pub fn canonical255(lo: [b85; 3], hi: b3) -> [b17; 15]Expand description
Canonical value of lo + hi * 2^255 for lo + 19 * hi < 2p.
w1 = lo + 19 hi and w2 = w1 + 19 are formed in parallel; when w2
reaches 2^255, w1 >= p and the answer is w2 - 2^255 = w1 - p.
Combinational. hi is the overflow above bit 255 (3 bits wide, callers
pass 0 or 1). Computing both candidates at once avoids a compare before
the subtraction.