Skip to content

Add Armv8.1-M Keccak x1 backend - #1277

Open
bremoran wants to merge 7 commits into
mainfrom
armv81m-keccak-x1
Open

Add Armv8.1-M Keccak x1 backend#1277
bremoran wants to merge 7 commits into
mainfrom
armv81m-keccak-x1

Conversation

@bremoran

@bremoran bremoran commented Jul 10, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Add the unmodified upstream Adomnicai Armv7-M Keccak source under armv81m_clean and the Slothy-generated M7 optimized x1 permutation under armv81m_opt, with a Makefile regeneration path.

Move the Armv8.1-M FIPS202 development sources to armv81m_opt and synchronize the production backend. Route x1 state XOR/extract through the clean-source assembly helpers so the optimized permutation can keep the state in the bit-interleaved native representation.

Keep the test changes focused on representation-aware Keccak x1/x4 unit coverage, including extracted-byte state dumps on x1 failures, and the static ML-DSA-87 unit-test workspace needed for Zephyr stack pressure.

Fixes #1322

@bremoran
bremoran requested a review from a team as a code owner July 10, 2026 08:11
@mkannwischer
mkannwischer marked this pull request as draft July 10, 2026 08:18
@oqs-bot

oqs-bot commented Jul 10, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

CBMC Results (ML-DSA-44)

⚠️ Attention Required

Proof Status Current Previous Change
**TOTAL** ⚠️ 2372s 1514s +56.7%
compute_pack_t0_t1 ⚠️ 103s 50s +106%
mld_attempt_signature_generation ⚠️ 370s 58s +538%
sig_unpack_hints ⚠️ 43s 2s +2050%
sign_pk_from_sk ⚠️ 42s 5s +740%
sign_signature_internal ⚠️ 78s 26s +200%
sign_verify_internal ⚠️ 292s 114s +156%
Full Results (210 proofs)
Proof Status Current Previous Change
**TOTAL** ⚠️ 2372s 1514s +56.7%
mld_attempt_signature_generation ⚠️ 370s 58s +538%
sign_verify_internal ⚠️ 292s 114s +156%
polyvecl_pointwise_acc_montgomery_c ✅ 167s 131s +27%
poly_pointwise_montgomery_c ✅ 136s 114s +19%
mld_invntt_layer ✅ 117s 107s +9%
compute_pack_t0_t1 ⚠️ 103s 50s +106%
sign_signature_internal ⚠️ 78s 26s +200%
fqmul ✅ 43s 39s +10%
mld_ntt_layer ✅ 43s 42s +2%
sig_unpack_hints ⚠️ 43s 2s +2050%
sign_pk_from_sk ⚠️ 42s 5s +740%
polyvec_matrix_expand ✅ 30s 28s +7%
mld_ntt_butterfly_block ✅ 23s 23s +0%
keccakf1600x4_permute_native ✅ 22s 22s +0%
poly_ntt_c ✅ 20s 19s +5%
polyvec_matrix_pointwise_montgomery_yvec ✅ 18s 15s +20%
poly_chknorm_c ✅ 16s 17s -6%
poly_uniform_4x ✅ 16s 14s +14%
polyeta_unpack ✅ 16s 14s +14%
polyt0_unpack ✅ 16s 15s +7%
rej_uniform_native_x86_64 ✅ 16s - new
sign_keypair_internal ✅ 16s 4s +300%
rej_uniform ✅ 13s 18s -28%
rej_uniform_c ✅ 13s 15s -13%
mld_compute_pack_z ✅ 11s 7s +57%
poly_invntt_tomont_c ✅ 11s 11s +0%
poly_uniform_eta_4x ✅ 11s 11s +0%
keccak_absorb_once_x4 ✅ 10s 9s +11%
polyvecl_chknorm ✅ 10s 10s +0%
polyz_unpack_c ✅ 10s 11s -9%
polyvec_matrix_expand_serial ✅ 9s 8s +12%
sign_keypair ✅ 9s 4s +125%
polyveck_ntt ✅ 8s 5s +60%
keccak_absorb ✅ 7s 5s +40%
mld_check_pct ✅ 7s 14s -50%
poly_add ✅ 7s 7s +0%
rej_uniform_native_aarch64 ✅ 7s 5s +40%
sign_verify_extmu ✅ 7s 3s +133%
keccak_squeezeblocks_x4 ✅ 6s 4s +50%
mld_keccakf1600_permute_c ✅ 6s 8s -25%
mld_sign_resume ✅ 6s - new
ntt_native_aarch64 ✅ 6s 3s +100%
pointwise_acc_native_aarch64 ✅ 6s 4s +50%
pointwise_acc_native_x86_64 ✅ 6s 7s -14%
poly_chknorm ✅ 6s 4s +50%
poly_decompose_c ✅ 6s 4s +50%
polyveck_caddq ✅ 6s 3s +100%
polyveck_decompose ✅ 6s 4s +50%
polyveck_invntt_tomont ✅ 6s 5s +20%
polyz_unpack_native_x86_64 ✅ 6s 3s +100%
mld_h ✅ 5s 4s +25%
poly_caddq_c ✅ 5s 2s +150%
poly_chknorm_native_aarch64 ✅ 5s 4s +25%
poly_decompose ✅ 5s 3s +67%
poly_invntt_tomont ✅ 5s 4s +25%
poly_invntt_tomont_native ✅ 5s 4s +25%
poly_permute_bitrev_to_custom_optional ✅ 5s 2s +150%
poly_reduce ✅ 5s 3s +67%
polyt0_pack ✅ 5s 2s +150%
polyt1_unpack ✅ 5s 5s +0%
polyveck_unpack_eta ✅ 5s 2s +150%
polyvecl_pointwise_acc_montgomery ✅ 5s 4s +25%
polyvecl_uniform_gamma1_serial ✅ 5s 2s +150%
polyz_unpack_17_native_aarch64 ✅ 5s 5s +0%
rej_eta_c ✅ 5s 4s +25%
shake256x4_squeezeblocks ✅ 5s 4s +25%
sign_verify ✅ 5s 4s +25%
sign_verify_pre_hash_internal ✅ 5s 3s +67%
unpack_sk ✅ 5s 3s +67%
yvec_init ✅ 5s 3s +67%
decompose ✅ 4s 2s +100%
keccak_f1600_x1_native_aarch64_v84a ✅ 4s 3s +33%
keccak_squeeze ✅ 4s 1s +300%
keccakf1600_extract_bytes (big endian) ✅ 4s 2s +100%
mld_ct_get_optblocker_u32 ✅ 4s 1s +300%
mld_ct_memcmp ✅ 4s 3s +33%
mld_sample_s1_s2 ✅ 4s 4s +0%
mld_sample_s1_s2_serial ✅ 4s 3s +33%
mld_sign_attempt ✅ 4s - new
mld_sign_finish ✅ 4s - new
mld_value_barrier_i64 ✅ 4s 2s +100%
ntt_native_x86_64 ✅ 4s 3s +33%
pack_sig_c ✅ 4s 2s +100%
pointwise_native_x86_64 ✅ 4s 4s +0%
poly_caddq ✅ 4s 2s +100%
poly_caddq_native_aarch64 ✅ 4s 4s +0%
poly_challenge ✅ 4s 3s +33%
poly_decompose_88_native_aarch64 ✅ 4s 4s +0%
poly_ntt ✅ 4s 3s +33%
poly_uniform ✅ 4s 6s -33%
poly_uniform_eta ✅ 4s 5s -20%
poly_uniform_gamma1 ✅ 4s 4s +0%
poly_uniform_gamma1_4x ✅ 4s 5s -20%
poly_use_hint ✅ 4s 4s +0%
poly_use_hint_native ✅ 4s 4s +0%
poly_use_hint_native_aarch64 ✅ 4s 2s +100%
polyvec_matrix_pointwise_montgomery_row ✅ 4s 2s +100%
polyveck_chknorm ✅ 4s 5s -20%
polyveck_pack_eta ✅ 4s 2s +100%
polyveck_reduce ✅ 4s 5s -20%
polyvecl_unpack_eta ✅ 4s 2s +100%
rej_eta_native ✅ 4s 6s -33%
rej_uniform_eta_native_aarch64 ✅ 4s 2s +100%
rej_uniform_native ✅ 4s 4s +0%
shake128_init ✅ 4s 3s +33%
shake256_absorb ✅ 4s 3s +33%
shake256x4_absorb_once ✅ 4s 3s +33%
sign_signature_pre_hash_internal ✅ 4s 6s -33%
sk_s1hat_get_poly ✅ 4s 3s +33%
sk_s2hat_get_poly ✅ 4s 2s +100%
unpack_pk_t1 ✅ 4s 5s -20%
use_hint ✅ 4s 2s +100%
caddq ✅ 3s 2s +50%
intt_native_aarch64 ✅ 3s 9s -67%
intt_native_x86_64 ✅ 3s 4s -25%
keccak_f1600_x4_native_aarch64_v8a_scalar_hybrid ✅ 3s 3s +0%
keccak_f1600_x4_native_aarch64_v8a_v84a_scalar_hybrid ✅ 3s 1s +200%
keccak_init ✅ 3s 3s +0%
keccakf1600_permute ✅ 3s 2s +50%
keccakf1600x4_extract_bytes ✅ 3s 2s +50%
keccakf1600x4_xor_bytes ✅ 3s 2s +50%
keccakf1600x4_xor_bytes_native ✅ 3s 3s +0%
mld_ct_abs_i32 ✅ 3s 2s +50%
mld_ct_cmask_nonzero_u32 ✅ 3s 2s +50%
mld_ct_get_optblocker_i64 ✅ 3s 4s -25%
mld_keccakf1600x4_xor_bytes_c ✅ 3s 2s +50%
nttunpack_native_x86_64 ✅ 3s 1s +200%
pack_sig_h ✅ 3s 3s +0%
pack_sk_rho_key_tr_s2 ✅ 3s 3s +0%
pack_sk_s1 ✅ 3s 2s +50%
poly_caddq_native ✅ 3s 5s -40%
poly_caddq_native_x86_64 ✅ 3s 4s -25%
poly_chknorm_native ✅ 3s 4s -25%
poly_chknorm_native_x86_64 ✅ 3s 2s +50%
poly_decompose_native_x86_64 ✅ 3s 3s +0%
poly_permute_bitrev_to_custom_optional_native ✅ 3s 4s -25%
poly_pointwise_montgomery_native ✅ 3s 2s +50%
poly_power2round ✅ 3s 4s -25%
poly_shiftl ✅ 3s 3s +0%
poly_sub ✅ 3s 3s +0%
poly_use_hint_c ✅ 3s 3s +0%
poly_use_hint_native_x86_64 ✅ 3s - new
polyeta_pack ✅ 3s 3s +0%
polyvecl_ntt ✅ 3s 2s +50%
polyvecl_pointwise_acc_montgomery_native ✅ 3s 2s +50%
polyvecl_uniform_gamma1 ✅ 3s 3s +0%
polyw1_pack_88 ✅ 3s 1s +200%
polyz_pack ✅ 3s 2s +50%
power2round ✅ 3s 3s +0%
rej_eta ✅ 3s 3s +0%
rej_uniform_eta_native_x86_64 ✅ 3s - new
shake128_absorb ✅ 3s 2s +50%
shake128_finalize ✅ 3s 2s +50%
shake128x4_absorb_once ✅ 3s 3s +0%
shake256 ✅ 3s 1s +200%
sign_signature_extmu ✅ 3s 4s -25%
sign_signature_pre_hash_shake256 ✅ 3s 3s +0%
sign_verify_pre_hash_shake256 ✅ 3s 5s -40%
sk_t0hat_get_poly ✅ 3s 2s +50%
unpack_sk_s2hat ✅ 3s 4s -25%
yvec_get_poly ✅ 3s 3s +0%
fqscale ✅ 2s 3s -33%
keccak_f1600_x1_native_aarch64 ✅ 2s 2s +0%
keccak_f1600_x4_native_avx2 ✅ 2s 3s -33%
keccak_finalize ✅ 2s 3s -33%
keccakf1600_xor_bytes ✅ 2s 1s +100%
keccakf1600_xor_bytes (big endian) ✅ 2s 4s -50%
keccakf1600x4_extract_bytes_native ✅ 2s 3s -33%
keccakf1600x4_permute ✅ 2s 4s -50%
make_hint ✅ 2s 3s -33%
mld_ct_cmask_neg_i32 ✅ 2s 3s -33%
mld_ct_cmask_nonzero_u8 ✅ 2s 2s +0%
mld_ct_get_optblocker_u8 ✅ 2s 1s +100%
mld_ct_sel_int32 ✅ 2s 2s +0%
mld_keccakf1600_extract_bytes ✅ 2s 2s +0%
mld_keccakf1600x4_extract_bytes_c ✅ 2s 2s +0%
mld_polymat_expand_entry ✅ 2s 3s -33%
mld_prepare_domain_separation_prefix ✅ 2s 4s -50%
mld_value_barrier_u32 ✅ 2s 2s +0%
mld_value_barrier_u8 ✅ 2s 3s -33%
montgomery_reduce ✅ 2s 3s -33%
pack_sig_z ✅ 2s 4s -50%
pointwise_native_aarch64 ✅ 2s 5s -60%
poly_decompose_native ✅ 2s 3s -33%
polyt1_pack ✅ 2s 4s -50%
polyveck_pack_w1 ✅ 2s 1s +100%
polyvecl_pack_eta ✅ 2s 3s -33%
polyvecl_unpack_z ✅ 2s 2s +0%
polyw1_pack ✅ 2s 3s -33%
polyw1_pack_32 ✅ 2s 2s +0%
polyz_unpack ✅ 2s 3s -33%
polyz_unpack_19_native_aarch64 ✅ 2s 5s -60%
polyz_unpack_native ✅ 2s 2s +0%
reduce32 ✅ 2s 2s +0%
shake128_release ✅ 2s 1s +100%
shake128_squeeze ✅ 2s 1s +100%
shake128x4_squeezeblocks ✅ 2s 1s +100%
shake256_finalize ✅ 2s 2s +0%
shake256_init ✅ 2s 3s -33%
shake256_squeeze ✅ 2s 2s +0%
sign_signature ✅ 2s 3s -33%
sys_check_capability ✅ 2s 4s -50%
unpack_sk_s1hat ✅ 2s 1s +100%
unpack_sk_t0hat ✅ 2s 3s -33%
keccak_f1600_x4_native_aarch64_v84a ✅ 1s 2s -50%
keccakf1600_permute_native ✅ 1s 3s -67%
poly_decompose_32_native_aarch64 ✅ 1s 2s -50%
poly_ntt_native ✅ 1s 5s -80%
poly_pointwise_montgomery ✅ 1s 3s -67%
shake256_release ✅ 1s 2s -50%

