Skip to content

Reject malformed ML-DSA signing inputs#1241

Open
tob-joe wants to merge 2 commits into
mainfrom
ptp/mldsa-reject-malformed-signing-inputs
Open

Reject malformed ML-DSA signing inputs#1241
tob-joe wants to merge 2 commits into
mainfrom
ptp/mldsa-reject-malformed-signing-inputs

Conversation

@tob-joe

@tob-joe tob-joe commented Jun 29, 2026

Copy link
Copy Markdown

Reject malformed ML-DSA signing inputs

Summary

  • Reject short external-mu inputs before copying mu in internal signing and verification.
  • Reject nonzero context length with a NULL context pointer at the domain-separation prefix boundary.
  • Add focused unit regression tests for the malformed external-mu and domain-prefix cases.

Verification

  • Pre-fix make run_unit_44 failed after adding the targeted malformed-input regression test.
  • make run_unit_44
  • make run_unit
  • make run_func

Note: the focused regression test and broader unit/functional runs above were collected on the tidy pre-replay patch commit. This PR branch was then cleanly replayed onto current upstream main; post-replay git diff --check passes, but the tests have not been rerun on the replayed commit yet.

Co-authored-by: Codex codex@openai.com

This work was completed by Trail of Bits as part of the Patch The Planet project in collaboration with OpenAI. The issue was identified primarily by the Codex coding agent, and manually reviewed before submission.

@tob-joe tob-joe requested a review from a team as a code owner June 29, 2026 16:31
@tob-joe tob-joe force-pushed the ptp/mldsa-reject-malformed-signing-inputs branch from 9f8843a to 7e15a5b Compare June 29, 2026 16:56
@oqs-bot

oqs-bot commented Jun 29, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

CBMC Results (ML-DSA-44, REDUCE-RAM)

Full Results (205 proofs)
Proof Status Current Previous Change
**TOTAL** ✅ 1368s 1364s +0.3%
polyvec_matrix_pointwise_montgomery_yvec ✅ 148s 149s -1%
poly_pointwise_montgomery_c ✅ 120s 112s +7%
mld_invntt_layer ✅ 108s 105s +3%
polyveck_chknorm ✅ 61s 67s -9%
sign_verify_internal ✅ 43s 49s -12%
mld_ntt_layer ✅ 42s 41s +2%
fqmul ✅ 41s 39s +5%
keccakf1600x4_permute_native ✅ 23s 22s +5%
mld_ntt_butterfly_block ✅ 21s 23s -9%
mld_attempt_signature_generation ✅ 19s 19s +0%
poly_ntt_c ✅ 17s 21s -19%
mld_check_pct ✅ 15s 15s +0%
rej_uniform_c ✅ 15s 16s -6%
polyeta_unpack ✅ 14s 14s +0%
polyvecl_chknorm ✅ 14s 11s +27%
compute_pack_t0_t1 ✅ 12s 12s +0%
poly_chknorm_c ✅ 12s 11s +9%
poly_uniform_eta_4x ✅ 12s 12s +0%
poly_invntt_tomont_c ✅ 11s 11s +0%
keccak_absorb_once_x4 ✅ 10s 8s +25%
polyt0_unpack ✅ 10s 12s -17%
polyz_unpack_c ✅ 10s 8s +25%
rej_uniform ✅ 9s 8s +12%
mld_keccakf1600_permute_c ✅ 7s 7s +0%
poly_add ✅ 7s 7s +0%
poly_power2round ✅ 7s 4s +75%
poly_reduce ✅ 7s 4s +75%
polyw1_pack_88 ✅ 7s 2s +250%
rej_uniform_native ✅ 7s 5s +40%
sign_signature_pre_hash_shake256 ✅ 7s 4s +75%
mld_compute_pack_z ✅ 6s 6s +0%
pointwise_acc_native_x86_64 ✅ 6s 4s +50%
poly_pointwise_montgomery_native ✅ 6s 2s +200%
polyvec_matrix_pointwise_montgomery_row ✅ 6s 6s +0%
polyveck_decompose ✅ 6s 7s -14%
polyveck_invntt_tomont ✅ 6s 5s +20%
polyvecl_ntt ✅ 6s 3s +100%
rej_eta_native ✅ 6s 3s +100%
sign_keypair ✅ 6s 5s +20%
intt_native_x86_64 ✅ 5s 2s +150%
make_hint ✅ 5s 3s +67%
mld_polymat_expand_entry ✅ 5s 2s +150%
poly_caddq_native_aarch64 ✅ 5s 3s +67%
poly_caddq_native_x86_64 ✅ 5s 4s +25%
poly_challenge ✅ 5s 6s -17%
poly_decompose_c ✅ 5s 5s +0%
poly_use_hint ✅ 5s 2s +150%
polyt0_pack ✅ 5s 4s +25%
polyveck_reduce ✅ 5s 4s +25%
polyveck_unpack_eta ✅ 5s 2s +150%
polyvecl_pack_eta ✅ 5s 2s +150%
polyvecl_pointwise_acc_montgomery_c ✅ 5s 4s +25%
sign_keypair_internal ✅ 5s 4s +25%
sign_signature_extmu ✅ 5s 4s +25%
sys_check_capability ✅ 5s 2s +150%
decompose ✅ 4s 3s +33%
keccak_f1600_x1_native_aarch64_v84a ✅ 4s 2s +100%
mld_prepare_domain_separation_prefix ✅ 4s 3s +33%
mld_sample_s1_s2 ✅ 4s 1s +300%
ntt_native_aarch64 ✅ 4s 4s +0%
pack_sig_z ✅ 4s 2s +100%
pointwise_acc_native_aarch64 ✅ 4s 6s -33%
poly_chknorm_native_aarch64 ✅ 4s 2s +100%
poly_decompose_native ✅ 4s 2s +100%
poly_invntt_tomont ✅ 4s 2s +100%
poly_shiftl ✅ 4s 4s +0%
poly_uniform_eta ✅ 4s 2s +100%
poly_uniform_gamma1_4x ✅ 4s 5s -20%
polyt1_unpack ✅ 4s 2s +100%
polyvec_matrix_expand_serial ✅ 4s 4s +0%
polyveck_caddq ✅ 4s 3s +33%
polyvecl_pointwise_acc_montgomery_native ✅ 4s 3s +33%
polyw1_pack ✅ 4s 4s +0%
polyw1_pack_32 ✅ 4s 3s +33%
