void curve448_scalar_halve(curve448_scalar_t out, const curve448_scalar_t a)
{
    c448_word_t mask = 0 - (a->limb[0] & 1);
    c448_dword_t chain = 0;
    unsigned int i;
    for (i = 0; i < C448_SCALAR_LIMBS; i++) {
        chain = (chain + a->limb[i]) + (sc_p->limb[i] & mask);
        out->limb[i] = (c448_word_t)chain;
        chain >>= C448_WORD_BITS;
    }
    for (i = 0; i < C448_SCALAR_LIMBS - 1; i++)
        out->limb[i] = out->limb[i] >> 1 | out->limb[i + 1] << (WBITS - 1);
    out->limb[i] = out->limb[i] >> 1 | (c448_word_t)(chain << (WBITS - 1));
}
['void curve448_precomputed_scalarmul(curve448_point_t out,\n                                    const curve448_precomputed_s * table,\n                                    const curve448_scalar_t scalar)\n{\n    unsigned int i, j, k;\n    const unsigned int n = COMBS_N, t = COMBS_T, s = COMBS_S;\n    niels_t ni;\n    curve448_scalar_t scalar1x;\n    curve448_scalar_add(scalar1x, scalar, precomputed_scalarmul_adjustment);\n    curve448_scalar_halve(scalar1x, scalar1x);\n    for (i = s; i > 0; i--) {\n        if (i != s)\n            point_double_internal(out, out, 0);\n        for (j = 0; j < n; j++) {\n            int tab = 0;\n            mask_t invert;\n            for (k = 0; k < t; k++) {\n                unsigned int bit = (i - 1) + s * (k + j * t);\n                if (bit < C448_SCALAR_BITS)\n                    tab |=\n                        (scalar1x->limb[bit / WBITS] >> (bit % WBITS) & 1) << k;\n            }\n            invert = (tab >> (t - 1)) - 1;\n            tab ^= invert;\n            tab &= (1 << (t - 1)) - 1;\n            constant_time_lookup_niels(ni, &table->table[j << (t - 1)],\n                                       1 << (t - 1), tab);\n            cond_neg_niels(ni, invert);\n            if ((i != s) || j != 0)\n                add_niels_to_pt(out, ni, j == n - 1 && i != 1);\n            else\n                niels_to_pt(out, ni);\n        }\n    }\n    OPENSSL_cleanse(ni, sizeof(ni));\n    OPENSSL_cleanse(scalar1x, sizeof(scalar1x));\n}', 'void curve448_scalar_add(curve448_scalar_t out, const curve448_scalar_t a,\n                         const curve448_scalar_t b)\n{\n    c448_dword_t chain = 0;\n    unsigned int i;\n    for (i = 0; i < C448_SCALAR_LIMBS; i++) {\n        chain = (chain + a->limb[i]) + b->limb[i];\n        out->limb[i] = (c448_word_t)chain;\n        chain >>= WBITS;\n    }\n    sc_subx(out, out->limb, sc_p, sc_p, (c448_word_t)chain);\n}', 'void curve448_scalar_halve(curve448_scalar_t out, const curve448_scalar_t a)\n{\n    c448_word_t mask = 0 - (a->limb[0] & 1);\n    c448_dword_t chain = 0;\n    unsigned int i;\n    for (i = 0; i < C448_SCALAR_LIMBS; i++) {\n        chain = (chain + a->limb[i]) + (sc_p->limb[i] & mask);\n        out->limb[i] = (c448_word_t)chain;\n        chain >>= C448_WORD_BITS;\n    }\n    for (i = 0; i < C448_SCALAR_LIMBS - 1; i++)\n        out->limb[i] = out->limb[i] >> 1 | out->limb[i + 1] << (WBITS - 1);\n    out->limb[i] = out->limb[i] >> 1 | (c448_word_t)(chain << (WBITS - 1));\n}']