// Copyright (c) 2016 The Go Authors. All rights reserved.
// Use of this source code is governed by a BSD-style
// license that can be found in the LICENSE file.

package edwards25519

import (
	
	
	
)

// A Scalar is an integer modulo
//
//     l = 2^252 + 27742317777372353535851937790883648493
//
// which is the prime order of the edwards25519 group.
//
// This type works similarly to math/big.Int, and all arguments and
// receivers are allowed to alias.
//
// The zero value is a valid zero element.
type Scalar struct {
	// s is the Scalar value in little-endian. The value is always reduced
	// between operations.
	s [32]byte
}

var (
	scZero = Scalar{[32]byte{0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0}}

	scOne = Scalar{[32]byte{1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0}}

	scMinusOne = Scalar{[32]byte{236, 211, 245, 92, 26, 99, 18, 88, 214, 156, 247, 162, 222, 249, 222, 20, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 16}}
)

// NewScalar returns a new zero Scalar.
func () *Scalar {
	return &Scalar{}
}

// MultiplyAdd sets s = x * y + z mod l, and returns s.
func ( *Scalar) (, ,  *Scalar) *Scalar {
	scMulAdd(&.s, &.s, &.s, &.s)
	return 
}

// Add sets s = x + y mod l, and returns s.
func ( *Scalar) (,  *Scalar) *Scalar {
	// s = 1 * x + y mod l
	scMulAdd(&.s, &scOne.s, &.s, &.s)
	return 
}

// Subtract sets s = x - y mod l, and returns s.
func ( *Scalar) (,  *Scalar) *Scalar {
	// s = -1 * y + x mod l
	scMulAdd(&.s, &scMinusOne.s, &.s, &.s)
	return 
}

// Negate sets s = -x mod l, and returns s.
func ( *Scalar) ( *Scalar) *Scalar {
	// s = -1 * x + 0 mod l
	scMulAdd(&.s, &scMinusOne.s, &.s, &scZero.s)
	return 
}

// Multiply sets s = x * y mod l, and returns s.
func ( *Scalar) (,  *Scalar) *Scalar {
	// s = x * y + 0 mod l
	scMulAdd(&.s, &.s, &.s, &scZero.s)
	return 
}

// Set sets s = x, and returns s.
func ( *Scalar) ( *Scalar) *Scalar {
	* = *
	return 
}

// SetUniformBytes sets s to an uniformly distributed value given 64 uniformly
// distributed random bytes.
func ( *Scalar) ( []byte) *Scalar {
	if len() != 64 {
		panic("edwards25519: invalid SetUniformBytes input length")
	}
	var  [64]byte
	copy([:], [:])
	scReduce(&.s, &)
	return 
}

// SetCanonicalBytes sets s = x, where x is a 32-byte little-endian encoding of
// s, and returns s. If x is not a canonical encoding of s, SetCanonicalBytes
// returns nil and an error, and the receiver is unchanged.
func ( *Scalar) ( []byte) (*Scalar, error) {
	if len() != 32 {
		return nil, errors.New("invalid scalar length")
	}
	 := &Scalar{}
	copy(.s[:], )
	if !isReduced() {
		return nil, errors.New("invalid scalar encoding")
	}
	.s = .s
	return , nil
}

// isReduced returns whether the given scalar is reduced modulo l.
func isReduced( *Scalar) bool {
	for  := len(.s) - 1;  >= 0; -- {
		switch {
		case .s[] > scMinusOne.s[]:
			return false
		case .s[] < scMinusOne.s[]:
			return true
		}
	}
	return true
}

// SetBytesWithClamping applies the buffer pruning described in RFC 8032,
// Section 5.1.5 (also known as clamping) and sets s to the result. The input
// must be 32 bytes, and it is not modified.
//
// Note that since Scalar values are always reduced modulo the prime order of
// the curve, the resulting value will not preserve any of the cofactor-clearing
// properties that clamping is meant to provide. It will however work as
// expected as long as it is applied to points on the prime order subgroup, like
// in Ed25519. In fact, it is lost to history why RFC 8032 adopted the
// irrelevant RFC 7748 clamping, but it is now required for compatibility.
func ( *Scalar) ( []byte) *Scalar {
	// The description above omits the purpose of the high bits of the clamping
	// for brevity, but those are also lost to reductions, and are also
	// irrelevant to edwards25519 as they protect against a specific
	// implementation bug that was once observed in a generic Montgomery ladder.
	if len() != 32 {
		panic("edwards25519: invalid SetBytesWithClamping input length")
	}
	var  [64]byte
	copy([:], [:])
	[0] &= 248
	[31] &= 63
	[31] |= 64
	scReduce(&.s, &)
	return 
}

