c448_error_t curve448_point_decode_like_eddsa_and_mul_by_ratio(
                                curve448_point_t p,
                                const uint8_t enc[EDDSA_448_PUBLIC_BYTES])
{
    uint8_t enc2[EDDSA_448_PUBLIC_BYTES];
    mask_t low;
    mask_t succ;
    memcpy(enc2, enc, sizeof(enc2));
    low = ~word_is_zero(enc2[EDDSA_448_PRIVATE_BYTES - 1] & 0x80);
    enc2[EDDSA_448_PRIVATE_BYTES - 1] &= ~0x80;
    succ = gf_deserialize(p->y, enc2, 1, 0);
#if 0 == 0
    succ &= word_is_zero(enc2[EDDSA_448_PRIVATE_BYTES - 1]);
#endif
    gf_sqr(p->x, p->y);
    gf_sub(p->z, ONE, p->x);
    gf_mulw(p->t, p->x, EDWARDS_D);
    gf_sub(p->t, ONE, p->t);
    gf_mul(p->x, p->z, p->t);
    succ &= gf_isr(p->t, p->x);
    gf_mul(p->x, p->t, p->z);
    gf_cond_neg(p->x, gf_lobit(p->x) ^ low);
    gf_copy(p->z, ONE);
    {
        gf a, b, c, d;
        gf_sqr(c, p->x);
        gf_sqr(a, p->y);
        gf_add(d, c, a);
        gf_add(p->t, p->y, p->x);
        gf_sqr(b, p->t);
        gf_sub(b, b, d);
        gf_sub(p->t, a, c);
        gf_sqr(p->x, p->z);
        gf_add(p->z, p->x, p->x);
        gf_sub(a, p->z, d);
        gf_mul(p->x, a, b);
        gf_mul(p->z, p->t, a);
        gf_mul(p->y, p->t, d);
        gf_mul(p->t, b, d);
        OPENSSL_cleanse(a, sizeof(a));
        OPENSSL_cleanse(b, sizeof(b));
        OPENSSL_cleanse(c, sizeof(c));
        OPENSSL_cleanse(d, sizeof(d));
    }
    OPENSSL_cleanse(enc2, sizeof(enc2));
    assert(curve448_point_valid(p) || ~succ);
    return c448_succeed_if(mask_to_bool(succ));
}
['c448_error_t curve448_point_decode_like_eddsa_and_mul_by_ratio(\n                                curve448_point_t p,\n                                const uint8_t enc[EDDSA_448_PUBLIC_BYTES])\n{\n    uint8_t enc2[EDDSA_448_PUBLIC_BYTES];\n    mask_t low;\n    mask_t succ;\n    memcpy(enc2, enc, sizeof(enc2));\n    low = ~word_is_zero(enc2[EDDSA_448_PRIVATE_BYTES - 1] & 0x80);\n    enc2[EDDSA_448_PRIVATE_BYTES - 1] &= ~0x80;\n    succ = gf_deserialize(p->y, enc2, 1, 0);\n#if 0 == 0\n    succ &= word_is_zero(enc2[EDDSA_448_PRIVATE_BYTES - 1]);\n#endif\n    gf_sqr(p->x, p->y);\n    gf_sub(p->z, ONE, p->x);\n    gf_mulw(p->t, p->x, EDWARDS_D);\n    gf_sub(p->t, ONE, p->t);\n    gf_mul(p->x, p->z, p->t);\n    succ &= gf_isr(p->t, p->x);\n    gf_mul(p->x, p->t, p->z);\n    gf_cond_neg(p->x, gf_lobit(p->x) ^ low);\n    gf_copy(p->z, ONE);\n    {\n        gf a, b, c, d;\n        gf_sqr(c, p->x);\n        gf_sqr(a, p->y);\n        gf_add(d, c, a);\n        gf_add(p->t, p->y, p->x);\n        gf_sqr(b, p->t);\n        gf_sub(b, b, d);\n        gf_sub(p->t, a, c);\n        gf_sqr(p->x, p->z);\n        gf_add(p->z, p->x, p->x);\n        gf_sub(a, p->z, d);\n        gf_mul(p->x, a, b);\n        gf_mul(p->z, p->t, a);\n        gf_mul(p->y, p->t, d);\n        gf_mul(p->t, b, d);\n        OPENSSL_cleanse(a, sizeof(a));\n        OPENSSL_cleanse(b, sizeof(b));\n        OPENSSL_cleanse(c, sizeof(c));\n        OPENSSL_cleanse(d, sizeof(d));\n    }\n    OPENSSL_cleanse(enc2, sizeof(enc2));\n    assert(curve448_point_valid(p) || ~succ);\n    return c448_succeed_if(mask_to_bool(succ));\n}']