Clear ML-DSA outputs on signing failure

[tob-joe]

Summary

• clear caller-visible ML-DSA keypair outputs when key generation fails
• clear signature and signed-message outputs, and reset output lengths, when
  signing fails
• add RNG/allocation/PCT failure regression test coverage for stale output
  buffers
• keep verify-only reduced-api allocation and RNG-failure tests buildable by
  compiling the zeroization helper only when keypair or signing tests are
  enabled

Notes

The reduced-api verify-only configuration disables both keypair and sign APIs.
Those verify tests intentionally keep no-op output checks because verification
does not expose a caller-owned output buffer that needs zeroing. Without the
API guard, the shared zeroization helper was compiled but unused in that mode,
which fails under -Werror=unused-function.

Testing

• make run_rng_fail
• make run_alloc
• make run_unit
• make run_func
• focused reduced-api alloc/rng-fail with ASan/UBSan flags
• focused reduced-api-reduce-ram alloc/rng-fail with ASan/UBSan flags
• git diff --check

Co-authored-by: Codex [email protected]
Signed-off-by: Joe Doyle [email protected]

This work was completed by Trail of Bits as part of the Patch The Planet
project in collaboration with OpenAI. The issue was identified primarily by
the Codex coding agent, and manually reviewed before submission.

[mkannwischer]

Thanks @tob-joe! Generally, I do support this change of clearing buffers on failures.
I'm not very happy about the added complexity to the test_alloc.c and test_rng_fail.c.
Can't we just modify the existing tests to init with with fixed values, and check it's zero in the end?
Please also rebase on top of main.

[oqs-bot]

CBMC Results (ML-DSA-44)

Full Results (203 proofs)

Proof	Status	Current	Previous	Change
**TOTAL**	✅	1569s	1698s	-7.6%
polyvecl_pointwise_acc_montgomery_c	✅	147s	174s	-16%
poly_pointwise_montgomery_c	✅	128s	149s	-14%
sign_verify_internal	✅	123s	130s	-5%
mld_invntt_layer	✅	111s	122s	-9%
mld_attempt_signature_generation	✅	62s	63s	-2%
compute_pack_t0_t1	✅	48s	56s	-14%
mld_ntt_layer	✅	45s	44s	+2%
fqmul	✅	43s	44s	-2%
polyvec_matrix_expand	✅	29s	29s	+0%
mld_ntt_butterfly_block	✅	25s	23s	+9%
sign_signature_internal	✅	24s	24s	+0%
keccakf1600x4_permute_native	✅	22s	25s	-12%
poly_ntt_c	✅	20s	23s	-13%
polyvec_matrix_pointwise_montgomery_yvec	✅	18s	18s	+0%
mld_check_pct	✅	17s	15s	+13%
polyt0_unpack	✅	17s	15s	+13%
rej_uniform	✅	17s	16s	+6%
poly_chknorm_c	✅	15s	20s	-25%
poly_uniform_4x	✅	15s	13s	+15%
polyeta_unpack	✅	15s	16s	-6%
rej_uniform_c	✅	14s	16s	-12%
polyz_unpack_c	✅	13s	13s	+0%
polyvecl_chknorm	✅	12s	12s	+0%
poly_invntt_tomont_c	✅	11s	11s	+0%
poly_uniform_eta_4x	✅	11s	11s	+0%
keccak_absorb_once_x4	✅	10s	10s	+0%
poly_add	✅	7s	7s	+0%
polyvec_matrix_expand_serial	✅	7s	7s	+0%
sign_verify_pre_hash_internal	✅	7s	4s	+75%
keccakf1600_permute	✅	6s	3s	+100%
mld_compute_pack_z	✅	6s	7s	-14%
mld_keccakf1600_permute_c	✅	6s	7s	-14%
mld_sample_s1_s2	✅	6s	6s	+0%
poly_uniform_eta	✅	6s	3s	+100%
poly_uniform_gamma1	✅	6s	5s	+20%
polyvecl_pointwise_acc_montgomery_native	✅	6s	2s	+200%
sign_signature	✅	6s	6s	+0%
sign_signature_extmu	✅	6s	4s	+50%
sign_signature_pre_hash_shake256	✅	6s	5s	+20%
keccak_absorb	✅	5s	6s	-17%
mld_sample_s1_s2_serial	✅	5s	2s	+150%
pointwise_acc_native_aarch64	✅	5s	6s	-17%
pointwise_acc_native_x86_64	✅	5s	4s	+25%
pointwise_native_x86_64	✅	5s	5s	+0%
poly_decompose_c	✅	5s	5s	+0%
poly_ntt_native	✅	5s	3s	+67%
polyveck_chknorm	✅	5s	4s	+25%
polyveck_decompose	✅	5s	6s	-17%
polyvecl_ntt	✅	5s	3s	+67%
polyvecl_pack_eta	✅	5s	3s	+67%
rej_eta_c	✅	5s	2s	+150%
rej_eta_native	✅	5s	5s	+0%
rej_uniform_native	✅	5s	5s	+0%
sign_keypair_internal	✅	5s	4s	+25%
sign_pk_from_sk	✅	5s	4s	+25%
sign_verify_extmu	✅	5s	3s	+67%
sk_s2hat_get_poly	✅	5s	2s	+150%
sk_t0hat_get_poly	✅	5s	3s	+67%
keccak_f1600_x4_native_aarch64_v8a_v84a_scalar_hybrid	✅	4s	3s	+33%
keccakf1600_xor_bytes (big endian)	✅	4s	2s	+100%
make_hint	✅	4s	4s	+0%
mld_prepare_domain_separation_prefix	✅	4s	3s	+33%
ntt_native_x86_64	✅	4s	3s	+33%
pack_sig_c	✅	4s	2s	+100%
poly_decompose_88_native_aarch64	✅	4s	3s	+33%
poly_permute_bitrev_to_custom_optional	✅	4s	4s	+0%
poly_pointwise_montgomery	✅	4s	3s	+33%
poly_pointwise_montgomery_native	✅	4s	3s	+33%
poly_reduce	✅	4s	4s	+0%
poly_use_hint_c	✅	4s	2s	+100%
polyt1_unpack	✅	4s	6s	-33%
polyveck_caddq	✅	4s	4s	+0%
polyveck_invntt_tomont	✅	4s	5s	-20%
polyveck_ntt	✅	4s	2s	+100%
polyveck_pack_eta	✅	4s	1s	+300%
polyveck_reduce	✅	4s	3s	+33%
polyveck_unpack_eta	✅	4s	4s	+0%
polyw1_pack_32	✅	4s	2s	+100%
polyw1_pack_88	✅	4s	2s	+100%
polyz_unpack_native	✅	4s	5s	-20%
reduce32	✅	4s	4s	+0%
rej_uniform_eta_native_aarch64	✅	4s	3s	+33%
rej_uniform_native_aarch64	✅	4s	6s	-33%
shake128x4_absorb_once	✅	4s	1s	+300%
sig_unpack_hints	✅	4s	3s	+33%
sign_keypair	✅	4s	2s	+100%
sys_check_capability	✅	4s	2s	+100%
unpack_pk_t1	✅	4s	2s	+100%
unpack_sk_t0hat	✅	4s	6s	-33%
decompose	✅	3s	4s	-25%
intt_native_aarch64	✅	3s	4s	-25%
keccak_squeezeblocks_x4	✅	3s	6s	-50%
mld_ct_cmask_neg_i32	✅	3s	1s	+200%
mld_ct_cmask_nonzero_u8	✅	3s	3s	+0%
mld_ct_memcmp	✅	3s	3s	+0%
mld_h	✅	3s	4s	-25%
mld_keccakf1600_extract_bytes	✅	3s	2s	+50%
mld_value_barrier_i64	✅	3s	3s	+0%
ntt_native_aarch64	✅	3s	4s	-25%
pack_sig_z	✅	3s	2s	+50%
pointwise_native_aarch64	✅	3s	4s	-25%
poly_caddq_native_x86_64	✅	3s	5s	-40%
poly_chknorm	✅	3s	5s	-40%
poly_chknorm_native_x86_64	✅	3s	3s	+0%
poly_decompose	✅	3s	3s	+0%
poly_invntt_tomont_native	✅	3s	4s	-25%
poly_shiftl	✅	3s	2s	+50%
poly_uniform_gamma1_4x	✅	3s	7s	-57%
poly_use_hint	✅	3s	3s	+0%
poly_use_hint_native	✅	3s	4s	-25%
poly_use_hint_native_aarch64	✅	3s	3s	+0%
polyt0_pack	✅	3s	3s	+0%
polyt1_pack	✅	3s	3s	+0%
polyveck_pack_w1	✅	3s	2s	+50%
polyvecl_unpack_z	✅	3s	2s	+50%
polyw1_pack	✅	3s	2s	+50%
polyz_pack	✅	3s	3s	+0%
polyz_unpack_native_x86_64	✅	3s	5s	-40%
power2round	✅	3s	3s	+0%
shake128_absorb	✅	3s	4s	-25%
shake128_finalize	✅	3s	4s	-25%
shake128_init	✅	3s	2s	+50%
shake128_release	✅	3s	5s	-40%
shake128_squeeze	✅	3s	3s	+0%
shake128x4_squeezeblocks	✅	3s	2s	+50%
shake256	✅	3s	4s	-25%
shake256_absorb	✅	3s	3s	+0%
shake256_finalize	✅	3s	3s	+0%
shake256_init	✅	3s	3s	+0%
sign_verify	✅	3s	5s	-40%
sign_verify_pre_hash_shake256	✅	3s	5s	-40%
unpack_sk_s2hat	✅	3s	3s	+0%
use_hint	✅	3s	2s	+50%
caddq	✅	2s	3s	-33%
intt_native_x86_64	✅	2s	3s	-33%
keccak_f1600_x1_native_aarch64	✅	2s	2s	+0%
keccak_f1600_x1_native_aarch64_v84a	✅	2s	3s	-33%
keccak_f1600_x4_native_aarch64_v8a_scalar_hybrid	✅	2s	3s	-33%
keccak_f1600_x4_native_avx2	✅	2s	4s	-50%
keccak_squeeze	✅	2s	2s	+0%
keccakf1600_extract_bytes (big endian)	✅	2s	3s	-33%
keccakf1600_xor_bytes	✅	2s	1s	+100%
keccakf1600x4_extract_bytes	✅	2s	3s	-33%
keccakf1600x4_permute	✅	2s	3s	-33%
mld_ct_abs_i32	✅	2s	3s	-33%
mld_ct_get_optblocker_u8	✅	2s	2s	+0%
mld_ct_sel_int32	✅	2s	3s	-33%
mld_keccakf1600x4_extract_bytes_c	✅	2s	2s	+0%
mld_keccakf1600x4_xor_bytes_c	✅	2s	3s	-33%
mld_polymat_expand_entry	✅	2s	2s	+0%
mld_value_barrier_u8	✅	2s	3s	-33%
montgomery_reduce	✅	2s	4s	-50%
nttunpack_native_x86_64	✅	2s	1s	+100%
pack_sig_h	✅	2s	4s	-50%
pack_sk_rho_key_tr_s2	✅	2s	6s	-67%
pack_sk_s1	✅	2s	5s	-60%
poly_caddq	✅	2s	2s	+0%
poly_caddq_c	✅	2s	3s	-33%
poly_caddq_native	✅	2s	4s	-50%
poly_caddq_native_aarch64	✅	2s	7s	-71%
poly_challenge	✅	2s	5s	-60%
poly_chknorm_native	✅	2s	3s	-33%
poly_chknorm_native_aarch64	✅	2s	5s	-60%
poly_decompose_native	✅	2s	3s	-33%
poly_invntt_tomont	✅	2s	3s	-33%
poly_ntt	✅	2s	2s	+0%
poly_permute_bitrev_to_custom_optional_native	✅	2s	2s	+0%
poly_power2round	✅	2s	5s	-60%
poly_sub	✅	2s	2s	+0%
poly_uniform	✅	2s	5s	-60%
polyeta_pack	✅	2s	3s	-33%
polyvec_matrix_pointwise_montgomery_row	✅	2s	2s	+0%
polyvecl_pointwise_acc_montgomery	✅	2s	5s	-60%
polyvecl_uniform_gamma1	✅	2s	3s	-33%
polyvecl_uniform_gamma1_serial	✅	2s	1s	+100%
polyvecl_unpack_eta	✅	2s	3s	-33%
polyz_unpack_17_native_aarch64	✅	2s	5s	-60%
polyz_unpack_19_native_aarch64	✅	2s	4s	-50%
rej_eta	✅	2s	2s	+0%
shake256_release	✅	2s	3s	-33%
shake256_squeeze	✅	2s	1s	+100%
shake256x4_absorb_once	✅	2s	2s	+0%
shake256x4_squeezeblocks	✅	2s	3s	-33%
sign_signature_pre_hash_internal	✅	2s	5s	-60%
sk_s1hat_get_poly	✅	2s	4s	-50%
unpack_sk_s1hat	✅	2s	3s	-33%
yvec_get_poly	✅	2s	2s	+0%
yvec_init	✅	2s	3s	-33%
fqscale	✅	1s	3s	-67%
keccak_f1600_x4_native_aarch64_v84a	✅	1s	4s	-75%
keccak_finalize	✅	1s	2s	-50%
keccak_init	✅	1s	2s	-50%
keccakf1600_permute_native	✅	1s	2s	-50%
keccakf1600x4_extract_bytes_native	✅	1s	4s	-75%
keccakf1600x4_xor_bytes	✅	1s	3s	-67%
keccakf1600x4_xor_bytes_native	✅	1s	4s	-75%
mld_ct_cmask_nonzero_u32	✅	1s	2s	-50%
mld_ct_get_optblocker_i64	✅	1s	2s	-50%
mld_ct_get_optblocker_u32	✅	1s	4s	-75%
mld_value_barrier_u32	✅	1s	2s	-50%
poly_decompose_32_native_aarch64	✅	1s	3s	-67%
polyz_unpack	✅	1s	4s	-75%
unpack_sk	✅	1s	2s	-50%

