void curve448_scalar_halve(curve448_scalar_t out, const curve448_scalar_t a)
{
    c448_word_t mask = 0 - (a->limb[0] & 1);
    c448_dword_t chain = 0;
    unsigned int i;
    for (i = 0; i < C448_SCALAR_LIMBS; i++) {
        chain = (chain + a->limb[i]) + (sc_p->limb[i] & mask);
        out->limb[i] = (c448_word_t)chain;
        chain >>= C448_WORD_BITS;
    }
    for (i = 0; i < C448_SCALAR_LIMBS - 1; i++)
        out->limb[i] = out->limb[i] >> 1 | out->limb[i + 1] << (WBITS - 1);
    out->limb[i] = out->limb[i] >> 1 | (c448_word_t)(chain << (WBITS - 1));
}
['c448_error_t c448_ed448_sign(\n                        uint8_t signature[EDDSA_448_SIGNATURE_BYTES],\n                        const uint8_t privkey[EDDSA_448_PRIVATE_BYTES],\n                        const uint8_t pubkey[EDDSA_448_PUBLIC_BYTES],\n                        const uint8_t *message, size_t message_len,\n                        uint8_t prehashed, const uint8_t *context,\n                        size_t context_len)\n{\n    curve448_scalar_t secret_scalar;\n    EVP_MD_CTX *hashctx = EVP_MD_CTX_new();\n    c448_error_t ret = C448_FAILURE;\n    curve448_scalar_t nonce_scalar;\n    uint8_t nonce_point[EDDSA_448_PUBLIC_BYTES] = { 0 };\n    unsigned int c;\n    curve448_scalar_t challenge_scalar;\n    if (hashctx == NULL)\n        return C448_FAILURE;\n    {\n        uint8_t expanded[EDDSA_448_PRIVATE_BYTES * 2];\n        if (!oneshot_hash(expanded, sizeof(expanded), privkey,\n                          EDDSA_448_PRIVATE_BYTES))\n            goto err;\n        clamp(expanded);\n        curve448_scalar_decode_long(secret_scalar, expanded,\n                                    EDDSA_448_PRIVATE_BYTES);\n        if (!hash_init_with_dom(hashctx, prehashed, 0, context, context_len)\n            || !EVP_DigestUpdate(hashctx, expanded + EDDSA_448_PRIVATE_BYTES,\n                                 EDDSA_448_PRIVATE_BYTES)\n            || !EVP_DigestUpdate(hashctx, message, message_len)) {\n            OPENSSL_cleanse(expanded, sizeof(expanded));\n            goto err;\n        }\n        OPENSSL_cleanse(expanded, sizeof(expanded));\n    }\n    {\n        uint8_t nonce[2 * EDDSA_448_PRIVATE_BYTES];\n        if (!EVP_DigestFinalXOF(hashctx, nonce, sizeof(nonce)))\n            goto err;\n        curve448_scalar_decode_long(nonce_scalar, nonce, sizeof(nonce));\n        OPENSSL_cleanse(nonce, sizeof(nonce));\n    }\n    {\n        curve448_scalar_t nonce_scalar_2;\n        curve448_point_t p;\n        curve448_scalar_halve(nonce_scalar_2, nonce_scalar);\n        for (c = 2; c < C448_EDDSA_ENCODE_RATIO; c <<= 1) {\n            curve448_scalar_halve(nonce_scalar_2, nonce_scalar_2);\n        }\n        curve448_precomputed_scalarmul(p, curve448_precomputed_base,\n                                       nonce_scalar_2);\n        curve448_point_mul_by_ratio_and_encode_like_eddsa(nonce_point, p);\n        curve448_point_destroy(p);\n        curve448_scalar_destroy(nonce_scalar_2);\n    }\n    {\n        uint8_t challenge[2 * EDDSA_448_PRIVATE_BYTES];\n        if (!hash_init_with_dom(hashctx, prehashed, 0, context, context_len)\n            || !EVP_DigestUpdate(hashctx, nonce_point, sizeof(nonce_point))\n            || !EVP_DigestUpdate(hashctx, pubkey, EDDSA_448_PUBLIC_BYTES)\n            || !EVP_DigestUpdate(hashctx, message, message_len)\n            || !EVP_DigestFinalXOF(hashctx, challenge, sizeof(challenge)))\n            goto err;\n        curve448_scalar_decode_long(challenge_scalar, challenge,\n                                    sizeof(challenge));\n        OPENSSL_cleanse(challenge, sizeof(challenge));\n    }\n    curve448_scalar_mul(challenge_scalar, challenge_scalar, secret_scalar);\n    curve448_scalar_add(challenge_scalar, challenge_scalar, nonce_scalar);\n    OPENSSL_cleanse(signature, EDDSA_448_SIGNATURE_BYTES);\n    memcpy(signature, nonce_point, sizeof(nonce_point));\n    curve448_scalar_encode(&signature[EDDSA_448_PUBLIC_BYTES],\n                           challenge_scalar);\n    curve448_scalar_destroy(secret_scalar);\n    curve448_scalar_destroy(nonce_scalar);\n    curve448_scalar_destroy(challenge_scalar);\n    ret = C448_SUCCESS;\n err:\n    EVP_MD_CTX_free(hashctx);\n    return ret;\n}', 'void curve448_scalar_halve(curve448_scalar_t out, const curve448_scalar_t a)\n{\n    c448_word_t mask = 0 - (a->limb[0] & 1);\n    c448_dword_t chain = 0;\n    unsigned int i;\n    for (i = 0; i < C448_SCALAR_LIMBS; i++) {\n        chain = (chain + a->limb[i]) + (sc_p->limb[i] & mask);\n        out->limb[i] = (c448_word_t)chain;\n        chain >>= C448_WORD_BITS;\n    }\n    for (i = 0; i < C448_SCALAR_LIMBS - 1; i++)\n        out->limb[i] = out->limb[i] >> 1 | out->limb[i + 1] << (WBITS - 1);\n    out->limb[i] = out->limb[i] >> 1 | (c448_word_t)(chain << (WBITS - 1));\n}']