Replace (f,g) with (g,g) if b == 1; replace (f,g) with (f,g) if b == 0.

FeMul calculates h = f * g Can overlap h with f or g.

FeNeg sets h = -f Preconditions: |f| bounded by 1.1*2^25,1.1*2^24,1.1*2^25,1.1*2^24,etc.

FeSquare calculates h = f*f.

FeSquare2 sets h = 2 * f * f Can overlap h with f.

FeToBytes marshals h to s.

GeDoubleScalarMultVartime sets r = a*A + b*B where a = a[0]+256*a[1]+...+256^31 a[31].

GeScalarMultBase computes h = a*B, where a = a[0]+256*a[1]+...+256^31 a[31] B is the Ed25519 base point (x,4/5) with x positive.

GeScalarMultVartime sets r = a*A where a = a[0]+256*a[1]+...+256^31 a[31].

InvertModL computes z mod l and puts the result into out.

ScMinimal returns true if the given scalar is less than the order of the curve.

The scalars are GF(2^252 + 27742317777372353535851937790883648493).

Input: a[0]+256*a[1]+...+256^31*a[31] = a b[0]+256*b[1]+...+256^31*b[31] = b c[0]+256*c[1]+...+256^31*c[31] = c Output: s[0]+256*s[1]+...+256^31*s[31] = (ab+c) mod l where l = 2^252 + 27742317777372353535851937790883648493.

Input: s[0]+256*s[1]+...+256^63*s[63] = s Output: s[0]+256*s[1]+...+256^31*s[31] = s mod l where l = 2^252 + 27742317777372353535851937790883648493.

A is a constant in the Montgomery-form of curve25519.

SqrtM1 is the square-root of -1 in the field.

FieldElement represents an element of the field GF(2^255 - 19).