Skip to content

Add Armv8.1-M Keccak x1 backend#1277

Draft
bremoran wants to merge 5 commits into
mainfrom
armv81m-keccak-x1
Draft

Add Armv8.1-M Keccak x1 backend#1277
bremoran wants to merge 5 commits into
mainfrom
armv81m-keccak-x1

Conversation

@bremoran

@bremoran bremoran commented Jul 10, 2026

Copy link
Copy Markdown
Contributor

Add the unmodified upstream Adomnicai Armv7-M Keccak source under armv81m_clean and the Slothy-generated M7 optimized x1 permutation under armv81m_opt, with a Makefile regeneration path.

Move the Armv8.1-M FIPS202 development sources to armv81m_opt and synchronize the production backend. Route x1 state XOR/extract through the clean-source assembly helpers so the optimized permutation can keep the state in the bit-interleaved native representation.

Keep the test changes focused on representation-aware Keccak x1/x4 unit coverage, including extracted-byte state dumps on x1 failures, and the static ML-DSA-87 unit-test workspace needed for Zephyr stack pressure.

@bremoran bremoran requested a review from a team as a code owner July 10, 2026 08:11
@mkannwischer mkannwischer marked this pull request as draft July 10, 2026 08:18
@oqs-bot

oqs-bot commented Jul 10, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

CBMC Results (ML-DSA-44)

Full Results (206 proofs)
Proof Status Current Previous Change
**TOTAL** ✅ 1536s 1514s +1.5%
polyvecl_pointwise_acc_montgomery_c ✅ 158s 131s +21%
poly_pointwise_montgomery_c ✅ 141s 114s +24%
mld_invntt_layer ✅ 116s 107s +8%
mld_attempt_signature_generation ✅ 63s 58s +9%
compute_pack_t0_t1 ✅ 50s 50s +0%
fqmul ✅ 44s 39s +13%
mld_ntt_layer ✅ 44s 42s +5%
sign_verify_internal ✅ 39s 114s -66%
polyvec_matrix_expand ✅ 32s 28s +14%
mld_ntt_butterfly_block ✅ 23s 23s +0%
keccakf1600x4_permute_native ✅ 22s 22s +0%
poly_ntt_c ✅ 22s 19s +16%
poly_chknorm_c ✅ 17s 17s +0%
polyeta_unpack ✅ 17s 14s +21%
polyvec_matrix_pointwise_montgomery_yvec ✅ 17s 15s +13%
rej_uniform ✅ 17s 18s -6%
polyt0_unpack ✅ 16s 15s +7%
rej_uniform_c ✅ 16s 15s +7%
sign_signature_internal ✅ 15s 26s -42%
mld_check_pct ✅ 14s 14s +0%
poly_uniform_eta_4x ✅ 14s 11s +27%
polyz_unpack_c ✅ 14s 11s +27%
poly_invntt_tomont_c ✅ 13s 11s +18%
poly_uniform_4x ✅ 12s 14s -14%
polyvecl_chknorm ✅ 12s 10s +20%
rej_uniform_native_x86_64 ✅ 12s - new
keccak_absorb_once_x4 ✅ 9s 9s +0%
polyvec_matrix_expand_serial ✅ 9s 8s +12%
mld_keccakf1600_permute_c ✅ 8s 8s +0%
pointwise_acc_native_aarch64 ✅ 7s 4s +75%
sign_verify ✅ 7s 4s +75%
keccakf1600_permute ✅ 6s 2s +200%
pointwise_acc_native_x86_64 ✅ 6s 7s -14%
poly_uniform_gamma1_4x ✅ 6s 5s +20%
polyt1_unpack ✅ 6s 5s +20%
shake256_absorb ✅ 6s 3s +100%
sig_unpack_hints ✅ 6s 2s +200%
sign_pk_from_sk ✅ 6s 5s +20%
sign_signature_pre_hash_shake256 ✅ 6s 3s +100%
keccak_absorb ✅ 5s 5s +0%
mld_compute_pack_z ✅ 5s 7s -29%
mld_sample_s1_s2 ✅ 5s 4s +25%
poly_add ✅ 5s 7s -29%
poly_challenge ✅ 5s 3s +67%
polyveck_caddq ✅ 5s 3s +67%
polyveck_chknorm ✅ 5s 5s +0%
polyveck_decompose ✅ 5s 4s +25%
polyvecl_pointwise_acc_montgomery ✅ 5s 4s +25%
polyw1_pack ✅ 5s 3s +67%
sign_signature ✅ 5s 3s +67%
unpack_sk_t0hat ✅ 5s 3s +67%
fqscale ✅ 4s 3s +33%
intt_native_aarch64 ✅ 4s 9s -56%
keccak_f1600_x4_native_aarch64_v8a_scalar_hybrid ✅ 4s 3s +33%
keccak_squeezeblocks_x4 ✅ 4s 4s +0%
keccakf1600_xor_bytes ✅ 4s 1s +300%
keccakf1600x4_extract_bytes ✅ 4s 2s +100%
keccakf1600x4_permute ✅ 4s 4s +0%
keccakf1600x4_xor_bytes_native ✅ 4s 3s +33%
poly_caddq_native_x86_64 ✅ 4s 4s +0%
poly_chknorm ✅ 4s 4s +0%
poly_decompose_32_native_aarch64 ✅ 4s 2s +100%
poly_decompose_c ✅ 4s 4s +0%
poly_decompose_native ✅ 4s 3s +33%
poly_decompose_native_x86_64 ✅ 4s 3s +33%
poly_invntt_tomont ✅ 4s 4s +0%
poly_ntt ✅ 4s 3s +33%
poly_ntt_native ✅ 4s 5s -20%
poly_permute_bitrev_to_custom_optional ✅ 4s 2s +100%
poly_permute_bitrev_to_custom_optional_native ✅ 4s 4s +0%
poly_pointwise_montgomery_native ✅ 4s 2s +100%
poly_uniform ✅ 4s 6s -33%
poly_uniform_eta ✅ 4s 5s -20%
poly_use_hint ✅ 4s 4s +0%
poly_use_hint_native ✅ 4s 4s +0%
polyt0_pack ✅ 4s 2s +100%
polyveck_invntt_tomont ✅ 4s 5s -20%
polyveck_pack_eta ✅ 4s 2s +100%
polyz_unpack ✅ 4s 3s +33%
reduce32 ✅ 4s 2s +100%
rej_eta_native ✅ 4s 6s -33%
