# single-tap: 2^127 - 1 # "kummer strikes back" 2^129 - 25 2^130 - 5 # poly1305 2^137 - 13 2^140 - 27 2^141 - 9 2^150 - 5 2^150 - 3 2^152 - 17 2^158 - 15 2^165 - 25 2^166 - 5 2^171 - 19 2^174 - 17 2^174 - 3 2^189 - 25 2^190 - 11 2^191 - 19 2^194 - 33 2^196 - 15 2^198 - 17 2^206 - 5 2^212 - 29 2^213 - 3 2^221 - 3 2^222 - 117 2^226 - 5 2^230 - 27 2^235 - 15 2^243 - 9 2^251 - 9 2^255 - 765 2^255 - 19 # curve25519 2^256 - 189 2^266 - 3 2^285 - 9 2^291 - 19 2^321 - 9 2^336 - 17 2^336 - 3 2^338 - 15 2^369 - 25 2^379 - 19 2^382 - 105 2^383 - 421 2^383 - 187 2^383 - 31 2^384 - 317 2^389 - 21 2^401 - 31 2^413 - 21 2^414 - 17 2^444 - 17 2^452 - 3 2^468 - 17 2^488 - 17 2^489 - 21 2^495 - 31 2^511 - 481 2^511 - 187 2^512 - 569 2^521 - 1 # p512 # two taps, golden ratio: 2^192 - 2^64 - 1 2^216 - 2^108 - 1 2^322 - 2^161 - 1 2^416 - 2^208 - 1 2^448 - 2^224 - 1 # goldilocks 2^450 - 2^225 - 1 2^480 - 2^240 - 1 # ridinghood # two ore more taps 2^205 - 45*2^198 - 1 2^224 - 2^96 + 1 # p224 2^256 - 2^224 + 2^192 + 2^96 - 1 # p256 2^256 - 2^32 - 977 # bitcoin 2^256 - 4294968273 # bitcoin, for 64-bit impl 2^384 - 2^128 - 2^96 + 2^32 - 1 # p384 # Montgomery-Friendly 2^256 - 88*2^240 - 1 2^254 - 127*2^240 - 1 2^384 - 79*2^376 - 1 2^384 - 5*2^368 - 1 2^512 - 491*2^496 - 1 2^510 - 290*2^496 - 1