/* Autogenerated: 'src/ExtractionOCaml/unsaturated_solinas' --lang Java --cmovznz-by-mul --widen-carry --widen-bytes --internal-static --package-name fiat_crypto --class-case UpperCamelCase --no-field-element-typedefs Poly1305 32 '(auto)' '2^130 - 5' carry_mul carry_square carry add sub opp selectznz to_bytes from_bytes relax */
/* curve description: Poly1305 */
/* machine_wordsize = 32 (from "32") */
/* requested operations: carry_mul, carry_square, carry, add, sub, opp, selectznz, to_bytes, from_bytes, relax */
/* n = 5 (from "(auto)") */
/* s-c = 2^130 - [(1, 5)] (from "2^130 - 5") */
/* tight_bounds_multiplier = 1 (from "") */
/*  */
/* Computed values: */
/*   carry_chain = [0, 1, 2, 3, 4, 0, 1] */
/*   eval z = z[0] + (z[1] << 26) + (z[2] << 52) + (z[3] << 78) + (z[4] << 104) */
/*   bytes_eval z = z[0] + (z[1] << 8) + (z[2] << 16) + (z[3] << 24) + (z[4] << 32) + (z[5] << 40) + (z[6] << 48) + (z[7] << 56) + (z[8] << 64) + (z[9] << 72) + (z[10] << 80) + (z[11] << 88) + (z[12] << 96) + (z[13] << 104) + (z[14] << 112) + (z[15] << 120) + (z[16] << 128) */
/*   balance = [0x7fffff6, 0x7fffffe, 0x7fffffe, 0x7fffffe, 0x7fffffe] */

package fiat_crypto;

public final class FiatPoly1305 {

static class Box<T> {
  private T value;
  public Box(T value) { this.value = value; }
  public void set(T value) { this.value = value; }
  public T get() { return this.value; }
}



/**
 * The function fiat_Poly1305_addcarryx_u26 is an addition with carry. <p>
 * <p>
 * Postconditions: <p>
 *   out1 = (arg1 + arg2 + arg3) mod 2^26 <p>
 *   out2 = ⌊(arg1 + arg2 + arg3) / 2^26⌋ <p>
 * <p>
 * Input Bounds: <p>
 *   arg1: [0x0 ~&gt; 0x1] <p>
 *   arg2: [0x0 ~&gt; 0x3ffffff] <p>
 *   arg3: [0x0 ~&gt; 0x3ffffff] <p>
 * Output Bounds: <p>
 *   out1: [0x0 ~&gt; 0x3ffffff] <p>
 *   out2: [0x0 ~&gt; 0x1] <p>
 */
static void fiat_Poly1305_addcarryx_u26(Box<Integer> out1, Box<Integer> out2, int arg1, int arg2, int arg3) {
  int x1 = ((arg1 + arg2) + arg3);
  int x2 = (x1 & 0x3ffffff);
  int x3 = (x1 >>> 26);
  out1.set(x2);
  out2.set(x3);
}

/**
 * The function fiat_Poly1305_subborrowx_u26 is a subtraction with borrow. <p>
 * <p>
 * Postconditions: <p>
 *   out1 = (-arg1 + arg2 + -arg3) mod 2^26 <p>
 *   out2 = -⌊(-arg1 + arg2 + -arg3) / 2^26⌋ <p>
 * <p>
 * Input Bounds: <p>
 *   arg1: [0x0 ~&gt; 0x1] <p>
 *   arg2: [0x0 ~&gt; 0x3ffffff] <p>
 *   arg3: [0x0 ~&gt; 0x3ffffff] <p>
 * Output Bounds: <p>
 *   out1: [0x0 ~&gt; 0x3ffffff] <p>
 *   out2: [0x0 ~&gt; 0x1] <p>
 */
static void fiat_Poly1305_subborrowx_u26(Box<Integer> out1, Box<Integer> out2, int arg1, int arg2, int arg3) {
  int x1 = (((int) Integer.toUnsignedLong(((Number) (arg2)).intValue()) - (int) Integer.toUnsignedLong(((Number) (arg1)).intValue())) - (int) Integer.toUnsignedLong(((Number) (arg3)).intValue()));
  int x2 = (x1 >>> 26);
  int x3 = ((int) Integer.toUnsignedLong(((Number) (x1)).intValue()) & 0x3ffffff);
  out1.set(x3);
  out2.set(((int) Integer.toUnsignedLong(((Number) (0x0)).intValue()) - (int) Integer.toUnsignedLong(((Number) (x2)).intValue())));
}

/**
 * The function fiat_Poly1305_cmovznz_u32 is a single-word conditional move. <p>
 * <p>
 * Postconditions: <p>
 *   out1 = (if arg1 = 0 then arg2 else arg3) <p>
 * <p>
 * Input Bounds: <p>
 *   arg1: [0x0 ~&gt; 0x1] <p>
 *   arg2: [0x0 ~&gt; 0xffffffff] <p>
 *   arg3: [0x0 ~&gt; 0xffffffff] <p>
 * Output Bounds: <p>
 *   out1: [0x0 ~&gt; 0xffffffff] <p>
 */
static void fiat_Poly1305_cmovznz_u32(Box<Integer> out1, int arg1, int arg2, int arg3) {
  int x1 = (arg1 * 0xffffffff);
  int x2 = ((x1 & arg3) | ((~x1) & arg2));
  out1.set(x2);
}

