--- libgo/Makefile.am.jj	2014-01-08 13:53:06.000000000 +0100

+++ libgo/Makefile.am	2014-03-05 15:20:09.938466093 +0100

@@ -1133,7 +1133,6 @@ go_crypto_ecdsa_files = \

 	go/crypto/ecdsa/ecdsa.go

 go_crypto_elliptic_files = \

 	go/crypto/elliptic/elliptic.go \

-	go/crypto/elliptic/p224.go \

 	go/crypto/elliptic/p256.go

 go_crypto_hmac_files = \

 	go/crypto/hmac/hmac.go

--- libgo/Makefile.in.jj	2014-01-08 13:53:06.000000000 +0100

+++ libgo/Makefile.in	2014-03-05 15:20:20.372465471 +0100

@@ -1291,7 +1291,6 @@ go_crypto_ecdsa_files = \

 go_crypto_elliptic_files = \

 	go/crypto/elliptic/elliptic.go \

-	go/crypto/elliptic/p224.go \

 	go/crypto/elliptic/p256.go

 go_crypto_hmac_files = \

--- libgo/go/crypto/elliptic/elliptic.go.jj	2016-02-05 20:11:20.000000000 +0100

+++ libgo/go/crypto/elliptic/elliptic.go	2016-02-05 22:36:06.145039321 +0100

@@ -338,7 +338,6 @@ var p384 *CurveParams

 var p521 *CurveParams

 func initAll() {

-	initP224()

 	initP256()

 	initP384()

 	initP521()

--- libgo/go/crypto/elliptic/elliptic_test.go.jj	2016-02-05 20:11:19.000000000 +0100

+++ libgo/go/crypto/elliptic/elliptic_test.go	2016-02-05 22:37:37.857772875 +0100

@@ -5,39 +5,16 @@

 package elliptic

 import (

-	"crypto/rand"

-	"encoding/hex"

-	"fmt"

 	"math/big"

 	"testing"

 )

-func TestOnCurve(t *testing.T) {

-	p224 := P224()

-	if !p224.IsOnCurve(p224.Params().Gx, p224.Params().Gy) {

-		t.Errorf("FAIL")

-	}

-}

-

-func TestOffCurve(t *testing.T) {

-	p224 := P224()

-	x, y := new(big.Int).SetInt64(1), new(big.Int).SetInt64(1)

-	if p224.IsOnCurve(x, y) {

-		t.Errorf("FAIL: point off curve is claimed to be on the curve")

-	}

-	b := Marshal(p224, x, y)

-	x1, y1 := Unmarshal(p224, b)

-	if x1 != nil || y1 != nil {

-		t.Errorf("FAIL: unmarshalling a point not on the curve succeeded")

-	}

-}

-

 type baseMultTest struct {

 	k    string

 	x, y string

 }

-var p224BaseMultTests = []baseMultTest{

+var p256BaseMultTests = []baseMultTest{

 	{

 		"1",

 		"b70e0cbd6bb4bf7f321390b94a03c1d356c21122343280d6115c1d21",

@@ -300,47 +277,12 @@ var p224BaseMultTests = []baseMultTest{

 	},

 }

-func TestBaseMult(t *testing.T) {

-	p224 := P224()

-	for i, e := range p224BaseMultTests {

-		k, ok := new(big.Int).SetString(e.k, 10)

-		if !ok {

-			t.Errorf("%d: bad value for k: %s", i, e.k)

-		}

-		x, y := p224.ScalarBaseMult(k.Bytes())

-		if fmt.Sprintf("%x", x) != e.x || fmt.Sprintf("%x", y) != e.y {

-			t.Errorf("%d: bad output for k=%s: got (%x, %x), want (%s, %s)", i, e.k, x, y, e.x, e.y)

-		}

-		if testing.Short() && i > 5 {

-			break

-		}

-	}

-}

-

-func TestGenericBaseMult(t *testing.T) {

-	// We use the P224 CurveParams directly in order to test the generic implementation.

