text:
// Copyright 2012 The Go Authors. All rights reserved.
// Use of this source code is governed by a BSD-style
// license that can be found in the LICENSE file.

package bn256

func lineFunctionAdd(r, p *twistPoint, q *curvePoint, r2 *gfP2, pool *bnPool) (a, b, c *gfP2, rOut *twistPoint) {
	// See the mixed addition algorithm from "Faster Computation of the
	// Tate Pairing", http://arxiv.org/pdf/0904.0854v3.pdf

	B := newGFp2(pool).Mul(p.x, r.t, pool)

	D := newGFp2(pool).Add(p.y, r.z)
	D.Square(D, pool)
	D.Sub(D, r2)
	D.Sub(D, r.t)
	D.Mul(D, r.t, pool)

	H := newGFp2(pool).Sub(B, r.x)
	I := newGFp2(pool).Square(H, pool)

	E := newGFp2(pool).Add(I, I)
	E.Add(E, E)

	J := newGFp2(pool).Mul(H, E, pool)

	L1 := newGFp2(pool).Sub(D, r.y)
	L1.Sub(L1, r.y)

	V := newGFp2(pool).Mul(r.x, E, pool)

	rOut = newTwistPoint(pool)
	rOut.x.Square(L1, pool)
	rOut.x.Sub(rOut.x, J)
	rOut.x.Sub(rOut.x, V)
	rOut.x.Sub(rOut.x, V)

	rOut.z.Add(r.z, H)
	rOut.z.Square(rOut.z, pool)
	rOut.z.Sub(rOut.z, r.t)
	rOut.z.Sub(rOut.z, I)

	t := newGFp2(pool).Sub(V, rOut.x)
	t.Mul(t, L1, pool)
	t2 := newGFp2(pool).Mul(r.y, J, pool)
	t2.Add(t2, t2)
	rOut.y.Sub(t, t2)

	rOut.t.Square(rOut.z, pool)

	t.Add(p.y, rOut.z)
	t.Square(t, pool)
	t.Sub(t, r2)
	t.Sub(t, rOut.t)

	t2.Mul(L1, p.x, pool)
	t2.Add(t2, t2)
	a = newGFp2(pool)
	a.Sub(t2, t)

	c = newGFp2(pool)
	c.MulScalar(rOut.z, q.y)
	c.Add(c, c)

	b = newGFp2(pool)
	b.SetZero()
	b.Sub(b, L1)
	b.MulScalar(b, q.x)
	b.Add(b, b)

	B.Put(pool)
	D.Put(pool)
	H.Put(pool)
	I.Put(pool)
	E.Put(pool)
	J.Put(pool)
	L1.Put(pool)
	V.Put(pool)
	t.Put(pool)
	t2.Put(pool)

	return
}

func lineFunctionDouble(r *twistPoint, q *curvePoint, pool *bnPool) (a, b, c *gfP2, rOut *twistPoint) {
	// See the doubling algorithm for a=0 from "Faster Computation of the
	// Tate Pairing", http://arxiv.org/pdf/0904.0854v3.pdf

	A := newGFp2(pool).Square(r.x, pool)
	B := newGFp2(pool).Square(r.y, pool)
	C := newGFp2(pool).Square(B, pool)

	D := newGFp2(pool).Add(r.x, B)
	D.Square(D, pool)
	D.Sub(D, A)
	D.Sub(D, C)
	D.Add(D, D)

	E := newGFp2(pool).Add(A, A)
	E.Add(E, A)

	G := newGFp2(pool).Square(E, pool)

	rOut = newTwistPoint(pool)
	rOut.x.Sub(G, D)
	rOut.x.Sub(rOut.x, D)

	rOut.z.Add(r.y, r.z)
	rOut.z.Square(rOut.z, pool)
	rOut.z.Sub(rOut.z, B)
	rOut.z.Sub(rOut.z, r.t)

	rOut.y.Sub(D, rOut.x)
	rOut.y.Mul(rOut.y, E, pool)
	t := newGFp2(pool).Add(C, C)
	t.Add(t, t)
	t.Add(t, t)
	rOut.y.Sub(rOut.y, t)

	rOut.t.Square(rOut.z, pool)

	t.Mul(E, r.t, pool)
	t.Add(t, t)
	b = newGFp2(pool)
	b.SetZero()
	b.Sub(b, t)
	b.MulScalar(b, q.x)

	a = newGFp2(pool)
	a.Add(r.x, E)
	a.Square(a, pool)
	a.Sub(a, A)
	a.Sub(a, G)
	t.Add(B, B)
	t.Add(t, t)
	a.Sub(a, t)

	c = newGFp2(pool)
	c.Mul(rOut.z, r.t, pool)
	c.Add(c, c)
	c.MulScalar(c, q.y)

	A.Put(pool)
	B.Put(pool)
	C.Put(pool)
	D.Put(pool)
	E.Put(pool)
	G.Put(pool)
	t.Put(pool)

	return
}

func mulLine(ret *gfP12, a, b, c *gfP2, pool *bnPool) {
	a2 := newGFp6(pool)
	a2.x.SetZero()
	a2.y.Set(a)
	a2.z.Set(b)
	a2.Mul(a2, ret.x, pool)
	t3 := newGFp6(pool).MulScalar(ret.y, c, pool)

	t := newGFp2(pool)
	t.Add(b, c)
	t2 := newGFp6(pool)
	t2.x.SetZero()
	t2.y.Set(a)
	t2.z.Set(t)
	ret.x.Add(ret.x, ret.y)

	ret.y.Set(t3)

	ret.x.Mul(ret.x, t2, pool)
	ret.x.Sub(ret.x, a2)
	ret.x.Sub(ret.x, ret.y)
	a2.MulTau(a2, pool)
	ret.y.Add(ret.y, a2)

	a2.Put(pool)
	t3.Put(pool)
	t2.Put(pool)
	t.Put(pool)
}

// sixuPlus2NAF is 6u+2 in non-adjacent form.
var sixuPlus2NAF = []int8{0, 0, 0, 1, 0, 0, 0, 0, 0, 1, 0, 0, 1, 0, 0, 0, -1, 0, 1, 0, 1, 0, 0, 0, 0, 1, 0, 1, 0, 0, 0, -1, 0, 1, 0, 0, 0, 1, 0, -1, 0, 0, 0, -1, 0, 1, 0, 0, 0, 0, 0, 1, 0, 0, -1, 0, -1, 0, 0, 0, 0, 1, 0, 0, 0, 1}

// miller implements the Miller loop for calculating the Optimal Ate pairing.
// See algorithm 1 from http://cryptojedi.org/papers/dclxvi-20100714.pdf
func miller(q *twistPoint, p *curvePoint, pool *bnPool) *gfP12 {
	ret := newGFp12(pool)
	ret.SetOne()

	aAffine := newTwistPoint(pool)
	aAffine.Set(q)
	aAffine.MakeAffine(pool)

	bAffine := newCurvePoint(pool)
	bAffine.Set(p)
	bAffine.MakeAffine(pool)

	minusA := newTwistPoint(pool)
	minusA.Negative(aAffine, pool)

	r := newTwistPoint(pool)
	r.Set(aAffine)

	r2 := newGFp2(pool)
	r2.Square(aAffine.y, pool)

	for i := len(sixuPlus2NAF) - 1; i > 0; i-- {
		a, b, c, newR := lineFunctionDouble(r, bAffine, pool)
		if i != len(sixuPlus2NAF)-1 {
			ret.Square(ret, pool)
		}

		mulLine(ret, a, b, c, pool)
		a.Put(pool)
		b.Put(pool)
		c.Put(pool)
		r.Put(pool)
		r = newR

		switch sixuPlus2NAF[i-1] {
		case 1:
			a, b, c, newR = lineFunctionAdd(r, aAffine, bAffine, r2, pool)
		case -1:
			a, b, c, newR = lineFunctionAdd(r, minusA, bAffine, r2, pool)
		default:
			continue
		}

		mulLine(ret, a, b, c, pool)
		a.Put(pool)
		b.Put(pool)
		c.Put(pool)
		r.Put(pool)
		r = newR
	}

	// In order to calculate Q1 we have to convert q from the sextic twist
	// to the full GF(p^12) group, apply the Frobenius there, and convert
	// back.
	//
	// The twist isomorphism is (x', y') -> (xω², yω³). If we consider just
	// x for a moment, then after applying the Frobenius, we have x̄ω^(2p)
	// where x̄ is the conjugate of x. If we are going to apply the inverse
	// isomorphism we need a value with a single coefficient of ω² so we
	// rewrite this as x̄ω^(2p-2)ω². ξ⁶ = ω and, due to the construction of
	// p, 2p-2 is a multiple of six. Therefore we can rewrite as
	// x̄ξ^((p-1)/3)ω² and applying the inverse isomorphism eliminates the
	// ω².
	//
	// A similar argument can be made for the y value.

	q1 := newTwistPoint(pool)
	q1.x.Conjugate(aAffine.x)
	q1.x.Mul(q1.x, xiToPMinus1Over3, pool)
	q1.y.Conjugate(aAffine.y)
	q1.y.Mul(q1.y, xiToPMinus1Over2, pool)
	q1.z.SetOne()
	q1.t.SetOne()

	// For Q2 we are applying the p² Frobenius. The two conjugations cancel
	// out and we are left only with the factors from the isomorphism. In
	// the case of x, we end up with a pure number which is why
	// xiToPSquaredMinus1Over3 is ∈ GF(p). With y we get a factor of -1. We
	// ignore this to end up with -Q2.

	minusQ2 := newTwistPoint(pool)
	minusQ2.x.MulScalar(aAffine.x, xiToPSquaredMinus1Over3)
	minusQ2.y.Set(aAffine.y)
	minusQ2.z.SetOne()
	minusQ2.t.SetOne()

	r2.Square(q1.y, pool)
	a, b, c, newR := lineFunctionAdd(r, q1, bAffine, r2, pool)
	mulLine(ret, a, b, c, pool)
	a.Put(pool)
	b.Put(pool)
	c.Put(pool)
	r.Put(pool)
	r = newR

	r2.Square(minusQ2.y, pool)
	a, b, c, newR = lineFunctionAdd(r, minusQ2, bAffine, r2, pool)
	mulLine(ret, a, b, c, pool)
	a.Put(pool)
	b.Put(pool)
	c.Put(pool)
	r.Put(pool)
	r = newR

	aAffine.Put(pool)
	bAffine.Put(pool)
	minusA.Put(pool)
	r.Put(pool)
	r2.Put(pool)

	return ret
}

// finalExponentiation computes the (p¹²-1)/Order-th power of an element of
// GF(p¹²) to obtain an element of GT (steps 13-15 of algorithm 1 from
// http://cryptojedi.org/papers/dclxvi-20100714.pdf)
func finalExponentiation(in *gfP12, pool *bnPool) *gfP12 {
	t1 := newGFp12(pool)

	// This is the p^6-Frobenius
	t1.x.Negative(in.x)
	t1.y.Set(in.y)

	inv := newGFp12(pool)
	inv.Invert(in, pool)
	t1.Mul(t1, inv, pool)

	t2 := newGFp12(pool).FrobeniusP2(t1, pool)
	t1.Mul(t1, t2, pool)

	fp := newGFp12(pool).Frobenius(t1, pool)
	fp2 := newGFp12(pool).FrobeniusP2(t1, pool)
	fp3 := newGFp12(pool).Frobenius(fp2, pool)

	fu, fu2, fu3 := newGFp12(pool), newGFp12(pool), newGFp12(pool)
	fu.Exp(t1, u, pool)
	fu2.Exp(fu, u, pool)
	fu3.Exp(fu2, u, pool)

	y3 := newGFp12(pool).Frobenius(fu, pool)
	fu2p := newGFp12(pool).Frobenius(fu2, pool)
	fu3p := newGFp12(pool).Frobenius(fu3, pool)
	y2 := newGFp12(pool).FrobeniusP2(fu2, pool)

	y0 := newGFp12(pool)
	y0.Mul(fp, fp2, pool)
	y0.Mul(y0, fp3, pool)

	y1, y4, y5 := newGFp12(pool), newGFp12(pool), newGFp12(pool)
	y1.Conjugate(t1)
	y5.Conjugate(fu2)
	y3.Conjugate(y3)
	y4.Mul(fu, fu2p, pool)
	y4.Conjugate(y4)

	y6 := newGFp12(pool)
	y6.Mul(fu3, fu3p, pool)
	y6.Conjugate(y6)

	t0 := newGFp12(pool)
	t0.Square(y6, pool)
	t0.Mul(t0, y4, pool)
	t0.Mul(t0, y5, pool)
	t1.Mul(y3, y5, pool)
	t1.Mul(t1, t0, pool)
	t0.Mul(t0, y2, pool)
	t1.Square(t1, pool)
	t1.Mul(t1, t0, pool)
	t1.Square(t1, pool)
	t0.Mul(t1, y1, pool)
	t1.Mul(t1, y0, pool)
	t0.Square(t0, pool)
	t0.Mul(t0, t1, pool)

	inv.Put(pool)
	t1.Put(pool)
	t2.Put(pool)
	fp.Put(pool)
	fp2.Put(pool)
	fp3.Put(pool)
	fu.Put(pool)
	fu2.Put(pool)
	fu3.Put(pool)
	fu2p.Put(pool)
	fu3p.Put(pool)
	y0.Put(pool)
	y1.Put(pool)
	y2.Put(pool)
	y3.Put(pool)
	y4.Put(pool)
	y5.Put(pool)
	y6.Put(pool)

	return t0
}

func optimalAte(a *twistPoint, b *curvePoint, pool *bnPool) *gfP12 {
	e := miller(a, b, pool)
	ret := finalExponentiation(e, pool)
	e.Put(pool)

	if a.IsInfinity() || b.IsInfinity() {
		ret.SetOne()
	}

	return ret
}


text:
// Copyright 2012 The Go Authors. All rights reserved.
// Use of this source code is governed by a BSD-style
// license that can be found in the LICENSE file.

package bn256

// For details of the algorithms used, see "Multiplication and Squaring on
// Pairing-Friendly Fields, Devegili et al.
// http://eprint.iacr.org/2006/471.pdf.

import (
	"math/big"
)

// gfP12 implements the field of size p¹² as a quadratic extension of gfP6
// where ω²=τ.
type gfP12 struct {
	x, y *gfP6 // value is xω + y
}

func newGFp12(pool *bnPool) *gfP12 {
	return &gfP12{newGFp6(pool), newGFp6(pool)}
}

func (e *gfP12) String() string {
	return "(" + e.x.String() + "," + e.y.String() + ")"
}

func (e *gfP12) Put(pool *bnPool) {
	e.x.Put(pool)
	e.y.Put(pool)
}

func (e *gfP12) Set(a *gfP12) *gfP12 {
	e.x.Set(a.x)
	e.y.Set(a.y)
	return e
}

func (e *gfP12) SetZero() *gfP12 {
	e.x.SetZero()
	e.y.SetZero()
	return e
}

func (e *gfP12) SetOne() *gfP12 {
	e.x.SetZero()
	e.y.SetOne()
	return e
}

func (e *gfP12) Minimal() {
	e.x.Minimal()
	e.y.Minimal()
}

func (e *gfP12) IsZero() bool {
	e.Minimal()
	return e.x.IsZero() && e.y.IsZero()
}

func (e *gfP12) IsOne() bool {
	e.Minimal()
	return e.x.IsZero() && e.y.IsOne()
}

func (e *gfP12) Conjugate(a *gfP12) *gfP12 {
	e.x.Negative(a.x)
	e.y.Set(a.y)
	return a
}

func (e *gfP12) Negative(a *gfP12) *gfP12 {
	e.x.Negative(a.x)
	e.y.Negative(a.y)
	return e
}

// Frobenius computes (xω+y)^p = x^p ω·ξ^((p-1)/6) + y^p
func (e *gfP12) Frobenius(a *gfP12, pool *bnPool) *gfP12 {
	e.x.Frobenius(a.x, pool)
	e.y.Frobenius(a.y, pool)
	e.x.MulScalar(e.x, xiToPMinus1Over6, pool)
	return e
}

// FrobeniusP2 computes (xω+y)^p² = x^p² ω·ξ^((p²-1)/6) + y^p²
func (e *gfP12) FrobeniusP2(a *gfP12, pool *bnPool) *gfP12 {
	e.x.FrobeniusP2(a.x)
	e.x.MulGFP(e.x, xiToPSquaredMinus1Over6)
	e.y.FrobeniusP2(a.y)
	return e
}

func (e *gfP12) Add(a, b *gfP12) *gfP12 {
	e.x.Add(a.x, b.x)
	e.y.Add(a.y, b.y)
	return e
}

func (e *gfP12) Sub(a, b *gfP12) *gfP12 {
	e.x.Sub(a.x, b.x)
	e.y.Sub(a.y, b.y)
	return e
}

func (e *gfP12) Mul(a, b *gfP12, pool *bnPool) *gfP12 {
	tx := newGFp6(pool)
	tx.Mul(a.x, b.y, pool)
	t := newGFp6(pool)
	t.Mul(b.x, a.y, pool)
	tx.Add(tx, t)

	ty := newGFp6(pool)
	ty.Mul(a.y, b.y, pool)
	t.Mul(a.x, b.x, pool)
	t.MulTau(t, pool)
	e.y.Add(ty, t)
	e.x.Set(tx)

	tx.Put(pool)
	ty.Put(pool)
	t.Put(pool)
	return e
}

func (e *gfP12) MulScalar(a *gfP12, b *gfP6, pool *bnPool) *gfP12 {
	e.x.Mul(e.x, b, pool)
	e.y.Mul(e.y, b, pool)
	return e
}

func (c *gfP12) Exp(a *gfP12, power *big.Int, pool *bnPool) *gfP12 {
	sum := newGFp12(pool)
	sum.SetOne()
	t := newGFp12(pool)

	for i := power.BitLen() - 1; i >= 0; i-- {
		t.Square(sum, pool)
		if power.Bit(i) != 0 {
			sum.Mul(t, a, pool)
		} else {
			sum.Set(t)
		}
	}

	c.Set(sum)

	sum.Put(pool)
	t.Put(pool)

	return c
}

func (e *gfP12) Square(a *gfP12, pool *bnPool) *gfP12 {
	// Complex squaring algorithm
	v0 := newGFp6(pool)
	v0.Mul(a.x, a.y, pool)

	t := newGFp6(pool)
	t.MulTau(a.x, pool)
	t.Add(a.y, t)
	ty := newGFp6(pool)
	ty.Add(a.x, a.y)
	ty.Mul(ty, t, pool)
	ty.Sub(ty, v0)
	t.MulTau(v0, pool)
	ty.Sub(ty, t)

	e.y.Set(ty)
	e.x.Double(v0)

	v0.Put(pool)
	t.Put(pool)
	ty.Put(pool)

	return e
}

func (e *gfP12) Invert(a *gfP12, pool *bnPool) *gfP12 {
	// See "Implementing cryptographic pairings", M. Scott, section 3.2.
	// ftp://136.206.11.249/pub/crypto/pairings.pdf
	t1 := newGFp6(pool)
	t2 := newGFp6(pool)

	t1.Square(a.x, pool)
	t2.Square(a.y, pool)
	t1.MulTau(t1, pool)
	t1.Sub(t2, t1)
	t2.Invert(t1, pool)

	e.x.Negative(a.x)
	e.y.Set(a.y)
	e.MulScalar(e, t2, pool)

	t1.Put(pool)
	t2.Put(pool)

	return e
}

repo_name: dan-v/dosxvpn

repo_language: Go

mime_type: text/x-shellscript


text:
// Copyright 2012 The Go Authors. All rights reserved.
// Use of this source code is governed by a BSD-style
// license that can be found in the LICENSE file.

