Skip to content

Document signing secret-key validity precondition#1229

Merged
mkannwischer merged 1 commit into
mainfrom
ptp/sign-accepts-invalid-secret-keys
Jul 13, 2026
Merged

Document signing secret-key validity precondition#1229
mkannwischer merged 1 commit into
mainfrom
ptp/sign-accepts-invalid-secret-keys

Conversation

@fegge

@fegge fegge commented Jun 26, 2026

Copy link
Copy Markdown
Contributor

Summary

  • Document that signing APIs require a valid secret key.
  • Point callers to pk_from_sk when they need to validate a serialized secret key before signing.
  • Add a Wycheproof client comment explaining why InvalidPrivateKey signing vectors are skipped while pkFromSk still tests those keys.

Validation

  • clang-format -i mldsa/src/sign.h mldsa/mldsa_native.h: passed
  • ruff format test/wycheproof/wycheproof_client.py: passed
  • ruff check test/wycheproof/wycheproof_client.py: passed
  • python3 -m py_compile test/wycheproof/wycheproof_client.py: passed
  • git diff --check -- mldsa/src/sign.h mldsa/mldsa_native.h test/wycheproof/wycheproof_client.py: passed
  • make run_func -j4: passed
  • make wycheproof -j4: passed
  • python3 test/wycheproof/wycheproof_client.py --data-dir <fresh-temp-dir>: passed
  • Not run: ./scripts/format because nixpkgs-fmt is not installed in this local environment
  • Not run: ./scripts/lint because shfmt is not installed in this local environment

Fixes #1216

This work was completed by Trail of Bits as part of the Patch The Planet project in collaboration with OpenAI. The issue was identified primarily by the Codex coding agent, and manually reviewed before submission.

@fegge fegge requested a review from a team as a code owner June 26, 2026 16:30
This was referenced Jun 26, 2026
Closed
Open
@oqs-bot

oqs-bot commented Jun 26, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

CBMC Results (ML-DSA-44, REDUCE-RAM)

Full Results (206 proofs)
Proof Status Current Previous Change
**TOTAL** ✅ 1383s 1364s +1.4%
polyvec_matrix_pointwise_montgomery_yvec ✅ 151s 149s +1%
poly_pointwise_montgomery_c ✅ 116s 112s +4%
mld_invntt_layer ✅ 105s 105s +0%
polyveck_chknorm ✅ 62s 67s -7%
sign_verify_internal ✅ 51s 49s +4%
mld_ntt_layer ✅ 42s 41s +2%
fqmul ✅ 41s 39s +5%
mld_ntt_butterfly_block ✅ 24s 23s +4%
keccakf1600x4_permute_native ✅ 23s 22s +5%
poly_ntt_c ✅ 20s 21s -5%
mld_attempt_signature_generation ✅ 19s 19s +0%
rej_uniform_c ✅ 16s 16s +0%
polyvecl_chknorm ✅ 13s 11s +18%
compute_pack_t0_t1 ✅ 12s 12s +0%
mld_check_pct ✅ 12s 15s -20%
polyeta_unpack ✅ 12s 14s -14%
poly_chknorm_c ✅ 11s 11s +0%
poly_invntt_tomont_c ✅ 11s 11s +0%
poly_uniform_eta_4x ✅ 11s 12s -8%
polyt0_unpack ✅ 11s 12s -8%
rej_uniform_native_x86_64 ✅ 10s - new
polyvec_matrix_pointwise_montgomery_row ✅ 9s 6s +50%
polyz_unpack_c ✅ 9s 8s +12%
keccak_absorb_once_x4 ✅ 8s 8s +0%
rej_uniform ✅ 8s 8s +0%
mld_ct_cmask_nonzero_u32 ✅ 7s 3s +133%
mld_keccakf1600_permute_c ✅ 7s 7s +0%
pointwise_acc_native_aarch64 ✅ 7s 6s +17%
pointwise_acc_native_x86_64 ✅ 7s 4s +75%
poly_decompose_c ✅ 7s 5s +40%
polyveck_decompose ✅ 7s 7s +0%
polyveck_invntt_tomont ✅ 7s 5s +40%
sign_signature_pre_hash_internal ✅ 7s 4s +75%
poly_decompose_32_native_aarch64 ✅ 6s 4s +50%
poly_reduce ✅ 6s 4s +50%
poly_uniform ✅ 6s 3s +100%
polyvecl_ntt ✅ 6s 3s +100%
rej_uniform_native ✅ 6s 5s +20%
sign_signature_internal ✅ 6s 4s +50%
caddq ✅ 5s 6s -17%
keccakf1600x4_extract_bytes_native ✅ 5s 4s +25%
mld_compute_pack_z ✅ 5s 6s -17%
mld_sample_s1_s2 ✅ 5s 1s +400%
poly_add ✅ 5s 7s -29%
poly_caddq_native ✅ 5s 3s +67%
polyveck_caddq ✅ 5s 3s +67%
polyveck_ntt ✅ 5s 2s +150%
polyveck_reduce ✅ 5s 4s +25%
sign_keypair ✅ 5s 5s +0%
sign_pk_from_sk ✅ 5s 5s +0%
sign_signature_extmu ✅ 5s 4s +25%
unpack_sk_s2hat ✅ 5s 4s +25%
keccak_finalize ✅ 4s 2s +100%
keccak_squeeze ✅ 4s 2s +100%
keccakf1600_extract_bytes (big endian) ✅ 4s 4s +0%
mld_ct_get_optblocker_u8 ✅ 4s 2s +100%
mld_sample_s1_s2_serial ✅ 4s 4s +0%
mld_value_barrier_u32 ✅ 4s 1s +300%
pack_sk_rho_key_tr_s2 ✅ 4s 5s -20%
pack_sk_s1 ✅ 4s 3s +33%
pointwise_native_x86_64 ✅ 4s 4s +0%
poly_caddq ✅ 4s 4s +0%
poly_caddq_native_aarch64 ✅ 4s 3s +33%
poly_challenge ✅ 4s 6s -33%
poly_decompose ✅ 4s 2s +100%
poly_invntt_tomont ✅ 4s 2s +100%
poly_ntt ✅ 4s 3s +33%
poly_permute_bitrev_to_custom_optional_native ✅ 4s 3s +33%
poly_pointwise_montgomery_native ✅ 4s 2s +100%
poly_power2round ✅ 4s 4s +0%
poly_sub ✅ 4s 3s +33%
polyt0_pack ✅ 4s 4s +0%
polyvec_matrix_expand ✅ 4s 3s +33%
polyveck_pack_eta ✅ 4s 4s +0%
