text: /* This file was generated by KreMLin <https://github.com/FStarLang/kremlin>
   * KreMLin invocation: /home/jonathan/Code/everest/kremlin/krml -I /home/jonathan/Code/everest/hacl-star/code/lib/kremlin -I /home/jonathan/Code/everest/kremlin/kremlib/compat -I /home/jonathan/Code/everest/hacl-star/specs -I /home/jonathan/Code/everest/hacl-star/specs/old -I . -ccopt -march=native -verbose -ldopt -flto -tmpdir x25519-c -I ../bignum -bundle Hacl.Curve25519=* -minimal -add-include "kremlib.h" -skip-compilation x25519-c/out.krml -o x25519-c/Hacl_Curve25519.c
   * F* version: 8f0ddba4
   * KreMLin version: 9768dccd
   */
  
  #include "Hacl_Curve25519.h"
  
  extern FStar_UInt128_uint128
  FStar_UInt128_add(FStar_UInt128_uint128 x0, FStar_UInt128_uint128 x1);
  
  extern FStar_UInt128_uint128
  FStar_UInt128_add_mod(FStar_UInt128_uint128 x0, FStar_UInt128_uint128 x1);
  
  extern FStar_UInt128_uint128
  FStar_UInt128_logand(FStar_UInt128_uint128 x0, FStar_UInt128_uint128 x1);
  
  extern FStar_UInt128_uint128 FStar_UInt128_shift_right(FStar_UInt128_uint128 x0, uint32_t x1);
  
  extern FStar_UInt128_uint128 FStar_UInt128_uint64_to_uint128(uint64_t x0);
  
  extern uint64_t FStar_UInt128_uint128_to_uint64(FStar_UInt128_uint128 x0);
  
  extern FStar_UInt128_uint128 FStar_UInt128_mul_wide(uint64_t x0, uint64_t x1);
  
  extern uint64_t FStar_UInt64_eq_mask(uint64_t x0, uint64_t x1);
  
  extern uint64_t FStar_UInt64_gte_mask(uint64_t x0, uint64_t x1);
  
  inline static void
  Hacl_Bignum_Fproduct_copy_from_wide_(uint64_t *output, FStar_UInt128_uint128 *input)
  {
    for (uint32_t i = (uint32_t)0U; i < (uint32_t)5U; i = i + (uint32_t)1U)
    {
      FStar_UInt128_uint128 xi = input[i];
      output[i] = FStar_UInt128_uint128_to_uint64(xi);
    }
  }
  
  inline static void
  Hacl_Bignum_Fproduct_sum_scalar_multiplication_(
    FStar_UInt128_uint128 *output,
    uint64_t *input,
    uint64_t s
  )
  {
    for (uint32_t i = (uint32_t)0U; i < (uint32_t)5U; i = i + (uint32_t)1U)
    {
      FStar_UInt128_uint128 xi = output[i];
      uint64_t yi = input[i];
      output[i] = FStar_UInt128_add_mod(xi, FStar_UInt128_mul_wide(yi, s));
    }
  }
  
  inline static void Hacl_Bignum_Fproduct_carry_wide_(FStar_UInt128_uint128 *tmp)
  {
    for (uint32_t i = (uint32_t)0U; i < (uint32_t)4U; i = i + (uint32_t)1U)
    {
      uint32_t ctr = i;
      FStar_UInt128_uint128 tctr = tmp[ctr];
      FStar_UInt128_uint128 tctrp1 = tmp[ctr + (uint32_t)1U];
      uint64_t r0 = FStar_UInt128_uint128_to_uint64(tctr) & (uint64_t)0x7ffffffffffffU;
      FStar_UInt128_uint128 c = FStar_UInt128_shift_right(tctr, (uint32_t)51U);
      tmp[ctr] = FStar_UInt128_uint64_to_uint128(r0);
      tmp[ctr + (uint32_t)1U] = FStar_UInt128_add(tctrp1, c);
    }
  }
  
  static void
  Hacl_EC_Point_swap_conditional_step(uint64_t *a, uint64_t *b, uint64_t swap1, uint32_t ctr)
  {
    uint32_t i = ctr - (uint32_t)1U;
    uint64_t ai = a[i];
    uint64_t bi = b[i];
    uint64_t x = swap1 & (ai ^ bi);
    uint64_t ai1 = ai ^ x;
    uint64_t bi1 = bi ^ x;
    a[i] = ai1;
    b[i] = bi1;
  }
  
  static void
  Hacl_EC_Point_swap_conditional_(uint64_t *a, uint64_t *b, uint64_t swap1, uint32_t ctr)
  {
    if (!(ctr == (uint32_t)0U))
    {
      Hacl_EC_Point_swap_conditional_step(a, b, swap1, ctr);
      uint32_t i = ctr - (uint32_t)1U;
      Hacl_EC_Point_swap_conditional_(a, b, swap1, i);
    }
  }
  
  static void Hacl_EC_Point_swap_conditional(uint64_t *a, uint64_t *b, uint64_t iswap)
  {
    uint64_t swap1 = (uint64_t)0U - iswap;
    Hacl_EC_Point_swap_conditional_(a, b, swap1, (uint32_t)5U);
    Hacl_EC_Point_swap_conditional_(a + (uint32_t)5U, b + (uint32_t)5U, swap1, (uint32_t)5U);
  }
  
  static void Hacl_EC_Point_copy(uint64_t *output, uint64_t *input)
  {
    memcpy(output, input, (uint32_t)5U * sizeof input[0U]);
    memcpy(output + (uint32_t)5U,
      input + (uint32_t)5U,
      (uint32_t)5U * sizeof (input + (uint32_t)5U)[0U]);
  }
  
  static void Hacl_Bignum_Modulo_carry_top(uint64_t *b)
  {
    uint64_t b4 = b[4U];
    uint64_t b0 = b[0U];
    uint64_t b4_ = b4 & (uint64_t)0x7ffffffffffffU;
    uint64_t b0_ = b0 + (uint64_t)19U * (b4 >> (uint32_t)51U);
    b[4U] = b4_;
    b[0U] = b0_;
  }
  