// Package bn256 implements a particular bilinear group.
//
// Bilinear groups are the basis of many of the new cryptographic protocols
// that have been proposed over the past decade. They consist of a triplet of
// groups (G₁, G₂ and GT) such that there exists a function e(g₁ˣ,g₂ʸ)=gTˣʸ
// (where gₓ is a generator of the respective group). That function is called
// a pairing function.
//
// This package specifically implements the Optimal Ate pairing over a 256-bit
// Barreto-Naehrig curve as described in
// http://cryptojedi.org/papers/dclxvi-20100714.pdf. Its output is compatible
// with the implementation described in that paper.
//
// (This package previously claimed to operate at a 128-bit security level.
// However, recent improvements in attacks mean that is no longer true. See
// https://moderncrypto.org/mail-archive/curves/2016/000740.html.)
package bn256 // import "golang.org/x/crypto/bn256"

import (
	"crypto/rand"
	"io"
	"math/big"
)

// BUG(agl): this implementation is not constant time.
// TODO(agl): keep GF(p²) elements in Mongomery form.

// G1 is an abstract cyclic group. The zero value is suitable for use as the
// output of an operation, but cannot be used as an input.
type G1 struct {
	p *curvePoint
}

// RandomG1 returns x and g₁ˣ where x is a random, non-zero number read from r.
func RandomG1(r io.Reader) (*big.Int, *G1, error) {
	var k *big.Int
	var err error

	for {
		k, err = rand.Int(r, Order)
		if err != nil {
			return nil, nil, err
		}
		if k.Sign() > 0 {
			break
		}
	}

	return k, new(G1).ScalarBaseMult(k), nil
}

func (e *G1) String() string {
	return "bn256.G1" + e.p.String()
}

// ScalarBaseMult sets e to g*k where g is the generator of the group and
// then returns e.
func (e *G1) ScalarBaseMult(k *big.Int) *G1 {
	if e.p == nil {
		e.p = newCurvePoint(nil)
	}
	e.p.Mul(curveGen, k, new(bnPool))
	return e
}

// ScalarMult sets e to a*k and then returns e.
func (e *G1) ScalarMult(a *G1, k *big.Int) *G1 {
	if e.p == nil {
		e.p = newCurvePoint(nil)
	}
	e.p.Mul(a.p, k, new(bnPool))
	return e
}

// Add sets e to a+b and then returns e.
// BUG(agl): this function is not complete: a==b fails.
func (e *G1) Add(a, b *G1) *G1 {
	if e.p == nil {
		e.p = newCurvePoint(nil)
	}
	e.p.Add(a.p, b.p, new(bnPool))
	return e
}

// Neg sets e to -a and then returns e.
func (e *G1) Neg(a *G1) *G1 {
	if e.p == nil {
		e.p = newCurvePoint(nil)
	}
	e.p.Negative(a.p)
	return e
}

// Marshal converts n to a byte slice.
func (e *G1) Marshal() []byte {
	e.p.MakeAffine(nil)

	xBytes := new(big.Int).Mod(e.p.x, p).Bytes()
	yBytes := new(big.Int).Mod(e.p.y, p).Bytes()

	// Each value is a 256-bit number.
	const numBytes = 256 / 8

	ret := make([]byte, numBytes*2)
	copy(ret[1*numBytes-len(xBytes):], xBytes)
	copy(ret[2*numBytes-len(yBytes):], yBytes)

	return ret
}

// Unmarshal sets e to the result of converting the output of Marshal back into
// a group element and then returns e.
func (e *G1) Unmarshal(m []byte) (*G1, bool) {
	// Each value is a 256-bit number.
	const numBytes = 256 / 8

	if len(m) != 2*numBytes {
		return nil, false
	}

	if e.p == nil {
		e.p = newCurvePoint(nil)
	}

	e.p.x.SetBytes(m[0*numBytes : 1*numBytes])
	e.p.y.SetBytes(m[1*numBytes : 2*numBytes])

	if e.p.x.Sign() == 0 && e.p.y.Sign() == 0 {
		// This is the point at infinity.
		e.p.y.SetInt64(1)
		e.p.z.SetInt64(0)
		e.p.t.SetInt64(0)
	} else {
		e.p.z.SetInt64(1)
		e.p.t.SetInt64(1)

		if !e.p.IsOnCurve() {
			return nil, false
		}
	}

	return e, true
}

// G2 is an abstract cyclic group. The zero value is suitable for use as the
// output of an operation, but cannot be used as an input.
type G2 struct {
	p *twistPoint
}

// RandomG1 returns x and g₂ˣ where x is a random, non-zero number read from r.
func RandomG2(r io.Reader) (*big.Int, *G2, error) {
	var k *big.Int
	var err error

	for {
		k, err = rand.Int(r, Order)
		if err != nil {
			return nil, nil, err
		}
		if k.Sign() > 0 {
			break
		}
	}

	return k, new(G2).ScalarBaseMult(k), nil
}

func (e *G2) String() string {
	return "bn256.G2" + e.p.String()
}

// ScalarBaseMult sets e to g*k where g is the generator of the group and
// then returns out.
func (e *G2) ScalarBaseMult(k *big.Int) *G2 {
	if e.p == nil {
		e.p = newTwistPoint(nil)
	}
	e.p.Mul(twistGen, k, new(bnPool))
	return e
}

// ScalarMult sets e to a*k and then returns e.
func (e *G2) ScalarMult(a *G2, k *big.Int) *G2 {
	if e.p == nil {
		e.p = newTwistPoint(nil)
	}
	e.p.Mul(a.p, k, new(bnPool))
	return e
}

// Add sets e to a+b and then returns e.
// BUG(agl): this function is not complete: a==b fails.
func (e *G2) Add(a, b *G2) *G2 {
	if e.p == nil {
		e.p = newTwistPoint(nil)
	}
	e.p.Add(a.p, b.p, new(bnPool))
	return e
}

// Marshal converts n into a byte slice.
func (n *G2) Marshal() []byte {
	n.p.MakeAffine(nil)

	xxBytes := new(big.Int).Mod(n.p.x.x, p).Bytes()
	xyBytes := new(big.Int).Mod(n.p.x.y, p).Bytes()
	yxBytes := new(big.Int).Mod(n.p.y.x, p).Bytes()
	yyBytes := new(big.Int).Mod(n.p.y.y, p).Bytes()

	// Each value is a 256-bit number.
	const numBytes = 256 / 8

	ret := make([]byte, numBytes*4)
	copy(ret[1*numBytes-len(xxBytes):], xxBytes)
	copy(ret[2*numBytes-len(xyBytes):], xyBytes)
	copy(ret[3*numBytes-len(yxBytes):], yxBytes)
	copy(ret[4*numBytes-len(yyBytes):], yyBytes)

	return ret
}

// Unmarshal sets e to the result of converting the output of Marshal back into
// a group element and then returns e.
func (e *G2) Unmarshal(m []byte) (*G2, bool) {
	// Each value is a 256-bit number.
	const numBytes = 256 / 8

	if len(m) != 4*numBytes {
		return nil, false
	}

	if e.p == nil {
		e.p = newTwistPoint(nil)
	}

	e.p.x.x.SetBytes(m[0*numBytes : 1*numBytes])
	e.p.x.y.SetBytes(m[1*numBytes : 2*numBytes])
	e.p.y.x.SetBytes(m[2*numBytes : 3*numBytes])
	e.p.y.y.SetBytes(m[3*numBytes : 4*numBytes])

	if e.p.x.x.Sign() == 0 &&
		e.p.x.y.Sign() == 0 &&
		e.p.y.x.Sign() == 0 &&
		e.p.y.y.Sign() == 0 {
		// This is the point at infinity.
		e.p.y.SetOne()
		e.p.z.SetZero()
		e.p.t.SetZero()
	} else {
		e.p.z.SetOne()
		e.p.t.SetOne()

		if !e.p.IsOnCurve() {
			return nil, false
		}
	}

	return e, true
}

// GT is an abstract cyclic group. The zero value is suitable for use as the
// output of an operation, but cannot be used as an input.
type GT struct {
	p *gfP12
}

func (g *GT) String() string {
	return "bn256.GT" + g.p.String()
}

// ScalarMult sets e to a*k and then returns e.
func (e *GT) ScalarMult(a *GT, k *big.Int) *GT {
	if e.p == nil {
		e.p = newGFp12(nil)
	}
	e.p.Exp(a.p, k, new(bnPool))
	return e
}

// Add sets e to a+b and then returns e.
func (e *GT) Add(a, b *GT) *GT {
	if e.p == nil {
		e.p = newGFp12(nil)
	}
	e.p.Mul(a.p, b.p, new(bnPool))
	return e
}

// Neg sets e to -a and then returns e.
func (e *GT) Neg(a *GT) *GT {
	if e.p == nil {
		e.p = newGFp12(nil)
	}
	e.p.Invert(a.p, new(bnPool))
	return e
}

// Marshal converts n into a byte slice.
func (n *GT) Marshal() []byte {
	n.p.Minimal()

	xxxBytes := n.p.x.x.x.Bytes()
	xxyBytes := n.p.x.x.y.Bytes()
	xyxBytes := n.p.x.y.x.Bytes()
	xyyBytes := n.p.x.y.y.Bytes()
	xzxBytes := n.p.x.z.x.Bytes()
	xzyBytes := n.p.x.z.y.Bytes()
	yxxBytes := n.p.y.x.x.Bytes()
	yxyBytes := n.p.y.x.y.Bytes()
	yyxBytes := n.p.y.y.x.Bytes()
	yyyBytes := n.p.y.y.y.Bytes()
	yzxBytes := n.p.y.z.x.Bytes()
	yzyBytes := n.p.y.z.y.Bytes()

	// Each value is a 256-bit number.
	const numBytes = 256 / 8

	ret := make([]byte, numBytes*12)
	copy(ret[1*numBytes-len(xxxBytes):], xxxBytes)
	copy(ret[2*numBytes-len(xxyBytes):], xxyBytes)
	copy(ret[3*numBytes-len(xyxBytes):], xyxBytes)
	copy(ret[4*numBytes-len(xyyBytes):], xyyBytes)
	copy(ret[5*numBytes-len(xzxBytes):], xzxBytes)
	copy(ret[6*numBytes-len(xzyBytes):], xzyBytes)
	copy(ret[7*numBytes-len(yxxBytes):], yxxBytes)
	copy(ret[8*numBytes-len(yxyBytes):], yxyBytes)
	copy(ret[9*numBytes-len(yyxBytes):], yyxBytes)
	copy(ret[10*numBytes-len(yyyBytes):], yyyBytes)
	copy(ret[11*numBytes-len(yzxBytes):], yzxBytes)
	copy(ret[12*numBytes-len(yzyBytes):], yzyBytes)

	return ret
}

// Unmarshal sets e to the result of converting the output of Marshal back into
// a group element and then returns e.
func (e *GT) Unmarshal(m []byte) (*GT, bool) {
	// Each value is a 256-bit number.
	const numBytes = 256 / 8

	if len(m) != 12*numBytes {
		return nil, false
	}

	if e.p == nil {
		e.p = newGFp12(nil)
	}

	e.p.x.x.x.SetBytes(m[0*numBytes : 1*numBytes])
	e.p.x.x.y.SetBytes(m[1*numBytes : 2*numBytes])
	e.p.x.y.x.SetBytes(m[2*numBytes : 3*numBytes])
	e.p.x.y.y.SetBytes(m[3*numBytes : 4*numBytes])
	e.p.x.z.x.SetBytes(m[4*numBytes : 5*numBytes])
	e.p.x.z.y.SetBytes(m[5*numBytes : 6*numBytes])
	e.p.y.x.x.SetBytes(m[6*numBytes : 7*numBytes])
	e.p.y.x.y.SetBytes(m[7*numBytes : 8*numBytes])
	e.p.y.y.x.SetBytes(m[8*numBytes : 9*numBytes])
	e.p.y.y.y.SetBytes(m[9*numBytes : 10*numBytes])
	e.p.y.z.x.SetBytes(m[10*numBytes : 11*numBytes])
	e.p.y.z.y.SetBytes(m[11*numBytes : 12*numBytes])

	return e, true
}

// Pair calculates an Optimal Ate pairing.
func Pair(g1 *G1, g2 *G2) *GT {
	return &GT{optimalAte(g2.p, g1.p, new(bnPool))}
}

// bnPool implements a tiny cache of *big.Int objects that's used to reduce the
// number of allocations made during processing.
type bnPool struct {
	bns   []*big.Int
	count int
}

func (pool *bnPool) Get() *big.Int {
	if pool == nil {
		return new(big.Int)
	}

	pool.count++
	l := len(pool.bns)
	if l == 0 {
		return new(big.Int)
	}

	bn := pool.bns[l-1]
	pool.bns = pool.bns[:l-1]
	return bn
}

func (pool *bnPool) Put(bn *big.Int) {
	if pool == nil {
		return
	}
	pool.bns = append(pool.bns, bn)
	pool.count--
}

func (pool *bnPool) Count() int {
	return pool.count
}


text:
// Copyright 2012 The Go Authors. All rights reserved.
// Use of this source code is governed by a BSD-style
// license that can be found in the LICENSE file.

package bn256

import (
	"math/big"
)

// curvePoint implements the elliptic curve y²=x³+3. Points are kept in
// Jacobian form and t=z² when valid. G₁ is the set of points of this curve on
// GF(p).
type curvePoint struct {
	x, y, z, t *big.Int
}

var curveB = new(big.Int).SetInt64(3)

// curveGen is the generator of G₁.
var curveGen = &curvePoint{
	new(big.Int).SetInt64(1),
	new(big.Int).SetInt64(-2),
	new(big.Int).SetInt64(1),
	new(big.Int).SetInt64(1),
}

func newCurvePoint(pool *bnPool) *curvePoint {
	return &curvePoint{
		pool.Get(),
		pool.Get(),
		pool.Get(),
		pool.Get(),
	}
}

func (c *curvePoint) String() string {
	c.MakeAffine(new(bnPool))
	return "(" + c.x.String() + ", " + c.y.String() + ")"
}

func (c *curvePoint) Put(pool *bnPool) {
	pool.Put(c.x)
	pool.Put(c.y)
	pool.Put(c.z)
	pool.Put(c.t)
}

func (c *curvePoint) Set(a *curvePoint) {
	c.x.Set(a.x)
	c.y.Set(a.y)
	c.z.Set(a.z)
	c.t.Set(a.t)
}

// IsOnCurve returns true iff c is on the curve where c must be in affine form.
func (c *curvePoint) IsOnCurve() bool {
	yy := new(big.Int).Mul(c.y, c.y)
	xxx := new(big.Int).Mul(c.x, c.x)
	xxx.Mul(xxx, c.x)
	yy.Sub(yy, xxx)
	yy.Sub(yy, curveB)
	if yy.Sign() < 0 || yy.Cmp(p) >= 0 {
		yy.Mod(yy, p)
	}
	return yy.Sign() == 0
}

func (c *curvePoint) SetInfinity() {
	c.z.SetInt64(0)
}

func (c *curvePoint) IsInfinity() bool {
	return c.z.Sign() == 0
}

func (c *curvePoint) Add(a, b *curvePoint, pool *bnPool) {
	if a.IsInfinity() {
		c.Set(b)
		return
	}
	if b.IsInfinity() {
		c.Set(a)
		return
	}

	// See http://hyperelliptic.org/EFD/g1p/auto-code/shortw/jacobian-0/addition/add-2007-bl.op3

	// Normalize the points by replacing a = [x1:y1:z1] and b = [x2:y2:z2]
	// by [u1:s1:z1·z2] and [u2:s2:z1·z2]
	// where u1 = x1·z2², s1 = y1·z2³ and u1 = x2·z1², s2 = y2·z1³
	z1z1 := pool.Get().Mul(a.z, a.z)
	z1z1.Mod(z1z1, p)
	z2z2 := pool.Get().Mul(b.z, b.z)
	z2z2.Mod(z2z2, p)
	u1 := pool.Get().Mul(a.x, z2z2)
	u1.Mod(u1, p)
	u2 := pool.Get().Mul(b.x, z1z1)
	u2.Mod(u2, p)

	t := pool.Get().Mul(b.z, z2z2)
	t.Mod(t, p)
	s1 := pool.Get().Mul(a.y, t)
	s1.Mod(s1, p)

	t.Mul(a.z, z1z1)
	t.Mod(t, p)
	s2 := pool.Get().Mul(b.y, t)
	s2.Mod(s2, p)

	// Compute x = (2h)²(s²-u1-u2)
	// where s = (s2-s1)/(u2-u1) is the slope of the line through
	// (u1,s1) and (u2,s2). The extra factor 2h = 2(u2-u1) comes from the value of z below.
	// This is also:
	// 4(s2-s1)² - 4h²(u1+u2) = 4(s2-s1)² - 4h³ - 4h²(2u1)
	//                        = r² - j - 2v
	// with the notations below.
	h := pool.Get().Sub(u2, u1)
	xEqual := h.Sign() == 0

	t.Add(h, h)
	// i = 4h²
	i := pool.Get().Mul(t, t)
	i.Mod(i, p)
	// j = 4h³
	j := pool.Get().Mul(h, i)
	j.Mod(j, p)

	t.Sub(s2, s1)
	yEqual := t.Sign() == 0
	if xEqual && yEqual {
		c.Double(a, pool)
		return
	}
	r := pool.Get().Add(t, t)

	v := pool.Get().Mul(u1, i)
	v.Mod(v, p)