// Bytes returns the canonical 32-byte little-endian encoding of s.
func ( *Scalar) () []byte {
	 := make([]byte, 32)
	copy(, .s[:])
	return 
}

// Equal returns 1 if s and t are equal, and 0 otherwise.
func ( *Scalar) ( *Scalar) int {
	return subtle.ConstantTimeCompare(.s[:], .s[:])
}

// scMulAdd and scReduce are ported from the public domain, “ref10”
// implementation of ed25519 from SUPERCOP.

func load3( []byte) int64 {
	 := int64([0])
	 |= int64([1]) << 8
	 |= int64([2]) << 16
	return 
}

func load4( []byte) int64 {
	 := int64([0])
	 |= int64([1]) << 8
	 |= int64([2]) << 16
	 |= int64([3]) << 24
	return 
}

// Input:
//   a[0]+256*a[1]+...+256^31*a[31] = a
//   b[0]+256*b[1]+...+256^31*b[31] = b
//   c[0]+256*c[1]+...+256^31*c[31] = c
//
// Output:
//   s[0]+256*s[1]+...+256^31*s[31] = (ab+c) mod l
//   where l = 2^252 + 27742317777372353535851937790883648493.
func scMulAdd(, , ,  *[32]byte) {
	 := 2097151 & load3([:])
	 := 2097151 & (load4([2:]) >> 5)
	 := 2097151 & (load3([5:]) >> 2)
	 := 2097151 & (load4([7:]) >> 7)
	 := 2097151 & (load4([10:]) >> 4)
	 := 2097151 & (load3([13:]) >> 1)
	 := 2097151 & (load4([15:]) >> 6)
	 := 2097151 & (load3([18:]) >> 3)
	 := 2097151 & load3([21:])
	 := 2097151 & (load4([23:]) >> 5)
	 := 2097151 & (load3([26:]) >> 2)
	 := (load4([28:]) >> 7)
	 := 2097151 & load3([:])
	 := 2097151 & (load4([2:]) >> 5)
	 := 2097151 & (load3([5:]) >> 2)
	 := 2097151 & (load4([7:]) >> 7)
	 := 2097151 & (load4([10:]) >> 4)
	 := 2097151 & (load3([13:]) >> 1)
	 := 2097151 & (load4([15:]) >> 6)
	 := 2097151 & (load3([18:]) >> 3)
	 := 2097151 & load3([21:])
	 := 2097151 & (load4([23:]) >> 5)
	 := 2097151 & (load3([26:]) >> 2)
	 := (load4([28:]) >> 7)
	 := 2097151 & load3([:])
	 := 2097151 & (load4([2:]) >> 5)
	 := 2097151 & (load3([5:]) >> 2)
	 := 2097151 & (load4([7:]) >> 7)
	 := 2097151 & (load4([10:]) >> 4)
	 := 2097151 & (load3([13:]) >> 1)
	 := 2097151 & (load4([15:]) >> 6)
	 := 2097151 & (load3([18:]) >> 3)
	 := 2097151 & load3([21:])
	 := 2097151 & (load4([23:]) >> 5)
	 := 2097151 & (load3([26:]) >> 2)
	 := (load4([28:]) >> 7)
	var  [23]int64

	 :=  + *
	 :=  + * + *
	 :=  + * + * + *
	 :=  + * + * + * + *
	 :=  + * + * + * + * + *
	 :=  + * + * + * + * + * + *
	 :=  + * + * + * + * + * + * + *
	 :=  + * + * + * + * + * + * + * + *
	 :=  + * + * + * + * + * + * + * + * + *
	 :=  + * + * + * + * + * + * + * + * + * + *
	 :=  + * + * + * + * + * + * + * + * + * + * + *
	 :=  + * + * + * + * + * + * + * + * + * + * + * + *
	 := * + * + * + * + * + * + * + * + * + * + *
	 := * + * + * + * + * + * + * + * + * + *
	 := * + * + * + * + * + * + * + * + *
	 := * + * + * + * + * + * + * + *
	 := * + * + * + * + * + * + *
	 := * + * + * + * + * + *
	 := * + * + * + * + *
	 := * + * + * + *
	 := * + * + *
	 := * + *
	 :=  * 
	 := int64(0)

