betrusted-ed25519-verified/verification/gen/CurveField/Funs.lean

-- THIS FILE WAS AUTOMATICALLY GENERATED BY AENEAS
-- [curve25519_dalek]: function definitions
import Aeneas
import CurveField.Types
import CurveField.FunsExternal
open Aeneas Aeneas.Std Result ControlFlow Error
set_option linter.dupNamespace false
set_option linter.hashCommand false
set_option linter.unusedVariables false

/- You can set the `maxHeartbeats` value with the `-max-heartbeats` CLI option -/
set_option maxHeartbeats 1000000

/- You can set the `maxRecDepth` value with the `-max-recdepth` CLI option -/
set_option maxRecDepth 2048

/- You can remove the following line by using the CLI option `-all-computable`: -/
noncomputable section

namespace curve25519_dalek

/-- Trait implementation: [core::array::{impl core::fmt::Debug for [T; N]}]
    Source: '/rustc/library/core/src/array/mod.rs', lines 355:0-355:57
    Name pattern: [core::fmt::Debug<[@T; @N]>] -/
@[reducible, rust_trait_impl "core::fmt::Debug<[@T; @N]>"]
def Array.Insts.CoreFmtDebug {T : Type} (N : Std.Usize) (fmtDebugInst :
  core.fmt.Debug T) : core.fmt.Debug (Array T N) := {
  fmt := core.array.DebugArray.fmt fmtDebugInst
}

/-- Trait implementation: [core::fmt::{impl core::fmt::Debug for [T]}]
    Source: '/rustc/library/core/src/fmt/mod.rs', lines 3121:0-3121:28
    Name pattern: [core::fmt::Debug<[@T]>] -/
@[reducible, rust_trait_impl "core::fmt::Debug<[@T]>"]
def Slice.Insts.CoreFmtDebug {T : Type} (DebugInst : core.fmt.Debug T) :
  core.fmt.Debug (Slice T) := {
  fmt := Slice.Insts.CoreFmtDebug.fmt DebugInst
}

/-- Trait implementation: [core::hash::impls::{impl core::hash::Hash for u8}]
    Source: '/rustc/library/core/src/hash/mod.rs', lines 810:12-810:29
    Name pattern: [core::hash::Hash<u8>] -/
@[reducible, rust_trait_impl "core::hash::Hash<u8>"]
def U8.Insts.CoreHashHash : core.hash.Hash Std.U8 := {
  hash := fun {H : Type} (HasherInst : core.hash.Hasher H) =>
    U8.Insts.CoreHashHash.hash HasherInst
}

/-- Trait implementation: [core::iter::range::{impl core::iter::range::Step for u32}]
    Source: '/rustc/library/core/src/iter/range.rs', lines 266:12-266:43
    Name pattern: [core::iter::range::Step<u32>] -/
@[reducible, rust_trait_impl "core::iter::range::Step<u32>"]
def U32.Insts.CoreIterRangeStep : core.iter.range.Step Std.U32 := {
  cloneInst := core.clone.CloneU32
  partialOrdInst := core.cmp.PartialOrdU32
  steps_between := U32.Insts.CoreIterRangeStep.steps_between
  forward_checked := U32.Insts.CoreIterRangeStep.forward_checked
  backward_checked := U32.Insts.CoreIterRangeStep.backward_checked
}

/-- Trait implementation: [core::slice::index::private_slice_index::{impl core::slice::index::private_slice_index::Sealed for core::ops::range::RangeFull}]
    Source: '/rustc/library/core/src/slice/index.rs', lines 120:4-120:34
    Name pattern: [core::slice::index::private_slice_index::Sealed<core::ops::range::RangeFull>] -/
@[reducible, rust_trait_impl
  "core::slice::index::private_slice_index::Sealed<core::ops::range::RangeFull>"]
def core.ops.range.RangeFull.Insts.CoreSliceIndexPrivate_slice_indexSealed :
  core.slice.index.private_slice_index.Sealed core.ops.range.RangeFull := {
}

/-- Trait implementation: [core::slice::index::{impl core::slice::index::SliceIndex<[T], [T]> for core::ops::range::RangeFull}]
    Source: '/rustc/library/core/src/slice/index.rs', lines 631:0-631:55
    Name pattern: [core::slice::index::SliceIndex<core::ops::range::RangeFull, [@T], [@T]>] -/
@[reducible, rust_trait_impl
  "core::slice::index::SliceIndex<core::ops::range::RangeFull, [@T], [@T]>"]
def core.ops.range.RangeFull.Insts.CoreSliceIndexSliceIndexSliceSlice (T :
  Type) : core.slice.index.SliceIndex core.ops.range.RangeFull (Slice T) (Slice
  T) := {
  sealedInst :=
    core.ops.range.RangeFull.Insts.CoreSliceIndexPrivate_slice_indexSealed
  get := core.ops.range.RangeFull.Insts.CoreSliceIndexSliceIndexSliceSlice.get
  get_mut :=
    core.ops.range.RangeFull.Insts.CoreSliceIndexSliceIndexSliceSlice.get_mut
  get_unchecked :=
    core.ops.range.RangeFull.Insts.CoreSliceIndexSliceIndexSliceSlice.get_unchecked
  get_unchecked_mut :=
    core.ops.range.RangeFull.Insts.CoreSliceIndexSliceIndexSliceSlice.get_unchecked_mut
  index :=
    core.ops.range.RangeFull.Insts.CoreSliceIndexSliceIndexSliceSlice.index
  index_mut :=
    core.ops.range.RangeFull.Insts.CoreSliceIndexSliceIndexSliceSlice.index_mut
}

/-- Trait implementation: [subtle::{impl core::convert::From<subtle::Choice> for bool}]
    Source: '/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/subtle-2.6.1/src/lib.rs', lines 138:0-138:26
    Name pattern: [core::convert::From<bool, subtle::Choice>] -/
@[reducible, rust_trait_impl "core::convert::From<bool, subtle::Choice>"]
def Bool.Insts.CoreConvertFromChoice : core.convert.From Bool subtle.Choice
  := {
  from_ := Bool.Insts.CoreConvertFromChoice.from
}

/-- Trait implementation: [subtle::{impl core::convert::From<u8> for subtle::Choice}]
    Source: '/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/subtle-2.6.1/src/lib.rs', lines 236:0-236:24
    Name pattern: [core::convert::From<subtle::Choice, u8>] -/
@[reducible, rust_trait_impl "core::convert::From<subtle::Choice, u8>"]
def subtle.Choice.Insts.CoreConvertFromU8 : core.convert.From subtle.Choice
  Std.U8 := {
  from_ := subtle.Choice.Insts.CoreConvertFromU8.from
}

/-- Trait implementation: [subtle::{impl subtle::ConstantTimeEq for u8}]
    Source: '/cargo/registry/src/index.crates.io-1949cf8c6b5b557f/subtle-2.6.1/src/lib.rs', lines 346:8-346:36
    Name pattern: [subtle::ConstantTimeEq<u8>] -/
@[reducible, rust_trait_impl "subtle::ConstantTimeEq<u8>"]
def U8.Insts.SubtleConstantTimeEq : subtle.ConstantTimeEq Std.U8 := {
  ct_eq := U8.Insts.SubtleConstantTimeEq.ct_eq
}

/-- [curve25519_dalek::backend::variable_base_mul]:
    Source: 'curve25519-dalek/src/backend/mod.rs', lines 227:0-237:1
    Visibility: public -/
def backend.variable_base_mul
  (point : edwards.EdwardsPoint) (scalar : scalar.Scalar) :
  Result edwards.EdwardsPoint
  := do
  let _ ← backend.get_selected_backend
  backend.serial.scalar_mul.variable_base.mul point scalar

/-- [curve25519_dalek::edwards::{curve25519_dalek::edwards::EdwardsPoint}::as_projective]:
    Source: 'curve25519-dalek/src/edwards.rs', lines 527:4-533:5 -/
def edwards.EdwardsPoint.as_projective
  (self : edwards.EdwardsPoint) :
  Result backend.serial.curve_models.ProjectivePoint
  := do
  ok { X := self.X, Y := self.Y, Z := self.Z }

/-- [curve25519_dalek::backend::serial::u64::field::{curve25519_dalek::backend::serial::u64::field::FieldElement51}::pow2k::LOW_51_BIT_MASK]
    Source: 'curve25519-dalek/src/backend/serial/u64/field.rs', lines 511:12-511:58 -/
@[global_simps, irreducible]
def backend.serial.u64.field.FieldElement51.pow2k.LOW_51_BIT_MASK
  : Result Std.U64 := do
  let i ← 1#u64 <<< 51#i32
  i - 1#u64

/-- [curve25519_dalek::backend::serial::u64::field::{curve25519_dalek::backend::serial::u64::field::FieldElement51}::pow2k::m]:
    Source: 'curve25519-dalek/src/backend/serial/u64/field.rs', lines 460:8-462:9 -/
def backend.serial.u64.field.FieldElement51.pow2k.m
  (x : Std.U64) (y : Std.U64) : Result Std.U128 := do
  let i ← lift (UScalar.cast .U128 x)
  let i1 ← lift (UScalar.cast .U128 y)
  i * i1

/-- [curve25519_dalek::backend::serial::u64::field::{curve25519_dalek::backend::serial::u64::field::FieldElement51}::pow2k]: loop body 0:
    Source: 'curve25519-dalek/src/backend/serial/u64/field.rs', lines 480:16-492:86
    Visibility: public -/
@[rust_loop_body]
def backend.serial.u64.field.FieldElement51.pow2k_loop.body
  (k : Std.U32) (a : Array Std.U64 5#usize) :
  Result (ControlFlow (Std.U32 × (Array Std.U64 5#usize)) (Array Std.U64
    5#usize))
  := do
  let i ← Array.index_usize a 3#usize
  let a3_19 ← 19#u64 * i
  let i1 ← Array.index_usize a 4#usize
  let a4_19 ← 19#u64 * i1
  let i2 ← Array.index_usize a 0#usize
  let i3 ← backend.serial.u64.field.FieldElement51.pow2k.m i2 i2
  let i4 ← Array.index_usize a 1#usize
  let i5 ← backend.serial.u64.field.FieldElement51.pow2k.m i4 a4_19
  let i6 ← Array.index_usize a 2#usize
  let i7 ← backend.serial.u64.field.FieldElement51.pow2k.m i6 a3_19
  let i8 ← i5 + i7
  let i9 ← 2#u128 * i8
  let c0 ← i3 + i9
  let i10 ← backend.serial.u64.field.FieldElement51.pow2k.m i a3_19
  let i11 ← backend.serial.u64.field.FieldElement51.pow2k.m i2 i4
  let i12 ← backend.serial.u64.field.FieldElement51.pow2k.m i6 a4_19
  let i13 ← i11 + i12
  let i14 ← 2#u128 * i13
  let c1 ← i10 + i14
  let i15 ← backend.serial.u64.field.FieldElement51.pow2k.m i4 i4
  let i16 ← backend.serial.u64.field.FieldElement51.pow2k.m i2 i6
  let i17 ← backend.serial.u64.field.FieldElement51.pow2k.m i1 a3_19
  let i18 ← i16 + i17
  let i19 ← 2#u128 * i18
  let c2 ← i15 + i19
  let i20 ← backend.serial.u64.field.FieldElement51.pow2k.m i1 a4_19
  let i21 ← backend.serial.u64.field.FieldElement51.pow2k.m i2 i
  let i22 ← backend.serial.u64.field.FieldElement51.pow2k.m i4 i6
  let i23 ← i21 + i22
  let i24 ← 2#u128 * i23
  let c3 ← i20 + i24
  let i25 ← backend.serial.u64.field.FieldElement51.pow2k.m i6 i6
  let i26 ← backend.serial.u64.field.FieldElement51.pow2k.m i2 i1
  let i27 ← backend.serial.u64.field.FieldElement51.pow2k.m i4 i
  let i28 ← i26 + i27
  let i29 ← 2#u128 * i28
  let c4 ← i25 + i29
  let i30 ← 1#u64 <<< 54#i32
  massert (i2 < i30)
  massert (i4 < i30)
  massert (i6 < i30)
  massert (i < i30)
  massert (i1 < i30)
  let i31 ← c0 >>> 51#i32
  let i32 ← lift (UScalar.cast .U64 i31)
  let i33 ← lift (UScalar.cast .U128 i32)
  let c11 ← c1 + i33
  let i34 ← lift (UScalar.cast .U64 c0)
  let i35 ← backend.serial.u64.field.FieldElement51.pow2k.LOW_51_BIT_MASK
  let i36 ← lift (i34 &&& i35)
  let a1 ← Array.update a 0#usize i36
  let i37 ← c11 >>> 51#i32
  let i38 ← lift (UScalar.cast .U64 i37)
  let i39 ← lift (UScalar.cast .U128 i38)
  let c21 ← c2 + i39
  let i40 ← lift (UScalar.cast .U64 c11)
  let i41 ← lift (i40 &&& i35)
  let a2 ← Array.update a1 1#usize i41
  let i42 ← c21 >>> 51#i32
  let i43 ← lift (UScalar.cast .U64 i42)
  let i44 ← lift (UScalar.cast .U128 i43)
  let c31 ← c3 + i44
  let i45 ← lift (UScalar.cast .U64 c21)
  let i46 ← lift (i45 &&& i35)
  let a3 ← Array.update a2 2#usize i46
  let i47 ← c31 >>> 51#i32
  let i48 ← lift (UScalar.cast .U64 i47)
  let i49 ← lift (UScalar.cast .U128 i48)
  let c41 ← c4 + i49
  let i50 ← lift (UScalar.cast .U64 c31)
  let i51 ← lift (i50 &&& i35)
  let a4 ← Array.update a3 3#usize i51
  let i52 ← c41 >>> 51#i32
  let carry ← lift (UScalar.cast .U64 i52)
  let i53 ← lift (UScalar.cast .U64 c41)
  let i54 ← lift (i53 &&& i35)
  let a5 ← Array.update a4 4#usize i54
  let i55 ← carry * 19#u64
  let i56 ← Array.index_usize a5 0#usize
  let i57 ← i56 + i55
  let a6 ← Array.update a5 0#usize i57
  let i58 ← Array.index_usize a6 0#usize
  let i59 ← i58 >>> 51#i32
  let i60 ← Array.index_usize a6 1#usize
  let i61 ← i60 + i59
  let a7 ← Array.update a6 1#usize i61
  let i62 ← Array.index_usize a7 0#usize
  let i63 ← lift (i62 &&& i35)
  let (_, index_mut_back) ← Array.index_mut_usize a7 0#usize
  let k1 ← k - 1#u32
  if k1 = 0#u32
  then let a8 := index_mut_back i63
       ok (done a8)
  else let a8 := index_mut_back i63
       ok (cont (k1, a8))

/-- [curve25519_dalek::backend::serial::u64::field::{curve25519_dalek::backend::serial::u64::field::FieldElement51}::pow2k]: loop 0:
    Source: 'curve25519-dalek/src/backend/serial/u64/field.rs', lines 480:16-492:86
    Visibility: public -/
@[rust_loop]
def backend.serial.u64.field.FieldElement51.pow2k_loop
  (k : Std.U32) (a : Array Std.U64 5#usize) :
  Result (Array Std.U64 5#usize)
  := do
  loop
    (fun (k1, a1) => backend.serial.u64.field.FieldElement51.pow2k_loop.body k1
      a1)
    (k, a)

/-- [curve25519_dalek::backend::serial::u64::field::{curve25519_dalek::backend::serial::u64::field::FieldElement51}::pow2k]:
    Source: 'curve25519-dalek/src/backend/serial/u64/field.rs', lines 454:4-559:5
    Visibility: public -/
def backend.serial.u64.field.FieldElement51.pow2k
  (self : backend.serial.u64.field.FieldElement51) (k : Std.U32) :
  Result backend.serial.u64.field.FieldElement51
  := do
  massert (k > 0#u32)
  let a ← backend.serial.u64.field.FieldElement51.pow2k_loop k self
  ok a

/-- [curve25519_dalek::backend::serial::u64::field::{curve25519_dalek::backend::serial::u64::field::FieldElement51}::square2]: loop body 0:
    Source: 'curve25519-dalek/src/backend/serial/u64/field.rs', lines 569:8-571:9
    Visibility: public -/
@[rust_loop_body]
def backend.serial.u64.field.FieldElement51.square2_loop.body
  (iter : core.ops.range.Range Std.Usize)
  (square : backend.serial.u64.field.FieldElement51) :
  Result (ControlFlow ((core.ops.range.Range Std.Usize) ×
    backend.serial.u64.field.FieldElement51)
    backend.serial.u64.field.FieldElement51)
  := do
  let (o, iter1) ←
    core.iter.range.IteratorRange.next core.iter.range.StepUsize iter
  match o with
  | none => ok (done square)
  | some i =>
    let i1 ← Array.index_usize square i
    let i2 ← i1 * 2#u64
    let a ← Array.update square i i2
    ok (cont (iter1, a))

/-- [curve25519_dalek::backend::serial::u64::field::{curve25519_dalek::backend::serial::u64::field::FieldElement51}::square2]: loop 0:
    Source: 'curve25519-dalek/src/backend/serial/u64/field.rs', lines 569:8-571:9
    Visibility: public -/
@[rust_loop]
def backend.serial.u64.field.FieldElement51.square2_loop
  (iter : core.ops.range.Range Std.Usize)
  (square : backend.serial.u64.field.FieldElement51) :
  Result backend.serial.u64.field.FieldElement51
  := do
  loop
    (fun (iter1, square1) =>
      backend.serial.u64.field.FieldElement51.square2_loop.body iter1 square1)
    (iter, square)

/-- [curve25519_dalek::backend::serial::u64::field::{curve25519_dalek::backend::serial::u64::field::FieldElement51}::square2]:
    Source: 'curve25519-dalek/src/backend/serial/u64/field.rs', lines 567:4-574:5
    Visibility: public -/
def backend.serial.u64.field.FieldElement51.square2
  (self : backend.serial.u64.field.FieldElement51) :
  Result backend.serial.u64.field.FieldElement51
  := do
  let square ← backend.serial.u64.field.FieldElement51.pow2k self 1#u32
  backend.serial.u64.field.FieldElement51.square2_loop
    { start := 0#usize, «end» := 5#usize } square

/-- [curve25519_dalek::backend::serial::u64::field::{curve25519_dalek::backend::serial::u64::field::FieldElement51}::square]:
    Source: 'curve25519-dalek/src/backend/serial/u64/field.rs', lines 562:4-564:5
    Visibility: public -/
def backend.serial.u64.field.FieldElement51.square
  (self : backend.serial.u64.field.FieldElement51) :
  Result backend.serial.u64.field.FieldElement51
  := do
  backend.serial.u64.field.FieldElement51.pow2k self 1#u32

/-- [curve25519_dalek::backend::serial::u64::field::{curve25519_dalek::backend::serial::u64::field::FieldElement51}::reduce::LOW_51_BIT_MASK]
    Source: 'curve25519-dalek/src/backend/serial/u64/field.rs', lines 291:8-291:54 -/
@[global_simps, irreducible]
def backend.serial.u64.field.FieldElement51.reduce.LOW_51_BIT_MASK
  : Result Std.U64 := do
  let i ← 1#u64 <<< 51#i32
  i - 1#u64

/-- [curve25519_dalek::backend::serial::u64::field::{curve25519_dalek::backend::serial::u64::field::FieldElement51}::reduce]:
    Source: 'curve25519-dalek/src/backend/serial/u64/field.rs', lines 290:4-323:5 -/
def backend.serial.u64.field.FieldElement51.reduce
  (limbs : Array Std.U64 5#usize) :
  Result backend.serial.u64.field.FieldElement51
  := do
  let i ← Array.index_usize limbs 0#usize
  let c0 ← i >>> 51#i32
  let i1 ← Array.index_usize limbs 1#usize
  let c1 ← i1 >>> 51#i32
  let i2 ← Array.index_usize limbs 2#usize
  let c2 ← i2 >>> 51#i32
  let i3 ← Array.index_usize limbs 3#usize
  let c3 ← i3 >>> 51#i32
  let i4 ← Array.index_usize limbs 4#usize
  let c4 ← i4 >>> 51#i32
  let i5 ← backend.serial.u64.field.FieldElement51.reduce.LOW_51_BIT_MASK
  let i6 ← lift (i &&& i5)
  let limbs1 ← Array.update limbs 0#usize i6
  let i7 ← Array.index_usize limbs1 1#usize
  let i8 ← lift (i7 &&& i5)
  let limbs2 ← Array.update limbs1 1#usize i8
  let i9 ← Array.index_usize limbs2 2#usize
  let i10 ← lift (i9 &&& i5)
  let limbs3 ← Array.update limbs2 2#usize i10
  let i11 ← Array.index_usize limbs3 3#usize
  let i12 ← lift (i11 &&& i5)
  let limbs4 ← Array.update limbs3 3#usize i12
  let i13 ← Array.index_usize limbs4 4#usize
  let i14 ← lift (i13 &&& i5)
  let limbs5 ← Array.update limbs4 4#usize i14
  let i15 ← c4 * 19#u64
  let i16 ← Array.index_usize limbs5 0#usize
  let i17 ← i16 + i15
  let limbs6 ← Array.update limbs5 0#usize i17
  let i18 ← Array.index_usize limbs6 1#usize
  let i19 ← i18 + c0
  let limbs7 ← Array.update limbs6 1#usize i19
  let i20 ← Array.index_usize limbs7 2#usize
  let i21 ← i20 + c1
  let limbs8 ← Array.update limbs7 2#usize i21
  let i22 ← Array.index_usize limbs8 3#usize
  let i23 ← i22 + c2
  let limbs9 ← Array.update limbs8 3#usize i23
  let i24 ← Array.index_usize limbs9 4#usize
  let i25 ← i24 + c3
  let limbs10 ← Array.update limbs9 4#usize i25
  ok limbs10

/-- [curve25519_dalek::backend::serial::u64::field::{impl core::ops::arith::Sub<&'b curve25519_dalek::backend::serial::u64::field::FieldElement51, curve25519_dalek::backend::serial::u64::field::FieldElement51> for &'a curve25519_dalek::backend::serial::u64::field::FieldElement51}::sub]:
    Source: 'curve25519-dalek/src/backend/serial/u64/field.rs', lines 84:4-101:5
    Visibility: public -/
def
  SharedAFieldElement51.Insts.CoreOpsArithSubSharedBFieldElement51FieldElement51.sub
  (self : backend.serial.u64.field.FieldElement51)
  (_rhs : backend.serial.u64.field.FieldElement51) :
  Result backend.serial.u64.field.FieldElement51
  := do
  let i ← Array.index_usize self 0#usize
  let i1 ← i + 36028797018963664#u64
  let i2 ← Array.index_usize _rhs 0#usize
  let i3 ← i1 - i2
  let i4 ← Array.index_usize self 1#usize
  let i5 ← i4 + 36028797018963952#u64
  let i6 ← Array.index_usize _rhs 1#usize
  let i7 ← i5 - i6
  let i8 ← Array.index_usize self 2#usize
  let i9 ← i8 + 36028797018963952#u64
  let i10 ← Array.index_usize _rhs 2#usize
  let i11 ← i9 - i10
  let i12 ← Array.index_usize self 3#usize
  let i13 ← i12 + 36028797018963952#u64
  let i14 ← Array.index_usize _rhs 3#usize
  let i15 ← i13 - i14
  let i16 ← Array.index_usize self 4#usize
  let i17 ← i16 + 36028797018963952#u64
  let i18 ← Array.index_usize _rhs 4#usize
  let i19 ← i17 - i18
  backend.serial.u64.field.FieldElement51.reduce
    (Array.make 5#usize [ i3, i7, i11, i15, i19 ])

/-- [curve25519_dalek::backend::serial::u64::field::{impl core::ops::arith::AddAssign<&'b curve25519_dalek::backend::serial::u64::field::FieldElement51> for curve25519_dalek::backend::serial::u64::field::FieldElement51}::add_assign]: loop body 0:
    Source: 'curve25519-dalek/src/backend/serial/u64/field.rs', lines 60:8-62:9
    Visibility: public -/
@[rust_loop_body]
def
  backend.serial.u64.field.FieldElement51.Insts.CoreOpsArithAddAssignSharedBFieldElement51.add_assign_loop.body
  (iter : core.ops.range.Range Std.Usize)
  (self : backend.serial.u64.field.FieldElement51)
  (_rhs : backend.serial.u64.field.FieldElement51) :
  Result (ControlFlow ((core.ops.range.Range Std.Usize) ×
    backend.serial.u64.field.FieldElement51 ×
    backend.serial.u64.field.FieldElement51)
    backend.serial.u64.field.FieldElement51)
  := do
  let (o, iter1) ←
    core.iter.range.IteratorRange.next core.iter.range.StepUsize iter
  match o with
  | none => ok (done self)
  | some i =>
    let i1 ← Array.index_usize _rhs i
    let i2 ← Array.index_usize self i
    let i3 ← i2 + i1
    let a ← Array.update self i i3
    ok (cont (iter1, a, _rhs))

/-- [curve25519_dalek::backend::serial::u64::field::{impl core::ops::arith::AddAssign<&'b curve25519_dalek::backend::serial::u64::field::FieldElement51> for curve25519_dalek::backend::serial::u64::field::FieldElement51}::add_assign]: loop 0:
    Source: 'curve25519-dalek/src/backend/serial/u64/field.rs', lines 60:8-62:9
    Visibility: public -/
@[rust_loop]
def
  backend.serial.u64.field.FieldElement51.Insts.CoreOpsArithAddAssignSharedBFieldElement51.add_assign_loop
  (iter : core.ops.range.Range Std.Usize)
  (self : backend.serial.u64.field.FieldElement51)
  (_rhs : backend.serial.u64.field.FieldElement51) :
  Result backend.serial.u64.field.FieldElement51
  := do
  loop
    (fun (iter1, self1, _rhs1) =>
      backend.serial.u64.field.FieldElement51.Insts.CoreOpsArithAddAssignSharedBFieldElement51.add_assign_loop.body
      iter1 self1 _rhs1)
    (iter, self, _rhs)

/-- [curve25519_dalek::backend::serial::u64::field::{impl core::ops::arith::AddAssign<&'b curve25519_dalek::backend::serial::u64::field::FieldElement51> for curve25519_dalek::backend::serial::u64::field::FieldElement51}::add_assign]:
    Source: 'curve25519-dalek/src/backend/serial/u64/field.rs', lines 59:4-63:5
    Visibility: public -/
@[reducible]
def
  backend.serial.u64.field.FieldElement51.Insts.CoreOpsArithAddAssignSharedBFieldElement51.add_assign
  (self : backend.serial.u64.field.FieldElement51)
  (_rhs : backend.serial.u64.field.FieldElement51) :
  Result backend.serial.u64.field.FieldElement51
  := do
  backend.serial.u64.field.FieldElement51.Insts.CoreOpsArithAddAssignSharedBFieldElement51.add_assign_loop
    { start := 0#usize, «end» := 5#usize } self _rhs

/-- [curve25519_dalek::backend::serial::u64::field::{impl core::ops::arith::Add<&'b curve25519_dalek::backend::serial::u64::field::FieldElement51, curve25519_dalek::backend::serial::u64::field::FieldElement51> for &'a curve25519_dalek::backend::serial::u64::field::FieldElement51}::add]:
    Source: 'curve25519-dalek/src/backend/serial/u64/field.rs', lines 68:4-72:5
    Visibility: public -/
def
  SharedAFieldElement51.Insts.CoreOpsArithAddSharedBFieldElement51FieldElement51.add
  (self : backend.serial.u64.field.FieldElement51)
  (_rhs : backend.serial.u64.field.FieldElement51) :
  Result backend.serial.u64.field.FieldElement51
  := do
  backend.serial.u64.field.FieldElement51.Insts.CoreOpsArithAddAssignSharedBFieldElement51.add_assign
    self _rhs

/-- [curve25519_dalek::backend::serial::curve_models::{curve25519_dalek::backend::serial::curve_models::ProjectivePoint}::double]:
    Source: 'curve25519-dalek/src/backend/serial/curve_models/mod.rs', lines 381:4-397:5
    Visibility: public -/
def backend.serial.curve_models.ProjectivePoint.double
  (self : backend.serial.curve_models.ProjectivePoint) :
  Result backend.serial.curve_models.CompletedPoint
  := do
  let XX ← backend.serial.u64.field.FieldElement51.square self.X
  let YY ← backend.serial.u64.field.FieldElement51.square self.Y
  let ZZ2 ← backend.serial.u64.field.FieldElement51.square2 self.Z
  let X_plus_Y ←
    SharedAFieldElement51.Insts.CoreOpsArithAddSharedBFieldElement51FieldElement51.add
      self.X self.Y
  let X_plus_Y_sq ← backend.serial.u64.field.FieldElement51.square X_plus_Y
  let YY_plus_XX ←
    SharedAFieldElement51.Insts.CoreOpsArithAddSharedBFieldElement51FieldElement51.add
      YY XX
  let YY_minus_XX ←
    SharedAFieldElement51.Insts.CoreOpsArithSubSharedBFieldElement51FieldElement51.sub
      YY XX
  let fe ←
    SharedAFieldElement51.Insts.CoreOpsArithSubSharedBFieldElement51FieldElement51.sub
      X_plus_Y_sq YY_plus_XX
  let fe1 ←
    SharedAFieldElement51.Insts.CoreOpsArithSubSharedBFieldElement51FieldElement51.sub
      ZZ2 YY_minus_XX
  ok { X := fe, Y := YY_plus_XX, Z := YY_minus_XX, T := fe1 }

/-- [curve25519_dalek::backend::serial::u64::field::{impl core::ops::arith::Mul<&'b curve25519_dalek::backend::serial::u64::field::FieldElement51, curve25519_dalek::backend::serial::u64::field::FieldElement51> for &'a curve25519_dalek::backend::serial::u64::field::FieldElement51}::mul::LOW_51_BIT_MASK]
    Source: 'curve25519-dalek/src/backend/serial/u64/field.rs', lines 172:8-172:54 -/
@[global_simps, irreducible]
def
  backend.serial.u64.field.MulSharedAFieldElement51SharedBFieldElement51FieldElement51.mul.LOW_51_BIT_MASK
  : Result Std.U64 := do
  let i ← 1#u64 <<< 51#i32
  i - 1#u64

/-- [curve25519_dalek::backend::serial::u64::field::{impl core::ops::arith::Mul<&'b curve25519_dalek::backend::serial::u64::field::FieldElement51, curve25519_dalek::backend::serial::u64::field::FieldElement51> for &'a curve25519_dalek::backend::serial::u64::field::FieldElement51}::mul::m]:
    Source: 'curve25519-dalek/src/backend/serial/u64/field.rs', lines 119:8-119:66 -/
def
  backend.serial.u64.field.MulSharedAFieldElement51SharedBFieldElement51FieldElement51.mul.m
  (x : Std.U64) (y : Std.U64) : Result Std.U128 := do
  let i ← lift (UScalar.cast .U128 x)
  let i1 ← lift (UScalar.cast .U128 y)
  i * i1

/-- [curve25519_dalek::backend::serial::u64::field::{impl core::ops::arith::Mul<&'b curve25519_dalek::backend::serial::u64::field::FieldElement51, curve25519_dalek::backend::serial::u64::field::FieldElement51> for &'a curve25519_dalek::backend::serial::u64::field::FieldElement51}::mul]:
    Source: 'curve25519-dalek/src/backend/serial/u64/field.rs', lines 115:4-213:5
    Visibility: public -/
def
  SharedAFieldElement51.Insts.CoreOpsArithMulSharedBFieldElement51FieldElement51.mul
  (self : backend.serial.u64.field.FieldElement51)
  (_rhs : backend.serial.u64.field.FieldElement51) :
  Result backend.serial.u64.field.FieldElement51
  := do
  let i ← Array.index_usize _rhs 1#usize
  let b1_19 ← i * 19#u64
  let i1 ← Array.index_usize _rhs 2#usize
  let b2_19 ← i1 * 19#u64
  let i2 ← Array.index_usize _rhs 3#usize
  let b3_19 ← i2 * 19#u64
  let i3 ← Array.index_usize _rhs 4#usize
  let b4_19 ← i3 * 19#u64
  let i4 ← Array.index_usize self 0#usize
  let i5 ← Array.index_usize _rhs 0#usize
  let i6 ←
    backend.serial.u64.field.MulSharedAFieldElement51SharedBFieldElement51FieldElement51.mul.m
      i4 i5
  let i7 ← Array.index_usize self 4#usize
  let i8 ←
    backend.serial.u64.field.MulSharedAFieldElement51SharedBFieldElement51FieldElement51.mul.m
      i7 b1_19
  let i9 ← i6 + i8
  let i10 ← Array.index_usize self 3#usize
  let i11 ←
    backend.serial.u64.field.MulSharedAFieldElement51SharedBFieldElement51FieldElement51.mul.m
      i10 b2_19
  let i12 ← i9 + i11
  let i13 ← Array.index_usize self 2#usize
  let i14 ←
    backend.serial.u64.field.MulSharedAFieldElement51SharedBFieldElement51FieldElement51.mul.m
      i13 b3_19
  let i15 ← i12 + i14
  let i16 ← Array.index_usize self 1#usize
  let i17 ←
    backend.serial.u64.field.MulSharedAFieldElement51SharedBFieldElement51FieldElement51.mul.m
      i16 b4_19
  let c0 ← i15 + i17
  let i18 ←
    backend.serial.u64.field.MulSharedAFieldElement51SharedBFieldElement51FieldElement51.mul.m
      i16 i5
  let i19 ←
    backend.serial.u64.field.MulSharedAFieldElement51SharedBFieldElement51FieldElement51.mul.m
      i4 i
  let i20 ← i18 + i19
  let i21 ←
    backend.serial.u64.field.MulSharedAFieldElement51SharedBFieldElement51FieldElement51.mul.m
      i7 b2_19
  let i22 ← i20 + i21
  let i23 ←
    backend.serial.u64.field.MulSharedAFieldElement51SharedBFieldElement51FieldElement51.mul.m
      i10 b3_19
  let i24 ← i22 + i23
  let i25 ←
    backend.serial.u64.field.MulSharedAFieldElement51SharedBFieldElement51FieldElement51.mul.m
      i13 b4_19
  let c1 ← i24 + i25
  let i26 ←
    backend.serial.u64.field.MulSharedAFieldElement51SharedBFieldElement51FieldElement51.mul.m
      i13 i5
  let i27 ←
    backend.serial.u64.field.MulSharedAFieldElement51SharedBFieldElement51FieldElement51.mul.m
      i16 i
  let i28 ← i26 + i27
  let i29 ←
    backend.serial.u64.field.MulSharedAFieldElement51SharedBFieldElement51FieldElement51.mul.m
      i4 i1
  let i30 ← i28 + i29
  let i31 ←
    backend.serial.u64.field.MulSharedAFieldElement51SharedBFieldElement51FieldElement51.mul.m
      i7 b3_19
  let i32 ← i30 + i31
  let i33 ←
    backend.serial.u64.field.MulSharedAFieldElement51SharedBFieldElement51FieldElement51.mul.m
      i10 b4_19
  let c2 ← i32 + i33
  let i34 ←
    backend.serial.u64.field.MulSharedAFieldElement51SharedBFieldElement51FieldElement51.mul.m
      i10 i5
  let i35 ←
    backend.serial.u64.field.MulSharedAFieldElement51SharedBFieldElement51FieldElement51.mul.m
      i13 i
  let i36 ← i34 + i35
  let i37 ←
    backend.serial.u64.field.MulSharedAFieldElement51SharedBFieldElement51FieldElement51.mul.m
      i16 i1
  let i38 ← i36 + i37
  let i39 ←
    backend.serial.u64.field.MulSharedAFieldElement51SharedBFieldElement51FieldElement51.mul.m
      i4 i2
  let i40 ← i38 + i39
  let i41 ←
    backend.serial.u64.field.MulSharedAFieldElement51SharedBFieldElement51FieldElement51.mul.m
      i7 b4_19
  let c3 ← i40 + i41
  let i42 ←
    backend.serial.u64.field.MulSharedAFieldElement51SharedBFieldElement51FieldElement51.mul.m
      i7 i5
  let i43 ←
    backend.serial.u64.field.MulSharedAFieldElement51SharedBFieldElement51FieldElement51.mul.m
      i10 i
  let i44 ← i42 + i43
  let i45 ←
    backend.serial.u64.field.MulSharedAFieldElement51SharedBFieldElement51FieldElement51.mul.m
      i13 i1
  let i46 ← i44 + i45
  let i47 ←
    backend.serial.u64.field.MulSharedAFieldElement51SharedBFieldElement51FieldElement51.mul.m
      i16 i2
  let i48 ← i46 + i47
  let i49 ←
    backend.serial.u64.field.MulSharedAFieldElement51SharedBFieldElement51FieldElement51.mul.m
      i4 i3
  let c4 ← i48 + i49
  let i50 ← 1#u64 <<< 54#i32
  massert (i4 < i50)
  massert (i5 < i50)
  massert (i16 < i50)
  massert (i < i50)
  massert (i13 < i50)
  massert (i1 < i50)
  massert (i10 < i50)
  massert (i2 < i50)
  massert (i7 < i50)
  massert (i3 < i50)
  let out := Array.repeat 5#usize 0#u64
  let i51 ← c0 >>> 51#i32
  let i52 ← lift (UScalar.cast .U64 i51)
  let i53 ← lift (UScalar.cast .U128 i52)
  let c11 ← c1 + i53
  let i54 ← lift (UScalar.cast .U64 c0)
  let i55 ←
    backend.serial.u64.field.MulSharedAFieldElement51SharedBFieldElement51FieldElement51.mul.LOW_51_BIT_MASK
  let i56 ← lift (i54 &&& i55)
  let out1 ← Array.update out 0#usize i56
  let i57 ← c11 >>> 51#i32
  let i58 ← lift (UScalar.cast .U64 i57)
  let i59 ← lift (UScalar.cast .U128 i58)
  let c21 ← c2 + i59
  let i60 ← lift (UScalar.cast .U64 c11)
  let i61 ← lift (i60 &&& i55)
  let out2 ← Array.update out1 1#usize i61
  let i62 ← c21 >>> 51#i32
  let i63 ← lift (UScalar.cast .U64 i62)
  let i64 ← lift (UScalar.cast .U128 i63)
  let c31 ← c3 + i64
  let i65 ← lift (UScalar.cast .U64 c21)
  let i66 ← lift (i65 &&& i55)
  let out3 ← Array.update out2 2#usize i66
  let i67 ← c31 >>> 51#i32
  let i68 ← lift (UScalar.cast .U64 i67)
  let i69 ← lift (UScalar.cast .U128 i68)
  let c41 ← c4 + i69
  let i70 ← lift (UScalar.cast .U64 c31)
  let i71 ← lift (i70 &&& i55)
  let out4 ← Array.update out3 3#usize i71
  let i72 ← c41 >>> 51#i32
  let carry ← lift (UScalar.cast .U64 i72)
  let i73 ← lift (UScalar.cast .U64 c41)
  let i74 ← lift (i73 &&& i55)
  let out5 ← Array.update out4 4#usize i74
  let i75 ← carry * 19#u64
  let i76 ← Array.index_usize out5 0#usize
  let i77 ← i76 + i75
  let out6 ← Array.update out5 0#usize i77
  let i78 ← Array.index_usize out6 0#usize
  let i79 ← i78 >>> 51#i32
  let i80 ← Array.index_usize out6 1#usize
  let i81 ← i80 + i79
  let out7 ← Array.update out6 1#usize i81
  let i82 ← Array.index_usize out7 0#usize
  let i83 ← lift (i82 &&& i55)
  let out8 ← Array.update out7 0#usize i83
  ok out8

