Skip to content

Add example for the use of context parameters - #1399

Open
hanno-becker wants to merge 3 commits into
mainfrom
context_param_ex
Open

Add example for the use of context parameters#1399
hanno-becker wants to merge 3 commits into
mainfrom
context_param_ex

Conversation

@hanno-becker

@hanno-becker hanno-becker commented Aug 28, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

@hanno-becker
API: Don't emit namespacing macros if MLD_CONFIG_CONSTANTS_ONLY is set
1fff644 
The public header mldsa_native.h can be included with
MLD_CONFIG_CONSTANTS_ONLY set to obtain constant definitions without the
function API. However, it still emitted namespacing and qualification
macros for the omitted function declarations, which are irrelevant in
that mode.

Move the hash-algorithm and domain-separation constants above the
namespacing section. Then move the
'#if !defined(MLD_CONFIG_CONSTANTS_ONLY)' guard upwards so a single
block encompasses both namespacing and the function API. Keep the
config-file include unconditional because the Memory Usage constants
(MLD_TOTAL_ALLOC_*) still depend on MLD_CONFIG_KEYGEN_PCT in
constants-only builds.

Ported from mlkem-native.

Signed-off-by: Hanno Becker <beckphan@amazon.co.uk>
@oqs-bot

oqs-bot commented Aug 28, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

CBMC Results (ML-DSA-44, REDUCE-RAM)

⚠️ Attention Required

Proof Status Current Previous Change
compute_pack_t0_t1 ⚠️ 29s 12s +142%
mld_attempt_signature_generation ⚠️ 140s 19s +637%
sign_pk_from_sk ⚠️ 40s 5s +700%
sign_verify_internal ⚠️ 159s 49s +224%
Full Results (210 proofs)
Proof Status Current Previous Change
**TOTAL** ✅ 1208s 1364s -11.4%
sign_verify_internal ⚠️ 159s 49s +224%
mld_attempt_signature_generation ⚠️ 140s 19s +637%
polyvec_matrix_pointwise_montgomery_yvec ✅ 97s 149s -35%
poly_pointwise_montgomery_c ✅ 62s 112s -45%
mld_invntt_layer ✅ 55s 105s -48%
sign_pk_from_sk ⚠️ 40s 5s +700%
compute_pack_t0_t1 ⚠️ 29s 12s +142%
fqmul ✅ 22s 39s -44%
mld_ntt_layer ✅ 22s 41s -46%
sign_keypair_internal ✅ 17s 4s +325%
mld_ntt_butterfly_block ✅ 13s 23s -43%
keccakf1600x4_permute_native ✅ 12s 22s -45%
sig_unpack_hints ✅ 12s 2s +500%
sign_signature_internal ✅ 12s 4s +200%
rej_uniform_c ✅ 11s 16s -31%
poly_ntt_c ✅ 10s 21s -52%
polyt0_unpack ✅ 9s 12s -25%
polyeta_unpack ✅ 8s 14s -43%
polyz_unpack_c ✅ 8s 8s +0%
rej_uniform ✅ 8s 8s +0%
poly_invntt_tomont_c ✅ 7s 11s -36%
polyvec_matrix_pointwise_montgomery_row ✅ 7s 6s +17%
rej_uniform_native_x86_64 ✅ 7s - new
mld_check_pct ✅ 6s 15s -60%
poly_chknorm_c ✅ 6s 11s -45%
poly_uniform_eta_4x ✅ 6s 12s -50%
sign_verify_pre_hash_shake256 ✅ 6s 5s +20%
pack_sk_rho_key_tr_s2 ✅ 5s 5s +0%
pointwise_acc_native_aarch64 ✅ 5s 6s -17%
poly_add ✅ 5s 7s -29%
poly_caddq_native ✅ 5s 3s +67%
poly_ntt_native ✅ 5s 3s +67%
polyvec_matrix_expand ✅ 5s 3s +67%
sign_keypair ✅ 5s 5s +0%
keccak_absorb_once_x4 ✅ 4s 8s -50%
mld_compute_pack_z ✅ 4s 6s -33%
mld_keccakf1600_permute_c ✅ 4s 7s -43%
ntt_native_x86_64 ✅ 4s 3s +33%
pointwise_acc_native_x86_64 ✅ 4s 4s +0%
poly_caddq_native_aarch64 ✅ 4s 3s +33%
poly_permute_bitrev_to_custom_optional ✅ 4s 5s -20%
poly_power2round ✅ 4s 4s +0%
poly_uniform_gamma1_4x ✅ 4s 5s -20%
poly_use_hint_c ✅ 4s 5s -20%
polyt0_pack ✅ 4s 4s +0%
polyt1_unpack ✅ 4s 2s +100%
polyveck_decompose ✅ 4s 7s -43%
polyvecl_pointwise_acc_montgomery_c ✅ 4s 4s +0%
polyw1_pack ✅ 4s 4s +0%
polyw1_pack_32 ✅ 4s 3s +33%
rej_uniform_native_aarch64 ✅ 4s 3s +33%
shake128x4_squeezeblocks ✅ 4s 2s +100%
sign_signature_pre_hash_shake256 ✅ 4s 4s +0%
unpack_sk ✅ 4s 3s +33%
intt_native_aarch64 ✅ 3s 3s +0%
intt_native_x86_64 ✅ 3s 2s +50%
keccak_f1600_x4_native_aarch64_v8a_scalar_hybrid ✅ 3s 2s +50%
keccak_squeezeblocks_x4 ✅ 3s 3s +0%
keccakf1600_extract_bytes (big endian) ✅ 3s 4s -25%
mld_ct_get_optblocker_u32 ✅ 3s 2s +50%
mld_h ✅ 3s 4s -25%
mld_polymat_expand_entry ✅ 3s 2s +50%
mld_sign_attempt ✅ 3s - new
mld_sign_finish ✅ 3s - new
mld_value_barrier_u8 ✅ 3s 4s -25%
pack_sig_c ✅ 3s 5s -40%
pointwise_native_aarch64 ✅ 3s 2s +50%
poly_caddq ✅ 3s 4s -25%
poly_chknorm_native ✅ 3s 4s -25%
poly_decompose_88_native_aarch64 ✅ 3s 3s +0%
poly_ntt ✅ 3s 3s +0%
poly_uniform ✅ 3s 3s +0%
polyveck_caddq ✅ 3s 3s +0%
polyveck_invntt_tomont ✅ 3s 5s -40%
polyveck_pack_w1 ✅ 3s 3s +0%
polyveck_unpack_eta ✅ 3s 2s +50%
polyvecl_chknorm ✅ 3s 11s -73%
polyvecl_pack_eta ✅ 3s 2s +50%
polyvecl_pointwise_acc_montgomery ✅ 3s 3s +0%