polyveck_pack_w1 ✅ 4s 3s +33%
polyvecl_unpack_eta ✅ 4s 4s +0%
polyw1_pack ✅ 4s 4s +0%
polyz_unpack ✅ 4s 3s +33%
polyz_unpack_native ✅ 4s 3s +33%
polyz_unpack_native_x86_64 ✅ 4s 3s +33%
reduce32 ✅ 4s 3s +33%
rej_eta_native ✅ 4s 3s +33%
rej_uniform_eta_native_aarch64 ✅ 4s 3s +33%
sign_signature ✅ 4s 6s -33%
sign_verify_pre_hash_internal ✅ 4s 5s -20%
unpack_sk ✅ 4s 3s +33%
intt_native_aarch64 ✅ 3s 3s +0%
intt_native_x86_64 ✅ 3s 2s +50%
keccak_absorb ✅ 3s 3s +0%
keccak_f1600_x1_native_aarch64 ✅ 3s 3s +0%
keccak_f1600_x1_native_aarch64_v84a ✅ 3s 2s +50%
keccak_squeezeblocks_x4 ✅ 3s 3s +0%
keccakf1600_permute ✅ 3s 2s +50%
keccakf1600_permute_native ✅ 3s 3s +0%
keccakf1600_xor_bytes ✅ 3s 3s +0%
keccakf1600x4_permute ✅ 3s 4s -25%
keccakf1600x4_xor_bytes ✅ 3s 3s +0%
make_hint ✅ 3s 3s +0%
mld_ct_cmask_neg_i32 ✅ 3s 2s +50%
mld_ct_cmask_nonzero_u8 ✅ 3s 2s +50%
mld_keccakf1600_extract_bytes ✅ 3s 2s +50%
mld_keccakf1600x4_xor_bytes_c ✅ 3s 4s -25%
mld_prepare_domain_separation_prefix ✅ 3s 3s +0%
montgomery_reduce ✅ 3s 2s +50%
ntt_native_aarch64 ✅ 3s 4s -25%
ntt_native_x86_64 ✅ 3s 3s +0%
nttunpack_native_x86_64 ✅ 3s 4s -25%
pack_sig_h ✅ 3s 4s -25%
poly_caddq_native_x86_64 ✅ 3s 4s -25%
poly_chknorm_native ✅ 3s 4s -25%
poly_decompose_native_x86_64 ✅ 3s 2s +50%
poly_ntt_native ✅ 3s 3s +0%
poly_uniform_eta ✅ 3s 2s +50%
poly_use_hint ✅ 3s 2s +50%
poly_use_hint_native ✅ 3s 3s +0%
poly_use_hint_native_aarch64 ✅ 3s 3s +0%
polyt1_pack ✅ 3s 3s +0%
polyvecl_pointwise_acc_montgomery ✅ 3s 3s +0%
polyvecl_uniform_gamma1 ✅ 3s 2s +50%
polyvecl_uniform_gamma1_serial ✅ 3s 2s +50%
polyvecl_unpack_z ✅ 3s 3s +0%
polyw1_pack_32 ✅ 3s 3s +0%
polyw1_pack_88 ✅ 3s 2s +50%
polyz_unpack_19_native_aarch64 ✅ 3s 4s -25%
power2round ✅ 3s 2s +50%
rej_eta_c ✅ 3s 4s -25%
shake128_squeeze ✅ 3s 2s +50%
shake128x4_absorb_once ✅ 3s 2s +50%
shake256_absorb ✅ 3s 2s +50%
shake256_finalize ✅ 3s 2s +50%
shake256x4_absorb_once ✅ 3s 1s +200%
sign_keypair_internal ✅ 3s 4s -25%
sign_signature_pre_hash_shake256 ✅ 3s 4s -25%
sign_verify ✅ 3s 4s -25%
sign_verify_extmu ✅ 3s 5s -40%
sign_verify_pre_hash_shake256 ✅ 3s 5s -40%
sys_check_capability ✅ 3s 2s +50%
unpack_sk_s1hat ✅ 3s 3s +0%
yvec_get_poly ✅ 3s 3s +0%
fqscale ✅ 2s 2s +0%
keccak_f1600_x4_native_aarch64_v8a_scalar_hybrid ✅ 2s 2s +0%
keccak_f1600_x4_native_aarch64_v8a_v84a_scalar_hybrid ✅ 2s 3s -33%
keccak_f1600_x4_native_avx2 ✅ 2s 2s +0%
keccak_init ✅ 2s 3s -33%
keccakf1600_xor_bytes (big endian) ✅ 2s 6s -67%
keccakf1600x4_extract_bytes ✅ 2s 2s +0%
keccakf1600x4_xor_bytes_native ✅ 2s 5s -60%
mld_ct_abs_i32 ✅ 2s 3s -33%
mld_ct_get_optblocker_i64 ✅ 2s 4s -50%
mld_ct_get_optblocker_u32 ✅ 2s 2s +0%
mld_ct_memcmp ✅ 2s 1s +100%
mld_ct_sel_int32 ✅ 2s 3s -33%
mld_h ✅ 2s 4s -50%
mld_polymat_expand_entry ✅ 2s 2s +0%
mld_value_barrier_i64 ✅ 2s 3s -33%
mld_value_barrier_u8 ✅ 2s 4s -50%
pack_sig_c ✅ 2s 5s -60%
pack_sig_z ✅ 2s 2s +0%
pointwise_native_aarch64 ✅ 2s 2s +0%
poly_chknorm ✅ 2s 3s -33%
poly_chknorm_native_aarch64 ✅ 2s 2s +0%
poly_chknorm_native_x86_64 ✅ 2s 2s +0%
poly_decompose_88_native_aarch64 ✅ 2s 3s -33%
poly_decompose_native ✅ 2s 2s +0%
poly_invntt_tomont_native ✅ 2s 3s -33%
poly_permute_bitrev_to_custom_optional ✅ 2s 5s -60%
poly_pointwise_montgomery ✅ 2s 3s -33%
poly_shiftl ✅ 2s 4s -50%
poly_uniform_4x ✅ 2s 3s -33%
poly_uniform_gamma1 ✅ 2s 3s -33%
poly_uniform_gamma1_4x ✅ 2s 5s -60%
poly_use_hint_c ✅ 2s 5s -60%
poly_use_hint_native_x86_64 ✅ 2s - new
polyeta_pack ✅ 2s 3s -33%
polyveck_unpack_eta ✅ 2s 2s +0%
polyvecl_pack_eta ✅ 2s 2s +0%
polyvecl_pointwise_acc_montgomery_c ✅ 2s 4s -50%
polyz_pack ✅ 2s 2s +0%
polyz_unpack_17_native_aarch64 ✅ 2s 2s +0%
rej_eta ✅ 2s 5s -60%
rej_uniform_native_aarch64 ✅ 2s 3s -33%
shake128_absorb ✅ 2s 3s -33%
shake128_finalize ✅ 2s 3s -33%
shake128_init ✅ 2s 2s +0%
shake128_release ✅ 2s 2s +0%
shake128x4_squeezeblocks ✅ 2s 2s +0%
shake256_init ✅ 2s 4s -50%
shake256_release ✅ 2s 1s +100%
shake256_squeeze ✅ 2s 2s +0%
sig_unpack_hints ✅ 2s 2s +0%
sk_s1hat_get_poly ✅ 2s 2s +0%
sk_s2hat_get_poly ✅ 2s 5s -60%
sk_t0hat_get_poly ✅ 2s 1s +100%
unpack_pk_t1 ✅ 2s 3s -33%
unpack_sk_t0hat ✅ 2s 2s +0%
use_hint ✅ 2s 2s +0%
decompose ✅ 1s 3s -67%
keccak_f1600_x4_native_aarch64_v84a ✅ 1s 3s -67%
mld_keccakf1600x4_extract_bytes_c ✅ 1s 4s -75%
poly_caddq_c ✅ 1s 3s -67%
polyt1_unpack ✅ 1s 2s -50%
polyvec_matrix_expand_serial ✅ 1s 4s -75%
polyvecl_pointwise_acc_montgomery_native ✅ 1s 3s -67%
shake256 ✅ 1s 1s +0%
shake256x4_squeezeblocks ✅ 1s 2s -50%
yvec_init ✅ 1s 1s +0%

