Skip to content

Support randomized Wycheproof signing vectors#1235

Merged
mkannwischer merged 1 commit into
mainfrom
ptp/wycheproof-randomized-signing-vectors-uncovered
Jul 14, 2026
Merged

Support randomized Wycheproof signing vectors#1235
mkannwischer merged 1 commit into
mainfrom
ptp/wycheproof-randomized-signing-vectors-uncovered

Conversation

@fegge

@fegge fegge commented Jun 26, 2026

Copy link
Copy Markdown
Contributor

Summary

  • Update the pinned Wycheproof commit to include randomized ML-DSA signing vectors.
  • Refresh cached vector files when the pinned commit changes.
  • Pass optional vector-provided rnd values to the local signing driver and validate malformed rnd inputs.

Validation

  • ruff format test/wycheproof/wycheproof_client.py: passed
  • ruff check test/wycheproof/wycheproof_client.py: passed
  • python3 -m py_compile test/wycheproof/wycheproof_client.py: passed
  • clang-format -i test/wycheproof/wycheproof_mldsa.c: passed
  • git diff --check -- test/wycheproof/wycheproof_client.py test/wycheproof/wycheproof_mldsa.c: passed
  • make wycheproof -j4: passed
  • make run_wycheproof -j4: passed, including refreshed randomized signing vectors such as ML-DSA-44 tcId=90
  • Direct driver probes for valid rnd and malformed rnd across sigGenSeedDeterministic, sigGenDeterministic, and sigGenInternalDeterministic: passed
  • Not run: ./scripts/format because nixpkgs-fmt is not installed in this local environment
  • Not run: ./scripts/lint because shfmt is not installed in this local environment

Fixes #1219

This work was completed by Trail of Bits as part of the Patch The Planet project in collaboration with OpenAI. The issue was identified primarily by the Codex coding agent, and manually reviewed before submission.

@fegge fegge requested a review from a team as a code owner June 26, 2026 16:30
This was referenced Jun 26, 2026
Closed
Open
@oqs-bot

oqs-bot commented Jun 26, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

CBMC Results (ML-DSA-65, REDUCE-RAM)

Full Results (206 proofs)
Proof Status Current Previous Change
**TOTAL** ✅ 1468s 1482s -0.9%
polyvec_matrix_pointwise_montgomery_yvec ✅ 205s 201s +2%
poly_pointwise_montgomery_c ✅ 129s 116s +11%
mld_invntt_layer ✅ 108s 108s +0%
fqmul ✅ 46s 40s +15%
polyvecl_chknorm ✅ 45s 43s +5%
mld_ntt_layer ✅ 43s 43s +0%
polyveck_chknorm ✅ 35s 36s -3%
sign_verify_internal ✅ 33s 71s -54%
mld_attempt_signature_generation ✅ 31s 31s +0%
keccakf1600x4_permute_native ✅ 22s 22s +0%
mld_ntt_butterfly_block ✅ 21s 25s -16%
poly_ntt_c ✅ 21s 22s -5%
rej_uniform_c ✅ 17s 16s +6%
mld_check_pct ✅ 15s 12s +25%
poly_chknorm_c ✅ 15s 13s +15%
poly_invntt_tomont_c ✅ 13s 10s +30%
polyt0_unpack ✅ 12s 13s -8%
polyveck_decompose ✅ 12s 14s -14%
poly_uniform_eta_4x ✅ 10s 13s -23%
keccak_absorb_once_x4 ✅ 9s 10s -10%
mld_keccakf1600_permute_c ✅ 9s 7s +29%
polyvec_matrix_pointwise_montgomery_row ✅ 9s 8s +12%
polyvecl_ntt ✅ 9s 7s +29%
polyz_unpack_c ✅ 9s 9s +0%
rej_uniform_native_x86_64 ✅ 9s - new
pointwise_acc_native_x86_64 ✅ 8s 5s +60%
poly_add ✅ 8s 7s +14%
rej_uniform ✅ 8s 7s +14%
compute_pack_t0_t1 ✅ 7s 7s +0%
poly_decompose_c ✅ 7s 8s -12%
polyveck_caddq ✅ 7s 7s +0%
pointwise_acc_native_aarch64 ✅ 6s 6s +0%
poly_reduce ✅ 6s 4s +50%
polyvec_matrix_expand ✅ 6s 6s +0%
polyveck_invntt_tomont ✅ 6s 7s -14%
polyveck_reduce ✅ 6s 6s +0%
sign_verify ✅ 6s 6s +0%
mld_compute_pack_z ✅ 5s 5s +0%
mld_sample_s1_s2_serial ✅ 5s 3s +67%
nttunpack_native_x86_64 ✅ 5s 3s +67%
pointwise_native_x86_64 ✅ 5s 2s +150%
poly_caddq_native_aarch64 ✅ 5s 2s +150%
poly_invntt_tomont_native ✅ 5s 5s +0%
poly_ntt ✅ 5s 2s +150%
poly_ntt_native ✅ 5s 2s +150%
poly_pointwise_montgomery ✅ 5s 2s +150%
poly_use_hint_native_aarch64 ✅ 5s 4s +25%
polyt0_pack ✅ 5s 5s +0%
polyt1_pack ✅ 5s 3s +67%
shake256_absorb ✅ 5s 4s +25%
sign_keypair ✅ 5s 4s +25%
sign_keypair_internal ✅ 5s 3s +67%
sign_signature_extmu ✅ 5s 4s +25%
sign_signature_internal ✅ 5s 6s -17%
sign_verify_pre_hash_internal ✅ 5s 5s +0%
fqscale ✅ 4s 3s +33%
keccak_absorb ✅ 4s 3s +33%
keccak_f1600_x4_native_aarch64_v8a_v84a_scalar_hybrid ✅ 4s 3s +33%
mld_ct_get_optblocker_u32 ✅ 4s 3s +33%
mld_sample_s1_s2 ✅ 4s 6s -33%
montgomery_reduce ✅ 4s 1s +300%
pack_sk_rho_key_tr_s2 ✅ 4s 2s +100%
poly_caddq ✅ 4s 3s +33%
poly_caddq_native ✅ 4s 4s +0%
poly_challenge ✅ 4s 5s -20%
poly_chknorm ✅ 4s 3s +33%
poly_chknorm_native_aarch64 ✅ 4s 2s +100%
poly_permute_bitrev_to_custom_optional_native ✅ 4s 3s +33%
poly_power2round ✅ 4s 7s -43%
poly_sub ✅ 4s 4s +0%
poly_uniform_4x ✅ 4s 4s +0%
poly_uniform_eta ✅ 4s 5s -20%