/**
 * The function fiat_Poly1305_carry_mul multiplies two field elements and reduces the result. <p>
 * <p>
 * Postconditions: <p>
 *   eval out1 mod m = (eval arg1 * eval arg2) mod m <p>
 * <p>
 * Input Bounds: <p>
 *   arg1: [[0x0 ~&gt; 0xc000000], [0x0 ~&gt; 0xc000000], [0x0 ~&gt; 0xc000000], [0x0 ~&gt; 0xc000000], [0x0 ~&gt; 0xc000000]] <p>
 *   arg2: [[0x0 ~&gt; 0xc000000], [0x0 ~&gt; 0xc000000], [0x0 ~&gt; 0xc000000], [0x0 ~&gt; 0xc000000], [0x0 ~&gt; 0xc000000]] <p>
 * Output Bounds: <p>
 *   out1: [[0x0 ~&gt; 0x4000000], [0x0 ~&gt; 0x4000000], [0x0 ~&gt; 0x4000000], [0x0 ~&gt; 0x4000000], [0x0 ~&gt; 0x4000000]] <p>
 */
public static void fiat_Poly1305_carry_mul(int[] out1, final int[] arg1, final int[] arg2) {
  long x1 = ((long) Integer.toUnsignedLong(((Number) ((arg1[4]))).intValue()) * (long) Integer.toUnsignedLong(((Number) (((arg2[4]) * 0x5))).intValue()));
  long x2 = ((long) Integer.toUnsignedLong(((Number) ((arg1[4]))).intValue()) * (long) Integer.toUnsignedLong(((Number) (((arg2[3]) * 0x5))).intValue()));
  long x3 = ((long) Integer.toUnsignedLong(((Number) ((arg1[4]))).intValue()) * (long) Integer.toUnsignedLong(((Number) (((arg2[2]) * 0x5))).intValue()));
  long x4 = ((long) Integer.toUnsignedLong(((Number) ((arg1[4]))).intValue()) * (long) Integer.toUnsignedLong(((Number) (((arg2[1]) * 0x5))).intValue()));
  long x5 = ((long) Integer.toUnsignedLong(((Number) ((arg1[3]))).intValue()) * (long) Integer.toUnsignedLong(((Number) (((arg2[4]) * 0x5))).intValue()));
  long x6 = ((long) Integer.toUnsignedLong(((Number) ((arg1[3]))).intValue()) * (long) Integer.toUnsignedLong(((Number) (((arg2[3]) * 0x5))).intValue()));
  long x7 = ((long) Integer.toUnsignedLong(((Number) ((arg1[3]))).intValue()) * (long) Integer.toUnsignedLong(((Number) (((arg2[2]) * 0x5))).intValue()));
  long x8 = ((long) Integer.toUnsignedLong(((Number) ((arg1[2]))).intValue()) * (long) Integer.toUnsignedLong(((Number) (((arg2[4]) * 0x5))).intValue()));
  long x9 = ((long) Integer.toUnsignedLong(((Number) ((arg1[2]))).intValue()) * (long) Integer.toUnsignedLong(((Number) (((arg2[3]) * 0x5))).intValue()));
  long x10 = ((long) Integer.toUnsignedLong(((Number) ((arg1[1]))).intValue()) * (long) Integer.toUnsignedLong(((Number) (((arg2[4]) * 0x5))).intValue()));
  long x11 = ((long) Integer.toUnsignedLong(((Number) ((arg1[4]))).intValue()) * (long) Integer.toUnsignedLong(((Number) ((arg2[0]))).intValue()));
  long x12 = ((long) Integer.toUnsignedLong(((Number) ((arg1[3]))).intValue()) * (long) Integer.toUnsignedLong(((Number) ((arg2[1]))).intValue()));
  long x13 = ((long) Integer.toUnsignedLong(((Number) ((arg1[3]))).intValue()) * (long) Integer.toUnsignedLong(((Number) ((arg2[0]))).intValue()));
  long x14 = ((long) Integer.toUnsignedLong(((Number) ((arg1[2]))).intValue()) * (long) Integer.toUnsignedLong(((Number) ((arg2[2]))).intValue()));
  long x15 = ((long) Integer.toUnsignedLong(((Number) ((arg1[2]))).intValue()) * (long) Integer.toUnsignedLong(((Number) ((arg2[1]))).intValue()));
  long x16 = ((long) Integer.toUnsignedLong(((Number) ((arg1[2]))).intValue()) * (long) Integer.toUnsignedLong(((Number) ((arg2[0]))).intValue()));
  long x17 = ((long) Integer.toUnsignedLong(((Number) ((arg1[1]))).intValue()) * (long) Integer.toUnsignedLong(((Number) ((arg2[3]))).intValue()));
  long x18 = ((long) Integer.toUnsignedLong(((Number) ((arg1[1]))).intValue()) * (long) Integer.toUnsignedLong(((Number) ((arg2[2]))).intValue()));
  long x19 = ((long) Integer.toUnsignedLong(((Number) ((arg1[1]))).intValue()) * (long) Integer.toUnsignedLong(((Number) ((arg2[1]))).intValue()));
  long x20 = ((long) Integer.toUnsignedLong(((Number) ((arg1[1]))).intValue()) * (long) Integer.toUnsignedLong(((Number) ((arg2[0]))).intValue()));
  long x21 = ((long) Integer.toUnsignedLong(((Number) ((arg1[0]))).intValue()) * (long) Integer.toUnsignedLong(((Number) ((arg2[4]))).intValue()));
  long x22 = ((long) Integer.toUnsignedLong(((Number) ((arg1[0]))).intValue()) * (long) Integer.toUnsignedLong(((Number) ((arg2[3]))).intValue()));
  long x23 = ((long) Integer.toUnsignedLong(((Number) ((arg1[0]))).intValue()) * (long) Integer.toUnsignedLong(((Number) ((arg2[2]))).intValue()));
  long x24 = ((long) Integer.toUnsignedLong(((Number) ((arg1[0]))).intValue()) * (long) Integer.toUnsignedLong(((Number) ((arg2[1]))).intValue()));
  long x25 = ((long) Integer.toUnsignedLong(((Number) ((arg1[0]))).intValue()) * (long) Integer.toUnsignedLong(((Number) ((arg2[0]))).intValue()));
  long x26 = (x25 + (x10 + (x9 + (x7 + x4))));
  long x27 = (x26 >>> 26);
  int x28 = ((int) Integer.toUnsignedLong(((Number) (x26)).intValue()) & 0x3ffffff);
  long x29 = (x21 + (x17 + (x14 + (x12 + x11))));
  long x30 = (x22 + (x18 + (x15 + (x13 + x1))));
  long x31 = (x23 + (x19 + (x16 + (x5 + x2))));
  long x32 = (x24 + (x20 + (x8 + (x6 + x3))));
  long x33 = (x27 + x32);
  long x34 = (x33 >>> 26);
  int x35 = ((int) Integer.toUnsignedLong(((Number) (x33)).intValue()) & 0x3ffffff);
  long x36 = (x34 + x31);
  long x37 = (x36 >>> 26);
  int x38 = ((int) Integer.toUnsignedLong(((Number) (x36)).intValue()) & 0x3ffffff);
  long x39 = (x37 + x30);
  long x40 = (x39 >>> 26);
  int x41 = ((int) Integer.toUnsignedLong(((Number) (x39)).intValue()) & 0x3ffffff);
  long x42 = (x40 + x29);
  int x43 = (int) Integer.toUnsignedLong(((Number) ((x42 >>> 26))).intValue());
  int x44 = ((int) Integer.toUnsignedLong(((Number) (x42)).intValue()) & 0x3ffffff);
  long x45 = ((long) Integer.toUnsignedLong(((Number) (x43)).intValue()) * (long) Integer.toUnsignedLong(((Number) (0x5)).intValue()));
  long x46 = ((long) Integer.toUnsignedLong(((Number) (x28)).intValue()) + x45);
  int x47 = (int) Integer.toUnsignedLong(((Number) ((x46 >>> 26))).intValue());
  int x48 = ((int) Integer.toUnsignedLong(((Number) (x46)).intValue()) & 0x3ffffff);
  int x49 = (x47 + x35);
  int x50 = (x49 >>> 26);
  int x51 = (x49 & 0x3ffffff);
  int x52 = (x50 + x38);
  out1[0] = x48;
  out1[1] = x51;
  out1[2] = x52;
  out1[3] = x41;
  out1[4] = x44;
}

