33D8          ; disallowed                             # 1.1  SQUARE PM
33D9          ; mapped                 ; 0070 0070 006D #1.1  SQUARE PPM
33DA          ; mapped                 ; 0070 0072     # 1.1  SQUARE PR
33DB          ; mapped                 ; 0073 0072     # 1.1  SQUARE SR
33DC          ; mapped                 ; 0073 0076     # 1.1  SQUARE SV
33DD          ; mapped                 ; 0077 0062     # 1.1  SQUARE WB

Cryptography, Algorithm 14.61, adapted by BoringSSL to bound // coefficients and avoid negative numbers. For more details and proof of // correctness, see https://github.com/mit-plv/fiat-crypto/pull/333/files. // // Following the proof linked in the PR above, the changes are: // // 1. Negate [B] and [C] so they are positive. The invariant now involves a // subtraction. // 2. If step 2 (both [x] and [y] are even) runs, abort immediately. This // case needs to be handled by the caller. // 3. Subtract...