rejected ch values, as well as which // check causes the rejection and which coefficient failed the check // (but not the value or sign of the coefficient). y := make([]ringElement, l, maxL) for r := range y { counter := make([]byte, 2) byteorder.LEPutUint16(counter, uint16(κ)) κ++ H.Reset() H.Write(nonce) H.Write(counter) v := make([]byte, (p.γ1+1)*n/8, (maxγ1+1)*n/8) H.Read(v) y[r] = bitUnpack(v, p) } // w = NTT⁻¹(Â ∘ NTT(y)) yHat := make([]nttElement, l, maxL) for i := range y { yHat[i] = ntt(y[i])...