Skip to content

[WIP] Add signing hooks for observing signature attempts and implementing restartable signing#1237

Draft
hanno-becker wants to merge 2 commits into
mainfrom
sign_hooks
Draft

[WIP] Add signing hooks for observing signature attempts and implementing restartable signing#1237
hanno-becker wants to merge 2 commits into
mainfrom
sign_hooks

Conversation

@hanno-becker

@hanno-becker hanno-becker commented Jun 28, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor 
    sign: Add configurable signing hooks (resume/attempt/finish)

    The runtime of ML-DSA signatures is theoretically unbounded. Even the
    bound of max 814 signature attempts -- approved by NIST as lowering the
    chance of signing failure below 2^{-256} -- leaves a performance distribution
    whose peak percentiles can be inacceptable for constrained systems with
    strict timing requirements.

    As a remedy, the library already provides a configuration option
    MLD_CONFIG_MAX_SIGNING_ATTEMPTS to limit the number of signing attempts.
    However, FIPS 204 explicitly forbids lowering the number of signing attempts
    below 814, rendering the use of this option in constrained environments
    non-compliant.

    As a remedy, this commit introduces a facility for _restartable signing_:
    In addition to using MLD_CONFIG_MAX_SIGNING_ATTEMPTS, the user can provide
    a custom hook for remembering the last signing attempt, and continuing the
    next signing call at that point.

    More specifically, the idea is to introduce three 'signing hooks'
    into the core signature routine:
    - `nonce = sign_resume()`: Return the nonce corresponding to the next
      signing attempt. `0` for the an initial / non-restartable signing
      operation.
    - `sign_attempt(nonce)`: Note the nonce for the next signing attempt.
    - `sign_finish(nonce)`: Note the nonce for which signing succeeded.

    Here, only `sign_resume()` affects the signing process functionally,
    while `sign_attempt()` and `sign_finish()` are passive logging operations.

    This approach to restartable signing only works if the consumer works
    directly with the internal signing API. If they use the randomized API,
    a fresh seed would be chosen even on supposedly restarted signing operations,
    leading to non-compliant signatures. The use of a `sign_resume()` hook
    is therefore only safe with MLD_CONFIG_NO_RANDOMIZED_API.

    In contrast, `sign_attempt` and `sign_finish` are passive, and can safely
    be used on their own with any configuration. Indeed, these hooks serve
    other uses outside of restartable signing:
    - sign_attempt can be used to get finer-grained benchmarks for individual
      signing attempts
    - sign_finish can be used to log the number of signing attempts, which
      can be useful again for benchmarking, or for checking the expected
      distribution of signing attempts.

    Finally, sign_{resume|attempt|finish} can all be implemented based on
    mutable globals, or based on a context. It therefore makes sense to
    introduce them under the the existing MLD_CONFIG_CONTEXT_PARAMETER
    wrapper, which allows functions to be called with or without an
    application-specific context pointer.

    Taking all these considerations together, here's what the commit changes:

    - Add independent MLD_CONFIG_SIGN_HOOK_{RESUME|FINISH|ATTEMPT} configuration
      options for registering signing hooks as above. When set, the user provides
      the following functions, respectively:

      - `nonce = mld_sign_resume([ctxt])`: Provide initial or resuming nonce
      - `mld_sign_attempt(nonce [, ctxt])`: Log/remember nonce for next attempt
      - `mld_sign_finish(nonce [, ctxt])`: Log/remember nonce for successful attempt

    - The option can be used with or without MLD_CONFIG_CONTEXT_PARAMETER. If the
      latter is set, the user-provided context will be passed to `mld_sign_xxx`
      as the last argument.

    - An example is added illustrating the use of the hooks to implement restartable
      signing.

    Note: A consumer might want to use restartable signing with randomized APIs.
    This is not natively supported. However, it is expected to be easily implementable
    since the components required to build randomized signing from deterministic
    signing are all public.

@hanno-becker hanno-becker changed the title Sign hooks Add signing hooks for observing signature attempts and implementing restartable signing Jun 28, 2026
@hanno-becker hanno-becker changed the title Add signing hooks for observing signature attempts and implementing restartable signing [WIP] Add signing hooks for observing signature attempts and implementing restartable signing Jun 28, 2026
@oqs-bot

oqs-bot commented Jun 28, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

CBMC Results (ML-DSA-44, REDUCE-RAM)

Full Results (208 proofs)
Proof Status Current Previous Change
**TOTAL** ✅ 2015s 2080s -3.1%
mld_invntt_layer ✅ 185s 197s -6%
mld_ct_memcmp ✅ 182s 204s -11%
rej_uniform_native ✅ 179s 189s -5%
polyvec_matrix_pointwise_montgomery_yvec ✅ 156s 159s -2%
poly_pointwise_montgomery_c ✅ 132s 135s -2%
rej_uniform_native_aarch64 ✅ 115s 118s -3%
polyveck_chknorm ✅ 68s 70s -3%
sign_verify_internal ✅ 52s 57s -9%
mld_ntt_layer ✅ 45s 49s -8%
fqmul ✅ 43s 44s -2%
mld_attempt_signature_generation ✅ 29s 25s +16%
mld_ntt_butterfly_block ✅ 23s 27s -15%
keccakf1600x4_permute_native ✅ 22s 20s +10%
poly_ntt_c ✅ 19s 22s -14%
compute_pack_t0_t1 ✅ 18s 11s +64%
mld_check_pct ✅ 17s 16s +6%
rej_uniform_c ✅ 17s 16s +6%
poly_chknorm_c ✅ 14s 14s +0%
poly_uniform_eta_4x ✅ 14s 15s -7%
polyeta_unpack ✅ 14s 14s +0%
polyt0_unpack ✅ 13s 13s +0%
polyvecl_chknorm ✅ 13s 13s +0%
poly_add ✅ 11s 7s +57%
poly_invntt_tomont_c ✅ 11s 11s +0%
rej_uniform ✅ 10s 7s +43%
sign ✅ 10s 10s +0%
keccak_absorb_once_x4 ✅ 9s 9s +0%
polyz_unpack_c ✅ 9s 10s -10%
mld_compute_pack_z ✅ 8s 7s +14%
polyveck_decompose ✅ 8s 8s +0%