polyz_unpack_17_native_aarch64 ✅ 4s 2s +100%
shake256x4_absorb_once ✅ 4s 1s +300%
sig_unpack_hints ✅ 4s 2s +100%
sign_signature_internal ✅ 4s 4s +0%
sign_signature_pre_hash_internal ✅ 4s 4s +0%
sign_verify_extmu ✅ 4s 5s -20%
sk_s2hat_get_poly ✅ 4s 5s -20%
unpack_sk_s1hat ✅ 4s 3s +33%
fqscale ✅ 3s 2s +50%
keccak_f1600_x1_native_aarch64 ✅ 3s 3s +0%
keccak_f1600_x4_native_aarch64_v8a_scalar_hybrid ✅ 3s 2s +50%
keccak_f1600_x4_native_avx2 ✅ 3s 2s +50%
keccak_finalize ✅ 3s 2s +50%
keccak_squeeze ✅ 3s 2s +50%
keccak_squeezeblocks_x4 ✅ 3s 3s +0%
keccakf1600_permute ✅ 3s 2s +50%
keccakf1600x4_extract_bytes ✅ 3s 2s +50%
keccakf1600x4_permute ✅ 3s 4s -25%
keccakf1600x4_xor_bytes_native ✅ 3s 5s -40%
mld_ct_cmask_nonzero_u32 ✅ 3s 3s +0%
mld_ct_get_optblocker_u32 ✅ 3s 2s +50%
mld_ct_sel_int32 ✅ 3s 3s +0%
mld_h ✅ 3s 4s -25%
mld_sample_s1_s2_serial ✅ 3s 4s -25%
mld_value_barrier_u32 ✅ 3s 1s +200%
mld_value_barrier_u8 ✅ 3s 4s -25%
montgomery_reduce ✅ 3s 2s +50%
ntt_native_x86_64 ✅ 3s 3s +0%
nttunpack_native_x86_64 ✅ 3s 4s -25%
pack_sig_h ✅ 3s 4s -25%
pack_sk_rho_key_tr_s2 ✅ 3s 5s -40%
pack_sk_s1 ✅ 3s 3s +0%
pointwise_native_aarch64 ✅ 3s 2s +50%
pointwise_native_x86_64 ✅ 3s 4s -25%
poly_caddq ✅ 3s 4s -25%
poly_caddq_native ✅ 3s 3s +0%
poly_chknorm_native ✅ 3s 4s -25%
poly_decompose_88_native_aarch64 ✅ 3s 3s +0%
poly_decompose_native_x86_64 ✅ 3s 2s +50%
poly_ntt ✅ 3s 3s +0%
poly_permute_bitrev_to_custom_optional_native ✅ 3s 3s +0%
poly_pointwise_montgomery ✅ 3s 3s +0%
poly_sub ✅ 3s 3s +0%
poly_uniform ✅ 3s 3s +0%
poly_uniform_4x ✅ 3s 3s +0%
poly_use_hint_c ✅ 3s 5s -40%
polyeta_pack ✅ 3s 3s +0%
polyt1_pack ✅ 3s 3s +0%
polyvec_matrix_expand ✅ 3s 3s +0%
polyveck_ntt ✅ 3s 2s +50%
polyz_pack ✅ 3s 2s +50%
polyz_unpack_19_native_aarch64 ✅ 3s 4s -25%
polyz_unpack_native ✅ 3s 3s +0%
polyz_unpack_native_x86_64 ✅ 3s 3s +0%
power2round ✅ 3s 2s +50%
reduce32 ✅ 3s 3s +0%
rej_uniform_eta_native_aarch64 ✅ 3s 3s +0%
shake128_finalize ✅ 3s 3s +0%
shake128_release ✅ 3s 2s +50%
shake256x4_squeezeblocks ✅ 3s 2s +50%
sign_pk_from_sk ✅ 3s 5s -40%
sign_signature ✅ 3s 6s -50%
sk_s1hat_get_poly ✅ 3s 2s +50%
sk_t0hat_get_poly ✅ 3s 1s +200%
unpack_sk ✅ 3s 3s +0%
unpack_sk_t0hat ✅ 3s 2s +50%
use_hint ✅ 3s 2s +50%
yvec_init ✅ 3s 1s +200%
caddq ✅ 2s 6s -67%
intt_native_aarch64 ✅ 2s 3s -33%
keccak_absorb ✅ 2s 3s -33%
keccak_f1600_x4_native_aarch64_v84a ✅ 2s 3s -33%
keccakf1600_extract_bytes (big endian) ✅ 2s 4s -50%
keccakf1600_permute_native ✅ 2s 3s -33%
keccakf1600_xor_bytes (big endian) ✅ 2s 6s -67%
keccakf1600x4_xor_bytes ✅ 2s 3s -33%
mld_ct_abs_i32 ✅ 2s 3s -33%
mld_ct_cmask_nonzero_u8 ✅ 2s 2s +0%
mld_ct_get_optblocker_i64 ✅ 2s 4s -50%
mld_ct_get_optblocker_u8 ✅ 2s 2s +0%
mld_ct_memcmp ✅ 2s 1s +100%
mld_keccakf1600_extract_bytes ✅ 2s 2s +0%
mld_keccakf1600x4_xor_bytes_c ✅ 2s 4s -50%
pack_sig_c ✅ 2s 5s -60%
poly_caddq_c ✅ 2s 3s -33%
poly_chknorm ✅ 2s 3s -33%
poly_chknorm_native_x86_64 ✅ 2s 2s +0%
poly_decompose_32_native_aarch64 ✅ 2s 4s -50%
poly_invntt_tomont_native ✅ 2s 3s -33%
poly_ntt_native ✅ 2s 3s -33%
poly_permute_bitrev_to_custom_optional ✅ 2s 5s -60%
poly_uniform_gamma1 ✅ 2s 3s -33%
poly_use_hint_native_x86_64 ✅ 2s - new
polyveck_pack_eta ✅ 2s 4s -50%
polyvecl_uniform_gamma1 ✅ 2s 2s +0%
polyvecl_uniform_gamma1_serial ✅ 2s 2s +0%
polyvecl_unpack_z ✅ 2s 3s -33%
rej_eta ✅ 2s 5s -60%
rej_eta_c ✅ 2s 4s -50%
rej_uniform_native_aarch64 ✅ 2s 3s -33%
shake128_absorb ✅ 2s 3s -33%
shake128_init ✅ 2s 2s +0%
shake128_squeeze ✅ 2s 2s +0%
shake128x4_absorb_once ✅ 2s 2s +0%
shake256 ✅ 2s 1s +100%
shake256_absorb ✅ 2s 2s +0%
shake256_finalize ✅ 2s 2s +0%
shake256_init ✅ 2s 4s -50%
shake256_release ✅ 2s 1s +100%
shake256_squeeze ✅ 2s 2s +0%
sign_verify ✅ 2s 4s -50%
sign_verify_pre_hash_internal ✅ 2s 5s -60%
sign_verify_pre_hash_shake256 ✅ 2s 5s -60%
unpack_pk_t1 ✅ 2s 3s -33%
yvec_get_poly ✅ 2s 3s -33%
keccak_f1600_x4_native_aarch64_v8a_v84a_scalar_hybrid ✅ 1s 3s -67%
keccak_init ✅ 1s 3s -67%
keccakf1600_xor_bytes ✅ 1s 3s -67%
keccakf1600x4_extract_bytes_native ✅ 1s 4s -75%
mld_ct_cmask_neg_i32 ✅ 1s 2s -50%
mld_keccakf1600x4_extract_bytes_c ✅ 1s 4s -75%
mld_value_barrier_i64 ✅ 1s 3s -67%
poly_decompose ✅ 1s 2s -50%
poly_use_hint_native ✅ 1s 3s -67%
poly_use_hint_native_aarch64 ✅ 1s 3s -67%
polyveck_pack_w1 ✅ 1s 3s -67%
polyvecl_pointwise_acc_montgomery ✅ 1s 3s -67%
polyvecl_unpack_eta ✅ 1s 4s -75%
polyz_unpack ✅ 1s 3s -67%
shake128x4_squeezeblocks ✅ 1s 2s -50%
unpack_sk_s2hat ✅ 1s 4s -75%

