uint32(f[i]) | uint32(f[i+1])<<12 B[0] = uint8(x) B[1] = uint8(x >> 8) B[2] = uint8(x >> 16) B = B[3:] } return out } // polyByteDecode decodes the 384-byte encoding of a polynomial, checking that // all the coefficients are properly reduced. This fulfills the "Modulus check" // step of ML-KEM Encapsulation. // // It implements ByteDecode₁₂, according to FIPS 203, Algorithm 6. func polyByteDecode[T ~[n]fieldElement](b []byte) (T, error) { if len(b) != encodingSize12 { return T{}, errors.New("mlkem: invalid...