// But in gcd(a - b, b), a - b is even and b is odd, so we can divide out powers of two.

      // We bend over backwards to avoid branching, adapting a technique from
      // http://graphics.stanford.edu/~seander/bithacks.html#IntegerMinOrMax

      long delta = a - b; // can't overflow, since a and b are nonnegative

      long minDeltaOrZero = delta & (delta >> (Long.SIZE - 1));
      // equivalent to Math.min(delta, 0)

:= highBits88(fieldFromMontgomery(fieldAdd(rPlusZ, ct0))) return byte(constanttime.ByteEq(v1, r1) ^ 1) } // bitPack implements BitPack(r mod± q, γ₁-1, γ₁), which packs the centered // coefficients of r into little-endian γ1+1-bit chunks. It appends to buf. // // It must only be applied to r with coefficients in [−γ₁+1, γ₁], as // guaranteed by the rejection conditions in Sign. func bitPack(b []byte, r ringElement, p parameters) []byte { switch p.γ1 { case 17: return bitPack18(b, r) case 19: return...

the leftmost octet in // maskedDB are not all equal to zero, output "inconsistent" and // stop. var bitMask byte = 0xff >> (8*emLen - emBits) if em[0] & ^bitMask != 0 { return ErrVerification } // 7. Let dbMask = MGF(H, emLen - hLen - 1). // // 8. Let DB = maskedDB \xor dbMask. mgf1XOR(db, hash, h) // 9. Set the leftmost 8 * emLen - emBits bits of the leftmost octet in DB // to zero. db[0] &= bitMask // If we don't know the salt length, look for the 0x01 delimiter. if sLen == pssSaltLengthAutodet {...