k, l, η := priv.pub.p.k, priv.pub.p.l, priv.pub.p.η sk := make([]byte, 0, semiExpandedPrivKeyS(priv.pub.p)) sk = append(sk, priv.pub.raw[:32]...) // ρ sk = append(sk, priv.k[:]...) // K sk = append(sk, priv.pub.tr[:]...) // tr for i := range l { sk = bitPackSlow(sk, inverseNTT(priv.s1[i]), η, η) } for i := range k { sk = bitPackSlow(sk, inverseNTT(priv.s2[i]), η, η) } const bound = 1 << (13 - 1) // 2^(d-1) for i := range k { sk = bitPackSlow(sk, inverseNTT(priv.t0[i]), bound-1, bound) } return sk...