// But in gcd(a - b, b), a - b is even and b is odd, so we can divide out powers of two.

      // We bend over backwards to avoid branching, adapting a technique from
      // http://graphics.stanford.edu/~seander/bithacks.html#IntegerMinOrMax

      long delta = a - b; // can't overflow, since a and b are nonnegative

      long minDeltaOrZero = delta & (delta >> (Long.SIZE - 1));
      // equivalent to Math.min(delta, 0)

:= highBits88(fieldFromMontgomery(fieldAdd(rPlusZ, ct0))) return byte(constanttime.ByteEq(v1, r1) ^ 1) } // bitPack implements BitPack(r mod± q, γ₁-1, γ₁), which packs the centered // coefficients of r into little-endian γ1+1-bit chunks. It appends to buf. // // It must only be applied to r with coefficients in [−γ₁+1, γ₁], as // guaranteed by the rejection conditions in Sign. func bitPack(b []byte, r ringElement, p parameters) []byte { switch p.γ1 { case 17: return bitPack18(b, r) case 19: return...