bitUnpackSlow(v []byte, a, b int) (ringElement, error) { bitlen := bits.Len(uint(a + b)) if bitlen <= 0 || bitlen > 16 { panic("mldsa: internal error: invalid bitlen") } if len(v) != n*bitlen/8 { return ringElement{}, errors.New("mldsa: invalid input length for bitUnpackSlow") } mask := uint32((1 << bitlen) - 1) maxValue := uint32(a + b) var r ringElement var acc uint32 var accBits uint vIdx := 0 for i := range r { for accBits < uint(bitlen) { if vIdx < len(v) { acc |= uint32(v[vIdx]) << accBits vIdx++...

checks in the loop. size := len(x.limbs) xLimbs := x.limbs[:size] for i := size - 1; i >= 0; i-- { if xLimbs[i] != 0 { return i*_W + bitLen(xLimbs[i]) } } return 0 } // bitLen is a version of bits.Len that only leaks the bit length of n, but not // its value. bits.Len and bits.LeadingZeros use a lookup table for the // low-order bits on some architectures. func bitLen(n uint) int { len := 0 // We assume, here and elsewhere, that comparison to zero is constant time // with respect to different non-zero...