25F8..25FF    ; valid                  ;      ; NV8    # 3.2  UPPER LEFT TRIANGLE..LOWER RIGHT TRIANGLE
2600..2613    ; valid                  ;      ; NV8    # 1.1  BLACK SUN WITH RAYS..SALTIRE
2614..2615    ; valid                  ;      ; NV8    # 4.0  UMBRELLA WITH RAIN DROPS..HOT BEVERAGE
2616..2617    ; valid                  ;      ; NV8    # 3.2  WHITE SHOGI PIECE..BLACK SHOGI PIECE

t.Log(reason, "rejection") reached[reason] = true } t.Cleanup(func() { testingOnlyRejection = nil }) fips140CAST() for reason, hit := range reached { if !hit { t.Errorf("Rejection path %q not hit", reason) } } } func BenchmarkCAST(b *testing.B) { // IG 10.3.A says "ML-DSA digital signature generation CASTs should cover // all applicable rejection sampling loop paths". For ML-DSA-44, there are // four paths. For ML-DSA-65 and ML-DSA-87, only three. This benchmark helps // us figure out which is faster: four rejections...