[oqs-bot]

CBMC Results (ML-DSA-44, REDUCE-RAM)

Full Results (203 proofs)

Proof	Status	Current	Previous	Change
**TOTAL**	✅	1396s	1438s	-2.9%
polyvec_matrix_pointwise_montgomery_yvec	✅	147s	163s	-10%
poly_pointwise_montgomery_c	✅	121s	125s	-3%
mld_invntt_layer	✅	99s	116s	-15%
polyveck_chknorm	✅	66s	69s	-4%
sign_verify_internal	✅	50s	52s	-4%
mld_ntt_layer	✅	43s	46s	-7%
fqmul	✅	40s	41s	-2%
keccakf1600x4_permute_native	✅	22s	23s	-4%
mld_ntt_butterfly_block	✅	22s	23s	-4%
poly_ntt_c	✅	21s	19s	+11%
mld_attempt_signature_generation	✅	18s	22s	-18%
polyeta_unpack	✅	15s	16s	-6%
rej_uniform_c	✅	15s	18s	-17%
compute_pack_t0_t1	✅	13s	14s	-7%
polyvecl_chknorm	✅	13s	14s	-7%
mld_check_pct	✅	12s	13s	-8%
poly_invntt_tomont_c	✅	12s	12s	+0%
polyt0_unpack	✅	12s	12s	+0%
poly_chknorm_c	✅	11s	14s	-21%
poly_uniform_eta_4x	✅	11s	13s	-15%
keccak_absorb_once_x4	✅	9s	9s	+0%
polyz_unpack_c	✅	9s	10s	-10%
mld_compute_pack_z	✅	8s	7s	+14%
polyveck_decompose	✅	8s	8s	+0%
poly_pointwise_montgomery_native	✅	7s	3s	+133%
poly_reduce	✅	7s	6s	+17%
polyveck_reduce	✅	7s	5s	+40%
polyvecl_ntt	✅	7s	3s	+133%
rej_uniform	✅	7s	6s	+17%
mld_keccakf1600_permute_c	✅	6s	6s	+0%
mld_polymat_expand_entry	✅	6s	3s	+100%
mld_sample_s1_s2_serial	✅	6s	7s	-14%
pointwise_acc_native_aarch64	✅	6s	7s	-14%
poly_power2round	✅	6s	4s	+50%
polyveck_caddq	✅	6s	2s	+200%
polyveck_pack_eta	✅	6s	3s	+100%
rej_eta_native	✅	6s	6s	+0%
shake128_squeeze	✅	6s	4s	+50%
sign_pk_from_sk	✅	6s	4s	+50%
intt_native_aarch64	✅	5s	4s	+25%
keccakf1600x4_extract_bytes	✅	5s	2s	+150%
keccakf1600x4_permute	✅	5s	3s	+67%
mld_keccakf1600x4_xor_bytes_c	✅	5s	6s	-17%
mld_sample_s1_s2	✅	5s	4s	+25%
pack_sk_rho_key_tr_s2	✅	5s	2s	+150%
poly_add	✅	5s	8s	-38%
poly_challenge	✅	5s	4s	+25%
poly_chknorm	✅	5s	5s	+0%
poly_decompose_88_native_aarch64	✅	5s	3s	+67%
poly_decompose_native	✅	5s	3s	+67%
poly_uniform_eta	✅	5s	3s	+67%
poly_use_hint_native	✅	5s	2s	+150%
polyvec_matrix_pointwise_montgomery_row	✅	5s	7s	-29%
polyveck_ntt	✅	5s	1s	+400%
polyvecl_unpack_eta	✅	5s	2s	+150%
rej_uniform_eta_native_aarch64	✅	5s	5s	+0%
rej_uniform_native	✅	5s	6s	-17%
shake256x4_squeezeblocks	✅	5s	3s	+67%
sign_signature_internal	✅	5s	6s	-17%
sign_signature_pre_hash_shake256	✅	5s	4s	+25%
sign_verify	✅	5s	2s	+150%
sign_verify_extmu	✅	5s	4s	+25%
sign_verify_pre_hash_shake256	✅	5s	5s	+0%
unpack_pk_t1	✅	5s	2s	+150%
fqscale	✅	4s	5s	-20%
intt_native_x86_64	✅	4s	5s	-20%
keccak_f1600_x4_native_avx2	✅	4s	3s	+33%
keccak_finalize	✅	4s	4s	+0%
keccak_squeeze	✅	4s	2s	+100%
keccakf1600x4_extract_bytes_native	✅	4s	2s	+100%
mld_ct_cmask_nonzero_u8	✅	4s	4s	+0%
mld_ct_get_optblocker_i64	✅	4s	4s	+0%
mld_prepare_domain_separation_prefix	✅	4s	5s	-20%
pointwise_acc_native_x86_64	✅	4s	9s	-56%
pointwise_native_aarch64	✅	4s	6s	-33%
poly_caddq	✅	4s	3s	+33%
poly_chknorm_native_aarch64	✅	4s	3s	+33%
poly_chknorm_native_x86_64	✅	4s	2s	+100%
poly_decompose	✅	4s	2s	+100%
poly_decompose_c	✅	4s	5s	-20%
poly_invntt_tomont	✅	4s	3s	+33%
poly_permute_bitrev_to_custom_optional	✅	4s	4s	+0%
poly_uniform_4x	✅	4s	5s	-20%
poly_use_hint	✅	4s	3s	+33%
polyt1_pack	✅	4s	2s	+100%
polyt1_unpack	✅	4s	2s	+100%
polyveck_invntt_tomont	✅	4s	7s	-43%
polyveck_pack_w1	✅	4s	2s	+100%
polyvecl_pack_eta	✅	4s	5s	-20%
polyvecl_uniform_gamma1_serial	✅	4s	3s	+33%
polyz_pack	✅	4s	2s	+100%
power2round	✅	4s	2s	+100%
rej_uniform_native_aarch64	✅	4s	2s	+100%
shake256_absorb	✅	4s	3s	+33%
sign_keypair	✅	4s	4s	+0%
sign_keypair_internal	✅	4s	5s	-20%
sign_signature	✅	4s	4s	+0%
sign_signature_extmu	✅	4s	7s	-43%
sign_signature_pre_hash_internal	✅	4s	3s	+33%
keccak_absorb	✅	3s	4s	-25%
keccak_squeezeblocks_x4	✅	3s	5s	-40%
keccakf1600_xor_bytes	✅	3s	3s	+0%
mld_ct_sel_int32	✅	3s	2s	+50%
mld_value_barrier_i64	✅	3s	3s	+0%
ntt_native_aarch64	✅	3s	3s	+0%
ntt_native_x86_64	✅	3s	6s	-50%
nttunpack_native_x86_64	✅	3s	2s	+50%
pack_sk_s1	✅	3s	3s	+0%
pointwise_native_x86_64	✅	3s	2s	+50%
poly_caddq_c	✅	3s	2s	+50%
poly_chknorm_native	✅	3s	3s	+0%
poly_ntt	✅	3s	3s	+0%
poly_ntt_native	✅	3s	1s	+200%
poly_pointwise_montgomery	✅	3s	1s	+200%
poly_shiftl	✅	3s	2s	+50%
poly_uniform_gamma1	✅	3s	3s	+0%
poly_uniform_gamma1_4x	✅	3s	2s	+50%
polyt0_pack	✅	3s	4s	-25%
polyvecl_pointwise_acc_montgomery_c	✅	3s	2s	+50%
polyvecl_pointwise_acc_montgomery_native	✅	3s	1s	+200%
polyz_unpack	✅	3s	3s	+0%
polyz_unpack_19_native_aarch64	✅	3s	6s	-50%
polyz_unpack_native	✅	3s	3s	+0%
rej_eta	✅	3s	3s	+0%
rej_eta_c	✅	3s	2s	+50%
shake128x4_absorb_once	✅	3s	1s	+200%
shake256	✅	3s	1s	+200%
shake256_finalize	✅	3s	4s	-25%
shake256_init	✅	3s	1s	+200%
shake256_release	✅	3s	2s	+50%
sk_s1hat_get_poly	✅	3s	2s	+50%
sk_s2hat_get_poly	✅	3s	2s	+50%
sk_t0hat_get_poly	✅	3s	4s	-25%
sys_check_capability	✅	3s	4s	-25%
unpack_sk_t0hat	✅	3s	2s	+50%
use_hint	✅	3s	4s	-25%
yvec_init	✅	3s	3s	+0%
caddq	✅	2s	3s	-33%
decompose	✅	2s	3s	-33%
keccak_f1600_x1_native_aarch64	✅	2s	2s	+0%
keccak_f1600_x1_native_aarch64_v84a	✅	2s	3s	-33%
keccak_f1600_x4_native_aarch64_v84a	✅	2s	2s	+0%
keccak_f1600_x4_native_aarch64_v8a_scalar_hybrid	✅	2s	1s	+100%
keccakf1600_extract_bytes (big endian)	✅	2s	3s	-33%
keccakf1600_permute	✅	2s	3s	-33%
keccakf1600_permute_native	✅	2s	3s	-33%
keccakf1600_xor_bytes (big endian)	✅	2s	2s	+0%
keccakf1600x4_xor_bytes	✅	2s	1s	+100%
keccakf1600x4_xor_bytes_native	✅	2s	1s	+100%
make_hint	✅	2s	7s	-71%
mld_ct_abs_i32	✅	2s	2s	+0%
mld_ct_cmask_neg_i32	✅	2s	2s	+0%
mld_ct_cmask_nonzero_u32	✅	2s	5s	-60%
mld_ct_get_optblocker_u32	✅	2s	2s	+0%
mld_ct_get_optblocker_u8	✅	2s	1s	+100%
mld_ct_memcmp	✅	2s	2s	+0%
mld_h	✅	2s	4s	-50%
mld_keccakf1600x4_extract_bytes_c	✅	2s	4s	-50%
mld_value_barrier_u32	✅	2s	1s	+100%
mld_value_barrier_u8	✅	2s	2s	+0%
montgomery_reduce	✅	2s	3s	-33%
pack_sig_c	✅	2s	3s	-33%
pack_sig_h	✅	2s	2s	+0%
pack_sig_z	✅	2s	5s	-60%
poly_caddq_native	✅	2s	5s	-60%
poly_caddq_native_aarch64	✅	2s	2s	+0%
poly_caddq_native_x86_64	✅	2s	6s	-67%
poly_decompose_32_native_aarch64	✅	2s	3s	-33%
poly_invntt_tomont_native	✅	2s	2s	+0%
poly_permute_bitrev_to_custom_optional_native	✅	2s	4s	-50%
poly_sub	✅	2s	3s	-33%
poly_uniform	✅	2s	3s	-33%
poly_use_hint_c	✅	2s	2s	+0%
poly_use_hint_native_aarch64	✅	2s	6s	-67%
polyeta_pack	✅	2s	2s	+0%
polyvec_matrix_expand	✅	2s	3s	-33%
polyvec_matrix_expand_serial	✅	2s	4s	-50%
polyveck_unpack_eta	✅	2s	3s	-33%
polyvecl_pointwise_acc_montgomery	✅	2s	3s	-33%
polyvecl_unpack_z	✅	2s	3s	-33%
polyw1_pack	✅	2s	2s	+0%
polyw1_pack_32	✅	2s	3s	-33%
polyw1_pack_88	✅	2s	3s	-33%
polyz_unpack_17_native_aarch64	✅	2s	3s	-33%
polyz_unpack_native_x86_64	✅	2s	2s	+0%
shake128_finalize	✅	2s	1s	+100%
shake128_init	✅	2s	2s	+0%
shake128_release	✅	2s	3s	-33%
shake128x4_squeezeblocks	✅	2s	1s	+100%
shake256_squeeze	✅	2s	3s	-33%
sig_unpack_hints	✅	2s	1s	+100%
sign_verify_pre_hash_internal	✅	2s	4s	-50%
unpack_sk	✅	2s	2s	+0%
unpack_sk_s1hat	✅	2s	2s	+0%
unpack_sk_s2hat	✅	2s	2s	+0%
yvec_get_poly	✅	2s	4s	-50%
keccak_f1600_x4_native_aarch64_v8a_v84a_scalar_hybrid	✅	1s	1s	+0%
keccak_init	✅	1s	2s	-50%
mld_keccakf1600_extract_bytes	✅	1s	2s	-50%
polyvecl_uniform_gamma1	✅	1s	2s	-50%
reduce32	✅	1s	1s	+0%
shake128_absorb	✅	1s	2s	-50%
shake256x4_absorb_once	✅	1s	4s	-75%

