ACVP: Support FIPS203-tr1 encapDecap (v1.1.0.43) by mkannwischer · Pull Request #1811 · pq-code-package/mlkem-native

mkannwischer · 2026-07-22T14:40:24Z

The FIPS203-tr1 encapDecap revision adds keyFormat 'seed'/'expanded' groups: the decapsulation key may be supplied as a seed (d||z) to expand rather than as the expanded dk.

Add a decode_dk() entry point to the ACVP harness accepting either dk=HEX or seed=HEX (expanding the seed via crypto_kem_keypair_derand), and route the decapsulation function through it. keyFormat is inspected per group, so the client copes whether or not a given file carries it. Download and run the ML-KEM-encapDecap-FIPS203-tr1 vectors when the version ships them (v1.1.0.43+); keep the base FIPS203 dataset.

Two quirks in the v1.1.0.43 sample vectors are worth recording:

decapsulationKeyCheck cases carry only a tcId with no dk, yet their expected results are a non-trivial mix of pass and fail, so they cannot be reproduced offline. The client drops decapsulationKeyCheck cases that lack a key, from prompt and expected alike; they run normally again once a key is present. This is a known upstream sample bug (Encoding issue for ML-KEM decapsulationKeyCheck tests in v1.1.0.43 usnistgov/ACVP-Server#459), where the maintainers confirm keyFormat there should be 'expanded' with the dk provided.
The base ML-KEM-encapDecap-FIPS203 file also gained keyFormat at v1.1.0.43, whereas for ML-DSA only the -tr1 revision carries it. This looks like an unintended regeneration of the base file; the per-group handling above keeps the client correct whether or not it is fixed.

Bump the default ACVP version to v1.1.0.43 and roll the CI matrix forward to the three latest revisions.

oqs-bot · 2026-07-22T15:14:19Z

CBMC Results (ML-KEM-1024)

Full Results (191 proofs)