sign_keypair_internal ✅ 4s 4s +0%
sign_signature_extmu ✅ 4s 4s +0%
sign_signature_pre_hash_internal ✅ 4s 6s -33%
sign_verify_extmu ✅ 4s 3s +33%
sk_t0hat_get_poly ✅ 4s 2s +100%
sys_check_capability ✅ 4s 4s +0%
unpack_sk_s2hat ✅ 4s 4s +0%
use_hint ✅ 4s 2s +100%
caddq ✅ 3s 2s +50%
intt_native_x86_64 ✅ 3s 4s -25%
keccak_f1600_x1_native_aarch64_v84a ✅ 3s 3s +0%
keccak_finalize ✅ 3s 3s +0%
keccakf1600_xor_bytes (big endian) ✅ 3s 4s -25%
keccakf1600x4_extract_bytes_native ✅ 3s 3s +0%
make_hint ✅ 3s 3s +0%
mld_ct_get_optblocker_u32 ✅ 3s 1s +200%
mld_ct_get_optblocker_u8 ✅ 3s 1s +200%
mld_ct_sel_int32 ✅ 3s 2s +50%
mld_h ✅ 3s 4s -25%
mld_keccakf1600x4_extract_bytes_c ✅ 3s 2s +50%
mld_polymat_expand_entry ✅ 3s 3s +0%
mld_prepare_domain_separation_prefix ✅ 3s 4s -25%
mld_sample_s1_s2_serial ✅ 3s 3s +0%
montgomery_reduce ✅ 3s 3s +0%
ntt_native_aarch64 ✅ 3s 3s +0%
pack_sig_c ✅ 3s 2s +50%
pack_sk_s1 ✅ 3s 2s +50%
pointwise_native_aarch64 ✅ 3s 5s -40%
poly_caddq_native_aarch64 ✅ 3s 4s -25%
poly_chknorm_native ✅ 3s 4s -25%
poly_chknorm_native_aarch64 ✅ 3s 4s -25%
poly_chknorm_native_x86_64 ✅ 3s 2s +50%
poly_decompose_88_native_aarch64 ✅ 3s 4s -25%
poly_invntt_tomont_native ✅ 3s 4s -25%
poly_pointwise_montgomery ✅ 3s 3s +0%
poly_shiftl ✅ 3s 3s +0%
poly_sub ✅ 3s 3s +0%
poly_use_hint_c ✅ 3s 3s +0%
polyeta_pack ✅ 3s 3s +0%
polyt1_pack ✅ 3s 4s -25%
polyveck_ntt ✅ 3s 5s -40%
polyveck_pack_w1 ✅ 3s 1s +200%
polyvecl_ntt ✅ 3s 2s +50%
polyvecl_pointwise_acc_montgomery_native ✅ 3s 2s +50%
polyvecl_uniform_gamma1 ✅ 3s 3s +0%
polyvecl_unpack_eta ✅ 3s 2s +50%
polyvecl_unpack_z ✅ 3s 2s +50%
polyw1_pack_32 ✅ 3s 2s +50%
polyw1_pack_88 ✅ 3s 1s +200%
polyz_pack ✅ 3s 2s +50%
polyz_unpack_17_native_aarch64 ✅ 3s 5s -40%
polyz_unpack_native ✅ 3s 2s +50%
rej_eta ✅ 3s 3s +0%
rej_eta_c ✅ 3s 4s -25%
rej_uniform_eta_native_aarch64 ✅ 3s 2s +50%
rej_uniform_native ✅ 3s 4s -25%
rej_uniform_native_aarch64 ✅ 3s 5s -40%
shake128_finalize ✅ 3s 2s +50%
shake128_release ✅ 3s 1s +200%
shake256_finalize ✅ 3s 2s +50%
shake256_init ✅ 3s 3s +0%
sign_keypair ✅ 3s 4s -25%
sk_s1hat_get_poly ✅ 3s 3s +0%
sk_s2hat_get_poly ✅ 3s 2s +50%
unpack_sk ✅ 3s 3s +0%
unpack_sk_s1hat ✅ 3s 1s +200%
decompose ✅ 2s 2s +0%
keccak_f1600_x1_native_aarch64 ✅ 2s 2s +0%
keccak_f1600_x4_native_aarch64_v84a ✅ 2s 2s +0%
keccak_f1600_x4_native_aarch64_v8a_v84a_scalar_hybrid ✅ 2s 1s +100%
keccak_f1600_x4_native_avx2 ✅ 2s 3s -33%
keccak_init ✅ 2s 3s -33%
keccak_squeeze ✅ 2s 1s +100%
keccakf1600x4_xor_bytes ✅ 2s 2s +0%
mld_ct_abs_i32 ✅ 2s 2s +0%
mld_ct_cmask_nonzero_u32 ✅ 2s 2s +0%
mld_ct_cmask_nonzero_u8 ✅ 2s 2s +0%
mld_keccakf1600_extract_bytes ✅ 2s 2s +0%
mld_value_barrier_i64 ✅ 2s 2s +0%
mld_value_barrier_u32 ✅ 2s 2s +0%
nttunpack_native_x86_64 ✅ 2s 1s +100%
pack_sig_h ✅ 2s 3s -33%
pack_sig_z ✅ 2s 4s -50%
pack_sk_rho_key_tr_s2 ✅ 2s 3s -33%
pointwise_native_x86_64 ✅ 2s 4s -50%
poly_caddq_c ✅ 2s 2s +0%
poly_caddq_native ✅ 2s 5s -60%
poly_decompose ✅ 2s 3s -33%
poly_power2round ✅ 2s 4s -50%
poly_reduce ✅ 2s 3s -33%
poly_uniform_gamma1 ✅ 2s 4s -50%
poly_use_hint_native_aarch64 ✅ 2s 2s +0%
poly_use_hint_native_x86_64 ✅ 2s - new
polyvec_matrix_pointwise_montgomery_row ✅ 2s 2s +0%
polyveck_reduce ✅ 2s 5s -60%
polyveck_unpack_eta ✅ 2s 2s +0%
polyvecl_pack_eta ✅ 2s 3s -33%
polyvecl_uniform_gamma1_serial ✅ 2s 2s +0%
polyz_unpack_19_native_aarch64 ✅ 2s 5s -60%
power2round ✅ 2s 3s -33%
shake128_absorb ✅ 2s 2s +0%
shake128x4_absorb_once ✅ 2s 3s -33%
shake256 ✅ 2s 1s +100%
shake256_squeeze ✅ 2s 2s +0%
shake256x4_absorb_once ✅ 2s 3s -33%
sign_verify_pre_hash_internal ✅ 2s 3s -33%
sign_verify_pre_hash_shake256 ✅ 2s 5s -60%
unpack_pk_t1 ✅ 2s 5s -60%
yvec_get_poly ✅ 2s 3s -33%
keccakf1600_extract_bytes (big endian) ✅ 1s 2s -50%
keccakf1600_permute_native ✅ 1s 3s -67%
mld_ct_cmask_neg_i32 ✅ 1s 3s -67%
mld_ct_get_optblocker_i64 ✅ 1s 4s -75%
mld_ct_memcmp ✅ 1s 3s -67%
mld_keccakf1600x4_xor_bytes_c ✅ 1s 2s -50%
mld_value_barrier_u8 ✅ 1s 3s -67%
ntt_native_x86_64 ✅ 1s 3s -67%
poly_caddq ✅ 1s 2s -50%
polyz_unpack_native_x86_64 ✅ 1s 3s -67%
shake128_init ✅ 1s 3s -67%
shake128_squeeze ✅ 1s 1s +0%
shake128x4_squeezeblocks ✅ 1s 1s +0%
shake256_release ✅ 1s 2s -50%
shake256x4_squeezeblocks ✅ 1s 4s -75%
yvec_init ✅ 1s 3s -67%

