static ossl_inline uint32_t constant_time_is_zero_32(uint32_t a)
{
    return constant_time_msb_32(~a & (a - 1));
}
['c448_error_t curve448_point_decode_like_eddsa_and_mul_by_ratio(\n                                curve448_point_t p,\n                                const uint8_t enc[EDDSA_448_PUBLIC_BYTES])\n{\n    uint8_t enc2[EDDSA_448_PUBLIC_BYTES];\n    mask_t low;\n    mask_t succ;\n    memcpy(enc2, enc, sizeof(enc2));\n    low = ~word_is_zero(enc2[EDDSA_448_PRIVATE_BYTES - 1] & 0x80);\n    enc2[EDDSA_448_PRIVATE_BYTES - 1] &= ~0x80;\n    succ = gf_deserialize(p->y, enc2, 1, 0);\n    succ &= word_is_zero(enc2[EDDSA_448_PRIVATE_BYTES - 1]);\n    gf_sqr(p->x, p->y);\n    gf_sub(p->z, ONE, p->x);\n    gf_mulw(p->t, p->x, EDWARDS_D);\n    gf_sub(p->t, ONE, p->t);\n    gf_mul(p->x, p->z, p->t);\n    succ &= gf_isr(p->t, p->x);\n    gf_mul(p->x, p->t, p->z);\n    gf_cond_neg(p->x, gf_lobit(p->x) ^ low);\n    gf_copy(p->z, ONE);\n    {\n        gf a, b, c, d;\n        gf_sqr(c, p->x);\n        gf_sqr(a, p->y);\n        gf_add(d, c, a);\n        gf_add(p->t, p->y, p->x);\n        gf_sqr(b, p->t);\n        gf_sub(b, b, d);\n        gf_sub(p->t, a, c);\n        gf_sqr(p->x, p->z);\n        gf_add(p->z, p->x, p->x);\n        gf_sub(a, p->z, d);\n        gf_mul(p->x, a, b);\n        gf_mul(p->z, p->t, a);\n        gf_mul(p->y, p->t, d);\n        gf_mul(p->t, b, d);\n        OPENSSL_cleanse(a, sizeof(a));\n        OPENSSL_cleanse(b, sizeof(b));\n        OPENSSL_cleanse(c, sizeof(c));\n        OPENSSL_cleanse(d, sizeof(d));\n    }\n    OPENSSL_cleanse(enc2, sizeof(enc2));\n    assert(curve448_point_valid(p) || ~succ);\n    return c448_succeed_if(mask_to_bool(succ));\n}', 'static ossl_inline uint32_t constant_time_is_zero_32(uint32_t a)\n{\n    return constant_time_msb_32(~a & (a - 1));\n}']