b)) if bitlen <= 0 || bitlen > 16 { panic("mldsa: internal error: invalid bitlen") } out, v := sliceForAppend(buf, n*bitlen/8) var acc uint32 var accBits uint for i := range r { w := int32(b) - fieldCenteredMod(r[i]) acc |= uint32(w) << accBits accBits += uint(bitlen) for accBits >= 8 { v[0] = byte(acc) v = v[1:] acc >>= 8 accBits -= 8 } } if accBits > 0 { v[0] = byte(acc) } return out } func bitUnpackSlow(v []byte, a, b int) (ringElement, error) { bitlen := bits.Len(uint(a + b)) if bitlen <= 0 || bitlen...

not the identity element, and returns the // x-coordinate of the result, performing Steps 2-5 of Section 5.7.1.2. return p.BytesX() } // isZero reports whether x is all zeroes in constant time. func isZero(x []byte) bool { var acc byte for _, b := range x { acc |= b } return acc == 0 } // isLess reports whether a < b, where a and b are big-endian buffers of the // same length and shorter than 72 bytes. func isLess(a, b []byte) bool { if len(a) != len(b) { panic("crypto/ecdh: internal error: mismatched...