internal error: unsupported γ2") } return h, count1s } // highBits32 implements HighBits from FIPS 204 for γ2 = (q - 1) / 32. func highBits32(x uint32) byte { // The implementation is based on the reference implementation and on // BoringSSL. There are exhaustive tests in TestDecompose that compare it to // a straightforward implementation of Decompose from the spec, so for our // purposes it only has to work and be constant-time. r1 := (x + 127) >> 7 r1 = (r1*1025 + (1 << 21)) >> 22 r1 &= 0b1111 return...