packages feed

crypton 2.2.4 → 2.2.5

raw patch · 21 files changed

+14509/−9220 lines, 21 files

Files

CHANGELOG.md view
@@ -1,5 +1,27 @@ # CHANGELOG for crypton +## 2.2.5++**RSA private-key operations check their CRT result.**  A fault in one+half of the computation could hand out a signature that reveals a prime of+the key; the result is now raised back to the public exponent first, as+OpenSSL does, at a cost of two or three per cent on signing.++* perf(rsa): verification in C at every RSA size on Apple AArch64+  [#340](https://github.com/kazu-yamamoto/crypton/pull/340)+* perf(rsa): a generated squaring at 48 limbs on AArch64+  [#341](https://github.com/kazu-yamamoto/crypton/pull/341)+* perf(rsa): verification without lists or Integer round trips+  [#342](https://github.com/kazu-yamamoto/crypton/pull/342)+* ci: time out instead of waiting on a stalled package mirror+  [#343](https://github.com/kazu-yamamoto/crypton/pull/343)+* fix(rsa): check the CRT result before letting it out+  [#344](https://github.com/kazu-yamamoto/crypton/pull/344)+* perf(hash): one context for a one-shot hash and for MGF1+  [#345](https://github.com/kazu-yamamoto/crypton/pull/345)+* perf(rsa): RSA-3072's 24-limb square from 8-limb pieces on x86-64+  [#346](https://github.com/kazu-yamamoto/crypton/pull/346)+ ## 2.2.4  **New module `Crypto.PubKey.RSA.Blinded`.**  A `BlindedKey` carries RSA
Crypto/Hash.hs view
@@ -53,12 +53,20 @@ import qualified Crypto.Internal.ByteArray as B import qualified Data.ByteString.Lazy as L import Data.Int (Int32)+import Data.Word (Word8)+import Foreign.Marshal.Alloc (allocaBytes) import qualified Foreign.Marshal.Utils as FMU import Foreign.Ptr (Ptr, castPtr, plusPtr)  -- | Hash a strict bytestring into a digest.-hash :: (ByteArrayAccess ba, HashAlgorithm a) => ba -> Digest a-hash bs = hashFinalize $ hashUpdate hashInit bs+hash :: forall ba a. (ByteArrayAccess ba, HashAlgorithm a) => ba -> Digest a+hash bs = Digest $+    allocAndFreezePrim (hashDigestSize (undefined :: a)) $ \(dig :: Ptr (Digest a)) ->+        -- one context, used in place: the pure steps would copy it three times+        allocaBytes (hashInternalContextSize (undefined :: a)) $ \(ctx :: Ptr (Context a)) -> do+            hashInternalInit ctx+            B.withByteArray bs (updateBlocks ctx (B.length bs))+            hashInternalFinalize ctx dig  -- | Hash the first N bytes of a bytestring, with code path independent from N. hashPrefix@@ -92,20 +100,19 @@ hashUpdates c l     | null ls = c     | otherwise = Context $ B.copyAndFreeze c $ \(ctx :: Ptr (Context a)) ->-        mapM_ (\b -> B.withByteArray b (processBlocks ctx (B.length b))) ls+        mapM_ (\b -> B.withByteArray b (updateBlocks ctx (B.length b))) ls   where     ls = filter (not . B.null) l-    -- process the data in 2GB chunks to fit in uint32_t and Int on 32 bit systems-    processBlocks ctx bytesLeft dataPtr-        | bytesLeft == 0 = return ()-        | otherwise = do-            hashInternalUpdate ctx dataPtr (fromIntegral actuallyProcessed)-            processBlocks-                ctx-                (bytesLeft - actuallyProcessed)-                (dataPtr `plusPtr` actuallyProcessed)-      where-        actuallyProcessed = min bytesLeft (fromIntegral (maxBound :: Int32))++-- | Process the data in 2GB chunks to fit in uint32_t and Int on 32 bit systems+updateBlocks :: HashAlgorithm a => Ptr (Context a) -> Int -> Ptr Word8 -> IO ()+updateBlocks ctx bytesLeft dataPtr+    | bytesLeft == 0 = return ()+    | otherwise = do+        hashInternalUpdate ctx dataPtr (fromIntegral actuallyProcessed)+        updateBlocks ctx (bytesLeft - actuallyProcessed) (dataPtr `plusPtr` actuallyProcessed)+  where+    actuallyProcessed = min bytesLeft (fromIntegral (maxBound :: Int32))  -- | Finalize a context and return a digest. hashFinalize
Crypto/Number/ModArithmetic.hs view
@@ -43,15 +43,13 @@ import Crypto.Internal.Compat (unsafeDoIO) import Crypto.Number.Basic import Crypto.Number.Compat+import Crypto.Number.ModArithmetic.Pub (expPub) import qualified Crypto.Number.Serialize.Internal as Internal import Data.Memory.PtrMethods (memSet) import Data.Word (Word32, Word8) import Foreign.C.Types (CInt (..)) import Foreign.Marshal.Alloc (allocaBytes) import Foreign.Ptr (Ptr, plusPtr)-import Data.IORef (IORef, atomicModifyIORef', newIORef)-import System.IO.Unsafe (unsafePerformIO)-import Crypto.Internal.ByteArray (Bytes, allocRet, withByteArray)  -- | Raised when two numbers are supposed to be coprimes but are not. data CoprimesAssertionError = CoprimesAssertionError@@ -186,87 +184,6 @@     | otherwise = slow   where     slow = gmpPowModInteger b e m `onGmpUnsupported` exponentiation b e m---- | The windowless exponentiation in C, for an exponent that is not a---   secret.  'Nothing' when the C declines, which it does on every machine---   where what the caller already has is faster -- so this is an---   optimisation and never the only path.  The base has to be reduced and---   the exponent positive, which the guard above sees to.-expPub :: Integer -> Integer -> Integer -> Maybe Integer-expPub b e m = unsafeDoIO $ do-    known <- r2For m-    case known of-        Nothing -> return Nothing-        Just r2 ->-            allocaBytes (sum widths) $ \start -> case scanl plusPtr start widths of-                (out : base : expo : modu : _) -> do-                    _ <- Internal.i2ospOf b base mLen-                    _ <- Internal.i2ospOf e expo eLen-                    _ <- Internal.i2ospOf m modu mLen-                    r <- withByteArray r2 $ \pr2 ->-                        c_powm_pub_r2-                            out-                            base-                            (fromIntegral mLen)-                            expo-                            (fromIntegral eLen)-                            modu-                            (fromIntegral mLen)-                            pr2-                    if r == 0-                        then do-                            !v <- Internal.os2ip out mLen-                            return (Just v)-                        else return Nothing-                _ -> return Nothing-  where-    !mLen = numBytes m-    !eLen = numBytes e-    widths = [mLen, mLen, eLen, mLen]---- | R^2 mod m for the public path, kept for the last few moduli, since a--- program verifies under the same keys again and again.  'Nothing' is kept--- too: it means the C declines this modulus, which is then not asked again.-r2For :: Integer -> IO (Maybe Bytes)-r2For m = do-    found <- atomicModifyIORef' r2Table $ \ks -> case break ((== m) . fst) ks of-        (before, hit : after) -> (hit : before ++ after, Just (snd hit))-        _ -> (ks, Nothing)-    case found of-        Just r2 -> return r2-        Nothing -> do-            let mLen = numBytes m-            r2 <- allocaBytes mLen $ \modu -> do-                _ <- Internal.i2ospOf m modu mLen-                (r, out) <- allocRet mLen $ \pout -> c_powm_r2 pout modu (fromIntegral mLen)-                return (if r == 0 then Just out else Nothing)-            atomicModifyIORef' r2Table $ \ks -> (take r2TableSize ((m, r2) : ks), ())-            return r2--r2TableSize :: Int-r2TableSize = 8--r2Table :: IORef [(Integer, Maybe Bytes)]-r2Table = unsafePerformIO (newIORef [])-{-# NOINLINE r2Table #-}---- safe, as the secure one below is: the call is tens of microseconds at RSA--- sizes, and the hundred nanoseconds this costs over an unsafe call is--- nothing beside holding a capability for that long in a server-foreign import ccall safe "crypton_powm_pub_r2"-    c_powm_pub_r2-        :: Ptr Word8-        -> Ptr Word8-        -> Word32-        -> Ptr Word8-        -> Word32-        -> Ptr Word8-        -> Word32-        -> Ptr Word8-        -> IO CInt--foreign import ccall unsafe "crypton_powm_r2"-    c_powm_r2 :: Ptr Word8 -> Ptr Word8 -> Word32 -> IO CInt  -- | @exponentiation@ computes modular exponentiation as /b^e mod m/ -- using repetitive squaring.
+ Crypto/Number/ModArithmetic/Pub.hs view
@@ -0,0 +1,158 @@+{-# LANGUAGE BangPatterns #-}++-- |+-- Module      : Crypto.Number.ModArithmetic.Pub+-- License     : BSD-style+-- Stability   : experimental+-- Portability : Good+--+-- The C exponentiation for an exponent that is not a secret, and the R^2+-- it keeps per modulus.  Internal: 'expPub' is behind 'expFast', and+-- 'expPubBytes' behind RSA's public-key operation.+module Crypto.Number.ModArithmetic.Pub (+    expPub,+    expPubBytes,+) where++import Crypto.Internal.ByteArray (+    ByteArray,+    ByteArrayAccess,+    Bytes,+    allocRet,+    withByteArray,+ )+import qualified Crypto.Internal.ByteArray as B+import Crypto.Internal.Compat (unsafeDoIO)+import Crypto.Number.Basic+import qualified Crypto.Number.Serialize.Internal as Internal+import Data.IORef (IORef, atomicModifyIORef', newIORef)+import Data.Word (Word32, Word8)+import Foreign.C.Types (CInt (..))+import Foreign.Marshal.Alloc (allocaBytes)+import Foreign.Ptr (Ptr, plusPtr)+import System.IO.Unsafe (unsafePerformIO)++-- | The windowless exponentiation in C, for an exponent that is not a+--   secret.  'Nothing' when the C declines, which it does on every machine+--   where what the caller already has is faster -- so this is an+--   optimisation and never the only path.  The base has to be reduced and+--   the exponent positive, which the caller sees to.+expPub :: Integer -> Integer -> Integer -> Maybe Integer+expPub b e m = unsafeDoIO $ do+    known <- r2For m+    case known of+        Nothing -> return Nothing+        Just (r2, modu) ->+            allocaBytes (sum widths) $ \start -> case scanl plusPtr start widths of+                (out : base : expo : _) -> do+                    _ <- Internal.i2ospOf b base mLen+                    _ <- Internal.i2ospOf e expo eLen+                    r <- withByteArray modu $ \pm -> withByteArray r2 $ \pr2 ->+                        c_powm_pub_r2+                            out+                            base+                            (fromIntegral mLen)+                            expo+                            (fromIntegral eLen)+                            pm+                            (fromIntegral mLen)+                            pr2+                    if r == 0+                        then do+                            !v <- Internal.os2ip out mLen+                            return (Just v)+                        else return Nothing+                _ -> return Nothing+  where+    !mLen = numBytes m+    !eLen = numBytes e+    widths = [mLen, mLen, eLen]++-- | The same with the base and the answer as big-endian bytes, as long as+--   the modulus: what RSA verification has in hand, so neither goes through+--   an 'Integer'.  'Nothing' also when the base is not below the modulus.+expPubBytes+    :: (ByteArrayAccess bi, ByteArray bo) => Integer -> Integer -> bi -> Maybe bo+expPubBytes e m b+    | e <= 0 || m <= 1 || even m || B.length b /= mLen = Nothing+    | otherwise = unsafeDoIO $ do+        known <- r2For m+        case known of+            Nothing -> return Nothing+            Just (r2, modu)+                | not (below b modu) -> return Nothing+                | otherwise -> allocaBytes eLen $ \expo -> do+                    _ <- Internal.i2ospOf e expo eLen+                    (r, out) <- allocRet mLen $ \pout ->+                        withByteArray b $ \pb -> withByteArray modu $ \pm ->+                            withByteArray r2 $ \pr2 ->+                                c_powm_pub_r2+                                    pout+                                    pb+                                    (fromIntegral mLen)+                                    expo+                                    (fromIntegral eLen)+                                    pm+                                    (fromIntegral mLen)+                                    pr2+                    return (if r == 0 then Just out else Nothing)+  where+    !mLen = numBytes m+    !eLen = numBytes e++-- big-endian numbers of one length: the first byte that differs decides+below :: (ByteArrayAccess a, ByteArrayAccess b) => a -> b -> Bool+below x y = go 0+  where+    n = B.length x+    go i+        | i >= n = False+        | otherwise = case compare (B.index x i) (B.index y i) of+            EQ -> go (i + 1)+            o -> o == LT++-- | R^2 mod m for the public path, and m in bytes, kept for the last few+-- moduli, since a program verifies under the same keys again and again.+-- 'Nothing' is kept too: it means the C declines this modulus, which is+-- then not asked again.+r2For :: Integer -> IO (Maybe (Bytes, Bytes))+r2For m = do+    found <- atomicModifyIORef' r2Table $ \ks -> case break ((== m) . fst) ks of+        (before, hit : after) -> (hit : before ++ after, Just (snd hit))+        _ -> (ks, Nothing)+    case found of+        Just r2 -> return r2+        Nothing -> do+            let mLen = numBytes m+            (r2, modu) <- allocRet mLen $ \modu -> do+                _ <- Internal.i2ospOf m modu mLen+                (r, out) <- allocRet mLen $ \pout -> c_powm_r2 pout modu (fromIntegral mLen)+                return (if r == 0 then Just out else Nothing)+            let kept = fmap (\x -> (x, modu)) r2+            atomicModifyIORef' r2Table $ \ks -> (take r2TableSize ((m, kept) : ks), ())+            return kept++r2TableSize :: Int+r2TableSize = 8++r2Table :: IORef [(Integer, Maybe (Bytes, Bytes))]+r2Table = unsafePerformIO (newIORef [])+{-# NOINLINE r2Table #-}++-- safe, as the secure one is: the call is tens of microseconds at RSA+-- sizes, and the hundred nanoseconds this costs over an unsafe call is+-- nothing beside holding a capability for that long in a server+foreign import ccall safe "crypton_powm_pub_r2"+    c_powm_pub_r2+        :: Ptr Word8+        -> Ptr Word8+        -> Word32+        -> Ptr Word8+        -> Word32+        -> Ptr Word8+        -> Word32+        -> Ptr Word8+        -> IO CInt++foreign import ccall unsafe "crypton_powm_r2"+    c_powm_r2 :: Ptr Word8 -> Ptr Word8 -> Word32 -> IO CInt
Crypto/PubKey/MaskGenFunction.hs view
@@ -1,4 +1,4 @@-{-# LANGUAGE BangPatterns #-}+{-# LANGUAGE ScopedTypeVariables #-}  -- | -- Module      : Crypto.PubKey.MaskGenFunction@@ -11,10 +11,17 @@     mgf1, ) where -import Crypto.Hash-import Crypto.Internal.ByteArray (ByteArray, ByteArrayAccess, Bytes)+import Control.Monad (forM_)+import Crypto.Hash (Context, Digest)+import Crypto.Hash.IO (HashAlgorithm (..))+import Crypto.Internal.ByteArray (ByteArray, ByteArrayAccess) import qualified Crypto.Internal.ByteArray as B-import Crypto.Number.Serialize (i2ospOf_)+import Data.Bits (shiftR)+import Data.Word (Word8)+import Foreign.Marshal.Alloc (allocaBytes)+import Foreign.Marshal.Utils (copyBytes)+import Foreign.Ptr (Ptr, castPtr, plusPtr)+import Foreign.Storable (pokeByteOff)  -- | Represent a mask generation algorithm type MaskGenAlgorithm seed output =@@ -26,20 +33,33 @@  -- | Mask generation algorithm MGF1 mgf1-    :: (ByteArrayAccess seed, ByteArray output, HashAlgorithm hashAlg)+    :: forall seed output hashAlg+     . (ByteArrayAccess seed, ByteArray output, HashAlgorithm hashAlg)     => hashAlg     -> seed     -> Int     -> output-mgf1 hashAlg seed len =-    let !seededCtx = hashUpdate (hashInitWith hashAlg) seed-     in B.take len $-            B.concat $-                map (hashCounter seededCtx) [0 .. fromIntegral (maxCounter - 1)]+mgf1 hashAlg seed len+    | len <= 0 = B.empty+    | otherwise = B.allocAndFreeze len $ \out ->+        -- the seeded context is kept, and copied for each block rather than+        -- rebuilt; each block's digest is written straight into the output+        allocaBytes ctxSize $ \(seeded :: Ptr (Context hashAlg)) ->+            allocaBytes ctxSize $ \(ctx :: Ptr (Context hashAlg)) ->+                allocaBytes digestLen $ \(dig :: Ptr (Digest hashAlg)) ->+                    allocaBytes 4 $ \(cnt :: Ptr Word8) -> do+                        hashInternalInit seeded+                        B.withByteArray seed $ \p ->+                            hashInternalUpdate seeded p (fromIntegral (B.length seed))+                        forM_ [0 .. maxCounter - 1] $ \i -> do+                            copyBytes ctx seeded ctxSize+                            forM_ [0 .. 3] $ \k ->+                                pokeByteOff cnt k (fromIntegral (i `shiftR` (8 * (3 - k))) :: Word8)+                            hashInternalUpdate ctx cnt 4+                            hashInternalFinalize ctx dig+                            let off = i * digestLen+                            copyBytes (out `plusPtr` off) (castPtr dig) (min digestLen (len - off))   where+    ctxSize = hashInternalContextSize hashAlg     digestLen = hashDigestSize hashAlg-    (chunks, left) = len `divMod` digestLen-    maxCounter = if left > 0 then chunks + 1 else chunks--    hashCounter :: HashAlgorithm a => Context a -> Integer -> Digest a-    hashCounter ctx counter = hashFinalize $ hashUpdate ctx (i2ospOf_ 4 counter :: Bytes)+    maxCounter = (len + digestLen - 1) `div` digestLen
Crypto/PubKey/RSA/PKCS15.hs view
@@ -415,10 +415,10 @@     :: ByteArray signature => Int -> signature -> Either Error signature padSignature klen signature     | klen < siglen + 11 = Left SignatureTooLong-    | otherwise = Right (B.pack padding `B.append` signature)+    | otherwise =+        Right (B.concat [B.pack [0, 1], B.replicate (klen - siglen - 3) 0xff, B.pack [0], signature])   where     siglen = B.length signature-    padding = 0 : 1 : (replicate (klen - siglen - 3) 0xff ++ [0])  -- | Try to remove a standard PKCS1.5 encryption padding. --
Crypto/PubKey/RSA/PSS.hs view
@@ -30,11 +30,11 @@ import Crypto.PubKey.RSA.Prim import Crypto.PubKey.RSA.Types import Crypto.Random.Types-import Data.Bits (complement, shiftR, xor, (.&.))+import Data.Bits (complement, shiftR, (.&.)) import Data.Word  import Crypto.Internal.ByteArray (ByteArray, ByteArrayAccess)-import qualified Crypto.Internal.ByteArray as B (convert, eq)+import qualified Crypto.Internal.ByteArray as B (bxor, convert, eq)  import Data.ByteString (ByteString) import qualified Data.ByteString as B@@ -113,7 +113,7 @@     h = B.convert $ hashWith (pssHash params) m'     db = B.concat [B.replicate (dbLen - saltLen - 1) 0, B.singleton 1, salt]     dbmask = pssMaskGenAlg params h dbLen-    maskedDB = B.pack $ normalizeToKeySize pubBits $ B.zipWith xor db dbmask+    maskedDB = normalizeToKeySize pubBits (B.bxor db dbmask :: ByteString)     em = B.concat [maskedDB, h, B.singleton (pssTrailerField params)]  -- | Sign using the PSS parameters and the salt explicitely passed as parameters.@@ -303,7 +303,7 @@     maskedDB = B.take dbLen em     h = B.take hashLen $ B.drop (B.length maskedDB) em     dbmask = pssMaskGenAlg params h dbLen-    db = B.pack $ normalizeToKeySize pubBits $ B.zipWith xor maskedDB dbmask+    db = normalizeToKeySize pubBits (B.bxor maskedDB dbmask :: ByteString)     (ps0, z) = B.break (== 1) db     (b1, salt) = B.splitAt 1 z     m' = B.concat [B.replicate 8 0, mHash, salt]@@ -313,9 +313,10 @@ emTruncate :: Int -> Bool emTruncate bits = ((bits - 1) .&. 0x7) == 0 -normalizeToKeySize :: Int -> [Word8] -> [Word8]-normalizeToKeySize _ [] = [] -- very unlikely-normalizeToKeySize bits (x : xs) = x .&. normalizeMask bits : xs+normalizeToKeySize :: Int -> ByteString -> ByteString+normalizeToKeySize bits x = case B.uncons x of+    Nothing -> x -- very unlikely+    Just (h, t) -> B.cons (h .&. normalizeMask bits) t  -- | The bits of the leftmost octet that belong to the encoding: the low -- @emBits `mod` 8@ of them, or all eight when that is zero.  Its complement
Crypto/PubKey/RSA/Prim.hs view
@@ -24,6 +24,7 @@ import Crypto.Internal.Compat (unsafeDoIO) import Crypto.Number.Basic (numBytes) import Crypto.Number.ModArithmetic (expFast, expSafe)+import Crypto.Number.ModArithmetic.Pub (expPubBytes) import Crypto.Number.Serialize (i2ospOf_, os2ip) import qualified Crypto.Number.Serialize.Internal as Internal import Crypto.PubKey.RSA.Types@@ -40,7 +41,7 @@ dpFast (Blinder r rm1) pk c =     i2ospOf_         (private_size pk)-        (multiplication rm1 (m2 + h * (private_q pk)) (private_n pk))+        (multiplication rm1 (crtChecked pk iC (m2 + h * (private_q pk))) (private_n pk))   where     re = expFast r (public_e $ private_pub pk) (private_n pk)     iC = multiplication re (os2ip c) (private_n pk)@@ -48,12 +49,23 @@     h = ((private_qinv pk) * (m1 - m2)) `mod` (private_p pk)  dpFastNoBlinder :: ByteArray ba => PrivateKey -> ba -> ba-dpFastNoBlinder pk c = i2ospOf_ (private_size pk) (m2 + h * (private_q pk))+dpFastNoBlinder pk c = i2ospOf_ (private_size pk) (crtChecked pk iC (m2 + h * (private_q pk)))   where     iC = os2ip c     (m1, m2) = crtHalves iC pk     h = ((private_qinv pk) * (m1 - m2)) `mod` (private_p pk) +-- | The CRT answer m for c, raised back to e before it is let out: a fault+-- in one half gives an m whose gcd with n is the other prime (Boneh, DeMillo+-- and Lipton).  On a mismatch it is computed again without CRT, as OpenSSL does.+crtChecked :: PrivateKey -> Integer -> Integer -> Integer+crtChecked pk c m+    | expFast m (public_e (private_pub pk)) n == c `mod` n = m+    | private_d pk > 0 = expSafe c (private_d pk) n+    | otherwise = m+  where+    n = private_n pk+ -- | c^dP mod p and c^dQ mod q, the halves of the private-key operation: both -- at once where the C can (AVX-512 IFMA, and the sizes of RSA-2048, -3072 and -- -4096), one after the other where it declines.@@ -112,7 +124,9 @@  -- | Compute the RSA encrypt primitive ep :: ByteArray ba => PublicKey -> ba -> ba-ep pk m = i2ospOf_ (public_size pk) $ expFast (os2ip m) (public_e pk) (public_n pk)+ep pk m = case expPubBytes (public_e pk) (public_n pk) m of+    Just r -> r+    Nothing -> i2ospOf_ (public_size pk) $ expFast (os2ip m) (public_e pk) (public_n pk)  -- | multiply 2 integers in Zm only performing the modulo operation if necessary multiplication :: Integer -> Integer -> Integer -> Integer
README.md view
@@ -78,10 +78,14 @@ ones to reach for.  Pass `Nothing` only where the input is not attacker controlled and you have decided that it is not. -The RSA rows in the tables below are the unblinded path.  A blinder costs one-more exponentiation, by the public exponent, which is the cheap direction:-measured on the M4, signing goes from about 460 to about 476 microseconds,-under four per cent.+The RSA rows in the tables below are the unblinded path.  A fresh blinder+costs one more exponentiation, by the public exponent, which is the cheap+direction: measured on the M4, signing goes from about 316 to about 331+microseconds, under five per cent.  `signSafer` and `decryptSafer` pay less+than that from 2.2.4: they keep the blinder of a key they have seen and+square it for the next use, as OpenSSL does, drawing a fresh one every 32+uses.  `Crypto.PubKey.RSA.Blinded` gives a caller the same thing to hold, a+`BlindedKey` passed along from one operation to the next.  Performance -----------@@ -111,33 +115,33 @@  Throughput in MB/s, **higher is better**: -| | crypton 1.1.5 | crypton 2.2.2 | OpenSSL | 2.2.2 / OpenSSL |+| | crypton 1.1.5 | crypton 2.2.4 | OpenSSL | 2.2.4 / OpenSSL | | --- | ---: | ---: | ---: | ---: |-| AES-128-GCM | 1336 | **6037** | 4050 | 1.49 |-| AES-256-GCM | 1093 | **5490** | 3769 | 1.46 |-| ChaCha20-Poly1305 | 399 | 2196 | 2222 | 0.99 |-| SHA-1 | 729 | 1663 | 1682 | 0.99 |-| SHA-256 | 289 | 1586 | 1579 | 1.00 |-| SHA-512 | 448 | 770 | 750 | 1.03 |-| SHA3-256 | 109 | 421 | 425 | 0.99 |+| AES-128-GCM | 1335 | **6041** | 4066 | 1.49 |+| AES-256-GCM | 1093 | **5492** | 3766 | 1.46 |+| ChaCha20-Poly1305 | 399 | 2195 | 2222 | 0.99 |+| SHA-1 | 727 | 1663 | 1672 | 0.99 |+| SHA-256 | 289 | 1585 | 1576 | 1.01 |+| SHA-512 | 448 | 770 | 749 | 1.03 |+| SHA3-256 | 109 | 421 | 429 | 0.98 |  Time per operation in microseconds, **lower is better**: -| | crypton 1.1.5 | crypton 2.2.2 | OpenSSL | OpenSSL / 2.2.2 |+| | crypton 1.1.5 | crypton 2.2.4 | OpenSSL | OpenSSL / 2.2.4 | | --- | ---: | ---: | ---: | ---: |-| X25519 | 44.06 | 28.54 | 36.50 | 1.28 |-| ECDH P-256 | 164.5 | 50.56 | 51.62 | 1.02 |-| ECDH P-384 | 2241 | **164.3** | 833.3 | 5.07 |-| Ed25519 sign | 29.78 | 18.61 | 33.51 | 1.80 |-| Ed25519 verify | 48.32 | 48.14 | 110.1 | 2.29 |-| ECDSA P-256 sign | 81.62 | 18.71 | 21.96 | 1.17 |-| ECDSA P-256 verify | 232.0 | 70.32 | 67.53 | 0.96 |-| ECDSA P-384 sign | 2270 | **304.1** | 880.3 | 2.89 |-| ECDSA P-384 verify | 2678 | **472.0** | 722.1 | 1.53 |-| RSA-2048 sign/decrypt | 759.7 | 614.3 | 659.2 | 1.07 |-| RSA-2048 verify/encrypt | 33.19 | 28.09 | 18.85 | 0.67 |-| RSA-3072 sign/decrypt | 2500 | 2316 | 2008 | 0.87 |-| RSA-3072 verify/encrypt | 65.97 | 63.47 | 40.12 | 0.63 |+| X25519 | 44.38 | 28.29 | 36.61 | 1.29 |+| ECDH P-256 | 164.0 | 51.31 | 51.70 | 1.01 |+| ECDH P-384 | 2242 | **164.3** | 836.1 | 5.09 |+| Ed25519 sign | 43.86 | 18.50 | 33.74 | 1.82 |+| Ed25519 verify | 48.30 | 48.43 | 109.8 | 2.27 |+| ECDSA P-256 sign | 81.80 | 19.72 | 21.84 | 1.11 |+| ECDSA P-256 verify | 231.8 | 70.47 | 67.55 | 0.96 |+| ECDSA P-384 sign | 2267 | **305.2** | 879.5 | 2.88 |+| ECDSA P-384 verify | 2698 | **473.6** | 725.2 | 1.53 |+| RSA-2048 sign/decrypt | 760.1 | 612.3 | 659.6 | 1.08 |+| RSA-2048 verify/encrypt | 33.61 | 23.50 | 18.88 | 0.80 |+| RSA-3072 sign/decrypt | 2499 | 2324 | 2012 | 0.87 |+| RSA-3072 verify/encrypt | 66.80 | 61.91 | 40.14 | 0.65 |  ### AArch64 @@ -146,37 +150,37 @@  Throughput in MB/s, **higher is better**: -| | crypton 1.1.5 | crypton 2.2.2 | OpenSSL | 2.2.2 / OpenSSL |+| | crypton 1.1.5 | crypton 2.2.4 | OpenSSL | 2.2.4 / OpenSSL | | --- | ---: | ---: | ---: | ---: |-| AES-128-GCM | 127 | **11661** | 10764 | 1.08 |-| AES-256-GCM | 98 | **9764** | 9187 | 1.06 |-| ChaCha20-Poly1305 | 767 | 2249 | 2263 | 0.99 |-| SHA-1 | 1215 | 3383 | 3357 | 1.01 |-| SHA-256 | 478 | 3391 | 3353 | 1.01 |-| SHA-512 | 733 | 1847 | 1835 | 1.01 |-| SHA3-256 | 549 | 1084 | 1073 | 1.01 |+| AES-128-GCM | 131 | **12052** | 10922 | 1.10 |+| AES-256-GCM | 99 | **10192** | 9208 | 1.11 |+| ChaCha20-Poly1305 | 783 | 2342 | 2261 | 1.04 |+| SHA-1 | 1234 | 3383 | 3347 | 1.01 |+| SHA-256 | 486 | 3392 | 3354 | 1.01 |+| SHA-512 | 742 | 1869 | 1860 | 1.00 |+| SHA3-256 | 552 | 1096 | 1092 | 1.00 |  Time per operation in microseconds, **lower is better**: -| | crypton 1.1.5 | crypton 2.2.2 | OpenSSL | OpenSSL / 2.2.2 |+| | crypton 1.1.5 | crypton 2.2.4 | OpenSSL | OpenSSL / 2.2.4 | | --- | ---: | ---: | ---: | ---: |-| X25519 | 18.27 | **11.55** | 15.38 | 1.33 |-| ECDH P-256 | 68.80 | **20.15** | 24.45 | 1.21 |-| ECDH P-384 | 3277 | **72.17** | 374.3 | 5.19 |-| Ed25519 sign | 13.42 | **7.450** | 13.27 | 1.78 |-| Ed25519 verify | 18.30 | 18.30 | 34.44 | 1.88 |-| ECDSA P-256 sign | 32.13 | **6.417** | 10.68 | 1.66 |-| ECDSA P-256 verify | 95.07 | **26.68** | 32.27 | 1.21 |-| ECDSA P-384 sign | 3241 | **124.7** | 392.8 | 3.15 |-| ECDSA P-384 verify | 3885 | **203.8** | 329.3 | 1.62 |-| RSA-2048 sign/decrypt | 451.0 | 458.7 | 320.3 | 0.70 |-| RSA-2048 verify/encrypt | 18.12 | 15.58 | 8.400 | 0.54 |-| RSA-3072 sign/decrypt | 1474 | 1317 | 927.7 | 0.70 |-| RSA-3072 verify/encrypt | 47.85 | 44.20 | 17.84 | 0.40 |+| X25519 | 17.92 | **12.02** | 15.32 | 1.28 |+| ECDH P-256 | 67.50 | **19.05** | 24.36 | 1.28 |+| ECDH P-384 | 3256 | **71.78** | 373.1 | 5.20 |+| Ed25519 sign | 13.38 | **7.717** | 13.31 | 1.72 |+| Ed25519 verify | 18.32 | 18.18 | 34.77 | 1.91 |+| ECDSA P-256 sign | 31.08 | **6.500** | 10.66 | 1.64 |+| ECDSA P-256 verify | 94.27 | **26.58** | 32.25 | 1.21 |+| ECDSA P-384 sign | 3225 | **124.0** | 394.2 | 3.18 |+| ECDSA P-384 verify | 3866 | **203.4** | 332.3 | 1.63 |+| RSA-2048 sign/decrypt | 451.3 | 318.4 | 321.5 | 1.01 |+| RSA-2048 verify/encrypt | 18.15 | 11.12 | 8.405 | 0.76 |+| RSA-3072 sign/decrypt | 1473 | 937.4 | 931.1 | 0.99 |+| RSA-3072 verify/encrypt | 47.95 | 43.63 | 17.89 | 0.41 |  ### What the numbers say -There are two changes behind the 1.1.5 column and the 2.2.2 one, not a+There are two changes behind the 1.1.5 column and the 2.2.4 one, not a single steady improvement.  The first, in 2.0.0, was a rewrite: the bulk algorithms moved into C, the@@ -204,25 +208,34 @@ it is Apache-2.0 only, and Intel and CloudFlare hold copyright in it besides OpenSSL, so nobody is in a position to relicense it. -Where crypton is behind, which is now the RSA rows on both architectures and-ECDSA P-256 verification on x86-64, there is one reason.  The AES-GCM rows+crypton is behind in a few rows now: RSA verification on both architectures,+and RSA-3072 signing and ECDSA P-256 verification on x86-64.  The AES-GCM rows were the other half of this section until 2.1.5; they are ahead on both machines now, and what the instructions do is still worth setting out.  *RSA.*  2.0.0 made signing slower than 1.1.5 on purpose: its modular exponentiation stopped indexing a table with the bits of the exponent, and-hiding the exponent is what the difference bought.  On x86-64 that cost is-more than repaid -- s2n-bignum's Montgomery multiplication is twice the C's,-because the C cannot form the two carry chains `ADCX` and `ADOX` give, and-2.2.2 signs in less than 1.1.5 took, at 3072 bits as well as 2048, while-keeping what 2.0.0 gained.  On AArch64 there is nothing to use: s2n-bignum's-routines there, the five that help on x86-64 and the generic ones alike,-measure no better than the C, so the C stays and the gap with it.  No-portable C closes that gap either -- the measurements are in-[#275](https://github.com/kazu-yamamoto/crypton/issues/275).  Verification-does not move much either way: its exponent is 65537, seventeen bits, and-there is no exponentiation to speak of.+hiding the exponent is what the difference bought.  2.2.4 has repaid that+cost on both machines, by different means.  On x86-64 s2n-bignum's+Montgomery multiplication is twice the C's, because the C cannot form the two+carry chains `ADCX` and `ADOX` give, and 2.2.4 signs in less than 1.1.5+took, at 3072 bits as well as 2048.  On AArch64 s2n-bignum's routines measure+no better than the C, so the gain there is the C's own: the multiplication+and squaring for each key size are generated and unrolled, with the+reduction folded into each column as in Koç, Acar and Kaliski's FIPS method,+and signing is level with OpenSSL.  The measurements are in+[#275](https://github.com/kazu-yamamoto/crypton/issues/275). +On processors with AVX-512 IFMA, Intel Xeons from Ice Lake and AMD from Zen 4,+2.2.4 computes the two halves of the CRT together in 52-bit digits, Gueron and+Krasnov's method and the one OpenSSL takes there.  Neither machine above has+IFMA, so neither table shows it.++Verification's exponent is 65537, seventeen bits, so there is little+exponentiation to speed up and the work around it counts.  2.2.4 keeps R^2,+the Montgomery constant of a modulus, for the moduli it has seen, which is+most of what the RSA-2048 verification rows gained.+ *The wide AES instructions.*  `VAES` and `VPCLMULQDQ` do two blocks where `AES-NI` and `PCLMULQDQ` do one, and four in their 512-bit form.  crypton uses the 256-bit form where the processor has it, which is Zen 3 and Ice Lake@@ -240,7 +253,7 @@ takes a block at a time where crypton takes two.  The same idea as theirs, one step further down the feature ladder; not a better one. -The 512-bit path arrived after 2.1.2, so it is in the 2.2.2 column -- but+The 512-bit path arrived after 2.1.2, so it is in the 2.2.4 column -- but neither machine in the tables above has AVX-512, so neither column shows it. On the runners that do, measured over 16 KiB in MB/s: an EPYC 9V45 (Zen 5) goes from 9616 to 14268 with it, a Xeon 6973P-C from 8095 to 9848, a Xeon@@ -265,7 +278,7 @@ key from the secret key every time it signs, so that a caller who passes a public key that does not match cannot be made to leak the private one.  That costs a second scalar multiplication, which OpenSSL's signing does not pay ---and the row is still 1.78 on AArch64 and 1.80 on x86-64, so the safety is had+and the row is still 1.72 on AArch64 and 1.82 on x86-64, so the safety is had for nothing here rather than paid for.  Ed25519 verification wanted one too, for an unhappier reason, and 2.2.1
cbits/crypton_mont.h view
@@ -1,9015 +1,13445 @@ /* Generated by cbits/crypton_mont.py; do not edit.  *  * Montgomery multiplication and squaring for AArch64 at 16, 24 and 32 limbs,- * the halves of RSA-2048, -3072 and -4096.  Each answers what mont_mul and- * mont_sqr answer. */-#ifndef CRYPTON_MONT_H-#define CRYPTON_MONT_H--#include "crypton_bignum.h"--/* (t2:t1:t0) += x * y */-#define MONT_MAC(t0, t1, t2, x, y)                                      \-	do {                                                                \-		limb_t lo_, hi_;                                                \-		__asm__("mul\t%0, %5, %6\n\t"                                   \-		        "umulh\t%1, %5, %6\n\t"                                 \-		        "adds\t%2, %2, %0\n\t"                                  \-		        "adcs\t%3, %3, %1\n\t"                                  \-		        "adc\t%4, %4, xzr"                                       \-		        : "=&r"(lo_), "=&r"(hi_), "+r"(t0), "+r"(t1), "+r"(t2)  \-		        : "r"(x), "r"(y)                                        \-		        : "cc");                                                \-	} while (0)--/* (s2:s1:s0) = x * y */-#define MONT_MUL(s0, s1, s2, x, y)                                      \-	__asm__("mul\t%0, %3, %4\n\t"                                       \-	        "umulh\t%1, %3, %4\n\t"                                     \-	        "mov\t%2, xzr"                                               \-	        : "=&r"(s0), "=&r"(s1), "=r"(s2)                            \-	        : "r"(x), "r"(y))--/* (t2:t1:t0) += (s2:s1:s0) */-#define MONT_ADD(t0, t1, t2, s0, s1, s2)                                \-	__asm__("adds\t%0, %0, %3\n\t"                                      \-	        "adcs\t%1, %1, %4\n\t"                                      \-	        "adc\t%2, %2, %5"                                            \-	        : "+r"(t0), "+r"(t1), "+r"(t2)                              \-	        : "r"(s0), "r"(s1), "r"(s2)                                 \-	        : "cc")--/* (s2:s1:s0) *= 2 */-#define MONT_DBL(s0, s1, s2)                                            \-	do {                                                                \-		s2 = (s2 << 1) | (s1 >> 63);                                    \-		s1 = (s1 << 1) | (s0 >> 63);                                    \-		s0 <<= 1;                                                       \-	} while (0)--/* r = a * b * R^-1 mod m, for a and b under m; t is 2n limbs of scratch */-static void crypton_mont_mul16(limb_t *r, const limb_t *a, const limb_t *b,-                               const limb_t *m, limb_t n0, limb_t *t)-{-	limb_t *u = t, *z = t + 16;-	limb_t t0 = 0, t1 = 0, t2 = 0, v0, v1, v2, w0, w1, w2, borrow, take;--	/* column 0 */-	MONT_MAC(t0, t1, t2, a[0], b[0]);-	u[0] = t0 * n0;-	MONT_MAC(t0, t1, t2, u[0], m[0]);-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 1 */-	MONT_MAC(t0, t1, t2, a[0], b[1]);-	MONT_MUL(v0, v1, v2, a[1], b[0]);-	MONT_MUL(w0, w1, w2, u[0], m[1]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_ADD(t0, t1, t2, w0, w1, w2);-	u[1] = t0 * n0;-	MONT_MAC(t0, t1, t2, u[1], m[0]);-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 2 */-	MONT_MAC(t0, t1, t2, a[0], b[2]);-	MONT_MUL(v0, v1, v2, a[1], b[1]);-	MONT_MUL(w0, w1, w2, a[2], b[0]);-	MONT_MAC(t0, t1, t2, u[0], m[2]);-	MONT_MAC(v0, v1, v2, u[1], m[1]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_ADD(t0, t1, t2, w0, w1, w2);-	u[2] = t0 * n0;-	MONT_MAC(t0, t1, t2, u[2], m[0]);-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 3 */-	MONT_MAC(t0, t1, t2, a[0], b[3]);-	MONT_MUL(v0, v1, v2, a[1], b[2]);-	MONT_MUL(w0, w1, w2, a[2], b[1]);-	MONT_MAC(t0, t1, t2, a[3], b[0]);-	MONT_MAC(v0, v1, v2, u[0], m[3]);-	MONT_MAC(w0, w1, w2, u[1], m[2]);-	MONT_MAC(t0, t1, t2, u[2], m[1]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_ADD(t0, t1, t2, w0, w1, w2);-	u[3] = t0 * n0;-	MONT_MAC(t0, t1, t2, u[3], m[0]);-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 4 */-	MONT_MAC(t0, t1, t2, a[0], b[4]);-	MONT_MUL(v0, v1, v2, a[1], b[3]);-	MONT_MUL(w0, w1, w2, a[2], b[2]);-	MONT_MAC(t0, t1, t2, a[3], b[1]);-	MONT_MAC(v0, v1, v2, a[4], b[0]);-	MONT_MAC(w0, w1, w2, u[0], m[4]);-	MONT_MAC(t0, t1, t2, u[1], m[3]);-	MONT_MAC(v0, v1, v2, u[2], m[2]);-	MONT_MAC(w0, w1, w2, u[3], m[1]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_ADD(t0, t1, t2, w0, w1, w2);-	u[4] = t0 * n0;-	MONT_MAC(t0, t1, t2, u[4], m[0]);-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 5 */-	MONT_MAC(t0, t1, t2, a[0], b[5]);-	MONT_MUL(v0, v1, v2, a[1], b[4]);-	MONT_MUL(w0, w1, w2, a[2], b[3]);-	MONT_MAC(t0, t1, t2, a[3], b[2]);-	MONT_MAC(v0, v1, v2, a[4], b[1]);-	MONT_MAC(w0, w1, w2, a[5], b[0]);-	MONT_MAC(t0, t1, t2, u[0], m[5]);-	MONT_MAC(v0, v1, v2, u[1], m[4]);-	MONT_MAC(w0, w1, w2, u[2], m[3]);-	MONT_MAC(t0, t1, t2, u[3], m[2]);-	MONT_MAC(v0, v1, v2, u[4], m[1]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_ADD(t0, t1, t2, w0, w1, w2);-	u[5] = t0 * n0;-	MONT_MAC(t0, t1, t2, u[5], m[0]);-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 6 */-	MONT_MAC(t0, t1, t2, a[0], b[6]);-	MONT_MUL(v0, v1, v2, a[1], b[5]);-	MONT_MUL(w0, w1, w2, a[2], b[4]);-	MONT_MAC(t0, t1, t2, a[3], b[3]);-	MONT_MAC(v0, v1, v2, a[4], b[2]);-	MONT_MAC(w0, w1, w2, a[5], b[1]);-	MONT_MAC(t0, t1, t2, a[6], b[0]);-	MONT_MAC(v0, v1, v2, u[0], m[6]);-	MONT_MAC(w0, w1, w2, u[1], m[5]);-	MONT_MAC(t0, t1, t2, u[2], m[4]);-	MONT_MAC(v0, v1, v2, u[3], m[3]);-	MONT_MAC(w0, w1, w2, u[4], m[2]);-	MONT_MAC(t0, t1, t2, u[5], m[1]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_ADD(t0, t1, t2, w0, w1, w2);-	u[6] = t0 * n0;-	MONT_MAC(t0, t1, t2, u[6], m[0]);-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 7 */-	MONT_MAC(t0, t1, t2, a[0], b[7]);-	MONT_MUL(v0, v1, v2, a[1], b[6]);-	MONT_MUL(w0, w1, w2, a[2], b[5]);-	MONT_MAC(t0, t1, t2, a[3], b[4]);-	MONT_MAC(v0, v1, v2, a[4], b[3]);-	MONT_MAC(w0, w1, w2, a[5], b[2]);-	MONT_MAC(t0, t1, t2, a[6], b[1]);-	MONT_MAC(v0, v1, v2, a[7], b[0]);-	MONT_MAC(w0, w1, w2, u[0], m[7]);-	MONT_MAC(t0, t1, t2, u[1], m[6]);-	MONT_MAC(v0, v1, v2, u[2], m[5]);-	MONT_MAC(w0, w1, w2, u[3], m[4]);-	MONT_MAC(t0, t1, t2, u[4], m[3]);-	MONT_MAC(v0, v1, v2, u[5], m[2]);-	MONT_MAC(w0, w1, w2, u[6], m[1]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_ADD(t0, t1, t2, w0, w1, w2);-	u[7] = t0 * n0;-	MONT_MAC(t0, t1, t2, u[7], m[0]);-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 8 */-	MONT_MAC(t0, t1, t2, a[0], b[8]);-	MONT_MUL(v0, v1, v2, a[1], b[7]);-	MONT_MUL(w0, w1, w2, a[2], b[6]);-	MONT_MAC(t0, t1, t2, a[3], b[5]);-	MONT_MAC(v0, v1, v2, a[4], b[4]);-	MONT_MAC(w0, w1, w2, a[5], b[3]);-	MONT_MAC(t0, t1, t2, a[6], b[2]);-	MONT_MAC(v0, v1, v2, a[7], b[1]);-	MONT_MAC(w0, w1, w2, a[8], b[0]);-	MONT_MAC(t0, t1, t2, u[0], m[8]);-	MONT_MAC(v0, v1, v2, u[1], m[7]);-	MONT_MAC(w0, w1, w2, u[2], m[6]);-	MONT_MAC(t0, t1, t2, u[3], m[5]);-	MONT_MAC(v0, v1, v2, u[4], m[4]);-	MONT_MAC(w0, w1, w2, u[5], m[3]);-	MONT_MAC(t0, t1, t2, u[6], m[2]);-	MONT_MAC(v0, v1, v2, u[7], m[1]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_ADD(t0, t1, t2, w0, w1, w2);-	u[8] = t0 * n0;-	MONT_MAC(t0, t1, t2, u[8], m[0]);-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 9 */-	MONT_MAC(t0, t1, t2, a[0], b[9]);-	MONT_MUL(v0, v1, v2, a[1], b[8]);-	MONT_MUL(w0, w1, w2, a[2], b[7]);-	MONT_MAC(t0, t1, t2, a[3], b[6]);-	MONT_MAC(v0, v1, v2, a[4], b[5]);-	MONT_MAC(w0, w1, w2, a[5], b[4]);-	MONT_MAC(t0, t1, t2, a[6], b[3]);-	MONT_MAC(v0, v1, v2, a[7], b[2]);-	MONT_MAC(w0, w1, w2, a[8], b[1]);-	MONT_MAC(t0, t1, t2, a[9], b[0]);-	MONT_MAC(v0, v1, v2, u[0], m[9]);-	MONT_MAC(w0, w1, w2, u[1], m[8]);-	MONT_MAC(t0, t1, t2, u[2], m[7]);-	MONT_MAC(v0, v1, v2, u[3], m[6]);-	MONT_MAC(w0, w1, w2, u[4], m[5]);-	MONT_MAC(t0, t1, t2, u[5], m[4]);-	MONT_MAC(v0, v1, v2, u[6], m[3]);-	MONT_MAC(w0, w1, w2, u[7], m[2]);-	MONT_MAC(t0, t1, t2, u[8], m[1]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_ADD(t0, t1, t2, w0, w1, w2);-	u[9] = t0 * n0;-	MONT_MAC(t0, t1, t2, u[9], m[0]);-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 10 */-	MONT_MAC(t0, t1, t2, a[0], b[10]);-	MONT_MUL(v0, v1, v2, a[1], b[9]);-	MONT_MUL(w0, w1, w2, a[2], b[8]);-	MONT_MAC(t0, t1, t2, a[3], b[7]);-	MONT_MAC(v0, v1, v2, a[4], b[6]);-	MONT_MAC(w0, w1, w2, a[5], b[5]);-	MONT_MAC(t0, t1, t2, a[6], b[4]);-	MONT_MAC(v0, v1, v2, a[7], b[3]);-	MONT_MAC(w0, w1, w2, a[8], b[2]);-	MONT_MAC(t0, t1, t2, a[9], b[1]);-	MONT_MAC(v0, v1, v2, a[10], b[0]);-	MONT_MAC(w0, w1, w2, u[0], m[10]);-	MONT_MAC(t0, t1, t2, u[1], m[9]);-	MONT_MAC(v0, v1, v2, u[2], m[8]);-	MONT_MAC(w0, w1, w2, u[3], m[7]);-	MONT_MAC(t0, t1, t2, u[4], m[6]);-	MONT_MAC(v0, v1, v2, u[5], m[5]);-	MONT_MAC(w0, w1, w2, u[6], m[4]);-	MONT_MAC(t0, t1, t2, u[7], m[3]);-	MONT_MAC(v0, v1, v2, u[8], m[2]);-	MONT_MAC(w0, w1, w2, u[9], m[1]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_ADD(t0, t1, t2, w0, w1, w2);-	u[10] = t0 * n0;-	MONT_MAC(t0, t1, t2, u[10], m[0]);-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 11 */-	MONT_MAC(t0, t1, t2, a[0], b[11]);-	MONT_MUL(v0, v1, v2, a[1], b[10]);-	MONT_MUL(w0, w1, w2, a[2], b[9]);-	MONT_MAC(t0, t1, t2, a[3], b[8]);-	MONT_MAC(v0, v1, v2, a[4], b[7]);-	MONT_MAC(w0, w1, w2, a[5], b[6]);-	MONT_MAC(t0, t1, t2, a[6], b[5]);-	MONT_MAC(v0, v1, v2, a[7], b[4]);-	MONT_MAC(w0, w1, w2, a[8], b[3]);-	MONT_MAC(t0, t1, t2, a[9], b[2]);-	MONT_MAC(v0, v1, v2, a[10], b[1]);-	MONT_MAC(w0, w1, w2, a[11], b[0]);-	MONT_MAC(t0, t1, t2, u[0], m[11]);-	MONT_MAC(v0, v1, v2, u[1], m[10]);-	MONT_MAC(w0, w1, w2, u[2], m[9]);-	MONT_MAC(t0, t1, t2, u[3], m[8]);-	MONT_MAC(v0, v1, v2, u[4], m[7]);-	MONT_MAC(w0, w1, w2, u[5], m[6]);-	MONT_MAC(t0, t1, t2, u[6], m[5]);-	MONT_MAC(v0, v1, v2, u[7], m[4]);-	MONT_MAC(w0, w1, w2, u[8], m[3]);-	MONT_MAC(t0, t1, t2, u[9], m[2]);-	MONT_MAC(v0, v1, v2, u[10], m[1]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_ADD(t0, t1, t2, w0, w1, w2);-	u[11] = t0 * n0;-	MONT_MAC(t0, t1, t2, u[11], m[0]);-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 12 */-	MONT_MAC(t0, t1, t2, a[0], b[12]);-	MONT_MUL(v0, v1, v2, a[1], b[11]);-	MONT_MUL(w0, w1, w2, a[2], b[10]);-	MONT_MAC(t0, t1, t2, a[3], b[9]);-	MONT_MAC(v0, v1, v2, a[4], b[8]);-	MONT_MAC(w0, w1, w2, a[5], b[7]);-	MONT_MAC(t0, t1, t2, a[6], b[6]);-	MONT_MAC(v0, v1, v2, a[7], b[5]);-	MONT_MAC(w0, w1, w2, a[8], b[4]);-	MONT_MAC(t0, t1, t2, a[9], b[3]);-	MONT_MAC(v0, v1, v2, a[10], b[2]);-	MONT_MAC(w0, w1, w2, a[11], b[1]);-	MONT_MAC(t0, t1, t2, a[12], b[0]);-	MONT_MAC(v0, v1, v2, u[0], m[12]);-	MONT_MAC(w0, w1, w2, u[1], m[11]);-	MONT_MAC(t0, t1, t2, u[2], m[10]);-	MONT_MAC(v0, v1, v2, u[3], m[9]);-	MONT_MAC(w0, w1, w2, u[4], m[8]);-	MONT_MAC(t0, t1, t2, u[5], m[7]);-	MONT_MAC(v0, v1, v2, u[6], m[6]);-	MONT_MAC(w0, w1, w2, u[7], m[5]);-	MONT_MAC(t0, t1, t2, u[8], m[4]);-	MONT_MAC(v0, v1, v2, u[9], m[3]);-	MONT_MAC(w0, w1, w2, u[10], m[2]);-	MONT_MAC(t0, t1, t2, u[11], m[1]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_ADD(t0, t1, t2, w0, w1, w2);-	u[12] = t0 * n0;-	MONT_MAC(t0, t1, t2, u[12], m[0]);-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 13 */-	MONT_MAC(t0, t1, t2, a[0], b[13]);-	MONT_MUL(v0, v1, v2, a[1], b[12]);-	MONT_MUL(w0, w1, w2, a[2], b[11]);-	MONT_MAC(t0, t1, t2, a[3], b[10]);-	MONT_MAC(v0, v1, v2, a[4], b[9]);-	MONT_MAC(w0, w1, w2, a[5], b[8]);-	MONT_MAC(t0, t1, t2, a[6], b[7]);-	MONT_MAC(v0, v1, v2, a[7], b[6]);-	MONT_MAC(w0, w1, w2, a[8], b[5]);-	MONT_MAC(t0, t1, t2, a[9], b[4]);-	MONT_MAC(v0, v1, v2, a[10], b[3]);-	MONT_MAC(w0, w1, w2, a[11], b[2]);-	MONT_MAC(t0, t1, t2, a[12], b[1]);-	MONT_MAC(v0, v1, v2, a[13], b[0]);-	MONT_MAC(w0, w1, w2, u[0], m[13]);-	MONT_MAC(t0, t1, t2, u[1], m[12]);-	MONT_MAC(v0, v1, v2, u[2], m[11]);-	MONT_MAC(w0, w1, w2, u[3], m[10]);-	MONT_MAC(t0, t1, t2, u[4], m[9]);-	MONT_MAC(v0, v1, v2, u[5], m[8]);-	MONT_MAC(w0, w1, w2, u[6], m[7]);-	MONT_MAC(t0, t1, t2, u[7], m[6]);-	MONT_MAC(v0, v1, v2, u[8], m[5]);-	MONT_MAC(w0, w1, w2, u[9], m[4]);-	MONT_MAC(t0, t1, t2, u[10], m[3]);-	MONT_MAC(v0, v1, v2, u[11], m[2]);-	MONT_MAC(w0, w1, w2, u[12], m[1]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_ADD(t0, t1, t2, w0, w1, w2);-	u[13] = t0 * n0;-	MONT_MAC(t0, t1, t2, u[13], m[0]);-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 14 */-	MONT_MAC(t0, t1, t2, a[0], b[14]);-	MONT_MUL(v0, v1, v2, a[1], b[13]);-	MONT_MUL(w0, w1, w2, a[2], b[12]);-	MONT_MAC(t0, t1, t2, a[3], b[11]);-	MONT_MAC(v0, v1, v2, a[4], b[10]);-	MONT_MAC(w0, w1, w2, a[5], b[9]);-	MONT_MAC(t0, t1, t2, a[6], b[8]);-	MONT_MAC(v0, v1, v2, a[7], b[7]);-	MONT_MAC(w0, w1, w2, a[8], b[6]);-	MONT_MAC(t0, t1, t2, a[9], b[5]);-	MONT_MAC(v0, v1, v2, a[10], b[4]);-	MONT_MAC(w0, w1, w2, a[11], b[3]);-	MONT_MAC(t0, t1, t2, a[12], b[2]);-	MONT_MAC(v0, v1, v2, a[13], b[1]);-	MONT_MAC(w0, w1, w2, a[14], b[0]);-	MONT_MAC(t0, t1, t2, u[0], m[14]);-	MONT_MAC(v0, v1, v2, u[1], m[13]);-	MONT_MAC(w0, w1, w2, u[2], m[12]);-	MONT_MAC(t0, t1, t2, u[3], m[11]);-	MONT_MAC(v0, v1, v2, u[4], m[10]);-	MONT_MAC(w0, w1, w2, u[5], m[9]);-	MONT_MAC(t0, t1, t2, u[6], m[8]);-	MONT_MAC(v0, v1, v2, u[7], m[7]);-	MONT_MAC(w0, w1, w2, u[8], m[6]);-	MONT_MAC(t0, t1, t2, u[9], m[5]);-	MONT_MAC(v0, v1, v2, u[10], m[4]);-	MONT_MAC(w0, w1, w2, u[11], m[3]);-	MONT_MAC(t0, t1, t2, u[12], m[2]);-	MONT_MAC(v0, v1, v2, u[13], m[1]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_ADD(t0, t1, t2, w0, w1, w2);-	u[14] = t0 * n0;-	MONT_MAC(t0, t1, t2, u[14], m[0]);-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 15 */-	MONT_MAC(t0, t1, t2, a[0], b[15]);-	MONT_MUL(v0, v1, v2, a[1], b[14]);-	MONT_MUL(w0, w1, w2, a[2], b[13]);-	MONT_MAC(t0, t1, t2, a[3], b[12]);-	MONT_MAC(v0, v1, v2, a[4], b[11]);-	MONT_MAC(w0, w1, w2, a[5], b[10]);-	MONT_MAC(t0, t1, t2, a[6], b[9]);-	MONT_MAC(v0, v1, v2, a[7], b[8]);-	MONT_MAC(w0, w1, w2, a[8], b[7]);-	MONT_MAC(t0, t1, t2, a[9], b[6]);-	MONT_MAC(v0, v1, v2, a[10], b[5]);-	MONT_MAC(w0, w1, w2, a[11], b[4]);-	MONT_MAC(t0, t1, t2, a[12], b[3]);-	MONT_MAC(v0, v1, v2, a[13], b[2]);-	MONT_MAC(w0, w1, w2, a[14], b[1]);-	MONT_MAC(t0, t1, t2, a[15], b[0]);-	MONT_MAC(v0, v1, v2, u[0], m[15]);-	MONT_MAC(w0, w1, w2, u[1], m[14]);-	MONT_MAC(t0, t1, t2, u[2], m[13]);-	MONT_MAC(v0, v1, v2, u[3], m[12]);-	MONT_MAC(w0, w1, w2, u[4], m[11]);-	MONT_MAC(t0, t1, t2, u[5], m[10]);-	MONT_MAC(v0, v1, v2, u[6], m[9]);-	MONT_MAC(w0, w1, w2, u[7], m[8]);-	MONT_MAC(t0, t1, t2, u[8], m[7]);-	MONT_MAC(v0, v1, v2, u[9], m[6]);-	MONT_MAC(w0, w1, w2, u[10], m[5]);-	MONT_MAC(t0, t1, t2, u[11], m[4]);-	MONT_MAC(v0, v1, v2, u[12], m[3]);-	MONT_MAC(w0, w1, w2, u[13], m[2]);-	MONT_MAC(t0, t1, t2, u[14], m[1]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_ADD(t0, t1, t2, w0, w1, w2);-	u[15] = t0 * n0;-	MONT_MAC(t0, t1, t2, u[15], m[0]);-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 16 */-	MONT_MAC(t0, t1, t2, a[1], b[15]);-	MONT_MUL(v0, v1, v2, a[2], b[14]);-	MONT_MUL(w0, w1, w2, a[3], b[13]);-	MONT_MAC(t0, t1, t2, a[4], b[12]);-	MONT_MAC(v0, v1, v2, a[5], b[11]);-	MONT_MAC(w0, w1, w2, a[6], b[10]);-	MONT_MAC(t0, t1, t2, a[7], b[9]);-	MONT_MAC(v0, v1, v2, a[8], b[8]);-	MONT_MAC(w0, w1, w2, a[9], b[7]);-	MONT_MAC(t0, t1, t2, a[10], b[6]);-	MONT_MAC(v0, v1, v2, a[11], b[5]);-	MONT_MAC(w0, w1, w2, a[12], b[4]);-	MONT_MAC(t0, t1, t2, a[13], b[3]);-	MONT_MAC(v0, v1, v2, a[14], b[2]);-	MONT_MAC(w0, w1, w2, a[15], b[1]);-	MONT_MAC(t0, t1, t2, u[1], m[15]);-	MONT_MAC(v0, v1, v2, u[2], m[14]);-	MONT_MAC(w0, w1, w2, u[3], m[13]);-	MONT_MAC(t0, t1, t2, u[4], m[12]);-	MONT_MAC(v0, v1, v2, u[5], m[11]);-	MONT_MAC(w0, w1, w2, u[6], m[10]);-	MONT_MAC(t0, t1, t2, u[7], m[9]);-	MONT_MAC(v0, v1, v2, u[8], m[8]);-	MONT_MAC(w0, w1, w2, u[9], m[7]);-	MONT_MAC(t0, t1, t2, u[10], m[6]);-	MONT_MAC(v0, v1, v2, u[11], m[5]);-	MONT_MAC(w0, w1, w2, u[12], m[4]);-	MONT_MAC(t0, t1, t2, u[13], m[3]);-	MONT_MAC(v0, v1, v2, u[14], m[2]);-	MONT_MAC(w0, w1, w2, u[15], m[1]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_ADD(t0, t1, t2, w0, w1, w2);-	z[0] = t0;-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 17 */-	MONT_MAC(t0, t1, t2, a[2], b[15]);-	MONT_MUL(v0, v1, v2, a[3], b[14]);-	MONT_MUL(w0, w1, w2, a[4], b[13]);-	MONT_MAC(t0, t1, t2, a[5], b[12]);-	MONT_MAC(v0, v1, v2, a[6], b[11]);-	MONT_MAC(w0, w1, w2, a[7], b[10]);-	MONT_MAC(t0, t1, t2, a[8], b[9]);-	MONT_MAC(v0, v1, v2, a[9], b[8]);-	MONT_MAC(w0, w1, w2, a[10], b[7]);-	MONT_MAC(t0, t1, t2, a[11], b[6]);-	MONT_MAC(v0, v1, v2, a[12], b[5]);-	MONT_MAC(w0, w1, w2, a[13], b[4]);-	MONT_MAC(t0, t1, t2, a[14], b[3]);-	MONT_MAC(v0, v1, v2, a[15], b[2]);-	MONT_MAC(w0, w1, w2, u[2], m[15]);-	MONT_MAC(t0, t1, t2, u[3], m[14]);-	MONT_MAC(v0, v1, v2, u[4], m[13]);-	MONT_MAC(w0, w1, w2, u[5], m[12]);-	MONT_MAC(t0, t1, t2, u[6], m[11]);-	MONT_MAC(v0, v1, v2, u[7], m[10]);-	MONT_MAC(w0, w1, w2, u[8], m[9]);-	MONT_MAC(t0, t1, t2, u[9], m[8]);-	MONT_MAC(v0, v1, v2, u[10], m[7]);-	MONT_MAC(w0, w1, w2, u[11], m[6]);-	MONT_MAC(t0, t1, t2, u[12], m[5]);-	MONT_MAC(v0, v1, v2, u[13], m[4]);-	MONT_MAC(w0, w1, w2, u[14], m[3]);-	MONT_MAC(t0, t1, t2, u[15], m[2]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_ADD(t0, t1, t2, w0, w1, w2);-	z[1] = t0;-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 18 */-	MONT_MAC(t0, t1, t2, a[3], b[15]);-	MONT_MUL(v0, v1, v2, a[4], b[14]);-	MONT_MUL(w0, w1, w2, a[5], b[13]);-	MONT_MAC(t0, t1, t2, a[6], b[12]);-	MONT_MAC(v0, v1, v2, a[7], b[11]);-	MONT_MAC(w0, w1, w2, a[8], b[10]);-	MONT_MAC(t0, t1, t2, a[9], b[9]);-	MONT_MAC(v0, v1, v2, a[10], b[8]);-	MONT_MAC(w0, w1, w2, a[11], b[7]);-	MONT_MAC(t0, t1, t2, a[12], b[6]);-	MONT_MAC(v0, v1, v2, a[13], b[5]);-	MONT_MAC(w0, w1, w2, a[14], b[4]);-	MONT_MAC(t0, t1, t2, a[15], b[3]);-	MONT_MAC(v0, v1, v2, u[3], m[15]);-	MONT_MAC(w0, w1, w2, u[4], m[14]);-	MONT_MAC(t0, t1, t2, u[5], m[13]);-	MONT_MAC(v0, v1, v2, u[6], m[12]);-	MONT_MAC(w0, w1, w2, u[7], m[11]);-	MONT_MAC(t0, t1, t2, u[8], m[10]);-	MONT_MAC(v0, v1, v2, u[9], m[9]);-	MONT_MAC(w0, w1, w2, u[10], m[8]);-	MONT_MAC(t0, t1, t2, u[11], m[7]);-	MONT_MAC(v0, v1, v2, u[12], m[6]);-	MONT_MAC(w0, w1, w2, u[13], m[5]);-	MONT_MAC(t0, t1, t2, u[14], m[4]);-	MONT_MAC(v0, v1, v2, u[15], m[3]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_ADD(t0, t1, t2, w0, w1, w2);-	z[2] = t0;-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 19 */-	MONT_MAC(t0, t1, t2, a[4], b[15]);-	MONT_MUL(v0, v1, v2, a[5], b[14]);-	MONT_MUL(w0, w1, w2, a[6], b[13]);-	MONT_MAC(t0, t1, t2, a[7], b[12]);-	MONT_MAC(v0, v1, v2, a[8], b[11]);-	MONT_MAC(w0, w1, w2, a[9], b[10]);-	MONT_MAC(t0, t1, t2, a[10], b[9]);-	MONT_MAC(v0, v1, v2, a[11], b[8]);-	MONT_MAC(w0, w1, w2, a[12], b[7]);-	MONT_MAC(t0, t1, t2, a[13], b[6]);-	MONT_MAC(v0, v1, v2, a[14], b[5]);-	MONT_MAC(w0, w1, w2, a[15], b[4]);-	MONT_MAC(t0, t1, t2, u[4], m[15]);-	MONT_MAC(v0, v1, v2, u[5], m[14]);-	MONT_MAC(w0, w1, w2, u[6], m[13]);-	MONT_MAC(t0, t1, t2, u[7], m[12]);-	MONT_MAC(v0, v1, v2, u[8], m[11]);-	MONT_MAC(w0, w1, w2, u[9], m[10]);-	MONT_MAC(t0, t1, t2, u[10], m[9]);-	MONT_MAC(v0, v1, v2, u[11], m[8]);-	MONT_MAC(w0, w1, w2, u[12], m[7]);-	MONT_MAC(t0, t1, t2, u[13], m[6]);-	MONT_MAC(v0, v1, v2, u[14], m[5]);-	MONT_MAC(w0, w1, w2, u[15], m[4]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_ADD(t0, t1, t2, w0, w1, w2);-	z[3] = t0;-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 20 */-	MONT_MAC(t0, t1, t2, a[5], b[15]);-	MONT_MUL(v0, v1, v2, a[6], b[14]);-	MONT_MUL(w0, w1, w2, a[7], b[13]);-	MONT_MAC(t0, t1, t2, a[8], b[12]);-	MONT_MAC(v0, v1, v2, a[9], b[11]);-	MONT_MAC(w0, w1, w2, a[10], b[10]);-	MONT_MAC(t0, t1, t2, a[11], b[9]);-	MONT_MAC(v0, v1, v2, a[12], b[8]);-	MONT_MAC(w0, w1, w2, a[13], b[7]);-	MONT_MAC(t0, t1, t2, a[14], b[6]);-	MONT_MAC(v0, v1, v2, a[15], b[5]);-	MONT_MAC(w0, w1, w2, u[5], m[15]);-	MONT_MAC(t0, t1, t2, u[6], m[14]);-	MONT_MAC(v0, v1, v2, u[7], m[13]);-	MONT_MAC(w0, w1, w2, u[8], m[12]);-	MONT_MAC(t0, t1, t2, u[9], m[11]);-	MONT_MAC(v0, v1, v2, u[10], m[10]);-	MONT_MAC(w0, w1, w2, u[11], m[9]);-	MONT_MAC(t0, t1, t2, u[12], m[8]);-	MONT_MAC(v0, v1, v2, u[13], m[7]);-	MONT_MAC(w0, w1, w2, u[14], m[6]);-	MONT_MAC(t0, t1, t2, u[15], m[5]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_ADD(t0, t1, t2, w0, w1, w2);-	z[4] = t0;-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 21 */-	MONT_MAC(t0, t1, t2, a[6], b[15]);-	MONT_MUL(v0, v1, v2, a[7], b[14]);-	MONT_MUL(w0, w1, w2, a[8], b[13]);-	MONT_MAC(t0, t1, t2, a[9], b[12]);-	MONT_MAC(v0, v1, v2, a[10], b[11]);-	MONT_MAC(w0, w1, w2, a[11], b[10]);-	MONT_MAC(t0, t1, t2, a[12], b[9]);-	MONT_MAC(v0, v1, v2, a[13], b[8]);-	MONT_MAC(w0, w1, w2, a[14], b[7]);-	MONT_MAC(t0, t1, t2, a[15], b[6]);-	MONT_MAC(v0, v1, v2, u[6], m[15]);-	MONT_MAC(w0, w1, w2, u[7], m[14]);-	MONT_MAC(t0, t1, t2, u[8], m[13]);-	MONT_MAC(v0, v1, v2, u[9], m[12]);-	MONT_MAC(w0, w1, w2, u[10], m[11]);-	MONT_MAC(t0, t1, t2, u[11], m[10]);-	MONT_MAC(v0, v1, v2, u[12], m[9]);-	MONT_MAC(w0, w1, w2, u[13], m[8]);-	MONT_MAC(t0, t1, t2, u[14], m[7]);-	MONT_MAC(v0, v1, v2, u[15], m[6]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_ADD(t0, t1, t2, w0, w1, w2);-	z[5] = t0;-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 22 */-	MONT_MAC(t0, t1, t2, a[7], b[15]);-	MONT_MUL(v0, v1, v2, a[8], b[14]);-	MONT_MUL(w0, w1, w2, a[9], b[13]);-	MONT_MAC(t0, t1, t2, a[10], b[12]);-	MONT_MAC(v0, v1, v2, a[11], b[11]);-	MONT_MAC(w0, w1, w2, a[12], b[10]);-	MONT_MAC(t0, t1, t2, a[13], b[9]);-	MONT_MAC(v0, v1, v2, a[14], b[8]);-	MONT_MAC(w0, w1, w2, a[15], b[7]);-	MONT_MAC(t0, t1, t2, u[7], m[15]);-	MONT_MAC(v0, v1, v2, u[8], m[14]);-	MONT_MAC(w0, w1, w2, u[9], m[13]);-	MONT_MAC(t0, t1, t2, u[10], m[12]);-	MONT_MAC(v0, v1, v2, u[11], m[11]);-	MONT_MAC(w0, w1, w2, u[12], m[10]);-	MONT_MAC(t0, t1, t2, u[13], m[9]);-	MONT_MAC(v0, v1, v2, u[14], m[8]);-	MONT_MAC(w0, w1, w2, u[15], m[7]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_ADD(t0, t1, t2, w0, w1, w2);-	z[6] = t0;-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 23 */-	MONT_MAC(t0, t1, t2, a[8], b[15]);-	MONT_MUL(v0, v1, v2, a[9], b[14]);-	MONT_MUL(w0, w1, w2, a[10], b[13]);-	MONT_MAC(t0, t1, t2, a[11], b[12]);-	MONT_MAC(v0, v1, v2, a[12], b[11]);-	MONT_MAC(w0, w1, w2, a[13], b[10]);-	MONT_MAC(t0, t1, t2, a[14], b[9]);-	MONT_MAC(v0, v1, v2, a[15], b[8]);-	MONT_MAC(w0, w1, w2, u[8], m[15]);-	MONT_MAC(t0, t1, t2, u[9], m[14]);-	MONT_MAC(v0, v1, v2, u[10], m[13]);-	MONT_MAC(w0, w1, w2, u[11], m[12]);-	MONT_MAC(t0, t1, t2, u[12], m[11]);-	MONT_MAC(v0, v1, v2, u[13], m[10]);-	MONT_MAC(w0, w1, w2, u[14], m[9]);-	MONT_MAC(t0, t1, t2, u[15], m[8]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_ADD(t0, t1, t2, w0, w1, w2);-	z[7] = t0;-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 24 */-	MONT_MAC(t0, t1, t2, a[9], b[15]);-	MONT_MUL(v0, v1, v2, a[10], b[14]);-	MONT_MUL(w0, w1, w2, a[11], b[13]);-	MONT_MAC(t0, t1, t2, a[12], b[12]);-	MONT_MAC(v0, v1, v2, a[13], b[11]);-	MONT_MAC(w0, w1, w2, a[14], b[10]);-	MONT_MAC(t0, t1, t2, a[15], b[9]);-	MONT_MAC(v0, v1, v2, u[9], m[15]);-	MONT_MAC(w0, w1, w2, u[10], m[14]);-	MONT_MAC(t0, t1, t2, u[11], m[13]);-	MONT_MAC(v0, v1, v2, u[12], m[12]);-	MONT_MAC(w0, w1, w2, u[13], m[11]);-	MONT_MAC(t0, t1, t2, u[14], m[10]);-	MONT_MAC(v0, v1, v2, u[15], m[9]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_ADD(t0, t1, t2, w0, w1, w2);-	z[8] = t0;-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 25 */-	MONT_MAC(t0, t1, t2, a[10], b[15]);-	MONT_MUL(v0, v1, v2, a[11], b[14]);-	MONT_MUL(w0, w1, w2, a[12], b[13]);-	MONT_MAC(t0, t1, t2, a[13], b[12]);-	MONT_MAC(v0, v1, v2, a[14], b[11]);-	MONT_MAC(w0, w1, w2, a[15], b[10]);-	MONT_MAC(t0, t1, t2, u[10], m[15]);-	MONT_MAC(v0, v1, v2, u[11], m[14]);-	MONT_MAC(w0, w1, w2, u[12], m[13]);-	MONT_MAC(t0, t1, t2, u[13], m[12]);-	MONT_MAC(v0, v1, v2, u[14], m[11]);-	MONT_MAC(w0, w1, w2, u[15], m[10]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_ADD(t0, t1, t2, w0, w1, w2);-	z[9] = t0;-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 26 */-	MONT_MAC(t0, t1, t2, a[11], b[15]);-	MONT_MUL(v0, v1, v2, a[12], b[14]);-	MONT_MUL(w0, w1, w2, a[13], b[13]);-	MONT_MAC(t0, t1, t2, a[14], b[12]);-	MONT_MAC(v0, v1, v2, a[15], b[11]);-	MONT_MAC(w0, w1, w2, u[11], m[15]);-	MONT_MAC(t0, t1, t2, u[12], m[14]);-	MONT_MAC(v0, v1, v2, u[13], m[13]);-	MONT_MAC(w0, w1, w2, u[14], m[12]);-	MONT_MAC(t0, t1, t2, u[15], m[11]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_ADD(t0, t1, t2, w0, w1, w2);-	z[10] = t0;-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 27 */-	MONT_MAC(t0, t1, t2, a[12], b[15]);-	MONT_MUL(v0, v1, v2, a[13], b[14]);-	MONT_MUL(w0, w1, w2, a[14], b[13]);-	MONT_MAC(t0, t1, t2, a[15], b[12]);-	MONT_MAC(v0, v1, v2, u[12], m[15]);-	MONT_MAC(w0, w1, w2, u[13], m[14]);-	MONT_MAC(t0, t1, t2, u[14], m[13]);-	MONT_MAC(v0, v1, v2, u[15], m[12]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_ADD(t0, t1, t2, w0, w1, w2);-	z[11] = t0;-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 28 */-	MONT_MAC(t0, t1, t2, a[13], b[15]);-	MONT_MUL(v0, v1, v2, a[14], b[14]);-	MONT_MUL(w0, w1, w2, a[15], b[13]);-	MONT_MAC(t0, t1, t2, u[13], m[15]);-	MONT_MAC(v0, v1, v2, u[14], m[14]);-	MONT_MAC(w0, w1, w2, u[15], m[13]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_ADD(t0, t1, t2, w0, w1, w2);-	z[12] = t0;-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 29 */-	MONT_MAC(t0, t1, t2, a[14], b[15]);-	MONT_MUL(v0, v1, v2, a[15], b[14]);-	MONT_MUL(w0, w1, w2, u[14], m[15]);-	MONT_MAC(t0, t1, t2, u[15], m[14]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_ADD(t0, t1, t2, w0, w1, w2);-	z[13] = t0;-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 30 */-	MONT_MAC(t0, t1, t2, a[15], b[15]);-	MONT_MUL(v0, v1, v2, u[15], m[15]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	z[14] = t0;-	t0 = t1;-	t1 = t2;-	t2 = 0;-	z[15] = t0;--	/* under 2m, with t1 the bit above n limbs: at most one subtraction */-	borrow = sub_n(r, z, m, 16);-	take = t1 | (borrow ^ 1);-	select_n(r, r, z, take & 1, 16);-}--/* r = a * a * R^-1 mod m, for a under m; t is 2n limbs of scratch */-static void crypton_mont_sqr16(limb_t *r, const limb_t *a,-                               const limb_t *m, limb_t n0, limb_t *t)-{-	limb_t *u = t, *z = t + 16;-	limb_t t0 = 0, t1 = 0, t2 = 0, v0, v1, v2, w0, w1, w2, borrow, take;-	limb_t s0, s1, s2, c0, c1, c2;--	/* column 0 */-	MONT_MAC(t0, t1, t2, a[0], a[0]);-	u[0] = t0 * n0;-	MONT_MAC(t0, t1, t2, u[0], m[0]);-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 1 */-	MONT_MUL(s0, s1, s2, a[0], a[1]);-	MONT_MAC(t0, t1, t2, u[0], m[1]);-	MONT_DBL(s0, s1, s2);-	MONT_ADD(t0, t1, t2, s0, s1, s2);-	u[1] = t0 * n0;-	MONT_MAC(t0, t1, t2, u[1], m[0]);-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 2 */-	MONT_MUL(s0, s1, s2, a[0], a[2]);-	MONT_MAC(t0, t1, t2, a[1], a[1]);-	MONT_MUL(v0, v1, v2, u[0], m[2]);-	MONT_MUL(w0, w1, w2, u[1], m[1]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_ADD(t0, t1, t2, w0, w1, w2);-	MONT_DBL(s0, s1, s2);-	MONT_ADD(t0, t1, t2, s0, s1, s2);-	u[2] = t0 * n0;-	MONT_MAC(t0, t1, t2, u[2], m[0]);-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 3 */-	MONT_MUL(s0, s1, s2, a[0], a[3]);-	MONT_MUL(c0, c1, c2, a[1], a[2]);-	MONT_MAC(t0, t1, t2, u[0], m[3]);-	MONT_MUL(v0, v1, v2, u[1], m[2]);-	MONT_MUL(w0, w1, w2, u[2], m[1]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_ADD(t0, t1, t2, w0, w1, w2);-	MONT_ADD(s0, s1, s2, c0, c1, c2);-	MONT_DBL(s0, s1, s2);-	MONT_ADD(t0, t1, t2, s0, s1, s2);-	u[3] = t0 * n0;-	MONT_MAC(t0, t1, t2, u[3], m[0]);-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 4 */-	MONT_MUL(s0, s1, s2, a[0], a[4]);-	MONT_MUL(c0, c1, c2, a[1], a[3]);-	MONT_MAC(t0, t1, t2, a[2], a[2]);-	MONT_MUL(v0, v1, v2, u[0], m[4]);-	MONT_MUL(w0, w1, w2, u[1], m[3]);-	MONT_MAC(t0, t1, t2, u[2], m[2]);-	MONT_MAC(v0, v1, v2, u[3], m[1]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_ADD(t0, t1, t2, w0, w1, w2);-	MONT_ADD(s0, s1, s2, c0, c1, c2);-	MONT_DBL(s0, s1, s2);-	MONT_ADD(t0, t1, t2, s0, s1, s2);-	u[4] = t0 * n0;-	MONT_MAC(t0, t1, t2, u[4], m[0]);-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 5 */-	MONT_MUL(s0, s1, s2, a[0], a[5]);-	MONT_MUL(c0, c1, c2, a[1], a[4]);-	MONT_MAC(s0, s1, s2, a[2], a[3]);-	MONT_MAC(t0, t1, t2, u[0], m[5]);-	MONT_MUL(v0, v1, v2, u[1], m[4]);-	MONT_MUL(w0, w1, w2, u[2], m[3]);-	MONT_MAC(t0, t1, t2, u[3], m[2]);-	MONT_MAC(v0, v1, v2, u[4], m[1]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_ADD(t0, t1, t2, w0, w1, w2);-	MONT_ADD(s0, s1, s2, c0, c1, c2);-	MONT_DBL(s0, s1, s2);-	MONT_ADD(t0, t1, t2, s0, s1, s2);-	u[5] = t0 * n0;-	MONT_MAC(t0, t1, t2, u[5], m[0]);-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 6 */-	MONT_MUL(s0, s1, s2, a[0], a[6]);-	MONT_MUL(c0, c1, c2, a[1], a[5]);-	MONT_MAC(s0, s1, s2, a[2], a[4]);-	MONT_MAC(t0, t1, t2, a[3], a[3]);-	MONT_MUL(v0, v1, v2, u[0], m[6]);-	MONT_MUL(w0, w1, w2, u[1], m[5]);-	MONT_MAC(t0, t1, t2, u[2], m[4]);-	MONT_MAC(v0, v1, v2, u[3], m[3]);-	MONT_MAC(w0, w1, w2, u[4], m[2]);-	MONT_MAC(t0, t1, t2, u[5], m[1]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_ADD(t0, t1, t2, w0, w1, w2);-	MONT_ADD(s0, s1, s2, c0, c1, c2);-	MONT_DBL(s0, s1, s2);-	MONT_ADD(t0, t1, t2, s0, s1, s2);-	u[6] = t0 * n0;-	MONT_MAC(t0, t1, t2, u[6], m[0]);-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 7 */-	MONT_MUL(s0, s1, s2, a[0], a[7]);-	MONT_MUL(c0, c1, c2, a[1], a[6]);-	MONT_MAC(s0, s1, s2, a[2], a[5]);-	MONT_MAC(c0, c1, c2, a[3], a[4]);-	MONT_MAC(t0, t1, t2, u[0], m[7]);-	MONT_MUL(v0, v1, v2, u[1], m[6]);-	MONT_MUL(w0, w1, w2, u[2], m[5]);-	MONT_MAC(t0, t1, t2, u[3], m[4]);-	MONT_MAC(v0, v1, v2, u[4], m[3]);-	MONT_MAC(w0, w1, w2, u[5], m[2]);-	MONT_MAC(t0, t1, t2, u[6], m[1]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_ADD(t0, t1, t2, w0, w1, w2);-	MONT_ADD(s0, s1, s2, c0, c1, c2);-	MONT_DBL(s0, s1, s2);-	MONT_ADD(t0, t1, t2, s0, s1, s2);-	u[7] = t0 * n0;-	MONT_MAC(t0, t1, t2, u[7], m[0]);-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 8 */-	MONT_MUL(s0, s1, s2, a[0], a[8]);-	MONT_MUL(c0, c1, c2, a[1], a[7]);-	MONT_MAC(s0, s1, s2, a[2], a[6]);-	MONT_MAC(c0, c1, c2, a[3], a[5]);-	MONT_MAC(t0, t1, t2, a[4], a[4]);-	MONT_MUL(v0, v1, v2, u[0], m[8]);-	MONT_MUL(w0, w1, w2, u[1], m[7]);-	MONT_MAC(t0, t1, t2, u[2], m[6]);-	MONT_MAC(v0, v1, v2, u[3], m[5]);-	MONT_MAC(w0, w1, w2, u[4], m[4]);-	MONT_MAC(t0, t1, t2, u[5], m[3]);-	MONT_MAC(v0, v1, v2, u[6], m[2]);-	MONT_MAC(w0, w1, w2, u[7], m[1]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_ADD(t0, t1, t2, w0, w1, w2);-	MONT_ADD(s0, s1, s2, c0, c1, c2);-	MONT_DBL(s0, s1, s2);-	MONT_ADD(t0, t1, t2, s0, s1, s2);-	u[8] = t0 * n0;-	MONT_MAC(t0, t1, t2, u[8], m[0]);-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 9 */-	MONT_MUL(s0, s1, s2, a[0], a[9]);-	MONT_MUL(c0, c1, c2, a[1], a[8]);-	MONT_MAC(s0, s1, s2, a[2], a[7]);-	MONT_MAC(c0, c1, c2, a[3], a[6]);-	MONT_MAC(s0, s1, s2, a[4], a[5]);-	MONT_MAC(t0, t1, t2, u[0], m[9]);-	MONT_MUL(v0, v1, v2, u[1], m[8]);-	MONT_MUL(w0, w1, w2, u[2], m[7]);-	MONT_MAC(t0, t1, t2, u[3], m[6]);-	MONT_MAC(v0, v1, v2, u[4], m[5]);-	MONT_MAC(w0, w1, w2, u[5], m[4]);-	MONT_MAC(t0, t1, t2, u[6], m[3]);-	MONT_MAC(v0, v1, v2, u[7], m[2]);-	MONT_MAC(w0, w1, w2, u[8], m[1]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_ADD(t0, t1, t2, w0, w1, w2);-	MONT_ADD(s0, s1, s2, c0, c1, c2);-	MONT_DBL(s0, s1, s2);-	MONT_ADD(t0, t1, t2, s0, s1, s2);-	u[9] = t0 * n0;-	MONT_MAC(t0, t1, t2, u[9], m[0]);-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 10 */-	MONT_MUL(s0, s1, s2, a[0], a[10]);-	MONT_MUL(c0, c1, c2, a[1], a[9]);-	MONT_MAC(s0, s1, s2, a[2], a[8]);-	MONT_MAC(c0, c1, c2, a[3], a[7]);-	MONT_MAC(s0, s1, s2, a[4], a[6]);-	MONT_MAC(t0, t1, t2, a[5], a[5]);-	MONT_MUL(v0, v1, v2, u[0], m[10]);-	MONT_MUL(w0, w1, w2, u[1], m[9]);-	MONT_MAC(t0, t1, t2, u[2], m[8]);-	MONT_MAC(v0, v1, v2, u[3], m[7]);-	MONT_MAC(w0, w1, w2, u[4], m[6]);-	MONT_MAC(t0, t1, t2, u[5], m[5]);-	MONT_MAC(v0, v1, v2, u[6], m[4]);-	MONT_MAC(w0, w1, w2, u[7], m[3]);-	MONT_MAC(t0, t1, t2, u[8], m[2]);-	MONT_MAC(v0, v1, v2, u[9], m[1]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_ADD(t0, t1, t2, w0, w1, w2);-	MONT_ADD(s0, s1, s2, c0, c1, c2);-	MONT_DBL(s0, s1, s2);-	MONT_ADD(t0, t1, t2, s0, s1, s2);-	u[10] = t0 * n0;-	MONT_MAC(t0, t1, t2, u[10], m[0]);-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 11 */-	MONT_MUL(s0, s1, s2, a[0], a[11]);-	MONT_MUL(c0, c1, c2, a[1], a[10]);-	MONT_MAC(s0, s1, s2, a[2], a[9]);-	MONT_MAC(c0, c1, c2, a[3], a[8]);-	MONT_MAC(s0, s1, s2, a[4], a[7]);-	MONT_MAC(c0, c1, c2, a[5], a[6]);-	MONT_MAC(t0, t1, t2, u[0], m[11]);-	MONT_MUL(v0, v1, v2, u[1], m[10]);-	MONT_MUL(w0, w1, w2, u[2], m[9]);-	MONT_MAC(t0, t1, t2, u[3], m[8]);-	MONT_MAC(v0, v1, v2, u[4], m[7]);-	MONT_MAC(w0, w1, w2, u[5], m[6]);-	MONT_MAC(t0, t1, t2, u[6], m[5]);-	MONT_MAC(v0, v1, v2, u[7], m[4]);-	MONT_MAC(w0, w1, w2, u[8], m[3]);-	MONT_MAC(t0, t1, t2, u[9], m[2]);-	MONT_MAC(v0, v1, v2, u[10], m[1]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_ADD(t0, t1, t2, w0, w1, w2);-	MONT_ADD(s0, s1, s2, c0, c1, c2);-	MONT_DBL(s0, s1, s2);-	MONT_ADD(t0, t1, t2, s0, s1, s2);-	u[11] = t0 * n0;-	MONT_MAC(t0, t1, t2, u[11], m[0]);-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 12 */-	MONT_MUL(s0, s1, s2, a[0], a[12]);-	MONT_MUL(c0, c1, c2, a[1], a[11]);-	MONT_MAC(s0, s1, s2, a[2], a[10]);-	MONT_MAC(c0, c1, c2, a[3], a[9]);-	MONT_MAC(s0, s1, s2, a[4], a[8]);-	MONT_MAC(c0, c1, c2, a[5], a[7]);-	MONT_MAC(t0, t1, t2, a[6], a[6]);-	MONT_MUL(v0, v1, v2, u[0], m[12]);-	MONT_MUL(w0, w1, w2, u[1], m[11]);-	MONT_MAC(t0, t1, t2, u[2], m[10]);-	MONT_MAC(v0, v1, v2, u[3], m[9]);-	MONT_MAC(w0, w1, w2, u[4], m[8]);-	MONT_MAC(t0, t1, t2, u[5], m[7]);-	MONT_MAC(v0, v1, v2, u[6], m[6]);-	MONT_MAC(w0, w1, w2, u[7], m[5]);-	MONT_MAC(t0, t1, t2, u[8], m[4]);-	MONT_MAC(v0, v1, v2, u[9], m[3]);-	MONT_MAC(w0, w1, w2, u[10], m[2]);-	MONT_MAC(t0, t1, t2, u[11], m[1]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_ADD(t0, t1, t2, w0, w1, w2);-	MONT_ADD(s0, s1, s2, c0, c1, c2);-	MONT_DBL(s0, s1, s2);-	MONT_ADD(t0, t1, t2, s0, s1, s2);-	u[12] = t0 * n0;-	MONT_MAC(t0, t1, t2, u[12], m[0]);-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 13 */-	MONT_MUL(s0, s1, s2, a[0], a[13]);-	MONT_MUL(c0, c1, c2, a[1], a[12]);-	MONT_MAC(s0, s1, s2, a[2], a[11]);-	MONT_MAC(c0, c1, c2, a[3], a[10]);-	MONT_MAC(s0, s1, s2, a[4], a[9]);-	MONT_MAC(c0, c1, c2, a[5], a[8]);-	MONT_MAC(s0, s1, s2, a[6], a[7]);-	MONT_MAC(t0, t1, t2, u[0], m[13]);-	MONT_MUL(v0, v1, v2, u[1], m[12]);-	MONT_MUL(w0, w1, w2, u[2], m[11]);-	MONT_MAC(t0, t1, t2, u[3], m[10]);-	MONT_MAC(v0, v1, v2, u[4], m[9]);-	MONT_MAC(w0, w1, w2, u[5], m[8]);-	MONT_MAC(t0, t1, t2, u[6], m[7]);-	MONT_MAC(v0, v1, v2, u[7], m[6]);-	MONT_MAC(w0, w1, w2, u[8], m[5]);-	MONT_MAC(t0, t1, t2, u[9], m[4]);-	MONT_MAC(v0, v1, v2, u[10], m[3]);-	MONT_MAC(w0, w1, w2, u[11], m[2]);-	MONT_MAC(t0, t1, t2, u[12], m[1]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_ADD(t0, t1, t2, w0, w1, w2);-	MONT_ADD(s0, s1, s2, c0, c1, c2);-	MONT_DBL(s0, s1, s2);-	MONT_ADD(t0, t1, t2, s0, s1, s2);-	u[13] = t0 * n0;-	MONT_MAC(t0, t1, t2, u[13], m[0]);-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 14 */-	MONT_MUL(s0, s1, s2, a[0], a[14]);-	MONT_MUL(c0, c1, c2, a[1], a[13]);-	MONT_MAC(s0, s1, s2, a[2], a[12]);-	MONT_MAC(c0, c1, c2, a[3], a[11]);-	MONT_MAC(s0, s1, s2, a[4], a[10]);-	MONT_MAC(c0, c1, c2, a[5], a[9]);-	MONT_MAC(s0, s1, s2, a[6], a[8]);-	MONT_MAC(t0, t1, t2, a[7], a[7]);-	MONT_MUL(v0, v1, v2, u[0], m[14]);-	MONT_MUL(w0, w1, w2, u[1], m[13]);-	MONT_MAC(t0, t1, t2, u[2], m[12]);-	MONT_MAC(v0, v1, v2, u[3], m[11]);-	MONT_MAC(w0, w1, w2, u[4], m[10]);-	MONT_MAC(t0, t1, t2, u[5], m[9]);-	MONT_MAC(v0, v1, v2, u[6], m[8]);-	MONT_MAC(w0, w1, w2, u[7], m[7]);-	MONT_MAC(t0, t1, t2, u[8], m[6]);-	MONT_MAC(v0, v1, v2, u[9], m[5]);-	MONT_MAC(w0, w1, w2, u[10], m[4]);-	MONT_MAC(t0, t1, t2, u[11], m[3]);-	MONT_MAC(v0, v1, v2, u[12], m[2]);-	MONT_MAC(w0, w1, w2, u[13], m[1]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_ADD(t0, t1, t2, w0, w1, w2);-	MONT_ADD(s0, s1, s2, c0, c1, c2);-	MONT_DBL(s0, s1, s2);-	MONT_ADD(t0, t1, t2, s0, s1, s2);-	u[14] = t0 * n0;-	MONT_MAC(t0, t1, t2, u[14], m[0]);-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 15 */-	MONT_MUL(s0, s1, s2, a[0], a[15]);-	MONT_MUL(c0, c1, c2, a[1], a[14]);-	MONT_MAC(s0, s1, s2, a[2], a[13]);-	MONT_MAC(c0, c1, c2, a[3], a[12]);-	MONT_MAC(s0, s1, s2, a[4], a[11]);-	MONT_MAC(c0, c1, c2, a[5], a[10]);-	MONT_MAC(s0, s1, s2, a[6], a[9]);-	MONT_MAC(c0, c1, c2, a[7], a[8]);-	MONT_MAC(t0, t1, t2, u[0], m[15]);-	MONT_MUL(v0, v1, v2, u[1], m[14]);-	MONT_MUL(w0, w1, w2, u[2], m[13]);-	MONT_MAC(t0, t1, t2, u[3], m[12]);-	MONT_MAC(v0, v1, v2, u[4], m[11]);-	MONT_MAC(w0, w1, w2, u[5], m[10]);-	MONT_MAC(t0, t1, t2, u[6], m[9]);-	MONT_MAC(v0, v1, v2, u[7], m[8]);-	MONT_MAC(w0, w1, w2, u[8], m[7]);-	MONT_MAC(t0, t1, t2, u[9], m[6]);-	MONT_MAC(v0, v1, v2, u[10], m[5]);-	MONT_MAC(w0, w1, w2, u[11], m[4]);-	MONT_MAC(t0, t1, t2, u[12], m[3]);-	MONT_MAC(v0, v1, v2, u[13], m[2]);-	MONT_MAC(w0, w1, w2, u[14], m[1]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_ADD(t0, t1, t2, w0, w1, w2);-	MONT_ADD(s0, s1, s2, c0, c1, c2);-	MONT_DBL(s0, s1, s2);-	MONT_ADD(t0, t1, t2, s0, s1, s2);-	u[15] = t0 * n0;-	MONT_MAC(t0, t1, t2, u[15], m[0]);-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 16 */-	MONT_MUL(s0, s1, s2, a[1], a[15]);-	MONT_MUL(c0, c1, c2, a[2], a[14]);-	MONT_MAC(s0, s1, s2, a[3], a[13]);-	MONT_MAC(c0, c1, c2, a[4], a[12]);-	MONT_MAC(s0, s1, s2, a[5], a[11]);-	MONT_MAC(c0, c1, c2, a[6], a[10]);-	MONT_MAC(s0, s1, s2, a[7], a[9]);-	MONT_MAC(t0, t1, t2, a[8], a[8]);-	MONT_MUL(v0, v1, v2, u[1], m[15]);-	MONT_MUL(w0, w1, w2, u[2], m[14]);-	MONT_MAC(t0, t1, t2, u[3], m[13]);-	MONT_MAC(v0, v1, v2, u[4], m[12]);-	MONT_MAC(w0, w1, w2, u[5], m[11]);-	MONT_MAC(t0, t1, t2, u[6], m[10]);-	MONT_MAC(v0, v1, v2, u[7], m[9]);-	MONT_MAC(w0, w1, w2, u[8], m[8]);-	MONT_MAC(t0, t1, t2, u[9], m[7]);-	MONT_MAC(v0, v1, v2, u[10], m[6]);-	MONT_MAC(w0, w1, w2, u[11], m[5]);-	MONT_MAC(t0, t1, t2, u[12], m[4]);-	MONT_MAC(v0, v1, v2, u[13], m[3]);-	MONT_MAC(w0, w1, w2, u[14], m[2]);-	MONT_MAC(t0, t1, t2, u[15], m[1]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_ADD(t0, t1, t2, w0, w1, w2);-	MONT_ADD(s0, s1, s2, c0, c1, c2);-	MONT_DBL(s0, s1, s2);-	MONT_ADD(t0, t1, t2, s0, s1, s2);-	z[0] = t0;-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 17 */-	MONT_MUL(s0, s1, s2, a[2], a[15]);-	MONT_MUL(c0, c1, c2, a[3], a[14]);-	MONT_MAC(s0, s1, s2, a[4], a[13]);-	MONT_MAC(c0, c1, c2, a[5], a[12]);-	MONT_MAC(s0, s1, s2, a[6], a[11]);-	MONT_MAC(c0, c1, c2, a[7], a[10]);-	MONT_MAC(s0, s1, s2, a[8], a[9]);-	MONT_MAC(t0, t1, t2, u[2], m[15]);-	MONT_MUL(v0, v1, v2, u[3], m[14]);-	MONT_MUL(w0, w1, w2, u[4], m[13]);-	MONT_MAC(t0, t1, t2, u[5], m[12]);-	MONT_MAC(v0, v1, v2, u[6], m[11]);-	MONT_MAC(w0, w1, w2, u[7], m[10]);-	MONT_MAC(t0, t1, t2, u[8], m[9]);-	MONT_MAC(v0, v1, v2, u[9], m[8]);-	MONT_MAC(w0, w1, w2, u[10], m[7]);-	MONT_MAC(t0, t1, t2, u[11], m[6]);-	MONT_MAC(v0, v1, v2, u[12], m[5]);-	MONT_MAC(w0, w1, w2, u[13], m[4]);-	MONT_MAC(t0, t1, t2, u[14], m[3]);-	MONT_MAC(v0, v1, v2, u[15], m[2]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_ADD(t0, t1, t2, w0, w1, w2);-	MONT_ADD(s0, s1, s2, c0, c1, c2);-	MONT_DBL(s0, s1, s2);-	MONT_ADD(t0, t1, t2, s0, s1, s2);-	z[1] = t0;-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 18 */-	MONT_MUL(s0, s1, s2, a[3], a[15]);-	MONT_MUL(c0, c1, c2, a[4], a[14]);-	MONT_MAC(s0, s1, s2, a[5], a[13]);-	MONT_MAC(c0, c1, c2, a[6], a[12]);-	MONT_MAC(s0, s1, s2, a[7], a[11]);-	MONT_MAC(c0, c1, c2, a[8], a[10]);-	MONT_MAC(t0, t1, t2, a[9], a[9]);-	MONT_MUL(v0, v1, v2, u[3], m[15]);-	MONT_MUL(w0, w1, w2, u[4], m[14]);-	MONT_MAC(t0, t1, t2, u[5], m[13]);-	MONT_MAC(v0, v1, v2, u[6], m[12]);-	MONT_MAC(w0, w1, w2, u[7], m[11]);-	MONT_MAC(t0, t1, t2, u[8], m[10]);-	MONT_MAC(v0, v1, v2, u[9], m[9]);-	MONT_MAC(w0, w1, w2, u[10], m[8]);-	MONT_MAC(t0, t1, t2, u[11], m[7]);-	MONT_MAC(v0, v1, v2, u[12], m[6]);-	MONT_MAC(w0, w1, w2, u[13], m[5]);-	MONT_MAC(t0, t1, t2, u[14], m[4]);-	MONT_MAC(v0, v1, v2, u[15], m[3]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_ADD(t0, t1, t2, w0, w1, w2);-	MONT_ADD(s0, s1, s2, c0, c1, c2);-	MONT_DBL(s0, s1, s2);-	MONT_ADD(t0, t1, t2, s0, s1, s2);-	z[2] = t0;-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 19 */-	MONT_MUL(s0, s1, s2, a[4], a[15]);-	MONT_MUL(c0, c1, c2, a[5], a[14]);-	MONT_MAC(s0, s1, s2, a[6], a[13]);-	MONT_MAC(c0, c1, c2, a[7], a[12]);-	MONT_MAC(s0, s1, s2, a[8], a[11]);-	MONT_MAC(c0, c1, c2, a[9], a[10]);-	MONT_MAC(t0, t1, t2, u[4], m[15]);-	MONT_MUL(v0, v1, v2, u[5], m[14]);-	MONT_MUL(w0, w1, w2, u[6], m[13]);-	MONT_MAC(t0, t1, t2, u[7], m[12]);-	MONT_MAC(v0, v1, v2, u[8], m[11]);-	MONT_MAC(w0, w1, w2, u[9], m[10]);-	MONT_MAC(t0, t1, t2, u[10], m[9]);-	MONT_MAC(v0, v1, v2, u[11], m[8]);-	MONT_MAC(w0, w1, w2, u[12], m[7]);-	MONT_MAC(t0, t1, t2, u[13], m[6]);-	MONT_MAC(v0, v1, v2, u[14], m[5]);-	MONT_MAC(w0, w1, w2, u[15], m[4]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_ADD(t0, t1, t2, w0, w1, w2);-	MONT_ADD(s0, s1, s2, c0, c1, c2);-	MONT_DBL(s0, s1, s2);-	MONT_ADD(t0, t1, t2, s0, s1, s2);-	z[3] = t0;-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 20 */-	MONT_MUL(s0, s1, s2, a[5], a[15]);-	MONT_MUL(c0, c1, c2, a[6], a[14]);-	MONT_MAC(s0, s1, s2, a[7], a[13]);-	MONT_MAC(c0, c1, c2, a[8], a[12]);-	MONT_MAC(s0, s1, s2, a[9], a[11]);-	MONT_MAC(t0, t1, t2, a[10], a[10]);-	MONT_MUL(v0, v1, v2, u[5], m[15]);-	MONT_MUL(w0, w1, w2, u[6], m[14]);-	MONT_MAC(t0, t1, t2, u[7], m[13]);-	MONT_MAC(v0, v1, v2, u[8], m[12]);-	MONT_MAC(w0, w1, w2, u[9], m[11]);-	MONT_MAC(t0, t1, t2, u[10], m[10]);-	MONT_MAC(v0, v1, v2, u[11], m[9]);-	MONT_MAC(w0, w1, w2, u[12], m[8]);-	MONT_MAC(t0, t1, t2, u[13], m[7]);-	MONT_MAC(v0, v1, v2, u[14], m[6]);-	MONT_MAC(w0, w1, w2, u[15], m[5]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_ADD(t0, t1, t2, w0, w1, w2);-	MONT_ADD(s0, s1, s2, c0, c1, c2);-	MONT_DBL(s0, s1, s2);-	MONT_ADD(t0, t1, t2, s0, s1, s2);-	z[4] = t0;-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 21 */-	MONT_MUL(s0, s1, s2, a[6], a[15]);-	MONT_MUL(c0, c1, c2, a[7], a[14]);-	MONT_MAC(s0, s1, s2, a[8], a[13]);-	MONT_MAC(c0, c1, c2, a[9], a[12]);-	MONT_MAC(s0, s1, s2, a[10], a[11]);-	MONT_MAC(t0, t1, t2, u[6], m[15]);-	MONT_MUL(v0, v1, v2, u[7], m[14]);-	MONT_MUL(w0, w1, w2, u[8], m[13]);-	MONT_MAC(t0, t1, t2, u[9], m[12]);-	MONT_MAC(v0, v1, v2, u[10], m[11]);-	MONT_MAC(w0, w1, w2, u[11], m[10]);-	MONT_MAC(t0, t1, t2, u[12], m[9]);-	MONT_MAC(v0, v1, v2, u[13], m[8]);-	MONT_MAC(w0, w1, w2, u[14], m[7]);-	MONT_MAC(t0, t1, t2, u[15], m[6]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_ADD(t0, t1, t2, w0, w1, w2);-	MONT_ADD(s0, s1, s2, c0, c1, c2);-	MONT_DBL(s0, s1, s2);-	MONT_ADD(t0, t1, t2, s0, s1, s2);-	z[5] = t0;-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 22 */-	MONT_MUL(s0, s1, s2, a[7], a[15]);-	MONT_MUL(c0, c1, c2, a[8], a[14]);-	MONT_MAC(s0, s1, s2, a[9], a[13]);-	MONT_MAC(c0, c1, c2, a[10], a[12]);-	MONT_MAC(t0, t1, t2, a[11], a[11]);-	MONT_MUL(v0, v1, v2, u[7], m[15]);-	MONT_MUL(w0, w1, w2, u[8], m[14]);-	MONT_MAC(t0, t1, t2, u[9], m[13]);-	MONT_MAC(v0, v1, v2, u[10], m[12]);-	MONT_MAC(w0, w1, w2, u[11], m[11]);-	MONT_MAC(t0, t1, t2, u[12], m[10]);-	MONT_MAC(v0, v1, v2, u[13], m[9]);-	MONT_MAC(w0, w1, w2, u[14], m[8]);-	MONT_MAC(t0, t1, t2, u[15], m[7]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_ADD(t0, t1, t2, w0, w1, w2);-	MONT_ADD(s0, s1, s2, c0, c1, c2);-	MONT_DBL(s0, s1, s2);-	MONT_ADD(t0, t1, t2, s0, s1, s2);-	z[6] = t0;-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 23 */-	MONT_MUL(s0, s1, s2, a[8], a[15]);-	MONT_MUL(c0, c1, c2, a[9], a[14]);-	MONT_MAC(s0, s1, s2, a[10], a[13]);-	MONT_MAC(c0, c1, c2, a[11], a[12]);-	MONT_MAC(t0, t1, t2, u[8], m[15]);-	MONT_MUL(v0, v1, v2, u[9], m[14]);-	MONT_MUL(w0, w1, w2, u[10], m[13]);-	MONT_MAC(t0, t1, t2, u[11], m[12]);-	MONT_MAC(v0, v1, v2, u[12], m[11]);-	MONT_MAC(w0, w1, w2, u[13], m[10]);-	MONT_MAC(t0, t1, t2, u[14], m[9]);-	MONT_MAC(v0, v1, v2, u[15], m[8]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_ADD(t0, t1, t2, w0, w1, w2);-	MONT_ADD(s0, s1, s2, c0, c1, c2);-	MONT_DBL(s0, s1, s2);-	MONT_ADD(t0, t1, t2, s0, s1, s2);-	z[7] = t0;-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 24 */-	MONT_MUL(s0, s1, s2, a[9], a[15]);-	MONT_MUL(c0, c1, c2, a[10], a[14]);-	MONT_MAC(s0, s1, s2, a[11], a[13]);-	MONT_MAC(t0, t1, t2, a[12], a[12]);-	MONT_MUL(v0, v1, v2, u[9], m[15]);-	MONT_MUL(w0, w1, w2, u[10], m[14]);-	MONT_MAC(t0, t1, t2, u[11], m[13]);-	MONT_MAC(v0, v1, v2, u[12], m[12]);-	MONT_MAC(w0, w1, w2, u[13], m[11]);-	MONT_MAC(t0, t1, t2, u[14], m[10]);-	MONT_MAC(v0, v1, v2, u[15], m[9]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_ADD(t0, t1, t2, w0, w1, w2);-	MONT_ADD(s0, s1, s2, c0, c1, c2);-	MONT_DBL(s0, s1, s2);-	MONT_ADD(t0, t1, t2, s0, s1, s2);-	z[8] = t0;-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 25 */-	MONT_MUL(s0, s1, s2, a[10], a[15]);-	MONT_MUL(c0, c1, c2, a[11], a[14]);-	MONT_MAC(s0, s1, s2, a[12], a[13]);-	MONT_MAC(t0, t1, t2, u[10], m[15]);-	MONT_MUL(v0, v1, v2, u[11], m[14]);-	MONT_MUL(w0, w1, w2, u[12], m[13]);-	MONT_MAC(t0, t1, t2, u[13], m[12]);-	MONT_MAC(v0, v1, v2, u[14], m[11]);-	MONT_MAC(w0, w1, w2, u[15], m[10]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_ADD(t0, t1, t2, w0, w1, w2);-	MONT_ADD(s0, s1, s2, c0, c1, c2);-	MONT_DBL(s0, s1, s2);-	MONT_ADD(t0, t1, t2, s0, s1, s2);-	z[9] = t0;-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 26 */-	MONT_MUL(s0, s1, s2, a[11], a[15]);-	MONT_MUL(c0, c1, c2, a[12], a[14]);-	MONT_MAC(t0, t1, t2, a[13], a[13]);-	MONT_MUL(v0, v1, v2, u[11], m[15]);-	MONT_MUL(w0, w1, w2, u[12], m[14]);-	MONT_MAC(t0, t1, t2, u[13], m[13]);-	MONT_MAC(v0, v1, v2, u[14], m[12]);-	MONT_MAC(w0, w1, w2, u[15], m[11]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_ADD(t0, t1, t2, w0, w1, w2);-	MONT_ADD(s0, s1, s2, c0, c1, c2);-	MONT_DBL(s0, s1, s2);-	MONT_ADD(t0, t1, t2, s0, s1, s2);-	z[10] = t0;-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 27 */-	MONT_MUL(s0, s1, s2, a[12], a[15]);-	MONT_MUL(c0, c1, c2, a[13], a[14]);-	MONT_MAC(t0, t1, t2, u[12], m[15]);-	MONT_MUL(v0, v1, v2, u[13], m[14]);-	MONT_MUL(w0, w1, w2, u[14], m[13]);-	MONT_MAC(t0, t1, t2, u[15], m[12]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_ADD(t0, t1, t2, w0, w1, w2);-	MONT_ADD(s0, s1, s2, c0, c1, c2);-	MONT_DBL(s0, s1, s2);-	MONT_ADD(t0, t1, t2, s0, s1, s2);-	z[11] = t0;-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 28 */-	MONT_MUL(s0, s1, s2, a[13], a[15]);-	MONT_MAC(t0, t1, t2, a[14], a[14]);-	MONT_MUL(v0, v1, v2, u[13], m[15]);-	MONT_MUL(w0, w1, w2, u[14], m[14]);-	MONT_MAC(t0, t1, t2, u[15], m[13]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_ADD(t0, t1, t2, w0, w1, w2);-	MONT_DBL(s0, s1, s2);-	MONT_ADD(t0, t1, t2, s0, s1, s2);-	z[12] = t0;-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 29 */-	MONT_MUL(s0, s1, s2, a[14], a[15]);-	MONT_MAC(t0, t1, t2, u[14], m[15]);-	MONT_MUL(v0, v1, v2, u[15], m[14]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_DBL(s0, s1, s2);-	MONT_ADD(t0, t1, t2, s0, s1, s2);-	z[13] = t0;-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 30 */-	MONT_MAC(t0, t1, t2, a[15], a[15]);-	MONT_MUL(v0, v1, v2, u[15], m[15]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	z[14] = t0;-	t0 = t1;-	t1 = t2;-	t2 = 0;-	z[15] = t0;--	/* under 2m, with t1 the bit above n limbs: at most one subtraction */-	borrow = sub_n(r, z, m, 16);-	take = t1 | (borrow ^ 1);-	select_n(r, r, z, take & 1, 16);-}--/* r = a * b * R^-1 mod m, for a and b under m; t is 2n limbs of scratch */-static void crypton_mont_mul24(limb_t *r, const limb_t *a, const limb_t *b,-                               const limb_t *m, limb_t n0, limb_t *t)-{-	limb_t *u = t, *z = t + 24;-	limb_t t0 = 0, t1 = 0, t2 = 0, v0, v1, v2, w0, w1, w2, borrow, take;--	/* column 0 */-	MONT_MAC(t0, t1, t2, a[0], b[0]);-	u[0] = t0 * n0;-	MONT_MAC(t0, t1, t2, u[0], m[0]);-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 1 */-	MONT_MAC(t0, t1, t2, a[0], b[1]);-	MONT_MUL(v0, v1, v2, a[1], b[0]);-	MONT_MUL(w0, w1, w2, u[0], m[1]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_ADD(t0, t1, t2, w0, w1, w2);-	u[1] = t0 * n0;-	MONT_MAC(t0, t1, t2, u[1], m[0]);-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 2 */-	MONT_MAC(t0, t1, t2, a[0], b[2]);-	MONT_MUL(v0, v1, v2, a[1], b[1]);-	MONT_MUL(w0, w1, w2, a[2], b[0]);-	MONT_MAC(t0, t1, t2, u[0], m[2]);-	MONT_MAC(v0, v1, v2, u[1], m[1]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_ADD(t0, t1, t2, w0, w1, w2);-	u[2] = t0 * n0;-	MONT_MAC(t0, t1, t2, u[2], m[0]);-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 3 */-	MONT_MAC(t0, t1, t2, a[0], b[3]);-	MONT_MUL(v0, v1, v2, a[1], b[2]);-	MONT_MUL(w0, w1, w2, a[2], b[1]);-	MONT_MAC(t0, t1, t2, a[3], b[0]);-	MONT_MAC(v0, v1, v2, u[0], m[3]);-	MONT_MAC(w0, w1, w2, u[1], m[2]);-	MONT_MAC(t0, t1, t2, u[2], m[1]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_ADD(t0, t1, t2, w0, w1, w2);-	u[3] = t0 * n0;-	MONT_MAC(t0, t1, t2, u[3], m[0]);-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 4 */-	MONT_MAC(t0, t1, t2, a[0], b[4]);-	MONT_MUL(v0, v1, v2, a[1], b[3]);-	MONT_MUL(w0, w1, w2, a[2], b[2]);-	MONT_MAC(t0, t1, t2, a[3], b[1]);-	MONT_MAC(v0, v1, v2, a[4], b[0]);-	MONT_MAC(w0, w1, w2, u[0], m[4]);-	MONT_MAC(t0, t1, t2, u[1], m[3]);-	MONT_MAC(v0, v1, v2, u[2], m[2]);-	MONT_MAC(w0, w1, w2, u[3], m[1]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_ADD(t0, t1, t2, w0, w1, w2);-	u[4] = t0 * n0;-	MONT_MAC(t0, t1, t2, u[4], m[0]);-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 5 */-	MONT_MAC(t0, t1, t2, a[0], b[5]);-	MONT_MUL(v0, v1, v2, a[1], b[4]);-	MONT_MUL(w0, w1, w2, a[2], b[3]);-	MONT_MAC(t0, t1, t2, a[3], b[2]);-	MONT_MAC(v0, v1, v2, a[4], b[1]);-	MONT_MAC(w0, w1, w2, a[5], b[0]);-	MONT_MAC(t0, t1, t2, u[0], m[5]);-	MONT_MAC(v0, v1, v2, u[1], m[4]);-	MONT_MAC(w0, w1, w2, u[2], m[3]);-	MONT_MAC(t0, t1, t2, u[3], m[2]);-	MONT_MAC(v0, v1, v2, u[4], m[1]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_ADD(t0, t1, t2, w0, w1, w2);-	u[5] = t0 * n0;-	MONT_MAC(t0, t1, t2, u[5], m[0]);-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 6 */-	MONT_MAC(t0, t1, t2, a[0], b[6]);-	MONT_MUL(v0, v1, v2, a[1], b[5]);-	MONT_MUL(w0, w1, w2, a[2], b[4]);-	MONT_MAC(t0, t1, t2, a[3], b[3]);-	MONT_MAC(v0, v1, v2, a[4], b[2]);-	MONT_MAC(w0, w1, w2, a[5], b[1]);-	MONT_MAC(t0, t1, t2, a[6], b[0]);-	MONT_MAC(v0, v1, v2, u[0], m[6]);-	MONT_MAC(w0, w1, w2, u[1], m[5]);-	MONT_MAC(t0, t1, t2, u[2], m[4]);-	MONT_MAC(v0, v1, v2, u[3], m[3]);-	MONT_MAC(w0, w1, w2, u[4], m[2]);-	MONT_MAC(t0, t1, t2, u[5], m[1]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_ADD(t0, t1, t2, w0, w1, w2);-	u[6] = t0 * n0;-	MONT_MAC(t0, t1, t2, u[6], m[0]);-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 7 */-	MONT_MAC(t0, t1, t2, a[0], b[7]);-	MONT_MUL(v0, v1, v2, a[1], b[6]);-	MONT_MUL(w0, w1, w2, a[2], b[5]);-	MONT_MAC(t0, t1, t2, a[3], b[4]);-	MONT_MAC(v0, v1, v2, a[4], b[3]);-	MONT_MAC(w0, w1, w2, a[5], b[2]);-	MONT_MAC(t0, t1, t2, a[6], b[1]);-	MONT_MAC(v0, v1, v2, a[7], b[0]);-	MONT_MAC(w0, w1, w2, u[0], m[7]);-	MONT_MAC(t0, t1, t2, u[1], m[6]);-	MONT_MAC(v0, v1, v2, u[2], m[5]);-	MONT_MAC(w0, w1, w2, u[3], m[4]);-	MONT_MAC(t0, t1, t2, u[4], m[3]);-	MONT_MAC(v0, v1, v2, u[5], m[2]);-	MONT_MAC(w0, w1, w2, u[6], m[1]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_ADD(t0, t1, t2, w0, w1, w2);-	u[7] = t0 * n0;-	MONT_MAC(t0, t1, t2, u[7], m[0]);-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 8 */-	MONT_MAC(t0, t1, t2, a[0], b[8]);-	MONT_MUL(v0, v1, v2, a[1], b[7]);-	MONT_MUL(w0, w1, w2, a[2], b[6]);-	MONT_MAC(t0, t1, t2, a[3], b[5]);-	MONT_MAC(v0, v1, v2, a[4], b[4]);-	MONT_MAC(w0, w1, w2, a[5], b[3]);-	MONT_MAC(t0, t1, t2, a[6], b[2]);-	MONT_MAC(v0, v1, v2, a[7], b[1]);-	MONT_MAC(w0, w1, w2, a[8], b[0]);-	MONT_MAC(t0, t1, t2, u[0], m[8]);-	MONT_MAC(v0, v1, v2, u[1], m[7]);-	MONT_MAC(w0, w1, w2, u[2], m[6]);-	MONT_MAC(t0, t1, t2, u[3], m[5]);-	MONT_MAC(v0, v1, v2, u[4], m[4]);-	MONT_MAC(w0, w1, w2, u[5], m[3]);-	MONT_MAC(t0, t1, t2, u[6], m[2]);-	MONT_MAC(v0, v1, v2, u[7], m[1]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_ADD(t0, t1, t2, w0, w1, w2);-	u[8] = t0 * n0;-	MONT_MAC(t0, t1, t2, u[8], m[0]);-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 9 */-	MONT_MAC(t0, t1, t2, a[0], b[9]);-	MONT_MUL(v0, v1, v2, a[1], b[8]);-	MONT_MUL(w0, w1, w2, a[2], b[7]);-	MONT_MAC(t0, t1, t2, a[3], b[6]);-	MONT_MAC(v0, v1, v2, a[4], b[5]);-	MONT_MAC(w0, w1, w2, a[5], b[4]);-	MONT_MAC(t0, t1, t2, a[6], b[3]);-	MONT_MAC(v0, v1, v2, a[7], b[2]);-	MONT_MAC(w0, w1, w2, a[8], b[1]);-	MONT_MAC(t0, t1, t2, a[9], b[0]);-	MONT_MAC(v0, v1, v2, u[0], m[9]);-	MONT_MAC(w0, w1, w2, u[1], m[8]);-	MONT_MAC(t0, t1, t2, u[2], m[7]);-	MONT_MAC(v0, v1, v2, u[3], m[6]);-	MONT_MAC(w0, w1, w2, u[4], m[5]);-	MONT_MAC(t0, t1, t2, u[5], m[4]);-	MONT_MAC(v0, v1, v2, u[6], m[3]);-	MONT_MAC(w0, w1, w2, u[7], m[2]);-	MONT_MAC(t0, t1, t2, u[8], m[1]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_ADD(t0, t1, t2, w0, w1, w2);-	u[9] = t0 * n0;-	MONT_MAC(t0, t1, t2, u[9], m[0]);-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 10 */-	MONT_MAC(t0, t1, t2, a[0], b[10]);-	MONT_MUL(v0, v1, v2, a[1], b[9]);-	MONT_MUL(w0, w1, w2, a[2], b[8]);-	MONT_MAC(t0, t1, t2, a[3], b[7]);-	MONT_MAC(v0, v1, v2, a[4], b[6]);-	MONT_MAC(w0, w1, w2, a[5], b[5]);-	MONT_MAC(t0, t1, t2, a[6], b[4]);-	MONT_MAC(v0, v1, v2, a[7], b[3]);-	MONT_MAC(w0, w1, w2, a[8], b[2]);-	MONT_MAC(t0, t1, t2, a[9], b[1]);-	MONT_MAC(v0, v1, v2, a[10], b[0]);-	MONT_MAC(w0, w1, w2, u[0], m[10]);-	MONT_MAC(t0, t1, t2, u[1], m[9]);-	MONT_MAC(v0, v1, v2, u[2], m[8]);-	MONT_MAC(w0, w1, w2, u[3], m[7]);-	MONT_MAC(t0, t1, t2, u[4], m[6]);-	MONT_MAC(v0, v1, v2, u[5], m[5]);-	MONT_MAC(w0, w1, w2, u[6], m[4]);-	MONT_MAC(t0, t1, t2, u[7], m[3]);-	MONT_MAC(v0, v1, v2, u[8], m[2]);-	MONT_MAC(w0, w1, w2, u[9], m[1]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_ADD(t0, t1, t2, w0, w1, w2);-	u[10] = t0 * n0;-	MONT_MAC(t0, t1, t2, u[10], m[0]);-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 11 */-	MONT_MAC(t0, t1, t2, a[0], b[11]);-	MONT_MUL(v0, v1, v2, a[1], b[10]);-	MONT_MUL(w0, w1, w2, a[2], b[9]);-	MONT_MAC(t0, t1, t2, a[3], b[8]);-	MONT_MAC(v0, v1, v2, a[4], b[7]);-	MONT_MAC(w0, w1, w2, a[5], b[6]);-	MONT_MAC(t0, t1, t2, a[6], b[5]);-	MONT_MAC(v0, v1, v2, a[7], b[4]);-	MONT_MAC(w0, w1, w2, a[8], b[3]);-	MONT_MAC(t0, t1, t2, a[9], b[2]);-	MONT_MAC(v0, v1, v2, a[10], b[1]);-	MONT_MAC(w0, w1, w2, a[11], b[0]);-	MONT_MAC(t0, t1, t2, u[0], m[11]);-	MONT_MAC(v0, v1, v2, u[1], m[10]);-	MONT_MAC(w0, w1, w2, u[2], m[9]);-	MONT_MAC(t0, t1, t2, u[3], m[8]);-	MONT_MAC(v0, v1, v2, u[4], m[7]);-	MONT_MAC(w0, w1, w2, u[5], m[6]);-	MONT_MAC(t0, t1, t2, u[6], m[5]);-	MONT_MAC(v0, v1, v2, u[7], m[4]);-	MONT_MAC(w0, w1, w2, u[8], m[3]);-	MONT_MAC(t0, t1, t2, u[9], m[2]);-	MONT_MAC(v0, v1, v2, u[10], m[1]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_ADD(t0, t1, t2, w0, w1, w2);-	u[11] = t0 * n0;-	MONT_MAC(t0, t1, t2, u[11], m[0]);-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 12 */-	MONT_MAC(t0, t1, t2, a[0], b[12]);-	MONT_MUL(v0, v1, v2, a[1], b[11]);-	MONT_MUL(w0, w1, w2, a[2], b[10]);-	MONT_MAC(t0, t1, t2, a[3], b[9]);-	MONT_MAC(v0, v1, v2, a[4], b[8]);-	MONT_MAC(w0, w1, w2, a[5], b[7]);-	MONT_MAC(t0, t1, t2, a[6], b[6]);-	MONT_MAC(v0, v1, v2, a[7], b[5]);-	MONT_MAC(w0, w1, w2, a[8], b[4]);-	MONT_MAC(t0, t1, t2, a[9], b[3]);-	MONT_MAC(v0, v1, v2, a[10], b[2]);-	MONT_MAC(w0, w1, w2, a[11], b[1]);-	MONT_MAC(t0, t1, t2, a[12], b[0]);-	MONT_MAC(v0, v1, v2, u[0], m[12]);-	MONT_MAC(w0, w1, w2, u[1], m[11]);-	MONT_MAC(t0, t1, t2, u[2], m[10]);-	MONT_MAC(v0, v1, v2, u[3], m[9]);-	MONT_MAC(w0, w1, w2, u[4], m[8]);-	MONT_MAC(t0, t1, t2, u[5], m[7]);-	MONT_MAC(v0, v1, v2, u[6], m[6]);-	MONT_MAC(w0, w1, w2, u[7], m[5]);-	MONT_MAC(t0, t1, t2, u[8], m[4]);-	MONT_MAC(v0, v1, v2, u[9], m[3]);-	MONT_MAC(w0, w1, w2, u[10], m[2]);-	MONT_MAC(t0, t1, t2, u[11], m[1]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_ADD(t0, t1, t2, w0, w1, w2);-	u[12] = t0 * n0;-	MONT_MAC(t0, t1, t2, u[12], m[0]);-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 13 */-	MONT_MAC(t0, t1, t2, a[0], b[13]);-	MONT_MUL(v0, v1, v2, a[1], b[12]);-	MONT_MUL(w0, w1, w2, a[2], b[11]);-	MONT_MAC(t0, t1, t2, a[3], b[10]);-	MONT_MAC(v0, v1, v2, a[4], b[9]);-	MONT_MAC(w0, w1, w2, a[5], b[8]);-	MONT_MAC(t0, t1, t2, a[6], b[7]);-	MONT_MAC(v0, v1, v2, a[7], b[6]);-	MONT_MAC(w0, w1, w2, a[8], b[5]);-	MONT_MAC(t0, t1, t2, a[9], b[4]);-	MONT_MAC(v0, v1, v2, a[10], b[3]);-	MONT_MAC(w0, w1, w2, a[11], b[2]);-	MONT_MAC(t0, t1, t2, a[12], b[1]);-	MONT_MAC(v0, v1, v2, a[13], b[0]);-	MONT_MAC(w0, w1, w2, u[0], m[13]);-	MONT_MAC(t0, t1, t2, u[1], m[12]);-	MONT_MAC(v0, v1, v2, u[2], m[11]);-	MONT_MAC(w0, w1, w2, u[3], m[10]);-	MONT_MAC(t0, t1, t2, u[4], m[9]);-	MONT_MAC(v0, v1, v2, u[5], m[8]);-	MONT_MAC(w0, w1, w2, u[6], m[7]);-	MONT_MAC(t0, t1, t2, u[7], m[6]);-	MONT_MAC(v0, v1, v2, u[8], m[5]);-	MONT_MAC(w0, w1, w2, u[9], m[4]);-	MONT_MAC(t0, t1, t2, u[10], m[3]);-	MONT_MAC(v0, v1, v2, u[11], m[2]);-	MONT_MAC(w0, w1, w2, u[12], m[1]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_ADD(t0, t1, t2, w0, w1, w2);-	u[13] = t0 * n0;-	MONT_MAC(t0, t1, t2, u[13], m[0]);-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 14 */-	MONT_MAC(t0, t1, t2, a[0], b[14]);-	MONT_MUL(v0, v1, v2, a[1], b[13]);-	MONT_MUL(w0, w1, w2, a[2], b[12]);-	MONT_MAC(t0, t1, t2, a[3], b[11]);-	MONT_MAC(v0, v1, v2, a[4], b[10]);-	MONT_MAC(w0, w1, w2, a[5], b[9]);-	MONT_MAC(t0, t1, t2, a[6], b[8]);-	MONT_MAC(v0, v1, v2, a[7], b[7]);-	MONT_MAC(w0, w1, w2, a[8], b[6]);-	MONT_MAC(t0, t1, t2, a[9], b[5]);-	MONT_MAC(v0, v1, v2, a[10], b[4]);-	MONT_MAC(w0, w1, w2, a[11], b[3]);-	MONT_MAC(t0, t1, t2, a[12], b[2]);-	MONT_MAC(v0, v1, v2, a[13], b[1]);-	MONT_MAC(w0, w1, w2, a[14], b[0]);-	MONT_MAC(t0, t1, t2, u[0], m[14]);-	MONT_MAC(v0, v1, v2, u[1], m[13]);-	MONT_MAC(w0, w1, w2, u[2], m[12]);-	MONT_MAC(t0, t1, t2, u[3], m[11]);-	MONT_MAC(v0, v1, v2, u[4], m[10]);-	MONT_MAC(w0, w1, w2, u[5], m[9]);-	MONT_MAC(t0, t1, t2, u[6], m[8]);-	MONT_MAC(v0, v1, v2, u[7], m[7]);-	MONT_MAC(w0, w1, w2, u[8], m[6]);-	MONT_MAC(t0, t1, t2, u[9], m[5]);-	MONT_MAC(v0, v1, v2, u[10], m[4]);-	MONT_MAC(w0, w1, w2, u[11], m[3]);-	MONT_MAC(t0, t1, t2, u[12], m[2]);-	MONT_MAC(v0, v1, v2, u[13], m[1]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_ADD(t0, t1, t2, w0, w1, w2);-	u[14] = t0 * n0;-	MONT_MAC(t0, t1, t2, u[14], m[0]);-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 15 */-	MONT_MAC(t0, t1, t2, a[0], b[15]);-	MONT_MUL(v0, v1, v2, a[1], b[14]);-	MONT_MUL(w0, w1, w2, a[2], b[13]);-	MONT_MAC(t0, t1, t2, a[3], b[12]);-	MONT_MAC(v0, v1, v2, a[4], b[11]);-	MONT_MAC(w0, w1, w2, a[5], b[10]);-	MONT_MAC(t0, t1, t2, a[6], b[9]);-	MONT_MAC(v0, v1, v2, a[7], b[8]);-	MONT_MAC(w0, w1, w2, a[8], b[7]);-	MONT_MAC(t0, t1, t2, a[9], b[6]);-	MONT_MAC(v0, v1, v2, a[10], b[5]);-	MONT_MAC(w0, w1, w2, a[11], b[4]);-	MONT_MAC(t0, t1, t2, a[12], b[3]);-	MONT_MAC(v0, v1, v2, a[13], b[2]);-	MONT_MAC(w0, w1, w2, a[14], b[1]);-	MONT_MAC(t0, t1, t2, a[15], b[0]);-	MONT_MAC(v0, v1, v2, u[0], m[15]);-	MONT_MAC(w0, w1, w2, u[1], m[14]);-	MONT_MAC(t0, t1, t2, u[2], m[13]);-	MONT_MAC(v0, v1, v2, u[3], m[12]);-	MONT_MAC(w0, w1, w2, u[4], m[11]);-	MONT_MAC(t0, t1, t2, u[5], m[10]);-	MONT_MAC(v0, v1, v2, u[6], m[9]);-	MONT_MAC(w0, w1, w2, u[7], m[8]);-	MONT_MAC(t0, t1, t2, u[8], m[7]);-	MONT_MAC(v0, v1, v2, u[9], m[6]);-	MONT_MAC(w0, w1, w2, u[10], m[5]);-	MONT_MAC(t0, t1, t2, u[11], m[4]);-	MONT_MAC(v0, v1, v2, u[12], m[3]);-	MONT_MAC(w0, w1, w2, u[13], m[2]);-	MONT_MAC(t0, t1, t2, u[14], m[1]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_ADD(t0, t1, t2, w0, w1, w2);-	u[15] = t0 * n0;-	MONT_MAC(t0, t1, t2, u[15], m[0]);-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 16 */-	MONT_MAC(t0, t1, t2, a[0], b[16]);-	MONT_MUL(v0, v1, v2, a[1], b[15]);-	MONT_MUL(w0, w1, w2, a[2], b[14]);-	MONT_MAC(t0, t1, t2, a[3], b[13]);-	MONT_MAC(v0, v1, v2, a[4], b[12]);-	MONT_MAC(w0, w1, w2, a[5], b[11]);-	MONT_MAC(t0, t1, t2, a[6], b[10]);-	MONT_MAC(v0, v1, v2, a[7], b[9]);-	MONT_MAC(w0, w1, w2, a[8], b[8]);-	MONT_MAC(t0, t1, t2, a[9], b[7]);-	MONT_MAC(v0, v1, v2, a[10], b[6]);-	MONT_MAC(w0, w1, w2, a[11], b[5]);-	MONT_MAC(t0, t1, t2, a[12], b[4]);-	MONT_MAC(v0, v1, v2, a[13], b[3]);-	MONT_MAC(w0, w1, w2, a[14], b[2]);-	MONT_MAC(t0, t1, t2, a[15], b[1]);-	MONT_MAC(v0, v1, v2, a[16], b[0]);-	MONT_MAC(w0, w1, w2, u[0], m[16]);-	MONT_MAC(t0, t1, t2, u[1], m[15]);-	MONT_MAC(v0, v1, v2, u[2], m[14]);-	MONT_MAC(w0, w1, w2, u[3], m[13]);-	MONT_MAC(t0, t1, t2, u[4], m[12]);-	MONT_MAC(v0, v1, v2, u[5], m[11]);-	MONT_MAC(w0, w1, w2, u[6], m[10]);-	MONT_MAC(t0, t1, t2, u[7], m[9]);-	MONT_MAC(v0, v1, v2, u[8], m[8]);-	MONT_MAC(w0, w1, w2, u[9], m[7]);-	MONT_MAC(t0, t1, t2, u[10], m[6]);-	MONT_MAC(v0, v1, v2, u[11], m[5]);-	MONT_MAC(w0, w1, w2, u[12], m[4]);-	MONT_MAC(t0, t1, t2, u[13], m[3]);-	MONT_MAC(v0, v1, v2, u[14], m[2]);-	MONT_MAC(w0, w1, w2, u[15], m[1]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_ADD(t0, t1, t2, w0, w1, w2);-	u[16] = t0 * n0;-	MONT_MAC(t0, t1, t2, u[16], m[0]);-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 17 */-	MONT_MAC(t0, t1, t2, a[0], b[17]);-	MONT_MUL(v0, v1, v2, a[1], b[16]);-	MONT_MUL(w0, w1, w2, a[2], b[15]);-	MONT_MAC(t0, t1, t2, a[3], b[14]);-	MONT_MAC(v0, v1, v2, a[4], b[13]);-	MONT_MAC(w0, w1, w2, a[5], b[12]);-	MONT_MAC(t0, t1, t2, a[6], b[11]);-	MONT_MAC(v0, v1, v2, a[7], b[10]);-	MONT_MAC(w0, w1, w2, a[8], b[9]);-	MONT_MAC(t0, t1, t2, a[9], b[8]);-	MONT_MAC(v0, v1, v2, a[10], b[7]);-	MONT_MAC(w0, w1, w2, a[11], b[6]);-	MONT_MAC(t0, t1, t2, a[12], b[5]);-	MONT_MAC(v0, v1, v2, a[13], b[4]);-	MONT_MAC(w0, w1, w2, a[14], b[3]);-	MONT_MAC(t0, t1, t2, a[15], b[2]);-	MONT_MAC(v0, v1, v2, a[16], b[1]);-	MONT_MAC(w0, w1, w2, a[17], b[0]);-	MONT_MAC(t0, t1, t2, u[0], m[17]);-	MONT_MAC(v0, v1, v2, u[1], m[16]);-	MONT_MAC(w0, w1, w2, u[2], m[15]);-	MONT_MAC(t0, t1, t2, u[3], m[14]);-	MONT_MAC(v0, v1, v2, u[4], m[13]);-	MONT_MAC(w0, w1, w2, u[5], m[12]);-	MONT_MAC(t0, t1, t2, u[6], m[11]);-	MONT_MAC(v0, v1, v2, u[7], m[10]);-	MONT_MAC(w0, w1, w2, u[8], m[9]);-	MONT_MAC(t0, t1, t2, u[9], m[8]);-	MONT_MAC(v0, v1, v2, u[10], m[7]);-	MONT_MAC(w0, w1, w2, u[11], m[6]);-	MONT_MAC(t0, t1, t2, u[12], m[5]);-	MONT_MAC(v0, v1, v2, u[13], m[4]);-	MONT_MAC(w0, w1, w2, u[14], m[3]);-	MONT_MAC(t0, t1, t2, u[15], m[2]);-	MONT_MAC(v0, v1, v2, u[16], m[1]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_ADD(t0, t1, t2, w0, w1, w2);-	u[17] = t0 * n0;-	MONT_MAC(t0, t1, t2, u[17], m[0]);-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 18 */-	MONT_MAC(t0, t1, t2, a[0], b[18]);-	MONT_MUL(v0, v1, v2, a[1], b[17]);-	MONT_MUL(w0, w1, w2, a[2], b[16]);-	MONT_MAC(t0, t1, t2, a[3], b[15]);-	MONT_MAC(v0, v1, v2, a[4], b[14]);-	MONT_MAC(w0, w1, w2, a[5], b[13]);-	MONT_MAC(t0, t1, t2, a[6], b[12]);-	MONT_MAC(v0, v1, v2, a[7], b[11]);-	MONT_MAC(w0, w1, w2, a[8], b[10]);-	MONT_MAC(t0, t1, t2, a[9], b[9]);-	MONT_MAC(v0, v1, v2, a[10], b[8]);-	MONT_MAC(w0, w1, w2, a[11], b[7]);-	MONT_MAC(t0, t1, t2, a[12], b[6]);-	MONT_MAC(v0, v1, v2, a[13], b[5]);-	MONT_MAC(w0, w1, w2, a[14], b[4]);-	MONT_MAC(t0, t1, t2, a[15], b[3]);-	MONT_MAC(v0, v1, v2, a[16], b[2]);-	MONT_MAC(w0, w1, w2, a[17], b[1]);-	MONT_MAC(t0, t1, t2, a[18], b[0]);-	MONT_MAC(v0, v1, v2, u[0], m[18]);-	MONT_MAC(w0, w1, w2, u[1], m[17]);-	MONT_MAC(t0, t1, t2, u[2], m[16]);-	MONT_MAC(v0, v1, v2, u[3], m[15]);-	MONT_MAC(w0, w1, w2, u[4], m[14]);-	MONT_MAC(t0, t1, t2, u[5], m[13]);-	MONT_MAC(v0, v1, v2, u[6], m[12]);-	MONT_MAC(w0, w1, w2, u[7], m[11]);-	MONT_MAC(t0, t1, t2, u[8], m[10]);-	MONT_MAC(v0, v1, v2, u[9], m[9]);-	MONT_MAC(w0, w1, w2, u[10], m[8]);-	MONT_MAC(t0, t1, t2, u[11], m[7]);-	MONT_MAC(v0, v1, v2, u[12], m[6]);-	MONT_MAC(w0, w1, w2, u[13], m[5]);-	MONT_MAC(t0, t1, t2, u[14], m[4]);-	MONT_MAC(v0, v1, v2, u[15], m[3]);-	MONT_MAC(w0, w1, w2, u[16], m[2]);-	MONT_MAC(t0, t1, t2, u[17], m[1]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_ADD(t0, t1, t2, w0, w1, w2);-	u[18] = t0 * n0;-	MONT_MAC(t0, t1, t2, u[18], m[0]);-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 19 */-	MONT_MAC(t0, t1, t2, a[0], b[19]);-	MONT_MUL(v0, v1, v2, a[1], b[18]);-	MONT_MUL(w0, w1, w2, a[2], b[17]);-	MONT_MAC(t0, t1, t2, a[3], b[16]);-	MONT_MAC(v0, v1, v2, a[4], b[15]);-	MONT_MAC(w0, w1, w2, a[5], b[14]);-	MONT_MAC(t0, t1, t2, a[6], b[13]);-	MONT_MAC(v0, v1, v2, a[7], b[12]);-	MONT_MAC(w0, w1, w2, a[8], b[11]);-	MONT_MAC(t0, t1, t2, a[9], b[10]);-	MONT_MAC(v0, v1, v2, a[10], b[9]);-	MONT_MAC(w0, w1, w2, a[11], b[8]);-	MONT_MAC(t0, t1, t2, a[12], b[7]);-	MONT_MAC(v0, v1, v2, a[13], b[6]);-	MONT_MAC(w0, w1, w2, a[14], b[5]);-	MONT_MAC(t0, t1, t2, a[15], b[4]);-	MONT_MAC(v0, v1, v2, a[16], b[3]);-	MONT_MAC(w0, w1, w2, a[17], b[2]);-	MONT_MAC(t0, t1, t2, a[18], b[1]);-	MONT_MAC(v0, v1, v2, a[19], b[0]);-	MONT_MAC(w0, w1, w2, u[0], m[19]);-	MONT_MAC(t0, t1, t2, u[1], m[18]);-	MONT_MAC(v0, v1, v2, u[2], m[17]);-	MONT_MAC(w0, w1, w2, u[3], m[16]);-	MONT_MAC(t0, t1, t2, u[4], m[15]);-	MONT_MAC(v0, v1, v2, u[5], m[14]);-	MONT_MAC(w0, w1, w2, u[6], m[13]);-	MONT_MAC(t0, t1, t2, u[7], m[12]);-	MONT_MAC(v0, v1, v2, u[8], m[11]);-	MONT_MAC(w0, w1, w2, u[9], m[10]);-	MONT_MAC(t0, t1, t2, u[10], m[9]);-	MONT_MAC(v0, v1, v2, u[11], m[8]);-	MONT_MAC(w0, w1, w2, u[12], m[7]);-	MONT_MAC(t0, t1, t2, u[13], m[6]);-	MONT_MAC(v0, v1, v2, u[14], m[5]);-	MONT_MAC(w0, w1, w2, u[15], m[4]);-	MONT_MAC(t0, t1, t2, u[16], m[3]);-	MONT_MAC(v0, v1, v2, u[17], m[2]);-	MONT_MAC(w0, w1, w2, u[18], m[1]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_ADD(t0, t1, t2, w0, w1, w2);-	u[19] = t0 * n0;-	MONT_MAC(t0, t1, t2, u[19], m[0]);-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 20 */-	MONT_MAC(t0, t1, t2, a[0], b[20]);-	MONT_MUL(v0, v1, v2, a[1], b[19]);-	MONT_MUL(w0, w1, w2, a[2], b[18]);-	MONT_MAC(t0, t1, t2, a[3], b[17]);-	MONT_MAC(v0, v1, v2, a[4], b[16]);-	MONT_MAC(w0, w1, w2, a[5], b[15]);-	MONT_MAC(t0, t1, t2, a[6], b[14]);-	MONT_MAC(v0, v1, v2, a[7], b[13]);-	MONT_MAC(w0, w1, w2, a[8], b[12]);-	MONT_MAC(t0, t1, t2, a[9], b[11]);-	MONT_MAC(v0, v1, v2, a[10], b[10]);-	MONT_MAC(w0, w1, w2, a[11], b[9]);-	MONT_MAC(t0, t1, t2, a[12], b[8]);-	MONT_MAC(v0, v1, v2, a[13], b[7]);-	MONT_MAC(w0, w1, w2, a[14], b[6]);-	MONT_MAC(t0, t1, t2, a[15], b[5]);-	MONT_MAC(v0, v1, v2, a[16], b[4]);-	MONT_MAC(w0, w1, w2, a[17], b[3]);-	MONT_MAC(t0, t1, t2, a[18], b[2]);-	MONT_MAC(v0, v1, v2, a[19], b[1]);-	MONT_MAC(w0, w1, w2, a[20], b[0]);-	MONT_MAC(t0, t1, t2, u[0], m[20]);-	MONT_MAC(v0, v1, v2, u[1], m[19]);-	MONT_MAC(w0, w1, w2, u[2], m[18]);-	MONT_MAC(t0, t1, t2, u[3], m[17]);-	MONT_MAC(v0, v1, v2, u[4], m[16]);-	MONT_MAC(w0, w1, w2, u[5], m[15]);-	MONT_MAC(t0, t1, t2, u[6], m[14]);-	MONT_MAC(v0, v1, v2, u[7], m[13]);-	MONT_MAC(w0, w1, w2, u[8], m[12]);-	MONT_MAC(t0, t1, t2, u[9], m[11]);-	MONT_MAC(v0, v1, v2, u[10], m[10]);-	MONT_MAC(w0, w1, w2, u[11], m[9]);-	MONT_MAC(t0, t1, t2, u[12], m[8]);-	