f[start:start+len], f[start+len:start+len+len] for j := 0; j < len; j++ { t := fieldMul(zeta, flen[j]) flen[j] = fieldSub(f[j], t) f[j] = fieldAdd(f[j], t) } } } return nttElement(f) } // inverseNTT maps a nttElement back to the ringElement it represents. // // It implements NTT⁻¹, according to FIPS 203, Algorithm 10. func inverseNTT(f nttElement) ringElement { k := 127 for len := 2; len <= 128; len *= 2 { for start := 0; start < 256; start += 2 * len { zeta := zetas[k] k-- // Bounds check elimination hint....