Proof	Status	Current	Previous	Change
`TOTAL`	✅	1797s	1806s	-0.5%
`mlk_indcpa_enc`	✅	384s	380s	+1%
`mlk_indcpa_keypair_derand`	✅	165s	170s	-3%
`mlk_poly_rej_uniform`	✅	159s	147s	+8%
`mlk_rej_uniform_c`	✅	132s	140s	-6%
`mlk_polyvec_basemul_acc_montgomery_cached_c`	✅	72s	85s	-15%
`rej_uniform_native_x86_64`	✅	62s	60s	+3%
`rej_uniform_native_aarch64`	✅	50s	49s	+2%
`poly_ntt_native`	✅	44s	48s	-8%
`mlk_ntt_layer`	✅	38s	30s	+27%
`mlk_poly_reduce_native`	✅	36s	33s	+9%
`polyvec_basemul_acc_montgomery_cached_native`	✅	30s	27s	+11%
`mlk_keccak_squeezeblocks_x4`	✅	25s	24s	+4%
`mlk_fqmul`	✅	18s	16s	+12%
`mlk_polyvec_add`	✅	18s	17s	+6%
`keccakf1600x4_permute_native_x4`	✅	16s	17s	-6%
`mlk_poly_decompress_d11_native`	✅	16s	16s	+0%
`mlk_poly_decompress_d5_native`	✅	16s	14s	+14%
`mlk_indcpa_dec`	✅	14s	11s	+27%
`mlk_poly_frommsg`	✅	10s	14s	-29%
`mlk_keccak_squeeze_once`	✅	9s	8s	+12%
`mlk_poly_frombytes_native`	✅	9s	9s	+0%
`mlk_polyvec_ntt`	✅	9s	9s	+0%
`mlk_keccak_squeezeblocks`	✅	8s	8s	+0%
`mlk_ntt_butterfly_block`	✅	8s	7s	+14%
`mlk_poly_sub`	✅	8s	7s	+14%
`mlk_keccak_absorb_once_x4`	✅	7s	7s	+0%
`mlk_poly_ntt`	✅	7s	11s	-36%
`kem_dec`	✅	6s	5s	+20%
`mlk_poly_cbd_eta1`	✅	6s	3s	+100%
`poly_decompress_d11_native_x86_64`	✅	6s	4s	+50%
`kem_enc_derand`	✅	5s	2s	+150%
`mlk_keccak_absorb_once`	✅	5s	4s	+25%
`mlk_keccakf1600_permute_c`	✅	5s	8s	-38%
`mlk_matvec_mul`	✅	5s	2s	+150%
`mlk_poly_compress_d11_c`	✅	5s	4s	+25%
`mlk_poly_rej_uniform_x4`	✅	5s	4s	+25%
`mlk_polymat_permute_bitrev_to_custom`	✅	5s	3s	+67%
`poly_decompress_d5_native_x86_64`	✅	5s	5s	+0%
`rej_uniform_native`	✅	5s	1s	+400%
`mlk_gen_matrix`	✅	4s	4s	+0%
`mlk_gen_matrix_serial`	✅	4s	4s	+0%
`mlk_invntt_layer`	✅	4s	5s	-20%
`mlk_keccakf1600_extract_bytes`	✅	4s	3s	+33%
`mlk_poly_add`	✅	4s	5s	-20%
`mlk_poly_compress_d11_native`	✅	4s	3s	+33%
`mlk_poly_compress_dv`	✅	4s	4s	+0%
`mlk_poly_tomont_native`	✅	4s	2s	+100%
`mlk_polyvec_basemul_acc_montgomery_cached`	✅	4s	2s	+100%
`mlk_polyvec_compress_du`	✅	4s	2s	+100%
`mlk_polyvec_decompress_du`	✅	4s	4s	+0%
`mlk_scalar_compress_d1`	✅	4s	2s	+100%
`mlk_scalar_compress_d5`	✅	4s	4s	+0%
`mlk_scalar_decompress_d10`	✅	4s	2s	+100%
`ntt_native_x86_64`	✅	4s	3s	+33%
`poly_compress_d5_native_x86_64`	✅	4s	2s	+100%
`poly_decompress_d4_native_x86_64`	✅	4s	1s	+300%
`poly_frombytes_native_x86_64`	✅	4s	5s	-20%
`polyvec_basemul_acc_montgomery_cached_k2_native_x86_64`	✅	4s	1s	+300%
`intt_native_aarch64`	✅	3s	4s	-25%
`intt_native_x86_64`	✅	3s	3s	+0%
`keccak_f1600_x1_native_aarch64`	✅	3s	1s	+200%
`keccak_f1600_x4_native_aarch64_v84a`	✅	3s	1s	+200%
`keccak_f1600_x4_native_aarch64_v8a_scalar_hybrid`	✅	3s	2s	+50%
`keccak_f1600_x4_native_avx2`	✅	3s	2s	+50%
`keccakf1600_permute_native`	✅	3s	2s	+50%
`keccakf1600x4_xor_bytes_native`	✅	3s	3s	+0%
`kem_enc`	✅	3s	2s	+50%
`kem_keypair_derand`	✅	3s	3s	+0%
`mlk_barrett_reduce`	✅	3s	1s	+200%
`mlk_ct_cmask_neg_i16`	✅	3s	2s	+50%
`mlk_ct_cmask_nonzero_u16`	✅	3s	3s	+0%
`mlk_ct_get_optblocker_u8`	✅	3s	3s	+0%
`mlk_ct_memcmp`	✅	3s	2s	+50%
`mlk_ct_sel_int16`	✅	3s	2s	+50%
`mlk_ct_sel_uint8`	✅	3s	4s	-25%
`mlk_enc_getnoise_eta1_eta2`	✅	3s	4s	-25%
`mlk_keypair_getnoise_eta1`	✅	3s	2s	+50%
`mlk_montgomery_reduce`	✅	3s	2s	+50%
`mlk_poly_compress_d10_c`	✅	3s	3s	+0%
`mlk_poly_compress_d4`	✅	3s	3s	+0%
`mlk_poly_compress_d4_native`	✅	3s	1s	+200%
`mlk_poly_compress_d5`	✅	3s	3s	+0%
`mlk_poly_compress_d5_native`	✅	3s	2s	+50%
`mlk_poly_decompress_d11_c`	✅	3s	2s	+50%
`mlk_poly_decompress_d4`	✅	3s	3s	+0%
`mlk_poly_decompress_d5_c`	✅	3s	2s	+50%
`mlk_poly_frombytes`	✅	3s	4s	-25%
`mlk_poly_frombytes_c`	✅	3s	4s	-25%
`mlk_poly_getnoise_eta1122_4x`	✅	3s	2s	+50%
`mlk_poly_getnoise_eta1_4x`	✅	3s	4s	-25%
`mlk_poly_getnoise_eta2`	✅	3s	2s	+50%
`mlk_poly_mulcache_compute_native`	✅	3s	1s	+200%
`mlk_poly_tobytes_c`	✅	3s	2s	+50%
`mlk_poly_tomont`	✅	3s	2s	+50%
`mlk_poly_tomont_c`	✅	3s	1s	+200%
`mlk_polyvec_frombytes`	✅	3s	2s	+50%
`mlk_polyvec_mulcache_compute`	✅	3s	3s	+0%
`mlk_polyvec_permute_bitrev_to_custom`	✅	3s	3s	+0%
`mlk_polyvec_permute_bitrev_to_custom_native`	✅	3s	3s	+0%
`mlk_polyvec_tobytes`	✅	3s	6s	-50%
`mlk_scalar_compress_d10`	✅	3s	2s	+50%
`mlk_shake128_squeezeblocks`	✅	3s	2s	+50%
`mlk_shake256`	✅	3s	2s	+50%
`mlk_shake256x4`	✅	3s	3s	+0%
`mlk_value_barrier_u32`	✅	3s	1s	+200%
`nttunpack_native_x86_64`	✅	3s	1s	+200%
`poly_compress_d11_native_x86_64`	✅	3s	5s	-40%
`poly_mulcache_compute_native_aarch64`	✅	3s	2s	+50%
`poly_mulcache_compute_native_x86_64`	✅	3s	1s	+200%
`poly_reduce_native_aarch64`	✅	3s	2s	+50%
`poly_tomont_native_aarch64`	✅	3s	3s	+0%
`polyvec_basemul_acc_montgomery_cached_k4_native_aarch64`	✅	3s	4s	-25%
`keccak_f1600_x1_native_aarch64_v84a`	✅	2s	2s	+0%
`keccak_f1600_x4_native_aarch64_v8a_v84a_scalar_hybrid`	✅	2s	3s	-33%
`kem_check_pk`	✅	2s	2s	+0%
`kem_check_sk`	✅	2s	3s	-33%
`kem_keypair`	✅	2s	2s	+0%
`mlk_check_pct`	✅	2s	5s	-60%
`mlk_ct_get_optblocker_i32`	✅	2s	1s	+100%
`mlk_keccakf1600_extract_bytes (big endian)`	✅	2s	3s	-33%
`mlk_keccakf1600_xor_bytes`	✅	2s	1s	+100%
`mlk_keccakf1600_xor_bytes (big endian)`	✅	2s	2s	+0%
`mlk_keccakf1600x4_extract_bytes_c`	✅	2s	1s	+100%
`mlk_keccakf1600x4_permute`	✅	2s	2s	+0%
`mlk_poly_cbd_eta2`	✅	2s	3s	-33%
`mlk_poly_compress_d10`	✅	2s	4s	-50%
`mlk_poly_compress_d10_native`	✅	2s	2s	+0%
`mlk_poly_compress_d11`	✅	2s	2s	+0%
`mlk_poly_compress_d4_c`	✅	2s	3s	-33%
`mlk_poly_compress_d5_c`	✅	2s	2s	+0%
`mlk_poly_compress_du`	✅	2s	5s	-60%
`mlk_poly_decompress_d10`	✅	2s	2s	+0%
`mlk_poly_decompress_d10_native`	✅	2s	2s	+0%
`mlk_poly_decompress_d11`	✅	2s	1s	+100%
`mlk_poly_decompress_d4_c`	✅	2s	3s	-33%
`mlk_poly_decompress_du`	✅	2s	5s	-60%
`mlk_poly_decompress_dv`	✅	2s	2s	+0%
`mlk_poly_invntt_tomont_c`	✅	2s	2s	+0%
`mlk_poly_mulcache_compute_c`	✅	2s	1s	+100%
`mlk_poly_reduce`	✅	2s	5s	-60%
`mlk_poly_reduce_c`	✅	2s	3s	-33%
`mlk_poly_tomsg`	✅	2s	4s	-50%
`mlk_polyvec_invntt_tomont`	✅	2s	5s	-60%
`mlk_polyvec_reduce`	✅	2s	2s	+0%
`mlk_polyvec_tomont`	✅	2s	1s	+100%
`mlk_rej_uniform`	✅	2s	4s	-50%
`mlk_scalar_decompress_d4`	✅	2s	4s	-50%
`mlk_scalar_decompress_d5`	✅	2s	6s	-67%
`mlk_scalar_signed_to_unsigned_q`	✅	2s	1s	+100%
`mlk_sha3_256`	✅	2s	3s	-33%
`mlk_shake128x4_absorb_once`	✅	2s	2s	+0%
`mlk_value_barrier_i32`	✅	2s	3s	-33%
`ntt_native_aarch64`	✅	2s	2s	+0%
`poly_compress_d10_native_x86_64`	✅	2s	2s	+0%
`poly_decompress_d10_native_x86_64`	✅	2s	3s	-33%
`poly_invntt_tomont_native`	✅	2s	1s	+100%
`polyvec_basemul_acc_montgomery_cached_k2_native_aarch64`	✅	2s	1s	+100%
`polyvec_basemul_acc_montgomery_cached_k3_native_x86_64`	✅	2s	3s	-33%
`polyvec_basemul_acc_montgomery_cached_k4_native_x86_64`	✅	2s	2s	+0%
`keccakf1600x4_extract_bytes_native`	✅	1s	2s	-50%
`mlk_ct_cmask_nonzero_u8`	✅	1s	4s	-75%
`mlk_ct_cmov_zero`	✅	1s	2s	-50%
`mlk_ct_get_optblocker_u32`	✅	1s	1s	+0%
`mlk_keccakf1600_permute`	✅	1s	4s	-75%
`mlk_keccakf1600x4_extract_bytes`	✅	1s	4s	-75%
`mlk_keccakf1600x4_xor_bytes`	✅	1s	2s	-50%
`mlk_keccakf1600x4_xor_bytes_c`	✅	1s	3s	-67%
`mlk_poly_decompress_d10_c`	✅	1s	2s	-50%
`mlk_poly_decompress_d4_native`	✅	1s	2s	-50%
`mlk_poly_decompress_d5`	✅	1s	1s	+0%
`mlk_poly_getnoise_eta1_4x_native`	✅	1s	8s	-88%
`mlk_poly_invntt_tomont`	✅	1s	2s	-50%
`mlk_poly_mulcache_compute`	✅	1s	3s	-67%
`mlk_poly_ntt_c`	✅	1s	4s	-75%
`mlk_poly_tobytes`	✅	1s	1s	+0%
`mlk_poly_tobytes_native`	✅	1s	2s	-50%
`mlk_scalar_compress_d11`	✅	1s	3s	-67%
`mlk_scalar_compress_d4`	✅	1s	1s	+0%
`mlk_scalar_decompress_d11`	✅	1s	2s	-50%
`mlk_sha3_512`	✅	1s	3s	-67%
`mlk_shake128_absorb_once`	✅	1s	2s	-50%
`mlk_shake128x4_squeezeblocks`	✅	1s	1s	+0%
`mlk_value_barrier_u8`	✅	1s	3s	-67%
`poly_compress_d4_native_x86_64`	✅	1s	3s	-67%
`poly_getnoise_eta1122_4x_native`	✅	1s	2s	-50%
`poly_reduce_native_x86_64`	✅	1s	1s	+0%
`poly_tobytes_native_aarch64`	✅	1s	3s	-67%
`poly_tobytes_native_x86_64`	✅	1s	4s	-75%
`poly_tomont_native_x86_64`	✅	1s	3s	-67%
`polyvec_basemul_acc_montgomery_cached_k3_native_aarch64`	✅	1s	2s	-50%
`sys_check_capability`	✅	1s	2s	-50%

