:= highBits88(fieldFromMontgomery(fieldAdd(rPlusZ, ct0))) return byte(constanttime.ByteEq(v1, r1) ^ 1) } // bitPack implements BitPack(r mod± q, γ₁-1, γ₁), which packs the centered // coefficients of r into little-endian γ1+1-bit chunks. It appends to buf. // // It must only be applied to r with coefficients in [−γ₁+1, γ₁], as // guaranteed by the rejection conditions in Sign. func bitPack(b []byte, r ringElement, p parameters) []byte { switch p.γ1 { case 17: return bitPack18(b, r) case 19: return...