x514, 0xf3b9cac2)
3045
+ const x526: u32 = toU32(w526)
3046
+ const x527: u32 = toU32(w526 >> 32)
3047
+ const w528: u64 = p256FiatMulxU32(x514, 0xfc632551)
3048
+ const x528: u32 = toU32(w528)
3049
+ const x529: u32 = toU32(w528 >> 32)
3050
+ const w530: u64 = p256FiatAddcarryxU32(0x0, x529, x526)
3051
+ const x530: u32 = toU32(w530)
3052
+ const x531: u32 = toU32(w530 >> 32)
3053
+ const w532: u64 = p256FiatAddcarryxU32(x531, x527, x524)
3054
+ const x532: u32 = toU32(w532)
3055
+ const x533: u32 = toU32(w532 >> 32)
3056
+ const w534: u64 = p256FiatAddcarryxU32(x533, x525, x522)
3057
+ const x534: u32 = toU32(w534)
3058
+ const x535: u32 = toU32(w534 >> 32)
3059
+ const w536: u64 = p256FiatAddcarryxU32(x535, x523, x520)
3060
+ const x536: u32 = toU32(w536)
3061
+ const x537: u32 = toU32(w536 >> 32)
3062
+ const w538: u64 = p256FiatAddcarryxU32(x537, x521, x518)
3063
+ const x538: u32 = toU32(w538)
3064
+ const x539: u32 = toU32(w538 >> 32)
3065
+ const x540: u32 = x539 + x519
3066
+ const w541: u64 = p256FiatAddcarryxU32(0x0, x496, x528)
3067
+ const x542: u32 = toU32(w541 >> 32)
3068
+ const w543: u64 = p256FiatAddcarryxU32(x542, x498, x530)
3069
+ const x543: u32 = toU32(w543)
3070
+ const x544: u32 = toU32(w543 >> 32)
3071
+ const w545: u64 = p256FiatAddcarryxU32(x544, x500, x532)
3072
+ const x545: u32 = toU32(w545)
3073
+ const x546: u32 = toU32(w545 >> 32)
3074
+ const w547: u64 = p256FiatAddcarryxU32(x546, x502, x534)
3075
+ const x547: u32 = toU32(w547)
3076
+ const x548: u32 = toU32(w547 >> 32)
3077
+ const w549: u64 = p256FiatAddcarryxU32(x548, x504, x536)
3078
+ const x549: u32 = toU32(w549)
3079
+ const x550: u32 = toU32(w549 >> 32)
3080
+ const w551: u64 = p256FiatAddcarryxU32(x550, x506, x538)
3081
+ const x551: u32 = toU32(w551)
3082
+ const x552: u32 = toU32(w551 >> 32)
3083
+ const w553: u64 = p256FiatAddcarryxU32(x552, x508, x540)
3084
+ const x553: u32 = toU32(w553)
3085
+ const x554: u32 = toU32(w553 >> 32)
3086
+ const w555: u64 = p256FiatAddcarryxU32(x554, x510, x516)
3087
+ const x555: u32 = toU32(w555)
3088
+ const x556: u32 = toU32(w555 >> 32)
3089
+ const w557: u64 = p256FiatAddcarryxU32(x556, x512, x517)
3090
+ const x557: u32 = toU32(w557)
3091
+ const x558: u32 = toU32(w557 >> 32)
3092
+ const x559: u32 = x558 + x513
3093
+ const w560: u64 = p256FiatMulxU32(x6, arg2[7])
3094
+ const x560: u32 = toU32(w560)
3095
+ const x561: u32 = toU32(w560 >> 32)
3096
+ const w562: u64 = p256FiatMulxU32(x6, arg2[6])
3097
+ const x562: u32 = toU32(w562)
3098
+ const x563: u32 = toU32(w562 >> 32)
3099
+ const w564: u64 = p256FiatMulxU32(x6, arg2[5])
3100
+ const x564: u32 = toU32(w564)
3101
+ const x565: u32 = toU32(w564 >> 32)
3102
+ const w566: u64 = p256FiatMulxU32(x6, arg2[4])
3103
+ const x566: u32 = toU32(w566)
3104
+ const x567: u32 = toU32(w566 >> 32)
3105
+ const w568: u64 = p256FiatMulxU32(x6, arg2[3])
3106
+ const x568: u32 = toU32(w568)
3107
+ const x569: u32 = toU32(w568 >> 32)
3108
+ const w570: u64 = p256FiatMulxU32(x6, arg2[2])
3109
+ const x570: u32 = toU32(w570)
3110
+ const x571: u32 = toU32(w570 >> 32)
3111
+ const w572: u64 = p256FiatMulxU32(x6, arg2[1])
3112
+ const x572: u32 = toU32(w572)
3113
+ const x573: u32 = toU32(w572 >> 32)
3114
+ const w574: u64 = p256FiatMulxU32(x6, arg2[0])
3115
+ const x574: u32 = toU32(w574)
3116
+ const x575: u32 = toU32(w574 >> 32)
3117
+ const w576: u64 = p256FiatAddcarryxU32(0x0, x575, x572)
3118
+ const x576: u32 = toU32(w576)
3119
+ const x577: u32 = toU32(w576 >> 32)
3120
+ const w578: u64 = p256FiatAddcarryxU32(x577, x573, x570)
3121
+ const x578: u32 = toU32(w578)
3122
+ const x579: u32 = toU32(w578 >> 32)
3123
+ const w580: u64 = p256FiatAddcarryxU32(x579, x571, x568)
3124
+ const x580: u32 = toU32(w580)
3125
+ const x581: u32 = toU32(w580 >> 32)
3126
+ const w582: u64 = p256FiatAddcarryxU32(x581, x569, x566)
3127
+ const x582: u32 = toU32(w582)
3128
+ const x583: u32 = toU32(w582 >> 32)
3129
+ const w584: u64 = p256FiatAddcarryxU32(x583, x567, x564)
3130
+ const x584: u32 = toU32(w584)
3131
+ const x585: u32 = toU32(w584 >> 32)
3132
+ const w586: u64 = p256FiatAddcarryxU32(x585, x565, x562)
3133
+ const x586: u32 = toU32(w586)
3134
+ const x587: u32 = toU32(w586 >> 32)
3135
+ const w588: u64 = p256FiatAddcarryxU32(x587, x563, x560)
3136
+ const x588: u32 = toU32(w588)
3137
+ const x589: u32 = toU32(w588 >> 32)
3138
+ const x590: u32 = x589 + x561
3139
+ const w591: u64 = p256FiatAddcarryxU32(0x0, x543, x574)
3140
+ const x591: u32 = toU32(w591)
3141
+ const x592: u32 = toU32(w591 >> 32)
3142
+ const w593: u64 = p256FiatAddcarryxU32(x592, x545, x576)
3143
+ const x593: u32 = toU32(w593)
3144
+ const x594: u32 = toU32(w593 >> 32)
3145
+ const w595: u64 = p256FiatAddcarryxU32(x594, x547, x578)
3146
+ const x595: u32 = toU32(w595)
3147
+ const x596: u32 = toU32(w595 >> 32)
3148
+ const w597: u64 = p256FiatAddcarryxU32(x596, x549, x580)
3149
+ const x597: u32 = toU32(w597)
3150
+ const x598: u32 = toU32(w597 >> 32)
3151
+ const w599: u64 = p256FiatAddcarryxU32(x598, x551, x582)
3152
+ const x599: u32 = toU32(w599)
3153
+ const x600: u32 = toU32(w599 >> 32)
3154
+ const w601: u64 = p256FiatAddcarryxU32(x600, x553, x584)
3155
+ const x601: u32 = toU32(w601)
3156
+ const x602: u32 = toU32(w601 >> 32)
3157
+ const w603: u64 = p256FiatAddcarryxU32(x602, x555, x586)
3158
+ const x603: u32 = toU32(w603)
3159
+ const x604: u32 = toU32(w603 >> 32)
3160
+ const w605: u64 = p256FiatAddcarryxU32(x604, x557, x588)
3161
+ const x605: u32 = toU32(w605)
3162
+ const x606: u32 = toU32(w605 >> 32)
3163
+ const w607: u64 = p256FiatAddcarryxU32(x606, x559, x590)
3164
+ const x607: u32 = toU32(w607)
3165
+ const x608: u32 = toU32(w607 >> 32)
3166
+ const w609: u64 = p256FiatMulxU32(x591, 0xee00bc4f)
3167
+ const x609: u32 = toU32(w609)
3168
+ const w611: u64 = p256FiatMulxU32(x609, 0xffffffff)
3169
+ const x611: u32 = toU32(w611)
3170
+ const x612: u32 = toU32(w611 >> 32)
3171
+ const w613: u64 = p256FiatMulxU32(x609, 0xffffffff)
3172
+ const x613: u32 = toU32(w613)
3173
+ const x614: u32 = toU32(w613 >> 32)
3174
+ const w615: u64 = p256FiatMulxU32(x609, 0xffffffff)
