760 	fe x1, x2, z2, x3, z3;  in curve25519_generic()  local
773 	 * z2' = z3' = 0, and z2 = z3 = 0 gives z2' = z3' = 0. The statement was  in curve25519_generic()
796 	fe_0(&z2);  in curve25519_generic()
805 		 *   pos >= -1; if z2 = 0 then x2 is nonzero; if z3 = 0 then x3  in curve25519_generic()
809 		 *   to_xz (r*P)     === if swap then (x3, z3) else (x2, z2)  in curve25519_generic()
810 		 *   to_xz ((r+1)*P) === if swap then (x2, z2) else (x3, z3)  in curve25519_generic()
817 		fe_cswap(&z2, &z3, swap);  in curve25519_generic()
827 		fe_sub(&tmp1l, &x2, &z2);  in curve25519_generic()
828 		fe_add(&x2l, &x2, &z2);  in curve25519_generic()
831 		fe_mul_tll(&z2, &z2l, &tmp1l);  in curve25519_generic()
834 		fe_add(&x3l, &z3, &z2);  in curve25519_generic()
835 		fe_sub(&z2l, &z3, &z2);  in curve25519_generic()
838 		fe_sq_tl(&z2, &z2l);  in curve25519_generic()
842 		fe_mul_ttt(&z3, &x1, &z2);  in curve25519_generic()
843 		fe_mul_tll(&z2, &tmp1l, &tmp0l);  in curve25519_generic()
846 	 * else (x2, z2)  in curve25519_generic()
849 	fe_cswap(&z2, &z3, swap);  in curve25519_generic()
851 	fe_invert(&z2, &z2);  in curve25519_generic()
852 	fe_mul_ttt(&x2, &x2, &z2);  in curve25519_generic()
857 	memzero_explicit(&z2, sizeof(z2));  in curve25519_generic()