SecP256K1Field.square(Y1.x, Y1Squared);
SecP256K1Field.square(Y1Squared, T);
SecP256K1Field.square(X1.x, M);
c = Nat256.addBothTo(M, M, M);
SecP256K1Field.reduce32(c, M);
SecP256K1Field.square(M, X3.x);
SecP256K1Field.subtract(X3.x, S, X3.x);
SecP256K1Field.subtract(X3.x, S, X3.x);