polyw1_pack_88 ✅ 3s 2s +50%
polyz_unpack_19_native_aarch64 ✅ 3s 4s -25%
shake128_absorb ✅ 3s 3s +0%
shake256x4_absorb_once ✅ 3s 1s +200%
sign_signature_pre_hash_internal ✅ 3s 4s -25%
sign_verify ✅ 3s 4s -25%
sign_verify_extmu ✅ 3s 5s -40%
sk_t0hat_get_poly ✅ 3s 1s +200%
sys_check_capability ✅ 3s 2s +50%
unpack_pk_t1 ✅ 3s 3s +0%
unpack_sk_s1hat ✅ 3s 3s +0%
unpack_sk_s2hat ✅ 3s 4s -25%
unpack_sk_t0hat ✅ 3s 2s +50%
yvec_init ✅ 3s 1s +200%
decompose ✅ 2s 3s -33%
fqscale ✅ 2s 2s +0%
keccak_absorb ✅ 2s 3s -33%
keccak_f1600_x1_native_aarch64 ✅ 2s 3s -33%
keccak_f1600_x1_native_aarch64_v84a ✅ 2s 2s +0%
keccak_f1600_x4_native_aarch64_v84a ✅ 2s 3s -33%
keccak_f1600_x4_native_aarch64_v8a_v84a_scalar_hybrid ✅ 2s 3s -33%
keccak_f1600_x4_native_avx2 ✅ 2s 2s +0%
keccak_finalize ✅ 2s 2s +0%
keccak_init ✅ 2s 3s -33%
keccakf1600_permute_native ✅ 2s 3s -33%
keccakf1600_xor_bytes (big endian) ✅ 2s 6s -67%
keccakf1600x4_extract_bytes_native ✅ 2s 4s -50%
keccakf1600x4_xor_bytes ✅ 2s 3s -33%
keccakf1600x4_xor_bytes_native ✅ 2s 5s -60%
mld_ct_cmask_nonzero_u32 ✅ 2s 3s -33%
mld_ct_cmask_nonzero_u8 ✅ 2s 2s +0%
mld_keccakf1600_extract_bytes ✅ 2s 2s +0%
mld_keccakf1600x4_extract_bytes_c ✅ 2s 4s -50%
mld_keccakf1600x4_xor_bytes_c ✅ 2s 4s -50%
mld_prepare_domain_separation_prefix ✅ 2s 3s -33%
mld_sample_s1_s2 ✅ 2s 1s +100%
mld_sign_resume ✅ 2s - new
ntt_native_aarch64 ✅ 2s 4s -50%
pack_sk_s1 ✅ 2s 3s -33%
poly_chknorm ✅ 2s 3s -33%
poly_chknorm_native_aarch64 ✅ 2s 2s +0%
poly_decompose_32_native_aarch64 ✅ 2s 4s -50%
poly_decompose_c ✅ 2s 5s -60%
poly_invntt_tomont ✅ 2s 2s +0%
poly_permute_bitrev_to_custom_optional_native ✅ 2s 3s -33%
poly_pointwise_montgomery ✅ 2s 3s -33%
poly_pointwise_montgomery_native ✅ 2s 2s +0%
poly_reduce ✅ 2s 4s -50%
poly_shiftl ✅ 2s 4s -50%
poly_uniform_4x ✅ 2s 3s -33%
poly_use_hint ✅ 2s 2s +0%
poly_use_hint_native ✅ 2s 3s -33%
polyeta_pack ✅ 2s 3s -33%
polyt1_pack ✅ 2s 3s -33%
polyveck_chknorm ✅ 2s 67s -97%
polyveck_ntt ✅ 2s 2s +0%
polyveck_pack_eta ✅ 2s 4s -50%
polyveck_reduce ✅ 2s 4s -50%
polyvecl_ntt ✅ 2s 3s -33%
polyvecl_unpack_eta ✅ 2s 4s -50%
polyz_pack ✅ 2s 2s +0%
polyz_unpack ✅ 2s 3s -33%
polyz_unpack_native ✅ 2s 3s -33%
polyz_unpack_native_x86_64 ✅ 2s 3s -33%
rej_eta ✅ 2s 5s -60%
rej_eta_c ✅ 2s 4s -50%
rej_eta_native ✅ 2s 3s -33%
rej_uniform_eta_native_x86_64 ✅ 2s - new
rej_uniform_native ✅ 2s 5s -60%
shake128_finalize ✅ 2s 3s -33%
shake128_init ✅ 2s 2s +0%
shake128_release ✅ 2s 2s +0%
shake256_absorb ✅ 2s 2s +0%
shake256_finalize ✅ 2s 2s +0%
shake256_release ✅ 2s 1s +100%
shake256_squeeze ✅ 2s 2s +0%
shake256x4_squeezeblocks ✅ 2s 2s +0%
sign_signature ✅ 2s 6s -67%
sign_signature_extmu ✅ 2s 4s -50%
sign_verify_pre_hash_internal ✅ 2s 5s -60%
sk_s1hat_get_poly ✅ 2s 2s +0%
sk_s2hat_get_poly ✅ 2s 5s -60%
caddq ✅ 1s 6s -83%
keccak_squeeze ✅ 1s 2s -50%
keccakf1600_permute ✅ 1s 2s -50%
keccakf1600_xor_bytes ✅ 1s 3s -67%
keccakf1600x4_extract_bytes ✅ 1s 2s -50%
keccakf1600x4_permute ✅ 1s 4s -75%
make_hint ✅ 1s 3s -67%
mld_ct_abs_i32 ✅ 1s 3s -67%
mld_ct_cmask_neg_i32 ✅ 1s 2s -50%
mld_ct_get_optblocker_i64 ✅ 1s 4s -75%
mld_ct_get_optblocker_u8 ✅ 1s 2s -50%
mld_ct_memcmp ✅ 1s 1s +0%
mld_ct_sel_int32 ✅ 1s 3s -67%
mld_sample_s1_s2_serial ✅ 1s 4s -75%
mld_value_barrier_i64 ✅ 1s 3s -67%
mld_value_barrier_u32 ✅ 1s 1s +0%
montgomery_reduce ✅ 1s 2s -50%
nttunpack_native_x86_64 ✅ 1s 4s -75%
pack_sig_h ✅ 1s 4s -75%
pack_sig_z ✅ 1s 2s -50%
pointwise_native_x86_64 ✅ 1s 4s -75%
poly_caddq_c ✅ 1s 3s -67%
poly_caddq_native_x86_64 ✅ 1s 4s -75%
poly_challenge ✅ 1s 6s -83%
poly_chknorm_native_x86_64 ✅ 1s 2s -50%
poly_decompose ✅ 1s 2s -50%
poly_decompose_native ✅ 1s 2s -50%
poly_decompose_native_x86_64 ✅ 1s 2s -50%
poly_invntt_tomont_native ✅ 1s 3s -67%
poly_sub ✅ 1s 3s -67%
poly_uniform_eta ✅ 1s 2s -50%
poly_uniform_gamma1 ✅ 1s 3s -67%
poly_use_hint_native_aarch64 ✅ 1s 3s -67%
poly_use_hint_native_x86_64 ✅ 1s - new
polyvec_matrix_expand_serial ✅ 1s 4s -75%
polyvecl_pointwise_acc_montgomery_native ✅ 1s 3s -67%
polyvecl_uniform_gamma1 ✅ 1s 2s -50%
polyvecl_uniform_gamma1_serial ✅ 1s 2s -50%
polyvecl_unpack_z ✅ 1s 3s -67%
polyz_unpack_17_native_aarch64 ✅ 1s 2s -50%
power2round ✅ 1s 2s -50%
reduce32 ✅ 1s 3s -67%
rej_uniform_eta_native_aarch64 ✅ 1s 3s -67%
shake128_squeeze ✅ 1s 2s -50%
shake128x4_absorb_once ✅ 1s 2s -50%
shake256 ✅ 1s 1s +0%
shake256_init ✅ 1s 4s -75%
use_hint ✅ 1s 2s -50%
yvec_get_poly ✅ 1s 3s -67%