[oqs-bot]

CBMC Results (ML-DSA-65, REDUCE-RAM)

Full Results (203 proofs)

Proof	Status	Current	Previous	Change
**TOTAL**	✅	1411s	1426s	-1.1%
polyvec_matrix_pointwise_montgomery_yvec	✅	184s	182s	+1%
poly_pointwise_montgomery_c	✅	114s	109s	+5%
mld_invntt_layer	✅	98s	103s	-5%
sign_verify_internal	✅	67s	70s	-4%
mld_ntt_layer	✅	41s	40s	+2%
fqmul	✅	40s	39s	+3%
polyvecl_chknorm	✅	38s	42s	-10%
polyveck_chknorm	✅	32s	32s	+0%
mld_attempt_signature_generation	✅	30s	31s	-3%
keccakf1600x4_permute_native	✅	21s	23s	-9%
mld_ntt_butterfly_block	✅	20s	22s	-9%
poly_ntt_c	✅	18s	19s	-5%
rej_uniform_c	✅	13s	16s	-19%
mld_check_pct	✅	12s	11s	+9%
poly_chknorm_c	✅	12s	11s	+9%
polyveck_decompose	✅	12s	14s	-14%
poly_invntt_tomont_c	✅	11s	12s	-8%
polyt0_unpack	✅	11s	12s	-8%
poly_uniform_eta_4x	✅	10s	12s	-17%
polyvec_matrix_pointwise_montgomery_row	✅	10s	9s	+11%
polyz_unpack_c	✅	9s	6s	+50%
compute_pack_t0_t1	✅	8s	6s	+33%
keccak_absorb_once_x4	✅	8s	8s	+0%
mld_keccakf1600_permute_c	✅	8s	8s	+0%
pointwise_acc_native_x86_64	✅	8s	8s	+0%
pointwise_acc_native_aarch64	✅	7s	8s	-12%
poly_permute_bitrev_to_custom_optional_native	✅	7s	4s	+75%
polyveck_reduce	✅	7s	8s	-12%
polyvecl_ntt	✅	7s	4s	+75%
rej_uniform	✅	7s	9s	-22%
mld_prepare_domain_separation_prefix	✅	6s	2s	+200%
poly_add	✅	6s	6s	+0%
poly_caddq_c	✅	6s	4s	+50%
poly_reduce	✅	6s	6s	+0%
polyveck_invntt_tomont	✅	6s	4s	+50%
rej_uniform_native	✅	6s	4s	+50%
use_hint	✅	6s	3s	+100%
keccak_squeezeblocks_x4	✅	5s	6s	-17%
mld_compute_pack_z	✅	5s	6s	-17%
poly_challenge	✅	5s	3s	+67%
poly_chknorm	✅	5s	3s	+67%
poly_chknorm_native_x86_64	✅	5s	2s	+150%
poly_decompose_c	✅	5s	7s	-29%
poly_uniform_4x	✅	5s	2s	+150%
poly_uniform_eta	✅	5s	3s	+67%
poly_use_hint	✅	5s	3s	+67%
shake128_release	✅	5s	4s	+25%
shake256_absorb	✅	5s	3s	+67%
sign_pk_from_sk	✅	5s	8s	-38%
sign_signature_internal	✅	5s	6s	-17%
sign_verify	✅	5s	4s	+25%
sign_verify_pre_hash_shake256	✅	5s	3s	+67%
unpack_sk	✅	5s	4s	+25%
unpack_sk_s2hat	✅	5s	4s	+25%
keccak_f1600_x4_native_avx2	✅	4s	2s	+100%
keccakf1600_xor_bytes	✅	4s	2s	+100%
mld_sample_s1_s2	✅	4s	5s	-20%
mld_value_barrier_i64	✅	4s	2s	+100%
ntt_native_x86_64	✅	4s	2s	+100%
pack_sig_z	✅	4s	2s	+100%
pointwise_native_aarch64	✅	4s	5s	-20%
pointwise_native_x86_64	✅	4s	4s	+0%
poly_caddq	✅	4s	4s	+0%
poly_chknorm_native_aarch64	✅	4s	4s	+0%
poly_decompose	✅	4s	2s	+100%
poly_decompose_88_native_aarch64	✅	4s	3s	+33%
poly_power2round	✅	4s	4s	+0%
poly_uniform_gamma1_4x	✅	4s	3s	+33%
poly_use_hint_c	✅	4s	3s	+33%
polyeta_pack	✅	4s	4s	+0%
polyeta_unpack	✅	4s	3s	+33%
polyvec_matrix_expand_serial	✅	4s	3s	+33%
polyveck_caddq	✅	4s	5s	-20%
polyvecl_uniform_gamma1	✅	4s	2s	+100%
polyvecl_unpack_z	✅	4s	2s	+100%
polyw1_pack	✅	4s	2s	+100%
polyz_unpack	✅	4s	2s	+100%
polyz_unpack_19_native_aarch64	✅	4s	2s	+100%
polyz_unpack_native	✅	4s	4s	+0%
rej_eta_native	✅	4s	3s	+33%
rej_uniform_native_aarch64	✅	4s	4s	+0%
shake256_release	✅	4s	3s	+33%
shake256x4_squeezeblocks	✅	4s	4s	+0%
sign_keypair_internal	✅	4s	5s	-20%
sign_signature_extmu	✅	4s	4s	+0%
sk_s1hat_get_poly	✅	4s	3s	+33%
sk_s2hat_get_poly	✅	4s	3s	+33%
unpack_pk_t1	✅	4s	2s	+100%
intt_native_aarch64	✅	3s	3s	+0%
intt_native_x86_64	✅	3s	3s	+0%
keccak_absorb	✅	3s	4s	-25%
keccak_f1600_x1_native_aarch64_v84a	✅	3s	2s	+50%
keccak_f1600_x4_native_aarch64_v84a	✅	3s	2s	+50%
keccak_squeeze	✅	3s	4s	-25%
keccakf1600_extract_bytes (big endian)	✅	3s	3s	+0%
keccakf1600_permute	✅	3s	2s	+50%
keccakf1600_xor_bytes (big endian)	✅	3s	2s	+50%
keccakf1600x4_extract_bytes_native	✅	3s	3s	+0%
keccakf1600x4_xor_bytes_native	✅	3s	4s	-25%
mld_ct_cmask_nonzero_u32	✅	3s	2s	+50%
mld_ct_cmask_nonzero_u8	✅	3s	5s	-40%
mld_ct_get_optblocker_i64	✅	3s	3s	+0%
mld_h	✅	3s	5s	-40%
mld_keccakf1600x4_extract_bytes_c	✅	3s	4s	-25%
mld_keccakf1600x4_xor_bytes_c	✅	3s	1s	+200%
mld_polymat_expand_entry	✅	3s	3s	+0%
mld_sample_s1_s2_serial	✅	3s	2s	+50%
mld_value_barrier_u32	✅	3s	1s	+200%
montgomery_reduce	✅	3s	3s	+0%
pack_sk_s1	✅	3s	1s	+200%
poly_decompose_native	✅	3s	5s	-40%
poly_invntt_tomont	✅	3s	3s	+0%
poly_invntt_tomont_native	✅	3s	3s	+0%
poly_ntt	✅	3s	4s	-25%
poly_ntt_native	✅	3s	2s	+50%
poly_pointwise_montgomery	✅	3s	2s	+50%
poly_pointwise_montgomery_native	✅	3s	3s	+0%
poly_sub	✅	3s	3s	+0%
poly_uniform	✅	3s	3s	+0%
poly_use_hint_native	✅	3s	3s	+0%
poly_use_hint_native_aarch64	✅	3s	4s	-25%
polyt0_pack	✅	3s	2s	+50%
polyt1_pack	✅	3s	4s	-25%
polyvec_matrix_expand	✅	3s	3s	+0%
polyveck_pack_w1	✅	3s	2s	+50%
polyveck_unpack_eta	✅	3s	3s	+0%
polyvecl_pack_eta	✅	3s	2s	+50%
polyvecl_pointwise_acc_montgomery	✅	3s	3s	+0%
polyw1_pack_32	✅	3s	4s	-25%
polyw1_pack_88	✅	3s	1s	+200%
polyz_pack	✅	3s	3s	+0%
polyz_unpack_17_native_aarch64	✅	3s	5s	-40%
polyz_unpack_native_x86_64	✅	3s	5s	-40%
rej_eta	✅	3s	3s	+0%
rej_uniform_eta_native_aarch64	✅	3s	6s	-50%
shake128_init	✅	3s	1s	+200%
shake128x4_absorb_once	✅	3s	1s	+200%
shake128x4_squeezeblocks	✅	3s	3s	+0%
shake256x4_absorb_once	✅	3s	3s	+0%
sig_unpack_hints	✅	3s	2s	+50%
sign_keypair	✅	3s	5s	-40%
sign_signature_pre_hash_shake256	✅	3s	2s	+50%
sign_verify_extmu	✅	3s	3s	+0%
sys_check_capability	✅	3s	3s	+0%
unpack_sk_s1hat	✅	3s	2s	+50%
unpack_sk_t0hat	✅	3s	3s	+0%
yvec_get_poly	✅	3s	3s	+0%
yvec_init	✅	3s	3s	+0%
decompose	✅	2s	4s	-50%
fqscale	✅	2s	3s	-33%
keccak_f1600_x4_native_aarch64_v8a_v84a_scalar_hybrid	✅	2s	2s	+0%
keccak_finalize	✅	2s	4s	-50%
keccak_init	✅	2s	5s	-60%
keccakf1600_permute_native	✅	2s	2s	+0%
keccakf1600x4_extract_bytes	✅	2s	2s	+0%
keccakf1600x4_permute	✅	2s	3s	-33%
keccakf1600x4_xor_bytes	✅	2s	3s	-33%
mld_ct_abs_i32	✅	2s	2s	+0%
mld_ct_cmask_neg_i32	✅	2s	2s	+0%
mld_ct_get_optblocker_u8	✅	2s	2s	+0%
mld_ct_memcmp	✅	2s	4s	-50%
mld_ct_sel_int32	✅	2s	1s	+100%
mld_value_barrier_u8	✅	2s	2s	+0%
ntt_native_aarch64	✅	2s	4s	-50%
nttunpack_native_x86_64	✅	2s	2s	+0%
pack_sig_c	✅	2s	2s	+0%
pack_sig_h	✅	2s	3s	-33%
pack_sk_rho_key_tr_s2	✅	2s	2s	+0%
poly_caddq_native	✅	2s	2s	+0%
poly_caddq_native_x86_64	✅	2s	3s	-33%
poly_chknorm_native	✅	2s	3s	-33%
poly_decompose_32_native_aarch64	✅	2s	3s	-33%
poly_permute_bitrev_to_custom_optional	✅	2s	2s	+0%
poly_shiftl	✅	2s	4s	-50%
polyt1_unpack	✅	2s	3s	-33%
polyveck_ntt	✅	2s	4s	-50%
polyveck_pack_eta	✅	2s	2s	+0%
polyvecl_pointwise_acc_montgomery_native	✅	2s	6s	-67%
polyvecl_uniform_gamma1_serial	✅	2s	4s	-50%
polyvecl_unpack_eta	✅	2s	3s	-33%
power2round	✅	2s	4s	-50%
shake128_absorb	✅	2s	2s	+0%
shake128_finalize	✅	2s	4s	-50%
shake256	✅	2s	3s	-33%
shake256_finalize	✅	2s	3s	-33%
shake256_init	✅	2s	2s	+0%
shake256_squeeze	✅	2s	2s	+0%
sign_signature	✅	2s	5s	-60%
sign_signature_pre_hash_internal	✅	2s	5s	-60%
sign_verify_pre_hash_internal	✅	2s	7s	-71%
sk_t0hat_get_poly	✅	2s	2s	+0%
caddq	✅	1s	3s	-67%
keccak_f1600_x1_native_aarch64	✅	1s	2s	-50%
keccak_f1600_x4_native_aarch64_v8a_scalar_hybrid	✅	1s	2s	-50%
make_hint	✅	1s	3s	-67%
mld_ct_get_optblocker_u32	✅	1s	2s	-50%
mld_keccakf1600_extract_bytes	✅	1s	5s	-80%
poly_caddq_native_aarch64	✅	1s	2s	-50%
poly_uniform_gamma1	✅	1s	4s	-75%
polyvecl_pointwise_acc_montgomery_c	✅	1s	2s	-50%
reduce32	✅	1s	4s	-75%
rej_eta_c	✅	1s	2s	-50%
shake128_squeeze	✅	1s	1s	+0%

