p.η γ1 := uint32(1 << p.γ1) γ1β := γ1 - uint32(β) z := make([]ringElement, l, maxL) h := make([][n]byte, k, maxK) ch, err := sigDecode(sig, z, h, p) if err != nil { return err } c := ntt(sampleInBall(ch, p)) // w = Â ∘ NTT(z) − NTT(c) ∘ NTT(t₁ ⋅ 2ᵈ) zHat := make([]nttElement, l, maxL) for i := range zHat { zHat[i] = ntt(z[i]) } w := make([]ringElement, k, maxK) for i := range w { var wHat nttElement for j := range l { wHat = polyAdd(wHat, nttMul(A[i*l+j], zHat[j])) } wHat = polySub(wHat, nttMul(c,...

1584, 2298, 2037, 3220, 375, 2549, 2090, 1645, 1063, 319, 2773, 757, 2099, 561, 2466, 2594, 2804, 1092, 403, 1026, 1143, 2150, 2775, 886, 1722, 1212, 1874, 1029, 2110, 2935, 885, 2154} // ntt maps a ringElement to its nttElement representation. // // It implements NTT, according to FIPS 203, Algorithm 9. func ntt(f ringElement) nttElement { k := 1 for len := 128; len >= 2; len /= 2 { for start := 0; start < 256; start += 2 * len { zeta := zetas[k] k++ // Bounds check elimination hint. f, flen := f[start:start+len],...