Nobuo Tsukamoto, Om Thakkar, Patrice Vignola, Philipp Hack, Pooya Jannaty, Prianka Liz Kariat, pshiko, Rajeshwar Reddy T, rdl4199, Rohit Santhanam, Rsanthanam-Amd, Sachin Muradi, Saoirse Stewart, Serge Panev, Shu Wang, Srinivasan Narayanamoorthy, Stella Stamenova, Stephan Hartmann, Sunita Nadampalli, synandi, Tamas Bela Feher, Tao Xu, Thibaut Goetghebuer-Planchon, Trevor Morris, Xiaoming (Jason) Cui, Yimei Sun, Yong Tang, Yuanqiang Liu, Yulv-Git, Zhoulong Jiang, ZihengJiang

# Release...

// case both if x >= m, or if x overflowed). // // The paper suggests in Section 4 that we can do an "Almost Montgomery // Multiplication" by subtracting only in the overflow case, but the // cost is very similar since the constant time subtraction tells us if // x >= m as a side effect, and taking care of the broken invariant is // highly undesirable (see https://go.dev/issue/13907). copy(x.reset(n).limbs, T[n:]) x.maybeSubtractModulus(choice(c), m) // The following specialized cases follow the exact...