H.Reset() H.Write(nonce) H.Write(counter) v := make([]byte, (p.γ1+1)*n/8, (maxγ1+1)*n/8) H.Read(v) y[r] = bitUnpack(v, p) } // w = NTT⁻¹(Â ∘ NTT(y)) yHat := make([]nttElement, l, maxL) for i := range y { yHat[i] = ntt(y[i]) } w := make([]ringElement, k, maxK) for i := range w { var wHat nttElement for j := range l { wHat = polyAdd(wHat, nttMul(A[i*l+j], yHat[j])) } w[i] = inverseNTT(wHat) } H.Reset() H.Write(μ[:]) for i := range w { w1Encode(H, highBits(w[i], p), p) } ch := make([]byte, p.λ/4, maxλ/4)...