/-- [curve25519_dalek::backend::serial::curve_models::{curve25519_dalek::backend::serial::curve_models::CompletedPoint}::as_extended]:
    Source: 'curve25519-dalek/src/backend/serial/curve_models/mod.rs', lines 365:4-372:5
    Visibility: public -/
def backend.serial.curve_models.CompletedPoint.as_extended
  (self : backend.serial.curve_models.CompletedPoint) :
  Result edwards.EdwardsPoint
  := do
  let fe ←
    SharedAFieldElement51.Insts.CoreOpsArithMulSharedBFieldElement51FieldElement51.mul
      self.X self.T
  let fe1 ←
    SharedAFieldElement51.Insts.CoreOpsArithMulSharedBFieldElement51FieldElement51.mul
      self.Y self.Z
  let fe2 ←
    SharedAFieldElement51.Insts.CoreOpsArithMulSharedBFieldElement51FieldElement51.mul
      self.Z self.T
  let fe3 ←
    SharedAFieldElement51.Insts.CoreOpsArithMulSharedBFieldElement51FieldElement51.mul
      self.X self.Y
  ok { X := fe, Y := fe1, Z := fe2, T := fe3 }

/-- [curve25519_dalek::edwards::{curve25519_dalek::edwards::EdwardsPoint}::double]:
    Source: 'curve25519-dalek/src/edwards.rs', lines 621:4-623:5 -/
def edwards.EdwardsPoint.double
  (self : edwards.EdwardsPoint) : Result edwards.EdwardsPoint := do
  let pp ← edwards.EdwardsPoint.as_projective self
  let cp ← backend.serial.curve_models.ProjectivePoint.double pp
  backend.serial.curve_models.CompletedPoint.as_extended cp

/-- [curve25519_dalek::backend::serial::u64::field::{curve25519_dalek::backend::serial::u64::field::FieldElement51}::from_limbs]:
    Source: 'curve25519-dalek/src/backend/serial/u64/field.rs', lines 258:4-260:5 -/
def backend.serial.u64.field.FieldElement51.from_limbs
  (limbs : Array Std.U64 5#usize) :
  Result backend.serial.u64.field.FieldElement51
  := do
  ok limbs

/-- [curve25519_dalek::backend::serial::u64::constants::EDWARDS_D2]
    Source: 'curve25519-dalek/src/backend/serial/u64/constants.rs', lines 44:0-50:3 -/
@[global_simps, irreducible]
def backend.serial.u64.constants.EDWARDS_D2
  : Result backend.serial.u64.field.FieldElement51 :=
  backend.serial.u64.field.FieldElement51.from_limbs
    (Array.make 5#usize [
      1859910466990425#u64, 932731440258426#u64, 1072319116312658#u64,
      1815898335770999#u64, 633789495995903#u64
      ])

/-- [curve25519_dalek::edwards::{curve25519_dalek::edwards::EdwardsPoint}::as_projective_niels]:
    Source: 'curve25519-dalek/src/edwards.rs', lines 514:4-521:5 -/
def edwards.EdwardsPoint.as_projective_niels
  (self : edwards.EdwardsPoint) :
  Result backend.serial.curve_models.ProjectiveNielsPoint
  := do
  let fe ←
    SharedAFieldElement51.Insts.CoreOpsArithAddSharedBFieldElement51FieldElement51.add
      self.Y self.X
  let fe1 ←
    SharedAFieldElement51.Insts.CoreOpsArithSubSharedBFieldElement51FieldElement51.sub
      self.Y self.X
  let fe2 ← backend.serial.u64.constants.EDWARDS_D2
  let fe3 ←
    SharedAFieldElement51.Insts.CoreOpsArithMulSharedBFieldElement51FieldElement51.mul
      self.T fe2
  ok { Y_plus_X := fe, Y_minus_X := fe1, Z := self.Z, T2d := fe3 }

/-- [curve25519_dalek::backend::serial::curve_models::{impl core::ops::arith::Add<&'b curve25519_dalek::backend::serial::curve_models::ProjectiveNielsPoint, curve25519_dalek::backend::serial::curve_models::CompletedPoint> for &'a curve25519_dalek::edwards::EdwardsPoint}::add]:
    Source: 'curve25519-dalek/src/backend/serial/curve_models/mod.rs', lines 414:4-429:5
    Visibility: public -/
def
  SharedAEdwardsPoint.Insts.CoreOpsArithAddSharedBProjectiveNielsPointCompletedPoint.add
  (self : edwards.EdwardsPoint)
  (other : backend.serial.curve_models.ProjectiveNielsPoint) :
  Result backend.serial.curve_models.CompletedPoint
  := do
  let Y_plus_X ←
    SharedAFieldElement51.Insts.CoreOpsArithAddSharedBFieldElement51FieldElement51.add
      self.Y self.X
  let Y_minus_X ←
    SharedAFieldElement51.Insts.CoreOpsArithSubSharedBFieldElement51FieldElement51.sub
      self.Y self.X
  let PP ←
    SharedAFieldElement51.Insts.CoreOpsArithMulSharedBFieldElement51FieldElement51.mul
      Y_plus_X other.Y_plus_X
  let MM ←
    SharedAFieldElement51.Insts.CoreOpsArithMulSharedBFieldElement51FieldElement51.mul
      Y_minus_X other.Y_minus_X
  let TT2d ←
    SharedAFieldElement51.Insts.CoreOpsArithMulSharedBFieldElement51FieldElement51.mul
      self.T other.T2d
  let ZZ ←
    SharedAFieldElement51.Insts.CoreOpsArithMulSharedBFieldElement51FieldElement51.mul
      self.Z other.Z
  let ZZ2 ←
    SharedAFieldElement51.Insts.CoreOpsArithAddSharedBFieldElement51FieldElement51.add
      ZZ ZZ
  let fe ←
    SharedAFieldElement51.Insts.CoreOpsArithSubSharedBFieldElement51FieldElement51.sub
      PP MM
  let fe1 ←
    SharedAFieldElement51.Insts.CoreOpsArithAddSharedBFieldElement51FieldElement51.add
      PP MM
  let fe2 ←
    SharedAFieldElement51.Insts.CoreOpsArithAddSharedBFieldElement51FieldElement51.add
      ZZ2 TT2d
  let fe3 ←
    SharedAFieldElement51.Insts.CoreOpsArithSubSharedBFieldElement51FieldElement51.sub
      ZZ2 TT2d
  ok { X := fe, Y := fe1, Z := fe2, T := fe3 }

/-- [curve25519_dalek::window::{impl core::convert::From<&'a curve25519_dalek::edwards::EdwardsPoint> for curve25519_dalek::window::NafLookupTable5<curve25519_dalek::backend::serial::curve_models::ProjectiveNielsPoint>}::from]: loop body 0:
    Source: 'curve25519-dalek/src/window.rs', lines 205:8-207:9
    Visibility: public -/
@[rust_loop_body]
def
  window.NafLookupTable5ProjectiveNielsPoint.Insts.CoreConvertFromSharedAEdwardsPoint.from_loop.body
  (A2 : edwards.EdwardsPoint) (iter : core.ops.range.Range Std.Usize)
  (Ai : Array backend.serial.curve_models.ProjectiveNielsPoint 8#usize) :
  Result (ControlFlow ((core.ops.range.Range Std.Usize) × (Array
    backend.serial.curve_models.ProjectiveNielsPoint 8#usize)) (Array
    backend.serial.curve_models.ProjectiveNielsPoint 8#usize))
  := do
  let (o, iter1) ←
    core.iter.range.IteratorRange.next core.iter.range.StepUsize iter
  match o with
  | none => ok (done Ai)
  | some i =>
    let pnp ← Array.index_usize Ai i
    let cp ←
      SharedAEdwardsPoint.Insts.CoreOpsArithAddSharedBProjectiveNielsPointCompletedPoint.add
        A2 pnp
    let ep ← backend.serial.curve_models.CompletedPoint.as_extended cp
    let pnp1 ← edwards.EdwardsPoint.as_projective_niels ep
    let i1 ← i + 1#usize
    let a ← Array.update Ai i1 pnp1
    ok (cont (iter1, a))

/-- [curve25519_dalek::window::{impl core::convert::From<&'a curve25519_dalek::edwards::EdwardsPoint> for curve25519_dalek::window::NafLookupTable5<curve25519_dalek::backend::serial::curve_models::ProjectiveNielsPoint>}::from]: loop 0:
    Source: 'curve25519-dalek/src/window.rs', lines 205:8-207:9
    Visibility: public -/
@[rust_loop]
def
  window.NafLookupTable5ProjectiveNielsPoint.Insts.CoreConvertFromSharedAEdwardsPoint.from_loop
  (iter : core.ops.range.Range Std.Usize)
  (Ai : Array backend.serial.curve_models.ProjectiveNielsPoint 8#usize)
  (A2 : edwards.EdwardsPoint) :
  Result (Array backend.serial.curve_models.ProjectiveNielsPoint 8#usize)
  := do
  loop
    (fun (iter1, Ai1) =>
      window.NafLookupTable5ProjectiveNielsPoint.Insts.CoreConvertFromSharedAEdwardsPoint.from_loop.body
      A2 iter1 Ai1)
    (iter, Ai)

/-- [curve25519_dalek::window::{impl core::convert::From<&'a curve25519_dalek::edwards::EdwardsPoint> for curve25519_dalek::window::NafLookupTable5<curve25519_dalek::backend::serial::curve_models::ProjectiveNielsPoint>}::from]:
    Source: 'curve25519-dalek/src/window.rs', lines 202:4-210:5
    Visibility: public -/
def
  window.NafLookupTable5ProjectiveNielsPoint.Insts.CoreConvertFromSharedAEdwardsPoint.from
  (A : edwards.EdwardsPoint) :
  Result (window.NafLookupTable5
    backend.serial.curve_models.ProjectiveNielsPoint)
  := do
  let pnp ← edwards.EdwardsPoint.as_projective_niels A
  let Ai := Array.repeat 8#usize pnp
  let A2 ← edwards.EdwardsPoint.double A
  let Ai1 ←
    window.NafLookupTable5ProjectiveNielsPoint.Insts.CoreConvertFromSharedAEdwardsPoint.from_loop
      { start := 0#usize, «end» := 7#usize } Ai A2
  ok Ai1

/-- [curve25519_dalek::scalar::{curve25519_dalek::scalar::Scalar}::non_adjacent_form]: loop body 1:
    Source: 'curve25519-dalek/src/scalar.rs', lines 944:12-947:13 -/
@[rust_loop_body]
def scalar.Scalar.non_adjacent_form_loop0_loop0.body
  (self : scalar.Scalar) (k : Std.Usize) (t : Std.U64) (bi : Std.Usize) :
  Result (ControlFlow (Std.U64 × Std.Usize) (scalar.Scalar × Std.U64))
  := do
  if bi < 8#usize
  then
    let i ← 8#usize * k
    let i1 ← i + bi
    let i2 ← Array.index_usize self.bytes i1
    let i3 ← lift (UScalar.cast .U64 i2)
    let i4 ← 8#usize * bi
    let i5 ← i3 <<< i4
    let t1 ← lift (t ||| i5)
    let bi1 ← bi + 1#usize
    ok (cont (t1, bi1))
  else ok (done (self, t))

/-- [curve25519_dalek::scalar::{curve25519_dalek::scalar::Scalar}::non_adjacent_form]: loop 1:
    Source: 'curve25519-dalek/src/scalar.rs', lines 944:12-947:13 -/
@[rust_loop]
def scalar.Scalar.non_adjacent_form_loop0_loop0
  (self : scalar.Scalar) (k : Std.Usize) (t : Std.U64) (bi : Std.Usize) :
  Result (scalar.Scalar × Std.U64)
  := do
  loop
    (fun (t1, bi1) => scalar.Scalar.non_adjacent_form_loop0_loop0.body self k
      t1 bi1)
    (t, bi)

/-- [curve25519_dalek::scalar::{curve25519_dalek::scalar::Scalar}::non_adjacent_form]: loop body 0:
    Source: 'curve25519-dalek/src/scalar.rs', lines 941:8-950:9 -/
@[rust_loop_body]
def scalar.Scalar.non_adjacent_form_loop0.body
  (self : scalar.Scalar) (x_u64 : Array Std.U64 5#usize) (k : Std.Usize) :
  Result (ControlFlow (scalar.Scalar × (Array Std.U64 5#usize) × Std.Usize)
    (Array Std.U64 5#usize))
  := do
  if k < 4#usize
  then
    let (self1, t) ←
      scalar.Scalar.non_adjacent_form_loop0_loop0 self k 0#u64 0#usize
    let a ← Array.update x_u64 k t
    let k1 ← k + 1#usize
    ok (cont (self1, a, k1))
  else ok (done x_u64)

/-- [curve25519_dalek::scalar::{curve25519_dalek::scalar::Scalar}::non_adjacent_form]: loop 0:
    Source: 'curve25519-dalek/src/scalar.rs', lines 941:8-950:9 -/
@[rust_loop]
def scalar.Scalar.non_adjacent_form_loop0
  (self : scalar.Scalar) (x_u64 : Array Std.U64 5#usize) (k : Std.Usize) :
  Result (Array Std.U64 5#usize)
  := do
  loop
    (fun (self1, x_u641, k1) => scalar.Scalar.non_adjacent_form_loop0.body
      self1 x_u641 k1)
    (self, x_u64, k)

/-- [curve25519_dalek::scalar::{curve25519_dalek::scalar::Scalar}::non_adjacent_form]: loop body 2:
    Source: 'curve25519-dalek/src/scalar.rs', lines 957:8-990:9 -/
@[rust_loop_body]
def scalar.Scalar.non_adjacent_form_loop1.body
  (w : Std.Usize) (x_u64 : Array Std.U64 5#usize) (width : Std.U64)
  (window_mask : Std.U64) (naf : Array Std.I8 256#usize) (pos : Std.Usize)
  (carry : Std.U64) :
  Result (ControlFlow ((Array Std.I8 256#usize) × Std.Usize × Std.U64) (Array
    Std.I8 256#usize))
  := do
  if pos < 256#usize
  then
    let u64_idx ← pos / 64#usize
    let bit_idx ← pos % 64#usize
    let i ← 64#usize - w
    let bit_buf ←
      if bit_idx < i
      then do
           let i1 ← Array.index_usize x_u64 u64_idx
           i1 >>> bit_idx
      else
        do
        let i1 ← Array.index_usize x_u64 u64_idx
        let i2 ← i1 >>> bit_idx
        let i3 ← 1#usize + u64_idx
        let i4 ← Array.index_usize x_u64 i3
        let i5 ← 64#usize - bit_idx
        let i6 ← i4 <<< i5
        ok (i2 ||| i6)
    let i1 ← lift (bit_buf &&& window_mask)
    let window ← carry + i1
    let i2 ← lift (window &&& 1#u64)
    if i2 = 0#u64
    then let pos1 ← pos + 1#usize
         ok (cont (naf, pos1, carry))
    else
      let i3 ← width / 2#u64
      let (naf1, carry1) ←
        if window < i3
        then
          do
          let i4 ← lift (UScalar.hcast .I8 window)
          let a ← Array.update naf pos i4
          ok (a, 0#u64)
        else
          do
          let i4 ← lift (UScalar.hcast .I8 window)
          let i5 ← lift (UScalar.hcast .I8 width)
          let i6 ← lift (core.num.I8.wrapping_sub i4 i5)
          let a ← Array.update naf pos i6
          ok (a, 1#u64)
      let pos1 ← pos + w
      ok (cont (naf1, pos1, carry1))
  else ok (done naf)

/-- [curve25519_dalek::scalar::{curve25519_dalek::scalar::Scalar}::non_adjacent_form]: loop 2:
    Source: 'curve25519-dalek/src/scalar.rs', lines 957:8-990:9 -/
@[rust_loop]
def scalar.Scalar.non_adjacent_form_loop1
  (w : Std.Usize) (naf : Array Std.I8 256#usize)
  (x_u64 : Array Std.U64 5#usize) (width : Std.U64) (window_mask : Std.U64)
  (pos : Std.Usize) (carry : Std.U64) :
  Result (Array Std.I8 256#usize)
  := do
  loop
    (fun (naf1, pos1, carry1) => scalar.Scalar.non_adjacent_form_loop1.body w
      x_u64 width window_mask naf1 pos1 carry1)
    (naf, pos, carry)

/-- [curve25519_dalek::scalar::{curve25519_dalek::scalar::Scalar}::non_adjacent_form]:
    Source: 'curve25519-dalek/src/scalar.rs', lines 928:4-993:5 -/
def scalar.Scalar.non_adjacent_form
  (self : scalar.Scalar) (w : Std.Usize) :
  Result (Array Std.I8 256#usize)
  := do
  massert (w >= 2#usize)
  massert (w <= 8#usize)
  let naf := Array.repeat 256#usize 0#i8
  let x_u64 := Array.repeat 5#usize 0#u64
  let x_u641 ← scalar.Scalar.non_adjacent_form_loop0 self x_u64 0#usize
  let width ← 1#u64 <<< w
  let window_mask ← width - 1#u64
  scalar.Scalar.non_adjacent_form_loop1 w naf x_u641 width window_mask 0#usize
    0#u64

/-- [curve25519_dalek::backend::serial::u64::constants::ED25519_BASEPOINT_POINT]
    Source: 'curve25519-dalek/src/backend/serial/u64/constants.rs', lines 151:0-174:2
    Visibility: public -/
@[global_simps, irreducible]
def backend.serial.u64.constants.ED25519_BASEPOINT_POINT
  : Result edwards.EdwardsPoint := do
  let fe ←
    backend.serial.u64.field.FieldElement51.from_limbs
      (Array.make 5#usize [
        1738742601995546#u64, 1146398526822698#u64, 2070867633025821#u64,
        562264141797630#u64, 587772402128613#u64
        ])
  let fe1 ←
    backend.serial.u64.field.FieldElement51.from_limbs
      (Array.make 5#usize [
        1801439850948184#u64, 1351079888211148#u64, 450359962737049#u64,
        900719925474099#u64, 1801439850948198#u64
        ])
  let fe2 ←
    backend.serial.u64.field.FieldElement51.from_limbs
      (Array.make 5#usize [ 1#u64, 0#u64, 0#u64, 0#u64, 0#u64 ])
  let fe3 ←
    backend.serial.u64.field.FieldElement51.from_limbs
      (Array.make 5#usize [
        1841354044333475#u64, 16398895984059#u64, 755974180946558#u64,
        900171276175154#u64, 1821297809914039#u64
        ])
  ok { X := fe, Y := fe1, Z := fe2, T := fe3 }

/-- [curve25519_dalek::window::{curve25519_dalek::window::NafLookupTable5<T>}::select]:
    Source: 'curve25519-dalek/src/window.rs', lines 187:4-192:5
    Visibility: public -/
def window.NafLookupTable5.select
  {T : Type} (coremarkerCopyInst : core.marker.Copy T)
  (self : window.NafLookupTable5 T) (x : Std.Usize) :
  Result T
  := do
  let left_val ← lift (x &&& 1#usize)
  massert (left_val = 1#usize)
  massert (x < 16#usize)
  let i ← x / 2#usize
  Array.index_usize self i

/-- [curve25519_dalek::backend::serial::curve_models::{impl core::ops::arith::Sub<&'b curve25519_dalek::backend::serial::curve_models::ProjectiveNielsPoint, curve25519_dalek::backend::serial::curve_models::CompletedPoint> for &'a curve25519_dalek::edwards::EdwardsPoint}::sub]:
    Source: 'curve25519-dalek/src/backend/serial/curve_models/mod.rs', lines 436:4-451:5
    Visibility: public -/
def
  SharedAEdwardsPoint.Insts.CoreOpsArithSubSharedBProjectiveNielsPointCompletedPoint.sub
  (self : edwards.EdwardsPoint)
  (other : backend.serial.curve_models.ProjectiveNielsPoint) :
  Result backend.serial.curve_models.CompletedPoint
  := do
  let Y_plus_X ←
    SharedAFieldElement51.Insts.CoreOpsArithAddSharedBFieldElement51FieldElement51.add
      self.Y self.X
  let Y_minus_X ←
    SharedAFieldElement51.Insts.CoreOpsArithSubSharedBFieldElement51FieldElement51.sub
      self.Y self.X
  let PM ←
    SharedAFieldElement51.Insts.CoreOpsArithMulSharedBFieldElement51FieldElement51.mul
      Y_plus_X other.Y_minus_X
  let MP ←
    SharedAFieldElement51.Insts.CoreOpsArithMulSharedBFieldElement51FieldElement51.mul
      Y_minus_X other.Y_plus_X
  let TT2d ←
    SharedAFieldElement51.Insts.CoreOpsArithMulSharedBFieldElement51FieldElement51.mul
      self.T other.T2d
  let ZZ ←
    SharedAFieldElement51.Insts.CoreOpsArithMulSharedBFieldElement51FieldElement51.mul
      self.Z other.Z
  let ZZ2 ←
    SharedAFieldElement51.Insts.CoreOpsArithAddSharedBFieldElement51FieldElement51.add
      ZZ ZZ
  let fe ←
    SharedAFieldElement51.Insts.CoreOpsArithSubSharedBFieldElement51FieldElement51.sub
      PM MP
  let fe1 ←
    SharedAFieldElement51.Insts.CoreOpsArithAddSharedBFieldElement51FieldElement51.add
      PM MP
  let fe2 ←
    SharedAFieldElement51.Insts.CoreOpsArithSubSharedBFieldElement51FieldElement51.sub
      ZZ2 TT2d
  let fe3 ←
    SharedAFieldElement51.Insts.CoreOpsArithAddSharedBFieldElement51FieldElement51.add
      ZZ2 TT2d
  ok { X := fe, Y := fe1, Z := fe2, T := fe3 }

/-- [curve25519_dalek::backend::serial::curve_models::{impl core::clone::Clone for curve25519_dalek::backend::serial::curve_models::ProjectiveNielsPoint}::clone]:
    Source: 'curve25519-dalek/src/backend/serial/curve_models/mod.rs', lines 204:15-204:20
    Visibility: public -/
def backend.serial.curve_models.ProjectiveNielsPoint.Insts.CoreCloneClone.clone
  (self : backend.serial.curve_models.ProjectiveNielsPoint) :
  Result backend.serial.curve_models.ProjectiveNielsPoint
  := do
  ok self

/-- Trait implementation: [curve25519_dalek::backend::serial::curve_models::{impl core::clone::Clone for curve25519_dalek::backend::serial::curve_models::ProjectiveNielsPoint}]
    Source: 'curve25519-dalek/src/backend/serial/curve_models/mod.rs', lines 204:15-204:20 -/
@[reducible]
def backend.serial.curve_models.ProjectiveNielsPoint.Insts.CoreCloneClone :
  core.clone.Clone backend.serial.curve_models.ProjectiveNielsPoint := {
  clone :=
    backend.serial.curve_models.ProjectiveNielsPoint.Insts.CoreCloneClone.clone
}

/-- Trait implementation: [curve25519_dalek::backend::serial::curve_models::{impl core::marker::Copy for curve25519_dalek::backend::serial::curve_models::ProjectiveNielsPoint}]
    Source: 'curve25519-dalek/src/backend/serial/curve_models/mod.rs', lines 204:9-204:13 -/
@[reducible]
def backend.serial.curve_models.ProjectiveNielsPoint.Insts.CoreMarkerCopy :
  core.marker.Copy backend.serial.curve_models.ProjectiveNielsPoint := {
  cloneInst :=
    backend.serial.curve_models.ProjectiveNielsPoint.Insts.CoreCloneClone
}

/-- [curve25519_dalek::backend::serial::scalar_mul::vartime_double_base::dsm_step_p]:
    Source: 'curve25519-dalek/src/backend/serial/scalar_mul/vartime_double_base.rs', lines 86:0-98:1 -/
def backend.serial.scalar_mul.vartime_double_base.dsm_step_p
  (t : backend.serial.curve_models.CompletedPoint)
  (table : window.NafLookupTable5
  backend.serial.curve_models.ProjectiveNielsPoint) (d : Std.I8) :
  Result backend.serial.curve_models.CompletedPoint
  := do
  if d > 0#i8
  then
    let ep ← backend.serial.curve_models.CompletedPoint.as_extended t
    let i ← lift (IScalar.hcast .Usize d)
    let pnp ←
      window.NafLookupTable5.select
        backend.serial.curve_models.ProjectiveNielsPoint.Insts.CoreMarkerCopy
        table i
    SharedAEdwardsPoint.Insts.CoreOpsArithAddSharedBProjectiveNielsPointCompletedPoint.add
      ep pnp
  else
    if d < 0#i8
    then
      let ep ← backend.serial.curve_models.CompletedPoint.as_extended t
      let i ← -. d
      let i1 ← lift (IScalar.hcast .Usize i)
      let pnp ←
        window.NafLookupTable5.select
          backend.serial.curve_models.ProjectiveNielsPoint.Insts.CoreMarkerCopy
          table i1
      SharedAEdwardsPoint.Insts.CoreOpsArithSubSharedBProjectiveNielsPointCompletedPoint.sub
        ep pnp
    else ok t

/-- [curve25519_dalek::backend::serial::scalar_mul::vartime_double_base::dsm_step_b]:
    Source: 'curve25519-dalek/src/backend/serial/scalar_mul/vartime_double_base.rs', lines 118:0-124:1 -/
def backend.serial.scalar_mul.vartime_double_base.dsm_step_b
  (t : backend.serial.curve_models.CompletedPoint)
  (table : window.NafLookupTable5
  backend.serial.curve_models.ProjectiveNielsPoint) (d : Std.I8) :
  Result backend.serial.curve_models.CompletedPoint
  := do
  backend.serial.scalar_mul.vartime_double_base.dsm_step_p t table d

/-- [curve25519_dalek::backend::serial::curve_models::{curve25519_dalek::backend::serial::curve_models::CompletedPoint}::as_projective]:
    Source: 'curve25519-dalek/src/backend/serial/curve_models/mod.rs', lines 353:4-359:5
    Visibility: public -/
def backend.serial.curve_models.CompletedPoint.as_projective
  (self : backend.serial.curve_models.CompletedPoint) :
  Result backend.serial.curve_models.ProjectivePoint
  := do
  let fe ←
    SharedAFieldElement51.Insts.CoreOpsArithMulSharedBFieldElement51FieldElement51.mul
      self.X self.T
  let fe1 ←
    SharedAFieldElement51.Insts.CoreOpsArithMulSharedBFieldElement51FieldElement51.mul
      self.Y self.Z
  let fe2 ←
    SharedAFieldElement51.Insts.CoreOpsArithMulSharedBFieldElement51FieldElement51.mul
      self.Z self.T
  ok { X := fe, Y := fe1, Z := fe2 }

/-- [curve25519_dalek::backend::serial::u64::field::{curve25519_dalek::backend::serial::u64::field::FieldElement51}::ONE]
    Source: 'curve25519-dalek/src/backend/serial/u64/field.rs', lines 265:4-265:80
    Visibility: public -/
@[global_simps, irreducible]
def backend.serial.u64.field.FieldElement51.ONE
  : Result backend.serial.u64.field.FieldElement51 :=
  backend.serial.u64.field.FieldElement51.from_limbs
    (Array.make 5#usize [ 1#u64, 0#u64, 0#u64, 0#u64, 0#u64 ])

/-- [curve25519_dalek::backend::serial::u64::field::{curve25519_dalek::backend::serial::u64::field::FieldElement51}::ZERO]
    Source: 'curve25519-dalek/src/backend/serial/u64/field.rs', lines 263:4-263:81
    Visibility: public -/
@[global_simps, irreducible]
def backend.serial.u64.field.FieldElement51.ZERO
  : Result backend.serial.u64.field.FieldElement51 :=
  let a := Array.repeat 5#usize 0#u64
  backend.serial.u64.field.FieldElement51.from_limbs a

/-- [curve25519_dalek::backend::serial::curve_models::{impl curve25519_dalek::traits::Identity for curve25519_dalek::backend::serial::curve_models::ProjectivePoint}::identity]:
    Source: 'curve25519-dalek/src/backend/serial/curve_models/mod.rs', lines 230:4-236:5
    Visibility: public -/
def
  backend.serial.curve_models.ProjectivePoint.Insts.Curve25519_dalekTraitsIdentity.identity
  : Result backend.serial.curve_models.ProjectivePoint := do
  let fe ← backend.serial.u64.field.FieldElement51.ZERO
  let fe1 ← backend.serial.u64.field.FieldElement51.ONE
  ok { X := fe, Y := fe1, Z := fe1 }

/-- [curve25519_dalek::backend::serial::scalar_mul::vartime_double_base::dsm_loop]: loop body 0:
    Source: 'curve25519-dalek/src/backend/serial/scalar_mul/vartime_double_base.rs', lines 72:4-79:5 -/
@[rust_loop_body]
def backend.serial.scalar_mul.vartime_double_base.dsm_loop_loop.body
  (a_naf : Array Std.I8 256#usize) (b_naf : Array Std.I8 256#usize)
  (table_a : window.NafLookupTable5
  backend.serial.curve_models.ProjectiveNielsPoint)
  (table_b : window.NafLookupTable5
  backend.serial.curve_models.ProjectiveNielsPoint)
  (r : backend.serial.curve_models.ProjectivePoint) (j : Std.Usize) :
  Result (ControlFlow (backend.serial.curve_models.ProjectivePoint ×
    Std.Usize) backend.serial.curve_models.ProjectivePoint)
  := do
  if j > 0#usize
  then
    let idx ← j - 1#usize
    let t0 ← backend.serial.curve_models.ProjectivePoint.double r
    let i ← Array.index_usize a_naf idx
    let t1 ←
      backend.serial.scalar_mul.vartime_double_base.dsm_step_p t0 table_a i
    let i1 ← Array.index_usize b_naf idx
    let t2 ←
      backend.serial.scalar_mul.vartime_double_base.dsm_step_b t1 table_b i1
    let r1 ← backend.serial.curve_models.CompletedPoint.as_projective t2
    ok (cont (r1, idx))
  else ok (done r)

/-- [curve25519_dalek::backend::serial::scalar_mul::vartime_double_base::dsm_loop]: loop 0:
    Source: 'curve25519-dalek/src/backend/serial/scalar_mul/vartime_double_base.rs', lines 72:4-79:5 -/
@[rust_loop]
def backend.serial.scalar_mul.vartime_double_base.dsm_loop_loop
  (a_naf : Array Std.I8 256#usize) (b_naf : Array Std.I8 256#usize)
  (table_a : window.NafLookupTable5
  backend.serial.curve_models.ProjectiveNielsPoint)
  (table_b : window.NafLookupTable5
  backend.serial.curve_models.ProjectiveNielsPoint)
  (r : backend.serial.curve_models.ProjectivePoint) (j : Std.Usize) :
  Result backend.serial.curve_models.ProjectivePoint
  := do
  loop
    (fun (r1, j1) =>
      backend.serial.scalar_mul.vartime_double_base.dsm_loop_loop.body a_naf
      b_naf table_a table_b r1 j1)
    (r, j)

/-- [curve25519_dalek::backend::serial::scalar_mul::vartime_double_base::dsm_loop]:
    Source: 'curve25519-dalek/src/backend/serial/scalar_mul/vartime_double_base.rs', lines 63:0-81:1 -/
def backend.serial.scalar_mul.vartime_double_base.dsm_loop
  (i : Std.Usize) (a_naf : Array Std.I8 256#usize)
  (b_naf : Array Std.I8 256#usize)
  (table_a : window.NafLookupTable5
  backend.serial.curve_models.ProjectiveNielsPoint)
  (table_b : window.NafLookupTable5
  backend.serial.curve_models.ProjectiveNielsPoint) :
  Result backend.serial.curve_models.ProjectivePoint
  := do
  let r ←
    backend.serial.curve_models.ProjectivePoint.Insts.Curve25519_dalekTraitsIdentity.identity
  let j ← i + 1#usize
  backend.serial.scalar_mul.vartime_double_base.dsm_loop_loop a_naf b_naf
    table_a table_b r j

/-- [curve25519_dalek::backend::serial::scalar_mul::vartime_double_base::dsm_top_index]:
    Source: 'curve25519-dalek/src/backend/serial/scalar_mul/vartime_double_base.rs', lines 29:0-37:1 -/
def backend.serial.scalar_mul.vartime_double_base.dsm_top_index
  (a_naf : Array Std.I8 256#usize) (b_naf : Array Std.I8 256#usize) :
  Result Std.Usize
  := do
  ok 255#usize

/-- [curve25519_dalek::backend::serial::curve_models::{curve25519_dalek::backend::serial::curve_models::ProjectivePoint}::as_extended]:
    Source: 'curve25519-dalek/src/backend/serial/curve_models/mod.rs', lines 338:4-345:5
    Visibility: public -/
def backend.serial.curve_models.ProjectivePoint.as_extended
  (self : backend.serial.curve_models.ProjectivePoint) :
  Result edwards.EdwardsPoint
  := do
  let fe ←
    SharedAFieldElement51.Insts.CoreOpsArithMulSharedBFieldElement51FieldElement51.mul
      self.X self.Z
  let fe1 ←
    SharedAFieldElement51.Insts.CoreOpsArithMulSharedBFieldElement51FieldElement51.mul
      self.Y self.Z
  let fe2 ← backend.serial.u64.field.FieldElement51.square self.Z
  let fe3 ←
    SharedAFieldElement51.Insts.CoreOpsArithMulSharedBFieldElement51FieldElement51.mul
      self.X self.Y
  ok { X := fe, Y := fe1, Z := fe2, T := fe3 }

/-- [curve25519_dalek::backend::serial::scalar_mul::vartime_double_base::mul]:
    Source: 'curve25519-dalek/src/backend/serial/scalar_mul/vartime_double_base.rs', lines 126:0-147:1
    Visibility: public -/
def backend.serial.scalar_mul.vartime_double_base.mul
  (a : scalar.Scalar) (A : edwards.EdwardsPoint) (b : scalar.Scalar) :
  Result edwards.EdwardsPoint
  := do
  let a_naf ← scalar.Scalar.non_adjacent_form a 5#usize
  let b_naf ← scalar.Scalar.non_adjacent_form b 5#usize
  let i ←
    backend.serial.scalar_mul.vartime_double_base.dsm_top_index a_naf b_naf
  let table_A ←
    window.NafLookupTable5ProjectiveNielsPoint.Insts.CoreConvertFromSharedAEdwardsPoint.from
      A
  let ep ← backend.serial.u64.constants.ED25519_BASEPOINT_POINT
  let table_B ←
    window.NafLookupTable5ProjectiveNielsPoint.Insts.CoreConvertFromSharedAEdwardsPoint.from
      ep
  let r ←
    backend.serial.scalar_mul.vartime_double_base.dsm_loop i a_naf b_naf
      table_A table_B
  backend.serial.curve_models.ProjectivePoint.as_extended r

/-- [curve25519_dalek::backend::vartime_double_base_mul]:
    Source: 'curve25519-dalek/src/backend/mod.rs', lines 241:0-251:1
    Visibility: public -/
def backend.vartime_double_base_mul
  (a : scalar.Scalar) (A : edwards.EdwardsPoint) (b : scalar.Scalar) :
  Result edwards.EdwardsPoint
  := do
  let _ ← backend.get_selected_backend
  backend.serial.scalar_mul.vartime_double_base.mul a A b

/-- [curve25519_dalek::backend::serial::curve_models::{impl core::clone::Clone for curve25519_dalek::backend::serial::curve_models::ProjectivePoint}::clone]:
    Source: 'curve25519-dalek/src/backend/serial/curve_models/mod.rs', lines 153:15-153:20
    Visibility: public -/
def backend.serial.curve_models.ProjectivePoint.Insts.CoreCloneClone.clone
  (self : backend.serial.curve_models.ProjectivePoint) :
  Result backend.serial.curve_models.ProjectivePoint
  := do
  ok self

/-- Trait implementation: [curve25519_dalek::backend::serial::curve_models::{impl core::clone::Clone for curve25519_dalek::backend::serial::curve_models::ProjectivePoint}]
    Source: 'curve25519-dalek/src/backend/serial/curve_models/mod.rs', lines 153:15-153:20 -/
@[reducible]
def backend.serial.curve_models.ProjectivePoint.Insts.CoreCloneClone :
  core.clone.Clone backend.serial.curve_models.ProjectivePoint := {
  clone :=
    backend.serial.curve_models.ProjectivePoint.Insts.CoreCloneClone.clone
}

/-- Trait implementation: [curve25519_dalek::backend::serial::curve_models::{impl core::marker::Copy for curve25519_dalek::backend::serial::curve_models::ProjectivePoint}]
    Source: 'curve25519-dalek/src/backend/serial/curve_models/mod.rs', lines 153:9-153:13 -/
@[reducible]
def backend.serial.curve_models.ProjectivePoint.Insts.CoreMarkerCopy :
  core.marker.Copy backend.serial.curve_models.ProjectivePoint := {
  cloneInst := backend.serial.curve_models.ProjectivePoint.Insts.CoreCloneClone
}

/-- [curve25519_dalek::backend::serial::curve_models::{impl core::clone::Clone for curve25519_dalek::backend::serial::curve_models::CompletedPoint}::clone]:
    Source: 'curve25519-dalek/src/backend/serial/curve_models/mod.rs', lines 167:15-167:20
    Visibility: public -/
def backend.serial.curve_models.CompletedPoint.Insts.CoreCloneClone.clone
  (self : backend.serial.curve_models.CompletedPoint) :
  Result backend.serial.curve_models.CompletedPoint
  := do
  ok self

/-- Trait implementation: [curve25519_dalek::backend::serial::curve_models::{impl core::clone::Clone for curve25519_dalek::backend::serial::curve_models::CompletedPoint}]
    Source: 'curve25519-dalek/src/backend/serial/curve_models/mod.rs', lines 167:15-167:20 -/
@[reducible]
def backend.serial.curve_models.CompletedPoint.Insts.CoreCloneClone :
  core.clone.Clone backend.serial.curve_models.CompletedPoint := {
  clone :=
    backend.serial.curve_models.CompletedPoint.Insts.CoreCloneClone.clone
}

/-- Trait implementation: [curve25519_dalek::backend::serial::curve_models::{impl core::marker::Copy for curve25519_dalek::backend::serial::curve_models::CompletedPoint}]
    Source: 'curve25519-dalek/src/backend/serial/curve_models/mod.rs', lines 167:9-167:13 -/
@[reducible]
def backend.serial.curve_models.CompletedPoint.Insts.CoreMarkerCopy :
  core.marker.Copy backend.serial.curve_models.CompletedPoint := {
  cloneInst := backend.serial.curve_models.CompletedPoint.Insts.CoreCloneClone
}

/-- [curve25519_dalek::backend::serial::curve_models::{impl core::clone::Clone for curve25519_dalek::backend::serial::curve_models::AffineNielsPoint}::clone]:
    Source: 'curve25519-dalek/src/backend/serial/curve_models/mod.rs', lines 182:15-182:20
    Visibility: public -/
def backend.serial.curve_models.AffineNielsPoint.Insts.CoreCloneClone.clone
  (self : backend.serial.curve_models.AffineNielsPoint) :
  Result backend.serial.curve_models.AffineNielsPoint
  := do
  ok self