oqs-bot · 2026-07-22T15:14:22Z

CBMC Results (ML-KEM-512)

Full Results (191 proofs)

Proof	Status	Current	Previous	Change
`TOTAL`	✅	1916s	1739s	+10.2%
`mlk_indcpa_enc`	✅	272s	271s	+0%
`mlk_indcpa_keypair_derand`	✅	243s	241s	+1%
`mlk_poly_rej_uniform`	✅	192s	177s	+8%
`mlk_rej_uniform_c`	✅	172s	139s	+24%
`rej_uniform_native_x86_64`	✅	67s	72s	-7%
`mlk_polyvec_basemul_acc_montgomery_cached_c`	✅	63s	57s	+11%
`rej_uniform_native_aarch64`	✅	56s	48s	+17%
`poly_ntt_native`	✅	51s	42s	+21%
`mlk_ntt_layer`	✅	49s	33s	+48%
`mlk_poly_reduce_native`	✅	49s	40s	+23%
`mlk_keccak_squeezeblocks_x4`	✅	32s	27s	+19%
`mlk_fqmul`	✅	24s	17s	+41%
`keccakf1600x4_permute_native_x4`	✅	22s	16s	+38%
`mlk_poly_decompress_d4_native`	✅	20s	15s	+33%
`mlk_poly_decompress_d10_native`	✅	19s	14s	+36%
`mlk_indcpa_dec`	✅	17s	17s	+0%
`mlk_poly_frommsg`	✅	14s	14s	+0%
`mlk_keccak_squeezeblocks`	✅	11s	8s	+38%
`mlk_ntt_butterfly_block`	✅	11s	9s	+22%
`mlk_polyvec_add`	✅	11s	12s	-8%
`mlk_poly_frombytes_native`	✅	10s	8s	+25%
`mlk_poly_ntt`	✅	10s	6s	+67%
`poly_frombytes_native_x86_64`	✅	9s	4s	+125%
`mlk_keccak_squeeze_once`	✅	8s	9s	-11%
`mlk_poly_rej_uniform_x4`	✅	8s	7s	+14%
`polyvec_basemul_acc_montgomery_cached_native`	✅	8s	8s	+0%
`mlk_invntt_layer`	✅	7s	6s	+17%
`mlk_poly_add`	✅	7s	5s	+40%
`mlk_poly_sub`	✅	7s	6s	+17%
`kem_dec`	✅	6s	3s	+100%
`mlk_keccak_absorb_once`	✅	6s	4s	+50%
`mlk_keccak_absorb_once_x4`	✅	6s	5s	+20%
`poly_decompress_d4_native_x86_64`	✅	6s	4s	+50%
`intt_native_x86_64`	✅	5s	2s	+150%
`keccak_f1600_x4_native_aarch64_v8a_scalar_hybrid`	✅	5s	3s	+67%
`mlk_gen_matrix`	✅	5s	3s	+67%
`mlk_keccakf1600_permute_c`	✅	5s	7s	-29%
`mlk_shake256x4`	✅	5s	6s	-17%
`poly_decompress_d10_native_x86_64`	✅	5s	5s	+0%
`poly_decompress_d5_native_x86_64`	✅	5s	2s	+150%
`keccak_f1600_x4_native_aarch64_v8a_v84a_scalar_hybrid`	✅	4s	2s	+100%
`kem_check_sk`	✅	4s	2s	+100%
`mlk_ct_cmask_neg_i16`	✅	4s	3s	+33%
`mlk_montgomery_reduce`	✅	4s	3s	+33%
`mlk_poly_compress_d10_c`	✅	4s	4s	+0%
`mlk_poly_compress_d11_native`	✅	4s	3s	+33%
`mlk_poly_compress_d4_native`	✅	4s	3s	+33%
`mlk_poly_decompress_d4_c`	✅	4s	4s	+0%
`mlk_poly_frombytes_c`	✅	4s	4s	+0%
`mlk_poly_getnoise_eta1_4x`	✅	4s	6s	-33%
`mlk_poly_getnoise_eta2`	✅	4s	1s	+300%
`mlk_poly_tobytes`	✅	4s	2s	+100%
`mlk_poly_tomont`	✅	4s	1s	+300%
`mlk_poly_tomsg`	✅	4s	3s	+33%
`mlk_polyvec_basemul_acc_montgomery_cached`	✅	4s	3s	+33%
`mlk_polyvec_decompress_du`	✅	4s	4s	+0%
`mlk_scalar_compress_d11`	✅	4s	3s	+33%
`mlk_scalar_decompress_d10`	✅	4s	5s	-20%
`mlk_value_barrier_i32`	✅	4s	1s	+300%
`poly_mulcache_compute_native_aarch64`	✅	4s	3s	+33%
`poly_mulcache_compute_native_x86_64`	✅	4s	2s	+100%
`poly_reduce_native_aarch64`	✅	4s	1s	+300%
`poly_tobytes_native_aarch64`	✅	4s	2s	+100%
`polyvec_basemul_acc_montgomery_cached_k2_native_aarch64`	✅	4s	2s	+100%
`polyvec_basemul_acc_montgomery_cached_k3_native_x86_64`	✅	4s	3s	+33%
`intt_native_aarch64`	✅	3s	4s	-25%
`keccak_f1600_x1_native_aarch64`	✅	3s	2s	+50%
`keccakf1600x4_xor_bytes_native`	✅	3s	2s	+50%
`kem_check_pk`	✅	3s	2s	+50%
`kem_enc`	✅	3s	3s	+0%
`kem_enc_derand`	✅	3s	2s	+50%
`mlk_barrett_reduce`	✅	3s	3s	+0%
`mlk_check_pct`	✅	3s	6s	-50%
`mlk_ct_get_optblocker_u32`	✅	3s	1s	+200%
`mlk_ct_memcmp`	✅	3s	2s	+50%
`mlk_ct_sel_int16`	✅	3s	2s	+50%
`mlk_ct_sel_uint8`	✅	3s	1s	+200%
`mlk_keccakf1600x4_extract_bytes_c`	✅	3s	2s	+50%
`mlk_keccakf1600x4_xor_bytes`	✅	3s	2s	+50%
`mlk_matvec_mul`	✅	3s	4s	-25%
`mlk_poly_cbd_eta1`	✅	3s	3s	+0%
`mlk_poly_cbd_eta2`	✅	3s	4s	-25%
`mlk_poly_compress_d10`	✅	3s	2s	+50%
`mlk_poly_compress_d4`	✅	3s	2s	+50%
`mlk_poly_compress_d4_c`	✅	3s	2s	+50%
`mlk_poly_compress_du`	✅	3s	2s	+50%
`mlk_poly_compress_dv`	✅	3s	1s	+200%
`mlk_poly_decompress_d10`	✅	3s	2s	+50%
`mlk_poly_decompress_d10_c`	✅	3s	4s	-25%
`mlk_poly_decompress_d11`	✅	3s	1s	+200%
`mlk_poly_decompress_d5`	✅	3s	2s	+50%
`mlk_poly_decompress_d5_native`	✅	3s	3s	+0%
`mlk_poly_frombytes`	✅	3s	2s	+50%
`mlk_poly_getnoise_eta1122_4x`	✅	3s	2s	+50%
`mlk_poly_getnoise_eta1_4x_native`	✅	3s	3s	+0%
