uint32(b)), true default: panic("internal error: unsupported η") } } // power2Round implements Power2Round from FIPS 204. // // It separates the bottom d = 13 bits of each 23-bit coefficient, rounding the // high part based on the low part, and correcting the low part accordingly. func power2Round(r fieldElement) (hi uint16, lo fieldElement) { rr := fieldFromMontgomery(r) // Add 2¹² - 1 to round up r1 by one if r0 > 2¹². // r is at most 2²³ - 2¹³ + 1, so rr + (2¹² - 1) won't overflow 23 bits. r1...

strings, // and context is either a fixed-length computed hash, or parsed from a // field which has the same length limitation. // // Another reasonable approach might be to return a randomized slice if // we encounter an error, which would break the connection, but avoid // panicking. This would perhaps be safer but significantly more // confusing to users. panic("tls13: label or context too long") } hkdfLabel := make([]byte, 0, 2+1+len("tls13 ")+len(label)+1+len(context)) hkdfLabel = byteorder.BEApp...