poly_uniform_gamma1 ✅ 4s 3s +33%
polyt1_unpack ✅ 4s 3s +33%
polyveck_ntt ✅ 4s 4s +0%
polyz_pack ✅ 4s 3s +33%
polyz_unpack_17_native_aarch64 ✅ 4s 2s +100%
rej_eta_c ✅ 4s 4s +0%
shake128_finalize ✅ 4s 2s +100%
sign_pk_from_sk ✅ 4s 5s -20%
sk_t0hat_get_poly ✅ 4s 1s +300%
unpack_sk_s2hat ✅ 4s 3s +33%
intt_native_aarch64 ✅ 3s 2s +50%
keccak_f1600_x1_native_aarch64 ✅ 3s 2s +50%
keccak_f1600_x4_native_aarch64_v84a ✅ 3s 2s +50%
keccak_finalize ✅ 3s 2s +50%
keccak_squeezeblocks_x4 ✅ 3s 4s -25%
keccakf1600x4_extract_bytes_native ✅ 3s 1s +200%
make_hint ✅ 3s 3s +0%
mld_ct_cmask_nonzero_u32 ✅ 3s 3s +0%
mld_ct_cmask_nonzero_u8 ✅ 3s 2s +50%
mld_ct_get_optblocker_i64 ✅ 3s 1s +200%
mld_ct_get_optblocker_u8 ✅ 3s 4s -25%
mld_keccakf1600x4_extract_bytes_c ✅ 3s 2s +50%
mld_keccakf1600x4_xor_bytes_c ✅ 3s 2s +50%
mld_polymat_expand_entry ✅ 3s 3s +0%
mld_prepare_domain_separation_prefix ✅ 3s 4s -25%
mld_value_barrier_u8 ✅ 3s 1s +200%
ntt_native_aarch64 ✅ 3s 3s +0%
ntt_native_x86_64 ✅ 3s 5s -40%
pack_sig_c ✅ 3s 3s +0%
pack_sig_z ✅ 3s 1s +200%
pointwise_native_aarch64 ✅ 3s 3s +0%
poly_caddq_c ✅ 3s 5s -40%
poly_caddq_native_x86_64 ✅ 3s 1s +200%
poly_chknorm_native ✅ 3s 4s -25%
poly_chknorm_native_x86_64 ✅ 3s 4s -25%
poly_decompose ✅ 3s 2s +50%
poly_decompose_32_native_aarch64 ✅ 3s 4s -25%
poly_decompose_native ✅ 3s 5s -40%
poly_invntt_tomont ✅ 3s 5s -40%
poly_permute_bitrev_to_custom_optional ✅ 3s 3s +0%
poly_pointwise_montgomery_native ✅ 3s 4s -25%
poly_uniform ✅ 3s 2s +50%
poly_uniform_gamma1_4x ✅ 3s 3s +0%
poly_use_hint ✅ 3s 3s +0%
poly_use_hint_c ✅ 3s 2s +50%
poly_use_hint_native ✅ 3s 7s -57%
polyeta_pack ✅ 3s 1s +200%
polyeta_unpack ✅ 3s 4s -25%
polyvec_matrix_expand_serial ✅ 3s 3s +0%
polyveck_pack_eta ✅ 3s 3s +0%
polyveck_pack_w1 ✅ 3s 4s -25%
polyvecl_pointwise_acc_montgomery ✅ 3s 3s +0%
polyw1_pack ✅ 3s 3s +0%
polyz_unpack_native ✅ 3s 3s +0%
reduce32 ✅ 3s 2s +50%
rej_eta ✅ 3s 5s -40%
rej_eta_native ✅ 3s 3s +0%
rej_uniform_eta_native_aarch64 ✅ 3s 5s -40%
rej_uniform_native ✅ 3s 4s -25%
rej_uniform_native_aarch64 ✅ 3s 5s -40%
shake128_release ✅ 3s 2s +50%
shake256 ✅ 3s 2s +50%
shake256_init ✅ 3s 4s -25%
shake256x4_absorb_once ✅ 3s 2s +50%
sign_signature ✅ 3s 5s -40%
sign_signature_pre_hash_internal ✅ 3s 3s +0%
sign_signature_pre_hash_shake256 ✅ 3s 7s -57%
sign_verify_extmu ✅ 3s 2s +50%
sk_s1hat_get_poly ✅ 3s 3s +0%
sk_s2hat_get_poly ✅ 3s 1s +200%
sys_check_capability ✅ 3s 1s +200%
unpack_pk_t1 ✅ 3s 2s +50%
unpack_sk_s1hat ✅ 3s 1s +200%
unpack_sk_t0hat ✅ 3s 4s -25%
use_hint ✅ 3s 2s +50%
caddq ✅ 2s 2s +0%
decompose ✅ 2s 4s -50%
intt_native_x86_64 ✅ 2s 4s -50%
keccak_f1600_x1_native_aarch64_v84a ✅ 2s 2s +0%
keccak_f1600_x4_native_aarch64_v8a_scalar_hybrid ✅ 2s 3s -33%
keccak_f1600_x4_native_avx2 ✅ 2s 2s +0%
keccak_init ✅ 2s 4s -50%
keccak_squeeze ✅ 2s 2s +0%
keccakf1600_extract_bytes (big endian) ✅ 2s 3s -33%
keccakf1600_permute ✅ 2s 4s -50%
keccakf1600_xor_bytes ✅ 2s 4s -50%
keccakf1600x4_extract_bytes ✅ 2s 4s -50%
keccakf1600x4_xor_bytes ✅ 2s 2s +0%
keccakf1600x4_xor_bytes_native ✅ 2s 2s +0%
mld_ct_memcmp ✅ 2s 4s -50%
mld_ct_sel_int32 ✅ 2s 2s +0%
mld_h ✅ 2s 3s -33%
mld_keccakf1600_extract_bytes ✅ 2s 2s +0%
mld_value_barrier_i64 ✅ 2s 2s +0%
mld_value_barrier_u32 ✅ 2s 4s -50%
pack_sig_h ✅ 2s 2s +0%
pack_sk_s1 ✅ 2s 3s -33%
poly_decompose_88_native_aarch64 ✅ 2s 2s +0%
poly_decompose_native_x86_64 ✅ 2s 2s +0%
poly_shiftl ✅ 2s 3s -33%
poly_use_hint_native_x86_64 ✅ 2s - new
polyvecl_pack_eta ✅ 2s 2s +0%
polyvecl_pointwise_acc_montgomery_c ✅ 2s 3s -33%
polyvecl_uniform_gamma1 ✅ 2s 4s -50%
polyvecl_uniform_gamma1_serial ✅ 2s 1s +100%
polyvecl_unpack_eta ✅ 2s 2s +0%
polyvecl_unpack_z ✅ 2s 1s +100%
polyw1_pack_32 ✅ 2s 2s +0%
polyw1_pack_88 ✅ 2s 3s -33%
polyz_unpack ✅ 2s 3s -33%
polyz_unpack_native_x86_64 ✅ 2s 3s -33%
power2round ✅ 2s 2s +0%
shake128_absorb ✅ 2s 2s +0%
shake128_init ✅ 2s 6s -67%
shake128x4_absorb_once ✅ 2s 2s +0%
shake256_finalize ✅ 2s 1s +100%
shake256_release ✅ 2s 3s -33%
shake256x4_squeezeblocks ✅ 2s 2s +0%
sig_unpack_hints ✅ 2s 1s +100%
sign_verify_pre_hash_shake256 ✅ 2s 6s -67%
unpack_sk ✅ 2s 3s -33%
yvec_get_poly ✅ 2s 3s -33%
yvec_init ✅ 2s 5s -60%
keccakf1600_permute_native ✅ 1s 2s -50%
keccakf1600_xor_bytes (big endian) ✅ 1s 2s -50%
keccakf1600x4_permute ✅ 1s 1s +0%
mld_ct_abs_i32 ✅ 1s 6s -83%
mld_ct_cmask_neg_i32 ✅ 1s 3s -67%
polyveck_unpack_eta ✅ 1s 3s -67%
polyvecl_pointwise_acc_montgomery_native ✅ 1s 3s -67%
polyz_unpack_19_native_aarch64 ✅ 1s 5s -80%
shake128_squeeze ✅ 1s 3s -67%
shake128x4_squeezeblocks ✅ 1s 2s -50%
shake256_squeeze ✅ 1s 4s -75%