@oqs-bot

oqs-bot commented Aug 28, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

CBMC Results (ML-DSA-65, REDUCE-RAM)

⚠️ Attention Required

Proof Status Current Previous Change
compute_pack_t0_t1 ⚠️ 32s 7s +357%
mld_attempt_signature_generation ⚠️ 144s 31s +365%
sign_keypair_internal ⚠️ 27s 3s +800%
sign_pk_from_sk ⚠️ 55s 5s +1000%
sign_verify_internal ⚠️ 171s 71s +141%
Full Results (210 proofs)
Proof Status Current Previous Change
**TOTAL** ✅ 1361s 1482s -8.2%
sign_verify_internal ⚠️ 171s 71s +141%
mld_attempt_signature_generation ⚠️ 144s 31s +365%
polyvec_matrix_pointwise_montgomery_yvec ✅ 142s 201s -29%
poly_pointwise_montgomery_c ✅ 65s 116s -44%
mld_invntt_layer ✅ 57s 108s -47%
sign_pk_from_sk ⚠️ 55s 5s +1000%
polyvecl_chknorm ✅ 47s 43s +9%
compute_pack_t0_t1 ⚠️ 32s 7s +357%
sign_keypair_internal ⚠️ 27s 3s +800%
fqmul ✅ 21s 40s -48%
mld_ntt_layer ✅ 21s 43s -51%
mld_ntt_butterfly_block ✅ 14s 25s -44%
sign_signature_internal ✅ 13s 6s +117%
keccakf1600x4_permute_native ✅ 12s 22s -45%
polyt0_unpack ✅ 11s 13s -15%
rej_uniform_c ✅ 11s 16s -31%
sig_unpack_hints ✅ 10s 1s +900%
poly_ntt_c ✅ 9s 22s -59%
rej_uniform_native_x86_64 ✅ 9s - new
rej_uniform ✅ 8s 7s +14%
poly_uniform_eta_4x ✅ 7s 13s -46%
polyveck_decompose ✅ 7s 14s -50%
sign_keypair ✅ 7s 4s +75%
mld_check_pct ✅ 6s 12s -50%
poly_invntt_tomont_c ✅ 6s 10s -40%
sign_verify_pre_hash_shake256 ✅ 6s 6s +0%
keccak_absorb_once_x4 ✅ 5s 10s -50%
keccakf1600x4_permute ✅ 5s 1s +400%
poly_caddq_native ✅ 5s 4s +25%
poly_chknorm_c ✅ 5s 13s -62%
poly_permute_bitrev_to_custom_optional ✅ 5s 3s +67%
polyt0_pack ✅ 5s 5s +0%
polyveck_caddq ✅ 5s 7s -29%
polyvecl_ntt ✅ 5s 7s -29%
polyvecl_pointwise_acc_montgomery_c ✅ 5s 3s +67%
unpack_sk_s1hat ✅ 5s 1s +400%
mld_compute_pack_z ✅ 4s 5s -20%
mld_ct_sel_int32 ✅ 4s 2s +100%
mld_h ✅ 4s 3s +33%
mld_keccakf1600_extract_bytes ✅ 4s 2s +100%
pack_sk_s1 ✅ 4s 3s +33%
pointwise_acc_native_aarch64 ✅ 4s 6s -33%
poly_caddq_c ✅ 4s 5s -20%
poly_challenge ✅ 4s 5s -20%
poly_ntt ✅ 4s 2s +100%
poly_uniform_gamma1 ✅ 4s 3s +33%
polyeta_unpack ✅ 4s 4s +0%
polyveck_reduce ✅ 4s 6s -33%
polyvecl_pointwise_acc_montgomery ✅ 4s 3s +33%
polyz_unpack_c ✅ 4s 9s -56%
rej_uniform_native ✅ 4s 4s +0%
sign_signature ✅ 4s 5s -20%
sign_signature_pre_hash_internal ✅ 4s 3s +33%
sign_signature_pre_hash_shake256 ✅ 4s 7s -43%
intt_native_x86_64 ✅ 3s 4s -25%
keccak_absorb ✅ 3s 3s +0%
keccak_init ✅ 3s 4s -25%
keccakf1600_extract_bytes (big endian) ✅ 3s 3s +0%
keccakf1600_xor_bytes ✅ 3s 4s -25%
keccakf1600x4_extract_bytes ✅ 3s 4s -25%
mld_ct_cmask_neg_i32 ✅ 3s 3s +0%
mld_ct_cmask_nonzero_u32 ✅ 3s 3s +0%
mld_keccakf1600_permute_c ✅ 3s 7s -57%
mld_keccakf1600x4_xor_bytes_c ✅ 3s 2s +50%
ntt_native_aarch64 ✅ 3s 3s +0%
pack_sk_rho_key_tr_s2 ✅ 3s 2s +50%
pointwise_native_x86_64 ✅ 3s 2s +50%
poly_caddq_native_aarch64 ✅ 3s 2s +50%
poly_chknorm_native_aarch64 ✅ 3s 2s +50%
poly_decompose_c ✅ 3s 8s -62%
poly_decompose_native_x86_64 ✅ 3s 2s +50%
poly_pointwise_montgomery ✅ 3s 2s +50%
poly_pointwise_montgomery_native ✅ 3s 4s -25%
poly_reduce ✅ 3s 4s -25%
poly_shiftl ✅ 3s 3s +0%
poly_sub ✅ 3s 4s -25%
poly_uniform_4x ✅ 3s 4s -25%
poly_uniform_gamma1_4x ✅ 3s 3s +0%
poly_use_hint ✅ 3s 3s +0%
poly_use_hint_native_aarch64 ✅ 3s 4s -25%
polyt1_pack ✅ 3s 3s +0%
polyvec_matrix_expand ✅ 3s 6s -50%
polyvec_matrix_pointwise_montgomery_row ✅ 3s 8s -62%
polyveck_invntt_tomont ✅ 3s 7s -57%
polyveck_ntt ✅ 3s 4s -25%
polyz_unpack_native_x86_64 ✅ 3s 3s +0%
rej_eta_c ✅ 3s 4s -25%
rej_uniform_eta_native_aarch64 ✅ 3s 5s -40%
shake128_release ✅ 3s 2s +50%
shake256_absorb ✅ 3s 4s -25%
sign_signature_extmu ✅ 3s 4s -25%
sign_verify ✅ 3s 6s -50%
sign_verify_pre_hash_internal ✅ 3s 5s -40%
sk_s1hat_get_poly ✅ 3s 3s +0%
sk_s2hat_get_poly ✅ 3s 1s +200%
unpack_sk ✅ 3s 3s +0%
use_hint ✅ 3s 2s +50%
yvec_get_poly ✅ 3s 3s +0%
decompose ✅ 2s 4s -50%
keccak_f1600_x1_native_aarch64 ✅ 2s 2s +0%
keccak_f1600_x1_native_aarch64_v84a ✅ 2s 2s +0%
keccak_f1600_x4_native_aarch64_v8a_scalar_hybrid ✅ 2s 3s -33%
keccak_f1600_x4_native_aarch64_v8a_v84a_scalar_hybrid ✅ 2s 3s -33%
keccak_f1600_x4_native_avx2 ✅ 2s 2s +0%
keccak_finalize ✅ 2s 2s +0%
keccak_squeeze ✅ 2s 2s +0%
keccak_squeezeblocks_x4 ✅ 2s 4s -50%
keccakf1600_xor_bytes (big endian) ✅ 2s 2s +0%
keccakf1600x4_extract_bytes_native ✅ 2s 1s +100%
keccakf1600x4_xor_bytes ✅ 2s 2s +0%
keccakf1600x4_xor_bytes_native ✅ 2s 2s +0%
make_hint ✅ 2s 3s -33%
mld_ct_abs_i32 ✅ 2s 6s -67%
mld_ct_cmask_nonzero_u8 ✅ 2s 2s +0%
mld_ct_get_optblocker_u32 ✅ 2s 3s -33%
mld_ct_get_optblocker_u8 ✅ 2s 4s -50%
mld_ct_memcmp ✅ 2s 4s -50%
mld_keccakf1600x4_extract_bytes_c ✅ 2s 2s +0%
mld_prepare_domain_separation_prefix ✅ 2s 4s -50%
mld_sample_s1_s2 ✅ 2s 6s -67%
mld_sample_s1_s2_serial ✅ 2s 3s -33%
mld_sign_attempt ✅ 2s - new
mld_sign_finish ✅ 2s - new
mld_sign_resume ✅ 2s - new
mld_value_barrier_u32 ✅ 2s 4s -50%
mld_value_barrier_u8 ✅ 2s 1s +100%
montgomery_reduce ✅ 2s 1s +100%
pack_sig_c ✅ 2s 3s -33%
pack_sig_z ✅ 2s 1s +100%
pointwise_acc_native_x86_64 ✅ 2s 5s -60%
pointwise_native_aarch64 ✅ 2s 3s -33%
poly_add ✅ 2s 7s -71%
poly_caddq ✅ 2s 3s -33%
poly_chknorm_native ✅ 2s 4s -50%
poly_chknorm_native_x86_64 ✅ 2s 4s -50%
poly_decompose ✅ 2s 2s +0%
poly_decompose_88_native_aarch64 ✅ 2s 2s +0%
poly_invntt_tomont ✅ 2s 5s -60%
poly_invntt_tomont_native ✅ 2s 5s -60%
poly_ntt_native ✅ 2s 2s +0%
poly_power2round ✅ 2s 7s -71%
poly_uniform ✅ 2s 2s +0%
poly_uniform_eta ✅ 2s 5s -60%
poly_use_hint_native ✅ 2s 7s -71%
polyeta_pack ✅ 2s 1s +100%
polyvec_matrix_expand_serial ✅ 2s 3s -33%
polyveck_pack_eta ✅ 2s 3s -33%
polyveck_pack_w1 ✅ 2s 4s -50%
polyveck_unpack_eta ✅ 2s 3s -33%
polyvecl_pack_eta ✅ 2s 2s +0%
polyvecl_pointwise_acc_montgomery_native ✅ 2s 3s -33%
polyvecl_uniform_gamma1_serial ✅ 2s 1s +100%
polyvecl_unpack_eta ✅ 2s 2s +0%
polyz_pack ✅ 2s 3s -33%
polyz_unpack ✅ 2s 3s -33%
polyz_unpack_17_native_aarch64 ✅ 2s 2s +0%
polyz_unpack_19_native_aarch64 ✅ 2s 5s -60%
rej_eta ✅ 2s 5s -60%
rej_eta_native ✅ 2s 3s -33%
rej_uniform_eta_native_x86_64 ✅ 2s - new
shake128_init ✅ 2s 6s -67%
shake128x4_absorb_once ✅ 2s 2s +0%
shake128x4_squeezeblocks ✅ 2s 2s +0%
shake256 ✅ 2s 2s +0%
shake256_init ✅ 2s 4s -50%
shake256_release ✅ 2s 3s -33%
shake256_squeeze ✅ 2s 4s -50%
shake256x4_absorb_once ✅ 2s 2s +0%
shake256x4_squeezeblocks ✅ 2s 2s +0%
sign_verify_extmu ✅ 2s 2s +0%
sk_t0hat_get_poly ✅ 2s 1s +100%
sys_check_capability ✅ 2s 1s +100%
unpack_pk_t1 ✅ 2s 2s +0%
unpack_sk_t0hat ✅ 2s 4s -50%
yvec_init ✅ 2s 5s -60%
caddq ✅ 1s 2s -50%
fqscale ✅ 1s 3s -67%
intt_native_aarch64 ✅ 1s 2s -50%
keccak_f1600_x4_native_aarch64_v84a ✅ 1s 2s -50%
keccakf1600_permute ✅ 1s 4s -75%
keccakf1600_permute_native ✅ 1s 2s -50%
mld_ct_get_optblocker_i64 ✅ 1s 1s +0%
mld_polymat_expand_entry ✅ 1s 3s -67%
mld_value_barrier_i64 ✅ 1s 2s -50%
ntt_native_x86_64 ✅ 1s 5s -80%
nttunpack_native_x86_64 ✅ 1s 3s -67%
pack_sig_h ✅ 1s 2s -50%
poly_caddq_native_x86_64 ✅ 1s 1s +0%
poly_chknorm ✅ 1s 3s -67%
poly_decompose_32_native_aarch64 ✅ 1s 4s -75%
poly_decompose_native ✅ 1s 5s -80%
poly_permute_bitrev_to_custom_optional_native ✅ 1s 3s -67%
poly_use_hint_c ✅ 1s 2s -50%
poly_use_hint_native_x86_64 ✅ 1s - new
polyt1_unpack ✅ 1s 3s -67%
polyveck_chknorm ✅ 1s 36s -97%
polyvecl_uniform_gamma1 ✅ 1s 4s -75%
polyvecl_unpack_z ✅ 1s 1s +0%
polyw1_pack ✅ 1s 3s -67%
polyw1_pack_32 ✅ 1s 2s -50%
polyw1_pack_88 ✅ 1s 3s -67%
polyz_unpack_native ✅ 1s 3s -67%
power2round ✅ 1s 2s -50%
reduce32 ✅ 1s 2s -50%
rej_uniform_native_aarch64 ✅ 1s 5s -80%
shake128_absorb ✅ 1s 2s -50%
shake128_finalize ✅ 1s 2s -50%
shake128_squeeze ✅ 1s 3s -67%
shake256_finalize ✅ 1s 1s +0%
unpack_sk_s2hat ✅ 1s 3s -67%

@oqs-bot

oqs-bot commented Aug 28, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

CBMC Results (ML-DSA-44)

