FIPS 204 for γ2 = (q - 1) / 32. func makeHint32(ct0, w, cs2 fieldElement) byte { // v1 = HighBits(r + z) = HighBits(w - cs2 + ct0 - ct0) = HighBits(w - cs2) rPlusZ := fieldSub(w, cs2) v1 := highBits32(fieldFromMontgomery(rPlusZ)) // r1 = HighBits(r) = HighBits(w - cs2 + ct0) r1 := highBits32(fieldFromMontgomery(fieldAdd(rPlusZ, ct0))) return byte(constanttime.ByteEq(v1, r1) ^ 1) } // highBits88 implements HighBits from FIPS 204 for γ2 = (q - 1) / 88. func highBits88(x uint32) byte { // Like highBits32,...