fieldSub(f[start+1], t) f[start+1] = fieldAdd(f[start+1], t) t = fieldMontgomeryMul(zeta, f[start+6]) f[start+6] = fieldSub(f[start+2], t) f[start+2] = fieldAdd(f[start+2], t) t = fieldMontgomeryMul(zeta, f[start+7]) f[start+7] = fieldSub(f[start+3], t) f[start+3] = fieldAdd(f[start+3], t) } for start := 0; start < 256; start += 4 { m++ zeta := zetas[m] t := fieldMontgomeryMul(zeta, f[start+2]) f[start+2] = fieldSub(f[start], t) f[start] = fieldAdd(f[start], t) t = fieldMontgomeryMul(zeta, f[start+3]) f[start+3]...

return fieldElement(a), nil } // fieldReduceOnce reduces a value a < 2q. func fieldReduceOnce(a uint16) fieldElement { x := a - q // If x underflowed, then x >= 2¹⁶ - q > 2¹⁵, so the top bit is set. x += (x >> 15) * q return fieldElement(x) } func fieldAdd(a, b fieldElement) fieldElement { x := uint16(a + b) return fieldReduceOnce(x) } func fieldSub(a, b fieldElement) fieldElement { x := uint16(a - b + q) return fieldReduceOnce(x) } const ( barrettMultiplier = 5039 // 2¹² * 2¹² / q barrettShift = 24...