@oqs-bot

oqs-bot commented Jul 10, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

CBMC Results (ML-DSA-44, REDUCE-RAM)

⚠️ Attention Required

Proof Status Current Previous Change
**TOTAL** ⚠️ 2064s 1364s +51.3%
compute_pack_t0_t1 ⚠️ 43s 12s +258%
mld_attempt_signature_generation ⚠️ 199s 19s +947%
rej_uniform ⚠️ 22s 8s +175%
sig_unpack_hints ⚠️ 44s 2s +2100%
sign_pk_from_sk ⚠️ 44s 5s +780%
sign_signature_internal ⚠️ 20s 4s +400%
sign_verify_internal ⚠️ 283s 49s +478%
Full Results (210 proofs)
Proof Status Current Previous Change
**TOTAL** ⚠️ 2064s 1364s +51.3%
sign_verify_internal ⚠️ 283s 49s +478%
mld_attempt_signature_generation ⚠️ 199s 19s +947%
polyvec_matrix_pointwise_montgomery_yvec ✅ 164s 149s +10%
poly_pointwise_montgomery_c ✅ 133s 112s +19%
mld_invntt_layer ✅ 119s 105s +13%
polyveck_chknorm ✅ 70s 67s +4%
mld_ntt_layer ✅ 47s 41s +15%
fqmul ✅ 44s 39s +13%
sig_unpack_hints ⚠️ 44s 2s +2100%
sign_pk_from_sk ⚠️ 44s 5s +780%
compute_pack_t0_t1 ⚠️ 43s 12s +258%
keccakf1600x4_permute_native ✅ 23s 22s +5%
mld_ntt_butterfly_block ✅ 22s 23s -4%
poly_ntt_c ✅ 22s 21s +5%
rej_uniform ⚠️ 22s 8s +175%
sign_signature_internal ⚠️ 20s 4s +400%
polyeta_unpack ✅ 17s 14s +21%
rej_uniform_c ✅ 16s 16s +0%
rej_uniform_native_x86_64 ✅ 16s - new
sign_keypair_internal ✅ 14s 4s +250%
polyvecl_chknorm ✅ 13s 11s +18%
poly_chknorm_c ✅ 12s 11s +9%
poly_uniform_eta_4x ✅ 12s 12s +0%
polyt0_unpack ✅ 12s 12s +0%
poly_invntt_tomont_c ✅ 11s 11s +0%
poly_add ✅ 9s 7s +29%
polyvec_matrix_pointwise_montgomery_row ✅ 9s 6s +50%
polyveck_decompose ✅ 9s 7s +29%
polyz_unpack_c ✅ 8s 8s +0%
sign_keypair ✅ 8s 5s +60%
sign_signature ✅ 8s 6s +33%
keccak_absorb_once_x4 ✅ 7s 8s -12%
mld_keccakf1600_permute_c ✅ 7s 7s +0%
pointwise_acc_native_aarch64 ✅ 7s 6s +17%
polyveck_reduce ✅ 7s 4s +75%
polyvecl_unpack_eta ✅ 7s 4s +75%
keccak_absorb ✅ 6s 3s +100%
keccak_squeezeblocks_x4 ✅ 6s 3s +100%
mld_compute_pack_z ✅ 6s 6s +0%
mld_h ✅ 6s 4s +50%
pack_sig_c ✅ 6s 5s +20%
pointwise_acc_native_x86_64 ✅ 6s 4s +50%
poly_challenge ✅ 6s 6s +0%
poly_decompose_c ✅ 6s 5s +20%
polyveck_invntt_tomont ✅ 6s 5s +20%
rej_uniform_native ✅ 6s 5s +20%
decompose ✅ 5s 3s +67%
fqscale ✅ 5s 2s +150%
intt_native_x86_64 ✅ 5s 2s +150%
mld_check_pct ✅ 5s 15s -67%
mld_sample_s1_s2_serial ✅ 5s 4s +25%
mld_sign_finish ✅ 5s - new
ntt_native_x86_64 ✅ 5s 3s +67%
pack_sig_z ✅ 5s 2s +150%
poly_decompose_88_native_aarch64 ✅ 5s 3s +67%
poly_decompose_native ✅ 5s 2s +150%
poly_power2round ✅ 5s 4s +25%
poly_reduce ✅ 5s 4s +25%
poly_uniform ✅ 5s 3s +67%
poly_uniform_eta ✅ 5s 2s +150%
polyvec_matrix_expand ✅ 5s 3s +67%
polyveck_caddq ✅ 5s 3s +67%
polyz_pack ✅ 5s 2s +150%
polyz_unpack_native ✅ 5s 3s +67%
rej_eta ✅ 5s 5s +0%
sign_signature_pre_hash_shake256 ✅ 5s 4s +25%
use_hint ✅ 5s 2s +150%
intt_native_aarch64 ✅ 4s 3s +33%
keccakf1600x4_extract_bytes_native ✅ 4s 4s +0%
mld_ct_abs_i32 ✅ 4s 3s +33%
mld_ct_cmask_neg_i32 ✅ 4s 2s +100%
mld_ct_get_optblocker_i64 ✅ 4s 4s +0%
mld_ct_get_optblocker_u8 ✅ 4s 2s +100%
mld_polymat_expand_entry ✅ 4s 2s +100%
mld_prepare_domain_separation_prefix ✅ 4s 3s +33%
mld_sample_s1_s2 ✅ 4s 1s +300%
mld_sign_resume ✅ 4s - new
pack_sk_rho_key_tr_s2 ✅ 4s 5s -20%
pointwise_native_aarch64 ✅ 4s 2s +100%
poly_caddq ✅ 4s 4s +0%
poly_caddq_native_x86_64 ✅ 4s 4s +0%
poly_decompose ✅ 4s 2s +100%
poly_use_hint_native_aarch64 ✅ 4s 3s +33%
poly_use_hint_native_x86_64 ✅ 4s - new
polyeta_pack ✅ 4s 3s +33%
polyvecl_ntt ✅ 4s 3s +33%
polyvecl_pack_eta ✅ 4s 2s +100%
polyvecl_pointwise_acc_montgomery ✅ 4s 3s +33%
polyw1_pack ✅ 4s 4s +0%
rej_eta_native ✅ 4s 3s +33%
rej_uniform_eta_native_aarch64 ✅ 4s 3s +33%
sign_signature_extmu ✅ 4s 4s +0%
sign_verify_pre_hash_shake256 ✅ 4s 5s -20%
sys_check_capability ✅ 4s 2s +100%
yvec_init ✅ 4s 1s +300%
keccak_f1600_x1_native_aarch64_v84a ✅ 3s 2s +50%
keccak_f1600_x4_native_aarch64_v8a_scalar_hybrid ✅ 3s 2s +50%
keccak_f1600_x4_native_aarch64_v8a_v84a_scalar_hybrid ✅ 3s 3s +0%
keccakf1600_permute ✅ 3s 2s +50%
keccakf1600x4_permute ✅ 3s 4s -25%
keccakf1600x4_xor_bytes ✅ 3s 3s +0%
keccakf1600x4_xor_bytes_native ✅ 3s 5s -40%
make_hint ✅ 3s 3s +0%
mld_ct_cmask_nonzero_u32 ✅ 3s 3s +0%
mld_ct_cmask_nonzero_u8 ✅ 3s 2s +50%
mld_ct_sel_int32 ✅ 3s 3s +0%
mld_keccakf1600x4_xor_bytes_c ✅ 3s 4s -25%
mld_sign_attempt ✅ 3s - new
mld_value_barrier_i64 ✅ 3s 3s +0%
nttunpack_native_x86_64 ✅ 3s 4s -25%
pack_sig_h ✅ 3s 4s -25%
pack_sk_s1 ✅ 3s 3s +0%
poly_caddq_c ✅ 3s 3s +0%
poly_caddq_native ✅ 3s 3s +0%
poly_chknorm ✅ 3s 3s +0%
poly_invntt_tomont ✅ 3s 2s +50%
poly_invntt_tomont_native ✅ 3s 3s +0%
poly_ntt_native ✅ 3s 3s +0%
poly_permute_bitrev_to_custom_optional_native ✅ 3s 3s +0%
poly_pointwise_montgomery ✅ 3s 3s +0%
poly_pointwise_montgomery_native ✅ 3s 2s +50%
poly_uniform_4x ✅ 3s 3s +0%
poly_uniform_gamma1 ✅ 3s 3s +0%
poly_use_hint ✅ 3s 2s +50%
poly_use_hint_c ✅ 3s 5s -40%
poly_use_hint_native ✅ 3s 3s +0%
polyt0_pack ✅ 3s 4s -25%
polyt1_pack ✅ 3s 3s +0%
polyvec_matrix_expand_serial ✅ 3s 4s -25%
polyveck_ntt ✅ 3s 2s +50%
polyveck_pack_eta ✅ 3s 4s -25%
polyveck_pack_w1 ✅ 3s 3s +0%
polyveck_unpack_eta ✅ 3s 2s +50%
polyvecl_pointwise_acc_montgomery_native ✅ 3s 3s +0%
polyvecl_uniform_gamma1 ✅ 3s 2s +50%
polyvecl_uniform_gamma1_serial ✅ 3s 2s +50%
polyz_unpack ✅ 3s 3s +0%
polyz_unpack_native_x86_64 ✅ 3s 3s +0%
power2round ✅ 3s 2s +50%
reduce32 ✅ 3s 3s +0%
rej_eta_c ✅ 3s 4s -25%
rej_uniform_eta_native_x86_64 ✅ 3s - new
rej_uniform_native_aarch64 ✅ 3s 3s +0%
shake128_init ✅ 3s 2s +50%
shake256_finalize ✅ 3s 2s +50%
shake256_init ✅ 3s 4s -25%
shake256_release ✅ 3s 1s +200%
sign_signature_pre_hash_internal ✅ 3s 4s -25%
sign_verify ✅ 3s 4s -25%
sign_verify_extmu ✅ 3s 5s -40%
sk_s1hat_get_poly ✅ 3s 2s +50%
sk_t0hat_get_poly ✅ 3s 1s +200%
unpack_pk_t1 ✅ 3s 3s +0%
unpack_sk_s2hat ✅ 3s 4s -25%
keccak_f1600_x1_native_aarch64 ✅ 2s 3s -33%
keccak_finalize ✅ 2s 2s +0%
keccak_init ✅ 2s 3s -33%
keccak_squeeze ✅ 2s 2s +0%
keccakf1600_extract_bytes (big endian) ✅ 2s 4s -50%
keccakf1600_permute_native ✅ 2s 3s -33%
keccakf1600_xor_bytes ✅ 2s 3s -33%
keccakf1600_xor_bytes (big endian) ✅ 2s 6s -67%
keccakf1600x4_extract_bytes ✅ 2s 2s +0%
mld_ct_get_optblocker_u32 ✅ 2s 2s +0%
mld_keccakf1600_extract_bytes ✅ 2s 2s +0%
mld_keccakf1600x4_extract_bytes_c ✅ 2s 4s -50%
mld_value_barrier_u32 ✅ 2s 1s +100%
mld_value_barrier_u8 ✅ 2s 4s -50%
ntt_native_aarch64 ✅ 2s 4s -50%
pointwise_native_x86_64 ✅ 2s 4s -50%
poly_chknorm_native ✅ 2s 4s -50%
poly_chknorm_native_aarch64 ✅ 2s 2s +0%
poly_chknorm_native_x86_64 ✅ 2s 2s +0%
poly_decompose_32_native_aarch64 ✅ 2s 4s -50%
poly_decompose_native_x86_64 ✅ 2s 2s +0%
poly_ntt ✅ 2s 3s -33%
poly_permute_bitrev_to_custom_optional ✅ 2s 5s -60%
poly_shiftl ✅ 2s 4s -50%
poly_uniform_gamma1_4x ✅ 2s 5s -60%
polyvecl_pointwise_acc_montgomery_c ✅ 2s 4s -50%
polyvecl_unpack_z ✅ 2s 3s -33%
polyw1_pack_32 ✅ 2s 3s -33%
polyw1_pack_88 ✅ 2s 2s +0%
polyz_unpack_17_native_aarch64 ✅ 2s 2s +0%
polyz_unpack_19_native_aarch64 ✅ 2s 4s -50%
shake128_absorb ✅ 2s 3s -33%
shake128_finalize ✅ 2s 3s -33%
shake128_release ✅ 2s 2s +0%
shake128_squeeze ✅ 2s 2s +0%
shake128x4_absorb_once ✅ 2s 2s +0%
shake128x4_squeezeblocks ✅ 2s 2s +0%
shake256_absorb ✅ 2s 2s +0%
shake256x4_absorb_once ✅ 2s 1s +100%
shake256x4_squeezeblocks ✅ 2s 2s +0%
sign_verify_pre_hash_internal ✅ 2s 5s -60%
sk_s2hat_get_poly ✅ 2s 5s -60%
unpack_sk ✅ 2s 3s -33%
unpack_sk_s1hat ✅ 2s 3s -33%
unpack_sk_t0hat ✅ 2s 2s +0%
yvec_get_poly ✅ 2s 3s -33%
caddq ✅ 1s 6s -83%
keccak_f1600_x4_native_aarch64_v84a ✅ 1s 3s -67%
keccak_f1600_x4_native_avx2 ✅ 1s 2s -50%
mld_ct_memcmp ✅ 1s 1s +0%
montgomery_reduce ✅ 1s 2s -50%
poly_caddq_native_aarch64 ✅ 1s 3s -67%
poly_sub ✅ 1s 3s -67%
polyt1_unpack ✅ 1s 2s -50%
shake256 ✅ 1s 1s +0%
shake256_squeeze ✅ 1s 2s -50%

