ec

Whether every limb of a is zero (an OR-accumulate over all limbs, no early exit).

Multi-limb unsigned compare, most-significant limb first.

r = a - b (mod 2^kBits), returns the borrow.

r = a + b (mod 2^kBits), returns the carry.

CIOS Montgomery multiplication: r = a*b*R^-1 mod m.

Modular addition: r = a + b mod m (add, then one conditional subtract of m).

Modular subtraction: r = a - b mod m (subtract, then one conditional add of m on borrow).

Convert a into Montgomery form: r = a*R mod m (one mont_mul by R^2).

Convert a out of Montgomery form: r = a*R^-1 mod m (one mont_mul by 1).

r = a^-1 mod m, via Fermat: a^(m-2).

a^-1 mod 2^64 (a odd), by Newton's iteration.

Build the Montgomery context for modulus m — every constant (n0, R^2 mod m, R mod m) derived at startup, no hand-transcribed Montgomery magic.

The curve's field context: the Montgomery context for the prime P, built once per instantiation (function-local static).

The curve's scalar context: the Montgomery context for the group order N, built once per instantiation (function-local static).

Load kBytes big-endian bytes into a little-endian limb array.

Store a limb array as kBytes big-endian bytes (the inverse of be_to_fe).

The point at infinity (the group identity): Z = 0 with the explicit flag set.

Jacobian point doubling, r = 2q, using the a = -3 formulas (true of every NIST prime curve).

Jacobian point addition, r = a + b, with branchy special cases (either operand infinity, a == b -> double, a == -b -> infinity).

Strauss-Shamir: u1*A + u2*B with ONE doubling chain (kBits doublings total) instead of two separate scalar multiplications.

The affine x-coordinate (normal form) of a Jacobian point: x = X / Z^2.

Lift an affine point into Jacobian Montgomery form (Z = 1).

The curve base point G, lifted to Jacobian form once (function-local static).

Fixed-base comb for k*G.

Branch-free boolean-to-mask: false -> 0, true -> all-ones.

Constant-time conditional move over a field element: r = m ?

Constant-time conditional move over a Jacobian point (all three coordinates via fe_cmov; the inf flag is recomputed from Z, which encodes infinity throughout the CT path).

Point doubling WITHOUT the is-infinity early return: the formula's Z3 = 2*Y*Z is already 0 when the input is infinity (Z==0), so it self-encodes infinity, and a prime-order curve has no finite 2-torsion point that could double TO infinity — so no branch is needed.

Point addition, branch-free.

Constant-time table lookup: scan every entry, copying the one whose index == sel via a mask, so the memory-access pattern (and timing) is independent of the secret selector.

k*G for a SECRET scalar k, in constant time: 64 doublings + 64 unconditional adds over the fixed-base comb table.

Differential self-check for the constant-time point ops.

Reduce a scalar already known to be < 2n into [0, n): a single conditional subtraction of the group order n.

Reduce a big-endian hash to a scalar in [0, n).

Parse SEQUENCE{INTEGER r, INTEGER s} -> kBytes big-endian r and s.

Is (x, y) on the curve y^2 = x^3 - 3x + b (mod p)?

ECDSA verification over raw byte forms: pubkey = 2*kBytes X||Y, sig = 2*kBytes r||s.

ECDSA verification of the DER form (SEQUENCE{INTEGER r, INTEGER s} — TLS/X.509).

Encode a raw r||s signature (2*kBytes big-endian bytes) as the DER SEQUENCE{INTEGER r, INTEGER s} that TLS CertificateVerify and X.509 carry — the exact inverse of der_to_rs.