@oqs-bot

oqs-bot commented Jun 29, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

CBMC Results (ML-DSA-44)

Full Results (205 proofs)
Proof Status Current Previous Change
**TOTAL** ✅ 1696s 1514s +12.0%
polyvecl_pointwise_acc_montgomery_c ✅ 172s 131s +31%
poly_pointwise_montgomery_c ✅ 143s 114s +25%
mld_invntt_layer ✅ 129s 107s +21%
sign_verify_internal ✅ 101s 114s -11%
mld_attempt_signature_generation ✅ 63s 58s +9%
compute_pack_t0_t1 ✅ 53s 50s +6%
mld_ntt_layer ✅ 46s 42s +10%
fqmul ✅ 45s 39s +15%
polyvec_matrix_expand ✅ 30s 28s +7%
mld_ntt_butterfly_block ✅ 24s 23s +4%
sign_signature_internal ✅ 23s 26s -12%
poly_ntt_c ✅ 22s 19s +16%
keccakf1600x4_permute_native ✅ 21s 22s -5%
polyeta_unpack ✅ 19s 14s +36%
polyvec_matrix_pointwise_montgomery_yvec ✅ 18s 15s +20%
poly_chknorm_c ✅ 17s 17s +0%
rej_uniform_c ✅ 16s 15s +7%
poly_uniform_eta_4x ✅ 15s 11s +36%
polyt0_unpack ✅ 15s 15s +0%
rej_uniform ✅ 15s 18s -17%
mld_check_pct ✅ 14s 14s +0%
poly_uniform_4x ✅ 14s 14s +0%
keccak_absorb_once_x4 ✅ 12s 9s +33%
poly_invntt_tomont_c ✅ 12s 11s +9%
polyz_unpack_c ✅ 11s 11s +0%
polyvecl_chknorm ✅ 10s 10s +0%
mld_compute_pack_z ✅ 9s 7s +29%
poly_add ✅ 9s 7s +29%
polyvec_matrix_expand_serial ✅ 8s 8s +0%
polyveck_decompose ✅ 8s 4s +100%
sign_pk_from_sk ✅ 8s 5s +60%
mld_keccakf1600_permute_c ✅ 7s 8s -12%
polyveck_caddq ✅ 7s 3s +133%
sign_verify_pre_hash_internal ✅ 7s 3s +133%
sign_verify_pre_hash_shake256 ✅ 7s 5s +40%
intt_native_aarch64 ✅ 6s 9s -33%
mld_sample_s1_s2 ✅ 6s 4s +50%
pointwise_acc_native_aarch64 ✅ 6s 4s +50%
poly_chknorm_native_x86_64 ✅ 6s 2s +200%
unpack_sk_t0hat ✅ 6s 3s +100%
decompose ✅ 5s 2s +150%
keccak_squeeze ✅ 5s 1s +400%
keccakf1600x4_xor_bytes_native ✅ 5s 3s +67%
mld_ct_cmask_nonzero_u32 ✅ 5s 2s +150%
mld_ct_get_optblocker_i64 ✅ 5s 4s +25%
mld_sample_s1_s2_serial ✅ 5s 3s +67%
mld_value_barrier_u32 ✅ 5s 2s +150%
pack_sig_z ✅ 5s 4s +25%
pointwise_acc_native_x86_64 ✅ 5s 7s -29%
poly_caddq_c ✅ 5s 2s +150%
poly_chknorm_native ✅ 5s 4s +25%
poly_invntt_tomont_native ✅ 5s 4s +25%
poly_uniform_eta ✅ 5s 5s +0%
poly_use_hint_native ✅ 5s 4s +25%
polyt1_unpack ✅ 5s 5s +0%
polyveck_invntt_tomont ✅ 5s 5s +0%
polyz_unpack_native_x86_64 ✅ 5s 3s +67%
rej_uniform_native ✅ 5s 4s +25%
sign_keypair_internal ✅ 5s 4s +25%
sign_signature ✅ 5s 3s +67%
sign_signature_extmu ✅ 5s 4s +25%
sign_signature_pre_hash_internal ✅ 5s 6s -17%
sign_signature_pre_hash_shake256 ✅ 5s 3s +67%
sign_verify ✅ 5s 4s +25%
unpack_sk ✅ 5s 3s +67%
intt_native_x86_64 ✅ 4s 4s +0%
keccak_squeezeblocks_x4 ✅ 4s 4s +0%
keccakf1600_xor_bytes ✅ 4s 1s +300%
keccakf1600_xor_bytes (big endian) ✅ 4s 4s +0%
make_hint ✅ 4s 3s +33%
mld_ct_cmask_nonzero_u8 ✅ 4s 2s +100%
mld_keccakf1600x4_xor_bytes_c ✅ 4s 2s +100%
montgomery_reduce ✅ 4s 3s +33%
nttunpack_native_x86_64 ✅ 4s 1s +300%
pack_sig_c ✅ 4s 2s +100%
pack_sk_rho_key_tr_s2 ✅ 4s 3s +33%
poly_caddq_native_aarch64 ✅ 4s 4s +0%
poly_challenge ✅ 4s 3s +33%
poly_decompose ✅ 4s 3s +33%
poly_decompose_c ✅ 4s 4s +0%
poly_invntt_tomont ✅ 4s 4s +0%
poly_ntt_native ✅ 4s 5s -20%
poly_pointwise_montgomery ✅ 4s 3s +33%
poly_power2round ✅ 4s 4s +0%
poly_shiftl ✅ 4s 3s +33%
poly_uniform_gamma1 ✅ 4s 4s +0%
poly_uniform_gamma1_4x ✅ 4s 5s -20%
poly_use_hint ✅ 4s 4s +0%
poly_use_hint_native_x86_64 ✅ 4s - new
polyvec_matrix_pointwise_montgomery_row ✅ 4s 2s +100%
polyveck_chknorm ✅ 4s 5s -20%
polyveck_ntt ✅ 4s 5s -20%
polyvecl_pointwise_acc_montgomery_native ✅ 4s 2s +100%
polyvecl_uniform_gamma1 ✅ 4s 3s +33%
polyvecl_uniform_gamma1_serial ✅ 4s 2s +100%
polyvecl_unpack_eta ✅ 4s 2s +100%
polyvecl_unpack_z ✅ 4s 2s +100%
polyw1_pack_32 ✅ 4s 2s +100%
polyz_unpack ✅ 4s 3s +33%
rej_eta_c ✅ 4s 4s +0%
rej_eta_native ✅ 4s 6s -33%
rej_uniform_eta_native_aarch64 ✅ 4s 2s +100%
rej_uniform_native_aarch64 ✅ 4s 5s -20%
shake128x4_absorb_once ✅ 4s 3s +33%
shake256_squeeze ✅ 4s 2s +100%
shake256x4_squeezeblocks ✅ 4s 4s +0%
sig_unpack_hints ✅ 4s 2s +100%
sign_keypair ✅ 4s 4s +0%
sign_verify_extmu ✅ 4s 3s +33%
unpack_pk_t1 ✅ 4s 5s -20%
yvec_init ✅ 4s 3s +33%
caddq ✅ 3s 2s +50%
keccak_absorb ✅ 3s 5s -40%
keccak_f1600_x1_native_aarch64_v84a ✅ 3s 3s +0%
keccak_f1600_x4_native_aarch64_v84a ✅ 3s 2s +50%
keccak_f1600_x4_native_avx2 ✅ 3s 3s +0%
keccakf1600_extract_bytes (big endian) ✅ 3s 2s +50%
keccakf1600x4_extract_bytes ✅ 3s 2s +50%
keccakf1600x4_extract_bytes_native ✅ 3s 3s +0%
mld_ct_abs_i32 ✅ 3s 2s +50%
mld_ct_get_optblocker_u32 ✅ 3s 1s +200%
mld_ct_get_optblocker_u8 ✅ 3s 1s +200%
mld_ct_sel_int32 ✅ 3s 2s +50%
mld_h ✅ 3s 4s -25%
mld_prepare_domain_separation_prefix ✅ 3s 4s -25%
ntt_native_aarch64 ✅ 3s 3s +0%
pack_sk_s1 ✅ 3s 2s +50%
poly_caddq ✅ 3s 2s +50%
poly_caddq_native ✅ 3s 5s -40%
poly_chknorm ✅ 3s 4s -25%
poly_chknorm_native_aarch64 ✅ 3s 4s -25%
poly_decompose_88_native_aarch64 ✅ 3s 4s -25%
poly_decompose_native ✅ 3s 3s +0%
poly_decompose_native_x86_64 ✅ 3s 3s +0%
poly_permute_bitrev_to_custom_optional ✅ 3s 2s +50%
poly_permute_bitrev_to_custom_optional_native ✅ 3s 4s -25%
poly_uniform ✅ 3s 6s -50%
poly_use_hint_c ✅ 3s 3s +0%
polyt0_pack ✅ 3s 2s +50%
polyt1_pack ✅ 3s 4s -25%
polyveck_pack_eta ✅ 3s 2s +50%
polyveck_reduce ✅ 3s 5s -40%
polyveck_unpack_eta ✅ 3s 2s +50%
polyvecl_ntt ✅ 3s 2s +50%
polyvecl_pointwise_acc_montgomery ✅ 3s 4s -25%
polyw1_pack ✅ 3s 3s +0%
power2round ✅ 3s 3s +0%
reduce32 ✅ 3s 2s +50%
shake128_init ✅ 3s 3s +0%
shake128_squeeze ✅ 3s 1s +200%
shake256 ✅ 3s 1s +200%
shake256_absorb ✅ 3s 3s +0%
shake256_init ✅ 3s 3s +0%
sk_s1hat_get_poly ✅ 3s 3s +0%
sk_s2hat_get_poly ✅ 3s 2s +50%
sk_t0hat_get_poly ✅ 3s 2s +50%
sys_check_capability ✅ 3s 4s -25%
unpack_sk_s2hat ✅ 3s 4s -25%
yvec_get_poly ✅ 3s 3s +0%
fqscale ✅ 2s 3s -33%
keccak_f1600_x1_native_aarch64 ✅ 2s 2s +0%
keccak_f1600_x4_native_aarch64_v8a_v84a_scalar_hybrid ✅ 2s 1s +100%
keccakf1600_permute ✅ 2s 2s +0%
keccakf1600_permute_native ✅ 2s 3s -33%
keccakf1600x4_permute ✅ 2s 4s -50%
keccakf1600x4_xor_bytes ✅ 2s 2s +0%
mld_ct_cmask_neg_i32 ✅ 2s 3s -33%
mld_ct_memcmp ✅ 2s 3s -33%
mld_keccakf1600x4_extract_bytes_c ✅ 2s 2s +0%
mld_polymat_expand_entry ✅ 2s 3s -33%
mld_value_barrier_i64 ✅ 2s 2s +0%
mld_value_barrier_u8 ✅ 2s 3s -33%
ntt_native_x86_64 ✅ 2s 3s -33%
pointwise_native_x86_64 ✅ 2s 4s -50%
poly_decompose_32_native_aarch64 ✅ 2s 2s +0%
poly_ntt ✅ 2s 3s -33%
poly_pointwise_montgomery_native ✅ 2s 2s +0%
poly_reduce ✅ 2s 3s -33%
poly_sub ✅ 2s 3s -33%
poly_use_hint_native_aarch64 ✅ 2s 2s +0%
polyeta_pack ✅ 2s 3s -33%
polyveck_pack_w1 ✅ 2s 1s +100%
polyvecl_pack_eta ✅ 2s 3s -33%
polyw1_pack_88 ✅ 2s 1s +100%
polyz_pack ✅ 2s 2s +0%
polyz_unpack_17_native_aarch64 ✅ 2s 5s -60%
polyz_unpack_19_native_aarch64 ✅ 2s 5s -60%
polyz_unpack_native ✅ 2s 2s +0%
rej_eta ✅ 2s 3s -33%
shake128_absorb ✅ 2s 2s +0%
shake128_release ✅ 2s 1s +100%
shake128x4_squeezeblocks ✅ 2s 1s +100%
shake256_release ✅ 2s 2s +0%
shake256x4_absorb_once ✅ 2s 3s -33%
unpack_sk_s1hat ✅ 2s 1s +100%
use_hint ✅ 2s 2s +0%
keccak_f1600_x4_native_aarch64_v8a_scalar_hybrid ✅ 1s 3s -67%
keccak_finalize ✅ 1s 3s -67%
keccak_init ✅ 1s 3s -67%
mld_keccakf1600_extract_bytes ✅ 1s 2s -50%
pack_sig_h ✅ 1s 3s -67%
pointwise_native_aarch64 ✅ 1s 5s -80%
poly_caddq_native_x86_64 ✅ 1s 4s -75%
shake128_finalize ✅ 1s 2s -50%
shake256_finalize ✅ 1s 2s -50%

@oqs-bot

oqs-bot commented Jun 29, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

CBMC Results (ML-DSA-65, REDUCE-RAM)