@oqs-bot

oqs-bot commented Jun 26, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

CBMC Results (ML-DSA-65, REDUCE-RAM)

Full Results (206 proofs)
Proof Status Current Previous Change
**TOTAL** ✅ 1497s 1482s +1.0%
polyvec_matrix_pointwise_montgomery_yvec ✅ 195s 201s -3%
poly_pointwise_montgomery_c ✅ 127s 116s +9%
mld_invntt_layer ✅ 107s 108s -1%
sign_verify_internal ✅ 74s 71s +4%
mld_ntt_layer ✅ 45s 43s +5%
polyvecl_chknorm ✅ 43s 43s +0%
fqmul ✅ 41s 40s +2%
polyveck_chknorm ✅ 35s 36s -3%
mld_attempt_signature_generation ✅ 32s 31s +3%
keccakf1600x4_permute_native ✅ 23s 22s +5%
mld_ntt_butterfly_block ✅ 22s 25s -12%
poly_ntt_c ✅ 21s 22s -5%
rej_uniform_c ✅ 18s 16s +12%
poly_chknorm_c ✅ 14s 13s +8%
poly_invntt_tomont_c ✅ 12s 10s +20%
polyt0_unpack ✅ 12s 13s -8%
polyveck_decompose ✅ 12s 14s -14%
mld_check_pct ✅ 11s 12s -8%
poly_uniform_eta_4x ✅ 11s 13s -15%
polyvec_matrix_pointwise_montgomery_row ✅ 9s 8s +12%
polyz_unpack_c ✅ 9s 9s +0%
rej_uniform_native_x86_64 ✅ 9s - new
sign_pk_from_sk ✅ 9s 5s +80%
keccak_absorb_once_x4 ✅ 8s 10s -20%
polyveck_reduce ✅ 8s 6s +33%
polyvecl_ntt ✅ 8s 7s +14%
keccakf1600_xor_bytes ✅ 7s 4s +75%
pointwise_acc_native_x86_64 ✅ 7s 5s +40%
polyveck_invntt_tomont ✅ 7s 7s +0%
unpack_pk_t1 ✅ 7s 2s +250%
caddq ✅ 6s 2s +200%
compute_pack_t0_t1 ✅ 6s 7s -14%
mld_keccakf1600_permute_c ✅ 6s 7s -14%
pointwise_acc_native_aarch64 ✅ 6s 6s +0%
poly_add ✅ 6s 7s -14%
poly_decompose_88_native_aarch64 ✅ 6s 2s +200%
poly_decompose_c ✅ 6s 8s -25%
poly_reduce ✅ 6s 4s +50%
polyveck_pack_eta ✅ 6s 3s +100%
polyveck_unpack_eta ✅ 6s 3s +100%
rej_uniform ✅ 6s 7s -14%
sign_signature_internal ✅ 6s 6s +0%
mld_h ✅ 5s 3s +67%
mld_prepare_domain_separation_prefix ✅ 5s 4s +25%
poly_caddq_c ✅ 5s 5s +0%
poly_permute_bitrev_to_custom_optional_native ✅ 5s 3s +67%
poly_use_hint_native ✅ 5s 7s -29%
polyvec_matrix_expand ✅ 5s 6s -17%
polyveck_caddq ✅ 5s 7s -29%
polyz_pack ✅ 5s 3s +67%
polyz_unpack_17_native_aarch64 ✅ 5s 2s +150%
rej_uniform_eta_native_aarch64 ✅ 5s 5s +0%
shake256_absorb ✅ 5s 4s +25%
sign_keypair_internal ✅ 5s 3s +67%
sk_s2hat_get_poly ✅ 5s 1s +400%
keccak_absorb ✅ 4s 3s +33%
keccak_squeezeblocks_x4 ✅ 4s 4s +0%
mld_compute_pack_z ✅ 4s 5s -20%
mld_ct_cmask_neg_i32 ✅ 4s 3s +33%
mld_ct_cmask_nonzero_u8 ✅ 4s 2s +100%
mld_ct_memcmp ✅ 4s 4s +0%
mld_ct_sel_int32 ✅ 4s 2s +100%
mld_sample_s1_s2 ✅ 4s 6s -33%
mld_sample_s1_s2_serial ✅ 4s 3s +33%
ntt_native_x86_64 ✅ 4s 5s -20%
pack_sig_z ✅ 4s 1s +300%
pointwise_native_aarch64 ✅ 4s 3s +33%
poly_caddq_native ✅ 4s 4s +0%
poly_decompose ✅ 4s 2s +100%
poly_sub ✅ 4s 4s +0%
poly_uniform ✅ 4s 2s +100%
poly_use_hint_c ✅ 4s 2s +100%
poly_use_hint_native_aarch64 ✅ 4s 4s +0%
poly_use_hint_native_x86_64 ✅ 4s - new
polyeta_unpack ✅ 4s 4s +0%
polyt0_pack ✅ 4s 5s -20%
polyt1_unpack ✅ 4s 3s +33%
polyveck_pack_w1 ✅ 4s 4s +0%
polyvecl_pack_eta ✅ 4s 2s +100%
polyz_unpack_19_native_aarch64 ✅ 4s 5s -20%
power2round ✅ 4s 2s +100%
reduce32 ✅ 4s 2s +100%
rej_eta_native ✅ 4s 3s +33%
rej_uniform_native ✅ 4s 4s +0%
shake128_squeeze ✅ 4s 3s +33%
shake256x4_absorb_once ✅ 4s 2s +100%
sign_signature ✅ 4s 5s -20%
sign_signature_pre_hash_internal ✅ 4s 3s +33%
sign_verify_extmu ✅ 4s 2s +100%
sk_s1hat_get_poly ✅ 4s 3s +33%
unpack_sk_s2hat ✅ 4s 3s +33%
unpack_sk_t0hat ✅ 4s 4s +0%
yvec_init ✅ 4s 5s -20%
fqscale ✅ 3s 3s +0%
intt_native_aarch64 ✅ 3s 2s +50%
intt_native_x86_64 ✅ 3s 4s -25%
keccak_f1600_x1_native_aarch64 ✅ 3s 2s +50%
keccak_f1600_x1_native_aarch64_v84a ✅ 3s 2s +50%
keccak_f1600_x4_native_aarch64_v84a ✅ 3s 2s +50%
keccak_f1600_x4_native_aarch64_v8a_scalar_hybrid ✅ 3s 3s +0%
keccak_init ✅ 3s 4s -25%
keccakf1600_permute ✅ 3s 4s -25%
keccakf1600x4_extract_bytes ✅ 3s 4s -25%
keccakf1600x4_extract_bytes_native ✅ 3s 1s +200%
keccakf1600x4_xor_bytes_native ✅ 3s 2s +50%
mld_ct_cmask_nonzero_u32 ✅ 3s 3s +0%
mld_ct_get_optblocker_u32 ✅ 3s 3s +0%
mld_keccakf1600x4_extract_bytes_c ✅ 3s 2s +50%
mld_value_barrier_u32 ✅ 3s 4s -25%
ntt_native_aarch64 ✅ 3s 3s +0%
nttunpack_native_x86_64 ✅ 3s 3s +0%
pack_sig_c ✅ 3s 3s +0%
pack_sig_h ✅ 3s 2s +50%
pack_sk_s1 ✅ 3s 3s +0%
pointwise_native_x86_64 ✅ 3s 2s +50%
poly_caddq_native_x86_64 ✅ 3s 1s +200%
poly_challenge ✅ 3s 5s -40%
poly_chknorm_native ✅ 3s 4s -25%
poly_chknorm_native_x86_64 ✅ 3s 4s -25%
poly_invntt_tomont ✅ 3s 5s -40%
poly_ntt_native ✅ 3s 2s +50%
poly_permute_bitrev_to_custom_optional ✅ 3s 3s +0%
poly_pointwise_montgomery ✅ 3s 2s +50%
poly_pointwise_montgomery_native ✅ 3s 4s -25%
poly_power2round ✅ 3s 7s -57%
poly_shiftl ✅ 3s 3s +0%
poly_uniform_gamma1_4x ✅ 3s 3s +0%
polyt1_pack ✅ 3s 3s +0%
polyvecl_pointwise_acc_montgomery ✅ 3s 3s +0%
polyvecl_pointwise_acc_montgomery_c ✅ 3s 3s +0%
polyvecl_unpack_eta ✅ 3s 2s +50%
polyvecl_unpack_z ✅ 3s 1s +200%
polyw1_pack ✅ 3s 3s +0%
polyw1_pack_88 ✅ 3s 3s +0%
polyz_unpack ✅ 3s 3s +0%
rej_eta ✅ 3s 5s -40%
shake128_release ✅ 3s 2s +50%
shake128x4_squeezeblocks ✅ 3s 2s +50%
shake256 ✅ 3s 2s +50%
shake256_finalize ✅ 3s 1s +200%
sig_unpack_hints ✅ 3s 1s +200%
sign_keypair ✅ 3s 4s -25%
sign_signature_extmu ✅ 3s 4s -25%
sign_signature_pre_hash_shake256 ✅ 3s 7s -57%
sign_verify_pre_hash_shake256 ✅ 3s 6s -50%
sk_t0hat_get_poly ✅ 3s 1s +200%
use_hint ✅ 3s 2s +50%
yvec_get_poly ✅ 3s 3s +0%
decompose ✅ 2s 4s -50%
keccak_f1600_x4_native_aarch64_v8a_v84a_scalar_hybrid ✅ 2s 3s -33%
keccak_f1600_x4_native_avx2 ✅ 2s 2s +0%
keccak_finalize ✅ 2s 2s +0%
keccak_squeeze ✅ 2s 2s +0%
keccakf1600_xor_bytes (big endian) ✅ 2s 2s +0%
keccakf1600x4_permute ✅ 2s 1s +100%
keccakf1600x4_xor_bytes ✅ 2s 2s +0%
make_hint ✅ 2s 3s -33%
mld_ct_get_optblocker_i64 ✅ 2s 1s +100%
mld_keccakf1600x4_xor_bytes_c ✅ 2s 2s +0%
mld_polymat_expand_entry ✅ 2s 3s -33%
montgomery_reduce ✅ 2s 1s +100%
pack_sk_rho_key_tr_s2 ✅ 2s 2s +0%
poly_caddq ✅ 2s 3s -33%
poly_caddq_native_aarch64 ✅ 2s 2s +0%
poly_chknorm_native_aarch64 ✅ 2s 2s +0%
poly_decompose_32_native_aarch64 ✅ 2s 4s -50%
poly_decompose_native ✅ 2s 5s -60%
poly_decompose_native_x86_64 ✅ 2s 2s +0%
poly_ntt ✅ 2s 2s +0%
poly_uniform_4x ✅ 2s 4s -50%
poly_uniform_eta ✅ 2s 5s -60%
poly_uniform_gamma1 ✅ 2s 3s -33%
poly_use_hint ✅ 2s 3s -33%
polyvec_matrix_expand_serial ✅ 2s 3s -33%
polyveck_ntt ✅ 2s 4s -50%
polyvecl_pointwise_acc_montgomery_native ✅ 2s 3s -33%
polyvecl_uniform_gamma1 ✅ 2s 4s -50%
polyvecl_uniform_gamma1_serial ✅ 2s 1s +100%
polyw1_pack_32 ✅ 2s 2s +0%
polyz_unpack_native ✅ 2s 3s -33%
rej_eta_c ✅ 2s 4s -50%
rej_uniform_native_aarch64 ✅ 2s 5s -60%
shake128x4_absorb_once ✅ 2s 2s +0%
shake256_init ✅ 2s 4s -50%
shake256_release ✅ 2s 3s -33%
shake256x4_squeezeblocks ✅ 2s 2s +0%
sign_verify ✅ 2s 6s -67%
sign_verify_pre_hash_internal ✅ 2s 5s -60%
sys_check_capability ✅ 2s 1s +100%
unpack_sk ✅ 2s 3s -33%
keccakf1600_extract_bytes (big endian) ✅ 1s 3s -67%
keccakf1600_permute_native ✅ 1s 2s -50%
mld_ct_abs_i32 ✅ 1s 6s -83%
mld_ct_get_optblocker_u8 ✅ 1s 4s -75%
mld_keccakf1600_extract_bytes ✅ 1s 2s -50%
mld_value_barrier_i64 ✅ 1s 2s -50%
mld_value_barrier_u8 ✅ 1s 1s +0%
poly_chknorm ✅ 1s 3s -67%
poly_invntt_tomont_native ✅ 1s 5s -80%
polyeta_pack ✅ 1s 1s +0%
polyz_unpack_native_x86_64 ✅ 1s 3s -67%
shake128_absorb ✅ 1s 2s -50%
shake128_finalize ✅ 1s 2s -50%
shake128_init ✅ 1s 6s -83%
shake256_squeeze ✅ 1s 4s -75%
unpack_sk_s1hat ✅ 1s 1s +0%

@oqs-bot

oqs-bot commented Jun 26, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

CBMC Results (ML-DSA-87, REDUCE-RAM)

