Existence of poly_csubq

[vincentvbh]

If I understand correctly, poly_csubq is not required for compressions. The reason is that, in the current avx2 implementations, the floor variant of Barrett reduction is used instead of the rounding one in the reference implementation prior to calling the compressions. The floor variant of Barrett outputs non-negative integers in [0, 3329]. When passed to the compression functions, 3329 is mapped to zero as 20159 is slightly larger than 2^26 / 3329. Strictly speaking, we have 20159 / (2^26 / 3329) ~ 1.0000066, implying that 2^d has to be larger than 10^5 to turn round(2^d * 3329 * 20159 / 2^26) into 1. The largest 2^d is 2048 in Kyber, so round(2^d * 3329 * 20159 / 2^26) is always zero, and we don't need to turn 3329 into 0 with csubq.

[vincentvbh]

Sorry, I overlook something. The above statement holds when we have infinite precision. For 32-bit precision, it only holds for D <= 4, which still applies to compress4. I'll investigate more on this.