k, maxK) ch, err := sigDecode(sig, z, h, p) if err != nil { return err } c := ntt(sampleInBall(ch, p)) // w = Â ∘ NTT(z) − NTT(c) ∘ NTT(t₁ ⋅ 2ᵈ) zHat := make([]nttElement, l, maxL) for i := range zHat { zHat[i] = ntt(z[i]) } w := make([]ringElement, k, maxK) for i := range w { var wHat nttElement for j := range l { wHat = polyAdd(wHat, nttMul(A[i*l+j], zHat[j])) } wHat = polySub(wHat, nttMul(c, t1[i])) w[i] = inverseNTT(wHat) } // Use hints h to compute w₁ from w(approx). w1 := make([][n]byte, k, maxK)...