return s } // polySub subtracts two ringElements or nttElements. func polySub[T ~[n]fieldElement](a, b T) (s T) { for i := range s { s[i] = fieldSub(a[i], b[i]) } return s } // polyByteEncode appends the 384-byte encoding of f to b. // // It implements ByteEncode₁₂, according to FIPS 203, Algorithm 5. func polyByteEncode[T ~[n]fieldElement](b []byte, f T) []byte { out, B := sliceForAppend(b, encodingSize12) for i := 0; i < n; i += 2 { x := uint32(f[i]) | uint32(f[i+1])<<12 B[0] = uint8(x) B[1] =...