pub fn multiply_ntts(f: &[i16; 256], g: &[i16; 256], h: &mut [i16; 256])Expand description
Pointwise basemul in NTT domain (Algorithms 11+12) — full Montgomery.
Each pair (h[2i], h[2i+1]) is the product of input pairs modulo (X²-γᵢ).
Output is in /R domain (one Montgomery division per coefficient).
For the encrypt/decrypt pipeline (basemul → iNTT), the /R is compensated by the F_SCALE factor in iNTT.
For KeyGen (basemul accumulate in NTT domain), call to_mont_poly to
convert from /R to normal domain before adding NTT(e).