r4 r3 r2 r1 r0 // // We can then use the reduction identity (a * 2²⁵⁵ + b = a * 19 + b) to // reduce the limbs that would overflow 255 bits. r5 * 2²⁵⁵ becomes 19 * r5, // r6 * 2³⁰⁶ becomes 19 * r6 * 2⁵¹, etc. // // Reduction can be carried out simultaneously to multiplication. For // example, we do not compute r5: whenever the result of a multiplication // belongs to r5, like a1b4, we multiply it by 19 and add the result to r0. // // a4b0 a3b0 a2b0 a1b0 a0b0 + // a3b1 a2b1 a1b1 a0b1 19×a4b1 + // a2b2...