@oqs-bot

oqs-bot commented Jul 10, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

CBMC Results (ML-DSA-44, REDUCE-RAM)

Full Results (206 proofs)
Proof Status Current Previous Change
**TOTAL** ✅ 1412s 1364s +3.5%
polyvec_matrix_pointwise_montgomery_yvec ✅ 156s 149s +5%
poly_pointwise_montgomery_c ✅ 128s 112s +14%
mld_invntt_layer ✅ 120s 105s +14%
polyveck_chknorm ✅ 68s 67s +1%
mld_ntt_layer ✅ 45s 41s +10%
fqmul ✅ 40s 39s +3%
sign_verify_internal ✅ 28s 49s -43%
keccakf1600x4_permute_native ✅ 23s 22s +5%
mld_ntt_butterfly_block ✅ 21s 23s -9%
mld_attempt_signature_generation ✅ 20s 19s +5%
poly_ntt_c ✅ 19s 21s -10%
rej_uniform_c ✅ 17s 16s +6%
polyeta_unpack ✅ 14s 14s +0%
mld_check_pct ✅ 13s 15s -13%
polyt0_unpack ✅ 13s 12s +8%
poly_chknorm_c ✅ 12s 11s +9%
poly_uniform_eta_4x ✅ 12s 12s +0%
polyvecl_chknorm ✅ 12s 11s +9%
compute_pack_t0_t1 ✅ 11s 12s -8%
polyz_unpack_c ✅ 10s 8s +25%
keccak_absorb_once_x4 ✅ 9s 8s +12%
poly_invntt_tomont_c ✅ 9s 11s -18%
polyveck_decompose ✅ 8s 7s +14%
rej_uniform_native_x86_64 ✅ 8s - new
sign_verify_extmu ✅ 8s 5s +60%
mld_keccakf1600_permute_c ✅ 7s 7s +0%
poly_reduce ✅ 7s 4s +75%
sign_pk_from_sk ✅ 7s 5s +40%
make_hint ✅ 6s 3s +100%
mld_compute_pack_z ✅ 6s 6s +0%
mld_sample_s1_s2_serial ✅ 6s 4s +50%
pointwise_acc_native_aarch64 ✅ 6s 6s +0%
pointwise_acc_native_x86_64 ✅ 6s 4s +50%
poly_add ✅ 6s 7s -14%
poly_decompose_c ✅ 6s 5s +20%
polyvec_matrix_pointwise_montgomery_row ✅ 6s 6s +0%
polyvecl_ntt ✅ 6s 3s +100%
rej_uniform ✅ 6s 8s -25%
fqscale ✅ 5s 2s +150%
intt_native_aarch64 ✅ 5s 3s +67%
keccak_f1600_x4_native_aarch64_v8a_v84a_scalar_hybrid ✅ 5s 3s +67%
mld_value_barrier_u8 ✅ 5s 4s +25%
poly_caddq ✅ 5s 4s +25%
poly_caddq_c ✅ 5s 3s +67%
poly_challenge ✅ 5s 6s -17%
poly_chknorm ✅ 5s 3s +67%
poly_invntt_tomont_native ✅ 5s 3s +67%
poly_pointwise_montgomery_native ✅ 5s 2s +150%
poly_uniform_4x ✅ 5s 3s +67%
poly_use_hint_c ✅ 5s 5s +0%
polyt1_pack ✅ 5s 3s +67%
polyvec_matrix_expand ✅ 5s 3s +67%
polyvec_matrix_expand_serial ✅ 5s 4s +25%
polyveck_invntt_tomont ✅ 5s 5s +0%
polyw1_pack_88 ✅ 5s 2s +150%
shake256x4_squeezeblocks ✅ 5s 2s +150%
sig_unpack_hints ✅ 5s 2s +150%
sign_keypair_internal ✅ 5s 4s +25%
decompose ✅ 4s 3s +33%
intt_native_x86_64 ✅ 4s 2s +100%
keccak_absorb ✅ 4s 3s +33%
keccak_f1600_x1_native_aarch64_v84a ✅ 4s 2s +100%
keccak_finalize ✅ 4s 2s +100%
keccak_squeezeblocks_x4 ✅ 4s 3s +33%
keccakf1600_permute ✅ 4s 2s +100%
keccakf1600_permute_native ✅ 4s 3s +33%
mld_ct_abs_i32 ✅ 4s 3s +33%
mld_h ✅ 4s 4s +0%
mld_keccakf1600x4_extract_bytes_c ✅ 4s 4s +0%
ntt_native_x86_64 ✅ 4s 3s +33%
nttunpack_native_x86_64 ✅ 4s 4s +0%
pointwise_native_aarch64 ✅ 4s 2s +100%
poly_chknorm_native_x86_64 ✅ 4s 2s +100%
poly_permute_bitrev_to_custom_optional ✅ 4s 5s -20%
poly_uniform_eta ✅ 4s 2s +100%
poly_uniform_gamma1_4x ✅ 4s 5s -20%
poly_use_hint ✅ 4s 2s +100%
polyt0_pack ✅ 4s 4s +0%
polyveck_pack_w1 ✅ 4s 3s +33%
polyveck_reduce ✅ 4s 4s +0%
polyvecl_pack_eta ✅ 4s 2s +100%
polyvecl_pointwise_acc_montgomery_c ✅ 4s 4s +0%
polyvecl_pointwise_acc_montgomery_native ✅ 4s 3s +33%
polyvecl_uniform_gamma1_serial ✅ 4s 2s +100%
polyw1_pack ✅ 4s 4s +0%
polyz_unpack_native_x86_64 ✅ 4s 3s +33%
reduce32 ✅ 4s 3s +33%
rej_eta_c ✅ 4s 4s +0%
rej_eta_native ✅ 4s 3s +33%
rej_uniform_native_aarch64 ✅ 4s 3s +33%
shake128_release ✅ 4s 2s +100%
sign_signature_internal ✅ 4s 4s +0%
sign_signature_pre_hash_internal ✅ 4s 4s +0%
sign_verify ✅ 4s 4s +0%
sign_verify_pre_hash_shake256 ✅ 4s 5s -20%
keccak_f1600_x4_native_avx2 ✅ 3s 2s +50%
keccak_squeeze ✅ 3s 2s +50%
keccakf1600_xor_bytes ✅ 3s 3s +0%
keccakf1600x4_xor_bytes ✅ 3s 3s +0%
keccakf1600x4_xor_bytes_native ✅ 3s 5s -40%
mld_ct_get_optblocker_u32 ✅ 3s 2s +50%
mld_ct_get_optblocker_u8 ✅ 3s 2s +50%
mld_prepare_domain_separation_prefix ✅ 3s 3s +0%
mld_sample_s1_s2 ✅ 3s 1s +200%
mld_value_barrier_u32 ✅ 3s 1s +200%
ntt_native_aarch64 ✅ 3s 4s -25%
pack_sig_h ✅ 3s 4s -25%
pack_sig_z ✅ 3s 2s +50%
poly_caddq_native_aarch64 ✅ 3s 3s +0%
poly_chknorm_native_aarch64 ✅ 3s 2s +50%
poly_decompose_native ✅ 3s 2s +50%
poly_decompose_native_x86_64 ✅ 3s 2s +50%
poly_ntt ✅ 3s 3s +0%
poly_ntt_native ✅ 3s 3s +0%
poly_pointwise_montgomery ✅ 3s 3s +0%
poly_power2round ✅ 3s 4s -25%
poly_shiftl ✅ 3s 4s -25%
poly_uniform ✅ 3s 3s +0%
poly_uniform_gamma1 ✅ 3s 3s +0%
poly_use_hint_native_aarch64 ✅ 3s 3s +0%
poly_use_hint_native_x86_64 ✅ 3s - new
polyeta_pack ✅ 3s 3s +0%
polyveck_caddq ✅ 3s 3s +0%
polyveck_ntt ✅ 3s 2s +50%
polyvecl_pointwise_acc_montgomery ✅ 3s 3s +0%
polyvecl_unpack_eta ✅ 3s 4s -25%
polyvecl_unpack_z ✅ 3s 3s +0%
polyw1_pack_32 ✅ 3s 3s +0%
polyz_pack ✅ 3s 2s +50%
polyz_unpack_17_native_aarch64 ✅ 3s 2s +50%
polyz_unpack_19_native_aarch64 ✅ 3s 4s -25%
power2round ✅ 3s 2s +50%
rej_eta ✅ 3s 5s -40%
rej_uniform_eta_native_aarch64 ✅ 3s 3s +0%
shake128_finalize ✅ 3s 3s +0%
shake128_squeeze ✅ 3s 2s +50%
shake128x4_absorb_once ✅ 3s 2s +50%
shake256 ✅ 3s 1s +200%
shake256_squeeze ✅ 3s 2s +50%
shake256x4_absorb_once ✅ 3s 1s +200%
sign_keypair ✅ 3s 5s -40%
sign_signature ✅ 3s 6s -50%
sign_signature_pre_hash_shake256 ✅ 3s 4s -25%
sk_s1hat_get_poly ✅ 3s 2s +50%
sys_check_capability ✅ 3s 2s +50%
unpack_pk_t1 ✅ 3s 3s +0%
unpack_sk ✅ 3s 3s +0%
caddq ✅ 2s 6s -67%
keccak_init ✅ 2s 3s -33%
keccakf1600_extract_bytes (big endian) ✅ 2s 4s -50%
keccakf1600_xor_bytes (big endian) ✅ 2s 6s -67%
keccakf1600x4_extract_bytes ✅ 2s 2s +0%
keccakf1600x4_permute ✅ 2s 4s -50%
mld_ct_cmask_neg_i32 ✅ 2s 2s +0%
mld_ct_cmask_nonzero_u32 ✅ 2s 3s -33%
mld_ct_cmask_nonzero_u8 ✅ 2s 2s +0%
mld_ct_get_optblocker_i64 ✅ 2s 4s -50%
mld_ct_memcmp ✅ 2s 1s +100%
mld_keccakf1600_extract_bytes ✅ 2s 2s +0%
mld_polymat_expand_entry ✅ 2s 2s +0%
mld_value_barrier_i64 ✅ 2s 3s -33%
montgomery_reduce ✅ 2s 2s +0%
pack_sig_c ✅ 2s 5s -60%
pack_sk_rho_key_tr_s2 ✅ 2s 5s -60%
pack_sk_s1 ✅ 2s 3s -33%
pointwise_native_x86_64 ✅ 2s 4s -50%
poly_caddq_native ✅ 2s 3s -33%
poly_caddq_native_x86_64 ✅ 2s 4s -50%
poly_chknorm_native ✅ 2s 4s -50%
poly_decompose ✅ 2s 2s +0%
poly_decompose_32_native_aarch64 ✅ 2s 4s -50%
poly_decompose_88_native_aarch64 ✅ 2s 3s -33%
poly_permute_bitrev_to_custom_optional_native ✅ 2s 3s -33%
poly_use_hint_native ✅ 2s 3s -33%
polyt1_unpack ✅ 2s 2s +0%
polyveck_pack_eta ✅ 2s 4s -50%
polyveck_unpack_eta ✅ 2s 2s +0%
polyvecl_uniform_gamma1 ✅ 2s 2s +0%
polyz_unpack ✅ 2s 3s -33%
polyz_unpack_native ✅ 2s 3s -33%
rej_uniform_native ✅ 2s 5s -60%
shake128_absorb ✅ 2s 3s -33%
shake256_init ✅ 2s 4s -50%
shake256_release ✅ 2s 1s +100%
sign_signature_extmu ✅ 2s 4s -50%
sign_verify_pre_hash_internal ✅ 2s 5s -60%
sk_t0hat_get_poly ✅ 2s 1s +100%
unpack_sk_s1hat ✅ 2s 3s -33%
unpack_sk_t0hat ✅ 2s 2s +0%
use_hint ✅ 2s 2s +0%
yvec_init ✅ 2s 1s +100%
keccak_f1600_x1_native_aarch64 ✅ 1s 3s -67%
keccak_f1600_x4_native_aarch64_v84a ✅ 1s 3s -67%
keccak_f1600_x4_native_aarch64_v8a_scalar_hybrid ✅ 1s 2s -50%
keccakf1600x4_extract_bytes_native ✅ 1s 4s -75%
mld_ct_sel_int32 ✅ 1s 3s -67%
mld_keccakf1600x4_xor_bytes_c ✅ 1s 4s -75%
poly_invntt_tomont ✅ 1s 2s -50%
poly_sub ✅ 1s 3s -67%
shake128_init ✅ 1s 2s -50%
shake128x4_squeezeblocks ✅ 1s 2s -50%
shake256_absorb ✅ 1s 2s -50%
shake256_finalize ✅ 1s 2s -50%
sk_s2hat_get_poly ✅ 1s 5s -80%
unpack_sk_s2hat ✅ 1s 4s -75%
yvec_get_poly ✅ 1s 3s -67%

@oqs-bot

oqs-bot commented Jul 10, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

CBMC Results (ML-DSA-87, REDUCE-RAM)

