append(sk, priv.pub.raw[:32]...) // ρ sk = append(sk, priv.k[:]...) // K sk = append(sk, priv.pub.tr[:]...) // tr for i := range l { sk = bitPackSlow(sk, inverseNTT(priv.s1[i]), η, η) } for i := range k { sk = bitPackSlow(sk, inverseNTT(priv.s2[i]), η, η) } const bound = 1 << (13 - 1) // 2^(d-1) for i := range k { sk = bitPackSlow(sk, inverseNTT(priv.t0[i]), bound-1, bound) } return sk } func skDecode(sk []byte, p parameters) (ρ, K [32]byte, tr [64]byte, s1, s2, t0 []ringElement, err error) { k, l,...

f[start:start+len], f[start+len:start+len+len] for j := 0; j < len; j++ { t := fieldMul(zeta, flen[j]) flen[j] = fieldSub(f[j], t) f[j] = fieldAdd(f[j], t) } } } return nttElement(f) } // inverseNTT maps a nttElement back to the ringElement it represents. // // It implements NTT⁻¹, according to FIPS 203, Algorithm 10. func inverseNTT(f nttElement) ringElement { k := 127 for len := 2; len <= 128; len *= 2 { for start := 0; start < 256; start += 2 * len { zeta := zetas[k] k-- // Bounds check elimination hint....