void curve448_scalar_halve(curve448_scalar_t out, const curve448_scalar_t a)
{
    c448_word_t mask = 0 - (a->limb[0] & 1);
    c448_dword_t chain = 0;
    unsigned int i;
    for (i = 0; i < C448_SCALAR_LIMBS; i++) {
        chain = (chain + a->limb[i]) + (sc_p->limb[i] & mask);
        out->limb[i] = (c448_word_t)chain;
        chain >>= C448_WORD_BITS;
    }
    for (i = 0; i < C448_SCALAR_LIMBS - 1; i++)
        out->limb[i] = out->limb[i] >> 1 | out->limb[i + 1] << (WBITS - 1);
    out->limb[i] = out->limb[i] >> 1 | (c448_word_t)(chain << (WBITS - 1));
}
['void x448_derive_public_key(uint8_t out[X_PUBLIC_BYTES],\n                            const uint8_t scalar[X_PRIVATE_BYTES])\n{\n    uint8_t scalar2[X_PRIVATE_BYTES];\n    curve448_scalar_t the_scalar;\n    curve448_point_t p;\n    unsigned int i;\n    memcpy(scalar2, scalar, sizeof(scalar2));\n    scalar2[0] &= -(uint8_t)COFACTOR;\n    scalar2[X_PRIVATE_BYTES - 1] &= ~((0u - 1u) << ((X_PRIVATE_BITS + 7) % 8));\n    scalar2[X_PRIVATE_BYTES - 1] |= 1 << ((X_PRIVATE_BITS + 7) % 8);\n    curve448_scalar_decode_long(the_scalar, scalar2, sizeof(scalar2));\n    for (i = 1; i < X448_ENCODE_RATIO; i <<= 1) {\n        curve448_scalar_halve(the_scalar, the_scalar);\n    }\n    curve448_precomputed_scalarmul(p, curve448_precomputed_base, the_scalar);\n    curve448_point_mul_by_ratio_and_encode_like_x448(out, p);\n    curve448_point_destroy(p);\n}', 'void curve448_scalar_decode_long(curve448_scalar_t s,\n                                 const unsigned char *ser, size_t ser_len)\n{\n    size_t i;\n    curve448_scalar_t t1, t2;\n    if (ser_len == 0) {\n        curve448_scalar_copy(s, curve448_scalar_zero);\n        return;\n    }\n    i = ser_len - (ser_len % C448_SCALAR_BYTES);\n    if (i == ser_len)\n        i -= C448_SCALAR_BYTES;\n    scalar_decode_short(t1, &ser[i], ser_len - i);\n    if (ser_len == sizeof(curve448_scalar_t)) {\n        assert(i == 0);\n        curve448_scalar_mul(s, t1, curve448_scalar_one);\n        curve448_scalar_destroy(t1);\n        return;\n    }\n    while (i) {\n        i -= C448_SCALAR_BYTES;\n        sc_montmul(t1, t1, sc_r2);\n        ignore_result(curve448_scalar_decode(t2, ser + i));\n        curve448_scalar_add(t1, t1, t2);\n    }\n    curve448_scalar_copy(s, t1);\n    curve448_scalar_destroy(t1);\n    curve448_scalar_destroy(t2);\n}', 'void curve448_scalar_halve(curve448_scalar_t out, const curve448_scalar_t a)\n{\n    c448_word_t mask = 0 - (a->limb[0] & 1);\n    c448_dword_t chain = 0;\n    unsigned int i;\n    for (i = 0; i < C448_SCALAR_LIMBS; i++) {\n        chain = (chain + a->limb[i]) + (sc_p->limb[i] & mask);\n        out->limb[i] = (c448_word_t)chain;\n        chain >>= C448_WORD_BITS;\n    }\n    for (i = 0; i < C448_SCALAR_LIMBS - 1; i++)\n        out->limb[i] = out->limb[i] >> 1 | out->limb[i + 1] << (WBITS - 1);\n    out->limb[i] = out->limb[i] >> 1 | (c448_word_t)(chain << (WBITS - 1));\n}']