constant time, but see comment above about // leaking rejected ch values being acceptable. c := ntt(sampleInBall(ch, p)) cs1 := make([]ringElement, l, maxL) for i := range cs1 { cs1[i] = inverseNTT(nttMul(c, s1[i])) } cs2 := make([]ringElement, k, maxK) for i := range cs2 { cs2[i] = inverseNTT(nttMul(c, s2[i])) } z := make([]ringElement, l, maxL) for i := range y { z[i] = polyAdd(y[i], cs1[i]) // Reject if ||z||∞ ≥ γ1 − β if coefficientsExceedBo(z[i], γ1β) { if testingOnlyRejection != nil { testingOnlyRejection("z")...