@oqs-bot

oqs-bot commented Jun 26, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

CBMC Results (ML-DSA-44, REDUCE-RAM)

Full Results (206 proofs)
Proof Status Current Previous Change
**TOTAL** ✅ 1381s 1364s +1.2%
polyvec_matrix_pointwise_montgomery_yvec ✅ 152s 149s +2%
poly_pointwise_montgomery_c ✅ 125s 112s +12%
mld_invntt_layer ✅ 105s 105s +0%
polyveck_chknorm ✅ 64s 67s -4%
mld_ntt_layer ✅ 42s 41s +2%
fqmul ✅ 39s 39s +0%
sign_verify_internal ✅ 29s 49s -41%
keccakf1600x4_permute_native ✅ 21s 22s -5%
mld_ntt_butterfly_block ✅ 21s 23s -9%
mld_attempt_signature_generation ✅ 19s 19s +0%
poly_ntt_c ✅ 18s 21s -14%
rej_uniform_c ✅ 16s 16s +0%
polyeta_unpack ✅ 15s 14s +7%
compute_pack_t0_t1 ✅ 14s 12s +17%
polyt0_unpack ✅ 14s 12s +17%
poly_chknorm_c ✅ 13s 11s +18%
mld_check_pct ✅ 12s 15s -20%
poly_uniform_eta_4x ✅ 12s 12s +0%
rej_uniform_native_x86_64 ✅ 11s - new
poly_invntt_tomont_c ✅ 10s 11s -9%
polyvec_matrix_pointwise_montgomery_row ✅ 10s 6s +67%
polyvecl_chknorm ✅ 10s 11s -9%
keccak_absorb_once_x4 ✅ 9s 8s +12%
polyveck_decompose ✅ 9s 7s +29%
mld_compute_pack_z ✅ 7s 6s +17%
mld_keccakf1600_permute_c ✅ 7s 7s +0%
pointwise_acc_native_x86_64 ✅ 7s 4s +75%
poly_add ✅ 7s 7s +0%
poly_power2round ✅ 7s 4s +75%
polyveck_reduce ✅ 7s 4s +75%
polyz_unpack_c ✅ 7s 8s -12%
rej_uniform ✅ 7s 8s -12%
mld_h ✅ 6s 4s +50%
poly_decompose_c ✅ 6s 5s +20%
poly_permute_bitrev_to_custom_optional_native ✅ 6s 3s +100%
poly_pointwise_montgomery_native ✅ 6s 2s +200%
polyvecl_unpack_z ✅ 6s 3s +100%
rej_eta_native ✅ 6s 3s +100%
sign_keypair ✅ 6s 5s +20%
sign_signature_internal ✅ 6s 4s +50%
sign_signature_pre_hash_shake256 ✅ 6s 4s +50%
keccakf1600_xor_bytes ✅ 5s 3s +67%
mld_prepare_domain_separation_prefix ✅ 5s 3s +67%
mld_sample_s1_s2_serial ✅ 5s 4s +25%
ntt_native_aarch64 ✅ 5s 4s +25%
poly_decompose_native ✅ 5s 2s +150%
poly_shiftl ✅ 5s 4s +25%
poly_uniform ✅ 5s 3s +67%
polyveck_invntt_tomont ✅ 5s 5s +0%
polyveck_pack_eta ✅ 5s 4s +25%
polyz_unpack_native ✅ 5s 3s +67%
rej_uniform_native ✅ 5s 5s +0%
shake256_finalize ✅ 5s 2s +150%
sign_keypair_internal ✅ 5s 4s +25%
sign_pk_from_sk ✅ 5s 5s +0%
sign_verify ✅ 5s 4s +25%
sk_s2hat_get_poly ✅ 5s 5s +0%
unpack_pk_t1 ✅ 5s 3s +67%
keccak_f1600_x4_native_aarch64_v8a_v84a_scalar_hybrid ✅ 4s 3s +33%
keccak_squeezeblocks_x4 ✅ 4s 3s +33%
mld_ct_cmask_nonzero_u32 ✅ 4s 3s +33%
mld_ct_get_optblocker_u8 ✅ 4s 2s +100%
mld_polymat_expand_entry ✅ 4s 2s +100%
pack_sig_h ✅ 4s 4s +0%
pointwise_acc_native_aarch64 ✅ 4s 6s -33%
poly_caddq_c ✅ 4s 3s +33%
poly_caddq_native_x86_64 ✅ 4s 4s +0%
poly_challenge ✅ 4s 6s -33%
poly_chknorm_native_aarch64 ✅ 4s 2s +100%
poly_chknorm_native_x86_64 ✅ 4s 2s +100%
poly_decompose_32_native_aarch64 ✅ 4s 4s +0%
poly_decompose_native_x86_64 ✅ 4s 2s +100%
poly_ntt ✅ 4s 3s +33%
poly_reduce ✅ 4s 4s +0%
poly_uniform_4x ✅ 4s 3s +33%
polyt0_pack ✅ 4s 4s +0%
polyvec_matrix_expand ✅ 4s 3s +33%
polyveck_caddq ✅ 4s 3s +33%
polyvecl_uniform_gamma1 ✅ 4s 2s +100%
rej_eta ✅ 4s 5s -20%
rej_eta_c ✅ 4s 4s +0%
rej_uniform_eta_native_aarch64 ✅ 4s 3s +33%
rej_uniform_native_aarch64 ✅ 4s 3s +33%
shake256x4_absorb_once ✅ 4s 1s +300%
sig_unpack_hints ✅ 4s 2s +100%
sign_signature ✅ 4s 6s -33%
sign_signature_extmu ✅ 4s 4s +0%
sign_signature_pre_hash_internal ✅ 4s 4s +0%
sk_t0hat_get_poly ✅ 4s 1s +300%
unpack_sk_s2hat ✅ 4s 4s +0%
caddq ✅ 3s 6s -50%
decompose ✅ 3s 3s +0%
fqscale ✅ 3s 2s +50%
intt_native_aarch64 ✅ 3s 3s +0%
keccak_absorb ✅ 3s 3s +0%
keccakf1600_xor_bytes (big endian) ✅ 3s 6s -50%
keccakf1600x4_permute ✅ 3s 4s -25%
keccakf1600x4_xor_bytes ✅ 3s 3s +0%
keccakf1600x4_xor_bytes_native ✅ 3s 5s -40%
make_hint ✅ 3s 3s +0%
mld_ct_abs_i32 ✅ 3s 3s +0%
mld_ct_cmask_neg_i32 ✅ 3s 2s +50%
mld_ct_cmask_nonzero_u8 ✅ 3s 2s +50%
mld_ct_memcmp ✅ 3s 1s +200%
mld_sample_s1_s2 ✅ 3s 1s +200%
mld_value_barrier_i64 ✅ 3s 3s +0%
mld_value_barrier_u8 ✅ 3s 4s -25%
ntt_native_x86_64 ✅ 3s 3s +0%
pack_sig_c ✅ 3s 5s -40%
pack_sig_z ✅ 3s 2s +50%
pack_sk_rho_key_tr_s2 ✅ 3s 5s -40%
pack_sk_s1 ✅ 3s 3s +0%
poly_caddq_native_aarch64 ✅ 3s 3s +0%
poly_chknorm_native ✅ 3s 4s -25%
poly_ntt_native ✅ 3s 3s +0%
poly_pointwise_montgomery ✅ 3s 3s +0%
poly_sub ✅ 3s 3s +0%
poly_use_hint_c ✅ 3s 5s -40%
poly_use_hint_native ✅ 3s 3s +0%
poly_use_hint_native_aarch64 ✅ 3s 3s +0%
polyeta_pack ✅ 3s 3s +0%
polyvecl_ntt ✅ 3s 3s +0%
polyvecl_pack_eta ✅ 3s 2s +50%
polyvecl_pointwise_acc_montgomery_native ✅ 3s 3s +0%
polyvecl_uniform_gamma1_serial ✅ 3s 2s +50%
polyvecl_unpack_eta ✅ 3s 4s -25%
polyw1_pack_32 ✅ 3s 3s +0%
polyz_pack ✅ 3s 2s +50%
polyz_unpack_17_native_aarch64 ✅ 3s 2s +50%
polyz_unpack_19_native_aarch64 ✅ 3s 4s -25%
power2round ✅ 3s 2s +50%
reduce32 ✅ 3s 3s +0%
shake128_absorb ✅ 3s 3s +0%
shake256 ✅ 3s 1s +200%
shake256_init ✅ 3s 4s -25%
shake256_release ✅ 3s 1s +200%
shake256_squeeze ✅ 3s 2s +50%
shake256x4_squeezeblocks ✅ 3s 2s +50%
sign_verify_extmu ✅ 3s 5s -40%
sign_verify_pre_hash_internal ✅ 3s 5s -40%
sign_verify_pre_hash_shake256 ✅ 3s 5s -40%
sk_s1hat_get_poly ✅ 3s 2s +50%
unpack_sk_s1hat ✅ 3s 3s +0%
unpack_sk_t0hat ✅ 3s 2s +50%
yvec_init ✅ 3s 1s +200%
intt_native_x86_64 ✅ 2s 2s +0%
keccak_f1600_x1_native_aarch64 ✅ 2s 3s -33%
keccak_f1600_x4_native_aarch64_v84a ✅ 2s 3s -33%
keccak_f1600_x4_native_avx2 ✅ 2s 2s +0%
keccak_finalize ✅ 2s 2s +0%
keccak_init ✅ 2s 3s -33%
keccak_squeeze ✅ 2s 2s +0%
keccakf1600_extract_bytes (big endian) ✅ 2s 4s -50%
keccakf1600x4_extract_bytes_native ✅ 2s 4s -50%
mld_ct_get_optblocker_u32 ✅ 2s 2s +0%
mld_keccakf1600x4_xor_bytes_c ✅ 2s 4s -50%
montgomery_reduce ✅ 2s 2s +0%
pointwise_native_aarch64 ✅ 2s 2s +0%
pointwise_native_x86_64 ✅ 2s 4s -50%
poly_caddq ✅ 2s 4s -50%
poly_caddq_native ✅ 2s 3s -33%
poly_chknorm ✅ 2s 3s -33%
poly_decompose_88_native_aarch64 ✅ 2s 3s -33%
poly_invntt_tomont ✅ 2s 2s +0%
poly_invntt_tomont_native ✅ 2s 3s -33%
poly_permute_bitrev_to_custom_optional ✅ 2s 5s -60%
poly_uniform_eta ✅ 2s 2s +0%
poly_uniform_gamma1 ✅ 2s 3s -33%
poly_uniform_gamma1_4x ✅ 2s 5s -60%
poly_use_hint_native_x86_64 ✅ 2s - new
polyt1_unpack ✅ 2s 2s +0%
polyvec_matrix_expand_serial ✅ 2s 4s -50%
polyveck_ntt ✅ 2s 2s +0%
polyveck_pack_w1 ✅ 2s 3s -33%
polyvecl_pointwise_acc_montgomery ✅ 2s 3s -33%
polyvecl_pointwise_acc_montgomery_c ✅ 2s 4s -50%
polyw1_pack ✅ 2s 4s -50%
polyw1_pack_88 ✅ 2s 2s +0%
polyz_unpack ✅ 2s 3s -33%
polyz_unpack_native_x86_64 ✅ 2s 3s -33%
shake128_init ✅ 2s 2s +0%
shake128_release ✅ 2s 2s +0%
shake128x4_absorb_once ✅ 2s 2s +0%
shake128x4_squeezeblocks ✅ 2s 2s +0%
shake256_absorb ✅ 2s 2s +0%
unpack_sk ✅ 2s 3s -33%
yvec_get_poly ✅ 2s 3s -33%
keccak_f1600_x1_native_aarch64_v84a ✅ 1s 2s -50%
keccak_f1600_x4_native_aarch64_v8a_scalar_hybrid ✅ 1s 2s -50%
keccakf1600_permute ✅ 1s 2s -50%
keccakf1600_permute_native ✅ 1s 3s -67%
keccakf1600x4_extract_bytes ✅ 1s 2s -50%
mld_ct_get_optblocker_i64 ✅ 1s 4s -75%
mld_ct_sel_int32 ✅ 1s 3s -67%
mld_keccakf1600_extract_bytes ✅ 1s 2s -50%
mld_keccakf1600x4_extract_bytes_c ✅ 1s 4s -75%
mld_value_barrier_u32 ✅ 1s 1s +0%
nttunpack_native_x86_64 ✅ 1s 4s -75%
poly_decompose ✅ 1s 2s -50%
poly_use_hint ✅ 1s 2s -50%
polyt1_pack ✅ 1s 3s -67%
polyveck_unpack_eta ✅ 1s 2s -50%
shake128_finalize ✅ 1s 3s -67%
shake128_squeeze ✅ 1s 2s -50%
sys_check_capability ✅ 1s 2s -50%
use_hint ✅ 1s 2s -50%

@oqs-bot

oqs-bot commented Jun 26, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

CBMC Results (ML-DSA-87, REDUCE-RAM)