	// t4 = 4(s2-s1)²
	t4 := pool.Get().Mul(r, r)
	t4.Mod(t4, p)
	t.Add(v, v)
	t6 := pool.Get().Sub(t4, j)
	c.x.Sub(t6, t)

	// Set y = -(2h)³(s1 + s*(x/4h²-u1))
	// This is also
	// y = - 2·s1·j - (s2-s1)(2x - 2i·u1) = r(v-x) - 2·s1·j
	t.Sub(v, c.x) // t7
	t4.Mul(s1, j) // t8
	t4.Mod(t4, p)
	t6.Add(t4, t4) // t9
	t4.Mul(r, t)   // t10
	t4.Mod(t4, p)
	c.y.Sub(t4, t6)

	// Set z = 2(u2-u1)·z1·z2 = 2h·z1·z2
	t.Add(a.z, b.z) // t11
	t4.Mul(t, t)    // t12
	t4.Mod(t4, p)
	t.Sub(t4, z1z1) // t13
	t4.Sub(t, z2z2) // t14
	c.z.Mul(t4, h)
	c.z.Mod(c.z, p)

	pool.Put(z1z1)
	pool.Put(z2z2)
	pool.Put(u1)
	pool.Put(u2)
	pool.Put(t)
	pool.Put(s1)
	pool.Put(s2)
	pool.Put(h)
	pool.Put(i)
	pool.Put(j)
	pool.Put(r)
	pool.Put(v)
	pool.Put(t4)
	pool.Put(t6)
}

func (c *curvePoint) Double(a *curvePoint, pool *bnPool) {
	// See http://hyperelliptic.org/EFD/g1p/auto-code/shortw/jacobian-0/doubling/dbl-2009-l.op3
	A := pool.Get().Mul(a.x, a.x)
	A.Mod(A, p)
	B := pool.Get().Mul(a.y, a.y)
	B.Mod(B, p)
	C := pool.Get().Mul(B, B)
	C.Mod(C, p)

	t := pool.Get().Add(a.x, B)
	t2 := pool.Get().Mul(t, t)
	t2.Mod(t2, p)
	t.Sub(t2, A)
	t2.Sub(t, C)
	d := pool.Get().Add(t2, t2)
	t.Add(A, A)
	e := pool.Get().Add(t, A)
	f := pool.Get().Mul(e, e)
	f.Mod(f, p)

	t.Add(d, d)
	c.x.Sub(f, t)

	t.Add(C, C)
	t2.Add(t, t)
	t.Add(t2, t2)
	c.y.Sub(d, c.x)
	t2.Mul(e, c.y)
	t2.Mod(t2, p)
	c.y.Sub(t2, t)

	t.Mul(a.y, a.z)
	t.Mod(t, p)
	c.z.Add(t, t)

	pool.Put(A)
	pool.Put(B)
	pool.Put(C)
	pool.Put(t)
	pool.Put(t2)
	pool.Put(d)
	pool.Put(e)
	pool.Put(f)
}

func (c *curvePoint) Mul(a *curvePoint, scalar *big.Int, pool *bnPool) *curvePoint {
	sum := newCurvePoint(pool)
	sum.SetInfinity()
	t := newCurvePoint(pool)

	for i := scalar.BitLen(); i >= 0; i-- {
		t.Double(sum, pool)
		if scalar.Bit(i) != 0 {
			sum.Add(t, a, pool)
		} else {
			sum.Set(t)
		}
	}

	c.Set(sum)
	sum.Put(pool)
	t.Put(pool)
	return c
}

func (c *curvePoint) MakeAffine(pool *bnPool) *curvePoint {
	if words := c.z.Bits(); len(words) == 1 && words[0] == 1 {
		return c
	}

	zInv := pool.Get().ModInverse(c.z, p)
	t := pool.Get().Mul(c.y, zInv)
	t.Mod(t, p)
	zInv2 := pool.Get().Mul(zInv, zInv)
	zInv2.Mod(zInv2, p)
	c.y.Mul(t, zInv2)
	c.y.Mod(c.y, p)
	t.Mul(c.x, zInv2)
	t.Mod(t, p)
	c.x.Set(t)
	c.z.SetInt64(1)
	c.t.SetInt64(1)

	pool.Put(zInv)
	pool.Put(t)
	pool.Put(zInv2)

	return c
}

func (c *curvePoint) Negative(a *curvePoint) {
	c.x.Set(a.x)
	c.y.Neg(a.y)
	c.z.Set(a.z)
	c.t.SetInt64(0)
}


text:
// Copyright 2012 The Go Authors. All rights reserved.
// Use of this source code is governed by a BSD-style
// license that can be found in the LICENSE file.

// This code was translated into a form compatible with 6a from the public
// domain sources in SUPERCOP: https://bench.cr.yp.to/supercop.html

// +build amd64,!gccgo,!appengine

// These constants cannot be encoded in non-MOVQ immediates.
// We access them directly from memory instead.

DATA ·_121666_213(SB)/8, $996687872
GLOBL ·_121666_213(SB), 8, $8

DATA ·_2P0(SB)/8, $0xFFFFFFFFFFFDA
GLOBL ·_2P0(SB), 8, $8

DATA ·_2P1234(SB)/8, $0xFFFFFFFFFFFFE
GLOBL ·_2P1234(SB), 8, $8


text:
// Copyright 2012 The Go Authors. All rights reserved.
// Use of this source code is governed by a BSD-style
// license that can be found in the LICENSE file.

// +build amd64,!gccgo,!appengine

package curve25519

// These functions are implemented in the .s files. The names of the functions
// in the rest of the file are also taken from the SUPERCOP sources to help
// people following along.

//go:noescape

func cswap(inout *[5]uint64, v uint64)

//go:noescape

func ladderstep(inout *[5][5]uint64)

//go:noescape

func freeze(inout *[5]uint64)

//go:noescape

func mul(dest, a, b *[5]uint64)

//go:noescape

func square(out, in *[5]uint64)

// mladder uses a Montgomery ladder to calculate (xr/zr) *= s.
func mladder(xr, zr *[5]uint64, s *[32]byte) {
	var work [5][5]uint64

	work[0] = *xr
	setint(&work[1], 1)
	setint(&work[2], 0)
	work[3] = *xr
	setint(&work[4], 1)

	j := uint(6)
	var prevbit byte

	for i := 31; i >= 0; i-- {
		for j < 8 {
			bit := ((*s)[i] >> j) & 1
			swap := bit ^ prevbit
			prevbit = bit
			cswap(&work[1], uint64(swap))
			ladderstep(&work)
			j--
		}
		j = 7
	}

	*xr = work[1]
	*zr = work[2]
}

func scalarMult(out, in, base *[32]byte) {
	var e [32]byte
	copy(e[:], (*in)[:])
	e[0] &= 248
	e[31] &= 127
	e[31] |= 64

	var t, z [5]uint64
	unpack(&t, base)
	mladder(&t, &z, &e)
	invert(&z, &z)
	mul(&t, &t, &z)
	pack(out, &t)
}

func setint(r *[5]uint64, v uint64) {
	r[0] = v
	r[1] = 0
	r[2] = 0
	r[3] = 0
	r[4] = 0
}

// unpack sets r = x where r consists of 5, 51-bit limbs in little-endian
// order.
func unpack(r *[5]uint64, x *[32]byte) {
	r[0] = uint64(x[0]) |
		uint64(x[1])<<8 |
		uint64(x[2])<<16 |
		uint64(x[3])<<24 |
		uint64(x[4])<<32 |
		uint64(x[5])<<40 |
		uint64(x[6]&7)<<48

	r[1] = uint64(x[6])>>3 |
		uint64(x[7])<<5 |
		uint64(x[8])<<13 |
		uint64(x[9])<<21 |
		uint64(x[10])<<29 |
		uint64(x[11])<<37 |
		uint64(x[12]&63)<<45

	r[2] = uint64(x[12])>>6 |
		uint64(x[13])<<2 |
		uint64(x[14])<<10 |
		uint64(x[15])<<18 |
		uint64(x[16])<<26 |
		uint64(x[17])<<34 |
		uint64(x[18])<<42 |
		uint64(x[19]&1)<<50

	r[3] = uint64(x[19])>>1 |
		uint64(x[20])<<7 |
		uint64(x[21])<<15 |
		uint64(x[22])<<23 |
		uint64(x[23])<<31 |
		uint64(x[24])<<39 |
		uint64(x[25]&15)<<47

	r[4] = uint64(x[25])>>4 |
		uint64(x[26])<<4 |
		uint64(x[27])<<12 |
		uint64(x[28])<<20 |
		uint64(x[29])<<28 |
		uint64(x[30])<<36 |
		uint64(x[31]&127)<<44
}

// pack sets out = x where out is the usual, little-endian form of the 5,
// 51-bit limbs in x.
func pack(out *[32]byte, x *[5]uint64) {
	t := *x
	freeze(&t)

	out[0] = byte(t[0])
	out[1] = byte(t[0] >> 8)
	out[2] = byte(t[0] >> 16)
	out[3] = byte(t[0] >> 24)
	out[4] = byte(t[0] >> 32)
	out[5] = byte(t[0] >> 40)
	out[6] = byte(t[0] >> 48)

	out[6] ^= byte(t[1]<<3) & 0xf8
	out[7] = byte(t[1] >> 5)
	out[8] = byte(t[1] >> 13)
	out[9] = byte(t[1] >> 21)
	out[10] = byte(t[1] >> 29)
	out[11] = byte(t[1] >> 37)
	out[12] = byte(t[1] >> 45)

	out[12] ^= byte(t[2]<<6) & 0xc0
	out[13] = byte(t[2] >> 2)
	out[14] = byte(t[2] >> 10)
	out[15] = byte(t[2] >> 18)
	out[16] = byte(t[2] >> 26)
	out[17] = byte(t[2] >> 34)
	out[18] = byte(t[2] >> 42)
	out[19] = byte(t[2] >> 50)

	out[19] ^= byte(t[3]<<1) & 0xfe
	out[20] = byte(t[3] >> 7)
	out[21] = byte(t[3] >> 15)
	out[22] = byte(t[3] >> 23)
	out[23] = byte(t[3] >> 31)
	out[24] = byte(t[3] >> 39)
	out[25] = byte(t[3] >> 47)

	out[25] ^= byte(t[4]<<4) & 0xf0
	out[26] = byte(t[4] >> 4)
	out[27] = byte(t[4] >> 12)
	out[28] = byte(t[4] >> 20)
	out[29] = byte(t[4] >> 28)
	out[30] = byte(t[4] >> 36)
	out[31] = byte(t[4] >> 44)
}

// invert calculates r = x^-1 mod p using Fermat's little theorem.
func invert(r *[5]uint64, x *[5]uint64) {
	var z2, z9, z11, z2_5_0, z2_10_0, z2_20_0, z2_50_0, z2_100_0, t [5]uint64

	square(&z2, x)        /* 2 */
	square(&t, &z2)       /* 4 */
	square(&t, &t)        /* 8 */
	mul(&z9, &t, x)       /* 9 */
	mul(&z11, &z9, &z2)   /* 11 */
	square(&t, &z11)      /* 22 */
	mul(&z2_5_0, &t, &z9) /* 2^5 - 2^0 = 31 */

	square(&t, &z2_5_0)      /* 2^6 - 2^1 */
	for i := 1; i < 5; i++ { /* 2^20 - 2^10 */
		square(&t, &t)
	}
	mul(&z2_10_0, &t, &z2_5_0) /* 2^10 - 2^0 */

	square(&t, &z2_10_0)      /* 2^11 - 2^1 */
	for i := 1; i < 10; i++ { /* 2^20 - 2^10 */
		square(&t, &t)
	}
	mul(&z2_20_0, &t, &z2_10_0) /* 2^20 - 2^0 */

	square(&t, &z2_20_0)      /* 2^21 - 2^1 */
	for i := 1; i < 20; i++ { /* 2^40 - 2^20 */
		square(&t, &t)
	}
	mul(&t, &t, &z2_20_0) /* 2^40 - 2^0 */

	square(&t, &t)            /* 2^41 - 2^1 */
	for i := 1; i < 10; i++ { /* 2^50 - 2^10 */
		square(&t, &t)
	}
	mul(&z2_50_0, &t, &z2_10_0) /* 2^50 - 2^0 */

	square(&t, &z2_50_0)      /* 2^51 - 2^1 */
	for i := 1; i < 50; i++ { /* 2^100 - 2^50 */
		square(&t, &t)
	}
	mul(&z2_100_0, &t, &z2_50_0) /* 2^100 - 2^0 */

	square(&t, &z2_100_0)      /* 2^101 - 2^1 */
	for i := 1; i < 100; i++ { /* 2^200 - 2^100 */
		square(&t, &t)
	}
	mul(&t, &t, &z2_100_0) /* 2^200 - 2^0 */

	square(&t, &t)            /* 2^201 - 2^1 */
	for i := 1; i < 50; i++ { /* 2^250 - 2^50 */
		square(&t, &t)
	}
	mul(&t, &t, &z2_50_0) /* 2^250 - 2^0 */

	square(&t, &t) /* 2^251 - 2^1 */
	square(&t, &t) /* 2^252 - 2^2 */
	square(&t, &t) /* 2^253 - 2^3 */

	square(&t, &t) /* 2^254 - 2^4 */

	square(&t, &t)   /* 2^255 - 2^5 */
	mul(r, &t, &z11) /* 2^255 - 21 */
}


text:
// Copyright 2012 The Go Authors. All rights reserved.
// Use of this source code is governed by a BSD-style
// license that can be found in the LICENSE file.

package curve25519

import (
	"fmt"
	"testing"
)

const expectedHex = "89161fde887b2b53de549af483940106ecc114d6982daa98256de23bdf77661a"

func TestBaseScalarMult(t *testing.T) {
	var a, b [32]byte
	in := &a
	out := &b
	a[0] = 1

	for i := 0; i < 200; i++ {
		ScalarBaseMult(out, in)
		in, out = out, in
	}

	result := fmt.Sprintf("%x", in[:])
	if result != expectedHex {
		t.Errorf("incorrect result: got %s, want %s", result, expectedHex)
	}
}

func BenchmarkScalarBaseMult(b *testing.B) {
	var in, out [32]byte
	in[0] = 1

	b.SetBytes(32)
	for i := 0; i < b.N; i++ {
		ScalarBaseMult(&out, &in)
	}
}


text:
// Copyright 2012 The Go Authors. All rights reserved.
// Use of this source code is governed by a BSD-style
// license that can be found in the LICENSE file.

// This code was translated into a form compatible with 6a from the public
// domain sources in SUPERCOP: https://bench.cr.yp.to/supercop.html

// +build amd64,!gccgo,!appengine

#include "const_amd64.h"

// func square(out, in *[5]uint64)
TEXT ·square(SB),7,$0-16
	MOVQ out+0(FP), DI
	MOVQ in+8(FP), SI

	MOVQ 0(SI),AX
	MULQ 0(SI)
	MOVQ AX,CX
	MOVQ DX,R8
	MOVQ 0(SI),AX
	SHLQ $1,AX
	MULQ 8(SI)
	MOVQ AX,R9
	MOVQ DX,R10
	MOVQ 0(SI),AX
	SHLQ $1,AX
	MULQ 16(SI)
	MOVQ AX,R11
	MOVQ DX,R12
	MOVQ 0(SI),AX
	SHLQ $1,AX
	MULQ 24(SI)
	MOVQ AX,R13
	MOVQ DX,R14
	MOVQ 0(SI),AX
	SHLQ $1,AX
	MULQ 32(SI)
	MOVQ AX,R15
	MOVQ DX,BX
	MOVQ 8(SI),AX
	MULQ 8(SI)
	ADDQ AX,R11
	ADCQ DX,R12
	MOVQ 8(SI),AX
	SHLQ $1,AX
	MULQ 16(SI)
	ADDQ AX,R13
	ADCQ DX,R14
	MOVQ 8(SI),AX
	SHLQ $1,AX
	MULQ 24(SI)
	ADDQ AX,R15
	ADCQ DX,BX
	MOVQ 8(SI),DX
	IMUL3Q $38,DX,AX
	MULQ 32(SI)
	ADDQ AX,CX
	ADCQ DX,R8
	MOVQ 16(SI),AX
	MULQ 16(SI)
	ADDQ AX,R15
	ADCQ DX,BX
	MOVQ 16(SI),DX
	IMUL3Q $38,DX,AX
	MULQ 24(SI)
	ADDQ AX,CX
	ADCQ DX,R8
	MOVQ 16(SI),DX
	IMUL3Q $38,DX,AX
	MULQ 32(SI)
	ADDQ AX,R9
	ADCQ DX,R10
	MOVQ 24(SI),DX
	IMUL3Q $19,DX,AX
	MULQ 24(SI)
	ADDQ AX,R9
	ADCQ DX,R10
	MOVQ 24(SI),DX
	IMUL3Q $38,DX,AX
	MULQ 32(SI)
	ADDQ AX,R11
	ADCQ DX,R12
	MOVQ 32(SI),DX
	IMUL3Q $19,DX,AX
	MULQ 32(SI)
	ADDQ AX,R13
	ADCQ DX,R14
	MOVQ $REDMASK51,SI
	SHLQ $13,R8:CX
	ANDQ SI,CX
	SHLQ $13,R10:R9
	ANDQ SI,R9
	ADDQ R8,R9
	SHLQ $13,R12:R11
	ANDQ SI,R11
	ADDQ R10,R11
	SHLQ $13,R14:R13
	ANDQ SI,R13
	ADDQ R12,R13
	SHLQ $13,BX:R15
	ANDQ SI,R15
	ADDQ R14,R15
	IMUL3Q $19,BX,DX
	ADDQ DX,CX
	MOVQ CX,DX
	SHRQ $51,DX
	ADDQ R9,DX
	ANDQ SI,CX
	MOVQ DX,R8
	SHRQ $51,DX
	ADDQ R11,DX
	ANDQ SI,R8
	MOVQ DX,R9
	SHRQ $51,DX
	ADDQ R13,DX
	ANDQ SI,R9
	MOVQ DX,AX
	SHRQ $51,DX
	ADDQ R15,DX
	ANDQ SI,AX
	MOVQ DX,R10
	SHRQ $51,DX
	IMUL3Q $19,DX,DX
	ADDQ DX,CX
	ANDQ SI,R10
	MOVQ CX,0(DI)
	MOVQ R8,8(DI)
	MOVQ R9,16(DI)
	MOVQ AX,24(DI)
	MOVQ R10,32(DI)
	RET


text:
// Copyright 2012 The Go Authors. All rights reserved.
// Use of this source code is governed by a BSD-style
// license that can be found in the LICENSE file.