MONT_MAC(v0, v1, v2, u[13], m[7]);-	MONT_MAC(w0, w1, w2, u[14], m[6]);-	MONT_MAC(t0, t1, t2, u[15], m[5]);-	MONT_MAC(v0, v1, v2, u[16], m[4]);-	MONT_MAC(w0, w1, w2, u[17], m[3]);-	MONT_MAC(t0, t1, t2, u[18], m[2]);-	MONT_MAC(v0, v1, v2, u[19], m[1]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_ADD(t0, t1, t2, w0, w1, w2);-	u[20] = t0 * n0;-	MONT_MAC(t0, t1, t2, u[20], m[0]);-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 21 */-	MONT_MAC(t0, t1, t2, a[0], b[21]);-	MONT_MUL(v0, v1, v2, a[1], b[20]);-	MONT_MUL(w0, w1, w2, a[2], b[19]);-	MONT_MAC(t0, t1, t2, a[3], b[18]);-	MONT_MAC(v0, v1, v2, a[4], b[17]);-	MONT_MAC(w0, w1, w2, a[5], b[16]);-	MONT_MAC(t0, t1, t2, a[6], b[15]);-	MONT_MAC(v0, v1, v2, a[7], b[14]);-	MONT_MAC(w0, w1, w2, a[8], b[13]);-	MONT_MAC(t0, t1, t2, a[9], b[12]);-	MONT_MAC(v0, v1, v2, a[10], b[11]);-	MONT_MAC(w0, w1, w2, a[11], b[10]);-	MONT_MAC(t0, t1, t2, a[12], b[9]);-	MONT_MAC(v0, v1, v2, a[13], b[8]);-	MONT_MAC(w0, w1, w2, a[14], b[7]);-	MONT_MAC(t0, t1, t2, a[15], b[6]);-	MONT_MAC(v0, v1, v2, a[16], b[5]);-	MONT_MAC(w0, w1, w2, a[17], b[4]);-	MONT_MAC(t0, t1, t2, a[18], b[3]);-	MONT_MAC(v0, v1, v2, a[19], b[2]);-	MONT_MAC(w0, w1, w2, a[20], b[1]);-	MONT_MAC(t0, t1, t2, a[21], b[0]);-	MONT_MAC(v0, v1, v2, u[0], m[21]);-	MONT_MAC(w0, w1, w2, u[1], m[20]);-	MONT_MAC(t0, t1, t2, u[2], m[19]);-	MONT_MAC(v0, v1, v2, u[3], m[18]);-	MONT_MAC(w0, w1, w2, u[4], m[17]);-	MONT_MAC(t0, t1, t2, u[5], m[16]);-	MONT_MAC(v0, v1, v2, u[6], m[15]);-	MONT_MAC(w0, w1, w2, u[7], m[14]);-	MONT_MAC(t0, t1, t2, u[8], m[13]);-	MONT_MAC(v0, v1, v2, u[9], m[12]);-	MONT_MAC(w0, w1, w2, u[10], m[11]);-	MONT_MAC(t0, t1, t2, u[11], m[10]);-	MONT_MAC(v0, v1, v2, u[12], m[9]);-	MONT_MAC(w0, w1, w2, u[13], m[8]);-	MONT_MAC(t0, t1, t2, u[14], m[7]);-	MONT_MAC(v0, v1, v2, u[15], m[6]);-	MONT_MAC(w0, w1, w2, u[16], m[5]);-	MONT_MAC(t0, t1, t2, u[17], m[4]);-	MONT_MAC(v0, v1, v2, u[18], m[3]);-	MONT_MAC(w0, w1, w2, u[19], m[2]);-	MONT_MAC(t0, t1, t2, u[20], m[1]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_ADD(t0, t1, t2, w0, w1, w2);-	u[21] = t0 * n0;-	MONT_MAC(t0, t1, t2, u[21], m[0]);-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 22 */-	MONT_MAC(t0, t1, t2, a[0], b[22]);-	MONT_MUL(v0, v1, v2, a[1], b[21]);-	MONT_MUL(w0, w1, w2, a[2], b[20]);-	MONT_MAC(t0, t1, t2, a[3], b[19]);-	MONT_MAC(v0, v1, v2, a[4], b[18]);-	MONT_MAC(w0, w1, w2, a[5], b[17]);-	MONT_MAC(t0, t1, t2, a[6], b[16]);-	MONT_MAC(v0, v1, v2, a[7], b[15]);-	MONT_MAC(w0, w1, w2, a[8], b[14]);-	MONT_MAC(t0, t1, t2, a[9], b[13]);-	MONT_MAC(v0, v1, v2, a[10], b[12]);-	MONT_MAC(w0, w1, w2, a[11], b[11]);-	MONT_MAC(t0, t1, t2, a[12], b[10]);-	MONT_MAC(v0, v1, v2, a[13], b[9]);-	MONT_MAC(w0, w1, w2, a[14], b[8]);-	MONT_MAC(t0, t1, t2, a[15], b[7]);-	MONT_MAC(v0, v1, v2, a[16], b[6]);-	MONT_MAC(w0, w1, w2, a[17], b[5]);-	MONT_MAC(t0, t1, t2, a[18], b[4]);-	MONT_MAC(v0, v1, v2, a[19], b[3]);-	MONT_MAC(w0, w1, w2, a[20], b[2]);-	MONT_MAC(t0, t1, t2, a[21], b[1]);-	MONT_MAC(v0, v1, v2, a[22], b[0]);-	MONT_MAC(w0, w1, w2, u[0], m[22]);-	MONT_MAC(t0, t1, t2, u[1], m[21]);-	MONT_MAC(v0, v1, v2, u[2], m[20]);-	MONT_MAC(w0, w1, w2, u[3], m[19]);-	MONT_MAC(t0, t1, t2, u[4], m[18]);-	MONT_MAC(v0, v1, v2, u[5], m[17]);-	MONT_MAC(w0, w1, w2, u[6], m[16]);-	MONT_MAC(t0, t1, t2, u[7], m[15]);-	MONT_MAC(v0, v1, v2, u[8], m[14]);-	MONT_MAC(w0, w1, w2, u[9], m[13]);-	MONT_MAC(t0, t1, t2, u[10], m[12]);-	MONT_MAC(v0, v1, v2, u[11], m[11]);-	MONT_MAC(w0, w1, w2, u[12], m[10]);-	MONT_MAC(t0, t1, t2, u[13], m[9]);-	MONT_MAC(v0, v1, v2, u[14], m[8]);-	MONT_MAC(w0, w1, w2, u[15], m[7]);-	MONT_MAC(t0, t1, t2, u[16], m[6]);-	MONT_MAC(v0, v1, v2, u[17], m[5]);-	MONT_MAC(w0, w1, w2, u[18], m[4]);-	MONT_MAC(t0, t1, t2, u[19], m[3]);-	MONT_MAC(v0, v1, v2, u[20], m[2]);-	MONT_MAC(w0, w1, w2, u[21], m[1]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_ADD(t0, t1, t2, w0, w1, w2);-	u[22] = t0 * n0;-	MONT_MAC(t0, t1, t2, u[22], m[0]);-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 23 */-	MONT_MAC(t0, t1, t2, a[0], b[23]);-	MONT_MUL(v0, v1, v2, a[1], b[22]);-	MONT_MUL(w0, w1, w2, a[2], b[21]);-	MONT_MAC(t0, t1, t2, a[3], b[20]);-	MONT_MAC(v0, v1, v2, a[4], b[19]);-	MONT_MAC(w0, w1, w2, a[5], b[18]);-	MONT_MAC(t0, t1, t2, a[6], b[17]);-	MONT_MAC(v0, v1, v2, a[7], b[16]);-	MONT_MAC(w0, w1, w2, a[8], b[15]);-	MONT_MAC(t0, t1, t2, a[9], b[14]);-	MONT_MAC(v0, v1, v2, a[10], b[13]);-	MONT_MAC(w0, w1, w2, a[11], b[12]);-	MONT_MAC(t0, t1, t2, a[12], b[11]);-	MONT_MAC(v0, v1, v2, a[13], b[10]);-	MONT_MAC(w0, w1, w2, a[14], b[9]);-	MONT_MAC(t0, t1, t2, a[15], b[8]);-	MONT_MAC(v0, v1, v2, a[16], b[7]);-	MONT_MAC(w0, w1, w2, a[17], b[6]);-	MONT_MAC(t0, t1, t2, a[18], b[5]);-	MONT_MAC(v0, v1, v2, a[19], b[4]);-	MONT_MAC(w0, w1, w2, a[20], b[3]);-	MONT_MAC(t0, t1, t2, a[21], b[2]);-	MONT_MAC(v0, v1, v2, a[22], b[1]);-	MONT_MAC(w0, w1, w2, a[23], b[0]);-	MONT_MAC(t0, t1, t2, u[0], m[23]);-	MONT_MAC(v0, v1, v2, u[1], m[22]);-	MONT_MAC(w0, w1, w2, u[2], m[21]);-	MONT_MAC(t0, t1, t2, u[3], m[20]);-	MONT_MAC(v0, v1, v2, u[4], m[19]);-	MONT_MAC(w0, w1, w2, u[5], m[18]);-	MONT_MAC(t0, t1, t2, u[6], m[17]);-	MONT_MAC(v0, v1, v2, u[7], m[16]);-	MONT_MAC(w0, w1, w2, u[8], m[15]);-	MONT_MAC(t0, t1, t2, u[9], m[14]);-	MONT_MAC(v0, v1, v2, u[10], m[13]);-	MONT_MAC(w0, w1, w2, u[11], m[12]);-	MONT_MAC(t0, t1, t2, u[12], m[11]);-	MONT_MAC(v0, v1, v2, u[13], m[10]);-	MONT_MAC(w0, w1, w2, u[14], m[9]);-	MONT_MAC(t0, t1, t2, u[15], m[8]);-	MONT_MAC(v0, v1, v2, u[16], m[7]);-	MONT_MAC(w0, w1, w2, u[17], m[6]);-	MONT_MAC(t0, t1, t2, u[18], m[5]);-	MONT_MAC(v0, v1, v2, u[19], m[4]);-	MONT_MAC(w0, w1, w2, u[20], m[3]);-	MONT_MAC(t0, t1, t2, u[21], m[2]);-	MONT_MAC(v0, v1, v2, u[22], m[1]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_ADD(t0, t1, t2, w0, w1, w2);-	u[23] = t0 * n0;-	MONT_MAC(t0, t1, t2, u[23], m[0]);-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 24 */-	MONT_MAC(t0, t1, t2, a[1], b[23]);-	MONT_MUL(v0, v1, v2, a[2], b[22]);-	MONT_MUL(w0, w1, w2, a[3], b[21]);-	MONT_MAC(t0, t1, t2, a[4], b[20]);-	MONT_MAC(v0, v1, v2, a[5], b[19]);-	MONT_MAC(w0, w1, w2, a[6], b[18]);-	MONT_MAC(t0, t1, t2, a[7], b[17]);-	MONT_MAC(v0, v1, v2, a[8], b[16]);-	MONT_MAC(w0, w1, w2, a[9], b[15]);-	MONT_MAC(t0, t1, t2, a[10], b[14]);-	MONT_MAC(v0, v1, v2, a[11], b[13]);-	MONT_MAC(w0, w1, w2, a[12], b[12]);-	MONT_MAC(t0, t1, t2, a[13], b[11]);-	MONT_MAC(v0, v1, v2, a[14], b[10]);-	MONT_MAC(w0, w1, w2, a[15], b[9]);-	MONT_MAC(t0, t1, t2, a[16], b[8]);-	MONT_MAC(v0, v1, v2, a[17], b[7]);-	MONT_MAC(w0, w1, w2, a[18], b[6]);-	MONT_MAC(t0, t1, t2, a[19], b[5]);-	MONT_MAC(v0, v1, v2, a[20], b[4]);-	MONT_MAC(w0, w1, w2, a[21], b[3]);-	MONT_MAC(t0, t1, t2, a[22], b[2]);-	MONT_MAC(v0, v1, v2, a[23], b[1]);-	MONT_MAC(w0, w1, w2, u[1], m[23]);-	MONT_MAC(t0, t1, t2, u[2], m[22]);-	MONT_MAC(v0, v1, v2, u[3], m[21]);-	MONT_MAC(w0, w1, w2, u[4], m[20]);-	MONT_MAC(t0, t1, t2, u[5], m[19]);-	MONT_MAC(v0, v1, v2, u[6], m[18]);-	MONT_MAC(w0, w1, w2, u[7], m[17]);-	MONT_MAC(t0, t1, t2, u[8], m[16]);-	MONT_MAC(v0, v1, v2, u[9], m[15]);-	MONT_MAC(w0, w1, w2, u[10], m[14]);-	MONT_MAC(t0, t1, t2, u[11], m[13]);-	MONT_MAC(v0, v1, v2, u[12], m[12]);-	MONT_MAC(w0, w1, w2, u[13], m[11]);-	MONT_MAC(t0, t1, t2, u[14], m[10]);-	MONT_MAC(v0, v1, v2, u[15], m[9]);-	MONT_MAC(w0, w1, w2, u[16], m[8]);-	MONT_MAC(t0, t1, t2, u[17], m[7]);-	MONT_MAC(v0, v1, v2, u[18], m[6]);-	MONT_MAC(w0, w1, w2, u[19], m[5]);-	MONT_MAC(t0, t1, t2, u[20], m[4]);-	MONT_MAC(v0, v1, v2, u[21], m[3]);-	MONT_MAC(w0, w1, w2, u[22], m[2]);-	MONT_MAC(t0, t1, t2, u[23], m[1]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_ADD(t0, t1, t2, w0, w1, w2);-	z[0] = t0;-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 25 */-	MONT_MAC(t0, t1, t2, a[2], b[23]);-	MONT_MUL(v0, v1, v2, a[3], b[22]);-	MONT_MUL(w0, w1, w2, a[4], b[21]);-	MONT_MAC(t0, t1, t2, a[5], b[20]);-	MONT_MAC(v0, v1, v2, a[6], b[19]);-	MONT_MAC(w0, w1, w2, a[7], b[18]);-	MONT_MAC(t0, t1, t2, a[8], b[17]);-	MONT_MAC(v0, v1, v2, a[9], b[16]);-	MONT_MAC(w0, w1, w2, a[10], b[15]);-	MONT_MAC(t0, t1, t2, a[11], b[14]);-	MONT_MAC(v0, v1, v2, a[12], b[13]);-	MONT_MAC(w0, w1, w2, a[13], b[12]);-	MONT_MAC(t0, t1, t2, a[14], b[11]);-	MONT_MAC(v0, v1, v2, a[15], b[10]);-	MONT_MAC(w0, w1, w2, a[16], b[9]);-	MONT_MAC(t0, t1, t2, a[17], b[8]);-	MONT_MAC(v0, v1, v2, a[18], b[7]);-	MONT_MAC(w0, w1, w2, a[19], b[6]);-	MONT_MAC(t0, t1, t2, a[20], b[5]);-	MONT_MAC(v0, v1, v2, a[21], b[4]);-	MONT_MAC(w0, w1, w2, a[22], b[3]);-	MONT_MAC(t0, t1, t2, a[23], b[2]);-	MONT_MAC(v0, v1, v2, u[2], m[23]);-	MONT_MAC(w0, w1, w2, u[3], m[22]);-	MONT_MAC(t0, t1, t2, u[4], m[21]);-	MONT_MAC(v0, v1, v2, u[5], m[20]);-	MONT_MAC(w0, w1, w2, u[6], m[19]);-	MONT_MAC(t0, t1, t2, u[7], m[18]);-	MONT_MAC(v0, v1, v2, u[8], m[17]);-	MONT_MAC(w0, w1, w2, u[9], m[16]);-	MONT_MAC(t0, t1, t2, u[10], m[15]);-	MONT_MAC(v0, v1, v2, u[11], m[14]);-	MONT_MAC(w0, w1, w2, u[12], m[13]);-	MONT_MAC(t0, t1, t2, u[13], m[12]);-	MONT_MAC(v0, v1, v2, u[14], m[11]);-	MONT_MAC(w0, w1, w2, u[15], m[10]);-	MONT_MAC(t0, t1, t2, u[16], m[9]);-	MONT_MAC(v0, v1, v2, u[17], m[8]);-	MONT_MAC(w0, w1, w2, u[18], m[7]);-	MONT_MAC(t0, t1, t2, u[19], m[6]);-	MONT_MAC(v0, v1, v2, u[20], m[5]);-	MONT_MAC(w0, w1, w2, u[21], m[4]);-	MONT_MAC(t0, t1, t2, u[22], m[3]);-	MONT_MAC(v0, v1, v2, u[23], m[2]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_ADD(t0, t1, t2, w0, w1, w2);-	z[1] = t0;-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 26 */-	MONT_MAC(t0, t1, t2, a[3], b[23]);-	MONT_MUL(v0, v1, v2, a[4], b[22]);-	MONT_MUL(w0, w1, w2, a[5], b[21]);-	MONT_MAC(t0, t1, t2, a[6], b[20]);-	MONT_MAC(v0, v1, v2, a[7], b[19]);-	MONT_MAC(w0, w1, w2, a[8], b[18]);-	MONT_MAC(t0, t1, t2, a[9], b[17]);-	MONT_MAC(v0, v1, v2, a[10], b[16]);-	MONT_MAC(w0, w1, w2, a[11], b[15]);-	MONT_MAC(t0, t1, t2, a[12], b[14]);-	MONT_MAC(v0, v1, v2, a[13], b[13]);-	MONT_MAC(w0, w1, w2, a[14], b[12]);-	MONT_MAC(t0, t1, t2, a[15], b[11]);-	MONT_MAC(v0, v1, v2, a[16], b[10]);-	MONT_MAC(w0, w1, w2, a[17], b[9]);-	MONT_MAC(t0, t1, t2, a[18], b[8]);-	MONT_MAC(v0, v1, v2, a[19], b[7]);-	MONT_MAC(w0, w1, w2, a[20], b[6]);-	MONT_MAC(t0, t1, t2, a[21], b[5]);-	MONT_MAC(v0, v1, v2, a[22], b[4]);-	MONT_MAC(w0, w1, w2, a[23], b[3]);-	MONT_MAC(t0, t1, t2, u[3], m[23]);-	MONT_MAC(v0, v1, v2, u[4], m[22]);-	MONT_MAC(w0, w1, w2, u[5], m[21]);-	MONT_MAC(t0, t1, t2, u[6], m[20]);-	MONT_MAC(v0, v1, v2, u[7], m[19]);-	MONT_MAC(w0, w1, w2, u[8], m[18]);-	MONT_MAC(t0, t1, t2, u[9], m[17]);-	MONT_MAC(v0, v1, v2, u[10], m[16]);-	MONT_MAC(w0, w1, w2, u[11], m[15]);-	MONT_MAC(t0, t1, t2, u[12], m[14]);-	MONT_MAC(v0, v1, v2, u[13], m[13]);-	MONT_MAC(w0, w1, w2, u[14], m[12]);-	MONT_MAC(t0, t1, t2, u[15], m[11]);-	MONT_MAC(v0, v1, v2, u[16], m[10]);-	MONT_MAC(w0, w1, w2, u[17], m[9]);-	MONT_MAC(t0, t1, t2, u[18], m[8]);-	MONT_MAC(v0, v1, v2, u[19], m[7]);-	MONT_MAC(w0, w1, w2, u[20], m[6]);-	MONT_MAC(t0, t1, t2, u[21], m[5]);-	MONT_MAC(v0, v1, v2, u[22], m[4]);-	MONT_MAC(w0, w1, w2, u[23], m[3]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_ADD(t0, t1, t2, w0, w1, w2);-	z[2] = t0;-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 27 */-	MONT_MAC(t0, t1, t2, a[4], b[23]);-	MONT_MUL(v0, v1, v2, a[5], b[22]);-	MONT_MUL(w0, w1, w2, a[6], b[21]);-	MONT_MAC(t0, t1, t2, a[7], b[20]);-	MONT_MAC(v0, v1, v2, a[8], b[19]);-	MONT_MAC(w0, w1, w2, a[9], b[18]);-	MONT_MAC(t0, t1, t2, a[10], b[17]);-	MONT_MAC(v0, v1, v2, a[11], b[16]);-	MONT_MAC(w0, w1, w2, a[12], b[15]);-	MONT_MAC(t0, t1, t2, a[13], b[14]);-	MONT_MAC(v0, v1, v2, a[14], b[13]);-	MONT_MAC(w0, w1, w2, a[15], b[12]);-	MONT_MAC(t0, t1, t2, a[16], b[11]);-	MONT_MAC(v0, v1, v2, a[17], b[10]);-	MONT_MAC(w0, w1, w2, a[18], b[9]);-	MONT_MAC(t0, t1, t2, a[19], b[8]);-	MONT_MAC(v0, v1, v2, a[20], b[7]);-	MONT_MAC(w0, w1, w2, a[21], b[6]);-	MONT_MAC(t0, t1, t2, a[22], b[5]);-	MONT_MAC(v0, v1, v2, a[23], b[4]);-	MONT_MAC(w0, w1, w2, u[4], m[23]);-	MONT_MAC(t0, t1, t2, u[5], m[22]);-	MONT_MAC(v0, v1, v2, u[6], m[21]);-	MONT_MAC(w0, w1, w2, u[7], m[20]);-	MONT_MAC(t0, t1, t2, u[8], m[19]);-	MONT_MAC(v0, v1, v2, u[9], m[18]);-	MONT_MAC(w0, w1, w2, u[10], m[17]);-	MONT_MAC(t0, t1, t2, u[11], m[16]);-	MONT_MAC(v0, v1, v2, u[12], m[15]);-	MONT_MAC(w0, w1, w2, u[13], m[14]);-	MONT_MAC(t0, t1, t2, u[14], m[13]);-	MONT_MAC(v0, v1, v2, u[15], m[12]);-	MONT_MAC(w0, w1, w2, u[16], m[11]);-	MONT_MAC(t0, t1, t2, u[17], m[10]);-	MONT_MAC(v0, v1, v2, u[18], m[9]);-	MONT_MAC(w0, w1, w2, u[19], m[8]);-	MONT_MAC(t0, t1, t2, u[20], m[7]);-	MONT_MAC(v0, v1, v2, u[21], m[6]);-	MONT_MAC(w0, w1, w2, u[22], m[5]);-	MONT_MAC(t0, t1, t2, u[23], m[4]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_ADD(t0, t1, t2, w0, w1, w2);-	z[3] = t0;-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 28 */-	MONT_MAC(t0, t1, t2, a[5], b[23]);-	MONT_MUL(v0, v1, v2, a[6], b[22]);-	MONT_MUL(w0, w1, w2, a[7], b[21]);-	MONT_MAC(t0, t1, t2, a[8], b[20]);-	MONT_MAC(v0, v1, v2, a[9], b[19]);-	MONT_MAC(w0, w1, w2, a[10], b[18]);-	MONT_MAC(t0, t1, t2, a[11], b[17]);-	MONT_MAC(v0, v1, v2, a[12], b[16]);-	MONT_MAC(w0, w1, w2, a[13], b[15]);-	MONT_MAC(t0, t1, t2, a[14], b[14]);-	MONT_MAC(v0, v1, v2, a[15], b[13]);-	MONT_MAC(w0, w1, w2, a[16], b[12]);-	MONT_MAC(t0, t1, t2, a[17], b[11]);-	MONT_MAC(v0, v1, v2, a[18], b[10]);-	MONT_MAC(w0, w1, w2, a[19], b[9]);-	MONT_MAC(t0, t1, t2, a[20], b[8]);-	MONT_MAC(v0, v1, v2, a[21], b[7]);-	MONT_MAC(w0, w1, w2, a[22], b[6]);-	MONT_MAC(t0, t1, t2, a[23], b[5]);-	MONT_MAC(v0, v1, v2, u[5], m[23]);-	MONT_MAC(w0, w1, w2, u[6], m[22]);-	MONT_MAC(t0, t1, t2, u[7], m[21]);-	MONT_MAC(v0, v1, v2, u[8], m[20]);-	MONT_MAC(w0, w1, w2, u[9], m[19]);-	MONT_MAC(t0, t1, t2, u[10], m[18]);-	MONT_MAC(v0, v1, v2, u[11], m[17]);-	MONT_MAC(w0, w1, w2, u[12], m[16]);-	MONT_MAC(t0, t1, t2, u[13], m[15]);-	MONT_MAC(v0, v1, v2, u[14], m[14]);-	MONT_MAC(w0, w1, w2, u[15], m[13]);-	MONT_MAC(t0, t1, t2, u[16], m[12]);-	MONT_MAC(v0, v1, v2, u[17], m[11]);-	MONT_MAC(w0, w1, w2, u[18], m[10]);-	MONT_MAC(t0, t1, t2, u[19], m[9]);-	MONT_MAC(v0, v1, v2, u[20], m[8]);-	MONT_MAC(w0, w1, w2, u[21], m[7]);-	MONT_MAC(t0, t1, t2, u[22], m[6]);-	MONT_MAC(v0, v1, v2, u[23], m[5]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_ADD(t0, t1, t2, w0, w1, w2);-	z[4] = t0;-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 29 */-	MONT_MAC(t0, t1, t2, a[6], b[23]);-	MONT_MUL(v0, v1, v2, a[7], b[22]);-	MONT_MUL(w0, w1, w2, a[8], b[21]);-	MONT_MAC(t0, t1, t2, a[9], b[20]);-	MONT_MAC(v0, v1, v2, a[10], b[19]);-	MONT_MAC(w0, w1, w2, a[11], b[18]);-	MONT_MAC(t0, t1, t2, a[12], b[17]);-	MONT_MAC(v0, v1, v2, a[13], b[16]);-	MONT_MAC(w0, w1, w2, a[14], b[15]);-	MONT_MAC(t0, t1, t2, a[15], b[14]);-	MONT_MAC(v0, v1, v2, a[16], b[13]);-	MONT_MAC(w0, w1, w2, a[17], b[12]);-	MONT_MAC(t0, t1, t2, a[18], b[11]);-	MONT_MAC(v0, v1, v2, a[19], b[10]);-	MONT_MAC(w0, w1, w2, a[20], b[9]);-	MONT_MAC(t0, t1, t2, a[21], b[8]);-	MONT_MAC(v0, v1, v2, a[22], b[7]);-	MONT_MAC(w0, w1, w2, a[23], b[6]);-	MONT_MAC(t0, t1, t2, u[6], m[23]);-	MONT_MAC(v0, v1, v2, u[7], m[22]);-	MONT_MAC(w0, w1, w2, u[8], m[21]);-	MONT_MAC(t0, t1, t2, u[9], m[20]);-	MONT_MAC(v0, v1, v2, u[10], m[19]);-	MONT_MAC(w0, w1, w2, u[11], m[18]);-	MONT_MAC(t0, t1, t2, u[12], m[17]);-	MONT_MAC(v0, v1, v2, u[13], m[16]);-	MONT_MAC(w0, w1, w2, u[14], m[15]);-	MONT_MAC(t0, t1, t2, u[15], m[14]);-	MONT_MAC(v0, v1, v2, u[16], m[13]);-	MONT_MAC(w0, w1, w2, u[17], m[12]);-	MONT_MAC(t0, t1, t2, u[18], m[11]);-	MONT_MAC(v0, v1, v2, u[19], m[10]);-	MONT_MAC(w0, w1, w2, u[20], m[9]);-	MONT_MAC(t0, t1, t2, u[21], m[8]);-	MONT_MAC(v0, v1, v2, u[22], m[7]);-	MONT_MAC(w0, w1, w2, u[23], m[6]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_ADD(t0, t1, t2, w0, w1, w2);-	z[5] = t0;-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 30 */-	MONT_MAC(t0, t1, t2, a[7], b[23]);-	MONT_MUL(v0, v1, v2, a[8], b[22]);-	MONT_MUL(w0, w1, w2, a[9], b[21]);-	MONT_MAC(t0, t1, t2, a[10], b[20]);-	MONT_MAC(v0, v1, v2, a[11], b[19]);-	MONT_MAC(w0, w1, w2, a[12], b[18]);-	MONT_MAC(t0, t1, t2, a[13], b[17]);-	MONT_MAC(v0, v1, v2, a[14], b[16]);-	MONT_MAC(w0, w1, w2, a[15], b[15]);-	MONT_MAC(t0, t1, t2, a[16], b[14]);-	MONT_MAC(v0, v1, v2, a[17], b[13]);-	MONT_MAC(w0, w1, w2, a[18], b[12]);-	MONT_MAC(t0, t1, t2, a[19], b[11]);-	MONT_MAC(v0, v1, v2, a[20], b[10]);-	MONT_MAC(w0, w1, w2, a[21], b[9]);-	MONT_MAC(t0, t1, t2, a[22], b[8]);-	MONT_MAC(v0, v1, v2, a[23], b[7]);-	MONT_MAC(w0, w1, w2, u[7], m[23]);-	MONT_MAC(t0, t1, t2, u[8], m[22]);-	MONT_MAC(v0, v1, v2, u[9], m[21]);-	MONT_MAC(w0, w1, w2, u[10], m[20]);-	MONT_MAC(t0, t1, t2, u[11], m[19]);-	MONT_MAC(v0, v1, v2, u[12], m[18]);-	MONT_MAC(w0, w1, w2, u[13], m[17]);-	MONT_MAC(t0, t1, t2, u[14], m[16]);-	MONT_MAC(v0, v1, v2, u[15], m[15]);-	MONT_MAC(w0, w1, w2, u[16], m[14]);-	MONT_MAC(t0, t1, t2, u[17], m[13]);-	MONT_MAC(v0, v1, v2, u[18], m[12]);-	MONT_MAC(w0, w1, w2, u[19], m[11]);-	MONT_MAC(t0, t1, t2, u[20], m[10]);-	MONT_MAC(v0, v1, v2, u[21], m[9]);-	MONT_MAC(w0, w1, w2, u[22], m[8]);-	MONT_MAC(t0, t1, t2, u[23], m[7]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_ADD(t0, t1, t2, w0, w1, w2);-	z[6] = t0;-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 31 */-	MONT_MAC(t0, t1, t2, a[8], b[23]);-	MONT_MUL(v0, v1, v2, a[9], b[22]);-	MONT_MUL(w0, w1, w2, a[10], b[21]);-	MONT_MAC(t0, t1, t2, a[11], b[20]);-	MONT_MAC(v0, v1, v2, a[12], b[19]);-	MONT_MAC(w0, w1, w2, a[13], b[18]);-	MONT_MAC(t0, t1, t2, a[14], b[17]);-	MONT_MAC(v0, v1, v2, a[15], b[16]);-	MONT_MAC(w0, w1, w2, a[16], b[15]);-	MONT_MAC(t0, t1, t2, a[17], b[14]);-	MONT_MAC(v0, v1, v2, a[18], b[13]);-	MONT_MAC(w0, w1, w2, a[19], b[12]);-	MONT_MAC(t0, t1, t2, a[20], b[11]);-	MONT_MAC(v0, v1, v2, a[21], b[10]);-	MONT_MAC(w0, w1, w2, a[22], b[9]);-	MONT_MAC(t0, t1, t2, a[23], b[8]);-	MONT_MAC(v0, v1, v2, u[8], m[23]);-	MONT_MAC(w0, w1, w2, u[9], m[22]);-	MONT_MAC(t0, t1, t2, u[10], m[21]);-	MONT_MAC(v0, v1, v2, u[11], m[20]);-	MONT_MAC(w0, w1, w2, u[12], m[19]);-	MONT_MAC(t0, t1, t2, u[13], m[18]);-	MONT_MAC(v0, v1, v2, u[14], m[17]);-	MONT_MAC(w0, w1, w2, u[15], m[16]);-	MONT_MAC(t0, t1, t2, u[16], m[15]);-	MONT_MAC(v0, v1, v2, u[17], m[14]);-	MONT_MAC(w0, w1, w2, u[18], m[13]);-	MONT_MAC(t0, t1, t2, u[19], m[12]);-	MONT_MAC(v0, v1, v2, u[20], m[11]);-	MONT_MAC(w0, w1, w2, u[21], m[10]);-	MONT_MAC(t0, t1, t2, u[22], m[9]);-	MONT_MAC(v0, v1, v2, u[23], m[8]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_ADD(t0, t1, t2, w0, w1, w2);-	z[7] = t0;-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 32 */-	MONT_MAC(t0, t1, t2, a[9], b[23]);-	MONT_MUL(v0, v1, v2, a[10], b[22]);-	MONT_MUL(w0, w1, w2, a[11], b[21]);-	MONT_MAC(t0, t1, t2, a[12], b[20]);-	MONT_MAC(v0, v1, v2, a[13], b[19]);-	MONT_MAC(w0, w1, w2, a[14], b[18]);-	MONT_MAC(t0, t1, t2, a[15], b[17]);-	MONT_MAC(v0, v1, v2, a[16], b[16]);-	MONT_MAC(w0, w1, w2, a[17], b[15]);-	MONT_MAC(t0, t1, t2, a[18], b[14]);-	MONT_MAC(v0, v1, v2, a[19], b[13]);-	MONT_MAC(w0, w1, w2, a[20], b[12]);-	MONT_MAC(t0, t1, t2, a[21], b[11]);-	MONT_MAC(v0, v1, v2, a[22], b[10]);-	MONT_MAC(w0, w1, w2, a[23], b[9]);-	MONT_MAC(t0, t1, t2, u[9], m[23]);-	MONT_MAC(v0, v1, v2, u[10], m[22]);-	MONT_MAC(w0, w1, w2, u[11], m[21]);-	MONT_MAC(t0, t1, t2, u[12], m[20]);-	MONT_MAC(v0, v1, v2, u[13], m[19]);-	MONT_MAC(w0, w1, w2, u[14], m[18]);-	MONT_MAC(t0, t1, t2, u[15], m[17]);-	MONT_MAC(v0, v1, v2, u[16], m[16]);-	MONT_MAC(w0, w1, w2, u[17], m[15]);-	MONT_MAC(t0, t1, t2, u[18], m[14]);-	MONT_MAC(v0, v1, v2, u[19], m[13]);-	MONT_MAC(w0, w1, w2, u[20], m[12]);-	MONT_MAC(t0, t1, t2, u[21], m[11]);-	MONT_MAC(v0, v1, v2, u[22], m[10]);-	MONT_MAC(w0, w1, w2, u[23], m[9]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_ADD(t0, t1, t2, w0, w1, w2);-	z[8] = t0;-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 33 */-	MONT_MAC(t0, t1, t2, a[10], b[23]);-	MONT_MUL(v0, v1, v2, a[11], b[22]);-	MONT_MUL(w0, w1, w2, a[12], b[21]);-	MONT_MAC(t0, t1, t2, a[13], b[20]);-	MONT_MAC(v0, v1, v2, a[14], b[19]);-	MONT_MAC(w0, w1, w2, a[15], b[18]);-	MONT_MAC(t0, t1, t2, a[16], b[17]);-	MONT_MAC(v0, v1, v2, a[17], b[16]);-	MONT_MAC(w0, w1, w2, a[18], b[15]);-	MONT_MAC(t0, t1, t2, a[19], b[14]);-	MONT_MAC(v0, v1, v2, a[20], b[13]);-	MONT_MAC(w0, w1, w2, a[21], b[12]);-	MONT_MAC(t0, t1, t2, a[22], b[11]);-	MONT_MAC(v0, v1, v2, a[23], b[10]);-	MONT_MAC(w0, w1, w2, u[10], m[23]);-	MONT_MAC(t0, t1, t2, u[11], m[22]);-	MONT_MAC(v0, v1, v2, u[12], m[21]);-	MONT_MAC(w0, w1, w2, u[13], m[20]);-	MONT_MAC(t0, t1, t2, u[14], m[19]);-	MONT_MAC(v0, v1, v2, u[15], m[18]);-	MONT_MAC(w0, w1, w2, u[16], m[17]);-	MONT_MAC(t0, t1, t2, u[17], m[16]);-	MONT_MAC(v0, v1, v2, u[18], m[15]);-	MONT_MAC(w0, w1, w2, u[19], m[14]);-	MONT_MAC(t0, t1, t2, u[20], m[13]);-	MONT_MAC(v0, v1, v2, u[21], m[12]);-	MONT_MAC(w0, w1, w2, u[22], m[11]);-	MONT_MAC(t0, t1, t2, u[23], m[10]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_ADD(t0, t1, t2, w0, w1, w2);-	z[9] = t0;-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 34 */-	MONT_MAC(t0, t1, t2, a[11], b[23]);-	MONT_MUL(v0, v1, v2, a[12], b[22]);-	MONT_MUL(w0, w1, w2, a[13], b[21]);-	MONT_MAC(t0, t1, t2, a[14], b[20]);-	MONT_MAC(v0, v1, v2, a[15], b[19]);-	MONT_MAC(w0, w1, w2, a[16], b[18]);-	MONT_MAC(t0, t1, t2, a[17], b[17]);-	MONT_MAC(v0, v1, v2, a[18], b[16]);-	MONT_MAC(w0, w1, w2, a[19], b[15]);-	MONT_MAC(t0, t1, t2, a[20], b[14]);-	MONT_MAC(v0, v1, v2, a[21], b[13]);-	MONT_MAC(w0, w1, w2, a[22], b[12]);-	MONT_MAC(t0, t1, t2, a[23], b[11]);-	MONT_MAC(v0, v1, v2, u[11], m[23]);-	MONT_MAC(w0, w1, w2, u[12], m[22]);-	MONT_MAC(t0, t1, t2, u[13], m[21]);-	MONT_MAC(v0, v1, v2, u[14], m[20]);-	MONT_MAC(w0, w1, w2, u[15], m[19]);-	MONT_MAC(t0, t1, t2, u[16], m[18]);-	MONT_MAC(v0, v1, v2, u[17], m[17]);-	MONT_MAC(w0, w1, w2, u[18], m[16]);-	MONT_MAC(t0, t1, t2, u[19], m[15]);-	MONT_MAC(v0, v1, v2, u[20], m[14]);-	MONT_MAC(w0, w1, w2, u[21], m[13]);-	MONT_MAC(t0, t1, t2, u[22], m[12]);-	MONT_MAC(v0, v1, v2, u[23], m[11]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_ADD(t0, t1, t2, w0, w1, w2);-	z[10] = t0;-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 35 */-	MONT_MAC(t0, t1, t2, a[12], b[23]);-	MONT_MUL(v0, v1, v2, a[13], b[22]);-	MONT_MUL(w0, w1, w2, a[14], b[21]);-	MONT_MAC(t0, t1, t2, a[15], b[20]);-	MONT_MAC(v0, v1, v2, a[16], b[19]);-	MONT_MAC(w0, w1, w2, a[17], b[18]);-	MONT_MAC(t0, t1, t2, a[18], b[17]);-	MONT_MAC(v0, v1, v2, a[19], b[16]);-	MONT_MAC(w0, w1, w2, a[20], b[15]);-	MONT_MAC(t0, t1, t2, a[21], b[14]);-	MONT_MAC(v0, v1, v2, a[22], b[13]);-	MONT_MAC(w0, w1, w2, a[23], b[12]);-	MONT_MAC(t0, t1, t2, u[12], m[23]);-	MONT_MAC(v0, v1, v2, u[13], m[22]);-	MONT_MAC(w0, w1, w2, u[14], m[21]);-	MONT_MAC(t0, t1, t2, u[15], m[20]);-	MONT_MAC(v0, v1, v2, u[16], m[19]);-	MONT_MAC(w0, w1, w2, u[17], m[18]);-	MONT_MAC(t0, t1, t2, u[18], m[17]);-	MONT_MAC(v0, v1, v2, u[19], m[16]);-	MONT_MAC(w0, w1, w2, u[20], m[15]);-	MONT_MAC(t0, t1, t2, u[21], m[14]);-	MONT_MAC(v0, v1, v2, u[22], m[13]);-	MONT_MAC(w0, w1, w2, u[23], m[12]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_ADD(t0, t1, t2, w0, w1, w2);-	z[11] = t0;-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 36 */-	MONT_MAC(t0, t1, t2, a[13], b[23]);-	MONT_MUL(v0, v1, v2, a[14], b[22]);-	MONT_MUL(w0, w1, w2, a[15], b[21]);-	MONT_MAC(t0, t1, t2, a[16], b[20]);-	MONT_MAC(v0, v1, v2, a[17], b[19]);-	MONT_MAC(w0, w1, w2, a[18], b[18]);-	MONT_MAC(t0, t1, t2, a[19], b[17]);-	MONT_MAC(v0, v1, v2, a[20], b[16]);-	MONT_MAC(w0, w1, w2, a[21], b[15]);-	MONT_MAC(t0, t1, t2, a[22], b[14]);-	MONT_MAC(v0, v1, v2, a[23], b[13]);-	MONT_MAC(w0, w1, w2, u[13], m[23]);-	MONT_MAC(t0, t1, t2, u[14], m[22]);-	MONT_MAC(v0, v1, v2, u[15], m[21]);-	MONT_MAC(w0, w1, w2, u[16], m[20]);-	MONT_MAC(t0, t1, t2, u[17], m[19]);-	MONT_MAC(v0, v1, v2, u[18], m[18]);-	MONT_MAC(w0, w1, w2, u[19], m[17]);-	MONT_MAC(t0, t1, t2, u[20], m[16]);-	MONT_MAC(v0, v1, v2, u[21], m[15]);-	MONT_MAC(w0, w1, w2, u[22], m[14]);-	MONT_MAC(t0, t1, t2, u[23], m[13]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_ADD(t0, t1, t2, w0, w1, w2);-	z[12] = t0;-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 37 */-	MONT_MAC(t0, t1, t2, a[14], b[23]);-	MONT_MUL(v0, v1, v2, a[15], b[22]);-	MONT_MUL(w0, w1, w2, a[16], b[21]);-	MONT_MAC(t0, t1, t2, a[17], b[20]);-	MONT_MAC(v0, v1, v2, a[18], b[19]);-	MONT_MAC(w0, w1, w2, a[19], b[18]);-	MONT_MAC(t0, t1, t2, a[20], b[17]);-	MONT_MAC(v0, v1, v2, a[21], b[16]);-	MONT_MAC(w0, w1, w2, a[22], b[15]);-	MONT_MAC(t0, t1, t2, a[23], b[14]);-	MONT_MAC(v0, v1, v2, u[14], m[23]);-	MONT_MAC(w0, w1, w2, u[15], m[22]);-	MONT_MAC(t0, t1, t2, u[16], m[21]);-	MONT_MAC(v0, v1, v2, u[17], m[20]);-	MONT_MAC(w0, w1, w2, u[18], m[19]);-	MONT_MAC(t0, t1, t2, u[19], m[18]);-	MONT_MAC(v0, v1, v2, u[20], m[17]);-	MONT_MAC(w0, w1, w2, u[21], m[16]);-	MONT_MAC(t0, t1, t2, u[22], m[15]);-	MONT_MAC(v0, v1, v2, u[23], m[14]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_ADD(t0, t1, t2, w0, w1, w2);-	z[13] = t0;-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 38 */-	MONT_MAC(t0, t1, t2, a[15], b[23]);-	MONT_MUL(v0, v1, v2, a[16], b[22]);-	MONT_MUL(w0, w1, w2, a[17], b[21]);-	MONT_MAC(t0, t1, t2, a[18], b[20]);-	MONT_MAC(v0, v1, v2, a[19], b[19]);-	MONT_MAC(w0, w1, w2, a[20], b[18]);-	MONT_MAC(t0, t1, t2, a[21], b[17]);-	MONT_MAC(v0, v1, v2, a[22], b[16]);-	MONT_MAC(w0, w1, w2, a[23], b[15]);-	MONT_MAC(t0, t1, t2, u[15], m[23]);-	MONT_MAC(v0, v1, v2, u[16], m[22]);-	MONT_MAC(w0, w1, w2, u[17], m[21]);-	MONT_MAC(t0, t1, t2, u[18], m[20]);-	MONT_MAC(v0, v1, v2, u[19], m[19]);-	MONT_MAC(w0, w1, w2, u[20], m[18]);-	MONT_MAC(t0, t1, t2, u[21], m[17]);-	MONT_MAC(v0, v1, v2, u[22], m[16]);-	MONT_MAC(w0, w1, w2, u[23], m[15]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_ADD(t0, t1, t2, w0, w1, w2);-	z[14] = t0;-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 39 */-	MONT_MAC(t0, t1, t2, a[16], b[23]);-	MONT_MUL(v0, v1, v2, a[17], b[22]);-	MONT_MUL(w0, w1, w2, a[18], b[21]);-	MONT_MAC(t0, t1, t2, a[19], b[20]);-	MONT_MAC(v0, v1, v2, a[20], b[19]);-	MONT_MAC(w0, w1, w2, a[21], b[18]);-	MONT_MAC(t0, t1, t2, a[22], b[17]);-	MONT_MAC(v0, v1, v2, a[23], b[16]);-	MONT_MAC(w0, w1, w2, u[16], m[23]);-	MONT_MAC(t0, t1, t2, u[17], m[22]);-	MONT_MAC(v0, v1, v2, u[18], m[21]);-	MONT_MAC(w0, w1, w2, u[19], m[20]);-	MONT_MAC(t0, t1, t2, u[20], m[19]);-	MONT_MAC(v0, v1, v2, u[21], m[18]);-	MONT_MAC(w0, w1, w2, u[22], m[17]);-	MONT_MAC(t0, t1, t2, u[23], m[16]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_ADD(t0, t1, t2, w0, w1, w2);-	z[15] = t0;-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 40 */-	MONT_MAC(t0, t1, t2, a[17], b[23]);-	MONT_MUL(v0, v1, v2, a[18], b[22]);-	MONT_MUL(w0, w1, w2, a[19], b[21]);-	MONT_MAC(t0, t1, t2, a[20], b[20]);-	MONT_MAC(v0, v1, v2, a[21], b[19]);-	MONT_MAC(w0, w1, w2, a[22], b[18]);-	MONT_MAC(t0, t1, t2, a[23], b[17]);-	MONT_MAC(v0, v1, v2, u[17], m[23]);-	MONT_MAC(w0, w1, w2, u[18], m[22]);-	MONT_MAC(t0, t1, t2, u[19], m[21]);-	MONT_MAC(v0, v1, v2, u[20], m[20]);-	MONT_MAC(w0, w1, w2, u[21], m[19]);-	MONT_MAC(t0, t1, t2, u[22], m[18]);-	MONT_MAC(v0, v1, v2, u[23], m[17]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_ADD(t0, t1, t2, w0, w1, w2);-	z[16] = t0;-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 41 */-	MONT_MAC(t0, t1, t2, a[18], b[23]);-	MONT_MUL(v0, v1, v2, a[19], b[22]);-	MONT_MUL(w0, w1, w2, a[20], b[21]);-	MONT_MAC(t0, t1, t2, a[21], b[20]);-	MONT_MAC(v0, v1, v2, a[22], b[19]);-	MONT_MAC(w0, w1, w2, a[23], b[18]);-	MONT_MAC(t0, t1, t2, u[18], m[23]);-	MONT_MAC(v0, v1, v2, u[19], m[22]);-	MONT_MAC(w0, w1, w2, u[20], m[21]);-	MONT_MAC(t0, t1, t2, u[21], m[20]);-	MONT_MAC(v0, v1, v2, u[22], m[19]);-	MONT_MAC(w0, w1, w2, u[23], m[18]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_ADD(t0, t1, t2, w0, w1, w2);-	z[17] = t0;-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 42 */-	MONT_MAC(t0, t1, t2, a[19], b[23]);-	MONT_MUL(v0, v1, v2, a[20], b[22]);-	MONT_MUL(w0, w1, w2, a[21], b[21]);-	MONT_MAC(t0, t1, t2, a[22], b[20]);-	MONT_MAC(v0, v1, v2, a[23], b[19]);-	MONT_MAC(w0, w1, w2, u[19], m[23]);-	MONT_MAC(t0, t1, t2, u[20], m[22]);-	MONT_MAC(v0, v1, v2, u[21], m[21]);-	MONT_MAC(w0, w1, w2, u[22], m[20]);-	MONT_MAC(t0, t1, t2, u[23], m[19]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_ADD(t0, t1, t2, w0, w1, w2);-	z[18] = t0;-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 43 */-	MONT_MAC(t0, t1, t2, a[20], b[23]);-	MONT_MUL(v0, v1, v2, a[21], b[22]);-	MONT_MUL(w0, w1, w2, a[22], b[21]);-	MONT_MAC(t0, t1, t2, a[23], b[20]);-	MONT_MAC(v0, v1, v2, u[20], m[23]);-	MONT_MAC(w0, w1, w2, u[21], m[22]);-	MONT_MAC(t0, t1, t2, u[22], m[21]);-	MONT_MAC(v0, v1, v2, u[23], m[20]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_ADD(t0, t1, t2, w0, w1, w2);-	z[19] = t0;-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 44 */-	MONT_MAC(t0, t1, t2, a[21], b[23]);-	MONT_MUL(v0, v1, v2, a[22], b[22]);-	MONT_MUL(w0, w1, w2, a[23], b[21]);-	MONT_MAC(t0, t1, t2, u[21], m[23]);-	MONT_MAC(v0, v1, v2, u[22], m[22]);-	MONT_MAC(w0, w1, w2, u[23], m[21]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_ADD(t0, t1, t2, w0, w1, w2);-	z[20] = t0;-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 45 */-	MONT_MAC(t0, t1, t2, a[22], b[23]);-	MONT_MUL(v0, v1, v2, a[23], b[22]);-	MONT_MUL(w0, w1, w2, u[22], m[23]);-	MONT_MAC(t0, t1, t2, u[23], m[22]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_ADD(t0, t1, t2, w0, w1, w2);-	z[21] = t0;-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 46 */-	MONT_MAC(t0, t1, t2, a[23], b[23]);-	MONT_MUL(v0, v1, v2, u[23], m[23]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	z[22] = t0;-	t0 = t1;-	t1 = t2;-	t2 = 0;-	z[23] = t0;--	/* under 2m, with t1 the bit above n limbs: at most one subtraction */-	borrow = sub_n(r, z, m, 24);-	take = t1 | (borrow ^ 1);-	select_n(r, r, z, take & 1, 24);-}--/* r = a * a * R^-1 mod m, for a under m; t is 2n limbs of scratch */-static void crypton_mont_sqr24(limb_t *r, const limb_t *a,-                               const limb_t *m, limb_t n0, limb_t *t)-{-	limb_t *u = t, *z = t + 24;-	limb_t t0 = 0, t1 = 0, t2 = 0, v0, v1, v2, w0, w1, w2, borrow, take;-	limb_t s0, s1, s2, c0, c1, c2;--	/* column 0 */-	MONT_MAC(t0, t1, t2, a[0], a[0]);-	u[0] = t0 * n0;-	MONT_MAC(t0, t1, t2, u[0], m[0]);-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 1 */-	MONT_MUL(s0, s1, s2, a[0], a[1]);-	MONT_MAC(t0, t1, t2, u[0], m[1]);-	MONT_DBL(s0, s1, s2);-	MONT_ADD(t0, t1, t2, s0, s1, s2);-	u[1] = t0 * n0;-	MONT_MAC(t0, t1, t2, u[1], m[0]);-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 2 */-	MONT_MUL(s0, s1, s2, a[0], a[2]);-	MONT_MAC(t0, t1, t2, a[1], a[1]);-	MONT_MUL(v0, v1, v2, u[0], m[2]);-	MONT_MUL(w0, w1, w2, u[1], m[1]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_ADD(t0, t1, t2, w0, w1, w2);-	MONT_DBL(s0, s1, s2);-	MONT_ADD(t0, t1, t2, s0, s1, s2);-	u[2] = t0 * n0;-	MONT_MAC(t0, t1, t2, u[2], m[0]);-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 3 */-	MONT_MUL(s0, s1, s2, a[0], a[3]);-	MONT_MUL(c0, c1, c2, a[1], a[2]);-	MONT_MAC(t0, t1, t2, u[0], m[3]);-	MONT_MUL(v0, v1, v2, u[1], m[2]);-	MONT_MUL(w0, w1, w2, u[2], m[1]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_ADD(t0, t1, t2, w0, w1, w2);-	MONT_ADD(s0, s1, s2, c0, c1, c2);-	MONT_DBL(s0, s1, s2);-	MONT_ADD(t0, t1, t2, s0, s1, s2);-	u[3] = t0 * n0;-	MONT_MAC(t0, t1, t2, u[3], m[0]);-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 4 */-	MONT_MUL(s0, s1, s2, a[0], a[4]);-	MONT_MUL(c0, c1, c2, a[1], a[3]);-	MONT_MAC(t0, t1, t2, a[2], a[2]);-	MONT_MUL(v0, v1, v2, u[0], m[4]);-	MONT_MUL(w0, w1, w2, u[1], m[3]);-	MONT_MAC(t0, t1, t2, u[2], m[2]);-	MONT_MAC(v0, v1, v2, u[3], m[1]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_ADD(t0, t1, t2, w0, w1, w2);-	MONT_ADD(s0, s1, s2, c0, c1, c2);-	MONT_DBL(s0, s1, s2);-	MONT_ADD(t0, t1, t2, s0, s1, s2);-	u[4] = t0 * n0;-	MONT_MAC(t0, t1, t2, u[4], m[0]);-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 5 */-	MONT_MUL(s0, s1, s2, a[0], a[5]);-	MONT_MUL(c0, c1, c2, a[1], a[4]);-	MONT_MAC(s0, s1, s2, a[2], a[3]);-	MONT_MAC(t0, t1, t2, u[0], m[5]);-	MONT_MUL(v0, v1, v2, u[1], m[4]);-	MONT_MUL(w0, w1, w2, u[2], m[3]);-	MONT_MAC(t0, t1, t2, u[3], m[2]);-	MONT_MAC(v0, v1, v2, u[4], m[1]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_ADD(t0, t1, t2, w0, w1, w2);-	MONT_ADD(s0, s1, s2, c0, c1, c2);-	MONT_DBL(s0, s1, s2);-	MONT_ADD(t0, t1, t2, s0, s1, s2);-	u[5] = t0 * n0;-	MONT_MAC(t0, t1, t2, u[5], m[0]);-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 6 */-	MONT_MUL(s0, s1, s2, a[0], a[6]);-	MONT_MUL(c0, c1, c2, a[1], a[5]);-	MONT_MAC(s0, s1, s2, a[2], a[4]);-	MONT_MAC(t0, t1, t2, a[3], a[3]);-	MONT_MUL(v0, v1, v2, u[0], m[6]);-	MONT_MUL(w0, w1, w2, u[1], m[5]);-	MONT_MAC(t0, t1, t2, u[2], m[4]);-	MONT_MAC(v0, v1, v2, u[3], m[3]);-	MONT_MAC(w0, w1, w2, u[4], m[2]);-	MONT_MAC(t0, t1, t2, u[5], m[1]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_ADD(t0, t1, t2, w0, w1, w2);-	MONT_ADD(s0, s1, s2, c0, c1, c2);-	MONT_DBL(s0, s1, s2);-	MONT_ADD(t0, t1, t2, s0, s1, s2);-	u[6] = t0 * n0;-	MONT_MAC(t0, t1, t2, u[6], m[0]);-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 7 */-	MONT_MUL(s0, s1, s2, a[0], a[7]);-	MONT_MUL(c0, c1, c2, a[1], a[6]);-	MONT_MAC(s0, s1, s2, a[2], a[5]);-	MONT_MAC(c0, c1, c2, a[3], a[4]);-	MONT_MAC(t0, t1, t2, u[0], m[7]);-	MONT_MUL(v0, v1, v2, u[1], m[6]);-	MONT_MUL(w0, w1, w2, u[2], m[5]);-	MONT_MAC(t0, t1, t2, u[3], m[4]);-	MONT_MAC(v0, v1, v2, u[4], m[3]);-	MONT_MAC(w0, w1, w2, u[5], m[2]);-	MONT_MAC(t0, t1, t2, u[6], m[1]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_ADD(t0, t1, t2, w0, w1, w2);-	MONT_ADD(s0, s1, s2, c0, c1, c2);-	MONT_DBL(s0, s1, s2);-	MONT_ADD(t0, t1, t2, s0, s1, s2);-	u[7] = t0 * n0;-	MONT_MAC(t0, t1, t2, u[7], m[0]);-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 8 */-	MONT_MUL(s0, s1, s2, a[0], a[8]);-	MONT_MUL(c0, c1, c2, a[1], a[7]);-	MONT_MAC(s0, s1, s2, a[2], a[6]);-	MONT_MAC(c0, c1, c2, a[3], a[5]);-	MONT_MAC(t0, t1, t2, a[4], a[4]);-	MONT_MUL(v0, v1, v2, u[0], m[8]);-	MONT_MUL(w0, w1, w2, u[1], m[7]);-	MONT_MAC(t0, t1, t2, u[2], m[6]);-	MONT_MAC(v0, v1, v2, u[3], m[5]);-	MONT_MAC(w0, w1, w2, u[4], m[4]);-	MONT_MAC(t0, t1, t2, u[5], m[3]);-	MONT_MAC(v0, v1, v2, u[6], m[2]);-	MONT_MAC(w0, w1, w2, u[7], m[1]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_ADD(t0, t1, t2, w0, w1, w2);-	MONT_ADD(s0, s1, s2, c0, c1, c2);-	MONT_DBL(s0, s1, s2);-	MONT_ADD(t0, t1, t2, s0, s1, s2);-	u[8] = t0 * n0;-	MONT_MAC(t0, t1, t2, u[8], m[0]);-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 9 */-	MONT_MUL(s0, s1, s2, a[0], a[9]);-	MONT_MUL(c0, c1, c2, a[1], a[8]);-	MONT_MAC(s0, s1, s2, a[2], a[7]);-	MONT_MAC(c0, c1, c2, a[3], a[6]);-	MONT_MAC(s0, s1, s2, a[4], a[5]);-	MONT_MAC(t0, t1, t2, u[0], m[9]);-	MONT_MUL(v0, v1, v2, u[1], m[8]);-	MONT_MUL(w0, w1, w2, u[2], m[7]);-	MONT_MAC(t0, t1, t2, u[3], m[6]);-	MONT_MAC(v0, v1, v2, u[4], m[5]);-	MONT_MAC(w0, w1, w2, u[5], m[4]);-	MONT_MAC(t0, t1, t2, u[6], m[3]);-	MONT_MAC(v0, v1, v2, u[7], m[2]);-	MONT_MAC(w0, w1, w2, u[8], m[1]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_ADD(t0, t1, t2, w0, w1, w2);-	MONT_ADD(s0, s1, s2, c0, c1, c2);-	MONT_DBL(s0, s1, s2);-	MONT_ADD(t0, t1, t2, s0, s1, s2);-	u[9] = t0 * n0;-	MONT_MAC(t0, t1, t2, u[9], m[0]);-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 10 */-	MONT_MUL(s0, s1, s2, a[0], a[10]);-	MONT_MUL(c0, c1, c2, a[1], a[9]);-	MONT_MAC(s0, s1, s2, a[2], a[8]);-	MONT_MAC(c0, c1, c2, a[3], a[7]);-	MONT_MAC(s0, s1, s2, a[4], a[6]);-	MONT_MAC(t0, t1, t2, a[5], a[5]);-	MONT_MUL(v0, v1, v2, u[0], m[10]);-	MONT_MUL(w0, w1, w2, u[1], m[9]);-	MONT_MAC(t0, t1, t2, u[2], m[8]);-	MONT_MAC(v0, v1, v2, u[3], m[7]);-	MONT_MAC(w0, w1, w2, u[4], m[6]);-	MONT_MAC(t0, t1, t2, u[5], m[5]);-	MONT_MAC(v0, v1, v2, u[6], m[4]);-	MONT_MAC(w0, w1, w2, u[7], m[3]);-	MONT_MAC(t0, t1, t2, u[8], m[2]);-	MONT_MAC(v0, v1, v2, u[9], m[1]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_ADD(t0, t1, t2, w0, w1, w2);-	MONT_ADD(s0, s1, s2, c0, c1, c2);-	MONT_DBL(s0, s1, s2);-	MONT_ADD(t0, t1, t2, s0, s1, s2);-	u[10] = t0 * n0;-	MONT_MAC(t0, t1, t2, u[10], m[0]);-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 11 */-	MONT_MUL(s0, s1, s2, a[0], a[11]);-	MONT_MUL(c0, c1, c2, a[1], a[10]);-	MONT_MAC(s0, s1, s2, a[2], a[9]);-	MONT_MAC(c0, c1, c2, a[3], a[8]);-	MONT_MAC(s0, s1, s2, a[4], a[7]);-	MONT_MAC(c0, c1, c2, a[5], a[6]);-	MONT_MAC(t0, t1, t2, u[0], m[11]);-	MONT_MUL(v0, v1, v2, u[1], m[10]);-	MONT_MUL(w0, w1, w2, u[2], m[9]);-	MONT_MAC(t0, t1, t2, u[3], m[8]);-	MONT_MAC(v0, v1, v2, u[4], m[7]);-	MONT_MAC(w0, w1, w2, u[5], m[6]);-	MONT_MAC(t0, t1, t2, u[6], m[5]);-	MONT_MAC(v0, v1, v2, u[7], m[4]);-	MONT_MAC(w0, w1, w2, u[8], m[3]);-	MONT_MAC(t0, t1, t2, u[9], m[2]);-	MONT_MAC(v0, v1, v2, u[10], m[1]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_ADD(t0, t1, t2, w0, w1, w2);-	MONT_ADD(s0, s1, s2, c0, c1, c2);-	MONT_DBL(s0, s1, s2);-	MONT_ADD(t0, t1, t2, s0, s1, s2);-	u[11] = t0 * n0;-	MONT_MAC(t0, t1, t2, u[11], m[0]);-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 12 */-	MONT_MUL(s0, s1, s2, a[0], a[12]);-	MONT_MUL(c0, c1, c2, a[1], a[11]);-	MONT_MAC(s0, s1, s2, a[2], a[10]);-	MONT_MAC(c0, c1, c2, a[3], a[9]);-	MONT_MAC(s0, s1, s2, a[4], a[8]);-	MONT_MAC(c0, c1, c2, a[5], a[7]);-	MONT_MAC(t0, t1, t2, a[6], a[6]);-	MONT_MUL(v0, v1, v2, u[0], m[12]);-	MONT_MUL(w0, w1, w2, u[1], m[11]);-	MONT_MAC(t0, t1, t2, u[2], m[10]);-	MONT_MAC(v0, v1, v2, u[3], m[9]);-	MONT_MAC(w0, w1, w2, u[4], m[8]);-	MONT_MAC(t0, t1, t2, u[5], m[7]);-	MONT_MAC(v0, v1, v2, u[6], m[6]);-	MONT_MAC(w0, w1, w2, u[7], m[5]);-	MONT_MAC(t0, t1, t2, u[8], m[4]);-	MONT_MAC(v0, v1, v2, u[9], m[3]);-	MONT_MAC(w0, w1, w2, u[10], m[2]);-	MONT_MAC(t0, t1, t2, u[11], m[1]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_ADD(t0, t1, t2, w0, w1, w2);-	MONT_ADD(s0, s1, s2, c0, c1, c2);-	MONT_DBL(s0, s1, s2);-	MONT_ADD(t0, t1, t2, s0, s1, s2);-	u[12] = t0 * n0;-	MONT_MAC(t0, t1, t2, u[12], m[0]);-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 13 */-	MONT_MUL(s0, s1, s2, a[0], a[13]);-	MONT_MUL(c0, c1, c2, a[1], a[12]);-	MONT_MAC(s0, s1, s2, a[2], a[11]);-	MONT_MAC(c0, c1, c2, a[3], a[10]);-	MONT_MAC(s0, s1, s2, a[4], a[9]);-	MONT_MAC(c0, c1, c2, a[5], a[8]);-	MONT_MAC(s0, s1, s2, a[6], a[7]);-	MONT_MAC(t0, t1, t2, u[0], m[13]);-	MONT_MUL(v0, v1, v2, u[1], m[12]);-	MONT_MUL(w0, w1, w2, u[2], m[11]);-	MONT_MAC(t0, t1, t2, u[3], m[10]);-	MONT_MAC(v0, v1, v2, u[4], m[9]);-	MONT_MAC(w0, w1, w2, u[5], m[8]);-	MONT_MAC(t0, t1, t2, u[6], m[7]);-	MONT_MAC(v0, v1, v2, u[7], m[6]);-	MONT_MAC(w0, w1, w2, u[8], m[5]);-	MONT_MAC(t0, t1, t2, u[9], m[4]);-	MONT_MAC(v0, v1, v2, u[10], m[3]);-	MONT_MAC(w0, w1, w2, u[11], m[2]);-	MONT_MAC(t0, t1, t2, u[12], m[1]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_ADD(t0, t1, t2, w0, w1, w2);-	MONT_ADD(s0, s1, s2, c0, c1, c2);-	MONT_DBL(s0, s1, s2);-	MONT_ADD(t0, t1, t2, s0, s1, s2);-	u[13] = t0 * n0;-	MONT_MAC(t0, t1, t2, u[13], m[0]);-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 14 */-	MONT_MUL(s0, s1, s2, a[0], a[14]);-	MONT_MUL(c0, c1, c2, a[1], a[13]);-	MONT_MAC(s0, s1, s2, a[2], a[12]);-	MONT_MAC(c0, c1, c2, a[3], a[11]);-	MONT_MAC(s0, s1, s2, a[4], a[10]);-	MONT_MAC(c0, c1, c2, a[5], a[9]);-	MONT_MAC(s0, s1, s2, a[6], a[8]);-	MONT_MAC(t0, t1, t2, a[7], a[7]);-	MONT_MUL(v0, v1, v2, u[0], m[14]);-	MONT_MUL(w0, w1, w2, u[1], m[13]);-	MONT_MAC(t0, t1, t2, u[2], m[12]);-	MONT_MAC(v0, v1, v2, u[3], m[11]);-	MONT_MAC(w0, w1, w2, u[4], m[10]);-	MONT_MAC(t0, t1, t2, u[5], m[9]);-	MONT_MAC(v0, v1, v2, u[6], m[8]);-	MONT_MAC(w0, w1, w2, u[7], m[7]);-	MONT_MAC(t0, t1, t2, u[8], m[6]);-	MONT_MAC(v0, v1, v2, u[9], m[5]);-	MONT_MAC(w0, w1, w2, u[10], m[4]);-	MONT_MAC(t0, t1, t2, u[11], m[3]);-	MONT_MAC(v0, v1, v2, u[12], m[2]);-	MONT_MAC(w0, w1, w2, u[13], m[1]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_ADD(t0, t1, t2, w0, w1, w2);-	MONT_ADD(s0, s1, s2, c0, c1, c2);-	MONT_DBL(s0, s1, s2);-	MONT_ADD(t0, t1, t2, s0, s1, s2);-	u[14] = t0 * n0;-	MONT_MAC(t0, t1, t2, u[14], m[0]);-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 15 */-	MONT_MUL(s0, s1, s2, a[0], a[15]);-	MONT_MUL(c0, c1, c2, a[1], a[14]);-	MONT_MAC(s0, s1, s2, a[2], a[13]);-	MONT_MAC(c0, c1, c2, a[3], a[12]);-	MONT_MAC(s0, s1, s2, a[4], a[11]);-	MONT_MAC(c0, c1, c2, a[5], a[10]);-	MONT_MAC(s0, s1, s2, a[6], a[9]);-	MONT_MAC(c0, c1, c2, a[7], a[8]);-	MONT_MAC(t0, t1, t2, u[0], m[15]);-	MONT_MUL(v0, v1, v2, u[1], m[14]);-	MONT_MUL(w0, w1, w2, u[2], m[13]);-	MONT_MAC(t0, t1, t2, u[3], m[12]);-	MONT_MAC(v0, v1, v2, u[4], m[11]);-	MONT_MAC(w0, w1, w2, u[5], m[10]);-	MONT_MAC(t0, t1, t2, u[6], m[9]);-	MONT_MAC(v0, v1, v2, u[7], m[8]);-	MONT_MAC(w0, w1, w2, u[8], m[7]);-	MONT_MAC(t0, t1, t2, u[9], m[6]);-	MONT_MAC(v0, v1, v2, u[10], m[5]);-	MONT_MAC(w0, w1, w2, u[11], m[4]);-	MONT_MAC(t0, t1, t2, u[12], m[3]);-	MONT_MAC(v0, v1, v2, u[13], m[2]);-	MONT_MAC(w0, w1, w2, u[14], m[1]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_ADD(t0, t1, t2, w0, w1, w2);-	MONT_ADD(s0, s1, s2, c0, c1, c2);-	MONT_DBL(s0, s1, s2);-	MONT_ADD(t0, t1, t2, s0, s1, s2);-	u[15] = t0 * n0;-	MONT_MAC(t0, t1, t2, u[15], m[0]);-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 16 */-	MONT_MUL(s0, s1, s2, a[0], a[16]);-	MONT_MUL(c0, c1, c2, a[1], a[15]);-	MONT_MAC(s0, s1, s2, a[2], a[14]);-	MONT_MAC(c0, c1, c2, a[3], a[13]);-	MONT_MAC(s0, s1, s2, a[4], a[12]);-	MONT_MAC(c0, c1, c2, a[5], a[11]);-	MONT_MAC(s0, s1, s2, a[6], a[10]);-	MONT_MAC(c0, c1, c2, a[7], a[9]);-	MONT_MAC(t0, t1, t2, a[8], a[8]);-	MONT_MUL(v0, v1, v2, u[0], m[16]);-	MONT_MUL(w0, w1, w2, u[1], m[15]);-	MONT_MAC(t0, t1, t2, u[2], m[14]);-	MONT_MAC(v0, v1, v2, u[3], m[13]);-	MONT_MAC(w0, w1, w2, u[4], m[12]);-	MONT_MAC(t0, t1, t2, u[5], m[11]);-	MONT_MAC(v0, v1, v2, u[6], m[10]);-	MONT_MAC(w0, w1, w2, u[7], m[9]);-	MONT_MAC(t0, t1, t2, u[8], m[8]);-	MONT_MAC(v0, v1, v2, u[9], m[7]);-	MONT_MAC(w0, w1, w2, u[10], m[6]);-	MONT_MAC(t0, t1, t2, u[11], m[5]);-	MONT_MAC(v0, v1, v2, u[12], m[4]);-	MONT_MAC(w0, w1, w2, u[13], m[3]);-	MONT_MAC(t0, t1, t2, u[14], m[2]);-	MONT_MAC(v0, v1, v2, u[15], m[1]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_ADD(t0, t1, t2, w0, w1, w2);-	MONT_ADD(s0, s1, s2, c0, c1, c2);-	MONT_DBL(s0, s1, s2);-	MONT_ADD(t0, t1, t2, s0, s1, s2);-	u[16] = t0 * n0;-	MONT_MAC(t0, t1, t2, u[16], m[0]);-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 17 */-	MONT_MUL(s0, s1, s2, a[0], a[17]);-	MONT_MUL(c0, c1, c2, a[1], a[16]);-	MONT_MAC(s0, s1, s2, a[2], a[15]);-	MONT_MAC(c0, c1, c2, a[3], a[14]);-	MONT_MAC(s0, s1, s2, a[4], a[13]);-	MONT_MAC(c0, c1, c2, a[5], a[12]);-	MONT_MAC(s0, s1, s2, a[6], a[11]);-	MONT_MAC(c0, c1, c2, a[7], a[10]);-	MONT_MAC(s0, s1, s2, a[8], a[9]);-	MONT_MAC(t0, t1, t2, u[0], m[17]);-	MONT_MUL(v0, v1, v2, u[1], m[16]);-	MONT_MUL(w0, w1, w2, u[2], m[15]);-	MONT_MAC(t0, t1, t2, u[3], m[14]);-	MONT_MAC(v0, v1, v2, u[4], m[13]);-	MONT_MAC(w0, w1, w2, u[5], m[12]);-	MONT_MAC(t0, t1, t2, u[6], m[11]);-	MONT_MAC(v0, v1, v2, u[7], m[10]);-	MONT_MAC(w0, w1, w2, u[8], m[9]);-	MONT_MAC(t0, t1, t2, u[9], m[8]);-	MONT_MAC(v0, v1, v2, u[10], m[7]);-	MONT_MAC(w0, w1, w2, u[11], m[6]);-	MONT_MAC(t0, t1, t2, u[12], m[5]);-	MONT_MAC(v0, v1, v2, u[13], m[4]);-	MONT_MAC(w0, w1, w2, u[14], m[3]);-	MONT_MAC(t0, t1, t2, u[15], m[2]);-	MONT_MAC(v0, v1, v2, u[16], m[1]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_ADD(t0, t1, t2, w0, w1, w2);-	MONT_ADD(s0, s1, s2, c0, c1, c2);-	MONT_DBL(s0, s1, s2);-	MONT_ADD(t0, t1, t2, s0, s1, s2);-	u[17] = t0 * n0;-	MONT_MAC(t0, t1, t2, u[17], m[0]);-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 18 */-	MONT_MUL(s0, s1, s2, a[0], a[18]);-	MONT_MUL(c0, c1, c2, a[1], a[17]);-	MONT_MAC(s0, s1, s2, a[2], a[16]);-	MONT_MAC(c0, c1, c2, a[3], a[15]);-	MONT_MAC(s0, s1, s2, a[4], a[14]);-	MONT_MAC(c0, c1, c2, a[5], a[13]);-	MONT_MAC(s0, s1, s2, a[6], a[12]);-	MONT_MAC(c0, c1, c2, a[7], a[11]);-	MONT_MAC(s0, s1, s2, a[8], a[10]);-	MONT_MAC(t0, t1, t2, a[9], a[9]);-	MONT_MUL(v0, v1, v2, u[0], m[18]);-	MONT_MUL(w0, w1, w2, u[1], m[17]);-	MONT_MAC(t0, t1, t2, u[2], m[16]);-	MONT_MAC(v0, v1, v2, u[3], m[15]);-	MONT_MAC(w0, w1, w2, u[4], m[14]);-	MONT_MAC(t0, t1, t2, u[5], m[13]);-	MONT_MAC(v0, v1, v2, u[6], m[12]);-	MONT_MAC(w0, w1, w2, u[7], m[11]);-	MONT_MAC(t0, t1, t2, u[8], m[10]);-	MONT_MAC(v0, v1, v2, u[9], m[9]);-	MONT_MAC(w0, w1, w2, u[10], m[8]);-	MONT_MAC(t0, t1, t2, u[11], m[7]);-	MONT_MAC(v0, v1, v2, u[12], m[6]);-	MONT_MAC(w0, w1, w2, u[13], m[5]);-	MONT_MAC(t0, t1, t2, u[14], m[4]);-	MONT_MAC(v0, v1, v2, u[15], m[3]);-	MONT_MAC(w0, w1, w2, u[16], m[2]);-	MONT_MAC(t0, t1, t2, u[17], m[1]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_ADD(t0, t1, t2, w0, w1, w2);-	MONT_ADD(s0, s1, s2, c0, c1, c2);-	MONT_DBL(s0, s1, s2);-	MONT_ADD(t0, t1, t2, s0, s1, s2);-	u[18] = t0 * n0;-	MONT_MAC(t0, t1, t2, u[18], m[0]);-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 19 */-	MONT_MUL(s0, s1, s2, a[0], a[19]);-	MONT_MUL(c0, c1, c2, a[1], a[18]);-	MONT_MAC(s0, s1, s2, a[2], a[17]);-	MONT_MAC(c0, c1, c2, a[3], a[16]);-	MONT_MAC(s0, s1, s2, a[4], a[15]);-	MONT_MAC(c0, c1, c2, a[5], a[14]);-	MONT_MAC(s0, s1, s2, a[6], a[13]);-	MONT_MAC(c0, c1, c2, a[7], a[12]);-	MONT_MAC(s0, s1, s2, a[8], a[11]);-	MONT_MAC(c0, c1, c2, a[9], a[10]);-	MONT_MAC(t0, t1, t2, u[0], m[19]);-	MONT_MUL(v0, v1, v2, u[1], m[18]);-	MONT_MUL(w0, w1, w2, u[2], m[17]);-	MONT_MAC(t0, t1, t2, u[3], m[16]);-	MONT_MAC(v0, v1, v2, u[4], m[15]);-	MONT_MAC(w0, w1, w2, u[5], m[14]);-	MONT_MAC(t0, t1, t2, u[6], m[13]);-	MONT_MAC(v0, v1, v2, u[7], m[12]);-	MONT_MAC(w0, w1, w2, u[8], m[11]);-	MONT_MAC(t0, t1, t2, u[9], m[10]);-	MONT_MAC(v0, v1, v2, u[10], m[9]);-	MONT_MAC(w0, w1, w2, u[11], m[8]);-	MONT_MAC(t0, t1, t2, u[12], m[7]);-	MONT_MAC(v0, v1, v2, u[13], m[6]);-	MONT_MAC(w0, w1, w2, u[14], m[5]);-	MONT_MAC(t0, t1, t2, u[15], m[4]);-	MONT_MAC(v0, v1, v2, u[16], m[3]);-	MONT_MAC(w0, w1, w2, u[17], m[2]);-	MONT_MAC(t0, t1, t2, u[18], m[1]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_ADD(t0, t1, t2, w0, w1, w2);-	MONT_ADD(s0, s1, s2, c0, c1, c2);-	MONT_DBL(s0, s1, s2);-	MONT_ADD(t0, t1, t2, s0, s1, s2);-	u[19] = t0 * n0;-	MONT_MAC(t0, t1, t2, u[19], m[0]);-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 20 */-	MONT_MUL(s0, s1, s2, a[0], a[20]);-	MONT_MUL(c0, c1, c2, a[1], a[19]);-	MONT_MAC(s0, s1, s2, a[2], a[18]);-	MONT_MAC(c0, c1, c2, a[3], a[17]);-	MONT_MAC(s0, s1, s2, a[4], a[16]);-	MONT_MAC(c0, c1, c2, a[5], a[15]);-	MONT_MAC(s0, s1, s2, a[6], a[14]);-	MONT_MAC(c0, c1, c2, a[7], a[13]);-	MONT_MAC(s0, s1, s2, a[8], a[12]);-	MONT_MAC(c0, c1, c2, a[9], a[11]);-	MONT_MAC(t0, t1, t2, a[10], a[10]);-	MONT_MUL(v0, v1, v2, u[0], m[20]);-	MONT_MUL(w0, w1, w2, u[1], m[19]);-	MONT_MAC(t0, t1, t2, u[2], m[18]);-	MONT_MAC(v0, v1, v2, u[3], m[17]);-	MONT_MAC(w0, w1, w2, u[4], m[16]);-	MONT_MAC(t0, t1, t2, u[5], m[15]);-	MONT_MAC(v0, v1, v2, u[6], m[14]);-	MONT_MAC(w0, w1, w2, u[7], m[13]);-	MONT_MAC(t0, t1, t2, u[8], m[12]);-	MONT_MAC(v0, v1, v2, u[9], m[11]);-	MONT_MAC(w0, w1, w2, u[10], m[10]);-	MONT_MAC(t0, t1, t2, u[11], m[9]);-	MONT_MAC(v0, v1, v2, u[12], m[8]);-	MONT_MAC(w0, w1, w2, u[13], m[7]);-	MONT_MAC(t0, t1, t2, u[14], m[6]);-	MONT_MAC(v0, v1, v2, u[15], m[5]);-	MONT_MAC(w0, w1, w2, u[16], m[4]);-	MONT_MAC(t0, t1, t2, u[17], m[3]);-	MONT_MAC(v0, v1, v2, u[18], m[2]);-	MONT_MAC(w0, w1, w2, u[19], m[1]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_ADD(t0, t1, t2, w0, w1, w2);-	MONT_ADD(s0, s1, s2, c0, c1, c2);-	MONT_DBL(s0, s1, s2);-	MONT_ADD(t0, t1, t2, s0, s1, s2);-	u[20] = t0 * n0;-	MONT_MAC(t0, t1, t2, u[20], m[0]);-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 21 */-	MONT_MUL(s0, s1, s2, a[0], a[21]);-	MONT_MUL(c0, c1, c2, a[1], a[20]);-	MONT_MAC(s0, s1, s2, a[2], a[19]);-	MONT_MAC(c0, c1, c2, a[3], a[18]);-	MONT_MAC(s0, s1, s2, a[4], a[17]);-	MONT_MAC(c0, c1, c2, a[5], a[16]);-	MONT_MAC(s0, s1, s2, a[6], a[15]);-	MONT_MAC(c0, c1, c2, a[7], a[14]);-	MONT_MAC(s0, s1, s2, a[8], a[13]);-	MONT_MAC(c0, c1, c2, a[9], a[12]);-	MONT_MAC(s0, s1, s2, a[10], a[11]);-	MONT_MAC(t0, t1, t2, u[0], m[21]);-	MONT_MUL(v0, v1, v2, u[1], m[20]);-	MONT_MUL(w0, w1, w2, u[2], m[19]);-	MONT_MAC(t0, t1, t2, u[3], m[18]);-	MONT_MAC(v0, v1, v2, u[4], m[17]);-	MONT_MAC(w0, w1, w2, u[5], m[16]);-	MONT_MAC(t0, t1, t2, u[6], m[15]);-	MONT_MAC(v0, v1, v2, u[7], m[14]);-	MONT_MAC(w0, w1, w2, u[8], m[13]);-	MONT_MAC(t0, t1, t2, u[9], m[12]);-	MONT_MAC(v0, v1, v2, u[10], m[11]);-	MONT_MAC(w0, w1, w2, u[11], m[10]);-	MONT_MAC(t0, t1, t2, u[12], m[9]);-	MONT_MAC(v0, v1, v2, u[13], m[8]);-	MONT_MAC(w0, w1, w2, u[14], m[7]);-	MONT_MAC(t0, t1, t2, u[15], m[6]);-	MONT_MAC(v0, v1, v2, u[16], m[5]);-	MONT_MAC(w0, w1, w2, u[17], m[4]);-	MONT_MAC(t0, t1, t2, u[18], m[3]);-	MONT_MAC(v0, v1, v2, u[19], m[2]);-	MONT_MAC(w0, w1, w2, u[20], m[1]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_ADD(t0, t1, t2, w0, w1, w2);-	MONT_ADD(s0, s1, s2, c0, c1, c2);-	MONT_DBL(s0, s1, s2);-	MONT_ADD(t0, t1, t2, s0, s1, s2);-	u[21] = t0 * n0;-	MONT_MAC(t0, t1, t2, u[21], m[0]);-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 22 */-	MONT_MUL(s0, s1, s2, a[0], a[22]);-	MONT_MUL(c0, c1, c2, a[1], a[21]);-	MONT_MAC(s0, s1, s2, a[2], a[20]);-	MONT_MAC(c0, c1, c2, a[3], a[19]);-	MONT_MAC(s0, s1, s2, a[4], a[18]);-	MONT_MAC(c0, c1, c2, a[5], a[17]);-	MONT_MAC(s0, s1, s2, a[6], a[16]);-	MONT_MAC(c0, c1, c2, a[7], a[15]);-	MONT_MAC(s0, s1, s2, a[8], a[14]);-	MONT_MAC(c0, c1, c2, a[9], a[13]);-	MONT_MAC(s0, s1, s2, a[10], a[12]);-	MONT_MAC(t0, t1, t2, a[11], a[11]);-	MONT_MUL(v0, v1, v2, u[0], m[22]);-	MONT_MUL(w0, w1, w2, u[1], m[21]);-	MONT_MAC(t0, t1, t2, u[2], m[20]);-	MONT_MAC(v0, v1, v2, u[3], m[19]);-	MONT_MAC(w0, w1, w2, u[4], m[18]);-	MONT_MAC(t0, t1, t2, u[5], m[17]);-	MONT_MAC(v0, v1, v2, u[6], m[16]);-	MONT_MAC(w0, w1, w2, u[7], m[15]);-	MONT_MAC(t0, t1, t2, u[8], m[14]);-	MONT_MAC(v0, v1, v2, u[9], m[13]);-	MONT_MAC(w0, w1, w2, u[10], m[12]);-	MONT_MAC(t0, t1, t2, u[11], m[11]);-	MONT_MAC(v0, v1, v2, u[12], m[10]);-	MONT_MAC(w0, w1, w2, u[13], m[9]);-	MONT_MAC(t0, t1, t2, u[14], m[8]);-	MONT_MAC(v0, v1, v2, u[15], m[7]);-	MONT_MAC(w0, w1, w2, u[16], m[6]);-	MONT_MAC(t0, t1, t2, u[17], m[5]);-	MONT_MAC(v0, v1, v2, u[18], m[4]);-	MONT_MAC(w0, w1, w2, u[19], m[3]);-	MONT_MAC(t0, t1, t2, u[20], m[2]);-	MONT_MAC(v0, v1, v2, u[21], m[1]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_ADD(t0, t1, t2, w0, w1, w2);-	MONT_ADD(s0, s1, s2, c0, c1, c2);-	MONT_DBL(s0, s1, s2);-	MONT_ADD(t0, t1, t2, s0, s1, s2);-	u[22] = t0 * n0;-	MONT_MAC(t0, t1, t2, u[22], m[0]);-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 23 */-	MONT_MUL(s0, s1, s2, a[0], a[23]);-	MONT_MUL(c0, c1, c2, a[1], a[22]);-	MONT_MAC(s0, s1, s2, a[2], a[21]);-	MONT_MAC(c0, c1, c2, a[3], a[20]);-	MONT_MAC(s0, s1, s2, a[4], a[19]);-	MONT_MAC(c0, c1, c2, a[5], a[18]);-	MONT_MAC(s0, s1, s2, a[6], a[17]);-	MONT_MAC(c0, c1, c2, a[7], a[16]);-	MONT_MAC(s0, s1, s2, a[8], a[15]);-	MONT_MAC(c0, c1, c2, a[9], a[14]);-	MONT_MAC(s0, s1, s2, a[10], a[13]);-	MONT_MAC(c0, c1, c2, a[11], a[12]);-	MONT_MAC(t0, t1, t2, u[0], m[23]);-	MONT_MUL(v0, v1, v2, u[1], m[22]);-	MONT_MUL(w0, w1, w2, u[2], m[21]);-	MONT_MAC(t0, t1, t2, u[3], m[20]);-	MONT_MAC(v0, v1, v2, u[4], m[19]);-	MONT_MAC(w0, w1, w2, u[5], m[18]);-	MONT_MAC(t0, t1, t2, u[6], m[17]);-	MONT_MAC(v0, v1, v2, u[7], m[16]);-	MONT_MAC(w0, w1, w2, u[8], m[15]);-	MONT_MAC(t0, t1, t2, u[9], m[14]);-	MONT_MAC(v0, v1, v2, u[10], m[13]);-	MONT_MAC(w0, w1, w2, u[11], m[12]);-	MONT_MAC(t0, t1, t2, u[12], m[11]);-	MONT_MAC(v0, v1, v2, u[13], m[10]);-	MONT_MAC(w0, w1, w2, u[14], m[9]);-	MONT_MAC(t0, t1, t2, u[15], m[8]);-	MONT_MAC(v0, v1, v2, u[16], m[7]);-	MONT_MAC(w0, w1, w2, u[17], m[6]);-	MONT_MAC(t0, t1, t2, u[18], m[5]);-	MONT_MAC(v0, v1, v2, u[19], m[4]);-	MONT_MAC(w0, w1, w2, u[20], m[3]);-	MONT_MAC(t0, t1, t2, u[21], m[2]);-	MONT_MAC(v0, v1, v2, u[22], m[1]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_ADD(t0, t1, t2, w0, w1, w2);-	MONT_ADD(s0, s1, s2, c0, c1, c2);-	MONT_DBL(s0, s1, s2);-	MONT_ADD(t0, t1, t2, s0, s1, s2);-	u[23] = t0 * n0;-	MONT_MAC(t0, t1, t2, u[23], m[0]);-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 24 */-	MONT_MUL(s0, s1, s2, a[1], a[23]);-	MONT_MUL(c0, c1, c2, a[2], a[22]);-	MONT_MAC(s0, s1, s2, a[3], a[21]);-	MONT_MAC(c0, c1, c2, a[4], a[20]);-	MONT_MAC(s0, s1, s2, a[5], a[19]);-	MONT_MAC(c0, c1, c2, a[6], a[18]);-	MONT_MAC(s0, s1, s2, a[7], a[17]);-	MONT_MAC(c0, c1, c2, a[8], a[16]);-	MONT_MAC(s0, s1, s2, a[9], a[15]);-	MONT_MAC(c0, c1, c2, a[10], a[14]);-	MONT_MAC(s0, s1, s2, a[11], a[13]);-	MONT_MAC(t0, t1, t2, a[12], a[12]);-	MONT_MUL(v0, v1, v2, u[1], m[23]);-	MONT_MUL(w0, w1, w2, u[2], m[22]);-	MONT_MAC(t0, t1, t2, u[3], m[21]);-	MONT_MAC(v0, v1, v2, u[4], m[20]);-	MONT_MAC(w0, w1, w2, u[5], m[19]);-	MONT_MAC(t0, t1, t2, u[6], m[18]);-	MONT_MAC(v0, v1, v2, u[7], m[17]);-	MONT_MAC(w0, w1, w2, u[8], m[16]);-	MONT_MAC(t0, t1, t2, u[9], m[15]);-	MONT_MAC(v0, v1, v2, u[10], m[14]);-	MONT_MAC(w0, w1, w2, u[11], m[13]);-	MONT_MAC(t0, t1, t2, u[12], m[12]);-	MONT_MAC(v0, v1, v2, u[13], m[11]);-	MONT_MAC(w0, w1, w2, u[14], m[10]);-	MONT_MAC(t0, t1, t2, u[15], m[9]);-	MONT_MAC(v0, v1, v2, u[16], m[8]);-	MONT_MAC(w0, w1, w2, u[17], m[7]);-	MONT_MAC(t0, t1, t2, u[18], m[6]);-	MONT_MAC(v0, v1, v2, u[19], m[5]);-	MONT_MAC(w0, w1, w2, u[20], m[4]);-	MONT_MAC(t0, t1, t2, u[21], m[3]);-	MONT_MAC(v0, v1, v2, u[22], m[2]);-	MONT_MAC(w0, w1, w2, u[23], m[1]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_ADD(t0, t1, t2, w0, w1, w2);-	MONT_ADD(s0, s1, s2, c0, c1, c2);-	MONT_DBL(s0, s1, s2);-	MONT_ADD(t0, t1, t2, s0, s1, s2);-	z[0] = t0;-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 25 */-	MONT_MUL(s0, s1, s2, a[2], a[23]);-	MONT_MUL(c0, c1, c2, a[3], a[22]);-	MONT_MAC(s0, s1, s2, a[4], a[21]);-	MONT_MAC(c0, c1, c2, a[5], a[20]);-	MONT_MAC(s0, s1, s2, a[6], a[19]);-	MONT_MAC(c0, c1, c2, a[7], a[18]);-	MONT_MAC(s0, s1, s2, a[8], a[17]);-	MONT_MAC(c0, c1, c2, a[9], a[16]);-	MONT_MAC(s0, s1, s2, a[10], a[15]);-	MONT_MAC(c0, c1, c2, a[11], a[14]);-	MONT_MAC(s0, s1, s2, a[12], a[13]);-	MONT_MAC(t0, t1, t2, u[2], m[23]);-	MONT_MUL(v0, v1, v2, u[3], m[22]);-	MONT_MUL(w0, w1, w2, u[4], m[21]);-	MONT_MAC(t0, t1, t2, u[5], m[20]);-	MONT_MAC(v0, v1, v2, u[6], m[19]);-	MONT_MAC(w0, w1, w2, u[7], m[18]);-	MONT_MAC(t0, t1, t2, u[8], m[17]);-	MONT_MAC(v0, v1, v2, u[9], m[16]);-	MONT_MAC(w0, w1, w2, u[10], m[15]);-	MONT_MAC(t0, t1, t2, u[11], m[14]);-	MONT_MAC(v0, v1, v2, u[12], m[13]);-	MONT_MAC(w0, w1, w2, u[13], m[12]);-	MONT_MAC(t0, t1, t2, u[14], m[11]);-	MONT_MAC(v0, v1, v2, u[15], m[10]);-	MONT_MAC(w0, w1, w2, u[16], m[9]);-	MONT_MAC(t0, t1, t2, u[17], m[8]);-	MONT_MAC(v0, v1, v2, u[18], m[7]);-	MONT_MAC(w0, w1, w2, u[19], m[6]);-	MONT_MAC(t0, t1, t2, u[20], m[5]);-	MONT_MAC(v0, v1, v2, u[21], m[4]);-	MONT_MAC(w0, w1, w2, u[22], m[3]);-	MONT_MAC(t0, t1, t2, u[23], m[2]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_ADD(t0, t1, t2, w0, w1, w2);-	MONT_ADD(s0, s1, s2, c0, c1, c2);-	MONT_DBL(s0, s1, s2);-	MONT_ADD(t0, t1, t2, s0, s1, s2);-	z[1] = t0;-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 26 */-	MONT_MUL(s0, s1, s2, a[3], a[23]);-	MONT_MUL(c0, c1, c2, a[4], a[22]);-	MONT_MAC(s0, s1, s2, a[5], a[21]);-	MONT_MAC(c0, c1, c2, a[6], a[20]);-	MONT_MAC(s0, s1, s2, a[7], a[19]);-	MONT_MAC(c0, c1, c2, a[8], a[18]);-	MONT_MAC(s0, s1, s2, a[9], a[17]);-	MONT_MAC(c0, c1, c2, a[10], a[16]);-	MONT_MAC(s0, s1, s2, a[11], a[15]);-	MONT_MAC(c0, c1, c2, a[12], a[14]);-	MONT_MAC(t0, t1, t2, a[13], a[13]);-	MONT_MUL(v0, v1, v2, u[3], m[23]);-	MONT_MUL(w0, w1, w2, u[4], m[22]);-	MONT_MAC(t0, t1, t2, u[5], m[21]);-	MONT_MAC(v0, v1, v2, u[6], m[20]);-	MONT_MAC(w0, w1, w2, u[7], m[19]);-	MONT_MAC(t0, t1, t2, u[8], m[18]);-	MONT_MAC(v0, v1, v2, u[9], m[17]);-	MONT_MAC(w0, w1, w2, u[10], m[16]);-	MONT_MAC(t0, t1, t2, u[11], m[15]);-	MONT_MAC(v0, v1, v2, u[12], m[14]);-	MONT_MAC(w0, w1, w2, u[13], m[13]);-	MONT_MAC(t0, t1, t2, u[14], m[12]);-	MONT_MAC(v0, v1, v2, u[15], m[11]);-	MONT_MAC(w0, w1, w2, u[16], m[10]);-	MONT_MAC(t0, t1, t2, u[17], m[9]);-	MONT_MAC(v0, v1, v2, u[18], m[8]);-	MONT_MAC(w0, w1, w2, u[19], m[7]);-	MONT_MAC(t0, t1, t2, u[20], m[6]);-	MONT_MAC(v0, v1, v2, u[21], m[5]);-	MONT_MAC(w0, w1, w2, u[22], m[4]);-	MONT_MAC(t0, t1, t2, u[23], m[3]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_ADD(t0, t1, t2, w0, w1, w2);-	MONT_ADD(s0, s1, s2, c0, c1, c2);-	MONT_DBL(s0, s1, s2);-	MONT_ADD(t0, t1, t2, s0, s1, s2);-	z[2] = t0;-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 27 */-	MONT_MUL(s0, s1, s2, a[4], a[23]);-	MONT_MUL(c0, c1, c2, a[5], a[22]);-	MONT_MAC(s0, s1, s2, a[6], a[21]);-	MONT_MAC(c0, c1, c2, a[7], a[20]);-	MONT_MAC(s0, s1, s2, a[8], a[19]);-	MONT_MAC(c0, c1, c2, a[9], a[18]);-	MONT_MAC(s0, s1, s2, a[10], a[17]);-	MONT_MAC(c0, c1, c2, a[11], a[16]);-	MONT_MAC(s0, s1, s2, a[12], a[15]);-	MONT_MAC(c0, c1, c2, a[13], a[14]);-	MONT_MAC(t0, t1, t2, u[4], m[23]);-	MONT_MUL(v0, v1, v2, u[5], m[22]);-	MONT_MUL(w0, w1, w2, u[6], m[21]);-	MONT_MAC(t0, t1, t2, u[7], m[20]);-	MONT_MAC(v0, v1, v2, u[8], m[19]);-	MONT_MAC(w0, w1, w2, u[9], m[18]);-	MONT_MAC(t0, t1, t2, u[10], m[17]);-	MONT_MAC(v0, v1, v2, u[11], m[16]);-	MONT_MAC(w0, w1, w2, u[12], m[15]);-	MONT_MAC(t0, t1, t2, u[13], m[14]);-	MONT_MAC(v0, v1, v2, u[14], m[13]);-	MONT_MAC(w0, w1, w2, u[15], m[12]);-	MONT_MAC(t0, t1, t2, u[16], m[11]);-	MONT_MAC(v0, v1, v2, u[17], m[10]);-	MONT_MAC(w0, w1, w2, u[18], m[9]);-	MONT_MAC(t0, t1, t2, u[19], m[8]);-	MONT_MAC(v0, v1, v2, u[20], m[7]);-	MONT_MAC(w0, w1, w2, u[21], m[6]);-	MONT_MAC(t0, t1, t2, u[22], m[5]);-	MONT_MAC(v0, v1, v2, u[23], m[4]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_ADD(t0, t1, t2, w0, w1, w2);-	MONT_ADD(s0, s1, s2, c0, c1, c2);-	MONT_DBL(s0, s1, s2);-	MONT_ADD(t0, t1, t2, s0, s1, s2);-	z[3] = t0;-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 28 */-	MONT_MUL(s0, s1, s2, a[5], a[23]);-	MONT_MUL(c0, c1, c2, a[6], a[22]);-	MONT_MAC(s0, s1, s2, a[7], a[21]);-	MONT_MAC(c0, c1, c2, a[8], a[20]);-	MONT_MAC(s0, s1, s2, a[9], a[19]);-	MONT_MAC(c0, c1, c2, a[10], a[18]);-	MONT_MAC(s0, s1, s2, a[11], a[17]);-	MONT_MAC(c0, c1, c2, a[12], a[16]);-	MONT_MAC(s0, s1, s2, a[13], a[15]);-	MONT_MAC(t0, t1, t2, a[14], a[14]);-	MONT_MUL(v0, v1, v2, u[5], m[23]);-	MONT_MUL(w0, w1, w2, u[6], m[22]);-	MONT_MAC(t0, t1, t2, u[7], m[21]);-	MONT_MAC(v0, v1, v2, u[8], m[20]);-	MONT_MAC(w0, w1, w2, u[9], m[19]);-	MONT_MAC(t0, t1, t2, u[10], m[18]);-	MONT_MAC(v0, v1, v2, u[11], m[17]);-	MONT_MAC(w0, w1, w2, u[12], m[16]);-	MONT_MAC(t0, t1, t2, u[13], m[15]);-	MONT_MAC(v0, v1, v2, u[14], m[14]);-	MONT_MAC(w0, w1, w2, u[15], m[13]);-	MONT_MAC(t0, t1, t2, u[16], m[12]);-	MONT_MAC(v0, v1, v2, u[17], m[11]);-	MONT_MAC(w0, w1, w2, u[18], m[10]);-	MONT_MAC(t0, t1, t2, u[19], m[9]);-	MONT_MAC(v0, v1, v2, u[20], m[8]);-	MONT_MAC(w0, w1, w2, u[21], m[7]);-	MONT_MAC(t0, t1, t2, u[22], m[6]);-	MONT_MAC(v0, v1, v2, u[23], m[5]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_ADD(t0, t1, t2, w0, w1, w2);-	MONT_ADD(s0, s1, s2, c0, c1, c2);-	MONT_DBL(s0, s1, s2);-	MONT_ADD(t0, t1, t2, s0, s1, s2);-	z[4] = t0;-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 29 */-	MONT_MUL(s0, s1, s2, a[6], a[23]);-	MONT_MUL(c0, c1, c2, a[7], a[22]);-	MONT_MAC(s0, s1, s2, a[8], a[21]);-	MONT_MAC(c0, c1, c2, a[9], a[20]);-	MONT_MAC(s0, s1, s2, a[10], a[19]);-	MONT_MAC(c0, c1, c2, a[11], a[18]);-	MONT_MAC(s0, s1, s2, a[12], a[17]);-	MONT_MAC(c0, c1, c2, a[13], a[16]);-	MONT_MAC(s0, s1, s2, a[14], a[15]);-	MONT_MAC(t0, t1, t2, u[6], m[23]);-	MONT_MUL(v0, v1, v2, u[7], m[22]);-	MONT_MUL(w0, w1, w2, u[8], m[21]);-	MONT_MAC(t0, t1, t2, u[9], m[20]);-	MONT_MAC(v0, v1, v2, u[10], m[19]);-	MONT_MAC(w0, w1, w2, u[11], m[18]);-	MONT_MAC(t0, t1, t2, u[12], m[17]);-	MONT_MAC(v0, v1, v2, u[13], m[16]);-	MONT_MAC(w0, w1, w2, u[14], m[15]);-	MONT_MAC(t0, t1, t2, u[15], m[14]);-	MONT_MAC(v0, v1, v2, u[16], m[13]);-	MONT_MAC(w0, w1, w2, u[17], m[12]);-	MONT_MAC(t0, t1, t2, u[18], m[11]);-	MONT_MAC(v0, v1, v2, u[19], m[10]);-	MONT_MAC(w0, w1, w2, u[20], m[9]);-	MONT_MAC(t0, t1, t2, u[21], m[8]);-	MONT_MAC(v0, v1, v2, u[22], m[7]);-	MONT_MAC(w0, w1, w2, u[23], m[6]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_ADD(t0, t1, t2, w0, w1, w2);-	MONT_ADD(s0, s1, s2, c0, c1, c2);-	MONT_DBL(s0, s1, s2);-	MONT_ADD(t0, t1, t2, s0, s1, s2);-	z[5] = t0;-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 30 */-	MONT_MUL(s0, s1, s2, a[7], a[23]);-	MONT_MUL(c0, c1, c2, a[8], a[22]);-	MONT_MAC(s0, s1, s2, a[9], a[21]);-	MONT_MAC(c0, c1, c2, a[10], a[20]);-	MONT_MAC(s0, s1, s2, a[11], a[19]);-	MONT_MAC(c0, c1, c2, a[12], a[18]);-	MONT_MAC(s0, s1, s2, a[13], a[17]);-	MONT_MAC(c0, c1, c2, a[14], a[16]);-	MONT_MAC(t0, t1, t2, a[15], a[15]);-	MONT_MUL(v0, v1, v2, u[7], m[23]);-	MONT_MUL(w0, w1, w2, u[8], m[22]);-	MONT_MAC(t0, t1, t2, u[9], m[21]);-	MONT_MAC(v0, v1, v2, u[10], m[20]);-	MONT_MAC(w0, w1, w2, u[11], m[19]);-	MONT_MAC(t0, t1, t2, u[12], m[18]);-	MONT_MAC(v0, v1, v2, u[13], m[17]);-	MONT_MAC(w0, w1, w2, u[14], m[16]);-	MONT_MAC(t0, t1, t2, u[15], m[15]);-	MONT_MAC(v0, v1, v2, u[16], m[14]);-	MONT_MAC(w0, w1, w2, u[17], m[13]);-	MONT_MAC(t0, t1, t2, u[18], m[12]);-	MONT_MAC(v0, v1, v2, u[19], m[11]);-	MONT_MAC(w0, w1, w2, u[20], m[10]);-	MONT_MAC(t0, t1, t2, u[21], m[9]);-	MONT_MAC(v0, v1, v2, u[22], m[8]);-	MONT_MAC(w0, w1, w2, u[23], m[7]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_ADD(t0, t1, t2, w0, w1, w2);-	MONT_ADD(s0, s1, s2, c0, c1, c2);-	MONT_DBL(s0, s1, s2);-	MONT_ADD(t0, t1, t2, s0, s1, s2);-	z[6] = t0;-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 31 */-	MONT_MUL(s0, s1, s2, a[8], a[23]);-	MONT_MUL(c0, c1, c2, a[9], a[22]);-	MONT_MAC(s0, s1, s2, a[10], a[21]);-	MONT_MAC(c0, c1, c2, a[11], a[20]);-	MONT_MAC(s0, s1, s2, a[12], a[19]);-	MONT_MAC(c0, c1, c2, a[13], a[18]);-	MONT_MAC(s0, s1, s2, a[14], a[17]);-	MONT_MAC(c0, c1, c2, a[15], a[16]);-	MONT_MAC(t0, t1, t2, u[8], m[23]);-	MONT_MUL(v0, v1, v2, u[9], m[22]);-	MONT_MUL(w0, w1, w2, u[10], m[21]);-	MONT_MAC(t0, t1, t2, u[11], m[20]);-	MONT_MAC(v0, v1, v2, u[12], m[19]);-	MONT_MAC(w0, w1, w2, u[13], m[18]);-	MONT_MAC(t0, t1, t2, u[14], m[17]);-	MONT_MAC(v0, v1, v2, u[15], m[16]);-	MONT_MAC(w0, w1, w2, u[16], m[15]);-	MONT_MAC(t0, t1, t2, u[17], m[14]);-	MONT_MAC(v0, v1, v2, u[18], m[13]);-	MONT_MAC(w0, w1, w2, u[19], m[12]);-	MONT_MAC(t0, t1, t2, u[20], m[11]);-	MONT_MAC(v0, v1, v2, u[21], m[10]);-	MONT_MAC(w0, w1, w2, u[22], m[9]);-	MONT_MAC(t0, t1, t2, u[23], m[8]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_ADD(t0, t1, t2, w0, w1, w2);-	MONT_ADD(s0, s1, s2, c0, c1, c2);-	MONT_DBL(s0, s1, s2);-	MONT_ADD(t0, t1, t2, s0, s1, s2);-	z[7] = t0;-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 32 */-	MONT_MUL(s0, s1, s2, a[9], a[23]);-	MONT_MUL(c0, c1, c2, a[10], a[22]);-	MONT_MAC(s0, s1, s2, a[11], a[21]);-	MONT_MAC(c0, c1, c2, a[12], a[20]);-	MONT_MAC(s0, s1, s2, a[13], a[19]);-	MONT_MAC(c0, c1, c2, a[14], a[18]);-	MONT_MAC(s0, s1, s2, a[15], a[17]);-	MONT_MAC(t0, t1, t2, a[16], a[16]);-	MONT_MUL(v0, v1, v2, u[9], m[23]);-	MONT_MUL(w0, w1, w2, u[10], m[22]);-	MONT_MAC(t0, t1, t2, u[11], m[21]);-	MONT_MAC(v0, v1, v2, u[12], m[20]);-	MONT_MAC(w0, w1, w2, u[13], m[19]);-	MONT_MAC(t0, t1, t2, u[14], m[18]);-	MONT_MAC(v0, v1, v2, u[15], m[17]);-	MONT_MAC(w0, w1, w2, u[16], m[16]);-	MONT_MAC(t0, t1, t2, u[17], m[15]);-	MONT_MAC(v0, v1, v2, u[18], m[14]);-	MONT_MAC(w0, w1, w2, u[19], m[13]);-	MONT_MAC(t0, t1, t2, u[20], m[12]);-	MONT_MAC(v0, v1, v2, u[21], m[11]);-	MONT_MAC(w0, w1, w2, u[22], m[10]);-	MONT_MAC(t0, t1, t2, u[23], m[9]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_ADD(t0, t1, t2, w0, w1, w2);-	MONT_ADD(s0, s1, s2, c0, c1, c2);-	MONT_DBL(s0, s1, s2);-	MONT_ADD(t0, t1, t2, s0, s1, s2);-	z[8] = t0;-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 33 */-	MONT_MUL(s0, s1, s2, a[10], a[23]);-	MONT_MUL(c0, c1, c2, a[11], a[22]);-	MONT_MAC(s0, s1, s2, a[12], a[21]);-	MONT_MAC(c0, c1, c2, a[13], a[20]);-	MONT_MAC(s0, s1, s2, a[14], a[19]);-	MONT_MAC(c0, c1, c2, a[15], a[18]);-	MONT_MAC(s0, s1, s2, a[16], a[17]);-	MONT_MAC(t0, t1, t2, u[10], m[23]);-	MONT_MUL(v0, v1, v2, u[11], m[22]);-	MONT_MUL(w0, w1, w2, u[12], m[21]);-	MONT_MAC(t0, t1, t2, u[13], m[20]);-	MONT_MAC(v0, v1, v2, u[14], m[19]);-	MONT_MAC(w0, w1, w2, u[15], m[18]);-	MONT_MAC(t0, t1, t2, u[16], m[17]);-	MONT_MAC(v0, v1, v2, u[17], m[16]);-	MONT_MAC(w0, w1, w2, u[18], m[15]);-	MONT_MAC(t0, t1, t2, u[19], m[14]);-	MONT_MAC(v0, v1, v2, u[20], m[13]);-	MONT_MAC(w0, w1, w2, u[21], m[12]);-	MONT_MAC(t0, t1, t2, u[22], m[11]);-	MONT_MAC(v0, v1, v2, u[23], m[10]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_ADD(t0, t1, t2, w0, w1, w2);-	MONT_ADD(s0, s1, s2, c0, c1, c2);-	MONT_DBL(s0, s1, s2);-	MONT_ADD(t0, t1, t2, s0, s1, s2);-	z[9] = t0;-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 34 */-	MONT_MUL(s0, s1, s2, a[11], a[23]);-	MONT_MUL(c0, c1, c2, a[12], a[22]);-	MONT_MAC(s0, s1, s2, a[13], a[21]);-	MONT_MAC(c0, c1, c2, a[14], a[20]);-	MONT_MAC(s0, s1, s2, a[15], a[19]);-	MONT_MAC(c0, c1, c2, a[16], a[18]);-	MONT_MAC(t0, t1, t2, a[17], a[17]);-	MONT_MUL(v0, v1, v2, u[11], m[23]);-	MONT_MUL(w0, w1, w2, u[12], m[22]);-	MONT_MAC(t0, t1, t2, u[13], m[21]);-	MONT_MAC(v0, v1, v2, u[14], m[20]);-	MONT_MAC(w0, w1, w2, u[15], m[19]);-	MONT_MAC(t0, t1, t2, u[16], m[18]);-	MONT_MAC(v0, v1, v2, u[17], m[17]);-	MONT_MAC(w0, w1, w2, u[18], m[16]);-	MONT_MAC(t0, t1, t2, u[19], m[15]);-	MONT_MAC(v0, v1, v2, u[20], m[14]);-	MONT_MAC(w0, w1, w2, u[21], m[13]);-	MONT_MAC(t0, t1, t2, u[22], m[12]);-	MONT_MAC(v0, v1, v2, u[23], m[11]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_ADD(t0, t1, t2, w0, w1, w2);-	MONT_ADD(s0, s1, s2, c0, c1, c2);-	MONT_DBL(s0, s1, s2);-	MONT_ADD(t0, t1, t2, s0, s1, s2);-	z[10] = t0;-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 35 */-	MONT_MUL(s0, s1, s2, a[12], a[23]);-	MONT_MUL(c0, c1, c2, a[13], a[22]);-	MONT_MAC(s0, s1, s2, a[14], a[21]);-	MONT_MAC(c0, c1, c2, a[15], a[20]);-	MONT_MAC(s0, s1, s2, a[16], a[19]);-	MONT_MAC(c0, c1, c2, a[17], a[18]);-	MONT_MAC(t0, t1, t2, u[12], m[23]);-	MONT_MUL(v0, v1, v2, u[13], m[22]);-	MONT_MUL(w0, w1, w2, u[14], m[21]);-	MONT_MAC(t0, t1, t2, u[15], m[20]);-	MONT_MAC(v0, v1, v2, u[16], m[19]);-	MONT_MAC(w0, w1, w2, u[17], m[18]);-	MONT_MAC(t0, t1, t2, u[18], m[17]);-	MONT_MAC(v0, v1, v2, u[19], m[16]);-	MONT_MAC(w0, w1, w2, u[20], m[15]);-	MONT_MAC(t0, t1, t2, u[21], m[14]);-	MONT_MAC(v0, v1, v2, u[22], m[13]);-	MONT_MAC(w0, w1, w2, u[23], m[12]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_ADD(t0, t1, t2, w0, w1, w2);-	MONT_ADD(s0, s1, s2, c0, c1, c2);-	MONT_DBL(s0, s1, s2);-	MONT_ADD(t0, t1, t2, s0, s1, s2);-	z[11] = t0;-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 36 */-	MONT_MUL(s0, s1, s2, a[13], a[23]);-	MONT_MUL(c0, c1, c2, a[14], a[22]);-	MONT_MAC(s0, s1, s2, a[15], a[21]);-	MONT_MAC(c0, c1, c2, a[16], a[20]);-	MONT_MAC(s0, s1, s2, a[17], a[19]);-	MONT_MAC(t0, t1, t2, a[18], a[18]);-	MONT_MUL(v0, v1, v2, u[13], m[23]);-	MONT_MUL(w0, w1, w2, u[14], m[22]);-	MONT_MAC(t0, t1, t2, u[15], m[21]);-	MONT_MAC(v0, v1, v2, u[16], m[20]);-	MONT_MAC(w0, w1, w2, u[17], m[19]);-	MONT_MAC(t0, t1, t2, u[18], m[18]);-	MONT_MAC(v0, v1, v2, u[19], m[17]);-	MONT_MAC(w0, w1, w2, u[20], m[16]);-	MONT_MAC(t0, t1, t2, u[21], m[15]);-	MONT_MAC(v0, v1, v2, u[22], m[14]);-	MONT_MAC(w0, w1, w2, u[23], m[13]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_ADD(t0, t1, t2, w0, w1, w2);-	MONT_ADD(s0, s1, s2, c0, c1, c2);-	MONT_DBL(s0, s1, s2);-	MONT_ADD(t0, t1, t2, s0, s1, s2);-	z[12] = t0;-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 37 */-	MONT_MUL(s0, s1, s2, a[14], a[23]);-	MONT_MUL(c0, c1, c2, a[15], a[22]);-	MONT_MAC(s0, s1, s2, a[16], a[21]);-	MONT_MAC(c0, c1, c2, a[17], a[20]);-	MONT_MAC(s0, s1, s2, a[18], a[19]);-	MONT_MAC(t0, t1, t2, u[14], m[23]);-	MONT_MUL(v0, v1, v2, u[15], m[22]);-	MONT_MUL(w0, w1, w2, u[16], m[21]);-	MONT_MAC(t0, t1, t2, u[17], m[20]);-	MONT_MAC(v0, v1, v2, u[18], m[19]);-	MONT_MAC(w0, w1, w2, u[19], m[18]);-	MONT_MAC(t0, t1, t2, u[20], m[17]);-	MONT_MAC(v0, v1, v2, u[21], m[16]);-	MONT_MAC(w0, w1, w2, u[22], m[15]);-	MONT_MAC(t0, t1, t2, u[23], m[14]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_ADD(t0, t1, t2, w0, w1, w2);-	MONT_ADD(s0, s1, s2, c0, c1, c2);-	MONT_DBL(s0, s1, s2);-	MONT_ADD(t0, t1, t2, s0, s1, s2);-	z[13] = t0;-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 38 */-	MONT_MUL(s0, s1, s2, a[15], a[23]);-	MONT_MUL(c0, c1, c2, a[16], a[22]);-	MONT_MAC(s0, s1, s2, a[17], a[21]);-	MONT_MAC(c0, c1, c2, a[18], a[20]);-	MONT_MAC(t0, t1, t2, a[19], a[19]);-	MONT_MUL(v0, v1, v2, u[15], m[23]);-	MONT_MUL(w0, w1, w2, u[16], m[22]);-	MONT_MAC(t0, t1, t2, u[17], m[21]);-	MONT_MAC(v0, v1, v2, u[18], m[20]);-	MONT_MAC(w0, w1, w2, u[19], m[19]);-	MONT_MAC(t0, t1, t2, u[20], m[18]);-	MONT_MAC(v0, v1, v2, u[21], m[17]);-	MONT_MAC(w0, w1, w2, u[22], m[16]);-	MONT_MAC(t0, t1, t2, u[23], m[15]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_ADD(t0, t1, t2, w0, w1, w2);-	MONT_ADD(s0, s1, s2, c0, c1, c2);-	MONT_DBL(s0, s1, s2);-	MONT_ADD(t0, t1, t2, s0, s1, s2);-	z[14] = t0;-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 39 */-	MONT_MUL(s0, s1, s2, a[16], a[23]);-	MONT_MUL(c0, c1, c2, a[17], a[22]);-	MONT_MAC(s0, s1, s2, a[18], a[21]);-	MONT_MAC(c0, c1, c2, a[19], a[20]);-	MONT_MAC(t0, t1, t2, u[16], m[23]);-	MONT_MUL(v0, v1, v2, u[17], m[22]);-	MONT_MUL(w0, w1, w2, u[18], m[21]);-	MONT_MAC(t0, t1, t2, u[19], m[20]);-	MONT_MAC(v0, v1, v2, u[20], m[19]);-	MONT_MAC(w0, w1, w2, u[21], m[18]);-	MONT_MAC(t0, t1, t2, u[22], m[17]);-	MONT_MAC(v0, v1, v2, u[23], m[16]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_ADD(t0, t1, t2, w0, w1, w2);-	MONT_ADD(s0, s1, s2, c0, c1, c2);-	MONT_DBL(s0, s1, s2);-	MONT_ADD(t0, t1, t2, s0, s1, s2);-	z[15] = t0;-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 40 */-	MONT_MUL(s0, s1, s2, a[17], a[23]);-	MONT_MUL(c0, c1, c2, a[18], a[22]);-	MONT_MAC(s0, s1, s2, a[19], a[21]);-	MONT_MAC(t0, t1, t2, a[20], a[20]);-	MONT_MUL(v0, v1, v2, u[17], m[23]);-	MONT_MUL(w0, w1, w2, u[18], m[22]);-	MONT_MAC(t0, t1, t2, u[19], m[21]);-	MONT_MAC(v0, v1, v2, u[20], m[20]);-	MONT_MAC(w0, w1, w2, u[21], m[19]);-	MONT_MAC(t0, t1, t2, u[22], m[18]);-	MONT_MAC(v0, v1, v2, u[23], m[17]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_ADD(t0, t1, t2, w0, w1, w2);-	MONT_ADD(s0, s1, s2, c0, c1, c2);-	MONT_DBL(s0, s1, s2);-	MONT_ADD(t0, t1, t2, s0, s1, s2);-	z[16] = t0;-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 41 */-	MONT_MUL(s0, s1, s2, a[18], a[23]);-	MONT_MUL(c0, c1, c2, a[19], a[22]);-	MONT_MAC(s0, s1, s2, a[20], a[21]);-	MONT_MAC(t0, t1, t2, u[18], m[23]);-	MONT_MUL(v0, v1, v2, u[19], m[22]);-	MONT_MUL(w0, w1, w2, u[20], m[21]);-	MONT_MAC(t0, t1, t2, u[21], m[20]);-	MONT_MAC(v0, v1, v2, u[22], m[19]);-	MONT_MAC(w0, w1, w2, u[23], m[18]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_ADD(t0, t1, t2, w0, w1, w2);-	MONT_ADD(s0, s1, s2, c0, c1, c2);-	MONT_DBL(s0, s1, s2);-	MONT_ADD(t0, t1, t2, s0, s1, s2);-	z[17] = t0;-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 42 */-	MONT_MUL(s0, s1, s2, a[19], a[23]);-	MONT_MUL(c0, c1, c2, a[20], a[22]);-	MONT_MAC(t0, t1, t2, a[21], a[21]);-	MONT_MUL(v0, v1, v2, u[19], m[23]);-	MONT_MUL(w0, w1, w2, u[20], m[22]);-	MONT_MAC(t0, t1, t2, u[21], m[21]);-	MONT_MAC(v0, v1, v2, u[22], m[20]);-	MONT_MAC(w0, w1, w2, u[23], m[19]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_ADD(t0, t1, t2, w0, w1, w2);-	MONT_ADD(s0, s1, s2, c0, c1, c2);-	MONT_DBL(s0, s1, s2);-	MONT_ADD(t0, t1, t2, s0, s1, s2);-	z[18] = t0;-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 43 */-	MONT_MUL(s0, s1, s2, a[20], a[23]);-	MONT_MUL(c0, c1, c2, a[21], a[22]);-	MONT_MAC(t0, t1, t2, u[20], m[23]);-	MONT_MUL(v0, v1, v2, u[21], m[22]);-	MONT_MUL(w0, w1, w2, u[22], m[21]);-	MONT_MAC(t0, t1, t2, u[23], m[20]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_ADD(t0, t1, t2, w0, w1, w2);-	MONT_ADD(s0, s1, s2, c0, c1, c2);-	MONT_DBL(s0, s1, s2);-	MONT_ADD(t0, t1, t2, s0, s1, s2);-	z[19] = t0;-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 44 */-	MONT_MUL(s0, s1, s2, a[21], a[23]);-	MONT_MAC(t0, t1, t2, a[22], a[22]);-	MONT_MUL(v0, v1, v2, u[21], m[23]);-	MONT_MUL(w0, w1, w2, u[22], m[22]);-	MONT_MAC(t0, t1, t2, u[23], m[21]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_ADD(t0, t1, t2, w0, w1, w2);-	MONT_DBL(s0, s1, s2);-	MONT_ADD(t0, t1, t2, s0, s1, s2);-	z[20] = t0;-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 45 */-	MONT_MUL(s0, s1, s2, a[22], a[23]);-	MONT_MAC(t0, t1, t2, u[22], m[23]);-	MONT_MUL(v0, v1, v2, u[23], m[22]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_DBL(s0, s1, s2);-	MONT_ADD(t0, t1, t2, s0, s1, s2);-	z[21] = t0;-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 46 */-	MONT_MAC(t0, t1, t2, a[23], a[23]);-	MONT_MUL(v0, v1, v2, u[23], m[23]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	z[22] = t0;-	t0 = t1;-	t1 = t2;-	t2 = 0;-	z[23] = t0;--	/* under 2m, with t1 the bit above n limbs: at most one subtraction */-	borrow = sub_n(r, z, m, 24);-	take = t1 | (borrow ^ 1);-	select_n(r, r, z, take & 1, 24);-}--/* r = a * b * R^-1 mod m, for a and b under m; t is 2n limbs of scratch */-static void crypton_mont_mul32(limb_t *r, const limb_t *a, const limb_t *b,-                               const limb_t *m, limb_t n0, limb_t *t)-{-	limb_t *u = t, *z = t + 32;-	limb_t t0 = 0, t1 = 0, t2 = 0, v0, v1, v2, w0, w1, w2, borrow, take;--	/* column 0 */-	MONT_MAC(t0, t1, t2, a[0], b[0]);-	u[0] = t0 * n0;-	MONT_MAC(t0, t1, t2, u[0], m[0]);-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 1 */-	MONT_MAC(t0, t1, t2, a[0], b[1]);-	MONT_MUL(v0, v1, v2, a[1], b[0]);-	MONT_MUL(w0, w1, w2, u[0], m[1]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_ADD(t0, t1, t2, w0, w1, w2);-	u[1] = t0 * n0;-	MONT_MAC(t0, t1, t2, u[1], m[0]);-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 2 */-	MONT_MAC(t0, t1, t2, a[0], b[2]);-	MONT_MUL(v0, v1, v2, a[1], b[1]);-	MONT_MUL(w0, w1, w2, a[2], b[0]);-	MONT_MAC(t0, t1, t2, u[0], m[2]);-	MONT_MAC(v0, v1, v2, u[1], m[1]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_ADD(t0, t1, t2, w0, w1, w2);-	u[2] = t0 * n0;-	MONT_MAC(t0, t1, t2, u[2], m[0]);-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 3 */-	MONT_MAC(t0, t1, t2, a[0], b[3]);-	MONT_MUL(v0, v1, v2, a[1], b[2]);-	MONT_MUL(w0, w1, w2, a[2], b[1]);-	MONT_MAC(t0, t1, t2, a[3], b[0]);-	MONT_MAC(v0, v1, v2, u[0], m[3]);-	MONT_MAC(w0, w1, w2, u[1], m[2]);-	MONT_MAC(t0, t1, t2, u[2], m[1]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_ADD(t0, t1, t2, w0, w1, w2);-	u[3] = t0 * n0;-	MONT_MAC(t0, t1, t2, u[3], m[0]);-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 4 */-	MONT_MAC(t0, t1, t2, a[0], b[4]);-	MONT_MUL(v0, v1, v2, a[1], b[3]);-	MONT_MUL(w0, w1, w2, a[2], b[2]);-	MONT_MAC(t0, t1, t2, a[3], b[1]);-	MONT_MAC(v0, v1, v2, a[4], b[0]);-	MONT_MAC(w0, w1, w2, u[0], m[4]);-	MONT_MAC(t0, t1, t2, u[1], m[3]);-	MONT_MAC(v0, v1, v2, u[2], m[2]);-	MONT_MAC(w0, w1, w2, u[3], m[1]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_ADD(t0, t1, t2, w0, w1, w2);-	u[4] = t0 * n0;-	MONT_MAC(t0, t1, t2, u[4], m[0]);-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 5 */-	MONT_MAC(t0, t1, t2, a[0], b[5]);-	MONT_MUL(v0, v1, v2, a[1], b[4]);-	MONT_MUL(w0, w1, w2, a[2], b[3]);-	MONT_MAC(t0, t1, t2, a[3], b[2]);-	MONT_MAC(v0, v1, v2, a[4], b[1]);-	MONT_MAC(w0, w1, w2, a[5], b[0]);-	MONT_MAC(t0, t1, t2, u[0], m[5]);-	MONT_MAC(v0, v1, v2, u[1], m[4]);-	MONT_MAC(w0, w1, w2, u[2], m[3]);-	MONT_MAC(t0, t1, t2, u[3], m[2]);-	MONT_MAC(v0, v1, v2, u[4], m[1]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_ADD(t0, t1, t2, w0, w1, w2);-	u[5] = t0 * n0;-	MONT_MAC(t0, t1, t2, u[5], m[0]);-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 6 */-	MONT_MAC(t0, t1, t2, a[0], b[6]);-	MONT_MUL(v0, v1, v2, a[1], b[5]);-	MONT_MUL(w0, w1, w2, a[2], b[4]);-	MONT_MAC(t0, t1, t2, a[3], b[3]);-	MONT_MAC(v0, v1, v2, a[4], b[2]);-	MONT_MAC(w0, w1, w2, a[5], b[1]);-	MONT_MAC(t0, t1, t2, a[6], b[0]);-	MONT_MAC(v0, v1, v2, u[0], m[6]);-	MONT_MAC(w0, w1, w2, u[1], m[5]);-	MONT_MAC(t0, t1, t2, u[2], m[4]);-	MONT_MAC(v0, v1, v2, u[3], m[3]);-	MONT_MAC(w0, w1, w2, u[4], m[2]);-	MONT_MAC(t0, t1, t2, u[5], m[1]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_ADD(t0, t1, t2, w0, w1, w2);-	u[6] = t0 * n0;-	MONT_MAC(t0, t1, t2, u[6], m[0]);-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 7 */-	MONT_MAC(t0, t1, t2, a[0], b[7]);-	MONT_MUL(v0, v1, v2, a[1], b[6]);-	MONT_MUL(w0, w1, w2, a[2], b[5]);-	MONT_MAC(t0, t1, t2, a[3], b[4]);-	MONT_MAC(v0, v1, v2, a[4], b[3]);-	MONT_MAC(w0, w1, w2, a[5], b[2]);-	MONT_MAC(t0, t1, t2, a[6], b[1]);-	MONT_MAC(v0, v1, v2, a[7], b[0]);-	MONT_MAC(w0, w1, w2, u[0], m[7]);-	MONT_MAC(t0, t1, t2, u[1], m[6]);-	MONT_MAC(v0, v1, v2, u[2], m[5]);-	MONT_MAC(w0, w1, w2, u[3], m[4]);-	MONT_MAC(t0, t1, t2, u[4], m[3]);-	MONT_MAC(v0, v1, v2, u[5], m[2]);-	MONT_MAC(w0, w1, w2, u[6], m[1]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_ADD(t0, t1, t2, w0, w1, w2);-	u[7] = t0 * n0;-	MONT_MAC(t0, t1, t2, u[7], m[0]);-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 8 */-	MONT_MAC(t0, t1, t2, a[0], b[8]);-	MONT_MUL(v0, v1, v2, a[1], b[7]);-	MONT_MUL(w0, w1, w2, a[2], b[6]);-	MONT_MAC(t0, t1, t2, a[3], b[5]);-	MONT_MAC(v0, v1, v2, a[4], b[4]);-	MONT_MAC(w0, w1, w2, a[5], b[3]);-	MONT_MAC(t0, t1, t2, a[6], b[2]);-	MONT_MAC(v0, v1, v2, a[7], b[1]);-	MONT_MAC(w0, w1, w2, a[8], b[0]);-	MONT_MAC(t0, t1, t2, u[0], m[8]);-	MONT_MAC(v0, v1, v2, u[1], m[7]);-	MONT_MAC(w0, w1, w2, u[2], m[6]);-	MONT_MAC(t0, t1, t2, u[3], m[5]);-	MONT_MAC(v0, v1, v2, u[4], m[4]);-	MONT_MAC(w0, w1, w2, u[5], m[3]);-	MONT_MAC(t0, t1, t2, u[6], m[2]);-	MONT_MAC(v0, v1, v2, u[7], m[1]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_ADD(t0, t1, t2, w0, w1, w2);-	u[8] = t0 * n0;-	MONT_MAC(t0, t1, t2, u[8], m[0]);-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 9 */-	MONT_MAC(t0, t1, t2, a[0], b[9]);-	MONT_MUL(v0, v1, v2, a[1], b[8]);-	MONT_MUL(w0, w1, w2, a[2], b[7]);-	MONT_MAC(t0, t1, t2, a[3], b[6]);-	MONT_MAC(v0, v1, v2, a[4], b[5]);-	MONT_MAC(w0, w1, w2, a[5], b[4]);-	MONT_MAC(t0, t1, t2, a[6], b[3]);-	MONT_MAC(v0, v1, v2, a[7], b[2]);-	MONT_MAC(w0, w1, w2, a[8], b[1]);-	MONT_MAC(t0, t1, t2, a[9], b[0]);-	MONT_MAC(v0, v1, v2, u[0], m[9]);-	MONT_MAC(w0, w1, w2, u[1], m[8]);-	MONT_MAC(t0, t1, t2, u[2], m[7]);-	MONT_MAC(v0, v1, v2, u[3], m[6]);-	MONT_MAC(w0, w1, w2, u[4], m[5]);-	MONT_MAC(t0, t1, t2, u[5], m[4]);-	MONT_MAC(v0, v1, v2, u[6], m[3]);-	MONT_MAC(w0, w1, w2, u[7], m[2]);-	MONT_MAC(t0, t1, t2, u[8], m[1]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_ADD(t0, t1, t2, w0, w1, w2);-	u[9] = t0 * n0;-	MONT_MAC(t0, t1, t2, u[9], m[0]);-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 10 */-	MONT_MAC(t0, t1, t2, a[0], b[10]);-	MONT_MUL(v0, v1, v2, a[1], b[9]);-	MONT_MUL(w0, w1, w2, a[2], b[8]);-	MONT_MAC(t0, t1, t2, a[3], b[7]);-	MONT_MAC(v0, v1, v2, a[4], b[6]);-	MONT_MAC(w0, w1, w2, a[5], b[5]);-	MONT_MAC(t0, t1, t2, a[6], b[4]);-	MONT_MAC(v0, v1, v2, a[7], b[3]);-	MONT_MAC(w0, w1, w2, a[8], b[2]);-	MONT_MAC(t0, t1, t2, a[9], b[1]);-	MONT_MAC(v0, v1, v2, a[10], b[0]);-	MONT_MAC(w0, w1, w2, u[0], m[10]);-	MONT_MAC(t0, t1, t2, u[1], m[9]);-	MONT_MAC(v0, v1, v2, u[2], m[8]);-	MONT_MAC(w0, w1, w2, u[3], m[7]);-	MONT_MAC(t0, t1, t2, u[4], m[6]);-	MONT_MAC(v0, v1, v2, u[5], m[5]);-	MONT_MAC(w0, w1, w2, u[6], m[4]);-	MONT_MAC(t0, t1, t2, u[7], m[3]);-	MONT_MAC(v0, v1, v2, u[8], m[2]);-	MONT_MAC(w0, w1, w2, u[9], m[1]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_ADD(t0, t1, t2, w0, w1, w2);-	u[10] = t0 * n0;-	MONT_MAC(t0, t1, t2, u[10], m[0]);-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 11 */-	MONT_MAC(t0, t1, t2, a[0], b[11]);-	MONT_MUL(v0, v1, v2, a[1], b[10]);-	MONT_MUL(w0, w1, w2, a[2], b[9]);-	MONT_MAC(t0, t1, t2, a[3], b[8]);-	MONT_MAC(v0, v1, v2, a[4], b[7]);-	MONT_MAC(w0, w1, w2, a[5], b[6]);-	MONT_MAC(t0, t1, t2, a[6], b[5]);-	MONT_MAC(v0, v1, v2, a[7], b[4]);-	MONT_MAC(w0, w1, w2, a[8], b[3]);-	MONT_MAC(t0, t1, t2, a[9], b[2]);-	MONT_MAC(v0, v1, v2, a[10], b[1]);-	MONT_MAC(w0, w1, w2, a[11], b[0]);-	MONT_MAC(t0, t1, t2, u[0], m[11]);-	MONT_MAC(v0, v1, v2, u[1], m[10]);-	MONT_MAC(w0, w1, w2, u[2], m[9]);-	MONT_MAC(t0, t1, t2, u[3], m[8]);-	MONT_MAC(v0, v1, v2, u[4], m[7]);-	MONT_MAC(w0, w1, w2, u[5], m[6]);-	MONT_MAC(t0, t1, t2, u[6], m[5]);-	MONT_MAC(v0, v1, v2, u[7], m[4]);-	MONT_MAC(w0, w1, w2, u[8], m[3]);-	MONT_MAC(t0, t1, t2, u[9], m[2]);-	MONT_MAC(v0, v1, v2, u[10], m[1]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_ADD(t0, t1, t2, w0, w1, w2);-	u[11] = t0 * n0;-	MONT_MAC(t0, t1, t2, u[11], m[0]);-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 12 */-	MONT_MAC(t0, t1, t2, a[0], b[12]);-	MONT_MUL(v0, v1, v2, a[1], b[11]);-	MONT_MUL(w0, w1, w2, a[2], b[10]);-	MONT_MAC(t0, t1, t2, a[3], b[9]);-	MONT_MAC(v0, v1, v2, a[4], b[8]);-	MONT_MAC(w0, w1, w2, a[5], b[7]);-	MONT_MAC(t0, t1, t2, a[6], b[6]);-	MONT_MAC(v0, v1, v2, a[7], b[5]);-	MONT_MAC(w0, w1, w2, a[8], b[4]);-	MONT_MAC(t0, t1, t2, a[9], b[3]);-	MONT_MAC(v0, v1, v2, a[10], b[2]);-	MONT_MAC(w0, w1, w2, a[11], b[1]);-	MONT_MAC(t0, t1, t2, a[12], b[0]);-	MONT_MAC(v0, v1, v2, u[0], m[12]);-	MONT_MAC(w0, w1, w2, u[1], m[11]);-	MONT_MAC(t0, t1, t2, u[2], m[10]);-	MONT_MAC(v0, v1, v2, u[3], m[9]);-	MONT_MAC(w0, w1, w2, u[4], m[8]);-	MONT_MAC(t0, t1, t2, u[5], m[7]);-	MONT_MAC(v0, v1, v2, u[6], m[6]);-	MONT_MAC(w0, w1, w2, u[7], m[5]);-	MONT_MAC(t0, t1, t2, u[8], m[4]);-	MONT_MAC(v0, v1, v2, u[9], m[3]);-	MONT_MAC(w0, w1, w2, u[10], m[2]);-	MONT_MAC(t0, t1, t2, u[11], m[1]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_ADD(t0, t1, t2, w0, w1, w2);-	u[12] = t0 * n0;-	MONT_MAC(t0, t1, t2, u[12], m[0]);-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 13 */-	MONT_MAC(t0, t1, t2, a[0], b[13]);-	MONT_MUL(v0, v1, v2, a[1], b[12]);-	MONT_MUL(w0, w1, w2, a[2], b[11]);-	MONT_MAC(t0, t1, t2, a[3], b[10]);-	MONT_MAC(v0, v1, v2, a[4], b[9]);-	MONT_MAC(w0, w1, w2, a[5], b[8]);-	MONT_MAC(t0, t1, t2, a[6], b[7]);-	MONT_MAC(v0, v1, v2, a[7], b[6]);-	MONT_MAC(w0, w1, w2, a[8], b[5]);-	MONT_MAC(t0, t1, t2, a[9], b[4]);-	MONT_MAC(v0, v1, v2, a[10], b[3]);-	MONT_MAC(w0, w1, w2, a[11], b[2]);-	MONT_MAC(t0, t1, t2, a[12], b[1]);-	MONT_MAC(v0, v1, v2, a[13], b[0]);-	MONT_MAC(w0, w1, w2, u[0], m[13]);-	MONT_MAC(t0, t1, t2, u[1], m[12]);-	MONT_MAC(v0, v1, v2, u[2], m[11]);-	MONT_MAC(w0, w1, w2, u[3], m[10]);-	MONT_MAC(t0, t1, t2, u[4], m[9]);-	MONT_MAC(v0, v1, v2, u[5], m[8]);-	MONT_MAC(w0, w1, w2, u[6], m[7]);-	MONT_MAC(t0, t1, t2, u[7], m[6]);-	MONT_MAC(v0, v1, v2, u[8], m[5]);-	MONT_MAC(w0, w1, w2, u[9], m[4]);-	MONT_MAC(t0, t1, t2, u[10], m[3]);-	MONT_MAC(v0, v1, v2, u[11], m[2]);-	MONT_MAC(w0, w1, w2, u[12], m[1]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_ADD(t0, t1, t2, w0, w1, w2);-	u[13] = t0 * n0;-	MONT_MAC(t0, t1, t2, u[13], m[0]);-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 14 */-	MONT_MAC(t0, t1, t2, a[0], b[14]);-	MONT_MUL(v0, v1, v2, a[1], b[13]);-	MONT_MUL(w0, w1, w2, a[2], b[12]);-	MONT_MAC(t0, t1, t2, a[3], b[11]);-	MONT_MAC(v0, v1, v2, a[4], b[10]);-	MONT_MAC(w0, w1, w2, a[5], b[9]);-	MONT_MAC(t0, t1, t2, a[6], b[8]);-	MONT_MAC(v0, v1, v2, a[7], b[7]);-	MONT_MAC(w0, w1, w2, a[8], b[6]);-	MONT_MAC(t0, t1, t2, a[9], b[5]);-	MONT_MAC(v0, v1, v2, a[10], b[4]);-	MONT_MAC(w0, w1, w2, a[11], b[3]);-	MONT_MAC(t0, t1, t2, a[12], b[2]);-	MONT_MAC(v0, v1, v2, a[13], b[1]);-	MONT_MAC(w0, w1, w2, a[14], b[0]);-	MONT_MAC(t0, t1, t2, u[0], m[14]);-	MONT_MAC(v0, v1, v2, u[1], m[13]);-	MONT_MAC(w0, w1, w2, u[2], m[12]);-	MONT_MAC(t0, t1, t2, u[3], m[11]);-	MONT_MAC(v0, v1, v2, u[4], m[10]);-	MONT_MAC(w0, w1, w2, u[5], m[9]);-	MONT_MAC(t0, t1, t2, u[6], m[8]);-	MONT_MAC(v0, v1, v2, u[7], m[7]);-	MONT_MAC(w0, w1, w2, u[8], m[6]);-	MONT_MAC(t0, t1, t2, u[9], m[5]);-	MONT_MAC(v0, v1, v2, u[10], m[4]);-	MONT_MAC(w0, w1, w2, u[11], m[3]);-	MONT_MAC(t0, t1, t2, u[12], m[2]);-	MONT_MAC(v0, v1, v2, u[13], m[1]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_ADD(t0, t1, t2, w0, w1, w2);-	u[14] = t0 * n0;-	MONT_MAC(t0, t1, t2, u[14], m[0]);-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 15 */-	MONT_MAC(t0, t1, t2, a[0], b[15]);-	MONT_MUL(v0, v1, v2, a[1], b[14]);-	MONT_MUL(w0, w1, w2, a[2], b[13]);-	MONT_MAC(t0, t1, t2, a[3], b[12]);-	MONT_MAC(v0, v1, v2, a[4], b[11]);-	MONT_MAC(w0, w1, w2, a[5], b[10]);-	MONT_MAC(t0, t1, t2, a[6], b[9]);-	MONT_MAC(v0, v1, v2, a[7], b[8]);-	MONT_MAC(w0, w1, w2, a[8], b[7]);-	MONT_MAC(t0, t1, t2, a[9], b[6]);-	MONT_MAC(v0, v1, v2, a[10], b[5]);-	MONT_MAC(w0, w1, w2, a[11], b[4]);-	MONT_MAC(t0, t1, t2, a[12], b[3]);-	MONT_MAC(v0, v1, v2, a[13], b[2]);-	MONT_MAC(w0, w1, w2, a[14], b[1]);-	MONT_MAC(t0, t1, t2, a[15], b[0]);-	MONT_MAC(v0, v1, v2, u[0], m[15]);-	MONT_MAC(w0, w1, w2, u[1], m[14]);-	MONT_MAC(t0, t1, t2, u[2], m[13]);-	MONT_MAC(v0, v1, v2, u[3], m[12]);-	MONT_MAC(w0, w1, w2, u[4], m[11]);-	MONT_MAC(t0, t1, t2, u[5], m[10]);-	MONT_MAC(v0, v1, v2, u[6], m[9]);-	MONT_MAC(w0, w1, w2, u[7], m[8]);-	MONT_MAC(t0, t1, t2, u[8], m[7]);-	MONT_MAC(v0, v1, v2, u[9], m[6]);-	MONT_MAC(w0, w1, w2, u[10], m[5]);-	MONT_MAC(t0, t1, t2, u[11], m[4]);-	MONT_MAC(v0, v1, v2, u[12], m[3]);-	MONT_MAC(w0, w1, w2, u[13], m[2]);-	MONT_MAC(t0, t1, t2, u[14], m[1]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_ADD(t0, t1, t2, w0, w1, w2);-	u[15] = t0 * n0;-	MONT_MAC(t0, t1, t2, u[15], m[0]);-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 16 */-	MONT_MAC(t0, t1, t2, a[0], b[16]);-	MONT_MUL(v0, v1, v2, a[1], b[15]);-	MONT_MUL(w0, w1, w2, a[2], b[14]);-	MONT_MAC(t0, t1, t2, a[3], b[13]);-	MONT_MAC(v0, v1, v2, a[4], b[12]);-	MONT_MAC(w0, w1, w2, a[5], b[11]);-	MONT_MAC(t0, t1, t2, a[6], b[10]);-	MONT_MAC(v0, v1, v2, a[7], b[9]);-	MONT_MAC(w0, w1, w2, a[8], b[8]);-	MONT_MAC(t0, t1, t2, a[9], b[7]);-	MONT_MAC(v0, v1, v2, a[10], b[6]);-	MONT_MAC(w0, w1, w2, a[11], b[5]);-	MONT_MAC(t0, t1, t2, a[12], b[4]);-	MONT_MAC(v0, v1, v2, a[13], b[3]);-	MONT_MAC(w0, w1, w2, a[14], b[2]);-	MONT_MAC(t0, t1, t2, a[15], b[1]);-	MONT_MAC(v0, v1, v2, a[16], b[0]);-	MONT_MAC(w0, w1, w2, u[0], m[16]);-	MONT_MAC(t0, t1, t2, u[1], m[15]);-	MONT_MAC(v0, v1, v2, u[2], m[14]);-	MONT_MAC(w0, w1, w2, u[3], m[13]);-	MONT_MAC(t0, t1, t2, u[4], m[12]);-	MONT_MAC(v0, v1, v2, u[5], m[11]);-	MONT_MAC(w0, w1, w2, u[6], m[10]);-	MONT_MAC(t0, t1, t2, u[7], m[9]);-	MONT_MAC(v0, v1, v2, u[8], m[8]);-	MONT_MAC(w0, w1, w2, u[9], m[7]);-	MONT_MAC(t0, t1, t2, u[10], m[6]);-	MONT_MAC(v0, v1, v2, u[11], m[5]);-	MONT_MAC(w0, w1, w2, u[12], m[4]);-	MONT_MAC(t0, t1, t2, u[13], m[3]);-	MONT_MAC(v0, v1, v2, u[14], m[2]);-	MONT_MAC(w0, w1, w2, u[15], m[1]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_ADD(t0, t1, t2, w0, w1, w2);-	u[16] = t0 * n0;-	MONT_MAC(t0, t1, t2, u[16], m[0]);-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 17 */-	MONT_MAC(t0, t1, t2, a[0], b[17]);-	MONT_MUL(v0, v1, v2, a[1], b[16]);-	MONT_MUL(w0, w1, w2, a[2], b[15]);-	MONT_MAC(t0, t1, t2, a[3], b[14]);-	MONT_MAC(v0, v1, v2, a[4], b[13]);-	MONT_MAC(w0, w1, w2, a[5], b[12]);-	MONT_MAC(t0, t1, t2, a[6], b[11]);-	MONT_MAC(v0, v1, v2, a[7], b[10]);-	MONT_MAC(w0, w1, w2, a[8], b[9]);-	MONT_MAC(t0, t1, t2, a[9], b[8]);-	MONT_MAC(v0, v1, v2, a[10], b[7]);-	MONT_MAC(w0, w1, w2, a[11], b[6]);-	MONT_MAC(t0, t1, t2, a[12], b[5]);-	MONT_MAC(v0, v1, v2, a[13], b[4]);-	MONT_MAC(w0, w1, w2, a[14], b[3]);-	MONT_MAC(t0, t1, t2, a[15], b[2]);-	MONT_MAC(v0, v1, v2, a[16], b[1]);-	MONT_MAC(w0, w1, w2, a[17], b[0]);-	MONT_MAC(t0, t1, t2, u[0], m[17]);-	MONT_MAC(v0, v1, v2, u[1], m[16]);-	MONT_MAC(w0, w1, w2, u[2], m[15]);-	MONT_MAC(t0, t1, t2, u[3], m[14]);-	MONT_MAC(v0, v1, v2, u[4], m[13]);-	MONT_MAC(w0, w1, w2, u[5], m[12]);-	MONT_MAC(t0, t1, t2, u[6], m[11]);-	MONT_MAC(v0, v1, v2, u[7], m[10]);-	MONT_MAC(w0, w1, w2, u[8], m[9]);-	MONT_MAC(t0, t1, t2, u[9], m[8]);-	MONT_MAC(v0, v1, v2, u[10], m[7]);-	MONT_MAC(w0, w1, w2, u[11], m[6]);-	MONT_MAC(t0, t1, t2, u[12], m[5]);-	MONT_MAC(v0, v1, v2, u[13], m[4]);-	MONT_MAC(w0, w1, w2, u[14], m[3]);-	MONT_MAC(t0, t1, t2, u[15], m[2]);-	MONT_MAC(v0, v1, v2, u[16], m[1]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_ADD(t0, t1, t2, w0, w1, w2);-	u[17] = t0 * n0;-	MONT_MAC(t0, t1, t2, u[17], m[0]);-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 18 */-	MONT_MAC(t0, t1, t2, a[0], b[18]);-	MONT_MUL(v0, v1, v2, a[1], b[17]);-	MONT_MUL(w0, w1, w2, a[2], b[16]);-	MONT_MAC(t0, t1, t2, a[3], b[15]);-	MONT_MAC(v0, v1, v2, a[4], b[14]);-	MONT_MAC(w0, w1, w2, a[5], b[13]);-	MONT_MAC(t0, t1, t2, a[6], b[12]);-	MONT_MAC(v0, v1, v2, a[7], b[11]);-	MONT_MAC(w0, w1, w2, a[8], b[10]);-	MONT_MAC(t0, t1, t2, a[9], b[9]);-	MONT_MAC(v0, v1, v2, a[10], b[8]);-	MONT_MAC(w0, w1, w2, a[11], b[7]);-	MONT_MAC(t0, t1, t2, a[12], b[6]);-	MONT_MAC(v0, v1, v2, a[13], b[5]);-	MONT_MAC(w0, w1, w2, a[14], b[4]);-	MONT_MAC(t0, t1, t2, a[15], b[3]);-	MONT_MAC(v0, v1, v2, a[16], b[2]);-	MONT_MAC(w0, w1, w2, a[17], b[1]);-	MONT_MAC(t0, t1, t2, a[18], b[0]);-	MONT_MAC(v0, v1, v2, u[0], m[18]);-	MONT_MAC(w0, w1, w2, u[1], m[17]);-	MONT_MAC(t0, t1, t2, u[2], m[16]);-	MONT_MAC(v0, v1, v2, u[3], m[15]);-	MONT_MAC(w0, w1, w2, u[4], m[14]);-	MONT_MAC(t0, t1, t2, u[5], m[13]);-	MONT_MAC(v0, v1, v2, u[6], m[12]);-	MONT_MAC(w0, w1, w2, u[7], m[11]);-	MONT_MAC(t0, t1, t2, u[8], m[10]);-	MONT_MAC(v0, v1, v2, u[9], m[9]);-	MONT_MAC(w0, w1, w2, u[10], m[8]);-	MONT_MAC(t0, t1, t2, u[11], m[7]);-	MONT_MAC(v0, v1, v2, u[12], m[6]);-	MONT_MAC(w0, w1, w2, u[13], m[5]);-	MONT_MAC(t0, t1, t2, u[14], m[4]);-	MONT_MAC(v0, v1, v2, u[15], m[3]);-	MONT_MAC(w0, w1, w2, u[16], m[2]);-	MONT_MAC(t0, t1, t2, u[17], m[1]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_ADD(t0, t1, t2, w0, w1, w2);-	u[18] = t0 * n0;-	MONT_MAC(t0, t1, t2, u[18], m[0]);-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 19 */-	MONT_MAC(t0, t1, t2, a[0], b[19]);-	MONT_MUL(v0, v1, v2, a[1], b[18]);-	MONT_MUL(w0, w1, w2, a[2], b[17]);-	MONT_MAC(t0, t1, t2, a[3], b[16]);-	MONT_MAC(v0, v1, v2, a[4], b[15]);-	MONT_MAC(w0, w1, w2, a[5], b[14]);-	MONT_MAC(t0, t1, t2, a[6], b[13]);-	MONT_MAC(v0, v1, v2, a[7], b[12]);-	MONT_MAC(w0, w1, w2, a[8], b[11]);-	MONT_MAC(t0, t1, t2, a[9], b[10]);-	MONT_MAC(v0, v1, v2, a[10], b[9]);-	MONT_MAC(w0, w1, w2, a[11], b[8]);-	MONT_MAC(t0, t1, t2, a[12], b[7]);-	MONT_MAC(v0, v1, v2, a[13], b[6]);-	MONT_MAC(w0, w1, w2, a[14], b[5]);-	MONT_MAC(t0, t1, t2, a[15], b[4]);-	MONT_MAC(v0, v1, v2, a[16], b[3]);-	MONT_MAC(w0, w1, w2, a[17], b[2]);-	MONT_MAC(t0, t1, t2, a[18], b[1]);-	MONT_MAC(v0, v1, v2, a[19], b[0]);-	MONT_MAC(w0, w1, w2, u[0], m[19]);-	MONT_MAC(t0, t1, t2, u[1], m[18]);-	MONT_MAC(v0, v1, v2, u[2], m[17]);-	MONT_MAC(w0, w1, w2, u[3], m[16]);-	MONT_MAC(t0, t1, t2, u[4], m[15]);-	MONT_MAC(v0, v1, v2, u[5], m[14]);-	MONT_MAC(w0, w1, w2, u[6], m[13]);-	MONT_MAC(t0, t1, t2, u[7], m[12]);-	MONT_MAC(v0, v1, v2, u[8], m[11]);-	MONT_MAC(w0, w1, w2, u[9], m[10]);-	MONT_MAC(t0, t1, t2, u[10], m[9]);-	MONT_MAC(v0, v1, v2, u[11], m[8]);-	MONT_MAC(w0, w1, w2, u[12], m[7]);-	MONT_MAC(t0, t1, t2, u[13], m[6]);-	MONT_MAC(v0, v1, v2, u[14], m[5]);-	MONT_MAC(w0, w1, w2, u[15], m[4]);-	MONT_MAC(t0, t1, t2, u[16], m[3]);-	MONT_MAC(v0, v1, v2, u[17], m[2]);-	MONT_MAC(w0, w1, w2, u[18], m[1]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_ADD(t0, t1, t2, w0, w1, w2);-	u[19] = t0 * n0;-	MONT_MAC(t0, t1, t2, u[19], m[0]);-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 20 */-	MONT_MAC(t0, t1, t2, a[0], b[20]);-	MONT_MUL(v0, v1, v2, a[1], b[19]);-	MONT_MUL(w0, w1, w2, a[2], b[18]);-	MONT_MAC(t0, t1, t2, a[3], b[17]);-	MONT_MAC(v0, v1, v2, a[4], b[16]);-	MONT_MAC(w0, w1, w2, a[5], b[15]);-	MONT_MAC(t0, t1, t2, a[6], b[14]);-	MONT_MAC(v0, v1, v2, a[7], b[13]);-	MONT_MAC(w0, w1, w2, a[8], b[12]);-	MONT_MAC(t0, t1, t2, a[9], b[11]);-	MONT_MAC(v0, v1, v2, a[10], b[10]);-	MONT_MAC(w0, w1, w2, a[11], b[9]);-	MONT_MAC(t0, t1, t2, a[12], b[8]);-	MONT_MAC(v0, v1, v2, a[13], b[7]);-	MONT_MAC(w0, w1, w2, a[14], b[6]);-	MONT_MAC(t0, t1, t2, a[15], b[5]);-	MONT_MAC(v0, v1, v2, a[16], b[4]);-	MONT_MAC(w0, w1, w2, a[17], b[3]);-	MONT_MAC(t0, t1, t2, a[18], b[2]);-	MONT_MAC(v0, v1, v2, a[19], b[1]);-	MONT_MAC(w0, w1, w2, a[20], b[0]);-	MONT_MAC(t0, t1, t2, u[0], m[20]);-	MONT_MAC(v0, v1, v2, u[1], m[19]);-	MONT_MAC(w0, w1, w2, u[2], m[18]);-	MONT_MAC(t0, t1, t2, u[3], m[17]);-	MONT_MAC(v0, v1, v2, u[4], m[16]);-	MONT_MAC(w0, w1, w2, u[5], m[15]);-	MONT_MAC(t0, t1, t2, u[6], m[14]);-	MONT_MAC(v0, v1, v2, u[7], m[13]);-	MONT_MAC(w0, w1, w2, u[8], m[12]);-	MONT_MAC(t0, t1, t2, u[9], m[11]);-	MONT_MAC(v0, v1, v2, u[10], m[10]);-	MONT_MAC(w0, w1, w2, u[11], m[9]);-	MONT_MAC(t0, t1, t2, u[12], m[8]);-	MONT_MAC(v0, v1, v2, u[13], m[7]);-	MONT_MAC(w0, w1, w2, u[14], m[6]);-	MONT_MAC(t0, t1, t2, u[15], m[5]);-	MONT_MAC(v0, v1, v2, u[16], m[4]);-	MONT_MAC(w0, w1, w2, u[17], m[3]);-	MONT_MAC(t0, t1, t2, u[18], m[2]);-	MONT_MAC(v0, v1, v2, u[19], m[1]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_ADD(t0, t1, t2, w0, w1, w2);-	u[20] = t0 * n0;-	MONT_MAC(t0, t1, t2, u[20], m[0]);-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 21 */-	MONT_MAC(t0, t1, t2, a[0], b[21]);-	MONT_MUL(v0, v1, v2, a[1], b[20]);-	MONT_MUL(w0, w1, w2, a[2], b[19]);-	MONT_MAC(t0, t1, t2, a[3], b[18]);-	MONT_MAC(v0, v1, v2, a[4], b[17]);-	MONT_MAC(w0, w1, w2, a[5], b[16]);-	MONT_MAC(t0, t1, t2, a[6], b[15]);-	MONT_MAC(v0, v1, v2, a[7], b[14]);-	MONT_MAC(w0, w1, w2, a[8], b[13]);-	MONT_MAC(t0, t1, t2, a[9], b[12]);-	MONT_MAC(v0, v1, v2, a[10], b[11]);-	MONT_MAC(w0, w1, w2, a[11], b[10]);-	MONT_MAC(t0, t1, t2, a[12], b[9]);-	MONT_MAC(v0, v1, v2, a[13], b[8]);-	MONT_MAC(w0, w1, w2, a[14], b[7]);-	MONT_MAC(t0, t1, t2, a[15], b[6]);-	MONT_MAC(v0, v1, v2, a[16], b[5]);-	MONT_MAC(w0, w1, w2, a[17], b[4]);-	MONT_MAC(t0, t1, t2, a[18], b[3]);-	MONT_MAC(v0, v1, v2, a[19], b[2]);-	MONT_MAC(w0, w1, w2, a[20], b[1]);-	MONT_MAC(t0, t1, t2, a[21], b[0]);-	MONT_MAC(v0, v1, v2, u[0], m[21]);-	MONT_MAC(w0, w1, w2, u[1], m[20]);-	MONT_MAC(t0, t1, t2, u[2], m[19]);-	MONT_MAC(v0, v1, v2, u[3], m[18]);-	MONT_MAC(w0, w1, w2, u[4], m[17]);-	MONT_MAC(t0, t1, t2, u[5], m[16]);-	MONT_MAC(v0, v1, v2, u[6], m[15]);-	MONT_MAC(w0, w1, w2, u[7], m[14]);-	MONT_MAC(t0, t1, t2, u[8], m[13]);-	MONT_MAC(v0, v1, v2, u[9], m[12]);-	MONT_MAC(w0, w1, w2, u[10], m[11]);-	MONT_MAC(t0, t1, t2, u[11], m[10]);-	MONT_MAC(v0, v1, v2, u[12], m[9]);-	MONT_MAC(w0, w1, w2, u[13], m[8]);-	MONT_MAC(t0, t1, t2, u[14], m[7]);-	MONT_MAC(v0, v1, v2, u[15], m[6]);-	MONT_MAC(w0, w1, w2, u[16], m[5]);-	MONT_MAC(t0, t1, t2, u[17], m[4]);-	MONT_MAC(v0, v1, v2, u[18], m[3]);-	MONT_MAC(w0, w1, w2, u[19], m[2]);-	MONT_MAC(t0, t1, t2, u[20], m[1]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_ADD(t0, t1, t2, w0, w1, w2);-	u[21] = t0 * n0;-	MONT_MAC(t0, t1, t2, u[21], m[0]);-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 22 */-	MONT_MAC(t0, t1, t2, a[0], b[22]);-	MONT_MUL(v0, v1, v2, a[1], b[21]);-	MONT_MUL(w0, w1, w2, a[2], b[20]);-	MONT_MAC(t0, t1, t2, a[3], b[19]);-	MONT_MAC(v0, v1, v2, a[4], b[18]);-	MONT_MAC(w0, w1, w2, a[5], b[17]);-	MONT_MAC(t0, t1, t2, a[6], b[16]);-	MONT_MAC(v0, v1, v2, a[7], b[15]);-	MONT_MAC(w0, w1, w2, a[8], b[14]);-	MONT_MAC(t0, t1, t2, a[9], b[13]);-	MONT_MAC(v0, v1, v2, a[10], b[12]);-	MONT_MAC(w0, w1, w2, a[11], b[11]);-	MONT_MAC(t0, t1, t2, a[12], b[10]);-	MONT_MAC(v0, v1, v2, a[13], b[9]);-	MONT_MAC(w0, w1, w2, a[14], b[8]);-	MONT_MAC(t0, t1, t2, a[15], b[7]);-	MONT_MAC(v0, v1, v2, a[16], b[6]);-	MONT_MAC(w0, w1, w2, a[17], b[5]);-	MONT_MAC(t0, t1, t2, a[18], b[4]);-	MONT_MAC(v0, v1, v2, a[19], b[3]);-	MONT_MAC(w0, w1, w2, a[20], b[2]);-	MONT_MAC(t0, t1, t2, a[21], b[1]);-	MONT_MAC(v0, v1, v2, a[22], b[0]);-	MONT_MAC(w0, w1, w2, u[0], m[22]);-	MONT_MAC(t0, t1, t2, u[1], m[21]);-	MONT_MAC(v0, v1, v2, u[2], m[20]);-	MONT_MAC(w0, w1, w2, u[3], m[19]);-	MONT_MAC(t0, t1, t2, u[4], m[18]);-	MONT_MAC(v0, v1, v2, u[5], m[17]);-	MONT_MAC(w0, w1, w2, u[6], m[16]);-	MONT_MAC(t0, t1, t2, u[7], m[15]);-	MONT_MAC(v0, v1, v2, u[8], m[14]);-	MONT_MAC(w0, w1, w2, u[9], m[13]);-	MONT_MAC(t0, t1, t2, u[10], m[12]);-	MONT_MAC(v0, v1, v2, u[11], m[11]);-	MONT_MAC(w0, w1, w2, u[12], m[10]);-	MONT_MAC(t0, t1, t2, u[13], m[9]);-	MONT_MAC(v0, v1, v2, u[14], m[8]);-	MONT_MAC(w0, w1, w2, u[15], m[7]);-	MONT_MAC(t0, t1, t2, u[16], m[6]);-	MONT_MAC(v0, v1, v2, u[17], m[5]);-	MONT_MAC(w0, w1, w2, u[18], m[4]);-	MONT_MAC(t0, t1, t2, u[19], m[3]);-	MONT_MAC(v0, v1, v2, u[20], m[2]);-	MONT_MAC(w0, w1, w2, u[21], m[1]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_ADD(t0, t1, t2, w0, w1, w2);-	u[22] = t0 * n0;-	MONT_MAC(t0, t1, t2, u[22], m[0]);-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 23 */-	MONT_MAC(t0, t1, t2, a[0], b[23]);-	MONT_MUL(v0, v1, v2, a[1], b[22]);-	MONT_MUL(w0, w1, w2, a[2], b[21]);-	MONT_MAC(t0, t1, t2, a[3], b[20]);-	MONT_MAC(v0, v1, v2, a[4], b[19]);-	MONT_MAC(w0, w1, w2, a[5], b[18]);-	MONT_MAC(t0, t1, t2, a[6], b[17]);-	MONT_MAC(v0, v1, v2, a[7], b[16]);-	MONT_MAC(w0, w1, w2, a[8], b[15]);-	MONT_MAC(t0, t1, t2, a[9], b[14]);-	MONT_MAC(v0, v1, v2, a[10], b[13]);-	MONT_MAC(w0, w1, w2, a[11], b[12]);-	MONT_MAC(t0, t1, t2, a[12], b[11]);-	MONT_MAC(v0, v1, v2, a[13], b[10]);-	MONT_MAC(w0, w1, w2, a[14], b[9]);-	MONT_MAC(t0, t1, t2, a[15], b[8]);-	MONT_MAC(v0, v1, v2, a[16], b[7]);-	MONT_MAC(w0, w1, w2, a[17], b[6]);-	MONT_MAC(t0, t1, t2, a[18], b[5]);-	MONT_MAC(v0, v1, v2, a[19], b[4]);-	MONT_MAC(w0, w1, w2, a[20], b[3]);-	MONT_MAC(t0, t1, t2, a[21], b[2]);-	MONT_MAC(v0, v1, v2, a[22], b[1]);-	MONT_MAC(w0, w1, w2, a[23], b[0]);-	MONT_MAC(t0, t1, t2, u[0], m[23]);-	MONT_MAC(v0, v1, v2, u[1], m[22]);-	MONT_MAC(w0, w1, w2, u[2], m[21]);-	MONT_MAC(t0, t1, t2, u[3], m[20]);-	MONT_MAC(v0, v1, v2, u[4], m[19]);-	MONT_MAC(w0, w1, w2, u[5], m[18]);-	MONT_MAC(t0, t1, t2, u[6], m[17]);-	MONT_MAC(v0, v1, v2, u[7], m[16]);-	MONT_MAC(w0, w1, w2, u[8], m[15]);-	MONT_MAC(t0, t1, t2, u[9], m[14]);-	MONT_MAC(v0, v1, v2, u[10], m[13]);-	MONT_MAC(w0, w1, w2, u[11], m[12]);-	MONT_MAC(t0, t1, t2, u[12], m[11]);-	MONT_MAC(v0, v1, v2, u[13], m[10]);-	MONT_MAC(w0, w1, w2, u[14], m[9]);-	MONT_MAC(t0, t1, t2, u[15], m[8]);-	MONT_MAC(v0, v1, v2, u[16], m[7]);-	MONT_MAC(w0, w1, w2, u[17], m[6]);-	MONT_MAC(t0, t1, t2, u[18], m[5]);-	MONT_MAC(v0, v1, v2, u[19], m[4]);-	MONT_MAC(w0, w1, w2, u[20], m[3]);-	MONT_MAC(t0, t1, t2, u[21], m[2]);-	MONT_MAC(v0, v1, v2, u[22], m[1]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_ADD(t0, t1, t2, w0, w1, w2);-	u[23] = t0 * n0;-	MONT_MAC(t0, t1, t2, u[23], m[0]);-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 24 */-	MONT_MAC(t0, t1, t2, a[0], b[24]);-	MONT_MUL(v0, v1, v2, a[1], b[23]);-	MONT_MUL(w0, w1, w2, a[2], b[22]);-	MONT_MAC(t0, t1, t2, a[3], b[21]);-	MONT_MAC(v0, v1, v2, a[4], b[20]);-	MONT_MAC(w0, w1, w2, a[5], b[19]);-	MONT_MAC(t0, t1, t2, a[6], b[18]);-	MONT_MAC(v0, v1, v2, a[7], b[17]);-	MONT_MAC(w0, w1, w2, a[8], b[16]);-	MONT_MAC(t0, t1, t2, a[9], b[15]);-	MONT_MAC(v0, v1, v2, a[10], b[14]);-	MONT_MAC(w0, w1, w2, a[11], b[13]);-	MONT_MAC(t0, t1, t2, a[12], b[12]);-	MONT_MAC(v0, v1, v2, a[13], b[11]);-	MONT_MAC(w0, w1, w2, a[14], b[10]);-	MONT_MAC(t0, t1, t2, a[15], b[9]);-	MONT_MAC(v0, v1, v2, a[16], b[8]);-	MONT_MAC(w0, w1, w2, a[17], b[7]);-	MONT_MAC(t0, t1, t2, a[18], b[6]);-	MONT_MAC(v0, v1, v2, a[19], b[5]);-	MONT_MAC(w0, w1, w2, a[20], b[4]);-	