  inline static void Hacl_Bignum_Fmul_shift_reduce(uint64_t *output)
  {
    uint64_t tmp = output[4U];
    for (uint32_t i = (uint32_t)0U; i < (uint32_t)4U; i = i + (uint32_t)1U)
    {
      uint32_t ctr = (uint32_t)5U - i - (uint32_t)1U;
      uint64_t z = output[ctr - (uint32_t)1U];
      output[ctr] = z;
    }
    output[0U] = tmp;
    uint64_t b0 = output[0U];
    output[0U] = (uint64_t)19U * b0;
  }
  
  static void
  Hacl_Bignum_Fmul_mul_shift_reduce_(
    FStar_UInt128_uint128 *output,
    uint64_t *input,
    uint64_t *input2
  )
  {
    for (uint32_t i = (uint32_t)0U; i < (uint32_t)4U; i = i + (uint32_t)1U)
    {
      uint64_t input2i = input2[i];
      Hacl_Bignum_Fproduct_sum_scalar_multiplication_(output, input, input2i);
      Hacl_Bignum_Fmul_shift_reduce(input);
    }
    uint32_t i = (uint32_t)4U;
    uint64_t input2i = input2[i];
    Hacl_Bignum_Fproduct_sum_scalar_multiplication_(output, input, input2i);
  }
  
  inline static void Hacl_Bignum_Fmul_fmul(uint64_t *output, uint64_t *input, uint64_t *input2)
  {
    uint64_t tmp[5U] = { 0U };
    memcpy(tmp, input, (uint32_t)5U * sizeof input[0U]);
    KRML_CHECK_SIZE(sizeof (FStar_UInt128_uint128), (uint32_t)5U);
    FStar_UInt128_uint128 t[5U];
    for (uint32_t _i = 0U; _i < (uint32_t)5U; ++_i)
      t[_i] = FStar_UInt128_uint64_to_uint128((uint64_t)0U);
    Hacl_Bignum_Fmul_mul_shift_reduce_(t, tmp, input2);
    Hacl_Bignum_Fproduct_carry_wide_(t);
    FStar_UInt128_uint128 b4 = t[4U];
    FStar_UInt128_uint128 b0 = t[0U];
    FStar_UInt128_uint128
    b4_ = FStar_UInt128_logand(b4, FStar_UInt128_uint64_to_uint128((uint64_t)0x7ffffffffffffU));
    FStar_UInt128_uint128
    b0_ =
      FStar_UInt128_add(b0,
        FStar_UInt128_mul_wide((uint64_t)19U,
          FStar_UInt128_uint128_to_uint64(FStar_UInt128_shift_right(b4, (uint32_t)51U))));
    t[4U] = b4_;
    t[0U] = b0_;
    Hacl_Bignum_Fproduct_copy_from_wide_(output, t);
    uint64_t i0 = output[0U];
    uint64_t i1 = output[1U];
    uint64_t i0_ = i0 & (uint64_t)0x7ffffffffffffU;
    uint64_t i1_ = i1 + (i0 >> (uint32_t)51U);
    output[0U] = i0_;
    output[1U] = i1_;
  }
  
  inline static void Hacl_Bignum_Fsquare_fsquare__(FStar_UInt128_uint128 *tmp, uint64_t *output)
  {
    uint64_t r0 = output[0U];
    uint64_t r1 = output[1U];
    uint64_t r2 = output[2U];
    uint64_t r3 = output[3U];
    uint64_t r4 = output[4U];
    uint64_t d0 = r0 * (uint64_t)2U;
    uint64_t d1 = r1 * (uint64_t)2U;
    uint64_t d2 = r2 * (uint64_t)2U * (uint64_t)19U;
    uint64_t d419 = r4 * (uint64_t)19U;
    uint64_t d4 = d419 * (uint64_t)2U;
    FStar_UInt128_uint128
    s0 =
      FStar_UInt128_add(FStar_UInt128_add(FStar_UInt128_mul_wide(r0, r0),
          FStar_UInt128_mul_wide(d4, r1)),
        FStar_UInt128_mul_wide(d2, r3));
    FStar_UInt128_uint128
    s1 =
      FStar_UInt128_add(FStar_UInt128_add(FStar_UInt128_mul_wide(d0, r1),
          FStar_UInt128_mul_wide(d4, r2)),
        FStar_UInt128_mul_wide(r3 * (uint64_t)19U, r3));
    FStar_UInt128_uint128
    s2 =
      FStar_UInt128_add(FStar_UInt128_add(FStar_UInt128_mul_wide(d0, r2),
          FStar_UInt128_mul_wide(r1, r1)),
        FStar_UInt128_mul_wide(d4, r3));
    FStar_UInt128_uint128
    s3 =
      FStar_UInt128_add(FStar_UInt128_add(FStar_UInt128_mul_wide(d0, r3),
          FStar_UInt128_mul_wide(d1, r2)),
        FStar_UInt128_mul_wide(r4, d419));
    FStar_UInt128_uint128
    s4 =
      FStar_UInt128_add(FStar_UInt128_add(FStar_UInt128_mul_wide(d0, r4),
          FStar_UInt128_mul_wide(d1, r3)),
        FStar_UInt128_mul_wide(r2, r2));
    tmp[0U] = s0;
    tmp[1U] = s1;
    tmp[2U] = s2;
    tmp[3U] = s3;
    tmp[4U] = s4;
  }
  
  inline static void Hacl_Bignum_Fsquare_fsquare_(FStar_UInt128_uint128 *tmp, uint64_t *output)
  {
    Hacl_Bignum_Fsquare_fsquare__(tmp, output);
    Hacl_Bignum_Fproduct_carry_wide_(tmp);
    FStar_UInt128_uint128 b4 = tmp[4U];
    FStar_UInt128_uint128 b0 = tmp[0U];
    FStar_UInt128_uint128
    b4_ = FStar_UInt128_logand(b4, FStar_UInt128_uint64_to_uint128((uint64_t)0x7ffffffffffffU));
    FStar_UInt128_uint128
    b0_ =
      FStar_UInt128_add(b0,
        FStar_UInt128_mul_wide((uint64_t)19U,
          FStar_UInt128_uint128_to_uint64(FStar_UInt128_shift_right(b4, (uint32_t)51U))));
    tmp[4U] = b4_;
    tmp[0U] = b0_;
    Hacl_Bignum_Fproduct_copy_from_wide_(output, tmp);
    uint64_t i0 = output[0U];
    uint64_t i1 = output[1U];
    uint64_t i0_ = i0 & (uint64_t)0x7ffffffffffffU;
    uint64_t i1_ = i1 + (i0 >> (uint32_t)51U);
    output[0U] = i0_;
    output[1U] = i1_;
  }
  