/**
 * The function fiat_Poly1305_carry_square squares a field element and reduces the result. <p>
 * <p>
 * Postconditions: <p>
 *   eval out1 mod m = (eval arg1 * eval arg1) mod m <p>
 * <p>
 * Input Bounds: <p>
 *   arg1: [[0x0 ~&gt; 0xc000000], [0x0 ~&gt; 0xc000000], [0x0 ~&gt; 0xc000000], [0x0 ~&gt; 0xc000000], [0x0 ~&gt; 0xc000000]] <p>
 * Output Bounds: <p>
 *   out1: [[0x0 ~&gt; 0x4000000], [0x0 ~&gt; 0x4000000], [0x0 ~&gt; 0x4000000], [0x0 ~&gt; 0x4000000], [0x0 ~&gt; 0x4000000]] <p>
 */
public static void fiat_Poly1305_carry_square(int[] out1, final int[] arg1) {
  int x1 = ((arg1[4]) * 0x5);
  int x2 = (x1 * 0x2);
  int x3 = ((arg1[4]) * 0x2);
  int x4 = ((arg1[3]) * 0x5);
  int x5 = (x4 * 0x2);
  int x6 = ((arg1[3]) * 0x2);
  int x7 = ((arg1[2]) * 0x2);
  int x8 = ((arg1[1]) * 0x2);
  long x9 = ((long) Integer.toUnsignedLong(((Number) ((arg1[4]))).intValue()) * (long) Integer.toUnsignedLong(((Number) (x1)).intValue()));
  long x10 = ((long) Integer.toUnsignedLong(((Number) ((arg1[3]))).intValue()) * (long) Integer.toUnsignedLong(((Number) (x2)).intValue()));
  long x11 = ((long) Integer.toUnsignedLong(((Number) ((arg1[3]))).intValue()) * (long) Integer.toUnsignedLong(((Number) (x4)).intValue()));
  long x12 = ((long) Integer.toUnsignedLong(((Number) ((arg1[2]))).intValue()) * (long) Integer.toUnsignedLong(((Number) (x2)).intValue()));
  long x13 = ((long) Integer.toUnsignedLong(((Number) ((arg1[2]))).intValue()) * (long) Integer.toUnsignedLong(((Number) (x5)).intValue()));
  long x14 = ((long) Integer.toUnsignedLong(((Number) ((arg1[2]))).intValue()) * (long) Integer.toUnsignedLong(((Number) ((arg1[2]))).intValue()));
  long x15 = ((long) Integer.toUnsignedLong(((Number) ((arg1[1]))).intValue()) * (long) Integer.toUnsignedLong(((Number) (x2)).intValue()));
  long x16 = ((long) Integer.toUnsignedLong(((Number) ((arg1[1]))).intValue()) * (long) Integer.toUnsignedLong(((Number) (x6)).intValue()));
  long x17 = ((long) Integer.toUnsignedLong(((Number) ((arg1[1]))).intValue()) * (long) Integer.toUnsignedLong(((Number) (x7)).intValue()));
  long x18 = ((long) Integer.toUnsignedLong(((Number) ((arg1[1]))).intValue()) * (long) Integer.toUnsignedLong(((Number) ((arg1[1]))).intValue()));
  long x19 = ((long) Integer.toUnsignedLong(((Number) ((arg1[0]))).intValue()) * (long) Integer.toUnsignedLong(((Number) (x3)).intValue()));
  long x20 = ((long) Integer.toUnsignedLong(((Number) ((arg1[0]))).intValue()) * (long) Integer.toUnsignedLong(((Number) (x6)).intValue()));
  long x21 = ((long) Integer.toUnsignedLong(((Number) ((arg1[0]))).intValue()) * (long) Integer.toUnsignedLong(((Number) (x7)).intValue()));
  long x22 = ((long) Integer.toUnsignedLong(((Number) ((arg1[0]))).intValue()) * (long) Integer.toUnsignedLong(((Number) (x8)).intValue()));
  long x23 = ((long) Integer.toUnsignedLong(((Number) ((arg1[0]))).intValue()) * (long) Integer.toUnsignedLong(((Number) ((arg1[0]))).intValue()));
  long x24 = (x23 + (x15 + x13));
  long x25 = (x24 >>> 26);
  int x26 = ((int) Integer.toUnsignedLong(((Number) (x24)).intValue()) & 0x3ffffff);
  long x27 = (x19 + (x16 + x14));
  long x28 = (x20 + (x17 + x9));
  long x29 = (x21 + (x18 + x10));
  long x30 = (x22 + (x12 + x11));
  long x31 = (x25 + x30);
  long x32 = (x31 >>> 26);
  int x33 = ((int) Integer.toUnsignedLong(((Number) (x31)).intValue()) & 0x3ffffff);
  long x34 = (x32 + x29);
  long x35 = (x34 >>> 26);
  int x36 = ((int) Integer.toUnsignedLong(((Number) (x34)).intValue()) & 0x3ffffff);
  long x37 = (x35 + x28);
  long x38 = (x37 >>> 26);
  int x39 = ((int) Integer.toUnsignedLong(((Number) (x37)).intValue()) & 0x3ffffff);
  long x40 = (x38 + x27);
  int x41 = (int) Integer.toUnsignedLong(((Number) ((x40 >>> 26))).intValue());
  int x42 = ((int) Integer.toUnsignedLong(((Number) (x40)).intValue()) & 0x3ffffff);
  long x43 = ((long) Integer.toUnsignedLong(((Number) (x41)).intValue()) * (long) Integer.toUnsignedLong(((Number) (0x5)).intValue()));
  long x44 = ((long) Integer.toUnsignedLong(((Number) (x26)).intValue()) + x43);
  int x45 = (int) Integer.toUnsignedLong(((Number) ((x44 >>> 26))).intValue());
  int x46 = ((int) Integer.toUnsignedLong(((Number) (x44)).intValue()) & 0x3ffffff);
  int x47 = (x45 + x33);
  int x48 = (x47 >>> 26);
  int x49 = (x47 & 0x3ffffff);
  int x50 = (x48 + x36);
  out1[0] = x46;
  out1[1] = x49;
  out1[2] = x50;
  out1[3] = x39;
  out1[4] = x42;
}

