[32]byte byteorder.BEPutUint64(out[24:], s[0]) byteorder.BEPutUint64(out[16:], s[1]) byteorder.BEPutUint64(out[8:], s[2]) byteorder.BEPutUint64(out[:], s[3]) return out[:] } // Rsh returns the 64 least significant bits of x >> n. n must be lower // than 256. The value of n leaks through timing side-channels. func (s *p256OrdElement) Rsh(n int) uint64 { i := n / 64 n = n % 64 res := s[i] >> n // Shift in the more significant limb, if present. if i := i + 1; i < len(s) { res |= s[i] << (64 - n) } return res...