pointwise_acc_native_x86_64 ✅ 7s 6s +17%
keccak_squeezeblocks_x4 ✅ 6s 5s +20%
mld_h ✅ 6s 2s +200%
mld_keccakf1600_permute_c ✅ 6s 10s -40%
mld_sample_s1_s2_serial ✅ 6s 6s +0%
poly_reduce ✅ 6s 8s -25%
polyvec_matrix_pointwise_montgomery_row ✅ 6s 6s +0%
sign_signature_pre_hash_shake256 ✅ 6s 4s +50%
keccak_absorb ✅ 5s 3s +67%
make_hint ✅ 5s 4s +25%
mld_sign_attempt ✅ 5s - new
pack_sig_z ✅ 5s 4s +25%
pointwise_acc_native_aarch64 ✅ 5s 5s +0%
pointwise_native_aarch64 ✅ 5s 3s +67%
poly_decompose_c ✅ 5s 6s -17%
poly_ntt_native ✅ 5s 2s +150%
poly_pointwise_montgomery ✅ 5s 4s +25%
poly_power2round ✅ 5s 6s -17%
poly_sub ✅ 5s 3s +67%
polyvecl_ntt ✅ 5s 3s +67%
rej_eta_c ✅ 5s 3s +67%
sign_keypair ✅ 5s 6s -17%
sign_keypair_internal ✅ 5s 7s -29%
sign_pk_from_sk ✅ 5s 8s -38%
sign_verify_extmu ✅ 5s 3s +67%
sign_verify_pre_hash_internal ✅ 5s 3s +67%
unpack_sk_s1hat ✅ 5s 5s +0%
unpack_sk_s2hat ✅ 5s 2s +150%
keccak_f1600_x4_native_aarch64_v8a_scalar_hybrid ✅ 4s 3s +33%
keccak_squeeze ✅ 4s 3s +33%
keccakf1600x4_extract_bytes_native ✅ 4s 2s +100%
keccakf1600x4_permute ✅ 4s 1s +300%
mld_ct_cmask_nonzero_u32 ✅ 4s 2s +100%
mld_ct_get_optblocker_i64 ✅ 4s 1s +300%
mld_ct_get_optblocker_u8 ✅ 4s 2s +100%
mld_prepare_domain_separation_prefix ✅ 4s 7s -43%
mld_sign_finish ✅ 4s - new
ntt_native_aarch64 ✅ 4s 3s +33%
poly_caddq ✅ 4s 3s +33%
poly_challenge ✅ 4s 5s -20%
poly_chknorm ✅ 4s 2s +100%
poly_chknorm_native_aarch64 ✅ 4s 3s +33%
poly_decompose ✅ 4s 4s +0%
poly_decompose_32_native_aarch64 ✅ 4s 2s +100%
poly_decompose_88_native_aarch64 ✅ 4s 3s +33%
poly_uniform_4x ✅ 4s 4s +0%
poly_uniform_eta ✅ 4s 5s -20%
polyt1_pack ✅ 4s 6s -33%
polyveck_caddq ✅ 4s 3s +33%
polyveck_invntt_tomont ✅ 4s 4s +0%
polyveck_unpack_eta ✅ 4s 2s +100%
polyvecl_pointwise_acc_montgomery_c ✅ 4s 2s +100%
polyvecl_pointwise_acc_montgomery_native ✅ 4s 5s -20%
polyvecl_unpack_z ✅ 4s 3s +33%
polyw1_pack ✅ 4s 4s +0%
polyw1_pack_32 ✅ 4s 2s +100%
polyz_unpack_17_native_aarch64 ✅ 4s 6s -33%
polyz_unpack_19_native_aarch64 ✅ 4s 3s +33%
polyz_unpack_native ✅ 4s 2s +100%
rej_eta_native ✅ 4s 5s -20%
rej_uniform_eta_native_aarch64 ✅ 4s 3s +33%
shake256_finalize ✅ 4s 3s +33%
shake256x4_squeezeblocks ✅ 4s 3s +33%
sig_unpack_hints ✅ 4s 2s +100%
sign_signature_internal ✅ 4s 6s -33%
sign_signature_pre_hash_internal ✅ 4s 3s +33%
sign_verify ✅ 4s 2s +100%
sign_verify_pre_hash_shake256 ✅ 4s 3s +33%
sk_t0hat_get_poly ✅ 4s 2s +100%
sys_check_capability ✅ 4s 4s +0%
unpack_pk_t1 ✅ 4s 2s +100%
caddq ✅ 3s 2s +50%
decompose ✅ 3s 3s +0%
intt_native_x86_64 ✅ 3s 3s +0%
keccak_init ✅ 3s 3s +0%
keccakf1600x4_xor_bytes_native ✅ 3s 1s +200%
mld_ct_abs_i32 ✅ 3s 3s +0%
mld_ct_cmask_nonzero_u8 ✅ 3s 4s -25%
mld_keccakf1600_extract_bytes ✅ 3s 3s +0%
mld_sample_s1_s2 ✅ 3s 6s -50%
mld_sign_resume ✅ 3s - new
mld_value_barrier_i64 ✅ 3s 2s +50%
pack_sig_c ✅ 3s 2s +50%
pack_sig_h ✅ 3s 3s +0%
pointwise_native_x86_64 ✅ 3s 3s +0%
poly_caddq_c ✅ 3s 5s -40%
poly_caddq_native_aarch64 ✅ 3s 3s +0%
poly_chknorm_native ✅ 3s 3s +0%
poly_chknorm_native_x86_64 ✅ 3s 3s +0%
poly_invntt_tomont ✅ 3s 1s +200%
poly_invntt_tomont_native ✅ 3s 3s +0%
poly_permute_bitrev_to_custom_optional ✅ 3s 3s +0%
poly_permute_bitrev_to_custom_optional_native ✅ 3s 2s +50%
poly_pointwise_montgomery_native ✅ 3s 5s -40%
poly_uniform ✅ 3s 5s -40%
poly_use_hint_native_aarch64 ✅ 3s 4s -25%
polyeta_pack ✅ 3s 2s +50%
polyt0_pack ✅ 3s 6s -50%
polyvec_matrix_expand ✅ 3s 3s +0%
polyvec_matrix_expand_serial ✅ 3s 3s +0%
polyveck_reduce ✅ 3s 4s -25%
polyvecl_pack_eta ✅ 3s 2s +50%
polyvecl_pointwise_acc_montgomery ✅ 3s 2s +50%
polyvecl_unpack_eta ✅ 3s 2s +50%
polyw1_pack_88 ✅ 3s 2s +50%
polyz_pack ✅ 3s 3s +0%
polyz_unpack_native_x86_64 ✅ 3s 5s -40%
power2round ✅ 3s 3s +0%
shake128_absorb ✅ 3s 3s +0%
shake128_init ✅ 3s 2s +50%
shake128_release ✅ 3s 3s +0%
shake256 ✅ 3s 3s +0%
shake256_init ✅ 3s 1s +200%
shake256_release ✅ 3s 3s +0%
sign_open ✅ 3s 6s -50%
sign_signature ✅ 3s 5s -40%
sk_s1hat_get_poly ✅ 3s 3s +0%
unpack_sk ✅ 3s 2s +50%
fqscale ✅ 2s 4s -50%
intt_native_aarch64 ✅ 2s 3s -33%
keccak_f1600_x1_native_aarch64 ✅ 2s 2s +0%
keccak_f1600_x1_native_aarch64_v84a ✅ 2s 1s +100%
keccak_f1600_x4_native_aarch64_v84a ✅ 2s 2s +0%
keccak_f1600_x4_native_aarch64_v8a_v84a_scalar_hybrid ✅ 2s 3s -33%
keccak_f1600_x4_native_avx2 ✅ 2s 2s +0%
keccak_finalize ✅ 2s 1s +100%
keccakf1600_permute ✅ 2s 3s -33%
keccakf1600x4_extract_bytes ✅ 2s 3s -33%
keccakf1600x4_xor_bytes ✅ 2s 1s +100%
mld_ct_cmask_neg_i32 ✅ 2s 3s -33%
mld_ct_get_optblocker_u32 ✅ 2s 2s +0%
mld_ct_sel_int32 ✅ 2s 2s +0%
mld_keccakf1600x4_extract_bytes_c ✅ 2s 2s +0%
mld_keccakf1600x4_xor_bytes_c ✅ 2s 2s +0%
mld_value_barrier_u32 ✅ 2s 2s +0%
montgomery_reduce ✅ 2s 4s -50%
ntt_native_x86_64 ✅ 2s 4s -50%
nttunpack_native_x86_64 ✅ 2s 3s -33%
pack_sk_rho_key_tr_s2 ✅ 2s 5s -60%
poly_caddq_native ✅ 2s 5s -60%
poly_caddq_native_x86_64 ✅ 2s 3s -33%
poly_ntt ✅ 2s 1s +100%
poly_shiftl ✅ 2s 5s -60%
poly_uniform_gamma1 ✅ 2s 4s -50%
poly_uniform_gamma1_4x ✅ 2s 4s -50%
poly_use_hint_c ✅ 2s 4s -50%
poly_use_hint_native ✅ 2s 5s -60%
polyt1_unpack ✅ 2s 4s -50%
polyveck_ntt ✅ 2s 3s -33%
polyveck_pack_eta ✅ 2s 2s +0%
polyveck_pack_w1 ✅ 2s 5s -60%
polyvecl_uniform_gamma1 ✅ 2s 3s -33%
polyz_unpack ✅ 2s 3s -33%
reduce32 ✅ 2s 2s +0%
rej_eta ✅ 2s 3s -33%
shake128_squeeze ✅ 2s 5s -60%
shake128x4_squeezeblocks ✅ 2s 3s -33%
shake256_absorb ✅ 2s 3s -33%
shake256_squeeze ✅ 2s 2s +0%
sign_signature_extmu ✅ 2s 6s -67%
sk_s2hat_get_poly ✅ 2s 2s +0%
unpack_sk_t0hat ✅ 2s 3s -33%
use_hint ✅ 2s 2s +0%
yvec_get_poly ✅ 2s 2s +0%
yvec_init ✅ 2s 2s +0%
keccakf1600_extract_bytes (big endian) ✅ 1s 4s -75%
keccakf1600_permute_native ✅ 1s 2s -50%
keccakf1600_xor_bytes ✅ 1s 2s -50%
keccakf1600_xor_bytes (big endian) ✅ 1s 3s -67%
mld_polymat_expand_entry ✅ 1s 4s -75%
mld_value_barrier_u8 ✅ 1s 3s -67%
pack_sk_s1 ✅ 1s 3s -67%
poly_decompose_native ✅ 1s 4s -75%
poly_use_hint ✅ 1s 4s -75%
polyvecl_uniform_gamma1_serial ✅ 1s 1s +0%
shake128_finalize ✅ 1s 3s -67%
shake128x4_absorb_once ✅ 1s 2s -50%
shake256x4_absorb_once ✅ 1s 3s -67%

