Skip to main content

sample_poly_cbd

ml_kem::algebra

Function sample_poly_cbd 

Source 
pub(crate) fn sample_poly_cbd<Eta>(
    B: &EncodedPolynomial<<Eta as CbdSamplingSize>::SampleSize>,
) -> Polynomial<BaseField>
where
    Eta: CbdSamplingSize,
Expand description

Algorithm 8: SamplePolyCBD_eta(B)

To avoid all the bitwise manipulation in the algorithm as written, we reuse the logic in ByteDecode. We decode the PRF output into integers with 2 * eta bits, then use count_ones to perform the summation described in the algorithm.

The PRF output is secret, so each coefficient is computed arithmetically: no memory access or branch depends on the sampled bits (in particular, there is no lookup table).