/-- Trait implementation: [curve25519_dalek::backend::serial::curve_models::{impl core::clone::Clone for curve25519_dalek::backend::serial::curve_models::AffineNielsPoint}]
    Source: 'curve25519-dalek/src/backend/serial/curve_models/mod.rs', lines 182:15-182:20 -/
@[reducible]
def backend.serial.curve_models.AffineNielsPoint.Insts.CoreCloneClone :
  core.clone.Clone backend.serial.curve_models.AffineNielsPoint := {
  clone :=
    backend.serial.curve_models.AffineNielsPoint.Insts.CoreCloneClone.clone
}

/-- Trait implementation: [curve25519_dalek::backend::serial::curve_models::{impl core::marker::Copy for curve25519_dalek::backend::serial::curve_models::AffineNielsPoint}]
    Source: 'curve25519-dalek/src/backend/serial/curve_models/mod.rs', lines 182:9-182:13 -/
@[reducible]
def backend.serial.curve_models.AffineNielsPoint.Insts.CoreMarkerCopy :
  core.marker.Copy backend.serial.curve_models.AffineNielsPoint := {
  cloneInst :=
    backend.serial.curve_models.AffineNielsPoint.Insts.CoreCloneClone
}

/-- [curve25519_dalek::backend::serial::u64::field::{curve25519_dalek::backend::serial::u64::field::FieldElement51}::as_bytes]:
    Source: 'curve25519-dalek/src/backend/serial/u64/field.rs', lines 368:4-450:5
    Visibility: public -/
def backend.serial.u64.field.FieldElement51.as_bytes
  (self : backend.serial.u64.field.FieldElement51) :
  Result (Array Std.U8 32#usize)
  := do
  let fe ← backend.serial.u64.field.FieldElement51.reduce self
  let i ← Array.index_usize fe 0#usize
  let i1 ← i + 19#u64
  let q ← i1 >>> 51#i32
  let i2 ← Array.index_usize fe 1#usize
  let i3 ← i2 + q
  let q1 ← i3 >>> 51#i32
  let i4 ← Array.index_usize fe 2#usize
  let i5 ← i4 + q1
  let q2 ← i5 >>> 51#i32
  let i6 ← Array.index_usize fe 3#usize
  let i7 ← i6 + q2
  let q3 ← i7 >>> 51#i32
  let i8 ← Array.index_usize fe 4#usize
  let i9 ← i8 + q3
  let q4 ← i9 >>> 51#i32
  let i10 ← 19#u64 * q4
  let i11 ← i + i10
  let limbs ← Array.update fe 0#usize i11
  let i12 ← 1#u64 <<< 51#i32
  let low_51_bit_mask ← i12 - 1#u64
  let i13 ← Array.index_usize limbs 0#usize
  let i14 ← i13 >>> 51#i32
  let i15 ← Array.index_usize limbs 1#usize
  let i16 ← i15 + i14
  let limbs1 ← Array.update limbs 1#usize i16
  let i17 ← Array.index_usize limbs1 0#usize
  let i18 ← lift (i17 &&& low_51_bit_mask)
  let limbs2 ← Array.update limbs1 0#usize i18
  let i19 ← Array.index_usize limbs2 1#usize
  let i20 ← i19 >>> 51#i32
  let i21 ← Array.index_usize limbs2 2#usize
  let i22 ← i21 + i20
  let limbs3 ← Array.update limbs2 2#usize i22
  let i23 ← Array.index_usize limbs3 1#usize
  let i24 ← lift (i23 &&& low_51_bit_mask)
  let limbs4 ← Array.update limbs3 1#usize i24
  let i25 ← Array.index_usize limbs4 2#usize
  let i26 ← i25 >>> 51#i32
  let i27 ← Array.index_usize limbs4 3#usize
  let i28 ← i27 + i26
  let limbs5 ← Array.update limbs4 3#usize i28
  let i29 ← Array.index_usize limbs5 2#usize
  let i30 ← lift (i29 &&& low_51_bit_mask)
  let limbs6 ← Array.update limbs5 2#usize i30
  let i31 ← Array.index_usize limbs6 3#usize
  let i32 ← i31 >>> 51#i32
  let i33 ← Array.index_usize limbs6 4#usize
  let i34 ← i33 + i32
  let limbs7 ← Array.update limbs6 4#usize i34
  let i35 ← Array.index_usize limbs7 3#usize
  let i36 ← lift (i35 &&& low_51_bit_mask)
  let limbs8 ← Array.update limbs7 3#usize i36
  let i37 ← Array.index_usize limbs8 4#usize
  let i38 ← lift (i37 &&& low_51_bit_mask)
  let limbs9 ← Array.update limbs8 4#usize i38
  let s := Array.repeat 32#usize 0#u8
  let i39 ← Array.index_usize limbs9 0#usize
  let i40 ← lift (UScalar.cast .U8 i39)
  let s1 ← Array.update s 0#usize i40
  let i41 ← i39 >>> 8#i32
  let i42 ← lift (UScalar.cast .U8 i41)
  let s2 ← Array.update s1 1#usize i42
  let i43 ← i39 >>> 16#i32
  let i44 ← lift (UScalar.cast .U8 i43)
  let s3 ← Array.update s2 2#usize i44
  let i45 ← i39 >>> 24#i32
  let i46 ← lift (UScalar.cast .U8 i45)
  let s4 ← Array.update s3 3#usize i46
  let i47 ← i39 >>> 32#i32
  let i48 ← lift (UScalar.cast .U8 i47)
  let s5 ← Array.update s4 4#usize i48
  let i49 ← i39 >>> 40#i32
  let i50 ← lift (UScalar.cast .U8 i49)
  let s6 ← Array.update s5 5#usize i50
  let i51 ← i39 >>> 48#i32
  let i52 ← Array.index_usize limbs9 1#usize
  let i53 ← i52 <<< 3#i32
  let i54 ← lift (i51 ||| i53)
  let i55 ← lift (UScalar.cast .U8 i54)
  let s7 ← Array.update s6 6#usize i55
  let i56 ← i52 >>> 5#i32
  let i57 ← lift (UScalar.cast .U8 i56)
  let s8 ← Array.update s7 7#usize i57
  let i58 ← i52 >>> 13#i32
  let i59 ← lift (UScalar.cast .U8 i58)
  let s9 ← Array.update s8 8#usize i59
  let i60 ← i52 >>> 21#i32
  let i61 ← lift (UScalar.cast .U8 i60)
  let s10 ← Array.update s9 9#usize i61
  let i62 ← i52 >>> 29#i32
  let i63 ← lift (UScalar.cast .U8 i62)
  let s11 ← Array.update s10 10#usize i63
  let i64 ← i52 >>> 37#i32
  let i65 ← lift (UScalar.cast .U8 i64)
  let s12 ← Array.update s11 11#usize i65
  let i66 ← i52 >>> 45#i32
  let i67 ← Array.index_usize limbs9 2#usize
  let i68 ← i67 <<< 6#i32
  let i69 ← lift (i66 ||| i68)
  let i70 ← lift (UScalar.cast .U8 i69)
  let s13 ← Array.update s12 12#usize i70
  let i71 ← i67 >>> 2#i32
  let i72 ← lift (UScalar.cast .U8 i71)
  let s14 ← Array.update s13 13#usize i72
  let i73 ← i67 >>> 10#i32
  let i74 ← lift (UScalar.cast .U8 i73)
  let s15 ← Array.update s14 14#usize i74
  let i75 ← i67 >>> 18#i32
  let i76 ← lift (UScalar.cast .U8 i75)
  let s16 ← Array.update s15 15#usize i76
  let i77 ← i67 >>> 26#i32
  let i78 ← lift (UScalar.cast .U8 i77)
  let s17 ← Array.update s16 16#usize i78
  let i79 ← i67 >>> 34#i32
  let i80 ← lift (UScalar.cast .U8 i79)
  let s18 ← Array.update s17 17#usize i80
  let i81 ← i67 >>> 42#i32
  let i82 ← lift (UScalar.cast .U8 i81)
  let s19 ← Array.update s18 18#usize i82
  let i83 ← i67 >>> 50#i32
  let i84 ← Array.index_usize limbs9 3#usize
  let i85 ← i84 <<< 1#i32
  let i86 ← lift (i83 ||| i85)
  let i87 ← lift (UScalar.cast .U8 i86)
  let s20 ← Array.update s19 19#usize i87
  let i88 ← i84 >>> 7#i32
  let i89 ← lift (UScalar.cast .U8 i88)
  let s21 ← Array.update s20 20#usize i89
  let i90 ← i84 >>> 15#i32
  let i91 ← lift (UScalar.cast .U8 i90)
  let s22 ← Array.update s21 21#usize i91
  let i92 ← i84 >>> 23#i32
  let i93 ← lift (UScalar.cast .U8 i92)
  let s23 ← Array.update s22 22#usize i93
  let i94 ← i84 >>> 31#i32
  let i95 ← lift (UScalar.cast .U8 i94)
  let s24 ← Array.update s23 23#usize i95
  let i96 ← i84 >>> 39#i32
  let i97 ← lift (UScalar.cast .U8 i96)
  let s25 ← Array.update s24 24#usize i97
  let i98 ← i84 >>> 47#i32
  let i99 ← Array.index_usize limbs9 4#usize
  let i100 ← i99 <<< 4#i32
  let i101 ← lift (i98 ||| i100)
  let i102 ← lift (UScalar.cast .U8 i101)
  let s26 ← Array.update s25 25#usize i102
  let i103 ← i99 >>> 4#i32
  let i104 ← lift (UScalar.cast .U8 i103)
  let s27 ← Array.update s26 26#usize i104
  let i105 ← i99 >>> 12#i32
  let i106 ← lift (UScalar.cast .U8 i105)
  let s28 ← Array.update s27 27#usize i106
  let i107 ← i99 >>> 20#i32
  let i108 ← lift (UScalar.cast .U8 i107)
  let s29 ← Array.update s28 28#usize i108
  let i109 ← i99 >>> 28#i32
  let i110 ← lift (UScalar.cast .U8 i109)
  let s30 ← Array.update s29 29#usize i110
  let i111 ← i99 >>> 36#i32
  let i112 ← lift (UScalar.cast .U8 i111)
  let s31 ← Array.update s30 30#usize i112
  let i113 ← i99 >>> 44#i32
  let i114 ← lift (UScalar.cast .U8 i113)
  let s32 ← Array.update s31 31#usize i114
  let i115 ← Array.index_usize s32 31#usize
  let i116 ← lift (i115 &&& 128#u8)
  massert (i116 = 0#u8)
  ok s32

/-- [curve25519_dalek::field::{impl subtle::ConstantTimeEq for curve25519_dalek::backend::serial::u64::field::FieldElement51}::ct_eq]:
    Source: 'curve25519-dalek/src/field.rs', lines 96:4-98:5
    Visibility: public -/
def backend.serial.u64.field.FieldElement51.Insts.SubtleConstantTimeEq.ct_eq
  (self : backend.serial.u64.field.FieldElement51)
  (other : backend.serial.u64.field.FieldElement51) :
  Result subtle.Choice
  := do
  let a ← backend.serial.u64.field.FieldElement51.as_bytes self
  let s ← lift (Array.to_slice a)
  let a1 ← backend.serial.u64.field.FieldElement51.as_bytes other
  let s1 ← lift (Array.to_slice a1)
  Slice.Insts.SubtleConstantTimeEq.ct_eq U8.Insts.SubtleConstantTimeEq s s1

/-- [curve25519_dalek::field::{impl core::cmp::PartialEq<curve25519_dalek::backend::serial::u64::field::FieldElement51> for curve25519_dalek::backend::serial::u64::field::FieldElement51}::eq]:
    Source: 'curve25519-dalek/src/field.rs', lines 87:4-89:5
    Visibility: public -/
def
  backend.serial.u64.field.FieldElement51.Insts.CoreCmpPartialEqFieldElement51.eq
  (self : backend.serial.u64.field.FieldElement51)
  (other : backend.serial.u64.field.FieldElement51) :
  Result Bool
  := do
  let c ←
    backend.serial.u64.field.FieldElement51.Insts.SubtleConstantTimeEq.ct_eq
      self other
  core.convert.IntoFrom.into Bool.Insts.CoreConvertFromChoice c

/-- [curve25519_dalek::backend::serial::curve_models::{impl core::cmp::PartialEq<curve25519_dalek::backend::serial::curve_models::AffineNielsPoint> for curve25519_dalek::backend::serial::curve_models::AffineNielsPoint}::eq]:
    Source: 'curve25519-dalek/src/backend/serial/curve_models/mod.rs', lines 182:26-182:35
    Visibility: public -/
def
  backend.serial.curve_models.AffineNielsPoint.Insts.CoreCmpPartialEqAffineNielsPoint.eq
  (self : backend.serial.curve_models.AffineNielsPoint)
  (other : backend.serial.curve_models.AffineNielsPoint) :
  Result Bool
  := do
  let b ←
    backend.serial.u64.field.FieldElement51.Insts.CoreCmpPartialEqFieldElement51.eq
      self.y_plus_x other.y_plus_x
  if b
  then
    let b1 ←
      backend.serial.u64.field.FieldElement51.Insts.CoreCmpPartialEqFieldElement51.eq
        self.y_minus_x other.y_minus_x
    if b1
    then
      backend.serial.u64.field.FieldElement51.Insts.CoreCmpPartialEqFieldElement51.eq
        self.xy2d other.xy2d
    else ok false
  else ok false

/-- Trait implementation: [curve25519_dalek::backend::serial::curve_models::{impl core::cmp::PartialEq<curve25519_dalek::backend::serial::curve_models::AffineNielsPoint> for curve25519_dalek::backend::serial::curve_models::AffineNielsPoint}]
    Source: 'curve25519-dalek/src/backend/serial/curve_models/mod.rs', lines 182:26-182:35 -/
@[reducible]
def
  backend.serial.curve_models.AffineNielsPoint.Insts.CoreCmpPartialEqAffineNielsPoint
  : core.cmp.PartialEq backend.serial.curve_models.AffineNielsPoint
  backend.serial.curve_models.AffineNielsPoint := {
  eq :=
    backend.serial.curve_models.AffineNielsPoint.Insts.CoreCmpPartialEqAffineNielsPoint.eq
}

/-- [curve25519_dalek::backend::serial::curve_models::{impl core::cmp::Eq for curve25519_dalek::backend::serial::curve_models::AffineNielsPoint}::assert_fields_are_eq]:
    Source: 'curve25519-dalek/src/backend/serial/curve_models/mod.rs', lines 182:22-182:24
    Visibility: public -/
def
  backend.serial.curve_models.AffineNielsPoint.Insts.CoreCmpEq.assert_fields_are_eq
  (self : backend.serial.curve_models.AffineNielsPoint) : Result Unit := do
  ok ()

/-- Trait implementation: [curve25519_dalek::backend::serial::curve_models::{impl core::cmp::Eq for curve25519_dalek::backend::serial::curve_models::AffineNielsPoint}]
    Source: 'curve25519-dalek/src/backend/serial/curve_models/mod.rs', lines 182:22-182:24 -/
@[reducible]
def backend.serial.curve_models.AffineNielsPoint.Insts.CoreCmpEq : core.cmp.Eq
  backend.serial.curve_models.AffineNielsPoint := {
  partialEqInst :=
    backend.serial.curve_models.AffineNielsPoint.Insts.CoreCmpPartialEqAffineNielsPoint
  assert_fields_are_eq :=
    backend.serial.curve_models.AffineNielsPoint.Insts.CoreCmpEq.assert_fields_are_eq
}

/-- Trait implementation: [curve25519_dalek::backend::serial::curve_models::{impl core::marker::StructuralPartialEq for curve25519_dalek::backend::serial::curve_models::AffineNielsPoint}]
    Source: 'curve25519-dalek/src/backend/serial/curve_models/mod.rs', lines 182:26-182:35 -/
@[reducible]
def
  backend.serial.curve_models.AffineNielsPoint.Insts.CoreMarkerStructuralPartialEq
  : core.marker.StructuralPartialEq
  backend.serial.curve_models.AffineNielsPoint := {
}

/-- Trait implementation: [curve25519_dalek::backend::serial::curve_models::{impl curve25519_dalek::traits::Identity for curve25519_dalek::backend::serial::curve_models::ProjectivePoint}]
    Source: 'curve25519-dalek/src/backend/serial/curve_models/mod.rs', lines 229:0-237:1 -/
@[reducible]
def
  backend.serial.curve_models.ProjectivePoint.Insts.Curve25519_dalekTraitsIdentity
  : traits.Identity backend.serial.curve_models.ProjectivePoint := {
  identity :=
    backend.serial.curve_models.ProjectivePoint.Insts.Curve25519_dalekTraitsIdentity.identity
}

/-- [curve25519_dalek::backend::serial::curve_models::{impl curve25519_dalek::traits::Identity for curve25519_dalek::backend::serial::curve_models::ProjectiveNielsPoint}::identity]:
    Source: 'curve25519-dalek/src/backend/serial/curve_models/mod.rs', lines 240:4-247:5
    Visibility: public -/
def
  backend.serial.curve_models.ProjectiveNielsPoint.Insts.Curve25519_dalekTraitsIdentity.identity
  : Result backend.serial.curve_models.ProjectiveNielsPoint := do
  let fe ← backend.serial.u64.field.FieldElement51.ONE
  let fe1 ← backend.serial.u64.field.FieldElement51.ZERO
  ok { Y_plus_X := fe, Y_minus_X := fe, Z := fe, T2d := fe1 }

/-- Trait implementation: [curve25519_dalek::backend::serial::curve_models::{impl curve25519_dalek::traits::Identity for curve25519_dalek::backend::serial::curve_models::ProjectiveNielsPoint}]
    Source: 'curve25519-dalek/src/backend/serial/curve_models/mod.rs', lines 239:0-248:1 -/
@[reducible]
def
  backend.serial.curve_models.ProjectiveNielsPoint.Insts.Curve25519_dalekTraitsIdentity
  : traits.Identity backend.serial.curve_models.ProjectiveNielsPoint := {
  identity :=
    backend.serial.curve_models.ProjectiveNielsPoint.Insts.Curve25519_dalekTraitsIdentity.identity
}

/-- [curve25519_dalek::backend::serial::curve_models::{impl core::default::Default for curve25519_dalek::backend::serial::curve_models::ProjectiveNielsPoint}::default]:
    Source: 'curve25519-dalek/src/backend/serial/curve_models/mod.rs', lines 251:4-253:5
    Visibility: public -/
def
  backend.serial.curve_models.ProjectiveNielsPoint.Insts.CoreDefaultDefault.default
  : Result backend.serial.curve_models.ProjectiveNielsPoint := do
  backend.serial.curve_models.ProjectiveNielsPoint.Insts.Curve25519_dalekTraitsIdentity.identity

/-- Trait implementation: [curve25519_dalek::backend::serial::curve_models::{impl core::default::Default for curve25519_dalek::backend::serial::curve_models::ProjectiveNielsPoint}]
    Source: 'curve25519-dalek/src/backend/serial/curve_models/mod.rs', lines 250:0-254:1 -/
@[reducible]
def backend.serial.curve_models.ProjectiveNielsPoint.Insts.CoreDefaultDefault :
  core.default.Default backend.serial.curve_models.ProjectiveNielsPoint := {
  default :=
    backend.serial.curve_models.ProjectiveNielsPoint.Insts.CoreDefaultDefault.default
}

/-- [curve25519_dalek::backend::serial::curve_models::{impl curve25519_dalek::traits::Identity for curve25519_dalek::backend::serial::curve_models::AffineNielsPoint}::identity]:
    Source: 'curve25519-dalek/src/backend/serial/curve_models/mod.rs', lines 257:4-263:5
    Visibility: public -/
def
  backend.serial.curve_models.AffineNielsPoint.Insts.Curve25519_dalekTraitsIdentity.identity
  : Result backend.serial.curve_models.AffineNielsPoint := do
  let fe ← backend.serial.u64.field.FieldElement51.ONE
  let fe1 ← backend.serial.u64.field.FieldElement51.ZERO
  ok { y_plus_x := fe, y_minus_x := fe, xy2d := fe1 }

/-- Trait implementation: [curve25519_dalek::backend::serial::curve_models::{impl curve25519_dalek::traits::Identity for curve25519_dalek::backend::serial::curve_models::AffineNielsPoint}]
    Source: 'curve25519-dalek/src/backend/serial/curve_models/mod.rs', lines 256:0-264:1 -/
@[reducible]
def
  backend.serial.curve_models.AffineNielsPoint.Insts.Curve25519_dalekTraitsIdentity
  : traits.Identity backend.serial.curve_models.AffineNielsPoint := {
  identity :=
    backend.serial.curve_models.AffineNielsPoint.Insts.Curve25519_dalekTraitsIdentity.identity
}

/-- [curve25519_dalek::backend::serial::curve_models::{impl core::default::Default for curve25519_dalek::backend::serial::curve_models::AffineNielsPoint}::default]:
    Source: 'curve25519-dalek/src/backend/serial/curve_models/mod.rs', lines 267:4-269:5
    Visibility: public -/
def
  backend.serial.curve_models.AffineNielsPoint.Insts.CoreDefaultDefault.default
  : Result backend.serial.curve_models.AffineNielsPoint := do
  backend.serial.curve_models.AffineNielsPoint.Insts.Curve25519_dalekTraitsIdentity.identity

/-- Trait implementation: [curve25519_dalek::backend::serial::curve_models::{impl core::default::Default for curve25519_dalek::backend::serial::curve_models::AffineNielsPoint}]
    Source: 'curve25519-dalek/src/backend/serial/curve_models/mod.rs', lines 266:0-270:1 -/
@[reducible]
def backend.serial.curve_models.AffineNielsPoint.Insts.CoreDefaultDefault :
  core.default.Default backend.serial.curve_models.AffineNielsPoint := {
  default :=
    backend.serial.curve_models.AffineNielsPoint.Insts.CoreDefaultDefault.default
}

/-- [curve25519_dalek::backend::serial::u64::constants::EDWARDS_D]
    Source: 'curve25519-dalek/src/backend/serial/u64/constants.rs', lines 35:0-41:3 -/
@[global_simps, irreducible]
def backend.serial.u64.constants.EDWARDS_D
  : Result backend.serial.u64.field.FieldElement51 :=
  backend.serial.u64.field.FieldElement51.from_limbs
    (Array.make 5#usize [
      929955233495203#u64, 466365720129213#u64, 1662059464998953#u64,
      2033849074728123#u64, 1442794654840575#u64
      ])

/-- [curve25519_dalek::backend::serial::curve_models::{impl curve25519_dalek::traits::ValidityCheck for curve25519_dalek::backend::serial::curve_models::ProjectivePoint}::is_valid]:
    Source: 'curve25519-dalek/src/backend/serial/curve_models/mod.rs', lines 277:4-288:5 -/
def
  backend.serial.curve_models.ProjectivePoint.Insts.Curve25519_dalekTraitsValidityCheck.is_valid
  (self : backend.serial.curve_models.ProjectivePoint) : Result Bool := do
  let XX ← backend.serial.u64.field.FieldElement51.square self.X
  let YY ← backend.serial.u64.field.FieldElement51.square self.Y
  let ZZ ← backend.serial.u64.field.FieldElement51.square self.Z
  let ZZZZ ← backend.serial.u64.field.FieldElement51.square ZZ
  let fe ←
    SharedAFieldElement51.Insts.CoreOpsArithSubSharedBFieldElement51FieldElement51.sub
      YY XX
  let lhs ←
    SharedAFieldElement51.Insts.CoreOpsArithMulSharedBFieldElement51FieldElement51.mul
      fe ZZ
  let fe1 ← backend.serial.u64.constants.EDWARDS_D
  let fe2 ←
    SharedAFieldElement51.Insts.CoreOpsArithMulSharedBFieldElement51FieldElement51.mul
      XX YY
  let fe3 ←
    SharedAFieldElement51.Insts.CoreOpsArithMulSharedBFieldElement51FieldElement51.mul
      fe1 fe2
  let rhs ←
    SharedAFieldElement51.Insts.CoreOpsArithAddSharedBFieldElement51FieldElement51.add
      ZZZZ fe3
  backend.serial.u64.field.FieldElement51.Insts.CoreCmpPartialEqFieldElement51.eq
    lhs rhs

/-- Trait implementation: [curve25519_dalek::backend::serial::curve_models::{impl curve25519_dalek::traits::ValidityCheck for curve25519_dalek::backend::serial::curve_models::ProjectivePoint}]
    Source: 'curve25519-dalek/src/backend/serial/curve_models/mod.rs', lines 276:0-289:1 -/
@[reducible]
def
  backend.serial.curve_models.ProjectivePoint.Insts.Curve25519_dalekTraitsValidityCheck
  : traits.ValidityCheck backend.serial.curve_models.ProjectivePoint := {
  is_valid :=
    backend.serial.curve_models.ProjectivePoint.Insts.Curve25519_dalekTraitsValidityCheck.is_valid
}

/-- [curve25519_dalek::backend::serial::u64::field::{impl subtle::ConditionallySelectable for curve25519_dalek::backend::serial::u64::field::FieldElement51}::conditional_assign]:
    Source: 'curve25519-dalek/src/backend/serial/u64/field.rs', lines 248:4-254:5
    Visibility: public -/
def
  backend.serial.u64.field.FieldElement51.Insts.SubtleConditionallySelectable.conditional_assign
  (self : backend.serial.u64.field.FieldElement51)
  (other : backend.serial.u64.field.FieldElement51) (choice : subtle.Choice) :
  Result backend.serial.u64.field.FieldElement51
  := do
  let (i, index_mut_back) ← Array.index_mut_usize self 0#usize
  let i1 ← Array.index_usize other 0#usize
  let i2 ←
    U64.Insts.SubtleConditionallySelectable.conditional_assign i i1 choice
  let a := index_mut_back i2
  let (i3, index_mut_back1) ← Array.index_mut_usize a 1#usize
  let i4 ← Array.index_usize other 1#usize
  let i5 ←
    U64.Insts.SubtleConditionallySelectable.conditional_assign i3 i4 choice
  let a1 := index_mut_back1 i5
  let (i6, index_mut_back2) ← Array.index_mut_usize a1 2#usize
  let i7 ← Array.index_usize other 2#usize
  let i8 ←
    U64.Insts.SubtleConditionallySelectable.conditional_assign i6 i7 choice
  let a2 := index_mut_back2 i8
  let (i9, index_mut_back3) ← Array.index_mut_usize a2 3#usize
  let i10 ← Array.index_usize other 3#usize
  let i11 ←
    U64.Insts.SubtleConditionallySelectable.conditional_assign i9 i10 choice
  let a3 := index_mut_back3 i11
  let (i12, index_mut_back4) ← Array.index_mut_usize a3 4#usize
  let i13 ← Array.index_usize other 4#usize
  let i14 ←
    U64.Insts.SubtleConditionallySelectable.conditional_assign i12 i13 choice
  let a4 := index_mut_back4 i14
  ok a4

/-- [curve25519_dalek::backend::serial::curve_models::{impl subtle::ConditionallySelectable for curve25519_dalek::backend::serial::curve_models::ProjectiveNielsPoint}::conditional_assign]:
    Source: 'curve25519-dalek/src/backend/serial/curve_models/mod.rs', lines 305:4-310:5
    Visibility: public -/
def
  backend.serial.curve_models.ProjectiveNielsPoint.Insts.SubtleConditionallySelectable.conditional_assign
  (self : backend.serial.curve_models.ProjectiveNielsPoint)
  (other : backend.serial.curve_models.ProjectiveNielsPoint)
  (choice : subtle.Choice) :
  Result backend.serial.curve_models.ProjectiveNielsPoint
  := do
  let fe ←
    backend.serial.u64.field.FieldElement51.Insts.SubtleConditionallySelectable.conditional_assign
      self.Y_plus_X other.Y_plus_X choice
  let fe1 ←
    backend.serial.u64.field.FieldElement51.Insts.SubtleConditionallySelectable.conditional_assign
      self.Y_minus_X other.Y_minus_X choice
  let fe2 ←
    backend.serial.u64.field.FieldElement51.Insts.SubtleConditionallySelectable.conditional_assign
      self.Z other.Z choice
  let fe3 ←
    backend.serial.u64.field.FieldElement51.Insts.SubtleConditionallySelectable.conditional_assign
      self.T2d other.T2d choice
  ok { Y_plus_X := fe, Y_minus_X := fe1, Z := fe2, T2d := fe3 }

/-- [curve25519_dalek::backend::serial::u64::field::{impl subtle::ConditionallySelectable for curve25519_dalek::backend::serial::u64::field::FieldElement51}::conditional_select]:
    Source: 'curve25519-dalek/src/backend/serial/u64/field.rs', lines 226:4-238:5
    Visibility: public -/
def
  backend.serial.u64.field.FieldElement51.Insts.SubtleConditionallySelectable.conditional_select
  (a : backend.serial.u64.field.FieldElement51)
  (b : backend.serial.u64.field.FieldElement51) (choice : subtle.Choice) :
  Result backend.serial.u64.field.FieldElement51
  := do
  let i ← Array.index_usize a 0#usize
  let i1 ← Array.index_usize b 0#usize
  let i2 ←
    U64.Insts.SubtleConditionallySelectable.conditional_select i i1 choice
  let i3 ← Array.index_usize a 1#usize
  let i4 ← Array.index_usize b 1#usize
  let i5 ←
    U64.Insts.SubtleConditionallySelectable.conditional_select i3 i4 choice
  let i6 ← Array.index_usize a 2#usize
  let i7 ← Array.index_usize b 2#usize
  let i8 ←
    U64.Insts.SubtleConditionallySelectable.conditional_select i6 i7 choice
  let i9 ← Array.index_usize a 3#usize
  let i10 ← Array.index_usize b 3#usize
  let i11 ←
    U64.Insts.SubtleConditionallySelectable.conditional_select i9 i10 choice
  let i12 ← Array.index_usize a 4#usize
  let i13 ← Array.index_usize b 4#usize
  let i14 ←
    U64.Insts.SubtleConditionallySelectable.conditional_select i12 i13 choice
  ok (Array.make 5#usize [ i2, i5, i8, i11, i14 ])

/-- [curve25519_dalek::backend::serial::curve_models::{impl subtle::ConditionallySelectable for curve25519_dalek::backend::serial::curve_models::ProjectiveNielsPoint}::conditional_select]:
    Source: 'curve25519-dalek/src/backend/serial/curve_models/mod.rs', lines 296:4-303:5
    Visibility: public -/
def
  backend.serial.curve_models.ProjectiveNielsPoint.Insts.SubtleConditionallySelectable.conditional_select
  (a : backend.serial.curve_models.ProjectiveNielsPoint)
  (b : backend.serial.curve_models.ProjectiveNielsPoint)
  (choice : subtle.Choice) :
  Result backend.serial.curve_models.ProjectiveNielsPoint
  := do
  let fe ←
    backend.serial.u64.field.FieldElement51.Insts.SubtleConditionallySelectable.conditional_select
      a.Y_plus_X b.Y_plus_X choice
  let fe1 ←
    backend.serial.u64.field.FieldElement51.Insts.SubtleConditionallySelectable.conditional_select
      a.Y_minus_X b.Y_minus_X choice
  let fe2 ←
    backend.serial.u64.field.FieldElement51.Insts.SubtleConditionallySelectable.conditional_select
      a.Z b.Z choice
  let fe3 ←
    backend.serial.u64.field.FieldElement51.Insts.SubtleConditionallySelectable.conditional_select
      a.T2d b.T2d choice
  ok { Y_plus_X := fe, Y_minus_X := fe1, Z := fe2, T2d := fe3 }

/-- Trait implementation: [curve25519_dalek::backend::serial::curve_models::{impl subtle::ConditionallySelectable for curve25519_dalek::backend::serial::curve_models::ProjectiveNielsPoint}]
    Source: 'curve25519-dalek/src/backend/serial/curve_models/mod.rs', lines 295:0-311:1 -/
@[reducible]
def
  backend.serial.curve_models.ProjectiveNielsPoint.Insts.SubtleConditionallySelectable
  : subtle.ConditionallySelectable
  backend.serial.curve_models.ProjectiveNielsPoint := {
  coremarkerCopyInst :=
    backend.serial.curve_models.ProjectiveNielsPoint.Insts.CoreMarkerCopy
  conditional_select :=
    backend.serial.curve_models.ProjectiveNielsPoint.Insts.SubtleConditionallySelectable.conditional_select
  conditional_assign :=
    backend.serial.curve_models.ProjectiveNielsPoint.Insts.SubtleConditionallySelectable.conditional_assign
  conditional_swap :=
    backend.serial.curve_models.ProjectiveNielsPoint.Insts.SubtleConditionallySelectable.conditional_swap
}

/-- [curve25519_dalek::backend::serial::curve_models::{impl subtle::ConditionallySelectable for curve25519_dalek::backend::serial::curve_models::AffineNielsPoint}::conditional_assign]:
    Source: 'curve25519-dalek/src/backend/serial/curve_models/mod.rs', lines 322:4-326:5
    Visibility: public -/
def
  backend.serial.curve_models.AffineNielsPoint.Insts.SubtleConditionallySelectable.conditional_assign
  (self : backend.serial.curve_models.AffineNielsPoint)
  (other : backend.serial.curve_models.AffineNielsPoint)
  (choice : subtle.Choice) :
  Result backend.serial.curve_models.AffineNielsPoint
  := do
  let fe ←
    backend.serial.u64.field.FieldElement51.Insts.SubtleConditionallySelectable.conditional_assign
      self.y_plus_x other.y_plus_x choice
  let fe1 ←
    backend.serial.u64.field.FieldElement51.Insts.SubtleConditionallySelectable.conditional_assign
      self.y_minus_x other.y_minus_x choice
  let fe2 ←
    backend.serial.u64.field.FieldElement51.Insts.SubtleConditionallySelectable.conditional_assign
      self.xy2d other.xy2d choice
  ok { y_plus_x := fe, y_minus_x := fe1, xy2d := fe2 }

/-- [curve25519_dalek::backend::serial::curve_models::{impl subtle::ConditionallySelectable for curve25519_dalek::backend::serial::curve_models::AffineNielsPoint}::conditional_select]:
    Source: 'curve25519-dalek/src/backend/serial/curve_models/mod.rs', lines 314:4-320:5
    Visibility: public -/
def
  backend.serial.curve_models.AffineNielsPoint.Insts.SubtleConditionallySelectable.conditional_select
  (a : backend.serial.curve_models.AffineNielsPoint)
  (b : backend.serial.curve_models.AffineNielsPoint) (choice : subtle.Choice) :
  Result backend.serial.curve_models.AffineNielsPoint
  := do
  let fe ←
    backend.serial.u64.field.FieldElement51.Insts.SubtleConditionallySelectable.conditional_select
      a.y_plus_x b.y_plus_x choice
  let fe1 ←
    backend.serial.u64.field.FieldElement51.Insts.SubtleConditionallySelectable.conditional_select
      a.y_minus_x b.y_minus_x choice
  let fe2 ←
    backend.serial.u64.field.FieldElement51.Insts.SubtleConditionallySelectable.conditional_select
      a.xy2d b.xy2d choice
  ok { y_plus_x := fe, y_minus_x := fe1, xy2d := fe2 }

/-- Trait implementation: [curve25519_dalek::backend::serial::curve_models::{impl subtle::ConditionallySelectable for curve25519_dalek::backend::serial::curve_models::AffineNielsPoint}]
    Source: 'curve25519-dalek/src/backend/serial/curve_models/mod.rs', lines 313:0-327:1 -/
@[reducible]
def
  backend.serial.curve_models.AffineNielsPoint.Insts.SubtleConditionallySelectable
  : subtle.ConditionallySelectable backend.serial.curve_models.AffineNielsPoint
  := {
  coremarkerCopyInst :=
    backend.serial.curve_models.AffineNielsPoint.Insts.CoreMarkerCopy
  conditional_select :=
    backend.serial.curve_models.AffineNielsPoint.Insts.SubtleConditionallySelectable.conditional_select
  conditional_assign :=
    backend.serial.curve_models.AffineNielsPoint.Insts.SubtleConditionallySelectable.conditional_assign
  conditional_swap :=
    backend.serial.curve_models.AffineNielsPoint.Insts.SubtleConditionallySelectable.conditional_swap
}

/-- Trait implementation: [curve25519_dalek::backend::serial::curve_models::{impl core::ops::arith::Add<&'b curve25519_dalek::backend::serial::curve_models::ProjectiveNielsPoint, curve25519_dalek::backend::serial::curve_models::CompletedPoint> for &'a curve25519_dalek::edwards::EdwardsPoint}]
    Source: 'curve25519-dalek/src/backend/serial/curve_models/mod.rs', lines 411:0-430:1 -/
@[reducible]
def
  SharedAEdwardsPoint.Insts.CoreOpsArithAddSharedBProjectiveNielsPointCompletedPoint
  : core.ops.arith.Add edwards.EdwardsPoint
  backend.serial.curve_models.ProjectiveNielsPoint
  backend.serial.curve_models.CompletedPoint := {
  add :=
    SharedAEdwardsPoint.Insts.CoreOpsArithAddSharedBProjectiveNielsPointCompletedPoint.add
}

/-- Trait implementation: [curve25519_dalek::backend::serial::curve_models::{impl core::ops::arith::Sub<&'b curve25519_dalek::backend::serial::curve_models::ProjectiveNielsPoint, curve25519_dalek::backend::serial::curve_models::CompletedPoint> for &'a curve25519_dalek::edwards::EdwardsPoint}]
    Source: 'curve25519-dalek/src/backend/serial/curve_models/mod.rs', lines 433:0-452:1 -/
@[reducible]
def
  SharedAEdwardsPoint.Insts.CoreOpsArithSubSharedBProjectiveNielsPointCompletedPoint
  : core.ops.arith.Sub edwards.EdwardsPoint
  backend.serial.curve_models.ProjectiveNielsPoint
  backend.serial.curve_models.CompletedPoint := {
  sub :=
    SharedAEdwardsPoint.Insts.CoreOpsArithSubSharedBProjectiveNielsPointCompletedPoint.sub
}

/-- [curve25519_dalek::backend::serial::curve_models::{impl core::ops::arith::Add<&'b curve25519_dalek::backend::serial::curve_models::AffineNielsPoint, curve25519_dalek::backend::serial::curve_models::CompletedPoint> for &'a curve25519_dalek::edwards::EdwardsPoint}::add]:
    Source: 'curve25519-dalek/src/backend/serial/curve_models/mod.rs', lines 458:4-472:5
    Visibility: public -/
def
  SharedAEdwardsPoint.Insts.CoreOpsArithAddSharedBAffineNielsPointCompletedPoint.add
  (self : edwards.EdwardsPoint)
  (other : backend.serial.curve_models.AffineNielsPoint) :
  Result backend.serial.curve_models.CompletedPoint
  := do
  let Y_plus_X ←
    SharedAFieldElement51.Insts.CoreOpsArithAddSharedBFieldElement51FieldElement51.add
      self.Y self.X
  let Y_minus_X ←
    SharedAFieldElement51.Insts.CoreOpsArithSubSharedBFieldElement51FieldElement51.sub
      self.Y self.X
  let PP ←
    SharedAFieldElement51.Insts.CoreOpsArithMulSharedBFieldElement51FieldElement51.mul
      Y_plus_X other.y_plus_x
  let MM ←
    SharedAFieldElement51.Insts.CoreOpsArithMulSharedBFieldElement51FieldElement51.mul
      Y_minus_X other.y_minus_x
  let Txy2d ←
    SharedAFieldElement51.Insts.CoreOpsArithMulSharedBFieldElement51FieldElement51.mul
      self.T other.xy2d
  let Z2 ←
    SharedAFieldElement51.Insts.CoreOpsArithAddSharedBFieldElement51FieldElement51.add
      self.Z self.Z
  let fe ←
    SharedAFieldElement51.Insts.CoreOpsArithSubSharedBFieldElement51FieldElement51.sub
      PP MM
  let fe1 ←
    SharedAFieldElement51.Insts.CoreOpsArithAddSharedBFieldElement51FieldElement51.add
      PP MM
  let fe2 ←
    SharedAFieldElement51.Insts.CoreOpsArithAddSharedBFieldElement51FieldElement51.add
      Z2 Txy2d
  let fe3 ←
    SharedAFieldElement51.Insts.CoreOpsArithSubSharedBFieldElement51FieldElement51.sub
      Z2 Txy2d
  ok { X := fe, Y := fe1, Z := fe2, T := fe3 }

