ringElements or nttElements. func polySub[T ~[n]fieldElement](a, b T) (s T) { for i := range s { s[i] = fieldSub(a[i], b[i]) } return s } // nttElement is an NTT representation, an element of T_q. type nttElement [n]fieldElement // zetas are the values ζ^BitRev₈(k) mod q for each index k, converted to the // Montgomery domain. var zetas = [256]fieldElement{4193792, 25847, 5771523, 7861508, 237124, 7602457, 7504169, 466468, 1826347, 2353451, 8021166, 6288512, 3119733, 5495562, 3111497, 2680103, 2725464, 1024112,...

func (d *Digest) Clone() *Digest { ret := *d return &ret } // permute applies the KeccakF-1600 permutation. func (d *Digest) permute() { keccakF1600(&d.a) d.n = 0 } // padAndPermute appends the domain separation bits in dsbyte, applies // the multi-bitrate 10..1 padding rule, and permutes the state. func (d *Digest) padAndPermute() { // Pad with this instance's domain-separator bits. We know that there's // at least one byte of space in the sponge because, if it were full, // permute would have been...