3175
+ const x615: u32 = toU32(w615)
3176
+ const x616: u32 = toU32(w615 >> 32)
3177
+ const w617: u64 = p256FiatMulxU32(x609, 0xbce6faad)
3178
+ const x617: u32 = toU32(w617)
3179
+ const x618: u32 = toU32(w617 >> 32)
3180
+ const w619: u64 = p256FiatMulxU32(x609, 0xa7179e84)
3181
+ const x619: u32 = toU32(w619)
3182
+ const x620: u32 = toU32(w619 >> 32)
3183
+ const w621: u64 = p256FiatMulxU32(x609, 0xf3b9cac2)
3184
+ const x621: u32 = toU32(w621)
3185
+ const x622: u32 = toU32(w621 >> 32)
3186
+ const w623: u64 = p256FiatMulxU32(x609, 0xfc632551)
3187
+ const x623: u32 = toU32(w623)
3188
+ const x624: u32 = toU32(w623 >> 32)
3189
+ const w625: u64 = p256FiatAddcarryxU32(0x0, x624, x621)
3190
+ const x625: u32 = toU32(w625)
3191
+ const x626: u32 = toU32(w625 >> 32)
3192
+ const w627: u64 = p256FiatAddcarryxU32(x626, x622, x619)
3193
+ const x627: u32 = toU32(w627)
3194
+ const x628: u32 = toU32(w627 >> 32)
3195
+ const w629: u64 = p256FiatAddcarryxU32(x628, x620, x617)
3196
+ const x629: u32 = toU32(w629)
3197
+ const x630: u32 = toU32(w629 >> 32)
3198
+ const w631: u64 = p256FiatAddcarryxU32(x630, x618, x615)
3199
+ const x631: u32 = toU32(w631)
3200
+ const x632: u32 = toU32(w631 >> 32)
3201
+ const w633: u64 = p256FiatAddcarryxU32(x632, x616, x613)
3202
+ const x633: u32 = toU32(w633)
3203
+ const x634: u32 = toU32(w633 >> 32)
3204
+ const x635: u32 = x634 + x614
3205
+ const w636: u64 = p256FiatAddcarryxU32(0x0, x591, x623)
3206
+ const x637: u32 = toU32(w636 >> 32)
3207
+ const w638: u64 = p256FiatAddcarryxU32(x637, x593, x625)
3208
+ const x638: u32 = toU32(w638)
3209
+ const x639: u32 = toU32(w638 >> 32)
3210
+ const w640: u64 = p256FiatAddcarryxU32(x639, x595, x627)
3211
+ const x640: u32 = toU32(w640)
3212
+ const x641: u32 = toU32(w640 >> 32)
3213
+ const w642: u64 = p256FiatAddcarryxU32(x641, x597, x629)
3214
+ const x642: u32 = toU32(w642)
3215
+ const x643: u32 = toU32(w642 >> 32)
3216
+ const w644: u64 = p256FiatAddcarryxU32(x643, x599, x631)
3217
+ const x644: u32 = toU32(w644)
3218
+ const x645: u32 = toU32(w644 >> 32)
3219
+ const w646: u64 = p256FiatAddcarryxU32(x645, x601, x633)
3220
+ const x646: u32 = toU32(w646)
3221
+ const x647: u32 = toU32(w646 >> 32)
3222
+ const w648: u64 = p256FiatAddcarryxU32(x647, x603, x635)
3223
+ const x648: u32 = toU32(w648)
3224
+ const x649: u32 = toU32(w648 >> 32)
3225
+ const w650: u64 = p256FiatAddcarryxU32(x649, x605, x611)
3226
+ const x650: u32 = toU32(w650)
3227
+ const x651: u32 = toU32(w650 >> 32)
3228
+ const w652: u64 = p256FiatAddcarryxU32(x651, x607, x612)
3229
+ const x652: u32 = toU32(w652)
3230
+ const x653: u32 = toU32(w652 >> 32)
3231
+ const x654: u32 = x653 + x608
3232
+ const w655: u64 = p256FiatMulxU32(x7, arg2[7])
3233
+ const x655: u32 = toU32(w655)
3234
+ const x656: u32 = toU32(w655 >> 32)
3235
+ const w657: u64 = p256FiatMulxU32(x7, arg2[6])
3236
+ const x657: u32 = toU32(w657)
3237
+ const x658: u32 = toU32(w657 >> 32)
3238
+ const w659: u64 = p256FiatMulxU32(x7, arg2[5])
3239
+ const x659: u32 = toU32(w659)
3240
+ const x660: u32 = toU32(w659 >> 32)
3241
+ const w661: u64 = p256FiatMulxU32(x7, arg2[4])
3242
+ const x661: u32 = toU32(w661)
3243
+ const x662: u32 = toU32(w661 >> 32)
3244
+ const w663: u64 = p256FiatMulxU32(x7, arg2[3])
3245
+ const x663: u32 = toU32(w663)
3246
+ const x664: u32 = toU32(w663 >> 32)
3247
+ const w665: u64 = p256FiatMulxU32(x7, arg2[2])
3248
+ const x665: u32 = toU32(w665)
3249
+ const x666: u32 = toU32(w665 >> 32)
3250
+ const w667: u64 = p256FiatMulxU32(x7, arg2[1])
3251
+ const x667: u32 = toU32(w667)
3252
+ const x668: u32 = toU32(w667 >> 32)
3253
+ const w669: u64 = p256FiatMulxU32(x7, arg2[0])
3254
+ const x669: u32 = toU32(w669)
3255
+ const x670: u32 = toU32(w669 >> 32)
3256
+ const w671: u64 = p256FiatAddcarryxU32(0x0, x670, x667)
3257
+ const x671: u32 = toU32(w671)
3258
+ const x672: u32 = toU32(w671 >> 32)
3259
+ const w673: u64 = p256FiatAddcarryxU32(x672, x668, x665)
3260
+ const x673: u32 = toU32(w673)
3261
+ const x674: u32 = toU32(w673 >> 32)
3262
+ const w675: u64 = p256FiatAddcarryxU32(x674, x666, x663)
3263
+ const x675: u32 = toU32(w675)
3264
+ const x676: u32 = toU32(w675 >> 32)
3265
+ const w677: u64 = p256FiatAddcarryxU32(x676, x664, x661)
3266
+ const x677: u32 = toU32(w677)
3267
+ const x678: u32 = toU32(w677 >> 32)
3268
+ const w679: u64 = p256FiatAddcarryxU32(x678, x662, x659)
3269
+ const x679: u32 = toU32(w679)
3270
+ const x680: u32 = toU32(w679 >> 32)
3271
+ const w681: u64 = p256FiatAddcarryxU32(x680, x660, x657)
3272
+ const x681: u32 = toU32(w681)
3273
+ const x682: u32 = toU32(w681 >> 32)
3274
+ const w683: u64 = p256FiatAddcarryxU32(x682, x658, x655)
3275
+ const x683: u32 = toU32(w683)
3276
+ const x684: u32 = toU32(w683 >> 32)
3277
+ const x685: u32 = x684 + x656
3278
+ const w686: u64 = p256FiatAddcarryxU32(0x0, x638, x669)
3279
+ const x686: u32 = toU32(w686)
3280
+ const x687: u32 = toU32(w686 >> 32)
3281
+ const w688: u64 = p256FiatAddcarryxU32(x687, x640, x671)
3282
+ const x688: u32 = toU32(w688)
3283
+ const x689: u32 = toU32(w688 >> 32)
3284
+ const w690: u64 = p256FiatAddcarryxU32(x689, x642, x673)
3285
+ const x690: u32 = toU32(w690)
3286
+ const x691: u32 = toU32(w690 >> 32)
3287
+ const w692: u64 = p256FiatAddcarryxU32(x691, x644, x675)
3288
+ const x692: u32 = toU32(w692)
3289
+ const x693: u32 = toU32(w692 >> 32)
3290
+ const w694: u64 = p256FiatAddcarryxU32(x693, x646, x677)
3291
+ const x694: u32 = toU32(w694)
3292
+ const x695: u32 = toU32(w694 >> 32)
3293
+ const w696: u64 = p256FiatAddcarryxU32(x695, x648, x679)
3294
+ const x696: u32 = toU32(w696)
3295
+ const x697: u32 = toU32(w696 >> 32)
3296
+ const w698: u64 = p256FiatAddcarryxU32(x697, x650, x681)
3297
+ const x698: u32 = toU32(w698)
3298
+ const x699: u32 = toU32(w698 >> 32)
3299
+ const w700: u64 = p256FiatAddcarryxU32(x699, x652, x683)
3300
+ const x700: u32 = toU32(w700)
3301
+ const x701: u32 = toU32(w700 >> 32)
3302
+ const w702: u64 = p256FiatAddcarryxU32(x701, x654, x685)
3303
+ const x702: u32 = toU32(w702)
3304
+ const x703: u32 = toU32(w702 >> 32)
3305
