170 	 * We compute d = 2^13*p + a - b; this ensures a positive  in f256_sub()
267 		 * The operations below compute:  in f256_montymul()
348 		 * The operations below compute:  in f256_montymul()
485 	 * We compute a^(p-2) mod p. The exponent pattern (from high to  in f256_invert()
550 	 * We compute t = r + (2^256 - p) = r + 2^224 - 2^192 - 2^96 + 1.  in f256_final_reduce()
732 	/* Compute affine coordinates x (in t1) and y (in t2). */  in point_encode()
780 	 * Compute z^2 in t1.  in p256_double()
785 	 * Compute x-z^2 in t2 and x+z^2 in t1.  in p256_double()
791 	 * Compute 3*(x+z^2)*(x-z^2) in t1.  in p256_double()
798 	 * Compute 4*x*y^2 (in t2) and 2*y^2 (in t3).  in p256_double()
806 	 * Compute x' = m^2 - 2*s.  in p256_double()
813 	 * Compute z' = 2*y*z.  in p256_double()
820 	 * Compute y' = m*(s - x') - 8*y^4. Note that we already have  in p256_double()
883 	 * Compute u1 = x1*z2^2 (in t1) and s1 = y1*z2^3 (in t3).  in p256_add()
891 	 * Compute u2 = x2*z1^2 (in t2) and s2 = y2*z1^3 (in t4).  in p256_add()
899 	 * Compute h = h2 - u1 (in t2) and r = s2 - s1 (in t4).  in p256_add()
911 	 * Compute u1*h^2 (in t6) and h^3 (in t5);  in p256_add()
918 	 * Compute x3 = r^2 - h^3 - 2*u1*h^2.  in p256_add()
926 	 * Compute y3 = r*(u1*h^2 - x3) - s1*h^3.  in p256_add()
934 	 * Compute z3 = h*z1*z2.  in p256_add()
995 	 * Compute u1 = x1 (in t1) and s1 = y1 (in t3).  in p256_add_mixed()
1001 	 * Compute u2 = x2*z1^2 (in t2) and s2 = y2*z1^3 (in t4).  in p256_add_mixed()
1009 	 * Compute h = h2 - u1 (in t2) and r = s2 - s1 (in t4).  in p256_add_mixed()
1021 	 * Compute u1*h^2 (in t6) and h^3 (in t5);  in p256_add_mixed()
1028 	 * Compute x3 = r^2 - h^3 - 2*u1*h^2.  in p256_add_mixed()
1036 	 * Compute y3 = r*(u1*h^2 - x3) - s1*h^3.  in p256_add_mixed()
1044 	 * Compute z3 = h*z1*z2.  in p256_add_mixed()
1093 	 * or all-zero otherwise; then we can compute the double of P2
1118 	 * Compute u1 = x1 (in t1) and s1 = y1 (in t3).
1124 	 * Compute u2 = x2*z1^2 (in t2) and s2 = y2*z1^3 (in t4).
1132 	 * Compute h = h2 - u1 (in t2) and r = s2 - s1 (in t4).
1149 	 * Compute u1*h^2 (in t6) and h^3 (in t5);
1156 	 * Compute x3 = r^2 - h^3 - 2*u1*h^2.
1164 	 * Compute y3 = r*(u1*h^2 - x3) - s1*h^3.
1172 	 * Compute z3 = h*z1.
1181 	 * Compute z' = 2*y2 (in t1).
1187 	 * Compute 2*(y2^2) (in t2) and s = 4*x2*(y2^2) (in t3).
1195 	 * Compute m = 3*(x2^2 - 1) (in t4).
1203 	 * Compute x' = m^2 - 2*s (in t5).
1210 	 * Compute y' = m*(s - x') - 8*y2^4 (in t6).
1339 	 * we compute u = 1/(z1*z2*z3*z4), and then we have:  in window_to_affine()
1464 	 * Compute window, in Jacobian coordinates.  in p256_mul()