Merge "bouncycastle: Android tree with upstream code for version 1.56" into upstream-master

8 files changed, 79 insertions, 77 deletions

diff --git a/bcprov/src/main/java/org/bouncycastle/math/ec/WNafUtil.java b/bcprov/src/main/java/org/bouncycastle/math/ec/WNafUtil.java
index 339689ea..301b5aee 100644
--- a/bcprov/src/main/java/org/bouncycastle/math/ec/WNafUtil.java
+++ b/bcprov/src/main/java/org/bouncycastle/math/ec/WNafUtil.java
@@ -440,7 +440,7 @@ public abstract class WNafUtil
                          *      1) additions do not use the curve's A, B coefficients.
                          *      2) no special cases (i.e. Q +/- Q) when calculating 1P, 3P, 5P, ...
                          */
-                        if (ECAlgorithms.isFpCurve(c) && c.getFieldSize() >= 64)
+                        if (!twiceP.isInfinity() && ECAlgorithms.isFpCurve(c) && c.getFieldSize() >= 64)
                         {
                             switch (c.getCoordinateSystem())
                             {
diff --git a/bcprov/src/main/java/org/bouncycastle/math/ec/custom/sec/SecP256R1Field.java b/bcprov/src/main/java/org/bouncycastle/math/ec/custom/sec/SecP256R1Field.java
index 5a066d81..1e04f4b9 100644
--- a/bcprov/src/main/java/org/bouncycastle/math/ec/custom/sec/SecP256R1Field.java
+++ b/bcprov/src/main/java/org/bouncycastle/math/ec/custom/sec/SecP256R1Field.java
@@ -112,9 +112,10 @@ public class SecP256R1Field
         long t4 = xx12 + xx13;
         long t5 = xx13 + xx14;
         long t6 = xx14 + xx15;
+        long t7 = t5 - t0;
 
         long cc = 0;
-        cc += (xx[0] & M) + t0 - t3 - t5;
+        cc += (xx[0] & M) - t3 - t7;
         z[0] = (int)cc;
         cc >>= 32;
         cc += (xx[1] & M) + t1 - t4 - t6;
@@ -123,7 +124,7 @@ public class SecP256R1Field
         cc += (xx[2] & M) + t2 - t5;
         z[2] = (int)cc;
         cc >>= 32;
-        cc += (xx[3] & M) + (t3 << 1) + xx13 - xx15 - t0;
+        cc += (xx[3] & M) + (t3 << 1) + t7 - t6;
         z[3] = (int)cc;
         cc >>= 32;
         cc += (xx[4] & M) + (t4 << 1) + xx14 - t1;
@@ -132,7 +133,7 @@ public class SecP256R1Field
         cc += (xx[5] & M) + (t5 << 1) - t2;
         z[5] = (int)cc;
         cc >>= 32;
-        cc += (xx[6] & M) + (t6 << 1) + t5 - t0;
+        cc += (xx[6] & M) + (t6 << 1) + t7;
         z[6] = (int)cc;
         cc >>= 32;
         cc += (xx[7] & M) + (xx15 << 1) + xx08 - t2 - t4;
diff --git a/bcprov/src/main/java/org/bouncycastle/math/ec/custom/sec/SecP384R1Field.java b/bcprov/src/main/java/org/bouncycastle/math/ec/custom/sec/SecP384R1Field.java
index fcbb8727..164a7957 100644
--- a/bcprov/src/main/java/org/bouncycastle/math/ec/custom/sec/SecP384R1Field.java
+++ b/bcprov/src/main/java/org/bouncycastle/math/ec/custom/sec/SecP384R1Field.java
@@ -107,9 +107,10 @@ public class SecP384R1Field
         long t4 = xx17 + xx21;
         long t5 = xx21 - xx23;
         long t6 = xx22 - xx23;
+        long t7 = t0 + t5;
 