MONT_MAC(t0, t1, t2, a[21], b[3]);-	MONT_MAC(v0, v1, v2, a[22], b[2]);-	MONT_MAC(w0, w1, w2, a[23], b[1]);-	MONT_MAC(t0, t1, t2, a[24], b[0]);-	MONT_MAC(v0, v1, v2, u[0], m[24]);-	MONT_MAC(w0, w1, w2, u[1], m[23]);-	MONT_MAC(t0, t1, t2, u[2], m[22]);-	MONT_MAC(v0, v1, v2, u[3], m[21]);-	MONT_MAC(w0, w1, w2, u[4], m[20]);-	MONT_MAC(t0, t1, t2, u[5], m[19]);-	MONT_MAC(v0, v1, v2, u[6], m[18]);-	MONT_MAC(w0, w1, w2, u[7], m[17]);-	MONT_MAC(t0, t1, t2, u[8], m[16]);-	MONT_MAC(v0, v1, v2, u[9], m[15]);-	MONT_MAC(w0, w1, w2, u[10], m[14]);-	MONT_MAC(t0, t1, t2, u[11], m[13]);-	MONT_MAC(v0, v1, v2, u[12], m[12]);-	MONT_MAC(w0, w1, w2, u[13], m[11]);-	MONT_MAC(t0, t1, t2, u[14], m[10]);-	MONT_MAC(v0, v1, v2, u[15], m[9]);-	MONT_MAC(w0, w1, w2, u[16], m[8]);-	MONT_MAC(t0, t1, t2, u[17], m[7]);-	MONT_MAC(v0, v1, v2, u[18], m[6]);-	MONT_MAC(w0, w1, w2, u[19], m[5]);-	MONT_MAC(t0, t1, t2, u[20], m[4]);-	MONT_MAC(v0, v1, v2, u[21], m[3]);-	MONT_MAC(w0, w1, w2, u[22], m[2]);-	MONT_MAC(t0, t1, t2, u[23], m[1]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_ADD(t0, t1, t2, w0, w1, w2);-	u[24] = t0 * n0;-	MONT_MAC(t0, t1, t2, u[24], m[0]);-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 25 */-	MONT_MAC(t0, t1, t2, a[0], b[25]);-	MONT_MUL(v0, v1, v2, a[1], b[24]);-	MONT_MUL(w0, w1, w2, a[2], b[23]);-	MONT_MAC(t0, t1, t2, a[3], b[22]);-	MONT_MAC(v0, v1, v2, a[4], b[21]);-	MONT_MAC(w0, w1, w2, a[5], b[20]);-	MONT_MAC(t0, t1, t2, a[6], b[19]);-	MONT_MAC(v0, v1, v2, a[7], b[18]);-	MONT_MAC(w0, w1, w2, a[8], b[17]);-	MONT_MAC(t0, t1, t2, a[9], b[16]);-	MONT_MAC(v0, v1, v2, a[10], b[15]);-	MONT_MAC(w0, w1, w2, a[11], b[14]);-	MONT_MAC(t0, t1, t2, a[12], b[13]);-	MONT_MAC(v0, v1, v2, a[13], b[12]);-	MONT_MAC(w0, w1, w2, a[14], b[11]);-	MONT_MAC(t0, t1, t2, a[15], b[10]);-	MONT_MAC(v0, v1, v2, a[16], b[9]);-	MONT_MAC(w0, w1, w2, a[17], b[8]);-	MONT_MAC(t0, t1, t2, a[18], b[7]);-	MONT_MAC(v0, v1, v2, a[19], b[6]);-	MONT_MAC(w0, w1, w2, a[20], b[5]);-	MONT_MAC(t0, t1, t2, a[21], b[4]);-	MONT_MAC(v0, v1, v2, a[22], b[3]);-	MONT_MAC(w0, w1, w2, a[23], b[2]);-	MONT_MAC(t0, t1, t2, a[24], b[1]);-	MONT_MAC(v0, v1, v2, a[25], b[0]);-	MONT_MAC(w0, w1, w2, u[0], m[25]);-	MONT_MAC(t0, t1, t2, u[1], m[24]);-	MONT_MAC(v0, v1, v2, u[2], m[23]);-	MONT_MAC(w0, w1, w2, u[3], m[22]);-	MONT_MAC(t0, t1, t2, u[4], m[21]);-	MONT_MAC(v0, v1, v2, u[5], m[20]);-	MONT_MAC(w0, w1, w2, u[6], m[19]);-	MONT_MAC(t0, t1, t2, u[7], m[18]);-	MONT_MAC(v0, v1, v2, u[8], m[17]);-	MONT_MAC(w0, w1, w2, u[9], m[16]);-	MONT_MAC(t0, t1, t2, u[10], m[15]);-	MONT_MAC(v0, v1, v2, u[11], m[14]);-	MONT_MAC(w0, w1, w2, u[12], m[13]);-	MONT_MAC(t0, t1, t2, u[13], m[12]);-	MONT_MAC(v0, v1, v2, u[14], m[11]);-	MONT_MAC(w0, w1, w2, u[15], m[10]);-	MONT_MAC(t0, t1, t2, u[16], m[9]);-	MONT_MAC(v0, v1, v2, u[17], m[8]);-	MONT_MAC(w0, w1, w2, u[18], m[7]);-	MONT_MAC(t0, t1, t2, u[19], m[6]);-	MONT_MAC(v0, v1, v2, u[20], m[5]);-	MONT_MAC(w0, w1, w2, u[21], m[4]);-	MONT_MAC(t0, t1, t2, u[22], m[3]);-	MONT_MAC(v0, v1, v2, u[23], m[2]);-	MONT_MAC(w0, w1, w2, u[24], m[1]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_ADD(t0, t1, t2, w0, w1, w2);-	u[25] = t0 * n0;-	MONT_MAC(t0, t1, t2, u[25], m[0]);-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 26 */-	MONT_MAC(t0, t1, t2, a[0], b[26]);-	MONT_MUL(v0, v1, v2, a[1], b[25]);-	MONT_MUL(w0, w1, w2, a[2], b[24]);-	MONT_MAC(t0, t1, t2, a[3], b[23]);-	MONT_MAC(v0, v1, v2, a[4], b[22]);-	MONT_MAC(w0, w1, w2, a[5], b[21]);-	MONT_MAC(t0, t1, t2, a[6], b[20]);-	MONT_MAC(v0, v1, v2, a[7], b[19]);-	MONT_MAC(w0, w1, w2, a[8], b[18]);-	MONT_MAC(t0, t1, t2, a[9], b[17]);-	MONT_MAC(v0, v1, v2, a[10], b[16]);-	MONT_MAC(w0, w1, w2, a[11], b[15]);-	MONT_MAC(t0, t1, t2, a[12], b[14]);-	MONT_MAC(v0, v1, v2, a[13], b[13]);-	MONT_MAC(w0, w1, w2, a[14], b[12]);-	MONT_MAC(t0, t1, t2, a[15], b[11]);-	MONT_MAC(v0, v1, v2, a[16], b[10]);-	MONT_MAC(w0, w1, w2, a[17], b[9]);-	MONT_MAC(t0, t1, t2, a[18], b[8]);-	MONT_MAC(v0, v1, v2, a[19], b[7]);-	MONT_MAC(w0, w1, w2, a[20], b[6]);-	MONT_MAC(t0, t1, t2, a[21], b[5]);-	MONT_MAC(v0, v1, v2, a[22], b[4]);-	MONT_MAC(w0, w1, w2, a[23], b[3]);-	MONT_MAC(t0, t1, t2, a[24], b[2]);-	MONT_MAC(v0, v1, v2, a[25], b[1]);-	MONT_MAC(w0, w1, w2, a[26], b[0]);-	MONT_MAC(t0, t1, t2, u[0], m[26]);-	MONT_MAC(v0, v1, v2, u[1], m[25]);-	MONT_MAC(w0, w1, w2, u[2], m[24]);-	MONT_MAC(t0, t1, t2, u[3], m[23]);-	MONT_MAC(v0, v1, v2, u[4], m[22]);-	MONT_MAC(w0, w1, w2, u[5], m[21]);-	MONT_MAC(t0, t1, t2, u[6], m[20]);-	MONT_MAC(v0, v1, v2, u[7], m[19]);-	MONT_MAC(w0, w1, w2, u[8], m[18]);-	MONT_MAC(t0, t1, t2, u[9], m[17]);-	MONT_MAC(v0, v1, v2, u[10], m[16]);-	MONT_MAC(w0, w1, w2, u[11], m[15]);-	MONT_MAC(t0, t1, t2, u[12], m[14]);-	MONT_MAC(v0, v1, v2, u[13], m[13]);-	MONT_MAC(w0, w1, w2, u[14], m[12]);-	MONT_MAC(t0, t1, t2, u[15], m[11]);-	MONT_MAC(v0, v1, v2, u[16], m[10]);-	MONT_MAC(w0, w1, w2, u[17], m[9]);-	MONT_MAC(t0, t1, t2, u[18], m[8]);-	MONT_MAC(v0, v1, v2, u[19], m[7]);-	MONT_MAC(w0, w1, w2, u[20], m[6]);-	MONT_MAC(t0, t1, t2, u[21], m[5]);-	MONT_MAC(v0, v1, v2, u[22], m[4]);-	MONT_MAC(w0, w1, w2, u[23], m[3]);-	MONT_MAC(t0, t1, t2, u[24], m[2]);-	MONT_MAC(v0, v1, v2, u[25], m[1]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_ADD(t0, t1, t2, w0, w1, w2);-	u[26] = t0 * n0;-	MONT_MAC(t0, t1, t2, u[26], m[0]);-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 27 */-	MONT_MAC(t0, t1, t2, a[0], b[27]);-	MONT_MUL(v0, v1, v2, a[1], b[26]);-	MONT_MUL(w0, w1, w2, a[2], b[25]);-	MONT_MAC(t0, t1, t2, a[3], b[24]);-	MONT_MAC(v0, v1, v2, a[4], b[23]);-	MONT_MAC(w0, w1, w2, a[5], b[22]);-	MONT_MAC(t0, t1, t2, a[6], b[21]);-	MONT_MAC(v0, v1, v2, a[7], b[20]);-	MONT_MAC(w0, w1, w2, a[8], b[19]);-	MONT_MAC(t0, t1, t2, a[9], b[18]);-	MONT_MAC(v0, v1, v2, a[10], b[17]);-	MONT_MAC(w0, w1, w2, a[11], b[16]);-	MONT_MAC(t0, t1, t2, a[12], b[15]);-	MONT_MAC(v0, v1, v2, a[13], b[14]);-	MONT_MAC(w0, w1, w2, a[14], b[13]);-	MONT_MAC(t0, t1, t2, a[15], b[12]);-	MONT_MAC(v0, v1, v2, a[16], b[11]);-	MONT_MAC(w0, w1, w2, a[17], b[10]);-	MONT_MAC(t0, t1, t2, a[18], b[9]);-	MONT_MAC(v0, v1, v2, a[19], b[8]);-	MONT_MAC(w0, w1, w2, a[20], b[7]);-	MONT_MAC(t0, t1, t2, a[21], b[6]);-	MONT_MAC(v0, v1, v2, a[22], b[5]);-	MONT_MAC(w0, w1, w2, a[23], b[4]);-	MONT_MAC(t0, t1, t2, a[24], b[3]);-	MONT_MAC(v0, v1, v2, a[25], b[2]);-	MONT_MAC(w0, w1, w2, a[26], b[1]);-	MONT_MAC(t0, t1, t2, a[27], b[0]);-	MONT_MAC(v0, v1, v2, u[0], m[27]);-	MONT_MAC(w0, w1, w2, u[1], m[26]);-	MONT_MAC(t0, t1, t2, u[2], m[25]);-	MONT_MAC(v0, v1, v2, u[3], m[24]);-	MONT_MAC(w0, w1, w2, u[4], m[23]);-	MONT_MAC(t0, t1, t2, u[5], m[22]);-	MONT_MAC(v0, v1, v2, u[6], m[21]);-	MONT_MAC(w0, w1, w2, u[7], m[20]);-	MONT_MAC(t0, t1, t2, u[8], m[19]);-	MONT_MAC(v0, v1, v2, u[9], m[18]);-	MONT_MAC(w0, w1, w2, u[10], m[17]);-	MONT_MAC(t0, t1, t2, u[11], m[16]);-	MONT_MAC(v0, v1, v2, u[12], m[15]);-	MONT_MAC(w0, w1, w2, u[13], m[14]);-	MONT_MAC(t0, t1, t2, u[14], m[13]);-	MONT_MAC(v0, v1, v2, u[15], m[12]);-	MONT_MAC(w0, w1, w2, u[16], m[11]);-	MONT_MAC(t0, t1, t2, u[17], m[10]);-	MONT_MAC(v0, v1, v2, u[18], m[9]);-	MONT_MAC(w0, w1, w2, u[19], m[8]);-	MONT_MAC(t0, t1, t2, u[20], m[7]);-	MONT_MAC(v0, v1, v2, u[21], m[6]);-	MONT_MAC(w0, w1, w2, u[22], m[5]);-	MONT_MAC(t0, t1, t2, u[23], m[4]);-	MONT_MAC(v0, v1, v2, u[24], m[3]);-	MONT_MAC(w0, w1, w2, u[25], m[2]);-	MONT_MAC(t0, t1, t2, u[26], m[1]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_ADD(t0, t1, t2, w0, w1, w2);-	u[27] = t0 * n0;-	MONT_MAC(t0, t1, t2, u[27], m[0]);-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 28 */-	MONT_MAC(t0, t1, t2, a[0], b[28]);-	MONT_MUL(v0, v1, v2, a[1], b[27]);-	MONT_MUL(w0, w1, w2, a[2], b[26]);-	MONT_MAC(t0, t1, t2, a[3], b[25]);-	MONT_MAC(v0, v1, v2, a[4], b[24]);-	MONT_MAC(w0, w1, w2, a[5], b[23]);-	MONT_MAC(t0, t1, t2, a[6], b[22]);-	MONT_MAC(v0, v1, v2, a[7], b[21]);-	MONT_MAC(w0, w1, w2, a[8], b[20]);-	MONT_MAC(t0, t1, t2, a[9], b[19]);-	MONT_MAC(v0, v1, v2, a[10], b[18]);-	MONT_MAC(w0, w1, w2, a[11], b[17]);-	MONT_MAC(t0, t1, t2, a[12], b[16]);-	MONT_MAC(v0, v1, v2, a[13], b[15]);-	MONT_MAC(w0, w1, w2, a[14], b[14]);-	MONT_MAC(t0, t1, t2, a[15], b[13]);-	MONT_MAC(v0, v1, v2, a[16], b[12]);-	MONT_MAC(w0, w1, w2, a[17], b[11]);-	MONT_MAC(t0, t1, t2, a[18], b[10]);-	MONT_MAC(v0, v1, v2, a[19], b[9]);-	MONT_MAC(w0, w1, w2, a[20], b[8]);-	MONT_MAC(t0, t1, t2, a[21], b[7]);-	MONT_MAC(v0, v1, v2, a[22], b[6]);-	MONT_MAC(w0, w1, w2, a[23], b[5]);-	MONT_MAC(t0, t1, t2, a[24], b[4]);-	MONT_MAC(v0, v1, v2, a[25], b[3]);-	MONT_MAC(w0, w1, w2, a[26], b[2]);-	MONT_MAC(t0, t1, t2, a[27], b[1]);-	MONT_MAC(v0, v1, v2, a[28], b[0]);-	MONT_MAC(w0, w1, w2, u[0], m[28]);-	MONT_MAC(t0, t1, t2, u[1], m[27]);-	MONT_MAC(v0, v1, v2, u[2], m[26]);-	MONT_MAC(w0, w1, w2, u[3], m[25]);-	MONT_MAC(t0, t1, t2, u[4], m[24]);-	MONT_MAC(v0, v1, v2, u[5], m[23]);-	MONT_MAC(w0, w1, w2, u[6], m[22]);-	MONT_MAC(t0, t1, t2, u[7], m[21]);-	MONT_MAC(v0, v1, v2, u[8], m[20]);-	MONT_MAC(w0, w1, w2, u[9], m[19]);-	MONT_MAC(t0, t1, t2, u[10], m[18]);-	MONT_MAC(v0, v1, v2, u[11], m[17]);-	MONT_MAC(w0, w1, w2, u[12], m[16]);-	MONT_MAC(t0, t1, t2, u[13], m[15]);-	MONT_MAC(v0, v1, v2, u[14], m[14]);-	MONT_MAC(w0, w1, w2, u[15], m[13]);-	MONT_MAC(t0, t1, t2, u[16], m[12]);-	MONT_MAC(v0, v1, v2, u[17], m[11]);-	MONT_MAC(w0, w1, w2, u[18], m[10]);-	MONT_MAC(t0, t1, t2, u[19], m[9]);-	MONT_MAC(v0, v1, v2, u[20], m[8]);-	MONT_MAC(w0, w1, w2, u[21], m[7]);-	MONT_MAC(t0, t1, t2, u[22], m[6]);-	MONT_MAC(v0, v1, v2, u[23], m[5]);-	MONT_MAC(w0, w1, w2, u[24], m[4]);-	MONT_MAC(t0, t1, t2, u[25], m[3]);-	MONT_MAC(v0, v1, v2, u[26], m[2]);-	MONT_MAC(w0, w1, w2, u[27], m[1]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_ADD(t0, t1, t2, w0, w1, w2);-	u[28] = t0 * n0;-	MONT_MAC(t0, t1, t2, u[28], m[0]);-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 29 */-	MONT_MAC(t0, t1, t2, a[0], b[29]);-	MONT_MUL(v0, v1, v2, a[1], b[28]);-	MONT_MUL(w0, w1, w2, a[2], b[27]);-	MONT_MAC(t0, t1, t2, a[3], b[26]);-	MONT_MAC(v0, v1, v2, a[4], b[25]);-	MONT_MAC(w0, w1, w2, a[5], b[24]);-	MONT_MAC(t0, t1, t2, a[6], b[23]);-	MONT_MAC(v0, v1, v2, a[7], b[22]);-	MONT_MAC(w0, w1, w2, a[8], b[21]);-	MONT_MAC(t0, t1, t2, a[9], b[20]);-	MONT_MAC(v0, v1, v2, a[10], b[19]);-	MONT_MAC(w0, w1, w2, a[11], b[18]);-	MONT_MAC(t0, t1, t2, a[12], b[17]);-	MONT_MAC(v0, v1, v2, a[13], b[16]);-	MONT_MAC(w0, w1, w2, a[14], b[15]);-	MONT_MAC(t0, t1, t2, a[15], b[14]);-	MONT_MAC(v0, v1, v2, a[16], b[13]);-	MONT_MAC(w0, w1, w2, a[17], b[12]);-	MONT_MAC(t0, t1, t2, a[18], b[11]);-	MONT_MAC(v0, v1, v2, a[19], b[10]);-	MONT_MAC(w0, w1, w2, a[20], b[9]);-	MONT_MAC(t0, t1, t2, a[21], b[8]);-	MONT_MAC(v0, v1, v2, a[22], b[7]);-	MONT_MAC(w0, w1, w2, a[23], b[6]);-	MONT_MAC(t0, t1, t2, a[24], b[5]);-	MONT_MAC(v0, v1, v2, a[25], b[4]);-	MONT_MAC(w0, w1, w2, a[26], b[3]);-	MONT_MAC(t0, t1, t2, a[27], b[2]);-	MONT_MAC(v0, v1, v2, a[28], b[1]);-	MONT_MAC(w0, w1, w2, a[29], b[0]);-	MONT_MAC(t0, t1, t2, u[0], m[29]);-	MONT_MAC(v0, v1, v2, u[1], m[28]);-	MONT_MAC(w0, w1, w2, u[2], m[27]);-	MONT_MAC(t0, t1, t2, u[3], m[26]);-	MONT_MAC(v0, v1, v2, u[4], m[25]);-	MONT_MAC(w0, w1, w2, u[5], m[24]);-	MONT_MAC(t0, t1, t2, u[6], m[23]);-	MONT_MAC(v0, v1, v2, u[7], m[22]);-	MONT_MAC(w0, w1, w2, u[8], m[21]);-	MONT_MAC(t0, t1, t2, u[9], m[20]);-	MONT_MAC(v0, v1, v2, u[10], m[19]);-	MONT_MAC(w0, w1, w2, u[11], m[18]);-	MONT_MAC(t0, t1, t2, u[12], m[17]);-	MONT_MAC(v0, v1, v2, u[13], m[16]);-	MONT_MAC(w0, w1, w2, u[14], m[15]);-	MONT_MAC(t0, t1, t2, u[15], m[14]);-	MONT_MAC(v0, v1, v2, u[16], m[13]);-	MONT_MAC(w0, w1, w2, u[17], m[12]);-	MONT_MAC(t0, t1, t2, u[18], m[11]);-	MONT_MAC(v0, v1, v2, u[19], m[10]);-	MONT_MAC(w0, w1, w2, u[20], m[9]);-	MONT_MAC(t0, t1, t2, u[21], m[8]);-	MONT_MAC(v0, v1, v2, u[22], m[7]);-	MONT_MAC(w0, w1, w2, u[23], m[6]);-	MONT_MAC(t0, t1, t2, u[24], m[5]);-	MONT_MAC(v0, v1, v2, u[25], m[4]);-	MONT_MAC(w0, w1, w2, u[26], m[3]);-	MONT_MAC(t0, t1, t2, u[27], m[2]);-	MONT_MAC(v0, v1, v2, u[28], m[1]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_ADD(t0, t1, t2, w0, w1, w2);-	u[29] = t0 * n0;-	MONT_MAC(t0, t1, t2, u[29], m[0]);-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 30 */-	MONT_MAC(t0, t1, t2, a[0], b[30]);-	MONT_MUL(v0, v1, v2, a[1], b[29]);-	MONT_MUL(w0, w1, w2, a[2], b[28]);-	MONT_MAC(t0, t1, t2, a[3], b[27]);-	MONT_MAC(v0, v1, v2, a[4], b[26]);-	MONT_MAC(w0, w1, w2, a[5], b[25]);-	MONT_MAC(t0, t1, t2, a[6], b[24]);-	MONT_MAC(v0, v1, v2, a[7], b[23]);-	MONT_MAC(w0, w1, w2, a[8], b[22]);-	MONT_MAC(t0, t1, t2, a[9], b[21]);-	MONT_MAC(v0, v1, v2, a[10], b[20]);-	MONT_MAC(w0, w1, w2, a[11], b[19]);-	MONT_MAC(t0, t1, t2, a[12], b[18]);-	MONT_MAC(v0, v1, v2, a[13], b[17]);-	MONT_MAC(w0, w1, w2, a[14], b[16]);-	MONT_MAC(t0, t1, t2, a[15], b[15]);-	MONT_MAC(v0, v1, v2, a[16], b[14]);-	MONT_MAC(w0, w1, w2, a[17], b[13]);-	MONT_MAC(t0, t1, t2, a[18], b[12]);-	MONT_MAC(v0, v1, v2, a[19], b[11]);-	MONT_MAC(w0, w1, w2, a[20], b[10]);-	MONT_MAC(t0, t1, t2, a[21], b[9]);-	MONT_MAC(v0, v1, v2, a[22], b[8]);-	MONT_MAC(w0, w1, w2, a[23], b[7]);-	MONT_MAC(t0, t1, t2, a[24], b[6]);-	MONT_MAC(v0, v1, v2, a[25], b[5]);-	MONT_MAC(w0, w1, w2, a[26], b[4]);-	MONT_MAC(t0, t1, t2, a[27], b[3]);-	MONT_MAC(v0, v1, v2, a[28], b[2]);-	MONT_MAC(w0, w1, w2, a[29], b[1]);-	MONT_MAC(t0, t1, t2, a[30], b[0]);-	MONT_MAC(v0, v1, v2, u[0], m[30]);-	MONT_MAC(w0, w1, w2, u[1], m[29]);-	MONT_MAC(t0, t1, t2, u[2], m[28]);-	MONT_MAC(v0, v1, v2, u[3], m[27]);-	MONT_MAC(w0, w1, w2, u[4], m[26]);-	MONT_MAC(t0, t1, t2, u[5], m[25]);-	MONT_MAC(v0, v1, v2, u[6], m[24]);-	MONT_MAC(w0, w1, w2, u[7], m[23]);-	MONT_MAC(t0, t1, t2, u[8], m[22]);-	MONT_MAC(v0, v1, v2, u[9], m[21]);-	MONT_MAC(w0, w1, w2, u[10], m[20]);-	MONT_MAC(t0, t1, t2, u[11], m[19]);-	MONT_MAC(v0, v1, v2, u[12], m[18]);-	MONT_MAC(w0, w1, w2, u[13], m[17]);-	MONT_MAC(t0, t1, t2, u[14], m[16]);-	MONT_MAC(v0, v1, v2, u[15], m[15]);-	MONT_MAC(w0, w1, w2, u[16], m[14]);-	MONT_MAC(t0, t1, t2, u[17], m[13]);-	MONT_MAC(v0, v1, v2, u[18], m[12]);-	MONT_MAC(w0, w1, w2, u[19], m[11]);-	MONT_MAC(t0, t1, t2, u[20], m[10]);-	MONT_MAC(v0, v1, v2, u[21], m[9]);-	MONT_MAC(w0, w1, w2, u[22], m[8]);-	MONT_MAC(t0, t1, t2, u[23], m[7]);-	MONT_MAC(v0, v1, v2, u[24], m[6]);-	MONT_MAC(w0, w1, w2, u[25], m[5]);-	MONT_MAC(t0, t1, t2, u[26], m[4]);-	MONT_MAC(v0, v1, v2, u[27], m[3]);-	MONT_MAC(w0, w1, w2, u[28], m[2]);-	MONT_MAC(t0, t1, t2, u[29], m[1]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_ADD(t0, t1, t2, w0, w1, w2);-	u[30] = t0 * n0;-	MONT_MAC(t0, t1, t2, u[30], m[0]);-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 31 */-	MONT_MAC(t0, t1, t2, a[0], b[31]);-	MONT_MUL(v0, v1, v2, a[1], b[30]);-	MONT_MUL(w0, w1, w2, a[2], b[29]);-	MONT_MAC(t0, t1, t2, a[3], b[28]);-	MONT_MAC(v0, v1, v2, a[4], b[27]);-	MONT_MAC(w0, w1, w2, a[5], b[26]);-	MONT_MAC(t0, t1, t2, a[6], b[25]);-	MONT_MAC(v0, v1, v2, a[7], b[24]);-	MONT_MAC(w0, w1, w2, a[8], b[23]);-	MONT_MAC(t0, t1, t2, a[9], b[22]);-	MONT_MAC(v0, v1, v2, a[10], b[21]);-	MONT_MAC(w0, w1, w2, a[11], b[20]);-	MONT_MAC(t0, t1, t2, a[12], b[19]);-	MONT_MAC(v0, v1, v2, a[13], b[18]);-	MONT_MAC(w0, w1, w2, a[14], b[17]);-	MONT_MAC(t0, t1, t2, a[15], b[16]);-	MONT_MAC(v0, v1, v2, a[16], b[15]);-	MONT_MAC(w0, w1, w2, a[17], b[14]);-	MONT_MAC(t0, t1, t2, a[18], b[13]);-	MONT_MAC(v0, v1, v2, a[19], b[12]);-	MONT_MAC(w0, w1, w2, a[20], b[11]);-	MONT_MAC(t0, t1, t2, a[21], b[10]);-	MONT_MAC(v0, v1, v2, a[22], b[9]);-	MONT_MAC(w0, w1, w2, a[23], b[8]);-	MONT_MAC(t0, t1, t2, a[24], b[7]);-	MONT_MAC(v0, v1, v2, a[25], b[6]);-	MONT_MAC(w0, w1, w2, a[26], b[5]);-	MONT_MAC(t0, t1, t2, a[27], b[4]);-	MONT_MAC(v0, v1, v2, a[28], b[3]);-	MONT_MAC(w0, w1, w2, a[29], b[2]);-	MONT_MAC(t0, t1, t2, a[30], b[1]);-	MONT_MAC(v0, v1, v2, a[31], b[0]);-	MONT_MAC(w0, w1, w2, u[0], m[31]);-	MONT_MAC(t0, t1, t2, u[1], m[30]);-	MONT_MAC(v0, v1, v2, u[2], m[29]);-	MONT_MAC(w0, w1, w2, u[3], m[28]);-	MONT_MAC(t0, t1, t2, u[4], m[27]);-	MONT_MAC(v0, v1, v2, u[5], m[26]);-	MONT_MAC(w0, w1, w2, u[6], m[25]);-	MONT_MAC(t0, t1, t2, u[7], m[24]);-	MONT_MAC(v0, v1, v2, u[8], m[23]);-	MONT_MAC(w0, w1, w2, u[9], m[22]);-	MONT_MAC(t0, t1, t2, u[10], m[21]);-	MONT_MAC(v0, v1, v2, u[11], m[20]);-	MONT_MAC(w0, w1, w2, u[12], m[19]);-	MONT_MAC(t0, t1, t2, u[13], m[18]);-	MONT_MAC(v0, v1, v2, u[14], m[17]);-	MONT_MAC(w0, w1, w2, u[15], m[16]);-	MONT_MAC(t0, t1, t2, u[16], m[15]);-	MONT_MAC(v0, v1, v2, u[17], m[14]);-	MONT_MAC(w0, w1, w2, u[18], m[13]);-	MONT_MAC(t0, t1, t2, u[19], m[12]);-	MONT_MAC(v0, v1, v2, u[20], m[11]);-	MONT_MAC(w0, w1, w2, u[21], m[10]);-	MONT_MAC(t0, t1, t2, u[22], m[9]);-	MONT_MAC(v0, v1, v2, u[23], m[8]);-	MONT_MAC(w0, w1, w2, u[24], m[7]);-	MONT_MAC(t0, t1, t2, u[25], m[6]);-	MONT_MAC(v0, v1, v2, u[26], m[5]);-	MONT_MAC(w0, w1, w2, u[27], m[4]);-	MONT_MAC(t0, t1, t2, u[28], m[3]);-	MONT_MAC(v0, v1, v2, u[29], m[2]);-	MONT_MAC(w0, w1, w2, u[30], m[1]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_ADD(t0, t1, t2, w0, w1, w2);-	u[31] = t0 * n0;-	MONT_MAC(t0, t1, t2, u[31], m[0]);-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 32 */-	MONT_MAC(t0, t1, t2, a[1], b[31]);-	MONT_MUL(v0, v1, v2, a[2], b[30]);-	MONT_MUL(w0, w1, w2, a[3], b[29]);-	MONT_MAC(t0, t1, t2, a[4], b[28]);-	MONT_MAC(v0, v1, v2, a[5], b[27]);-	MONT_MAC(w0, w1, w2, a[6], b[26]);-	MONT_MAC(t0, t1, t2, a[7], b[25]);-	MONT_MAC(v0, v1, v2, a[8], b[24]);-	MONT_MAC(w0, w1, w2, a[9], b[23]);-	MONT_MAC(t0, t1, t2, a[10], b[22]);-	MONT_MAC(v0, v1, v2, a[11], b[21]);-	MONT_MAC(w0, w1, w2, a[12], b[20]);-	MONT_MAC(t0, t1, t2, a[13], b[19]);-	MONT_MAC(v0, v1, v2, a[14], b[18]);-	MONT_MAC(w0, w1, w2, a[15], b[17]);-	MONT_MAC(t0, t1, t2, a[16], b[16]);-	MONT_MAC(v0, v1, v2, a[17], b[15]);-	MONT_MAC(w0, w1, w2, a[18], b[14]);-	MONT_MAC(t0, t1, t2, a[19], b[13]);-	MONT_MAC(v0, v1, v2, a[20], b[12]);-	MONT_MAC(w0, w1, w2, a[21], b[11]);-	MONT_MAC(t0, t1, t2, a[22], b[10]);-	MONT_MAC(v0, v1, v2, a[23], b[9]);-	MONT_MAC(w0, w1, w2, a[24], b[8]);-	MONT_MAC(t0, t1, t2, a[25], b[7]);-	MONT_MAC(v0, v1, v2, a[26], b[6]);-	MONT_MAC(w0, w1, w2, a[27], b[5]);-	MONT_MAC(t0, t1, t2, a[28], b[4]);-	MONT_MAC(v0, v1, v2, a[29], b[3]);-	MONT_MAC(w0, w1, w2, a[30], b[2]);-	MONT_MAC(t0, t1, t2, a[31], b[1]);-	MONT_MAC(v0, v1, v2, u[1], m[31]);-	MONT_MAC(w0, w1, w2, u[2], m[30]);-	MONT_MAC(t0, t1, t2, u[3], m[29]);-	MONT_MAC(v0, v1, v2, u[4], m[28]);-	MONT_MAC(w0, w1, w2, u[5], m[27]);-	MONT_MAC(t0, t1, t2, u[6], m[26]);-	MONT_MAC(v0, v1, v2, u[7], m[25]);-	MONT_MAC(w0, w1, w2, u[8], m[24]);-	MONT_MAC(t0, t1, t2, u[9], m[23]);-	MONT_MAC(v0, v1, v2, u[10], m[22]);-	MONT_MAC(w0, w1, w2, u[11], m[21]);-	MONT_MAC(t0, t1, t2, u[12], m[20]);-	MONT_MAC(v0, v1, v2, u[13], m[19]);-	MONT_MAC(w0, w1, w2, u[14], m[18]);-	MONT_MAC(t0, t1, t2, u[15], m[17]);-	MONT_MAC(v0, v1, v2, u[16], m[16]);-	MONT_MAC(w0, w1, w2, u[17], m[15]);-	MONT_MAC(t0, t1, t2, u[18], m[14]);-	MONT_MAC(v0, v1, v2, u[19], m[13]);-	MONT_MAC(w0, w1, w2, u[20], m[12]);-	MONT_MAC(t0, t1, t2, u[21], m[11]);-	MONT_MAC(v0, v1, v2, u[22], m[10]);-	MONT_MAC(w0, w1, w2, u[23], m[9]);-	MONT_MAC(t0, t1, t2, u[24], m[8]);-	MONT_MAC(v0, v1, v2, u[25], m[7]);-	MONT_MAC(w0, w1, w2, u[26], m[6]);-	MONT_MAC(t0, t1, t2, u[27], m[5]);-	MONT_MAC(v0, v1, v2, u[28], m[4]);-	MONT_MAC(w0, w1, w2, u[29], m[3]);-	MONT_MAC(t0, t1, t2, u[30], m[2]);-	MONT_MAC(v0, v1, v2, u[31], m[1]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_ADD(t0, t1, t2, w0, w1, w2);-	z[0] = t0;-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 33 */-	MONT_MAC(t0, t1, t2, a[2], b[31]);-	MONT_MUL(v0, v1, v2, a[3], b[30]);-	MONT_MUL(w0, w1, w2, a[4], b[29]);-	MONT_MAC(t0, t1, t2, a[5], b[28]);-	MONT_MAC(v0, v1, v2, a[6], b[27]);-	MONT_MAC(w0, w1, w2, a[7], b[26]);-	MONT_MAC(t0, t1, t2, a[8], b[25]);-	MONT_MAC(v0, v1, v2, a[9], b[24]);-	MONT_MAC(w0, w1, w2, a[10], b[23]);-	MONT_MAC(t0, t1, t2, a[11], b[22]);-	MONT_MAC(v0, v1, v2, a[12], b[21]);-	MONT_MAC(w0, w1, w2, a[13], b[20]);-	MONT_MAC(t0, t1, t2, a[14], b[19]);-	MONT_MAC(v0, v1, v2, a[15], b[18]);-	MONT_MAC(w0, w1, w2, a[16], b[17]);-	MONT_MAC(t0, t1, t2, a[17], b[16]);-	MONT_MAC(v0, v1, v2, a[18], b[15]);-	MONT_MAC(w0, w1, w2, a[19], b[14]);-	MONT_MAC(t0, t1, t2, a[20], b[13]);-	MONT_MAC(v0, v1, v2, a[21], b[12]);-	MONT_MAC(w0, w1, w2, a[22], b[11]);-	MONT_MAC(t0, t1, t2, a[23], b[10]);-	MONT_MAC(v0, v1, v2, a[24], b[9]);-	MONT_MAC(w0, w1, w2, a[25], b[8]);-	MONT_MAC(t0, t1, t2, a[26], b[7]);-	MONT_MAC(v0, v1, v2, a[27], b[6]);-	MONT_MAC(w0, w1, w2, a[28], b[5]);-	MONT_MAC(t0, t1, t2, a[29], b[4]);-	MONT_MAC(v0, v1, v2, a[30], b[3]);-	MONT_MAC(w0, w1, w2, a[31], b[2]);-	MONT_MAC(t0, t1, t2, u[2], m[31]);-	MONT_MAC(v0, v1, v2, u[3], m[30]);-	MONT_MAC(w0, w1, w2, u[4], m[29]);-	MONT_MAC(t0, t1, t2, u[5], m[28]);-	MONT_MAC(v0, v1, v2, u[6], m[27]);-	MONT_MAC(w0, w1, w2, u[7], m[26]);-	MONT_MAC(t0, t1, t2, u[8], m[25]);-	MONT_MAC(v0, v1, v2, u[9], m[24]);-	MONT_MAC(w0, w1, w2, u[10], m[23]);-	MONT_MAC(t0, t1, t2, u[11], m[22]);-	MONT_MAC(v0, v1, v2, u[12], m[21]);-	MONT_MAC(w0, w1, w2, u[13], m[20]);-	MONT_MAC(t0, t1, t2, u[14], m[19]);-	MONT_MAC(v0, v1, v2, u[15], m[18]);-	MONT_MAC(w0, w1, w2, u[16], m[17]);-	MONT_MAC(t0, t1, t2, u[17], m[16]);-	MONT_MAC(v0, v1, v2, u[18], m[15]);-	MONT_MAC(w0, w1, w2, u[19], m[14]);-	MONT_MAC(t0, t1, t2, u[20], m[13]);-	MONT_MAC(v0, v1, v2, u[21], m[12]);-	MONT_MAC(w0, w1, w2, u[22], m[11]);-	MONT_MAC(t0, t1, t2, u[23], m[10]);-	MONT_MAC(v0, v1, v2, u[24], m[9]);-	MONT_MAC(w0, w1, w2, u[25], m[8]);-	MONT_MAC(t0, t1, t2, u[26], m[7]);-	MONT_MAC(v0, v1, v2, u[27], m[6]);-	MONT_MAC(w0, w1, w2, u[28], m[5]);-	MONT_MAC(t0, t1, t2, u[29], m[4]);-	MONT_MAC(v0, v1, v2, u[30], m[3]);-	MONT_MAC(w0, w1, w2, u[31], m[2]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_ADD(t0, t1, t2, w0, w1, w2);-	z[1] = t0;-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 34 */-	MONT_MAC(t0, t1, t2, a[3], b[31]);-	MONT_MUL(v0, v1, v2, a[4], b[30]);-	MONT_MUL(w0, w1, w2, a[5], b[29]);-	MONT_MAC(t0, t1, t2, a[6], b[28]);-	MONT_MAC(v0, v1, v2, a[7], b[27]);-	MONT_MAC(w0, w1, w2, a[8], b[26]);-	MONT_MAC(t0, t1, t2, a[9], b[25]);-	MONT_MAC(v0, v1, v2, a[10], b[24]);-	MONT_MAC(w0, w1, w2, a[11], b[23]);-	MONT_MAC(t0, t1, t2, a[12], b[22]);-	MONT_MAC(v0, v1, v2, a[13], b[21]);-	MONT_MAC(w0, w1, w2, a[14], b[20]);-	MONT_MAC(t0, t1, t2, a[15], b[19]);-	MONT_MAC(v0, v1, v2, a[16], b[18]);-	MONT_MAC(w0, w1, w2, a[17], b[17]);-	MONT_MAC(t0, t1, t2, a[18], b[16]);-	MONT_MAC(v0, v1, v2, a[19], b[15]);-	MONT_MAC(w0, w1, w2, a[20], b[14]);-	MONT_MAC(t0, t1, t2, a[21], b[13]);-	MONT_MAC(v0, v1, v2, a[22], b[12]);-	MONT_MAC(w0, w1, w2, a[23], b[11]);-	MONT_MAC(t0, t1, t2, a[24], b[10]);-	MONT_MAC(v0, v1, v2, a[25], b[9]);-	MONT_MAC(w0, w1, w2, a[26], b[8]);-	MONT_MAC(t0, t1, t2, a[27], b[7]);-	MONT_MAC(v0, v1, v2, a[28], b[6]);-	MONT_MAC(w0, w1, w2, a[29], b[5]);-	MONT_MAC(t0, t1, t2, a[30], b[4]);-	MONT_MAC(v0, v1, v2, a[31], b[3]);-	MONT_MAC(w0, w1, w2, u[3], m[31]);-	MONT_MAC(t0, t1, t2, u[4], m[30]);-	MONT_MAC(v0, v1, v2, u[5], m[29]);-	MONT_MAC(w0, w1, w2, u[6], m[28]);-	MONT_MAC(t0, t1, t2, u[7], m[27]);-	MONT_MAC(v0, v1, v2, u[8], m[26]);-	MONT_MAC(w0, w1, w2, u[9], m[25]);-	MONT_MAC(t0, t1, t2, u[10], m[24]);-	MONT_MAC(v0, v1, v2, u[11], m[23]);-	MONT_MAC(w0, w1, w2, u[12], m[22]);-	MONT_MAC(t0, t1, t2, u[13], m[21]);-	MONT_MAC(v0, v1, v2, u[14], m[20]);-	MONT_MAC(w0, w1, w2, u[15], m[19]);-	MONT_MAC(t0, t1, t2, u[16], m[18]);-	MONT_MAC(v0, v1, v2, u[17], m[17]);-	MONT_MAC(w0, w1, w2, u[18], m[16]);-	MONT_MAC(t0, t1, t2, u[19], m[15]);-	MONT_MAC(v0, v1, v2, u[20], m[14]);-	MONT_MAC(w0, w1, w2, u[21], m[13]);-	MONT_MAC(t0, t1, t2, u[22], m[12]);-	MONT_MAC(v0, v1, v2, u[23], m[11]);-	MONT_MAC(w0, w1, w2, u[24], m[10]);-	MONT_MAC(t0, t1, t2, u[25], m[9]);-	MONT_MAC(v0, v1, v2, u[26], m[8]);-	MONT_MAC(w0, w1, w2, u[27], m[7]);-	MONT_MAC(t0, t1, t2, u[28], m[6]);-	MONT_MAC(v0, v1, v2, u[29], m[5]);-	MONT_MAC(w0, w1, w2, u[30], m[4]);-	MONT_MAC(t0, t1, t2, u[31], m[3]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_ADD(t0, t1, t2, w0, w1, w2);-	z[2] = t0;-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 35 */-	MONT_MAC(t0, t1, t2, a[4], b[31]);-	MONT_MUL(v0, v1, v2, a[5], b[30]);-	MONT_MUL(w0, w1, w2, a[6], b[29]);-	MONT_MAC(t0, t1, t2, a[7], b[28]);-	MONT_MAC(v0, v1, v2, a[8], b[27]);-	MONT_MAC(w0, w1, w2, a[9], b[26]);-	MONT_MAC(t0, t1, t2, a[10], b[25]);-	MONT_MAC(v0, v1, v2, a[11], b[24]);-	MONT_MAC(w0, w1, w2, a[12], b[23]);-	MONT_MAC(t0, t1, t2, a[13], b[22]);-	MONT_MAC(v0, v1, v2, a[14], b[21]);-	MONT_MAC(w0, w1, w2, a[15], b[20]);-	MONT_MAC(t0, t1, t2, a[16], b[19]);-	MONT_MAC(v0, v1, v2, a[17], b[18]);-	MONT_MAC(w0, w1, w2, a[18], b[17]);-	MONT_MAC(t0, t1, t2, a[19], b[16]);-	MONT_MAC(v0, v1, v2, a[20], b[15]);-	MONT_MAC(w0, w1, w2, a[21], b[14]);-	MONT_MAC(t0, t1, t2, a[22], b[13]);-	MONT_MAC(v0, v1, v2, a[23], b[12]);-	MONT_MAC(w0, w1, w2, a[24], b[11]);-	MONT_MAC(t0, t1, t2, a[25], b[10]);-	MONT_MAC(v0, v1, v2, a[26], b[9]);-	MONT_MAC(w0, w1, w2, a[27], b[8]);-	MONT_MAC(t0, t1, t2, a[28], b[7]);-	MONT_MAC(v0, v1, v2, a[29], b[6]);-	MONT_MAC(w0, w1, w2, a[30], b[5]);-	MONT_MAC(t0, t1, t2, a[31], b[4]);-	MONT_MAC(v0, v1, v2, u[4], m[31]);-	MONT_MAC(w0, w1, w2, u[5], m[30]);-	MONT_MAC(t0, t1, t2, u[6], m[29]);-	MONT_MAC(v0, v1, v2, u[7], m[28]);-	MONT_MAC(w0, w1, w2, u[8], m[27]);-	MONT_MAC(t0, t1, t2, u[9], m[26]);-	MONT_MAC(v0, v1, v2, u[10], m[25]);-	MONT_MAC(w0, w1, w2, u[11], m[24]);-	MONT_MAC(t0, t1, t2, u[12], m[23]);-	MONT_MAC(v0, v1, v2, u[13], m[22]);-	MONT_MAC(w0, w1, w2, u[14], m[21]);-	MONT_MAC(t0, t1, t2, u[15], m[20]);-	MONT_MAC(v0, v1, v2, u[16], m[19]);-	MONT_MAC(w0, w1, w2, u[17], m[18]);-	MONT_MAC(t0, t1, t2, u[18], m[17]);-	MONT_MAC(v0, v1, v2, u[19], m[16]);-	MONT_MAC(w0, w1, w2, u[20], m[15]);-	MONT_MAC(t0, t1, t2, u[21], m[14]);-	MONT_MAC(v0, v1, v2, u[22], m[13]);-	MONT_MAC(w0, w1, w2, u[23], m[12]);-	MONT_MAC(t0, t1, t2, u[24], m[11]);-	MONT_MAC(v0, v1, v2, u[25], m[10]);-	MONT_MAC(w0, w1, w2, u[26], m[9]);-	MONT_MAC(t0, t1, t2, u[27], m[8]);-	MONT_MAC(v0, v1, v2, u[28], m[7]);-	MONT_MAC(w0, w1, w2, u[29], m[6]);-	MONT_MAC(t0, t1, t2, u[30], m[5]);-	MONT_MAC(v0, v1, v2, u[31], m[4]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_ADD(t0, t1, t2, w0, w1, w2);-	z[3] = t0;-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 36 */-	MONT_MAC(t0, t1, t2, a[5], b[31]);-	MONT_MUL(v0, v1, v2, a[6], b[30]);-	MONT_MUL(w0, w1, w2, a[7], b[29]);-	MONT_MAC(t0, t1, t2, a[8], b[28]);-	MONT_MAC(v0, v1, v2, a[9], b[27]);-	MONT_MAC(w0, w1, w2, a[10], b[26]);-	MONT_MAC(t0, t1, t2, a[11], b[25]);-	MONT_MAC(v0, v1, v2, a[12], b[24]);-	MONT_MAC(w0, w1, w2, a[13], b[23]);-	MONT_MAC(t0, t1, t2, a[14], b[22]);-	MONT_MAC(v0, v1, v2, a[15], b[21]);-	MONT_MAC(w0, w1, w2, a[16], b[20]);-	MONT_MAC(t0, t1, t2, a[17], b[19]);-	MONT_MAC(v0, v1, v2, a[18], b[18]);-	MONT_MAC(w0, w1, w2, a[19], b[17]);-	MONT_MAC(t0, t1, t2, a[20], b[16]);-	MONT_MAC(v0, v1, v2, a[21], b[15]);-	MONT_MAC(w0, w1, w2, a[22], b[14]);-	MONT_MAC(t0, t1, t2, a[23], b[13]);-	MONT_MAC(v0, v1, v2, a[24], b[12]);-	MONT_MAC(w0, w1, w2, a[25], b[11]);-	MONT_MAC(t0, t1, t2, a[26], b[10]);-	MONT_MAC(v0, v1, v2, a[27], b[9]);-	MONT_MAC(w0, w1, w2, a[28], b[8]);-	MONT_MAC(t0, t1, t2, a[29], b[7]);-	MONT_MAC(v0, v1, v2, a[30], b[6]);-	MONT_MAC(w0, w1, w2, a[31], b[5]);-	MONT_MAC(t0, t1, t2, u[5], m[31]);-	MONT_MAC(v0, v1, v2, u[6], m[30]);-	MONT_MAC(w0, w1, w2, u[7], m[29]);-	MONT_MAC(t0, t1, t2, u[8], m[28]);-	MONT_MAC(v0, v1, v2, u[9], m[27]);-	MONT_MAC(w0, w1, w2, u[10], m[26]);-	MONT_MAC(t0, t1, t2, u[11], m[25]);-	MONT_MAC(v0, v1, v2, u[12], m[24]);-	MONT_MAC(w0, w1, w2, u[13], m[23]);-	MONT_MAC(t0, t1, t2, u[14], m[22]);-	MONT_MAC(v0, v1, v2, u[15], m[21]);-	MONT_MAC(w0, w1, w2, u[16], m[20]);-	MONT_MAC(t0, t1, t2, u[17], m[19]);-	MONT_MAC(v0, v1, v2, u[18], m[18]);-	MONT_MAC(w0, w1, w2, u[19], m[17]);-	MONT_MAC(t0, t1, t2, u[20], m[16]);-	MONT_MAC(v0, v1, v2, u[21], m[15]);-	MONT_MAC(w0, w1, w2, u[22], m[14]);-	MONT_MAC(t0, t1, t2, u[23], m[13]);-	MONT_MAC(v0, v1, v2, u[24], m[12]);-	MONT_MAC(w0, w1, w2, u[25], m[11]);-	MONT_MAC(t0, t1, t2, u[26], m[10]);-	MONT_MAC(v0, v1, v2, u[27], m[9]);-	MONT_MAC(w0, w1, w2, u[28], m[8]);-	MONT_MAC(t0, t1, t2, u[29], m[7]);-	MONT_MAC(v0, v1, v2, u[30], m[6]);-	MONT_MAC(w0, w1, w2, u[31], m[5]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_ADD(t0, t1, t2, w0, w1, w2);-	z[4] = t0;-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 37 */-	MONT_MAC(t0, t1, t2, a[6], b[31]);-	MONT_MUL(v0, v1, v2, a[7], b[30]);-	MONT_MUL(w0, w1, w2, a[8], b[29]);-	MONT_MAC(t0, t1, t2, a[9], b[28]);-	MONT_MAC(v0, v1, v2, a[10], b[27]);-	MONT_MAC(w0, w1, w2, a[11], b[26]);-	MONT_MAC(t0, t1, t2, a[12], b[25]);-	MONT_MAC(v0, v1, v2, a[13], b[24]);-	MONT_MAC(w0, w1, w2, a[14], b[23]);-	MONT_MAC(t0, t1, t2, a[15], b[22]);-	MONT_MAC(v0, v1, v2, a[16], b[21]);-	MONT_MAC(w0, w1, w2, a[17], b[20]);-	MONT_MAC(t0, t1, t2, a[18], b[19]);-	MONT_MAC(v0, v1, v2, a[19], b[18]);-	MONT_MAC(w0, w1, w2, a[20], b[17]);-	MONT_MAC(t0, t1, t2, a[21], b[16]);-	MONT_MAC(v0, v1, v2, a[22], b[15]);-	MONT_MAC(w0, w1, w2, a[23], b[14]);-	MONT_MAC(t0, t1, t2, a[24], b[13]);-	MONT_MAC(v0, v1, v2, a[25], b[12]);-	MONT_MAC(w0, w1, w2, a[26], b[11]);-	MONT_MAC(t0, t1, t2, a[27], b[10]);-	MONT_MAC(v0, v1, v2, a[28], b[9]);-	MONT_MAC(w0, w1, w2, a[29], b[8]);-	MONT_MAC(t0, t1, t2, a[30], b[7]);-	MONT_MAC(v0, v1, v2, a[31], b[6]);-	MONT_MAC(w0, w1, w2, u[6], m[31]);-	MONT_MAC(t0, t1, t2, u[7], m[30]);-	MONT_MAC(v0, v1, v2, u[8], m[29]);-	MONT_MAC(w0, w1, w2, u[9], m[28]);-	MONT_MAC(t0, t1, t2, u[10], m[27]);-	MONT_MAC(v0, v1, v2, u[11], m[26]);-	MONT_MAC(w0, w1, w2, u[12], m[25]);-	MONT_MAC(t0, t1, t2, u[13], m[24]);-	MONT_MAC(v0, v1, v2, u[14], m[23]);-	MONT_MAC(w0, w1, w2, u[15], m[22]);-	MONT_MAC(t0, t1, t2, u[16], m[21]);-	MONT_MAC(v0, v1, v2, u[17], m[20]);-	MONT_MAC(w0, w1, w2, u[18], m[19]);-	MONT_MAC(t0, t1, t2, u[19], m[18]);-	MONT_MAC(v0, v1, v2, u[20], m[17]);-	MONT_MAC(w0, w1, w2, u[21], m[16]);-	MONT_MAC(t0, t1, t2, u[22], m[15]);-	MONT_MAC(v0, v1, v2, u[23], m[14]);-	MONT_MAC(w0, w1, w2, u[24], m[13]);-	MONT_MAC(t0, t1, t2, u[25], m[12]);-	MONT_MAC(v0, v1, v2, u[26], m[11]);-	MONT_MAC(w0, w1, w2, u[27], m[10]);-	MONT_MAC(t0, t1, t2, u[28], m[9]);-	MONT_MAC(v0, v1, v2, u[29], m[8]);-	MONT_MAC(w0, w1, w2, u[30], m[7]);-	MONT_MAC(t0, t1, t2, u[31], m[6]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_ADD(t0, t1, t2, w0, w1, w2);-	z[5] = t0;-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 38 */-	MONT_MAC(t0, t1, t2, a[7], b[31]);-	MONT_MUL(v0, v1, v2, a[8], b[30]);-	MONT_MUL(w0, w1, w2, a[9], b[29]);-	MONT_MAC(t0, t1, t2, a[10], b[28]);-	MONT_MAC(v0, v1, v2, a[11], b[27]);-	MONT_MAC(w0, w1, w2, a[12], b[26]);-	MONT_MAC(t0, t1, t2, a[13], b[25]);-	MONT_MAC(v0, v1, v2, a[14], b[24]);-	MONT_MAC(w0, w1, w2, a[15], b[23]);-	MONT_MAC(t0, t1, t2, a[16], b[22]);-	MONT_MAC(v0, v1, v2, a[17], b[21]);-	MONT_MAC(w0, w1, w2, a[18], b[20]);-	MONT_MAC(t0, t1, t2, a[19], b[19]);-	MONT_MAC(v0, v1, v2, a[20], b[18]);-	MONT_MAC(w0, w1, w2, a[21], b[17]);-	MONT_MAC(t0, t1, t2, a[22], b[16]);-	MONT_MAC(v0, v1, v2, a[23], b[15]);-	MONT_MAC(w0, w1, w2, a[24], b[14]);-	MONT_MAC(t0, t1, t2, a[25], b[13]);-	MONT_MAC(v0, v1, v2, a[26], b[12]);-	MONT_MAC(w0, w1, w2, a[27], b[11]);-	MONT_MAC(t0, t1, t2, a[28], b[10]);-	MONT_MAC(v0, v1, v2, a[29], b[9]);-	MONT_MAC(w0, w1, w2, a[30], b[8]);-	MONT_MAC(t0, t1, t2, a[31], b[7]);-	MONT_MAC(v0, v1, v2, u[7], m[31]);-	MONT_MAC(w0, w1, w2, u[8], m[30]);-	MONT_MAC(t0, t1, t2, u[9], m[29]);-	MONT_MAC(v0, v1, v2, u[10], m[28]);-	MONT_MAC(w0, w1, w2, u[11], m[27]);-	MONT_MAC(t0, t1, t2, u[12], m[26]);-	MONT_MAC(v0, v1, v2, u[13], m[25]);-	MONT_MAC(w0, w1, w2, u[14], m[24]);-	MONT_MAC(t0, t1, t2, u[15], m[23]);-	MONT_MAC(v0, v1, v2, u[16], m[22]);-	MONT_MAC(w0, w1, w2, u[17], m[21]);-	MONT_MAC(t0, t1, t2, u[18], m[20]);-	MONT_MAC(v0, v1, v2, u[19], m[19]);-	MONT_MAC(w0, w1, w2, u[20], m[18]);-	MONT_MAC(t0, t1, t2, u[21], m[17]);-	MONT_MAC(v0, v1, v2, u[22], m[16]);-	MONT_MAC(w0, w1, w2, u[23], m[15]);-	MONT_MAC(t0, t1, t2, u[24], m[14]);-	MONT_MAC(v0, v1, v2, u[25], m[13]);-	MONT_MAC(w0, w1, w2, u[26], m[12]);-	MONT_MAC(t0, t1, t2, u[27], m[11]);-	MONT_MAC(v0, v1, v2, u[28], m[10]);-	MONT_MAC(w0, w1, w2, u[29], m[9]);-	MONT_MAC(t0, t1, t2, u[30], m[8]);-	MONT_MAC(v0, v1, v2, u[31], m[7]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_ADD(t0, t1, t2, w0, w1, w2);-	z[6] = t0;-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 39 */-	MONT_MAC(t0, t1, t2, a[8], b[31]);-	MONT_MUL(v0, v1, v2, a[9], b[30]);-	MONT_MUL(w0, w1, w2, a[10], b[29]);-	MONT_MAC(t0, t1, t2, a[11], b[28]);-	MONT_MAC(v0, v1, v2, a[12], b[27]);-	MONT_MAC(w0, w1, w2, a[13], b[26]);-	MONT_MAC(t0, t1, t2, a[14], b[25]);-	MONT_MAC(v0, v1, v2, a[15], b[24]);-	MONT_MAC(w0, w1, w2, a[16], b[23]);-	MONT_MAC(t0, t1, t2, a[17], b[22]);-	MONT_MAC(v0, v1, v2, a[18], b[21]);-	MONT_MAC(w0, w1, w2, a[19], b[20]);-	MONT_MAC(t0, t1, t2, a[20], b[19]);-	MONT_MAC(v0, v1, v2, a[21], b[18]);-	MONT_MAC(w0, w1, w2, a[22], b[17]);-	MONT_MAC(t0, t1, t2, a[23], b[16]);-	MONT_MAC(v0, v1, v2, a[24], b[15]);-	MONT_MAC(w0, w1, w2, a[25], b[14]);-	MONT_MAC(t0, t1, t2, a[26], b[13]);-	MONT_MAC(v0, v1, v2, a[27], b[12]);-	MONT_MAC(w0, w1, w2, a[28], b[11]);-	MONT_MAC(t0, t1, t2, a[29], b[10]);-	MONT_MAC(v0, v1, v2, a[30], b[9]);-	MONT_MAC(w0, w1, w2, a[31], b[8]);-	MONT_MAC(t0, t1, t2, u[8], m[31]);-	MONT_MAC(v0, v1, v2, u[9], m[30]);-	MONT_MAC(w0, w1, w2, u[10], m[29]);-	MONT_MAC(t0, t1, t2, u[11], m[28]);-	MONT_MAC(v0, v1, v2, u[12], m[27]);-	MONT_MAC(w0, w1, w2, u[13], m[26]);-	MONT_MAC(t0, t1, t2, u[14], m[25]);-	MONT_MAC(v0, v1, v2, u[15], m[24]);-	MONT_MAC(w0, w1, w2, u[16], m[23]);-	MONT_MAC(t0, t1, t2, u[17], m[22]);-	MONT_MAC(v0, v1, v2, u[18], m[21]);-	MONT_MAC(w0, w1, w2, u[19], m[20]);-	MONT_MAC(t0, t1, t2, u[20], m[19]);-	MONT_MAC(v0, v1, v2, u[21], m[18]);-	MONT_MAC(w0, w1, w2, u[22], m[17]);-	MONT_MAC(t0, t1, t2, u[23], m[16]);-	MONT_MAC(v0, v1, v2, u[24], m[15]);-	MONT_MAC(w0, w1, w2, u[25], m[14]);-	MONT_MAC(t0, t1, t2, u[26], m[13]);-	MONT_MAC(v0, v1, v2, u[27], m[12]);-	MONT_MAC(w0, w1, w2, u[28], m[11]);-	MONT_MAC(t0, t1, t2, u[29], m[10]);-	MONT_MAC(v0, v1, v2, u[30], m[9]);-	MONT_MAC(w0, w1, w2, u[31], m[8]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_ADD(t0, t1, t2, w0, w1, w2);-	z[7] = t0;-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 40 */-	MONT_MAC(t0, t1, t2, a[9], b[31]);-	MONT_MUL(v0, v1, v2, a[10], b[30]);-	MONT_MUL(w0, w1, w2, a[11], b[29]);-	MONT_MAC(t0, t1, t2, a[12], b[28]);-	MONT_MAC(v0, v1, v2, a[13], b[27]);-	MONT_MAC(w0, w1, w2, a[14], b[26]);-	MONT_MAC(t0, t1, t2, a[15], b[25]);-	MONT_MAC(v0, v1, v2, a[16], b[24]);-	MONT_MAC(w0, w1, w2, a[17], b[23]);-	MONT_MAC(t0, t1, t2, a[18], b[22]);-	MONT_MAC(v0, v1, v2, a[19], b[21]);-	MONT_MAC(w0, w1, w2, a[20], b[20]);-	MONT_MAC(t0, t1, t2, a[21], b[19]);-	MONT_MAC(v0, v1, v2, a[22], b[18]);-	MONT_MAC(w0, w1, w2, a[23], b[17]);-	MONT_MAC(t0, t1, t2, a[24], b[16]);-	MONT_MAC(v0, v1, v2, a[25], b[15]);-	MONT_MAC(w0, w1, w2, a[26], b[14]);-	MONT_MAC(t0, t1, t2, a[27], b[13]);-	MONT_MAC(v0, v1, v2, a[28], b[12]);-	MONT_MAC(w0, w1, w2, a[29], b[11]);-	MONT_MAC(t0, t1, t2, a[30], b[10]);-	MONT_MAC(v0, v1, v2, a[31], b[9]);-	MONT_MAC(w0, w1, w2, u[9], m[31]);-	MONT_MAC(t0, t1, t2, u[10], m[30]);-	MONT_MAC(v0, v1, v2, u[11], m[29]);-	MONT_MAC(w0, w1, w2, u[12], m[28]);-	MONT_MAC(t0, t1, t2, u[13], m[27]);-	MONT_MAC(v0, v1, v2, u[14], m[26]);-	MONT_MAC(w0, w1, w2, u[15], m[25]);-	MONT_MAC(t0, t1, t2, u[16], m[24]);-	MONT_MAC(v0, v1, v2, u[17], m[23]);-	MONT_MAC(w0, w1, w2, u[18], m[22]);-	MONT_MAC(t0, t1, t2, u[19], m[21]);-	MONT_MAC(v0, v1, v2, u[20], m[20]);-	MONT_MAC(w0, w1, w2, u[21], m[19]);-	MONT_MAC(t0, t1, t2, u[22], m[18]);-	MONT_MAC(v0, v1, v2, u[23], m[17]);-	MONT_MAC(w0, w1, w2, u[24], m[16]);-	MONT_MAC(t0, t1, t2, u[25], m[15]);-	MONT_MAC(v0, v1, v2, u[26], m[14]);-	MONT_MAC(w0, w1, w2, u[27], m[13]);-	MONT_MAC(t0, t1, t2, u[28], m[12]);-	MONT_MAC(v0, v1, v2, u[29], m[11]);-	MONT_MAC(w0, w1, w2, u[30], m[10]);-	MONT_MAC(t0, t1, t2, u[31], m[9]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_ADD(t0, t1, t2, w0, w1, w2);-	z[8] = t0;-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 41 */-	MONT_MAC(t0, t1, t2, a[10], b[31]);-	MONT_MUL(v0, v1, v2, a[11], b[30]);-	MONT_MUL(w0, w1, w2, a[12], b[29]);-	MONT_MAC(t0, t1, t2, a[13], b[28]);-	MONT_MAC(v0, v1, v2, a[14], b[27]);-	MONT_MAC(w0, w1, w2, a[15], b[26]);-	MONT_MAC(t0, t1, t2, a[16], b[25]);-	MONT_MAC(v0, v1, v2, a[17], b[24]);-	MONT_MAC(w0, w1, w2, a[18], b[23]);-	MONT_MAC(t0, t1, t2, a[19], b[22]);-	MONT_MAC(v0, v1, v2, a[20], b[21]);-	MONT_MAC(w0, w1, w2, a[21], b[20]);-	MONT_MAC(t0, t1, t2, a[22], b[19]);-	MONT_MAC(v0, v1, v2, a[23], b[18]);-	MONT_MAC(w0, w1, w2, a[24], b[17]);-	MONT_MAC(t0, t1, t2, a[25], b[16]);-	MONT_MAC(v0, v1, v2, a[26], b[15]);-	MONT_MAC(w0, w1, w2, a[27], b[14]);-	MONT_MAC(t0, t1, t2, a[28], b[13]);-	MONT_MAC(v0, v1, v2, a[29], b[12]);-	MONT_MAC(w0, w1, w2, a[30], b[11]);-	MONT_MAC(t0, t1, t2, a[31], b[10]);-	MONT_MAC(v0, v1, v2, u[10], m[31]);-	MONT_MAC(w0, w1, w2, u[11], m[30]);-	MONT_MAC(t0, t1, t2, u[12], m[29]);-	MONT_MAC(v0, v1, v2, u[13], m[28]);-	MONT_MAC(w0, w1, w2, u[14], m[27]);-	MONT_MAC(t0, t1, t2, u[15], m[26]);-	MONT_MAC(v0, v1, v2, u[16], m[25]);-	MONT_MAC(w0, w1, w2, u[17], m[24]);-	MONT_MAC(t0, t1, t2, u[18], m[23]);-	MONT_MAC(v0, v1, v2, u[19], m[22]);-	MONT_MAC(w0, w1, w2, u[20], m[21]);-	MONT_MAC(t0, t1, t2, u[21], m[20]);-	MONT_MAC(v0, v1, v2, u[22], m[19]);-	MONT_MAC(w0, w1, w2, u[23], m[18]);-	MONT_MAC(t0, t1, t2, u[24], m[17]);-	MONT_MAC(v0, v1, v2, u[25], m[16]);-	MONT_MAC(w0, w1, w2, u[26], m[15]);-	MONT_MAC(t0, t1, t2, u[27], m[14]);-	MONT_MAC(v0, v1, v2, u[28], m[13]);-	MONT_MAC(w0, w1, w2, u[29], m[12]);-	MONT_MAC(t0, t1, t2, u[30], m[11]);-	MONT_MAC(v0, v1, v2, u[31], m[10]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_ADD(t0, t1, t2, w0, w1, w2);-	z[9] = t0;-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 42 */-	MONT_MAC(t0, t1, t2, a[11], b[31]);-	MONT_MUL(v0, v1, v2, a[12], b[30]);-	MONT_MUL(w0, w1, w2, a[13], b[29]);-	MONT_MAC(t0, t1, t2, a[14], b[28]);-	MONT_MAC(v0, v1, v2, a[15], b[27]);-	MONT_MAC(w0, w1, w2, a[16], b[26]);-	MONT_MAC(t0, t1, t2, a[17], b[25]);-	MONT_MAC(v0, v1, v2, a[18], b[24]);-	MONT_MAC(w0, w1, w2, a[19], b[23]);-	MONT_MAC(t0, t1, t2, a[20], b[22]);-	MONT_MAC(v0, v1, v2, a[21], b[21]);-	MONT_MAC(w0, w1, w2, a[22], b[20]);-	MONT_MAC(t0, t1, t2, a[23], b[19]);-	MONT_MAC(v0, v1, v2, a[24], b[18]);-	MONT_MAC(w0, w1, w2, a[25], b[17]);-	MONT_MAC(t0, t1, t2, a[26], b[16]);-	MONT_MAC(v0, v1, v2, a[27], b[15]);-	MONT_MAC(w0, w1, w2, a[28], b[14]);-	MONT_MAC(t0, t1, t2, a[29], b[13]);-	MONT_MAC(v0, v1, v2, a[30], b[12]);-	MONT_MAC(w0, w1, w2, a[31], b[11]);-	MONT_MAC(t0, t1, t2, u[11], m[31]);-	MONT_MAC(v0, v1, v2, u[12], m[30]);-	MONT_MAC(w0, w1, w2, u[13], m[29]);-	MONT_MAC(t0, t1, t2, u[14], m[28]);-	MONT_MAC(v0, v1, v2, u[15], m[27]);-	MONT_MAC(w0, w1, w2, u[16], m[26]);-	MONT_MAC(t0, t1, t2, u[17], m[25]);-	MONT_MAC(v0, v1, v2, u[18], m[24]);-	MONT_MAC(w0, w1, w2, u[19], m[23]);-	MONT_MAC(t0, t1, t2, u[20], m[22]);-	MONT_MAC(v0, v1, v2, u[21], m[21]);-	MONT_MAC(w0, w1, w2, u[22], m[20]);-	MONT_MAC(t0, t1, t2, u[23], m[19]);-	MONT_MAC(v0, v1, v2, u[24], m[18]);-	MONT_MAC(w0, w1, w2, u[25], m[17]);-	MONT_MAC(t0, t1, t2, u[26], m[16]);-	MONT_MAC(v0, v1, v2, u[27], m[15]);-	MONT_MAC(w0, w1, w2, u[28], m[14]);-	MONT_MAC(t0, t1, t2, u[29], m[13]);-	MONT_MAC(v0, v1, v2, u[30], m[12]);-	MONT_MAC(w0, w1, w2, u[31], m[11]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_ADD(t0, t1, t2, w0, w1, w2);-	z[10] = t0;-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 43 */-	MONT_MAC(t0, t1, t2, a[12], b[31]);-	MONT_MUL(v0, v1, v2, a[13], b[30]);-	MONT_MUL(w0, w1, w2, a[14], b[29]);-	MONT_MAC(t0, t1, t2, a[15], b[28]);-	MONT_MAC(v0, v1, v2, a[16], b[27]);-	MONT_MAC(w0, w1, w2, a[17], b[26]);-	MONT_MAC(t0, t1, t2, a[18], b[25]);-	MONT_MAC(v0, v1, v2, a[19], b[24]);-	MONT_MAC(w0, w1, w2, a[20], b[23]);-	MONT_MAC(t0, t1, t2, a[21], b[22]);-	MONT_MAC(v0, v1, v2, a[22], b[21]);-	MONT_MAC(w0, w1, w2, a[23], b[20]);-	MONT_MAC(t0, t1, t2, a[24], b[19]);-	MONT_MAC(v0, v1, v2, a[25], b[18]);-	MONT_MAC(w0, w1, w2, a[26], b[17]);-	MONT_MAC(t0, t1, t2, a[27], b[16]);-	MONT_MAC(v0, v1, v2, a[28], b[15]);-	MONT_MAC(w0, w1, w2, a[29], b[14]);-	MONT_MAC(t0, t1, t2, a[30], b[13]);-	MONT_MAC(v0, v1, v2, a[31], b[12]);-	MONT_MAC(w0, w1, w2, u[12], m[31]);-	MONT_MAC(t0, t1, t2, u[13], m[30]);-	MONT_MAC(v0, v1, v2, u[14], m[29]);-	MONT_MAC(w0, w1, w2, u[15], m[28]);-	MONT_MAC(t0, t1, t2, u[16], m[27]);-	MONT_MAC(v0, v1, v2, u[17], m[26]);-	MONT_MAC(w0, w1, w2, u[18], m[25]);-	MONT_MAC(t0, t1, t2, u[19], m[24]);-	MONT_MAC(v0, v1, v2, u[20], m[23]);-	MONT_MAC(w0, w1, w2, u[21], m[22]);-	MONT_MAC(t0, t1, t2, u[22], m[21]);-	MONT_MAC(v0, v1, v2, u[23], m[20]);-	MONT_MAC(w0, w1, w2, u[24], m[19]);-	MONT_MAC(t0, t1, t2, u[25], m[18]);-	MONT_MAC(v0, v1, v2, u[26], m[17]);-	MONT_MAC(w0, w1, w2, u[27], m[16]);-	MONT_MAC(t0, t1, t2, u[28], m[15]);-	MONT_MAC(v0, v1, v2, u[29], m[14]);-	MONT_MAC(w0, w1, w2, u[30], m[13]);-	MONT_MAC(t0, t1, t2, u[31], m[12]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_ADD(t0, t1, t2, w0, w1, w2);-	z[11] = t0;-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 44 */-	MONT_MAC(t0, t1, t2, a[13], b[31]);-	MONT_MUL(v0, v1, v2, a[14], b[30]);-	MONT_MUL(w0, w1, w2, a[15], b[29]);-	MONT_MAC(t0, t1, t2, a[16], b[28]);-	MONT_MAC(v0, v1, v2, a[17], b[27]);-	MONT_MAC(w0, w1, w2, a[18], b[26]);-	MONT_MAC(t0, t1, t2, a[19], b[25]);-	MONT_MAC(v0, v1, v2, a[20], b[24]);-	MONT_MAC(w0, w1, w2, a[21], b[23]);-	MONT_MAC(t0, t1, t2, a[22], b[22]);-	MONT_MAC(v0, v1, v2, a[23], b[21]);-	MONT_MAC(w0, w1, w2, a[24], b[20]);-	MONT_MAC(t0, t1, t2, a[25], b[19]);-	MONT_MAC(v0, v1, v2, a[26], b[18]);-	MONT_MAC(w0, w1, w2, a[27], b[17]);-	MONT_MAC(t0, t1, t2, a[28], b[16]);-	MONT_MAC(v0, v1, v2, a[29], b[15]);-	MONT_MAC(w0, w1, w2, a[30], b[14]);-	MONT_MAC(t0, t1, t2, a[31], b[13]);-	MONT_MAC(v0, v1, v2, u[13], m[31]);-	MONT_MAC(w0, w1, w2, u[14], m[30]);-	MONT_MAC(t0, t1, t2, u[15], m[29]);-	MONT_MAC(v0, v1, v2, u[16], m[28]);-	MONT_MAC(w0, w1, w2, u[17], m[27]);-	MONT_MAC(t0, t1, t2, u[18], m[26]);-	MONT_MAC(v0, v1, v2, u[19], m[25]);-	MONT_MAC(w0, w1, w2, u[20], m[24]);-	MONT_MAC(t0, t1, t2, u[21], m[23]);-	MONT_MAC(v0, v1, v2, u[22], m[22]);-	MONT_MAC(w0, w1, w2, u[23], m[21]);-	MONT_MAC(t0, t1, t2, u[24], m[20]);-	MONT_MAC(v0, v1, v2, u[25], m[19]);-	MONT_MAC(w0, w1, w2, u[26], m[18]);-	MONT_MAC(t0, t1, t2, u[27], m[17]);-	MONT_MAC(v0, v1, v2, u[28], m[16]);-	MONT_MAC(w0, w1, w2, u[29], m[15]);-	MONT_MAC(t0, t1, t2, u[30], m[14]);-	MONT_MAC(v0, v1, v2, u[31], m[13]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_ADD(t0, t1, t2, w0, w1, w2);-	z[12] = t0;-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 45 */-	MONT_MAC(t0, t1, t2, a[14], b[31]);-	MONT_MUL(v0, v1, v2, a[15], b[30]);-	MONT_MUL(w0, w1, w2, a[16], b[29]);-	MONT_MAC(t0, t1, t2, a[17], b[28]);-	MONT_MAC(v0, v1, v2, a[18], b[27]);-	MONT_MAC(w0, w1, w2, a[19], b[26]);-	MONT_MAC(t0, t1, t2, a[20], b[25]);-	MONT_MAC(v0, v1, v2, a[21], b[24]);-	MONT_MAC(w0, w1, w2, a[22], b[23]);-	MONT_MAC(t0, t1, t2, a[23], b[22]);-	MONT_MAC(v0, v1, v2, a[24], b[21]);-	MONT_MAC(w0, w1, w2, a[25], b[20]);-	MONT_MAC(t0, t1, t2, a[26], b[19]);-	MONT_MAC(v0, v1, v2, a[27], b[18]);-	MONT_MAC(w0, w1, w2, a[28], b[17]);-	MONT_MAC(t0, t1, t2, a[29], b[16]);-	MONT_MAC(v0, v1, v2, a[30], b[15]);-	MONT_MAC(w0, w1, w2, a[31], b[14]);-	MONT_MAC(t0, t1, t2, u[14], m[31]);-	MONT_MAC(v0, v1, v2, u[15], m[30]);-	MONT_MAC(w0, w1, w2, u[16], m[29]);-	MONT_MAC(t0, t1, t2, u[17], m[28]);-	MONT_MAC(v0, v1, v2, u[18], m[27]);-	MONT_MAC(w0, w1, w2, u[19], m[26]);-	MONT_MAC(t0, t1, t2, u[20], m[25]);-	MONT_MAC(v0, v1, v2, u[21], m[24]);-	MONT_MAC(w0, w1, w2, u[22], m[23]);-	MONT_MAC(t0, t1, t2, u[23], m[22]);-	MONT_MAC(v0, v1, v2, u[24], m[21]);-	MONT_MAC(w0, w1, w2, u[25], m[20]);-	MONT_MAC(t0, t1, t2, u[26], m[19]);-	MONT_MAC(v0, v1, v2, u[27], m[18]);-	MONT_MAC(w0, w1, w2, u[28], m[17]);-	MONT_MAC(t0, t1, t2, u[29], m[16]);-	MONT_MAC(v0, v1, v2, u[30], m[15]);-	MONT_MAC(w0, w1, w2, u[31], m[14]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_ADD(t0, t1, t2, w0, w1, w2);-	z[13] = t0;-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 46 */-	MONT_MAC(t0, t1, t2, a[15], b[31]);-	MONT_MUL(v0, v1, v2, a[16], b[30]);-	MONT_MUL(w0, w1, w2, a[17], b[29]);-	MONT_MAC(t0, t1, t2, a[18], b[28]);-	MONT_MAC(v0, v1, v2, a[19], b[27]);-	MONT_MAC(w0, w1, w2, a[20], b[26]);-	MONT_MAC(t0, t1, t2, a[21], b[25]);-	MONT_MAC(v0, v1, v2, a[22], b[24]);-	MONT_MAC(w0, w1, w2, a[23], b[23]);-	MONT_MAC(t0, t1, t2, a[24], b[22]);-	MONT_MAC(v0, v1, v2, a[25], b[21]);-	MONT_MAC(w0, w1, w2, a[26], b[20]);-	MONT_MAC(t0, t1, t2, a[27], b[19]);-	MONT_MAC(v0, v1, v2, a[28], b[18]);-	MONT_MAC(w0, w1, w2, a[29], b[17]);-	MONT_MAC(t0, t1, t2, a[30], b[16]);-	MONT_MAC(v0, v1, v2, a[31], b[15]);-	MONT_MAC(w0, w1, w2, u[15], m[31]);-	MONT_MAC(t0, t1, t2, u[16], m[30]);-	MONT_MAC(v0, v1, v2, u[17], m[29]);-	MONT_MAC(w0, w1, w2, u[18], m[28]);-	MONT_MAC(t0, t1, t2, u[19], m[27]);-	MONT_MAC(v0, v1, v2, u[20], m[26]);-	MONT_MAC(w0, w1, w2, u[21], m[25]);-	MONT_MAC(t0, t1, t2, u[22], m[24]);-	MONT_MAC(v0, v1, v2, u[23], m[23]);-	MONT_MAC(w0, w1, w2, u[24], m[22]);-	MONT_MAC(t0, t1, t2, u[25], m[21]);-	MONT_MAC(v0, v1, v2, u[26], m[20]);-	MONT_MAC(w0, w1, w2, u[27], m[19]);-	MONT_MAC(t0, t1, t2, u[28], m[18]);-	MONT_MAC(v0, v1, v2, u[29], m[17]);-	MONT_MAC(w0, w1, w2, u[30], m[16]);-	MONT_MAC(t0, t1, t2, u[31], m[15]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_ADD(t0, t1, t2, w0, w1, w2);-	z[14] = t0;-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 47 */-	MONT_MAC(t0, t1, t2, a[16], b[31]);-	MONT_MUL(v0, v1, v2, a[17], b[30]);-	MONT_MUL(w0, w1, w2, a[18], b[29]);-	MONT_MAC(t0, t1, t2, a[19], b[28]);-	MONT_MAC(v0, v1, v2, a[20], b[27]);-	MONT_MAC(w0, w1, w2, a[21], b[26]);-	MONT_MAC(t0, t1, t2, a[22], b[25]);-	MONT_MAC(v0, v1, v2, a[23], b[24]);-	MONT_MAC(w0, w1, w2, a[24], b[23]);-	MONT_MAC(t0, t1, t2, a[25], b[22]);-	MONT_MAC(v0, v1, v2, a[26], b[21]);-	MONT_MAC(w0, w1, w2, a[27], b[20]);-	MONT_MAC(t0, t1, t2, a[28], b[19]);-	MONT_MAC(v0, v1, v2, a[29], b[18]);-	MONT_MAC(w0, w1, w2, a[30], b[17]);-	MONT_MAC(t0, t1, t2, a[31], b[16]);-	MONT_MAC(v0, v1, v2, u[16], m[31]);-	MONT_MAC(w0, w1, w2, u[17], m[30]);-	MONT_MAC(t0, t1, t2, u[18], m[29]);-	MONT_MAC(v0, v1, v2, u[19], m[28]);-	MONT_MAC(w0, w1, w2, u[20], m[27]);-	MONT_MAC(t0, t1, t2, u[21], m[26]);-	MONT_MAC(v0, v1, v2, u[22], m[25]);-	MONT_MAC(w0, w1, w2, u[23], m[24]);-	MONT_MAC(t0, t1, t2, u[24], m[23]);-	MONT_MAC(v0, v1, v2, u[25], m[22]);-	MONT_MAC(w0, w1, w2, u[26], m[21]);-	MONT_MAC(t0, t1, t2, u[27], m[20]);-	MONT_MAC(v0, v1, v2, u[28], m[19]);-	MONT_MAC(w0, w1, w2, u[29], m[18]);-	MONT_MAC(t0, t1, t2, u[30], m[17]);-	MONT_MAC(v0, v1, v2, u[31], m[16]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_ADD(t0, t1, t2, w0, w1, w2);-	z[15] = t0;-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 48 */-	MONT_MAC(t0, t1, t2, a[17], b[31]);-	MONT_MUL(v0, v1, v2, a[18], b[30]);-	MONT_MUL(w0, w1, w2, a[19], b[29]);-	MONT_MAC(t0, t1, t2, a[20], b[28]);-	MONT_MAC(v0, v1, v2, a[21], b[27]);-	MONT_MAC(w0, w1, w2, a[22], b[26]);-	MONT_MAC(t0, t1, t2, a[23], b[25]);-	MONT_MAC(v0, v1, v2, a[24], b[24]);-	MONT_MAC(w0, w1, w2, a[25], b[23]);-	MONT_MAC(t0, t1, t2, a[26], b[22]);-	MONT_MAC(v0, v1, v2, a[27], b[21]);-	MONT_MAC(w0, w1, w2, a[28], b[20]);-	MONT_MAC(t0, t1, t2, a[29], b[19]);-	MONT_MAC(v0, v1, v2, a[30], b[18]);-	MONT_MAC(w0, w1, w2, a[31], b[17]);-	MONT_MAC(t0, t1, t2, u[17], m[31]);-	MONT_MAC(v0, v1, v2, u[18], m[30]);-	MONT_MAC(w0, w1, w2, u[19], m[29]);-	MONT_MAC(t0, t1, t2, u[20], m[28]);-	MONT_MAC(v0, v1, v2, u[21], m[27]);-	MONT_MAC(w0, w1, w2, u[22], m[26]);-	MONT_MAC(t0, t1, t2, u[23], m[25]);-	MONT_MAC(v0, v1, v2, u[24], m[24]);-	MONT_MAC(w0, w1, w2, u[25], m[23]);-	MONT_MAC(t0, t1, t2, u[26], m[22]);-	MONT_MAC(v0, v1, v2, u[27], m[21]);-	MONT_MAC(w0, w1, w2, u[28], m[20]);-	MONT_MAC(t0, t1, t2, u[29], m[19]);-	MONT_MAC(v0, v1, v2, u[30], m[18]);-	MONT_MAC(w0, w1, w2, u[31], m[17]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_ADD(t0, t1, t2, w0, w1, w2);-	z[16] = t0;-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 49 */-	MONT_MAC(t0, t1, t2, a[18], b[31]);-	MONT_MUL(v0, v1, v2, a[19], b[30]);-	MONT_MUL(w0, w1, w2, a[20], b[29]);-	MONT_MAC(t0, t1, t2, a[21], b[28]);-	MONT_MAC(v0, v1, v2, a[22], b[27]);-	MONT_MAC(w0, w1, w2, a[23], b[26]);-	MONT_MAC(t0, t1, t2, a[24], b[25]);-	MONT_MAC(v0, v1, v2, a[25], b[24]);-	MONT_MAC(w0, w1, w2, a[26], b[23]);-	MONT_MAC(t0, t1, t2, a[27], b[22]);-	MONT_MAC(v0, v1, v2, a[28], b[21]);-	MONT_MAC(w0, w1, w2, a[29], b[20]);-	MONT_MAC(t0, t1, t2, a[30], b[19]);-	MONT_MAC(v0, v1, v2, a[31], b[18]);-	MONT_MAC(w0, w1, w2, u[18], m[31]);-	MONT_MAC(t0, t1, t2, u[19], m[30]);-	MONT_MAC(v0, v1, v2, u[20], m[29]);-	MONT_MAC(w0, w1, w2, u[21], m[28]);-	MONT_MAC(t0, t1, t2, u[22], m[27]);-	MONT_MAC(v0, v1, v2, u[23], m[26]);-	MONT_MAC(w0, w1, w2, u[24], m[25]);-	MONT_MAC(t0, t1, t2, u[25], m[24]);-	MONT_MAC(v0, v1, v2, u[26], m[23]);-	MONT_MAC(w0, w1, w2, u[27], m[22]);-	MONT_MAC(t0, t1, t2, u[28], m[21]);-	MONT_MAC(v0, v1, v2, u[29], m[20]);-	MONT_MAC(w0, w1, w2, u[30], m[19]);-	MONT_MAC(t0, t1, t2, u[31], m[18]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_ADD(t0, t1, t2, w0, w1, w2);-	z[17] = t0;-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 50 */-	MONT_MAC(t0, t1, t2, a[19], b[31]);-	MONT_MUL(v0, v1, v2, a[20], b[30]);-	MONT_MUL(w0, w1, w2, a[21], b[29]);-	MONT_MAC(t0, t1, t2, a[22], b[28]);-	MONT_MAC(v0, v1, v2, a[23], b[27]);-	MONT_MAC(w0, w1, w2, a[24], b[26]);-	MONT_MAC(t0, t1, t2, a[25], b[25]);-	MONT_MAC(v0, v1, v2, a[26], b[24]);-	MONT_MAC(w0, w1, w2, a[27], b[23]);-	MONT_MAC(t0, t1, t2, a[28], b[22]);-	MONT_MAC(v0, v1, v2, a[29], b[21]);-	MONT_MAC(w0, w1, w2, a[30], b[20]);-	MONT_MAC(t0, t1, t2, a[31], b[19]);-	MONT_MAC(v0, v1, v2, u[19], m[31]);-	MONT_MAC(w0, w1, w2, u[20], m[30]);-	MONT_MAC(t0, t1, t2, u[21], m[29]);-	MONT_MAC(v0, v1, v2, u[22], m[28]);-	MONT_MAC(w0, w1, w2, u[23], m[27]);-	MONT_MAC(t0, t1, t2, u[24], m[26]);-	MONT_MAC(v0, v1, v2, u[25], m[25]);-	MONT_MAC(w0, w1, w2, u[26], m[24]);-	MONT_MAC(t0, t1, t2, u[27], m[23]);-	MONT_MAC(v0, v1, v2, u[28], m[22]);-	MONT_MAC(w0, w1, w2, u[29], m[21]);-	MONT_MAC(t0, t1, t2, u[30], m[20]);-	MONT_MAC(v0, v1, v2, u[31], m[19]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_ADD(t0, t1, t2, w0, w1, w2);-	z[18] = t0;-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 51 */-	MONT_MAC(t0, t1, t2, a[20], b[31]);-	MONT_MUL(v0, v1, v2, a[21], b[30]);-	MONT_MUL(w0, w1, w2, a[22], b[29]);-	MONT_MAC(t0, t1, t2, a[23], b[28]);-	MONT_MAC(v0, v1, v2, a[24], b[27]);-	MONT_MAC(w0, w1, w2, a[25], b[26]);-	MONT_MAC(t0, t1, t2, a[26], b[25]);-	MONT_MAC(v0, v1, v2, a[27], b[24]);-	MONT_MAC(w0, w1, w2, a[28], b[23]);-	MONT_MAC(t0, t1, t2, a[29], b[22]);-	MONT_MAC(v0, v1, v2, a[30], b[21]);-	MONT_MAC(w0, w1, w2, a[31], b[20]);-	MONT_MAC(t0, t1, t2, u[20], m[31]);-	MONT_MAC(v0, v1, v2, u[21], m[30]);-	MONT_MAC(w0, w1, w2, u[22], m[29]);-	MONT_MAC(t0, t1, t2, u[23], m[28]);-	MONT_MAC(v0, v1, v2, u[24], m[27]);-	MONT_MAC(w0, w1, w2, u[25], m[26]);-	MONT_MAC(t0, t1, t2, u[26], m[25]);-	MONT_MAC(v0, v1, v2, u[27], m[24]);-	MONT_MAC(w0, w1, w2, u[28], m[23]);-	MONT_MAC(t0, t1, t2, u[29], m[22]);-	MONT_MAC(v0, v1, v2, u[30], m[21]);-	MONT_MAC(w0, w1, w2, u[31], m[20]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_ADD(t0, t1, t2, w0, w1, w2);-	z[19] = t0;-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 52 */-	MONT_MAC(t0, t1, t2, a[21], b[31]);-	MONT_MUL(v0, v1, v2, a[22], b[30]);-	MONT_MUL(w0, w1, w2, a[23], b[29]);-	MONT_MAC(t0, t1, t2, a[24], b[28]);-	MONT_MAC(v0, v1, v2, a[25], b[27]);-	MONT_MAC(w0, w1, w2, a[26], b[26]);-	MONT_MAC(t0, t1, t2, a[27], b[25]);-	MONT_MAC(v0, v1, v2, a[28], b[24]);-	MONT_MAC(w0, w1, w2, a[29], b[23]);-	MONT_MAC(t0, t1, t2, a[30], b[22]);-	MONT_MAC(v0, v1, v2, a[31], b[21]);-	MONT_MAC(w0, w1, w2, u[21], m[31]);-	MONT_MAC(t0, t1, t2, u[22], m[30]);-	MONT_MAC(v0, v1, v2, u[23], m[29]);-	MONT_MAC(w0, w1, w2, u[24], m[28]);-	MONT_MAC(t0, t1, t2, u[25], m[27]);-	MONT_MAC(v0, v1, v2, u[26], m[26]);-	MONT_MAC(w0, w1, w2, u[27], m[25]);-	MONT_MAC(t0, t1, t2, u[28], m[24]);-	MONT_MAC(v0, v1, v2, u[29], m[23]);-	MONT_MAC(w0, w1, w2, u[30], m[22]);-	MONT_MAC(t0, t1, t2, u[31], m[21]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_ADD(t0, t1, t2, w0, w1, w2);-	z[20] = t0;-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 53 */-	MONT_MAC(t0, t1, t2, a[22], b[31]);-	MONT_MUL(v0, v1, v2, a[23], b[30]);-	MONT_MUL(w0, w1, w2, a[24], b[29]);-	MONT_MAC(t0, t1, t2, a[25], b[28]);-	MONT_MAC(v0, v1, v2, a[26], b[27]);-	MONT_MAC(w0, w1, w2, a[27], b[26]);-	MONT_MAC(t0, t1, t2, a[28], b[25]);-	MONT_MAC(v0, v1, v2, a[29], b[24]);-	MONT_MAC(w0, w1, w2, a[30], b[23]);-	MONT_MAC(t0, t1, t2, a[31], b[22]);-	MONT_MAC(v0, v1, v2, u[22], m[31]);-	MONT_MAC(w0, w1, w2, u[23], m[30]);-	MONT_MAC(t0, t1, t2, u[24], m[29]);-	MONT_MAC(v0, v1, v2, u[25], m[28]);-	MONT_MAC(w0, w1, w2, u[26], m[27]);-	MONT_MAC(t0, t1, t2, u[27], m[26]);-	MONT_MAC(v0, v1, v2, u[28], m[25]);-	MONT_MAC(w0, w1, w2, u[29], m[24]);-	MONT_MAC(t0, t1, t2, u[30], m[23]);-	MONT_MAC(v0, v1, v2, u[31], m[22]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_ADD(t0, t1, t2, w0, w1, w2);-	z[21] = t0;-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 54 */-	MONT_MAC(t0, t1, t2, a[23], b[31]);-	MONT_MUL(v0, v1, v2, a[24], b[30]);-	MONT_MUL(w0, w1, w2, a[25], b[29]);-	MONT_MAC(t0, t1, t2, a[26], b[28]);-	MONT_MAC(v0, v1, v2, a[27], b[27]);-	MONT_MAC(w0, w1, w2, a[28], b[26]);-	MONT_MAC(t0, t1, t2, a[29], b[25]);-	MONT_MAC(v0, v1, v2, a[30], b[24]);-	MONT_MAC(w0, w1, w2, a[31], b[23]);-	MONT_MAC(t0, t1, t2, u[23], m[31]);-	MONT_MAC(v0, v1, v2, u[24], m[30]);-	MONT_MAC(w0, w1, w2, u[25], m[29]);-	MONT_MAC(t0, t1, t2, u[26], m[28]);-	MONT_MAC(v0, v1, v2, u[27], m[27]);-	MONT_MAC(w0, w1, w2, u[28], m[26]);-	MONT_MAC(t0, t1, t2, u[29], m[25]);-	MONT_MAC(v0, v1, v2, u[30], m[24]);-	MONT_MAC(w0, w1, w2, u[31], m[23]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_ADD(t0, t1, t2, w0, w1, w2);-	z[22] = t0;-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 55 */-	MONT_MAC(t0, t1, t2, a[24], b[31]);-	MONT_MUL(v0, v1, v2, a[25], b[30]);-	MONT_MUL(w0, w1, w2, a[26], b[29]);-	MONT_MAC(t0, t1, t2, a[27], b[28]);-	MONT_MAC(v0, v1, v2, a[28], b[27]);-	MONT_MAC(w0, w1, w2, a[29], b[26]);-	MONT_MAC(t0, t1, t2, a[30], b[25]);-	MONT_MAC(v0, v1, v2, a[31], b[24]);-	MONT_MAC(w0, w1, w2, u[24], m[31]);-	MONT_MAC(t0, t1, t2, u[25], m[30]);-	MONT_MAC(v0, v1, v2, u[26], m[29]);-	MONT_MAC(w0, w1, w2, u[27], m[28]);-	MONT_MAC(t0, t1, t2, u[28], m[27]);-	MONT_MAC(v0, v1, v2, u[29], m[26]);-	MONT_MAC(w0, w1, w2, u[30], m[25]);-	MONT_MAC(t0, t1, t2, u[31], m[24]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_ADD(t0, t1, t2, w0, w1, w2);-	z[23] = t0;-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 56 */-	MONT_MAC(t0, t1, t2, a[25], b[31]);-	MONT_MUL(v0, v1, v2, a[26], b[30]);-	MONT_MUL(w0, w1, w2, a[27], b[29]);-	MONT_MAC(t0, t1, t2, a[28], b[28]);-	MONT_MAC(v0, v1, v2, a[29], b[27]);-	MONT_MAC(w0, w1, w2, a[30], b[26]);-	MONT_MAC(t0, t1, t2, a[31], b[25]);-	MONT_MAC(v0, v1, v2, u[25], m[31]);-	MONT_MAC(w0, w1, w2, u[26], m[30]);-	MONT_MAC(t0, t1, t2, u[27], m[29]);-	MONT_MAC(v0, v1, v2, u[28], m[28]);-	MONT_MAC(w0, w1, w2, u[29], m[27]);-	MONT_MAC(t0, t1, t2, u[30], m[26]);-	MONT_MAC(v0, v1, v2, u[31], m[25]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_ADD(t0, t1, t2, w0, w1, w2);-	z[24] = t0;-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 57 */-	MONT_MAC(t0, t1, t2, a[26], b[31]);-	MONT_MUL(v0, v1, v2, a[27], b[30]);-	MONT_MUL(w0, w1, w2, a[28], b[29]);-	MONT_MAC(t0, t1, t2, a[29], b[28]);-	MONT_MAC(v0, v1, v2, a[30], b[27]);-	MONT_MAC(w0, w1, w2, a[31], b[26]);-	MONT_MAC(t0, t1, t2, u[26], m[31]);-	MONT_MAC(v0, v1, v2, u[27], m[30]);-	MONT_MAC(w0, w1, w2, u[28], m[29]);-	MONT_MAC(t0, t1, t2, u[29], m[28]);-	MONT_MAC(v0, v1, v2, u[30], m[27]);-	MONT_MAC(w0, w1, w2, u[31], m[26]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_ADD(t0, t1, t2, w0, w1, w2);-	z[25] = t0;-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 58 */-	MONT_MAC(t0, t1, t2, a[27], b[31]);-	MONT_MUL(v0, v1, v2, a[28], b[30]);-	MONT_MUL(w0, w1, w2, a[29], b[29]);-	MONT_MAC(t0, t1, t2, a[30], b[28]);-	MONT_MAC(v0, v1, v2, a[31], b[27]);-	MONT_MAC(w0, w1, w2, u[27], m[31]);-	MONT_MAC(t0, t1, t2, u[28], m[30]);-	MONT_MAC(v0, v1, v2, u[29], m[29]);-	MONT_MAC(w0, w1, w2, u[30], m[28]);-	MONT_MAC(t0, t1, t2, u[31], m[27]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_ADD(t0, t1, t2, w0, w1, w2);-	z[26] = t0;-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 59 */-	MONT_MAC(t0, t1, t2, a[28], b[31]);-	MONT_MUL(v0, v1, v2, a[29], b[30]);-	MONT_MUL(w0, w1, w2, a[30], b[29]);-	MONT_MAC(t0, t1, t2, a[31], b[28]);-	MONT_MAC(v0, v1, v2, u[28], m[31]);-	MONT_MAC(w0, w1, w2, u[29], m[30]);-	MONT_MAC(t0, t1, t2, u[30], m[29]);-	MONT_MAC(v0, v1, v2, u[31], m[28]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_ADD(t0, t1, t2, w0, w1, w2);-	z[27] = t0;-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 60 */-	MONT_MAC(t0, t1, t2, a[29], b[31]);-	MONT_MUL(v0, v1, v2, a[30], b[30]);-	MONT_MUL(w0, w1, w2, a[31], b[29]);-	MONT_MAC(t0, t1, t2, u[29], m[31]);-	MONT_MAC(v0, v1, v2, u[30], m[30]);-	MONT_MAC(w0, w1, w2, u[31], m[29]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_ADD(t0, t1, t2, w0, w1, w2);-	z[28] = t0;-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 61 */-	MONT_MAC(t0, t1, t2, a[30], b[31]);-	MONT_MUL(v0, v1, v2, a[31], b[30]);-	MONT_MUL(w0, w1, w2, u[30], m[31]);-	MONT_MAC(t0, t1, t2, u[31], m[30]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_ADD(t0, t1, t2, w0, w1, w2);-	z[29] = t0;-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 62 */-	MONT_MAC(t0, t1, t2, a[31], b[31]);-	MONT_MUL(v0, v1, v2, u[31], m[31]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	z[30] = t0;-	t0 = t1;-	t1 = t2;-	t2 = 0;-	z[31] = t0;--	/* under 2m, with t1 the bit above n limbs: at most one subtraction */-	borrow = sub_n(r, z, m, 32);-	take = t1 | (borrow ^ 1);-	select_n(r, r, z, take & 1, 32);-}--/* r = a * a * R^-1 mod m, for a under m; t is 2n limbs of scratch */-static void crypton_mont_sqr32(limb_t *r, const limb_t *a,-                               const limb_t *m, limb_t n0, limb_t *t)-{-	limb_t *u = t, *z = t + 32;-	limb_t t0 = 0, t1 = 0, t2 = 0, v0, v1, v2, w0, w1, w2, borrow, take;-	limb_t s0, s1, s2, c0, c1, c2;--	/* column 0 */-	MONT_MAC(t0, t1, t2, a[0], a[0]);-	u[0] = t0 * n0;-	MONT_MAC(t0, t1, t2, u[0], m[0]);-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 1 */-	MONT_MUL(s0, s1, s2, a[0], a[1]);-	MONT_MAC(t0, t1, t2, u[0], m[1]);-	MONT_DBL(s0, s1, s2);-	MONT_ADD(t0, t1, t2, s0, s1, s2);-	u[1] = t0 * n0;-	MONT_MAC(t0, t1, t2, u[1], m[0]);-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 2 */-	MONT_MUL(s0, s1, s2, a[0], a[2]);-	MONT_MAC(t0, t1, t2, a[1], a[1]);-	MONT_MUL(v0, v1, v2, u[0], m[2]);-	MONT_MUL(w0, w1, w2, u[1], m[1]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_ADD(t0, t1, t2, w0, w1, w2);-	MONT_DBL(s0, s1, s2);-	MONT_ADD(t0, t1, t2, s0, s1, s2);-	u[2] = t0 * n0;-	MONT_MAC(t0, t1, t2, u[2], m[0]);-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 3 */-	MONT_MUL(s0, s1, s2, a[0], a[3]);-	MONT_MUL(c0, c1, c2, a[1], a[2]);-	MONT_MAC(t0, t1, t2, u[0], m[3]);-	MONT_MUL(v0, v1, v2, u[1], m[2]);-	MONT_MUL(w0, w1, w2, u[2], m[1]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_ADD(t0, t1, t2, w0, w1, w2);-	MONT_ADD(s0, s1, s2, c0, c1, c2);-	MONT_DBL(s0, s1, s2);-	MONT_ADD(t0, t1, t2, s0, s1, s2);-	u[3] = t0 * n0;-	MONT_MAC(t0, t1, t2, u[3], m[0]);-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 4 */-	MONT_MUL(s0, s1, s2, a[0], a[4]);-	MONT_MUL(c0, c1, c2, a[1], a[3]);-	MONT_MAC(t0, t1, t2, a[2], a[2]);-	MONT_MUL(v0, v1, v2, u[0], m[4]);-	MONT_MUL(w0, w1, w2, u[1], m[3]);-	MONT_MAC(t0, t1, t2, u[2], m[2]);-	MONT_MAC(v0, v1, v2, u[3], m[1]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_ADD(t0, t1, t2, w0, w1, w2);-	MONT_ADD(s0, s1, s2, c0, c1, c2);-	MONT_DBL(s0, s1, s2);-	MONT_ADD(t0, t1, t2, s0, s1, s2);-	u[4] = t0 * n0;-	MONT_MAC(t0, t1, t2, u[4], m[0]);-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 5 */-	MONT_MUL(s0, s1, s2, a[0], a[5]);-	MONT_MUL(c0, c1, c2, a[1], a[4]);-	MONT_MAC(s0, s1, s2, a[2], a[3]);-	MONT_MAC(t0, t1, t2, u[0], m[5]);-	MONT_MUL(v0, v1, v2, u[1], m[4]);-	MONT_MUL(w0, w1, w2, u[2], m[3]);-	MONT_MAC(t0, t1, t2, u[3], m[2]);-	MONT_MAC(v0, v1, v2, u[4], m[1]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_ADD(t0, t1, t2, w0, w1, w2);-	MONT_ADD(s0, s1, s2, c0, c1, c2);-	MONT_DBL(s0, s1, s2);-	MONT_ADD(t0, t1, t2, s0, s1, s2);-	u[5] = t0 * n0;-	MONT_MAC(t0, t1, t2, u[5], m[0]);-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 6 */-	MONT_MUL(s0, s1, s2, a[0], a[6]);-	MONT_MUL(c0, c1, c2, a[1], a[5]);-	MONT_MAC(s0, s1, s2, a[2], a[4]);-	MONT_MAC(t0, t1, t2, a[3], a[3]);-	MONT_MUL(v0, v1, v2, u[0], m[6]);-	MONT_MUL(w0, w1, w2, u[1], m[5]);-	MONT_MAC(t0, t1, t2, u[2], m[4]);-	MONT_MAC(v0, v1, v2, u[3], m[3]);-	MONT_MAC(w0, w1, w2, u[4], m[2]);-	MONT_MAC(t0, t1, t2, u[5], m[1]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_ADD(t0, t1, t2, w0, w1, w2);-	MONT_ADD(s0, s1, s2, c0, c1, c2);-	MONT_DBL(s0, s1, s2);-	MONT_ADD(t0, t1, t2, s0, s1, s2);-	u[6] = t0 * n0;-	MONT_MAC(t0, t1, t2, u[6], m[0]);-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 7 */-	MONT_MUL(s0, s1, s2, a[0], a[7]);-	MONT_MUL(c0, c1, c2, a[1], a[6]);-	MONT_MAC(s0, s1, s2, a[2], a[5]);-	MONT_MAC(c0, c1, c2, a[3], a[4]);-	MONT_MAC(t0, t1, t2, u[0], m[7]);-	MONT_MUL(v0, v1, v2, u[1], m[6]);-	MONT_MUL(w0, w1, w2, u[2], m[5]);-	MONT_MAC(t0, t1, t2, u[3], m[4]);-	MONT_MAC(v0, v1, v2, u[4], m[3]);-	MONT_MAC(w0, w1, w2, u[5], m[2]);-	MONT_MAC(t0, t1, t2, u[6], m[1]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_ADD(t0, t1, t2, w0, w1, w2);-	MONT_ADD(s0, s1, s2, c0, c1, c2);-	MONT_DBL(s0, s1, s2);-	MONT_ADD(t0, t1, t2, s0, s1, s2);-	u[7] = t0 * n0;-	MONT_MAC(t0, t1, t2, u[7], m[0]);-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 8 */-	MONT_MUL(s0, s1, s2, a[0], a[8]);-	MONT_MUL(c0, c1, c2, a[1], a[7]);-	MONT_MAC(s0, s1, s2, a[2], a[6]);-	MONT_MAC(c0, c1, c2, a[3], a[5]);-	MONT_MAC(t0, t1, t2, a[4], a[4]);-	MONT_MUL(v0, v1, v2, u[0], m[8]);-	MONT_MUL(w0, w1, w2, u[1], m[7]);-	MONT_MAC(t0, t1, t2, u[2], m[6]);-	MONT_MAC(v0, v1, v2, u[3], m[5]);-	MONT_MAC(w0, w1, w2, u[4], m[4]);-	MONT_MAC(t0, t1, t2, u[5], m[3]);-	MONT_MAC(v0, v1, v2, u[6], m[2]);-	MONT_MAC(w0, w1, w2, u[7], m[1]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_ADD(t0, t1, t2, w0, w1, w2);-	MONT_ADD(s0, s1, s2, c0, c1, c2);-	MONT_DBL(s0, s1, s2);-	MONT_ADD(t0, t1, t2, s0, s1, s2);-	u[8] = t0 * n0;-	MONT_MAC(t0, t1, t2, u[8], m[0]);-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 9 */-	MONT_MUL(s0, s1, s2, a[0], a[9]);-	MONT_MUL(c0, c1, c2, a[1], a[8]);-	MONT_MAC(s0, s1, s2, a[2], a[7]);-	MONT_MAC(c0, c1, c2, a[3], a[6]);-	MONT_MAC(s0, s1, s2, a[4], a[5]);-	MONT_MAC(t0, t1, t2, u[0], m[9]);-	MONT_MUL(v0, v1, v2, u[1], m[8]);-	MONT_MUL(w0, w1, w2, u[2], m[7]);-	MONT_MAC(t0, t1, t2, u[3], m[6]);-	MONT_MAC(v0, v1, v2, u[4], m[5]);-	MONT_MAC(w0, w1, w2, u[5], m[4]);-	MONT_MAC(t0, t1, t2, u[6], m[3]);-	MONT_MAC(v0, v1, v2, u[7], m[2]);-	MONT_MAC(w0, w1, w2, u[8], m[1]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_ADD(t0, t1, t2, w0, w1, w2);-	MONT_ADD(s0, s1, s2, c0, c1, c2);-	MONT_DBL(s0, s1, s2);-	MONT_ADD(t0, t1, t2, s0, s1, s2);-	u[9] = t0 * n0;-	MONT_MAC(t0, t1, t2, u[9], m[0]);-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 10 */-	MONT_MUL(s0, s1, s2, a[0], a[10]);-	MONT_MUL(c0, c1, c2, a[1], a[9]);-	MONT_MAC(s0, s1, s2, a[2], a[8]);-	MONT_MAC(c0, c1, c2, a[3], a[7]);-	MONT_MAC(s0, s1, s2, a[4], a[6]);-	MONT_MAC(t0, t1, t2, a[5], a[5]);-	MONT_MUL(v0, v1, v2, u[0], m[10]);-	MONT_MUL(w0, w1, w2, u[1], m[9]);-	MONT_MAC(t0, t1, t2, u[2], m[8]);-	MONT_MAC(v0, v1, v2, u[3], m[7]);-	MONT_MAC(w0, w1, w2, u[4], m[6]);-	MONT_MAC(t0, t1, t2, u[5], m[5]);-	MONT_MAC(v0, v1, v2, u[6], m[4]);-	MONT_MAC(w0, w1, w2, u[7], m[3]);-	MONT_MAC(t0, t1, t2, u[8], m[2]);-	MONT_MAC(v0, v1, v2, u[9], m[1]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_ADD(t0, t1, t2, w0, w1, w2);-	MONT_ADD(s0, s1, s2, c0, c1, c2);-	MONT_DBL(s0, s1, s2);-	MONT_ADD(t0, t1, t2, s0, s1, s2);-	u[10] = t0 * n0;-	MONT_MAC(t0, t1, t2, u[10], m[0]);-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 11 */-	MONT_MUL(s0, s1, s2, a[0], a[11]);-	MONT_MUL(c0, c1, c2, a[1], a[10]);-	MONT_MAC(s0, s1, s2, a[2], a[9]);-	MONT_MAC(c0, c1, c2, a[3], a[8]);-	MONT_MAC(s0, s1, s2, a[4], a[7]);-	MONT_MAC(c0, c1, c2, a[5], a[6]);-	MONT_MAC(t0, t1, t2, u[0], m[11]);-	MONT_MUL(v0, v1, v2, u[1], m[10]);-	MONT_MUL(w0, w1, w2, u[2], m[9]);-	MONT_MAC(t0, t1, t2, u[3], m[8]);-	MONT_MAC(v0, v1, v2, u[4], m[7]);-	MONT_MAC(w0, w1, w2, u[5], m[6]);-	MONT_MAC(t0, t1, t2, u[6], m[5]);-	MONT_MAC(v0, v1, v2, u[7], m[4]);-	MONT_MAC(w0, w1, w2, u[8], m[3]);-	MONT_MAC(t0, t1, t2, u[9], m[2]);-	MONT_MAC(v0, v1, v2, u[10], m[1]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_ADD(t0, t1, t2, w0, w1, w2);-	MONT_ADD(s0, s1, s2, c0, c1, c2);-	MONT_DBL(s0, s1, s2);-	MONT_ADD(t0, t1, t2, s0, s1, s2);-	u[11] = t0 * n0;-	MONT_MAC(t0, t1, t2, u[11], m[0]);-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 12 */-	MONT_MUL(s0, s1, s2, a[0], a[12]);-	MONT_MUL(c0, c1, c2, a[1], a[11]);-	MONT_MAC(s0, s1, s2, a[2], a[10]);-	MONT_MAC(c0, c1, c2, a[3], a[9]);-	MONT_MAC(s0, s1, s2, a[4], a[8]);-	MONT_MAC(c0, c1, c2, a[5], a[7]);-	MONT_MAC(t0, t1, t2, a[6], a[6]);-	MONT_MUL(v0, v1, v2, u[0], m[12]);-	MONT_MUL(w0, w1, w2, u[1], m[11]);-	MONT_MAC(t0, t1, t2, u[2], m[10]);-	MONT_MAC(v0, v1, v2, u[3], m[9]);-	MONT_MAC(w0, w1, w2, u[4], m[8]);-	MONT_MAC(t0, t1, t2, u[5], m[7]);-	MONT_MAC(v0, v1, v2, u[6], m[6]);-	MONT_MAC(w0, w1, w2, u[7], m[5]);-	MONT_MAC(t0, t1, t2, u[8], m[4]);-	MONT_MAC(v0, v1, v2, u[9], m[3]);-	MONT_MAC(w0, w1, w2, u[10], m[2]);-	MONT_MAC(t0, t1, t2, u[11], m[1]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_ADD(t0, t1, t2, w0, w1, w2);-	MONT_ADD(s0, s1, s2, c0, c1, c2);-	MONT_DBL(s0, s1, s2);-	MONT_ADD(t0, t1, t2, s0, s1, s2);-	u[12] = t0 * n0;-	MONT_MAC(t0, t1, t2, u[12], m[0]);-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 13 */-	MONT_MUL(s0, s1, s2, a[0], a[13]);-	MONT_MUL(c0, c1, c2, a[1], a[12]);-	MONT_MAC(s0, s1, s2, a[2], a[11]);-	MONT_MAC(c0, c1, c2, a[3], a[10]);-	MONT_MAC(s0, s1, s2, a[4], a[9]);-	MONT_MAC(c0, c1, c2, a[5], a[8]);-	MONT_MAC(s0, s1, s2, a[6], a[7]);-	MONT_MAC(t0, t1, t2, u[0], m[13]);-	MONT_MUL(v0, v1, v2, u[1], m[12]);-	MONT_MUL(w0, w1, w2, u[2], m[11]);-	MONT_MAC(t0, t1, t2, u[3], m[10]);-	MONT_MAC(v0, v1, v2, u[4], m[9]);-	MONT_MAC(w0, w1, w2, u[5], m[8]);-	MONT_MAC(t0, t1, t2, u[6], m[7]);-	MONT_MAC(v0, v1, v2, u[7], m[6]);-	MONT_MAC(w0, w1, w2, u[8], m[5]);-	MONT_MAC(t0, t1, t2, u[9], m[4]);-	MONT_MAC(v0, v1, v2, u[10], m[3]);-	MONT_MAC(w0, w1, w2, u[11], m[2]);-	MONT_MAC(t0, t1, t2, u[12], m[1]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_ADD(t0, t1, t2, w0, w1, w2);-	MONT_ADD(s0, s1, s2, c0, c1, c2);-	MONT_DBL(s0, s1, s2);-	MONT_ADD(t0, t1, t2, s0, s1, s2);-	u[13] = t0 * n0;-	MONT_MAC(t0, t1, t2, u[13], m[0]);-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 14 */-	MONT_MUL(s0, s1, s2, a[0], a[14]);-	MONT_MUL(c0, c1, c2, a[1], a[13]);-	MONT_MAC(s0, s1, s2, a[2], a[12]);-	MONT_MAC(c0, c1, c2, a[3], a[11]);-	MONT_MAC(s0, s1, s2, a[4], a[10]);-	MONT_MAC(c0, c1, c2, a[5], a[9]);-	MONT_MAC(s0, s1, s2, a[6], a[8]);-	MONT_MAC(t0, t1, t2, a[7], a[7]);-	MONT_MUL(v0, v1, v2, u[0], m[14]);-	MONT_MUL(w0, w1, w2, u[1], m[13]);-	MONT_MAC(t0, t1, t2, u[2], m[12]);-	MONT_MAC(v0, v1, v2, u[3], m[11]);-	MONT_MAC(w0, w1, w2, u[4], m[10]);-	MONT_MAC(t0, t1, t2, u[5], m[9]);-	MONT_MAC(v0, v1, v2, u[6], m[8]);-	MONT_MAC(w0, w1, w2, u[7], m[7]);-	MONT_MAC(t0, t1, t2, u[8], m[6]);-	MONT_MAC(v0, v1, v2, u[9], m[5]);-	MONT_MAC(w0, w1, w2, u[10], m[4]);-	MONT_MAC(t0, t1, t2, u[11], m[3]);-	MONT_MAC(v0, v1, v2, u[12], m[2]);-	MONT_MAC(w0, w1, w2, u[13], m[1]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_ADD(t0, t1, t2, w0, w1, w2);-	MONT_ADD(s0, s1, s2, c0, c1, c2);-	MONT_DBL(s0, s1, s2);-	MONT_ADD(t0, t1, t2, s0, s1, s2);-	u[14] = t0 * n0;-	MONT_MAC(t0, t1, t2, u[14], m[0]);-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 15 */-	MONT_MUL(s0, s1, s2, a[0], a[15]);-	MONT_MUL(c0, c1, c2, a[1], a[14]);-	MONT_MAC(s0, s1, s2, a[2], a[13]);-	MONT_MAC(c0, c1, c2, a[3], a[12]);-	MONT_MAC(s0, s1, s2, a[4], a[11]);-	MONT_MAC(c0, c1, c2, a[5], a[10]);-	MONT_MAC(s0, s1, s2, a[6], a[9]);-	MONT_MAC(c0, c1, c2, a[7], a[8]);-	MONT_MAC(t0, t1, t2, u[0], m[15]);-	MONT_MUL(v0, v1, v2, u[1], m[14]);-	MONT_MUL(w0, w1, w2, u[2], m[13]);-	MONT_MAC(t0, t1, t2, u[3], m[12]);-	MONT_MAC(v0, v1, v2, u[4], m[11]);-	MONT_MAC(w0, w1, w2, u[5], m[10]);-	MONT_MAC(t0, t1, t2, u[6], m[9]);-	MONT_MAC(v0, v1, v2, u[7], m[8]);-	MONT_MAC(w0, w1, w2, u[8], m[7]);-	MONT_MAC(t0, t1, t2, u[9], m[6]);-	MONT_MAC(v0, v1, v2, u[10], m[5]);-	MONT_MAC(w0, w1, w2, u[11], m[4]);-	MONT_MAC(t0, t1, t2, u[12], m[3]);-	MONT_MAC(v0, v1, v2, u[13], m[2]);-	MONT_MAC(w0, w1, w2, u[14], m[1]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_ADD(t0, t1, t2, w0, w1, w2);-	MONT_ADD(s0, s1, s2, c0, c1, c2);-	MONT_DBL(s0, s1, s2);-	MONT_ADD(t0, t1, t2, s0, s1, s2);-	u[15] = t0 * n0;-	MONT_MAC(t0, t1, t2, u[15], m[0]);-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 16 */-	MONT_MUL(s0, s1, s2, a[0], a[16]);-	MONT_MUL(c0, c1, c2, a[1], a[15]);-	MONT_MAC(s0, s1, s2, a[2], a[14]);-	MONT_MAC(c0, c1, c2, a[3], a[13]);-	MONT_MAC(s0, s1, s2, a[4], a[12]);-	MONT_MAC(c0, c1, c2, a[5], a[11]);-	MONT_MAC(s0, s1, s2, a[6], a[10]);-	MONT_MAC(c0, c1, c2, a[7], a[9]);-	MONT_MAC(t0, t1, t2, a[8], a[8]);-	MONT_MUL(v0, v1, v2, u[0], m[16]);-	MONT_MUL(w0, w1, w2, u[1], m[15]);-	MONT_MAC(t0, t1, t2, u[2], m[14]);-	MONT_MAC(v0, v1, v2, u[3], m[13]);-	MONT_MAC(w0, w1, w2, u[4], m[12]);-	MONT_MAC(t0, t1, t2, u[5], m[11]);-	MONT_MAC(v0, v1, v2, u[6], m[10]);-	MONT_MAC(w0, w1, w2, u[7], m[9]);-	MONT_MAC(t0, t1, t2, u[8], m[8]);-	MONT_MAC(v0, v1, v2, u[9], m[7]);-	MONT_MAC(w0, w1, w2, u[10], m[6]);-	MONT_MAC(t0, t1, t2, u[11], m[5]);-	MONT_MAC(v0, v1, v2, u[12], m[4]);-	MONT_MAC(w0, w1, w2, u[13], m[3]);-	MONT_MAC(t0, t1, t2, u[14], m[2]);-	MONT_MAC(v0, v1, v2, u[15], m[1]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_ADD(t0, t1, t2, w0, w1, w2);-	MONT_ADD(s0, s1, s2, c0, c1, c2);-	MONT_DBL(s0, s1, s2);-	MONT_ADD(t0, t1, t2, s0, s1, s2);-	u[16] = t0 * n0;-	MONT_MAC(t0, t1, t2, u[16], m[0]);-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 17 */-	MONT_MUL(s0, s1, s2, a[0], a[17]);-	MONT_MUL(c0, c1, c2, a[1], a[16]);-	MONT_MAC(s0, s1, s2, a[2], a[15]);-	MONT_MAC(c0, c1, c2, a[3], a[14]);-	MONT_MAC(s0, s1, s2, a[4], a[13]);-	MONT_MAC(c0, c1, c2, a[5], a[12]);-	MONT_MAC(s0, s1, s2, a[6], a[11]);-	MONT_MAC(c0, c1, c2, a[7], a[10]);-	MONT_MAC(s0, s1, s2, a[8], a[9]);-	MONT_MAC(t0, t1, t2, u[0], m[17]);-	MONT_MUL(v0, v1, v2, u[1], m[16]);-	MONT_MUL(w0, w1, w2, u[2], m[15]);-	MONT_MAC(t0, t1, t2, u[3], m[14]);-	MONT_MAC(v0, v1, v2, u[4], m[13]);-	MONT_MAC(w0, w1, w2, u[5], m[12]);-	MONT_MAC(t0, t1, t2, u[6], m[11]);-	MONT_MAC(v0, v1, v2, u[7], m[10]);-	MONT_MAC(w0, w1, w2, u[8], m[9]);-	MONT_MAC(t0, t1, t2, u[9], m[8]);-	MONT_MAC(v0, v1, v2, u[10], m[7]);-	MONT_MAC(w0, w1, w2, u[11], m[6]);-	MONT_MAC(t0, t1, t2, u[12], m[5]);-	MONT_MAC(v0, v1, v2, u[13], m[4]);-	MONT_MAC(w0, w1, w2, u[14], m[3]);-	MONT_MAC(t0, t1, t2, u[15], m[2]);-	MONT_MAC(v0, v1, v2, u[16], m[1]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_ADD(t0, t1, t2, w0, w1, w2);-	MONT_ADD(s0, s1, s2, c0, c1, c2);-	MONT_DBL(s0, s1, s2);-	MONT_ADD(t0, t1, t2, s0, s1, s2);-	u[17] = t0 * n0;-	MONT_MAC(t0, t1, t2, u[17], m[0]);-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 18 */-	MONT_MUL(s0, s1, s2, a[0], a[18]);-	MONT_MUL(c0, c1, c2, a[1], a[17]);-	MONT_MAC(s0, s1, s2, a[2], a[16]);-	MONT_MAC(c0, c1, c2, a[3], a[15]);-	MONT_MAC(s0, s1, s2, a[4], a[14]);-	MONT_MAC(c0, c1, c2, a[5], a[13]);-	MONT_MAC(s0, s1, s2, a[6], a[12]);-	MONT_MAC(c0, c1, c2, a[7], a[11]);-	MONT_MAC(s0, s1, s2, a[8], a[10]);-	MONT_MAC(t0, t1, t2, a[9], a[9]);-	MONT_MUL(v0, v1, v2, u[0], m[18]);-	MONT_MUL(w0, w1, w2, u[1], m[17]);-	MONT_MAC(t0, t1, t2, u[2], m[16]);-	MONT_MAC(v0, v1, v2, u[3], m[15]);-	MONT_MAC(w0, w1, w2, u[4], m[14]);-	MONT_MAC(t0, t1, t2, u[5], m[13]);-	MONT_MAC(v0, v1, v2, u[6], m[12]);-	MONT_MAC(w0, w1, w2, u[7], m[11]);-	MONT_MAC(t0, t1, t2, u[8], m[10]);-	MONT_MAC(v0, v1, v2, u[9], m[9]);-	MONT_MAC(w0, w1, w2, u[10], m[8]);-	MONT_MAC(t0, t1, t2, u[11], m[7]);-	MONT_MAC(v0, v1, v2, u[12], m[6]);-	MONT_MAC(w0, w1, w2, u[13], m[5]);-	MONT_MAC(t0, t1, t2, u[14], m[4]);-	MONT_MAC(v0, v1, v2, u[15], m[3]);-	MONT_MAC(w0, w1, w2, u[16], m[2]);-	MONT_MAC(t0, t1, t2, u[17], m[1]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_ADD(t0, t1, t2, w0, w1, w2);-	MONT_ADD(s0, s1, s2, c0, c1, c2);-	MONT_DBL(s0, s1, s2);-	MONT_ADD(t0, t1, t2, s0, s1, s2);-	u[18] = t0 * n0;-	MONT_MAC(t0, t1, t2, u[18], m[0]);-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 19 */-	MONT_MUL(s0, s1, s2, a[0], a[19]);-	MONT_MUL(c0, c1, c2, a[1], a[18]);-	MONT_MAC(s0, s1, s2, a[2], a[17]);-	MONT_MAC(c0, c1, c2, a[3], a[16]);-	MONT_MAC(s0, s1, s2, a[4], a[15]);-	MONT_MAC(c0, c1, c2, a[5], a[14]);-	MONT_MAC(s0, s1, s2, a[6], a[13]);-	MONT_MAC(c0, c1, c2, a[7], a[12]);-	MONT_MAC(s0, s1, s2, a[8], a[11]);-	MONT_MAC(c0, c1, c2, a[9], a[10]);-	MONT_MAC(t0, t1, t2, u[0], m[19]);-	MONT_MUL(v0, v1, v2, u[1], m[18]);-	MONT_MUL(w0, w1, w2, u[2], m[17]);-	MONT_MAC(t0, t1, t2, u[3], m[16]);-	MONT_MAC(v0, v1, v2, u[4], m[15]);-	MONT_MAC(w0, w1, w2, u[5], m[14]);-	MONT_MAC(t0, t1, t2, u[6], m[13]);-	MONT_MAC(v0, v1, v2, u[7], m[12]);-	MONT_MAC(w0, w1, w2, u[8], m[11]);-	MONT_MAC(t0, t1, t2, u[9], m[10]);-	MONT_MAC(v0, v1, v2, u[10], m[9]);-	MONT_MAC(w0, w1, w2, u[11], m[8]);-	MONT_MAC(t0, t1, t2, u[12], m[7]);-	MONT_MAC(v0, v1, v2, u[13], m[6]);-	MONT_MAC(w0, w1, w2, u[14], m[5]);-	MONT_MAC(t0, t1, t2, u[15], m[4]);-	MONT_MAC(v0, v1, v2, u[16], m[3]);-	MONT_MAC(w0, w1, w2, u[17], m[2]);-	MONT_MAC(t0, t1, t2, u[18], m[1]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_ADD(t0, t1, t2, w0, w1, w2);-	MONT_ADD(s0, s1, s2, c0, c1, c2);-	MONT_DBL(s0, s1, s2);-	MONT_ADD(t0, t1, t2, s0, s1, s2);-	u[19] = t0 * n0;-	MONT_MAC(t0, t1, t2, u[19], m[0]);-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 20 */-	MONT_MUL(s0, s1, s2, a[0], a[20]);-	MONT_MUL(c0, c1, c2, a[1], a[19]);-	MONT_MAC(s0, s1, s2, a[2], a[18]);-	MONT_MAC(c0, c1, c2, a[3], a[17]);-	MONT_MAC(s0, s1, s2, a[4], a[16]);-	MONT_MAC(c0, c1, c2, a[5], a[15]);-	MONT_MAC(s0, s1, s2, a[6], a[14]);-	MONT_MAC(c0, c1, c2, a[7], a[13]);-	MONT_MAC(s0, s1, s2, a[8], a[12]);-	MONT_MAC(c0, c1, c2, a[9], a[11]);-	MONT_MAC(t0, t1, t2, a[10], a[10]);-	MONT_MUL(v0, v1, v2, u[0], m[20]);-	MONT_MUL(w0, w1, w2, u[1], m[19]);-	MONT_MAC(t0, t1, t2, u[2], m[18]);-	MONT_MAC(v0, v1, v2, u[3], m[17]);-	MONT_MAC(w0, w1, w2, u[4], m[16]);-	MONT_MAC(t0, t1, t2, u[5], m[15]);-	MONT_MAC(v0, v1, v2, u[6], m[14]);-	MONT_MAC(w0, w1, w2, u[7], m[13]);-	MONT_MAC(t0, t1, t2, u[8], m[12]);-	MONT_MAC(v0, v1, v2, u[9], m[11]);-	MONT_MAC(w0, w1, w2, u[10], m[10]);-	MONT_MAC(t0, t1, t2, u[11], m[9]);-	MONT_MAC(v0, v1, v2, u[12], m[8]);-	MONT_MAC(w0, w1, w2, u[13], m[7]);-	MONT_MAC(t0, t1, t2, u[14], m[6]);-	MONT_MAC(v0, v1, v2, u[15], m[5]);-	MONT_MAC(w0, w1, w2, u[16], m[4]);-	MONT_MAC(t0, t1, t2, u[17], m[3]);-	MONT_MAC(v0, v1, v2, u[18], m[2]);-	MONT_MAC(w0, w1, w2, u[19], m[1]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_ADD(t0, t1, t2, w0, w1, w2);-	MONT_ADD(s0, s1, s2, c0, c1, c2);-	MONT_DBL(s0, s1, s2);-	MONT_ADD(t0, t1, t2, s0, s1, s2);-	u[20] = t0 * n0;-	MONT_MAC(t0, t1, t2, u[20], m[0]);-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 21 */-	MONT_MUL(s0, s1, s2, a[0], a[21]);-	MONT_MUL(c0, c1, c2, a[1], a[20]);-	MONT_MAC(s0, s1, s2, a[2], a[19]);-	MONT_MAC(c0, c1, c2, a[3], a[18]);-	MONT_MAC(s0, s1, s2, a[4], a[17]);-	MONT_MAC(c0, c1, c2, a[5], a[16]);-	MONT_MAC(s0, s1, s2, a[6], a[15]);-	MONT_MAC(c0, c1, c2, a[7], a[14]);-	MONT_MAC(s0, s1, s2, a[8], a[13]);-	MONT_MAC(c0, c1, c2, a[9], a[12]);-	MONT_MAC(s0, s1, s2, a[10], a[11]);-	MONT_MAC(t0, t1, t2, u[0], m[21]);-	MONT_MUL(v0, v1, v2, u[1], m[20]);-	MONT_MUL(w0, w1, w2, u[2], m[19]);-	MONT_MAC(t0, t1, t2, u[3], m[18]);-	MONT_MAC(v0, v1, v2, u[4], m[17]);-	MONT_MAC(w0, w1, w2, u[5], m[16]);-	MONT_MAC(t0, t1, t2, u[6], m[15]);-	MONT_MAC(v0, v1, v2, u[7], m[14]);-	MONT_MAC(w0, w1, w2, u[8], m[13]);-	MONT_MAC(t0, t1, t2, u[9], m[12]);-	MONT_MAC(v0, v1, v2, u[10], m[11]);-	MONT_MAC(w0, w1, w2, u[11], m[10]);-	MONT_MAC(t0, t1, t2, u[12], m[9]);-	MONT_MAC(v0, v1, v2, u[13], m[8]);-	MONT_MAC(w0, w1, w2, u[14], m[7]);-	MONT_MAC(t0, t1, t2, u[15], m[6]);-	MONT_MAC(v0, v1, v2, u[16], m[5]);-	MONT_MAC(w0, w1, w2, u[17], m[4]);-	MONT_MAC(t0, t1, t2, u[18], m[3]);-	MONT_MAC(v0, v1, v2, u[19], m[2]);-	MONT_MAC(w0, w1, w2, u[20], m[1]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_ADD(t0, t1, t2, w0, w1, w2);-	MONT_ADD(s0, s1, s2, c0, c1, c2);-	MONT_DBL(s0, s1, s2);-	MONT_ADD(t0, t1, t2, s0, s1, s2);-	u[21] = t0 * n0;-	MONT_MAC(t0, t1, t2, u[21], m[0]);-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 22 */-	MONT_MUL(s0, s1, s2, a[0], a[22]);-	MONT_MUL(c0, c1, c2, a[1], a[21]);-	MONT_MAC(s0, s1, s2, a[2], a[20]);-	MONT_MAC(c0, c1, c2, a[3], a[19]);-	MONT_MAC(s0, s1, s2, a[4], a[18]);-	MONT_MAC(c0, c1, c2, a[5], a[17]);-	MONT_MAC(s0, s1, s2, a[6], a[16]);-	MONT_MAC(c0, c1, c2, a[7], a[15]);-	MONT_MAC(s0, s1, s2, a[8], a[14]);-	MONT_MAC(c0, c1, c2, a[9], a[13]);-	MONT_MAC(s0, s1, s2, a[10], a[12]);-	MONT_MAC(t0, t1, t2, a[11], a[11]);-	MONT_MUL(v0, v1, v2, u[0], m[22]);-	MONT_MUL(w0, w1, w2, u[1], m[21]);-	MONT_MAC(t0, t1, t2, u[2], m[20]);-	MONT_MAC(v0, v1, v2, u[3], m[19]);-	MONT_MAC(w0, w1, w2, u[4], m[18]);-	MONT_MAC(t0, t1, t2, u[5], m[17]);-	MONT_MAC(v0, v1, v2, u[6], m[16]);-	MONT_MAC(w0, w1, w2, u[7], m[15]);-	MONT_MAC(t0, t1, t2, u[8], m[14]);-	MONT_MAC(v0, v1, v2, u[9], m[13]);-	MONT_MAC(w0, w1, w2, u[10], m[12]);-	MONT_MAC(t0, t1, t2, u[11], m[11]);-	MONT_MAC(v0, v1, v2, u[12], m[10]);-	MONT_MAC(w0, w1, w2, u[13], m[9]);-	MONT_MAC(t0, t1, t2, u[14], m[8]);-	MONT_MAC(v0, v1, v2, u[15], m[7]);-	MONT_MAC(w0, w1, w2, u[16], m[6]);-	MONT_MAC(t0, t1, t2, u[17], m[5]);-	MONT_MAC(v0, v1, v2, u[18], m[4]);-	MONT_MAC(w0, w1, w2, u[19], m[3]);-	MONT_MAC(t0, t1, t2, u[20], m[2]);-	MONT_MAC(v0, v1, v2, u[21], m[1]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_ADD(t0, t1, t2, w0, w1, w2);-	MONT_ADD(s0, s1, s2, c0, c1, c2);-	MONT_DBL(s0, s1, s2);-	MONT_ADD(t0, t1, t2, s0, s1, s2);-	u[22] = t0 * n0;-	MONT_MAC(t0, t1, t2, u[22], m[0]);-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 23 */-	MONT_MUL(s0, s1, s2, a[0], a[23]);-	MONT_MUL(c0, c1, c2, a[1], a[22]);-	MONT_MAC(s0, s1, s2, a[2], a[21]);-	MONT_MAC(c0, c1, c2, a[3], a[20]);-	MONT_MAC(s0, s1, s2, a[4], a[19]);-	MONT_MAC(c0, c1, c2, a[5], a[18]);-	MONT_MAC(s0, s1, s2, a[6], a[17]);-	MONT_MAC(c0, c1, c2, a[7], a[16]);-	MONT_MAC(s0, s1, s2, a[8], a[15]);-	MONT_MAC(c0, c1, c2, a[9], a[14]);-	MONT_MAC(s0, s1, s2, a[10], a[13]);-	MONT_MAC(c0, c1, c2, a[11], a[12]);-	MONT_MAC(t0, t1, t2, u[0], m[23]);-	MONT_MUL(v0, v1, v2, u[1], m[22]);-	MONT_MUL(w0, w1, w2, u[2], m[21]);-	MONT_MAC(t0, t1, t2, u[3], m[20]);-	MONT_MAC(v0, v1, v2, u[4], m[19]);-	MONT_MAC(w0, w1, w2, u[5], m[18]);-	MONT_MAC(t0, t1, t2, u[6], m[17]);-	MONT_MAC(v0, v1, v2, u[7], m[16]);-	MONT_MAC(w0, w1, w2, u[8], m[15]);-	MONT_MAC(t0, t1, t2, u[9], m[14]);-	MONT_MAC(v0, v1, v2, u[10], m[13]);-	MONT_MAC(w0, w1, w2, u[11], m[12]);-	MONT_MAC(t0, t1, t2, u[12], m[11]);-	MONT_MAC(v0, v1, v2, u[13], m[10]);-	MONT_MAC(w0, w1, w2, u[14], m[9]);-	MONT_MAC(t0, t1, t2, u[15], m[8]);-	MONT_MAC(v0, v1, v2, u[16], m[7]);-	MONT_MAC(w0, w1, w2, u[17], m[6]);-	MONT_MAC(t0, t1, t2, u[18], m[5]);-	MONT_MAC(v0, v1, v2, u[19], m[4]);-	MONT_MAC(w0, w1, w2, u[20], m[3]);-	MONT_MAC(t0, t1, t2, u[21], m[2]);-	MONT_MAC(v0, v1, v2, u[22], m[1]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_ADD(t0, t1, t2, w0, w1, w2);-	MONT_ADD(s0, s1, s2, c0, c1, c2);-	MONT_DBL(s0, s1, s2);-	MONT_ADD(t0, t1, t2, s0, s1, s2);-	u[23] = t0 * n0;-	MONT_MAC(t0, t1, t2, u[23], m[0]);-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 24 */-	MONT_MUL(s0, s1, s2, a[0], a[24]);-	MONT_MUL(c0, c1, c2, a[1], a[23]);-	MONT_MAC(s0, s1, s2, a[2], a[22]);-	MONT_MAC(c0, c1, c2, a[3], a[21]);-	MONT_MAC(s0, s1, s2, a[4], a[20]);-	MONT_MAC(c0, c1, c2, a[5], a[19]);-	MONT_MAC(s0, s1, s2, a[6], a[18]);-	MONT_MAC(c0, c1, c2, a[7], a[17]);-	MONT_MAC(s0, s1, s2, a[8], a[16]);-	MONT_MAC(c0, c1, c2, a[9], a[15]);-	MONT_MAC(s0, s1, s2, a[10], a[14]);-	MONT_MAC(c0, c1, c2, a[11], a[13]);-	MONT_MAC(t0, t1, t2, a[12], a[12]);-	MONT_MUL(v0, v1, v2, u[0], m[24]);-	MONT_MUL(w0, w1, w2, u[1], m[23]);-	MONT_MAC(t0, t1, t2, u[2], m[22]);-	MONT_MAC(v0, v1, v2, u[3], m[21]);-	MONT_MAC(w0, w1, w2, u[4], m[20]);-	MONT_MAC(t0, t1, t2, u[5], m[19]);-	MONT_MAC(v0, v1, v2, u[6], m[18]);-	MONT_MAC(w0, w1, w2, u[7], m[17]);-	MONT_MAC(t0, t1, t2, u[8], m[16]);-	MONT_MAC(v0, v1, v2, u[9], m[15]);-	MONT_MAC(w0, w1, w2, u[10], m[14]);-	MONT_MAC(t0, t1, t2, u[11], m[13]);-	MONT_MAC(v0, v1, v2, u[12], m[12]);-	MONT_MAC(w0, w1, w2, u[13], m[11]);-	MONT_MAC(t0, t1, t2, u[14], m[10]);-	MONT_MAC(v0, v1, v2, u[15], m[9]);-	MONT_MAC(w0, w1, w2, u[16], m[8]);-	MONT_MAC(t0, t1, t2, u[17], m[7]);-	MONT_MAC(v0, v1, v2, u[18], m[6]);-	MONT_MAC(w0, w1, w2, u[19], m[5]);-	MONT_MAC(t0, t1, t2, u[20], m[4]);-	MONT_MAC(v0, v1, v2, u[21], m[3]);-	MONT_MAC(w0, w1, w2, u[22], m[2]);-	MONT_MAC(t0, t1, t2, u[23], m[1]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_ADD(t0, t1, t2, w0, w1, w2);-	MONT_ADD(s0, s1, s2, c0, c1, c2);-	MONT_DBL(s0, s1, s2);-	MONT_ADD(t0, t1, t2, s0, s1, s2);-	u[24] = t0 * n0;-	MONT_MAC(t0, t1, t2, u[24], m[0]);-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 25 */-	MONT_MUL(s0, s1, s2, a[0], a[25]);-	MONT_MUL(c0, c1, c2, a[1], a[24]);-	MONT_MAC(s0, s1, s2, a[2], a[23]);-	MONT_MAC(c0, c1, c2, a[3], a[22]);-	MONT_MAC(s0, s1, s2, a[4], a[21]);-	MONT_MAC(c0, c1, c2, a[5], a[20]);-	MONT_MAC(s0, s1, s2, a[6], a[19]);-	MONT_MAC(c0, c1, c2, a[7], a[18]);-	MONT_MAC(s0, s1, s2, a[8], a[17]);-	MONT_MAC(c0, c1, c2, a[9], a[16]);-	MONT_MAC(s0, s1, s2, a[10], a[15]);-	MONT_MAC(c0, c1, c2, a[11], a[14]);-	MONT_MAC(s0, s1, s2, a[12], a[13]);-	MONT_MAC(t0, t1, t2, u[0], m[25]);-	MONT_MUL(v0, v1, v2, u[1], m[24]);-	MONT_MUL(w0, w1, w2, u[2], m[23]);-	MONT_MAC(t0, t1, t2, u[3], m[22]);-	MONT_MAC(v0, v1, v2, u[4], m[21]);-	MONT_MAC(w0, w1, w2, u[5], m[20]);-	MONT_MAC(t0, t1, t2, u[6], m[19]);-	MONT_MAC(v0, v1, v2, u[7], m[18]);-	MONT_MAC(w0, w1, w2, u[8], m[17]);-	MONT_MAC(t0, t1, t2, u[9], m[16]);-	MONT_MAC(v0, v1, v2, u[10], m[15]);-	MONT_MAC(w0, w1, w2, u[11], m[14]);-	MONT_MAC(t0, t1, t2, u[12], m[13]);-	MONT_MAC(v0, v1, v2, u[13], m[12]);-	MONT_MAC(w0, w1, w2, u[14], m[11]);-	MONT_MAC(t0, t1, t2, u[15], m[10]);-	MONT_MAC(v0, v1, v2, u[16], m[9]);-	MONT_MAC(w0, w1, w2, u[17], m[8]);-	MONT_MAC(t0, t1, t2, u[18], m[7]);-	MONT_MAC(v0, v1, v2, u[19], m[6]);-	MONT_MAC(w0, w1, w2, u[20], m[5]);-	MONT_MAC(t0, t1, t2, u[21], m[4]);-	MONT_MAC(v0, v1, v2, u[22], m[3]);-	MONT_MAC(w0, w1, w2, u[23], m[2]);-	MONT_MAC(t0, t1, t2, u[24], m[1]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_ADD(t0, t1, t2, w0, w1, w2);-	MONT_ADD(s0, s1, s2, c0, c1, c2);-	MONT_DBL(s0, s1, s2);-	MONT_ADD(t0, t1, t2, s0, s1, s2);-	u[25] = t0 * n0;-	MONT_MAC(t0, t1, t2, u[25], m[0]);-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 26 */-	MONT_MUL(s0, s1, s2, a[0], a[26]);-	MONT_MUL(c0, c1, c2, a[1], a[25]);-	MONT_MAC(s0, s1, s2, a[2], a[24]);-	MONT_MAC(c0, c1, c2, a[3], a[23]);-	MONT_MAC(s0, s1, s2, a[4], a[22]);-	MONT_MAC(c0, c1, c2, a[5], a[21]);-	MONT_MAC(s0, s1, s2, a[6], a[20]);-	MONT_MAC(c0, c1, c2, a[7], a[19]);-	MONT_MAC(s0, s1, s2, a[8], a[18]);-	MONT_MAC(c0, c1, c2, a[9], a[17]);-	MONT_MAC(s0, s1, s2, a[10], a[16]);-	MONT_MAC(c0, c1, c2, a[11], a[15]);-	MONT_MAC(s0, s1, s2, a[12], a[14]);-	MONT_MAC(t0, t1, t2, a[13], a[13]);-	MONT_MUL(v0, v1, v2, u[0], m[26]);-	MONT_MUL(w0, w1, w2, u[1], m[25]);-	MONT_MAC(t0, t1, t2, u[2], m[24]);-	MONT_MAC(v0, v1, v2, u[3], m[23]);-	MONT_MAC(w0, w1, w2, u[4], m[22]);-	MONT_MAC(t0, t1, t2, u[5], m[21]);-	MONT_MAC(v0, v1, v2, u[6], m[20]);-	MONT_MAC(w0, w1, w2, u[7], m[19]);-	MONT_MAC(t0, t1, t2, u[8], m[18]);-	MONT_MAC(v0, v1, v2, u[9], m[17]);-	MONT_MAC(w0, w1, w2, u[10], m[16]);-	MONT_MAC(t0, t1, t2, u[11], m[15]);-	MONT_MAC(v0, v1, v2, u[12], m[14]);-	MONT_MAC(w0, w1, w2, u[13], m[13]);-	MONT_MAC(t0, t1, t2, u[14], m[12]);-	MONT_MAC(v0, v1, v2, u[15], m[11]);-	MONT_MAC(w0, w1, w2, u[16], m[10]);-	MONT_MAC(t0, t1, t2, u[17], m[9]);-	MONT_MAC(v0, v1, v2, u[18], m[8]);-	MONT_MAC(w0, w1, w2, u[19], m[7]);-	MONT_MAC(t0, t1, t2, u[20], m[6]);-	MONT_MAC(v0, v1, v2, u[21], m[5]);-	MONT_MAC(w0, w1, w2, u[22], m[4]);-	MONT_MAC(t0, t1, t2, u[23], m[3]);-	MONT_MAC(v0, v1, v2, u[24], m[2]);-	MONT_MAC(w0, w1, w2, u[25], m[1]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_ADD(t0, t1, t2, w0, w1, w2);-	MONT_ADD(s0, s1, s2, c0, c1, c2);-	MONT_DBL(s0, s1, s2);-	MONT_ADD(t0, t1, t2, s0, s1, s2);-	u[26] = t0 * n0;-	MONT_MAC(t0, t1, t2, u[26], m[0]);-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 27 */-	MONT_MUL(s0, s1, s2, a[0], a[27]);-	MONT_MUL(c0, c1, c2, a[1], a[26]);-	MONT_MAC(s0, s1, s2, a[2], a[25]);-	MONT_MAC(c0, c1, c2, a[3], a[24]);-	MONT_MAC(s0, s1, s2, a[4], a[23]);-	MONT_MAC(c0, c1, c2, a[5], a[22]);-	MONT_MAC(s0, s1, s2, a[6], a[21]);-	MONT_MAC(c0, c1, c2, a[7], a[20]);-	MONT_MAC(s0, s1, s2, a[8], a[19]);-	MONT_MAC(c0, c1, c2, a[9], a[18]);-	MONT_MAC(s0, s1, s2, a[10], a[17]);-	MONT_MAC(c0, c1, c2, a[11], a[16]);-	MONT_MAC(s0, s1, s2, a[12], a[15]);-	MONT_MAC(c0, c1, c2, a[13], a[14]);-	MONT_MAC(t0, t1, t2, u[0], m[27]);-	MONT_MUL(v0, v1, v2, u[1], m[26]);-	MONT_MUL(w0, w1, w2, u[2], m[25]);-	MONT_MAC(t0, t1, t2, u[3], m[24]);-	MONT_MAC(v0, v1, v2, u[4], m[23]);-	MONT_MAC(w0, w1, w2, u[5], m[22]);-	MONT_MAC(t0, t1, t2, u[6], m[21]);-	MONT_MAC(v0, v1, v2, u[7], m[20]);-	MONT_MAC(w0, w1, w2, u[8], m[19]);-	MONT_MAC(t0, t1, t2, u[9], m[18]);-	MONT_MAC(v0, v1, v2, u[10], m[17]);-	MONT_MAC(w0, w1, w2, u[11], m[16]);-	MONT_MAC(t0, t1, t2, u[12], m[15]);-	MONT_MAC(v0, v1, v2, u[13], m[14]);-	MONT_MAC(w0, w1, w2, u[14], m[13]);-	MONT_MAC(t0, t1, t2, u[15], m[12]);-	MONT_MAC(v0, v1, v2, u[16], m[11]);-	MONT_MAC(w0, w1, w2, u[17], m[10]);-	MONT_MAC(t0, t1, t2, u[18], m[9]);-	MONT_MAC(v0, v1, v2, u[19], m[8]);-	MONT_MAC(w0, w1, w2, u[20], m[7]);-	MONT_MAC(t0, t1, t2, u[21], m[6]);-	MONT_MAC(v0, v1, v2, u[22], m[5]);-	MONT_MAC(w0, w1, w2, u[23], m[4]);-	MONT_MAC(t0, t1, t2, u[24], m[3]);-	MONT_MAC(v0, v1, v2, u[25], m[2]);-	MONT_MAC(w0, w1, w2, u[26], m[1]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_ADD(t0, t1, t2, w0, w1, w2);-	MONT_ADD(s0, s1, s2, c0, c1, c2);-	MONT_DBL(s0, s1, s2);-	MONT_ADD(t0, t1, t2, s0, s1, s2);-	u[27] = t0 * n0;-	MONT_MAC(t0, t1, t2, u[27], m[0]);-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 28 */-	MONT_MUL(s0, s1, s2, a[0], a[28]);-	MONT_MUL(c0, c1, c2, a[1], a[27]);-	MONT_MAC(s0, s1, s2, a[2], a[26]);-	MONT_MAC(c0, c1, c2, a[3], a[25]);-	MONT_MAC(s0, s1, s2, a[4], a[24]);-	MONT_MAC(c0, c1, c2, a[5], a[23]);-	MONT_MAC(s0, s1, s2, a[6], a[22]);-	MONT_MAC(c0, c1, c2, a[7], a[21]);-	MONT_MAC(s0, s1, s2, a[8], a[20]);-	MONT_MAC(c0, c1, c2, a[9], a[19]);-	MONT_MAC(s0, s1, s2, a[10], a[18]);-	MONT_MAC(c0, c1, c2, a[11], a[17]);-	MONT_MAC(s0, s1, s2, a[12], a[16]);-	MONT_MAC(c0, c1, c2, a[13], a[15]);-	MONT_MAC(t0, t1, t2, a[14], a[14]);-	MONT_MUL(v0, v1, v2, u[0], m[28]);-	MONT_MUL(w0, w1, w2, u[1], m[27]);-	MONT_MAC(t0, t1, t2, u[2], m[26]);-	MONT_MAC(v0, v1, v2, u[3], m[25]);-	MONT_MAC(w0, w1, w2, u[4], m[24]);-	MONT_MAC(t0, t1, t2, u[5], m[23]);-	MONT_MAC(v0, v1, v2, u[6], m[22]);-	MONT_MAC(w0, w1, w2, u[7], m[21]);-	MONT_MAC(t0, t1, t2, u[8], m[20]);-	MONT_MAC(v0, v1, v2, u[9], m[19]);-	MONT_MAC(w0, w1, w2, u[10], m[18]);-	MONT_MAC(t0, t1, t2, u[11], m[17]);-	MONT_MAC(v0, v1, v2, u[12], m[16]);-	MONT_MAC(w0, w1, w2, u[13], m[15]);-	MONT_MAC(t0, t1, t2, u[14], m[14]);-	MONT_MAC(v0, v1, v2, u[15], m[13]);-	MONT_MAC(w0, w1, w2, u[16], m[12]);-	MONT_MAC(t0, t1, t2, u[17], m[11]);-	MONT_MAC(v0, v1, v2, u[18], m[10]);-	MONT_MAC(w0, w1, w2, u[19], m[9]);-	MONT_MAC(t0, t1, t2, u[20], m[8]);-	MONT_MAC(v0, v1, v2, u[21], m[7]);-	MONT_MAC(w0, w1, w2, u[22], m[6]);-	MONT_MAC(t0, t1, t2, u[23], m[5]);-	MONT_MAC(v0, v1, v2, u[24], m[4]);-	MONT_MAC(w0, w1, w2, u[25], m[3]);-	MONT_MAC(t0, t1, t2, u[26], m[2]);-	MONT_MAC(v0, v1, v2, u[27], m[1]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_ADD(t0, t1, t2, w0, w1, w2);-	MONT_ADD(s0, s1, s2, c0, c1, c2);-	MONT_DBL(s0, s1, s2);-	MONT_ADD(t0, t1, t2, s0, s1, s2);-	u[28] = t0 * n0;-	MONT_MAC(t0, t1, t2, u[28], m[0]);-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 29 */-	MONT_MUL(s0, s1, s2, a[0], a[29]);-	MONT_MUL(c0, c1, c2, a[1], a[28]);-	MONT_MAC(s0, s1, s2, a[2], a[27]);-	MONT_MAC(c0, c1, c2, a[3], a[26]);-	MONT_MAC(s0, s1, s2, a[4], a[25]);-	MONT_MAC(c0, c1, c2, a[5], a[24]);-	MONT_MAC(s0, s1, s2, a[6], a[23]);-	MONT_MAC(c0, c1, c2, a[7], a[22]);-	MONT_MAC(s0, s1, s2, a[8], a[21]);-	MONT_MAC(c0, c1, c2, a[9], a[20]);-	MONT_MAC(s0, s1, s2, a[10], a[19]);-	MONT_MAC(c0, c1, c2, a[11], a[18]);-	MONT_MAC(s0, s1, s2, a[12], a[17]);-	MONT_MAC(c0, c1, c2, a[13], a[16]);-	MONT_MAC(s0, s1, s2, a[14], a[15]);-	MONT_MAC(t0, t1, t2, u[0], m[29]);-	MONT_MUL(v0, v1, v2, u[1], m[28]);-	MONT_MUL(w0, w1, w2, u[2], m[27]);-	MONT_MAC(t0, t1, t2, u[3], m[26]);-	MONT_MAC(v0, v1, v2, u[4], m[25]);-	MONT_MAC(w0, w1, w2, u[5], m[24]);-	MONT_MAC(t0, t1, t2, u[6], m[23]);-	MONT_MAC(v0, v1, v2, u[7], m[22]);-	MONT_MAC(w0, w1, w2, u[8], m[21]);-	MONT_MAC(t0, t1, t2, u[9], m[20]);-	MONT_MAC(v0, v1, v2, u[10], m[19]);-	MONT_MAC(w0, w1, w2, u[11], m[18]);-	MONT_MAC(t0, t1, t2, u[12], m[17]);-	MONT_MAC(v0, v1, v2, u[13], m[16]);-	MONT_MAC(w0, w1, w2, u[14], m[15]);-	MONT_MAC(t0, t1, t2, u[15], m[14]);-	MONT_MAC(v0, v1, v2, u[16], m[13]);-	MONT_MAC(w0, w1, w2, u[17], m[12]);-	MONT_MAC(t0, t1, t2, u[18], m[11]);-	MONT_MAC(v0, v1, v2, u[19], m[10]);-	MONT_MAC(w0, w1, w2, u[20], m[9]);-	MONT_MAC(t0, t1, t2, u[21], m[8]);-	MONT_MAC(v0, v1, v2, u[22], m[7]);-	MONT_MAC(w0, w1, w2, u[23], m[6]);-	MONT_MAC(t0, t1, t2, u[24], m[5]);-	MONT_MAC(v0, v1, v2, u[25], m[4]);-	MONT_MAC(w0, w1, w2, u[26], m[3]);-	MONT_MAC(t0, t1, t2, u[27], m[2]);-	MONT_MAC(v0, v1, v2, u[28], m[1]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_ADD(t0, t1, t2, w0, w1, w2);-	MONT_ADD(s0, s1, s2, c0, c1, c2);-	MONT_DBL(s0, s1, s2);-	MONT_ADD(t0, t1, t2, s0, s1, s2);-	u[29] = t0 * n0;-	MONT_MAC(t0, t1, t2, u[29], m[0]);-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 30 */-	MONT_MUL(s0, s1, s2, a[0], a[30]);-	MONT_MUL(c0, c1, c2, a[1], a[29]);-	MONT_MAC(s0, s1, s2, a[2], a[28]);-	MONT_MAC(c0, c1, c2, a[3], a[27]);-	MONT_MAC(s0, s1, s2, a[4], a[26]);-	MONT_MAC(c0, c1, c2, a[5], a[25]);-	MONT_MAC(s0, s1, s2, a[6], a[24]);-	MONT_MAC(c0, c1, c2, a[7], a[23]);-	MONT_MAC(s0, s1, s2, a[8], a[22]);-	MONT_MAC(c0, c1, c2, a[9], a[21]);-	MONT_MAC(s0, s1, s2, a[10], a[20]);-	MONT_MAC(c0, c1, c2, a[11], a[19]);-	MONT_MAC(s0, s1, s2, a[12], a[18]);-	MONT_MAC(c0, c1, c2, a[13], a[17]);-	MONT_MAC(s0, s1, s2, a[14], a[16]);-	MONT_MAC(t0, t1, t2, a[15], a[15]);-	MONT_MUL(v0, v1, v2, u[0], m[30]);-	MONT_MUL(w0, w1, w2, u[1], m[29]);-	MONT_MAC(t0, t1, t2, u[2], m[28]);-	MONT_MAC(v0, v1, v2, u[3], m[27]);-	MONT_MAC(w0, w1, w2, u[4], m[26]);-	MONT_MAC(t0, t1, t2, u[5], m[25]);-	MONT_MAC(v0, v1, v2, u[6], m[24]);-	MONT_MAC(w0, w1, w2, u[7], m[23]);-	MONT_MAC(t0, t1, t2, u[8], m[22]);-	MONT_MAC(v0, v1, v2, u[9], m[21]);-	MONT_MAC(w0, w1, w2, u[10], m[20]);-	MONT_MAC(t0, t1, t2, u[11], m[19]);-	MONT_MAC(v0, v1, v2, u[12], m[18]);-	MONT_MAC(w0, w1, w2, u[13], m[17]);-	MONT_MAC(t0, t1, t2, u[14], m[16]);-	MONT_MAC(v0, v1, v2, u[15], m[15]);-	MONT_MAC(w0, w1, w2, u[16], m[14]);-	MONT_MAC(t0, t1, t2, u[17], m[13]);-	MONT_MAC(v0, v1, v2, u[18], m[12]);-	MONT_MAC(w0, w1, w2, u[19], m[11]);-	MONT_MAC(t0, t1, t2, u[20], m[10]);-	MONT_MAC(v0, v1, v2, u[21], m[9]);-	MONT_MAC(w0, w1, w2, u[22], m[8]);-	MONT_MAC(t0, t1, t2, u[23], m[7]);-	MONT_MAC(v0, v1, v2, u[24], m[6]);-	MONT_MAC(w0, w1, w2, u[25], m[5]);-	MONT_MAC(t0, t1, t2, u[26], m[4]);-	MONT_MAC(v0, v1, v2, u[27], m[3]);-	MONT_MAC(w0, w1, w2, u[28], m[2]);-	MONT_MAC(t0, t1, t2, u[29], m[1]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_ADD(t0, t1, t2, w0, w1, w2);-	MONT_ADD(s0, s1, s2, c0, c1, c2);-	MONT_DBL(s0, s1, s2);-	MONT_ADD(t0, t1, t2, s0, s1, s2);-	u[30] = t0 * n0;-	MONT_MAC(t0, t1, t2, u[30], m[0]);-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 31 */-	MONT_MUL(s0, s1, s2, a[0], a[31]);-	MONT_MUL(c0, c1, c2, a[1], a[30]);-	MONT_MAC(s0, s1, s2, a[2], a[29]);-	MONT_MAC(c0, c1, c2, a[3], a[28]);-	MONT_MAC(s0, s1, s2, a[4], a[27]);-	MONT_MAC(c0, c1, c2, a[5], a[26]);-	MONT_MAC(s0, s1, s2, a[6], a[25]);-	MONT_MAC(c0, c1, c2, a[7], a[24]);-	MONT_MAC(s0, s1, s2, a[8], a[23]);-	MONT_MAC(c0, c1, c2, a[9], a[22]);-	MONT_MAC(s0, s1, s2, a[10], a[21]);-	MONT_MAC(c0, c1, c2, a[11], a[20]);-	MONT_MAC(s0, s1, s2, a[12], a[19]);-	MONT_MAC(c0, c1, c2, a[13], a[18]);-	MONT_MAC(s0, s1, s2, a[14], a[17]);-	MONT_MAC(c0, c1, c2, a[15], a[16]);-	MONT_MAC(t0, t1, t2, u[0], m[31]);-	MONT_MUL(v0, v1, v2, u[1], m[30]);-	MONT_MUL(w0, w1, w2, u[2], m[29]);-	MONT_MAC(t0, t1, t2, u[3], m[28]);-	MONT_MAC(v0, v1, v2, u[4], m[27]);-	MONT_MAC(w0, w1, w2, u[5], m[26]);-	MONT_MAC(t0, t1, t2, u[6], m[25]);-	MONT_MAC(v0, v1, v2, u[7], m[24]);-	MONT_MAC(w0, w1, w2, u[8], m[23]);-	MONT_MAC(t0, t1, t2, u[9], m[22]);-	MONT_MAC(v0, v1, v2, u[10], m[21]);-	MONT_MAC(w0, w1, w2, u[11], m[20]);-	MONT_MAC(t0, t1, t2, u[12], m[19]);-	MONT_MAC(v0, v1, v2, u[13], m[18]);-	MONT_MAC(w0, w1, w2, u[14], m[17]);-	MONT_MAC(t0, t1, t2, u[15], m[16]);-	MONT_MAC(v0, v1, v2, u[16], m[15]);-	MONT_MAC(w0, w1, w2, u[17], m[14]);-	MONT_MAC(t0, t1, t2, u[18], m[13]);-	MONT_MAC(v0, v1, v2, u[19], m[12]);-	MONT_MAC(w0, w1, w2, u[20], m[11]);-	MONT_MAC(t0, t1, t2, u[21], m[10]);-	MONT_MAC(v0, v1, v2, u[22], m[9]);-	MONT_MAC(w0, w1, w2, u[23], m[8]);-	MONT_MAC(t0, t1, t2, u[24], m[7]);-	MONT_MAC(v0, v1, v2, u[25], m[6]);-	MONT_MAC(w0, w1, w2, u[26], m[5]);-	MONT_MAC(t0, t1, t2, u[27], m[4]);-	MONT_MAC(v0, v1, v2, u[28], m[3]);-	MONT_MAC(w0, w1, w2, u[29], m[2]);-	MONT_MAC(t0, t1, t2, u[30], m[1]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_ADD(t0, t1, t2, w0, w1, w2);-	MONT_ADD(s0, s1, s2, c0, c1, c2);-	MONT_DBL(s0, s1, s2);-	MONT_ADD(t0, t1, t2, s0, s1, s2);-	u[31] = t0 * n0;-	MONT_MAC(t0, t1, t2, u[31], m[0]);-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 32 */-	MONT_MUL(s0, s1, s2, a[1], a[31]);-	MONT_MUL(c0, c1, c2, a[2], a[30]);-	MONT_MAC(s0, s1, s2, a[3], a[29]);-	MONT_MAC(c0, c1, c2, a[4], a[28]);-	MONT_MAC(s0, s1, s2, a[5], a[27]);-	MONT_MAC(c0, c1, c2, a[6], a[26]);-	MONT_MAC(s0, s1, s2, a[7], a[25]);-	MONT_MAC(c0, c1, c2, a[8], a[24]);-	MONT_MAC(s0, s1, s2, a[9], a[23]);-	MONT_MAC(c0, c1, c2, a[10], a[22]);-	MONT_MAC(s0, s1, s2, a[11], a[21]);-	MONT_MAC(c0, c1, c2, a[12], a[20]);-	MONT_MAC(s0, s1, s2, a[13], a[19]);-	MONT_MAC(c0, c1, c2, a[14], a[18]);-	MONT_MAC(s0, s1, s2, a[15], a[17]);-	MONT_MAC(t0, t1, t2, a[16], a[16]);-	MONT_MUL(v0, v1, v2, u[1], m[31]);-	MONT_MUL(w0, w1, w2, u[2], m[30]);-	MONT_MAC(t0, t1, t2, u[3], m[29]);-	MONT_MAC(v0, v1, v2, u[4], m[28]);-	MONT_MAC(w0, w1, w2, u[5], m[27]);-	MONT_MAC(t0, t1, t2, u[6], m[26]);-	MONT_MAC(v0, v1, v2, u[7], m[25]);-	MONT_MAC(w0, w1, w2, u[8], m[24]);-	MONT_MAC(t0, t1, t2, u[9], m[23]);-	MONT_MAC(v0, v1, v2, u[10], m[22]);-	MONT_MAC(w0, w1, w2, u[11], m[21]);-	MONT_MAC(t0, t1, t2, u[12], m[20]);-	MONT_MAC(v0, v1, v2, u[13], m[19]);-	MONT_MAC(w0, w1, w2, u[14], m[18]);-	MONT_MAC(t0, t1, t2, u[15], m[17]);-	MONT_MAC(v0, v1, v2, u[16], m[16]);-	MONT_MAC(w0, w1, w2, u[17], m[15]);-	MONT_MAC(t0, t1, t2, u[18], m[14]);-	MONT_MAC(v0, v1, v2, u[19], m[13]);-	MONT_MAC(w0, w1, w2, u[20], m[12]);-	MONT_MAC(t0, t1, t2, u[21], m[11]);-	MONT_MAC(v0, v1, v2, u[22], m[10]);-	MONT_MAC(w0, w1, w2, u[23], m[9]);-	MONT_MAC(t0, t1, t2, u[24], m[8]);-	MONT_MAC(v0, v1, v2, u[25], m[7]);-	MONT_MAC(w0, w1, w2, u[26], m[6]);-	MONT_MAC(t0, t1, t2, u[27], m[5]);-	MONT_MAC(v0, v1, v2, u[28], m[4]);-	MONT_MAC(w0, w1, w2, u[29], m[3]);-	MONT_MAC(t0, t1, t2, u[30], m[2]);-	MONT_MAC(v0, v1, v2, u[31], m[1]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_ADD(t0, t1, t2, w0, w1, w2);-	MONT_ADD(s0, s1, s2, c0, c1, c2);-	MONT_DBL(s0, s1, s2);-	MONT_ADD(t0, t1, t2, s0, s1, s2);-	z[0] = t0;-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 33 */-	MONT_MUL(s0, s1, s2, a[2], a[31]);-	MONT_MUL(c0, c1, c2, a[3], a[30]);-	MONT_MAC(s0, s1, s2, a[4], a[29]);-	MONT_MAC(c0, c1, c2, a[5], a[28]);-	MONT_MAC(s0, s1, s2, a[6], a[27]);-	MONT_MAC(c0, c1, c2, a[7], a[26]);-	MONT_MAC(s0, s1, s2, a[8], a[25]);-	MONT_MAC(c0, c1, c2, a[9], a[24]);-	MONT_MAC(s0, s1, s2, a[10], a[23]);-	MONT_MAC(c0, c1, c2, a[11], a[22]);-	MONT_MAC(s0, s1, s2, a[12], a[21]);-	MONT_MAC(c0, c1, c2, a[13], a[20]);-	MONT_MAC(s0, s1, s2, a[14], a[19]);-	MONT_MAC(c0, c1, c2, a[15], a[18]);-	MONT_MAC(s0, s1, s2, a[16], a[17]);-	MONT_MAC(t0, t1, t2, u[2], m[31]);-	MONT_MUL(v0, v1, v2, u[3], m[30]);-	MONT_MUL(w0, w1, w2, u[4], m[29]);-	MONT_MAC(t0, t1, t2, u[5], m[28]);-	MONT_MAC(v0, v1, v2, u[6], m[27]);-	MONT_MAC(w0, w1, w2, u[7], m[26]);-	MONT_MAC(t0, t1, t2, u[8], m[25]);-	MONT_MAC(v0, v1, v2, u[9], m[24]);-	MONT_MAC(w0, w1, w2, u[10], m[23]);-	MONT_MAC(t0, t1, t2, u[11], m[22]);-	MONT_MAC(v0, v1, v2, u[12], m[21]);-	MONT_MAC(w0, w1, w2, u[13], m[20]);-	MONT_MAC(t0, t1, t2, u[14], m[19]);-	MONT_MAC(v0, v1, v2, u[15], m[18]);-	MONT_MAC(w0, w1, w2, u[16], m[17]);-	MONT_MAC(t0, t1, t2, u[17], m[16]);-	MONT_MAC(v0, v1, v2, u[18], m[15]);-	MONT_MAC(w0, w1, w2, u[19], m[14]);-	MONT_MAC(t0, t1, t2, u[20], m[13]);-	MONT_MAC(v0, v1, v2, u[21], m[12]);-	MONT_MAC(w0, w1, w2, u[22], m[11]);-	MONT_MAC(t0, t1, t2, u[23], m[10]);-	MONT_MAC(v0, v1, v2, u[24], m[9]);-	MONT_MAC(w0, w1, w2, u[25], m[8]);-	MONT_MAC(t0, t1, t2, u[26], m[7]);-	MONT_MAC(v0, v1, v2, u[27], m[6]);-	MONT_MAC(w0, w1, w2, u[28], m[5]);-	MONT_MAC(t0, t1, t2, u[29], m[4]);-	MONT_MAC(v0, v1, v2, u[30], m[3]);-	MONT_MAC(w0, w1, w2, u[31], m[2]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_ADD(t0, t1, t2, w0, w1, w2);-	MONT_ADD(s0, s1, s2, c0, c1, c2);-	MONT_DBL(s0, s1, s2);-	MONT_ADD(t0, t1, t2, s0, s1, s2);-	z[1] = t0;-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 34 */-	MONT_MUL(s0, s1, s2, a[3], a[31]);-	MONT_MUL(c0, c1, c2, a[4], a[30]);-	MONT_MAC(s0, s1, s2, a[5], a[29]);-	MONT_MAC(c0, c1, c2, a[6], a[28]);-	MONT_MAC(s0, s1, s2, a[7], a[27]);-	MONT_MAC(c0, c1, c2, a[8], a[26]);-	