/**
 * The function fiat_Poly1305_carry reduces a field element. <p>
 * <p>
 * Postconditions: <p>
 *   eval out1 mod m = eval arg1 mod m <p>
 * <p>
 * Input Bounds: <p>
 *   arg1: [[0x0 ~&gt; 0xc000000], [0x0 ~&gt; 0xc000000], [0x0 ~&gt; 0xc000000], [0x0 ~&gt; 0xc000000], [0x0 ~&gt; 0xc000000]] <p>
 * Output Bounds: <p>
 *   out1: [[0x0 ~&gt; 0x4000000], [0x0 ~&gt; 0x4000000], [0x0 ~&gt; 0x4000000], [0x0 ~&gt; 0x4000000], [0x0 ~&gt; 0x4000000]] <p>
 */
public static void fiat_Poly1305_carry(int[] out1, final int[] arg1) {
  int x1 = (arg1[0]);
  int x2 = ((x1 >>> 26) + (arg1[1]));
  int x3 = ((x2 >>> 26) + (arg1[2]));
  int x4 = ((x3 >>> 26) + (arg1[3]));
  int x5 = ((x4 >>> 26) + (arg1[4]));
  int x6 = ((x1 & 0x3ffffff) + ((x5 >>> 26) * 0x5));
  int x7 = ((x6 >>> 26) + (x2 & 0x3ffffff));
  int x8 = (x6 & 0x3ffffff);
  int x9 = (x7 & 0x3ffffff);
  int x10 = ((x7 >>> 26) + (x3 & 0x3ffffff));
  int x11 = (x4 & 0x3ffffff);
  int x12 = (x5 & 0x3ffffff);
  out1[0] = x8;
  out1[1] = x9;
  out1[2] = x10;
  out1[3] = x11;
  out1[4] = x12;
}