  static void
  Hacl_Bignum_Fsquare_fsquare_times_(
    uint64_t *input,
    FStar_UInt128_uint128 *tmp,
    uint32_t count1
  )
  {
    Hacl_Bignum_Fsquare_fsquare_(tmp, input);
    for (uint32_t i = (uint32_t)1U; i < count1; i = i + (uint32_t)1U)
      Hacl_Bignum_Fsquare_fsquare_(tmp, input);
  }
  
  inline static void
  Hacl_Bignum_Fsquare_fsquare_times(uint64_t *output, uint64_t *input, uint32_t count1)
  {
    KRML_CHECK_SIZE(sizeof (FStar_UInt128_uint128), (uint32_t)5U);
    FStar_UInt128_uint128 t[5U];
    for (uint32_t _i = 0U; _i < (uint32_t)5U; ++_i)
      t[_i] = FStar_UInt128_uint64_to_uint128((uint64_t)0U);
    memcpy(output, input, (uint32_t)5U * sizeof input[0U]);
    Hacl_Bignum_Fsquare_fsquare_times_(output, t, count1);
  }
  
  inline static void Hacl_Bignum_Fsquare_fsquare_times_inplace(uint64_t *output, uint32_t count1)
  {
    KRML_CHECK_SIZE(sizeof (FStar_UInt128_uint128), (uint32_t)5U);
    FStar_UInt128_uint128 t[5U];
    for (uint32_t _i = 0U; _i < (uint32_t)5U; ++_i)
      t[_i] = FStar_UInt128_uint64_to_uint128((uint64_t)0U);
    Hacl_Bignum_Fsquare_fsquare_times_(output, t, count1);
  }
  
  inline static void Hacl_Bignum_Crecip_crecip(uint64_t *out, uint64_t *z)
  {
    uint64_t buf[20U] = { 0U };
    uint64_t *a = buf;
    uint64_t *t00 = buf + (uint32_t)5U;
    uint64_t *b0 = buf + (uint32_t)10U;
    Hacl_Bignum_Fsquare_fsquare_times(a, z, (uint32_t)1U);
    Hacl_Bignum_Fsquare_fsquare_times(t00, a, (uint32_t)2U);
    Hacl_Bignum_Fmul_fmul(b0, t00, z);
    Hacl_Bignum_Fmul_fmul(a, b0, a);
    Hacl_Bignum_Fsquare_fsquare_times(t00, a, (uint32_t)1U);
    Hacl_Bignum_Fmul_fmul(b0, t00, b0);
    Hacl_Bignum_Fsquare_fsquare_times(t00, b0, (uint32_t)5U);
    uint64_t *t01 = buf + (uint32_t)5U;
    uint64_t *b1 = buf + (uint32_t)10U;
    uint64_t *c0 = buf + (uint32_t)15U;
    Hacl_Bignum_Fmul_fmul(b1, t01, b1);
    Hacl_Bignum_Fsquare_fsquare_times(t01, b1, (uint32_t)10U);
    Hacl_Bignum_Fmul_fmul(c0, t01, b1);
    Hacl_Bignum_Fsquare_fsquare_times(t01, c0, (uint32_t)20U);
    Hacl_Bignum_Fmul_fmul(t01, t01, c0);
    Hacl_Bignum_Fsquare_fsquare_times_inplace(t01, (uint32_t)10U);
    Hacl_Bignum_Fmul_fmul(b1, t01, b1);
    Hacl_Bignum_Fsquare_fsquare_times(t01, b1, (uint32_t)50U);
    uint64_t *a0 = buf;
    uint64_t *t0 = buf + (uint32_t)5U;
    uint64_t *b = buf + (uint32_t)10U;
    uint64_t *c = buf + (uint32_t)15U;
    Hacl_Bignum_Fmul_fmul(c, t0, b);
    Hacl_Bignum_Fsquare_fsquare_times(t0, c, (uint32_t)100U);
    Hacl_Bignum_Fmul_fmul(t0, t0, c);
    Hacl_Bignum_Fsquare_fsquare_times_inplace(t0, (uint32_t)50U);
    Hacl_Bignum_Fmul_fmul(t0, t0, b);
    Hacl_Bignum_Fsquare_fsquare_times_inplace(t0, (uint32_t)5U);
    Hacl_Bignum_Fmul_fmul(out, t0, a0);
  }
  
  inline static void Hacl_Bignum_fsum(uint64_t *a, uint64_t *b)
  {
    for (uint32_t i = (uint32_t)0U; i < (uint32_t)5U; i = i + (uint32_t)1U)
    {
      uint64_t xi = a[i];
      uint64_t yi = b[i];
      a[i] = xi + yi;
    }
  }
  
  inline static void Hacl_Bignum_fdifference(uint64_t *a, uint64_t *b)
  {
    uint64_t tmp[5U] = { 0U };
    memcpy(tmp, b, (uint32_t)5U * sizeof b[0U]);
    uint64_t b0 = tmp[0U];
    uint64_t b1 = tmp[1U];
    uint64_t b2 = tmp[2U];
    uint64_t b3 = tmp[3U];
    uint64_t b4 = tmp[4U];
    tmp[0U] = b0 + (uint64_t)0x3fffffffffff68U;
    tmp[1U] = b1 + (uint64_t)0x3ffffffffffff8U;
    tmp[2U] = b2 + (uint64_t)0x3ffffffffffff8U;
    tmp[3U] = b3 + (uint64_t)0x3ffffffffffff8U;
    tmp[4U] = b4 + (uint64_t)0x3ffffffffffff8U;
    for (uint32_t i = (uint32_t)0U; i < (uint32_t)5U; i = i + (uint32_t)1U)
    {
      uint64_t xi = a[i];
      uint64_t yi = tmp[i];
      a[i] = yi - xi;
    }
  }
  