[oqs-bot]

CBMC Results (ML-DSA-87, REDUCE-RAM)

Full Results (203 proofs)

Proof	Status	Current	Previous	Change
**TOTAL**	✅	1598s	1419s	+12.6%
polyvec_matrix_pointwise_montgomery_yvec	✅	213s	180s	+18%
poly_pointwise_montgomery_c	✅	153s	114s	+34%
mld_invntt_layer	✅	129s	105s	+23%
mld_ntt_layer	✅	51s	41s	+24%
sign_verify_internal	✅	51s	45s	+13%
fqmul	✅	47s	40s	+18%
polyvecl_chknorm	✅	42s	32s	+31%
mld_attempt_signature_generation	✅	38s	30s	+27%
mld_ntt_butterfly_block	✅	28s	21s	+33%
keccakf1600x4_permute_native	✅	24s	23s	+4%
poly_ntt_c	✅	22s	16s	+38%
rej_uniform_c	✅	19s	18s	+6%
poly_chknorm_c	✅	16s	12s	+33%
polyeta_unpack	✅	16s	14s	+14%
poly_uniform_eta_4x	✅	15s	11s	+36%
compute_pack_t0_t1	✅	14s	12s	+17%
mld_check_pct	✅	14s	15s	-7%
poly_invntt_tomont_c	✅	14s	11s	+27%
polyvec_matrix_pointwise_montgomery_row	✅	14s	13s	+8%
polyveck_decompose	✅	13s	11s	+18%
polyt0_unpack	✅	12s	12s	+0%
keccak_absorb_once_x4	✅	11s	11s	+0%
pointwise_acc_native_x86_64	✅	10s	9s	+11%
mld_keccakf1600_permute_c	✅	9s	7s	+29%
polyveck_chknorm	✅	9s	9s	+0%
rej_uniform	✅	9s	8s	+12%
mld_sample_s1_s2	✅	8s	7s	+14%
poly_decompose_c	✅	8s	7s	+14%
polyvecl_ntt	✅	8s	10s	-20%
polyz_unpack_c	✅	8s	8s	+0%
mld_compute_pack_z	✅	7s	7s	+0%
pointwise_acc_native_aarch64	✅	7s	8s	-12%
poly_caddq	✅	7s	1s	+600%
polyveck_caddq	✅	7s	6s	+17%
polyveck_reduce	✅	7s	8s	-12%
sign_pk_from_sk	✅	7s	5s	+40%
keccak_absorb	✅	6s	3s	+100%
pack_sk_s1	✅	6s	2s	+200%
poly_add	✅	6s	9s	-33%
poly_chknorm_native	✅	6s	3s	+100%
poly_invntt_tomont_native	✅	6s	4s	+50%
poly_reduce	✅	6s	6s	+0%
poly_uniform	✅	6s	6s	+0%
sign_signature_pre_hash_shake256	✅	6s	4s	+50%
yvec_init	✅	6s	3s	+100%
fqscale	✅	5s	5s	+0%
keccak_squeezeblocks_x4	✅	5s	6s	-17%
mld_ct_sel_int32	✅	5s	1s	+400%
mld_h	✅	5s	4s	+25%
mld_sample_s1_s2_serial	✅	5s	4s	+25%
nttunpack_native_x86_64	✅	5s	4s	+25%
pointwise_native_x86_64	✅	5s	2s	+150%
poly_decompose	✅	5s	4s	+25%
poly_decompose_32_native_aarch64	✅	5s	3s	+67%
polyveck_invntt_tomont	✅	5s	6s	-17%
polyvecl_uniform_gamma1_serial	✅	5s	2s	+150%
polyw1_pack_32	✅	5s	3s	+67%
polyz_unpack_19_native_aarch64	✅	5s	2s	+150%
rej_eta_c	✅	5s	6s	-17%
rej_uniform_eta_native_aarch64	✅	5s	3s	+67%
rej_uniform_native	✅	5s	5s	+0%
sig_unpack_hints	✅	5s	2s	+150%
sign_signature_internal	✅	5s	3s	+67%
sk_s2hat_get_poly	✅	5s	3s	+67%
decompose	✅	4s	2s	+100%
intt_native_aarch64	✅	4s	3s	+33%
keccakf1600_xor_bytes (big endian)	✅	4s	2s	+100%
keccakf1600x4_permute	✅	4s	6s	-33%
mld_prepare_domain_separation_prefix	✅	4s	4s	+0%
pack_sk_rho_key_tr_s2	✅	4s	3s	+33%
poly_caddq_native_aarch64	✅	4s	2s	+100%
poly_caddq_native_x86_64	✅	4s	2s	+100%
poly_challenge	✅	4s	5s	-20%
poly_chknorm_native_x86_64	✅	4s	2s	+100%
poly_ntt	✅	4s	6s	-33%
poly_ntt_native	✅	4s	2s	+100%
poly_power2round	✅	4s	4s	+0%
poly_uniform_eta	✅	4s	5s	-20%
poly_use_hint_c	✅	4s	2s	+100%
polyeta_pack	✅	4s	2s	+100%
polyt0_pack	✅	4s	3s	+33%
polyvec_matrix_expand_serial	✅	4s	3s	+33%
polyveck_pack_eta	✅	4s	4s	+0%
polyveck_unpack_eta	✅	4s	4s	+0%
polyvecl_pack_eta	✅	4s	4s	+0%
polyvecl_pointwise_acc_montgomery	✅	4s	3s	+33%
polyvecl_pointwise_acc_montgomery_c	✅	4s	3s	+33%
polyvecl_unpack_eta	✅	4s	3s	+33%
polyz_pack	✅	4s	2s	+100%
rej_eta_native	✅	4s	5s	-20%
shake256	✅	4s	2s	+100%
shake256_squeeze	✅	4s	2s	+100%
shake256x4_absorb_once	✅	4s	3s	+33%
sign_keypair	✅	4s	4s	+0%
sign_keypair_internal	✅	4s	6s	-33%
sign_signature	✅	4s	3s	+33%
sign_signature_pre_hash_internal	✅	4s	3s	+33%
sign_verify	✅	4s	4s	+0%
unpack_sk	✅	4s	2s	+100%
unpack_sk_s1hat	✅	4s	3s	+33%
yvec_get_poly	✅	4s	2s	+100%
intt_native_x86_64	✅	3s	4s	-25%
keccak_f1600_x4_native_aarch64_v8a_v84a_scalar_hybrid	✅	3s	2s	+50%
keccak_finalize	✅	3s	3s	+0%
keccak_squeeze	✅	3s	2s	+50%
mld_ct_abs_i32	✅	3s	2s	+50%
mld_ct_cmask_neg_i32	✅	3s	3s	+0%
mld_ct_cmask_nonzero_u32	✅	3s	1s	+200%
mld_ct_cmask_nonzero_u8	✅	3s	3s	+0%
mld_keccakf1600_extract_bytes	✅	3s	2s	+50%
mld_value_barrier_i64	✅	3s	3s	+0%
mld_value_barrier_u32	✅	3s	3s	+0%
ntt_native_aarch64	✅	3s	3s	+0%
ntt_native_x86_64	✅	3s	4s	-25%
pack_sig_c	✅	3s	4s	-25%
pack_sig_z	✅	3s	3s	+0%
pointwise_native_aarch64	✅	3s	3s	+0%
poly_caddq_c	✅	3s	5s	-40%
poly_caddq_native	✅	3s	4s	-25%
poly_chknorm	✅	3s	2s	+50%
poly_decompose_88_native_aarch64	✅	3s	3s	+0%
poly_permute_bitrev_to_custom_optional	✅	3s	5s	-40%
poly_permute_bitrev_to_custom_optional_native	✅	3s	1s	+200%
poly_pointwise_montgomery	✅	3s	3s	+0%
poly_shiftl	✅	3s	4s	-25%
poly_sub	✅	3s	4s	-25%
poly_uniform_gamma1	✅	3s	3s	+0%
poly_uniform_gamma1_4x	✅	3s	2s	+50%
poly_use_hint	✅	3s	4s	-25%
poly_use_hint_native	✅	3s	3s	+0%
polyvecl_uniform_gamma1	✅	3s	3s	+0%
polyvecl_unpack_z	✅	3s	2s	+50%
polyw1_pack	✅	3s	3s	+0%
polyz_unpack_17_native_aarch64	✅	3s	2s	+50%
power2round	✅	3s	3s	+0%
shake128_release	✅	3s	3s	+0%
shake128_squeeze	✅	3s	2s	+50%
shake128x4_absorb_once	✅	3s	3s	+0%
shake128x4_squeezeblocks	✅	3s	2s	+50%
shake256_finalize	✅	3s	3s	+0%
shake256x4_squeezeblocks	✅	3s	2s	+50%
sign_verify_extmu	✅	3s	2s	+50%
sign_verify_pre_hash_internal	✅	3s	7s	-57%
sk_s1hat_get_poly	✅	3s	3s	+0%
sk_t0hat_get_poly	✅	3s	3s	+0%
caddq	✅	2s	2s	+0%
keccak_f1600_x1_native_aarch64_v84a	✅	2s	2s	+0%
keccak_f1600_x4_native_aarch64_v84a	✅	2s	3s	-33%
keccak_f1600_x4_native_avx2	✅	2s	2s	+0%
keccakf1600_permute	✅	2s	3s	-33%
keccakf1600_permute_native	✅	2s	5s	-60%
keccakf1600x4_extract_bytes	✅	2s	4s	-50%
keccakf1600x4_xor_bytes	✅	2s	2s	+0%
make_hint	✅	2s	4s	-50%
mld_ct_get_optblocker_i64	✅	2s	1s	+100%
mld_ct_get_optblocker_u32	✅	2s	4s	-50%
mld_ct_get_optblocker_u8	✅	2s	1s	+100%
mld_ct_memcmp	✅	2s	2s	+0%
mld_keccakf1600x4_extract_bytes_c	✅	2s	4s	-50%
mld_keccakf1600x4_xor_bytes_c	✅	2s	2s	+0%
mld_polymat_expand_entry	✅	2s	3s	-33%
mld_value_barrier_u8	✅	2s	4s	-50%
montgomery_reduce	✅	2s	2s	+0%
pack_sig_h	✅	2s	4s	-50%
poly_decompose_native	✅	2s	3s	-33%
poly_invntt_tomont	✅	2s	4s	-50%
poly_pointwise_montgomery_native	✅	2s	5s	-60%
poly_uniform_4x	✅	2s	4s	-50%
poly_use_hint_native_aarch64	✅	2s	4s	-50%
polyt1_pack	✅	2s	3s	-33%
polyvec_matrix_expand	✅	2s	3s	-33%
polyveck_ntt	✅	2s	3s	-33%
polyvecl_pointwise_acc_montgomery_native	✅	2s	2s	+0%
polyw1_pack_88	✅	2s	2s	+0%
polyz_unpack	✅	2s	4s	-50%
polyz_unpack_native	✅	2s	4s	-50%
polyz_unpack_native_x86_64	✅	2s	3s	-33%
rej_uniform_native_aarch64	✅	2s	3s	-33%
shake128_absorb	✅	2s	2s	+0%
shake128_finalize	✅	2s	3s	-33%
shake256_absorb	✅	2s	4s	-50%
shake256_init	✅	2s	3s	-33%
shake256_release	✅	2s	2s	+0%
sign_signature_extmu	✅	2s	5s	-60%
sign_verify_pre_hash_shake256	✅	2s	4s	-50%
sys_check_capability	✅	2s	3s	-33%
unpack_pk_t1	✅	2s	3s	-33%
unpack_sk_s2hat	✅	2s	2s	+0%
unpack_sk_t0hat	✅	2s	2s	+0%
keccak_f1600_x1_native_aarch64	✅	1s	2s	-50%
keccak_f1600_x4_native_aarch64_v8a_scalar_hybrid	✅	1s	2s	-50%
keccak_init	✅	1s	1s	+0%
keccakf1600_extract_bytes (big endian)	✅	1s	3s	-67%
keccakf1600_xor_bytes	✅	1s	2s	-50%
keccakf1600x4_extract_bytes_native	✅	1s	4s	-75%
keccakf1600x4_xor_bytes_native	✅	1s	3s	-67%
poly_chknorm_native_aarch64	✅	1s	4s	-75%
polyt1_unpack	✅	1s	3s	-67%
polyveck_pack_w1	✅	1s	2s	-50%
reduce32	✅	1s	2s	-50%
rej_eta	✅	1s	4s	-75%
shake128_init	✅	1s	3s	-67%
use_hint	✅	1s	4s	-75%

