p.η γ1 := uint32(1 << p.γ1) γ1β := γ1 - uint32(β) z := make([]ringElement, l, maxL) h := make([][n]byte, k, maxK) ch, err := sigDecode(sig, z, h, p) if err != nil { return err } c := ntt(sampleInBall(ch, p)) // w = Â ∘ NTT(z) − NTT(c) ∘ NTT(t₁ ⋅ 2ᵈ) zHat := make([]nttElement, l, maxL) for i := range zHat { zHat[i] = ntt(z[i]) } w := make([]ringElement, k, maxK) for i := range w { var wHat nttElement for j := range l { wHat = polyAdd(wHat, nttMul(A[i*l+j], zHat[j])) } wHat = polySub(wHat, nttMul(c,...