Skip to content

Reject MLD_PREHASH_NONE in prehash APIs#1228

Merged
hanno-becker merged 1 commit into
mainfrom
ptp/prehash-none-message-bypass
Jul 13, 2026
Merged

Reject MLD_PREHASH_NONE in prehash APIs#1228
hanno-becker merged 1 commit into
mainfrom
ptp/prehash-none-message-bypass

Conversation

@fegge

@fegge fegge commented Jun 26, 2026

Copy link
Copy Markdown
Contributor

Summary

  • Reject MLD_PREHASH_NONE in the unstable pre-hash signing and verification APIs.
  • Document that MLD_PREHASH_NONE is not supported by these HashML-DSA entry points.
  • Add functional coverage for the rejected pre-hash algorithm.

Validation

  • clang-format -i mldsa/src/sign.c mldsa/src/sign.h mldsa/mldsa_native.h test/src/test_mldsa.c: passed
  • git diff --check -- mldsa/src/sign.c mldsa/src/sign.h mldsa/mldsa_native.h test/src/test_mldsa.c: passed
  • make run_func -j4: passed
  • Not run: ./scripts/format because nixpkgs-fmt is not installed in this local environment
  • Not run: ./scripts/lint because shfmt is not installed in this local environment

Fixes #1215

This work was completed by Trail of Bits as part of the Patch The Planet project in collaboration with OpenAI. The issue was identified primarily by the Codex coding agent, and manually reviewed before submission.

@fegge fegge requested a review from a team as a code owner June 26, 2026 16:30
This was referenced Jun 26, 2026
Closed
Open
@oqs-bot

oqs-bot commented Jun 26, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

CBMC Results (ML-DSA-65, REDUCE-RAM)

Full Results (206 proofs)
Proof Status Current Previous Change
**TOTAL** ✅ 1532s 1482s +3.4%
polyvec_matrix_pointwise_montgomery_yvec ✅ 201s 201s +0%
poly_pointwise_montgomery_c ✅ 118s 116s +2%
mld_invntt_layer ✅ 111s 108s +3%
sign_verify_internal ✅ 73s 71s +3%
mld_ntt_layer ✅ 45s 43s +5%
fqmul ✅ 43s 40s +7%
polyvecl_chknorm ✅ 43s 43s +0%
polyveck_chknorm ✅ 37s 36s +3%
mld_attempt_signature_generation ✅ 32s 31s +3%
poly_ntt_c ✅ 25s 22s +14%
keccakf1600x4_permute_native ✅ 24s 22s +9%
mld_ntt_butterfly_block ✅ 22s 25s -12%
rej_uniform_c ✅ 19s 16s +19%
mld_check_pct ✅ 17s 12s +42%
poly_chknorm_c ✅ 13s 13s +0%
poly_uniform_eta_4x ✅ 12s 13s -8%
poly_add ✅ 11s 7s +57%
poly_invntt_tomont_c ✅ 11s 10s +10%
polyt0_unpack ✅ 11s 13s -15%
polyvec_matrix_pointwise_montgomery_row ✅ 11s 8s +38%
polyveck_decompose ✅ 10s 14s -29%
rej_uniform_native_x86_64 ✅ 10s - new
keccak_absorb_once_x4 ✅ 9s 10s -10%
polyz_unpack_c ✅ 9s 9s +0%
rej_uniform ✅ 9s 7s +29%
polyveck_invntt_tomont ✅ 8s 7s +14%
compute_pack_t0_t1 ✅ 7s 7s +0%
pointwise_acc_native_aarch64 ✅ 7s 6s +17%
pointwise_acc_native_x86_64 ✅ 7s 5s +40%
polyveck_reduce ✅ 7s 6s +17%
polyvecl_ntt ✅ 7s 7s +0%
rej_uniform_native ✅ 7s 4s +75%
sign_keypair_internal ✅ 7s 3s +133%
keccak_init ✅ 6s 4s +50%
mld_compute_pack_z ✅ 6s 5s +20%
mld_keccakf1600_permute_c ✅ 6s 7s -14%
pointwise_native_x86_64 ✅ 6s 2s +200%
poly_permute_bitrev_to_custom_optional_native ✅ 6s 3s +100%
poly_reduce ✅ 6s 4s +50%
sign_pk_from_sk ✅ 6s 5s +20%
intt_native_x86_64 ✅ 5s 4s +25%
keccak_squeeze ✅ 5s 2s +150%
keccak_squeezeblocks_x4 ✅ 5s 4s +25%
mld_ct_cmask_neg_i32 ✅ 5s 3s +67%
poly_caddq_c ✅ 5s 5s +0%
poly_chknorm_native ✅ 5s 4s +25%
poly_decompose_c ✅ 5s 8s -38%
poly_power2round ✅ 5s 7s -29%
poly_uniform ✅ 5s 2s +150%
poly_uniform_gamma1_4x ✅ 5s 3s +67%
polyeta_unpack ✅ 5s 4s +25%
polyveck_caddq ✅ 5s 7s -29%
sign_signature_pre_hash_shake256 ✅ 5s 7s -29%
sign_verify_extmu ✅ 5s 2s +150%
sign_verify_pre_hash_shake256 ✅ 5s 6s -17%
sys_check_capability ✅ 5s 1s +400%
caddq ✅ 4s 2s +100%
keccak_f1600_x1_native_aarch64_v84a ✅ 4s 2s +100%
keccak_f1600_x4_native_avx2 ✅ 4s 2s +100%
mld_sample_s1_s2 ✅ 4s 6s -33%
ntt_native_aarch64 ✅ 4s 3s +33%
ntt_native_x86_64 ✅ 4s 5s -20%
pack_sk_s1 ✅ 4s 3s +33%
pointwise_native_aarch64 ✅ 4s 3s +33%
poly_decompose_32_native_aarch64 ✅ 4s 4s +0%
poly_ntt_native ✅ 4s 2s +100%
poly_pointwise_montgomery_native ✅ 4s 4s +0%
poly_shiftl ✅ 4s 3s +33%
poly_uniform_gamma1 ✅ 4s 3s +33%
poly_use_hint_c ✅ 4s 2s +100%
polyeta_pack ✅ 4s 1s +300%
polyt0_pack ✅ 4s 5s -20%
polyt1_unpack ✅ 4s 3s +33%
polyveck_pack_eta ✅ 4s 3s +33%
polyveck_pack_w1 ✅ 4s 4s +0%
polyveck_unpack_eta ✅ 4s 3s +33%
polyvecl_pointwise_acc_montgomery_c ✅ 4s 3s +33%
polyw1_pack ✅ 4s 3s +33%
polyz_pack ✅ 4s 3s +33%
rej_eta_c ✅ 4s 4s +0%
