Computeμ(pk, M, ctx):

  # Referred to as 'ExternalMu-ML-DSA.Prehash(pk, M, ctx)'
  # in the FIPS 204 FAQ.
  # M is the message, a bit-string
  # μ and ctx are byte-strings.
  # ctx is the context string, which defaults to the empty string.

  μ = H(BytesToBits(H(pk, 64) || IntegerToBytes(0, 1) ||
                IntegerToBytes(|ctx|, 1) || ctx) || M, 64)
  # The functions `BytesToBits` and `IntegerToBytes` are defined
  # in FIPS 204.
  return μ