[oqs-bot]

CBMC Results (ML-DSA-65)

Full Results (203 proofs)

Proof	Status	Current	Previous	Change
**TOTAL**	✅	2017s	1936s	+4.2%
polyvecl_pointwise_acc_montgomery_c	✅	278s	250s	+11%
sign_verify_internal	✅	193s	187s	+3%
poly_pointwise_montgomery_c	✅	150s	143s	+5%
mld_invntt_layer	✅	122s	118s	+3%
polyvec_matrix_expand	✅	120s	114s	+5%
mld_attempt_signature_generation	✅	70s	66s	+6%
sign_signature_internal	✅	58s	57s	+2%
fqmul	✅	45s	41s	+10%
mld_ntt_layer	✅	45s	45s	+0%
polyvec_matrix_expand_serial	✅	32s	30s	+7%
poly_ntt_c	✅	26s	20s	+30%
mld_ntt_butterfly_block	✅	24s	23s	+4%
keccakf1600x4_permute_native	✅	23s	22s	+5%
polyvec_matrix_pointwise_montgomery_yvec	✅	19s	21s	-10%
polyt0_unpack	✅	18s	16s	+12%
poly_chknorm_c	✅	17s	17s	+0%
rej_uniform	✅	17s	17s	+0%
rej_uniform_c	✅	17s	16s	+6%
mld_check_pct	✅	14s	14s	+0%
poly_uniform_4x	✅	14s	12s	+17%
polyz_unpack_c	✅	14s	12s	+17%
compute_pack_t0_t1	✅	13s	17s	-24%
polyveck_decompose	✅	13s	13s	+0%
keccak_absorb_once_x4	✅	12s	11s	+9%
poly_invntt_tomont_c	✅	12s	12s	+0%
poly_uniform_eta_4x	✅	12s	12s	+0%
polyveck_invntt_tomont	✅	10s	9s	+11%
mld_compute_pack_z	✅	9s	9s	+0%
poly_add	✅	9s	4s	+125%
poly_use_hint_c	✅	7s	7s	+0%
polyveck_caddq	✅	7s	7s	+0%
polyveck_chknorm	✅	7s	7s	+0%
polyvecl_chknorm	✅	7s	7s	+0%
polyvecl_ntt	✅	7s	5s	+40%
sign_signature_pre_hash_internal	✅	7s	5s	+40%
keccakf1600x4_xor_bytes_native	✅	6s	2s	+200%
mld_keccakf1600_permute_c	✅	6s	7s	-14%
mld_sample_s1_s2	✅	6s	2s	+200%
pointwise_acc_native_aarch64	✅	6s	6s	+0%
pointwise_native_x86_64	✅	6s	4s	+50%
poly_power2round	✅	6s	2s	+200%
polyeta_unpack	✅	6s	6s	+0%
polyveck_ntt	✅	6s	8s	-25%
polyz_unpack_native	✅	6s	2s	+200%
sign_keypair	✅	6s	4s	+50%
sign_signature	✅	6s	2s	+200%
sign_verify	✅	6s	6s	+0%
unpack_pk_t1	✅	6s	3s	+100%
unpack_sk_t0hat	✅	6s	5s	+20%
intt_native_x86_64	✅	5s	5s	+0%
mld_h	✅	5s	3s	+67%
pointwise_acc_native_x86_64	✅	5s	6s	-17%
pointwise_native_aarch64	✅	5s	3s	+67%
poly_decompose_c	✅	5s	5s	+0%
polyt1_pack	✅	5s	2s	+150%
polyvecl_pointwise_acc_montgomery	✅	5s	6s	-17%
polyvecl_unpack_eta	✅	5s	3s	+67%
polyvecl_unpack_z	✅	5s	3s	+67%
polyz_unpack_17_native_aarch64	✅	5s	3s	+67%
rej_eta	✅	5s	2s	+150%
rej_eta_c	✅	5s	7s	-29%
sig_unpack_hints	✅	5s	2s	+150%
sign_pk_from_sk	✅	5s	7s	-29%
sign_verify_pre_hash_internal	✅	5s	5s	+0%
sk_s1hat_get_poly	✅	5s	1s	+400%
unpack_sk_s2hat	✅	5s	1s	+400%
keccak_f1600_x1_native_aarch64_v84a	✅	4s	3s	+33%
keccak_f1600_x4_native_aarch64_v8a_v84a_scalar_hybrid	✅	4s	2s	+100%
keccakf1600x4_xor_bytes	✅	4s	1s	+300%
mld_ct_get_optblocker_u32	✅	4s	3s	+33%
mld_ct_memcmp	✅	4s	2s	+100%
mld_keccakf1600_extract_bytes	✅	4s	2s	+100%
ntt_native_x86_64	✅	4s	4s	+0%
pack_sig_c	✅	4s	4s	+0%
poly_caddq_native	✅	4s	4s	+0%
poly_challenge	✅	4s	4s	+0%
poly_chknorm_native_aarch64	✅	4s	4s	+0%
poly_chknorm_native_x86_64	✅	4s	4s	+0%
poly_invntt_tomont_native	✅	4s	2s	+100%
poly_permute_bitrev_to_custom_optional_native	✅	4s	3s	+33%
poly_pointwise_montgomery	✅	4s	4s	+0%
poly_reduce	✅	4s	2s	+100%
poly_use_hint	✅	4s	4s	+0%
polyeta_pack	✅	4s	4s	+0%
polyt1_unpack	✅	4s	4s	+0%
polyvec_matrix_pointwise_montgomery_row	✅	4s	2s	+100%
polyveck_pack_eta	✅	4s	2s	+100%
polyvecl_pack_eta	✅	4s	3s	+33%
polyvecl_uniform_gamma1	✅	4s	6s	-33%
polyw1_pack	✅	4s	4s	+0%
polyw1_pack_32	✅	4s	1s	+300%
polyw1_pack_88	✅	4s	2s	+100%
polyz_unpack_native_x86_64	✅	4s	4s	+0%
rej_eta_native	✅	4s	2s	+100%
rej_uniform_native	✅	4s	5s	-20%
shake256	✅	4s	3s	+33%
shake256x4_squeezeblocks	✅	4s	3s	+33%
sign_keypair_internal	✅	4s	7s	-43%
sign_signature_pre_hash_shake256	✅	4s	5s	-20%
sign_verify_extmu	✅	4s	4s	+0%
sign_verify_pre_hash_shake256	✅	4s	4s	+0%
unpack_sk	✅	4s	4s	+0%
yvec_init	✅	4s	6s	-33%
fqscale	✅	3s	2s	+50%
intt_native_aarch64	✅	3s	5s	-40%
keccak_absorb	✅	3s	5s	-40%
keccak_finalize	✅	3s	1s	+200%
keccak_init	✅	3s	3s	+0%
keccak_squeeze	✅	3s	5s	-40%
keccak_squeezeblocks_x4	✅	3s	3s	+0%
keccakf1600_extract_bytes (big endian)	✅	3s	3s	+0%
keccakf1600_permute	✅	3s	3s	+0%
keccakf1600_xor_bytes (big endian)	✅	3s	4s	-25%
keccakf1600x4_extract_bytes	✅	3s	3s	+0%
mld_ct_abs_i32	✅	3s	5s	-40%
mld_ct_cmask_nonzero_u32	✅	3s	3s	+0%
mld_ct_get_optblocker_i64	✅	3s	1s	+200%
mld_polymat_expand_entry	✅	3s	3s	+0%
mld_prepare_domain_separation_prefix	✅	3s	6s	-50%
mld_sample_s1_s2_serial	✅	3s	4s	-25%
mld_value_barrier_u32	✅	3s	1s	+200%
mld_value_barrier_u8	✅	3s	2s	+50%
ntt_native_aarch64	✅	3s	4s	-25%
nttunpack_native_x86_64	✅	3s	5s	-40%
pack_sig_h	✅	3s	3s	+0%
pack_sk_rho_key_tr_s2	✅	3s	5s	-40%
poly_caddq	✅	3s	2s	+50%
poly_caddq_c	✅	3s	5s	-40%
poly_caddq_native_x86_64	✅	3s	4s	-25%
poly_chknorm_native	✅	3s	3s	+0%
poly_decompose	✅	3s	3s	+0%
poly_decompose_32_native_aarch64	✅	3s	4s	-25%
poly_decompose_88_native_aarch64	✅	3s	2s	+50%
poly_decompose_native	✅	3s	4s	-25%
poly_invntt_tomont	✅	3s	2s	+50%
poly_ntt_native	✅	3s	3s	+0%
poly_sub	✅	3s	5s	-40%
poly_uniform	✅	3s	6s	-50%
poly_uniform_eta	✅	3s	5s	-40%
poly_uniform_gamma1	✅	3s	4s	-25%
poly_uniform_gamma1_4x	✅	3s	5s	-40%
poly_use_hint_native	✅	3s	4s	-25%
poly_use_hint_native_aarch64	✅	3s	3s	+0%
polyt0_pack	✅	3s	3s	+0%
polyveck_reduce	✅	3s	3s	+0%
polyveck_unpack_eta	✅	3s	4s	-25%
polyvecl_pointwise_acc_montgomery_native	✅	3s	4s	-25%
polyvecl_uniform_gamma1_serial	✅	3s	4s	-25%
polyz_unpack	✅	3s	3s	+0%
polyz_unpack_19_native_aarch64	✅	3s	3s	+0%
power2round	✅	3s	6s	-50%
reduce32	✅	3s	3s	+0%
rej_uniform_eta_native_aarch64	✅	3s	5s	-40%
rej_uniform_native_aarch64	✅	3s	5s	-40%
shake128_absorb	✅	3s	2s	+50%
shake128_init	✅	3s	1s	+200%
shake128x4_squeezeblocks	✅	3s	2s	+50%
shake256_absorb	✅	3s	1s	+200%
shake256_squeeze	✅	3s	2s	+50%
shake256x4_absorb_once	✅	3s	2s	+50%
sign_signature_extmu	✅	3s	3s	+0%
unpack_sk_s1hat	✅	3s	2s	+50%
yvec_get_poly	✅	3s	1s	+200%
caddq	✅	2s	4s	-50%
decompose	✅	2s	4s	-50%
keccak_f1600_x4_native_aarch64_v84a	✅	2s	3s	-33%
keccak_f1600_x4_native_aarch64_v8a_scalar_hybrid	✅	2s	1s	+100%
keccakf1600_permute_native	✅	2s	3s	-33%
keccakf1600_xor_bytes	✅	2s	3s	-33%
keccakf1600x4_extract_bytes_native	✅	2s	3s	-33%
keccakf1600x4_permute	✅	2s	2s	+0%
make_hint	✅	2s	2s	+0%
mld_ct_cmask_neg_i32	✅	2s	4s	-50%
mld_ct_cmask_nonzero_u8	✅	2s	5s	-60%
mld_ct_get_optblocker_u8	✅	2s	3s	-33%
mld_ct_sel_int32	✅	2s	2s	+0%
mld_value_barrier_i64	✅	2s	2s	+0%
montgomery_reduce	✅	2s	4s	-50%
pack_sig_z	✅	2s	1s	+100%
pack_sk_s1	✅	2s	2s	+0%
poly_caddq_native_aarch64	✅	2s	4s	-50%
poly_chknorm	✅	2s	3s	-33%
poly_ntt	✅	2s	5s	-60%
poly_permute_bitrev_to_custom_optional	✅	2s	4s	-50%
poly_pointwise_montgomery_native	✅	2s	3s	-33%
polyveck_pack_w1	✅	2s	4s	-50%
polyz_pack	✅	2s	3s	-33%
shake128_finalize	✅	2s	2s	+0%
shake128_squeeze	✅	2s	4s	-50%
shake128x4_absorb_once	✅	2s	4s	-50%
shake256_finalize	✅	2s	2s	+0%
shake256_init	✅	2s	3s	-33%
sk_s2hat_get_poly	✅	2s	3s	-33%
sys_check_capability	✅	2s	3s	-33%
use_hint	✅	2s	3s	-33%
keccak_f1600_x1_native_aarch64	✅	1s	2s	-50%
keccak_f1600_x4_native_avx2	✅	1s	4s	-75%
mld_keccakf1600x4_extract_bytes_c	✅	1s	4s	-75%
mld_keccakf1600x4_xor_bytes_c	✅	1s	1s	+0%
poly_shiftl	✅	1s	3s	-67%
shake128_release	✅	1s	1s	+0%
shake256_release	✅	1s	2s	-50%
sk_t0hat_get_poly	✅	1s	3s	-67%