Full Results (206 proofs)
Proof Status Current Previous Change
**TOTAL** ✅ 1387s 1436s -3.4%
polyvec_matrix_pointwise_montgomery_yvec ✅ 184s 196s -6%
poly_pointwise_montgomery_c ✅ 112s 125s -10%
mld_invntt_layer ✅ 96s 111s -14%
sign_verify_internal ✅ 46s 47s -2%
mld_ntt_layer ✅ 40s 44s -9%
fqmul ✅ 39s 39s +0%
polyvecl_chknorm ✅ 34s 38s -11%
mld_attempt_signature_generation ✅ 31s 34s -9%
mld_ntt_butterfly_block ✅ 22s 23s -4%
keccakf1600x4_permute_native ✅ 21s 25s -16%
poly_ntt_c ✅ 19s 19s +0%
polyeta_unpack ✅ 16s 13s +23%
rej_uniform_c ✅ 15s 18s -17%
mld_check_pct ✅ 14s 15s -7%
poly_uniform_eta_4x ✅ 13s 12s +8%
polyveck_decompose ✅ 12s 12s +0%
poly_chknorm_c ✅ 11s 13s -15%
poly_invntt_tomont_c ✅ 11s 9s +22%
polyt0_unpack ✅ 11s 14s -21%
polyvec_matrix_pointwise_montgomery_row ✅ 11s 13s -15%
polyveck_chknorm ✅ 11s 9s +22%
compute_pack_t0_t1 ✅ 10s 12s -17%
keccak_absorb_once_x4 ✅ 10s 8s +25%
polyz_unpack_c ✅ 8s 7s +14%
rej_uniform_native_x86_64 ✅ 8s - new
pointwise_acc_native_aarch64 ✅ 7s 5s +40%
pointwise_acc_native_x86_64 ✅ 7s 8s -12%
poly_caddq_c ✅ 7s 3s +133%
polyveck_caddq ✅ 7s 8s -12%
polyveck_invntt_tomont ✅ 7s 4s +75%
polyvecl_ntt ✅ 7s 8s -12%
sign_signature_pre_hash_shake256 ✅ 7s 3s +133%
mld_sample_s1_s2 ✅ 6s 8s -25%
mld_sample_s1_s2_serial ✅ 6s 6s +0%
poly_add ✅ 6s 8s -25%
poly_decompose_c ✅ 6s 6s +0%
poly_reduce ✅ 6s 4s +50%
polyveck_reduce ✅ 6s 6s +0%
rej_uniform ✅ 6s 7s -14%
keccak_f1600_x1_native_aarch64 ✅ 5s 2s +150%
keccak_squeeze ✅ 5s 5s +0%
keccak_squeezeblocks_x4 ✅ 5s 4s +25%
mld_compute_pack_z ✅ 5s 6s -17%
mld_keccakf1600_permute_c ✅ 5s 8s -38%
poly_challenge ✅ 5s 4s +25%
poly_permute_bitrev_to_custom_optional_native ✅ 5s 3s +67%
poly_power2round ✅ 5s 7s -29%
polyvecl_unpack_z ✅ 5s 3s +67%
polyz_unpack_17_native_aarch64 ✅ 5s 4s +25%
rej_uniform_eta_native_aarch64 ✅ 5s 3s +67%
sign_signature_extmu ✅ 5s 4s +25%
sign_signature_pre_hash_internal ✅ 5s 2s +150%
sign_verify_extmu ✅ 5s 4s +25%
sign_verify_pre_hash_internal ✅ 5s 3s +67%
sk_s1hat_get_poly ✅ 5s 3s +67%
keccakf1600_permute_native ✅ 4s 3s +33%
make_hint ✅ 4s 2s +100%
mld_ct_get_optblocker_i64 ✅ 4s 2s +100%
mld_keccakf1600x4_extract_bytes_c ✅ 4s 3s +33%
mld_prepare_domain_separation_prefix ✅ 4s 3s +33%
mld_value_barrier_u8 ✅ 4s 2s +100%
ntt_native_x86_64 ✅ 4s 2s +100%
nttunpack_native_x86_64 ✅ 4s 3s +33%
pack_sk_rho_key_tr_s2 ✅ 4s 2s +100%
pointwise_native_aarch64 ✅ 4s 4s +0%
pointwise_native_x86_64 ✅ 4s 5s -20%
poly_caddq_native_aarch64 ✅ 4s 3s +33%
poly_chknorm_native_aarch64 ✅ 4s 5s -20%
poly_decompose ✅ 4s 2s +100%
poly_decompose_native ✅ 4s 2s +100%
poly_decompose_native_x86_64 ✅ 4s 3s +33%
poly_invntt_tomont ✅ 4s 4s +0%
poly_permute_bitrev_to_custom_optional ✅ 4s 2s +100%
poly_pointwise_montgomery ✅ 4s 3s +33%
poly_uniform_eta ✅ 4s 5s -20%
poly_uniform_gamma1_4x ✅ 4s 3s +33%
poly_use_hint_native ✅ 4s 1s +300%
polyeta_pack ✅ 4s 3s +33%
polyveck_pack_w1 ✅ 4s 3s +33%
rej_eta_native ✅ 4s 4s +0%
rej_uniform_native_aarch64 ✅ 4s 3s +33%
shake128x4_absorb_once ✅ 4s 4s +0%
shake256x4_squeezeblocks ✅ 4s 4s +0%
sign_keypair ✅ 4s 4s +0%
sign_keypair_internal ✅ 4s 6s -33%
sign_signature_internal ✅ 4s 3s +33%
sk_t0hat_get_poly ✅ 4s 3s +33%
unpack_sk ✅ 4s 4s +0%
caddq ✅ 3s 3s +0%
fqscale ✅ 3s 1s +200%
intt_native_aarch64 ✅ 3s 4s -25%
intt_native_x86_64 ✅ 3s 4s -25%
keccak_f1600_x4_native_avx2 ✅ 3s 3s +0%
keccak_init ✅ 3s 1s +200%
keccakf1600x4_permute ✅ 3s 2s +50%
keccakf1600x4_xor_bytes ✅ 3s 1s +200%
mld_ct_abs_i32 ✅ 3s 1s +200%
mld_ct_get_optblocker_u32 ✅ 3s 2s +50%
mld_h ✅ 3s 2s +50%
mld_polymat_expand_entry ✅ 3s 4s -25%
mld_value_barrier_i64 ✅ 3s 2s +50%
mld_value_barrier_u32 ✅ 3s 3s +0%
montgomery_reduce ✅ 3s 2s +50%
ntt_native_aarch64 ✅ 3s 4s -25%
pack_sig_h ✅ 3s 3s +0%
pack_sk_s1 ✅ 3s 2s +50%
poly_caddq_native_x86_64 ✅ 3s 3s +0%
poly_chknorm ✅ 3s 4s -25%
poly_chknorm_native_x86_64 ✅ 3s 2s +50%
poly_decompose_32_native_aarch64 ✅ 3s 3s +0%
poly_decompose_88_native_aarch64 ✅ 3s 2s +50%
poly_ntt_native ✅ 3s 4s -25%
poly_pointwise_montgomery_native ✅ 3s 3s +0%
poly_shiftl ✅ 3s 4s -25%
poly_sub ✅ 3s 5s -40%
poly_uniform ✅ 3s 4s -25%
poly_use_hint ✅ 3s 4s -25%
poly_use_hint_native_x86_64 ✅ 3s - new
polyt0_pack ✅ 3s 3s +0%
polyt1_unpack ✅ 3s 3s +0%
polyvec_matrix_expand_serial ✅ 3s 3s +0%
polyvecl_pack_eta ✅ 3s 2s +50%
polyvecl_pointwise_acc_montgomery ✅ 3s 2s +50%
polyvecl_pointwise_acc_montgomery_c ✅ 3s 2s +50%
polyvecl_unpack_eta ✅ 3s 3s +0%
polyw1_pack ✅ 3s 2s +50%
polyw1_pack_32 ✅ 3s 3s +0%
polyw1_pack_88 ✅ 3s 2s +50%
polyz_unpack ✅ 3s 3s +0%
polyz_unpack_native ✅ 3s 1s +200%
polyz_unpack_native_x86_64 ✅ 3s 3s +0%
rej_eta ✅ 3s 2s +50%
rej_uniform_native ✅ 3s 5s -40%
shake256_finalize ✅ 3s 3s +0%
shake256_init ✅ 3s 3s +0%
shake256_squeeze ✅ 3s 2s +50%
sign_pk_from_sk ✅ 3s 6s -50%
sign_verify ✅ 3s 2s +50%
sys_check_capability ✅ 3s 2s +50%
unpack_sk_s1hat ✅ 3s 3s +0%
unpack_sk_s2hat ✅ 3s 3s +0%
unpack_sk_t0hat ✅ 3s 4s -25%
yvec_get_poly ✅ 3s 2s +50%
decompose ✅ 2s 2s +0%
keccak_absorb ✅ 2s 4s -50%
keccak_f1600_x4_native_aarch64_v84a ✅ 2s 1s +100%
keccak_f1600_x4_native_aarch64_v8a_scalar_hybrid ✅ 2s 2s +0%
keccak_f1600_x4_native_aarch64_v8a_v84a_scalar_hybrid ✅ 2s 2s +0%
keccak_finalize ✅ 2s 1s +100%
keccakf1600_extract_bytes (big endian) ✅ 2s 3s -33%
keccakf1600_permute ✅ 2s 2s +0%
keccakf1600_xor_bytes ✅ 2s 1s +100%
keccakf1600_xor_bytes (big endian) ✅ 2s 2s +0%
keccakf1600x4_extract_bytes ✅ 2s 1s +100%
keccakf1600x4_xor_bytes_native ✅ 2s 2s +0%
mld_ct_cmask_neg_i32 ✅ 2s 2s +0%
mld_ct_cmask_nonzero_u8 ✅ 2s 2s +0%
mld_ct_memcmp ✅ 2s 1s +100%
mld_ct_sel_int32 ✅ 2s 2s +0%
mld_keccakf1600_extract_bytes ✅ 2s 1s +100%
mld_keccakf1600x4_xor_bytes_c ✅ 2s 1s +100%
pack_sig_c ✅ 2s 2s +0%
pack_sig_z ✅ 2s 3s -33%
poly_caddq ✅ 2s 5s -60%
poly_caddq_native ✅ 2s 3s -33%
poly_chknorm_native ✅ 2s 1s +100%
poly_invntt_tomont_native ✅ 2s 2s +0%
poly_ntt ✅ 2s 2s +0%
poly_uniform_4x ✅ 2s 3s -33%
poly_uniform_gamma1 ✅ 2s 3s -33%
poly_use_hint_c ✅ 2s 4s -50%
poly_use_hint_native_aarch64 ✅ 2s 3s -33%
polyt1_pack ✅ 2s 5s -60%
polyvec_matrix_expand ✅ 2s 3s -33%
polyveck_ntt ✅ 2s 3s -33%
polyveck_pack_eta ✅ 2s 5s -60%
polyveck_unpack_eta ✅ 2s 3s -33%
polyvecl_pointwise_acc_montgomery_native ✅ 2s 2s +0%
polyvecl_uniform_gamma1 ✅ 2s 3s -33%
polyvecl_uniform_gamma1_serial ✅ 2s 2s +0%
polyz_pack ✅ 2s 4s -50%
polyz_unpack_19_native_aarch64 ✅ 2s 5s -60%
reduce32 ✅ 2s 3s -33%
rej_eta_c ✅ 2s 4s -50%
shake128_absorb ✅ 2s 2s +0%
shake128_finalize ✅ 2s 2s +0%
shake256 ✅ 2s 3s -33%
shake256_absorb ✅ 2s 3s -33%
shake256x4_absorb_once ✅ 2s 5s -60%
sig_unpack_hints ✅ 2s 4s -50%
sign_signature ✅ 2s 4s -50%
sign_verify_pre_hash_shake256 ✅ 2s 7s -71%
sk_s2hat_get_poly ✅ 2s 2s +0%
yvec_init ✅ 2s 4s -50%
keccak_f1600_x1_native_aarch64_v84a ✅ 1s 2s -50%
keccakf1600x4_extract_bytes_native ✅ 1s 4s -75%
mld_ct_cmask_nonzero_u32 ✅ 1s 5s -80%
mld_ct_get_optblocker_u8 ✅ 1s 3s -67%
power2round ✅ 1s 3s -67%
shake128_init ✅ 1s 2s -50%
shake128_release ✅ 1s 3s -67%
shake128_squeeze ✅ 1s 1s +0%
shake128x4_squeezeblocks ✅ 1s 1s +0%
shake256_release ✅ 1s 5s -80%
unpack_pk_t1 ✅ 1s 2s -50%
use_hint ✅ 1s 3s -67%

@oqs-bot

oqs-bot commented Jun 26, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

CBMC Results (ML-DSA-65)

