[sw] Pull-in MLDSA software impl for eg100 by sasdf · Pull Request #30552 · lowRISC/opentitan

sasdf · 2026-06-30T18:37:55Z

This PR integrates the embedpqc software implementation of ML-DSA and updates the KMAC driver to support the required SHAKE operations.

The embedpqc library from Google's BoringSSL doesn't have public repo yet, so we pull the sources directly for now. This PR only pulls the mldsa-44 tiny-stack profile.

Key Changes

ML-DSA Software Library (third_party/embedpqc):
- Pulled in the core embedpqc library files.
- Added a porting layer in third_party/embedpqc/ports/ that implements the SHAKE128 and SHAKE256 interfaces by wrapping the Silicon Creator KMAC driver.
KMAC Driver Enhancements (sw/device/silicon_creator/lib/drivers/):
- Added kmac_shake128_configure() to support SHAKE-128 mode.
- Refactored squeezing logic to expose kmac_squeeze_words() and kmac_done(), allowing arbitrary-length squeezing required by ML-DSA.
Verification Tests (sw/device/tests/embedpqc/):
- Added test suites for ML-DSA-44-tiny using test vectors to verify correctness and measure stack usage.

Stack usage estimation:

Algorithm / Phase	Variant	KeyGen	Sign	Verify

ML-DSA-44	Tiny	9,908 B	13,492 B	11,268 B

cfrantz · 2026-07-01T17:57:57Z

+  register uint8_t *a0 asm("a0") = out_pk;
+  register const uint8_t *a1 asm("a1") = seed;
+  register void *a2 asm("a2") = stack_top;
+
+  asm volatile(
+      "mv s1, sp\n"
+      "mv sp, a2\n"
+      "call mldsa44_tiny_pub_from_seed\n"
+      "mv sp, s1\n"
+      : "+r"(a0), "+r"(a1), "+r"(a2)
+      :
+      : "ra", "s1", "a3", "a4", "a5", "a6", "a7", "t0", "t1", "t2", "t3", "t4",
+        "t5", "t6", "memory");


This is pretty advanced stuff :)

What does the codegen look like for this, and how does this compare with writing an actual assembly language entrypoint (e.g. mldsa44_tiny_caller.S)?

With an assembly-language entrypoint, we could simply obey the C-ABI register convention rather than having to mark it all as clobbered in the inline assembly statement. However, we'd have to appropriately manage whichever register is responsible for holding the original stack pointer so we can restore it after the call returns.

(Hmm, I forgot the reason why I decided to switch from standalone asm to inline asm during prototyping...)

The PR is updated to use assembly-language entrypoint, and I also confirmed manually that unused functions will be stripped correctly.

cfrantz · 2026-07-01T17:59:27Z

+cc_library(
+    name = "mldsa44",
+    srcs = ["mldsa44.c"],
+    hdrs = ["mldsa44.h"],
+    deps = [
+        ":ct",
+        ":mldsa_mu",
+        "//third_party/embedpqc/ports:shake",
+    ],
+)


Are we bringing in both the regular and tiny versions of the functions?

I don't have the tools for measuring latency on real chips now, maybe we can keep both variants for now and decide later?

I think it is almost certain we only need tiny, no @cfrantz ?

Dropped all variants other than mldsa-44-tiny variant for this initial PR.

siemen11

Thank you @sasdf, what a monster haha! I checked the assembly whether the parts that should be constant time are so, this looks to be the case

johannheyszl · 2026-07-03T10:54:24Z

Can we add some cycle counts to the tiny executions maybe?

Using `.strip()` on the file content before splitting removes all leading whitespaces of the entire file. By switching to `.rstrip()`, we preserve any leading empty lines/spaces while still stripping trailing whitespaces and ensuring the file ends with a single newline. Signed-off-by: Yi-Hsuan Deng <yhdeng@google.com> Change-Id: Ib9954c5ed78c1610b1148ee7913f786f6a6a6964

This patch exports the `kmac_squeeze_words` and `kmac_done` functions from the kmac driver to allow caller to squeeze an arbitrary number of words from the Keccak state incrementally. Also, adds `kmac_shake128_configure` to support SHAKE-128 configuration. Signed-off-by: Yi-Hsuan Deng <yhdeng@google.com> Change-Id: Ide996b205dcd4cf41425571315cd0b496a6a6964

Import `embedpqc` library containing embedded friendly implementations of ML-DSA-44, ML-DSA-65, and ML-DSA-87 signatures derived from BoringSSL. This commit pulls in both the standard variants and the stack usage optimized "tiny" variants of ML-DSA, integrated with OpenTitan's hardware KMAC block for SHAKE acceleration. The change also introduces smoke tests for each variant targeting the Earlgrey chip. Signed-off-by: Yi-Hsuan Deng <yhdeng@google.com> Change-Id: Ide996b205dcd4cf41425571315cd0b496a6a6964

nasahlpa

Thanks @sasdf for pulling this code into the repository.

