uint32(v[6])>>6 | uint32(v[7])<<2 | uint32(v[8])<<10 r[i+3] = fieldSubToMontgomery(b, w3&mask18) v = v[4*18/8:] } return r } // bitUnpack20 implements BitUnpack(v, 2¹⁹-1, 2¹⁹), which unpacks each 20 bits // in little-endian into a coefficient in [-2¹⁹+1, 2¹⁹]. func bitUnpack20(v []byte) ringElement { if len(v) != 20*n/8 { panic("mldsa: internal error: invalid bitUnpack20 input length") } const b = 1 << 19 const mask20 = 1<<20 - 1 var r ringElement for i := 0; i < n; i += 2 { w0 := uint32(v[0]) | uint32(v[1])<<8...