Full Results (206 proofs)
Proof Status Current Previous Change
**TOTAL** ✅ 1863s 1784s +4.4%
polyvecl_pointwise_acc_montgomery_c ✅ 228s 210s +9%
sign_verify_internal ✅ 181s 177s +2%
poly_pointwise_montgomery_c ✅ 133s 125s +6%
mld_invntt_layer ✅ 119s 109s +9%
polyvec_matrix_expand ✅ 108s 110s -2%
mld_attempt_signature_generation ✅ 67s 63s +6%
sign_signature_internal ✅ 57s 55s +4%
mld_ntt_layer ✅ 44s 41s +7%
fqmul ✅ 41s 40s +2%
polyvec_matrix_expand_serial ✅ 29s 27s +7%
keccakf1600x4_permute_native ✅ 23s 23s +0%
mld_ntt_butterfly_block ✅ 22s 24s -8%
poly_ntt_c ✅ 21s 19s +11%
polyvec_matrix_pointwise_montgomery_yvec ✅ 20s 18s +11%
polyt0_unpack ✅ 16s 16s +0%
rej_uniform ✅ 16s 18s -11%
poly_chknorm_c ✅ 15s 15s +0%
polyveck_decompose ✅ 14s 12s +17%
rej_uniform_c ✅ 14s 14s +0%
poly_uniform_4x ✅ 13s 13s +0%
compute_pack_t0_t1 ✅ 12s 13s -8%
mld_check_pct ✅ 12s 14s -14%
poly_uniform_eta_4x ✅ 12s 14s -14%
polyz_unpack_c ✅ 12s 13s -8%
poly_invntt_tomont_c ✅ 11s 11s +0%
mld_compute_pack_z ✅ 10s 7s +43%
poly_use_hint_c ✅ 10s 5s +100%
polyveck_caddq ✅ 10s 6s +67%
keccak_absorb_once_x4 ✅ 9s 8s +12%
polyveck_ntt ✅ 9s 7s +29%
polyveck_invntt_tomont ✅ 8s 8s +0%
rej_uniform_native_x86_64 ✅ 8s - new
mld_keccakf1600_permute_c ✅ 7s 6s +17%
pointwise_acc_native_aarch64 ✅ 7s 6s +17%
polyveck_chknorm ✅ 7s 6s +17%
mld_sample_s1_s2 ✅ 6s 6s +0%
pack_sig_h ✅ 6s 5s +20%
pointwise_acc_native_x86_64 ✅ 6s 8s -25%
pointwise_native_x86_64 ✅ 6s 3s +100%
poly_decompose_32_native_aarch64 ✅ 6s 3s +100%
poly_decompose_c ✅ 6s 5s +20%
poly_power2round ✅ 6s 4s +50%
rej_uniform_native ✅ 6s 4s +50%
sign_verify ✅ 6s 3s +100%
sign_verify_extmu ✅ 6s 3s +100%
keccak_squeezeblocks_x4 ✅ 5s 5s +0%
mld_sample_s1_s2_serial ✅ 5s 4s +25%
poly_add ✅ 5s 9s -44%
poly_challenge ✅ 5s 6s -17%
poly_chknorm_native ✅ 5s 2s +150%
poly_permute_bitrev_to_custom_optional ✅ 5s 2s +150%
poly_reduce ✅ 5s 3s +67%
poly_uniform_gamma1 ✅ 5s 3s +67%
polyeta_unpack ✅ 5s 8s -38%
polyt1_unpack ✅ 5s 5s +0%
polyvecl_ntt ✅ 5s 4s +25%
rej_eta_native ✅ 5s 3s +67%
sig_unpack_hints ✅ 5s 2s +150%
sign_keypair_internal ✅ 5s 5s +0%
sign_pk_from_sk ✅ 5s 6s -17%
sign_signature_extmu ✅ 5s 2s +150%
sign_signature_pre_hash_shake256 ✅ 5s 3s +67%
unpack_pk_t1 ✅ 5s 5s +0%
unpack_sk ✅ 5s 3s +67%
keccak_f1600_x1_native_aarch64 ✅ 4s 2s +100%
mld_ct_get_optblocker_i64 ✅ 4s 2s +100%
ntt_native_aarch64 ✅ 4s 2s +100%
ntt_native_x86_64 ✅ 4s 2s +100%
pack_sk_rho_key_tr_s2 ✅ 4s 2s +100%
pointwise_native_aarch64 ✅ 4s 5s -20%
poly_chknorm ✅ 4s 4s +0%
poly_decompose ✅ 4s 2s +100%
poly_decompose_native ✅ 4s 3s +33%
poly_sub ✅ 4s 3s +33%
poly_use_hint ✅ 4s 3s +33%
poly_use_hint_native_aarch64 ✅ 4s 3s +33%
poly_use_hint_native_x86_64 ✅ 4s - new
polyt1_pack ✅ 4s 3s +33%
polyveck_pack_w1 ✅ 4s 3s +33%
polyvecl_chknorm ✅ 4s 7s -43%
polyvecl_pointwise_acc_montgomery ✅ 4s 3s +33%
polyvecl_uniform_gamma1 ✅ 4s 2s +100%
polyvecl_unpack_eta ✅ 4s 3s +33%
polyz_unpack ✅ 4s 3s +33%
rej_uniform_eta_native_aarch64 ✅ 4s 4s +0%
shake256_absorb ✅ 4s 2s +100%
sign_signature_pre_hash_internal ✅ 4s 3s +33%
sign_verify_pre_hash_internal ✅ 4s 5s -20%
sk_t0hat_get_poly ✅ 4s 2s +100%
sys_check_capability ✅ 4s 4s +0%
unpack_sk_t0hat ✅ 4s 5s -20%
use_hint ✅ 4s 2s +100%
yvec_get_poly ✅ 4s 3s +33%
caddq ✅ 3s 3s +0%
intt_native_aarch64 ✅ 3s 3s +0%
intt_native_x86_64 ✅ 3s 3s +0%
keccak_absorb ✅ 3s 3s +0%
keccak_f1600_x4_native_aarch64_v84a ✅ 3s 4s -25%
keccak_f1600_x4_native_aarch64_v8a_scalar_hybrid ✅ 3s 2s +50%
keccak_squeeze ✅ 3s 4s -25%
keccakf1600_extract_bytes (big endian) ✅ 3s 2s +50%
keccakf1600_permute ✅ 3s 2s +50%
keccakf1600_permute_native ✅ 3s 3s +0%
keccakf1600_xor_bytes ✅ 3s 2s +50%
keccakf1600x4_permute ✅ 3s 4s -25%
keccakf1600x4_xor_bytes_native ✅ 3s 3s +0%
mld_h ✅ 3s 2s +50%
mld_keccakf1600_extract_bytes ✅ 3s 1s +200%
mld_keccakf1600x4_extract_bytes_c ✅ 3s 3s +0%
mld_polymat_expand_entry ✅ 3s 4s -25%
mld_prepare_domain_separation_prefix ✅ 3s 2s +50%
nttunpack_native_x86_64 ✅ 3s 3s +0%
pack_sig_z ✅ 3s 2s +50%
poly_caddq_c ✅ 3s 2s +50%
poly_caddq_native_aarch64 ✅ 3s 2s +50%
poly_decompose_88_native_aarch64 ✅ 3s 1s +200%
poly_decompose_native_x86_64 ✅ 3s 3s +0%
poly_invntt_tomont_native ✅ 3s 2s +50%
poly_ntt ✅ 3s 2s +50%
poly_ntt_native ✅ 3s 4s -25%
poly_permute_bitrev_to_custom_optional_native ✅ 3s 4s -25%
poly_pointwise_montgomery_native ✅ 3s 3s +0%
poly_shiftl ✅ 3s 3s +0%
poly_uniform ✅ 3s 4s -25%
poly_uniform_eta ✅ 3s 4s -25%
poly_uniform_gamma1_4x ✅ 3s 4s -25%
polyt0_pack ✅ 3s 3s +0%
polyvec_matrix_pointwise_montgomery_row ✅ 3s 1s +200%
polyveck_reduce ✅ 3s 4s -25%
polyveck_unpack_eta ✅ 3s 6s -50%
polyvecl_pack_eta ✅ 3s 3s +0%
polyvecl_unpack_z ✅ 3s 3s +0%
polyw1_pack ✅ 3s 4s -25%
polyw1_pack_88 ✅ 3s 2s +50%
polyz_unpack_17_native_aarch64 ✅ 3s 3s +0%
power2round ✅ 3s 1s +200%
rej_eta_c ✅ 3s 5s -40%
shake128_absorb ✅ 3s 2s +50%
shake128_squeeze ✅ 3s 2s +50%
shake128x4_squeezeblocks ✅ 3s 3s +0%
shake256_finalize ✅ 3s 1s +200%
shake256x4_absorb_once ✅ 3s 3s +0%
sign_signature ✅ 3s 6s -50%
sign_verify_pre_hash_shake256 ✅ 3s 5s -40%
sk_s1hat_get_poly ✅ 3s 6s -50%
sk_s2hat_get_poly ✅ 3s 2s +50%
decompose ✅ 2s 1s +100%
fqscale ✅ 2s 3s -33%
keccak_f1600_x1_native_aarch64_v84a ✅ 2s 3s -33%
keccak_f1600_x4_native_aarch64_v8a_v84a_scalar_hybrid ✅ 2s 2s +0%
keccak_finalize ✅ 2s 2s +0%
keccak_init ✅ 2s 1s +100%
keccakf1600_xor_bytes (big endian) ✅ 2s 2s +0%
keccakf1600x4_extract_bytes ✅ 2s 4s -50%
keccakf1600x4_extract_bytes_native ✅ 2s 4s -50%
keccakf1600x4_xor_bytes ✅ 2s 1s +100%
make_hint ✅ 2s 2s +0%
mld_ct_abs_i32 ✅ 2s 2s +0%
mld_ct_cmask_neg_i32 ✅ 2s 2s +0%
mld_ct_cmask_nonzero_u32 ✅ 2s 4s -50%
mld_ct_cmask_nonzero_u8 ✅ 2s 3s -33%
mld_ct_get_optblocker_u32 ✅ 2s 3s -33%
mld_ct_memcmp ✅ 2s 2s +0%
mld_ct_sel_int32 ✅ 2s 3s -33%
mld_value_barrier_i64 ✅ 2s 2s +0%
mld_value_barrier_u32 ✅ 2s 3s -33%
montgomery_reduce ✅ 2s 4s -50%
pack_sig_c ✅ 2s 5s -60%
pack_sk_s1 ✅ 2s 5s -60%
poly_caddq_native ✅ 2s 2s +0%
poly_caddq_native_x86_64 ✅ 2s 3s -33%
poly_chknorm_native_aarch64 ✅ 2s 3s -33%
poly_chknorm_native_x86_64 ✅ 2s 3s -33%
poly_invntt_tomont ✅ 2s 3s -33%
poly_pointwise_montgomery ✅ 2s 3s -33%
polyeta_pack ✅ 2s 3s -33%
polyveck_pack_eta ✅ 2s 4s -50%
polyvecl_pointwise_acc_montgomery_native ✅ 2s 2s +0%
polyvecl_uniform_gamma1_serial ✅ 2s 3s -33%
polyw1_pack_32 ✅ 2s 4s -50%
polyz_pack ✅ 2s 3s -33%
polyz_unpack_native ✅ 2s 4s -50%
polyz_unpack_native_x86_64 ✅ 2s 3s -33%
reduce32 ✅ 2s 3s -33%
rej_uniform_native_aarch64 ✅ 2s 3s -33%
shake128_finalize ✅ 2s 1s +100%
shake256 ✅ 2s 2s +0%
shake256_init ✅ 2s 2s +0%
shake256_release ✅ 2s 2s +0%
shake256_squeeze ✅ 2s 3s -33%
sign_keypair ✅ 2s 3s -33%
unpack_sk_s1hat ✅ 2s 2s +0%
unpack_sk_s2hat ✅ 2s 4s -50%
yvec_init ✅ 2s 3s -33%
keccak_f1600_x4_native_avx2 ✅ 1s 2s -50%
mld_ct_get_optblocker_u8 ✅ 1s 2s -50%
mld_keccakf1600x4_xor_bytes_c ✅ 1s 2s -50%
mld_value_barrier_u8 ✅ 1s 3s -67%
poly_caddq ✅ 1s 2s -50%
poly_use_hint_native ✅ 1s 2s -50%
polyz_unpack_19_native_aarch64 ✅ 1s 3s -67%
rej_eta ✅ 1s 2s -50%
shake128_init ✅ 1s 2s -50%
shake128_release ✅ 1s 3s -67%
shake128x4_absorb_once ✅ 1s 3s -67%
shake256x4_squeezeblocks ✅ 1s 2s -50%