`mlk_poly_mulcache_compute_c`	✅	3s	3s	+0%
`mlk_poly_ntt_c`	✅	3s	2s	+50%
`mlk_poly_reduce_c`	✅	3s	3s	+0%
`mlk_poly_tomont_c`	✅	3s	1s	+200%
`mlk_poly_tomont_native`	✅	3s	2s	+50%
`mlk_polymat_permute_bitrev_to_custom`	✅	3s	3s	+0%
`mlk_polyvec_compress_du`	✅	3s	2s	+50%
`mlk_polyvec_mulcache_compute`	✅	3s	2s	+50%
`mlk_polyvec_ntt`	✅	3s	1s	+200%
`mlk_polyvec_permute_bitrev_to_custom`	✅	3s	2s	+50%
`mlk_polyvec_permute_bitrev_to_custom_native`	✅	3s	2s	+50%
`mlk_polyvec_reduce`	✅	3s	3s	+0%
`mlk_scalar_compress_d5`	✅	3s	2s	+50%
`mlk_scalar_decompress_d4`	✅	3s	1s	+200%
`mlk_scalar_decompress_d5`	✅	3s	1s	+200%
`mlk_shake128x4_absorb_once`	✅	3s	2s	+50%
`mlk_shake128x4_squeezeblocks`	✅	3s	2s	+50%
`mlk_value_barrier_u8`	✅	3s	2s	+50%
`poly_compress_d10_native_x86_64`	✅	3s	2s	+50%
`poly_compress_d11_native_x86_64`	✅	3s	1s	+200%
`poly_compress_d5_native_x86_64`	✅	3s	2s	+50%
`poly_invntt_tomont_native`	✅	3s	1s	+200%
`poly_tobytes_native_x86_64`	✅	3s	1s	+200%
`poly_tomont_native_aarch64`	✅	3s	4s	-25%
`polyvec_basemul_acc_montgomery_cached_k2_native_x86_64`	✅	3s	3s	+0%
`polyvec_basemul_acc_montgomery_cached_k3_native_aarch64`	✅	3s	3s	+0%
`polyvec_basemul_acc_montgomery_cached_k4_native_x86_64`	✅	3s	4s	-25%
`keccak_f1600_x1_native_aarch64_v84a`	✅	2s	2s	+0%
`keccakf1600_permute_native`	✅	2s	1s	+100%
`kem_keypair`	✅	2s	3s	-33%
`kem_keypair_derand`	✅	2s	3s	-33%
`mlk_ct_cmask_nonzero_u16`	✅	2s	2s	+0%
`mlk_ct_cmov_zero`	✅	2s	2s	+0%
`mlk_enc_getnoise_eta1_eta2`	✅	2s	4s	-50%
`mlk_gen_matrix_serial`	✅	2s	4s	-50%
`mlk_keccakf1600_extract_bytes`	✅	2s	2s	+0%
`mlk_keccakf1600_extract_bytes (big endian)`	✅	2s	5s	-60%
`mlk_keccakf1600_xor_bytes`	✅	2s	2s	+0%
`mlk_keccakf1600_xor_bytes (big endian)`	✅	2s	2s	+0%
`mlk_keccakf1600x4_extract_bytes`	✅	2s	4s	-50%
`mlk_keypair_getnoise_eta1`	✅	2s	2s	+0%
`mlk_poly_compress_d11`	✅	2s	3s	-33%
`mlk_poly_compress_d11_c`	✅	2s	4s	-50%
`mlk_poly_compress_d5`	✅	2s	1s	+100%
`mlk_poly_compress_d5_c`	✅	2s	1s	+100%
`mlk_poly_decompress_d11_c`	✅	2s	3s	-33%
`mlk_poly_decompress_d5_c`	✅	2s	2s	+0%
`mlk_poly_decompress_du`	✅	2s	3s	-33%
`mlk_poly_decompress_dv`	✅	2s	1s	+100%
`mlk_poly_mulcache_compute`	✅	2s	3s	-33%
`mlk_poly_mulcache_compute_native`	✅	2s	1s	+100%
`mlk_poly_reduce`	✅	2s	2s	+0%
`mlk_poly_tobytes_c`	✅	2s	4s	-50%
`mlk_poly_tobytes_native`	✅	2s	2s	+0%
`mlk_polyvec_frombytes`	✅	2s	1s	+100%
`mlk_polyvec_invntt_tomont`	✅	2s	2s	+0%
`mlk_polyvec_tomont`	✅	2s	2s	+0%
`mlk_rej_uniform`	✅	2s	1s	+100%
`mlk_scalar_compress_d1`	✅	2s	2s	+0%
`mlk_scalar_compress_d4`	✅	2s	4s	-50%
`mlk_sha3_512`	✅	2s	2s	+0%
`mlk_shake128_absorb_once`	✅	2s	2s	+0%
`mlk_shake128_squeezeblocks`	✅	2s	3s	-33%
`mlk_shake256`	✅	2s	3s	-33%
`ntt_native_aarch64`	✅	2s	2s	+0%
`ntt_native_x86_64`	✅	2s	3s	-33%
`nttunpack_native_x86_64`	✅	2s	3s	-33%
`poly_compress_d4_native_x86_64`	✅	2s	3s	-33%
`poly_decompress_d11_native_x86_64`	✅	2s	3s	-33%
`poly_getnoise_eta1122_4x_native`	✅	2s	2s	+0%
`poly_reduce_native_x86_64`	✅	2s	3s	-33%
`poly_tomont_native_x86_64`	✅	2s	4s	-50%
`polyvec_basemul_acc_montgomery_cached_k4_native_aarch64`	✅	2s	2s	+0%
`rej_uniform_native`	✅	2s	2s	+0%
`sys_check_capability`	✅	2s	3s	-33%
`keccak_f1600_x4_native_aarch64_v84a`	✅	1s	1s	+0%
`keccak_f1600_x4_native_avx2`	✅	1s	2s	-50%
`keccakf1600x4_extract_bytes_native`	✅	1s	2s	-50%
`mlk_ct_cmask_nonzero_u8`	✅	1s	3s	-67%
`mlk_ct_get_optblocker_i32`	✅	1s	1s	+0%
`mlk_ct_get_optblocker_u8`	✅	1s	6s	-83%
`mlk_keccakf1600_permute`	✅	1s	2s	-50%
`mlk_keccakf1600x4_permute`	✅	1s	2s	-50%
`mlk_keccakf1600x4_xor_bytes_c`	✅	1s	2s	-50%
`mlk_poly_compress_d10_native`	✅	1s	2s	-50%
`mlk_poly_compress_d5_native`	✅	1s	2s	-50%
`mlk_poly_decompress_d11_native`	✅	1s	3s	-67%
`mlk_poly_decompress_d4`	✅	1s	1s	+0%
`mlk_poly_invntt_tomont`	✅	1s	3s	-67%
`mlk_poly_invntt_tomont_c`	✅	1s	2s	-50%
`mlk_polyvec_tobytes`	✅	1s	2s	-50%
`mlk_scalar_compress_d10`	✅	1s	2s	-50%
`mlk_scalar_decompress_d11`	✅	1s	1s	+0%
`mlk_scalar_signed_to_unsigned_q`	✅	1s	3s	-67%
`mlk_sha3_256`	✅	1s	2s	-50%
`mlk_value_barrier_u32`	✅	1s	3s	-67%

