sbb static method

(Uint64, Uint64) sbb(
  1. Uint64 a,
  2. Uint64 b,
  3. Uint64 borrowIn
)

Subtract-with-borrow: a - b - borrowBit, where the borrow bit is derived from borrowIn (zero = no borrow; any nonzero = borrow — matches the all-ones-mask convention constant-time field code uses). Returns (result, borrowOutMask), where borrowOutMask is Uint64.zero or Uint64.max — ready to & directly against a modulus limb for a conditional add-back.

Implementation

static (Uint64 result, Uint64 borrowOutMask) sbb(
  Uint64 a,
  Uint64 b,
  Uint64 borrowIn,
) {
  final bit = borrowIn.isZero ? Uint64.zero : Uint64.one;
  final s1 = a - b;
  final bw1 = a < b ? Uint64.one : Uint64.zero;
  final s2 = s1 - bit;
  final bw2 = s1 < bit ? Uint64.one : Uint64.zero;
  final totalBorrow = bw1 + bw2;
  final outMask = totalBorrow.isZero ? Uint64.zero : Uint64.max;
  return (s2, outMask);
}