@oqs-bot

oqs-bot commented Jul 10, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

CBMC Results (ML-DSA-87, REDUCE-RAM)

⚠️ Attention Required

Proof Status Current Previous Change
**TOTAL** ⚠️ 2044s 1436s +42.3%
compute_pack_t0_t1 ⚠️ 44s 12s +267%
mld_attempt_signature_generation ⚠️ 217s 34s +538%
rej_uniform ⚠️ 24s 7s +243%
sig_unpack_hints ⚠️ 20s 4s +400%
sign_pk_from_sk ⚠️ 56s 6s +833%
sign_verify_internal ⚠️ 261s 47s +455%
Full Results (210 proofs)
Proof Status Current Previous Change
**TOTAL** ⚠️ 2044s 1436s +42.3%
sign_verify_internal ⚠️ 261s 47s +455%
mld_attempt_signature_generation ⚠️ 217s 34s +538%
polyvec_matrix_pointwise_montgomery_yvec ✅ 196s 196s +0%
poly_pointwise_montgomery_c ✅ 129s 125s +3%
mld_invntt_layer ✅ 113s 111s +2%
sign_pk_from_sk ⚠️ 56s 6s +833%
compute_pack_t0_t1 ⚠️ 44s 12s +267%
mld_ntt_layer ✅ 44s 44s +0%
fqmul ✅ 41s 39s +5%
polyvecl_chknorm ✅ 36s 38s -5%
rej_uniform ⚠️ 24s 7s +243%
keccakf1600x4_permute_native ✅ 21s 25s -16%
mld_ntt_butterfly_block ✅ 21s 23s -9%
sig_unpack_hints ⚠️ 20s 4s +400%
sign_signature_internal ✅ 19s 3s +533%
poly_ntt_c ✅ 18s 19s -5%
sign_keypair_internal ✅ 17s 6s +183%
polyeta_unpack ✅ 16s 13s +23%
poly_chknorm_c ✅ 15s 13s +15%
polyvec_matrix_pointwise_montgomery_row ✅ 15s 13s +15%
rej_uniform_native_x86_64 ✅ 15s - new
poly_uniform_eta_4x ✅ 14s 12s +17%
rej_uniform_c ✅ 13s 18s -28%
polyt0_unpack ✅ 12s 14s -14%
polyveck_decompose ✅ 12s 12s +0%
polyvecl_ntt ✅ 10s 8s +25%
poly_add ✅ 9s 8s +12%
poly_invntt_tomont_c ✅ 9s 9s +0%
polyveck_chknorm ✅ 9s 9s +0%
sign_keypair ✅ 9s 4s +125%
keccak_absorb_once_x4 ✅ 8s 8s +0%
mld_keccakf1600_permute_c ✅ 8s 8s +0%
mld_sample_s1_s2 ✅ 8s 8s +0%
mld_sample_s1_s2_serial ✅ 8s 6s +33%
pointwise_acc_native_x86_64 ✅ 8s 8s +0%
poly_decompose_c ✅ 8s 6s +33%
polyveck_caddq ✅ 8s 8s +0%
polyz_unpack_c ✅ 8s 7s +14%
keccak_absorb ✅ 7s 4s +75%
mld_check_pct ✅ 7s 15s -53%
mld_compute_pack_z ✅ 7s 6s +17%
pointwise_acc_native_aarch64 ✅ 7s 5s +40%
poly_challenge ✅ 7s 4s +75%
poly_decompose_native_x86_64 ✅ 7s 3s +133%
polyveck_invntt_tomont ✅ 7s 4s +75%
polyveck_reduce ✅ 7s 6s +17%
keccak_squeezeblocks_x4 ✅ 6s 4s +50%
poly_power2round ✅ 6s 7s -14%
rej_uniform_native ✅ 6s 5s +20%
sign_signature_extmu ✅ 6s 4s +50%
unpack_sk_s2hat ✅ 6s 3s +100%
intt_native_aarch64 ✅ 5s 4s +25%
keccak_squeeze ✅ 5s 5s +0%
pack_sig_z ✅ 5s 3s +67%
poly_caddq_c ✅ 5s 3s +67%
poly_reduce ✅ 5s 4s +25%
poly_use_hint_c ✅ 5s 4s +25%
polyvecl_unpack_eta ✅ 5s 3s +67%
shake128_release ✅ 5s 3s +67%
shake256 ✅ 5s 3s +67%
sign_signature_pre_hash_internal ✅ 5s 2s +150%
sign_verify_extmu ✅ 5s 4s +25%
unpack_pk_t1 ✅ 5s 2s +150%
caddq ✅ 4s 3s +33%
mld_ct_abs_i32 ✅ 4s 1s +300%
mld_ct_cmask_nonzero_u8 ✅ 4s 2s +100%
mld_h ✅ 4s 2s +100%
mld_prepare_domain_separation_prefix ✅ 4s 3s +33%
mld_value_barrier_u32 ✅ 4s 3s +33%
nttunpack_native_x86_64 ✅ 4s 3s +33%
pack_sig_c ✅ 4s 2s +100%
pack_sk_rho_key_tr_s2 ✅ 4s 2s +100%
pointwise_native_aarch64 ✅ 4s 4s +0%
poly_invntt_tomont_native ✅ 4s 2s +100%
poly_ntt_native ✅ 4s 4s +0%
poly_permute_bitrev_to_custom_optional ✅ 4s 2s +100%
polyt1_unpack ✅ 4s 3s +33%
polyvecl_pack_eta ✅ 4s 2s +100%
polyvecl_pointwise_acc_montgomery_c ✅ 4s 2s +100%
polyvecl_pointwise_acc_montgomery_native ✅ 4s 2s +100%
polyz_unpack_17_native_aarch64 ✅ 4s 4s +0%
polyz_unpack_native_x86_64 ✅ 4s 3s +33%
rej_eta_native ✅ 4s 4s +0%
shake256_absorb ✅ 4s 3s +33%
shake256_finalize ✅ 4s 3s +33%
sign_signature ✅ 4s 4s +0%
sign_signature_pre_hash_shake256 ✅ 4s 3s +33%
sign_verify ✅ 4s 2s +100%
sign_verify_pre_hash_internal ✅ 4s 3s +33%
sys_check_capability ✅ 4s 2s +100%
unpack_sk ✅ 4s 4s +0%
yvec_init ✅ 4s 4s +0%
decompose ✅ 3s 2s +50%
keccak_f1600_x1_native_aarch64 ✅ 3s 2s +50%
keccak_f1600_x4_native_aarch64_v84a ✅ 3s 1s +200%
keccak_f1600_x4_native_aarch64_v8a_scalar_hybrid ✅ 3s 2s +50%
keccak_f1600_x4_native_aarch64_v8a_v84a_scalar_hybrid ✅ 3s 2s +50%
keccak_finalize ✅ 3s 1s +200%
keccakf1600_extract_bytes (big endian) ✅ 3s 3s +0%
keccakf1600_permute ✅ 3s 2s +50%
keccakf1600_xor_bytes ✅ 3s 1s +200%
keccakf1600_xor_bytes (big endian) ✅ 3s 2s +50%
keccakf1600x4_permute ✅ 3s 2s +50%
keccakf1600x4_xor_bytes_native ✅ 3s 2s +50%
make_hint ✅ 3s 2s +50%
mld_ct_cmask_nonzero_u32 ✅ 3s 5s -40%
mld_ct_get_optblocker_i64 ✅ 3s 2s +50%
mld_keccakf1600_extract_bytes ✅ 3s 1s +200%
mld_sign_attempt ✅ 3s - new
mld_sign_resume ✅ 3s - new
mld_value_barrier_i64 ✅ 3s 2s +50%
ntt_native_x86_64 ✅ 3s 2s +50%
pack_sig_h ✅ 3s 3s +0%
pack_sk_s1 ✅ 3s 2s +50%
pointwise_native_x86_64 ✅ 3s 5s -40%
poly_caddq_native_aarch64 ✅ 3s 3s +0%
poly_caddq_native_x86_64 ✅ 3s 3s +0%
poly_chknorm ✅ 3s 4s -25%
poly_chknorm_native ✅ 3s 1s +200%
poly_decompose ✅ 3s 2s +50%
poly_pointwise_montgomery ✅ 3s 3s +0%
poly_pointwise_montgomery_native ✅ 3s 3s +0%
poly_sub ✅ 3s 5s -40%
poly_uniform_eta ✅ 3s 5s -40%
poly_uniform_gamma1_4x ✅ 3s 3s +0%
poly_use_hint ✅ 3s 4s -25%
poly_use_hint_native_aarch64 ✅ 3s 3s +0%
poly_use_hint_native_x86_64 ✅ 3s - new
polyt1_pack ✅ 3s 5s -40%
polyvec_matrix_expand_serial ✅ 3s 3s +0%
polyveck_pack_eta ✅ 3s 5s -40%
polyveck_unpack_eta ✅ 3s 3s +0%
polyvecl_pointwise_acc_montgomery ✅ 3s 2s +50%
polyvecl_unpack_z ✅ 3s 3s +0%
polyw1_pack ✅ 3s 2s +50%
polyz_pack ✅ 3s 4s -25%
polyz_unpack_19_native_aarch64 ✅ 3s 5s -40%
polyz_unpack_native ✅ 3s 1s +200%
power2round ✅ 3s 3s +0%
reduce32 ✅ 3s 3s +0%
rej_eta_c ✅ 3s 4s -25%
rej_uniform_eta_native_aarch64 ✅ 3s 3s +0%
rej_uniform_native_aarch64 ✅ 3s 3s +0%
shake128_finalize ✅ 3s 2s +50%
shake128x4_squeezeblocks ✅ 3s 1s +200%
shake256_release ✅ 3s 5s -40%
shake256x4_absorb_once ✅ 3s 5s -40%
shake256x4_squeezeblocks ✅ 3s 4s -25%
sk_s2hat_get_poly ✅ 3s 2s +50%
sk_t0hat_get_poly ✅ 3s 3s +0%
unpack_sk_s1hat ✅ 3s 3s +0%
use_hint ✅ 3s 3s +0%
fqscale ✅ 2s 1s +100%
intt_native_x86_64 ✅ 2s 4s -50%
keccak_f1600_x1_native_aarch64_v84a ✅ 2s 2s +0%
keccak_init ✅ 2s 1s +100%
keccakf1600_permute_native ✅ 2s 3s -33%
keccakf1600x4_extract_bytes ✅ 2s 1s +100%
keccakf1600x4_extract_bytes_native ✅ 2s 4s -50%
mld_ct_cmask_neg_i32 ✅ 2s 2s +0%
mld_ct_get_optblocker_u8 ✅ 2s 3s -33%
mld_ct_memcmp ✅ 2s 1s +100%
mld_ct_sel_int32 ✅ 2s 2s +0%
mld_keccakf1600x4_extract_bytes_c ✅ 2s 3s -33%
mld_sign_finish ✅ 2s - new
poly_caddq_native ✅ 2s 3s -33%
poly_chknorm_native_aarch64 ✅ 2s 5s -60%
poly_chknorm_native_x86_64 ✅ 2s 2s +0%
poly_decompose_32_native_aarch64 ✅ 2s 3s -33%
poly_decompose_88_native_aarch64 ✅ 2s 2s +0%
poly_decompose_native ✅ 2s 2s +0%
poly_invntt_tomont ✅ 2s 4s -50%
poly_ntt ✅ 2s 2s +0%
poly_permute_bitrev_to_custom_optional_native ✅ 2s 3s -33%
poly_shiftl ✅ 2s 4s -50%
poly_uniform ✅ 2s 4s -50%
poly_uniform_4x ✅ 2s 3s -33%
poly_uniform_gamma1 ✅ 2s 3s -33%
poly_use_hint_native ✅ 2s 1s +100%
polyeta_pack ✅ 2s 3s -33%
polyt0_pack ✅ 2s 3s -33%
polyveck_ntt ✅ 2s 3s -33%
polyvecl_uniform_gamma1 ✅ 2s 3s -33%
polyvecl_uniform_gamma1_serial ✅ 2s 2s +0%
polyw1_pack_32 ✅ 2s 3s -33%
polyw1_pack_88 ✅ 2s 2s +0%
polyz_unpack ✅ 2s 3s -33%
rej_eta ✅ 2s 2s +0%
rej_uniform_eta_native_x86_64 ✅ 2s - new
shake128_absorb ✅ 2s 2s +0%
shake128_init ✅ 2s 2s +0%
shake128_squeeze ✅ 2s 1s +100%
shake256_init ✅ 2s 3s -33%
sign_verify_pre_hash_shake256 ✅ 2s 7s -71%
sk_s1hat_get_poly ✅ 2s 3s -33%
unpack_sk_t0hat ✅ 2s 4s -50%
yvec_get_poly ✅ 2s 2s +0%
keccak_f1600_x4_native_avx2 ✅ 1s 3s -67%
keccakf1600x4_xor_bytes ✅ 1s 1s +0%
mld_ct_get_optblocker_u32 ✅ 1s 2s -50%
mld_keccakf1600x4_xor_bytes_c ✅ 1s 1s +0%
mld_polymat_expand_entry ✅ 1s 4s -75%
mld_value_barrier_u8 ✅ 1s 2s -50%
montgomery_reduce ✅ 1s 2s -50%
ntt_native_aarch64 ✅ 1s 4s -75%
poly_caddq ✅ 1s 5s -80%
polyvec_matrix_expand ✅ 1s 3s -67%
polyveck_pack_w1 ✅ 1s 3s -67%
shake128x4_absorb_once ✅ 1s 4s -75%
shake256_squeeze ✅ 1s 2s -50%