rej_uniform_native_aarch64 ✅ 4s 5s -20%
shake256_finalize ✅ 4s 1s +300%
shake256_release ✅ 4s 3s +33%
sig_unpack_hints ✅ 4s 1s +300%
sign_keypair ✅ 4s 4s +0%
sign_signature ✅ 4s 5s -20%
sign_signature_extmu ✅ 4s 4s +0%
sign_signature_internal ✅ 4s 6s -33%
sign_signature_pre_hash_internal ✅ 4s 3s +33%
sign_verify ✅ 4s 6s -33%
sk_s1hat_get_poly ✅ 4s 3s +33%
sk_t0hat_get_poly ✅ 4s 1s +300%
unpack_sk ✅ 4s 3s +33%
unpack_sk_s1hat ✅ 4s 1s +300%
unpack_sk_t0hat ✅ 4s 4s +0%
use_hint ✅ 4s 2s +100%
yvec_get_poly ✅ 4s 3s +33%
yvec_init ✅ 4s 5s -20%
fqscale ✅ 3s 3s +0%
keccak_f1600_x1_native_aarch64 ✅ 3s 2s +50%
keccak_f1600_x4_native_aarch64_v8a_v84a_scalar_hybrid ✅ 3s 3s +0%
keccakf1600_extract_bytes (big endian) ✅ 3s 3s +0%
keccakf1600_xor_bytes (big endian) ✅ 3s 2s +50%
keccakf1600x4_extract_bytes_native ✅ 3s 1s +200%
keccakf1600x4_permute ✅ 3s 1s +200%
keccakf1600x4_xor_bytes ✅ 3s 2s +50%
keccakf1600x4_xor_bytes_native ✅ 3s 2s +50%
mld_ct_abs_i32 ✅ 3s 6s -50%
mld_ct_cmask_nonzero_u32 ✅ 3s 3s +0%
mld_ct_get_optblocker_i64 ✅ 3s 1s +200%
mld_ct_memcmp ✅ 3s 4s -25%
mld_ct_sel_int32 ✅ 3s 2s +50%
mld_keccakf1600x4_extract_bytes_c ✅ 3s 2s +50%
mld_sample_s1_s2_serial ✅ 3s 3s +0%
mld_value_barrier_u32 ✅ 3s 4s -25%
mld_value_barrier_u8 ✅ 3s 1s +200%
nttunpack_native_x86_64 ✅ 3s 3s +0%
pack_sk_rho_key_tr_s2 ✅ 3s 2s +50%
poly_caddq_native ✅ 3s 4s -25%
poly_caddq_native_aarch64 ✅ 3s 2s +50%
poly_caddq_native_x86_64 ✅ 3s 1s +200%
poly_challenge ✅ 3s 5s -40%
poly_decompose_88_native_aarch64 ✅ 3s 2s +50%
poly_ntt ✅ 3s 2s +50%
poly_permute_bitrev_to_custom_optional ✅ 3s 3s +0%
poly_pointwise_montgomery ✅ 3s 2s +50%
poly_uniform_4x ✅ 3s 4s -25%
poly_uniform_eta ✅ 3s 5s -40%
poly_use_hint_native_aarch64 ✅ 3s 4s -25%
polyt1_pack ✅ 3s 3s +0%
polyvec_matrix_expand ✅ 3s 6s -50%
polyvec_matrix_expand_serial ✅ 3s 3s +0%
polyveck_ntt ✅ 3s 4s -25%
polyvecl_pack_eta ✅ 3s 2s +50%
polyvecl_pointwise_acc_montgomery_native ✅ 3s 3s +0%
polyvecl_uniform_gamma1 ✅ 3s 4s -25%
polyvecl_unpack_eta ✅ 3s 2s +50%
polyvecl_unpack_z ✅ 3s 1s +200%
polyw1_pack_88 ✅ 3s 3s +0%
polyz_unpack ✅ 3s 3s +0%
polyz_unpack_19_native_aarch64 ✅ 3s 5s -40%
rej_eta_native ✅ 3s 3s +0%
rej_uniform_eta_native_aarch64 ✅ 3s 5s -40%
shake128_finalize ✅ 3s 2s +50%
shake128_init ✅ 3s 6s -50%
shake256_init ✅ 3s 4s -25%
shake256_squeeze ✅ 3s 4s -25%
shake256x4_absorb_once ✅ 3s 2s +50%
shake256x4_squeezeblocks ✅ 3s 2s +50%
sign_verify_pre_hash_internal ✅ 3s 5s -40%
decompose ✅ 2s 4s -50%
intt_native_aarch64 ✅ 2s 2s +0%
keccak_absorb ✅ 2s 3s -33%
keccak_f1600_x4_native_aarch64_v84a ✅ 2s 2s +0%
keccak_f1600_x4_native_aarch64_v8a_scalar_hybrid ✅ 2s 3s -33%
keccakf1600_permute ✅ 2s 4s -50%
keccakf1600_xor_bytes ✅ 2s 4s -50%
keccakf1600x4_extract_bytes ✅ 2s 4s -50%
make_hint ✅ 2s 3s -33%
mld_ct_cmask_nonzero_u8 ✅ 2s 2s +0%
mld_ct_get_optblocker_u32 ✅ 2s 3s -33%
mld_ct_get_optblocker_u8 ✅ 2s 4s -50%
mld_h ✅ 2s 3s -33%
mld_keccakf1600x4_xor_bytes_c ✅ 2s 2s +0%
mld_polymat_expand_entry ✅ 2s 3s -33%
mld_prepare_domain_separation_prefix ✅ 2s 4s -50%
mld_value_barrier_i64 ✅ 2s 2s +0%
montgomery_reduce ✅ 2s 1s +100%
pack_sig_c ✅ 2s 3s -33%
pack_sig_h ✅ 2s 2s +0%
pack_sig_z ✅ 2s 1s +100%
poly_chknorm ✅ 2s 3s -33%
poly_chknorm_native_x86_64 ✅ 2s 4s -50%
poly_decompose ✅ 2s 2s +0%
poly_decompose_native ✅ 2s 5s -60%
poly_decompose_native_x86_64 ✅ 2s 2s +0%
poly_invntt_tomont ✅ 2s 5s -60%
poly_invntt_tomont_native ✅ 2s 5s -60%
poly_sub ✅ 2s 4s -50%
poly_use_hint ✅ 2s 3s -33%
poly_use_hint_native ✅ 2s 7s -71%
poly_use_hint_native_x86_64 ✅ 2s - new
polyvecl_pointwise_acc_montgomery ✅ 2s 3s -33%
polyvecl_uniform_gamma1_serial ✅ 2s 1s +100%
polyw1_pack_32 ✅ 2s 2s +0%
polyz_unpack_17_native_aarch64 ✅ 2s 2s +0%
polyz_unpack_native ✅ 2s 3s -33%
polyz_unpack_native_x86_64 ✅ 2s 3s -33%
reduce32 ✅ 2s 2s +0%
rej_eta ✅ 2s 5s -60%
shake128_absorb ✅ 2s 2s +0%
shake128_release ✅ 2s 2s +0%
shake128_squeeze ✅ 2s 3s -33%
shake128x4_squeezeblocks ✅ 2s 2s +0%
shake256 ✅ 2s 2s +0%
sk_s2hat_get_poly ✅ 2s 1s +100%
unpack_sk_s2hat ✅ 2s 3s -33%
keccak_finalize ✅ 1s 2s -50%
keccakf1600_permute_native ✅ 1s 2s -50%
mld_keccakf1600_extract_bytes ✅ 1s 2s -50%
poly_caddq ✅ 1s 3s -67%
poly_chknorm_native_aarch64 ✅ 1s 2s -50%
power2round ✅ 1s 2s -50%
shake128x4_absorb_once ✅ 1s 2s -50%
shake256_absorb ✅ 1s 4s -75%
unpack_pk_t1 ✅ 1s 2s -50%