-	p224 := P224().Params()

-	for i, e := range p224BaseMultTests {

-		k, ok := new(big.Int).SetString(e.k, 10)

-		if !ok {

-			t.Errorf("%d: bad value for k: %s", i, e.k)

-		}

-		x, y := p224.ScalarBaseMult(k.Bytes())

-		if fmt.Sprintf("%x", x) != e.x || fmt.Sprintf("%x", y) != e.y {

-			t.Errorf("%d: bad output for k=%s: got (%x, %x), want (%s, %s)", i, e.k, x, y, e.x, e.y)

-		}

-		if testing.Short() && i > 5 {

-			break

-		}

-	}

-}

-

 func TestP256BaseMult(t *testing.T) {

 	p256 := P256()

 	p256Generic := p256.Params()

-	scalars := make([]*big.Int, 0, len(p224BaseMultTests)+1)

-	for _, e := range p224BaseMultTests {

+	scalars := make([]*big.Int, 0, len(p256BaseMultTests)+1)

+	for _, e := range p256BaseMultTests {

 		k, _ := new(big.Int).SetString(e.k, 10)

 		scalars = append(scalars, k)

 	}

@@ -365,7 +307,7 @@ func TestP256Mult(t *testing.T) {

 	p256 := P256()

 	p256Generic := p256.Params()

-	for i, e := range p224BaseMultTests {

+	for i, e := range p256BaseMultTests {

 		x, _ := new(big.Int).SetString(e.x, 16)

 		y, _ := new(big.Int).SetString(e.y, 16)

 		k, _ := new(big.Int).SetString(e.k, 10)

@@ -386,7 +328,6 @@ func TestInfinity(t *testing.T) {

 		name  string

 		curve Curve

 	}{

-		{"p224", P224()},

 		{"p256", P256()},

 	}

@@ -419,21 +360,10 @@ func TestInfinity(t *testing.T) {

 	}

 }

-func BenchmarkBaseMult(b *testing.B) {

-	b.ResetTimer()

-	p224 := P224()

-	e := p224BaseMultTests[25]

-	k, _ := new(big.Int).SetString(e.k, 10)

-	b.StartTimer()

-	for i := 0; i < b.N; i++ {

-		p224.ScalarBaseMult(k.Bytes())

-	}

-}

-

 func BenchmarkBaseMultP256(b *testing.B) {

 	b.ResetTimer()

 	p256 := P256()

-	e := p224BaseMultTests[25]

+	e := p256BaseMultTests[25]

 	k, _ := new(big.Int).SetString(e.k, 10)

 	b.StartTimer()

 	for i := 0; i < b.N; i++ {

@@ -452,32 +382,3 @@ func BenchmarkScalarMultP256(b *testing.

 		p256.ScalarMult(x, y, priv)

 	}

 }

-

-func TestMarshal(t *testing.T) {

-	p224 := P224()

-	_, x, y, err := GenerateKey(p224, rand.Reader)

-	if err != nil {

-		t.Error(err)

-		return

-	}

-	serialized := Marshal(p224, x, y)

-	xx, yy := Unmarshal(p224, serialized)

-	if xx == nil {

-		t.Error("failed to unmarshal")

-		return

-	}

-	if xx.Cmp(x) != 0 || yy.Cmp(y) != 0 {

-		t.Error("unmarshal returned different values")

-		return

-	}

-}

-

-func TestP224Overflow(t *testing.T) {

-	// This tests for a specific bug in the P224 implementation.

-	p224 := P224()

-	pointData, _ := hex.DecodeString("049B535B45FB0A2072398A6831834624C7E32CCFD5A4B933BCEAF77F1DD945E08BBE5178F5EDF5E733388F196D2A631D2E075BB16CBFEEA15B")

-	x, y := Unmarshal(p224, pointData)

-	if !p224.IsOnCurve(x, y) {

-		t.Error("P224 failed to validate a correct point")

-	}

-}

--- libgo/go/crypto/ecdsa/ecdsa_test.go.jj	2016-02-05 20:10:59.000000000 +0100

+++ libgo/go/crypto/ecdsa/ecdsa_test.go	2016-02-05 22:41:54.916215999 +0100

@@ -33,7 +33,6 @@ func testKeyGeneration(t *testing.T, c e

 }

 func TestKeyGeneration(t *testing.T) {

-	testKeyGeneration(t, elliptic.P224(), "p224")

 	if testing.Short() {

 		return

 	}

@@ -98,7 +97,6 @@ func testSignAndVerify(t *testing.T, c e

 }

 func TestSignAndVerify(t *testing.T) {

-	testSignAndVerify(t, elliptic.P224(), "p224")