@oqs-bot

oqs-bot commented Jul 10, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

CBMC Results (ML-DSA-65)

⚠️ Attention Required

Proof Status Current Previous Change
**TOTAL** ⚠️ 2570s 1784s +44.1%
compute_pack_t0_t1 ⚠️ 76s 13s +485%
mld_attempt_signature_generation ⚠️ 382s 63s +506%
sig_unpack_hints ⚠️ 30s 2s +1400%
sign_pk_from_sk ⚠️ 53s 6s +783%
sign_signature_internal ⚠️ 101s 55s +84%
sign_verify_internal ⚠️ 382s 177s +116%
Full Results (210 proofs)
Proof Status Current Previous Change
**TOTAL** ⚠️ 2570s 1784s +44.1%
mld_attempt_signature_generation ⚠️ 382s 63s +506%
sign_verify_internal ⚠️ 382s 177s +116%
polyvecl_pointwise_acc_montgomery_c ✅ 220s 210s +5%
poly_pointwise_montgomery_c ✅ 129s 125s +3%
mld_invntt_layer ✅ 110s 109s +1%
polyvec_matrix_expand ✅ 107s 110s -3%
sign_signature_internal ⚠️ 101s 55s +84%
compute_pack_t0_t1 ⚠️ 76s 13s +485%
sign_pk_from_sk ⚠️ 53s 6s +783%
fqmul ✅ 44s 40s +10%
mld_ntt_layer ✅ 43s 41s +5%
polyvec_matrix_expand_serial ✅ 30s 27s +11%
sig_unpack_hints ⚠️ 30s 2s +1400%
keccakf1600x4_permute_native ✅ 22s 23s -4%
mld_ntt_butterfly_block ✅ 20s 24s -17%
poly_ntt_c ✅ 18s 19s -5%
polyt0_unpack ✅ 18s 16s +12%
polyvec_matrix_pointwise_montgomery_yvec ✅ 18s 18s +0%
poly_chknorm_c ✅ 16s 15s +7%
rej_uniform ✅ 15s 18s -17%
rej_uniform_native_x86_64 ✅ 15s - new
sign_keypair_internal ✅ 15s 5s +200%
polyveck_decompose ✅ 14s 12s +17%
rej_uniform_c ✅ 14s 14s +0%
poly_uniform_4x ✅ 13s 13s +0%
poly_uniform_eta_4x ✅ 13s 14s -7%
polyz_unpack_c ✅ 13s 13s +0%
poly_invntt_tomont_c ✅ 11s 11s +0%
mld_check_pct ✅ 9s 14s -36%
mld_compute_pack_z ✅ 9s 7s +29%
polyveck_invntt_tomont ✅ 8s 8s +0%
pointwise_acc_native_aarch64 ✅ 7s 6s +17%
pointwise_acc_native_x86_64 ✅ 7s 8s -12%
poly_add ✅ 7s 9s -22%
sign_keypair ✅ 7s 3s +133%
keccak_absorb ✅ 6s 3s +100%
keccak_absorb_once_x4 ✅ 6s 8s -25%
mld_keccakf1600_permute_c ✅ 6s 6s +0%
pointwise_native_x86_64 ✅ 6s 3s +100%
poly_sub ✅ 6s 3s +100%
poly_use_hint_c ✅ 6s 5s +20%
polyveck_ntt ✅ 6s 7s -14%
rej_eta_native ✅ 6s 3s +100%
sign_signature_extmu ✅ 6s 2s +200%
unpack_pk_t1 ✅ 6s 5s +20%
keccak_squeezeblocks_x4 ✅ 5s 5s +0%
ntt_native_aarch64 ✅ 5s 2s +150%
nttunpack_native_x86_64 ✅ 5s 3s +67%
pack_sk_rho_key_tr_s2 ✅ 5s 2s +150%
poly_caddq_native_x86_64 ✅ 5s 3s +67%
poly_decompose ✅ 5s 2s +150%
poly_decompose_c ✅ 5s 5s +0%
poly_uniform_eta ✅ 5s 4s +25%
polyt0_pack ✅ 5s 3s +67%
polyt1_unpack ✅ 5s 5s +0%
polyveck_caddq ✅ 5s 6s -17%
polyveck_chknorm ✅ 5s 6s -17%
polyvecl_chknorm ✅ 5s 7s -29%
polyvecl_ntt ✅ 5s 4s +25%
rej_eta_c ✅ 5s 5s +0%
sign_signature_pre_hash_internal ✅ 5s 3s +67%
sign_verify ✅ 5s 3s +67%
unpack_sk ✅ 5s 3s +67%
unpack_sk_s2hat ✅ 5s 4s +25%
yvec_get_poly ✅ 5s 3s +67%
caddq ✅ 4s 3s +33%
fqscale ✅ 4s 3s +33%
keccak_f1600_x1_native_aarch64_v84a ✅ 4s 3s +33%
keccak_finalize ✅ 4s 2s +100%
keccakf1600_permute_native ✅ 4s 3s +33%
mld_ct_sel_int32 ✅ 4s 3s +33%
mld_h ✅ 4s 2s +100%
mld_sample_s1_s2 ✅ 4s 6s -33%
mld_sample_s1_s2_serial ✅ 4s 4s +0%
mld_sign_finish ✅ 4s - new
mld_value_barrier_u8 ✅ 4s 3s +33%
pack_sig_c ✅ 4s 5s -20%
pack_sig_z ✅ 4s 2s +100%
poly_caddq_c ✅ 4s 2s +100%
poly_caddq_native_aarch64 ✅ 4s 2s +100%
poly_chknorm_native_x86_64 ✅ 4s 3s +33%
poly_decompose_native ✅ 4s 3s +33%
poly_decompose_native_x86_64 ✅ 4s 3s +33%
poly_invntt_tomont_native ✅ 4s 2s +100%
poly_permute_bitrev_to_custom_optional ✅ 4s 2s +100%
poly_pointwise_montgomery ✅ 4s 3s +33%
poly_pointwise_montgomery_native ✅ 4s 3s +33%
poly_power2round ✅ 4s 4s +0%
poly_uniform_gamma1 ✅ 4s 3s +33%
poly_use_hint_native_x86_64 ✅ 4s - new
polyeta_unpack ✅ 4s 8s -50%
polyveck_pack_w1 ✅ 4s 3s +33%
polyvecl_pack_eta ✅ 4s 3s +33%
polyvecl_pointwise_acc_montgomery ✅ 4s 3s +33%
polyvecl_uniform_gamma1_serial ✅ 4s 3s +33%
polyw1_pack ✅ 4s 4s +0%
polyw1_pack_88 ✅ 4s 2s +100%
polyz_unpack_19_native_aarch64 ✅ 4s 3s +33%
polyz_unpack_native ✅ 4s 4s +0%
rej_uniform_native ✅ 4s 4s +0%
shake256_squeeze ✅ 4s 3s +33%
sign_signature ✅ 4s 6s -33%
sign_verify_pre_hash_internal ✅ 4s 5s -20%
sign_verify_pre_hash_shake256 ✅ 4s 5s -20%
unpack_sk_t0hat ✅ 4s 5s -20%
intt_native_aarch64 ✅ 3s 3s +0%
intt_native_x86_64 ✅ 3s 3s +0%
keccak_f1600_x1_native_aarch64 ✅ 3s 2s +50%
keccak_f1600_x4_native_aarch64_v84a ✅ 3s 4s -25%
keccak_f1600_x4_native_aarch64_v8a_scalar_hybrid ✅ 3s 2s +50%
keccak_f1600_x4_native_aarch64_v8a_v84a_scalar_hybrid ✅ 3s 2s +50%
keccakf1600_extract_bytes (big endian) ✅ 3s 2s +50%
keccakf1600_xor_bytes ✅ 3s 2s +50%
make_hint ✅ 3s 2s +50%
mld_ct_cmask_nonzero_u8 ✅ 3s 3s +0%
mld_ct_get_optblocker_u32 ✅ 3s 3s +0%
mld_keccakf1600x4_extract_bytes_c ✅ 3s 3s +0%
mld_keccakf1600x4_xor_bytes_c ✅ 3s 2s +50%
mld_polymat_expand_entry ✅ 3s 4s -25%
mld_prepare_domain_separation_prefix ✅ 3s 2s +50%
mld_sign_attempt ✅ 3s - new
mld_sign_resume ✅ 3s - new
pack_sig_h ✅ 3s 5s -40%
pointwise_native_aarch64 ✅ 3s 5s -40%
poly_challenge ✅ 3s 6s -50%
poly_chknorm ✅ 3s 4s -25%
poly_chknorm_native ✅ 3s 2s +50%
poly_chknorm_native_aarch64 ✅ 3s 3s +0%
poly_decompose_88_native_aarch64 ✅ 3s 1s +200%
poly_ntt ✅ 3s 2s +50%
poly_ntt_native ✅ 3s 4s -25%
poly_permute_bitrev_to_custom_optional_native ✅ 3s 4s -25%
poly_shiftl ✅ 3s 3s +0%
poly_uniform ✅ 3s 4s -25%
poly_uniform_gamma1_4x ✅ 3s 4s -25%
poly_use_hint ✅ 3s 3s +0%
poly_use_hint_native ✅ 3s 2s +50%
polyeta_pack ✅ 3s 3s +0%
polyvec_matrix_pointwise_montgomery_row ✅ 3s 1s +200%
polyveck_pack_eta ✅ 3s 4s -25%
polyveck_reduce ✅ 3s 4s -25%
polyvecl_pointwise_acc_montgomery_native ✅ 3s 2s +50%
polyvecl_unpack_eta ✅ 3s 3s +0%
polyvecl_unpack_z ✅ 3s 3s +0%
polyw1_pack_32 ✅ 3s 4s -25%
polyz_unpack_17_native_aarch64 ✅ 3s 3s +0%
polyz_unpack_native_x86_64 ✅ 3s 3s +0%
power2round ✅ 3s 1s +200%
rej_uniform_eta_native_aarch64 ✅ 3s 4s -25%
rej_uniform_eta_native_x86_64 ✅ 3s - new
shake128_init ✅ 3s 2s +50%
shake128_squeeze ✅ 3s 2s +50%
shake128x4_absorb_once ✅ 3s 3s +0%
shake256 ✅ 3s 2s +50%
shake256_init ✅ 3s 2s +50%
shake256_release ✅ 3s 2s +50%
sign_verify_extmu ✅ 3s 3s +0%
sk_s2hat_get_poly ✅ 3s 2s +50%
sk_t0hat_get_poly ✅ 3s 2s +50%
use_hint ✅ 3s 2s +50%
decompose ✅ 2s 1s +100%
keccak_f1600_x4_native_avx2 ✅ 2s 2s +0%
keccak_init ✅ 2s 1s +100%
keccak_squeeze ✅ 2s 4s -50%
keccakf1600_permute ✅ 2s 2s +0%
keccakf1600x4_extract_bytes ✅ 2s 4s -50%
keccakf1600x4_extract_bytes_native ✅ 2s 4s -50%
keccakf1600x4_permute ✅ 2s 4s -50%
keccakf1600x4_xor_bytes ✅ 2s 1s +100%
keccakf1600x4_xor_bytes_native ✅ 2s 3s -33%
mld_ct_cmask_neg_i32 ✅ 2s 2s +0%
mld_ct_get_optblocker_i64 ✅ 2s 2s +0%
mld_ct_get_optblocker_u8 ✅ 2s 2s +0%
mld_ct_memcmp ✅ 2s 2s +0%
mld_keccakf1600_extract_bytes ✅ 2s 1s +100%
mld_value_barrier_i64 ✅ 2s 2s +0%
ntt_native_x86_64 ✅ 2s 2s +0%
pack_sk_s1 ✅ 2s 5s -60%
poly_caddq ✅ 2s 2s +0%
poly_caddq_native ✅ 2s 2s +0%
poly_reduce ✅ 2s 3s -33%
poly_use_hint_native_aarch64 ✅ 2s 3s -33%
polyt1_pack ✅ 2s 3s -33%
polyveck_unpack_eta ✅ 2s 6s -67%
polyvecl_uniform_gamma1 ✅ 2s 2s +0%
polyz_pack ✅ 2s 3s -33%
polyz_unpack ✅ 2s 3s -33%
reduce32 ✅ 2s 3s -33%
rej_uniform_native_aarch64 ✅ 2s 3s -33%
shake128_absorb ✅ 2s 2s +0%
shake128_release ✅ 2s 3s -33%
shake128x4_squeezeblocks ✅ 2s 3s -33%
shake256_absorb ✅ 2s 2s +0%
shake256_finalize ✅ 2s 1s +100%
shake256x4_squeezeblocks ✅ 2s 2s +0%
sign_signature_pre_hash_shake256 ✅ 2s 3s -33%
sk_s1hat_get_poly ✅ 2s 6s -67%
sys_check_capability ✅ 2s 4s -50%
unpack_sk_s1hat ✅ 2s 2s +0%
keccakf1600_xor_bytes (big endian) ✅ 1s 2s -50%
mld_ct_abs_i32 ✅ 1s 2s -50%
mld_ct_cmask_nonzero_u32 ✅ 1s 4s -75%
mld_value_barrier_u32 ✅ 1s 3s -67%
montgomery_reduce ✅ 1s 4s -75%
poly_decompose_32_native_aarch64 ✅ 1s 3s -67%
poly_invntt_tomont ✅ 1s 3s -67%
rej_eta ✅ 1s 2s -50%
shake128_finalize ✅ 1s 1s +0%
shake256x4_absorb_once ✅ 1s 3s -67%
yvec_init ✅ 1s 3s -67%