oqs-bot · 2026-07-22T15:17:36Z

CBMC Results (ML-KEM-768)

Full Results (191 proofs)

Proof	Status	Current	Previous	Change
`TOTAL`	✅	1642s	1809s	-9.2%
`mlk_indcpa_keypair_derand`	✅	310s	327s	-5%
`mlk_indcpa_enc`	✅	247s	260s	-5%
`mlk_poly_rej_uniform`	✅	133s	153s	-13%
`mlk_rej_uniform_c`	✅	112s	136s	-18%
`rej_uniform_native_x86_64`	✅	56s	62s	-10%
`mlk_polyvec_basemul_acc_montgomery_cached_c`	✅	46s	54s	-15%
`rej_uniform_native_aarch64`	✅	45s	50s	-10%
`poly_ntt_native`	✅	38s	44s	-14%
`mlk_poly_reduce_native`	✅	34s	38s	-11%
`mlk_ntt_layer`	✅	32s	37s	-14%
`mlk_keccak_squeezeblocks_x4`	✅	26s	26s	+0%
`keccakf1600x4_permute_native_x4`	✅	17s	15s	+13%
`mlk_fqmul`	✅	16s	15s	+7%
`polyvec_basemul_acc_montgomery_cached_native`	✅	16s	17s	-6%
`mlk_poly_decompress_d4_native`	✅	14s	14s	+0%
`mlk_poly_decompress_d10_native`	✅	12s	14s	-14%
`mlk_indcpa_dec`	✅	11s	12s	-8%
`mlk_polyvec_add`	✅	10s	13s	-23%
`mlk_poly_frombytes_native`	✅	9s	8s	+12%
`mlk_poly_frommsg`	✅	9s	14s	-36%
`mlk_keccak_absorb_once_x4`	✅	8s	6s	+33%
`mlk_keccak_squeeze_once`	✅	8s	9s	-11%
`mlk_keccakf1600_permute_c`	✅	8s	5s	+60%
`mlk_keccak_squeezeblocks`	✅	7s	9s	-22%
`mlk_poly_sub`	✅	7s	6s	+17%
`mlk_ntt_butterfly_block`	✅	6s	8s	-25%
`mlk_poly_add`	✅	6s	7s	-14%
`mlk_scalar_compress_d4`	✅	6s	5s	+20%
`mlk_gen_matrix_serial`	✅	5s	4s	+25%
`mlk_poly_decompress_d4_c`	✅	5s	3s	+67%
`mlk_poly_frombytes_c`	✅	5s	5s	+0%
`mlk_poly_ntt`	✅	5s	8s	-38%
`mlk_scalar_decompress_d11`	✅	5s	3s	+67%
`mlk_shake256x4`	✅	5s	4s	+25%
`poly_decompress_d10_native_x86_64`	✅	5s	5s	+0%
`poly_frombytes_native_x86_64`	✅	5s	6s	-17%
`mlk_invntt_layer`	✅	4s	6s	-33%
`mlk_keccak_absorb_once`	✅	4s	4s	+0%
`mlk_keccakf1600_permute`	✅	4s	2s	+100%
`mlk_montgomery_reduce`	✅	4s	3s	+33%
`mlk_poly_cbd_eta2`	✅	4s	1s	+300%
`mlk_poly_compress_d10_native`	✅	4s	3s	+33%
`mlk_poly_compress_d11_native`	✅	4s	2s	+100%
`mlk_poly_decompress_dv`	✅	4s	4s	+0%
`mlk_poly_rej_uniform_x4`	✅	4s	5s	-20%
`mlk_polyvec_compress_du`	✅	4s	2s	+100%
`mlk_polyvec_tobytes`	✅	4s	3s	+33%
`mlk_scalar_decompress_d4`	✅	4s	2s	+100%
`mlk_value_barrier_i32`	✅	4s	3s	+33%
`poly_getnoise_eta1122_4x_native`	✅	4s	4s	+0%
`poly_tomont_native_x86_64`	✅	4s	4s	+0%
`polyvec_basemul_acc_montgomery_cached_k2_native_x86_64`	✅	4s	3s	+33%
`polyvec_basemul_acc_montgomery_cached_k4_native_x86_64`	✅	4s	5s	-20%
`keccakf1600x4_xor_bytes_native`	✅	3s	2s	+50%
`kem_check_pk`	✅	3s	3s	+0%
`kem_dec`	✅	3s	6s	-50%
`kem_enc`	✅	3s	3s	+0%
`kem_keypair_derand`	✅	3s	3s	+0%
`mlk_ct_cmask_neg_i16`	✅	3s	2s	+50%
`mlk_ct_cmov_zero`	✅	3s	2s	+50%
`mlk_enc_getnoise_eta1_eta2`	✅	3s	3s	+0%
`mlk_gen_matrix`	✅	3s	2s	+50%
`mlk_keccakf1600x4_xor_bytes`	✅	3s	1s	+200%
`mlk_keypair_getnoise_eta1`	✅	3s	4s	-25%
`mlk_matvec_mul`	✅	3s	1s	+200%
`mlk_poly_cbd_eta1`	✅	3s	4s	-25%
`mlk_poly_compress_d10_c`	✅	3s	2s	+50%
`mlk_poly_compress_d11_c`	✅	3s	2s	+50%
`mlk_poly_compress_d4`	✅	3s	3s	+0%
`mlk_poly_compress_d5_c`	✅	3s	2s	+50%
`mlk_poly_compress_du`	✅	3s	2s	+50%
`mlk_poly_decompress_d11_native`	✅	3s	3s	+0%
`mlk_poly_decompress_d5`	✅	3s	3s	+0%
`mlk_poly_decompress_d5_native`	✅	3s	2s	+50%
`mlk_poly_getnoise_eta1_4x`	✅	3s	3s	+0%
`mlk_poly_getnoise_eta1_4x_native`	✅	3s	2s	+50%
`mlk_poly_invntt_tomont_c`	✅	3s	6s	-50%
`mlk_poly_tomont`	✅	3s	3s	+0%
`mlk_polyvec_decompress_du`	✅	3s	3s	+0%
`mlk_polyvec_invntt_tomont`	✅	3s	2s	+50%
`mlk_polyvec_permute_bitrev_to_custom`	✅	3s	4s	-25%
`mlk_polyvec_permute_bitrev_to_custom_native`	✅	3s	5s	-40%
`mlk_scalar_compress_d1`	✅	3s	4s	-25%
`mlk_shake128_absorb_once`	✅	3s	2s	+50%
`mlk_shake128x4_absorb_once`	✅	3s	2s	+50%
`mlk_shake256`	✅	3s	2s	+50%
`mlk_value_barrier_u32`	✅	3s	3s	+0%
`mlk_value_barrier_u8`	✅	3s	5s	-40%
`ntt_native_x86_64`	✅	3s	4s	-25%
`poly_compress_d10_native_x86_64`	✅	3s	1s	+200%
`poly_decompress_d4_native_x86_64`	✅	3s	4s	-25%
`poly_mulcache_compute_native_aarch64`	✅	3s	3s	+0%
`poly_mulcache_compute_native_x86_64`	✅	3s	3s	+0%
`poly_reduce_native_x86_64`	✅	3s	2s	+50%
`poly_tobytes_native_aarch64`	✅	3s	2s	+50%
