dk.encryptionKey1024 = ek.encryptionKey1024 b = b[EncapsulationKeySize:] if !bytes.Equal(dk.h[:], b[:32]) { return nil, errors.New("mlkem: inconsistent H(ek) in encoded bytes") } b = b[32:] copy(dk.z[:], b) // Generate a random d value for use in Bytes(). This is a safety mechanism // that avoids returning a broken key vs a random key if this function is // called in contravention of the TestingOnlyNewDecaps function // comment advising against it. drbg.Read(dk.d[:]) return dk, nil } // kemKeyGen1024 generates a decapsulation...