  inline static void Hacl_Bignum_fscalar(uint64_t *output, uint64_t *b, uint64_t s)
  {
    KRML_CHECK_SIZE(sizeof (FStar_UInt128_uint128), (uint32_t)5U);
    FStar_UInt128_uint128 tmp[5U];
    for (uint32_t _i = 0U; _i < (uint32_t)5U; ++_i)
      tmp[_i] = FStar_UInt128_uint64_to_uint128((uint64_t)0U);
    for (uint32_t i = (uint32_t)0U; i < (uint32_t)5U; i = i + (uint32_t)1U)
    {
      uint64_t xi = b[i];
      tmp[i] = FStar_UInt128_mul_wide(xi, s);
    }
    Hacl_Bignum_Fproduct_carry_wide_(tmp);
    FStar_UInt128_uint128 b4 = tmp[4U];
    FStar_UInt128_uint128 b0 = tmp[0U];
    FStar_UInt128_uint128
    b4_ = FStar_UInt128_logand(b4, FStar_UInt128_uint64_to_uint128((uint64_t)0x7ffffffffffffU));
    FStar_UInt128_uint128
    b0_ =
      FStar_UInt128_add(b0,
        FStar_UInt128_mul_wide((uint64_t)19U,
          FStar_UInt128_uint128_to_uint64(FStar_UInt128_shift_right(b4, (uint32_t)51U))));
    tmp[4U] = b4_;
    tmp[0U] = b0_;
    Hacl_Bignum_Fproduct_copy_from_wide_(output, tmp);
  }
  
  inline static void Hacl_Bignum_fmul(uint64_t *output, uint64_t *a, uint64_t *b)
  {
    Hacl_Bignum_Fmul_fmul(output, a, b);
  }
  
  inline static void Hacl_Bignum_crecip(uint64_t *output, uint64_t *input)
  {
    Hacl_Bignum_Crecip_crecip(output, input);
  }
  
  static void Hacl_EC_Format_fexpand(uint64_t *output, uint8_t *input)
  {
    uint64_t i0 = load64_le(input);
    uint8_t *x00 = input + (uint32_t)6U;
    uint64_t i1 = load64_le(x00);
    uint8_t *x01 = input + (uint32_t)12U;
    uint64_t i2 = load64_le(x01);
    uint8_t *x02 = input + (uint32_t)19U;
    uint64_t i3 = load64_le(x02);
    uint8_t *x0 = input + (uint32_t)24U;
    uint64_t i4 = load64_le(x0);
    uint64_t output0 = i0 & (uint64_t)0x7ffffffffffffU;
    uint64_t output1 = i1 >> (uint32_t)3U & (uint64_t)0x7ffffffffffffU;
    uint64_t output2 = i2 >> (uint32_t)6U & (uint64_t)0x7ffffffffffffU;
    uint64_t output3 = i3 >> (uint32_t)1U & (uint64_t)0x7ffffffffffffU;
    uint64_t output4 = i4 >> (uint32_t)12U & (uint64_t)0x7ffffffffffffU;
    output[0U] = output0;
    output[1U] = output1;
    output[2U] = output2;
    output[3U] = output3;
    output[4U] = output4;
  }
  
  static void Hacl_EC_Format_fcontract_first_carry_pass(uint64_t *input)
  {
    uint64_t t0 = input[0U];
    uint64_t t1 = input[1U];
    uint64_t t2 = input[2U];
    uint64_t t3 = input[3U];
    uint64_t t4 = input[4U];
    uint64_t t1_ = t1 + (t0 >> (uint32_t)51U);
    uint64_t t0_ = t0 & (uint64_t)0x7ffffffffffffU;
    uint64_t t2_ = t2 + (t1_ >> (uint32_t)51U);
    uint64_t t1__ = t1_ & (uint64_t)0x7ffffffffffffU;
    uint64_t t3_ = t3 + (t2_ >> (uint32_t)51U);
    uint64_t t2__ = t2_ & (uint64_t)0x7ffffffffffffU;
    uint64_t t4_ = t4 + (t3_ >> (uint32_t)51U);
    uint64_t t3__ = t3_ & (uint64_t)0x7ffffffffffffU;
    input[0U] = t0_;
    input[1U] = t1__;
    input[2U] = t2__;
    input[3U] = t3__;
    input[4U] = t4_;
  }
  
  static void Hacl_EC_Format_fcontract_first_carry_full(uint64_t *input)
  {
    Hacl_EC_Format_fcontract_first_carry_pass(input);
    Hacl_Bignum_Modulo_carry_top(input);
  }
  
  static void Hacl_EC_Format_fcontract_second_carry_pass(uint64_t *input)
  {
    uint64_t t0 = input[0U];
    uint64_t t1 = input[1U];
    uint64_t t2 = input[2U];
    uint64_t t3 = input[3U];
    uint64_t t4 = input[4U];
    uint64_t t1_ = t1 + (t0 >> (uint32_t)51U);
    uint64_t t0_ = t0 & (uint64_t)0x7ffffffffffffU;
    uint64_t t2_ = t2 + (t1_ >> (uint32_t)51U);
    uint64_t t1__ = t1_ & (uint64_t)0x7ffffffffffffU;
    uint64_t t3_ = t3 + (t2_ >> (uint32_t)51U);
    uint64_t t2__ = t2_ & (uint64_t)0x7ffffffffffffU;
    uint64_t t4_ = t4 + (t3_ >> (uint32_t)51U);
    uint64_t t3__ = t3_ & (uint64_t)0x7ffffffffffffU;
    input[0U] = t0_;
    input[1U] = t1__;
    input[2U] = t2__;
    input[3U] = t3__;
    input[4U] = t4_;
  }
  
  static void Hacl_EC_Format_fcontract_second_carry_full(uint64_t *input)
  {
    Hacl_EC_Format_fcontract_second_carry_pass(input);
    Hacl_Bignum_Modulo_carry_top(input);
    uint64_t i0 = input[0U];
    uint64_t i1 = input[1U];
    uint64_t i0_ = i0 & (uint64_t)0x7ffffffffffffU;
    uint64_t i1_ = i1 + (i0 >> (uint32_t)51U);
    input[0U] = i0_;
    input[1U] = i1_;
  }
  