`intt_native_aarch64`	✅	2s	3s	-33%
`keccak_f1600_x1_native_aarch64_v84a`	✅	2s	3s	-33%
`keccak_f1600_x4_native_aarch64_v84a`	✅	2s	2s	+0%
`keccak_f1600_x4_native_aarch64_v8a_scalar_hybrid`	✅	2s	3s	-33%
`keccak_f1600_x4_native_aarch64_v8a_v84a_scalar_hybrid`	✅	2s	3s	-33%
`keccak_f1600_x4_native_avx2`	✅	2s	3s	-33%
`keccakf1600_permute_native`	✅	2s	3s	-33%
`keccakf1600x4_extract_bytes_native`	✅	2s	2s	+0%
`kem_check_sk`	✅	2s	5s	-60%
`kem_keypair`	✅	2s	2s	+0%
`mlk_ct_cmask_nonzero_u16`	✅	2s	3s	-33%
`mlk_ct_get_optblocker_u32`	✅	2s	1s	+100%
`mlk_ct_get_optblocker_u8`	✅	2s	2s	+0%
`mlk_ct_memcmp`	✅	2s	4s	-50%
`mlk_ct_sel_int16`	✅	2s	2s	+0%
`mlk_keccakf1600_extract_bytes (big endian)`	✅	2s	2s	+0%
`mlk_keccakf1600_xor_bytes (big endian)`	✅	2s	2s	+0%
`mlk_keccakf1600x4_extract_bytes`	✅	2s	3s	-33%
`mlk_keccakf1600x4_xor_bytes_c`	✅	2s	1s	+100%
`mlk_poly_compress_d4_native`	✅	2s	3s	-33%
`mlk_poly_compress_d5`	✅	2s	2s	+0%
`mlk_poly_compress_dv`	✅	2s	2s	+0%
`mlk_poly_decompress_d10_c`	✅	2s	5s	-60%
`mlk_poly_decompress_d11_c`	✅	2s	4s	-50%
`mlk_poly_decompress_d4`	✅	2s	2s	+0%
`mlk_poly_decompress_d5_c`	✅	2s	1s	+100%
`mlk_poly_frombytes`	✅	2s	3s	-33%
`mlk_poly_invntt_tomont`	✅	2s	2s	+0%
`mlk_poly_mulcache_compute`	✅	2s	2s	+0%
`mlk_poly_mulcache_compute_c`	✅	2s	1s	+100%
`mlk_poly_mulcache_compute_native`	✅	2s	2s	+0%
`mlk_poly_ntt_c`	✅	2s	2s	+0%
`mlk_poly_reduce`	✅	2s	2s	+0%
`mlk_poly_tobytes`	✅	2s	3s	-33%
`mlk_poly_tobytes_c`	✅	2s	2s	+0%
`mlk_poly_tomont_native`	✅	2s	2s	+0%
`mlk_poly_tomsg`	✅	2s	1s	+100%
`mlk_polymat_permute_bitrev_to_custom`	✅	2s	5s	-60%
`mlk_polyvec_basemul_acc_montgomery_cached`	✅	2s	2s	+0%
`mlk_polyvec_frombytes`	✅	2s	1s	+100%
`mlk_polyvec_mulcache_compute`	✅	2s	2s	+0%
`mlk_polyvec_reduce`	✅	2s	3s	-33%
`mlk_polyvec_tomont`	✅	2s	2s	+0%
`mlk_rej_uniform`	✅	2s	5s	-60%
`mlk_scalar_compress_d5`	✅	2s	1s	+100%
`mlk_scalar_decompress_d10`	✅	2s	3s	-33%
`mlk_scalar_decompress_d5`	✅	2s	2s	+0%
`mlk_scalar_signed_to_unsigned_q`	✅	2s	2s	+0%
`mlk_sha3_256`	✅	2s	2s	+0%
`mlk_shake128_squeezeblocks`	✅	2s	1s	+100%
`mlk_shake128x4_squeezeblocks`	✅	2s	2s	+0%
`ntt_native_aarch64`	✅	2s	1s	+100%
`nttunpack_native_x86_64`	✅	2s	2s	+0%
`poly_compress_d11_native_x86_64`	✅	2s	5s	-60%
`poly_compress_d4_native_x86_64`	✅	2s	4s	-50%
`poly_compress_d5_native_x86_64`	✅	2s	2s	+0%
`poly_decompress_d5_native_x86_64`	✅	2s	2s	+0%
`poly_tobytes_native_x86_64`	✅	2s	4s	-50%
`poly_tomont_native_aarch64`	✅	2s	2s	+0%
`polyvec_basemul_acc_montgomery_cached_k3_native_aarch64`	✅	2s	2s	+0%
`polyvec_basemul_acc_montgomery_cached_k4_native_aarch64`	✅	2s	1s	+100%
`rej_uniform_native`	✅	2s	3s	-33%
`sys_check_capability`	✅	2s	1s	+100%
`intt_native_x86_64`	✅	1s	2s	-50%
`keccak_f1600_x1_native_aarch64`	✅	1s	3s	-67%
`kem_enc_derand`	✅	1s	1s	+0%
`mlk_barrett_reduce`	✅	1s	3s	-67%
`mlk_check_pct`	✅	1s	1s	+0%
`mlk_ct_cmask_nonzero_u8`	✅	1s	4s	-75%
`mlk_ct_get_optblocker_i32`	✅	1s	2s	-50%
`mlk_ct_sel_uint8`	✅	1s	1s	+0%
`mlk_keccakf1600_extract_bytes`	✅	1s	2s	-50%
`mlk_keccakf1600_xor_bytes`	✅	1s	3s	-67%
`mlk_keccakf1600x4_extract_bytes_c`	✅	1s	3s	-67%
`mlk_keccakf1600x4_permute`	✅	1s	2s	-50%
`mlk_poly_compress_d10`	✅	1s	1s	+0%
`mlk_poly_compress_d11`	✅	1s	2s	-50%
`mlk_poly_compress_d4_c`	✅	1s	5s	-80%
`mlk_poly_compress_d5_native`	✅	1s	3s	-67%
`mlk_poly_decompress_d10`	✅	1s	3s	-67%
`mlk_poly_decompress_d11`	✅	1s	2s	-50%
`mlk_poly_decompress_du`	✅	1s	1s	+0%
`mlk_poly_getnoise_eta1122_4x`	✅	1s	1s	+0%
`mlk_poly_getnoise_eta2`	✅	1s	3s	-67%
`mlk_poly_reduce_c`	✅	1s	2s	-50%
`mlk_poly_tobytes_native`	✅	1s	4s	-75%
`mlk_poly_tomont_c`	✅	1s	4s	-75%
`mlk_polyvec_ntt`	✅	1s	3s	-67%
`mlk_scalar_compress_d10`	✅	1s	2s	-50%
`mlk_scalar_compress_d11`	✅	1s	1s	+0%
`mlk_sha3_512`	✅	1s	3s	-67%
`poly_decompress_d11_native_x86_64`	✅	1s	3s	-67%
`poly_invntt_tomont_native`	✅	1s	2s	-50%
`poly_reduce_native_aarch64`	✅	1s	2s	-50%
`polyvec_basemul_acc_montgomery_cached_k2_native_aarch64`	✅	1s	3s	-67%
`polyvec_basemul_acc_montgomery_cached_k3_native_x86_64`	✅	1s	2s	-50%