Full Results (206 proofs)
Proof Status Current Previous Change
**TOTAL** ✅ 1405s 1436s -2.2%
polyvec_matrix_pointwise_montgomery_yvec ✅ 203s 196s +4%
poly_pointwise_montgomery_c ✅ 125s 125s +0%
mld_invntt_layer ✅ 110s 111s -1%
mld_ntt_layer ✅ 42s 44s -5%
fqmul ✅ 38s 39s -3%
mld_attempt_signature_generation ✅ 33s 34s -3%
polyvecl_chknorm ✅ 32s 38s -16%
keccakf1600x4_permute_native ✅ 21s 25s -16%
mld_ntt_butterfly_block ✅ 20s 23s -13%
poly_ntt_c ✅ 20s 19s +5%
sign_verify_internal ✅ 20s 47s -57%
poly_chknorm_c ✅ 15s 13s +15%
polyeta_unpack ✅ 15s 13s +15%
rej_uniform_c ✅ 14s 18s -22%
polyt0_unpack ✅ 13s 14s -7%
mld_check_pct ✅ 12s 15s -20%
polyvec_matrix_pointwise_montgomery_row ✅ 11s 13s -15%
polyveck_decompose ✅ 11s 12s -8%
compute_pack_t0_t1 ✅ 10s 12s -17%
poly_invntt_tomont_c ✅ 10s 9s +11%
poly_uniform_eta_4x ✅ 10s 12s -17%
keccak_absorb_once_x4 ✅ 9s 8s +12%
rej_uniform_native_x86_64 ✅ 9s - new
polyveck_chknorm ✅ 8s 9s -11%
polyvecl_ntt ✅ 8s 8s +0%
rej_uniform ✅ 8s 7s +14%
mld_sample_s1_s2 ✅ 7s 8s -12%
poly_reduce ✅ 7s 4s +75%
polyveck_caddq ✅ 7s 8s -12%
polyveck_reduce ✅ 7s 6s +17%
polyz_unpack_c ✅ 7s 7s +0%
mld_h ✅ 6s 2s +200%
mld_keccakf1600_permute_c ✅ 6s 8s -25%
mld_sample_s1_s2_serial ✅ 6s 6s +0%
pointwise_acc_native_aarch64 ✅ 6s 5s +20%
pointwise_acc_native_x86_64 ✅ 6s 8s -25%
poly_add ✅ 6s 8s -25%
poly_caddq_c ✅ 6s 3s +100%
poly_decompose_c ✅ 6s 6s +0%
poly_uniform ✅ 6s 4s +50%
sign_pk_from_sk ✅ 6s 6s +0%
mld_compute_pack_z ✅ 5s 6s -17%
ntt_native_aarch64 ✅ 5s 4s +25%
poly_challenge ✅ 5s 4s +25%
poly_chknorm ✅ 5s 4s +25%
poly_ntt ✅ 5s 2s +150%
polyw1_pack_88 ✅ 5s 2s +150%
polyz_unpack_19_native_aarch64 ✅ 5s 5s +0%
sign_signature ✅ 5s 4s +25%
sign_signature_extmu ✅ 5s 4s +25%
sign_signature_internal ✅ 5s 3s +67%
fqscale ✅ 4s 1s +300%
intt_native_x86_64 ✅ 4s 4s +0%
keccak_finalize ✅ 4s 1s +300%
keccak_squeezeblocks_x4 ✅ 4s 4s +0%
keccakf1600x4_xor_bytes_native ✅ 4s 2s +100%
mld_ct_get_optblocker_u8 ✅ 4s 3s +33%
mld_ct_memcmp ✅ 4s 1s +300%
mld_keccakf1600_extract_bytes ✅ 4s 1s +300%
mld_keccakf1600x4_extract_bytes_c ✅ 4s 3s +33%
pack_sig_c ✅ 4s 2s +100%
pointwise_native_aarch64 ✅ 4s 4s +0%
poly_caddq_native ✅ 4s 3s +33%
poly_chknorm_native_aarch64 ✅ 4s 5s -20%
poly_decompose_native_x86_64 ✅ 4s 3s +33%
poly_invntt_tomont ✅ 4s 4s +0%
poly_ntt_native ✅ 4s 4s +0%
poly_permute_bitrev_to_custom_optional ✅ 4s 2s +100%
poly_power2round ✅ 4s 7s -43%
poly_shiftl ✅ 4s 4s +0%
poly_uniform_eta ✅ 4s 5s -20%
poly_use_hint_c ✅ 4s 4s +0%
polyeta_pack ✅ 4s 3s +33%
polyvec_matrix_expand_serial ✅ 4s 3s +33%
polyveck_invntt_tomont ✅ 4s 4s +0%
polyveck_pack_eta ✅ 4s 5s -20%
polyveck_unpack_eta ✅ 4s 3s +33%
polyvecl_pack_eta ✅ 4s 2s +100%
polyvecl_unpack_z ✅ 4s 3s +33%
polyw1_pack ✅ 4s 2s +100%
power2round ✅ 4s 3s +33%
reduce32 ✅ 4s 3s +33%
rej_uniform_native ✅ 4s 5s -20%
shake128_release ✅ 4s 3s +33%
shake256 ✅ 4s 3s +33%
shake256_finalize ✅ 4s 3s +33%
sig_unpack_hints ✅ 4s 4s +0%
sign_verify_extmu ✅ 4s 4s +0%
sign_verify_pre_hash_internal ✅ 4s 3s +33%
sys_check_capability ✅ 4s 2s +100%
unpack_sk_s1hat ✅ 4s 3s +33%
yvec_get_poly ✅ 4s 2s +100%
caddq ✅ 3s 3s +0%
decompose ✅ 3s 2s +50%
keccak_f1600_x4_native_aarch64_v84a ✅ 3s 1s +200%
keccak_f1600_x4_native_aarch64_v8a_v84a_scalar_hybrid ✅ 3s 2s +50%
keccak_init ✅ 3s 1s +200%
keccakf1600_permute_native ✅ 3s 3s +0%
keccakf1600x4_extract_bytes_native ✅ 3s 4s -25%
make_hint ✅ 3s 2s +50%
mld_ct_abs_i32 ✅ 3s 1s +200%
mld_ct_get_optblocker_i64 ✅ 3s 2s +50%
mld_polymat_expand_entry ✅ 3s 4s -25%
mld_prepare_domain_separation_prefix ✅ 3s 3s +0%
montgomery_reduce ✅ 3s 2s +50%
pack_sig_z ✅ 3s 3s +0%
pack_sk_rho_key_tr_s2 ✅ 3s 2s +50%
pack_sk_s1 ✅ 3s 2s +50%
pointwise_native_x86_64 ✅ 3s 5s -40%
poly_caddq_native_x86_64 ✅ 3s 3s +0%
poly_chknorm_native ✅ 3s 1s +200%
poly_chknorm_native_x86_64 ✅ 3s 2s +50%
poly_decompose ✅ 3s 2s +50%
poly_decompose_32_native_aarch64 ✅ 3s 3s +0%
poly_decompose_88_native_aarch64 ✅ 3s 2s +50%
poly_pointwise_montgomery ✅ 3s 3s +0%
poly_pointwise_montgomery_native ✅ 3s 3s +0%
poly_uniform_gamma1 ✅ 3s 3s +0%
poly_use_hint ✅ 3s 4s -25%
polyveck_ntt ✅ 3s 3s +0%
polyveck_pack_w1 ✅ 3s 3s +0%
polyvecl_pointwise_acc_montgomery_c ✅ 3s 2s +50%
polyvecl_uniform_gamma1_serial ✅ 3s 2s +50%
polyvecl_unpack_eta ✅ 3s 3s +0%
polyw1_pack_32 ✅ 3s 3s +0%
polyz_pack ✅ 3s 4s -25%
polyz_unpack ✅ 3s 3s +0%
polyz_unpack_native ✅ 3s 1s +200%
rej_eta ✅ 3s 2s +50%
rej_eta_c ✅ 3s 4s -25%
rej_eta_native ✅ 3s 4s -25%
rej_uniform_native_aarch64 ✅ 3s 3s +0%
shake128_squeeze ✅ 3s 1s +200%
shake128x4_absorb_once ✅ 3s 4s -25%
shake256_absorb ✅ 3s 3s +0%
shake256_release ✅ 3s 5s -40%
shake256_squeeze ✅ 3s 2s +50%
sign_keypair ✅ 3s 4s -25%
sign_signature_pre_hash_internal ✅ 3s 2s +50%
sign_signature_pre_hash_shake256 ✅ 3s 3s +0%
sign_verify ✅ 3s 2s +50%
sign_verify_pre_hash_shake256 ✅ 3s 7s -57%
sk_s1hat_get_poly ✅ 3s 3s +0%
sk_s2hat_get_poly ✅ 3s 2s +50%
unpack_sk_s2hat ✅ 3s 3s +0%
intt_native_aarch64 ✅ 2s 4s -50%
keccak_absorb ✅ 2s 4s -50%
keccak_f1600_x1_native_aarch64 ✅ 2s 2s +0%
keccak_f1600_x1_native_aarch64_v84a ✅ 2s 2s +0%
keccak_f1600_x4_native_aarch64_v8a_scalar_hybrid ✅ 2s 2s +0%
keccak_f1600_x4_native_avx2 ✅ 2s 3s -33%
keccak_squeeze ✅ 2s 5s -60%
keccakf1600_extract_bytes (big endian) ✅ 2s 3s -33%
keccakf1600_xor_bytes ✅ 2s 1s +100%
keccakf1600_xor_bytes (big endian) ✅ 2s 2s +0%
keccakf1600x4_extract_bytes ✅ 2s 1s +100%
keccakf1600x4_permute ✅ 2s 2s +0%
keccakf1600x4_xor_bytes ✅ 2s 1s +100%
mld_ct_cmask_neg_i32 ✅ 2s 2s +0%
mld_ct_cmask_nonzero_u32 ✅ 2s 5s -60%
mld_keccakf1600x4_xor_bytes_c ✅ 2s 1s +100%
mld_value_barrier_i64 ✅ 2s 2s +0%
mld_value_barrier_u32 ✅ 2s 3s -33%
mld_value_barrier_u8 ✅ 2s 2s +0%
nttunpack_native_x86_64 ✅ 2s 3s -33%
pack_sig_h ✅ 2s 3s -33%
poly_caddq ✅ 2s 5s -60%
poly_caddq_native_aarch64 ✅ 2s 3s -33%
poly_decompose_native ✅ 2s 2s +0%
poly_invntt_tomont_native ✅ 2s 2s +0%
poly_permute_bitrev_to_custom_optional_native ✅ 2s 3s -33%
poly_sub ✅ 2s 5s -60%
poly_uniform_4x ✅ 2s 3s -33%
poly_uniform_gamma1_4x ✅ 2s 3s -33%
poly_use_hint_native ✅ 2s 1s +100%
poly_use_hint_native_aarch64 ✅ 2s 3s -33%
poly_use_hint_native_x86_64 ✅ 2s - new
polyt0_pack ✅ 2s 3s -33%
polyt1_pack ✅ 2s 5s -60%
polyt1_unpack ✅ 2s 3s -33%
polyvec_matrix_expand ✅ 2s 3s -33%
polyvecl_pointwise_acc_montgomery ✅ 2s 2s +0%
polyvecl_uniform_gamma1 ✅ 2s 3s -33%
polyz_unpack_17_native_aarch64 ✅ 2s 4s -50%
polyz_unpack_native_x86_64 ✅ 2s 3s -33%
rej_uniform_eta_native_aarch64 ✅ 2s 3s -33%
shake128_finalize ✅ 2s 2s +0%
shake128_init ✅ 2s 2s +0%
shake128x4_squeezeblocks ✅ 2s 1s +100%
shake256x4_squeezeblocks ✅ 2s 4s -50%
sign_keypair_internal ✅ 2s 6s -67%
unpack_pk_t1 ✅ 2s 2s +0%
use_hint ✅ 2s 3s -33%
yvec_init ✅ 2s 4s -50%
keccakf1600_permute ✅ 1s 2s -50%
mld_ct_cmask_nonzero_u8 ✅ 1s 2s -50%
mld_ct_get_optblocker_u32 ✅ 1s 2s -50%
mld_ct_sel_int32 ✅ 1s 2s -50%
ntt_native_x86_64 ✅ 1s 2s -50%
polyvecl_pointwise_acc_montgomery_native ✅ 1s 2s -50%
shake128_absorb ✅ 1s 2s -50%
shake256_init ✅ 1s 3s -67%
shake256x4_absorb_once ✅ 1s 5s -80%
sk_t0hat_get_poly ✅ 1s 3s -67%
unpack_sk ✅ 1s 4s -75%
unpack_sk_t0hat ✅ 1s 4s -75%

@oqs-bot

oqs-bot commented Jun 26, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

CBMC Results (ML-DSA-65)

