uint32(constantTimeSelectLe(x, q/2, x, q-x)) } // fieldReduceOnce reduces a value a < 2q. func fieldReduceOnce(a uint32) fieldElement { x, b := bits.Sub64(uint64(a), uint64(q), 0) return fieldElement(x + b*q) } // fieldAdd returns a + b mod q. func fieldAdd(a, b fieldElement) fieldElement { x := uint32(a + b) return fieldReduceOnce(x) } // fieldSub returns a - b mod q. func fieldSub(a, b fieldElement) fieldElement { x := uint32(a - b + q) return fieldReduceOnce(x) } // fieldMontgomeryMul returns a * b * R⁻¹ mod q....

 "crypto/internal/fips140deps/byteorder" "errors" ) // fieldElement is an integer modulo q, an element of ℤ_q. It is always reduced. type fieldElement uint16 // fieldCheckReduced checks that a value a is < q. func fieldCheckReduced(a uint16) (fieldElement, error) { if a >= q { return 0, errors.New("unreduced field element") } return fieldElement(a), nil } // fieldReduceOnce reduces a value a < 2q. func fieldReduceOnce(a uint16) fieldElement { x := a - q // If x underflowed, then x >= 2¹⁶ - q > 2¹⁵,...