// dkPKE ← ByteEncode₁₂(s)
	// ekPKE ← ByteEncode₁₂(t) || ρ
	// ek ← ekPKE
	// dk ← dkPKE || ek || H(ek) || z
	dkB := dk.dk[:0]

	for i := range s {
		dkB = polyByteEncode(dkB, s[i])
	}

	for i := range t {
		dkB = polyByteEncode(dkB, t[i])
	}
	dkB = append(dkB, ρ...)

	H := sha3.New256()
	H.Write(dkB[decryptionKeySize:])
	dkB = H.Sum(dkB)

	dkB = append(dkB, z[:]...)