zero if subtraction underflowed s[0] ^= (t0 ^ s[0]) & tMask s[1] ^= (t1 ^ s[1]) & tMask s[2] ^= (t2 ^ s[2]) & tMask s[3] ^= (t3 ^ s[3]) & tMask } func p256OrdLittleToBig(b *[32]byte, l *p256OrdElement) { limbsToBytes(b, (*[4]uint64)(l)) } func p256OrdBigToLittle(l *p256OrdElement, b *[32]byte) { bytesToLimbs((*[4]uint64)(l), b) } // Add sets q = p1 + p2, and returns q. The points may overlap. func (q *P256Point) Add(r1, r2 *P256Point) *P256Point { var sum, double P256Point r1IsInfinity := r1.isInfinity()...