 	if testing.Short() {

 		return

 	}

@@ -135,7 +133,6 @@ func testNonceSafety(t *testing.T, c ell

 }

 func TestNonceSafety(t *testing.T) {

-	testNonceSafety(t, elliptic.P224(), "p224")

 	if testing.Short() {

 		return

 	}

@@ -170,7 +167,6 @@ func testINDCCA(t *testing.T, c elliptic

 }

 func TestINDCCA(t *testing.T) {

-	testINDCCA(t, elliptic.P224(), "p224")

 	if testing.Short() {

 		return

 	}

@@ -236,8 +232,6 @@ func TestVectors(t *testing.T) {

 			parts := strings.SplitN(line, ",", 2)

 			switch parts[0] {

-			case "P-224":

-				pub.Curve = elliptic.P224()

 			case "P-256":

 				pub.Curve = elliptic.P256()

 			case "P-384":

--- libgo/go/crypto/x509/x509.go.jj	2016-02-05 20:11:19.000000000 +0100

+++ libgo/go/crypto/x509/x509.go	2016-02-05 22:36:06.147039294 +0100

@@ -334,9 +334,6 @@ func getPublicKeyAlgorithmFromOID(oid as

 // RFC 5480, 2.1.1.1. Named Curve

 //

-// secp224r1 OBJECT IDENTIFIER ::= {

-//   iso(1) identified-organization(3) certicom(132) curve(0) 33 }

-//

 // secp256r1 OBJECT IDENTIFIER ::= {

 //   iso(1) member-body(2) us(840) ansi-X9-62(10045) curves(3)

 //   prime(1) 7 }

@@ -349,7 +346,6 @@ func getPublicKeyAlgorithmFromOID(oid as

 //

 // NB: secp256r1 is equivalent to prime256v1

 var (

-	oidNamedCurveP224 = asn1.ObjectIdentifier{1, 3, 132, 0, 33}

 	oidNamedCurveP256 = asn1.ObjectIdentifier{1, 2, 840, 10045, 3, 1, 7}

 	oidNamedCurveP384 = asn1.ObjectIdentifier{1, 3, 132, 0, 34}

 	oidNamedCurveP521 = asn1.ObjectIdentifier{1, 3, 132, 0, 35}

@@ -357,8 +353,6 @@ var (

 func namedCurveFromOID(oid asn1.ObjectIdentifier) elliptic.Curve {

 	switch {

-	case oid.Equal(oidNamedCurveP224):

-		return elliptic.P224()

 	case oid.Equal(oidNamedCurveP256):

 		return elliptic.P256()

 	case oid.Equal(oidNamedCurveP384):

@@ -371,8 +365,6 @@ func namedCurveFromOID(oid asn1.ObjectId

 func oidFromNamedCurve(curve elliptic.Curve) (asn1.ObjectIdentifier, bool) {

 	switch curve {

-	case elliptic.P224():

-		return oidNamedCurveP224, true

 	case elliptic.P256():

 		return oidNamedCurveP256, true

 	case elliptic.P384():

@@ -1502,7 +1494,7 @@ func signingParamsForPublicKey(pub inter

 		pubType = ECDSA

 		switch pub.Curve {

-		case elliptic.P224(), elliptic.P256():

+		case elliptic.P256():

 			hashFunc = crypto.SHA256

 			sigAlgo.Algorithm = oidSignatureECDSAWithSHA256

 		case elliptic.P384():

--- libgo/go/crypto/elliptic/p224.go.jj	2016-01-15 10:58:09.000000000 +0100

+++ libgo/go/crypto/elliptic/p224.go	2016-02-05 22:36:06.147039294 +0100

@@ -1,765 +0,0 @@

-// Copyright 2012 The Go Authors.  All rights reserved.

-// Use of this source code is governed by a BSD-style

-// license that can be found in the LICENSE file.

-

-package elliptic

-

-// This is a constant-time, 32-bit implementation of P224. See FIPS 186-3,

-// section D.2.2.

-//

-// See http://www.imperialviolet.org/2010/12/04/ecc.html ([1]) for background.

