l { wHat = polyAdd(wHat, nttMul(A[i*l+j], yHat[j])) } w[i] = inverseNTT(wHat) } H.Reset() H.Write(μ[:]) for i := range w { w1Encode(H, highBits(w[i], p), p) } ch := make([]byte, p.λ/4, maxλ/4) H.Read(ch) // sampleInBall is not constant time, but see comment above about // leaking rejected ch values being acceptable. c := ntt(sampleInBall(ch, p)) cs1 := make([]ringElement, l, maxL) for i := range cs1 { cs1[i] = inverseNTT(nttMul(c, s1[i])) } cs2 := make([]ringElement, k, maxK) for i := range cs2 {...

XORL CX, BX; \ XORL DX, BX; \ ADDL ((index-16)*4)(BP), BX; \ ADDL BX, AX; \ MOVL AX, ((index)*4)(BP) // Calculate T1 in AX - uses AX, BX, CX and DX registers. // Wt is passed in AX. // T1 = h + BIGSIGMA1(e) + Ch(e, f, g) + Kt + Wt // BIGSIGMA1(x) = ROTR(6,x) XOR ROTR(11,x) XOR ROTR(25,x) // Ch(x, y, z) = (x AND y) XOR (NOT x AND z) #define SHA256T1(const, e, f, g, h) \ MOVL (h*4)(DI), BX; \ ADDL AX, BX; \ MOVL (e*4)(DI), AX; \ ADDL $const, BX; \ MOVL (e*4)(DI), CX; \ RORL $6, AX; \ MOVL (e*4)(DI),...