@oqs-bot

oqs-bot commented Jun 28, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

CBMC Results (ML-DSA-65)

Full Results (208 proofs)
Proof Status Current Previous Change
**TOTAL** ✅ 2534s 2695s -6.0%
polyvecl_pointwise_acc_montgomery_c ✅ 331s 401s -17%
mld_invntt_layer ✅ 204s 225s -9%
mld_ct_memcmp ✅ 185s 200s -7%
rej_uniform_native ✅ 183s 203s -10%
sign_verify_internal ✅ 177s 185s -4%
poly_pointwise_montgomery_c ✅ 134s 145s -8%
rej_uniform_native_aarch64 ✅ 113s 119s -5%
polyvec_matrix_expand ✅ 109s 117s -7%
mld_attempt_signature_generation ✅ 75s 51s +47%
sign_signature_internal ✅ 60s 51s +18%
mld_ntt_layer ✅ 42s 47s -11%
fqmul ✅ 39s 44s -11%
polyvec_matrix_expand_serial ✅ 28s 28s +0%
keccakf1600x4_permute_native ✅ 22s 23s -4%
mld_ntt_butterfly_block ✅ 21s 23s -9%
polyvec_matrix_pointwise_montgomery_yvec ✅ 21s 23s -9%
mld_check_pct ✅ 18s 15s +20%
poly_ntt_c ✅ 18s 23s -22%
rej_uniform_c ✅ 16s 17s -6%
poly_chknorm_c ✅ 15s 18s -17%
polyt0_unpack ✅ 15s 16s -6%
rej_uniform ✅ 15s 15s +0%
compute_pack_t0_t1 ✅ 14s 14s +0%
poly_uniform_eta_4x ✅ 13s 13s +0%
polyveck_decompose ✅ 13s 17s -24%
poly_invntt_tomont_c ✅ 12s 10s +20%
polyz_unpack_c ✅ 12s 13s -8%
keccak_absorb_once_x4 ✅ 11s 10s +10%
poly_uniform_4x ✅ 11s 13s -15%
polyveck_invntt_tomont ✅ 8s 9s -11%
mld_compute_pack_z ✅ 7s 9s -22%
mld_keccakf1600_permute_c ✅ 7s 5s +40%
pointwise_acc_native_aarch64 ✅ 7s 6s +17%
poly_decompose_c ✅ 7s 6s +17%
polyeta_unpack ✅ 7s 6s +17%
polyvec_matrix_pointwise_montgomery_row ✅ 7s 3s +133%
polyveck_caddq ✅ 7s 8s -12%
polyveck_chknorm ✅ 7s 8s -12%
polyveck_ntt ✅ 7s 9s -22%
sign ✅ 7s 9s -22%
keccakf1600x4_permute ✅ 6s 2s +200%
poly_add ✅ 6s 8s -25%
poly_ntt_native ✅ 6s 3s +100%
poly_use_hint_c ✅ 6s 6s +0%
polyt1_unpack ✅ 6s 6s +0%
polyvecl_chknorm ✅ 6s 4s +50%
sign_signature_pre_hash_internal ✅ 6s 3s +100%
keccak_absorb ✅ 5s 6s -17%
keccak_f1600_x4_native_avx2 ✅ 5s 3s +67%
mld_keccakf1600x4_xor_bytes_c ✅ 5s 2s +150%
mld_prepare_domain_separation_prefix ✅ 5s 6s -17%
mld_sign_resume ✅ 5s - new
pointwise_acc_native_x86_64 ✅ 5s 6s -17%
poly_challenge ✅ 5s 4s +25%
poly_pointwise_montgomery_native ✅ 5s 4s +25%
poly_use_hint_native_aarch64 ✅ 5s 2s +150%
polyvecl_ntt ✅ 5s 5s +0%
polyw1_pack_88 ✅ 5s 3s +67%
polyz_unpack_17_native_aarch64 ✅ 5s 5s +0%
reduce32 ✅ 5s 3s +67%
rej_eta ✅ 5s 2s +150%
rej_uniform_eta_native_aarch64 ✅ 5s 5s +0%
shake256_finalize ✅ 5s 2s +150%
sign_keypair_internal ✅ 5s 6s -17%
sign_signature_pre_hash_shake256 ✅ 5s 3s +67%
sign_verify ✅ 5s 2s +150%
unpack_sk_t0hat ✅ 5s 8s -38%
intt_native_aarch64 ✅ 4s 3s +33%
keccak_squeezeblocks_x4 ✅ 4s 5s -20%
mld_h ✅ 4s 6s -33%
mld_value_barrier_i64 ✅ 4s 3s +33%
ntt_native_aarch64 ✅ 4s 4s +0%
nttunpack_native_x86_64 ✅ 4s 5s -20%
pack_sk_rho_key_tr_s2 ✅ 4s 4s +0%
pointwise_native_aarch64 ✅ 4s 4s +0%
pointwise_native_x86_64 ✅ 4s 2s +100%
poly_chknorm_native_x86_64 ✅ 4s 3s +33%
poly_decompose_32_native_aarch64 ✅ 4s 4s +0%
poly_permute_bitrev_to_custom_optional ✅ 4s 2s +100%
poly_power2round ✅ 4s 4s +0%
poly_sub ✅ 4s 2s +100%
poly_uniform ✅ 4s 4s +0%
poly_uniform_gamma1_4x ✅ 4s 5s -20%
poly_use_hint ✅ 4s 4s +0%
polyt0_pack ✅ 4s 3s +33%
polyw1_pack_32 ✅ 4s 1s +300%
polyz_unpack_19_native_aarch64 ✅ 4s 3s +33%
power2round ✅ 4s 2s +100%
shake256_init ✅ 4s 1s +300%
sign_keypair ✅ 4s 3s +33%
sign_pk_from_sk ✅ 4s 7s -43%
sign_signature ✅ 4s 3s +33%
sign_signature_extmu ✅ 4s 3s +33%
sign_verify_extmu ✅ 4s 4s +0%
sys_check_capability ✅ 4s 1s +300%
unpack_sk_s2hat ✅ 4s 5s -20%
use_hint ✅ 4s 3s +33%
caddq ✅ 3s 3s +0%
fqscale ✅ 3s 2s +50%
intt_native_x86_64 ✅ 3s 3s +0%
keccak_f1600_x4_native_aarch64_v8a_scalar_hybrid ✅ 3s 1s +200%
keccak_squeeze ✅ 3s 2s +50%
keccakf1600_extract_bytes (big endian) ✅ 3s 3s +0%
keccakf1600_permute ✅ 3s 1s +200%
keccakf1600_xor_bytes (big endian) ✅ 3s 3s +0%
keccakf1600x4_xor_bytes ✅ 3s 2s +50%
make_hint ✅ 3s 3s +0%
mld_ct_cmask_nonzero_u8 ✅ 3s 4s -25%
mld_ct_get_optblocker_u8 ✅ 3s 1s +200%
mld_polymat_expand_entry ✅ 3s 3s +0%
mld_sample_s1_s2 ✅ 3s 6s -50%
mld_sample_s1_s2_serial ✅ 3s 7s -57%
mld_sign_attempt ✅ 3s - new
mld_sign_finish ✅ 3s - new
mld_value_barrier_u8 ✅ 3s 2s +50%
montgomery_reduce ✅ 3s 2s +50%
pack_sig_h ✅ 3s 3s +0%
pack_sk_s1 ✅ 3s 2s +50%
poly_caddq ✅ 3s 3s +0%
poly_caddq_c ✅ 3s 3s +0%
poly_caddq_native ✅ 3s 3s +0%
poly_caddq_native_aarch64 ✅ 3s 2s +50%
poly_caddq_native_x86_64 ✅ 3s 4s -25%
poly_decompose_88_native_aarch64 ✅ 3s 3s +0%
poly_invntt_tomont ✅ 3s 4s -25%
poly_invntt_tomont_native ✅ 3s 3s +0%
poly_shiftl ✅ 3s 3s +0%
poly_uniform_eta ✅ 3s 4s -25%
poly_use_hint_native ✅ 3s 3s +0%
polyveck_pack_eta ✅ 3s 4s -25%
polyveck_pack_w1 ✅ 3s 4s -25%
polyveck_reduce ✅ 3s 3s +0%
polyvecl_pointwise_acc_montgomery ✅ 3s 4s -25%
polyvecl_pointwise_acc_montgomery_native ✅ 3s 2s +50%
polyvecl_uniform_gamma1 ✅ 3s 2s +50%
polyvecl_uniform_gamma1_serial ✅ 3s 3s +0%
polyvecl_unpack_eta ✅ 3s 2s +50%
polyvecl_unpack_z ✅ 3s 5s -40%
polyw1_pack ✅ 3s 2s +50%
polyz_pack ✅ 3s 3s +0%
polyz_unpack ✅ 3s 2s +50%
polyz_unpack_native_x86_64 ✅ 3s 3s +0%
rej_eta_native ✅ 3s 5s -40%
shake128_absorb ✅ 3s 2s +50%
shake128_finalize ✅ 3s 4s -25%
shake128_release ✅ 3s 3s +0%
shake128_squeeze ✅ 3s 3s +0%
shake256_release ✅ 3s 2s +50%
shake256_squeeze ✅ 3s 3s +0%
shake256x4_squeezeblocks ✅ 3s 1s +200%
sig_unpack_hints ✅ 3s 5s -40%
sign_open ✅ 3s 4s -25%
sign_verify_pre_hash_internal ✅ 3s 6s -50%
sign_verify_pre_hash_shake256 ✅ 3s 2s +50%
unpack_pk_t1 ✅ 3s 1s +200%
unpack_sk ✅ 3s 3s +0%
decompose ✅ 2s 3s -33%
keccak_f1600_x4_native_aarch64_v84a ✅ 2s 2s +0%
keccak_f1600_x4_native_aarch64_v8a_v84a_scalar_hybrid ✅ 2s 2s +0%
keccak_init ✅ 2s 2s +0%
keccakf1600x4_extract_bytes ✅ 2s 4s -50%
keccakf1600x4_xor_bytes_native ✅ 2s 2s +0%
mld_ct_abs_i32 ✅ 2s 3s -33%
mld_ct_cmask_neg_i32 ✅ 2s 3s -33%
mld_ct_cmask_nonzero_u32 ✅ 2s 5s -60%
mld_ct_get_optblocker_i64 ✅ 2s 2s +0%
mld_ct_get_optblocker_u32 ✅ 2s 2s +0%
mld_ct_sel_int32 ✅ 2s 2s +0%
mld_keccakf1600_extract_bytes ✅ 2s 2s +0%
mld_keccakf1600x4_extract_bytes_c ✅ 2s 2s +0%
mld_value_barrier_u32 ✅ 2s 1s +100%
ntt_native_x86_64 ✅ 2s 4s -50%
pack_sig_c ✅ 2s 6s -67%
pack_sig_z ✅ 2s 3s -33%
poly_chknorm ✅ 2s 4s -50%
poly_chknorm_native ✅ 2s 4s -50%
poly_chknorm_native_aarch64 ✅ 2s 3s -33%
poly_decompose ✅ 2s 2s +0%
poly_decompose_native ✅ 2s 5s -60%
poly_ntt ✅ 2s 2s +0%
poly_permute_bitrev_to_custom_optional_native ✅ 2s 4s -50%
poly_reduce ✅ 2s 4s -50%
poly_uniform_gamma1 ✅ 2s 3s -33%
polyeta_pack ✅ 2s 2s +0%
polyt1_pack ✅ 2s 3s -33%
polyz_unpack_native ✅ 2s 4s -50%
shake128x4_absorb_once ✅ 2s 3s -33%
shake128x4_squeezeblocks ✅ 2s 3s -33%
shake256 ✅ 2s 3s -33%
shake256_absorb ✅ 2s 2s +0%
shake256x4_absorb_once ✅ 2s 4s -50%
sk_s1hat_get_poly ✅ 2s 4s -50%
sk_s2hat_get_poly ✅ 2s 4s -50%
yvec_get_poly ✅ 2s 2s +0%
keccak_f1600_x1_native_aarch64 ✅ 1s 3s -67%
keccak_f1600_x1_native_aarch64_v84a ✅ 1s 4s -75%
keccak_finalize ✅ 1s 4s -75%
keccakf1600_permute_native ✅ 1s 2s -50%
keccakf1600_xor_bytes ✅ 1s 3s -67%
keccakf1600x4_extract_bytes_native ✅ 1s 1s +0%
poly_pointwise_montgomery ✅ 1s 1s +0%
polyveck_unpack_eta ✅ 1s 3s -67%
polyvecl_pack_eta ✅ 1s 4s -75%
rej_eta_c ✅ 1s 3s -67%
shake128_init ✅ 1s 2s -50%
sk_t0hat_get_poly ✅ 1s 3s -67%
unpack_sk_s1hat ✅ 1s 4s -75%
yvec_init ✅ 1s 3s -67%

@oqs-bot

oqs-bot commented Jun 28, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

CBMC Results (ML-DSA-44)

