(d []byte)
| 37 | ) |
| 38 | |
| 39 | func sampleNTT(d []byte) int { |
| 40 | G := sha3.Sum512(d) |
| 41 | rho := G[:32] |
| 42 | |
| 43 | B := sha3.NewShake128() |
| 44 | B.Write(rho) |
| 45 | B.Write([]byte{0, 0}) |
| 46 | |
| 47 | var samples int |
| 48 | var j int |
| 49 | var buf [24]byte // buffered reads from B |
| 50 | off := len(buf) // index into buf, starts in a "buffer fully consumed" state |
| 51 | for { |
| 52 | if off >= len(buf) { |
| 53 | B.Read(buf[:]) |
| 54 | off = 0 |
| 55 | } |
| 56 | d1 := binary.LittleEndian.Uint16(buf[off:]) & 0b1111_1111_1111 |
| 57 | d2 := binary.LittleEndian.Uint16(buf[off+1:]) >> 4 |
| 58 | off += 3 |
| 59 | samples++ |
| 60 | if d1 < q { |
| 61 | j++ |
| 62 | } |
| 63 | if j == n { |
| 64 | break |
| 65 | } |
| 66 | samples++ |
| 67 | if d2 < q { |
| 68 | j++ |
| 69 | } |
| 70 | if j == n { |
| 71 | break |
| 72 | } |
| 73 | } |
| 74 | return samples |
| 75 | } |