c448_error_t x448_int(uint8_t out[X_PUBLIC_BYTES],
                      const uint8_t base[X_PUBLIC_BYTES],
                      const uint8_t scalar[X_PRIVATE_BYTES])
{
    gf x1, x2, z2, x3, z3, t1, t2;
    int t;
    mask_t swap = 0;
    mask_t nz;
    ignore_result(gf_deserialize(x1, base, 1, 0));
    gf_copy(x2, ONE);
    gf_copy(z2, ZERO);
    gf_copy(x3, x1);
    gf_copy(z3, ONE);
    for (t = X_PRIVATE_BITS - 1; t >= 0; t--) {
        uint8_t sb = scalar[t / 8];
        mask_t k_t;
        if (t / 8 == 0)
            sb &= -(uint8_t)COFACTOR;
        else if (t == X_PRIVATE_BITS - 1)
            sb = -1;
        k_t = (sb >> (t % 8)) & 1;
        k_t = 0 - k_t;
        swap ^= k_t;
        gf_cond_swap(x2, x3, swap);
        gf_cond_swap(z2, z3, swap);
        swap = k_t;
        gf_add_nr(t1, x2, z2);
        gf_sub_nr(t2, x2, z2);
        gf_sub_nr(z2, x3, z3);
        gf_mul(x2, t1, z2);
        gf_add_nr(z2, z3, x3);
        gf_mul(x3, t2, z2);
        gf_sub_nr(z3, x2, x3);
        gf_sqr(z2, z3);
        gf_mul(z3, x1, z2);
        gf_add_nr(z2, x2, x3);
        gf_sqr(x3, z2);
        gf_sqr(z2, t1);
        gf_sqr(t1, t2);
        gf_mul(x2, z2, t1);
        gf_sub_nr(t2, z2, t1);
        gf_mulw(t1, t2, -EDWARDS_D);
        gf_add_nr(t1, t1, z2);
        gf_mul(z2, t2, t1);
    }
    gf_cond_swap(x2, x3, swap);
    gf_cond_swap(z2, z3, swap);
    gf_invert(z2, z2, 0);
    gf_mul(x1, x2, z2);
    gf_serialize(out, x1, 1);
    nz = ~gf_eq(x1, ZERO);
    OPENSSL_cleanse(x1, sizeof(x1));
    OPENSSL_cleanse(x2, sizeof(x2));
    OPENSSL_cleanse(z2, sizeof(z2));
    OPENSSL_cleanse(x3, sizeof(x3));
    OPENSSL_cleanse(z3, sizeof(z3));
    OPENSSL_cleanse(t1, sizeof(t1));
    OPENSSL_cleanse(t2, sizeof(t2));
    return c448_succeed_if(mask_to_bool(nz));
}
['c448_error_t x448_int(uint8_t out[X_PUBLIC_BYTES],\n                      const uint8_t base[X_PUBLIC_BYTES],\n                      const uint8_t scalar[X_PRIVATE_BYTES])\n{\n    gf x1, x2, z2, x3, z3, t1, t2;\n    int t;\n    mask_t swap = 0;\n    mask_t nz;\n    ignore_result(gf_deserialize(x1, base, 1, 0));\n    gf_copy(x2, ONE);\n    gf_copy(z2, ZERO);\n    gf_copy(x3, x1);\n    gf_copy(z3, ONE);\n    for (t = X_PRIVATE_BITS - 1; t >= 0; t--) {\n        uint8_t sb = scalar[t / 8];\n        mask_t k_t;\n        if (t / 8 == 0)\n            sb &= -(uint8_t)COFACTOR;\n        else if (t == X_PRIVATE_BITS - 1)\n            sb = -1;\n        k_t = (sb >> (t % 8)) & 1;\n        k_t = 0 - k_t;\n        swap ^= k_t;\n        gf_cond_swap(x2, x3, swap);\n        gf_cond_swap(z2, z3, swap);\n        swap = k_t;\n        gf_add_nr(t1, x2, z2);\n        gf_sub_nr(t2, x2, z2);\n        gf_sub_nr(z2, x3, z3);\n        gf_mul(x2, t1, z2);\n        gf_add_nr(z2, z3, x3);\n        gf_mul(x3, t2, z2);\n        gf_sub_nr(z3, x2, x3);\n        gf_sqr(z2, z3);\n        gf_mul(z3, x1, z2);\n        gf_add_nr(z2, x2, x3);\n        gf_sqr(x3, z2);\n        gf_sqr(z2, t1);\n        gf_sqr(t1, t2);\n        gf_mul(x2, z2, t1);\n        gf_sub_nr(t2, z2, t1);\n        gf_mulw(t1, t2, -EDWARDS_D);\n        gf_add_nr(t1, t1, z2);\n        gf_mul(z2, t2, t1);\n    }\n    gf_cond_swap(x2, x3, swap);\n    gf_cond_swap(z2, z3, swap);\n    gf_invert(z2, z2, 0);\n    gf_mul(x1, x2, z2);\n    gf_serialize(out, x1, 1);\n    nz = ~gf_eq(x1, ZERO);\n    OPENSSL_cleanse(x1, sizeof(x1));\n    OPENSSL_cleanse(x2, sizeof(x2));\n    OPENSSL_cleanse(z2, sizeof(z2));\n    OPENSSL_cleanse(x3, sizeof(x3));\n    OPENSSL_cleanse(z3, sizeof(z3));\n    OPENSSL_cleanse(t1, sizeof(t1));\n    OPENSSL_cleanse(t2, sizeof(t2));\n    return c448_succeed_if(mask_to_bool(nz));\n}']