为什么在curve25519.c中的openssl的fe_frombytes函数像这样？

如何解决为什么在curve25519.c中的openssl的fe_frombytes函数像这样？

static void fe_frombytes(fe h,const uint8_t *s)
{
    /* Ignores top bit of h. */
    int64_t h0 =  load_4(s);
    int64_t h1 =  load_3(s +  4) << 6;  
    int64_t h2 =  load_3(s +  7) << 5;
    int64_t h3 =  load_3(s + 10) << 3;
    int64_t h4 =  load_3(s + 13) << 2;
    int64_t h5 =  load_4(s + 16);
    int64_t h6 =  load_3(s + 20) << 7;
    int64_t h7 =  load_3(s + 23) << 5;
    int64_t h8 =  load_3(s + 26) << 4;
    int64_t h9 = (load_3(s + 29) & 0x7fffff) << 2;
    int64_t carry0;
    int64_t carry1;
    int64_t carry2;
    int64_t carry3;
    int64_t carry4;
    int64_t carry5;
    int64_t carry6;
    int64_t carry7;
    int64_t carry8;
    int64_t carry9;

    carry9 = h9 + (1 << 24); h0 += (carry9 >> 25) * 19; h9 -= carry9 & kTop39Bits;
    carry1 = h1 + (1 << 24); h2 += carry1 >> 25; h1 -= carry1 & kTop39Bits;
    carry3 = h3 + (1 << 24); h4 += carry3 >> 25; h3 -= carry3 & kTop39Bits;
    carry5 = h5 + (1 << 24); h6 += carry5 >> 25; h5 -= carry5 & kTop39Bits;
    carry7 = h7 + (1 << 24); h8 += carry7 >> 25; h7 -= carry7 & kTop39Bits;

    carry0 = h0 + (1 << 25); h1 += carry0 >> 26; h0 -= carry0 & kTop38Bits;
    carry2 = h2 + (1 << 25); h3 += carry2 >> 26; h2 -= carry2 & kTop38Bits;
    carry4 = h4 + (1 << 25); h5 += carry4 >> 26; h4 -= carry4 & kTop38Bits;
    carry6 = h6 + (1 << 25); h7 += carry6 >> 26; h6 -= carry6 & kTop38Bits;
    carry8 = h8 + (1 << 25); h9 += carry8 >> 26; h8 -= carry8 & kTop38Bits;

    h[0] = (int32_t)h0;
    h[1] = (int32_t)h1;
    h[2] = (int32_t)h2;
    h[3] = (int32_t)h3;
    h[4] = (int32_t)h4;
    h[5] = (int32_t)h5;
    h[6] = (int32_t)h6;
    h[7] = (int32_t)h7;
    h[8] = (int32_t)h8;
    h[9] = (int32_t)h9;
}

这是openssl的curve25519.c中的代码 基数为2 ^ r的表示形式，r = 25.5，请参见“ Sandy2x：New Curve25519速度记录” 我的问题： 为什么