Full Results (206 proofs)
Proof Status Current Previous Change
**TOTAL** ✅ 1382s 1436s -3.8%
polyvec_matrix_pointwise_montgomery_yvec ✅ 180s 196s -8%
poly_pointwise_montgomery_c ✅ 111s 125s -11%
mld_invntt_layer ✅ 105s 111s -5%
mld_ntt_layer ✅ 42s 44s -5%
fqmul ✅ 39s 39s +0%
mld_attempt_signature_generation ✅ 35s 34s +3%
polyvecl_chknorm ✅ 34s 38s -11%
keccakf1600x4_permute_native ✅ 23s 25s -8%
mld_ntt_butterfly_block ✅ 21s 23s -9%
sign_verify_internal ✅ 21s 47s -55%
poly_ntt_c ✅ 20s 19s +5%
polyeta_unpack ✅ 16s 13s +23%
rej_uniform_c ✅ 15s 18s -17%
poly_chknorm_c ✅ 13s 13s +0%
polyveck_decompose ✅ 13s 12s +8%
mld_check_pct ✅ 12s 15s -20%
compute_pack_t0_t1 ✅ 11s 12s -8%
poly_uniform_eta_4x ✅ 11s 12s -8%
polyvec_matrix_pointwise_montgomery_row ✅ 11s 13s -15%
poly_invntt_tomont_c ✅ 10s 9s +11%
polyt0_unpack ✅ 10s 14s -29%
polyveck_chknorm ✅ 10s 9s +11%
polyz_unpack_c ✅ 10s 7s +43%
keccak_absorb_once_x4 ✅ 9s 8s +12%
polyvecl_ntt ✅ 9s 8s +12%
rej_uniform_native_x86_64 ✅ 9s - new
poly_decompose_c ✅ 8s 6s +33%
polyveck_reduce ✅ 8s 6s +33%
rej_uniform ✅ 8s 7s +14%
mld_compute_pack_z ✅ 7s 6s +17%
mld_sample_s1_s2 ✅ 7s 8s -12%
poly_reduce ✅ 7s 4s +75%
polyveck_caddq ✅ 7s 8s -12%
rej_eta_native ✅ 7s 4s +75%
mld_keccakf1600_permute_c ✅ 6s 8s -25%
pointwise_acc_native_aarch64 ✅ 6s 5s +20%
pointwise_acc_native_x86_64 ✅ 6s 8s -25%
poly_caddq_c ✅ 6s 3s +100%
polyz_unpack ✅ 6s 3s +100%
sign_keypair_internal ✅ 6s 6s +0%
decompose ✅ 5s 2s +150%
mld_h ✅ 5s 2s +150%
mld_sample_s1_s2_serial ✅ 5s 6s -17%
montgomery_reduce ✅ 5s 2s +150%
pack_sk_s1 ✅ 5s 2s +150%
pointwise_native_x86_64 ✅ 5s 5s +0%
poly_add ✅ 5s 8s -38%
poly_challenge ✅ 5s 4s +25%
poly_invntt_tomont_native ✅ 5s 2s +150%
poly_pointwise_montgomery ✅ 5s 3s +67%
poly_sub ✅ 5s 5s +0%
polyvecl_pointwise_acc_montgomery_native ✅ 5s 2s +150%
sign_pk_from_sk ✅ 5s 6s -17%
unpack_sk_t0hat ✅ 5s 4s +25%
caddq ✅ 4s 3s +33%
intt_native_x86_64 ✅ 4s 4s +0%
keccak_absorb ✅ 4s 4s +0%
keccak_f1600_x1_native_aarch64_v84a ✅ 4s 2s +100%
keccak_init ✅ 4s 1s +300%
keccak_squeezeblocks_x4 ✅ 4s 4s +0%
keccakf1600x4_permute ✅ 4s 2s +100%
make_hint ✅ 4s 2s +100%
mld_ct_cmask_nonzero_u8 ✅ 4s 2s +100%
mld_value_barrier_u8 ✅ 4s 2s +100%
ntt_native_x86_64 ✅ 4s 2s +100%
pack_sig_z ✅ 4s 3s +33%
pointwise_native_aarch64 ✅ 4s 4s +0%
poly_decompose_32_native_aarch64 ✅ 4s 3s +33%
poly_decompose_native ✅ 4s 2s +100%
poly_ntt_native ✅ 4s 4s +0%
poly_power2round ✅ 4s 7s -43%
poly_use_hint ✅ 4s 4s +0%
polyt1_pack ✅ 4s 5s -20%
polyveck_invntt_tomont ✅ 4s 4s +0%
polyvecl_uniform_gamma1_serial ✅ 4s 2s +100%
rej_uniform_native ✅ 4s 5s -20%
sig_unpack_hints ✅ 4s 4s +0%
sign_keypair ✅ 4s 4s +0%
sign_signature_internal ✅ 4s 3s +33%
sign_signature_pre_hash_internal ✅ 4s 2s +100%
sign_signature_pre_hash_shake256 ✅ 4s 3s +33%
sign_verify ✅ 4s 2s +100%
sign_verify_pre_hash_shake256 ✅ 4s 7s -43%
unpack_sk_s1hat ✅ 4s 3s +33%
unpack_sk_s2hat ✅ 4s 3s +33%
fqscale ✅ 3s 1s +200%
intt_native_aarch64 ✅ 3s 4s -25%
keccak_f1600_x4_native_aarch64_v8a_scalar_hybrid ✅ 3s 2s +50%
keccak_f1600_x4_native_aarch64_v8a_v84a_scalar_hybrid ✅ 3s 2s +50%
keccak_squeeze ✅ 3s 5s -40%
keccakf1600_xor_bytes ✅ 3s 1s +200%
keccakf1600x4_extract_bytes_native ✅ 3s 4s -25%
keccakf1600x4_xor_bytes ✅ 3s 1s +200%
keccakf1600x4_xor_bytes_native ✅ 3s 2s +50%
mld_ct_cmask_nonzero_u32 ✅ 3s 5s -40%
mld_ct_get_optblocker_i64 ✅ 3s 2s +50%
mld_ct_get_optblocker_u8 ✅ 3s 3s +0%
mld_ct_sel_int32 ✅ 3s 2s +50%
mld_keccakf1600x4_extract_bytes_c ✅ 3s 3s +0%
mld_keccakf1600x4_xor_bytes_c ✅ 3s 1s +200%
mld_polymat_expand_entry ✅ 3s 4s -25%
mld_prepare_domain_separation_prefix ✅ 3s 3s +0%
mld_value_barrier_u32 ✅ 3s 3s +0%
ntt_native_aarch64 ✅ 3s 4s -25%
nttunpack_native_x86_64 ✅ 3s 3s +0%
pack_sig_c ✅ 3s 2s +50%
pack_sk_rho_key_tr_s2 ✅ 3s 2s +50%
poly_caddq_native_aarch64 ✅ 3s 3s +0%
poly_chknorm ✅ 3s 4s -25%
poly_chknorm_native ✅ 3s 1s +200%
poly_chknorm_native_aarch64 ✅ 3s 5s -40%
poly_decompose_88_native_aarch64 ✅ 3s 2s +50%
poly_invntt_tomont ✅ 3s 4s -25%
poly_permute_bitrev_to_custom_optional ✅ 3s 2s +50%
poly_permute_bitrev_to_custom_optional_native ✅ 3s 3s +0%
poly_pointwise_montgomery_native ✅ 3s 3s +0%
poly_shiftl ✅ 3s 4s -25%
poly_uniform ✅ 3s 4s -25%
poly_uniform_eta ✅ 3s 5s -40%
poly_use_hint_native_aarch64 ✅ 3s 3s +0%
polyeta_pack ✅ 3s 3s +0%
polyt0_pack ✅ 3s 3s +0%
polyvec_matrix_expand ✅ 3s 3s +0%
polyveck_ntt ✅ 3s 3s +0%
polyveck_unpack_eta ✅ 3s 3s +0%
polyvecl_pack_eta ✅ 3s 2s +50%
polyw1_pack ✅ 3s 2s +50%
polyw1_pack_32 ✅ 3s 3s +0%
polyz_pack ✅ 3s 4s -25%
polyz_unpack_17_native_aarch64 ✅ 3s 4s -25%
polyz_unpack_native ✅ 3s 1s +200%
reduce32 ✅ 3s 3s +0%
rej_eta ✅ 3s 2s +50%
rej_uniform_native_aarch64 ✅ 3s 3s +0%
shake128_finalize ✅ 3s 2s +50%
shake128_squeeze ✅ 3s 1s +200%
shake128x4_squeezeblocks ✅ 3s 1s +200%
shake256 ✅ 3s 3s +0%
shake256_init ✅ 3s 3s +0%
shake256_release ✅ 3s 5s -40%
shake256x4_absorb_once ✅ 3s 5s -40%
sign_signature ✅ 3s 4s -25%
sign_signature_extmu ✅ 3s 4s -25%
sign_verify_extmu ✅ 3s 4s -25%
sign_verify_pre_hash_internal ✅ 3s 3s +0%
sk_s2hat_get_poly ✅ 3s 2s +50%
unpack_sk ✅ 3s 4s -25%
yvec_init ✅ 3s 4s -25%
keccak_f1600_x1_native_aarch64 ✅ 2s 2s +0%
keccak_f1600_x4_native_aarch64_v84a ✅ 2s 1s +100%
keccak_f1600_x4_native_avx2 ✅ 2s 3s -33%
keccakf1600_extract_bytes (big endian) ✅ 2s 3s -33%
keccakf1600_permute ✅ 2s 2s +0%
keccakf1600_permute_native ✅ 2s 3s -33%
keccakf1600_xor_bytes (big endian) ✅ 2s 2s +0%
keccakf1600x4_extract_bytes ✅ 2s 1s +100%
mld_ct_cmask_neg_i32 ✅ 2s 2s +0%
mld_ct_get_optblocker_u32 ✅ 2s 2s +0%
mld_keccakf1600_extract_bytes ✅ 2s 1s +100%
mld_value_barrier_i64 ✅ 2s 2s +0%
pack_sig_h ✅ 2s 3s -33%
poly_caddq ✅ 2s 5s -60%
poly_caddq_native_x86_64 ✅ 2s 3s -33%
poly_chknorm_native_x86_64 ✅ 2s 2s +0%
poly_decompose ✅ 2s 2s +0%
poly_decompose_native_x86_64 ✅ 2s 3s -33%
poly_ntt ✅ 2s 2s +0%
poly_uniform_4x ✅ 2s 3s -33%
poly_uniform_gamma1 ✅ 2s 3s -33%
poly_use_hint_c ✅ 2s 4s -50%
poly_use_hint_native ✅ 2s 1s +100%
poly_use_hint_native_x86_64 ✅ 2s - new
polyt1_unpack ✅ 2s 3s -33%
polyvec_matrix_expand_serial ✅ 2s 3s -33%
polyveck_pack_w1 ✅ 2s 3s -33%
polyvecl_pointwise_acc_montgomery ✅ 2s 2s +0%
polyvecl_pointwise_acc_montgomery_c ✅ 2s 2s +0%
polyvecl_uniform_gamma1 ✅ 2s 3s -33%
polyvecl_unpack_eta ✅ 2s 3s -33%
polyvecl_unpack_z ✅ 2s 3s -33%
polyz_unpack_19_native_aarch64 ✅ 2s 5s -60%
polyz_unpack_native_x86_64 ✅ 2s 3s -33%
rej_eta_c ✅ 2s 4s -50%
rej_uniform_eta_native_aarch64 ✅ 2s 3s -33%
shake128_absorb ✅ 2s 2s +0%
shake128_init ✅ 2s 2s +0%
shake128x4_absorb_once ✅ 2s 4s -50%
shake256_absorb ✅ 2s 3s -33%
shake256_squeeze ✅ 2s 2s +0%
sk_s1hat_get_poly ✅ 2s 3s -33%
sk_t0hat_get_poly ✅ 2s 3s -33%
sys_check_capability ✅ 2s 2s +0%
unpack_pk_t1 ✅ 2s 2s +0%
yvec_get_poly ✅ 2s 2s +0%
keccak_finalize ✅ 1s 1s +0%
mld_ct_abs_i32 ✅ 1s 1s +0%
mld_ct_memcmp ✅ 1s 1s +0%
poly_caddq_native ✅ 1s 3s -67%
poly_uniform_gamma1_4x ✅ 1s 3s -67%
polyveck_pack_eta ✅ 1s 5s -80%
polyw1_pack_88 ✅ 1s 2s -50%
power2round ✅ 1s 3s -67%
shake128_release ✅ 1s 3s -67%
shake256_finalize ✅ 1s 3s -67%
shake256x4_squeezeblocks ✅ 1s 4s -75%
use_hint ✅ 1s 3s -67%