@oqs-bot

oqs-bot commented Jul 10, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

CBMC Results (ML-DSA-65, REDUCE-RAM)

⚠️ Attention Required

Proof Status Current Previous Change
**TOTAL** ⚠️ 2284s 1482s +54.1%
compute_pack_t0_t1 ⚠️ 50s 7s +614%
mld_attempt_signature_generation ⚠️ 449s 31s +1348%
rej_uniform ⚠️ 23s 7s +229%
sig_unpack_hints ⚠️ 20s 1s +1900%
sign_pk_from_sk ⚠️ 42s 5s +740%
sign_verify_internal ⚠️ 269s 71s +279%
Full Results (210 proofs)
Proof Status Current Previous Change
**TOTAL** ⚠️ 2284s 1482s +54.1%
mld_attempt_signature_generation ⚠️ 449s 31s +1348%
sign_verify_internal ⚠️ 269s 71s +279%
polyvec_matrix_pointwise_montgomery_yvec ✅ 204s 201s +1%
poly_pointwise_montgomery_c ✅ 129s 116s +11%
mld_invntt_layer ✅ 112s 108s +4%
compute_pack_t0_t1 ⚠️ 50s 7s +614%
mld_ntt_layer ✅ 43s 43s +0%
polyvecl_chknorm ✅ 43s 43s +0%
sign_pk_from_sk ⚠️ 42s 5s +740%
fqmul ✅ 41s 40s +2%
polyveck_chknorm ✅ 33s 36s -8%
rej_uniform ⚠️ 23s 7s +229%
keccakf1600x4_permute_native ✅ 22s 22s +0%
mld_ntt_butterfly_block ✅ 20s 25s -20%
poly_ntt_c ✅ 20s 22s -9%
sig_unpack_hints ⚠️ 20s 1s +1900%
sign_keypair_internal ✅ 18s 3s +500%
sign_signature_internal ✅ 18s 6s +200%
rej_uniform_native_x86_64 ✅ 16s - new
rej_uniform_c ✅ 15s 16s -6%
polyt0_unpack ✅ 12s 13s -8%
poly_uniform_eta_4x ✅ 11s 13s -15%
poly_chknorm_c ✅ 10s 13s -23%
poly_invntt_tomont_c ✅ 10s 10s +0%
polyveck_decompose ✅ 10s 14s -29%
mld_check_pct ✅ 9s 12s -25%
polyveck_reduce ✅ 9s 6s +50%
keccak_absorb_once_x4 ✅ 8s 10s -20%
polyvec_matrix_pointwise_montgomery_row ✅ 8s 8s +0%
sign_signature_pre_hash_internal ✅ 8s 3s +167%
decompose ✅ 7s 4s +75%
mld_compute_pack_z ✅ 7s 5s +40%
mld_sample_s1_s2 ✅ 7s 6s +17%
mld_sign_attempt ✅ 7s - new
pointwise_acc_native_aarch64 ✅ 7s 6s +17%
pointwise_acc_native_x86_64 ✅ 7s 5s +40%
poly_decompose_c ✅ 7s 8s -12%
polyvecl_ntt ✅ 7s 7s +0%
polyz_unpack_c ✅ 7s 9s -22%
keccak_absorb ✅ 6s 3s +100%
poly_caddq_c ✅ 6s 5s +20%
poly_chknorm_native ✅ 6s 4s +50%
poly_power2round ✅ 6s 7s -14%
polyveck_invntt_tomont ✅ 6s 7s -14%
polyveck_pack_w1 ✅ 6s 4s +50%
rej_eta_native ✅ 6s 3s +100%
rej_uniform_native ✅ 6s 4s +50%
sign_keypair ✅ 6s 4s +50%
keccakf1600x4_xor_bytes_native ✅ 5s 2s +150%
mld_h ✅ 5s 3s +67%
mld_keccakf1600_permute_c ✅ 5s 7s -29%
mld_keccakf1600x4_extract_bytes_c ✅ 5s 2s +150%
mld_sample_s1_s2_serial ✅ 5s 3s +67%
mld_sign_finish ✅ 5s - new
ntt_native_x86_64 ✅ 5s 5s +0%
poly_add ✅ 5s 7s -29%
poly_challenge ✅ 5s 5s +0%
poly_reduce ✅ 5s 4s +25%
poly_uniform ✅ 5s 2s +150%
poly_use_hint_c ✅ 5s 2s +150%
polyveck_caddq ✅ 5s 7s -29%
polyveck_ntt ✅ 5s 4s +25%
polyz_unpack_19_native_aarch64 ✅ 5s 5s +0%
sign_signature ✅ 5s 5s +0%
sign_verify ✅ 5s 6s -17%
sign_verify_extmu ✅ 5s 2s +150%
sign_verify_pre_hash_internal ✅ 5s 5s +0%
caddq ✅ 4s 2s +100%
intt_native_x86_64 ✅ 4s 4s +0%
keccak_f1600_x1_native_aarch64 ✅ 4s 2s +100%
keccak_squeezeblocks_x4 ✅ 4s 4s +0%
keccakf1600_xor_bytes (big endian) ✅ 4s 2s +100%
keccakf1600x4_extract_bytes_native ✅ 4s 1s +300%
keccakf1600x4_permute ✅ 4s 1s +300%
mld_ct_cmask_nonzero_u8 ✅ 4s 2s +100%
mld_prepare_domain_separation_prefix ✅ 4s 4s +0%
nttunpack_native_x86_64 ✅ 4s 3s +33%
pack_sig_z ✅ 4s 1s +300%
pointwise_native_x86_64 ✅ 4s 2s +100%
poly_caddq_native_x86_64 ✅ 4s 1s +300%
poly_chknorm_native_aarch64 ✅ 4s 2s +100%
poly_decompose_32_native_aarch64 ✅ 4s 4s +0%
poly_decompose_88_native_aarch64 ✅ 4s 2s +100%
poly_invntt_tomont_native ✅ 4s 5s -20%
poly_ntt ✅ 4s 2s +100%
poly_pointwise_montgomery ✅ 4s 2s +100%
poly_uniform_4x ✅ 4s 4s +0%
poly_uniform_eta ✅ 4s 5s -20%
polyt1_pack ✅ 4s 3s +33%
polyvecl_pack_eta ✅ 4s 2s +100%
polyvecl_unpack_z ✅ 4s 1s +300%
polyw1_pack_32 ✅ 4s 2s +100%
polyz_unpack_native ✅ 4s 3s +33%
power2round ✅ 4s 2s +100%
rej_uniform_eta_native_aarch64 ✅ 4s 5s -20%
rej_uniform_native_aarch64 ✅ 4s 5s -20%
shake128_init ✅ 4s 6s -33%
shake256 ✅ 4s 2s +100%
sign_signature_extmu ✅ 4s 4s +0%
sk_s2hat_get_poly ✅ 4s 1s +300%
unpack_sk ✅ 4s 3s +33%
fqscale ✅ 3s 3s +0%
keccak_f1600_x4_native_aarch64_v84a ✅ 3s 2s +50%
keccak_f1600_x4_native_aarch64_v8a_scalar_hybrid ✅ 3s 3s +0%
keccak_f1600_x4_native_aarch64_v8a_v84a_scalar_hybrid ✅ 3s 3s +0%
keccak_squeeze ✅ 3s 2s +50%
keccakf1600_extract_bytes (big endian) ✅ 3s 3s +0%
keccakf1600x4_extract_bytes ✅ 3s 4s -25%
keccakf1600x4_xor_bytes ✅ 3s 2s +50%
mld_ct_cmask_neg_i32 ✅ 3s 3s +0%
mld_ct_cmask_nonzero_u32 ✅ 3s 3s +0%
mld_ct_get_optblocker_i64 ✅ 3s 1s +200%
mld_ct_memcmp ✅ 3s 4s -25%
mld_polymat_expand_entry ✅ 3s 3s +0%
mld_value_barrier_u8 ✅ 3s 1s +200%
montgomery_reduce ✅ 3s 1s +200%
pack_sig_c ✅ 3s 3s +0%
pack_sig_h ✅ 3s 2s +50%
poly_caddq_native ✅ 3s 4s -25%
poly_decompose_native ✅ 3s 5s -40%
poly_decompose_native_x86_64 ✅ 3s 2s +50%
poly_permute_bitrev_to_custom_optional ✅ 3s 3s +0%
poly_permute_bitrev_to_custom_optional_native ✅ 3s 3s +0%
poly_uniform_gamma1_4x ✅ 3s 3s +0%
poly_use_hint ✅ 3s 3s +0%
poly_use_hint_native ✅ 3s 7s -57%
polyeta_pack ✅ 3s 1s +200%
polyeta_unpack ✅ 3s 4s -25%
polyt1_unpack ✅ 3s 3s +0%
polyvec_matrix_expand_serial ✅ 3s 3s +0%
polyveck_pack_eta ✅ 3s 3s +0%
polyvecl_pointwise_acc_montgomery ✅ 3s 3s +0%
polyvecl_unpack_eta ✅ 3s 2s +50%
polyw1_pack_88 ✅ 3s 3s +0%
polyz_unpack_17_native_aarch64 ✅ 3s 2s +50%
polyz_unpack_native_x86_64 ✅ 3s 3s +0%
rej_eta_c ✅ 3s 4s -25%
shake128_absorb ✅ 3s 2s +50%
shake128_finalize ✅ 3s 2s +50%
shake128_squeeze ✅ 3s 3s +0%
shake128x4_squeezeblocks ✅ 3s 2s +50%
shake256_absorb ✅ 3s 4s -25%
shake256_init ✅ 3s 4s -25%
shake256_release ✅ 3s 3s +0%
shake256x4_squeezeblocks ✅ 3s 2s +50%
sign_signature_pre_hash_shake256 ✅ 3s 7s -57%
sign_verify_pre_hash_shake256 ✅ 3s 6s -50%
sys_check_capability ✅ 3s 1s +200%
unpack_pk_t1 ✅ 3s 2s +50%
unpack_sk_s1hat ✅ 3s 1s +200%
yvec_get_poly ✅ 3s 3s +0%
intt_native_aarch64 ✅ 2s 2s +0%
keccak_finalize ✅ 2s 2s +0%
keccakf1600_permute ✅ 2s 4s -50%
keccakf1600_permute_native ✅ 2s 2s +0%
keccakf1600_xor_bytes ✅ 2s 4s -50%
make_hint ✅ 2s 3s -33%
mld_ct_get_optblocker_u32 ✅ 2s 3s -33%
mld_ct_get_optblocker_u8 ✅ 2s 4s -50%
mld_keccakf1600_extract_bytes ✅ 2s 2s +0%
mld_sign_resume ✅ 2s - new
mld_value_barrier_u32 ✅ 2s 4s -50%
ntt_native_aarch64 ✅ 2s 3s -33%
pack_sk_rho_key_tr_s2 ✅ 2s 2s +0%
pack_sk_s1 ✅ 2s 3s -33%
pointwise_native_aarch64 ✅ 2s 3s -33%
poly_caddq ✅ 2s 3s -33%
poly_caddq_native_aarch64 ✅ 2s 2s +0%
poly_chknorm ✅ 2s 3s -33%
poly_chknorm_native_x86_64 ✅ 2s 4s -50%
poly_decompose ✅ 2s 2s +0%
poly_ntt_native ✅ 2s 2s +0%
poly_pointwise_montgomery_native ✅ 2s 4s -50%
poly_sub ✅ 2s 4s -50%
poly_uniform_gamma1 ✅ 2s 3s -33%
poly_use_hint_native_aarch64 ✅ 2s 4s -50%
polyt0_pack ✅ 2s 5s -60%
polyvec_matrix_expand ✅ 2s 6s -67%
polyveck_unpack_eta ✅ 2s 3s -33%
polyvecl_pointwise_acc_montgomery_native ✅ 2s 3s -33%
polyvecl_uniform_gamma1 ✅ 2s 4s -50%
polyw1_pack ✅ 2s 3s -33%
polyz_pack ✅ 2s 3s -33%
polyz_unpack ✅ 2s 3s -33%
reduce32 ✅ 2s 2s +0%
rej_eta ✅ 2s 5s -60%
rej_uniform_eta_native_x86_64 ✅ 2s - new
shake128_release ✅ 2s 2s +0%
shake256_finalize ✅ 2s 1s +100%
shake256_squeeze ✅ 2s 4s -50%
shake256x4_absorb_once ✅ 2s 2s +0%
sk_s1hat_get_poly ✅ 2s 3s -33%
sk_t0hat_get_poly ✅ 2s 1s +100%
unpack_sk_s2hat ✅ 2s 3s -33%
use_hint ✅ 2s 2s +0%
yvec_init ✅ 2s 5s -60%
keccak_f1600_x1_native_aarch64_v84a ✅ 1s 2s -50%
keccak_f1600_x4_native_avx2 ✅ 1s 2s -50%
keccak_init ✅ 1s 4s -75%
mld_ct_abs_i32 ✅ 1s 6s -83%
mld_ct_sel_int32 ✅ 1s 2s -50%
mld_keccakf1600x4_xor_bytes_c ✅ 1s 2s -50%
mld_value_barrier_i64 ✅ 1s 2s -50%
poly_invntt_tomont ✅ 1s 5s -80%
poly_shiftl ✅ 1s 3s -67%
poly_use_hint_native_x86_64 ✅ 1s - new
polyvecl_pointwise_acc_montgomery_c ✅ 1s 3s -67%
polyvecl_uniform_gamma1_serial ✅ 1s 1s +0%
shake128x4_absorb_once ✅ 1s 2s -50%
unpack_sk_t0hat ✅ 1s 4s -75%