  static void Hacl_EC_Format_fcontract_trim(uint64_t *input)
  {
    uint64_t a0 = input[0U];
    uint64_t a1 = input[1U];
    uint64_t a2 = input[2U];
    uint64_t a3 = input[3U];
    uint64_t a4 = input[4U];
    uint64_t mask0 = FStar_UInt64_gte_mask(a0, (uint64_t)0x7ffffffffffedU);
    uint64_t mask1 = FStar_UInt64_eq_mask(a1, (uint64_t)0x7ffffffffffffU);
    uint64_t mask2 = FStar_UInt64_eq_mask(a2, (uint64_t)0x7ffffffffffffU);
    uint64_t mask3 = FStar_UInt64_eq_mask(a3, (uint64_t)0x7ffffffffffffU);
    uint64_t mask4 = FStar_UInt64_eq_mask(a4, (uint64_t)0x7ffffffffffffU);
    uint64_t mask = mask0 & mask1 & mask2 & mask3 & mask4;
    uint64_t a0_ = a0 - ((uint64_t)0x7ffffffffffedU & mask);
    uint64_t a1_ = a1 - ((uint64_t)0x7ffffffffffffU & mask);
    uint64_t a2_ = a2 - ((uint64_t)0x7ffffffffffffU & mask);
    uint64_t a3_ = a3 - ((uint64_t)0x7ffffffffffffU & mask);
    uint64_t a4_ = a4 - ((uint64_t)0x7ffffffffffffU & mask);
    input[0U] = a0_;
    input[1U] = a1_;
    input[2U] = a2_;
    input[3U] = a3_;
    input[4U] = a4_;
  }
  
  static void Hacl_EC_Format_fcontract_store(uint8_t *output, uint64_t *input)
  {
    uint64_t t0 = input[0U];
    uint64_t t1 = input[1U];
    uint64_t t2 = input[2U];
    uint64_t t3 = input[3U];
    uint64_t t4 = input[4U];
    uint64_t o0 = t1 << (uint32_t)51U | t0;
    uint64_t o1 = t2 << (uint32_t)38U | t1 >> (uint32_t)13U;
    uint64_t o2 = t3 << (uint32_t)25U | t2 >> (uint32_t)26U;
    uint64_t o3 = t4 << (uint32_t)12U | t3 >> (uint32_t)39U;
    uint8_t *b0 = output;
    uint8_t *b1 = output + (uint32_t)8U;
    uint8_t *b2 = output + (uint32_t)16U;
    uint8_t *b3 = output + (uint32_t)24U;
    store64_le(b0, o0);
    store64_le(b1, o1);
    store64_le(b2, o2);
    store64_le(b3, o3);
  }
  
  static void Hacl_EC_Format_fcontract(uint8_t *output, uint64_t *input)
  {
    Hacl_EC_Format_fcontract_first_carry_full(input);
    Hacl_EC_Format_fcontract_second_carry_full(input);
    Hacl_EC_Format_fcontract_trim(input);
    Hacl_EC_Format_fcontract_store(output, input);
  }
  
  static void Hacl_EC_Format_scalar_of_point(uint8_t *scalar, uint64_t *point)
  {
    uint64_t *x = point;
    uint64_t *z = point + (uint32_t)5U;
    uint64_t buf[10U] = { 0U };
    uint64_t *zmone = buf;
    uint64_t *sc = buf + (uint32_t)5U;
    Hacl_Bignum_crecip(zmone, z);
    Hacl_Bignum_fmul(sc, x, zmone);
    Hacl_EC_Format_fcontract(scalar, sc);
  }
  
  static void
  Hacl_EC_AddAndDouble_fmonty(
    uint64_t *pp,
    uint64_t *ppq,
    uint64_t *p,
    uint64_t *pq,
    uint64_t *qmqp
  )
  {
    uint64_t *qx = qmqp;
    uint64_t *x2 = pp;
    uint64_t *z2 = pp + (uint32_t)5U;
    uint64_t *x3 = ppq;
    uint64_t *z3 = ppq + (uint32_t)5U;
    uint64_t *x = p;
    uint64_t *z = p + (uint32_t)5U;
    uint64_t *xprime = pq;
    uint64_t *zprime = pq + (uint32_t)5U;
    uint64_t buf[40U] = { 0U };
    uint64_t *origx = buf;
    uint64_t *origxprime = buf + (uint32_t)5U;
    uint64_t *xxprime0 = buf + (uint32_t)25U;
    uint64_t *zzprime0 = buf + (uint32_t)30U;
    memcpy(origx, x, (uint32_t)5U * sizeof x[0U]);
    Hacl_Bignum_fsum(x, z);
    Hacl_Bignum_fdifference(z, origx);
    memcpy(origxprime, xprime, (uint32_t)5U * sizeof xprime[0U]);
    Hacl_Bignum_fsum(xprime, zprime);
    Hacl_Bignum_fdifference(zprime, origxprime);
    Hacl_Bignum_fmul(xxprime0, xprime, z);
    Hacl_Bignum_fmul(zzprime0, x, zprime);
    uint64_t *origxprime0 = buf + (uint32_t)5U;
    uint64_t *xx0 = buf + (uint32_t)15U;
    uint64_t *zz0 = buf + (uint32_t)20U;
    uint64_t *xxprime = buf + (uint32_t)25U;
    uint64_t *zzprime = buf + (uint32_t)30U;
    uint64_t *zzzprime = buf + (uint32_t)35U;
    memcpy(origxprime0, xxprime, (uint32_t)5U * sizeof xxprime[0U]);
    Hacl_Bignum_fsum(xxprime, zzprime);
    Hacl_Bignum_fdifference(zzprime, origxprime0);
    Hacl_Bignum_Fsquare_fsquare_times(x3, xxprime, (uint32_t)1U);
    Hacl_Bignum_Fsquare_fsquare_times(zzzprime, zzprime, (uint32_t)1U);
    Hacl_Bignum_fmul(z3, zzzprime, qx);
    Hacl_Bignum_Fsquare_fsquare_times(xx0, x, (uint32_t)1U);
    Hacl_Bignum_Fsquare_fsquare_times(zz0, z, (uint32_t)1U);
    uint64_t *zzz = buf + (uint32_t)10U;
    uint64_t *xx = buf + (uint32_t)15U;
    uint64_t *zz = buf + (uint32_t)20U;
    Hacl_Bignum_fmul(x2, xx, zz);
    Hacl_Bignum_fdifference(zz, xx);
    uint64_t scalar = (uint64_t)121665U;
    Hacl_Bignum_fscalar(zzz, zz, scalar);
    Hacl_Bignum_fsum(zzz, xx);
    Hacl_Bignum_fmul(z2, zzz, zz);
  }
  