@oqs-bot

oqs-bot commented Jul 10, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

CBMC Results (ML-DSA-65)

Full Results (206 proofs)
Proof Status Current Previous Change
**TOTAL** ✅ 1795s 1784s +0.6%
polyvecl_pointwise_acc_montgomery_c ✅ 251s 210s +20%
poly_pointwise_montgomery_c ✅ 134s 125s +7%
mld_invntt_layer ✅ 118s 109s +8%
polyvec_matrix_expand ✅ 114s 110s +4%
sign_verify_internal ✅ 71s 177s -60%
mld_attempt_signature_generation ✅ 70s 63s +11%
mld_ntt_layer ✅ 45s 41s +10%
fqmul ✅ 44s 40s +10%
sign_signature_internal ✅ 32s 55s -42%
polyvec_matrix_expand_serial ✅ 28s 27s +4%
keccakf1600x4_permute_native ✅ 25s 23s +9%
poly_ntt_c ✅ 25s 19s +32%
mld_ntt_butterfly_block ✅ 23s 24s -4%
polyvec_matrix_pointwise_montgomery_yvec ✅ 21s 18s +17%
poly_chknorm_c ✅ 17s 15s +13%
rej_uniform ✅ 17s 18s -6%
rej_uniform_c ✅ 17s 14s +21%
compute_pack_t0_t1 ✅ 15s 13s +15%
polyt0_unpack ✅ 15s 16s -6%
polyveck_decompose ✅ 14s 12s +17%
polyz_unpack_c ✅ 14s 13s +8%
mld_check_pct ✅ 12s 14s -14%
poly_invntt_tomont_c ✅ 12s 11s +9%
poly_uniform_4x ✅ 12s 13s -8%
poly_uniform_eta_4x ✅ 12s 14s -14%
keccak_absorb_once_x4 ✅ 11s 8s +38%
mld_compute_pack_z ✅ 10s 7s +43%
rej_uniform_native_x86_64 ✅ 10s - new
polyveck_invntt_tomont ✅ 9s 8s +12%
polyveck_chknorm ✅ 8s 6s +33%
sign_signature_pre_hash_shake256 ✅ 8s 3s +167%
mld_keccakf1600_permute_c ✅ 7s 6s +17%
ntt_native_x86_64 ✅ 7s 2s +250%
pointwise_acc_native_aarch64 ✅ 7s 6s +17%
pointwise_acc_native_x86_64 ✅ 7s 8s -12%
sign_pk_from_sk ✅ 7s 6s +17%
mld_sample_s1_s2_serial ✅ 6s 4s +50%
poly_add ✅ 6s 9s -33%
poly_decompose_c ✅ 6s 5s +20%
poly_uniform_eta ✅ 6s 4s +50%
polyeta_unpack ✅ 6s 8s -25%
polyveck_caddq ✅ 6s 6s +0%
polyveck_ntt ✅ 6s 7s -14%
polyvecl_ntt ✅ 6s 4s +50%
rej_uniform_native ✅ 6s 4s +50%
sign_signature ✅ 6s 6s +0%
intt_native_aarch64 ✅ 5s 3s +67%
keccak_squeezeblocks_x4 ✅ 5s 5s +0%
keccakf1600x4_extract_bytes_native ✅ 5s 4s +25%
mld_sample_s1_s2 ✅ 5s 6s -17%
pack_sig_h ✅ 5s 5s +0%
poly_challenge ✅ 5s 6s -17%
poly_ntt ✅ 5s 2s +150%
poly_shiftl ✅ 5s 3s +67%
poly_uniform ✅ 5s 4s +25%
polyt1_pack ✅ 5s 3s +67%
polyt1_unpack ✅ 5s 5s +0%
polyvecl_uniform_gamma1 ✅ 5s 2s +150%
rej_eta_native ✅ 5s 3s +67%
rej_uniform_eta_native_aarch64 ✅ 5s 4s +25%
rej_uniform_native_aarch64 ✅ 5s 3s +67%
shake128_absorb ✅ 5s 2s +150%
shake128_release ✅ 5s 3s +67%
shake128x4_absorb_once ✅ 5s 3s +67%
sign_keypair ✅ 5s 3s +67%
sign_keypair_internal ✅ 5s 5s +0%
unpack_pk_t1 ✅ 5s 5s +0%
intt_native_x86_64 ✅ 4s 3s +33%
keccak_absorb ✅ 4s 3s +33%
keccakf1600_extract_bytes (big endian) ✅ 4s 2s +100%
keccakf1600x4_xor_bytes_native ✅ 4s 3s +33%
mld_h ✅ 4s 2s +100%
mld_keccakf1600x4_extract_bytes_c ✅ 4s 3s +33%
nttunpack_native_x86_64 ✅ 4s 3s +33%
pointwise_native_aarch64 ✅ 4s 5s -20%
poly_caddq_native ✅ 4s 2s +100%
poly_chknorm ✅ 4s 4s +0%
poly_chknorm_native ✅ 4s 2s +100%
poly_decompose ✅ 4s 2s +100%
poly_decompose_32_native_aarch64 ✅ 4s 3s +33%
poly_decompose_native_x86_64 ✅ 4s 3s +33%
poly_invntt_tomont ✅ 4s 3s +33%
poly_ntt_native ✅ 4s 4s +0%
poly_uniform_gamma1_4x ✅ 4s 4s +0%
poly_use_hint ✅ 4s 3s +33%
poly_use_hint_c ✅ 4s 5s -20%
poly_use_hint_native_aarch64 ✅ 4s 3s +33%
poly_use_hint_native_x86_64 ✅ 4s - new
polyvec_matrix_pointwise_montgomery_row ✅ 4s 1s +300%
polyveck_pack_eta ✅ 4s 4s +0%
polyvecl_chknorm ✅ 4s 7s -43%
polyvecl_pointwise_acc_montgomery ✅ 4s 3s +33%
rej_eta ✅ 4s 2s +100%
rej_eta_c ✅ 4s 5s -20%
shake128x4_squeezeblocks ✅ 4s 3s +33%
shake256_finalize ✅ 4s 1s +300%
sig_unpack_hints ✅ 4s 2s +100%
sign_signature_extmu ✅ 4s 2s +100%
sign_signature_pre_hash_internal ✅ 4s 3s +33%
sign_verify_extmu ✅ 4s 3s +33%
sign_verify_pre_hash_internal ✅ 4s 5s -20%
sign_verify_pre_hash_shake256 ✅ 4s 5s -20%
sk_s1hat_get_poly ✅ 4s 6s -33%
caddq ✅ 3s 3s +0%
fqscale ✅ 3s 3s +0%
keccak_f1600_x1_native_aarch64_v84a ✅ 3s 3s +0%
keccak_f1600_x4_native_aarch64_v84a ✅ 3s 4s -25%
keccak_f1600_x4_native_aarch64_v8a_v84a_scalar_hybrid ✅ 3s 2s +50%
keccak_f1600_x4_native_avx2 ✅ 3s 2s +50%
keccak_finalize ✅ 3s 2s +50%
keccak_init ✅ 3s 1s +200%
keccak_squeeze ✅ 3s 4s -25%
keccakf1600_permute ✅ 3s 2s +50%
keccakf1600_xor_bytes ✅ 3s 2s +50%
mld_ct_cmask_neg_i32 ✅ 3s 2s +50%
mld_ct_get_optblocker_i64 ✅ 3s 2s +50%
mld_ct_get_optblocker_u8 ✅ 3s 2s +50%
mld_keccakf1600_extract_bytes ✅ 3s 1s +200%
mld_prepare_domain_separation_prefix ✅ 3s 2s +50%
pack_sig_z ✅ 3s 2s +50%
pack_sk_rho_key_tr_s2 ✅ 3s 2s +50%
pack_sk_s1 ✅ 3s 5s -40%
pointwise_native_x86_64 ✅ 3s 3s +0%
poly_caddq_c ✅ 3s 2s +50%
poly_caddq_native_aarch64 ✅ 3s 2s +50%
poly_decompose_native ✅ 3s 3s +0%
poly_invntt_tomont_native ✅ 3s 2s +50%
poly_permute_bitrev_to_custom_optional ✅ 3s 2s +50%
poly_permute_bitrev_to_custom_optional_native ✅ 3s 4s -25%
poly_reduce ✅ 3s 3s +0%
poly_uniform_gamma1 ✅ 3s 3s +0%
poly_use_hint_native ✅ 3s 2s +50%
polyeta_pack ✅ 3s 3s +0%
polyt0_pack ✅ 3s 3s +0%
polyveck_reduce ✅ 3s 4s -25%
polyveck_unpack_eta ✅ 3s 6s -50%
polyvecl_pack_eta ✅ 3s 3s +0%
polyvecl_uniform_gamma1_serial ✅ 3s 3s +0%
polyvecl_unpack_eta ✅ 3s 3s +0%
polyz_unpack_19_native_aarch64 ✅ 3s 3s +0%
polyz_unpack_native_x86_64 ✅ 3s 3s +0%
shake256_release ✅ 3s 2s +50%
shake256_squeeze ✅ 3s 3s +0%
sign_verify ✅ 3s 3s +0%
sk_t0hat_get_poly ✅ 3s 2s +50%
unpack_sk ✅ 3s 3s +0%
unpack_sk_t0hat ✅ 3s 5s -40%
use_hint ✅ 3s 2s +50%
yvec_get_poly ✅ 3s 3s +0%
yvec_init ✅ 3s 3s +0%
decompose ✅ 2s 1s +100%
keccak_f1600_x1_native_aarch64 ✅ 2s 2s +0%
keccakf1600_permute_native ✅ 2s 3s -33%
keccakf1600_xor_bytes (big endian) ✅ 2s 2s +0%
keccakf1600x4_permute ✅ 2s 4s -50%
mld_ct_cmask_nonzero_u32 ✅ 2s 4s -50%
mld_ct_cmask_nonzero_u8 ✅ 2s 3s -33%
mld_ct_memcmp ✅ 2s 2s +0%
mld_ct_sel_int32 ✅ 2s 3s -33%
mld_keccakf1600x4_xor_bytes_c ✅ 2s 2s +0%
mld_value_barrier_u8 ✅ 2s 3s -33%
montgomery_reduce ✅ 2s 4s -50%
ntt_native_aarch64 ✅ 2s 2s +0%
pack_sig_c ✅ 2s 5s -60%
poly_caddq ✅ 2s 2s +0%
poly_chknorm_native_aarch64 ✅ 2s 3s -33%
poly_chknorm_native_x86_64 ✅ 2s 3s -33%
poly_decompose_88_native_aarch64 ✅ 2s 1s +100%
poly_pointwise_montgomery ✅ 2s 3s -33%
poly_power2round ✅ 2s 4s -50%
poly_sub ✅ 2s 3s -33%
polyveck_pack_w1 ✅ 2s 3s -33%
polyvecl_pointwise_acc_montgomery_native ✅ 2s 2s +0%
polyvecl_unpack_z ✅ 2s 3s -33%
polyw1_pack_32 ✅ 2s 4s -50%
polyz_pack ✅ 2s 3s -33%
polyz_unpack ✅ 2s 3s -33%
polyz_unpack_17_native_aarch64 ✅ 2s 3s -33%
polyz_unpack_native ✅ 2s 4s -50%
power2round ✅ 2s 1s +100%
reduce32 ✅ 2s 3s -33%
shake128_finalize ✅ 2s 1s +100%
shake128_squeeze ✅ 2s 2s +0%
shake256 ✅ 2s 2s +0%
shake256_init ✅ 2s 2s +0%
shake256x4_absorb_once ✅ 2s 3s -33%
shake256x4_squeezeblocks ✅ 2s 2s +0%
sk_s2hat_get_poly ✅ 2s 2s +0%
unpack_sk_s1hat ✅ 2s 2s +0%
unpack_sk_s2hat ✅ 2s 4s -50%
keccak_f1600_x4_native_aarch64_v8a_scalar_hybrid ✅ 1s 2s -50%
keccakf1600x4_extract_bytes ✅ 1s 4s -75%
keccakf1600x4_xor_bytes ✅ 1s 1s +0%
make_hint ✅ 1s 2s -50%
mld_ct_abs_i32 ✅ 1s 2s -50%
mld_ct_get_optblocker_u32 ✅ 1s 3s -67%
mld_polymat_expand_entry ✅ 1s 4s -75%
mld_value_barrier_i64 ✅ 1s 2s -50%
mld_value_barrier_u32 ✅ 1s 3s -67%
poly_caddq_native_x86_64 ✅ 1s 3s -67%
poly_pointwise_montgomery_native ✅ 1s 3s -67%
polyw1_pack ✅ 1s 4s -75%
polyw1_pack_88 ✅ 1s 2s -50%
shake128_init ✅ 1s 2s -50%
shake256_absorb ✅ 1s 2s -50%
sys_check_capability ✅ 1s 4s -75%