/**
 * The function fiat_Poly1305_add adds two field elements. <p>
 * <p>
 * Postconditions: <p>
 *   eval out1 mod m = (eval arg1 + eval arg2) mod m <p>
 * <p>
 * Input Bounds: <p>
 *   arg1: [[0x0 ~&gt; 0x4000000], [0x0 ~&gt; 0x4000000], [0x0 ~&gt; 0x4000000], [0x0 ~&gt; 0x4000000], [0x0 ~&gt; 0x4000000]] <p>
 *   arg2: [[0x0 ~&gt; 0x4000000], [0x0 ~&gt; 0x4000000], [0x0 ~&gt; 0x4000000], [0x0 ~&gt; 0x4000000], [0x0 ~&gt; 0x4000000]] <p>
 * Output Bounds: <p>
 *   out1: [[0x0 ~&gt; 0xc000000], [0x0 ~&gt; 0xc000000], [0x0 ~&gt; 0xc000000], [0x0 ~&gt; 0xc000000], [0x0 ~&gt; 0xc000000]] <p>
 */
public static void fiat_Poly1305_add(int[] out1, final int[] arg1, final int[] arg2) {
  int x1 = ((arg1[0]) + (arg2[0]));
  int x2 = ((arg1[1]) + (arg2[1]));
  int x3 = ((arg1[2]) + (arg2[2]));
  int x4 = ((arg1[3]) + (arg2[3]));
  int x5 = ((arg1[4]) + (arg2[4]));
  out1[0] = x1;
  out1[1] = x2;
  out1[2] = x3;
  out1[3] = x4;
  out1[4] = x5;
}

/**
 * The function fiat_Poly1305_sub subtracts two field elements. <p>
 * <p>
 * Postconditions: <p>
 *   eval out1 mod m = (eval arg1 - eval arg2) mod m <p>
 * <p>
 * Input Bounds: <p>
 *   arg1: [[0x0 ~&gt; 0x4000000], [0x0 ~&gt; 0x4000000], [0x0 ~&gt; 0x4000000], [0x0 ~&gt; 0x4000000], [0x0 ~&gt; 0x4000000]] <p>
 *   arg2: [[0x0 ~&gt; 0x4000000], [0x0 ~&gt; 0x4000000], [0x0 ~&gt; 0x4000000], [0x0 ~&gt; 0x4000000], [0x0 ~&gt; 0x4000000]] <p>
 * Output Bounds: <p>
 *   out1: [[0x0 ~&gt; 0xc000000], [0x0 ~&gt; 0xc000000], [0x0 ~&gt; 0xc000000], [0x0 ~&gt; 0xc000000], [0x0 ~&gt; 0xc000000]] <p>
 */
public static void fiat_Poly1305_sub(int[] out1, final int[] arg1, final int[] arg2) {
  int x1 = ((0x7fffff6 + (arg1[0])) - (arg2[0]));
  int x2 = ((0x7fffffe + (arg1[1])) - (arg2[1]));
  int x3 = ((0x7fffffe + (arg1[2])) - (arg2[2]));
  int x4 = ((0x7fffffe + (arg1[3])) - (arg2[3]));
  int x5 = ((0x7fffffe + (arg1[4])) - (arg2[4]));
  out1[0] = x1;
  out1[1] = x2;
  out1[2] = x3;
  out1[3] = x4;
  out1[4] = x5;
}