The FIPS203-tr1 encapDecap revision adds keyFormat 'seed'/'expanded' groups: the decapsulation key may be supplied as a seed (d||z) to expand rather than as the expanded dk. Add a decode_dk() entry point to the ACVP harness accepting either dk=HEX or seed=HEX (expanding the seed via crypto_kem_keypair_derand), and route the decapsulation function through it. keyFormat is inspected per group, so the client copes whether or not a given file carries it. decode_dk is MLK_NOINLINE so its keyGen scratch stays out of main's stack frame, which under -fsanitize=undefined would otherwise overflow AVR RAM. Download and run the ML-KEM-encapDecap-FIPS203-tr1 vectors when the version ships them (v1.1.0.43+); keep the base FIPS203 dataset. Two quirks in the v1.1.0.43 sample vectors are worth recording: - decapsulationKeyCheck cases carry only a tcId with no dk, yet their expected results are a non-trivial mix of pass and fail, so they cannot be reproduced offline. The client drops decapsulationKeyCheck cases that lack a key, from prompt and expected alike; they run normally again once a key is present. This is a known upstream sample bug (usnistgov/ACVP-Server#459), where the maintainers confirm keyFormat there should be 'expanded' with the dk provided. - The base ML-KEM-encapDecap-FIPS203 file also gained keyFormat at v1.1.0.43, whereas for ML-DSA only the -tr1 revision carries it. This looks like an unintended regeneration of the base file; the per-group handling above keeps the client correct whether or not it is fixed. Bump the default ACVP version to v1.1.0.43 and roll the CI matrix forward to the three latest revisions. Signed-off-by: Matthias J. Kannwischer <matthias@zerorisc.com>

