the carry bit from that addition is // brought forward to the next iteration. c2 := addMulVVW(T[i:n+i], mLimbs, Y) T[n+i], c = bits.Add(c1, c2, c) } // Finally for Step 7 we copy the final T window into x, and subtract m // if necessary (which as explained in maybeSubtractModulus can be the // case both if x >= m, or if x overflowed). // // The paper suggests in Section 4 that we can do an "Almost Montgomery // Multiplication" by subtracting only in the overflow case, but the // cost is very similar...

the carry bit from that addition is // brought forward to the next iteration. c2 := addMulVVW(T[i:n+i], mLimbs, Y) T[n+i], c = bits.Add(c1, c2, c) } // Finally for Step 7 we copy the final T window into x, and subtract m // if necessary (which as explained in maybeSubtractModulus can be the // case both if x >= m, or if x overflowed). // // The paper suggests in Section 4 that we can do an "Almost Montgomery // Multiplication" by subtracting only in the overflow case, but the // cost is very similar...