Distribution for gen_matrix in reference implementation? #101
Description
gen_matrix in the reference implementation draws from a uniform random distribution and is used by indcpa_keypair_derand() through the gen_a macro. This is multiplied with NTT'ed key data in polyvec_basemul_acc_montgomery(). However, it isn't NTT'ed first. Comments in polyvec_basemul_acc_montgomery() state both elements should be in the NTT domain. Since a is random this appears at first glance a non-issue but the NTT of a uniform random distribution is not uniform random so the code effectively changes the distribution of A. Is this intended? If so could the comments for gen_matrix be updated to reflect this use? If not I'd suggest adding the polyvec_ntt(a[i]) to the multiplication loop on line 232.