func (v *Element) Select(a, b *Element, cond int) *Element {
	m := mask64Bits(cond)
	v.l0 = (m & a.l0) | (^m & b.l0)
	v.l1 = (m & a.l1) | (^m & b.l1)
	v.l2 = (m & a.l2) | (^m & b.l2)
	v.l3 = (m & a.l3) | (^m & b.l3)
	v.l4 = (m & a.l4) | (^m & b.l4)
	return v
}
Select sets v to a if cond == 1, and to b if cond == 0.
package field
import (
	"crypto/subtle"
	"encoding/binary"
	"math/bits"
)
type Element struct {
	l0 uint64
	l1 uint64
	l2 uint64
	l3 uint64
	l4 uint64
}
const maskLow51Bits uint64 = (1 << 51) - 1
var feZero = &Element{0, 0, 0, 0, 0}
func (v *Element) Zero() *Element {
	*v = *feZero
	return v
}
var feOne = &Element{1, 0, 0, 0, 0}
func (v *Element) One() *Element {
	*v = *feOne
	return v
}
func (v *Element) reduce() *Element {
	v.carryPropagate()
	c := (v.l0 + 19) >> 51
	c = (v.l1 + c) >> 51
	c = (v.l2 + c) >> 51
	c = (v.l3 + c) >> 51
	c = (v.l4 + c) >> 51
	v.l0 += 19 * c
	v.l1 += v.l0 >> 51
	v.l0 = v.l0 & maskLow51Bits
	v.l2 += v.l1 >> 51
	v.l1 = v.l1 & maskLow51Bits
	v.l3 += v.l2 >> 51
	v.l2 = v.l2 & maskLow51Bits
	v.l4 += v.l3 >> 51
	v.l3 = v.l3 & maskLow51Bits
	v.l4 = v.l4 & maskLow51Bits
	return v
}
func (v *Element) Add(a, b *Element) *Element {
	v.l0 = a.l0 + b.l0
	v.l1 = a.l1 + b.l1
	v.l2 = a.l2 + b.l2
	v.l3 = a.l3 + b.l3
	v.l4 = a.l4 + b.l4
	return v.carryPropagateGeneric()
}
func (v *Element) Subtract(a, b *Element) *Element {
	v.l0 = (a.l0 + 0xFFFFFFFFFFFDA) - b.l0
	v.l1 = (a.l1 + 0xFFFFFFFFFFFFE) - b.l1
	v.l2 = (a.l2 + 0xFFFFFFFFFFFFE) - b.l2
	v.l3 = (a.l3 + 0xFFFFFFFFFFFFE) - b.l3
	v.l4 = (a.l4 + 0xFFFFFFFFFFFFE) - b.l4
	return v.carryPropagate()
}
func (v *Element) Negate(a *Element) *Element {
	return v.Subtract(feZero, a)
}
func (v *Element) Invert(z *Element) *Element {
	var z2, z9, z11, z2_5_0, z2_10_0, z2_20_0, z2_50_0, z2_100_0, t Element
	z2.Square(z)              
	t.Square(&z2)             
	t.Square(&t)              
	z9.Multiply(&t, z)        
	z11.Multiply(&z9, &z2)    
	t.Square(&z11)            
	z2_5_0.Multiply(&t, &z9)  
	t.Square(&z2_5_0)  
	for i := 0; i < 4; i++ {
		t.Square(&t)  
	}
	z2_10_0.Multiply(&t, &z2_5_0)  
	t.Square(&z2_10_0)  
	for i := 0; i < 9; i++ {
		t.Square(&t)  
	}
	z2_20_0.Multiply(&t, &z2_10_0)  
	t.Square(&z2_20_0)  
	for i := 0; i < 19; i++ {
		t.Square(&t)  
	}
	t.Multiply(&t, &z2_20_0)  
	t.Square(&t)  
	for i := 0; i < 9; i++ {
		t.Square(&t)  
	}
	z2_50_0.Multiply(&t, &z2_10_0)  
	t.Square(&z2_50_0)  
	for i := 0; i < 49; i++ {
		t.Square(&t)  
	}
	z2_100_0.Multiply(&t, &z2_50_0)  
	t.Square(&z2_100_0)  
	for i := 0; i < 99; i++ {
		t.Square(&t)  
	}
	t.Multiply(&t, &z2_100_0)  
	t.Square(&t)  
	for i := 0; i < 49; i++ {
		t.Square(&t)  
	}
	t.Multiply(&t, &z2_50_0)  
	t.Square(&t)  
	t.Square(&t)  
	t.Square(&t)  
	t.Square(&t)  
	t.Square(&t)  
	return v.Multiply(&t, &z11)  
}
func (v *Element) Set(a *Element) *Element {
	*v = *a
	return v
}
func (v *Element) SetBytes(x []byte) *Element {
	if len(x) != 32 {
		panic("edwards25519: invalid field element input size")
	}
	v.l0 = binary.LittleEndian.Uint64(x[0:8])
	v.l0 &= maskLow51Bits
	v.l1 = binary.LittleEndian.Uint64(x[6:14]) >> 3
	v.l1 &= maskLow51Bits
	v.l2 = binary.LittleEndian.Uint64(x[12:20]) >> 6
	v.l2 &= maskLow51Bits
	v.l3 = binary.LittleEndian.Uint64(x[19:27]) >> 1
	v.l3 &= maskLow51Bits
	v.l4 = binary.LittleEndian.Uint64(x[24:32]) >> 12
	v.l4 &= maskLow51Bits
	return v
}
func (v *Element) Bytes() []byte {
	var out [32]byte
	return v.bytes(&out)
}
func (v *Element) bytes(out *[32]byte) []byte {
	t := *v
	t.reduce()
	var buf [8]byte
	for i, l := range [5]uint64{t.l0, t.l1, t.l2, t.l3, t.l4} {
		bitsOffset := i * 51
		binary.LittleEndian.PutUint64(buf[:], l<<uint(bitsOffset%8))
		for i, bb := range buf {
			off := bitsOffset/8 + i
			if off >= len(out) {
				break
			}
			out[off] |= bb
		}
	}
	return out[:]
}
func (v *Element) Equal(u *Element) int {
	sa, sv := u.Bytes(), v.Bytes()
	return subtle.ConstantTimeCompare(sa, sv)
}
func mask64Bits(cond int) uint64 { return ^(uint64(cond) - 1) }