@oqs-bot

oqs-bot commented Jul 10, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

CBMC Results (ML-DSA-87)

⚠️ Attention Required

Proof Status Current Previous Change
**TOTAL** ⚠️ 3004s 2151s +39.7%
compute_pack_t0_t1 ⚠️ 82s 19s +332%
mld_attempt_signature_generation ⚠️ 348s 55s +533%
sig_unpack_hints ⚠️ 27s 3s +800%
sign_pk_from_sk ⚠️ 41s 6s +583%
sign_signature_internal ⚠️ 149s 42s +255%
sign_verify_internal ⚠️ 507s 97s +423%
Full Results (210 proofs)
Proof Status Current Previous Change
**TOTAL** ⚠️ 3004s 2151s +39.7%
sign_verify_internal ⚠️ 507s 97s +423%
mld_attempt_signature_generation ⚠️ 348s 55s +533%
polyvecl_pointwise_acc_montgomery_c ✅ 342s 353s -3%
polyvec_matrix_expand ✅ 301s 324s -7%
sign_signature_internal ⚠️ 149s 42s +255%
poly_pointwise_montgomery_c ✅ 130s 144s -10%
mld_invntt_layer ✅ 107s 115s -7%
compute_pack_t0_t1 ⚠️ 82s 19s +332%
mld_ntt_layer ✅ 42s 45s -7%
sign_pk_from_sk ⚠️ 41s 6s +583%
fqmul ✅ 40s 43s -7%
polyvec_matrix_expand_serial ✅ 36s 38s -5%
sig_unpack_hints ⚠️ 27s 3s +800%
keccakf1600x4_permute_native ✅ 24s 23s +4%
mld_ntt_butterfly_block ✅ 20s 24s -17%
poly_ntt_c ✅ 19s 21s -10%
polyvec_matrix_pointwise_montgomery_yvec ✅ 18s 18s +0%
sign_keypair_internal ✅ 16s 6s +167%
polyeta_unpack ✅ 15s 17s -12%
polyt0_unpack ✅ 14s 14s +0%
rej_uniform ✅ 14s 15s -7%
rej_uniform_c ✅ 14s 19s -26%
poly_chknorm_c ✅ 13s 15s -13%
poly_uniform_eta_4x ✅ 13s 11s +18%
rej_uniform_native_x86_64 ✅ 13s - new
poly_invntt_tomont_c ✅ 11s 12s -8%
poly_uniform_4x ✅ 11s 13s -15%
polyveck_decompose ✅ 11s 13s -15%
mld_sample_s1_s2_serial ✅ 9s 8s +12%
polyvecl_ntt ✅ 8s 7s +14%
unpack_sk_t0hat ✅ 8s 7s +14%
mld_check_pct ✅ 7s 16s -56%
pointwise_acc_native_x86_64 ✅ 7s 6s +17%
poly_use_hint_c ✅ 7s 2s +250%
polyveck_caddq ✅ 7s 8s -12%
polyveck_ntt ✅ 7s 11s -36%
keccak_absorb_once_x4 ✅ 6s 9s -33%
keccak_finalize ✅ 6s 1s +500%
mld_compute_pack_z ✅ 6s 8s -25%
mld_keccakf1600_permute_c ✅ 6s 7s -14%
mld_sample_s1_s2 ✅ 6s 6s +0%
pointwise_acc_native_aarch64 ✅ 6s 6s +0%
poly_add ✅ 6s 6s +0%
poly_uniform ✅ 6s 4s +50%
polyveck_invntt_tomont ✅ 6s 9s -33%
sign_keypair ✅ 6s 4s +50%
sign_verify_pre_hash_internal ✅ 6s 3s +100%
unpack_sk ✅ 6s 5s +20%
keccak_absorb ✅ 5s 3s +67%
keccak_squeezeblocks_x4 ✅ 5s 4s +25%
mld_h ✅ 5s 3s +67%
mld_value_barrier_u32 ✅ 5s 2s +150%
ntt_native_x86_64 ✅ 5s 2s +150%
pack_sig_c ✅ 5s 4s +25%
poly_pointwise_montgomery ✅ 5s 4s +25%
poly_sub ✅ 5s 3s +67%
polyt1_pack ✅ 5s 3s +67%
polyveck_chknorm ✅ 5s 3s +67%
rej_eta_native ✅ 5s 6s -17%
rej_uniform_eta_native_x86_64 ✅ 5s - new
rej_uniform_native ✅ 5s 8s -38%
shake128_squeeze ✅ 5s 2s +150%
sign_signature ✅ 5s 5s +0%
sign_verify ✅ 5s 5s +0%
sign_verify_extmu ✅ 5s 3s +67%
intt_native_x86_64 ✅ 4s 3s +33%
keccakf1600_extract_bytes (big endian) ✅ 4s 3s +33%
keccakf1600x4_permute ✅ 4s 3s +33%
make_hint ✅ 4s 3s +33%
mld_prepare_domain_separation_prefix ✅ 4s 4s +0%
ntt_native_aarch64 ✅ 4s 6s -33%
pack_sig_z ✅ 4s 5s -20%
pack_sk_rho_key_tr_s2 ✅ 4s 3s +33%
pointwise_native_aarch64 ✅ 4s 5s -20%
poly_challenge ✅ 4s 5s -20%
poly_chknorm_native_x86_64 ✅ 4s 2s +100%
poly_decompose_native ✅ 4s 2s +100%
poly_reduce ✅ 4s 2s +100%
poly_uniform_gamma1_4x ✅ 4s 3s +33%
poly_use_hint_native ✅ 4s 3s +33%
polyvec_matrix_pointwise_montgomery_row ✅ 4s 3s +33%
polyveck_pack_eta ✅ 4s 6s -33%
polyveck_unpack_eta ✅ 4s 4s +0%
polyvecl_chknorm ✅ 4s 7s -43%
polyvecl_pointwise_acc_montgomery_native ✅ 4s 3s +33%
polyvecl_uniform_gamma1 ✅ 4s 2s +100%
polyvecl_unpack_eta ✅ 4s 5s -20%
polyvecl_unpack_z ✅ 4s 4s +0%
polyw1_pack ✅ 4s 4s +0%
polyz_unpack_17_native_aarch64 ✅ 4s 3s +33%
polyz_unpack_c ✅ 4s 3s +33%
power2round ✅ 4s 4s +0%
rej_uniform_native_aarch64 ✅ 4s 2s +100%
shake128_finalize ✅ 4s 2s +100%
shake256_release ✅ 4s 3s +33%
sign_signature_extmu ✅ 4s 4s +0%
sign_signature_pre_hash_internal ✅ 4s 5s -20%
unpack_sk_s1hat ✅ 4s 2s +100%
caddq ✅ 3s 4s -25%
fqscale ✅ 3s 3s +0%
intt_native_aarch64 ✅ 3s 3s +0%
keccak_f1600_x1_native_aarch64_v84a ✅ 3s 1s +200%
keccak_f1600_x4_native_aarch64_v84a ✅ 3s 4s -25%
keccak_f1600_x4_native_aarch64_v8a_v84a_scalar_hybrid ✅ 3s 4s -25%
keccak_f1600_x4_native_avx2 ✅ 3s 2s +50%
keccakf1600_permute ✅ 3s 3s +0%
keccakf1600_permute_native ✅ 3s 4s -25%
keccakf1600x4_extract_bytes_native ✅ 3s 2s +50%
mld_ct_cmask_neg_i32 ✅ 3s 4s -25%
mld_ct_cmask_nonzero_u32 ✅ 3s 2s +50%
mld_ct_cmask_nonzero_u8 ✅ 3s 3s +0%
mld_ct_get_optblocker_i64 ✅ 3s 3s +0%
mld_ct_get_optblocker_u32 ✅ 3s 2s +50%
mld_keccakf1600x4_extract_bytes_c ✅ 3s 2s +50%
mld_keccakf1600x4_xor_bytes_c ✅ 3s 4s -25%
mld_sign_attempt ✅ 3s - new
mld_sign_finish ✅ 3s - new
mld_sign_resume ✅ 3s - new
mld_value_barrier_i64 ✅ 3s 1s +200%
montgomery_reduce ✅ 3s 3s +0%
nttunpack_native_x86_64 ✅ 3s 3s +0%
pack_sig_h ✅ 3s 4s -25%
pack_sk_s1 ✅ 3s 1s +200%
pointwise_native_x86_64 ✅ 3s 2s +50%
poly_caddq ✅ 3s 2s +50%
poly_caddq_c ✅ 3s 3s +0%
poly_caddq_native_x86_64 ✅ 3s 2s +50%
poly_chknorm ✅ 3s 3s +0%
poly_chknorm_native ✅ 3s 4s -25%
poly_chknorm_native_aarch64 ✅ 3s 4s -25%
poly_decompose_c ✅ 3s 5s -40%
poly_invntt_tomont ✅ 3s 1s +200%
poly_ntt_native ✅ 3s 3s +0%
poly_permute_bitrev_to_custom_optional_native ✅ 3s 5s -40%
poly_pointwise_montgomery_native ✅ 3s 5s -40%
poly_shiftl ✅ 3s 4s -25%
poly_uniform_eta ✅ 3s 4s -25%
poly_uniform_gamma1 ✅ 3s 4s -25%
poly_use_hint_native_x86_64 ✅ 3s - new
polyeta_pack ✅ 3s 4s -25%
polyt1_unpack ✅ 3s 4s -25%
polyvecl_pointwise_acc_montgomery ✅ 3s 5s -40%
polyw1_pack_88 ✅ 3s 3s +0%
polyz_pack ✅ 3s 5s -40%
polyz_unpack ✅ 3s 2s +50%
polyz_unpack_19_native_aarch64 ✅ 3s 4s -25%
polyz_unpack_native ✅ 3s 4s -25%
polyz_unpack_native_x86_64 ✅ 3s 3s +0%
rej_eta ✅ 3s 4s -25%
shake128_release ✅ 3s 4s -25%
shake128x4_squeezeblocks ✅ 3s 3s +0%
shake256 ✅ 3s 2s +50%
shake256_finalize ✅ 3s 2s +50%
shake256x4_absorb_once ✅ 3s 2s +50%
sign_signature_pre_hash_shake256 ✅ 3s 6s -50%
sign_verify_pre_hash_shake256 ✅ 3s 3s +0%
sk_s1hat_get_poly ✅ 3s 3s +0%
yvec_get_poly ✅ 3s 4s -25%
decompose ✅ 2s 3s -33%
keccak_f1600_x1_native_aarch64 ✅ 2s 1s +100%
keccak_f1600_x4_native_aarch64_v8a_scalar_hybrid ✅ 2s 3s -33%
keccak_init ✅ 2s 3s -33%
keccak_squeeze ✅ 2s 2s +0%
keccakf1600_xor_bytes ✅ 2s 3s -33%
keccakf1600_xor_bytes (big endian) ✅ 2s 2s +0%
keccakf1600x4_xor_bytes ✅ 2s 3s -33%
mld_ct_abs_i32 ✅ 2s 3s -33%
mld_ct_get_optblocker_u8 ✅ 2s 3s -33%
mld_ct_memcmp ✅ 2s 3s -33%
mld_ct_sel_int32 ✅ 2s 3s -33%
mld_keccakf1600_extract_bytes ✅ 2s 4s -50%
mld_polymat_expand_entry ✅ 2s 3s -33%
mld_value_barrier_u8 ✅ 2s 3s -33%
poly_caddq_native ✅ 2s 4s -50%
poly_caddq_native_aarch64 ✅ 2s 3s -33%
poly_decompose ✅ 2s 3s -33%
poly_decompose_32_native_aarch64 ✅ 2s 5s -60%
poly_decompose_native_x86_64 ✅ 2s 2s +0%
poly_invntt_tomont_native ✅ 2s 5s -60%
poly_ntt ✅ 2s 3s -33%
poly_permute_bitrev_to_custom_optional ✅ 2s 3s -33%
poly_power2round ✅ 2s 3s -33%
poly_use_hint ✅ 2s 1s +100%
poly_use_hint_native_aarch64 ✅ 2s 2s +0%
polyt0_pack ✅ 2s 4s -50%
polyveck_pack_w1 ✅ 2s 3s -33%
polyvecl_pack_eta ✅ 2s 3s -33%
polyvecl_uniform_gamma1_serial ✅ 2s 4s -50%
polyw1_pack_32 ✅ 2s 4s -50%
rej_eta_c ✅ 2s 5s -60%
rej_uniform_eta_native_aarch64 ✅ 2s 5s -60%
shake128_absorb ✅ 2s 4s -50%
shake128_init ✅ 2s 1s +100%
shake256_absorb ✅ 2s 2s +0%
shake256_init ✅ 2s 2s +0%
shake256_squeeze ✅ 2s 2s +0%
shake256x4_squeezeblocks ✅ 2s 1s +100%
sk_t0hat_get_poly ✅ 2s 4s -50%
sys_check_capability ✅ 2s 3s -33%
unpack_pk_t1 ✅ 2s 1s +100%
unpack_sk_s2hat ✅ 2s 3s -33%
use_hint ✅ 2s 3s -33%
yvec_init ✅ 2s 4s -50%
keccakf1600x4_extract_bytes ✅ 1s 2s -50%
keccakf1600x4_xor_bytes_native ✅ 1s 3s -67%
poly_decompose_88_native_aarch64 ✅ 1s 2s -50%
polyveck_reduce ✅ 1s 3s -67%
reduce32 ✅ 1s 3s -67%
shake128x4_absorb_once ✅ 1s 5s -80%
sk_s2hat_get_poly ✅ 1s 3s -67%

@bremoran
bremoran force-pushed the armv81m-keccak-x1 branch 3 times, most recently from a1dde44 to e8a49a1 Compare July 14, 2026 10:42
@bremoran
bremoran force-pushed the armv81m-keccak-x1 branch from d0543bf to c45a108 Compare July 23, 2026 11:03
@bremoran bremoran mentioned this pull request Jul 24, 2026
Closed
@bremoran

bremoran commented Jul 28, 2026

Copy link
Copy Markdown
Contributor Author

Depends on either #1312 or #1318

This was referenced Jul 30, 2026
Open
Closed
Open
Open
Closed
@bremoran
bremoran force-pushed the armv81m-keccak-x1 branch 2 times, most recently from 4f71edb to 1c70ab2 Compare August 3, 2026 12:46
bremoran added 3 commits August 3, 2026 17:16
@bremoran
Test: Run ABI checks as Zephyr applications
7a3f08d 
Build the ABI checker and assembly sources directly with Zephyr's target toolchain. Select the Armv8.1-M checker for M55 and preserve OPT/AUTO through the run stage so the checker is actually executed.

