cs2) v1 := highBits32(fieldFromMontgomery(rPlusZ)) // r1 = HighBits(r) = HighBits(w - cs2 + ct0) r1 := highBits32(fieldFromMontgomery(fieldAdd(rPlusZ, ct0))) return byte(constanttime.ByteEq(v1, r1) ^ 1) } // highBits88 implements HighBits from FIPS 204 for γ2 = (q - 1) / 88. func highBits88(x uint32) byte { // Like highBits32, this is exhaustively tested in TestDecompose. r1 := (x + 127) >> 7 r1 = (r1*11275 + (1 << 23)) >> 24 r1 = constantTimeSelectEq(r1, 44, 0, r1) return byte(r1) } // decompose88...