+ const w704: u64 = p256FiatMulxU32(x686, 0xee00bc4f)
3306
+ const x704: u32 = toU32(w704)
3307
+ const w706: u64 = p256FiatMulxU32(x704, 0xffffffff)
3308
+ const x706: u32 = toU32(w706)
3309
+ const x707: u32 = toU32(w706 >> 32)
3310
+ const w708: u64 = p256FiatMulxU32(x704, 0xffffffff)
3311
+ const x708: u32 = toU32(w708)
3312
+ const x709: u32 = toU32(w708 >> 32)
3313
+ const w710: u64 = p256FiatMulxU32(x704, 0xffffffff)
3314
+ const x710: u32 = toU32(w710)
3315
+ const x711: u32 = toU32(w710 >> 32)
3316
+ const w712: u64 = p256FiatMulxU32(x704, 0xbce6faad)
3317
+ const x712: u32 = toU32(w712)
3318
+ const x713: u32 = toU32(w712 >> 32)
3319
+ const w714: u64 = p256FiatMulxU32(x704, 0xa7179e84)
3320
+ const x714: u32 = toU32(w714)
3321
+ const x715: u32 = toU32(w714 >> 32)
3322
+ const w716: u64 = p256FiatMulxU32(x704, 0xf3b9cac2)
3323
+ const x716: u32 = toU32(w716)
3324
+ const x717: u32 = toU32(w716 >> 32)
3325
+ const w718: u64 = p256FiatMulxU32(x704, 0xfc632551)
3326
+ const x718: u32 = toU32(w718)
3327
+ const x719: u32 = toU32(w718 >> 32)
3328
+ const w720: u64 = p256FiatAddcarryxU32(0x0, x719, x716)
3329
+ const x720: u32 = toU32(w720)
3330
+ const x721: u32 = toU32(w720 >> 32)
3331
+ const w722: u64 = p256FiatAddcarryxU32(x721, x717, x714)
3332
+ const x722: u32 = toU32(w722)
3333
+ const x723: u32 = toU32(w722 >> 32)
3334
+ const w724: u64 = p256FiatAddcarryxU32(x723, x715, x712)
3335
+ const x724: u32 = toU32(w724)
3336
+ const x725: u32 = toU32(w724 >> 32)
3337
+ const w726: u64 = p256FiatAddcarryxU32(x725, x713, x710)
3338
+ const x726: u32 = toU32(w726)
3339
+ const x727: u32 = toU32(w726 >> 32)
3340
+ const w728: u64 = p256FiatAddcarryxU32(x727, x711, x708)
3341
+ const x728: u32 = toU32(w728)
3342
+ const x729: u32 = toU32(w728 >> 32)
3343
+ const x730: u32 = x729 + x709
3344
+ const w731: u64 = p256FiatAddcarryxU32(0x0, x686, x718)
3345
+ const x732: u32 = toU32(w731 >> 32)
3346
+ const w733: u64 = p256FiatAddcarryxU32(x732, x688, x720)
3347
+ const x733: u32 = toU32(w733)
3348
+ const x734: u32 = toU32(w733 >> 32)
3349
+ const w735: u64 = p256FiatAddcarryxU32(x734, x690, x722)
3350
+ const x735: u32 = toU32(w735)
3351
+ const x736: u32 = toU32(w735 >> 32)
3352
+ const w737: u64 = p256FiatAddcarryxU32(x736, x692, x724)
3353
+ const x737: u32 = toU32(w737)
3354
+ const x738: u32 = toU32(w737 >> 32)
3355
+ const w739: u64 = p256FiatAddcarryxU32(x738, x694, x726)
3356
+ const x739: u32 = toU32(w739)
3357
+ const x740: u32 = toU32(w739 >> 32)
3358
+ const w741: u64 = p256FiatAddcarryxU32(x740, x696, x728)
3359
+ const x741: u32 = toU32(w741)
3360
+ const x742: u32 = toU32(w741 >> 32)
3361
+ const w743: u64 = p256FiatAddcarryxU32(x742, x698, x730)
3362
+ const x743: u32 = toU32(w743)
3363
+ const x744: u32 = toU32(w743 >> 32)
3364
+ const w745: u64 = p256FiatAddcarryxU32(x744, x700, x706)
3365
+ const x745: u32 = toU32(w745)
3366
+ const x746: u32 = toU32(w745 >> 32)
3367
+ const w747: u64 = p256FiatAddcarryxU32(x746, x702, x707)
3368
+ const x747: u32 = toU32(w747)
3369
+ const x748: u32 = toU32(w747 >> 32)
3370
+ const x749: u32 = x748 + x703
3371
+ const w750: u64 = p256FiatSubborrowxU32(0x0, x733, 0xfc632551)
3372
+ const x750: u32 = toU32(w750)
3373
+ const x751: u32 = toU32(w750 >> 32)
3374
+ const w752: u64 = p256FiatSubborrowxU32(x751, x735, 0xf3b9cac2)
3375
+ const x752: u32 = toU32(w752)
3376
+ const x753: u32 = toU32(w752 >> 32)
3377
+ const w754: u64 = p256FiatSubborrowxU32(x753, x737, 0xa7179e84)
3378
+ const x754: u32 = toU32(w754)
3379
+ const x755: u32 = toU32(w754 >> 32)
3380
+ const w756: u64 = p256FiatSubborrowxU32(x755, x739, 0xbce6faad)
3381
+ const x756: u32 = toU32(w756)
3382
+ const x757: u32 = toU32(w756 >> 32)
3383
+ const w758: u64 = p256FiatSubborrowxU32(x757, x741, 0xffffffff)
3384
+ const x758: u32 = toU32(w758)
3385
+ const x759: u32 = toU32(w758 >> 32)
3386
+ const w760: u64 = p256FiatSubborrowxU32(x759, x743, 0xffffffff)
3387
+ const x760: u32 = toU32(w760)
3388
+ const x761: u32 = toU32(w760 >> 32)
3389
+ const w762: u64 = p256FiatSubborrowxU32(x761, x745, 0x0)
3390
+ const x762: u32 = toU32(w762)
3391
+ const x763: u32 = toU32(w762 >> 32)
3392
+ const w764: u64 = p256FiatSubborrowxU32(x763, x747, 0xffffffff)
3393
+ const x764: u32 = toU32(w764)
3394
+ const x765: u32 = toU32(w764 >> 32)
3395
+ const w766: u64 = p256FiatSubborrowxU32(x765, x749, 0x0)
3396
+ const x767: u32 = toU32(w766 >> 32)
3397
+ const x768: u32 = p256FiatCmovznzU32(x767, x750, x733)
3398
+ const x769: u32 = p256FiatCmovznzU32(x767, x752, x735)
3399
+ const x770: u32 = p256FiatCmovznzU32(x767, x754, x737)
3400
+ const x771: u32 = p256FiatCmovznzU32(x767, x756, x739)
3401
+ const x772: u32 = p256FiatCmovznzU32(x767, x758, x741)
3402
+ const x773: u32 = p256FiatCmovznzU32(x767, x760, x743)
3403
+ const x774: u32 = p256FiatCmovznzU32(x767, x762, x745)
3404
+ const x775: u32 = p256FiatCmovznzU32(x767, x764, x747)
3405
+ out1[0] = x768
3406
+ out1[1] = x769
3407
+ out1[2] = x770
3408
+ out1[3] = x771
3409
+ out1[4] = x772
3410
+ out1[5] = x773
3411
+ out1[6] = x774
3412
+ out1[7] = x775
3413
+ }
3414
+
3415
+ /** fiat's `fiat_p256_scalar_add`: adds two field elements in the Montgomery domain. */
3416
+ const p256FiatScalarAdd = (out1: u32[], arg1: u32[], arg2: u32[]): void => {
3417
+ if (toI32(out1.length) < 8 || toI32(arg1.length) < 8 || toI32(arg2.length) < 8) {
3418
+ return
3419
+ }
3420
+ const w1: u64 = p256FiatAddcarryxU32(0x0, arg1[0], arg2[0])
3421
+ const x1: u32 = toU32(w1)
3422
+ const x2: u32 = toU32(w1 >> 32)
3423
+ const w3: u64 = p256FiatAddcarryxU32(x2, arg1[1], arg2[1])
3424
+ const x3: u32 = toU32(w3)
3425
+ const x4: u32 = toU32(w3 >> 32)
3426
+ const w5: u64 = p256FiatAddcarryxU32(x4, arg1[2], arg2[2])
3427
+ const x5: u32 = toU32(w5)
3428
+ const x6: u32 = toU32(w5 >> 32)
3429
+ const w7: u64 = p256FiatAddcarryxU32(x6, arg1[3], arg2[3])
3430
+ const x7: u32 = toU32(w7)
3431
+ const x8: u32 = toU32(w7 >> 32)
3432
+ const w9: u64 = p256FiatAddcarryxU32(x8, arg1[4], arg2[4])
3433
+ const x9: u32 = toU32(w9)
3434
+ const x10: u32 = toU32(w9 >> 32)
3435
+ const w11: u64 = p256FiatAddcarryxU32(x10, arg1[5], arg2[5])