@oqs-bot

oqs-bot commented Jul 10, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

CBMC Results (ML-DSA-65, REDUCE-RAM)

Full Results (206 proofs)
Proof Status Current Previous Change
**TOTAL** ✅ 1420s 1482s -4.2%
polyvec_matrix_pointwise_montgomery_yvec ✅ 196s 201s -2%
poly_pointwise_montgomery_c ✅ 116s 116s +0%
mld_invntt_layer ✅ 103s 108s -5%
mld_ntt_layer ✅ 45s 43s +5%
fqmul ✅ 41s 40s +2%
polyvecl_chknorm ✅ 40s 43s -7%
polyveck_chknorm ✅ 34s 36s -6%
mld_attempt_signature_generation ✅ 32s 31s +3%
sign_verify_internal ✅ 30s 71s -58%
keccakf1600x4_permute_native ✅ 22s 22s +0%
mld_ntt_butterfly_block ✅ 22s 25s -12%
poly_ntt_c ✅ 20s 22s -9%
poly_chknorm_c ✅ 16s 13s +23%
rej_uniform_c ✅ 16s 16s +0%
mld_check_pct ✅ 14s 12s +17%
polyt0_unpack ✅ 13s 13s +0%
polyveck_decompose ✅ 12s 14s -14%
keccak_absorb_once_x4 ✅ 11s 10s +10%
poly_invntt_tomont_c ✅ 10s 10s +0%
poly_uniform_eta_4x ✅ 10s 13s -23%
rej_uniform_native_x86_64 ✅ 10s - new
polyz_unpack_c ✅ 9s 9s +0%
compute_pack_t0_t1 ✅ 8s 7s +14%
polyveck_caddq ✅ 8s 7s +14%
rej_uniform ✅ 8s 7s +14%
keccak_absorb ✅ 7s 3s +133%
poly_add ✅ 7s 7s +0%
poly_decompose_c ✅ 7s 8s -12%
polyvec_matrix_pointwise_montgomery_row ✅ 7s 8s -12%
polyvecl_ntt ✅ 7s 7s +0%
sign_pk_from_sk ✅ 7s 5s +40%
keccak_f1600_x4_native_avx2 ✅ 6s 2s +200%
ntt_native_x86_64 ✅ 6s 5s +20%
pointwise_acc_native_x86_64 ✅ 6s 5s +20%
polyveck_invntt_tomont ✅ 6s 7s -14%
polyveck_reduce ✅ 6s 6s +0%
rej_uniform_native ✅ 6s 4s +50%
decompose ✅ 5s 4s +25%
keccak_finalize ✅ 5s 2s +150%
keccak_squeezeblocks_x4 ✅ 5s 4s +25%
mld_compute_pack_z ✅ 5s 5s +0%
mld_h ✅ 5s 3s +67%
mld_keccakf1600_permute_c ✅ 5s 7s -29%
ntt_native_aarch64 ✅ 5s 3s +67%
pack_sk_s1 ✅ 5s 3s +67%
pointwise_acc_native_aarch64 ✅ 5s 6s -17%
poly_decompose_88_native_aarch64 ✅ 5s 2s +150%
poly_uniform ✅ 5s 2s +150%
poly_uniform_eta ✅ 5s 5s +0%
polyveck_ntt ✅ 5s 4s +25%
polyveck_unpack_eta ✅ 5s 3s +67%
polyvecl_uniform_gamma1_serial ✅ 5s 1s +400%
sign_keypair_internal ✅ 5s 3s +67%
sign_signature_internal ✅ 5s 6s -17%
sign_signature_pre_hash_internal ✅ 5s 3s +67%
unpack_sk ✅ 5s 3s +67%
intt_native_x86_64 ✅ 4s 4s +0%
keccak_f1600_x1_native_aarch64 ✅ 4s 2s +100%
keccakf1600x4_extract_bytes_native ✅ 4s 1s +300%
keccakf1600x4_xor_bytes ✅ 4s 2s +100%
mld_ct_cmask_nonzero_u8 ✅ 4s 2s +100%
mld_sample_s1_s2 ✅ 4s 6s -33%
mld_sample_s1_s2_serial ✅ 4s 3s +33%
pack_sk_rho_key_tr_s2 ✅ 4s 2s +100%
poly_caddq_c ✅ 4s 5s -20%
poly_challenge ✅ 4s 5s -20%
poly_ntt_native ✅ 4s 2s +100%
poly_shiftl ✅ 4s 3s +33%
poly_uniform_gamma1 ✅ 4s 3s +33%
polyeta_unpack ✅ 4s 4s +0%
polyt0_pack ✅ 4s 5s -20%
polyvecl_unpack_eta ✅ 4s 2s +100%
polyw1_pack_32 ✅ 4s 2s +100%
polyz_pack ✅ 4s 3s +33%
polyz_unpack_17_native_aarch64 ✅ 4s 2s +100%
polyz_unpack_native_x86_64 ✅ 4s 3s +33%
reduce32 ✅ 4s 2s +100%
shake128_finalize ✅ 4s 2s +100%
shake256_init ✅ 4s 4s +0%
shake256x4_squeezeblocks ✅ 4s 2s +100%
sig_unpack_hints ✅ 4s 1s +300%
sign_keypair ✅ 4s 4s +0%
sign_signature ✅ 4s 5s -20%
sign_verify ✅ 4s 6s -33%
sk_s2hat_get_poly ✅ 4s 1s +300%
use_hint ✅ 4s 2s +100%
caddq ✅ 3s 2s +50%
fqscale ✅ 3s 3s +0%
keccak_f1600_x1_native_aarch64_v84a ✅ 3s 2s +50%
keccak_f1600_x4_native_aarch64_v84a ✅ 3s 2s +50%
keccak_f1600_x4_native_aarch64_v8a_v84a_scalar_hybrid ✅ 3s 3s +0%
keccak_init ✅ 3s 4s -25%
keccakf1600_permute ✅ 3s 4s -25%
mld_ct_abs_i32 ✅ 3s 6s -50%
mld_ct_cmask_nonzero_u32 ✅ 3s 3s +0%
mld_keccakf1600x4_extract_bytes_c ✅ 3s 2s +50%
mld_prepare_domain_separation_prefix ✅ 3s 4s -25%
mld_value_barrier_i64 ✅ 3s 2s +50%
mld_value_barrier_u32 ✅ 3s 4s -25%
pack_sig_z ✅ 3s 1s +200%
pointwise_native_aarch64 ✅ 3s 3s +0%
pointwise_native_x86_64 ✅ 3s 2s +50%
poly_caddq ✅ 3s 3s +0%
poly_caddq_native ✅ 3s 4s -25%
poly_chknorm ✅ 3s 3s +0%
poly_chknorm_native ✅ 3s 4s -25%
poly_chknorm_native_x86_64 ✅ 3s 4s -25%
poly_invntt_tomont ✅ 3s 5s -40%
poly_invntt_tomont_native ✅ 3s 5s -40%
poly_permute_bitrev_to_custom_optional ✅ 3s 3s +0%
poly_permute_bitrev_to_custom_optional_native ✅ 3s 3s +0%
poly_pointwise_montgomery_native ✅ 3s 4s -25%
poly_power2round ✅ 3s 7s -57%
poly_reduce ✅ 3s 4s -25%
poly_sub ✅ 3s 4s -25%
poly_uniform_4x ✅ 3s 4s -25%
poly_use_hint_native_aarch64 ✅ 3s 4s -25%
polyt1_unpack ✅ 3s 3s +0%
polyvec_matrix_expand ✅ 3s 6s -50%
polyveck_pack_eta ✅ 3s 3s +0%
polyveck_pack_w1 ✅ 3s 4s -25%
polyvecl_pack_eta ✅ 3s 2s +50%
polyvecl_pointwise_acc_montgomery ✅ 3s 3s +0%
polyvecl_unpack_z ✅ 3s 1s +200%
polyw1_pack_88 ✅ 3s 3s +0%
polyz_unpack_19_native_aarch64 ✅ 3s 5s -40%
polyz_unpack_native ✅ 3s 3s +0%
rej_eta_c ✅ 3s 4s -25%
rej_eta_native ✅ 3s 3s +0%
rej_uniform_eta_native_aarch64 ✅ 3s 5s -40%
rej_uniform_native_aarch64 ✅ 3s 5s -40%
shake128_squeeze ✅ 3s 3s +0%
shake128x4_squeezeblocks ✅ 3s 2s +50%
shake256_absorb ✅ 3s 4s -25%
shake256_finalize ✅ 3s 1s +200%
shake256_squeeze ✅ 3s 4s -25%
sign_signature_pre_hash_shake256 ✅ 3s 7s -57%
sign_verify_extmu ✅ 3s 2s +50%
sign_verify_pre_hash_internal ✅ 3s 5s -40%
sys_check_capability ✅ 3s 1s +200%
unpack_sk_s1hat ✅ 3s 1s +200%
yvec_get_poly ✅ 3s 3s +0%
intt_native_aarch64 ✅ 2s 2s +0%
keccak_f1600_x4_native_aarch64_v8a_scalar_hybrid ✅ 2s 3s -33%
keccak_squeeze ✅ 2s 2s +0%
keccakf1600_permute_native ✅ 2s 2s +0%
keccakf1600_xor_bytes (big endian) ✅ 2s 2s +0%
keccakf1600x4_permute ✅ 2s 1s +100%
keccakf1600x4_xor_bytes_native ✅ 2s 2s +0%
mld_ct_cmask_neg_i32 ✅ 2s 3s -33%
mld_ct_get_optblocker_u32 ✅ 2s 3s -33%
mld_ct_memcmp ✅ 2s 4s -50%
mld_ct_sel_int32 ✅ 2s 2s +0%
mld_keccakf1600_extract_bytes ✅ 2s 2s +0%
mld_keccakf1600x4_xor_bytes_c ✅ 2s 2s +0%
mld_polymat_expand_entry ✅ 2s 3s -33%
mld_value_barrier_u8 ✅ 2s 1s +100%
montgomery_reduce ✅ 2s 1s +100%
nttunpack_native_x86_64 ✅ 2s 3s -33%
pack_sig_c ✅ 2s 3s -33%
pack_sig_h ✅ 2s 2s +0%
poly_caddq_native_x86_64 ✅ 2s 1s +100%
poly_chknorm_native_aarch64 ✅ 2s 2s +0%
poly_decompose ✅ 2s 2s +0%
poly_decompose_32_native_aarch64 ✅ 2s 4s -50%
poly_decompose_native ✅ 2s 5s -60%
poly_decompose_native_x86_64 ✅ 2s 2s +0%
poly_ntt ✅ 2s 2s +0%
poly_pointwise_montgomery ✅ 2s 2s +0%
poly_use_hint ✅ 2s 3s -33%
poly_use_hint_c ✅ 2s 2s +0%
poly_use_hint_native ✅ 2s 7s -71%
poly_use_hint_native_x86_64 ✅ 2s - new
polyeta_pack ✅ 2s 1s +100%
polyt1_pack ✅ 2s 3s -33%
polyvec_matrix_expand_serial ✅ 2s 3s -33%
polyvecl_uniform_gamma1 ✅ 2s 4s -50%
polyw1_pack ✅ 2s 3s -33%
polyz_unpack ✅ 2s 3s -33%
power2round ✅ 2s 2s +0%
rej_eta ✅ 2s 5s -60%
shake128x4_absorb_once ✅ 2s 2s +0%
shake256 ✅ 2s 2s +0%
sign_signature_extmu ✅ 2s 4s -50%
sign_verify_pre_hash_shake256 ✅ 2s 6s -67%
sk_s1hat_get_poly ✅ 2s 3s -33%
sk_t0hat_get_poly ✅ 2s 1s +100%
unpack_pk_t1 ✅ 2s 2s +0%
unpack_sk_s2hat ✅ 2s 3s -33%
unpack_sk_t0hat ✅ 2s 4s -50%
yvec_init ✅ 2s 5s -60%
keccakf1600_extract_bytes (big endian) ✅ 1s 3s -67%
keccakf1600_xor_bytes ✅ 1s 4s -75%
keccakf1600x4_extract_bytes ✅ 1s 4s -75%
make_hint ✅ 1s 3s -67%
mld_ct_get_optblocker_i64 ✅ 1s 1s +0%
mld_ct_get_optblocker_u8 ✅ 1s 4s -75%
poly_caddq_native_aarch64 ✅ 1s 2s -50%
poly_uniform_gamma1_4x ✅ 1s 3s -67%
polyvecl_pointwise_acc_montgomery_c ✅ 1s 3s -67%
polyvecl_pointwise_acc_montgomery_native ✅ 1s 3s -67%
shake128_absorb ✅ 1s 2s -50%
shake128_init ✅ 1s 6s -83%
shake128_release ✅ 1s 2s -50%
shake256_release ✅ 1s 3s -67%
shake256x4_absorb_once ✅ 1s 2s -50%