The test vectors added in the last commit lead to a stack overflow on AVR for ML-KEM-1024. This commit ports the AVR setup from mldsa-native, including its increase in RAM to nearly 64K. This fixes the AVR test, and also makes future maintenance of the AVR backend across mlkem-native and mldsa-native simpler. - nix/avr: RAMEND 0x81FF -> 0xFFFF, EEPROM E2END 0x3FFF -> 0x7FFF - platform.mk: __stack=0x81FF -> __DATA_REGION_LENGTH__=0xFC00, so .data/.bss grow up from 0x0200 with the stack set at runtime - avr_wrapper.c / init7.S / exec_wrapper.py: place the argc/argv block at the top of RAM and set SP just below it, giving the largest possible stack Keeping this identical (modulo naming) to mldsa-native lets both projects share one AVR baremetal harness, so fixes port across as a prefix diff. Signed-off-by: Hanno Becker <beckphan@amazon.co.uk>

hanno-becker · 2026-07-27T04:19:44Z

+
+    Some ML-KEM sample vectors omit dk for these cases; the check cannot run
+    without a key. Removed from prompt and expected so the comparison stays
+    consistent, and runs normally once a key is present.


We should open an issue to remove this once upstream is fixed

hanno-becker · 2026-07-27T04:23:19Z

+  {
+    unsigned char ek[CRYPTO_PUBLICKEYBYTES];
+    unsigned char coins[2 * MLKEM_SYMBYTES];
+    if (decode_hex("seed", coins, sizeof(coins), arg) != 0)


NB: We should align this with mldsa-native, where decode_hex operates in-place.

hanno-becker · 2026-07-27T04:25:06Z

+    {
+      return 1;
+    }
+    if (crypto_kem_keypair_derand(ek, dk, coins) != 0)


This relates to pq-code-package/mldsa-native#1272. It would be nice to avoid the unused ek buffer here.

mkannwischer force-pushed the acvp-fips203-tr1 branch from 600407e to c64f565 Compare July 25, 2026 13:03

mkannwischer and others added 2 commits July 27, 2026 01:32

mkannwischer force-pushed the acvp-fips203-tr1 branch from c64f565 to d9f71df Compare July 26, 2026 17:32

hanno-becker reviewed Jul 27, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

ACVP: Support FIPS203-tr1 encapDecap (v1.1.0.43) - #1811

ACVP: Support FIPS203-tr1 encapDecap (v1.1.0.43)#1811
mkannwischer wants to merge 2 commits into
mainfrom
acvp-fips203-tr1

mkannwischer commented Jul 22, 2026

Uh oh!

oqs-bot commented Jul 22, 2026 •

edited

Loading

Uh oh!

oqs-bot commented Jul 22, 2026 •

edited

Loading

Uh oh!

oqs-bot commented Jul 22, 2026 •

edited

Loading

Uh oh!

hanno-becker Jul 27, 2026

Uh oh!

hanno-becker Jul 27, 2026

Uh oh!

hanno-becker Jul 27, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

mkannwischer commented Jul 22, 2026

Uh oh!

oqs-bot commented Jul 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

CBMC Results (ML-KEM-1024)

Uh oh!

oqs-bot commented Jul 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

CBMC Results (ML-KEM-512)

Uh oh!

oqs-bot commented Jul 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

CBMC Results (ML-KEM-768)

Uh oh!

hanno-becker Jul 27, 2026

Choose a reason for hiding this comment

Uh oh!

hanno-becker Jul 27, 2026

Choose a reason for hiding this comment

Uh oh!

hanno-becker Jul 27, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

oqs-bot commented Jul 22, 2026 •

edited

Loading

oqs-bot commented Jul 22, 2026 •

edited

Loading

oqs-bot commented Jul 22, 2026 •

edited

Loading