@oqs-bot

oqs-bot commented Jun 26, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

CBMC Results (ML-DSA-44, REDUCE-RAM)

Full Results (206 proofs)
Proof Status Current Previous Change
**TOTAL** ✅ 1489s 1364s +9.2%
polyvec_matrix_pointwise_montgomery_yvec ✅ 158s 149s +6%
poly_pointwise_montgomery_c ✅ 132s 112s +18%
mld_invntt_layer ✅ 115s 105s +10%
polyveck_chknorm ✅ 66s 67s -1%
sign_verify_internal ✅ 56s 49s +14%
mld_ntt_layer ✅ 45s 41s +10%
fqmul ✅ 42s 39s +8%
keccakf1600x4_permute_native ✅ 23s 22s +5%
mld_ntt_butterfly_block ✅ 23s 23s +0%
poly_ntt_c ✅ 21s 21s +0%
mld_attempt_signature_generation ✅ 20s 19s +5%
polyt0_unpack ✅ 17s 12s +42%
rej_uniform_c ✅ 17s 16s +6%
polyeta_unpack ✅ 16s 14s +14%
compute_pack_t0_t1 ✅ 15s 12s +25%
poly_uniform_eta_4x ✅ 15s 12s +25%
polyvecl_chknorm ✅ 14s 11s +27%
mld_check_pct ✅ 13s 15s -13%
poly_chknorm_c ✅ 13s 11s +18%
keccak_absorb_once_x4 ✅ 11s 8s +38%
poly_invntt_tomont_c ✅ 11s 11s +0%
rej_uniform_native_x86_64 ✅ 11s - new
polyvec_matrix_pointwise_montgomery_row ✅ 9s 6s +50%
polyveck_decompose ✅ 9s 7s +29%
polyz_unpack_c ✅ 9s 8s +12%
mld_keccakf1600_permute_c ✅ 8s 7s +14%
poly_reduce ✅ 8s 4s +100%
rej_uniform ✅ 8s 8s +0%
poly_add ✅ 7s 7s +0%
fqscale ✅ 6s 2s +200%
pointwise_acc_native_x86_64 ✅ 6s 4s +50%
poly_challenge ✅ 6s 6s +0%
poly_decompose_c ✅ 6s 5s +20%
poly_power2round ✅ 6s 4s +50%
polyveck_reduce ✅ 6s 4s +50%
sign_signature_pre_hash_shake256 ✅ 6s 4s +50%
sk_s2hat_get_poly ✅ 6s 5s +20%
intt_native_x86_64 ✅ 5s 2s +150%
keccak_absorb ✅ 5s 3s +67%
keccak_finalize ✅ 5s 2s +150%
keccak_squeeze ✅ 5s 2s +150%
keccak_squeezeblocks_x4 ✅ 5s 3s +67%
mld_ct_abs_i32 ✅ 5s 3s +67%
mld_sample_s1_s2 ✅ 5s 1s +400%
mld_sample_s1_s2_serial ✅ 5s 4s +25%
nttunpack_native_x86_64 ✅ 5s 4s +25%
pack_sig_h ✅ 5s 4s +25%
poly_decompose ✅ 5s 2s +150%
poly_decompose_32_native_aarch64 ✅ 5s 4s +25%
poly_decompose_88_native_aarch64 ✅ 5s 3s +67%
polyveck_caddq ✅ 5s 3s +67%
polyw1_pack ✅ 5s 4s +25%
polyw1_pack_32 ✅ 5s 3s +67%
reduce32 ✅ 5s 3s +67%
rej_eta_c ✅ 5s 4s +25%
rej_uniform_native ✅ 5s 5s +0%
sign_signature_extmu ✅ 5s 4s +25%
sign_signature_internal ✅ 5s 4s +25%
sign_verify_extmu ✅ 5s 5s +0%
sign_verify_pre_hash_shake256 ✅ 5s 5s +0%
unpack_sk ✅ 5s 3s +67%
decompose ✅ 4s 3s +33%
keccak_init ✅ 4s 3s +33%
keccakf1600x4_extract_bytes ✅ 4s 2s +100%
keccakf1600x4_extract_bytes_native ✅ 4s 4s +0%
keccakf1600x4_permute ✅ 4s 4s +0%
make_hint ✅ 4s 3s +33%
mld_compute_pack_z ✅ 4s 6s -33%
mld_keccakf1600_extract_bytes ✅ 4s 2s +100%
mld_keccakf1600x4_xor_bytes_c ✅ 4s 4s +0%
mld_value_barrier_u8 ✅ 4s 4s +0%
pointwise_acc_native_aarch64 ✅ 4s 6s -33%
pointwise_native_aarch64 ✅ 4s 2s +100%
poly_caddq_c ✅ 4s 3s +33%
poly_chknorm ✅ 4s 3s +33%
poly_chknorm_native ✅ 4s 4s +0%
poly_chknorm_native_aarch64 ✅ 4s 2s +100%
poly_chknorm_native_x86_64 ✅ 4s 2s +100%
poly_decompose_native_x86_64 ✅ 4s 2s +100%
poly_invntt_tomont ✅ 4s 2s +100%
poly_invntt_tomont_native ✅ 4s 3s +33%
poly_pointwise_montgomery_native ✅ 4s 2s +100%
poly_uniform_eta ✅ 4s 2s +100%
poly_uniform_gamma1_4x ✅ 4s 5s -20%
poly_use_hint ✅ 4s 2s +100%
poly_use_hint_native_aarch64 ✅ 4s 3s +33%
polyveck_invntt_tomont ✅ 4s 5s -20%
polyvecl_pointwise_acc_montgomery_c ✅ 4s 4s +0%
polyvecl_pointwise_acc_montgomery_native ✅ 4s 3s +33%
polyw1_pack_88 ✅ 4s 2s +100%
polyz_unpack_native ✅ 4s 3s +33%
polyz_unpack_native_x86_64 ✅ 4s 3s +33%
rej_eta_native ✅ 4s 3s +33%
rej_uniform_eta_native_aarch64 ✅ 4s 3s +33%
rej_uniform_native_aarch64 ✅ 4s 3s +33%
shake256_init ✅ 4s 4s +0%
shake256x4_squeezeblocks ✅ 4s 2s +100%
sign_keypair ✅ 4s 5s -20%
sign_keypair_internal ✅ 4s 4s +0%
sign_pk_from_sk ✅ 4s 5s -20%
sign_signature_pre_hash_internal ✅ 4s 4s +0%
sign_verify ✅ 4s 4s +0%
sign_verify_pre_hash_internal ✅ 4s 5s -20%
sk_t0hat_get_poly ✅ 4s 1s +300%
unpack_sk_s1hat ✅ 4s 3s +33%
caddq ✅ 3s 6s -50%
keccakf1600_extract_bytes (big endian) ✅ 3s 4s -25%
keccakf1600_permute ✅ 3s 2s +50%
keccakf1600_permute_native ✅ 3s 3s +0%
keccakf1600_xor_bytes ✅ 3s 3s +0%
keccakf1600x4_xor_bytes_native ✅ 3s 5s -40%
mld_ct_cmask_neg_i32 ✅ 3s 2s +50%
mld_ct_cmask_nonzero_u8 ✅ 3s 2s +50%
mld_ct_sel_int32 ✅ 3s 3s +0%
mld_polymat_expand_entry ✅ 3s 2s +50%
montgomery_reduce ✅ 3s 2s +50%
pack_sk_s1 ✅ 3s 3s +0%
pointwise_native_x86_64 ✅ 3s 4s -25%
poly_caddq_native_aarch64 ✅ 3s 3s +0%
poly_caddq_native_x86_64 ✅ 3s 4s -25%
poly_decompose_native ✅ 3s 2s +50%
poly_sub ✅ 3s 3s +0%
poly_uniform_gamma1 ✅ 3s 3s +0%
poly_use_hint_native ✅ 3s 3s +0%
poly_use_hint_native_x86_64 ✅ 3s - new
polyeta_pack ✅ 3s 3s +0%
polyt0_pack ✅ 3s 4s -25%
polyt1_pack ✅ 3s 3s +0%
polyvec_matrix_expand ✅ 3s 3s +0%
polyvec_matrix_expand_serial ✅ 3s 4s -25%
polyveck_pack_eta ✅ 3s 4s -25%
polyveck_pack_w1 ✅ 3s 3s +0%
polyvecl_ntt ✅ 3s 3s +0%
polyvecl_pack_eta ✅ 3s 2s +50%
polyvecl_uniform_gamma1 ✅ 3s 2s +50%
polyvecl_unpack_z ✅ 3s 3s +0%
polyz_pack ✅ 3s 2s +50%
polyz_unpack ✅ 3s 3s +0%
polyz_unpack_17_native_aarch64 ✅ 3s 2s +50%
power2round ✅ 3s 2s +50%
shake128_init ✅ 3s 2s +50%
shake128x4_absorb_once ✅ 3s 2s +50%
shake256x4_absorb_once ✅ 3s 1s +200%
sign_signature ✅ 3s 6s -50%
use_hint ✅ 3s 2s +50%
yvec_init ✅ 3s 1s +200%
intt_native_aarch64 ✅ 2s 3s -33%
keccak_f1600_x4_native_aarch64_v84a ✅ 2s 3s -33%
keccak_f1600_x4_native_aarch64_v8a_v84a_scalar_hybrid ✅ 2s 3s -33%
keccak_f1600_x4_native_avx2 ✅ 2s 2s +0%
keccakf1600_xor_bytes (big endian) ✅ 2s 6s -67%
keccakf1600x4_xor_bytes ✅ 2s 3s -33%
mld_ct_cmask_nonzero_u32 ✅ 2s 3s -33%
mld_ct_get_optblocker_u8 ✅ 2s 2s +0%
mld_h ✅ 2s 4s -50%
mld_keccakf1600x4_extract_bytes_c ✅ 2s 4s -50%
mld_prepare_domain_separation_prefix ✅ 2s 3s -33%
mld_value_barrier_i64 ✅ 2s 3s -33%
mld_value_barrier_u32 ✅ 2s 1s +100%
ntt_native_aarch64 ✅ 2s 4s -50%
ntt_native_x86_64 ✅ 2s 3s -33%
pack_sig_c ✅ 2s 5s -60%
pack_sig_z ✅ 2s 2s +0%
pack_sk_rho_key_tr_s2 ✅ 2s 5s -60%
poly_caddq ✅ 2s 4s -50%
poly_caddq_native ✅ 2s 3s -33%
poly_ntt ✅ 2s 3s -33%
poly_ntt_native ✅ 2s 3s -33%
poly_permute_bitrev_to_custom_optional ✅ 2s 5s -60%
poly_permute_bitrev_to_custom_optional_native ✅ 2s 3s -33%
poly_pointwise_montgomery ✅ 2s 3s -33%
poly_shiftl ✅ 2s 4s -50%
poly_uniform ✅ 2s 3s -33%
poly_uniform_4x ✅ 2s 3s -33%
poly_use_hint_c ✅ 2s 5s -60%
polyt1_unpack ✅ 2s 2s +0%
polyveck_ntt ✅ 2s 2s +0%
polyveck_unpack_eta ✅ 2s 2s +0%
polyvecl_pointwise_acc_montgomery ✅ 2s 3s -33%
polyvecl_uniform_gamma1_serial ✅ 2s 2s +0%
polyvecl_unpack_eta ✅ 2s 4s -50%
polyz_unpack_19_native_aarch64 ✅ 2s 4s -50%
rej_eta ✅ 2s 5s -60%
shake128_absorb ✅ 2s 3s -33%
shake128_finalize ✅ 2s 3s -33%
shake128_release ✅ 2s 2s +0%
shake128x4_squeezeblocks ✅ 2s 2s +0%
shake256 ✅ 2s 1s +100%
shake256_absorb ✅ 2s 2s +0%
shake256_finalize ✅ 2s 2s +0%
shake256_release ✅ 2s 1s +100%
sig_unpack_hints ✅ 2s 2s +0%
unpack_pk_t1 ✅ 2s 3s -33%
unpack_sk_s2hat ✅ 2s 4s -50%
unpack_sk_t0hat ✅ 2s 2s +0%
yvec_get_poly ✅ 2s 3s -33%
keccak_f1600_x1_native_aarch64 ✅ 1s 3s -67%
keccak_f1600_x1_native_aarch64_v84a ✅ 1s 2s -50%
keccak_f1600_x4_native_aarch64_v8a_scalar_hybrid ✅ 1s 2s -50%
mld_ct_get_optblocker_i64 ✅ 1s 4s -75%
mld_ct_get_optblocker_u32 ✅ 1s 2s -50%
mld_ct_memcmp ✅ 1s 1s +0%
shake128_squeeze ✅ 1s 2s -50%
shake256_squeeze ✅ 1s 2s -50%
sk_s1hat_get_poly ✅ 1s 2s -50%
sys_check_capability ✅ 1s 2s -50%

@oqs-bot

oqs-bot commented Jun 26, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

CBMC Results (ML-DSA-87, REDUCE-RAM)