MONT_MAC(s0, s1, s2, a[9], a[25]);-	MONT_MAC(c0, c1, c2, a[10], a[24]);-	MONT_MAC(s0, s1, s2, a[11], a[23]);-	MONT_MAC(c0, c1, c2, a[12], a[22]);-	MONT_MAC(s0, s1, s2, a[13], a[21]);-	MONT_MAC(c0, c1, c2, a[14], a[20]);-	MONT_MAC(s0, s1, s2, a[15], a[19]);-	MONT_MAC(c0, c1, c2, a[16], a[18]);-	MONT_MAC(t0, t1, t2, a[17], a[17]);-	MONT_MUL(v0, v1, v2, u[3], m[31]);-	MONT_MUL(w0, w1, w2, u[4], m[30]);-	MONT_MAC(t0, t1, t2, u[5], m[29]);-	MONT_MAC(v0, v1, v2, u[6], m[28]);-	MONT_MAC(w0, w1, w2, u[7], m[27]);-	MONT_MAC(t0, t1, t2, u[8], m[26]);-	MONT_MAC(v0, v1, v2, u[9], m[25]);-	MONT_MAC(w0, w1, w2, u[10], m[24]);-	MONT_MAC(t0, t1, t2, u[11], m[23]);-	MONT_MAC(v0, v1, v2, u[12], m[22]);-	MONT_MAC(w0, w1, w2, u[13], m[21]);-	MONT_MAC(t0, t1, t2, u[14], m[20]);-	MONT_MAC(v0, v1, v2, u[15], m[19]);-	MONT_MAC(w0, w1, w2, u[16], m[18]);-	MONT_MAC(t0, t1, t2, u[17], m[17]);-	MONT_MAC(v0, v1, v2, u[18], m[16]);-	MONT_MAC(w0, w1, w2, u[19], m[15]);-	MONT_MAC(t0, t1, t2, u[20], m[14]);-	MONT_MAC(v0, v1, v2, u[21], m[13]);-	MONT_MAC(w0, w1, w2, u[22], m[12]);-	MONT_MAC(t0, t1, t2, u[23], m[11]);-	MONT_MAC(v0, v1, v2, u[24], m[10]);-	MONT_MAC(w0, w1, w2, u[25], m[9]);-	MONT_MAC(t0, t1, t2, u[26], m[8]);-	MONT_MAC(v0, v1, v2, u[27], m[7]);-	MONT_MAC(w0, w1, w2, u[28], m[6]);-	MONT_MAC(t0, t1, t2, u[29], m[5]);-	MONT_MAC(v0, v1, v2, u[30], m[4]);-	MONT_MAC(w0, w1, w2, u[31], m[3]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_ADD(t0, t1, t2, w0, w1, w2);-	MONT_ADD(s0, s1, s2, c0, c1, c2);-	MONT_DBL(s0, s1, s2);-	MONT_ADD(t0, t1, t2, s0, s1, s2);-	z[2] = t0;-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 35 */-	MONT_MUL(s0, s1, s2, a[4], a[31]);-	MONT_MUL(c0, c1, c2, a[5], a[30]);-	MONT_MAC(s0, s1, s2, a[6], a[29]);-	MONT_MAC(c0, c1, c2, a[7], a[28]);-	MONT_MAC(s0, s1, s2, a[8], a[27]);-	MONT_MAC(c0, c1, c2, a[9], a[26]);-	MONT_MAC(s0, s1, s2, a[10], a[25]);-	MONT_MAC(c0, c1, c2, a[11], a[24]);-	MONT_MAC(s0, s1, s2, a[12], a[23]);-	MONT_MAC(c0, c1, c2, a[13], a[22]);-	MONT_MAC(s0, s1, s2, a[14], a[21]);-	MONT_MAC(c0, c1, c2, a[15], a[20]);-	MONT_MAC(s0, s1, s2, a[16], a[19]);-	MONT_MAC(c0, c1, c2, a[17], a[18]);-	MONT_MAC(t0, t1, t2, u[4], m[31]);-	MONT_MUL(v0, v1, v2, u[5], m[30]);-	MONT_MUL(w0, w1, w2, u[6], m[29]);-	MONT_MAC(t0, t1, t2, u[7], m[28]);-	MONT_MAC(v0, v1, v2, u[8], m[27]);-	MONT_MAC(w0, w1, w2, u[9], m[26]);-	MONT_MAC(t0, t1, t2, u[10], m[25]);-	MONT_MAC(v0, v1, v2, u[11], m[24]);-	MONT_MAC(w0, w1, w2, u[12], m[23]);-	MONT_MAC(t0, t1, t2, u[13], m[22]);-	MONT_MAC(v0, v1, v2, u[14], m[21]);-	MONT_MAC(w0, w1, w2, u[15], m[20]);-	MONT_MAC(t0, t1, t2, u[16], m[19]);-	MONT_MAC(v0, v1, v2, u[17], m[18]);-	MONT_MAC(w0, w1, w2, u[18], m[17]);-	MONT_MAC(t0, t1, t2, u[19], m[16]);-	MONT_MAC(v0, v1, v2, u[20], m[15]);-	MONT_MAC(w0, w1, w2, u[21], m[14]);-	MONT_MAC(t0, t1, t2, u[22], m[13]);-	MONT_MAC(v0, v1, v2, u[23], m[12]);-	MONT_MAC(w0, w1, w2, u[24], m[11]);-	MONT_MAC(t0, t1, t2, u[25], m[10]);-	MONT_MAC(v0, v1, v2, u[26], m[9]);-	MONT_MAC(w0, w1, w2, u[27], m[8]);-	MONT_MAC(t0, t1, t2, u[28], m[7]);-	MONT_MAC(v0, v1, v2, u[29], m[6]);-	MONT_MAC(w0, w1, w2, u[30], m[5]);-	MONT_MAC(t0, t1, t2, u[31], m[4]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_ADD(t0, t1, t2, w0, w1, w2);-	MONT_ADD(s0, s1, s2, c0, c1, c2);-	MONT_DBL(s0, s1, s2);-	MONT_ADD(t0, t1, t2, s0, s1, s2);-	z[3] = t0;-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 36 */-	MONT_MUL(s0, s1, s2, a[5], a[31]);-	MONT_MUL(c0, c1, c2, a[6], a[30]);-	MONT_MAC(s0, s1, s2, a[7], a[29]);-	MONT_MAC(c0, c1, c2, a[8], a[28]);-	MONT_MAC(s0, s1, s2, a[9], a[27]);-	MONT_MAC(c0, c1, c2, a[10], a[26]);-	MONT_MAC(s0, s1, s2, a[11], a[25]);-	MONT_MAC(c0, c1, c2, a[12], a[24]);-	MONT_MAC(s0, s1, s2, a[13], a[23]);-	MONT_MAC(c0, c1, c2, a[14], a[22]);-	MONT_MAC(s0, s1, s2, a[15], a[21]);-	MONT_MAC(c0, c1, c2, a[16], a[20]);-	MONT_MAC(s0, s1, s2, a[17], a[19]);-	MONT_MAC(t0, t1, t2, a[18], a[18]);-	MONT_MUL(v0, v1, v2, u[5], m[31]);-	MONT_MUL(w0, w1, w2, u[6], m[30]);-	MONT_MAC(t0, t1, t2, u[7], m[29]);-	MONT_MAC(v0, v1, v2, u[8], m[28]);-	MONT_MAC(w0, w1, w2, u[9], m[27]);-	MONT_MAC(t0, t1, t2, u[10], m[26]);-	MONT_MAC(v0, v1, v2, u[11], m[25]);-	MONT_MAC(w0, w1, w2, u[12], m[24]);-	MONT_MAC(t0, t1, t2, u[13], m[23]);-	MONT_MAC(v0, v1, v2, u[14], m[22]);-	MONT_MAC(w0, w1, w2, u[15], m[21]);-	MONT_MAC(t0, t1, t2, u[16], m[20]);-	MONT_MAC(v0, v1, v2, u[17], m[19]);-	MONT_MAC(w0, w1, w2, u[18], m[18]);-	MONT_MAC(t0, t1, t2, u[19], m[17]);-	MONT_MAC(v0, v1, v2, u[20], m[16]);-	MONT_MAC(w0, w1, w2, u[21], m[15]);-	MONT_MAC(t0, t1, t2, u[22], m[14]);-	MONT_MAC(v0, v1, v2, u[23], m[13]);-	MONT_MAC(w0, w1, w2, u[24], m[12]);-	MONT_MAC(t0, t1, t2, u[25], m[11]);-	MONT_MAC(v0, v1, v2, u[26], m[10]);-	MONT_MAC(w0, w1, w2, u[27], m[9]);-	MONT_MAC(t0, t1, t2, u[28], m[8]);-	MONT_MAC(v0, v1, v2, u[29], m[7]);-	MONT_MAC(w0, w1, w2, u[30], m[6]);-	MONT_MAC(t0, t1, t2, u[31], m[5]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_ADD(t0, t1, t2, w0, w1, w2);-	MONT_ADD(s0, s1, s2, c0, c1, c2);-	MONT_DBL(s0, s1, s2);-	MONT_ADD(t0, t1, t2, s0, s1, s2);-	z[4] = t0;-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 37 */-	MONT_MUL(s0, s1, s2, a[6], a[31]);-	MONT_MUL(c0, c1, c2, a[7], a[30]);-	MONT_MAC(s0, s1, s2, a[8], a[29]);-	MONT_MAC(c0, c1, c2, a[9], a[28]);-	MONT_MAC(s0, s1, s2, a[10], a[27]);-	MONT_MAC(c0, c1, c2, a[11], a[26]);-	MONT_MAC(s0, s1, s2, a[12], a[25]);-	MONT_MAC(c0, c1, c2, a[13], a[24]);-	MONT_MAC(s0, s1, s2, a[14], a[23]);-	MONT_MAC(c0, c1, c2, a[15], a[22]);-	MONT_MAC(s0, s1, s2, a[16], a[21]);-	MONT_MAC(c0, c1, c2, a[17], a[20]);-	MONT_MAC(s0, s1, s2, a[18], a[19]);-	MONT_MAC(t0, t1, t2, u[6], m[31]);-	MONT_MUL(v0, v1, v2, u[7], m[30]);-	MONT_MUL(w0, w1, w2, u[8], m[29]);-	MONT_MAC(t0, t1, t2, u[9], m[28]);-	MONT_MAC(v0, v1, v2, u[10], m[27]);-	MONT_MAC(w0, w1, w2, u[11], m[26]);-	MONT_MAC(t0, t1, t2, u[12], m[25]);-	MONT_MAC(v0, v1, v2, u[13], m[24]);-	MONT_MAC(w0, w1, w2, u[14], m[23]);-	MONT_MAC(t0, t1, t2, u[15], m[22]);-	MONT_MAC(v0, v1, v2, u[16], m[21]);-	MONT_MAC(w0, w1, w2, u[17], m[20]);-	MONT_MAC(t0, t1, t2, u[18], m[19]);-	MONT_MAC(v0, v1, v2, u[19], m[18]);-	MONT_MAC(w0, w1, w2, u[20], m[17]);-	MONT_MAC(t0, t1, t2, u[21], m[16]);-	MONT_MAC(v0, v1, v2, u[22], m[15]);-	MONT_MAC(w0, w1, w2, u[23], m[14]);-	MONT_MAC(t0, t1, t2, u[24], m[13]);-	MONT_MAC(v0, v1, v2, u[25], m[12]);-	MONT_MAC(w0, w1, w2, u[26], m[11]);-	MONT_MAC(t0, t1, t2, u[27], m[10]);-	MONT_MAC(v0, v1, v2, u[28], m[9]);-	MONT_MAC(w0, w1, w2, u[29], m[8]);-	MONT_MAC(t0, t1, t2, u[30], m[7]);-	MONT_MAC(v0, v1, v2, u[31], m[6]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_ADD(t0, t1, t2, w0, w1, w2);-	MONT_ADD(s0, s1, s2, c0, c1, c2);-	MONT_DBL(s0, s1, s2);-	MONT_ADD(t0, t1, t2, s0, s1, s2);-	z[5] = t0;-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 38 */-	MONT_MUL(s0, s1, s2, a[7], a[31]);-	MONT_MUL(c0, c1, c2, a[8], a[30]);-	MONT_MAC(s0, s1, s2, a[9], a[29]);-	MONT_MAC(c0, c1, c2, a[10], a[28]);-	MONT_MAC(s0, s1, s2, a[11], a[27]);-	MONT_MAC(c0, c1, c2, a[12], a[26]);-	MONT_MAC(s0, s1, s2, a[13], a[25]);-	MONT_MAC(c0, c1, c2, a[14], a[24]);-	MONT_MAC(s0, s1, s2, a[15], a[23]);-	MONT_MAC(c0, c1, c2, a[16], a[22]);-	MONT_MAC(s0, s1, s2, a[17], a[21]);-	MONT_MAC(c0, c1, c2, a[18], a[20]);-	MONT_MAC(t0, t1, t2, a[19], a[19]);-	MONT_MUL(v0, v1, v2, u[7], m[31]);-	MONT_MUL(w0, w1, w2, u[8], m[30]);-	MONT_MAC(t0, t1, t2, u[9], m[29]);-	MONT_MAC(v0, v1, v2, u[10], m[28]);-	MONT_MAC(w0, w1, w2, u[11], m[27]);-	MONT_MAC(t0, t1, t2, u[12], m[26]);-	MONT_MAC(v0, v1, v2, u[13], m[25]);-	MONT_MAC(w0, w1, w2, u[14], m[24]);-	MONT_MAC(t0, t1, t2, u[15], m[23]);-	MONT_MAC(v0, v1, v2, u[16], m[22]);-	MONT_MAC(w0, w1, w2, u[17], m[21]);-	MONT_MAC(t0, t1, t2, u[18], m[20]);-	MONT_MAC(v0, v1, v2, u[19], m[19]);-	MONT_MAC(w0, w1, w2, u[20], m[18]);-	MONT_MAC(t0, t1, t2, u[21], m[17]);-	MONT_MAC(v0, v1, v2, u[22], m[16]);-	MONT_MAC(w0, w1, w2, u[23], m[15]);-	MONT_MAC(t0, t1, t2, u[24], m[14]);-	MONT_MAC(v0, v1, v2, u[25], m[13]);-	MONT_MAC(w0, w1, w2, u[26], m[12]);-	MONT_MAC(t0, t1, t2, u[27], m[11]);-	MONT_MAC(v0, v1, v2, u[28], m[10]);-	MONT_MAC(w0, w1, w2, u[29], m[9]);-	MONT_MAC(t0, t1, t2, u[30], m[8]);-	MONT_MAC(v0, v1, v2, u[31], m[7]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_ADD(t0, t1, t2, w0, w1, w2);-	MONT_ADD(s0, s1, s2, c0, c1, c2);-	MONT_DBL(s0, s1, s2);-	MONT_ADD(t0, t1, t2, s0, s1, s2);-	z[6] = t0;-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 39 */-	MONT_MUL(s0, s1, s2, a[8], a[31]);-	MONT_MUL(c0, c1, c2, a[9], a[30]);-	MONT_MAC(s0, s1, s2, a[10], a[29]);-	MONT_MAC(c0, c1, c2, a[11], a[28]);-	MONT_MAC(s0, s1, s2, a[12], a[27]);-	MONT_MAC(c0, c1, c2, a[13], a[26]);-	MONT_MAC(s0, s1, s2, a[14], a[25]);-	MONT_MAC(c0, c1, c2, a[15], a[24]);-	MONT_MAC(s0, s1, s2, a[16], a[23]);-	MONT_MAC(c0, c1, c2, a[17], a[22]);-	MONT_MAC(s0, s1, s2, a[18], a[21]);-	MONT_MAC(c0, c1, c2, a[19], a[20]);-	MONT_MAC(t0, t1, t2, u[8], m[31]);-	MONT_MUL(v0, v1, v2, u[9], m[30]);-	MONT_MUL(w0, w1, w2, u[10], m[29]);-	MONT_MAC(t0, t1, t2, u[11], m[28]);-	MONT_MAC(v0, v1, v2, u[12], m[27]);-	MONT_MAC(w0, w1, w2, u[13], m[26]);-	MONT_MAC(t0, t1, t2, u[14], m[25]);-	MONT_MAC(v0, v1, v2, u[15], m[24]);-	MONT_MAC(w0, w1, w2, u[16], m[23]);-	MONT_MAC(t0, t1, t2, u[17], m[22]);-	MONT_MAC(v0, v1, v2, u[18], m[21]);-	MONT_MAC(w0, w1, w2, u[19], m[20]);-	MONT_MAC(t0, t1, t2, u[20], m[19]);-	MONT_MAC(v0, v1, v2, u[21], m[18]);-	MONT_MAC(w0, w1, w2, u[22], m[17]);-	MONT_MAC(t0, t1, t2, u[23], m[16]);-	MONT_MAC(v0, v1, v2, u[24], m[15]);-	MONT_MAC(w0, w1, w2, u[25], m[14]);-	MONT_MAC(t0, t1, t2, u[26], m[13]);-	MONT_MAC(v0, v1, v2, u[27], m[12]);-	MONT_MAC(w0, w1, w2, u[28], m[11]);-	MONT_MAC(t0, t1, t2, u[29], m[10]);-	MONT_MAC(v0, v1, v2, u[30], m[9]);-	MONT_MAC(w0, w1, w2, u[31], m[8]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_ADD(t0, t1, t2, w0, w1, w2);-	MONT_ADD(s0, s1, s2, c0, c1, c2);-	MONT_DBL(s0, s1, s2);-	MONT_ADD(t0, t1, t2, s0, s1, s2);-	z[7] = t0;-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 40 */-	MONT_MUL(s0, s1, s2, a[9], a[31]);-	MONT_MUL(c0, c1, c2, a[10], a[30]);-	MONT_MAC(s0, s1, s2, a[11], a[29]);-	MONT_MAC(c0, c1, c2, a[12], a[28]);-	MONT_MAC(s0, s1, s2, a[13], a[27]);-	MONT_MAC(c0, c1, c2, a[14], a[26]);-	MONT_MAC(s0, s1, s2, a[15], a[25]);-	MONT_MAC(c0, c1, c2, a[16], a[24]);-	MONT_MAC(s0, s1, s2, a[17], a[23]);-	MONT_MAC(c0, c1, c2, a[18], a[22]);-	MONT_MAC(s0, s1, s2, a[19], a[21]);-	MONT_MAC(t0, t1, t2, a[20], a[20]);-	MONT_MUL(v0, v1, v2, u[9], m[31]);-	MONT_MUL(w0, w1, w2, u[10], m[30]);-	MONT_MAC(t0, t1, t2, u[11], m[29]);-	MONT_MAC(v0, v1, v2, u[12], m[28]);-	MONT_MAC(w0, w1, w2, u[13], m[27]);-	MONT_MAC(t0, t1, t2, u[14], m[26]);-	MONT_MAC(v0, v1, v2, u[15], m[25]);-	MONT_MAC(w0, w1, w2, u[16], m[24]);-	MONT_MAC(t0, t1, t2, u[17], m[23]);-	MONT_MAC(v0, v1, v2, u[18], m[22]);-	MONT_MAC(w0, w1, w2, u[19], m[21]);-	MONT_MAC(t0, t1, t2, u[20], m[20]);-	MONT_MAC(v0, v1, v2, u[21], m[19]);-	MONT_MAC(w0, w1, w2, u[22], m[18]);-	MONT_MAC(t0, t1, t2, u[23], m[17]);-	MONT_MAC(v0, v1, v2, u[24], m[16]);-	MONT_MAC(w0, w1, w2, u[25], m[15]);-	MONT_MAC(t0, t1, t2, u[26], m[14]);-	MONT_MAC(v0, v1, v2, u[27], m[13]);-	MONT_MAC(w0, w1, w2, u[28], m[12]);-	MONT_MAC(t0, t1, t2, u[29], m[11]);-	MONT_MAC(v0, v1, v2, u[30], m[10]);-	MONT_MAC(w0, w1, w2, u[31], m[9]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_ADD(t0, t1, t2, w0, w1, w2);-	MONT_ADD(s0, s1, s2, c0, c1, c2);-	MONT_DBL(s0, s1, s2);-	MONT_ADD(t0, t1, t2, s0, s1, s2);-	z[8] = t0;-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 41 */-	MONT_MUL(s0, s1, s2, a[10], a[31]);-	MONT_MUL(c0, c1, c2, a[11], a[30]);-	MONT_MAC(s0, s1, s2, a[12], a[29]);-	MONT_MAC(c0, c1, c2, a[13], a[28]);-	MONT_MAC(s0, s1, s2, a[14], a[27]);-	MONT_MAC(c0, c1, c2, a[15], a[26]);-	MONT_MAC(s0, s1, s2, a[16], a[25]);-	MONT_MAC(c0, c1, c2, a[17], a[24]);-	MONT_MAC(s0, s1, s2, a[18], a[23]);-	MONT_MAC(c0, c1, c2, a[19], a[22]);-	MONT_MAC(s0, s1, s2, a[20], a[21]);-	MONT_MAC(t0, t1, t2, u[10], m[31]);-	MONT_MUL(v0, v1, v2, u[11], m[30]);-	MONT_MUL(w0, w1, w2, u[12], m[29]);-	MONT_MAC(t0, t1, t2, u[13], m[28]);-	MONT_MAC(v0, v1, v2, u[14], m[27]);-	MONT_MAC(w0, w1, w2, u[15], m[26]);-	MONT_MAC(t0, t1, t2, u[16], m[25]);-	MONT_MAC(v0, v1, v2, u[17], m[24]);-	MONT_MAC(w0, w1, w2, u[18], m[23]);-	MONT_MAC(t0, t1, t2, u[19], m[22]);-	MONT_MAC(v0, v1, v2, u[20], m[21]);-	MONT_MAC(w0, w1, w2, u[21], m[20]);-	MONT_MAC(t0, t1, t2, u[22], m[19]);-	MONT_MAC(v0, v1, v2, u[23], m[18]);-	MONT_MAC(w0, w1, w2, u[24], m[17]);-	MONT_MAC(t0, t1, t2, u[25], m[16]);-	MONT_MAC(v0, v1, v2, u[26], m[15]);-	MONT_MAC(w0, w1, w2, u[27], m[14]);-	MONT_MAC(t0, t1, t2, u[28], m[13]);-	MONT_MAC(v0, v1, v2, u[29], m[12]);-	MONT_MAC(w0, w1, w2, u[30], m[11]);-	MONT_MAC(t0, t1, t2, u[31], m[10]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_ADD(t0, t1, t2, w0, w1, w2);-	MONT_ADD(s0, s1, s2, c0, c1, c2);-	MONT_DBL(s0, s1, s2);-	MONT_ADD(t0, t1, t2, s0, s1, s2);-	z[9] = t0;-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 42 */-	MONT_MUL(s0, s1, s2, a[11], a[31]);-	MONT_MUL(c0, c1, c2, a[12], a[30]);-	MONT_MAC(s0, s1, s2, a[13], a[29]);-	MONT_MAC(c0, c1, c2, a[14], a[28]);-	MONT_MAC(s0, s1, s2, a[15], a[27]);-	MONT_MAC(c0, c1, c2, a[16], a[26]);-	MONT_MAC(s0, s1, s2, a[17], a[25]);-	MONT_MAC(c0, c1, c2, a[18], a[24]);-	MONT_MAC(s0, s1, s2, a[19], a[23]);-	MONT_MAC(c0, c1, c2, a[20], a[22]);-	MONT_MAC(t0, t1, t2, a[21], a[21]);-	MONT_MUL(v0, v1, v2, u[11], m[31]);-	MONT_MUL(w0, w1, w2, u[12], m[30]);-	MONT_MAC(t0, t1, t2, u[13], m[29]);-	MONT_MAC(v0, v1, v2, u[14], m[28]);-	MONT_MAC(w0, w1, w2, u[15], m[27]);-	MONT_MAC(t0, t1, t2, u[16], m[26]);-	MONT_MAC(v0, v1, v2, u[17], m[25]);-	MONT_MAC(w0, w1, w2, u[18], m[24]);-	MONT_MAC(t0, t1, t2, u[19], m[23]);-	MONT_MAC(v0, v1, v2, u[20], m[22]);-	MONT_MAC(w0, w1, w2, u[21], m[21]);-	MONT_MAC(t0, t1, t2, u[22], m[20]);-	MONT_MAC(v0, v1, v2, u[23], m[19]);-	MONT_MAC(w0, w1, w2, u[24], m[18]);-	MONT_MAC(t0, t1, t2, u[25], m[17]);-	MONT_MAC(v0, v1, v2, u[26], m[16]);-	MONT_MAC(w0, w1, w2, u[27], m[15]);-	MONT_MAC(t0, t1, t2, u[28], m[14]);-	MONT_MAC(v0, v1, v2, u[29], m[13]);-	MONT_MAC(w0, w1, w2, u[30], m[12]);-	MONT_MAC(t0, t1, t2, u[31], m[11]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_ADD(t0, t1, t2, w0, w1, w2);-	MONT_ADD(s0, s1, s2, c0, c1, c2);-	MONT_DBL(s0, s1, s2);-	MONT_ADD(t0, t1, t2, s0, s1, s2);-	z[10] = t0;-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 43 */-	MONT_MUL(s0, s1, s2, a[12], a[31]);-	MONT_MUL(c0, c1, c2, a[13], a[30]);-	MONT_MAC(s0, s1, s2, a[14], a[29]);-	MONT_MAC(c0, c1, c2, a[15], a[28]);-	MONT_MAC(s0, s1, s2, a[16], a[27]);-	MONT_MAC(c0, c1, c2, a[17], a[26]);-	MONT_MAC(s0, s1, s2, a[18], a[25]);-	MONT_MAC(c0, c1, c2, a[19], a[24]);-	MONT_MAC(s0, s1, s2, a[20], a[23]);-	MONT_MAC(c0, c1, c2, a[21], a[22]);-	MONT_MAC(t0, t1, t2, u[12], m[31]);-	MONT_MUL(v0, v1, v2, u[13], m[30]);-	MONT_MUL(w0, w1, w2, u[14], m[29]);-	MONT_MAC(t0, t1, t2, u[15], m[28]);-	MONT_MAC(v0, v1, v2, u[16], m[27]);-	MONT_MAC(w0, w1, w2, u[17], m[26]);-	MONT_MAC(t0, t1, t2, u[18], m[25]);-	MONT_MAC(v0, v1, v2, u[19], m[24]);-	MONT_MAC(w0, w1, w2, u[20], m[23]);-	MONT_MAC(t0, t1, t2, u[21], m[22]);-	MONT_MAC(v0, v1, v2, u[22], m[21]);-	MONT_MAC(w0, w1, w2, u[23], m[20]);-	MONT_MAC(t0, t1, t2, u[24], m[19]);-	MONT_MAC(v0, v1, v2, u[25], m[18]);-	MONT_MAC(w0, w1, w2, u[26], m[17]);-	MONT_MAC(t0, t1, t2, u[27], m[16]);-	MONT_MAC(v0, v1, v2, u[28], m[15]);-	MONT_MAC(w0, w1, w2, u[29], m[14]);-	MONT_MAC(t0, t1, t2, u[30], m[13]);-	MONT_MAC(v0, v1, v2, u[31], m[12]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_ADD(t0, t1, t2, w0, w1, w2);-	MONT_ADD(s0, s1, s2, c0, c1, c2);-	MONT_DBL(s0, s1, s2);-	MONT_ADD(t0, t1, t2, s0, s1, s2);-	z[11] = t0;-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 44 */-	MONT_MUL(s0, s1, s2, a[13], a[31]);-	MONT_MUL(c0, c1, c2, a[14], a[30]);-	MONT_MAC(s0, s1, s2, a[15], a[29]);-	MONT_MAC(c0, c1, c2, a[16], a[28]);-	MONT_MAC(s0, s1, s2, a[17], a[27]);-	MONT_MAC(c0, c1, c2, a[18], a[26]);-	MONT_MAC(s0, s1, s2, a[19], a[25]);-	MONT_MAC(c0, c1, c2, a[20], a[24]);-	MONT_MAC(s0, s1, s2, a[21], a[23]);-	MONT_MAC(t0, t1, t2, a[22], a[22]);-	MONT_MUL(v0, v1, v2, u[13], m[31]);-	MONT_MUL(w0, w1, w2, u[14], m[30]);-	MONT_MAC(t0, t1, t2, u[15], m[29]);-	MONT_MAC(v0, v1, v2, u[16], m[28]);-	MONT_MAC(w0, w1, w2, u[17], m[27]);-	MONT_MAC(t0, t1, t2, u[18], m[26]);-	MONT_MAC(v0, v1, v2, u[19], m[25]);-	MONT_MAC(w0, w1, w2, u[20], m[24]);-	MONT_MAC(t0, t1, t2, u[21], m[23]);-	MONT_MAC(v0, v1, v2, u[22], m[22]);-	MONT_MAC(w0, w1, w2, u[23], m[21]);-	MONT_MAC(t0, t1, t2, u[24], m[20]);-	MONT_MAC(v0, v1, v2, u[25], m[19]);-	MONT_MAC(w0, w1, w2, u[26], m[18]);-	MONT_MAC(t0, t1, t2, u[27], m[17]);-	MONT_MAC(v0, v1, v2, u[28], m[16]);-	MONT_MAC(w0, w1, w2, u[29], m[15]);-	MONT_MAC(t0, t1, t2, u[30], m[14]);-	MONT_MAC(v0, v1, v2, u[31], m[13]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_ADD(t0, t1, t2, w0, w1, w2);-	MONT_ADD(s0, s1, s2, c0, c1, c2);-	MONT_DBL(s0, s1, s2);-	MONT_ADD(t0, t1, t2, s0, s1, s2);-	z[12] = t0;-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 45 */-	MONT_MUL(s0, s1, s2, a[14], a[31]);-	MONT_MUL(c0, c1, c2, a[15], a[30]);-	MONT_MAC(s0, s1, s2, a[16], a[29]);-	MONT_MAC(c0, c1, c2, a[17], a[28]);-	MONT_MAC(s0, s1, s2, a[18], a[27]);-	MONT_MAC(c0, c1, c2, a[19], a[26]);-	MONT_MAC(s0, s1, s2, a[20], a[25]);-	MONT_MAC(c0, c1, c2, a[21], a[24]);-	MONT_MAC(s0, s1, s2, a[22], a[23]);-	MONT_MAC(t0, t1, t2, u[14], m[31]);-	MONT_MUL(v0, v1, v2, u[15], m[30]);-	MONT_MUL(w0, w1, w2, u[16], m[29]);-	MONT_MAC(t0, t1, t2, u[17], m[28]);-	MONT_MAC(v0, v1, v2, u[18], m[27]);-	MONT_MAC(w0, w1, w2, u[19], m[26]);-	MONT_MAC(t0, t1, t2, u[20], m[25]);-	MONT_MAC(v0, v1, v2, u[21], m[24]);-	MONT_MAC(w0, w1, w2, u[22], m[23]);-	MONT_MAC(t0, t1, t2, u[23], m[22]);-	MONT_MAC(v0, v1, v2, u[24], m[21]);-	MONT_MAC(w0, w1, w2, u[25], m[20]);-	MONT_MAC(t0, t1, t2, u[26], m[19]);-	MONT_MAC(v0, v1, v2, u[27], m[18]);-	MONT_MAC(w0, w1, w2, u[28], m[17]);-	MONT_MAC(t0, t1, t2, u[29], m[16]);-	MONT_MAC(v0, v1, v2, u[30], m[15]);-	MONT_MAC(w0, w1, w2, u[31], m[14]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_ADD(t0, t1, t2, w0, w1, w2);-	MONT_ADD(s0, s1, s2, c0, c1, c2);-	MONT_DBL(s0, s1, s2);-	MONT_ADD(t0, t1, t2, s0, s1, s2);-	z[13] = t0;-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 46 */-	MONT_MUL(s0, s1, s2, a[15], a[31]);-	MONT_MUL(c0, c1, c2, a[16], a[30]);-	MONT_MAC(s0, s1, s2, a[17], a[29]);-	MONT_MAC(c0, c1, c2, a[18], a[28]);-	MONT_MAC(s0, s1, s2, a[19], a[27]);-	MONT_MAC(c0, c1, c2, a[20], a[26]);-	MONT_MAC(s0, s1, s2, a[21], a[25]);-	MONT_MAC(c0, c1, c2, a[22], a[24]);-	MONT_MAC(t0, t1, t2, a[23], a[23]);-	MONT_MUL(v0, v1, v2, u[15], m[31]);-	MONT_MUL(w0, w1, w2, u[16], m[30]);-	MONT_MAC(t0, t1, t2, u[17], m[29]);-	MONT_MAC(v0, v1, v2, u[18], m[28]);-	MONT_MAC(w0, w1, w2, u[19], m[27]);-	MONT_MAC(t0, t1, t2, u[20], m[26]);-	MONT_MAC(v0, v1, v2, u[21], m[25]);-	MONT_MAC(w0, w1, w2, u[22], m[24]);-	MONT_MAC(t0, t1, t2, u[23], m[23]);-	MONT_MAC(v0, v1, v2, u[24], m[22]);-	MONT_MAC(w0, w1, w2, u[25], m[21]);-	MONT_MAC(t0, t1, t2, u[26], m[20]);-	MONT_MAC(v0, v1, v2, u[27], m[19]);-	MONT_MAC(w0, w1, w2, u[28], m[18]);-	MONT_MAC(t0, t1, t2, u[29], m[17]);-	MONT_MAC(v0, v1, v2, u[30], m[16]);-	MONT_MAC(w0, w1, w2, u[31], m[15]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_ADD(t0, t1, t2, w0, w1, w2);-	MONT_ADD(s0, s1, s2, c0, c1, c2);-	MONT_DBL(s0, s1, s2);-	MONT_ADD(t0, t1, t2, s0, s1, s2);-	z[14] = t0;-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 47 */-	MONT_MUL(s0, s1, s2, a[16], a[31]);-	MONT_MUL(c0, c1, c2, a[17], a[30]);-	MONT_MAC(s0, s1, s2, a[18], a[29]);-	MONT_MAC(c0, c1, c2, a[19], a[28]);-	MONT_MAC(s0, s1, s2, a[20], a[27]);-	MONT_MAC(c0, c1, c2, a[21], a[26]);-	MONT_MAC(s0, s1, s2, a[22], a[25]);-	MONT_MAC(c0, c1, c2, a[23], a[24]);-	MONT_MAC(t0, t1, t2, u[16], m[31]);-	MONT_MUL(v0, v1, v2, u[17], m[30]);-	MONT_MUL(w0, w1, w2, u[18], m[29]);-	MONT_MAC(t0, t1, t2, u[19], m[28]);-	MONT_MAC(v0, v1, v2, u[20], m[27]);-	MONT_MAC(w0, w1, w2, u[21], m[26]);-	MONT_MAC(t0, t1, t2, u[22], m[25]);-	MONT_MAC(v0, v1, v2, u[23], m[24]);-	MONT_MAC(w0, w1, w2, u[24], m[23]);-	MONT_MAC(t0, t1, t2, u[25], m[22]);-	MONT_MAC(v0, v1, v2, u[26], m[21]);-	MONT_MAC(w0, w1, w2, u[27], m[20]);-	MONT_MAC(t0, t1, t2, u[28], m[19]);-	MONT_MAC(v0, v1, v2, u[29], m[18]);-	MONT_MAC(w0, w1, w2, u[30], m[17]);-	MONT_MAC(t0, t1, t2, u[31], m[16]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_ADD(t0, t1, t2, w0, w1, w2);-	MONT_ADD(s0, s1, s2, c0, c1, c2);-	MONT_DBL(s0, s1, s2);-	MONT_ADD(t0, t1, t2, s0, s1, s2);-	z[15] = t0;-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 48 */-	MONT_MUL(s0, s1, s2, a[17], a[31]);-	MONT_MUL(c0, c1, c2, a[18], a[30]);-	MONT_MAC(s0, s1, s2, a[19], a[29]);-	MONT_MAC(c0, c1, c2, a[20], a[28]);-	MONT_MAC(s0, s1, s2, a[21], a[27]);-	MONT_MAC(c0, c1, c2, a[22], a[26]);-	MONT_MAC(s0, s1, s2, a[23], a[25]);-	MONT_MAC(t0, t1, t2, a[24], a[24]);-	MONT_MUL(v0, v1, v2, u[17], m[31]);-	MONT_MUL(w0, w1, w2, u[18], m[30]);-	MONT_MAC(t0, t1, t2, u[19], m[29]);-	MONT_MAC(v0, v1, v2, u[20], m[28]);-	MONT_MAC(w0, w1, w2, u[21], m[27]);-	MONT_MAC(t0, t1, t2, u[22], m[26]);-	MONT_MAC(v0, v1, v2, u[23], m[25]);-	MONT_MAC(w0, w1, w2, u[24], m[24]);-	MONT_MAC(t0, t1, t2, u[25], m[23]);-	MONT_MAC(v0, v1, v2, u[26], m[22]);-	MONT_MAC(w0, w1, w2, u[27], m[21]);-	MONT_MAC(t0, t1, t2, u[28], m[20]);-	MONT_MAC(v0, v1, v2, u[29], m[19]);-	MONT_MAC(w0, w1, w2, u[30], m[18]);-	MONT_MAC(t0, t1, t2, u[31], m[17]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_ADD(t0, t1, t2, w0, w1, w2);-	MONT_ADD(s0, s1, s2, c0, c1, c2);-	MONT_DBL(s0, s1, s2);-	MONT_ADD(t0, t1, t2, s0, s1, s2);-	z[16] = t0;-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 49 */-	MONT_MUL(s0, s1, s2, a[18], a[31]);-	MONT_MUL(c0, c1, c2, a[19], a[30]);-	MONT_MAC(s0, s1, s2, a[20], a[29]);-	MONT_MAC(c0, c1, c2, a[21], a[28]);-	MONT_MAC(s0, s1, s2, a[22], a[27]);-	MONT_MAC(c0, c1, c2, a[23], a[26]);-	MONT_MAC(s0, s1, s2, a[24], a[25]);-	MONT_MAC(t0, t1, t2, u[18], m[31]);-	MONT_MUL(v0, v1, v2, u[19], m[30]);-	MONT_MUL(w0, w1, w2, u[20], m[29]);-	MONT_MAC(t0, t1, t2, u[21], m[28]);-	MONT_MAC(v0, v1, v2, u[22], m[27]);-	MONT_MAC(w0, w1, w2, u[23], m[26]);-	MONT_MAC(t0, t1, t2, u[24], m[25]);-	MONT_MAC(v0, v1, v2, u[25], m[24]);-	MONT_MAC(w0, w1, w2, u[26], m[23]);-	MONT_MAC(t0, t1, t2, u[27], m[22]);-	MONT_MAC(v0, v1, v2, u[28], m[21]);-	MONT_MAC(w0, w1, w2, u[29], m[20]);-	MONT_MAC(t0, t1, t2, u[30], m[19]);-	MONT_MAC(v0, v1, v2, u[31], m[18]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_ADD(t0, t1, t2, w0, w1, w2);-	MONT_ADD(s0, s1, s2, c0, c1, c2);-	MONT_DBL(s0, s1, s2);-	MONT_ADD(t0, t1, t2, s0, s1, s2);-	z[17] = t0;-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 50 */-	MONT_MUL(s0, s1, s2, a[19], a[31]);-	MONT_MUL(c0, c1, c2, a[20], a[30]);-	MONT_MAC(s0, s1, s2, a[21], a[29]);-	MONT_MAC(c0, c1, c2, a[22], a[28]);-	MONT_MAC(s0, s1, s2, a[23], a[27]);-	MONT_MAC(c0, c1, c2, a[24], a[26]);-	MONT_MAC(t0, t1, t2, a[25], a[25]);-	MONT_MUL(v0, v1, v2, u[19], m[31]);-	MONT_MUL(w0, w1, w2, u[20], m[30]);-	MONT_MAC(t0, t1, t2, u[21], m[29]);-	MONT_MAC(v0, v1, v2, u[22], m[28]);-	MONT_MAC(w0, w1, w2, u[23], m[27]);-	MONT_MAC(t0, t1, t2, u[24], m[26]);-	MONT_MAC(v0, v1, v2, u[25], m[25]);-	MONT_MAC(w0, w1, w2, u[26], m[24]);-	MONT_MAC(t0, t1, t2, u[27], m[23]);-	MONT_MAC(v0, v1, v2, u[28], m[22]);-	MONT_MAC(w0, w1, w2, u[29], m[21]);-	MONT_MAC(t0, t1, t2, u[30], m[20]);-	MONT_MAC(v0, v1, v2, u[31], m[19]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_ADD(t0, t1, t2, w0, w1, w2);-	MONT_ADD(s0, s1, s2, c0, c1, c2);-	MONT_DBL(s0, s1, s2);-	MONT_ADD(t0, t1, t2, s0, s1, s2);-	z[18] = t0;-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 51 */-	MONT_MUL(s0, s1, s2, a[20], a[31]);-	MONT_MUL(c0, c1, c2, a[21], a[30]);-	MONT_MAC(s0, s1, s2, a[22], a[29]);-	MONT_MAC(c0, c1, c2, a[23], a[28]);-	MONT_MAC(s0, s1, s2, a[24], a[27]);-	MONT_MAC(c0, c1, c2, a[25], a[26]);-	MONT_MAC(t0, t1, t2, u[20], m[31]);-	MONT_MUL(v0, v1, v2, u[21], m[30]);-	MONT_MUL(w0, w1, w2, u[22], m[29]);-	MONT_MAC(t0, t1, t2, u[23], m[28]);-	MONT_MAC(v0, v1, v2, u[24], m[27]);-	MONT_MAC(w0, w1, w2, u[25], m[26]);-	MONT_MAC(t0, t1, t2, u[26], m[25]);-	MONT_MAC(v0, v1, v2, u[27], m[24]);-	MONT_MAC(w0, w1, w2, u[28], m[23]);-	MONT_MAC(t0, t1, t2, u[29], m[22]);-	MONT_MAC(v0, v1, v2, u[30], m[21]);-	MONT_MAC(w0, w1, w2, u[31], m[20]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_ADD(t0, t1, t2, w0, w1, w2);-	MONT_ADD(s0, s1, s2, c0, c1, c2);-	MONT_DBL(s0, s1, s2);-	MONT_ADD(t0, t1, t2, s0, s1, s2);-	z[19] = t0;-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 52 */-	MONT_MUL(s0, s1, s2, a[21], a[31]);-	MONT_MUL(c0, c1, c2, a[22], a[30]);-	MONT_MAC(s0, s1, s2, a[23], a[29]);-	MONT_MAC(c0, c1, c2, a[24], a[28]);-	MONT_MAC(s0, s1, s2, a[25], a[27]);-	MONT_MAC(t0, t1, t2, a[26], a[26]);-	MONT_MUL(v0, v1, v2, u[21], m[31]);-	MONT_MUL(w0, w1, w2, u[22], m[30]);-	MONT_MAC(t0, t1, t2, u[23], m[29]);-	MONT_MAC(v0, v1, v2, u[24], m[28]);-	MONT_MAC(w0, w1, w2, u[25], m[27]);-	MONT_MAC(t0, t1, t2, u[26], m[26]);-	MONT_MAC(v0, v1, v2, u[27], m[25]);-	MONT_MAC(w0, w1, w2, u[28], m[24]);-	MONT_MAC(t0, t1, t2, u[29], m[23]);-	MONT_MAC(v0, v1, v2, u[30], m[22]);-	MONT_MAC(w0, w1, w2, u[31], m[21]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_ADD(t0, t1, t2, w0, w1, w2);-	MONT_ADD(s0, s1, s2, c0, c1, c2);-	MONT_DBL(s0, s1, s2);-	MONT_ADD(t0, t1, t2, s0, s1, s2);-	z[20] = t0;-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 53 */-	MONT_MUL(s0, s1, s2, a[22], a[31]);-	MONT_MUL(c0, c1, c2, a[23], a[30]);-	MONT_MAC(s0, s1, s2, a[24], a[29]);-	MONT_MAC(c0, c1, c2, a[25], a[28]);-	MONT_MAC(s0, s1, s2, a[26], a[27]);-	MONT_MAC(t0, t1, t2, u[22], m[31]);-	MONT_MUL(v0, v1, v2, u[23], m[30]);-	MONT_MUL(w0, w1, w2, u[24], m[29]);-	MONT_MAC(t0, t1, t2, u[25], m[28]);-	MONT_MAC(v0, v1, v2, u[26], m[27]);-	MONT_MAC(w0, w1, w2, u[27], m[26]);-	MONT_MAC(t0, t1, t2, u[28], m[25]);-	MONT_MAC(v0, v1, v2, u[29], m[24]);-	MONT_MAC(w0, w1, w2, u[30], m[23]);-	MONT_MAC(t0, t1, t2, u[31], m[22]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_ADD(t0, t1, t2, w0, w1, w2);-	MONT_ADD(s0, s1, s2, c0, c1, c2);-	MONT_DBL(s0, s1, s2);-	MONT_ADD(t0, t1, t2, s0, s1, s2);-	z[21] = t0;-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 54 */-	MONT_MUL(s0, s1, s2, a[23], a[31]);-	MONT_MUL(c0, c1, c2, a[24], a[30]);-	MONT_MAC(s0, s1, s2, a[25], a[29]);-	MONT_MAC(c0, c1, c2, a[26], a[28]);-	MONT_MAC(t0, t1, t2, a[27], a[27]);-	MONT_MUL(v0, v1, v2, u[23], m[31]);-	MONT_MUL(w0, w1, w2, u[24], m[30]);-	MONT_MAC(t0, t1, t2, u[25], m[29]);-	MONT_MAC(v0, v1, v2, u[26], m[28]);-	MONT_MAC(w0, w1, w2, u[27], m[27]);-	MONT_MAC(t0, t1, t2, u[28], m[26]);-	MONT_MAC(v0, v1, v2, u[29], m[25]);-	MONT_MAC(w0, w1, w2, u[30], m[24]);-	MONT_MAC(t0, t1, t2, u[31], m[23]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_ADD(t0, t1, t2, w0, w1, w2);-	MONT_ADD(s0, s1, s2, c0, c1, c2);-	MONT_DBL(s0, s1, s2);-	MONT_ADD(t0, t1, t2, s0, s1, s2);-	z[22] = t0;-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 55 */-	MONT_MUL(s0, s1, s2, a[24], a[31]);-	MONT_MUL(c0, c1, c2, a[25], a[30]);-	MONT_MAC(s0, s1, s2, a[26], a[29]);-	MONT_MAC(c0, c1, c2, a[27], a[28]);-	MONT_MAC(t0, t1, t2, u[24], m[31]);-	MONT_MUL(v0, v1, v2, u[25], m[30]);-	MONT_MUL(w0, w1, w2, u[26], m[29]);-	MONT_MAC(t0, t1, t2, u[27], m[28]);-	MONT_MAC(v0, v1, v2, u[28], m[27]);-	MONT_MAC(w0, w1, w2, u[29], m[26]);-	MONT_MAC(t0, t1, t2, u[30], m[25]);-	MONT_MAC(v0, v1, v2, u[31], m[24]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_ADD(t0, t1, t2, w0, w1, w2);-	MONT_ADD(s0, s1, s2, c0, c1, c2);-	MONT_DBL(s0, s1, s2);-	MONT_ADD(t0, t1, t2, s0, s1, s2);-	z[23] = t0;-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 56 */-	MONT_MUL(s0, s1, s2, a[25], a[31]);-	MONT_MUL(c0, c1, c2, a[26], a[30]);-	MONT_MAC(s0, s1, s2, a[27], a[29]);-	MONT_MAC(t0, t1, t2, a[28], a[28]);-	MONT_MUL(v0, v1, v2, u[25], m[31]);-	MONT_MUL(w0, w1, w2, u[26], m[30]);-	MONT_MAC(t0, t1, t2, u[27], m[29]);-	MONT_MAC(v0, v1, v2, u[28], m[28]);-	MONT_MAC(w0, w1, w2, u[29], m[27]);-	MONT_MAC(t0, t1, t2, u[30], m[26]);-	MONT_MAC(v0, v1, v2, u[31], m[25]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_ADD(t0, t1, t2, w0, w1, w2);-	MONT_ADD(s0, s1, s2, c0, c1, c2);-	MONT_DBL(s0, s1, s2);-	MONT_ADD(t0, t1, t2, s0, s1, s2);-	z[24] = t0;-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 57 */-	MONT_MUL(s0, s1, s2, a[26], a[31]);-	MONT_MUL(c0, c1, c2, a[27], a[30]);-	MONT_MAC(s0, s1, s2, a[28], a[29]);-	MONT_MAC(t0, t1, t2, u[26], m[31]);-	MONT_MUL(v0, v1, v2, u[27], m[30]);-	MONT_MUL(w0, w1, w2, u[28], m[29]);-	MONT_MAC(t0, t1, t2, u[29], m[28]);-	MONT_MAC(v0, v1, v2, u[30], m[27]);-	MONT_MAC(w0, w1, w2, u[31], m[26]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_ADD(t0, t1, t2, w0, w1, w2);-	MONT_ADD(s0, s1, s2, c0, c1, c2);-	MONT_DBL(s0, s1, s2);-	MONT_ADD(t0, t1, t2, s0, s1, s2);-	z[25] = t0;-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 58 */-	MONT_MUL(s0, s1, s2, a[27], a[31]);-	MONT_MUL(c0, c1, c2, a[28], a[30]);-	MONT_MAC(t0, t1, t2, a[29], a[29]);-	MONT_MUL(v0, v1, v2, u[27], m[31]);-	MONT_MUL(w0, w1, w2, u[28], m[30]);-	MONT_MAC(t0, t1, t2, u[29], m[29]);-	MONT_MAC(v0, v1, v2, u[30], m[28]);-	MONT_MAC(w0, w1, w2, u[31], m[27]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_ADD(t0, t1, t2, w0, w1, w2);-	MONT_ADD(s0, s1, s2, c0, c1, c2);-	MONT_DBL(s0, s1, s2);-	MONT_ADD(t0, t1, t2, s0, s1, s2);-	z[26] = t0;-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 59 */-	MONT_MUL(s0, s1, s2, a[28], a[31]);-	MONT_MUL(c0, c1, c2, a[29], a[30]);-	MONT_MAC(t0, t1, t2, u[28], m[31]);-	MONT_MUL(v0, v1, v2, u[29], m[30]);-	MONT_MUL(w0, w1, w2, u[30], m[29]);-	MONT_MAC(t0, t1, t2, u[31], m[28]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_ADD(t0, t1, t2, w0, w1, w2);-	MONT_ADD(s0, s1, s2, c0, c1, c2);-	MONT_DBL(s0, s1, s2);-	MONT_ADD(t0, t1, t2, s0, s1, s2);-	z[27] = t0;-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 60 */-	MONT_MUL(s0, s1, s2, a[29], a[31]);-	MONT_MAC(t0, t1, t2, a[30], a[30]);-	MONT_MUL(v0, v1, v2, u[29], m[31]);-	MONT_MUL(w0, w1, w2, u[30], m[30]);-	MONT_MAC(t0, t1, t2, u[31], m[29]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_ADD(t0, t1, t2, w0, w1, w2);-	MONT_DBL(s0, s1, s2);-	MONT_ADD(t0, t1, t2, s0, s1, s2);-	z[28] = t0;-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 61 */-	MONT_MUL(s0, s1, s2, a[30], a[31]);-	MONT_MAC(t0, t1, t2, u[30], m[31]);-	MONT_MUL(v0, v1, v2, u[31], m[30]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	MONT_DBL(s0, s1, s2);-	MONT_ADD(t0, t1, t2, s0, s1, s2);-	z[29] = t0;-	t0 = t1;-	t1 = t2;-	t2 = 0;-	/* column 62 */-	MONT_MAC(t0, t1, t2, a[31], a[31]);-	MONT_MUL(v0, v1, v2, u[31], m[31]);-	MONT_ADD(t0, t1, t2, v0, v1, v2);-	z[30] = t0;-	t0 = t1;-	t1 = t2;-	t2 = 0;-	z[31] = t0;--	/* under 2m, with t1 the bit above n limbs: at most one subtraction */-	borrow = sub_n(r, z, m, 32);-	take = t1 | (borrow ^ 1);-	select_n(r, r, z, take & 1, 32);+ * the halves of RSA-2048, -3072 and -4096, and squaring at 48, RSA-3072's+ * modulus.  Each answers what mont_mul and mont_sqr answer. */+#ifndef CRYPTON_MONT_H+#define CRYPTON_MONT_H++#include "crypton_bignum.h"++/* (t2:t1:t0) += x * y */+#define MONT_MAC(t0, t1, t2, x, y)                                      \+	do {                                                                \+		limb_t lo_, hi_;                                                \+		__asm__("mul\t%0, %5, %6\n\t"                                   \+		        "umulh\t%1, %5, %6\n\t"                                 \+		        "adds\t%2, %2, %0\n\t"                                  \+		        "adcs\t%3, %3, %1\n\t"                                  \+		        "adc\t%4, %4, xzr"                                       \+		        : "=&r"(lo_), "=&r"(hi_), "+r"(t0), "+r"(t1), "+r"(t2)  \+		        : "r"(x), "r"(y)                                        \+		        : "cc");                                                \+	} while (0)++/* (s2:s1:s0) = x * y */+#define MONT_MUL(s0, s1, s2, x, y)                                      \+	__asm__("mul\t%0, %3, %4\n\t"                                       \+	        "umulh\t%1, %3, %4\n\t"                                     \+	        "mov\t%2, xzr"                                               \+	        : "=&r"(s0), "=&r"(s1), "=r"(s2)                            \+	        : "r"(x), "r"(y))++/* (t2:t1:t0) += (s2:s1:s0) */+#define MONT_ADD(t0, t1, t2, s0, s1, s2)                                \+	__asm__("adds\t%0, %0, %3\n\t"                                      \+	        "adcs\t%1, %1, %4\n\t"                                      \+	        "adc\t%2, %2, %5"                                            \+	        : "+r"(t0), "+r"(t1), "+r"(t2)                              \+	        : "r"(s0), "r"(s1), "r"(s2)                                 \+	        : "cc")++/* (s2:s1:s0) *= 2 */+#define MONT_DBL(s0, s1, s2)                                            \+	do {                                                                \+		s2 = (s2 << 1) | (s1 >> 63);                                    \+		s1 = (s1 << 1) | (s0 >> 63);                                    \+		s0 <<= 1;                                                       \+	} while (0)++/* r = a * b * R^-1 mod m, for a and b under m; t is 2n limbs of scratch */+static void crypton_mont_mul16(limb_t *r, const limb_t *a, const limb_t *b,+                               const limb_t *m, limb_t n0, limb_t *t)+{+	limb_t *u = t, *z = t + 16;+	limb_t t0 = 0, t1 = 0, t2 = 0, v0, v1, v2, w0, w1, w2, borrow, take;++	/* column 0 */+	MONT_MAC(t0, t1, t2, a[0], b[0]);+	u[0] = t0 * n0;+	MONT_MAC(t0, t1, t2, u[0], m[0]);+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 1 */+	MONT_MAC(t0, t1, t2, a[0], b[1]);+	MONT_MUL(v0, v1, v2, a[1], b[0]);+	MONT_MUL(w0, w1, w2, u[0], m[1]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	u[1] = t0 * n0;+	MONT_MAC(t0, t1, t2, u[1], m[0]);+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 2 */+	MONT_MAC(t0, t1, t2, a[0], b[2]);+	MONT_MUL(v0, v1, v2, a[1], b[1]);+	MONT_MUL(w0, w1, w2, a[2], b[0]);+	MONT_MAC(t0, t1, t2, u[0], m[2]);+	MONT_MAC(v0, v1, v2, u[1], m[1]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	u[2] = t0 * n0;+	MONT_MAC(t0, t1, t2, u[2], m[0]);+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 3 */+	MONT_MAC(t0, t1, t2, a[0], b[3]);+	MONT_MUL(v0, v1, v2, a[1], b[2]);+	MONT_MUL(w0, w1, w2, a[2], b[1]);+	MONT_MAC(t0, t1, t2, a[3], b[0]);+	MONT_MAC(v0, v1, v2, u[0], m[3]);+	MONT_MAC(w0, w1, w2, u[1], m[2]);+	MONT_MAC(t0, t1, t2, u[2], m[1]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	u[3] = t0 * n0;+	MONT_MAC(t0, t1, t2, u[3], m[0]);+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 4 */+	MONT_MAC(t0, t1, t2, a[0], b[4]);+	MONT_MUL(v0, v1, v2, a[1], b[3]);+	MONT_MUL(w0, w1, w2, a[2], b[2]);+	MONT_MAC(t0, t1, t2, a[3], b[1]);+	MONT_MAC(v0, v1, v2, a[4], b[0]);+	MONT_MAC(w0, w1, w2, u[0], m[4]);+	MONT_MAC(t0, t1, t2, u[1], m[3]);+	MONT_MAC(v0, v1, v2, u[2], m[2]);+	MONT_MAC(w0, w1, w2, u[3], m[1]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	u[4] = t0 * n0;+	MONT_MAC(t0, t1, t2, u[4], m[0]);+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 5 */+	MONT_MAC(t0, t1, t2, a[0], b[5]);+	MONT_MUL(v0, v1, v2, a[1], b[4]);+	MONT_MUL(w0, w1, w2, a[2], b[3]);+	MONT_MAC(t0, t1, t2, a[3], b[2]);+	MONT_MAC(v0, v1, v2, a[4], b[1]);+	MONT_MAC(w0, w1, w2, a[5], b[0]);+	MONT_MAC(t0, t1, t2, u[0], m[5]);+	MONT_MAC(v0, v1, v2, u[1], m[4]);+	MONT_MAC(w0, w1, w2, u[2], m[3]);+	MONT_MAC(t0, t1, t2, u[3], m[2]);+	MONT_MAC(v0, v1, v2, u[4], m[1]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	u[5] = t0 * n0;+	MONT_MAC(t0, t1, t2, u[5], m[0]);+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 6 */+	MONT_MAC(t0, t1, t2, a[0], b[6]);+	MONT_MUL(v0, v1, v2, a[1], b[5]);+	MONT_MUL(w0, w1, w2, a[2], b[4]);+	MONT_MAC(t0, t1, t2, a[3], b[3]);+	MONT_MAC(v0, v1, v2, a[4], b[2]);+	MONT_MAC(w0, w1, w2, a[5], b[1]);+	MONT_MAC(t0, t1, t2, a[6], b[0]);+	MONT_MAC(v0, v1, v2, u[0], m[6]);+	MONT_MAC(w0, w1, w2, u[1], m[5]);+	MONT_MAC(t0, t1, t2, u[2], m[4]);+	MONT_MAC(v0, v1, v2, u[3], m[3]);+	MONT_MAC(w0, w1, w2, u[4], m[2]);+	MONT_MAC(t0, t1, t2, u[5], m[1]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	u[6] = t0 * n0;+	MONT_MAC(t0, t1, t2, u[6], m[0]);+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 7 */+	MONT_MAC(t0, t1, t2, a[0], b[7]);+	MONT_MUL(v0, v1, v2, a[1], b[6]);+	MONT_MUL(w0, w1, w2, a[2], b[5]);+	MONT_MAC(t0, t1, t2, a[3], b[4]);+	MONT_MAC(v0, v1, v2, a[4], b[3]);+	MONT_MAC(w0, w1, w2, a[5], b[2]);+	MONT_MAC(t0, t1, t2, a[6], b[1]);+	MONT_MAC(v0, v1, v2, a[7], b[0]);+	MONT_MAC(w0, w1, w2, u[0], m[7]);+	MONT_MAC(t0, t1, t2, u[1], m[6]);+	MONT_MAC(v0, v1, v2, u[2], m[5]);+	MONT_MAC(w0, w1, w2, u[3], m[4]);+	MONT_MAC(t0, t1, t2, u[4], m[3]);+	MONT_MAC(v0, v1, v2, u[5], m[2]);+	MONT_MAC(w0, w1, w2, u[6], m[1]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	u[7] = t0 * n0;+	MONT_MAC(t0, t1, t2, u[7], m[0]);+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 8 */+	MONT_MAC(t0, t1, t2, a[0], b[8]);+	MONT_MUL(v0, v1, v2, a[1], b[7]);+	MONT_MUL(w0, w1, w2, a[2], b[6]);+	MONT_MAC(t0, t1, t2, a[3], b[5]);+	MONT_MAC(v0, v1, v2, a[4], b[4]);+	MONT_MAC(w0, w1, w2, a[5], b[3]);+	MONT_MAC(t0, t1, t2, a[6], b[2]);+	MONT_MAC(v0, v1, v2, a[7], b[1]);+	MONT_MAC(w0, w1, w2, a[8], b[0]);+	MONT_MAC(t0, t1, t2, u[0], m[8]);+	MONT_MAC(v0, v1, v2, u[1], m[7]);+	MONT_MAC(w0, w1, w2, u[2], m[6]);+	MONT_MAC(t0, t1, t2, u[3], m[5]);+	MONT_MAC(v0, v1, v2, u[4], m[4]);+	MONT_MAC(w0, w1, w2, u[5], m[3]);+	MONT_MAC(t0, t1, t2, u[6], m[2]);+	MONT_MAC(v0, v1, v2, u[7], m[1]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	u[8] = t0 * n0;+	MONT_MAC(t0, t1, t2, u[8], m[0]);+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 9 */+	MONT_MAC(t0, t1, t2, a[0], b[9]);+	MONT_MUL(v0, v1, v2, a[1], b[8]);+	MONT_MUL(w0, w1, w2, a[2], b[7]);+	MONT_MAC(t0, t1, t2, a[3], b[6]);+	MONT_MAC(v0, v1, v2, a[4], b[5]);+	MONT_MAC(w0, w1, w2, a[5], b[4]);+	MONT_MAC(t0, t1, t2, a[6], b[3]);+	MONT_MAC(v0, v1, v2, a[7], b[2]);+	MONT_MAC(w0, w1, w2, a[8], b[1]);+	MONT_MAC(t0, t1, t2, a[9], b[0]);+	MONT_MAC(v0, v1, v2, u[0], m[9]);+	MONT_MAC(w0, w1, w2, u[1], m[8]);+	MONT_MAC(t0, t1, t2, u[2], m[7]);+	MONT_MAC(v0, v1, v2, u[3], m[6]);+	MONT_MAC(w0, w1, w2, u[4], m[5]);+	MONT_MAC(t0, t1, t2, u[5], m[4]);+	MONT_MAC(v0, v1, v2, u[6], m[3]);+	MONT_MAC(w0, w1, w2, u[7], m[2]);+	MONT_MAC(t0, t1, t2, u[8], m[1]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	u[9] = t0 * n0;+	MONT_MAC(t0, t1, t2, u[9], m[0]);+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 10 */+	MONT_MAC(t0, t1, t2, a[0], b[10]);+	MONT_MUL(v0, v1, v2, a[1], b[9]);+	MONT_MUL(w0, w1, w2, a[2], b[8]);+	MONT_MAC(t0, t1, t2, a[3], b[7]);+	MONT_MAC(v0, v1, v2, a[4], b[6]);+	MONT_MAC(w0, w1, w2, a[5], b[5]);+	MONT_MAC(t0, t1, t2, a[6], b[4]);+	MONT_MAC(v0, v1, v2, a[7], b[3]);+	MONT_MAC(w0, w1, w2, a[8], b[2]);+	MONT_MAC(t0, t1, t2, a[9], b[1]);+	MONT_MAC(v0, v1, v2, a[10], b[0]);+	MONT_MAC(w0, w1, w2, u[0], m[10]);+	MONT_MAC(t0, t1, t2, u[1], m[9]);+	MONT_MAC(v0, v1, v2, u[2], m[8]);+	MONT_MAC(w0, w1, w2, u[3], m[7]);+	MONT_MAC(t0, t1, t2, u[4], m[6]);+	MONT_MAC(v0, v1, v2, u[5], m[5]);+	MONT_MAC(w0, w1, w2, u[6], m[4]);+	MONT_MAC(t0, t1, t2, u[7], m[3]);+	MONT_MAC(v0, v1, v2, u[8], m[2]);+	MONT_MAC(w0, w1, w2, u[9], m[1]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	u[10] = t0 * n0;+	MONT_MAC(t0, t1, t2, u[10], m[0]);+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 11 */+	MONT_MAC(t0, t1, t2, a[0], b[11]);+	MONT_MUL(v0, v1, v2, a[1], b[10]);+	MONT_MUL(w0, w1, w2, a[2], b[9]);+	MONT_MAC(t0, t1, t2, a[3], b[8]);+	MONT_MAC(v0, v1, v2, a[4], b[7]);+	MONT_MAC(w0, w1, w2, a[5], b[6]);+	MONT_MAC(t0, t1, t2, a[6], b[5]);+	MONT_MAC(v0, v1, v2, a[7], b[4]);+	MONT_MAC(w0, w1, w2, a[8], b[3]);+	MONT_MAC(t0, t1, t2, a[9], b[2]);+	MONT_MAC(v0, v1, v2, a[10], b[1]);+	MONT_MAC(w0, w1, w2, a[11], b[0]);+	MONT_MAC(t0, t1, t2, u[0], m[11]);+	MONT_MAC(v0, v1, v2, u[1], m[10]);+	MONT_MAC(w0, w1, w2, u[2], m[9]);+	MONT_MAC(t0, t1, t2, u[3], m[8]);+	MONT_MAC(v0, v1, v2, u[4], m[7]);+	MONT_MAC(w0, w1, w2, u[5], m[6]);+	MONT_MAC(t0, t1, t2, u[6], m[5]);+	MONT_MAC(v0, v1, v2, u[7], m[4]);+	MONT_MAC(w0, w1, w2, u[8], m[3]);+	MONT_MAC(t0, t1, t2, u[9], m[2]);+	MONT_MAC(v0, v1, v2, u[10], m[1]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	u[11] = t0 * n0;+	MONT_MAC(t0, t1, t2, u[11], m[0]);+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 12 */+	MONT_MAC(t0, t1, t2, a[0], b[12]);+	MONT_MUL(v0, v1, v2, a[1], b[11]);+	MONT_MUL(w0, w1, w2, a[2], b[10]);+	MONT_MAC(t0, t1, t2, a[3], b[9]);+	MONT_MAC(v0, v1, v2, a[4], b[8]);+	MONT_MAC(w0, w1, w2, a[5], b[7]);+	MONT_MAC(t0, t1, t2, a[6], b[6]);+	MONT_MAC(v0, v1, v2, a[7], b[5]);+	MONT_MAC(w0, w1, w2, a[8], b[4]);+	MONT_MAC(t0, t1, t2, a[9], b[3]);+	MONT_MAC(v0, v1, v2, a[10], b[2]);+	MONT_MAC(w0, w1, w2, a[11], b[1]);+	MONT_MAC(t0, t1, t2, a[12], b[0]);+	MONT_MAC(v0, v1, v2, u[0], m[12]);+	MONT_MAC(w0, w1, w2, u[1], m[11]);+	MONT_MAC(t0, t1, t2, u[2], m[10]);+	MONT_MAC(v0, v1, v2, u[3], m[9]);+	MONT_MAC(w0, w1, w2, u[4], m[8]);+	MONT_MAC(t0, t1, t2, u[5], m[7]);+	MONT_MAC(v0, v1, v2, u[6], m[6]);+	MONT_MAC(w0, w1, w2, u[7], m[5]);+	MONT_MAC(t0, t1, t2, u[8], m[4]);+	MONT_MAC(v0, v1, v2, u[9], m[3]);+	MONT_MAC(w0, w1, w2, u[10], m[2]);+	MONT_MAC(t0, t1, t2, u[11], m[1]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	u[12] = t0 * n0;+	MONT_MAC(t0, t1, t2, u[12], m[0]);+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 13 */+	MONT_MAC(t0, t1, t2, a[0], b[13]);+	MONT_MUL(v0, v1, v2, a[1], b[12]);+	MONT_MUL(w0, w1, w2, a[2], b[11]);+	MONT_MAC(t0, t1, t2, a[3], b[10]);+	MONT_MAC(v0, v1, v2, a[4], b[9]);+	MONT_MAC(w0, w1, w2, a[5], b[8]);+	MONT_MAC(t0, t1, t2, a[6], b[7]);+	MONT_MAC(v0, v1, v2, a[7], b[6]);+	MONT_MAC(w0, w1, w2, a[8], b[5]);+	MONT_MAC(t0, t1, t2, a[9], b[4]);+	MONT_MAC(v0, v1, v2, a[10], b[3]);+	MONT_MAC(w0, w1, w2, a[11], b[2]);+	MONT_MAC(t0, t1, t2, a[12], b[1]);+	MONT_MAC(v0, v1, v2, a[13], b[0]);+	MONT_MAC(w0, w1, w2, u[0], m[13]);+	MONT_MAC(t0, t1, t2, u[1], m[12]);+	MONT_MAC(v0, v1, v2, u[2], m[11]);+	MONT_MAC(w0, w1, w2, u[3], m[10]);+	MONT_MAC(t0, t1, t2, u[4], m[9]);+	MONT_MAC(v0, v1, v2, u[5], m[8]);+	MONT_MAC(w0, w1, w2, u[6], m[7]);+	MONT_MAC(t0, t1, t2, u[7], m[6]);+	MONT_MAC(v0, v1, v2, u[8], m[5]);+	MONT_MAC(w0, w1, w2, u[9], m[4]);+	MONT_MAC(t0, t1, t2, u[10], m[3]);+	MONT_MAC(v0, v1, v2, u[11], m[2]);+	MONT_MAC(w0, w1, w2, u[12], m[1]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	u[13] = t0 * n0;+	MONT_MAC(t0, t1, t2, u[13], m[0]);+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 14 */+	MONT_MAC(t0, t1, t2, a[0], b[14]);+	MONT_MUL(v0, v1, v2, a[1], b[13]);+	MONT_MUL(w0, w1, w2, a[2], b[12]);+	MONT_MAC(t0, t1, t2, a[3], b[11]);+	MONT_MAC(v0, v1, v2, a[4], b[10]);+	MONT_MAC(w0, w1, w2, a[5], b[9]);+	MONT_MAC(t0, t1, t2, a[6], b[8]);+	MONT_MAC(v0, v1, v2, a[7], b[7]);+	MONT_MAC(w0, w1, w2, a[8], b[6]);+	MONT_MAC(t0, t1, t2, a[9], b[5]);+	MONT_MAC(v0, v1, v2, a[10], b[4]);+	MONT_MAC(w0, w1, w2, a[11], b[3]);+	MONT_MAC(t0, t1, t2, a[12], b[2]);+	MONT_MAC(v0, v1, v2, a[13], b[1]);+	MONT_MAC(w0, w1, w2, a[14], b[0]);+	MONT_MAC(t0, t1, t2, u[0], m[14]);+	MONT_MAC(v0, v1, v2, u[1], m[13]);+	MONT_MAC(w0, w1, w2, u[2], m[12]);+	MONT_MAC(t0, t1, t2, u[3], m[11]);+	MONT_MAC(v0, v1, v2, u[4], m[10]);+	MONT_MAC(w0, w1, w2, u[5], m[9]);+	MONT_MAC(t0, t1, t2, u[6], m[8]);+	MONT_MAC(v0, v1, v2, u[7], m[7]);+	MONT_MAC(w0, w1, w2, u[8], m[6]);+	MONT_MAC(t0, t1, t2, u[9], m[5]);+	MONT_MAC(v0, v1, v2, u[10], m[4]);+	MONT_MAC(w0, w1, w2, u[11], m[3]);+	MONT_MAC(t0, t1, t2, u[12], m[2]);+	MONT_MAC(v0, v1, v2, u[13], m[1]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	u[14] = t0 * n0;+	MONT_MAC(t0, t1, t2, u[14], m[0]);+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 15 */+	MONT_MAC(t0, t1, t2, a[0], b[15]);+	MONT_MUL(v0, v1, v2, a[1], b[14]);+	MONT_MUL(w0, w1, w2, a[2], b[13]);+	MONT_MAC(t0, t1, t2, a[3], b[12]);+	MONT_MAC(v0, v1, v2, a[4], b[11]);+	MONT_MAC(w0, w1, w2, a[5], b[10]);+	MONT_MAC(t0, t1, t2, a[6], b[9]);+	MONT_MAC(v0, v1, v2, a[7], b[8]);+	MONT_MAC(w0, w1, w2, a[8], b[7]);+	MONT_MAC(t0, t1, t2, a[9], b[6]);+	MONT_MAC(v0, v1, v2, a[10], b[5]);+	MONT_MAC(w0, w1, w2, a[11], b[4]);+	MONT_MAC(t0, t1, t2, a[12], b[3]);+	MONT_MAC(v0, v1, v2, a[13], b[2]);+	MONT_MAC(w0, w1, w2, a[14], b[1]);+	MONT_MAC(t0, t1, t2, a[15], b[0]);+	MONT_MAC(v0, v1, v2, u[0], m[15]);+	MONT_MAC(w0, w1, w2, u[1], m[14]);+	MONT_MAC(t0, t1, t2, u[2], m[13]);+	MONT_MAC(v0, v1, v2, u[3], m[12]);+	MONT_MAC(w0, w1, w2, u[4], m[11]);+	MONT_MAC(t0, t1, t2, u[5], m[10]);+	MONT_MAC(v0, v1, v2, u[6], m[9]);+	MONT_MAC(w0, w1, w2, u[7], m[8]);+	MONT_MAC(t0, t1, t2, u[8], m[7]);+	MONT_MAC(v0, v1, v2, u[9], m[6]);+	MONT_MAC(w0, w1, w2, u[10], m[5]);+	MONT_MAC(t0, t1, t2, u[11], m[4]);+	MONT_MAC(v0, v1, v2, u[12], m[3]);+	MONT_MAC(w0, w1, w2, u[13], m[2]);+	MONT_MAC(t0, t1, t2, u[14], m[1]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	u[15] = t0 * n0;+	MONT_MAC(t0, t1, t2, u[15], m[0]);+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 16 */+	MONT_MAC(t0, t1, t2, a[1], b[15]);+	MONT_MUL(v0, v1, v2, a[2], b[14]);+	MONT_MUL(w0, w1, w2, a[3], b[13]);+	MONT_MAC(t0, t1, t2, a[4], b[12]);+	MONT_MAC(v0, v1, v2, a[5], b[11]);+	MONT_MAC(w0, w1, w2, a[6], b[10]);+	MONT_MAC(t0, t1, t2, a[7], b[9]);+	MONT_MAC(v0, v1, v2, a[8], b[8]);+	MONT_MAC(w0, w1, w2, a[9], b[7]);+	MONT_MAC(t0, t1, t2, a[10], b[6]);+	MONT_MAC(v0, v1, v2, a[11], b[5]);+	MONT_MAC(w0, w1, w2, a[12], b[4]);+	MONT_MAC(t0, t1, t2, a[13], b[3]);+	MONT_MAC(v0, v1, v2, a[14], b[2]);+	MONT_MAC(w0, w1, w2, a[15], b[1]);+	MONT_MAC(t0, t1, t2, u[1], m[15]);+	MONT_MAC(v0, v1, v2, u[2], m[14]);+	MONT_MAC(w0, w1, w2, u[3], m[13]);+	MONT_MAC(t0, t1, t2, u[4], m[12]);+	MONT_MAC(v0, v1, v2, u[5], m[11]);+	MONT_MAC(w0, w1, w2, u[6], m[10]);+	MONT_MAC(t0, t1, t2, u[7], m[9]);+	MONT_MAC(v0, v1, v2, u[8], m[8]);+	MONT_MAC(w0, w1, w2, u[9], m[7]);+	MONT_MAC(t0, t1, t2, u[10], m[6]);+	MONT_MAC(v0, v1, v2, u[11], m[5]);+	MONT_MAC(w0, w1, w2, u[12], m[4]);+	MONT_MAC(t0, t1, t2, u[13], m[3]);+	MONT_MAC(v0, v1, v2, u[14], m[2]);+	MONT_MAC(w0, w1, w2, u[15], m[1]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	z[0] = t0;+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 17 */+	MONT_MAC(t0, t1, t2, a[2], b[15]);+	MONT_MUL(v0, v1, v2, a[3], b[14]);+	MONT_MUL(w0, w1, w2, a[4], b[13]);+	MONT_MAC(t0, t1, t2, a[5], b[12]);+	MONT_MAC(v0, v1, v2, a[6], b[11]);+	MONT_MAC(w0, w1, w2, a[7], b[10]);+	MONT_MAC(t0, t1, t2, a[8], b[9]);+	MONT_MAC(v0, v1, v2, a[9], b[8]);+	MONT_MAC(w0, w1, w2, a[10], b[7]);+	MONT_MAC(t0, t1, t2, a[11], b[6]);+	MONT_MAC(v0, v1, v2, a[12], b[5]);+	MONT_MAC(w0, w1, w2, a[13], b[4]);+	MONT_MAC(t0, t1, t2, a[14], b[3]);+	MONT_MAC(v0, v1, v2, a[15], b[2]);+	MONT_MAC(w0, w1, w2, u[2], m[15]);+	MONT_MAC(t0, t1, t2, u[3], m[14]);+	MONT_MAC(v0, v1, v2, u[4], m[13]);+	MONT_MAC(w0, w1, w2, u[5], m[12]);+	MONT_MAC(t0, t1, t2, u[6], m[11]);+	MONT_MAC(v0, v1, v2, u[7], m[10]);+	MONT_MAC(w0, w1, w2, u[8], m[9]);+	MONT_MAC(t0, t1, t2, u[9], m[8]);+	MONT_MAC(v0, v1, v2, u[10], m[7]);+	MONT_MAC(w0, w1, w2, u[11], m[6]);+	MONT_MAC(t0, t1, t2, u[12], m[5]);+	MONT_MAC(v0, v1, v2, u[13], m[4]);+	MONT_MAC(w0, w1, w2, u[14], m[3]);+	MONT_MAC(t0, t1, t2, u[15], m[2]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	z[1] = t0;+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 18 */+	MONT_MAC(t0, t1, t2, a[3], b[15]);+	MONT_MUL(v0, v1, v2, a[4], b[14]);+	MONT_MUL(w0, w1, w2, a[5], b[13]);+	MONT_MAC(t0, t1, t2, a[6], b[12]);+	MONT_MAC(v0, v1, v2, a[7], b[11]);+	MONT_MAC(w0, w1, w2, a[8], b[10]);+	MONT_MAC(t0, t1, t2, a[9], b[9]);+	MONT_MAC(v0, v1, v2, a[10], b[8]);+	MONT_MAC(w0, w1, w2, a[11], b[7]);+	MONT_MAC(t0, t1, t2, a[12], b[6]);+	MONT_MAC(v0, v1, v2, a[13], b[5]);+	MONT_MAC(w0, w1, w2, a[14], b[4]);+	MONT_MAC(t0, t1, t2, a[15], b[3]);+	MONT_MAC(v0, v1, v2, u[3], m[15]);+	MONT_MAC(w0, w1, w2, u[4], m[14]);+	MONT_MAC(t0, t1, t2, u[5], m[13]);+	MONT_MAC(v0, v1, v2, u[6], m[12]);+	MONT_MAC(w0, w1, w2, u[7], m[11]);+	MONT_MAC(t0, t1, t2, u[8], m[10]);+	MONT_MAC(v0, v1, v2, u[9], m[9]);+	MONT_MAC(w0, w1, w2, u[10], m[8]);+	MONT_MAC(t0, t1, t2, u[11], m[7]);+	MONT_MAC(v0, v1, v2, u[12], m[6]);+	MONT_MAC(w0, w1, w2, u[13], m[5]);+	MONT_MAC(t0, t1, t2, u[14], m[4]);+	MONT_MAC(v0, v1, v2, u[15], m[3]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	z[2] = t0;+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 19 */+	MONT_MAC(t0, t1, t2, a[4], b[15]);+	MONT_MUL(v0, v1, v2, a[5], b[14]);+	MONT_MUL(w0, w1, w2, a[6], b[13]);+	MONT_MAC(t0, t1, t2, a[7], b[12]);+	MONT_MAC(v0, v1, v2, a[8], b[11]);+	MONT_MAC(w0, w1, w2, a[9], b[10]);+	MONT_MAC(t0, t1, t2, a[10], b[9]);+	MONT_MAC(v0, v1, v2, a[11], b[8]);+	MONT_MAC(w0, w1, w2, a[12], b[7]);+	MONT_MAC(t0, t1, t2, a[13], b[6]);+	MONT_MAC(v0, v1, v2, a[14], b[5]);+	MONT_MAC(w0, w1, w2, a[15], b[4]);+	MONT_MAC(t0, t1, t2, u[4], m[15]);+	MONT_MAC(v0, v1, v2, u[5], m[14]);+	MONT_MAC(w0, w1, w2, u[6], m[13]);+	MONT_MAC(t0, t1, t2, u[7], m[12]);+	MONT_MAC(v0, v1, v2, u[8], m[11]);+	MONT_MAC(w0, w1, w2, u[9], m[10]);+	MONT_MAC(t0, t1, t2, u[10], m[9]);+	MONT_MAC(v0, v1, v2, u[11], m[8]);+	MONT_MAC(w0, w1, w2, u[12], m[7]);+	MONT_MAC(t0, t1, t2, u[13], m[6]);+	MONT_MAC(v0, v1, v2, u[14], m[5]);+	MONT_MAC(w0, w1, w2, u[15], m[4]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	z[3] = t0;+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 20 */+	MONT_MAC(t0, t1, t2, a[5], b[15]);+	MONT_MUL(v0, v1, v2, a[6], b[14]);+	MONT_MUL(w0, w1, w2, a[7], b[13]);+	MONT_MAC(t0, t1, t2, a[8], b[12]);+	MONT_MAC(v0, v1, v2, a[9], b[11]);+	MONT_MAC(w0, w1, w2, a[10], b[10]);+	MONT_MAC(t0, t1, t2, a[11], b[9]);+	MONT_MAC(v0, v1, v2, a[12], b[8]);+	MONT_MAC(w0, w1, w2, a[13], b[7]);+	MONT_MAC(t0, t1, t2, a[14], b[6]);+	MONT_MAC(v0, v1, v2, a[15], b[5]);+	MONT_MAC(w0, w1, w2, u[5], m[15]);+	MONT_MAC(t0, t1, t2, u[6], m[14]);+	MONT_MAC(v0, v1, v2, u[7], m[13]);+	MONT_MAC(w0, w1, w2, u[8], m[12]);+	MONT_MAC(t0, t1, t2, u[9], m[11]);+	MONT_MAC(v0, v1, v2, u[10], m[10]);+	MONT_MAC(w0, w1, w2, u[11], m[9]);+	MONT_MAC(t0, t1, t2, u[12], m[8]);+	MONT_MAC(v0, v1, v2, u[13], m[7]);+	MONT_MAC(w0, w1, w2, u[14], m[6]);+	MONT_MAC(t0, t1, t2, u[15], m[5]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	z[4] = t0;+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 21 */+	MONT_MAC(t0, t1, t2, a[6], b[15]);+	MONT_MUL(v0, v1, v2, a[7], b[14]);+	MONT_MUL(w0, w1, w2, a[8], b[13]);+	MONT_MAC(t0, t1, t2, a[9], b[12]);+	MONT_MAC(v0, v1, v2, a[10], b[11]);+	MONT_MAC(w0, w1, w2, a[11], b[10]);+	MONT_MAC(t0, t1, t2, a[12], b[9]);+	MONT_MAC(v0, v1, v2, a[13], b[8]);+	MONT_MAC(w0, w1, w2, a[14], b[7]);+	MONT_MAC(t0, t1, t2, a[15], b[6]);+	MONT_MAC(v0, v1, v2, u[6], m[15]);+	MONT_MAC(w0, w1, w2, u[7], m[14]);+	MONT_MAC(t0, t1, t2, u[8], m[13]);+	MONT_MAC(v0, v1, v2, u[9], m[12]);+	MONT_MAC(w0, w1, w2, u[10], m[11]);+	MONT_MAC(t0, t1, t2, u[11], m[10]);+	MONT_MAC(v0, v1, v2, u[12], m[9]);+	MONT_MAC(w0, w1, w2, u[13], m[8]);+	MONT_MAC(t0, t1, t2, u[14], m[7]);+	MONT_MAC(v0, v1, v2, u[15], m[6]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	z[5] = t0;+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 22 */+	MONT_MAC(t0, t1, t2, a[7], b[15]);+	MONT_MUL(v0, v1, v2, a[8], b[14]);+	MONT_MUL(w0, w1, w2, a[9], b[13]);+	MONT_MAC(t0, t1, t2, a[10], b[12]);+	MONT_MAC(v0, v1, v2, a[11], b[11]);+	MONT_MAC(w0, w1, w2, a[12], b[10]);+	MONT_MAC(t0, t1, t2, a[13], b[9]);+	MONT_MAC(v0, v1, v2, a[14], b[8]);+	MONT_MAC(w0, w1, w2, a[15], b[7]);+	MONT_MAC(t0, t1, t2, u[7], m[15]);+	MONT_MAC(v0, v1, v2, u[8], m[14]);+	MONT_MAC(w0, w1, w2, u[9], m[13]);+	MONT_MAC(t0, t1, t2, u[10], m[12]);+	MONT_MAC(v0, v1, v2, u[11], m[11]);+	MONT_MAC(w0, w1, w2, u[12], m[10]);+	MONT_MAC(t0, t1, t2, u[13], m[9]);+	MONT_MAC(v0, v1, v2, u[14], m[8]);+	MONT_MAC(w0, w1, w2, u[15], m[7]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	z[6] = t0;+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 23 */+	MONT_MAC(t0, t1, t2, a[8], b[15]);+	MONT_MUL(v0, v1, v2, a[9], b[14]);+	MONT_MUL(w0, w1, w2, a[10], b[13]);+	MONT_MAC(t0, t1, t2, a[11], b[12]);+	MONT_MAC(v0, v1, v2, a[12], b[11]);+	MONT_MAC(w0, w1, w2, a[13], b[10]);+	MONT_MAC(t0, t1, t2, a[14], b[9]);+	MONT_MAC(v0, v1, v2, a[15], b[8]);+	MONT_MAC(w0, w1, w2, u[8], m[15]);+	MONT_MAC(t0, t1, t2, u[9], m[14]);+	MONT_MAC(v0, v1, v2, u[10], m[13]);+	MONT_MAC(w0, w1, w2, u[11], m[12]);+	MONT_MAC(t0, t1, t2, u[12], m[11]);+	MONT_MAC(v0, v1, v2, u[13], m[10]);+	MONT_MAC(w0, w1, w2, u[14], m[9]);+	MONT_MAC(t0, t1, t2, u[15], m[8]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	z[7] = t0;+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 24 */+	MONT_MAC(t0, t1, t2, a[9], b[15]);+	MONT_MUL(v0, v1, v2, a[10], b[14]);+	MONT_MUL(w0, w1, w2, a[11], b[13]);+	MONT_MAC(t0, t1, t2, a[12], b[12]);+	MONT_MAC(v0, v1, v2, a[13], b[11]);+	MONT_MAC(w0, w1, w2, a[14], b[10]);+	MONT_MAC(t0, t1, t2, a[15], b[9]);+	MONT_MAC(v0, v1, v2, u[9], m[15]);+	MONT_MAC(w0, w1, w2, u[10], m[14]);+	MONT_MAC(t0, t1, t2, u[11], m[13]);+	MONT_MAC(v0, v1, v2, u[12], m[12]);+	MONT_MAC(w0, w1, w2, u[13], m[11]);+	MONT_MAC(t0, t1, t2, u[14], m[10]);+	MONT_MAC(v0, v1, v2, u[15], m[9]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	z[8] = t0;+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 25 */+	MONT_MAC(t0, t1, t2, a[10], b[15]);+	MONT_MUL(v0, v1, v2, a[11], b[14]);+	MONT_MUL(w0, w1, w2, a[12], b[13]);+	MONT_MAC(t0, t1, t2, a[13], b[12]);+	MONT_MAC(v0, v1, v2, a[14], b[11]);+	MONT_MAC(w0, w1, w2, a[15], b[10]);+	MONT_MAC(t0, t1, t2, u[10], m[15]);+	MONT_MAC(v0, v1, v2, u[11], m[14]);+	MONT_MAC(w0, w1, w2, u[12], m[13]);+	MONT_MAC(t0, t1, t2, u[13], m[12]);+	MONT_MAC(v0, v1, v2, u[14], m[11]);+	MONT_MAC(w0, w1, w2, u[15], m[10]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	z[9] = t0;+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 26 */+	MONT_MAC(t0, t1, t2, a[11], b[15]);+	MONT_MUL(v0, v1, v2, a[12], b[14]);+	MONT_MUL(w0, w1, w2, a[13], b[13]);+	MONT_MAC(t0, t1, t2, a[14], b[12]);+	MONT_MAC(v0, v1, v2, a[15], b[11]);+	MONT_MAC(w0, w1, w2, u[11], m[15]);+	MONT_MAC(t0, t1, t2, u[12], m[14]);+	MONT_MAC(v0, v1, v2, u[13], m[13]);+	MONT_MAC(w0, w1, w2, u[14], m[12]);+	MONT_MAC(t0, t1, t2, u[15], m[11]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	z[10] = t0;+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 27 */+	MONT_MAC(t0, t1, t2, a[12], b[15]);+	MONT_MUL(v0, v1, v2, a[13], b[14]);+	MONT_MUL(w0, w1, w2, a[14], b[13]);+	MONT_MAC(t0, t1, t2, a[15], b[12]);+	MONT_MAC(v0, v1, v2, u[12], m[15]);+	MONT_MAC(w0, w1, w2, u[13], m[14]);+	MONT_MAC(t0, t1, t2, u[14], m[13]);+	MONT_MAC(v0, v1, v2, u[15], m[12]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	z[11] = t0;+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 28 */+	MONT_MAC(t0, t1, t2, a[13], b[15]);+	MONT_MUL(v0, v1, v2, a[14], b[14]);+	MONT_MUL(w0, w1, w2, a[15], b[13]);+	MONT_MAC(t0, t1, t2, u[13], m[15]);+	MONT_MAC(v0, v1, v2, u[14], m[14]);+	MONT_MAC(w0, w1, w2, u[15], m[13]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	z[12] = t0;+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 29 */+	MONT_MAC(t0, t1, t2, a[14], b[15]);+	MONT_MUL(v0, v1, v2, a[15], b[14]);+	MONT_MUL(w0, w1, w2, u[14], m[15]);+	MONT_MAC(t0, t1, t2, u[15], m[14]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	z[13] = t0;+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 30 */+	MONT_MAC(t0, t1, t2, a[15], b[15]);+	MONT_MUL(v0, v1, v2, u[15], m[15]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	z[14] = t0;+	t0 = t1;+	t1 = t2;+	t2 = 0;+	z[15] = t0;++	/* under 2m, with t1 the bit above n limbs: at most one subtraction */+	borrow = sub_n(r, z, m, 16);+	take = t1 | (borrow ^ 1);+	select_n(r, r, z, take & 1, 16);+}++/* r = a * a * R^-1 mod m, for a under m; t is 2n limbs of scratch */+static void crypton_mont_sqr16(limb_t *r, const limb_t *a,+                               const limb_t *m, limb_t n0, limb_t *t)+{+	limb_t *u = t, *z = t + 16;+	limb_t t0 = 0, t1 = 0, t2 = 0, v0, v1, v2, w0, w1, w2, borrow, take;+	limb_t s0, s1, s2, c0, c1, c2;++	/* column 0 */+	MONT_MAC(t0, t1, t2, a[0], a[0]);+	u[0] = t0 * n0;+	MONT_MAC(t0, t1, t2, u[0], m[0]);+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 1 */+	MONT_MUL(s0, s1, s2, a[0], a[1]);+	MONT_MAC(t0, t1, t2, u[0], m[1]);+	MONT_DBL(s0, s1, s2);+	MONT_ADD(t0, t1, t2, s0, s1, s2);+	u[1] = t0 * n0;+	MONT_MAC(t0, t1, t2, u[1], m[0]);+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 2 */+	MONT_MUL(s0, s1, s2, a[0], a[2]);+	MONT_MAC(t0, t1, t2, a[1], a[1]);+	MONT_MUL(v0, v1, v2, u[0], m[2]);+	MONT_MUL(w0, w1, w2, u[1], m[1]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	MONT_DBL(s0, s1, s2);+	MONT_ADD(t0, t1, t2, s0, s1, s2);+	u[2] = t0 * n0;+	MONT_MAC(t0, t1, t2, u[2], m[0]);+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 3 */+	MONT_MUL(s0, s1, s2, a[0], a[3]);+	MONT_MUL(c0, c1, c2, a[1], a[2]);+	MONT_MAC(t0, t1, t2, u[0], m[3]);+	MONT_MUL(v0, v1, v2, u[1], m[2]);+	MONT_MUL(w0, w1, w2, u[2], m[1]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	MONT_ADD(s0, s1, s2, c0, c1, c2);+	MONT_DBL(s0, s1, s2);+	MONT_ADD(t0, t1, t2, s0, s1, s2);+	u[3] = t0 * n0;+	MONT_MAC(t0, t1, t2, u[3], m[0]);+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 4 */+	MONT_MUL(s0, s1, s2, a[0], a[4]);+	MONT_MUL(c0, c1, c2, a[1], a[3]);+	MONT_MAC(t0, t1, t2, a[2], a[2]);+	MONT_MUL(v0, v1, v2, u[0], m[4]);+	MONT_MUL(w0, w1, w2, u[1], m[3]);+	MONT_MAC(t0, t1, t2, u[2], m[2]);+	MONT_MAC(v0, v1, v2, u[3], m[1]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	MONT_ADD(s0, s1, s2, c0, c1, c2);+	MONT_DBL(s0, s1, s2);+	MONT_ADD(t0, t1, t2, s0, s1, s2);+	u[4] = t0 * n0;+	MONT_MAC(t0, t1, t2, u[4], m[0]);+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 5 */+	MONT_MUL(s0, s1, s2, a[0], a[5]);+	MONT_MUL(c0, c1, c2, a[1], a[4]);+	MONT_MAC(s0, s1, s2, a[2], a[3]);+	MONT_MAC(t0, t1, t2, u[0], m[5]);+	MONT_MUL(v0, v1, v2, u[1], m[4]);+	MONT_MUL(w0, w1, w2, u[2], m[3]);+	MONT_MAC(t0, t1, t2, u[3], m[2]);+	MONT_MAC(v0, v1, v2, u[4], m[1]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	MONT_ADD(s0, s1, s2, c0, c1, c2);+	MONT_DBL(s0, s1, s2);+	MONT_ADD(t0, t1, t2, s0, s1, s2);+	u[5] = t0 * n0;+	MONT_MAC(t0, t1, t2, u[5], m[0]);+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 6 */+	MONT_MUL(s0, s1, s2, a[0], a[6]);+	MONT_MUL(c0, c1, c2, a[1], a[5]);+	MONT_MAC(s0, s1, s2, a[2], a[4]);+	MONT_MAC(t0, t1, t2, a[3], a[3]);+	MONT_MUL(v0, v1, v2, u[0], m[6]);+	MONT_MUL(w0, w1, w2, u[1], m[5]);+	MONT_MAC(t0, t1, t2, u[2], m[4]);+	MONT_MAC(v0, v1, v2, u[3], m[3]);+	MONT_MAC(w0, w1, w2, u[4], m[2]);+	MONT_MAC(t0, t1, t2, u[5], m[1]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	MONT_ADD(s0, s1, s2, c0, c1, c2);+	MONT_DBL(s0, s1, s2);+	MONT_ADD(t0, t1, t2, s0, s1, s2);+	u[6] = t0 * n0;+	MONT_MAC(t0, t1, t2, u[6], m[0]);+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 7 */+	MONT_MUL(s0, s1, s2, a[0], a[7]);+	MONT_MUL(c0, c1, c2, a[1], a[6]);+	MONT_MAC(s0, s1, s2, a[2], a[5]);+	MONT_MAC(c0, c1, c2, a[3], a[4]);+	MONT_MAC(t0, t1, t2, u[0], m[7]);+	MONT_MUL(v0, v1, v2, u[1], m[6]);+	MONT_MUL(w0, w1, w2, u[2], m[5]);+	MONT_MAC(t0, t1, t2, u[3], m[4]);+	MONT_MAC(v0, v1, v2, u[4], m[3]);+	MONT_MAC(w0, w1, w2, u[5], m[2]);+	MONT_MAC(t0, t1, t2, u[6], m[1]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	MONT_ADD(s0, s1, s2, c0, c1, c2);+	MONT_DBL(s0, s1, s2);+	MONT_ADD(t0, t1, t2, s0, s1, s2);+	u[7] = t0 * n0;+	MONT_MAC(t0, t1, t2, u[7], m[0]);+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 8 */+	MONT_MUL(s0, s1, s2, a[0], a[8]);+	MONT_MUL(c0, c1, c2, a[1], a[7]);+	MONT_MAC(s0, s1, s2, a[2], a[6]);+	MONT_MAC(c0, c1, c2, a[3], a[5]);+	MONT_MAC(t0, t1, t2, a[4], a[4]);+	MONT_MUL(v0, v1, v2, u[0], m[8]);+	MONT_MUL(w0, w1, w2, u[1], m[7]);+	MONT_MAC(t0, t1, t2, u[2], m[6]);+	MONT_MAC(v0, v1, v2, u[3], m[5]);+	MONT_MAC(w0, w1, w2, u[4], m[4]);+	MONT_MAC(t0, t1, t2, u[5], m[3]);+	MONT_MAC(v0, v1, v2, u[6], m[2]);+	MONT_MAC(w0, w1, w2, u[7], m[1]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	MONT_ADD(s0, s1, s2, c0, c1, c2);+	MONT_DBL(s0, s1, s2);+	MONT_ADD(t0, t1, t2, s0, s1, s2);+	u[8] = t0 * n0;+	MONT_MAC(t0, t1, t2, u[8], m[0]);+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 9 */+	MONT_MUL(s0, s1, s2, a[0], a[9]);+	MONT_MUL(c0, c1, c2, a[1], a[8]);+	MONT_MAC(s0, s1, s2, a[2], a[7]);+	MONT_MAC(c0, c1, c2, a[3], a[6]);+	MONT_MAC(s0, s1, s2, a[4], a[5]);+	MONT_MAC(t0, t1, t2, u[0], m[9]);+	MONT_MUL(v0, v1, v2, u[1], m[8]);+	MONT_MUL(w0, w1, w2, u[2], m[7]);+	MONT_MAC(t0, t1, t2, u[3], m[6]);+	MONT_MAC(v0, v1, v2, u[4], m[5]);+	MONT_MAC(w0, w1, w2, u[5], m[4]);+	MONT_MAC(t0, t1, t2, u[6], m[3]);+	MONT_MAC(v0, v1, v2, u[7], m[2]);+	MONT_MAC(w0, w1, w2, u[8], m[1]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	MONT_ADD(s0, s1, s2, c0, c1, c2);+	MONT_DBL(s0, s1, s2);+	MONT_ADD(t0, t1, t2, s0, s1, s2);+	u[9] = t0 * n0;+	MONT_MAC(t0, t1, t2, u[9], m[0]);+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 10 */+	MONT_MUL(s0, s1, s2, a[0], a[10]);+	MONT_MUL(c0, c1, c2, a[1], a[9]);+	MONT_MAC(s0, s1, s2, a[2], a[8]);+	MONT_MAC(c0, c1, c2, a[3], a[7]);+	MONT_MAC(s0, s1, s2, a[4], a[6]);+	MONT_MAC(t0, t1, t2, a[5], a[5]);+	MONT_MUL(v0, v1, v2, u[0], m[10]);+	MONT_MUL(w0, w1, w2, u[1], m[9]);+	MONT_MAC(t0, t1, t2, u[2], m[8]);+	MONT_MAC(v0, v1, v2, u[3], m[7]);+	MONT_MAC(w0, w1, w2, u[4], m[6]);+	MONT_MAC(t0, t1, t2, u[5], m[5]);+	MONT_MAC(v0, v1, v2, u[6], m[4]);+	MONT_MAC(w0, w1, w2, u[7], m[3]);+	MONT_MAC(t0, t1, t2, u[8], m[2]);+	MONT_MAC(v0, v1, v2, u[9], m[1]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	MONT_ADD(s0, s1, s2, c0, c1, c2);+	MONT_DBL(s0, s1, s2);+	MONT_ADD(t0, t1, t2, s0, s1, s2);+	u[10] = t0 * n0;+	MONT_MAC(t0, t1, t2, u[10], m[0]);+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 11 */+	MONT_MUL(s0, s1, s2, a[0], a[11]);+	MONT_MUL(c0, c1, c2, a[1], a[10]);+	MONT_MAC(s0, s1, s2, a[2], a[9]);+	MONT_MAC(c0, c1, c2, a[3], a[8]);+	MONT_MAC(s0, s1, s2, a[4], a[7]);+	MONT_MAC(c0, c1, c2, a[5], a[6]);+	MONT_MAC(t0, t1, t2, u[0], m[11]);+	MONT_MUL(v0, v1, v2, u[1], m[10]);+	MONT_MUL(w0, w1, w2, u[2], m[9]);+	MONT_MAC(t0, t1, t2, u[3], m[8]);+	MONT_MAC(v0, v1, v2, u[4], m[7]);+	MONT_MAC(w0, w1, w2, u[5], m[6]);+	MONT_MAC(t0, t1, t2, u[6], m[5]);+	MONT_MAC(v0, v1, v2, u[7], m[4]);+	MONT_MAC(w0, w1, w2, u[8], m[3]);+	MONT_MAC(t0, t1, t2, u[9], m[2]);+	MONT_MAC(v0, v1, v2, u[10], m[1]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	MONT_ADD(s0, s1, s2, c0, c1, c2);+	MONT_DBL(s0, s1, s2);+	MONT_ADD(t0, t1, t2, s0, s1, s2);+	u[11] = t0 * n0;+	MONT_MAC(t0, t1, t2, u[11], m[0]);+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 12 */+	MONT_MUL(s0, s1, s2, a[0], a[12]);+	MONT_MUL(c0, c1, c2, a[1], a[11]);+	MONT_MAC(s0, s1, s2, a[2], a[10]);+	MONT_MAC(c0, c1, c2, a[3], a[9]);+	MONT_MAC(s0, s1, s2, a[4], a[8]);+	MONT_MAC(c0, c1, c2, a[5], a[7]);+	MONT_MAC(t0, t1, t2, a[6], a[6]);+	MONT_MUL(v0, v1, v2, u[0], m[12]);+	MONT_MUL(w0, w1, w2, u[1], m[11]);+	MONT_MAC(t0, t1, t2, u[2], m[10]);+	MONT_MAC(v0, v1, v2, u[3], m[9]);+	MONT_MAC(w0, w1, w2, u[4], m[8]);+	MONT_MAC(t0, t1, t2, u[5], m[7]);+	MONT_MAC(v0, v1, v2, u[6], m[6]);+	MONT_MAC(w0, w1, w2, u[7], m[5]);+	MONT_MAC(t0, t1, t2, u[8], m[4]);+	MONT_MAC(v0, v1, v2, u[9], m[3]);+	MONT_MAC(w0, w1, w2, u[10], m[2]);+	MONT_MAC(t0, t1, t2, u[11], m[1]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	MONT_ADD(s0, s1, s2, c0, c1, c2);+	MONT_DBL(s0, s1, s2);+	MONT_ADD(t0, t1, t2, s0, s1, s2);+	u[12] = t0 * n0;+	MONT_MAC(t0, t1, t2, u[12], m[0]);+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 13 */+	MONT_MUL(s0, s1, s2, a[0], a[13]);+	MONT_MUL(c0, c1, c2, a[1], a[12]);+	MONT_MAC(s0, s1, s2, a[2], a[11]);+	MONT_MAC(c0, c1, c2, a[3], a[10]);+	MONT_MAC(s0, s1, s2, a[4], a[9]);+	MONT_MAC(c0, c1, c2, a[5], a[8]);+	MONT_MAC(s0, s1, s2, a[6], a[7]);+	MONT_MAC(t0, t1, t2, u[0], m[13]);+	MONT_MUL(v0, v1, v2, u[1], m[12]);+	MONT_MUL(w0, w1, w2, u[2], m[11]);+	MONT_MAC(t0, t1, t2, u[3], m[10]);+	MONT_MAC(v0, v1, v2, u[4], m[9]);+	MONT_MAC(w0, w1, w2, u[5], m[8]);+	MONT_MAC(t0, t1, t2, u[6], m[7]);+	MONT_MAC(v0, v1, v2, u[7], m[6]);+	MONT_MAC(w0, w1, w2, u[8], m[5]);+	MONT_MAC(t0, t1, t2, u[9], m[4]);+	MONT_MAC(v0, v1, v2, u[10], m[3]);+	MONT_MAC(w0, w1, w2, u[11], m[2]);+	MONT_MAC(t0, t1, t2, u[12], m[1]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	MONT_ADD(s0, s1, s2, c0, c1, c2);+	MONT_DBL(s0, s1, s2);+	MONT_ADD(t0, t1, t2, s0, s1, s2);+	u[13] = t0 * n0;+	MONT_MAC(t0, t1, t2, u[13], m[0]);+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 14 */+	MONT_MUL(s0, s1, s2, a[0], a[14]);+	MONT_MUL(c0, c1, c2, a[1], a[13]);+	MONT_MAC(s0, s1, s2, a[2], a[12]);+	MONT_MAC(c0, c1, c2, a[3], a[11]);+	MONT_MAC(s0, s1, s2, a[4], a[10]);+	MONT_MAC(c0, c1, c2, a[5], a[9]);+	MONT_MAC(s0, s1, s2, a[6], a[8]);+	MONT_MAC(t0, t1, t2, a[7], a[7]);+	MONT_MUL(v0, v1, v2, u[0], m[14]);+	MONT_MUL(w0, w1, w2, u[1], m[13]);+	MONT_MAC(t0, t1, t2, u[2], m[12]);+	MONT_MAC(v0, v1, v2, u[3], m[11]);+	MONT_MAC(w0, w1, w2, u[4], m[10]);+	MONT_MAC(t0, t1, t2, u[5], m[9]);+	MONT_MAC(v0, v1, v2, u[6], m[8]);+	MONT_MAC(w0, w1, w2, u[7], m[7]);+	MONT_MAC(t0, t1, t2, u[8], m[6]);+	MONT_MAC(v0, v1, v2, u[9], m[5]);+	MONT_MAC(w0, w1, w2, u[10], m[4]);+	MONT_MAC(t0, t1, t2, u[11], m[3]);+	MONT_MAC(v0, v1, v2, u[12], m[2]);+	MONT_MAC(w0, w1, w2, u[13], m[1]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	MONT_ADD(s0, s1, s2, c0, c1, c2);+	MONT_DBL(s0, s1, s2);+	MONT_ADD(t0, t1, t2, s0, s1, s2);+	u[14] = t0 * n0;+	MONT_MAC(t0, t1, t2, u[14], m[0]);+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 15 */+	MONT_MUL(s0, s1, s2, a[0], a[15]);+	MONT_MUL(c0, c1, c2, a[1], a[14]);+	MONT_MAC(s0, s1, s2, a[2], a[13]);+	MONT_MAC(c0, c1, c2, a[3], a[12]);+	MONT_MAC(s0, s1, s2, a[4], a[11]);+	MONT_MAC(c0, c1, c2, a[5], a[10]);+	MONT_MAC(s0, s1, s2, a[6], a[9]);+	MONT_MAC(c0, c1, c2, a[7], a[8]);+	MONT_MAC(t0, t1, t2, u[0], m[15]);+	MONT_MUL(v0, v1, v2, u[1], m[14]);+	MONT_MUL(w0, w1, w2, u[2], m[13]);+	MONT_MAC(t0, t1, t2, u[3], m[12]);+	MONT_MAC(v0, v1, v2, u[4], m[11]);+	MONT_MAC(w0, w1, w2, u[5], m[10]);+	MONT_MAC(t0, t1, t2, u[6], m[9]);+	MONT_MAC(v0, v1, v2, u[7], m[8]);+	MONT_MAC(w0, w1, w2, u[8], m[7]);+	MONT_MAC(t0, t1, t2, u[9], m[6]);+	MONT_MAC(v0, v1, v2, u[10], m[5]);+	MONT_MAC(w0, w1, w2, u[11], m[4]);+	MONT_MAC(t0, t1, t2, u[12], m[3]);+	MONT_MAC(v0, v1, v2, u[13], m[2]);+	MONT_MAC(w0, w1, w2, u[14], m[1]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	MONT_ADD(s0, s1, s2, c0, c1, c2);+	MONT_DBL(s0, s1, s2);+	MONT_ADD(t0, t1, t2, s0, s1, s2);+	u[15] = t0 * n0;+	MONT_MAC(t0, t1, t2, u[15], m[0]);+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 16 */+	MONT_MUL(s0, s1, s2, a[1], a[15]);+	MONT_MUL(c0, c1, c2, a[2], a[14]);+	MONT_MAC(s0, s1, s2, a[3], a[13]);+	MONT_MAC(c0, c1, c2, a[4], a[12]);+	MONT_MAC(s0, s1, s2, a[5], a[11]);+	MONT_MAC(c0, c1, c2, a[6], a[10]);+	MONT_MAC(s0, s1, s2, a[7], a[9]);+	MONT_MAC(t0, t1, t2, a[8], a[8]);+	MONT_MUL(v0, v1, v2, u[1], m[15]);+	MONT_MUL(w0, w1, w2, u[2], m[14]);+	MONT_MAC(t0, t1, t2, u[3], m[13]);+	MONT_MAC(v0, v1, v2, u[4], m[12]);+	MONT_MAC(w0, w1, w2, u[5], m[11]);+	MONT_MAC(t0, t1, t2, u[6], m[10]);+	MONT_MAC(v0, v1, v2, u[7], m[9]);+	MONT_MAC(w0, w1, w2, u[8], m[8]);+	MONT_MAC(t0, t1, t2, u[9], m[7]);+	MONT_MAC(v0, v1, v2, u[10], m[6]);+	MONT_MAC(w0, w1, w2, u[11], m[5]);+	MONT_MAC(t0, t1, t2, u[12], m[4]);+	MONT_MAC(v0, v1, v2, u[13], m[3]);+	MONT_MAC(w0, w1, w2, u[14], m[2]);+	MONT_MAC(t0, t1, t2, u[15], m[1]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	MONT_ADD(s0, s1, s2, c0, c1, c2);+	MONT_DBL(s0, s1, s2);+	MONT_ADD(t0, t1, t2, s0, s1, s2);+	z[0] = t0;+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 17 */+	MONT_MUL(s0, s1, s2, a[2], a[15]);+	MONT_MUL(c0, c1, c2, a[3], a[14]);+	MONT_MAC(s0, s1, s2, a[4], a[13]);+	MONT_MAC(c0, c1, c2, a[5], a[12]);+	MONT_MAC(s0, s1, s2, a[6], a[11]);+	MONT_MAC(c0, c1, c2, a[7], a[10]);+	MONT_MAC(s0, s1, s2, a[8], a[9]);+	MONT_MAC(t0, t1, t2, u[2], m[15]);+	MONT_MUL(v0, v1, v2, u[3], m[14]);+	MONT_MUL(w0, w1, w2, u[4], m[13]);+	MONT_MAC(t0, t1, t2, u[5], m[12]);+	MONT_MAC(v0, v1, v2, u[6], m[11]);+	MONT_MAC(w0, w1, w2, u[7], m[10]);+	MONT_MAC(t0, t1, t2, u[8], m[9]);+	MONT_MAC(v0, v1, v2, u[9], m[8]);+	MONT_MAC(w0, w1, w2, u[10], m[7]);+	MONT_MAC(t0, t1, t2, u[11], m[6]);+	MONT_MAC(v0, v1, v2, u[12], m[5]);+	MONT_MAC(w0, w1, w2, u[13], m[4]);+	MONT_MAC(t0, t1, t2, u[14], m[3]);+	MONT_MAC(v0, v1, v2, u[15], m[2]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	MONT_ADD(s0, s1, s2, c0, c1, c2);+	MONT_DBL(s0, s1, s2);+	MONT_ADD(t0, t1, t2, s0, s1, s2);+	z[1] = t0;+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 18 */+	MONT_MUL(s0, s1, s2, a[3], a[15]);+	MONT_MUL(c0, c1, c2, a[4], a[14]);+	MONT_MAC(s0, s1, s2, a[5], a[13]);+	MONT_MAC(c0, c1, c2, a[6], a[12]);+	MONT_MAC(s0, s1, s2, a[7], a[11]);+	MONT_MAC(c0, c1, c2, a[8], a[10]);+	MONT_MAC(t0, t1, t2, a[9], a[9]);+	MONT_MUL(v0, v1, v2, u[3], m[15]);+	MONT_MUL(w0, w1, w2, u[4], m[14]);+	MONT_MAC(t0, t1, t2, u[5], m[13]);+	MONT_MAC(v0, v1, v2, u[6], m[12]);+	MONT_MAC(w0, w1, w2, u[7], m[11]);+	MONT_MAC(t0, t1, t2, u[8], m[10]);+	MONT_MAC(v0, v1, v2, u[9], m[9]);+	MONT_MAC(w0, w1, w2, u[10], m[8]);+	MONT_MAC(t0, t1, t2, u[11], m[7]);+	MONT_MAC(v0, v1, v2, u[12], m[6]);+	MONT_MAC(w0, w1, w2, u[13], m[5]);+	MONT_MAC(t0, t1, t2, u[14], m[4]);+	MONT_MAC(v0, v1, v2, u[15], m[3]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	MONT_ADD(s0, s1, s2, c0, c1, c2);+	MONT_DBL(s0, s1, s2);+	MONT_ADD(t0, t1, t2, s0, s1, s2);+	z[2] = t0;+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 19 */+	MONT_MUL(s0, s1, s2, a[4], a[15]);+	MONT_MUL(c0, c1, c2, a[5], a[14]);+	MONT_MAC(s0, s1, s2, a[6], a[13]);+	MONT_MAC(c0, c1, c2, a[7], a[12]);+	MONT_MAC(s0, s1, s2, a[8], a[11]);+	MONT_MAC(c0, c1, c2, a[9], a[10]);+	MONT_MAC(t0, t1, t2, u[4], m[15]);+	MONT_MUL(v0, v1, v2, u[5], m[14]);+	MONT_MUL(w0, w1, w2, u[6], m[13]);+	MONT_MAC(t0, t1, t2, u[7], m[12]);+	MONT_MAC(v0, v1, v2, u[8], m[11]);+	MONT_MAC(w0, w1, w2, u[9], m[10]);+	MONT_MAC(t0, t1, t2, u[10], m[9]);+	MONT_MAC(v0, v1, v2, u[11], m[8]);+	MONT_MAC(w0, w1, w2, u[12], m[7]);+	MONT_MAC(t0, t1, t2, u[13], m[6]);+	MONT_MAC(v0, v1, v2, u[14], m[5]);+	MONT_MAC(w0, w1, w2, u[15], m[4]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	MONT_ADD(s0, s1, s2, c0, c1, c2);+	MONT_DBL(s0, s1, s2);+	MONT_ADD(t0, t1, t2, s0, s1, s2);+	z[3] = t0;+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 20 */+	MONT_MUL(s0, s1, s2, a[5], a[15]);+	MONT_MUL(c0, c1, c2, a[6], a[14]);+	MONT_MAC(s0, s1, s2, a[7], a[13]);+	MONT_MAC(c0, c1, c2, a[8], a[12]);+	MONT_MAC(s0, s1, s2, a[9], a[11]);+	MONT_MAC(t0, t1, t2, a[10], a[10]);+	MONT_MUL(v0, v1, v2, u[5], m[15]);+	MONT_MUL(w0, w1, w2, u[6], m[14]);+	MONT_MAC(t0, t1, t2, u[7], m[13]);+	MONT_MAC(v0, v1, v2, u[8], m[12]);+	MONT_MAC(w0, w1, w2, u[9], m[11]);+	MONT_MAC(t0, t1, t2, u[10], m[10]);+	MONT_MAC(v0, v1, v2, u[11], m[9]);+	MONT_MAC(w0, w1, w2, u[12], m[8]);+	MONT_MAC(t0, t1, t2, u[13], m[7]);+	MONT_MAC(v0, v1, v2, u[14], m[6]);+	MONT_MAC(w0, w1, w2, u[15], m[5]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	MONT_ADD(s0, s1, s2, c0, c1, c2);+	MONT_DBL(s0, s1, s2);+	MONT_ADD(t0, t1, t2, s0, s1, s2);+	z[4] = t0;+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 21 */+	MONT_MUL(s0, s1, s2, a[6], a[15]);+	MONT_MUL(c0, c1, c2, a[7], a[14]);+	MONT_MAC(s0, s1, s2, a[8], a[13]);+	MONT_MAC(c0, c1, c2, a[9], a[12]);+	MONT_MAC(s0, s1, s2, a[10], a[11]);+	MONT_MAC(t0, t1, t2, u[6], m[15]);+	MONT_MUL(v0, v1, v2, u[7], m[14]);+	MONT_MUL(w0, w1, w2, u[8], m[13]);+	MONT_MAC(t0, t1, t2, u[9], m[12]);+	MONT_MAC(v0, v1, v2, u[10], m[11]);+	MONT_MAC(w0, w1, w2, u[11], m[10]);+	MONT_MAC(t0, t1, t2, u[12], m[9]);+	MONT_MAC(v0, v1, v2, u[13], m[8]);+	MONT_MAC(w0, w1, w2, u[14], m[7]);+	MONT_MAC(t0, t1, t2, u[15], m[6]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	MONT_ADD(s0, s1, s2, c0, c1, c2);+	MONT_DBL(s0, s1, s2);+	MONT_ADD(t0, t1, t2, s0, s1, s2);+	z[5] = t0;+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 22 */+	MONT_MUL(s0, s1, s2, a[7], a[15]);+	MONT_MUL(c0, c1, c2, a[8], a[14]);+	MONT_MAC(s0, s1, s2, a[9], a[13]);+	MONT_MAC(c0, c1, c2, a[10], a[12]);+	MONT_MAC(t0, t1, t2, a[11], a[11]);+	MONT_MUL(v0, v1, v2, u[7], m[15]);+	MONT_MUL(w0, w1, w2, u[8], m[14]);+	MONT_MAC(t0, t1, t2, u[9], m[13]);+	MONT_MAC(v0, v1, v2, u[10], m[12]);+	MONT_MAC(w0, w1, w2, u[11], m[11]);+	MONT_MAC(t0, t1, t2, u[12], m[10]);+	MONT_MAC(v0, v1, v2, u[13], m[9]);+	MONT_MAC(w0, w1, w2, u[14], m[8]);+	MONT_MAC(t0, t1, t2, u[15], m[7]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	MONT_ADD(s0, s1, s2, c0, c1, c2);+	MONT_DBL(s0, s1, s2);+	MONT_ADD(t0, t1, t2, s0, s1, s2);+	z[6] = t0;+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 23 */+	MONT_MUL(s0, s1, s2, a[8], a[15]);+	MONT_MUL(c0, c1, c2, a[9], a[14]);+	MONT_MAC(s0, s1, s2, a[10], a[13]);+	MONT_MAC(c0, c1, c2, a[11], a[12]);+	MONT_MAC(t0, t1, t2, u[8], m[15]);+	MONT_MUL(v0, v1, v2, u[9], m[14]);+	MONT_MUL(w0, w1, w2, u[10], m[13]);+	MONT_MAC(t0, t1, t2, u[11], m[12]);+	MONT_MAC(v0, v1, v2, u[12], m[11]);+	MONT_MAC(w0, w1, w2, u[13], m[10]);+	MONT_MAC(t0, t1, t2, u[14], m[9]);+	MONT_MAC(v0, v1, v2, u[15], m[8]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	MONT_ADD(s0, s1, s2, c0, c1, c2);+	MONT_DBL(s0, s1, s2);+	MONT_ADD(t0, t1, t2, s0, s1, s2);+	z[7] = t0;+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 24 */+	MONT_MUL(s0, s1, s2, a[9], a[15]);+	MONT_MUL(c0, c1, c2, a[10], a[14]);+	MONT_MAC(s0, s1, s2, a[11], a[13]);+	MONT_MAC(t0, t1, t2, a[12], a[12]);+	MONT_MUL(v0, v1, v2, u[9], m[15]);+	MONT_MUL(w0, w1, w2, u[10], m[14]);+	MONT_MAC(t0, t1, t2, u[11], m[13]);+	MONT_MAC(v0, v1, v2, u[12], m[12]);+	MONT_MAC(w0, w1, w2, u[13], m[11]);+	MONT_MAC(t0, t1, t2, u[14], m[10]);+	MONT_MAC(v0, v1, v2, u[15], m[9]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	MONT_ADD(s0, s1, s2, c0, c1, c2);+	MONT_DBL(s0, s1, s2);+	MONT_ADD(t0, t1, t2, s0, s1, s2);+	z[8] = t0;+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 25 */+	MONT_MUL(s0, s1, s2, a[10], a[15]);+	MONT_MUL(c0, c1, c2, a[11], a[14]);+	MONT_MAC(s0, s1, s2, a[12], a[13]);+	MONT_MAC(t0, t1, t2, u[10], m[15]);+	MONT_MUL(v0, v1, v2, u[11], m[14]);+	MONT_MUL(w0, w1, w2, u[12], m[13]);+	MONT_MAC(t0, t1, t2, u[13], m[12]);+	MONT_MAC(v0, v1, v2, u[14], m[11]);+	MONT_MAC(w0, w1, w2, u[15], m[10]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	MONT_ADD(s0, s1, s2, c0, c1, c2);+	MONT_DBL(s0, s1, s2);+	MONT_ADD(t0, t1, t2, s0, s1, s2);+	z[9] = t0;+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 26 */+	MONT_MUL(s0, s1, s2, a[11], a[15]);+	MONT_MUL(c0, c1, c2, a[12], a[14]);+	MONT_MAC(t0, t1, t2, a[13], a[13]);+	MONT_MUL(v0, v1, v2, u[11], m[15]);+	MONT_MUL(w0, w1, w2, u[12], m[14]);+	MONT_MAC(t0, t1, t2, u[13], m[13]);+	MONT_MAC(v0, v1, v2, u[14], m[12]);+	MONT_MAC(w0, w1, w2, u[15], m[11]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	MONT_ADD(s0, s1, s2, c0, c1, c2);+	MONT_DBL(s0, s1, s2);+	MONT_ADD(t0, t1, t2, s0, s1, s2);+	z[10] = t0;+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 27 */+	MONT_MUL(s0, s1, s2, a[12], a[15]);+	MONT_MUL(c0, c1, c2, a[13], a[14]);+	MONT_MAC(t0, t1, t2, u[12], m[15]);+	MONT_MUL(v0, v1, v2, u[13], m[14]);+	MONT_MUL(w0, w1, w2, u[14], m[13]);+	MONT_MAC(t0, t1, t2, u[15], m[12]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	MONT_ADD(s0, s1, s2, c0, c1, c2);+	MONT_DBL(s0, s1, s2);+	MONT_ADD(t0, t1, t2, s0, s1, s2);+	z[11] = t0;+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 28 */+	MONT_MUL(s0, s1, s2, a[13], a[15]);+	MONT_MAC(t0, t1, t2, a[14], a[14]);+	MONT_MUL(v0, v1, v2, u[13], m[15]);+	MONT_MUL(w0, w1, w2, u[14], m[14]);+	MONT_MAC(t0, t1, t2, u[15], m[13]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	MONT_DBL(s0, s1, s2);+	MONT_ADD(t0, t1, t2, s0, s1, s2);+	z[12] = t0;+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 29 */+	MONT_MUL(s0, s1, s2, a[14], a[15]);+	MONT_MAC(t0, t1, t2, u[14], m[15]);+	MONT_MUL(v0, v1, v2, u[15], m[14]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_DBL(s0, s1, s2);+	MONT_ADD(t0, t1, t2, s0, s1, s2);+	z[13] = t0;+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 30 */+	MONT_MAC(t0, t1, t2, a[15], a[15]);+	MONT_MUL(v0, v1, v2, u[15], m[15]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	z[14] = t0;+	t0 = t1;+	t1 = t2;+	t2 = 0;+	z[15] = t0;++	/* under 2m, with t1 the bit above n limbs: at most one subtraction */+	borrow = sub_n(r, z, m, 16);+	take = t1 | (borrow ^ 1);+	select_n(r, r, z, take & 1, 16);+}++/* r = a * b * R^-1 mod m, for a and b under m; t is 2n limbs of scratch */+static void crypton_mont_mul24(limb_t *r, const limb_t *a, const limb_t *b,+                               const limb_t *m, limb_t n0, limb_t *t)+{+	limb_t *u = t, *z = t + 24;+	limb_t t0 = 0, t1 = 0, t2 = 0, v0, v1, v2, w0, w1, w2, borrow, take;++	/* column 0 */+	MONT_MAC(t0, t1, t2, a[0], b[0]);+	u[0] = t0 * n0;+	MONT_MAC(t0, t1, t2, u[0], m[0]);+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 1 */+	MONT_MAC(t0, t1, t2, a[0], b[1]);+	MONT_MUL(v0, v1, v2, a[1], b[0]);+	MONT_MUL(w0, w1, w2, u[0], m[1]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	u[1] = t0 * n0;+	MONT_MAC(t0, t1, t2, u[1], m[0]);+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 2 */+	MONT_MAC(t0, t1, t2, a[0], b[2]);+	MONT_MUL(v0, v1, v2, a[1], b[1]);+	MONT_MUL(w0, w1, w2, a[2], b[0]);+	MONT_MAC(t0, t1, t2, u[0], m[2]);+	MONT_MAC(v0, v1, v2, u[1], m[1]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	u[2] = t0 * n0;+	MONT_MAC(t0, t1, t2, u[2], m[0]);+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 3 */+	MONT_MAC(t0, t1, t2, a[0], b[3]);+	MONT_MUL(v0, v1, v2, a[1], b[2]);+	MONT_MUL(w0, w1, w2, a[2], b[1]);+	MONT_MAC(t0, t1, t2, a[3], b[0]);+	MONT_MAC(v0, v1, v2, u[0], m[3]);+	MONT_MAC(w0, w1, w2, u[1], m[2]);+	MONT_MAC(t0, t1, t2, u[2], m[1]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	u[3] = t0 * n0;+	MONT_MAC(t0, t1, t2, u[3], m[0]);+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 4 */+	MONT_MAC(t0, t1, t2, a[0], b[4]);+	MONT_MUL(v0, v1, v2, a[1], b[3]);+	MONT_MUL(w0, w1, w2, a[2], b[2]);+	MONT_MAC(t0, t1, t2, a[3], b[1]);+	MONT_MAC(v0, v1, v2, a[4], b[0]);+	MONT_MAC(w0, w1, w2, u[0], m[4]);+	MONT_MAC(t0, t1, t2, u[1], m[3]);+	MONT_MAC(v0, v1, v2, u[2], m[2]);+	MONT_MAC(w0, w1, w2, u[3], m[1]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	u[4] = t0 * n0;+	MONT_MAC(t0, t1, t2, u[4], m[0]);+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 5 */+	MONT_MAC(t0, t1, t2, a[0], b[5]);+	MONT_MUL(v0, v1, v2, a[1], b[4]);+	MONT_MUL(w0, w1, w2, a[2], b[3]);+	MONT_MAC(t0, t1, t2, a[3], b[2]);+	MONT_MAC(v0, v1, v2, a[4], b[1]);+	MONT_MAC(w0, w1, w2, a[5], b[0]);+	MONT_MAC(t0, t1, t2, u[0], m[5]);+	MONT_MAC(v0, v1, v2, u[1], m[4]);+	MONT_MAC(w0, w1, w2, u[2], m[3]);+	MONT_MAC(t0, t1, t2, u[3], m[2]);+	MONT_MAC(v0, v1, v2, u[4], m[1]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	u[5] = t0 * n0;+	MONT_MAC(t0, t1, t2, u[5], m[0]);+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 6 */+	MONT_MAC(t0, t1, t2, a[0], b[6]);+	MONT_MUL(v0, v1, v2, a[1], b[5]);+	MONT_MUL(w0, w1, w2, a[2], b[4]);+	MONT_MAC(t0, t1, t2, a[3], b[3]);+	MONT_MAC(v0, v1, v2, a[4], b[2]);+	MONT_MAC(w0, w1, w2, a[5], b[1]);+	MONT_MAC(t0, t1, t2, a[6], b[0]);+	MONT_MAC(v0, v1, v2, u[0], m[6]);+	MONT_MAC(w0, w1, w2, u[1], m[5]);+	MONT_MAC(t0, t1, t2, u[2], m[4]);+	MONT_MAC(v0, v1, v2, u[3], m[3]);+	MONT_MAC(w0, w1, w2, u[4], m[2]);+	MONT_MAC(t0, t1, t2, u[5], m[1]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	u[6] = t0 * n0;+	MONT_MAC(t0, t1, t2, u[6], m[0]);+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 7 */+	MONT_MAC(t0, t1, t2, a[0], b[7]);+	MONT_MUL(v0, v1, v2, a[1], b[6]);+	MONT_MUL(w0, w1, w2, a[2], b[5]);+	MONT_MAC(t0, t1, t2, a[3], b[4]);+	MONT_MAC(v0, v1, v2, a[4], b[3]);+	MONT_MAC(w0, w1, w2, a[5], b[2]);+	MONT_MAC(t0, t1, t2, a[6], b[1]);+	MONT_MAC(v0, v1, v2, a[7], b[0]);+	MONT_MAC(w0, w1, w2, u[0], m[7]);+	MONT_MAC(t0, t1, t2, u[1], m[6]);+	MONT_MAC(v0, v1, v2, u[2], m[5]);+	MONT_MAC(w0, w1, w2, u[3], m[4]);+	MONT_MAC(t0, t1, t2, u[4], m[3]);+	MONT_MAC(v0, v1, v2, u[5], m[2]);+	MONT_MAC(w0, w1, w2, u[6], m[1]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	u[7] = t0 * n0;+	MONT_MAC(t0, t1, t2, u[7], m[0]);+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 8 */+	MONT_MAC(t0, t1, t2, a[0], b[8]);+	MONT_MUL(v0, v1, v2, a[1], b[7]);+	MONT_MUL(w0, w1, w2, a[2], b[6]);+	MONT_MAC(t0, t1, t2, a[3], b[5]);+	MONT_MAC(v0, v1, v2, a[4], b[4]);+	MONT_MAC(w0, w1, w2, a[5], b[3]);+	MONT_MAC(t0, t1, t2, a[6], b[2]);+	MONT_MAC(v0, v1, v2, a[7], b[1]);+	MONT_MAC(w0, w1, w2, a[8], b[0]);+	MONT_MAC(t0, t1, t2, u[0], m[8]);+	MONT_MAC(v0, v1, v2, u[1], m[7]);+	MONT_MAC(w0, w1, w2, u[2], m[6]);+	MONT_MAC(t0, t1, t2, u[3], m[5]);+	MONT_MAC(v0, v1, v2, u[4], m[4]);+	MONT_MAC(w0, w1, w2, u[5], m[3]);+	MONT_MAC(t0, t1, t2, u[6], m[2]);+	MONT_MAC(v0, v1, v2, u[7], m[1]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	u[8] = t0 * n0;+	MONT_MAC(t0, t1, t2, u[8], m[0]);+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 9 */+	MONT_MAC(t0, t1, t2, a[0], b[9]);+	MONT_MUL(v0, v1, v2, a[1], b[8]);+	MONT_MUL(w0, w1, w2, a[2], b[7]);+	MONT_MAC(t0, t1, t2, a[3], b[6]);+	MONT_MAC(v0, v1, v2, a[4], b[5]);+	MONT_MAC(w0, w1, w2, a[5], b[4]);+	MONT_MAC(t0, t1, t2, a[6], b[3]);+	MONT_MAC(v0, v1, v2, a[7], b[2]);+	MONT_MAC(w0, w1, w2, a[8], b[1]);+	MONT_MAC(t0, t1, t2, a[9], b[0]);+	MONT_MAC(v0, v1, v2, u[0], m[9]);+	MONT_MAC(w0, w1, w2, u[1], m[8]);+	MONT_MAC(t0, t1, t2, u[2], m[7]);+	MONT_MAC(v0, v1, v2, u[3], m[6]);+	MONT_MAC(w0, w1, w2, u[4], m[5]);+	MONT_MAC(t0, t1, t2, u[5], m[4]);+	MONT_MAC(v0, v1, v2, u[6], m[3]);+	MONT_MAC(w0, w1, w2, u[7], m[2]);+	MONT_MAC(t0, t1, t2, u[8], m[1]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	u[9] = t0 * n0;+	MONT_MAC(t0, t1, t2, u[9], m[0]);+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 10 */+	MONT_MAC(t0, t1, t2, a[0], b[10]);+	MONT_MUL(v0, v1, v2, a[1], b[9]);+	MONT_MUL(w0, w1, w2, a[2], b[8]);+	MONT_MAC(t0, t1, t2, a[3], b[7]);+	MONT_MAC(v0, v1, v2, a[4], b[6]);+	MONT_MAC(w0, w1, w2, a[5], b[5]);+	MONT_MAC(t0, t1, t2, a[6], b[4]);+	MONT_MAC(v0, v1, v2, a[7], b[3]);+	MONT_MAC(w0, w1, w2, a[8], b[2]);+	MONT_MAC(t0, t1, t2, a[9], b[1]);+	MONT_MAC(v0, v1, v2, a[10], b[0]);+	MONT_MAC(w0, w1, w2, u[0], m[10]);+	MONT_MAC(t0, t1, t2, u[1], m[9]);+	MONT_MAC(v0, v1, v2, u[2], m[8]);+	MONT_MAC(w0, w1, w2, u[3], m[7]);+	MONT_MAC(t0, t1, t2, u[4], m[6]);+	MONT_MAC(v0, v1, v2, u[5], m[5]);+	MONT_MAC(w0, w1, w2, u[6], m[4]);+	MONT_MAC(t0, t1, t2, u[7], m[3]);+	MONT_MAC(v0, v1, v2, u[8], m[2]);+	MONT_MAC(w0, w1, w2, u[9], m[1]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	u[10] = t0 * n0;+	MONT_MAC(t0, t1, t2, u[10], m[0]);+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 11 */+	MONT_MAC(t0, t1, t2, a[0], b[11]);+	MONT_MUL(v0, v1, v2, a[1], b[10]);+	MONT_MUL(w0, w1, w2, a[2], b[9]);+	MONT_MAC(t0, t1, t2, a[3], b[8]);+	MONT_MAC(v0, v1, v2, a[4], b[7]);+	MONT_MAC(w0, w1, w2, a[5], b[6]);+	MONT_MAC(t0, t1, t2, a[6], b[5]);+	MONT_MAC(v0, v1, v2, a[7], b[4]);+	MONT_MAC(w0, w1, w2, a[8], b[3]);+	MONT_MAC(t0, t1, t2, a[9], b[2]);+	MONT_MAC(v0, v1, v2, a[10], b[1]);+	MONT_MAC(w0, w1, w2, a[11], b[0]);+	MONT_MAC(t0, t1, t2, u[0], m[11]);+	MONT_MAC(v0, v1, v2, u[1], m[10]);+	MONT_MAC(w0, w1, w2, u[2], m[9]);+	MONT_MAC(t0, t1, t2, u[3], m[8]);+	MONT_MAC(v0, v1, v2, u[4], m[7]);+	MONT_MAC(w0, w1, w2, u[5], m[6]);+	MONT_MAC(t0, t1, t2, u[6], m[5]);+	MONT_MAC(v0, v1, v2, u[7], m[4]);+	MONT_MAC(w0, w1, w2, u[8], m[3]);+	MONT_MAC(t0, t1, t2, u[9], m[2]);+	MONT_MAC(v0, v1, v2, u[10], m[1]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	u[11] = t0 * n0;+	MONT_MAC(t0, t1, t2, u[11], m[0]);+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 12 */+	MONT_MAC(t0, t1, t2, a[0], b[12]);+	MONT_MUL(v0, v1, v2, a[1], b[11]);+	MONT_MUL(w0, w1, w2, a[2], b[10]);+	MONT_MAC(t0, t1, t2, a[3], b[9]);+	MONT_MAC(v0, v1, v2, a[4], b[8]);+	MONT_MAC(w0, w1, w2, a[5], b[7]);+	MONT_MAC(t0, t1, t2, a[6], b[6]);+	MONT_MAC(v0, v1, v2, a[7], b[5]);+	MONT_MAC(w0, w1, w2, a[8], b[4]);+	MONT_MAC(t0, t1, t2, a[9], b[3]);+	MONT_MAC(v0, v1, v2, a[10], b[2]);+	MONT_MAC(w0, w1, w2, a[11], b[1]);+	MONT_MAC(t0, t1, t2, a[12], b[0]);+	MONT_MAC(v0, v1, v2, u[0], m[12]);+	MONT_MAC(w0, w1, w2, u[1], m[11]);+	MONT_MAC(t0, t1, t2, u[2], m[10]);+	MONT_MAC(v0, v1, v2, u[3], m[9]);+	MONT_MAC(w0, w1, w2, u[4], m[8]);+	MONT_MAC(t0, t1, t2, u[5], m[7]);+	MONT_MAC(v0, v1, v2, u[6], m[6]);+	MONT_MAC(w0, w1, w2, u[7], m[5]);+	MONT_MAC(t0, t1, t2, u[8], m[4]);+	MONT_MAC(v0, v1, v2, u[9], m[3]);+	MONT_MAC(w0, w1, w2, u[10], m[2]);+	MONT_MAC(t0, t1, t2, u[11], m[1]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	u[12] = t0 * n0;+	MONT_MAC(t0, t1, t2, u[12], m[0]);+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 13 */+	MONT_MAC(t0, t1, t2, a[0], b[13]);+	MONT_MUL(v0, v1, v2, a[1], b[12]);+	MONT_MUL(w0, w1, w2, a[2], b[11]);+	MONT_MAC(t0, t1, t2, a[3], b[10]);+	MONT_MAC(v0, v1, v2, a[4], b[9]);+	MONT_MAC(w0, w1, w2, a[5], b[8]);+	MONT_MAC(t0, t1, t2, a[6], b[7]);+	MONT_MAC(v0, v1, v2, a[7], b[6]);+	MONT_MAC(w0, w1, w2, a[8], b[5]);+	MONT_MAC(t0, t1, t2, a[9], b[4]);+	MONT_MAC(v0, v1, v2, a[10], b[3]);+	MONT_MAC(w0, w1, w2, a[11], b[2]);+	MONT_MAC(t0, t1, t2, a[12], b[1]);+	MONT_MAC(v0, v1, v2, a[13], b[0]);+	MONT_MAC(w0, w1, w2, u[0], m[13]);+	MONT_MAC(t0, t1, t2, u[1], m[12]);+	MONT_MAC(v0, v1, v2, u[2], m[11]);+	MONT_MAC(w0, w1, w2, u[3], m[10]);+	MONT_MAC(t0, t1, t2, u[4], m[9]);+	MONT_MAC(v0, v1, v2, u[5], m[8]);+	MONT_MAC(w0, w1, w2, u[6], m[7]);+	MONT_MAC(t0, t1, t2, u[7], m[6]);+	MONT_MAC(v0, v1, v2, u[8], m[5]);+	MONT_MAC(w0, w1, w2, u[9], m[4]);+	MONT_MAC(t0, t1, t2, u[10], m[3]);+	MONT_MAC(v0, v1, v2, u[11], m[2]);+	MONT_MAC(w0, w1, w2, u[12], m[1]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	u[13] = t0 * n0;+	MONT_MAC(t0, t1, t2, u[13], m[0]);+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 14 */+	MONT_MAC(t0, t1, t2, a[0], b[14]);+	MONT_MUL(v0, v1, v2, a[1], b[13]);+	MONT_MUL(w0, w1, w2, a[2], b[12]);+	MONT_MAC(t0, t1, t2, a[3], b[11]);+	MONT_MAC(v0, v1, v2, a[4], b[10]);+	MONT_MAC(w0, w1, w2, a[5], b[9]);+	MONT_MAC(t0, t1, t2, a[6], b[8]);+	MONT_MAC(v0, v1, v2, a[7], b[7]);+	MONT_MAC(w0, w1, w2, a[8], b[6]);+	MONT_MAC(t0, t1, t2, a[9], b[5]);+	MONT_MAC(v0, v1, v2, a[10], b[4]);+	MONT_MAC(w0, w1, w2, a[11], b[3]);+	MONT_MAC(t0, t1, t2, a[12], b[2]);+	MONT_MAC(v0, v1, v2, a[13], b[1]);+	MONT_MAC(w0, w1, w2, a[14], b[0]);+	MONT_MAC(t0, t1, t2, u[0], m[14]);+	MONT_MAC(v0, v1, v2, u[1], m[13]);+	MONT_MAC(w0, w1, w2, u[2], m[12]);+	MONT_MAC(t0, t1, t2, u[3], m[11]);+	MONT_MAC(v0, v1, v2, u[4], m[10]);+	MONT_MAC(w0, w1, w2, u[5], m[9]);+	MONT_MAC(t0, t1, t2, u[6], m[8]);+	MONT_MAC(v0, v1, v2, u[7], m[7]);+	MONT_MAC(w0, w1, w2, u[8], m[6]);+	MONT_MAC(t0, t1, t2, u[9], m[5]);+	MONT_MAC(v0, v1, v2, u[10], m[4]);+	MONT_MAC(w0, w1, w2, u[11], m[3]);+	MONT_MAC(t0, t1, t2, u[12], m[2]);+	MONT_MAC(v0, v1, v2, u[13], m[1]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	u[14] = t0 * n0;+	MONT_MAC(t0, t1, t2, u[14], m[0]);+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 15 */+	MONT_MAC(t0, t1, t2, a[0], b[15]);+	MONT_MUL(v0, v1, v2, a[1], b[14]);+	MONT_MUL(w0, w1, w2, a[2], b[13]);+	MONT_MAC(t0, t1, t2, a[3], b[12]);+	MONT_MAC(v0, v1, v2, a[4], b[11]);+	MONT_MAC(w0, w1, w2, a[5], b[10]);+	MONT_MAC(t0, t1, t2, a[6], b[9]);+	MONT_MAC(v0, v1, v2, a[7], b[8]);+	MONT_MAC(w0, w1, w2, a[8], b[7]);+	MONT_MAC(t0, t1, t2, a[9], b[6]);+	MONT_MAC(v0, v1, v2, a[10], b[5]);+	MONT_MAC(w0, w1, w2, a[11], b[4]);+	MONT_MAC(t0, t1, t2, a[12], b[3]);+	MONT_MAC(v0, v1, v2, a[13], b[2]);+	MONT_MAC(w0, w1, w2, a[14], b[1]);+	MONT_MAC(t0, t1, t2, a[15], b[0]);+	MONT_MAC(v0, v1, v2, u[0], m[15]);+	MONT_MAC(w0, w1, w2, u[1], m[14]);+	MONT_MAC(t0, t1, t2, u[2], m[13]);+	MONT_MAC(v0, v1, v2, u[3], m[12]);+	MONT_MAC(w0, w1, w2, u[4], m[11]);+	MONT_MAC(t0, t1, t2, u[5], m[10]);+	MONT_MAC(v0, v1, v2, u[6], m[9]);+	MONT_MAC(w0, w1, w2, u[7], m[8]);+	MONT_MAC(t0, t1, t2, u[8], m[7]);+	MONT_MAC(v0, v1, v2, u[9], m[6]);+	MONT_MAC(w0, w1, w2, u[10], m[5]);+	MONT_MAC(t0, t1, t2, u[11], m[4]);+	MONT_MAC(v0, v1, v2, u[12], m[3]);+	MONT_MAC(w0, w1, w2, u[13], m[2]);+	MONT_MAC(t0, t1, t2, u[14], m[1]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	u[15] = t0 * n0;+	MONT_MAC(t0, t1, t2, u[15], m[0]);+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 16 */+	MONT_MAC(t0, t1, t2, a[0], b[16]);+	MONT_MUL(v0, v1, v2, a[1], b[15]);+	MONT_MUL(w0, w1, w2, a[2], b[14]);+	MONT_MAC(t0, t1, t2, a[3], b[13]);+	MONT_MAC(v0, v1, v2, a[4], b[12]);+	MONT_MAC(w0, w1, w2, a[5], b[11]);+	MONT_MAC(t0, t1, t2, a[6], b[10]);+	MONT_MAC(v0, v1, v2, a[7], b[9]);+	MONT_MAC(w0, w1, w2, a[8], b[8]);+	MONT_MAC(t0, t1, t2, a[9], b[7]);+	MONT_MAC(v0, v1, v2, a[10], b[6]);+	MONT_MAC(w0, w1, w2, a[11], b[5]);+	MONT_MAC(t0, t1, t2, a[12], b[4]);+	MONT_MAC(v0, v1, v2, a[13], b[3]);+	MONT_MAC(w0, w1, w2, a[14], b[2]);+	MONT_MAC(t0, t1, t2, a[15], b[1]);+	MONT_MAC(v0, v1, v2, a[16], b[0]);+	MONT_MAC(w0, w1, w2, u[0], m[16]);+	MONT_MAC(t0, t1, t2, u[1], m[15]);+	MONT_MAC(v0, v1, v2, u[2], m[14]);+	MONT_MAC(w0, w1, w2, u[3], m[13]);+	MONT_MAC(t0, t1, t2, u[4], m[12]);+	MONT_MAC(v0, v1, v2, u[5], m[11]);+	MONT_MAC(w0, w1, w2, u[6], m[10]);+	MONT_MAC(t0, t1, t2, u[7], m[9]);+	MONT_MAC(v0, v1, v2, u[8], m[8]);+	MONT_MAC(w0, w1, w2, u[9], m[7]);+	MONT_MAC(t0, t1, t2, u[10], m[6]);+	MONT_MAC(v0, v1, v2, u[11], m[5]);+	MONT_MAC(w0, w1, w2, u[12], m[4]);+	MONT_MAC(t0, t1, t2, u[13], m[3]);+	MONT_MAC(v0, v1, v2, u[14], m[2]);+	MONT_MAC(w0, w1, w2, u[15], m[1]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	u[16] = t0 * n0;+	MONT_MAC(t0, t1, t2, u[16], m[0]);+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 17 */+	MONT_MAC(t0, t1, t2, a[0], b[17]);+	MONT_MUL(v0, v1, v2, a[1], b[16]);+	MONT_MUL(w0, w1, w2, a[2], b[15]);+	MONT_MAC(t0, t1, t2, a[3], b[14]);+	MONT_MAC(v0, v1, v2, a[4], b[13]);+	MONT_MAC(w0, w1, w2, a[5], b[12]);+	MONT_MAC(t0, t1, t2, a[6], b[11]);+	MONT_MAC(v0, v1, v2, a[7], b[10]);+	MONT_MAC(w0, w1, w2, a[8], b[9]);+	MONT_MAC(t0, t1, t2, a[9], b[8]);+	MONT_MAC(v0, v1, v2, a[10], b[7]);+	MONT_MAC(w0, w1, w2, a[11], b[6]);+	MONT_MAC(t0, t1, t2, a[12], b[5]);+	MONT_MAC(v0, v1, v2, a[13], b[4]);+	MONT_MAC(w0, w1, w2, a[14], b[3]);+	MONT_MAC(t0, t1, t2, a[15], b[2]);+	MONT_MAC(v0, v1, v2, a[16], b[1]);+	MONT_MAC(w0, w1, w2, a[17], b[0]);+	MONT_MAC(t0, t1, t2, u[0], m[17]);+	MONT_MAC(v0, v1, v2, u[1], m[16]);+	MONT_MAC(w0, w1, w2, u[2], m[15]);+	MONT_MAC(t0, t1, t2, u[3], m[14]);+	MONT_MAC(v0, v1, v2, u[4], m[13]);+	MONT_MAC(w0, w1, w2, u[5], m[12]);+	MONT_MAC(t0, t1, t2, u[6], m[11]);+	MONT_MAC(v0, v1, v2, u[7], m[10]);+	MONT_MAC(w0, w1, w2, u[8], m[9]);+	MONT_MAC(t0, t1, t2, u[9], m[8]);+	MONT_MAC(v0, v1, v2, u[10], m[7]);+	MONT_MAC(w0, w1, w2, u[11], m[6]);+	MONT_MAC(t0, t1, t2, u[12], m[5]);+	MONT_MAC(v0, v1, v2, u[13], m[4]);+	MONT_MAC(w0, w1, w2, u[14], m[3]);+	MONT_MAC(t0, t1, t2, u[15], m[2]);+	MONT_MAC(v0, v1, v2, u[16], m[1]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	u[17] = t0 * n0;+	MONT_MAC(t0, t1, t2, u[17], m[0]);+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 18 */+	MONT_MAC(t0, t1, t2, a[0], b[18]);+	MONT_MUL(v0, v1, v2, a[1], b[17]);+	MONT_MUL(w0, w1, w2, a[2], b[16]);+	MONT_MAC(t0, t1, t2, a[3], b[15]);+	MONT_MAC(v0, v1, v2, a[4], b[14]);+	MONT_MAC(w0, w1, w2, a[5], b[13]);+	MONT_MAC(t0, t1, t2, a[6], b[12]);+	MONT_MAC(v0, v1, v2, a[7], b[11]);+	MONT_MAC(w0, w1, w2, a[8], b[10]);+	MONT_MAC(t0, t1, t2, a[9], b[9]);+	MONT_MAC(v0, v1, v2, a[10], b[8]);+	MONT_MAC(w0, w1, w2, a[11], b[7]);+	MONT_MAC(t0, t1, t2, a[12], b[6]);+	MONT_MAC(v0, v1, v2, a[13], b[5]);+	MONT_MAC(w0, w1, w2, a[14], b[4]);+	MONT_MAC(t0, t1, t2, a[15], b[3]);+	MONT_MAC(v0, v1, v2, a[16], b[2]);+	MONT_MAC(w0, w1, w2, a[17], b[1]);+	MONT_MAC(t0, t1, t2, a[18], b[0]);+	MONT_MAC(v0, v1, v2, u[0], m[18]);+	MONT_MAC(w0, w1, w2, u[1], m[17]);+	MONT_MAC(t0, t1, t2, u[2], m[16]);+	MONT_MAC(v0, v1, v2, u[3], m[15]);+	MONT_MAC(w0, w1, w2, u[4], m[14]);+	MONT_MAC(t0, t1, t2, u[5], m[13]);+	MONT_MAC(v0, v1, v2, u[6], m[12]);+	MONT_MAC(w0, w1, w2, u[7], m[11]);+	MONT_MAC(t0, t1, t2, u[8], m[10]);+	MONT_MAC(v0, v1, v2, u[9], m[9]);+	MONT_MAC(w0, w1, w2, u[10], m[8]);+	MONT_MAC(t0, t1, t2, u[11], m[7]);+	MONT_MAC(v0, v1, v2, u[12], m[6]);+	MONT_MAC(w0, w1, w2, u[13], m[5]);+	MONT_MAC(t0, t1, t2, u[14], m[4]);+	MONT_MAC(v0, v1, v2, u[15], m[3]);+	MONT_MAC(w0, w1, w2, u[16], m[2]);+	MONT_MAC(t0, t1, t2, u[17], m[1]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	u[18] = t0 * n0;+	MONT_MAC(t0, t1, t2, u[18], m[0]);+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 19 */+	MONT_MAC(t0, t1, t2, a[0], b[19]);+	MONT_MUL(v0, v1, v2, a[1], b[18]);+	MONT_MUL(w0, w1, w2, a[2], b[17]);+	MONT_MAC(t0, t1, t2, a[3], b[16]);+	MONT_MAC(v0, v1, v2, a[4], b[15]);+	MONT_MAC(w0, w1, w2, a[5], b[14]);+	MONT_MAC(t0, t1, t2, a[6], b[13]);+	MONT_MAC(v0, v1, v2, a[7], b[12]);+	MONT_MAC(w0, w1, w2, a[8], b[11]);+	MONT_MAC(t0, t1, t2, a[9], b[10]);+	MONT_MAC(v0, v1, v2, a[10], b[9]);+	MONT_MAC(w0, w1, w2, a[11], b[8]);+	MONT_MAC(t0, t1, t2, a[12], b[7]);+	MONT_MAC(v0, v1, v2, a[13], b[6]);+	MONT_MAC(w0, w1, w2, a[14], b[5]);+	MONT_MAC(t0, t1, t2, a[15], b[4]);+	MONT_MAC(v0, v1, v2, a[16], b[3]);+	MONT_MAC(w0, w1, w2, a[17], b[2]);+	MONT_MAC(t0, t1, t2, a[18], b[1]);+	MONT_MAC(v0, v1, v2, a[19], b[0]);+	MONT_MAC(w0, w1, w2, u[0], m[19]);+	MONT_MAC(t0, t1, t2, u[1], m[18]);+	MONT_MAC(v0, v1, v2, u[2], m[17]);+	MONT_MAC(w0, w1, w2, u[3], m[16]);+	MONT_MAC(t0, t1, t2, u[4], m[15]);+	MONT_MAC(v0, v1, v2, u[5], m[14]);+	MONT_MAC(w0, w1, w2, u[6], m[13]);+	MONT_MAC(t0, t1, t2, u[7], m[12]);+	MONT_MAC(v0, v1, v2, u[8], m[11]);+	MONT_MAC(w0, w1, w2, u[9], m[10]);+	MONT_MAC(t0, t1, t2, u[10], m[9]);+	MONT_MAC(v0, v1, v2, u[11], m[8]);+	MONT_MAC(w0, w1, w2, u[12], m[7]);+	MONT_MAC(t0, t1, t2, u[13], m[6]);+	MONT_MAC(v0, v1, v2, u[14], m[5]);+	MONT_MAC(w0, w1, w2, u[15], m[4]);+	MONT_MAC(t0, t1, t2, u[16], m[3]);+	MONT_MAC(v0, v1, v2, u[17], m[2]);+	MONT_MAC(w0, w1, w2, u[18], m[1]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	u[19] = t0 * n0;+	MONT_MAC(t0, t1, t2, u[19], m[0]);+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 20 */+	MONT_MAC(t0, t1, t2, a[0], b[20]);+	MONT_MUL(v0, v1, v2, a[1], b[19]);+	MONT_MUL(w0, w1, w2, a[2], b[18]);+	MONT_MAC(t0, t1, t2, a[3], b[17]);+	MONT_MAC(v0, v1, v2, a[4], b[16]);+	MONT_MAC(w0, w1, w2, a[5], b[15]);+	MONT_MAC(t0, t1, t2, a[6], b[14]);+	MONT_MAC(v0, v1, v2, a[7], b[13]);+	MONT_MAC(w0, w1, w2, a[8], b[12]);+	MONT_MAC(t0, t1, t2, a[9], b[11]);+	MONT_MAC(v0, v1, v2, a[10], b[10]);+	MONT_MAC(w0, w1, w2, a[11], b[9]);+	MONT_MAC(t0, t1, t2, a[12], b[8]);+	MONT_MAC(v0, v1, v2, a[13], b[7]);+	MONT_MAC(w0, w1, w2, a[14], b[6]);+	MONT_MAC(t0, t1, t2, a[15], b[5]);+	MONT_MAC(v0, v1, v2, a[16], b[4]);+	MONT_MAC(w0, w1, w2, a[17], b[3]);+	MONT_MAC(t0, t1, t2, a[18], b[2]);+	MONT_MAC(v0, v1, v2, a[19], b[1]);+	MONT_MAC(w0, w1, w2, a[20], b[0]);+	MONT_MAC(t0, t1, t2, u[0], m[20]);+	MONT_MAC(v0, v1, v2, u[1], m[19]);+	MONT_MAC(w0, w1, w2, u[2], m[18]);+	MONT_MAC(t0, t1, t2, u[3], m[17]);+	MONT_MAC(v0, v1, v2, u[4], m[16]);+	MONT_MAC(w0, w1, w2, u[5], m[15]);+	MONT_MAC(t0, t1, t2, u[6], m[14]);+	MONT_MAC(v0, v1, v2, u[7], m[13]);+	MONT_MAC(w0, w1, w2, u[8], m[12]);+	MONT_MAC(t0, t1, t2, u[9], m[11]);+	MONT_MAC(v0, v1, v2, u[10], m[10]);+	MONT_MAC(w0, w1, w2, u[11], m[9]);+	MONT_MAC(t0, t1, t2, u[12], m[8]);+	MONT_MAC(v0, v1, v2, u[13], m[7]);+	MONT_MAC(w0, w1, w2, u[14], m[6]);+	MONT_MAC(t0, t1, t2, u[15], m[5]);+	MONT_MAC(v0, v1, v2, u[16], m[4]);+	MONT_MAC(w0, w1, w2, u[17], m[3]);+	MONT_MAC(t0, t1, t2, u[18], m[2]);+	MONT_MAC(v0, v1, v2, u[19], m[1]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	u[20] = t0 * n0;+	MONT_MAC(t0, t1, t2, u[20], m[0]);+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 21 */+	MONT_MAC(t0, t1, t2, a[0], b[21]);+	MONT_MUL(v0, v1, v2, a[1], b[20]);+	MONT_MUL(w0, w1, w2, a[2], b[19]);+	MONT_MAC(t0, t1, t2, a[3], b[18]);+	MONT_MAC(v0, v1, v2, a[4], b[17]);+	MONT_MAC(w0, w1, w2, a[5], b[16]);+	MONT_MAC(t0, t1, t2, a[6], b[15]);+	MONT_MAC(v0, v1, v2, a[7], b[14]);+	MONT_MAC(w0, w1, w2, a[8], b[13]);+	MONT_MAC(t0, t1, t2, a[9], b[12]);+	MONT_MAC(v0, v1, v2, a[10], b[11]);+	MONT_MAC(w0, w1, w2, a[11], b[10]);+	MONT_MAC(t0, t1, t2, a[12], b[9]);+	MONT_MAC(v0, v1, v2, a[13], b[8]);+	MONT_MAC(w0, w1, w2, a[14], b[7]);+	MONT_MAC(t0, t1, t2, a[15], b[6]);+	MONT_MAC(v0, v1, v2, a[16], b[5]);+	MONT_MAC(w0, w1, w2, a[17], b[4]);+	MONT_MAC(t0, t1, t2, a[18], b[3]);+	MONT_MAC(v0, v1, v2, a[19], b[2]);+	MONT_MAC(w0, w1, w2, a[20], b[1]);+	MONT_MAC(t0, t1, t2, a[21], b[0]);+	MONT_MAC(v0, v1, v2, u[0], m[21]);+	MONT_MAC(w0, w1, w2, u[1], m[20]);+	MONT_MAC(t0, t1, t2, u[2], m[19]);+	MONT_MAC(v0, v1, v2, u[3], m[18]);+	MONT_MAC(w0, w1, w2, u[4], m[17]);+	MONT_MAC(t0, t1, t2, u[5], m[16]);+	MONT_MAC(v0, v1, v2, u[6], m[15]);+	MONT_MAC(w0, w1, w2, u[7], m[14]);+	MONT_MAC(t0, t1, t2, u[8], m[13]);+	MONT_MAC(v0, v1, v2, u[9], m[12]);+	MONT_MAC(w0, w1, w2, u[10], m[11]);+	MONT_MAC(t0, t1, t2, u[11], m[10]);+	MONT_MAC(v0, v1, v2, u[12], m[9]);+	MONT_MAC(w0, w1, w2, u[13], m[8]);+	MONT_MAC(t0, t1, t2, u[14], m[7]);+	MONT_MAC(v0, v1, v2, u[15], m[6]);+	MONT_MAC(w0, w1, w2, u[16], m[5]);+	MONT_MAC(t0, t1, t2, u[17], m[4]);+	MONT_MAC(v0, v1, v2, u[18], m[3]);+	MONT_MAC(w0, w1, w2, u[19], m[2]);+	MONT_MAC(t0, t1, t2, u[20], m[1]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	u[21] = t0 * n0;+	MONT_MAC(t0, t1, t2, u[21], m[0]);+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 22 */+	MONT_MAC(t0, t1, t2, a[0], b[22]);+	MONT_MUL(v0, v1, v2, a[1], b[21]);+	MONT_MUL(w0, w1, w2, a[2], b[20]);+	MONT_MAC(t0, t1, t2, a[3], b[19]);+	MONT_MAC(v0, v1, v2, a[4], b[18]);+	MONT_MAC(w0, w1, w2, a[5], b[17]);+	MONT_MAC(t0, t1, t2, a[6], b[16]);+	MONT_MAC(v0, v1, v2, a[7], b[15]);+	MONT_MAC(w0, w1, w2, a[8], b[14]);+	MONT_MAC(t0, t1, t2, a[9], b[13]);+	MONT_MAC(v0, v1, v2, a[10], b[12]);+	MONT_MAC(w0, w1, w2, a[11], b[11]);+	MONT_MAC(t0, t1, t2, a[12], b[10]);+	MONT_MAC(v0, v1, v2, a[13], b[9]);+	MONT_MAC(w0, w1, w2, a[14], b[8]);+	MONT_MAC(t0, t1, t2, a[15], b[7]);+	MONT_MAC(v0, v1, v2, a[16], b[6]);+	MONT_MAC(w0, w1, w2, a[17], b[5]);+	MONT_MAC(t0, t1, t2, a[18], b[4]);+	MONT_MAC(v0, v1, v2, a[19], b[3]);+	MONT_MAC(w0, w1, w2, a[20], b[2]);+	MONT_MAC(t0, t1, t2, a[21], b[1]);+	MONT_MAC(v0, v1, v2, a[22], b[0]);+	MONT_MAC(w0, w1, w2, u[0], m[22]);+	MONT_MAC(t0, t1, t2, u[1], m[21]);+	MONT_MAC(v0, v1, v2, u[2], m[20]);+	MONT_MAC(w0, w1, w2, u[3], m[19]);+	MONT_MAC(t0, t1, t2, u[4], m[18]);+	MONT_MAC(v0, v1, v2, u[5], m[17]);+	MONT_MAC(w0, w1, w2, u[6], m[16]);+	MONT_MAC(t0, t1, t2, u[7], m[15]);+	MONT_MAC(v0, v1, v2, u[8], m[14]);+	MONT_MAC(w0, w1, w2, u[9], m[13]);+	MONT_MAC(t0, t1, t2, u[10], m[12]);+	MONT_MAC(v0, v1, v2, u[11], m[11]);+	MONT_MAC(w0, w1, w2, u[12], m[10]);+	