power2Round(t[i][j]) } t0[i] = ntt(w) } // The computations below (and their storage in the PrivateKey struct) are // not strictly necessary and could be deferred to PrivateKey.PublicKey(). // That would require keeping or re-deriving ρ and t/t1, though. pk := pkEncode(priv.pub.raw[:0], ρ, t1, p) priv.pub.tr = computePublicKeyHash(pk) computeT1Hat(priv.pub.t1[:k], t1) // NTT(t₁ ⋅ 2ᵈ) return priv } func computeMatrixA(A []nttElement, ρ []byte, p parameters) { k, l := p.k, p.l for r := range k { for s := range l...