new 128-bit timings. use l2r xgcd until lehmer is faster