by the same Resolution. It // compares the results with hashes instead of values, to avoid embedding several // kilobytes of test vectors in every binary, as allowed by GeneralNote7. func fips140CAST() error { // From https://pages.nist.gov/ACVP/draft-celi-acvp-ml-dsa.html#table-1. var seed = &[32]byte{ 0x5c, 0x62, 0x4f, 0xcc, 0x18, 0x62, 0x45, 0x24, 0x52, 0xd0, 0xc6, 0x65, 0x84, 0x0d, 0x82, 0x37, 0xf4, 0x31, 0x08, 0xe5, 0x49, 0x9e, 0xdc, 0xdc, 0x10, 0x8f, 0xbc, 0x49, 0xd5, 0x96, 0xe4, 0xb7, } var...

coefficient of x¹²⁷ can be obtained by v.high & 1. type gcmFieldElement struct { low, high uint64 } // GHASH is exposed to allow crypto/cipher to implement non-AES GCM modes. // It is not allowed as a stand-alone operation in FIPS mode because it // is not ACVP tested. func GHASH(key *[16]byte, inputs ...[]byte) []byte { fips140.RecordNonApproved() var out [gcmBlockSize]byte ghash(&out, key, inputs...) return out[:] } // ghash is a variable-time generic implementation of GHASH, which shouldn't // be used...