libcrypto/curve25519/curve25519.c

67   int64_t h7 = load_3(s + 23) << 5;
85   carry7 = h7 + (1 << 24); h8 += carry7 >> 25; h7 -= carry7 & kTop39Bits;
90   carry6 = h6 + (1 << 25); h7 += carry6 >> 26; h6 -= carry6 & kTop38Bits;
100   h[7] = h7;
135   int32_t h7 = h[7];
148   q = (h7 + q) >> 25;
162   h7 += h6 >> 26; h6 &= kBottom26Bits;
163   h8 += h7 >> 25; h7 &= kBottom25Bits;
195   s[22] = (h6 >> 23) | ((uint32_t)(h7) << 3);
196   s[23] = h7 >> 5;
197   s[24] = h7 >> 13;
198   s[25] = (h7 >> 21) | ((uint32_t)(h8) << 4);
422   int64_t h7 = f0g7+f1g6   +f2g5   +f3g4   +f4g3   +f5g2   +f6g1   +f7g0   +f8g9_19+f9g8_19;
439    *   i.e. |h1| <= 1.7*2^59; narrower ranges for h3, h5, h7, h9 */
456   carry6 = h6 + (1 << 25); h7 += carry6 >> 26; h6 -= carry6 & kTop38Bits;
460   /* |h7| <= 1.71*2^59 */
463   carry7 = h7 + (1 << 24); h8 += carry7 >> 25; h7 -= carry7 & kTop39Bits;
465   /* |h7| <= 2^24; from now on fits into int32 unchanged */
491   h[7] = h7;
592   int64_t h7 = f0f7_2+f1f6_2 +f2f5_2 +f3f4_2 +f8f9_38;
613   carry6 = h6 + (1 << 25); h7 += carry6 >> 26; h6 -= carry6 & kTop38Bits;
616   carry7 = h7 + (1 << 24); h8 += carry7 >> 25; h7 -= carry7 & kTop39Bits;
632   h[7] = h7;
843   int64_t h7 = f0f7_2+f1f6_2 +f2f5_2 +f3f4_2 +f8f9_38;
864   h7 += h7;
875   carry6 = h6 + (1 << 25); h7 += carry6 >> 26; h6 -= carry6 & kTop38Bits;
878   carry7 = h7 + (1 << 24); h8 += carry7 >> 25; h7 -= carry7 & kTop39Bits;
894   h[7] = h7;
4783   int64_t h7 = f7 * (int64_t) 121666;
4801   carry7 = h7 + (1 << 24); h8 += carry7 >> 25; h7 -= carry7 & kTop39Bits;
4806   carry6 = h6 + (1 << 25); h7 += carry6 >> 26; h6 -= carry6 & kTop38Bits;
4816   h[7] = h7;