crypto_ct_lt_mask
mask = crypto_ct_lt_mask(j, bn->top);
if (mask != crypto_ct_lt_mask(a, b)) {
(unsigned long long)crypto_ct_lt_mask(a, b),