Full Results (206 proofs)
Proof Status Current Previous Change
**TOTAL** ✅ 1669s 1784s -6.4%
polyvecl_pointwise_acc_montgomery_c ✅ 209s 210s -0%
poly_pointwise_montgomery_c ✅ 127s 125s +2%
mld_invntt_layer ✅ 104s 109s -5%
polyvec_matrix_expand ✅ 103s 110s -6%
sign_verify_internal ✅ 67s 177s -62%
mld_attempt_signature_generation ✅ 63s 63s +0%
mld_ntt_layer ✅ 42s 41s +2%
fqmul ✅ 39s 40s -3%
polyvec_matrix_expand_serial ✅ 32s 27s +19%
sign_signature_internal ✅ 29s 55s -47%
keccakf1600x4_permute_native ✅ 22s 23s -4%
mld_ntt_butterfly_block ✅ 21s 24s -12%
polyvec_matrix_pointwise_montgomery_yvec ✅ 20s 18s +11%
poly_ntt_c ✅ 19s 19s +0%
compute_pack_t0_t1 ✅ 15s 13s +15%
polyt0_unpack ✅ 15s 16s -6%
rej_uniform_c ✅ 15s 14s +7%
poly_chknorm_c ✅ 14s 15s -7%
rej_uniform ✅ 14s 18s -22%
polyveck_decompose ✅ 13s 12s +8%
poly_uniform_4x ✅ 12s 13s -8%
poly_uniform_eta_4x ✅ 12s 14s -14%
mld_check_pct ✅ 11s 14s -21%
poly_invntt_tomont_c ✅ 11s 11s +0%
polyveck_invntt_tomont ✅ 11s 8s +38%
polyz_unpack_c ✅ 11s 13s -15%
rej_uniform_native_x86_64 ✅ 10s - new
keccak_absorb_once_x4 ✅ 9s 8s +12%
poly_add ✅ 8s 9s -11%
polyeta_unpack ✅ 8s 8s +0%
mld_compute_pack_z ✅ 7s 7s +0%
mld_keccakf1600_permute_c ✅ 7s 6s +17%
polyveck_caddq ✅ 7s 6s +17%
polyveck_ntt ✅ 7s 7s +0%
rej_uniform_eta_native_aarch64 ✅ 7s 4s +75%
keccak_f1600_x1_native_aarch64 ✅ 6s 2s +200%
pointwise_acc_native_aarch64 ✅ 6s 6s +0%
pointwise_acc_native_x86_64 ✅ 6s 8s -25%
poly_chknorm_native_x86_64 ✅ 6s 3s +100%
poly_decompose_c ✅ 6s 5s +20%
shake256 ✅ 6s 2s +200%
unpack_sk_t0hat ✅ 6s 5s +20%
fqscale ✅ 5s 3s +67%
ntt_native_aarch64 ✅ 5s 2s +150%
ntt_native_x86_64 ✅ 5s 2s +150%
pack_sig_h ✅ 5s 5s +0%
poly_challenge ✅ 5s 6s -17%
poly_chknorm_native ✅ 5s 2s +150%
poly_use_hint_c ✅ 5s 5s +0%
poly_use_hint_native ✅ 5s 2s +150%
polyt0_pack ✅ 5s 3s +67%
polyt1_unpack ✅ 5s 5s +0%
polyveck_chknorm ✅ 5s 6s -17%
polyveck_reduce ✅ 5s 4s +25%
polyveck_unpack_eta ✅ 5s 6s -17%
polyvecl_chknorm ✅ 5s 7s -29%
polyvecl_pack_eta ✅ 5s 3s +67%
rej_uniform_native ✅ 5s 4s +25%
sign_pk_from_sk ✅ 5s 6s -17%
sign_signature ✅ 5s 6s -17%
sign_signature_pre_hash_internal ✅ 5s 3s +67%
sys_check_capability ✅ 5s 4s +25%
decompose ✅ 4s 1s +300%
keccak_absorb ✅ 4s 3s +33%
keccak_f1600_x4_native_avx2 ✅ 4s 2s +100%
keccak_squeeze ✅ 4s 4s +0%
keccakf1600_permute_native ✅ 4s 3s +33%
keccakf1600_xor_bytes ✅ 4s 2s +100%
mld_ct_cmask_neg_i32 ✅ 4s 2s +100%
mld_ct_cmask_nonzero_u32 ✅ 4s 4s +0%
mld_ct_cmask_nonzero_u8 ✅ 4s 3s +33%
mld_sample_s1_s2_serial ✅ 4s 4s +0%
pack_sk_rho_key_tr_s2 ✅ 4s 2s +100%
poly_caddq_native ✅ 4s 2s +100%
poly_decompose_32_native_aarch64 ✅ 4s 3s +33%
poly_invntt_tomont ✅ 4s 3s +33%
poly_permute_bitrev_to_custom_optional ✅ 4s 2s +100%
poly_pointwise_montgomery_native ✅ 4s 3s +33%
poly_uniform ✅ 4s 4s +0%
poly_uniform_eta ✅ 4s 4s +0%
poly_uniform_gamma1 ✅ 4s 3s +33%
poly_use_hint ✅ 4s 3s +33%
poly_use_hint_native_x86_64 ✅ 4s - new
polyveck_pack_eta ✅ 4s 4s +0%
polyveck_pack_w1 ✅ 4s 3s +33%
polyvecl_ntt ✅ 4s 4s +0%
polyvecl_unpack_eta ✅ 4s 3s +33%
polyw1_pack_88 ✅ 4s 2s +100%
polyz_unpack_19_native_aarch64 ✅ 4s 3s +33%
rej_eta ✅ 4s 2s +100%
rej_eta_native ✅ 4s 3s +33%
shake128_release ✅ 4s 3s +33%
shake128_squeeze ✅ 4s 2s +100%
shake128x4_absorb_once ✅ 4s 3s +33%
shake256x4_absorb_once ✅ 4s 3s +33%
sign_signature_extmu ✅ 4s 2s +100%
sign_verify ✅ 4s 3s +33%
sign_verify_extmu ✅ 4s 3s +33%
sk_s2hat_get_poly ✅ 4s 2s +100%
sk_t0hat_get_poly ✅ 4s 2s +100%
intt_native_aarch64 ✅ 3s 3s +0%
keccak_f1600_x4_native_aarch64_v84a ✅ 3s 4s -25%
keccak_f1600_x4_native_aarch64_v8a_scalar_hybrid ✅ 3s 2s +50%
keccak_finalize ✅ 3s 2s +50%
keccak_squeezeblocks_x4 ✅ 3s 5s -40%
keccakf1600x4_extract_bytes ✅ 3s 4s -25%
keccakf1600x4_permute ✅ 3s 4s -25%
keccakf1600x4_xor_bytes_native ✅ 3s 3s +0%
make_hint ✅ 3s 2s +50%
mld_ct_abs_i32 ✅ 3s 2s +50%
mld_ct_memcmp ✅ 3s 2s +50%
mld_keccakf1600x4_extract_bytes_c ✅ 3s 3s +0%
mld_polymat_expand_entry ✅ 3s 4s -25%
mld_prepare_domain_separation_prefix ✅ 3s 2s +50%
mld_sample_s1_s2 ✅ 3s 6s -50%
mld_value_barrier_i64 ✅ 3s 2s +50%
mld_value_barrier_u32 ✅ 3s 3s +0%
nttunpack_native_x86_64 ✅ 3s 3s +0%
pack_sig_z ✅ 3s 2s +50%
poly_caddq ✅ 3s 2s +50%
poly_caddq_c ✅ 3s 2s +50%
poly_caddq_native_aarch64 ✅ 3s 2s +50%
poly_caddq_native_x86_64 ✅ 3s 3s +0%
poly_chknorm ✅ 3s 4s -25%
poly_chknorm_native_aarch64 ✅ 3s 3s +0%
poly_decompose ✅ 3s 2s +50%
poly_invntt_tomont_native ✅ 3s 2s +50%
poly_ntt ✅ 3s 2s +50%
poly_permute_bitrev_to_custom_optional_native ✅ 3s 4s -25%
poly_pointwise_montgomery ✅ 3s 3s +0%
poly_power2round ✅ 3s 4s -25%
poly_reduce ✅ 3s 3s +0%
poly_shiftl ✅ 3s 3s +0%
polyeta_pack ✅ 3s 3s +0%
polyt1_pack ✅ 3s 3s +0%
polyvecl_pointwise_acc_montgomery ✅ 3s 3s +0%
polyvecl_pointwise_acc_montgomery_native ✅ 3s 2s +50%
polyvecl_uniform_gamma1 ✅ 3s 2s +50%
polyvecl_unpack_z ✅ 3s 3s +0%
polyz_unpack_native ✅ 3s 4s -25%
sig_unpack_hints ✅ 3s 2s +50%
sign_keypair ✅ 3s 3s +0%
sign_keypair_internal ✅ 3s 5s -40%
sign_signature_pre_hash_shake256 ✅ 3s 3s +0%
sign_verify_pre_hash_internal ✅ 3s 5s -40%
sign_verify_pre_hash_shake256 ✅ 3s 5s -40%
unpack_sk ✅ 3s 3s +0%
unpack_sk_s2hat ✅ 3s 4s -25%
use_hint ✅ 3s 2s +50%
yvec_get_poly ✅ 3s 3s +0%
yvec_init ✅ 3s 3s +0%
caddq ✅ 2s 3s -33%
intt_native_x86_64 ✅ 2s 3s -33%
keccak_f1600_x1_native_aarch64_v84a ✅ 2s 3s -33%
keccak_f1600_x4_native_aarch64_v8a_v84a_scalar_hybrid ✅ 2s 2s +0%
keccak_init ✅ 2s 1s +100%
keccakf1600_extract_bytes (big endian) ✅ 2s 2s +0%
keccakf1600_permute ✅ 2s 2s +0%
keccakf1600x4_extract_bytes_native ✅ 2s 4s -50%
mld_ct_get_optblocker_i64 ✅ 2s 2s +0%
mld_ct_get_optblocker_u32 ✅ 2s 3s -33%
mld_ct_sel_int32 ✅ 2s 3s -33%
mld_h ✅ 2s 2s +0%
mld_keccakf1600_extract_bytes ✅ 2s 1s +100%
mld_keccakf1600x4_xor_bytes_c ✅ 2s 2s +0%
mld_value_barrier_u8 ✅ 2s 3s -33%
montgomery_reduce ✅ 2s 4s -50%
pack_sig_c ✅ 2s 5s -60%
pointwise_native_aarch64 ✅ 2s 5s -60%
pointwise_native_x86_64 ✅ 2s 3s -33%
poly_decompose_88_native_aarch64 ✅ 2s 1s +100%
poly_decompose_native ✅ 2s 3s -33%
poly_ntt_native ✅ 2s 4s -50%
poly_sub ✅ 2s 3s -33%
poly_uniform_gamma1_4x ✅ 2s 4s -50%
poly_use_hint_native_aarch64 ✅ 2s 3s -33%
polyvec_matrix_pointwise_montgomery_row ✅ 2s 1s +100%
polyvecl_uniform_gamma1_serial ✅ 2s 3s -33%
polyw1_pack ✅ 2s 4s -50%
polyz_pack ✅ 2s 3s -33%
polyz_unpack ✅ 2s 3s -33%
polyz_unpack_17_native_aarch64 ✅ 2s 3s -33%
polyz_unpack_native_x86_64 ✅ 2s 3s -33%
reduce32 ✅ 2s 3s -33%
rej_eta_c ✅ 2s 5s -60%
rej_uniform_native_aarch64 ✅ 2s 3s -33%
shake128_finalize ✅ 2s 1s +100%
shake128_init ✅ 2s 2s +0%
shake128x4_squeezeblocks ✅ 2s 3s -33%
shake256_absorb ✅ 2s 2s +0%
shake256_finalize ✅ 2s 1s +100%
shake256_init ✅ 2s 2s +0%
shake256_squeeze ✅ 2s 3s -33%
shake256x4_squeezeblocks ✅ 2s 2s +0%
sk_s1hat_get_poly ✅ 2s 6s -67%
unpack_pk_t1 ✅ 2s 5s -60%
unpack_sk_s1hat ✅ 2s 2s +0%
keccakf1600_xor_bytes (big endian) ✅ 1s 2s -50%
keccakf1600x4_xor_bytes ✅ 1s 1s +0%
mld_ct_get_optblocker_u8 ✅ 1s 2s -50%
pack_sk_s1 ✅ 1s 5s -80%
poly_decompose_native_x86_64 ✅ 1s 3s -67%
polyw1_pack_32 ✅ 1s 4s -75%
power2round ✅ 1s 1s +0%
shake128_absorb ✅ 1s 2s -50%
shake256_release ✅ 1s 2s -50%

