+ a1×b3 + a2×b2 + a3×b1 + a4×b0 // r4 < 5 × 2⁵² × 2⁵² // r4 < 2¹⁰⁷ // c0 := shiftRightBy51(r0) c1 := shiftRightBy51(r1) c2 := shiftRightBy51(r2) c3 := shiftRightBy51(r3) c4 := shiftRightBy51(r4) rr0 := r0.lo&maskLow51Bits + c4*19 rr1 := r1.lo&maskLow51Bits + c0 rr2 := r2.lo&maskLow51Bits + c1 rr3 := r3.lo&maskLow51Bits + c2 rr4 := r4.lo&maskLow51Bits + c3 // Now all coefficients fit into 64-bit registers but are still too large to // be passed around as an Element. We therefore do one last carry chain,...