t) } } } for i := range f { f[i] = fieldMul(f[i], 3303) // 3303 = 128⁻¹ mod q } return ringElement(f) } // sampleNTT draws a uniformly random nttElement from a stream of uniformly // random bytes generated by the XOF function, according to FIPS 203, // Algorithm 7. func sampleNTT(rho []byte, ii, jj byte) nttElement { B := sha3.NewShake128() B.Write(rho) B.Write([]byte{ii, jj}) // SampleNTT essentially draws 12 bits at a time from r, interprets them in // little-endian, and rejects values higher than...