nx_p384_field_mul_fast.nx

nx_p384_field_mul_fast.nx -- fast P-384 field multiply (mod p) via the prime's own complement, replacing the 385-iteration bit-by-bit reduction in nx_p384_field_mul.nx (the measured ~640ms-per-ECDSA-verify bottleneck). P-384 prime: p = 2^384 - 2^128 - 2^96 + 2^32 - 1, so 2^384 == 2^128 + 2^96 - 2^32 + 1 (mod p). For a 768-bit product C = Hi*2^384 + Lo, C == Lo + Hi*(2^128 + 2^96 - 2^32 + 1) (mod p). All multipliers are word-aligned (128/96/32 are multiples of the 32-bit limb), so the fold is just shifted adds/subs (offsets 4/3/1/0). Two folds bring a 768-bit product below ~2p; a short final reduce finishes it. Normal domain in/out -> true drop-in for p384_field_mul (no Montgomery conversions). Correctness is pinned by KAT equality vs the bit-by-bit p384_field_mul in nx_p384_field_mul_fast_gate.nx (same a*b mod p for random a,b). license_tier: INDEPENDENT_REDERIVE genealogy_id: international-research-sources/nist/fips_186_5 (P-384 generalized-Mersenne) lineage_id: nishi_p384_field_mul_fast_q10