-

-import (

-	"math/big"

-)

-

-var p224 p224Curve

-

-type p224Curve struct {

-	*CurveParams

-	gx, gy, b p224FieldElement

-}

-

-func initP224() {

-	// See FIPS 186-3, section D.2.2

-	p224.CurveParams = &CurveParams{Name: "P-224"}

-	p224.P, _ = new(big.Int).SetString("26959946667150639794667015087019630673557916260026308143510066298881", 10)

-	p224.N, _ = new(big.Int).SetString("26959946667150639794667015087019625940457807714424391721682722368061", 10)

-	p224.B, _ = new(big.Int).SetString("b4050a850c04b3abf54132565044b0b7d7bfd8ba270b39432355ffb4", 16)

-	p224.Gx, _ = new(big.Int).SetString("b70e0cbd6bb4bf7f321390b94a03c1d356c21122343280d6115c1d21", 16)

-	p224.Gy, _ = new(big.Int).SetString("bd376388b5f723fb4c22dfe6cd4375a05a07476444d5819985007e34", 16)

-	p224.BitSize = 224

-

-	p224FromBig(&p224.gx, p224.Gx)

-	p224FromBig(&p224.gy, p224.Gy)

-	p224FromBig(&p224.b, p224.B)

-}

-

-// P224 returns a Curve which implements P-224 (see FIPS 186-3, section D.2.2)

-func P224() Curve {

-	initonce.Do(initAll)

-	return p224

-}

-

-func (curve p224Curve) Params() *CurveParams {

-	return curve.CurveParams

-}

-

-func (curve p224Curve) IsOnCurve(bigX, bigY *big.Int) bool {

-	var x, y p224FieldElement

-	p224FromBig(&x, bigX)

-	p224FromBig(&y, bigY)

-

-	// y² = x³ - 3x + b

-	var tmp p224LargeFieldElement

-	var x3 p224FieldElement

-	p224Square(&x3, &x, &tmp)

-	p224Mul(&x3, &x3, &x, &tmp)

-

-	for i := 0; i < 8; i++ {

-		x[i] *= 3

-	}

-	p224Sub(&x3, &x3, &x)

-	p224Reduce(&x3)

-	p224Add(&x3, &x3, &curve.b)

-	p224Contract(&x3, &x3)

-

-	p224Square(&y, &y, &tmp)

-	p224Contract(&y, &y)

-

-	for i := 0; i < 8; i++ {

-		if y[i] != x3[i] {

-			return false

-		}

-	}

-	return true

-}

-

-func (p224Curve) Add(bigX1, bigY1, bigX2, bigY2 *big.Int) (x, y *big.Int) {

-	var x1, y1, z1, x2, y2, z2, x3, y3, z3 p224FieldElement

-

-	p224FromBig(&x1, bigX1)

-	p224FromBig(&y1, bigY1)

-	if bigX1.Sign() != 0 || bigY1.Sign() != 0 {

-		z1[0] = 1

-	}

-	p224FromBig(&x2, bigX2)

-	p224FromBig(&y2, bigY2)

-	if bigX2.Sign() != 0 || bigY2.Sign() != 0 {

-		z2[0] = 1

-	}

-

-	p224AddJacobian(&x3, &y3, &z3, &x1, &y1, &z1, &x2, &y2, &z2)

-	return p224ToAffine(&x3, &y3, &z3)

-}

-

-func (p224Curve) Double(bigX1, bigY1 *big.Int) (x, y *big.Int) {

-	var x1, y1, z1, x2, y2, z2 p224FieldElement

-

-	p224FromBig(&x1, bigX1)

-	p224FromBig(&y1, bigY1)

-	z1[0] = 1

-

-	p224DoubleJacobian(&x2, &y2, &z2, &x1, &y1, &z1)

-	return p224ToAffine(&x2, &y2, &z2)

-}

-

-func (p224Curve) ScalarMult(bigX1, bigY1 *big.Int, scalar []byte) (x, y *big.Int) {

-	var x1, y1, z1, x2, y2, z2 p224FieldElement

-

-	p224FromBig(&x1, bigX1)

-	p224FromBig(&y1, bigY1)

-	z1[0] = 1

-

-	p224ScalarMult(&x2, &y2, &z2, &x1, &y1, &z1, scalar)

-	return p224ToAffine(&x2, &y2, &z2)

-}

-

-func (curve p224Curve) ScalarBaseMult(scalar []byte) (x, y *big.Int) {

-	var z1, x2, y2, z2 p224FieldElement

-

-	z1[0] = 1

-	p224ScalarMult(&x2, &y2, &z2, &curve.gx, &curve.gy, &z1, scalar)

-	return p224ToAffine(&x2, &y2, &z2)

-}

-

-// Field element functions.