3436
+ const x11: u32 = toU32(w11)
3437
+ const x12: u32 = toU32(w11 >> 32)
3438
+ const w13: u64 = p256FiatAddcarryxU32(x12, arg1[6], arg2[6])
3439
+ const x13: u32 = toU32(w13)
3440
+ const x14: u32 = toU32(w13 >> 32)
3441
+ const w15: u64 = p256FiatAddcarryxU32(x14, arg1[7], arg2[7])
3442
+ const x15: u32 = toU32(w15)
3443
+ const x16: u32 = toU32(w15 >> 32)
3444
+ const w17: u64 = p256FiatSubborrowxU32(0x0, x1, 0xfc632551)
3445
+ const x17: u32 = toU32(w17)
3446
+ const x18: u32 = toU32(w17 >> 32)
3447
+ const w19: u64 = p256FiatSubborrowxU32(x18, x3, 0xf3b9cac2)
3448
+ const x19: u32 = toU32(w19)
3449
+ const x20: u32 = toU32(w19 >> 32)
3450
+ const w21: u64 = p256FiatSubborrowxU32(x20, x5, 0xa7179e84)
3451
+ const x21: u32 = toU32(w21)
3452
+ const x22: u32 = toU32(w21 >> 32)
3453
+ const w23: u64 = p256FiatSubborrowxU32(x22, x7, 0xbce6faad)
3454
+ const x23: u32 = toU32(w23)
3455
+ const x24: u32 = toU32(w23 >> 32)
3456
+ const w25: u64 = p256FiatSubborrowxU32(x24, x9, 0xffffffff)
3457
+ const x25: u32 = toU32(w25)
3458
+ const x26: u32 = toU32(w25 >> 32)
3459
+ const w27: u64 = p256FiatSubborrowxU32(x26, x11, 0xffffffff)
3460
+ const x27: u32 = toU32(w27)
3461
+ const x28: u32 = toU32(w27 >> 32)
3462
+ const w29: u64 = p256FiatSubborrowxU32(x28, x13, 0x0)
3463
+ const x29: u32 = toU32(w29)
3464
+ const x30: u32 = toU32(w29 >> 32)
3465
+ const w31: u64 = p256FiatSubborrowxU32(x30, x15, 0xffffffff)
3466
+ const x31: u32 = toU32(w31)
3467
+ const x32: u32 = toU32(w31 >> 32)
3468
+ const w33: u64 = p256FiatSubborrowxU32(x32, x16, 0x0)
3469
+ const x34: u32 = toU32(w33 >> 32)
3470
+ const x35: u32 = p256FiatCmovznzU32(x34, x17, x1)
3471
+ const x36: u32 = p256FiatCmovznzU32(x34, x19, x3)
3472
+ const x37: u32 = p256FiatCmovznzU32(x34, x21, x5)
3473
+ const x38: u32 = p256FiatCmovznzU32(x34, x23, x7)
3474
+ const x39: u32 = p256FiatCmovznzU32(x34, x25, x9)
3475
+ const x40: u32 = p256FiatCmovznzU32(x34, x27, x11)
3476
+ const x41: u32 = p256FiatCmovznzU32(x34, x29, x13)
3477
+ const x42: u32 = p256FiatCmovznzU32(x34, x31, x15)
3478
+ out1[0] = x35
3479
+ out1[1] = x36
3480
+ out1[2] = x37
3481
+ out1[3] = x38
3482
+ out1[4] = x39
3483
+ out1[5] = x40
3484
+ out1[6] = x41
3485
+ out1[7] = x42
3486
+ }
3487
+
3488
+ /** fiat's `fiat_p256_scalar_set_one`: returns the field element one in the Montgomery domain. */
3489
+ const p256FiatScalarSetOne = (out1: u32[]): void => {
3490
+ if (toI32(out1.length) < 8) {
3491
+ return
3492
+ }
3493
+ out1[0] = 0x39cdaaf
3494
+ out1[1] = 0xc46353d
3495
+ out1[2] = 0x58e8617b
3496
+ out1[3] = 0x43190552
3497
+ out1[4] = 0x0
3498
+ out1[5] = 0x0
3499
+ out1[6] = 0xffffffff
3500
+ out1[7] = 0x0
3501
+ }
3502
+
3503
+ /** The eight limbs `l0` (least significant) to `l7` written into `out`. */
3504
+ const p256SetLimbs = (
3505
+ out: u32[],
3506
+ l0: u32,
3507
+ l1: u32,
3508
+ l2: u32,
3509
+ l3: u32,
3510
+ l4: u32,
3511
+ l5: u32,
3512
+ l6: u32,
3513
+ l7: u32
3514
+ ): void => {
3515
+ if (toI32(out.length) < 8) {
3516
+ return
3517
+ }
3518
+ out[0] = l0
3519
+ out[1] = l1
3520
+ out[2] = l2
3521
+ out[3] = l3
3522
+ out[4] = l4
3523
+ out[5] = l5
3524
+ out[6] = l6
3525
+ out[7] = l7
3526
+ }
3527
+
3528
+ /** `out = 0`, limb by limb. */
3529
+ const p256SetZero = (out: u32[]): void => {
3530
+ if (toI32(out.length) < 8) {
3531
+ return
3532
+ }
3533
+ for (let i: i32 = 0; i < 8; i++) {
3534
+ out[i] = 0
3535
+ }
3536
+ }
3537
+
3538
+ /** A fresh eight-limb array, zero. */
3539
+ const p256Limbs = (): u32[] => new Array<u32>(8)
3540
+
3541
+ /** The field prime p = 2^256 - 2^224 + 2^192 + 2^96 - 1, as plain limbs. */
3542
+ const p256Prime = (): u32[] => {
3543
+ const out: u32[] = p256Limbs()
3544
+ p256SetLimbs(out, 0xffffffff, 0xffffffff, 0xffffffff, 0, 0, 0, 1, 0xffffffff)
3545
+ return out
3546
+ }
3547
+
3548
+ /** The group order n (SEC 2 §2.4.2), as plain limbs. */
3549
+ const p256Order = (): u32[] => {
3550
+ const out: u32[] = p256Limbs()
3551
+ p256SetLimbs(out, 0xfc632551, 0xf3b9cac2, 0xa7179e84, 0xbce6faad, 0xffffffff, 0xffffffff, 0, 0xffffffff)
3552
+ return out
3553
+ }
3554
+
3555
+ /**
3556
+ * R^2 mod p for R = 2^256: a Montgomery multiply by it takes a plain element
3557
+ * into the Montgomery domain, which is all fiat's `to_montgomery` does.
3558
+ */
3559
+ const p256FieldR2 = (): u32[] => {
3560
+ const out: u32[] = p256Limbs()
3561
+ p256SetLimbs(out, 3, 0, 0xffffffff, 0xfffffffb, 0xfffffffe, 0xffffffff, 0xfffffffd, 4)
3562
+ return out
3563
+ }
3564
+
3565
+ /** R^2 mod n, which does for the scalars what `p256FieldR2` does for the field. */
3566
+ const p256ScalarR2 = (): u32[] => {
3567
+ const out: u32[] = p256Limbs()
3568
+ p256SetLimbs(
3569
+ out,
3570
+ 0xbe79eea2,
3571
+ 0x83244c95,
3572
+ 0x49bd6fa6,
3573
+ 0x4699799c,
3574
+ 0x2b6bec59,
3575
+ 0x2845b239,
3576
+ 0xf3d95620,
3577
+ 0x66e12d94
3578
+ )
3579
+ return out
3580
+ }
3581
+
3582
+ /** The curve's `b` (SEC 2 §2.4.2) times R mod p: `b` in the Montgomery domain. */
3583
+ const p256CurveB = (): u32[] => {
3584
+ const out: u32[] = p256Limbs()
3585
+ p256SetLimbs(
3586
+ out,
3587
+ 0x29c4bddf,
3588
+ 0xd89cdf62,
3589
+ 0x78843090,
3590
+ 0xacf005cd,
3591
+ 0xf7212ed6,
3592
+ 0xe5a220ab,
3593
+ 0x04874834,
3594
+ 0xdc30061d
3595
+ )
3596
+ return out
3597
+ }
3598
+
3599
+ /**
3600
+ * The plain 1, `[1, 0, …, 0]`. A Montgomery multiply by it divides by R, which
3601
+ * takes an element out of the Montgomery domain: fiat's `from_montgomery`.
3602
+ */
3603
+ const p256PlainOne = (): u32[] => {
3604
+ const out: u32[] = p256Limbs()
3605
+ out[0] = 1
3606
+ return out
3607
+ }
3608
+
3609
+ /** `out = a`, limb by limb. */
3610
+ const p256Copy = (out: u32[], a: u32[]): void => {
3611
+ if (toI32(out.length) < 8 || toI32(a.length) < 8) {
3612
+ return
3613
+ }
3614
+ for (let i: i32 = 0; i < 8; i++) {
3615
+ out[i] = a[i]
3616
+ }
3617
+ }
3618
+
3619
+ /**
3620
+ * The plain limbs of the 32 big-endian bytes `bytes[at .. at + 32)`, limb 0
3621
+ * the least significant. A window outside `bytes` leaves `out` as it was;
3622
+ * every caller has checked the length first.
