f[start+5]) f[start+5] = fieldSub(f[start+1], t) f[start+1] = fieldAdd(f[start+1], t) t = fieldMontgomeryMul(zeta, f[start+6]) f[start+6] = fieldSub(f[start+2], t) f[start+2] = fieldAdd(f[start+2], t) t = fieldMontgomeryMul(zeta, f[start+7]) f[start+7] = fieldSub(f[start+3], t) f[start+3] = fieldAdd(f[start+3], t) } for start := 0; start < 256; start += 4 { m++ zeta := zetas[m] t := fieldMontgomeryMul(zeta, f[start+2]) f[start+2] = fieldSub(f[start], t) f[start] = fieldAdd(f[start], t) t = fieldMontgomeryMul(zeta,...

for len := 128; len >= 2; len /= 2 { for start := 0; start < 256; start += 2 * len { zeta := zetas[k] k++ // Bounds check elimination hint. f, flen := f[start:start+len], f[start+len:start+len+len] for j := 0; j < len; j++ { t := fieldMul(zeta, flen[j]) flen[j] = fieldSub(f[j], t) f[j] = fieldAdd(f[j], t) } } } return nttElement(f) } // inverseNTT maps a nttElement back to the ringElement it represents. // // It implements NTT⁻¹, according to FIPS 203, Algorithm 10. func inverseNTT(f nttElement) ringElement...