*[encodingSize11]byte) ringElement { return ringDecodeAndDecompr(bb[:], 11) } // samplePolyCBD draws a ringElement from the special Dη distribution given a // stream of random bytes generated by the PRF function, according to FIPS 203, // Algorithm 8 and Definition 4.3. func samplePolyCBD(s []byte, b byte) ringElement { prf := sha3.NewShake256() prf.Write(s) prf.Write([]byte{b}) B := make([]byte, 64*2) // η = 2 prf.Read(B) // SamplePolyCBD simply draws four (2η) bits for each coefficient, and adds // the first...