-//

-// The field that we're dealing with is ℤ/pℤ where p = 2**224 - 2**96 + 1.

-//

-// Field elements are represented by a FieldElement, which is a typedef to an

-// array of 8 uint32's. The value of a FieldElement, a, is:

-//   a[0] + 2**28·a[1] + 2**56·a[1] + ... + 2**196·a[7]

-//

-// Using 28-bit limbs means that there's only 4 bits of headroom, which is less

-// than we would really like. But it has the useful feature that we hit 2**224

-// exactly, making the reflections during a reduce much nicer.

-type p224FieldElement [8]uint32

-

-// p224P is the order of the field, represented as a p224FieldElement.

-var p224P = [8]uint32{1, 0, 0, 0xffff000, 0xfffffff, 0xfffffff, 0xfffffff, 0xfffffff}

-

-// p224IsZero returns 1 if a == 0 mod p and 0 otherwise.

-//

-// a[i] < 2**29

-func p224IsZero(a *p224FieldElement) uint32 {

-	// Since a p224FieldElement contains 224 bits there are two possible

-	// representations of 0: 0 and p.

-	var minimal p224FieldElement

-	p224Contract(&minimal, a)

-

-	var isZero, isP uint32

-	for i, v := range minimal {

-		isZero |= v

-		isP |= v - p224P[i]

-	}

-

-	// If either isZero or isP is 0, then we should return 1.

-	isZero |= isZero >> 16

-	isZero |= isZero >> 8

-	isZero |= isZero >> 4

-	isZero |= isZero >> 2

-	isZero |= isZero >> 1

-

-	isP |= isP >> 16

-	isP |= isP >> 8

-	isP |= isP >> 4

-	isP |= isP >> 2

-	isP |= isP >> 1

-

-	// For isZero and isP, the LSB is 0 iff all the bits are zero.

-	result := isZero & isP

-	result = (^result) & 1

-

-	return result

-}

-

-// p224Add computes *out = a+b

-//

-// a[i] + b[i] < 2**32

-func p224Add(out, a, b *p224FieldElement) {

-	for i := 0; i < 8; i++ {

-		out[i] = a[i] + b[i]

-	}

-}

-

-const two31p3 = 1<<31 + 1<<3

-const two31m3 = 1<<31 - 1<<3

-const two31m15m3 = 1<<31 - 1<<15 - 1<<3

-

-// p224ZeroModP31 is 0 mod p where bit 31 is set in all limbs so that we can

-// subtract smaller amounts without underflow. See the section "Subtraction" in

-// [1] for reasoning.

-var p224ZeroModP31 = []uint32{two31p3, two31m3, two31m3, two31m15m3, two31m3, two31m3, two31m3, two31m3}

-

-// p224Sub computes *out = a-b

-//

-// a[i], b[i] < 2**30

-// out[i] < 2**32

-func p224Sub(out, a, b *p224FieldElement) {

-	for i := 0; i < 8; i++ {

-		out[i] = a[i] + p224ZeroModP31[i] - b[i]

-	}

-}

-

-// LargeFieldElement also represents an element of the field. The limbs are

-// still spaced 28-bits apart and in little-endian order. So the limbs are at

-// 0, 28, 56, ..., 392 bits, each 64-bits wide.

-type p224LargeFieldElement [15]uint64

-

-const two63p35 = 1<<63 + 1<<35

-const two63m35 = 1<<63 - 1<<35

-const two63m35m19 = 1<<63 - 1<<35 - 1<<19

-

-// p224ZeroModP63 is 0 mod p where bit 63 is set in all limbs. See the section

-// "Subtraction" in [1] for why.