Full Results (206 proofs)
Proof Status Current Previous Change
**TOTAL** ✅ 1399s 1436s -2.6%
polyvec_matrix_pointwise_montgomery_yvec ✅ 181s 196s -8%
poly_pointwise_montgomery_c ✅ 110s 125s -12%
mld_invntt_layer ✅ 95s 111s -14%
sign_verify_internal ✅ 44s 47s -6%
fqmul ✅ 41s 39s +5%
mld_ntt_layer ✅ 41s 44s -7%
mld_attempt_signature_generation ✅ 35s 34s +3%
polyvecl_chknorm ✅ 34s 38s -11%
keccakf1600x4_permute_native ✅ 23s 25s -8%
mld_ntt_butterfly_block ✅ 21s 23s -9%
poly_ntt_c ✅ 18s 19s -5%
mld_check_pct ✅ 14s 15s -7%
polyt0_unpack ✅ 14s 14s +0%
poly_chknorm_c ✅ 13s 13s +0%
poly_invntt_tomont_c ✅ 13s 9s +44%
polyvec_matrix_pointwise_montgomery_row ✅ 13s 13s +0%
compute_pack_t0_t1 ✅ 12s 12s +0%
poly_uniform_eta_4x ✅ 12s 12s +0%
polyeta_unpack ✅ 12s 13s -8%
polyveck_decompose ✅ 12s 12s +0%
rej_uniform_c ✅ 12s 18s -33%
polyz_unpack_c ✅ 11s 7s +57%
polyveck_chknorm ✅ 10s 9s +11%
rej_uniform_native_x86_64 ✅ 10s - new
keccak_absorb_once_x4 ✅ 9s 8s +12%
rej_uniform ✅ 9s 7s +29%
pointwise_acc_native_x86_64 ✅ 8s 8s +0%
polyveck_reduce ✅ 8s 6s +33%
polyvecl_ntt ✅ 8s 8s +0%
mld_keccakf1600_permute_c ✅ 7s 8s -12%
mld_sample_s1_s2 ✅ 7s 8s -12%
polyveck_caddq ✅ 7s 8s -12%
polyvecl_pointwise_acc_montgomery_c ✅ 7s 2s +250%
mld_compute_pack_z ✅ 6s 6s +0%
mld_sample_s1_s2_serial ✅ 6s 6s +0%
pack_sk_rho_key_tr_s2 ✅ 6s 2s +200%
pointwise_acc_native_aarch64 ✅ 6s 5s +20%
polyeta_pack ✅ 6s 3s +100%
sign_signature_internal ✅ 6s 3s +100%
use_hint ✅ 6s 3s +100%
fqscale ✅ 5s 1s +400%
keccak_squeezeblocks_x4 ✅ 5s 4s +25%
keccakf1600_extract_bytes (big endian) ✅ 5s 3s +67%
ntt_native_aarch64 ✅ 5s 4s +25%
poly_add ✅ 5s 8s -38%
poly_decompose_c ✅ 5s 6s -17%
poly_power2round ✅ 5s 7s -29%
poly_reduce ✅ 5s 4s +25%
polyvec_matrix_expand ✅ 5s 3s +67%
polyveck_invntt_tomont ✅ 5s 4s +25%
polyw1_pack_32 ✅ 5s 3s +67%
polyz_unpack ✅ 5s 3s +67%
polyz_unpack_19_native_aarch64 ✅ 5s 5s +0%
polyz_unpack_native ✅ 5s 1s +400%
reduce32 ✅ 5s 3s +67%
rej_uniform_native ✅ 5s 5s +0%
sign_keypair ✅ 5s 4s +25%
sign_pk_from_sk ✅ 5s 6s -17%
sign_verify_pre_hash_internal ✅ 5s 3s +67%
sk_s1hat_get_poly ✅ 5s 3s +67%
sys_check_capability ✅ 5s 2s +150%
caddq ✅ 4s 3s +33%
keccak_squeeze ✅ 4s 5s -20%
keccakf1600x4_xor_bytes_native ✅ 4s 2s +100%
mld_ct_get_optblocker_u8 ✅ 4s 3s +33%
mld_value_barrier_u8 ✅ 4s 2s +100%
montgomery_reduce ✅ 4s 2s +100%
nttunpack_native_x86_64 ✅ 4s 3s +33%
pack_sig_c ✅ 4s 2s +100%
poly_caddq ✅ 4s 5s -20%
poly_caddq_c ✅ 4s 3s +33%
poly_challenge ✅ 4s 4s +0%
poly_chknorm_native ✅ 4s 1s +300%
poly_chknorm_native_x86_64 ✅ 4s 2s +100%
poly_pointwise_montgomery ✅ 4s 3s +33%
poly_uniform_eta ✅ 4s 5s -20%
polyt1_pack ✅ 4s 5s -20%
polyvecl_pointwise_acc_montgomery_native ✅ 4s 2s +100%
polyw1_pack ✅ 4s 2s +100%
polyz_unpack_17_native_aarch64 ✅ 4s 4s +0%
rej_eta_native ✅ 4s 4s +0%
rej_uniform_eta_native_aarch64 ✅ 4s 3s +33%
shake256 ✅ 4s 3s +33%
shake256_absorb ✅ 4s 3s +33%
sign_signature ✅ 4s 4s +0%
sign_signature_pre_hash_internal ✅ 4s 2s +100%
sign_signature_pre_hash_shake256 ✅ 4s 3s +33%
decompose ✅ 3s 2s +50%
intt_native_x86_64 ✅ 3s 4s -25%
keccak_absorb ✅ 3s 4s -25%
keccakf1600_permute_native ✅ 3s 3s +0%
keccakf1600x4_extract_bytes_native ✅ 3s 4s -25%
keccakf1600x4_permute ✅ 3s 2s +50%
make_hint ✅ 3s 2s +50%
mld_ct_abs_i32 ✅ 3s 1s +200%
mld_ct_cmask_neg_i32 ✅ 3s 2s +50%
mld_ct_cmask_nonzero_u8 ✅ 3s 2s +50%
mld_ct_sel_int32 ✅ 3s 2s +50%
mld_h ✅ 3s 2s +50%
mld_keccakf1600_extract_bytes ✅ 3s 1s +200%
mld_keccakf1600x4_extract_bytes_c ✅ 3s 3s +0%
mld_keccakf1600x4_xor_bytes_c ✅ 3s 1s +200%
mld_polymat_expand_entry ✅ 3s 4s -25%
mld_prepare_domain_separation_prefix ✅ 3s 3s +0%
pack_sig_z ✅ 3s 3s +0%
pack_sk_s1 ✅ 3s 2s +50%
pointwise_native_aarch64 ✅ 3s 4s -25%
pointwise_native_x86_64 ✅ 3s 5s -40%
poly_caddq_native_aarch64 ✅ 3s 3s +0%
poly_caddq_native_x86_64 ✅ 3s 3s +0%
poly_chknorm ✅ 3s 4s -25%
poly_decompose_88_native_aarch64 ✅ 3s 2s +50%
poly_ntt ✅ 3s 2s +50%
poly_shiftl ✅ 3s 4s -25%
poly_uniform ✅ 3s 4s -25%
poly_uniform_4x ✅ 3s 3s +0%
poly_uniform_gamma1 ✅ 3s 3s +0%
poly_uniform_gamma1_4x ✅ 3s 3s +0%
poly_use_hint ✅ 3s 4s -25%
poly_use_hint_native ✅ 3s 1s +200%
poly_use_hint_native_aarch64 ✅ 3s 3s +0%
polyt0_pack ✅ 3s 3s +0%
polyt1_unpack ✅ 3s 3s +0%
polyvec_matrix_expand_serial ✅ 3s 3s +0%
polyveck_pack_w1 ✅ 3s 3s +0%
polyvecl_pointwise_acc_montgomery ✅ 3s 2s +50%
polyvecl_uniform_gamma1 ✅ 3s 3s +0%
polyvecl_uniform_gamma1_serial ✅ 3s 2s +50%
polyvecl_unpack_eta ✅ 3s 3s +0%
polyz_pack ✅ 3s 4s -25%
shake128_init ✅ 3s 2s +50%
shake128_release ✅ 3s 3s +0%
shake128x4_squeezeblocks ✅ 3s 1s +200%
shake256x4_squeezeblocks ✅ 3s 4s -25%
sig_unpack_hints ✅ 3s 4s -25%
sign_keypair_internal ✅ 3s 6s -50%
sign_verify ✅ 3s 2s +50%
sign_verify_extmu ✅ 3s 4s -25%
sign_verify_pre_hash_shake256 ✅ 3s 7s -57%
sk_s2hat_get_poly ✅ 3s 2s +50%
unpack_pk_t1 ✅ 3s 2s +50%
unpack_sk_t0hat ✅ 3s 4s -25%
intt_native_aarch64 ✅ 2s 4s -50%
keccak_f1600_x1_native_aarch64_v84a ✅ 2s 2s +0%
keccak_f1600_x4_native_aarch64_v84a ✅ 2s 1s +100%
keccak_f1600_x4_native_aarch64_v8a_scalar_hybrid ✅ 2s 2s +0%
keccak_f1600_x4_native_aarch64_v8a_v84a_scalar_hybrid ✅ 2s 2s +0%
keccak_init ✅ 2s 1s +100%
keccakf1600_permute ✅ 2s 2s +0%
keccakf1600_xor_bytes ✅ 2s 1s +100%
keccakf1600x4_extract_bytes ✅ 2s 1s +100%
keccakf1600x4_xor_bytes ✅ 2s 1s +100%
mld_ct_get_optblocker_i64 ✅ 2s 2s +0%
mld_ct_get_optblocker_u32 ✅ 2s 2s +0%
mld_value_barrier_i64 ✅ 2s 2s +0%
mld_value_barrier_u32 ✅ 2s 3s -33%
ntt_native_x86_64 ✅ 2s 2s +0%
pack_sig_h ✅ 2s 3s -33%
poly_caddq_native ✅ 2s 3s -33%
poly_chknorm_native_aarch64 ✅ 2s 5s -60%
poly_decompose ✅ 2s 2s +0%
poly_decompose_native ✅ 2s 2s +0%
poly_invntt_tomont ✅ 2s 4s -50%
poly_invntt_tomont_native ✅ 2s 2s +0%
poly_ntt_native ✅ 2s 4s -50%
poly_permute_bitrev_to_custom_optional ✅ 2s 2s +0%
poly_permute_bitrev_to_custom_optional_native ✅ 2s 3s -33%
poly_pointwise_montgomery_native ✅ 2s 3s -33%
poly_sub ✅ 2s 5s -60%
poly_use_hint_native_x86_64 ✅ 2s - new
polyveck_ntt ✅ 2s 3s -33%
polyveck_pack_eta ✅ 2s 5s -60%
polyveck_unpack_eta ✅ 2s 3s -33%
polyvecl_pack_eta ✅ 2s 2s +0%
polyw1_pack_88 ✅ 2s 2s +0%
polyz_unpack_native_x86_64 ✅ 2s 3s -33%
power2round ✅ 2s 3s -33%
rej_eta ✅ 2s 2s +0%
rej_eta_c ✅ 2s 4s -50%
rej_uniform_native_aarch64 ✅ 2s 3s -33%
shake128_squeeze ✅ 2s 1s +100%
shake256_finalize ✅ 2s 3s -33%
shake256_squeeze ✅ 2s 2s +0%
shake256x4_absorb_once ✅ 2s 5s -60%
sign_signature_extmu ✅ 2s 4s -50%
sk_t0hat_get_poly ✅ 2s 3s -33%
unpack_sk_s1hat ✅ 2s 3s -33%
unpack_sk_s2hat ✅ 2s 3s -33%
yvec_get_poly ✅ 2s 2s +0%
yvec_init ✅ 2s 4s -50%
keccak_f1600_x1_native_aarch64 ✅ 1s 2s -50%
keccak_f1600_x4_native_avx2 ✅ 1s 3s -67%
keccak_finalize ✅ 1s 1s +0%
keccakf1600_xor_bytes (big endian) ✅ 1s 2s -50%
mld_ct_cmask_nonzero_u32 ✅ 1s 5s -80%
mld_ct_memcmp ✅ 1s 1s +0%
poly_decompose_32_native_aarch64 ✅ 1s 3s -67%
poly_decompose_native_x86_64 ✅ 1s 3s -67%
poly_use_hint_c ✅ 1s 4s -75%
polyvecl_unpack_z ✅ 1s 3s -67%
shake128_absorb ✅ 1s 2s -50%
shake128_finalize ✅ 1s 2s -50%
shake128x4_absorb_once ✅ 1s 4s -75%
shake256_init ✅ 1s 3s -67%
shake256_release ✅ 1s 5s -80%
unpack_sk ✅ 1s 4s -75%

@oqs-bot

oqs-bot commented Jun 26, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

CBMC Results (ML-DSA-65)