         long cc = 0;
-        cc += (xx[0] & M) + t0 + t5;
+        cc += (xx[0] & M) + t7;
         z[0] = (int)cc;
         cc >>= 32;
         cc += (xx[1] & M) + xx23 - t0 + t1;
@@ -118,10 +119,10 @@ public class SecP384R1Field
         cc += (xx[2] & M) - xx21 - t1 + t2;
         z[2] = (int)cc;
         cc >>= 32;
-        cc += (xx[3] & M) + t0 - t2 + t3 + t5;
+        cc += (xx[3] & M) - t2 + t3 + t7;
         z[3] = (int)cc;
         cc >>= 32;
-        cc += (xx[4] & M) + xx16 + xx21 + t0 + t1 - t3 + t5;
+        cc += (xx[4] & M) + xx16 + xx21 + t1 - t3 + t7;
         z[4] = (int)cc;
         cc >>= 32;
         cc += (xx[5] & M) - xx16 + t1 + t2 + t4;
diff --git a/bcprov/src/main/java/org/bouncycastle/math/raw/Nat128.java b/bcprov/src/main/java/org/bouncycastle/math/raw/Nat128.java
index 8d621c17..ae4ae489 100644
--- a/bcprov/src/main/java/org/bouncycastle/math/raw/Nat128.java
+++ b/bcprov/src/main/java/org/bouncycastle/math/raw/Nat128.java
@@ -636,8 +636,8 @@ public abstract class Nat128
         }
 
         long x_3 = x[3] & M;
-        long zz_5 = zz[5] & M;
-        long zz_6 = zz[6] & M;
+        long zz_5 = (zz[5] & M) + (zz_4 >>> 32); zz_4 &= M;
+        long zz_6 = (zz[6] & M) + (zz_5 >>> 32); zz_5 &= M;
         {
             zz_3 += x_3 * x_0;
             w = (int)zz_3;
@@ -658,7 +658,7 @@ public abstract class Nat128
         w = (int)zz_6;
         zz[6] = (w << 1) | c;
         c = w >>> 31;
-        w = zz[7] + (int)(zz_6 >> 32);
+        w = zz[7] + (int)(zz_6 >>> 32);
         zz[7] = (w << 1) | c;
     }
 
@@ -713,8 +713,8 @@ public abstract class Nat128
         }
 
         long x_3 = x[xOff + 3] & M;
-        long zz_5 = zz[zzOff + 5] & M;
-        long zz_6 = zz[zzOff + 6] & M;
+        long zz_5 = (zz[zzOff + 5] & M) + (zz_4 >>> 32); zz_4 &= M;
+        long zz_6 = (zz[zzOff + 6] & M) + (zz_5 >>> 32); zz_5 &= M;
         {
             zz_3 += x_3 * x_0;
             w = (int)zz_3;
@@ -734,7 +734,7 @@ public abstract class Nat128
         w = (int)zz_6;
         zz[zzOff + 6] = (w << 1) | c;
         c = w >>> 31;
-        w = zz[zzOff + 7] + (int)(zz_6 >> 32);
+        w = zz[zzOff + 7] + (int)(zz_6 >>> 32);
         zz[zzOff + 7] = (w << 1) | c;
     }
 
diff --git a/bcprov/src/main/java/org/bouncycastle/math/raw/Nat160.java b/bcprov/src/main/java/org/bouncycastle/math/raw/Nat160.java
index 55010dc3..620f9bcf 100644
--- a/bcprov/src/main/java/org/bouncycastle/math/raw/Nat160.java
+++ b/bcprov/src/main/java/org/bouncycastle/math/raw/Nat160.java
@@ -609,8 +609,8 @@ public abstract class Nat160
         }
 
         long x_3 = x[3] & M;
-        long zz_5 = zz[5] & M;
-        long zz_6 = zz[6] & M;
+        long zz_5 = (zz[5] & M) + (zz_4 >>> 32); zz_4 &= M;
+        long zz_6 = (zz[6] & M) + (zz_5 >>> 32); zz_5 &= M;
         {
             zz_3 += x_3 * x_0;
             w = (int)zz_3;
@@ -624,8 +624,8 @@ public abstract class Nat160
         }
 
         long x_4 = x[4] & M;
-        long zz_7 = zz[7] & M;
-        long zz_8 = zz[8] & M;
+        long zz_7 = (zz[7] & M) + (zz_6 >>> 32); zz_6 &= M;
+        long zz_8 = (zz[8] & M) + (zz_7 >>> 32); zz_7 &= M;
         {
             zz_4 += x_4 * x_0;
             w = (int)zz_4;
@@ -649,7 +649,7 @@ public abstract class Nat160
         w = (int)zz_8;
         zz[8] = (w << 1) | c;
         c = w >>> 31;
-        w = zz[9] + (int)(zz_8 >> 32);
+        w = zz[9] + (int)(zz_8 >>> 32);
         zz[9] = (w << 1) | c;
     }
 