	[0] = ( + (1 << 20)) >> 21
	 += [0]
	 -= [0] << 21
	[2] = ( + (1 << 20)) >> 21
	 += [2]
	 -= [2] << 21
	[4] = ( + (1 << 20)) >> 21
	 += [4]
	 -= [4] << 21
	[6] = ( + (1 << 20)) >> 21
	 += [6]
	 -= [6] << 21
	[8] = ( + (1 << 20)) >> 21
	 += [8]
	 -= [8] << 21
	[10] = ( + (1 << 20)) >> 21
	 += [10]
	 -= [10] << 21
	[12] = ( + (1 << 20)) >> 21
	 += [12]
	 -= [12] << 21
	[14] = ( + (1 << 20)) >> 21
	 += [14]
	 -= [14] << 21
	[16] = ( + (1 << 20)) >> 21
	 += [16]
	 -= [16] << 21
	[18] = ( + (1 << 20)) >> 21
	 += [18]
	 -= [18] << 21
	[20] = ( + (1 << 20)) >> 21
	 += [20]
	 -= [20] << 21
	[22] = ( + (1 << 20)) >> 21
	 += [22]
	 -= [22] << 21

	[1] = ( + (1 << 20)) >> 21
	 += [1]
	 -= [1] << 21
	[3] = ( + (1 << 20)) >> 21
	 += [3]
	 -= [3] << 21
	[5] = ( + (1 << 20)) >> 21
	 += [5]
	 -= [5] << 21
	[7] = ( + (1 << 20)) >> 21
	 += [7]
	 -= [7] << 21
	[9] = ( + (1 << 20)) >> 21
	 += [9]
	 -= [9] << 21
	[11] = ( + (1 << 20)) >> 21
	 += [11]
	 -= [11] << 21
	[13] = ( + (1 << 20)) >> 21
	 += [13]
	 -= [13] << 21
	[15] = ( + (1 << 20)) >> 21
	 += [15]
	 -= [15] << 21
	[17] = ( + (1 << 20)) >> 21
	 += [17]
	 -= [17] << 21
	[19] = ( + (1 << 20)) >> 21
	 += [19]
	 -= [19] << 21
	[21] = ( + (1 << 20)) >> 21
	 += [21]
	 -= [21] << 21

	 +=  * 666643
	 +=  * 470296
	 +=  * 654183
	 -=  * 997805
	 +=  * 136657
	 -=  * 683901
	 = 0

	 +=  * 666643
	 +=  * 470296
	 +=  * 654183
	 -=  * 997805
	 +=  * 136657
	 -=  * 683901
	 = 0

	 +=  * 666643
	 +=  * 470296
	 +=  * 654183
	 -=  * 997805
	 +=  * 136657
	 -=  * 683901
	 = 0

	 +=  * 666643
	 +=  * 470296
	 +=  * 654183
	 -=  * 997805
	 +=  * 136657
	 -=  * 683901
	 = 0

	 +=  * 666643
	 +=  * 470296
	 +=  * 654183
	 -=  * 997805
	 +=  * 136657
	 -=  * 683901
	 = 0

	 +=  * 666643
	 +=  * 470296
	 +=  * 654183
	 -=  * 997805
	 +=  * 136657
	 -=  * 683901
	 = 0

	[6] = ( + (1 << 20)) >> 21
	 += [6]
	 -= [6] << 21
	[8] = ( + (1 << 20)) >> 21
	 += [8]
	 -= [8] << 21
	[10] = ( + (1 << 20)) >> 21
	 += [10]
	 -= [10] << 21
	[12] = ( + (1 << 20)) >> 21
	 += [12]
	 -= [12] << 21
	[14] = ( + (1 << 20)) >> 21
	 += [14]
	 -= [14] << 21
	[16] = ( + (1 << 20)) >> 21
	 += [16]
	 -= [16] << 21

	[7] = ( + (1 << 20)) >> 21
	 += [7]
	 -= [7] << 21
	[9] = ( + (1 << 20)) >> 21
	 += [9]
	 -= [9] << 21
	[11] = ( + (1 << 20)) >> 21
	 += [11]
	 -= [11] << 21
	[13] = ( + (1 << 20)) >> 21
	 += [13]
	 -= [13] << 21
	[15] = ( + (1 << 20)) >> 21
	 += [15]
	 -= [15] << 21