  static void
  Hacl_EC_Ladder_SmallLoop_cmult_small_loop_step(
    uint64_t *nq,
    uint64_t *nqpq,
    uint64_t *nq2,
    uint64_t *nqpq2,
    uint64_t *q,
    uint8_t byt
  )
  {
    uint64_t bit = (uint64_t)(byt >> (uint32_t)7U);
    Hacl_EC_Point_swap_conditional(nq, nqpq, bit);
    Hacl_EC_AddAndDouble_fmonty(nq2, nqpq2, nq, nqpq, q);
    uint64_t bit0 = (uint64_t)(byt >> (uint32_t)7U);
    Hacl_EC_Point_swap_conditional(nq2, nqpq2, bit0);
  }
  
  static void
  Hacl_EC_Ladder_SmallLoop_cmult_small_loop_double_step(
    uint64_t *nq,
    uint64_t *nqpq,
    uint64_t *nq2,
    uint64_t *nqpq2,
    uint64_t *q,
    uint8_t byt
  )
  {
    Hacl_EC_Ladder_SmallLoop_cmult_small_loop_step(nq, nqpq, nq2, nqpq2, q, byt);
    uint8_t byt1 = byt << (uint32_t)1U;
    Hacl_EC_Ladder_SmallLoop_cmult_small_loop_step(nq2, nqpq2, nq, nqpq, q, byt1);
  }
  
  static void
  Hacl_EC_Ladder_SmallLoop_cmult_small_loop(
    uint64_t *nq,
    uint64_t *nqpq,
    uint64_t *nq2,
    uint64_t *nqpq2,
    uint64_t *q,
    uint8_t byt,
    uint32_t i
  )
  {
    if (!(i == (uint32_t)0U))
    {
      uint32_t i_ = i - (uint32_t)1U;
      Hacl_EC_Ladder_SmallLoop_cmult_small_loop_double_step(nq, nqpq, nq2, nqpq2, q, byt);
      uint8_t byt_ = byt << (uint32_t)2U;
      Hacl_EC_Ladder_SmallLoop_cmult_small_loop(nq, nqpq, nq2, nqpq2, q, byt_, i_);
    }
  }
  
  static void
  Hacl_EC_Ladder_BigLoop_cmult_big_loop(
    uint8_t *n1,
    uint64_t *nq,
    uint64_t *nqpq,
    uint64_t *nq2,
    uint64_t *nqpq2,
    uint64_t *q,
    uint32_t i
  )
  {
    if (!(i == (uint32_t)0U))
    {
      uint32_t i1 = i - (uint32_t)1U;
      uint8_t byte = n1[i1];
      Hacl_EC_Ladder_SmallLoop_cmult_small_loop(nq, nqpq, nq2, nqpq2, q, byte, (uint32_t)4U);
      Hacl_EC_Ladder_BigLoop_cmult_big_loop(n1, nq, nqpq, nq2, nqpq2, q, i1);
    }
  }
  
  static void Hacl_EC_Ladder_cmult(uint64_t *result, uint8_t *n1, uint64_t *q)
  {
    uint64_t point_buf[40U] = { 0U };
    uint64_t *nq = point_buf;
    uint64_t *nqpq = point_buf + (uint32_t)10U;
    uint64_t *nq2 = point_buf + (uint32_t)20U;
    uint64_t *nqpq2 = point_buf + (uint32_t)30U;
    Hacl_EC_Point_copy(nqpq, q);
    nq[0U] = (uint64_t)1U;
    Hacl_EC_Ladder_BigLoop_cmult_big_loop(n1, nq, nqpq, nq2, nqpq2, q, (uint32_t)32U);
    Hacl_EC_Point_copy(result, nq);
  }
  
  void Hacl_Curve25519_crypto_scalarmult(uint8_t *mypublic, uint8_t *secret, uint8_t *basepoint)
  {
    uint64_t buf0[10U] = { 0U };
    uint64_t *x0 = buf0;
    uint64_t *z = buf0 + (uint32_t)5U;
    Hacl_EC_Format_fexpand(x0, basepoint);
    z[0U] = (uint64_t)1U;
    uint64_t *q = buf0;
    uint8_t e[32U] = { 0U };
    memcpy(e, secret, (uint32_t)32U * sizeof secret[0U]);
    uint8_t e0 = e[0U];
    uint8_t e31 = e[31U];
    uint8_t e01 = e0 & (uint8_t)248U;
    uint8_t e311 = e31 & (uint8_t)127U;
    uint8_t e312 = e311 | (uint8_t)64U;
    e[0U] = e01;
    e[31U] = e312;
    uint8_t *scalar = e;
    uint64_t buf[15U] = { 0U };
    uint64_t *nq = buf;
    uint64_t *x = nq;
    x[0U] = (uint64_t)1U;
    Hacl_EC_Ladder_cmult(nq, scalar, q);
    Hacl_EC_Format_scalar_of_point(mypublic, nq);
  }
  
  /* Copyright (c) INRIA and Microsoft Corporation. All rights reserved.
     Licensed under the Apache 2.0 License. */
  
  /******************************************************************************/
  /* Machine integers (128-bit arithmetic)                                      */
  /******************************************************************************/
  
  /* This header makes KreMLin-generated C code work with, 0x
   * - the default setting where we assume the target compiler defines __int128
   * - the setting where we use FStar.UInt128's implementation instead; in that
   *   case, generated C files must be compiled with -DKRML_VERIFIED_UINT128
   * - a refinement of the case above, wherein all structures are passed by
   *   reference, a.k.a. "-fnostruct-passing", meaning that the KreMLin-generated
   *   must be compiled with -DKRML_NOSTRUCT_PASSING
   * Note, 0x no MSVC support in this file.
   */
  
