def clamp_last

bend-collections-laws-crypto@1.0.0.0 · spec/crypto/curve25519/x25519.bend:18

import Base

18# decodeScalar25519's clamping: k[0] &= 248; k[31] &= 127; k[31] |= 64
19def clamp_last(xs: List<&2, U32>) -> List<&2, U32>:
20  match xs:
21    case Nil{}:
22      Nil{}
23    case Con{x, xt}:
24      match xt:
25        case Nil{}:
26          Con{U32.or(U32.and(x, 127), 64), Nil{}}
27        case Con{y, yt}:
28          Con{x, clamp_last(Con{y, yt})}