Signed-off-by: Brendan Moran <brendan.moran@arm.com>
@bremoran
Zephyr: Track test configuration in build key
b2101e4 
Include OPT, the selected FIPS202 backend, and configurable test counts in the active build marker so changes to those inputs rebuild stale Zephyr binaries. Track the native assembly amalgamation and its direct development-source include as explicit dependencies, and allow QEMU execution timeouts to be overridden.

Signed-off-by: Brendan Moran <brendan.moran@arm.com>
@bremoran
Test: Preserve build mode when running tests
c4a6ece 
Signed-off-by: Brendan Moran <brendan.moran@arm.com>
@bremoran
bremoran force-pushed the armv81m-keccak-x1 branch from 1c70ab2 to 3ed4031 Compare August 3, 2026 17:03
bremoran added 3 commits August 4, 2026 07:32
@bremoran
Test: Move the ML-DSA-87 workspace out of the Zephyr stack
e5d8997 
The lazy/eager polyvector unit test allocates both ML-DSA-87
representations and their scratch space through MLD_ALLOC. The default
MLD_ALLOC implementation expands to aligned automatic arrays, so this
single test exceeds the Zephyr test thread stack on the Cortex-M55 test
configuration.

Use test-local, aligned static buffers for this workspace. The
TEST_STATIC_ALLOC and TEST_STATIC_FREE helpers are deliberately scoped
to test_unit.c: they preserve cleanup by zeroizing every buffer and
clearing its pointer, without changing the allocator used by production
code or other tests.

Only test/src/test_unit.c changes. The test inputs, comparisons, and
coverage remain the same; this commit changes where its temporary
workspace is stored.

Signed-off-by: Brendan Moran <brendan.moran@arm.com>
@bremoran
Test: Allow fixed byte values in ABI check buffers
4439bd7 
Generated ABI checks normally fill every assembly argument buffer with
random bytes. That is unsuitable for interfaces containing control data.
The Armv8.1-M Keccak x1 permutation consumes 49 round-constant words and
requires the final word to be 0x000000ff as a loop terminator. Leaving
that word random can make the checker read beyond the supplied buffer.

Add an optional test_bytes mapping to buffer entries in the assembly ABI
YAML. scripts/autogen validates that offsets are integers within the
buffer and that values are bytes, sorts the overrides, and emits them
after randombytes initializes the rest of the buffer. Existing ABI
metadata without test_bytes retains its current behaviour.

Document the new metadata in test/abicheck/README.md. The generic
facility is introduced here before its Keccak x1 consumer so the
following backend commit contains only feature-specific metadata and
generated checks.

Signed-off-by: Brendan Moran <brendan.moran@arm.com>
@bremoran
Armv8.1-M: Add a scalar single-state Keccak-f[1600] backend
91039f7 
Add the first of three deliberately separated Cortex-M55 Keccak changes: a known-good scalar baseline derived from the Adomnicai/XKCP Armv7-M implementation. Measurements made while preparing the series showed that the existing Cortex-M7 schedule runs faster on Cortex-M55 than the Cortex-M4 schedule, so this commit establishes the M7-scheduled implementation before later commits introduce an M55 scheduling model and a 64-bit load/store-aware scalar input. The code in this commit is scalar and does not require or use MVE.

Keep the Keccak state in the even/odd bit-interleaved representation across permutations. Native xor and extract hooks convert only the lanes crossing the byte interface, and a private round-constant table supplies the 24 interleaved constants and loop terminator expected by the permutation.

Organize the implementation so its origin and generated form remain reviewable. dev/fips202/armv81m_clean contains only the unscheduled permutation input. dev/fips202/armv81m_opt contains the SLOTHY driver, Makefile, concise development README, C wrapper, scheduled permutation, and separate scalar xor and extract assembly sources. Splitting the helpers gives every assembly file one external entry point and lets the normal loop-label check cover all x1 sources.

Teach scripts/autogen to merge the existing Armv8.1-M and new x1 development directories into the production directory. The retained filename set is derived from both inputs, replacing the hard-coded keep list and ensuring removed or renamed files cannot leave stale output. The helper assembly is simplified and synchronized like other production assembly, so mldsa_native_asm.S includes only files under mldsa/ and no longer reaches into dev/. Zephyr custom builds track all production assembly inputs for reliable rebuilds.

Describe and generate AAPCS32 checks for all three external assembly routines: permutation, xor, and extract. The scalar routines carry no MVE feature requirement. Add focused xor and extract tests for zero length, unaligned starts, 7/8/9-byte lane boundaries, cross-lane ranges, final-lane ranges, and the complete 200-byte state; canary-filled extraction buffers also detect writes beyond the requested length. Existing representation-aware permutation tests continue to compare against the portable reference.

Update the bibliography and license material for the imported XKCP, Adomnicai, and SLOTHY work. Keep the x1 header, constants, sources, generation path, tests, and ABI metadata separate from the established parallel implementation so no x4 source file is changed.

Signed-off-by: Brendan Moran <brendan.moran@arm.com>
@bremoran
bremoran force-pushed the armv81m-keccak-x1 branch from 14b78cc to 91039f7 Compare August 4, 2026 13:56
github-actions[bot]
github-actions Bot reviewed Aug 4, 2026
View reviewed changes

@github-actions github-actions Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Arm Cortex-A76 (Raspberry Pi 5) benchmarks (opt)

Details
Benchmark suite Current: 91039f7 Previous: 27aebe7 Ratio
ML-DSA-44 keypair 112292 cycles 112421 cycles 1.00
ML-DSA-44 sign 353509 cycles 353943 cycles 1.00
ML-DSA-44 verify 117045 cycles 117107 cycles 1.00
ML-DSA-65 keypair 194768 cycles 194811 cycles 1.00
ML-DSA-65 sign 583684 cycles 583921 cycles 1.00
ML-DSA-65 verify 192841 cycles 192856 cycles 1.00
ML-DSA-87 keypair 320755 cycles 321141 cycles 1.00
ML-DSA-87 sign 746990 cycles 747840 cycles 1.00
ML-DSA-87 verify 318459 cycles 318856 cycles 1.00

This comment was automatically generated by workflow using github-action-benchmark.

oqs-bot
oqs-bot reviewed Aug 4, 2026
View reviewed changes

@oqs-bot oqs-bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Graviton4

Details
Benchmark suite Current: 91039f7 Previous: 27aebe7 Ratio
ML-DSA-44 keypair 67170 cycles 67140 cycles 1.00
ML-DSA-44 sign 198275 cycles 198520 cycles 1.00
ML-DSA-44 verify 70187 cycles 70179 cycles 1.00
ML-DSA-65 keypair 119479 cycles 119327 cycles 1.00
ML-DSA-65 sign 326165 cycles 325855 cycles 1.00
ML-DSA-65 verify 116767 cycles 116729 cycles 1.00
ML-DSA-87 keypair 196332 cycles 196421 cycles 1.00
ML-DSA-87 sign 421029 cycles 421793 cycles 1.00
ML-DSA-87 verify 193128 cycles 193311 cycles 1.00

This comment was automatically generated by workflow using github-action-benchmark.

oqs-bot
oqs-bot reviewed Aug 4, 2026
View reviewed changes

@oqs-bot oqs-bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Graviton3

Details
Benchmark suite Current: 91039f7 Previous: 27aebe7 Ratio
ML-DSA-44 keypair 71467 cycles 71566 cycles 1.00
ML-DSA-44 sign 209093 cycles 209190 cycles 1.00
ML-DSA-44 verify 74899 cycles 74886 cycles 1.00
ML-DSA-65 keypair 126082 cycles 125982 cycles 1.00
ML-DSA-65 sign 345255 cycles 345302 cycles 1.00
ML-DSA-65 verify 124183 cycles 124016 cycles 1.00
ML-DSA-87 keypair 206788 cycles 206174 cycles 1.00
ML-DSA-87 sign 443594 cycles 439456 cycles 1.01
ML-DSA-87 verify 204221 cycles 204466 cycles 1.00

This comment was automatically generated by workflow using github-action-benchmark.

github-actions[bot]
github-actions Bot reviewed Aug 4, 2026
View reviewed changes

@github-actions github-actions Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Arm Cortex-A76 (Raspberry Pi 5) benchmarks (no-opt)

Details
Benchmark suite Current: 91039f7 Previous: 27aebe7 Ratio
ML-DSA-44 keypair 212023 cycles 211728 cycles 1.00
ML-DSA-44 sign 760177 cycles 760105 cycles 1.00
ML-DSA-44 verify 229622 cycles 229528 cycles 1.00
ML-DSA-65 keypair 376006 cycles 375776 cycles 1.00
ML-DSA-65 sign 1247772 cycles 1247636 cycles 1.00
ML-DSA-65 verify 372103 cycles 371972 cycles 1.00
ML-DSA-87 keypair 601327 cycles 601076 cycles 1.00
ML-DSA-87 sign 1583437 cycles 1583880 cycles 1.00
ML-DSA-87 verify 617108 cycles 616981 cycles 1.00

This comment was automatically generated by workflow using github-action-benchmark.

oqs-bot
oqs-bot reviewed Aug 4, 2026
View reviewed changes

@oqs-bot oqs-bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Graviton4 (no-opt)

Details
Benchmark suite Current: 91039f7 Previous: 27aebe7 Ratio
ML-DSA-44 keypair 127897 cycles 127841 cycles 1.00
ML-DSA-44 sign 441495 cycles 440929 cycles 1.00
ML-DSA-44 verify 136358 cycles 136340 cycles 1.00
ML-DSA-65 keypair 221663 cycles 221539 cycles 1.00
ML-DSA-65 sign 714078 cycles 713985 cycles 1.00
ML-DSA-65 verify 220580 cycles 220544 cycles 1.00
ML-DSA-87 keypair 365287 cycles 364498 cycles 1.00
ML-DSA-87 sign 916065 cycles 915431 cycles 1.00
ML-DSA-87 verify 370911 cycles 371022 cycles 1.00

This comment was automatically generated by workflow using github-action-benchmark.

oqs-bot
oqs-bot reviewed Aug 4, 2026
View reviewed changes

@oqs-bot oqs-bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Graviton3 (no-opt)

Details
Benchmark suite Current: 91039f7 Previous: 27aebe7 Ratio
ML-DSA-44 keypair 138441 cycles 138205 cycles 1.00
ML-DSA-44 sign 486106 cycles 485764 cycles 1.00
ML-DSA-44 verify 149269 cycles 149259 cycles 1.00
ML-DSA-65 keypair 242153 cycles 241613 cycles 1.00
ML-DSA-65 sign 791700 cycles 791618 cycles 1.00
ML-DSA-65 verify 241534 cycles 241503 cycles 1.00
ML-DSA-87 keypair 396162 cycles 395195 cycles 1.00
ML-DSA-87 sign 1013608 cycles 1014135 cycles 1.00
ML-DSA-87 verify 403785 cycles 404031 cycles 1.00

This comment was automatically generated by workflow using github-action-benchmark.

oqs-bot
oqs-bot reviewed Aug 4, 2026
View reviewed changes

@oqs-bot oqs-bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Intel Xeon 4th gen (c7i)

Details
Benchmark suite Current: 91039f7 Previous: 27aebe7 Ratio
ML-DSA-44 keypair 43290 cycles 43407 cycles 1.00
ML-DSA-44 sign 130107 cycles 130440 cycles 1.00
ML-DSA-44 verify 45233 cycles 45231 cycles 1.00
ML-DSA-65 keypair 75800 cycles 75611 cycles 1.00
ML-DSA-65 sign 213743 cycles 213750 cycles 1.00
ML-DSA-65 verify 74411 cycles 74462 cycles 1.00
ML-DSA-87 keypair 122926 cycles 122917 cycles 1.00
ML-DSA-87 sign 270981 cycles 271210 cycles 1.00
ML-DSA-87 verify 120778 cycles 120613 cycles 1.00

This comment was automatically generated by workflow using github-action-benchmark.