Full Results (206 proofs)
Proof Status Current Previous Change
**TOTAL** ✅ 1784s 1784s +0.0%
polyvecl_pointwise_acc_montgomery_c ✅ 216s 210s +3%
sign_verify_internal ✅ 172s 177s -3%
poly_pointwise_montgomery_c ✅ 122s 125s -2%
polyvec_matrix_expand ✅ 109s 110s -1%
mld_invntt_layer ✅ 108s 109s -1%
mld_attempt_signature_generation ✅ 65s 63s +3%
sign_signature_internal ✅ 55s 55s +0%
fqmul ✅ 42s 40s +5%
mld_ntt_layer ✅ 41s 41s +0%
polyvec_matrix_expand_serial ✅ 28s 27s +4%
mld_ntt_butterfly_block ✅ 22s 24s -8%
keccakf1600x4_permute_native ✅ 21s 23s -9%
poly_ntt_c ✅ 21s 19s +11%
polyvec_matrix_pointwise_montgomery_yvec ✅ 20s 18s +11%
poly_chknorm_c ✅ 15s 15s +0%
polyt0_unpack ✅ 15s 16s -6%
compute_pack_t0_t1 ✅ 14s 13s +8%
mld_check_pct ✅ 14s 14s +0%
poly_uniform_eta_4x ✅ 13s 14s -7%
polyveck_decompose ✅ 13s 12s +8%
rej_uniform ✅ 13s 18s -28%
rej_uniform_c ✅ 13s 14s -7%
poly_uniform_4x ✅ 12s 13s -8%
polyz_unpack_c ✅ 11s 13s -15%
keccak_absorb_once_x4 ✅ 10s 8s +25%
polyveck_invntt_tomont ✅ 10s 8s +25%
poly_invntt_tomont_c ✅ 9s 11s -18%
rej_uniform_native_x86_64 ✅ 8s - new
mld_compute_pack_z ✅ 7s 7s +0%
mld_keccakf1600_permute_c ✅ 7s 6s +17%
polyveck_ntt ✅ 7s 7s +0%
sign_verify_pre_hash_internal ✅ 7s 5s +40%
unpack_sk_s2hat ✅ 7s 4s +75%
mld_ct_cmask_nonzero_u8 ✅ 6s 3s +100%
nttunpack_native_x86_64 ✅ 6s 3s +100%
pointwise_acc_native_aarch64 ✅ 6s 6s +0%
poly_challenge ✅ 6s 6s +0%
poly_use_hint_c ✅ 6s 5s +20%
polyeta_unpack ✅ 6s 8s -25%
polyveck_chknorm ✅ 6s 6s +0%
polyvecl_uniform_gamma1 ✅ 6s 2s +200%
sign_keypair_internal ✅ 6s 5s +20%
sign_pk_from_sk ✅ 6s 6s +0%
sign_signature ✅ 6s 6s +0%
unpack_sk_t0hat ✅ 6s 5s +20%
intt_native_x86_64 ✅ 5s 3s +67%
mld_ct_cmask_nonzero_u32 ✅ 5s 4s +25%
mld_sample_s1_s2_serial ✅ 5s 4s +25%
pointwise_acc_native_x86_64 ✅ 5s 8s -38%
poly_add ✅ 5s 9s -44%
poly_decompose_c ✅ 5s 5s +0%
poly_ntt_native ✅ 5s 4s +25%
poly_uniform_gamma1 ✅ 5s 3s +67%
polyt1_pack ✅ 5s 3s +67%
polyt1_unpack ✅ 5s 5s +0%
polyveck_caddq ✅ 5s 6s -17%
polyvecl_ntt ✅ 5s 4s +25%
polyz_unpack_native_x86_64 ✅ 5s 3s +67%
power2round ✅ 5s 1s +400%
rej_uniform_eta_native_aarch64 ✅ 5s 4s +25%
rej_uniform_native ✅ 5s 4s +25%
sign_signature_extmu ✅ 5s 2s +150%
intt_native_aarch64 ✅ 4s 3s +33%
make_hint ✅ 4s 2s +100%
montgomery_reduce ✅ 4s 4s +0%
pack_sig_z ✅ 4s 2s +100%
pointwise_native_x86_64 ✅ 4s 3s +33%
poly_chknorm_native_x86_64 ✅ 4s 3s +33%
poly_decompose_88_native_aarch64 ✅ 4s 1s +300%
poly_permute_bitrev_to_custom_optional_native ✅ 4s 4s +0%
poly_use_hint_native_aarch64 ✅ 4s 3s +33%
polyvecl_chknorm ✅ 4s 7s -43%
polyvecl_pack_eta ✅ 4s 3s +33%
polyw1_pack ✅ 4s 4s +0%
rej_eta_c ✅ 4s 5s -20%
shake128_absorb ✅ 4s 2s +100%
sign_keypair ✅ 4s 3s +33%
sign_signature_pre_hash_shake256 ✅ 4s 3s +33%
sign_verify_pre_hash_shake256 ✅ 4s 5s -20%
sys_check_capability ✅ 4s 4s +0%
unpack_pk_t1 ✅ 4s 5s -20%
use_hint ✅ 4s 2s +100%
yvec_init ✅ 4s 3s +33%
caddq ✅ 3s 3s +0%
decompose ✅ 3s 1s +200%
fqscale ✅ 3s 3s +0%
keccak_f1600_x1_native_aarch64_v84a ✅ 3s 3s +0%
keccak_f1600_x4_native_avx2 ✅ 3s 2s +50%
keccak_squeezeblocks_x4 ✅ 3s 5s -40%
keccakf1600_permute ✅ 3s 2s +50%
keccakf1600_permute_native ✅ 3s 3s +0%
keccakf1600x4_extract_bytes ✅ 3s 4s -25%
keccakf1600x4_permute ✅ 3s 4s -25%
mld_ct_abs_i32 ✅ 3s 2s +50%
mld_ct_get_optblocker_u32 ✅ 3s 3s +0%
mld_ct_get_optblocker_u8 ✅ 3s 2s +50%
mld_ct_memcmp ✅ 3s 2s +50%
mld_ct_sel_int32 ✅ 3s 3s +0%
mld_keccakf1600x4_extract_bytes_c ✅ 3s 3s +0%
mld_keccakf1600x4_xor_bytes_c ✅ 3s 2s +50%
mld_prepare_domain_separation_prefix ✅ 3s 2s +50%
mld_sample_s1_s2 ✅ 3s 6s -50%
mld_value_barrier_i64 ✅ 3s 2s +50%
mld_value_barrier_u32 ✅ 3s 3s +0%
mld_value_barrier_u8 ✅ 3s 3s +0%
ntt_native_aarch64 ✅ 3s 2s +50%
ntt_native_x86_64 ✅ 3s 2s +50%
pack_sig_c ✅ 3s 5s -40%
pack_sk_rho_key_tr_s2 ✅ 3s 2s +50%
pack_sk_s1 ✅ 3s 5s -40%
pointwise_native_aarch64 ✅ 3s 5s -40%
poly_caddq ✅ 3s 2s +50%
poly_caddq_c ✅ 3s 2s +50%
poly_chknorm ✅ 3s 4s -25%
poly_chknorm_native ✅ 3s 2s +50%
poly_chknorm_native_aarch64 ✅ 3s 3s +0%
poly_decompose ✅ 3s 2s +50%
poly_decompose_32_native_aarch64 ✅ 3s 3s +0%
poly_invntt_tomont_native ✅ 3s 2s +50%
poly_ntt ✅ 3s 2s +50%
poly_pointwise_montgomery ✅ 3s 3s +0%
poly_pointwise_montgomery_native ✅ 3s 3s +0%
poly_power2round ✅ 3s 4s -25%
poly_shiftl ✅ 3s 3s +0%
poly_sub ✅ 3s 3s +0%
poly_uniform ✅ 3s 4s -25%
poly_uniform_eta ✅ 3s 4s -25%
poly_uniform_gamma1_4x ✅ 3s 4s -25%
poly_use_hint ✅ 3s 3s +0%
polyt0_pack ✅ 3s 3s +0%
polyveck_pack_eta ✅ 3s 4s -25%
polyveck_pack_w1 ✅ 3s 3s +0%
polyveck_reduce ✅ 3s 4s -25%
polyveck_unpack_eta ✅ 3s 6s -50%
polyvecl_pointwise_acc_montgomery_native ✅ 3s 2s +50%
polyvecl_unpack_eta ✅ 3s 3s +0%
polyvecl_unpack_z ✅ 3s 3s +0%
polyw1_pack_32 ✅ 3s 4s -25%
polyz_unpack_17_native_aarch64 ✅ 3s 3s +0%
rej_uniform_native_aarch64 ✅ 3s 3s +0%
shake128_finalize ✅ 3s 1s +200%
shake128_squeeze ✅ 3s 2s +50%
shake256_finalize ✅ 3s 1s +200%
shake256_init ✅ 3s 2s +50%
shake256_release ✅ 3s 2s +50%
sign_signature_pre_hash_internal ✅ 3s 3s +0%
sign_verify_extmu ✅ 3s 3s +0%
sk_s1hat_get_poly ✅ 3s 6s -50%
unpack_sk ✅ 3s 3s +0%
keccak_absorb ✅ 2s 3s -33%
keccak_f1600_x4_native_aarch64_v8a_scalar_hybrid ✅ 2s 2s +0%
keccak_init ✅ 2s 1s +100%
keccak_squeeze ✅ 2s 4s -50%
keccakf1600_xor_bytes ✅ 2s 2s +0%
keccakf1600_xor_bytes (big endian) ✅ 2s 2s +0%
keccakf1600x4_extract_bytes_native ✅ 2s 4s -50%
keccakf1600x4_xor_bytes ✅ 2s 1s +100%
mld_h ✅ 2s 2s +0%
mld_keccakf1600_extract_bytes ✅ 2s 1s +100%
pack_sig_h ✅ 2s 5s -60%
poly_caddq_native ✅ 2s 2s +0%
poly_caddq_native_aarch64 ✅ 2s 2s +0%
poly_caddq_native_x86_64 ✅ 2s 3s -33%
poly_decompose_native_x86_64 ✅ 2s 3s -33%
poly_invntt_tomont ✅ 2s 3s -33%
poly_permute_bitrev_to_custom_optional ✅ 2s 2s +0%
poly_use_hint_native ✅ 2s 2s +0%
poly_use_hint_native_x86_64 ✅ 2s - new
polyeta_pack ✅ 2s 3s -33%
polyvec_matrix_pointwise_montgomery_row ✅ 2s 1s +100%
polyvecl_pointwise_acc_montgomery ✅ 2s 3s -33%
polyvecl_uniform_gamma1_serial ✅ 2s 3s -33%
polyw1_pack_88 ✅ 2s 2s +0%
polyz_pack ✅ 2s 3s -33%
polyz_unpack ✅ 2s 3s -33%
polyz_unpack_19_native_aarch64 ✅ 2s 3s -33%
polyz_unpack_native ✅ 2s 4s -50%
reduce32 ✅ 2s 3s -33%
rej_eta_native ✅ 2s 3s -33%
shake128_release ✅ 2s 3s -33%
shake128x4_absorb_once ✅ 2s 3s -33%
shake256 ✅ 2s 2s +0%
shake256_absorb ✅ 2s 2s +0%
shake256_squeeze ✅ 2s 3s -33%
sig_unpack_hints ✅ 2s 2s +0%
sign_verify ✅ 2s 3s -33%
sk_s2hat_get_poly ✅ 2s 2s +0%
sk_t0hat_get_poly ✅ 2s 2s +0%
unpack_sk_s1hat ✅ 2s 2s +0%
yvec_get_poly ✅ 2s 3s -33%
keccak_f1600_x1_native_aarch64 ✅ 1s 2s -50%
keccak_f1600_x4_native_aarch64_v84a ✅ 1s 4s -75%
keccak_f1600_x4_native_aarch64_v8a_v84a_scalar_hybrid ✅ 1s 2s -50%
keccak_finalize ✅ 1s 2s -50%
keccakf1600_extract_bytes (big endian) ✅ 1s 2s -50%
keccakf1600x4_xor_bytes_native ✅ 1s 3s -67%
mld_ct_cmask_neg_i32 ✅ 1s 2s -50%
mld_ct_get_optblocker_i64 ✅ 1s 2s -50%
mld_polymat_expand_entry ✅ 1s 4s -75%
poly_decompose_native ✅ 1s 3s -67%
poly_reduce ✅ 1s 3s -67%
rej_eta ✅ 1s 2s -50%
shake128_init ✅ 1s 2s -50%
shake128x4_squeezeblocks ✅ 1s 3s -67%
shake256x4_absorb_once ✅ 1s 3s -67%
shake256x4_squeezeblocks ✅ 1s 2s -50%

