return ringElement(f) } // sampleNTT draws a uniformly random nttElement from a stream of uniformly // random bytes generated by the XOF function, according to FIPS 203, // Algorithm 7. func sampleNTT(rho []byte, ii, jj byte) nttElement { B := sha3.NewShake128() B.Write(rho) B.Write([]byte{ii, jj}) // SampleNTT essentially draws 12 bits at a time from r, interprets them in // little-endian, and rejects values higher than q, until it drew 256 // values. (The rejection rate is approximately 19%.) // //...