Add Armv8.1-M Keccak x1 backend

.github/workflows/zephyr.yml

@@ -37,14 +37,26 @@ jobs:
           acvp: true
           wycheproof: false
           examples: false
-          unit: false
+          unit: ${{ matrix.target.board == 'mps3-an547' }}
           stack: false
           alloc: false
           rng_fail: false
           check_namespace: false
           # Zephyr's CMake selects the target arch; disable the host-arch
           # auto-detection that would otherwise leak into the forwarded CFLAGS.
           extra_args: --no-auto
+      # Keep unit coverage for the retained x4 backend after an547 defaults to
+      # x1. Select its dedicated xor/permute/extract unit to avoid rerunning the
+      # unrelated unit suite under the slower x4 QEMU backend.
+      - name: Armv8.1-M x4 FIPS202 unit
+        if: matrix.target.board == 'mps3-an547'
+        run: |
+          nix develop .#zephyr --command make run_unit_44 \
+            EXTRA_MAKEFILE=test/zephyr/platform.mk \
+            ZEPHYR_TARGET=mps3-an547 \
+            ZEPHYR_FIPS202_BACKEND=fips202/native/armv81m/mve.h \
+            NUM_RANDOM_TESTS=1 UNIT_TEST_FIPS202_X4_ONLY=1 \
+            OPT=1 AUTO=0 CYCLES=NO -j1
       # Smoke only: QEMU doesn't model cycle counts (real numbers come from the
       # FPGA); this just exercises the bench build + run.
       - name: bench (smoke)

BIBLIOGRAPHY.md

@@ -36,6 +36,17 @@ source code and documentation.
 * Referenced from:
   - [README.md](README.md)
 
+### `ADOMNICAI23`
+
+* An update on Keccak performance on ARMv7-M
+* Author(s):
+  - Alexandre Adomnicai
+* URL: https://eprint.iacr.org/2023/773
+* Referenced from:
+  - [dev/fips202/armv81m_clean/src/keccak_f1600_x1_armv7m.S](dev/fips202/armv81m_clean/src/keccak_f1600_x1_armv7m.S)
+  - [dev/fips202/armv81m_opt/src/keccak_f1600_x1_armv7m_opt_m7.S](dev/fips202/armv81m_opt/src/keccak_f1600_x1_armv7m_opt_m7.S)
+  - [mldsa/src/fips202/native/armv81m/src/keccak_f1600_x1_armv7m_opt_m7.S](mldsa/src/fips202/native/armv81m/src/keccak_f1600_x1_armv7m_opt_m7.S)
+
 ### `ArmARMv8M`
 
 * Armv8-M Architecture Reference Manual (DDI 0553)
@@ -411,6 +422,19 @@ source code and documentation.
   - [mldsa/src/sign.c](mldsa/src/sign.c)
   - [proofs/hol_light/README.md](proofs/hol_light/README.md)
 
+### `SLOTHYM7`
+
+* Enabling Microarchitectural Agility: Taking ML-KEM and ML-DSA from Cortex-M4 to M7 with SLOTHY
+* Author(s):
+  - Amin Abdulrahman
+  - Matthias J. Kannwischer
+  - Joel Lim
+* URL: https://eprint.iacr.org/2025/366
+* Referenced from:
+  - [dev/fips202/armv81m_clean/src/keccak_f1600_x1_armv7m.S](dev/fips202/armv81m_clean/src/keccak_f1600_x1_armv7m.S)
+  - [dev/fips202/armv81m_opt/src/keccak_f1600_x1_armv7m_opt_m7.S](dev/fips202/armv81m_opt/src/keccak_f1600_x1_armv7m_opt_m7.S)
+  - [mldsa/src/fips202/native/armv81m/src/keccak_f1600_x1_armv7m_opt_m7.S](mldsa/src/fips202/native/armv81m/src/keccak_f1600_x1_armv7m_opt_m7.S)
+
 ### `SLOTHY_Paper`
 
 * Fast and Clean: Auditable high-performance assembly via constraint solving
@@ -444,6 +468,21 @@ source code and documentation.
   - [test/abicheck/README.md](test/abicheck/README.md)
   - [test/abicheck/x86_64/abicheck_x86_64.c](test/abicheck/x86_64/abicheck_x86_64.c)
 
+### `XKCP`
+
+* eXtended Keccak Code Package
+* Author(s):
+  - Guido Bertoni
+  - Joan Daemen
+  - Michaël Peeters
+  - Gilles Van Assche
+  - Ronny Van Keer
+* URL: https://github.com/XKCP/XKCP
+* Referenced from:
+  - [dev/fips202/armv81m_clean/src/keccak_f1600_x1_armv7m.S](dev/fips202/armv81m_clean/src/keccak_f1600_x1_armv7m.S)
+  - [dev/fips202/armv81m_opt/src/keccak_f1600_x1_armv7m_opt_m7.S](dev/fips202/armv81m_opt/src/keccak_f1600_x1_armv7m_opt_m7.S)
+  - [mldsa/src/fips202/native/armv81m/src/keccak_f1600_x1_armv7m_opt_m7.S](mldsa/src/fips202/native/armv81m/src/keccak_f1600_x1_armv7m_opt_m7.S)
+
 ### `libmceliece`
 