/**
 * The function fiat_Poly1305_opp negates a field element. <p>
 * <p>
 * Postconditions: <p>
 *   eval out1 mod m = -eval arg1 mod m <p>
 * <p>
 * Input Bounds: <p>
 *   arg1: [[0x0 ~&gt; 0x4000000], [0x0 ~&gt; 0x4000000], [0x0 ~&gt; 0x4000000], [0x0 ~&gt; 0x4000000], [0x0 ~&gt; 0x4000000]] <p>
 * Output Bounds: <p>
 *   out1: [[0x0 ~&gt; 0xc000000], [0x0 ~&gt; 0xc000000], [0x0 ~&gt; 0xc000000], [0x0 ~&gt; 0xc000000], [0x0 ~&gt; 0xc000000]] <p>
 */
public static void fiat_Poly1305_opp(int[] out1, final int[] arg1) {
  int x1 = (0x7fffff6 - (arg1[0]));
  int x2 = (0x7fffffe - (arg1[1]));
  int x3 = (0x7fffffe - (arg1[2]));
  int x4 = (0x7fffffe - (arg1[3]));
  int x5 = (0x7fffffe - (arg1[4]));
  out1[0] = x1;
  out1[1] = x2;
  out1[2] = x3;
  out1[3] = x4;
  out1[4] = x5;
}

/**
 * The function fiat_Poly1305_selectznz is a multi-limb conditional select. <p>
 * <p>
 * Postconditions: <p>
 *   out1 = (if arg1 = 0 then arg2 else arg3) <p>
 * <p>
 * Input Bounds: <p>
 *   arg1: [0x0 ~&gt; 0x1] <p>
 *   arg2: [[0x0 ~&gt; 0xffffffff], [0x0 ~&gt; 0xffffffff], [0x0 ~&gt; 0xffffffff], [0x0 ~&gt; 0xffffffff], [0x0 ~&gt; 0xffffffff]] <p>
 *   arg3: [[0x0 ~&gt; 0xffffffff], [0x0 ~&gt; 0xffffffff], [0x0 ~&gt; 0xffffffff], [0x0 ~&gt; 0xffffffff], [0x0 ~&gt; 0xffffffff]] <p>
 * Output Bounds: <p>
 *   out1: [[0x0 ~&gt; 0xffffffff], [0x0 ~&gt; 0xffffffff], [0x0 ~&gt; 0xffffffff], [0x0 ~&gt; 0xffffffff], [0x0 ~&gt; 0xffffffff]] <p>
 */
public static void fiat_Poly1305_selectznz(int[] out1, int arg1, final int[] arg2, final int[] arg3) {
  Box<Integer> x1 = new Box<Integer>((int)0);
  fiat_Poly1305_cmovznz_u32(x1, arg1, (arg2[0]), (arg3[0]));
  Box<Integer> x2 = new Box<Integer>((int)0);
  fiat_Poly1305_cmovznz_u32(x2, arg1, (arg2[1]), (arg3[1]));
  Box<Integer> x3 = new Box<Integer>((int)0);
  fiat_Poly1305_cmovznz_u32(x3, arg1, (arg2[2]), (arg3[2]));
  Box<Integer> x4 = new Box<Integer>((int)0);
  fiat_Poly1305_cmovznz_u32(x4, arg1, (arg2[3]), (arg3[3]));
  Box<Integer> x5 = new Box<Integer>((int)0);
  fiat_Poly1305_cmovznz_u32(x5, arg1, (arg2[4]), (arg3[4]));
  out1[0] = (x1).get();
  out1[1] = (x2).get();
  out1[2] = (x3).get();
  out1[3] = (x4).get();
  out1[4] = (x5).get();
}