3623
+ */
3624
+ const p256LimbsFromBytes = (out: u32[], bytes: u8[], at: i32): void => {
3625
+ const length: i32 = toI32(bytes.length)
3626
+ if (toI32(out.length) < 8 || at < 0 || at > length - 32) {
3627
+ return
3628
+ }
3629
+ for (let i: i32 = 0; i < 8; i++) {
3630
+ let limb: u32 = 0
3631
+ for (let b: i32 = 0; b < 4; b++) {
3632
+ const j: i32 = at + 28 - 4 * i + b
3633
+ if (j >= 0 && j < length) {
3634
+ limb = (limb << 8) | toU32(bytes[j])
3635
+ }
3636
+ }
3637
+ out[i] = limb
3638
+ }
3639
+ }
3640
+
3641
+ /** The plain limbs `a` as 32 big-endian bytes at `out[at .. at + 32)`. */
3642
+ const p256LimbsToBytes = (out: u8[], at: i32, a: u32[]): void => {
3643
+ const length: i32 = toI32(out.length)
3644
+ if (toI32(a.length) < 8 || at < 0 || at > length - 32) {
3645
+ return
3646
+ }
3647
+ for (let i: i32 = 0; i < 8; i++) {
3648
+ const limb: u32 = a[i]
3649
+ for (let b: i32 = 0; b < 4; b++) {
3650
+ const j: i32 = at + 31 - 4 * i - b
3651
+ if (j >= 0 && j < length) {
3652
+ out[j] = toU8(limb >> toU32(8 * b))
3653
+ }
3654
+ }
3655
+ }
3656
+ }
3657
+
3658
+ /**
3659
+ * `d = a - m` modulo 2^256 for plain limbs, answering the borrow out of the
3660
+ * top limb: 1 when `a` is below `m` and 0 otherwise. Every limb is subtracted
3661
+ * whatever the values, so the answer takes no comparison a secret could steer.
3662
+ */
3663
+ const p256SubBorrow = (d: u32[], a: u32[], m: u32[]): u32 => {
3664
+ if (toI32(d.length) < 8 || toI32(a.length) < 8 || toI32(m.length) < 8) {
3665
+ return 0
3666
+ }
3667
+ let borrow: u32 = 0
3668
+ for (let i: i32 = 0; i < 8; i++) {
3669
+ const w: u64 = p256FiatSubborrowxU32(borrow, a[i], m[i])
3670
+ d[i] = toU32(w)
3671
+ borrow = toU32(w >> 32)
3672
+ }
3673
+ return borrow
3674
+ }
3675
+
3676
+ /**
3677
+ * 1 when the plain value `a` is below `m` and 0 otherwise: the borrow out of
3678
+ * `a - m`, carried through every limb, so the answer takes no comparison a
3679
+ * secret could steer.
3680
+ */
3681
+ const p256Below = (a: u32[], m: u32[]): u32 => p256SubBorrow(new Array<u32>(8), a, m)
3682
+
3683
+ /**
3684
+ * `out = a mod m` for a plain `a` below 2m: `a - m` is computed whatever `a`
3685
+ * is, and fiat's conditional move keeps it when there was no borrow. That is
3686
+ * how an x-coordinate (below p < 2n) and a 256-bit digest are taken mod n.
3687
+ */
3688
+ const p256ReduceOnce = (out: u32[], a: u32[], m: u32[]): void => {
3689
+ const d: u32[] = new Array<u32>(8)
3690
+ p256FiatSelectznz(out, p256SubBorrow(d, a, m), d, a)
3691
+ }
3692
+
3693
+ /**
3694
+ * Whether bit `i` (0 the least significant) of the plain limbs `e` is set.
3695
+ * Only ever asked of a public exponent.
3696
+ */
3697
+ const p256Bit = (e: u32[], i: i32): boolean => {
3698
+ const limb: i32 = i >> 5
3699
+ if (limb < 0 || limb >= 8 || toI32(e.length) < 8) {
3700
+ return false
3701
+ }
3702
+ return ((e[limb] >> toU32(i & 31)) & 1) === 1
3703
+ }
3704
+
3705
+ /**
3706
+ * `out = 1 / a` in the field, as `a^(p - 2)` (Fermat); zero for a zero `a`.
3707
+ * Square-and-multiply from the top bit: the branch is on the exponent's bits,
3708
+ * which are a constant.
3709
+ */
3710
+ const p256FieldInvert = (out: u32[], a: u32[]): void => {
3711
+ const e: u32[] = p256Prime()
3712
+ e[0] = 0xfffffffd
3713
+ const acc: u32[] = p256Limbs()
3714
+ p256FiatSetOne(acc)
3715
+ for (let i: i32 = 255; i >= 0; i--) {
3716
+ p256FiatSquare(acc, acc)
3717
+ if (p256Bit(e, i)) {
3718
+ p256FiatMul(acc, acc, a)
3719
+ }
3720
+ }
3721
+ p256Copy(out, acc)
3722
+ }
3723
+
3724
+ /**
3725
+ * `out = 1 / a` mod n, as `a^(n - 2)` with the scalar Montgomery multiply;
3726
+ * the exponent is public, so the square-and-multiply branches only on a
3727
+ * constant.
3728
+ */
3729
+ const p256ScalarInvert = (out: u32[], a: u32[]): void => {
3730
+ const e: u32[] = p256Order()
3731
+ e[0] = 0xfc63254f
3732
+ const acc: u32[] = p256Limbs()
3733
+ p256FiatScalarSetOne(acc)
3734
+ for (let i: i32 = 255; i >= 0; i--) {
3735
+ p256FiatScalarMul(acc, acc, acc)
3736
+ if (p256Bit(e, i)) {
3737
+ p256FiatScalarMul(acc, acc, a)
3738
+ }
3739
+ }
3740
+ p256Copy(out, acc)
3741
+ }
3742
+
3743
+ /**
3744
+ * A point in projective coordinates (X : Y : Z), each coordinate a field
3745
+ * element in the Montgomery domain. It stands for the affine (X/Z, Y/Z), and
3746
+ * Z = 0 is the identity, which the complete formulas take like any other point.
3747
+ */
3748
+ class P256ProjectivePoint {
3749
+ x: u32[]
3750
+ y: u32[]
3751
+ z: u32[]
3752
+
3753
+ /** The identity, (0 : 1 : 0). */
3754
+ constructor() {
3755
+ this.x = p256Limbs()
3756
+ this.y = p256Limbs()
3757
+ this.z = p256Limbs()
3758
+ p256FiatSetOne(this.y)
3759
+ }
3760
+ }
3761
+
3762
+ /**
3763
+ * The temporaries of one addition or doubling, allocated once per scalar
3764
+ * multiplication rather than once per step, and the curve's `b`, which the
3765
+ * formulas multiply by.
3766
+ */
3767
+ class P256PointScratch {
3768
+ t0: u32[]
3769
+ t1: u32[]
3770
+ t2: u32[]
3771
+ t3: u32[]
3772
+ t4: u32[]
3773
+ sum: P256ProjectivePoint
3774
+ b: u32[]
3775
+
3776
+ constructor() {
3777
+ this.t0 = p256Limbs()
3778
+ this.t1 = p256Limbs()
3779
+ this.t2 = p256Limbs()
3780
+ this.t3 = p256Limbs()
3781
+ this.t4 = p256Limbs()
3782
+ this.sum = new P256ProjectivePoint()
3783
+ this.b = p256CurveB()
3784
+ }
3785
+ }
3786
+
3787
+ /** `out = p`, coordinate by coordinate. */
3788
+ const p256PointCopy = (out: P256ProjectivePoint, p: P256ProjectivePoint): void => {
3789
+ p256Copy(out.x, p.x)
3790
+ p256Copy(out.y, p.y)
3791
+ p256Copy(out.z, p.z)
3792
+ }
3793
+
3794
+ /**
3795
+ * `out = p + q`, by Renes, Costello and Batina's Algorithm 4 (complete
3796
+ * addition for a = -3), step for step in the paper's order and with its names.
3797
+ * `out` may be `p` or `q`: the sum is built in the scratch and copied out.
3798
+ */
3799
+ const p256PointAdd = (
3800
+ out: P256ProjectivePoint,
3801
+ p: P256ProjectivePoint,
3802
+ q: P256ProjectivePoint,
3803
+ s: P256PointScratch
3804
+ ): void => {
3805
+ const t0: u32[] = s.t0
3806
+ const t1: u32[] = s.t1
3807
+ const t2: u32[] = s.t2
3808
+ const t3: u32[] = s.t3
3809
+ const t4: u32[] = s.t4
3810
+ const x3: u32[] = s.sum.x
3811
+ const y3: u32[] = s.sum.y
3812
+ const z3: u32[] = s.sum.z
3813
+ p256FiatMul(t0, p.x, q.x) // 1
3814
+ p256FiatMul(t1, p.y, q.y)
3815
+ p256FiatMul(t2, p.z, q.z)
3816
+ p256FiatAdd(t3, p.x, p.y)
3817
+ p256FiatAdd(t4, q.x, q.y) // 5
3818
+ p256FiatMul(t3, t3, t4)
3819
+ p256FiatAdd(t4, t0, t1)
3820
+ p256FiatSub(t3, t3, t4)
3821
+ p256FiatAdd(t4, p.y, p.z)
3822
+ p256FiatAdd(x3, q.y, q.z) // 10
3823
+ p256FiatMul(t4, t4, x3)
3824
+ p256FiatAdd(x3, t1, t2)
3825
+ p256FiatSub(t4, t4, x3)
3826
+ p256FiatAdd(x3, p.x, p.z)
3827
+ p256FiatAdd(y3, q.x, q.z) // 15
3828
+ p256FiatMul(x3, x3, y3)
3829
+ p256FiatAdd(y3, t0, t2)
3830
+ p256FiatSub(y3, x3, y3)
3831
+ p256FiatMul(z3, s.b, t2)
3832
+ p256FiatSub(x3, y3, z3) // 20
3833
+ p256FiatAdd(z3, x3, x3)
3834
+ p256FiatAdd(x3, x3, z3)
3835
+ p256FiatSub(z3, t1, x3)
3836
+ p256FiatAdd(x3, t1, x3)
3837
+ p256FiatMul(y3, s.b, y3) // 25
3838
+ p256FiatAdd(t1, t2, t2)
3839
+ p256FiatAdd(t2, t1, t2)
3840
+ p256FiatSub(y3, y3, t2)
3841
+ p256FiatSub(y3, y3, t0)
3842
+ p256FiatAdd(t1, y3, y3) // 30
3843
+ p256FiatAdd(y3, t1, y3)
3844
+ p256FiatAdd(t1, t0, t0)
3845
+ p256FiatAdd(t0, t1, t0)
3846
+ p256FiatSub(t0, t0, t2)
3847
+ p256FiatMul(t1, t4, y3) // 35
3848
+ p256FiatMul(t2, t0, y3)
3849
+ p256FiatMul(y3, x3, z3)
3850
+ p256FiatAdd(y3, y3, t2)
3851
+ p256FiatMul(x3, t3, x3)
3852
+ p256FiatSub(x3, x3, t1) // 40
3853
+ p256FiatMul(z3, t4, z3)
3854
+ p256FiatMul(t1, t3, t0)
3855
+ p256FiatAdd(z3, z3, t1)
3856
+ p256PointCopy(out, s.sum)
3857
+ }
3858
+
3859
+ /**
3860
+ * `out = 2p`, by Renes, Costello and Batina's Algorithm 6 (exception-free
3861
+ * doubling for a = -3), step for step. `out` may be `p`.