MONT_MAC(t0, t1, t2, u[13], m[9]);+	MONT_MAC(v0, v1, v2, u[14], m[8]);+	MONT_MAC(w0, w1, w2, u[15], m[7]);+	MONT_MAC(t0, t1, t2, u[16], m[6]);+	MONT_MAC(v0, v1, v2, u[17], m[5]);+	MONT_MAC(w0, w1, w2, u[18], m[4]);+	MONT_MAC(t0, t1, t2, u[19], m[3]);+	MONT_MAC(v0, v1, v2, u[20], m[2]);+	MONT_MAC(w0, w1, w2, u[21], m[1]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	u[22] = t0 * n0;+	MONT_MAC(t0, t1, t2, u[22], m[0]);+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 23 */+	MONT_MAC(t0, t1, t2, a[0], b[23]);+	MONT_MUL(v0, v1, v2, a[1], b[22]);+	MONT_MUL(w0, w1, w2, a[2], b[21]);+	MONT_MAC(t0, t1, t2, a[3], b[20]);+	MONT_MAC(v0, v1, v2, a[4], b[19]);+	MONT_MAC(w0, w1, w2, a[5], b[18]);+	MONT_MAC(t0, t1, t2, a[6], b[17]);+	MONT_MAC(v0, v1, v2, a[7], b[16]);+	MONT_MAC(w0, w1, w2, a[8], b[15]);+	MONT_MAC(t0, t1, t2, a[9], b[14]);+	MONT_MAC(v0, v1, v2, a[10], b[13]);+	MONT_MAC(w0, w1, w2, a[11], b[12]);+	MONT_MAC(t0, t1, t2, a[12], b[11]);+	MONT_MAC(v0, v1, v2, a[13], b[10]);+	MONT_MAC(w0, w1, w2, a[14], b[9]);+	MONT_MAC(t0, t1, t2, a[15], b[8]);+	MONT_MAC(v0, v1, v2, a[16], b[7]);+	MONT_MAC(w0, w1, w2, a[17], b[6]);+	MONT_MAC(t0, t1, t2, a[18], b[5]);+	MONT_MAC(v0, v1, v2, a[19], b[4]);+	MONT_MAC(w0, w1, w2, a[20], b[3]);+	MONT_MAC(t0, t1, t2, a[21], b[2]);+	MONT_MAC(v0, v1, v2, a[22], b[1]);+	MONT_MAC(w0, w1, w2, a[23], b[0]);+	MONT_MAC(t0, t1, t2, u[0], m[23]);+	MONT_MAC(v0, v1, v2, u[1], m[22]);+	MONT_MAC(w0, w1, w2, u[2], m[21]);+	MONT_MAC(t0, t1, t2, u[3], m[20]);+	MONT_MAC(v0, v1, v2, u[4], m[19]);+	MONT_MAC(w0, w1, w2, u[5], m[18]);+	MONT_MAC(t0, t1, t2, u[6], m[17]);+	MONT_MAC(v0, v1, v2, u[7], m[16]);+	MONT_MAC(w0, w1, w2, u[8], m[15]);+	MONT_MAC(t0, t1, t2, u[9], m[14]);+	MONT_MAC(v0, v1, v2, u[10], m[13]);+	MONT_MAC(w0, w1, w2, u[11], m[12]);+	MONT_MAC(t0, t1, t2, u[12], m[11]);+	MONT_MAC(v0, v1, v2, u[13], m[10]);+	MONT_MAC(w0, w1, w2, u[14], m[9]);+	MONT_MAC(t0, t1, t2, u[15], m[8]);+	MONT_MAC(v0, v1, v2, u[16], m[7]);+	MONT_MAC(w0, w1, w2, u[17], m[6]);+	MONT_MAC(t0, t1, t2, u[18], m[5]);+	MONT_MAC(v0, v1, v2, u[19], m[4]);+	MONT_MAC(w0, w1, w2, u[20], m[3]);+	MONT_MAC(t0, t1, t2, u[21], m[2]);+	MONT_MAC(v0, v1, v2, u[22], m[1]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	u[23] = t0 * n0;+	MONT_MAC(t0, t1, t2, u[23], m[0]);+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 24 */+	MONT_MAC(t0, t1, t2, a[1], b[23]);+	MONT_MUL(v0, v1, v2, a[2], b[22]);+	MONT_MUL(w0, w1, w2, a[3], b[21]);+	MONT_MAC(t0, t1, t2, a[4], b[20]);+	MONT_MAC(v0, v1, v2, a[5], b[19]);+	MONT_MAC(w0, w1, w2, a[6], b[18]);+	MONT_MAC(t0, t1, t2, a[7], b[17]);+	MONT_MAC(v0, v1, v2, a[8], b[16]);+	MONT_MAC(w0, w1, w2, a[9], b[15]);+	MONT_MAC(t0, t1, t2, a[10], b[14]);+	MONT_MAC(v0, v1, v2, a[11], b[13]);+	MONT_MAC(w0, w1, w2, a[12], b[12]);+	MONT_MAC(t0, t1, t2, a[13], b[11]);+	MONT_MAC(v0, v1, v2, a[14], b[10]);+	MONT_MAC(w0, w1, w2, a[15], b[9]);+	MONT_MAC(t0, t1, t2, a[16], b[8]);+	MONT_MAC(v0, v1, v2, a[17], b[7]);+	MONT_MAC(w0, w1, w2, a[18], b[6]);+	MONT_MAC(t0, t1, t2, a[19], b[5]);+	MONT_MAC(v0, v1, v2, a[20], b[4]);+	MONT_MAC(w0, w1, w2, a[21], b[3]);+	MONT_MAC(t0, t1, t2, a[22], b[2]);+	MONT_MAC(v0, v1, v2, a[23], b[1]);+	MONT_MAC(w0, w1, w2, u[1], m[23]);+	MONT_MAC(t0, t1, t2, u[2], m[22]);+	MONT_MAC(v0, v1, v2, u[3], m[21]);+	MONT_MAC(w0, w1, w2, u[4], m[20]);+	MONT_MAC(t0, t1, t2, u[5], m[19]);+	MONT_MAC(v0, v1, v2, u[6], m[18]);+	MONT_MAC(w0, w1, w2, u[7], m[17]);+	MONT_MAC(t0, t1, t2, u[8], m[16]);+	MONT_MAC(v0, v1, v2, u[9], m[15]);+	MONT_MAC(w0, w1, w2, u[10], m[14]);+	MONT_MAC(t0, t1, t2, u[11], m[13]);+	MONT_MAC(v0, v1, v2, u[12], m[12]);+	MONT_MAC(w0, w1, w2, u[13], m[11]);+	MONT_MAC(t0, t1, t2, u[14], m[10]);+	MONT_MAC(v0, v1, v2, u[15], m[9]);+	MONT_MAC(w0, w1, w2, u[16], m[8]);+	MONT_MAC(t0, t1, t2, u[17], m[7]);+	MONT_MAC(v0, v1, v2, u[18], m[6]);+	MONT_MAC(w0, w1, w2, u[19], m[5]);+	MONT_MAC(t0, t1, t2, u[20], m[4]);+	MONT_MAC(v0, v1, v2, u[21], m[3]);+	MONT_MAC(w0, w1, w2, u[22], m[2]);+	MONT_MAC(t0, t1, t2, u[23], m[1]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	z[0] = t0;+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 25 */+	MONT_MAC(t0, t1, t2, a[2], b[23]);+	MONT_MUL(v0, v1, v2, a[3], b[22]);+	MONT_MUL(w0, w1, w2, a[4], b[21]);+	MONT_MAC(t0, t1, t2, a[5], b[20]);+	MONT_MAC(v0, v1, v2, a[6], b[19]);+	MONT_MAC(w0, w1, w2, a[7], b[18]);+	MONT_MAC(t0, t1, t2, a[8], b[17]);+	MONT_MAC(v0, v1, v2, a[9], b[16]);+	MONT_MAC(w0, w1, w2, a[10], b[15]);+	MONT_MAC(t0, t1, t2, a[11], b[14]);+	MONT_MAC(v0, v1, v2, a[12], b[13]);+	MONT_MAC(w0, w1, w2, a[13], b[12]);+	MONT_MAC(t0, t1, t2, a[14], b[11]);+	MONT_MAC(v0, v1, v2, a[15], b[10]);+	MONT_MAC(w0, w1, w2, a[16], b[9]);+	MONT_MAC(t0, t1, t2, a[17], b[8]);+	MONT_MAC(v0, v1, v2, a[18], b[7]);+	MONT_MAC(w0, w1, w2, a[19], b[6]);+	MONT_MAC(t0, t1, t2, a[20], b[5]);+	MONT_MAC(v0, v1, v2, a[21], b[4]);+	MONT_MAC(w0, w1, w2, a[22], b[3]);+	MONT_MAC(t0, t1, t2, a[23], b[2]);+	MONT_MAC(v0, v1, v2, u[2], m[23]);+	MONT_MAC(w0, w1, w2, u[3], m[22]);+	MONT_MAC(t0, t1, t2, u[4], m[21]);+	MONT_MAC(v0, v1, v2, u[5], m[20]);+	MONT_MAC(w0, w1, w2, u[6], m[19]);+	MONT_MAC(t0, t1, t2, u[7], m[18]);+	MONT_MAC(v0, v1, v2, u[8], m[17]);+	MONT_MAC(w0, w1, w2, u[9], m[16]);+	MONT_MAC(t0, t1, t2, u[10], m[15]);+	MONT_MAC(v0, v1, v2, u[11], m[14]);+	MONT_MAC(w0, w1, w2, u[12], m[13]);+	MONT_MAC(t0, t1, t2, u[13], m[12]);+	MONT_MAC(v0, v1, v2, u[14], m[11]);+	MONT_MAC(w0, w1, w2, u[15], m[10]);+	MONT_MAC(t0, t1, t2, u[16], m[9]);+	MONT_MAC(v0, v1, v2, u[17], m[8]);+	MONT_MAC(w0, w1, w2, u[18], m[7]);+	MONT_MAC(t0, t1, t2, u[19], m[6]);+	MONT_MAC(v0, v1, v2, u[20], m[5]);+	MONT_MAC(w0, w1, w2, u[21], m[4]);+	MONT_MAC(t0, t1, t2, u[22], m[3]);+	MONT_MAC(v0, v1, v2, u[23], m[2]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	z[1] = t0;+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 26 */+	MONT_MAC(t0, t1, t2, a[3], b[23]);+	MONT_MUL(v0, v1, v2, a[4], b[22]);+	MONT_MUL(w0, w1, w2, a[5], b[21]);+	MONT_MAC(t0, t1, t2, a[6], b[20]);+	MONT_MAC(v0, v1, v2, a[7], b[19]);+	MONT_MAC(w0, w1, w2, a[8], b[18]);+	MONT_MAC(t0, t1, t2, a[9], b[17]);+	MONT_MAC(v0, v1, v2, a[10], b[16]);+	MONT_MAC(w0, w1, w2, a[11], b[15]);+	MONT_MAC(t0, t1, t2, a[12], b[14]);+	MONT_MAC(v0, v1, v2, a[13], b[13]);+	MONT_MAC(w0, w1, w2, a[14], b[12]);+	MONT_MAC(t0, t1, t2, a[15], b[11]);+	MONT_MAC(v0, v1, v2, a[16], b[10]);+	MONT_MAC(w0, w1, w2, a[17], b[9]);+	MONT_MAC(t0, t1, t2, a[18], b[8]);+	MONT_MAC(v0, v1, v2, a[19], b[7]);+	MONT_MAC(w0, w1, w2, a[20], b[6]);+	MONT_MAC(t0, t1, t2, a[21], b[5]);+	MONT_MAC(v0, v1, v2, a[22], b[4]);+	MONT_MAC(w0, w1, w2, a[23], b[3]);+	MONT_MAC(t0, t1, t2, u[3], m[23]);+	MONT_MAC(v0, v1, v2, u[4], m[22]);+	MONT_MAC(w0, w1, w2, u[5], m[21]);+	MONT_MAC(t0, t1, t2, u[6], m[20]);+	MONT_MAC(v0, v1, v2, u[7], m[19]);+	MONT_MAC(w0, w1, w2, u[8], m[18]);+	MONT_MAC(t0, t1, t2, u[9], m[17]);+	MONT_MAC(v0, v1, v2, u[10], m[16]);+	MONT_MAC(w0, w1, w2, u[11], m[15]);+	MONT_MAC(t0, t1, t2, u[12], m[14]);+	MONT_MAC(v0, v1, v2, u[13], m[13]);+	MONT_MAC(w0, w1, w2, u[14], m[12]);+	MONT_MAC(t0, t1, t2, u[15], m[11]);+	MONT_MAC(v0, v1, v2, u[16], m[10]);+	MONT_MAC(w0, w1, w2, u[17], m[9]);+	MONT_MAC(t0, t1, t2, u[18], m[8]);+	MONT_MAC(v0, v1, v2, u[19], m[7]);+	MONT_MAC(w0, w1, w2, u[20], m[6]);+	MONT_MAC(t0, t1, t2, u[21], m[5]);+	MONT_MAC(v0, v1, v2, u[22], m[4]);+	MONT_MAC(w0, w1, w2, u[23], m[3]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	z[2] = t0;+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 27 */+	MONT_MAC(t0, t1, t2, a[4], b[23]);+	MONT_MUL(v0, v1, v2, a[5], b[22]);+	MONT_MUL(w0, w1, w2, a[6], b[21]);+	MONT_MAC(t0, t1, t2, a[7], b[20]);+	MONT_MAC(v0, v1, v2, a[8], b[19]);+	MONT_MAC(w0, w1, w2, a[9], b[18]);+	MONT_MAC(t0, t1, t2, a[10], b[17]);+	MONT_MAC(v0, v1, v2, a[11], b[16]);+	MONT_MAC(w0, w1, w2, a[12], b[15]);+	MONT_MAC(t0, t1, t2, a[13], b[14]);+	MONT_MAC(v0, v1, v2, a[14], b[13]);+	MONT_MAC(w0, w1, w2, a[15], b[12]);+	MONT_MAC(t0, t1, t2, a[16], b[11]);+	MONT_MAC(v0, v1, v2, a[17], b[10]);+	MONT_MAC(w0, w1, w2, a[18], b[9]);+	MONT_MAC(t0, t1, t2, a[19], b[8]);+	MONT_MAC(v0, v1, v2, a[20], b[7]);+	MONT_MAC(w0, w1, w2, a[21], b[6]);+	MONT_MAC(t0, t1, t2, a[22], b[5]);+	MONT_MAC(v0, v1, v2, a[23], b[4]);+	MONT_MAC(w0, w1, w2, u[4], m[23]);+	MONT_MAC(t0, t1, t2, u[5], m[22]);+	MONT_MAC(v0, v1, v2, u[6], m[21]);+	MONT_MAC(w0, w1, w2, u[7], m[20]);+	MONT_MAC(t0, t1, t2, u[8], m[19]);+	MONT_MAC(v0, v1, v2, u[9], m[18]);+	MONT_MAC(w0, w1, w2, u[10], m[17]);+	MONT_MAC(t0, t1, t2, u[11], m[16]);+	MONT_MAC(v0, v1, v2, u[12], m[15]);+	MONT_MAC(w0, w1, w2, u[13], m[14]);+	MONT_MAC(t0, t1, t2, u[14], m[13]);+	MONT_MAC(v0, v1, v2, u[15], m[12]);+	MONT_MAC(w0, w1, w2, u[16], m[11]);+	MONT_MAC(t0, t1, t2, u[17], m[10]);+	MONT_MAC(v0, v1, v2, u[18], m[9]);+	MONT_MAC(w0, w1, w2, u[19], m[8]);+	MONT_MAC(t0, t1, t2, u[20], m[7]);+	MONT_MAC(v0, v1, v2, u[21], m[6]);+	MONT_MAC(w0, w1, w2, u[22], m[5]);+	MONT_MAC(t0, t1, t2, u[23], m[4]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	z[3] = t0;+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 28 */+	MONT_MAC(t0, t1, t2, a[5], b[23]);+	MONT_MUL(v0, v1, v2, a[6], b[22]);+	MONT_MUL(w0, w1, w2, a[7], b[21]);+	MONT_MAC(t0, t1, t2, a[8], b[20]);+	MONT_MAC(v0, v1, v2, a[9], b[19]);+	MONT_MAC(w0, w1, w2, a[10], b[18]);+	MONT_MAC(t0, t1, t2, a[11], b[17]);+	MONT_MAC(v0, v1, v2, a[12], b[16]);+	MONT_MAC(w0, w1, w2, a[13], b[15]);+	MONT_MAC(t0, t1, t2, a[14], b[14]);+	MONT_MAC(v0, v1, v2, a[15], b[13]);+	MONT_MAC(w0, w1, w2, a[16], b[12]);+	MONT_MAC(t0, t1, t2, a[17], b[11]);+	MONT_MAC(v0, v1, v2, a[18], b[10]);+	MONT_MAC(w0, w1, w2, a[19], b[9]);+	MONT_MAC(t0, t1, t2, a[20], b[8]);+	MONT_MAC(v0, v1, v2, a[21], b[7]);+	MONT_MAC(w0, w1, w2, a[22], b[6]);+	MONT_MAC(t0, t1, t2, a[23], b[5]);+	MONT_MAC(v0, v1, v2, u[5], m[23]);+	MONT_MAC(w0, w1, w2, u[6], m[22]);+	MONT_MAC(t0, t1, t2, u[7], m[21]);+	MONT_MAC(v0, v1, v2, u[8], m[20]);+	MONT_MAC(w0, w1, w2, u[9], m[19]);+	MONT_MAC(t0, t1, t2, u[10], m[18]);+	MONT_MAC(v0, v1, v2, u[11], m[17]);+	MONT_MAC(w0, w1, w2, u[12], m[16]);+	MONT_MAC(t0, t1, t2, u[13], m[15]);+	MONT_MAC(v0, v1, v2, u[14], m[14]);+	MONT_MAC(w0, w1, w2, u[15], m[13]);+	MONT_MAC(t0, t1, t2, u[16], m[12]);+	MONT_MAC(v0, v1, v2, u[17], m[11]);+	MONT_MAC(w0, w1, w2, u[18], m[10]);+	MONT_MAC(t0, t1, t2, u[19], m[9]);+	MONT_MAC(v0, v1, v2, u[20], m[8]);+	MONT_MAC(w0, w1, w2, u[21], m[7]);+	MONT_MAC(t0, t1, t2, u[22], m[6]);+	MONT_MAC(v0, v1, v2, u[23], m[5]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	z[4] = t0;+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 29 */+	MONT_MAC(t0, t1, t2, a[6], b[23]);+	MONT_MUL(v0, v1, v2, a[7], b[22]);+	MONT_MUL(w0, w1, w2, a[8], b[21]);+	MONT_MAC(t0, t1, t2, a[9], b[20]);+	MONT_MAC(v0, v1, v2, a[10], b[19]);+	MONT_MAC(w0, w1, w2, a[11], b[18]);+	MONT_MAC(t0, t1, t2, a[12], b[17]);+	MONT_MAC(v0, v1, v2, a[13], b[16]);+	MONT_MAC(w0, w1, w2, a[14], b[15]);+	MONT_MAC(t0, t1, t2, a[15], b[14]);+	MONT_MAC(v0, v1, v2, a[16], b[13]);+	MONT_MAC(w0, w1, w2, a[17], b[12]);+	MONT_MAC(t0, t1, t2, a[18], b[11]);+	MONT_MAC(v0, v1, v2, a[19], b[10]);+	MONT_MAC(w0, w1, w2, a[20], b[9]);+	MONT_MAC(t0, t1, t2, a[21], b[8]);+	MONT_MAC(v0, v1, v2, a[22], b[7]);+	MONT_MAC(w0, w1, w2, a[23], b[6]);+	MONT_MAC(t0, t1, t2, u[6], m[23]);+	MONT_MAC(v0, v1, v2, u[7], m[22]);+	MONT_MAC(w0, w1, w2, u[8], m[21]);+	MONT_MAC(t0, t1, t2, u[9], m[20]);+	MONT_MAC(v0, v1, v2, u[10], m[19]);+	MONT_MAC(w0, w1, w2, u[11], m[18]);+	MONT_MAC(t0, t1, t2, u[12], m[17]);+	MONT_MAC(v0, v1, v2, u[13], m[16]);+	MONT_MAC(w0, w1, w2, u[14], m[15]);+	MONT_MAC(t0, t1, t2, u[15], m[14]);+	MONT_MAC(v0, v1, v2, u[16], m[13]);+	MONT_MAC(w0, w1, w2, u[17], m[12]);+	MONT_MAC(t0, t1, t2, u[18], m[11]);+	MONT_MAC(v0, v1, v2, u[19], m[10]);+	MONT_MAC(w0, w1, w2, u[20], m[9]);+	MONT_MAC(t0, t1, t2, u[21], m[8]);+	MONT_MAC(v0, v1, v2, u[22], m[7]);+	MONT_MAC(w0, w1, w2, u[23], m[6]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	z[5] = t0;+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 30 */+	MONT_MAC(t0, t1, t2, a[7], b[23]);+	MONT_MUL(v0, v1, v2, a[8], b[22]);+	MONT_MUL(w0, w1, w2, a[9], b[21]);+	MONT_MAC(t0, t1, t2, a[10], b[20]);+	MONT_MAC(v0, v1, v2, a[11], b[19]);+	MONT_MAC(w0, w1, w2, a[12], b[18]);+	MONT_MAC(t0, t1, t2, a[13], b[17]);+	MONT_MAC(v0, v1, v2, a[14], b[16]);+	MONT_MAC(w0, w1, w2, a[15], b[15]);+	MONT_MAC(t0, t1, t2, a[16], b[14]);+	MONT_MAC(v0, v1, v2, a[17], b[13]);+	MONT_MAC(w0, w1, w2, a[18], b[12]);+	MONT_MAC(t0, t1, t2, a[19], b[11]);+	MONT_MAC(v0, v1, v2, a[20], b[10]);+	MONT_MAC(w0, w1, w2, a[21], b[9]);+	MONT_MAC(t0, t1, t2, a[22], b[8]);+	MONT_MAC(v0, v1, v2, a[23], b[7]);+	MONT_MAC(w0, w1, w2, u[7], m[23]);+	MONT_MAC(t0, t1, t2, u[8], m[22]);+	MONT_MAC(v0, v1, v2, u[9], m[21]);+	MONT_MAC(w0, w1, w2, u[10], m[20]);+	MONT_MAC(t0, t1, t2, u[11], m[19]);+	MONT_MAC(v0, v1, v2, u[12], m[18]);+	MONT_MAC(w0, w1, w2, u[13], m[17]);+	MONT_MAC(t0, t1, t2, u[14], m[16]);+	MONT_MAC(v0, v1, v2, u[15], m[15]);+	MONT_MAC(w0, w1, w2, u[16], m[14]);+	MONT_MAC(t0, t1, t2, u[17], m[13]);+	MONT_MAC(v0, v1, v2, u[18], m[12]);+	MONT_MAC(w0, w1, w2, u[19], m[11]);+	MONT_MAC(t0, t1, t2, u[20], m[10]);+	MONT_MAC(v0, v1, v2, u[21], m[9]);+	MONT_MAC(w0, w1, w2, u[22], m[8]);+	MONT_MAC(t0, t1, t2, u[23], m[7]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	z[6] = t0;+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 31 */+	MONT_MAC(t0, t1, t2, a[8], b[23]);+	MONT_MUL(v0, v1, v2, a[9], b[22]);+	MONT_MUL(w0, w1, w2, a[10], b[21]);+	MONT_MAC(t0, t1, t2, a[11], b[20]);+	MONT_MAC(v0, v1, v2, a[12], b[19]);+	MONT_MAC(w0, w1, w2, a[13], b[18]);+	MONT_MAC(t0, t1, t2, a[14], b[17]);+	MONT_MAC(v0, v1, v2, a[15], b[16]);+	MONT_MAC(w0, w1, w2, a[16], b[15]);+	MONT_MAC(t0, t1, t2, a[17], b[14]);+	MONT_MAC(v0, v1, v2, a[18], b[13]);+	MONT_MAC(w0, w1, w2, a[19], b[12]);+	MONT_MAC(t0, t1, t2, a[20], b[11]);+	MONT_MAC(v0, v1, v2, a[21], b[10]);+	MONT_MAC(w0, w1, w2, a[22], b[9]);+	MONT_MAC(t0, t1, t2, a[23], b[8]);+	MONT_MAC(v0, v1, v2, u[8], m[23]);+	MONT_MAC(w0, w1, w2, u[9], m[22]);+	MONT_MAC(t0, t1, t2, u[10], m[21]);+	MONT_MAC(v0, v1, v2, u[11], m[20]);+	MONT_MAC(w0, w1, w2, u[12], m[19]);+	MONT_MAC(t0, t1, t2, u[13], m[18]);+	MONT_MAC(v0, v1, v2, u[14], m[17]);+	MONT_MAC(w0, w1, w2, u[15], m[16]);+	MONT_MAC(t0, t1, t2, u[16], m[15]);+	MONT_MAC(v0, v1, v2, u[17], m[14]);+	MONT_MAC(w0, w1, w2, u[18], m[13]);+	MONT_MAC(t0, t1, t2, u[19], m[12]);+	MONT_MAC(v0, v1, v2, u[20], m[11]);+	MONT_MAC(w0, w1, w2, u[21], m[10]);+	MONT_MAC(t0, t1, t2, u[22], m[9]);+	MONT_MAC(v0, v1, v2, u[23], m[8]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	z[7] = t0;+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 32 */+	MONT_MAC(t0, t1, t2, a[9], b[23]);+	MONT_MUL(v0, v1, v2, a[10], b[22]);+	MONT_MUL(w0, w1, w2, a[11], b[21]);+	MONT_MAC(t0, t1, t2, a[12], b[20]);+	MONT_MAC(v0, v1, v2, a[13], b[19]);+	MONT_MAC(w0, w1, w2, a[14], b[18]);+	MONT_MAC(t0, t1, t2, a[15], b[17]);+	MONT_MAC(v0, v1, v2, a[16], b[16]);+	MONT_MAC(w0, w1, w2, a[17], b[15]);+	MONT_MAC(t0, t1, t2, a[18], b[14]);+	MONT_MAC(v0, v1, v2, a[19], b[13]);+	MONT_MAC(w0, w1, w2, a[20], b[12]);+	MONT_MAC(t0, t1, t2, a[21], b[11]);+	MONT_MAC(v0, v1, v2, a[22], b[10]);+	MONT_MAC(w0, w1, w2, a[23], b[9]);+	MONT_MAC(t0, t1, t2, u[9], m[23]);+	MONT_MAC(v0, v1, v2, u[10], m[22]);+	MONT_MAC(w0, w1, w2, u[11], m[21]);+	MONT_MAC(t0, t1, t2, u[12], m[20]);+	MONT_MAC(v0, v1, v2, u[13], m[19]);+	MONT_MAC(w0, w1, w2, u[14], m[18]);+	MONT_MAC(t0, t1, t2, u[15], m[17]);+	MONT_MAC(v0, v1, v2, u[16], m[16]);+	MONT_MAC(w0, w1, w2, u[17], m[15]);+	MONT_MAC(t0, t1, t2, u[18], m[14]);+	MONT_MAC(v0, v1, v2, u[19], m[13]);+	MONT_MAC(w0, w1, w2, u[20], m[12]);+	MONT_MAC(t0, t1, t2, u[21], m[11]);+	MONT_MAC(v0, v1, v2, u[22], m[10]);+	MONT_MAC(w0, w1, w2, u[23], m[9]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	z[8] = t0;+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 33 */+	MONT_MAC(t0, t1, t2, a[10], b[23]);+	MONT_MUL(v0, v1, v2, a[11], b[22]);+	MONT_MUL(w0, w1, w2, a[12], b[21]);+	MONT_MAC(t0, t1, t2, a[13], b[20]);+	MONT_MAC(v0, v1, v2, a[14], b[19]);+	MONT_MAC(w0, w1, w2, a[15], b[18]);+	MONT_MAC(t0, t1, t2, a[16], b[17]);+	MONT_MAC(v0, v1, v2, a[17], b[16]);+	MONT_MAC(w0, w1, w2, a[18], b[15]);+	MONT_MAC(t0, t1, t2, a[19], b[14]);+	MONT_MAC(v0, v1, v2, a[20], b[13]);+	MONT_MAC(w0, w1, w2, a[21], b[12]);+	MONT_MAC(t0, t1, t2, a[22], b[11]);+	MONT_MAC(v0, v1, v2, a[23], b[10]);+	MONT_MAC(w0, w1, w2, u[10], m[23]);+	MONT_MAC(t0, t1, t2, u[11], m[22]);+	MONT_MAC(v0, v1, v2, u[12], m[21]);+	MONT_MAC(w0, w1, w2, u[13], m[20]);+	MONT_MAC(t0, t1, t2, u[14], m[19]);+	MONT_MAC(v0, v1, v2, u[15], m[18]);+	MONT_MAC(w0, w1, w2, u[16], m[17]);+	MONT_MAC(t0, t1, t2, u[17], m[16]);+	MONT_MAC(v0, v1, v2, u[18], m[15]);+	MONT_MAC(w0, w1, w2, u[19], m[14]);+	MONT_MAC(t0, t1, t2, u[20], m[13]);+	MONT_MAC(v0, v1, v2, u[21], m[12]);+	MONT_MAC(w0, w1, w2, u[22], m[11]);+	MONT_MAC(t0, t1, t2, u[23], m[10]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	z[9] = t0;+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 34 */+	MONT_MAC(t0, t1, t2, a[11], b[23]);+	MONT_MUL(v0, v1, v2, a[12], b[22]);+	MONT_MUL(w0, w1, w2, a[13], b[21]);+	MONT_MAC(t0, t1, t2, a[14], b[20]);+	MONT_MAC(v0, v1, v2, a[15], b[19]);+	MONT_MAC(w0, w1, w2, a[16], b[18]);+	MONT_MAC(t0, t1, t2, a[17], b[17]);+	MONT_MAC(v0, v1, v2, a[18], b[16]);+	MONT_MAC(w0, w1, w2, a[19], b[15]);+	MONT_MAC(t0, t1, t2, a[20], b[14]);+	MONT_MAC(v0, v1, v2, a[21], b[13]);+	MONT_MAC(w0, w1, w2, a[22], b[12]);+	MONT_MAC(t0, t1, t2, a[23], b[11]);+	MONT_MAC(v0, v1, v2, u[11], m[23]);+	MONT_MAC(w0, w1, w2, u[12], m[22]);+	MONT_MAC(t0, t1, t2, u[13], m[21]);+	MONT_MAC(v0, v1, v2, u[14], m[20]);+	MONT_MAC(w0, w1, w2, u[15], m[19]);+	MONT_MAC(t0, t1, t2, u[16], m[18]);+	MONT_MAC(v0, v1, v2, u[17], m[17]);+	MONT_MAC(w0, w1, w2, u[18], m[16]);+	MONT_MAC(t0, t1, t2, u[19], m[15]);+	MONT_MAC(v0, v1, v2, u[20], m[14]);+	MONT_MAC(w0, w1, w2, u[21], m[13]);+	MONT_MAC(t0, t1, t2, u[22], m[12]);+	MONT_MAC(v0, v1, v2, u[23], m[11]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	z[10] = t0;+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 35 */+	MONT_MAC(t0, t1, t2, a[12], b[23]);+	MONT_MUL(v0, v1, v2, a[13], b[22]);+	MONT_MUL(w0, w1, w2, a[14], b[21]);+	MONT_MAC(t0, t1, t2, a[15], b[20]);+	MONT_MAC(v0, v1, v2, a[16], b[19]);+	MONT_MAC(w0, w1, w2, a[17], b[18]);+	MONT_MAC(t0, t1, t2, a[18], b[17]);+	MONT_MAC(v0, v1, v2, a[19], b[16]);+	MONT_MAC(w0, w1, w2, a[20], b[15]);+	MONT_MAC(t0, t1, t2, a[21], b[14]);+	MONT_MAC(v0, v1, v2, a[22], b[13]);+	MONT_MAC(w0, w1, w2, a[23], b[12]);+	MONT_MAC(t0, t1, t2, u[12], m[23]);+	MONT_MAC(v0, v1, v2, u[13], m[22]);+	MONT_MAC(w0, w1, w2, u[14], m[21]);+	MONT_MAC(t0, t1, t2, u[15], m[20]);+	MONT_MAC(v0, v1, v2, u[16], m[19]);+	MONT_MAC(w0, w1, w2, u[17], m[18]);+	MONT_MAC(t0, t1, t2, u[18], m[17]);+	MONT_MAC(v0, v1, v2, u[19], m[16]);+	MONT_MAC(w0, w1, w2, u[20], m[15]);+	MONT_MAC(t0, t1, t2, u[21], m[14]);+	MONT_MAC(v0, v1, v2, u[22], m[13]);+	MONT_MAC(w0, w1, w2, u[23], m[12]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	z[11] = t0;+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 36 */+	MONT_MAC(t0, t1, t2, a[13], b[23]);+	MONT_MUL(v0, v1, v2, a[14], b[22]);+	MONT_MUL(w0, w1, w2, a[15], b[21]);+	MONT_MAC(t0, t1, t2, a[16], b[20]);+	MONT_MAC(v0, v1, v2, a[17], b[19]);+	MONT_MAC(w0, w1, w2, a[18], b[18]);+	MONT_MAC(t0, t1, t2, a[19], b[17]);+	MONT_MAC(v0, v1, v2, a[20], b[16]);+	MONT_MAC(w0, w1, w2, a[21], b[15]);+	MONT_MAC(t0, t1, t2, a[22], b[14]);+	MONT_MAC(v0, v1, v2, a[23], b[13]);+	MONT_MAC(w0, w1, w2, u[13], m[23]);+	MONT_MAC(t0, t1, t2, u[14], m[22]);+	MONT_MAC(v0, v1, v2, u[15], m[21]);+	MONT_MAC(w0, w1, w2, u[16], m[20]);+	MONT_MAC(t0, t1, t2, u[17], m[19]);+	MONT_MAC(v0, v1, v2, u[18], m[18]);+	MONT_MAC(w0, w1, w2, u[19], m[17]);+	MONT_MAC(t0, t1, t2, u[20], m[16]);+	MONT_MAC(v0, v1, v2, u[21], m[15]);+	MONT_MAC(w0, w1, w2, u[22], m[14]);+	MONT_MAC(t0, t1, t2, u[23], m[13]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	z[12] = t0;+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 37 */+	MONT_MAC(t0, t1, t2, a[14], b[23]);+	MONT_MUL(v0, v1, v2, a[15], b[22]);+	MONT_MUL(w0, w1, w2, a[16], b[21]);+	MONT_MAC(t0, t1, t2, a[17], b[20]);+	MONT_MAC(v0, v1, v2, a[18], b[19]);+	MONT_MAC(w0, w1, w2, a[19], b[18]);+	MONT_MAC(t0, t1, t2, a[20], b[17]);+	MONT_MAC(v0, v1, v2, a[21], b[16]);+	MONT_MAC(w0, w1, w2, a[22], b[15]);+	MONT_MAC(t0, t1, t2, a[23], b[14]);+	MONT_MAC(v0, v1, v2, u[14], m[23]);+	MONT_MAC(w0, w1, w2, u[15], m[22]);+	MONT_MAC(t0, t1, t2, u[16], m[21]);+	MONT_MAC(v0, v1, v2, u[17], m[20]);+	MONT_MAC(w0, w1, w2, u[18], m[19]);+	MONT_MAC(t0, t1, t2, u[19], m[18]);+	MONT_MAC(v0, v1, v2, u[20], m[17]);+	MONT_MAC(w0, w1, w2, u[21], m[16]);+	MONT_MAC(t0, t1, t2, u[22], m[15]);+	MONT_MAC(v0, v1, v2, u[23], m[14]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	z[13] = t0;+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 38 */+	MONT_MAC(t0, t1, t2, a[15], b[23]);+	MONT_MUL(v0, v1, v2, a[16], b[22]);+	MONT_MUL(w0, w1, w2, a[17], b[21]);+	MONT_MAC(t0, t1, t2, a[18], b[20]);+	MONT_MAC(v0, v1, v2, a[19], b[19]);+	MONT_MAC(w0, w1, w2, a[20], b[18]);+	MONT_MAC(t0, t1, t2, a[21], b[17]);+	MONT_MAC(v0, v1, v2, a[22], b[16]);+	MONT_MAC(w0, w1, w2, a[23], b[15]);+	MONT_MAC(t0, t1, t2, u[15], m[23]);+	MONT_MAC(v0, v1, v2, u[16], m[22]);+	MONT_MAC(w0, w1, w2, u[17], m[21]);+	MONT_MAC(t0, t1, t2, u[18], m[20]);+	MONT_MAC(v0, v1, v2, u[19], m[19]);+	MONT_MAC(w0, w1, w2, u[20], m[18]);+	MONT_MAC(t0, t1, t2, u[21], m[17]);+	MONT_MAC(v0, v1, v2, u[22], m[16]);+	MONT_MAC(w0, w1, w2, u[23], m[15]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	z[14] = t0;+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 39 */+	MONT_MAC(t0, t1, t2, a[16], b[23]);+	MONT_MUL(v0, v1, v2, a[17], b[22]);+	MONT_MUL(w0, w1, w2, a[18], b[21]);+	MONT_MAC(t0, t1, t2, a[19], b[20]);+	MONT_MAC(v0, v1, v2, a[20], b[19]);+	MONT_MAC(w0, w1, w2, a[21], b[18]);+	MONT_MAC(t0, t1, t2, a[22], b[17]);+	MONT_MAC(v0, v1, v2, a[23], b[16]);+	MONT_MAC(w0, w1, w2, u[16], m[23]);+	MONT_MAC(t0, t1, t2, u[17], m[22]);+	MONT_MAC(v0, v1, v2, u[18], m[21]);+	MONT_MAC(w0, w1, w2, u[19], m[20]);+	MONT_MAC(t0, t1, t2, u[20], m[19]);+	MONT_MAC(v0, v1, v2, u[21], m[18]);+	MONT_MAC(w0, w1, w2, u[22], m[17]);+	MONT_MAC(t0, t1, t2, u[23], m[16]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	z[15] = t0;+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 40 */+	MONT_MAC(t0, t1, t2, a[17], b[23]);+	MONT_MUL(v0, v1, v2, a[18], b[22]);+	MONT_MUL(w0, w1, w2, a[19], b[21]);+	MONT_MAC(t0, t1, t2, a[20], b[20]);+	MONT_MAC(v0, v1, v2, a[21], b[19]);+	MONT_MAC(w0, w1, w2, a[22], b[18]);+	MONT_MAC(t0, t1, t2, a[23], b[17]);+	MONT_MAC(v0, v1, v2, u[17], m[23]);+	MONT_MAC(w0, w1, w2, u[18], m[22]);+	MONT_MAC(t0, t1, t2, u[19], m[21]);+	MONT_MAC(v0, v1, v2, u[20], m[20]);+	MONT_MAC(w0, w1, w2, u[21], m[19]);+	MONT_MAC(t0, t1, t2, u[22], m[18]);+	MONT_MAC(v0, v1, v2, u[23], m[17]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	z[16] = t0;+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 41 */+	MONT_MAC(t0, t1, t2, a[18], b[23]);+	MONT_MUL(v0, v1, v2, a[19], b[22]);+	MONT_MUL(w0, w1, w2, a[20], b[21]);+	MONT_MAC(t0, t1, t2, a[21], b[20]);+	MONT_MAC(v0, v1, v2, a[22], b[19]);+	MONT_MAC(w0, w1, w2, a[23], b[18]);+	MONT_MAC(t0, t1, t2, u[18], m[23]);+	MONT_MAC(v0, v1, v2, u[19], m[22]);+	MONT_MAC(w0, w1, w2, u[20], m[21]);+	MONT_MAC(t0, t1, t2, u[21], m[20]);+	MONT_MAC(v0, v1, v2, u[22], m[19]);+	MONT_MAC(w0, w1, w2, u[23], m[18]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	z[17] = t0;+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 42 */+	MONT_MAC(t0, t1, t2, a[19], b[23]);+	MONT_MUL(v0, v1, v2, a[20], b[22]);+	MONT_MUL(w0, w1, w2, a[21], b[21]);+	MONT_MAC(t0, t1, t2, a[22], b[20]);+	MONT_MAC(v0, v1, v2, a[23], b[19]);+	MONT_MAC(w0, w1, w2, u[19], m[23]);+	MONT_MAC(t0, t1, t2, u[20], m[22]);+	MONT_MAC(v0, v1, v2, u[21], m[21]);+	MONT_MAC(w0, w1, w2, u[22], m[20]);+	MONT_MAC(t0, t1, t2, u[23], m[19]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	z[18] = t0;+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 43 */+	MONT_MAC(t0, t1, t2, a[20], b[23]);+	MONT_MUL(v0, v1, v2, a[21], b[22]);+	MONT_MUL(w0, w1, w2, a[22], b[21]);+	MONT_MAC(t0, t1, t2, a[23], b[20]);+	MONT_MAC(v0, v1, v2, u[20], m[23]);+	MONT_MAC(w0, w1, w2, u[21], m[22]);+	MONT_MAC(t0, t1, t2, u[22], m[21]);+	MONT_MAC(v0, v1, v2, u[23], m[20]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	z[19] = t0;+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 44 */+	MONT_MAC(t0, t1, t2, a[21], b[23]);+	MONT_MUL(v0, v1, v2, a[22], b[22]);+	MONT_MUL(w0, w1, w2, a[23], b[21]);+	MONT_MAC(t0, t1, t2, u[21], m[23]);+	MONT_MAC(v0, v1, v2, u[22], m[22]);+	MONT_MAC(w0, w1, w2, u[23], m[21]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	z[20] = t0;+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 45 */+	MONT_MAC(t0, t1, t2, a[22], b[23]);+	MONT_MUL(v0, v1, v2, a[23], b[22]);+	MONT_MUL(w0, w1, w2, u[22], m[23]);+	MONT_MAC(t0, t1, t2, u[23], m[22]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	z[21] = t0;+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 46 */+	MONT_MAC(t0, t1, t2, a[23], b[23]);+	MONT_MUL(v0, v1, v2, u[23], m[23]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	z[22] = t0;+	t0 = t1;+	t1 = t2;+	t2 = 0;+	z[23] = t0;++	/* under 2m, with t1 the bit above n limbs: at most one subtraction */+	borrow = sub_n(r, z, m, 24);+	take = t1 | (borrow ^ 1);+	select_n(r, r, z, take & 1, 24);+}++/* r = a * a * R^-1 mod m, for a under m; t is 2n limbs of scratch */+static void crypton_mont_sqr24(limb_t *r, const limb_t *a,+                               const limb_t *m, limb_t n0, limb_t *t)+{+	limb_t *u = t, *z = t + 24;+	limb_t t0 = 0, t1 = 0, t2 = 0, v0, v1, v2, w0, w1, w2, borrow, take;+	limb_t s0, s1, s2, c0, c1, c2;++	/* column 0 */+	MONT_MAC(t0, t1, t2, a[0], a[0]);+	u[0] = t0 * n0;+	MONT_MAC(t0, t1, t2, u[0], m[0]);+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 1 */+	MONT_MUL(s0, s1, s2, a[0], a[1]);+	MONT_MAC(t0, t1, t2, u[0], m[1]);+	MONT_DBL(s0, s1, s2);+	MONT_ADD(t0, t1, t2, s0, s1, s2);+	u[1] = t0 * n0;+	MONT_MAC(t0, t1, t2, u[1], m[0]);+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 2 */+	MONT_MUL(s0, s1, s2, a[0], a[2]);+	MONT_MAC(t0, t1, t2, a[1], a[1]);+	MONT_MUL(v0, v1, v2, u[0], m[2]);+	MONT_MUL(w0, w1, w2, u[1], m[1]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	MONT_DBL(s0, s1, s2);+	MONT_ADD(t0, t1, t2, s0, s1, s2);+	u[2] = t0 * n0;+	MONT_MAC(t0, t1, t2, u[2], m[0]);+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 3 */+	MONT_MUL(s0, s1, s2, a[0], a[3]);+	MONT_MUL(c0, c1, c2, a[1], a[2]);+	MONT_MAC(t0, t1, t2, u[0], m[3]);+	MONT_MUL(v0, v1, v2, u[1], m[2]);+	MONT_MUL(w0, w1, w2, u[2], m[1]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	MONT_ADD(s0, s1, s2, c0, c1, c2);+	MONT_DBL(s0, s1, s2);+	MONT_ADD(t0, t1, t2, s0, s1, s2);+	u[3] = t0 * n0;+	MONT_MAC(t0, t1, t2, u[3], m[0]);+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 4 */+	MONT_MUL(s0, s1, s2, a[0], a[4]);+	MONT_MUL(c0, c1, c2, a[1], a[3]);+	MONT_MAC(t0, t1, t2, a[2], a[2]);+	MONT_MUL(v0, v1, v2, u[0], m[4]);+	MONT_MUL(w0, w1, w2, u[1], m[3]);+	MONT_MAC(t0, t1, t2, u[2], m[2]);+	MONT_MAC(v0, v1, v2, u[3], m[1]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	MONT_ADD(s0, s1, s2, c0, c1, c2);+	MONT_DBL(s0, s1, s2);+	MONT_ADD(t0, t1, t2, s0, s1, s2);+	u[4] = t0 * n0;+	MONT_MAC(t0, t1, t2, u[4], m[0]);+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 5 */+	MONT_MUL(s0, s1, s2, a[0], a[5]);+	MONT_MUL(c0, c1, c2, a[1], a[4]);+	MONT_MAC(s0, s1, s2, a[2], a[3]);+	MONT_MAC(t0, t1, t2, u[0], m[5]);+	MONT_MUL(v0, v1, v2, u[1], m[4]);+	MONT_MUL(w0, w1, w2, u[2], m[3]);+	MONT_MAC(t0, t1, t2, u[3], m[2]);+	MONT_MAC(v0, v1, v2, u[4], m[1]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	MONT_ADD(s0, s1, s2, c0, c1, c2);+	MONT_DBL(s0, s1, s2);+	MONT_ADD(t0, t1, t2, s0, s1, s2);+	u[5] = t0 * n0;+	MONT_MAC(t0, t1, t2, u[5], m[0]);+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 6 */+	MONT_MUL(s0, s1, s2, a[0], a[6]);+	MONT_MUL(c0, c1, c2, a[1], a[5]);+	MONT_MAC(s0, s1, s2, a[2], a[4]);+	MONT_MAC(t0, t1, t2, a[3], a[3]);+	MONT_MUL(v0, v1, v2, u[0], m[6]);+	MONT_MUL(w0, w1, w2, u[1], m[5]);+	MONT_MAC(t0, t1, t2, u[2], m[4]);+	MONT_MAC(v0, v1, v2, u[3], m[3]);+	MONT_MAC(w0, w1, w2, u[4], m[2]);+	MONT_MAC(t0, t1, t2, u[5], m[1]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	MONT_ADD(s0, s1, s2, c0, c1, c2);+	MONT_DBL(s0, s1, s2);+	MONT_ADD(t0, t1, t2, s0, s1, s2);+	u[6] = t0 * n0;+	MONT_MAC(t0, t1, t2, u[6], m[0]);+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 7 */+	MONT_MUL(s0, s1, s2, a[0], a[7]);+	MONT_MUL(c0, c1, c2, a[1], a[6]);+	MONT_MAC(s0, s1, s2, a[2], a[5]);+	MONT_MAC(c0, c1, c2, a[3], a[4]);+	MONT_MAC(t0, t1, t2, u[0], m[7]);+	MONT_MUL(v0, v1, v2, u[1], m[6]);+	MONT_MUL(w0, w1, w2, u[2], m[5]);+	MONT_MAC(t0, t1, t2, u[3], m[4]);+	MONT_MAC(v0, v1, v2, u[4], m[3]);+	MONT_MAC(w0, w1, w2, u[5], m[2]);+	MONT_MAC(t0, t1, t2, u[6], m[1]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	MONT_ADD(s0, s1, s2, c0, c1, c2);+	MONT_DBL(s0, s1, s2);+	MONT_ADD(t0, t1, t2, s0, s1, s2);+	u[7] = t0 * n0;+	MONT_MAC(t0, t1, t2, u[7], m[0]);+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 8 */+	MONT_MUL(s0, s1, s2, a[0], a[8]);+	MONT_MUL(c0, c1, c2, a[1], a[7]);+	MONT_MAC(s0, s1, s2, a[2], a[6]);+	MONT_MAC(c0, c1, c2, a[3], a[5]);+	MONT_MAC(t0, t1, t2, a[4], a[4]);+	MONT_MUL(v0, v1, v2, u[0], m[8]);+	MONT_MUL(w0, w1, w2, u[1], m[7]);+	MONT_MAC(t0, t1, t2, u[2], m[6]);+	MONT_MAC(v0, v1, v2, u[3], m[5]);+	MONT_MAC(w0, w1, w2, u[4], m[4]);+	MONT_MAC(t0, t1, t2, u[5], m[3]);+	MONT_MAC(v0, v1, v2, u[6], m[2]);+	MONT_MAC(w0, w1, w2, u[7], m[1]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	MONT_ADD(s0, s1, s2, c0, c1, c2);+	MONT_DBL(s0, s1, s2);+	MONT_ADD(t0, t1, t2, s0, s1, s2);+	u[8] = t0 * n0;+	MONT_MAC(t0, t1, t2, u[8], m[0]);+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 9 */+	MONT_MUL(s0, s1, s2, a[0], a[9]);+	MONT_MUL(c0, c1, c2, a[1], a[8]);+	MONT_MAC(s0, s1, s2, a[2], a[7]);+	MONT_MAC(c0, c1, c2, a[3], a[6]);+	MONT_MAC(s0, s1, s2, a[4], a[5]);+	MONT_MAC(t0, t1, t2, u[0], m[9]);+	MONT_MUL(v0, v1, v2, u[1], m[8]);+	MONT_MUL(w0, w1, w2, u[2], m[7]);+	MONT_MAC(t0, t1, t2, u[3], m[6]);+	MONT_MAC(v0, v1, v2, u[4], m[5]);+	MONT_MAC(w0, w1, w2, u[5], m[4]);+	MONT_MAC(t0, t1, t2, u[6], m[3]);+	MONT_MAC(v0, v1, v2, u[7], m[2]);+	MONT_MAC(w0, w1, w2, u[8], m[1]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	MONT_ADD(s0, s1, s2, c0, c1, c2);+	MONT_DBL(s0, s1, s2);+	MONT_ADD(t0, t1, t2, s0, s1, s2);+	u[9] = t0 * n0;+	MONT_MAC(t0, t1, t2, u[9], m[0]);+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 10 */+	MONT_MUL(s0, s1, s2, a[0], a[10]);+	MONT_MUL(c0, c1, c2, a[1], a[9]);+	MONT_MAC(s0, s1, s2, a[2], a[8]);+	MONT_MAC(c0, c1, c2, a[3], a[7]);+	MONT_MAC(s0, s1, s2, a[4], a[6]);+	MONT_MAC(t0, t1, t2, a[5], a[5]);+	MONT_MUL(v0, v1, v2, u[0], m[10]);+	MONT_MUL(w0, w1, w2, u[1], m[9]);+	MONT_MAC(t0, t1, t2, u[2], m[8]);+	MONT_MAC(v0, v1, v2, u[3], m[7]);+	MONT_MAC(w0, w1, w2, u[4], m[6]);+	MONT_MAC(t0, t1, t2, u[5], m[5]);+	MONT_MAC(v0, v1, v2, u[6], m[4]);+	MONT_MAC(w0, w1, w2, u[7], m[3]);+	MONT_MAC(t0, t1, t2, u[8], m[2]);+	MONT_MAC(v0, v1, v2, u[9], m[1]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	MONT_ADD(s0, s1, s2, c0, c1, c2);+	MONT_DBL(s0, s1, s2);+	MONT_ADD(t0, t1, t2, s0, s1, s2);+	u[10] = t0 * n0;+	MONT_MAC(t0, t1, t2, u[10], m[0]);+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 11 */+	MONT_MUL(s0, s1, s2, a[0], a[11]);+	MONT_MUL(c0, c1, c2, a[1], a[10]);+	MONT_MAC(s0, s1, s2, a[2], a[9]);+	MONT_MAC(c0, c1, c2, a[3], a[8]);+	MONT_MAC(s0, s1, s2, a[4], a[7]);+	MONT_MAC(c0, c1, c2, a[5], a[6]);+	MONT_MAC(t0, t1, t2, u[0], m[11]);+	MONT_MUL(v0, v1, v2, u[1], m[10]);+	MONT_MUL(w0, w1, w2, u[2], m[9]);+	MONT_MAC(t0, t1, t2, u[3], m[8]);+	MONT_MAC(v0, v1, v2, u[4], m[7]);+	MONT_MAC(w0, w1, w2, u[5], m[6]);+	MONT_MAC(t0, t1, t2, u[6], m[5]);+	MONT_MAC(v0, v1, v2, u[7], m[4]);+	MONT_MAC(w0, w1, w2, u[8], m[3]);+	MONT_MAC(t0, t1, t2, u[9], m[2]);+	MONT_MAC(v0, v1, v2, u[10], m[1]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	MONT_ADD(s0, s1, s2, c0, c1, c2);+	MONT_DBL(s0, s1, s2);+	MONT_ADD(t0, t1, t2, s0, s1, s2);+	u[11] = t0 * n0;+	MONT_MAC(t0, t1, t2, u[11], m[0]);+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 12 */+	MONT_MUL(s0, s1, s2, a[0], a[12]);+	MONT_MUL(c0, c1, c2, a[1], a[11]);+	MONT_MAC(s0, s1, s2, a[2], a[10]);+	MONT_MAC(c0, c1, c2, a[3], a[9]);+	MONT_MAC(s0, s1, s2, a[4], a[8]);+	MONT_MAC(c0, c1, c2, a[5], a[7]);+	MONT_MAC(t0, t1, t2, a[6], a[6]);+	MONT_MUL(v0, v1, v2, u[0], m[12]);+	MONT_MUL(w0, w1, w2, u[1], m[11]);+	MONT_MAC(t0, t1, t2, u[2], m[10]);+	MONT_MAC(v0, v1, v2, u[3], m[9]);+	MONT_MAC(w0, w1, w2, u[4], m[8]);+	MONT_MAC(t0, t1, t2, u[5], m[7]);+	MONT_MAC(v0, v1, v2, u[6], m[6]);+	MONT_MAC(w0, w1, w2, u[7], m[5]);+	MONT_MAC(t0, t1, t2, u[8], m[4]);+	MONT_MAC(v0, v1, v2, u[9], m[3]);+	MONT_MAC(w0, w1, w2, u[10], m[2]);+	MONT_MAC(t0, t1, t2, u[11], m[1]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	MONT_ADD(s0, s1, s2, c0, c1, c2);+	MONT_DBL(s0, s1, s2);+	MONT_ADD(t0, t1, t2, s0, s1, s2);+	u[12] = t0 * n0;+	MONT_MAC(t0, t1, t2, u[12], m[0]);+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 13 */+	MONT_MUL(s0, s1, s2, a[0], a[13]);+	MONT_MUL(c0, c1, c2, a[1], a[12]);+	MONT_MAC(s0, s1, s2, a[2], a[11]);+	MONT_MAC(c0, c1, c2, a[3], a[10]);+	MONT_MAC(s0, s1, s2, a[4], a[9]);+	MONT_MAC(c0, c1, c2, a[5], a[8]);+	MONT_MAC(s0, s1, s2, a[6], a[7]);+	MONT_MAC(t0, t1, t2, u[0], m[13]);+	MONT_MUL(v0, v1, v2, u[1], m[12]);+	MONT_MUL(w0, w1, w2, u[2], m[11]);+	MONT_MAC(t0, t1, t2, u[3], m[10]);+	MONT_MAC(v0, v1, v2, u[4], m[9]);+	MONT_MAC(w0, w1, w2, u[5], m[8]);+	MONT_MAC(t0, t1, t2, u[6], m[7]);+	MONT_MAC(v0, v1, v2, u[7], m[6]);+	MONT_MAC(w0, w1, w2, u[8], m[5]);+	MONT_MAC(t0, t1, t2, u[9], m[4]);+	MONT_MAC(v0, v1, v2, u[10], m[3]);+	MONT_MAC(w0, w1, w2, u[11], m[2]);+	MONT_MAC(t0, t1, t2, u[12], m[1]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	MONT_ADD(s0, s1, s2, c0, c1, c2);+	MONT_DBL(s0, s1, s2);+	MONT_ADD(t0, t1, t2, s0, s1, s2);+	u[13] = t0 * n0;+	MONT_MAC(t0, t1, t2, u[13], m[0]);+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 14 */+	MONT_MUL(s0, s1, s2, a[0], a[14]);+	MONT_MUL(c0, c1, c2, a[1], a[13]);+	MONT_MAC(s0, s1, s2, a[2], a[12]);+	MONT_MAC(c0, c1, c2, a[3], a[11]);+	MONT_MAC(s0, s1, s2, a[4], a[10]);+	MONT_MAC(c0, c1, c2, a[5], a[9]);+	MONT_MAC(s0, s1, s2, a[6], a[8]);+	MONT_MAC(t0, t1, t2, a[7], a[7]);+	MONT_MUL(v0, v1, v2, u[0], m[14]);+	MONT_MUL(w0, w1, w2, u[1], m[13]);+	MONT_MAC(t0, t1, t2, u[2], m[12]);+	MONT_MAC(v0, v1, v2, u[3], m[11]);+	MONT_MAC(w0, w1, w2, u[4], m[10]);+	MONT_MAC(t0, t1, t2, u[5], m[9]);+	MONT_MAC(v0, v1, v2, u[6], m[8]);+	MONT_MAC(w0, w1, w2, u[7], m[7]);+	MONT_MAC(t0, t1, t2, u[8], m[6]);+	MONT_MAC(v0, v1, v2, u[9], m[5]);+	MONT_MAC(w0, w1, w2, u[10], m[4]);+	MONT_MAC(t0, t1, t2, u[11], m[3]);+	MONT_MAC(v0, v1, v2, u[12], m[2]);+	MONT_MAC(w0, w1, w2, u[13], m[1]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	MONT_ADD(s0, s1, s2, c0, c1, c2);+	MONT_DBL(s0, s1, s2);+	MONT_ADD(t0, t1, t2, s0, s1, s2);+	u[14] = t0 * n0;+	MONT_MAC(t0, t1, t2, u[14], m[0]);+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 15 */+	MONT_MUL(s0, s1, s2, a[0], a[15]);+	MONT_MUL(c0, c1, c2, a[1], a[14]);+	MONT_MAC(s0, s1, s2, a[2], a[13]);+	MONT_MAC(c0, c1, c2, a[3], a[12]);+	MONT_MAC(s0, s1, s2, a[4], a[11]);+	MONT_MAC(c0, c1, c2, a[5], a[10]);+	MONT_MAC(s0, s1, s2, a[6], a[9]);+	MONT_MAC(c0, c1, c2, a[7], a[8]);+	MONT_MAC(t0, t1, t2, u[0], m[15]);+	MONT_MUL(v0, v1, v2, u[1], m[14]);+	MONT_MUL(w0, w1, w2, u[2], m[13]);+	MONT_MAC(t0, t1, t2, u[3], m[12]);+	MONT_MAC(v0, v1, v2, u[4], m[11]);+	MONT_MAC(w0, w1, w2, u[5], m[10]);+	MONT_MAC(t0, t1, t2, u[6], m[9]);+	MONT_MAC(v0, v1, v2, u[7], m[8]);+	MONT_MAC(w0, w1, w2, u[8], m[7]);+	MONT_MAC(t0, t1, t2, u[9], m[6]);+	MONT_MAC(v0, v1, v2, u[10], m[5]);+	MONT_MAC(w0, w1, w2, u[11], m[4]);+	MONT_MAC(t0, t1, t2, u[12], m[3]);+	MONT_MAC(v0, v1, v2, u[13], m[2]);+	MONT_MAC(w0, w1, w2, u[14], m[1]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	MONT_ADD(s0, s1, s2, c0, c1, c2);+	MONT_DBL(s0, s1, s2);+	MONT_ADD(t0, t1, t2, s0, s1, s2);+	u[15] = t0 * n0;+	MONT_MAC(t0, t1, t2, u[15], m[0]);+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 16 */+	MONT_MUL(s0, s1, s2, a[0], a[16]);+	MONT_MUL(c0, c1, c2, a[1], a[15]);+	MONT_MAC(s0, s1, s2, a[2], a[14]);+	MONT_MAC(c0, c1, c2, a[3], a[13]);+	MONT_MAC(s0, s1, s2, a[4], a[12]);+	MONT_MAC(c0, c1, c2, a[5], a[11]);+	MONT_MAC(s0, s1, s2, a[6], a[10]);+	MONT_MAC(c0, c1, c2, a[7], a[9]);+	MONT_MAC(t0, t1, t2, a[8], a[8]);+	MONT_MUL(v0, v1, v2, u[0], m[16]);+	MONT_MUL(w0, w1, w2, u[1], m[15]);+	MONT_MAC(t0, t1, t2, u[2], m[14]);+	MONT_MAC(v0, v1, v2, u[3], m[13]);+	MONT_MAC(w0, w1, w2, u[4], m[12]);+	MONT_MAC(t0, t1, t2, u[5], m[11]);+	MONT_MAC(v0, v1, v2, u[6], m[10]);+	MONT_MAC(w0, w1, w2, u[7], m[9]);+	MONT_MAC(t0, t1, t2, u[8], m[8]);+	MONT_MAC(v0, v1, v2, u[9], m[7]);+	MONT_MAC(w0, w1, w2, u[10], m[6]);+	MONT_MAC(t0, t1, t2, u[11], m[5]);+	MONT_MAC(v0, v1, v2, u[12], m[4]);+	MONT_MAC(w0, w1, w2, u[13], m[3]);+	MONT_MAC(t0, t1, t2, u[14], m[2]);+	MONT_MAC(v0, v1, v2, u[15], m[1]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	MONT_ADD(s0, s1, s2, c0, c1, c2);+	MONT_DBL(s0, s1, s2);+	MONT_ADD(t0, t1, t2, s0, s1, s2);+	u[16] = t0 * n0;+	MONT_MAC(t0, t1, t2, u[16], m[0]);+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 17 */+	MONT_MUL(s0, s1, s2, a[0], a[17]);+	MONT_MUL(c0, c1, c2, a[1], a[16]);+	MONT_MAC(s0, s1, s2, a[2], a[15]);+	MONT_MAC(c0, c1, c2, a[3], a[14]);+	MONT_MAC(s0, s1, s2, a[4], a[13]);+	MONT_MAC(c0, c1, c2, a[5], a[12]);+	MONT_MAC(s0, s1, s2, a[6], a[11]);+	MONT_MAC(c0, c1, c2, a[7], a[10]);+	MONT_MAC(s0, s1, s2, a[8], a[9]);+	MONT_MAC(t0, t1, t2, u[0], m[17]);+	MONT_MUL(v0, v1, v2, u[1], m[16]);+	MONT_MUL(w0, w1, w2, u[2], m[15]);+	MONT_MAC(t0, t1, t2, u[3], m[14]);+	MONT_MAC(v0, v1, v2, u[4], m[13]);+	MONT_MAC(w0, w1, w2, u[5], m[12]);+	MONT_MAC(t0, t1, t2, u[6], m[11]);+	MONT_MAC(v0, v1, v2, u[7], m[10]);+	MONT_MAC(w0, w1, w2, u[8], m[9]);+	MONT_MAC(t0, t1, t2, u[9], m[8]);+	MONT_MAC(v0, v1, v2, u[10], m[7]);+	MONT_MAC(w0, w1, w2, u[11], m[6]);+	MONT_MAC(t0, t1, t2, u[12], m[5]);+	MONT_MAC(v0, v1, v2, u[13], m[4]);+	MONT_MAC(w0, w1, w2, u[14], m[3]);+	MONT_MAC(t0, t1, t2, u[15], m[2]);+	MONT_MAC(v0, v1, v2, u[16], m[1]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	MONT_ADD(s0, s1, s2, c0, c1, c2);+	MONT_DBL(s0, s1, s2);+	MONT_ADD(t0, t1, t2, s0, s1, s2);+	u[17] = t0 * n0;+	MONT_MAC(t0, t1, t2, u[17], m[0]);+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 18 */+	MONT_MUL(s0, s1, s2, a[0], a[18]);+	MONT_MUL(c0, c1, c2, a[1], a[17]);+	MONT_MAC(s0, s1, s2, a[2], a[16]);+	MONT_MAC(c0, c1, c2, a[3], a[15]);+	MONT_MAC(s0, s1, s2, a[4], a[14]);+	MONT_MAC(c0, c1, c2, a[5], a[13]);+	MONT_MAC(s0, s1, s2, a[6], a[12]);+	MONT_MAC(c0, c1, c2, a[7], a[11]);+	MONT_MAC(s0, s1, s2, a[8], a[10]);+	MONT_MAC(t0, t1, t2, a[9], a[9]);+	MONT_MUL(v0, v1, v2, u[0], m[18]);+	MONT_MUL(w0, w1, w2, u[1], m[17]);+	MONT_MAC(t0, t1, t2, u[2], m[16]);+	MONT_MAC(v0, v1, v2, u[3], m[15]);+	MONT_MAC(w0, w1, w2, u[4], m[14]);+	MONT_MAC(t0, t1, t2, u[5], m[13]);+	MONT_MAC(v0, v1, v2, u[6], m[12]);+	MONT_MAC(w0, w1, w2, u[7], m[11]);+	MONT_MAC(t0, t1, t2, u[8], m[10]);+	MONT_MAC(v0, v1, v2, u[9], m[9]);+	MONT_MAC(w0, w1, w2, u[10], m[8]);+	MONT_MAC(t0, t1, t2, u[11], m[7]);+	MONT_MAC(v0, v1, v2, u[12], m[6]);+	MONT_MAC(w0, w1, w2, u[13], m[5]);+	MONT_MAC(t0, t1, t2, u[14], m[4]);+	MONT_MAC(v0, v1, v2, u[15], m[3]);+	MONT_MAC(w0, w1, w2, u[16], m[2]);+	MONT_MAC(t0, t1, t2, u[17], m[1]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	MONT_ADD(s0, s1, s2, c0, c1, c2);+	MONT_DBL(s0, s1, s2);+	MONT_ADD(t0, t1, t2, s0, s1, s2);+	u[18] = t0 * n0;+	MONT_MAC(t0, t1, t2, u[18], m[0]);+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 19 */+	MONT_MUL(s0, s1, s2, a[0], a[19]);+	MONT_MUL(c0, c1, c2, a[1], a[18]);+	MONT_MAC(s0, s1, s2, a[2], a[17]);+	MONT_MAC(c0, c1, c2, a[3], a[16]);+	MONT_MAC(s0, s1, s2, a[4], a[15]);+	MONT_MAC(c0, c1, c2, a[5], a[14]);+	MONT_MAC(s0, s1, s2, a[6], a[13]);+	MONT_MAC(c0, c1, c2, a[7], a[12]);+	MONT_MAC(s0, s1, s2, a[8], a[11]);+	MONT_MAC(c0, c1, c2, a[9], a[10]);+	MONT_MAC(t0, t1, t2, u[0], m[19]);+	MONT_MUL(v0, v1, v2, u[1], m[18]);+	MONT_MUL(w0, w1, w2, u[2], m[17]);+	MONT_MAC(t0, t1, t2, u[3], m[16]);+	MONT_MAC(v0, v1, v2, u[4], m[15]);+	MONT_MAC(w0, w1, w2, u[5], m[14]);+	MONT_MAC(t0, t1, t2, u[6], m[13]);+	MONT_MAC(v0, v1, v2, u[7], m[12]);+	MONT_MAC(w0, w1, w2, u[8], m[11]);+	MONT_MAC(t0, t1, t2, u[9], m[10]);+	MONT_MAC(v0, v1, v2, u[10], m[9]);+	MONT_MAC(w0, w1, w2, u[11], m[8]);+	MONT_MAC(t0, t1, t2, u[12], m[7]);+	MONT_MAC(v0, v1, v2, u[13], m[6]);+	MONT_MAC(w0, w1, w2, u[14], m[5]);+	MONT_MAC(t0, t1, t2, u[15], m[4]);+	MONT_MAC(v0, v1, v2, u[16], m[3]);+	MONT_MAC(w0, w1, w2, u[17], m[2]);+	MONT_MAC(t0, t1, t2, u[18], m[1]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	MONT_ADD(s0, s1, s2, c0, c1, c2);+	MONT_DBL(s0, s1, s2);+	MONT_ADD(t0, t1, t2, s0, s1, s2);+	u[19] = t0 * n0;+	MONT_MAC(t0, t1, t2, u[19], m[0]);+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 20 */+	MONT_MUL(s0, s1, s2, a[0], a[20]);+	MONT_MUL(c0, c1, c2, a[1], a[19]);+	MONT_MAC(s0, s1, s2, a[2], a[18]);+	MONT_MAC(c0, c1, c2, a[3], a[17]);+	MONT_MAC(s0, s1, s2, a[4], a[16]);+	MONT_MAC(c0, c1, c2, a[5], a[15]);+	MONT_MAC(s0, s1, s2, a[6], a[14]);+	MONT_MAC(c0, c1, c2, a[7], a[13]);+	MONT_MAC(s0, s1, s2, a[8], a[12]);+	MONT_MAC(c0, c1, c2, a[9], a[11]);+	MONT_MAC(t0, t1, t2, a[10], a[10]);+	MONT_MUL(v0, v1, v2, u[0], m[20]);+	MONT_MUL(w0, w1, w2, u[1], m[19]);+	MONT_MAC(t0, t1, t2, u[2], m[18]);+	MONT_MAC(v0, v1, v2, u[3], m[17]);+	MONT_MAC(w0, w1, w2, u[4], m[16]);+	MONT_MAC(t0, t1, t2, u[5], m[15]);+	MONT_MAC(v0, v1, v2, u[6], m[14]);+	MONT_MAC(w0, w1, w2, u[7], m[13]);+	MONT_MAC(t0, t1, t2, u[8], m[12]);+	MONT_MAC(v0, v1, v2, u[9], m[11]);+	MONT_MAC(w0, w1, w2, u[10], m[10]);+	MONT_MAC(t0, t1, t2, u[11], m[9]);+	MONT_MAC(v0, v1, v2, u[12], m[8]);+	MONT_MAC(w0, w1, w2, u[13], m[7]);+	MONT_MAC(t0, t1, t2, u[14], m[6]);+	MONT_MAC(v0, v1, v2, u[15], m[5]);+	MONT_MAC(w0, w1, w2, u[16], m[4]);+	MONT_MAC(t0, t1, t2, u[17], m[3]);+	MONT_MAC(v0, v1, v2, u[18], m[2]);+	MONT_MAC(w0, w1, w2, u[19], m[1]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	MONT_ADD(s0, s1, s2, c0, c1, c2);+	MONT_DBL(s0, s1, s2);+	MONT_ADD(t0, t1, t2, s0, s1, s2);+	u[20] = t0 * n0;+	MONT_MAC(t0, t1, t2, u[20], m[0]);+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 21 */+	MONT_MUL(s0, s1, s2, a[0], a[21]);+	MONT_MUL(c0, c1, c2, a[1], a[20]);+	MONT_MAC(s0, s1, s2, a[2], a[19]);+	MONT_MAC(c0, c1, c2, a[3], a[18]);+	MONT_MAC(s0, s1, s2, a[4], a[17]);+	MONT_MAC(c0, c1, c2, a[5], a[16]);+	MONT_MAC(s0, s1, s2, a[6], a[15]);+	MONT_MAC(c0, c1, c2, a[7], a[14]);+	MONT_MAC(s0, s1, s2, a[8], a[13]);+	MONT_MAC(c0, c1, c2, a[9], a[12]);+	MONT_MAC(s0, s1, s2, a[10], a[11]);+	MONT_MAC(t0, t1, t2, u[0], m[21]);+	MONT_MUL(v0, v1, v2, u[1], m[20]);+	MONT_MUL(w0, w1, w2, u[2], m[19]);+	MONT_MAC(t0, t1, t2, u[3], m[18]);+	MONT_MAC(v0, v1, v2, u[4], m[17]);+	MONT_MAC(w0, w1, w2, u[5], m[16]);+	MONT_MAC(t0, t1, t2, u[6], m[15]);+	MONT_MAC(v0, v1, v2, u[7], m[14]);+	MONT_MAC(w0, w1, w2, u[8], m[13]);+	MONT_MAC(t0, t1, t2, u[9], m[12]);+	MONT_MAC(v0, v1, v2, u[10], m[11]);+	MONT_MAC(w0, w1, w2, u[11], m[10]);+	MONT_MAC(t0, t1, t2, u[12], m[9]);+	MONT_MAC(v0, v1, v2, u[13], m[8]);+	MONT_MAC(w0, w1, w2, u[14], m[7]);+	MONT_MAC(t0, t1, t2, u[15], m[6]);+	MONT_MAC(v0, v1, v2, u[16], m[5]);+	MONT_MAC(w0, w1, w2, u[17], m[4]);+	MONT_MAC(t0, t1, t2, u[18], m[3]);+	MONT_MAC(v0, v1, v2, u[19], m[2]);+	MONT_MAC(w0, w1, w2, u[20], m[1]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	MONT_ADD(s0, s1, s2, c0, c1, c2);+	MONT_DBL(s0, s1, s2);+	MONT_ADD(t0, t1, t2, s0, s1, s2);+	u[21] = t0 * n0;+	MONT_MAC(t0, t1, t2, u[21], m[0]);+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 22 */+	MONT_MUL(s0, s1, s2, a[0], a[22]);+	MONT_MUL(c0, c1, c2, a[1], a[21]);+	MONT_MAC(s0, s1, s2, a[2], a[20]);+	MONT_MAC(c0, c1, c2, a[3], a[19]);+	MONT_MAC(s0, s1, s2, a[4], a[18]);+	MONT_MAC(c0, c1, c2, a[5], a[17]);+	MONT_MAC(s0, s1, s2, a[6], a[16]);+	MONT_MAC(c0, c1, c2, a[7], a[15]);+	MONT_MAC(s0, s1, s2, a[8], a[14]);+	MONT_MAC(c0, c1, c2, a[9], a[13]);+	MONT_MAC(s0, s1, s2, a[10], a[12]);+	MONT_MAC(t0, t1, t2, a[11], a[11]);+	MONT_MUL(v0, v1, v2, u[0], m[22]);+	MONT_MUL(w0, w1, w2, u[1], m[21]);+	MONT_MAC(t0, t1, t2, u[2], m[20]);+	MONT_MAC(v0, v1, v2, u[3], m[19]);+	MONT_MAC(w0, w1, w2, u[4], m[18]);+	MONT_MAC(t0, t1, t2, u[5], m[17]);+	MONT_MAC(v0, v1, v2, u[6], m[16]);+	MONT_MAC(w0, w1, w2, u[7], m[15]);+	MONT_MAC(t0, t1, t2, u[8], m[14]);+	MONT_MAC(v0, v1, v2, u[9], m[13]);+	MONT_MAC(w0, w1, w2, u[10], m[12]);+	MONT_MAC(t0, t1, t2, u[11], m[11]);+	MONT_MAC(v0, v1, v2, u[12], m[10]);+	MONT_MAC(w0, w1, w2, u[13], m[9]);+	MONT_MAC(t0, t1, t2, u[14], m[8]);+	MONT_MAC(v0, v1, v2, u[15], m[7]);+	MONT_MAC(w0, w1, w2, u[16], m[6]);+	MONT_MAC(t0, t1, t2, u[17], m[5]);+	MONT_MAC(v0, v1, v2, u[18], m[4]);+	MONT_MAC(w0, w1, w2, u[19], m[3]);+	MONT_MAC(t0, t1, t2, u[20], m[2]);+	MONT_MAC(v0, v1, v2, u[21], m[1]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	MONT_ADD(s0, s1, s2, c0, c1, c2);+	MONT_DBL(s0, s1, s2);+	MONT_ADD(t0, t1, t2, s0, s1, s2);+	u[22] = t0 * n0;+	MONT_MAC(t0, t1, t2, u[22], m[0]);+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 23 */+	MONT_MUL(s0, s1, s2, a[0], a[23]);+	MONT_MUL(c0, c1, c2, a[1], a[22]);+	MONT_MAC(s0, s1, s2, a[2], a[21]);+	MONT_MAC(c0, c1, c2, a[3], a[20]);+	MONT_MAC(s0, s1, s2, a[4], a[19]);+	MONT_MAC(c0, c1, c2, a[5], a[18]);+	MONT_MAC(s0, s1, s2, a[6], a[17]);+	MONT_MAC(c0, c1, c2, a[7], a[16]);+	MONT_MAC(s0, s1, s2, a[8], a[15]);+	MONT_MAC(c0, c1, c2, a[9], a[14]);+	MONT_MAC(s0, s1, s2, a[10], a[13]);+	MONT_MAC(c0, c1, c2, a[11], a[12]);+	MONT_MAC(t0, t1, t2, u[0], m[23]);+	MONT_MUL(v0, v1, v2, u[1], m[22]);+	MONT_MUL(w0, w1, w2, u[2], m[21]);+	MONT_MAC(t0, t1, t2, u[3], m[20]);+	MONT_MAC(v0, v1, v2, u[4], m[19]);+	MONT_MAC(w0, w1, w2, u[5], m[18]);+	MONT_MAC(t0, t1, t2, u[6], m[17]);+	MONT_MAC(v0, v1, v2, u[7], m[16]);+	MONT_MAC(w0, w1, w2, u[8], m[15]);+	MONT_MAC(t0, t1, t2, u[9], m[14]);+	MONT_MAC(v0, v1, v2, u[10], m[13]);+	MONT_MAC(w0, w1, w2, u[11], m[12]);+	MONT_MAC(t0, t1, t2, u[12], m[11]);+	MONT_MAC(v0, v1, v2, u[13], m[10]);+	MONT_MAC(w0, w1, w2, u[14], m[9]);+	MONT_MAC(t0, t1, t2, u[15], m[8]);+	MONT_MAC(v0, v1, v2, u[16], m[7]);+	MONT_MAC(w0, w1, w2, u[17], m[6]);+	MONT_MAC(t0, t1, t2, u[18], m[5]);+	MONT_MAC(v0, v1, v2, u[19], m[4]);+	MONT_MAC(w0, w1, w2, u[20], m[3]);+	MONT_MAC(t0, t1, t2, u[21], m[2]);+	MONT_MAC(v0, v1, v2, u[22], m[1]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	MONT_ADD(s0, s1, s2, c0, c1, c2);+	MONT_DBL(s0, s1, s2);+	MONT_ADD(t0, t1, t2, s0, s1, s2);+	u[23] = t0 * n0;+	MONT_MAC(t0, t1, t2, u[23], m[0]);+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 24 */+	MONT_MUL(s0, s1, s2, a[1], a[23]);+	MONT_MUL(c0, c1, c2, a[2], a[22]);+	MONT_MAC(s0, s1, s2, a[3], a[21]);+	MONT_MAC(c0, c1, c2, a[4], a[20]);+	MONT_MAC(s0, s1, s2, a[5], a[19]);+	MONT_MAC(c0, c1, c2, a[6], a[18]);+	MONT_MAC(s0, s1, s2, a[7], a[17]);+	MONT_MAC(c0, c1, c2, a[8], a[16]);+	MONT_MAC(s0, s1, s2, a[9], a[15]);+	MONT_MAC(c0, c1, c2, a[10], a[14]);+	MONT_MAC(s0, s1, s2, a[11], a[13]);+	MONT_MAC(t0, t1, t2, a[12], a[12]);+	MONT_MUL(v0, v1, v2, u[1], m[23]);+	MONT_MUL(w0, w1, w2, u[2], m[22]);+	MONT_MAC(t0, t1, t2, u[3], m[21]);+	MONT_MAC(v0, v1, v2, u[4], m[20]);+	MONT_MAC(w0, w1, w2, u[5], m[19]);+	MONT_MAC(t0, t1, t2, u[6], m[18]);+	MONT_MAC(v0, v1, v2, u[7], m[17]);+	MONT_MAC(w0, w1, w2, u[8], m[16]);+	MONT_MAC(t0, t1, t2, u[9], m[15]);+	MONT_MAC(v0, v1, v2, u[10], m[14]);+	MONT_MAC(w0, w1, w2, u[11], m[13]);+	MONT_MAC(t0, t1, t2, u[12], m[12]);+	MONT_MAC(v0, v1, v2, u[13], m[11]);+	MONT_MAC(w0, w1, w2, u[14], m[10]);+	MONT_MAC(t0, t1, t2, u[15], m[9]);+	MONT_MAC(v0, v1, v2, u[16], m[8]);+	MONT_MAC(w0, w1, w2, u[17], m[7]);+	MONT_MAC(t0, t1, t2, u[18], m[6]);+	MONT_MAC(v0, v1, v2, u[19], m[5]);+	MONT_MAC(w0, w1, w2, u[20], m[4]);+	MONT_MAC(t0, t1, t2, u[21], m[3]);+	MONT_MAC(v0, v1, v2, u[22], m[2]);+	MONT_MAC(w0, w1, w2, u[23], m[1]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	MONT_ADD(s0, s1, s2, c0, c1, c2);+	MONT_DBL(s0, s1, s2);+	MONT_ADD(t0, t1, t2, s0, s1, s2);+	z[0] = t0;+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 25 */+	MONT_MUL(s0, s1, s2, a[2], a[23]);+	MONT_MUL(c0, c1, c2, a[3], a[22]);+	MONT_MAC(s0, s1, s2, a[4], a[21]);+	MONT_MAC(c0, c1, c2, a[5], a[20]);+	MONT_MAC(s0, s1, s2, a[6], a[19]);+	MONT_MAC(c0, c1, c2, a[7], a[18]);+	MONT_MAC(s0, s1, s2, a[8], a[17]);+	MONT_MAC(c0, c1, c2, a[9], a[16]);+	MONT_MAC(s0, s1, s2, a[10], a[15]);+	MONT_MAC(c0, c1, c2, a[11], a[14]);+	MONT_MAC(s0, s1, s2, a[12], a[13]);+	MONT_MAC(t0, t1, t2, u[2], m[23]);+	MONT_MUL(v0, v1, v2, u[3], m[22]);+	MONT_MUL(w0, w1, w2, u[4], m[21]);+	MONT_MAC(t0, t1, t2, u[5], m[20]);+	MONT_MAC(v0, v1, v2, u[6], m[19]);+	MONT_MAC(w0, w1, w2, u[7], m[18]);+	MONT_MAC(t0, t1, t2, u[8], m[17]);+	MONT_MAC(v0, v1, v2, u[9], m[16]);+	MONT_MAC(w0, w1, w2, u[10], m[15]);+	MONT_MAC(t0, t1, t2, u[11], m[14]);+	MONT_MAC(v0, v1, v2, u[12], m[13]);+	MONT_MAC(w0, w1, w2, u[13], m[12]);+	MONT_MAC(t0, t1, t2, u[14], m[11]);+	MONT_MAC(v0, v1, v2, u[15], m[10]);+	MONT_MAC(w0, w1, w2, u[16], m[9]);+	MONT_MAC(t0, t1, t2, u[17], m[8]);+	MONT_MAC(v0, v1, v2, u[18], m[7]);+	MONT_MAC(w0, w1, w2, u[19], m[6]);+	MONT_MAC(t0, t1, t2, u[20], m[5]);+	MONT_MAC(v0, v1, v2, u[21], m[4]);+	MONT_MAC(w0, w1, w2, u[22], m[3]);+	MONT_MAC(t0, t1, t2, u[23], m[2]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	MONT_ADD(s0, s1, s2, c0, c1, c2);+	MONT_DBL(s0, s1, s2);+	MONT_ADD(t0, t1, t2, s0, s1, s2);+	z[1] = t0;+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 26 */+	MONT_MUL(s0, s1, s2, a[3], a[23]);+	MONT_MUL(c0, c1, c2, a[4], a[22]);+	MONT_MAC(s0, s1, s2, a[5], a[21]);+	MONT_MAC(c0, c1, c2, a[6], a[20]);+	MONT_MAC(s0, s1, s2, a[7], a[19]);+	MONT_MAC(c0, c1, c2, a[8], a[18]);+	MONT_MAC(s0, s1, s2, a[9], a[17]);+	MONT_MAC(c0, c1, c2, a[10], a[16]);+	MONT_MAC(s0, s1, s2, a[11], a[15]);+	MONT_MAC(c0, c1, c2, a[12], a[14]);+	MONT_MAC(t0, t1, t2, a[13], a[13]);+	MONT_MUL(v0, v1, v2, u[3], m[23]);+	MONT_MUL(w0, w1, w2, u[4], m[22]);+	MONT_MAC(t0, t1, t2, u[5], m[21]);+	MONT_MAC(v0, v1, v2, u[6], m[20]);+	MONT_MAC(w0, w1, w2, u[7], m[19]);+	MONT_MAC(t0, t1, t2, u[8], m[18]);+	MONT_MAC(v0, v1, v2, u[9], m[17]);+	MONT_MAC(w0, w1, w2, u[10], m[16]);+	MONT_MAC(t0, t1, t2, u[11], m[15]);+	MONT_MAC(v0, v1, v2, u[12], m[14]);+	MONT_MAC(w0, w1, w2, u[13], m[13]);+	MONT_MAC(t0, t1, t2, u[14], m[12]);+	MONT_MAC(v0, v1, v2, u[15], m[11]);+	MONT_MAC(w0, w1, w2, u[16], m[10]);+	MONT_MAC(t0, t1, t2, u[17], m[9]);+	MONT_MAC(v0, v1, v2, u[18], m[8]);+	MONT_MAC(w0, w1, w2, u[19], m[7]);+	MONT_MAC(t0, t1, t2, u[20], m[6]);+	MONT_MAC(v0, v1, v2, u[21], m[5]);+	MONT_MAC(w0, w1, w2, u[22], m[4]);+	MONT_MAC(t0, t1, t2, u[23], m[3]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	MONT_ADD(s0, s1, s2, c0, c1, c2);+	MONT_DBL(s0, s1, s2);+	MONT_ADD(t0, t1, t2, s0, s1, s2);+	z[2] = t0;+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 27 */+	MONT_MUL(s0, s1, s2, a[4], a[23]);+	MONT_MUL(c0, c1, c2, a[5], a[22]);+	MONT_MAC(s0, s1, s2, a[6], a[21]);+	MONT_MAC(c0, c1, c2, a[7], a[20]);+	MONT_MAC(s0, s1, s2, a[8], a[19]);+	MONT_MAC(c0, c1, c2, a[9], a[18]);+	MONT_MAC(s0, s1, s2, a[10], a[17]);+	MONT_MAC(c0, c1, c2, a[11], a[16]);+	MONT_MAC(s0, s1, s2, a[12], a[15]);+	MONT_MAC(c0, c1, c2, a[13], a[14]);+	MONT_MAC(t0, t1, t2, u[4], m[23]);+	MONT_MUL(v0, v1, v2, u[5], m[22]);+	MONT_MUL(w0, w1, w2, u[6], m[21]);+	MONT_MAC(t0, t1, t2, u[7], m[20]);+	MONT_MAC(v0, v1, v2, u[8], m[19]);+	MONT_MAC(w0, w1, w2, u[9], m[18]);+	MONT_MAC(t0, t1, t2, u[10], m[17]);+	MONT_MAC(v0, v1, v2, u[11], m[16]);+	MONT_MAC(w0, w1, w2, u[12], m[15]);+	MONT_MAC(t0, t1, t2, u[13], m[14]);+	MONT_MAC(v0, v1, v2, u[14], m[13]);+	MONT_MAC(w0, w1, w2, u[15], m[12]);+	MONT_MAC(t0, t1, t2, u[16], m[11]);+	MONT_MAC(v0, v1, v2, u[17], m[10]);+	MONT_MAC(w0, w1, w2, u[18], m[9]);+	MONT_MAC(t0, t1, t2, u[19], m[8]);+	MONT_MAC(v0, v1, v2, u[20], m[7]);+	MONT_MAC(w0, w1, w2, u[21], m[6]);+	MONT_MAC(t0, t1, t2, u[22], m[5]);+	MONT_MAC(v0, v1, v2, u[23], m[4]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	MONT_ADD(s0, s1, s2, c0, c1, c2);+	MONT_DBL(s0, s1, s2);+	MONT_ADD(t0, t1, t2, s0, s1, s2);+	z[3] = t0;+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 28 */+	MONT_MUL(s0, s1, s2, a[5], a[23]);+	MONT_MUL(c0, c1, c2, a[6], a[22]);+	MONT_MAC(s0, s1, s2, a[7], a[21]);+	MONT_MAC(c0, c1, c2, a[8], a[20]);+	MONT_MAC(s0, s1, s2, a[9], a[19]);+	MONT_MAC(c0, c1, c2, a[10], a[18]);+	MONT_MAC(s0, s1, s2, a[11], a[17]);+	MONT_MAC(c0, c1, c2, a[12], a[16]);+	MONT_MAC(s0, s1, s2, a[13], a[15]);+	MONT_MAC(t0, t1, t2, a[14], a[14]);+	MONT_MUL(v0, v1, v2, u[5], m[23]);+	MONT_MUL(w0, w1, w2, u[6], m[22]);+	MONT_MAC(t0, t1, t2, u[7], m[21]);+	MONT_MAC(v0, v1, v2, u[8], m[20]);+	MONT_MAC(w0, w1, w2, u[9], m[19]);+	MONT_MAC(t0, t1, t2, u[10], m[18]);+	MONT_MAC(v0, v1, v2, u[11], m[17]);+	MONT_MAC(w0, w1, w2, u[12], m[16]);+	MONT_MAC(t0, t1, t2, u[13], m[15]);+	MONT_MAC(v0, v1, v2, u[14], m[14]);+	MONT_MAC(w0, w1, w2, u[15], m[13]);+	MONT_MAC(t0, t1, t2, u[16], m[12]);+	MONT_MAC(v0, v1, v2, u[17], m[11]);+	MONT_MAC(w0, w1, w2, u[18], m[10]);+	MONT_MAC(t0, t1, t2, u[19], m[9]);+	MONT_MAC(v0, v1, v2, u[20], m[8]);+	MONT_MAC(w0, w1, w2, u[21], m[7]);+	MONT_MAC(t0, t1, t2, u[22], m[6]);+	MONT_MAC(v0, v1, v2, u[23], m[5]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	MONT_ADD(s0, s1, s2, c0, c1, c2);+	MONT_DBL(s0, s1, s2);+	MONT_ADD(t0, t1, t2, s0, s1, s2);+	z[4] = t0;+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 29 */+	MONT_MUL(s0, s1, s2, a[6], a[23]);+	MONT_MUL(c0, c1, c2, a[7], a[22]);+	MONT_MAC(s0, s1, s2, a[8], a[21]);+	MONT_MAC(c0, c1, c2, a[9], a[20]);+	MONT_MAC(s0, s1, s2, a[10], a[19]);+	MONT_MAC(c0, c1, c2, a[11], a[18]);+	MONT_MAC(s0, s1, s2, a[12], a[17]);+	MONT_MAC(c0, c1, c2, a[13], a[16]);+	MONT_MAC(s0, s1, s2, a[14], a[15]);+	MONT_MAC(t0, t1, t2, u[6], m[23]);+	MONT_MUL(v0, v1, v2, u[7], m[22]);+	MONT_MUL(w0, w1, w2, u[8], m[21]);+	MONT_MAC(t0, t1, t2, u[9], m[20]);+	MONT_MAC(v0, v1, v2, u[10], m[19]);+	MONT_MAC(w0, w1, w2, u[11], m[18]);+	MONT_MAC(t0, t1, t2, u[12], m[17]);+	MONT_MAC(v0, v1, v2, u[13], m[16]);+	MONT_MAC(w0, w1, w2, u[14], m[15]);+	MONT_MAC(t0, t1, t2, u[15], m[14]);+	MONT_MAC(v0, v1, v2, u[16], m[13]);+	MONT_MAC(w0, w1, w2, u[17], m[12]);+	MONT_MAC(t0, t1, t2, u[18], m[11]);+	MONT_MAC(v0, v1, v2, u[19], m[10]);+	MONT_MAC(w0, w1, w2, u[20], m[9]);+	MONT_MAC(t0, t1, t2, u[21], m[8]);+	MONT_MAC(v0, v1, v2, u[22], m[7]);+	MONT_MAC(w0, w1, w2, u[23], m[6]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	MONT_ADD(s0, s1, s2, c0, c1, c2);+	MONT_DBL(s0, s1, s2);+	MONT_ADD(t0, t1, t2, s0, s1, s2);+	z[5] = t0;+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 30 */+	MONT_MUL(s0, s1, s2, a[7], a[23]);+	MONT_MUL(c0, c1, c2, a[8], a[22]);+	MONT_MAC(s0, s1, s2, a[9], a[21]);+	MONT_MAC(c0, c1, c2, a[10], a[20]);+	MONT_MAC(s0, s1, s2, a[11], a[19]);+	MONT_MAC(c0, c1, c2, a[12], a[18]);+	MONT_MAC(s0, s1, s2, a[13], a[17]);+	MONT_MAC(c0, c1, c2, a[14], a[16]);+	MONT_MAC(t0, t1, t2, a[15], a[15]);+	MONT_MUL(v0, v1, v2, u[7], m[23]);+	MONT_MUL(w0, w1, w2, u[8], m[22]);+	MONT_MAC(t0, t1, t2, u[9], m[21]);+	MONT_MAC(v0, v1, v2, u[10], m[20]);+	MONT_MAC(w0, w1, w2, u[11], m[19]);+	MONT_MAC(t0, t1, t2, u[12], m[18]);+	MONT_MAC(v0, v1, v2, u[13], m[17]);+	MONT_MAC(w0, w1, w2, u[14], m[16]);+	MONT_MAC(t0, t1, t2, u[15], m[15]);+	MONT_MAC(v0, v1, v2, u[16], m[14]);+	MONT_MAC(w0, w1, w2, u[17], m[13]);+	MONT_MAC(t0, t1, t2, u[18], m[12]);+	MONT_MAC(v0, v1, v2, u[19], m[11]);+	MONT_MAC(w0, w1, w2, u[20], m[10]);+	MONT_MAC(t0, t1, t2, u[21], m[9]);+	MONT_MAC(v0, v1, v2, u[22], m[8]);+	MONT_MAC(w0, w1, w2, u[23], m[7]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	MONT_ADD(s0, s1, s2, c0, c1, c2);+	MONT_DBL(s0, s1, s2);+	MONT_ADD(t0, t1, t2, s0, s1, s2);+	z[6] = t0;+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 31 */+	MONT_MUL(s0, s1, s2, a[8], a[23]);+	MONT_MUL(c0, c1, c2, a[9], a[22]);+	MONT_MAC(s0, s1, s2, a[10], a[21]);+	MONT_MAC(c0, c1, c2, a[11], a[20]);+	MONT_MAC(s0, s1, s2, a[12], a[19]);+	MONT_MAC(c0, c1, c2, a[13], a[18]);+	MONT_MAC(s0, s1, s2, a[14], a[17]);+	MONT_MAC(c0, c1, c2, a[15], a[16]);+	MONT_MAC(t0, t1, t2, u[8], m[23]);+	MONT_MUL(v0, v1, v2, u[9], m[22]);+	MONT_MUL(w0, w1, w2, u[10], m[21]);+	MONT_MAC(t0, t1, t2, u[11], m[20]);+	MONT_MAC(v0, v1, v2, u[12], m[19]);+	MONT_MAC(w0, w1, w2, u[13], m[18]);+	MONT_MAC(t0, t1, t2, u[14], m[17]);+	MONT_MAC(v0, v1, v2, u[15], m[16]);+	MONT_MAC(w0, w1, w2, u[16], m[15]);+	MONT_MAC(t0, t1, t2, u[17], m[14]);+	MONT_MAC(v0, v1, v2, u[18], m[13]);+	MONT_MAC(w0, w1, w2, u[19], m[12]);+	MONT_MAC(t0, t1, t2, u[20], m[11]);+	MONT_MAC(v0, v1, v2, u[21], m[10]);+	MONT_MAC(w0, w1, w2, u[22], m[9]);+	MONT_MAC(t0, t1, t2, u[23], m[8]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	MONT_ADD(s0, s1, s2, c0, c1, c2);+	MONT_DBL(s0, s1, s2);+	MONT_ADD(t0, t1, t2, s0, s1, s2);+	z[7] = t0;+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 32 */+	MONT_MUL(s0, s1, s2, a[9], a[23]);+	MONT_MUL(c0, c1, c2, a[10], a[22]);+	MONT_MAC(s0, s1, s2, a[11], a[21]);+	MONT_MAC(c0, c1, c2, a[12], a[20]);+	MONT_MAC(s0, s1, s2, a[13], a[19]);+	MONT_MAC(c0, c1, c2, a[14], a[18]);+	MONT_MAC(s0, s1, s2, a[15], a[17]);+	MONT_MAC(t0, t1, t2, a[16], a[16]);+	MONT_MUL(v0, v1, v2, u[9], m[23]);+	MONT_MUL(w0, w1, w2, u[10], m[22]);+	MONT_MAC(t0, t1, t2, u[11], m[21]);+	MONT_MAC(v0, v1, v2, u[12], m[20]);+	MONT_MAC(w0, w1, w2, u[13], m[19]);+	MONT_MAC(t0, t1, t2, u[14], m[18]);+	MONT_MAC(v0, v1, v2, u[15], m[17]);+	MONT_MAC(w0, w1, w2, u[16], m[16]);+	MONT_MAC(t0, t1, t2, u[17], m[15]);+	MONT_MAC(v0, v1, v2, u[18], m[14]);+	MONT_MAC(w0, w1, w2, u[19], m[13]);+	MONT_MAC(t0, t1, t2, u[20], m[12]);+	MONT_MAC(v0, v1, v2, u[21], m[11]);+	MONT_MAC(w0, w1, w2, u[22], m[10]);+	MONT_MAC(t0, t1, t2, u[23], m[9]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	MONT_ADD(s0, s1, s2, c0, c1, c2);+	MONT_DBL(s0, s1, s2);+	MONT_ADD(t0, t1, t2, s0, s1, s2);+	z[8] = t0;+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 33 */+	MONT_MUL(s0, s1, s2, a[10], a[23]);+	MONT_MUL(c0, c1, c2, a[11], a[22]);+	MONT_MAC(s0, s1, s2, a[12], a[21]);+	MONT_MAC(c0, c1, c2, a[13], a[20]);+	MONT_MAC(s0, s1, s2, a[14], a[19]);+	MONT_MAC(c0, c1, c2, a[15], a[18]);+	MONT_MAC(s0, s1, s2, a[16], a[17]);+	MONT_MAC(t0, t1, t2, u[10], m[23]);+	MONT_MUL(v0, v1, v2, u[11], m[22]);+	MONT_MUL(w0, w1, w2, u[12], m[21]);+	MONT_MAC(t0, t1, t2, u[13], m[20]);+	MONT_MAC(v0, v1, v2, u[14], m[19]);+	MONT_MAC(w0, w1, w2, u[15], m[18]);+	MONT_MAC(t0, t1, t2, u[16], m[17]);+	MONT_MAC(v0, v1, v2, u[17], m[16]);+	MONT_MAC(w0, w1, w2, u[18], m[15]);+	MONT_MAC(t0, t1, t2, u[19], m[14]);+	MONT_MAC(v0, v1, v2, u[20], m[13]);+	MONT_MAC(w0, w1, w2, u[21], m[12]);+	MONT_MAC(t0, t1, t2, u[22], m[11]);+	MONT_MAC(v0, v1, v2, u[23], m[10]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	MONT_ADD(s0, s1, s2, c0, c1, c2);+	MONT_DBL(s0, s1, s2);+	MONT_ADD(t0, t1, t2, s0, s1, s2);+	z[9] = t0;+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 34 */+	MONT_MUL(s0, s1, s2, a[11], a[23]);+	MONT_MUL(c0, c1, c2, a[12], a[22]);+	MONT_MAC(s0, s1, s2, a[13], a[21]);+	MONT_MAC(c0, c1, c2, a[14], a[20]);+	MONT_MAC(s0, s1, s2, a[15], a[19]);+	MONT_MAC(c0, c1, c2, a[16], a[18]);+	MONT_MAC(t0, t1, t2, a[17], a[17]);+	MONT_MUL(v0, v1, v2, u[11], m[23]);+	MONT_MUL(w0, w1, w2, u[12], m[22]);+	MONT_MAC(t0, t1, t2, u[13], m[21]);+	MONT_MAC(v0, v1, v2, u[14], m[20]);+	MONT_MAC(w0, w1, w2, u[15], m[19]);+	MONT_MAC(t0, t1, t2, u[16], m[18]);+	MONT_MAC(v0, v1, v2, u[17], m[17]);+	MONT_MAC(w0, w1, w2, u[18], m[16]);+	MONT_MAC(t0, t1, t2, u[19], m[15]);+	MONT_MAC(v0, v1, v2, u[20], m[14]);+	MONT_MAC(w0, w1, w2, u[21], m[13]);+	MONT_MAC(t0, t1, t2, u[22], m[12]);+	MONT_MAC(v0, v1, v2, u[23], m[11]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	MONT_ADD(s0, s1, s2, c0, c1, c2);+	MONT_DBL(s0, s1, s2);+	MONT_ADD(t0, t1, t2, s0, s1, s2);+	z[10] = t0;+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 35 */+	MONT_MUL(s0, s1, s2, a[12], a[23]);+	MONT_MUL(c0, c1, c2, a[13], a[22]);+	MONT_MAC(s0, s1, s2, a[14], a[21]);+	MONT_MAC(c0, c1, c2, a[15], a[20]);+	MONT_MAC(s0, s1, s2, a[16], a[19]);+	MONT_MAC(c0, c1, c2, a[17], a[18]);+	MONT_MAC(t0, t1, t2, u[12], m[23]);+	MONT_MUL(v0, v1, v2, u[13], m[22]);+	MONT_MUL(w0, w1, w2, u[14], m[21]);+	MONT_MAC(t0, t1, t2, u[15], m[20]);+	MONT_MAC(v0, v1, v2, u[16], m[19]);+	MONT_MAC(w0, w1, w2, u[17], m[18]);+	MONT_MAC(t0, t1, t2, u[18], m[17]);+	MONT_MAC(v0, v1, v2, u[19], m[16]);+	MONT_MAC(w0, w1, w2, u[20], m[15]);+	MONT_MAC(t0, t1, t2, u[21], m[14]);+	MONT_MAC(v0, v1, v2, u[22], m[13]);+	MONT_MAC(w0, w1, w2, u[23], m[12]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	MONT_ADD(s0, s1, s2, c0, c1, c2);+	MONT_DBL(s0, s1, s2);+	MONT_ADD(t0, t1, t2, s0, s1, s2);+	z[11] = t0;+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 36 */+	MONT_MUL(s0, s1, s2, a[13], a[23]);+	MONT_MUL(c0, c1, c2, a[14], a[22]);+	MONT_MAC(s0, s1, s2, a[15], a[21]);+	MONT_MAC(c0, c1, c2, a[16], a[20]);+	MONT_MAC(s0, s1, s2, a[17], a[19]);+	MONT_MAC(t0, t1, t2, a[18], a[18]);+	MONT_MUL(v0, v1, v2, u[13], m[23]);+	MONT_MUL(w0, w1, w2, u[14], m[22]);+	MONT_MAC(t0, t1, t2, u[15], m[21]);+	MONT_MAC(v0, v1, v2, u[16], m[20]);+	MONT_MAC(w0, w1, w2, u[17], m[19]);+	MONT_MAC(t0, t1, t2, u[18], m[18]);+	MONT_MAC(v0, v1, v2, u[19], m[17]);+	MONT_MAC(w0, w1, w2, u[20], m[16]);+	MONT_MAC(t0, t1, t2, u[21], m[15]);+	MONT_MAC(v0, v1, v2, u[22], m[14]);+	MONT_MAC(w0, w1, w2, u[23], m[13]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	MONT_ADD(s0, s1, s2, c0, c1, c2);+	MONT_DBL(s0, s1, s2);+	MONT_ADD(t0, t1, t2, s0, s1, s2);+	z[12] = t0;+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 37 */+	MONT_MUL(s0, s1, s2, a[14], a[23]);+	MONT_MUL(c0, c1, c2, a[15], a[22]);+	MONT_MAC(s0, s1, s2, a[16], a[21]);+	MONT_MAC(c0, c1, c2, a[17], a[20]);+	MONT_MAC(s0, s1, s2, a[18], a[19]);+	MONT_MAC(t0, t1, t2, u[14], m[23]);+	MONT_MUL(v0, v1, v2, u[15], m[22]);+	MONT_MUL(w0, w1, w2, u[16], m[21]);+	MONT_MAC(t0, t1, t2, u[17], m[20]);+	MONT_MAC(v0, v1, v2, u[18], m[19]);+	MONT_MAC(w0, w1, w2, u[19], m[18]);+	MONT_MAC(t0, t1, t2, u[20], m[17]);+	MONT_MAC(v0, v1, v2, u[21], m[16]);+	MONT_MAC(w0, w1, w2, u[22], m[15]);+	MONT_MAC(t0, t1, t2, u[23], m[14]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	MONT_ADD(s0, s1, s2, c0, c1, c2);+	MONT_DBL(s0, s1, s2);+	MONT_ADD(t0, t1, t2, s0, s1, s2);+	z[13] = t0;+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 38 */+	MONT_MUL(s0, s1, s2, a[15], a[23]);+	MONT_MUL(c0, c1, c2, a[16], a[22]);+	MONT_MAC(s0, s1, s2, a[17], a[21]);+	MONT_MAC(c0, c1, c2, a[18], a[20]);+	MONT_MAC(t0, t1, t2, a[19], a[19]);+	MONT_MUL(v0, v1, v2, u[15], m[23]);+	MONT_MUL(w0, w1, w2, u[16], m[22]);+	MONT_MAC(t0, t1, t2, u[17], m[21]);+	MONT_MAC(v0, v1, v2, u[18], m[20]);+	MONT_MAC(w0, w1, w2, u[19], m[19]);+	MONT_MAC(t0, t1, t2, u[20], m[18]);+	MONT_MAC(v0, v1, v2, u[21], m[17]);+	MONT_MAC(w0, w1, w2, u[22], m[16]);+	MONT_MAC(t0, t1, t2, u[23], m[15]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	MONT_ADD(s0, s1, s2, c0, c1, c2);+	MONT_DBL(s0, s1, s2);+	MONT_ADD(t0, t1, t2, s0, s1, s2);+	z[14] = t0;+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 39 */+	MONT_MUL(s0, s1, s2, a[16], a[23]);+	MONT_MUL(c0, c1, c2, a[17], a[22]);+	MONT_MAC(s0, s1, s2, a[18], a[21]);+	MONT_MAC(c0, c1, c2, a[19], a[20]);+	MONT_MAC(t0, t1, t2, u[16], m[23]);+	MONT_MUL(v0, v1, v2, u[17], m[22]);+	MONT_MUL(w0, w1, w2, u[18], m[21]);+	MONT_MAC(t0, t1, t2, u[19], m[20]);+	MONT_MAC(v0, v1, v2, u[20], m[19]);+	MONT_MAC(w0, w1, w2, u[21], m[18]);+	MONT_MAC(t0, t1, t2, u[22], m[17]);+	MONT_MAC(v0, v1, v2, u[23], m[16]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	MONT_ADD(s0, s1, s2, c0, c1, c2);+	MONT_DBL(s0, s1, s2);+	MONT_ADD(t0, t1, t2, s0, s1, s2);+	z[15] = t0;+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 40 */+	MONT_MUL(s0, s1, s2, a[17], a[23]);+	MONT_MUL(c0, c1, c2, a[18], a[22]);+	MONT_MAC(s0, s1, s2, a[19], a[21]);+	MONT_MAC(t0, t1, t2, a[20], a[20]);+	MONT_MUL(v0, v1, v2, u[17], m[23]);+	MONT_MUL(w0, w1, w2, u[18], m[22]);+	MONT_MAC(t0, t1, t2, u[19], m[21]);+	MONT_MAC(v0, v1, v2, u[20], m[20]);+	MONT_MAC(w0, w1, w2, u[21], m[19]);+	MONT_MAC(t0, t1, t2, u[22], m[18]);+	MONT_MAC(v0, v1, v2, u[23], m[17]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	MONT_ADD(s0, s1, s2, c0, c1, c2);+	MONT_DBL(s0, s1, s2);+	MONT_ADD(t0, t1, t2, s0, s1, s2);+	z[16] = t0;+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 41 */+	MONT_MUL(s0, s1, s2, a[18], a[23]);+	MONT_MUL(c0, c1, c2, a[19], a[22]);+	MONT_MAC(s0, s1, s2, a[20], a[21]);+	MONT_MAC(t0, t1, t2, u[18], m[23]);+	MONT_MUL(v0, v1, v2, u[19], m[22]);+	MONT_MUL(w0, w1, w2, u[20], m[21]);+	MONT_MAC(t0, t1, t2, u[21], m[20]);+	MONT_MAC(v0, v1, v2, u[22], m[19]);+	MONT_MAC(w0, w1, w2, u[23], m[18]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	MONT_ADD(s0, s1, s2, c0, c1, c2);+	MONT_DBL(s0, s1, s2);+	MONT_ADD(t0, t1, t2, s0, s1, s2);+	z[17] = t0;+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 42 */+	MONT_MUL(s0, s1, s2, a[19], a[23]);+	MONT_MUL(c0, c1, c2, a[20], a[22]);+	MONT_MAC(t0, t1, t2, a[21], a[21]);+	MONT_MUL(v0, v1, v2, u[19], m[23]);+	MONT_MUL(w0, w1, w2, u[20], m[22]);+	MONT_MAC(t0, t1, t2, u[21], m[21]);+	MONT_MAC(v0, v1, v2, u[22], m[20]);+	MONT_MAC(w0, w1, w2, u[23], m[19]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	MONT_ADD(s0, s1, s2, c0, c1, c2);+	MONT_DBL(s0, s1, s2);+	MONT_ADD(t0, t1, t2, s0, s1, s2);+	z[18] = t0;+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 43 */+	MONT_MUL(s0, s1, s2, a[20], a[23]);+	MONT_MUL(c0, c1, c2, a[21], a[22]);+	MONT_MAC(t0, t1, t2, u[20], m[23]);+	MONT_MUL(v0, v1, v2, u[21], m[22]);+	MONT_MUL(w0, w1, w2, u[22], m[21]);+	MONT_MAC(t0, t1, t2, u[23], m[20]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	MONT_ADD(s0, s1, s2, c0, c1, c2);+	MONT_DBL(s0, s1, s2);+	MONT_ADD(t0, t1, t2, s0, s1, s2);+	z[19] = t0;+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 44 */+	MONT_MUL(s0, s1, s2, a[21], a[23]);+	MONT_MAC(t0, t1, t2, a[22], a[22]);+	MONT_MUL(v0, v1, v2, u[21], m[23]);+	MONT_MUL(w0, w1, w2, u[22], m[22]);+	MONT_MAC(t0, t1, t2, u[23], m[21]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	MONT_DBL(s0, s1, s2);+	MONT_ADD(t0, t1, t2, s0, s1, s2);+	z[20] = t0;+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 45 */+	MONT_MUL(s0, s1, s2, a[22], a[23]);+	MONT_MAC(t0, t1, t2, u[22], m[23]);+	MONT_MUL(v0, v1, v2, u[23], m[22]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_DBL(s0, s1, s2);+	MONT_ADD(t0, t1, t2, s0, s1, s2);+	z[21] = t0;+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 46 */+	MONT_MAC(t0, t1, t2, a[23], a[23]);+	MONT_MUL(v0, v1, v2, u[23], m[23]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	z[22] = t0;+	t0 = t1;+	t1 = t2;+	t2 = 0;+	z[23] = t0;++	/* under 2m, with t1 the bit above n limbs: at most one subtraction */+	borrow = sub_n(r, z, m, 24);+	take = t1 | (borrow ^ 1);+	select_n(r, r, z, take & 1, 24);+}++/* r = a * b * R^-1 mod m, for a and b under m; t is 2n limbs of scratch */+static void crypton_mont_mul32(limb_t *r, const limb_t *a, const limb_t *b,+                               const limb_t *m, limb_t n0, limb_t *t)+{+	limb_t *u = t, *z = t + 32;+	limb_t t0 = 0, t1 = 0, t2 = 0, v0, v1, v2, w0, w1, w2, borrow, take;++	/* column 0 */+	MONT_MAC(t0, t1, t2, a[0], b[0]);+	u[0] = t0 * n0;+	MONT_MAC(t0, t1, t2, u[0], m[0]);+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 1 */+	MONT_MAC(t0, t1, t2, a[0], b[1]);+	MONT_MUL(v0, v1, v2, a[1], b[0]);+	MONT_MUL(w0, w1, w2, u[0], m[1]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	u[1] = t0 * n0;+	MONT_MAC(t0, t1, t2, u[1], m[0]);+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 2 */+	MONT_MAC(t0, t1, t2, a[0], b[2]);+	MONT_MUL(v0, v1, v2, a[1], b[1]);+	MONT_MUL(w0, w1, w2, a[2], b[0]);+	MONT_MAC(t0, t1, t2, u[0], m[2]);+	MONT_MAC(v0, v1, v2, u[1], m[1]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	u[2] = t0 * n0;+	MONT_MAC(t0, t1, t2, u[2], m[0]);+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 3 */+	MONT_MAC(t0, t1, t2, a[0], b[3]);+	MONT_MUL(v0, v1, v2, a[1], b[2]);+	MONT_MUL(w0, w1, w2, a[2], b[1]);+	MONT_MAC(t0, t1, t2, a[3], b[0]);+	MONT_MAC(v0, v1, v2, u[0], m[3]);+	MONT_MAC(w0, w1, w2, u[1], m[2]);+	MONT_MAC(t0, t1, t2, u[2], m[1]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	u[3] = t0 * n0;+	MONT_MAC(t0, t1, t2, u[3], m[0]);+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 4 */+	MONT_MAC(t0, t1, t2, a[0], b[4]);+	MONT_MUL(v0, v1, v2, a[1], b[3]);+	MONT_MUL(w0, w1, w2, a[2], b[2]);+	MONT_MAC(t0, t1, t2, a[3], b[1]);+	MONT_MAC(v0, v1, v2, a[4], b[0]);+	MONT_MAC(w0, w1, w2, u[0], m[4]);+	MONT_MAC(t0, t1, t2, u[1], m[3]);+	MONT_MAC(v0, v1, v2, u[2], m[2]);+	MONT_MAC(w0, w1, w2, u[3], m[1]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	u[4] = t0 * n0;+	MONT_MAC(t0, t1, t2, u[4], m[0]);+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 5 */+	MONT_MAC(t0, t1, t2, a[0], b[5]);+	MONT_MUL(v0, v1, v2, a[1], b[4]);+	MONT_MUL(w0, w1, w2, a[2], b[3]);+	MONT_MAC(t0, t1, t2, a[3], b[2]);+	MONT_MAC(v0, v1, v2, a[4], b[1]);+	MONT_MAC(w0, w1, w2, a[5], b[0]);+	MONT_MAC(t0, t1, t2, u[0], m[5]);+	MONT_MAC(v0, v1, v2, u[1], m[4]);+	MONT_MAC(w0, w1, w2, u[2], m[3]);+	MONT_MAC(t0, t1, t2, u[3], m[2]);+	MONT_MAC(v0, v1, v2, u[4], m[1]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	u[5] = t0 * n0;+	MONT_MAC(t0, t1, t2, u[5], m[0]);+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 6 */+	MONT_MAC(t0, t1, t2, a[0], b[6]);+	MONT_MUL(v0, v1, v2, a[1], b[5]);+	MONT_MUL(w0, w1, w2, a[2], b[4]);+	MONT_MAC(t0, t1, t2, a[3], b[3]);+	MONT_MAC(v0, v1, v2, a[4], b[2]);+	MONT_MAC(w0, w1, w2, a[5], b[1]);+	MONT_MAC(t0, t1, t2, a[6], b[0]);+	MONT_MAC(v0, v1, v2, u[0], m[6]);+	MONT_MAC(w0, w1, w2, u[1], m[5]);+	MONT_MAC(t0, t1, t2, u[2], m[4]);+	MONT_MAC(v0, v1, v2, u[3], m[3]);+	MONT_MAC(w0, w1, w2, u[4], m[2]);+	MONT_MAC(t0, t1, t2, u[5], m[1]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	u[6] = t0 * n0;+	MONT_MAC(t0, t1, t2, u[6], m[0]);+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 7 */+	MONT_MAC(t0, t1, t2, a[0], b[7]);+	MONT_MUL(v0, v1, v2, a[1], b[6]);+	MONT_MUL(w0, w1, w2, a[2], b[5]);+	MONT_MAC(t0, t1, t2, a[3], b[4]);+	MONT_MAC(v0, v1, v2, a[4], b[3]);+	MONT_MAC(w0, w1, w2, a[5], b[2]);+	MONT_MAC(t0, t1, t2, a[6], b[1]);+	MONT_MAC(v0, v1, v2, a[7], b[0]);+	MONT_MAC(w0, w1, w2, u[0], m[7]);+	MONT_MAC(t0, t1, t2, u[1], m[6]);+	MONT_MAC(v0, v1, v2, u[2], m[5]);+	MONT_MAC(w0, w1, w2, u[3], m[4]);+	MONT_MAC(t0, t1, t2, u[4], m[3]);+	MONT_MAC(v0, v1, v2, u[5], m[2]);+	MONT_MAC(w0, w1, w2, u[6], m[1]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	u[7] = t0 * n0;+	MONT_MAC(t0, t1, t2, u[7], m[0]);+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 8 */+	MONT_MAC(t0, t1, t2, a[0], b[8]);+	MONT_MUL(v0, v1, v2, a[1], b[7]);+	MONT_MUL(w0, w1, w2, a[2], b[6]);+	MONT_MAC(t0, t1, t2, a[3], b[5]);+	MONT_MAC(v0, v1, v2, a[4], b[4]);+	MONT_MAC(w0, w1, w2, a[5], b[3]);+	MONT_MAC(t0, t1, t2, a[6], b[2]);+	MONT_MAC(v0, v1, v2, a[7], b[1]);+	MONT_MAC(w0, w1, w2, a[8], b[0]);+	MONT_MAC(t0, t1, t2, u[0], m[8]);+	MONT_MAC(v0, v1, v2, u[1], m[7]);+	MONT_MAC(w0, w1, w2, u[2], m[6]);+	MONT_MAC(t0, t1, t2, u[3], m[5]);+	MONT_MAC(v0, v1, v2, u[4], m[4]);+	MONT_MAC(w0, w1, w2, u[5], m[3]);+	MONT_MAC(t0, t1, t2, u[6], m[2]);+	MONT_MAC(v0, v1, v2, u[7], m[1]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	u[8] = t0 * n0;+	MONT_MAC(t0, t1, t2, u[8], m[0]);+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 9 */+	MONT_MAC(t0, t1, t2, a[0], b[9]);+	MONT_MUL(v0, v1, v2, a[1], b[8]);+	MONT_MUL(w0, w1, w2, a[2], b[7]);+	MONT_MAC(t0, t1, t2, a[3], b[6]);+	MONT_MAC(v0, v1, v2, a[4], b[5]);+	MONT_MAC(w0, w1, w2, a[5], b[4]);+	MONT_MAC(t0, t1, t2, a[6], b[3]);+	MONT_MAC(v0, v1, v2, a[7], b[2]);+	MONT_MAC(w0, w1, w2, a[8], b[1]);+	MONT_MAC(t0, t1, t2, a[9], b[0]);+	MONT_MAC(v0, v1, v2, u[0], m[9]);+	MONT_MAC(w0, w1, w2, u[1], m[8]);+	MONT_MAC(t0, t1, t2, u[2], m[7]);+	MONT_MAC(v0, v1, v2, u[3], m[6]);+	MONT_MAC(w0, w1, w2, u[4], m[5]);+	MONT_MAC(t0, t1, t2, u[5], m[4]);+	MONT_MAC(v0, v1, v2, u[6], m[3]);+	MONT_MAC(w0, w1, w2, u[7], m[2]);+	MONT_MAC(t0, t1, t2, u[8], m[1]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	u[9] = t0 * n0;+	MONT_MAC(t0, t1, t2, u[9], m[0]);+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 10 */+	MONT_MAC(t0, t1, t2, a[0], b[10]);+	MONT_MUL(v0, v1, v2, a[1], b[9]);+	MONT_MUL(w0, w1, w2, a[2], b[8]);+	MONT_MAC(t0, t1, t2, a[3], b[7]);+	MONT_MAC(v0, v1, v2, a[4], b[6]);+	MONT_MAC(w0, w1, w2, a[5], b[5]);+	MONT_MAC(t0, t1, t2, a[6], b[4]);+	MONT_MAC(v0, v1, v2, a[7], b[3]);+	MONT_MAC(w0, w1, w2, a[8], b[2]);+	MONT_MAC(t0, t1, t2, a[9], b[1]);+	MONT_MAC(v0, v1, v2, a[10], b[0]);+	MONT_MAC(w0, w1, w2, u[0], m[10]);+	MONT_MAC(t0, t1, t2, u[1], m[9]);+	MONT_MAC(v0, v1, v2, u[2], m[8]);+	MONT_MAC(w0, w1, w2, u[3], m[7]);+	MONT_MAC(t0, t1, t2, u[4], m[6]);+	MONT_MAC(v0, v1, v2, u[5], m[5]);+	MONT_MAC(w0, w1, w2, u[6], m[4]);+	MONT_MAC(t0, t1, t2, u[7], m[3]);+	MONT_MAC(v0, v1, v2, u[8], m[2]);+	MONT_MAC(w0, w1, w2, u[9], m[1]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	u[10] = t0 * n0;+	MONT_MAC(t0, t1, t2, u[10], m[0]);+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 11 */+	MONT_MAC(t0, t1, t2, a[0], b[11]);+	MONT_MUL(v0, v1, v2, a[1], b[10]);+	MONT_MUL(w0, w1, w2, a[2], b[9]);+	MONT_MAC(t0, t1, t2, a[3], b[8]);+	MONT_MAC(v0, v1, v2, a[4], b[7]);+	MONT_MAC(w0, w1, w2, a[5], b[6]);+	MONT_MAC(t0, t1, t2, a[6], b[5]);+	MONT_MAC(v0, v1, v2, a[7], b[4]);+	MONT_MAC(w0, w1, w2, a[8], b[3]);+	MONT_MAC(t0, t1, t2, a[9], b[2]);+	MONT_MAC(v0, v1, v2, a[10], b[1]);+	MONT_MAC(w0, w1, w2, a[11], b[0]);+	MONT_MAC(t0, t1, t2, u[0], m[11]);+	MONT_MAC(v0, v1, v2, u[1], m[10]);+	MONT_MAC(w0, w1, w2, u[2], m[9]);+	MONT_MAC(t0, t1, t2, u[3], m[8]);+	MONT_MAC(v0, v1, v2, u[4], m[7]);+	MONT_MAC(w0, w1, w2, u[5], m[6]);+	MONT_MAC(t0, t1, t2, u[6], m[5]);+	MONT_MAC(v0, v1, v2, u[7], m[4]);+	MONT_MAC(w0, w1, w2, u[8], m[3]);+	MONT_MAC(t0, t1, t2, u[9], m[2]);+	MONT_MAC(v0, v1, v2, u[10], m[1]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	u[11] = t0 * n0;+	MONT_MAC(t0, t1, t2, u[11], m[0]);+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 12 */+	MONT_MAC(t0, t1, t2, a[0], b[12]);+	MONT_MUL(v0, v1, v2, a[1], b[11]);+	MONT_MUL(w0, w1, w2, a[2], b[10]);+	MONT_MAC(t0, t1, t2, a[3], b[9]);+	MONT_MAC(v0, v1, v2, a[4], b[8]);+	MONT_MAC(w0, w1, w2, a[5], b[7]);+	MONT_MAC(t0, t1, t2, a[6], b[6]);+	MONT_MAC(v0, v1, v2, a[7], b[5]);+	MONT_MAC(w0, w1, w2, a[8], b[4]);+	MONT_MAC(t0, t1, t2, a[9], b[3]);+	MONT_MAC(v0, v1, v2, a[10], b[2]);+	MONT_MAC(w0, w1, w2, a[11], b[1]);+	MONT_MAC(t0, t1, t2, a[12], b[0]);+	MONT_MAC(v0, v1, v2, u[0], m[12]);+	MONT_MAC(w0, w1, w2, u[1], m[11]);+	MONT_MAC(t0, t1, t2, u[2], m[10]);+	MONT_MAC(v0, v1, v2, u[3], m[9]);+	MONT_MAC(w0, w1, w2, u[4], m[8]);+	MONT_MAC(t0, t1, t2, u[5], m[7]);+	MONT_MAC(v0, v1, v2, u[6], m[6]);+	MONT_MAC(w0, w1, w2, u[7], m[5]);+	MONT_MAC(t0, t1, t2, u[8], m[4]);+	MONT_MAC(v0, v1, v2, u[9], m[3]);+	MONT_MAC(w0, w1, w2, u[10], m[2]);+	MONT_MAC(t0, t1, t2, u[11], m[1]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	u[12] = t0 * n0;+	MONT_MAC(t0, t1, t2, u[12], m[0]);+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 13 */+	MONT_MAC(t0, t1, t2, a[0], b[13]);+	MONT_MUL(v0, v1, v2, a[1], b[12]);+	MONT_MUL(w0, w1, w2, a[2], b[11]);+	MONT_MAC(t0, t1, t2, a[3], b[10]);+	MONT_MAC(v0, v1, v2, a[4], b[9]);+	MONT_MAC(w0, w1, w2, a[5], b[8]);+	MONT_MAC(t0, t1, t2, a[6], b[7]);+	MONT_MAC(v0, v1, v2, a[7], b[6]);+	MONT_MAC(w0, w1, w2, a[8], b[5]);+	MONT_MAC(t0, t1, t2, a[9], b[4]);+	MONT_MAC(v0, v1, v2, a[10], b[3]);+	MONT_MAC(w0, w1, w2, a[11], b[2]);+	MONT_MAC(t0, t1, t2, a[12], b[1]);+	MONT_MAC(v0, v1, v2, a[13], b[0]);+	MONT_MAC(w0, w1, w2, u[0], m[13]);+	MONT_MAC(t0, t1, t2, u[1], m[12]);+	MONT_MAC(v0, v1, v2, u[2], m[11]);+	MONT_MAC(w0, w1, w2, u[3], m[10]);+	MONT_MAC(t0, t1, t2, u[4], m[9]);+	MONT_MAC(v0, v1, v2, u[5], m[8]);+	MONT_MAC(w0, w1, w2, u[6], m[7]);+	MONT_MAC(t0, t1, t2, u[7], m[6]);+	MONT_MAC(v0, v1, v2, u[8], m[5]);+	MONT_MAC(w0, w1, w2, u[9], m[4]);+	MONT_MAC(t0, t1, t2, u[10], m[3]);+	MONT_MAC(v0, v1, v2, u[11], m[2]);+	MONT_MAC(w0, w1, w2, u[12], m[1]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	u[13] = t0 * n0;+	MONT_MAC(t0, t1, t2, u[13], m[0]);+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 14 */+	MONT_MAC(t0, t1, t2, a[0], b[14]);+	MONT_MUL(v0, v1, v2, a[1], b[13]);+	MONT_MUL(w0, w1, w2, a[2], b[12]);+	MONT_MAC(t0, t1, t2, a[3], b[11]);+	MONT_MAC(v0, v1, v2, a[4], b[10]);+	MONT_MAC(w0, w1, w2, a[5], b[9]);+	MONT_MAC(t0, t1, t2, a[6], b[8]);+	MONT_MAC(v0, v1, v2, a[7], b[7]);+	MONT_MAC(w0, w1, w2, a[8], b[6]);+	MONT_MAC(t0, t1, t2, a[9], b[5]);+	MONT_MAC(v0, v1, v2, a[10], b[4]);+	MONT_MAC(w0, w1, w2, a[11], b[3]);+	MONT_MAC(t0, t1, t2, a[12], b[2]);+	MONT_MAC(v0, v1, v2, a[13], b[1]);+	MONT_MAC(w0, w1, w2, a[14], b[0]);+	MONT_MAC(t0, t1, t2, u[0], m[14]);+	MONT_MAC(v0, v1, v2, u[1], m[13]);+	MONT_MAC(w0, w1, w2, u[2], m[12]);+	MONT_MAC(t0, t1, t2, u[3], m[11]);+	MONT_MAC(v0, v1, v2, u[4], m[10]);+	MONT_MAC(w0, w1, w2, u[5], m[9]);+	MONT_MAC(t0, t1, t2, u[6], m[8]);+	MONT_MAC(v0, v1, v2, u[7], m[7]);+	MONT_MAC(w0, w1, w2, u[8], m[6]);+	MONT_MAC(t0, t1, t2, u[9], m[5]);+	MONT_MAC(v0, v1, v2, u[10], m[4]);+	MONT_MAC(w0, w1, w2, u[11], m[3]);+	MONT_MAC(t0, t1, t2, u[12], m[2]);+	MONT_MAC(v0, v1, v2, u[13], m[1]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	u[14] = t0 * n0;+	MONT_MAC(t0, t1, t2, u[14], m[0]);+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 15 */+	MONT_MAC(t0, t1, t2, a[0], b[15]);+	MONT_MUL(v0, v1, v2, a[1], b[14]);+	MONT_MUL(w0, w1, w2, a[2], b[13]);+	MONT_MAC(t0, t1, t2, a[3], b[12]);+	MONT_MAC(v0, v1, v2, a[4], b[11]);+	MONT_MAC(w0, w1, w2, a[5], b[10]);+	MONT_MAC(t0, t1, t2, a[6], b[9]);+	MONT_MAC(v0, v1, v2, a[7], b[8]);+	MONT_MAC(w0, w1, w2, a[8], b[7]);+	MONT_MAC(t0, t1, t2, a[9], b[6]);+	MONT_MAC(v0, v1, v2, a[10], b[5]);+	MONT_MAC(w0, w1, w2, a[11], b[4]);+	MONT_MAC(t0, t1, t2, a[12], b[3]);+	MONT_MAC(v0, v1, v2, a[13], b[2]);+	MONT_MAC(w0, w1, w2, a[14], b[1]);+	MONT_MAC(t0, t1, t2, a[15], b[0]);+	MONT_MAC(v0, v1, v2, u[0], m[15]);+	MONT_MAC(w0, w1, w2, u[1], m[14]);+	MONT_MAC(t0, t1, t2, u[2], m[13]);+	MONT_MAC(v0, v1, v2, u[3], m[12]);+	MONT_MAC(w0, w1, w2, u[4], m[11]);+	MONT_MAC(t0, t1, t2, u[5], m[10]);+	MONT_MAC(v0, v1, v2, u[6], m[9]);+	MONT_MAC(w0, w1, w2, u[7], m[8]);+	MONT_MAC(t0, t1, t2, u[8], m[7]);+	MONT_MAC(v0, v1, v2, u[9], m[6]);+	MONT_MAC(w0, w1, w2, u[10], m[5]);+	MONT_MAC(t0, t1, t2, u[11], m[4]);+	MONT_MAC(v0, v1, v2, u[12], m[3]);+	MONT_MAC(w0, w1, w2, u[13], m[2]);+	MONT_MAC(t0, t1, t2, u[14], m[1]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	u[15] = t0 * n0;+	MONT_MAC(t0, t1, t2, u[15], m[0]);+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 16 */+	MONT_MAC(t0, t1, t2, a[0], b[16]);+	MONT_MUL(v0, v1, v2, a[1], b[15]);+	MONT_MUL(w0, w1, w2, a[2], b[14]);+	MONT_MAC(t0, t1, t2, a[3], b[13]);+	MONT_MAC(v0, v1, v2, a[4], b[12]);+	MONT_MAC(w0, w1, w2, a[5], b[11]);+	MONT_MAC(t0, t1, t2, a[6], b[10]);+	MONT_MAC(v0, v1, v2, a[7], b[9]);+	MONT_MAC(w0, w1, w2, a[8], b[8]);+	MONT_MAC(t0, t1, t2, a[9], b[7]);+	MONT_MAC(v0, v1, v2, a[10], b[6]);+	MONT_MAC(w0, w1, w2, a[11], b[5]);+	MONT_MAC(t0, t1, t2, a[12], b[4]);+	MONT_MAC(v0, v1, v2, a[13], b[3]);+	MONT_MAC(w0, w1, w2, a[14], b[2]);+	MONT_MAC(t0, t1, t2, a[15], b[1]);+	MONT_MAC(v0, v1, v2, a[16], b[0]);+	MONT_MAC(w0, w1, w2, u[0], m[16]);+	MONT_MAC(t0, t1, t2, u[1], m[15]);+	MONT_MAC(v0, v1, v2, u[2], m[14]);+	MONT_MAC(w0, w1, w2, u[3], m[13]);+	MONT_MAC(t0, t1, t2, u[4], m[12]);+	MONT_MAC(v0, v1, v2, u[5], m[11]);+	MONT_MAC(w0, w1, w2, u[6], m[10]);+	MONT_MAC(t0, t1, t2, u[7], m[9]);+	MONT_MAC(v0, v1, v2, u[8], m[8]);+	MONT_MAC(w0, w1, w2, u[9], m[7]);+	MONT_MAC(t0, t1, t2, u[10], m[6]);+	MONT_MAC(v0, v1, v2, u[11], m[5]);+	MONT_MAC(w0, w1, w2, u[12], m[4]);+	MONT_MAC(t0, t1, t2, u[13], m[3]);+	MONT_MAC(v0, v1, v2, u[14], m[2]);+	MONT_MAC(w0, w1, w2, u[15], m[1]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	u[16] = t0 * n0;+	MONT_MAC(t0, t1, t2, u[16], m[0]);+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 17 */+	MONT_MAC(t0, t1, t2, a[0], b[17]);+	MONT_MUL(v0, v1, v2, a[1], b[16]);+	MONT_MUL(w0, w1, w2, a[2], b[15]);+	MONT_MAC(t0, t1, t2, a[3], b[14]);+	MONT_MAC(v0, v1, v2, a[4], b[13]);+	MONT_MAC(w0, w1, w2, a[5], b[12]);+	MONT_MAC(t0, t1, t2, a[6], b[11]);+	MONT_MAC(v0, v1, v2, a[7], b[10]);+	MONT_MAC(w0, w1, w2, a[8], b[9]);+	MONT_MAC(t0, t1, t2, a[9], b[8]);+	MONT_MAC(v0, v1, v2, a[10], b[7]);+	MONT_MAC(w0, w1, w2, a[11], b[6]);+	MONT_MAC(t0, t1, t2, a[12], b[5]);+	MONT_MAC(v0, v1, v2, a[13], b[4]);+	MONT_MAC(w0, w1, w2, a[14], b[3]);+	MONT_MAC(t0, t1, t2, a[15], b[2]);+	MONT_MAC(v0, v1, v2, a[16], b[1]);+	MONT_MAC(w0, w1, w2, a[17], b[0]);+	MONT_MAC(t0, t1, t2, u[0], m[17]);+	MONT_MAC(v0, v1, v2, u[1], m[16]);+	MONT_MAC(w0, w1, w2, u[2], m[15]);+	MONT_MAC(t0, t1, t2, u[3], m[14]);+	MONT_MAC(v0, v1, v2, u[4], m[13]);+	MONT_MAC(w0, w1, w2, u[5], m[12]);+	MONT_MAC(t0, t1, t2, u[6], m[11]);+	MONT_MAC(v0, v1, v2, u[7], m[10]);+	MONT_MAC(w0, w1, w2, u[8], m[9]);+	MONT_MAC(t0, t1, t2, u[9], m[8]);+	MONT_MAC(v0, v1, v2, u[10], m[7]);+	MONT_MAC(w0, w1, w2, u[11], m[6]);+	MONT_MAC(t0, t1, t2, u[12], m[5]);+	MONT_MAC(v0, v1, v2, u[13], m[4]);+	MONT_MAC(w0, w1, w2, u[14], m[3]);+	MONT_MAC(t0, t1, t2, u[15], m[2]);+	MONT_MAC(v0, v1, v2, u[16], m[1]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	u[17] = t0 * n0;+	MONT_MAC(t0, t1, t2, u[17], m[0]);+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 18 */+	MONT_MAC(t0, t1, t2, a[0], b[18]);+	MONT_MUL(v0, v1, v2, a[1], b[17]);+	MONT_MUL(w0, w1, w2, a[2], b[16]);+	MONT_MAC(t0, t1, t2, a[3], b[15]);+	MONT_MAC(v0, v1, v2, a[4], b[14]);+	MONT_MAC(w0, w1, w2, a[5], b[13]);+	MONT_MAC(t0, t1, t2, a[6], b[12]);+	MONT_MAC(v0, v1, v2, a[7], b[11]);+	MONT_MAC(w0, w1, w2, a[8], b[10]);+	MONT_MAC(t0, t1, t2, a[9], b[9]);+	MONT_MAC(v0, v1, v2, a[10], b[8]);+	MONT_MAC(w0, w1, w2, a[11], b[7]);+	MONT_MAC(t0, t1, t2, a[12], b[6]);+	MONT_MAC(v0, v1, v2, a[13], b[5]);+	MONT_MAC(w0, w1, w2, a[14], b[4]);+	MONT_MAC(t0, t1, t2, a[15], b[3]);+	MONT_MAC(v0, v1, v2, a[16], b[2]);+	MONT_MAC(w0, w1, w2, a[17], b[1]);+	MONT_MAC(t0, t1, t2, a[18], b[0]);+	MONT_MAC(v0, v1, v2, u[0], m[18]);+	MONT_MAC(w0, w1, w2, u[1], m[17]);+	MONT_MAC(t0, t1, t2, u[2], m[16]);+	MONT_MAC(v0, v1, v2, u[3], m[15]);+	MONT_MAC(w0, w1, w2, u[4], m[14]);+	MONT_MAC(t0, t1, t2, u[5], m[13]);+	MONT_MAC(v0, v1, v2, u[6], m[12]);+	MONT_MAC(w0, w1, w2, u[7], m[11]);+	MONT_MAC(t0, t1, t2, u[8], m[10]);+	MONT_MAC(v0, v1, v2, u[9], m[9]);+	MONT_MAC(w0, w1, w2, u[10], m[8]);+	MONT_MAC(t0, t1, t2, u[11], m[7]);+	MONT_MAC(v0, v1, v2, u[12], m[6]);+	MONT_MAC(w0, w1, w2, u[13], m[5]);+	MONT_MAC(t0, t1, t2, u[14], m[4]);+	MONT_MAC(v0, v1, v2, u[15], m[3]);+	MONT_MAC(w0, w1, w2, u[16], m[2]);+	MONT_MAC(t0, t1, t2, u[17], m[1]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	u[18] = t0 * n0;+	MONT_MAC(t0, t1, t2, u[18], m[0]);+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 19 */+	MONT_MAC(t0, t1, t2, a[0], b[19]);+	MONT_MUL(v0, v1, v2, a[1], b[18]);+	MONT_MUL(w0, w1, w2, a[2], b[17]);+	MONT_MAC(t0, t1, t2, a[3], b[16]);+	MONT_MAC(v0, v1, v2, a[4], b[15]);+	MONT_MAC(w0, w1, w2, a[5], b[14]);+	MONT_MAC(t0, t1, t2, a[6], b[13]);+	MONT_MAC(v0, v1, v2, a[7], b[12]);+	MONT_MAC(w0, w1, w2, a[8], b[11]);+	MONT_MAC(t0, t1, t2, a[9], b[10]);+	MONT_MAC(v0, v1, v2, a[10], b[9]);+	MONT_MAC(w0, w1, w2, a[11], b[8]);+	MONT_MAC(t0, t1, t2, a[12], b[7]);+	MONT_MAC(v0, v1, v2, a[13], b[6]);+	MONT_MAC(w0, w1, w2, a[14], b[5]);+	MONT_MAC(t0, t1, t2, a[15], b[4]);+	MONT_MAC(v0, v1, v2, a[16], b[3]);+	MONT_MAC(w0, w1, w2, a[17], b[2]);+	MONT_MAC(t0, t1, t2, a[18], b[1]);+	MONT_MAC(v0, v1, v2, a[19], b[0]);+	MONT_MAC(w0, w1, w2, u[0], m[19]);+	MONT_MAC(t0, t1, t2, u[1], m[18]);+	MONT_MAC(v0, v1, v2, u[2], m[17]);+	MONT_MAC(w0, w1, w2, u[3], m[16]);+	MONT_MAC(t0, t1, t2, u[4], m[15]);+	MONT_MAC(v0, v1, v2, u[5], m[14]);+	MONT_MAC(w0, w1, w2, u[6], m[13]);+	MONT_MAC(t0, t1, t2, u[7], m[12]);+	MONT_MAC(v0, v1, v2, u[8], m[11]);+	MONT_MAC(w0, w1, w2, u[9], m[10]);+	MONT_MAC(t0, t1, t2, u[10], m[9]);+	MONT_MAC(v0, v1, v2, u[11], m[8]);+	MONT_MAC(w0, w1, w2, u[12], m[7]);+	MONT_MAC(t0, t1, t2, u[13], m[6]);+	MONT_MAC(v0, v1, v2, u[14], m[5]);+	MONT_MAC(w0, w1, w2, u[15], m[4]);+	MONT_MAC(t0, t1, t2, u[16], m[3]);+	MONT_MAC(v0, v1, v2, u[17], m[2]);+	MONT_MAC(w0, w1, w2, u[18], m[1]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	u[19] = t0 * n0;+	MONT_MAC(t0, t1, t2, u[19], m[0]);+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 20 */+	MONT_MAC(t0, t1, t2, a[0], b[20]);+	MONT_MUL(v0, v1, v2, a[1], b[19]);+	MONT_MUL(w0, w1, w2, a[2], b[18]);+	MONT_MAC(t0, t1, t2, a[3], b[17]);+	MONT_MAC(v0, v1, v2, a[4], b[16]);+	MONT_MAC(w0, w1, w2, a[5], b[15]);+	MONT_MAC(t0, t1, t2, a[6], b[14]);+	MONT_MAC(v0, v1, v2, a[7], b[13]);+	MONT_MAC(w0, w1, w2, a[8], b[12]);+	MONT_MAC(t0, t1, t2, a[9], b[11]);+	MONT_MAC(v0, v1, v2, a[10], b[10]);+	MONT_MAC(w0, w1, w2, a[11], b[9]);+	MONT_MAC(t0, t1, t2, a[12], b[8]);+	MONT_MAC(v0, v1, v2, a[13], b[7]);+	MONT_MAC(w0, w1, w2, a[14], b[6]);+	MONT_MAC(t0, t1, t2, a[15], b[5]);+	MONT_MAC(v0, v1, v2, a[16], b[4]);+	MONT_MAC(w0, w1, w2, a[17], b[3]);+	MONT_MAC(t0, t1, t2, a[18], b[2]);+	MONT_MAC(v0, v1, v2, a[19], b[1]);+	MONT_MAC(w0, w1, w2, a[20], b[0]);+	MONT_MAC(t0, t1, t2, u[0], m[20]);+	MONT_MAC(v0, v1, v2, u[1], m[19]);+	MONT_MAC(w0, w1, w2, u[2], m[18]);+	MONT_MAC(t0, t1, t2, u[3], m[17]);+	MONT_MAC(v0, v1, v2, u[4], m[16]);+	MONT_MAC(w0, w1, w2, u[5], m[15]);+	MONT_MAC(t0, t1, t2, u[6], m[14]);+	MONT_MAC(v0, v1, v2, u[7], m[13]);+	MONT_MAC(w0, w1, w2, u[8], m[12]);+	MONT_MAC(t0, t1, t2, u[9], m[11]);+	MONT_MAC(v0, v1, v2, u[10], m[10]);+	MONT_MAC(w0, w1, w2, u[11], m[9]);+	MONT_MAC(t0, t1, t2, u[12], m[8]);+	MONT_MAC(v0, v1, v2, u[13], m[7]);+	MONT_MAC(w0, w1, w2, u[14], m[6]);+	MONT_MAC(t0, t1, t2, u[15], m[5]);+	MONT_MAC(v0, v1, v2, u[16], m[4]);+	MONT_MAC(w0, w1, w2, u[17], m[3]);+	MONT_MAC(t0, t1, t2, u[18], m[2]);+	MONT_MAC(v0, v1, v2, u[19], m[1]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	u[20] = t0 * n0;+	MONT_MAC(t0, t1, t2, u[20], m[0]);+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 21 */+	MONT_MAC(t0, t1, t2, a[0], b[21]);+	MONT_MUL(v0, v1, v2, a[1], b[20]);+	MONT_MUL(w0, w1, w2, a[2], b[19]);+	MONT_MAC(t0, t1, t2, a[3], b[18]);+	MONT_MAC(v0, v1, v2, a[4], b[17]);+	MONT_MAC(w0, w1, w2, a[5], b[16]);+	MONT_MAC(t0, t1, t2, a[6], b[15]);+	MONT_MAC(v0, v1, v2, a[7], b[14]);+	MONT_MAC(w0, w1, w2, a[8], b[13]);+	MONT_MAC(t0, t1, t2, a[9], b[12]);+	MONT_MAC(v0, v1, v2, a[10], b[11]);+	MONT_MAC(w0, w1, w2, a[11], b[10]);+	MONT_MAC(t0, t1, t2, a[12], b[9]);+	MONT_MAC(v0, v1, v2, a[13], b[8]);+	MONT_MAC(w0, w1, w2, a[14], b[7]);+	MONT_MAC(t0, t1, t2, a[15], b[6]);+	MONT_MAC(v0, v1, v2, a[16], b[5]);+	MONT_MAC(w0, w1, w2, a[17], b[4]);+	MONT_MAC(t0, t1, t2, a[18], b[3]);+	MONT_MAC(v0, v1, v2, a[19], b[2]);+	MONT_MAC(w0, w1, w2, a[20], b[1]);+	MONT_MAC(t0, t1, t2, a[21], b[0]);+	MONT_MAC(v0, v1, v2, u[0], m[21]);+	MONT_MAC(w0, w1, w2, u[1], m[20]);+	MONT_MAC(t0, t1, t2, u[2], m[19]);+	MONT_MAC(v0, v1, v2, u[3], m[18]);+	MONT_MAC(w0, w1, w2, u[4], m[17]);+	MONT_MAC(t0, t1, t2, u[5], m[16]);+	MONT_MAC(v0, v1, v2, u[6], m[15]);+	MONT_MAC(w0, w1, w2, u[7], m[14]);+	MONT_MAC(t0, t1, t2, u[8], m[13]);+	MONT_MAC(v0, v1, v2, u[9], m[12]);+	MONT_MAC(w0, w1, w2, u[10], m[11]);+	MONT_MAC(t0, t1, t2, u[11], m[10]);+	MONT_MAC(v0, v1, v2, u[12], m[9]);+	MONT_MAC(w0, w1, w2, u[13], m[8]);+	MONT_MAC(t0, t1, t2, u[14], m[7]);+	MONT_MAC(v0, v1, v2, u[15], m[6]);+	MONT_MAC(w0, w1, w2, u[16], m[5]);+	MONT_MAC(t0, t1, t2, u[17], m[4]);+	MONT_MAC(v0, v1, v2, u[18], m[3]);+	MONT_MAC(w0, w1, w2, u[19], m[2]);+	MONT_MAC(t0, t1, t2, u[20], m[1]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	u[21] = t0 * n0;+	MONT_MAC(t0, t1, t2, u[21], m[0]);+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 22 */+	MONT_MAC(t0, t1, t2, a[0], b[22]);+	MONT_MUL(v0, v1, v2, a[1], b[21]);+	MONT_MUL(w0, w1, w2, a[2], b[20]);+	MONT_MAC(t0, t1, t2, a[3], b[19]);+	MONT_MAC(v0, v1, v2, a[4], b[18]);+	MONT_MAC(w0, w1, w2, a[5], b[17]);+	MONT_MAC(t0, t1, t2, a[6], b[16]);+	MONT_MAC(v0, v1, v2, a[7], b[15]);+	MONT_MAC(w0, w1, w2, a[8], b[14]);+	MONT_MAC(t0, t1, t2, a[9], b[13]);+	MONT_MAC(v0, v1, v2, a[10], b[12]);+	MONT_MAC(w0, w1, w2, a[11], b[11]);+	MONT_MAC(t0, t1, t2, a[12], b[10]);+	MONT_MAC(v0, v1, v2, a[13], b[9]);+	MONT_MAC(w0, w1, w2, a[14], b[8]);+	MONT_MAC(t0, t1, t2, a[15], b[7]);+	MONT_MAC(v0, v1, v2, a[16], b[6]);+	MONT_MAC(w0, w1, w2, a[17], b[5]);+	MONT_MAC(t0, t1, t2, a[18], b[4]);+	MONT_MAC(v0, v1, v2, a[19], b[3]);+	MONT_MAC(w0, w1, w2, a[20], b[2]);+	MONT_MAC(t0, t1, t2, a[21], b[1]);+	MONT_MAC(v0, v1, v2, a[22], b[0]);+	MONT_MAC(w0, w1, w2, u[0], m[22]);+	MONT_MAC(t0, t1, t2, u[1], m[21]);+	MONT_MAC(v0, v1, v2, u[2], m[20]);+	MONT_MAC(w0, w1, w2, u[3], m[19]);+	MONT_MAC(t0, t1, t2, u[4], m[18]);+	MONT_MAC(v0, v1, v2, u[5], m[17]);+	MONT_MAC(w0, w1, w2, u[6], m[16]);+	MONT_MAC(t0, t1, t2, u[7], m[15]);+	MONT_MAC(v0, v1, v2, u[8], m[14]);+	MONT_MAC(w0, w1, w2, u[9], m[13]);+	MONT_MAC(t0, t1, t2, u[10], m[12]);+	MONT_MAC(v0, v1, v2, u[11], m[11]);+	MONT_MAC(w0, w1, w2, u[12], m[10]);+	MONT_MAC(t0, t1, t2, u[13], m[9]);+	MONT_MAC(v0, v1, v2, u[14], m[8]);+	MONT_MAC(w0, w1, w2, u[15], m[7]);+	MONT_MAC(t0, t1, t2, u[16], m[6]);+	MONT_MAC(v0, v1, v2, u[17], m[5]);+	MONT_MAC(w0, w1, w2, u[18], m[4]);+	MONT_MAC(t0, t1, t2, u[19], m[3]);+	MONT_MAC(v0, v1, v2, u[20], m[2]);+	MONT_MAC(w0, w1, w2, u[21], m[1]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	u[22] = t0 * n0;+	MONT_MAC(t0, t1, t2, u[22], m[0]);+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 23 */+	MONT_MAC(t0, t1, t2, a[0], b[23]);+	MONT_MUL(v0, v1, v2, a[1], b[22]);+	MONT_MUL(w0, w1, w2, a[2], b[21]);+	MONT_MAC(t0, t1, t2, a[3], b[20]);+	MONT_MAC(v0, v1, v2, a[4], b[19]);+	MONT_MAC(w0, w1, w2, a[5], b[18]);+	MONT_MAC(t0, t1, t2, a[6], b[17]);+	MONT_MAC(v0, v1, v2, a[7], b[16]);+	MONT_MAC(w0, w1, w2, a[8], b[15]);+	MONT_MAC(t0, t1, t2, a[9], b[14]);+	MONT_MAC(v0, v1, v2, a[10], b[13]);+	MONT_MAC(w0, w1, w2, a[11], b[12]);+	MONT_MAC(t0, t1, t2, a[12], b[11]);+	MONT_MAC(v0, v1, v2, a[13], b[10]);+	MONT_MAC(w0, w1, w2, a[14], b[9]);+	MONT_MAC(t0, t1, t2, a[15], b[8]);+	MONT_MAC(v0, v1, v2, a[16], b[7]);+	MONT_MAC(w0, w1, w2, a[17], b[6]);+	MONT_MAC(t0, t1, t2, a[18], b[5]);+	MONT_MAC(v0, v1, v2, a[19], b[4]);+	MONT_MAC(w0, w1, w2, a[20], b[3]);+	MONT_MAC(t0, t1, t2, a[21], b[2]);+	MONT_MAC(v0, v1, v2, a[22], b[1]);+	MONT_MAC(w0, w1, w2, a[23], b[0]);+	MONT_MAC(t0, t1, t2, u[0], m[23]);+	MONT_MAC(v0, v1, v2, u[1], m[22]);+	MONT_MAC(w0, w1, w2, u[2], m[21]);+	MONT_MAC(t0, t1, t2, u[3], m[20]);+	MONT_MAC(v0, v1, v2, u[4], m[19]);+	MONT_MAC(w0, w1, w2, u[5], m[18]);+	MONT_MAC(t0, t1, t2, u[6], m[17]);+	MONT_MAC(v0, v1, v2, u[7], m[16]);+	MONT_MAC(w0, w1, w2, u[8], m[15]);+	MONT_MAC(t0, t1, t2, u[9], m[14]);+	MONT_MAC(v0, v1, v2, u[10], m[13]);+	MONT_MAC(w0, w1, w2, u[11], m[12]);+	MONT_MAC(t0, t1, t2, u[12], m[11]);+	MONT_MAC(v0, v1, v2, u[13], m[10]);+	MONT_MAC(w0, w1, w2, u[14], m[9]);+	MONT_MAC(t0, t1, t2, u[15], m[8]);+	MONT_MAC(v0, v1, v2, u[16], m[7]);+	MONT_MAC(w0, w1, w2, u[17], m[6]);+	MONT_MAC(t0, t1, t2, u[18], m[5]);+	MONT_MAC(v0, v1, v2, u[19], m[4]);+	MONT_MAC(w0, w1, w2, u[20], m[3]);+	MONT_MAC(t0, t1, t2, u[21], m[2]);+	MONT_MAC(v0, v1, v2, u[22], m[1]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	u[23] = t0 * n0;+	MONT_MAC(t0, t1, t2, u[23], m[0]);+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 24 */+	MONT_MAC(t0, t1, t2, a[0], b[24]);+	MONT_MUL(v0, v1, v2, a[1], b[23]);+	MONT_MUL(w0, w1, w2, a[2], b[22]);+	MONT_MAC(t0, t1, t2, a[3], b[21]);+	MONT_MAC(v0, v1, v2, a[4], b[20]);+	MONT_MAC(w0, w1, w2, a[5], b[19]);+	MONT_MAC(t0, t1, t2, a[6], b[18]);+	MONT_MAC(v0, v1, v2, a[7], b[17]);+	MONT_MAC(w0, w1, w2, a[8], b[16]);+	MONT_MAC(t0, t1, t2, a[9], b[15]);+	MONT_MAC(v0, v1, v2, a[10], b[14]);+	MONT_MAC(w0, w1, w2, a[11], b[13]);+	MONT_MAC(t0, t1, t2, a[12], b[12]);+	MONT_MAC(v0, v1, v2, a[13], b[11]);+	MONT_MAC(w0, w1, w2, a[14], b[10]);+	MONT_MAC(t0, t1, t2, a[15], b[9]);+	MONT_MAC(v0, v1, v2, a[16], b[8]);+	MONT_MAC(w0, w1, w2, a[17], b[7]);+	MONT_MAC(t0, t1, t2, a[18], b[6]);+	MONT_MAC(v0, v1, v2, a[19], b[5]);+	MONT_MAC(w0, w1, w2, a[20], b[4]);+	MONT_MAC(t0, t1, t2, a[21], b[3]);+	MONT_MAC(v0, v1, v2, a[22], b[2]);+	MONT_MAC(w0, w1, w2, a[23], b[1]);+	MONT_MAC(t0, t1, t2, a[24], b[0]);+	MONT_MAC(v0, v1, v2, u[0], m[24]);+	MONT_MAC(w0, w1, w2, u[1], m[23]);+	MONT_MAC(t0, t1, t2, u[2], m[22]);+	MONT_MAC(v0, v1, v2, u[3], m[21]);+	MONT_MAC(w0, w1, w2, u[4], m[20]);+	MONT_MAC(t0, t1, t2, u[5], m[19]);+	MONT_MAC(v0, v1, v2, u[6], m[18]);+	MONT_MAC(w0, w1, w2, u[7], m[17]);+	MONT_MAC(t0, t1, t2, u[8], m[16]);+	MONT_MAC(v0, v1, v2, u[9], m[15]);+	MONT_MAC(w0, w1, w2, u[10], m[14]);+	MONT_MAC(t0, t1, t2, u[11], m[13]);+	MONT_MAC(v0, v1, v2, u[12], m[12]);+	MONT_MAC(w0, w1, w2, u[13], m[11]);+	MONT_MAC(t0, t1, t2, u[14], m[10]);+	MONT_MAC(v0, v1, v2, u[15], m[9]);+	MONT_MAC(w0, w1, w2, u[16], m[8]);+	MONT_MAC(t0, t1, t2, u[17], m[7]);+	MONT_MAC(v0, v1, v2, u[18], m[6]);+	MONT_MAC(w0, w1, w2, u[19], m[5]);+	MONT_MAC(t0, t1, t2, u[20], m[4]);+	MONT_MAC(v0, v1, v2, u[21], m[3]);+	MONT_MAC(w0, w1, w2, u[22], m[2]);+	MONT_MAC(t0, t1, t2, u[23], m[1]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	u[24] = t0 * n0;+	MONT_MAC(t0, t1, t2, u[24], m[0]);+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 25 */+	MONT_MAC(t0, t1, t2, a[0], b[25]);+	MONT_MUL(v0, v1, v2, a[1], b[24]);+	MONT_MUL(w0, w1, w2, a[2], b[23]);+	MONT_MAC(t0, t1, t2, a[3], b[22]);+	MONT_MAC(v0, v1, v2, a[4], b[21]);+	MONT_MAC(w0, w1, w2, a[5], b[20]);+	MONT_MAC(t0, t1, t2, a[6], b[19]);+	MONT_MAC(v0, v1, v2, a[7], b[18]);+	MONT_MAC(w0, w1, w2, a[8], b[17]);+	MONT_MAC(t0, t1, t2, a[9], b[16]);+	MONT_MAC(v0, v1, v2, a[10], b[15]);+	MONT_MAC(w0, w1, w2, a[11], b[14]);+	MONT_MAC(t0, t1, t2, a[12], b[13]);+	MONT_MAC(v0, v1, v2, a[13], b[12]);+	MONT_MAC(w0, w1, w2, a[14], b[11]);+	MONT_MAC(t0, t1, t2, a[15], b[10]);+	MONT_MAC(v0, v1, v2, a[16], b[9]);+	MONT_MAC(w0, w1, w2, a[17], b[8]);+	MONT_MAC(t0, t1, t2, a[18], b[7]);+	MONT_MAC(v0, v1, v2, a[19], b[6]);+	MONT_MAC(w0, w1, w2, a[20], b[5]);+	MONT_MAC(t0, t1, t2, a[21], b[4]);+	MONT_MAC(v0, v1, v2, a[22], b[3]);+	MONT_MAC(w0, w1, w2, a[23], b[2]);+	MONT_MAC(t0, t1, t2, a[24], b[1]);+	MONT_MAC(v0, v1, v2, a[25], b[0]);+	MONT_MAC(w0, w1, w2, u[0], m[25]);+	MONT_MAC(t0, t1, t2, u[1], m[24]);+	MONT_MAC(v0, v1, v2, u[2], m[23]);+	MONT_MAC(w0, w1, w2, u[3], m[22]);+	MONT_MAC(t0, t1, t2, u[4], m[21]);+	MONT_MAC(v0, v1, v2, u[5], m[20]);+	MONT_MAC(w0, w1, w2, u[6], m[19]);+	MONT_MAC(t0, t1, t2, u[7], m[18]);+	MONT_MAC(v0, v1, v2, u[8], m[17]);+	MONT_MAC(w0, w1, w2, u[9], m[16]);+	MONT_MAC(t0, t1, t2, u[10], m[15]);+	MONT_MAC(v0, v1, v2, u[11], m[14]);+	MONT_MAC(w0, w1, w2, u[12], m[13]);+	MONT_MAC(t0, t1, t2, u[13], m[12]);+	MONT_MAC(v0, v1, v2, u[14], m[11]);+	MONT_MAC(w0, w1, w2, u[15], m[10]);+	MONT_MAC(t0, t1, t2, u[16], m[9]);+	MONT_MAC(v0, v1, v2, u[17], m[8]);+	MONT_MAC(w0, w1, w2, u[18], m[7]);+	MONT_MAC(t0, t1, t2, u[19], m[6]);+	MONT_MAC(v0, v1, v2, u[20], m[5]);+	MONT_MAC(w0, w1, w2, u[21], m[4]);+	MONT_MAC(t0, t1, t2, u[22], m[3]);+	MONT_MAC(v0, v1, v2, u[23], m[2]);+	MONT_MAC(w0, w1, w2, u[24], m[1]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	u[25] = t0 * n0;+	MONT_MAC(t0, t1, t2, u[25], m[0]);+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 26 */+	MONT_MAC(t0, t1, t2, a[0], b[26]);+	MONT_MUL(v0, v1, v2, a[1], b[25]);+	MONT_MUL(w0, w1, w2, a[2], b[24]);+	MONT_MAC(t0, t1, t2, a[3], b[23]);+	MONT_MAC(v0, v1, v2, a[4], b[22]);+	MONT_MAC(w0, w1, w2, a[5], b[21]);+	MONT_MAC(t0, t1, t2, a[6], b[20]);+	MONT_MAC(v0, v1, v2, a[7], b[19]);+	MONT_MAC(w0, w1, w2, a[8], b[18]);+	MONT_MAC(t0, t1, t2, a[9], b[17]);+	MONT_MAC(v0, v1, v2, a[10], b[16]);+	MONT_MAC(w0, w1, w2, a[11], b[15]);+	MONT_MAC(t0, t1, t2, a[12], b[14]);+	MONT_MAC(v0, v1, v2, a[13], b[13]);+	MONT_MAC(w0, w1, w2, a[14], b[12]);+	MONT_MAC(t0, t1, t2, a[15], b[11]);+	MONT_MAC(v0, v1, v2, a[16], b[10]);+	MONT_MAC(w0, w1, w2, a[17], b[9]);+	MONT_MAC(t0, t1, t2, a[18], b[8]);+	MONT_MAC(v0, v1, v2, a[19], b[7]);+	MONT_MAC(w0, w1, w2, a[20], b[6]);+	MONT_MAC(t0, t1, t2, a[21], b[5]);+	MONT_MAC(v0, v1, v2, a[22], b[4]);+	MONT_MAC(w0, w1, w2, a[23], b[3]);+	MONT_MAC(t0, t1, t2, a[24], b[2]);+	MONT_MAC(v0, v1, v2, a[25], b[1]);+	MONT_MAC(w0, w1, w2, a[26], b[0]);+	MONT_MAC(t0, t1, t2, u[0], m[26]);+	MONT_MAC(v0, v1, v2, u[1], m[25]);+	MONT_MAC(w0, w1, w2, u[2], m[24]);+	MONT_MAC(t0, t1, t2, u[3], m[23]);+	MONT_MAC(v0, v1, v2, u[4], m[22]);+	MONT_MAC(w0, w1, w2, u[5], m[21]);+	MONT_MAC(t0, t1, t2, u[6], m[20]);+	MONT_MAC(v0, v1, v2, u[7], m[19]);+	MONT_MAC(w0, w1, w2, u[8], m[18]);+	MONT_MAC(t0, t1, t2, u[9], m[17]);+	MONT_MAC(v0, v1, v2, u[10], m[16]);+	MONT_MAC(w0, w1, w2, u[11], m[15]);+	MONT_MAC(t0, t1, t2, u[12], m[14]);+	MONT_MAC(v0, v1, v2, u[13], m[13]);+	MONT_MAC(w0, w1, w2, u[14], m[12]);+	MONT_MAC(t0, t1, t2, u[15], m[11]);+	MONT_MAC(v0, v1, v2, u[16], m[10]);+	MONT_MAC(w0, w1, w2, u[17], m[9]);+	MONT_MAC(t0, t1, t2, u[18], m[8]);+	MONT_MAC(v0, v1, v2, u[19], m[7]);+	MONT_MAC(w0, w1, w2, u[20], m[6]);+	MONT_MAC(t0, t1, t2, u[21], m[5]);+	MONT_MAC(v0, v1, v2, u[22], m[4]);+	MONT_MAC(w0, w1, w2, u[23], m[3]);+	MONT_MAC(t0, t1, t2, u[24], m[2]);+	MONT_MAC(v0, v1, v2, u[25], m[1]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	u[26] = t0 * n0;+	MONT_MAC(t0, t1, t2, u[26], m[0]);+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 27 */+	MONT_MAC(t0, t1, t2, a[0], b[27]);+	MONT_MUL(v0, v1, v2, a[1], b[26]);+	MONT_MUL(w0, w1, w2, a[2], b[25]);+	MONT_MAC(t0, t1, t2, a[3], b[24]);+	MONT_MAC(v0, v1, v2, a[4], b[23]);+	MONT_MAC(w0, w1, w2, a[5], b[22]);+	MONT_MAC(t0, t1, t2, a[6], b[21]);+	MONT_MAC(v0, v1, v2, a[7], b[20]);+	MONT_MAC(w0, w1, w2, a[8], b[19]);+	MONT_MAC(t0, t1, t2, a[9], b[18]);+	MONT_MAC(v0, v1, v2, a[10], b[17]);+	MONT_MAC(w0, w1, w2, a[11], b[16]);+	MONT_MAC(t0, t1, t2, a[12], b[15]);+	MONT_MAC(v0, v1, v2, a[13], b[14]);+	MONT_MAC(w0, w1, w2, a[14], b[13]);+	MONT_MAC(t0, t1, t2, a[15], b[12]);+	MONT_MAC(v0, v1, v2, a[16], b[11]);+	MONT_MAC(w0, w1, w2, a[17], b[10]);+	MONT_MAC(t0, t1, t2, a[18], b[9]);+	MONT_MAC(v0, v1, v2, a[19], b[8]);+	MONT_MAC(w0, w1, w2, a[20], b[7]);+	MONT_MAC(t0, t1, t2, a[21], b[6]);+	MONT_MAC(v0, v1, v2, a[22], b[5]);+	MONT_MAC(w0, w1, w2, a[23], b[4]);+	MONT_MAC(t0, t1, t2, a[24], b[3]);+	MONT_MAC(v0, v1, v2, a[25], b[2]);+	