Full Results (208 proofs)
Proof Status Current Previous Change
**TOTAL** ✅ 2418s 2439s -0.9%
polyvecl_pointwise_acc_montgomery_c ✅ 436s 446s -2%
mld_invntt_layer ✅ 200s 208s -4%
mld_ct_memcmp ✅ 183s 176s +4%
rej_uniform_native ✅ 181s 193s -6%
poly_pointwise_montgomery_c ✅ 133s 139s -4%
sign_verify_internal ✅ 118s 120s -2%
rej_uniform_native_aarch64 ✅ 112s 119s -6%
compute_pack_t0_t1 ✅ 50s 52s -4%
mld_attempt_signature_generation ✅ 44s 52s -15%
mld_ntt_layer ✅ 43s 44s -2%
fqmul ✅ 41s 42s -2%
polyvec_matrix_expand ✅ 29s 29s +0%
mld_ntt_butterfly_block ✅ 25s 23s +9%
keccakf1600x4_permute_native ✅ 22s 21s +5%
sign_signature_internal ✅ 22s 17s +29%
poly_ntt_c ✅ 20s 18s +11%
poly_chknorm_c ✅ 17s 16s +6%
polyeta_unpack ✅ 16s 17s -6%
polyt0_unpack ✅ 16s 15s +7%
polyvec_matrix_pointwise_montgomery_yvec ✅ 16s 19s -16%
mld_check_pct ✅ 14s 15s -7%
rej_uniform ✅ 14s 15s -7%
rej_uniform_c ✅ 14s 17s -18%
poly_invntt_tomont_c ✅ 12s 11s +9%
poly_uniform_eta_4x ✅ 12s 12s +0%
polyz_unpack_c ✅ 12s 12s +0%
poly_uniform_4x ✅ 11s 14s -21%
keccak_absorb_once_x4 ✅ 10s 10s +0%
polyvec_matrix_expand_serial ✅ 9s 9s +0%
polyvecl_chknorm ✅ 9s 9s +0%
mld_sample_s1_s2 ✅ 7s 5s +40%
polyveck_decompose ✅ 7s 4s +75%
sign ✅ 7s 8s -12%
mld_keccakf1600_permute_c ✅ 6s 7s -14%
poly_add ✅ 6s 7s -14%
poly_caddq_c ✅ 6s 3s +100%
polyt1_unpack ✅ 6s 4s +50%
polyveck_chknorm ✅ 6s 4s +50%
sign_verify_pre_hash_internal ✅ 6s 3s +100%
sign_verify_pre_hash_shake256 ✅ 6s 3s +100%
intt_native_aarch64 ✅ 5s 3s +67%
mld_h ✅ 5s 5s +0%
mld_value_barrier_u8 ✅ 5s 3s +67%
ntt_native_aarch64 ✅ 5s 5s +0%
pack_sig_c ✅ 5s 5s +0%
pointwise_acc_native_aarch64 ✅ 5s 4s +25%
pointwise_native_aarch64 ✅ 5s 2s +150%
poly_pointwise_montgomery ✅ 5s 1s +400%
poly_shiftl ✅ 5s 3s +67%
polyveck_reduce ✅ 5s 4s +25%
polyw1_pack_88 ✅ 5s 1s +400%
polyz_unpack ✅ 5s 2s +150%
shake128_finalize ✅ 5s 4s +25%
shake256 ✅ 5s 2s +150%
sign_keypair_internal ✅ 5s 5s +0%
sign_open ✅ 5s 7s -29%
sign_pk_from_sk ✅ 5s 8s -38%
caddq ✅ 4s 3s +33%
decompose ✅ 4s 2s +100%
fqscale ✅ 4s 3s +33%
intt_native_x86_64 ✅ 4s 2s +100%
keccak_squeezeblocks_x4 ✅ 4s 4s +0%
keccakf1600_extract_bytes (big endian) ✅ 4s 3s +33%
keccakf1600x4_extract_bytes ✅ 4s 1s +300%
mld_compute_pack_z ✅ 4s 7s -43%
mld_prepare_domain_separation_prefix ✅ 4s 3s +33%
mld_sign_attempt ✅ 4s - new
ntt_native_x86_64 ✅ 4s 3s +33%
pack_sk_s1 ✅ 4s 2s +100%
pointwise_acc_native_x86_64 ✅ 4s 5s -20%
poly_caddq_native ✅ 4s 5s -20%
poly_caddq_native_aarch64 ✅ 4s 3s +33%
poly_caddq_native_x86_64 ✅ 4s 3s +33%
poly_challenge ✅ 4s 4s +0%
poly_chknorm_native_aarch64 ✅ 4s 5s -20%
poly_decompose_88_native_aarch64 ✅ 4s 3s +33%
poly_decompose_c ✅ 4s 4s +0%
poly_ntt ✅ 4s 4s +0%
poly_ntt_native ✅ 4s 2s +100%
poly_permute_bitrev_to_custom_optional_native ✅ 4s 4s +0%
poly_sub ✅ 4s 4s +0%
poly_use_hint_c ✅ 4s 2s +100%
poly_use_hint_native ✅ 4s 6s -33%
polyvec_matrix_pointwise_montgomery_row ✅ 4s 1s +300%
polyveck_caddq ✅ 4s 4s +0%
polyveck_ntt ✅ 4s 3s +33%
polyveck_pack_w1 ✅ 4s 2s +100%
polyvecl_unpack_z ✅ 4s 1s +300%
polyw1_pack ✅ 4s 2s +100%
rej_eta_c ✅ 4s 5s -20%
rej_eta_native ✅ 4s 5s -20%
rej_uniform_eta_native_aarch64 ✅ 4s 5s -20%
shake256_absorb ✅ 4s 2s +100%
sign_signature_pre_hash_shake256 ✅ 4s 2s +100%
sign_verify ✅ 4s 3s +33%
sign_verify_extmu ✅ 4s 5s -20%
sk_s2hat_get_poly ✅ 4s 2s +100%
sys_check_capability ✅ 4s 1s +300%
unpack_sk ✅ 4s 4s +0%
unpack_sk_t0hat ✅ 4s 4s +0%
yvec_init ✅ 4s 4s +0%
keccak_absorb ✅ 3s 6s -50%
keccak_f1600_x4_native_aarch64_v84a ✅ 3s 1s +200%
keccak_f1600_x4_native_avx2 ✅ 3s 2s +50%
keccak_init ✅ 3s 3s +0%
keccakf1600_permute_native ✅ 3s 3s +0%
keccakf1600x4_xor_bytes ✅ 3s 2s +50%
keccakf1600x4_xor_bytes_native ✅ 3s 3s +0%
mld_ct_cmask_nonzero_u32 ✅ 3s 3s +0%
mld_ct_cmask_nonzero_u8 ✅ 3s 2s +50%
mld_ct_get_optblocker_u32 ✅ 3s 2s +50%
mld_ct_get_optblocker_u8 ✅ 3s 2s +50%
mld_keccakf1600x4_extract_bytes_c ✅ 3s 2s +50%
mld_keccakf1600x4_xor_bytes_c ✅ 3s 2s +50%
mld_polymat_expand_entry ✅ 3s 3s +0%
mld_sample_s1_s2_serial ✅ 3s 3s +0%
mld_sign_finish ✅ 3s - new
mld_sign_resume ✅ 3s - new
mld_value_barrier_i64 ✅ 3s 3s +0%
nttunpack_native_x86_64 ✅ 3s 2s +50%
pointwise_native_x86_64 ✅ 3s 4s -25%
poly_chknorm ✅ 3s 5s -40%
poly_invntt_tomont_native ✅ 3s 2s +50%
poly_uniform ✅ 3s 4s -25%
poly_uniform_gamma1 ✅ 3s 1s +200%
poly_use_hint_native_aarch64 ✅ 3s 5s -40%
polyeta_pack ✅ 3s 3s +0%
polyt1_pack ✅ 3s 4s -25%
polyveck_invntt_tomont ✅ 3s 4s -25%
polyvecl_pack_eta ✅ 3s 1s +200%
polyvecl_pointwise_acc_montgomery ✅ 3s 2s +50%
polyvecl_pointwise_acc_montgomery_native ✅ 3s 3s +0%
polyvecl_uniform_gamma1_serial ✅ 3s 3s +0%
polyz_pack ✅ 3s 3s +0%
polyz_unpack_17_native_aarch64 ✅ 3s 1s +200%
polyz_unpack_native ✅ 3s 2s +50%
polyz_unpack_native_x86_64 ✅ 3s 5s -40%
reduce32 ✅ 3s 4s -25%
shake128_init ✅ 3s 4s -25%
shake128_release ✅ 3s 3s +0%
shake256_squeeze ✅ 3s 1s +200%
shake256x4_absorb_once ✅ 3s 5s -40%
shake256x4_squeezeblocks ✅ 3s 2s +50%
sign_keypair ✅ 3s 4s -25%
sign_signature ✅ 3s 4s -25%
sign_signature_extmu ✅ 3s 3s +0%
sign_signature_pre_hash_internal ✅ 3s 5s -40%
unpack_pk_t1 ✅ 3s 3s +0%
unpack_sk_s1hat ✅ 3s 2s +50%
use_hint ✅ 3s 2s +50%
keccak_f1600_x1_native_aarch64_v84a ✅ 2s 3s -33%
keccak_f1600_x4_native_aarch64_v8a_scalar_hybrid ✅ 2s 2s +0%
keccak_f1600_x4_native_aarch64_v8a_v84a_scalar_hybrid ✅ 2s 1s +100%
keccak_finalize ✅ 2s 1s +100%
keccak_squeeze ✅ 2s 2s +0%
keccakf1600_permute ✅ 2s 5s -60%
keccakf1600_xor_bytes (big endian) ✅ 2s 2s +0%
keccakf1600x4_extract_bytes_native ✅ 2s 1s +100%
keccakf1600x4_permute ✅ 2s 2s +0%
make_hint ✅ 2s 4s -50%
mld_ct_abs_i32 ✅ 2s 1s +100%
mld_ct_cmask_neg_i32 ✅ 2s 1s +100%
mld_ct_get_optblocker_i64 ✅ 2s 1s +100%
mld_ct_sel_int32 ✅ 2s 2s +0%
mld_keccakf1600_extract_bytes ✅ 2s 2s +0%
mld_value_barrier_u32 ✅ 2s 5s -60%
montgomery_reduce ✅ 2s 2s +0%
pack_sig_h ✅ 2s 4s -50%
poly_caddq ✅ 2s 3s -33%
poly_chknorm_native ✅ 2s 3s -33%
poly_chknorm_native_x86_64 ✅ 2s 2s +0%
poly_decompose ✅ 2s 4s -50%
poly_decompose_32_native_aarch64 ✅ 2s 3s -33%
poly_decompose_native ✅ 2s 4s -50%
poly_invntt_tomont ✅ 2s 2s +0%
poly_permute_bitrev_to_custom_optional ✅ 2s 4s -50%
poly_pointwise_montgomery_native ✅ 2s 3s -33%
poly_power2round ✅ 2s 4s -50%
poly_reduce ✅ 2s 2s +0%
poly_uniform_eta ✅ 2s 4s -50%
poly_uniform_gamma1_4x ✅ 2s 3s -33%
poly_use_hint ✅ 2s 2s +0%
polyt0_pack ✅ 2s 3s -33%
polyveck_pack_eta ✅ 2s 3s -33%
polyveck_unpack_eta ✅ 2s 4s -50%
polyvecl_ntt ✅ 2s 3s -33%
polyvecl_uniform_gamma1 ✅ 2s 2s +0%
polyw1_pack_32 ✅ 2s 4s -50%
polyz_unpack_19_native_aarch64 ✅ 2s 5s -60%
power2round ✅ 2s 5s -60%
shake128_squeeze ✅ 2s 3s -33%
shake128x4_squeezeblocks ✅ 2s 3s -33%
shake256_init ✅ 2s 2s +0%
shake256_release ✅ 2s 2s +0%
sig_unpack_hints ✅ 2s 3s -33%
sk_s1hat_get_poly ✅ 2s 1s +100%
sk_t0hat_get_poly ✅ 2s 4s -50%
unpack_sk_s2hat ✅ 2s 1s +100%
keccak_f1600_x1_native_aarch64 ✅ 1s 2s -50%
keccakf1600_xor_bytes ✅ 1s 3s -67%
pack_sig_z ✅ 1s 4s -75%
pack_sk_rho_key_tr_s2 ✅ 1s 2s -50%
polyvecl_unpack_eta ✅ 1s 2s -50%
rej_eta ✅ 1s 3s -67%
shake128_absorb ✅ 1s 3s -67%
shake128x4_absorb_once ✅ 1s 2s -50%
shake256_finalize ✅ 1s 2s -50%
yvec_get_poly ✅ 1s 2s -50%