-var p224ZeroModP63 = [8]uint64{two63p35, two63m35, two63m35, two63m35, two63m35m19, two63m35, two63m35, two63m35}

-

-const bottom12Bits = 0xfff

-const bottom28Bits = 0xfffffff

-

-// p224Mul computes *out = a*b

-//

-// a[i] < 2**29, b[i] < 2**30 (or vice versa)

-// out[i] < 2**29

-func p224Mul(out, a, b *p224FieldElement, tmp *p224LargeFieldElement) {

-	for i := 0; i < 15; i++ {

-		tmp[i] = 0

-	}

-

-	for i := 0; i < 8; i++ {

-		for j := 0; j < 8; j++ {

-			tmp[i+j] += uint64(a[i]) * uint64(b[j])

-		}

-	}

-

-	p224ReduceLarge(out, tmp)

-}

-

-// Square computes *out = a*a

-//

-// a[i] < 2**29

-// out[i] < 2**29

-func p224Square(out, a *p224FieldElement, tmp *p224LargeFieldElement) {

-	for i := 0; i < 15; i++ {

-		tmp[i] = 0

-	}

-

-	for i := 0; i < 8; i++ {

-		for j := 0; j <= i; j++ {

-			r := uint64(a[i]) * uint64(a[j])

-			if i == j {

-				tmp[i+j] += r

-			} else {

-				tmp[i+j] += r << 1

-			}

-		}

-	}

-

-	p224ReduceLarge(out, tmp)

-}

-

-// ReduceLarge converts a p224LargeFieldElement to a p224FieldElement.

-//

-// in[i] < 2**62

-func p224ReduceLarge(out *p224FieldElement, in *p224LargeFieldElement) {

-	for i := 0; i < 8; i++ {

-		in[i] += p224ZeroModP63[i]

-	}

-

-	// Eliminate the coefficients at 2**224 and greater.

-	for i := 14; i >= 8; i-- {

-		in[i-8] -= in[i]

-		in[i-5] += (in[i] & 0xffff) << 12

-		in[i-4] += in[i] >> 16

-	}

-	in[8] = 0

-	// in[0..8] < 2**64

-

-	// As the values become small enough, we start to store them in |out|

-	// and use 32-bit operations.

-	for i := 1; i < 8; i++ {

-		in[i+1] += in[i] >> 28

-		out[i] = uint32(in[i] & bottom28Bits)

-	}

-	in[0] -= in[8]

-	out[3] += uint32(in[8]&0xffff) << 12

-	out[4] += uint32(in[8] >> 16)

-	// in[0] < 2**64

-	// out[3] < 2**29

-	// out[4] < 2**29

-	// out[1,2,5..7] < 2**28

-

-	out[0] = uint32(in[0] & bottom28Bits)

-	out[1] += uint32((in[0] >> 28) & bottom28Bits)

-	out[2] += uint32(in[0] >> 56)

-	// out[0] < 2**28

-	// out[1..4] < 2**29

-	// out[5..7] < 2**28

-}

-

-// Reduce reduces the coefficients of a to smaller bounds.

-//

-// On entry: a[i] < 2**31 + 2**30

-// On exit: a[i] < 2**29

-func p224Reduce(a *p224FieldElement) {

-	for i := 0; i < 7; i++ {

-		a[i+1] += a[i] >> 28

-		a[i] &= bottom28Bits

-	}

-	top := a[7] >> 28

-	a[7] &= bottom28Bits

-

-	// top < 2**4

-	mask := top

-	mask |= mask >> 2

-	mask |= mask >> 1

-	mask <<= 31

-	mask = uint32(int32(mask) >> 31)

-	// Mask is all ones if top != 0, all zero otherwise

-

-	a[0] -= top

-	a[3] += top << 12

-

-	// We may have just made a[0] negative but, if we did, then we must

-	// have added something to a[3], this it's > 2**12. Therefore we can

-	// carry down to a[0].

-	a[3] -= 1 & mask

-	a[2] += mask & (1<<28 - 1)

-	a[1] += mask & (1<<28 - 1)

-	a[0] += mask & (1 << 28)

-}

-

-// p224Invert calculates *out = in**-1 by computing in**(2**224 - 2**96 - 1),

-// i.e. Fermat's little theorem.

