added sub1 implementation that uses only constant-time operations

didn't prove running time because ... its complicated. I'm not even
sure what is a useful thing to state!