@oqs-bot

oqs-bot commented Jun 26, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

CBMC Results (ML-DSA-44)

Full Results (206 proofs)
Proof Status Current Previous Change
**TOTAL** ✅ 1595s 1514s +5.4%
polyvecl_pointwise_acc_montgomery_c ✅ 160s 131s +22%
poly_pointwise_montgomery_c ✅ 134s 114s +18%
mld_invntt_layer ✅ 116s 107s +8%
mld_attempt_signature_generation ✅ 64s 58s +10%
compute_pack_t0_t1 ✅ 53s 50s +6%
mld_ntt_layer ✅ 49s 42s +17%
fqmul ✅ 43s 39s +10%
sign_verify_internal ✅ 39s 114s -66%
polyvec_matrix_expand ✅ 31s 28s +11%
keccakf1600x4_permute_native ✅ 23s 22s +5%
mld_ntt_butterfly_block ✅ 22s 23s -4%
poly_ntt_c ✅ 21s 19s +11%
sign_signature_internal ✅ 19s 26s -27%
poly_chknorm_c ✅ 18s 17s +6%
polyeta_unpack ✅ 18s 14s +29%
polyvec_matrix_pointwise_montgomery_yvec ✅ 18s 15s +20%
rej_uniform ✅ 18s 18s +0%
polyt0_unpack ✅ 16s 15s +7%
rej_uniform_c ✅ 16s 15s +7%
polyz_unpack_c ✅ 15s 11s +36%
poly_uniform_4x ✅ 14s 14s +0%
mld_check_pct ✅ 12s 14s -14%
poly_invntt_tomont_c ✅ 12s 11s +9%
poly_uniform_eta_4x ✅ 11s 11s +0%
polyvecl_chknorm ✅ 11s 10s +10%
polyvec_matrix_expand_serial ✅ 10s 8s +25%
keccak_absorb_once_x4 ✅ 9s 9s +0%
rej_uniform_native_x86_64 ✅ 9s - new
sign_pk_from_sk ✅ 9s 5s +80%
mld_compute_pack_z ✅ 8s 7s +14%
pointwise_acc_native_x86_64 ✅ 8s 7s +14%
unpack_sk_t0hat ✅ 8s 3s +167%
mld_keccakf1600_permute_c ✅ 7s 8s -12%
rej_eta_native ✅ 7s 6s +17%
keccak_absorb ✅ 6s 5s +20%
mld_sample_s1_s2 ✅ 6s 4s +50%
poly_add ✅ 6s 7s -14%
poly_caddq_c ✅ 6s 2s +200%
polyvec_matrix_pointwise_montgomery_row ✅ 6s 2s +200%
rej_eta_c ✅ 6s 4s +50%
sign_signature ✅ 6s 3s +100%
sign_signature_pre_hash_internal ✅ 6s 6s +0%
sign_signature_pre_hash_shake256 ✅ 6s 3s +100%
fqscale ✅ 5s 3s +67%
keccak_finalize ✅ 5s 3s +67%
keccak_squeezeblocks_x4 ✅ 5s 4s +25%
keccakf1600x4_xor_bytes_native ✅ 5s 3s +67%
mld_ct_sel_int32 ✅ 5s 2s +150%
pack_sk_rho_key_tr_s2 ✅ 5s 3s +67%
pointwise_acc_native_aarch64 ✅ 5s 4s +25%
pointwise_native_x86_64 ✅ 5s 4s +25%
poly_challenge ✅ 5s 3s +67%
poly_invntt_tomont_native ✅ 5s 4s +25%
polyt0_pack ✅ 5s 2s +150%
polyveck_caddq ✅ 5s 3s +67%
polyz_pack ✅ 5s 2s +150%
rej_uniform_eta_native_aarch64 ✅ 5s 2s +150%
shake128x4_squeezeblocks ✅ 5s 1s +400%
sign_verify_pre_hash_internal ✅ 5s 3s +67%
sk_s1hat_get_poly ✅ 5s 3s +67%
use_hint ✅ 5s 2s +150%
decompose ✅ 4s 2s +100%
make_hint ✅ 4s 3s +33%
mld_ct_cmask_nonzero_u8 ✅ 4s 2s +100%
mld_h ✅ 4s 4s +0%
mld_keccakf1600x4_extract_bytes_c ✅ 4s 2s +100%
mld_prepare_domain_separation_prefix ✅ 4s 4s +0%
mld_value_barrier_i64 ✅ 4s 2s +100%
ntt_native_aarch64 ✅ 4s 3s +33%
ntt_native_x86_64 ✅ 4s 3s +33%
pack_sig_z ✅ 4s 4s +0%
poly_caddq_native_x86_64 ✅ 4s 4s +0%
poly_chknorm ✅ 4s 4s +0%
poly_decompose ✅ 4s 3s +33%
poly_decompose_88_native_aarch64 ✅ 4s 4s +0%
poly_decompose_c ✅ 4s 4s +0%
poly_pointwise_montgomery ✅ 4s 3s +33%
poly_pointwise_montgomery_native ✅ 4s 2s +100%
poly_shiftl ✅ 4s 3s +33%
poly_uniform ✅ 4s 6s -33%
poly_uniform_eta ✅ 4s 5s -20%
poly_use_hint_c ✅ 4s 3s +33%
polyt1_pack ✅ 4s 4s +0%
polyt1_unpack ✅ 4s 5s -20%
polyveck_chknorm ✅ 4s 5s -20%
polyveck_decompose ✅ 4s 4s +0%
polyveck_invntt_tomont ✅ 4s 5s -20%
polyveck_pack_eta ✅ 4s 2s +100%
polyvecl_ntt ✅ 4s 2s +100%
polyvecl_uniform_gamma1 ✅ 4s 3s +33%
polyvecl_unpack_eta ✅ 4s 2s +100%
polyz_unpack ✅ 4s 3s +33%
rej_uniform_native_aarch64 ✅ 4s 5s -20%
shake256 ✅ 4s 1s +300%
shake256_finalize ✅ 4s 2s +100%
shake256_init ✅ 4s 3s +33%
sign_keypair ✅ 4s 4s +0%
sign_verify ✅ 4s 4s +0%
sign_verify_extmu ✅ 4s 3s +33%
unpack_sk ✅ 4s 3s +33%
yvec_init ✅ 4s 3s +33%
caddq ✅ 3s 2s +50%
intt_native_aarch64 ✅ 3s 9s -67%
intt_native_x86_64 ✅ 3s 4s -25%
keccak_f1600_x4_native_aarch64_v84a ✅ 3s 2s +50%
keccakf1600_extract_bytes (big endian) ✅ 3s 2s +50%
keccakf1600_permute ✅ 3s 2s +50%
keccakf1600_permute_native ✅ 3s 3s +0%
keccakf1600_xor_bytes ✅ 3s 1s +200%
keccakf1600_xor_bytes (big endian) ✅ 3s 4s -25%
keccakf1600x4_extract_bytes ✅ 3s 2s +50%
keccakf1600x4_xor_bytes ✅ 3s 2s +50%
mld_ct_cmask_neg_i32 ✅ 3s 3s +0%
mld_ct_memcmp ✅ 3s 3s +0%
mld_keccakf1600_extract_bytes ✅ 3s 2s +50%
mld_sample_s1_s2_serial ✅ 3s 3s +0%
mld_value_barrier_u8 ✅ 3s 3s +0%
nttunpack_native_x86_64 ✅ 3s 1s +200%
pack_sig_c ✅ 3s 2s +50%
pack_sig_h ✅ 3s 3s +0%
poly_caddq_native ✅ 3s 5s -40%
poly_caddq_native_aarch64 ✅ 3s 4s -25%
poly_chknorm_native ✅ 3s 4s -25%
poly_chknorm_native_aarch64 ✅ 3s 4s -25%
poly_decompose_native ✅ 3s 3s +0%
poly_ntt ✅ 3s 3s +0%
poly_permute_bitrev_to_custom_optional_native ✅ 3s 4s -25%
poly_power2round ✅ 3s 4s -25%
poly_reduce ✅ 3s 3s +0%
poly_uniform_gamma1 ✅ 3s 4s -25%
poly_uniform_gamma1_4x ✅ 3s 5s -40%
poly_use_hint_native ✅ 3s 4s -25%
poly_use_hint_native_aarch64 ✅ 3s 2s +50%
poly_use_hint_native_x86_64 ✅ 3s - new
polyveck_ntt ✅ 3s 5s -40%
polyveck_pack_w1 ✅ 3s 1s +200%
polyveck_unpack_eta ✅ 3s 2s +50%
polyvecl_pack_eta ✅ 3s 3s +0%
polyvecl_pointwise_acc_montgomery ✅ 3s 4s -25%
polyvecl_pointwise_acc_montgomery_native ✅ 3s 2s +50%
polyvecl_uniform_gamma1_serial ✅ 3s 2s +50%
polyvecl_unpack_z ✅ 3s 2s +50%
polyw1_pack ✅ 3s 3s +0%
polyw1_pack_32 ✅ 3s 2s +50%
polyw1_pack_88 ✅ 3s 1s +200%
polyz_unpack_17_native_aarch64 ✅ 3s 5s -40%
polyz_unpack_19_native_aarch64 ✅ 3s 5s -40%
polyz_unpack_native ✅ 3s 2s +50%
polyz_unpack_native_x86_64 ✅ 3s 3s +0%
power2round ✅ 3s 3s +0%
rej_uniform_native ✅ 3s 4s -25%
shake128_squeeze ✅ 3s 1s +200%
shake128x4_absorb_once ✅ 3s 3s +0%
shake256_absorb ✅ 3s 3s +0%
shake256_release ✅ 3s 2s +50%
shake256_squeeze ✅ 3s 2s +50%
shake256x4_absorb_once ✅ 3s 3s +0%
sig_unpack_hints ✅ 3s 2s +50%
sign_keypair_internal ✅ 3s 4s -25%
sign_signature_extmu ✅ 3s 4s -25%
unpack_pk_t1 ✅ 3s 5s -40%
keccak_f1600_x1_native_aarch64 ✅ 2s 2s +0%
keccak_f1600_x4_native_aarch64_v8a_scalar_hybrid ✅ 2s 3s -33%
keccak_f1600_x4_native_avx2 ✅ 2s 3s -33%
keccak_squeeze ✅ 2s 1s +100%
keccakf1600x4_extract_bytes_native ✅ 2s 3s -33%
keccakf1600x4_permute ✅ 2s 4s -50%
mld_ct_abs_i32 ✅ 2s 2s +0%
mld_ct_cmask_nonzero_u32 ✅ 2s 2s +0%
mld_ct_get_optblocker_u32 ✅ 2s 1s +100%
mld_ct_get_optblocker_u8 ✅ 2s 1s +100%
mld_keccakf1600x4_xor_bytes_c ✅ 2s 2s +0%
mld_polymat_expand_entry ✅ 2s 3s -33%
mld_value_barrier_u32 ✅ 2s 2s +0%
pack_sk_s1 ✅ 2s 2s +0%
poly_caddq ✅ 2s 2s +0%
poly_chknorm_native_x86_64 ✅ 2s 2s +0%
poly_decompose_32_native_aarch64 ✅ 2s 2s +0%
poly_decompose_native_x86_64 ✅ 2s 3s -33%
poly_invntt_tomont ✅ 2s 4s -50%
poly_ntt_native ✅ 2s 5s -60%
poly_sub ✅ 2s 3s -33%
poly_use_hint ✅ 2s 4s -50%
polyeta_pack ✅ 2s 3s -33%
polyveck_reduce ✅ 2s 5s -60%
reduce32 ✅ 2s 2s +0%
rej_eta ✅ 2s 3s -33%
shake128_absorb ✅ 2s 2s +0%
shake128_finalize ✅ 2s 2s +0%
shake128_init ✅ 2s 3s -33%
shake128_release ✅ 2s 1s +100%
shake256x4_squeezeblocks ✅ 2s 4s -50%
sign_verify_pre_hash_shake256 ✅ 2s 5s -60%
sk_s2hat_get_poly ✅ 2s 2s +0%
sk_t0hat_get_poly ✅ 2s 2s +0%
sys_check_capability ✅ 2s 4s -50%
unpack_sk_s1hat ✅ 2s 1s +100%
unpack_sk_s2hat ✅ 2s 4s -50%
yvec_get_poly ✅ 2s 3s -33%
keccak_f1600_x1_native_aarch64_v84a ✅ 1s 3s -67%
keccak_f1600_x4_native_aarch64_v8a_v84a_scalar_hybrid ✅ 1s 1s +0%
keccak_init ✅ 1s 3s -67%
mld_ct_get_optblocker_i64 ✅ 1s 4s -75%
montgomery_reduce ✅ 1s 3s -67%
pointwise_native_aarch64 ✅ 1s 5s -80%
poly_permute_bitrev_to_custom_optional ✅ 1s 2s -50%