// This code was translated into a form compatible with 6a from the public
// domain sources in SUPERCOP: https://bench.cr.yp.to/supercop.html

// +build amd64,!gccgo,!appengine

#include "const_amd64.h"

// func mul(dest, a, b *[5]uint64)
TEXT ·mul(SB),0,$16-24
	MOVQ dest+0(FP), DI
	MOVQ a+8(FP), SI
	MOVQ b+16(FP), DX

	MOVQ DX,CX
	MOVQ 24(SI),DX
	IMUL3Q $19,DX,AX
	MOVQ AX,0(SP)
	MULQ 16(CX)
	MOVQ AX,R8
	MOVQ DX,R9
	MOVQ 32(SI),DX
	IMUL3Q $19,DX,AX
	MOVQ AX,8(SP)
	MULQ 8(CX)
	ADDQ AX,R8
	ADCQ DX,R9
	MOVQ 0(SI),AX
	MULQ 0(CX)
	ADDQ AX,R8
	ADCQ DX,R9
	MOVQ 0(SI),AX
	MULQ 8(CX)
	MOVQ AX,R10
	MOVQ DX,R11
	MOVQ 0(SI),AX
	MULQ 16(CX)
	MOVQ AX,R12
	MOVQ DX,R13
	MOVQ 0(SI),AX
	MULQ 24(CX)
	MOVQ AX,R14
	MOVQ DX,R15
	MOVQ 0(SI),AX
	MULQ 32(CX)
	MOVQ AX,BX
	MOVQ DX,BP
	MOVQ 8(SI),AX
	MULQ 0(CX)
	ADDQ AX,R10
	ADCQ DX,R11
	MOVQ 8(SI),AX
	MULQ 8(CX)
	ADDQ AX,R12
	ADCQ DX,R13
	MOVQ 8(SI),AX
	MULQ 16(CX)
	ADDQ AX,R14
	ADCQ DX,R15
	MOVQ 8(SI),AX
	MULQ 24(CX)
	ADDQ AX,BX
	ADCQ DX,BP
	MOVQ 8(SI),DX
	IMUL3Q $19,DX,AX
	MULQ 32(CX)
	ADDQ AX,R8
	ADCQ DX,R9
	MOVQ 16(SI),AX
	MULQ 0(CX)
	ADDQ AX,R12
	ADCQ DX,R13
	MOVQ 16(SI),AX
	MULQ 8(CX)
	ADDQ AX,R14
	ADCQ DX,R15
	MOVQ 16(SI),AX
	MULQ 16(CX)
	ADDQ AX,BX
	ADCQ DX,BP
	MOVQ 16(SI),DX
	IMUL3Q $19,DX,AX
	MULQ 24(CX)
	ADDQ AX,R8
	ADCQ DX,R9
	MOVQ 16(SI),DX
	IMUL3Q $19,DX,AX
	MULQ 32(CX)
	ADDQ AX,R10
	ADCQ DX,R11
	MOVQ 24(SI),AX
	MULQ 0(CX)
	ADDQ AX,R14
	ADCQ DX,R15
	MOVQ 24(SI),AX
	MULQ 8(CX)
	ADDQ AX,BX
	ADCQ DX,BP
	MOVQ 0(SP),AX
	MULQ 24(CX)
	ADDQ AX,R10
	ADCQ DX,R11
	MOVQ 0(SP),AX
	MULQ 32(CX)
	ADDQ AX,R12
	ADCQ DX,R13
	MOVQ 32(SI),AX
	MULQ 0(CX)
	ADDQ AX,BX
	ADCQ DX,BP
	MOVQ 8(SP),AX
	MULQ 16(CX)
	ADDQ AX,R10
	ADCQ DX,R11
	MOVQ 8(SP),AX
	MULQ 24(CX)
	ADDQ AX,R12
	ADCQ DX,R13
	MOVQ 8(SP),AX
	MULQ 32(CX)
	ADDQ AX,R14
	ADCQ DX,R15
	MOVQ $REDMASK51,SI
	SHLQ $13,R9:R8
	ANDQ SI,R8
	SHLQ $13,R11:R10
	ANDQ SI,R10
	ADDQ R9,R10
	SHLQ $13,R13:R12
	ANDQ SI,R12
	ADDQ R11,R12
	SHLQ $13,R15:R14
	ANDQ SI,R14
	ADDQ R13,R14
	SHLQ $13,BP:BX
	ANDQ SI,BX
	ADDQ R15,BX
	IMUL3Q $19,BP,DX
	ADDQ DX,R8
	MOVQ R8,DX
	SHRQ $51,DX
	ADDQ R10,DX
	MOVQ DX,CX
	SHRQ $51,DX
	ANDQ SI,R8
	ADDQ R12,DX
	MOVQ DX,R9
	SHRQ $51,DX
	ANDQ SI,CX
	ADDQ R14,DX
	MOVQ DX,AX
	SHRQ $51,DX
	ANDQ SI,R9
	ADDQ BX,DX
	MOVQ DX,R10
	SHRQ $51,DX
	ANDQ SI,AX
	IMUL3Q $19,DX,DX
	ADDQ DX,R8
	ANDQ SI,R10
	MOVQ R8,0(DI)
	MOVQ CX,8(DI)
	MOVQ R9,16(DI)
	MOVQ AX,24(DI)
	MOVQ R10,32(DI)
	RET


text:
// Copyright 2012 The Go Authors. All rights reserved.
// Use of this source code is governed by a BSD-style
// license that can be found in the LICENSE file.

// This code was translated into a form compatible with 6a from the public
// domain sources in SUPERCOP: https://bench.cr.yp.to/supercop.html

#define REDMASK51     0x0007FFFFFFFFFFFF


text:
// Copyright 2013 The Go Authors. All rights reserved.
// Use of this source code is governed by a BSD-style
// license that can be found in the LICENSE file.

// We have an implementation in amd64 assembly so this code is only run on
// non-amd64 platforms. The amd64 assembly does not support gccgo.
// +build !amd64 gccgo appengine

package curve25519

import (
	"encoding/binary"
)

// This code is a port of the public domain, "ref10" implementation of
// curve25519 from SUPERCOP 20130419 by D. J. Bernstein.

// fieldElement represents an element of the field GF(2^255 - 19). An element
// t, entries t[0]...t[9], represents the integer t[0]+2^26 t[1]+2^51 t[2]+2^77
// t[3]+2^102 t[4]+...+2^230 t[9]. Bounds on each t[i] vary depending on
// context.
type fieldElement [10]int32

func feZero(fe *fieldElement) {
	for i := range fe {
		fe[i] = 0
	}
}

func feOne(fe *fieldElement) {
	feZero(fe)
	fe[0] = 1
}

func feAdd(dst, a, b *fieldElement) {
	for i := range dst {
		dst[i] = a[i] + b[i]
	}
}

func feSub(dst, a, b *fieldElement) {
	for i := range dst {
		dst[i] = a[i] - b[i]
	}
}

func feCopy(dst, src *fieldElement) {
	for i := range dst {
		dst[i] = src[i]
	}
}

// feCSwap replaces (f,g) with (g,f) if b == 1; replaces (f,g) with (f,g) if b == 0.
//
// Preconditions: b in {0,1}.
func feCSwap(f, g *fieldElement, b int32) {
	b = -b
	for i := range f {
		t := b & (f[i] ^ g[i])
		f[i] ^= t
		g[i] ^= t
	}
}

// load3 reads a 24-bit, little-endian value from in.
func load3(in []byte) int64 {
	var r int64
	r = int64(in[0])
	r |= int64(in[1]) << 8
	r |= int64(in[2]) << 16
	return r
}

// load4 reads a 32-bit, little-endian value from in.
func load4(in []byte) int64 {
	return int64(binary.LittleEndian.Uint32(in))
}

func feFromBytes(dst *fieldElement, src *[32]byte) {
	h0 := load4(src[:])
	h1 := load3(src[4:]) << 6
	h2 := load3(src[7:]) << 5
	h3 := load3(src[10:]) << 3
	h4 := load3(src[13:]) << 2
	h5 := load4(src[16:])
	h6 := load3(src[20:]) << 7
	h7 := load3(src[23:]) << 5
	h8 := load3(src[26:]) << 4
	h9 := load3(src[29:]) << 2

	var carry [10]int64
	carry[9] = (h9 + 1<<24) >> 25
	h0 += carry[9] * 19
	h9 -= carry[9] << 25
	carry[1] = (h1 + 1<<24) >> 25
	h2 += carry[1]
	h1 -= carry[1] << 25
	carry[3] = (h3 + 1<<24) >> 25
	h4 += carry[3]
	h3 -= carry[3] << 25
	carry[5] = (h5 + 1<<24) >> 25
	h6 += carry[5]
	h5 -= carry[5] << 25
	carry[7] = (h7 + 1<<24) >> 25
	h8 += carry[7]
	h7 -= carry[7] << 25

	carry[0] = (h0 + 1<<25) >> 26
	h1 += carry[0]
	h0 -= carry[0] << 26
	carry[2] = (h2 + 1<<25) >> 26
	h3 += carry[2]
	h2 -= carry[2] << 26
	carry[4] = (h4 + 1<<25) >> 26
	h5 += carry[4]
	h4 -= carry[4] << 26
	carry[6] = (h6 + 1<<25) >> 26
	h7 += carry[6]
	h6 -= carry[6] << 26
	carry[8] = (h8 + 1<<25) >> 26
	h9 += carry[8]
	h8 -= carry[8] << 26

	dst[0] = int32(h0)
	dst[1] = int32(h1)
	dst[2] = int32(h2)
	dst[3] = int32(h3)
	dst[4] = int32(h4)
	dst[5] = int32(h5)
	dst[6] = int32(h6)
	dst[7] = int32(h7)
	dst[8] = int32(h8)
	dst[9] = int32(h9)
}

// feToBytes marshals h to s.
// Preconditions:
//   |h| bounded by 1.1*2^25,1.1*2^24,1.1*2^25,1.1*2^24,etc.
//
// Write p=2^255-19; q=floor(h/p).
// Basic claim: q = floor(2^(-255)(h + 19 2^(-25)h9 + 2^(-1))).
//
// Proof:
//   Have |h|<=p so |q|<=1 so |19^2 2^(-255) q|<1/4.
//   Also have |h-2^230 h9|<2^230 so |19 2^(-255)(h-2^230 h9)|<1/4.
//
//   Write y=2^(-1)-19^2 2^(-255)q-19 2^(-255)(h-2^230 h9).
//   Then 0<y<1.
//
//   Write r=h-pq.
//   Have 0<=r<=p-1=2^255-20.
//   Thus 0<=r+19(2^-255)r<r+19(2^-255)2^255<=2^255-1.
//
//   Write x=r+19(2^-255)r+y.
//   Then 0<x<2^255 so floor(2^(-255)x) = 0 so floor(q+2^(-255)x) = q.
//
//   Have q+2^(-255)x = 2^(-255)(h + 19 2^(-25) h9 + 2^(-1))
//   so floor(2^(-255)(h + 19 2^(-25) h9 + 2^(-1))) = q.
func feToBytes(s *[32]byte, h *fieldElement) {
	var carry [10]int32

	q := (19*h[9] + (1 << 24)) >> 25
	q = (h[0] + q) >> 26
	q = (h[1] + q) >> 25
	q = (h[2] + q) >> 26
	q = (h[3] + q) >> 25
	q = (h[4] + q) >> 26
	q = (h[5] + q) >> 25
	q = (h[6] + q) >> 26
	q = (h[7] + q) >> 25
	q = (h[8] + q) >> 26
	q = (h[9] + q) >> 25

	// Goal: Output h-(2^255-19)q, which is between 0 and 2^255-20.
	h[0] += 19 * q
	// Goal: Output h-2^255 q, which is between 0 and 2^255-20.

	carry[0] = h[0] >> 26
	h[1] += carry[0]
	h[0] -= carry[0] << 26
	carry[1] = h[1] >> 25
	h[2] += carry[1]
	h[1] -= carry[1] << 25
	carry[2] = h[2] >> 26
	h[3] += carry[2]
	h[2] -= carry[2] << 26
	carry[3] = h[3] >> 25
	h[4] += carry[3]
	h[3] -= carry[3] << 25
	carry[4] = h[4] >> 26
	h[5] += carry[4]
	h[4] -= carry[4] << 26
	carry[5] = h[5] >> 25
	h[6] += carry[5]
	h[5] -= carry[5] << 25
	carry[6] = h[6] >> 26
	h[7] += carry[6]
	h[6] -= carry[6] << 26
	carry[7] = h[7] >> 25
	h[8] += carry[7]
	h[7] -= carry[7] << 25
	carry[8] = h[8] >> 26
	h[9] += carry[8]
	h[8] -= carry[8] << 26
	carry[9] = h[9] >> 25
	h[9] -= carry[9] << 25
	// h10 = carry9

	// Goal: Output h[0]+...+2^255 h10-2^255 q, which is between 0 and 2^255-20.
	// Have h[0]+...+2^230 h[9] between 0 and 2^255-1;
	// evidently 2^255 h10-2^255 q = 0.
	// Goal: Output h[0]+...+2^230 h[9].

	s[0] = byte(h[0] >> 0)
	s[1] = byte(h[0] >> 8)
	s[2] = byte(h[0] >> 16)
	s[3] = byte((h[0] >> 24) | (h[1] << 2))
	s[4] = byte(h[1] >> 6)
	s[5] = byte(h[1] >> 14)
	s[6] = byte((h[1] >> 22) | (h[2] << 3))
	s[7] = byte(h[2] >> 5)
	s[8] = byte(h[2] >> 13)
	s[9] = byte((h[2] >> 21) | (h[3] << 5))
	s[10] = byte(h[3] >> 3)
	s[11] = byte(h[3] >> 11)
	s[12] = byte((h[3] >> 19) | (h[4] << 6))
	s[13] = byte(h[4] >> 2)
	s[14] = byte(h[4] >> 10)
	s[15] = byte(h[4] >> 18)
	s[16] = byte(h[5] >> 0)
	s[17] = byte(h[5] >> 8)
	s[18] = byte(h[5] >> 16)
	s[19] = byte((h[5] >> 24) | (h[6] << 1))
	s[20] = byte(h[6] >> 7)
	s[21] = byte(h[6] >> 15)
	s[22] = byte((h[6] >> 23) | (h[7] << 3))
	s[23] = byte(h[7] >> 5)
	s[24] = byte(h[7] >> 13)
	s[25] = byte((h[7] >> 21) | (h[8] << 4))
	s[26] = byte(h[8] >> 4)
	s[27] = byte(h[8] >> 12)
	s[28] = byte((h[8] >> 20) | (h[9] << 6))
	s[29] = byte(h[9] >> 2)
	s[30] = byte(h[9] >> 10)
	s[31] = byte(h[9] >> 18)
}