@oqs-bot

oqs-bot commented Jun 28, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

CBMC Results (ML-DSA-87)

⚠️ Attention Required

Proof Status Current Previous Change
sign_signature_internal ⚠️ 89s 30s +197%
Full Results (208 proofs)
Proof Status Current Previous Change
**TOTAL** ✅ 3015s 3540s -14.8%
polyvecl_pointwise_acc_montgomery_c ✅ 673s 991s -32%
polyvec_matrix_expand ✅ 312s 348s -10%
mld_invntt_layer ✅ 202s 222s -9%
rej_uniform_native ✅ 187s 205s -9%
mld_ct_memcmp ✅ 183s 219s -16%
poly_pointwise_montgomery_c ✅ 132s 144s -8%
rej_uniform_native_aarch64 ✅ 111s 121s -8%
sign_verify_internal ✅ 98s 101s -3%
sign_signature_internal ⚠️ 89s 30s +197%
mld_attempt_signature_generation ✅ 54s 129s -58%
mld_ntt_layer ✅ 42s 46s -9%
fqmul ✅ 40s 46s -13%
polyvec_matrix_expand_serial ✅ 36s 39s -8%
keccakf1600x4_permute_native ✅ 23s 24s -4%
compute_pack_t0_t1 ✅ 20s 20s +0%
mld_ntt_butterfly_block ✅ 19s 24s -21%
poly_ntt_c ✅ 19s 22s -14%
polyvec_matrix_pointwise_montgomery_yvec ✅ 18s 19s -5%
poly_chknorm_c ✅ 15s 15s +0%
polyeta_unpack ✅ 14s 15s -7%
polyt0_unpack ✅ 14s 17s -18%
rej_uniform_c ✅ 14s 16s -12%
poly_uniform_4x ✅ 13s 14s -7%
rej_uniform ✅ 13s 17s -24%
mld_check_pct ✅ 12s 16s -25%
polyveck_decompose ✅ 12s 11s +9%
poly_invntt_tomont_c ✅ 11s 12s -8%
mld_compute_pack_z ✅ 10s 10s +0%
poly_uniform_eta_4x ✅ 10s 14s -29%
polyveck_ntt ✅ 10s 9s +11%
keccak_absorb_once_x4 ✅ 9s 8s +12%
pointwise_acc_native_aarch64 ✅ 9s 8s +12%
polyveck_invntt_tomont ✅ 9s 9s +0%
mld_sample_s1_s2 ✅ 8s 6s +33%
sign_signature ✅ 8s 3s +167%
mld_sample_s1_s2_serial ✅ 7s 5s +40%
pointwise_acc_native_x86_64 ✅ 7s 9s -22%
polyveck_caddq ✅ 7s 8s -12%
polyvecl_ntt ✅ 7s 7s +0%
polyvecl_unpack_eta ✅ 7s 4s +75%
sign ✅ 7s 8s -12%
unpack_sk_t0hat ✅ 7s 6s +17%
mld_keccakf1600_permute_c ✅ 6s 6s +0%
mld_keccakf1600x4_extract_bytes_c ✅ 6s 3s +100%
polyt1_unpack ✅ 6s 7s -14%
polyveck_chknorm ✅ 6s 6s +0%
polyz_unpack_native ✅ 6s 2s +200%
sign_keypair ✅ 6s 6s +0%
sign_pk_from_sk ✅ 6s 6s +0%
ntt_native_x86_64 ✅ 5s 3s +67%
poly_caddq_native_aarch64 ✅ 5s 2s +150%
poly_challenge ✅ 5s 7s -29%
poly_chknorm_native_x86_64 ✅ 5s 3s +67%
poly_decompose ✅ 5s 5s +0%
poly_power2round ✅ 5s 1s +400%
poly_reduce ✅ 5s 3s +67%
poly_use_hint ✅ 5s 2s +150%
poly_use_hint_c ✅ 5s 4s +25%
polyvecl_chknorm ✅ 5s 4s +25%
polyvecl_unpack_z ✅ 5s 2s +150%
rej_eta ✅ 5s 3s +67%
shake128_squeeze ✅ 5s 2s +150%
shake256_release ✅ 5s 4s +25%
sign_open ✅ 5s 8s -38%
sign_signature_pre_hash_internal ✅ 5s 3s +67%
intt_native_aarch64 ✅ 4s 4s +0%
keccak_absorb ✅ 4s 5s -20%
keccak_f1600_x4_native_aarch64_v8a_v84a_scalar_hybrid ✅ 4s 2s +100%
keccak_squeezeblocks_x4 ✅ 4s 4s +0%
keccakf1600_extract_bytes (big endian) ✅ 4s 1s +300%
keccakf1600x4_xor_bytes ✅ 4s 2s +100%
mld_h ✅ 4s 3s +33%
mld_keccakf1600_extract_bytes ✅ 4s 2s +100%
mld_keccakf1600x4_xor_bytes_c ✅ 4s 2s +100%
mld_prepare_domain_separation_prefix ✅ 4s 2s +100%
mld_sign_attempt ✅ 4s - new
mld_sign_finish ✅ 4s - new
mld_sign_resume ✅ 4s - new
nttunpack_native_x86_64 ✅ 4s 2s +100%
pack_sk_s1 ✅ 4s 2s +100%
poly_add ✅ 4s 7s -43%
poly_caddq ✅ 4s 3s +33%
poly_decompose_c ✅ 4s 4s +0%
poly_pointwise_montgomery_native ✅ 4s 5s -20%
poly_uniform ✅ 4s 5s -20%
poly_uniform_eta ✅ 4s 5s -20%
poly_use_hint_native_aarch64 ✅ 4s 4s +0%
polyveck_unpack_eta ✅ 4s 5s -20%
polyvecl_pointwise_acc_montgomery ✅ 4s 4s +0%
polyvecl_pointwise_acc_montgomery_native ✅ 4s 5s -20%
polyz_pack ✅ 4s 3s +33%
polyz_unpack_17_native_aarch64 ✅ 4s 2s +100%
polyz_unpack_19_native_aarch64 ✅ 4s 2s +100%
power2round ✅ 4s 3s +33%
rej_eta_c ✅ 4s 4s +0%
rej_eta_native ✅ 4s 8s -50%
sign_signature_pre_hash_shake256 ✅ 4s 5s -20%
sign_verify ✅ 4s 7s -43%
sign_verify_pre_hash_internal ✅ 4s 4s +0%
unpack_pk_t1 ✅ 4s 4s +0%
unpack_sk_s2hat ✅ 4s 4s +0%
use_hint ✅ 4s 4s +0%
caddq ✅ 3s 2s +50%
decompose ✅ 3s 3s +0%
fqscale ✅ 3s 3s +0%
intt_native_x86_64 ✅ 3s 4s -25%
keccak_f1600_x1_native_aarch64_v84a ✅ 3s 1s +200%
keccak_finalize ✅ 3s 3s +0%
keccakf1600_xor_bytes (big endian) ✅ 3s 2s +50%
keccakf1600x4_xor_bytes_native ✅ 3s 2s +50%
make_hint ✅ 3s 3s +0%
mld_ct_cmask_nonzero_u8 ✅ 3s 5s -40%
montgomery_reduce ✅ 3s 5s -40%
ntt_native_aarch64 ✅ 3s 3s +0%
pack_sig_c ✅ 3s 4s -25%
pointwise_native_aarch64 ✅ 3s 4s -25%
poly_caddq_native_x86_64 ✅ 3s 5s -40%
poly_chknorm_native_aarch64 ✅ 3s 4s -25%
poly_decompose_32_native_aarch64 ✅ 3s 3s +0%
poly_decompose_88_native_aarch64 ✅ 3s 2s +50%
poly_invntt_tomont_native ✅ 3s 4s -25%
poly_ntt_native ✅ 3s 5s -40%
poly_permute_bitrev_to_custom_optional_native ✅ 3s 5s -40%
poly_shiftl ✅ 3s 4s -25%
poly_sub ✅ 3s 4s -25%
poly_uniform_gamma1 ✅ 3s 2s +50%
poly_uniform_gamma1_4x ✅ 3s 4s -25%
polyt1_pack ✅ 3s 3s +0%
polyveck_pack_w1 ✅ 3s 3s +0%
polyveck_reduce ✅ 3s 2s +50%
polyvecl_uniform_gamma1 ✅ 3s 5s -40%
polyvecl_uniform_gamma1_serial ✅ 3s 5s -40%
polyw1_pack ✅ 3s 3s +0%
polyz_unpack ✅ 3s 1s +200%
polyz_unpack_c ✅ 3s 3s +0%
reduce32 ✅ 3s 3s +0%
rej_uniform_eta_native_aarch64 ✅ 3s 5s -40%
shake128_absorb ✅ 3s 4s -25%
shake256 ✅ 3s 2s +50%
shake256_init ✅ 3s 2s +50%
shake256_squeeze ✅ 3s 1s +200%
sign_keypair_internal ✅ 3s 6s -50%
sign_signature_extmu ✅ 3s 4s -25%
sign_verify_extmu ✅ 3s 4s -25%
sk_t0hat_get_poly ✅ 3s 5s -40%
sys_check_capability ✅ 3s 2s +50%
unpack_sk ✅ 3s 4s -25%
yvec_init ✅ 3s 2s +50%
keccak_f1600_x4_native_aarch64_v84a ✅ 2s 5s -60%
keccak_f1600_x4_native_aarch64_v8a_scalar_hybrid ✅ 2s 4s -50%
keccak_f1600_x4_native_avx2 ✅ 2s 3s -33%
keccak_init ✅ 2s 4s -50%
keccak_squeeze ✅ 2s 4s -50%
keccakf1600_permute_native ✅ 2s 2s +0%
keccakf1600_xor_bytes ✅ 2s 2s +0%
keccakf1600x4_extract_bytes ✅ 2s 3s -33%
keccakf1600x4_extract_bytes_native ✅ 2s 4s -50%
keccakf1600x4_permute ✅ 2s 2s +0%
mld_ct_abs_i32 ✅ 2s 1s +100%
mld_ct_cmask_nonzero_u32 ✅ 2s 1s +100%
mld_ct_get_optblocker_u32 ✅ 2s 3s -33%
mld_ct_get_optblocker_u8 ✅ 2s 3s -33%
mld_ct_sel_int32 ✅ 2s 2s +0%
mld_polymat_expand_entry ✅ 2s 2s +0%
mld_value_barrier_i64 ✅ 2s 1s +100%
mld_value_barrier_u32 ✅ 2s 2s +0%
mld_value_barrier_u8 ✅ 2s 2s +0%
pack_sig_h ✅ 2s 2s +0%
pack_sig_z ✅ 2s 4s -50%
pack_sk_rho_key_tr_s2 ✅ 2s 4s -50%
pointwise_native_x86_64 ✅ 2s 5s -60%
poly_caddq_c ✅ 2s 3s -33%
poly_chknorm_native ✅ 2s 2s +0%
poly_decompose_native ✅ 2s 5s -60%
poly_invntt_tomont ✅ 2s 2s +0%
poly_ntt ✅ 2s 3s -33%
poly_use_hint_native ✅ 2s 4s -50%
polyeta_pack ✅ 2s 2s +0%
polyt0_pack ✅ 2s 4s -50%
polyvec_matrix_pointwise_montgomery_row ✅ 2s 2s +0%
polyveck_pack_eta ✅ 2s 2s +0%
polyvecl_pack_eta ✅ 2s 2s +0%
polyw1_pack_32 ✅ 2s 2s +0%
polyw1_pack_88 ✅ 2s 3s -33%
polyz_unpack_native_x86_64 ✅ 2s 3s -33%
shake128_finalize ✅ 2s 3s -33%
shake128_init ✅ 2s 4s -50%
shake256_absorb ✅ 2s 1s +100%
shake256_finalize ✅ 2s 4s -50%
shake256x4_absorb_once ✅ 2s 3s -33%
shake256x4_squeezeblocks ✅ 2s 3s -33%
sig_unpack_hints ✅ 2s 4s -50%
sign_verify_pre_hash_shake256 ✅ 2s 4s -50%
sk_s1hat_get_poly ✅ 2s 2s +0%
sk_s2hat_get_poly ✅ 2s 4s -50%
unpack_sk_s1hat ✅ 2s 4s -50%
yvec_get_poly ✅ 2s 2s +0%
keccak_f1600_x1_native_aarch64 ✅ 1s 1s +0%
keccakf1600_permute ✅ 1s 2s -50%
mld_ct_cmask_neg_i32 ✅ 1s 1s +0%
mld_ct_get_optblocker_i64 ✅ 1s 2s -50%
poly_caddq_native ✅ 1s 4s -75%
poly_chknorm ✅ 1s 4s -75%
poly_permute_bitrev_to_custom_optional ✅ 1s 2s -50%
poly_pointwise_montgomery ✅ 1s 1s +0%
shake128_release ✅ 1s 2s -50%
shake128x4_absorb_once ✅ 1s 4s -75%
shake128x4_squeezeblocks ✅ 1s 3s -67%

