def clamp_top

bend-collections-laws-crypto@1.0.0.0 · src/crypto/curve25519/x25519.bend:44

import Base

44# RFC 7748 decodeScalar25519's clamping: k[0] &= 248, k[31] &= 127, k[31] |= 64
45def clamp_top(xs: List<&2, U32>) -> List<&2, U32>:
46  match xs:
47    case Nil{}:
48      Nil{}
49    case Con{x, xt}:
50      match xt:
51        case Nil{}:
52          Con{U32.or(U32.and(x, 127), 64), Nil{}}
53        case Con{y, yt}:
54          Con{x, clamp_top(Con{y, yt})}