nx_kyber_poly_tomont_wasm.nx

nx_kyber_poly_tomont_wasm.nx -- Convert polynomial to Montgomery form. After polyvec_basemul_acc_montgomery (= nx_kyber_poly_basemul_acc), each coefficient is in the "x * R^{-1} mod q" form because every fqmul multiplied by R^{-1}. poly_tomont multiplies by R^2 mod q (= 1353) and then applies montgomery_reduce, which has the effect of multiplying the polynomial by R -- canceling the R^{-1} factor and restoring CANONICAL representation. Per PQClean's poly_tomont(): const int16_t f = (1ULL << 32) % KYBER_Q; // = 1353 for each coef c: c = montgomery_reduce(c * f); Used immediately after basemul_acc inside K-PKE keygen/encrypt to put the accumulated polynomial back into canonical form so it can be added to canonical-form e/e1/e2/mu polynomials without mixing representations. API: nx_kyber_poly_tomont(poly) -> i64 license_tier: INDEPENDENT_REDERIVE genealogy_id: international-research-sources/nist/fips_203 lineage_id: nishi_kyber_poly_tomont_wasm_q1 safe_shift_audit: no 64-bit rotations in this module