in contravention of the TestingOnlyNewDecaps function // comment advising against it. drbg.Read(dk.d[:]) return dk, nil } // kemKeyGen1024 generates a decapsulation key. // // It implements ML-KEM.KeyGen_internal according to FIPS 203, Algorithm 16, and // K-PKE.KeyGen according to FIPS 203, Algorithm 13. The two are merged to save // copies and allocations. func kemKeyGen1024(dk *DecapsulationKey1024, d, z *[32]byte) { dk.d = *d dk.z = *z g := sha3.New512() g.Write(d[:]) g.Write([]byte{k1024}) //...