⚠️ Attention Required

Proof Status Current Previous Change
**TOTAL** ⚠️ 1897s 1514s +25.3%
compute_pack_t0_t1 ⚠️ 101s 50s +102%
mld_attempt_signature_generation ⚠️ 311s 58s +436%
sig_unpack_hints ⚠️ 21s 2s +950%
sign_keypair_internal ⚠️ 21s 4s +425%
sign_pk_from_sk ⚠️ 40s 5s +700%
sign_signature_internal ⚠️ 98s 26s +277%
sign_verify_internal ⚠️ 304s 114s +167%
Full Results (210 proofs)
Proof Status Current Previous Change
**TOTAL** ⚠️ 1897s 1514s +25.3%
mld_attempt_signature_generation ⚠️ 311s 58s +436%
sign_verify_internal ⚠️ 304s 114s +167%
polyvecl_pointwise_acc_montgomery_c ✅ 157s 131s +20%
poly_pointwise_montgomery_c ✅ 147s 114s +29%
compute_pack_t0_t1 ⚠️ 101s 50s +102%
sign_signature_internal ⚠️ 98s 26s +277%
mld_invntt_layer ✅ 60s 107s -44%
sign_pk_from_sk ⚠️ 40s 5s +700%
fqmul ✅ 24s 39s -38%
mld_ntt_layer ✅ 24s 42s -43%
sig_unpack_hints ⚠️ 21s 2s +950%
sign_keypair_internal ⚠️ 21s 4s +425%
polyvec_matrix_expand ✅ 20s 28s -29%
mld_ntt_butterfly_block ✅ 13s 23s -43%
keccakf1600x4_permute_native ✅ 11s 22s -50%
poly_ntt_c ✅ 11s 19s -42%
polyeta_unpack ✅ 10s 14s -29%
polyvec_matrix_pointwise_montgomery_yvec ✅ 10s 15s -33%
rej_uniform ✅ 10s 18s -44%
polyt0_unpack ✅ 9s 15s -40%
poly_uniform_eta_4x ✅ 8s 11s -27%
rej_uniform_c ✅ 8s 15s -47%
rej_uniform_native_x86_64 ✅ 8s - new
sign_keypair ✅ 7s 4s +75%
keccak_absorb_once_x4 ✅ 6s 9s -33%
keccak_squeezeblocks_x4 ✅ 6s 4s +50%
poly_chknorm_c ✅ 6s 17s -65%
poly_invntt_tomont_c ✅ 6s 11s -45%
polyz_unpack_c ✅ 6s 11s -45%
sign_signature_pre_hash_internal ✅ 6s 6s +0%
mld_check_pct ✅ 5s 14s -64%
mld_compute_pack_z ✅ 5s 7s -29%
mld_h ✅ 5s 4s +25%
poly_add ✅ 5s 7s -29%
poly_uniform_4x ✅ 5s 14s -64%
poly_use_hint_native_x86_64 ✅ 5s - new
polyveck_caddq ✅ 5s 3s +67%
power2round ✅ 5s 3s +67%
sign_signature_pre_hash_shake256 ✅ 5s 3s +67%
make_hint ✅ 4s 3s +33%
mld_keccakf1600_permute_c ✅ 4s 8s -50%
pack_sig_z ✅ 4s 4s +0%
pack_sk_s1 ✅ 4s 2s +100%
pointwise_native_x86_64 ✅ 4s 4s +0%
poly_caddq ✅ 4s 2s +100%
poly_decompose_c ✅ 4s 4s +0%
poly_power2round ✅ 4s 4s +0%
poly_reduce ✅ 4s 3s +33%
poly_use_hint_c ✅ 4s 3s +33%
poly_use_hint_native_aarch64 ✅ 4s 2s +100%
polyt0_pack ✅ 4s 2s +100%
polyveck_decompose ✅ 4s 4s +0%
polyveck_invntt_tomont ✅ 4s 5s -20%
polyz_unpack_19_native_aarch64 ✅ 4s 5s -20%
rej_uniform_native ✅ 4s 4s +0%
shake128_finalize ✅ 4s 2s +100%
sign_signature ✅ 4s 3s +33%
sign_signature_extmu ✅ 4s 4s +0%
caddq ✅ 3s 2s +50%
fqscale ✅ 3s 3s +0%
keccak_absorb ✅ 3s 5s -40%
keccak_f1600_x1_native_aarch64 ✅ 3s 2s +50%
keccak_squeeze ✅ 3s 1s +200%
keccakf1600x4_permute ✅ 3s 4s -25%
mld_ct_abs_i32 ✅ 3s 2s +50%
mld_ct_get_optblocker_i64 ✅ 3s 4s -25%
mld_sample_s1_s2 ✅ 3s 4s -25%
mld_sample_s1_s2_serial ✅ 3s 3s +0%
mld_sign_resume ✅ 3s - new
ntt_native_aarch64 ✅ 3s 3s +0%
ntt_native_x86_64 ✅ 3s 3s +0%
nttunpack_native_x86_64 ✅ 3s 1s +200%
pack_sig_h ✅ 3s 3s +0%
pointwise_acc_native_x86_64 ✅ 3s 7s -57%
poly_caddq_native_x86_64 ✅ 3s 4s -25%
poly_challenge ✅ 3s 3s +0%
poly_chknorm ✅ 3s 4s -25%
poly_decompose_native ✅ 3s 3s +0%
poly_invntt_tomont ✅ 3s 4s -25%
poly_ntt_native ✅ 3s 5s -40%
poly_sub ✅ 3s 3s +0%
poly_uniform_gamma1_4x ✅ 3s 5s -40%
polyt1_pack ✅ 3s 4s -25%
polyt1_unpack ✅ 3s 5s -40%
polyveck_chknorm ✅ 3s 5s -40%
polyveck_unpack_eta ✅ 3s 2s +50%
polyvecl_chknorm ✅ 3s 10s -70%
polyvecl_ntt ✅ 3s 2s +50%
polyz_unpack ✅ 3s 3s +0%
reduce32 ✅ 3s 2s +50%
rej_eta ✅ 3s 3s +0%
rej_eta_c ✅ 3s 4s -25%
rej_eta_native ✅ 3s 6s -50%
rej_uniform_native_aarch64 ✅ 3s 5s -40%
shake128_squeeze ✅ 3s 1s +200%
shake128x4_absorb_once ✅ 3s 3s +0%
shake256_init ✅ 3s 3s +0%
shake256_squeeze ✅ 3s 2s +50%
sign_verify_extmu ✅ 3s 3s +0%
sign_verify_pre_hash_internal ✅ 3s 3s +0%
sign_verify_pre_hash_shake256 ✅ 3s 5s -40%
sys_check_capability ✅ 3s 4s -25%
unpack_sk_s2hat ✅ 3s 4s -25%
unpack_sk_t0hat ✅ 3s 3s +0%
decompose ✅ 2s 2s +0%
intt_native_aarch64 ✅ 2s 9s -78%
keccak_f1600_x4_native_aarch64_v8a_scalar_hybrid ✅ 2s 3s -33%
keccak_finalize ✅ 2s 3s -33%
keccak_init ✅ 2s 3s -33%
keccakf1600_extract_bytes (big endian) ✅ 2s 2s +0%
keccakf1600_permute ✅ 2s 2s +0%
keccakf1600_xor_bytes ✅ 2s 1s +100%
keccakf1600x4_xor_bytes_native ✅ 2s 3s -33%
mld_ct_cmask_nonzero_u32 ✅ 2s 2s +0%
mld_ct_cmask_nonzero_u8 ✅ 2s 2s +0%
mld_ct_get_optblocker_u8 ✅ 2s 1s +100%
mld_ct_sel_int32 ✅ 2s 2s +0%
mld_polymat_expand_entry ✅ 2s 3s -33%
mld_sign_attempt ✅ 2s - new
mld_sign_finish ✅ 2s - new
mld_value_barrier_i64 ✅ 2s 2s +0%
pack_sig_c ✅ 2s 2s +0%
pack_sk_rho_key_tr_s2 ✅ 2s 3s -33%
pointwise_acc_native_aarch64 ✅ 2s 4s -50%
poly_caddq_c ✅ 2s 2s +0%
poly_caddq_native ✅ 2s 5s -60%
poly_caddq_native_aarch64 ✅ 2s 4s -50%
poly_chknorm_native ✅ 2s 4s -50%
poly_chknorm_native_aarch64 ✅ 2s 4s -50%
poly_chknorm_native_x86_64 ✅ 2s 2s +0%
poly_decompose ✅ 2s 3s -33%
poly_decompose_32_native_aarch64 ✅ 2s 2s +0%
poly_decompose_88_native_aarch64 ✅ 2s 4s -50%
poly_decompose_native_x86_64 ✅ 2s 3s -33%
poly_invntt_tomont_native ✅ 2s 4s -50%
poly_ntt ✅ 2s 3s -33%
poly_permute_bitrev_to_custom_optional ✅ 2s 2s +0%
poly_pointwise_montgomery ✅ 2s 3s -33%
poly_shiftl ✅ 2s 3s -33%
poly_uniform_eta ✅ 2s 5s -60%
poly_uniform_gamma1 ✅ 2s 4s -50%
poly_use_hint ✅ 2s 4s -50%
poly_use_hint_native ✅ 2s 4s -50%
polyvec_matrix_expand_serial ✅ 2s 8s -75%
polyvec_matrix_pointwise_montgomery_row ✅ 2s 2s +0%
polyveck_ntt ✅ 2s 5s -60%
polyveck_pack_eta ✅ 2s 2s +0%
polyveck_pack_w1 ✅ 2s 1s +100%
polyveck_reduce ✅ 2s 5s -60%
polyvecl_pack_eta ✅ 2s 3s -33%
polyvecl_pointwise_acc_montgomery_native ✅ 2s 2s +0%
polyvecl_uniform_gamma1_serial ✅ 2s 2s +0%
polyvecl_unpack_z ✅ 2s 2s +0%
polyw1_pack_32 ✅ 2s 2s +0%
polyz_unpack_native ✅ 2s 2s +0%
polyz_unpack_native_x86_64 ✅ 2s 3s -33%
rej_uniform_eta_native_aarch64 ✅ 2s 2s +0%
rej_uniform_eta_native_x86_64 ✅ 2s - new
shake128_absorb ✅ 2s 2s +0%
shake128x4_squeezeblocks ✅ 2s 1s +100%
shake256 ✅ 2s 1s +100%
shake256_absorb ✅ 2s 3s -33%
shake256x4_squeezeblocks ✅ 2s 4s -50%
sk_s1hat_get_poly ✅ 2s 3s -33%
unpack_sk ✅ 2s 3s -33%
use_hint ✅ 2s 2s +0%
yvec_get_poly ✅ 2s 3s -33%
intt_native_x86_64 ✅ 1s 4s -75%
keccak_f1600_x1_native_aarch64_v84a ✅ 1s 3s -67%
keccak_f1600_x4_native_aarch64_v84a ✅ 1s 2s -50%
keccak_f1600_x4_native_aarch64_v8a_v84a_scalar_hybrid ✅ 1s 1s +0%
keccak_f1600_x4_native_avx2 ✅ 1s 3s -67%
keccakf1600_permute_native ✅ 1s 3s -67%
keccakf1600_xor_bytes (big endian) ✅ 1s 4s -75%
keccakf1600x4_extract_bytes ✅ 1s 2s -50%
keccakf1600x4_extract_bytes_native ✅ 1s 3s -67%
keccakf1600x4_xor_bytes ✅ 1s 2s -50%
mld_ct_cmask_neg_i32 ✅ 1s 3s -67%
mld_ct_get_optblocker_u32 ✅ 1s 1s +0%
mld_ct_memcmp ✅ 1s 3s -67%
mld_keccakf1600_extract_bytes ✅ 1s 2s -50%
mld_keccakf1600x4_extract_bytes_c ✅ 1s 2s -50%
mld_keccakf1600x4_xor_bytes_c ✅ 1s 2s -50%
mld_prepare_domain_separation_prefix ✅ 1s 4s -75%
mld_value_barrier_u32 ✅ 1s 2s -50%
mld_value_barrier_u8 ✅ 1s 3s -67%
montgomery_reduce ✅ 1s 3s -67%
pointwise_native_aarch64 ✅ 1s 5s -80%
poly_permute_bitrev_to_custom_optional_native ✅ 1s 4s -75%
poly_pointwise_montgomery_native ✅ 1s 2s -50%
poly_uniform ✅ 1s 6s -83%
polyeta_pack ✅ 1s 3s -67%
polyvecl_pointwise_acc_montgomery ✅ 1s 4s -75%
polyvecl_uniform_gamma1 ✅ 1s 3s -67%
polyvecl_unpack_eta ✅ 1s 2s -50%
polyw1_pack ✅ 1s 3s -67%
polyw1_pack_88 ✅ 1s 1s +0%
polyz_pack ✅ 1s 2s -50%
polyz_unpack_17_native_aarch64 ✅ 1s 5s -80%
shake128_init ✅ 1s 3s -67%
shake128_release ✅ 1s 1s +0%
shake256_finalize ✅ 1s 2s -50%
shake256_release ✅ 1s 2s -50%
shake256x4_absorb_once ✅ 1s 3s -67%
sign_verify ✅ 1s 4s -75%
sk_s2hat_get_poly ✅ 1s 2s -50%
sk_t0hat_get_poly ✅ 1s 2s -50%
unpack_pk_t1 ✅ 1s 5s -80%
unpack_sk_s1hat ✅ 1s 1s +0%
yvec_init ✅ 1s 3s -67%

@oqs-bot

oqs-bot commented Aug 28, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

CBMC Results (ML-DSA-87, REDUCE-RAM)

