coeffFromHalfByte(z0, p) if ok { a[j] = coeff j++ } if j >= len(a) { break } coeff, ok = coeffFromHalfByte(z1, p) if ok { a[j] = coeff j++ } if j >= len(a) { break } } return a } // sampleInBall samples a ringElement with coefficients in {−1, 0, 1}, and τ // non-zero coefficients. It is not constant-time. func sampleInBall(rho []byte, p parameters) ringElement { H := sha3.NewShake256() H.Write(rho) s := make([]byte, 8) H.Read(s) var c ringElement for i := 256 - p.τ; i < 256; i++ { j := make([]byte,...