libcrypto/curve25519/curve25519.c

66   int64_t h6 = load_3(s + 20) << 7;
84   carry5 = h5 + (1 << 24); h6 += carry5 >> 25; h5 -= carry5 & kTop39Bits;
90   carry6 = h6 + (1 << 25); h7 += carry6 >> 26; h6 -= carry6 & kTop38Bits;
99   h[6] = h6;
134   int32_t h6 = h[6];
147   q = (h6 + q) >> 26;
161   h6 += h5 >> 25; h5 &= kBottom25Bits;
162   h7 += h6 >> 26; h6 &= kBottom26Bits;
192   s[19] = (h5 >> 24) | ((uint32_t)(h6) << 1);
193   s[20] = h6 >> 7;
194   s[21] = h6 >> 15;
195   s[22] = (h6 >> 23) | ((uint32_t)(h7) << 3);
421   int64_t h6 = f0g6+f1g5_2 +f2g4   +f3g3_2 +f4g2   +f5g1_2 +f6g0   +f7g9_38+f8g8_19+f9g7_38;
437    *   i.e. |h0| <= 1.4*2^60; narrower ranges for h2, h4, h6, h8
449   carry5 = h5 + (1 << 24); h6 += carry5 >> 25; h5 -= carry5 & kTop39Bits;
453   /* |h6| <= 1.41*2^60 */
456   carry6 = h6 + (1 << 25); h7 += carry6 >> 26; h6 -= carry6 & kTop38Bits;
458   /* |h6| <= 2^25; from now on fits into int32 unchanged */
490   h[6] = h6;
591   int64_t h6 = f0f6_2+f1f5_4 +f2f4_2 +f3f3_2 +f7f9_76+f8f8_19;
610   carry5 = h5 + (1 << 24); h6 += carry5 >> 25; h5 -= carry5 & kTop39Bits;
613   carry6 = h6 + (1 << 25); h7 += carry6 >> 26; h6 -= carry6 & kTop38Bits;
631   h[6] = h6;
842   int64_t h6 = f0f6_2+f1f5_4 +f2f4_2 +f3f3_2 +f7f9_76+f8f8_19;
863   h6 += h6;
872   carry5 = h5 + (1 << 24); h6 += carry5 >> 25; h5 -= carry5 & kTop39Bits;
875   carry6 = h6 + (1 << 25); h7 += carry6 >> 26; h6 -= carry6 & kTop38Bits;
893   h[6] = h6;
4782   int64_t h6 = f6 * (int64_t) 121666;
4800   carry5 = h5 + (1 << 24); h6 += carry5 >> 25; h5 -= carry5 & kTop39Bits;
4806   carry6 = h6 + (1 << 25); h7 += carry6 >> 26; h6 -= carry6 & kTop38Bits;
4815   h[6] = h6;