I've focused my review on the fist two commits as well as the test code in sw/device/tests/embedpqc. This LGTM!

The only remark I have is that we should add a readme to third_party/embedpqc stating that this code is not hardened against SCA and FI attacks.

nasahlpa · 2026-07-08T06:23:33Z

            print(f'Binary file: "{path}"')
            continue
-        new_text = "\n".join([line.rstrip() for line in old_text.strip().split("\n")]) + "\n"
+        new_text = "\n".join([line.rstrip() for line in old_text.rstrip().split("\n")]) + "\n"


With this change, the documentation at the top of the file is outdated:

# - There is no leading whitespace in the file.

nasahlpa · 2026-07-08T06:42:49Z

    }

-    if (launder32(offset) == kShake256KeccakRateWords) {
+    if (launder32(offset) == rate_words) {


In cryptolib, we have:

opentitan/sw/device/lib/crypto/drivers/kmac.c

Line 762 in 56715af

if (launder32(offset) == keccak_rate_words && idx < digest_len_words) {

So here we are running an additional CMD.RUN after a last full block. This is fine.

nasahlpa · 2026-07-08T06:56:06Z

 rom_error_t kmac_shake256_squeeze_end(uint32_t *out, size_t outlen);

+/**
+ * Squeeze arbitrary number of words from the Keccak state.


Is it really an arbitrary number of words or should it be a multiple of rate_words? If a first call would ask for non-rate multiple, the next call to this function would then re-read those words? I think it might be worth documenting this here.

nasahlpa · 2026-07-08T07:03:27Z

+        ":mldsa_testvectors",
+        "//sw/device/lib/runtime:log",
+        "//sw/device/lib/testing/test_framework:ottf_main",
+        "//third_party/embedpqc/ports:mldsa44_tiny_caller",


Suggested change

"//third_party/embedpqc/ports:mldsa44_tiny_caller",

"//third_party/embedpqc/ports:mldsa44_tiny_caller",

"//third_party/embedpqc:mldsa44_tiny",

I think this could be added to make the includes more robust.

nasahlpa · 2026-07-08T07:06:24Z

+  LOG_INFO("Sign Test Passed.");
+
+  // 3. Verify Test
+  mldsa44_tiny_pub_from_seed_with_stack(buf, kMldsa44SignSeed,


Should we compare here to a golden public key? On the other hand, if this fails, the verify below would also fail. So fine for me to leave it as it is.

sasdf force-pushed the mjTmlqqtoxz branch 3 times, most recently from a394044 to 720ee09 Compare June 30, 2026 20:24

sasdf requested review from cfrantz and siemen11 June 30, 2026 22:26

sasdf marked this pull request as ready for review June 30, 2026 22:26

sasdf requested a review from a team as a code owner June 30, 2026 22:26

sasdf requested review from moidx and removed request for a team June 30, 2026 22:26

cfrantz reviewed Jul 1, 2026

View reviewed changes

sasdf force-pushed the mjTmlqqtoxz branch 2 times, most recently from 5ab37dc to a586c10 Compare July 1, 2026 19:48

siemen11 approved these changes Jul 3, 2026

View reviewed changes

sasdf added 2 commits July 6, 2026 21:34

sasdf force-pushed the mjTmlqqtoxz branch 3 times, most recently from 60eab91 to e0d0d6d Compare July 8, 2026 04:44

sasdf force-pushed the mjTmlqqtoxz branch from e0d0d6d to 99a3e65 Compare July 8, 2026 04:50

nasahlpa reviewed Jul 8, 2026

View reviewed changes

	"//third_party/embedpqc/ports:mldsa44_tiny_caller",
	"//third_party/embedpqc/ports:mldsa44_tiny_caller",
	"//third_party/embedpqc:mldsa44_tiny",

Uh oh!

Conversation

sasdf commented Jun 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Key Changes

Stack usage estimation:

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

siemen11 left a comment

Choose a reason for hiding this comment

Uh oh!

johannheyszl commented Jul 3, 2026

Uh oh!

nasahlpa left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

sasdf commented Jun 30, 2026 •

edited

Loading