/-- Trait implementation: [curve25519_dalek::backend::serial::curve_models::{impl core::ops::arith::Add<&'b curve25519_dalek::backend::serial::curve_models::AffineNielsPoint, curve25519_dalek::backend::serial::curve_models::CompletedPoint> for &'a curve25519_dalek::edwards::EdwardsPoint}]
    Source: 'curve25519-dalek/src/backend/serial/curve_models/mod.rs', lines 455:0-473:1 -/
@[reducible]
def
  SharedAEdwardsPoint.Insts.CoreOpsArithAddSharedBAffineNielsPointCompletedPoint
  : core.ops.arith.Add edwards.EdwardsPoint
  backend.serial.curve_models.AffineNielsPoint
  backend.serial.curve_models.CompletedPoint := {
  add :=
    SharedAEdwardsPoint.Insts.CoreOpsArithAddSharedBAffineNielsPointCompletedPoint.add
}

/-- [curve25519_dalek::backend::serial::curve_models::{impl core::ops::arith::Sub<&'b curve25519_dalek::backend::serial::curve_models::AffineNielsPoint, curve25519_dalek::backend::serial::curve_models::CompletedPoint> for &'a curve25519_dalek::edwards::EdwardsPoint}::sub]:
    Source: 'curve25519-dalek/src/backend/serial/curve_models/mod.rs', lines 479:4-493:5
    Visibility: public -/
def
  SharedAEdwardsPoint.Insts.CoreOpsArithSubSharedBAffineNielsPointCompletedPoint.sub
  (self : edwards.EdwardsPoint)
  (other : backend.serial.curve_models.AffineNielsPoint) :
  Result backend.serial.curve_models.CompletedPoint
  := do
  let Y_plus_X ←
    SharedAFieldElement51.Insts.CoreOpsArithAddSharedBFieldElement51FieldElement51.add
      self.Y self.X
  let Y_minus_X ←
    SharedAFieldElement51.Insts.CoreOpsArithSubSharedBFieldElement51FieldElement51.sub
      self.Y self.X
  let PM ←
    SharedAFieldElement51.Insts.CoreOpsArithMulSharedBFieldElement51FieldElement51.mul
      Y_plus_X other.y_minus_x
  let MP ←
    SharedAFieldElement51.Insts.CoreOpsArithMulSharedBFieldElement51FieldElement51.mul
      Y_minus_X other.y_plus_x
  let Txy2d ←
    SharedAFieldElement51.Insts.CoreOpsArithMulSharedBFieldElement51FieldElement51.mul
      self.T other.xy2d
  let Z2 ←
    SharedAFieldElement51.Insts.CoreOpsArithAddSharedBFieldElement51FieldElement51.add
      self.Z self.Z
  let fe ←
    SharedAFieldElement51.Insts.CoreOpsArithSubSharedBFieldElement51FieldElement51.sub
      PM MP
  let fe1 ←
    SharedAFieldElement51.Insts.CoreOpsArithAddSharedBFieldElement51FieldElement51.add
      PM MP
  let fe2 ←
    SharedAFieldElement51.Insts.CoreOpsArithSubSharedBFieldElement51FieldElement51.sub
      Z2 Txy2d
  let fe3 ←
    SharedAFieldElement51.Insts.CoreOpsArithAddSharedBFieldElement51FieldElement51.add
      Z2 Txy2d
  ok { X := fe, Y := fe1, Z := fe2, T := fe3 }

/-- Trait implementation: [curve25519_dalek::backend::serial::curve_models::{impl core::ops::arith::Sub<&'b curve25519_dalek::backend::serial::curve_models::AffineNielsPoint, curve25519_dalek::backend::serial::curve_models::CompletedPoint> for &'a curve25519_dalek::edwards::EdwardsPoint}]
    Source: 'curve25519-dalek/src/backend/serial/curve_models/mod.rs', lines 476:0-494:1 -/
@[reducible]
def
  SharedAEdwardsPoint.Insts.CoreOpsArithSubSharedBAffineNielsPointCompletedPoint
  : core.ops.arith.Sub edwards.EdwardsPoint
  backend.serial.curve_models.AffineNielsPoint
  backend.serial.curve_models.CompletedPoint := {
  sub :=
    SharedAEdwardsPoint.Insts.CoreOpsArithSubSharedBAffineNielsPointCompletedPoint.sub
}

/-- [curve25519_dalek::backend::serial::u64::field::{curve25519_dalek::backend::serial::u64::field::FieldElement51}::negate]:
    Source: 'curve25519-dalek/src/backend/serial/u64/field.rs', lines 276:4-286:5
    Visibility: public -/
def backend.serial.u64.field.FieldElement51.negate
  (self : backend.serial.u64.field.FieldElement51) :
  Result backend.serial.u64.field.FieldElement51
  := do
  let i ← Array.index_usize self 0#usize
  let i1 ← 36028797018963664#u64 - i
  let i2 ← Array.index_usize self 1#usize
  let i3 ← 36028797018963952#u64 - i2
  let i4 ← Array.index_usize self 2#usize
  let i5 ← 36028797018963952#u64 - i4
  let i6 ← Array.index_usize self 3#usize
  let i7 ← 36028797018963952#u64 - i6
  let i8 ← Array.index_usize self 4#usize
  let i9 ← 36028797018963952#u64 - i8
  let neg ←
    backend.serial.u64.field.FieldElement51.reduce
      (Array.make 5#usize [ i1, i3, i5, i7, i9 ])
  ok neg

/-- [curve25519_dalek::backend::serial::u64::field::{impl core::ops::arith::Neg<curve25519_dalek::backend::serial::u64::field::FieldElement51> for &'a curve25519_dalek::backend::serial::u64::field::FieldElement51}::neg]:
    Source: 'curve25519-dalek/src/backend/serial/u64/field.rs', lines 218:4-222:5
    Visibility: public -/
def SharedAFieldElement51.Insts.CoreOpsArithNegFieldElement51.neg
  (self : backend.serial.u64.field.FieldElement51) :
  Result backend.serial.u64.field.FieldElement51
  := do
  backend.serial.u64.field.FieldElement51.negate self

/-- [curve25519_dalek::backend::serial::curve_models::{impl core::ops::arith::Neg<curve25519_dalek::backend::serial::curve_models::ProjectiveNielsPoint> for &'a curve25519_dalek::backend::serial::curve_models::ProjectiveNielsPoint}::neg]:
    Source: 'curve25519-dalek/src/backend/serial/curve_models/mod.rs', lines 503:4-510:5
    Visibility: public -/
def SharedAProjectiveNielsPoint.Insts.CoreOpsArithNegProjectiveNielsPoint.neg
  (self : backend.serial.curve_models.ProjectiveNielsPoint) :
  Result backend.serial.curve_models.ProjectiveNielsPoint
  := do
  let fe ←
    SharedAFieldElement51.Insts.CoreOpsArithNegFieldElement51.neg self.T2d
  ok
    {
      self
        with
        Y_plus_X := self.Y_minus_X, Y_minus_X := self.Y_plus_X, T2d := fe
    }

/-- Trait implementation: [curve25519_dalek::backend::serial::curve_models::{impl core::ops::arith::Neg<curve25519_dalek::backend::serial::curve_models::ProjectiveNielsPoint> for &'a curve25519_dalek::backend::serial::curve_models::ProjectiveNielsPoint}]
    Source: 'curve25519-dalek/src/backend/serial/curve_models/mod.rs', lines 500:0-511:1 -/
@[reducible]
def SharedAProjectiveNielsPoint.Insts.CoreOpsArithNegProjectiveNielsPoint :
  core.ops.arith.Neg backend.serial.curve_models.ProjectiveNielsPoint
  backend.serial.curve_models.ProjectiveNielsPoint := {
  neg :=
    SharedAProjectiveNielsPoint.Insts.CoreOpsArithNegProjectiveNielsPoint.neg
}

/-- [curve25519_dalek::backend::serial::curve_models::{impl core::ops::arith::Neg<curve25519_dalek::backend::serial::curve_models::AffineNielsPoint> for &'a curve25519_dalek::backend::serial::curve_models::AffineNielsPoint}::neg]:
    Source: 'curve25519-dalek/src/backend/serial/curve_models/mod.rs', lines 516:4-522:5
    Visibility: public -/
def SharedAAffineNielsPoint.Insts.CoreOpsArithNegAffineNielsPoint.neg
  (self : backend.serial.curve_models.AffineNielsPoint) :
  Result backend.serial.curve_models.AffineNielsPoint
  := do
  let fe ←
    SharedAFieldElement51.Insts.CoreOpsArithNegFieldElement51.neg self.xy2d
  ok { y_plus_x := self.y_minus_x, y_minus_x := self.y_plus_x, xy2d := fe }

/-- Trait implementation: [curve25519_dalek::backend::serial::curve_models::{impl core::ops::arith::Neg<curve25519_dalek::backend::serial::curve_models::AffineNielsPoint> for &'a curve25519_dalek::backend::serial::curve_models::AffineNielsPoint}]
    Source: 'curve25519-dalek/src/backend/serial/curve_models/mod.rs', lines 513:0-523:1 -/
@[reducible]
def SharedAAffineNielsPoint.Insts.CoreOpsArithNegAffineNielsPoint :
  core.ops.arith.Neg backend.serial.curve_models.AffineNielsPoint
  backend.serial.curve_models.AffineNielsPoint := {
  neg := SharedAAffineNielsPoint.Insts.CoreOpsArithNegAffineNielsPoint.neg
}

/-- [curve25519_dalek::backend::serial::u64::field::{impl core::fmt::Debug for curve25519_dalek::backend::serial::u64::field::FieldElement51}::fmt]:
    Source: 'curve25519-dalek/src/backend/serial/u64/field.rs', lines 46:4-48:5
    Visibility: public -/
def backend.serial.u64.field.FieldElement51.Insts.CoreFmtDebug.fmt
  (self : backend.serial.u64.field.FieldElement51) (f : core.fmt.Formatter) :
  Result ((core.result.Result Unit core.fmt.Error) × core.fmt.Formatter)
  := do
  let args ←
    core.array.Array.index (core.ops.index.IndexSlice
      (core.ops.range.RangeFull.Insts.CoreSliceIndexSliceIndexSliceSlice
      Std.U64)) self ()
  let a ←
    core.fmt.rt.Argument.new_debug (core.fmt.DebugShared
      (Slice.Insts.CoreFmtDebug core.fmt.DebugU64)) args
  let a1 ←
    core.fmt.Arguments.new
      (Array.make 20#usize [
        15#u8, 70#u8, 105#u8, 101#u8, 108#u8, 100#u8, 69#u8, 108#u8, 101#u8,
        109#u8, 101#u8, 110#u8, 116#u8, 53#u8, 49#u8, 40#u8, 192#u8, 1#u8,
        41#u8, 0#u8
        ]) (Array.make 1#usize [ a ])
  core.fmt.Formatter.write_fmt f a1

/-- Trait implementation: [curve25519_dalek::backend::serial::u64::field::{impl core::fmt::Debug for curve25519_dalek::backend::serial::u64::field::FieldElement51}]
    Source: 'curve25519-dalek/src/backend/serial/u64/field.rs', lines 45:0-49:1 -/
@[reducible]
def backend.serial.u64.field.FieldElement51.Insts.CoreFmtDebug : core.fmt.Debug
  backend.serial.u64.field.FieldElement51 := {
  fmt := backend.serial.u64.field.FieldElement51.Insts.CoreFmtDebug.fmt
}

/-- [curve25519_dalek::backend::serial::curve_models::{impl core::fmt::Debug for curve25519_dalek::backend::serial::curve_models::ProjectivePoint}::fmt]:
    Source: 'curve25519-dalek/src/backend/serial/curve_models/mod.rs', lines 530:4-536:5
    Visibility: public -/
def backend.serial.curve_models.ProjectivePoint.Insts.CoreFmtDebug.fmt
  (self : backend.serial.curve_models.ProjectivePoint) (f : core.fmt.Formatter)
  :
  Result ((core.result.Result Unit core.fmt.Error) × core.fmt.Formatter)
  := do
  let a ←
    core.fmt.rt.Argument.new_debug (core.fmt.DebugShared
      backend.serial.u64.field.FieldElement51.Insts.CoreFmtDebug) self.X
  let a1 ←
    core.fmt.rt.Argument.new_debug (core.fmt.DebugShared
      backend.serial.u64.field.FieldElement51.Insts.CoreFmtDebug) self.Y
  let a2 ←
    core.fmt.rt.Argument.new_debug (core.fmt.DebugShared
      backend.serial.u64.field.FieldElement51.Insts.CoreFmtDebug) self.Z
  let a3 ←
    core.fmt.Arguments.new
      (Array.make 43#usize [
        21#u8, 80#u8, 114#u8, 111#u8, 106#u8, 101#u8, 99#u8, 116#u8, 105#u8,
        118#u8, 101#u8, 80#u8, 111#u8, 105#u8, 110#u8, 116#u8, 123#u8, 10#u8,
        9#u8, 88#u8, 58#u8, 32#u8, 192#u8, 6#u8, 44#u8, 10#u8, 9#u8, 89#u8,
        58#u8, 32#u8, 192#u8, 6#u8, 44#u8, 10#u8, 9#u8, 90#u8, 58#u8, 32#u8,
        192#u8, 2#u8, 10#u8, 125#u8, 0#u8
        ]) (Array.make 3#usize [ a, a1, a2 ])
  core.fmt.Formatter.write_fmt f a3

/-- Trait implementation: [curve25519_dalek::backend::serial::curve_models::{impl core::fmt::Debug for curve25519_dalek::backend::serial::curve_models::ProjectivePoint}]
    Source: 'curve25519-dalek/src/backend/serial/curve_models/mod.rs', lines 529:0-537:1 -/
@[reducible]
def backend.serial.curve_models.ProjectivePoint.Insts.CoreFmtDebug :
  core.fmt.Debug backend.serial.curve_models.ProjectivePoint := {
  fmt := backend.serial.curve_models.ProjectivePoint.Insts.CoreFmtDebug.fmt
}

/-- [curve25519_dalek::backend::serial::curve_models::{impl core::fmt::Debug for curve25519_dalek::backend::serial::curve_models::CompletedPoint}::fmt]:
    Source: 'curve25519-dalek/src/backend/serial/curve_models/mod.rs', lines 540:4-546:5
    Visibility: public -/
def backend.serial.curve_models.CompletedPoint.Insts.CoreFmtDebug.fmt
  (self : backend.serial.curve_models.CompletedPoint) (f : core.fmt.Formatter)
  :
  Result ((core.result.Result Unit core.fmt.Error) × core.fmt.Formatter)
  := do
  let a ←
    core.fmt.rt.Argument.new_debug (core.fmt.DebugShared
      backend.serial.u64.field.FieldElement51.Insts.CoreFmtDebug) self.X
  let a1 ←
    core.fmt.rt.Argument.new_debug (core.fmt.DebugShared
      backend.serial.u64.field.FieldElement51.Insts.CoreFmtDebug) self.Y
  let a2 ←
    core.fmt.rt.Argument.new_debug (core.fmt.DebugShared
      backend.serial.u64.field.FieldElement51.Insts.CoreFmtDebug) self.Z
  let a3 ←
    core.fmt.rt.Argument.new_debug (core.fmt.DebugShared
      backend.serial.u64.field.FieldElement51.Insts.CoreFmtDebug) self.T
  let a4 ←
    core.fmt.Arguments.new
      (Array.make 50#usize [
        20#u8, 67#u8, 111#u8, 109#u8, 112#u8, 108#u8, 101#u8, 116#u8, 101#u8,
        100#u8, 80#u8, 111#u8, 105#u8, 110#u8, 116#u8, 123#u8, 10#u8, 9#u8,
        88#u8, 58#u8, 32#u8, 192#u8, 6#u8, 44#u8, 10#u8, 9#u8, 89#u8, 58#u8,
        32#u8, 192#u8, 6#u8, 44#u8, 10#u8, 9#u8, 90#u8, 58#u8, 32#u8, 192#u8,
        6#u8, 44#u8, 10#u8, 9#u8, 84#u8, 58#u8, 32#u8, 192#u8, 2#u8, 10#u8,
        125#u8, 0#u8
        ]) (Array.make 4#usize [ a, a1, a2, a3 ])
  core.fmt.Formatter.write_fmt f a4

/-- Trait implementation: [curve25519_dalek::backend::serial::curve_models::{impl core::fmt::Debug for curve25519_dalek::backend::serial::curve_models::CompletedPoint}]
    Source: 'curve25519-dalek/src/backend/serial/curve_models/mod.rs', lines 539:0-547:1 -/
@[reducible]
def backend.serial.curve_models.CompletedPoint.Insts.CoreFmtDebug :
  core.fmt.Debug backend.serial.curve_models.CompletedPoint := {
  fmt := backend.serial.curve_models.CompletedPoint.Insts.CoreFmtDebug.fmt
}

/-- [curve25519_dalek::backend::serial::curve_models::{impl core::fmt::Debug for curve25519_dalek::backend::serial::curve_models::AffineNielsPoint}::fmt]:
    Source: 'curve25519-dalek/src/backend/serial/curve_models/mod.rs', lines 550:4-556:5
    Visibility: public -/
def backend.serial.curve_models.AffineNielsPoint.Insts.CoreFmtDebug.fmt
  (self : backend.serial.curve_models.AffineNielsPoint)
  (f : core.fmt.Formatter) :
  Result ((core.result.Result Unit core.fmt.Error) × core.fmt.Formatter)
  := do
  let a ←
    core.fmt.rt.Argument.new_debug (core.fmt.DebugShared
      backend.serial.u64.field.FieldElement51.Insts.CoreFmtDebug) self.y_plus_x
  let a1 ←
    core.fmt.rt.Argument.new_debug (core.fmt.DebugShared
      backend.serial.u64.field.FieldElement51.Insts.CoreFmtDebug)
      self.y_minus_x
  let a2 ←
    core.fmt.rt.Argument.new_debug (core.fmt.DebugShared
      backend.serial.u64.field.FieldElement51.Insts.CoreFmtDebug) self.xy2d
  let a3 ←
    core.fmt.Arguments.new
      (Array.make 62#usize [
        29#u8, 65#u8, 102#u8, 102#u8, 105#u8, 110#u8, 101#u8, 78#u8, 105#u8,
        101#u8, 108#u8, 115#u8, 80#u8, 111#u8, 105#u8, 110#u8, 116#u8, 123#u8,
        10#u8, 9#u8, 121#u8, 95#u8, 112#u8, 108#u8, 117#u8, 115#u8, 95#u8,
        120#u8, 58#u8, 32#u8, 192#u8, 14#u8, 44#u8, 10#u8, 9#u8, 121#u8, 95#u8,
        109#u8, 105#u8, 110#u8, 117#u8, 115#u8, 95#u8, 120#u8, 58#u8, 32#u8,
        192#u8, 9#u8, 44#u8, 10#u8, 9#u8, 120#u8, 121#u8, 50#u8, 100#u8, 58#u8,
        32#u8, 192#u8, 2#u8, 10#u8, 125#u8, 0#u8
        ]) (Array.make 3#usize [ a, a1, a2 ])
  core.fmt.Formatter.write_fmt f a3

/-- Trait implementation: [curve25519_dalek::backend::serial::curve_models::{impl core::fmt::Debug for curve25519_dalek::backend::serial::curve_models::AffineNielsPoint}]
    Source: 'curve25519-dalek/src/backend/serial/curve_models/mod.rs', lines 549:0-557:1 -/
@[reducible]
def backend.serial.curve_models.AffineNielsPoint.Insts.CoreFmtDebug :
  core.fmt.Debug backend.serial.curve_models.AffineNielsPoint := {
  fmt := backend.serial.curve_models.AffineNielsPoint.Insts.CoreFmtDebug.fmt
}

/-- [curve25519_dalek::backend::serial::curve_models::{impl core::fmt::Debug for curve25519_dalek::backend::serial::curve_models::ProjectiveNielsPoint}::fmt]:
    Source: 'curve25519-dalek/src/backend/serial/curve_models/mod.rs', lines 560:4-563:5
    Visibility: public -/
def backend.serial.curve_models.ProjectiveNielsPoint.Insts.CoreFmtDebug.fmt
  (self : backend.serial.curve_models.ProjectiveNielsPoint)
  (f : core.fmt.Formatter) :
  Result ((core.result.Result Unit core.fmt.Error) × core.fmt.Formatter)
  := do
  let a ←
    core.fmt.rt.Argument.new_debug (core.fmt.DebugShared
      backend.serial.u64.field.FieldElement51.Insts.CoreFmtDebug) self.Y_plus_X
  let a1 ←
    core.fmt.rt.Argument.new_debug (core.fmt.DebugShared
      backend.serial.u64.field.FieldElement51.Insts.CoreFmtDebug)
      self.Y_minus_X
  let a2 ←
    core.fmt.rt.Argument.new_debug (core.fmt.DebugShared
      backend.serial.u64.field.FieldElement51.Insts.CoreFmtDebug) self.Z
  let a3 ←
    core.fmt.rt.Argument.new_debug (core.fmt.DebugShared
      backend.serial.u64.field.FieldElement51.Insts.CoreFmtDebug) self.T2d
  let a4 ←
    core.fmt.Arguments.new
      (Array.make 73#usize [
        33#u8, 80#u8, 114#u8, 111#u8, 106#u8, 101#u8, 99#u8, 116#u8, 105#u8,
        118#u8, 101#u8, 78#u8, 105#u8, 101#u8, 108#u8, 115#u8, 80#u8, 111#u8,
        105#u8, 110#u8, 116#u8, 123#u8, 10#u8, 9#u8, 89#u8, 95#u8, 112#u8,
        108#u8, 117#u8, 115#u8, 95#u8, 88#u8, 58#u8, 32#u8, 192#u8, 14#u8,
        44#u8, 10#u8, 9#u8, 89#u8, 95#u8, 109#u8, 105#u8, 110#u8, 117#u8,
        115#u8, 95#u8, 88#u8, 58#u8, 32#u8, 192#u8, 6#u8, 44#u8, 10#u8, 9#u8,
        90#u8, 58#u8, 32#u8, 192#u8, 8#u8, 44#u8, 10#u8, 9#u8, 84#u8, 50#u8,
        100#u8, 58#u8, 32#u8, 192#u8, 2#u8, 10#u8, 125#u8, 0#u8
        ]) (Array.make 4#usize [ a, a1, a2, a3 ])
  core.fmt.Formatter.write_fmt f a4

/-- Trait implementation: [curve25519_dalek::backend::serial::curve_models::{impl core::fmt::Debug for curve25519_dalek::backend::serial::curve_models::ProjectiveNielsPoint}]
    Source: 'curve25519-dalek/src/backend/serial/curve_models/mod.rs', lines 559:0-564:1 -/
@[reducible]
def backend.serial.curve_models.ProjectiveNielsPoint.Insts.CoreFmtDebug :
  core.fmt.Debug backend.serial.curve_models.ProjectiveNielsPoint := {
  fmt :=
    backend.serial.curve_models.ProjectiveNielsPoint.Insts.CoreFmtDebug.fmt
}

/-- [curve25519_dalek::backend::serial::u64::constants::SQRT_M1]
    Source: 'curve25519-dalek/src/backend/serial/u64/constants.rs', lines 89:0-95:3 -/
@[global_simps, irreducible]
def backend.serial.u64.constants.SQRT_M1
  : Result backend.serial.u64.field.FieldElement51 :=
  backend.serial.u64.field.FieldElement51.from_limbs
    (Array.make 5#usize [
      1718705420411056#u64, 234908883556509#u64, 2233514472574048#u64,
      2117202627021982#u64, 765476049583133#u64
      ])

/-- [curve25519_dalek::backend::serial::u64::constants::L]
    Source: 'curve25519-dalek/src/backend/serial/u64/constants.rs', lines 117:0-123:3 -/
@[global_simps, irreducible]
def backend.serial.u64.constants.L : backend.serial.u64.scalar.Scalar52 :=
  Array.make 5#usize [
    671914833335277#u64, 3916664325105025#u64, 1367801#u64, 0#u64,
    17592186044416#u64
    ]

/-- [curve25519_dalek::backend::serial::u64::constants::LFACTOR]
    Source: 'curve25519-dalek/src/backend/serial/u64/constants.rs', lines 126:0-126:48 -/
@[global_simps, irreducible]
def backend.serial.u64.constants.LFACTOR : Std.U64 := 1439961107955227#u64

/-- [curve25519_dalek::backend::serial::u64::constants::R]
    Source: 'curve25519-dalek/src/backend/serial/u64/constants.rs', lines 129:0-135:3 -/
@[global_simps, irreducible]
def backend.serial.u64.constants.R : backend.serial.u64.scalar.Scalar52 :=
  Array.make 5#usize [
    4302102966953709#u64, 1049714374468698#u64, 4503599278581019#u64,
    4503599627370495#u64, 17592186044415#u64
    ]

/-- [curve25519_dalek::backend::serial::u64::constants::RR]
    Source: 'curve25519-dalek/src/backend/serial/u64/constants.rs', lines 138:0-144:3 -/
@[global_simps, irreducible]
def backend.serial.u64.constants.RR : backend.serial.u64.scalar.Scalar52 :=
  Array.make 5#usize [
    2764609938444603#u64, 3768881411696287#u64, 1616719297148420#u64,
    1087343033131391#u64, 10175238647962#u64
    ]

/-- [curve25519_dalek::backend::serial::u64::field::{impl core::clone::Clone for curve25519_dalek::backend::serial::u64::field::FieldElement51}::clone]:
    Source: 'curve25519-dalek/src/backend/serial/u64/field.rs', lines 42:15-42:20
    Visibility: public -/
def backend.serial.u64.field.FieldElement51.Insts.CoreCloneClone.clone
  (self : backend.serial.u64.field.FieldElement51) :
  Result backend.serial.u64.field.FieldElement51
  := do
  ok self

/-- Trait implementation: [curve25519_dalek::backend::serial::u64::field::{impl core::clone::Clone for curve25519_dalek::backend::serial::u64::field::FieldElement51}]
    Source: 'curve25519-dalek/src/backend/serial/u64/field.rs', lines 42:15-42:20 -/
@[reducible]
def backend.serial.u64.field.FieldElement51.Insts.CoreCloneClone :
  core.clone.Clone backend.serial.u64.field.FieldElement51 := {
  clone := backend.serial.u64.field.FieldElement51.Insts.CoreCloneClone.clone
}

/-- Trait implementation: [curve25519_dalek::backend::serial::u64::field::{impl core::marker::Copy for curve25519_dalek::backend::serial::u64::field::FieldElement51}]
    Source: 'curve25519-dalek/src/backend/serial/u64/field.rs', lines 42:9-42:13 -/
@[reducible]
def backend.serial.u64.field.FieldElement51.Insts.CoreMarkerCopy :
  core.marker.Copy backend.serial.u64.field.FieldElement51 := {
  cloneInst := backend.serial.u64.field.FieldElement51.Insts.CoreCloneClone
}

/-- Trait implementation: [curve25519_dalek::backend::serial::u64::field::{impl core::ops::arith::AddAssign<&'b curve25519_dalek::backend::serial::u64::field::FieldElement51> for curve25519_dalek::backend::serial::u64::field::FieldElement51}]
    Source: 'curve25519-dalek/src/backend/serial/u64/field.rs', lines 58:0-64:1 -/
@[reducible]
def
  backend.serial.u64.field.FieldElement51.Insts.CoreOpsArithAddAssignSharedBFieldElement51
  : core.ops.arith.AddAssign backend.serial.u64.field.FieldElement51
  backend.serial.u64.field.FieldElement51 := {
  add_assign :=
    backend.serial.u64.field.FieldElement51.Insts.CoreOpsArithAddAssignSharedBFieldElement51.add_assign
}

/-- Trait implementation: [curve25519_dalek::backend::serial::u64::field::{impl core::ops::arith::Add<&'b curve25519_dalek::backend::serial::u64::field::FieldElement51, curve25519_dalek::backend::serial::u64::field::FieldElement51> for &'a curve25519_dalek::backend::serial::u64::field::FieldElement51}]
    Source: 'curve25519-dalek/src/backend/serial/u64/field.rs', lines 66:0-73:1 -/
@[reducible]
def
  SharedAFieldElement51.Insts.CoreOpsArithAddSharedBFieldElement51FieldElement51
  : core.ops.arith.Add backend.serial.u64.field.FieldElement51
  backend.serial.u64.field.FieldElement51
  backend.serial.u64.field.FieldElement51 := {
  add :=
    SharedAFieldElement51.Insts.CoreOpsArithAddSharedBFieldElement51FieldElement51.add
}

/-- [curve25519_dalek::backend::serial::u64::field::{impl core::ops::arith::SubAssign<&'b curve25519_dalek::backend::serial::u64::field::FieldElement51> for curve25519_dalek::backend::serial::u64::field::FieldElement51}::sub_assign]:
    Source: 'curve25519-dalek/src/backend/serial/u64/field.rs', lines 76:4-79:5
    Visibility: public -/
def
  backend.serial.u64.field.FieldElement51.Insts.CoreOpsArithSubAssignSharedBFieldElement51.sub_assign
  (self : backend.serial.u64.field.FieldElement51)
  (_rhs : backend.serial.u64.field.FieldElement51) :
  Result backend.serial.u64.field.FieldElement51
  := do
  let result ←
    SharedAFieldElement51.Insts.CoreOpsArithSubSharedBFieldElement51FieldElement51.sub
      self _rhs
  ok result

/-- Trait implementation: [curve25519_dalek::backend::serial::u64::field::{impl core::ops::arith::SubAssign<&'b curve25519_dalek::backend::serial::u64::field::FieldElement51> for curve25519_dalek::backend::serial::u64::field::FieldElement51}]
    Source: 'curve25519-dalek/src/backend/serial/u64/field.rs', lines 75:0-80:1 -/
@[reducible]
def
  backend.serial.u64.field.FieldElement51.Insts.CoreOpsArithSubAssignSharedBFieldElement51
  : core.ops.arith.SubAssign backend.serial.u64.field.FieldElement51
  backend.serial.u64.field.FieldElement51 := {
  sub_assign :=
    backend.serial.u64.field.FieldElement51.Insts.CoreOpsArithSubAssignSharedBFieldElement51.sub_assign
}

/-- Trait implementation: [curve25519_dalek::backend::serial::u64::field::{impl core::ops::arith::Sub<&'b curve25519_dalek::backend::serial::u64::field::FieldElement51, curve25519_dalek::backend::serial::u64::field::FieldElement51> for &'a curve25519_dalek::backend::serial::u64::field::FieldElement51}]
    Source: 'curve25519-dalek/src/backend/serial/u64/field.rs', lines 82:0-102:1 -/
@[reducible]
def
  SharedAFieldElement51.Insts.CoreOpsArithSubSharedBFieldElement51FieldElement51
  : core.ops.arith.Sub backend.serial.u64.field.FieldElement51
  backend.serial.u64.field.FieldElement51
  backend.serial.u64.field.FieldElement51 := {
  sub :=
    SharedAFieldElement51.Insts.CoreOpsArithSubSharedBFieldElement51FieldElement51.sub
}

/-- [curve25519_dalek::backend::serial::u64::field::{impl core::ops::arith::MulAssign<&'b curve25519_dalek::backend::serial::u64::field::FieldElement51> for curve25519_dalek::backend::serial::u64::field::FieldElement51}::mul_assign]:
    Source: 'curve25519-dalek/src/backend/serial/u64/field.rs', lines 105:4-108:5
    Visibility: public -/
def
  backend.serial.u64.field.FieldElement51.Insts.CoreOpsArithMulAssignSharedBFieldElement51.mul_assign
  (self : backend.serial.u64.field.FieldElement51)
  (_rhs : backend.serial.u64.field.FieldElement51) :
  Result backend.serial.u64.field.FieldElement51
  := do
  let result ←
    SharedAFieldElement51.Insts.CoreOpsArithMulSharedBFieldElement51FieldElement51.mul
      self _rhs
  ok result

/-- Trait implementation: [curve25519_dalek::backend::serial::u64::field::{impl core::ops::arith::MulAssign<&'b curve25519_dalek::backend::serial::u64::field::FieldElement51> for curve25519_dalek::backend::serial::u64::field::FieldElement51}]
    Source: 'curve25519-dalek/src/backend/serial/u64/field.rs', lines 104:0-109:1 -/
@[reducible]
def
  backend.serial.u64.field.FieldElement51.Insts.CoreOpsArithMulAssignSharedBFieldElement51
  : core.ops.arith.MulAssign backend.serial.u64.field.FieldElement51
  backend.serial.u64.field.FieldElement51 := {
  mul_assign :=
    backend.serial.u64.field.FieldElement51.Insts.CoreOpsArithMulAssignSharedBFieldElement51.mul_assign
}

/-- Trait implementation: [curve25519_dalek::backend::serial::u64::field::{impl core::ops::arith::Mul<&'b curve25519_dalek::backend::serial::u64::field::FieldElement51, curve25519_dalek::backend::serial::u64::field::FieldElement51> for &'a curve25519_dalek::backend::serial::u64::field::FieldElement51}]
    Source: 'curve25519-dalek/src/backend/serial/u64/field.rs', lines 111:0-214:1 -/
@[reducible]
def
  SharedAFieldElement51.Insts.CoreOpsArithMulSharedBFieldElement51FieldElement51
  : core.ops.arith.Mul backend.serial.u64.field.FieldElement51
  backend.serial.u64.field.FieldElement51
  backend.serial.u64.field.FieldElement51 := {
  mul :=
    SharedAFieldElement51.Insts.CoreOpsArithMulSharedBFieldElement51FieldElement51.mul
}

/-- Trait implementation: [curve25519_dalek::backend::serial::u64::field::{impl core::ops::arith::Neg<curve25519_dalek::backend::serial::u64::field::FieldElement51> for &'a curve25519_dalek::backend::serial::u64::field::FieldElement51}]
    Source: 'curve25519-dalek/src/backend/serial/u64/field.rs', lines 216:0-223:1 -/
@[reducible]
def SharedAFieldElement51.Insts.CoreOpsArithNegFieldElement51 :
  core.ops.arith.Neg backend.serial.u64.field.FieldElement51
  backend.serial.u64.field.FieldElement51 := {
  neg := SharedAFieldElement51.Insts.CoreOpsArithNegFieldElement51.neg
}

/-- [curve25519_dalek::backend::serial::u64::field::{impl subtle::ConditionallySelectable for curve25519_dalek::backend::serial::u64::field::FieldElement51}::conditional_swap]:
    Source: 'curve25519-dalek/src/backend/serial/u64/field.rs', lines 240:4-246:5
    Visibility: public -/
def
  backend.serial.u64.field.FieldElement51.Insts.SubtleConditionallySelectable.conditional_swap
  (a : backend.serial.u64.field.FieldElement51)
  (b : backend.serial.u64.field.FieldElement51) (choice : subtle.Choice) :
  Result (backend.serial.u64.field.FieldElement51 ×
    backend.serial.u64.field.FieldElement51)
  := do
  let (i, index_mut_back) ← Array.index_mut_usize a 0#usize
  let (i1, index_mut_back1) ← Array.index_mut_usize b 0#usize
  let (i2, i3) ←
    U64.Insts.SubtleConditionallySelectable.conditional_swap i i1 choice
  let a1 := index_mut_back i2
  let (i4, index_mut_back2) ← Array.index_mut_usize a1 1#usize
  let a2 := index_mut_back1 i3
  let (i5, index_mut_back3) ← Array.index_mut_usize a2 1#usize
  let (i6, i7) ←
    U64.Insts.SubtleConditionallySelectable.conditional_swap i4 i5 choice
  let a3 := index_mut_back2 i6
  let (i8, index_mut_back4) ← Array.index_mut_usize a3 2#usize
  let a4 := index_mut_back3 i7
  let (i9, index_mut_back5) ← Array.index_mut_usize a4 2#usize
  let (i10, i11) ←
    U64.Insts.SubtleConditionallySelectable.conditional_swap i8 i9 choice
  let a5 := index_mut_back4 i10
  let (i12, index_mut_back6) ← Array.index_mut_usize a5 3#usize
  let a6 := index_mut_back5 i11
  let (i13, index_mut_back7) ← Array.index_mut_usize a6 3#usize
  let (i14, i15) ←
    U64.Insts.SubtleConditionallySelectable.conditional_swap i12 i13 choice
  let a7 := index_mut_back6 i14
  let (i16, index_mut_back8) ← Array.index_mut_usize a7 4#usize
  let a8 := index_mut_back7 i15
  let (i17, index_mut_back9) ← Array.index_mut_usize a8 4#usize
  let (i18, i19) ←
    U64.Insts.SubtleConditionallySelectable.conditional_swap i16 i17 choice
  let a9 := index_mut_back8 i18
  let a10 := index_mut_back9 i19
  ok (a9, a10)

/-- Trait implementation: [curve25519_dalek::backend::serial::u64::field::{impl subtle::ConditionallySelectable for curve25519_dalek::backend::serial::u64::field::FieldElement51}]
    Source: 'curve25519-dalek/src/backend/serial/u64/field.rs', lines 225:0-255:1 -/
@[reducible]
def backend.serial.u64.field.FieldElement51.Insts.SubtleConditionallySelectable
  : subtle.ConditionallySelectable backend.serial.u64.field.FieldElement51 := {
  coremarkerCopyInst :=
    backend.serial.u64.field.FieldElement51.Insts.CoreMarkerCopy
  conditional_select :=
    backend.serial.u64.field.FieldElement51.Insts.SubtleConditionallySelectable.conditional_select
  conditional_assign :=
    backend.serial.u64.field.FieldElement51.Insts.SubtleConditionallySelectable.conditional_assign
  conditional_swap :=
    backend.serial.u64.field.FieldElement51.Insts.SubtleConditionallySelectable.conditional_swap
}

/-- [curve25519_dalek::backend::serial::u64::field::{curve25519_dalek::backend::serial::u64::field::FieldElement51}::MINUS_ONE]
    Source: 'curve25519-dalek/src/backend/serial/u64/field.rs', lines 267:4-273:7
    Visibility: public -/
@[global_simps, irreducible]
def backend.serial.u64.field.FieldElement51.MINUS_ONE
  : Result backend.serial.u64.field.FieldElement51 :=
  backend.serial.u64.field.FieldElement51.from_limbs
    (Array.make 5#usize [
      2251799813685228#u64, 2251799813685247#u64, 2251799813685247#u64,
      2251799813685247#u64, 2251799813685247#u64
      ])