[oqs-bot]

CBMC Results (ML-DSA-87)

Full Results (203 proofs)

Proof	Status	Current	Previous	Change
**TOTAL**	✅	2144s	2045s	+4.8%
polyvecl_pointwise_acc_montgomery_c	✅	363s	338s	+7%
polyvec_matrix_expand	✅	317s	293s	+8%
poly_pointwise_montgomery_c	✅	134s	121s	+11%
mld_invntt_layer	✅	118s	108s	+9%
sign_verify_internal	✅	99s	98s	+1%
mld_attempt_signature_generation	✅	55s	54s	+2%
mld_ntt_layer	✅	45s	41s	+10%
sign_signature_internal	✅	43s	42s	+2%
fqmul	✅	42s	42s	+0%
polyvec_matrix_expand_serial	✅	37s	38s	-3%
keccakf1600x4_permute_native	✅	23s	22s	+5%
mld_ntt_butterfly_block	✅	22s	20s	+10%
poly_ntt_c	✅	22s	19s	+16%
rej_uniform	✅	18s	14s	+29%
compute_pack_t0_t1	✅	17s	16s	+6%
mld_check_pct	✅	17s	17s	+0%
polyvec_matrix_pointwise_montgomery_yvec	✅	17s	17s	+0%
poly_chknorm_c	✅	16s	14s	+14%
rej_uniform_c	✅	16s	14s	+14%
polyeta_unpack	✅	15s	14s	+7%
polyt0_unpack	✅	14s	16s	-12%
poly_invntt_tomont_c	✅	13s	10s	+30%
poly_uniform_4x	✅	13s	10s	+30%
poly_uniform_eta_4x	✅	13s	12s	+8%
keccak_absorb_once_x4	✅	12s	10s	+20%
mld_compute_pack_z	✅	11s	8s	+38%
polyveck_decompose	✅	11s	12s	-8%
mld_keccakf1600_permute_c	✅	8s	10s	-20%
poly_decompose_c	✅	8s	5s	+60%
polyveck_caddq	✅	8s	7s	+14%
polyveck_invntt_tomont	✅	8s	7s	+14%
polyveck_ntt	✅	8s	9s	-11%
polyvecl_ntt	✅	8s	6s	+33%
mld_sample_s1_s2	✅	7s	6s	+17%
mld_sample_s1_s2_serial	✅	7s	7s	+0%
pointwise_acc_native_x86_64	✅	7s	7s	+0%
poly_add	✅	7s	7s	+0%
rej_uniform_native	✅	7s	4s	+75%
sign_keypair_internal	✅	7s	5s	+40%
sign_pk_from_sk	✅	7s	5s	+40%
pointwise_acc_native_aarch64	✅	6s	6s	+0%
poly_challenge	✅	6s	4s	+50%
polyveck_pack_w1	✅	6s	3s	+100%
polyz_unpack_c	✅	6s	3s	+100%
sign_verify_extmu	✅	6s	4s	+50%
intt_native_aarch64	✅	5s	4s	+25%
mld_ct_get_optblocker_i64	✅	5s	4s	+25%
mld_prepare_domain_separation_prefix	✅	5s	4s	+25%
poly_chknorm_native_aarch64	✅	5s	3s	+67%
poly_decompose	✅	5s	3s	+67%
poly_permute_bitrev_to_custom_optional_native	✅	5s	4s	+25%
poly_uniform	✅	5s	4s	+25%
poly_uniform_eta	✅	5s	4s	+25%
poly_use_hint_c	✅	5s	5s	+0%
polyt0_pack	✅	5s	5s	+0%
polyvecl_chknorm	✅	5s	6s	-17%
polyvecl_pointwise_acc_montgomery	✅	5s	4s	+25%
polyvecl_uniform_gamma1	✅	5s	4s	+25%
polyz_unpack_17_native_aarch64	✅	5s	2s	+150%
rej_eta_c	✅	5s	4s	+25%
sign_signature	✅	5s	6s	-17%
sign_signature_pre_hash_shake256	✅	5s	4s	+25%
unpack_pk_t1	✅	5s	3s	+67%
unpack_sk	✅	5s	4s	+25%
unpack_sk_s1hat	✅	5s	1s	+400%
unpack_sk_t0hat	✅	5s	6s	-17%
fqscale	✅	4s	2s	+100%
keccak_absorb	✅	4s	3s	+33%
keccak_f1600_x4_native_avx2	✅	4s	3s	+33%
keccakf1600_xor_bytes (big endian)	✅	4s	2s	+100%
keccakf1600x4_permute	✅	4s	2s	+100%
mld_ct_cmask_nonzero_u32	✅	4s	3s	+33%
mld_h	✅	4s	4s	+0%
nttunpack_native_x86_64	✅	4s	4s	+0%
pack_sk_rho_key_tr_s2	✅	4s	5s	-20%
pointwise_native_x86_64	✅	4s	5s	-20%
poly_caddq	✅	4s	2s	+100%
poly_caddq_native_aarch64	✅	4s	3s	+33%
poly_caddq_native_x86_64	✅	4s	4s	+0%
poly_chknorm	✅	4s	5s	-20%
poly_decompose_32_native_aarch64	✅	4s	4s	+0%
poly_invntt_tomont	✅	4s	2s	+100%
poly_shiftl	✅	4s	5s	-20%
poly_uniform_gamma1_4x	✅	4s	7s	-43%
polyeta_pack	✅	4s	4s	+0%
polyt1_pack	✅	4s	3s	+33%
polyveck_reduce	✅	4s	5s	-20%
polyvecl_pack_eta	✅	4s	5s	-20%
polyvecl_uniform_gamma1_serial	✅	4s	1s	+300%
polyvecl_unpack_eta	✅	4s	2s	+100%
polyz_unpack	✅	4s	2s	+100%
polyz_unpack_native_x86_64	✅	4s	2s	+100%
rej_eta	✅	4s	3s	+33%
rej_uniform_native_aarch64	✅	4s	4s	+0%
shake128_absorb	✅	4s	3s	+33%
shake256_init	✅	4s	1s	+300%
sig_unpack_hints	✅	4s	4s	+0%
sign_keypair	✅	4s	3s	+33%
sign_signature_extmu	✅	4s	5s	-20%
sign_verify	✅	4s	4s	+0%
sign_verify_pre_hash_shake256	✅	4s	4s	+0%
sk_t0hat_get_poly	✅	4s	2s	+100%
sys_check_capability	✅	4s	3s	+33%
caddq	✅	3s	3s	+0%
keccak_f1600_x4_native_aarch64_v8a_v84a_scalar_hybrid	✅	3s	3s	+0%
keccak_init	✅	3s	4s	-25%
keccak_squeeze	✅	3s	3s	+0%
keccakf1600_xor_bytes	✅	3s	4s	-25%
keccakf1600x4_extract_bytes_native	✅	3s	2s	+50%
mld_ct_abs_i32	✅	3s	2s	+50%
mld_ct_get_optblocker_u8	✅	3s	4s	-25%
mld_ct_memcmp	✅	3s	3s	+0%
mld_ct_sel_int32	✅	3s	4s	-25%
mld_keccakf1600_extract_bytes	✅	3s	3s	+0%
mld_value_barrier_u32	✅	3s	4s	-25%
mld_value_barrier_u8	✅	3s	4s	-25%
montgomery_reduce	✅	3s	4s	-25%
ntt_native_x86_64	✅	3s	3s	+0%
pack_sig_c	✅	3s	2s	+50%
pack_sig_z	✅	3s	4s	-25%
pack_sk_s1	✅	3s	2s	+50%
pointwise_native_aarch64	✅	3s	2s	+50%
poly_caddq_c	✅	3s	2s	+50%
poly_chknorm_native_x86_64	✅	3s	6s	-50%
poly_decompose_88_native_aarch64	✅	3s	5s	-40%
poly_decompose_native	✅	3s	7s	-57%
poly_invntt_tomont_native	✅	3s	3s	+0%
poly_ntt	✅	3s	1s	+200%
poly_ntt_native	✅	3s	3s	+0%
poly_permute_bitrev_to_custom_optional	✅	3s	3s	+0%
poly_pointwise_montgomery_native	✅	3s	3s	+0%
poly_use_hint	✅	3s	4s	-25%
poly_use_hint_native_aarch64	✅	3s	3s	+0%
polyt1_unpack	✅	3s	4s	-25%
polyvec_matrix_pointwise_montgomery_row	✅	3s	2s	+50%
polyveck_chknorm	✅	3s	3s	+0%
polyveck_pack_eta	✅	3s	5s	-40%
polyvecl_pointwise_acc_montgomery_native	✅	3s	5s	-40%
polyvecl_unpack_z	✅	3s	2s	+50%
polyw1_pack	✅	3s	3s	+0%
polyw1_pack_88	✅	3s	4s	-25%
power2round	✅	3s	3s	+0%
reduce32	✅	3s	3s	+0%
rej_eta_native	✅	3s	5s	-40%
shake128_init	✅	3s	3s	+0%
shake128x4_absorb_once	✅	3s	2s	+50%
shake128x4_squeezeblocks	✅	3s	2s	+50%
shake256x4_absorb_once	✅	3s	2s	+50%
shake256x4_squeezeblocks	✅	3s	3s	+0%
sign_signature_pre_hash_internal	✅	3s	5s	-40%
sign_verify_pre_hash_internal	✅	3s	2s	+50%
sk_s1hat_get_poly	✅	3s	2s	+50%
use_hint	✅	3s	3s	+0%
yvec_init	✅	3s	4s	-25%
decompose	✅	2s	4s	-50%
intt_native_x86_64	✅	2s	2s	+0%
keccak_f1600_x1_native_aarch64	✅	2s	4s	-50%
keccak_f1600_x4_native_aarch64_v8a_scalar_hybrid	✅	2s	2s	+0%
keccak_finalize	✅	2s	2s	+0%
keccak_squeezeblocks_x4	✅	2s	5s	-60%
keccakf1600_extract_bytes (big endian)	✅	2s	2s	+0%
keccakf1600_permute	✅	2s	2s	+0%
keccakf1600_permute_native	✅	2s	2s	+0%
keccakf1600x4_extract_bytes	✅	2s	1s	+100%
keccakf1600x4_xor_bytes_native	✅	2s	1s	+100%
make_hint	✅	2s	3s	-33%
mld_ct_cmask_neg_i32	✅	2s	2s	+0%
mld_ct_cmask_nonzero_u8	✅	2s	5s	-60%
mld_ct_get_optblocker_u32	✅	2s	2s	+0%
mld_keccakf1600x4_xor_bytes_c	✅	2s	2s	+0%
mld_polymat_expand_entry	✅	2s	5s	-60%
mld_value_barrier_i64	✅	2s	3s	-33%
ntt_native_aarch64	✅	2s	3s	-33%
pack_sig_h	✅	2s	2s	+0%
poly_chknorm_native	✅	2s	5s	-60%
poly_reduce	✅	2s	3s	-33%
poly_sub	✅	2s	4s	-50%
poly_uniform_gamma1	✅	2s	3s	-33%
poly_use_hint_native	✅	2s	3s	-33%
polyveck_unpack_eta	✅	2s	3s	-33%
polyz_pack	✅	2s	5s	-60%
polyz_unpack_19_native_aarch64	✅	2s	3s	-33%
polyz_unpack_native	✅	2s	3s	-33%
rej_uniform_eta_native_aarch64	✅	2s	2s	+0%
shake128_release	✅	2s	4s	-50%
shake128_squeeze	✅	2s	2s	+0%
shake256	✅	2s	3s	-33%
shake256_absorb	✅	2s	2s	+0%
shake256_finalize	✅	2s	2s	+0%
shake256_squeeze	✅	2s	4s	-50%
sk_s2hat_get_poly	✅	2s	3s	-33%
unpack_sk_s2hat	✅	2s	3s	-33%
yvec_get_poly	✅	2s	4s	-50%
keccak_f1600_x1_native_aarch64_v84a	✅	1s	3s	-67%
keccak_f1600_x4_native_aarch64_v84a	✅	1s	3s	-67%
keccakf1600x4_xor_bytes	✅	1s	1s	+0%
mld_keccakf1600x4_extract_bytes_c	✅	1s	3s	-67%
poly_caddq_native	✅	1s	5s	-80%
poly_pointwise_montgomery	✅	1s	2s	-50%
poly_power2round	✅	1s	4s	-75%
polyw1_pack_32	✅	1s	4s	-75%
shake128_finalize	✅	1s	2s	-50%
shake256_release	✅	1s	2s	-50%