⚠️ Attention Required

Proof Status Current Previous Change
compute_pack_t0_t1 ⚠️ 28s 12s +133%
mld_attempt_signature_generation ⚠️ 233s 34s +585%
sign_keypair_internal ⚠️ 44s 6s +633%
sign_pk_from_sk ⚠️ 62s 6s +933%
sign_verify_internal ⚠️ 298s 47s +534%
Full Results (210 proofs)
Proof Status Current Previous Change
**TOTAL** ✅ 1567s 1436s +9.1%
sign_verify_internal ⚠️ 298s 47s +534%
mld_attempt_signature_generation ⚠️ 233s 34s +585%
polyvec_matrix_pointwise_montgomery_yvec ✅ 187s 196s -5%
poly_pointwise_montgomery_c ✅ 62s 125s -50%
sign_pk_from_sk ⚠️ 62s 6s +933%
mld_invntt_layer ✅ 55s 111s -50%
sign_keypair_internal ⚠️ 44s 6s +633%
compute_pack_t0_t1 ⚠️ 28s 12s +133%
fqmul ✅ 22s 39s -44%
mld_ntt_layer ✅ 20s 44s -55%
sign_signature_internal ✅ 13s 3s +333%
keccakf1600x4_permute_native ✅ 12s 25s -52%
sig_unpack_hints ✅ 12s 4s +200%
polyt0_unpack ✅ 11s 14s -21%
rej_uniform_c ✅ 11s 18s -39%
mld_ntt_butterfly_block ✅ 10s 23s -57%
rej_uniform ✅ 10s 7s +43%
poly_ntt_c ✅ 8s 19s -58%
polyeta_unpack ✅ 8s 13s -38%
polyveck_decompose ✅ 8s 12s -33%
rej_uniform_native_x86_64 ✅ 8s - new
keccak_absorb_once_x4 ✅ 7s 8s -12%
poly_invntt_tomont_c ✅ 6s 9s -33%
poly_uniform_eta_4x ✅ 6s 12s -50%
sign_signature_pre_hash_shake256 ✅ 6s 3s +100%
mld_check_pct ✅ 5s 15s -67%
poly_chknorm_c ✅ 5s 13s -62%
poly_decompose_native_x86_64 ✅ 5s 3s +67%
poly_uniform_4x ✅ 5s 3s +67%
polyt0_pack ✅ 5s 3s +67%
polyvec_matrix_pointwise_montgomery_row ✅ 5s 13s -62%
polyvecl_ntt ✅ 5s 8s -38%
sign_keypair ✅ 5s 4s +25%
sign_verify ✅ 5s 2s +150%
keccak_absorb ✅ 4s 4s +0%
mld_keccakf1600_permute_c ✅ 4s 8s -50%
mld_sign_finish ✅ 4s - new
pack_sk_s1 ✅ 4s 2s +100%
pointwise_acc_native_x86_64 ✅ 4s 8s -50%
poly_add ✅ 4s 8s -50%
poly_caddq_native ✅ 4s 3s +33%
poly_chknorm_native_x86_64 ✅ 4s 2s +100%
poly_decompose_c ✅ 4s 6s -33%
polyvec_matrix_expand ✅ 4s 3s +33%
polyveck_invntt_tomont ✅ 4s 4s +0%
polyvecl_chknorm ✅ 4s 38s -89%
unpack_sk_t0hat ✅ 4s 4s +0%
yvec_init ✅ 4s 4s +0%
caddq ✅ 3s 3s +0%
keccak_f1600_x4_native_aarch64_v8a_v84a_scalar_hybrid ✅ 3s 2s +50%
keccak_init ✅ 3s 1s +200%
keccakf1600_xor_bytes (big endian) ✅ 3s 2s +50%
mld_ct_cmask_neg_i32 ✅ 3s 2s +50%
mld_polymat_expand_entry ✅ 3s 4s -25%
mld_prepare_domain_separation_prefix ✅ 3s 3s +0%
mld_sample_s1_s2 ✅ 3s 8s -62%
mld_sample_s1_s2_serial ✅ 3s 6s -50%
mld_sign_attempt ✅ 3s - new
nttunpack_native_x86_64 ✅ 3s 3s +0%
pack_sig_h ✅ 3s 3s +0%
pack_sk_rho_key_tr_s2 ✅ 3s 2s +50%
pointwise_acc_native_aarch64 ✅ 3s 5s -40%
poly_caddq ✅ 3s 5s -40%
poly_challenge ✅ 3s 4s -25%
poly_decompose_88_native_aarch64 ✅ 3s 2s +50%
poly_invntt_tomont_native ✅ 3s 2s +50%
poly_ntt ✅ 3s 2s +50%
poly_ntt_native ✅ 3s 4s -25%
poly_permute_bitrev_to_custom_optional_native ✅ 3s 3s +0%
poly_pointwise_montgomery ✅ 3s 3s +0%
poly_power2round ✅ 3s 7s -57%
poly_uniform_eta ✅ 3s 5s -40%
poly_use_hint ✅ 3s 4s -25%
poly_use_hint_native_aarch64 ✅ 3s 3s +0%
poly_use_hint_native_x86_64 ✅ 3s - new
polyeta_pack ✅ 3s 3s +0%
polyt1_unpack ✅ 3s 3s +0%
polyveck_caddq ✅ 3s 8s -62%
polyveck_chknorm ✅ 3s 9s -67%
polyvecl_pointwise_acc_montgomery_c ✅ 3s 2s +50%
polyw1_pack_32 ✅ 3s 3s +0%
polyz_pack ✅ 3s 4s -25%
polyz_unpack ✅ 3s 3s +0%
sign_signature_pre_hash_internal ✅ 3s 2s +50%
sign_verify_pre_hash_shake256 ✅ 3s 7s -57%
unpack_pk_t1 ✅ 3s 2s +50%
yvec_get_poly ✅ 3s 2s +50%
decompose ✅ 2s 2s +0%
fqscale ✅ 2s 1s +100%
intt_native_aarch64 ✅ 2s 4s -50%
intt_native_x86_64 ✅ 2s 4s -50%
keccak_f1600_x4_native_aarch64_v84a ✅ 2s 1s +100%
keccak_finalize ✅ 2s 1s +100%
keccak_squeezeblocks_x4 ✅ 2s 4s -50%
keccakf1600_extract_bytes (big endian) ✅ 2s 3s -33%
keccakf1600_xor_bytes ✅ 2s 1s +100%
keccakf1600x4_extract_bytes ✅ 2s 1s +100%
keccakf1600x4_extract_bytes_native ✅ 2s 4s -50%
keccakf1600x4_xor_bytes ✅ 2s 1s +100%
keccakf1600x4_xor_bytes_native ✅ 2s 2s +0%
make_hint ✅ 2s 2s +0%
mld_ct_abs_i32 ✅ 2s 1s +100%
mld_ct_get_optblocker_u8 ✅ 2s 3s -33%
mld_ct_memcmp ✅ 2s 1s +100%
mld_h ✅ 2s 2s +0%
mld_keccakf1600_extract_bytes ✅ 2s 1s +100%
mld_keccakf1600x4_extract_bytes_c ✅ 2s 3s -33%
mld_sign_resume ✅ 2s - new
ntt_native_aarch64 ✅ 2s 4s -50%
pointwise_native_aarch64 ✅ 2s 4s -50%
poly_caddq_c ✅ 2s 3s -33%
poly_caddq_native_aarch64 ✅ 2s 3s -33%
poly_caddq_native_x86_64 ✅ 2s 3s -33%
poly_chknorm ✅ 2s 4s -50%
poly_chknorm_native_aarch64 ✅ 2s 5s -60%
poly_decompose_32_native_aarch64 ✅ 2s 3s -33%
poly_decompose_native ✅ 2s 2s +0%
poly_reduce ✅ 2s 4s -50%
poly_sub ✅ 2s 5s -60%
poly_uniform ✅ 2s 4s -50%
poly_uniform_gamma1 ✅ 2s 3s -33%
poly_uniform_gamma1_4x ✅ 2s 3s -33%
poly_use_hint_c ✅ 2s 4s -50%
poly_use_hint_native ✅ 2s 1s +100%
polyvec_matrix_expand_serial ✅ 2s 3s -33%
polyveck_ntt ✅ 2s 3s -33%
polyveck_pack_eta ✅ 2s 5s -60%
polyveck_reduce ✅ 2s 6s -67%
polyvecl_pack_eta ✅ 2s 2s +0%
polyvecl_pointwise_acc_montgomery ✅ 2s 2s +0%
polyvecl_pointwise_acc_montgomery_native ✅ 2s 2s +0%
polyvecl_uniform_gamma1 ✅ 2s 3s -33%
polyvecl_unpack_eta ✅ 2s 3s -33%
polyvecl_unpack_z ✅ 2s 3s -33%
polyw1_pack ✅ 2s 2s +0%
polyw1_pack_88 ✅ 2s 2s +0%
polyz_unpack_17_native_aarch64 ✅ 2s 4s -50%
polyz_unpack_19_native_aarch64 ✅ 2s 5s -60%
polyz_unpack_c ✅ 2s 7s -71%
polyz_unpack_native ✅ 2s 1s +100%
polyz_unpack_native_x86_64 ✅ 2s 3s -33%
power2round ✅ 2s 3s -33%
reduce32 ✅ 2s 3s -33%
rej_eta ✅ 2s 2s +0%
rej_eta_native ✅ 2s 4s -50%
rej_uniform_eta_native_aarch64 ✅ 2s 3s -33%
rej_uniform_eta_native_x86_64 ✅ 2s - new
rej_uniform_native_aarch64 ✅ 2s 3s -33%
shake128x4_absorb_once ✅ 2s 4s -50%
shake256 ✅ 2s 3s -33%
shake256_absorb ✅ 2s 3s -33%
shake256_finalize ✅ 2s 3s -33%
shake256_init ✅ 2s 3s -33%
shake256_release ✅ 2s 5s -60%
shake256_squeeze ✅ 2s 2s +0%
shake256x4_absorb_once ✅ 2s 5s -60%
shake256x4_squeezeblocks ✅ 2s 4s -50%
sign_signature ✅ 2s 4s -50%
sign_signature_extmu ✅ 2s 4s -50%
sign_verify_extmu ✅ 2s 4s -50%
sk_s1hat_get_poly ✅ 2s 3s -33%
sk_s2hat_get_poly ✅ 2s 2s +0%
sk_t0hat_get_poly ✅ 2s 3s -33%
unpack_sk ✅ 2s 4s -50%
unpack_sk_s2hat ✅ 2s 3s -33%
use_hint ✅ 2s 3s -33%
keccak_f1600_x1_native_aarch64 ✅ 1s 2s -50%
keccak_f1600_x1_native_aarch64_v84a ✅ 1s 2s -50%
keccak_f1600_x4_native_aarch64_v8a_scalar_hybrid ✅ 1s 2s -50%
keccak_f1600_x4_native_avx2 ✅ 1s 3s -67%
keccak_squeeze ✅ 1s 5s -80%
keccakf1600_permute ✅ 1s 2s -50%
keccakf1600_permute_native ✅ 1s 3s -67%
keccakf1600x4_permute ✅ 1s 2s -50%
mld_compute_pack_z ✅ 1s 6s -83%
mld_ct_cmask_nonzero_u32 ✅ 1s 5s -80%
mld_ct_cmask_nonzero_u8 ✅ 1s 2s -50%
mld_ct_get_optblocker_i64 ✅ 1s 2s -50%
mld_ct_get_optblocker_u32 ✅ 1s 2s -50%
mld_ct_sel_int32 ✅ 1s 2s -50%
mld_keccakf1600x4_xor_bytes_c ✅ 1s 1s +0%
mld_value_barrier_i64 ✅ 1s 2s -50%
mld_value_barrier_u32 ✅ 1s 3s -67%
mld_value_barrier_u8 ✅ 1s 2s -50%
montgomery_reduce ✅ 1s 2s -50%
ntt_native_x86_64 ✅ 1s 2s -50%
pack_sig_c ✅ 1s 2s -50%
pack_sig_z ✅ 1s 3s -67%
pointwise_native_x86_64 ✅ 1s 5s -80%
poly_chknorm_native ✅ 1s 1s +0%
poly_decompose ✅ 1s 2s -50%
poly_invntt_tomont ✅ 1s 4s -75%
poly_permute_bitrev_to_custom_optional ✅ 1s 2s -50%
poly_pointwise_montgomery_native ✅ 1s 3s -67%
poly_shiftl ✅ 1s 4s -75%
polyt1_pack ✅ 1s 5s -80%
polyveck_pack_w1 ✅ 1s 3s -67%
polyveck_unpack_eta ✅ 1s 3s -67%
polyvecl_uniform_gamma1_serial ✅ 1s 2s -50%
rej_eta_c ✅ 1s 4s -75%
rej_uniform_native ✅ 1s 5s -80%
shake128_absorb ✅ 1s 2s -50%
shake128_finalize ✅ 1s 2s -50%
shake128_init ✅ 1s 2s -50%
shake128_release ✅ 1s 3s -67%
shake128_squeeze ✅ 1s 1s +0%
shake128x4_squeezeblocks ✅ 1s 1s +0%
sign_verify_pre_hash_internal ✅ 1s 3s -67%
sys_check_capability ✅ 1s 2s -50%
unpack_sk_s1hat ✅ 1s 3s -67%