MONT_MAC(w0, w1, w2, a[26], b[1]);+	MONT_MAC(t0, t1, t2, a[27], b[0]);+	MONT_MAC(v0, v1, v2, u[0], m[27]);+	MONT_MAC(w0, w1, w2, u[1], m[26]);+	MONT_MAC(t0, t1, t2, u[2], m[25]);+	MONT_MAC(v0, v1, v2, u[3], m[24]);+	MONT_MAC(w0, w1, w2, u[4], m[23]);+	MONT_MAC(t0, t1, t2, u[5], m[22]);+	MONT_MAC(v0, v1, v2, u[6], m[21]);+	MONT_MAC(w0, w1, w2, u[7], m[20]);+	MONT_MAC(t0, t1, t2, u[8], m[19]);+	MONT_MAC(v0, v1, v2, u[9], m[18]);+	MONT_MAC(w0, w1, w2, u[10], m[17]);+	MONT_MAC(t0, t1, t2, u[11], m[16]);+	MONT_MAC(v0, v1, v2, u[12], m[15]);+	MONT_MAC(w0, w1, w2, u[13], m[14]);+	MONT_MAC(t0, t1, t2, u[14], m[13]);+	MONT_MAC(v0, v1, v2, u[15], m[12]);+	MONT_MAC(w0, w1, w2, u[16], m[11]);+	MONT_MAC(t0, t1, t2, u[17], m[10]);+	MONT_MAC(v0, v1, v2, u[18], m[9]);+	MONT_MAC(w0, w1, w2, u[19], m[8]);+	MONT_MAC(t0, t1, t2, u[20], m[7]);+	MONT_MAC(v0, v1, v2, u[21], m[6]);+	MONT_MAC(w0, w1, w2, u[22], m[5]);+	MONT_MAC(t0, t1, t2, u[23], m[4]);+	MONT_MAC(v0, v1, v2, u[24], m[3]);+	MONT_MAC(w0, w1, w2, u[25], m[2]);+	MONT_MAC(t0, t1, t2, u[26], m[1]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	u[27] = t0 * n0;+	MONT_MAC(t0, t1, t2, u[27], m[0]);+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 28 */+	MONT_MAC(t0, t1, t2, a[0], b[28]);+	MONT_MUL(v0, v1, v2, a[1], b[27]);+	MONT_MUL(w0, w1, w2, a[2], b[26]);+	MONT_MAC(t0, t1, t2, a[3], b[25]);+	MONT_MAC(v0, v1, v2, a[4], b[24]);+	MONT_MAC(w0, w1, w2, a[5], b[23]);+	MONT_MAC(t0, t1, t2, a[6], b[22]);+	MONT_MAC(v0, v1, v2, a[7], b[21]);+	MONT_MAC(w0, w1, w2, a[8], b[20]);+	MONT_MAC(t0, t1, t2, a[9], b[19]);+	MONT_MAC(v0, v1, v2, a[10], b[18]);+	MONT_MAC(w0, w1, w2, a[11], b[17]);+	MONT_MAC(t0, t1, t2, a[12], b[16]);+	MONT_MAC(v0, v1, v2, a[13], b[15]);+	MONT_MAC(w0, w1, w2, a[14], b[14]);+	MONT_MAC(t0, t1, t2, a[15], b[13]);+	MONT_MAC(v0, v1, v2, a[16], b[12]);+	MONT_MAC(w0, w1, w2, a[17], b[11]);+	MONT_MAC(t0, t1, t2, a[18], b[10]);+	MONT_MAC(v0, v1, v2, a[19], b[9]);+	MONT_MAC(w0, w1, w2, a[20], b[8]);+	MONT_MAC(t0, t1, t2, a[21], b[7]);+	MONT_MAC(v0, v1, v2, a[22], b[6]);+	MONT_MAC(w0, w1, w2, a[23], b[5]);+	MONT_MAC(t0, t1, t2, a[24], b[4]);+	MONT_MAC(v0, v1, v2, a[25], b[3]);+	MONT_MAC(w0, w1, w2, a[26], b[2]);+	MONT_MAC(t0, t1, t2, a[27], b[1]);+	MONT_MAC(v0, v1, v2, a[28], b[0]);+	MONT_MAC(w0, w1, w2, u[0], m[28]);+	MONT_MAC(t0, t1, t2, u[1], m[27]);+	MONT_MAC(v0, v1, v2, u[2], m[26]);+	MONT_MAC(w0, w1, w2, u[3], m[25]);+	MONT_MAC(t0, t1, t2, u[4], m[24]);+	MONT_MAC(v0, v1, v2, u[5], m[23]);+	MONT_MAC(w0, w1, w2, u[6], m[22]);+	MONT_MAC(t0, t1, t2, u[7], m[21]);+	MONT_MAC(v0, v1, v2, u[8], m[20]);+	MONT_MAC(w0, w1, w2, u[9], m[19]);+	MONT_MAC(t0, t1, t2, u[10], m[18]);+	MONT_MAC(v0, v1, v2, u[11], m[17]);+	MONT_MAC(w0, w1, w2, u[12], m[16]);+	MONT_MAC(t0, t1, t2, u[13], m[15]);+	MONT_MAC(v0, v1, v2, u[14], m[14]);+	MONT_MAC(w0, w1, w2, u[15], m[13]);+	MONT_MAC(t0, t1, t2, u[16], m[12]);+	MONT_MAC(v0, v1, v2, u[17], m[11]);+	MONT_MAC(w0, w1, w2, u[18], m[10]);+	MONT_MAC(t0, t1, t2, u[19], m[9]);+	MONT_MAC(v0, v1, v2, u[20], m[8]);+	MONT_MAC(w0, w1, w2, u[21], m[7]);+	MONT_MAC(t0, t1, t2, u[22], m[6]);+	MONT_MAC(v0, v1, v2, u[23], m[5]);+	MONT_MAC(w0, w1, w2, u[24], m[4]);+	MONT_MAC(t0, t1, t2, u[25], m[3]);+	MONT_MAC(v0, v1, v2, u[26], m[2]);+	MONT_MAC(w0, w1, w2, u[27], m[1]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	u[28] = t0 * n0;+	MONT_MAC(t0, t1, t2, u[28], m[0]);+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 29 */+	MONT_MAC(t0, t1, t2, a[0], b[29]);+	MONT_MUL(v0, v1, v2, a[1], b[28]);+	MONT_MUL(w0, w1, w2, a[2], b[27]);+	MONT_MAC(t0, t1, t2, a[3], b[26]);+	MONT_MAC(v0, v1, v2, a[4], b[25]);+	MONT_MAC(w0, w1, w2, a[5], b[24]);+	MONT_MAC(t0, t1, t2, a[6], b[23]);+	MONT_MAC(v0, v1, v2, a[7], b[22]);+	MONT_MAC(w0, w1, w2, a[8], b[21]);+	MONT_MAC(t0, t1, t2, a[9], b[20]);+	MONT_MAC(v0, v1, v2, a[10], b[19]);+	MONT_MAC(w0, w1, w2, a[11], b[18]);+	MONT_MAC(t0, t1, t2, a[12], b[17]);+	MONT_MAC(v0, v1, v2, a[13], b[16]);+	MONT_MAC(w0, w1, w2, a[14], b[15]);+	MONT_MAC(t0, t1, t2, a[15], b[14]);+	MONT_MAC(v0, v1, v2, a[16], b[13]);+	MONT_MAC(w0, w1, w2, a[17], b[12]);+	MONT_MAC(t0, t1, t2, a[18], b[11]);+	MONT_MAC(v0, v1, v2, a[19], b[10]);+	MONT_MAC(w0, w1, w2, a[20], b[9]);+	MONT_MAC(t0, t1, t2, a[21], b[8]);+	MONT_MAC(v0, v1, v2, a[22], b[7]);+	MONT_MAC(w0, w1, w2, a[23], b[6]);+	MONT_MAC(t0, t1, t2, a[24], b[5]);+	MONT_MAC(v0, v1, v2, a[25], b[4]);+	MONT_MAC(w0, w1, w2, a[26], b[3]);+	MONT_MAC(t0, t1, t2, a[27], b[2]);+	MONT_MAC(v0, v1, v2, a[28], b[1]);+	MONT_MAC(w0, w1, w2, a[29], b[0]);+	MONT_MAC(t0, t1, t2, u[0], m[29]);+	MONT_MAC(v0, v1, v2, u[1], m[28]);+	MONT_MAC(w0, w1, w2, u[2], m[27]);+	MONT_MAC(t0, t1, t2, u[3], m[26]);+	MONT_MAC(v0, v1, v2, u[4], m[25]);+	MONT_MAC(w0, w1, w2, u[5], m[24]);+	MONT_MAC(t0, t1, t2, u[6], m[23]);+	MONT_MAC(v0, v1, v2, u[7], m[22]);+	MONT_MAC(w0, w1, w2, u[8], m[21]);+	MONT_MAC(t0, t1, t2, u[9], m[20]);+	MONT_MAC(v0, v1, v2, u[10], m[19]);+	MONT_MAC(w0, w1, w2, u[11], m[18]);+	MONT_MAC(t0, t1, t2, u[12], m[17]);+	MONT_MAC(v0, v1, v2, u[13], m[16]);+	MONT_MAC(w0, w1, w2, u[14], m[15]);+	MONT_MAC(t0, t1, t2, u[15], m[14]);+	MONT_MAC(v0, v1, v2, u[16], m[13]);+	MONT_MAC(w0, w1, w2, u[17], m[12]);+	MONT_MAC(t0, t1, t2, u[18], m[11]);+	MONT_MAC(v0, v1, v2, u[19], m[10]);+	MONT_MAC(w0, w1, w2, u[20], m[9]);+	MONT_MAC(t0, t1, t2, u[21], m[8]);+	MONT_MAC(v0, v1, v2, u[22], m[7]);+	MONT_MAC(w0, w1, w2, u[23], m[6]);+	MONT_MAC(t0, t1, t2, u[24], m[5]);+	MONT_MAC(v0, v1, v2, u[25], m[4]);+	MONT_MAC(w0, w1, w2, u[26], m[3]);+	MONT_MAC(t0, t1, t2, u[27], m[2]);+	MONT_MAC(v0, v1, v2, u[28], m[1]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	u[29] = t0 * n0;+	MONT_MAC(t0, t1, t2, u[29], m[0]);+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 30 */+	MONT_MAC(t0, t1, t2, a[0], b[30]);+	MONT_MUL(v0, v1, v2, a[1], b[29]);+	MONT_MUL(w0, w1, w2, a[2], b[28]);+	MONT_MAC(t0, t1, t2, a[3], b[27]);+	MONT_MAC(v0, v1, v2, a[4], b[26]);+	MONT_MAC(w0, w1, w2, a[5], b[25]);+	MONT_MAC(t0, t1, t2, a[6], b[24]);+	MONT_MAC(v0, v1, v2, a[7], b[23]);+	MONT_MAC(w0, w1, w2, a[8], b[22]);+	MONT_MAC(t0, t1, t2, a[9], b[21]);+	MONT_MAC(v0, v1, v2, a[10], b[20]);+	MONT_MAC(w0, w1, w2, a[11], b[19]);+	MONT_MAC(t0, t1, t2, a[12], b[18]);+	MONT_MAC(v0, v1, v2, a[13], b[17]);+	MONT_MAC(w0, w1, w2, a[14], b[16]);+	MONT_MAC(t0, t1, t2, a[15], b[15]);+	MONT_MAC(v0, v1, v2, a[16], b[14]);+	MONT_MAC(w0, w1, w2, a[17], b[13]);+	MONT_MAC(t0, t1, t2, a[18], b[12]);+	MONT_MAC(v0, v1, v2, a[19], b[11]);+	MONT_MAC(w0, w1, w2, a[20], b[10]);+	MONT_MAC(t0, t1, t2, a[21], b[9]);+	MONT_MAC(v0, v1, v2, a[22], b[8]);+	MONT_MAC(w0, w1, w2, a[23], b[7]);+	MONT_MAC(t0, t1, t2, a[24], b[6]);+	MONT_MAC(v0, v1, v2, a[25], b[5]);+	MONT_MAC(w0, w1, w2, a[26], b[4]);+	MONT_MAC(t0, t1, t2, a[27], b[3]);+	MONT_MAC(v0, v1, v2, a[28], b[2]);+	MONT_MAC(w0, w1, w2, a[29], b[1]);+	MONT_MAC(t0, t1, t2, a[30], b[0]);+	MONT_MAC(v0, v1, v2, u[0], m[30]);+	MONT_MAC(w0, w1, w2, u[1], m[29]);+	MONT_MAC(t0, t1, t2, u[2], m[28]);+	MONT_MAC(v0, v1, v2, u[3], m[27]);+	MONT_MAC(w0, w1, w2, u[4], m[26]);+	MONT_MAC(t0, t1, t2, u[5], m[25]);+	MONT_MAC(v0, v1, v2, u[6], m[24]);+	MONT_MAC(w0, w1, w2, u[7], m[23]);+	MONT_MAC(t0, t1, t2, u[8], m[22]);+	MONT_MAC(v0, v1, v2, u[9], m[21]);+	MONT_MAC(w0, w1, w2, u[10], m[20]);+	MONT_MAC(t0, t1, t2, u[11], m[19]);+	MONT_MAC(v0, v1, v2, u[12], m[18]);+	MONT_MAC(w0, w1, w2, u[13], m[17]);+	MONT_MAC(t0, t1, t2, u[14], m[16]);+	MONT_MAC(v0, v1, v2, u[15], m[15]);+	MONT_MAC(w0, w1, w2, u[16], m[14]);+	MONT_MAC(t0, t1, t2, u[17], m[13]);+	MONT_MAC(v0, v1, v2, u[18], m[12]);+	MONT_MAC(w0, w1, w2, u[19], m[11]);+	MONT_MAC(t0, t1, t2, u[20], m[10]);+	MONT_MAC(v0, v1, v2, u[21], m[9]);+	MONT_MAC(w0, w1, w2, u[22], m[8]);+	MONT_MAC(t0, t1, t2, u[23], m[7]);+	MONT_MAC(v0, v1, v2, u[24], m[6]);+	MONT_MAC(w0, w1, w2, u[25], m[5]);+	MONT_MAC(t0, t1, t2, u[26], m[4]);+	MONT_MAC(v0, v1, v2, u[27], m[3]);+	MONT_MAC(w0, w1, w2, u[28], m[2]);+	MONT_MAC(t0, t1, t2, u[29], m[1]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	u[30] = t0 * n0;+	MONT_MAC(t0, t1, t2, u[30], m[0]);+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 31 */+	MONT_MAC(t0, t1, t2, a[0], b[31]);+	MONT_MUL(v0, v1, v2, a[1], b[30]);+	MONT_MUL(w0, w1, w2, a[2], b[29]);+	MONT_MAC(t0, t1, t2, a[3], b[28]);+	MONT_MAC(v0, v1, v2, a[4], b[27]);+	MONT_MAC(w0, w1, w2, a[5], b[26]);+	MONT_MAC(t0, t1, t2, a[6], b[25]);+	MONT_MAC(v0, v1, v2, a[7], b[24]);+	MONT_MAC(w0, w1, w2, a[8], b[23]);+	MONT_MAC(t0, t1, t2, a[9], b[22]);+	MONT_MAC(v0, v1, v2, a[10], b[21]);+	MONT_MAC(w0, w1, w2, a[11], b[20]);+	MONT_MAC(t0, t1, t2, a[12], b[19]);+	MONT_MAC(v0, v1, v2, a[13], b[18]);+	MONT_MAC(w0, w1, w2, a[14], b[17]);+	MONT_MAC(t0, t1, t2, a[15], b[16]);+	MONT_MAC(v0, v1, v2, a[16], b[15]);+	MONT_MAC(w0, w1, w2, a[17], b[14]);+	MONT_MAC(t0, t1, t2, a[18], b[13]);+	MONT_MAC(v0, v1, v2, a[19], b[12]);+	MONT_MAC(w0, w1, w2, a[20], b[11]);+	MONT_MAC(t0, t1, t2, a[21], b[10]);+	MONT_MAC(v0, v1, v2, a[22], b[9]);+	MONT_MAC(w0, w1, w2, a[23], b[8]);+	MONT_MAC(t0, t1, t2, a[24], b[7]);+	MONT_MAC(v0, v1, v2, a[25], b[6]);+	MONT_MAC(w0, w1, w2, a[26], b[5]);+	MONT_MAC(t0, t1, t2, a[27], b[4]);+	MONT_MAC(v0, v1, v2, a[28], b[3]);+	MONT_MAC(w0, w1, w2, a[29], b[2]);+	MONT_MAC(t0, t1, t2, a[30], b[1]);+	MONT_MAC(v0, v1, v2, a[31], b[0]);+	MONT_MAC(w0, w1, w2, u[0], m[31]);+	MONT_MAC(t0, t1, t2, u[1], m[30]);+	MONT_MAC(v0, v1, v2, u[2], m[29]);+	MONT_MAC(w0, w1, w2, u[3], m[28]);+	MONT_MAC(t0, t1, t2, u[4], m[27]);+	MONT_MAC(v0, v1, v2, u[5], m[26]);+	MONT_MAC(w0, w1, w2, u[6], m[25]);+	MONT_MAC(t0, t1, t2, u[7], m[24]);+	MONT_MAC(v0, v1, v2, u[8], m[23]);+	MONT_MAC(w0, w1, w2, u[9], m[22]);+	MONT_MAC(t0, t1, t2, u[10], m[21]);+	MONT_MAC(v0, v1, v2, u[11], m[20]);+	MONT_MAC(w0, w1, w2, u[12], m[19]);+	MONT_MAC(t0, t1, t2, u[13], m[18]);+	MONT_MAC(v0, v1, v2, u[14], m[17]);+	MONT_MAC(w0, w1, w2, u[15], m[16]);+	MONT_MAC(t0, t1, t2, u[16], m[15]);+	MONT_MAC(v0, v1, v2, u[17], m[14]);+	MONT_MAC(w0, w1, w2, u[18], m[13]);+	MONT_MAC(t0, t1, t2, u[19], m[12]);+	MONT_MAC(v0, v1, v2, u[20], m[11]);+	MONT_MAC(w0, w1, w2, u[21], m[10]);+	MONT_MAC(t0, t1, t2, u[22], m[9]);+	MONT_MAC(v0, v1, v2, u[23], m[8]);+	MONT_MAC(w0, w1, w2, u[24], m[7]);+	MONT_MAC(t0, t1, t2, u[25], m[6]);+	MONT_MAC(v0, v1, v2, u[26], m[5]);+	MONT_MAC(w0, w1, w2, u[27], m[4]);+	MONT_MAC(t0, t1, t2, u[28], m[3]);+	MONT_MAC(v0, v1, v2, u[29], m[2]);+	MONT_MAC(w0, w1, w2, u[30], m[1]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	u[31] = t0 * n0;+	MONT_MAC(t0, t1, t2, u[31], m[0]);+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 32 */+	MONT_MAC(t0, t1, t2, a[1], b[31]);+	MONT_MUL(v0, v1, v2, a[2], b[30]);+	MONT_MUL(w0, w1, w2, a[3], b[29]);+	MONT_MAC(t0, t1, t2, a[4], b[28]);+	MONT_MAC(v0, v1, v2, a[5], b[27]);+	MONT_MAC(w0, w1, w2, a[6], b[26]);+	MONT_MAC(t0, t1, t2, a[7], b[25]);+	MONT_MAC(v0, v1, v2, a[8], b[24]);+	MONT_MAC(w0, w1, w2, a[9], b[23]);+	MONT_MAC(t0, t1, t2, a[10], b[22]);+	MONT_MAC(v0, v1, v2, a[11], b[21]);+	MONT_MAC(w0, w1, w2, a[12], b[20]);+	MONT_MAC(t0, t1, t2, a[13], b[19]);+	MONT_MAC(v0, v1, v2, a[14], b[18]);+	MONT_MAC(w0, w1, w2, a[15], b[17]);+	MONT_MAC(t0, t1, t2, a[16], b[16]);+	MONT_MAC(v0, v1, v2, a[17], b[15]);+	MONT_MAC(w0, w1, w2, a[18], b[14]);+	MONT_MAC(t0, t1, t2, a[19], b[13]);+	MONT_MAC(v0, v1, v2, a[20], b[12]);+	MONT_MAC(w0, w1, w2, a[21], b[11]);+	MONT_MAC(t0, t1, t2, a[22], b[10]);+	MONT_MAC(v0, v1, v2, a[23], b[9]);+	MONT_MAC(w0, w1, w2, a[24], b[8]);+	MONT_MAC(t0, t1, t2, a[25], b[7]);+	MONT_MAC(v0, v1, v2, a[26], b[6]);+	MONT_MAC(w0, w1, w2, a[27], b[5]);+	MONT_MAC(t0, t1, t2, a[28], b[4]);+	MONT_MAC(v0, v1, v2, a[29], b[3]);+	MONT_MAC(w0, w1, w2, a[30], b[2]);+	MONT_MAC(t0, t1, t2, a[31], b[1]);+	MONT_MAC(v0, v1, v2, u[1], m[31]);+	MONT_MAC(w0, w1, w2, u[2], m[30]);+	MONT_MAC(t0, t1, t2, u[3], m[29]);+	MONT_MAC(v0, v1, v2, u[4], m[28]);+	MONT_MAC(w0, w1, w2, u[5], m[27]);+	MONT_MAC(t0, t1, t2, u[6], m[26]);+	MONT_MAC(v0, v1, v2, u[7], m[25]);+	MONT_MAC(w0, w1, w2, u[8], m[24]);+	MONT_MAC(t0, t1, t2, u[9], m[23]);+	MONT_MAC(v0, v1, v2, u[10], m[22]);+	MONT_MAC(w0, w1, w2, u[11], m[21]);+	MONT_MAC(t0, t1, t2, u[12], m[20]);+	MONT_MAC(v0, v1, v2, u[13], m[19]);+	MONT_MAC(w0, w1, w2, u[14], m[18]);+	MONT_MAC(t0, t1, t2, u[15], m[17]);+	MONT_MAC(v0, v1, v2, u[16], m[16]);+	MONT_MAC(w0, w1, w2, u[17], m[15]);+	MONT_MAC(t0, t1, t2, u[18], m[14]);+	MONT_MAC(v0, v1, v2, u[19], m[13]);+	MONT_MAC(w0, w1, w2, u[20], m[12]);+	MONT_MAC(t0, t1, t2, u[21], m[11]);+	MONT_MAC(v0, v1, v2, u[22], m[10]);+	MONT_MAC(w0, w1, w2, u[23], m[9]);+	MONT_MAC(t0, t1, t2, u[24], m[8]);+	MONT_MAC(v0, v1, v2, u[25], m[7]);+	MONT_MAC(w0, w1, w2, u[26], m[6]);+	MONT_MAC(t0, t1, t2, u[27], m[5]);+	MONT_MAC(v0, v1, v2, u[28], m[4]);+	MONT_MAC(w0, w1, w2, u[29], m[3]);+	MONT_MAC(t0, t1, t2, u[30], m[2]);+	MONT_MAC(v0, v1, v2, u[31], m[1]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	z[0] = t0;+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 33 */+	MONT_MAC(t0, t1, t2, a[2], b[31]);+	MONT_MUL(v0, v1, v2, a[3], b[30]);+	MONT_MUL(w0, w1, w2, a[4], b[29]);+	MONT_MAC(t0, t1, t2, a[5], b[28]);+	MONT_MAC(v0, v1, v2, a[6], b[27]);+	MONT_MAC(w0, w1, w2, a[7], b[26]);+	MONT_MAC(t0, t1, t2, a[8], b[25]);+	MONT_MAC(v0, v1, v2, a[9], b[24]);+	MONT_MAC(w0, w1, w2, a[10], b[23]);+	MONT_MAC(t0, t1, t2, a[11], b[22]);+	MONT_MAC(v0, v1, v2, a[12], b[21]);+	MONT_MAC(w0, w1, w2, a[13], b[20]);+	MONT_MAC(t0, t1, t2, a[14], b[19]);+	MONT_MAC(v0, v1, v2, a[15], b[18]);+	MONT_MAC(w0, w1, w2, a[16], b[17]);+	MONT_MAC(t0, t1, t2, a[17], b[16]);+	MONT_MAC(v0, v1, v2, a[18], b[15]);+	MONT_MAC(w0, w1, w2, a[19], b[14]);+	MONT_MAC(t0, t1, t2, a[20], b[13]);+	MONT_MAC(v0, v1, v2, a[21], b[12]);+	MONT_MAC(w0, w1, w2, a[22], b[11]);+	MONT_MAC(t0, t1, t2, a[23], b[10]);+	MONT_MAC(v0, v1, v2, a[24], b[9]);+	MONT_MAC(w0, w1, w2, a[25], b[8]);+	MONT_MAC(t0, t1, t2, a[26], b[7]);+	MONT_MAC(v0, v1, v2, a[27], b[6]);+	MONT_MAC(w0, w1, w2, a[28], b[5]);+	MONT_MAC(t0, t1, t2, a[29], b[4]);+	MONT_MAC(v0, v1, v2, a[30], b[3]);+	MONT_MAC(w0, w1, w2, a[31], b[2]);+	MONT_MAC(t0, t1, t2, u[2], m[31]);+	MONT_MAC(v0, v1, v2, u[3], m[30]);+	MONT_MAC(w0, w1, w2, u[4], m[29]);+	MONT_MAC(t0, t1, t2, u[5], m[28]);+	MONT_MAC(v0, v1, v2, u[6], m[27]);+	MONT_MAC(w0, w1, w2, u[7], m[26]);+	MONT_MAC(t0, t1, t2, u[8], m[25]);+	MONT_MAC(v0, v1, v2, u[9], m[24]);+	MONT_MAC(w0, w1, w2, u[10], m[23]);+	MONT_MAC(t0, t1, t2, u[11], m[22]);+	MONT_MAC(v0, v1, v2, u[12], m[21]);+	MONT_MAC(w0, w1, w2, u[13], m[20]);+	MONT_MAC(t0, t1, t2, u[14], m[19]);+	MONT_MAC(v0, v1, v2, u[15], m[18]);+	MONT_MAC(w0, w1, w2, u[16], m[17]);+	MONT_MAC(t0, t1, t2, u[17], m[16]);+	MONT_MAC(v0, v1, v2, u[18], m[15]);+	MONT_MAC(w0, w1, w2, u[19], m[14]);+	MONT_MAC(t0, t1, t2, u[20], m[13]);+	MONT_MAC(v0, v1, v2, u[21], m[12]);+	MONT_MAC(w0, w1, w2, u[22], m[11]);+	MONT_MAC(t0, t1, t2, u[23], m[10]);+	MONT_MAC(v0, v1, v2, u[24], m[9]);+	MONT_MAC(w0, w1, w2, u[25], m[8]);+	MONT_MAC(t0, t1, t2, u[26], m[7]);+	MONT_MAC(v0, v1, v2, u[27], m[6]);+	MONT_MAC(w0, w1, w2, u[28], m[5]);+	MONT_MAC(t0, t1, t2, u[29], m[4]);+	MONT_MAC(v0, v1, v2, u[30], m[3]);+	MONT_MAC(w0, w1, w2, u[31], m[2]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	z[1] = t0;+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 34 */+	MONT_MAC(t0, t1, t2, a[3], b[31]);+	MONT_MUL(v0, v1, v2, a[4], b[30]);+	MONT_MUL(w0, w1, w2, a[5], b[29]);+	MONT_MAC(t0, t1, t2, a[6], b[28]);+	MONT_MAC(v0, v1, v2, a[7], b[27]);+	MONT_MAC(w0, w1, w2, a[8], b[26]);+	MONT_MAC(t0, t1, t2, a[9], b[25]);+	MONT_MAC(v0, v1, v2, a[10], b[24]);+	MONT_MAC(w0, w1, w2, a[11], b[23]);+	MONT_MAC(t0, t1, t2, a[12], b[22]);+	MONT_MAC(v0, v1, v2, a[13], b[21]);+	MONT_MAC(w0, w1, w2, a[14], b[20]);+	MONT_MAC(t0, t1, t2, a[15], b[19]);+	MONT_MAC(v0, v1, v2, a[16], b[18]);+	MONT_MAC(w0, w1, w2, a[17], b[17]);+	MONT_MAC(t0, t1, t2, a[18], b[16]);+	MONT_MAC(v0, v1, v2, a[19], b[15]);+	MONT_MAC(w0, w1, w2, a[20], b[14]);+	MONT_MAC(t0, t1, t2, a[21], b[13]);+	MONT_MAC(v0, v1, v2, a[22], b[12]);+	MONT_MAC(w0, w1, w2, a[23], b[11]);+	MONT_MAC(t0, t1, t2, a[24], b[10]);+	MONT_MAC(v0, v1, v2, a[25], b[9]);+	MONT_MAC(w0, w1, w2, a[26], b[8]);+	MONT_MAC(t0, t1, t2, a[27], b[7]);+	MONT_MAC(v0, v1, v2, a[28], b[6]);+	MONT_MAC(w0, w1, w2, a[29], b[5]);+	MONT_MAC(t0, t1, t2, a[30], b[4]);+	MONT_MAC(v0, v1, v2, a[31], b[3]);+	MONT_MAC(w0, w1, w2, u[3], m[31]);+	MONT_MAC(t0, t1, t2, u[4], m[30]);+	MONT_MAC(v0, v1, v2, u[5], m[29]);+	MONT_MAC(w0, w1, w2, u[6], m[28]);+	MONT_MAC(t0, t1, t2, u[7], m[27]);+	MONT_MAC(v0, v1, v2, u[8], m[26]);+	MONT_MAC(w0, w1, w2, u[9], m[25]);+	MONT_MAC(t0, t1, t2, u[10], m[24]);+	MONT_MAC(v0, v1, v2, u[11], m[23]);+	MONT_MAC(w0, w1, w2, u[12], m[22]);+	MONT_MAC(t0, t1, t2, u[13], m[21]);+	MONT_MAC(v0, v1, v2, u[14], m[20]);+	MONT_MAC(w0, w1, w2, u[15], m[19]);+	MONT_MAC(t0, t1, t2, u[16], m[18]);+	MONT_MAC(v0, v1, v2, u[17], m[17]);+	MONT_MAC(w0, w1, w2, u[18], m[16]);+	MONT_MAC(t0, t1, t2, u[19], m[15]);+	MONT_MAC(v0, v1, v2, u[20], m[14]);+	MONT_MAC(w0, w1, w2, u[21], m[13]);+	MONT_MAC(t0, t1, t2, u[22], m[12]);+	MONT_MAC(v0, v1, v2, u[23], m[11]);+	MONT_MAC(w0, w1, w2, u[24], m[10]);+	MONT_MAC(t0, t1, t2, u[25], m[9]);+	MONT_MAC(v0, v1, v2, u[26], m[8]);+	MONT_MAC(w0, w1, w2, u[27], m[7]);+	MONT_MAC(t0, t1, t2, u[28], m[6]);+	MONT_MAC(v0, v1, v2, u[29], m[5]);+	MONT_MAC(w0, w1, w2, u[30], m[4]);+	MONT_MAC(t0, t1, t2, u[31], m[3]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	z[2] = t0;+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 35 */+	MONT_MAC(t0, t1, t2, a[4], b[31]);+	MONT_MUL(v0, v1, v2, a[5], b[30]);+	MONT_MUL(w0, w1, w2, a[6], b[29]);+	MONT_MAC(t0, t1, t2, a[7], b[28]);+	MONT_MAC(v0, v1, v2, a[8], b[27]);+	MONT_MAC(w0, w1, w2, a[9], b[26]);+	MONT_MAC(t0, t1, t2, a[10], b[25]);+	MONT_MAC(v0, v1, v2, a[11], b[24]);+	MONT_MAC(w0, w1, w2, a[12], b[23]);+	MONT_MAC(t0, t1, t2, a[13], b[22]);+	MONT_MAC(v0, v1, v2, a[14], b[21]);+	MONT_MAC(w0, w1, w2, a[15], b[20]);+	MONT_MAC(t0, t1, t2, a[16], b[19]);+	MONT_MAC(v0, v1, v2, a[17], b[18]);+	MONT_MAC(w0, w1, w2, a[18], b[17]);+	MONT_MAC(t0, t1, t2, a[19], b[16]);+	MONT_MAC(v0, v1, v2, a[20], b[15]);+	MONT_MAC(w0, w1, w2, a[21], b[14]);+	MONT_MAC(t0, t1, t2, a[22], b[13]);+	MONT_MAC(v0, v1, v2, a[23], b[12]);+	MONT_MAC(w0, w1, w2, a[24], b[11]);+	MONT_MAC(t0, t1, t2, a[25], b[10]);+	MONT_MAC(v0, v1, v2, a[26], b[9]);+	MONT_MAC(w0, w1, w2, a[27], b[8]);+	MONT_MAC(t0, t1, t2, a[28], b[7]);+	MONT_MAC(v0, v1, v2, a[29], b[6]);+	MONT_MAC(w0, w1, w2, a[30], b[5]);+	MONT_MAC(t0, t1, t2, a[31], b[4]);+	MONT_MAC(v0, v1, v2, u[4], m[31]);+	MONT_MAC(w0, w1, w2, u[5], m[30]);+	MONT_MAC(t0, t1, t2, u[6], m[29]);+	MONT_MAC(v0, v1, v2, u[7], m[28]);+	MONT_MAC(w0, w1, w2, u[8], m[27]);+	MONT_MAC(t0, t1, t2, u[9], m[26]);+	MONT_MAC(v0, v1, v2, u[10], m[25]);+	MONT_MAC(w0, w1, w2, u[11], m[24]);+	MONT_MAC(t0, t1, t2, u[12], m[23]);+	MONT_MAC(v0, v1, v2, u[13], m[22]);+	MONT_MAC(w0, w1, w2, u[14], m[21]);+	MONT_MAC(t0, t1, t2, u[15], m[20]);+	MONT_MAC(v0, v1, v2, u[16], m[19]);+	MONT_MAC(w0, w1, w2, u[17], m[18]);+	MONT_MAC(t0, t1, t2, u[18], m[17]);+	MONT_MAC(v0, v1, v2, u[19], m[16]);+	MONT_MAC(w0, w1, w2, u[20], m[15]);+	MONT_MAC(t0, t1, t2, u[21], m[14]);+	MONT_MAC(v0, v1, v2, u[22], m[13]);+	MONT_MAC(w0, w1, w2, u[23], m[12]);+	MONT_MAC(t0, t1, t2, u[24], m[11]);+	MONT_MAC(v0, v1, v2, u[25], m[10]);+	MONT_MAC(w0, w1, w2, u[26], m[9]);+	MONT_MAC(t0, t1, t2, u[27], m[8]);+	MONT_MAC(v0, v1, v2, u[28], m[7]);+	MONT_MAC(w0, w1, w2, u[29], m[6]);+	MONT_MAC(t0, t1, t2, u[30], m[5]);+	MONT_MAC(v0, v1, v2, u[31], m[4]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	z[3] = t0;+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 36 */+	MONT_MAC(t0, t1, t2, a[5], b[31]);+	MONT_MUL(v0, v1, v2, a[6], b[30]);+	MONT_MUL(w0, w1, w2, a[7], b[29]);+	MONT_MAC(t0, t1, t2, a[8], b[28]);+	MONT_MAC(v0, v1, v2, a[9], b[27]);+	MONT_MAC(w0, w1, w2, a[10], b[26]);+	MONT_MAC(t0, t1, t2, a[11], b[25]);+	MONT_MAC(v0, v1, v2, a[12], b[24]);+	MONT_MAC(w0, w1, w2, a[13], b[23]);+	MONT_MAC(t0, t1, t2, a[14], b[22]);+	MONT_MAC(v0, v1, v2, a[15], b[21]);+	MONT_MAC(w0, w1, w2, a[16], b[20]);+	MONT_MAC(t0, t1, t2, a[17], b[19]);+	MONT_MAC(v0, v1, v2, a[18], b[18]);+	MONT_MAC(w0, w1, w2, a[19], b[17]);+	MONT_MAC(t0, t1, t2, a[20], b[16]);+	MONT_MAC(v0, v1, v2, a[21], b[15]);+	MONT_MAC(w0, w1, w2, a[22], b[14]);+	MONT_MAC(t0, t1, t2, a[23], b[13]);+	MONT_MAC(v0, v1, v2, a[24], b[12]);+	MONT_MAC(w0, w1, w2, a[25], b[11]);+	MONT_MAC(t0, t1, t2, a[26], b[10]);+	MONT_MAC(v0, v1, v2, a[27], b[9]);+	MONT_MAC(w0, w1, w2, a[28], b[8]);+	MONT_MAC(t0, t1, t2, a[29], b[7]);+	MONT_MAC(v0, v1, v2, a[30], b[6]);+	MONT_MAC(w0, w1, w2, a[31], b[5]);+	MONT_MAC(t0, t1, t2, u[5], m[31]);+	MONT_MAC(v0, v1, v2, u[6], m[30]);+	MONT_MAC(w0, w1, w2, u[7], m[29]);+	MONT_MAC(t0, t1, t2, u[8], m[28]);+	MONT_MAC(v0, v1, v2, u[9], m[27]);+	MONT_MAC(w0, w1, w2, u[10], m[26]);+	MONT_MAC(t0, t1, t2, u[11], m[25]);+	MONT_MAC(v0, v1, v2, u[12], m[24]);+	MONT_MAC(w0, w1, w2, u[13], m[23]);+	MONT_MAC(t0, t1, t2, u[14], m[22]);+	MONT_MAC(v0, v1, v2, u[15], m[21]);+	MONT_MAC(w0, w1, w2, u[16], m[20]);+	MONT_MAC(t0, t1, t2, u[17], m[19]);+	MONT_MAC(v0, v1, v2, u[18], m[18]);+	MONT_MAC(w0, w1, w2, u[19], m[17]);+	MONT_MAC(t0, t1, t2, u[20], m[16]);+	MONT_MAC(v0, v1, v2, u[21], m[15]);+	MONT_MAC(w0, w1, w2, u[22], m[14]);+	MONT_MAC(t0, t1, t2, u[23], m[13]);+	MONT_MAC(v0, v1, v2, u[24], m[12]);+	MONT_MAC(w0, w1, w2, u[25], m[11]);+	MONT_MAC(t0, t1, t2, u[26], m[10]);+	MONT_MAC(v0, v1, v2, u[27], m[9]);+	MONT_MAC(w0, w1, w2, u[28], m[8]);+	MONT_MAC(t0, t1, t2, u[29], m[7]);+	MONT_MAC(v0, v1, v2, u[30], m[6]);+	MONT_MAC(w0, w1, w2, u[31], m[5]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	z[4] = t0;+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 37 */+	MONT_MAC(t0, t1, t2, a[6], b[31]);+	MONT_MUL(v0, v1, v2, a[7], b[30]);+	MONT_MUL(w0, w1, w2, a[8], b[29]);+	MONT_MAC(t0, t1, t2, a[9], b[28]);+	MONT_MAC(v0, v1, v2, a[10], b[27]);+	MONT_MAC(w0, w1, w2, a[11], b[26]);+	MONT_MAC(t0, t1, t2, a[12], b[25]);+	MONT_MAC(v0, v1, v2, a[13], b[24]);+	MONT_MAC(w0, w1, w2, a[14], b[23]);+	MONT_MAC(t0, t1, t2, a[15], b[22]);+	MONT_MAC(v0, v1, v2, a[16], b[21]);+	MONT_MAC(w0, w1, w2, a[17], b[20]);+	MONT_MAC(t0, t1, t2, a[18], b[19]);+	MONT_MAC(v0, v1, v2, a[19], b[18]);+	MONT_MAC(w0, w1, w2, a[20], b[17]);+	MONT_MAC(t0, t1, t2, a[21], b[16]);+	MONT_MAC(v0, v1, v2, a[22], b[15]);+	MONT_MAC(w0, w1, w2, a[23], b[14]);+	MONT_MAC(t0, t1, t2, a[24], b[13]);+	MONT_MAC(v0, v1, v2, a[25], b[12]);+	MONT_MAC(w0, w1, w2, a[26], b[11]);+	MONT_MAC(t0, t1, t2, a[27], b[10]);+	MONT_MAC(v0, v1, v2, a[28], b[9]);+	MONT_MAC(w0, w1, w2, a[29], b[8]);+	MONT_MAC(t0, t1, t2, a[30], b[7]);+	MONT_MAC(v0, v1, v2, a[31], b[6]);+	MONT_MAC(w0, w1, w2, u[6], m[31]);+	MONT_MAC(t0, t1, t2, u[7], m[30]);+	MONT_MAC(v0, v1, v2, u[8], m[29]);+	MONT_MAC(w0, w1, w2, u[9], m[28]);+	MONT_MAC(t0, t1, t2, u[10], m[27]);+	MONT_MAC(v0, v1, v2, u[11], m[26]);+	MONT_MAC(w0, w1, w2, u[12], m[25]);+	MONT_MAC(t0, t1, t2, u[13], m[24]);+	MONT_MAC(v0, v1, v2, u[14], m[23]);+	MONT_MAC(w0, w1, w2, u[15], m[22]);+	MONT_MAC(t0, t1, t2, u[16], m[21]);+	MONT_MAC(v0, v1, v2, u[17], m[20]);+	MONT_MAC(w0, w1, w2, u[18], m[19]);+	MONT_MAC(t0, t1, t2, u[19], m[18]);+	MONT_MAC(v0, v1, v2, u[20], m[17]);+	MONT_MAC(w0, w1, w2, u[21], m[16]);+	MONT_MAC(t0, t1, t2, u[22], m[15]);+	MONT_MAC(v0, v1, v2, u[23], m[14]);+	MONT_MAC(w0, w1, w2, u[24], m[13]);+	MONT_MAC(t0, t1, t2, u[25], m[12]);+	MONT_MAC(v0, v1, v2, u[26], m[11]);+	MONT_MAC(w0, w1, w2, u[27], m[10]);+	MONT_MAC(t0, t1, t2, u[28], m[9]);+	MONT_MAC(v0, v1, v2, u[29], m[8]);+	MONT_MAC(w0, w1, w2, u[30], m[7]);+	MONT_MAC(t0, t1, t2, u[31], m[6]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	z[5] = t0;+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 38 */+	MONT_MAC(t0, t1, t2, a[7], b[31]);+	MONT_MUL(v0, v1, v2, a[8], b[30]);+	MONT_MUL(w0, w1, w2, a[9], b[29]);+	MONT_MAC(t0, t1, t2, a[10], b[28]);+	MONT_MAC(v0, v1, v2, a[11], b[27]);+	MONT_MAC(w0, w1, w2, a[12], b[26]);+	MONT_MAC(t0, t1, t2, a[13], b[25]);+	MONT_MAC(v0, v1, v2, a[14], b[24]);+	MONT_MAC(w0, w1, w2, a[15], b[23]);+	MONT_MAC(t0, t1, t2, a[16], b[22]);+	MONT_MAC(v0, v1, v2, a[17], b[21]);+	MONT_MAC(w0, w1, w2, a[18], b[20]);+	MONT_MAC(t0, t1, t2, a[19], b[19]);+	MONT_MAC(v0, v1, v2, a[20], b[18]);+	MONT_MAC(w0, w1, w2, a[21], b[17]);+	MONT_MAC(t0, t1, t2, a[22], b[16]);+	MONT_MAC(v0, v1, v2, a[23], b[15]);+	MONT_MAC(w0, w1, w2, a[24], b[14]);+	MONT_MAC(t0, t1, t2, a[25], b[13]);+	MONT_MAC(v0, v1, v2, a[26], b[12]);+	MONT_MAC(w0, w1, w2, a[27], b[11]);+	MONT_MAC(t0, t1, t2, a[28], b[10]);+	MONT_MAC(v0, v1, v2, a[29], b[9]);+	MONT_MAC(w0, w1, w2, a[30], b[8]);+	MONT_MAC(t0, t1, t2, a[31], b[7]);+	MONT_MAC(v0, v1, v2, u[7], m[31]);+	MONT_MAC(w0, w1, w2, u[8], m[30]);+	MONT_MAC(t0, t1, t2, u[9], m[29]);+	MONT_MAC(v0, v1, v2, u[10], m[28]);+	MONT_MAC(w0, w1, w2, u[11], m[27]);+	MONT_MAC(t0, t1, t2, u[12], m[26]);+	MONT_MAC(v0, v1, v2, u[13], m[25]);+	MONT_MAC(w0, w1, w2, u[14], m[24]);+	MONT_MAC(t0, t1, t2, u[15], m[23]);+	MONT_MAC(v0, v1, v2, u[16], m[22]);+	MONT_MAC(w0, w1, w2, u[17], m[21]);+	MONT_MAC(t0, t1, t2, u[18], m[20]);+	MONT_MAC(v0, v1, v2, u[19], m[19]);+	MONT_MAC(w0, w1, w2, u[20], m[18]);+	MONT_MAC(t0, t1, t2, u[21], m[17]);+	MONT_MAC(v0, v1, v2, u[22], m[16]);+	MONT_MAC(w0, w1, w2, u[23], m[15]);+	MONT_MAC(t0, t1, t2, u[24], m[14]);+	MONT_MAC(v0, v1, v2, u[25], m[13]);+	MONT_MAC(w0, w1, w2, u[26], m[12]);+	MONT_MAC(t0, t1, t2, u[27], m[11]);+	MONT_MAC(v0, v1, v2, u[28], m[10]);+	MONT_MAC(w0, w1, w2, u[29], m[9]);+	MONT_MAC(t0, t1, t2, u[30], m[8]);+	MONT_MAC(v0, v1, v2, u[31], m[7]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	z[6] = t0;+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 39 */+	MONT_MAC(t0, t1, t2, a[8], b[31]);+	MONT_MUL(v0, v1, v2, a[9], b[30]);+	MONT_MUL(w0, w1, w2, a[10], b[29]);+	MONT_MAC(t0, t1, t2, a[11], b[28]);+	MONT_MAC(v0, v1, v2, a[12], b[27]);+	MONT_MAC(w0, w1, w2, a[13], b[26]);+	MONT_MAC(t0, t1, t2, a[14], b[25]);+	MONT_MAC(v0, v1, v2, a[15], b[24]);+	MONT_MAC(w0, w1, w2, a[16], b[23]);+	MONT_MAC(t0, t1, t2, a[17], b[22]);+	MONT_MAC(v0, v1, v2, a[18], b[21]);+	MONT_MAC(w0, w1, w2, a[19], b[20]);+	MONT_MAC(t0, t1, t2, a[20], b[19]);+	MONT_MAC(v0, v1, v2, a[21], b[18]);+	MONT_MAC(w0, w1, w2, a[22], b[17]);+	MONT_MAC(t0, t1, t2, a[23], b[16]);+	MONT_MAC(v0, v1, v2, a[24], b[15]);+	MONT_MAC(w0, w1, w2, a[25], b[14]);+	MONT_MAC(t0, t1, t2, a[26], b[13]);+	MONT_MAC(v0, v1, v2, a[27], b[12]);+	MONT_MAC(w0, w1, w2, a[28], b[11]);+	MONT_MAC(t0, t1, t2, a[29], b[10]);+	MONT_MAC(v0, v1, v2, a[30], b[9]);+	MONT_MAC(w0, w1, w2, a[31], b[8]);+	MONT_MAC(t0, t1, t2, u[8], m[31]);+	MONT_MAC(v0, v1, v2, u[9], m[30]);+	MONT_MAC(w0, w1, w2, u[10], m[29]);+	MONT_MAC(t0, t1, t2, u[11], m[28]);+	MONT_MAC(v0, v1, v2, u[12], m[27]);+	MONT_MAC(w0, w1, w2, u[13], m[26]);+	MONT_MAC(t0, t1, t2, u[14], m[25]);+	MONT_MAC(v0, v1, v2, u[15], m[24]);+	MONT_MAC(w0, w1, w2, u[16], m[23]);+	MONT_MAC(t0, t1, t2, u[17], m[22]);+	MONT_MAC(v0, v1, v2, u[18], m[21]);+	MONT_MAC(w0, w1, w2, u[19], m[20]);+	MONT_MAC(t0, t1, t2, u[20], m[19]);+	MONT_MAC(v0, v1, v2, u[21], m[18]);+	MONT_MAC(w0, w1, w2, u[22], m[17]);+	MONT_MAC(t0, t1, t2, u[23], m[16]);+	MONT_MAC(v0, v1, v2, u[24], m[15]);+	MONT_MAC(w0, w1, w2, u[25], m[14]);+	MONT_MAC(t0, t1, t2, u[26], m[13]);+	MONT_MAC(v0, v1, v2, u[27], m[12]);+	MONT_MAC(w0, w1, w2, u[28], m[11]);+	MONT_MAC(t0, t1, t2, u[29], m[10]);+	MONT_MAC(v0, v1, v2, u[30], m[9]);+	MONT_MAC(w0, w1, w2, u[31], m[8]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	z[7] = t0;+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 40 */+	MONT_MAC(t0, t1, t2, a[9], b[31]);+	MONT_MUL(v0, v1, v2, a[10], b[30]);+	MONT_MUL(w0, w1, w2, a[11], b[29]);+	MONT_MAC(t0, t1, t2, a[12], b[28]);+	MONT_MAC(v0, v1, v2, a[13], b[27]);+	MONT_MAC(w0, w1, w2, a[14], b[26]);+	MONT_MAC(t0, t1, t2, a[15], b[25]);+	MONT_MAC(v0, v1, v2, a[16], b[24]);+	MONT_MAC(w0, w1, w2, a[17], b[23]);+	MONT_MAC(t0, t1, t2, a[18], b[22]);+	MONT_MAC(v0, v1, v2, a[19], b[21]);+	MONT_MAC(w0, w1, w2, a[20], b[20]);+	MONT_MAC(t0, t1, t2, a[21], b[19]);+	MONT_MAC(v0, v1, v2, a[22], b[18]);+	MONT_MAC(w0, w1, w2, a[23], b[17]);+	MONT_MAC(t0, t1, t2, a[24], b[16]);+	MONT_MAC(v0, v1, v2, a[25], b[15]);+	MONT_MAC(w0, w1, w2, a[26], b[14]);+	MONT_MAC(t0, t1, t2, a[27], b[13]);+	MONT_MAC(v0, v1, v2, a[28], b[12]);+	MONT_MAC(w0, w1, w2, a[29], b[11]);+	MONT_MAC(t0, t1, t2, a[30], b[10]);+	MONT_MAC(v0, v1, v2, a[31], b[9]);+	MONT_MAC(w0, w1, w2, u[9], m[31]);+	MONT_MAC(t0, t1, t2, u[10], m[30]);+	MONT_MAC(v0, v1, v2, u[11], m[29]);+	MONT_MAC(w0, w1, w2, u[12], m[28]);+	MONT_MAC(t0, t1, t2, u[13], m[27]);+	MONT_MAC(v0, v1, v2, u[14], m[26]);+	MONT_MAC(w0, w1, w2, u[15], m[25]);+	MONT_MAC(t0, t1, t2, u[16], m[24]);+	MONT_MAC(v0, v1, v2, u[17], m[23]);+	MONT_MAC(w0, w1, w2, u[18], m[22]);+	MONT_MAC(t0, t1, t2, u[19], m[21]);+	MONT_MAC(v0, v1, v2, u[20], m[20]);+	MONT_MAC(w0, w1, w2, u[21], m[19]);+	MONT_MAC(t0, t1, t2, u[22], m[18]);+	MONT_MAC(v0, v1, v2, u[23], m[17]);+	MONT_MAC(w0, w1, w2, u[24], m[16]);+	MONT_MAC(t0, t1, t2, u[25], m[15]);+	MONT_MAC(v0, v1, v2, u[26], m[14]);+	MONT_MAC(w0, w1, w2, u[27], m[13]);+	MONT_MAC(t0, t1, t2, u[28], m[12]);+	MONT_MAC(v0, v1, v2, u[29], m[11]);+	MONT_MAC(w0, w1, w2, u[30], m[10]);+	MONT_MAC(t0, t1, t2, u[31], m[9]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	z[8] = t0;+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 41 */+	MONT_MAC(t0, t1, t2, a[10], b[31]);+	MONT_MUL(v0, v1, v2, a[11], b[30]);+	MONT_MUL(w0, w1, w2, a[12], b[29]);+	MONT_MAC(t0, t1, t2, a[13], b[28]);+	MONT_MAC(v0, v1, v2, a[14], b[27]);+	MONT_MAC(w0, w1, w2, a[15], b[26]);+	MONT_MAC(t0, t1, t2, a[16], b[25]);+	MONT_MAC(v0, v1, v2, a[17], b[24]);+	MONT_MAC(w0, w1, w2, a[18], b[23]);+	MONT_MAC(t0, t1, t2, a[19], b[22]);+	MONT_MAC(v0, v1, v2, a[20], b[21]);+	MONT_MAC(w0, w1, w2, a[21], b[20]);+	MONT_MAC(t0, t1, t2, a[22], b[19]);+	MONT_MAC(v0, v1, v2, a[23], b[18]);+	MONT_MAC(w0, w1, w2, a[24], b[17]);+	MONT_MAC(t0, t1, t2, a[25], b[16]);+	MONT_MAC(v0, v1, v2, a[26], b[15]);+	MONT_MAC(w0, w1, w2, a[27], b[14]);+	MONT_MAC(t0, t1, t2, a[28], b[13]);+	MONT_MAC(v0, v1, v2, a[29], b[12]);+	MONT_MAC(w0, w1, w2, a[30], b[11]);+	MONT_MAC(t0, t1, t2, a[31], b[10]);+	MONT_MAC(v0, v1, v2, u[10], m[31]);+	MONT_MAC(w0, w1, w2, u[11], m[30]);+	MONT_MAC(t0, t1, t2, u[12], m[29]);+	MONT_MAC(v0, v1, v2, u[13], m[28]);+	MONT_MAC(w0, w1, w2, u[14], m[27]);+	MONT_MAC(t0, t1, t2, u[15], m[26]);+	MONT_MAC(v0, v1, v2, u[16], m[25]);+	MONT_MAC(w0, w1, w2, u[17], m[24]);+	MONT_MAC(t0, t1, t2, u[18], m[23]);+	MONT_MAC(v0, v1, v2, u[19], m[22]);+	MONT_MAC(w0, w1, w2, u[20], m[21]);+	MONT_MAC(t0, t1, t2, u[21], m[20]);+	MONT_MAC(v0, v1, v2, u[22], m[19]);+	MONT_MAC(w0, w1, w2, u[23], m[18]);+	MONT_MAC(t0, t1, t2, u[24], m[17]);+	MONT_MAC(v0, v1, v2, u[25], m[16]);+	MONT_MAC(w0, w1, w2, u[26], m[15]);+	MONT_MAC(t0, t1, t2, u[27], m[14]);+	MONT_MAC(v0, v1, v2, u[28], m[13]);+	MONT_MAC(w0, w1, w2, u[29], m[12]);+	MONT_MAC(t0, t1, t2, u[30], m[11]);+	MONT_MAC(v0, v1, v2, u[31], m[10]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	z[9] = t0;+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 42 */+	MONT_MAC(t0, t1, t2, a[11], b[31]);+	MONT_MUL(v0, v1, v2, a[12], b[30]);+	MONT_MUL(w0, w1, w2, a[13], b[29]);+	MONT_MAC(t0, t1, t2, a[14], b[28]);+	MONT_MAC(v0, v1, v2, a[15], b[27]);+	MONT_MAC(w0, w1, w2, a[16], b[26]);+	MONT_MAC(t0, t1, t2, a[17], b[25]);+	MONT_MAC(v0, v1, v2, a[18], b[24]);+	MONT_MAC(w0, w1, w2, a[19], b[23]);+	MONT_MAC(t0, t1, t2, a[20], b[22]);+	MONT_MAC(v0, v1, v2, a[21], b[21]);+	MONT_MAC(w0, w1, w2, a[22], b[20]);+	MONT_MAC(t0, t1, t2, a[23], b[19]);+	MONT_MAC(v0, v1, v2, a[24], b[18]);+	MONT_MAC(w0, w1, w2, a[25], b[17]);+	MONT_MAC(t0, t1, t2, a[26], b[16]);+	MONT_MAC(v0, v1, v2, a[27], b[15]);+	MONT_MAC(w0, w1, w2, a[28], b[14]);+	MONT_MAC(t0, t1, t2, a[29], b[13]);+	MONT_MAC(v0, v1, v2, a[30], b[12]);+	MONT_MAC(w0, w1, w2, a[31], b[11]);+	MONT_MAC(t0, t1, t2, u[11], m[31]);+	MONT_MAC(v0, v1, v2, u[12], m[30]);+	MONT_MAC(w0, w1, w2, u[13], m[29]);+	MONT_MAC(t0, t1, t2, u[14], m[28]);+	MONT_MAC(v0, v1, v2, u[15], m[27]);+	MONT_MAC(w0, w1, w2, u[16], m[26]);+	MONT_MAC(t0, t1, t2, u[17], m[25]);+	MONT_MAC(v0, v1, v2, u[18], m[24]);+	MONT_MAC(w0, w1, w2, u[19], m[23]);+	MONT_MAC(t0, t1, t2, u[20], m[22]);+	MONT_MAC(v0, v1, v2, u[21], m[21]);+	MONT_MAC(w0, w1, w2, u[22], m[20]);+	MONT_MAC(t0, t1, t2, u[23], m[19]);+	MONT_MAC(v0, v1, v2, u[24], m[18]);+	MONT_MAC(w0, w1, w2, u[25], m[17]);+	MONT_MAC(t0, t1, t2, u[26], m[16]);+	MONT_MAC(v0, v1, v2, u[27], m[15]);+	MONT_MAC(w0, w1, w2, u[28], m[14]);+	MONT_MAC(t0, t1, t2, u[29], m[13]);+	MONT_MAC(v0, v1, v2, u[30], m[12]);+	MONT_MAC(w0, w1, w2, u[31], m[11]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	z[10] = t0;+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 43 */+	MONT_MAC(t0, t1, t2, a[12], b[31]);+	MONT_MUL(v0, v1, v2, a[13], b[30]);+	MONT_MUL(w0, w1, w2, a[14], b[29]);+	MONT_MAC(t0, t1, t2, a[15], b[28]);+	MONT_MAC(v0, v1, v2, a[16], b[27]);+	MONT_MAC(w0, w1, w2, a[17], b[26]);+	MONT_MAC(t0, t1, t2, a[18], b[25]);+	MONT_MAC(v0, v1, v2, a[19], b[24]);+	MONT_MAC(w0, w1, w2, a[20], b[23]);+	MONT_MAC(t0, t1, t2, a[21], b[22]);+	MONT_MAC(v0, v1, v2, a[22], b[21]);+	MONT_MAC(w0, w1, w2, a[23], b[20]);+	MONT_MAC(t0, t1, t2, a[24], b[19]);+	MONT_MAC(v0, v1, v2, a[25], b[18]);+	MONT_MAC(w0, w1, w2, a[26], b[17]);+	MONT_MAC(t0, t1, t2, a[27], b[16]);+	MONT_MAC(v0, v1, v2, a[28], b[15]);+	MONT_MAC(w0, w1, w2, a[29], b[14]);+	MONT_MAC(t0, t1, t2, a[30], b[13]);+	MONT_MAC(v0, v1, v2, a[31], b[12]);+	MONT_MAC(w0, w1, w2, u[12], m[31]);+	MONT_MAC(t0, t1, t2, u[13], m[30]);+	MONT_MAC(v0, v1, v2, u[14], m[29]);+	MONT_MAC(w0, w1, w2, u[15], m[28]);+	MONT_MAC(t0, t1, t2, u[16], m[27]);+	MONT_MAC(v0, v1, v2, u[17], m[26]);+	MONT_MAC(w0, w1, w2, u[18], m[25]);+	MONT_MAC(t0, t1, t2, u[19], m[24]);+	MONT_MAC(v0, v1, v2, u[20], m[23]);+	MONT_MAC(w0, w1, w2, u[21], m[22]);+	MONT_MAC(t0, t1, t2, u[22], m[21]);+	MONT_MAC(v0, v1, v2, u[23], m[20]);+	MONT_MAC(w0, w1, w2, u[24], m[19]);+	MONT_MAC(t0, t1, t2, u[25], m[18]);+	MONT_MAC(v0, v1, v2, u[26], m[17]);+	MONT_MAC(w0, w1, w2, u[27], m[16]);+	MONT_MAC(t0, t1, t2, u[28], m[15]);+	MONT_MAC(v0, v1, v2, u[29], m[14]);+	MONT_MAC(w0, w1, w2, u[30], m[13]);+	MONT_MAC(t0, t1, t2, u[31], m[12]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	z[11] = t0;+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 44 */+	MONT_MAC(t0, t1, t2, a[13], b[31]);+	MONT_MUL(v0, v1, v2, a[14], b[30]);+	MONT_MUL(w0, w1, w2, a[15], b[29]);+	MONT_MAC(t0, t1, t2, a[16], b[28]);+	MONT_MAC(v0, v1, v2, a[17], b[27]);+	MONT_MAC(w0, w1, w2, a[18], b[26]);+	MONT_MAC(t0, t1, t2, a[19], b[25]);+	MONT_MAC(v0, v1, v2, a[20], b[24]);+	MONT_MAC(w0, w1, w2, a[21], b[23]);+	MONT_MAC(t0, t1, t2, a[22], b[22]);+	MONT_MAC(v0, v1, v2, a[23], b[21]);+	MONT_MAC(w0, w1, w2, a[24], b[20]);+	MONT_MAC(t0, t1, t2, a[25], b[19]);+	MONT_MAC(v0, v1, v2, a[26], b[18]);+	MONT_MAC(w0, w1, w2, a[27], b[17]);+	MONT_MAC(t0, t1, t2, a[28], b[16]);+	MONT_MAC(v0, v1, v2, a[29], b[15]);+	MONT_MAC(w0, w1, w2, a[30], b[14]);+	MONT_MAC(t0, t1, t2, a[31], b[13]);+	MONT_MAC(v0, v1, v2, u[13], m[31]);+	MONT_MAC(w0, w1, w2, u[14], m[30]);+	MONT_MAC(t0, t1, t2, u[15], m[29]);+	MONT_MAC(v0, v1, v2, u[16], m[28]);+	MONT_MAC(w0, w1, w2, u[17], m[27]);+	MONT_MAC(t0, t1, t2, u[18], m[26]);+	MONT_MAC(v0, v1, v2, u[19], m[25]);+	MONT_MAC(w0, w1, w2, u[20], m[24]);+	MONT_MAC(t0, t1, t2, u[21], m[23]);+	MONT_MAC(v0, v1, v2, u[22], m[22]);+	MONT_MAC(w0, w1, w2, u[23], m[21]);+	MONT_MAC(t0, t1, t2, u[24], m[20]);+	MONT_MAC(v0, v1, v2, u[25], m[19]);+	MONT_MAC(w0, w1, w2, u[26], m[18]);+	MONT_MAC(t0, t1, t2, u[27], m[17]);+	MONT_MAC(v0, v1, v2, u[28], m[16]);+	MONT_MAC(w0, w1, w2, u[29], m[15]);+	MONT_MAC(t0, t1, t2, u[30], m[14]);+	MONT_MAC(v0, v1, v2, u[31], m[13]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	z[12] = t0;+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 45 */+	MONT_MAC(t0, t1, t2, a[14], b[31]);+	MONT_MUL(v0, v1, v2, a[15], b[30]);+	MONT_MUL(w0, w1, w2, a[16], b[29]);+	MONT_MAC(t0, t1, t2, a[17], b[28]);+	MONT_MAC(v0, v1, v2, a[18], b[27]);+	MONT_MAC(w0, w1, w2, a[19], b[26]);+	MONT_MAC(t0, t1, t2, a[20], b[25]);+	MONT_MAC(v0, v1, v2, a[21], b[24]);+	MONT_MAC(w0, w1, w2, a[22], b[23]);+	MONT_MAC(t0, t1, t2, a[23], b[22]);+	MONT_MAC(v0, v1, v2, a[24], b[21]);+	MONT_MAC(w0, w1, w2, a[25], b[20]);+	MONT_MAC(t0, t1, t2, a[26], b[19]);+	MONT_MAC(v0, v1, v2, a[27], b[18]);+	MONT_MAC(w0, w1, w2, a[28], b[17]);+	MONT_MAC(t0, t1, t2, a[29], b[16]);+	MONT_MAC(v0, v1, v2, a[30], b[15]);+	MONT_MAC(w0, w1, w2, a[31], b[14]);+	MONT_MAC(t0, t1, t2, u[14], m[31]);+	MONT_MAC(v0, v1, v2, u[15], m[30]);+	MONT_MAC(w0, w1, w2, u[16], m[29]);+	MONT_MAC(t0, t1, t2, u[17], m[28]);+	MONT_MAC(v0, v1, v2, u[18], m[27]);+	MONT_MAC(w0, w1, w2, u[19], m[26]);+	MONT_MAC(t0, t1, t2, u[20], m[25]);+	MONT_MAC(v0, v1, v2, u[21], m[24]);+	MONT_MAC(w0, w1, w2, u[22], m[23]);+	MONT_MAC(t0, t1, t2, u[23], m[22]);+	MONT_MAC(v0, v1, v2, u[24], m[21]);+	MONT_MAC(w0, w1, w2, u[25], m[20]);+	MONT_MAC(t0, t1, t2, u[26], m[19]);+	MONT_MAC(v0, v1, v2, u[27], m[18]);+	MONT_MAC(w0, w1, w2, u[28], m[17]);+	MONT_MAC(t0, t1, t2, u[29], m[16]);+	MONT_MAC(v0, v1, v2, u[30], m[15]);+	MONT_MAC(w0, w1, w2, u[31], m[14]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	z[13] = t0;+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 46 */+	MONT_MAC(t0, t1, t2, a[15], b[31]);+	MONT_MUL(v0, v1, v2, a[16], b[30]);+	MONT_MUL(w0, w1, w2, a[17], b[29]);+	MONT_MAC(t0, t1, t2, a[18], b[28]);+	MONT_MAC(v0, v1, v2, a[19], b[27]);+	MONT_MAC(w0, w1, w2, a[20], b[26]);+	MONT_MAC(t0, t1, t2, a[21], b[25]);+	MONT_MAC(v0, v1, v2, a[22], b[24]);+	MONT_MAC(w0, w1, w2, a[23], b[23]);+	MONT_MAC(t0, t1, t2, a[24], b[22]);+	MONT_MAC(v0, v1, v2, a[25], b[21]);+	MONT_MAC(w0, w1, w2, a[26], b[20]);+	MONT_MAC(t0, t1, t2, a[27], b[19]);+	MONT_MAC(v0, v1, v2, a[28], b[18]);+	MONT_MAC(w0, w1, w2, a[29], b[17]);+	MONT_MAC(t0, t1, t2, a[30], b[16]);+	MONT_MAC(v0, v1, v2, a[31], b[15]);+	MONT_MAC(w0, w1, w2, u[15], m[31]);+	MONT_MAC(t0, t1, t2, u[16], m[30]);+	MONT_MAC(v0, v1, v2, u[17], m[29]);+	MONT_MAC(w0, w1, w2, u[18], m[28]);+	MONT_MAC(t0, t1, t2, u[19], m[27]);+	MONT_MAC(v0, v1, v2, u[20], m[26]);+	MONT_MAC(w0, w1, w2, u[21], m[25]);+	MONT_MAC(t0, t1, t2, u[22], m[24]);+	MONT_MAC(v0, v1, v2, u[23], m[23]);+	MONT_MAC(w0, w1, w2, u[24], m[22]);+	MONT_MAC(t0, t1, t2, u[25], m[21]);+	MONT_MAC(v0, v1, v2, u[26], m[20]);+	MONT_MAC(w0, w1, w2, u[27], m[19]);+	MONT_MAC(t0, t1, t2, u[28], m[18]);+	MONT_MAC(v0, v1, v2, u[29], m[17]);+	MONT_MAC(w0, w1, w2, u[30], m[16]);+	MONT_MAC(t0, t1, t2, u[31], m[15]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	z[14] = t0;+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 47 */+	MONT_MAC(t0, t1, t2, a[16], b[31]);+	MONT_MUL(v0, v1, v2, a[17], b[30]);+	MONT_MUL(w0, w1, w2, a[18], b[29]);+	MONT_MAC(t0, t1, t2, a[19], b[28]);+	MONT_MAC(v0, v1, v2, a[20], b[27]);+	MONT_MAC(w0, w1, w2, a[21], b[26]);+	MONT_MAC(t0, t1, t2, a[22], b[25]);+	MONT_MAC(v0, v1, v2, a[23], b[24]);+	MONT_MAC(w0, w1, w2, a[24], b[23]);+	MONT_MAC(t0, t1, t2, a[25], b[22]);+	MONT_MAC(v0, v1, v2, a[26], b[21]);+	MONT_MAC(w0, w1, w2, a[27], b[20]);+	MONT_MAC(t0, t1, t2, a[28], b[19]);+	MONT_MAC(v0, v1, v2, a[29], b[18]);+	MONT_MAC(w0, w1, w2, a[30], b[17]);+	MONT_MAC(t0, t1, t2, a[31], b[16]);+	MONT_MAC(v0, v1, v2, u[16], m[31]);+	MONT_MAC(w0, w1, w2, u[17], m[30]);+	MONT_MAC(t0, t1, t2, u[18], m[29]);+	MONT_MAC(v0, v1, v2, u[19], m[28]);+	MONT_MAC(w0, w1, w2, u[20], m[27]);+	MONT_MAC(t0, t1, t2, u[21], m[26]);+	MONT_MAC(v0, v1, v2, u[22], m[25]);+	MONT_MAC(w0, w1, w2, u[23], m[24]);+	MONT_MAC(t0, t1, t2, u[24], m[23]);+	MONT_MAC(v0, v1, v2, u[25], m[22]);+	MONT_MAC(w0, w1, w2, u[26], m[21]);+	MONT_MAC(t0, t1, t2, u[27], m[20]);+	MONT_MAC(v0, v1, v2, u[28], m[19]);+	MONT_MAC(w0, w1, w2, u[29], m[18]);+	MONT_MAC(t0, t1, t2, u[30], m[17]);+	MONT_MAC(v0, v1, v2, u[31], m[16]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	z[15] = t0;+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 48 */+	MONT_MAC(t0, t1, t2, a[17], b[31]);+	MONT_MUL(v0, v1, v2, a[18], b[30]);+	MONT_MUL(w0, w1, w2, a[19], b[29]);+	MONT_MAC(t0, t1, t2, a[20], b[28]);+	MONT_MAC(v0, v1, v2, a[21], b[27]);+	MONT_MAC(w0, w1, w2, a[22], b[26]);+	MONT_MAC(t0, t1, t2, a[23], b[25]);+	MONT_MAC(v0, v1, v2, a[24], b[24]);+	MONT_MAC(w0, w1, w2, a[25], b[23]);+	MONT_MAC(t0, t1, t2, a[26], b[22]);+	MONT_MAC(v0, v1, v2, a[27], b[21]);+	MONT_MAC(w0, w1, w2, a[28], b[20]);+	MONT_MAC(t0, t1, t2, a[29], b[19]);+	MONT_MAC(v0, v1, v2, a[30], b[18]);+	MONT_MAC(w0, w1, w2, a[31], b[17]);+	MONT_MAC(t0, t1, t2, u[17], m[31]);+	MONT_MAC(v0, v1, v2, u[18], m[30]);+	MONT_MAC(w0, w1, w2, u[19], m[29]);+	MONT_MAC(t0, t1, t2, u[20], m[28]);+	MONT_MAC(v0, v1, v2, u[21], m[27]);+	MONT_MAC(w0, w1, w2, u[22], m[26]);+	MONT_MAC(t0, t1, t2, u[23], m[25]);+	MONT_MAC(v0, v1, v2, u[24], m[24]);+	MONT_MAC(w0, w1, w2, u[25], m[23]);+	MONT_MAC(t0, t1, t2, u[26], m[22]);+	MONT_MAC(v0, v1, v2, u[27], m[21]);+	MONT_MAC(w0, w1, w2, u[28], m[20]);+	MONT_MAC(t0, t1, t2, u[29], m[19]);+	MONT_MAC(v0, v1, v2, u[30], m[18]);+	MONT_MAC(w0, w1, w2, u[31], m[17]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	z[16] = t0;+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 49 */+	MONT_MAC(t0, t1, t2, a[18], b[31]);+	MONT_MUL(v0, v1, v2, a[19], b[30]);+	MONT_MUL(w0, w1, w2, a[20], b[29]);+	MONT_MAC(t0, t1, t2, a[21], b[28]);+	MONT_MAC(v0, v1, v2, a[22], b[27]);+	MONT_MAC(w0, w1, w2, a[23], b[26]);+	MONT_MAC(t0, t1, t2, a[24], b[25]);+	MONT_MAC(v0, v1, v2, a[25], b[24]);+	MONT_MAC(w0, w1, w2, a[26], b[23]);+	MONT_MAC(t0, t1, t2, a[27], b[22]);+	MONT_MAC(v0, v1, v2, a[28], b[21]);+	MONT_MAC(w0, w1, w2, a[29], b[20]);+	MONT_MAC(t0, t1, t2, a[30], b[19]);+	MONT_MAC(v0, v1, v2, a[31], b[18]);+	MONT_MAC(w0, w1, w2, u[18], m[31]);+	MONT_MAC(t0, t1, t2, u[19], m[30]);+	MONT_MAC(v0, v1, v2, u[20], m[29]);+	MONT_MAC(w0, w1, w2, u[21], m[28]);+	MONT_MAC(t0, t1, t2, u[22], m[27]);+	MONT_MAC(v0, v1, v2, u[23], m[26]);+	MONT_MAC(w0, w1, w2, u[24], m[25]);+	MONT_MAC(t0, t1, t2, u[25], m[24]);+	MONT_MAC(v0, v1, v2, u[26], m[23]);+	MONT_MAC(w0, w1, w2, u[27], m[22]);+	MONT_MAC(t0, t1, t2, u[28], m[21]);+	MONT_MAC(v0, v1, v2, u[29], m[20]);+	MONT_MAC(w0, w1, w2, u[30], m[19]);+	MONT_MAC(t0, t1, t2, u[31], m[18]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	z[17] = t0;+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 50 */+	MONT_MAC(t0, t1, t2, a[19], b[31]);+	MONT_MUL(v0, v1, v2, a[20], b[30]);+	MONT_MUL(w0, w1, w2, a[21], b[29]);+	MONT_MAC(t0, t1, t2, a[22], b[28]);+	MONT_MAC(v0, v1, v2, a[23], b[27]);+	MONT_MAC(w0, w1, w2, a[24], b[26]);+	MONT_MAC(t0, t1, t2, a[25], b[25]);+	MONT_MAC(v0, v1, v2, a[26], b[24]);+	MONT_MAC(w0, w1, w2, a[27], b[23]);+	MONT_MAC(t0, t1, t2, a[28], b[22]);+	MONT_MAC(v0, v1, v2, a[29], b[21]);+	MONT_MAC(w0, w1, w2, a[30], b[20]);+	MONT_MAC(t0, t1, t2, a[31], b[19]);+	MONT_MAC(v0, v1, v2, u[19], m[31]);+	MONT_MAC(w0, w1, w2, u[20], m[30]);+	MONT_MAC(t0, t1, t2, u[21], m[29]);+	MONT_MAC(v0, v1, v2, u[22], m[28]);+	MONT_MAC(w0, w1, w2, u[23], m[27]);+	MONT_MAC(t0, t1, t2, u[24], m[26]);+	MONT_MAC(v0, v1, v2, u[25], m[25]);+	MONT_MAC(w0, w1, w2, u[26], m[24]);+	MONT_MAC(t0, t1, t2, u[27], m[23]);+	MONT_MAC(v0, v1, v2, u[28], m[22]);+	MONT_MAC(w0, w1, w2, u[29], m[21]);+	MONT_MAC(t0, t1, t2, u[30], m[20]);+	MONT_MAC(v0, v1, v2, u[31], m[19]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	z[18] = t0;+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 51 */+	MONT_MAC(t0, t1, t2, a[20], b[31]);+	MONT_MUL(v0, v1, v2, a[21], b[30]);+	MONT_MUL(w0, w1, w2, a[22], b[29]);+	MONT_MAC(t0, t1, t2, a[23], b[28]);+	MONT_MAC(v0, v1, v2, a[24], b[27]);+	MONT_MAC(w0, w1, w2, a[25], b[26]);+	MONT_MAC(t0, t1, t2, a[26], b[25]);+	MONT_MAC(v0, v1, v2, a[27], b[24]);+	MONT_MAC(w0, w1, w2, a[28], b[23]);+	MONT_MAC(t0, t1, t2, a[29], b[22]);+	MONT_MAC(v0, v1, v2, a[30], b[21]);+	MONT_MAC(w0, w1, w2, a[31], b[20]);+	MONT_MAC(t0, t1, t2, u[20], m[31]);+	MONT_MAC(v0, v1, v2, u[21], m[30]);+	MONT_MAC(w0, w1, w2, u[22], m[29]);+	MONT_MAC(t0, t1, t2, u[23], m[28]);+	MONT_MAC(v0, v1, v2, u[24], m[27]);+	MONT_MAC(w0, w1, w2, u[25], m[26]);+	MONT_MAC(t0, t1, t2, u[26], m[25]);+	MONT_MAC(v0, v1, v2, u[27], m[24]);+	MONT_MAC(w0, w1, w2, u[28], m[23]);+	MONT_MAC(t0, t1, t2, u[29], m[22]);+	MONT_MAC(v0, v1, v2, u[30], m[21]);+	MONT_MAC(w0, w1, w2, u[31], m[20]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	z[19] = t0;+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 52 */+	MONT_MAC(t0, t1, t2, a[21], b[31]);+	MONT_MUL(v0, v1, v2, a[22], b[30]);+	MONT_MUL(w0, w1, w2, a[23], b[29]);+	MONT_MAC(t0, t1, t2, a[24], b[28]);+	MONT_MAC(v0, v1, v2, a[25], b[27]);+	MONT_MAC(w0, w1, w2, a[26], b[26]);+	MONT_MAC(t0, t1, t2, a[27], b[25]);+	MONT_MAC(v0, v1, v2, a[28], b[24]);+	MONT_MAC(w0, w1, w2, a[29], b[23]);+	MONT_MAC(t0, t1, t2, a[30], b[22]);+	MONT_MAC(v0, v1, v2, a[31], b[21]);+	MONT_MAC(w0, w1, w2, u[21], m[31]);+	MONT_MAC(t0, t1, t2, u[22], m[30]);+	MONT_MAC(v0, v1, v2, u[23], m[29]);+	MONT_MAC(w0, w1, w2, u[24], m[28]);+	MONT_MAC(t0, t1, t2, u[25], m[27]);+	MONT_MAC(v0, v1, v2, u[26], m[26]);+	MONT_MAC(w0, w1, w2, u[27], m[25]);+	MONT_MAC(t0, t1, t2, u[28], m[24]);+	MONT_MAC(v0, v1, v2, u[29], m[23]);+	MONT_MAC(w0, w1, w2, u[30], m[22]);+	MONT_MAC(t0, t1, t2, u[31], m[21]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	z[20] = t0;+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 53 */+	MONT_MAC(t0, t1, t2, a[22], b[31]);+	MONT_MUL(v0, v1, v2, a[23], b[30]);+	MONT_MUL(w0, w1, w2, a[24], b[29]);+	MONT_MAC(t0, t1, t2, a[25], b[28]);+	MONT_MAC(v0, v1, v2, a[26], b[27]);+	MONT_MAC(w0, w1, w2, a[27], b[26]);+	MONT_MAC(t0, t1, t2, a[28], b[25]);+	MONT_MAC(v0, v1, v2, a[29], b[24]);+	MONT_MAC(w0, w1, w2, a[30], b[23]);+	MONT_MAC(t0, t1, t2, a[31], b[22]);+	MONT_MAC(v0, v1, v2, u[22], m[31]);+	MONT_MAC(w0, w1, w2, u[23], m[30]);+	MONT_MAC(t0, t1, t2, u[24], m[29]);+	MONT_MAC(v0, v1, v2, u[25], m[28]);+	MONT_MAC(w0, w1, w2, u[26], m[27]);+	MONT_MAC(t0, t1, t2, u[27], m[26]);+	MONT_MAC(v0, v1, v2, u[28], m[25]);+	MONT_MAC(w0, w1, w2, u[29], m[24]);+	MONT_MAC(t0, t1, t2, u[30], m[23]);+	MONT_MAC(v0, v1, v2, u[31], m[22]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	z[21] = t0;+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 54 */+	MONT_MAC(t0, t1, t2, a[23], b[31]);+	MONT_MUL(v0, v1, v2, a[24], b[30]);+	MONT_MUL(w0, w1, w2, a[25], b[29]);+	MONT_MAC(t0, t1, t2, a[26], b[28]);+	MONT_MAC(v0, v1, v2, a[27], b[27]);+	MONT_MAC(w0, w1, w2, a[28], b[26]);+	MONT_MAC(t0, t1, t2, a[29], b[25]);+	MONT_MAC(v0, v1, v2, a[30], b[24]);+	MONT_MAC(w0, w1, w2, a[31], b[23]);+	MONT_MAC(t0, t1, t2, u[23], m[31]);+	MONT_MAC(v0, v1, v2, u[24], m[30]);+	MONT_MAC(w0, w1, w2, u[25], m[29]);+	MONT_MAC(t0, t1, t2, u[26], m[28]);+	MONT_MAC(v0, v1, v2, u[27], m[27]);+	MONT_MAC(w0, w1, w2, u[28], m[26]);+	MONT_MAC(t0, t1, t2, u[29], m[25]);+	MONT_MAC(v0, v1, v2, u[30], m[24]);+	MONT_MAC(w0, w1, w2, u[31], m[23]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	z[22] = t0;+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 55 */+	MONT_MAC(t0, t1, t2, a[24], b[31]);+	MONT_MUL(v0, v1, v2, a[25], b[30]);+	MONT_MUL(w0, w1, w2, a[26], b[29]);+	MONT_MAC(t0, t1, t2, a[27], b[28]);+	MONT_MAC(v0, v1, v2, a[28], b[27]);+	MONT_MAC(w0, w1, w2, a[29], b[26]);+	MONT_MAC(t0, t1, t2, a[30], b[25]);+	MONT_MAC(v0, v1, v2, a[31], b[24]);+	MONT_MAC(w0, w1, w2, u[24], m[31]);+	MONT_MAC(t0, t1, t2, u[25], m[30]);+	MONT_MAC(v0, v1, v2, u[26], m[29]);+	MONT_MAC(w0, w1, w2, u[27], m[28]);+	MONT_MAC(t0, t1, t2, u[28], m[27]);+	MONT_MAC(v0, v1, v2, u[29], m[26]);+	MONT_MAC(w0, w1, w2, u[30], m[25]);+	MONT_MAC(t0, t1, t2, u[31], m[24]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	z[23] = t0;+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 56 */+	MONT_MAC(t0, t1, t2, a[25], b[31]);+	MONT_MUL(v0, v1, v2, a[26], b[30]);+	MONT_MUL(w0, w1, w2, a[27], b[29]);+	MONT_MAC(t0, t1, t2, a[28], b[28]);+	MONT_MAC(v0, v1, v2, a[29], b[27]);+	MONT_MAC(w0, w1, w2, a[30], b[26]);+	MONT_MAC(t0, t1, t2, a[31], b[25]);+	MONT_MAC(v0, v1, v2, u[25], m[31]);+	MONT_MAC(w0, w1, w2, u[26], m[30]);+	MONT_MAC(t0, t1, t2, u[27], m[29]);+	MONT_MAC(v0, v1, v2, u[28], m[28]);+	MONT_MAC(w0, w1, w2, u[29], m[27]);+	MONT_MAC(t0, t1, t2, u[30], m[26]);+	MONT_MAC(v0, v1, v2, u[31], m[25]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	z[24] = t0;+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 57 */+	MONT_MAC(t0, t1, t2, a[26], b[31]);+	MONT_MUL(v0, v1, v2, a[27], b[30]);+	MONT_MUL(w0, w1, w2, a[28], b[29]);+	MONT_MAC(t0, t1, t2, a[29], b[28]);+	MONT_MAC(v0, v1, v2, a[30], b[27]);+	MONT_MAC(w0, w1, w2, a[31], b[26]);+	MONT_MAC(t0, t1, t2, u[26], m[31]);+	MONT_MAC(v0, v1, v2, u[27], m[30]);+	MONT_MAC(w0, w1, w2, u[28], m[29]);+	MONT_MAC(t0, t1, t2, u[29], m[28]);+	MONT_MAC(v0, v1, v2, u[30], m[27]);+	MONT_MAC(w0, w1, w2, u[31], m[26]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	z[25] = t0;+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 58 */+	MONT_MAC(t0, t1, t2, a[27], b[31]);+	MONT_MUL(v0, v1, v2, a[28], b[30]);+	MONT_MUL(w0, w1, w2, a[29], b[29]);+	MONT_MAC(t0, t1, t2, a[30], b[28]);+	MONT_MAC(v0, v1, v2, a[31], b[27]);+	MONT_MAC(w0, w1, w2, u[27], m[31]);+	MONT_MAC(t0, t1, t2, u[28], m[30]);+	MONT_MAC(v0, v1, v2, u[29], m[29]);+	MONT_MAC(w0, w1, w2, u[30], m[28]);+	MONT_MAC(t0, t1, t2, u[31], m[27]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	z[26] = t0;+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 59 */+	MONT_MAC(t0, t1, t2, a[28], b[31]);+	MONT_MUL(v0, v1, v2, a[29], b[30]);+	MONT_MUL(w0, w1, w2, a[30], b[29]);+	MONT_MAC(t0, t1, t2, a[31], b[28]);+	MONT_MAC(v0, v1, v2, u[28], m[31]);+	MONT_MAC(w0, w1, w2, u[29], m[30]);+	MONT_MAC(t0, t1, t2, u[30], m[29]);+	MONT_MAC(v0, v1, v2, u[31], m[28]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	z[27] = t0;+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 60 */+	MONT_MAC(t0, t1, t2, a[29], b[31]);+	MONT_MUL(v0, v1, v2, a[30], b[30]);+	MONT_MUL(w0, w1, w2, a[31], b[29]);+	MONT_MAC(t0, t1, t2, u[29], m[31]);+	MONT_MAC(v0, v1, v2, u[30], m[30]);+	MONT_MAC(w0, w1, w2, u[31], m[29]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	z[28] = t0;+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 61 */+	MONT_MAC(t0, t1, t2, a[30], b[31]);+	MONT_MUL(v0, v1, v2, a[31], b[30]);+	MONT_MUL(w0, w1, w2, u[30], m[31]);+	MONT_MAC(t0, t1, t2, u[31], m[30]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	z[29] = t0;+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 62 */+	MONT_MAC(t0, t1, t2, a[31], b[31]);+	MONT_MUL(v0, v1, v2, u[31], m[31]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	z[30] = t0;+	t0 = t1;+	t1 = t2;+	t2 = 0;+	z[31] = t0;++	/* under 2m, with t1 the bit above n limbs: at most one subtraction */+	borrow = sub_n(r, z, m, 32);+	take = t1 | (borrow ^ 1);+	select_n(r, r, z, take & 1, 32);+}++/* r = a * a * R^-1 mod m, for a under m; t is 2n limbs of scratch */+static void crypton_mont_sqr32(limb_t *r, const limb_t *a,+                               const limb_t *m, limb_t n0, limb_t *t)+{+	limb_t *u = t, *z = t + 32;+	limb_t t0 = 0, t1 = 0, t2 = 0, v0, v1, v2, w0, w1, w2, borrow, take;+	limb_t s0, s1, s2, c0, c1, c2;++	/* column 0 */+	MONT_MAC(t0, t1, t2, a[0], a[0]);+	u[0] = t0 * n0;+	MONT_MAC(t0, t1, t2, u[0], m[0]);+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 1 */+	MONT_MUL(s0, s1, s2, a[0], a[1]);+	MONT_MAC(t0, t1, t2, u[0], m[1]);+	MONT_DBL(s0, s1, s2);+	MONT_ADD(t0, t1, t2, s0, s1, s2);+	u[1] = t0 * n0;+	MONT_MAC(t0, t1, t2, u[1], m[0]);+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 2 */+	MONT_MUL(s0, s1, s2, a[0], a[2]);+	MONT_MAC(t0, t1, t2, a[1], a[1]);+	MONT_MUL(v0, v1, v2, u[0], m[2]);+	MONT_MUL(w0, w1, w2, u[1], m[1]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	MONT_DBL(s0, s1, s2);+	MONT_ADD(t0, t1, t2, s0, s1, s2);+	u[2] = t0 * n0;+	MONT_MAC(t0, t1, t2, u[2], m[0]);+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 3 */+	MONT_MUL(s0, s1, s2, a[0], a[3]);+	MONT_MUL(c0, c1, c2, a[1], a[2]);+	MONT_MAC(t0, t1, t2, u[0], m[3]);+	MONT_MUL(v0, v1, v2, u[1], m[2]);+	MONT_MUL(w0, w1, w2, u[2], m[1]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	MONT_ADD(s0, s1, s2, c0, c1, c2);+	MONT_DBL(s0, s1, s2);+	MONT_ADD(t0, t1, t2, s0, s1, s2);+	u[3] = t0 * n0;+	MONT_MAC(t0, t1, t2, u[3], m[0]);+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 4 */+	MONT_MUL(s0, s1, s2, a[0], a[4]);+	MONT_MUL(c0, c1, c2, a[1], a[3]);+	MONT_MAC(t0, t1, t2, a[2], a[2]);+	MONT_MUL(v0, v1, v2, u[0], m[4]);+	MONT_MUL(w0, w1, w2, u[1], m[3]);+	MONT_MAC(t0, t1, t2, u[2], m[2]);+	MONT_MAC(v0, v1, v2, u[3], m[1]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	MONT_ADD(s0, s1, s2, c0, c1, c2);+	MONT_DBL(s0, s1, s2);+	MONT_ADD(t0, t1, t2, s0, s1, s2);+	u[4] = t0 * n0;+	MONT_MAC(t0, t1, t2, u[4], m[0]);+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 5 */+	MONT_MUL(s0, s1, s2, a[0], a[5]);+	MONT_MUL(c0, c1, c2, a[1], a[4]);+	MONT_MAC(s0, s1, s2, a[2], a[3]);+	MONT_MAC(t0, t1, t2, u[0], m[5]);+	MONT_MUL(v0, v1, v2, u[1], m[4]);+	MONT_MUL(w0, w1, w2, u[2], m[3]);+	MONT_MAC(t0, t1, t2, u[3], m[2]);+	MONT_MAC(v0, v1, v2, u[4], m[1]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	MONT_ADD(s0, s1, s2, c0, c1, c2);+	MONT_DBL(s0, s1, s2);+	MONT_ADD(t0, t1, t2, s0, s1, s2);+	u[5] = t0 * n0;+	MONT_MAC(t0, t1, t2, u[5], m[0]);+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 6 */+	MONT_MUL(s0, s1, s2, a[0], a[6]);+	MONT_MUL(c0, c1, c2, a[1], a[5]);+	MONT_MAC(s0, s1, s2, a[2], a[4]);+	MONT_MAC(t0, t1, t2, a[3], a[3]);+	MONT_MUL(v0, v1, v2, u[0], m[6]);+	MONT_MUL(w0, w1, w2, u[1], m[5]);+	MONT_MAC(t0, t1, t2, u[2], m[4]);+	MONT_MAC(v0, v1, v2, u[3], m[3]);+	MONT_MAC(w0, w1, w2, u[4], m[2]);+	MONT_MAC(t0, t1, t2, u[5], m[1]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	MONT_ADD(s0, s1, s2, c0, c1, c2);+	MONT_DBL(s0, s1, s2);+	MONT_ADD(t0, t1, t2, s0, s1, s2);+	u[6] = t0 * n0;+	MONT_MAC(t0, t1, t2, u[6], m[0]);+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 7 */+	MONT_MUL(s0, s1, s2, a[0], a[7]);+	MONT_MUL(c0, c1, c2, a[1], a[6]);+	MONT_MAC(s0, s1, s2, a[2], a[5]);+	MONT_MAC(c0, c1, c2, a[3], a[4]);+	MONT_MAC(t0, t1, t2, u[0], m[7]);+	MONT_MUL(v0, v1, v2, u[1], m[6]);+	MONT_MUL(w0, w1, w2, u[2], m[5]);+	MONT_MAC(t0, t1, t2, u[3], m[4]);+	MONT_MAC(v0, v1, v2, u[4], m[3]);+	MONT_MAC(w0, w1, w2, u[5], m[2]);+	MONT_MAC(t0, t1, t2, u[6], m[1]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	MONT_ADD(s0, s1, s2, c0, c1, c2);+	MONT_DBL(s0, s1, s2);+	MONT_ADD(t0, t1, t2, s0, s1, s2);+	u[7] = t0 * n0;+	MONT_MAC(t0, t1, t2, u[7], m[0]);+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 8 */+	MONT_MUL(s0, s1, s2, a[0], a[8]);+	MONT_MUL(c0, c1, c2, a[1], a[7]);+	MONT_MAC(s0, s1, s2, a[2], a[6]);+	MONT_MAC(c0, c1, c2, a[3], a[5]);+	MONT_MAC(t0, t1, t2, a[4], a[4]);+	MONT_MUL(v0, v1, v2, u[0], m[8]);+	MONT_MUL(w0, w1, w2, u[1], m[7]);+	MONT_MAC(t0, t1, t2, u[2], m[6]);+	MONT_MAC(v0, v1, v2, u[3], m[5]);+	MONT_MAC(w0, w1, w2, u[4], m[4]);+	MONT_MAC(t0, t1, t2, u[5], m[3]);+	MONT_MAC(v0, v1, v2, u[6], m[2]);+	MONT_MAC(w0, w1, w2, u[7], m[1]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	MONT_ADD(s0, s1, s2, c0, c1, c2);+	MONT_DBL(s0, s1, s2);+	MONT_ADD(t0, t1, t2, s0, s1, s2);+	u[8] = t0 * n0;+	MONT_MAC(t0, t1, t2, u[8], m[0]);+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 9 */+	MONT_MUL(s0, s1, s2, a[0], a[9]);+	MONT_MUL(c0, c1, c2, a[1], a[8]);+	MONT_MAC(s0, s1, s2, a[2], a[7]);+	MONT_MAC(c0, c1, c2, a[3], a[6]);+	MONT_MAC(s0, s1, s2, a[4], a[5]);+	MONT_MAC(t0, t1, t2, u[0], m[9]);+	MONT_MUL(v0, v1, v2, u[1], m[8]);+	MONT_MUL(w0, w1, w2, u[2], m[7]);+	MONT_MAC(t0, t1, t2, u[3], m[6]);+	MONT_MAC(v0, v1, v2, u[4], m[5]);+	MONT_MAC(w0, w1, w2, u[5], m[4]);+	MONT_MAC(t0, t1, t2, u[6], m[3]);+	MONT_MAC(v0, v1, v2, u[7], m[2]);+	MONT_MAC(w0, w1, w2, u[8], m[1]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	MONT_ADD(s0, s1, s2, c0, c1, c2);+	MONT_DBL(s0, s1, s2);+	MONT_ADD(t0, t1, t2, s0, s1, s2);+	u[9] = t0 * n0;+	MONT_MAC(t0, t1, t2, u[9], m[0]);+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 10 */+	MONT_MUL(s0, s1, s2, a[0], a[10]);+	MONT_MUL(c0, c1, c2, a[1], a[9]);+	MONT_MAC(s0, s1, s2, a[2], a[8]);+	MONT_MAC(c0, c1, c2, a[3], a[7]);+	MONT_MAC(s0, s1, s2, a[4], a[6]);+	MONT_MAC(t0, t1, t2, a[5], a[5]);+	MONT_MUL(v0, v1, v2, u[0], m[10]);+	MONT_MUL(w0, w1, w2, u[1], m[9]);+	MONT_MAC(t0, t1, t2, u[2], m[8]);+	MONT_MAC(v0, v1, v2, u[3], m[7]);+	MONT_MAC(w0, w1, w2, u[4], m[6]);+	MONT_MAC(t0, t1, t2, u[5], m[5]);+	MONT_MAC(v0, v1, v2, u[6], m[4]);+	MONT_MAC(w0, w1, w2, u[7], m[3]);+	MONT_MAC(t0, t1, t2, u[8], m[2]);+	MONT_MAC(v0, v1, v2, u[9], m[1]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	MONT_ADD(s0, s1, s2, c0, c1, c2);+	MONT_DBL(s0, s1, s2);+	MONT_ADD(t0, t1, t2, s0, s1, s2);+	u[10] = t0 * n0;+	MONT_MAC(t0, t1, t2, u[10], m[0]);+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 11 */+	MONT_MUL(s0, s1, s2, a[0], a[11]);+	MONT_MUL(c0, c1, c2, a[1], a[10]);+	MONT_MAC(s0, s1, s2, a[2], a[9]);+	MONT_MAC(c0, c1, c2, a[3], a[8]);+	MONT_MAC(s0, s1, s2, a[4], a[7]);+	MONT_MAC(c0, c1, c2, a[5], a[6]);+	MONT_MAC(t0, t1, t2, u[0], m[11]);+	MONT_MUL(v0, v1, v2, u[1], m[10]);+	MONT_MUL(w0, w1, w2, u[2], m[9]);+	MONT_MAC(t0, t1, t2, u[3], m[8]);+	MONT_MAC(v0, v1, v2, u[4], m[7]);+	MONT_MAC(w0, w1, w2, u[5], m[6]);+	MONT_MAC(t0, t1, t2, u[6], m[5]);+	MONT_MAC(v0, v1, v2, u[7], m[4]);+	MONT_MAC(w0, w1, w2, u[8], m[3]);+	MONT_MAC(t0, t1, t2, u[9], m[2]);+	MONT_MAC(v0, v1, v2, u[10], m[1]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	MONT_ADD(s0, s1, s2, c0, c1, c2);+	MONT_DBL(s0, s1, s2);+	MONT_ADD(t0, t1, t2, s0, s1, s2);+	u[11] = t0 * n0;+	MONT_MAC(t0, t1, t2, u[11], m[0]);+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 12 */+	MONT_MUL(s0, s1, s2, a[0], a[12]);+	MONT_MUL(c0, c1, c2, a[1], a[11]);+	MONT_MAC(s0, s1, s2, a[2], a[10]);+	MONT_MAC(c0, c1, c2, a[3], a[9]);+	MONT_MAC(s0, s1, s2, a[4], a[8]);+	MONT_MAC(c0, c1, c2, a[5], a[7]);+	MONT_MAC(t0, t1, t2, a[6], a[6]);+	MONT_MUL(v0, v1, v2, u[0], m[12]);+	MONT_MUL(w0, w1, w2, u[1], m[11]);+	MONT_MAC(t0, t1, t2, u[2], m[10]);+	MONT_MAC(v0, v1, v2, u[3], m[9]);+	MONT_MAC(w0, w1, w2, u[4], m[8]);+	MONT_MAC(t0, t1, t2, u[5], m[7]);+	MONT_MAC(v0, v1, v2, u[6], m[6]);+	MONT_MAC(w0, w1, w2, u[7], m[5]);+	MONT_MAC(t0, t1, t2, u[8], m[4]);+	MONT_MAC(v0, v1, v2, u[9], m[3]);+	MONT_MAC(w0, w1, w2, u[10], m[2]);+	MONT_MAC(t0, t1, t2, u[11], m[1]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	MONT_ADD(s0, s1, s2, c0, c1, c2);+	MONT_DBL(s0, s1, s2);+	MONT_ADD(t0, t1, t2, s0, s1, s2);+	u[12] = t0 * n0;+	MONT_MAC(t0, t1, t2, u[12], m[0]);+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 13 */+	MONT_MUL(s0, s1, s2, a[0], a[13]);+	MONT_MUL(c0, c1, c2, a[1], a[12]);+	MONT_MAC(s0, s1, s2, a[2], a[11]);+	MONT_MAC(c0, c1, c2, a[3], a[10]);+	MONT_MAC(s0, s1, s2, a[4], a[9]);+	MONT_MAC(c0, c1, c2, a[5], a[8]);+	MONT_MAC(s0, s1, s2, a[6], a[7]);+	MONT_MAC(t0, t1, t2, u[0], m[13]);+	MONT_MUL(v0, v1, v2, u[1], m[12]);+	MONT_MUL(w0, w1, w2, u[2], m[11]);+	MONT_MAC(t0, t1, t2, u[3], m[10]);+	MONT_MAC(v0, v1, v2, u[4], m[9]);+	MONT_MAC(w0, w1, w2, u[5], m[8]);+	MONT_MAC(t0, t1, t2, u[6], m[7]);+	MONT_MAC(v0, v1, v2, u[7], m[6]);+	MONT_MAC(w0, w1, w2, u[8], m[5]);+	MONT_MAC(t0, t1, t2, u[9], m[4]);+	MONT_MAC(v0, v1, v2, u[10], m[3]);+	MONT_MAC(w0, w1, w2, u[11], m[2]);+	MONT_MAC(t0, t1, t2, u[12], m[1]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	MONT_ADD(s0, s1, s2, c0, c1, c2);+	MONT_DBL(s0, s1, s2);+	MONT_ADD(t0, t1, t2, s0, s1, s2);+	u[13] = t0 * n0;+	MONT_MAC(t0, t1, t2, u[13], m[0]);+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 14 */+	MONT_MUL(s0, s1, s2, a[0], a[14]);+	MONT_MUL(c0, c1, c2, a[1], a[13]);+	MONT_MAC(s0, s1, s2, a[2], a[12]);+	MONT_MAC(c0, c1, c2, a[3], a[11]);+	MONT_MAC(s0, s1, s2, a[4], a[10]);+	MONT_MAC(c0, c1, c2, a[5], a[9]);+	MONT_MAC(s0, s1, s2, a[6], a[8]);+	MONT_MAC(t0, t1, t2, a[7], a[7]);+	MONT_MUL(v0, v1, v2, u[0], m[14]);+	MONT_MUL(w0, w1, w2, u[1], m[13]);+	MONT_MAC(t0, t1, t2, u[2], m[12]);+	MONT_MAC(v0, v1, v2, u[3], m[11]);+	MONT_MAC(w0, w1, w2, u[4], m[10]);+	MONT_MAC(t0, t1, t2, u[5], m[9]);+	MONT_MAC(v0, v1, v2, u[6], m[8]);+	MONT_MAC(w0, w1, w2, u[7], m[7]);+	MONT_MAC(t0, t1, t2, u[8], m[6]);+	MONT_MAC(v0, v1, v2, u[9], m[5]);+	MONT_MAC(w0, w1, w2, u[10], m[4]);+	MONT_MAC(t0, t1, t2, u[11], m[3]);+	MONT_MAC(v0, v1, v2, u[12], m[2]);+	MONT_MAC(w0, w1, w2, u[13], m[1]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	MONT_ADD(s0, s1, s2, c0, c1, c2);+	MONT_DBL(s0, s1, s2);+	MONT_ADD(t0, t1, t2, s0, s1, s2);+	u[14] = t0 * n0;+	MONT_MAC(t0, t1, t2, u[14], m[0]);+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 15 */+	MONT_MUL(s0, s1, s2, a[0], a[15]);+	MONT_MUL(c0, c1, c2, a[1], a[14]);+	MONT_MAC(s0, s1, s2, a[2], a[13]);+	MONT_MAC(c0, c1, c2, a[3], a[12]);+	MONT_MAC(s0, s1, s2, a[4], a[11]);+	MONT_MAC(c0, c1, c2, a[5], a[10]);+	MONT_MAC(s0, s1, s2, a[6], a[9]);+	MONT_MAC(c0, c1, c2, a[7], a[8]);+	MONT_MAC(t0, t1, t2, u[0], m[15]);+	MONT_MUL(v0, v1, v2, u[1], m[14]);+	MONT_MUL(w0, w1, w2, u[2], m[13]);+	MONT_MAC(t0, t1, t2, u[3], m[12]);+	MONT_MAC(v0, v1, v2, u[4], m[11]);+	MONT_MAC(w0, w1, w2, u[5], m[10]);+	MONT_MAC(t0, t1, t2, u[6], m[9]);+	MONT_MAC(v0, v1, v2, u[7], m[8]);+	MONT_MAC(w0, w1, w2, u[8], m[7]);+	MONT_MAC(t0, t1, t2, u[9], m[6]);+	MONT_MAC(v0, v1, v2, u[10], m[5]);+	MONT_MAC(w0, w1, w2, u[11], m[4]);+	MONT_MAC(t0, t1, t2, u[12], m[3]);+	MONT_MAC(v0, v1, v2, u[13], m[2]);+	MONT_MAC(w0, w1, w2, u[14], m[1]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	MONT_ADD(s0, s1, s2, c0, c1, c2);+	MONT_DBL(s0, s1, s2);+	MONT_ADD(t0, t1, t2, s0, s1, s2);+	u[15] = t0 * n0;+	MONT_MAC(t0, t1, t2, u[15], m[0]);+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 16 */+	MONT_MUL(s0, s1, s2, a[0], a[16]);+	MONT_MUL(c0, c1, c2, a[1], a[15]);+	MONT_MAC(s0, s1, s2, a[2], a[14]);+	MONT_MAC(c0, c1, c2, a[3], a[13]);+	MONT_MAC(s0, s1, s2, a[4], a[12]);+	MONT_MAC(c0, c1, c2, a[5], a[11]);+	MONT_MAC(s0, s1, s2, a[6], a[10]);+	MONT_MAC(c0, c1, c2, a[7], a[9]);+	MONT_MAC(t0, t1, t2, a[8], a[8]);+	MONT_MUL(v0, v1, v2, u[0], m[16]);+	MONT_MUL(w0, w1, w2, u[1], m[15]);+	MONT_MAC(t0, t1, t2, u[2], m[14]);+	MONT_MAC(v0, v1, v2, u[3], m[13]);+	MONT_MAC(w0, w1, w2, u[4], m[12]);+	MONT_MAC(t0, t1, t2, u[5], m[11]);+	MONT_MAC(v0, v1, v2, u[6], m[10]);+	MONT_MAC(w0, w1, w2, u[7], m[9]);+	MONT_MAC(t0, t1, t2, u[8], m[8]);+	MONT_MAC(v0, v1, v2, u[9], m[7]);+	MONT_MAC(w0, w1, w2, u[10], m[6]);+	MONT_MAC(t0, t1, t2, u[11], m[5]);+	MONT_MAC(v0, v1, v2, u[12], m[4]);+	MONT_MAC(w0, w1, w2, u[13], m[3]);+	MONT_MAC(t0, t1, t2, u[14], m[2]);+	MONT_MAC(v0, v1, v2, u[15], m[1]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	MONT_ADD(s0, s1, s2, c0, c1, c2);+	MONT_DBL(s0, s1, s2);+	MONT_ADD(t0, t1, t2, s0, s1, s2);+	u[16] = t0 * n0;+	MONT_MAC(t0, t1, t2, u[16], m[0]);+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 17 */+	MONT_MUL(s0, s1, s2, a[0], a[17]);+	MONT_MUL(c0, c1, c2, a[1], a[16]);+	MONT_MAC(s0, s1, s2, a[2], a[15]);+	MONT_MAC(c0, c1, c2, a[3], a[14]);+	MONT_MAC(s0, s1, s2, a[4], a[13]);+	MONT_MAC(c0, c1, c2, a[5], a[12]);+	MONT_MAC(s0, s1, s2, a[6], a[11]);+	MONT_MAC(c0, c1, c2, a[7], a[10]);+	MONT_MAC(s0, s1, s2, a[8], a[9]);+	MONT_MAC(t0, t1, t2, u[0], m[17]);+	MONT_MUL(v0, v1, v2, u[1], m[16]);+	MONT_MUL(w0, w1, w2, u[2], m[15]);+	MONT_MAC(t0, t1, t2, u[3], m[14]);+	MONT_MAC(v0, v1, v2, u[4], m[13]);+	MONT_MAC(w0, w1, w2, u[5], m[12]);+	MONT_MAC(t0, t1, t2, u[6], m[11]);+	MONT_MAC(v0, v1, v2, u[7], m[10]);+	MONT_MAC(w0, w1, w2, u[8], m[9]);+	MONT_MAC(t0, t1, t2, u[9], m[8]);+	MONT_MAC(v0, v1, v2, u[10], m[7]);+	MONT_MAC(w0, w1, w2, u[11], m[6]);+	MONT_MAC(t0, t1, t2, u[12], m[5]);+	MONT_MAC(v0, v1, v2, u[13], m[4]);+	MONT_MAC(w0, w1, w2, u[14], m[3]);+	MONT_MAC(t0, t1, t2, u[15], m[2]);+	MONT_MAC(v0, v1, v2, u[16], m[1]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	MONT_ADD(s0, s1, s2, c0, c1, c2);+	MONT_DBL(s0, s1, s2);+	MONT_ADD(t0, t1, t2, s0, s1, s2);+	u[17] = t0 * n0;+	MONT_MAC(t0, t1, t2, u[17], m[0]);+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 18 */+	MONT_MUL(s0, s1, s2, a[0], a[18]);+	MONT_MUL(c0, c1, c2, a[1], a[17]);+	MONT_MAC(s0, s1, s2, a[2], a[16]);+	MONT_MAC(c0, c1, c2, a[3], a[15]);+	MONT_MAC(s0, s1, s2, a[4], a[14]);+	MONT_MAC(c0, c1, c2, a[5], a[13]);+	MONT_MAC(s0, s1, s2, a[6], a[12]);+	MONT_MAC(c0, c1, c2, a[7], a[11]);+	MONT_MAC(s0, s1, s2, a[8], a[10]);+	MONT_MAC(t0, t1, t2, a[9], a[9]);+	MONT_MUL(v0, v1, v2, u[0], m[18]);+	MONT_MUL(w0, w1, w2, u[1], m[17]);+	MONT_MAC(t0, t1, t2, u[2], m[16]);+	MONT_MAC(v0, v1, v2, u[3], m[15]);+	MONT_MAC(w0, w1, w2, u[4], m[14]);+	MONT_MAC(t0, t1, t2, u[5], m[13]);+	MONT_MAC(v0, v1, v2, u[6], m[12]);+	MONT_MAC(w0, w1, w2, u[7], m[11]);+	MONT_MAC(t0, t1, t2, u[8], m[10]);+	MONT_MAC(v0, v1, v2, u[9], m[9]);+	MONT_MAC(w0, w1, w2, u[10], m[8]);+	MONT_MAC(t0, t1, t2, u[11], m[7]);+	MONT_MAC(v0, v1, v2, u[12], m[6]);+	MONT_MAC(w0, w1, w2, u[13], m[5]);+	MONT_MAC(t0, t1, t2, u[14], m[4]);+	MONT_MAC(v0, v1, v2, u[15], m[3]);+	MONT_MAC(w0, w1, w2, u[16], m[2]);+	MONT_MAC(t0, t1, t2, u[17], m[1]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	MONT_ADD(s0, s1, s2, c0, c1, c2);+	MONT_DBL(s0, s1, s2);+	MONT_ADD(t0, t1, t2, s0, s1, s2);+	u[18] = t0 * n0;+	MONT_MAC(t0, t1, t2, u[18], m[0]);+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 19 */+	MONT_MUL(s0, s1, s2, a[0], a[19]);+	MONT_MUL(c0, c1, c2, a[1], a[18]);+	MONT_MAC(s0, s1, s2, a[2], a[17]);+	MONT_MAC(c0, c1, c2, a[3], a[16]);+	MONT_MAC(s0, s1, s2, a[4], a[15]);+	MONT_MAC(c0, c1, c2, a[5], a[14]);+	MONT_MAC(s0, s1, s2, a[6], a[13]);+	MONT_MAC(c0, c1, c2, a[7], a[12]);+	MONT_MAC(s0, s1, s2, a[8], a[11]);+	MONT_MAC(c0, c1, c2, a[9], a[10]);+	MONT_MAC(t0, t1, t2, u[0], m[19]);+	MONT_MUL(v0, v1, v2, u[1], m[18]);+	MONT_MUL(w0, w1, w2, u[2], m[17]);+	MONT_MAC(t0, t1, t2, u[3], m[16]);+	MONT_MAC(v0, v1, v2, u[4], m[15]);+	MONT_MAC(w0, w1, w2, u[5], m[14]);+	MONT_MAC(t0, t1, t2, u[6], m[13]);+	MONT_MAC(v0, v1, v2, u[7], m[12]);+	MONT_MAC(w0, w1, w2, u[8], m[11]);+	MONT_MAC(t0, t1, t2, u[9], m[10]);+	MONT_MAC(v0, v1, v2, u[10], m[9]);+	MONT_MAC(w0, w1, w2, u[11], m[8]);+	MONT_MAC(t0, t1, t2, u[12], m[7]);+	MONT_MAC(v0, v1, v2, u[13], m[6]);+	MONT_MAC(w0, w1, w2, u[14], m[5]);+	MONT_MAC(t0, t1, t2, u[15], m[4]);+	MONT_MAC(v0, v1, v2, u[16], m[3]);+	MONT_MAC(w0, w1, w2, u[17], m[2]);+	MONT_MAC(t0, t1, t2, u[18], m[1]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	MONT_ADD(s0, s1, s2, c0, c1, c2);+	MONT_DBL(s0, s1, s2);+	MONT_ADD(t0, t1, t2, s0, s1, s2);+	u[19] = t0 * n0;+	MONT_MAC(t0, t1, t2, u[19], m[0]);+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 20 */+	MONT_MUL(s0, s1, s2, a[0], a[20]);+	MONT_MUL(c0, c1, c2, a[1], a[19]);+	MONT_MAC(s0, s1, s2, a[2], a[18]);+	MONT_MAC(c0, c1, c2, a[3], a[17]);+	MONT_MAC(s0, s1, s2, a[4], a[16]);+	MONT_MAC(c0, c1, c2, a[5], a[15]);+	MONT_MAC(s0, s1, s2, a[6], a[14]);+	MONT_MAC(c0, c1, c2, a[7], a[13]);+	MONT_MAC(s0, s1, s2, a[8], a[12]);+	MONT_MAC(c0, c1, c2, a[9], a[11]);+	MONT_MAC(t0, t1, t2, a[10], a[10]);+	MONT_MUL(v0, v1, v2, u[0], m[20]);+	MONT_MUL(w0, w1, w2, u[1], m[19]);+	MONT_MAC(t0, t1, t2, u[2], m[18]);+	MONT_MAC(v0, v1, v2, u[3], m[17]);+	MONT_MAC(w0, w1, w2, u[4], m[16]);+	MONT_MAC(t0, t1, t2, u[5], m[15]);+	MONT_MAC(v0, v1, v2, u[6], m[14]);+	MONT_MAC(w0, w1, w2, u[7], m[13]);+	MONT_MAC(t0, t1, t2, u[8], m[12]);+	MONT_MAC(v0, v1, v2, u[9], m[11]);+	MONT_MAC(w0, w1, w2, u[10], m[10]);+	MONT_MAC(t0, t1, t2, u[11], m[9]);+	MONT_MAC(v0, v1, v2, u[12], m[8]);+	MONT_MAC(w0, w1, w2, u[13], m[7]);+	MONT_MAC(t0, t1, t2, u[14], m[6]);+	MONT_MAC(v0, v1, v2, u[15], m[5]);+	MONT_MAC(w0, w1, w2, u[16], m[4]);+	MONT_MAC(t0, t1, t2, u[17], m[3]);+	MONT_MAC(v0, v1, v2, u[18], m[2]);+	MONT_MAC(w0, w1, w2, u[19], m[1]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	MONT_ADD(s0, s1, s2, c0, c1, c2);+	MONT_DBL(s0, s1, s2);+	MONT_ADD(t0, t1, t2, s0, s1, s2);+	u[20] = t0 * n0;+	MONT_MAC(t0, t1, t2, u[20], m[0]);+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 21 */+	MONT_MUL(s0, s1, s2, a[0], a[21]);+	MONT_MUL(c0, c1, c2, a[1], a[20]);+	MONT_MAC(s0, s1, s2, a[2], a[19]);+	MONT_MAC(c0, c1, c2, a[3], a[18]);+	MONT_MAC(s0, s1, s2, a[4], a[17]);+	MONT_MAC(c0, c1, c2, a[5], a[16]);+	MONT_MAC(s0, s1, s2, a[6], a[15]);+	MONT_MAC(c0, c1, c2, a[7], a[14]);+	MONT_MAC(s0, s1, s2, a[8], a[13]);+	MONT_MAC(c0, c1, c2, a[9], a[12]);+	MONT_MAC(s0, s1, s2, a[10], a[11]);+	MONT_MAC(t0, t1, t2, u[0], m[21]);+	MONT_MUL(v0, v1, v2, u[1], m[20]);+	MONT_MUL(w0, w1, w2, u[2], m[19]);+	MONT_MAC(t0, t1, t2, u[3], m[18]);+	MONT_MAC(v0, v1, v2, u[4], m[17]);+	MONT_MAC(w0, w1, w2, u[5], m[16]);+	MONT_MAC(t0, t1, t2, u[6], m[15]);+	MONT_MAC(v0, v1, v2, u[7], m[14]);+	MONT_MAC(w0, w1, w2, u[8], m[13]);+	MONT_MAC(t0, t1, t2, u[9], m[12]);+	MONT_MAC(v0, v1, v2, u[10], m[11]);+	MONT_MAC(w0, w1, w2, u[11], m[10]);+	MONT_MAC(t0, t1, t2, u[12], m[9]);+	MONT_MAC(v0, v1, v2, u[13], m[8]);+	MONT_MAC(w0, w1, w2, u[14], m[7]);+	MONT_MAC(t0, t1, t2, u[15], m[6]);+	MONT_MAC(v0, v1, v2, u[16], m[5]);+	MONT_MAC(w0, w1, w2, u[17], m[4]);+	MONT_MAC(t0, t1, t2, u[18], m[3]);+	MONT_MAC(v0, v1, v2, u[19], m[2]);+	MONT_MAC(w0, w1, w2, u[20], m[1]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	MONT_ADD(s0, s1, s2, c0, c1, c2);+	MONT_DBL(s0, s1, s2);+	MONT_ADD(t0, t1, t2, s0, s1, s2);+	u[21] = t0 * n0;+	MONT_MAC(t0, t1, t2, u[21], m[0]);+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 22 */+	MONT_MUL(s0, s1, s2, a[0], a[22]);+	MONT_MUL(c0, c1, c2, a[1], a[21]);+	MONT_MAC(s0, s1, s2, a[2], a[20]);+	MONT_MAC(c0, c1, c2, a[3], a[19]);+	MONT_MAC(s0, s1, s2, a[4], a[18]);+	MONT_MAC(c0, c1, c2, a[5], a[17]);+	MONT_MAC(s0, s1, s2, a[6], a[16]);+	MONT_MAC(c0, c1, c2, a[7], a[15]);+	MONT_MAC(s0, s1, s2, a[8], a[14]);+	MONT_MAC(c0, c1, c2, a[9], a[13]);+	MONT_MAC(s0, s1, s2, a[10], a[12]);+	MONT_MAC(t0, t1, t2, a[11], a[11]);+	MONT_MUL(v0, v1, v2, u[0], m[22]);+	MONT_MUL(w0, w1, w2, u[1], m[21]);+	MONT_MAC(t0, t1, t2, u[2], m[20]);+	MONT_MAC(v0, v1, v2, u[3], m[19]);+	MONT_MAC(w0, w1, w2, u[4], m[18]);+	MONT_MAC(t0, t1, t2, u[5], m[17]);+	MONT_MAC(v0, v1, v2, u[6], m[16]);+	MONT_MAC(w0, w1, w2, u[7], m[15]);+	MONT_MAC(t0, t1, t2, u[8], m[14]);+	MONT_MAC(v0, v1, v2, u[9], m[13]);+	MONT_MAC(w0, w1, w2, u[10], m[12]);+	MONT_MAC(t0, t1, t2, u[11], m[11]);+	MONT_MAC(v0, v1, v2, u[12], m[10]);+	MONT_MAC(w0, w1, w2, u[13], m[9]);+	MONT_MAC(t0, t1, t2, u[14], m[8]);+	MONT_MAC(v0, v1, v2, u[15], m[7]);+	MONT_MAC(w0, w1, w2, u[16], m[6]);+	MONT_MAC(t0, t1, t2, u[17], m[5]);+	MONT_MAC(v0, v1, v2, u[18], m[4]);+	MONT_MAC(w0, w1, w2, u[19], m[3]);+	MONT_MAC(t0, t1, t2, u[20], m[2]);+	MONT_MAC(v0, v1, v2, u[21], m[1]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	MONT_ADD(s0, s1, s2, c0, c1, c2);+	MONT_DBL(s0, s1, s2);+	MONT_ADD(t0, t1, t2, s0, s1, s2);+	u[22] = t0 * n0;+	MONT_MAC(t0, t1, t2, u[22], m[0]);+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 23 */+	MONT_MUL(s0, s1, s2, a[0], a[23]);+	MONT_MUL(c0, c1, c2, a[1], a[22]);+	MONT_MAC(s0, s1, s2, a[2], a[21]);+	MONT_MAC(c0, c1, c2, a[3], a[20]);+	MONT_MAC(s0, s1, s2, a[4], a[19]);+	MONT_MAC(c0, c1, c2, a[5], a[18]);+	MONT_MAC(s0, s1, s2, a[6], a[17]);+	MONT_MAC(c0, c1, c2, a[7], a[16]);+	MONT_MAC(s0, s1, s2, a[8], a[15]);+	MONT_MAC(c0, c1, c2, a[9], a[14]);+	MONT_MAC(s0, s1, s2, a[10], a[13]);+	MONT_MAC(c0, c1, c2, a[11], a[12]);+	MONT_MAC(t0, t1, t2, u[0], m[23]);+	MONT_MUL(v0, v1, v2, u[1], m[22]);+	MONT_MUL(w0, w1, w2, u[2], m[21]);+	MONT_MAC(t0, t1, t2, u[3], m[20]);+	MONT_MAC(v0, v1, v2, u[4], m[19]);+	MONT_MAC(w0, w1, w2, u[5], m[18]);+	MONT_MAC(t0, t1, t2, u[6], m[17]);+	MONT_MAC(v0, v1, v2, u[7], m[16]);+	MONT_MAC(w0, w1, w2, u[8], m[15]);+	MONT_MAC(t0, t1, t2, u[9], m[14]);+	MONT_MAC(v0, v1, v2, u[10], m[13]);+	MONT_MAC(w0, w1, w2, u[11], m[12]);+	MONT_MAC(t0, t1, t2, u[12], m[11]);+	MONT_MAC(v0, v1, v2, u[13], m[10]);+	MONT_MAC(w0, w1, w2, u[14], m[9]);+	MONT_MAC(t0, t1, t2, u[15], m[8]);+	MONT_MAC(v0, v1, v2, u[16], m[7]);+	MONT_MAC(w0, w1, w2, u[17], m[6]);+	MONT_MAC(t0, t1, t2, u[18], m[5]);+	MONT_MAC(v0, v1, v2, u[19], m[4]);+	MONT_MAC(w0, w1, w2, u[20], m[3]);+	MONT_MAC(t0, t1, t2, u[21], m[2]);+	MONT_MAC(v0, v1, v2, u[22], m[1]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	MONT_ADD(s0, s1, s2, c0, c1, c2);+	MONT_DBL(s0, s1, s2);+	MONT_ADD(t0, t1, t2, s0, s1, s2);+	u[23] = t0 * n0;+	MONT_MAC(t0, t1, t2, u[23], m[0]);+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 24 */+	MONT_MUL(s0, s1, s2, a[0], a[24]);+	MONT_MUL(c0, c1, c2, a[1], a[23]);+	MONT_MAC(s0, s1, s2, a[2], a[22]);+	MONT_MAC(c0, c1, c2, a[3], a[21]);+	MONT_MAC(s0, s1, s2, a[4], a[20]);+	MONT_MAC(c0, c1, c2, a[5], a[19]);+	MONT_MAC(s0, s1, s2, a[6], a[18]);+	MONT_MAC(c0, c1, c2, a[7], a[17]);+	MONT_MAC(s0, s1, s2, a[8], a[16]);+	MONT_MAC(c0, c1, c2, a[9], a[15]);+	MONT_MAC(s0, s1, s2, a[10], a[14]);+	MONT_MAC(c0, c1, c2, a[11], a[13]);+	MONT_MAC(t0, t1, t2, a[12], a[12]);+	MONT_MUL(v0, v1, v2, u[0], m[24]);+	MONT_MUL(w0, w1, w2, u[1], m[23]);+	MONT_MAC(t0, t1, t2, u[2], m[22]);+	MONT_MAC(v0, v1, v2, u[3], m[21]);+	MONT_MAC(w0, w1, w2, u[4], m[20]);+	MONT_MAC(t0, t1, t2, u[5], m[19]);+	MONT_MAC(v0, v1, v2, u[6], m[18]);+	MONT_MAC(w0, w1, w2, u[7], m[17]);+	MONT_MAC(t0, t1, t2, u[8], m[16]);+	MONT_MAC(v0, v1, v2, u[9], m[15]);+	MONT_MAC(w0, w1, w2, u[10], m[14]);+	MONT_MAC(t0, t1, t2, u[11], m[13]);+	MONT_MAC(v0, v1, v2, u[12], m[12]);+	MONT_MAC(w0, w1, w2, u[13], m[11]);+	MONT_MAC(t0, t1, t2, u[14], m[10]);+	MONT_MAC(v0, v1, v2, u[15], m[9]);+	MONT_MAC(w0, w1, w2, u[16], m[8]);+	MONT_MAC(t0, t1, t2, u[17], m[7]);+	MONT_MAC(v0, v1, v2, u[18], m[6]);+	MONT_MAC(w0, w1, w2, u[19], m[5]);+	MONT_MAC(t0, t1, t2, u[20], m[4]);+	MONT_MAC(v0, v1, v2, u[21], m[3]);+	MONT_MAC(w0, w1, w2, u[22], m[2]);+	MONT_MAC(t0, t1, t2, u[23], m[1]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	MONT_ADD(s0, s1, s2, c0, c1, c2);+	MONT_DBL(s0, s1, s2);+	MONT_ADD(t0, t1, t2, s0, s1, s2);+	u[24] = t0 * n0;+	MONT_MAC(t0, t1, t2, u[24], m[0]);+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 25 */+	MONT_MUL(s0, s1, s2, a[0], a[25]);+	MONT_MUL(c0, c1, c2, a[1], a[24]);+	MONT_MAC(s0, s1, s2, a[2], a[23]);+	MONT_MAC(c0, c1, c2, a[3], a[22]);+	MONT_MAC(s0, s1, s2, a[4], a[21]);+	MONT_MAC(c0, c1, c2, a[5], a[20]);+	MONT_MAC(s0, s1, s2, a[6], a[19]);+	MONT_MAC(c0, c1, c2, a[7], a[18]);+	MONT_MAC(s0, s1, s2, a[8], a[17]);+	MONT_MAC(c0, c1, c2, a[9], a[16]);+	MONT_MAC(s0, s1, s2, a[10], a[15]);+	MONT_MAC(c0, c1, c2, a[11], a[14]);+	MONT_MAC(s0, s1, s2, a[12], a[13]);+	MONT_MAC(t0, t1, t2, u[0], m[25]);+	MONT_MUL(v0, v1, v2, u[1], m[24]);+	MONT_MUL(w0, w1, w2, u[2], m[23]);+	MONT_MAC(t0, t1, t2, u[3], m[22]);+	MONT_MAC(v0, v1, v2, u[4], m[21]);+	MONT_MAC(w0, w1, w2, u[5], m[20]);+	MONT_MAC(t0, t1, t2, u[6], m[19]);+	MONT_MAC(v0, v1, v2, u[7], m[18]);+	MONT_MAC(w0, w1, w2, u[8], m[17]);+	MONT_MAC(t0, t1, t2, u[9], m[16]);+	MONT_MAC(v0, v1, v2, u[10], m[15]);+	MONT_MAC(w0, w1, w2, u[11], m[14]);+	MONT_MAC(t0, t1, t2, u[12], m[13]);+	MONT_MAC(v0, v1, v2, u[13], m[12]);+	MONT_MAC(w0, w1, w2, u[14], m[11]);+	MONT_MAC(t0, t1, t2, u[15], m[10]);+	MONT_MAC(v0, v1, v2, u[16], m[9]);+	MONT_MAC(w0, w1, w2, u[17], m[8]);+	MONT_MAC(t0, t1, t2, u[18], m[7]);+	MONT_MAC(v0, v1, v2, u[19], m[6]);+	MONT_MAC(w0, w1, w2, u[20], m[5]);+	MONT_MAC(t0, t1, t2, u[21], m[4]);+	MONT_MAC(v0, v1, v2, u[22], m[3]);+	MONT_MAC(w0, w1, w2, u[23], m[2]);+	MONT_MAC(t0, t1, t2, u[24], m[1]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	MONT_ADD(s0, s1, s2, c0, c1, c2);+	MONT_DBL(s0, s1, s2);+	MONT_ADD(t0, t1, t2, s0, s1, s2);+	u[25] = t0 * n0;+	MONT_MAC(t0, t1, t2, u[25], m[0]);+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 26 */+	MONT_MUL(s0, s1, s2, a[0], a[26]);+	MONT_MUL(c0, c1, c2, a[1], a[25]);+	MONT_MAC(s0, s1, s2, a[2], a[24]);+	MONT_MAC(c0, c1, c2, a[3], a[23]);+	MONT_MAC(s0, s1, s2, a[4], a[22]);+	MONT_MAC(c0, c1, c2, a[5], a[21]);+	MONT_MAC(s0, s1, s2, a[6], a[20]);+	MONT_MAC(c0, c1, c2, a[7], a[19]);+	MONT_MAC(s0, s1, s2, a[8], a[18]);+	MONT_MAC(c0, c1, c2, a[9], a[17]);+	MONT_MAC(s0, s1, s2, a[10], a[16]);+	MONT_MAC(c0, c1, c2, a[11], a[15]);+	MONT_MAC(s0, s1, s2, a[12], a[14]);+	MONT_MAC(t0, t1, t2, a[13], a[13]);+	MONT_MUL(v0, v1, v2, u[0], m[26]);+	MONT_MUL(w0, w1, w2, u[1], m[25]);+	MONT_MAC(t0, t1, t2, u[2], m[24]);+	MONT_MAC(v0, v1, v2, u[3], m[23]);+	MONT_MAC(w0, w1, w2, u[4], m[22]);+	MONT_MAC(t0, t1, t2, u[5], m[21]);+	MONT_MAC(v0, v1, v2, u[6], m[20]);+	MONT_MAC(w0, w1, w2, u[7], m[19]);+	MONT_MAC(t0, t1, t2, u[8], m[18]);+	MONT_MAC(v0, v1, v2, u[9], m[17]);+	MONT_MAC(w0, w1, w2, u[10], m[16]);+	MONT_MAC(t0, t1, t2, u[11], m[15]);+	MONT_MAC(v0, v1, v2, u[12], m[14]);+	MONT_MAC(w0, w1, w2, u[13], m[13]);+	MONT_MAC(t0, t1, t2, u[14], m[12]);+	MONT_MAC(v0, v1, v2, u[15], m[11]);+	MONT_MAC(w0, w1, w2, u[16], m[10]);+	MONT_MAC(t0, t1, t2, u[17], m[9]);+	MONT_MAC(v0, v1, v2, u[18], m[8]);+	MONT_MAC(w0, w1, w2, u[19], m[7]);+	MONT_MAC(t0, t1, t2, u[20], m[6]);+	MONT_MAC(v0, v1, v2, u[21], m[5]);+	MONT_MAC(w0, w1, w2, u[22], m[4]);+	MONT_MAC(t0, t1, t2, u[23], m[3]);+	MONT_MAC(v0, v1, v2, u[24], m[2]);+	MONT_MAC(w0, w1, w2, u[25], m[1]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	MONT_ADD(s0, s1, s2, c0, c1, c2);+	MONT_DBL(s0, s1, s2);+	MONT_ADD(t0, t1, t2, s0, s1, s2);+	u[26] = t0 * n0;+	MONT_MAC(t0, t1, t2, u[26], m[0]);+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 27 */+	MONT_MUL(s0, s1, s2, a[0], a[27]);+	MONT_MUL(c0, c1, c2, a[1], a[26]);+	MONT_MAC(s0, s1, s2, a[2], a[25]);+	MONT_MAC(c0, c1, c2, a[3], a[24]);+	MONT_MAC(s0, s1, s2, a[4], a[23]);+	MONT_MAC(c0, c1, c2, a[5], a[22]);+	MONT_MAC(s0, s1, s2, a[6], a[21]);+	MONT_MAC(c0, c1, c2, a[7], a[20]);+	MONT_MAC(s0, s1, s2, a[8], a[19]);+	MONT_MAC(c0, c1, c2, a[9], a[18]);+	MONT_MAC(s0, s1, s2, a[10], a[17]);+	MONT_MAC(c0, c1, c2, a[11], a[16]);+	MONT_MAC(s0, s1, s2, a[12], a[15]);+	MONT_MAC(c0, c1, c2, a[13], a[14]);+	MONT_MAC(t0, t1, t2, u[0], m[27]);+	MONT_MUL(v0, v1, v2, u[1], m[26]);+	MONT_MUL(w0, w1, w2, u[2], m[25]);+	MONT_MAC(t0, t1, t2, u[3], m[24]);+	MONT_MAC(v0, v1, v2, u[4], m[23]);+	MONT_MAC(w0, w1, w2, u[5], m[22]);+	MONT_MAC(t0, t1, t2, u[6], m[21]);+	MONT_MAC(v0, v1, v2, u[7], m[20]);+	MONT_MAC(w0, w1, w2, u[8], m[19]);+	MONT_MAC(t0, t1, t2, u[9], m[18]);+	MONT_MAC(v0, v1, v2, u[10], m[17]);+	MONT_MAC(w0, w1, w2, u[11], m[16]);+	MONT_MAC(t0, t1, t2, u[12], m[15]);+	MONT_MAC(v0, v1, v2, u[13], m[14]);+	MONT_MAC(w0, w1, w2, u[14], m[13]);+	MONT_MAC(t0, t1, t2, u[15], m[12]);+	MONT_MAC(v0, v1, v2, u[16], m[11]);+	MONT_MAC(w0, w1, w2, u[17], m[10]);+	MONT_MAC(t0, t1, t2, u[18], m[9]);+	MONT_MAC(v0, v1, v2, u[19], m[8]);+	MONT_MAC(w0, w1, w2, u[20], m[7]);+	MONT_MAC(t0, t1, t2, u[21], m[6]);+	MONT_MAC(v0, v1, v2, u[22], m[5]);+	MONT_MAC(w0, w1, w2, u[23], m[4]);+	MONT_MAC(t0, t1, t2, u[24], m[3]);+	MONT_MAC(v0, v1, v2, u[25], m[2]);+	MONT_MAC(w0, w1, w2, u[26], m[1]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	MONT_ADD(s0, s1, s2, c0, c1, c2);+	MONT_DBL(s0, s1, s2);+	MONT_ADD(t0, t1, t2, s0, s1, s2);+	u[27] = t0 * n0;+	MONT_MAC(t0, t1, t2, u[27], m[0]);+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 28 */+	MONT_MUL(s0, s1, s2, a[0], a[28]);+	MONT_MUL(c0, c1, c2, a[1], a[27]);+	MONT_MAC(s0, s1, s2, a[2], a[26]);+	MONT_MAC(c0, c1, c2, a[3], a[25]);+	MONT_MAC(s0, s1, s2, a[4], a[24]);+	MONT_MAC(c0, c1, c2, a[5], a[23]);+	MONT_MAC(s0, s1, s2, a[6], a[22]);+	MONT_MAC(c0, c1, c2, a[7], a[21]);+	MONT_MAC(s0, s1, s2, a[8], a[20]);+	MONT_MAC(c0, c1, c2, a[9], a[19]);+	MONT_MAC(s0, s1, s2, a[10], a[18]);+	MONT_MAC(c0, c1, c2, a[11], a[17]);+	MONT_MAC(s0, s1, s2, a[12], a[16]);+	MONT_MAC(c0, c1, c2, a[13], a[15]);+	MONT_MAC(t0, t1, t2, a[14], a[14]);+	MONT_MUL(v0, v1, v2, u[0], m[28]);+	MONT_MUL(w0, w1, w2, u[1], m[27]);+	MONT_MAC(t0, t1, t2, u[2], m[26]);+	MONT_MAC(v0, v1, v2, u[3], m[25]);+	MONT_MAC(w0, w1, w2, u[4], m[24]);+	MONT_MAC(t0, t1, t2, u[5], m[23]);+	MONT_MAC(v0, v1, v2, u[6], m[22]);+	MONT_MAC(w0, w1, w2, u[7], m[21]);+	MONT_MAC(t0, t1, t2, u[8], m[20]);+	MONT_MAC(v0, v1, v2, u[9], m[19]);+	MONT_MAC(w0, w1, w2, u[10], m[18]);+	MONT_MAC(t0, t1, t2, u[11], m[17]);+	MONT_MAC(v0, v1, v2, u[12], m[16]);+	MONT_MAC(w0, w1, w2, u[13], m[15]);+	MONT_MAC(t0, t1, t2, u[14], m[14]);+	MONT_MAC(v0, v1, v2, u[15], m[13]);+	MONT_MAC(w0, w1, w2, u[16], m[12]);+	MONT_MAC(t0, t1, t2, u[17], m[11]);+	MONT_MAC(v0, v1, v2, u[18], m[10]);+	MONT_MAC(w0, w1, w2, u[19], m[9]);+	MONT_MAC(t0, t1, t2, u[20], m[8]);+	MONT_MAC(v0, v1, v2, u[21], m[7]);+	MONT_MAC(w0, w1, w2, u[22], m[6]);+	MONT_MAC(t0, t1, t2, u[23], m[5]);+	MONT_MAC(v0, v1, v2, u[24], m[4]);+	MONT_MAC(w0, w1, w2, u[25], m[3]);+	MONT_MAC(t0, t1, t2, u[26], m[2]);+	MONT_MAC(v0, v1, v2, u[27], m[1]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	MONT_ADD(s0, s1, s2, c0, c1, c2);+	MONT_DBL(s0, s1, s2);+	MONT_ADD(t0, t1, t2, s0, s1, s2);+	u[28] = t0 * n0;+	MONT_MAC(t0, t1, t2, u[28], m[0]);+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 29 */+	MONT_MUL(s0, s1, s2, a[0], a[29]);+	MONT_MUL(c0, c1, c2, a[1], a[28]);+	MONT_MAC(s0, s1, s2, a[2], a[27]);+	MONT_MAC(c0, c1, c2, a[3], a[26]);+	MONT_MAC(s0, s1, s2, a[4], a[25]);+	MONT_MAC(c0, c1, c2, a[5], a[24]);+	MONT_MAC(s0, s1, s2, a[6], a[23]);+	MONT_MAC(c0, c1, c2, a[7], a[22]);+	MONT_MAC(s0, s1, s2, a[8], a[21]);+	MONT_MAC(c0, c1, c2, a[9], a[20]);+	MONT_MAC(s0, s1, s2, a[10], a[19]);+	MONT_MAC(c0, c1, c2, a[11], a[18]);+	MONT_MAC(s0, s1, s2, a[12], a[17]);+	MONT_MAC(c0, c1, c2, a[13], a[16]);+	MONT_MAC(s0, s1, s2, a[14], a[15]);+	MONT_MAC(t0, t1, t2, u[0], m[29]);+	MONT_MUL(v0, v1, v2, u[1], m[28]);+	MONT_MUL(w0, w1, w2, u[2], m[27]);+	MONT_MAC(t0, t1, t2, u[3], m[26]);+	MONT_MAC(v0, v1, v2, u[4], m[25]);+	MONT_MAC(w0, w1, w2, u[5], m[24]);+	MONT_MAC(t0, t1, t2, u[6], m[23]);+	MONT_MAC(v0, v1, v2, u[7], m[22]);+	MONT_MAC(w0, w1, w2, u[8], m[21]);+	MONT_MAC(t0, t1, t2, u[9], m[20]);+	MONT_MAC(v0, v1, v2, u[10], m[19]);+	MONT_MAC(w0, w1, w2, u[11], m[18]);+	MONT_MAC(t0, t1, t2, u[12], m[17]);+	MONT_MAC(v0, v1, v2, u[13], m[16]);+	MONT_MAC(w0, w1, w2, u[14], m[15]);+	MONT_MAC(t0, t1, t2, u[15], m[14]);+	MONT_MAC(v0, v1, v2, u[16], m[13]);+	MONT_MAC(w0, w1, w2, u[17], m[12]);+	MONT_MAC(t0, t1, t2, u[18], m[11]);+	MONT_MAC(v0, v1, v2, u[19], m[10]);+	MONT_MAC(w0, w1, w2, u[20], m[9]);+	MONT_MAC(t0, t1, t2, u[21], m[8]);+	MONT_MAC(v0, v1, v2, u[22], m[7]);+	MONT_MAC(w0, w1, w2, u[23], m[6]);+	MONT_MAC(t0, t1, t2, u[24], m[5]);+	MONT_MAC(v0, v1, v2, u[25], m[4]);+	MONT_MAC(w0, w1, w2, u[26], m[3]);+	MONT_MAC(t0, t1, t2, u[27], m[2]);+	MONT_MAC(v0, v1, v2, u[28], m[1]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	MONT_ADD(s0, s1, s2, c0, c1, c2);+	MONT_DBL(s0, s1, s2);+	MONT_ADD(t0, t1, t2, s0, s1, s2);+	u[29] = t0 * n0;+	MONT_MAC(t0, t1, t2, u[29], m[0]);+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 30 */+	MONT_MUL(s0, s1, s2, a[0], a[30]);+	MONT_MUL(c0, c1, c2, a[1], a[29]);+	MONT_MAC(s0, s1, s2, a[2], a[28]);+	MONT_MAC(c0, c1, c2, a[3], a[27]);+	MONT_MAC(s0, s1, s2, a[4], a[26]);+	MONT_MAC(c0, c1, c2, a[5], a[25]);+	MONT_MAC(s0, s1, s2, a[6], a[24]);+	MONT_MAC(c0, c1, c2, a[7], a[23]);+	MONT_MAC(s0, s1, s2, a[8], a[22]);+	MONT_MAC(c0, c1, c2, a[9], a[21]);+	MONT_MAC(s0, s1, s2, a[10], a[20]);+	MONT_MAC(c0, c1, c2, a[11], a[19]);+	MONT_MAC(s0, s1, s2, a[12], a[18]);+	MONT_MAC(c0, c1, c2, a[13], a[17]);+	MONT_MAC(s0, s1, s2, a[14], a[16]);+	MONT_MAC(t0, t1, t2, a[15], a[15]);+	MONT_MUL(v0, v1, v2, u[0], m[30]);+	MONT_MUL(w0, w1, w2, u[1], m[29]);+	MONT_MAC(t0, t1, t2, u[2], m[28]);+	MONT_MAC(v0, v1, v2, u[3], m[27]);+	MONT_MAC(w0, w1, w2, u[4], m[26]);+	MONT_MAC(t0, t1, t2, u[5], m[25]);+	MONT_MAC(v0, v1, v2, u[6], m[24]);+	MONT_MAC(w0, w1, w2, u[7], m[23]);+	MONT_MAC(t0, t1, t2, u[8], m[22]);+	MONT_MAC(v0, v1, v2, u[9], m[21]);+	MONT_MAC(w0, w1, w2, u[10], m[20]);+	MONT_MAC(t0, t1, t2, u[11], m[19]);+	MONT_MAC(v0, v1, v2, u[12], m[18]);+	MONT_MAC(w0, w1, w2, u[13], m[17]);+	MONT_MAC(t0, t1, t2, u[14], m[16]);+	MONT_MAC(v0, v1, v2, u[15], m[15]);+	MONT_MAC(w0, w1, w2, u[16], m[14]);+	MONT_MAC(t0, t1, t2, u[17], m[13]);+	MONT_MAC(v0, v1, v2, u[18], m[12]);+	MONT_MAC(w0, w1, w2, u[19], m[11]);+	MONT_MAC(t0, t1, t2, u[20], m[10]);+	MONT_MAC(v0, v1, v2, u[21], m[9]);+	MONT_MAC(w0, w1, w2, u[22], m[8]);+	MONT_MAC(t0, t1, t2, u[23], m[7]);+	MONT_MAC(v0, v1, v2, u[24], m[6]);+	MONT_MAC(w0, w1, w2, u[25], m[5]);+	MONT_MAC(t0, t1, t2, u[26], m[4]);+	MONT_MAC(v0, v1, v2, u[27], m[3]);+	MONT_MAC(w0, w1, w2, u[28], m[2]);+	MONT_MAC(t0, t1, t2, u[29], m[1]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	MONT_ADD(s0, s1, s2, c0, c1, c2);+	MONT_DBL(s0, s1, s2);+	MONT_ADD(t0, t1, t2, s0, s1, s2);+	u[30] = t0 * n0;+	MONT_MAC(t0, t1, t2, u[30], m[0]);+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 31 */+	MONT_MUL(s0, s1, s2, a[0], a[31]);+	MONT_MUL(c0, c1, c2, a[1], a[30]);+	MONT_MAC(s0, s1, s2, a[2], a[29]);+	MONT_MAC(c0, c1, c2, a[3], a[28]);+	MONT_MAC(s0, s1, s2, a[4], a[27]);+	MONT_MAC(c0, c1, c2, a[5], a[26]);+	MONT_MAC(s0, s1, s2, a[6], a[25]);+	MONT_MAC(c0, c1, c2, a[7], a[24]);+	MONT_MAC(s0, s1, s2, a[8], a[23]);+	MONT_MAC(c0, c1, c2, a[9], a[22]);+	MONT_MAC(s0, s1, s2, a[10], a[21]);+	MONT_MAC(c0, c1, c2, a[11], a[20]);+	MONT_MAC(s0, s1, s2, a[12], a[19]);+	MONT_MAC(c0, c1, c2, a[13], a[18]);+	MONT_MAC(s0, s1, s2, a[14], a[17]);+	MONT_MAC(c0, c1, c2, a[15], a[16]);+	MONT_MAC(t0, t1, t2, u[0], m[31]);+	MONT_MUL(v0, v1, v2, u[1], m[30]);+	MONT_MUL(w0, w1, w2, u[2], m[29]);+	MONT_MAC(t0, t1, t2, u[3], m[28]);+	MONT_MAC(v0, v1, v2, u[4], m[27]);+	MONT_MAC(w0, w1, w2, u[5], m[26]);+	MONT_MAC(t0, t1, t2, u[6], m[25]);+	MONT_MAC(v0, v1, v2, u[7], m[24]);+	MONT_MAC(w0, w1, w2, u[8], m[23]);+	MONT_MAC(t0, t1, t2, u[9], m[22]);+	MONT_MAC(v0, v1, v2, u[10], m[21]);+	MONT_MAC(w0, w1, w2, u[11], m[20]);+	MONT_MAC(t0, t1, t2, u[12], m[19]);+	MONT_MAC(v0, v1, v2, u[13], m[18]);+	MONT_MAC(w0, w1, w2, u[14], m[17]);+	MONT_MAC(t0, t1, t2, u[15], m[16]);+	MONT_MAC(v0, v1, v2, u[16], m[15]);+	MONT_MAC(w0, w1, w2, u[17], m[14]);+	MONT_MAC(t0, t1, t2, u[18], m[13]);+	MONT_MAC(v0, v1, v2, u[19], m[12]);+	MONT_MAC(w0, w1, w2, u[20], m[11]);+	MONT_MAC(t0, t1, t2, u[21], m[10]);+	MONT_MAC(v0, v1, v2, u[22], m[9]);+	MONT_MAC(w0, w1, w2, u[23], m[8]);+	MONT_MAC(t0, t1, t2, u[24], m[7]);+	MONT_MAC(v0, v1, v2, u[25], m[6]);+	MONT_MAC(w0, w1, w2, u[26], m[5]);+	MONT_MAC(t0, t1, t2, u[27], m[4]);+	MONT_MAC(v0, v1, v2, u[28], m[3]);+	MONT_MAC(w0, w1, w2, u[29], m[2]);+	MONT_MAC(t0, t1, t2, u[30], m[1]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	MONT_ADD(s0, s1, s2, c0, c1, c2);+	MONT_DBL(s0, s1, s2);+	MONT_ADD(t0, t1, t2, s0, s1, s2);+	u[31] = t0 * n0;+	MONT_MAC(t0, t1, t2, u[31], m[0]);+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 32 */+	MONT_MUL(s0, s1, s2, a[1], a[31]);+	MONT_MUL(c0, c1, c2, a[2], a[30]);+	MONT_MAC(s0, s1, s2, a[3], a[29]);+	MONT_MAC(c0, c1, c2, a[4], a[28]);+	MONT_MAC(s0, s1, s2, a[5], a[27]);+	MONT_MAC(c0, c1, c2, a[6], a[26]);+	MONT_MAC(s0, s1, s2, a[7], a[25]);+	MONT_MAC(c0, c1, c2, a[8], a[24]);+	MONT_MAC(s0, s1, s2, a[9], a[23]);+	MONT_MAC(c0, c1, c2, a[10], a[22]);+	MONT_MAC(s0, s1, s2, a[11], a[21]);+	MONT_MAC(c0, c1, c2, a[12], a[20]);+	MONT_MAC(s0, s1, s2, a[13], a[19]);+	MONT_MAC(c0, c1, c2, a[14], a[18]);+	MONT_MAC(s0, s1, s2, a[15], a[17]);+	MONT_MAC(t0, t1, t2, a[16], a[16]);+	MONT_MUL(v0, v1, v2, u[1], m[31]);+	MONT_MUL(w0, w1, w2, u[2], m[30]);+	MONT_MAC(t0, t1, t2, u[3], m[29]);+	MONT_MAC(v0, v1, v2, u[4], m[28]);+	MONT_MAC(w0, w1, w2, u[5], m[27]);+	MONT_MAC(t0, t1, t2, u[6], m[26]);+	MONT_MAC(v0, v1, v2, u[7], m[25]);+	MONT_MAC(w0, w1, w2, u[8], m[24]);+	MONT_MAC(t0, t1, t2, u[9], m[23]);+	MONT_MAC(v0, v1, v2, u[10], m[22]);+	MONT_MAC(w0, w1, w2, u[11], m[21]);+	MONT_MAC(t0, t1, t2, u[12], m[20]);+	MONT_MAC(v0, v1, v2, u[13], m[19]);+	MONT_MAC(w0, w1, w2, u[14], m[18]);+	MONT_MAC(t0, t1, t2, u[15], m[17]);+	MONT_MAC(v0, v1, v2, u[16], m[16]);+	MONT_MAC(w0, w1, w2, u[17], m[15]);+	MONT_MAC(t0, t1, t2, u[18], m[14]);+	MONT_MAC(v0, v1, v2, u[19], m[13]);+	MONT_MAC(w0, w1, w2, u[20], m[12]);+	MONT_MAC(t0, t1, t2, u[21], m[11]);+	MONT_MAC(v0, v1, v2, u[22], m[10]);+	MONT_MAC(w0, w1, w2, u[23], m[9]);+	MONT_MAC(t0, t1, t2, u[24], m[8]);+	MONT_MAC(v0, v1, v2, u[25], m[7]);+	MONT_MAC(w0, w1, w2, u[26], m[6]);+	MONT_MAC(t0, t1, t2, u[27], m[5]);+	MONT_MAC(v0, v1, v2, u[28], m[4]);+	MONT_MAC(w0, w1, w2, u[29], m[3]);+	MONT_MAC(t0, t1, t2, u[30], m[2]);+	MONT_MAC(v0, v1, v2, u[31], m[1]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	MONT_ADD(s0, s1, s2, c0, c1, c2);+	MONT_DBL(s0, s1, s2);+	MONT_ADD(t0, t1, t2, s0, s1, s2);+	z[0] = t0;+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 33 */+	MONT_MUL(s0, s1, s2, a[2], a[31]);+	MONT_MUL(c0, c1, c2, a[3], a[30]);+	MONT_MAC(s0, s1, s2, a[4], a[29]);+	MONT_MAC(c0, c1, c2, a[5], a[28]);+	MONT_MAC(s0, s1, s2, a[6], a[27]);+	MONT_MAC(c0, c1, c2, a[7], a[26]);+	MONT_MAC(s0, s1, s2, a[8], a[25]);+	MONT_MAC(c0, c1, c2, a[9], a[24]);+	MONT_MAC(s0, s1, s2, a[10], a[23]);+	MONT_MAC(c0, c1, c2, a[11], a[22]);+	MONT_MAC(s0, s1, s2, a[12], a[21]);+	MONT_MAC(c0, c1, c2, a[13], a[20]);+	MONT_MAC(s0, s1, s2, a[14], a[19]);+	MONT_MAC(c0, c1, c2, a[15], a[18]);+	MONT_MAC(s0, s1, s2, a[16], a[17]);+	MONT_MAC(t0, t1, t2, u[2], m[31]);+	MONT_MUL(v0, v1, v2, u[3], m[30]);+	MONT_MUL(w0, w1, w2, u[4], m[29]);+	MONT_MAC(t0, t1, t2, u[5], m[28]);+	MONT_MAC(v0, v1, v2, u[6], m[27]);+	MONT_MAC(w0, w1, w2, u[7], m[26]);+	MONT_MAC(t0, t1, t2, u[8], m[25]);+	MONT_MAC(v0, v1, v2, u[9], m[24]);+	MONT_MAC(w0, w1, w2, u[10], m[23]);+	MONT_MAC(t0, t1, t2, u[11], m[22]);+	MONT_MAC(v0, v1, v2, u[12], m[21]);+	MONT_MAC(w0, w1, w2, u[13], m[20]);+	MONT_MAC(t0, t1, t2, u[14], m[19]);+	MONT_MAC(v0, v1, v2, u[15], m[18]);+	MONT_MAC(w0, w1, w2, u[16], m[17]);+	MONT_MAC(t0, t1, t2, u[17], m[16]);+	MONT_MAC(v0, v1, v2, u[18], m[15]);+	MONT_MAC(w0, w1, w2, u[19], m[14]);+	MONT_MAC(t0, t1, t2, u[20], m[13]);+	MONT_MAC(v0, v1, v2, u[21], m[12]);+	MONT_MAC(w0, w1, w2, u[22], m[11]);+	MONT_MAC(t0, t1, t2, u[23], m[10]);+	MONT_MAC(v0, v1, v2, u[24], m[9]);+	MONT_MAC(w0, w1, w2, u[25], m[8]);+	MONT_MAC(t0, t1, t2, u[26], m[7]);+	MONT_MAC(v0, v1, v2, u[27], m[6]);+	MONT_MAC(w0, w1, w2, u[28], m[5]);+	MONT_MAC(t0, t1, t2, u[29], m[4]);+	MONT_MAC(v0, v1, v2, u[30], m[3]);+	MONT_MAC(w0, w1, w2, u[31], m[2]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	MONT_ADD(s0, s1, s2, c0, c1, c2);+	MONT_DBL(s0, s1, s2);+	MONT_ADD(t0, t1, t2, s0, s1, s2);+	z[1] = t0;+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 34 */+	MONT_MUL(s0, s1, s2, a[3], a[31]);+	MONT_MUL(c0, c1, c2, a[4], a[30]);+	MONT_MAC(s0, s1, s2, a[5], a[29]);+	MONT_MAC(c0, c1, c2, a[6], a[28]);+	MONT_MAC(s0, s1, s2, a[7], a[27]);+	MONT_MAC(c0, c1, c2, a[8], a[26]);+	MONT_MAC(s0, s1, s2, a[9], a[25]);+	MONT_MAC(c0, c1, c2, a[10], a[24]);+	MONT_MAC(s0, s1, s2, a[11], a[23]);+	MONT_MAC(c0, c1, c2, a[12], a[22]);+	MONT_MAC(s0, s1, s2, a[13], a[21]);+	MONT_MAC(c0, c1, c2, a[14], a[20]);+	MONT_MAC(s0, s1, s2, a[15], a[19]);+	MONT_MAC(c0, c1, c2, a[16], a[18]);+	MONT_MAC(t0, t1, t2, a[17], a[17]);+	MONT_MUL(v0, v1, v2, u[3], m[31]);+	MONT_MUL(w0, w1, w2, u[4], m[30]);+	MONT_MAC(t0, t1, t2, u[5], m[29]);+	MONT_MAC(v0, v1, v2, u[6], m[28]);+	MONT_MAC(w0, w1, w2, u[7], m[27]);+	MONT_MAC(t0, t1, t2, u[8], m[26]);+	MONT_MAC(v0, v1, v2, u[9], m[25]);+	MONT_MAC(w0, w1, w2, u[10], m[24]);+	MONT_MAC(t0, t1, t2, u[11], m[23]);+	MONT_MAC(v0, v1, v2, u[12], m[22]);+	MONT_MAC(w0, w1, w2, u[13], m[21]);+	MONT_MAC(t0, t1, t2, u[14], m[20]);+	MONT_MAC(v0, v1, v2, u[15], m[19]);+	MONT_MAC(w0, w1, w2, u[16], m[18]);+	MONT_MAC(t0, t1, t2, u[17], m[17]);+	MONT_MAC(v0, v1, v2, u[18], m[16]);+	MONT_MAC(w0, w1, w2, u[19], m[15]);+	MONT_MAC(t0, t1, t2, u[20], m[14]);+	MONT_MAC(v0, v1, v2, u[21], m[13]);+	MONT_MAC(w0, w1, w2, u[22], m[12]);+	MONT_MAC(t0, t1, t2, u[23], m[11]);+	MONT_MAC(v0, v1, v2, u[24], m[10]);+	MONT_MAC(w0, w1, w2, u[25], m[9]);+	MONT_MAC(t0, t1, t2, u[26], m[8]);+	MONT_MAC(v0, v1, v2, u[27], m[7]);+	MONT_MAC(w0, w1, w2, u[28], m[6]);+	MONT_MAC(t0, t1, t2, u[29], m[5]);+	MONT_MAC(v0, v1, v2, u[30], m[4]);+	MONT_MAC(w0, w1, w2, u[31], m[3]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	MONT_ADD(s0, s1, s2, c0, c1, c2);+	MONT_DBL(s0, s1, s2);+	MONT_ADD(t0, t1, t2, s0, s1, s2);+	z[2] = t0;+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 35 */+	MONT_MUL(s0, s1, s2, a[4], a[31]);+	MONT_MUL(c0, c1, c2, a[5], a[30]);+	MONT_MAC(s0, s1, s2, a[6], a[29]);+	MONT_MAC(c0, c1, c2, a[7], a[28]);+	MONT_MAC(s0, s1, s2, a[8], a[27]);+	MONT_MAC(c0, c1, c2, a[9], a[26]);+	MONT_MAC(s0, s1, s2, a[10], a[25]);+	MONT_MAC(c0, c1, c2, a[11], a[24]);+	MONT_MAC(s0, s1, s2, a[12], a[23]);+	MONT_MAC(c0, c1, c2, a[13], a[22]);+	MONT_MAC(s0, s1, s2, a[14], a[21]);+	MONT_MAC(c0, c1, c2, a[15], a[20]);+	MONT_MAC(s0, s1, s2, a[16], a[19]);+	MONT_MAC(c0, c1, c2, a[17], a[18]);+	MONT_MAC(t0, t1, t2, u[4], m[31]);+	MONT_MUL(v0, v1, v2, u[5], m[30]);+	MONT_MUL(w0, w1, w2, u[6], m[29]);+	MONT_MAC(t0, t1, t2, u[7], m[28]);+	MONT_MAC(v0, v1, v2, u[8], m[27]);+	MONT_MAC(w0, w1, w2, u[9], m[26]);+	MONT_MAC(t0, t1, t2, u[10], m[25]);+	MONT_MAC(v0, v1, v2, u[11], m[24]);+	MONT_MAC(w0, w1, w2, u[12], m[23]);+	MONT_MAC(t0, t1, t2, u[13], m[22]);+	MONT_MAC(v0, v1, v2, u[14], m[21]);+	MONT_MAC(w0, w1, w2, u[15], m[20]);+	MONT_MAC(t0, t1, t2, u[16], m[19]);+	MONT_MAC(v0, v1, v2, u[17], m[18]);+	MONT_MAC(w0, w1, w2, u[18], m[17]);+	MONT_MAC(t0, t1, t2, u[19], m[16]);+	MONT_MAC(v0, v1, v2, u[20], m[15]);+	MONT_MAC(w0, w1, w2, u[21], m[14]);+	MONT_MAC(t0, t1, t2, u[22], m[13]);+	MONT_MAC(v0, v1, v2, u[23], m[12]);+	MONT_MAC(w0, w1, w2, u[24], m[11]);+	MONT_MAC(t0, t1, t2, u[25], m[10]);+	MONT_MAC(v0, v1, v2, u[26], m[9]);+	MONT_MAC(w0, w1, w2, u[27], m[8]);+	MONT_MAC(t0, t1, t2, u[28], m[7]);+	MONT_MAC(v0, v1, v2, u[29], m[6]);+	MONT_MAC(w0, w1, w2, u[30], m[5]);+	MONT_MAC(t0, t1, t2, u[31], m[4]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	MONT_ADD(s0, s1, s2, c0, c1, c2);+	MONT_DBL(s0, s1, s2);+	MONT_ADD(t0, t1, t2, s0, s1, s2);+	z[3] = t0;+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 36 */+	MONT_MUL(s0, s1, s2, a[5], a[31]);+	MONT_MUL(c0, c1, c2, a[6], a[30]);+	MONT_MAC(s0, s1, s2, a[7], a[29]);+	MONT_MAC(c0, c1, c2, a[8], a[28]);+	MONT_MAC(s0, s1, s2, a[9], a[27]);+	MONT_MAC(c0, c1, c2, a[10], a[26]);+	MONT_MAC(s0, s1, s2, a[11], a[25]);+	MONT_MAC(c0, c1, c2, a[12], a[24]);+	MONT_MAC(s0, s1, s2, a[13], a[23]);+	MONT_MAC(c0, c1, c2, a[14], a[22]);+	MONT_MAC(s0, s1, s2, a[15], a[21]);+	MONT_MAC(c0, c1, c2, a[16], a[20]);+	MONT_MAC(s0, s1, s2, a[17], a[19]);+	MONT_MAC(t0, t1, t2, a[18], a[18]);+	MONT_MUL(v0, v1, v2, u[5], m[31]);+	MONT_MUL(w0, w1, w2, u[6], m[30]);+	MONT_MAC(t0, t1, t2, u[7], m[29]);+	MONT_MAC(v0, v1, v2, u[8], m[28]);+	MONT_MAC(w0, w1, w2, u[9], m[27]);+	MONT_MAC(t0, t1, t2, u[10], m[26]);+	MONT_MAC(v0, v1, v2, u[11], m[25]);+	MONT_MAC(w0, w1, w2, u[12], m[24]);+	MONT_MAC(t0, t1, t2, u[13], m[23]);+	MONT_MAC(v0, v1, v2, u[14], m[22]);+	MONT_MAC(w0, w1, w2, u[15], m[21]);+	MONT_MAC(t0, t1, t2, u[16], m[20]);+	MONT_MAC(v0, v1, v2, u[17], m[19]);+	MONT_MAC(w0, w1, w2, u[18], m[18]);+	MONT_MAC(t0, t1, t2, u[19], m[17]);+	MONT_MAC(v0, v1, v2, u[20], m[16]);+	MONT_MAC(w0, w1, w2, u[21], m[15]);+	MONT_MAC(t0, t1, t2, u[22], m[14]);+	MONT_MAC(v0, v1, v2, u[23], m[13]);+	MONT_MAC(w0, w1, w2, u[24], m[12]);+	MONT_MAC(t0, t1, t2, u[25], m[11]);+	MONT_MAC(v0, v1, v2, u[26], m[10]);+	MONT_MAC(w0, w1, w2, u[27], m[9]);+	MONT_MAC(t0, t1, t2, u[28], m[8]);+	MONT_MAC(v0, v1, v2, u[29], m[7]);+	MONT_MAC(w0, w1, w2, u[30], m[6]);+	MONT_MAC(t0, t1, t2, u[31], m[5]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	MONT_ADD(s0, s1, s2, c0, c1, c2);+	MONT_DBL(s0, s1, s2);+	MONT_ADD(t0, t1, t2, s0, s1, s2);+	z[4] = t0;+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 37 */+	MONT_MUL(s0, s1, s2, a[6], a[31]);+	MONT_MUL(c0, c1, c2, a[7], a[30]);+	MONT_MAC(s0, s1, s2, a[8], a[29]);+	MONT_MAC(c0, c1, c2, a[9], a[28]);+	MONT_MAC(s0, s1, s2, a[10], a[27]);+	MONT_MAC(c0, c1, c2, a[11], a[26]);+	MONT_MAC(s0, s1, s2, a[12], a[25]);+	MONT_MAC(c0, c1, c2, a[13], a[24]);+	MONT_MAC(s0, s1, s2, a[14], a[23]);+	MONT_MAC(c0, c1, c2, a[15], a[22]);+	MONT_MAC(s0, s1, s2, a[16], a[21]);+	MONT_MAC(c0, c1, c2, a[17], a[20]);+	MONT_MAC(s0, s1, s2, a[18], a[19]);+	MONT_MAC(t0, t1, t2, u[6], m[31]);+	MONT_MUL(v0, v1, v2, u[7], m[30]);+	MONT_MUL(w0, w1, w2, u[8], m[29]);+	MONT_MAC(t0, t1, t2, u[9], m[28]);+	MONT_MAC(v0, v1, v2, u[10], m[27]);+	MONT_MAC(w0, w1, w2, u[11], m[26]);+	MONT_MAC(t0, t1, t2, u[12], m[25]);+	MONT_MAC(v0, v1, v2, u[13], m[24]);+	MONT_MAC(w0, w1, w2, u[14], m[23]);+	MONT_MAC(t0, t1, t2, u[15], m[22]);+	MONT_MAC(v0, v1, v2, u[16], m[21]);+	MONT_MAC(w0, w1, w2, u[17], m[20]);+	MONT_MAC(t0, t1, t2, u[18], m[19]);+	MONT_MAC(v0, v1, v2, u[19], m[18]);+	MONT_MAC(w0, w1, w2, u[20], m[17]);+	MONT_MAC(t0, t1, t2, u[21], m[16]);+	MONT_MAC(v0, v1, v2, u[22], m[15]);+	MONT_MAC(w0, w1, w2, u[23], m[14]);+	MONT_MAC(t0, t1, t2, u[24], m[13]);+	MONT_MAC(v0, v1, v2, u[25], m[12]);+	MONT_MAC(w0, w1, w2, u[26], m[11]);+	MONT_MAC(t0, t1, t2, u[27], m[10]);+	MONT_MAC(v0, v1, v2, u[28], m[9]);+	MONT_MAC(w0, w1, w2, u[29], m[8]);+	MONT_MAC(t0, t1, t2, u[30], m[7]);+	MONT_MAC(v0, v1, v2, u[31], m[6]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	MONT_ADD(s0, s1, s2, c0, c1, c2);+	MONT_DBL(s0, s1, s2);+	MONT_ADD(t0, t1, t2, s0, s1, s2);+	z[5] = t0;+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 38 */+	MONT_MUL(s0, s1, s2, a[7], a[31]);+	MONT_MUL(c0, c1, c2, a[8], a[30]);+	MONT_MAC(s0, s1, s2, a[9], a[29]);+	MONT_MAC(c0, c1, c2, a[10], a[28]);+	MONT_MAC(s0, s1, s2, a[11], a[27]);+	MONT_MAC(c0, c1, c2, a[12], a[26]);+	MONT_MAC(s0, s1, s2, a[13], a[25]);+	MONT_MAC(c0, c1, c2, a[14], a[24]);+	MONT_MAC(s0, s1, s2, a[15], a[23]);+	MONT_MAC(c0, c1, c2, a[16], a[22]);+	MONT_MAC(s0, s1, s2, a[17], a[21]);+	MONT_MAC(c0, c1, c2, a[18], a[20]);+	MONT_MAC(t0, t1, t2, a[19], a[19]);+	MONT_MUL(v0, v1, v2, u[7], m[31]);+	MONT_MUL(w0, w1, w2, u[8], m[30]);+	MONT_MAC(t0, t1, t2, u[9], m[29]);+	MONT_MAC(v0, v1, v2, u[10], m[28]);+	MONT_MAC(w0, w1, w2, u[11], m[27]);+	MONT_MAC(t0, t1, t2, u[12], m[26]);+	MONT_MAC(v0, v1, v2, u[13], m[25]);+	MONT_MAC(w0, w1, w2, u[14], m[24]);+	MONT_MAC(t0, t1, t2, u[15], m[23]);+	MONT_MAC(v0, v1, v2, u[16], m[22]);+	MONT_MAC(w0, w1, w2, u[17], m[21]);+	MONT_MAC(t0, t1, t2, u[18], m[20]);+	MONT_MAC(v0, v1, v2, u[19], m[19]);+	MONT_MAC(w0, w1, w2, u[20], m[18]);+	MONT_MAC(t0, t1, t2, u[21], m[17]);+	MONT_MAC(v0, v1, v2, u[22], m[16]);+	MONT_MAC(w0, w1, w2, u[23], m[15]);+	MONT_MAC(t0, t1, t2, u[24], m[14]);+	MONT_MAC(v0, v1, v2, u[25], m[13]);+	MONT_MAC(w0, w1, w2, u[26], m[12]);+	MONT_MAC(t0, t1, t2, u[27], m[11]);+	MONT_MAC(v0, v1, v2, u[28], m[10]);+	MONT_MAC(w0, w1, w2, u[29], m[9]);+	MONT_MAC(t0, t1, t2, u[30], m[8]);+	MONT_MAC(v0, v1, v2, u[31], m[7]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	MONT_ADD(s0, s1, s2, c0, c1, c2);+	MONT_DBL(s0, s1, s2);+	MONT_ADD(t0, t1, t2, s0, s1, s2);+	z[6] = t0;+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 