Full Results (205 proofs)
Proof Status Current Previous Change
**TOTAL** ✅ 1440s 1482s -2.8%
polyvec_matrix_pointwise_montgomery_yvec ✅ 194s 201s -3%
poly_pointwise_montgomery_c ✅ 117s 116s +1%
mld_invntt_layer ✅ 109s 108s +1%
mld_ntt_layer ✅ 42s 43s -2%
polyvecl_chknorm ✅ 41s 43s -5%
fqmul ✅ 40s 40s +0%
sign_verify_internal ✅ 40s 71s -44%
polyveck_chknorm ✅ 34s 36s -6%
mld_attempt_signature_generation ✅ 31s 31s +0%
keccakf1600x4_permute_native ✅ 23s 22s +5%
mld_ntt_butterfly_block ✅ 23s 25s -8%
poly_ntt_c ✅ 21s 22s -5%
mld_check_pct ✅ 19s 12s +58%
rej_uniform_c ✅ 15s 16s -6%
polyt0_unpack ✅ 13s 13s +0%
keccak_absorb_once_x4 ✅ 12s 10s +20%
poly_uniform_eta_4x ✅ 12s 13s -8%
poly_chknorm_c ✅ 11s 13s -15%
polyveck_decompose ✅ 11s 14s -21%
poly_invntt_tomont_c ✅ 10s 10s +0%
polyvec_matrix_pointwise_montgomery_row ✅ 10s 8s +25%
polyz_unpack_c ✅ 9s 9s +0%
compute_pack_t0_t1 ✅ 7s 7s +0%
mld_sample_s1_s2 ✅ 7s 6s +17%
pointwise_acc_native_x86_64 ✅ 7s 5s +40%
polyveck_invntt_tomont ✅ 7s 7s +0%
polyvecl_ntt ✅ 7s 7s +0%
rej_uniform ✅ 7s 7s +0%
sign_signature_internal ✅ 7s 6s +17%
mld_keccakf1600_permute_c ✅ 6s 7s -14%
poly_decompose_c ✅ 6s 8s -25%
poly_uniform ✅ 6s 2s +200%
poly_uniform_gamma1_4x ✅ 6s 3s +100%
poly_use_hint_native_x86_64 ✅ 6s - new
polyveck_caddq ✅ 6s 7s -14%
polyveck_reduce ✅ 6s 6s +0%
sign_pk_from_sk ✅ 6s 5s +20%
mld_compute_pack_z ✅ 5s 5s +0%
mld_prepare_domain_separation_prefix ✅ 5s 4s +25%
mld_sample_s1_s2_serial ✅ 5s 3s +67%
nttunpack_native_x86_64 ✅ 5s 3s +67%
pointwise_acc_native_aarch64 ✅ 5s 6s -17%
poly_add ✅ 5s 7s -29%
poly_caddq_c ✅ 5s 5s +0%
poly_challenge ✅ 5s 5s +0%
poly_decompose_88_native_aarch64 ✅ 5s 2s +150%
poly_invntt_tomont_native ✅ 5s 5s +0%
poly_power2round ✅ 5s 7s -29%
poly_reduce ✅ 5s 4s +25%
poly_uniform_gamma1 ✅ 5s 3s +67%
polyvecl_uniform_gamma1 ✅ 5s 4s +25%
polyw1_pack ✅ 5s 3s +67%
polyz_pack ✅ 5s 3s +67%
polyz_unpack ✅ 5s 3s +67%
polyz_unpack_19_native_aarch64 ✅ 5s 5s +0%
sign_keypair_internal ✅ 5s 3s +67%
sign_verify_pre_hash_internal ✅ 5s 5s +0%
use_hint ✅ 5s 2s +150%
decompose ✅ 4s 4s +0%
fqscale ✅ 4s 3s +33%
intt_native_x86_64 ✅ 4s 4s +0%
keccak_f1600_x4_native_aarch64_v8a_scalar_hybrid ✅ 4s 3s +33%
keccak_squeeze ✅ 4s 2s +100%
keccakf1600_permute_native ✅ 4s 2s +100%
mld_ct_cmask_nonzero_u32 ✅ 4s 3s +33%
mld_ct_cmask_nonzero_u8 ✅ 4s 2s +100%
mld_ct_get_optblocker_u8 ✅ 4s 4s +0%
mld_ct_memcmp ✅ 4s 4s +0%
mld_h ✅ 4s 3s +33%
pack_sk_s1 ✅ 4s 3s +33%
pointwise_native_aarch64 ✅ 4s 3s +33%
poly_caddq_native_aarch64 ✅ 4s 2s +100%
poly_chknorm_native_x86_64 ✅ 4s 4s +0%
poly_decompose_native ✅ 4s 5s -20%
poly_invntt_tomont ✅ 4s 5s -20%
poly_sub ✅ 4s 4s +0%
poly_use_hint_native ✅ 4s 7s -43%
poly_use_hint_native_aarch64 ✅ 4s 4s +0%
polyt1_pack ✅ 4s 3s +33%
polyt1_unpack ✅ 4s 3s +33%
polyveck_pack_w1 ✅ 4s 4s +0%
polyvecl_pointwise_acc_montgomery_c ✅ 4s 3s +33%
polyvecl_unpack_eta ✅ 4s 2s +100%
rej_eta_native ✅ 4s 3s +33%
rej_uniform_native ✅ 4s 4s +0%
rej_uniform_native_aarch64 ✅ 4s 5s -20%
shake128_init ✅ 4s 6s -33%
shake128_release ✅ 4s 2s +100%
shake256_init ✅ 4s 4s +0%
shake256x4_squeezeblocks ✅ 4s 2s +100%
sign_keypair ✅ 4s 4s +0%
sign_signature ✅ 4s 5s -20%
sign_signature_extmu ✅ 4s 4s +0%
sign_signature_pre_hash_internal ✅ 4s 3s +33%
sign_verify_extmu ✅ 4s 2s +100%
yvec_init ✅ 4s 5s -20%
caddq ✅ 3s 2s +50%
intt_native_aarch64 ✅ 3s 2s +50%
keccak_absorb ✅ 3s 3s +0%
keccak_f1600_x4_native_aarch64_v84a ✅ 3s 2s +50%
keccak_f1600_x4_native_aarch64_v8a_v84a_scalar_hybrid ✅ 3s 3s +0%
keccak_init ✅ 3s 4s -25%
keccak_squeezeblocks_x4 ✅ 3s 4s -25%
keccakf1600_permute ✅ 3s 4s -25%
keccakf1600_xor_bytes (big endian) ✅ 3s 2s +50%
keccakf1600x4_extract_bytes ✅ 3s 4s -25%
keccakf1600x4_xor_bytes ✅ 3s 2s +50%
mld_ct_abs_i32 ✅ 3s 6s -50%
mld_keccakf1600x4_extract_bytes_c ✅ 3s 2s +50%
montgomery_reduce ✅ 3s 1s +200%
ntt_native_aarch64 ✅ 3s 3s +0%
pack_sig_c ✅ 3s 3s +0%
pack_sk_rho_key_tr_s2 ✅ 3s 2s +50%
poly_caddq ✅ 3s 3s +0%
poly_chknorm ✅ 3s 3s +0%
poly_chknorm_native ✅ 3s 4s -25%
poly_decompose_32_native_aarch64 ✅ 3s 4s -25%
poly_ntt_native ✅ 3s 2s +50%
poly_pointwise_montgomery ✅ 3s 2s +50%
poly_pointwise_montgomery_native ✅ 3s 4s -25%
poly_uniform_eta ✅ 3s 5s -40%
polyeta_unpack ✅ 3s 4s -25%
polyveck_pack_eta ✅ 3s 3s +0%
polyveck_unpack_eta ✅ 3s 3s +0%
polyvecl_pointwise_acc_montgomery ✅ 3s 3s +0%
polyz_unpack_native ✅ 3s 3s +0%
reduce32 ✅ 3s 2s +50%
rej_eta ✅ 3s 5s -40%
rej_eta_c ✅ 3s 4s -25%
rej_uniform_eta_native_aarch64 ✅ 3s 5s -40%
shake128_finalize ✅ 3s 2s +50%
shake256 ✅ 3s 2s +50%
shake256_absorb ✅ 3s 4s -25%
shake256_finalize ✅ 3s 1s +200%
shake256_release ✅ 3s 3s +0%
shake256_squeeze ✅ 3s 4s -25%
sig_unpack_hints ✅ 3s 1s +200%
sign_signature_pre_hash_shake256 ✅ 3s 7s -57%
sign_verify ✅ 3s 6s -50%
sign_verify_pre_hash_shake256 ✅ 3s 6s -50%
sk_s2hat_get_poly ✅ 3s 1s +200%
unpack_sk_s1hat ✅ 3s 1s +200%
yvec_get_poly ✅ 3s 3s +0%
keccak_f1600_x1_native_aarch64 ✅ 2s 2s +0%
keccakf1600_extract_bytes (big endian) ✅ 2s 3s -33%
keccakf1600x4_extract_bytes_native ✅ 2s 1s +100%
keccakf1600x4_permute ✅ 2s 1s +100%
keccakf1600x4_xor_bytes_native ✅ 2s 2s +0%
mld_ct_get_optblocker_u32 ✅ 2s 3s -33%
mld_keccakf1600_extract_bytes ✅ 2s 2s +0%
mld_keccakf1600x4_xor_bytes_c ✅ 2s 2s +0%
mld_polymat_expand_entry ✅ 2s 3s -33%
mld_value_barrier_i64 ✅ 2s 2s +0%
mld_value_barrier_u8 ✅ 2s 1s +100%
ntt_native_x86_64 ✅ 2s 5s -60%
pack_sig_h ✅ 2s 2s +0%
pack_sig_z ✅ 2s 1s +100%
pointwise_native_x86_64 ✅ 2s 2s +0%
poly_caddq_native ✅ 2s 4s -50%
poly_caddq_native_x86_64 ✅ 2s 1s +100%
poly_chknorm_native_aarch64 ✅ 2s 2s +0%
poly_decompose ✅ 2s 2s +0%
poly_decompose_native_x86_64 ✅ 2s 2s +0%
poly_ntt ✅ 2s 2s +0%
poly_shiftl ✅ 2s 3s -33%
poly_uniform_4x ✅ 2s 4s -50%
poly_use_hint ✅ 2s 3s -33%
poly_use_hint_c ✅ 2s 2s +0%
polyt0_pack ✅ 2s 5s -60%
polyvec_matrix_expand ✅ 2s 6s -67%
polyvec_matrix_expand_serial ✅ 2s 3s -33%
polyveck_ntt ✅ 2s 4s -50%
polyvecl_pack_eta ✅ 2s 2s +0%
polyvecl_pointwise_acc_montgomery_native ✅ 2s 3s -33%
polyvecl_uniform_gamma1_serial ✅ 2s 1s +100%
polyvecl_unpack_z ✅ 2s 1s +100%
polyw1_pack_32 ✅ 2s 2s +0%
polyw1_pack_88 ✅ 2s 3s -33%
polyz_unpack_17_native_aarch64 ✅ 2s 2s +0%
polyz_unpack_native_x86_64 ✅ 2s 3s -33%
power2round ✅ 2s 2s +0%
shake128_absorb ✅ 2s 2s +0%
shake128_squeeze ✅ 2s 3s -33%
shake128x4_absorb_once ✅ 2s 2s +0%
shake256x4_absorb_once ✅ 2s 2s +0%
sk_s1hat_get_poly ✅ 2s 3s -33%
sys_check_capability ✅ 2s 1s +100%
unpack_sk ✅ 2s 3s -33%
unpack_sk_s2hat ✅ 2s 3s -33%
keccak_f1600_x1_native_aarch64_v84a ✅ 1s 2s -50%
keccak_f1600_x4_native_avx2 ✅ 1s 2s -50%
keccak_finalize ✅ 1s 2s -50%
keccakf1600_xor_bytes ✅ 1s 4s -75%
make_hint ✅ 1s 3s -67%
mld_ct_cmask_neg_i32 ✅ 1s 3s -67%
mld_ct_get_optblocker_i64 ✅ 1s 1s +0%
mld_ct_sel_int32 ✅ 1s 2s -50%
mld_value_barrier_u32 ✅ 1s 4s -75%
poly_permute_bitrev_to_custom_optional ✅ 1s 3s -67%
poly_permute_bitrev_to_custom_optional_native ✅ 1s 3s -67%
polyeta_pack ✅ 1s 1s +0%
shake128x4_squeezeblocks ✅ 1s 2s -50%
sk_t0hat_get_poly ✅ 1s 1s +0%
unpack_pk_t1 ✅ 1s 2s -50%
unpack_sk_t0hat ✅ 1s 4s -75%

@oqs-bot

oqs-bot commented Jun 29, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

CBMC Results (ML-DSA-87, REDUCE-RAM)

