if len(gobFacts) > 0 {
		if err := gob.NewEncoder(&buf).Encode(gobFacts); err != nil {
			// Fact encoding should never fail. Identify the culprit.
			for _, gf := range gobFacts {
				if err := gob.NewEncoder(io.Discard).Encode(gf); err != nil {
					fact := gf.Fact
					pkgpath := reflect.TypeOf(fact).Elem().PkgPath()

	i = ((i << 1) & 0xa) | ((i >> 1) & 0x5)
	return i
}

// gcmAdd adds two elements of GF(2¹²⁸) and returns the sum.
func gcmAdd(x, y *gcmFieldElement) gcmFieldElement {
	// Addition in a characteristic 2 field is just XOR.
	return gcmFieldElement{x.low ^ y.low, x.high ^ y.high}
}

// gcmDouble returns the result of doubling an element of GF(2¹²⁸).
func gcmDouble(x *gcmFieldElement) (double gcmFieldElement) {
	msbSet := x.high&1 == 1

			logDiff(t, fmt.Sprintf("%s[%d]", prefix, i), got.Index(i), want.Index(i))
		}
	case reflect.Struct:
		for i := 0; i < typ.NumField(); i++ {
			gf, wf := got.Field(i), want.Field(i)
			logDiff(t, prefix+"."+typ.Field(i).Name, gf, wf)
		}
	case reflect.Map:
		t.Fatal("not implemented: logDiff for map")
	default:
		if got.Interface() != want.Interface() {

// Package field implements fast arithmetic modulo 2^255-19.
package field

import (
	"crypto/subtle"
	"errors"
	"internal/byteorder"
	"math/bits"
)

// Element represents an element of the field GF(2^255-19). Note that this
// is not a cryptographically secure group, and should only be used to interact
// with edwards25519.Point coordinates.
//
// This type works similarly to math/big.Int, and all arguments and receivers

00000370  d4 95 fd 8d 63 a4 78 6c  2f 7d 6a a5 53 e4 42 97  |....c.xl/}j.S.B.|
00000380  e8 19 36 bf 14 9c a8 48  9f 57 ad 29 7a 30 e5 a9  |..6....H.W.)z0..|
00000390  32 e7 0f 24 9c ca 9d 6d  b7 47 46 1c cb 90 7d 18  |2..$...m.GF...}.|
000003a0  39 70 d2 c1 08 28 dc d7  3a 3e 5e 62 a7 4a 4a af  |9p...(..:>^b.JJ.|
000003b0  02 93 ce 4b 5d a2 96 f3  17 03 03 00 35 10 07 d6  |...K].......5...|

			_, err := kInv.SetBytes(kBytes, c.N)
			if err != nil {
				panic("ecdsa: internal error: P256OrdInverse produced an invalid value")
			}
			return
		}
	}

	// Calculate the inverse of s in GF(N) using Fermat's method
	// (exponentiation modulo P - 2, per Euler's theorem)
	kInv.Exp(k, c.nMinus2, c.N)
}

// hashToNat sets e to the left-most bits of hash, according to

00000200  0e cb d4 0f 98 c8 5c 69  d0 61 6e b5 ef 2a dd 5f  |......\i.an..*._|
00000210  63 92 b4 3e 6e f4 b8 fc  45 bf 58 79 08 a4 95 6f  |c..>n...E.Xy...o|
00000220  34 01 9b 8a 19 a5 e4 11  3f d4 97 47 66 e8 42 ef  |4.......?..Gf.B.|
00000230  92 72 01 f4 6f 07 a4 35  81 83 ee 26 d0 96 cc de  |.r..o..5...&....|
00000240  42 2a 65 64 cc a9 0c 39  31 d5 7c 2f 42 e5 ce 36  |B*ed...91.|/B..6|