of m. // // It is an error if either a or m is zero, or if they are both even. func extendedGCD(a, m *Nat) (u, A *Nat, err error) { // This is the extended binary GCD algorithm described in the Handbook of // Applied Cryptography, Algorithm 14.61, adapted by BoringSSL to bound // coefficients and avoid negative numbers. For more details and proof of // correctness, see https://github.com/mit-plv/fiat-crypto/pull/333/files. // // Following the proof linked in the PR above, the changes are: // // 1....