underflow := x.sub(y) // If the subtraction underflowed, add m. t := NewNat().set(x) t.add(m.nat) x.assign(choice(underflow), t) return x } // SubOne computes x = x - 1 mod m. // // The length of x must be the same as the modulus. func (x *Nat) SubOne(m *Modulus) *Nat { one := NewNat().ExpandFor(m) one.limbs[0] = 1 // Sub asks for x to be reduced modulo m, while SubOne doesn't, but when // y = 1, it works, and this is an internal use. return x.Sub(one, m) } // Add computes x = x + y mod m. // // The length...