@oqs-bot

oqs-bot commented Jun 26, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

CBMC Results (ML-DSA-87)

Full Results (206 proofs)
Proof Status Current Previous Change
**TOTAL** ✅ 2148s 2151s -0.1%
polyvecl_pointwise_acc_montgomery_c ✅ 356s 353s +1%
polyvec_matrix_expand ✅ 335s 324s +3%
poly_pointwise_montgomery_c ✅ 134s 144s -7%
mld_invntt_layer ✅ 117s 115s +2%
sign_verify_internal ✅ 79s 97s -19%
sign_signature_internal ✅ 57s 42s +36%
mld_attempt_signature_generation ✅ 56s 55s +2%
mld_ntt_layer ✅ 45s 45s +0%
fqmul ✅ 43s 43s +0%
polyvec_matrix_expand_serial ✅ 39s 38s +3%
keccakf1600x4_permute_native ✅ 23s 23s +0%
compute_pack_t0_t1 ✅ 22s 19s +16%
mld_ntt_butterfly_block ✅ 22s 24s -8%
poly_ntt_c ✅ 20s 21s -5%
polyvec_matrix_pointwise_montgomery_yvec ✅ 20s 18s +11%
polyt0_unpack ✅ 18s 14s +29%
poly_chknorm_c ✅ 17s 15s +13%
polyeta_unpack ✅ 17s 17s +0%
rej_uniform_c ✅ 16s 19s -16%
poly_uniform_4x ✅ 14s 13s +8%
rej_uniform ✅ 14s 15s -7%
keccak_absorb_once_x4 ✅ 12s 9s +33%
poly_invntt_tomont_c ✅ 12s 12s +0%
mld_compute_pack_z ✅ 11s 8s +38%
poly_uniform_eta_4x ✅ 11s 11s +0%
mld_check_pct ✅ 10s 16s -38%
polyveck_decompose ✅ 10s 13s -23%
polyveck_ntt ✅ 10s 11s -9%
polyvecl_ntt ✅ 10s 7s +43%
pointwise_acc_native_x86_64 ✅ 9s 6s +50%
polyveck_caddq ✅ 9s 8s +12%
rej_uniform_native_x86_64 ✅ 9s - new
mld_sample_s1_s2_serial ✅ 8s 8s +0%
mld_sample_s1_s2 ✅ 7s 6s +17%
pointwise_acc_native_aarch64 ✅ 7s 6s +17%
polyveck_invntt_tomont ✅ 7s 9s -22%
unpack_sk_t0hat ✅ 7s 7s +0%
mld_keccakf1600_permute_c ✅ 6s 7s -14%
montgomery_reduce ✅ 6s 3s +100%
poly_add ✅ 6s 6s +0%
poly_decompose_c ✅ 6s 5s +20%
poly_power2round ✅ 6s 3s +100%
polyveck_chknorm ✅ 6s 3s +100%
polyvecl_chknorm ✅ 6s 7s -14%
rej_eta_native ✅ 6s 6s +0%
rej_uniform_eta_native_aarch64 ✅ 6s 5s +20%
sign_pk_from_sk ✅ 6s 6s +0%
sign_verify_pre_hash_internal ✅ 6s 3s +100%
mld_ct_cmask_nonzero_u8 ✅ 5s 3s +67%
poly_decompose_native ✅ 5s 2s +150%
poly_permute_bitrev_to_custom_optional_native ✅ 5s 5s +0%
poly_uniform_gamma1 ✅ 5s 4s +25%
polyt1_pack ✅ 5s 3s +67%
polyt1_unpack ✅ 5s 4s +25%
polyveck_reduce ✅ 5s 3s +67%
polyz_unpack_17_native_aarch64 ✅ 5s 3s +67%
unpack_sk ✅ 5s 5s +0%
decompose ✅ 4s 3s +33%
intt_native_aarch64 ✅ 4s 3s +33%
keccak_squeezeblocks_x4 ✅ 4s 4s +0%
keccakf1600_permute ✅ 4s 3s +33%
keccakf1600x4_extract_bytes_native ✅ 4s 2s +100%
make_hint ✅ 4s 3s +33%
mld_h ✅ 4s 3s +33%
mld_keccakf1600_extract_bytes ✅ 4s 4s +0%
mld_keccakf1600x4_xor_bytes_c ✅ 4s 4s +0%
mld_polymat_expand_entry ✅ 4s 3s +33%
ntt_native_aarch64 ✅ 4s 6s -33%
ntt_native_x86_64 ✅ 4s 2s +100%
pointwise_native_aarch64 ✅ 4s 5s -20%
poly_caddq_c ✅ 4s 3s +33%
poly_caddq_native ✅ 4s 4s +0%
poly_caddq_native_x86_64 ✅ 4s 2s +100%
poly_challenge ✅ 4s 5s -20%
poly_chknorm_native ✅ 4s 4s +0%
poly_decompose_32_native_aarch64 ✅ 4s 5s -20%
poly_invntt_tomont ✅ 4s 1s +300%
poly_ntt_native ✅ 4s 3s +33%
poly_pointwise_montgomery ✅ 4s 4s +0%
poly_reduce ✅ 4s 2s +100%
poly_shiftl ✅ 4s 4s +0%
poly_uniform_eta ✅ 4s 4s +0%
poly_use_hint_native_aarch64 ✅ 4s 2s +100%
polyt0_pack ✅ 4s 4s +0%
polyvec_matrix_pointwise_montgomery_row ✅ 4s 3s +33%
polyvecl_pointwise_acc_montgomery_native ✅ 4s 3s +33%
polyvecl_unpack_z ✅ 4s 4s +0%
polyw1_pack ✅ 4s 4s +0%
polyw1_pack_32 ✅ 4s 4s +0%
power2round ✅ 4s 4s +0%
rej_eta ✅ 4s 4s +0%
rej_eta_c ✅ 4s 5s -20%
rej_uniform_native ✅ 4s 8s -50%
rej_uniform_native_aarch64 ✅ 4s 2s +100%
shake128_absorb ✅ 4s 4s +0%
sign_keypair ✅ 4s 4s +0%
sign_keypair_internal ✅ 4s 6s -33%
sign_signature_pre_hash_internal ✅ 4s 5s -20%
sign_signature_pre_hash_shake256 ✅ 4s 6s -33%
yvec_init ✅ 4s 4s +0%
fqscale ✅ 3s 3s +0%
keccak_f1600_x4_native_aarch64_v84a ✅ 3s 4s -25%
keccak_f1600_x4_native_aarch64_v8a_v84a_scalar_hybrid ✅ 3s 4s -25%
keccak_finalize ✅ 3s 1s +200%
keccakf1600_permute_native ✅ 3s 4s -25%
keccakf1600x4_permute ✅ 3s 3s +0%
keccakf1600x4_xor_bytes_native ✅ 3s 3s +0%
mld_ct_cmask_neg_i32 ✅ 3s 4s -25%
mld_ct_cmask_nonzero_u32 ✅ 3s 2s +50%
mld_ct_get_optblocker_u32 ✅ 3s 2s +50%
mld_prepare_domain_separation_prefix ✅ 3s 4s -25%
nttunpack_native_x86_64 ✅ 3s 3s +0%
pack_sig_z ✅ 3s 5s -40%
pack_sk_rho_key_tr_s2 ✅ 3s 3s +0%
poly_caddq ✅ 3s 2s +50%
poly_caddq_native_aarch64 ✅ 3s 3s +0%
poly_chknorm_native_x86_64 ✅ 3s 2s +50%
poly_decompose ✅ 3s 3s +0%
poly_decompose_88_native_aarch64 ✅ 3s 2s +50%
poly_invntt_tomont_native ✅ 3s 5s -40%
poly_ntt ✅ 3s 3s +0%
poly_pointwise_montgomery_native ✅ 3s 5s -40%
poly_use_hint_c ✅ 3s 2s +50%
poly_use_hint_native ✅ 3s 3s +0%
poly_use_hint_native_x86_64 ✅ 3s - new
polyeta_pack ✅ 3s 4s -25%
polyveck_pack_eta ✅ 3s 6s -50%
polyveck_pack_w1 ✅ 3s 3s +0%
polyveck_unpack_eta ✅ 3s 4s -25%
polyvecl_uniform_gamma1 ✅ 3s 2s +50%
polyvecl_unpack_eta ✅ 3s 5s -40%
polyz_unpack ✅ 3s 2s +50%
polyz_unpack_c ✅ 3s 3s +0%
polyz_unpack_native ✅ 3s 4s -25%
polyz_unpack_native_x86_64 ✅ 3s 3s +0%
shake128_init ✅ 3s 1s +200%
shake128x4_absorb_once ✅ 3s 5s -40%
shake256_absorb ✅ 3s 2s +50%
shake256_finalize ✅ 3s 2s +50%
