算法流程 paper在此:https://eprint.iacr.org/2015/612.pdf x ⋘\lll⋘ c denotes the cyclic shift of x to the left by c bits. x & y is the bitwise AND of x and y. x⊕yx \oplus yx⊕