-func p224Invert(out, in *p224FieldElement) {

-	var f1, f2, f3, f4 p224FieldElement

-	var c p224LargeFieldElement

-

-	p224Square(&f1, in, &c)    // 2

-	p224Mul(&f1, &f1, in, &c)  // 2**2 - 1

-	p224Square(&f1, &f1, &c)   // 2**3 - 2

-	p224Mul(&f1, &f1, in, &c)  // 2**3 - 1

-	p224Square(&f2, &f1, &c)   // 2**4 - 2

-	p224Square(&f2, &f2, &c)   // 2**5 - 4

-	p224Square(&f2, &f2, &c)   // 2**6 - 8

-	p224Mul(&f1, &f1, &f2, &c) // 2**6 - 1

-	p224Square(&f2, &f1, &c)   // 2**7 - 2

-	for i := 0; i < 5; i++ {   // 2**12 - 2**6

-		p224Square(&f2, &f2, &c)

-	}

-	p224Mul(&f2, &f2, &f1, &c) // 2**12 - 1

-	p224Square(&f3, &f2, &c)   // 2**13 - 2

-	for i := 0; i < 11; i++ {  // 2**24 - 2**12

-		p224Square(&f3, &f3, &c)

-	}

-	p224Mul(&f2, &f3, &f2, &c) // 2**24 - 1

-	p224Square(&f3, &f2, &c)   // 2**25 - 2

-	for i := 0; i < 23; i++ {  // 2**48 - 2**24

-		p224Square(&f3, &f3, &c)

-	}

-	p224Mul(&f3, &f3, &f2, &c) // 2**48 - 1

-	p224Square(&f4, &f3, &c)   // 2**49 - 2

-	for i := 0; i < 47; i++ {  // 2**96 - 2**48

-		p224Square(&f4, &f4, &c)

-	}

-	p224Mul(&f3, &f3, &f4, &c) // 2**96 - 1

-	p224Square(&f4, &f3, &c)   // 2**97 - 2

-	for i := 0; i < 23; i++ {  // 2**120 - 2**24

-		p224Square(&f4, &f4, &c)

-	}

-	p224Mul(&f2, &f4, &f2, &c) // 2**120 - 1

-	for i := 0; i < 6; i++ {   // 2**126 - 2**6

-		p224Square(&f2, &f2, &c)

-	}

-	p224Mul(&f1, &f1, &f2, &c) // 2**126 - 1

-	p224Square(&f1, &f1, &c)   // 2**127 - 2

-	p224Mul(&f1, &f1, in, &c)  // 2**127 - 1

-	for i := 0; i < 97; i++ {  // 2**224 - 2**97

-		p224Square(&f1, &f1, &c)

-	}

-	p224Mul(out, &f1, &f3, &c) // 2**224 - 2**96 - 1

-}

-

-// p224Contract converts a FieldElement to its unique, minimal form.

-//

-// On entry, in[i] < 2**29

-// On exit, in[i] < 2**28

-func p224Contract(out, in *p224FieldElement) {

-	copy(out[:], in[:])

-

-	for i := 0; i < 7; i++ {

-		out[i+1] += out[i] >> 28

-		out[i] &= bottom28Bits

-	}

-	top := out[7] >> 28

-	out[7] &= bottom28Bits

-

-	out[0] -= top

-	out[3] += top << 12

-

-	// We may just have made out[i] negative. So we carry down. If we made

-	// out[0] negative then we know that out[3] is sufficiently positive

-	// because we just added to it.

-	for i := 0; i < 3; i++ {

-		mask := uint32(int32(out[i]) >> 31)

-		out[i] += (1 << 28) & mask

-		out[i+1] -= 1 & mask

-	}

-

-	// We might have pushed out[3] over 2**28 so we perform another, partial,

-	// carry chain.

-	for i := 3; i < 7; i++ {

-		out[i+1] += out[i] >> 28

-		out[i] &= bottom28Bits

-	}

-	top = out[7] >> 28

-	out[7] &= bottom28Bits

-

-	// Eliminate top while maintaining the same value mod p.

-	out[0] -= top

-	out[3] += top << 12

-

-	// There are two cases to consider for out[3]:

-	//   1) The first time that we eliminated top, we didn't push out[3] over

-	//      2**28. In this case, the partial carry chain didn't change any values

-	//      and top is zero.

-	//   2) We did push out[3] over 2**28 the first time that we eliminated top.

-	//      The first value of top was in [0..16), therefore, prior to eliminating

-	//      the first top, 0xfff1000 <= out[3] <= 0xfffffff. Therefore, after

-	//      overflowing and being reduced by the second carry chain, out[3] <=

-	//      0xf000. Thus it cannot have overflowed when we eliminated top for the