/**
 * The function fiat_Poly1305_to_bytes serializes a field element to bytes in little-endian order. <p>
 * <p>
 * Postconditions: <p>
 *   out1 = map (λ x, ⌊((eval arg1 mod m) mod 2^(8 * (x + 1))) / 2^(8 * x)⌋) [0..16] <p>
 * <p>
 * Input Bounds: <p>
 *   arg1: [[0x0 ~&gt; 0x4000000], [0x0 ~&gt; 0x4000000], [0x0 ~&gt; 0x4000000], [0x0 ~&gt; 0x4000000], [0x0 ~&gt; 0x4000000]] <p>
 * Output Bounds: <p>
 *   out1: [[0x0 ~&gt; 0xff], [0x0 ~&gt; 0xff], [0x0 ~&gt; 0xff], [0x0 ~&gt; 0xff], [0x0 ~&gt; 0xff], [0x0 ~&gt; 0xff], [0x0 ~&gt; 0xff], [0x0 ~&gt; 0xff], [0x0 ~&gt; 0xff], [0x0 ~&gt; 0xff], [0x0 ~&gt; 0xff], [0x0 ~&gt; 0xff], [0x0 ~&gt; 0xff], [0x0 ~&gt; 0xff], [0x0 ~&gt; 0xff], [0x0 ~&gt; 0xff], [0x0 ~&gt; 0x3]] <p>
 */
public static void fiat_Poly1305_to_bytes(int[] out1, final int[] arg1) {
  Box<Integer> x1 = new Box<Integer>((int)0);
  Box<Integer> x2 = new Box<Integer>((int)0);
  fiat_Poly1305_subborrowx_u26(x1, x2, (int) Integer.toUnsignedLong(((Number) (0x0)).intValue()), (arg1[0]), 0x3fffffb);
  Box<Integer> x3 = new Box<Integer>((int)0);
  Box<Integer> x4 = new Box<Integer>((int)0);
  fiat_Poly1305_subborrowx_u26(x3, x4, (x2).get(), (arg1[1]), 0x3ffffff);
  Box<Integer> x5 = new Box<Integer>((int)0);
  Box<Integer> x6 = new Box<Integer>((int)0);
  fiat_Poly1305_subborrowx_u26(x5, x6, (x4).get(), (arg1[2]), 0x3ffffff);
  Box<Integer> x7 = new Box<Integer>((int)0);
  Box<Integer> x8 = new Box<Integer>((int)0);
  fiat_Poly1305_subborrowx_u26(x7, x8, (x6).get(), (arg1[3]), 0x3ffffff);
  Box<Integer> x9 = new Box<Integer>((int)0);
  Box<Integer> x10 = new Box<Integer>((int)0);
  fiat_Poly1305_subborrowx_u26(x9, x10, (x8).get(), (arg1[4]), 0x3ffffff);
  Box<Integer> x11 = new Box<Integer>((int)0);
  fiat_Poly1305_cmovznz_u32(x11, (x10).get(), (int) Integer.toUnsignedLong(((Number) (0x0)).intValue()), 0xffffffff);
  Box<Integer> x12 = new Box<Integer>((int)0);
  Box<Integer> x13 = new Box<Integer>((int)0);
  fiat_Poly1305_addcarryx_u26(x12, x13, 0x0, (x1).get(), ((x11).get() & 0x3fffffb));
  Box<Integer> x14 = new Box<Integer>((int)0);
  Box<Integer> x15 = new Box<Integer>((int)0);
  fiat_Poly1305_addcarryx_u26(x14, x15, (x13).get(), (x3).get(), ((x11).get() & 0x3ffffff));
  Box<Integer> x16 = new Box<Integer>((int)0);
  Box<Integer> x17 = new Box<Integer>((int)0);
  fiat_Poly1305_addcarryx_u26(x16, x17, (x15).get(), (x5).get(), ((x11).get() & 0x3ffffff));
  Box<Integer> x18 = new Box<Integer>((int)0);
  Box<Integer> x19 = new Box<Integer>((int)0);
  fiat_Poly1305_addcarryx_u26(x18, x19, (x17).get(), (x7).get(), ((x11).get() & 0x3ffffff));
  Box<Integer> x20 = new Box<Integer>((int)0);
  Box<Integer> x21 = new Box<Integer>((int)0);
  fiat_Poly1305_addcarryx_u26(x20, x21, (x19).get(), (x9).get(), ((x11).get() & 0x3ffffff));
  int x22 = ((x18).get() << 6);
  int x23 = ((x16).get() << 4);
  int x24 = ((x14).get() << 2);
  int x25 = ((x12).get() & 0xff);
  int x26 = ((x12).get() >>> 8);
  int x27 = (x26 & 0xff);
  int x28 = (x26 >>> 8);
  int x29 = (x28 & 0xff);
  int x30 = (x28 >>> 8);
  int x31 = (x24 + x30);
  int x32 = (x31 & 0xff);
  int x33 = (x31 >>> 8);
  int x34 = (x33 & 0xff);
  int x35 = (x33 >>> 8);
  int x36 = (x35 & 0xff);
  int x37 = (x35 >>> 8);
  int x38 = (x23 + x37);
  int x39 = (x38 & 0xff);
  int x40 = (x38 >>> 8);
  int x41 = (x40 & 0xff);
  int x42 = (x40 >>> 8);
  int x43 = (x42 & 0xff);
  int x44 = (x42 >>> 8);
  int x45 = (x22 + x44);
  int x46 = (x45 & 0xff);
  int x47 = (x45 >>> 8);
  int x48 = (x47 & 0xff);
  int x49 = (x47 >>> 8);
  int x50 = (x49 & 0xff);
  int x51 = (x49 >>> 8);
  int x52 = ((x20).get() & 0xff);
  int x53 = ((x20).get() >>> 8);
  int x54 = (x53 & 0xff);
  int x55 = (x53 >>> 8);
  int x56 = (x55 & 0xff);
  int x57 = (x55 >>> 8);
  out1[0] = x25;
  out1[1] = x27;
  out1[2] = x29;
  out1[3] = x32;
  out1[4] = x34;
  out1[5] = x36;
  out1[6] = x39;
  out1[7] = x41;
  out1[8] = x43;
  out1[9] = x46;
  out1[10] = x48;
  out1[11] = x50;
  out1[12] = x51;
  out1[13] = x52;
  out1[14] = x54;
  out1[15] = x56;
  out1[16] = x57;
}