@oqs-bot

oqs-bot commented Aug 28, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

CBMC Results (ML-DSA-65)

⚠️ Attention Required

Proof Status Current Previous Change
compute_pack_t0_t1 ⚠️ 121s 13s +831%
mld_attempt_signature_generation ⚠️ 237s 63s +276%
sig_unpack_hints ⚠️ 26s 2s +1200%
sign_keypair_internal ⚠️ 21s 5s +320%
sign_pk_from_sk ⚠️ 41s 6s +583%
sign_signature_internal ⚠️ 186s 55s +238%
sign_verify_internal ⚠️ 355s 177s +101%
Full Results (210 proofs)
Proof Status Current Previous Change
**TOTAL** ✅ 2027s 1784s +13.6%
sign_verify_internal ⚠️ 355s 177s +101%
mld_attempt_signature_generation ⚠️ 237s 63s +276%
sign_signature_internal ⚠️ 186s 55s +238%
polyvecl_pointwise_acc_montgomery_c ✅ 158s 210s -25%
poly_pointwise_montgomery_c ✅ 134s 125s +7%
compute_pack_t0_t1 ⚠️ 121s 13s +831%
polyvec_matrix_expand ✅ 70s 110s -36%
mld_invntt_layer ✅ 56s 109s -49%
sign_pk_from_sk ⚠️ 41s 6s +583%
sig_unpack_hints ⚠️ 26s 2s +1200%
fqmul ✅ 23s 40s -43%
sign_keypair_internal ⚠️ 21s 5s +320%
mld_ntt_layer ✅ 20s 41s -51%
polyvec_matrix_expand_serial ✅ 17s 27s -37%
polyveck_ntt ✅ 15s 7s +114%
keccakf1600x4_permute_native ✅ 13s 23s -43%
mld_ntt_butterfly_block ✅ 12s 24s -50%
poly_ntt_c ✅ 9s 19s -53%
polyt0_unpack ✅ 9s 16s -44%
polyveck_decompose ✅ 9s 12s -25%
rej_uniform_c ✅ 9s 14s -36%
poly_chknorm_c ✅ 8s 15s -47%
mld_check_pct ✅ 7s 14s -50%
polyvec_matrix_pointwise_montgomery_yvec ✅ 7s 18s -61%
rej_uniform ✅ 7s 18s -61%
sign_verify_pre_hash_internal ✅ 7s 5s +40%
poly_decompose_c ✅ 6s 5s +20%
poly_invntt_tomont_c ✅ 6s 11s -45%
poly_uniform_eta_4x ✅ 6s 14s -57%
rej_uniform_native_x86_64 ✅ 6s - new
sign_verify_pre_hash_shake256 ✅ 6s 5s +20%
keccak_absorb_once_x4 ✅ 5s 8s -38%
mld_ct_sel_int32 ✅ 5s 3s +67%
mld_sample_s1_s2 ✅ 5s 6s -17%
poly_uniform_4x ✅ 5s 13s -62%
keccak_squeezeblocks_x4 ✅ 4s 5s -20%
mld_compute_pack_z ✅ 4s 7s -43%
mld_keccakf1600_permute_c ✅ 4s 6s -33%
mld_sign_resume ✅ 4s - new
ntt_native_x86_64 ✅ 4s 2s +100%
pack_sig_h ✅ 4s 5s -20%
poly_caddq_native_x86_64 ✅ 4s 3s +33%
poly_chknorm ✅ 4s 4s +0%
poly_decompose ✅ 4s 2s +100%
poly_invntt_tomont ✅ 4s 3s +33%
poly_ntt_native ✅ 4s 4s +0%
poly_power2round ✅ 4s 4s +0%
poly_use_hint_c ✅ 4s 5s -20%
poly_use_hint_native ✅ 4s 2s +100%
polyveck_caddq ✅ 4s 6s -33%
polyvecl_ntt ✅ 4s 4s +0%
polyw1_pack_32 ✅ 4s 4s +0%
polyz_unpack ✅ 4s 3s +33%
polyz_unpack_c ✅ 4s 13s -69%
polyz_unpack_native_x86_64 ✅ 4s 3s +33%
rej_uniform_eta_native_x86_64 ✅ 4s - new
sign_keypair ✅ 4s 3s +33%
sign_signature_pre_hash_internal ✅ 4s 3s +33%
sign_signature_pre_hash_shake256 ✅ 4s 3s +33%
intt_native_x86_64 ✅ 3s 3s +0%
keccak_absorb ✅ 3s 3s +0%
keccak_f1600_x1_native_aarch64 ✅ 3s 2s +50%
keccakf1600x4_xor_bytes_native ✅ 3s 3s +0%
mld_ct_abs_i32 ✅ 3s 2s +50%
mld_ct_cmask_neg_i32 ✅ 3s 2s +50%
mld_ct_get_optblocker_u32 ✅ 3s 3s +0%
mld_keccakf1600_extract_bytes ✅ 3s 1s +200%
mld_polymat_expand_entry ✅ 3s 4s -25%
mld_sign_attempt ✅ 3s - new
mld_sign_finish ✅ 3s - new
montgomery_reduce ✅ 3s 4s -25%
pack_sk_rho_key_tr_s2 ✅ 3s 2s +50%
pack_sk_s1 ✅ 3s 5s -40%
pointwise_acc_native_x86_64 ✅ 3s 8s -62%
poly_add ✅ 3s 9s -67%
poly_caddq ✅ 3s 2s +50%
poly_caddq_c ✅ 3s 2s +50%
poly_challenge ✅ 3s 6s -50%
poly_chknorm_native ✅ 3s 2s +50%
poly_decompose_native ✅ 3s 3s +0%
poly_ntt ✅ 3s 2s +50%
poly_pointwise_montgomery ✅ 3s 3s +0%
poly_uniform ✅ 3s 4s -25%
poly_uniform_gamma1 ✅ 3s 3s +0%
poly_use_hint ✅ 3s 3s +0%
poly_use_hint_native_aarch64 ✅ 3s 3s +0%
polyveck_pack_eta ✅ 3s 4s -25%
polyveck_pack_w1 ✅ 3s 3s +0%
polyvecl_pointwise_acc_montgomery_native ✅ 3s 2s +50%
polyvecl_unpack_eta ✅ 3s 3s +0%
polyvecl_unpack_z ✅ 3s 3s +0%
rej_eta_native ✅ 3s 3s +0%
shake128_absorb ✅ 3s 2s +50%
shake128_squeeze ✅ 3s 2s +50%
shake128x4_squeezeblocks ✅ 3s 3s +0%
shake256x4_absorb_once ✅ 3s 3s +0%
sign_signature_extmu ✅ 3s 2s +50%
sk_s1hat_get_poly ✅ 3s 6s -50%
sk_t0hat_get_poly ✅ 3s 2s +50%
unpack_sk_s1hat ✅ 3s 2s +50%
unpack_sk_s2hat ✅ 3s 4s -25%
fqscale ✅ 2s 3s -33%
keccak_f1600_x4_native_avx2 ✅ 2s 2s +0%
keccak_squeeze ✅ 2s 4s -50%
keccakf1600_xor_bytes ✅ 2s 2s +0%
keccakf1600_xor_bytes (big endian) ✅ 2s 2s +0%
keccakf1600x4_extract_bytes_native ✅ 2s 4s -50%
keccakf1600x4_permute ✅ 2s 4s -50%
keccakf1600x4_xor_bytes ✅ 2s 1s +100%
mld_ct_cmask_nonzero_u8 ✅ 2s 3s -33%
mld_ct_get_optblocker_i64 ✅ 2s 2s +0%
mld_ct_get_optblocker_u8 ✅ 2s 2s +0%
mld_ct_memcmp ✅ 2s 2s +0%
mld_keccakf1600x4_extract_bytes_c ✅ 2s 3s -33%
mld_keccakf1600x4_xor_bytes_c ✅ 2s 2s +0%
mld_sample_s1_s2_serial ✅ 2s 4s -50%
mld_value_barrier_i64 ✅ 2s 2s +0%
mld_value_barrier_u8 ✅ 2s 3s -33%
ntt_native_aarch64 ✅ 2s 2s +0%
nttunpack_native_x86_64 ✅ 2s 3s -33%
pointwise_acc_native_aarch64 ✅ 2s 6s -67%
pointwise_native_aarch64 ✅ 2s 5s -60%
pointwise_native_x86_64 ✅ 2s 3s -33%
poly_caddq_native_aarch64 ✅ 2s 2s +0%
poly_chknorm_native_aarch64 ✅ 2s 3s -33%
poly_chknorm_native_x86_64 ✅ 2s 3s -33%
poly_decompose_32_native_aarch64 ✅ 2s 3s -33%
poly_decompose_88_native_aarch64 ✅ 2s 1s +100%
poly_decompose_native_x86_64 ✅ 2s 3s -33%
poly_permute_bitrev_to_custom_optional ✅ 2s 2s +0%
poly_permute_bitrev_to_custom_optional_native ✅ 2s 4s -50%
poly_pointwise_montgomery_native ✅ 2s 3s -33%
poly_reduce ✅ 2s 3s -33%
poly_uniform_eta ✅ 2s 4s -50%
poly_uniform_gamma1_4x ✅ 2s 4s -50%
poly_use_hint_native_x86_64 ✅ 2s - new
polyeta_pack ✅ 2s 3s -33%
polyeta_unpack ✅ 2s 8s -75%
polyt1_pack ✅ 2s 3s -33%
polyt1_unpack ✅ 2s 5s -60%
polyveck_chknorm ✅ 2s 6s -67%
polyveck_invntt_tomont ✅ 2s 8s -75%
polyveck_unpack_eta ✅ 2s 6s -67%
polyvecl_chknorm ✅ 2s 7s -71%
polyvecl_pack_eta ✅ 2s 3s -33%
polyvecl_pointwise_acc_montgomery ✅ 2s 3s -33%
polyvecl_uniform_gamma1 ✅ 2s 2s +0%
polyw1_pack ✅ 2s 4s -50%
polyw1_pack_88 ✅ 2s 2s +0%
polyz_unpack_19_native_aarch64 ✅ 2s 3s -33%
power2round ✅ 2s 1s +100%
rej_eta ✅ 2s 2s +0%
rej_eta_c ✅ 2s 5s -60%
rej_uniform_eta_native_aarch64 ✅ 2s 4s -50%
shake128_finalize ✅ 2s 1s +100%
shake128_init ✅ 2s 2s +0%
shake128_release ✅ 2s 3s -33%
shake128x4_absorb_once ✅ 2s 3s -33%
shake256 ✅ 2s 2s +0%
shake256_finalize ✅ 2s 1s +100%
shake256_squeeze ✅ 2s 3s -33%
shake256x4_squeezeblocks ✅ 2s 2s +0%
sign_verify ✅ 2s 3s -33%
sign_verify_extmu ✅ 2s 3s -33%
sys_check_capability ✅ 2s 4s -50%
unpack_pk_t1 ✅ 2s 5s -60%
unpack_sk ✅ 2s 3s -33%
unpack_sk_t0hat ✅ 2s 5s -60%
yvec_get_poly ✅ 2s 3s -33%
yvec_init ✅ 2s 3s -33%
caddq ✅ 1s 3s -67%
decompose ✅ 1s 1s +0%
intt_native_aarch64 ✅ 1s 3s -67%
keccak_f1600_x1_native_aarch64_v84a ✅ 1s 3s -67%
keccak_f1600_x4_native_aarch64_v84a ✅ 1s 4s -75%
keccak_f1600_x4_native_aarch64_v8a_scalar_hybrid ✅ 1s 2s -50%
keccak_f1600_x4_native_aarch64_v8a_v84a_scalar_hybrid ✅ 1s 2s -50%
keccak_finalize ✅ 1s 2s -50%
keccak_init ✅ 1s 1s +0%
keccakf1600_extract_bytes (big endian) ✅ 1s 2s -50%
keccakf1600_permute ✅ 1s 2s -50%
keccakf1600_permute_native ✅ 1s 3s -67%
keccakf1600x4_extract_bytes ✅ 1s 4s -75%
make_hint ✅ 1s 2s -50%
mld_ct_cmask_nonzero_u32 ✅ 1s 4s -75%
mld_h ✅ 1s 2s -50%
mld_prepare_domain_separation_prefix ✅ 1s 2s -50%
mld_value_barrier_u32 ✅ 1s 3s -67%
pack_sig_c ✅ 1s 5s -80%
pack_sig_z ✅ 1s 2s -50%
poly_caddq_native ✅ 1s 2s -50%
poly_invntt_tomont_native ✅ 1s 2s -50%
poly_shiftl ✅ 1s 3s -67%
poly_sub ✅ 1s 3s -67%
polyt0_pack ✅ 1s 3s -67%
polyvec_matrix_pointwise_montgomery_row ✅ 1s 1s +0%
polyveck_reduce ✅ 1s 4s -75%
polyvecl_uniform_gamma1_serial ✅ 1s 3s -67%
polyz_pack ✅ 1s 3s -67%
polyz_unpack_17_native_aarch64 ✅ 1s 3s -67%
polyz_unpack_native ✅ 1s 4s -75%
reduce32 ✅ 1s 3s -67%
rej_uniform_native ✅ 1s 4s -75%
rej_uniform_native_aarch64 ✅ 1s 3s -67%
shake256_absorb ✅ 1s 2s -50%
shake256_init ✅ 1s 2s -50%
shake256_release ✅ 1s 2s -50%
sign_signature ✅ 1s 6s -83%
sk_s2hat_get_poly ✅ 1s 2s -50%
use_hint ✅ 1s 2s -50%