@oqs-bot

oqs-bot commented Jun 26, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

CBMC Results (ML-DSA-44)

Full Results (206 proofs)
Proof Status Current Previous Change
**TOTAL** ✅ 1562s 1514s +3.2%
polyvecl_pointwise_acc_montgomery_c ✅ 131s 131s +0%
poly_pointwise_montgomery_c ✅ 127s 114s +11%
sign_verify_internal ✅ 115s 114s +1%
mld_invntt_layer ✅ 112s 107s +5%
mld_attempt_signature_generation ✅ 59s 58s +2%
compute_pack_t0_t1 ✅ 49s 50s -2%
mld_ntt_layer ✅ 45s 42s +7%
fqmul ✅ 38s 39s -3%
polyvec_matrix_expand ✅ 28s 28s +0%
mld_ntt_butterfly_block ✅ 24s 23s +4%
sign_signature_internal ✅ 23s 26s -12%
keccakf1600x4_permute_native ✅ 22s 22s +0%
poly_ntt_c ✅ 22s 19s +16%
poly_chknorm_c ✅ 17s 17s +0%
mld_check_pct ✅ 16s 14s +14%
rej_uniform_c ✅ 16s 15s +7%
polyt0_unpack ✅ 15s 15s +0%
polyvec_matrix_pointwise_montgomery_yvec ✅ 15s 15s +0%
polyeta_unpack ✅ 14s 14s +0%
poly_invntt_tomont_c ✅ 13s 11s +18%
polyz_unpack_c ✅ 13s 11s +18%
rej_uniform ✅ 13s 18s -28%
poly_uniform_4x ✅ 11s 14s -21%
poly_uniform_eta_4x ✅ 11s 11s +0%
polyvecl_chknorm ✅ 11s 10s +10%
rej_uniform_native_x86_64 ✅ 10s - new
keccak_absorb_once_x4 ✅ 9s 9s +0%
mld_keccakf1600_permute_c ✅ 8s 8s +0%
poly_chknorm_native_aarch64 ✅ 8s 4s +100%
polyvec_matrix_expand_serial ✅ 8s 8s +0%
mld_compute_pack_z ✅ 7s 7s +0%
pointwise_acc_native_x86_64 ✅ 7s 7s +0%
poly_add ✅ 6s 7s -14%
sign_pk_from_sk ✅ 6s 5s +20%
mld_h ✅ 5s 4s +25%
mld_polymat_expand_entry ✅ 5s 3s +67%
pack_sig_z ✅ 5s 4s +25%
pointwise_native_aarch64 ✅ 5s 5s +0%
poly_chknorm_native ✅ 5s 4s +25%
poly_decompose_c ✅ 5s 4s +25%
poly_permute_bitrev_to_custom_optional ✅ 5s 2s +150%
polyt1_pack ✅ 5s 4s +25%
polyveck_chknorm ✅ 5s 5s +0%
polyveck_decompose ✅ 5s 4s +25%
polyvecl_pack_eta ✅ 5s 3s +67%
polyvecl_uniform_gamma1 ✅ 5s 3s +67%
polyvecl_uniform_gamma1_serial ✅ 5s 2s +150%
rej_eta ✅ 5s 3s +67%
rej_eta_c ✅ 5s 4s +25%
shake256x4_absorb_once ✅ 5s 3s +67%
sign_signature_pre_hash_internal ✅ 5s 6s -17%
sign_verify_extmu ✅ 5s 3s +67%
sign_verify_pre_hash_internal ✅ 5s 3s +67%
sign_verify_pre_hash_shake256 ✅ 5s 5s +0%
unpack_sk_s1hat ✅ 5s 1s +400%
fqscale ✅ 4s 3s +33%
keccak_finalize ✅ 4s 3s +33%
keccak_squeezeblocks_x4 ✅ 4s 4s +0%
keccakf1600_xor_bytes ✅ 4s 1s +300%
make_hint ✅ 4s 3s +33%
mld_ct_cmask_nonzero_u8 ✅ 4s 2s +100%
mld_ct_get_optblocker_u8 ✅ 4s 1s +300%
mld_keccakf1600_extract_bytes ✅ 4s 2s +100%
mld_sample_s1_s2 ✅ 4s 4s +0%
ntt_native_aarch64 ✅ 4s 3s +33%
pack_sig_h ✅ 4s 3s +33%
pack_sk_rho_key_tr_s2 ✅ 4s 3s +33%
pointwise_acc_native_aarch64 ✅ 4s 4s +0%
poly_caddq_native_aarch64 ✅ 4s 4s +0%
poly_caddq_native_x86_64 ✅ 4s 4s +0%
poly_challenge ✅ 4s 3s +33%
poly_chknorm ✅ 4s 4s +0%
poly_decompose_32_native_aarch64 ✅ 4s 2s +100%
poly_invntt_tomont_native ✅ 4s 4s +0%
poly_permute_bitrev_to_custom_optional_native ✅ 4s 4s +0%
poly_power2round ✅ 4s 4s +0%
poly_reduce ✅ 4s 3s +33%
poly_uniform ✅ 4s 6s -33%
poly_use_hint_native ✅ 4s 4s +0%
poly_use_hint_native_aarch64 ✅ 4s 2s +100%
poly_use_hint_native_x86_64 ✅ 4s - new
polyeta_pack ✅ 4s 3s +33%
polyt1_unpack ✅ 4s 5s -20%
polyveck_caddq ✅ 4s 3s +33%
polyvecl_ntt ✅ 4s 2s +100%
polyvecl_pointwise_acc_montgomery ✅ 4s 4s +0%
polyvecl_pointwise_acc_montgomery_native ✅ 4s 2s +100%
polyw1_pack ✅ 4s 3s +33%
polyw1_pack_88 ✅ 4s 1s +300%
polyz_unpack_17_native_aarch64 ✅ 4s 5s -20%
polyz_unpack_native_x86_64 ✅ 4s 3s +33%
shake128_finalize ✅ 4s 2s +100%
shake128_squeeze ✅ 4s 1s +300%
shake256 ✅ 4s 1s +300%
shake256_init ✅ 4s 3s +33%
sign_keypair_internal ✅ 4s 4s +0%
sign_signature_extmu ✅ 4s 4s +0%
sign_verify ✅ 4s 4s +0%
unpack_sk_t0hat ✅ 4s 3s +33%
intt_native_aarch64 ✅ 3s 9s -67%
intt_native_x86_64 ✅ 3s 4s -25%
keccak_f1600_x1_native_aarch64 ✅ 3s 2s +50%
keccak_f1600_x1_native_aarch64_v84a ✅ 3s 3s +0%
keccak_f1600_x4_native_aarch64_v84a ✅ 3s 2s +50%
keccak_f1600_x4_native_aarch64_v8a_scalar_hybrid ✅ 3s 3s +0%
keccak_f1600_x4_native_aarch64_v8a_v84a_scalar_hybrid ✅ 3s 1s +200%
keccak_f1600_x4_native_avx2 ✅ 3s 3s +0%
keccak_squeeze ✅ 3s 1s +200%
keccakf1600_permute ✅ 3s 2s +50%
keccakf1600_xor_bytes (big endian) ✅ 3s 4s -25%
mld_ct_abs_i32 ✅ 3s 2s +50%
mld_ct_cmask_nonzero_u32 ✅ 3s 2s +50%
mld_prepare_domain_separation_prefix ✅ 3s 4s -25%
mld_sample_s1_s2_serial ✅ 3s 3s +0%
mld_value_barrier_u8 ✅ 3s 3s +0%
ntt_native_x86_64 ✅ 3s 3s +0%
pack_sk_s1 ✅ 3s 2s +50%
poly_caddq ✅ 3s 2s +50%
poly_caddq_c ✅ 3s 2s +50%
poly_chknorm_native_x86_64 ✅ 3s 2s +50%
poly_ntt_native ✅ 3s 5s -40%
poly_pointwise_montgomery_native ✅ 3s 2s +50%
poly_shiftl ✅ 3s 3s +0%
poly_uniform_gamma1_4x ✅ 3s 5s -40%
polyt0_pack ✅ 3s 2s +50%
polyveck_invntt_tomont ✅ 3s 5s -40%
polyveck_reduce ✅ 3s 5s -40%
polyvecl_unpack_eta ✅ 3s 2s +50%
polyvecl_unpack_z ✅ 3s 2s +50%
polyz_unpack_native ✅ 3s 2s +50%
power2round ✅ 3s 3s +0%
rej_eta_native ✅ 3s 6s -50%
rej_uniform_eta_native_aarch64 ✅ 3s 2s +50%
rej_uniform_native ✅ 3s 4s -25%
rej_uniform_native_aarch64 ✅ 3s 5s -40%
shake128_absorb ✅ 3s 2s +50%
shake128_init ✅ 3s 3s +0%
shake128_release ✅ 3s 1s +200%
shake128x4_absorb_once ✅ 3s 3s +0%
shake256_finalize ✅ 3s 2s +50%
sig_unpack_hints ✅ 3s 2s +50%
sign_keypair ✅ 3s 4s -25%
sign_signature ✅ 3s 3s +0%
sign_signature_pre_hash_shake256 ✅ 3s 3s +0%
sk_s1hat_get_poly ✅ 3s 3s +0%
use_hint ✅ 3s 2s +50%
yvec_get_poly ✅ 3s 3s +0%
yvec_init ✅ 3s 3s +0%
caddq ✅ 2s 2s +0%
decompose ✅ 2s 2s +0%
keccak_absorb ✅ 2s 5s -60%
keccak_init ✅ 2s 3s -33%
keccakf1600_extract_bytes (big endian) ✅ 2s 2s +0%
keccakf1600x4_extract_bytes ✅ 2s 2s +0%
keccakf1600x4_permute ✅ 2s 4s -50%
keccakf1600x4_xor_bytes_native ✅ 2s 3s -33%
mld_ct_cmask_neg_i32 ✅ 2s 3s -33%
mld_ct_get_optblocker_u32 ✅ 2s 1s +100%
mld_ct_memcmp ✅ 2s 3s -33%
mld_ct_sel_int32 ✅ 2s 2s +0%
mld_keccakf1600x4_xor_bytes_c ✅ 2s 2s +0%
mld_value_barrier_i64 ✅ 2s 2s +0%
mld_value_barrier_u32 ✅ 2s 2s +0%
montgomery_reduce ✅ 2s 3s -33%
nttunpack_native_x86_64 ✅ 2s 1s +100%
pointwise_native_x86_64 ✅ 2s 4s -50%
poly_caddq_native ✅ 2s 5s -60%
poly_decompose ✅ 2s 3s -33%
poly_decompose_88_native_aarch64 ✅ 2s 4s -50%
poly_decompose_native ✅ 2s 3s -33%
poly_decompose_native_x86_64 ✅ 2s 3s -33%
poly_invntt_tomont ✅ 2s 4s -50%
poly_ntt ✅ 2s 3s -33%
poly_sub ✅ 2s 3s -33%
poly_uniform_eta ✅ 2s 5s -60%
poly_uniform_gamma1 ✅ 2s 4s -50%
poly_use_hint ✅ 2s 4s -50%
poly_use_hint_c ✅ 2s 3s -33%
polyvec_matrix_pointwise_montgomery_row ✅ 2s 2s +0%
polyveck_ntt ✅ 2s 5s -60%
polyveck_pack_w1 ✅ 2s 1s +100%
polyveck_unpack_eta ✅ 2s 2s +0%
polyw1_pack_32 ✅ 2s 2s +0%
polyz_pack ✅ 2s 2s +0%
polyz_unpack ✅ 2s 3s -33%
polyz_unpack_19_native_aarch64 ✅ 2s 5s -60%
reduce32 ✅ 2s 2s +0%
shake256_absorb ✅ 2s 3s -33%
shake256_release ✅ 2s 2s +0%
shake256_squeeze ✅ 2s 2s +0%
sk_s2hat_get_poly ✅ 2s 2s +0%
sk_t0hat_get_poly ✅ 2s 2s +0%
unpack_pk_t1 ✅ 2s 5s -60%
unpack_sk ✅ 2s 3s -33%
unpack_sk_s2hat ✅ 2s 4s -50%
keccakf1600_permute_native ✅ 1s 3s -67%
keccakf1600x4_extract_bytes_native ✅ 1s 3s -67%
keccakf1600x4_xor_bytes ✅ 1s 2s -50%
mld_ct_get_optblocker_i64 ✅ 1s 4s -75%
mld_keccakf1600x4_extract_bytes_c ✅ 1s 2s -50%
pack_sig_c ✅ 1s 2s -50%
poly_pointwise_montgomery ✅ 1s 3s -67%
polyveck_pack_eta ✅ 1s 2s -50%
shake128x4_squeezeblocks ✅ 1s 1s +0%
shake256x4_squeezeblocks ✅ 1s 4s -75%
sys_check_capability ✅ 1s 4s -75%