/**
 * The function fiat_Poly1305_from_bytes deserializes a field element from bytes in little-endian order. <p>
 * <p>
 * Postconditions: <p>
 *   eval out1 mod m = bytes_eval arg1 mod m <p>
 * <p>
 * Input Bounds: <p>
 *   arg1: [[0x0 ~&gt; 0xff], [0x0 ~&gt; 0xff], [0x0 ~&gt; 0xff], [0x0 ~&gt; 0xff], [0x0 ~&gt; 0xff], [0x0 ~&gt; 0xff], [0x0 ~&gt; 0xff], [0x0 ~&gt; 0xff], [0x0 ~&gt; 0xff], [0x0 ~&gt; 0xff], [0x0 ~&gt; 0xff], [0x0 ~&gt; 0xff], [0x0 ~&gt; 0xff], [0x0 ~&gt; 0xff], [0x0 ~&gt; 0xff], [0x0 ~&gt; 0xff], [0x0 ~&gt; 0x3]] <p>
 * Output Bounds: <p>
 *   out1: [[0x0 ~&gt; 0x4000000], [0x0 ~&gt; 0x4000000], [0x0 ~&gt; 0x4000000], [0x0 ~&gt; 0x4000000], [0x0 ~&gt; 0x4000000]] <p>
 */
public static void fiat_Poly1305_from_bytes(int[] out1, final int[] arg1) {
  int x1 = ((arg1[16]) << 24);
  int x2 = ((arg1[15]) << 16);
  int x3 = ((arg1[14]) << 8);
  int x4 = (arg1[13]);
  int x5 = ((arg1[12]) << 18);
  int x6 = ((arg1[11]) << 10);
  int x7 = ((arg1[10]) << 2);
  int x8 = ((arg1[9]) << 20);
  int x9 = ((arg1[8]) << 12);
  int x10 = ((arg1[7]) << 4);
  int x11 = ((arg1[6]) << 22);
  int x12 = ((arg1[5]) << 14);
  int x13 = ((arg1[4]) << 6);
  int x14 = ((arg1[3]) << 24);
  int x15 = ((arg1[2]) << 16);
  int x16 = ((arg1[1]) << 8);
  int x17 = (arg1[0]);
  int x18 = (x16 + x17);
  int x19 = (x15 + x18);
  int x20 = (x14 + x19);
  int x21 = (x20 & 0x3ffffff);
  int x22 = (x20 >>> 26);
  int x23 = (x13 + x22);
  int x24 = (x12 + x23);
  int x25 = (x11 + x24);
  int x26 = (x25 & 0x3ffffff);
  int x27 = (x25 >>> 26);
  int x28 = (x10 + x27);
  int x29 = (x9 + x28);
  int x30 = (x8 + x29);
  int x31 = (x30 & 0x3ffffff);
  int x32 = (x30 >>> 26);
  int x33 = (x7 + x32);
  int x34 = (x6 + x33);
  int x35 = (x5 + x34);
  int x36 = (x3 + x4);
  int x37 = (x2 + x36);
  int x38 = (x1 + x37);
  out1[0] = x21;
  out1[1] = x26;
  out1[2] = x31;
  out1[3] = x35;
  out1[4] = x38;
}

/**
 * The function fiat_Poly1305_relax is the identity function converting from tight field elements to loose field elements. <p>
 * <p>
 * Postconditions: <p>
 *   out1 = arg1 <p>
 * <p>
 * Input Bounds: <p>
 *   arg1: [[0x0 ~&gt; 0x4000000], [0x0 ~&gt; 0x4000000], [0x0 ~&gt; 0x4000000], [0x0 ~&gt; 0x4000000], [0x0 ~&gt; 0x4000000]] <p>
 * Output Bounds: <p>
 *   out1: [[0x0 ~&gt; 0xc000000], [0x0 ~&gt; 0xc000000], [0x0 ~&gt; 0xc000000], [0x0 ~&gt; 0xc000000], [0x0 ~&gt; 0xc000000]] <p>
 */
public static void fiat_Poly1305_relax(int[] out1, final int[] arg1) {
  int x1 = (arg1[0]);
  int x2 = (arg1[1]);
  int x3 = (arg1[2]);
  int x4 = (arg1[3]);
  int x5 = (arg1[4]);
  out1[0] = x1;
  out1[1] = x2;
  out1[2] = x3;
  out1[3] = x4;
  out1[4] = x5;
}

}
