p.l priv := &PrivateKey{pub: PublicKey{p: p}} priv.seed = *seed ξ := sha3.NewShake256() ξ.Write(seed[:]) ξ.Write([]byte{byte(k), byte(l)}) ρ, ρs := make([]byte, 32), make([]byte, 64) ξ.Read(ρ) ξ.Read(ρs) ξ.Read(priv.k[:]) A := priv.pub.a[:k*l] computeMatrixA(A, ρ, p) s1 := priv.s1[:l] for r := range l { s1[r] = ntt(sampleBoundedPoly(ρs, byte(r), p)) } s2 := priv.s2[:k] for r := range k { s2[r] = ntt(sampleBoundedPoly(ρs, byte(l+r), p)) } // ˆt = Â ∘ ŝ₁ + ŝ₂ tHat := make([]nttElement, k, maxK) for...