[]byte { pk := append(buf, ρ...) for _, w := range t1[:p.k] { // Encode four at a time into 4 * 10 bits = 5 bytes. for i := 0; i < n; i += 4 { c0 := w[i] c1 := w[i+1] c2 := w[i+2] c3 := w[i+3] b0 := byte(c0 >> 0) b1 := byte((c0 >> 8) | (c1 << 2)) b2 := byte((c1 >> 6) | (c2 << 4)) b3 := byte((c2 >> 4) | (c3 << 6)) b4 := byte(c3 >> 2) pk = append(pk, b0, b1, b2, b3, b4) } } return pk } func pkDecode(pk []byte, t1 [][n]uint16, p parameters) (ρ []byte, err error) { if len(pk) != pubKeySize(p) { return nil,...

+ a1×b3 + a2×b2 + a3×b1 + a4×b0 // r4 < 5 × 2⁵² × 2⁵² // r4 < 2¹⁰⁷ // c0 := shiftRightBy51(r0) c1 := shiftRightBy51(r1) c2 := shiftRightBy51(r2) c3 := shiftRightBy51(r3) c4 := shiftRightBy51(r4) rr0 := r0.lo&maskLow51Bits + c4*19 rr1 := r1.lo&maskLow51Bits + c0 rr2 := r2.lo&maskLow51Bits + c1 rr3 := r3.lo&maskLow51Bits + c2 rr4 := r4.lo&maskLow51Bits + c3 // Now all coefficients fit into 64-bit registers but are still too large to // be passed around as an Element. We therefore do one last carry chain,...