Full Results (205 proofs)
Proof Status Current Previous Change
**TOTAL** ✅ 1402s 1436s -2.4%
polyvec_matrix_pointwise_montgomery_yvec ✅ 193s 196s -2%
poly_pointwise_montgomery_c ✅ 112s 125s -10%
mld_invntt_layer ✅ 104s 111s -6%
mld_ntt_layer ✅ 42s 44s -5%
fqmul ✅ 39s 39s +0%
mld_attempt_signature_generation ✅ 35s 34s +3%
polyvecl_chknorm ✅ 35s 38s -8%
sign_verify_internal ✅ 28s 47s -40%
keccakf1600x4_permute_native ✅ 22s 25s -12%
mld_ntt_butterfly_block ✅ 21s 23s -9%
poly_ntt_c ✅ 20s 19s +5%
polyeta_unpack ✅ 14s 13s +8%
rej_uniform_c ✅ 14s 18s -22%
mld_check_pct ✅ 12s 15s -20%
poly_chknorm_c ✅ 12s 13s -8%
poly_uniform_eta_4x ✅ 12s 12s +0%
polyt0_unpack ✅ 12s 14s -14%
polyvec_matrix_pointwise_montgomery_row ✅ 12s 13s -8%
polyveck_decompose ✅ 12s 12s +0%
compute_pack_t0_t1 ✅ 11s 12s -8%
keccak_absorb_once_x4 ✅ 10s 8s +25%
poly_invntt_tomont_c ✅ 10s 9s +11%
polyveck_chknorm ✅ 10s 9s +11%
polyz_unpack_c ✅ 10s 7s +43%
polyveck_reduce ✅ 9s 6s +50%
mld_keccakf1600_permute_c ✅ 8s 8s +0%
pointwise_acc_native_x86_64 ✅ 8s 8s +0%
poly_challenge ✅ 8s 4s +100%
poly_reduce ✅ 8s 4s +100%
polyveck_caddq ✅ 8s 8s +0%
polyvecl_ntt ✅ 8s 8s +0%
rej_uniform ✅ 8s 7s +14%
mld_sample_s1_s2 ✅ 7s 8s -12%
poly_add ✅ 7s 8s -12%
poly_decompose_c ✅ 7s 6s +17%
sign_keypair ✅ 7s 4s +75%
mld_compute_pack_z ✅ 6s 6s +0%
mld_h ✅ 6s 2s +200%
pointwise_acc_native_aarch64 ✅ 6s 5s +20%
poly_caddq_c ✅ 6s 3s +100%
poly_shiftl ✅ 6s 4s +50%
polyvecl_uniform_gamma1 ✅ 6s 3s +100%
keccak_finalize ✅ 5s 1s +400%
keccak_squeezeblocks_x4 ✅ 5s 4s +25%
keccakf1600_permute_native ✅ 5s 3s +67%
mld_value_barrier_u32 ✅ 5s 3s +67%
pack_sk_rho_key_tr_s2 ✅ 5s 2s +150%
poly_chknorm ✅ 5s 4s +25%
poly_chknorm_native_x86_64 ✅ 5s 2s +150%
poly_power2round ✅ 5s 7s -29%
sign_pk_from_sk ✅ 5s 6s -17%
sign_signature ✅ 5s 4s +25%
sign_signature_internal ✅ 5s 3s +67%
sign_signature_pre_hash_shake256 ✅ 5s 3s +67%
decompose ✅ 4s 2s +100%
keccakf1600x4_extract_bytes_native ✅ 4s 4s +0%
mld_sample_s1_s2_serial ✅ 4s 6s -33%
mld_value_barrier_u8 ✅ 4s 2s +100%
nttunpack_native_x86_64 ✅ 4s 3s +33%
pack_sig_z ✅ 4s 3s +33%
pointwise_native_aarch64 ✅ 4s 4s +0%
pointwise_native_x86_64 ✅ 4s 5s -20%
poly_caddq_native_x86_64 ✅ 4s 3s +33%
poly_decompose ✅ 4s 2s +100%
poly_decompose_32_native_aarch64 ✅ 4s 3s +33%
poly_decompose_native_x86_64 ✅ 4s 3s +33%
poly_invntt_tomont ✅ 4s 4s +0%
poly_invntt_tomont_native ✅ 4s 2s +100%
poly_ntt ✅ 4s 2s +100%
poly_ntt_native ✅ 4s 4s +0%
poly_uniform ✅ 4s 4s +0%
poly_uniform_gamma1_4x ✅ 4s 3s +33%
poly_use_hint_native ✅ 4s 1s +300%
poly_use_hint_native_aarch64 ✅ 4s 3s +33%
polyt0_pack ✅ 4s 3s +33%
polyt1_unpack ✅ 4s 3s +33%
polyvecl_pack_eta ✅ 4s 2s +100%
polyvecl_unpack_eta ✅ 4s 3s +33%
polyz_pack ✅ 4s 4s +0%
rej_eta_native ✅ 4s 4s +0%
shake256_absorb ✅ 4s 3s +33%
sign_keypair_internal ✅ 4s 6s -33%
sign_verify_extmu ✅ 4s 4s +0%
sign_verify_pre_hash_shake256 ✅ 4s 7s -43%
sk_s1hat_get_poly ✅ 4s 3s +33%
unpack_sk_s2hat ✅ 4s 3s +33%
caddq ✅ 3s 3s +0%
intt_native_x86_64 ✅ 3s 4s -25%
keccak_init ✅ 3s 1s +200%
keccak_squeeze ✅ 3s 5s -40%
keccakf1600_extract_bytes (big endian) ✅ 3s 3s +0%
keccakf1600_permute ✅ 3s 2s +50%
keccakf1600_xor_bytes (big endian) ✅ 3s 2s +50%
keccakf1600x4_extract_bytes ✅ 3s 1s +200%
mld_ct_cmask_nonzero_u32 ✅ 3s 5s -40%
mld_ct_get_optblocker_i64 ✅ 3s 2s +50%
mld_ct_get_optblocker_u32 ✅ 3s 2s +50%
mld_ct_get_optblocker_u8 ✅ 3s 3s +0%
mld_keccakf1600x4_xor_bytes_c ✅ 3s 1s +200%
mld_polymat_expand_entry ✅ 3s 4s -25%
mld_prepare_domain_separation_prefix ✅ 3s 3s +0%
poly_caddq_native ✅ 3s 3s +0%
poly_chknorm_native_aarch64 ✅ 3s 5s -40%
poly_decompose_88_native_aarch64 ✅ 3s 2s +50%
poly_decompose_native ✅ 3s 2s +50%
poly_permute_bitrev_to_custom_optional ✅ 3s 2s +50%
poly_pointwise_montgomery ✅ 3s 3s +0%
poly_pointwise_montgomery_native ✅ 3s 3s +0%
poly_sub ✅ 3s 5s -40%
poly_uniform_4x ✅ 3s 3s +0%
poly_uniform_eta ✅ 3s 5s -40%
poly_uniform_gamma1 ✅ 3s 3s +0%
poly_use_hint ✅ 3s 4s -25%
poly_use_hint_c ✅ 3s 4s -25%
polyeta_pack ✅ 3s 3s +0%
polyt1_pack ✅ 3s 5s -40%
polyvec_matrix_expand ✅ 3s 3s +0%
polyveck_invntt_tomont ✅ 3s 4s -25%
polyveck_ntt ✅ 3s 3s +0%
polyveck_pack_w1 ✅ 3s 3s +0%
polyveck_unpack_eta ✅ 3s 3s +0%
polyvecl_pointwise_acc_montgomery_c ✅ 3s 2s +50%
polyw1_pack_88 ✅ 3s 2s +50%
polyz_unpack ✅ 3s 3s +0%
polyz_unpack_17_native_aarch64 ✅ 3s 4s -25%
polyz_unpack_19_native_aarch64 ✅ 3s 5s -40%
power2round ✅ 3s 3s +0%
rej_eta ✅ 3s 2s +50%
rej_uniform_native ✅ 3s 5s -40%
rej_uniform_native_aarch64 ✅ 3s 3s +0%
shake128_absorb ✅ 3s 2s +50%
shake128_finalize ✅ 3s 2s +50%
shake256 ✅ 3s 3s +0%
shake256_finalize ✅ 3s 3s +0%
shake256x4_squeezeblocks ✅ 3s 4s -25%
sig_unpack_hints ✅ 3s 4s -25%
sign_signature_extmu ✅ 3s 4s -25%
sign_verify ✅ 3s 2s +50%
sign_verify_pre_hash_internal ✅ 3s 3s +0%
unpack_pk_t1 ✅ 3s 2s +50%
unpack_sk ✅ 3s 4s -25%
unpack_sk_s1hat ✅ 3s 3s +0%
unpack_sk_t0hat ✅ 3s 4s -25%
yvec_init ✅ 3s 4s -25%
fqscale ✅ 2s 1s +100%
intt_native_aarch64 ✅ 2s 4s -50%
keccak_absorb ✅ 2s 4s -50%
keccak_f1600_x1_native_aarch64 ✅ 2s 2s +0%
keccak_f1600_x1_native_aarch64_v84a ✅ 2s 2s +0%
keccak_f1600_x4_native_aarch64_v84a ✅ 2s 1s +100%
keccak_f1600_x4_native_aarch64_v8a_scalar_hybrid ✅ 2s 2s +0%
keccak_f1600_x4_native_aarch64_v8a_v84a_scalar_hybrid ✅ 2s 2s +0%
keccakf1600_xor_bytes ✅ 2s 1s +100%
keccakf1600x4_xor_bytes ✅ 2s 1s +100%
keccakf1600x4_xor_bytes_native ✅ 2s 2s +0%
make_hint ✅ 2s 2s +0%
mld_ct_abs_i32 ✅ 2s 1s +100%
mld_ct_memcmp ✅ 2s 1s +100%
mld_ct_sel_int32 ✅ 2s 2s +0%
mld_keccakf1600_extract_bytes ✅ 2s 1s +100%
mld_keccakf1600x4_extract_bytes_c ✅ 2s 3s -33%
mld_value_barrier_i64 ✅ 2s 2s +0%
montgomery_reduce ✅ 2s 2s +0%
ntt_native_aarch64 ✅ 2s 4s -50%
pack_sig_c ✅ 2s 2s +0%
pack_sig_h ✅ 2s 3s -33%
pack_sk_s1 ✅ 2s 2s +0%
poly_caddq ✅ 2s 5s -60%
poly_caddq_native_aarch64 ✅ 2s 3s -33%
poly_chknorm_native ✅ 2s 1s +100%
poly_use_hint_native_x86_64 ✅ 2s - new
polyveck_pack_eta ✅ 2s 5s -60%
polyvecl_pointwise_acc_montgomery ✅ 2s 2s +0%
polyvecl_pointwise_acc_montgomery_native ✅ 2s 2s +0%
polyvecl_unpack_z ✅ 2s 3s -33%
polyw1_pack ✅ 2s 2s +0%
polyw1_pack_32 ✅ 2s 3s -33%
polyz_unpack_native ✅ 2s 1s +100%
polyz_unpack_native_x86_64 ✅ 2s 3s -33%
reduce32 ✅ 2s 3s -33%
rej_eta_c ✅ 2s 4s -50%
rej_uniform_eta_native_aarch64 ✅ 2s 3s -33%
shake128_init ✅ 2s 2s +0%
shake128_squeeze ✅ 2s 1s +100%
shake128x4_squeezeblocks ✅ 2s 1s +100%
shake256_init ✅ 2s 3s -33%
shake256_squeeze ✅ 2s 2s +0%
sign_signature_pre_hash_internal ✅ 2s 2s +0%
sk_s2hat_get_poly ✅ 2s 2s +0%
sk_t0hat_get_poly ✅ 2s 3s -33%
sys_check_capability ✅ 2s 2s +0%
use_hint ✅ 2s 3s -33%
keccak_f1600_x4_native_avx2 ✅ 1s 3s -67%
keccakf1600x4_permute ✅ 1s 2s -50%
mld_ct_cmask_neg_i32 ✅ 1s 2s -50%
mld_ct_cmask_nonzero_u8 ✅ 1s 2s -50%
ntt_native_x86_64 ✅ 1s 2s -50%
poly_permute_bitrev_to_custom_optional_native ✅ 1s 3s -67%
polyvec_matrix_expand_serial ✅ 1s 3s -67%
polyvecl_uniform_gamma1_serial ✅ 1s 2s -50%
shake128_release ✅ 1s 3s -67%
shake128x4_absorb_once ✅ 1s 4s -75%
shake256_release ✅ 1s 5s -80%
shake256x4_absorb_once ✅ 1s 5s -80%
yvec_get_poly ✅ 1s 2s -50%