	 +=  * 666643
	 +=  * 470296
	 +=  * 654183
	 -=  * 997805
	 +=  * 136657
	 -=  * 683901
	 = 0

	 +=  * 666643
	 +=  * 470296
	 +=  * 654183
	 -=  * 997805
	 +=  * 136657
	 -=  * 683901
	 = 0

	 +=  * 666643
	 +=  * 470296
	 +=  * 654183
	 -=  * 997805
	 +=  * 136657
	 -=  * 683901
	 = 0

	 +=  * 666643
	 +=  * 470296
	 +=  * 654183
	 -=  * 997805
	 +=  * 136657
	 -=  * 683901
	 = 0

	 +=  * 666643
	 +=  * 470296
	 +=  * 654183
	 -=  * 997805
	 +=  * 136657
	 -=  * 683901
	 = 0

	 +=  * 666643
	 +=  * 470296
	 +=  * 654183
	 -=  * 997805
	 +=  * 136657
	 -=  * 683901
	 = 0

	[0] = ( + (1 << 20)) >> 21
	 += [0]
	 -= [0] << 21
	[2] = ( + (1 << 20)) >> 21
	 += [2]
	 -= [2] << 21
	[4] = ( + (1 << 20)) >> 21
	 += [4]
	 -= [4] << 21
	[6] = ( + (1 << 20)) >> 21
	 += [6]
	 -= [6] << 21
	[8] = ( + (1 << 20)) >> 21
	 += [8]
	 -= [8] << 21
	[10] = ( + (1 << 20)) >> 21
	 += [10]
	 -= [10] << 21

	[1] = ( + (1 << 20)) >> 21
	 += [1]
	 -= [1] << 21
	[3] = ( + (1 << 20)) >> 21
	 += [3]
	 -= [3] << 21
	[5] = ( + (1 << 20)) >> 21
	 += [5]
	 -= [5] << 21
	[7] = ( + (1 << 20)) >> 21
	 += [7]
	 -= [7] << 21
	[9] = ( + (1 << 20)) >> 21
	 += [9]
	 -= [9] << 21
	[11] = ( + (1 << 20)) >> 21
	 += [11]
	 -= [11] << 21

	 +=  * 666643
	 +=  * 470296
	 +=  * 654183
	 -=  * 997805
	 +=  * 136657
	 -=  * 683901
	 = 0

	[0] =  >> 21
	 += [0]
	 -= [0] << 21
	[1] =  >> 21
	 += [1]
	 -= [1] << 21
	[2] =  >> 21
	 += [2]
	 -= [2] << 21
	[3] =  >> 21
	 += [3]
	 -= [3] << 21
	[4] =  >> 21
	 += [4]
	 -= [4] << 21
	[5] =  >> 21
	 += [5]
	 -= [5] << 21
	[6] =  >> 21
	 += [6]
	 -= [6] << 21
	[7] =  >> 21
	 += [7]
	 -= [7] << 21
	[8] =  >> 21
	 += [8]
	 -= [8] << 21
	[9] =  >> 21
	 += [9]
	 -= [9] << 21
	[10] =  >> 21
	 += [10]
	 -= [10] << 21
	[11] =  >> 21
	 += [11]
	 -= [11] << 21

	 +=  * 666643
	 +=  * 470296
	 +=  * 654183
	 -=  * 997805
	 +=  * 136657
	 -=  * 683901
	 = 0

	[0] =  >> 21
	 += [0]
	 -= [0] << 21
	[1] =  >> 21
	 += [1]
	 -= [1] << 21
	[2] =  >> 21
	 += [2]
	 -= [2] << 21
	[3] =  >> 21
	 += [3]
	 -= [3] << 21
	[4] =  >> 21
	 += [4]
	 -= [4] << 21
	[5] =  >> 21
	 += [5]
	 -= [5] << 21
	[6] =  >> 21
	 += [6]
	 -= [6] << 21
	[7] =  >> 21
	 += [7]
	 -= [7] << 21
	[8] =  >> 21
	 += [8]
	 -= [8] << 21
	[9] =  >> 21
	 += [9]
	 -= [9] << 21
	[10] =  >> 21
	 += [10]
	 -= [10] << 21