3862
+ */
3863
+ const p256PointDouble = (out: P256ProjectivePoint, p: P256ProjectivePoint, s: P256PointScratch): void => {
3864
+ const t0: u32[] = s.t0
3865
+ const t1: u32[] = s.t1
3866
+ const t2: u32[] = s.t2
3867
+ const t3: u32[] = s.t3
3868
+ const x3: u32[] = s.sum.x
3869
+ const y3: u32[] = s.sum.y
3870
+ const z3: u32[] = s.sum.z
3871
+ p256FiatSquare(t0, p.x) // 1
3872
+ p256FiatSquare(t1, p.y)
3873
+ p256FiatSquare(t2, p.z)
3874
+ p256FiatMul(t3, p.x, p.y)
3875
+ p256FiatAdd(t3, t3, t3) // 5
3876
+ p256FiatMul(z3, p.x, p.z)
3877
+ p256FiatAdd(z3, z3, z3)
3878
+ p256FiatMul(y3, s.b, t2)
3879
+ p256FiatSub(y3, y3, z3)
3880
+ p256FiatAdd(x3, y3, y3) // 10
3881
+ p256FiatAdd(y3, x3, y3)
3882
+ p256FiatSub(x3, t1, y3)
3883
+ p256FiatAdd(y3, t1, y3)
3884
+ p256FiatMul(y3, x3, y3)
3885
+ p256FiatMul(x3, x3, t3) // 15
3886
+ p256FiatAdd(t3, t2, t2)
3887
+ p256FiatAdd(t2, t2, t3)
3888
+ p256FiatMul(z3, s.b, z3)
3889
+ p256FiatSub(z3, z3, t2)
3890
+ p256FiatSub(z3, z3, t0) // 20
3891
+ p256FiatAdd(t3, z3, z3)
3892
+ p256FiatAdd(z3, z3, t3)
3893
+ p256FiatAdd(t3, t0, t0)
3894
+ p256FiatAdd(t0, t3, t0)
3895
+ p256FiatSub(t0, t0, t2) // 25
3896
+ p256FiatMul(t0, t0, z3)
3897
+ p256FiatAdd(y3, y3, t0)
3898
+ p256FiatMul(t0, p.y, p.z)
3899
+ p256FiatAdd(t0, t0, t0)
3900
+ p256FiatMul(z3, t0, z3) // 30
3901
+ p256FiatSub(x3, x3, z3)
3902
+ p256FiatMul(z3, t0, t1)
3903
+ p256FiatAdd(z3, z3, z3)
3904
+ p256FiatAdd(z3, z3, z3)
3905
+ p256PointCopy(out, s.sum)
3906
+ }
3907
+
3908
+ /** The limbs one table entry takes: X, Y and Z, eight each. */
3909
+ const P256_ENTRY: i32 = 24
3910
+
3911
+ /** `table[at .. at + 8) = a`. */
3912
+ const p256TableStore = (table: u32[], at: i32, a: u32[]): void => {
3913
+ if (toI32(a.length) < 8 || at < 0 || at > toI32(table.length) - 8) {
3914
+ return
3915
+ }
3916
+ for (let i: i32 = 0; i < 8; i++) {
3917
+ table[at + i] = a[i]
3918
+ }
3919
+ }
3920
+
3921
+ /** Table entry `i` (limbs `24i` to `24i + 23`, X then Y then Z) = `p`. */
3922
+ const p256TableStorePoint = (table: u32[], i: i32, p: P256ProjectivePoint): void => {
3923
+ p256TableStore(table, i * P256_ENTRY, p.x)
3924
+ p256TableStore(table, i * P256_ENTRY + 8, p.y)
3925
+ p256TableStore(table, i * P256_ENTRY + 16, p.z)
3926
+ }
3927
+
3928
+ /**
3929
+ * The window table: entry `i` is `i * p`, for `i` from 0 to 15. Built from
3930
+ * `p`, which is public here (G or a received key) and a secret only in that
3931
+ * it is about to be multiplied. Entry 0 is the identity and entry 1 is `p`;
3932
+ * each later one adds `p` to the one before.
3933
+ */
3934
+ const p256TableBuild = (table: u32[], p: P256ProjectivePoint, s: P256PointScratch): void => {
3935
+ const acc = new P256ProjectivePoint()
3936
+ p256TableStorePoint(table, 0, acc)
3937
+ p256PointCopy(acc, p)
3938
+ p256TableStorePoint(table, 1, acc)
3939
+ for (let i: i32 = 2; i < 16; i++) {
3940
+ p256PointAdd(acc, acc, p, s)
3941
+ p256TableStorePoint(table, i, acc)
3942
+ }
3943
+ }
3944
+
3945
+ /**
3946
+ * `out = table[at .. at + 8)` when `hit` is 1, and `out` unchanged when it is
3947
+ * 0, by fiat's conditional move on every limb: the eight loads happen either
3948
+ * way, at an offset that is the caller's loop position, never the secret.
3949
+ */
3950
+ const p256TableMove = (out: u32[], table: u32[], at: i32, hit: u32): void => {
3951
+ if (toI32(out.length) < 8 || at < 0 || at > toI32(table.length) - 8) {
3952
+ return
3953
+ }
3954
+ out[0] = p256FiatCmovznzU32(hit, out[0], table[at])
3955
+ out[1] = p256FiatCmovznzU32(hit, out[1], table[at + 1])
3956
+ out[2] = p256FiatCmovznzU32(hit, out[2], table[at + 2])
3957
+ out[3] = p256FiatCmovznzU32(hit, out[3], table[at + 3])
3958
+ out[4] = p256FiatCmovznzU32(hit, out[4], table[at + 4])
3959
+ out[5] = p256FiatCmovznzU32(hit, out[5], table[at + 5])
3960
+ out[6] = p256FiatCmovznzU32(hit, out[6], table[at + 6])
3961
+ out[7] = p256FiatCmovznzU32(hit, out[7], table[at + 7])
3962
+ }
3963
+
3964
+ /**
3965
+ * The table entry `digit` into `out`, without indexing by `digit`: all
3966
+ * sixteen entries are read, and `p256TableMove` keeps entry `i` when `ctEq`
3967
+ * says `i` is the digit. The loop runs over public positions; the digit only
3968
+ * ever reaches the mask.
3969
+ */
3970
+ const p256TableSelect = (out: P256ProjectivePoint, table: u32[], digit: u32): void => {
3971
+ p256SetZero(out.x)
3972
+ p256SetZero(out.y)
3973
+ p256SetZero(out.z)
3974
+ for (let i: i32 = 0; i < 16; i++) {
3975
+ const hit: u32 = ctEq(toU32(i), digit) & 1
3976
+ p256TableMove(out.x, table, i * P256_ENTRY, hit)
3977
+ p256TableMove(out.y, table, i * P256_ENTRY + 8, hit)
3978
+ p256TableMove(out.z, table, i * P256_ENTRY + 16, hit)
3979
+ }
3980
+ }
3981
+
3982
+ /**
3983
+ * `out = k * p` for 32 big-endian bytes `k`, in constant time: the fixed
3984
+ * 4-bit window described in the module's header. The 64 digits are read from
3985
+ * the top nibble down; their positions are public, their values reach only
3986
+ * `p256TableSelect`. Every window does four doublings, one table read and one
3987
+ * complete addition, so a zero digit or a leading run of zeros costs what any
3988
+ * other digit does.
