file. package mldsa import ( "bytes" "crypto/internal/fips140" "crypto/internal/fips140/drbg" "crypto/internal/fips140/sha3" "crypto/internal/fips140/subtle" "crypto/internal/fips140deps/byteorder" "errors" ) type parameters struct { k, l int // dimensions of A η int // bound for secret coefficients γ1 int // log₂(γ₁), where [-γ₁+1, γ₁] is the bound of y γ2 int // denominator of γ₂ = (q - 1) / γ2 λ int // collison strength τ int // number of non-zero coefficients in challenge ω int // max number of...

27BF          ; valid                  ;      ; NV8    # 6.0  DOUBLE CURLY LOOP
27C0..27C6    ; valid                  ;      ; NV8    # 4.1  THREE DIMENSIONAL ANGLE..RIGHT S-SHAPED BAG DELIMITER
27C7..27CA    ; valid                  ;      ; NV8    # 5.0  OR WITH DOT INSIDE..VERTICAL BAR WITH HORIZONTAL STROKE

K-PKE.KeyGen according to FIPS 203, Algorithm 13. The two are merged to save // copies and allocations. func kemKeyGen1024(dk *DecapsulationKey1024, d, z *[32]byte) { dk.d = *d dk.z = *z g := sha3.New512() g.Write(d[:]) g.Write([]byte{k1024}) // Module dimension as a domain separator. G := g.Sum(make([]byte, 0, 64)) ρ, σ := G[:32], G[32:] dk.ρ = [32]byte(ρ) A := &dk.a for i := byte(0); i < k1024; i++ { for j := byte(0); j < k1024; j++ { A[i*k1024+j] = sampleNTT(ρ, j, i) } } var N byte s := &dk.s for i :=...