@oqs-bot

oqs-bot commented Jun 29, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

CBMC Results (ML-DSA-65)

Full Results (205 proofs)
Proof Status Current Previous Change
**TOTAL** ✅ 1773s 1784s -0.6%
polyvecl_pointwise_acc_montgomery_c ✅ 219s 210s +4%
sign_verify_internal ✅ 130s 177s -27%
poly_pointwise_montgomery_c ✅ 122s 125s -2%
mld_invntt_layer ✅ 107s 109s -2%
polyvec_matrix_expand ✅ 107s 110s -3%
mld_attempt_signature_generation ✅ 64s 63s +2%
sign_signature_internal ✅ 45s 55s -18%
mld_ntt_layer ✅ 43s 41s +5%
fqmul ✅ 39s 40s -3%
polyvec_matrix_expand_serial ✅ 27s 27s +0%
mld_ntt_butterfly_block ✅ 24s 24s +0%
keccakf1600x4_permute_native ✅ 23s 23s +0%
poly_ntt_c ✅ 19s 19s +0%
polyvec_matrix_pointwise_montgomery_yvec ✅ 19s 18s +6%
mld_check_pct ✅ 17s 14s +21%
poly_chknorm_c ✅ 16s 15s +7%
rej_uniform_c ✅ 16s 14s +14%
poly_uniform_4x ✅ 15s 13s +15%
polyt0_unpack ✅ 15s 16s -6%
rej_uniform ✅ 15s 18s -17%
poly_uniform_eta_4x ✅ 14s 14s +0%
compute_pack_t0_t1 ✅ 13s 13s +0%
polyveck_decompose ✅ 13s 12s +8%
poly_invntt_tomont_c ✅ 12s 11s +9%
polyz_unpack_c ✅ 11s 13s -15%
keccak_absorb_once_x4 ✅ 9s 8s +12%
polyveck_invntt_tomont ✅ 9s 8s +12%
poly_add ✅ 8s 9s -11%
mld_keccakf1600_permute_c ✅ 7s 6s +17%
ntt_native_x86_64 ✅ 7s 2s +250%
poly_decompose_c ✅ 7s 5s +40%
poly_use_hint_c ✅ 7s 5s +40%
polyeta_unpack ✅ 7s 8s -12%
polyt0_pack ✅ 7s 3s +133%
polyveck_caddq ✅ 7s 6s +17%
mld_compute_pack_z ✅ 6s 7s -14%
pointwise_acc_native_aarch64 ✅ 6s 6s +0%
poly_caddq_native_x86_64 ✅ 6s 3s +100%
poly_challenge ✅ 6s 6s +0%
polyveck_ntt ✅ 6s 7s -14%
polyw1_pack ✅ 6s 4s +50%
sign_keypair_internal ✅ 6s 5s +20%
sign_pk_from_sk ✅ 6s 6s +0%
keccakf1600_extract_bytes (big endian) ✅ 5s 2s +150%
keccakf1600x4_xor_bytes ✅ 5s 1s +400%
mld_h ✅ 5s 2s +150%
mld_sample_s1_s2 ✅ 5s 6s -17%
pointwise_acc_native_x86_64 ✅ 5s 8s -38%
poly_invntt_tomont_native ✅ 5s 2s +150%
poly_permute_bitrev_to_custom_optional_native ✅ 5s 4s +25%
poly_power2round ✅ 5s 4s +25%
poly_uniform_gamma1 ✅ 5s 3s +67%
polyt1_unpack ✅ 5s 5s +0%
polyvec_matrix_pointwise_montgomery_row ✅ 5s 1s +400%
polyveck_chknorm ✅ 5s 6s -17%
polyveck_unpack_eta ✅ 5s 6s -17%
polyvecl_ntt ✅ 5s 4s +25%
rej_uniform_native ✅ 5s 4s +25%
sign_keypair ✅ 5s 3s +67%
sign_signature_extmu ✅ 5s 2s +150%
sign_signature_pre_hash_internal ✅ 5s 3s +67%
sign_signature_pre_hash_shake256 ✅ 5s 3s +67%
sign_verify_extmu ✅ 5s 3s +67%
unpack_sk ✅ 5s 3s +67%
unpack_sk_t0hat ✅ 5s 5s +0%
decompose ✅ 4s 1s +300%
intt_native_x86_64 ✅ 4s 3s +33%
keccak_absorb ✅ 4s 3s +33%
keccak_squeezeblocks_x4 ✅ 4s 5s -20%
keccakf1600x4_extract_bytes ✅ 4s 4s +0%
make_hint ✅ 4s 2s +100%
mld_ct_cmask_nonzero_u32 ✅ 4s 4s +0%
mld_ct_memcmp ✅ 4s 2s +100%
mld_sample_s1_s2_serial ✅ 4s 4s +0%
pack_sk_rho_key_tr_s2 ✅ 4s 2s +100%
pack_sk_s1 ✅ 4s 5s -20%
pointwise_native_x86_64 ✅ 4s 3s +33%
poly_caddq_c ✅ 4s 2s +100%
poly_caddq_native ✅ 4s 2s +100%
poly_chknorm ✅ 4s 4s +0%
poly_pointwise_montgomery ✅ 4s 3s +33%
poly_pointwise_montgomery_native ✅ 4s 3s +33%
poly_reduce ✅ 4s 3s +33%
poly_shiftl ✅ 4s 3s +33%
poly_uniform ✅ 4s 4s +0%
poly_uniform_eta ✅ 4s 4s +0%
polyt1_pack ✅ 4s 3s +33%
polyvecl_chknorm ✅ 4s 7s -43%
polyvecl_pack_eta ✅ 4s 3s +33%
polyvecl_uniform_gamma1_serial ✅ 4s 3s +33%
polyz_unpack_native ✅ 4s 4s +0%
rej_eta ✅ 4s 2s +100%
rej_eta_c ✅ 4s 5s -20%
rej_uniform_eta_native_aarch64 ✅ 4s 4s +0%
sk_s1hat_get_poly ✅ 4s 6s -33%
unpack_sk_s2hat ✅ 4s 4s +0%
caddq ✅ 3s 3s +0%
fqscale ✅ 3s 3s +0%
intt_native_aarch64 ✅ 3s 3s +0%
keccak_f1600_x1_native_aarch64_v84a ✅ 3s 3s +0%
keccak_f1600_x4_native_aarch64_v84a ✅ 3s 4s -25%
keccak_f1600_x4_native_aarch64_v8a_scalar_hybrid ✅ 3s 2s +50%
keccakf1600_permute_native ✅ 3s 3s +0%
keccakf1600_xor_bytes (big endian) ✅ 3s 2s +50%
keccakf1600x4_xor_bytes_native ✅ 3s 3s +0%
mld_ct_abs_i32 ✅ 3s 2s +50%
mld_ct_cmask_neg_i32 ✅ 3s 2s +50%
mld_ct_cmask_nonzero_u8 ✅ 3s 3s +0%
mld_ct_get_optblocker_i64 ✅ 3s 2s +50%
mld_keccakf1600_extract_bytes ✅ 3s 1s +200%
mld_polymat_expand_entry ✅ 3s 4s -25%
mld_prepare_domain_separation_prefix ✅ 3s 2s +50%
mld_value_barrier_i64 ✅ 3s 2s +50%
mld_value_barrier_u8 ✅ 3s 3s +0%
montgomery_reduce ✅ 3s 4s -25%
nttunpack_native_x86_64 ✅ 3s 3s +0%
pack_sig_c ✅ 3s 5s -40%
pack_sig_h ✅ 3s 5s -40%
pack_sig_z ✅ 3s 2s +50%
poly_caddq ✅ 3s 2s +50%
poly_caddq_native_aarch64 ✅ 3s 2s +50%
poly_chknorm_native ✅ 3s 2s +50%
poly_chknorm_native_x86_64 ✅ 3s 3s +0%
poly_decompose ✅ 3s 2s +50%
poly_decompose_32_native_aarch64 ✅ 3s 3s +0%
poly_decompose_88_native_aarch64 ✅ 3s 1s +200%
poly_decompose_native_x86_64 ✅ 3s 3s +0%
poly_ntt ✅ 3s 2s +50%
poly_ntt_native ✅ 3s 4s -25%
poly_permute_bitrev_to_custom_optional ✅ 3s 2s +50%
poly_sub ✅ 3s 3s +0%
poly_uniform_gamma1_4x ✅ 3s 4s -25%
poly_use_hint_native_aarch64 ✅ 3s 3s +0%
polyeta_pack ✅ 3s 3s +0%
polyveck_pack_eta ✅ 3s 4s -25%
polyveck_pack_w1 ✅ 3s 3s +0%
polyvecl_pointwise_acc_montgomery ✅ 3s 3s +0%
polyvecl_pointwise_acc_montgomery_native ✅ 3s 2s +50%
polyvecl_unpack_z ✅ 3s 3s +0%
polyw1_pack_88 ✅ 3s 2s +50%
polyz_unpack ✅ 3s 3s +0%
polyz_unpack_17_native_aarch64 ✅ 3s 3s +0%
polyz_unpack_native_x86_64 ✅ 3s 3s +0%
rej_uniform_native_aarch64 ✅ 3s 3s +0%
shake128_absorb ✅ 3s 2s +50%
shake128_init ✅ 3s 2s +50%
shake128_release ✅ 3s 3s +0%
shake128_squeeze ✅ 3s 2s +50%
shake128x4_absorb_once ✅ 3s 3s +0%
shake256_init ✅ 3s 2s +50%
shake256_release ✅ 3s 2s +50%
shake256_squeeze ✅ 3s 3s +0%
sign_signature ✅ 3s 6s -50%
sign_verify ✅ 3s 3s +0%
sign_verify_pre_hash_shake256 ✅ 3s 5s -40%
use_hint ✅ 3s 2s +50%
yvec_init ✅ 3s 3s +0%
keccak_f1600_x1_native_aarch64 ✅ 2s 2s +0%
keccak_f1600_x4_native_avx2 ✅ 2s 2s +0%
keccak_finalize ✅ 2s 2s +0%
keccak_init ✅ 2s 1s +100%
keccakf1600_permute ✅ 2s 2s +0%
keccakf1600x4_extract_bytes_native ✅ 2s 4s -50%
mld_ct_get_optblocker_u8 ✅ 2s 2s +0%
mld_ct_sel_int32 ✅ 2s 3s -33%
mld_keccakf1600x4_extract_bytes_c ✅ 2s 3s -33%
mld_keccakf1600x4_xor_bytes_c ✅ 2s 2s +0%
mld_value_barrier_u32 ✅ 2s 3s -33%
ntt_native_aarch64 ✅ 2s 2s +0%
pointwise_native_aarch64 ✅ 2s 5s -60%
poly_chknorm_native_aarch64 ✅ 2s 3s -33%
poly_invntt_tomont ✅ 2s 3s -33%
poly_use_hint ✅ 2s 3s -33%
poly_use_hint_native ✅ 2s 2s +0%
poly_use_hint_native_x86_64 ✅ 2s - new
polyveck_reduce ✅ 2s 4s -50%
polyvecl_uniform_gamma1 ✅ 2s 2s +0%
polyw1_pack_32 ✅ 2s 4s -50%
polyz_pack ✅ 2s 3s -33%
polyz_unpack_19_native_aarch64 ✅ 2s 3s -33%
power2round ✅ 2s 1s +100%
reduce32 ✅ 2s 3s -33%
rej_eta_native ✅ 2s 3s -33%
shake128_finalize ✅ 2s 1s +100%
shake128x4_squeezeblocks ✅ 2s 3s -33%
shake256 ✅ 2s 2s +0%
shake256_absorb ✅ 2s 2s +0%
shake256_finalize ✅ 2s 1s +100%
shake256x4_absorb_once ✅ 2s 3s -33%
sig_unpack_hints ✅ 2s 2s +0%
sign_verify_pre_hash_internal ✅ 2s 5s -60%
sk_s2hat_get_poly ✅ 2s 2s +0%
sk_t0hat_get_poly ✅ 2s 2s +0%
sys_check_capability ✅ 2s 4s -50%
unpack_pk_t1 ✅ 2s 5s -60%
unpack_sk_s1hat ✅ 2s 2s +0%
yvec_get_poly ✅ 2s 3s -33%
keccak_f1600_x4_native_aarch64_v8a_v84a_scalar_hybrid ✅ 1s 2s -50%
keccak_squeeze ✅ 1s 4s -75%
keccakf1600_xor_bytes ✅ 1s 2s -50%
keccakf1600x4_permute ✅ 1s 4s -75%
mld_ct_get_optblocker_u32 ✅ 1s 3s -67%
poly_decompose_native ✅ 1s 3s -67%
polyvecl_unpack_eta ✅ 1s 3s -67%
shake256x4_squeezeblocks ✅ 1s 2s -50%