3989
+ */
3990
+ const p256ScalarMult = (
3991
+ out: P256ProjectivePoint,
3992
+ k: u8[],
3993
+ p: P256ProjectivePoint,
3994
+ s: P256PointScratch
3995
+ ): void => {
3996
+ const kLength: i32 = toI32(k.length)
3997
+ if (kLength < 32) {
3998
+ return
3999
+ }
4000
+ const table: u32[] = new Array<u32>(384)
4001
+ p256TableBuild(table, p, s)
4002
+ const acc = new P256ProjectivePoint()
4003
+ const entry = new P256ProjectivePoint()
4004
+ for (let i: i32 = 0; i < 64; i++) {
4005
+ // Digit i is the high nibble of byte i / 2 when i is even, the low when odd.
4006
+ const at: i32 = i >> 1
4007
+ const byte: u32 = at >= 0 && at < kLength ? toU32(k[at]) : 0
4008
+ const digit: u32 = (byte >> ((1 - toU32(i & 1)) << 2)) & 15
4009
+ p256PointDouble(acc, acc, s)
4010
+ p256PointDouble(acc, acc, s)
4011
+ p256PointDouble(acc, acc, s)
4012
+ p256PointDouble(acc, acc, s)
4013
+ p256TableSelect(entry, table, digit)
4014
+ p256PointAdd(acc, acc, entry, s)
4015
+ }
4016
+ p256PointCopy(out, acc)
4017
+ }
4018
+
4019
+ /** The base point G (SEC 2 §2.4.2), in the Montgomery domain with Z = 1. */
4020
+ const p256Generator = (): P256ProjectivePoint => {
4021
+ const g = new P256ProjectivePoint()
4022
+ const r2: u32[] = p256FieldR2()
4023
+ p256SetLimbs(
4024
+ g.x,
4025
+ 0xd898c296,
4026
+ 0xf4a13945,
4027
+ 0x2deb33a0,
4028
+ 0x77037d81,
4029
+ 0x63a440f2,
4030
+ 0xf8bce6e5,
4031
+ 0xe12c4247,
4032
+ 0x6b17d1f2
4033
+ )
4034
+ p256SetLimbs(
4035
+ g.y,
4036
+ 0x37bf51f5,
4037
+ 0xcbb64068,
4038
+ 0x6b315ece,
4039
+ 0x2bce3357,
4040
+ 0x7c0f9e16,
4041
+ 0x8ee7eb4a,
4042
+ 0xfe1a7f9b,
4043
+ 0x4fe342e2
4044
+ )
4045
+ p256FiatMul(g.x, g.x, r2)
4046
+ p256FiatMul(g.y, g.y, r2)
4047
+ p256FiatSetOne(g.z)
4048
+ return g
4049
+ }
4050
+
4051
+ /**
4052
+ * The affine x of `p` as plain limbs, `X / Z` out of the Montgomery domain,
4053
+ * which is all ECDSA reads of a point. The identity has no affine form; its Z
4054
+ * inverts to zero and so does the answer, which callers rule out first.
4055
+ */
4056
+ const p256AffineX = (x: u32[], p: P256ProjectivePoint): void => {
4057
+ const zInverse: u32[] = p256Limbs()
4058
+ p256FieldInvert(zInverse, p.z)
4059
+ p256FiatMul(x, p.x, zInverse)
4060
+ p256FiatMul(x, x, p256PlainOne())
4061
+ }
4062
+
4063
+ /**
4064
+ * The point a SEC 1 §2.3.4 uncompressed encoding names, or `null` when it
4065
+ * names none: a length other than 65, a first byte other than 0x04, a
4066
+ * coordinate of p or more, or a pair that is not on the curve. The identity
4067
+ * has no 65-byte encoding (SEC 1 writes it as the single byte 0x00), so it is
4068
+ * refused by the length, and its would-be spelling as (0, 0) is not on the
4069
+ * curve. Everything here is public — it is a key someone sent — so it may
4070
+ * branch.
4071
+ */
4072
+ const p256DecodePoint = (bytes: u8[]): P256ProjectivePoint | null => {
4073
+ if (toI32(bytes.length) !== 65 || toI32(bytes[0]) !== 4) {
4074
+ return null
4075
+ }
4076
+ const prime: u32[] = p256Prime()
4077
+ const r2: u32[] = p256FieldR2()
4078
+ const p = new P256ProjectivePoint()
4079
+ p256LimbsFromBytes(p.x, bytes, 1)
4080
+ p256LimbsFromBytes(p.y, bytes, 33)
4081
+ if (p256Below(p.x, prime) === 0 || p256Below(p.y, prime) === 0) {
4082
+ return null
4083
+ }
4084
+ p256FiatMul(p.x, p.x, r2)
4085
+ p256FiatMul(p.y, p.y, r2)
4086
+ p256FiatSetOne(p.z)
4087
+ // y^2 = x^3 - 3x + b, both sides in the Montgomery domain.
4088
+ const lhs: u32[] = p256Limbs()
4089
+ const rhs: u32[] = p256Limbs()
4090
+ const t: u32[] = p256Limbs()
4091
+ p256FiatSquare(lhs, p.y)
4092
+ p256FiatSquare(rhs, p.x)
4093
+ p256FiatMul(rhs, rhs, p.x)
4094
+ p256FiatAdd(t, p.x, p.x)
4095
+ p256FiatAdd(t, t, p.x)
4096
+ p256FiatSub(rhs, rhs, t)
4097
+ p256FiatAdd(rhs, rhs, p256CurveB())
4098
+ p256FiatSub(t, lhs, rhs)
4099
+ if (p256FiatNonzero(t) !== 0) {
4100
+ return null
4101
+ }
4102
+ return p
4103
+ }
4104
+
4105
+ /** `p` as its 65-byte uncompressed SEC 1 encoding; `p` is never the identity here. */
4106
+ const p256EncodePoint = (p: P256ProjectivePoint): u8[] => {
4107
+ const zInverse: u32[] = p256Limbs()
4108
+ const one: u32[] = p256PlainOne()
4109
+ const x: u32[] = p256Limbs()
4110
+ const y: u32[] = p256Limbs()
4111
+ p256FieldInvert(zInverse, p.z)
4112
+ p256FiatMul(x, p.x, zInverse)
4113
+ p256FiatMul(y, p.y, zInverse)
4114
+ p256FiatMul(x, x, one)
4115
+ p256FiatMul(y, y, one)
4116
+ const out: u8[] = new Array<u8>(65)
4117
+ out[0] = 4
4118
+ p256LimbsToBytes(out, 1, x)
4119
+ p256LimbsToBytes(out, 33, y)
4120
+ return out
4121
+ }
4122
+
4123
+ /**
4124
+ * Whether 32 big-endian bytes hold a scalar in [1, n), the range of a private
4125
+ * key, a nonce and each half of a signature. Constant time in the value; the
4126
+ * caller branches on the answer, which says only that the input was usable.
4127
+ */
4128
+ const p256ScalarInRange = (bytes: u8[]): boolean => {
4129
+ if (toI32(bytes.length) !== 32) {
4130
+ return false
4131
+ }
4132
+ const a: u32[] = p256Limbs()
4133
+ p256LimbsFromBytes(a, bytes, 0)
4134
+ const below: u32 = p256Below(a, p256Order())
4135
+ const zero: u32 = ctEq(p256FiatNonzero(a), 0) & 1
4136
+ return (below & (zero ^ 1)) === 1
4137
+ }
4138
+
4139
+ /**
4140
+ * bits2int of RFC 6979 §2.3.2 for qlen = 256, then reduced mod n: the leftmost
4141
+ * 256 bits of `digest` as an integer, as FIPS 186-4 §6.4 takes a hash, and
4142
+ * then n subtracted once if it is at least n. A digest shorter than 32 bytes
4143
+ * is its own value, zero-extended on the left. Answers plain limbs.
4144
+ */
4145
+ const p256DigestScalar = (out: u32[], digest: u8[]): void => {
4146
+ const length: i32 = toI32(digest.length)
4147
+ const bytes: u8[] = new Array<u8>(32)
4148
+ const take: i32 = length < 32 ? length : 32
4149
+ const skip: i32 = 32 - take
4150
+ for (let i: i32 = 0; i < take && i < length && skip + i < 32; i++) {
4151
+ bytes[skip + i] = digest[i]
4152
+ }
4153
+ const a: u32[] = p256Limbs()
4154
+ p256LimbsFromBytes(a, bytes, 0)
4155
+ p256ReduceOnce(out, a, p256Order())
4156
+ }
4157
+
4158
+ /**
4159
+ * HMAC_K(V || sep || x || h), the key update of RFC 6979 §3.2 steps d and f
4160
+ * (with `sep` 0 and then 1) and, with `x` and `h` empty, step h.3.
4161
+ */
4162
+ const p256NonceKey = (k: u8[], v: u8[], sep: u8, x: u8[], h: u8[]): u8[] => {
4163
+ const mac = new HmacSha256(k)
4164
+ const separator: u8[] = new Array<u8>(1)
4165
+ separator[0] = sep
4166
+ mac.update(v, P256_FROM, toI32(v.length))
4167
+ mac.update(separator, P256_FROM, toI32(separator.length))
4168
+ mac.update(x, P256_FROM, toI32(x.length))
4169
+ mac.update(h, P256_FROM, toI32(h.length))
4170
+ return mac.digest()
4171
+ }
4172
+
4173
+ /**
4174
+ * The signature of the plain scalar `z` (a digest mod n) under the private key
4175
+ * `priv`, already checked to be in [1, n), with the nonce of RFC 6979 §3.2 for
4176
+ * HMAC-SHA-256. For P-256 and SHA-256, qlen = hlen = 256, so one HMAC output
4177
+ * is one candidate `k` (step h.2 runs once) and bits2int is the identity.
