the remaining bits of the exponent with a // square-and-double chain. for i > 0 { rr.montgomeryMul(rr, rr, m) i-- if logR>>i&1 != 0 { rr.Add(rr, m) } } return rr } // minusInverseModW computes -x⁻¹ mod _W with x odd. // // This operation is used to precompute a constant involved in Montgomery // multiplication. func minusInverseModW(x uint) uint { // Every iteration of this loop doubles the least-significant bits of // correct inverse in y. The first three bits are already correct (1⁻¹ = 1, // 3⁻¹...