* The function fiat_pasta_fq_add adds two field elements in the Montgomery domain.

* The function fiat_pasta_fp_addcarryx_u64 is an addition with carry.

* The function fiat_pasta_fp_cmovznz_u64 is a single-word conditional move.

* The function fiat_pasta_fp_divstep computes a divstep.

* The function fiat_pasta_fp_divstep_precomp returns the precomputed value for Bernstein-Yang-inversion (in montgomery form).

* The function fiat_pasta_fp_from_bytes deserializes a field element NOT in the Montgomery domain from bytes in little-endian order.

* The function fiat_pasta_fp_from_montgomery translates a field element out of the Montgomery domain.

* The function fiat_pasta_fp_msat returns the saturated represtation of the prime modulus.

* The function fiat_pasta_fp_mul multiplies two field elements in the Montgomery domain.

* The function fiat_pasta_fp_mulx_u64 is a multiplication, returning the full double-width result.

* The function fiat_pasta_fp_nonzero outputs a single non-zero word if the input is non-zero and zero otherwise.

* The function fiat_pasta_fp_opp negates a field element in the Montgomery domain.

* The function fiat_pasta_fp_selectznz is a multi-limb conditional select.

* The function fiat_pasta_fp_set_one returns the field element one in the Montgomery domain.

* The function fiat_pasta_fp_square squares a field element in the Montgomery domain.

* The function fiat_pasta_fp_sub subtracts two field elements in the Montgomery domain.

* The function fiat_pasta_fp_subborrowx_u64 is a subtraction with borrow.

* The function fiat_pasta_fp_to_bytes serializes a field element NOT in the Montgomery domain to bytes in little-endian order.

* The function fiat_pasta_fp_to_montgomery translates a field element into the Montgomery domain.

* The function fiat_pasta_fq_add adds two field elements in the Montgomery domain.

* The function fiat_pasta_fq_addcarryx_u64 is an addition with carry.

* The function fiat_pasta_fq_cmovznz_u64 is a single-word conditional move.

* The function fiat_pasta_fq_divstep computes a divstep.

* The function fiat_pasta_fq_divstep_precomp returns the precomputed value for Bernstein-Yang-inversion (in montgomery form).

* The function fiat_pasta_fq_from_bytes deserializes a field element NOT in the Montgomery domain from bytes in little-endian order.

* The function fiat_pasta_fq_from_montgomery translates a field element out of the Montgomery domain.

* The function fiat_pasta_fq_msat returns the saturated represtation of the prime modulus.

* The function fiat_pasta_fq_mul multiplies two field elements in the Montgomery domain.

* The function fiat_pasta_fq_mulx_u64 is a multiplication, returning the full double-width result.

* The function fiat_pasta_fq_nonzero outputs a single non-zero word if the input is non-zero and zero otherwise.

* The function fiat_pasta_fq_opp negates a field element in the Montgomery domain.

* The function fiat_pasta_fq_selectznz is a multi-limb conditional select.

* The function fiat_pasta_fq_set_one returns the field element one in the Montgomery domain.

* The function fiat_pasta_fq_square squares a field element in the Montgomery domain.

* The function fiat_pasta_fq_sub subtracts two field elements in the Montgomery domain.

* The function fiat_pasta_fq_subborrowx_u64 is a subtraction with borrow.

* The function fiat_pasta_fq_to_bytes serializes a field element NOT in the Montgomery domain to bytes in little-endian order.

* The function fiat_pasta_fq_to_montgomery translates a field element into the Montgomery domain.

privateKey : big endian publicKey : big endian X || Y all data is in big int field.

MdsMatrix3W = [SpongeWidth3W][SpongeWidth3W]Field{.

RoundKeys3W = [RoundCount3W][SpongeWidth3W]Field{.