performance. t = f[j+1] f[j+1] = fieldAdd(t, flen[j+1]) flen[j+1] = fieldMontgomeryMulSu(zeta, flen[j+1], t) } } } for i := range f { f[i] = fieldMontgomeryMul(f[i], 16382) // 16382 = 256⁻¹ * R mod q } return ringElement(f) } // nttMul multiplies two nttElements. func nttMul(a, b nttElement) (p nttElement) { for i := range p { p[i] = fieldMontgomeryMul(a[i], b[i]) } return p } // sampleNTT samples an nttElement uniformly at random from the seed rho and the // indices s and r. It implements Step 3 of...

735, 2804, 525, 1092, 2237, 403, 2926, 1026, 2303, 1143, 2186, 2150, 1179, 2775, 554, 886, 2443, 1722, 1607, 1212, 2117, 1874, 1455, 1029, 2300, 2110, 1219, 2935, 394, 885, 2444, 2154, 1175} // nttMul multiplies two nttElements. // // It implements MultiplyNTTs, according to FIPS 203, Algorithm 11. func nttMul(f, g nttElement) nttElement { var h nttElement // We use i += 2 for bounds check elimination. See https://go.dev/issue/66826. for i := 0; i < 256; i += 2 { a0, a1 := f[i], f[i+1] b0, b1 := g[i],...