for i := range e1 { e1[i] = samplePolyCBD(rnd, N) N++ } e2 := samplePolyCBD(rnd, N) u := make([]ringElement, k1024) // NTT⁻¹(AT ◦ r) + e1 for i := range u { var uHat nttElement for j := range r { // Note that i and j are inverted, as we need the transposed of A. uHat = polyAdd(uHat, nttMul(ex.a[j*k1024+i], r[j])) } u[i] = polyAdd(e1[i], inverseNTT(uHat)) } μ := ringDecodeAndDecompr(m) var vNTT nttElement // t⊺ ◦ r for i := range ex.t { vNTT = polyAdd(vNTT, nttMul(ex.t[i], r[i])) } v := polyAdd(po...