@hanno-becker hanno-becker force-pushed the sign_hooks branch 2 times, most recently from a599d22 to ba5df63 Compare June 29, 2026 04:39
@hanno-becker
common: Split context-parameter machinery into context.h
c7ce4e7 
Move the MLD_CONTEXT_PARAMETERS_n macros and the associated configuration
check out of common.h into a new, level-generic header context.h, included
by common.h at the point the material previously sat. No behavioral change.

Signed-off-by: Hanno Becker <beckphan@amazon.co.uk>
@hanno-becker
sign: Add configurable signing hooks (resume/attempt/finish)
f9cbe01 
The runtime of ML-DSA signatures is theoretically unbounded. Even the
bound of max 814 signature attempts -- approved by NIST as lowering the
chance of signing failure below 2^{-256} -- leaves a performance distribution
whose peak percentiles can be inacceptable for constrained systems with
strict timing requirements.

As a remedy, the library already provides a configuration option
MLD_CONFIG_MAX_SIGNING_ATTEMPTS to limit the number of signing attempts.
However, FIPS 204 explicitly forbids lowering the number of signing attempts
below 814, rendering the use of this option in constrained environments
non-compliant.

As a remedy, this commit introduces a facility for _restartable signing_:
In addition to using MLD_CONFIG_MAX_SIGNING_ATTEMPTS, the user can provide
a custom hook for remembering the last signing attempt, and continuing the
next signing call at that point.

More specifically, the idea is to introduce three 'signing hooks'
into the core signature routine:
- `nonce = sign_resume()`: Return the nonce corresponding to the next
  signing attempt. `0` for the an initial / non-restartable signing
  operation.
- `sign_attempt(nonce)`: Note the nonce for the next signing attempt.
- `sign_finish(nonce)`: Note the nonce for which signing succeeded.

Here, only `sign_resume()` affects the signing process functionally,
while `sign_attempt()` and `sign_finish()` are passive logging operations.

This approach to restartable signing only works if the consumer works
directly with the internal signing API. If they use the randomized API,
a fresh seed would be chosen even on supposedly restarted signing operations,
leading to non-compliant signatures. The use of a `sign_resume()` hook
is therefore only safe with MLD_CONFIG_NO_RANDOMIZED_API.

In contrast, `sign_attempt` and `sign_finish` are passive, and can safely
be used on their own with any configuration. Indeed, these hooks serve
other uses outside of restartable signing:
- sign_attempt can be used to get finer-grained benchmarks for individual
  signing attempts
- sign_finish can be used to log the number of signing attempts, which
  can be useful again for benchmarking, or for checking the expected
  distribution of signing attempts.

Finally, sign_{resume|attempt|finish} can all be implemented based on
mutable globals, or based on a context. It therefore makes sense to
introduce them under the the existing MLD_CONFIG_CONTEXT_PARAMETER
wrapper, which allows functions to be called with or without an
application-specific context pointer.

Taking all these considerations together, here's what the commit changes:

- Add independent MLD_CONFIG_SIGN_HOOK_{RESUME|FINISH|ATTEMPT} configuration
  options for registering signing hooks as above. When set, the user provides
  the following functions, respectively:

  - `nonce = mld_sign_resume([ctxt])`: Provide initial or resuming nonce
  - `mld_sign_attempt(nonce [, ctxt])`: Log/remember nonce for next attempt
  - `mld_sign_finish(nonce [, ctxt])`: Log/remember nonce for successful attempt

- The option can be used with or without MLD_CONFIG_CONTEXT_PARAMETER. If the
  latter is set, the user-provided context will be passed to `mld_sign_xxx`
  as the last argument.

- An example is added illustrating the use of the hooks to implement restartable
  signing.

Note: A consumer might want to use restartable signing with randomized APIs.
This is not natively supported. However, it is expected to be easily implementable
since the components required to build randomized signing from deterministic
signing are all public.

Signed-off-by: Hanno Becker <beckphan@amazon.co.uk>
@oqs-bot

oqs-bot commented Jun 29, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

CBMC Results (ML-DSA-65, REDUCE-RAM)