[jakemas]

Is there a performance penalty to this? Added benchmark label to see if it will pick up anything. Did you do any locally testing on performance?

[github-actions]

Mac Mini (M1, 2020) benchmarks (opt)

Details

Benchmark suite	Current: f143afc	Previous: 1b816bb	Ratio
ML-DSA-44 keypair	46532 cycles	46524 cycles	1.00
ML-DSA-44 sign	131208 cycles	131158 cycles	1.00
ML-DSA-44 verify	47347 cycles	47327 cycles	1.00
ML-DSA-65 keypair	81682 cycles	81704 cycles	1.00
ML-DSA-65 sign	215356 cycles	215402 cycles	1.00
ML-DSA-65 verify	79305 cycles	79316 cycles	1.00
ML-DSA-87 keypair	132412 cycles	132438 cycles	1.00
ML-DSA-87 sign	277590 cycles	277438 cycles	1.00
ML-DSA-87 verify	134055 cycles	134054 cycles	1.00

This comment was automatically generated by workflow using github-action-benchmark.

[github-actions]

Mac Mini (M1, 2020) benchmarks (no-opt)

Details

Benchmark suite	Current: f143afc	Previous: 1b816bb	Ratio
ML-DSA-44 keypair	112847 cycles	112790 cycles	1.00
ML-DSA-44 sign	401240 cycles	401108 cycles	1.00
ML-DSA-44 verify	119505 cycles	119469 cycles	1.00
ML-DSA-65 keypair	192943 cycles	192920 cycles	1.00
ML-DSA-65 sign	650114 cycles	649987 cycles	1.00
ML-DSA-65 verify	192893 cycles	192911 cycles	1.00
ML-DSA-87 keypair	318850 cycles	318805 cycles	1.00
ML-DSA-87 sign	828897 cycles	828874 cycles	1.00
ML-DSA-87 verify	326860 cycles	326791 cycles	1.00

This comment was automatically generated by workflow using github-action-benchmark.

[github-actions]

Arm Cortex-A76 (Raspberry Pi 5) benchmarks (opt)

Details

Benchmark suite	Current: f143afc	Previous: 1b816bb	Ratio
ML-DSA-44 keypair	112010 cycles	112145 cycles	1.00
ML-DSA-44 sign	353609 cycles	353664 cycles	1.00
ML-DSA-44 verify	117237 cycles	117210 cycles	1.00
ML-DSA-65 keypair	194380 cycles	194423 cycles	1.00
ML-DSA-65 sign	583869 cycles	583751 cycles	1.00
ML-DSA-65 verify	193157 cycles	193229 cycles	1.00
ML-DSA-87 keypair	320272 cycles	320030 cycles	1.00
ML-DSA-87 sign	747437 cycles	747793 cycles	1.00
ML-DSA-87 verify	318299 cycles	317948 cycles	1.00

This comment was automatically generated by workflow using github-action-benchmark.

[oqs-bot]

Intel Xeon 4th gen (c7i)

Details

Benchmark suite	Current: f143afc	Previous: 1b816bb	Ratio
ML-DSA-44 keypair	43351 cycles	43317 cycles	1.00
ML-DSA-44 sign	130142 cycles	130203 cycles	1.00
ML-DSA-44 verify	45064 cycles	45356 cycles	0.99
ML-DSA-65 keypair	75691 cycles	75546 cycles	1.00
ML-DSA-65 sign	213826 cycles	213879 cycles	1.00
ML-DSA-65 verify	74423 cycles	74538 cycles	1.00
ML-DSA-87 keypair	123380 cycles	123153 cycles	1.00
ML-DSA-87 sign	271119 cycles	270344 cycles	1.00
ML-DSA-87 verify	120789 cycles	120702 cycles	1.00

This comment was automatically generated by workflow using github-action-benchmark.

[oqs-bot]

AMD EPYC 4th gen (c7a)

Details

Benchmark suite	Current: f143afc	Previous: 1b816bb	Ratio
ML-DSA-44 keypair	50223 cycles	46629 cycles	1.08
ML-DSA-44 sign	141714 cycles	138231 cycles	1.03
ML-DSA-44 verify	49623 cycles	49282 cycles	1.01
ML-DSA-65 keypair	82391 cycles	81985 cycles	1.00
ML-DSA-65 sign	228162 cycles	225547 cycles	1.01
ML-DSA-65 verify	81539 cycles	81950 cycles	0.99
ML-DSA-87 keypair	128617 cycles	128720 cycles	1.00
ML-DSA-87 sign	279328 cycles	277529 cycles	1.01
ML-DSA-87 verify	127888 cycles	127816 cycles	1.00

This comment was automatically generated by workflow using github-action-benchmark.

[oqs-bot]

⚠️ Performance Alert ⚠️

Possible performance regression was detected for benchmark 'AMD EPYC 4th gen (c7a)'.
Benchmark result of this commit is worse than the previous benchmark result exceeding threshold 1.03.

Benchmark suite	Current: f143afc	Previous: 1b816bb	Ratio
ML-DSA-44 keypair	50223 cycles	46629 cycles	1.08

This comment was automatically generated by workflow using github-action-benchmark.

[oqs-bot]

Intel Xeon 4th gen (c7i) (no-opt)

Details

Benchmark suite	Current: f143afc	Previous: 1b816bb	Ratio
ML-DSA-44 keypair	91506 cycles	91412 cycles	1.00
ML-DSA-44 sign	352258 cycles	352090 cycles	1.00
ML-DSA-44 verify	99906 cycles	99969 cycles	1.00
ML-DSA-65 keypair	153893 cycles	153968 cycles	1.00
ML-DSA-65 sign	571767 cycles	572041 cycles	1.00
ML-DSA-65 verify	159847 cycles	159945 cycles	1.00
ML-DSA-87 keypair	255311 cycles	255217 cycles	1.00
ML-DSA-87 sign	725870 cycles	726289 cycles	1.00
ML-DSA-87 verify	263919 cycles	263820 cycles	1.00

This comment was automatically generated by workflow using github-action-benchmark.

[oqs-bot]

AMD EPYC 3rd gen (c6a)

Details

Benchmark suite	Current: f143afc	Previous: 1b816bb	Ratio
ML-DSA-44 keypair	51972 cycles	51836 cycles	1.00
ML-DSA-44 sign	155391 cycles	154512 cycles	1.01
ML-DSA-44 verify	54305 cycles	54139 cycles	1.00
ML-DSA-65 keypair	89774 cycles	89155 cycles	1.01
ML-DSA-65 sign	251991 cycles	252934 cycles	1.00
ML-DSA-65 verify	89325 cycles	89565 cycles	1.00
ML-DSA-87 keypair	142048 cycles	142627 cycles	1.00
ML-DSA-87 sign	310417 cycles	312120 cycles	0.99
ML-DSA-87 verify	138689 cycles	139226 cycles	1.00

This comment was automatically generated by workflow using github-action-benchmark.

[github-actions]

Arm Cortex-A55 (Snapdragon 888) benchmarks (opt)

Details

Benchmark suite	Current: f143afc	Previous: 1b816bb	Ratio
ML-DSA-44 keypair	270783 cycles	270738 cycles	1.00
ML-DSA-44 sign	824911 cycles	819744 cycles	1.01
ML-DSA-44 verify	275488 cycles	275272 cycles	1.00
ML-DSA-65 keypair	466459 cycles	466759 cycles	1.00
ML-DSA-65 sign	1328999 cycles	1341171 cycles	0.99
ML-DSA-65 verify	452100 cycles	451207 cycles	1.00
ML-DSA-87 keypair	796882 cycles	799586 cycles	1.00
ML-DSA-87 sign	1837273 cycles	1849427 cycles	0.99
ML-DSA-87 verify	779135 cycles	778504 cycles	1.00

This comment was automatically generated by workflow using github-action-benchmark.

[oqs-bot]

Intel Xeon 3rd gen (c6i)

Details

Benchmark suite	Current: f143afc	Previous: 1b816bb	Ratio
ML-DSA-44 keypair	61587 cycles	61451 cycles	1.00
ML-DSA-44 sign	188514 cycles	188135 cycles	1.00
ML-DSA-44 verify	66279 cycles	66473 cycles	1.00
ML-DSA-65 keypair	110673 cycles	108648 cycles	1.02
ML-DSA-65 sign	314706 cycles	312439 cycles	1.01
ML-DSA-65 verify	110384 cycles	109517 cycles	1.01
ML-DSA-87 keypair	172474 cycles	171731 cycles	1.00
ML-DSA-87 sign	379315 cycles	377596 cycles	1.00
ML-DSA-87 verify	170728 cycles	170346 cycles	1.00

This comment was automatically generated by workflow using github-action-benchmark.

[oqs-bot]

AMD EPYC 4th gen (c7a) (no-opt)

Details

Benchmark suite	Current: f143afc	Previous: 1b816bb	Ratio
ML-DSA-44 keypair	118433 cycles	117918 cycles	1.00
ML-DSA-44 sign	457721 cycles	457220 cycles	1.00
ML-DSA-44 verify	130523 cycles	129921 cycles	1.00
ML-DSA-65 keypair	200713 cycles	200829 cycles	1.00
ML-DSA-65 sign	745099 cycles	742025 cycles	1.00
ML-DSA-65 verify	209006 cycles	208797 cycles	1.00
ML-DSA-87 keypair	329548 cycles	330135 cycles	1.00
ML-DSA-87 sign	938876 cycles	934677 cycles	1.00
ML-DSA-87 verify	343182 cycles	344222 cycles	1.00

This comment was automatically generated by workflow using github-action-benchmark.

[oqs-bot]

Graviton5

Details

Benchmark suite	Current: f143afc	Previous: 1b816bb	Ratio
ML-DSA-44 keypair	51547 cycles	51433 cycles	1.00
ML-DSA-44 sign	162083 cycles	162012 cycles	1.00
ML-DSA-44 verify	54640 cycles	54757 cycles	1.00
ML-DSA-65 keypair	90156 cycles	90180 cycles	1.00
ML-DSA-65 sign	267405 cycles	268065 cycles	1.00
ML-DSA-65 verify	89793 cycles	89928 cycles	1.00
ML-DSA-87 keypair	145920 cycles	145887 cycles	1.00
ML-DSA-87 sign	336091 cycles	335527 cycles	1.00
ML-DSA-87 verify	145487 cycles	144958 cycles	1.00

This comment was automatically generated by workflow using github-action-benchmark.