@oqs-bot

oqs-bot commented Jun 29, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

CBMC Results (ML-DSA-87)

⚠️ Attention Required

Proof Status Current Previous Change
sign_verify_internal ⚠️ 285s 97s +194%
Full Results (205 proofs)
Proof Status Current Previous Change
**TOTAL** ✅ 2240s 2151s +4.1%
polyvecl_pointwise_acc_montgomery_c ✅ 335s 353s -5%
sign_verify_internal ⚠️ 285s 97s +194%
polyvec_matrix_expand ✅ 284s 324s -12%
poly_pointwise_montgomery_c ✅ 125s 144s -13%
mld_invntt_layer ✅ 109s 115s -5%
sign_signature_internal ✅ 55s 42s +31%
mld_attempt_signature_generation ✅ 52s 55s -5%
mld_ntt_layer ✅ 43s 45s -4%
fqmul ✅ 41s 43s -5%
polyvec_matrix_expand_serial ✅ 36s 38s -5%
keccakf1600x4_permute_native ✅ 23s 23s +0%
compute_pack_t0_t1 ✅ 22s 19s +16%
mld_ntt_butterfly_block ✅ 21s 24s -12%
polyvec_matrix_pointwise_montgomery_yvec ✅ 19s 18s +6%
poly_ntt_c ✅ 18s 21s -14%
rej_uniform ✅ 17s 15s +13%
poly_invntt_tomont_c ✅ 16s 12s +33%
polyeta_unpack ✅ 16s 17s -6%
poly_chknorm_c ✅ 15s 15s +0%
polyt0_unpack ✅ 14s 14s +0%
poly_uniform_4x ✅ 13s 13s +0%
rej_uniform_c ✅ 13s 19s -32%
polyveck_decompose ✅ 12s 13s -8%
mld_check_pct ✅ 11s 16s -31%
poly_uniform_eta_4x ✅ 11s 11s +0%
mld_compute_pack_z ✅ 10s 8s +25%
keccak_absorb_once_x4 ✅ 9s 9s +0%
polyveck_invntt_tomont ✅ 8s 9s -11%
polyveck_ntt ✅ 8s 11s -27%
sign_pk_from_sk ✅ 8s 6s +33%
mld_keccakf1600_permute_c ✅ 7s 7s +0%
mld_sample_s1_s2 ✅ 7s 6s +17%
mld_value_barrier_u8 ✅ 7s 3s +133%
pointwise_acc_native_aarch64 ✅ 7s 6s +17%
poly_decompose_c ✅ 7s 5s +40%
poly_invntt_tomont_native ✅ 7s 5s +40%
polyveck_caddq ✅ 7s 8s -12%
sign_verify_pre_hash_shake256 ✅ 7s 3s +133%
keccak_squeezeblocks_x4 ✅ 6s 4s +50%
pointwise_acc_native_x86_64 ✅ 6s 6s +0%
polyt0_pack ✅ 6s 4s +50%
polyvecl_ntt ✅ 6s 7s -14%
polyvecl_uniform_gamma1 ✅ 6s 2s +200%
sk_s1hat_get_poly ✅ 6s 3s +100%
unpack_sk_t0hat ✅ 6s 7s -14%
keccak_absorb ✅ 5s 3s +67%
keccakf1600_xor_bytes ✅ 5s 3s +67%
mld_h ✅ 5s 3s +67%
mld_sample_s1_s2_serial ✅ 5s 8s -38%
pack_sk_rho_key_tr_s2 ✅ 5s 3s +67%
poly_add ✅ 5s 6s -17%
poly_caddq ✅ 5s 2s +150%
poly_caddq_native_x86_64 ✅ 5s 2s +150%
poly_chknorm ✅ 5s 3s +67%
poly_shiftl ✅ 5s 4s +25%
poly_use_hint_native_x86_64 ✅ 5s - new
polyeta_pack ✅ 5s 4s +25%
polyvecl_pointwise_acc_montgomery ✅ 5s 5s +0%
polyvecl_unpack_z ✅ 5s 4s +25%
power2round ✅ 5s 4s +25%
shake128x4_absorb_once ✅ 5s 5s +0%
sign_keypair ✅ 5s 4s +25%
sign_signature_extmu ✅ 5s 4s +25%
decompose ✅ 4s 3s +33%
fqscale ✅ 4s 3s +33%
keccak_f1600_x1_native_aarch64 ✅ 4s 1s +300%
keccak_f1600_x4_native_avx2 ✅ 4s 2s +100%
keccak_finalize ✅ 4s 1s +300%
mld_ct_abs_i32 ✅ 4s 3s +33%
mld_ct_get_optblocker_u8 ✅ 4s 3s +33%
mld_ct_sel_int32 ✅ 4s 3s +33%
mld_keccakf1600x4_xor_bytes_c ✅ 4s 4s +0%
ntt_native_aarch64 ✅ 4s 6s -33%
ntt_native_x86_64 ✅ 4s 2s +100%
pack_sig_c ✅ 4s 4s +0%
poly_caddq_c ✅ 4s 3s +33%
poly_decompose_88_native_aarch64 ✅ 4s 2s +100%
poly_ntt ✅ 4s 3s +33%
poly_pointwise_montgomery_native ✅ 4s 5s -20%
poly_power2round ✅ 4s 3s +33%
poly_uniform ✅ 4s 4s +0%
poly_use_hint_c ✅ 4s 2s +100%
poly_use_hint_native_aarch64 ✅ 4s 2s +100%
polyt1_pack ✅ 4s 3s +33%
polyt1_unpack ✅ 4s 4s +0%
polyvec_matrix_pointwise_montgomery_row ✅ 4s 3s +33%
polyveck_unpack_eta ✅ 4s 4s +0%
polyvecl_uniform_gamma1_serial ✅ 4s 4s +0%
polyw1_pack_32 ✅ 4s 4s +0%
polyz_unpack_17_native_aarch64 ✅ 4s 3s +33%
polyz_unpack_native ✅ 4s 4s +0%
rej_eta ✅ 4s 4s +0%
rej_eta_c ✅ 4s 5s -20%
rej_eta_native ✅ 4s 6s -33%
rej_uniform_eta_native_aarch64 ✅ 4s 5s -20%
rej_uniform_native_aarch64 ✅ 4s 2s +100%
shake256x4_squeezeblocks ✅ 4s 1s +300%
sign_signature_pre_hash_internal ✅ 4s 5s -20%
sign_verify_extmu ✅ 4s 3s +33%
sk_s2hat_get_poly ✅ 4s 3s +33%
caddq ✅ 3s 4s -25%
intt_native_aarch64 ✅ 3s 3s +0%
intt_native_x86_64 ✅ 3s 3s +0%
keccak_f1600_x1_native_aarch64_v84a ✅ 3s 1s +200%
keccak_f1600_x4_native_aarch64_v8a_v84a_scalar_hybrid ✅ 3s 4s -25%
keccak_init ✅ 3s 3s +0%
keccakf1600_extract_bytes (big endian) ✅ 3s 3s +0%
keccakf1600x4_extract_bytes ✅ 3s 2s +50%
make_hint ✅ 3s 3s +0%
mld_ct_cmask_neg_i32 ✅ 3s 4s -25%
mld_ct_cmask_nonzero_u32 ✅ 3s 2s +50%
mld_ct_get_optblocker_u32 ✅ 3s 2s +50%
mld_ct_memcmp ✅ 3s 3s +0%
mld_polymat_expand_entry ✅ 3s 3s +0%
mld_prepare_domain_separation_prefix ✅ 3s 4s -25%
mld_value_barrier_i64 ✅ 3s 1s +200%
mld_value_barrier_u32 ✅ 3s 2s +50%
pack_sig_h ✅ 3s 4s -25%
poly_caddq_native ✅ 3s 4s -25%
poly_challenge ✅ 3s 5s -40%
poly_chknorm_native_aarch64 ✅ 3s 4s -25%
poly_decompose ✅ 3s 3s +0%
poly_decompose_32_native_aarch64 ✅ 3s 5s -40%
poly_decompose_native ✅ 3s 2s +50%