Full Results (208 proofs)
Proof Status Current Previous Change
**TOTAL** ✅ 2038s 2085s -2.3%
polyvec_matrix_pointwise_montgomery_yvec ✅ 204s 209s -2%
mld_ct_memcmp ✅ 189s 192s -2%
mld_invntt_layer ✅ 182s 189s -4%
rej_uniform_native ✅ 168s 176s -5%
poly_pointwise_montgomery_c ✅ 121s 134s -10%
rej_uniform_native_aarch64 ✅ 111s 116s -4%
sign_verify_internal ✅ 69s 73s -5%
mld_ntt_layer ✅ 44s 45s -2%
polyvecl_chknorm ✅ 43s 46s -7%
fqmul ✅ 38s 42s -10%
polyveck_chknorm ✅ 33s 34s -3%
mld_attempt_signature_generation ✅ 29s 28s +4%
mld_ntt_butterfly_block ✅ 22s 24s -8%
keccakf1600x4_permute_native ✅ 21s 24s -12%
poly_ntt_c ✅ 20s 19s +5%
rej_uniform_c ✅ 15s 16s -6%
mld_check_pct ✅ 14s 15s -7%
polyt0_unpack ✅ 13s 14s -7%
polyveck_decompose ✅ 13s 12s +8%
poly_uniform_eta_4x ✅ 12s 12s +0%
poly_chknorm_c ✅ 11s 14s -21%
poly_invntt_tomont_c ✅ 11s 14s -21%
keccak_absorb_once_x4 ✅ 10s 11s -9%
polyz_unpack_c ✅ 10s 9s +11%
poly_add ✅ 9s 6s +50%
poly_caddq_c ✅ 9s 6s +50%
poly_decompose_c ✅ 9s 9s +0%
sign ✅ 8s 7s +14%
poly_power2round ✅ 7s 4s +75%
polyvec_matrix_pointwise_montgomery_row ✅ 7s 10s -30%
polyveck_caddq ✅ 7s 7s +0%
polyveck_reduce ✅ 7s 6s +17%
polyvecl_pointwise_acc_montgomery ✅ 7s 3s +133%
rej_eta_native ✅ 7s 5s +40%
rej_uniform ✅ 7s 9s -22%
sign_signature_internal ✅ 7s 7s +0%
mld_compute_pack_z ✅ 6s 9s -33%
mld_keccakf1600_permute_c ✅ 6s 7s -14%
pointwise_acc_native_x86_64 ✅ 6s 7s -14%
poly_caddq_native_aarch64 ✅ 6s 2s +200%
poly_challenge ✅ 6s 3s +100%
poly_reduce ✅ 6s 5s +20%
polyvecl_unpack_z ✅ 6s 7s -14%
power2round ✅ 6s 3s +100%
sign_keypair_internal ✅ 6s 8s -25%
sign_pk_from_sk ✅ 6s 8s -25%
compute_pack_t0_t1 ✅ 5s 9s -44%
mld_prepare_domain_separation_prefix ✅ 5s 2s +150%
mld_sample_s1_s2 ✅ 5s 5s +0%
mld_sample_s1_s2_serial ✅ 5s 5s +0%
pack_sk_rho_key_tr_s2 ✅ 5s 3s +67%
pack_sk_s1 ✅ 5s 3s +67%
poly_caddq_native ✅ 5s 2s +150%
poly_sub ✅ 5s 3s +67%
poly_uniform ✅ 5s 3s +67%
poly_uniform_gamma1 ✅ 5s 3s +67%
poly_uniform_gamma1_4x ✅ 5s 3s +67%
poly_use_hint ✅ 5s 1s +400%
poly_use_hint_native ✅ 5s 2s +150%
polyvecl_ntt ✅ 5s 5s +0%
polyvecl_uniform_gamma1_serial ✅ 5s 2s +150%
polyw1_pack_88 ✅ 5s 2s +150%
rej_eta_c ✅ 5s 3s +67%
shake128x4_absorb_once ✅ 5s 2s +150%
sign_signature ✅ 5s 7s -29%
sign_signature_extmu ✅ 5s 6s -17%
sign_verify_pre_hash_shake256 ✅ 5s 4s +25%
caddq ✅ 4s 5s -20%
intt_native_aarch64 ✅ 4s 4s +0%
keccak_f1600_x4_native_aarch64_v8a_scalar_hybrid ✅ 4s 1s +300%
keccak_squeezeblocks_x4 ✅ 4s 5s -20%
keccakf1600_xor_bytes ✅ 4s 1s +300%
mld_ct_cmask_nonzero_u32 ✅ 4s 4s +0%
mld_ct_get_optblocker_u8 ✅ 4s 2s +100%
mld_keccakf1600_extract_bytes ✅ 4s 2s +100%
mld_keccakf1600x4_xor_bytes_c ✅ 4s 3s +33%
mld_polymat_expand_entry ✅ 4s 2s +100%
mld_sign_attempt ✅ 4s - new
pack_sig_c ✅ 4s 5s -20%
pointwise_acc_native_aarch64 ✅ 4s 5s -20%
poly_caddq_native_x86_64 ✅ 4s 2s +100%
poly_chknorm_native_x86_64 ✅ 4s 3s +33%
poly_decompose_32_native_aarch64 ✅ 4s 3s +33%
poly_pointwise_montgomery_native ✅ 4s 2s +100%
poly_uniform_eta ✅ 4s 2s +100%
polyt1_pack ✅ 4s 3s +33%
polyvec_matrix_expand_serial ✅ 4s 2s +100%
polyveck_ntt ✅ 4s 2s +100%
polyveck_unpack_eta ✅ 4s 2s +100%
polyvecl_unpack_eta ✅ 4s 3s +33%
polyz_pack ✅ 4s 3s +33%
rej_uniform_eta_native_aarch64 ✅ 4s 3s +33%
shake256_squeeze ✅ 4s 1s +300%
sign_keypair ✅ 4s 3s +33%
sign_open ✅ 4s 3s +33%
sign_signature_pre_hash_internal ✅ 4s 5s -20%
sign_signature_pre_hash_shake256 ✅ 4s 4s +0%
sk_t0hat_get_poly ✅ 4s 5s -20%
unpack_sk_s1hat ✅ 4s 4s +0%
decompose ✅ 3s 4s -25%
keccak_absorb ✅ 3s 4s -25%
keccak_f1600_x1_native_aarch64_v84a ✅ 3s 1s +200%
keccak_finalize ✅ 3s 2s +50%
keccakf1600_permute ✅ 3s 4s -25%
keccakf1600_permute_native ✅ 3s 1s +200%
keccakf1600x4_permute ✅ 3s 3s +0%
mld_ct_abs_i32 ✅ 3s 3s +0%
mld_ct_cmask_nonzero_u8 ✅ 3s 3s +0%
mld_h ✅ 3s 6s -50%
mld_keccakf1600x4_extract_bytes_c ✅ 3s 1s +200%
mld_sign_resume ✅ 3s - new
mld_value_barrier_u32 ✅ 3s 1s +200%
ntt_native_x86_64 ✅ 3s 3s +0%
nttunpack_native_x86_64 ✅ 3s 2s +50%
pack_sig_h ✅ 3s 1s +200%
pointwise_native_x86_64 ✅ 3s 3s +0%
poly_caddq ✅ 3s 4s -25%
poly_chknorm ✅ 3s 2s +50%
poly_chknorm_native ✅ 3s 4s -25%
poly_decompose ✅ 3s 1s +200%
poly_decompose_native ✅ 3s 3s +0%
poly_invntt_tomont ✅ 3s 2s +50%
poly_ntt_native ✅ 3s 3s +0%
poly_uniform_4x ✅ 3s 5s -40%
polyeta_unpack ✅ 3s 2s +50%
polyt0_pack ✅ 3s 3s +0%
polyt1_unpack ✅ 3s 2s +50%
polyvec_matrix_expand ✅ 3s 3s +0%
polyveck_invntt_tomont ✅ 3s 6s -50%
polyveck_pack_w1 ✅ 3s 5s -40%
polyvecl_pointwise_acc_montgomery_c ✅ 3s 4s -25%
polyz_unpack ✅ 3s 6s -50%
polyz_unpack_19_native_aarch64 ✅ 3s 4s -25%
polyz_unpack_native ✅ 3s 4s -25%
polyz_unpack_native_x86_64 ✅ 3s 4s -25%
shake128_finalize ✅ 3s 2s +50%
shake128_squeeze ✅ 3s 3s +0%
shake128x4_squeezeblocks ✅ 3s 3s +0%
shake256_absorb ✅ 3s 3s +0%
shake256_release ✅ 3s 3s +0%
shake256x4_absorb_once ✅ 3s 3s +0%
sign_verify ✅ 3s 4s -25%
sign_verify_extmu ✅ 3s 3s +0%
sign_verify_pre_hash_internal ✅ 3s 5s -40%
sk_s1hat_get_poly ✅ 3s 4s -25%
sys_check_capability ✅ 3s 3s +0%
fqscale ✅ 2s 3s -33%
intt_native_x86_64 ✅ 2s 5s -60%
keccak_f1600_x4_native_aarch64_v8a_v84a_scalar_hybrid ✅ 2s 2s +0%
keccak_f1600_x4_native_avx2 ✅ 2s 1s +100%
keccakf1600_xor_bytes (big endian) ✅ 2s 3s -33%
keccakf1600x4_extract_bytes ✅ 2s 2s +0%
make_hint ✅ 2s 3s -33%
mld_ct_cmask_neg_i32 ✅ 2s 1s +100%
mld_ct_get_optblocker_i64 ✅ 2s 3s -33%
mld_ct_get_optblocker_u32 ✅ 2s 2s +0%
mld_ct_sel_int32 ✅ 2s 1s +100%
mld_sign_finish ✅ 2s - new
mld_value_barrier_i64 ✅ 2s 3s -33%
mld_value_barrier_u8 ✅ 2s 2s +0%
montgomery_reduce ✅ 2s 3s -33%
ntt_native_aarch64 ✅ 2s 5s -60%
pack_sig_z ✅ 2s 2s +0%
pointwise_native_aarch64 ✅ 2s 3s -33%
poly_chknorm_native_aarch64 ✅ 2s 3s -33%
poly_decompose_88_native_aarch64 ✅ 2s 3s -33%
poly_invntt_tomont_native ✅ 2s 2s +0%
poly_permute_bitrev_to_custom_optional ✅ 2s 3s -33%
poly_permute_bitrev_to_custom_optional_native ✅ 2s 3s -33%
poly_pointwise_montgomery ✅ 2s 3s -33%
poly_shiftl ✅ 2s 5s -60%
poly_use_hint_c ✅ 2s 2s +0%
poly_use_hint_native_aarch64 ✅ 2s 4s -50%
polyeta_pack ✅ 2s 1s +100%
polyveck_pack_eta ✅ 2s 4s -50%
polyvecl_pack_eta ✅ 2s 3s -33%
polyvecl_pointwise_acc_montgomery_native ✅ 2s 2s +0%
polyvecl_uniform_gamma1 ✅ 2s 5s -60%
polyw1_pack ✅ 2s 3s -33%
polyw1_pack_32 ✅ 2s 4s -50%
polyz_unpack_17_native_aarch64 ✅ 2s 2s +0%
reduce32 ✅ 2s 1s +100%
rej_eta ✅ 2s 2s +0%
shake128_absorb ✅ 2s 3s -33%
shake256_init ✅ 2s 2s +0%
shake256x4_squeezeblocks ✅ 2s 2s +0%
sig_unpack_hints ✅ 2s 2s +0%
sk_s2hat_get_poly ✅ 2s 3s -33%
unpack_pk_t1 ✅ 2s 3s -33%
unpack_sk ✅ 2s 2s +0%
unpack_sk_s2hat ✅ 2s 3s -33%
unpack_sk_t0hat ✅ 2s 4s -50%
use_hint ✅ 2s 2s +0%
yvec_get_poly ✅ 2s 3s -33%
keccak_f1600_x1_native_aarch64 ✅ 1s 2s -50%
keccak_f1600_x4_native_aarch64_v84a ✅ 1s 3s -67%
keccak_init ✅ 1s 2s -50%
keccak_squeeze ✅ 1s 1s +0%
keccakf1600_extract_bytes (big endian) ✅ 1s 4s -75%
keccakf1600x4_extract_bytes_native ✅ 1s 1s +0%
keccakf1600x4_xor_bytes ✅ 1s 2s -50%
keccakf1600x4_xor_bytes_native ✅ 1s 4s -75%
poly_ntt ✅ 1s 2s -50%
shake128_init ✅ 1s 3s -67%
shake128_release ✅ 1s 2s -50%
shake256 ✅ 1s 3s -67%
shake256_finalize ✅ 1s 5s -80%
yvec_init ✅ 1s 3s -67%

@oqs-bot

oqs-bot commented Jun 29, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

CBMC Results (ML-DSA-87, REDUCE-RAM)

