0xffffffffffffffff, b) t3, b := bits.Sub64(s[3], 0xffffffff00000000, b) tMask := b - 1 // zero if subtraction underflowed s[0] ^= (t0 ^ s[0]) & tMask s[1] ^= (t1 ^ s[1]) & tMask s[2] ^= (t2 ^ s[2]) & tMask s[3] ^= (t3 ^ s[3]) & tMask } func p256OrdLittleToBig(b *[32]byte, l *p256OrdElement) { limbsToBytes(b, (*[4]uint64)(l)) } func p256OrdBigToLittle(l *p256OrdElement, b *[32]byte) { bytesToLimbs((*[4]uint64)(l), b) } // Add sets q = p1 + p2, and returns q. The points may overlap. func (q *P256Point)...