poly_decompose_native_x86_64 ✅ 3s 2s +50%
poly_invntt_tomont ✅ 3s 1s +200%
poly_ntt_native ✅ 3s 3s +0%
poly_permute_bitrev_to_custom_optional_native ✅ 3s 5s -40%
poly_reduce ✅ 3s 2s +50%
poly_sub ✅ 3s 3s +0%
poly_uniform_eta ✅ 3s 4s -25%
polyveck_chknorm ✅ 3s 3s +0%
polyveck_pack_eta ✅ 3s 6s -50%
polyvecl_chknorm ✅ 3s 7s -57%
polyvecl_pack_eta ✅ 3s 3s +0%
polyvecl_unpack_eta ✅ 3s 5s -40%
polyw1_pack_88 ✅ 3s 3s +0%
polyz_pack ✅ 3s 5s -40%
polyz_unpack_19_native_aarch64 ✅ 3s 4s -25%
polyz_unpack_native_x86_64 ✅ 3s 3s +0%
rej_uniform_native ✅ 3s 8s -62%
shake128_absorb ✅ 3s 4s -25%
shake128_finalize ✅ 3s 2s +50%
shake128_release ✅ 3s 4s -25%
shake256_init ✅ 3s 2s +50%
shake256x4_absorb_once ✅ 3s 2s +50%
sign_keypair_internal ✅ 3s 6s -50%
sign_signature ✅ 3s 5s -40%
sign_signature_pre_hash_shake256 ✅ 3s 6s -50%
sign_verify ✅ 3s 5s -40%
sign_verify_pre_hash_internal ✅ 3s 3s +0%
sk_t0hat_get_poly ✅ 3s 4s -25%
unpack_pk_t1 ✅ 3s 1s +200%
unpack_sk ✅ 3s 5s -40%
unpack_sk_s1hat ✅ 3s 2s +50%
yvec_get_poly ✅ 3s 4s -25%
keccak_squeeze ✅ 2s 2s +0%
keccakf1600_permute_native ✅ 2s 4s -50%
keccakf1600_xor_bytes (big endian) ✅ 2s 2s +0%
keccakf1600x4_extract_bytes_native ✅ 2s 2s +0%
keccakf1600x4_permute ✅ 2s 3s -33%
keccakf1600x4_xor_bytes ✅ 2s 3s -33%
keccakf1600x4_xor_bytes_native ✅ 2s 3s -33%
mld_ct_get_optblocker_i64 ✅ 2s 3s -33%
mld_keccakf1600_extract_bytes ✅ 2s 4s -50%
mld_keccakf1600x4_extract_bytes_c ✅ 2s 2s +0%
nttunpack_native_x86_64 ✅ 2s 3s -33%
pack_sig_z ✅ 2s 5s -60%
pack_sk_s1 ✅ 2s 1s +100%
pointwise_native_aarch64 ✅ 2s 5s -60%
pointwise_native_x86_64 ✅ 2s 2s +0%
poly_caddq_native_aarch64 ✅ 2s 3s -33%
poly_chknorm_native ✅ 2s 4s -50%
poly_permute_bitrev_to_custom_optional ✅ 2s 3s -33%
poly_pointwise_montgomery ✅ 2s 4s -50%
poly_uniform_gamma1 ✅ 2s 4s -50%
poly_uniform_gamma1_4x ✅ 2s 3s -33%
poly_use_hint ✅ 2s 1s +100%
poly_use_hint_native ✅ 2s 3s -33%
polyveck_pack_w1 ✅ 2s 3s -33%
polyvecl_pointwise_acc_montgomery_native ✅ 2s 3s -33%
polyw1_pack ✅ 2s 4s -50%
polyz_unpack ✅ 2s 2s +0%
polyz_unpack_c ✅ 2s 3s -33%
shake128_squeeze ✅ 2s 2s +0%
shake128x4_squeezeblocks ✅ 2s 3s -33%
shake256 ✅ 2s 2s +0%
shake256_absorb ✅ 2s 2s +0%
shake256_finalize ✅ 2s 2s +0%
shake256_release ✅ 2s 3s -33%
sig_unpack_hints ✅ 2s 3s -33%
unpack_sk_s2hat ✅ 2s 3s -33%
use_hint ✅ 2s 3s -33%
yvec_init ✅ 2s 4s -50%
keccak_f1600_x4_native_aarch64_v84a ✅ 1s 4s -75%
keccak_f1600_x4_native_aarch64_v8a_scalar_hybrid ✅ 1s 3s -67%
keccakf1600_permute ✅ 1s 3s -67%
mld_ct_cmask_nonzero_u8 ✅ 1s 3s -67%
montgomery_reduce ✅ 1s 3s -67%
poly_chknorm_native_x86_64 ✅ 1s 2s -50%
polyveck_reduce ✅ 1s 3s -67%
reduce32 ✅ 1s 3s -67%
shake128_init ✅ 1s 1s +0%
shake256_squeeze ✅ 1s 2s -50%
sys_check_capability ✅ 1s 3s -67%

@tob-joe tob-joe force-pushed the ptp/mldsa-reject-malformed-signing-inputs branch from 752bcdd to d60b5bd Compare July 5, 2026 23:49
tob-joe and others added 2 commits July 7, 2026 17:18
@tob-joe @codex
Reject malformed ML-DSA signing inputs
3ae19b5 
Reject short external-mu inputs before copying mu in internal signing and
verification, and reject nonzero context length with a NULL context pointer
at the domain-separation prefix boundary.

Add focused unit regression tests for the malformed external-mu and
domain-prefix cases without bundling unrelated SHAKE/output-cleanup tests.

Verification:

- pre-fix `make run_unit_44` failed after adding the targeted malformed-input
  regression test

- make run_unit_44

- make run_unit

- make run_func

Co-authored-by: Codex <codex@openai.com>
Signed-off-by: Joe Doyle <joseph.doyle@trailofbits.com>
@tob-joe @codex
Keep malformed-input unit test reduced-api safe
83c27aa 
Keep the signing-side short external-mu unit regression test enabled when the build exposes keygen and sign APIs but compiles out verification. Guard only the verify-side malformed external-mu assertion so reduced-api keygen+sign builds do not reference verify_internal.

Verification:

- pre-fix focused reduced-api unit check failed with an implicit declaration of verify_internal under MLD_CONFIG_NO_VERIFY_API

- focused reduced-api unit check passed for keygen+sign/no-verify

- focused reduced-api-reduce-ram unit check passed for keygen+sign/no-verify

- nix develop .#ci -c lint

Co-authored-by: Codex <codex@openai.com>
Signed-off-by: Joe Doyle <joseph.doyle@trailofbits.com>
@tob-joe tob-joe force-pushed the ptp/mldsa-reject-malformed-signing-inputs branch from d60b5bd to 83c27aa Compare July 7, 2026 21:30
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@tob-joe @oqs-bot