@@ -704,8 +704,8 @@ public abstract class Nat160
         }
 
         long x_3 = x[xOff + 3] & M;
-        long zz_5 = zz[zzOff + 5] & M;
-        long zz_6 = zz[zzOff + 6] & M;
+        long zz_5 = (zz[zzOff + 5] & M) + (zz_4 >>> 32); zz_4 &= M;
+        long zz_6 = (zz[zzOff + 6] & M) + (zz_5 >>> 32); zz_5 &= M;
         {
             zz_3 += x_3 * x_0;
             w = (int)zz_3;
@@ -719,8 +719,8 @@ public abstract class Nat160
         }
 
         long x_4 = x[xOff + 4] & M;
-        long zz_7 = zz[zzOff + 7] & M;
-        long zz_8 = zz[zzOff + 8] & M;
+        long zz_7 = (zz[zzOff + 7] & M) + (zz_6 >>> 32); zz_6 &= M;
+        long zz_8 = (zz[zzOff + 8] & M) + (zz_7 >>> 32); zz_7 &= M;
         {
             zz_4 += x_4 * x_0;
             w = (int)zz_4;
@@ -744,7 +744,7 @@ public abstract class Nat160
         w = (int)zz_8;
         zz[zzOff + 8] = (w << 1) | c;
         c = w >>> 31;
-        w = zz[zzOff + 9] + (int)(zz_8 >> 32);
+        w = zz[zzOff + 9] + (int)(zz_8 >>> 32);
         zz[zzOff + 9] = (w << 1) | c;
     }
 
diff --git a/bcprov/src/main/java/org/bouncycastle/math/raw/Nat192.java b/bcprov/src/main/java/org/bouncycastle/math/raw/Nat192.java
index 421883e0..12db01bc 100644
--- a/bcprov/src/main/java/org/bouncycastle/math/raw/Nat192.java
+++ b/bcprov/src/main/java/org/bouncycastle/math/raw/Nat192.java
@@ -715,8 +715,8 @@ public abstract class Nat192
         }
 
         long x_3 = x[3] & M;
-        long zz_5 = zz[5] & M;
-        long zz_6 = zz[6] & M;
+        long zz_5 = (zz[5] & M) + (zz_4 >>> 32); zz_4 &= M;
+        long zz_6 = (zz[6] & M) + (zz_5 >>> 32); zz_5 &= M;
         {
             zz_3 += x_3 * x_0;
             w = (int)zz_3;
@@ -730,8 +730,8 @@ public abstract class Nat192
         }
 
         long x_4 = x[4] & M;
-        long zz_7 = zz[7] & M;
-        long zz_8 = zz[8] & M;
+        long zz_7 = (zz[7] & M) + (zz_6 >>> 32); zz_6 &= M;
+        long zz_8 = (zz[8] & M) + (zz_7 >>> 32); zz_7 &= M;
         {
             zz_4 += x_4 * x_0;
             w = (int)zz_4;
@@ -747,8 +747,8 @@ public abstract class Nat192
         }
 
         long x_5 = x[5] & M;
-        long zz_9 = zz[9] & M;
-        long zz_10 = zz[10] & M;
+        long zz_9 = (zz[9] & M) + (zz_8 >>> 32); zz_8 &= M;
+        long zz_10 = (zz[10] & M) + (zz_9 >>> 32); zz_9 &= M;
         {
             zz_5 += x_5 * x_0;
             w = (int)zz_5;
@@ -776,7 +776,7 @@ public abstract class Nat192
         w = (int)zz_10;
         zz[10] = (w << 1) | c;
         c = w >>> 31;
-        w = zz[11] + (int)(zz_10 >> 32);
+        w = zz[11] + (int)(zz_10 >>> 32);
         zz[11] = (w << 1) | c;
     }
 
@@ -831,8 +831,8 @@ public abstract class Nat192
         }
 
         long x_3 = x[xOff + 3] & M;
-        long zz_5 = zz[zzOff + 5] & M;
-        long zz_6 = zz[zzOff + 6] & M;
+        long zz_5 = (zz[zzOff + 5] & M) + (zz_4 >>> 32); zz_4 &= M;
+        long zz_6 = (zz[zzOff + 6] & M) + (zz_5 >>> 32); zz_5 &= M;
         {
             zz_3 += x_3 * x_0;
             w = (int)zz_3;
@@ -846,8 +846,8 @@ public abstract class Nat192
         }
 