@hanno-becker
Config: Declare test context type with the context parameter option
6a05855 
test_alloc_config.h was the only configuration combining custom alloc/free
with a context parameter, but it was not usable as a template: it compiles
only because test_alloc.c defines MLD_BUILD_INTERNAL before including
mldsa_native.h. The forward declaration of struct test_ctx_t sat in the
MLD_CONFIG_CUSTOM_ALLOC_FREE block, which is inside the build-only section
of the configuration.

A consumer includes mldsa_native.h without MLD_BUILD_INTERNAL, so the struct
is first seen inside the public prototypes, where it declares a type distinct
from the application's own, triggering -Wvisibility.

Move the declaration next to MLD_CONFIG_CONTEXT_PARAMETER, which precedes the
build-only section.

Signed-off-by: Hanno Becker <beckphan@amazon.co.uk>
@hanno-becker
Examples: Add context parameter example
1bee8dc 
Demonstrates MLD_CONFIG_CONTEXT_PARAMETER by passing a bump allocator
through the public API to MLD_CUSTOM_ALLOC/MLD_CUSTOM_FREE. The buffer is
sized from MLD_TOTAL_ALLOC_{44,65,87}, and freeing is a single cursor
move since mldsa-native deallocates in reverse order of allocation.

Unlike test_alloc.c, the example sets MLD_BUILD_INTERNAL neither explicitly
nor implicitly: main.c obtains the context type solely from the public
header, via the include that mldsa_native_config.h places next to
MLD_CONFIG_CONTEXT_PARAMETER.

Ported from pq-code-package/mlkem-native#1877.

Signed-off-by: Hanno Becker <beckphan@amazon.co.uk>
@oqs-bot

oqs-bot commented Aug 28, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

CBMC Results (ML-DSA-87)