@oqs-bot

oqs-bot commented Jun 26, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

CBMC Results (ML-DSA-44)

Full Results (206 proofs)
Proof Status Current Previous Change
**TOTAL** ✅ 1630s 1514s +7.7%
polyvecl_pointwise_acc_montgomery_c ✅ 152s 131s +16%
poly_pointwise_montgomery_c ✅ 132s 114s +16%
sign_verify_internal ✅ 122s 114s +7%
mld_invntt_layer ✅ 116s 107s +8%
mld_attempt_signature_generation ✅ 59s 58s +2%
compute_pack_t0_t1 ✅ 51s 50s +2%
mld_ntt_layer ✅ 45s 42s +7%
fqmul ✅ 43s 39s +10%
polyvec_matrix_expand ✅ 28s 28s +0%
sign_signature_internal ✅ 25s 26s -4%
keccakf1600x4_permute_native ✅ 23s 22s +5%
mld_ntt_butterfly_block ✅ 23s 23s +0%
poly_ntt_c ✅ 20s 19s +5%
polyt0_unpack ✅ 18s 15s +20%
poly_chknorm_c ✅ 17s 17s +0%
polyeta_unpack ✅ 16s 14s +14%
polyvec_matrix_pointwise_montgomery_yvec ✅ 16s 15s +7%
rej_uniform_c ✅ 16s 15s +7%
rej_uniform ✅ 15s 18s -17%
poly_uniform_4x ✅ 14s 14s +0%
mld_check_pct ✅ 13s 14s -7%
poly_uniform_eta_4x ✅ 13s 11s +18%
poly_invntt_tomont_c ✅ 12s 11s +9%
rej_uniform_native_x86_64 ✅ 12s - new
polyvecl_chknorm ✅ 11s 10s +10%
polyz_unpack_c ✅ 10s 11s -9%
polyvec_matrix_expand_serial ✅ 9s 8s +12%
keccak_absorb_once_x4 ✅ 8s 9s -11%
sign_pk_from_sk ✅ 8s 5s +60%
mld_compute_pack_z ✅ 7s 7s +0%
poly_add ✅ 7s 7s +0%
polyvecl_ntt ✅ 7s 2s +250%
mld_keccakf1600_permute_c ✅ 6s 8s -25%
mld_sample_s1_s2 ✅ 6s 4s +50%
polyt1_unpack ✅ 6s 5s +20%
polyz_unpack ✅ 6s 3s +100%
rej_uniform_native ✅ 6s 4s +50%
shake128_release ✅ 6s 1s +500%
sign_signature_pre_hash_shake256 ✅ 6s 3s +100%
fqscale ✅ 5s 3s +67%
intt_native_aarch64 ✅ 5s 9s -44%
keccak_f1600_x4_native_aarch64_v8a_v84a_scalar_hybrid ✅ 5s 1s +400%
mld_keccakf1600_extract_bytes ✅ 5s 2s +150%
mld_polymat_expand_entry ✅ 5s 3s +67%
pack_sig_c ✅ 5s 2s +150%
pointwise_acc_native_aarch64 ✅ 5s 4s +25%
pointwise_acc_native_x86_64 ✅ 5s 7s -29%
poly_caddq_native_aarch64 ✅ 5s 4s +25%
poly_challenge ✅ 5s 3s +67%
poly_chknorm ✅ 5s 4s +25%
poly_ntt_native ✅ 5s 5s +0%
poly_uniform ✅ 5s 6s -17%
poly_use_hint ✅ 5s 4s +25%
polyveck_caddq ✅ 5s 3s +67%
polyveck_invntt_tomont ✅ 5s 5s +0%
rej_uniform_eta_native_aarch64 ✅ 5s 2s +150%
rej_uniform_native_aarch64 ✅ 5s 5s +0%
sign_verify_pre_hash_shake256 ✅ 5s 5s +0%
sk_t0hat_get_poly ✅ 5s 2s +150%
unpack_sk ✅ 5s 3s +67%
intt_native_x86_64 ✅ 4s 4s +0%
keccak_absorb ✅ 4s 5s -20%
keccak_finalize ✅ 4s 3s +33%
keccak_squeezeblocks_x4 ✅ 4s 4s +0%
keccakf1600x4_xor_bytes_native ✅ 4s 3s +33%
make_hint ✅ 4s 3s +33%
mld_h ✅ 4s 4s +0%
mld_keccakf1600x4_extract_bytes_c ✅ 4s 2s +100%
mld_keccakf1600x4_xor_bytes_c ✅ 4s 2s +100%
mld_prepare_domain_separation_prefix ✅ 4s 4s +0%
mld_sample_s1_s2_serial ✅ 4s 3s +33%
ntt_native_aarch64 ✅ 4s 3s +33%
pack_sig_h ✅ 4s 3s +33%
pointwise_native_x86_64 ✅ 4s 4s +0%
poly_caddq_native ✅ 4s 5s -20%
poly_decompose_c ✅ 4s 4s +0%
poly_decompose_native ✅ 4s 3s +33%
poly_permute_bitrev_to_custom_optional ✅ 4s 2s +100%
poly_reduce ✅ 4s 3s +33%
poly_uniform_eta ✅ 4s 5s -20%
poly_use_hint_native ✅ 4s 4s +0%
polyvec_matrix_pointwise_montgomery_row ✅ 4s 2s +100%
polyveck_chknorm ✅ 4s 5s -20%
polyveck_decompose ✅ 4s 4s +0%
polyveck_pack_eta ✅ 4s 2s +100%
polyvecl_pointwise_acc_montgomery_native ✅ 4s 2s +100%
polyvecl_uniform_gamma1 ✅ 4s 3s +33%
polyvecl_unpack_eta ✅ 4s 2s +100%
rej_eta ✅ 4s 3s +33%
shake128x4_absorb_once ✅ 4s 3s +33%
shake256_absorb ✅ 4s 3s +33%
sign_signature_pre_hash_internal ✅ 4s 6s -33%
sk_s1hat_get_poly ✅ 4s 3s +33%
unpack_pk_t1 ✅ 4s 5s -20%
unpack_sk_t0hat ✅ 4s 3s +33%
yvec_get_poly ✅ 4s 3s +33%
yvec_init ✅ 4s 3s +33%
caddq ✅ 3s 2s +50%
keccak_f1600_x1_native_aarch64 ✅ 3s 2s +50%
keccak_f1600_x1_native_aarch64_v84a ✅ 3s 3s +0%
keccak_f1600_x4_native_aarch64_v8a_scalar_hybrid ✅ 3s 3s +0%
keccak_f1600_x4_native_avx2 ✅ 3s 3s +0%
keccak_init ✅ 3s 3s +0%
keccak_squeeze ✅ 3s 1s +200%
keccakf1600_extract_bytes (big endian) ✅ 3s 2s +50%
keccakf1600_xor_bytes ✅ 3s 1s +200%
keccakf1600x4_permute ✅ 3s 4s -25%
mld_ct_cmask_neg_i32 ✅ 3s 3s +0%
mld_ct_cmask_nonzero_u32 ✅ 3s 2s +50%
mld_ct_get_optblocker_u32 ✅ 3s 1s +200%
mld_ct_memcmp ✅ 3s 3s +0%
mld_value_barrier_u8 ✅ 3s 3s +0%
montgomery_reduce ✅ 3s 3s +0%
ntt_native_x86_64 ✅ 3s 3s +0%
nttunpack_native_x86_64 ✅ 3s 1s +200%
pack_sk_rho_key_tr_s2 ✅ 3s 3s +0%
pack_sk_s1 ✅ 3s 2s +50%
pointwise_native_aarch64 ✅ 3s 5s -40%
poly_chknorm_native_aarch64 ✅ 3s 4s -25%
poly_decompose_native_x86_64 ✅ 3s 3s +0%
poly_permute_bitrev_to_custom_optional_native ✅ 3s 4s -25%
poly_pointwise_montgomery ✅ 3s 3s +0%
poly_pointwise_montgomery_native ✅ 3s 2s +50%
poly_power2round ✅ 3s 4s -25%
poly_uniform_gamma1_4x ✅ 3s 5s -40%
poly_use_hint_c ✅ 3s 3s +0%
poly_use_hint_native_x86_64 ✅ 3s - new
polyeta_pack ✅ 3s 3s +0%
polyt1_pack ✅ 3s 4s -25%
polyveck_ntt ✅ 3s 5s -40%
polyveck_pack_w1 ✅ 3s 1s +200%
polyveck_reduce ✅ 3s 5s -40%
polyveck_unpack_eta ✅ 3s 2s +50%
polyvecl_pack_eta ✅ 3s 3s +0%
polyvecl_pointwise_acc_montgomery ✅ 3s 4s -25%
polyvecl_uniform_gamma1_serial ✅ 3s 2s +50%
polyw1_pack_88 ✅ 3s 1s +200%
polyz_pack ✅ 3s 2s +50%
polyz_unpack_19_native_aarch64 ✅ 3s 5s -40%
polyz_unpack_native ✅ 3s 2s +50%
polyz_unpack_native_x86_64 ✅ 3s 3s +0%
power2round ✅ 3s 3s +0%
reduce32 ✅ 3s 2s +50%
rej_eta_native ✅ 3s 6s -50%
shake128_init ✅ 3s 3s +0%
shake256 ✅ 3s 1s +200%
shake256_finalize ✅ 3s 2s +50%
shake256_init ✅ 3s 3s +0%
shake256_release ✅ 3s 2s +50%
shake256x4_squeezeblocks ✅ 3s 4s -25%
sign_keypair_internal ✅ 3s 4s -25%
sign_signature ✅ 3s 3s +0%
sign_signature_extmu ✅ 3s 4s -25%
sign_verify_extmu ✅ 3s 3s +0%
sign_verify_pre_hash_internal ✅ 3s 3s +0%
sys_check_capability ✅ 3s 4s -25%
decompose ✅ 2s 2s +0%
keccakf1600_permute ✅ 2s 2s +0%
keccakf1600_permute_native ✅ 2s 3s -33%
keccakf1600x4_extract_bytes ✅ 2s 2s +0%
keccakf1600x4_xor_bytes ✅ 2s 2s +0%
mld_ct_abs_i32 ✅ 2s 2s +0%
mld_ct_cmask_nonzero_u8 ✅ 2s 2s +0%
mld_ct_get_optblocker_u8 ✅ 2s 1s +100%
mld_ct_sel_int32 ✅ 2s 2s +0%
mld_value_barrier_i64 ✅ 2s 2s +0%
pack_sig_z ✅ 2s 4s -50%
poly_caddq ✅ 2s 2s +0%
poly_caddq_c ✅ 2s 2s +0%
poly_caddq_native_x86_64 ✅ 2s 4s -50%
poly_chknorm_native_x86_64 ✅ 2s 2s +0%
poly_decompose ✅ 2s 3s -33%
poly_decompose_32_native_aarch64 ✅ 2s 2s +0%
poly_decompose_88_native_aarch64 ✅ 2s 4s -50%
poly_invntt_tomont ✅ 2s 4s -50%
poly_invntt_tomont_native ✅ 2s 4s -50%
poly_ntt ✅ 2s 3s -33%
poly_shiftl ✅ 2s 3s -33%
poly_sub ✅ 2s 3s -33%
poly_uniform_gamma1 ✅ 2s 4s -50%
poly_use_hint_native_aarch64 ✅ 2s 2s +0%
polyvecl_unpack_z ✅ 2s 2s +0%
polyw1_pack ✅ 2s 3s -33%
polyw1_pack_32 ✅ 2s 2s +0%
polyz_unpack_17_native_aarch64 ✅ 2s 5s -60%
rej_eta_c ✅ 2s 4s -50%
shake128_absorb ✅ 2s 2s +0%
shake128_finalize ✅ 2s 2s +0%
shake256_squeeze ✅ 2s 2s +0%
sig_unpack_hints ✅ 2s 2s +0%
sign_keypair ✅ 2s 4s -50%
sign_verify ✅ 2s 4s -50%
sk_s2hat_get_poly ✅ 2s 2s +0%
unpack_sk_s1hat ✅ 2s 1s +100%
unpack_sk_s2hat ✅ 2s 4s -50%
use_hint ✅ 2s 2s +0%
keccak_f1600_x4_native_aarch64_v84a ✅ 1s 2s -50%
keccakf1600_xor_bytes (big endian) ✅ 1s 4s -75%
keccakf1600x4_extract_bytes_native ✅ 1s 3s -67%
mld_ct_get_optblocker_i64 ✅ 1s 4s -75%
mld_value_barrier_u32 ✅ 1s 2s -50%
poly_chknorm_native ✅ 1s 4s -75%
polyt0_pack ✅ 1s 2s -50%
shake128_squeeze ✅ 1s 1s +0%
shake128x4_squeezeblocks ✅ 1s 1s +0%
shake256x4_absorb_once ✅ 1s 3s -67%