// feMul calculates h = f * g
// Can overlap h with f or g.
//
// Preconditions:
//    |f| bounded by 1.1*2^26,1.1*2^25,1.1*2^26,1.1*2^25,etc.
//    |g| bounded by 1.1*2^26,1.1*2^25,1.1*2^26,1.1*2^25,etc.
//
// Postconditions:
//    |h| bounded by 1.1*2^25,1.1*2^24,1.1*2^25,1.1*2^24,etc.
//
// Notes on implementation strategy:
//
// Using schoolbook multiplication.
// Karatsuba would save a little in some cost models.
//
// Most multiplications by 2 and 19 are 32-bit precomputations;
// cheaper than 64-bit postcomputations.
//
// There is one remaining multiplication by 19 in the carry chain;
// one *19 precomputation can be merged into this,
// but the resulting data flow is considerably less clean.
//
// There are 12 carries below.
// 10 of them are 2-way parallelizable and vectorizable.
// Can get away with 11 carries, but then data flow is much deeper.
//
// With tighter constraints on inputs can squeeze carries into int32.
func feMul(h, f, g *fieldElement) {
	f0 := f[0]
	f1 := f[1]
	f2 := f[2]
	f3 := f[3]
	f4 := f[4]
	f5 := f[5]
	f6 := f[6]
	f7 := f[7]
	f8 := f[8]
	f9 := f[9]
	g0 := g[0]
	g1 := g[1]
	g2 := g[2]
	g3 := g[3]
	g4 := g[4]
	g5 := g[5]
	g6 := g[6]
	g7 := g[7]
	g8 := g[8]
	g9 := g[9]
	g1_19 := 19 * g1 // 1.4*2^29
	g2_19 := 19 * g2 // 1.4*2^30; still ok
	g3_19 := 19 * g3
	g4_19 := 19 * g4
	g5_19 := 19 * g5
	g6_19 := 19 * g6
	g7_19 := 19 * g7
	g8_19 := 19 * g8
	g9_19 := 19 * g9
	f1_2 := 2 * f1
	f3_2 := 2 * f3
	f5_2 := 2 * f5
	f7_2 := 2 * f7
	f9_2 := 2 * f9
	f0g0 := int64(f0) * int64(g0)
	f0g1 := int64(f0) * int64(g1)
	f0g2 := int64(f0) * int64(g2)
	f0g3 := int64(f0) * int64(g3)
	f0g4 := int64(f0) * int64(g4)
	f0g5 := int64(f0) * int64(g5)
	f0g6 := int64(f0) * int64(g6)
	f0g7 := int64(f0) * int64(g7)
	f0g8 := int64(f0) * int64(g8)
	f0g9 := int64(f0) * int64(g9)
	f1g0 := int64(f1) * int64(g0)
	f1g1_2 := int64(f1_2) * int64(g1)
	f1g2 := int64(f1) * int64(g2)
	f1g3_2 := int64(f1_2) * int64(g3)
	f1g4 := int64(f1) * int64(g4)
	f1g5_2 := int64(f1_2) * int64(g5)
	f1g6 := int64(f1) * int64(g6)
	f1g7_2 := int64(f1_2) * int64(g7)
	f1g8 := int64(f1) * int64(g8)
	f1g9_38 := int64(f1_2) * int64(g9_19)
	f2g0 := int64(f2) * int64(g0)
	f2g1 := int64(f2) * int64(g1)
	f2g2 := int64(f2) * int64(g2)
	f2g3 := int64(f2) * int64(g3)
	f2g4 := int64(f2) * int64(g4)
	f2g5 := int64(f2) * int64(g5)
	f2g6 := int64(f2) * int64(g6)
	f2g7 := int64(f2) * int64(g7)
	f2g8_19 := int64(f2) * int64(g8_19)
	f2g9_19 := int64(f2) * int64(g9_19)
	f3g0 := int64(f3) * int64(g0)
	f3g1_2 := int64(f3_2) * int64(g1)
	f3g2 := int64(f3) * int64(g2)
	f3g3_2 := int64(f3_2) * int64(g3)
	f3g4 := int64(f3) * int64(g4)
	f3g5_2 := int64(f3_2) * int64(g5)
	f3g6 := int64(f3) * int64(g6)
	f3g7_38 := int64(f3_2) * int64(g7_19)
	f3g8_19 := int64(f3) * int64(g8_19)
	f3g9_38 := int64(f3_2) * int64(g9_19)
	f4g0 := int64(f4) * int64(g0)
	f4g1 := int64(f4) * int64(g1)
	f4g2 := int64(f4) * int64(g2)
	f4g3 := int64(f4) * int64(g3)
	f4g4 := int64(f4) * int64(g4)
	f4g5 := int64(f4) * int64(g5)
	f4g6_19 := int64(f4) * int64(g6_19)
	f4g7_19 := int64(f4) * int64(g7_19)
	f4g8_19 := int64(f4) * int64(g8_19)
	f4g9_19 := int64(f4) * int64(g9_19)
	f5g0 := int64(f5) * int64(g0)
	f5g1_2 := int64(f5_2) * int64(g1)
	f5g2 := int64(f5) * int64(g2)
	f5g3_2 := int64(f5_2) * int64(g3)
	f5g4 := int64(f5) * int64(g4)
	f5g5_38 := int64(f5_2) * int64(g5_19)
	f5g6_19 := int64(f5) * int64(g6_19)
	f5g7_38 := int64(f5_2) * int64(g7_19)
	f5g8_19 := int64(f5) * int64(g8_19)
	f5g9_38 := int64(f5_2) * int64(g9_19)
	f6g0 := int64(f6) * int64(g0)
	f6g1 := int64(f6) * int64(g1)
	f6g2 := int64(f6) * int64(g2)
	f6g3 := int64(f6) * int64(g3)
	f6g4_19 := int64(f6) * int64(g4_19)
	f6g5_19 := int64(f6) * int64(g5_19)
	f6g6_19 := int64(f6) * int64(g6_19)
	f6g7_19 := int64(f6) * int64(g7_19)
	f6g8_19 := int64(f6) * int64(g8_19)
	f6g9_19 := int64(f6) * int64(g9_19)
	f7g0 := int64(f7) * int64(g0)
	f7g1_2 := int64(f7_2) * int64(g1)
	f7g2 := int64(f7) * int64(g2)
	f7g3_38 := int64(f7_2) * int64(g3_19)
	f7g4_19 := int64(f7) * int64(g4_19)
	f7g5_38 := int64(f7_2) * int64(g5_19)
	f7g6_19 := int64(f7) * int64(g6_19)
	f7g7_38 := int64(f7_2) * int64(g7_19)
	f7g8_19 := int64(f7) * int64(g8_19)
	f7g9_38 := int64(f7_2) * int64(g9_19)
	f8g0 := int64(f8) * int64(g0)
	f8g1 := int64(f8) * int64(g1)
	f8g2_19 := int64(f8) * int64(g2_19)
	f8g3_19 := int64(f8) * int64(g3_19)
	f8g4_19 := int64(f8) * int64(g4_19)
	f8g5_19 := int64(f8) * int64(g5_19)
	f8g6_19 := int64(f8) * int64(g6_19)
	f8g7_19 := int64(f8) * int64(g7_19)
	f8g8_19 := int64(f8) * int64(g8_19)
	f8g9_19 := int64(f8) * int64(g9_19)
	f9g0 := int64(f9) * int64(g0)
	f9g1_38 := int64(f9_2) * int64(g1_19)
	f9g2_19 := int64(f9) * int64(g2_19)
	f9g3_38 := int64(f9_2) * int64(g3_19)
	f9g4_19 := int64(f9) * int64(g4_19)
	f9g5_38 := int64(f9_2) * int64(g5_19)
	f9g6_19 := int64(f9) * int64(g6_19)
	f9g7_38 := int64(f9_2) * int64(g7_19)
	f9g8_19 := int64(f9) * int64(g8_19)
	f9g9_38 := int64(f9_2) * int64(g9_19)
	h0 := f0g0 + f1g9_38 + f2g8_19 + f3g7_38 + f4g6_19 + f5g5_38 + f6g4_19 + f7g3_38 + f8g2_19 + f9g1_38
	h1 := f0g1 + f1g0 + f2g9_19 + f3g8_19 + f4g7_19 + f5g6_19 + f6g5_19 + f7g4_19 + f8g3_19 + f9g2_19
	h2 := f0g2 + f1g1_2 + f2g0 + f3g9_38 + f4g8_19 + f5g7_38 + f6g6_19 + f7g5_38 + f8g4_19 + f9g3_38
	h3 := f0g3 + f1g2 + f2g1 + f3g0 + f4g9_19 + f5g8_19 + f6g7_19 + f7g6_19 + f8g5_19 + f9g4_19
	h4 := f0g4 + f1g3_2 + f2g2 + f3g1_2 + f4g0 + f5g9_38 + f6g8_19 + f7g7_38 + f8g6_19 + f9g5_38
	h5 := f0g5 + f1g4 + f2g3 + f3g2 + f4g1 + f5g0 + f6g9_19 + f7g8_19 + f8g7_19 + f9g6_19
	h6 := f0g6 + f1g5_2 + f2g4 + f3g3_2 + f4g2 + f5g1_2 + f6g0 + f7g9_38 + f8g8_19 + f9g7_38
	h7 := f0g7 + f1g6 + f2g5 + f3g4 + f4g3 + f5g2 + f6g1 + f7g0 + f8g9_19 + f9g8_19
	h8 := f0g8 + f1g7_2 + f2g6 + f3g5_2 + f4g4 + f5g3_2 + f6g2 + f7g1_2 + f8g0 + f9g9_38
	h9 := f0g9 + f1g8 + f2g7 + f3g6 + f4g5 + f5g4 + f6g3 + f7g2 + f8g1 + f9g0
	var carry [10]int64

	// |h0| <= (1.1*1.1*2^52*(1+19+19+19+19)+1.1*1.1*2^50*(38+38+38+38+38))
	//   i.e. |h0| <= 1.2*2^59; narrower ranges for h2, h4, h6, h8
	// |h1| <= (1.1*1.1*2^51*(1+1+19+19+19+19+19+19+19+19))
	//   i.e. |h1| <= 1.5*2^58; narrower ranges for h3, h5, h7, h9

	carry[0] = (h0 + (1 << 25)) >> 26
	h1 += carry[0]
	h0 -= carry[0] << 26
	carry[4] = (h4 + (1 << 25)) >> 26
	h5 += carry[4]
	h4 -= carry[4] << 26
	// |h0| <= 2^25
	// |h4| <= 2^25
	// |h1| <= 1.51*2^58
	// |h5| <= 1.51*2^58

	carry[1] = (h1 + (1 << 24)) >> 25
	h2 += carry[1]
	h1 -= carry[1] << 25
	carry[5] = (h5 + (1 << 24)) >> 25
	h6 += carry[5]
	h5 -= carry[5] << 25
	// |h1| <= 2^24; from now on fits into int32
	// |h5| <= 2^24; from now on fits into int32
	// |h2| <= 1.21*2^59
	// |h6| <= 1.21*2^59

	carry[2] = (h2 + (1 << 25)) >> 26
	h3 += carry[2]
	h2 -= carry[2] << 26
	carry[6] = (h6 + (1 << 25)) >> 26
	h7 += carry[6]
	h6 -= carry[6] << 26
	// |h2| <= 2^25; from now on fits into int32 unchanged
	// |h6| <= 2^25; from now on fits into int32 unchanged
	// |h3| <= 1.51*2^58
	// |h7| <= 1.51*2^58

	carry[3] = (h3 + (1 << 24)) >> 25
	h4 += carry[3]
	h3 -= carry[3] << 25
	carry[7] = (h7 + (1 << 24)) >> 25
	h8 += carry[7]
	h7 -= carry[7] << 25
	// |h3| <= 2^24; from now on fits into int32 unchanged
	// |h7| <= 2^24; from now on fits into int32 unchanged
	// |h4| <= 1.52*2^33
	// |h8| <= 1.52*2^33

	carry[4] = (h4 + (1 << 25)) >> 26
	h5 += carry[4]
	h4 -= carry[4] << 26
	carry[8] = (h8 + (1 << 25)) >> 26
	h9 += carry[8]
	h8 -= carry[8] << 26
	// |h4| <= 2^25; from now on fits into int32 unchanged
	// |h8| <= 2^25; from now on fits into int32 unchanged
	// |h5| <= 1.01*2^24
	// |h9| <= 1.51*2^58

	carry[9] = (h9 + (1 << 24)) >> 25
	h0 += carry[9] * 19
	h9 -= carry[9] << 25
	// |h9| <= 2^24; from now on fits into int32 unchanged
	// |h0| <= 1.8*2^37

	carry[0] = (h0 + (1 << 25)) >> 26
	h1 += carry[0]
	h0 -= carry[0] << 26
	// |h0| <= 2^25; from now on fits into int32 unchanged
	// |h1| <= 1.01*2^24

	h[0] = int32(h0)
	h[1] = int32(h1)
	h[2] = int32(h2)
	h[3] = int32(h3)
	h[4] = int32(h4)
	h[5] = int32(h5)
	h[6] = int32(h6)
	h[7] = int32(h7)
	h[8] = int32(h8)
	h[9] = int32(h9)
}

// feSquare calculates h = f*f. Can overlap h with f.
//
// Preconditions:
//    |f| bounded by 1.1*2^26,1.1*2^25,1.1*2^26,1.1*2^25,etc.
//
// Postconditions:
//    |h| bounded by 1.1*2^25,1.1*2^24,1.1*2^25,1.1*2^24,etc.
func feSquare(h, f *fieldElement) {
	f0 := f[0]
	f1 := f[1]
	f2 := f[2]
	f3 := f[3]
	f4 := f[4]
	f5 := f[5]
	f6 := f[6]
	f7 := f[7]
	f8 := f[8]
	f9 := f[9]
	f0_2 := 2 * f0
	f1_2 := 2 * f1
	f2_2 := 2 * f2
	f3_2 := 2 * f3
	f4_2 := 2 * f4
	f5_2 := 2 * f5
	f6_2 := 2 * f6
	f7_2 := 2 * f7
	f5_38 := 38 * f5 // 1.31*2^30
	f6_19 := 19 * f6 // 1.31*2^30
	f7_38 := 38 * f7 // 1.31*2^30
	f8_19 := 19 * f8 // 1.31*2^30
	f9_38 := 38 * f9 // 1.31*2^30
	f0f0 := int64(f0) * int64(f0)
	f0f1_2 := int64(f0_2) * int64(f1)
	f0f2_2 := int64(f0_2) * int64(f2)
	f0f3_2 := int64(f0_2) * int64(f3)
	f0f4_2 := int64(f0_2) * int64(f4)
	f0f5_2 := int64(f0_2) * int64(f5)
	f0f6_2 := int64(f0_2) * int64(f6)
	f0f7_2 := int64(f0_2) * int64(f7)
	f0f8_2 := int64(f0_2) * int64(f8)
	f0f9_2 := int64(f0_2) * int64(f9)
	f1f1_2 := int64(f1_2) * int64(f1)
	f1f2_2 := int64(f1_2) * int64(f2)
	f1f3_4 := int64(f1_2) * int64(f3_2)
	f1f4_2 := int64(f1_2) * int64(f4)
	f1f5_4 := int64(f1_2) * int64(f5_2)
	f1f6_2 := int64(f1_2) * int64(f6)
	f1f7_4 := int64(f1_2) * int64(f7_2)
	f1f8_2 := int64(f1_2) * int64(f8)
	f1f9_76 := int64(f1_2) * int64(f9_38)
	f2f2 := int64(f2) * int64(f2)
	f2f3_2 := int64(f2_2) * int64(f3)
	f2f4_2 := int64(f2_2) * int64(f4)
	f2f5_2 := int64(f2_2) * int64(f5)
	f2f6_2 := int64(f2_2) * int64(f6)
	f2f7_2 := int64(f2_2) * int64(f7)
	f2f8_38 := int64(f2_2) * int64(f8_19)
	f2f9_38 := int64(f2) * int64(f9_38)
	f3f3_2 := int64(f3_2) * int64(f3)
	f3f4_2 := int64(f3_2) * int64(f4)
	f3f5_4 := int64(f3_2) * int64(f5_2)
	f3f6_2 := int64(f3_2) * int64(f6)
	f3f7_76 := int64(f3_2) * int64(f7_38)
	f3f8_38 := int64(f3_2) * int64(f8_19)
	f3f9_76 := int64(f3_2) * int64(f9_38)
	f4f4 := int64(f4) * int64(f4)
	f4f5_2 := int64(f4_2) * int64(f5)
	f4f6_38 := int64(f4_2) * int64(f6_19)
	f4f7_38 := int64(f4) * int64(f7_38)
	f4f8_38 := int64(f4_2) * int64(f8_19)
	f4f9_38 := int64(f4) * int64(f9_38)
	f5f5_38 := int64(f5) * int64(f5_38)
	f5f6_38 := int64(f5_2) * int64(f6_19)
	f5f7_76 := int64(f5_2) * int64(f7_38)
	f5f8_38 := int64(f5_2) * int64(f8_19)
	f5f9_76 := int64(f5_2) * int64(f9_38)
	f6f6_19 := int64(f6) * int64(f6_19)
	f6f7_38 := int64(f6) * int64(f7_38)
	f6f8_38 := int64(f6_2) * int64(f8_19)
	f6f9_38 := int64(f6) * int64(f9_38)
	f7f7_38 := int64(f7) * int64(f7_38)
	f7f8_38 := int64(f7_2) * int64(f8_19)
	f7f9_76 := int64(f7_2) * int64(f9_38)
	f8f8_19 := int64(f8) * int64(f8_19)
	f8f9_38 := int64(f8) * int64(f9_38)
	f9f9_38 := int64(f9) * int64(f9_38)
	h0 := f0f0 + f1f9_76 + f2f8_38 + f3f7_76 + f4f6_38 + f5f5_38
	h1 := f0f1_2 + f2f9_38 + f3f8_38 + f4f7_38 + f5f6_38
	h2 := f0f2_2 + f1f1_2 + f3f9_76 + f4f8_38 + f5f7_76 + f6f6_19
	h3 := f0f3_2 + f1f2_2 + f4f9_38 + f5f8_38 + f6f7_38
	h4 := f0f4_2 + f1f3_4 + f2f2 + f5f9_76 + f6f8_38 + f7f7_38
	h5 := f0f5_2 + f1f4_2 + f2f3_2 + f6f9_38 + f7f8_38
	h6 := f0f6_2 + f1f5_4 + f2f4_2 + f3f3_2 + f7f9_76 + f8f8_19
	h7 := f0f7_2 + f1f6_2 + f2f5_2 + f3f4_2 + f8f9_38
	h8 := f0f8_2 + f1f7_4 + f2f6_2 + f3f5_4 + f4f4 + f9f9_38
	h9 := f0f9_2 + f1f8_2 + f2f7_2 + f3f6_2 + f4f5_2
	var carry [10]int64

	carry[0] = (h0 + (1 << 25)) >> 26
	h1 += carry[0]
	h0 -= carry[0] << 26
	carry[4] = (h4 + (1 << 25)) >> 26
	h5 += carry[4]
	h4 -= carry[4] << 26

	carry[1] = (h1 + (1 << 24)) >> 25
	h2 += carry[1]
	h1 -= carry[1] << 25
	carry[5] = (h5 + (1 << 24)) >> 25
	h6 += carry[5]
	h5 -= carry[5] << 25

	carry[2] = (h2 + (1 << 25)) >> 26
	h3 += carry[2]
	h2 -= carry[2] << 26
	carry[6] = (h6 + (1 << 25)) >> 26
	h7 += carry[6]
	h6 -= carry[6] << 26

	carry[3] = (h3 + (1 << 24)) >> 25
	h4 += carry[3]
	h3 -= carry[3] << 25
	carry[7] = (h7 + (1 << 24)) >> 25
	h8 += carry[7]
	h7 -= carry[7] << 25

	carry[4] = (h4 + (1 << 25)) >> 26
	h5 += carry[4]
	h4 -= carry[4] << 26
	carry[8] = (h8 + (1 << 25)) >> 26
	h9 += carry[8]
	h8 -= carry[8] << 26

	carry[9] = (h9 + (1 << 24)) >> 25
	h0 += carry[9] * 19
	h9 -= carry[9] << 25

	carry[0] = (h0 + (1 << 25)) >> 26
	h1 += carry[0]
	h0 -= carry[0] << 26

	h[0] = int32(h0)
	h[1] = int32(h1)
	h[2] = int32(h2)
	h[3] = int32(h3)
	h[4] = int32(h4)
	h[5] = int32(h5)
	h[6] = int32(h6)
	h[7] = int32(h7)
	h[8] = int32(h8)
	h[9] = int32(h9)
}