/-- [curve25519_dalek::backend::serial::u64::field::{curve25519_dalek::backend::serial::u64::field::FieldElement51}::from_bytes::{impl core::ops::function::Fn<(&'_ [u8],), u64> for curve25519_dalek::backend::serial::u64::field::{curve25519_dalek::backend::serial::u64::field::FieldElement51}::from_bytes::closure}::call]:
    Source: 'curve25519-dalek/src/backend/serial/u64/field.rs', lines 339:20-348:9 -/
def
  backend.serial.u64.field.FieldElement51.from_bytes.closure.Insts.CoreOpsFunctionFnTupleSharedSliceU8U64.call
  (c : backend.serial.u64.field.FieldElement51.from_bytes.closure)
  (tupled_args : Slice Std.U8) :
  Result Std.U64
  := do
  let i ← Slice.index_usize tupled_args 0#usize
  let i1 ← lift (UScalar.cast .U64 i)
  let i2 ← Slice.index_usize tupled_args 1#usize
  let i3 ← lift (UScalar.cast .U64 i2)
  let i4 ← i3 <<< 8#i32
  let i5 ← lift (i1 ||| i4)
  let i6 ← Slice.index_usize tupled_args 2#usize
  let i7 ← lift (UScalar.cast .U64 i6)
  let i8 ← i7 <<< 16#i32
  let i9 ← lift (i5 ||| i8)
  let i10 ← Slice.index_usize tupled_args 3#usize
  let i11 ← lift (UScalar.cast .U64 i10)
  let i12 ← i11 <<< 24#i32
  let i13 ← lift (i9 ||| i12)
  let i14 ← Slice.index_usize tupled_args 4#usize
  let i15 ← lift (UScalar.cast .U64 i14)
  let i16 ← i15 <<< 32#i32
  let i17 ← lift (i13 ||| i16)
  let i18 ← Slice.index_usize tupled_args 5#usize
  let i19 ← lift (UScalar.cast .U64 i18)
  let i20 ← i19 <<< 40#i32
  let i21 ← lift (i17 ||| i20)
  let i22 ← Slice.index_usize tupled_args 6#usize
  let i23 ← lift (UScalar.cast .U64 i22)
  let i24 ← i23 <<< 48#i32
  let i25 ← lift (i21 ||| i24)
  let i26 ← Slice.index_usize tupled_args 7#usize
  let i27 ← lift (UScalar.cast .U64 i26)
  let i28 ← i27 <<< 56#i32
  ok (i25 ||| i28)

/-- [curve25519_dalek::backend::serial::u64::field::{curve25519_dalek::backend::serial::u64::field::FieldElement51}::from_bytes]:
    Source: 'curve25519-dalek/src/backend/serial/u64/field.rs', lines 338:4-363:5
    Visibility: public -/
def backend.serial.u64.field.FieldElement51.from_bytes
  (bytes : Array Std.U8 32#usize) :
  Result backend.serial.u64.field.FieldElement51
  := do
  let i ← 1#u64 <<< 51#i32
  let low_51_bit_mask ← i - 1#u64
  let s ←
    core.array.Array.index (core.ops.index.IndexSlice
      (core.slice.index.SliceIndexRangeFromUsizeSlice Std.U8)) bytes
      { start := 0#usize }
  let i1 ←
    backend.serial.u64.field.FieldElement51.from_bytes.closure.Insts.CoreOpsFunctionFnTupleSharedSliceU8U64.call
      () s
  let i2 ← lift (i1 &&& low_51_bit_mask)
  let s1 ←
    core.array.Array.index (core.ops.index.IndexSlice
      (core.slice.index.SliceIndexRangeFromUsizeSlice Std.U8)) bytes
      { start := 6#usize }
  let i3 ←
    backend.serial.u64.field.FieldElement51.from_bytes.closure.Insts.CoreOpsFunctionFnTupleSharedSliceU8U64.call
      () s1
  let i4 ← i3 >>> 3#i32
  let i5 ← lift (i4 &&& low_51_bit_mask)
  let s2 ←
    core.array.Array.index (core.ops.index.IndexSlice
      (core.slice.index.SliceIndexRangeFromUsizeSlice Std.U8)) bytes
      { start := 12#usize }
  let i6 ←
    backend.serial.u64.field.FieldElement51.from_bytes.closure.Insts.CoreOpsFunctionFnTupleSharedSliceU8U64.call
      () s2
  let i7 ← i6 >>> 6#i32
  let i8 ← lift (i7 &&& low_51_bit_mask)
  let s3 ←
    core.array.Array.index (core.ops.index.IndexSlice
      (core.slice.index.SliceIndexRangeFromUsizeSlice Std.U8)) bytes
      { start := 19#usize }
  let i9 ←
    backend.serial.u64.field.FieldElement51.from_bytes.closure.Insts.CoreOpsFunctionFnTupleSharedSliceU8U64.call
      () s3
  let i10 ← i9 >>> 1#i32
  let i11 ← lift (i10 &&& low_51_bit_mask)
  let s4 ←
    core.array.Array.index (core.ops.index.IndexSlice
      (core.slice.index.SliceIndexRangeFromUsizeSlice Std.U8)) bytes
      { start := 24#usize }
  let i12 ←
    backend.serial.u64.field.FieldElement51.from_bytes.closure.Insts.CoreOpsFunctionFnTupleSharedSliceU8U64.call
      () s4
  let i13 ← i12 >>> 12#i32
  let i14 ← lift (i13 &&& low_51_bit_mask)
  ok (Array.make 5#usize [ i2, i5, i8, i11, i14 ])

/-- [curve25519_dalek::backend::serial::u64::field::{curve25519_dalek::backend::serial::u64::field::FieldElement51}::from_bytes::{impl core::ops::function::FnMut<(&'_ [u8],), u64> for curve25519_dalek::backend::serial::u64::field::{curve25519_dalek::backend::serial::u64::field::FieldElement51}::from_bytes::closure}::call_mut]:
    Source: 'curve25519-dalek/src/backend/serial/u64/field.rs', lines 339:20-348:9 -/
def
  backend.serial.u64.field.FieldElement51.from_bytes.closure.Insts.CoreOpsFunctionFnMutTupleSharedSliceU8U64.call_mut
  (state : backend.serial.u64.field.FieldElement51.from_bytes.closure)
  (args : Slice Std.U8) :
  Result (Std.U64 ×
    backend.serial.u64.field.FieldElement51.from_bytes.closure)
  := do
  let i ←
    backend.serial.u64.field.FieldElement51.from_bytes.closure.Insts.CoreOpsFunctionFnTupleSharedSliceU8U64.call
      state args
  ok (i, state)

/-- [curve25519_dalek::backend::serial::u64::field::{curve25519_dalek::backend::serial::u64::field::FieldElement51}::from_bytes::{impl core::ops::function::FnOnce<(&'_ [u8],), u64> for curve25519_dalek::backend::serial::u64::field::{curve25519_dalek::backend::serial::u64::field::FieldElement51}::from_bytes::closure}::call_once]:
    Source: 'curve25519-dalek/src/backend/serial/u64/field.rs', lines 339:20-348:9 -/
def
  backend.serial.u64.field.FieldElement51.from_bytes.closure.Insts.CoreOpsFunctionFnOnceTupleSharedSliceU8U64.call_once
  (c : backend.serial.u64.field.FieldElement51.from_bytes.closure)
  (s : Slice Std.U8) :
  Result Std.U64
  := do
  let (i, _) ←
    backend.serial.u64.field.FieldElement51.from_bytes.closure.Insts.CoreOpsFunctionFnMutTupleSharedSliceU8U64.call_mut
      c s
  ok i

/-- Trait implementation: [curve25519_dalek::backend::serial::u64::field::{curve25519_dalek::backend::serial::u64::field::FieldElement51}::from_bytes::{impl core::ops::function::FnOnce<(&'_ [u8],), u64> for curve25519_dalek::backend::serial::u64::field::{curve25519_dalek::backend::serial::u64::field::FieldElement51}::from_bytes::closure}]
    Source: 'curve25519-dalek/src/backend/serial/u64/field.rs', lines 339:20-348:9 -/
@[reducible]
def
  backend.serial.u64.field.FieldElement51.from_bytes.closure.Insts.CoreOpsFunctionFnOnceTupleSharedSliceU8U64
  : core.ops.function.FnOnce
  backend.serial.u64.field.FieldElement51.from_bytes.closure (Slice Std.U8)
  Std.U64 := {
  call_once :=
    backend.serial.u64.field.FieldElement51.from_bytes.closure.Insts.CoreOpsFunctionFnOnceTupleSharedSliceU8U64.call_once
}

/-- Trait implementation: [curve25519_dalek::backend::serial::u64::field::{curve25519_dalek::backend::serial::u64::field::FieldElement51}::from_bytes::{impl core::ops::function::FnMut<(&'_ [u8],), u64> for curve25519_dalek::backend::serial::u64::field::{curve25519_dalek::backend::serial::u64::field::FieldElement51}::from_bytes::closure}]
    Source: 'curve25519-dalek/src/backend/serial/u64/field.rs', lines 339:20-348:9 -/
@[reducible]
def
  backend.serial.u64.field.FieldElement51.from_bytes.closure.Insts.CoreOpsFunctionFnMutTupleSharedSliceU8U64
  : core.ops.function.FnMut
  backend.serial.u64.field.FieldElement51.from_bytes.closure (Slice Std.U8)
  Std.U64 := {
  FnOnceInst :=
    backend.serial.u64.field.FieldElement51.from_bytes.closure.Insts.CoreOpsFunctionFnOnceTupleSharedSliceU8U64
  call_mut :=
    backend.serial.u64.field.FieldElement51.from_bytes.closure.Insts.CoreOpsFunctionFnMutTupleSharedSliceU8U64.call_mut
}

/-- Trait implementation: [curve25519_dalek::backend::serial::u64::field::{curve25519_dalek::backend::serial::u64::field::FieldElement51}::from_bytes::{impl core::ops::function::Fn<(&'_ [u8],), u64> for curve25519_dalek::backend::serial::u64::field::{curve25519_dalek::backend::serial::u64::field::FieldElement51}::from_bytes::closure}]
    Source: 'curve25519-dalek/src/backend/serial/u64/field.rs', lines 339:20-348:9 -/
@[reducible]
def
  backend.serial.u64.field.FieldElement51.from_bytes.closure.Insts.CoreOpsFunctionFnTupleSharedSliceU8U64
  : core.ops.function.Fn
  backend.serial.u64.field.FieldElement51.from_bytes.closure (Slice Std.U8)
  Std.U64 := {
  FnMutInst :=
    backend.serial.u64.field.FieldElement51.from_bytes.closure.Insts.CoreOpsFunctionFnMutTupleSharedSliceU8U64
  call :=
    backend.serial.u64.field.FieldElement51.from_bytes.closure.Insts.CoreOpsFunctionFnTupleSharedSliceU8U64.call
}

/-- [curve25519_dalek::backend::serial::u64::scalar::{impl core::ops::index::Index<usize, u64> for curve25519_dalek::backend::serial::u64::scalar::Scalar52}::index]:
    Source: 'curve25519-dalek/src/backend/serial/u64/scalar.rs', lines 42:4-44:5
    Visibility: public -/
def backend.serial.u64.scalar.Scalar52.Insts.CoreOpsIndexIndexUsizeU64.index
  (self : backend.serial.u64.scalar.Scalar52) (_index : Std.Usize) :
  Result Std.U64
  := do
  Array.index_usize self _index

/-- [curve25519_dalek::backend::serial::u64::scalar::{impl core::ops::index::IndexMut<usize, u64> for curve25519_dalek::backend::serial::u64::scalar::Scalar52}::index_mut]:
    Source: 'curve25519-dalek/src/backend/serial/u64/scalar.rs', lines 48:4-50:5
    Visibility: public -/
def
  backend.serial.u64.scalar.Scalar52.Insts.CoreOpsIndexIndexMutUsizeU64.index_mut
  (self : backend.serial.u64.scalar.Scalar52) (_index : Std.Usize) :
  Result (Std.U64 × (Std.U64 → backend.serial.u64.scalar.Scalar52))
  := do
  let (i, index_mut_back) ← Array.index_mut_usize self _index
  let back := fun i1 => let a := index_mut_back i1
                        a
  ok (i, back)

/-- [curve25519_dalek::backend::serial::u64::scalar::m]:
    Source: 'curve25519-dalek/src/backend/serial/u64/scalar.rs', lines 55:0-57:1 -/
def backend.serial.u64.scalar.m
  (x : Std.U64) (y : Std.U64) : Result Std.U128 := do
  let i ← lift (UScalar.cast .U128 x)
  let i1 ← lift (UScalar.cast .U128 y)
  i * i1

/-- [curve25519_dalek::backend::serial::u64::scalar::{curve25519_dalek::backend::serial::u64::scalar::Scalar52}::ZERO]
    Source: 'curve25519-dalek/src/backend/serial/u64/scalar.rs', lines 61:4-61:57
    Visibility: public -/
@[global_simps, irreducible]
def backend.serial.u64.scalar.Scalar52.ZERO
  : backend.serial.u64.scalar.Scalar52 :=
  let a := Array.repeat 5#usize 0#u64
  a

/-- [curve25519_dalek::backend::serial::u64::scalar::{curve25519_dalek::backend::serial::u64::scalar::Scalar52}::from_bytes]: loop body 1:
    Source: 'curve25519-dalek/src/backend/serial/u64/scalar.rs', lines 68:12-70:13
    Visibility: public -/
@[rust_loop_body]
def backend.serial.u64.scalar.Scalar52.from_bytes_loop0_loop0.body
  (bytes : Array Std.U8 32#usize) (i : Std.Usize)
  (iter : core.ops.range.Range Std.Usize) (words : Array Std.U64 4#usize) :
  Result (ControlFlow ((core.ops.range.Range Std.Usize) × (Array Std.U64
    4#usize)) (Array Std.U64 4#usize))
  := do
  let (o, iter1) ←
    core.iter.range.IteratorRange.next core.iter.range.StepUsize iter
  match o with
  | none => ok (done words)
  | some j =>
    let i1 ← i * 8#usize
    let i2 ← i1 + j
    let i3 ← Array.index_usize bytes i2
    let i4 ← lift (UScalar.cast .U64 i3)
    let i5 ← j * 8#usize
    let i6 ← i4 <<< i5
    let i7 ← Array.index_usize words i
    let i8 ← lift (i7 ||| i6)
    let a ← Array.update words i i8
    ok (cont (iter1, a))

/-- [curve25519_dalek::backend::serial::u64::scalar::{curve25519_dalek::backend::serial::u64::scalar::Scalar52}::from_bytes]: loop 1:
    Source: 'curve25519-dalek/src/backend/serial/u64/scalar.rs', lines 68:12-70:13
    Visibility: public -/
@[rust_loop]
def backend.serial.u64.scalar.Scalar52.from_bytes_loop0_loop0
  (iter : core.ops.range.Range Std.Usize) (bytes : Array Std.U8 32#usize)
  (words : Array Std.U64 4#usize) (i : Std.Usize) :
  Result (Array Std.U64 4#usize)
  := do
  loop
    (fun (iter1, words1) =>
      backend.serial.u64.scalar.Scalar52.from_bytes_loop0_loop0.body bytes i
      iter1 words1)
    (iter, words)

/-- [curve25519_dalek::backend::serial::u64::scalar::{curve25519_dalek::backend::serial::u64::scalar::Scalar52}::from_bytes]: loop body 0:
    Source: 'curve25519-dalek/src/backend/serial/u64/scalar.rs', lines 67:8-71:9
    Visibility: public -/
@[rust_loop_body]
def backend.serial.u64.scalar.Scalar52.from_bytes_loop0.body
  (bytes : Array Std.U8 32#usize) (iter : core.ops.range.Range Std.Usize)
  (words : Array Std.U64 4#usize) :
  Result (ControlFlow ((core.ops.range.Range Std.Usize) × (Array Std.U64
    4#usize)) (Array Std.U64 4#usize))
  := do
  let (o, iter1) ←
    core.iter.range.IteratorRange.next core.iter.range.StepUsize iter
  match o with
  | none => ok (done words)
  | some i =>
    let words1 ←
      backend.serial.u64.scalar.Scalar52.from_bytes_loop0_loop0
        { start := 0#usize, «end» := 8#usize } bytes words i
    ok (cont (iter1, words1))

/-- [curve25519_dalek::backend::serial::u64::scalar::{curve25519_dalek::backend::serial::u64::scalar::Scalar52}::from_bytes]: loop 0:
    Source: 'curve25519-dalek/src/backend/serial/u64/scalar.rs', lines 67:8-71:9
    Visibility: public -/
@[rust_loop]
def backend.serial.u64.scalar.Scalar52.from_bytes_loop0
  (iter : core.ops.range.Range Std.Usize) (bytes : Array Std.U8 32#usize)
  (words : Array Std.U64 4#usize) :
  Result (Array Std.U64 4#usize)
  := do
  loop
    (fun (iter1, words1) =>
      backend.serial.u64.scalar.Scalar52.from_bytes_loop0.body bytes iter1
      words1)
    (iter, words)

/-- [curve25519_dalek::backend::serial::u64::scalar::{curve25519_dalek::backend::serial::u64::scalar::Scalar52}::from_bytes]:
    Source: 'curve25519-dalek/src/backend/serial/u64/scalar.rs', lines 65:4-84:5
    Visibility: public -/
def backend.serial.u64.scalar.Scalar52.from_bytes
  (bytes : Array Std.U8 32#usize) :
  Result backend.serial.u64.scalar.Scalar52
  := do
  let words := Array.repeat 4#usize 0#u64
  let words1 ←
    backend.serial.u64.scalar.Scalar52.from_bytes_loop0
      { start := 0#usize, «end» := 4#usize } bytes words
  let i ← 1#u64 <<< 52#i32
  let mask ← i - 1#u64
  let i1 ← 1#u64 <<< 48#i32
  let top_mask ← i1 - 1#u64
  let i2 ← Array.index_usize words1 0#usize
  let (_, index_mut_back) ←
    backend.serial.u64.scalar.Scalar52.Insts.CoreOpsIndexIndexMutUsizeU64.index_mut
      backend.serial.u64.scalar.Scalar52.ZERO 0#usize
  let i3 ← lift (i2 &&& mask)
  let i4 ← i2 >>> 52#i32
  let i5 ← Array.index_usize words1 1#usize
  let i6 ← i5 <<< 12#i32
  let i7 ← lift (i4 ||| i6)
  let s := index_mut_back i3
  let (_, index_mut_back1) ←
    backend.serial.u64.scalar.Scalar52.Insts.CoreOpsIndexIndexMutUsizeU64.index_mut
      s 1#usize
  let i8 ← lift (i7 &&& mask)
  let i9 ← i5 >>> 40#i32
  let i10 ← Array.index_usize words1 2#usize
  let i11 ← i10 <<< 24#i32
  let i12 ← lift (i9 ||| i11)
  let s1 := index_mut_back1 i8
  let (_, index_mut_back2) ←
    backend.serial.u64.scalar.Scalar52.Insts.CoreOpsIndexIndexMutUsizeU64.index_mut
      s1 2#usize
  let i13 ← lift (i12 &&& mask)
  let i14 ← i10 >>> 28#i32
  let i15 ← Array.index_usize words1 3#usize
  let i16 ← i15 <<< 36#i32
  let i17 ← lift (i14 ||| i16)
  let s2 := index_mut_back2 i13
  let (_, index_mut_back3) ←
    backend.serial.u64.scalar.Scalar52.Insts.CoreOpsIndexIndexMutUsizeU64.index_mut
      s2 3#usize
  let i18 ← lift (i17 &&& mask)
  let i19 ← i15 >>> 16#i32
  let s3 := index_mut_back3 i18
  let (_, index_mut_back4) ←
    backend.serial.u64.scalar.Scalar52.Insts.CoreOpsIndexIndexMutUsizeU64.index_mut
      s3 4#usize
  let i20 ← lift (i19 &&& top_mask)
  ok (index_mut_back4 i20)

/-- [curve25519_dalek::backend::serial::u64::scalar::{curve25519_dalek::backend::serial::u64::scalar::Scalar52}::split_words_lo]:
    Source: 'curve25519-dalek/src/backend/serial/u64/scalar.rs', lines 95:4-104:5 -/
def backend.serial.u64.scalar.Scalar52.split_words_lo
  (words : Array Std.U64 8#usize) :
  Result backend.serial.u64.scalar.Scalar52
  := do
  let i ← 1#u64 <<< 52#i32
  let mask ← i - 1#u64
  let i1 ← Array.index_usize words 0#usize
  let i2 ← lift (i1 &&& mask)
  let i3 ← i1 >>> 52#i32
  let i4 ← Array.index_usize words 1#usize
  let i5 ← i4 <<< 12#i32
  let i6 ← lift (i3 ||| i5)
  let i7 ← lift (i6 &&& mask)
  let i8 ← i4 >>> 40#i32
  let i9 ← Array.index_usize words 2#usize
  let i10 ← i9 <<< 24#i32
  let i11 ← lift (i8 ||| i10)
  let i12 ← lift (i11 &&& mask)
  let i13 ← i9 >>> 28#i32
  let i14 ← Array.index_usize words 3#usize
  let i15 ← i14 <<< 36#i32
  let i16 ← lift (i13 ||| i15)
  let i17 ← lift (i16 &&& mask)
  let i18 ← i14 >>> 16#i32
  let i19 ← Array.index_usize words 4#usize
  let i20 ← i19 <<< 48#i32
  let i21 ← lift (i18 ||| i20)
  let i22 ← lift (i21 &&& mask)
  ok (Array.make 5#usize [ i2, i7, i12, i17, i22 ])

/-- [curve25519_dalek::backend::serial::u64::scalar::{curve25519_dalek::backend::serial::u64::scalar::Scalar52}::split_words_hi]:
    Source: 'curve25519-dalek/src/backend/serial/u64/scalar.rs', lines 107:4-116:5 -/
def backend.serial.u64.scalar.Scalar52.split_words_hi
  (words : Array Std.U64 8#usize) :
  Result backend.serial.u64.scalar.Scalar52
  := do
  let i ← 1#u64 <<< 52#i32
  let mask ← i - 1#u64
  let i1 ← Array.index_usize words 4#usize
  let i2 ← i1 >>> 4#i32
  let i3 ← lift (i2 &&& mask)
  let i4 ← i1 >>> 56#i32
  let i5 ← Array.index_usize words 5#usize
  let i6 ← i5 <<< 8#i32
  let i7 ← lift (i4 ||| i6)
  let i8 ← lift (i7 &&& mask)
  let i9 ← i5 >>> 44#i32
  let i10 ← Array.index_usize words 6#usize
  let i11 ← i10 <<< 20#i32
  let i12 ← lift (i9 ||| i11)
  let i13 ← lift (i12 &&& mask)
  let i14 ← i10 >>> 32#i32
  let i15 ← Array.index_usize words 7#usize
  let i16 ← i15 <<< 32#i32
  let i17 ← lift (i14 ||| i16)
  let i18 ← lift (i17 &&& mask)
  let i19 ← i15 >>> 20#i32
  let i20 ← lift (i19 &&& mask)
  ok (Array.make 5#usize [ i3, i8, i13, i18, i20 ])

/-- [curve25519_dalek::backend::serial::u64::scalar::{curve25519_dalek::backend::serial::u64::scalar::Scalar52}::from_bytes_wide_parts]: loop body 1:
    Source: 'curve25519-dalek/src/backend/serial/u64/scalar.rs', lines 129:12-131:13 -/
@[rust_loop_body]
def backend.serial.u64.scalar.Scalar52.from_bytes_wide_parts_loop0_loop0.body
  (bytes : Array Std.U8 64#usize) (i : Std.Usize)
  (iter : core.ops.range.Range Std.Usize) (words : Array Std.U64 8#usize) :
  Result (ControlFlow ((core.ops.range.Range Std.Usize) × (Array Std.U64
    8#usize)) (Array Std.U64 8#usize))
  := do
  let (o, iter1) ←
    core.iter.range.IteratorRange.next core.iter.range.StepUsize iter
  match o with
  | none => ok (done words)
  | some j =>
    let i1 ← i * 8#usize
    let i2 ← i1 + j
    let i3 ← Array.index_usize bytes i2
    let i4 ← lift (UScalar.cast .U64 i3)
    let i5 ← j * 8#usize
    let i6 ← i4 <<< i5
    let i7 ← Array.index_usize words i
    let i8 ← lift (i7 ||| i6)
    let a ← Array.update words i i8
    ok (cont (iter1, a))

/-- [curve25519_dalek::backend::serial::u64::scalar::{curve25519_dalek::backend::serial::u64::scalar::Scalar52}::from_bytes_wide_parts]: loop 1:
    Source: 'curve25519-dalek/src/backend/serial/u64/scalar.rs', lines 129:12-131:13 -/
@[rust_loop]
def backend.serial.u64.scalar.Scalar52.from_bytes_wide_parts_loop0_loop0
  (iter : core.ops.range.Range Std.Usize) (bytes : Array Std.U8 64#usize)
  (words : Array Std.U64 8#usize) (i : Std.Usize) :
  Result (Array Std.U64 8#usize)
  := do
  loop
    (fun (iter1, words1) =>
      backend.serial.u64.scalar.Scalar52.from_bytes_wide_parts_loop0_loop0.body
      bytes i iter1 words1)
    (iter, words)

/-- [curve25519_dalek::backend::serial::u64::scalar::{curve25519_dalek::backend::serial::u64::scalar::Scalar52}::from_bytes_wide_parts]: loop body 0:
    Source: 'curve25519-dalek/src/backend/serial/u64/scalar.rs', lines 128:8-132:9 -/
@[rust_loop_body]
def backend.serial.u64.scalar.Scalar52.from_bytes_wide_parts_loop0.body
  (bytes : Array Std.U8 64#usize) (iter : core.ops.range.Range Std.Usize)
  (words : Array Std.U64 8#usize) :
  Result (ControlFlow ((core.ops.range.Range Std.Usize) × (Array Std.U64
    8#usize)) (Array Std.U64 8#usize))
  := do
  let (o, iter1) ←
    core.iter.range.IteratorRange.next core.iter.range.StepUsize iter
  match o with
  | none => ok (done words)
  | some i =>
    let words1 ←
      backend.serial.u64.scalar.Scalar52.from_bytes_wide_parts_loop0_loop0
        { start := 0#usize, «end» := 8#usize } bytes words i
    ok (cont (iter1, words1))

/-- [curve25519_dalek::backend::serial::u64::scalar::{curve25519_dalek::backend::serial::u64::scalar::Scalar52}::from_bytes_wide_parts]: loop 0:
    Source: 'curve25519-dalek/src/backend/serial/u64/scalar.rs', lines 128:8-132:9 -/
@[rust_loop]
def backend.serial.u64.scalar.Scalar52.from_bytes_wide_parts_loop0
  (iter : core.ops.range.Range Std.Usize) (bytes : Array Std.U8 64#usize)
  (words : Array Std.U64 8#usize) :
  Result (Array Std.U64 8#usize)
  := do
  loop
    (fun (iter1, words1) =>
      backend.serial.u64.scalar.Scalar52.from_bytes_wide_parts_loop0.body bytes
      iter1 words1)
    (iter, words)

/-- [curve25519_dalek::backend::serial::u64::scalar::{curve25519_dalek::backend::serial::u64::scalar::Scalar52}::from_bytes_wide_parts]:
    Source: 'curve25519-dalek/src/backend/serial/u64/scalar.rs', lines 126:4-134:5 -/
def backend.serial.u64.scalar.Scalar52.from_bytes_wide_parts
  (bytes : Array Std.U8 64#usize) :
  Result (backend.serial.u64.scalar.Scalar52 ×
    backend.serial.u64.scalar.Scalar52)
  := do
  let words := Array.repeat 8#usize 0#u64
  let words1 ←
    backend.serial.u64.scalar.Scalar52.from_bytes_wide_parts_loop0
      { start := 0#usize, «end» := 8#usize } bytes words
  let s ← backend.serial.u64.scalar.Scalar52.split_words_lo words1
  let s1 ← backend.serial.u64.scalar.Scalar52.split_words_hi words1
  ok (s, s1)

/-- [curve25519_dalek::backend::serial::u64::scalar::{curve25519_dalek::backend::serial::u64::scalar::Scalar52}::montgomery_reduce::part2]:
    Source: 'curve25519-dalek/src/backend/serial/u64/scalar.rs', lines 279:8-282:9 -/
def backend.serial.u64.scalar.Scalar52.montgomery_reduce.part2
  (sum : Std.U128) : Result (Std.U128 × Std.U64) := do
  let i ← lift (UScalar.cast .U64 sum)
  let i1 ← 1#u64 <<< 52#i32
  let i2 ← i1 - 1#u64
  let w ← lift (i &&& i2)
  let i3 ← sum >>> 52#i32
  ok (i3, w)

/-- [curve25519_dalek::backend::serial::u64::scalar::{curve25519_dalek::backend::serial::u64::scalar::Scalar52}::montgomery_reduce::part1]:
    Source: 'curve25519-dalek/src/backend/serial/u64/scalar.rs', lines 273:8-276:9 -/
def backend.serial.u64.scalar.Scalar52.montgomery_reduce.part1
  (sum : Std.U128) : Result (Std.U128 × Std.U64) := do
  let i ← lift (UScalar.cast .U64 sum)
  let i1 ←
    lift (core.num.U64.wrapping_mul i backend.serial.u64.constants.LFACTOR)
  let i2 ← 1#u64 <<< 52#i32
  let i3 ← i2 - 1#u64
  let p ← lift (i1 &&& i3)
  let i4 ←
    backend.serial.u64.scalar.Scalar52.Insts.CoreOpsIndexIndexUsizeU64.index
      backend.serial.u64.constants.L 0#usize
  let i5 ← backend.serial.u64.scalar.m p i4
  let i6 ← sum + i5
  let i7 ← i6 >>> 52#i32
  ok (i7, p)

/-- [curve25519_dalek::backend::serial::u64::scalar::{curve25519_dalek::backend::serial::u64::scalar::Scalar52}::sub]: loop body 0:
    Source: 'curve25519-dalek/src/backend/serial/u64/scalar.rs', lines 208:8-211:9
    Visibility: public -/
@[rust_loop_body]
def backend.serial.u64.scalar.Scalar52.sub_loop0.body
  (a : backend.serial.u64.scalar.Scalar52)
  (b : backend.serial.u64.scalar.Scalar52) (mask : Std.U64)
  (iter : core.ops.range.Range Std.Usize)
  (difference : backend.serial.u64.scalar.Scalar52) (borrow : Std.U64) :
  Result (ControlFlow ((core.ops.range.Range Std.Usize) ×
    backend.serial.u64.scalar.Scalar52 × Std.U64)
    (backend.serial.u64.scalar.Scalar52 × Std.U64))
  := do
  let (o, iter1) ←
    core.iter.range.IteratorRange.next core.iter.range.StepUsize iter
  match o with
  | none => ok (done (difference, borrow))
  | some i =>
    let i1 ←
      backend.serial.u64.scalar.Scalar52.Insts.CoreOpsIndexIndexUsizeU64.index
        a i
    let i2 ←
      backend.serial.u64.scalar.Scalar52.Insts.CoreOpsIndexIndexUsizeU64.index
        b i
    let i3 ← borrow >>> 63#i32
    let i4 ← i2 + i3
    let borrow1 ← lift (core.num.U64.wrapping_sub i1 i4)
    let (_, index_mut_back) ←
      backend.serial.u64.scalar.Scalar52.Insts.CoreOpsIndexIndexMutUsizeU64.index_mut
        difference i
    let i5 ← lift (borrow1 &&& mask)
    let difference1 := index_mut_back i5
    ok (cont (iter1, difference1, borrow1))

/-- [curve25519_dalek::backend::serial::u64::scalar::{curve25519_dalek::backend::serial::u64::scalar::Scalar52}::sub]: loop 0:
    Source: 'curve25519-dalek/src/backend/serial/u64/scalar.rs', lines 208:8-211:9
    Visibility: public -/
@[rust_loop]
def backend.serial.u64.scalar.Scalar52.sub_loop0
  (iter : core.ops.range.Range Std.Usize)
  (a : backend.serial.u64.scalar.Scalar52)
  (b : backend.serial.u64.scalar.Scalar52)
  (difference : backend.serial.u64.scalar.Scalar52) (mask : Std.U64)
  (borrow : Std.U64) :
  Result (backend.serial.u64.scalar.Scalar52 × Std.U64)
  := do
  loop
    (fun (iter1, difference1, borrow1) =>
      backend.serial.u64.scalar.Scalar52.sub_loop0.body a b mask iter1
      difference1 borrow1)
    (iter, difference, borrow)

/-- [curve25519_dalek::backend::serial::u64::scalar::{curve25519_dalek::backend::serial::u64::scalar::Scalar52}::sub]: loop body 1:
    Source: 'curve25519-dalek/src/backend/serial/u64/scalar.rs', lines 0:0-219:9
    Visibility: public -/
@[rust_loop_body]
def backend.serial.u64.scalar.Scalar52.sub_loop1.body
  (mask : Std.U64) (underflow_mask : Std.U64)
  (iter : core.ops.range.Range Std.Usize)
  (difference : backend.serial.u64.scalar.Scalar52) (carry : Std.U64) :
  Result (ControlFlow ((core.ops.range.Range Std.Usize) ×
    backend.serial.u64.scalar.Scalar52 × Std.U64)
    backend.serial.u64.scalar.Scalar52)
  := do
  let (o, iter1) ←
    core.iter.range.IteratorRange.next core.iter.range.StepUsize iter
  match o with
  | none => ok (done difference)
  | some i =>
    let i1 ← carry >>> 52#i32
    let i2 ←
      backend.serial.u64.scalar.Scalar52.Insts.CoreOpsIndexIndexUsizeU64.index
        difference i
    let i3 ← i1 + i2
    let i4 ←
      backend.serial.u64.scalar.Scalar52.Insts.CoreOpsIndexIndexUsizeU64.index
        backend.serial.u64.constants.L i
    let i5 ← lift (i4 &&& underflow_mask)
    let carry1 ← i3 + i5
    let (_, index_mut_back) ←
      backend.serial.u64.scalar.Scalar52.Insts.CoreOpsIndexIndexMutUsizeU64.index_mut
        difference i
    let i6 ← lift (carry1 &&& mask)
    let difference1 := index_mut_back i6
    ok (cont (iter1, difference1, carry1))

/-- [curve25519_dalek::backend::serial::u64::scalar::{curve25519_dalek::backend::serial::u64::scalar::Scalar52}::sub]: loop 1:
    Source: 'curve25519-dalek/src/backend/serial/u64/scalar.rs', lines 0:0-219:9
    Visibility: public -/
@[rust_loop]
def backend.serial.u64.scalar.Scalar52.sub_loop1
  (iter : core.ops.range.Range Std.Usize)
  (difference : backend.serial.u64.scalar.Scalar52) (mask : Std.U64)
  (underflow_mask : Std.U64) (carry : Std.U64) :
  Result backend.serial.u64.scalar.Scalar52
  := do
  loop
    (fun (iter1, difference1, carry1) =>
      backend.serial.u64.scalar.Scalar52.sub_loop1.body mask underflow_mask
      iter1 difference1 carry1)
    (iter, difference, carry)

/-- [curve25519_dalek::backend::serial::u64::scalar::{curve25519_dalek::backend::serial::u64::scalar::Scalar52}::sub]:
    Source: 'curve25519-dalek/src/backend/serial/u64/scalar.rs', lines 202:4-222:5
    Visibility: public -/
def backend.serial.u64.scalar.Scalar52.sub
  (a : backend.serial.u64.scalar.Scalar52)
  (b : backend.serial.u64.scalar.Scalar52) :
  Result backend.serial.u64.scalar.Scalar52
  := do
  let i ← 1#u64 <<< 52#i32
  let mask ← i - 1#u64
  let (difference, borrow) ←
    backend.serial.u64.scalar.Scalar52.sub_loop0
      { start := 0#usize, «end» := 5#usize } a b
      backend.serial.u64.scalar.Scalar52.ZERO mask 0#u64
  let i1 ← borrow >>> 63#i32
  let i2 ← lift (i1 ^^^ 1#u64)
  let underflow_mask ← lift (core.num.U64.wrapping_sub i2 1#u64)
  backend.serial.u64.scalar.Scalar52.sub_loop1
    { start := 0#usize, «end» := 5#usize } difference mask underflow_mask
    0#u64

/-- [curve25519_dalek::backend::serial::u64::scalar::{curve25519_dalek::backend::serial::u64::scalar::Scalar52}::montgomery_reduce]:
    Source: 'curve25519-dalek/src/backend/serial/u64/scalar.rs', lines 270:4-303:5 -/
def backend.serial.u64.scalar.Scalar52.montgomery_reduce
  (limbs : Array Std.U128 9#usize) :
  Result backend.serial.u64.scalar.Scalar52
  := do
  let i ← Array.index_usize limbs 0#usize
  let (carry, n0) ←
    backend.serial.u64.scalar.Scalar52.montgomery_reduce.part1 i
  let i1 ← Array.index_usize limbs 1#usize
  let i2 ← carry + i1
  let i3 ←
    backend.serial.u64.scalar.Scalar52.Insts.CoreOpsIndexIndexUsizeU64.index
      backend.serial.u64.constants.L 1#usize
  let i4 ← backend.serial.u64.scalar.m n0 i3
  let i5 ← i2 + i4
  let (carry1, n1) ←
    backend.serial.u64.scalar.Scalar52.montgomery_reduce.part1 i5
  let i6 ← Array.index_usize limbs 2#usize
  let i7 ← carry1 + i6
  let i8 ←
    backend.serial.u64.scalar.Scalar52.Insts.CoreOpsIndexIndexUsizeU64.index
      backend.serial.u64.constants.L 2#usize
  let i9 ← backend.serial.u64.scalar.m n0 i8
  let i10 ← i7 + i9
  let i11 ← backend.serial.u64.scalar.m n1 i3
  let i12 ← i10 + i11
  let (carry2, n2) ←
    backend.serial.u64.scalar.Scalar52.montgomery_reduce.part1 i12
  let i13 ← Array.index_usize limbs 3#usize
  let i14 ← carry2 + i13
  let i15 ← backend.serial.u64.scalar.m n1 i8
  let i16 ← i14 + i15
  let i17 ← backend.serial.u64.scalar.m n2 i3
  let i18 ← i16 + i17
  let (carry3, n3) ←
    backend.serial.u64.scalar.Scalar52.montgomery_reduce.part1 i18
  let i19 ← Array.index_usize limbs 4#usize
  let i20 ← carry3 + i19
  let i21 ←
    backend.serial.u64.scalar.Scalar52.Insts.CoreOpsIndexIndexUsizeU64.index
      backend.serial.u64.constants.L 4#usize
  let i22 ← backend.serial.u64.scalar.m n0 i21
  let i23 ← i20 + i22
  let i24 ← backend.serial.u64.scalar.m n2 i8
  let i25 ← i23 + i24
  let i26 ← backend.serial.u64.scalar.m n3 i3
  let i27 ← i25 + i26
  let (carry4, n4) ←
    backend.serial.u64.scalar.Scalar52.montgomery_reduce.part1 i27
  let i28 ← Array.index_usize limbs 5#usize
  let i29 ← carry4 + i28
  let i30 ← backend.serial.u64.scalar.m n1 i21
  let i31 ← i29 + i30
  let i32 ← backend.serial.u64.scalar.m n3 i8
  let i33 ← i31 + i32
  let i34 ← backend.serial.u64.scalar.m n4 i3
  let i35 ← i33 + i34
  let (carry5, r0) ←
    backend.serial.u64.scalar.Scalar52.montgomery_reduce.part2 i35
  let i36 ← Array.index_usize limbs 6#usize
  let i37 ← carry5 + i36
  let i38 ← backend.serial.u64.scalar.m n2 i21
  let i39 ← i37 + i38
  let i40 ← backend.serial.u64.scalar.m n4 i8
  let i41 ← i39 + i40
  let (carry6, r1) ←
    backend.serial.u64.scalar.Scalar52.montgomery_reduce.part2 i41
  let i42 ← Array.index_usize limbs 7#usize
  let i43 ← carry6 + i42
  let i44 ← backend.serial.u64.scalar.m n3 i21
  let i45 ← i43 + i44
  let (carry7, r2) ←
    backend.serial.u64.scalar.Scalar52.montgomery_reduce.part2 i45
  let i46 ← Array.index_usize limbs 8#usize
  let i47 ← carry7 + i46
  let i48 ← backend.serial.u64.scalar.m n4 i21
  let i49 ← i47 + i48
  let (carry8, r3) ←
    backend.serial.u64.scalar.Scalar52.montgomery_reduce.part2 i49
  let r4 ← lift (UScalar.cast .U64 carry8)
  backend.serial.u64.scalar.Scalar52.sub
    (Array.make 5#usize [ r0, r1, r2, r3, r4 ]) backend.serial.u64.constants.L