	[0] = byte( >> 0)
	[1] = byte( >> 8)
	[2] = byte(( >> 16) | ( << 5))
	[3] = byte( >> 3)
	[4] = byte( >> 11)
	[5] = byte(( >> 19) | ( << 2))
	[6] = byte( >> 6)
	[7] = byte(( >> 14) | ( << 7))
	[8] = byte( >> 1)
	[9] = byte( >> 9)
	[10] = byte(( >> 17) | ( << 4))
	[11] = byte( >> 4)
	[12] = byte( >> 12)
	[13] = byte(( >> 20) | ( << 1))
	[14] = byte( >> 7)
	[15] = byte(( >> 15) | ( << 6))
	[16] = byte( >> 2)
	[17] = byte( >> 10)
	[18] = byte(( >> 18) | ( << 3))
	[19] = byte( >> 5)
	[20] = byte( >> 13)
	[21] = byte( >> 0)
	[22] = byte( >> 8)
	[23] = byte(( >> 16) | ( << 5))
	[24] = byte( >> 3)
	[25] = byte( >> 11)
	[26] = byte(( >> 19) | ( << 2))
	[27] = byte( >> 6)
	[28] = byte(( >> 14) | ( << 7))
	[29] = byte( >> 1)
	[30] = byte( >> 9)
	[31] = byte( >> 17)
}

// Input:
//   s[0]+256*s[1]+...+256^63*s[63] = s
//
// Output:
//   s[0]+256*s[1]+...+256^31*s[31] = s mod l
//   where l = 2^252 + 27742317777372353535851937790883648493.
func scReduce( *[32]byte,  *[64]byte) {
	 := 2097151 & load3([:])
	 := 2097151 & (load4([2:]) >> 5)
	 := 2097151 & (load3([5:]) >> 2)
	 := 2097151 & (load4([7:]) >> 7)
	 := 2097151 & (load4([10:]) >> 4)
	 := 2097151 & (load3([13:]) >> 1)
	 := 2097151 & (load4([15:]) >> 6)
	 := 2097151 & (load3([18:]) >> 3)
	 := 2097151 & load3([21:])
	 := 2097151 & (load4([23:]) >> 5)
	 := 2097151 & (load3([26:]) >> 2)
	 := 2097151 & (load4([28:]) >> 7)
	 := 2097151 & (load4([31:]) >> 4)
	 := 2097151 & (load3([34:]) >> 1)
	 := 2097151 & (load4([36:]) >> 6)
	 := 2097151 & (load3([39:]) >> 3)
	 := 2097151 & load3([42:])
	 := 2097151 & (load4([44:]) >> 5)
	 := 2097151 & (load3([47:]) >> 2)
	 := 2097151 & (load4([49:]) >> 7)
	 := 2097151 & (load4([52:]) >> 4)
	 := 2097151 & (load3([55:]) >> 1)
	 := 2097151 & (load4([57:]) >> 6)
	 := (load4([60:]) >> 3)

	 +=  * 666643
	 +=  * 470296
	 +=  * 654183
	 -=  * 997805
	 +=  * 136657
	 -=  * 683901
	 = 0

	 +=  * 666643
	 +=  * 470296
	 +=  * 654183
	 -=  * 997805
	 +=  * 136657
	 -=  * 683901
	 = 0

	 +=  * 666643
	 +=  * 470296
	 +=  * 654183
	 -=  * 997805
	 +=  * 136657
	 -=  * 683901
	 = 0

	 +=  * 666643
	 +=  * 470296
	 +=  * 654183
	 -=  * 997805
	 +=  * 136657
	 -=  * 683901
	 = 0

	 +=  * 666643
	 +=  * 470296
	 +=  * 654183
	 -=  * 997805
	 +=  * 136657
	 -=  * 683901
	 = 0

	 +=  * 666643
	 +=  * 470296
	 +=  * 654183
	 -=  * 997805
	 +=  * 136657
	 -=  * 683901
	 = 0

	var  [17]int64

	[6] = ( + (1 << 20)) >> 21
	 += [6]
	 -= [6] << 21
	[8] = ( + (1 << 20)) >> 21
	 += [8]
	 -= [8] << 21
	[10] = ( + (1 << 20)) >> 21
	 += [10]
	 -= [10] << 21
	[12] = ( + (1 << 20)) >> 21
	 += [12]
	 -= [12] << 21
	[14] = ( + (1 << 20)) >> 21
	 += [14]
	 -= [14] << 21
	[16] = ( + (1 << 20)) >> 21
	 += [16]
	 -= [16] << 21