  /* This file is used for both the minimal and generic kremlib distributions. As
   * such, it assumes that the machine integers have been bundled the exact same
   * way in both cases. */
  
  #include "FStar_UInt128.h"
  #include "FStar_UInt_8_16_32_64.h"
  #include "C_Endianness.h"
  
  #if !defined(KRML_VERIFIED_UINT128) && !defined(_MSC_VER)
  
  /* GCC + using native unsigned __int128 support */
  
  uint128_t load128_le(uint8_t *b) {
    uint128_t l = (uint128_t)load64_le(b);
    uint128_t h = (uint128_t)load64_le(b + 8);
    return (h << 64 | l);
  }
  
  void store128_le(uint8_t *b, uint128_t n) {
    store64_le(b, (uint64_t)n);
  
    store64_le(b + 8, (uint64_t)(n >> 64));
  }
  
  uint128_t load128_be(uint8_t *b) {
    uint128_t h = (uint128_t)load64_be(b);
    uint128_t l = (uint128_t)load64_be(b + 8);
    return (h << 64 | l);
  }
  
  void store128_be(uint8_t *b, uint128_t n) {
    store64_be(b, (uint64_t)(n >> 64));
    store64_be(b + 8, (uint64_t)n);
  }
  
  uint128_t FStar_UInt128_add(uint128_t x, uint128_t y) {
    return x + y;
  }
  
  uint128_t FStar_UInt128_mul(uint128_t x, uint128_t y) {
    return x * y;
  }
  
  uint128_t FStar_UInt128_add_mod(uint128_t x, uint128_t y) {
    return x + y;
  }
  
  uint128_t FStar_UInt128_sub(uint128_t x, uint128_t y) {
    return x - y;
  }
  
  uint128_t FStar_UInt128_sub_mod(uint128_t x, uint128_t y) {
    return x - y;
  }
  
  uint128_t FStar_UInt128_logand(uint128_t x, uint128_t y) {
    return x & y;
  }
  
  uint128_t FStar_UInt128_logor(uint128_t x, uint128_t y) {
    return x | y;
  }
  
  uint128_t FStar_UInt128_logxor(uint128_t x, uint128_t y) {
    return x ^ y;
  }
  
  uint128_t FStar_UInt128_lognot(uint128_t x) {
    return ~x;
  }
  
  uint128_t FStar_UInt128_shift_left(uint128_t x, uint32_t y) {
    return x << y;
  }
  
  uint128_t FStar_UInt128_shift_right(uint128_t x, uint32_t y) {
    return x >> y;
  }
  
  uint128_t FStar_UInt128_uint64_to_uint128(uint64_t x) {
    return (uint128_t)x;
  }
  
  uint64_t FStar_UInt128_uint128_to_uint64(uint128_t x) {
    return (uint64_t)x;
  }
  
  uint128_t FStar_UInt128_mul_wide(uint64_t x, uint64_t y) {
    return ((uint128_t) x) * y;
  }
  
  uint128_t FStar_UInt128_eq_mask(uint128_t x, uint128_t y) {
    uint64_t mask =
        FStar_UInt64_eq_mask((uint64_t)(x >> 64), (uint64_t)(y >> 64)) &
        FStar_UInt64_eq_mask(x, y);
    return ((uint128_t)mask) << 64 | mask;
  }
  
  uint128_t FStar_UInt128_gte_mask(uint128_t x, uint128_t y) {
    uint64_t mask =
        (FStar_UInt64_gte_mask(x >> 64, y >> 64) &
         ~(FStar_UInt64_eq_mask(x >> 64, y >> 64))) |
        (FStar_UInt64_eq_mask(x >> 64, y >> 64) & FStar_UInt64_gte_mask(x, y));
    return ((uint128_t)mask) << 64 | mask;
  }
  
  uint128_t FStar_Int_Cast_Full_uint64_to_uint128(uint64_t x) {
    return x;
  }
  
  uint64_t FStar_Int_Cast_Full_uint128_to_uint64(uint128_t x) {
    return x;
  }
  
  #elif !defined(_MSC_VER) && defined(KRML_VERIFIED_UINT128)
  
  /* Verified uint128 implementation. */
  
  /* Access 64-bit fields within the int128. */
  #define HIGH64_OF(x) ((x)->high)
  #define LOW64_OF(x)  ((x)->low)
  
  typedef FStar_UInt128_uint128 FStar_UInt128_t_, uint128_t;
  
  /* A series of definitions written using pointers. */
  
  void load128_le_(uint8_t *b, uint128_t *r) {
    LOW64_OF(r) = load64_le(b);
    HIGH64_OF(r) = load64_le(b + 8);
  }
  
  void store128_le_(uint8_t *b, uint128_t *n) {
    store64_le(b, LOW64_OF(n));
    store64_le(b + 8, HIGH64_OF(n));
  }
  
  void load128_be_(uint8_t *b, uint128_t *r) {
    HIGH64_OF(r) = load64_be(b);
    LOW64_OF(r) = load64_be(b + 8);
  }
  
  void store128_be_(uint8_t *b, uint128_t *n) {
    store64_be(b, HIGH64_OF(n));
    store64_be(b + 8, LOW64_OF(n));
  }
  
  void
  FStar_Int_Cast_Full_uint64_to_uint128_(uint64_t x, uint128_t *dst) {
    /* C89 */
    LOW64_OF(dst) = x;
    HIGH64_OF(dst) = 0;
  }
  
  uint64_t FStar_Int_Cast_Full_uint128_to_uint64_(uint128_t *x) {
    return LOW64_OF(x);
  }
  
  #    ifndef KRML_NOSTRUCT_PASSING
  
  uint128_t load128_le(uint8_t *b) {
    uint128_t r;
    load128_le_(b, &r);
    return r;
  }
  
  void store128_le(uint8_t *b, uint128_t n) {
    store128_le_(b, &n);
  }
  
  uint128_t load128_be(uint8_t *b) {
    uint128_t r;
    load128_be_(b, &r);
    return r;
  }
  
  void store128_be(uint8_t *b, uint128_t n) {
    store128_be_(b, &n);
  }
  
  uint128_t FStar_Int_Cast_Full_uint64_to_uint128(uint64_t x) {
    uint128_t dst;
    FStar_Int_Cast_Full_uint64_to_uint128_(x, &dst);
    return dst;
  }
  
  uint64_t FStar_Int_Cast_Full_uint128_to_uint64(uint128_t x) {
    return FStar_Int_Cast_Full_uint128_to_uint64_(&x);
  }
  