39 */+	MONT_MUL(s0, s1, s2, a[8], a[31]);+	MONT_MUL(c0, c1, c2, a[9], a[30]);+	MONT_MAC(s0, s1, s2, a[10], a[29]);+	MONT_MAC(c0, c1, c2, a[11], a[28]);+	MONT_MAC(s0, s1, s2, a[12], a[27]);+	MONT_MAC(c0, c1, c2, a[13], a[26]);+	MONT_MAC(s0, s1, s2, a[14], a[25]);+	MONT_MAC(c0, c1, c2, a[15], a[24]);+	MONT_MAC(s0, s1, s2, a[16], a[23]);+	MONT_MAC(c0, c1, c2, a[17], a[22]);+	MONT_MAC(s0, s1, s2, a[18], a[21]);+	MONT_MAC(c0, c1, c2, a[19], a[20]);+	MONT_MAC(t0, t1, t2, u[8], m[31]);+	MONT_MUL(v0, v1, v2, u[9], m[30]);+	MONT_MUL(w0, w1, w2, u[10], m[29]);+	MONT_MAC(t0, t1, t2, u[11], m[28]);+	MONT_MAC(v0, v1, v2, u[12], m[27]);+	MONT_MAC(w0, w1, w2, u[13], m[26]);+	MONT_MAC(t0, t1, t2, u[14], m[25]);+	MONT_MAC(v0, v1, v2, u[15], m[24]);+	MONT_MAC(w0, w1, w2, u[16], m[23]);+	MONT_MAC(t0, t1, t2, u[17], m[22]);+	MONT_MAC(v0, v1, v2, u[18], m[21]);+	MONT_MAC(w0, w1, w2, u[19], m[20]);+	MONT_MAC(t0, t1, t2, u[20], m[19]);+	MONT_MAC(v0, v1, v2, u[21], m[18]);+	MONT_MAC(w0, w1, w2, u[22], m[17]);+	MONT_MAC(t0, t1, t2, u[23], m[16]);+	MONT_MAC(v0, v1, v2, u[24], m[15]);+	MONT_MAC(w0, w1, w2, u[25], m[14]);+	MONT_MAC(t0, t1, t2, u[26], m[13]);+	MONT_MAC(v0, v1, v2, u[27], m[12]);+	MONT_MAC(w0, w1, w2, u[28], m[11]);+	MONT_MAC(t0, t1, t2, u[29], m[10]);+	MONT_MAC(v0, v1, v2, u[30], m[9]);+	MONT_MAC(w0, w1, w2, u[31], m[8]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	MONT_ADD(s0, s1, s2, c0, c1, c2);+	MONT_DBL(s0, s1, s2);+	MONT_ADD(t0, t1, t2, s0, s1, s2);+	z[7] = t0;+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 40 */+	MONT_MUL(s0, s1, s2, a[9], a[31]);+	MONT_MUL(c0, c1, c2, a[10], a[30]);+	MONT_MAC(s0, s1, s2, a[11], a[29]);+	MONT_MAC(c0, c1, c2, a[12], a[28]);+	MONT_MAC(s0, s1, s2, a[13], a[27]);+	MONT_MAC(c0, c1, c2, a[14], a[26]);+	MONT_MAC(s0, s1, s2, a[15], a[25]);+	MONT_MAC(c0, c1, c2, a[16], a[24]);+	MONT_MAC(s0, s1, s2, a[17], a[23]);+	MONT_MAC(c0, c1, c2, a[18], a[22]);+	MONT_MAC(s0, s1, s2, a[19], a[21]);+	MONT_MAC(t0, t1, t2, a[20], a[20]);+	MONT_MUL(v0, v1, v2, u[9], m[31]);+	MONT_MUL(w0, w1, w2, u[10], m[30]);+	MONT_MAC(t0, t1, t2, u[11], m[29]);+	MONT_MAC(v0, v1, v2, u[12], m[28]);+	MONT_MAC(w0, w1, w2, u[13], m[27]);+	MONT_MAC(t0, t1, t2, u[14], m[26]);+	MONT_MAC(v0, v1, v2, u[15], m[25]);+	MONT_MAC(w0, w1, w2, u[16], m[24]);+	MONT_MAC(t0, t1, t2, u[17], m[23]);+	MONT_MAC(v0, v1, v2, u[18], m[22]);+	MONT_MAC(w0, w1, w2, u[19], m[21]);+	MONT_MAC(t0, t1, t2, u[20], m[20]);+	MONT_MAC(v0, v1, v2, u[21], m[19]);+	MONT_MAC(w0, w1, w2, u[22], m[18]);+	MONT_MAC(t0, t1, t2, u[23], m[17]);+	MONT_MAC(v0, v1, v2, u[24], m[16]);+	MONT_MAC(w0, w1, w2, u[25], m[15]);+	MONT_MAC(t0, t1, t2, u[26], m[14]);+	MONT_MAC(v0, v1, v2, u[27], m[13]);+	MONT_MAC(w0, w1, w2, u[28], m[12]);+	MONT_MAC(t0, t1, t2, u[29], m[11]);+	MONT_MAC(v0, v1, v2, u[30], m[10]);+	MONT_MAC(w0, w1, w2, u[31], m[9]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	MONT_ADD(s0, s1, s2, c0, c1, c2);+	MONT_DBL(s0, s1, s2);+	MONT_ADD(t0, t1, t2, s0, s1, s2);+	z[8] = t0;+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 41 */+	MONT_MUL(s0, s1, s2, a[10], a[31]);+	MONT_MUL(c0, c1, c2, a[11], a[30]);+	MONT_MAC(s0, s1, s2, a[12], a[29]);+	MONT_MAC(c0, c1, c2, a[13], a[28]);+	MONT_MAC(s0, s1, s2, a[14], a[27]);+	MONT_MAC(c0, c1, c2, a[15], a[26]);+	MONT_MAC(s0, s1, s2, a[16], a[25]);+	MONT_MAC(c0, c1, c2, a[17], a[24]);+	MONT_MAC(s0, s1, s2, a[18], a[23]);+	MONT_MAC(c0, c1, c2, a[19], a[22]);+	MONT_MAC(s0, s1, s2, a[20], a[21]);+	MONT_MAC(t0, t1, t2, u[10], m[31]);+	MONT_MUL(v0, v1, v2, u[11], m[30]);+	MONT_MUL(w0, w1, w2, u[12], m[29]);+	MONT_MAC(t0, t1, t2, u[13], m[28]);+	MONT_MAC(v0, v1, v2, u[14], m[27]);+	MONT_MAC(w0, w1, w2, u[15], m[26]);+	MONT_MAC(t0, t1, t2, u[16], m[25]);+	MONT_MAC(v0, v1, v2, u[17], m[24]);+	MONT_MAC(w0, w1, w2, u[18], m[23]);+	MONT_MAC(t0, t1, t2, u[19], m[22]);+	MONT_MAC(v0, v1, v2, u[20], m[21]);+	MONT_MAC(w0, w1, w2, u[21], m[20]);+	MONT_MAC(t0, t1, t2, u[22], m[19]);+	MONT_MAC(v0, v1, v2, u[23], m[18]);+	MONT_MAC(w0, w1, w2, u[24], m[17]);+	MONT_MAC(t0, t1, t2, u[25], m[16]);+	MONT_MAC(v0, v1, v2, u[26], m[15]);+	MONT_MAC(w0, w1, w2, u[27], m[14]);+	MONT_MAC(t0, t1, t2, u[28], m[13]);+	MONT_MAC(v0, v1, v2, u[29], m[12]);+	MONT_MAC(w0, w1, w2, u[30], m[11]);+	MONT_MAC(t0, t1, t2, u[31], m[10]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	MONT_ADD(s0, s1, s2, c0, c1, c2);+	MONT_DBL(s0, s1, s2);+	MONT_ADD(t0, t1, t2, s0, s1, s2);+	z[9] = t0;+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 42 */+	MONT_MUL(s0, s1, s2, a[11], a[31]);+	MONT_MUL(c0, c1, c2, a[12], a[30]);+	MONT_MAC(s0, s1, s2, a[13], a[29]);+	MONT_MAC(c0, c1, c2, a[14], a[28]);+	MONT_MAC(s0, s1, s2, a[15], a[27]);+	MONT_MAC(c0, c1, c2, a[16], a[26]);+	MONT_MAC(s0, s1, s2, a[17], a[25]);+	MONT_MAC(c0, c1, c2, a[18], a[24]);+	MONT_MAC(s0, s1, s2, a[19], a[23]);+	MONT_MAC(c0, c1, c2, a[20], a[22]);+	MONT_MAC(t0, t1, t2, a[21], a[21]);+	MONT_MUL(v0, v1, v2, u[11], m[31]);+	MONT_MUL(w0, w1, w2, u[12], m[30]);+	MONT_MAC(t0, t1, t2, u[13], m[29]);+	MONT_MAC(v0, v1, v2, u[14], m[28]);+	MONT_MAC(w0, w1, w2, u[15], m[27]);+	MONT_MAC(t0, t1, t2, u[16], m[26]);+	MONT_MAC(v0, v1, v2, u[17], m[25]);+	MONT_MAC(w0, w1, w2, u[18], m[24]);+	MONT_MAC(t0, t1, t2, u[19], m[23]);+	MONT_MAC(v0, v1, v2, u[20], m[22]);+	MONT_MAC(w0, w1, w2, u[21], m[21]);+	MONT_MAC(t0, t1, t2, u[22], m[20]);+	MONT_MAC(v0, v1, v2, u[23], m[19]);+	MONT_MAC(w0, w1, w2, u[24], m[18]);+	MONT_MAC(t0, t1, t2, u[25], m[17]);+	MONT_MAC(v0, v1, v2, u[26], m[16]);+	MONT_MAC(w0, w1, w2, u[27], m[15]);+	MONT_MAC(t0, t1, t2, u[28], m[14]);+	MONT_MAC(v0, v1, v2, u[29], m[13]);+	MONT_MAC(w0, w1, w2, u[30], m[12]);+	MONT_MAC(t0, t1, t2, u[31], m[11]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	MONT_ADD(s0, s1, s2, c0, c1, c2);+	MONT_DBL(s0, s1, s2);+	MONT_ADD(t0, t1, t2, s0, s1, s2);+	z[10] = t0;+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 43 */+	MONT_MUL(s0, s1, s2, a[12], a[31]);+	MONT_MUL(c0, c1, c2, a[13], a[30]);+	MONT_MAC(s0, s1, s2, a[14], a[29]);+	MONT_MAC(c0, c1, c2, a[15], a[28]);+	MONT_MAC(s0, s1, s2, a[16], a[27]);+	MONT_MAC(c0, c1, c2, a[17], a[26]);+	MONT_MAC(s0, s1, s2, a[18], a[25]);+	MONT_MAC(c0, c1, c2, a[19], a[24]);+	MONT_MAC(s0, s1, s2, a[20], a[23]);+	MONT_MAC(c0, c1, c2, a[21], a[22]);+	MONT_MAC(t0, t1, t2, u[12], m[31]);+	MONT_MUL(v0, v1, v2, u[13], m[30]);+	MONT_MUL(w0, w1, w2, u[14], m[29]);+	MONT_MAC(t0, t1, t2, u[15], m[28]);+	MONT_MAC(v0, v1, v2, u[16], m[27]);+	MONT_MAC(w0, w1, w2, u[17], m[26]);+	MONT_MAC(t0, t1, t2, u[18], m[25]);+	MONT_MAC(v0, v1, v2, u[19], m[24]);+	MONT_MAC(w0, w1, w2, u[20], m[23]);+	MONT_MAC(t0, t1, t2, u[21], m[22]);+	MONT_MAC(v0, v1, v2, u[22], m[21]);+	MONT_MAC(w0, w1, w2, u[23], m[20]);+	MONT_MAC(t0, t1, t2, u[24], m[19]);+	MONT_MAC(v0, v1, v2, u[25], m[18]);+	MONT_MAC(w0, w1, w2, u[26], m[17]);+	MONT_MAC(t0, t1, t2, u[27], m[16]);+	MONT_MAC(v0, v1, v2, u[28], m[15]);+	MONT_MAC(w0, w1, w2, u[29], m[14]);+	MONT_MAC(t0, t1, t2, u[30], m[13]);+	MONT_MAC(v0, v1, v2, u[31], m[12]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	MONT_ADD(s0, s1, s2, c0, c1, c2);+	MONT_DBL(s0, s1, s2);+	MONT_ADD(t0, t1, t2, s0, s1, s2);+	z[11] = t0;+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 44 */+	MONT_MUL(s0, s1, s2, a[13], a[31]);+	MONT_MUL(c0, c1, c2, a[14], a[30]);+	MONT_MAC(s0, s1, s2, a[15], a[29]);+	MONT_MAC(c0, c1, c2, a[16], a[28]);+	MONT_MAC(s0, s1, s2, a[17], a[27]);+	MONT_MAC(c0, c1, c2, a[18], a[26]);+	MONT_MAC(s0, s1, s2, a[19], a[25]);+	MONT_MAC(c0, c1, c2, a[20], a[24]);+	MONT_MAC(s0, s1, s2, a[21], a[23]);+	MONT_MAC(t0, t1, t2, a[22], a[22]);+	MONT_MUL(v0, v1, v2, u[13], m[31]);+	MONT_MUL(w0, w1, w2, u[14], m[30]);+	MONT_MAC(t0, t1, t2, u[15], m[29]);+	MONT_MAC(v0, v1, v2, u[16], m[28]);+	MONT_MAC(w0, w1, w2, u[17], m[27]);+	MONT_MAC(t0, t1, t2, u[18], m[26]);+	MONT_MAC(v0, v1, v2, u[19], m[25]);+	MONT_MAC(w0, w1, w2, u[20], m[24]);+	MONT_MAC(t0, t1, t2, u[21], m[23]);+	MONT_MAC(v0, v1, v2, u[22], m[22]);+	MONT_MAC(w0, w1, w2, u[23], m[21]);+	MONT_MAC(t0, t1, t2, u[24], m[20]);+	MONT_MAC(v0, v1, v2, u[25], m[19]);+	MONT_MAC(w0, w1, w2, u[26], m[18]);+	MONT_MAC(t0, t1, t2, u[27], m[17]);+	MONT_MAC(v0, v1, v2, u[28], m[16]);+	MONT_MAC(w0, w1, w2, u[29], m[15]);+	MONT_MAC(t0, t1, t2, u[30], m[14]);+	MONT_MAC(v0, v1, v2, u[31], m[13]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	MONT_ADD(s0, s1, s2, c0, c1, c2);+	MONT_DBL(s0, s1, s2);+	MONT_ADD(t0, t1, t2, s0, s1, s2);+	z[12] = t0;+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 45 */+	MONT_MUL(s0, s1, s2, a[14], a[31]);+	MONT_MUL(c0, c1, c2, a[15], a[30]);+	MONT_MAC(s0, s1, s2, a[16], a[29]);+	MONT_MAC(c0, c1, c2, a[17], a[28]);+	MONT_MAC(s0, s1, s2, a[18], a[27]);+	MONT_MAC(c0, c1, c2, a[19], a[26]);+	MONT_MAC(s0, s1, s2, a[20], a[25]);+	MONT_MAC(c0, c1, c2, a[21], a[24]);+	MONT_MAC(s0, s1, s2, a[22], a[23]);+	MONT_MAC(t0, t1, t2, u[14], m[31]);+	MONT_MUL(v0, v1, v2, u[15], m[30]);+	MONT_MUL(w0, w1, w2, u[16], m[29]);+	MONT_MAC(t0, t1, t2, u[17], m[28]);+	MONT_MAC(v0, v1, v2, u[18], m[27]);+	MONT_MAC(w0, w1, w2, u[19], m[26]);+	MONT_MAC(t0, t1, t2, u[20], m[25]);+	MONT_MAC(v0, v1, v2, u[21], m[24]);+	MONT_MAC(w0, w1, w2, u[22], m[23]);+	MONT_MAC(t0, t1, t2, u[23], m[22]);+	MONT_MAC(v0, v1, v2, u[24], m[21]);+	MONT_MAC(w0, w1, w2, u[25], m[20]);+	MONT_MAC(t0, t1, t2, u[26], m[19]);+	MONT_MAC(v0, v1, v2, u[27], m[18]);+	MONT_MAC(w0, w1, w2, u[28], m[17]);+	MONT_MAC(t0, t1, t2, u[29], m[16]);+	MONT_MAC(v0, v1, v2, u[30], m[15]);+	MONT_MAC(w0, w1, w2, u[31], m[14]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	MONT_ADD(s0, s1, s2, c0, c1, c2);+	MONT_DBL(s0, s1, s2);+	MONT_ADD(t0, t1, t2, s0, s1, s2);+	z[13] = t0;+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 46 */+	MONT_MUL(s0, s1, s2, a[15], a[31]);+	MONT_MUL(c0, c1, c2, a[16], a[30]);+	MONT_MAC(s0, s1, s2, a[17], a[29]);+	MONT_MAC(c0, c1, c2, a[18], a[28]);+	MONT_MAC(s0, s1, s2, a[19], a[27]);+	MONT_MAC(c0, c1, c2, a[20], a[26]);+	MONT_MAC(s0, s1, s2, a[21], a[25]);+	MONT_MAC(c0, c1, c2, a[22], a[24]);+	MONT_MAC(t0, t1, t2, a[23], a[23]);+	MONT_MUL(v0, v1, v2, u[15], m[31]);+	MONT_MUL(w0, w1, w2, u[16], m[30]);+	MONT_MAC(t0, t1, t2, u[17], m[29]);+	MONT_MAC(v0, v1, v2, u[18], m[28]);+	MONT_MAC(w0, w1, w2, u[19], m[27]);+	MONT_MAC(t0, t1, t2, u[20], m[26]);+	MONT_MAC(v0, v1, v2, u[21], m[25]);+	MONT_MAC(w0, w1, w2, u[22], m[24]);+	MONT_MAC(t0, t1, t2, u[23], m[23]);+	MONT_MAC(v0, v1, v2, u[24], m[22]);+	MONT_MAC(w0, w1, w2, u[25], m[21]);+	MONT_MAC(t0, t1, t2, u[26], m[20]);+	MONT_MAC(v0, v1, v2, u[27], m[19]);+	MONT_MAC(w0, w1, w2, u[28], m[18]);+	MONT_MAC(t0, t1, t2, u[29], m[17]);+	MONT_MAC(v0, v1, v2, u[30], m[16]);+	MONT_MAC(w0, w1, w2, u[31], m[15]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	MONT_ADD(s0, s1, s2, c0, c1, c2);+	MONT_DBL(s0, s1, s2);+	MONT_ADD(t0, t1, t2, s0, s1, s2);+	z[14] = t0;+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 47 */+	MONT_MUL(s0, s1, s2, a[16], a[31]);+	MONT_MUL(c0, c1, c2, a[17], a[30]);+	MONT_MAC(s0, s1, s2, a[18], a[29]);+	MONT_MAC(c0, c1, c2, a[19], a[28]);+	MONT_MAC(s0, s1, s2, a[20], a[27]);+	MONT_MAC(c0, c1, c2, a[21], a[26]);+	MONT_MAC(s0, s1, s2, a[22], a[25]);+	MONT_MAC(c0, c1, c2, a[23], a[24]);+	MONT_MAC(t0, t1, t2, u[16], m[31]);+	MONT_MUL(v0, v1, v2, u[17], m[30]);+	MONT_MUL(w0, w1, w2, u[18], m[29]);+	MONT_MAC(t0, t1, t2, u[19], m[28]);+	MONT_MAC(v0, v1, v2, u[20], m[27]);+	MONT_MAC(w0, w1, w2, u[21], m[26]);+	MONT_MAC(t0, t1, t2, u[22], m[25]);+	MONT_MAC(v0, v1, v2, u[23], m[24]);+	MONT_MAC(w0, w1, w2, u[24], m[23]);+	MONT_MAC(t0, t1, t2, u[25], m[22]);+	MONT_MAC(v0, v1, v2, u[26], m[21]);+	MONT_MAC(w0, w1, w2, u[27], m[20]);+	MONT_MAC(t0, t1, t2, u[28], m[19]);+	MONT_MAC(v0, v1, v2, u[29], m[18]);+	MONT_MAC(w0, w1, w2, u[30], m[17]);+	MONT_MAC(t0, t1, t2, u[31], m[16]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	MONT_ADD(s0, s1, s2, c0, c1, c2);+	MONT_DBL(s0, s1, s2);+	MONT_ADD(t0, t1, t2, s0, s1, s2);+	z[15] = t0;+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 48 */+	MONT_MUL(s0, s1, s2, a[17], a[31]);+	MONT_MUL(c0, c1, c2, a[18], a[30]);+	MONT_MAC(s0, s1, s2, a[19], a[29]);+	MONT_MAC(c0, c1, c2, a[20], a[28]);+	MONT_MAC(s0, s1, s2, a[21], a[27]);+	MONT_MAC(c0, c1, c2, a[22], a[26]);+	MONT_MAC(s0, s1, s2, a[23], a[25]);+	MONT_MAC(t0, t1, t2, a[24], a[24]);+	MONT_MUL(v0, v1, v2, u[17], m[31]);+	MONT_MUL(w0, w1, w2, u[18], m[30]);+	MONT_MAC(t0, t1, t2, u[19], m[29]);+	MONT_MAC(v0, v1, v2, u[20], m[28]);+	MONT_MAC(w0, w1, w2, u[21], m[27]);+	MONT_MAC(t0, t1, t2, u[22], m[26]);+	MONT_MAC(v0, v1, v2, u[23], m[25]);+	MONT_MAC(w0, w1, w2, u[24], m[24]);+	MONT_MAC(t0, t1, t2, u[25], m[23]);+	MONT_MAC(v0, v1, v2, u[26], m[22]);+	MONT_MAC(w0, w1, w2, u[27], m[21]);+	MONT_MAC(t0, t1, t2, u[28], m[20]);+	MONT_MAC(v0, v1, v2, u[29], m[19]);+	MONT_MAC(w0, w1, w2, u[30], m[18]);+	MONT_MAC(t0, t1, t2, u[31], m[17]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	MONT_ADD(s0, s1, s2, c0, c1, c2);+	MONT_DBL(s0, s1, s2);+	MONT_ADD(t0, t1, t2, s0, s1, s2);+	z[16] = t0;+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 49 */+	MONT_MUL(s0, s1, s2, a[18], a[31]);+	MONT_MUL(c0, c1, c2, a[19], a[30]);+	MONT_MAC(s0, s1, s2, a[20], a[29]);+	MONT_MAC(c0, c1, c2, a[21], a[28]);+	MONT_MAC(s0, s1, s2, a[22], a[27]);+	MONT_MAC(c0, c1, c2, a[23], a[26]);+	MONT_MAC(s0, s1, s2, a[24], a[25]);+	MONT_MAC(t0, t1, t2, u[18], m[31]);+	MONT_MUL(v0, v1, v2, u[19], m[30]);+	MONT_MUL(w0, w1, w2, u[20], m[29]);+	MONT_MAC(t0, t1, t2, u[21], m[28]);+	MONT_MAC(v0, v1, v2, u[22], m[27]);+	MONT_MAC(w0, w1, w2, u[23], m[26]);+	MONT_MAC(t0, t1, t2, u[24], m[25]);+	MONT_MAC(v0, v1, v2, u[25], m[24]);+	MONT_MAC(w0, w1, w2, u[26], m[23]);+	MONT_MAC(t0, t1, t2, u[27], m[22]);+	MONT_MAC(v0, v1, v2, u[28], m[21]);+	MONT_MAC(w0, w1, w2, u[29], m[20]);+	MONT_MAC(t0, t1, t2, u[30], m[19]);+	MONT_MAC(v0, v1, v2, u[31], m[18]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	MONT_ADD(s0, s1, s2, c0, c1, c2);+	MONT_DBL(s0, s1, s2);+	MONT_ADD(t0, t1, t2, s0, s1, s2);+	z[17] = t0;+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 50 */+	MONT_MUL(s0, s1, s2, a[19], a[31]);+	MONT_MUL(c0, c1, c2, a[20], a[30]);+	MONT_MAC(s0, s1, s2, a[21], a[29]);+	MONT_MAC(c0, c1, c2, a[22], a[28]);+	MONT_MAC(s0, s1, s2, a[23], a[27]);+	MONT_MAC(c0, c1, c2, a[24], a[26]);+	MONT_MAC(t0, t1, t2, a[25], a[25]);+	MONT_MUL(v0, v1, v2, u[19], m[31]);+	MONT_MUL(w0, w1, w2, u[20], m[30]);+	MONT_MAC(t0, t1, t2, u[21], m[29]);+	MONT_MAC(v0, v1, v2, u[22], m[28]);+	MONT_MAC(w0, w1, w2, u[23], m[27]);+	MONT_MAC(t0, t1, t2, u[24], m[26]);+	MONT_MAC(v0, v1, v2, u[25], m[25]);+	MONT_MAC(w0, w1, w2, u[26], m[24]);+	MONT_MAC(t0, t1, t2, u[27], m[23]);+	MONT_MAC(v0, v1, v2, u[28], m[22]);+	MONT_MAC(w0, w1, w2, u[29], m[21]);+	MONT_MAC(t0, t1, t2, u[30], m[20]);+	MONT_MAC(v0, v1, v2, u[31], m[19]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	MONT_ADD(s0, s1, s2, c0, c1, c2);+	MONT_DBL(s0, s1, s2);+	MONT_ADD(t0, t1, t2, s0, s1, s2);+	z[18] = t0;+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 51 */+	MONT_MUL(s0, s1, s2, a[20], a[31]);+	MONT_MUL(c0, c1, c2, a[21], a[30]);+	MONT_MAC(s0, s1, s2, a[22], a[29]);+	MONT_MAC(c0, c1, c2, a[23], a[28]);+	MONT_MAC(s0, s1, s2, a[24], a[27]);+	MONT_MAC(c0, c1, c2, a[25], a[26]);+	MONT_MAC(t0, t1, t2, u[20], m[31]);+	MONT_MUL(v0, v1, v2, u[21], m[30]);+	MONT_MUL(w0, w1, w2, u[22], m[29]);+	MONT_MAC(t0, t1, t2, u[23], m[28]);+	MONT_MAC(v0, v1, v2, u[24], m[27]);+	MONT_MAC(w0, w1, w2, u[25], m[26]);+	MONT_MAC(t0, t1, t2, u[26], m[25]);+	MONT_MAC(v0, v1, v2, u[27], m[24]);+	MONT_MAC(w0, w1, w2, u[28], m[23]);+	MONT_MAC(t0, t1, t2, u[29], m[22]);+	MONT_MAC(v0, v1, v2, u[30], m[21]);+	MONT_MAC(w0, w1, w2, u[31], m[20]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	MONT_ADD(s0, s1, s2, c0, c1, c2);+	MONT_DBL(s0, s1, s2);+	MONT_ADD(t0, t1, t2, s0, s1, s2);+	z[19] = t0;+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 52 */+	MONT_MUL(s0, s1, s2, a[21], a[31]);+	MONT_MUL(c0, c1, c2, a[22], a[30]);+	MONT_MAC(s0, s1, s2, a[23], a[29]);+	MONT_MAC(c0, c1, c2, a[24], a[28]);+	MONT_MAC(s0, s1, s2, a[25], a[27]);+	MONT_MAC(t0, t1, t2, a[26], a[26]);+	MONT_MUL(v0, v1, v2, u[21], m[31]);+	MONT_MUL(w0, w1, w2, u[22], m[30]);+	MONT_MAC(t0, t1, t2, u[23], m[29]);+	MONT_MAC(v0, v1, v2, u[24], m[28]);+	MONT_MAC(w0, w1, w2, u[25], m[27]);+	MONT_MAC(t0, t1, t2, u[26], m[26]);+	MONT_MAC(v0, v1, v2, u[27], m[25]);+	MONT_MAC(w0, w1, w2, u[28], m[24]);+	MONT_MAC(t0, t1, t2, u[29], m[23]);+	MONT_MAC(v0, v1, v2, u[30], m[22]);+	MONT_MAC(w0, w1, w2, u[31], m[21]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	MONT_ADD(s0, s1, s2, c0, c1, c2);+	MONT_DBL(s0, s1, s2);+	MONT_ADD(t0, t1, t2, s0, s1, s2);+	z[20] = t0;+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 53 */+	MONT_MUL(s0, s1, s2, a[22], a[31]);+	MONT_MUL(c0, c1, c2, a[23], a[30]);+	MONT_MAC(s0, s1, s2, a[24], a[29]);+	MONT_MAC(c0, c1, c2, a[25], a[28]);+	MONT_MAC(s0, s1, s2, a[26], a[27]);+	MONT_MAC(t0, t1, t2, u[22], m[31]);+	MONT_MUL(v0, v1, v2, u[23], m[30]);+	MONT_MUL(w0, w1, w2, u[24], m[29]);+	MONT_MAC(t0, t1, t2, u[25], m[28]);+	MONT_MAC(v0, v1, v2, u[26], m[27]);+	MONT_MAC(w0, w1, w2, u[27], m[26]);+	MONT_MAC(t0, t1, t2, u[28], m[25]);+	MONT_MAC(v0, v1, v2, u[29], m[24]);+	MONT_MAC(w0, w1, w2, u[30], m[23]);+	MONT_MAC(t0, t1, t2, u[31], m[22]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	MONT_ADD(s0, s1, s2, c0, c1, c2);+	MONT_DBL(s0, s1, s2);+	MONT_ADD(t0, t1, t2, s0, s1, s2);+	z[21] = t0;+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 54 */+	MONT_MUL(s0, s1, s2, a[23], a[31]);+	MONT_MUL(c0, c1, c2, a[24], a[30]);+	MONT_MAC(s0, s1, s2, a[25], a[29]);+	MONT_MAC(c0, c1, c2, a[26], a[28]);+	MONT_MAC(t0, t1, t2, a[27], a[27]);+	MONT_MUL(v0, v1, v2, u[23], m[31]);+	MONT_MUL(w0, w1, w2, u[24], m[30]);+	MONT_MAC(t0, t1, t2, u[25], m[29]);+	MONT_MAC(v0, v1, v2, u[26], m[28]);+	MONT_MAC(w0, w1, w2, u[27], m[27]);+	MONT_MAC(t0, t1, t2, u[28], m[26]);+	MONT_MAC(v0, v1, v2, u[29], m[25]);+	MONT_MAC(w0, w1, w2, u[30], m[24]);+	MONT_MAC(t0, t1, t2, u[31], m[23]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	MONT_ADD(s0, s1, s2, c0, c1, c2);+	MONT_DBL(s0, s1, s2);+	MONT_ADD(t0, t1, t2, s0, s1, s2);+	z[22] = t0;+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 55 */+	MONT_MUL(s0, s1, s2, a[24], a[31]);+	MONT_MUL(c0, c1, c2, a[25], a[30]);+	MONT_MAC(s0, s1, s2, a[26], a[29]);+	MONT_MAC(c0, c1, c2, a[27], a[28]);+	MONT_MAC(t0, t1, t2, u[24], m[31]);+	MONT_MUL(v0, v1, v2, u[25], m[30]);+	MONT_MUL(w0, w1, w2, u[26], m[29]);+	MONT_MAC(t0, t1, t2, u[27], m[28]);+	MONT_MAC(v0, v1, v2, u[28], m[27]);+	MONT_MAC(w0, w1, w2, u[29], m[26]);+	MONT_MAC(t0, t1, t2, u[30], m[25]);+	MONT_MAC(v0, v1, v2, u[31], m[24]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	MONT_ADD(s0, s1, s2, c0, c1, c2);+	MONT_DBL(s0, s1, s2);+	MONT_ADD(t0, t1, t2, s0, s1, s2);+	z[23] = t0;+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 56 */+	MONT_MUL(s0, s1, s2, a[25], a[31]);+	MONT_MUL(c0, c1, c2, a[26], a[30]);+	MONT_MAC(s0, s1, s2, a[27], a[29]);+	MONT_MAC(t0, t1, t2, a[28], a[28]);+	MONT_MUL(v0, v1, v2, u[25], m[31]);+	MONT_MUL(w0, w1, w2, u[26], m[30]);+	MONT_MAC(t0, t1, t2, u[27], m[29]);+	MONT_MAC(v0, v1, v2, u[28], m[28]);+	MONT_MAC(w0, w1, w2, u[29], m[27]);+	MONT_MAC(t0, t1, t2, u[30], m[26]);+	MONT_MAC(v0, v1, v2, u[31], m[25]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	MONT_ADD(s0, s1, s2, c0, c1, c2);+	MONT_DBL(s0, s1, s2);+	MONT_ADD(t0, t1, t2, s0, s1, s2);+	z[24] = t0;+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 57 */+	MONT_MUL(s0, s1, s2, a[26], a[31]);+	MONT_MUL(c0, c1, c2, a[27], a[30]);+	MONT_MAC(s0, s1, s2, a[28], a[29]);+	MONT_MAC(t0, t1, t2, u[26], m[31]);+	MONT_MUL(v0, v1, v2, u[27], m[30]);+	MONT_MUL(w0, w1, w2, u[28], m[29]);+	MONT_MAC(t0, t1, t2, u[29], m[28]);+	MONT_MAC(v0, v1, v2, u[30], m[27]);+	MONT_MAC(w0, w1, w2, u[31], m[26]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	MONT_ADD(s0, s1, s2, c0, c1, c2);+	MONT_DBL(s0, s1, s2);+	MONT_ADD(t0, t1, t2, s0, s1, s2);+	z[25] = t0;+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 58 */+	MONT_MUL(s0, s1, s2, a[27], a[31]);+	MONT_MUL(c0, c1, c2, a[28], a[30]);+	MONT_MAC(t0, t1, t2, a[29], a[29]);+	MONT_MUL(v0, v1, v2, u[27], m[31]);+	MONT_MUL(w0, w1, w2, u[28], m[30]);+	MONT_MAC(t0, t1, t2, u[29], m[29]);+	MONT_MAC(v0, v1, v2, u[30], m[28]);+	MONT_MAC(w0, w1, w2, u[31], m[27]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	MONT_ADD(s0, s1, s2, c0, c1, c2);+	MONT_DBL(s0, s1, s2);+	MONT_ADD(t0, t1, t2, s0, s1, s2);+	z[26] = t0;+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 59 */+	MONT_MUL(s0, s1, s2, a[28], a[31]);+	MONT_MUL(c0, c1, c2, a[29], a[30]);+	MONT_MAC(t0, t1, t2, u[28], m[31]);+	MONT_MUL(v0, v1, v2, u[29], m[30]);+	MONT_MUL(w0, w1, w2, u[30], m[29]);+	MONT_MAC(t0, t1, t2, u[31], m[28]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	MONT_ADD(s0, s1, s2, c0, c1, c2);+	MONT_DBL(s0, s1, s2);+	MONT_ADD(t0, t1, t2, s0, s1, s2);+	z[27] = t0;+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 60 */+	MONT_MUL(s0, s1, s2, a[29], a[31]);+	MONT_MAC(t0, t1, t2, a[30], a[30]);+	MONT_MUL(v0, v1, v2, u[29], m[31]);+	MONT_MUL(w0, w1, w2, u[30], m[30]);+	MONT_MAC(t0, t1, t2, u[31], m[29]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	MONT_DBL(s0, s1, s2);+	MONT_ADD(t0, t1, t2, s0, s1, s2);+	z[28] = t0;+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 61 */+	MONT_MUL(s0, s1, s2, a[30], a[31]);+	MONT_MAC(t0, t1, t2, u[30], m[31]);+	MONT_MUL(v0, v1, v2, u[31], m[30]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_DBL(s0, s1, s2);+	MONT_ADD(t0, t1, t2, s0, s1, s2);+	z[29] = t0;+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 62 */+	MONT_MAC(t0, t1, t2, a[31], a[31]);+	MONT_MUL(v0, v1, v2, u[31], m[31]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	z[30] = t0;+	t0 = t1;+	t1 = t2;+	t2 = 0;+	z[31] = t0;++	/* under 2m, with t1 the bit above n limbs: at most one subtraction */+	borrow = sub_n(r, z, m, 32);+	take = t1 | (borrow ^ 1);+	select_n(r, r, z, take & 1, 32);+}++/* r = a * a * R^-1 mod m, for a under m; t is 2n limbs of scratch */+static void crypton_mont_sqr48(limb_t *r, const limb_t *a,+                               const limb_t *m, limb_t n0, limb_t *t)+{+	limb_t *u = t, *z = t + 48;+	limb_t t0 = 0, t1 = 0, t2 = 0, v0, v1, v2, w0, w1, w2, borrow, take;+	limb_t s0, s1, s2, c0, c1, c2;++	/* column 0 */+	MONT_MAC(t0, t1, t2, a[0], a[0]);+	u[0] = t0 * n0;+	MONT_MAC(t0, t1, t2, u[0], m[0]);+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 1 */+	MONT_MUL(s0, s1, s2, a[0], a[1]);+	MONT_MAC(t0, t1, t2, u[0], m[1]);+	MONT_DBL(s0, s1, s2);+	MONT_ADD(t0, t1, t2, s0, s1, s2);+	u[1] = t0 * n0;+	MONT_MAC(t0, t1, t2, u[1], m[0]);+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 2 */+	MONT_MUL(s0, s1, s2, a[0], a[2]);+	MONT_MAC(t0, t1, t2, a[1], a[1]);+	MONT_MUL(v0, v1, v2, u[0], m[2]);+	MONT_MUL(w0, w1, w2, u[1], m[1]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	MONT_DBL(s0, s1, s2);+	MONT_ADD(t0, t1, t2, s0, s1, s2);+	u[2] = t0 * n0;+	MONT_MAC(t0, t1, t2, u[2], m[0]);+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 3 */+	MONT_MUL(s0, s1, s2, a[0], a[3]);+	MONT_MUL(c0, c1, c2, a[1], a[2]);+	MONT_MAC(t0, t1, t2, u[0], m[3]);+	MONT_MUL(v0, v1, v2, u[1], m[2]);+	MONT_MUL(w0, w1, w2, u[2], m[1]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	MONT_ADD(s0, s1, s2, c0, c1, c2);+	MONT_DBL(s0, s1, s2);+	MONT_ADD(t0, t1, t2, s0, s1, s2);+	u[3] = t0 * n0;+	MONT_MAC(t0, t1, t2, u[3], m[0]);+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 4 */+	MONT_MUL(s0, s1, s2, a[0], a[4]);+	MONT_MUL(c0, c1, c2, a[1], a[3]);+	MONT_MAC(t0, t1, t2, a[2], a[2]);+	MONT_MUL(v0, v1, v2, u[0], m[4]);+	MONT_MUL(w0, w1, w2, u[1], m[3]);+	MONT_MAC(t0, t1, t2, u[2], m[2]);+	MONT_MAC(v0, v1, v2, u[3], m[1]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	MONT_ADD(s0, s1, s2, c0, c1, c2);+	MONT_DBL(s0, s1, s2);+	MONT_ADD(t0, t1, t2, s0, s1, s2);+	u[4] = t0 * n0;+	MONT_MAC(t0, t1, t2, u[4], m[0]);+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 5 */+	MONT_MUL(s0, s1, s2, a[0], a[5]);+	MONT_MUL(c0, c1, c2, a[1], a[4]);+	MONT_MAC(s0, s1, s2, a[2], a[3]);+	MONT_MAC(t0, t1, t2, u[0], m[5]);+	MONT_MUL(v0, v1, v2, u[1], m[4]);+	MONT_MUL(w0, w1, w2, u[2], m[3]);+	MONT_MAC(t0, t1, t2, u[3], m[2]);+	MONT_MAC(v0, v1, v2, u[4], m[1]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	MONT_ADD(s0, s1, s2, c0, c1, c2);+	MONT_DBL(s0, s1, s2);+	MONT_ADD(t0, t1, t2, s0, s1, s2);+	u[5] = t0 * n0;+	MONT_MAC(t0, t1, t2, u[5], m[0]);+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 6 */+	MONT_MUL(s0, s1, s2, a[0], a[6]);+	MONT_MUL(c0, c1, c2, a[1], a[5]);+	MONT_MAC(s0, s1, s2, a[2], a[4]);+	MONT_MAC(t0, t1, t2, a[3], a[3]);+	MONT_MUL(v0, v1, v2, u[0], m[6]);+	MONT_MUL(w0, w1, w2, u[1], m[5]);+	MONT_MAC(t0, t1, t2, u[2], m[4]);+	MONT_MAC(v0, v1, v2, u[3], m[3]);+	MONT_MAC(w0, w1, w2, u[4], m[2]);+	MONT_MAC(t0, t1, t2, u[5], m[1]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	MONT_ADD(s0, s1, s2, c0, c1, c2);+	MONT_DBL(s0, s1, s2);+	MONT_ADD(t0, t1, t2, s0, s1, s2);+	u[6] = t0 * n0;+	MONT_MAC(t0, t1, t2, u[6], m[0]);+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 7 */+	MONT_MUL(s0, s1, s2, a[0], a[7]);+	MONT_MUL(c0, c1, c2, a[1], a[6]);+	MONT_MAC(s0, s1, s2, a[2], a[5]);+	MONT_MAC(c0, c1, c2, a[3], a[4]);+	MONT_MAC(t0, t1, t2, u[0], m[7]);+	MONT_MUL(v0, v1, v2, u[1], m[6]);+	MONT_MUL(w0, w1, w2, u[2], m[5]);+	MONT_MAC(t0, t1, t2, u[3], m[4]);+	MONT_MAC(v0, v1, v2, u[4], m[3]);+	MONT_MAC(w0, w1, w2, u[5], m[2]);+	MONT_MAC(t0, t1, t2, u[6], m[1]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	MONT_ADD(s0, s1, s2, c0, c1, c2);+	MONT_DBL(s0, s1, s2);+	MONT_ADD(t0, t1, t2, s0, s1, s2);+	u[7] = t0 * n0;+	MONT_MAC(t0, t1, t2, u[7], m[0]);+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 8 */+	MONT_MUL(s0, s1, s2, a[0], a[8]);+	MONT_MUL(c0, c1, c2, a[1], a[7]);+	MONT_MAC(s0, s1, s2, a[2], a[6]);+	MONT_MAC(c0, c1, c2, a[3], a[5]);+	MONT_MAC(t0, t1, t2, a[4], a[4]);+	MONT_MUL(v0, v1, v2, u[0], m[8]);+	MONT_MUL(w0, w1, w2, u[1], m[7]);+	MONT_MAC(t0, t1, t2, u[2], m[6]);+	MONT_MAC(v0, v1, v2, u[3], m[5]);+	MONT_MAC(w0, w1, w2, u[4], m[4]);+	MONT_MAC(t0, t1, t2, u[5], m[3]);+	MONT_MAC(v0, v1, v2, u[6], m[2]);+	MONT_MAC(w0, w1, w2, u[7], m[1]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	MONT_ADD(s0, s1, s2, c0, c1, c2);+	MONT_DBL(s0, s1, s2);+	MONT_ADD(t0, t1, t2, s0, s1, s2);+	u[8] = t0 * n0;+	MONT_MAC(t0, t1, t2, u[8], m[0]);+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 9 */+	MONT_MUL(s0, s1, s2, a[0], a[9]);+	MONT_MUL(c0, c1, c2, a[1], a[8]);+	MONT_MAC(s0, s1, s2, a[2], a[7]);+	MONT_MAC(c0, c1, c2, a[3], a[6]);+	MONT_MAC(s0, s1, s2, a[4], a[5]);+	MONT_MAC(t0, t1, t2, u[0], m[9]);+	MONT_MUL(v0, v1, v2, u[1], m[8]);+	MONT_MUL(w0, w1, w2, u[2], m[7]);+	MONT_MAC(t0, t1, t2, u[3], m[6]);+	MONT_MAC(v0, v1, v2, u[4], m[5]);+	MONT_MAC(w0, w1, w2, u[5], m[4]);+	MONT_MAC(t0, t1, t2, u[6], m[3]);+	MONT_MAC(v0, v1, v2, u[7], m[2]);+	MONT_MAC(w0, w1, w2, u[8], m[1]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	MONT_ADD(s0, s1, s2, c0, c1, c2);+	MONT_DBL(s0, s1, s2);+	MONT_ADD(t0, t1, t2, s0, s1, s2);+	u[9] = t0 * n0;+	MONT_MAC(t0, t1, t2, u[9], m[0]);+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 10 */+	MONT_MUL(s0, s1, s2, a[0], a[10]);+	MONT_MUL(c0, c1, c2, a[1], a[9]);+	MONT_MAC(s0, s1, s2, a[2], a[8]);+	MONT_MAC(c0, c1, c2, a[3], a[7]);+	MONT_MAC(s0, s1, s2, a[4], a[6]);+	MONT_MAC(t0, t1, t2, a[5], a[5]);+	MONT_MUL(v0, v1, v2, u[0], m[10]);+	MONT_MUL(w0, w1, w2, u[1], m[9]);+	MONT_MAC(t0, t1, t2, u[2], m[8]);+	MONT_MAC(v0, v1, v2, u[3], m[7]);+	MONT_MAC(w0, w1, w2, u[4], m[6]);+	MONT_MAC(t0, t1, t2, u[5], m[5]);+	MONT_MAC(v0, v1, v2, u[6], m[4]);+	MONT_MAC(w0, w1, w2, u[7], m[3]);+	MONT_MAC(t0, t1, t2, u[8], m[2]);+	MONT_MAC(v0, v1, v2, u[9], m[1]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	MONT_ADD(s0, s1, s2, c0, c1, c2);+	MONT_DBL(s0, s1, s2);+	MONT_ADD(t0, t1, t2, s0, s1, s2);+	u[10] = t0 * n0;+	MONT_MAC(t0, t1, t2, u[10], m[0]);+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 11 */+	MONT_MUL(s0, s1, s2, a[0], a[11]);+	MONT_MUL(c0, c1, c2, a[1], a[10]);+	MONT_MAC(s0, s1, s2, a[2], a[9]);+	MONT_MAC(c0, c1, c2, a[3], a[8]);+	MONT_MAC(s0, s1, s2, a[4], a[7]);+	MONT_MAC(c0, c1, c2, a[5], a[6]);+	MONT_MAC(t0, t1, t2, u[0], m[11]);+	MONT_MUL(v0, v1, v2, u[1], m[10]);+	MONT_MUL(w0, w1, w2, u[2], m[9]);+	MONT_MAC(t0, t1, t2, u[3], m[8]);+	MONT_MAC(v0, v1, v2, u[4], m[7]);+	MONT_MAC(w0, w1, w2, u[5], m[6]);+	MONT_MAC(t0, t1, t2, u[6], m[5]);+	MONT_MAC(v0, v1, v2, u[7], m[4]);+	MONT_MAC(w0, w1, w2, u[8], m[3]);+	MONT_MAC(t0, t1, t2, u[9], m[2]);+	MONT_MAC(v0, v1, v2, u[10], m[1]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	MONT_ADD(s0, s1, s2, c0, c1, c2);+	MONT_DBL(s0, s1, s2);+	MONT_ADD(t0, t1, t2, s0, s1, s2);+	u[11] = t0 * n0;+	MONT_MAC(t0, t1, t2, u[11], m[0]);+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 12 */+	MONT_MUL(s0, s1, s2, a[0], a[12]);+	MONT_MUL(c0, c1, c2, a[1], a[11]);+	MONT_MAC(s0, s1, s2, a[2], a[10]);+	MONT_MAC(c0, c1, c2, a[3], a[9]);+	MONT_MAC(s0, s1, s2, a[4], a[8]);+	MONT_MAC(c0, c1, c2, a[5], a[7]);+	MONT_MAC(t0, t1, t2, a[6], a[6]);+	MONT_MUL(v0, v1, v2, u[0], m[12]);+	MONT_MUL(w0, w1, w2, u[1], m[11]);+	MONT_MAC(t0, t1, t2, u[2], m[10]);+	MONT_MAC(v0, v1, v2, u[3], m[9]);+	MONT_MAC(w0, w1, w2, u[4], m[8]);+	MONT_MAC(t0, t1, t2, u[5], m[7]);+	MONT_MAC(v0, v1, v2, u[6], m[6]);+	MONT_MAC(w0, w1, w2, u[7], m[5]);+	MONT_MAC(t0, t1, t2, u[8], m[4]);+	MONT_MAC(v0, v1, v2, u[9], m[3]);+	MONT_MAC(w0, w1, w2, u[10], m[2]);+	MONT_MAC(t0, t1, t2, u[11], m[1]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	MONT_ADD(s0, s1, s2, c0, c1, c2);+	MONT_DBL(s0, s1, s2);+	MONT_ADD(t0, t1, t2, s0, s1, s2);+	u[12] = t0 * n0;+	MONT_MAC(t0, t1, t2, u[12], m[0]);+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 13 */+	MONT_MUL(s0, s1, s2, a[0], a[13]);+	MONT_MUL(c0, c1, c2, a[1], a[12]);+	MONT_MAC(s0, s1, s2, a[2], a[11]);+	MONT_MAC(c0, c1, c2, a[3], a[10]);+	MONT_MAC(s0, s1, s2, a[4], a[9]);+	MONT_MAC(c0, c1, c2, a[5], a[8]);+	MONT_MAC(s0, s1, s2, a[6], a[7]);+	MONT_MAC(t0, t1, t2, u[0], m[13]);+	MONT_MUL(v0, v1, v2, u[1], m[12]);+	MONT_MUL(w0, w1, w2, u[2], m[11]);+	MONT_MAC(t0, t1, t2, u[3], m[10]);+	MONT_MAC(v0, v1, v2, u[4], m[9]);+	MONT_MAC(w0, w1, w2, u[5], m[8]);+	MONT_MAC(t0, t1, t2, u[6], m[7]);+	MONT_MAC(v0, v1, v2, u[7], m[6]);+	MONT_MAC(w0, w1, w2, u[8], m[5]);+	MONT_MAC(t0, t1, t2, u[9], m[4]);+	MONT_MAC(v0, v1, v2, u[10], m[3]);+	MONT_MAC(w0, w1, w2, u[11], m[2]);+	MONT_MAC(t0, t1, t2, u[12], m[1]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	MONT_ADD(s0, s1, s2, c0, c1, c2);+	MONT_DBL(s0, s1, s2);+	MONT_ADD(t0, t1, t2, s0, s1, s2);+	u[13] = t0 * n0;+	MONT_MAC(t0, t1, t2, u[13], m[0]);+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 14 */+	MONT_MUL(s0, s1, s2, a[0], a[14]);+	MONT_MUL(c0, c1, c2, a[1], a[13]);+	MONT_MAC(s0, s1, s2, a[2], a[12]);+	MONT_MAC(c0, c1, c2, a[3], a[11]);+	MONT_MAC(s0, s1, s2, a[4], a[10]);+	MONT_MAC(c0, c1, c2, a[5], a[9]);+	MONT_MAC(s0, s1, s2, a[6], a[8]);+	MONT_MAC(t0, t1, t2, a[7], a[7]);+	MONT_MUL(v0, v1, v2, u[0], m[14]);+	MONT_MUL(w0, w1, w2, u[1], m[13]);+	MONT_MAC(t0, t1, t2, u[2], m[12]);+	MONT_MAC(v0, v1, v2, u[3], m[11]);+	MONT_MAC(w0, w1, w2, u[4], m[10]);+	MONT_MAC(t0, t1, t2, u[5], m[9]);+	MONT_MAC(v0, v1, v2, u[6], m[8]);+	MONT_MAC(w0, w1, w2, u[7], m[7]);+	MONT_MAC(t0, t1, t2, u[8], m[6]);+	MONT_MAC(v0, v1, v2, u[9], m[5]);+	MONT_MAC(w0, w1, w2, u[10], m[4]);+	MONT_MAC(t0, t1, t2, u[11], m[3]);+	MONT_MAC(v0, v1, v2, u[12], m[2]);+	MONT_MAC(w0, w1, w2, u[13], m[1]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	MONT_ADD(s0, s1, s2, c0, c1, c2);+	MONT_DBL(s0, s1, s2);+	MONT_ADD(t0, t1, t2, s0, s1, s2);+	u[14] = t0 * n0;+	MONT_MAC(t0, t1, t2, u[14], m[0]);+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 15 */+	MONT_MUL(s0, s1, s2, a[0], a[15]);+	MONT_MUL(c0, c1, c2, a[1], a[14]);+	MONT_MAC(s0, s1, s2, a[2], a[13]);+	MONT_MAC(c0, c1, c2, a[3], a[12]);+	MONT_MAC(s0, s1, s2, a[4], a[11]);+	MONT_MAC(c0, c1, c2, a[5], a[10]);+	MONT_MAC(s0, s1, s2, a[6], a[9]);+	MONT_MAC(c0, c1, c2, a[7], a[8]);+	MONT_MAC(t0, t1, t2, u[0], m[15]);+	MONT_MUL(v0, v1, v2, u[1], m[14]);+	MONT_MUL(w0, w1, w2, u[2], m[13]);+	MONT_MAC(t0, t1, t2, u[3], m[12]);+	MONT_MAC(v0, v1, v2, u[4], m[11]);+	MONT_MAC(w0, w1, w2, u[5], m[10]);+	MONT_MAC(t0, t1, t2, u[6], m[9]);+	MONT_MAC(v0, v1, v2, u[7], m[8]);+	MONT_MAC(w0, w1, w2, u[8], m[7]);+	MONT_MAC(t0, t1, t2, u[9], m[6]);+	MONT_MAC(v0, v1, v2, u[10], m[5]);+	MONT_MAC(w0, w1, w2, u[11], m[4]);+	MONT_MAC(t0, t1, t2, u[12], m[3]);+	MONT_MAC(v0, v1, v2, u[13], m[2]);+	MONT_MAC(w0, w1, w2, u[14], m[1]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	MONT_ADD(s0, s1, s2, c0, c1, c2);+	MONT_DBL(s0, s1, s2);+	MONT_ADD(t0, t1, t2, s0, s1, s2);+	u[15] = t0 * n0;+	MONT_MAC(t0, t1, t2, u[15], m[0]);+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 16 */+	MONT_MUL(s0, s1, s2, a[0], a[16]);+	MONT_MUL(c0, c1, c2, a[1], a[15]);+	MONT_MAC(s0, s1, s2, a[2], a[14]);+	MONT_MAC(c0, c1, c2, a[3], a[13]);+	MONT_MAC(s0, s1, s2, a[4], a[12]);+	MONT_MAC(c0, c1, c2, a[5], a[11]);+	MONT_MAC(s0, s1, s2, a[6], a[10]);+	MONT_MAC(c0, c1, c2, a[7], a[9]);+	MONT_MAC(t0, t1, t2, a[8], a[8]);+	MONT_MUL(v0, v1, v2, u[0], m[16]);+	MONT_MUL(w0, w1, w2, u[1], m[15]);+	MONT_MAC(t0, t1, t2, u[2], m[14]);+	MONT_MAC(v0, v1, v2, u[3], m[13]);+	MONT_MAC(w0, w1, w2, u[4], m[12]);+	MONT_MAC(t0, t1, t2, u[5], m[11]);+	MONT_MAC(v0, v1, v2, u[6], m[10]);+	MONT_MAC(w0, w1, w2, u[7], m[9]);+	MONT_MAC(t0, t1, t2, u[8], m[8]);+	MONT_MAC(v0, v1, v2, u[9], m[7]);+	MONT_MAC(w0, w1, w2, u[10], m[6]);+	MONT_MAC(t0, t1, t2, u[11], m[5]);+	MONT_MAC(v0, v1, v2, u[12], m[4]);+	MONT_MAC(w0, w1, w2, u[13], m[3]);+	MONT_MAC(t0, t1, t2, u[14], m[2]);+	MONT_MAC(v0, v1, v2, u[15], m[1]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	MONT_ADD(s0, s1, s2, c0, c1, c2);+	MONT_DBL(s0, s1, s2);+	MONT_ADD(t0, t1, t2, s0, s1, s2);+	u[16] = t0 * n0;+	MONT_MAC(t0, t1, t2, u[16], m[0]);+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 17 */+	MONT_MUL(s0, s1, s2, a[0], a[17]);+	MONT_MUL(c0, c1, c2, a[1], a[16]);+	MONT_MAC(s0, s1, s2, a[2], a[15]);+	MONT_MAC(c0, c1, c2, a[3], a[14]);+	MONT_MAC(s0, s1, s2, a[4], a[13]);+	MONT_MAC(c0, c1, c2, a[5], a[12]);+	MONT_MAC(s0, s1, s2, a[6], a[11]);+	MONT_MAC(c0, c1, c2, a[7], a[10]);+	MONT_MAC(s0, s1, s2, a[8], a[9]);+	MONT_MAC(t0, t1, t2, u[0], m[17]);+	MONT_MUL(v0, v1, v2, u[1], m[16]);+	MONT_MUL(w0, w1, w2, u[2], m[15]);+	MONT_MAC(t0, t1, t2, u[3], m[14]);+	MONT_MAC(v0, v1, v2, u[4], m[13]);+	MONT_MAC(w0, w1, w2, u[5], m[12]);+	MONT_MAC(t0, t1, t2, u[6], m[11]);+	MONT_MAC(v0, v1, v2, u[7], m[10]);+	MONT_MAC(w0, w1, w2, u[8], m[9]);+	MONT_MAC(t0, t1, t2, u[9], m[8]);+	MONT_MAC(v0, v1, v2, u[10], m[7]);+	MONT_MAC(w0, w1, w2, u[11], m[6]);+	MONT_MAC(t0, t1, t2, u[12], m[5]);+	MONT_MAC(v0, v1, v2, u[13], m[4]);+	MONT_MAC(w0, w1, w2, u[14], m[3]);+	MONT_MAC(t0, t1, t2, u[15], m[2]);+	MONT_MAC(v0, v1, v2, u[16], m[1]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	MONT_ADD(s0, s1, s2, c0, c1, c2);+	MONT_DBL(s0, s1, s2);+	MONT_ADD(t0, t1, t2, s0, s1, s2);+	u[17] = t0 * n0;+	MONT_MAC(t0, t1, t2, u[17], m[0]);+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 18 */+	MONT_MUL(s0, s1, s2, a[0], a[18]);+	MONT_MUL(c0, c1, c2, a[1], a[17]);+	MONT_MAC(s0, s1, s2, a[2], a[16]);+	MONT_MAC(c0, c1, c2, a[3], a[15]);+	MONT_MAC(s0, s1, s2, a[4], a[14]);+	MONT_MAC(c0, c1, c2, a[5], a[13]);+	MONT_MAC(s0, s1, s2, a[6], a[12]);+	MONT_MAC(c0, c1, c2, a[7], a[11]);+	MONT_MAC(s0, s1, s2, a[8], a[10]);+	MONT_MAC(t0, t1, t2, a[9], a[9]);+	MONT_MUL(v0, v1, v2, u[0], m[18]);+	MONT_MUL(w0, w1, w2, u[1], m[17]);+	MONT_MAC(t0, t1, t2, u[2], m[16]);+	MONT_MAC(v0, v1, v2, u[3], m[15]);+	MONT_MAC(w0, w1, w2, u[4], m[14]);+	MONT_MAC(t0, t1, t2, u[5], m[13]);+	MONT_MAC(v0, v1, v2, u[6], m[12]);+	MONT_MAC(w0, w1, w2, u[7], m[11]);+	MONT_MAC(t0, t1, t2, u[8], m[10]);+	MONT_MAC(v0, v1, v2, u[9], m[9]);+	MONT_MAC(w0, w1, w2, u[10], m[8]);+	MONT_MAC(t0, t1, t2, u[11], m[7]);+	MONT_MAC(v0, v1, v2, u[12], m[6]);+	MONT_MAC(w0, w1, w2, u[13], m[5]);+	MONT_MAC(t0, t1, t2, u[14], m[4]);+	MONT_MAC(v0, v1, v2, u[15], m[3]);+	MONT_MAC(w0, w1, w2, u[16], m[2]);+	MONT_MAC(t0, t1, t2, u[17], m[1]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	MONT_ADD(s0, s1, s2, c0, c1, c2);+	MONT_DBL(s0, s1, s2);+	MONT_ADD(t0, t1, t2, s0, s1, s2);+	u[18] = t0 * n0;+	MONT_MAC(t0, t1, t2, u[18], m[0]);+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 19 */+	MONT_MUL(s0, s1, s2, a[0], a[19]);+	MONT_MUL(c0, c1, c2, a[1], a[18]);+	MONT_MAC(s0, s1, s2, a[2], a[17]);+	MONT_MAC(c0, c1, c2, a[3], a[16]);+	MONT_MAC(s0, s1, s2, a[4], a[15]);+	MONT_MAC(c0, c1, c2, a[5], a[14]);+	MONT_MAC(s0, s1, s2, a[6], a[13]);+	MONT_MAC(c0, c1, c2, a[7], a[12]);+	MONT_MAC(s0, s1, s2, a[8], a[11]);+	MONT_MAC(c0, c1, c2, a[9], a[10]);+	MONT_MAC(t0, t1, t2, u[0], m[19]);+	MONT_MUL(v0, v1, v2, u[1], m[18]);+	MONT_MUL(w0, w1, w2, u[2], m[17]);+	MONT_MAC(t0, t1, t2, u[3], m[16]);+	MONT_MAC(v0, v1, v2, u[4], m[15]);+	MONT_MAC(w0, w1, w2, u[5], m[14]);+	MONT_MAC(t0, t1, t2, u[6], m[13]);+	MONT_MAC(v0, v1, v2, u[7], m[12]);+	MONT_MAC(w0, w1, w2, u[8], m[11]);+	MONT_MAC(t0, t1, t2, u[9], m[10]);+	MONT_MAC(v0, v1, v2, u[10], m[9]);+	MONT_MAC(w0, w1, w2, u[11], m[8]);+	MONT_MAC(t0, t1, t2, u[12], m[7]);+	MONT_MAC(v0, v1, v2, u[13], m[6]);+	MONT_MAC(w0, w1, w2, u[14], m[5]);+	MONT_MAC(t0, t1, t2, u[15], m[4]);+	MONT_MAC(v0, v1, v2, u[16], m[3]);+	MONT_MAC(w0, w1, w2, u[17], m[2]);+	MONT_MAC(t0, t1, t2, u[18], m[1]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	MONT_ADD(s0, s1, s2, c0, c1, c2);+	MONT_DBL(s0, s1, s2);+	MONT_ADD(t0, t1, t2, s0, s1, s2);+	u[19] = t0 * n0;+	MONT_MAC(t0, t1, t2, u[19], m[0]);+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 20 */+	MONT_MUL(s0, s1, s2, a[0], a[20]);+	MONT_MUL(c0, c1, c2, a[1], a[19]);+	MONT_MAC(s0, s1, s2, a[2], a[18]);+	MONT_MAC(c0, c1, c2, a[3], a[17]);+	MONT_MAC(s0, s1, s2, a[4], a[16]);+	MONT_MAC(c0, c1, c2, a[5], a[15]);+	MONT_MAC(s0, s1, s2, a[6], a[14]);+	MONT_MAC(c0, c1, c2, a[7], a[13]);+	MONT_MAC(s0, s1, s2, a[8], a[12]);+	MONT_MAC(c0, c1, c2, a[9], a[11]);+	MONT_MAC(t0, t1, t2, a[10], a[10]);+	MONT_MUL(v0, v1, v2, u[0], m[20]);+	MONT_MUL(w0, w1, w2, u[1], m[19]);+	MONT_MAC(t0, t1, t2, u[2], m[18]);+	MONT_MAC(v0, v1, v2, u[3], m[17]);+	MONT_MAC(w0, w1, w2, u[4], m[16]);+	MONT_MAC(t0, t1, t2, u[5], m[15]);+	MONT_MAC(v0, v1, v2, u[6], m[14]);+	MONT_MAC(w0, w1, w2, u[7], m[13]);+	MONT_MAC(t0, t1, t2, u[8], m[12]);+	MONT_MAC(v0, v1, v2, u[9], m[11]);+	MONT_MAC(w0, w1, w2, u[10], m[10]);+	MONT_MAC(t0, t1, t2, u[11], m[9]);+	MONT_MAC(v0, v1, v2, u[12], m[8]);+	MONT_MAC(w0, w1, w2, u[13], m[7]);+	MONT_MAC(t0, t1, t2, u[14], m[6]);+	MONT_MAC(v0, v1, v2, u[15], m[5]);+	MONT_MAC(w0, w1, w2, u[16], m[4]);+	MONT_MAC(t0, t1, t2, u[17], m[3]);+	MONT_MAC(v0, v1, v2, u[18], m[2]);+	MONT_MAC(w0, w1, w2, u[19], m[1]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	MONT_ADD(s0, s1, s2, c0, c1, c2);+	MONT_DBL(s0, s1, s2);+	MONT_ADD(t0, t1, t2, s0, s1, s2);+	u[20] = t0 * n0;+	MONT_MAC(t0, t1, t2, u[20], m[0]);+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 21 */+	MONT_MUL(s0, s1, s2, a[0], a[21]);+	MONT_MUL(c0, c1, c2, a[1], a[20]);+	MONT_MAC(s0, s1, s2, a[2], a[19]);+	MONT_MAC(c0, c1, c2, a[3], a[18]);+	MONT_MAC(s0, s1, s2, a[4], a[17]);+	MONT_MAC(c0, c1, c2, a[5], a[16]);+	MONT_MAC(s0, s1, s2, a[6], a[15]);+	MONT_MAC(c0, c1, c2, a[7], a[14]);+	MONT_MAC(s0, s1, s2, a[8], a[13]);+	MONT_MAC(c0, c1, c2, a[9], a[12]);+	MONT_MAC(s0, s1, s2, a[10], a[11]);+	MONT_MAC(t0, t1, t2, u[0], m[21]);+	MONT_MUL(v0, v1, v2, u[1], m[20]);+	MONT_MUL(w0, w1, w2, u[2], m[19]);+	MONT_MAC(t0, t1, t2, u[3], m[18]);+	MONT_MAC(v0, v1, v2, u[4], m[17]);+	MONT_MAC(w0, w1, w2, u[5], m[16]);+	MONT_MAC(t0, t1, t2, u[6], m[15]);+	MONT_MAC(v0, v1, v2, u[7], m[14]);+	MONT_MAC(w0, w1, w2, u[8], m[13]);+	MONT_MAC(t0, t1, t2, u[9], m[12]);+	MONT_MAC(v0, v1, v2, u[10], m[11]);+	MONT_MAC(w0, w1, w2, u[11], m[10]);+	MONT_MAC(t0, t1, t2, u[12], m[9]);+	MONT_MAC(v0, v1, v2, u[13], m[8]);+	MONT_MAC(w0, w1, w2, u[14], m[7]);+	MONT_MAC(t0, t1, t2, u[15], m[6]);+	MONT_MAC(v0, v1, v2, u[16], m[5]);+	MONT_MAC(w0, w1, w2, u[17], m[4]);+	MONT_MAC(t0, t1, t2, u[18], m[3]);+	MONT_MAC(v0, v1, v2, u[19], m[2]);+	MONT_MAC(w0, w1, w2, u[20], m[1]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	MONT_ADD(s0, s1, s2, c0, c1, c2);+	MONT_DBL(s0, s1, s2);+	MONT_ADD(t0, t1, t2, s0, s1, s2);+	u[21] = t0 * n0;+	MONT_MAC(t0, t1, t2, u[21], m[0]);+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 22 */+	MONT_MUL(s0, s1, s2, a[0], a[22]);+	MONT_MUL(c0, c1, c2, a[1], a[21]);+	MONT_MAC(s0, s1, s2, a[2], a[20]);+	MONT_MAC(c0, c1, c2, a[3], a[19]);+	MONT_MAC(s0, s1, s2, a[4], a[18]);+	MONT_MAC(c0, c1, c2, a[5], a[17]);+	MONT_MAC(s0, s1, s2, a[6], a[16]);+	MONT_MAC(c0, c1, c2, a[7], a[15]);+	MONT_MAC(s0, s1, s2, a[8], a[14]);+	MONT_MAC(c0, c1, c2, a[9], a[13]);+	MONT_MAC(s0, s1, s2, a[10], a[12]);+	MONT_MAC(t0, t1, t2, a[11], a[11]);+	MONT_MUL(v0, v1, v2, u[0], m[22]);+	MONT_MUL(w0, w1, w2, u[1], m[21]);+	MONT_MAC(t0, t1, t2, u[2], m[20]);+	MONT_MAC(v0, v1, v2, u[3], m[19]);+	MONT_MAC(w0, w1, w2, u[4], m[18]);+	MONT_MAC(t0, t1, t2, u[5], m[17]);+	MONT_MAC(v0, v1, v2, u[6], m[16]);+	MONT_MAC(w0, w1, w2, u[7], m[15]);+	MONT_MAC(t0, t1, t2, u[8], m[14]);+	MONT_MAC(v0, v1, v2, u[9], m[13]);+	MONT_MAC(w0, w1, w2, u[10], m[12]);+	MONT_MAC(t0, t1, t2, u[11], m[11]);+	MONT_MAC(v0, v1, v2, u[12], m[10]);+	MONT_MAC(w0, w1, w2, u[13], m[9]);+	MONT_MAC(t0, t1, t2, u[14], m[8]);+	MONT_MAC(v0, v1, v2, u[15], m[7]);+	MONT_MAC(w0, w1, w2, u[16], m[6]);+	MONT_MAC(t0, t1, t2, u[17], m[5]);+	MONT_MAC(v0, v1, v2, u[18], m[4]);+	MONT_MAC(w0, w1, w2, u[19], m[3]);+	MONT_MAC(t0, t1, t2, u[20], m[2]);+	MONT_MAC(v0, v1, v2, u[21], m[1]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	MONT_ADD(s0, s1, s2, c0, c1, c2);+	MONT_DBL(s0, s1, s2);+	MONT_ADD(t0, t1, t2, s0, s1, s2);+	u[22] = t0 * n0;+	MONT_MAC(t0, t1, t2, u[22], m[0]);+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 23 */+	MONT_MUL(s0, s1, s2, a[0], a[23]);+	MONT_MUL(c0, c1, c2, a[1], a[22]);+	MONT_MAC(s0, s1, s2, a[2], a[21]);+	MONT_MAC(c0, c1, c2, a[3], a[20]);+	MONT_MAC(s0, s1, s2, a[4], a[19]);+	MONT_MAC(c0, c1, c2, a[5], a[18]);+	MONT_MAC(s0, s1, s2, a[6], a[17]);+	MONT_MAC(c0, c1, c2, a[7], a[16]);+	MONT_MAC(s0, s1, s2, a[8], a[15]);+	MONT_MAC(c0, c1, c2, a[9], a[14]);+	MONT_MAC(s0, s1, s2, a[10], a[13]);+	MONT_MAC(c0, c1, c2, a[11], a[12]);+	MONT_MAC(t0, t1, t2, u[0], m[23]);+	MONT_MUL(v0, v1, v2, u[1], m[22]);+	MONT_MUL(w0, w1, w2, u[2], m[21]);+	MONT_MAC(t0, t1, t2, u[3], m[20]);+	MONT_MAC(v0, v1, v2, u[4], m[19]);+	MONT_MAC(w0, w1, w2, u[5], m[18]);+	MONT_MAC(t0, t1, t2, u[6], m[17]);+	MONT_MAC(v0, v1, v2, u[7], m[16]);+	MONT_MAC(w0, w1, w2, u[8], m[15]);+	MONT_MAC(t0, t1, t2, u[9], m[14]);+	MONT_MAC(v0, v1, v2, u[10], m[13]);+	MONT_MAC(w0, w1, w2, u[11], m[12]);+	MONT_MAC(t0, t1, t2, u[12], m[11]);+	MONT_MAC(v0, v1, v2, u[13], m[10]);+	MONT_MAC(w0, w1, w2, u[14], m[9]);+	MONT_MAC(t0, t1, t2, u[15], m[8]);+	MONT_MAC(v0, v1, v2, u[16], m[7]);+	MONT_MAC(w0, w1, w2, u[17], m[6]);+	MONT_MAC(t0, t1, t2, u[18], m[5]);+	MONT_MAC(v0, v1, v2, u[19], m[4]);+	MONT_MAC(w0, w1, w2, u[20], m[3]);+	MONT_MAC(t0, t1, t2, u[21], m[2]);+	MONT_MAC(v0, v1, v2, u[22], m[1]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	MONT_ADD(s0, s1, s2, c0, c1, c2);+	MONT_DBL(s0, s1, s2);+	MONT_ADD(t0, t1, t2, s0, s1, s2);+	u[23] = t0 * n0;+	MONT_MAC(t0, t1, t2, u[23], m[0]);+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 24 */+	MONT_MUL(s0, s1, s2, a[0], a[24]);+	MONT_MUL(c0, c1, c2, a[1], a[23]);+	MONT_MAC(s0, s1, s2, a[2], a[22]);+	MONT_MAC(c0, c1, c2, a[3], a[21]);+	MONT_MAC(s0, s1, s2, a[4], a[20]);+	MONT_MAC(c0, c1, c2, a[5], a[19]);+	MONT_MAC(s0, s1, s2, a[6], a[18]);+	MONT_MAC(c0, c1, c2, a[7], a[17]);+	MONT_MAC(s0, s1, s2, a[8], a[16]);+	MONT_MAC(c0, c1, c2, a[9], a[15]);+	MONT_MAC(s0, s1, s2, a[10], a[14]);+	MONT_MAC(c0, c1, c2, a[11], a[13]);+	MONT_MAC(t0, t1, t2, a[12], a[12]);+	MONT_MUL(v0, v1, v2, u[0], m[24]);+	MONT_MUL(w0, w1, w2, u[1], m[23]);+	MONT_MAC(t0, t1, t2, u[2], m[22]);+	MONT_MAC(v0, v1, v2, u[3], m[21]);+	MONT_MAC(w0, w1, w2, u[4], m[20]);+	MONT_MAC(t0, t1, t2, u[5], m[19]);+	MONT_MAC(v0, v1, v2, u[6], m[18]);+	MONT_MAC(w0, w1, w2, u[7], m[17]);+	MONT_MAC(t0, t1, t2, u[8], m[16]);+	MONT_MAC(v0, v1, v2, u[9], m[15]);+	MONT_MAC(w0, w1, w2, u[10], m[14]);+	MONT_MAC(t0, t1, t2, u[11], m[13]);+	MONT_MAC(v0, v1, v2, u[12], m[12]);+	MONT_MAC(w0, w1, w2, u[13], m[11]);+	MONT_MAC(t0, t1, t2, u[14], m[10]);+	MONT_MAC(v0, v1, v2, u[15], m[9]);+	MONT_MAC(w0, w1, w2, u[16], m[8]);+	MONT_MAC(t0, t1, t2, u[17], m[7]);+	MONT_MAC(v0, v1, v2, u[18], m[6]);+	MONT_MAC(w0, w1, w2, u[19], m[5]);+	MONT_MAC(t0, t1, t2, u[20], m[4]);+	MONT_MAC(v0, v1, v2, u[21], m[3]);+	MONT_MAC(w0, w1, w2, u[22], m[2]);+	MONT_MAC(t0, t1, t2, u[23], m[1]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	MONT_ADD(s0, s1, s2, c0, c1, c2);+	MONT_DBL(s0, s1, s2);+	MONT_ADD(t0, t1, t2, s0, s1, s2);+	u[24] = t0 * n0;+	MONT_MAC(t0, t1, t2, u[24], m[0]);+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 25 */+	MONT_MUL(s0, s1, s2, a[0], a[25]);+	MONT_MUL(c0, c1, c2, a[1], a[24]);+	MONT_MAC(s0, s1, s2, a[2], a[23]);+	MONT_MAC(c0, c1, c2, a[3], a[22]);+	MONT_MAC(s0, s1, s2, a[4], a[21]);+	MONT_MAC(c0, c1, c2, a[5], a[20]);+	MONT_MAC(s0, s1, s2, a[6], a[19]);+	MONT_MAC(c0, c1, c2, a[7], a[18]);+	MONT_MAC(s0, s1, s2, a[8], a[17]);+	MONT_MAC(c0, c1, c2, a[9], a[16]);+	MONT_MAC(s0, s1, s2, a[10], a[15]);+	MONT_MAC(c0, c1, c2, a[11], a[14]);+	MONT_MAC(s0, s1, s2, a[12], a[13]);+	MONT_MAC(t0, t1, t2, u[0], m[25]);+	MONT_MUL(v0, v1, v2, u[1], m[24]);+	MONT_MUL(w0, w1, w2, u[2], m[23]);+	MONT_MAC(t0, t1, t2, u[3], m[22]);+	MONT_MAC(v0, v1, v2, u[4], m[21]);+	MONT_MAC(w0, w1, w2, u[5], m[20]);+	MONT_MAC(t0, t1, t2, u[6], m[19]);+	MONT_MAC(v0, v1, v2, u[7], m[18]);+	MONT_MAC(w0, w1, w2, u[8], m[17]);+	MONT_MAC(t0, t1, t2, u[9], m[16]);+	MONT_MAC(v0, v1, v2, u[10], m[15]);+	MONT_MAC(w0, w1, w2, u[11], m[14]);+	MONT_MAC(t0, t1, t2, u[12], m[13]);+	MONT_MAC(v0, v1, v2, u[13], m[12]);+	MONT_MAC(w0, w1, w2, u[14], m[11]);+	MONT_MAC(t0, t1, t2, u[15], m[10]);+	MONT_MAC(v0, v1, v2, u[16], m[9]);+	MONT_MAC(w0, w1, w2, u[17], m[8]);+	MONT_MAC(t0, t1, t2, u[18], m[7]);+	MONT_MAC(v0, v1, v2, u[19], m[6]);+	MONT_MAC(w0, w1, w2, u[20], m[5]);+	MONT_MAC(t0, t1, t2, u[21], m[4]);+	MONT_MAC(v0, v1, v2, u[22], m[3]);+	MONT_MAC(w0, w1, w2, u[23], m[2]);+	MONT_MAC(t0, t1, t2, u[24], m[1]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	MONT_ADD(s0, s1, s2, c0, c1, c2);+	MONT_DBL(s0, s1, s2);+	MONT_ADD(t0, t1, t2, s0, s1, s2);+	u[25] = t0 * n0;+	MONT_MAC(t0, t1, t2, u[25], m[0]);+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 26 */+	MONT_MUL(s0, s1, s2, a[0], a[26]);+	MONT_MUL(c0, c1, c2, a[1], a[25]);+	MONT_MAC(s0, s1, s2, a[2], a[24]);+	MONT_MAC(c0, c1, c2, a[3], a[23]);+	MONT_MAC(s0, s1, s2, a[4], a[22]);+	MONT_MAC(c0, c1, c2, a[5], a[21]);+	MONT_MAC(s0, s1, s2, a[6], a[20]);+	MONT_MAC(c0, c1, c2, a[7], a[19]);+	MONT_MAC(s0, s1, s2, a[8], a[18]);+	MONT_MAC(c0, c1, c2, a[9], a[17]);+	MONT_MAC(s0, s1, s2, a[10], a[16]);+	MONT_MAC(c0, c1, c2, a[11], a[15]);+	MONT_MAC(s0, s1, s2, a[12], a[14]);+	MONT_MAC(t0, t1, t2, a[13], a[13]);+	MONT_MUL(v0, v1, v2, u[0], m[26]);+	MONT_MUL(w0, w1, w2, u[1], m[25]);+	MONT_MAC(t0, t1, t2, u[2], m[24]);+	MONT_MAC(v0, v1, v2, u[3], m[23]);+	MONT_MAC(w0, w1, w2, u[4], m[22]);+	MONT_MAC(t0, t1, t2, u[5], m[21]);+	MONT_MAC(v0, v1, v2, u[6], m[20]);+	MONT_MAC(w0, w1, w2, u[7], m[19]);+	MONT_MAC(t0, t1, t2, u[8], m[18]);+	MONT_MAC(v0, v1, v2, u[9], m[17]);+	MONT_MAC(w0, w1, w2, u[10], m[16]);+	MONT_MAC(t0, t1, t2, u[11], m[15]);+	MONT_MAC(v0, v1, v2, u[12], m[14]);+	MONT_MAC(w0, w1, w2, u[13], m[13]);+	MONT_MAC(t0, t1, t2, u[14], m[12]);+	MONT_MAC(v0, v1, v2, u[15], m[11]);+	MONT_MAC(w0, w1, w2, u[16], m[10]);+	MONT_MAC(t0, t1, t2, u[17], m[9]);+	MONT_MAC(v0, v1, v2, u[18], m[8]);+	MONT_MAC(w0, w1, w2, u[19], m[7]);+	MONT_MAC(t0, t1, t2, u[20], m[6]);+	MONT_MAC(v0, v1, v2, u[21], m[5]);+	MONT_MAC(w0, w1, w2, u[22], m[4]);+	MONT_MAC(t0, t1, t2, u[23], m[3]);+	MONT_MAC(v0, v1, v2, u[24], m[2]);+	MONT_MAC(w0, w1, w2, u[25], m[1]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	MONT_ADD(s0, s1, s2, c0, c1, c2);+	MONT_DBL(s0, s1, s2);+	MONT_ADD(t0, t1, t2, s0, s1, s2);+	u[26] = t0 * n0;+	MONT_MAC(t0, t1, t2, u[26], m[0]);+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 27 */+	MONT_MUL(s0, s1, s2, a[0], a[27]);+	MONT_MUL(c0, c1, c2, a[1], a[26]);+	MONT_MAC(s0, s1, s2, a[2], a[25]);+	MONT_MAC(c0, c1, c2, a[3], a[24]);+	MONT_MAC(s0, s1, s2, a[4], a[23]);+	MONT_MAC(c0, c1, c2, a[5], a[22]);+	MONT_MAC(s0, s1, s2, a[6], a[21]);+	MONT_MAC(c0, c1, c2, a[7], a[20]);+	MONT_MAC(s0, s1, s2, a[8], a[19]);+	MONT_MAC(c0, c1, c2, a[9], a[18]);+	MONT_MAC(s0, s1, s2, a[10], a[17]);+	MONT_MAC(c0, c1, c2, a[11], a[16]);+	MONT_MAC(s0, s1, s2, a[12], a[15]);+	MONT_MAC(c0, c1, c2, a[13], a[14]);+	MONT_MAC(t0, t1, t2, u[0], m[27]);+	MONT_MUL(v0, v1, v2, u[1], m[26]);+	MONT_MUL(w0, w1, w2, u[2], m[25]);+	MONT_MAC(t0, t1, t2, u[3], m[24]);+	MONT_MAC(v0, v1, v2, u[4], m[23]);+	MONT_MAC(w0, w1, w2, u[5], m[22]);+	MONT_MAC(t0, t1, t2, u[6], m[21]);+	MONT_MAC(v0, v1, v2, u[7], m[20]);+	MONT_MAC(w0, w1, w2, u[8], m[19]);+	MONT_MAC(t0, t1, t2, u[9], m[18]);+	MONT_MAC(v0, v1, v2, u[10], m[17]);+	MONT_MAC(w0, w1, w2, u[11], m[16]);+	MONT_MAC(t0, t1, t2, u[12], m[15]);+	MONT_MAC(v0, v1, v2, u[13], m[14]);+	MONT_MAC(w0, w1, w2, u[14], m[13]);+	MONT_MAC(t0, t1, t2, u[15], m[12]);+	MONT_MAC(v0, v1, v2, u[16], m[11]);+	MONT_MAC(w0, w1, w2, u[17], m[10]);+	MONT_MAC(t0, t1, t2, u[18], m[9]);+	MONT_MAC(v0, v1, v2, u[19], m[8]);+	MONT_MAC(w0, w1, w2, u[20], m[7]);+	MONT_MAC(t0, t1, t2, u[21], m[6]);+	MONT_MAC(v0, v1, v2, u[22], m[5]);+	MONT_MAC(w0, w1, w2, u[23], m[4]);+	MONT_MAC(t0, t1, t2, u[24], m[3]);+	MONT_MAC(v0, v1, v2, u[25], m[2]);+	MONT_MAC(w0, w1, w2, u[26], m[1]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	MONT_ADD(s0, s1, s2, c0, c1, c2);+	MONT_DBL(s0, s1, s2);+	MONT_ADD(t0, t1, t2, s0, s1, s2);+	u[27] = t0 * n0;+	MONT_MAC(t0, t1, t2, u[27], m[0]);+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 28 */+	MONT_MUL(s0, s1, s2, a[0], a[28]);+	MONT_MUL(c0, c1, c2, a[1], a[27]);+	MONT_MAC(s0, s1, s2, a[2], a[26]);+	MONT_MAC(c0, c1, c2, a[3], a[25]);+	MONT_MAC(s0, s1, s2, a[4], a[24]);+	MONT_MAC(c0, c1, c2, a[5], a[23]);+	MONT_MAC(s0, s1, s2, a[6], a[22]);+	MONT_MAC(c0, c1, c2, a[7], a[21]);+	MONT_MAC(s0, s1, s2, a[8], a[20]);+	MONT_MAC(c0, c1, c2, a[9], a[19]);+	MONT_MAC(s0, s1, s2, a[10], a[18]);+	MONT_MAC(c0, c1, c2, a[11], a[17]);+	MONT_MAC(s0, s1, s2, a[12], a[16]);+	MONT_MAC(c0, c1, c2, a[13], a[15]);+	MONT_MAC(t0, t1, t2, a[14], a[14]);+	MONT_MUL(v0, v1, v2, u[0], m[28]);+	MONT_MUL(w0, w1, w2, u[1], m[27]);+	MONT_MAC(t0, t1, t2, u[2], m[26]);+	MONT_MAC(v0, v1, v2, u[3], m[25]);+	MONT_MAC(w0, w1, w2, u[4], m[24]);+	MONT_MAC(t0, t1, t2, u[5], m[23]);+	MONT_MAC(v0, v1, v2, u[6], m[22]);+	MONT_MAC(w0, w1, w2, u[7], m[21]);+	MONT_MAC(t0, t1, t2, u[8], m[20]);+	MONT_MAC(v0, v1, v2, u[9], m[19]);+	MONT_MAC(w0, w1, w2, u[10], m[18]);+	MONT_MAC(t0, t1, t2, u[11], m[17]);+	MONT_MAC(v0, v1, v2, u[12], m[16]);+	MONT_MAC(w0, w1, w2, u[13], m[15]);+	MONT_MAC(t0, t1, t2, u[14], m[14]);+	MONT_MAC(v0, v1, v2, u[15], m[13]);+	MONT_MAC(w0, w1, w2, u[16], m[12]);+	MONT_MAC(t0, t1, t2, u[17], m[11]);+	MONT_MAC(v0, v1, v2, u[18], m[10]);+	MONT_MAC(w0, w1, w2, u[19], m[9]);+	MONT_MAC(t0, t1, t2, u[20], m[8]);+	MONT_MAC(v0, v1, v2, u[21], m[7]);+	MONT_MAC(w0, w1, w2, u[22], m[6]);+	MONT_MAC(t0, t1, t2, u[23], m[5]);+	MONT_MAC(v0, v1, v2, u[24], m[4]);+	MONT_MAC(w0, w1, w2, u[25], m[3]);+	MONT_MAC(t0, t1, t2, u[26], m[2]);+	MONT_MAC(v0, v1, v2, u[27], m[1]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	MONT_ADD(s0, s1, s2, c0, c1, c2);+	MONT_DBL(s0, s1, s2);+	MONT_ADD(t0, t1, t2, s0, s1, s2);+	u[28] = t0 * n0;+	MONT_MAC(t0, t1, t2, u[28], m[0]);+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 29 */+	MONT_MUL(s0, s1, s2, a[0], a[29]);+	MONT_MUL(c0, c1, c2, a[1], a[28]);+	MONT_MAC(s0, s1, s2, a[2], a[27]);+	MONT_MAC(c0, c1, c2, a[3], a[26]);+	MONT_MAC(s0, s1, s2, a[4], a[25]);+	MONT_MAC(c0, c1, c2, a[5], a[24]);+	MONT_MAC(s0, s1, s2, a[6], a[23]);+	MONT_MAC(c0, c1, c2, a[7], a[22]);+	MONT_MAC(s0, s1, s2, a[8], a[21]);+	MONT_MAC(c0, c1, c2, a[9], a[20]);+	MONT_MAC(s0, s1, s2, a[10], a[19]);+	MONT_MAC(c0, c1, c2, a[11], a[18]);+	MONT_MAC(s0, s1, s2, a[12], a[17]);+	MONT_MAC(c0, c1, c2, a[13], a[16]);+	MONT_MAC(s0, s1, s2, a[14], a[15]);+	MONT_MAC(t0, t1, t2, u[0], m[29]);+	MONT_MUL(v0, v1, v2, u[1], m[28]);+	MONT_MUL(w0, w1, w2, u[2], m[27]);+	MONT_MAC(t0, t1, t2, u[3], m[26]);+	MONT_MAC(v0, v1, v2, u[4], m[25]);+	MONT_MAC(w0, w1, w2, u[5], m[24]);+	MONT_MAC(t0, t1, t2, u[6], m[23]);+	MONT_MAC(v0, v1, v2, u[7], m[22]);+	MONT_MAC(w0, w1, w2, u[8], m[21]);+	MONT_MAC(t0, t1, t2, u[9], m[20]);+	MONT_MAC(v0, v1, v2, u[10], m[19]);+	MONT_MAC(w0, w1, w2, u[11], m[18]);+	MONT_MAC(t0, t1, t2, u[12], m[17]);+	MONT_MAC(v0, v1, v2, u[13], m[16]);+	MONT_MAC(w0, w1, w2, u[14], m[15]);+	MONT_MAC(t0, t1, t2, u[15], m[14]);+	MONT_MAC(v0, v1, v2, u[16], m[13]);+	MONT_MAC(w0, w1, w2, u[17], m[12]);+	MONT_MAC(t0, t1, t2, u[18], m[11]);+	MONT_MAC(v0, v1, v2, u[19], m[10]);+	MONT_MAC(w0, w1, w2, u[20], m[9]);+	MONT_MAC(t0, t1, t2, u[21], m[8]);+	MONT_MAC(v0, v1, v2, u[22], m[7]);+	MONT_MAC(w0, w1, w2, u[23], m[6]);+	MONT_MAC(t0, t1, t2, u[24], m[5]);+	MONT_MAC(v0, v1, v2, u[25], m[4]);+	MONT_MAC(w0, w1, w2, u[26], m[3]);+	MONT_MAC(t0, t1, t2, u[27], m[2]);+	MONT_MAC(v0, v1, v2, u[28], m[1]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	MONT_ADD(s0, s1, s2, c0, c1, c2);+	MONT_DBL(s0, s1, s2);+	MONT_ADD(t0, t1, t2, s0, s1, s2);+	u[29] = t0 * n0;+	MONT_MAC(t0, t1, t2, u[29], m[0]);+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 30 */+	MONT_MUL(s0, s1, s2, a[0], a[30]);+	MONT_MUL(c0, c1, c2, a[1], a[29]);+	MONT_MAC(s0, s1, s2, a[2], a[28]);+	MONT_MAC(c0, c1, c2, a[3], a[27]);+	MONT_MAC(s0, s1, s2, a[4], a[26]);+	MONT_MAC(c0, c1, c2, a[5], a[25]);+	MONT_MAC(s0, s1, s2, a[6], a[24]);+	MONT_MAC(c0, c1, c2, a[7], a[23]);+	MONT_MAC(s0, s1, s2, a[8], a[22]);+	MONT_MAC(c0, c1, c2, a[9], a[21]);+	MONT_MAC(s0, s1, s2, a[10], a[20]);+	MONT_MAC(c0, c1, c2, a[11], a[19]);+	MONT_MAC(s0, s1, s2, a[12], a[18]);+	MONT_MAC(c0, c1, c2, a[13], a[17]);+	MONT_MAC(s0, s1, s2, a[14], a[16]);+	MONT_MAC(t0, t1, t2, a[15], a[15]);+	MONT_MUL(v0, v1, v2, u[0], m[30]);+	MONT_MUL(w0, w1, w2, u[1], m[29]);+	MONT_MAC(t0, t1, t2, u[2], m[28]);+	MONT_MAC(v0, v1, v2, u[3], m[27]);+	MONT_MAC(w0, w1, w2, u[4], m[26]);+	MONT_MAC(t0, t1, t2, u[5], m[25]);+	MONT_MAC(v0, v1, v2, u[6], m[24]);+	MONT_MAC(w0, w1, w2, u[7], m[23]);+	MONT_MAC(t0, t1, t2, u[8], m[22]);+	MONT_MAC(v0, v1, v2, u[9], m[21]);+	MONT_MAC(w0, w1, w2, u[10], m[20]);+	MONT_MAC(t0, t1, t2, u[11], m[19]);+	MONT_MAC(v0, v1, v2, u[12], m[18]);+	MONT_MAC(w0, w1, w2, u[13], m[17]);+	MONT_MAC(t0, t1, t2, u[14], m[16]);+	MONT_MAC(v0, v1, v2, u[15], m[15]);+	MONT_MAC(w0, w1, w2, u[16], m[14]);+	MONT_MAC(t0, t1, t2, u[17], m[13]);+	MONT_MAC(v0, v1, v2, u[18], m[12]);+	MONT_MAC(w0, w1, w2, u[19], m[11]);+	MONT_MAC(t0, t1, t2, u[20], m[10]);+	MONT_MAC(v0, v1, v2, u[21], m[9]);+	MONT_MAC(w0, w1, w2, u[22], m[8]);+	MONT_MAC(t0, t1, t2, u[23], m[7]);+	MONT_MAC(v0, v1, v2, u[24], m[6]);+	MONT_MAC(w0, w1, w2, u[25], m[5]);+	MONT_MAC(t0, t1, t2, u[26], m[4]);+	MONT_MAC(v0, v1, v2, u[27], m[3]);+	MONT_MAC(w0, w1, w2, u[28], m[2]);+	MONT_MAC(t0, t1, t2, u[29], m[1]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	MONT_ADD(s0, s1, s2, c0, c1, c2);+	MONT_DBL(s0, s1, s2);+	MONT_ADD(t0, t1, t2, s0, s1, s2);+	u[30] = t0 * n0;+	MONT_MAC(t0, t1, t2, u[30], m[0]);+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 31 */+	MONT_MUL(s0, s1, s2, a[0], a[31]);+	MONT_MUL(c0, c1, c2, a[1], a[30]);+	MONT_MAC(s0, s1, s2, a[2], a[29]);+	MONT_MAC(c0, c1, c2, a[3], a[28]);+	MONT_MAC(s0, s1, s2, a[4], a[27]);+	MONT_MAC(c0, c1, c2, a[5], a[26]);+	MONT_MAC(s0, s1, s2, a[6], a[25]);+	MONT_MAC(c0, c1, c2, a[7], a[24]);+	MONT_MAC(s0, s1, s2, a[8], a[23]);+	MONT_MAC(c0, c1, c2, a[9], a[22]);+	MONT_MAC(s0, s1, s2, a[10], a[21]);+	MONT_MAC(c0, c1, c2, a[11], a[20]);+	MONT_MAC(s0, s1, s2, a[12], a[19]);+	MONT_MAC(c0, c1, c2, a[13], a[18]);+	MONT_MAC(s0, s1, s2, a[14], a[17]);+	MONT_MAC(c0, c1, c2, a[15], a[16]);+	MONT_MAC(t0, t1, t2, u[0], m[31]);+	MONT_MUL(v0, v1, v2, u[1], m[30]);+	MONT_MUL(w0, w1, w2, u[2], m[29]);+	MONT_MAC(t0, t1, t2, u[3], m[28]);+	MONT_MAC(v0, v1, v2, u[4], m[27]);+	MONT_MAC(w0, w1, w2, u[5], m[26]);+	MONT_MAC(t0, t1, t2, u[6], m[25]);+	MONT_MAC(v0, v1, v2, u[7], m[24]);+	MONT_MAC(w0, w1, w2, u[8], m[23]);+	MONT_MAC(t0, t1, t2, u[9], m[22]);+	MONT_MAC(v0, v1, v2, u[10], m[21]);+	MONT_MAC(w0, w1, w2, u[11], m[20]);+	MONT_MAC(t0, t1, t2, u[12], m[19]);+	MONT_MAC(v0, v1, v2, u[13], m[18]);+	MONT_MAC(w0, w1, w2, u[14], m[17]);+	MONT_MAC(t0, t1, t2, u[15], m[16]);+	MONT_MAC(v0, v1, v2, u[16], m[15]);+	MONT_MAC(w0, w1, w2, u[17], m[14]);+	MONT_MAC(t0, t1, t2, u[18], m[13]);+	MONT_MAC(v0, v1, v2, u[19], m[12]);+	MONT_MAC(w0, w1, w2, u[20], m[11]);+	MONT_MAC(t0, t1, t2, u[21], m[10]);+	MONT_MAC(v0, v1, v2, u[22], m[9]);+	MONT_MAC(w0, w1, w2, u[23], m[8]);+	MONT_MAC(t0, t1, t2, u[24], m[7]);+	MONT_MAC(v0, v1, v2, u[25], m[6]);+	MONT_MAC(w0, w1, w2, u[26], m[5]);+	MONT_MAC(t0, t1, t2, u[27], m[4]);+	MONT_MAC(v0, v1, v2, u[28], m[3]);+	MONT_MAC(w0, w1, w2, u[29], m[2]);+	MONT_MAC(t0, t1, t2, u[30], m[1]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	MONT_ADD(s0, s1, s2, c0, c1, c2);+	MONT_DBL(s0, s1, s2);+	MONT_ADD(t0, t1, t2, s0, s1, s2);+	u[31] = t0 * n0;+	MONT_MAC(t0, t1, t2, u[31], m[0]);+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 32 */+	MONT_MUL(s0, s1, s2, a[0], a[32]);+	MONT_MUL(c0, c1, c2, a[1], a[31]);+	MONT_MAC(s0, s1, s2, a[2], a[30]);+	MONT_MAC(c0, c1, c2, a[3], a[29]);+	MONT_MAC(s0, s1, s2, a[4], a[28]);+	MONT_MAC(c0, c1, c2, a[5], a[27]);+	MONT_MAC(s0, s1, s2, a[6], a[26]);+	MONT_MAC(c0, c1, c2, a[7], a[25]);+	MONT_MAC(s0, s1, s2, a[8], a[24]);+	MONT_MAC(c0, c1, c2, a[9], a[23]);+	MONT_MAC(s0, s1, s2, a[10], a[22]);+	MONT_MAC(c0, c1, c2, a[11], a[21]);+	MONT_MAC(s0, s1, s2, a[12], a[20]);+	MONT_MAC(c0, c1, c2, a[13], a[19]);+	MONT_MAC(s0, s1, s2, a[14], a[18]);+	MONT_MAC(c0, c1, c2, a[15], a[17]);+	MONT_MAC(t0, t1, t2, a[16], a[16]);+	MONT_MUL(v0, v1, v2, u[0], m[32]);+	MONT_MUL(w0, w1, w2, u[1], m[31]);+	MONT_MAC(t0, t1, t2, u[2], m[30]);+	MONT_MAC(v0, v1, v2, u[3], m[29]);+	MONT_MAC(w0, w1, w2, u[4], m[28]);+	MONT_MAC(t0, t1, t2, u[5], m[27]);+	MONT_MAC(v0, v1, v2, u[6], m[26]);+	MONT_MAC(w0, w1, w2, u[7], m[25]);+	MONT_MAC(t0, t1, t2, u[8], m[24]);+	MONT_MAC(v0, v1, v2, u[9], m[23]);+	MONT_MAC(w0, w1, w2, u[10], m[22]);+	MONT_MAC(t0, t1, t2, u[11], m[21]);+	MONT_MAC(v0, v1, v2, u[12], m[20]);+	MONT_MAC(w0, w1, w2, u[13], m[19]);+	MONT_MAC(t0, t1, t2, u[14], m[18]);+	MONT_MAC(v0, v1, v2, u[15], m[17]);+	MONT_MAC(w0, w1, w2, u[16], m[16]);+	MONT_MAC(t0, t1, t2, u[17], m[15]);+	MONT_MAC(v0, v1, v2, u[18], m[14]);+	MONT_MAC(w0, w1, w2, u[19], m[13]);+	MONT_MAC(t0, t1, t2, u[20], m[12]);+	MONT_MAC(v0, v1, v2, u[21], m[11]);+	MONT_MAC(w0, w1, w2, u[22], m[10]);+	MONT_MAC(t0, t1, t2, u[23], m[9]);+	MONT_MAC(v0, v1, v2, u[24], m[8]);+	MONT_MAC(w0, w1, w2, u[25], m[7]);+	MONT_MAC(t0, t1, t2, u[26], m[6]);+	MONT_MAC(v0, v1, v2, u[27], m[5]);+	MONT_MAC(w0, w1, w2, u[28], m[4]);+	MONT_MAC(t0, t1, t2, u[29], m[3]);+	MONT_MAC(v0, v1, v2, u[30], m[2]);+	MONT_MAC(w0, w1, w2, u[31], m[1]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	MONT_ADD(s0, s1, s2, c0, c1, c2);+	MONT_DBL(s0, s1, s2);+	MONT_ADD(t0, t1, t2, s0, s1, s2);+	u[32] = t0 * n0;+	MONT_MAC(t0, t1, t2, u[32], m[0]);+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 33 */+	MONT_MUL(s0, s1, s2, a[0], a[33]);+	MONT_MUL(c0, c1, c2, a[1], a[32]);+	MONT_MAC(s0, s1, s2, a[2], a[31]);+	MONT_MAC(c0, c1, c2, a[3], a[30]);+	MONT_MAC(s0, s1, s2, a[4], a[29]);+	MONT_MAC(c0, c1, c2, a[5], a[28]);+	MONT_MAC(s0, s1, s2, a[6], a[27]);+	MONT_MAC(c0, c1, c2, a[7], a[26]);+	MONT_MAC(s0, s1, s2, a[8], a[25]);+	MONT_MAC(c0, c1, c2, a[9], a[24]);+	MONT_MAC(s0, s1, s2, a[10], a[23]);+	MONT_MAC(c0, c1, c2, a[11], a[22]);+	MONT_MAC(s0, s1, s2, a[12], a[21]);+	MONT_MAC(c0, c1, c2, a[13], a[20]);+	MONT_MAC(s0, s1, s2, a[14], a[19]);+	MONT_MAC(c0, c1, c2, a[15], a[18]);+	MONT_MAC(s0, s1, s2, a[16], a[17]);+	MONT_MAC(t0, t1, t2, u[0], m[33]);+	MONT_MUL(v0, v1, v2, u[1], m[32]);+	MONT_MUL(w0, w1, w2, u[2], m[31]);+	MONT_MAC(t0, t1, t2, u[3], m[30]);+	MONT_MAC(v0, v1, v2, u[4], m[29]);+	MONT_MAC(w0, w1, w2, u[5], m[28]);+	MONT_MAC(t0, t1, t2, u[6], m[27]);+	MONT_MAC(v0, v1, v2, u[7], m[26]);+	MONT_MAC(w0, w1, w2, u[8], m[25]);+	MONT_MAC(t0, t1, t2, u[9], m[24]);+	MONT_MAC(v0, v1, v2, u[10], m[23]);+	MONT_MAC(w0, w1, w2, u[11], m[22]);+	MONT_MAC(t0, t1, t2, u[12], m[21]);+	MONT_MAC(v0, v1, v2, u[13], m[20]);+	MONT_MAC(w0, w1, w2, u[14], m[19]);+	MONT_MAC(t0, t1, t2, u[15], m[18]);+	MONT_MAC(v0, v1, v2, u[16], m[17]);+	MONT_MAC(w0, w1, w2, u[17], m[16]);+	MONT_MAC(t0, t1, t2, u[18], m[15]);+	MONT_MAC(v0, v1, v2, u[19], m[14]);+	MONT_MAC(w0, w1, w2, u[20], m[13]);+	MONT_MAC(t0, t1, t2, u[21], m[12]);+	MONT_MAC(v0, v1, v2, u[22], m[11]);+	MONT_MAC(w0, w1, w2, u[23], m[10]);+	MONT_MAC(t0, t1, t2, u[24], m[9]);+	MONT_MAC(v0, v1, v2, u[25], m[8]);+	MONT_MAC(w0, w1, w2, u[26], m[7]);+	MONT_MAC(t0, t1, t2, u[27], m[6]);+	MONT_MAC(v0, v1, v2, u[28], m[5]);+	MONT_MAC(w0, w1, w2, u[29], m[4]);+	MONT_MAC(t0, t1, t2, u[30], m[3]);+	MONT_MAC(v0, v1, v2, u[31], m[2]);+	MONT_MAC(w0, w1, w2, u[32], m[1]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	MONT_ADD(s0, s1, s2, c0, c1, c2);+	MONT_DBL(s0, s1, s2);+	MONT_ADD(t0, t1, t2, s0, s1, s2);+	u[33] = t0 * n0;+	MONT_MAC(t0, t1, t2, u[33], m[0]);+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 34 */+	MONT_MUL(s0, s1, s2, a[0], a[34]);+	MONT_MUL(c0, c1, c2, a[1], a[33]);+	MONT_MAC(s0, s1, s2, a[2], a[32]);+	MONT_MAC(c0, c1, c2, a[3], a[31]);+	MONT_MAC(s0, s1, s2, a[4], a[30]);+	MONT_MAC(c0, c1, c2, a[5], a[29]);+	MONT_MAC(s0, s1, s2, a[6], a[28]);+	MONT_MAC(c0, c1, c2, a[7], a[27]);+	MONT_MAC(s0, s1, s2, a[8], a[26]);+	MONT_MAC(c0, c1, c2, a[9], a[25]);+	MONT_MAC(s0, s1, s2, a[10], a[24]);+	MONT_MAC(c0, c1, c2, a[11], a[23]);+	MONT_MAC(s0, s1, s2, a[12], a[22]);+	MONT_MAC(c0, c1, c2, a[13], a[21]);+	MONT_MAC(s0, s1, s2, a[14], a[20]);+	MONT_MAC(c0, c1, c2, a[15], a[19]);+	MONT_MAC(s0, s1, s2, a[16], a[18]);+	MONT_MAC(t0, t1, t2, a[17], a[17]);+	MONT_MUL(v0, v1, v2, u[0], m[34]);+	MONT_MUL(w0, w1, w2, u[1], m[33]);+	MONT_MAC(t0, t1, t2, u[2], m[32]);+	MONT_MAC(v0, v1, v2, u[3], m[31]);+	MONT_MAC(w0, w1, w2, u[4], m[30]);+	MONT_MAC(t0, t1, t2, u[5], m[29]);+	MONT_MAC(v0, v1, v2, u[6], m[28]);+	MONT_MAC(w0, w1, w2, u[7], m[27]);+	MONT_MAC(t0, t1, t2, u[8], m[26]);+	MONT_MAC(v0, v1, v2, u[9], m[25]);+	MONT_MAC(w0, w1, w2, u[10], m[24]);+	MONT_MAC(t0, t1, t2, u[11], m[23]);+	MONT_MAC(v0, v1, v2, u[12], m[22]);+	MONT_MAC(w0, w1, w2, u[13], m[21]);+	MONT_MAC(t0, t1, t2, u[14], m[20]);+	MONT_MAC(v0, v1, v2, u[15], m[19]);+	MONT_MAC(w0, w1, w2, u[16], m[18]);+	MONT_MAC(t0, t1, t2, u[17], m[17]);+	MONT_MAC(v0, v1, v2, u[18], m[16]);+	MONT_MAC(w0, w1, w2, u[19], m[15]);+	MONT_MAC(t0, t1, t2, u[20], m[14]);+	MONT_MAC(v0, v1, v2, u[21], m[13]);+	MONT_MAC(w0, w1, w2, u[22], m[12]);+	MONT_MAC(t0, t1, t2, u[23], m[11]);+	MONT_MAC(v0, v1, v2, u[24], m[10]);+	MONT_MAC(w0, w1, w2, u[25], m[9]);+	MONT_MAC(t0, t1, t2, u[26], m[8]);+	MONT_MAC(v0, v1, v2, u[27], m[7]);+	MONT_MAC(w0, w1, w2, u[28], m[6]);+	MONT_MAC(t0, t1, t2, u[29], m[5]);+	MONT_MAC(v0, v1, v2, u[30], m[4]);+	MONT_MAC(w0, w1, w2, u[31], m[3]);+	MONT_MAC(t0, t1, t2, u[32], m[2]);+	MONT_MAC(v0, v1, v2, u[33], m[1]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	MONT_ADD(s0, s1, s2, c0, c1, c2);+	MONT_DBL(s0, s1, s2);+	MONT_ADD(t0, t1, t2, s0, s1, s2);+	u[34] = t0 * n0;+	MONT_MAC(t0, t1, t2, u[34], m[0]);+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 35 */+	MONT_MUL(s0, s1, s2, a[0], a[35]);+	MONT_MUL(c0, c1, c2, a[1], a[34]);+	MONT_MAC(s0, s1, s2, a[2], a[33]);+	MONT_MAC(c0, c1, c2, a[3], a[32]);+	MONT_MAC(s0, s1, s2, a[4], a[31]);+	MONT_MAC(c0, c1, c2, a[5], a[30]);+	MONT_MAC(s0, s1, s2, a[6], a[29]);+	MONT_MAC(c0, c1, c2, a[7], a[28]);+	MONT_MAC(s0, s1, s2, a[8], a[27]);+	MONT_MAC(c0, c1, c2, a[9], a[26]);+	MONT_MAC(s0, s1, s2, a[10], a[25]);+	MONT_MAC(c0, c1, c2, a[11], a[24]);+	MONT_MAC(s0, s1, s2, a[12], a[23]);+	MONT_MAC(c0, c1, c2, a[13], a[22]);+	MONT_MAC(s0, s1, s2, a[14], a[21]);+	MONT_MAC(c0, c1, c2, a[15], a[20]);+	MONT_MAC(s0, s1, s2, a[16], a[19]);+	MONT_MAC(c0, c1, c2, a[17], a[18]);+	MONT_MAC(t0, t1, t2, u[0], m[35]);+	MONT_MUL(v0, v1, v2, u[1], m[34]);+	MONT_MUL(w0, w1, w2, u[2], m[33]);+	MONT_MAC(t0, t1, t2, u[3], m[32]);+	MONT_MAC(v0, v1, v2, u[4], m[31]);+	MONT_MAC(w0, w1, w2, u[5], m[30]);+	MONT_MAC(t0, t1, t2, u[6], m[29]);+	MONT_MAC(v0, v1, v2, u[7], m[28]);+	MONT_MAC(w0, w1, w2, u[8], m[27]);+	MONT_MAC(t0, t1, t2, u[9], m[26]);+	MONT_MAC(v0, v1, v2, u[10], m[25]);+	MONT_MAC(w0, w1, w2, u[11], m[24]);+	MONT_MAC(t0, t1, t2, u[12], m[23]);+	MONT_MAC(v0, v1, v2, u[13], m[22]);+	MONT_MAC(w0, w1, w2, u[14], m[21]);+	MONT_MAC(t0, t1, t2, u[15], m[20]);+	MONT_MAC(v0, v1, v2, u[16], m[19]);+	MONT_MAC(w0, w1, w2, u[17], m[18]);+	MONT_MAC(t0, t1, t2, u[18], m[17]);+	MONT_MAC(v0, v1, v2, u[19], m[16]);+	MONT_MAC(w0, w1, w2, u[20], m[15]);+	MONT_MAC(t0, t1, t2, u[21], m[14]);+	MONT_MAC(v0, v1, v2, u[22], m[13]);+	MONT_MAC(w0, w1, w2, u[23], m[12]);+	MONT_MAC(t0, t1, t2, u[24], m[11]);+	MONT_MAC(v0, v1, v2, u[25], m[10]);+	MONT_MAC(w0, w1, w2, u[26], m[9]);+	MONT_MAC(t0, t1, t2, u[27], m[8]);+	MONT_MAC(v0, v1, v2, u[28], m[7]);+	MONT_MAC(w0, w1, w2, u[29], m[6]);+	MONT_MAC(t0, t1, t2, u[30], m[5]);+	MONT_MAC(v0, v1, v2, u[31], m[4]);+	MONT_MAC(w0, w1, w2, u[32], m[3]);+	MONT_MAC(t0, t1, t2, u[33], m[2]);+	MONT_MAC(v0, v1, v2, u[34], m[1]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	MONT_ADD(s0, s1, s2, c0, c1, c2);+	MONT_DBL(s0, s1, s2);+	MONT_ADD(t0, t1, t2, s0, s1, s2);+	u[35] = t0 * n0;+	MONT_MAC(t0, t1, t2, u[35], m[0]);+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 36 */+	MONT_MUL(s0, s1, s2, a[0], a[36]);+	MONT_MUL(c0, c1, c2, a[1], a[35]);+	MONT_MAC(s0, s1, s2, a[2], a[34]);+	MONT_MAC(c0, c1, c2, a[3], a[33]);+	MONT_MAC(s0, s1, s2, a[4], a[32]);+	MONT_MAC(c0, c1, c2, a[5], a[31]);+	MONT_MAC(s0, s1, s2, a[6], a[30]);+	MONT_MAC(c0, c1, c2, a[7], a[29]);+	MONT_MAC(s0, s1, s2, a[8], a[28]);+	MONT_MAC(c0, c1, c2, a[9], a[27]);+	MONT_MAC(s0, s1, s2, a[10], a[26]);+	MONT_MAC(c0, c1, c2, a[11], a[25]);+	MONT_MAC(s0, s1, s2, a[12], a[24]);+	MONT_MAC(c0, c1, c2, a[13], a[23]);+	MONT_MAC(s0, s1, s2, a[14], a[22]);+	MONT_MAC(c0, c1, c2, a[15], a[21]);+	MONT_MAC(s0, s1, s2, a[16], a[20]);+	MONT_MAC(c0, c1, c2, a[17], a[19]);+	MONT_MAC(t0, t1, t2, a[18], a[18]);+	MONT_MUL(v0, v1, v2, u[0], m[36]);+	MONT_MUL(w0, w1, w2, u[1], m[35]);+	MONT_MAC(t0, t1, t2, u[2], m[34]);+	MONT_MAC(v0, v1, v2, u[3], m[33]);+	MONT_MAC(w0, w1, w2, u[4], m[32]);+	MONT_MAC(t0, t1, t2, u[5], m[31]);+	MONT_MAC(v0, v1, v2, u[6], m[30]);+	MONT_MAC(w0, w1, w2, u[7], m[29]);+	MONT_MAC(t0, t1, t2, u[8], m[28]);+	MONT_MAC(v0, v1, v2, u[9], m[27]);+	MONT_MAC(w0, w1, w2, u[10], m[26]);+	MONT_MAC(t0, t1, t2, u[11], m[25]);+	MONT_MAC(v0, v1, v2, u[12], m[24]);+	MONT_MAC(w0, w1, w2, u[13], m[23]);+	MONT_MAC(t0, t1, t2, u[14], m[22]);+	MONT_MAC(v0, v1, v2, u[15], m[21]);+	MONT_MAC(w0, w1, w2, u[16], m[20]);+	MONT_MAC(t0, t1, t2, u[17], m[19]);+	MONT_MAC(v0, v1, v2, u[18], m[18]);+	MONT_MAC(w0, w1, w2, u[19], m[17]);+	MONT_MAC(t0, t1, t2, u[20], m[16]);+	MONT_MAC(v0, v1, v2, u[21], m[15]);+	MONT_MAC(w0, w1, w2, u[22], m[14]);+	MONT_MAC(t0, t1, t2, u[23], m[13]);+	MONT_MAC(v0, v1, v2, u[24], m[12]);+	MONT_MAC(w0, w1, w2, u[25], m[11]);+	MONT_MAC(t0, t1, t2, u[26], m[10]);+	MONT_MAC(v0, v1, v2, u[27], m[9]);+	MONT_MAC(w0, w1, w2, u[28], m[8]);+	MONT_MAC(t0, t1, t2, u[29], m[7]);+	MONT_MAC(v0, v1, v2, u[30], m[6]);+	MONT_MAC(w0, w1, w2, u[31], m[5]);+	MONT_MAC(t0, t1, t2, u[32], m[4]);+	MONT_MAC(v0, v1, v2, u[33], m[3]);+	MONT_MAC(w0, w1, w2, u[34], m[2]);+	MONT_MAC(t0, t1, t2, u[35], m[1]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	MONT_ADD(s0, s1, s2, c0, c1, c2);+	MONT_DBL(s0, s1, s2);+	MONT_ADD(t0, t1, t2, s0, s1, s2);+	u[36] = t0 * n0;+	MONT_MAC(t0, t1, t2, u[36], m[0]);+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 37 */+	MONT_MUL(s0, s1, s2, a[0], a[37]);+	MONT_MUL(c0, c1, c2, a[1], a[36]);+	MONT_MAC(s0, s1, s2, a[2], a[35]);+	MONT_MAC(c0, c1, c2, a[3], a[34]);+	MONT_MAC(s0, s1, s2, a[4], a[33]);+	MONT_MAC(c0, c1, c2, a[5], a[32]);+	MONT_MAC(s0, s1, s2, a[6], a[31]);+	MONT_MAC(c0, c1, c2, a[7], a[30]);+	MONT_MAC(s0, s1, s2, a[8], a[29]);+	MONT_MAC(c0, c1, c2, a[9], a[28]);+	MONT_MAC(s0, s1, s2, a[10], a[27]);+	MONT_MAC(c0, c1, c2, a[11], a[26]);+	MONT_MAC(s0, s1, s2, a[12], a[25]);+	MONT_MAC(c0, c1, c2, a[13], a[24]);+	MONT_MAC(s0, s1, s2, a[14], a[23]);+	MONT_MAC(c0, c1, c2, a[15], a[22]);+	MONT_MAC(s0, s1, s2, a[16], a[21]);+	MONT_MAC(c0, c1, c2, a[17], a[20]);+	MONT_MAC(s0, s1, s2, a[18], a[19]);+	MONT_MAC(t0, t1, t2, u[0], m[37]);+	MONT_MUL(v0, v1, v2, u[1], m[36]);+	MONT_MUL(w0, w1, w2, u[2], m[35]);+	MONT_MAC(t0, t1, t2, u[3], m[34]);+	MONT_MAC(v0, v1, v2, u[4], m[33]);+	MONT_MAC(w0, w1, w2, u[5], m[32]);+	MONT_MAC(t0, t1, t2, u[6], m[31]);+	MONT_MAC(v0, v1, v2, u[7], m[30]);+	MONT_MAC(w0, w1, w2, u[8], m[29]);+	MONT_MAC(t0, t1, t2, u[9], m[28]);+	MONT_MAC(v0, v1, v2, u[10], m[27]);+	MONT_MAC(w0, w1, w2, u[11], m[26]);+	MONT_MAC(t0, t1, t2, u[12], m[25]);+	MONT_MAC(v0, v1, v2, u[13], m[24]);+	MONT_MAC(w0, w1, w2, u[14], m[23]);+	MONT_MAC(t0, t1, t2, u[15], m[22]);+	MONT_MAC(v0, v1, v2, u[16], m[21]);+	MONT_MAC(w0, w1, w2, u[17], m[20]);+	MONT_MAC(t0, t1, t2, u[18], m[19]);+	MONT_MAC(v0, v1, v2, u[19], m[18]);+	MONT_MAC(w0, w1, w2, u[20], m[17]);+	MONT_MAC(t0, t1, t2, u[21], m[16]);+	MONT_MAC(v0, v1, v2, u[22], m[15]);+	MONT_MAC(w0, w1, w2, u[23], m[14]);+	MONT_MAC(t0, t1, t2, u[24], m[13]);+	MONT_MAC(v0, v1, v2, u[25], m[12]);+	MONT_MAC(w0, w1, w2, u[26], m[11]);+	MONT_MAC(t0, t1, t2, u[27], m[10]);+	MONT_MAC(v0, v1, v2, u[28], m[9]);+	MONT_MAC(w0, w1, w2, u[29], m[8]);+	MONT_MAC(t0, t1, t2, u[30], m[7]);+	MONT_MAC(v0, v1, v2, u[31], m[6]);+	MONT_MAC(w0, w1, w2, u[32], m[5]);+	MONT_MAC(t0, t1, t2, u[33], m[4]);+	MONT_MAC(v0, v1, v2, u[34], m[3]);+	MONT_MAC(w0, w1, w2, u[35], m[2]);+	MONT_MAC(t0, t1, t2, u[36], m[1]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	MONT_ADD(s0, s1, s2, c0, c1, c2);+	MONT_DBL(s0, s1, s2);+	MONT_ADD(t0, t1, t2, s0, s1, s2);+	u[37] = t0 * n0;+	MONT_MAC(t0, t1, t2, u[37], m[0]);+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 38 */+	MONT_MUL(s0, s1, s2, a[0], a[38]);+	MONT_MUL(c0, c1, c2, a[1], a[37]);+	MONT_MAC(s0, s1, s2, a[2], a[36]);+	MONT_MAC(c0, c1, c2, a[3], a[35]);+	MONT_MAC(s0, s1, s2, a[4], a[34]);+	MONT_MAC(c0, c1, c2, a[5], a[33]);+	MONT_MAC(s0, s1, s2, a[6], a[32]);+	MONT_MAC(c0, c1, c2, a[7], a[31]);+	MONT_MAC(s0, s1, s2, a[8], a[30]);+	MONT_MAC(c0, c1, c2, a[9], a[29]);+	MONT_MAC(s0, s1, s2, a[10], a[28]);+	MONT_MAC(c0, c1, c2, a[11], a[27]);+	MONT_MAC(s0, s1, s2, a[12], a[26]);+	MONT_MAC(c0, c1, c2, a[13], a[25]);+	MONT_MAC(s0, s1, s2, a[14], a[24]);+	MONT_MAC(c0, c1, c2, a[15], a[23]);+	MONT_MAC(s0, s1, s2, a[16], a[22]);+	MONT_MAC(c0, c1, c2, a[17], a[21]);+	MONT_MAC(s0, s1, s2, a[18], a[20]);+	MONT_MAC(t0, t1, t2, a[19], a[19]);+	MONT_MUL(v0, v1, v2, u[0], m[38]);+	MONT_MUL(w0, w1, w2, u[1], m[37]);+	MONT_MAC(t0, t1, t2, u[2], m[36]);+	MONT_MAC(v0, v1, v2, u[3], m[35]);+	MONT_MAC(w0, w1, w2, u[4], m[34]);+	MONT_MAC(t0, t1, t2, u[5], m[33]);+	MONT_MAC(v0, v1, v2, u[6], m[32]);+	MONT_MAC(w0, w1, w2, u[7], m[31]);+	MONT_MAC(t0, t1, t2, u[8], m[30]);+	MONT_MAC(v0, v1, v2, u[9], m[29]);+	MONT_MAC(w0, w1, w2, u[10], m[28]);+	MONT_MAC(t0, t1, t2, u[11], m[27]);+	MONT_MAC(v0, v1, v2, u[12], m[26]);+	MONT_MAC(w0, w1, w2, u[13], m[25]);+	MONT_MAC(t0, t1, t2, u[14], m[24]);+	MONT_MAC(v0, v1, v2, u[15], m[23]);+	MONT_MAC(w0, w1, w2, u[16], m[22]);+	MONT_MAC(t0, t1, t2, u[17], m[21]);+	MONT_MAC(v0, v1, v2, u[18], m[20]);+	MONT_MAC(w0, w1, w2, u[19], m[19]);+	MONT_MAC(t0, t1, t2, u[20], m[18]);+	MONT_MAC(v0, v1, v2, u[21], m[17]);+	MONT_MAC(w0, w1, w2, u[22], m[16]);+	MONT_MAC(t0, t1, t2, u[23], m[15]);+	MONT_MAC(v0, v1, v2, u[24], m[14]);+	MONT_MAC(w0, w1, w2, u[25], m[13]);+	MONT_MAC(t0, t1, t2, u[26], m[12]);+	MONT_MAC(v0, v1, v2, u[27], m[11]);+	MONT_MAC(w0, w1, w2, u[28], m[10]);+	MONT_MAC(t0, t1, t2, u[29], m[9]);+	MONT_MAC(v0, v1, v2, u[30], m[8]);+	MONT_MAC(w0, w1, w2, u[31], m[7]);+	MONT_MAC(t0, t1, t2, u[32], m[6]);+	MONT_MAC(v0, v1, v2, u[33], m[5]);+	MONT_MAC(w0, w1, w2, u[34], m[4]);+	MONT_MAC(t0, t1, t2, u[35], m[3]);+	MONT_MAC(v0, v1, v2, u[36], m[2]);+	MONT_MAC(w0, w1, w2, u[37], m[1]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	MONT_ADD(s0, s1, s2, c0, c1, c2);+	MONT_DBL(s0, s1, s2);+	MONT_ADD(t0, t1, t2, s0, s1, s2);+	u[38] = t0 * n0;+	MONT_MAC(t0, t1, t2, u[38], m[0]);+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 39 */+	MONT_MUL(s0, s1, s2, a[0], a[39]);+	MONT_MUL(c0, c1, c2, a[1], a[38]);+	MONT_MAC(s0, s1, s2, a[2], a[37]);+	MONT_MAC(c0, c1, c2, a[3], a[36]);+	MONT_MAC(s0, s1, s2, a[4], a[35]);+	MONT_MAC(c0, c1, c2, a[5], a[34]);+	MONT_MAC(s0, s1, s2, a[6], a[33]);+	MONT_MAC(c0, c1, c2, a[7], a[32]);+	MONT_MAC(s0, s1, s2, a[8], a[31]);+	MONT_MAC(c0, c1, c2, a[9], a[30]);+	MONT_MAC(s0, s1, s2, a[10], a[29]);+	MONT_MAC(c0, c1, c2, a[11], a[28]);+	MONT_MAC(s0, s1, s2, a[12], a[27]);+	MONT_MAC(c0, c1, c2, a[13], a[26]);+	MONT_MAC(s0, s1, s2, a[14], a[25]);+	MONT_MAC(c0, c1, c2, a[15], a[24]);+	MONT_MAC(s0, s1, s2, a[16], a[23]);+	MONT_MAC(c0, c1, c2, a[17], a[22]);+	MONT_MAC(s0, s1, s2, a[18], a[21]);+	MONT_MAC(c0, c1, c2, a[19], a[20]);+	MONT_MAC(t0, t1, t2, u[0], m[39]);+	MONT_MUL(v0, v1, v2, u[1], m[38]);+	MONT_MUL(w0, w1, w2, u[2], m[37]);+	MONT_MAC(t0, t1, t2, u[3], m[36]);+	MONT_MAC(v0, v1, v2, u[4], m[35]);+	MONT_MAC(w0, w1, w2, u[5], m[34]);+	MONT_MAC(t0, t1, t2, u[6], m[33]);+	MONT_MAC(v0, v1, v2, u[7], m[32]);+	MONT_MAC(w0, w1, w2, u[8], m[31]);+	MONT_MAC(t0, t1, t2, u[9], m[30]);+	MONT_MAC(v0, v1, v2, u[10], m[29]);+	MONT_MAC(w0, w1, w2, u[11], m[28]);+	MONT_MAC(t0, t1, t2, u[12], m[27]);+	MONT_MAC(v0, v1, v2, u[13], m[26]);+	MONT_MAC(w0, w1, w2, u[14], m[25]);+	MONT_MAC(t0, t1, t2, u[15], m[24]);+	MONT_MAC(v0, v1, v2, u[16], m[23]);+	MONT_MAC(w0, w1, w2, u[17], m[22]);+	MONT_MAC(t0, t1, t2, u[18], m[21]);+	MONT_MAC(v0, v1, v2, u[19], m[20]);+	MONT_MAC(w0, w1, w2, u[20], m[19]);+	MONT_MAC(t0, t1, t2, u[21], m[18]);+	MONT_MAC(v0, v1, v2, u[22], m[17]);+	MONT_MAC(w0, w1, w2, u[23], m[16]);+	MONT_MAC(t0, t1, t2, u[24], m[15]);+	MONT_MAC(v0, v1, v2, u[25], m[14]);+	MONT_MAC(w0, w1, w2, u[26], m[13]);+	MONT_MAC(t0, t1, t2, u[27], m[12]);+	MONT_MAC(v0, v1, v2, u[28], m[11]);+	MONT_MAC(w0, w1, w2, u[29], m[10]);+	MONT_MAC(t0, t1, t2, u[30], m[9]);+	MONT_MAC(v0, v1, v2, u[31], m[8]);+	MONT_MAC(w0, w1, w2, u[32], m[7]);+	MONT_MAC(t0, t1, t2, u[33], m[6]);+	MONT_MAC(v0, v1, v2, u[34], m[5]);+	MONT_MAC(w0, w1, w2, u[35], m[4]);+	MONT_MAC(t0, t1, t2, u[36], m[3]);+	MONT_MAC(v0, v1, v2, u[37], m[2]);+	MONT_MAC(w0, w1, w2, u[38], m[1]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	MONT_ADD(s0, s1, s2, c0, c1, c2);+	MONT_DBL(s0, s1, s2);+	MONT_ADD(t0, t1, t2, s0, s1, s2);+	u[39] = t0 * n0;+	MONT_MAC(t0, t1, t2, u[39], m[0]);+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 40 */+	MONT_MUL(s0, s1, s2, a[0], a[40]);+	MONT_MUL(c0, c1, c2, a[1], a[39]);+	MONT_MAC(s0, s1, s2, a[2], a[38]);+	MONT_MAC(c0, c1, c2, a[3], a[37]);+	MONT_MAC(s0, s1, s2, a[4], a[36]);+	MONT_MAC(c0, c1, c2, a[5], a[35]);+	MONT_MAC(s0, s1, s2, a[6], a[34]);+	MONT_MAC(c0, c1, c2, a[7], a[33]);+	MONT_MAC(s0, s1, s2, a[8], a[32]);+	MONT_MAC(c0, c1, c2, a[9], a[31]);+	MONT_MAC(s0, s1, s2, a[10], a[30]);+	MONT_MAC(c0, c1, c2, a[11], a[29]);+	MONT_MAC(s0, s1, s2, a[12], a[28]);+	MONT_MAC(c0, c1, c2, a[13], a[27]);+	MONT_MAC(s0, s1, s2, a[14], a[26]);+	MONT_MAC(c0, c1, c2, a[15], a[25]);+	MONT_MAC(s0, s1, s2, a[16], a[24]);+	MONT_MAC(c0, c1, c2, a[17], a[23]);+	MONT_MAC(s0, s1, s2, a[18], a[22]);+	MONT_MAC(c0, c1, c2, a[19], a[21]);+	MONT_MAC(t0, t1, t2, a[20], a[20]);+	MONT_MUL(v0, v1, v2, u[0], m[40]);+	MONT_MUL(w0, w1, w2, u[1], m[39]);+	MONT_MAC(t0, t1, t2, u[2], m[38]);+	MONT_MAC(v0, v1, v2, u[3], m[37]);+	MONT_MAC(w0, w1, w2, u[4], m[36]);+	MONT_MAC(t0, t1, t2, u[5], m[35]);+	MONT_MAC(v0, v1, v2, u[6], m[34]);+	MONT_MAC(w0, w1, w2, u[7], m[33]);+	MONT_MAC(t0, t1, t2, u[8], m[32]);+	MONT_MAC(v0, v1, v2, u[9], m[31]);+	MONT_MAC(w0, w1, w2, u[10], m[30]);+	MONT_MAC(t0, t1, t2, u[11], m[29]);+	MONT_MAC(v0, v1, v2, u[12], m[28]);+	MONT_MAC(w0, w1, w2, u[13], m[27]);+	MONT_MAC(t0, t1, t2, u[14], m[26]);+	MONT_MAC(v0, v1, v2, u[15], m[25]);+	MONT_MAC(w0, w1, w2, u[16], m[24]);+	MONT_MAC(t0, t1, t2, u[17], m[23]);+	MONT_MAC(v0, v1, v2, u[18], m[22]);+	MONT_MAC(w0, w1, w2, u[19], m[21]);+	MONT_MAC(t0, t1, t2, u[20], m[20]);+	MONT_MAC(v0, v1, v2, u[21], m[19]);+	MONT_MAC(w0, w1, w2, u[22], m[18]);+	MONT_MAC(t0, t1, t2, u[23], m[17]);+	MONT_MAC(v0, v1, v2, u[24], m[16]);+	MONT_MAC(w0, w1, w2, u[25], m[15]);+	MONT_MAC(t0, t1, t2, u[26], m[14]);+	MONT_MAC(v0, v1, v2, u[27], m[13]);+	MONT_MAC(w0, w1, w2, u[28], m[12]);+	MONT_MAC(t0, t1, t2, u[29], m[11]);+	MONT_MAC(v0, v1, v2, u[30], m[10]);+	MONT_MAC(w0, w1, w2, u[31], m[9]);+	MONT_MAC(t0, t1, t2, u[32], m[8]);+	MONT_MAC(v0, v1, v2, u[33], m[7]);+	MONT_MAC(w0, w1, w2, u[34], m[6]);+	MONT_MAC(t0, t1, t2, u[35], m[5]);+	MONT_MAC(v0, v1, v2, u[36], m[4]);+	MONT_MAC(w0, w1, w2, u[37], m[3]);+	MONT_MAC(t0, t1, t2, u[38], m[2]);+	MONT_MAC(v0, v1, v2, u[39], m[1]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	MONT_ADD(s0, s1, s2, c0, c1, c2);+	MONT_DBL(s0, s1, s2);+	MONT_ADD(t0, t1, t2, s0, s1, s2);+	u[40] = t0 * n0;+	MONT_MAC(t0, t1, t2, u[40], m[0]);+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 41 */+	MONT_MUL(s0, s1, s2, a[0], a[41]);+	MONT_MUL(c0, c1, c2, a[1], a[40]);+	MONT_MAC(s0, s1, s2, a[2], a[39]);+	MONT_MAC(c0, c1, c2, a[3], a[38]);+	MONT_MAC(s0, s1, s2, a[4], a[37]);+	MONT_MAC(c0, c1, c2, a[5], a[36]);+	MONT_MAC(s0, s1, s2, a[6], a[35]);+	MONT_MAC(c0, c1, c2, a[7], a[34]);+	MONT_MAC(s0, s1, s2, a[8], a[33]);+	MONT_MAC(c0, c1, c2, a[9], a[32]);+	MONT_MAC(s0, s1, s2, a[10], a[31]);+	MONT_MAC(c0, c1, c2, a[11], a[30]);+	MONT_MAC(s0, s1, s2, a[12], a[29]);+	MONT_MAC(c0, c1, c2, a[13], a[28]);+	MONT_MAC(s0, s1, s2, a[14], a[27]);+	MONT_MAC(c0, c1, c2, a[15], a[26]);+	MONT_MAC(s0, s1, s2, a[16], a[25]);+	MONT_MAC(c0, c1, c2, a[17], a[24]);+	MONT_MAC(s0, s1, s2, a[18], a[23]);+	MONT_MAC(c0, c1, c2, a[19], a[22]);+	MONT_MAC(s0, s1, s2, a[20], a[21]);+	MONT_MAC(t0, t1, t2, u[0], m[41]);+	MONT_MUL(v0, v1, v2, u[1], m[40]);+	MONT_MUL(w0, w1, w2, u[2], m[39]);+	MONT_MAC(t0, t1, t2, u[3], m[38]);+	MONT_MAC(v0, v1, v2, u[4], m[37]);+	MONT_MAC(w0, w1, w2, u[5], m[36]);+	MONT_MAC(t0, t1, t2, u[6], m[35]);+	MONT_MAC(v0, v1, v2, u[7], m[34]);+	MONT_MAC(w0, w1, w2, u[8], m[33]);+	MONT_MAC(t0, t1, t2, u[9], m[32]);+	MONT_MAC(v0, v1, v2, u[10], m[31]);+	MONT_MAC(w0, w1, w2, u[11], m[30]);+	MONT_MAC(t0, t1, t2, u[12], m[29]);+	MONT_MAC(v0, v1, v2, u[13], m[28]);+	MONT_MAC(w0, w1, w2, u[14], m[27]);+	MONT_MAC(t0, t1, t2, u[15], m[26]);+	MONT_MAC(v0, v1, v2, u[16], m[25]);+	MONT_MAC(w0, w1, w2, u[17], m[24]);+	MONT_MAC(t0, t1, t2, u[18], m[23]);+	MONT_MAC(v0, v1, v2, u[19], m[22]);+	MONT_MAC(w0, w1, w2, u[20], m[21]);+	MONT_MAC(t0, t1, t2, u[21], m[20]);+	MONT_MAC(v0, v1, v2, u[22], m[19]);+	MONT_MAC(w0, w1, w2, u[23], m[18]);+	MONT_MAC(t0, t1, t2, u[24], m[17]);+	MONT_MAC(v0, v1, v2, u[25], m[16]);+	MONT_MAC(w0, w1, w2, u[26], m[15]);+	MONT_MAC(t0, t1, t2, u[27], m[14]);+	MONT_MAC(v0, v1, v2, u[28], m[13]);+	MONT_MAC(w0, w1, w2, u[29], m[12]);+	MONT_MAC(t0, t1, t2, u[30], m[11]);+	MONT_MAC(v0, v1, v2, u[31], m[10]);+	MONT_MAC(w0, w1, w2, u[32], m[9]);+	MONT_MAC(t0, t1, t2, u[33], m[8]);+	MONT_MAC(v0, v1, v2, u[34], m[7]);+	MONT_MAC(w0, w1, w2, u[35], m[6]);+	MONT_MAC(t0, t1, t2, u[36], m[5]);+	MONT_MAC(v0, v1, v2, u[37], m[4]);+	MONT_MAC(w0, w1, w2, u[38], m[3]);+	MONT_MAC(t0, t1, t2, u[39], m[2]);+	MONT_MAC(v0, v1, v2, u[40], m[1]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	MONT_ADD(s0, s1, s2, c0, c1, c2);+	MONT_DBL(s0, s1, s2);+	MONT_ADD(t0, t1, t2, s0, s1, s2);+	u[41] = t0 * n0;+	MONT_MAC(t0, t1, t2, u[41], m[0]);+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 42 */+	MONT_MUL(s0, s1, s2, a[0], a[42]);+	MONT_MUL(c0, c1, c2, a[1], a[41]);+	MONT_MAC(s0, s1, s2, a[2], a[40]);+	MONT_MAC(c0, c1, c2, a[3], a[39]);+	MONT_MAC(s0, s1, s2, a[4], a[38]);+	MONT_MAC(c0, c1, c2, a[5], a[37]);+	MONT_MAC(s0, s1, s2, a[6], a[36]);+	MONT_MAC(c0, c1, c2, a[7], a[35]);+	MONT_MAC(s0, s1, s2, a[8], a[34]);+	MONT_MAC(c0, c1, c2, a[9], a[33]);+	MONT_MAC(s0, s1, s2, a[10], a[32]);+	MONT_MAC(c0, c1, c2, a[11], a[31]);+	MONT_MAC(s0, s1, s2, a[12], a[30]);+	MONT_MAC(c0, c1, c2, a[13], a[29]);+	MONT_MAC(s0, s1, s2, a[14], a[28]);+	MONT_MAC(c0, c1, c2, a[15], a[27]);+	MONT_MAC(s0, s1, s2, a[16], a[26]);+	MONT_MAC(c0, c1, c2, a[17], a[25]);+	MONT_MAC(s0, s1, s2, a[18], a[24]);+	MONT_MAC(c0, c1, c2, a[19], a[23]);+	MONT_MAC(s0, s1, s2, a[20], a[22]);+	MONT_MAC(t0, t1, t2, a[21], a[21]);+	MONT_MUL(v0, v1, v2, u[0], m[42]);+	MONT_MUL(w0, w1, w2, u[1], m[41]);+	MONT_MAC(t0, t1, t2, u[2], m[40]);+	MONT_MAC(v0, v1, v2, u[3], m[39]);+	MONT_MAC(w0, w1, w2, u[4], m[38]);+	MONT_MAC(t0, t1, t2, u[5], m[37]);+	MONT_MAC(v0, v1, v2, u[6], m[36]);+	MONT_MAC(w0, w1, w2, u[7], m[35]);+	MONT_MAC(t0, t1, t2, u[8], m[34]);+	MONT_MAC(v0, v1, v2, u[9], m[33]);+	MONT_MAC(w0, w1, w2, u[10], m[32]);+	MONT_MAC(t0, t1, t2, u[11], m[31]);+	MONT_MAC(v0, v1, v2, u[12], m[30]);+	MONT_MAC(w0, w1, w2, u[13], m[29]);+	MONT_MAC(t0, t1, t2, u[14], m[28]);+	MONT_MAC(v0, v1, v2, u[15], m[27]);+	MONT_MAC(w0, w1, w2, u[16], m[26]);+	MONT_MAC(t0, t1, t2, u[17], m[25]);+	MONT_MAC(v0, v1, v2, u[18], m[24]);+	MONT_MAC(w0, w1, w2, u[19], m[23]);+	MONT_MAC(t0, t1, t2, u[20], m[22]);+	MONT_MAC(v0, v1, v2, u[21], m[21]);+	MONT_MAC(w0, w1, w2, u[22], m[20]);+	MONT_MAC(t0, t1, t2, u[23], m[19]);+	MONT_MAC(v0, v1, v2, u[24], m[18]);+	MONT_MAC(w0, w1, w2, u[25], m[17]);+	MONT_MAC(t0, t1, t2, u[26], m[16]);+	MONT_MAC(v0, v1, v2, u[27], m[15]);+	MONT_MAC(w0, w1, w2, u[28], m[14]);+	MONT_MAC(t0, t1, t2, u[29], m[13]);+	MONT_MAC(v0, v1, v2, u[30], m[12]);+	MONT_MAC(w0, w1, w2, u[31], m[11]);+	MONT_MAC(t0, t1, t2, u[32], m[10]);+	MONT_MAC(v0, v1, v2, u[33], m[9]);+	MONT_MAC(w0, w1, w2, u[34], m[8]);+	MONT_MAC(t0, t1, t2, u[35], m[7]);+	MONT_MAC(v0, v1, v2, u[36], m[6]);+	MONT_MAC(w0, w1, w2, u[37], m[5]);+	MONT_MAC(t0, t1, t2, u[38], m[4]);+	MONT_MAC(v0, v1, v2, u[39], m[3]);+	MONT_MAC(w0, w1, w2, u[40], m[2]);+	MONT_MAC(t0, t1, t2, u[41], m[1]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	MONT_ADD(s0, s1, s2, c0, c1, c2);+	MONT_DBL(s0, s1, s2);+	MONT_ADD(t0, t1, t2, s0, s1, s2);+	u[42] = t0 * n0;+	MONT_MAC(t0, t1, t2, u[42], m[0]);+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 43 */+	MONT_MUL(s0, s1, s2, a[0], a[43]);+	MONT_MUL(c0, c1, c2, a[1], a[42]);+	MONT_MAC(s0, s1, s2, a[2], a[41]);+	MONT_MAC(c0, c1, c2, a[3], a[40]);+	MONT_MAC(s0, s1, s2, a[4], a[39]);+	MONT_MAC(c0, c1, c2, a[5], a[38]);+	MONT_MAC(s0, s1, s2, a[6], a[37]);+	MONT_MAC(c0, c1, c2, a[7], a[36]);+	MONT_MAC(s0, s1, s2, a[8], a[35]);+	MONT_MAC(c0, c1, c2, a[9], a[34]);+	MONT_MAC(s0, s1, s2, a[10], a[33]);+	MONT_MAC(c0, c1, c2, a[11], a[32]);+	MONT_MAC(s0, s1, s2, a[12], a[31]);+	MONT_MAC(c0, c1, c2, a[13], a[30]);+	MONT_MAC(s0, s1, s2, a[14], a[29]);+	MONT_MAC(c0, c1, c2, a[15], a[28]);+	MONT_MAC(s0, s1, s2, a[16], a[27]);+	MONT_MAC(c0, c1, c2, a[17], a[26]);+	MONT_MAC(s0, s1, s2, a[18], a[25]);+	MONT_MAC(c0, c1, c2, a[19], a[24]);+	MONT_MAC(s0, s1, s2, a[20], a[23]);+	MONT_MAC(c0, c1, c2, a[21], a[22]);+	MONT_MAC(t0, t1, t2, u[0], m[43]);+	MONT_MUL(v0, v1, v2, u[1], m[42]);+	MONT_MUL(w0, w1, w2, u[2], m[41]);+	MONT_MAC(t0, t1, t2, u[3], m[40]);+	MONT_MAC(v0, v1, v2, u[4], m[39]);+	MONT_MAC(w0, w1, w2, u[5], m[38]);+	MONT_MAC(t0, t1, t2, u[6], m[37]);+	MONT_MAC(v0, v1, v2, u[7], m[36]);+	MONT_MAC(w0, w1, w2, u[8], m[35]);+	MONT_MAC(t0, t1, t2, u[9], m[34]);+	MONT_MAC(v0, v1, v2, u[10], m[33]);+	MONT_MAC(w0, w1, w2, u[11], m[32]);+	MONT_MAC(t0, t1, t2, u[12], m[31]);+	MONT_MAC(v0, v1, v2, u[13], m[30]);+	MONT_MAC(w0, w1, w2, u[14], m[29]);+	MONT_MAC(t0, t1, t2, u[15], m[28]);+	MONT_MAC(v0, v1, v2, u[16], m[27]);+	MONT_MAC(w0, w1, w2, u[17], m[26]);+	MONT_MAC(t0, t1, t2, u[18], m[25]);+	MONT_MAC(v0, v1, v2, u[19], m[24]);+	MONT_MAC(w0, w1, w2, u[20], m[23]);+	MONT_MAC(t0, t1, t2, u[21], m[22]);+	MONT_MAC(v0, v1, v2, u[22], m[21]);+	MONT_MAC(w0, w1, w2, u[23], m[20]);+	MONT_MAC(t0, t1, t2, u[24], m[19]);+	MONT_MAC(v0, v1, v2, u[25], m[18]);+	MONT_MAC(w0, w1, w2, u[26], m[17]);+	MONT_MAC(t0, t1, t2, u[27], m[16]);+	MONT_MAC(v0, v1, v2, u[28], m[15]);+	MONT_MAC(w0, w1, w2, u[29], m[14]);+	MONT_MAC(t0, t1, t2, u[30], m[13]);+	MONT_MAC(v0, v1, v2, u[31], m[12]);+	MONT_MAC(w0, w1, w2, u[32], m[11]);+	MONT_MAC(t0, t1, t2, u[33], m[10]);+	MONT_MAC(v0, v1, v2, u[34], m[9]);+	MONT_MAC(w0, w1, w2, u[35], m[8]);+	MONT_MAC(t0, t1, t2, u[36], m[7]);+	MONT_MAC(v0, v1, v2, u[37], m[6]);+	MONT_MAC(w0, w1, w2, u[38], m[5]);+	MONT_MAC(t0, t1, t2, u[39], m[4]);+	MONT_MAC(v0, v1, v2, u[40], m[3]);+	MONT_MAC(w0, w1, w2, u[41], m[2]);+	MONT_MAC(t0, t1, t2, u[42], m[1]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	MONT_ADD(s0, s1, s2, c0, c1, c2);+	MONT_DBL(s0, s1, s2);+	MONT_ADD(t0, t1, t2, s0, s1, s2);+	u[43] = t0 * n0;+	MONT_MAC(t0, t1, t2, u[43], m[0]);+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 44 */+	MONT_MUL(s0, s1, s2, a[0], a[44]);+	MONT_MUL(c0, c1, c2, a[1], a[43]);+	MONT_MAC(s0, s1, s2, a[2], a[42]);+	MONT_MAC(c0, c1, c2, a[3], a[41]);+	MONT_MAC(s0, s1, s2, a[4], a[40]);+	MONT_MAC(c0, c1, c2, a[5], a[39]);+	MONT_MAC(s0, s1, s2, a[6], a[38]);+	MONT_MAC(c0, c1, c2, a[7], a[37]);+	MONT_MAC(s0, s1, s2, a[8], a[36]);+	MONT_MAC(c0, c1, c2, a[9], a[35]);+	MONT_MAC(s0, s1, s2, a[10], a[34]);+	MONT_MAC(c0, c1, c2, a[11], a[33]);+	MONT_MAC(s0, s1, s2, a[12], a[32]);+	MONT_MAC(c0, c1, c2, a[13], a[31]);+	MONT_MAC(s0, s1, s2, a[14], a[30]);+	MONT_MAC(c0, c1, c2, a[15], a[29]);+	MONT_MAC(s0, s1, s2, a[16], a[28]);+	MONT_MAC(c0, c1, c2, a[17], a[27]);+	MONT_MAC(s0, s1, s2, a[18], a[26]);+	MONT_MAC(c0, c1, c2, a[19], a[25]);+	MONT_MAC(s0, s1, s2, a[20], a[24]);+	MONT_MAC(c0, c1, c2, a[21], a[23]);+	MONT_MAC(t0, t1, t2, a[22], a[22]);+	MONT_MUL(v0, v1, v2, u[0], m[44]);+	MONT_MUL(w0, w1, w2, u[1], m[43]);+	MONT_MAC(t0, t1, t2, u[2], m[42]);+	MONT_MAC(v0, v1, v2, u[3], m[41]);+	MONT_MAC(w0, w1, w2, u[4], m[40]);+	MONT_MAC(t0, t1, t2, u[5], m[39]);+	MONT_MAC(v0, v1, v2, u[6], m[38]);+	MONT_MAC(w0, w1, w2, u[7], m[37]);+	MONT_MAC(t0, t1, t2, u[8], m[36]);+	MONT_MAC(v0, v1, v2, u[9], m[35]);+	MONT_MAC(w0, w1, w2, u[10], m[34]);+	MONT_MAC(t0, t1, t2, u[11], m[33]);+	MONT_MAC(v0, v1, v2, u[12], m[32]);+	MONT_MAC(w0, w1, w2, u[13], m[31]);+	MONT_MAC(t0, t1, t2, u[14], m[30]);+	MONT_MAC(v0, v1, v2, u[15], m[29]);+	MONT_MAC(w0, w1, w2, u[16], m[28]);+	MONT_MAC(t0, t1, t2, u[17], m[27]);+	MONT_MAC(v0, v1, v2, u[18], m[26]);+	MONT_MAC(w0, w1, w2, u[19], m[25]);+	MONT_MAC(t0, t1, t2, u[20], m[24]);+	MONT_MAC(v0, v1, v2, u[21], m[23]);+	MONT_MAC(w0, w1, w2, u[22], m[22]);+	MONT_MAC(t0, t1, t2, u[23], m[21]);+	MONT_MAC(v0, v1, v2, u[24], m[20]);+	MONT_MAC(w0, w1, w2, u[25], m[19]);+	MONT_MAC(t0, t1, t2, u[26], m[18]);+	MONT_MAC(v0, v1, v2, u[27], m[17]);+	MONT_MAC(w0, w1, w2, u[28], m[16]);+	MONT_MAC(t0, t1, t2, u[29], m[15]);+	MONT_MAC(v0, v1, v2, u[30], m[14]);+	MONT_MAC(w0, w1, w2, u[31], m[13]);+	MONT_MAC(t0, t1, t2, u[32], m[12]);+	MONT_MAC(v0, v1, v2, u[33], m[11]);+	MONT_MAC(w0, w1, w2, u[34], m[10]);+	MONT_MAC(t0, t1, t2, u[35], m[9]);+	MONT_MAC(v0, v1, v2, u[36], m[8]);+	MONT_MAC(w0, w1, w2, u[37], m[7]);+	MONT_MAC(t0, t1, t2, u[38], m[6]);+	MONT_MAC(v0, v1, v2, u[39], m[5]);+	MONT_MAC(w0, w1, w2, u[40], m[4]);+	MONT_MAC(t0, t1, t2, u[41], m[3]);+	MONT_MAC(v0, v1, v2, u[42], m[2]);+	MONT_MAC(w0, w1, w2, u[43], m[1]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	MONT_ADD(s0, s1, s2, c0, c1, c2);+	MONT_DBL(s0, s1, s2);+	MONT_ADD(t0, t1, t2, s0, s1, s2);+	u[44] = t0 * n0;+	MONT_MAC(t0, t1, t2, u[44], m[0]);+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 45 */+	MONT_MUL(s0, s1, s2, a[0], a[45]);+	MONT_MUL(c0, c1, c2, a[1], a[44]);+	MONT_MAC(s0, s1, s2, a[2], a[43]);+	MONT_MAC(c0, c1, c2, a[3], a[42]);+	MONT_MAC(s0, s1, s2, a[4], a[41]);+	MONT_MAC(c0, c1, c2, a[5], a[40]);+	MONT_MAC(s0, s1, s2, a[6], a[39]);+	MONT_MAC(c0, c1, c2, a[7], a[38]);+	MONT_MAC(s0, s1, s2, a[8], a[37]);+	MONT_MAC(c0, c1, c2, a[9], a[36]);+	MONT_MAC(s0, s1, s2, a[10], a[35]);+	MONT_MAC(c0, c1, c2, a[11], a[34]);+	MONT_MAC(s0, s1, s2, a[12], a[33]);+	MONT_MAC(c0, c1, c2, a[13], a[32]);+	MONT_MAC(s0, s1, s2, a[14], a[31]);+	MONT_MAC(c0, c1, c2, a[15], a[30]);+	MONT_MAC(s0, s1, s2, a[16], a[29]);+	MONT_MAC(c0, c1, c2, a[17], a[28]);+	MONT_MAC(s0, s1, s2, a[18], a[27]);+	MONT_MAC(c0, c1, c2, a[19], a[26]);+	MONT_MAC(s0, s1, s2, a[20], a[25]);+	MONT_MAC(c0, c1, c2, a[21], a[24]);+	MONT_MAC(s0, s1, s2, a[22], a[23]);+	MONT_MAC(t0, t1, t2, u[0], m[45]);+	MONT_MUL(v0, v1, v2, u[1], m[44]);+	MONT_MUL(w0, w1, w2, u[2], m[43]);+	MONT_MAC(t0, t1, t2, u[3], m[42]);+	MONT_MAC(v0, v1, v2, u[4], m[41]);+	MONT_MAC(w0, w1, w2, u[5], m[40]);+	MONT_MAC(t0, t1, t2, u[6], m[39]);+	MONT_MAC(v0, v1, v2, u[7], m[38]);+	MONT_MAC(w0, w1, w2, u[8], m[37]);+	MONT_MAC(t0, t1, t2, u[9], m[36]);+	MONT_MAC(v0, v1, v2, u[10], m[35]);+	MONT_MAC(w0, w1, w2, u[11], m[34]);+	MONT_MAC(t0, t1, t2, u[12], m[33]);+	MONT_MAC(v0, v1, v2, u[13], m[32]);+	MONT_MAC(w0, w1, w2, u[14], m[31]);+	MONT_MAC(t0, t1, t2, u[15], m[30]);+	MONT_MAC(v0, v1, v2, u[16], m[29]);+	MONT_MAC(w0, w1, w2, u[17], m[28]);+	MONT_MAC(t0, t1, t2, u[18], m[27]);+	MONT_MAC(v0, v1, v2, u[19], m[26]);+	MONT_MAC(w0, w1, w2, u[20], m[25]);+	MONT_MAC(t0, t1, t2, u[21], m[24]);+	MONT_MAC(v0, v1, v2, u[22], m[23]);+	MONT_MAC(w0, w1, w2, u[23], m[22]);+	MONT_MAC(t0, t1, t2, u[24], m[21]);+	MONT_MAC(v0, v1, v2, u[25], m[20]);+	MONT_MAC(w0, w1, w2, u[26], m[19]);+	MONT_MAC(t0, t1, t2, u[27], m[18]);+	MONT_MAC(v0, v1, v2, u[28], m[17]);+	MONT_MAC(w0, w1, w2, u[29], m[16]);+	MONT_MAC(t0, t1, t2, u[30], m[15]);+	MONT_MAC(v0, v1, v2, u[31], m[14]);+	MONT_MAC(w0, w1, w2, u[32], m[13]);+	MONT_MAC(t0, t1, t2, u[33], m[12]);+	MONT_MAC(v0, v1, v2, u[34], m[11]);+	MONT_MAC(w0, w1, w2, u[35], m[10]);+	MONT_MAC(t0, t1, t2, u[36], m[9]);+	MONT_MAC(v0, v1, v2, u[37], m[8]);+	MONT_MAC(w0, w1, w2, u[38], m[7]);+	MONT_MAC(t0, t1, t2, u[39], m[6]);+	MONT_MAC(v0, v1, v2, u[40], m[5]);+	MONT_MAC(w0, w1, w2, u[41], m[4]);+	MONT_MAC(t0, t1, t2, u[42], m[3]);+	MONT_MAC(v0, v1, v2, u[43], m[2]);+	MONT_MAC(w0, w1, w2, u[44], m[1]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	MONT_ADD(s0, s1, s2, c0, c1, c2);+	MONT_DBL(s0, s1, s2);+	MONT_ADD(t0, t1, t2, s0, s1, s2);+	u[45] = t0 * n0;+	MONT_MAC(t0, t1, t2, u[45], m[0]);+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 46 */+	MONT_MUL(s0, s1, s2, a[0], a[46]);+	MONT_MUL(c0, c1, c2, a[1], a[45]);+	MONT_MAC(s0, s1, s2, a[2], a[44]);+	MONT_MAC(c0, c1, c2, a[3], a[43]);+	MONT_MAC(s0, s1, s2, a[4], a[42]);+	MONT_MAC(c0, c1, c2, a[5], a[41]);+	MONT_MAC(s0, s1, s2, a[6], a[40]);+	MONT_MAC(c0, c1, c2, a[7], a[39]);+	MONT_MAC(s0, s1, s2, a[8], a[38]);+	MONT_MAC(c0, c1, c2, a[9], a[37]);+	MONT_MAC(s0, s1, s2, a[10], a[36]);+	MONT_MAC(c0, c1, c2, a[11], a[35]);+	MONT_MAC(s0, s1, s2, a[12], a[34]);+	MONT_MAC(c0, c1, c2, a[13], a[33]);+	MONT_MAC(s0, s1, s2, a[14], a[32]);+	MONT_MAC(c0, c1, c2, a[15], a[31]);+	MONT_MAC(s0, s1, s2, a[16], a[30]);+	MONT_MAC(c0, c1, c2, a[17], a[29]);+	MONT_MAC(s0, s1, s2, a[18], a[28]);+	MONT_MAC(c0, c1, c2, a[19], a[27]);+	MONT_MAC(s0, s1, s2, a[20], a[26]);+	MONT_MAC(c0, c1, c2, a[21], a[25]);+	MONT_MAC(s0, s1, s2, a[22], a[24]);+	MONT_MAC(t0, t1, t2, a[23], a[23]);+	MONT_MUL(v0, v1, v2, u[0], m[46]);+	MONT_MUL(w0, w1, w2, u[1], m[45]);+	MONT_MAC(t0, t1, t2, u[2], m[44]);+	MONT_MAC(v0, v1, v2, u[3], m[43]);+	MONT_MAC(w0, w1, w2, u[4], m[42]);+	MONT_MAC(t0, t1, t2, u[5], m[41]);+	MONT_MAC(v0, v1, v2, u[6], m[40]);+	MONT_MAC(w0, w1, w2, u[7], m[39]);+	MONT_MAC(t0, t1, t2, u[8], m[38]);+	MONT_MAC(v0, v1, v2, u[9], m[37]);+	MONT_MAC(w0, w1, w2, u[10], m[36]);+	MONT_MAC(t0, t1, t2, u[11], m[35]);+	MONT_MAC(v0, v1, v2, u[12], m[34]);+	MONT_MAC(w0, w1, w2, u[13], m[33]);+	MONT_MAC(t0, t1, t2, u[14], m[32]);+	MONT_MAC(v0, v1, v2, u[15], m[31]);+	MONT_MAC(w0, w1, w2, u[16], m[30]);+	MONT_MAC(t0, t1, t2, u[17], m[29]);+	MONT_MAC(v0, v1, v2, u[18], m[28]);+	MONT_MAC(w0, w1, w2, u[19], m[27]);+	MONT_MAC(t0, t1, t2, u[20], m[26]);+	MONT_MAC(v0, v1, v2, u[21], m[25]);+	MONT_MAC(w0, w1, w2, u[22], m[24]);+	MONT_MAC(t0, t1, t2, u[23], m[23]);+	MONT_MAC(v0, v1, v2, u[24], m[22]);+	MONT_MAC(w0, w1, w2, u[25], m[21]);+	MONT_MAC(t0, t1, t2, u[26], m[20]);+	MONT_MAC(v0, v1, v2, u[27], m[19]);+	MONT_MAC(w0, w1, w2, u[28], m[18]);+	MONT_MAC(t0, t1, t2, u[29], m[17]);+	MONT_MAC(v0, v1, v2, u[30], m[16]);+	MONT_MAC(w0, w1, w2, u[31], m[15]);+	MONT_MAC(t0, t1, t2, u[32], m[14]);+	MONT_MAC(v0, v1, v2, u[33], m[13]);+	MONT_MAC(w0, w1, w2, u[34], m[12]);+	MONT_MAC(t0, t1, t2, u[35], m[11]);+	MONT_MAC(v0, v1, v2, u[36], m[10]);+	MONT_MAC(w0, w1, w2, u[37], m[9]);+	MONT_MAC(t0, t1, t2, u[38], m[8]);+	MONT_MAC(v0, v1, v2, u[39], m[7]);+	MONT_MAC(w0, w1, w2, u[40], m[6]);+	MONT_MAC(t0, t1, t2, u[41], m[5]);+	MONT_MAC(v0, v1, v2, u[42], m[4]);+	MONT_MAC(w0, w1, w2, u[43], m[3]);+	MONT_MAC(t0, t1, t2, u[44], m[2]);+	MONT_MAC(v0, v1, v2, u[45], m[1]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	MONT_ADD(s0, s1, s2, c0, c1, c2);+	MONT_DBL(s0, s1, s2);+	MONT_ADD(t0, t1, t2, s0, s1, s2);+	u[46] = t0 * n0;+	MONT_MAC(t0, t1, t2, u[46], m[0]);+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 47 */+	MONT_MUL(s0, s1, s2, a[0], a[47]);+	MONT_MUL(c0, c1, c2, a[1], a[46]);+	MONT_MAC(s0, s1, s2, a[2], a[45]);+	MONT_MAC(c0, c1, c2, a[3], a[44]);+	MONT_MAC(s0, s1, s2, a[4], a[43]);+	MONT_MAC(c0, c1, c2, a[5], a[42]);+	MONT_MAC(s0, s1, s2, a[6], a[41]);+	MONT_MAC(c0, c1, c2, a[7], a[40]);+	MONT_MAC(s0, s1, s2, a[8], a[39]);+	MONT_MAC(c0, c1, c2, a[9], a[38]);+	MONT_MAC(s0, s1, s2, a[10], a[37]);+	MONT_MAC(c0, c1, c2, a[11], a[36]);+	MONT_MAC(s0, s1, s2, a[12], a[35]);+	MONT_MAC(c0, c1, c2, a[13], a[34]);+	MONT_MAC(s0, s1, s2, a[14], a[33]);+	MONT_MAC(c0, c1, c2, a[15], a[32]);+	MONT_MAC(s0, s1, s2, a[16], a[31]);+	MONT_MAC(c0, c1, c2, a[17], a[30]);+	MONT_MAC(s0, s1, s2, a[18], a[29]);+	MONT_MAC(c0, c1, c2, a[19], a[28]);+	MONT_MAC(s0, s1, s2, a[20], a[27]);+	MONT_MAC(c0, c1, c2, a[21], a[26]);+	MONT_MAC(s0, s1, s2, a[22], a[25]);+	MONT_MAC(c0, c1, c2, a[23], a[24]);+	MONT_MAC(t0, t1, t2, u[0], m[47]);+	MONT_MUL(v0, v1, v2, u[1], m[46]);+	MONT_MUL(w0, w1, w2, u[2], m[45]);+	MONT_MAC(t0, t1, t2, u[3], m[44]);+	MONT_MAC(v0, v1, v2, u[4], m[43]);+	MONT_MAC(w0, w1, w2, u[5], m[42]);+	MONT_MAC(t0, t1, t2, u[6], m[41]);+	MONT_MAC(v0, v1, v2, u[7], m[40]);+	MONT_MAC(w0, w1, w2, u[8], m[39]);+	MONT_MAC(t0, t1, t2, u[9], m[38]);+	MONT_MAC(v0, v1, v2, u[10], m[37]);+	MONT_MAC(w0, w1, w2, u[11], m[36]);+	MONT_MAC(t0, t1, t2, u[12], m[35]);+	MONT_MAC(v0, v1, v2, u[13], m[34]);+	MONT_MAC(w0, w1, w2, u[14], m[33]);+	MONT_MAC(t0, t1, t2, u[15], m[32]);+	MONT_MAC(v0, v1, v2, u[16], m[31]);+	MONT_MAC(w0, w1, w2, u[17], m[30]);+	MONT_MAC(t0, t1, t2, u[18], m[29]);+	MONT_MAC(v0, v1, v2, u[19], m[28]);+	MONT_MAC(w0, w1, w2, u[20], m[27]);+	MONT_MAC(t0, t1, t2, u[21], m[26]);+	MONT_MAC(v0, v1, v2, u[22], m[25]);+	MONT_MAC(w0, w1, w2, u[23], m[24]);+	MONT_MAC(t0, t1, t2, u[24], m[23]);+	MONT_MAC(v0, v1, v2, u[25], m[22]);+	MONT_MAC(w0, w1, w2, u[26], m[21]);+	MONT_MAC(t0, t1, t2, u[27], m[20]);+	MONT_MAC(v0, v1, v2, u[28], m[19]);+	MONT_MAC(w0, w1, w2, u[29], m[18]);+	MONT_MAC(t0, t1, t2, u[30], m[17]);+	MONT_MAC(v0, v1, v2, u[31], m[16]);+	MONT_MAC(w0, w1, w2, u[32], m[15]);+	MONT_MAC(t0, t1, t2, u[33], m[14]);+	MONT_MAC(v0, v1, v2, u[34], m[13]);+	MONT_MAC(w0, w1, w2, u[35], m[12]);+	MONT_MAC(t0, t1, t2, u[36], m[11]);+	MONT_MAC(v0, v1, v2, u[37], m[10]);+	MONT_MAC(w0, w1, w2, u[38], m[9]);+	MONT_MAC(t0, t1, t2, u[39], m[8]);+	MONT_MAC(v0, v1, v2, u[40], m[7]);+	MONT_MAC(w0, w1, w2, u[41], m[6]);+	MONT_MAC(t0, t1, t2, u[42], m[5]);+	MONT_MAC(v0, v1, v2, u[43], m[4]);+	MONT_MAC(w0, w1, w2, u[44], m[3]);+	MONT_MAC(t0, t1, t2, u[45], m[2]);+	MONT_MAC(v0, v1, v2, u[46], m[1]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	MONT_ADD(s0, s1, s2, c0, c1, c2);+	MONT_DBL(s0, s1, s2);+	MONT_ADD(t0, t1, t2, s0, s1, s2);+	u[47] = t0 * n0;+	MONT_MAC(t0, t1, t2, u[47], m[0]);+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 48 */+	MONT_MUL(s0, s1, s2, a[1], a[47]);+	MONT_MUL(c0, c1, c2, a[2], a[46]);+	MONT_MAC(s0, s1, s2, a[3], a[45]);+	MONT_MAC(c0, c1, c2, a[4], a[44]);+	MONT_MAC(s0, s1, s2, a[5], a[43]);+	MONT_MAC(c0, c1, c2, a[6], a[42]);+	MONT_MAC(s0, s1, s2, a[7], a[41]);+	MONT_MAC(c0, c1, c2, a[8], a[40]);+	MONT_MAC(s0, s1, s2, a[9], a[39]);+	MONT_MAC(c0, c1, c2, a[10], a[38]);+	MONT_MAC(s0, s1, s2, a[11], a[37]);+	MONT_MAC(c0, c1, c2, a[12], a[36]);+	MONT_MAC(s0, s1, s2, a[13], a[35]);+	MONT_MAC(c0, c1, c2, a[14], a[34]);+	MONT_MAC(s0, s1, s2, a[15], a[33]);+	MONT_MAC(c0, c1, c2, a[16], a[32]);+	MONT_MAC(s0, s1, s2, a[17], a[31]);+	MONT_MAC(c0, c1, c2, a[18], a[30]);+	MONT_MAC(s0, s1, s2, a[19], a[29]);+	MONT_MAC(c0, c1, c2, a[20], a[28]);+	MONT_MAC(s0, s1, s2, a[21], a[27]);+	MONT_MAC(c0, c1, c2, a[22], a[26]);+	MONT_MAC(s0, s1, s2, a[23], a[25]);+	MONT_MAC(t0, t1, t2, a[24], a[24]);+	MONT_MUL(v0, v1, v2, u[1], m[47]);+	MONT_MUL(w0, w1, w2, u[2], m[46]);+	MONT_MAC(t0, t1, t2, u[3], m[45]);+	MONT_MAC(v0, v1, v2, u[4], m[44]);+	MONT_MAC(w0, w1, w2, u[5], m[43]);+	MONT_MAC(t0, t1, t2, u[6], m[42]);+	MONT_MAC(v0, v1, v2, u[7], m[41]);+	MONT_MAC(w0, w1, w2, u[8], m[40]);+	MONT_MAC(t0, t1, t2, u[9], m[39]);+	MONT_MAC(v0, v1, v2, u[10], m[38]);+	MONT_MAC(w0, w1, w2, u[11], m[37]);+	MONT_MAC(t0, t1, t2, u[12], m[36]);+	MONT_MAC(v0, v1, v2, u[13], m[35]);+	MONT_MAC(w0, w1, w2, u[14], m[34]);+	MONT_MAC(t0, t1, t2, u[15], m[33]);+	MONT_MAC(v0, v1, v2, u[16], m[32]);+	MONT_MAC(w0, w1, w2, u[17], m[31]);+	MONT_MAC(t0, t1, t2, u[18], m[30]);+	MONT_MAC(v0, v1, v2, u[19], m[29]);+	MONT_MAC(w0, w1, w2, u[20], m[28]);+	MONT_MAC(t0, t1, t2, u[21], m[27]);+	MONT_MAC(v0, v1, v2, u[22], m[26]);+	MONT_MAC(w0, w1, w2, u[23], m[25]);+	MONT_MAC(t0, t1, t2, u[24], m[24]);+	MONT_MAC(v0, v1, v2, u[25], m[23]);+	MONT_MAC(w0, w1, w2, u[26], m[22]);+	MONT_MAC(t0, t1, t2, u[27], m[21]);+	MONT_MAC(v0, v1, v2, u[28], m[20]);+	MONT_MAC(w0, w1, w2, u[29], m[19]);+	MONT_MAC(t0, t1, t2, u[30], m[18]);+	MONT_MAC(v0, v1, v2, u[31], m[17]);+	MONT_MAC(w0, w1, w2, u[32], m[16]);+	MONT_MAC(t0, t1, t2, u[33], m[15]);+	MONT_MAC(v0, v1, v2, u[34], m[14]);+	MONT_MAC(w0, w1, w2, u[35], m[13]);+	