	[7] = ( + (1 << 20)) >> 21
	 += [7]
	 -= [7] << 21
	[9] = ( + (1 << 20)) >> 21
	 += [9]
	 -= [9] << 21
	[11] = ( + (1 << 20)) >> 21
	 += [11]
	 -= [11] << 21
	[13] = ( + (1 << 20)) >> 21
	 += [13]
	 -= [13] << 21
	[15] = ( + (1 << 20)) >> 21
	 += [15]
	 -= [15] << 21

	 +=  * 666643
	 +=  * 470296
	 +=  * 654183
	 -=  * 997805
	 +=  * 136657
	 -=  * 683901
	 = 0

	 +=  * 666643
	 +=  * 470296
	 +=  * 654183
	 -=  * 997805
	 +=  * 136657
	 -=  * 683901
	 = 0

	 +=  * 666643
	 +=  * 470296
	 +=  * 654183
	 -=  * 997805
	 +=  * 136657
	 -=  * 683901
	 = 0

	 +=  * 666643
	 +=  * 470296
	 +=  * 654183
	 -=  * 997805
	 +=  * 136657
	 -=  * 683901
	 = 0

	 +=  * 666643
	 +=  * 470296
	 +=  * 654183
	 -=  * 997805
	 +=  * 136657
	 -=  * 683901
	 = 0

	 +=  * 666643
	 +=  * 470296
	 +=  * 654183
	 -=  * 997805
	 +=  * 136657
	 -=  * 683901
	 = 0

	[0] = ( + (1 << 20)) >> 21
	 += [0]
	 -= [0] << 21
	[2] = ( + (1 << 20)) >> 21
	 += [2]
	 -= [2] << 21
	[4] = ( + (1 << 20)) >> 21
	 += [4]
	 -= [4] << 21
	[6] = ( + (1 << 20)) >> 21
	 += [6]
	 -= [6] << 21
	[8] = ( + (1 << 20)) >> 21
	 += [8]
	 -= [8] << 21
	[10] = ( + (1 << 20)) >> 21
	 += [10]
	 -= [10] << 21

	[1] = ( + (1 << 20)) >> 21
	 += [1]
	 -= [1] << 21
	[3] = ( + (1 << 20)) >> 21
	 += [3]
	 -= [3] << 21
	[5] = ( + (1 << 20)) >> 21
	 += [5]
	 -= [5] << 21
	[7] = ( + (1 << 20)) >> 21
	 += [7]
	 -= [7] << 21
	[9] = ( + (1 << 20)) >> 21
	 += [9]
	 -= [9] << 21
	[11] = ( + (1 << 20)) >> 21
	 += [11]
	 -= [11] << 21

	 +=  * 666643
	 +=  * 470296
	 +=  * 654183
	 -=  * 997805
	 +=  * 136657
	 -=  * 683901
	 = 0

	[0] =  >> 21
	 += [0]
	 -= [0] << 21
	[1] =  >> 21
	 += [1]
	 -= [1] << 21
	[2] =  >> 21
	 += [2]
	 -= [2] << 21
	[3] =  >> 21
	 += [3]
	 -= [3] << 21
	[4] =  >> 21
	 += [4]
	 -= [4] << 21
	[5] =  >> 21
	 += [5]
	 -= [5] << 21
	[6] =  >> 21
	 += [6]
	 -= [6] << 21
	[7] =  >> 21
	 += [7]
	 -= [7] << 21
	[8] =  >> 21
	 += [8]
	 -= [8] << 21
	[9] =  >> 21
	 += [9]
	 -= [9] << 21
	[10] =  >> 21
	 += [10]
	 -= [10] << 21
	[11] =  >> 21
	 += [11]
	 -= [11] << 21

	 +=  * 666643
	 +=  * 470296
	 +=  * 654183
	 -=  * 997805
	 +=  * 136657
	 -=  * 683901
	 = 0