Full Results (208 proofs)
Proof Status Current Previous Change
**TOTAL** ✅ 1928s 2028s -4.9%
polyvec_matrix_pointwise_montgomery_yvec ✅ 187s 203s -8%
mld_invntt_layer ✅ 180s 183s -2%
mld_ct_memcmp ✅ 172s 184s -7%
rej_uniform_native ✅ 162s 174s -7%
poly_pointwise_montgomery_c ✅ 123s 137s -10%
rej_uniform_native_aarch64 ✅ 106s 109s -3%
sign_verify_internal ✅ 45s 47s -4%
mld_ntt_layer ✅ 44s 43s +2%
fqmul ✅ 41s 43s -5%
polyvecl_chknorm ✅ 34s 35s -3%
mld_attempt_signature_generation ✅ 25s 32s -22%
keccakf1600x4_permute_native ✅ 21s 22s -5%
mld_ntt_butterfly_block ✅ 21s 23s -9%
poly_ntt_c ✅ 21s 19s +11%
polyeta_unpack ✅ 17s 15s +13%
mld_check_pct ✅ 15s 18s -17%
rej_uniform_c ✅ 15s 17s -12%
polyt0_unpack ✅ 14s 13s +8%
polyveck_decompose ✅ 14s 12s +17%
compute_pack_t0_t1 ✅ 12s 10s +20%
poly_uniform_eta_4x ✅ 12s 12s +0%
polyvec_matrix_pointwise_montgomery_row ✅ 12s 16s -25%
keccak_absorb_once_x4 ✅ 11s 11s +0%
poly_chknorm_c ✅ 10s 11s -9%
poly_invntt_tomont_c ✅ 10s 10s +0%
poly_add ✅ 9s 7s +29%
polyveck_chknorm ✅ 9s 12s -25%
polyvecl_ntt ✅ 9s 8s +12%
polyz_unpack_c ✅ 9s 9s +0%
rej_eta_native ✅ 8s 4s +100%
mld_sample_s1_s2 ✅ 7s 8s -12%
pointwise_acc_native_aarch64 ✅ 7s 8s -12%
pointwise_acc_native_x86_64 ✅ 7s 8s -12%
poly_power2round ✅ 7s 4s +75%
polyveck_caddq ✅ 7s 9s -22%
rej_uniform ✅ 7s 8s -12%
sign_pk_from_sk ✅ 7s 6s +17%
sign_signature_internal ✅ 7s 4s +75%
mld_sign_attempt ✅ 6s - new
poly_caddq_native_aarch64 ✅ 6s 5s +20%
sign ✅ 6s 9s -33%
caddq ✅ 5s 3s +67%
keccak_absorb ✅ 5s 4s +25%
mld_compute_pack_z ✅ 5s 6s -17%
mld_keccakf1600_permute_c ✅ 5s 5s +0%
mld_sample_s1_s2_serial ✅ 5s 4s +25%
mld_sign_resume ✅ 5s - new
poly_caddq_c ✅ 5s 3s +67%
poly_chknorm ✅ 5s 5s +0%
poly_decompose_32_native_aarch64 ✅ 5s 3s +67%
poly_decompose_c ✅ 5s 7s -29%
poly_reduce ✅ 5s 4s +25%
poly_uniform ✅ 5s 4s +25%
polyveck_invntt_tomont ✅ 5s 5s +0%
polyveck_ntt ✅ 5s 3s +67%
polyveck_pack_eta ✅ 5s 4s +25%
polyz_pack ✅ 5s 1s +400%
polyz_unpack_19_native_aarch64 ✅ 5s 2s +150%
rej_uniform_eta_native_aarch64 ✅ 5s 2s +150%
shake128_finalize ✅ 5s 3s +67%
shake256_init ✅ 5s 2s +150%
shake256_release ✅ 5s 3s +67%
sign_verify_pre_hash_shake256 ✅ 5s 6s -17%
decompose ✅ 4s 2s +100%
keccak_f1600_x4_native_aarch64_v8a_v84a_scalar_hybrid ✅ 4s 2s +100%
keccak_squeeze ✅ 4s 3s +33%
pointwise_native_aarch64 ✅ 4s 2s +100%
poly_challenge ✅ 4s 3s +33%
poly_chknorm_native ✅ 4s 2s +100%
poly_chknorm_native_x86_64 ✅ 4s 3s +33%
poly_permute_bitrev_to_custom_optional ✅ 4s 4s +0%
poly_permute_bitrev_to_custom_optional_native ✅ 4s 2s +100%
poly_pointwise_montgomery ✅ 4s 5s -20%
poly_sub ✅ 4s 3s +33%
poly_uniform_gamma1 ✅ 4s 3s +33%
poly_use_hint_c ✅ 4s 2s +100%
polyveck_reduce ✅ 4s 7s -43%
polyvecl_pack_eta ✅ 4s 4s +0%
polyvecl_pointwise_acc_montgomery_c ✅ 4s 3s +33%
sign_keypair ✅ 4s 6s -33%
sign_keypair_internal ✅ 4s 5s -20%
sign_signature ✅ 4s 4s +0%
sign_verify_extmu ✅ 4s 4s +0%
sign_verify_pre_hash_internal ✅ 4s 4s +0%
sk_s1hat_get_poly ✅ 4s 2s +100%
unpack_sk ✅ 4s 2s +100%
unpack_sk_s2hat ✅ 4s 2s +100%
yvec_get_poly ✅ 4s 3s +33%
fqscale ✅ 3s 2s +50%
intt_native_x86_64 ✅ 3s 5s -40%
keccak_f1600_x1_native_aarch64 ✅ 3s 2s +50%
keccak_f1600_x4_native_aarch64_v84a ✅ 3s 2s +50%
keccak_f1600_x4_native_avx2 ✅ 3s 2s +50%
keccakf1600_permute_native ✅ 3s 2s +50%
keccakf1600x4_extract_bytes ✅ 3s 2s +50%
keccakf1600x4_xor_bytes_native ✅ 3s 3s +0%
mld_ct_abs_i32 ✅ 3s 2s +50%
mld_h ✅ 3s 6s -50%
mld_keccakf1600_extract_bytes ✅ 3s 2s +50%
mld_keccakf1600x4_extract_bytes_c ✅ 3s 3s +0%
mld_polymat_expand_entry ✅ 3s 3s +0%
mld_prepare_domain_separation_prefix ✅ 3s 3s +0%
mld_sign_finish ✅ 3s - new
mld_value_barrier_i64 ✅ 3s 1s +200%
montgomery_reduce ✅ 3s 4s -25%
ntt_native_x86_64 ✅ 3s 2s +50%
pointwise_native_x86_64 ✅ 3s 3s +0%
poly_caddq_native ✅ 3s 4s -25%
poly_chknorm_native_aarch64 ✅ 3s 3s +0%
poly_decompose ✅ 3s 3s +0%
poly_decompose_88_native_aarch64 ✅ 3s 3s +0%
poly_decompose_native ✅ 3s 4s -25%
poly_invntt_tomont ✅ 3s 3s +0%
poly_ntt ✅ 3s 2s +50%
poly_shiftl ✅ 3s 3s +0%
poly_uniform_4x ✅ 3s 4s -25%
poly_uniform_gamma1_4x ✅ 3s 2s +50%
polyeta_pack ✅ 3s 2s +50%
polyt0_pack ✅ 3s 2s +50%
polyveck_pack_w1 ✅ 3s 2s +50%
polyvecl_pointwise_acc_montgomery ✅ 3s 2s +50%
polyvecl_uniform_gamma1 ✅ 3s 2s +50%
polyz_unpack_17_native_aarch64 ✅ 3s 3s +0%
polyz_unpack_native ✅ 3s 2s +50%
polyz_unpack_native_x86_64 ✅ 3s 3s +0%
power2round ✅ 3s 4s -25%
reduce32 ✅ 3s 4s -25%
rej_eta ✅ 3s 3s +0%
rej_eta_c ✅ 3s 5s -40%
shake256_absorb ✅ 3s 3s +0%
shake256x4_squeezeblocks ✅ 3s 2s +50%
sig_unpack_hints ✅ 3s 2s +50%
sign_open ✅ 3s 8s -62%
sign_signature_extmu ✅ 3s 2s +50%
sign_signature_pre_hash_shake256 ✅ 3s 3s +0%
sk_t0hat_get_poly ✅ 3s 4s -25%
use_hint ✅ 3s 4s -25%
yvec_init ✅ 3s 4s -25%
intt_native_aarch64 ✅ 2s 5s -60%
keccak_f1600_x1_native_aarch64_v84a ✅ 2s 1s +100%
keccak_finalize ✅ 2s 3s -33%
keccak_init ✅ 2s 3s -33%
keccak_squeezeblocks_x4 ✅ 2s 5s -60%
keccakf1600_xor_bytes (big endian) ✅ 2s 1s +100%
keccakf1600x4_extract_bytes_native ✅ 2s 2s +0%
keccakf1600x4_permute ✅ 2s 3s -33%
keccakf1600x4_xor_bytes ✅ 2s 1s +100%
make_hint ✅ 2s 5s -60%
mld_ct_cmask_neg_i32 ✅ 2s 2s +0%
mld_ct_cmask_nonzero_u32 ✅ 2s 4s -50%
mld_ct_cmask_nonzero_u8 ✅ 2s 4s -50%
mld_ct_get_optblocker_i64 ✅ 2s 2s +0%
mld_ct_get_optblocker_u32 ✅ 2s 3s -33%
mld_ct_sel_int32 ✅ 2s 2s +0%
mld_keccakf1600x4_xor_bytes_c ✅ 2s 5s -60%
mld_value_barrier_u32 ✅ 2s 3s -33%
mld_value_barrier_u8 ✅ 2s 3s -33%
ntt_native_aarch64 ✅ 2s 5s -60%
nttunpack_native_x86_64 ✅ 2s 4s -50%
pack_sig_h ✅ 2s 4s -50%
pack_sig_z ✅ 2s 3s -33%
pack_sk_rho_key_tr_s2 ✅ 2s 1s +100%
pack_sk_s1 ✅ 2s 3s -33%
poly_caddq ✅ 2s 6s -67%
poly_caddq_native_x86_64 ✅ 2s 4s -50%
poly_invntt_tomont_native ✅ 2s 2s +0%
poly_ntt_native ✅ 2s 3s -33%
poly_pointwise_montgomery_native ✅ 2s 2s +0%
poly_uniform_eta ✅ 2s 3s -33%
poly_use_hint ✅ 2s 2s +0%
poly_use_hint_native ✅ 2s 3s -33%
poly_use_hint_native_aarch64 ✅ 2s 3s -33%
polyt1_pack ✅ 2s 5s -60%
polyt1_unpack ✅ 2s 3s -33%
polyvec_matrix_expand_serial ✅ 2s 4s -50%
polyveck_unpack_eta ✅ 2s 3s -33%
polyvecl_pointwise_acc_montgomery_native ✅ 2s 4s -50%
polyvecl_unpack_eta ✅ 2s 4s -50%
polyw1_pack_32 ✅ 2s 2s +0%
polyw1_pack_88 ✅ 2s 3s -33%
polyz_unpack ✅ 2s 4s -50%
shake128_absorb ✅ 2s 2s +0%
shake128_squeeze ✅ 2s 1s +100%
shake128x4_absorb_once ✅ 2s 2s +0%
shake128x4_squeezeblocks ✅ 2s 3s -33%
shake256 ✅ 2s 4s -50%
shake256_finalize ✅ 2s 4s -50%
shake256_squeeze ✅ 2s 3s -33%
sign_signature_pre_hash_internal ✅ 2s 3s -33%
sign_verify ✅ 2s 4s -50%
sk_s2hat_get_poly ✅ 2s 2s +0%
unpack_pk_t1 ✅ 2s 2s +0%
unpack_sk_s1hat ✅ 2s 3s -33%
unpack_sk_t0hat ✅ 2s 3s -33%
keccak_f1600_x4_native_aarch64_v8a_scalar_hybrid ✅ 1s 2s -50%
keccakf1600_extract_bytes (big endian) ✅ 1s 2s -50%
keccakf1600_permute ✅ 1s 3s -67%
keccakf1600_xor_bytes ✅ 1s 1s +0%
mld_ct_get_optblocker_u8 ✅ 1s 4s -75%
pack_sig_c ✅ 1s 4s -75%
polyvec_matrix_expand ✅ 1s 3s -67%
polyvecl_uniform_gamma1_serial ✅ 1s 3s -67%
polyvecl_unpack_z ✅ 1s 2s -50%
polyw1_pack ✅ 1s 2s -50%
shake128_init ✅ 1s 5s -80%
shake128_release ✅ 1s 3s -67%
shake256x4_absorb_once ✅ 1s 3s -67%
sys_check_capability ✅ 1s 3s -67%

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@hanno-becker @oqs-bot