         long x_4 = x[xOff + 4] & M;
-        long zz_7 = zz[zzOff + 7] & M;
-        long zz_8 = zz[zzOff + 8] & M;
+        long zz_7 = (zz[zzOff + 7] & M) + (zz_6 >>> 32); zz_6 &= M;
+        long zz_8 = (zz[zzOff + 8] & M) + (zz_7 >>> 32); zz_7 &= M;
         {
             zz_4 += x_4 * x_0;
             w = (int)zz_4;
@@ -863,8 +863,8 @@ public abstract class Nat192
         }
 
         long x_5 = x[xOff + 5] & M;
-        long zz_9 = zz[zzOff + 9] & M;
-        long zz_10 = zz[zzOff + 10] & M;
+        long zz_9 = (zz[zzOff + 9] & M) + (zz_8 >>> 32); zz_8 &= M;
+        long zz_10 = (zz[zzOff + 10] & M) + (zz_9 >>> 32); zz_9 &= M;
         {
             zz_5 += x_5 * x_0;
             w = (int)zz_5;
@@ -892,7 +892,7 @@ public abstract class Nat192
         w = (int)zz_10;
         zz[zzOff + 10] = (w << 1) | c;
         c = w >>> 31;
-        w = zz[zzOff + 11] + (int)(zz_10 >> 32);
+        w = zz[zzOff + 11] + (int)(zz_10 >>> 32);
         zz[zzOff + 11] = (w << 1) | c;
     }
 
diff --git a/bcprov/src/main/java/org/bouncycastle/math/raw/Nat224.java b/bcprov/src/main/java/org/bouncycastle/math/raw/Nat224.java
index bbe81caa..9ff107c1 100644
--- a/bcprov/src/main/java/org/bouncycastle/math/raw/Nat224.java
+++ b/bcprov/src/main/java/org/bouncycastle/math/raw/Nat224.java
@@ -793,8 +793,8 @@ public abstract class Nat224
         }
 
         long x_3 = x[3] & M;
-        long zz_5 = zz[5] & M;
-        long zz_6 = zz[6] & M;
+        long zz_5 = (zz[5] & M) + (zz_4 >>> 32); zz_4 &= M;
+        long zz_6 = (zz[6] & M) + (zz_5 >>> 32); zz_5 &= M;
         {
             zz_3 += x_3 * x_0;
             w = (int)zz_3;
@@ -808,8 +808,8 @@ public abstract class Nat224
         }
 
         long x_4 = x[4] & M;
-        long zz_7 = zz[7] & M;
-        long zz_8 = zz[8] & M;
+        long zz_7 = (zz[7] & M) + (zz_6 >>> 32); zz_6 &= M;
+        long zz_8 = (zz[8] & M) + (zz_7 >>> 32); zz_7 &= M;
         {
             zz_4 += x_4 * x_0;
             w = (int)zz_4;
@@ -825,8 +825,8 @@ public abstract class Nat224
         }
 
         long x_5 = x[5] & M;
-        long zz_9 = zz[9] & M;
-        long zz_10 = zz[10] & M;
+        long zz_9 = (zz[9] & M) + (zz_8 >>> 32); zz_8 &= M;
+        long zz_10 = (zz[10] & M) + (zz_9 >>> 32); zz_9 &= M;
         {
             zz_5 += x_5 * x_0;
             w = (int)zz_5;
@@ -844,8 +844,8 @@ public abstract class Nat224
         }
 
         long x_6 = x[6] & M;
-        long zz_11 = zz[11] & M;
-        long zz_12 = zz[12] & M;
+        long zz_11 = (zz[11] & M) + (zz_10 >>> 32); zz_10 &= M;
+        long zz_12 = (zz[12] & M) + (zz_11 >>> 32); zz_11 &= M;
         {
             zz_6 += x_6 * x_0;
             w = (int)zz_6;
@@ -877,7 +877,7 @@ public abstract class Nat224
         w = (int)zz_12;
         zz[12] = (w << 1) | c;
         c = w >>> 31;
-        w = zz[13] + (int)(zz_12 >> 32);
+        w = zz[13] + (int)(zz_12 >>> 32);
         zz[13] = (w << 1) | c;
     }
 