4178
+ *
4179
+ * A candidate at or above n, and a `k` that gives `r = 0` or `s = 0`, go round
4180
+ * again through step h.3, as the RFC says. Whether a candidate is below n is a
4181
+ * branch on the secret, and the one the RFC prescribes: it is taken once in
4182
+ * about 2^32 signatures and says only that a discarded value was large.
4183
+ */
4184
+ const p256SignScalar = (priv: u8[], z: u32[]): u8[] => {
4185
+ const n: u32[] = p256Order()
4186
+ const r2: u32[] = p256ScalarR2()
4187
+ const h1: u8[] = new Array<u8>(32)
4188
+ p256LimbsToBytes(h1, 0, z)
4189
+ const empty: u8[] = new Array<u8>(0)
4190
+ let v: u8[] = new Array<u8>(32)
4191
+ let k: u8[] = new Array<u8>(32)
4192
+ for (let i: i32 = 0; i < 32; i++) {
4193
+ v[i] = 1
4194
+ }
4195
+ k = p256NonceKey(k, v, 0, priv, h1) // step d
4196
+ v = hmacSha256(k, v) // step e
4197
+ k = p256NonceKey(k, v, 1, priv, h1) // step f
4198
+ v = hmacSha256(k, v) // step g
4199
+
4200
+ const dM: u32[] = p256Limbs()
4201
+ p256LimbsFromBytes(dM, priv, 0)
4202
+ p256FiatScalarMul(dM, dM, r2)
4203
+ const g: P256ProjectivePoint = p256Generator()
4204
+ const scratch = new P256PointScratch()
4205
+ const point = new P256ProjectivePoint()
4206
+ const x: u32[] = p256Limbs()
4207
+ const r: u32[] = p256Limbs()
4208
+ const kM: u32[] = p256Limbs()
4209
+ const s: u32[] = p256Limbs()
4210
+ while (true) {
4211
+ v = hmacSha256(k, v) // step h.2
4212
+ if (p256ScalarInRange(v)) {
4213
+ p256ScalarMult(point, v, g, scratch)
4214
+ p256AffineX(x, point)
4215
+ p256ReduceOnce(r, x, n)
4216
+ // s = k^-1 (z + r d) mod n. A Montgomery multiply of a plain value by
4217
+ // one in the Montgomery domain answers a plain value, so only d and
4218
+ // k^-1 are converted: r d and then (z + r d) k^-1 come out plain.
4219
+ p256LimbsFromBytes(kM, v, 0)
4220
+ p256FiatScalarMul(kM, kM, r2)
4221
+ p256ScalarInvert(kM, kM)
4222
+ p256FiatScalarMul(s, r, dM)
4223
+ p256FiatScalarAdd(s, s, z)
4224
+ p256FiatScalarMul(s, s, kM)
4225
+ if (p256FiatNonzero(r) !== 0 && p256FiatNonzero(s) !== 0) {
4226
+ const sig: u8[] = new Array<u8>(64)
4227
+ p256LimbsToBytes(sig, 0, r)
4228
+ p256LimbsToBytes(sig, 32, s)
4229
+ return sig
4230
+ }
4231
+ }
4232
+ k = p256NonceKey(k, v, 0, empty, empty) // step h.3
4233
+ v = hmacSha256(k, v)
4234
+ }
4235
+ }
4236
+
4237
+ /**
4238
+ * The public key of `priv`: `priv * G` in the 65-byte uncompressed SEC 1
4239
+ * encoding. Answers `null` unless `priv` is `P256_SCALAR_SIZE` bytes holding a
4240
+ * scalar in [1, n) — 0 and n and everything above are not private keys.
4241
+ */
4242
+ export const p256PublicKey = (priv: u8[]): u8[] | null => {
4243
+ if (!p256ScalarInRange(priv)) {
4244
+ return null
4245
+ }
4246
+ const point = new P256ProjectivePoint()
4247
+ p256ScalarMult(point, priv, p256Generator(), new P256PointScratch())
4248
+ return p256EncodePoint(point)
4249
+ }
4250
+
4251
+ /**
4252
+ * The ECDSA signature (FIPS 186-4 §6.4) of `digest` under `priv`, as `r || s`,
4253
+ * 64 bytes, with the deterministic nonce of RFC 6979 §3.2 over HMAC-SHA-256.
4254
+ * `digest` is the message's hash, taken as bits2int does: its leftmost 256
4255
+ * bits. The same key and digest always give the same signature, and `s` is
4256
+ * not normalised to the lower half. Answers `null` for a private key
4257
+ * `p256PublicKey` would refuse.
4258
+ */
4259
+ export const p256Sign = (priv: u8[], digest: u8[]): u8[] | null => {
4260
+ if (!p256ScalarInRange(priv)) {
4261
+ return null
4262
+ }
4263
+ const z: u32[] = p256Limbs()
4264
+ p256DigestScalar(z, digest)
4265
+ return p256SignScalar(priv, z)
4266
+ }
4267
+
4268
+ /**
4269
+ * Whether `sig` (`r || s`) is a valid ECDSA signature of `digest` under the
4270
+ * public key `pub` (FIPS 186-4 §6.4.2): `r` and `s` in [1, n), and the
4271
+ * x-coordinate of `u1 * G + u2 * Q` equal to `r` mod n, with `w = s^-1`,
4272
+ * `u1 = z w` and `u2 = r w`. A key or signature of the wrong length, a key
4273
+ * that is not a point on the curve, and a sum that is the identity all answer
4274
+ * `false`. Every value here is public, so the answer may be reached by
4275
+ * branches; the multiplications are the constant-time ones all the same.
4276
+ */
4277
+ export const p256Verify = (pub: u8[], digest: u8[], sig: u8[]): boolean => {
4278
+ if (toI32(sig.length) !== 64) {
4279
+ return false
4280
+ }
4281
+ const q: P256ProjectivePoint | null = p256DecodePoint(pub)
4282
+ if (q === null) {
4283
+ return false
4284
+ }
4285
+ const rBytes: u8[] = new Array<u8>(32)
4286
+ const sBytes: u8[] = new Array<u8>(32)
4287
+ for (let i: i32 = 0; i < 32; i++) {
4288
+ rBytes[i] = sig[i]
4289
+ sBytes[i] = sig[i + 32]
4290
+ }
4291
+ if (!p256ScalarInRange(rBytes) || !p256ScalarInRange(sBytes)) {
4292
+ return false
4293
+ }
4294
+ const n: u32[] = p256Order()
4295
+ const r2: u32[] = p256ScalarR2()
4296
+ const r: u32[] = p256Limbs()
4297
+ const w: u32[] = p256Limbs()
4298
+ const z: u32[] = p256Limbs()
4299
+ p256LimbsFromBytes(r, rBytes, 0)
4300
+ p256LimbsFromBytes(w, sBytes, 0)
4301
+ p256DigestScalar(z, digest)
4302
+ // w = s^-1 in the Montgomery domain; u1 = z w and u2 = r w multiply a
4303
+ // plain value by it, so they come out plain.
4304
+ p256FiatScalarMul(w, w, r2)
4305
+ p256ScalarInvert(w, w)
4306
+ const u1: u32[] = p256Limbs()
4307
+ const u2: u32[] = p256Limbs()
4308
+ p256FiatScalarMul(u1, z, w)
4309
+ p256FiatScalarMul(u2, r, w)
4310
+ const u1Bytes: u8[] = new Array<u8>(32)
4311
+ const u2Bytes: u8[] = new Array<u8>(32)
4312
+ p256LimbsToBytes(u1Bytes, 0, u1)
4313
+ p256LimbsToBytes(u2Bytes, 0, u2)
4314
+
4315
+ const scratch = new P256PointScratch()
4316
+ const sum = new P256ProjectivePoint()
4317
+ const other = new P256ProjectivePoint()
4318
+ p256ScalarMult(sum, u1Bytes, p256Generator(), scratch)
4319
+ p256ScalarMult(other, u2Bytes, q, scratch)
4320
+ p256PointAdd(sum, sum, other, scratch)
4321
+ if (p256FiatNonzero(sum.z) === 0) {
4322
+ return false
4323
+ }
4324
+ const x: u32[] = p256Limbs()
4325
+ p256AffineX(x, sum)
4326
+ p256ReduceOnce(x, x, n)
4327
+ const vBytes: u8[] = new Array<u8>(32)
4328
+ p256LimbsToBytes(vBytes, 0, x)
4329
+ return timingSafeEqual(vBytes, rBytes)
4330
+ }
4331
+
4332
+ /** `p256Sign` of the SHA-256 of `msg`: ECDSA with SHA-256 over the whole message. */
4333
+ export const p256SignSha256 = (priv: u8[], msg: u8[]): u8[] | null => p256Sign(priv, sha256(msg))
4334
+
4335
+ /** `p256Verify` of the SHA-256 of `msg`. */
4336
+ export const p256VerifySha256 = (pub: u8[], msg: u8[], sig: u8[]): boolean =>
4337
+ p256Verify(pub, sha256(msg), sig)