	[0] =  >> 21
	 += [0]
	 -= [0] << 21
	[1] =  >> 21
	 += [1]
	 -= [1] << 21
	[2] =  >> 21
	 += [2]
	 -= [2] << 21
	[3] =  >> 21
	 += [3]
	 -= [3] << 21
	[4] =  >> 21
	 += [4]
	 -= [4] << 21
	[5] =  >> 21
	 += [5]
	 -= [5] << 21
	[6] =  >> 21
	 += [6]
	 -= [6] << 21
	[7] =  >> 21
	 += [7]
	 -= [7] << 21
	[8] =  >> 21
	 += [8]
	 -= [8] << 21
	[9] =  >> 21
	 += [9]
	 -= [9] << 21
	[10] =  >> 21
	 += [10]
	 -= [10] << 21

	[0] = byte( >> 0)
	[1] = byte( >> 8)
	[2] = byte(( >> 16) | ( << 5))
	[3] = byte( >> 3)
	[4] = byte( >> 11)
	[5] = byte(( >> 19) | ( << 2))
	[6] = byte( >> 6)
	[7] = byte(( >> 14) | ( << 7))
	[8] = byte( >> 1)
	[9] = byte( >> 9)
	[10] = byte(( >> 17) | ( << 4))
	[11] = byte( >> 4)
	[12] = byte( >> 12)
	[13] = byte(( >> 20) | ( << 1))
	[14] = byte( >> 7)
	[15] = byte(( >> 15) | ( << 6))
	[16] = byte( >> 2)
	[17] = byte( >> 10)
	[18] = byte(( >> 18) | ( << 3))
	[19] = byte( >> 5)
	[20] = byte( >> 13)
	[21] = byte( >> 0)
	[22] = byte( >> 8)
	[23] = byte(( >> 16) | ( << 5))
	[24] = byte( >> 3)
	[25] = byte( >> 11)
	[26] = byte(( >> 19) | ( << 2))
	[27] = byte( >> 6)
	[28] = byte(( >> 14) | ( << 7))
	[29] = byte( >> 1)
	[30] = byte( >> 9)
	[31] = byte( >> 17)
}

// nonAdjacentForm computes a width-w non-adjacent form for this scalar.
//
// w must be between 2 and 8, or nonAdjacentForm will panic.
func ( *Scalar) ( uint) [256]int8 {
	// This implementation is adapted from the one
	// in curve25519-dalek and is documented there:
	// https://github.com/dalek-cryptography/curve25519-dalek/blob/f630041af28e9a405255f98a8a93adca18e4315b/src/scalar.rs#L800-L871
	if .s[31] > 127 {
		panic("scalar has high bit set illegally")
	}
	if  < 2 {
		panic("w must be at least 2 by the definition of NAF")
	} else if  > 8 {
		panic("NAF digits must fit in int8")
	}

	var  [256]int8
	var  [5]uint64

	for  := 0;  < 4; ++ {
		[] = binary.LittleEndian.Uint64(.s[*8:])
	}

	 := uint64(1 << )
	 := uint64( - 1)

	 := uint(0)
	 := uint64(0)
	for  < 256 {
		 :=  / 64
		 :=  % 64
		var  uint64
		if  < 64- {
			// This window's bits are contained in a single u64
			 = [] >> 
		} else {
			// Combine the current 64 bits with bits from the next 64
			 = ([] >> ) | ([1+] << (64 - ))
		}

		// Add carry into the current window
		 :=  + ( & )

		if &1 == 0 {
			// If the window value is even, preserve the carry and continue.
			// Why is the carry preserved?
			// If carry == 0 and window & 1 == 0,
			//    then the next carry should be 0
			// If carry == 1 and window & 1 == 0,
			//    then bit_buf & 1 == 1 so the next carry should be 1
			 += 1
			continue
		}

		if  < /2 {
			 = 0
			[] = int8()
		} else {
			 = 1
			[] = int8() - int8()
		}

		 += 
	}
	return 
}

func ( *Scalar) () [64]int8 {
	if .s[31] > 127 {
		panic("scalar has high bit set illegally")
	}

	var  [64]int8

	// Compute unsigned radix-16 digits:
	for  := 0;  < 32; ++ {
		[2*] = int8(.s[] & 15)
		[2*+1] = int8((.s[] >> 4) & 15)
	}

	// Recenter coefficients:
	for  := 0;  < 63; ++ {
		 := ([] + 8) >> 4
		[] -=  << 4
		[+1] += 
	}

	return 
}