fieldMontgomeryMulSu(zeta, flen[j+1], t) } } } for i := range f { f[i] = fieldMontgomeryMul(f[i], 16382) // 16382 = 256⁻¹ * R mod q } return ringElement(f) } // nttMul multiplies two nttElements. func nttMul(a, b nttElement) (p nttElement) { for i := range p { p[i] = fieldMontgomeryMul(a[i], b[i]) } return p } // sampleNTT samples an nttElement uniformly at random from the seed rho and the // indices s and r. It implements Step 3 of ExpandA, RejNTTPoly, and // CoeffFromThreeBytes from FIPS 204, passing in ρ, s,...

2926, 1026, 2303, 1143, 2186, 2150, 1179, 2775, 554, 886, 2443, 1722, 1607, 1212, 2117, 1874, 1455, 1029, 2300, 2110, 1219, 2935, 394, 885, 2444, 2154, 1175} // nttMul multiplies two nttElements. // // It implements MultiplyNTTs, according to FIPS 203, Algorithm 11. func nttMul(f, g nttElement) nttElement { var h nttElement // We use i += 2 for bounds check elimination. See https://go.dev/issue/66826. for i := 0; i < 256; i += 2 { a0, a1 := f[i], f[i+1] b0, b1 := g[i], g[i+1] h[i] = fieldAddMul(a0, b0,...