}) // fips140CAST covers all rejection sampling paths, as recommended by IG 10.3.A, // and as tested by TestCASTRejectionPat. It tests only one parameter set as // allowed by Note26. It tests the modified version of Algorithm 7 and 8 with a // fixed mu/μ, as allowed by IG 10.3.A, Resolution 15. It compares sk and not // pk, because H(pk) is part of sk, as allowed by the same Resolution. It // compares the results with hashes instead of values, to avoid embedding several // kilobytes of test vectors...