@oqs-bot

oqs-bot commented Jul 10, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

CBMC Results (ML-DSA-87)

Full Results (206 proofs)
Proof Status Current Previous Change
**TOTAL** ✅ 2143s 2151s -0.4%
polyvecl_pointwise_acc_montgomery_c ✅ 373s 353s +6%
polyvec_matrix_expand ✅ 315s 324s -3%
poly_pointwise_montgomery_c ✅ 131s 144s -9%
mld_invntt_layer ✅ 112s 115s -3%
sign_verify_internal ✅ 80s 97s -18%
sign_signature_internal ✅ 61s 42s +45%
mld_attempt_signature_generation ✅ 56s 55s +2%
mld_ntt_layer ✅ 49s 45s +9%
fqmul ✅ 41s 43s -5%
polyvec_matrix_expand_serial ✅ 38s 38s +0%
mld_ntt_butterfly_block ✅ 24s 24s +0%
keccakf1600x4_permute_native ✅ 23s 23s +0%
poly_ntt_c ✅ 20s 21s -5%
compute_pack_t0_t1 ✅ 19s 19s +0%
polyvec_matrix_pointwise_montgomery_yvec ✅ 18s 18s +0%
rej_uniform ✅ 18s 15s +20%
polyt0_unpack ✅ 17s 14s +21%
poly_chknorm_c ✅ 16s 15s +7%
polyeta_unpack ✅ 15s 17s -12%
rej_uniform_c ✅ 15s 19s -21%
poly_uniform_4x ✅ 13s 13s +0%
mld_check_pct ✅ 12s 16s -25%
poly_uniform_eta_4x ✅ 12s 11s +9%
polyveck_decompose ✅ 12s 13s -8%
poly_invntt_tomont_c ✅ 11s 12s -8%
keccak_absorb_once_x4 ✅ 10s 9s +11%
rej_uniform_native_x86_64 ✅ 10s - new
pointwise_acc_native_aarch64 ✅ 9s 6s +50%
pointwise_acc_native_x86_64 ✅ 9s 6s +50%
polyveck_invntt_tomont ✅ 9s 9s +0%
polyveck_ntt ✅ 9s 11s -18%
polyvecl_ntt ✅ 9s 7s +29%
mld_sample_s1_s2_serial ✅ 8s 8s +0%
poly_add ✅ 8s 6s +33%
mld_compute_pack_z ✅ 7s 8s -12%
mld_keccakf1600_permute_c ✅ 7s 7s +0%
mld_sample_s1_s2 ✅ 7s 6s +17%
polyt1_unpack ✅ 7s 4s +75%
polyveck_caddq ✅ 7s 8s -12%
rej_uniform_native ✅ 7s 8s -12%
poly_decompose_c ✅ 6s 5s +20%
poly_sub ✅ 6s 3s +100%
poly_uniform ✅ 6s 4s +50%
poly_uniform_eta ✅ 6s 4s +50%
rej_uniform_eta_native_aarch64 ✅ 6s 5s +20%
sign_pk_from_sk ✅ 6s 6s +0%
sign_verify ✅ 6s 5s +20%
unpack_sk ✅ 6s 5s +20%
unpack_sk_t0hat ✅ 6s 7s -14%
yvec_init ✅ 6s 4s +50%
montgomery_reduce ✅ 5s 3s +67%
poly_caddq_native ✅ 5s 4s +25%
poly_invntt_tomont_native ✅ 5s 5s +0%
poly_use_hint_native ✅ 5s 3s +67%
polyeta_pack ✅ 5s 4s +25%
polyt1_pack ✅ 5s 3s +67%
polyvecl_uniform_gamma1 ✅ 5s 2s +150%
polyz_unpack_17_native_aarch64 ✅ 5s 3s +67%
polyz_unpack_native_x86_64 ✅ 5s 3s +67%
shake128_init ✅ 5s 1s +400%
sign_keypair_internal ✅ 5s 6s -17%
decompose ✅ 4s 3s +33%
intt_native_x86_64 ✅ 4s 3s +33%
keccak_absorb ✅ 4s 3s +33%
keccak_f1600_x4_native_aarch64_v84a ✅ 4s 4s +0%
keccak_squeezeblocks_x4 ✅ 4s 4s +0%
keccakf1600_extract_bytes (big endian) ✅ 4s 3s +33%
keccakf1600x4_xor_bytes_native ✅ 4s 3s +33%
mld_keccakf1600x4_xor_bytes_c ✅ 4s 4s +0%
pack_sk_s1 ✅ 4s 1s +300%
poly_caddq_native_aarch64 ✅ 4s 3s +33%
poly_caddq_native_x86_64 ✅ 4s 2s +100%
poly_challenge ✅ 4s 5s -20%
poly_chknorm_native ✅ 4s 4s +0%
poly_chknorm_native_x86_64 ✅ 4s 2s +100%
poly_ntt ✅ 4s 3s +33%
poly_permute_bitrev_to_custom_optional_native ✅ 4s 5s -20%
poly_use_hint ✅ 4s 1s +300%
poly_use_hint_c ✅ 4s 2s +100%
polyt0_pack ✅ 4s 4s +0%
polyvec_matrix_pointwise_montgomery_row ✅ 4s 3s +33%
polyveck_chknorm ✅ 4s 3s +33%
polyveck_pack_w1 ✅ 4s 3s +33%
polyveck_unpack_eta ✅ 4s 4s +0%
polyvecl_chknorm ✅ 4s 7s -43%
polyvecl_pointwise_acc_montgomery ✅ 4s 5s -20%
rej_eta_native ✅ 4s 6s -33%
shake256_absorb ✅ 4s 2s +100%
sign_keypair ✅ 4s 4s +0%
sign_signature_extmu ✅ 4s 4s +0%
sign_signature_pre_hash_shake256 ✅ 4s 6s -33%
sign_verify_pre_hash_internal ✅ 4s 3s +33%
sign_verify_pre_hash_shake256 ✅ 4s 3s +33%
sk_s2hat_get_poly ✅ 4s 3s +33%
unpack_pk_t1 ✅ 4s 1s +300%
unpack_sk_s1hat ✅ 4s 2s +100%
use_hint ✅ 4s 3s +33%
yvec_get_poly ✅ 4s 4s +0%
caddq ✅ 3s 4s -25%
intt_native_aarch64 ✅ 3s 3s +0%
keccak_f1600_x1_native_aarch64 ✅ 3s 1s +200%
keccak_f1600_x1_native_aarch64_v84a ✅ 3s 1s +200%
keccak_f1600_x4_native_avx2 ✅ 3s 2s +50%
keccak_finalize ✅ 3s 1s +200%
keccakf1600_permute_native ✅ 3s 4s -25%
keccakf1600_xor_bytes ✅ 3s 3s +0%
keccakf1600_xor_bytes (big endian) ✅ 3s 2s +50%
keccakf1600x4_permute ✅ 3s 3s +0%
make_hint ✅ 3s 3s +0%
mld_ct_cmask_nonzero_u32 ✅ 3s 2s +50%
mld_ct_cmask_nonzero_u8 ✅ 3s 3s +0%
mld_ct_memcmp ✅ 3s 3s +0%
mld_h ✅ 3s 3s +0%
mld_keccakf1600x4_extract_bytes_c ✅ 3s 2s +50%