shake256_init ✅ 3s 2s +50%
shake256_squeeze ✅ 3s 2s +50%
sig_unpack_hints ✅ 3s 3s +0%
sign_signature ✅ 3s 5s -40%
sign_signature_extmu ✅ 3s 4s -25%
sign_verify ✅ 3s 5s -40%
sign_verify_extmu ✅ 3s 3s +0%
sign_verify_pre_hash_shake256 ✅ 3s 3s +0%
sk_t0hat_get_poly ✅ 3s 4s -25%
unpack_sk_s1hat ✅ 3s 2s +50%
unpack_sk_s2hat ✅ 3s 3s +0%
caddq ✅ 2s 4s -50%
intt_native_x86_64 ✅ 2s 3s -33%
keccak_absorb ✅ 2s 3s -33%
keccak_f1600_x1_native_aarch64_v84a ✅ 2s 1s +100%
keccak_f1600_x4_native_aarch64_v8a_scalar_hybrid ✅ 2s 3s -33%
keccak_init ✅ 2s 3s -33%
keccak_squeeze ✅ 2s 2s +0%
keccakf1600_extract_bytes (big endian) ✅ 2s 3s -33%
keccakf1600_xor_bytes ✅ 2s 3s -33%
keccakf1600_xor_bytes (big endian) ✅ 2s 2s +0%
keccakf1600x4_extract_bytes ✅ 2s 2s +0%
mld_ct_get_optblocker_i64 ✅ 2s 3s -33%
mld_ct_get_optblocker_u8 ✅ 2s 3s -33%
mld_ct_sel_int32 ✅ 2s 3s -33%
mld_value_barrier_i64 ✅ 2s 1s +100%
mld_value_barrier_u32 ✅ 2s 2s +0%
mld_value_barrier_u8 ✅ 2s 3s -33%
pack_sig_c ✅ 2s 4s -50%
pack_sig_h ✅ 2s 4s -50%
pack_sk_s1 ✅ 2s 1s +100%
pointwise_native_x86_64 ✅ 2s 2s +0%
poly_chknorm ✅ 2s 3s -33%
poly_chknorm_native_aarch64 ✅ 2s 4s -50%
poly_decompose_native_x86_64 ✅ 2s 2s +0%
poly_sub ✅ 2s 3s -33%
poly_uniform ✅ 2s 4s -50%
poly_uniform_gamma1_4x ✅ 2s 3s -33%
poly_use_hint ✅ 2s 1s +100%
polyvecl_pack_eta ✅ 2s 3s -33%
polyvecl_pointwise_acc_montgomery ✅ 2s 5s -60%
polyvecl_uniform_gamma1_serial ✅ 2s 4s -50%
polyw1_pack_88 ✅ 2s 3s -33%
polyz_pack ✅ 2s 5s -60%
reduce32 ✅ 2s 3s -33%
shake128_finalize ✅ 2s 2s +0%
shake128_squeeze ✅ 2s 2s +0%
shake256 ✅ 2s 2s +0%
shake256_release ✅ 2s 3s -33%
shake256x4_absorb_once ✅ 2s 2s +0%
shake256x4_squeezeblocks ✅ 2s 1s +100%
sk_s1hat_get_poly ✅ 2s 3s -33%
sk_s2hat_get_poly ✅ 2s 3s -33%
sys_check_capability ✅ 2s 3s -33%
unpack_pk_t1 ✅ 2s 1s +100%
use_hint ✅ 2s 3s -33%
yvec_get_poly ✅ 2s 4s -50%
keccak_f1600_x1_native_aarch64 ✅ 1s 1s +0%
keccak_f1600_x4_native_avx2 ✅ 1s 2s -50%
keccakf1600x4_xor_bytes ✅ 1s 3s -67%
mld_ct_abs_i32 ✅ 1s 3s -67%
mld_ct_memcmp ✅ 1s 3s -67%
mld_keccakf1600x4_extract_bytes_c ✅ 1s 2s -50%
poly_permute_bitrev_to_custom_optional ✅ 1s 3s -67%
polyz_unpack_19_native_aarch64 ✅ 1s 4s -75%
shake128_release ✅ 1s 4s -75%
shake128x4_squeezeblocks ✅ 1s 3s -67%

@mkannwischer mkannwischer force-pushed the ptp/wycheproof-randomized-signing-vectors-uncovered branch from 959eec9 to e9a522e Compare June 29, 2026 04:07
mkannwischer
mkannwischer reviewed Jun 29, 2026
View reviewed changes
Comment thread test/wycheproof/wycheproof_client.py Outdated
@mkannwischer mkannwischer mentioned this pull request Jun 29, 2026
Open
mkannwischer
mkannwischer requested changes Jun 29, 2026
View reviewed changes

@mkannwischer mkannwischer left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks @fegge - this is a nice addition and the core looks correct to me.
Can you please get it through CI?

Comment thread test/wycheproof/wycheproof_client.py Outdated
mkannwischer
mkannwischer requested changes Jul 1, 2026
View reviewed changes

@mkannwischer mkannwischer left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks @fegge.

The changes look good to me now! Could you kindly combine your two commits? We are using Rebase and merge only and would like to keep the history cleaned up.

@mkannwischer mkannwischer added this to the v1.0.0 milestone Jul 14, 2026
@fegge @mkannwischer
Support randomized Wycheproof signing vectors
350171d 
Bump the pinned Wycheproof commit to include randomized ML-DSA signing
vectors, pass optional vector-provided rnd values to the signing driver,
and cache vector files under a per-commit directory so they refresh when
the pin changes.

Signed-off-by: Fredrik Dahlgren <fredrik.dahlgren@trailofbits.com>
@mkannwischer mkannwischer force-pushed the ptp/wycheproof-randomized-signing-vectors-uncovered branch from bd87099 to 350171d Compare July 14, 2026 06:50
mkannwischer
mkannwischer approved these changes Jul 14, 2026
View reviewed changes

@mkannwischer mkannwischer left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I took the liberty to rebase your changes on top of main and squash your second commit into the first one.

Thanks again for this improvement!

@mkannwischer mkannwischer enabled auto-merge July 14, 2026 06:51
@mkannwischer mkannwischer added this pull request to the merge queue Jul 14, 2026
Merged via the queue into main with commit b7e5755 Jul 14, 2026
740 of 742 checks passed
@mkannwischer mkannwischer deleted the ptp/wycheproof-randomized-signing-vectors-uncovered branch July 14, 2026 08:31
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@mkannwischer mkannwischer mkannwischer approved these changes

Assignees

No one assigned

Labels

needs-mlkem-native-port

Projects

None yet

Milestone

v1.0.0

Development

Successfully merging this pull request may close these issues.

Wycheproof randomized signing vectors are not covered

3 participants

@fegge @oqs-bot @mkannwischer