@oqs-bot

oqs-bot commented Jun 26, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

CBMC Results (ML-DSA-87)

Full Results (206 proofs)
Proof Status Current Previous Change
**TOTAL** ✅ 2163s 2151s +0.6%
polyvecl_pointwise_acc_montgomery_c ✅ 358s 353s +1%
polyvec_matrix_expand ✅ 322s 324s -1%
poly_pointwise_montgomery_c ✅ 139s 144s -3%
mld_invntt_layer ✅ 123s 115s +7%
sign_verify_internal ✅ 99s 97s +2%
mld_attempt_signature_generation ✅ 53s 55s -4%
mld_ntt_layer ✅ 44s 45s -2%
fqmul ✅ 42s 43s -2%
sign_signature_internal ✅ 39s 42s -7%
polyvec_matrix_expand_serial ✅ 38s 38s +0%
keccakf1600x4_permute_native ✅ 25s 23s +9%
mld_ntt_butterfly_block ✅ 22s 24s -8%
poly_ntt_c ✅ 21s 21s +0%
polyt0_unpack ✅ 19s 14s +36%
compute_pack_t0_t1 ✅ 18s 19s -5%
rej_uniform_c ✅ 18s 19s -5%
polyvec_matrix_pointwise_montgomery_yvec ✅ 17s 18s -6%
rej_uniform ✅ 17s 15s +13%
mld_check_pct ✅ 16s 16s +0%
poly_chknorm_c ✅ 16s 15s +7%
polyeta_unpack ✅ 15s 17s -12%
poly_uniform_4x ✅ 14s 13s +8%
polyveck_decompose ✅ 13s 13s +0%
poly_uniform_eta_4x ✅ 12s 11s +9%
poly_invntt_tomont_c ✅ 11s 12s -8%
pointwise_acc_native_aarch64 ✅ 10s 6s +67%
pointwise_acc_native_x86_64 ✅ 10s 6s +67%
rej_uniform_native_x86_64 ✅ 10s - new
keccak_absorb_once_x4 ✅ 9s 9s +0%
mld_sample_s1_s2 ✅ 9s 6s +50%
unpack_sk_t0hat ✅ 9s 7s +29%
mld_compute_pack_z ✅ 8s 8s +0%
polyveck_caddq ✅ 8s 8s +0%
polyveck_invntt_tomont ✅ 8s 9s -11%
polyveck_ntt ✅ 8s 11s -27%
polyvecl_ntt ✅ 8s 7s +14%
mld_keccakf1600_permute_c ✅ 7s 7s +0%
mld_sample_s1_s2_serial ✅ 7s 8s -12%
rej_eta_native ✅ 7s 6s +17%
keccakf1600_xor_bytes (big endian) ✅ 6s 2s +200%
pack_sk_s1 ✅ 6s 1s +500%
poly_add ✅ 6s 6s +0%
poly_decompose_c ✅ 6s 5s +20%
poly_invntt_tomont ✅ 6s 1s +500%
polyveck_pack_w1 ✅ 6s 3s +100%
polyvecl_chknorm ✅ 6s 7s -14%
rej_uniform_native ✅ 6s 8s -25%
keccak_init ✅ 5s 3s +67%
poly_decompose_native ✅ 5s 2s +150%
poly_decompose_native_x86_64 ✅ 5s 2s +150%
poly_pointwise_montgomery_native ✅ 5s 5s +0%
polyz_unpack_19_native_aarch64 ✅ 5s 4s +25%
polyz_unpack_c ✅ 5s 3s +67%
rej_eta_c ✅ 5s 5s +0%
sign_keypair_internal ✅ 5s 6s -17%
sign_pk_from_sk ✅ 5s 6s -17%
sign_signature ✅ 5s 5s +0%
sign_verify_extmu ✅ 5s 3s +67%
sign_verify_pre_hash_shake256 ✅ 5s 3s +67%
keccak_absorb ✅ 4s 3s +33%
keccak_f1600_x4_native_aarch64_v8a_v84a_scalar_hybrid ✅ 4s 4s +0%
keccak_f1600_x4_native_avx2 ✅ 4s 2s +100%
keccakf1600x4_extract_bytes ✅ 4s 2s +100%
keccakf1600x4_permute ✅ 4s 3s +33%
mld_ct_cmask_neg_i32 ✅ 4s 4s +0%
mld_ct_cmask_nonzero_u8 ✅ 4s 3s +33%
mld_ct_get_optblocker_i64 ✅ 4s 3s +33%
mld_ct_sel_int32 ✅ 4s 3s +33%
mld_keccakf1600x4_xor_bytes_c ✅ 4s 4s +0%
mld_prepare_domain_separation_prefix ✅ 4s 4s +0%
mld_value_barrier_u32 ✅ 4s 2s +100%
poly_caddq_native_x86_64 ✅ 4s 2s +100%
poly_chknorm ✅ 4s 3s +33%
poly_chknorm_native_aarch64 ✅ 4s 4s +0%
poly_decompose ✅ 4s 3s +33%
poly_power2round ✅ 4s 3s +33%
poly_sub ✅ 4s 3s +33%
poly_uniform_eta ✅ 4s 4s +0%
poly_uniform_gamma1_4x ✅ 4s 3s +33%
poly_use_hint_native_aarch64 ✅ 4s 2s +100%
polyeta_pack ✅ 4s 4s +0%
polyt0_pack ✅ 4s 4s +0%
polyt1_pack ✅ 4s 3s +33%
polyt1_unpack ✅ 4s 4s +0%
polyvec_matrix_pointwise_montgomery_row ✅ 4s 3s +33%
polyveck_chknorm ✅ 4s 3s +33%
polyveck_pack_eta ✅ 4s 6s -33%
polyvecl_pack_eta ✅ 4s 3s +33%
polyvecl_unpack_eta ✅ 4s 5s -20%
polyz_unpack ✅ 4s 2s +100%
polyz_unpack_native ✅ 4s 4s +0%
rej_uniform_eta_native_aarch64 ✅ 4s 5s -20%
shake128_init ✅ 4s 1s +300%
shake256 ✅ 4s 2s +100%
shake256_release ✅ 4s 3s +33%
shake256x4_squeezeblocks ✅ 4s 1s +300%
sign_keypair ✅ 4s 4s +0%
sign_signature_extmu ✅ 4s 4s +0%
sign_verify_pre_hash_internal ✅ 4s 3s +33%
unpack_sk ✅ 4s 5s -20%
unpack_sk_s1hat ✅ 4s 2s +100%
unpack_sk_s2hat ✅ 4s 3s +33%
yvec_init ✅ 4s 4s +0%
caddq ✅ 3s 4s -25%
decompose ✅ 3s 3s +0%
intt_native_x86_64 ✅ 3s 3s +0%
keccak_f1600_x1_native_aarch64 ✅ 3s 1s +200%
keccak_f1600_x1_native_aarch64_v84a ✅ 3s 1s +200%
keccak_f1600_x4_native_aarch64_v84a ✅ 3s 4s -25%
keccak_squeeze ✅ 3s 2s +50%
keccak_squeezeblocks_x4 ✅ 3s 4s -25%
keccakf1600_permute ✅ 3s 3s +0%
keccakf1600x4_xor_bytes ✅ 3s 3s +0%
keccakf1600x4_xor_bytes_native ✅ 3s 3s +0%
mld_ct_cmask_nonzero_u32 ✅ 3s 2s +50%
mld_ct_get_optblocker_u32 ✅ 3s 2s +50%
mld_ct_get_optblocker_u8 ✅ 3s 3s +0%
mld_ct_memcmp ✅ 3s 3s +0%
mld_h ✅ 3s 3s +0%
mld_keccakf1600x4_extract_bytes_c ✅ 3s 2s +50%
ntt_native_x86_64 ✅ 3s 2s +50%
nttunpack_native_x86_64 ✅ 3s 3s +0%
pack_sig_c ✅ 3s 4s -25%
pack_sig_h ✅ 3s 4s -25%
pack_sig_z ✅ 3s 5s -40%
pack_sk_rho_key_tr_s2 ✅ 3s 3s +0%
pointwise_native_x86_64 ✅ 3s 2s +50%
poly_caddq_native_aarch64 ✅ 3s 3s +0%
poly_challenge ✅ 3s 5s -40%
poly_chknorm_native ✅ 3s 4s -25%
poly_chknorm_native_x86_64 ✅ 3s 2s +50%
poly_decompose_32_native_aarch64 ✅ 3s 5s -40%
poly_decompose_88_native_aarch64 ✅ 3s 2s +50%
