byte(w1 >> 4) v[4] = byte(w1 >> 12) v = v[2*20/8:] } return out } // bitUnpack implements BitUnpack(v, 2^γ1-1, 2^γ1), which unpacks each γ1+1 bits // in little-endian into a coefficient in [-2^γ1+1, 2^γ1]. func bitUnpack(v []byte, p parameters) ringElement { switch p.γ1 { case 17: return bitUnpack18(v) case 19: return bitUnpack20(v) default: panic("mldsa: internal error: unsupported γ1") } } // bitUnpack18 implements BitUnpack(v, 2¹⁷-1, 2¹⁷), which unpacks each 18 bits // in little-endian into a...