} // Finally for Step 7 we copy the final T window into x, and subtract m // if necessary (which as explained in maybeSubtractModulus can be the // case both if x >= m, or if x overflowed). // // The paper suggests in Section 4 that we can do an "Almost Montgomery // Multiplication" by subtracting only in the overflow case, but the // cost is very similar since the constant time subtraction tells us if // x >= m as a side effect, and taking care of the broken invariant is // highly undesirable (see...

} // Finally for Step 7 we copy the final T window into x, and subtract m // if necessary (which as explained in maybeSubtractModulus can be the // case both if x >= m, or if x overflowed). // // The paper suggests in Section 4 that we can do an "Almost Montgomery // Multiplication" by subtracting only in the overflow case, but the // cost is very similar since the constant time subtraction tells us if // x >= m as a side effect, and taking care of the broken invariant is // highly undesirable (see...