poly_pointwise_montgomery ✅ 3s 4s -25%
poly_reduce ✅ 3s 2s +50%
poly_uniform ✅ 3s 4s -25%
poly_use_hint ✅ 3s 1s +200%
poly_use_hint_c ✅ 3s 2s +50%
poly_use_hint_native_x86_64 ✅ 3s - new
polyveck_unpack_eta ✅ 3s 4s -25%
polyvecl_pointwise_acc_montgomery_native ✅ 3s 3s +0%
polyvecl_unpack_z ✅ 3s 4s -25%
polyz_pack ✅ 3s 5s -40%
polyz_unpack_17_native_aarch64 ✅ 3s 3s +0%
reduce32 ✅ 3s 3s +0%
rej_eta ✅ 3s 4s -25%
shake128_squeeze ✅ 3s 2s +50%
shake256_absorb ✅ 3s 2s +50%
shake256_finalize ✅ 3s 2s +50%
shake256_init ✅ 3s 2s +50%
sig_unpack_hints ✅ 3s 3s +0%
sign_signature_pre_hash_internal ✅ 3s 5s -40%
sign_signature_pre_hash_shake256 ✅ 3s 6s -50%
sign_verify ✅ 3s 5s -40%
sk_s1hat_get_poly ✅ 3s 3s +0%
sk_s2hat_get_poly ✅ 3s 3s +0%
sk_t0hat_get_poly ✅ 3s 4s -25%
use_hint ✅ 3s 3s +0%
yvec_get_poly ✅ 3s 4s -25%
fqscale ✅ 2s 3s -33%
intt_native_aarch64 ✅ 2s 3s -33%
keccak_f1600_x4_native_aarch64_v8a_scalar_hybrid ✅ 2s 3s -33%
keccakf1600_extract_bytes (big endian) ✅ 2s 3s -33%
keccakf1600_xor_bytes ✅ 2s 3s -33%
keccakf1600x4_extract_bytes_native ✅ 2s 2s +0%
make_hint ✅ 2s 3s -33%
mld_ct_abs_i32 ✅ 2s 3s -33%
mld_keccakf1600_extract_bytes ✅ 2s 4s -50%
mld_polymat_expand_entry ✅ 2s 3s -33%
ntt_native_aarch64 ✅ 2s 6s -67%
pointwise_native_aarch64 ✅ 2s 5s -60%
poly_caddq ✅ 2s 2s +0%
poly_caddq_c ✅ 2s 3s -33%
poly_caddq_native ✅ 2s 4s -50%
poly_invntt_tomont_native ✅ 2s 5s -60%
poly_ntt ✅ 2s 3s -33%
poly_ntt_native ✅ 2s 3s -33%
poly_permute_bitrev_to_custom_optional ✅ 2s 3s -33%
poly_permute_bitrev_to_custom_optional_native ✅ 2s 5s -60%
poly_uniform_gamma1 ✅ 2s 4s -50%
poly_use_hint_native ✅ 2s 3s -33%
polyveck_reduce ✅ 2s 3s -33%
polyvecl_pointwise_acc_montgomery ✅ 2s 5s -60%
polyvecl_uniform_gamma1 ✅ 2s 2s +0%
polyvecl_uniform_gamma1_serial ✅ 2s 4s -50%
polyw1_pack ✅ 2s 4s -50%
polyw1_pack_32 ✅ 2s 4s -50%
polyz_unpack_native_x86_64 ✅ 2s 3s -33%
rej_uniform_native_aarch64 ✅ 2s 2s +0%
shake128_absorb ✅ 2s 4s -50%
shake128_release ✅ 2s 4s -50%
shake128x4_absorb_once ✅ 2s 5s -60%
shake128x4_squeezeblocks ✅ 2s 3s -33%
unpack_pk_t1 ✅ 2s 1s +100%
keccak_finalize ✅ 1s 1s +0%
keccakf1600_permute_native ✅ 1s 4s -75%
mld_value_barrier_i64 ✅ 1s 1s +0%
mld_value_barrier_u8 ✅ 1s 3s -67%
montgomery_reduce ✅ 1s 3s -67%
poly_shiftl ✅ 1s 4s -75%
polyw1_pack_88 ✅ 1s 3s -67%
power2round ✅ 1s 4s -75%
shake128_finalize ✅ 1s 2s -50%
shake256_squeeze ✅ 1s 2s -50%
shake256x4_absorb_once ✅ 1s 2s -50%
sys_check_capability ✅ 1s 3s -67%

hanno-becker
hanno-becker reviewed Jun 27, 2026
View reviewed changes
Comment thread mldsa/src/sign.h Outdated
hanno-becker
hanno-becker requested changes Jun 27, 2026
View reviewed changes

@hanno-becker hanno-becker left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thank you @fegge, I support this change. One could even make the comment more prominent, see comment. @mkannwischer wdyt

hanno-becker
hanno-becker approved these changes Jul 12, 2026
View reviewed changes

@hanno-becker hanno-becker left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@fegge @hanno-becker
Document signing secret-key validity precondition
abf2742 
Signing APIs assume a valid, bit-packed secret key and do not
perform full serialized-key validation (t0, tr, s1, s2). Callers
importing serialized keys can validate them via pk_from_sk before
signing.

* Add @warning notices to all sign* / signature* / pre_hash sign
  entry points in mldsa_native.h and mldsa/src/sign.h, and reword
  the sk parameter descriptions to "assumed to be valid".
* Expand the Wycheproof client comment for the InvalidPrivateKey
  skip: FIPS 204 does not require signing to validate serialized
  private keys, full validation covers t0 and tr and is exposed
  through pk_from_sk, and those vectors are still tested via
  pkFromSk.

Signed-off-by: Fredrik Dahlgren <fredrik.dahlgren@trailofbits.com>
[hbecker: rebase+squash, adjust commit message]
Signed-off-by: Hanno Becker <beckphan@amazon.co.uk>
@hanno-becker hanno-becker force-pushed the ptp/sign-accepts-invalid-secret-keys branch from b3f019d to abf2742 Compare July 12, 2026 05:54
@mkannwischer mkannwischer enabled auto-merge July 13, 2026 03:30
@mkannwischer mkannwischer added this pull request to the merge queue Jul 13, 2026
Merged via the queue into main with commit bdad2c5 Jul 13, 2026
376 checks passed
@mkannwischer mkannwischer deleted the ptp/sign-accepts-invalid-secret-keys branch July 13, 2026 04:19
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@mkannwischer mkannwischer mkannwischer approved these changes
@hanno-becker hanno-becker hanno-becker approved these changes

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Signing accepts invalid secret keys that pk_from_sk rejects

4 participants

@fegge @oqs-bot @mkannwischer @hanno-becker