// feMul121666 calculates h = f * 121666. Can overlap h with f.
//
// Preconditions:
//    |f| bounded by 1.1*2^26,1.1*2^25,1.1*2^26,1.1*2^25,etc.
//
// Postconditions:
//    |h| bounded by 1.1*2^25,1.1*2^24,1.1*2^25,1.1*2^24,etc.
func feMul121666(h, f *fieldElement) {
	h0 := int64(f[0]) * 121666
	h1 := int64(f[1]) * 121666
	h2 := int64(f[2]) * 121666
	h3 := int64(f[3]) * 121666
	h4 := int64(f[4]) * 121666
	h5 := int64(f[5]) * 121666
	h6 := int64(f[6]) * 121666
	h7 := int64(f[7]) * 121666
	h8 := int64(f[8]) * 121666
	h9 := int64(f[9]) * 121666
	var carry [10]int64

	carry[9] = (h9 + (1 << 24)) >> 25
	h0 += carry[9] * 19
	h9 -= carry[9] << 25
	carry[1] = (h1 + (1 << 24)) >> 25
	h2 += carry[1]
	h1 -= carry[1] << 25
	carry[3] = (h3 + (1 << 24)) >> 25
	h4 += carry[3]
	h3 -= carry[3] << 25
	carry[5] = (h5 + (1 << 24)) >> 25
	h6 += carry[5]
	h5 -= carry[5] << 25
	carry[7] = (h7 + (1 << 24)) >> 25
	h8 += carry[7]
	h7 -= carry[7] << 25

	carry[0] = (h0 + (1 << 25)) >> 26
	h1 += carry[0]
	h0 -= carry[0] << 26
	carry[2] = (h2 + (1 << 25)) >> 26
	h3 += carry[2]
	h2 -= carry[2] << 26
	carry[4] = (h4 + (1 << 25)) >> 26
	h5 += carry[4]
	h4 -= carry[4] << 26
	carry[6] = (h6 + (1 << 25)) >> 26
	h7 += carry[6]
	h6 -= carry[6] << 26
	carry[8] = (h8 + (1 << 25)) >> 26
	h9 += carry[8]
	h8 -= carry[8] << 26

	h[0] = int32(h0)
	h[1] = int32(h1)
	h[2] = int32(h2)
	h[3] = int32(h3)
	h[4] = int32(h4)
	h[5] = int32(h5)
	h[6] = int32(h6)
	h[7] = int32(h7)
	h[8] = int32(h8)
	h[9] = int32(h9)
}

// feInvert sets out = z^-1.
func feInvert(out, z *fieldElement) {
	var t0, t1, t2, t3 fieldElement
	var i int

	feSquare(&t0, z)
	for i = 1; i < 1; i++ {
		feSquare(&t0, &t0)
	}
	feSquare(&t1, &t0)
	for i = 1; i < 2; i++ {
		feSquare(&t1, &t1)
	}
	feMul(&t1, z, &t1)
	feMul(&t0, &t0, &t1)
	feSquare(&t2, &t0)
	for i = 1; i < 1; i++ {
		feSquare(&t2, &t2)
	}
	feMul(&t1, &t1, &t2)
	feSquare(&t2, &t1)
	for i = 1; i < 5; i++ {
		feSquare(&t2, &t2)
	}
	feMul(&t1, &t2, &t1)
	feSquare(&t2, &t1)
	for i = 1; i < 10; i++ {
		feSquare(&t2, &t2)
	}
	feMul(&t2, &t2, &t1)
	feSquare(&t3, &t2)
	for i = 1; i < 20; i++ {
		feSquare(&t3, &t3)
	}
	feMul(&t2, &t3, &t2)
	feSquare(&t2, &t2)
	for i = 1; i < 10; i++ {
		feSquare(&t2, &t2)
	}
	feMul(&t1, &t2, &t1)
	feSquare(&t2, &t1)
	for i = 1; i < 50; i++ {
		feSquare(&t2, &t2)
	}
	feMul(&t2, &t2, &t1)
	feSquare(&t3, &t2)
	for i = 1; i < 100; i++ {
		feSquare(&t3, &t3)
	}
	feMul(&t2, &t3, &t2)
	feSquare(&t2, &t2)
	for i = 1; i < 50; i++ {
		feSquare(&t2, &t2)
	}
	feMul(&t1, &t2, &t1)
	feSquare(&t1, &t1)
	for i = 1; i < 5; i++ {
		feSquare(&t1, &t1)
	}
	feMul(out, &t1, &t0)
}

func scalarMult(out, in, base *[32]byte) {
	var e [32]byte

	copy(e[:], in[:])
	e[0] &= 248
	e[31] &= 127
	e[31] |= 64

	var x1, x2, z2, x3, z3, tmp0, tmp1 fieldElement
	feFromBytes(&x1, base)
	feOne(&x2)
	feCopy(&x3, &x1)
	feOne(&z3)

	swap := int32(0)
	for pos := 254; pos >= 0; pos-- {
		b := e[pos/8] >> uint(pos&7)
		b &= 1
		swap ^= int32(b)
		feCSwap(&x2, &x3, swap)
		feCSwap(&z2, &z3, swap)
		swap = int32(b)

		feSub(&tmp0, &x3, &z3)
		feSub(&tmp1, &x2, &z2)
		feAdd(&x2, &x2, &z2)
		feAdd(&z2, &x3, &z3)
		feMul(&z3, &tmp0, &x2)
		feMul(&z2, &z2, &tmp1)
		feSquare(&tmp0, &tmp1)
		feSquare(&tmp1, &x2)
		feAdd(&x3, &z3, &z2)
		feSub(&z2, &z3, &z2)
		feMul(&x2, &tmp1, &tmp0)
		feSub(&tmp1, &tmp1, &tmp0)
		feSquare(&z2, &z2)
		feMul121666(&z3, &tmp1)
		feSquare(&x3, &x3)
		feAdd(&tmp0, &tmp0, &z3)
		feMul(&z3, &x1, &z2)
		feMul(&z2, &tmp1, &tmp0)
	}

	feCSwap(&x2, &x3, swap)
	feCSwap(&z2, &z3, swap)

	feInvert(&z2, &z2)
	feMul(&x2, &x2, &z2)
	feToBytes(out, &x2)
}


text:
// Copyright 2012 The Go Authors. All rights reserved.
// Use of this source code is governed by a BSD-style
// license that can be found in the LICENSE file.

// This code was translated into a form compatible with 6a from the public
// domain sources in SUPERCOP: https://bench.cr.yp.to/supercop.html

// +build amd64,!gccgo,!appengine

#include "const_amd64.h"

// func ladderstep(inout *[5][5]uint64)
TEXT ·ladderstep(SB),0,$296-8
	MOVQ inout+0(FP),DI