 * libmceliece implementation of Classic McEliece

BIBLIOGRAPHY.yml

@@ -115,6 +115,29 @@
   - Klein, Fabien
   url: https://eprint.iacr.org/2022/1303
 
+- id: ADOMNICAI23
+  name: "An update on Keccak performance on ARMv7-M"
+  author: Adomnicai, Alexandre
+  url: https://eprint.iacr.org/2023/773
+
+- id: SLOTHYM7
+  name: "Enabling Microarchitectural Agility: Taking ML-KEM and ML-DSA from Cortex-M4 to M7 with SLOTHY"
+  author:
+  - Abdulrahman, Amin
+  - Kannwischer, Matthias J.
+  - Lim, Joel
+  url: https://eprint.iacr.org/2025/366
+
+- id: XKCP
+  name: eXtended Keccak Code Package
+  author:
+  - Bertoni, Guido
+  - Daemen, Joan
+  - Peeters, Michaël
+  - Van Assche, Gilles
+  - Van Keer, Ronny
+  url: https://github.com/XKCP/XKCP
+
 - id: NeonNTT
   name: "Neon NTT: Faster Dilithium, Kyber, and Saber on Cortex-A72 and Apple M1"
   year: 2022

dev/fips202/armv81m/mve_x1.h

@@ -0,0 +1,68 @@
+/*
+ * Copyright (c) The mlkem-native project authors
+ * Copyright (c) The mldsa-native project authors
+ * SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT
+ */
+
+#ifndef MLD_DEV_FIPS202_ARMV81M_MVE_X1_H
+#define MLD_DEV_FIPS202_ARMV81M_MVE_X1_H
+
+#define MLD_FIPS202_NATIVE_ARMV81M
+
+/* Part of backend API */
+#define MLD_USE_NATIVE_FIPS202_X1
+#define MLD_USE_NATIVE_FIPS202_X1_XOR_BYTES
+#define MLD_USE_NATIVE_FIPS202_X1_EXTRACT_BYTES
+/* Guard for assembly files */
+#define MLD_FIPS202_ARMV81M_NEED_X1
+
+#if !defined(__ASSEMBLER__)
+#include "../api.h"
+
+#define mld_keccak_f1600_x1_native_impl \
+  MLD_NAMESPACE(keccak_f1600_x1_native_impl)
+MLD_INTERNAL_API
+int mld_keccak_f1600_x1_native_impl(uint64_t *state);
+
+MLD_MUST_CHECK_RETURN_VALUE
+static MLD_INLINE int mld_keccak_f1600_x1_native(uint64_t *state)
+{
+  return mld_keccak_f1600_x1_native_impl(state);
+}
+
+#define mld_keccakf1600_xor_bytes_x1_native_impl \
+  MLD_NAMESPACE(keccakf1600_xor_bytes_x1_native_impl)
+MLD_INTERNAL_API
+int mld_keccakf1600_xor_bytes_x1_native_impl(uint64_t *state,
+                                             const uint8_t *data,
+                                             unsigned offset, unsigned length);
+
+MLD_MUST_CHECK_RETURN_VALUE
+static MLD_INLINE int mld_keccakf1600_xor_bytes_x1_native(uint64_t *state,
+                                                          const uint8_t *data,
+                                                          unsigned offset,
+                                                          unsigned length)
+{
+  return mld_keccakf1600_xor_bytes_x1_native_impl(state, data, offset, length);
+}
+
+#define mld_keccakf1600_extract_bytes_x1_native_impl \
+  MLD_NAMESPACE(keccakf1600_extract_bytes_x1_native_impl)
+MLD_INTERNAL_API
+int mld_keccakf1600_extract_bytes_x1_native_impl(uint64_t *state, uint8_t *data,
+                                                 unsigned offset,
+                                                 unsigned length);
+
+MLD_MUST_CHECK_RETURN_VALUE
+static MLD_INLINE int mld_keccakf1600_extract_bytes_x1_native(uint64_t *state,
+                                                              uint8_t *data,
+                                                              unsigned offset,
+                                                              unsigned length)
+{
+  return mld_keccakf1600_extract_bytes_x1_native_impl(state, data, offset,
+                                                      length);
+}
+
+#endif /* !__ASSEMBLER__ */
+
+#endif /* !MLD_DEV_FIPS202_ARMV81M_MVE_X1_H */