tests, to ensure that all rejection // paths are covered. If not nil, it is called with a string describing the // reason for rejection: "z", "r0", "ct0", or "h". var testingOnlyRejection func(reason string) // w1Encode implements w1Encode from FIPS 204, writing directly into H. func w1Encode(H *sha3.SHAKE, w [n]byte, p parameters) { switch p.γ2 { case 32: // Coefficients are <= (q − 1)/(2γ2) − 1 = 15, four bits each. buf := make([]byte, 4*n/8) for i := 0; i < n; i += 2 { b0 := w[i] b1 := w[i+1] buf[i/2]...