  #    else /* !defined(KRML_STRUCT_PASSING) */
  
  #      define print128 print128_
  #      define load128_le load128_le_
  #      define store128_le store128_le_
  #      define load128_be load128_be_
  #      define store128_be store128_be_
  #      define FStar_Int_Cast_Full_uint128_to_uint64                            \
          FStar_Int_Cast_Full_uint128_to_uint64_
  #      define FStar_Int_Cast_Full_uint64_to_uint128                            \
          FStar_Int_Cast_Full_uint64_to_uint128_
  
  #    endif /* KRML_STRUCT_PASSING */
  
  #endif
  
  #include "FStar_UInt_8_16_32_64.h"
  
  uint64_t FStar_UInt64_eq_mask(uint64_t a, uint64_t b)
  {
    uint64_t x = a ^ b;
    uint64_t minus_x = ~x + (uint64_t)1U;
    uint64_t x_or_minus_x = x | minus_x;
    uint64_t xnx = x_or_minus_x >> (uint32_t)63U;
    return xnx - (uint64_t)1U;
  }
  
  uint64_t FStar_UInt64_gte_mask(uint64_t a, uint64_t b)
  {
    uint64_t x = a;
    uint64_t y = b;
    uint64_t x_xor_y = x ^ y;
    uint64_t x_sub_y = x - y;
    uint64_t x_sub_y_xor_y = x_sub_y ^ y;
    uint64_t q = x_xor_y | x_sub_y_xor_y;
    uint64_t x_xor_q = x ^ q;
    uint64_t x_xor_q_ = x_xor_q >> (uint32_t)63U;
    return x_xor_q_ - (uint64_t)1U;
  }
  
  uint32_t FStar_UInt32_eq_mask(uint32_t a, uint32_t b)
  {
    uint32_t x = a ^ b;
    uint32_t minus_x = ~x + (uint32_t)1U;
    uint32_t x_or_minus_x = x | minus_x;
    uint32_t xnx = x_or_minus_x >> (uint32_t)31U;
    return xnx - (uint32_t)1U;
  }
  
  uint32_t FStar_UInt32_gte_mask(uint32_t a, uint32_t b)
  {
    uint32_t x = a;
    uint32_t y = b;
    uint32_t x_xor_y = x ^ y;
    uint32_t x_sub_y = x - y;
    uint32_t x_sub_y_xor_y = x_sub_y ^ y;
    uint32_t q = x_xor_y | x_sub_y_xor_y;
    uint32_t x_xor_q = x ^ q;
    uint32_t x_xor_q_ = x_xor_q >> (uint32_t)31U;
    return x_xor_q_ - (uint32_t)1U;
  }
  
  uint16_t FStar_UInt16_eq_mask(uint16_t a, uint16_t b)
  {
    uint16_t x = a ^ b;
    uint16_t minus_x = ~x + (uint16_t)1U;
    uint16_t x_or_minus_x = x | minus_x;
    uint16_t xnx = x_or_minus_x >> (uint32_t)15U;
    return xnx - (uint16_t)1U;
  }
  
  uint16_t FStar_UInt16_gte_mask(uint16_t a, uint16_t b)
  {
    uint16_t x = a;
    uint16_t y = b;
    uint16_t x_xor_y = x ^ y;
    uint16_t x_sub_y = x - y;
    uint16_t x_sub_y_xor_y = x_sub_y ^ y;
    uint16_t q = x_xor_y | x_sub_y_xor_y;
    uint16_t x_xor_q = x ^ q;
    uint16_t x_xor_q_ = x_xor_q >> (uint32_t)15U;
    return x_xor_q_ - (uint16_t)1U;
  }
  
  uint8_t FStar_UInt8_eq_mask(uint8_t a, uint8_t b)
  {
    uint8_t x = a ^ b;
    uint8_t minus_x = ~x + (uint8_t)1U;
    uint8_t x_or_minus_x = x | minus_x;
    uint8_t xnx = x_or_minus_x >> (uint32_t)7U;
    return xnx - (uint8_t)1U;
  }
  
  uint8_t FStar_UInt8_gte_mask(uint8_t a, uint8_t b)
  {
    uint8_t x = a;
    uint8_t y = b;
    uint8_t x_xor_y = x ^ y;
    uint8_t x_sub_y = x - y;
    uint8_t x_sub_y_xor_y = x_sub_y ^ y;
    uint8_t q = x_xor_y | x_sub_y_xor_y;
    uint8_t x_xor_q = x ^ q;
    uint8_t x_xor_q_ = x_xor_q >> (uint32_t)7U;
    return x_xor_q_ - (uint8_t)1U;
  }
  
  int main() {
    uint8_t sk[] = {
      0xa5, 0x46, 0xe3, 0x6b, 0xf0, 0x52, 0x7c, 0x9d,
      0x3b, 0x16, 0x15, 0x4b, 0x82, 0x46, 0x5e, 0xdd,
      0x62, 0x14, 0x4c, 0x0a, 0xc1, 0xfc, 0x5a, 0x18,
      0x50, 0x6a, 0x22, 0x44, 0xba, 0x44, 0x9a, 0xc4
    };
    uint8_t base[] = {
      0xe6, 0xdb, 0x68, 0x67, 0x58, 0x30, 0x30, 0xdb,
      0x35, 0x94, 0xc1, 0xa4, 0x24, 0xb1, 0x5f, 0x7c,
      0x72, 0x66, 0x24, 0xec, 0x26, 0xb3, 0x35, 0x3b,
      0x10, 0xa9, 0x03, 0xa6, 0xd0, 0xab, 0x1c, 0x4c
    };
    uint8_t pub[32];
    /* c3da55379de9c6908e94ea4df28d084f32eccf03491c71f754b4075577a28552 */
    Hacl_Curve25519_crypto_scalarmult(pub, sk, base);
    for (int i = 0; i < 32; i++) printf("%hhx", pub[i]);
  }
  