/-- [curve25519_dalek::backend::serial::u64::scalar::{curve25519_dalek::backend::serial::u64::scalar::Scalar52}::mul_internal]:
    Source: 'curve25519-dalek/src/backend/serial/u64/scalar.rs', lines 227:4-241:5 -/
def backend.serial.u64.scalar.Scalar52.mul_internal
  (a : backend.serial.u64.scalar.Scalar52)
  (b : backend.serial.u64.scalar.Scalar52) :
  Result (Array Std.U128 9#usize)
  := do
  let z := Array.repeat 9#usize 0#u128
  let i ←
    backend.serial.u64.scalar.Scalar52.Insts.CoreOpsIndexIndexUsizeU64.index a
      0#usize
  let i1 ←
    backend.serial.u64.scalar.Scalar52.Insts.CoreOpsIndexIndexUsizeU64.index b
      0#usize
  let i2 ← backend.serial.u64.scalar.m i i1
  let z1 ← Array.update z 0#usize i2
  let i3 ←
    backend.serial.u64.scalar.Scalar52.Insts.CoreOpsIndexIndexUsizeU64.index b
      1#usize
  let i4 ← backend.serial.u64.scalar.m i i3
  let i5 ←
    backend.serial.u64.scalar.Scalar52.Insts.CoreOpsIndexIndexUsizeU64.index a
      1#usize
  let i6 ← backend.serial.u64.scalar.m i5 i1
  let i7 ← i4 + i6
  let z2 ← Array.update z1 1#usize i7
  let i8 ←
    backend.serial.u64.scalar.Scalar52.Insts.CoreOpsIndexIndexUsizeU64.index b
      2#usize
  let i9 ← backend.serial.u64.scalar.m i i8
  let i10 ← backend.serial.u64.scalar.m i5 i3
  let i11 ← i9 + i10
  let i12 ←
    backend.serial.u64.scalar.Scalar52.Insts.CoreOpsIndexIndexUsizeU64.index a
      2#usize
  let i13 ← backend.serial.u64.scalar.m i12 i1
  let i14 ← i11 + i13
  let z3 ← Array.update z2 2#usize i14
  let i15 ←
    backend.serial.u64.scalar.Scalar52.Insts.CoreOpsIndexIndexUsizeU64.index b
      3#usize
  let i16 ← backend.serial.u64.scalar.m i i15
  let i17 ← backend.serial.u64.scalar.m i5 i8
  let i18 ← i16 + i17
  let i19 ← backend.serial.u64.scalar.m i12 i3
  let i20 ← i18 + i19
  let i21 ←
    backend.serial.u64.scalar.Scalar52.Insts.CoreOpsIndexIndexUsizeU64.index a
      3#usize
  let i22 ← backend.serial.u64.scalar.m i21 i1
  let i23 ← i20 + i22
  let z4 ← Array.update z3 3#usize i23
  let i24 ←
    backend.serial.u64.scalar.Scalar52.Insts.CoreOpsIndexIndexUsizeU64.index b
      4#usize
  let i25 ← backend.serial.u64.scalar.m i i24
  let i26 ← backend.serial.u64.scalar.m i5 i15
  let i27 ← i25 + i26
  let i28 ← backend.serial.u64.scalar.m i12 i8
  let i29 ← i27 + i28
  let i30 ← backend.serial.u64.scalar.m i21 i3
  let i31 ← i29 + i30
  let i32 ←
    backend.serial.u64.scalar.Scalar52.Insts.CoreOpsIndexIndexUsizeU64.index a
      4#usize
  let i33 ← backend.serial.u64.scalar.m i32 i1
  let i34 ← i31 + i33
  let z5 ← Array.update z4 4#usize i34
  let i35 ← backend.serial.u64.scalar.m i5 i24
  let i36 ← backend.serial.u64.scalar.m i12 i15
  let i37 ← i35 + i36
  let i38 ← backend.serial.u64.scalar.m i21 i8
  let i39 ← i37 + i38
  let i40 ← backend.serial.u64.scalar.m i32 i3
  let i41 ← i39 + i40
  let z6 ← Array.update z5 5#usize i41
  let i42 ← backend.serial.u64.scalar.m i12 i24
  let i43 ← backend.serial.u64.scalar.m i21 i15
  let i44 ← i42 + i43
  let i45 ← backend.serial.u64.scalar.m i32 i8
  let i46 ← i44 + i45
  let z7 ← Array.update z6 6#usize i46
  let i47 ← backend.serial.u64.scalar.m i21 i24
  let i48 ← backend.serial.u64.scalar.m i32 i15
  let i49 ← i47 + i48
  let z8 ← Array.update z7 7#usize i49
  let i50 ← backend.serial.u64.scalar.m i32 i24
  Array.update z8 8#usize i50

/-- [curve25519_dalek::backend::serial::u64::scalar::{curve25519_dalek::backend::serial::u64::scalar::Scalar52}::montgomery_mul]:
    Source: 'curve25519-dalek/src/backend/serial/u64/scalar.rs', lines 322:4-324:5
    Visibility: public -/
def backend.serial.u64.scalar.Scalar52.montgomery_mul
  (a : backend.serial.u64.scalar.Scalar52)
  (b : backend.serial.u64.scalar.Scalar52) :
  Result backend.serial.u64.scalar.Scalar52
  := do
  let a1 ← backend.serial.u64.scalar.Scalar52.mul_internal a b
  backend.serial.u64.scalar.Scalar52.montgomery_reduce a1

/-- [curve25519_dalek::backend::serial::u64::scalar::{curve25519_dalek::backend::serial::u64::scalar::Scalar52}::add]: loop body 0:
    Source: 'curve25519-dalek/src/backend/serial/u64/scalar.rs', lines 192:8-195:9
    Visibility: public -/
@[rust_loop_body]
def backend.serial.u64.scalar.Scalar52.add_loop.body
  (a : backend.serial.u64.scalar.Scalar52)
  (b : backend.serial.u64.scalar.Scalar52) (mask : Std.U64)
  (iter : core.ops.range.Range Std.Usize)
  (sum : backend.serial.u64.scalar.Scalar52) (carry : Std.U64) :
  Result (ControlFlow ((core.ops.range.Range Std.Usize) ×
    backend.serial.u64.scalar.Scalar52 × Std.U64)
    backend.serial.u64.scalar.Scalar52)
  := do
  let (o, iter1) ←
    core.iter.range.IteratorRange.next core.iter.range.StepUsize iter
  match o with
  | none => ok (done sum)
  | some i =>
    let i1 ←
      backend.serial.u64.scalar.Scalar52.Insts.CoreOpsIndexIndexUsizeU64.index
        a i
    let i2 ←
      backend.serial.u64.scalar.Scalar52.Insts.CoreOpsIndexIndexUsizeU64.index
        b i
    let i3 ← i1 + i2
    let i4 ← carry >>> 52#i32
    let carry1 ← i3 + i4
    let (_, index_mut_back) ←
      backend.serial.u64.scalar.Scalar52.Insts.CoreOpsIndexIndexMutUsizeU64.index_mut
        sum i
    let i5 ← lift (carry1 &&& mask)
    let sum1 := index_mut_back i5
    ok (cont (iter1, sum1, carry1))

/-- [curve25519_dalek::backend::serial::u64::scalar::{curve25519_dalek::backend::serial::u64::scalar::Scalar52}::add]: loop 0:
    Source: 'curve25519-dalek/src/backend/serial/u64/scalar.rs', lines 192:8-195:9
    Visibility: public -/
@[rust_loop]
def backend.serial.u64.scalar.Scalar52.add_loop
  (iter : core.ops.range.Range Std.Usize)
  (a : backend.serial.u64.scalar.Scalar52)
  (b : backend.serial.u64.scalar.Scalar52)
  (sum : backend.serial.u64.scalar.Scalar52) (mask : Std.U64) (carry : Std.U64)
  :
  Result backend.serial.u64.scalar.Scalar52
  := do
  loop
    (fun (iter1, sum1, carry1) =>
      backend.serial.u64.scalar.Scalar52.add_loop.body a b mask iter1 sum1
      carry1)
    (iter, sum, carry)

/-- [curve25519_dalek::backend::serial::u64::scalar::{curve25519_dalek::backend::serial::u64::scalar::Scalar52}::add]:
    Source: 'curve25519-dalek/src/backend/serial/u64/scalar.rs', lines 186:4-199:5
    Visibility: public -/
def backend.serial.u64.scalar.Scalar52.add
  (a : backend.serial.u64.scalar.Scalar52)
  (b : backend.serial.u64.scalar.Scalar52) :
  Result backend.serial.u64.scalar.Scalar52
  := do
  let i ← 1#u64 <<< 52#i32
  let mask ← i - 1#u64
  let sum ←
    backend.serial.u64.scalar.Scalar52.add_loop
      { start := 0#usize, «end» := 5#usize } a b
      backend.serial.u64.scalar.Scalar52.ZERO mask 0#u64
  backend.serial.u64.scalar.Scalar52.sub sum backend.serial.u64.constants.L

/-- [curve25519_dalek::backend::serial::u64::scalar::{curve25519_dalek::backend::serial::u64::scalar::Scalar52}::from_bytes_wide]:
    Source: 'curve25519-dalek/src/backend/serial/u64/scalar.rs', lines 136:4-141:5
    Visibility: public -/
def backend.serial.u64.scalar.Scalar52.from_bytes_wide
  (bytes : Array Std.U8 64#usize) :
  Result backend.serial.u64.scalar.Scalar52
  := do
  let (lo, hi) ←
    backend.serial.u64.scalar.Scalar52.from_bytes_wide_parts bytes
  let lo1 ←
    backend.serial.u64.scalar.Scalar52.montgomery_mul lo
      backend.serial.u64.constants.R
  let hi1 ←
    backend.serial.u64.scalar.Scalar52.montgomery_mul hi
      backend.serial.u64.constants.RR
  backend.serial.u64.scalar.Scalar52.add hi1 lo1

/-- [curve25519_dalek::backend::serial::u64::scalar::{curve25519_dalek::backend::serial::u64::scalar::Scalar52}::as_bytes]:
    Source: 'curve25519-dalek/src/backend/serial/u64/scalar.rs', lines 146:4-183:5
    Visibility: public -/
def backend.serial.u64.scalar.Scalar52.as_bytes
  (self : backend.serial.u64.scalar.Scalar52) :
  Result (Array Std.U8 32#usize)
  := do
  let s := Array.repeat 32#usize 0#u8
  let i ← Array.index_usize self 0#usize
  let i1 ← i >>> 0#i32
  let i2 ← lift (UScalar.cast .U8 i1)
  let s1 ← Array.update s 0#usize i2
  let i3 ← i >>> 8#i32
  let i4 ← lift (UScalar.cast .U8 i3)
  let s2 ← Array.update s1 1#usize i4
  let i5 ← i >>> 16#i32
  let i6 ← lift (UScalar.cast .U8 i5)
  let s3 ← Array.update s2 2#usize i6
  let i7 ← i >>> 24#i32
  let i8 ← lift (UScalar.cast .U8 i7)
  let s4 ← Array.update s3 3#usize i8
  let i9 ← i >>> 32#i32
  let i10 ← lift (UScalar.cast .U8 i9)
  let s5 ← Array.update s4 4#usize i10
  let i11 ← i >>> 40#i32
  let i12 ← lift (UScalar.cast .U8 i11)
  let s6 ← Array.update s5 5#usize i12
  let i13 ← i >>> 48#i32
  let i14 ← Array.index_usize self 1#usize
  let i15 ← i14 <<< 4#i32
  let i16 ← lift (i13 ||| i15)
  let i17 ← lift (UScalar.cast .U8 i16)
  let s7 ← Array.update s6 6#usize i17
  let i18 ← i14 >>> 4#i32
  let i19 ← lift (UScalar.cast .U8 i18)
  let s8 ← Array.update s7 7#usize i19
  let i20 ← i14 >>> 12#i32
  let i21 ← lift (UScalar.cast .U8 i20)
  let s9 ← Array.update s8 8#usize i21
  let i22 ← i14 >>> 20#i32
  let i23 ← lift (UScalar.cast .U8 i22)
  let s10 ← Array.update s9 9#usize i23
  let i24 ← i14 >>> 28#i32
  let i25 ← lift (UScalar.cast .U8 i24)
  let s11 ← Array.update s10 10#usize i25
  let i26 ← i14 >>> 36#i32
  let i27 ← lift (UScalar.cast .U8 i26)
  let s12 ← Array.update s11 11#usize i27
  let i28 ← i14 >>> 44#i32
  let i29 ← lift (UScalar.cast .U8 i28)
  let s13 ← Array.update s12 12#usize i29
  let i30 ← Array.index_usize self 2#usize
  let i31 ← i30 >>> 0#i32
  let i32 ← lift (UScalar.cast .U8 i31)
  let s14 ← Array.update s13 13#usize i32
  let i33 ← i30 >>> 8#i32
  let i34 ← lift (UScalar.cast .U8 i33)
  let s15 ← Array.update s14 14#usize i34
  let i35 ← i30 >>> 16#i32
  let i36 ← lift (UScalar.cast .U8 i35)
  let s16 ← Array.update s15 15#usize i36
  let i37 ← i30 >>> 24#i32
  let i38 ← lift (UScalar.cast .U8 i37)
  let s17 ← Array.update s16 16#usize i38
  let i39 ← i30 >>> 32#i32
  let i40 ← lift (UScalar.cast .U8 i39)
  let s18 ← Array.update s17 17#usize i40
  let i41 ← i30 >>> 40#i32
  let i42 ← lift (UScalar.cast .U8 i41)
  let s19 ← Array.update s18 18#usize i42
  let i43 ← i30 >>> 48#i32
  let i44 ← Array.index_usize self 3#usize
  let i45 ← i44 <<< 4#i32
  let i46 ← lift (i43 ||| i45)
  let i47 ← lift (UScalar.cast .U8 i46)
  let s20 ← Array.update s19 19#usize i47
  let i48 ← i44 >>> 4#i32
  let i49 ← lift (UScalar.cast .U8 i48)
  let s21 ← Array.update s20 20#usize i49
  let i50 ← i44 >>> 12#i32
  let i51 ← lift (UScalar.cast .U8 i50)
  let s22 ← Array.update s21 21#usize i51
  let i52 ← i44 >>> 20#i32
  let i53 ← lift (UScalar.cast .U8 i52)
  let s23 ← Array.update s22 22#usize i53
  let i54 ← i44 >>> 28#i32
  let i55 ← lift (UScalar.cast .U8 i54)
  let s24 ← Array.update s23 23#usize i55
  let i56 ← i44 >>> 36#i32
  let i57 ← lift (UScalar.cast .U8 i56)
  let s25 ← Array.update s24 24#usize i57
  let i58 ← i44 >>> 44#i32
  let i59 ← lift (UScalar.cast .U8 i58)
  let s26 ← Array.update s25 25#usize i59
  let i60 ← Array.index_usize self 4#usize
  let i61 ← i60 >>> 0#i32
  let i62 ← lift (UScalar.cast .U8 i61)
  let s27 ← Array.update s26 26#usize i62
  let i63 ← i60 >>> 8#i32
  let i64 ← lift (UScalar.cast .U8 i63)
  let s28 ← Array.update s27 27#usize i64
  let i65 ← i60 >>> 16#i32
  let i66 ← lift (UScalar.cast .U8 i65)
  let s29 ← Array.update s28 28#usize i66
  let i67 ← i60 >>> 24#i32
  let i68 ← lift (UScalar.cast .U8 i67)
  let s30 ← Array.update s29 29#usize i68
  let i69 ← i60 >>> 32#i32
  let i70 ← lift (UScalar.cast .U8 i69)
  let s31 ← Array.update s30 30#usize i70
  let i71 ← i60 >>> 40#i32
  let i72 ← lift (UScalar.cast .U8 i71)
  Array.update s31 31#usize i72

/-- [curve25519_dalek::backend::serial::u64::scalar::{curve25519_dalek::backend::serial::u64::scalar::Scalar52}::square_internal]:
    Source: 'curve25519-dalek/src/backend/serial/u64/scalar.rs', lines 246:4-265:5 -/
def backend.serial.u64.scalar.Scalar52.square_internal
  (a : backend.serial.u64.scalar.Scalar52) :
  Result (Array Std.U128 9#usize)
  := do
  let i ←
    backend.serial.u64.scalar.Scalar52.Insts.CoreOpsIndexIndexUsizeU64.index a
      0#usize
  let i1 ← i * 2#u64
  let i2 ←
    backend.serial.u64.scalar.Scalar52.Insts.CoreOpsIndexIndexUsizeU64.index a
      1#usize
  let i3 ← i2 * 2#u64
  let i4 ←
    backend.serial.u64.scalar.Scalar52.Insts.CoreOpsIndexIndexUsizeU64.index a
      2#usize
  let i5 ← i4 * 2#u64
  let i6 ←
    backend.serial.u64.scalar.Scalar52.Insts.CoreOpsIndexIndexUsizeU64.index a
      3#usize
  let i7 ← i6 * 2#u64
  let i8 ← backend.serial.u64.scalar.m i i
  let i9 ← Array.index_usize (Array.make 4#usize [ i1, i3, i5, i7 ]) 0#usize
  let i10 ← backend.serial.u64.scalar.m i9 i2
  let i11 ← backend.serial.u64.scalar.m i9 i4
  let i12 ← backend.serial.u64.scalar.m i2 i2
  let i13 ← i11 + i12
  let i14 ← backend.serial.u64.scalar.m i9 i6
  let i15 ← Array.index_usize (Array.make 4#usize [ i1, i3, i5, i7 ]) 1#usize
  let i16 ← backend.serial.u64.scalar.m i15 i4
  let i17 ← i14 + i16
  let i18 ←
    backend.serial.u64.scalar.Scalar52.Insts.CoreOpsIndexIndexUsizeU64.index a
      4#usize
  let i19 ← backend.serial.u64.scalar.m i9 i18
  let i20 ← backend.serial.u64.scalar.m i15 i6
  let i21 ← i19 + i20
  let i22 ← backend.serial.u64.scalar.m i4 i4
  let i23 ← i21 + i22
  let i24 ← backend.serial.u64.scalar.m i15 i18
  let i25 ← Array.index_usize (Array.make 4#usize [ i1, i3, i5, i7 ]) 2#usize
  let i26 ← backend.serial.u64.scalar.m i25 i6
  let i27 ← i24 + i26
  let i28 ← backend.serial.u64.scalar.m i25 i18
  let i29 ← backend.serial.u64.scalar.m i6 i6
  let i30 ← i28 + i29
  let i31 ← Array.index_usize (Array.make 4#usize [ i1, i3, i5, i7 ]) 3#usize
  let i32 ← backend.serial.u64.scalar.m i31 i18
  let i33 ← backend.serial.u64.scalar.m i18 i18
  ok (Array.make 9#usize [ i8, i10, i13, i17, i23, i27, i30, i32, i33 ])

/-- [curve25519_dalek::backend::serial::u64::scalar::{curve25519_dalek::backend::serial::u64::scalar::Scalar52}::mul]:
    Source: 'curve25519-dalek/src/backend/serial/u64/scalar.rs', lines 307:4-310:5
    Visibility: public -/
def backend.serial.u64.scalar.Scalar52.mul
  (a : backend.serial.u64.scalar.Scalar52)
  (b : backend.serial.u64.scalar.Scalar52) :
  Result backend.serial.u64.scalar.Scalar52
  := do
  let a1 ← backend.serial.u64.scalar.Scalar52.mul_internal a b
  let ab ← backend.serial.u64.scalar.Scalar52.montgomery_reduce a1
  let a2 ←
    backend.serial.u64.scalar.Scalar52.mul_internal ab
      backend.serial.u64.constants.RR
  backend.serial.u64.scalar.Scalar52.montgomery_reduce a2

/-- [curve25519_dalek::backend::serial::u64::scalar::{curve25519_dalek::backend::serial::u64::scalar::Scalar52}::square]:
    Source: 'curve25519-dalek/src/backend/serial/u64/scalar.rs', lines 315:4-318:5
    Visibility: public -/
def backend.serial.u64.scalar.Scalar52.square
  (self : backend.serial.u64.scalar.Scalar52) :
  Result backend.serial.u64.scalar.Scalar52
  := do
  let a ← backend.serial.u64.scalar.Scalar52.square_internal self
  let aa ← backend.serial.u64.scalar.Scalar52.montgomery_reduce a
  let a1 ←
    backend.serial.u64.scalar.Scalar52.mul_internal aa
      backend.serial.u64.constants.RR
  backend.serial.u64.scalar.Scalar52.montgomery_reduce a1

/-- [curve25519_dalek::backend::serial::u64::scalar::{curve25519_dalek::backend::serial::u64::scalar::Scalar52}::montgomery_square]:
    Source: 'curve25519-dalek/src/backend/serial/u64/scalar.rs', lines 328:4-330:5
    Visibility: public -/
def backend.serial.u64.scalar.Scalar52.montgomery_square
  (self : backend.serial.u64.scalar.Scalar52) :
  Result backend.serial.u64.scalar.Scalar52
  := do
  let a ← backend.serial.u64.scalar.Scalar52.square_internal self
  backend.serial.u64.scalar.Scalar52.montgomery_reduce a

/-- [curve25519_dalek::backend::serial::u64::scalar::{curve25519_dalek::backend::serial::u64::scalar::Scalar52}::as_montgomery]:
    Source: 'curve25519-dalek/src/backend/serial/u64/scalar.rs', lines 334:4-336:5
    Visibility: public -/
def backend.serial.u64.scalar.Scalar52.as_montgomery
  (self : backend.serial.u64.scalar.Scalar52) :
  Result backend.serial.u64.scalar.Scalar52
  := do
  backend.serial.u64.scalar.Scalar52.montgomery_mul self
    backend.serial.u64.constants.RR

/-- [curve25519_dalek::backend::serial::u64::scalar::{curve25519_dalek::backend::serial::u64::scalar::Scalar52}::from_montgomery]: loop body 0:
    Source: 'curve25519-dalek/src/backend/serial/u64/scalar.rs', lines 343:8-345:9
    Visibility: public -/
@[rust_loop_body]
def backend.serial.u64.scalar.Scalar52.from_montgomery_loop.body
  (self : backend.serial.u64.scalar.Scalar52)
  (iter : core.ops.range.Range Std.Usize) (limbs : Array Std.U128 9#usize) :
  Result (ControlFlow ((core.ops.range.Range Std.Usize) × (Array Std.U128
    9#usize)) (Array Std.U128 9#usize))
  := do
  let (o, iter1) ←
    core.iter.range.IteratorRange.next core.iter.range.StepUsize iter
  match o with
  | none => ok (done limbs)
  | some i =>
    let i1 ←
      backend.serial.u64.scalar.Scalar52.Insts.CoreOpsIndexIndexUsizeU64.index
        self i
    let i2 ← lift (UScalar.cast .U128 i1)
    let a ← Array.update limbs i i2
    ok (cont (iter1, a))

/-- [curve25519_dalek::backend::serial::u64::scalar::{curve25519_dalek::backend::serial::u64::scalar::Scalar52}::from_montgomery]: loop 0:
    Source: 'curve25519-dalek/src/backend/serial/u64/scalar.rs', lines 343:8-345:9
    Visibility: public -/
@[rust_loop]
def backend.serial.u64.scalar.Scalar52.from_montgomery_loop
  (iter : core.ops.range.Range Std.Usize)
  (self : backend.serial.u64.scalar.Scalar52) (limbs : Array Std.U128 9#usize)
  :
  Result (Array Std.U128 9#usize)
  := do
  loop
    (fun (iter1, limbs1) =>
      backend.serial.u64.scalar.Scalar52.from_montgomery_loop.body self iter1
      limbs1)
    (iter, limbs)

/-- [curve25519_dalek::backend::serial::u64::scalar::{curve25519_dalek::backend::serial::u64::scalar::Scalar52}::from_montgomery]:
    Source: 'curve25519-dalek/src/backend/serial/u64/scalar.rs', lines 341:4-347:5
    Visibility: public -/
def backend.serial.u64.scalar.Scalar52.from_montgomery
  (self : backend.serial.u64.scalar.Scalar52) :
  Result backend.serial.u64.scalar.Scalar52
  := do
  let limbs := Array.repeat 9#usize 0#u128
  let limbs1 ←
    backend.serial.u64.scalar.Scalar52.from_montgomery_loop
      { start := 0#usize, «end» := 5#usize } self limbs
  backend.serial.u64.scalar.Scalar52.montgomery_reduce limbs1

/-- [curve25519_dalek::constants::BASEPOINT_ORDER_PRIVATE]
    Source: 'curve25519-dalek/src/constants.rs', lines 77:0-83:2 -/
@[global_simps, irreducible]
def constants.BASEPOINT_ORDER_PRIVATE : scalar.Scalar :=
  {
    bytes :=
      (Array.make 32#usize [
        237#u8, 211#u8, 245#u8, 92#u8, 26#u8, 99#u8, 18#u8, 88#u8, 214#u8,
        156#u8, 247#u8, 162#u8, 222#u8, 249#u8, 222#u8, 20#u8, 0#u8, 0#u8,
        0#u8, 0#u8, 0#u8, 0#u8, 0#u8, 0#u8, 0#u8, 0#u8, 0#u8, 0#u8, 0#u8, 0#u8,
        0#u8, 16#u8
        ])
  }

/-- [curve25519_dalek::edwards::{impl core::clone::Clone for curve25519_dalek::edwards::CompressedEdwardsY}::clone]:
    Source: 'curve25519-dalek/src/edwards.rs', lines 163:15-163:20
    Visibility: public -/
def edwards.CompressedEdwardsY.Insts.CoreCloneClone.clone
  (self : edwards.CompressedEdwardsY) : Result edwards.CompressedEdwardsY := do
  ok self

/-- Trait implementation: [curve25519_dalek::edwards::{impl core::clone::Clone for curve25519_dalek::edwards::CompressedEdwardsY}]
    Source: 'curve25519-dalek/src/edwards.rs', lines 163:15-163:20 -/
@[reducible]
def edwards.CompressedEdwardsY.Insts.CoreCloneClone : core.clone.Clone
  edwards.CompressedEdwardsY := {
  clone := edwards.CompressedEdwardsY.Insts.CoreCloneClone.clone
}

/-- Trait implementation: [curve25519_dalek::edwards::{impl core::marker::Copy for curve25519_dalek::edwards::CompressedEdwardsY}]
    Source: 'curve25519-dalek/src/edwards.rs', lines 163:9-163:13 -/
@[reducible]
def edwards.CompressedEdwardsY.Insts.CoreMarkerCopy : core.marker.Copy
  edwards.CompressedEdwardsY := {
  cloneInst := edwards.CompressedEdwardsY.Insts.CoreCloneClone
}

/-- [curve25519_dalek::edwards::{impl core::cmp::PartialEq<curve25519_dalek::edwards::CompressedEdwardsY> for curve25519_dalek::edwards::CompressedEdwardsY}::eq]:
    Source: 'curve25519-dalek/src/edwards.rs', lines 163:26-163:35
    Visibility: public -/
def edwards.CompressedEdwardsY.Insts.CoreCmpPartialEqCompressedEdwardsY.eq
  (self : edwards.CompressedEdwardsY) (other : edwards.CompressedEdwardsY) :
  Result Bool
  := do
  core.array.equality.PartialEqArray.eq core.cmp.PartialEqU8 self other

/-- Trait implementation: [curve25519_dalek::edwards::{impl core::cmp::PartialEq<curve25519_dalek::edwards::CompressedEdwardsY> for curve25519_dalek::edwards::CompressedEdwardsY}]
    Source: 'curve25519-dalek/src/edwards.rs', lines 163:26-163:35 -/
@[reducible]
def edwards.CompressedEdwardsY.Insts.CoreCmpPartialEqCompressedEdwardsY :
  core.cmp.PartialEq edwards.CompressedEdwardsY edwards.CompressedEdwardsY := {
  eq := edwards.CompressedEdwardsY.Insts.CoreCmpPartialEqCompressedEdwardsY.eq
}

/-- [curve25519_dalek::edwards::{impl core::cmp::Eq for curve25519_dalek::edwards::CompressedEdwardsY}::assert_fields_are_eq]:
    Source: 'curve25519-dalek/src/edwards.rs', lines 163:22-163:24
    Visibility: public -/
def edwards.CompressedEdwardsY.Insts.CoreCmpEq.assert_fields_are_eq
  (self : edwards.CompressedEdwardsY) : Result Unit := do
  ok ()

/-- Trait implementation: [curve25519_dalek::edwards::{impl core::cmp::Eq for curve25519_dalek::edwards::CompressedEdwardsY}]
    Source: 'curve25519-dalek/src/edwards.rs', lines 163:22-163:24 -/
@[reducible]
def edwards.CompressedEdwardsY.Insts.CoreCmpEq : core.cmp.Eq
  edwards.CompressedEdwardsY := {
  partialEqInst :=
    edwards.CompressedEdwardsY.Insts.CoreCmpPartialEqCompressedEdwardsY
  assert_fields_are_eq :=
    edwards.CompressedEdwardsY.Insts.CoreCmpEq.assert_fields_are_eq
}

/-- Trait implementation: [curve25519_dalek::edwards::{impl core::marker::StructuralPartialEq for curve25519_dalek::edwards::CompressedEdwardsY}]
    Source: 'curve25519-dalek/src/edwards.rs', lines 163:26-163:35 -/
@[reducible]
def edwards.CompressedEdwardsY.Insts.CoreMarkerStructuralPartialEq :
  core.marker.StructuralPartialEq edwards.CompressedEdwardsY := {
}

/-- [curve25519_dalek::edwards::{impl core::hash::Hash for curve25519_dalek::edwards::CompressedEdwardsY}::hash]:
    Source: 'curve25519-dalek/src/edwards.rs', lines 163:37-163:41
    Visibility: public -/
def edwards.CompressedEdwardsY.Insts.CoreHashHash.hash
  {__H : Type} (corehashHasherInst : core.hash.Hasher __H)
  (self : edwards.CompressedEdwardsY) (state : __H) :
  Result __H
  := do
  Array.Insts.CoreHashHash.hash U8.Insts.CoreHashHash corehashHasherInst self
    state

/-- Trait implementation: [curve25519_dalek::edwards::{impl core::hash::Hash for curve25519_dalek::edwards::CompressedEdwardsY}]
    Source: 'curve25519-dalek/src/edwards.rs', lines 163:37-163:41 -/
@[reducible]
def edwards.CompressedEdwardsY.Insts.CoreHashHash : core.hash.Hash
  edwards.CompressedEdwardsY := {
  hash := fun {H : Type} (corehashHasherInst : core.hash.Hasher H) =>
    edwards.CompressedEdwardsY.Insts.CoreHashHash.hash corehashHasherInst
}

/-- [curve25519_dalek::edwards::{curve25519_dalek::edwards::CompressedEdwardsY}::as_bytes]:
    Source: 'curve25519-dalek/src/edwards.rs', lines 180:4-182:5
    Visibility: public -/
def edwards.CompressedEdwardsY.as_bytes
  (self : edwards.CompressedEdwardsY) : Result (Array Std.U8 32#usize) := do
  ok self

/-- [curve25519_dalek::edwards::{impl subtle::ConstantTimeEq for curve25519_dalek::edwards::CompressedEdwardsY}::ct_eq]:
    Source: 'curve25519-dalek/src/edwards.rs', lines 167:4-169:5
    Visibility: public -/
def edwards.CompressedEdwardsY.Insts.SubtleConstantTimeEq.ct_eq
  (self : edwards.CompressedEdwardsY) (other : edwards.CompressedEdwardsY) :
  Result subtle.Choice
  := do
  let a ← edwards.CompressedEdwardsY.as_bytes self
  let s ← lift (Array.to_slice a)
  let a1 ← edwards.CompressedEdwardsY.as_bytes other
  let s1 ← lift (Array.to_slice a1)
  Slice.Insts.SubtleConstantTimeEq.ct_eq U8.Insts.SubtleConstantTimeEq s s1

/-- Trait implementation: [curve25519_dalek::edwards::{impl subtle::ConstantTimeEq for curve25519_dalek::edwards::CompressedEdwardsY}]
    Source: 'curve25519-dalek/src/edwards.rs', lines 166:0-170:1 -/
@[reducible]
def edwards.CompressedEdwardsY.Insts.SubtleConstantTimeEq :
  subtle.ConstantTimeEq edwards.CompressedEdwardsY := {
  ct_eq := edwards.CompressedEdwardsY.Insts.SubtleConstantTimeEq.ct_eq
}

/-- [curve25519_dalek::edwards::{impl core::fmt::Debug for curve25519_dalek::edwards::CompressedEdwardsY}::fmt]:
    Source: 'curve25519-dalek/src/edwards.rs', lines 173:4-175:5
    Visibility: public -/
def edwards.CompressedEdwardsY.Insts.CoreFmtDebug.fmt
  (self : edwards.CompressedEdwardsY) (f : core.fmt.Formatter) :
  Result ((core.result.Result Unit core.fmt.Error) × core.fmt.Formatter)
  := do
  let args ← edwards.CompressedEdwardsY.as_bytes self
  let a ←
    core.fmt.rt.Argument.new_debug (core.fmt.DebugShared
      (Array.Insts.CoreFmtDebug 32#usize core.fmt.DebugU8)) args
  let a1 ←
    core.fmt.Arguments.new
      (Array.make 23#usize [
        20#u8, 67#u8, 111#u8, 109#u8, 112#u8, 114#u8, 101#u8, 115#u8, 115#u8,
        101#u8, 100#u8, 69#u8, 100#u8, 119#u8, 97#u8, 114#u8, 100#u8, 115#u8,
        89#u8, 58#u8, 32#u8, 192#u8, 0#u8
        ]) (Array.make 1#usize [ a ])
  core.fmt.Formatter.write_fmt f a1

/-- Trait implementation: [curve25519_dalek::edwards::{impl core::fmt::Debug for curve25519_dalek::edwards::CompressedEdwardsY}]
    Source: 'curve25519-dalek/src/edwards.rs', lines 172:0-176:1 -/
@[reducible]
def edwards.CompressedEdwardsY.Insts.CoreFmtDebug : core.fmt.Debug
  edwards.CompressedEdwardsY := {
  fmt := edwards.CompressedEdwardsY.Insts.CoreFmtDebug.fmt
}

/-- [curve25519_dalek::edwards::{curve25519_dalek::edwards::CompressedEdwardsY}::to_bytes]:
    Source: 'curve25519-dalek/src/edwards.rs', lines 185:4-187:5
    Visibility: public -/
def edwards.CompressedEdwardsY.to_bytes
  (self : edwards.CompressedEdwardsY) : Result (Array Std.U8 32#usize) := do
  ok self

/-- [curve25519_dalek::edwards::decompress::step_2]:
    Source: 'curve25519-dalek/src/edwards.rs', lines 222:4-245:5 -/
def edwards.decompress.step_2
  (repr : edwards.CompressedEdwardsY)
  (X : backend.serial.u64.field.FieldElement51)
  (Y : backend.serial.u64.field.FieldElement51)
  (Z : backend.serial.u64.field.FieldElement51) :
  Result edwards.EdwardsPoint
  := do
  let a ← edwards.CompressedEdwardsY.as_bytes repr
  let i ← Array.index_usize a 31#usize
  let i1 ← i >>> 7#i32
  let compressed_sign_bit ← subtle.Choice.Insts.CoreConvertFromU8.from i1
  let X_neg ← SharedAFieldElement51.Insts.CoreOpsArithNegFieldElement51.neg X
  let X1 ←
    backend.serial.u64.field.FieldElement51.Insts.SubtleConditionallySelectable.conditional_assign
      X X_neg compressed_sign_bit
  let fe ←
    SharedAFieldElement51.Insts.CoreOpsArithMulSharedBFieldElement51FieldElement51.mul
      X1 Y
  ok { X := X1, Y, Z, T := fe }

/-- [curve25519_dalek::field::{curve25519_dalek::backend::serial::u64::field::FieldElement51}::pow22501]:
    Source: 'curve25519-dalek/src/field.rs', lines 129:4-163:5 -/
def field.FieldElement51.pow22501
  (self : backend.serial.u64.field.FieldElement51) :
  Result (backend.serial.u64.field.FieldElement51 ×
    backend.serial.u64.field.FieldElement51)
  := do
  let t0 ← backend.serial.u64.field.FieldElement51.square self
  let fe ← backend.serial.u64.field.FieldElement51.square t0
  let t1 ← backend.serial.u64.field.FieldElement51.square fe
  let t2 ←
    SharedAFieldElement51.Insts.CoreOpsArithMulSharedBFieldElement51FieldElement51.mul
      self t1
  let t3 ←
    SharedAFieldElement51.Insts.CoreOpsArithMulSharedBFieldElement51FieldElement51.mul
      t0 t2
  let t4 ← backend.serial.u64.field.FieldElement51.square t3
  let t5 ←
    SharedAFieldElement51.Insts.CoreOpsArithMulSharedBFieldElement51FieldElement51.mul
      t2 t4
  let t6 ← backend.serial.u64.field.FieldElement51.pow2k t5 5#u32
  let t7 ←
    SharedAFieldElement51.Insts.CoreOpsArithMulSharedBFieldElement51FieldElement51.mul
      t6 t5
  let t8 ← backend.serial.u64.field.FieldElement51.pow2k t7 10#u32
  let t9 ←
    SharedAFieldElement51.Insts.CoreOpsArithMulSharedBFieldElement51FieldElement51.mul
      t8 t7
  let t10 ← backend.serial.u64.field.FieldElement51.pow2k t9 20#u32
  let t11 ←
    SharedAFieldElement51.Insts.CoreOpsArithMulSharedBFieldElement51FieldElement51.mul
      t10 t9
  let t12 ← backend.serial.u64.field.FieldElement51.pow2k t11 10#u32
  let t13 ←
    SharedAFieldElement51.Insts.CoreOpsArithMulSharedBFieldElement51FieldElement51.mul
      t12 t7
  let t14 ← backend.serial.u64.field.FieldElement51.pow2k t13 50#u32
  let t15 ←
    SharedAFieldElement51.Insts.CoreOpsArithMulSharedBFieldElement51FieldElement51.mul
      t14 t13
  let t16 ← backend.serial.u64.field.FieldElement51.pow2k t15 100#u32
  let t17 ←
    SharedAFieldElement51.Insts.CoreOpsArithMulSharedBFieldElement51FieldElement51.mul
      t16 t15
  let t18 ← backend.serial.u64.field.FieldElement51.pow2k t17 50#u32
  let t19 ←
    SharedAFieldElement51.Insts.CoreOpsArithMulSharedBFieldElement51FieldElement51.mul
      t18 t13
  ok (t19, t3)