@@ -932,8 +932,8 @@ public abstract class Nat224
         }
 
         long x_3 = x[xOff + 3] & M;
-        long zz_5 = zz[zzOff + 5] & M;
-        long zz_6 = zz[zzOff + 6] & M;
+        long zz_5 = (zz[zzOff + 5] & M) + (zz_4 >>> 32); zz_4 &= M;
+        long zz_6 = (zz[zzOff + 6] & M) + (zz_5 >>> 32); zz_5 &= M;
         {
             zz_3 += x_3 * x_0;
             w = (int)zz_3;
@@ -947,8 +947,8 @@ public abstract class Nat224
         }
 
         long x_4 = x[xOff + 4] & M;
-        long zz_7 = zz[zzOff + 7] & M;
-        long zz_8 = zz[zzOff + 8] & M;
+        long zz_7 = (zz[zzOff + 7] & M) + (zz_6 >>> 32); zz_6 &= M;
+        long zz_8 = (zz[zzOff + 8] & M) + (zz_7 >>> 32); zz_7 &= M;
         {
             zz_4 += x_4 * x_0;
             w = (int)zz_4;
@@ -964,8 +964,8 @@ public abstract class Nat224
         }
 
         long x_5 = x[xOff + 5] & M;
-        long zz_9 = zz[zzOff + 9] & M;
-        long zz_10 = zz[zzOff + 10] & M;
+        long zz_9 = (zz[zzOff + 9] & M) + (zz_8 >>> 32); zz_8 &= M;
+        long zz_10 = (zz[zzOff + 10] & M) + (zz_9 >>> 32); zz_9 &= M;
         {
             zz_5 += x_5 * x_0;
             w = (int)zz_5;
@@ -983,8 +983,8 @@ public abstract class Nat224
         }
 
         long x_6 = x[xOff + 6] & M;
-        long zz_11 = zz[zzOff + 11] & M;
-        long zz_12 = zz[zzOff + 12] & M;
+        long zz_11 = (zz[zzOff + 11] & M) + (zz_10 >>> 32); zz_10 &= M;
+        long zz_12 = (zz[zzOff + 12] & M) + (zz_11 >>> 32); zz_11 &= M;
         {
             zz_6 += x_6 * x_0;
             w = (int)zz_6;
@@ -1016,7 +1016,7 @@ public abstract class Nat224
         w = (int)zz_12;
         zz[zzOff + 12] = (w << 1) | c;
         c = w >>> 31;
-        w = zz[zzOff + 13] + (int)(zz_12 >> 32);
+        w = zz[zzOff + 13] + (int)(zz_12 >>> 32);
         zz[zzOff + 13] = (w << 1) | c;
     }
 
diff --git a/bcprov/src/main/java/org/bouncycastle/math/raw/Nat256.java b/bcprov/src/main/java/org/bouncycastle/math/raw/Nat256.java
index db1daac0..726bae35 100644
--- a/bcprov/src/main/java/org/bouncycastle/math/raw/Nat256.java
+++ b/bcprov/src/main/java/org/bouncycastle/math/raw/Nat256.java
@@ -926,8 +926,8 @@ public abstract class Nat256
         }
 
         long x_3 = x[3] & M;
-        long zz_5 = zz[5] & M;
-        long zz_6 = zz[6] & M;
+        long zz_5 = (zz[5] & M) + (zz_4 >>> 32); zz_4 &= M;
+        long zz_6 = (zz[6] & M) + (zz_5 >>> 32); zz_5 &= M;
         {
             zz_3 += x_3 * x_0;
             w = (int)zz_3;
@@ -941,8 +941,8 @@ public abstract class Nat256
         }
 
         long x_4 = x[4] & M;
-        long zz_7 = zz[7] & M;
-        long zz_8 = zz[8] & M;
+        long zz_7 = (zz[7] & M) + (zz_6 >>> 32); zz_6 &= M;
+        long zz_8 = (zz[8] & M) + (zz_7 >>> 32); zz_7 &= M;
         {
             zz_4 += x_4 * x_0;
             w = (int)zz_4;
@@ -958,8 +958,8 @@ public abstract class Nat256
         }
 
         long x_5 = x[5] & M;
-        long zz_9 = zz[9] & M;
-        long zz_10 = zz[10] & M;
+        long zz_9 = (zz[9] & M) + (zz_8 >>> 32); zz_8 &= M;
+        long zz_10 = (zz[10] & M) + (zz_9 >>> 32); zz_9 &= M;
         {
             zz_5 += x_5 * x_0;
             w = (int)zz_5;
@@ -977,8 +977,8 @@ public abstract class Nat256
         }
 
