760 	fe x1, x2, z2, x3, z3;  in curve25519_generic()  local
773 	 * z2' = z3' = 0, and z2 = z3 = 0 gives z2' = z3' = 0. The statement was  in curve25519_generic()
798 	fe_1(&z3);  in curve25519_generic()
805 		 *   pos >= -1; if z2 = 0 then x2 is nonzero; if z3 = 0 then x3  in curve25519_generic()
809 		 *   to_xz (r*P)     === if swap then (x3, z3) else (x2, z2)  in curve25519_generic()
810 		 *   to_xz ((r+1)*P) === if swap then (x2, z2) else (x3, z3)  in curve25519_generic()
817 		fe_cswap(&z2, &z3, swap);  in curve25519_generic()
826 		fe_sub(&tmp0l, &x3, &z3);  in curve25519_generic()
829 		fe_add(&z2l, &x3, &z3);  in curve25519_generic()
830 		fe_mul_tll(&z3, &tmp0l, &x2l);  in curve25519_generic()
834 		fe_add(&x3l, &z3, &z2);  in curve25519_generic()
835 		fe_sub(&z2l, &z3, &z2);  in curve25519_generic()
839 		fe_mul121666(&z3, &tmp1l);  in curve25519_generic()
841 		fe_add(&tmp0l, &tmp0, &z3);  in curve25519_generic()
842 		fe_mul_ttt(&z3, &x1, &z2);  in curve25519_generic()
845 	/* here pos=-1, so r=e, so to_xz (e*P) === if swap then (x3, z3)  in curve25519_generic()
849 	fe_cswap(&z2, &z3, swap);  in curve25519_generic()
859 	memzero_explicit(&z3, sizeof(z3));  in curve25519_generic()