⚠️ Attention Required

Proof Status Current Previous Change
**TOTAL** ⚠️ 3022s 2151s +40.5%
compute_pack_t0_t1 ⚠️ 204s 19s +974%
mld_attempt_signature_generation ⚠️ 322s 55s +485%
sig_unpack_hints ⚠️ 28s 3s +833%
sign_keypair_internal ⚠️ 55s 6s +817%
sign_pk_from_sk ⚠️ 51s 6s +750%
sign_signature_internal ⚠️ 340s 42s +710%
sign_verify_internal ⚠️ 799s 97s +724%
Full Results (210 proofs)
Proof Status Current Previous Change
**TOTAL** ⚠️ 3022s 2151s +40.5%
sign_verify_internal ⚠️ 799s 97s +724%
sign_signature_internal ⚠️ 340s 42s +710%
mld_attempt_signature_generation ⚠️ 322s 55s +485%
polyvecl_pointwise_acc_montgomery_c ✅ 246s 353s -30%
compute_pack_t0_t1 ⚠️ 204s 19s +974%
poly_pointwise_montgomery_c ✅ 151s 144s +5%
polyvec_matrix_expand ✅ 88s 324s -73%
mld_invntt_layer ✅ 66s 115s -43%
sign_keypair_internal ⚠️ 55s 6s +817%
sign_pk_from_sk ⚠️ 51s 6s +750%
sig_unpack_hints ⚠️ 28s 3s +833%
fqmul ✅ 25s 43s -42%
polyvec_matrix_expand_serial ✅ 24s 38s -37%
mld_ntt_layer ✅ 23s 45s -49%
keccakf1600x4_permute_native ✅ 14s 23s -39%
mld_ntt_butterfly_block ✅ 14s 24s -42%
polyvec_matrix_pointwise_montgomery_yvec ✅ 13s 18s -28%
rej_uniform_native_x86_64 ✅ 12s - new
rej_uniform ✅ 11s 15s -27%
poly_ntt_c ✅ 10s 21s -52%
polyt0_unpack ✅ 10s 14s -29%
rej_uniform_c ✅ 10s 19s -47%
poly_uniform_eta_4x ✅ 8s 11s -27%
polyeta_unpack ✅ 8s 17s -53%
polyveck_decompose ✅ 7s 13s -46%
polyz_unpack_c ✅ 7s 3s +133%
sign_keypair ✅ 7s 4s +75%
sign_verify_pre_hash_internal ✅ 7s 3s +133%
mld_check_pct ✅ 6s 16s -62%
poly_add ✅ 6s 6s +0%
poly_chknorm_c ✅ 6s 15s -60%
poly_invntt_tomont_c ✅ 6s 12s -50%
poly_uniform_4x ✅ 6s 13s -54%
polyveck_caddq ✅ 6s 8s -25%
polyveck_invntt_tomont ✅ 6s 9s -33%
sign_signature_pre_hash_shake256 ✅ 6s 6s +0%
keccak_absorb ✅ 5s 3s +67%
keccak_absorb_once_x4 ✅ 5s 9s -44%
keccak_squeezeblocks_x4 ✅ 5s 4s +25%
mld_compute_pack_z ✅ 5s 8s -38%
mld_keccakf1600_permute_c ✅ 5s 7s -29%
mld_sample_s1_s2 ✅ 5s 6s -17%
pointwise_acc_native_x86_64 ✅ 5s 6s -17%
polyvecl_chknorm ✅ 5s 7s -29%
polyvecl_ntt ✅ 5s 7s -29%
mld_sample_s1_s2_serial ✅ 4s 8s -50%
ntt_native_aarch64 ✅ 4s 6s -33%
pack_sk_s1 ✅ 4s 1s +300%
pointwise_acc_native_aarch64 ✅ 4s 6s -33%
poly_caddq ✅ 4s 2s +100%
poly_uniform_gamma1_4x ✅ 4s 3s +33%
polyt0_pack ✅ 4s 4s +0%
polyt1_unpack ✅ 4s 4s +0%
polyveck_ntt ✅ 4s 11s -64%
rej_uniform_native ✅ 4s 8s -50%
shake128_finalize ✅ 4s 2s +100%
shake256_release ✅ 4s 3s +33%
sign_signature ✅ 4s 5s -20%
sign_signature_pre_hash_internal ✅ 4s 5s -20%
sign_verify ✅ 4s 5s -20%
sign_verify_pre_hash_shake256 ✅ 4s 3s +33%
sk_s1hat_get_poly ✅ 4s 3s +33%
unpack_sk_s2hat ✅ 4s 3s +33%
caddq ✅ 3s 4s -25%
fqscale ✅ 3s 3s +0%
keccak_f1600_x4_native_aarch64_v8a_v84a_scalar_hybrid ✅ 3s 4s -25%
keccak_f1600_x4_native_avx2 ✅ 3s 2s +50%
keccakf1600_permute_native ✅ 3s 4s -25%
keccakf1600x4_permute ✅ 3s 3s +0%
mld_ct_cmask_nonzero_u8 ✅ 3s 3s +0%
mld_h ✅ 3s 3s +0%
mld_keccakf1600x4_xor_bytes_c ✅ 3s 4s -25%
mld_sign_finish ✅ 3s - new
pack_sig_c ✅ 3s 4s -25%
poly_caddq_c ✅ 3s 3s +0%
poly_chknorm_native ✅ 3s 4s -25%
poly_chknorm_native_x86_64 ✅ 3s 2s +50%
poly_decompose_32_native_aarch64 ✅ 3s 5s -40%
poly_decompose_88_native_aarch64 ✅ 3s 2s +50%
poly_decompose_native ✅ 3s 2s +50%
poly_decompose_native_x86_64 ✅ 3s 2s +50%
poly_invntt_tomont_native ✅ 3s 5s -40%
poly_ntt_native ✅ 3s 3s +0%
poly_permute_bitrev_to_custom_optional_native ✅ 3s 5s -40%
poly_pointwise_montgomery ✅ 3s 4s -25%
poly_power2round ✅ 3s 3s +0%
poly_reduce ✅ 3s 2s +50%
poly_uniform_gamma1 ✅ 3s 4s -25%
polyt1_pack ✅ 3s 3s +0%
polyvec_matrix_pointwise_montgomery_row ✅ 3s 3s +0%
polyveck_chknorm ✅ 3s 3s +0%
polyveck_reduce ✅ 3s 3s +0%
polyvecl_pack_eta ✅ 3s 3s +0%
polyvecl_unpack_z ✅ 3s 4s -25%
polyw1_pack_32 ✅ 3s 4s -25%
polyz_unpack_19_native_aarch64 ✅ 3s 4s -25%
rej_eta ✅ 3s 4s -25%
rej_uniform_eta_native_aarch64 ✅ 3s 5s -40%
rej_uniform_eta_native_x86_64 ✅ 3s - new
rej_uniform_native_aarch64 ✅ 3s 2s +50%
shake128_squeeze ✅ 3s 2s +50%
sign_signature_extmu ✅ 3s 4s -25%
yvec_get_poly ✅ 3s 4s -25%
decompose ✅ 2s 3s -33%
intt_native_aarch64 ✅ 2s 3s -33%
intt_native_x86_64 ✅ 2s 3s -33%
keccak_f1600_x1_native_aarch64 ✅ 2s 1s +100%
keccak_f1600_x1_native_aarch64_v84a ✅ 2s 1s +100%
keccak_finalize ✅ 2s 1s +100%
keccak_squeeze ✅ 2s 2s +0%
keccakf1600_permute ✅ 2s 3s -33%
keccakf1600_xor_bytes ✅ 2s 3s -33%
keccakf1600x4_xor_bytes ✅ 2s 3s -33%
keccakf1600x4_xor_bytes_native ✅ 2s 3s -33%
mld_ct_cmask_neg_i32 ✅ 2s 4s -50%
mld_ct_cmask_nonzero_u32 ✅ 2s 2s +0%
mld_ct_memcmp ✅ 2s 3s -33%
mld_keccakf1600x4_extract_bytes_c ✅ 2s 2s +0%
mld_polymat_expand_entry ✅ 2s 3s -33%
mld_prepare_domain_separation_prefix ✅ 2s 4s -50%
mld_sign_attempt ✅ 2s - new
mld_sign_resume ✅ 2s - new
mld_value_barrier_i64 ✅ 2s 1s +100%
montgomery_reduce ✅ 2s 3s -33%
nttunpack_native_x86_64 ✅ 2s 3s -33%
pack_sig_h ✅ 2s 4s -50%
pack_sig_z ✅ 2s 5s -60%
pointwise_native_aarch64 ✅ 2s 5s -60%
pointwise_native_x86_64 ✅ 2s 2s +0%
poly_caddq_native_aarch64 ✅ 2s 3s -33%
poly_caddq_native_x86_64 ✅ 2s 2s +0%
poly_challenge ✅ 2s 5s -60%
poly_chknorm ✅ 2s 3s -33%
poly_decompose ✅ 2s 3s -33%
poly_invntt_tomont ✅ 2s 1s +100%
poly_ntt ✅ 2s 3s -33%
poly_shiftl ✅ 2s 4s -50%
poly_sub ✅ 2s 3s -33%
poly_uniform ✅ 2s 4s -50%
poly_uniform_eta ✅ 2s 4s -50%
poly_use_hint ✅ 2s 1s +100%
poly_use_hint_c ✅ 2s 2s +0%
poly_use_hint_native ✅ 2s 3s -33%
polyeta_pack ✅ 2s 4s -50%
polyveck_pack_eta ✅ 2s 6s -67%
polyvecl_pointwise_acc_montgomery ✅ 2s 5s -60%
polyvecl_pointwise_acc_montgomery_native ✅ 2s 3s -33%
polyvecl_uniform_gamma1_serial ✅ 2s 4s -50%
polyvecl_unpack_eta ✅ 2s 5s -60%
polyw1_pack ✅ 2s 4s -50%
polyw1_pack_88 ✅ 2s 3s -33%
polyz_pack ✅ 2s 5s -60%
polyz_unpack ✅ 2s 2s +0%
polyz_unpack_17_native_aarch64 ✅ 2s 3s -33%
polyz_unpack_native ✅ 2s 4s -50%
reduce32 ✅ 2s 3s -33%
rej_eta_c ✅ 2s 5s -60%
rej_eta_native ✅ 2s 6s -67%
shake128_release ✅ 2s 4s -50%
shake128x4_absorb_once ✅ 2s 5s -60%
shake128x4_squeezeblocks ✅ 2s 3s -33%
shake256 ✅ 2s 2s +0%
shake256_absorb ✅ 2s 2s +0%
shake256_finalize ✅ 2s 2s +0%
shake256_init ✅ 2s 2s +0%
shake256_squeeze ✅ 2s 2s +0%
shake256x4_absorb_once ✅ 2s 2s +0%
sk_s2hat_get_poly ✅ 2s 3s -33%
sys_check_capability ✅ 2s 3s -33%
unpack_sk ✅ 2s 5s -60%
unpack_sk_t0hat ✅ 2s 7s -71%
use_hint ✅ 2s 3s -33%
yvec_init ✅ 2s 4s -50%
keccak_f1600_x4_native_aarch64_v84a ✅ 1s 4s -75%
keccak_f1600_x4_native_aarch64_v8a_scalar_hybrid ✅ 1s 3s -67%
keccak_init ✅ 1s 3s -67%
keccakf1600_extract_bytes (big endian) ✅ 1s 3s -67%
keccakf1600_xor_bytes (big endian) ✅ 1s 2s -50%
keccakf1600x4_extract_bytes ✅ 1s 2s -50%
keccakf1600x4_extract_bytes_native ✅ 1s 2s -50%
make_hint ✅ 1s 3s -67%
mld_ct_abs_i32 ✅ 1s 3s -67%
mld_ct_get_optblocker_i64 ✅ 1s 3s -67%
mld_ct_get_optblocker_u32 ✅ 1s 2s -50%
mld_ct_get_optblocker_u8 ✅ 1s 3s -67%
mld_ct_sel_int32 ✅ 1s 3s -67%
mld_keccakf1600_extract_bytes ✅ 1s 4s -75%
mld_value_barrier_u32 ✅ 1s 2s -50%
mld_value_barrier_u8 ✅ 1s 3s -67%
ntt_native_x86_64 ✅ 1s 2s -50%
pack_sk_rho_key_tr_s2 ✅ 1s 3s -67%
poly_caddq_native ✅ 1s 4s -75%
poly_chknorm_native_aarch64 ✅ 1s 4s -75%
poly_decompose_c ✅ 1s 5s -80%
poly_permute_bitrev_to_custom_optional ✅ 1s 3s -67%
poly_pointwise_montgomery_native ✅ 1s 5s -80%
poly_use_hint_native_aarch64 ✅ 1s 2s -50%
poly_use_hint_native_x86_64 ✅ 1s - new
polyveck_pack_w1 ✅ 1s 3s -67%
polyveck_unpack_eta ✅ 1s 4s -75%
polyvecl_uniform_gamma1 ✅ 1s 2s -50%
polyz_unpack_native_x86_64 ✅ 1s 3s -67%
power2round ✅ 1s 4s -75%
shake128_absorb ✅ 1s 4s -75%
shake128_init ✅ 1s 1s +0%
shake256x4_squeezeblocks ✅ 1s 1s +0%
sign_verify_extmu ✅ 1s 3s -67%
sk_t0hat_get_poly ✅ 1s 4s -75%
unpack_pk_t1 ✅ 1s 1s +0%
unpack_sk_s1hat ✅ 1s 2s -50%

@hanno-becker
hanno-becker marked this pull request as ready for review August 28, 2026 04:01
@hanno-becker
hanno-becker requested a review from a team as a code owner August 28, 2026 04:01
@hanno-becker hanno-becker added documentation Improvements or additions to documentation enhancement New feature or request labels Aug 28, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@mkannwischer mkannwischer Awaiting requested review from mkannwischer

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

documentation Improvements or additions to documentation enhancement New feature or request

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@hanno-becker @oqs-bot