         long x_6 = x[6] & M;
-        long zz_11 = zz[11] & M;
-        long zz_12 = zz[12] & M;
+        long zz_11 = (zz[11] & M) + (zz_10 >>> 32); zz_10 &= M;
+        long zz_12 = (zz[12] & M) + (zz_11 >>> 32); zz_11 &= M;
         {
             zz_6 += x_6 * x_0;
             w = (int)zz_6;
@@ -998,8 +998,8 @@ public abstract class Nat256
         }
 
         long x_7 = x[7] & M;
-        long zz_13 = zz[13] & M;
-        long zz_14 = zz[14] & M;
+        long zz_13 = (zz[13] & M) + (zz_12 >>> 32); zz_12 &= M;
+        long zz_14 = (zz[14] & M) + (zz_13 >>> 32); zz_13 &= M;
         {
             zz_7 += x_7 * x_0;
             w = (int)zz_7;
@@ -1035,7 +1035,7 @@ public abstract class Nat256
         w = (int)zz_14;
         zz[14] = (w << 1) | c;
         c = w >>> 31;
-        w = zz[15] + (int)(zz_14 >> 32);
+        w = zz[15] + (int)(zz_14 >>> 32);
         zz[15] = (w << 1) | c;
     }
 
@@ -1090,8 +1090,8 @@ public abstract class Nat256
         }
 
         long x_3 = x[xOff + 3] & M;
-        long zz_5 = zz[zzOff + 5] & M;
-        long zz_6 = zz[zzOff + 6] & M;
+        long zz_5 = (zz[zzOff + 5] & M) + (zz_4 >>> 32); zz_4 &= M;
+        long zz_6 = (zz[zzOff + 6] & M) + (zz_5 >>> 32); zz_5 &= M;
         {
             zz_3 += x_3 * x_0;
             w = (int)zz_3;
@@ -1105,8 +1105,8 @@ public abstract class Nat256
         }
 
         long x_4 = x[xOff + 4] & M;
-        long zz_7 = zz[zzOff + 7] & M;
-        long zz_8 = zz[zzOff + 8] & M;
+        long zz_7 = (zz[zzOff + 7] & M) + (zz_6 >>> 32); zz_6 &= M;
+        long zz_8 = (zz[zzOff + 8] & M) + (zz_7 >>> 32); zz_7 &= M;
         {
             zz_4 += x_4 * x_0;
             w = (int)zz_4;
@@ -1122,8 +1122,8 @@ public abstract class Nat256
         }
 
         long x_5 = x[xOff + 5] & M;
-        long zz_9 = zz[zzOff + 9] & M;
-        long zz_10 = zz[zzOff + 10] & M;
+        long zz_9 = (zz[zzOff + 9] & M) + (zz_8 >>> 32); zz_8 &= M;
+        long zz_10 = (zz[zzOff + 10] & M) + (zz_9 >>> 32); zz_9 &= M;
         {
             zz_5 += x_5 * x_0;
             w = (int)zz_5;
@@ -1141,8 +1141,8 @@ public abstract class Nat256
         }
 
         long x_6 = x[xOff + 6] & M;
-        long zz_11 = zz[zzOff + 11] & M;
-        long zz_12 = zz[zzOff + 12] & M;
+        long zz_11 = (zz[zzOff + 11] & M) + (zz_10 >>> 32); zz_10 &= M;
+        long zz_12 = (zz[zzOff + 12] & M) + (zz_11 >>> 32); zz_11 &= M;
         {
             zz_6 += x_6 * x_0;
             w = (int)zz_6;
@@ -1162,8 +1162,8 @@ public abstract class Nat256
         }
 
         long x_7 = x[xOff + 7] & M;
-        long zz_13 = zz[zzOff + 13] & M;
-        long zz_14 = zz[zzOff + 14] & M;
+        long zz_13 = (zz[zzOff + 13] & M) + (zz_12 >>> 32); zz_12 &= M;
+        long zz_14 = (zz[zzOff + 14] & M) + (zz_13 >>> 32); zz_13 &= M;
         {
             zz_7 += x_7 * x_0;
             w = (int)zz_7;
@@ -1199,7 +1199,7 @@ public abstract class Nat256
         w = (int)zz_14;
         zz[zzOff + 14] = (w << 1) | c;
         c = w >>> 31;
-        w = zz[zzOff + 15] + (int)(zz_14 >> 32);
+        w = zz[zzOff + 15] + (int)(zz_14 >>> 32);
         zz[zzOff + 15] = (w << 1) | c;
     }