One reason this cannot be translated into a portable C version while retaining its compactness (and readability) is the lack of support for carry/borrow chains.<p>In Go, bits.Add64 takes as input and returns the carry.<p>In C, there are some constructs that modern compilers will recognize as patterns people use to extract the carry, but it is a hit-and-miss.<p>Even compiler-specific intrinsics are a few and far between, inefficient or even broken.
Great write-up, I haven't dug into understanding the whole code yet, but perhaps someone can answer this for me: can the code be made even simpler using Go's bignum: big.Int?
I find a lot of go libraries are very well commented and very accessible, but the standard library and especially the crypto stuff is very sparsely commented.