mld_polymat_expand_entry ✅ 3s 3s +0%
mld_prepare_domain_separation_prefix ✅ 3s 4s -25%
mld_value_barrier_u32 ✅ 3s 2s +50%
pack_sig_h ✅ 3s 4s -25%
pack_sk_rho_key_tr_s2 ✅ 3s 3s +0%
pointwise_native_aarch64 ✅ 3s 5s -40%
pointwise_native_x86_64 ✅ 3s 2s +50%
poly_caddq_c ✅ 3s 3s +0%
poly_chknorm_native_aarch64 ✅ 3s 4s -25%
poly_decompose_32_native_aarch64 ✅ 3s 5s -40%
poly_decompose_native ✅ 3s 2s +50%
poly_decompose_native_x86_64 ✅ 3s 2s +50%
poly_power2round ✅ 3s 3s +0%
poly_shiftl ✅ 3s 4s -25%
poly_uniform_gamma1_4x ✅ 3s 3s +0%
poly_use_hint_native_aarch64 ✅ 3s 2s +50%
poly_use_hint_native_x86_64 ✅ 3s - new
polyveck_pack_eta ✅ 3s 6s -50%
polyvecl_pack_eta ✅ 3s 3s +0%
polyvecl_pointwise_acc_montgomery_native ✅ 3s 3s +0%
polyvecl_unpack_z ✅ 3s 4s -25%
polyw1_pack ✅ 3s 4s -25%
polyw1_pack_32 ✅ 3s 4s -25%
polyw1_pack_88 ✅ 3s 3s +0%
polyz_unpack ✅ 3s 2s +50%
polyz_unpack_19_native_aarch64 ✅ 3s 4s -25%
polyz_unpack_c ✅ 3s 3s +0%
rej_eta ✅ 3s 4s -25%
rej_eta_c ✅ 3s 5s -40%
shake256 ✅ 3s 2s +50%
shake256_finalize ✅ 3s 2s +50%
shake256_release ✅ 3s 3s +0%
shake256_squeeze ✅ 3s 2s +50%
sign_signature ✅ 3s 5s -40%
sign_signature_pre_hash_internal ✅ 3s 5s -40%
sign_verify_extmu ✅ 3s 3s +0%
sk_s1hat_get_poly ✅ 3s 3s +0%
unpack_sk_s2hat ✅ 3s 3s +0%
fqscale ✅ 2s 3s -33%
keccak_f1600_x4_native_aarch64_v8a_v84a_scalar_hybrid ✅ 2s 4s -50%
keccak_init ✅ 2s 3s -33%
keccak_squeeze ✅ 2s 2s +0%
keccakf1600x4_extract_bytes_native ✅ 2s 2s +0%
mld_ct_cmask_neg_i32 ✅ 2s 4s -50%
mld_ct_get_optblocker_i64 ✅ 2s 3s -33%
mld_ct_get_optblocker_u32 ✅ 2s 2s +0%
mld_ct_sel_int32 ✅ 2s 3s -33%
mld_value_barrier_i64 ✅ 2s 1s +100%
mld_value_barrier_u8 ✅ 2s 3s -33%
ntt_native_aarch64 ✅ 2s 6s -67%
ntt_native_x86_64 ✅ 2s 2s +0%
nttunpack_native_x86_64 ✅ 2s 3s -33%
pack_sig_c ✅ 2s 4s -50%
pack_sig_z ✅ 2s 5s -60%
poly_caddq ✅ 2s 2s +0%
poly_decompose_88_native_aarch64 ✅ 2s 2s +0%
poly_invntt_tomont ✅ 2s 1s +100%
poly_ntt_native ✅ 2s 3s -33%
poly_permute_bitrev_to_custom_optional ✅ 2s 3s -33%
poly_pointwise_montgomery ✅ 2s 4s -50%
poly_pointwise_montgomery_native ✅ 2s 5s -60%
poly_reduce ✅ 2s 2s +0%
poly_uniform_gamma1 ✅ 2s 4s -50%
polyveck_reduce ✅ 2s 3s -33%
polyvecl_uniform_gamma1_serial ✅ 2s 4s -50%
polyvecl_unpack_eta ✅ 2s 5s -60%
polyz_pack ✅ 2s 5s -60%
reduce32 ✅ 2s 3s -33%
rej_uniform_native_aarch64 ✅ 2s 2s +0%
shake128_finalize ✅ 2s 2s +0%
shake128_squeeze ✅ 2s 2s +0%
shake128x4_absorb_once ✅ 2s 5s -60%
shake128x4_squeezeblocks ✅ 2s 3s -33%
shake256_init ✅ 2s 2s +0%
shake256x4_absorb_once ✅ 2s 2s +0%
shake256x4_squeezeblocks ✅ 2s 1s +100%
sig_unpack_hints ✅ 2s 3s -33%
sk_t0hat_get_poly ✅ 2s 4s -50%
keccak_f1600_x4_native_aarch64_v8a_scalar_hybrid ✅ 1s 3s -67%
keccakf1600_permute ✅ 1s 3s -67%
keccakf1600x4_extract_bytes ✅ 1s 2s -50%
keccakf1600x4_xor_bytes ✅ 1s 3s -67%
mld_ct_abs_i32 ✅ 1s 3s -67%
mld_ct_get_optblocker_u8 ✅ 1s 3s -67%
mld_keccakf1600_extract_bytes ✅ 1s 4s -75%
poly_chknorm ✅ 1s 3s -67%
poly_decompose ✅ 1s 3s -67%
polyz_unpack_native ✅ 1s 4s -75%
power2round ✅ 1s 4s -75%
shake128_absorb ✅ 1s 4s -75%
shake128_release ✅ 1s 4s -75%
sys_check_capability ✅ 1s 3s -67%

@bremoran bremoran force-pushed the armv81m-keccak-x1 branch 2 times, most recently from f875a73 to a1dde44 Compare July 14, 2026 06:05
bremoran added 2 commits July 14, 2026 07:53
@bremoran
Move Armv81-M FIPS202 dev backend to opt
a1175cb 
Signed-off-by: Brendan Moran <brendan.moran@arm.com>
@bremoran
Integrate Armv81-M Keccak x1 backends
e8a49a1 
Signed-off-by: Brendan Moran <brendan.moran@arm.com>
@bremoran bremoran force-pushed the armv81m-keccak-x1 branch from a1dde44 to e8a49a1 Compare July 14, 2026 10:42
bremoran added 3 commits July 14, 2026 21:42
@bremoran
Switch to python slothy script
0d031e1 
Signed-off-by: Brendan Moran <brendan.moran@arm.com>
@bremoran
Add 1000s timeout
8bbc5fb 
Signed-off-by: Brendan Moran <brendan.moran@arm.com>
@bremoran
Clean up M7 code gen for keccak x1
a8e5cb8 
Signed-off-by: Brendan Moran <brendan.moran@arm.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@bremoran @oqs-bot