save a // fieldReduceOnce after the subtraction. func fieldMontgomeryMulSu(a, b, c fieldElement) fieldElement { x := uint64(a) * uint64(b-c+q) return fieldMontgomeryReduc(x) } // fieldMontgomeryAddMu returns a * b + c * d. This operation is fused to save // a fieldReduceOnce and a fieldReduce. func fieldMontgomeryAddMu(a, b, c, d fieldElement) fieldElement { x := uint64(a) * uint64(b) x += uint64(c) * uint64(d) return fieldMontgomeryReduc(x) } const n = 256 // ringElement is a polynomial, an element...