@oqs-bot

oqs-bot commented Jun 26, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

CBMC Results (ML-DSA-87)

Full Results (206 proofs)
Proof Status Current Previous Change
**TOTAL** ✅ 2092s 2151s -2.7%
polyvecl_pointwise_acc_montgomery_c ✅ 338s 353s -4%
polyvec_matrix_expand ✅ 305s 324s -6%
poly_pointwise_montgomery_c ✅ 136s 144s -6%
mld_invntt_layer ✅ 121s 115s +5%
sign_verify_internal ✅ 100s 97s +3%
mld_attempt_signature_generation ✅ 55s 55s +0%
mld_ntt_layer ✅ 45s 45s +0%
sign_signature_internal ✅ 44s 42s +5%
fqmul ✅ 42s 43s -2%
polyvec_matrix_expand_serial ✅ 37s 38s -3%
keccakf1600x4_permute_native ✅ 23s 23s +0%
mld_ntt_butterfly_block ✅ 23s 24s -4%
poly_ntt_c ✅ 23s 21s +10%
compute_pack_t0_t1 ✅ 19s 19s +0%
poly_chknorm_c ✅ 16s 15s +7%
polyeta_unpack ✅ 16s 17s -6%
polyt0_unpack ✅ 16s 14s +14%
polyvec_matrix_pointwise_montgomery_yvec ✅ 16s 18s -11%
rej_uniform ✅ 15s 15s +0%
rej_uniform_c ✅ 15s 19s -21%
poly_uniform_4x ✅ 14s 13s +8%
polyveck_decompose ✅ 14s 13s +8%
mld_check_pct ✅ 13s 16s -19%
poly_invntt_tomont_c ✅ 12s 12s +0%
poly_uniform_eta_4x ✅ 12s 11s +9%
polyveck_ntt ✅ 12s 11s +9%
mld_compute_pack_z ✅ 11s 8s +38%
keccak_absorb_once_x4 ✅ 10s 9s +11%
mld_sample_s1_s2 ✅ 9s 6s +50%
mld_keccakf1600_permute_c ✅ 8s 7s +14%
polyveck_invntt_tomont ✅ 8s 9s -11%
rej_uniform_native_x86_64 ✅ 8s - new
pointwise_acc_native_x86_64 ✅ 7s 6s +17%
pointwise_native_aarch64 ✅ 7s 5s +40%
polyvecl_ntt ✅ 7s 7s +0%
pointwise_acc_native_aarch64 ✅ 6s 6s +0%
poly_add ✅ 6s 6s +0%
poly_pointwise_montgomery_native ✅ 6s 5s +20%
poly_uniform_eta ✅ 6s 4s +50%
polyveck_caddq ✅ 6s 8s -25%
polyvecl_unpack_z ✅ 6s 4s +50%
rej_uniform_native ✅ 6s 8s -25%
sign_keypair_internal ✅ 6s 6s +0%
sign_signature_pre_hash_internal ✅ 6s 5s +20%
unpack_sk_t0hat ✅ 6s 7s -14%
make_hint ✅ 5s 3s +67%
mld_h ✅ 5s 3s +67%
mld_sample_s1_s2_serial ✅ 5s 8s -38%
montgomery_reduce ✅ 5s 3s +67%
ntt_native_aarch64 ✅ 5s 6s -17%
nttunpack_native_x86_64 ✅ 5s 3s +67%
pointwise_native_x86_64 ✅ 5s 2s +150%
poly_caddq_native_x86_64 ✅ 5s 2s +150%
poly_challenge ✅ 5s 5s +0%
poly_chknorm ✅ 5s 3s +67%
poly_decompose ✅ 5s 3s +67%
poly_ntt ✅ 5s 3s +67%
polyt1_unpack ✅ 5s 4s +25%
reduce32 ✅ 5s 3s +67%
sign_keypair ✅ 5s 4s +25%
sign_signature_extmu ✅ 5s 4s +25%
sign_signature_pre_hash_shake256 ✅ 5s 6s -17%
intt_native_aarch64 ✅ 4s 3s +33%
intt_native_x86_64 ✅ 4s 3s +33%
keccak_squeeze ✅ 4s 2s +100%
keccakf1600_permute_native ✅ 4s 4s +0%
keccakf1600x4_xor_bytes ✅ 4s 3s +33%
mld_prepare_domain_separation_prefix ✅ 4s 4s +0%
pack_sk_s1 ✅ 4s 1s +300%
poly_caddq_native ✅ 4s 4s +0%
poly_caddq_native_aarch64 ✅ 4s 3s +33%
poly_chknorm_native_x86_64 ✅ 4s 2s +100%
poly_decompose_native ✅ 4s 2s +100%
poly_invntt_tomont ✅ 4s 1s +300%
poly_invntt_tomont_native ✅ 4s 5s -20%
poly_ntt_native ✅ 4s 3s +33%
poly_permute_bitrev_to_custom_optional ✅ 4s 3s +33%
poly_shiftl ✅ 4s 4s +0%
poly_uniform ✅ 4s 4s +0%
poly_uniform_gamma1 ✅ 4s 4s +0%
poly_use_hint ✅ 4s 1s +300%
poly_use_hint_native_aarch64 ✅ 4s 2s +100%
poly_use_hint_native_x86_64 ✅ 4s - new
polyeta_pack ✅ 4s 4s +0%
polyveck_unpack_eta ✅ 4s 4s +0%
polyvecl_pack_eta ✅ 4s 3s +33%
polyvecl_pointwise_acc_montgomery_native ✅ 4s 3s +33%
polyz_unpack_native_x86_64 ✅ 4s 3s +33%
rej_eta_native ✅ 4s 6s -33%
shake128_init ✅ 4s 1s +300%
shake256x4_absorb_once ✅ 4s 2s +100%
sig_unpack_hints ✅ 4s 3s +33%
sign_pk_from_sk ✅ 4s 6s -33%
sign_verify_extmu ✅ 4s 3s +33%
sign_verify_pre_hash_internal ✅ 4s 3s +33%
sign_verify_pre_hash_shake256 ✅ 4s 3s +33%
yvec_get_poly ✅ 4s 4s +0%
caddq ✅ 3s 4s -25%
keccak_absorb ✅ 3s 3s +0%
keccak_f1600_x1_native_aarch64 ✅ 3s 1s +200%
keccak_f1600_x4_native_aarch64_v8a_scalar_hybrid ✅ 3s 3s +0%
keccak_squeezeblocks_x4 ✅ 3s 4s -25%
keccakf1600_permute ✅ 3s 3s +0%
keccakf1600x4_extract_bytes ✅ 3s 2s +50%
mld_ct_cmask_nonzero_u32 ✅ 3s 2s +50%
mld_ct_cmask_nonzero_u8 ✅ 3s 3s +0%
mld_ct_get_optblocker_u32 ✅ 3s 2s +50%
mld_ct_get_optblocker_u8 ✅ 3s 3s +0%
mld_keccakf1600_extract_bytes ✅ 3s 4s -25%
mld_keccakf1600x4_xor_bytes_c ✅ 3s 4s -25%
mld_value_barrier_i64 ✅ 3s 1s +200%
pack_sig_c ✅ 3s 4s -25%
pack_sig_h ✅ 3s 4s -25%
pack_sig_z ✅ 3s 5s -40%
pack_sk_rho_key_tr_s2 ✅ 3s 3s +0%
poly_caddq_c ✅ 3s 3s +0%
poly_chknorm_native ✅ 3s 4s -25%
poly_chknorm_native_aarch64 ✅ 3s 4s -25%
poly_decompose_c ✅ 3s 5s -40%
poly_permute_bitrev_to_custom_optional_native ✅ 3s 5s -40%
poly_pointwise_montgomery ✅ 3s 4s -25%
poly_reduce ✅ 3s 2s +50%
poly_sub ✅ 3s 3s +0%
poly_use_hint_native ✅ 3s 3s +0%
polyt1_pack ✅ 3s 3s +0%
polyveck_chknorm ✅ 3s 3s +0%
polyveck_reduce ✅ 3s 3s +0%
polyvecl_uniform_gamma1_serial ✅ 3s 4s -25%
polyvecl_unpack_eta ✅ 3s 5s -40%
polyz_unpack_19_native_aarch64 ✅ 3s 4s -25%
polyz_unpack_native ✅ 3s 4s -25%
power2round ✅ 3s 4s -25%
rej_eta ✅ 3s 4s -25%
rej_uniform_native_aarch64 ✅ 3s 2s +50%
shake128_absorb ✅ 3s 4s -25%
shake128_finalize ✅ 3s 2s +50%
shake128x4_squeezeblocks ✅ 3s 3s +0%
shake256 ✅ 3s 2s +50%