[github-actions]

Arm Cortex-A76 (Raspberry Pi 5) benchmarks (no-opt)

Details

Benchmark suite	Current: f143afc	Previous: 1b816bb	Ratio
ML-DSA-44 keypair	211737 cycles	211724 cycles	1.00
ML-DSA-44 sign	760337 cycles	759874 cycles	1.00
ML-DSA-44 verify	229541 cycles	229517 cycles	1.00
ML-DSA-65 keypair	378019 cycles	377914 cycles	1.00
ML-DSA-65 sign	1246942 cycles	1246728 cycles	1.00
ML-DSA-65 verify	372126 cycles	371980 cycles	1.00
ML-DSA-87 keypair	601720 cycles	600873 cycles	1.00
ML-DSA-87 sign	1582444 cycles	1581216 cycles	1.00
ML-DSA-87 verify	617666 cycles	616851 cycles	1.00

This comment was automatically generated by workflow using github-action-benchmark.

[oqs-bot]

Graviton4

Details

Benchmark suite	Current: f143afc	Previous: 1b816bb	Ratio
ML-DSA-44 keypair	67330 cycles	67221 cycles	1.00
ML-DSA-44 sign	198448 cycles	198329 cycles	1.00
ML-DSA-44 verify	70184 cycles	70202 cycles	1.00
ML-DSA-65 keypair	119423 cycles	119328 cycles	1.00
ML-DSA-65 sign	325784 cycles	326385 cycles	1.00
ML-DSA-65 verify	116824 cycles	116914 cycles	1.00
ML-DSA-87 keypair	196667 cycles	196585 cycles	1.00
ML-DSA-87 sign	421954 cycles	421660 cycles	1.00
ML-DSA-87 verify	193355 cycles	193024 cycles	1.00

This comment was automatically generated by workflow using github-action-benchmark.

[oqs-bot]

AMD EPYC 3rd gen (c6a) (no-opt)

Details

Benchmark suite	Current: f143afc	Previous: 1b816bb	Ratio
ML-DSA-44 keypair	133241 cycles	133101 cycles	1.00
ML-DSA-44 sign	519470 cycles	519290 cycles	1.00
ML-DSA-44 verify	146604 cycles	146343 cycles	1.00
ML-DSA-65 keypair	223500 cycles	224195 cycles	1.00
ML-DSA-65 sign	842422 cycles	843033 cycles	1.00
ML-DSA-65 verify	233986 cycles	234168 cycles	1.00
ML-DSA-87 keypair	367254 cycles	366577 cycles	1.00
ML-DSA-87 sign	1059895 cycles	1058137 cycles	1.00
ML-DSA-87 verify	381753 cycles	380302 cycles	1.00

This comment was automatically generated by workflow using github-action-benchmark.

[oqs-bot]

Intel Xeon 3rd gen (c6i) (no-opt)

Details

Benchmark suite	Current: f143afc	Previous: 1b816bb	Ratio
ML-DSA-44 keypair	153961 cycles	153814 cycles	1.00
ML-DSA-44 sign	588677 cycles	587991 cycles	1.00
ML-DSA-44 verify	169072 cycles	168996 cycles	1.00
ML-DSA-65 keypair	262035 cycles	261866 cycles	1.00
ML-DSA-65 sign	961173 cycles	961798 cycles	1.00
ML-DSA-65 verify	271468 cycles	271335 cycles	1.00
ML-DSA-87 keypair	432656 cycles	432528 cycles	1.00
ML-DSA-87 sign	1212618 cycles	1210167 cycles	1.00
ML-DSA-87 verify	447763 cycles	446874 cycles	1.00

This comment was automatically generated by workflow using github-action-benchmark.

[oqs-bot]

Graviton5 (no-opt)

Details

Benchmark suite	Current: f143afc	Previous: 1b816bb	Ratio
ML-DSA-44 keypair	99970 cycles	100029 cycles	1.00
ML-DSA-44 sign	369204 cycles	369119 cycles	1.00
ML-DSA-44 verify	110058 cycles	110140 cycles	1.00
ML-DSA-65 keypair	174648 cycles	174558 cycles	1.00
ML-DSA-65 sign	597390 cycles	599151 cycles	1.00
ML-DSA-65 verify	178161 cycles	178218 cycles	1.00
ML-DSA-87 keypair	286503 cycles	285922 cycles	1.00
ML-DSA-87 sign	760899 cycles	759458 cycles	1.00
ML-DSA-87 verify	296394 cycles	296253 cycles	1.00

This comment was automatically generated by workflow using github-action-benchmark.

[oqs-bot]

Graviton3

Details

Benchmark suite	Current: f143afc	Previous: 1b816bb	Ratio
ML-DSA-44 keypair	71536 cycles	71486 cycles	1.00
ML-DSA-44 sign	209090 cycles	208801 cycles	1.00
ML-DSA-44 verify	74800 cycles	74918 cycles	1.00
ML-DSA-65 keypair	125977 cycles	125917 cycles	1.00
ML-DSA-65 sign	345603 cycles	345720 cycles	1.00
ML-DSA-65 verify	124059 cycles	124421 cycles	1.00
ML-DSA-87 keypair	206581 cycles	207047 cycles	1.00
ML-DSA-87 sign	439666 cycles	444360 cycles	0.99
ML-DSA-87 verify	204484 cycles	203973 cycles	1.00

This comment was automatically generated by workflow using github-action-benchmark.

[oqs-bot]

Graviton4 (no-opt)

Details

Benchmark suite	Current: f143afc	Previous: 1b816bb	Ratio
ML-DSA-44 keypair	127653 cycles	127732 cycles	1.00
ML-DSA-44 sign	441345 cycles	440962 cycles	1.00
ML-DSA-44 verify	136358 cycles	136482 cycles	1.00
ML-DSA-65 keypair	220771 cycles	220440 cycles	1.00
ML-DSA-65 sign	714091 cycles	714733 cycles	1.00
ML-DSA-65 verify	220665 cycles	221428 cycles	1.00
ML-DSA-87 keypair	365200 cycles	364306 cycles	1.00
ML-DSA-87 sign	915510 cycles	915947 cycles	1.00
ML-DSA-87 verify	370856 cycles	371317 cycles	1.00

This comment was automatically generated by workflow using github-action-benchmark.

[oqs-bot]

Graviton2

Details

Benchmark suite	Current: f143afc	Previous: 1b816bb	Ratio
ML-DSA-44 keypair	112453 cycles	112514 cycles	1.00
ML-DSA-44 sign	354064 cycles	353832 cycles	1.00
ML-DSA-44 verify	117171 cycles	117377 cycles	1.00
ML-DSA-65 keypair	194645 cycles	194923 cycles	1.00
ML-DSA-65 sign	584387 cycles	584471 cycles	1.00
ML-DSA-65 verify	193220 cycles	193118 cycles	1.00
ML-DSA-87 keypair	320951 cycles	321297 cycles	1.00
ML-DSA-87 sign	747176 cycles	747721 cycles	1.00
ML-DSA-87 verify	318757 cycles	318931 cycles	1.00

This comment was automatically generated by workflow using github-action-benchmark.

[oqs-bot]

Graviton3 (no-opt)

Details

Benchmark suite	Current: f143afc	Previous: 1b816bb	Ratio
ML-DSA-44 keypair	138078 cycles	138205 cycles	1.00
ML-DSA-44 sign	486144 cycles	485965 cycles	1.00
ML-DSA-44 verify	149097 cycles	149251 cycles	1.00
ML-DSA-65 keypair	241749 cycles	241691 cycles	1.00
ML-DSA-65 sign	791601 cycles	792289 cycles	1.00
ML-DSA-65 verify	241541 cycles	243139 cycles	0.99
ML-DSA-87 keypair	396335 cycles	395571 cycles	1.00
ML-DSA-87 sign	1013056 cycles	1014534 cycles	1.00
ML-DSA-87 verify	403818 cycles	404492 cycles	1.00

This comment was automatically generated by workflow using github-action-benchmark.

[oqs-bot]

Graviton2 (no-opt)

Details

Benchmark suite	Current: f143afc	Previous: 1b816bb	Ratio
ML-DSA-44 keypair	211631 cycles	211948 cycles	1.00
ML-DSA-44 sign	759884 cycles	759551 cycles	1.00
ML-DSA-44 verify	229180 cycles	229366 cycles	1.00
ML-DSA-65 keypair	377263 cycles	377678 cycles	1.00
ML-DSA-65 sign	1247013 cycles	1248242 cycles	1.00
ML-DSA-65 verify	372689 cycles	372697 cycles	1.00
ML-DSA-87 keypair	600463 cycles	601178 cycles	1.00
ML-DSA-87 sign	1584817 cycles	1584582 cycles	1.00
ML-DSA-87 verify	616450 cycles	616670 cycles	1.00

This comment was automatically generated by workflow using github-action-benchmark.

[github-actions]

Arm Cortex-A55 (Snapdragon 888) benchmarks (no-opt)

Details

Benchmark suite	Current: f143afc	Previous: 1b816bb	Ratio
ML-DSA-44 keypair	465627 cycles	465372 cycles	1.00
ML-DSA-44 sign	2136434 cycles	2141728 cycles	1.00
ML-DSA-44 verify	556861 cycles	559074 cycles	1.00
ML-DSA-65 keypair	784172 cycles	784054 cycles	1.00
ML-DSA-65 sign	3488229 cycles	3495166 cycles	1.00
ML-DSA-65 verify	867697 cycles	867478 cycles	1.00
ML-DSA-87 keypair	1273606 cycles	1283032 cycles	0.99
ML-DSA-87 sign	4324702 cycles	4395370 cycles	0.98
ML-DSA-87 verify	1399074 cycles	1403681 cycles	1.00

This comment was automatically generated by workflow using github-action-benchmark.

[github-actions]

SpacemiT K1 8 (Banana Pi F3) benchmarks (no-opt)

Details

Benchmark suite	Current: f143afc	Previous: 1b816bb	Ratio
ML-DSA-44 keypair	759745 cycles	759818 cycles	1.00
ML-DSA-44 sign	3137361 cycles	3139267 cycles	1.00
ML-DSA-44 verify	858944 cycles	858530 cycles	1.00
ML-DSA-65 keypair	1288488 cycles	1288999 cycles	1.00
ML-DSA-65 sign	5082295 cycles	5079065 cycles	1.00
ML-DSA-65 verify	1367718 cycles	1368670 cycles	1.00
ML-DSA-87 keypair	2110805 cycles	2110335 cycles	1.00
ML-DSA-87 sign	6342795 cycles	6338237 cycles	1.00
ML-DSA-87 verify	2228729 cycles	2227398 cycles	1.00

This comment was automatically generated by workflow using github-action-benchmark.

[github-actions]

Arm Cortex-A72 (Raspberry Pi 4) benchmarks (opt)

Details

Benchmark suite	Current: f143afc	Previous: 1b816bb	Ratio
ML-DSA-44 keypair	219096 cycles	219242 cycles	1.00
ML-DSA-44 sign	596190 cycles	597439 cycles	1.00
ML-DSA-44 verify	217500 cycles	218271 cycles	1.00
ML-DSA-65 keypair	381463 cycles	386466 cycles	0.99
ML-DSA-65 sign	987365 cycles	992663 cycles	0.99
ML-DSA-65 verify	366170 cycles	367437 cycles	1.00
ML-DSA-87 keypair	639625 cycles	641685 cycles	1.00
ML-DSA-87 sign	1308102 cycles	1323843 cycles	0.99
ML-DSA-87 verify	620689 cycles	627671 cycles	0.99

This comment was automatically generated by workflow using github-action-benchmark.

[github-actions]

Arm Cortex-A72 (Raspberry Pi 4) benchmarks (no-opt)

Details

Benchmark suite	Current: f143afc	Previous: 1b816bb	Ratio
ML-DSA-44 keypair	301518 cycles	301147 cycles	1.00
ML-DSA-44 sign	1140401 cycles	1131790 cycles	1.01
ML-DSA-44 verify	331704 cycles	330936 cycles	1.00
ML-DSA-65 keypair	550005 cycles	541315 cycles	1.02
ML-DSA-65 sign	1890323 cycles	1850240 cycles	1.02
ML-DSA-65 verify	532955 cycles	521681 cycles	1.02
ML-DSA-87 keypair	842066 cycles	850580 cycles	0.99
ML-DSA-87 sign	2372191 cycles	2350706 cycles	1.01
ML-DSA-87 verify	871133 cycles	874184 cycles	1.00

This comment was automatically generated by workflow using github-action-benchmark.