/-- [curve25519_dalek::field::{curve25519_dalek::backend::serial::u64::field::FieldElement51}::pow_p58]:
    Source: 'curve25519-dalek/src/field.rs', lines 228:4-237:5 -/
def field.FieldElement51.pow_p58
  (self : backend.serial.u64.field.FieldElement51) :
  Result backend.serial.u64.field.FieldElement51
  := do
  let (t19, _) ← field.FieldElement51.pow22501 self
  let t20 ← backend.serial.u64.field.FieldElement51.pow2k t19 2#u32
  SharedAFieldElement51.Insts.CoreOpsArithMulSharedBFieldElement51FieldElement51.mul
    self t20

/-- [curve25519_dalek::field::{curve25519_dalek::backend::serial::u64::field::FieldElement51}::is_negative]:
    Source: 'curve25519-dalek/src/field.rs', lines 109:4-112:5 -/
def field.FieldElement51.is_negative
  (self : backend.serial.u64.field.FieldElement51) : Result subtle.Choice := do
  let bytes ← backend.serial.u64.field.FieldElement51.as_bytes self
  let i ← Array.index_usize bytes 0#usize
  let i1 ← lift (i &&& 1#u8)
  core.convert.IntoFrom.into subtle.Choice.Insts.CoreConvertFromU8 i1

/-- [curve25519_dalek::field::{curve25519_dalek::backend::serial::u64::field::FieldElement51}::sqrt_ratio_i]:
    Source: 'curve25519-dalek/src/field.rs', lines 251:4-297:5 -/
def field.FieldElement51.sqrt_ratio_i
  (u : backend.serial.u64.field.FieldElement51)
  (v : backend.serial.u64.field.FieldElement51) :
  Result (subtle.Choice × backend.serial.u64.field.FieldElement51)
  := do
  let fe ← backend.serial.u64.field.FieldElement51.square v
  let v3 ←
    SharedAFieldElement51.Insts.CoreOpsArithMulSharedBFieldElement51FieldElement51.mul
      fe v
  let fe1 ← backend.serial.u64.field.FieldElement51.square v3
  let v7 ←
    SharedAFieldElement51.Insts.CoreOpsArithMulSharedBFieldElement51FieldElement51.mul
      fe1 v
  let fe2 ←
    SharedAFieldElement51.Insts.CoreOpsArithMulSharedBFieldElement51FieldElement51.mul
      u v3
  let fe3 ←
    SharedAFieldElement51.Insts.CoreOpsArithMulSharedBFieldElement51FieldElement51.mul
      u v7
  let fe4 ← field.FieldElement51.pow_p58 fe3
  let r ←
    SharedAFieldElement51.Insts.CoreOpsArithMulSharedBFieldElement51FieldElement51.mul
      fe2 fe4
  let fe5 ← backend.serial.u64.field.FieldElement51.square r
  let check ←
    SharedAFieldElement51.Insts.CoreOpsArithMulSharedBFieldElement51FieldElement51.mul
      v fe5
  let i ← backend.serial.u64.constants.SQRT_M1
  let correct_sign_sqrt ←
    backend.serial.u64.field.FieldElement51.Insts.SubtleConstantTimeEq.ct_eq
      check u
  let fe6 ← SharedAFieldElement51.Insts.CoreOpsArithNegFieldElement51.neg u
  let flipped_sign_sqrt ←
    backend.serial.u64.field.FieldElement51.Insts.SubtleConstantTimeEq.ct_eq
      check fe6
  let fe7 ←
    SharedAFieldElement51.Insts.CoreOpsArithMulSharedBFieldElement51FieldElement51.mul
      fe6 i
  let flipped_sign_sqrt_i ←
    backend.serial.u64.field.FieldElement51.Insts.SubtleConstantTimeEq.ct_eq
      check fe7
  let r_prime ←
    SharedAFieldElement51.Insts.CoreOpsArithMulSharedBFieldElement51FieldElement51.mul
      i r
  let c ←
    subtle.Choice.Insts.CoreOpsBitBitOrChoiceChoice.bitor flipped_sign_sqrt
      flipped_sign_sqrt_i
  let r1 ←
    backend.serial.u64.field.FieldElement51.Insts.SubtleConditionallySelectable.conditional_assign
      r r_prime c
  let r_is_negative ← field.FieldElement51.is_negative r1
  let r_neg ←
    SharedAFieldElement51.Insts.CoreOpsArithNegFieldElement51.neg r1
  let r2 ←
    backend.serial.u64.field.FieldElement51.Insts.SubtleConditionallySelectable.conditional_assign
      r1 r_neg r_is_negative
  let was_nonzero_square ←
    subtle.Choice.Insts.CoreOpsBitBitOrChoiceChoice.bitor correct_sign_sqrt
      flipped_sign_sqrt
  ok (was_nonzero_square, r2)

/-- [curve25519_dalek::edwards::decompress::step_1]:
    Source: 'curve25519-dalek/src/edwards.rs', lines 208:4-219:5 -/
def edwards.decompress.step_1
  (repr : edwards.CompressedEdwardsY) :
  Result (subtle.Choice × backend.serial.u64.field.FieldElement51 ×
    backend.serial.u64.field.FieldElement51 ×
    backend.serial.u64.field.FieldElement51)
  := do
  let a ← edwards.CompressedEdwardsY.as_bytes repr
  let Y ← backend.serial.u64.field.FieldElement51.from_bytes a
  let Z ← backend.serial.u64.field.FieldElement51.ONE
  let YY ← backend.serial.u64.field.FieldElement51.square Y
  let u ←
    SharedAFieldElement51.Insts.CoreOpsArithSubSharedBFieldElement51FieldElement51.sub
      YY Z
  let fe ← backend.serial.u64.constants.EDWARDS_D
  let fe1 ←
    SharedAFieldElement51.Insts.CoreOpsArithMulSharedBFieldElement51FieldElement51.mul
      YY fe
  let v ←
    SharedAFieldElement51.Insts.CoreOpsArithAddSharedBFieldElement51FieldElement51.add
      fe1 Z
  let (is_valid_y_coord, X) ← field.FieldElement51.sqrt_ratio_i u v
  ok (is_valid_y_coord, X, Y, Z)

/-- [curve25519_dalek::edwards::{curve25519_dalek::edwards::CompressedEdwardsY}::decompress]:
    Source: 'curve25519-dalek/src/edwards.rs', lines 193:4-201:5
    Visibility: public -/
def edwards.CompressedEdwardsY.decompress
  (self : edwards.CompressedEdwardsY) :
  Result (Option edwards.EdwardsPoint)
  := do
  let (is_valid_y_coord, X, Y, Z) ← edwards.decompress.step_1 self
  let b ←
    core.convert.IntoFrom.into Bool.Insts.CoreConvertFromChoice
      is_valid_y_coord
  if b
  then let ep ← edwards.decompress.step_2 self X Y Z
       ok (some ep)
  else ok none

/-- [curve25519_dalek::edwards::{impl core::convert::TryFrom<&'_0 [u8], core::array::TryFromSliceError> for curve25519_dalek::edwards::CompressedEdwardsY}::try_from]:
    Source: 'curve25519-dalek/src/edwards.rs', lines 251:4-253:5
    Visibility: public -/
def
  edwards.CompressedEdwardsY.Insts.CoreConvertTryFromShared0SliceU8TryFromSliceError.try_from
  (slice : Slice Std.U8) :
  Result (core.result.Result edwards.CompressedEdwardsY
    core.array.TryFromSliceError)
  := do
  edwards.CompressedEdwardsY.from_slice slice

/-- Trait implementation: [curve25519_dalek::edwards::{impl core::convert::TryFrom<&'_0 [u8], core::array::TryFromSliceError> for curve25519_dalek::edwards::CompressedEdwardsY}]
    Source: 'curve25519-dalek/src/edwards.rs', lines 248:0-254:1 -/
@[reducible]
def
  edwards.CompressedEdwardsY.Insts.CoreConvertTryFromShared0SliceU8TryFromSliceError
  : core.convert.TryFrom edwards.CompressedEdwardsY (Slice Std.U8)
  core.array.TryFromSliceError := {
  try_from :=
    edwards.CompressedEdwardsY.Insts.CoreConvertTryFromShared0SliceU8TryFromSliceError.try_from
}

/-- [curve25519_dalek::edwards::{impl core::clone::Clone for curve25519_dalek::edwards::EdwardsPoint}::clone]:
    Source: 'curve25519-dalek/src/edwards.rs', lines 374:15-374:20
    Visibility: public -/
def edwards.EdwardsPoint.Insts.CoreCloneClone.clone
  (self : edwards.EdwardsPoint) : Result edwards.EdwardsPoint := do
  ok self

/-- Trait implementation: [curve25519_dalek::edwards::{impl core::clone::Clone for curve25519_dalek::edwards::EdwardsPoint}]
    Source: 'curve25519-dalek/src/edwards.rs', lines 374:15-374:20 -/
@[reducible]
def edwards.EdwardsPoint.Insts.CoreCloneClone : core.clone.Clone
  edwards.EdwardsPoint := {
  clone := edwards.EdwardsPoint.Insts.CoreCloneClone.clone
}

/-- Trait implementation: [curve25519_dalek::edwards::{impl core::marker::Copy for curve25519_dalek::edwards::EdwardsPoint}]
    Source: 'curve25519-dalek/src/edwards.rs', lines 374:9-374:13 -/
@[reducible]
def edwards.EdwardsPoint.Insts.CoreMarkerCopy : core.marker.Copy
  edwards.EdwardsPoint := {
  cloneInst := edwards.EdwardsPoint.Insts.CoreCloneClone
}

/-- [curve25519_dalek::edwards::{impl curve25519_dalek::traits::Identity for curve25519_dalek::edwards::CompressedEdwardsY}::identity]:
    Source: 'curve25519-dalek/src/edwards.rs', lines 388:4-393:5
    Visibility: public -/
def edwards.CompressedEdwardsY.Insts.Curve25519_dalekTraitsIdentity.identity
  : Result edwards.CompressedEdwardsY := do
  ok
    (Array.make 32#usize [
      1#u8, 0#u8, 0#u8, 0#u8, 0#u8, 0#u8, 0#u8, 0#u8, 0#u8, 0#u8, 0#u8, 0#u8,
      0#u8, 0#u8, 0#u8, 0#u8, 0#u8, 0#u8, 0#u8, 0#u8, 0#u8, 0#u8, 0#u8, 0#u8,
      0#u8, 0#u8, 0#u8, 0#u8, 0#u8, 0#u8, 0#u8, 0#u8
      ])

/-- Trait implementation: [curve25519_dalek::edwards::{impl curve25519_dalek::traits::Identity for curve25519_dalek::edwards::CompressedEdwardsY}]
    Source: 'curve25519-dalek/src/edwards.rs', lines 387:0-394:1 -/
@[reducible]
def edwards.CompressedEdwardsY.Insts.Curve25519_dalekTraitsIdentity :
  traits.Identity edwards.CompressedEdwardsY := {
  identity :=
    edwards.CompressedEdwardsY.Insts.Curve25519_dalekTraitsIdentity.identity
}

/-- [curve25519_dalek::edwards::{impl core::default::Default for curve25519_dalek::edwards::CompressedEdwardsY}::default]:
    Source: 'curve25519-dalek/src/edwards.rs', lines 397:4-399:5
    Visibility: public -/
def edwards.CompressedEdwardsY.Insts.CoreDefaultDefault.default
  : Result edwards.CompressedEdwardsY := do
  edwards.CompressedEdwardsY.Insts.Curve25519_dalekTraitsIdentity.identity

/-- Trait implementation: [curve25519_dalek::edwards::{impl core::default::Default for curve25519_dalek::edwards::CompressedEdwardsY}]
    Source: 'curve25519-dalek/src/edwards.rs', lines 396:0-400:1 -/
@[reducible]
def edwards.CompressedEdwardsY.Insts.CoreDefaultDefault : core.default.Default
  edwards.CompressedEdwardsY := {
  default := edwards.CompressedEdwardsY.Insts.CoreDefaultDefault.default
}

/-- [curve25519_dalek::edwards::{impl curve25519_dalek::traits::Identity for curve25519_dalek::edwards::EdwardsPoint}::identity]:
    Source: 'curve25519-dalek/src/edwards.rs', lines 415:4-422:5
    Visibility: public -/
def edwards.EdwardsPoint.Insts.Curve25519_dalekTraitsIdentity.identity
  : Result edwards.EdwardsPoint := do
  let fe ← backend.serial.u64.field.FieldElement51.ZERO
  let fe1 ← backend.serial.u64.field.FieldElement51.ONE
  ok { X := fe, Y := fe1, Z := fe1, T := fe }

/-- Trait implementation: [curve25519_dalek::edwards::{impl curve25519_dalek::traits::Identity for curve25519_dalek::edwards::EdwardsPoint}]
    Source: 'curve25519-dalek/src/edwards.rs', lines 414:0-423:1 -/
@[reducible]
def edwards.EdwardsPoint.Insts.Curve25519_dalekTraitsIdentity : traits.Identity
  edwards.EdwardsPoint := {
  identity :=
    edwards.EdwardsPoint.Insts.Curve25519_dalekTraitsIdentity.identity
}

/-- [curve25519_dalek::edwards::{impl core::default::Default for curve25519_dalek::edwards::EdwardsPoint}::default]:
    Source: 'curve25519-dalek/src/edwards.rs', lines 426:4-428:5
    Visibility: public -/
def edwards.EdwardsPoint.Insts.CoreDefaultDefault.default
  : Result edwards.EdwardsPoint := do
  edwards.EdwardsPoint.Insts.Curve25519_dalekTraitsIdentity.identity

/-- Trait implementation: [curve25519_dalek::edwards::{impl core::default::Default for curve25519_dalek::edwards::EdwardsPoint}]
    Source: 'curve25519-dalek/src/edwards.rs', lines 425:0-429:1 -/
@[reducible]
def edwards.EdwardsPoint.Insts.CoreDefaultDefault : core.default.Default
  edwards.EdwardsPoint := {
  default := edwards.EdwardsPoint.Insts.CoreDefaultDefault.default
}

/-- [curve25519_dalek::edwards::{impl curve25519_dalek::traits::ValidityCheck for curve25519_dalek::edwards::EdwardsPoint}::is_valid]:
    Source: 'curve25519-dalek/src/edwards.rs', lines 460:4-465:5 -/
def edwards.EdwardsPoint.Insts.Curve25519_dalekTraitsValidityCheck.is_valid
  (self : edwards.EdwardsPoint) : Result Bool := do
  let pp ← edwards.EdwardsPoint.as_projective self
  let point_on_curve ←
    backend.serial.curve_models.ProjectivePoint.Insts.Curve25519_dalekTraitsValidityCheck.is_valid
      pp
  let fe ←
    SharedAFieldElement51.Insts.CoreOpsArithMulSharedBFieldElement51FieldElement51.mul
      self.X self.Y
  let fe1 ←
    SharedAFieldElement51.Insts.CoreOpsArithMulSharedBFieldElement51FieldElement51.mul
      self.Z self.T
  let on_segre_image ←
    backend.serial.u64.field.FieldElement51.Insts.CoreCmpPartialEqFieldElement51.eq
      fe fe1
  if point_on_curve
  then ok on_segre_image
  else ok false

/-- Trait implementation: [curve25519_dalek::edwards::{impl curve25519_dalek::traits::ValidityCheck for curve25519_dalek::edwards::EdwardsPoint}]
    Source: 'curve25519-dalek/src/edwards.rs', lines 459:0-466:1 -/
@[reducible]
def edwards.EdwardsPoint.Insts.Curve25519_dalekTraitsValidityCheck :
  traits.ValidityCheck edwards.EdwardsPoint := {
  is_valid :=
    edwards.EdwardsPoint.Insts.Curve25519_dalekTraitsValidityCheck.is_valid
}

/-- [curve25519_dalek::edwards::{impl subtle::ConditionallySelectable for curve25519_dalek::edwards::EdwardsPoint}::conditional_select]:
    Source: 'curve25519-dalek/src/edwards.rs', lines 473:4-480:5
    Visibility: public -/
def edwards.EdwardsPoint.Insts.SubtleConditionallySelectable.conditional_select
  (a : edwards.EdwardsPoint) (b : edwards.EdwardsPoint)
  (choice : subtle.Choice) :
  Result edwards.EdwardsPoint
  := do
  let fe ←
    backend.serial.u64.field.FieldElement51.Insts.SubtleConditionallySelectable.conditional_select
      a.X b.X choice
  let fe1 ←
    backend.serial.u64.field.FieldElement51.Insts.SubtleConditionallySelectable.conditional_select
      a.Y b.Y choice
  let fe2 ←
    backend.serial.u64.field.FieldElement51.Insts.SubtleConditionallySelectable.conditional_select
      a.Z b.Z choice
  let fe3 ←
    backend.serial.u64.field.FieldElement51.Insts.SubtleConditionallySelectable.conditional_select
      a.T b.T choice
  ok { X := fe, Y := fe1, Z := fe2, T := fe3 }

/-- Trait implementation: [curve25519_dalek::edwards::{impl subtle::ConditionallySelectable for curve25519_dalek::edwards::EdwardsPoint}]
    Source: 'curve25519-dalek/src/edwards.rs', lines 472:0-481:1 -/
@[reducible]
def edwards.EdwardsPoint.Insts.SubtleConditionallySelectable :
  subtle.ConditionallySelectable edwards.EdwardsPoint := {
  coremarkerCopyInst := edwards.EdwardsPoint.Insts.CoreMarkerCopy
  conditional_select :=
    edwards.EdwardsPoint.Insts.SubtleConditionallySelectable.conditional_select
  conditional_assign :=
    edwards.EdwardsPoint.Insts.SubtleConditionallySelectable.conditional_assign
  conditional_swap :=
    edwards.EdwardsPoint.Insts.SubtleConditionallySelectable.conditional_swap
}

/-- [curve25519_dalek::edwards::{impl subtle::ConstantTimeEq for curve25519_dalek::edwards::EdwardsPoint}::ct_eq]:
    Source: 'curve25519-dalek/src/edwards.rs', lines 488:4-497:5
    Visibility: public -/
def edwards.EdwardsPoint.Insts.SubtleConstantTimeEq.ct_eq
  (self : edwards.EdwardsPoint) (other : edwards.EdwardsPoint) :
  Result subtle.Choice
  := do
  let fe ←
    SharedAFieldElement51.Insts.CoreOpsArithMulSharedBFieldElement51FieldElement51.mul
      self.X other.Z
  let fe1 ←
    SharedAFieldElement51.Insts.CoreOpsArithMulSharedBFieldElement51FieldElement51.mul
      other.X self.Z
  let c ←
    backend.serial.u64.field.FieldElement51.Insts.SubtleConstantTimeEq.ct_eq fe
      fe1
  let fe2 ←
    SharedAFieldElement51.Insts.CoreOpsArithMulSharedBFieldElement51FieldElement51.mul
      self.Y other.Z
  let fe3 ←
    SharedAFieldElement51.Insts.CoreOpsArithMulSharedBFieldElement51FieldElement51.mul
      other.Y self.Z
  let c1 ←
    backend.serial.u64.field.FieldElement51.Insts.SubtleConstantTimeEq.ct_eq
      fe2 fe3
  subtle.Choice.Insts.CoreOpsBitBitAndChoiceChoice.bitand c c1

/-- Trait implementation: [curve25519_dalek::edwards::{impl subtle::ConstantTimeEq for curve25519_dalek::edwards::EdwardsPoint}]
    Source: 'curve25519-dalek/src/edwards.rs', lines 487:0-498:1 -/
@[reducible]
def edwards.EdwardsPoint.Insts.SubtleConstantTimeEq : subtle.ConstantTimeEq
  edwards.EdwardsPoint := {
  ct_eq := edwards.EdwardsPoint.Insts.SubtleConstantTimeEq.ct_eq
}

/-- [curve25519_dalek::edwards::{impl core::cmp::PartialEq<curve25519_dalek::edwards::EdwardsPoint> for curve25519_dalek::edwards::EdwardsPoint}::eq]:
    Source: 'curve25519-dalek/src/edwards.rs', lines 501:4-503:5
    Visibility: public -/
def edwards.EdwardsPoint.Insts.CoreCmpPartialEqEdwardsPoint.eq
  (self : edwards.EdwardsPoint) (other : edwards.EdwardsPoint) :
  Result Bool
  := do
  let c ← edwards.EdwardsPoint.Insts.SubtleConstantTimeEq.ct_eq self other
  core.convert.IntoFrom.into Bool.Insts.CoreConvertFromChoice c

/-- Trait implementation: [curve25519_dalek::edwards::{impl core::cmp::PartialEq<curve25519_dalek::edwards::EdwardsPoint> for curve25519_dalek::edwards::EdwardsPoint}]
    Source: 'curve25519-dalek/src/edwards.rs', lines 500:0-504:1 -/
@[reducible]
def edwards.EdwardsPoint.Insts.CoreCmpPartialEqEdwardsPoint :
  core.cmp.PartialEq edwards.EdwardsPoint edwards.EdwardsPoint := {
  eq := edwards.EdwardsPoint.Insts.CoreCmpPartialEqEdwardsPoint.eq
}

/-- Trait implementation: [curve25519_dalek::edwards::{impl core::cmp::Eq for curve25519_dalek::edwards::EdwardsPoint}]
    Source: 'curve25519-dalek/src/edwards.rs', lines 506:0-506:27 -/
@[reducible]
def edwards.EdwardsPoint.Insts.CoreCmpEq : core.cmp.Eq edwards.EdwardsPoint
  := {
  partialEqInst := edwards.EdwardsPoint.Insts.CoreCmpPartialEqEdwardsPoint
  assert_fields_are_eq :=
    edwards.EdwardsPoint.Insts.CoreCmpEq.assert_fields_are_eq
}

/-- [curve25519_dalek::field::{curve25519_dalek::backend::serial::u64::field::FieldElement51}::invert]:
    Source: 'curve25519-dalek/src/field.rs', lines 214:4-223:5 -/
def field.FieldElement51.invert
  (self : backend.serial.u64.field.FieldElement51) :
  Result backend.serial.u64.field.FieldElement51
  := do
  let (t19, t3) ← field.FieldElement51.pow22501 self
  let t20 ← backend.serial.u64.field.FieldElement51.pow2k t19 5#u32
  SharedAFieldElement51.Insts.CoreOpsArithMulSharedBFieldElement51FieldElement51.mul
    t20 t3

/-- [curve25519_dalek::edwards::{curve25519_dalek::edwards::EdwardsPoint}::as_affine_niels]:
    Source: 'curve25519-dalek/src/edwards.rs', lines 537:4-547:5 -/
def edwards.EdwardsPoint.as_affine_niels
  (self : edwards.EdwardsPoint) :
  Result backend.serial.curve_models.AffineNielsPoint
  := do
  let recip ← field.FieldElement51.invert self.Z
  let x ←
    SharedAFieldElement51.Insts.CoreOpsArithMulSharedBFieldElement51FieldElement51.mul
      self.X recip
  let y ←
    SharedAFieldElement51.Insts.CoreOpsArithMulSharedBFieldElement51FieldElement51.mul
      self.Y recip
  let fe ←
    SharedAFieldElement51.Insts.CoreOpsArithMulSharedBFieldElement51FieldElement51.mul
      x y
  let fe1 ← backend.serial.u64.constants.EDWARDS_D2
  let xy2d ←
    SharedAFieldElement51.Insts.CoreOpsArithMulSharedBFieldElement51FieldElement51.mul
      fe fe1
  let fe2 ←
    SharedAFieldElement51.Insts.CoreOpsArithAddSharedBFieldElement51FieldElement51.add
      y x
  let fe3 ←
    SharedAFieldElement51.Insts.CoreOpsArithSubSharedBFieldElement51FieldElement51.sub
      y x
  ok { y_plus_x := fe2, y_minus_x := fe3, xy2d }

/-- [curve25519_dalek::edwards::{curve25519_dalek::edwards::EdwardsPoint}::to_montgomery]:
    Source: 'curve25519-dalek/src/edwards.rs', lines 558:4-568:5
    Visibility: public -/
def edwards.EdwardsPoint.to_montgomery
  (self : edwards.EdwardsPoint) : Result montgomery.MontgomeryPoint := do
  let U ←
    SharedAFieldElement51.Insts.CoreOpsArithAddSharedBFieldElement51FieldElement51.add
      self.Z self.Y
  let W ←
    SharedAFieldElement51.Insts.CoreOpsArithSubSharedBFieldElement51FieldElement51.sub
      self.Z self.Y
  let fe ← field.FieldElement51.invert W
  let u ←
    SharedAFieldElement51.Insts.CoreOpsArithMulSharedBFieldElement51FieldElement51.mul
      U fe
  let a ← backend.serial.u64.field.FieldElement51.as_bytes u
  ok a

/-- [curve25519_dalek::edwards::{curve25519_dalek::edwards::EdwardsPoint}::compress]:
    Source: 'curve25519-dalek/src/edwards.rs', lines 571:4-580:5
    Visibility: public -/
def edwards.EdwardsPoint.compress
  (self : edwards.EdwardsPoint) : Result edwards.CompressedEdwardsY := do
  let recip ← field.FieldElement51.invert self.Z
  let x ←
    SharedAFieldElement51.Insts.CoreOpsArithMulSharedBFieldElement51FieldElement51.mul
      self.X recip
  let y ←
    SharedAFieldElement51.Insts.CoreOpsArithMulSharedBFieldElement51FieldElement51.mul
      self.Y recip
  let s ← backend.serial.u64.field.FieldElement51.as_bytes y
  let c ← field.FieldElement51.is_negative x
  let i ← subtle.Choice.unwrap_u8 c
  let i1 ← i <<< 7#i32
  let i2 ← Array.index_usize s 31#usize
  let i3 ← lift (i2 ^^^ i1)
  let s1 ← Array.update s 31#usize i3
  ok s1

/-- [curve25519_dalek::edwards::{impl core::ops::arith::Add<&'b curve25519_dalek::edwards::EdwardsPoint, curve25519_dalek::edwards::EdwardsPoint> for &'a curve25519_dalek::edwards::EdwardsPoint}::add]:
    Source: 'curve25519-dalek/src/edwards.rs', lines 632:4-634:5
    Visibility: public -/
def
  SharedAEdwardsPoint.Insts.CoreOpsArithAddSharedBEdwardsPointEdwardsPoint.add
  (self : edwards.EdwardsPoint) (other : edwards.EdwardsPoint) :
  Result edwards.EdwardsPoint
  := do
  let pnp ← edwards.EdwardsPoint.as_projective_niels other
  let cp ←
    SharedAEdwardsPoint.Insts.CoreOpsArithAddSharedBProjectiveNielsPointCompletedPoint.add
      self pnp
  backend.serial.curve_models.CompletedPoint.as_extended cp

/-- Trait implementation: [curve25519_dalek::edwards::{impl core::ops::arith::Add<&'b curve25519_dalek::edwards::EdwardsPoint, curve25519_dalek::edwards::EdwardsPoint> for &'a curve25519_dalek::edwards::EdwardsPoint}]
    Source: 'curve25519-dalek/src/edwards.rs', lines 630:0-635:1 -/
@[reducible]
def SharedAEdwardsPoint.Insts.CoreOpsArithAddSharedBEdwardsPointEdwardsPoint :
  core.ops.arith.Add edwards.EdwardsPoint edwards.EdwardsPoint
  edwards.EdwardsPoint := {
  add :=
    SharedAEdwardsPoint.Insts.CoreOpsArithAddSharedBEdwardsPointEdwardsPoint.add
}

/-- [curve25519_dalek::edwards::{impl core::ops::arith::AddAssign<&'b curve25519_dalek::edwards::EdwardsPoint> for curve25519_dalek::edwards::EdwardsPoint}::add_assign]:
    Source: 'curve25519-dalek/src/edwards.rs', lines 644:4-646:5
    Visibility: public -/
def
  edwards.EdwardsPoint.Insts.CoreOpsArithAddAssignSharedBEdwardsPoint.add_assign
  (self : edwards.EdwardsPoint) (_rhs : edwards.EdwardsPoint) :
  Result edwards.EdwardsPoint
  := do
  SharedAEdwardsPoint.Insts.CoreOpsArithAddSharedBEdwardsPointEdwardsPoint.add
    self _rhs

/-- Trait implementation: [curve25519_dalek::edwards::{impl core::ops::arith::AddAssign<&'b curve25519_dalek::edwards::EdwardsPoint> for curve25519_dalek::edwards::EdwardsPoint}]
    Source: 'curve25519-dalek/src/edwards.rs', lines 643:0-647:1 -/
@[reducible]
def edwards.EdwardsPoint.Insts.CoreOpsArithAddAssignSharedBEdwardsPoint :
  core.ops.arith.AddAssign edwards.EdwardsPoint edwards.EdwardsPoint := {
  add_assign :=
    edwards.EdwardsPoint.Insts.CoreOpsArithAddAssignSharedBEdwardsPoint.add_assign
}

/-- [curve25519_dalek::edwards::{impl core::ops::arith::Sub<&'b curve25519_dalek::edwards::EdwardsPoint, curve25519_dalek::edwards::EdwardsPoint> for &'a curve25519_dalek::edwards::EdwardsPoint}::sub]:
    Source: 'curve25519-dalek/src/edwards.rs', lines 653:4-655:5
    Visibility: public -/
def
  SharedAEdwardsPoint.Insts.CoreOpsArithSubSharedBEdwardsPointEdwardsPoint.sub
  (self : edwards.EdwardsPoint) (other : edwards.EdwardsPoint) :
  Result edwards.EdwardsPoint
  := do
  let pnp ← edwards.EdwardsPoint.as_projective_niels other
  let cp ←
    SharedAEdwardsPoint.Insts.CoreOpsArithSubSharedBProjectiveNielsPointCompletedPoint.sub
      self pnp
  backend.serial.curve_models.CompletedPoint.as_extended cp

/-- Trait implementation: [curve25519_dalek::edwards::{impl core::ops::arith::Sub<&'b curve25519_dalek::edwards::EdwardsPoint, curve25519_dalek::edwards::EdwardsPoint> for &'a curve25519_dalek::edwards::EdwardsPoint}]
    Source: 'curve25519-dalek/src/edwards.rs', lines 651:0-656:1 -/
@[reducible]
def SharedAEdwardsPoint.Insts.CoreOpsArithSubSharedBEdwardsPointEdwardsPoint :
  core.ops.arith.Sub edwards.EdwardsPoint edwards.EdwardsPoint
  edwards.EdwardsPoint := {
  sub :=
    SharedAEdwardsPoint.Insts.CoreOpsArithSubSharedBEdwardsPointEdwardsPoint.sub
}

/-- [curve25519_dalek::edwards::{impl core::ops::arith::SubAssign<&'b curve25519_dalek::edwards::EdwardsPoint> for curve25519_dalek::edwards::EdwardsPoint}::sub_assign]:
    Source: 'curve25519-dalek/src/edwards.rs', lines 665:4-667:5
    Visibility: public -/
def
  edwards.EdwardsPoint.Insts.CoreOpsArithSubAssignSharedBEdwardsPoint.sub_assign
  (self : edwards.EdwardsPoint) (_rhs : edwards.EdwardsPoint) :
  Result edwards.EdwardsPoint
  := do
  SharedAEdwardsPoint.Insts.CoreOpsArithSubSharedBEdwardsPointEdwardsPoint.sub
    self _rhs

/-- Trait implementation: [curve25519_dalek::edwards::{impl core::ops::arith::SubAssign<&'b curve25519_dalek::edwards::EdwardsPoint> for curve25519_dalek::edwards::EdwardsPoint}]
    Source: 'curve25519-dalek/src/edwards.rs', lines 664:0-668:1 -/
@[reducible]
def edwards.EdwardsPoint.Insts.CoreOpsArithSubAssignSharedBEdwardsPoint :
  core.ops.arith.SubAssign edwards.EdwardsPoint edwards.EdwardsPoint := {
  sub_assign :=
    edwards.EdwardsPoint.Insts.CoreOpsArithSubAssignSharedBEdwardsPoint.sub_assign
}

/-- Trait implementation: [curve25519_dalek::edwards::{impl core::iter::traits::accum::Sum<T> for curve25519_dalek::edwards::EdwardsPoint}]
    Source: 'curve25519-dalek/src/edwards.rs', lines 672:0-682:1 -/
@[reducible]
def edwards.EdwardsPoint.Insts.CoreIterTraitsAccumSum {T : Type}
  (coreborrowBorrowTEdwardsPointInst : core.borrow.Borrow T
  edwards.EdwardsPoint) : core.iter.traits.accum.Sum edwards.EdwardsPoint T
  := {
  sum := fun {I : Type} (coreitertraitsiteratorIteratorInst :
    core.iter.traits.iterator.Iterator I T) =>
    edwards.EdwardsPoint.Insts.CoreIterTraitsAccumSum.sum
    coreborrowBorrowTEdwardsPointInst coreitertraitsiteratorIteratorInst
}

/-- [curve25519_dalek::edwards::{impl core::ops::arith::Neg<curve25519_dalek::edwards::EdwardsPoint> for &'a curve25519_dalek::edwards::EdwardsPoint}::neg]:
    Source: 'curve25519-dalek/src/edwards.rs', lines 691:4-698:5
    Visibility: public -/
def SharedAEdwardsPoint.Insts.CoreOpsArithNegEdwardsPoint.neg
  (self : edwards.EdwardsPoint) : Result edwards.EdwardsPoint := do
  let fe ←
    SharedAFieldElement51.Insts.CoreOpsArithNegFieldElement51.neg self.X
  let fe1 ←
    SharedAFieldElement51.Insts.CoreOpsArithNegFieldElement51.neg self.T
  ok { self with X := fe, T := fe1 }

/-- Trait implementation: [curve25519_dalek::edwards::{impl core::ops::arith::Neg<curve25519_dalek::edwards::EdwardsPoint> for &'a curve25519_dalek::edwards::EdwardsPoint}]
    Source: 'curve25519-dalek/src/edwards.rs', lines 688:0-699:1 -/
@[reducible]
def SharedAEdwardsPoint.Insts.CoreOpsArithNegEdwardsPoint : core.ops.arith.Neg
  edwards.EdwardsPoint edwards.EdwardsPoint := {
  neg := SharedAEdwardsPoint.Insts.CoreOpsArithNegEdwardsPoint.neg
}

/-- [curve25519_dalek::edwards::{impl core::ops::arith::Neg<curve25519_dalek::edwards::EdwardsPoint> for curve25519_dalek::edwards::EdwardsPoint}::neg]:
    Source: 'curve25519-dalek/src/edwards.rs', lines 704:4-706:5
    Visibility: public -/
def edwards.EdwardsPoint.Insts.CoreOpsArithNegEdwardsPoint.neg
  (self : edwards.EdwardsPoint) : Result edwards.EdwardsPoint := do
  SharedAEdwardsPoint.Insts.CoreOpsArithNegEdwardsPoint.neg self

/-- Trait implementation: [curve25519_dalek::edwards::{impl core::ops::arith::Neg<curve25519_dalek::edwards::EdwardsPoint> for curve25519_dalek::edwards::EdwardsPoint}]
    Source: 'curve25519-dalek/src/edwards.rs', lines 701:0-707:1 -/
@[reducible]
def edwards.EdwardsPoint.Insts.CoreOpsArithNegEdwardsPoint : core.ops.arith.Neg
  edwards.EdwardsPoint edwards.EdwardsPoint := {
  neg := edwards.EdwardsPoint.Insts.CoreOpsArithNegEdwardsPoint.neg
}

/-- [curve25519_dalek::edwards::{impl core::ops::arith::Mul<&'b curve25519_dalek::scalar::Scalar, curve25519_dalek::edwards::EdwardsPoint> for &'a curve25519_dalek::edwards::EdwardsPoint}::mul]:
    Source: 'curve25519-dalek/src/edwards.rs', lines 731:4-733:5
    Visibility: public -/
def SharedAEdwardsPoint.Insts.CoreOpsArithMulSharedBScalarEdwardsPoint.mul
  (self : edwards.EdwardsPoint) (scalar : scalar.Scalar) :
  Result edwards.EdwardsPoint
  := do
  backend.variable_base_mul self scalar

/-- [curve25519_dalek::edwards::{impl core::ops::arith::MulAssign<&'b curve25519_dalek::scalar::Scalar> for curve25519_dalek::edwards::EdwardsPoint}::mul_assign]:
    Source: 'curve25519-dalek/src/edwards.rs', lines 714:4-717:5
    Visibility: public -/
def edwards.EdwardsPoint.Insts.CoreOpsArithMulAssignSharedBScalar.mul_assign
  (self : edwards.EdwardsPoint) (scalar : scalar.Scalar) :
  Result edwards.EdwardsPoint
  := do
  SharedAEdwardsPoint.Insts.CoreOpsArithMulSharedBScalarEdwardsPoint.mul self
    scalar

/-- Trait implementation: [curve25519_dalek::edwards::{impl core::ops::arith::MulAssign<&'b curve25519_dalek::scalar::Scalar> for curve25519_dalek::edwards::EdwardsPoint}]
    Source: 'curve25519-dalek/src/edwards.rs', lines 713:0-718:1 -/
@[reducible]
def edwards.EdwardsPoint.Insts.CoreOpsArithMulAssignSharedBScalar :
  core.ops.arith.MulAssign edwards.EdwardsPoint scalar.Scalar := {
  mul_assign :=
    edwards.EdwardsPoint.Insts.CoreOpsArithMulAssignSharedBScalar.mul_assign
}

/-- Trait implementation: [curve25519_dalek::edwards::{impl core::ops::arith::Mul<&'b curve25519_dalek::scalar::Scalar, curve25519_dalek::edwards::EdwardsPoint> for &'a curve25519_dalek::edwards::EdwardsPoint}]
    Source: 'curve25519-dalek/src/edwards.rs', lines 725:0-734:1 -/
@[reducible]
def SharedAEdwardsPoint.Insts.CoreOpsArithMulSharedBScalarEdwardsPoint :
  core.ops.arith.Mul edwards.EdwardsPoint scalar.Scalar edwards.EdwardsPoint
  := {
  mul := SharedAEdwardsPoint.Insts.CoreOpsArithMulSharedBScalarEdwardsPoint.mul
}