shake256_absorb ✅ 3s 2s +50%
shake256_init ✅ 3s 2s +50%
shake256_release ✅ 3s 3s +0%
sign_signature ✅ 3s 5s -40%
sign_verify ✅ 3s 5s -40%
sk_t0hat_get_poly ✅ 3s 4s -25%
unpack_sk ✅ 3s 5s -40%
unpack_sk_s1hat ✅ 3s 2s +50%
use_hint ✅ 3s 3s +0%
yvec_init ✅ 3s 4s -25%
decompose ✅ 2s 3s -33%
fqscale ✅ 2s 3s -33%
keccak_f1600_x1_native_aarch64_v84a ✅ 2s 1s +100%
keccak_f1600_x4_native_aarch64_v84a ✅ 2s 4s -50%
keccak_f1600_x4_native_avx2 ✅ 2s 2s +0%
keccak_init ✅ 2s 3s -33%
keccakf1600_extract_bytes (big endian) ✅ 2s 3s -33%
keccakf1600_xor_bytes (big endian) ✅ 2s 2s +0%
keccakf1600x4_permute ✅ 2s 3s -33%
mld_ct_abs_i32 ✅ 2s 3s -33%
mld_keccakf1600x4_extract_bytes_c ✅ 2s 2s +0%
mld_polymat_expand_entry ✅ 2s 3s -33%
poly_caddq ✅ 2s 2s +0%
poly_decompose_88_native_aarch64 ✅ 2s 2s +0%
poly_decompose_native_x86_64 ✅ 2s 2s +0%
poly_power2round ✅ 2s 3s -33%
poly_uniform_gamma1_4x ✅ 2s 3s -33%
poly_use_hint_c ✅ 2s 2s +0%
polyt0_pack ✅ 2s 4s -50%
polyvec_matrix_pointwise_montgomery_row ✅ 2s 3s -33%
polyveck_pack_w1 ✅ 2s 3s -33%
polyvecl_chknorm ✅ 2s 7s -71%
polyvecl_pointwise_acc_montgomery ✅ 2s 5s -60%
polyvecl_uniform_gamma1 ✅ 2s 2s +0%
polyw1_pack ✅ 2s 4s -50%
polyw1_pack_32 ✅ 2s 4s -50%
polyz_pack ✅ 2s 5s -60%
polyz_unpack ✅ 2s 2s +0%
polyz_unpack_17_native_aarch64 ✅ 2s 3s -33%
polyz_unpack_c ✅ 2s 3s -33%
rej_eta_c ✅ 2s 5s -60%
rej_uniform_eta_native_aarch64 ✅ 2s 5s -60%
shake128_squeeze ✅ 2s 2s +0%
shake128x4_absorb_once ✅ 2s 5s -60%
shake256_finalize ✅ 2s 2s +0%
shake256x4_squeezeblocks ✅ 2s 1s +100%
sk_s1hat_get_poly ✅ 2s 3s -33%
sk_s2hat_get_poly ✅ 2s 3s -33%
unpack_sk_s2hat ✅ 2s 3s -33%
keccak_f1600_x4_native_aarch64_v8a_v84a_scalar_hybrid ✅ 1s 4s -75%
keccak_finalize ✅ 1s 1s +0%
keccakf1600_xor_bytes ✅ 1s 3s -67%
keccakf1600x4_extract_bytes_native ✅ 1s 2s -50%
keccakf1600x4_xor_bytes_native ✅ 1s 3s -67%
mld_ct_cmask_neg_i32 ✅ 1s 4s -75%
mld_ct_get_optblocker_i64 ✅ 1s 3s -67%
mld_ct_memcmp ✅ 1s 3s -67%
mld_ct_sel_int32 ✅ 1s 3s -67%
mld_value_barrier_u32 ✅ 1s 2s -50%
mld_value_barrier_u8 ✅ 1s 3s -67%
ntt_native_x86_64 ✅ 1s 2s -50%
poly_decompose_32_native_aarch64 ✅ 1s 5s -80%
polyveck_pack_eta ✅ 1s 6s -83%
polyw1_pack_88 ✅ 1s 3s -67%
shake128_release ✅ 1s 4s -75%
shake256_squeeze ✅ 1s 2s -50%
sys_check_capability ✅ 1s 3s -67%
unpack_pk_t1 ✅ 1s 1s +0%

hanno-becker
hanno-becker reviewed Jun 27, 2026
View reviewed changes
Comment thread test/src/test_mldsa.c Outdated
hanno-becker
hanno-becker reviewed Jun 27, 2026
View reviewed changes
Comment thread test/src/test_mldsa.c Outdated
hanno-becker
hanno-becker reviewed Jun 27, 2026
View reviewed changes
Comment thread mldsa/mldsa_native.h Outdated
hanno-becker
hanno-becker requested changes Jun 27, 2026
View reviewed changes

@hanno-becker hanno-becker left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thank you @fegge, I support this change.

Minor nit regarding the documentation, and I believe the test can be simplified -- see comments.

@fegge @hanno-becker
Reject MLD_PREHASH_NONE in prehash APIs
bf43e12 
The internal pre-hash sign/verify entry points now return
MLD_ERR_FAIL when called with MLD_PREHASH_NONE, matching the
documented set of accepted hash algorithms. Doc comments in
mldsa_native.h and sign.h are updated to state the rejection
explicitly.

test_sign_pre_hash is extended to cover both rejection paths.

Signed-off-by: Fredrik Dahlgren <fredrik.dahlgren@trailofbits.com>
[hbecker: squashed fixup commits, rewrote subject/body, folded
 the rejection checks into test_sign_pre_hash]
Signed-off-by: Hanno Becker <beckphan@amazon.co.uk>
@hanno-becker hanno-becker force-pushed the ptp/prehash-none-message-bypass branch from abcabdb to bf43e12 Compare July 12, 2026 05:35
hanno-becker
hanno-becker approved these changes Jul 12, 2026
View reviewed changes

@hanno-becker hanno-becker left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thank you @fegge for this! I took the liberty to squash the fixup commits and simplify the test a little.

@mkannwischer Are you OK with this? It, too, touches on the broader question of parameter validation of the public API.

@hanno-becker hanno-becker added this pull request to the merge queue Jul 13, 2026
@hanno-becker hanno-becker removed this pull request from the merge queue due to a manual request Jul 13, 2026
@hanno-becker hanno-becker added this pull request to the merge queue Jul 13, 2026
Merged via the queue into main with commit 4d1cd02 Jul 13, 2026
376 checks passed
@hanno-becker hanno-becker deleted the ptp/prehash-none-message-bypass branch July 13, 2026 04:26
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@hanno-becker hanno-becker hanno-becker approved these changes
@mkannwischer mkannwischer Awaiting requested review from mkannwischer

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Prehash API accepts MLD_PREHASH_NONE and ignores the digest

3 participants

@fegge @oqs-bot @hanno-becker