	MOVQ 40(DI),SI
	MOVQ 48(DI),DX
	MOVQ 56(DI),CX
	MOVQ 64(DI),R8
	MOVQ 72(DI),R9
	MOVQ SI,AX
	MOVQ DX,R10
	MOVQ CX,R11
	MOVQ R8,R12
	MOVQ R9,R13
	ADDQ ·_2P0(SB),AX
	ADDQ ·_2P1234(SB),R10
	ADDQ ·_2P1234(SB),R11
	ADDQ ·_2P1234(SB),R12
	ADDQ ·_2P1234(SB),R13
	ADDQ 80(DI),SI
	ADDQ 88(DI),DX
	ADDQ 96(DI),CX
	ADDQ 104(DI),R8
	ADDQ 112(DI),R9
	SUBQ 80(DI),AX
	SUBQ 88(DI),R10
	SUBQ 96(DI),R11
	SUBQ 104(DI),R12
	SUBQ 112(DI),R13
	MOVQ SI,0(SP)
	MOVQ DX,8(SP)
	MOVQ CX,16(SP)
	MOVQ R8,24(SP)
	MOVQ R9,32(SP)
	MOVQ AX,40(SP)
	MOVQ R10,48(SP)
	MOVQ R11,56(SP)
	MOVQ R12,64(SP)
	MOVQ R13,72(SP)
	MOVQ 40(SP),AX
	MULQ 40(SP)
	MOVQ AX,SI
	MOVQ DX,CX
	MOVQ 40(SP),AX
	SHLQ $1,AX
	MULQ 48(SP)
	MOVQ AX,R8
	MOVQ DX,R9
	MOVQ 40(SP),AX
	SHLQ $1,AX
	MULQ 56(SP)
	MOVQ AX,R10
	MOVQ DX,R11
	MOVQ 40(SP),AX
	SHLQ $1,AX
	MULQ 64(SP)
	MOVQ AX,R12
	MOVQ DX,R13
	MOVQ 40(SP),AX
	SHLQ $1,AX
	MULQ 72(SP)
	MOVQ AX,R14
	MOVQ DX,R15
	MOVQ 48(SP),AX
	MULQ 48(SP)
	ADDQ AX,R10
	ADCQ DX,R11
	MOVQ 48(SP),AX
	SHLQ $1,AX
	MULQ 56(SP)
	ADDQ AX,R12
	ADCQ DX,R13
	MOVQ 48(SP),AX
	SHLQ $1,AX
	MULQ 64(SP)
	ADDQ AX,R14
	ADCQ DX,R15
	MOVQ 48(SP),DX
	IMUL3Q $38,DX,AX
	MULQ 72(SP)
	ADDQ AX,SI
	ADCQ DX,CX
	MOVQ 56(SP),AX
	MULQ 56(SP)
	ADDQ AX,R14
	ADCQ DX,R15
	MOVQ 56(SP),DX
	IMUL3Q $38,DX,AX
	MULQ 64(SP)
	ADDQ AX,SI
	ADCQ DX,CX
	MOVQ 56(SP),DX
	IMUL3Q $38,DX,AX
	MULQ 72(SP)
	ADDQ AX,R8
	ADCQ DX,R9
	MOVQ 64(SP),DX
	IMUL3Q $19,DX,AX
	MULQ 64(SP)
	ADDQ AX,R8
	ADCQ DX,R9
	MOVQ 64(SP),DX
	IMUL3Q $38,DX,AX
	MULQ 72(SP)
	ADDQ AX,R10
	ADCQ DX,R11
	MOVQ 72(SP),DX
	IMUL3Q $19,DX,AX
	MULQ 72(SP)
	ADDQ AX,R12
	ADCQ DX,R13
	MOVQ $REDMASK51,DX
	SHLQ $13,CX:SI
	ANDQ DX,SI
	SHLQ $13,R9:R8
	ANDQ DX,R8
	ADDQ CX,R8
	SHLQ $13,R11:R10
	ANDQ DX,R10
	ADDQ R9,R10
	SHLQ $13,R13:R12
	ANDQ DX,R12
	ADDQ R11,R12
	SHLQ $13,R15:R14
	ANDQ DX,R14
	ADDQ R13,R14
	IMUL3Q $19,R15,CX
	ADDQ CX,SI
	MOVQ SI,CX
	SHRQ $51,CX
	ADDQ R8,CX
	ANDQ DX,SI
	MOVQ CX,R8
	SHRQ $51,CX
	ADDQ R10,CX
	ANDQ DX,R8
	MOVQ CX,R9
	SHRQ $51,CX
	ADDQ R12,CX
	ANDQ DX,R9
	MOVQ CX,AX
	SHRQ $51,CX
	ADDQ R14,CX
	ANDQ DX,AX
	MOVQ CX,R10
	SHRQ $51,CX
	IMUL3Q $19,CX,CX
	ADDQ CX,SI
	ANDQ DX,R10
	MOVQ SI,80(SP)
	MOVQ R8,88(SP)
	MOVQ R9,96(SP)
	MOVQ AX,104(SP)
	MOVQ R10,112(SP)
	MOVQ 0(SP),AX
	MULQ 0(SP)
	MOVQ AX,SI
	MOVQ DX,CX
	MOVQ 0(SP),AX
	SHLQ $1,AX
	MULQ 8(SP)
	MOVQ AX,R8
	MOVQ DX,R9
	MOVQ 0(SP),AX
	SHLQ $1,AX
	MULQ 16(SP)
	MOVQ AX,R10
	MOVQ DX,R11
	MOVQ 0(SP),AX
	SHLQ $1,AX
	MULQ 24(SP)
	MOVQ AX,R12
	MOVQ DX,R13
	MOVQ 0(SP),AX
	SHLQ $1,AX
	MULQ 32(SP)
	MOVQ AX,R14
	MOVQ DX,R15
	MOVQ 8(SP),AX
	MULQ 8(SP)
	ADDQ AX,R10
	ADCQ DX,R11
	MOVQ 8(SP),AX
	SHLQ $1,AX
	MULQ 16(SP)
	ADDQ AX,R12
	ADCQ DX,R13
	MOVQ 8(SP),AX
	SHLQ $1,AX
	MULQ 24(SP)
	ADDQ AX,R14
	ADCQ DX,R15
	MOVQ 8(SP),DX
	IMUL3Q $38,DX,AX
	MULQ 32(SP)
	ADDQ AX,SI
	ADCQ DX,CX
	MOVQ 16(SP),AX
	MULQ 16(SP)
	ADDQ AX,R14
	ADCQ DX,R15
	MOVQ 16(SP),DX
	IMUL3Q $38,DX,AX
	MULQ 24(SP)
	ADDQ AX,SI
	ADCQ DX,CX
	MOVQ 16(SP),DX
	IMUL3Q $38,DX,AX
	MULQ 32(SP)
	ADDQ AX,R8
	ADCQ DX,R9
	MOVQ 24(SP),DX
	IMUL3Q $19,DX,AX
	MULQ 24(SP)
	ADDQ AX,R8
	ADCQ DX,R9
	MOVQ 24(SP),DX
	IMUL3Q $38,DX,AX
	MULQ 32(SP)
	ADDQ AX,R10
	ADCQ DX,R11
	MOVQ 32(SP),DX
	IMUL3Q $19,DX,AX
	MULQ 32(SP)
	ADDQ AX,R12
	ADCQ DX,R13
	MOVQ $REDMASK51,DX
	SHLQ $13,CX:SI
	ANDQ DX,SI
	SHLQ $13,R9:R8
	ANDQ DX,R8
	ADDQ CX,R8
	SHLQ $13,R11:R10
	ANDQ DX,R10
	ADDQ R9,R10
	SHLQ $13,R13:R12
	ANDQ DX,R12
	ADDQ R11,R12
	SHLQ $13,R15:R14
	ANDQ DX,R14
	ADDQ R13,R14
	IMUL3Q $19,R15,CX
	ADDQ CX,SI
	MOVQ SI,CX
	SHRQ $51,CX
	ADDQ R8,CX
	ANDQ DX,SI
	MOVQ CX,R8
	SHRQ $51,CX
	ADDQ R10,CX
	ANDQ DX,R8
	MOVQ CX,R9
	SHRQ $51,CX
	ADDQ R12,CX
	ANDQ DX,R9
	MOVQ CX,AX
	SHRQ $51,CX
	ADDQ R14,CX
	ANDQ DX,AX
	MOVQ CX,R10
	SHRQ $51,CX
	IMUL3Q $19,CX,CX
	ADDQ CX,SI
	ANDQ DX,R10
	MOVQ SI,120(SP)
	MOVQ R8,128(SP)
	MOVQ R9,136(SP)
	MOVQ AX,144(SP)
	MOVQ R10,152(SP)
	MOVQ SI,SI
	MOVQ R8,DX
	MOVQ R9,CX
	MOVQ AX,R8
	MOVQ R10,R9
	ADDQ ·_2P0(SB),SI
	ADDQ ·_2P1234(SB),DX
	ADDQ ·_2P1234(SB),CX
	ADDQ ·_2P1234(SB),R8
	ADDQ ·_2P1234(SB),R9
	SUBQ 80(SP),SI
	SUBQ 88(SP),DX
	SUBQ 96(SP),CX
	SUBQ 104(SP),R8
	SUBQ 112(SP),R9
	MOVQ SI,160(SP)
	MOVQ DX,168(SP)
	MOVQ CX,176(SP)
	MOVQ R8,184(SP)
	MOVQ R9,192(SP)
	MOVQ 120(DI),SI
	MOVQ 128(DI),DX
	MOVQ 136(DI),CX
	MOVQ 144(DI),R8
	MOVQ 152(DI),R9
	MOVQ SI,AX
	MOVQ DX,R10
	MOVQ CX,R11
	MOVQ R8,R12
	MOVQ R9,R13
	ADDQ ·_2P0(SB),AX
	ADDQ ·_2P1234(SB),R10
	ADDQ ·_2P1234(SB),R11
	ADDQ ·_2P1234(SB),R12
	ADDQ ·_2P1234(SB),R13
	ADDQ 160(DI),SI
	ADDQ 168(DI),DX
	ADDQ 176(DI),CX
	ADDQ 184(DI),R8
	ADDQ 192(DI),R9
	SUBQ 160(DI),AX
	SUBQ 168(DI),R10
	SUBQ 176(DI),R11
	SUBQ 184(DI),R12
	SUBQ 192(DI),R13
	MOVQ SI,200(SP)
	MOVQ DX,208(SP)
	MOVQ CX,216(SP)
	MOVQ R8,224(SP)
	MOVQ R9,232(SP)
	MOVQ AX,240(SP)
	MOVQ R10,248(SP)
	MOVQ R11,256(SP)
	MOVQ R12,264(SP)
	MOVQ R13,272(SP)
	MOVQ 224(SP),SI
	IMUL3Q $19,SI,AX
	MOVQ AX,280(SP)
	MULQ 56(SP)
	MOVQ AX,SI
	MOVQ DX,CX
	MOVQ 232(SP),DX
	IMUL3Q $19,DX,AX
	MOVQ AX,288(SP)
	MULQ 48(SP)
	ADDQ AX,SI
	ADCQ DX,CX
	MOVQ 200(SP),AX
	MULQ 40(SP)
	ADDQ AX,SI
	ADCQ DX,CX
	MOVQ 200(SP),AX
	MULQ 48(SP)
	MOVQ AX,R8
	MOVQ DX,R9
	MOVQ 200(SP),AX
	MULQ 56(SP)
	MOVQ AX,R10
	MOVQ DX,R11
	MOVQ 200(SP),AX
	MULQ 64(SP)
	MOVQ AX,R12
	MOVQ DX,R13
	MOVQ 200(SP),AX
	MULQ 72(SP)
	MOVQ AX,R14
	MOVQ DX,R15
	MOVQ 208(SP),AX
	MULQ 40(SP)
	ADDQ AX,R8
	ADCQ DX,R9
	MOVQ 208(SP),AX
	MULQ 48(SP)
	ADDQ AX,R10
	ADCQ DX,R11
	MOVQ 208(SP),AX
	MULQ 56(SP)
	ADDQ AX,R12
	ADCQ DX,R13
	MOVQ 208(SP),AX
	MULQ 64(SP)
	ADDQ AX,R14
	ADCQ DX,R15
	MOVQ 208(SP),DX
	IMUL3Q $19,DX,AX
	MULQ 72(SP)
	ADDQ AX,SI
	ADCQ DX,CX
	MOVQ 216(SP),AX
	MULQ 40(SP)
	ADDQ AX,R10
	ADCQ DX,R11
	MOVQ 216(SP),AX
	MULQ 48(SP)
	ADDQ AX,R12
	ADCQ DX,R13
	MOVQ 216(SP),AX
	MULQ 56(SP)
	ADDQ AX,R14
	ADCQ DX,R15
	MOVQ 216(SP),DX
	IMUL3Q $19,DX,AX
	MULQ 64(SP)
	ADDQ AX,SI
	ADCQ DX,CX
	MOVQ 216(SP),DX
	IMUL3Q $19,DX,AX
	MULQ 72(SP)
	ADDQ AX,R8
	ADCQ DX,R9
	MOVQ 224(SP),AX
	MULQ 40(SP)
	ADDQ AX,R12
	ADCQ DX,R13
	MOVQ 224(SP),AX
	MULQ 48(SP)
	ADDQ AX,R14
	ADCQ DX,R15
	MOVQ 280(SP),AX
	MULQ 64(SP)
	ADDQ AX,R8
	ADCQ DX,R9
	MOVQ 280(SP),AX
	MULQ 72(SP)
	ADDQ AX,R10
	ADCQ DX,R11
	MOVQ 232(SP),AX
	MULQ 40(SP)
	ADDQ AX,R14
	ADCQ DX,R15
	MOVQ 288(SP),AX
	MULQ 56(SP)
	ADDQ AX,R8
	ADCQ DX,R9
	MOVQ 288(SP),AX
	MULQ 64(SP)
	ADDQ AX,R10
	ADCQ DX,R11
	MOVQ 288(SP),AX
	MULQ 72(SP)
	ADDQ AX,R12
	ADCQ DX,R13
	MOVQ $REDMASK51,DX
	SHLQ $13,CX:SI
	ANDQ DX,SI
	SHLQ $13,R9:R8
	ANDQ DX,R8
	ADDQ CX,R8
	SHLQ $13,R11:R10
	ANDQ DX,R10
	ADDQ R9,R10
	SHLQ $13,R13:R12
	ANDQ DX,R12
	ADDQ R11,R12
	SHLQ $13,R15:R14
	ANDQ DX,R14
	ADDQ R13,R14
	IMUL3Q $19,R15,CX
	ADDQ CX,SI
	MOVQ SI,CX
	SHRQ $51,CX
	ADDQ R8,CX
	MOVQ CX,R8
	SHRQ $51,CX
	ANDQ DX,SI
	ADDQ R10,CX
	MOVQ CX,R9
	SHRQ $51,CX
	ANDQ DX,R8
	ADDQ R12,CX
	MOVQ CX,AX
	SHRQ $51,CX
	ANDQ DX,R9
	ADDQ R14,CX
	MOVQ CX,R10
	SHRQ $51,CX
	ANDQ DX,AX
	IMUL3Q $19,CX,CX
	ADDQ CX,SI
	ANDQ DX,R10
	MOVQ SI,40(SP)
	MOVQ R8,48(SP)
	MOVQ R9,56(SP)
	MOVQ AX,64(SP)
	MOVQ R10,72(SP)
	MOVQ 264(SP),SI
	IMUL3Q $19,SI,AX
	MOVQ AX,200(SP)
	MULQ 16(SP)
	MOVQ AX,SI
	MOVQ DX,CX
	MOVQ 272(SP),DX
	IMUL3Q $19,DX,AX
	MOVQ AX,208(SP)
	MULQ 8(SP)
	ADDQ AX,SI
	ADCQ DX,CX
	MOVQ 240(SP),AX
	MULQ 0(SP)
	ADDQ AX,SI
	ADCQ DX,CX
	MOVQ 240(SP),AX
	MULQ 8(SP)
	MOVQ AX,R8
	MOVQ DX,R9
	MOVQ 240(SP),AX
	MULQ 16(SP)
	MOVQ AX,R10
	MOVQ DX,R11
	MOVQ 240(SP),AX
	MULQ 24(SP)
	MOVQ AX,R12
	MOVQ DX,R13
	MOVQ 240(SP),AX
	MULQ 32(SP)
	MOVQ AX,R14
	MOVQ DX,R15
	MOVQ 248(SP),AX
	MULQ 0(SP)
	ADDQ AX,R8
	ADCQ DX,R9
	MOVQ 248(SP),AX
	MULQ 8(SP)
	ADDQ AX,R10
	ADCQ DX,R11
	MOVQ 248(SP),AX
	MULQ 16(SP)
	ADDQ AX,R12
	ADCQ DX,R13
	MOVQ 248(SP),AX
	MULQ 24(SP)
	ADDQ AX,R14
	ADCQ DX,R15
	MOVQ 248(SP),DX
	IMUL3Q $19,DX,AX
	MULQ 32(SP)
	ADDQ AX,SI
	ADCQ DX,CX
	MOVQ 256(SP),AX
	MULQ 0(SP)
	ADDQ AX,R10
	ADCQ DX,R11
	MOVQ 256(SP),AX
	MULQ 8(SP)
	ADDQ AX,R12
	ADCQ DX,R13
	MOVQ 256(SP),AX
	MULQ 16(SP)
	ADDQ AX,R14
	ADCQ DX,R15
	MOVQ 256(SP),DX
	IMUL3Q $19,DX,AX
	MULQ 24(SP)
	ADDQ AX,SI
	ADCQ DX,CX
	MOVQ 256(SP),DX
	IMUL3Q $19,DX,AX
	MULQ 32(SP)
	ADDQ AX,R8
	ADCQ DX,R9
	MOVQ 264(SP),AX
	MULQ 0(SP)
	ADDQ AX,R12
	ADCQ DX,R13
	MOVQ 264(SP),AX
	MULQ 8(SP)
	ADDQ AX,R14
	ADCQ DX,R15
	MOVQ 200(SP),AX
	MULQ 24(SP)
	ADDQ AX,R8
	ADCQ DX,R9
	MOVQ 200(SP),AX
	MULQ 32(SP)
	ADDQ AX,R10
	ADCQ DX,R11
	MOVQ 272(SP),AX
	MULQ 0(SP)
	ADDQ AX,R14
	ADCQ DX,R15
	MOVQ 208(SP),AX
	MULQ 16(SP)
	ADDQ AX,R8
	ADCQ DX,R9
	MOVQ 208(SP),AX
	MULQ 24(SP)
	ADDQ AX,R10
	ADCQ DX,R11
	MOVQ 208(SP),AX
	MULQ 32(SP)
	ADDQ AX,R12
	ADCQ DX,R13
	MOVQ $REDMASK51,DX
	SHLQ $13,CX:SI
	ANDQ DX,SI
	SHLQ $13,R9:R8
	ANDQ DX,R8
	ADDQ CX,R8
	SHLQ $13,R11:R10
	ANDQ DX,R10
	ADDQ R9,R10
	SHLQ $13,R13:R12
	ANDQ DX,R12
	ADDQ R11,R12
	SHLQ $13,R15:R14
	ANDQ DX,R14
	ADDQ R13,R14
	IMUL3Q $19,R15,CX
	ADDQ CX,SI
	MOVQ SI,CX
	SHRQ $51,CX
	ADDQ R8,CX
	MOVQ CX,R8
	SHRQ $51,CX
	ANDQ DX,SI
	ADDQ R10,CX
	MOVQ CX,R9
	SHRQ $51,CX
	ANDQ DX,R8
	ADDQ R12,CX
	MOVQ CX,AX
	SHRQ $51,CX
	ANDQ DX,R9
	ADDQ R14,CX
	MOVQ CX,R10
	SHRQ $51,CX
	ANDQ DX,AX
	IMUL3Q $19,CX,CX
	ADDQ CX,SI
	ANDQ DX,R10
	MOVQ SI,DX
	MOVQ R8,CX
	MOVQ R9,R11
	MOVQ AX,R12
	MOVQ R10,R13
	ADDQ ·_2P0(SB),DX
	ADDQ ·_2P1234(SB),CX
	ADDQ ·_2P1234(SB),R11
	ADDQ ·_2P1234(SB),R12
	ADDQ ·_2P1234(SB),R13
	ADDQ 40(SP),SI
	ADDQ 48(SP),R8
	ADDQ 56(SP),R9
	ADDQ 64(SP),AX
	ADDQ 72(SP),R10
	SUBQ 40(SP),DX
	SUBQ 48(SP),CX
	SUBQ 56(SP),R11
	SUBQ 64(SP),R12
	SUBQ 72(SP),R13
	MOVQ SI,120(DI)
	MOVQ R8,128(DI)
	MOVQ R9,136(DI)
	MOVQ AX,144(DI)
	MOVQ R10,152(DI)
	MOVQ DX,160(DI)
	MOVQ CX,168(DI)
	MOVQ R11,176(DI)
	MOVQ R12,184(DI)
	MOVQ R13,192(DI)
	MOVQ 120(DI),AX
	MULQ 120(DI)
	MOVQ AX,SI
	MOVQ DX,CX
	MOVQ 120(DI),AX
	SHLQ $1,AX
	MULQ 128(DI)
	MOVQ AX,R8
	MOVQ DX,R9
	MOVQ 120(DI),AX
	SHLQ $1,AX
	MULQ 136(DI)
	MOVQ AX,R10
	MOVQ DX,R11
	MOVQ 120(DI),AX
	SHLQ $1,AX
	MULQ 144(DI)
	MOVQ AX,R12
	MOVQ DX,R13
	MOVQ 120(DI),AX
	SHLQ $1,AX
	MULQ 152(DI)
	MOVQ AX,R14
	MOVQ DX,R15
	MOVQ 128(DI),AX
	MULQ 128(DI)
	ADDQ AX,R10
	ADCQ DX,R11
	MOVQ 128(DI),AX
	SHLQ $1,AX
	MULQ 136(DI)
	ADDQ AX,R12
	ADCQ DX,R13
	MOVQ 128(DI),AX
	SHLQ $1,AX
	MULQ 144(DI)
	ADDQ AX,R14
	ADCQ DX,R15
	MOVQ 128(DI),DX
	IMUL3Q $38,DX,AX
	MULQ 152(DI)
	ADDQ AX,SI
	ADCQ DX,CX
	MOVQ 136(DI),AX
	MULQ 136(DI)
	ADDQ AX,R14
	ADCQ DX,R15
	MOVQ 136(DI),DX
	IMUL3Q $38,DX,AX
	MULQ 144(DI)
	ADDQ AX,SI
	ADCQ DX,CX
	MOVQ 136(DI),DX
	IMUL3Q $38,DX,AX
	MULQ 152(DI)
	ADDQ AX,R8
	ADCQ DX,R9
	MOVQ 144(DI),DX
	IMUL3Q $19,DX,AX
	MULQ 144(DI)
	ADDQ AX,R8
	ADCQ DX,R9
	MOVQ 144(DI),DX
	IMUL3Q $38,DX,AX
	MULQ 152(DI)
	ADDQ AX,R10
	ADCQ DX,R11
	MOVQ 152(DI),DX
	IMUL3Q $19,DX,AX
	MULQ 152(DI)
	ADDQ AX,R12
	ADCQ DX,R13
	MOVQ $REDMASK51,DX
	SHLQ $13,CX:SI
	ANDQ DX,SI
	SHLQ $13,R9:R8
	ANDQ DX,R8
	ADDQ CX,R8
	SHLQ $13,R11:R10
	ANDQ DX,R10
	ADDQ R9,R10
	SHLQ $13,R13:R12
	ANDQ DX,R12
	ADDQ R11,R12
	SHLQ $13,R15:R14
	ANDQ DX,R14
	ADDQ R13,R14
	IMUL3Q $19,R15,CX
	ADDQ CX,SI
	MOVQ SI,CX
	SHRQ $51,CX
	ADDQ R8,CX
	ANDQ DX,SI
	MOVQ CX,R8
	SHRQ $51,CX
	ADDQ R10,CX
	ANDQ DX,R8
	MOVQ CX,R9
	SHRQ $51,CX
	ADDQ R12,CX
	ANDQ DX,R9
	MOVQ CX,AX
	SHRQ $51,CX
	ADDQ R14,CX
	ANDQ DX,AX
	MOVQ CX,R10
	SHRQ $51,CX
	IMUL3Q $19,CX,CX
	ADDQ CX,SI
	ANDQ DX,R10
	MOVQ SI,120(DI)
	MOVQ R8,128(DI)
	MOVQ R9,136(DI)
	MOVQ AX,144(DI)
	MOVQ R10,152(DI)
	MOVQ 160(DI),AX
	MULQ 160(DI)
	MOVQ AX,SI
	MOVQ DX,CX
	MOVQ 160(DI),AX
	SHLQ $1,AX
	MULQ 168(DI)
	MOVQ AX,R8
	MOVQ DX,R9
	MOVQ 160(DI),AX
	SHLQ $1,AX
	MULQ 176(DI)
	MOVQ AX,R10
	MOVQ DX,R11
	MOVQ 160(DI),AX
	SHLQ $1,AX
	MULQ 184(DI)
	MOVQ AX,R12
	MOVQ DX,R13
	MOVQ 160(DI),AX
	SHLQ $1,AX
	MULQ 192(DI)
	MOVQ AX,R14
	MOVQ DX,R15
	MOVQ 168(DI),AX
	MULQ 168(DI)
	ADDQ AX,R10
	ADCQ DX,R11
	MOVQ 168(DI),AX
	SHLQ $1,AX
	MULQ 176(DI)
	ADDQ AX,R12
	ADCQ DX,R13
	MOVQ 168(DI),AX
	SHLQ $1,AX
	MULQ 184(DI)
	ADDQ AX,R14
	ADCQ DX,R15
	MOVQ 168(DI),DX
	IMUL3Q $38,DX,AX
	MULQ 192(DI)
	ADDQ AX,SI
	ADCQ DX,CX
	MOVQ 176(DI),AX
	MULQ 176(DI)
	ADDQ AX,R14
	ADCQ DX,R15
	MOVQ 176(DI),DX
	IMUL3Q $38,DX,AX
	MULQ 184(DI)
	ADDQ AX,SI
	ADCQ DX,CX
	MOVQ 176(DI),DX
	IMUL3Q $38,DX,AX
	MULQ 192(DI)
	ADDQ AX,R8
	ADCQ DX,R9
	MOVQ 184(DI),DX
	IMUL3Q $19,DX,AX
	MULQ 184(DI)
	ADDQ AX,R8
	ADCQ DX,R9
	MOVQ 184(DI),DX
	IMUL3Q $38,DX,AX
	MULQ 192(DI)
	ADDQ AX,R10
	ADCQ DX,R11
	MOVQ 192(DI),DX
	IMUL3Q $19,DX,AX
	MULQ 192(DI)
	ADDQ AX,R12
	ADCQ DX,R13
	MOVQ $REDMASK51,DX
	SHLQ $13,CX:SI
	ANDQ DX,SI
	SHLQ $13,R9:R8
	ANDQ DX,R8
	ADDQ CX,R8
	SHLQ $13,R11:R10
	ANDQ DX,R10
	ADDQ R9,R10
	SHLQ $13,R13:R12
	ANDQ DX,R12
	ADDQ R11,R12
	SHLQ $13,R15:R14
	ANDQ DX,R14
	ADDQ R13,R14
	IMUL3Q $19,R15,CX
	ADDQ CX,SI
	MOVQ SI,CX
	SHRQ $51,CX
	ADDQ R8,CX
	ANDQ DX,SI
	MOVQ CX,R8
	SHRQ $51,CX
	ADDQ R10,CX
	ANDQ DX,R8
	MOVQ CX,R9
	SHRQ $51,CX
	ADDQ R12,CX
	ANDQ DX,R9
	MOVQ CX,AX
	SHRQ $51,CX
	ADDQ R14,CX
	ANDQ DX,AX
	MOVQ CX,R10
	SHRQ $51,CX
	IMUL3Q $19,CX,CX
	ADDQ CX,SI
	ANDQ DX,R10
	MOVQ SI,160(DI)
	MOVQ R8,168(DI)
	MOVQ R9,176(DI)
	MOVQ AX,184(DI)
	MOVQ R10,192(DI)
	MOVQ 184(DI),SI
	IMUL3Q $19,SI,AX
	MOVQ AX,0(SP)
	MULQ 16(DI)
	MOVQ AX,SI
	MOVQ DX,CX
	MOVQ 192(DI),DX
	IMUL3Q $19,DX,AX
	MOVQ AX,8(SP)
	MULQ 8(DI)
	ADDQ AX,SI
	ADCQ DX,CX
	MOVQ 160(DI),AX
	MULQ 0(DI)
	ADDQ AX,SI
	ADCQ DX,CX
	MOVQ 160(DI),AX
	MULQ 8(DI)
	MOVQ AX,R8
	MOVQ DX,R9
	MOVQ 160(DI),AX
	MULQ 16(DI)
	MOVQ AX,R10
	MOVQ DX,R11
	MOVQ 160(DI),AX
	MULQ 24(DI)
	MOVQ AX,R12
	MOVQ DX,R13
	MOVQ 160(DI),AX
	MULQ 32(DI)
	MOVQ AX,R14
	MOVQ DX,R15
	MOVQ 168(DI),AX
	MULQ 0(DI)
	ADDQ AX,R8
	ADCQ DX,R9
	MOVQ 168(DI),AX
	MULQ 8(DI)
	ADDQ AX,R10
	ADCQ DX,R11
	MOVQ 168(DI),AX
	MULQ 16(DI)
	ADDQ AX,R12
	ADCQ DX,R13
	MOVQ 168(DI),AX
	MULQ 24(DI)
	ADDQ AX,R14
	ADCQ DX,R15
	MOVQ 168(DI),DX
	IMUL3Q $19,DX,AX
	MULQ 32(DI)
	ADDQ AX,SI
	ADCQ DX,CX
	MOVQ 176(DI),AX
	MULQ 0(DI)
	ADDQ AX,R10
	ADCQ DX,R11
	MOVQ 176(DI),AX
	MULQ 8(DI)
	ADDQ AX,R12
	ADCQ DX,R13
	MOVQ 176(DI),AX
	MULQ 16(DI)
	ADDQ AX,R14
	ADCQ DX,R15
	MOVQ 176(DI),DX
	IMUL3Q $19,DX,AX
	MULQ 24(DI)
	ADDQ AX,SI
	ADCQ DX,CX
	MOVQ 176(DI),DX
	IMUL3Q $19,DX,AX
	MULQ 32(DI)
	ADDQ AX,R8
	ADCQ DX,R9
	MOVQ 184(DI),AX
	MULQ 0(DI)
	ADDQ AX,R12
	ADCQ DX,R13
	MOVQ 184(DI),AX
	MULQ 8(DI)
	ADDQ AX,R14
	ADCQ DX,R15
	MOVQ 0(SP),AX
	MULQ 24(DI)
	ADDQ AX,R8
	ADCQ DX,R9
	MOVQ 0(SP),AX
	MULQ 32(DI)
	ADDQ AX,R10
	ADCQ DX,R11
	MOVQ 192(DI),AX
	MULQ 0(DI)
	ADDQ AX,R14
	ADCQ DX,R15
	MOVQ 8(SP),AX
	MULQ 16(DI)
	ADDQ AX,R8
	ADCQ DX,R9
	MOVQ 8(SP),AX
	MULQ 24(DI)
	ADDQ AX,R10
	ADCQ DX,R11
	MOVQ 8(SP),AX
	MULQ 32(DI)
	ADDQ AX,R12
	ADCQ DX,R13
	MOVQ $REDMASK51,DX
	SHLQ $13,CX:SI
	ANDQ DX,SI
	SHLQ $13,R9:R8
	ANDQ DX,R8
	ADDQ CX,R8
	SHLQ $13,R11:R10
	ANDQ DX,R10
	ADDQ R9,R10
	SHLQ $13,R13:R12
	ANDQ DX,R12
	ADDQ R11,R12
	SHLQ $13,R15:R14
	ANDQ DX,R14
	ADDQ R13,R14
	IMUL3Q $19,R15,CX
	ADDQ CX,SI
	MOVQ SI,CX
	SHRQ $51,CX
	ADDQ R8,CX
	MOVQ CX,R8
	SHRQ $51,CX
	ANDQ DX,SI
	ADDQ R10,CX
	MOVQ CX,R9
	SHRQ $51,CX
	ANDQ DX,R8
	ADDQ R12,CX
	MOVQ CX,AX
	SHRQ $51,CX
	ANDQ DX,R9
	ADDQ R14,CX
	MOVQ CX,R10
	SHRQ $51,CX
	ANDQ DX,AX
	IMUL3Q $19,CX,CX
	ADDQ CX,SI
	ANDQ DX,R10
	MOVQ SI,160(DI)
	MOVQ R8,168(DI)
	MOVQ R9,176(DI)
	MOVQ AX,184(DI)
	MOVQ R10,192(DI)
	MOVQ 144(SP),SI
	IMUL3Q $19,SI,AX
	MOVQ AX,0(SP)
	MULQ 96(SP)
	MOVQ AX,SI
	MOVQ DX,CX
	MOVQ 152(SP),DX
	IMUL3Q $19,DX,AX
	MOVQ AX,8(SP)
	MULQ 88(SP)
	ADDQ AX,SI
	ADCQ DX,CX
	MOVQ 120(SP),AX
	MULQ 80(SP)
	ADDQ AX,SI
	ADCQ DX,CX
	MOVQ 120(SP),AX
	MULQ 88(SP)
	MOVQ AX,R8
	MOVQ DX,R9
	MOVQ 120(SP),AX
	MULQ 96(SP)
	MOVQ AX,R10
	MOVQ DX,R11
	MOVQ 120(SP),AX
	MULQ 104(SP)
	MOVQ AX,R12
	MOVQ DX,R13
	MOVQ 120(SP),AX
	MULQ 112(SP)
	MOVQ AX,R14
	MOVQ DX,R15
	MOVQ 128(SP),AX
	MULQ 80(SP)
	ADDQ AX,R8
	ADCQ DX,R9
	MOVQ 128(SP),AX
	MULQ 88(SP)
	ADDQ AX,R10
	ADCQ DX,R11
	MOVQ 128(SP),AX
	MULQ 96(SP)
	ADDQ AX,R12
	ADCQ DX,R13
	MOVQ 128(SP),AX
	MULQ 104(SP)
	ADDQ AX,R14
	ADCQ DX,R15
	MOVQ 128(SP),DX
	IMUL3Q $19,DX,AX
	MULQ 112(SP)
	ADDQ AX,SI
	ADCQ DX,CX
	MOVQ 136(SP),AX
	MULQ 80(SP)
	ADDQ AX,R10
	ADCQ DX,R11
	MOVQ 136(SP),AX
	MULQ 88(SP)
	ADDQ AX,R12
	ADCQ DX,R13
	MOVQ 136(SP),AX
	MULQ 96(SP)
	ADDQ AX,R14
	ADCQ DX,R15
	MOVQ 136(SP),DX
	IMUL3Q $19,DX,AX
	MULQ 104(SP)
	ADDQ AX,SI
	ADCQ DX,CX
	MOVQ 136(SP),DX
	IMUL3Q $19,DX,AX
	MULQ 112(SP)
	ADDQ AX,R8
	ADCQ DX,R9
	MOVQ 144(SP),AX
	MULQ 80(SP)
	ADDQ AX,R12
	ADCQ DX,R13
	MOVQ 144(SP),AX
	MULQ 88(SP)
	ADDQ AX,R14
	ADCQ DX,R15
	MOVQ 0(SP),AX
	MULQ 104(SP)
	ADDQ AX,R8
	ADCQ DX,R9
	MOVQ 0(SP),AX
	MULQ 112(SP)
	ADDQ AX,R10
	ADCQ DX,R11
	MOVQ 152(SP),AX
	MULQ 80(SP)
	ADDQ AX,R14
	ADCQ DX,R15
	MOVQ 8(SP),AX
	MULQ 96(SP)
	ADDQ AX,R8
	ADCQ DX,R9
	MOVQ 8(SP),AX
	MULQ 104(SP)
	ADDQ AX,R10
	ADCQ DX,R11
	MOVQ 8(SP),AX
	MULQ 112(SP)
	ADDQ AX,R12
	ADCQ DX,R13
	MOVQ $REDMASK51,DX
	SHLQ $13,CX:SI
	ANDQ DX,SI
	SHLQ $13,R9:R8
	ANDQ DX,R8
	ADDQ CX,R8
	SHLQ $13,R11:R10
	ANDQ DX,R10
	ADDQ R9,R10
	SHLQ $13,R13:R12
	ANDQ DX,R12
	ADDQ R11,R12
	SHLQ $13,R15:R14
	ANDQ DX,R14
	ADDQ R13,R14
	IMUL3Q $19,R15,CX
	ADDQ CX,SI
	MOVQ SI,CX
	SHRQ $51,CX
	ADDQ R8,CX
	MOVQ CX,R8
	SHRQ $51,CX
	ANDQ DX,SI
	ADDQ R10,CX
	MOVQ CX,R9
	SHRQ $51,CX
	ANDQ DX,R8
	ADDQ R12,CX
	MOVQ CX,AX
	SHRQ $51,CX
	ANDQ DX,R9
	ADDQ R14,CX
	MOVQ CX,R10
	SHRQ $51,CX
	ANDQ DX,AX
	IMUL3Q $19,CX,CX
	ADDQ CX,SI
	ANDQ DX,R10
	MOVQ SI,40(DI)
	MOVQ R8,48(DI)
	MOVQ R9,56(DI)
	MOVQ AX,64(DI)
	MOVQ R10,72(DI)
	MOVQ 160(SP),AX
	MULQ ·_121666_213(SB)
	SHRQ $13,AX
	MOVQ AX,SI
	MOVQ DX,CX
	MOVQ 168(SP),AX
	MULQ ·_121666_213(SB)
	SHRQ $13,AX
	ADDQ AX,CX
	MOVQ DX,R8
	MOVQ 176(SP),AX
	MULQ ·_121666_213(SB)
	SHRQ $13,AX
	ADDQ AX,R8
	MOVQ DX,R9
	MOVQ 184(SP),AX
	MULQ ·_121666_213(SB)
	SHRQ $13,AX
	ADDQ AX,R9
	MOVQ DX,R10
	MOVQ 192(SP),AX
	MULQ ·_121666_213(SB)
	SHRQ $13,AX
	ADDQ AX,R10
	IMUL3Q $19,DX,DX
	ADDQ DX,SI
	ADDQ 80(SP),SI
	ADDQ 88(SP),CX
	ADDQ 96(SP),R8
	ADDQ 104(SP),R9
	ADDQ 112(SP),R10
	MOVQ SI,80(DI)
	MOVQ CX,88(DI)
	MOVQ R8,96(DI)
	MOVQ R9,104(DI)
	MOVQ R10,112(DI)
	MOVQ 104(DI),SI
	IMUL3Q $19,SI,AX
	MOVQ AX,0(SP)
	MULQ 176(SP)
	MOVQ AX,SI
	MOVQ DX,CX
	MOVQ 112(DI),DX
	IMUL3Q $19,DX,AX
	MOVQ AX,8(SP)
	MULQ 168(SP)
	ADDQ AX,SI
	ADCQ DX,CX
	MOVQ 80(DI),AX
	MULQ 160(SP)
	ADDQ AX,SI
	ADCQ DX,CX
	MOVQ 80(DI),AX
	MULQ 168(SP)
	MOVQ AX,R8
	MOVQ DX,R9
	MOVQ 80(DI),AX
	MULQ 176(SP)
	MOVQ AX,R10
	MOVQ DX,R11
	MOVQ 80(DI),AX
	MULQ 184(SP)
	MOVQ AX,R12
	MOVQ DX,R13
	MOVQ 80(DI),AX
	MULQ 192(SP)
	MOVQ AX,R14
	MOVQ DX,R15
	MOVQ 88(DI),AX
	MULQ 160(SP)
	ADDQ AX,R8
	ADCQ DX,R9
	MOVQ 88(DI),AX
	MULQ 168(SP)
	ADDQ AX,R10
	ADCQ DX,R11
	MOVQ 88(DI),AX
	MULQ 176(SP)
	ADDQ AX,R12
	ADCQ DX,R13
	MOVQ 88(DI),AX
	MULQ 184(SP)
	ADDQ AX,R14
	ADCQ DX,R15
	MOVQ 88(DI),DX
	IMUL3Q $19,DX,AX
	MULQ 192(SP)
	ADDQ AX,SI
	ADCQ DX,CX
	MOVQ 96(DI),AX
	MULQ 160(SP)
	ADDQ AX,R10
	ADCQ DX,R11
	MOVQ 96(DI),AX
	MULQ 168(SP)
	ADDQ AX,R12
	ADCQ DX,R13
	MOVQ 96(DI),AX
	MULQ 176(SP)
	ADDQ AX,R14
	ADCQ DX,R15
	MOVQ 96(DI),DX
	IMUL3Q $19,DX,AX
	MULQ 184(SP)
	ADDQ AX,SI
	ADCQ DX,CX
	MOVQ 96(DI),DX
	IMUL3Q $19,DX,AX
	MULQ 192(SP)
	ADDQ AX,R8
	ADCQ DX,R9
	MOVQ 104(DI),AX
	MULQ 160(SP)
	ADDQ AX,R12
	ADCQ DX,R13
	MOVQ 104(DI),AX
	MULQ 168(SP)
	ADDQ AX,R14
	ADCQ DX,R15
	MOVQ 0(SP),AX
	MULQ 184(SP)
	ADDQ AX,R8
	ADCQ DX,R9
	MOVQ 0(SP),AX
	MULQ 192(SP)
	ADDQ AX,R10
	ADCQ DX,R11
	MOVQ 112(DI),AX
	MULQ 160(SP)
	ADDQ AX,R14
	ADCQ DX,R15
	MOVQ 8(SP),AX
	MULQ 176(SP)
	ADDQ AX,R8
	ADCQ DX,R9
	MOVQ 8(SP),AX
	MULQ 184(SP)
	ADDQ AX,R10
	ADCQ DX,R11
	MOVQ 8(SP),AX
	MULQ 192(SP)
	ADDQ AX,R12
	ADCQ DX,R13
	MOVQ $REDMASK51,DX
	SHLQ $13,CX:SI
	ANDQ DX,SI
	SHLQ $13,R9:R8
	ANDQ DX,R8
	ADDQ CX,R8
	SHLQ $13,R11:R10
	ANDQ DX,R10
	ADDQ R9,R10
	SHLQ $13,R13:R12
	ANDQ DX,R12
	ADDQ R11,R12
	SHLQ $13,R15:R14
	ANDQ DX,R14
	ADDQ R13,R14
	IMUL3Q $19,R15,CX
	ADDQ CX,SI
	MOVQ SI,CX
	SHRQ $51,CX
	ADDQ R8,CX
	MOVQ CX,R8
	SHRQ $51,CX
	ANDQ DX,SI
	ADDQ R10,CX
	MOVQ CX,R9
	SHRQ $51,CX
	ANDQ DX,R8
	ADDQ R12,CX
	MOVQ CX,AX
	SHRQ $51,CX
	ANDQ DX,R9
	ADDQ R14,CX
	MOVQ CX,R10
	SHRQ $51,CX
	ANDQ DX,AX
	IMUL3Q $19,CX,CX
	ADDQ CX,SI
	ANDQ DX,R10
	MOVQ SI,80(DI)
	MOVQ R8,88(DI)
	MOVQ R9,96(DI)
	MOVQ AX,104(DI)
	MOVQ R10,112(DI)
	RET