MONT_MAC(t0, t1, t2, u[36], m[12]);+	MONT_MAC(v0, v1, v2, u[37], m[11]);+	MONT_MAC(w0, w1, w2, u[38], m[10]);+	MONT_MAC(t0, t1, t2, u[39], m[9]);+	MONT_MAC(v0, v1, v2, u[40], m[8]);+	MONT_MAC(w0, w1, w2, u[41], m[7]);+	MONT_MAC(t0, t1, t2, u[42], m[6]);+	MONT_MAC(v0, v1, v2, u[43], m[5]);+	MONT_MAC(w0, w1, w2, u[44], m[4]);+	MONT_MAC(t0, t1, t2, u[45], m[3]);+	MONT_MAC(v0, v1, v2, u[46], m[2]);+	MONT_MAC(w0, w1, w2, u[47], m[1]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	MONT_ADD(s0, s1, s2, c0, c1, c2);+	MONT_DBL(s0, s1, s2);+	MONT_ADD(t0, t1, t2, s0, s1, s2);+	z[0] = t0;+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 49 */+	MONT_MUL(s0, s1, s2, a[2], a[47]);+	MONT_MUL(c0, c1, c2, a[3], a[46]);+	MONT_MAC(s0, s1, s2, a[4], a[45]);+	MONT_MAC(c0, c1, c2, a[5], a[44]);+	MONT_MAC(s0, s1, s2, a[6], a[43]);+	MONT_MAC(c0, c1, c2, a[7], a[42]);+	MONT_MAC(s0, s1, s2, a[8], a[41]);+	MONT_MAC(c0, c1, c2, a[9], a[40]);+	MONT_MAC(s0, s1, s2, a[10], a[39]);+	MONT_MAC(c0, c1, c2, a[11], a[38]);+	MONT_MAC(s0, s1, s2, a[12], a[37]);+	MONT_MAC(c0, c1, c2, a[13], a[36]);+	MONT_MAC(s0, s1, s2, a[14], a[35]);+	MONT_MAC(c0, c1, c2, a[15], a[34]);+	MONT_MAC(s0, s1, s2, a[16], a[33]);+	MONT_MAC(c0, c1, c2, a[17], a[32]);+	MONT_MAC(s0, s1, s2, a[18], a[31]);+	MONT_MAC(c0, c1, c2, a[19], a[30]);+	MONT_MAC(s0, s1, s2, a[20], a[29]);+	MONT_MAC(c0, c1, c2, a[21], a[28]);+	MONT_MAC(s0, s1, s2, a[22], a[27]);+	MONT_MAC(c0, c1, c2, a[23], a[26]);+	MONT_MAC(s0, s1, s2, a[24], a[25]);+	MONT_MAC(t0, t1, t2, u[2], m[47]);+	MONT_MUL(v0, v1, v2, u[3], m[46]);+	MONT_MUL(w0, w1, w2, u[4], m[45]);+	MONT_MAC(t0, t1, t2, u[5], m[44]);+	MONT_MAC(v0, v1, v2, u[6], m[43]);+	MONT_MAC(w0, w1, w2, u[7], m[42]);+	MONT_MAC(t0, t1, t2, u[8], m[41]);+	MONT_MAC(v0, v1, v2, u[9], m[40]);+	MONT_MAC(w0, w1, w2, u[10], m[39]);+	MONT_MAC(t0, t1, t2, u[11], m[38]);+	MONT_MAC(v0, v1, v2, u[12], m[37]);+	MONT_MAC(w0, w1, w2, u[13], m[36]);+	MONT_MAC(t0, t1, t2, u[14], m[35]);+	MONT_MAC(v0, v1, v2, u[15], m[34]);+	MONT_MAC(w0, w1, w2, u[16], m[33]);+	MONT_MAC(t0, t1, t2, u[17], m[32]);+	MONT_MAC(v0, v1, v2, u[18], m[31]);+	MONT_MAC(w0, w1, w2, u[19], m[30]);+	MONT_MAC(t0, t1, t2, u[20], m[29]);+	MONT_MAC(v0, v1, v2, u[21], m[28]);+	MONT_MAC(w0, w1, w2, u[22], m[27]);+	MONT_MAC(t0, t1, t2, u[23], m[26]);+	MONT_MAC(v0, v1, v2, u[24], m[25]);+	MONT_MAC(w0, w1, w2, u[25], m[24]);+	MONT_MAC(t0, t1, t2, u[26], m[23]);+	MONT_MAC(v0, v1, v2, u[27], m[22]);+	MONT_MAC(w0, w1, w2, u[28], m[21]);+	MONT_MAC(t0, t1, t2, u[29], m[20]);+	MONT_MAC(v0, v1, v2, u[30], m[19]);+	MONT_MAC(w0, w1, w2, u[31], m[18]);+	MONT_MAC(t0, t1, t2, u[32], m[17]);+	MONT_MAC(v0, v1, v2, u[33], m[16]);+	MONT_MAC(w0, w1, w2, u[34], m[15]);+	MONT_MAC(t0, t1, t2, u[35], m[14]);+	MONT_MAC(v0, v1, v2, u[36], m[13]);+	MONT_MAC(w0, w1, w2, u[37], m[12]);+	MONT_MAC(t0, t1, t2, u[38], m[11]);+	MONT_MAC(v0, v1, v2, u[39], m[10]);+	MONT_MAC(w0, w1, w2, u[40], m[9]);+	MONT_MAC(t0, t1, t2, u[41], m[8]);+	MONT_MAC(v0, v1, v2, u[42], m[7]);+	MONT_MAC(w0, w1, w2, u[43], m[6]);+	MONT_MAC(t0, t1, t2, u[44], m[5]);+	MONT_MAC(v0, v1, v2, u[45], m[4]);+	MONT_MAC(w0, w1, w2, u[46], m[3]);+	MONT_MAC(t0, t1, t2, u[47], m[2]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	MONT_ADD(s0, s1, s2, c0, c1, c2);+	MONT_DBL(s0, s1, s2);+	MONT_ADD(t0, t1, t2, s0, s1, s2);+	z[1] = t0;+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 50 */+	MONT_MUL(s0, s1, s2, a[3], a[47]);+	MONT_MUL(c0, c1, c2, a[4], a[46]);+	MONT_MAC(s0, s1, s2, a[5], a[45]);+	MONT_MAC(c0, c1, c2, a[6], a[44]);+	MONT_MAC(s0, s1, s2, a[7], a[43]);+	MONT_MAC(c0, c1, c2, a[8], a[42]);+	MONT_MAC(s0, s1, s2, a[9], a[41]);+	MONT_MAC(c0, c1, c2, a[10], a[40]);+	MONT_MAC(s0, s1, s2, a[11], a[39]);+	MONT_MAC(c0, c1, c2, a[12], a[38]);+	MONT_MAC(s0, s1, s2, a[13], a[37]);+	MONT_MAC(c0, c1, c2, a[14], a[36]);+	MONT_MAC(s0, s1, s2, a[15], a[35]);+	MONT_MAC(c0, c1, c2, a[16], a[34]);+	MONT_MAC(s0, s1, s2, a[17], a[33]);+	MONT_MAC(c0, c1, c2, a[18], a[32]);+	MONT_MAC(s0, s1, s2, a[19], a[31]);+	MONT_MAC(c0, c1, c2, a[20], a[30]);+	MONT_MAC(s0, s1, s2, a[21], a[29]);+	MONT_MAC(c0, c1, c2, a[22], a[28]);+	MONT_MAC(s0, s1, s2, a[23], a[27]);+	MONT_MAC(c0, c1, c2, a[24], a[26]);+	MONT_MAC(t0, t1, t2, a[25], a[25]);+	MONT_MUL(v0, v1, v2, u[3], m[47]);+	MONT_MUL(w0, w1, w2, u[4], m[46]);+	MONT_MAC(t0, t1, t2, u[5], m[45]);+	MONT_MAC(v0, v1, v2, u[6], m[44]);+	MONT_MAC(w0, w1, w2, u[7], m[43]);+	MONT_MAC(t0, t1, t2, u[8], m[42]);+	MONT_MAC(v0, v1, v2, u[9], m[41]);+	MONT_MAC(w0, w1, w2, u[10], m[40]);+	MONT_MAC(t0, t1, t2, u[11], m[39]);+	MONT_MAC(v0, v1, v2, u[12], m[38]);+	MONT_MAC(w0, w1, w2, u[13], m[37]);+	MONT_MAC(t0, t1, t2, u[14], m[36]);+	MONT_MAC(v0, v1, v2, u[15], m[35]);+	MONT_MAC(w0, w1, w2, u[16], m[34]);+	MONT_MAC(t0, t1, t2, u[17], m[33]);+	MONT_MAC(v0, v1, v2, u[18], m[32]);+	MONT_MAC(w0, w1, w2, u[19], m[31]);+	MONT_MAC(t0, t1, t2, u[20], m[30]);+	MONT_MAC(v0, v1, v2, u[21], m[29]);+	MONT_MAC(w0, w1, w2, u[22], m[28]);+	MONT_MAC(t0, t1, t2, u[23], m[27]);+	MONT_MAC(v0, v1, v2, u[24], m[26]);+	MONT_MAC(w0, w1, w2, u[25], m[25]);+	MONT_MAC(t0, t1, t2, u[26], m[24]);+	MONT_MAC(v0, v1, v2, u[27], m[23]);+	MONT_MAC(w0, w1, w2, u[28], m[22]);+	MONT_MAC(t0, t1, t2, u[29], m[21]);+	MONT_MAC(v0, v1, v2, u[30], m[20]);+	MONT_MAC(w0, w1, w2, u[31], m[19]);+	MONT_MAC(t0, t1, t2, u[32], m[18]);+	MONT_MAC(v0, v1, v2, u[33], m[17]);+	MONT_MAC(w0, w1, w2, u[34], m[16]);+	MONT_MAC(t0, t1, t2, u[35], m[15]);+	MONT_MAC(v0, v1, v2, u[36], m[14]);+	MONT_MAC(w0, w1, w2, u[37], m[13]);+	MONT_MAC(t0, t1, t2, u[38], m[12]);+	MONT_MAC(v0, v1, v2, u[39], m[11]);+	MONT_MAC(w0, w1, w2, u[40], m[10]);+	MONT_MAC(t0, t1, t2, u[41], m[9]);+	MONT_MAC(v0, v1, v2, u[42], m[8]);+	MONT_MAC(w0, w1, w2, u[43], m[7]);+	MONT_MAC(t0, t1, t2, u[44], m[6]);+	MONT_MAC(v0, v1, v2, u[45], m[5]);+	MONT_MAC(w0, w1, w2, u[46], m[4]);+	MONT_MAC(t0, t1, t2, u[47], m[3]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	MONT_ADD(s0, s1, s2, c0, c1, c2);+	MONT_DBL(s0, s1, s2);+	MONT_ADD(t0, t1, t2, s0, s1, s2);+	z[2] = t0;+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 51 */+	MONT_MUL(s0, s1, s2, a[4], a[47]);+	MONT_MUL(c0, c1, c2, a[5], a[46]);+	MONT_MAC(s0, s1, s2, a[6], a[45]);+	MONT_MAC(c0, c1, c2, a[7], a[44]);+	MONT_MAC(s0, s1, s2, a[8], a[43]);+	MONT_MAC(c0, c1, c2, a[9], a[42]);+	MONT_MAC(s0, s1, s2, a[10], a[41]);+	MONT_MAC(c0, c1, c2, a[11], a[40]);+	MONT_MAC(s0, s1, s2, a[12], a[39]);+	MONT_MAC(c0, c1, c2, a[13], a[38]);+	MONT_MAC(s0, s1, s2, a[14], a[37]);+	MONT_MAC(c0, c1, c2, a[15], a[36]);+	MONT_MAC(s0, s1, s2, a[16], a[35]);+	MONT_MAC(c0, c1, c2, a[17], a[34]);+	MONT_MAC(s0, s1, s2, a[18], a[33]);+	MONT_MAC(c0, c1, c2, a[19], a[32]);+	MONT_MAC(s0, s1, s2, a[20], a[31]);+	MONT_MAC(c0, c1, c2, a[21], a[30]);+	MONT_MAC(s0, s1, s2, a[22], a[29]);+	MONT_MAC(c0, c1, c2, a[23], a[28]);+	MONT_MAC(s0, s1, s2, a[24], a[27]);+	MONT_MAC(c0, c1, c2, a[25], a[26]);+	MONT_MAC(t0, t1, t2, u[4], m[47]);+	MONT_MUL(v0, v1, v2, u[5], m[46]);+	MONT_MUL(w0, w1, w2, u[6], m[45]);+	MONT_MAC(t0, t1, t2, u[7], m[44]);+	MONT_MAC(v0, v1, v2, u[8], m[43]);+	MONT_MAC(w0, w1, w2, u[9], m[42]);+	MONT_MAC(t0, t1, t2, u[10], m[41]);+	MONT_MAC(v0, v1, v2, u[11], m[40]);+	MONT_MAC(w0, w1, w2, u[12], m[39]);+	MONT_MAC(t0, t1, t2, u[13], m[38]);+	MONT_MAC(v0, v1, v2, u[14], m[37]);+	MONT_MAC(w0, w1, w2, u[15], m[36]);+	MONT_MAC(t0, t1, t2, u[16], m[35]);+	MONT_MAC(v0, v1, v2, u[17], m[34]);+	MONT_MAC(w0, w1, w2, u[18], m[33]);+	MONT_MAC(t0, t1, t2, u[19], m[32]);+	MONT_MAC(v0, v1, v2, u[20], m[31]);+	MONT_MAC(w0, w1, w2, u[21], m[30]);+	MONT_MAC(t0, t1, t2, u[22], m[29]);+	MONT_MAC(v0, v1, v2, u[23], m[28]);+	MONT_MAC(w0, w1, w2, u[24], m[27]);+	MONT_MAC(t0, t1, t2, u[25], m[26]);+	MONT_MAC(v0, v1, v2, u[26], m[25]);+	MONT_MAC(w0, w1, w2, u[27], m[24]);+	MONT_MAC(t0, t1, t2, u[28], m[23]);+	MONT_MAC(v0, v1, v2, u[29], m[22]);+	MONT_MAC(w0, w1, w2, u[30], m[21]);+	MONT_MAC(t0, t1, t2, u[31], m[20]);+	MONT_MAC(v0, v1, v2, u[32], m[19]);+	MONT_MAC(w0, w1, w2, u[33], m[18]);+	MONT_MAC(t0, t1, t2, u[34], m[17]);+	MONT_MAC(v0, v1, v2, u[35], m[16]);+	MONT_MAC(w0, w1, w2, u[36], m[15]);+	MONT_MAC(t0, t1, t2, u[37], m[14]);+	MONT_MAC(v0, v1, v2, u[38], m[13]);+	MONT_MAC(w0, w1, w2, u[39], m[12]);+	MONT_MAC(t0, t1, t2, u[40], m[11]);+	MONT_MAC(v0, v1, v2, u[41], m[10]);+	MONT_MAC(w0, w1, w2, u[42], m[9]);+	MONT_MAC(t0, t1, t2, u[43], m[8]);+	MONT_MAC(v0, v1, v2, u[44], m[7]);+	MONT_MAC(w0, w1, w2, u[45], m[6]);+	MONT_MAC(t0, t1, t2, u[46], m[5]);+	MONT_MAC(v0, v1, v2, u[47], m[4]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	MONT_ADD(s0, s1, s2, c0, c1, c2);+	MONT_DBL(s0, s1, s2);+	MONT_ADD(t0, t1, t2, s0, s1, s2);+	z[3] = t0;+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 52 */+	MONT_MUL(s0, s1, s2, a[5], a[47]);+	MONT_MUL(c0, c1, c2, a[6], a[46]);+	MONT_MAC(s0, s1, s2, a[7], a[45]);+	MONT_MAC(c0, c1, c2, a[8], a[44]);+	MONT_MAC(s0, s1, s2, a[9], a[43]);+	MONT_MAC(c0, c1, c2, a[10], a[42]);+	MONT_MAC(s0, s1, s2, a[11], a[41]);+	MONT_MAC(c0, c1, c2, a[12], a[40]);+	MONT_MAC(s0, s1, s2, a[13], a[39]);+	MONT_MAC(c0, c1, c2, a[14], a[38]);+	MONT_MAC(s0, s1, s2, a[15], a[37]);+	MONT_MAC(c0, c1, c2, a[16], a[36]);+	MONT_MAC(s0, s1, s2, a[17], a[35]);+	MONT_MAC(c0, c1, c2, a[18], a[34]);+	MONT_MAC(s0, s1, s2, a[19], a[33]);+	MONT_MAC(c0, c1, c2, a[20], a[32]);+	MONT_MAC(s0, s1, s2, a[21], a[31]);+	MONT_MAC(c0, c1, c2, a[22], a[30]);+	MONT_MAC(s0, s1, s2, a[23], a[29]);+	MONT_MAC(c0, c1, c2, a[24], a[28]);+	MONT_MAC(s0, s1, s2, a[25], a[27]);+	MONT_MAC(t0, t1, t2, a[26], a[26]);+	MONT_MUL(v0, v1, v2, u[5], m[47]);+	MONT_MUL(w0, w1, w2, u[6], m[46]);+	MONT_MAC(t0, t1, t2, u[7], m[45]);+	MONT_MAC(v0, v1, v2, u[8], m[44]);+	MONT_MAC(w0, w1, w2, u[9], m[43]);+	MONT_MAC(t0, t1, t2, u[10], m[42]);+	MONT_MAC(v0, v1, v2, u[11], m[41]);+	MONT_MAC(w0, w1, w2, u[12], m[40]);+	MONT_MAC(t0, t1, t2, u[13], m[39]);+	MONT_MAC(v0, v1, v2, u[14], m[38]);+	MONT_MAC(w0, w1, w2, u[15], m[37]);+	MONT_MAC(t0, t1, t2, u[16], m[36]);+	MONT_MAC(v0, v1, v2, u[17], m[35]);+	MONT_MAC(w0, w1, w2, u[18], m[34]);+	MONT_MAC(t0, t1, t2, u[19], m[33]);+	MONT_MAC(v0, v1, v2, u[20], m[32]);+	MONT_MAC(w0, w1, w2, u[21], m[31]);+	MONT_MAC(t0, t1, t2, u[22], m[30]);+	MONT_MAC(v0, v1, v2, u[23], m[29]);+	MONT_MAC(w0, w1, w2, u[24], m[28]);+	MONT_MAC(t0, t1, t2, u[25], m[27]);+	MONT_MAC(v0, v1, v2, u[26], m[26]);+	MONT_MAC(w0, w1, w2, u[27], m[25]);+	MONT_MAC(t0, t1, t2, u[28], m[24]);+	MONT_MAC(v0, v1, v2, u[29], m[23]);+	MONT_MAC(w0, w1, w2, u[30], m[22]);+	MONT_MAC(t0, t1, t2, u[31], m[21]);+	MONT_MAC(v0, v1, v2, u[32], m[20]);+	MONT_MAC(w0, w1, w2, u[33], m[19]);+	MONT_MAC(t0, t1, t2, u[34], m[18]);+	MONT_MAC(v0, v1, v2, u[35], m[17]);+	MONT_MAC(w0, w1, w2, u[36], m[16]);+	MONT_MAC(t0, t1, t2, u[37], m[15]);+	MONT_MAC(v0, v1, v2, u[38], m[14]);+	MONT_MAC(w0, w1, w2, u[39], m[13]);+	MONT_MAC(t0, t1, t2, u[40], m[12]);+	MONT_MAC(v0, v1, v2, u[41], m[11]);+	MONT_MAC(w0, w1, w2, u[42], m[10]);+	MONT_MAC(t0, t1, t2, u[43], m[9]);+	MONT_MAC(v0, v1, v2, u[44], m[8]);+	MONT_MAC(w0, w1, w2, u[45], m[7]);+	MONT_MAC(t0, t1, t2, u[46], m[6]);+	MONT_MAC(v0, v1, v2, u[47], m[5]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	MONT_ADD(s0, s1, s2, c0, c1, c2);+	MONT_DBL(s0, s1, s2);+	MONT_ADD(t0, t1, t2, s0, s1, s2);+	z[4] = t0;+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 53 */+	MONT_MUL(s0, s1, s2, a[6], a[47]);+	MONT_MUL(c0, c1, c2, a[7], a[46]);+	MONT_MAC(s0, s1, s2, a[8], a[45]);+	MONT_MAC(c0, c1, c2, a[9], a[44]);+	MONT_MAC(s0, s1, s2, a[10], a[43]);+	MONT_MAC(c0, c1, c2, a[11], a[42]);+	MONT_MAC(s0, s1, s2, a[12], a[41]);+	MONT_MAC(c0, c1, c2, a[13], a[40]);+	MONT_MAC(s0, s1, s2, a[14], a[39]);+	MONT_MAC(c0, c1, c2, a[15], a[38]);+	MONT_MAC(s0, s1, s2, a[16], a[37]);+	MONT_MAC(c0, c1, c2, a[17], a[36]);+	MONT_MAC(s0, s1, s2, a[18], a[35]);+	MONT_MAC(c0, c1, c2, a[19], a[34]);+	MONT_MAC(s0, s1, s2, a[20], a[33]);+	MONT_MAC(c0, c1, c2, a[21], a[32]);+	MONT_MAC(s0, s1, s2, a[22], a[31]);+	MONT_MAC(c0, c1, c2, a[23], a[30]);+	MONT_MAC(s0, s1, s2, a[24], a[29]);+	MONT_MAC(c0, c1, c2, a[25], a[28]);+	MONT_MAC(s0, s1, s2, a[26], a[27]);+	MONT_MAC(t0, t1, t2, u[6], m[47]);+	MONT_MUL(v0, v1, v2, u[7], m[46]);+	MONT_MUL(w0, w1, w2, u[8], m[45]);+	MONT_MAC(t0, t1, t2, u[9], m[44]);+	MONT_MAC(v0, v1, v2, u[10], m[43]);+	MONT_MAC(w0, w1, w2, u[11], m[42]);+	MONT_MAC(t0, t1, t2, u[12], m[41]);+	MONT_MAC(v0, v1, v2, u[13], m[40]);+	MONT_MAC(w0, w1, w2, u[14], m[39]);+	MONT_MAC(t0, t1, t2, u[15], m[38]);+	MONT_MAC(v0, v1, v2, u[16], m[37]);+	MONT_MAC(w0, w1, w2, u[17], m[36]);+	MONT_MAC(t0, t1, t2, u[18], m[35]);+	MONT_MAC(v0, v1, v2, u[19], m[34]);+	MONT_MAC(w0, w1, w2, u[20], m[33]);+	MONT_MAC(t0, t1, t2, u[21], m[32]);+	MONT_MAC(v0, v1, v2, u[22], m[31]);+	MONT_MAC(w0, w1, w2, u[23], m[30]);+	MONT_MAC(t0, t1, t2, u[24], m[29]);+	MONT_MAC(v0, v1, v2, u[25], m[28]);+	MONT_MAC(w0, w1, w2, u[26], m[27]);+	MONT_MAC(t0, t1, t2, u[27], m[26]);+	MONT_MAC(v0, v1, v2, u[28], m[25]);+	MONT_MAC(w0, w1, w2, u[29], m[24]);+	MONT_MAC(t0, t1, t2, u[30], m[23]);+	MONT_MAC(v0, v1, v2, u[31], m[22]);+	MONT_MAC(w0, w1, w2, u[32], m[21]);+	MONT_MAC(t0, t1, t2, u[33], m[20]);+	MONT_MAC(v0, v1, v2, u[34], m[19]);+	MONT_MAC(w0, w1, w2, u[35], m[18]);+	MONT_MAC(t0, t1, t2, u[36], m[17]);+	MONT_MAC(v0, v1, v2, u[37], m[16]);+	MONT_MAC(w0, w1, w2, u[38], m[15]);+	MONT_MAC(t0, t1, t2, u[39], m[14]);+	MONT_MAC(v0, v1, v2, u[40], m[13]);+	MONT_MAC(w0, w1, w2, u[41], m[12]);+	MONT_MAC(t0, t1, t2, u[42], m[11]);+	MONT_MAC(v0, v1, v2, u[43], m[10]);+	MONT_MAC(w0, w1, w2, u[44], m[9]);+	MONT_MAC(t0, t1, t2, u[45], m[8]);+	MONT_MAC(v0, v1, v2, u[46], m[7]);+	MONT_MAC(w0, w1, w2, u[47], m[6]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	MONT_ADD(s0, s1, s2, c0, c1, c2);+	MONT_DBL(s0, s1, s2);+	MONT_ADD(t0, t1, t2, s0, s1, s2);+	z[5] = t0;+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 54 */+	MONT_MUL(s0, s1, s2, a[7], a[47]);+	MONT_MUL(c0, c1, c2, a[8], a[46]);+	MONT_MAC(s0, s1, s2, a[9], a[45]);+	MONT_MAC(c0, c1, c2, a[10], a[44]);+	MONT_MAC(s0, s1, s2, a[11], a[43]);+	MONT_MAC(c0, c1, c2, a[12], a[42]);+	MONT_MAC(s0, s1, s2, a[13], a[41]);+	MONT_MAC(c0, c1, c2, a[14], a[40]);+	MONT_MAC(s0, s1, s2, a[15], a[39]);+	MONT_MAC(c0, c1, c2, a[16], a[38]);+	MONT_MAC(s0, s1, s2, a[17], a[37]);+	MONT_MAC(c0, c1, c2, a[18], a[36]);+	MONT_MAC(s0, s1, s2, a[19], a[35]);+	MONT_MAC(c0, c1, c2, a[20], a[34]);+	MONT_MAC(s0, s1, s2, a[21], a[33]);+	MONT_MAC(c0, c1, c2, a[22], a[32]);+	MONT_MAC(s0, s1, s2, a[23], a[31]);+	MONT_MAC(c0, c1, c2, a[24], a[30]);+	MONT_MAC(s0, s1, s2, a[25], a[29]);+	MONT_MAC(c0, c1, c2, a[26], a[28]);+	MONT_MAC(t0, t1, t2, a[27], a[27]);+	MONT_MUL(v0, v1, v2, u[7], m[47]);+	MONT_MUL(w0, w1, w2, u[8], m[46]);+	MONT_MAC(t0, t1, t2, u[9], m[45]);+	MONT_MAC(v0, v1, v2, u[10], m[44]);+	MONT_MAC(w0, w1, w2, u[11], m[43]);+	MONT_MAC(t0, t1, t2, u[12], m[42]);+	MONT_MAC(v0, v1, v2, u[13], m[41]);+	MONT_MAC(w0, w1, w2, u[14], m[40]);+	MONT_MAC(t0, t1, t2, u[15], m[39]);+	MONT_MAC(v0, v1, v2, u[16], m[38]);+	MONT_MAC(w0, w1, w2, u[17], m[37]);+	MONT_MAC(t0, t1, t2, u[18], m[36]);+	MONT_MAC(v0, v1, v2, u[19], m[35]);+	MONT_MAC(w0, w1, w2, u[20], m[34]);+	MONT_MAC(t0, t1, t2, u[21], m[33]);+	MONT_MAC(v0, v1, v2, u[22], m[32]);+	MONT_MAC(w0, w1, w2, u[23], m[31]);+	MONT_MAC(t0, t1, t2, u[24], m[30]);+	MONT_MAC(v0, v1, v2, u[25], m[29]);+	MONT_MAC(w0, w1, w2, u[26], m[28]);+	MONT_MAC(t0, t1, t2, u[27], m[27]);+	MONT_MAC(v0, v1, v2, u[28], m[26]);+	MONT_MAC(w0, w1, w2, u[29], m[25]);+	MONT_MAC(t0, t1, t2, u[30], m[24]);+	MONT_MAC(v0, v1, v2, u[31], m[23]);+	MONT_MAC(w0, w1, w2, u[32], m[22]);+	MONT_MAC(t0, t1, t2, u[33], m[21]);+	MONT_MAC(v0, v1, v2, u[34], m[20]);+	MONT_MAC(w0, w1, w2, u[35], m[19]);+	MONT_MAC(t0, t1, t2, u[36], m[18]);+	MONT_MAC(v0, v1, v2, u[37], m[17]);+	MONT_MAC(w0, w1, w2, u[38], m[16]);+	MONT_MAC(t0, t1, t2, u[39], m[15]);+	MONT_MAC(v0, v1, v2, u[40], m[14]);+	MONT_MAC(w0, w1, w2, u[41], m[13]);+	MONT_MAC(t0, t1, t2, u[42], m[12]);+	MONT_MAC(v0, v1, v2, u[43], m[11]);+	MONT_MAC(w0, w1, w2, u[44], m[10]);+	MONT_MAC(t0, t1, t2, u[45], m[9]);+	MONT_MAC(v0, v1, v2, u[46], m[8]);+	MONT_MAC(w0, w1, w2, u[47], m[7]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	MONT_ADD(s0, s1, s2, c0, c1, c2);+	MONT_DBL(s0, s1, s2);+	MONT_ADD(t0, t1, t2, s0, s1, s2);+	z[6] = t0;+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 55 */+	MONT_MUL(s0, s1, s2, a[8], a[47]);+	MONT_MUL(c0, c1, c2, a[9], a[46]);+	MONT_MAC(s0, s1, s2, a[10], a[45]);+	MONT_MAC(c0, c1, c2, a[11], a[44]);+	MONT_MAC(s0, s1, s2, a[12], a[43]);+	MONT_MAC(c0, c1, c2, a[13], a[42]);+	MONT_MAC(s0, s1, s2, a[14], a[41]);+	MONT_MAC(c0, c1, c2, a[15], a[40]);+	MONT_MAC(s0, s1, s2, a[16], a[39]);+	MONT_MAC(c0, c1, c2, a[17], a[38]);+	MONT_MAC(s0, s1, s2, a[18], a[37]);+	MONT_MAC(c0, c1, c2, a[19], a[36]);+	MONT_MAC(s0, s1, s2, a[20], a[35]);+	MONT_MAC(c0, c1, c2, a[21], a[34]);+	MONT_MAC(s0, s1, s2, a[22], a[33]);+	MONT_MAC(c0, c1, c2, a[23], a[32]);+	MONT_MAC(s0, s1, s2, a[24], a[31]);+	MONT_MAC(c0, c1, c2, a[25], a[30]);+	MONT_MAC(s0, s1, s2, a[26], a[29]);+	MONT_MAC(c0, c1, c2, a[27], a[28]);+	MONT_MAC(t0, t1, t2, u[8], m[47]);+	MONT_MUL(v0, v1, v2, u[9], m[46]);+	MONT_MUL(w0, w1, w2, u[10], m[45]);+	MONT_MAC(t0, t1, t2, u[11], m[44]);+	MONT_MAC(v0, v1, v2, u[12], m[43]);+	MONT_MAC(w0, w1, w2, u[13], m[42]);+	MONT_MAC(t0, t1, t2, u[14], m[41]);+	MONT_MAC(v0, v1, v2, u[15], m[40]);+	MONT_MAC(w0, w1, w2, u[16], m[39]);+	MONT_MAC(t0, t1, t2, u[17], m[38]);+	MONT_MAC(v0, v1, v2, u[18], m[37]);+	MONT_MAC(w0, w1, w2, u[19], m[36]);+	MONT_MAC(t0, t1, t2, u[20], m[35]);+	MONT_MAC(v0, v1, v2, u[21], m[34]);+	MONT_MAC(w0, w1, w2, u[22], m[33]);+	MONT_MAC(t0, t1, t2, u[23], m[32]);+	MONT_MAC(v0, v1, v2, u[24], m[31]);+	MONT_MAC(w0, w1, w2, u[25], m[30]);+	MONT_MAC(t0, t1, t2, u[26], m[29]);+	MONT_MAC(v0, v1, v2, u[27], m[28]);+	MONT_MAC(w0, w1, w2, u[28], m[27]);+	MONT_MAC(t0, t1, t2, u[29], m[26]);+	MONT_MAC(v0, v1, v2, u[30], m[25]);+	MONT_MAC(w0, w1, w2, u[31], m[24]);+	MONT_MAC(t0, t1, t2, u[32], m[23]);+	MONT_MAC(v0, v1, v2, u[33], m[22]);+	MONT_MAC(w0, w1, w2, u[34], m[21]);+	MONT_MAC(t0, t1, t2, u[35], m[20]);+	MONT_MAC(v0, v1, v2, u[36], m[19]);+	MONT_MAC(w0, w1, w2, u[37], m[18]);+	MONT_MAC(t0, t1, t2, u[38], m[17]);+	MONT_MAC(v0, v1, v2, u[39], m[16]);+	MONT_MAC(w0, w1, w2, u[40], m[15]);+	MONT_MAC(t0, t1, t2, u[41], m[14]);+	MONT_MAC(v0, v1, v2, u[42], m[13]);+	MONT_MAC(w0, w1, w2, u[43], m[12]);+	MONT_MAC(t0, t1, t2, u[44], m[11]);+	MONT_MAC(v0, v1, v2, u[45], m[10]);+	MONT_MAC(w0, w1, w2, u[46], m[9]);+	MONT_MAC(t0, t1, t2, u[47], m[8]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	MONT_ADD(s0, s1, s2, c0, c1, c2);+	MONT_DBL(s0, s1, s2);+	MONT_ADD(t0, t1, t2, s0, s1, s2);+	z[7] = t0;+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 56 */+	MONT_MUL(s0, s1, s2, a[9], a[47]);+	MONT_MUL(c0, c1, c2, a[10], a[46]);+	MONT_MAC(s0, s1, s2, a[11], a[45]);+	MONT_MAC(c0, c1, c2, a[12], a[44]);+	MONT_MAC(s0, s1, s2, a[13], a[43]);+	MONT_MAC(c0, c1, c2, a[14], a[42]);+	MONT_MAC(s0, s1, s2, a[15], a[41]);+	MONT_MAC(c0, c1, c2, a[16], a[40]);+	MONT_MAC(s0, s1, s2, a[17], a[39]);+	MONT_MAC(c0, c1, c2, a[18], a[38]);+	MONT_MAC(s0, s1, s2, a[19], a[37]);+	MONT_MAC(c0, c1, c2, a[20], a[36]);+	MONT_MAC(s0, s1, s2, a[21], a[35]);+	MONT_MAC(c0, c1, c2, a[22], a[34]);+	MONT_MAC(s0, s1, s2, a[23], a[33]);+	MONT_MAC(c0, c1, c2, a[24], a[32]);+	MONT_MAC(s0, s1, s2, a[25], a[31]);+	MONT_MAC(c0, c1, c2, a[26], a[30]);+	MONT_MAC(s0, s1, s2, a[27], a[29]);+	MONT_MAC(t0, t1, t2, a[28], a[28]);+	MONT_MUL(v0, v1, v2, u[9], m[47]);+	MONT_MUL(w0, w1, w2, u[10], m[46]);+	MONT_MAC(t0, t1, t2, u[11], m[45]);+	MONT_MAC(v0, v1, v2, u[12], m[44]);+	MONT_MAC(w0, w1, w2, u[13], m[43]);+	MONT_MAC(t0, t1, t2, u[14], m[42]);+	MONT_MAC(v0, v1, v2, u[15], m[41]);+	MONT_MAC(w0, w1, w2, u[16], m[40]);+	MONT_MAC(t0, t1, t2, u[17], m[39]);+	MONT_MAC(v0, v1, v2, u[18], m[38]);+	MONT_MAC(w0, w1, w2, u[19], m[37]);+	MONT_MAC(t0, t1, t2, u[20], m[36]);+	MONT_MAC(v0, v1, v2, u[21], m[35]);+	MONT_MAC(w0, w1, w2, u[22], m[34]);+	MONT_MAC(t0, t1, t2, u[23], m[33]);+	MONT_MAC(v0, v1, v2, u[24], m[32]);+	MONT_MAC(w0, w1, w2, u[25], m[31]);+	MONT_MAC(t0, t1, t2, u[26], m[30]);+	MONT_MAC(v0, v1, v2, u[27], m[29]);+	MONT_MAC(w0, w1, w2, u[28], m[28]);+	MONT_MAC(t0, t1, t2, u[29], m[27]);+	MONT_MAC(v0, v1, v2, u[30], m[26]);+	MONT_MAC(w0, w1, w2, u[31], m[25]);+	MONT_MAC(t0, t1, t2, u[32], m[24]);+	MONT_MAC(v0, v1, v2, u[33], m[23]);+	MONT_MAC(w0, w1, w2, u[34], m[22]);+	MONT_MAC(t0, t1, t2, u[35], m[21]);+	MONT_MAC(v0, v1, v2, u[36], m[20]);+	MONT_MAC(w0, w1, w2, u[37], m[19]);+	MONT_MAC(t0, t1, t2, u[38], m[18]);+	MONT_MAC(v0, v1, v2, u[39], m[17]);+	MONT_MAC(w0, w1, w2, u[40], m[16]);+	MONT_MAC(t0, t1, t2, u[41], m[15]);+	MONT_MAC(v0, v1, v2, u[42], m[14]);+	MONT_MAC(w0, w1, w2, u[43], m[13]);+	MONT_MAC(t0, t1, t2, u[44], m[12]);+	MONT_MAC(v0, v1, v2, u[45], m[11]);+	MONT_MAC(w0, w1, w2, u[46], m[10]);+	MONT_MAC(t0, t1, t2, u[47], m[9]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	MONT_ADD(s0, s1, s2, c0, c1, c2);+	MONT_DBL(s0, s1, s2);+	MONT_ADD(t0, t1, t2, s0, s1, s2);+	z[8] = t0;+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 57 */+	MONT_MUL(s0, s1, s2, a[10], a[47]);+	MONT_MUL(c0, c1, c2, a[11], a[46]);+	MONT_MAC(s0, s1, s2, a[12], a[45]);+	MONT_MAC(c0, c1, c2, a[13], a[44]);+	MONT_MAC(s0, s1, s2, a[14], a[43]);+	MONT_MAC(c0, c1, c2, a[15], a[42]);+	MONT_MAC(s0, s1, s2, a[16], a[41]);+	MONT_MAC(c0, c1, c2, a[17], a[40]);+	MONT_MAC(s0, s1, s2, a[18], a[39]);+	MONT_MAC(c0, c1, c2, a[19], a[38]);+	MONT_MAC(s0, s1, s2, a[20], a[37]);+	MONT_MAC(c0, c1, c2, a[21], a[36]);+	MONT_MAC(s0, s1, s2, a[22], a[35]);+	MONT_MAC(c0, c1, c2, a[23], a[34]);+	MONT_MAC(s0, s1, s2, a[24], a[33]);+	MONT_MAC(c0, c1, c2, a[25], a[32]);+	MONT_MAC(s0, s1, s2, a[26], a[31]);+	MONT_MAC(c0, c1, c2, a[27], a[30]);+	MONT_MAC(s0, s1, s2, a[28], a[29]);+	MONT_MAC(t0, t1, t2, u[10], m[47]);+	MONT_MUL(v0, v1, v2, u[11], m[46]);+	MONT_MUL(w0, w1, w2, u[12], m[45]);+	MONT_MAC(t0, t1, t2, u[13], m[44]);+	MONT_MAC(v0, v1, v2, u[14], m[43]);+	MONT_MAC(w0, w1, w2, u[15], m[42]);+	MONT_MAC(t0, t1, t2, u[16], m[41]);+	MONT_MAC(v0, v1, v2, u[17], m[40]);+	MONT_MAC(w0, w1, w2, u[18], m[39]);+	MONT_MAC(t0, t1, t2, u[19], m[38]);+	MONT_MAC(v0, v1, v2, u[20], m[37]);+	MONT_MAC(w0, w1, w2, u[21], m[36]);+	MONT_MAC(t0, t1, t2, u[22], m[35]);+	MONT_MAC(v0, v1, v2, u[23], m[34]);+	MONT_MAC(w0, w1, w2, u[24], m[33]);+	MONT_MAC(t0, t1, t2, u[25], m[32]);+	MONT_MAC(v0, v1, v2, u[26], m[31]);+	MONT_MAC(w0, w1, w2, u[27], m[30]);+	MONT_MAC(t0, t1, t2, u[28], m[29]);+	MONT_MAC(v0, v1, v2, u[29], m[28]);+	MONT_MAC(w0, w1, w2, u[30], m[27]);+	MONT_MAC(t0, t1, t2, u[31], m[26]);+	MONT_MAC(v0, v1, v2, u[32], m[25]);+	MONT_MAC(w0, w1, w2, u[33], m[24]);+	MONT_MAC(t0, t1, t2, u[34], m[23]);+	MONT_MAC(v0, v1, v2, u[35], m[22]);+	MONT_MAC(w0, w1, w2, u[36], m[21]);+	MONT_MAC(t0, t1, t2, u[37], m[20]);+	MONT_MAC(v0, v1, v2, u[38], m[19]);+	MONT_MAC(w0, w1, w2, u[39], m[18]);+	MONT_MAC(t0, t1, t2, u[40], m[17]);+	MONT_MAC(v0, v1, v2, u[41], m[16]);+	MONT_MAC(w0, w1, w2, u[42], m[15]);+	MONT_MAC(t0, t1, t2, u[43], m[14]);+	MONT_MAC(v0, v1, v2, u[44], m[13]);+	MONT_MAC(w0, w1, w2, u[45], m[12]);+	MONT_MAC(t0, t1, t2, u[46], m[11]);+	MONT_MAC(v0, v1, v2, u[47], m[10]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	MONT_ADD(s0, s1, s2, c0, c1, c2);+	MONT_DBL(s0, s1, s2);+	MONT_ADD(t0, t1, t2, s0, s1, s2);+	z[9] = t0;+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 58 */+	MONT_MUL(s0, s1, s2, a[11], a[47]);+	MONT_MUL(c0, c1, c2, a[12], a[46]);+	MONT_MAC(s0, s1, s2, a[13], a[45]);+	MONT_MAC(c0, c1, c2, a[14], a[44]);+	MONT_MAC(s0, s1, s2, a[15], a[43]);+	MONT_MAC(c0, c1, c2, a[16], a[42]);+	MONT_MAC(s0, s1, s2, a[17], a[41]);+	MONT_MAC(c0, c1, c2, a[18], a[40]);+	MONT_MAC(s0, s1, s2, a[19], a[39]);+	MONT_MAC(c0, c1, c2, a[20], a[38]);+	MONT_MAC(s0, s1, s2, a[21], a[37]);+	MONT_MAC(c0, c1, c2, a[22], a[36]);+	MONT_MAC(s0, s1, s2, a[23], a[35]);+	MONT_MAC(c0, c1, c2, a[24], a[34]);+	MONT_MAC(s0, s1, s2, a[25], a[33]);+	MONT_MAC(c0, c1, c2, a[26], a[32]);+	MONT_MAC(s0, s1, s2, a[27], a[31]);+	MONT_MAC(c0, c1, c2, a[28], a[30]);+	MONT_MAC(t0, t1, t2, a[29], a[29]);+	MONT_MUL(v0, v1, v2, u[11], m[47]);+	MONT_MUL(w0, w1, w2, u[12], m[46]);+	MONT_MAC(t0, t1, t2, u[13], m[45]);+	MONT_MAC(v0, v1, v2, u[14], m[44]);+	MONT_MAC(w0, w1, w2, u[15], m[43]);+	MONT_MAC(t0, t1, t2, u[16], m[42]);+	MONT_MAC(v0, v1, v2, u[17], m[41]);+	MONT_MAC(w0, w1, w2, u[18], m[40]);+	MONT_MAC(t0, t1, t2, u[19], m[39]);+	MONT_MAC(v0, v1, v2, u[20], m[38]);+	MONT_MAC(w0, w1, w2, u[21], m[37]);+	MONT_MAC(t0, t1, t2, u[22], m[36]);+	MONT_MAC(v0, v1, v2, u[23], m[35]);+	MONT_MAC(w0, w1, w2, u[24], m[34]);+	MONT_MAC(t0, t1, t2, u[25], m[33]);+	MONT_MAC(v0, v1, v2, u[26], m[32]);+	MONT_MAC(w0, w1, w2, u[27], m[31]);+	MONT_MAC(t0, t1, t2, u[28], m[30]);+	MONT_MAC(v0, v1, v2, u[29], m[29]);+	MONT_MAC(w0, w1, w2, u[30], m[28]);+	MONT_MAC(t0, t1, t2, u[31], m[27]);+	MONT_MAC(v0, v1, v2, u[32], m[26]);+	MONT_MAC(w0, w1, w2, u[33], m[25]);+	MONT_MAC(t0, t1, t2, u[34], m[24]);+	MONT_MAC(v0, v1, v2, u[35], m[23]);+	MONT_MAC(w0, w1, w2, u[36], m[22]);+	MONT_MAC(t0, t1, t2, u[37], m[21]);+	MONT_MAC(v0, v1, v2, u[38], m[20]);+	MONT_MAC(w0, w1, w2, u[39], m[19]);+	MONT_MAC(t0, t1, t2, u[40], m[18]);+	MONT_MAC(v0, v1, v2, u[41], m[17]);+	MONT_MAC(w0, w1, w2, u[42], m[16]);+	MONT_MAC(t0, t1, t2, u[43], m[15]);+	MONT_MAC(v0, v1, v2, u[44], m[14]);+	MONT_MAC(w0, w1, w2, u[45], m[13]);+	MONT_MAC(t0, t1, t2, u[46], m[12]);+	MONT_MAC(v0, v1, v2, u[47], m[11]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	MONT_ADD(s0, s1, s2, c0, c1, c2);+	MONT_DBL(s0, s1, s2);+	MONT_ADD(t0, t1, t2, s0, s1, s2);+	z[10] = t0;+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 59 */+	MONT_MUL(s0, s1, s2, a[12], a[47]);+	MONT_MUL(c0, c1, c2, a[13], a[46]);+	MONT_MAC(s0, s1, s2, a[14], a[45]);+	MONT_MAC(c0, c1, c2, a[15], a[44]);+	MONT_MAC(s0, s1, s2, a[16], a[43]);+	MONT_MAC(c0, c1, c2, a[17], a[42]);+	MONT_MAC(s0, s1, s2, a[18], a[41]);+	MONT_MAC(c0, c1, c2, a[19], a[40]);+	MONT_MAC(s0, s1, s2, a[20], a[39]);+	MONT_MAC(c0, c1, c2, a[21], a[38]);+	MONT_MAC(s0, s1, s2, a[22], a[37]);+	MONT_MAC(c0, c1, c2, a[23], a[36]);+	MONT_MAC(s0, s1, s2, a[24], a[35]);+	MONT_MAC(c0, c1, c2, a[25], a[34]);+	MONT_MAC(s0, s1, s2, a[26], a[33]);+	MONT_MAC(c0, c1, c2, a[27], a[32]);+	MONT_MAC(s0, s1, s2, a[28], a[31]);+	MONT_MAC(c0, c1, c2, a[29], a[30]);+	MONT_MAC(t0, t1, t2, u[12], m[47]);+	MONT_MUL(v0, v1, v2, u[13], m[46]);+	MONT_MUL(w0, w1, w2, u[14], m[45]);+	MONT_MAC(t0, t1, t2, u[15], m[44]);+	MONT_MAC(v0, v1, v2, u[16], m[43]);+	MONT_MAC(w0, w1, w2, u[17], m[42]);+	MONT_MAC(t0, t1, t2, u[18], m[41]);+	MONT_MAC(v0, v1, v2, u[19], m[40]);+	MONT_MAC(w0, w1, w2, u[20], m[39]);+	MONT_MAC(t0, t1, t2, u[21], m[38]);+	MONT_MAC(v0, v1, v2, u[22], m[37]);+	MONT_MAC(w0, w1, w2, u[23], m[36]);+	MONT_MAC(t0, t1, t2, u[24], m[35]);+	MONT_MAC(v0, v1, v2, u[25], m[34]);+	MONT_MAC(w0, w1, w2, u[26], m[33]);+	MONT_MAC(t0, t1, t2, u[27], m[32]);+	MONT_MAC(v0, v1, v2, u[28], m[31]);+	MONT_MAC(w0, w1, w2, u[29], m[30]);+	MONT_MAC(t0, t1, t2, u[30], m[29]);+	MONT_MAC(v0, v1, v2, u[31], m[28]);+	MONT_MAC(w0, w1, w2, u[32], m[27]);+	MONT_MAC(t0, t1, t2, u[33], m[26]);+	MONT_MAC(v0, v1, v2, u[34], m[25]);+	MONT_MAC(w0, w1, w2, u[35], m[24]);+	MONT_MAC(t0, t1, t2, u[36], m[23]);+	MONT_MAC(v0, v1, v2, u[37], m[22]);+	MONT_MAC(w0, w1, w2, u[38], m[21]);+	MONT_MAC(t0, t1, t2, u[39], m[20]);+	MONT_MAC(v0, v1, v2, u[40], m[19]);+	MONT_MAC(w0, w1, w2, u[41], m[18]);+	MONT_MAC(t0, t1, t2, u[42], m[17]);+	MONT_MAC(v0, v1, v2, u[43], m[16]);+	MONT_MAC(w0, w1, w2, u[44], m[15]);+	MONT_MAC(t0, t1, t2, u[45], m[14]);+	MONT_MAC(v0, v1, v2, u[46], m[13]);+	MONT_MAC(w0, w1, w2, u[47], m[12]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	MONT_ADD(s0, s1, s2, c0, c1, c2);+	MONT_DBL(s0, s1, s2);+	MONT_ADD(t0, t1, t2, s0, s1, s2);+	z[11] = t0;+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 60 */+	MONT_MUL(s0, s1, s2, a[13], a[47]);+	MONT_MUL(c0, c1, c2, a[14], a[46]);+	MONT_MAC(s0, s1, s2, a[15], a[45]);+	MONT_MAC(c0, c1, c2, a[16], a[44]);+	MONT_MAC(s0, s1, s2, a[17], a[43]);+	MONT_MAC(c0, c1, c2, a[18], a[42]);+	MONT_MAC(s0, s1, s2, a[19], a[41]);+	MONT_MAC(c0, c1, c2, a[20], a[40]);+	MONT_MAC(s0, s1, s2, a[21], a[39]);+	MONT_MAC(c0, c1, c2, a[22], a[38]);+	MONT_MAC(s0, s1, s2, a[23], a[37]);+	MONT_MAC(c0, c1, c2, a[24], a[36]);+	MONT_MAC(s0, s1, s2, a[25], a[35]);+	MONT_MAC(c0, c1, c2, a[26], a[34]);+	MONT_MAC(s0, s1, s2, a[27], a[33]);+	MONT_MAC(c0, c1, c2, a[28], a[32]);+	MONT_MAC(s0, s1, s2, a[29], a[31]);+	MONT_MAC(t0, t1, t2, a[30], a[30]);+	MONT_MUL(v0, v1, v2, u[13], m[47]);+	MONT_MUL(w0, w1, w2, u[14], m[46]);+	MONT_MAC(t0, t1, t2, u[15], m[45]);+	MONT_MAC(v0, v1, v2, u[16], m[44]);+	MONT_MAC(w0, w1, w2, u[17], m[43]);+	MONT_MAC(t0, t1, t2, u[18], m[42]);+	MONT_MAC(v0, v1, v2, u[19], m[41]);+	MONT_MAC(w0, w1, w2, u[20], m[40]);+	MONT_MAC(t0, t1, t2, u[21], m[39]);+	MONT_MAC(v0, v1, v2, u[22], m[38]);+	MONT_MAC(w0, w1, w2, u[23], m[37]);+	MONT_MAC(t0, t1, t2, u[24], m[36]);+	MONT_MAC(v0, v1, v2, u[25], m[35]);+	MONT_MAC(w0, w1, w2, u[26], m[34]);+	MONT_MAC(t0, t1, t2, u[27], m[33]);+	MONT_MAC(v0, v1, v2, u[28], m[32]);+	MONT_MAC(w0, w1, w2, u[29], m[31]);+	MONT_MAC(t0, t1, t2, u[30], m[30]);+	MONT_MAC(v0, v1, v2, u[31], m[29]);+	MONT_MAC(w0, w1, w2, u[32], m[28]);+	MONT_MAC(t0, t1, t2, u[33], m[27]);+	MONT_MAC(v0, v1, v2, u[34], m[26]);+	MONT_MAC(w0, w1, w2, u[35], m[25]);+	MONT_MAC(t0, t1, t2, u[36], m[24]);+	MONT_MAC(v0, v1, v2, u[37], m[23]);+	MONT_MAC(w0, w1, w2, u[38], m[22]);+	MONT_MAC(t0, t1, t2, u[39], m[21]);+	MONT_MAC(v0, v1, v2, u[40], m[20]);+	MONT_MAC(w0, w1, w2, u[41], m[19]);+	MONT_MAC(t0, t1, t2, u[42], m[18]);+	MONT_MAC(v0, v1, v2, u[43], m[17]);+	MONT_MAC(w0, w1, w2, u[44], m[16]);+	MONT_MAC(t0, t1, t2, u[45], m[15]);+	MONT_MAC(v0, v1, v2, u[46], m[14]);+	MONT_MAC(w0, w1, w2, u[47], m[13]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	MONT_ADD(s0, s1, s2, c0, c1, c2);+	MONT_DBL(s0, s1, s2);+	MONT_ADD(t0, t1, t2, s0, s1, s2);+	z[12] = t0;+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 61 */+	MONT_MUL(s0, s1, s2, a[14], a[47]);+	MONT_MUL(c0, c1, c2, a[15], a[46]);+	MONT_MAC(s0, s1, s2, a[16], a[45]);+	MONT_MAC(c0, c1, c2, a[17], a[44]);+	MONT_MAC(s0, s1, s2, a[18], a[43]);+	MONT_MAC(c0, c1, c2, a[19], a[42]);+	MONT_MAC(s0, s1, s2, a[20], a[41]);+	MONT_MAC(c0, c1, c2, a[21], a[40]);+	MONT_MAC(s0, s1, s2, a[22], a[39]);+	MONT_MAC(c0, c1, c2, a[23], a[38]);+	MONT_MAC(s0, s1, s2, a[24], a[37]);+	MONT_MAC(c0, c1, c2, a[25], a[36]);+	MONT_MAC(s0, s1, s2, a[26], a[35]);+	MONT_MAC(c0, c1, c2, a[27], a[34]);+	MONT_MAC(s0, s1, s2, a[28], a[33]);+	MONT_MAC(c0, c1, c2, a[29], a[32]);+	MONT_MAC(s0, s1, s2, a[30], a[31]);+	MONT_MAC(t0, t1, t2, u[14], m[47]);+	MONT_MUL(v0, v1, v2, u[15], m[46]);+	MONT_MUL(w0, w1, w2, u[16], m[45]);+	MONT_MAC(t0, t1, t2, u[17], m[44]);+	MONT_MAC(v0, v1, v2, u[18], m[43]);+	MONT_MAC(w0, w1, w2, u[19], m[42]);+	MONT_MAC(t0, t1, t2, u[20], m[41]);+	MONT_MAC(v0, v1, v2, u[21], m[40]);+	MONT_MAC(w0, w1, w2, u[22], m[39]);+	MONT_MAC(t0, t1, t2, u[23], m[38]);+	MONT_MAC(v0, v1, v2, u[24], m[37]);+	MONT_MAC(w0, w1, w2, u[25], m[36]);+	MONT_MAC(t0, t1, t2, u[26], m[35]);+	MONT_MAC(v0, v1, v2, u[27], m[34]);+	MONT_MAC(w0, w1, w2, u[28], m[33]);+	MONT_MAC(t0, t1, t2, u[29], m[32]);+	MONT_MAC(v0, v1, v2, u[30], m[31]);+	MONT_MAC(w0, w1, w2, u[31], m[30]);+	MONT_MAC(t0, t1, t2, u[32], m[29]);+	MONT_MAC(v0, v1, v2, u[33], m[28]);+	MONT_MAC(w0, w1, w2, u[34], m[27]);+	MONT_MAC(t0, t1, t2, u[35], m[26]);+	MONT_MAC(v0, v1, v2, u[36], m[25]);+	MONT_MAC(w0, w1, w2, u[37], m[24]);+	MONT_MAC(t0, t1, t2, u[38], m[23]);+	MONT_MAC(v0, v1, v2, u[39], m[22]);+	MONT_MAC(w0, w1, w2, u[40], m[21]);+	MONT_MAC(t0, t1, t2, u[41], m[20]);+	MONT_MAC(v0, v1, v2, u[42], m[19]);+	MONT_MAC(w0, w1, w2, u[43], m[18]);+	MONT_MAC(t0, t1, t2, u[44], m[17]);+	MONT_MAC(v0, v1, v2, u[45], m[16]);+	MONT_MAC(w0, w1, w2, u[46], m[15]);+	MONT_MAC(t0, t1, t2, u[47], m[14]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	MONT_ADD(s0, s1, s2, c0, c1, c2);+	MONT_DBL(s0, s1, s2);+	MONT_ADD(t0, t1, t2, s0, s1, s2);+	z[13] = t0;+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 62 */+	MONT_MUL(s0, s1, s2, a[15], a[47]);+	MONT_MUL(c0, c1, c2, a[16], a[46]);+	MONT_MAC(s0, s1, s2, a[17], a[45]);+	MONT_MAC(c0, c1, c2, a[18], a[44]);+	MONT_MAC(s0, s1, s2, a[19], a[43]);+	MONT_MAC(c0, c1, c2, a[20], a[42]);+	MONT_MAC(s0, s1, s2, a[21], a[41]);+	MONT_MAC(c0, c1, c2, a[22], a[40]);+	MONT_MAC(s0, s1, s2, a[23], a[39]);+	MONT_MAC(c0, c1, c2, a[24], a[38]);+	MONT_MAC(s0, s1, s2, a[25], a[37]);+	MONT_MAC(c0, c1, c2, a[26], a[36]);+	MONT_MAC(s0, s1, s2, a[27], a[35]);+	MONT_MAC(c0, c1, c2, a[28], a[34]);+	MONT_MAC(s0, s1, s2, a[29], a[33]);+	MONT_MAC(c0, c1, c2, a[30], a[32]);+	MONT_MAC(t0, t1, t2, a[31], a[31]);+	MONT_MUL(v0, v1, v2, u[15], m[47]);+	MONT_MUL(w0, w1, w2, u[16], m[46]);+	MONT_MAC(t0, t1, t2, u[17], m[45]);+	MONT_MAC(v0, v1, v2, u[18], m[44]);+	MONT_MAC(w0, w1, w2, u[19], m[43]);+	MONT_MAC(t0, t1, t2, u[20], m[42]);+	MONT_MAC(v0, v1, v2, u[21], m[41]);+	MONT_MAC(w0, w1, w2, u[22], m[40]);+	MONT_MAC(t0, t1, t2, u[23], m[39]);+	MONT_MAC(v0, v1, v2, u[24], m[38]);+	MONT_MAC(w0, w1, w2, u[25], m[37]);+	MONT_MAC(t0, t1, t2, u[26], m[36]);+	MONT_MAC(v0, v1, v2, u[27], m[35]);+	MONT_MAC(w0, w1, w2, u[28], m[34]);+	MONT_MAC(t0, t1, t2, u[29], m[33]);+	MONT_MAC(v0, v1, v2, u[30], m[32]);+	MONT_MAC(w0, w1, w2, u[31], m[31]);+	MONT_MAC(t0, t1, t2, u[32], m[30]);+	MONT_MAC(v0, v1, v2, u[33], m[29]);+	MONT_MAC(w0, w1, w2, u[34], m[28]);+	MONT_MAC(t0, t1, t2, u[35], m[27]);+	MONT_MAC(v0, v1, v2, u[36], m[26]);+	MONT_MAC(w0, w1, w2, u[37], m[25]);+	MONT_MAC(t0, t1, t2, u[38], m[24]);+	MONT_MAC(v0, v1, v2, u[39], m[23]);+	MONT_MAC(w0, w1, w2, u[40], m[22]);+	MONT_MAC(t0, t1, t2, u[41], m[21]);+	MONT_MAC(v0, v1, v2, u[42], m[20]);+	MONT_MAC(w0, w1, w2, u[43], m[19]);+	MONT_MAC(t0, t1, t2, u[44], m[18]);+	MONT_MAC(v0, v1, v2, u[45], m[17]);+	MONT_MAC(w0, w1, w2, u[46], m[16]);+	MONT_MAC(t0, t1, t2, u[47], m[15]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	MONT_ADD(s0, s1, s2, c0, c1, c2);+	MONT_DBL(s0, s1, s2);+	MONT_ADD(t0, t1, t2, s0, s1, s2);+	z[14] = t0;+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 63 */+	MONT_MUL(s0, s1, s2, a[16], a[47]);+	MONT_MUL(c0, c1, c2, a[17], a[46]);+	MONT_MAC(s0, s1, s2, a[18], a[45]);+	MONT_MAC(c0, c1, c2, a[19], a[44]);+	MONT_MAC(s0, s1, s2, a[20], a[43]);+	MONT_MAC(c0, c1, c2, a[21], a[42]);+	MONT_MAC(s0, s1, s2, a[22], a[41]);+	MONT_MAC(c0, c1, c2, a[23], a[40]);+	MONT_MAC(s0, s1, s2, a[24], a[39]);+	MONT_MAC(c0, c1, c2, a[25], a[38]);+	MONT_MAC(s0, s1, s2, a[26], a[37]);+	MONT_MAC(c0, c1, c2, a[27], a[36]);+	MONT_MAC(s0, s1, s2, a[28], a[35]);+	MONT_MAC(c0, c1, c2, a[29], a[34]);+	MONT_MAC(s0, s1, s2, a[30], a[33]);+	MONT_MAC(c0, c1, c2, a[31], a[32]);+	MONT_MAC(t0, t1, t2, u[16], m[47]);+	MONT_MUL(v0, v1, v2, u[17], m[46]);+	MONT_MUL(w0, w1, w2, u[18], m[45]);+	MONT_MAC(t0, t1, t2, u[19], m[44]);+	MONT_MAC(v0, v1, v2, u[20], m[43]);+	MONT_MAC(w0, w1, w2, u[21], m[42]);+	MONT_MAC(t0, t1, t2, u[22], m[41]);+	MONT_MAC(v0, v1, v2, u[23], m[40]);+	MONT_MAC(w0, w1, w2, u[24], m[39]);+	MONT_MAC(t0, t1, t2, u[25], m[38]);+	MONT_MAC(v0, v1, v2, u[26], m[37]);+	MONT_MAC(w0, w1, w2, u[27], m[36]);+	MONT_MAC(t0, t1, t2, u[28], m[35]);+	MONT_MAC(v0, v1, v2, u[29], m[34]);+	MONT_MAC(w0, w1, w2, u[30], m[33]);+	MONT_MAC(t0, t1, t2, u[31], m[32]);+	MONT_MAC(v0, v1, v2, u[32], m[31]);+	MONT_MAC(w0, w1, w2, u[33], m[30]);+	MONT_MAC(t0, t1, t2, u[34], m[29]);+	MONT_MAC(v0, v1, v2, u[35], m[28]);+	MONT_MAC(w0, w1, w2, u[36], m[27]);+	MONT_MAC(t0, t1, t2, u[37], m[26]);+	MONT_MAC(v0, v1, v2, u[38], m[25]);+	MONT_MAC(w0, w1, w2, u[39], m[24]);+	MONT_MAC(t0, t1, t2, u[40], m[23]);+	MONT_MAC(v0, v1, v2, u[41], m[22]);+	MONT_MAC(w0, w1, w2, u[42], m[21]);+	MONT_MAC(t0, t1, t2, u[43], m[20]);+	MONT_MAC(v0, v1, v2, u[44], m[19]);+	MONT_MAC(w0, w1, w2, u[45], m[18]);+	MONT_MAC(t0, t1, t2, u[46], m[17]);+	MONT_MAC(v0, v1, v2, u[47], m[16]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	MONT_ADD(s0, s1, s2, c0, c1, c2);+	MONT_DBL(s0, s1, s2);+	MONT_ADD(t0, t1, t2, s0, s1, s2);+	z[15] = t0;+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 64 */+	MONT_MUL(s0, s1, s2, a[17], a[47]);+	MONT_MUL(c0, c1, c2, a[18], a[46]);+	MONT_MAC(s0, s1, s2, a[19], a[45]);+	MONT_MAC(c0, c1, c2, a[20], a[44]);+	MONT_MAC(s0, s1, s2, a[21], a[43]);+	MONT_MAC(c0, c1, c2, a[22], a[42]);+	MONT_MAC(s0, s1, s2, a[23], a[41]);+	MONT_MAC(c0, c1, c2, a[24], a[40]);+	MONT_MAC(s0, s1, s2, a[25], a[39]);+	MONT_MAC(c0, c1, c2, a[26], a[38]);+	MONT_MAC(s0, s1, s2, a[27], a[37]);+	MONT_MAC(c0, c1, c2, a[28], a[36]);+	MONT_MAC(s0, s1, s2, a[29], a[35]);+	MONT_MAC(c0, c1, c2, a[30], a[34]);+	MONT_MAC(s0, s1, s2, a[31], a[33]);+	MONT_MAC(t0, t1, t2, a[32], a[32]);+	MONT_MUL(v0, v1, v2, u[17], m[47]);+	MONT_MUL(w0, w1, w2, u[18], m[46]);+	MONT_MAC(t0, t1, t2, u[19], m[45]);+	MONT_MAC(v0, v1, v2, u[20], m[44]);+	MONT_MAC(w0, w1, w2, u[21], m[43]);+	MONT_MAC(t0, t1, t2, u[22], m[42]);+	MONT_MAC(v0, v1, v2, u[23], m[41]);+	MONT_MAC(w0, w1, w2, u[24], m[40]);+	MONT_MAC(t0, t1, t2, u[25], m[39]);+	MONT_MAC(v0, v1, v2, u[26], m[38]);+	MONT_MAC(w0, w1, w2, u[27], m[37]);+	MONT_MAC(t0, t1, t2, u[28], m[36]);+	MONT_MAC(v0, v1, v2, u[29], m[35]);+	MONT_MAC(w0, w1, w2, u[30], m[34]);+	MONT_MAC(t0, t1, t2, u[31], m[33]);+	MONT_MAC(v0, v1, v2, u[32], m[32]);+	MONT_MAC(w0, w1, w2, u[33], m[31]);+	MONT_MAC(t0, t1, t2, u[34], m[30]);+	MONT_MAC(v0, v1, v2, u[35], m[29]);+	MONT_MAC(w0, w1, w2, u[36], m[28]);+	MONT_MAC(t0, t1, t2, u[37], m[27]);+	MONT_MAC(v0, v1, v2, u[38], m[26]);+	MONT_MAC(w0, w1, w2, u[39], m[25]);+	MONT_MAC(t0, t1, t2, u[40], m[24]);+	MONT_MAC(v0, v1, v2, u[41], m[23]);+	MONT_MAC(w0, w1, w2, u[42], m[22]);+	MONT_MAC(t0, t1, t2, u[43], m[21]);+	MONT_MAC(v0, v1, v2, u[44], m[20]);+	MONT_MAC(w0, w1, w2, u[45], m[19]);+	MONT_MAC(t0, t1, t2, u[46], m[18]);+	MONT_MAC(v0, v1, v2, u[47], m[17]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	MONT_ADD(s0, s1, s2, c0, c1, c2);+	MONT_DBL(s0, s1, s2);+	MONT_ADD(t0, t1, t2, s0, s1, s2);+	z[16] = t0;+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 65 */+	MONT_MUL(s0, s1, s2, a[18], a[47]);+	MONT_MUL(c0, c1, c2, a[19], a[46]);+	MONT_MAC(s0, s1, s2, a[20], a[45]);+	MONT_MAC(c0, c1, c2, a[21], a[44]);+	MONT_MAC(s0, s1, s2, a[22], a[43]);+	MONT_MAC(c0, c1, c2, a[23], a[42]);+	MONT_MAC(s0, s1, s2, a[24], a[41]);+	MONT_MAC(c0, c1, c2, a[25], a[40]);+	MONT_MAC(s0, s1, s2, a[26], a[39]);+	MONT_MAC(c0, c1, c2, a[27], a[38]);+	MONT_MAC(s0, s1, s2, a[28], a[37]);+	MONT_MAC(c0, c1, c2, a[29], a[36]);+	MONT_MAC(s0, s1, s2, a[30], a[35]);+	MONT_MAC(c0, c1, c2, a[31], a[34]);+	MONT_MAC(s0, s1, s2, a[32], a[33]);+	MONT_MAC(t0, t1, t2, u[18], m[47]);+	MONT_MUL(v0, v1, v2, u[19], m[46]);+	MONT_MUL(w0, w1, w2, u[20], m[45]);+	MONT_MAC(t0, t1, t2, u[21], m[44]);+	MONT_MAC(v0, v1, v2, u[22], m[43]);+	MONT_MAC(w0, w1, w2, u[23], m[42]);+	MONT_MAC(t0, t1, t2, u[24], m[41]);+	MONT_MAC(v0, v1, v2, u[25], m[40]);+	MONT_MAC(w0, w1, w2, u[26], m[39]);+	MONT_MAC(t0, t1, t2, u[27], m[38]);+	MONT_MAC(v0, v1, v2, u[28], m[37]);+	MONT_MAC(w0, w1, w2, u[29], m[36]);+	MONT_MAC(t0, t1, t2, u[30], m[35]);+	MONT_MAC(v0, v1, v2, u[31], m[34]);+	MONT_MAC(w0, w1, w2, u[32], m[33]);+	MONT_MAC(t0, t1, t2, u[33], m[32]);+	MONT_MAC(v0, v1, v2, u[34], m[31]);+	MONT_MAC(w0, w1, w2, u[35], m[30]);+	MONT_MAC(t0, t1, t2, u[36], m[29]);+	MONT_MAC(v0, v1, v2, u[37], m[28]);+	MONT_MAC(w0, w1, w2, u[38], m[27]);+	MONT_MAC(t0, t1, t2, u[39], m[26]);+	MONT_MAC(v0, v1, v2, u[40], m[25]);+	MONT_MAC(w0, w1, w2, u[41], m[24]);+	MONT_MAC(t0, t1, t2, u[42], m[23]);+	MONT_MAC(v0, v1, v2, u[43], m[22]);+	MONT_MAC(w0, w1, w2, u[44], m[21]);+	MONT_MAC(t0, t1, t2, u[45], m[20]);+	MONT_MAC(v0, v1, v2, u[46], m[19]);+	MONT_MAC(w0, w1, w2, u[47], m[18]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	MONT_ADD(s0, s1, s2, c0, c1, c2);+	MONT_DBL(s0, s1, s2);+	MONT_ADD(t0, t1, t2, s0, s1, s2);+	z[17] = t0;+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 66 */+	MONT_MUL(s0, s1, s2, a[19], a[47]);+	MONT_MUL(c0, c1, c2, a[20], a[46]);+	MONT_MAC(s0, s1, s2, a[21], a[45]);+	MONT_MAC(c0, c1, c2, a[22], a[44]);+	MONT_MAC(s0, s1, s2, a[23], a[43]);+	MONT_MAC(c0, c1, c2, a[24], a[42]);+	MONT_MAC(s0, s1, s2, a[25], a[41]);+	MONT_MAC(c0, c1, c2, a[26], a[40]);+	MONT_MAC(s0, s1, s2, a[27], a[39]);+	MONT_MAC(c0, c1, c2, a[28], a[38]);+	MONT_MAC(s0, s1, s2, a[29], a[37]);+	MONT_MAC(c0, c1, c2, a[30], a[36]);+	MONT_MAC(s0, s1, s2, a[31], a[35]);+	MONT_MAC(c0, c1, c2, a[32], a[34]);+	MONT_MAC(t0, t1, t2, a[33], a[33]);+	MONT_MUL(v0, v1, v2, u[19], m[47]);+	MONT_MUL(w0, w1, w2, u[20], m[46]);+	MONT_MAC(t0, t1, t2, u[21], m[45]);+	MONT_MAC(v0, v1, v2, u[22], m[44]);+	MONT_MAC(w0, w1, w2, u[23], m[43]);+	MONT_MAC(t0, t1, t2, u[24], m[42]);+	MONT_MAC(v0, v1, v2, u[25], m[41]);+	MONT_MAC(w0, w1, w2, u[26], m[40]);+	MONT_MAC(t0, t1, t2, u[27], m[39]);+	MONT_MAC(v0, v1, v2, u[28], m[38]);+	MONT_MAC(w0, w1, w2, u[29], m[37]);+	MONT_MAC(t0, t1, t2, u[30], m[36]);+	MONT_MAC(v0, v1, v2, u[31], m[35]);+	MONT_MAC(w0, w1, w2, u[32], m[34]);+	MONT_MAC(t0, t1, t2, u[33], m[33]);+	MONT_MAC(v0, v1, v2, u[34], m[32]);+	MONT_MAC(w0, w1, w2, u[35], m[31]);+	MONT_MAC(t0, t1, t2, u[36], m[30]);+	MONT_MAC(v0, v1, v2, u[37], m[29]);+	MONT_MAC(w0, w1, w2, u[38], m[28]);+	MONT_MAC(t0, t1, t2, u[39], m[27]);+	MONT_MAC(v0, v1, v2, u[40], m[26]);+	MONT_MAC(w0, w1, w2, u[41], m[25]);+	MONT_MAC(t0, t1, t2, u[42], m[24]);+	MONT_MAC(v0, v1, v2, u[43], m[23]);+	MONT_MAC(w0, w1, w2, u[44], m[22]);+	MONT_MAC(t0, t1, t2, u[45], m[21]);+	MONT_MAC(v0, v1, v2, u[46], m[20]);+	MONT_MAC(w0, w1, w2, u[47], m[19]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	MONT_ADD(s0, s1, s2, c0, c1, c2);+	MONT_DBL(s0, s1, s2);+	MONT_ADD(t0, t1, t2, s0, s1, s2);+	z[18] = t0;+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 67 */+	MONT_MUL(s0, s1, s2, a[20], a[47]);+	MONT_MUL(c0, c1, c2, a[21], a[46]);+	MONT_MAC(s0, s1, s2, a[22], a[45]);+	MONT_MAC(c0, c1, c2, a[23], a[44]);+	MONT_MAC(s0, s1, s2, a[24], a[43]);+	MONT_MAC(c0, c1, c2, a[25], a[42]);+	MONT_MAC(s0, s1, s2, a[26], a[41]);+	MONT_MAC(c0, c1, c2, a[27], a[40]);+	MONT_MAC(s0, s1, s2, a[28], a[39]);+	MONT_MAC(c0, c1, c2, a[29], a[38]);+	MONT_MAC(s0, s1, s2, a[30], a[37]);+	MONT_MAC(c0, c1, c2, a[31], a[36]);+	MONT_MAC(s0, s1, s2, a[32], a[35]);+	MONT_MAC(c0, c1, c2, a[33], a[34]);+	MONT_MAC(t0, t1, t2, u[20], m[47]);+	MONT_MUL(v0, v1, v2, u[21], m[46]);+	MONT_MUL(w0, w1, w2, u[22], m[45]);+	MONT_MAC(t0, t1, t2, u[23], m[44]);+	MONT_MAC(v0, v1, v2, u[24], m[43]);+	MONT_MAC(w0, w1, w2, u[25], m[42]);+	MONT_MAC(t0, t1, t2, u[26], m[41]);+	MONT_MAC(v0, v1, v2, u[27], m[40]);+	MONT_MAC(w0, w1, w2, u[28], m[39]);+	MONT_MAC(t0, t1, t2, u[29], m[38]);+	MONT_MAC(v0, v1, v2, u[30], m[37]);+	MONT_MAC(w0, w1, w2, u[31], m[36]);+	MONT_MAC(t0, t1, t2, u[32], m[35]);+	MONT_MAC(v0, v1, v2, u[33], m[34]);+	MONT_MAC(w0, w1, w2, u[34], m[33]);+	MONT_MAC(t0, t1, t2, u[35], m[32]);+	MONT_MAC(v0, v1, v2, u[36], m[31]);+	MONT_MAC(w0, w1, w2, u[37], m[30]);+	MONT_MAC(t0, t1, t2, u[38], m[29]);+	MONT_MAC(v0, v1, v2, u[39], m[28]);+	MONT_MAC(w0, w1, w2, u[40], m[27]);+	MONT_MAC(t0, t1, t2, u[41], m[26]);+	MONT_MAC(v0, v1, v2, u[42], m[25]);+	MONT_MAC(w0, w1, w2, u[43], m[24]);+	MONT_MAC(t0, t1, t2, u[44], m[23]);+	MONT_MAC(v0, v1, v2, u[45], m[22]);+	MONT_MAC(w0, w1, w2, u[46], m[21]);+	MONT_MAC(t0, t1, t2, u[47], m[20]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	MONT_ADD(s0, s1, s2, c0, c1, c2);+	MONT_DBL(s0, s1, s2);+	MONT_ADD(t0, t1, t2, s0, s1, s2);+	z[19] = t0;+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 68 */+	MONT_MUL(s0, s1, s2, a[21], a[47]);+	MONT_MUL(c0, c1, c2, a[22], a[46]);+	MONT_MAC(s0, s1, s2, a[23], a[45]);+	MONT_MAC(c0, c1, c2, a[24], a[44]);+	MONT_MAC(s0, s1, s2, a[25], a[43]);+	MONT_MAC(c0, c1, c2, a[26], a[42]);+	MONT_MAC(s0, s1, s2, a[27], a[41]);+	MONT_MAC(c0, c1, c2, a[28], a[40]);+	MONT_MAC(s0, s1, s2, a[29], a[39]);+	MONT_MAC(c0, c1, c2, a[30], a[38]);+	MONT_MAC(s0, s1, s2, a[31], a[37]);+	MONT_MAC(c0, c1, c2, a[32], a[36]);+	MONT_MAC(s0, s1, s2, a[33], a[35]);+	MONT_MAC(t0, t1, t2, a[34], a[34]);+	MONT_MUL(v0, v1, v2, u[21], m[47]);+	MONT_MUL(w0, w1, w2, u[22], m[46]);+	MONT_MAC(t0, t1, t2, u[23], m[45]);+	MONT_MAC(v0, v1, v2, u[24], m[44]);+	MONT_MAC(w0, w1, w2, u[25], m[43]);+	MONT_MAC(t0, t1, t2, u[26], m[42]);+	MONT_MAC(v0, v1, v2, u[27], m[41]);+	MONT_MAC(w0, w1, w2, u[28], m[40]);+	MONT_MAC(t0, t1, t2, u[29], m[39]);+	MONT_MAC(v0, v1, v2, u[30], m[38]);+	MONT_MAC(w0, w1, w2, u[31], m[37]);+	MONT_MAC(t0, t1, t2, u[32], m[36]);+	MONT_MAC(v0, v1, v2, u[33], m[35]);+	MONT_MAC(w0, w1, w2, u[34], m[34]);+	MONT_MAC(t0, t1, t2, u[35], m[33]);+	MONT_MAC(v0, v1, v2, u[36], m[32]);+	MONT_MAC(w0, w1, w2, u[37], m[31]);+	MONT_MAC(t0, t1, t2, u[38], m[30]);+	MONT_MAC(v0, v1, v2, u[39], m[29]);+	MONT_MAC(w0, w1, w2, u[40], m[28]);+	MONT_MAC(t0, t1, t2, u[41], m[27]);+	MONT_MAC(v0, v1, v2, u[42], m[26]);+	MONT_MAC(w0, w1, w2, u[43], m[25]);+	MONT_MAC(t0, t1, t2, u[44], m[24]);+	MONT_MAC(v0, v1, v2, u[45], m[23]);+	MONT_MAC(w0, w1, w2, u[46], m[22]);+	MONT_MAC(t0, t1, t2, u[47], m[21]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	MONT_ADD(s0, s1, s2, c0, c1, c2);+	MONT_DBL(s0, s1, s2);+	MONT_ADD(t0, t1, t2, s0, s1, s2);+	z[20] = t0;+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 69 */+	MONT_MUL(s0, s1, s2, a[22], a[47]);+	MONT_MUL(c0, c1, c2, a[23], a[46]);+	MONT_MAC(s0, s1, s2, a[24], a[45]);+	MONT_MAC(c0, c1, c2, a[25], a[44]);+	MONT_MAC(s0, s1, s2, a[26], a[43]);+	MONT_MAC(c0, c1, c2, a[27], a[42]);+	MONT_MAC(s0, s1, s2, a[28], a[41]);+	MONT_MAC(c0, c1, c2, a[29], a[40]);+	MONT_MAC(s0, s1, s2, a[30], a[39]);+	MONT_MAC(c0, c1, c2, a[31], a[38]);+	MONT_MAC(s0, s1, s2, a[32], a[37]);+	MONT_MAC(c0, c1, c2, a[33], a[36]);+	MONT_MAC(s0, s1, s2, a[34], a[35]);+	MONT_MAC(t0, t1, t2, u[22], m[47]);+	MONT_MUL(v0, v1, v2, u[23], m[46]);+	MONT_MUL(w0, w1, w2, u[24], m[45]);+	MONT_MAC(t0, t1, t2, u[25], m[44]);+	MONT_MAC(v0, v1, v2, u[26], m[43]);+	MONT_MAC(w0, w1, w2, u[27], m[42]);+	MONT_MAC(t0, t1, t2, u[28], m[41]);+	MONT_MAC(v0, v1, v2, u[29], m[40]);+	MONT_MAC(w0, w1, w2, u[30], m[39]);+	MONT_MAC(t0, t1, t2, u[31], m[38]);+	MONT_MAC(v0, v1, v2, u[32], m[37]);+	MONT_MAC(w0, w1, w2, u[33], m[36]);+	MONT_MAC(t0, t1, t2, u[34], m[35]);+	MONT_MAC(v0, v1, v2, u[35], m[34]);+	MONT_MAC(w0, w1, w2, u[36], m[33]);+	MONT_MAC(t0, t1, t2, u[37], m[32]);+	MONT_MAC(v0, v1, v2, u[38], m[31]);+	MONT_MAC(w0, w1, w2, u[39], m[30]);+	MONT_MAC(t0, t1, t2, u[40], m[29]);+	MONT_MAC(v0, v1, v2, u[41], m[28]);+	MONT_MAC(w0, w1, w2, u[42], m[27]);+	MONT_MAC(t0, t1, t2, u[43], m[26]);+	MONT_MAC(v0, v1, v2, u[44], m[25]);+	MONT_MAC(w0, w1, w2, u[45], m[24]);+	MONT_MAC(t0, t1, t2, u[46], m[23]);+	MONT_MAC(v0, v1, v2, u[47], m[22]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	MONT_ADD(s0, s1, s2, c0, c1, c2);+	MONT_DBL(s0, s1, s2);+	MONT_ADD(t0, t1, t2, s0, s1, s2);+	z[21] = t0;+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 70 */+	MONT_MUL(s0, s1, s2, a[23], a[47]);+	MONT_MUL(c0, c1, c2, a[24], a[46]);+	MONT_MAC(s0, s1, s2, a[25], a[45]);+	MONT_MAC(c0, c1, c2, a[26], a[44]);+	MONT_MAC(s0, s1, s2, a[27], a[43]);+	MONT_MAC(c0, c1, c2, a[28], a[42]);+	MONT_MAC(s0, s1, s2, a[29], a[41]);+	MONT_MAC(c0, c1, c2, a[30], a[40]);+	MONT_MAC(s0, s1, s2, a[31], a[39]);+	MONT_MAC(c0, c1, c2, a[32], a[38]);+	MONT_MAC(s0, s1, s2, a[33], a[37]);+	MONT_MAC(c0, c1, c2, a[34], a[36]);+	MONT_MAC(t0, t1, t2, a[35], a[35]);+	MONT_MUL(v0, v1, v2, u[23], m[47]);+	MONT_MUL(w0, w1, w2, u[24], m[46]);+	MONT_MAC(t0, t1, t2, u[25], m[45]);+	MONT_MAC(v0, v1, v2, u[26], m[44]);+	MONT_MAC(w0, w1, w2, u[27], m[43]);+	MONT_MAC(t0, t1, t2, u[28], m[42]);+	MONT_MAC(v0, v1, v2, u[29], m[41]);+	MONT_MAC(w0, w1, w2, u[30], m[40]);+	MONT_MAC(t0, t1, t2, u[31], m[39]);+	MONT_MAC(v0, v1, v2, u[32], m[38]);+	MONT_MAC(w0, w1, w2, u[33], m[37]);+	MONT_MAC(t0, t1, t2, u[34], m[36]);+	MONT_MAC(v0, v1, v2, u[35], m[35]);+	MONT_MAC(w0, w1, w2, u[36], m[34]);+	MONT_MAC(t0, t1, t2, u[37], m[33]);+	MONT_MAC(v0, v1, v2, u[38], m[32]);+	MONT_MAC(w0, w1, w2, u[39], m[31]);+	MONT_MAC(t0, t1, t2, u[40], m[30]);+	MONT_MAC(v0, v1, v2, u[41], m[29]);+	MONT_MAC(w0, w1, w2, u[42], m[28]);+	MONT_MAC(t0, t1, t2, u[43], m[27]);+	MONT_MAC(v0, v1, v2, u[44], m[26]);+	MONT_MAC(w0, w1, w2, u[45], m[25]);+	MONT_MAC(t0, t1, t2, u[46], m[24]);+	MONT_MAC(v0, v1, v2, u[47], m[23]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	MONT_ADD(s0, s1, s2, c0, c1, c2);+	MONT_DBL(s0, s1, s2);+	MONT_ADD(t0, t1, t2, s0, s1, s2);+	z[22] = t0;+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 71 */+	MONT_MUL(s0, s1, s2, a[24], a[47]);+	MONT_MUL(c0, c1, c2, a[25], a[46]);+	MONT_MAC(s0, s1, s2, a[26], a[45]);+	MONT_MAC(c0, c1, c2, a[27], a[44]);+	MONT_MAC(s0, s1, s2, a[28], a[43]);+	MONT_MAC(c0, c1, c2, a[29], a[42]);+	MONT_MAC(s0, s1, s2, a[30], a[41]);+	MONT_MAC(c0, c1, c2, a[31], a[40]);+	MONT_MAC(s0, s1, s2, a[32], a[39]);+	MONT_MAC(c0, c1, c2, a[33], a[38]);+	MONT_MAC(s0, s1, s2, a[34], a[37]);+	MONT_MAC(c0, c1, c2, a[35], a[36]);+	MONT_MAC(t0, t1, t2, u[24], m[47]);+	MONT_MUL(v0, v1, v2, u[25], m[46]);+	MONT_MUL(w0, w1, w2, u[26], m[45]);+	MONT_MAC(t0, t1, t2, u[27], m[44]);+	MONT_MAC(v0, v1, v2, u[28], m[43]);+	MONT_MAC(w0, w1, w2, u[29], m[42]);+	MONT_MAC(t0, t1, t2, u[30], m[41]);+	MONT_MAC(v0, v1, v2, u[31], m[40]);+	MONT_MAC(w0, w1, w2, u[32], m[39]);+	MONT_MAC(t0, t1, t2, u[33], m[38]);+	MONT_MAC(v0, v1, v2, u[34], m[37]);+	MONT_MAC(w0, w1, w2, u[35], m[36]);+	MONT_MAC(t0, t1, t2, u[36], m[35]);+	MONT_MAC(v0, v1, v2, u[37], m[34]);+	MONT_MAC(w0, w1, w2, u[38], m[33]);+	MONT_MAC(t0, t1, t2, u[39], m[32]);+	MONT_MAC(v0, v1, v2, u[40], m[31]);+	MONT_MAC(w0, w1, w2, u[41], m[30]);+	MONT_MAC(t0, t1, t2, u[42], m[29]);+	MONT_MAC(v0, v1, v2, u[43], m[28]);+	MONT_MAC(w0, w1, w2, u[44], m[27]);+	MONT_MAC(t0, t1, t2, u[45], m[26]);+	MONT_MAC(v0, v1, v2, u[46], m[25]);+	MONT_MAC(w0, w1, w2, u[47], m[24]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	MONT_ADD(s0, s1, s2, c0, c1, c2);+	MONT_DBL(s0, s1, s2);+	MONT_ADD(t0, t1, t2, s0, s1, s2);+	z[23] = t0;+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 72 */+	MONT_MUL(s0, s1, s2, a[25], a[47]);+	MONT_MUL(c0, c1, c2, a[26], a[46]);+	MONT_MAC(s0, s1, s2, a[27], a[45]);+	MONT_MAC(c0, c1, c2, a[28], a[44]);+	MONT_MAC(s0, s1, s2, a[29], a[43]);+	MONT_MAC(c0, c1, c2, a[30], a[42]);+	MONT_MAC(s0, s1, s2, a[31], a[41]);+	MONT_MAC(c0, c1, c2, a[32], a[40]);+	MONT_MAC(s0, s1, s2, a[33], a[39]);+	MONT_MAC(c0, c1, c2, a[34], a[38]);+	MONT_MAC(s0, s1, s2, a[35], a[37]);+	MONT_MAC(t0, t1, t2, a[36], a[36]);+	MONT_MUL(v0, v1, v2, u[25], m[47]);+	MONT_MUL(w0, w1, w2, u[26], m[46]);+	MONT_MAC(t0, t1, t2, u[27], m[45]);+	MONT_MAC(v0, v1, v2, u[28], m[44]);+	MONT_MAC(w0, w1, w2, u[29], m[43]);+	MONT_MAC(t0, t1, t2, u[30], m[42]);+	MONT_MAC(v0, v1, v2, u[31], m[41]);+	MONT_MAC(w0, w1, w2, u[32], m[40]);+	MONT_MAC(t0, t1, t2, u[33], m[39]);+	MONT_MAC(v0, v1, v2, u[34], m[38]);+	MONT_MAC(w0, w1, w2, u[35], m[37]);+	MONT_MAC(t0, t1, t2, u[36], m[36]);+	MONT_MAC(v0, v1, v2, u[37], m[35]);+	MONT_MAC(w0, w1, w2, u[38], m[34]);+	MONT_MAC(t0, t1, t2, u[39], m[33]);+	MONT_MAC(v0, v1, v2, u[40], m[32]);+	MONT_MAC(w0, w1, w2, u[41], m[31]);+	MONT_MAC(t0, t1, t2, u[42], m[30]);+	MONT_MAC(v0, v1, v2, u[43], m[29]);+	MONT_MAC(w0, w1, w2, u[44], m[28]);+	MONT_MAC(t0, t1, t2, u[45], m[27]);+	MONT_MAC(v0, v1, v2, u[46], m[26]);+	MONT_MAC(w0, w1, w2, u[47], m[25]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	MONT_ADD(s0, s1, s2, c0, c1, c2);+	MONT_DBL(s0, s1, s2);+	MONT_ADD(t0, t1, t2, s0, s1, s2);+	z[24] = t0;+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 73 */+	MONT_MUL(s0, s1, s2, a[26], a[47]);+	MONT_MUL(c0, c1, c2, a[27], a[46]);+	MONT_MAC(s0, s1, s2, a[28], a[45]);+	MONT_MAC(c0, c1, c2, a[29], a[44]);+	MONT_MAC(s0, s1, s2, a[30], a[43]);+	MONT_MAC(c0, c1, c2, a[31], a[42]);+	MONT_MAC(s0, s1, s2, a[32], a[41]);+	MONT_MAC(c0, c1, c2, a[33], a[40]);+	MONT_MAC(s0, s1, s2, a[34], a[39]);+	MONT_MAC(c0, c1, c2, a[35], a[38]);+	MONT_MAC(s0, s1, s2, a[36], a[37]);+	MONT_MAC(t0, t1, t2, u[26], m[47]);+	MONT_MUL(v0, v1, v2, u[27], m[46]);+	MONT_MUL(w0, w1, w2, u[28], m[45]);+	MONT_MAC(t0, t1, t2, u[29], m[44]);+	MONT_MAC(v0, v1, v2, u[30], m[43]);+	MONT_MAC(w0, w1, w2, u[31], m[42]);+	MONT_MAC(t0, t1, t2, u[32], m[41]);+	MONT_MAC(v0, v1, v2, u[33], m[40]);+	MONT_MAC(w0, w1, w2, u[34], m[39]);+	MONT_MAC(t0, t1, t2, u[35], m[38]);+	MONT_MAC(v0, v1, v2, u[36], m[37]);+	MONT_MAC(w0, w1, w2, u[37], m[36]);+	MONT_MAC(t0, t1, t2, u[38], m[35]);+	MONT_MAC(v0, v1, v2, u[39], m[34]);+	MONT_MAC(w0, w1, w2, u[40], m[33]);+	MONT_MAC(t0, t1, t2, u[41], m[32]);+	MONT_MAC(v0, v1, v2, u[42], m[31]);+	MONT_MAC(w0, w1, w2, u[43], m[30]);+	MONT_MAC(t0, t1, t2, u[44], m[29]);+	MONT_MAC(v0, v1, v2, u[45], m[28]);+	MONT_MAC(w0, w1, w2, u[46], m[27]);+	MONT_MAC(t0, t1, t2, u[47], m[26]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	MONT_ADD(s0, s1, s2, c0, c1, c2);+	MONT_DBL(s0, s1, s2);+	MONT_ADD(t0, t1, t2, s0, s1, s2);+	z[25] = t0;+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 74 */+	MONT_MUL(s0, s1, s2, a[27], a[47]);+	MONT_MUL(c0, c1, c2, a[28], a[46]);+	MONT_MAC(s0, s1, s2, a[29], a[45]);+	MONT_MAC(c0, c1, c2, a[30], a[44]);+	MONT_MAC(s0, s1, s2, a[31], a[43]);+	MONT_MAC(c0, c1, c2, a[32], a[42]);+	MONT_MAC(s0, s1, s2, a[33], a[41]);+	MONT_MAC(c0, c1, c2, a[34], a[40]);+	MONT_MAC(s0, s1, s2, a[35], a[39]);+	MONT_MAC(c0, c1, c2, a[36], a[38]);+	MONT_MAC(t0, t1, t2, a[37], a[37]);+	MONT_MUL(v0, v1, v2, u[27], m[47]);+	MONT_MUL(w0, w1, w2, u[28], m[46]);+	MONT_MAC(t0, t1, t2, u[29], m[45]);+	MONT_MAC(v0, v1, v2, u[30], m[44]);+	MONT_MAC(w0, w1, w2, u[31], m[43]);+	MONT_MAC(t0, t1, t2, u[32], m[42]);+	MONT_MAC(v0, v1, v2, u[33], m[41]);+	MONT_MAC(w0, w1, w2, u[34], m[40]);+	MONT_MAC(t0, t1, t2, u[35], m[39]);+	MONT_MAC(v0, v1, v2, u[36], m[38]);+	MONT_MAC(w0, w1, w2, u[37], m[37]);+	MONT_MAC(t0, t1, t2, u[38], m[36]);+	MONT_MAC(v0, v1, v2, u[39], m[35]);+	MONT_MAC(w0, w1, w2, u[40], m[34]);+	MONT_MAC(t0, t1, t2, u[41], m[33]);+	MONT_MAC(v0, v1, v2, u[42], m[32]);+	MONT_MAC(w0, w1, w2, u[43], m[31]);+	MONT_MAC(t0, t1, t2, u[44], m[30]);+	MONT_MAC(v0, v1, v2, u[45], m[29]);+	MONT_MAC(w0, w1, w2, u[46], m[28]);+	MONT_MAC(t0, t1, t2, u[47], m[27]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	MONT_ADD(s0, s1, s2, c0, c1, c2);+	MONT_DBL(s0, s1, s2);+	MONT_ADD(t0, t1, t2, s0, s1, s2);+	z[26] = t0;+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 75 */+	MONT_MUL(s0, s1, s2, a[28], a[47]);+	MONT_MUL(c0, c1, c2, a[29], a[46]);+	MONT_MAC(s0, s1, s2, a[30], a[45]);+	MONT_MAC(c0, c1, c2, a[31], a[44]);+	MONT_MAC(s0, s1, s2, a[32], a[43]);+	MONT_MAC(c0, c1, c2, a[33], a[42]);+	MONT_MAC(s0, s1, s2, a[34], a[41]);+	MONT_MAC(c0, c1, c2, a[35], a[40]);+	MONT_MAC(s0, s1, s2, a[36], a[39]);+	MONT_MAC(c0, c1, c2, a[37], a[38]);+	MONT_MAC(t0, t1, t2, u[28], m[47]);+	MONT_MUL(v0, v1, v2, u[29], m[46]);+	MONT_MUL(w0, w1, w2, u[30], m[45]);+	MONT_MAC(t0, t1, t2, u[31], m[44]);+	MONT_MAC(v0, v1, v2, u[32], m[43]);+	MONT_MAC(w0, w1, w2, u[33], m[42]);+	MONT_MAC(t0, t1, t2, u[34], m[41]);+	MONT_MAC(v0, v1, v2, u[35], m[40]);+	MONT_MAC(w0, w1, w2, u[36], m[39]);+	MONT_MAC(t0, t1, t2, u[37], m[38]);+	MONT_MAC(v0, v1, v2, u[38], m[37]);+	MONT_MAC(w0, w1, w2, u[39], m[36]);+	MONT_MAC(t0, t1, t2, u[40], m[35]);+	MONT_MAC(v0, v1, v2, u[41], m[34]);+	MONT_MAC(w0, w1, w2, u[42], m[33]);+	MONT_MAC(t0, t1, t2, u[43], m[32]);+	MONT_MAC(v0, v1, v2, u[44], m[31]);+	MONT_MAC(w0, w1, w2, u[45], m[30]);+	MONT_MAC(t0, t1, t2, u[46], m[29]);+	MONT_MAC(v0, v1, v2, u[47], m[28]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	MONT_ADD(s0, s1, s2, c0, c1, c2);+	MONT_DBL(s0, s1, s2);+	MONT_ADD(t0, t1, t2, s0, s1, s2);+	z[27] = t0;+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 76 */+	MONT_MUL(s0, s1, s2, a[29], a[47]);+	MONT_MUL(c0, c1, c2, a[30], a[46]);+	MONT_MAC(s0, s1, s2, a[31], a[45]);+	MONT_MAC(c0, c1, c2, a[32], a[44]);+	MONT_MAC(s0, s1, s2, a[33], a[43]);+	MONT_MAC(c0, c1, c2, a[34], a[42]);+	MONT_MAC(s0, s1, s2, a[35], a[41]);+	MONT_MAC(c0, c1, c2, a[36], a[40]);+	MONT_MAC(s0, s1, s2, a[37], a[39]);+	MONT_MAC(t0, t1, t2, a[38], a[38]);+	MONT_MUL(v0, v1, v2, u[29], m[47]);+	MONT_MUL(w0, w1, w2, u[30], m[46]);+	MONT_MAC(t0, t1, t2, u[31], m[45]);+	MONT_MAC(v0, v1, v2, u[32], m[44]);+	MONT_MAC(w0, w1, w2, u[33], m[43]);+	MONT_MAC(t0, t1, t2, u[34], m[42]);+	MONT_MAC(v0, v1, v2, u[35], m[41]);+	MONT_MAC(w0, w1, w2, u[36], m[40]);+	MONT_MAC(t0, t1, t2, u[37], m[39]);+	MONT_MAC(v0, v1, v2, u[38], m[38]);+	MONT_MAC(w0, w1, w2, u[39], m[37]);+	MONT_MAC(t0, t1, t2, u[40], m[36]);+	MONT_MAC(v0, v1, v2, u[41], m[35]);+	MONT_MAC(w0, w1, w2, u[42], m[34]);+	MONT_MAC(t0, t1, t2, u[43], m[33]);+	MONT_MAC(v0, v1, v2, u[44], m[32]);+	MONT_MAC(w0, w1, w2, u[45], m[31]);+	MONT_MAC(t0, t1, t2, u[46], m[30]);+	MONT_MAC(v0, v1, v2, u[47], m[29]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	MONT_ADD(s0, s1, s2, c0, c1, c2);+	MONT_DBL(s0, s1, s2);+	MONT_ADD(t0, t1, t2, s0, s1, s2);+	z[28] = t0;+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 77 */+	MONT_MUL(s0, s1, s2, a[30], a[47]);+	MONT_MUL(c0, c1, c2, a[31], a[46]);+	MONT_MAC(s0, s1, s2, a[32], a[45]);+	MONT_MAC(c0, c1, c2, a[33], a[44]);+	MONT_MAC(s0, s1, s2, a[34], a[43]);+	MONT_MAC(c0, c1, c2, a[35], a[42]);+	MONT_MAC(s0, s1, s2, a[36], a[41]);+	MONT_MAC(c0, c1, c2, a[37], a[40]);+	MONT_MAC(s0, s1, s2, a[38], a[39]);+	MONT_MAC(t0, t1, t2, u[30], m[47]);+	MONT_MUL(v0, v1, v2, u[31], m[46]);+	MONT_MUL(w0, w1, w2, u[32], m[45]);+	MONT_MAC(t0, t1, t2, u[33], m[44]);+	MONT_MAC(v0, v1, v2, u[34], m[43]);+	MONT_MAC(w0, w1, w2, u[35], m[42]);+	MONT_MAC(t0, t1, t2, u[36], m[41]);+	MONT_MAC(v0, v1, v2, u[37], m[40]);+	MONT_MAC(w0, w1, w2, u[38], m[39]);+	MONT_MAC(t0, t1, t2, u[39], m[38]);+	MONT_MAC(v0, v1, v2, u[40], m[37]);+	MONT_MAC(w0, w1, w2, u[41], m[36]);+	MONT_MAC(t0, t1, t2, u[42], m[35]);+	MONT_MAC(v0, v1, v2, u[43], m[34]);+	MONT_MAC(w0, w1, w2, u[44], m[33]);+	MONT_MAC(t0, t1, t2, u[45], m[32]);+	MONT_MAC(v0, v1, v2, u[46], m[31]);+	MONT_MAC(w0, w1, w2, u[47], m[30]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	MONT_ADD(s0, s1, s2, c0, c1, c2);+	MONT_DBL(s0, s1, s2);+	MONT_ADD(t0, t1, t2, s0, s1, s2);+	z[29] = t0;+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 78 */+	MONT_MUL(s0, s1, s2, a[31], a[47]);+	MONT_MUL(c0, c1, c2, a[32], a[46]);+	MONT_MAC(s0, s1, s2, a[33], a[45]);+	MONT_MAC(c0, c1, c2, a[34], a[44]);+	MONT_MAC(s0, s1, s2, a[35], a[43]);+	MONT_MAC(c0, c1, c2, a[36], a[42]);+	MONT_MAC(s0, s1, s2, a[37], a[41]);+	MONT_MAC(c0, c1, c2, a[38], a[40]);+	MONT_MAC(t0, t1, t2, a[39], a[39]);+	MONT_MUL(v0, v1, v2, u[31], m[47]);+	MONT_MUL(w0, w1, w2, u[32], m[46]);+	MONT_MAC(t0, t1, t2, u[33], m[45]);+	MONT_MAC(v0, v1, v2, u[34], m[44]);+	MONT_MAC(w0, w1, w2, u[35], m[43]);+	MONT_MAC(t0, t1, t2, u[36], m[42]);+	MONT_MAC(v0, v1, v2, u[37], m[41]);+	MONT_MAC(w0, w1, w2, u[38], m[40]);+	MONT_MAC(t0, t1, t2, u[39], m[39]);+	MONT_MAC(v0, v1, v2, u[40], m[38]);+	MONT_MAC(w0, w1, w2, u[41], m[37]);+	MONT_MAC(t0, t1, t2, u[42], m[36]);+	MONT_MAC(v0, v1, v2, u[43], m[35]);+	MONT_MAC(w0, w1, w2, u[44], m[34]);+	MONT_MAC(t0, t1, t2, u[45], m[33]);+	MONT_MAC(v0, v1, v2, u[46], m[32]);+	MONT_MAC(w0, w1, w2, u[47], m[31]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	MONT_ADD(s0, s1, s2, c0, c1, c2);+	MONT_DBL(s0, s1, s2);+	MONT_ADD(t0, t1, t2, s0, s1, s2);+	z[30] = t0;+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 79 */+	MONT_MUL(s0, s1, s2, a[32], a[47]);+	MONT_MUL(c0, c1, c2, a[33], a[46]);+	MONT_MAC(s0, s1, s2, a[34], a[45]);+	MONT_MAC(c0, c1, c2, a[35], a[44]);+	MONT_MAC(s0, s1, s2, a[36], a[43]);+	MONT_MAC(c0, c1, c2, a[37], a[42]);+	MONT_MAC(s0, s1, s2, a[38], a[41]);+	MONT_MAC(c0, c1, c2, a[39], a[40]);+	MONT_MAC(t0, t1, t2, u[32], m[47]);+	MONT_MUL(v0, v1, v2, u[33], m[46]);+	MONT_MUL(w0, w1, w2, u[34], m[45]);+	MONT_MAC(t0, t1, t2, u[35], m[44]);+	MONT_MAC(v0, v1, v2, u[36], m[43]);+	MONT_MAC(w0, w1, w2, u[37], m[42]);+	MONT_MAC(t0, t1, t2, u[38], m[41]);+	MONT_MAC(v0, v1, v2, u[39], m[40]);+	MONT_MAC(w0, w1, w2, u[40], m[39]);+	MONT_MAC(t0, t1, t2, u[41], m[38]);+	MONT_MAC(v0, v1, v2, u[42], m[37]);+	MONT_MAC(w0, w1, w2, u[43], m[36]);+	MONT_MAC(t0, t1, t2, u[44], m[35]);+	MONT_MAC(v0, v1, v2, u[45], m[34]);+	MONT_MAC(w0, w1, w2, u[46], m[33]);+	MONT_MAC(t0, t1, t2, u[47], m[32]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	MONT_ADD(s0, s1, s2, c0, c1, c2);+	MONT_DBL(s0, s1, s2);+	MONT_ADD(t0, t1, t2, s0, s1, s2);+	z[31] = t0;+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 80 */+	MONT_MUL(s0, s1, s2, a[33], a[47]);+	MONT_MUL(c0, c1, c2, a[34], a[46]);+	MONT_MAC(s0, s1, s2, a[35], a[45]);+	MONT_MAC(c0, c1, c2, a[36], a[44]);+	MONT_MAC(s0, s1, s2, a[37], a[43]);+	MONT_MAC(c0, c1, c2, a[38], a[42]);+	MONT_MAC(s0, s1, s2, a[39], a[41]);+	MONT_MAC(t0, t1, t2, a[40], a[40]);+	MONT_MUL(v0, v1, v2, u[33], m[47]);+	MONT_MUL(w0, w1, w2, u[34], m[46]);+	MONT_MAC(t0, t1, t2, u[35], m[45]);+	MONT_MAC(v0, v1, v2, u[36], m[44]);+	MONT_MAC(w0, w1, w2, u[37], m[43]);+	MONT_MAC(t0, t1, t2, u[38], m[42]);+	MONT_MAC(v0, v1, v2, u[39], m[41]);+	MONT_MAC(w0, w1, w2, u[40], m[40]);+	MONT_MAC(t0, t1, t2, u[41], m[39]);+	MONT_MAC(v0, v1, v2, u[42], m[38]);+	MONT_MAC(w0, w1, w2, u[43], m[37]);+	MONT_MAC(t0, t1, t2, u[44], m[36]);+	MONT_MAC(v0, v1, v2, u[45], m[35]);+	MONT_MAC(w0, w1, w2, u[46], m[34]);+	MONT_MAC(t0, t1, t2, u[47], m[33]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	MONT_ADD(s0, s1, s2, c0, c1, c2);+	MONT_DBL(s0, s1, s2);+	MONT_ADD(t0, t1, t2, s0, s1, s2);+	z[32] = t0;+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 81 */+	MONT_MUL(s0, s1, s2, a[34], a[47]);+	MONT_MUL(c0, c1, c2, a[35], a[46]);+	MONT_MAC(s0, s1, s2, a[36], a[45]);+	MONT_MAC(c0, c1, c2, a[37], a[44]);+	MONT_MAC(s0, s1, s2, a[38], a[43]);+	MONT_MAC(c0, c1, c2, a[39], a[42]);+	MONT_MAC(s0, s1, s2, a[40], a[41]);+	MONT_MAC(t0, t1, t2, u[34], m[47]);+	MONT_MUL(v0, v1, v2, u[35], m[46]);+	MONT_MUL(w0, w1, w2, u[36], m[45]);+	MONT_MAC(t0, t1, t2, u[37], m[44]);+	MONT_MAC(v0, v1, v2, u[38], m[43]);+	MONT_MAC(w0, w1, w2, u[39], m[42]);+	MONT_MAC(t0, t1, t2, u[40], m[41]);+	MONT_MAC(v0, v1, v2, u[41], m[40]);+	MONT_MAC(w0, w1, w2, u[42], m[39]);+	MONT_MAC(t0, t1, t2, u[43], m[38]);+	MONT_MAC(v0, v1, v2, u[44], m[37]);+	MONT_MAC(w0, w1, w2, u[45], m[36]);+	MONT_MAC(t0, t1, t2, u[46], m[35]);+	MONT_MAC(v0, v1, v2, u[47], m[34]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	MONT_ADD(s0, s1, s2, c0, c1, c2);+	MONT_DBL(s0, s1, s2);+	MONT_ADD(t0, t1, t2, s0, s1, s2);+	z[33] = t0;+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 82 */+	MONT_MUL(s0, s1, s2, a[35], a[47]);+	MONT_MUL(c0, c1, c2, a[36], a[46]);+	MONT_MAC(s0, s1, s2, a[37], a[45]);+	MONT_MAC(c0, c1, c2, a[38], a[44]);+	MONT_MAC(s0, s1, s2, a[39], a[43]);+	MONT_MAC(c0, c1, c2, a[40], a[42]);+	MONT_MAC(t0, t1, t2, a[41], a[41]);+	MONT_MUL(v0, v1, v2, u[35], m[47]);+	MONT_MUL(w0, w1, w2, u[36], m[46]);+	MONT_MAC(t0, t1, t2, u[37], m[45]);+	MONT_MAC(v0, v1, v2, u[38], m[44]);+	MONT_MAC(w0, w1, w2, u[39], m[43]);+	MONT_MAC(t0, t1, t2, u[40], m[42]);+	MONT_MAC(v0, v1, v2, u[41], m[41]);+	MONT_MAC(w0, w1, w2, u[42], m[40]);+	MONT_MAC(t0, t1, t2, u[43], m[39]);+	MONT_MAC(v0, v1, v2, u[44], m[38]);+	MONT_MAC(w0, w1, w2, u[45], m[37]);+	MONT_MAC(t0, t1, t2, u[46], m[36]);+	MONT_MAC(v0, v1, v2, u[47], m[35]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	MONT_ADD(s0, s1, s2, c0, c1, c2);+	MONT_DBL(s0, s1, s2);+	MONT_ADD(t0, t1, t2, s0, s1, s2);+	z[34] = t0;+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 83 */+	MONT_MUL(s0, s1, s2, a[36], a[47]);+	MONT_MUL(c0, c1, c2, a[37], a[46]);+	MONT_MAC(s0, s1, s2, a[38], a[45]);+	MONT_MAC(c0, c1, c2, a[39], a[44]);+	MONT_MAC(s0, s1, s2, a[40], a[43]);+	MONT_MAC(c0, c1, c2, a[41], a[42]);+	MONT_MAC(t0, t1, t2, u[36], m[47]);+	MONT_MUL(v0, v1, v2, u[37], m[46]);+	MONT_MUL(w0, w1, w2, u[38], m[45]);+	MONT_MAC(t0, t1, t2, u[39], m[44]);+	MONT_MAC(v0, v1, v2, u[40], m[43]);+	MONT_MAC(w0, w1, w2, u[41], m[42]);+	MONT_MAC(t0, t1, t2, u[42], m[41]);+	MONT_MAC(v0, v1, v2, u[43], m[40]);+	MONT_MAC(w0, w1, w2, u[44], m[39]);+	MONT_MAC(t0, t1, t2, u[45], m[38]);+	MONT_MAC(v0, v1, v2, u[46], m[37]);+	MONT_MAC(w0, w1, w2, u[47], m[36]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	MONT_ADD(s0, s1, s2, c0, c1, c2);+	MONT_DBL(s0, s1, s2);+	MONT_ADD(t0, t1, t2, s0, s1, s2);+	z[35] = t0;+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 84 */+	MONT_MUL(s0, s1, s2, a[37], a[47]);+	MONT_MUL(c0, c1, c2, a[38], a[46]);+	MONT_MAC(s0, s1, s2, a[39], a[45]);+	MONT_MAC(c0, c1, c2, a[40], a[44]);+	MONT_MAC(s0, s1, s2, a[41], a[43]);+	MONT_MAC(t0, t1, t2, a[42], a[42]);+	MONT_MUL(v0, v1, v2, u[37], m[47]);+	MONT_MUL(w0, w1, w2, u[38], m[46]);+	MONT_MAC(t0, t1, t2, u[39], m[45]);+	MONT_MAC(v0, v1, v2, u[40], m[44]);+	MONT_MAC(w0, w1, w2, u[41], m[43]);+	MONT_MAC(t0, t1, t2, u[42], m[42]);+	MONT_MAC(v0, v1, v2, u[43], m[41]);+	MONT_MAC(w0, w1, w2, u[44], m[40]);+	MONT_MAC(t0, t1, t2, u[45], m[39]);+	MONT_MAC(v0, v1, v2, u[46], m[38]);+	MONT_MAC(w0, w1, w2, u[47], m[37]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	MONT_ADD(s0, s1, s2, c0, c1, c2);+	MONT_DBL(s0, s1, s2);+	MONT_ADD(t0, t1, t2, s0, s1, s2);+	z[36] = t0;+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 85 */+	MONT_MUL(s0, s1, s2, a[38], a[47]);+	MONT_MUL(c0, c1, c2, a[39], a[46]);+	MONT_MAC(s0, s1, s2, a[40], a[45]);+	MONT_MAC(c0, c1, c2, a[41], a[44]);+	MONT_MAC(s0, s1, s2, a[42], a[43]);+	MONT_MAC(t0, t1, t2, u[38], m[47]);+	MONT_MUL(v0, v1, v2, u[39], m[46]);+	MONT_MUL(w0, w1, w2, u[40], m[45]);+	MONT_MAC(t0, t1, t2, u[41], m[44]);+	MONT_MAC(v0, v1, v2, u[42], m[43]);+	MONT_MAC(w0, w1, w2, u[43], m[42]);+	MONT_MAC(t0, t1, t2, u[44], m[41]);+	MONT_MAC(v0, v1, v2, u[45], m[40]);+	MONT_MAC(w0, w1, w2, u[46], m[39]);+	MONT_MAC(t0, t1, t2, u[47], m[38]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	MONT_ADD(s0, s1, s2, c0, c1, c2);+	MONT_DBL(s0, s1, s2);+	MONT_ADD(t0, t1, t2, s0, s1, s2);+	z[37] = t0;+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 86 */+	MONT_MUL(s0, s1, s2, a[39], a[47]);+	MONT_MUL(c0, c1, c2, a[40], a[46]);+	MONT_MAC(s0, s1, s2, a[41], a[45]);+	MONT_MAC(c0, c1, c2, a[42], a[44]);+	MONT_MAC(t0, t1, t2, a[43], a[43]);+	MONT_MUL(v0, v1, v2, u[39], m[47]);+	MONT_MUL(w0, w1, w2, u[40], m[46]);+	MONT_MAC(t0, t1, t2, u[41], m[45]);+	MONT_MAC(v0, v1, v2, u[42], m[44]);+	MONT_MAC(w0, w1, w2, u[43], m[43]);+	MONT_MAC(t0, t1, t2, u[44], m[42]);+	MONT_MAC(v0, v1, v2, u[45], m[41]);+	MONT_MAC(w0, w1, w2, u[46], m[40]);+	MONT_MAC(t0, t1, t2, u[47], m[39]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	MONT_ADD(s0, s1, s2, c0, c1, c2);+	MONT_DBL(s0, s1, s2);+	MONT_ADD(t0, t1, t2, s0, s1, s2);+	z[38] = t0;+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 87 */+	MONT_MUL(s0, s1, s2, a[40], a[47]);+	MONT_MUL(c0, c1, c2, a[41], a[46]);+	MONT_MAC(s0, s1, s2, a[42], a[45]);+	MONT_MAC(c0, c1, c2, a[43], a[44]);+	MONT_MAC(t0, t1, t2, u[40], m[47]);+	MONT_MUL(v0, v1, v2, u[41], m[46]);+	MONT_MUL(w0, w1, w2, u[42], m[45]);+	MONT_MAC(t0, t1, t2, u[43], m[44]);+	MONT_MAC(v0, v1, v2, u[44], m[43]);+	MONT_MAC(w0, w1, w2, u[45], m[42]);+	MONT_MAC(t0, t1, t2, u[46], m[41]);+	MONT_MAC(v0, v1, v2, u[47], m[40]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	MONT_ADD(s0, s1, s2, c0, c1, c2);+	MONT_DBL(s0, s1, s2);+	MONT_ADD(t0, t1, t2, s0, s1, s2);+	z[39] = t0;+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 88 */+	MONT_MUL(s0, s1, s2, a[41], a[47]);+	MONT_MUL(c0, c1, c2, a[42], a[46]);+	MONT_MAC(s0, s1, s2, a[43], a[45]);+	MONT_MAC(t0, t1, t2, a[44], a[44]);+	MONT_MUL(v0, v1, v2, u[41], m[47]);+	MONT_MUL(w0, w1, w2, u[42], m[46]);+	MONT_MAC(t0, t1, t2, u[43], m[45]);+	MONT_MAC(v0, v1, v2, u[44], m[44]);+	MONT_MAC(w0, w1, w2, u[45], m[43]);+	MONT_MAC(t0, t1, t2, u[46], m[42]);+	MONT_MAC(v0, v1, v2, u[47], m[41]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	MONT_ADD(s0, s1, s2, c0, c1, c2);+	MONT_DBL(s0, s1, s2);+	MONT_ADD(t0, t1, t2, s0, s1, s2);+	z[40] = t0;+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 89 */+	MONT_MUL(s0, s1, s2, a[42], a[47]);+	MONT_MUL(c0, c1, c2, a[43], a[46]);+	MONT_MAC(s0, s1, s2, a[44], a[45]);+	MONT_MAC(t0, t1, t2, u[42], m[47]);+	MONT_MUL(v0, v1, v2, u[43], m[46]);+	MONT_MUL(w0, w1, w2, u[44], m[45]);+	MONT_MAC(t0, t1, t2, u[45], m[44]);+	MONT_MAC(v0, v1, v2, u[46], m[43]);+	MONT_MAC(w0, w1, w2, u[47], m[42]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	MONT_ADD(s0, s1, s2, c0, c1, c2);+	MONT_DBL(s0, s1, s2);+	MONT_ADD(t0, t1, t2, s0, s1, s2);+	z[41] = t0;+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 90 */+	MONT_MUL(s0, s1, s2, a[43], a[47]);+	MONT_MUL(c0, c1, c2, a[44], a[46]);+	MONT_MAC(t0, t1, t2, a[45], a[45]);+	MONT_MUL(v0, v1, v2, u[43], m[47]);+	MONT_MUL(w0, w1, w2, u[44], m[46]);+	MONT_MAC(t0, t1, t2, u[45], m[45]);+	MONT_MAC(v0, v1, v2, u[46], m[44]);+	MONT_MAC(w0, w1, w2, u[47], m[43]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	MONT_ADD(s0, s1, s2, c0, c1, c2);+	MONT_DBL(s0, s1, s2);+	MONT_ADD(t0, t1, t2, s0, s1, s2);+	z[42] = t0;+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 91 */+	MONT_MUL(s0, s1, s2, a[44], a[47]);+	MONT_MUL(c0, c1, c2, a[45], a[46]);+	MONT_MAC(t0, t1, t2, u[44], m[47]);+	MONT_MUL(v0, v1, v2, u[45], m[46]);+	MONT_MUL(w0, w1, w2, u[46], m[45]);+	MONT_MAC(t0, t1, t2, u[47], m[44]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	MONT_ADD(s0, s1, s2, c0, c1, c2);+	MONT_DBL(s0, s1, s2);+	MONT_ADD(t0, t1, t2, s0, s1, s2);+	z[43] = t0;+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 92 */+	MONT_MUL(s0, s1, s2, a[45], a[47]);+	MONT_MAC(t0, t1, t2, a[46], a[46]);+	MONT_MUL(v0, v1, v2, u[45], m[47]);+	MONT_MUL(w0, w1, w2, u[46], m[46]);+	MONT_MAC(t0, t1, t2, u[47], m[45]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_ADD(t0, t1, t2, w0, w1, w2);+	MONT_DBL(s0, s1, s2);+	MONT_ADD(t0, t1, t2, s0, s1, s2);+	z[44] = t0;+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 93 */+	MONT_MUL(s0, s1, s2, a[46], a[47]);+	MONT_MAC(t0, t1, t2, u[46], m[47]);+	MONT_MUL(v0, v1, v2, u[47], m[46]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	MONT_DBL(s0, s1, s2);+	MONT_ADD(t0, t1, t2, s0, s1, s2);+	z[45] = t0;+	t0 = t1;+	t1 = t2;+	t2 = 0;+	/* column 94 */+	MONT_MAC(t0, t1, t2, a[47], a[47]);+	MONT_MUL(v0, v1, v2, u[47], m[47]);+	MONT_ADD(t0, t1, t2, v0, v1, v2);+	z[46] = t0;+	t0 = t1;+	t1 = t2;+	t2 = 0;+	z[47] = t0;++	/* under 2m, with t1 the bit above n limbs: at most one subtraction */+	borrow = sub_n(r, z, m, 48);+	take = t1 | (borrow ^ 1);+	select_n(r, r, z, take & 1, 48); }  #endif
cbits/crypton_mont.py view
@@ -14,13 +14,16 @@ """  SIZES = (16, 24, 32)+# Squaring at 48 too, RSA-3072's modulus, for the verification that is+# seventeen squarings.  Its multiplication, at twice the code, is left out.+SQR_ONLY = (48,)  HEADER = """\ /* Generated by cbits/crypton_mont.py; do not edit.  *  * Montgomery multiplication and squaring for AArch64 at 16, 24 and 32 limbs,- * the halves of RSA-2048, -3072 and -4096.  Each answers what mont_mul and- * mont_sqr answer. */+ * the halves of RSA-2048, -3072 and -4096, and squaring at 48, RSA-3072's+ * modulus.  Each answers what mont_mul and mont_sqr answer. */ #ifndef CRYPTON_MONT_H #define CRYPTON_MONT_H @@ -160,6 +163,8 @@     print(HEADER)     for n in SIZES:         print(gen(n, False))+        print(gen(n, True))+    for n in SQR_ONLY:         print(gen(n, True))     print(FOOTER, end="")
cbits/crypton_powm.c view
@@ -59,13 +59,16 @@ extern void bignum_mul(uint64_t k, uint64_t *z, uint64_t m, const uint64_t *x,                        uint64_t n, const uint64_t *y); extern void bignum_sqr(uint64_t k, uint64_t *z, uint64_t n, const uint64_t *x);+extern void bignum_sqr_8_16(uint64_t *z, const uint64_t *x);+extern void bignum_mul_8_16(uint64_t *z, const uint64_t *x, const uint64_t *y);  /* 16 limbs is 1024 bits and 32 is 2048: the halves a CRT exponentiation  * works in for RSA-2048 and RSA-4096, and the whole thing without CRT.  24- * is 1536, the half of RSA-3072, which has no Karatsuba routine of its own- * and is run through the 32-limb one with its operands padded -- a third- * of that routine's work wasted, and still nearly twice the C, since the C- * cannot form ADCX and ADOX's two carry chains at any size.+ * is 1536, the half of RSA-3072, which has no Karatsuba routine of its own:+ * its multiplication is the 32-limb one with the operands padded, and its+ * square is built from 8-limb pieces, which measured faster on a whole+ * exponentiation than the padded square.  Both are still nearly twice the+ * C, since the C cannot form ADCX and ADOX's two carry chains at any size.  *  * 48 and 64 are 3072 and 4096 bits: finite-field Diffie-Hellman over the  * RFC 7919 groups of those sizes, and RSA without CRT.  There is no@@ -138,14 +141,39 @@ 	powm_s2n_finish(r, z, m, bignum_emontredc_8n(n, z, m, n0), n); } +/* a^2 for a of 24 limbs, from three 8-limb squares and three 8-limb+ * products: a = a0 + a1 X + a2 X^2 with X = 2^512, and the cross terms, at+ * X to X^3 in c, go in doubled.  c is 48 limbs of scratch. */+static void powm_s2n_sqr24(limb_t *z, const limb_t *a, limb_t *c)+{+	limb_t k;+	uint32_t i;++	bignum_sqr_8_16(z, a);+	bignum_sqr_8_16(z + 16, a + 8);+	bignum_sqr_8_16(z + 32, a + 16);+	bignum_mul_8_16(c, a, a + 8);+	bignum_mul_8_16(c + 16, a + 8, a + 16);+	bignum_mul_8_16(c + 32, a, a + 16);+	k = add_n(c + 8, c + 8, c + 32, 16);+	for (i = 24; i < 32; i++) {+		c[i] += k;+		k = c[i] < k;+	}+	k = shl1(c, 32);+	k += add_n(z + 8, z + 8, c, 32);+	for (i = 40; i < 48; i++) {+		z[i] += k;+		k = z[i] < k;+	}+}+ static void powm_s2n_sqr(limb_t *r, const limb_t *a, const limb_t *m,                          limb_t n0, uint32_t n, limb_t *z, limb_t *scratch) { 	if (n == 24) { 		z = scratch + POWM_S2N_PAD_Z;-		powm_s2n_pad(scratch + POWM_S2N_PAD_X, a);-		bignum_ksqr_32_64(z, scratch + POWM_S2N_PAD_X,-		                  scratch + POWM_S2N_PAD_T);+		powm_s2n_sqr24(z, a, scratch + POWM_S2N_PAD_T); 	} else if (n == 48 || n == 64) 		bignum_sqr(2 * n, z, n, a); 	else if (n == 16)@@ -203,6 +231,7 @@ 	case 16: crypton_mont_sqr16(r, a, m, n0, t); return; 	case 24: crypton_mont_sqr24(r, a, m, n0, t); return; 	case 32: crypton_mont_sqr32(r, a, m, n0, t); return;+	case 48: crypton_mont_sqr48(r, a, m, n0, t); return; 	} #endif 	mont_sqr(r, a, m, n0, n, t);@@ -350,14 +379,8 @@  * bits; the bound is set well above them and well below where a Diffie-  * Hellman or DSA exponent starts.  *- * The second is a machine where s2n-bignum's Montgomery multiplication does- * not run.  There the multiplication here is the C one, which is not faster- * than what the caller already has, so there is nothing to take over.  That- * was written as an expectation and has since been measured: on an Apple- * M4, verification through here and through GMP come out level, the- * difference no larger than between two rows neither of them touches.- * The third is every size but 2048 bits, where the assembly runs and GMP is- * faster all the same; see powm_pub_wanted.+ * The second and third are a machine and a size where GMP, which the+ * caller has, was measured the faster; see powm_pub_wanted.  *  * Define CRYPTON_POWM_PUB_ALWAYS to make it accept anyway: the differential  * test builds that way, so that this arithmetic is exercised on the@@ -380,9 +403,15 @@ #elif defined(CRYPTON_POWM_S2N) 	return n == 32 && powm_s2n_usable(n); #elif defined(CRYPTON_MONT_FIXED)-	/* AArch64: the generated code is ahead of GMP at 2048 bits, and the-	 * Linux GMP is ahead of the C at 3072 and 4096 */+	/* AArch64: the generated code is ahead of GMP at 2048 bits.  At the+	 * other RSA sizes Linux's GMP is level with the C or ahead of it.  The+	 * GMP GHC builds into itself on macOS is compiled without -O, and is+	 * behind the C from 1024 to 4096 bits on the same M4 */+#if defined(__APPLE__)+	return n >= 16 && n <= 64;+#else 	return n == 32;+#endif #else 	(void) n; 	return 0;
cbits/s2n/README.md view
@@ -53,7 +53,8 @@ `crypton_powm.c`'s modular exponentiation also borrows from here, but only its innermost step and only on x86-64: `bignum_kmul_16_32`, `bignum_ksqr_16_32`, `bignum_kmul_32_64`, `bignum_ksqr_32_64` and `bignum_emontredc_8n` replace the-C's Montgomery multiplication and square.  The window, the table and its masked+C's Montgomery multiplication and square, and at RSA-3072's 24 limbs the square+is built from `bignum_sqr_8_16` and `bignum_mul_8_16`.  The window, the table and its masked scan are crypton's throughout.  Sixteen limbs is 1024 bits and thirty-two is 2048: the halves a CRT exponentiation works in for RSA-2048 and RSA-4096, and the whole thing without CRT.  The reduction wants ADX, so the choice is made at
cbits/s2n/import.sh view
@@ -110,6 +110,10 @@ take_x86 fastmul bignum_kmul_32_64 take_x86 fastmul bignum_ksqr_32_64 take_x86 fastmul bignum_emontredc_8n+# RSA-3072's 24-limb square, built from these where the 32-limb Karatsuba+# would take its operands padded+take_x86 fastmul bignum_sqr_8_16+take_x86 fastmul bignum_mul_8_16 # and, for the sizes there is no Karatsuba routine for, the schoolbook # multiplication and squaring of any size, which bignum_emontredc_8n then # reduces as it reduces the others
+ cbits/s2n/x86_att/bignum_mul_8_16.S view
@@ -0,0 +1,264 @@+// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.+// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0++// ----------------------------------------------------------------------------+// Multiply z := x * y+// Inputs x[8], y[8]; output z[16]+//+//    extern void bignum_mul_8_16(uint64_t z[static 16], const uint64_t x[static 8],+//                                const uint64_t y[static 8]);+//+// Standard x86-64 ABI: RDI = z, RSI = x, RDX = y+// Microsoft x64 ABI:   RCX = z, RDX = x, R8 = y+// ----------------------------------------------------------------------------++#include "_internal_s2n_bignum_x86_att.h"+++        S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_mul_8_16)+        S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_mul_8_16)+        S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_mul_8_16)+        .text++// These are actually right++#define z %rdi+#define x %rsi++// Copied in or set up++#define y %rcx++// A zero register++#define zero %rbp+#define zeroe %ebp++// mulpadd i, j adds x[i] * rdx (now assumed = y[j]) into the window at i+j++.macro mulpadd arg1,arg2+        mulxq   8*\arg1(x), %rax, %rbx+.if ((\arg1 + \arg2) % 8 == 0)+        adcxq   %rax, %r8+        adoxq   %rbx, %r9+.elseif ((\arg1 + \arg2) % 8 == 1)+        adcxq   %rax, %r9+        adoxq   %rbx, %r10+.elseif ((\arg1 + \arg2) % 8 == 2)+        adcxq   %rax, %r10+        adoxq   %rbx, %r11+.elseif ((\arg1 + \arg2) % 8 == 3)+        adcxq   %rax, %r11+        adoxq   %rbx, %r12+.elseif ((\arg1 + \arg2) % 8 == 4)+        adcxq   %rax, %r12+        adoxq   %rbx, %r13+.elseif ((\arg1 + \arg2) % 8 == 5)+        adcxq   %rax, %r13+        adoxq   %rbx, %r14+.elseif ((\arg1 + \arg2) % 8 == 6)+        adcxq   %rax, %r14+        adoxq   %rbx, %r15+.elseif ((\arg1 + \arg2) % 8 == 7)+        adcxq   %rax, %r15+        adoxq   %rbx, %r8+.endif++.endm++// mulpade i, j adds x[i] * rdx (now assumed = y[j]) into the window at i+j+// but re-creates the top word assuming nothing to add there++.macro mulpade arg1,arg2+.if ((\arg1 + \arg2) % 8 == 0)+        mulxq   8*\arg1(x), %rax, %r9+        adcxq   %rax, %r8+        adoxq   zero, %r9+.elseif ((\arg1 + \arg2) % 8 == 1)+        mulxq   8*\arg1(x), %rax, %r10+        adcxq   %rax, %r9+        adoxq   zero, %r10+.elseif ((\arg1 + \arg2) % 8 == 2)+        mulxq   8*\arg1(x), %rax, %r11+        adcxq   %rax, %r10+        adoxq   zero, %r11+.elseif ((\arg1 + \arg2) % 8 == 3)+        mulxq   8*\arg1(x), %rax, %r12+        adcxq   %rax, %r11+        adoxq   zero, %r12+.elseif ((\arg1 + \arg2) % 8 == 4)+        mulxq   8*\arg1(x), %rax, %r13+        adcxq   %rax, %r12+        adoxq   zero, %r13+.elseif ((\arg1 + \arg2) % 8 == 5)+        mulxq   8*\arg1(x), %rax, %r14+        adcxq   %rax, %r13+        adoxq   zero, %r14+.elseif ((\arg1 + \arg2) % 8 == 6)+        mulxq   8*\arg1(x), %rax, %r15+        adcxq   %rax, %r14+        adoxq   zero, %r15+.elseif ((\arg1 + \arg2) % 8 == 7)+        mulxq   8*\arg1(x), %rax, %r8+        adcxq   %rax, %r15+        adoxq   zero, %r8+.endif++.endm++// Add in the whole j'th row++.macro addrow arg1+        movq    8*\arg1(y), %rdx+        xorl    zeroe, zeroe++        mulpadd 0, \arg1++.if (\arg1 % 8 == 0)+        movq    %r8, 8*\arg1(z)+.elseif (\arg1 % 8 == 1)+        movq    %r9, 8*\arg1(z)+.elseif (\arg1 % 8 == 2)+        movq    %r10, 8*\arg1(z)+.elseif (\arg1 % 8 == 3)+        movq    %r11, 8*\arg1(z)+.elseif (\arg1 % 8 == 4)+        movq    %r12, 8*\arg1(z)+.elseif (\arg1 % 8 == 5)+        movq    %r13, 8*\arg1(z)+.elseif (\arg1 % 8 == 6)+        movq    %r14, 8*\arg1(z)+.elseif (\arg1 % 8 == 7)+        movq    %r15, 8*\arg1(z)+.endif++        mulpadd 1, \arg1+        mulpadd 2, \arg1+        mulpadd 3, \arg1+        mulpadd 4, \arg1+        mulpadd 5, \arg1+        mulpadd 6, \arg1+        mulpade 7, \arg1++.if (\arg1 % 8 == 0)+        adcq    zero, %r8+.elseif (\arg1 % 8 == 1)+        adcq    zero, %r9+.elseif (\arg1 % 8 == 2)+        adcq    zero, %r10+.elseif (\arg1 % 8 == 3)+        adcq    zero, %r11+.elseif (\arg1 % 8 == 4)+        adcq    zero, %r12+.elseif (\arg1 % 8 == 5)+        adcq    zero, %r13+.elseif (\arg1 % 8 == 6)+        adcq    zero, %r14+.elseif (\arg1 % 8 == 7)+        adcq    zero, %r15+.endif++.endm+++S2N_BN_SYMBOL(bignum_mul_8_16):+        CFI_START+        _CET_ENDBR++#if WINDOWS_ABI+        CFI_PUSH(%rdi)+        CFI_PUSH(%rsi)+        movq    %rcx, %rdi+        movq    %rdx, %rsi+        movq    %r8, %rdx+#endif++// Save more registers to play with++        CFI_PUSH(%rbp)+        CFI_PUSH(%rbx)+        CFI_PUSH(%r12)+        CFI_PUSH(%r13)+        CFI_PUSH(%r14)+        CFI_PUSH(%r15)++// Copy y into a safe register to start with++        movq    %rdx, y++// Zero a register, which also makes sure we don't get a fake carry-in++        xorl    zeroe, zeroe++// Do the zeroth row, which is a bit different+// Write back the zero-zero product and then accumulate+// %r8,%r15,%r14,%r13,%r12,%r11,%r10,%r9 as y[0] * x from 1..8++        movq    (y), %rdx++        mulxq   (x), %r8, %r9+        movq    %r8, (z)++        mulxq   8(x), %rbx, %r10+        adcq    %rbx, %r9++        mulxq   16(x), %rbx, %r11+        adcq    %rbx, %r10++        mulxq   24(x), %rbx, %r12+        adcq    %rbx, %r11++        mulxq   32(x), %rbx, %r13+        adcq    %rbx, %r12++        mulxq   40(x), %rbx, %r14+        adcq    %rbx, %r13++        mulxq   48(x), %rbx, %r15+        adcq    %rbx, %r14++        mulxq   56(x), %rbx, %r8+        adcq    %rbx, %r15+        adcq    zero, %r8++// Now all the other rows in a uniform pattern++        addrow  1+        addrow  2+        addrow  3+        addrow  4+        addrow  5+        addrow  6+        addrow  7++// Now write back the additional columns++        movq    %r8, 64(z)+        movq    %r9, 72(z)+        movq    %r10, 80(z)+        movq    %r11, 88(z)+        movq    %r12, 96(z)+        movq    %r13, 104(z)+        movq    %r14, 112(z)+        movq    %r15, 120(z)++// Real epilog++        CFI_POP(%r15)+        CFI_POP(%r14)+        CFI_POP(%r13)+        CFI_POP(%r12)+        CFI_POP(%rbx)+        CFI_POP(%rbp)++#if WINDOWS_ABI+        CFI_POP(%rsi)+        CFI_POP(%rdi)+#endif+        CFI_RET++S2N_BN_SIZE_DIRECTIVE(bignum_mul_8_16)++#if defined(__linux__) && defined(__ELF__)+.section .note.GNU-stack,"",%progbits+#endif
+ cbits/s2n/x86_att/bignum_sqr_8_16.S view
@@ -0,0 +1,302 @@+// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.+// SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT-0++// ----------------------------------------------------------------------------+// Square, z := x^2+// Input x[8]; output z[16]+//+//    extern void bignum_sqr_8_16(uint64_t z[static 16], const uint64_t x[static 8]);+//+// Standard x86-64 ABI: RDI = z, RSI = x+// Microsoft x64 ABI:   RCX = z, RDX = x+// ----------------------------------------------------------------------------++#include "_internal_s2n_bignum_x86_att.h"+++        S2N_BN_SYM_VISIBILITY_DIRECTIVE(bignum_sqr_8_16)+        S2N_BN_FUNCTION_TYPE_DIRECTIVE(bignum_sqr_8_16)+        S2N_BN_SYM_PRIVACY_DIRECTIVE(bignum_sqr_8_16)+        .text++// These are actually right++#define z %rdi+#define x %rsi++// A zero register++#define zero %rbp+#define zeroe %ebp++// mulpadd i, j adds rdx * x[i] into the window  at the i+j point++.macro mulpadd arg1,arg2+        mulxq   8*\arg1(x), %rax, %rcx+.if ((\arg1 + \arg2) % 8 == 0)+        adcxq   %rax, %r8+        adoxq   %rcx, %r9+.elseif ((\arg1 + \arg2) % 8 == 1)+        adcxq   %rax, %r9+        adoxq   %rcx, %r10+.elseif ((\arg1 + \arg2) % 8 == 2)+        adcxq   %rax, %r10+        adoxq   %rcx, %r11+.elseif ((\arg1 + \arg2) % 8 == 3)+        adcxq   %rax, %r11+        adoxq   %rcx, %r12+.elseif ((\arg1 + \arg2) % 8 == 4)+        adcxq   %rax, %r12+        adoxq   %rcx, %r13+.elseif ((\arg1 + \arg2) % 8 == 5)+        adcxq   %rax, %r13+        adoxq   %rcx, %r14+.elseif ((\arg1 + \arg2) % 8 == 6)+        adcxq   %rax, %r14+        adoxq   %rcx, %r15+.elseif ((\arg1 + \arg2) % 8 == 7)+        adcxq   %rax, %r15+        adoxq   %rcx, %r8+.endif++.endm++// mulpade i, j adds rdx * x[i] into the window at i+j+// but re-creates the top word assuming nothing to add there++.macro mulpade arg1,arg2+.if ((\arg1 + \arg2) % 8 == 0)+        mulxq   8*\arg1(x), %rax, %r9+        adcxq   %rax, %r8+        adoxq   zero, %r9+.elseif ((\arg1 + \arg2) % 8 == 1)+        mulxq   8*\arg1(x), %rax, %r10+        adcxq   %rax, %r9+        adoxq   zero, %r10+.elseif ((\arg1 + \arg2) % 8 == 2)+        mulxq   8*\arg1(x), %rax, %r11+        adcxq   %rax, %r10+        adoxq   zero, %r11+.elseif ((\arg1 + \arg2) % 8 == 3)+        mulxq   8*\arg1(x), %rax, %r12+        adcxq   %rax, %r11+        adoxq   zero, %r12+.elseif ((\arg1 + \arg2) % 8 == 4)+        mulxq   8*\arg1(x), %rax, %r13+        adcxq   %rax, %r12+        adoxq   zero, %r13+.elseif ((\arg1 + \arg2) % 8 == 5)+        mulxq   8*\arg1(x), %rax, %r14+        adcxq   %rax, %r13+        adoxq   zero, %r14+.elseif ((\arg1 + \arg2) % 8 == 6)+        mulxq   8*\arg1(x), %rax, %r15+        adcxq   %rax, %r14+        adoxq   zero, %r15+.elseif ((\arg1 + \arg2) % 8 == 7)+        mulxq   8*\arg1(x), %rax, %r8+        adcxq   %rax, %r15+        adoxq   zero, %r8+.endif++.endm++.macro diagonals++        xorl    zeroe, zeroe++// Set initial window [%r8..%r10] + 2 wb = 10 + 20 + 30 + 40 + 50 + 60 + 70++        movq    (x), %rdx+        mulxq   8(x), %r9, %rax+        movq    %r9, 8(z)+        mulxq   16(x), %r10, %rcx+        adcxq   %rax, %r10+        movq    %r10, 16(z)+        mulxq   24(x), %r11, %rax+        adcxq   %rcx, %r11+        mulxq   32(x), %r12, %rcx+        adcxq   %rax, %r12+        mulxq   40(x), %r13, %rax+        adcxq   %rcx, %r13+        mulxq   48(x), %r14, %rcx+        adcxq   %rax, %r14+        mulxq   56(x), %r15, %r8+        adcxq   %rcx, %r15+        adcxq   zero, %r8++// Add in the next diagonal = 21 + 31 + 41 + 51 + 61 + 71 + 54++        xorl    zeroe, zeroe+        movq    8(x), %rdx+        mulpadd 2, 1+        movq    %r11, 24(z)+        mulpadd 3, 1+        movq    %r12, 32(z)+        mulpadd 4, 1+        mulpadd 5, 1+        mulpadd 6, 1+        mulpade 7, 1+        movq    32(x), %rdx+        mulpade 5, 4+        adcxq   zero, %r10++// And the next one = 32 + 42 + 52 + 62 + 72 + 64 + 65++        xorl    zeroe, zeroe+        movq    16(x), %rdx+        mulpadd 3, 2+        movq    %r13, 40(z)+        mulpadd 4, 2+        movq    %r14, 48(z)+        mulpadd 5, 2+        mulpadd 6, 2+        mulpadd 7, 2+        movq    48(x), %rdx+        mulpade 4, 6+        mulpade 5, 6+        adcxq   zero, %r12++// And the final one = 43 + 53 + 63 + 73 + 74 + 75 + 76++        xorl    zeroe, zeroe+        movq    24(x), %rdx+        mulpadd 4, 3+        movq    %r15, 56(z)+        mulpadd 5, 3+        movq    %r8, 64(z)+        mulpadd 6, 3+        mulpadd 7, 3+        movq    56(x), %rdx+        mulpadd 4, 7+        mulpade 5, 7+        mulpade 6, 7+        adcxq   zero, %r14++// Double and add things; use z[1]..z[8] and thereafter the registers+// %r9..%r15 which haven't been written back yet++        xorl    zeroe, zeroe+        movq    (x), %rdx+        mulxq   %rdx, %rax, %rcx+        movq    %rax, (z)+        movq    8(z), %rax+        adcxq   %rax, %rax+        adoxq   %rcx, %rax+        movq    %rax, 8(z)++        movq    16(z), %rax+        movq    8(x), %rdx+        mulxq   %rdx, %rdx, %rcx+        adcxq   %rax, %rax+        adoxq   %rdx, %rax+        movq    %rax, 16(z)+        movq    24(z), %rax+        adcxq   %rax, %rax+        adoxq   %rcx, %rax+        movq    %rax, 24(z)++        movq    32(z), %rax+        movq    16(x), %rdx+        mulxq   %rdx, %rdx, %rcx+        adcxq   %rax, %rax+        adoxq   %rdx, %rax+        movq    %rax, 32(z)+        movq    40(z), %rax+        adcxq   %rax, %rax+        adoxq   %rcx, %rax+        movq    %rax, 40(z)++        movq    48(z), %rax+        movq    24(x), %rdx+        mulxq   %rdx, %rdx, %rcx+        adcxq   %rax, %rax+        adoxq   %rdx, %rax+        movq    %rax, 48(z)+        movq    56(z), %rax+        adcxq   %rax, %rax+        adoxq   %rcx, %rax+        movq    %rax, 56(z)++        movq    64(z), %rax+        movq    32(x), %rdx+        mulxq   %rdx, %rdx, %rcx+        adcxq   %rax, %rax+        adoxq   %rdx, %rax+        movq    %rax, 64(z)+        adcxq   %r9, %r9+        adoxq   %rcx, %r9+        movq    %r9, 72(z)++        movq    40(x), %rdx+        mulxq   %rdx, %rdx, %rcx+        adcxq   %r10, %r10+        adoxq   %rdx, %r10+        movq    %r10, 80(z)+        adcxq   %r11, %r11+        adoxq   %rcx, %r11+        movq    %r11, 88(z)++        movq    48(x), %rdx+        mulxq   %rdx, %rdx, %rcx+        adcxq   %r12, %r12+        adoxq   %rdx, %r12+        movq    %r12, 96(z)+        adcxq   %r13, %r13+        adoxq   %rcx, %r13+        movq    %r13, 104(z)++        movq    56(x), %rdx+        mulxq   %rdx, %rdx, %r15+        adcxq   %r14, %r14+        adoxq   %rdx, %r14+        movq    %r14, 112(z)+        adcxq   zero, %r15+        adoxq   zero, %r15+        movq    %r15, 120(z)++.endm+++S2N_BN_SYMBOL(bignum_sqr_8_16):+        CFI_START+        _CET_ENDBR++#if WINDOWS_ABI+        CFI_PUSH(%rdi)+        CFI_PUSH(%rsi)+        movq    %rcx, %rdi+        movq    %rdx, %rsi+#endif++// Save more registers to play with++        CFI_PUSH(%rbp)+        CFI_PUSH(%r12)+        CFI_PUSH(%r13)+        CFI_PUSH(%r14)+        CFI_PUSH(%r15)++// Do the multiplication++        diagonals++// Real epilog++        CFI_POP(%r15)+        CFI_POP(%r14)+        CFI_POP(%r13)+        CFI_POP(%r12)+        CFI_POP(%rbp)++#if WINDOWS_ABI+        CFI_POP(%rsi)+        CFI_POP(%rdi)+#endif+        CFI_RET++S2N_BN_SIZE_DIRECTIVE(bignum_sqr_8_16)++#if defined(__linux__) && defined(__ELF__)+.section .note.GNU-stack,"",%progbits+#endif
cbits/tests/ct/run.sh view
@@ -296,6 +296,7 @@ 			$s2n/bignum_montifier.S $s2n/bignum_emontredc_8n.S 			$s2n/bignum_kmul_16_32.S $s2n/bignum_ksqr_16_32.S 			$s2n/bignum_kmul_32_64.S $s2n/bignum_ksqr_32_64.S+			$s2n/bignum_sqr_8_16.S $s2n/bignum_mul_8_16.S 			$s2n/bignum_mul.S $s2n/bignum_sqr.S" 		powm_s2n_inc="-Icbits/s2n/include -DCRYPTON_S2N_BIGNUM 			-DCRYPTON_CPU_TESTING_ADX -DCT_POWM_COUNT_S2N
crypton.cabal view
@@ -1,6 +1,6 @@ cabal-version:      3.0 name:               crypton-version:            2.2.4+version:            2.2.5 -- crypton's own code is BSD-3-Clause.  The parts of -- cbits/aes/gcm_fused_x86.c that follow picotls's fusion are MIT, and the -- vendored s2n-bignum assembly in cbits/s2n is taken under ISC, and the@@ -408,6 +408,7 @@         cbits/p256/p256_ec.c      other-modules:+        Crypto.Number.ModArithmetic.Pub         Crypto.PubKey.RSA.Blinded.Internal         Crypto.Cipher.AES.Primitive         Crypto.Cipher.Blowfish.Primitive@@ -725,6 +726,8 @@                     cbits/s2n/x86_att/bignum_kmul_32_64.S                     cbits/s2n/x86_att/bignum_ksqr_16_32.S                     cbits/s2n/x86_att/bignum_ksqr_32_64.S+                    cbits/s2n/x86_att/bignum_sqr_8_16.S+                    cbits/s2n/x86_att/bignum_mul_8_16.S      -- The PQ Code Package's mlkem-native and mldsa-native, vendored under     -- cbits/mlkem and cbits/mldsa.  Apache-2.0 OR ISC OR MIT, the same
tests/NumberSpec.hs view
@@ -202,6 +202,14 @@             forAll (wideOf bytes) $ \e ->                 forAll (wideOf 128) $ \b ->                     expSafe b e modulus1024 === expFast b e modulus1024+    -- the C takes RSA's exponent at these sizes on some machines; plain+    -- squaring shares no multiplication with it+    prop "agrees with plain squaring on RSA's exponent at every key size" $+        forAll (elements [128, 192, 256, 384, 512]) $ \bytes ->+            forAll (wideOf bytes) $ \m' ->+                forAll (wideOf bytes) $ \b ->+                    let m = m' .|. bit (8 * bytes - 1) .|. 1+                     in expFast b 65537 m === naivePow (b `mod` m) 65537 m     -- the fast one keeps R^2 for the last few moduli; asking under more of     -- them than it keeps, round and round, would show one used for another     it "keeps each modulus' constant to that modulus" $ do
tests/PubKey/MGF1Spec.hs view
@@ -10,7 +10,11 @@ import Data.ByteString.Char8 ()  import Crypto.Hash+import qualified Data.ByteArray as BA+import Crypto.Number.Serialize (i2ospOf_) import Crypto.PubKey.MaskGenFunction+import Test.Hspec.QuickCheck (prop)+import Test.QuickCheck (choose, forAll)  import Utils @@ -32,5 +36,26 @@         }     ] +-- | RFC 8017's definition through the pure hash API, block by block, which+-- shares nothing with mgf1's in-place contexts or with the one-shot hash.+reference :: HashAlgorithm a => a -> ByteString -> Int -> ByteString+reference alg sd len = B.take len $ B.concat [block c | c <- [0 .. blocks - 1]]+  where+    blocks = (len + hashDigestSize alg - 1) `div` hashDigestSize alg+    block c = BA.convert (hashFinalize (hashUpdates (hashInitWith alg) [sd, i2ospOf_ 4 (fromIntegral c)])) :: ByteString+ spec :: Spec-spec = zipWithM_ doMGFTest [katZero ..] vectorsMGF+spec = do+    zipWithM_ doMGFTest [katZero ..] vectorsMGF+    describe "against the definition" $+        mapM_ agree+            [ ("SHA1", \s n -> (mgf1 SHA1 s n, reference SHA1 s n))+            , ("SHA256", \s n -> (mgf1 SHA256 s n, reference SHA256 s n))+            , ("SHA512", \s n -> (mgf1 SHA512 s n, reference SHA512 s n))+            , ("SHA3_256", \s n -> (mgf1 SHA3_256 s n, reference SHA3_256 s n))+            , ("Blake2b_512", \s n -> (mgf1 Blake2b_512 s n, reference Blake2b_512 s n))+            ]+  where+    agree (name, f) = prop name $+        forAll (arbitraryBSof 0 100) $ \s -> forAll (choose (0, 300)) $ \n ->+            let (got, want) = f s n in got == (want :: ByteString)
tests/PubKey/RSASpec.hs view
@@ -20,6 +20,7 @@ import Crypto.PubKey.RSA.Prim (ep) import qualified Crypto.PubKey.RSA.Prim as Prim import qualified Data.ByteString as B+import Data.Bits ((.|.)) import Data.Either  import Imports@@ -241,6 +242,68 @@             , os2ip ct + modulus < 2 ^ (8 * k)             ] +-- | The public-key operation takes bytes to the C and back where it can, and+-- the 'Integer' path where it cannot: a representative not below the+-- modulus, or one of another length.  Either way the answer is what plain+-- squaring gives, which shares nothing with the C.+publicOperationTests :: Spec+publicOperationTests = describe "public-key operation" $ do+    prop "agrees with plain squaring" $+        forAll (elements [128, 256, 384]) $ \k ->+            forAll (arbitraryBS k) $ \nb ->+                forAll (arbitraryBS k) $ \m ->+                    let pk = keyOf k nb in ep pk m === expected pk m+    prop "agrees at the edges of the modulus and of the length" $+        forAll (elements [128, 256, 384]) $ \k ->+            forAll (arbitraryBS k) $ \nb ->+                let pk = keyOf k nb+                    nn = RSA.public_n pk+                    edges =+                        [i2ospOf_ k x | x <- [0, 1, nn - 1, nn, nn + 1], x < 2 ^ (8 * k)]+                            ++ [i2ospOf_ (k - 1) (nn `div` 256), B.cons 0 (i2ospOf_ k (nn - 1))]+                 in [m | m <- edges, ep pk m /= expected pk m] === []+  where+    -- an odd modulus of exactly k bytes, which is all the operation needs+    keyOf k nb =+        RSA.PublicKey k (os2ip nb .|. (2 ^ (8 * k - 1)) .|. 1) 0x10001+    -- b^65537 as b squared sixteen times, times b+    expected pk m = i2ospOf_ (RSA.public_size pk) (squared 16 b * b `mod` nn) :: ByteString+      where+        nn = RSA.public_n pk+        b = os2ip m `mod` nn+        squared :: Int -> Integer -> Integer+        squared 0 x = x+        squared i x = squared (i - 1) (x * x `mod` nn)++-- | A key whose CRT values are off by one stands in for a fault in one half+-- of the computation, which would otherwise hand out a signature whose gcd+-- with n is a prime.  Every private-key path has to answer as the sound key.+crtFaultTests :: Spec+crtFaultTests = describe "a fault in one CRT half" $+    forM_ faults $ \(name, bad) -> describe name $ do+        it "signs what the sound key signs" $+            RSA.sign Nothing (Just SHA256) bad m `shouldBe` RSA.sign Nothing (Just SHA256) key m+        prop "signs with a blinder what the sound key signs" $ \testDRG ->+            let blinder = withTestDRG testDRG $ RSA.generateBlinder (RSA.public_n pub)+             in RSA.sign (Just blinder) (Just SHA256) bad m+                    === RSA.sign Nothing (Just SHA256) key m+        prop "signs through signSafer what the sound key signs" $ \testDRG ->+            withTestDRG testDRG (RSA.signSafer (Just SHA256) bad m)+                === RSA.sign Nothing (Just SHA256) key m+        it "decrypts what it was given" $ do+            c <- either (error . show) id <$> RSA.encrypt pub m+            RSA.decrypt Nothing bad c `shouldBe` (Right m :: Either RSA.Error ByteString)+  where+    vector = firstVector vectorsSHA1+    key = vectorToPrivate vector+    pub = vectorToPublic vector+    m = "a message to sign" :: ByteString+    faults =+        [ ("dP", key{RSA.private_dP = RSA.private_dP key + 1})+        , ("dQ", key{RSA.private_dQ = RSA.private_dQ key + 1})+        , ("qinv", key{RSA.private_qinv = RSA.private_qinv key + 1})+        ]+ -- | Building a key from its two primes has to arrive at the key the vectors -- carry -- the private exponent, both of its halves, and the inverse of one -- prime modulo the other, which is the part worked out without the extended@@ -555,3 +618,5 @@     blindedKeyTests     unpadTests     ciphertextRangeTests+    publicOperationTests+    crtFaultTests