/-- [curve25519_dalek::edwards::{impl core::ops::arith::Mul<&'b curve25519_dalek::edwards::EdwardsPoint, curve25519_dalek::edwards::EdwardsPoint> for &'a curve25519_dalek::scalar::Scalar}::mul]:
    Source: 'curve25519-dalek/src/edwards.rs', lines 743:4-745:5
    Visibility: public -/
def SharedAScalar.Insts.CoreOpsArithMulSharedBEdwardsPointEdwardsPoint.mul
  (self : scalar.Scalar) (point : edwards.EdwardsPoint) :
  Result edwards.EdwardsPoint
  := do
  SharedAEdwardsPoint.Insts.CoreOpsArithMulSharedBScalarEdwardsPoint.mul point
    self

/-- Trait implementation: [curve25519_dalek::edwards::{impl core::ops::arith::Mul<&'b curve25519_dalek::edwards::EdwardsPoint, curve25519_dalek::edwards::EdwardsPoint> for &'a curve25519_dalek::scalar::Scalar}]
    Source: 'curve25519-dalek/src/edwards.rs', lines 736:0-746:1 -/
@[reducible]
def SharedAScalar.Insts.CoreOpsArithMulSharedBEdwardsPointEdwardsPoint :
  core.ops.arith.Mul scalar.Scalar edwards.EdwardsPoint edwards.EdwardsPoint
  := {
  mul := SharedAScalar.Insts.CoreOpsArithMulSharedBEdwardsPointEdwardsPoint.mul
}

/-- [curve25519_dalek::edwards::{impl core::ops::arith::Mul<curve25519_dalek::edwards::EdwardsPoint, curve25519_dalek::edwards::EdwardsPoint> for &'a curve25519_dalek::scalar::Scalar}::mul]:
    Source: 'curve25519-dalek/src/macros.rs', lines 100:12-102:13
    Visibility: public -/
def SharedAScalar.Insts.CoreOpsArithMulEdwardsPointEdwardsPoint.mul
  (self : scalar.Scalar) (rhs : edwards.EdwardsPoint) :
  Result edwards.EdwardsPoint
  := do
  SharedAScalar.Insts.CoreOpsArithMulSharedBEdwardsPointEdwardsPoint.mul self
    rhs

/-- [curve25519_dalek::edwards::{curve25519_dalek::edwards::EdwardsPoint}::mul_base]:
    Source: 'curve25519-dalek/src/edwards.rs', lines 753:4-763:5
    Visibility: public -/
def edwards.EdwardsPoint.mul_base
  (scalar : scalar.Scalar) : Result edwards.EdwardsPoint := do
  let ep ← backend.serial.u64.constants.ED25519_BASEPOINT_POINT
  SharedAScalar.Insts.CoreOpsArithMulEdwardsPointEdwardsPoint.mul scalar ep

/-- [curve25519_dalek::scalar::clamp_integer]:
    Source: 'curve25519-dalek/src/scalar.rs', lines 1404:0-1409:1
    Visibility: public -/
def scalar.clamp_integer
  (bytes : Array Std.U8 32#usize) : Result (Array Std.U8 32#usize) := do
  let i ← Array.index_usize bytes 0#usize
  let i1 ← lift (i &&& 248#u8)
  let bytes1 ← Array.update bytes 0#usize i1
  let i2 ← Array.index_usize bytes1 31#usize
  let i3 ← lift (i2 &&& 127#u8)
  let bytes2 ← Array.update bytes1 31#usize i3
  let i4 ← Array.index_usize bytes2 31#usize
  let i5 ← lift (i4 ||| 64#u8)
  Array.update bytes2 31#usize i5

/-- [curve25519_dalek::edwards::{impl core::ops::arith::Mul<curve25519_dalek::edwards::EdwardsPoint, curve25519_dalek::edwards::EdwardsPoint> for curve25519_dalek::scalar::Scalar}::mul]:
    Source: 'curve25519-dalek/src/macros.rs', lines 107:12-109:13
    Visibility: public -/
def scalar.Scalar.Insts.CoreOpsArithMulEdwardsPointEdwardsPoint.mul
  (self : scalar.Scalar) (rhs : edwards.EdwardsPoint) :
  Result edwards.EdwardsPoint
  := do
  SharedAScalar.Insts.CoreOpsArithMulSharedBEdwardsPointEdwardsPoint.mul self
    rhs

/-- [curve25519_dalek::edwards::{curve25519_dalek::edwards::EdwardsPoint}::mul_clamped]:
    Source: 'curve25519-dalek/src/edwards.rs', lines 767:4-779:5
    Visibility: public -/
def edwards.EdwardsPoint.mul_clamped
  (self : edwards.EdwardsPoint) (bytes : Array Std.U8 32#usize) :
  Result edwards.EdwardsPoint
  := do
  let a ← scalar.clamp_integer bytes
  scalar.Scalar.Insts.CoreOpsArithMulEdwardsPointEdwardsPoint.mul
    { bytes := a } self

/-- [curve25519_dalek::edwards::{curve25519_dalek::edwards::EdwardsPoint}::mul_base_clamped]:
    Source: 'curve25519-dalek/src/edwards.rs', lines 783:4-791:5
    Visibility: public -/
def edwards.EdwardsPoint.mul_base_clamped
  (bytes : Array Std.U8 32#usize) : Result edwards.EdwardsPoint := do
  let a ← scalar.clamp_integer bytes
  edwards.EdwardsPoint.mul_base { bytes := a }

/-- [curve25519_dalek::edwards::{curve25519_dalek::edwards::EdwardsPoint}::vartime_double_scalar_mul_basepoint]:
    Source: 'curve25519-dalek/src/edwards.rs', lines 907:4-913:5
    Visibility: public -/
def edwards.EdwardsPoint.vartime_double_scalar_mul_basepoint
  (a : scalar.Scalar) (A : edwards.EdwardsPoint) (b : scalar.Scalar) :
  Result edwards.EdwardsPoint
  := do
  backend.vartime_double_base_mul a A b

/-- [curve25519_dalek::edwards::{curve25519_dalek::edwards::EdwardsPoint}::mul_by_pow_2]: loop body 0:
    Source: 'curve25519-dalek/src/edwards.rs', lines 1201:8-1204:9 -/
@[rust_loop_body]
def edwards.EdwardsPoint.mul_by_pow_2_loop.body
  (iter : core.ops.range.Range Std.U32)
  (s : backend.serial.curve_models.ProjectivePoint) :
  Result (ControlFlow ((core.ops.range.Range Std.U32) ×
    backend.serial.curve_models.ProjectivePoint)
    backend.serial.curve_models.ProjectivePoint)
  := do
  let (o, iter1) ←
    core.iter.range.IteratorRange.next U32.Insts.CoreIterRangeStep iter
  match o with
  | none => ok (done s)
  | some _ =>
    let r ← backend.serial.curve_models.ProjectivePoint.double s
    let s1 ← backend.serial.curve_models.CompletedPoint.as_projective r
    ok (cont (iter1, s1))

/-- [curve25519_dalek::edwards::{curve25519_dalek::edwards::EdwardsPoint}::mul_by_pow_2]: loop 0:
    Source: 'curve25519-dalek/src/edwards.rs', lines 1201:8-1204:9 -/
@[rust_loop]
def edwards.EdwardsPoint.mul_by_pow_2_loop
  (iter : core.ops.range.Range Std.U32)
  (s : backend.serial.curve_models.ProjectivePoint) :
  Result backend.serial.curve_models.ProjectivePoint
  := do
  loop
    (fun (iter1, s1) => edwards.EdwardsPoint.mul_by_pow_2_loop.body iter1 s1)
    (iter, s)

/-- [curve25519_dalek::edwards::{curve25519_dalek::edwards::EdwardsPoint}::mul_by_pow_2]:
    Source: 'curve25519-dalek/src/edwards.rs', lines 1197:4-1207:5 -/
def edwards.EdwardsPoint.mul_by_pow_2
  (self : edwards.EdwardsPoint) (k : Std.U32) :
  Result edwards.EdwardsPoint
  := do
  massert (k > 0#u32)
  let s ← edwards.EdwardsPoint.as_projective self
  let i ← k - 1#u32
  let s1 ←
    edwards.EdwardsPoint.mul_by_pow_2_loop { start := 0#u32, «end» := i } s
  let cp ← backend.serial.curve_models.ProjectivePoint.double s1
  backend.serial.curve_models.CompletedPoint.as_extended cp

/-- [curve25519_dalek::edwards::{curve25519_dalek::edwards::EdwardsPoint}::mul_by_cofactor]:
    Source: 'curve25519-dalek/src/edwards.rs', lines 1192:4-1194:5
    Visibility: public -/
def edwards.EdwardsPoint.mul_by_cofactor
  (self : edwards.EdwardsPoint) : Result edwards.EdwardsPoint := do
  edwards.EdwardsPoint.mul_by_pow_2 self 3#u32

/-- [curve25519_dalek::traits::{impl curve25519_dalek::traits::IsIdentity for T}::is_identity]:
    Source: 'curve25519-dalek/src/traits.rs', lines 45:4-47:5
    Visibility: public -/
def traits.IsIdentity.Blanket.is_identity
  {T : Type} (subtleConstantTimeEqInst : subtle.ConstantTimeEq T) (IdentityInst
  : traits.Identity T) (self : T) :
  Result Bool
  := do
  let t ← IdentityInst.identity
  let c ← subtleConstantTimeEqInst.ct_eq self t
  core.convert.IntoFrom.into Bool.Insts.CoreConvertFromChoice c

/-- [curve25519_dalek::edwards::{curve25519_dalek::edwards::EdwardsPoint}::is_small_order]:
    Source: 'curve25519-dalek/src/edwards.rs', lines 1232:4-1234:5
    Visibility: public -/
def edwards.EdwardsPoint.is_small_order
  (self : edwards.EdwardsPoint) : Result Bool := do
  let ep ← edwards.EdwardsPoint.mul_by_cofactor self
  traits.IsIdentity.Blanket.is_identity
    edwards.EdwardsPoint.Insts.SubtleConstantTimeEq
    edwards.EdwardsPoint.Insts.Curve25519_dalekTraitsIdentity ep

/-- [curve25519_dalek::edwards::{impl core::ops::arith::Mul<curve25519_dalek::scalar::Scalar, curve25519_dalek::edwards::EdwardsPoint> for &'a curve25519_dalek::edwards::EdwardsPoint}::mul]:
    Source: 'curve25519-dalek/src/macros.rs', lines 100:12-102:13
    Visibility: public -/
def SharedAEdwardsPoint.Insts.CoreOpsArithMulScalarEdwardsPoint.mul
  (self : edwards.EdwardsPoint) (rhs : scalar.Scalar) :
  Result edwards.EdwardsPoint
  := do
  SharedAEdwardsPoint.Insts.CoreOpsArithMulSharedBScalarEdwardsPoint.mul self
    rhs

/-- [curve25519_dalek::edwards::{curve25519_dalek::edwards::EdwardsPoint}::is_torsion_free]:
    Source: 'curve25519-dalek/src/edwards.rs', lines 1262:4-1264:5
    Visibility: public -/
def edwards.EdwardsPoint.is_torsion_free
  (self : edwards.EdwardsPoint) : Result Bool := do
  let ep ←
    SharedAEdwardsPoint.Insts.CoreOpsArithMulScalarEdwardsPoint.mul self
      constants.BASEPOINT_ORDER_PRIVATE
  traits.IsIdentity.Blanket.is_identity
    edwards.EdwardsPoint.Insts.SubtleConstantTimeEq
    edwards.EdwardsPoint.Insts.Curve25519_dalekTraitsIdentity ep

/-- [curve25519_dalek::edwards::{impl core::fmt::Debug for curve25519_dalek::edwards::EdwardsPoint}::fmt]:
    Source: 'curve25519-dalek/src/edwards.rs', lines 1272:4-1278:5
    Visibility: public -/
def edwards.EdwardsPoint.Insts.CoreFmtDebug.fmt
  (self : edwards.EdwardsPoint) (f : core.fmt.Formatter) :
  Result ((core.result.Result Unit core.fmt.Error) × core.fmt.Formatter)
  := do
  let a ←
    core.fmt.rt.Argument.new_debug (core.fmt.DebugShared
      backend.serial.u64.field.FieldElement51.Insts.CoreFmtDebug) self.X
  let a1 ←
    core.fmt.rt.Argument.new_debug (core.fmt.DebugShared
      backend.serial.u64.field.FieldElement51.Insts.CoreFmtDebug) self.Y
  let a2 ←
    core.fmt.rt.Argument.new_debug (core.fmt.DebugShared
      backend.serial.u64.field.FieldElement51.Insts.CoreFmtDebug) self.Z
  let a3 ←
    core.fmt.rt.Argument.new_debug (core.fmt.DebugShared
      backend.serial.u64.field.FieldElement51.Insts.CoreFmtDebug) self.T
  let a4 ←
    core.fmt.Arguments.new
      (Array.make 48#usize [
        18#u8, 69#u8, 100#u8, 119#u8, 97#u8, 114#u8, 100#u8, 115#u8, 80#u8,
        111#u8, 105#u8, 110#u8, 116#u8, 123#u8, 10#u8, 9#u8, 88#u8, 58#u8,
        32#u8, 192#u8, 6#u8, 44#u8, 10#u8, 9#u8, 89#u8, 58#u8, 32#u8, 192#u8,
        6#u8, 44#u8, 10#u8, 9#u8, 90#u8, 58#u8, 32#u8, 192#u8, 6#u8, 44#u8,
        10#u8, 9#u8, 84#u8, 58#u8, 32#u8, 192#u8, 2#u8, 10#u8, 125#u8, 0#u8
        ]) (Array.make 4#usize [ a, a1, a2, a3 ])
  core.fmt.Formatter.write_fmt f a4

/-- Trait implementation: [curve25519_dalek::edwards::{impl core::fmt::Debug for curve25519_dalek::edwards::EdwardsPoint}]
    Source: 'curve25519-dalek/src/edwards.rs', lines 1271:0-1279:1 -/
@[reducible]
def edwards.EdwardsPoint.Insts.CoreFmtDebug : core.fmt.Debug
  edwards.EdwardsPoint := {
  fmt := edwards.EdwardsPoint.Insts.CoreFmtDebug.fmt
}

/-- Trait implementation: [curve25519_dalek::field::{impl core::cmp::PartialEq<curve25519_dalek::backend::serial::u64::field::FieldElement51> for curve25519_dalek::backend::serial::u64::field::FieldElement51}]
    Source: 'curve25519-dalek/src/field.rs', lines 86:0-90:1 -/
@[reducible]
def
  backend.serial.u64.field.FieldElement51.Insts.CoreCmpPartialEqFieldElement51
  : core.cmp.PartialEq backend.serial.u64.field.FieldElement51
  backend.serial.u64.field.FieldElement51 := {
  eq :=
    backend.serial.u64.field.FieldElement51.Insts.CoreCmpPartialEqFieldElement51.eq
}

/-- Trait implementation: [curve25519_dalek::field::{impl core::cmp::Eq for curve25519_dalek::backend::serial::u64::field::FieldElement51}]
    Source: 'curve25519-dalek/src/field.rs', lines 84:0-84:27 -/
@[reducible]
def backend.serial.u64.field.FieldElement51.Insts.CoreCmpEq : core.cmp.Eq
  backend.serial.u64.field.FieldElement51 := {
  partialEqInst :=
    backend.serial.u64.field.FieldElement51.Insts.CoreCmpPartialEqFieldElement51
  assert_fields_are_eq :=
    backend.serial.u64.field.FieldElement51.Insts.CoreCmpEq.assert_fields_are_eq
}

/-- Trait implementation: [curve25519_dalek::field::{impl subtle::ConstantTimeEq for curve25519_dalek::backend::serial::u64::field::FieldElement51}]
    Source: 'curve25519-dalek/src/field.rs', lines 92:0-99:1 -/
@[reducible]
def backend.serial.u64.field.FieldElement51.Insts.SubtleConstantTimeEq :
  subtle.ConstantTimeEq backend.serial.u64.field.FieldElement51 := {
  ct_eq :=
    backend.serial.u64.field.FieldElement51.Insts.SubtleConstantTimeEq.ct_eq
}

/-- [curve25519_dalek::field::{curve25519_dalek::backend::serial::u64::field::FieldElement51}::is_zero]:
    Source: 'curve25519-dalek/src/field.rs', lines 119:4-124:5 -/
def field.FieldElement51.is_zero
  (self : backend.serial.u64.field.FieldElement51) : Result subtle.Choice := do
  let zero := Array.repeat 32#usize 0#u8
  let bytes ← backend.serial.u64.field.FieldElement51.as_bytes self
  let s ← lift (Array.to_slice bytes)
  let s1 ← lift (Array.to_slice zero)
  Slice.Insts.SubtleConstantTimeEq.ct_eq U8.Insts.SubtleConstantTimeEq s s1

/-- [curve25519_dalek::field::{curve25519_dalek::backend::serial::u64::field::FieldElement51}::invsqrt]:
    Source: 'curve25519-dalek/src/field.rs', lines 311:4-313:5 -/
def field.FieldElement51.invsqrt
  (self : backend.serial.u64.field.FieldElement51) :
  Result (subtle.Choice × backend.serial.u64.field.FieldElement51)
  := do
  let fe ← backend.serial.u64.field.FieldElement51.ONE
  field.FieldElement51.sqrt_ratio_i fe self

/-- [curve25519_dalek::edwards::{impl core::ops::arith::Add<&'b curve25519_dalek::edwards::EdwardsPoint, curve25519_dalek::edwards::EdwardsPoint> for curve25519_dalek::edwards::EdwardsPoint}::add]:
    Source: 'curve25519-dalek/src/macros.rs', lines 19:12-21:13
    Visibility: public -/
def
  edwards.EdwardsPoint.Insts.CoreOpsArithAddSharedBEdwardsPointEdwardsPoint.add
  (self : edwards.EdwardsPoint) (rhs : edwards.EdwardsPoint) :
  Result edwards.EdwardsPoint
  := do
  SharedAEdwardsPoint.Insts.CoreOpsArithAddSharedBEdwardsPointEdwardsPoint.add
    self rhs

/-- Trait implementation: [curve25519_dalek::edwards::{impl core::ops::arith::Add<&'b curve25519_dalek::edwards::EdwardsPoint, curve25519_dalek::edwards::EdwardsPoint> for curve25519_dalek::edwards::EdwardsPoint}]
    Source: 'curve25519-dalek/src/macros.rs', lines 17:8-22:9 -/
@[reducible]
def edwards.EdwardsPoint.Insts.CoreOpsArithAddSharedBEdwardsPointEdwardsPoint :
  core.ops.arith.Add edwards.EdwardsPoint edwards.EdwardsPoint
  edwards.EdwardsPoint := {
  add :=
    edwards.EdwardsPoint.Insts.CoreOpsArithAddSharedBEdwardsPointEdwardsPoint.add
}

/-- [curve25519_dalek::edwards::{impl core::ops::arith::Add<curve25519_dalek::edwards::EdwardsPoint, curve25519_dalek::edwards::EdwardsPoint> for &'a curve25519_dalek::edwards::EdwardsPoint}::add]:
    Source: 'curve25519-dalek/src/macros.rs', lines 26:12-28:13
    Visibility: public -/
def SharedAEdwardsPoint.Insts.CoreOpsArithAddEdwardsPointEdwardsPoint.add
  (self : edwards.EdwardsPoint) (rhs : edwards.EdwardsPoint) :
  Result edwards.EdwardsPoint
  := do
  SharedAEdwardsPoint.Insts.CoreOpsArithAddSharedBEdwardsPointEdwardsPoint.add
    self rhs

/-- Trait implementation: [curve25519_dalek::edwards::{impl core::ops::arith::Add<curve25519_dalek::edwards::EdwardsPoint, curve25519_dalek::edwards::EdwardsPoint> for &'a curve25519_dalek::edwards::EdwardsPoint}]
    Source: 'curve25519-dalek/src/macros.rs', lines 24:8-29:9 -/
@[reducible]
def SharedAEdwardsPoint.Insts.CoreOpsArithAddEdwardsPointEdwardsPoint :
  core.ops.arith.Add edwards.EdwardsPoint edwards.EdwardsPoint
  edwards.EdwardsPoint := {
  add := SharedAEdwardsPoint.Insts.CoreOpsArithAddEdwardsPointEdwardsPoint.add
}

/-- [curve25519_dalek::edwards::{impl core::ops::arith::Add<curve25519_dalek::edwards::EdwardsPoint, curve25519_dalek::edwards::EdwardsPoint> for curve25519_dalek::edwards::EdwardsPoint}::add]:
    Source: 'curve25519-dalek/src/macros.rs', lines 33:12-35:13
    Visibility: public -/
def edwards.EdwardsPoint.Insts.CoreOpsArithAddEdwardsPointEdwardsPoint.add
  (self : edwards.EdwardsPoint) (rhs : edwards.EdwardsPoint) :
  Result edwards.EdwardsPoint
  := do
  SharedAEdwardsPoint.Insts.CoreOpsArithAddSharedBEdwardsPointEdwardsPoint.add
    self rhs

/-- Trait implementation: [curve25519_dalek::edwards::{impl core::ops::arith::Add<curve25519_dalek::edwards::EdwardsPoint, curve25519_dalek::edwards::EdwardsPoint> for curve25519_dalek::edwards::EdwardsPoint}]
    Source: 'curve25519-dalek/src/macros.rs', lines 31:8-36:9 -/
@[reducible]
def edwards.EdwardsPoint.Insts.CoreOpsArithAddEdwardsPointEdwardsPoint :
  core.ops.arith.Add edwards.EdwardsPoint edwards.EdwardsPoint
  edwards.EdwardsPoint := {
  add := edwards.EdwardsPoint.Insts.CoreOpsArithAddEdwardsPointEdwardsPoint.add
}

/-- [curve25519_dalek::edwards::{impl core::ops::arith::AddAssign<curve25519_dalek::edwards::EdwardsPoint> for curve25519_dalek::edwards::EdwardsPoint}::add_assign]:
    Source: 'curve25519-dalek/src/macros.rs', lines 44:12-46:13
    Visibility: public -/
def edwards.EdwardsPoint.Insts.CoreOpsArithAddAssignEdwardsPoint.add_assign
  (self : edwards.EdwardsPoint) (rhs : edwards.EdwardsPoint) :
  Result edwards.EdwardsPoint
  := do
  edwards.EdwardsPoint.Insts.CoreOpsArithAddAssignSharedBEdwardsPoint.add_assign
    self rhs

/-- Trait implementation: [curve25519_dalek::edwards::{impl core::ops::arith::AddAssign<curve25519_dalek::edwards::EdwardsPoint> for curve25519_dalek::edwards::EdwardsPoint}]
    Source: 'curve25519-dalek/src/macros.rs', lines 43:8-47:9 -/
@[reducible]
def edwards.EdwardsPoint.Insts.CoreOpsArithAddAssignEdwardsPoint :
  core.ops.arith.AddAssign edwards.EdwardsPoint edwards.EdwardsPoint := {
  add_assign :=
    edwards.EdwardsPoint.Insts.CoreOpsArithAddAssignEdwardsPoint.add_assign
}

/-- [curve25519_dalek::edwards::{impl core::ops::arith::Sub<&'b curve25519_dalek::edwards::EdwardsPoint, curve25519_dalek::edwards::EdwardsPoint> for curve25519_dalek::edwards::EdwardsPoint}::sub]:
    Source: 'curve25519-dalek/src/macros.rs', lines 56:12-58:13
    Visibility: public -/
def
  edwards.EdwardsPoint.Insts.CoreOpsArithSubSharedBEdwardsPointEdwardsPoint.sub
  (self : edwards.EdwardsPoint) (rhs : edwards.EdwardsPoint) :
  Result edwards.EdwardsPoint
  := do
  SharedAEdwardsPoint.Insts.CoreOpsArithSubSharedBEdwardsPointEdwardsPoint.sub
    self rhs

/-- Trait implementation: [curve25519_dalek::edwards::{impl core::ops::arith::Sub<&'b curve25519_dalek::edwards::EdwardsPoint, curve25519_dalek::edwards::EdwardsPoint> for curve25519_dalek::edwards::EdwardsPoint}]
    Source: 'curve25519-dalek/src/macros.rs', lines 54:8-59:9 -/
@[reducible]
def edwards.EdwardsPoint.Insts.CoreOpsArithSubSharedBEdwardsPointEdwardsPoint :
  core.ops.arith.Sub edwards.EdwardsPoint edwards.EdwardsPoint
  edwards.EdwardsPoint := {
  sub :=
    edwards.EdwardsPoint.Insts.CoreOpsArithSubSharedBEdwardsPointEdwardsPoint.sub
}

/-- [curve25519_dalek::edwards::{impl core::ops::arith::Sub<curve25519_dalek::edwards::EdwardsPoint, curve25519_dalek::edwards::EdwardsPoint> for &'a curve25519_dalek::edwards::EdwardsPoint}::sub]:
    Source: 'curve25519-dalek/src/macros.rs', lines 63:12-65:13
    Visibility: public -/
def SharedAEdwardsPoint.Insts.CoreOpsArithSubEdwardsPointEdwardsPoint.sub
  (self : edwards.EdwardsPoint) (rhs : edwards.EdwardsPoint) :
  Result edwards.EdwardsPoint
  := do
  SharedAEdwardsPoint.Insts.CoreOpsArithSubSharedBEdwardsPointEdwardsPoint.sub
    self rhs

/-- Trait implementation: [curve25519_dalek::edwards::{impl core::ops::arith::Sub<curve25519_dalek::edwards::EdwardsPoint, curve25519_dalek::edwards::EdwardsPoint> for &'a curve25519_dalek::edwards::EdwardsPoint}]
    Source: 'curve25519-dalek/src/macros.rs', lines 61:8-66:9 -/
@[reducible]
def SharedAEdwardsPoint.Insts.CoreOpsArithSubEdwardsPointEdwardsPoint :
  core.ops.arith.Sub edwards.EdwardsPoint edwards.EdwardsPoint
  edwards.EdwardsPoint := {
  sub := SharedAEdwardsPoint.Insts.CoreOpsArithSubEdwardsPointEdwardsPoint.sub
}

/-- [curve25519_dalek::edwards::{impl core::ops::arith::Sub<curve25519_dalek::edwards::EdwardsPoint, curve25519_dalek::edwards::EdwardsPoint> for curve25519_dalek::edwards::EdwardsPoint}::sub]:
    Source: 'curve25519-dalek/src/macros.rs', lines 70:12-72:13
    Visibility: public -/
def edwards.EdwardsPoint.Insts.CoreOpsArithSubEdwardsPointEdwardsPoint.sub
  (self : edwards.EdwardsPoint) (rhs : edwards.EdwardsPoint) :
  Result edwards.EdwardsPoint
  := do
  SharedAEdwardsPoint.Insts.CoreOpsArithSubSharedBEdwardsPointEdwardsPoint.sub
    self rhs

/-- Trait implementation: [curve25519_dalek::edwards::{impl core::ops::arith::Sub<curve25519_dalek::edwards::EdwardsPoint, curve25519_dalek::edwards::EdwardsPoint> for curve25519_dalek::edwards::EdwardsPoint}]
    Source: 'curve25519-dalek/src/macros.rs', lines 68:8-73:9 -/
@[reducible]
def edwards.EdwardsPoint.Insts.CoreOpsArithSubEdwardsPointEdwardsPoint :
  core.ops.arith.Sub edwards.EdwardsPoint edwards.EdwardsPoint
  edwards.EdwardsPoint := {
  sub := edwards.EdwardsPoint.Insts.CoreOpsArithSubEdwardsPointEdwardsPoint.sub
}

/-- [curve25519_dalek::edwards::{impl core::ops::arith::SubAssign<curve25519_dalek::edwards::EdwardsPoint> for curve25519_dalek::edwards::EdwardsPoint}::sub_assign]:
    Source: 'curve25519-dalek/src/macros.rs', lines 81:12-83:13
    Visibility: public -/
def edwards.EdwardsPoint.Insts.CoreOpsArithSubAssignEdwardsPoint.sub_assign
  (self : edwards.EdwardsPoint) (rhs : edwards.EdwardsPoint) :
  Result edwards.EdwardsPoint
  := do
  edwards.EdwardsPoint.Insts.CoreOpsArithSubAssignSharedBEdwardsPoint.sub_assign
    self rhs

/-- Trait implementation: [curve25519_dalek::edwards::{impl core::ops::arith::SubAssign<curve25519_dalek::edwards::EdwardsPoint> for curve25519_dalek::edwards::EdwardsPoint}]
    Source: 'curve25519-dalek/src/macros.rs', lines 80:8-84:9 -/
@[reducible]
def edwards.EdwardsPoint.Insts.CoreOpsArithSubAssignEdwardsPoint :
  core.ops.arith.SubAssign edwards.EdwardsPoint edwards.EdwardsPoint := {
  sub_assign :=
    edwards.EdwardsPoint.Insts.CoreOpsArithSubAssignEdwardsPoint.sub_assign
}

/-- [curve25519_dalek::edwards::{impl core::ops::arith::Mul<&'b curve25519_dalek::scalar::Scalar, curve25519_dalek::edwards::EdwardsPoint> for curve25519_dalek::edwards::EdwardsPoint}::mul]:
    Source: 'curve25519-dalek/src/macros.rs', lines 93:12-95:13
    Visibility: public -/
def edwards.EdwardsPoint.Insts.CoreOpsArithMulSharedBScalarEdwardsPoint.mul
  (self : edwards.EdwardsPoint) (rhs : scalar.Scalar) :
  Result edwards.EdwardsPoint
  := do
  SharedAEdwardsPoint.Insts.CoreOpsArithMulSharedBScalarEdwardsPoint.mul self
    rhs

/-- Trait implementation: [curve25519_dalek::edwards::{impl core::ops::arith::Mul<&'b curve25519_dalek::scalar::Scalar, curve25519_dalek::edwards::EdwardsPoint> for curve25519_dalek::edwards::EdwardsPoint}]
    Source: 'curve25519-dalek/src/macros.rs', lines 91:8-96:9 -/
@[reducible]
def edwards.EdwardsPoint.Insts.CoreOpsArithMulSharedBScalarEdwardsPoint :
  core.ops.arith.Mul edwards.EdwardsPoint scalar.Scalar edwards.EdwardsPoint
  := {
  mul :=
    edwards.EdwardsPoint.Insts.CoreOpsArithMulSharedBScalarEdwardsPoint.mul
}

/-- [curve25519_dalek::edwards::{impl core::ops::arith::Mul<&'b curve25519_dalek::edwards::EdwardsPoint, curve25519_dalek::edwards::EdwardsPoint> for curve25519_dalek::scalar::Scalar}::mul]:
    Source: 'curve25519-dalek/src/macros.rs', lines 93:12-95:13
    Visibility: public -/
def scalar.Scalar.Insts.CoreOpsArithMulSharedBEdwardsPointEdwardsPoint.mul
  (self : scalar.Scalar) (rhs : edwards.EdwardsPoint) :
  Result edwards.EdwardsPoint
  := do
  SharedAScalar.Insts.CoreOpsArithMulSharedBEdwardsPointEdwardsPoint.mul self
    rhs

/-- Trait implementation: [curve25519_dalek::edwards::{impl core::ops::arith::Mul<&'b curve25519_dalek::edwards::EdwardsPoint, curve25519_dalek::edwards::EdwardsPoint> for curve25519_dalek::scalar::Scalar}]
    Source: 'curve25519-dalek/src/macros.rs', lines 91:8-96:9 -/
@[reducible]
def scalar.Scalar.Insts.CoreOpsArithMulSharedBEdwardsPointEdwardsPoint :
  core.ops.arith.Mul scalar.Scalar edwards.EdwardsPoint edwards.EdwardsPoint
  := {
  mul := scalar.Scalar.Insts.CoreOpsArithMulSharedBEdwardsPointEdwardsPoint.mul
}

/-- Trait implementation: [curve25519_dalek::edwards::{impl core::ops::arith::Mul<curve25519_dalek::scalar::Scalar, curve25519_dalek::edwards::EdwardsPoint> for &'a curve25519_dalek::edwards::EdwardsPoint}]
    Source: 'curve25519-dalek/src/macros.rs', lines 98:8-103:9 -/
@[reducible]
def SharedAEdwardsPoint.Insts.CoreOpsArithMulScalarEdwardsPoint :
  core.ops.arith.Mul edwards.EdwardsPoint scalar.Scalar edwards.EdwardsPoint
  := {
  mul := SharedAEdwardsPoint.Insts.CoreOpsArithMulScalarEdwardsPoint.mul
}

/-- Trait implementation: [curve25519_dalek::edwards::{impl core::ops::arith::Mul<curve25519_dalek::edwards::EdwardsPoint, curve25519_dalek::edwards::EdwardsPoint> for &'a curve25519_dalek::scalar::Scalar}]
    Source: 'curve25519-dalek/src/macros.rs', lines 98:8-103:9 -/
@[reducible]
def SharedAScalar.Insts.CoreOpsArithMulEdwardsPointEdwardsPoint :
  core.ops.arith.Mul scalar.Scalar edwards.EdwardsPoint edwards.EdwardsPoint
  := {
  mul := SharedAScalar.Insts.CoreOpsArithMulEdwardsPointEdwardsPoint.mul
}

/-- [curve25519_dalek::edwards::{impl core::ops::arith::Mul<curve25519_dalek::scalar::Scalar, curve25519_dalek::edwards::EdwardsPoint> for curve25519_dalek::edwards::EdwardsPoint}::mul]:
    Source: 'curve25519-dalek/src/macros.rs', lines 107:12-109:13
    Visibility: public -/
def edwards.EdwardsPoint.Insts.CoreOpsArithMulScalarEdwardsPoint.mul
  (self : edwards.EdwardsPoint) (rhs : scalar.Scalar) :
  Result edwards.EdwardsPoint
  := do
  SharedAEdwardsPoint.Insts.CoreOpsArithMulSharedBScalarEdwardsPoint.mul self
    rhs

/-- Trait implementation: [curve25519_dalek::edwards::{impl core::ops::arith::Mul<curve25519_dalek::scalar::Scalar, curve25519_dalek::edwards::EdwardsPoint> for curve25519_dalek::edwards::EdwardsPoint}]
    Source: 'curve25519-dalek/src/macros.rs', lines 105:8-110:9 -/
@[reducible]
def edwards.EdwardsPoint.Insts.CoreOpsArithMulScalarEdwardsPoint :
  core.ops.arith.Mul edwards.EdwardsPoint scalar.Scalar edwards.EdwardsPoint
  := {
  mul := edwards.EdwardsPoint.Insts.CoreOpsArithMulScalarEdwardsPoint.mul
}

/-- Trait implementation: [curve25519_dalek::edwards::{impl core::ops::arith::Mul<curve25519_dalek::edwards::EdwardsPoint, curve25519_dalek::edwards::EdwardsPoint> for curve25519_dalek::scalar::Scalar}]
    Source: 'curve25519-dalek/src/macros.rs', lines 105:8-110:9 -/
@[reducible]
def scalar.Scalar.Insts.CoreOpsArithMulEdwardsPointEdwardsPoint :
  core.ops.arith.Mul scalar.Scalar edwards.EdwardsPoint edwards.EdwardsPoint
  := {
  mul := scalar.Scalar.Insts.CoreOpsArithMulEdwardsPointEdwardsPoint.mul
}

/-- [curve25519_dalek::edwards::{impl core::ops::arith::MulAssign<curve25519_dalek::scalar::Scalar> for curve25519_dalek::edwards::EdwardsPoint}::mul_assign]:
    Source: 'curve25519-dalek/src/macros.rs', lines 118:12-120:13
    Visibility: public -/
def edwards.EdwardsPoint.Insts.CoreOpsArithMulAssignScalar.mul_assign
  (self : edwards.EdwardsPoint) (rhs : scalar.Scalar) :
  Result edwards.EdwardsPoint
  := do
  edwards.EdwardsPoint.Insts.CoreOpsArithMulAssignSharedBScalar.mul_assign self
    rhs

/-- Trait implementation: [curve25519_dalek::edwards::{impl core::ops::arith::MulAssign<curve25519_dalek::scalar::Scalar> for curve25519_dalek::edwards::EdwardsPoint}]
    Source: 'curve25519-dalek/src/macros.rs', lines 117:8-121:9 -/
@[reducible]
def edwards.EdwardsPoint.Insts.CoreOpsArithMulAssignScalar :
  core.ops.arith.MulAssign edwards.EdwardsPoint scalar.Scalar := {
  mul_assign :=
    edwards.EdwardsPoint.Insts.CoreOpsArithMulAssignScalar.mul_assign
}

/-- [curve25519_dalek::scalar::{curve25519_dalek::backend::serial::u64::scalar::Scalar52}::pack]:
    Source: 'curve25519-dalek/src/scalar.rs', lines 1161:4-1165:5 -/
def scalar.Scalar52.pack
  (self : backend.serial.u64.scalar.Scalar52) : Result scalar.Scalar := do
  let a ← backend.serial.u64.scalar.Scalar52.as_bytes self
  ok { bytes := a }

/-- [curve25519_dalek::scalar::{curve25519_dalek::scalar::Scalar}::unpack]:
    Source: 'curve25519-dalek/src/scalar.rs', lines 1139:4-1141:5 -/
def scalar.Scalar.unpack
  (self : scalar.Scalar) : Result backend.serial.u64.scalar.Scalar52 := do
  backend.serial.u64.scalar.Scalar52.from_bytes self.bytes

/-- [curve25519_dalek::scalar::{curve25519_dalek::scalar::Scalar}::reduce]:
    Source: 'curve25519-dalek/src/scalar.rs', lines 1145:4-1150:5 -/
def scalar.Scalar.reduce (self : scalar.Scalar) : Result scalar.Scalar := do
  let x ← scalar.Scalar.unpack self
  let xR ←
    backend.serial.u64.scalar.Scalar52.mul_internal x
      backend.serial.u64.constants.R
  let x_mod_l ← backend.serial.u64.scalar.Scalar52.montgomery_reduce xR
  scalar.Scalar52.pack x_mod_l

/-- [curve25519_dalek::scalar::{impl core::ops::index::Index<usize, u8> for curve25519_dalek::scalar::Scalar}::index]:
    Source: 'curve25519-dalek/src/scalar.rs', lines 317:4-319:5
    Visibility: public -/
def scalar.Scalar.Insts.CoreOpsIndexIndexUsizeU8.index
  (self : scalar.Scalar) (_index : Std.Usize) : Result Std.U8 := do
  Array.index_usize self.bytes _index

/-- [curve25519_dalek::scalar::{curve25519_dalek::scalar::Scalar}::from_bytes_mod_order]:
    Source: 'curve25519-dalek/src/scalar.rs', lines 244:4-253:5
    Visibility: public -/
def scalar.Scalar.from_bytes_mod_order
  (bytes : Array Std.U8 32#usize) : Result scalar.Scalar := do
  let s ← scalar.Scalar.reduce { bytes }
  let i ← scalar.Scalar.Insts.CoreOpsIndexIndexUsizeU8.index s 31#usize
  let right_val ← i >>> 7#i32
  massert (0#u8 = right_val)
  ok s

/-- [curve25519_dalek::scalar::{curve25519_dalek::scalar::Scalar}::from_bytes_mod_order_wide]:
    Source: 'curve25519-dalek/src/scalar.rs', lines 257:4-259:5
    Visibility: public -/
def scalar.Scalar.from_bytes_mod_order_wide
  (input : Array Std.U8 64#usize) : Result scalar.Scalar := do
  let s ← backend.serial.u64.scalar.Scalar52.from_bytes_wide input
  scalar.Scalar52.pack s

end curve25519_dalek