text:
// Copyright 2012 The Go Authors. All rights reserved.
// Use of this source code is governed by a BSD-style
// license that can be found in the LICENSE file.

// +build amd64,!gccgo,!appengine

// func cswap(inout *[4][5]uint64, v uint64)
TEXT ·cswap(SB),7,$0
	MOVQ inout+0(FP),DI
	MOVQ v+8(FP),SI

	SUBQ $1, SI
	NOTQ SI
	MOVQ SI, X15
	PSHUFD $0x44, X15, X15

	MOVOU 0(DI), X0
	MOVOU 16(DI), X2
	MOVOU 32(DI), X4
	MOVOU 48(DI), X6
	MOVOU 64(DI), X8
	MOVOU 80(DI), X1
	MOVOU 96(DI), X3
	MOVOU 112(DI), X5
	MOVOU 128(DI), X7
	MOVOU 144(DI), X9

	MOVO X1, X10
	MOVO X3, X11
	MOVO X5, X12
	MOVO X7, X13
	MOVO X9, X14

	PXOR X0, X10
	PXOR X2, X11
	PXOR X4, X12
	PXOR X6, X13
	PXOR X8, X14
	PAND X15, X10
	PAND X15, X11
	PAND X15, X12
	PAND X15, X13
	PAND X15, X14
	PXOR X10, X0
	PXOR X10, X1
	PXOR X11, X2
	PXOR X11, X3
	PXOR X12, X4
	PXOR X12, X5
	PXOR X13, X6
	PXOR X13, X7
	PXOR X14, X8
	PXOR X14, X9

	MOVOU X0, 0(DI)
	MOVOU X2, 16(DI)
	MOVOU X4, 32(DI)
	MOVOU X6, 48(DI)
	MOVOU X8, 64(DI)
	MOVOU X1, 80(DI)
	MOVOU X3, 96(DI)
	MOVOU X5, 112(DI)
	MOVOU X7, 128(DI)
	MOVOU X9, 144(DI)
	RET


text:
// Copyright 2012 The Go Authors. All rights reserved.
// Use of this source code is governed by a BSD-style
// license that can be found in the LICENSE file.

// This code was translated into a form compatible with 6a from the public
// domain sources in SUPERCOP: https://bench.cr.yp.to/supercop.html

// +build amd64,!gccgo,!appengine

#include "const_amd64.h"

// func freeze(inout *[5]uint64)
TEXT ·freeze(SB),7,$0-8
	MOVQ inout+0(FP), DI

	MOVQ 0(DI),SI
	MOVQ 8(DI),DX
	MOVQ 16(DI),CX
	MOVQ 24(DI),R8
	MOVQ 32(DI),R9
	MOVQ $REDMASK51,AX
	MOVQ AX,R10
	SUBQ $18,R10
	MOVQ $3,R11
REDUCELOOP:
	MOVQ SI,R12
	SHRQ $51,R12
	ANDQ AX,SI
	ADDQ R12,DX
	MOVQ DX,R12
	SHRQ $51,R12
	ANDQ AX,DX
	ADDQ R12,CX
	MOVQ CX,R12
	SHRQ $51,R12
	ANDQ AX,CX
	ADDQ R12,R8
	MOVQ R8,R12
	SHRQ $51,R12
	ANDQ AX,R8
	ADDQ R12,R9
	MOVQ R9,R12
	SHRQ $51,R12
	ANDQ AX,R9
	IMUL3Q $19,R12,R12
	ADDQ R12,SI
	SUBQ $1,R11
	JA REDUCELOOP
	MOVQ $1,R12
	CMPQ R10,SI
	CMOVQLT R11,R12
	CMPQ AX,DX
	CMOVQNE R11,R12
	CMPQ AX,CX
	CMOVQNE R11,R12
	CMPQ AX,R8
	CMOVQNE R11,R12
	CMPQ AX,R9
	CMOVQNE R11,R12
	NEGQ R12
	ANDQ R12,AX
	ANDQ R12,R10
	SUBQ R10,SI
	SUBQ AX,DX
	SUBQ AX,CX
	SUBQ AX,R8
	SUBQ AX,R9
	MOVQ SI,0(DI)
	MOVQ DX,8(DI)
	MOVQ CX,16(DI)
	MOVQ R8,24(DI)
	MOVQ R9,32(DI)
	RET


text:
// Copyright 2012 The Go Authors. All rights reserved.
// Use of this source code is governed by a BSD-style
// license that can be found in the LICENSE file.

// Package curve25519 provides an implementation of scalar multiplication on
// the elliptic curve known as curve25519. See https://cr.yp.to/ecdh.html
package curve25519 // import "golang.org/x/crypto/curve25519"

// basePoint is the x coordinate of the generator of the curve.
var basePoint = [32]byte{9, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0}

// ScalarMult sets dst to the product in*base where dst and base are the x
// coordinates of group points and all values are in little-endian form.
func ScalarMult(dst, in, base *[32]byte) {
	scalarMult(dst, in, base)
}

// ScalarBaseMult sets dst to the product in*base where dst and base are the x
// coordinates of group points, base is the standard generator and all values
// are in little-endian form.
func ScalarBaseMult(dst, in *[32]byte) {
	ScalarMult(dst, in, &basePoint)
}