oqs-bot
oqs-bot reviewed Aug 4, 2026
View reviewed changes

@oqs-bot oqs-bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

AMD EPYC 4th gen (c7a)

Details
Benchmark suite Current: 91039f7 Previous: 27aebe7 Ratio
ML-DSA-44 keypair 46735 cycles 46709 cycles 1.00
ML-DSA-44 sign 139947 cycles 139435 cycles 1.00
ML-DSA-44 verify 49469 cycles 49461 cycles 1.00
ML-DSA-65 keypair 82621 cycles 81967 cycles 1.01
ML-DSA-65 sign 227154 cycles 226735 cycles 1.00
ML-DSA-65 verify 81978 cycles 82665 cycles 0.99
ML-DSA-87 keypair 130551 cycles 129492 cycles 1.01
ML-DSA-87 sign 279924 cycles 280340 cycles 1.00
ML-DSA-87 verify 128506 cycles 128405 cycles 1.00

This comment was automatically generated by workflow using github-action-benchmark.

oqs-bot
oqs-bot reviewed Aug 4, 2026
View reviewed changes

@oqs-bot oqs-bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Intel Xeon 4th gen (c7i) (no-opt)

Details
Benchmark suite Current: 91039f7 Previous: 27aebe7 Ratio
ML-DSA-44 keypair 91704 cycles 91774 cycles 1.00
ML-DSA-44 sign 351502 cycles 351709 cycles 1.00
ML-DSA-44 verify 99387 cycles 99709 cycles 1.00
ML-DSA-65 keypair 154237 cycles 154289 cycles 1.00
ML-DSA-65 sign 571927 cycles 570738 cycles 1.00
ML-DSA-65 verify 160351 cycles 160181 cycles 1.00
ML-DSA-87 keypair 255233 cycles 255166 cycles 1.00
ML-DSA-87 sign 720046 cycles 720821 cycles 1.00
ML-DSA-87 verify 264335 cycles 263865 cycles 1.00

This comment was automatically generated by workflow using github-action-benchmark.

oqs-bot
oqs-bot reviewed Aug 4, 2026
View reviewed changes

@oqs-bot oqs-bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Graviton2

Details
Benchmark suite Current: 91039f7 Previous: 27aebe7 Ratio
ML-DSA-44 keypair 112198 cycles 112399 cycles 1.00
ML-DSA-44 sign 353753 cycles 353820 cycles 1.00
ML-DSA-44 verify 117415 cycles 117171 cycles 1.00
ML-DSA-65 keypair 194605 cycles 194786 cycles 1.00
ML-DSA-65 sign 584072 cycles 584013 cycles 1.00
ML-DSA-65 verify 193382 cycles 193015 cycles 1.00
ML-DSA-87 keypair 320883 cycles 320852 cycles 1.00
ML-DSA-87 sign 747307 cycles 747201 cycles 1.00
ML-DSA-87 verify 318179 cycles 318645 cycles 1.00

This comment was automatically generated by workflow using github-action-benchmark.

oqs-bot
oqs-bot reviewed Aug 4, 2026
View reviewed changes

@oqs-bot oqs-bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

AMD EPYC 3rd gen (c6a)

Details
Benchmark suite Current: 91039f7 Previous: 27aebe7 Ratio
ML-DSA-44 keypair 52008 cycles 51879 cycles 1.00
ML-DSA-44 sign 154462 cycles 155064 cycles 1.00
ML-DSA-44 verify 54166 cycles 54259 cycles 1.00
ML-DSA-65 keypair 89427 cycles 89685 cycles 1.00
ML-DSA-65 sign 253071 cycles 254754 cycles 0.99
ML-DSA-65 verify 89176 cycles 89439 cycles 1.00
ML-DSA-87 keypair 143367 cycles 142352 cycles 1.01
ML-DSA-87 sign 310438 cycles 311341 cycles 1.00
ML-DSA-87 verify 138807 cycles 139359 cycles 1.00

This comment was automatically generated by workflow using github-action-benchmark.

oqs-bot
oqs-bot reviewed Aug 4, 2026
View reviewed changes

@oqs-bot oqs-bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

AMD EPYC 4th gen (c7a) (no-opt)

Details
Benchmark suite Current: 91039f7 Previous: 27aebe7 Ratio
ML-DSA-44 keypair 118639 cycles 118234 cycles 1.00
ML-DSA-44 sign 458559 cycles 458712 cycles 1.00
ML-DSA-44 verify 130837 cycles 131121 cycles 1.00
ML-DSA-65 keypair 201470 cycles 200822 cycles 1.00
ML-DSA-65 sign 743521 cycles 747583 cycles 0.99
ML-DSA-65 verify 209873 cycles 209481 cycles 1.00
ML-DSA-87 keypair 331170 cycles 332858 cycles 0.99
ML-DSA-87 sign 935608 cycles 936652 cycles 1.00
ML-DSA-87 verify 343114 cycles 343994 cycles 1.00

This comment was automatically generated by workflow using github-action-benchmark.

oqs-bot
oqs-bot reviewed Aug 4, 2026
View reviewed changes

@oqs-bot oqs-bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

AMD EPYC 3rd gen (c6a) (no-opt)

Details
Benchmark suite Current: 91039f7 Previous: 27aebe7 Ratio
ML-DSA-44 keypair 133187 cycles 134282 cycles 0.99
ML-DSA-44 sign 518022 cycles 520818 cycles 0.99
ML-DSA-44 verify 146634 cycles 147777 cycles 0.99
ML-DSA-65 keypair 224332 cycles 224694 cycles 1.00
ML-DSA-65 sign 843960 cycles 843127 cycles 1.00
ML-DSA-65 verify 234144 cycles 233924 cycles 1.00
ML-DSA-87 keypair 367057 cycles 367125 cycles 1.00
ML-DSA-87 sign 1058600 cycles 1057892 cycles 1.00
ML-DSA-87 verify 380447 cycles 380252 cycles 1.00

This comment was automatically generated by workflow using github-action-benchmark.

oqs-bot
oqs-bot reviewed Aug 4, 2026
View reviewed changes

@oqs-bot oqs-bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Graviton2 (no-opt)

Details
Benchmark suite Current: 91039f7 Previous: 27aebe7 Ratio
ML-DSA-44 keypair 212129 cycles 212335 cycles 1.00
ML-DSA-44 sign 760693 cycles 761210 cycles 1.00
ML-DSA-44 verify 229484 cycles 229974 cycles 1.00
ML-DSA-65 keypair 375440 cycles 376324 cycles 1.00
ML-DSA-65 sign 1248106 cycles 1248564 cycles 1.00
ML-DSA-65 verify 371579 cycles 372377 cycles 1.00
ML-DSA-87 keypair 600041 cycles 601386 cycles 1.00
ML-DSA-87 sign 1586041 cycles 1607791 cycles 0.99
ML-DSA-87 verify 615917 cycles 617602 cycles 1.00

This comment was automatically generated by workflow using github-action-benchmark.

oqs-bot
oqs-bot reviewed Aug 4, 2026
View reviewed changes

@oqs-bot oqs-bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Intel Xeon 3rd gen (c6i)

Details
Benchmark suite Current: 91039f7 Previous: 27aebe7 Ratio
ML-DSA-44 keypair 61706 cycles 61819 cycles 1.00
ML-DSA-44 sign 187966 cycles 188851 cycles 1.00
ML-DSA-44 verify 66228 cycles 66399 cycles 1.00
ML-DSA-65 keypair 109427 cycles 110427 cycles 0.99
ML-DSA-65 sign 311800 cycles 313769 cycles 0.99
ML-DSA-65 verify 109443 cycles 111323 cycles 0.98
ML-DSA-87 keypair 170673 cycles 173116 cycles 0.99
ML-DSA-87 sign 379405 cycles 385429 cycles 0.98
ML-DSA-87 verify 170627 cycles 174422 cycles 0.98

This comment was automatically generated by workflow using github-action-benchmark.

oqs-bot
oqs-bot reviewed Aug 4, 2026
View reviewed changes

@oqs-bot oqs-bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Intel Xeon 3rd gen (c6i) (no-opt)

Details
Benchmark suite Current: 91039f7 Previous: 27aebe7 Ratio
ML-DSA-44 keypair 154055 cycles 154452 cycles 1.00
ML-DSA-44 sign 587101 cycles 588162 cycles 1.00
ML-DSA-44 verify 169059 cycles 168998 cycles 1.00
ML-DSA-65 keypair 261730 cycles 262562 cycles 1.00
ML-DSA-65 sign 964081 cycles 965903 cycles 1.00
ML-DSA-65 verify 271336 cycles 272372 cycles 1.00
ML-DSA-87 keypair 431609 cycles 431929 cycles 1.00
ML-DSA-87 sign 1212961 cycles 1211899 cycles 1.00
ML-DSA-87 verify 447991 cycles 447459 cycles 1.00

This comment was automatically generated by workflow using github-action-benchmark.

github-actions[bot]
github-actions Bot reviewed Aug 4, 2026
View reviewed changes

@github-actions github-actions Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Arm Cortex-M55 (NUCLEO-N657X0-Q) benchmarks (opt)

Details
Benchmark suite Current: 91039f7 Previous: 27aebe7 Ratio
ML-DSA-44 keypair 1690331 cycles 2328440 cycles 0.73
ML-DSA-44 sign 13600033 cycles 17851737 cycles 0.76
ML-DSA-44 verify 1806518 cycles 2398876 cycles 0.75
ML-DSA-65 keypair 2895358 cycles 4025122 cycles 0.72
ML-DSA-65 sign 11228232 cycles 14793522 cycles 0.76
ML-DSA-65 verify 2973684 cycles 4012792 cycles 0.74
ML-DSA-87 keypair 4888795 cycles 6864887 cycles 0.71
ML-DSA-87 sign 18455928 cycles 24785157 cycles 0.74
ML-DSA-87 verify 5009804 cycles 6864412 cycles 0.73

This comment was automatically generated by workflow using github-action-benchmark.

github-actions[bot]
github-actions Bot reviewed Aug 4, 2026
View reviewed changes

@github-actions github-actions Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Arm Cortex-M55 (NUCLEO-N657X0-Q) benchmarks (no-opt)

Details
Benchmark suite Current: 91039f7 Previous: 27aebe7 Ratio
ML-DSA-44 keypair 2328440 cycles 2328440 cycles 1
ML-DSA-44 sign 17851737 cycles 17851737 cycles 1
ML-DSA-44 verify 2398876 cycles 2398876 cycles 1
ML-DSA-65 keypair 4025122 cycles 4025122 cycles 1
ML-DSA-65 sign 14793522 cycles 14793522 cycles 1
ML-DSA-65 verify 4012792 cycles 4012792 cycles 1
ML-DSA-87 keypair 6864887 cycles 6864887 cycles 1
ML-DSA-87 sign 24785157 cycles 24785157 cycles 1
ML-DSA-87 verify 6864412 cycles 6864412 cycles 1

This comment was automatically generated by workflow using github-action-benchmark.

github-actions[bot]
github-actions Bot reviewed Aug 4, 2026
View reviewed changes

@github-actions github-actions Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Arm Cortex-A55 (Snapdragon 888) benchmarks (opt)

Details
Benchmark suite Current: 91039f7 Previous: 27aebe7 Ratio
ML-DSA-44 keypair 272258 cycles 271067 cycles 1.00
ML-DSA-44 sign 811182 cycles 812320 cycles 1.00
ML-DSA-44 verify 273722 cycles 273045 cycles 1.00
ML-DSA-65 keypair 467921 cycles 467726 cycles 1.00
ML-DSA-65 sign 1374610 cycles 1341160 cycles 1.02
ML-DSA-65 verify 452328 cycles 454368 cycles 1.00
ML-DSA-87 keypair 794593 cycles 803830 cycles 0.99
ML-DSA-87 sign 1852551 cycles 1831323 cycles 1.01
ML-DSA-87 verify 781142 cycles 778295 cycles 1.00

This comment was automatically generated by workflow using github-action-benchmark.

@bremoran bremoran mentioned this pull request Aug 4, 2026
Open
github-actions[bot]
github-actions Bot reviewed Aug 4, 2026
View reviewed changes

@github-actions github-actions Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Arm Cortex-A55 (Snapdragon 888) benchmarks (no-opt)

Details
Benchmark suite Current: 91039f7 Previous: 27aebe7 Ratio
ML-DSA-44 keypair 465428 cycles 465494 cycles 1.00
ML-DSA-44 sign 2134682 cycles 2144256 cycles 1.00
ML-DSA-44 verify 556859 cycles 559936 cycles 0.99
ML-DSA-65 keypair 784546 cycles 783372 cycles 1.00
ML-DSA-65 sign 3502813 cycles 3496274 cycles 1.00
ML-DSA-65 verify 867806 cycles 869188 cycles 1.00
ML-DSA-87 keypair 1265637 cycles 1266792 cycles 1.00
ML-DSA-87 sign 4348278 cycles 4317269 cycles 1.01
ML-DSA-87 verify 1387880 cycles 1394437 cycles 1.00

This comment was automatically generated by workflow using github-action-benchmark.

github-actions[bot]
github-actions Bot reviewed Aug 4, 2026
View reviewed changes

@github-actions github-actions Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Arm Cortex-A72 (Raspberry Pi 4) benchmarks (opt)

Details
Benchmark suite Current: 91039f7 Previous: 27aebe7 Ratio
ML-DSA-44 keypair 218060 cycles 216344 cycles 1.01
ML-DSA-44 sign 597336 cycles 593807 cycles 1.01
ML-DSA-44 verify 217728 cycles 216553 cycles 1.01
ML-DSA-65 keypair 380946 cycles 378995 cycles 1.01
ML-DSA-65 sign 983605 cycles 982529 cycles 1.00
ML-DSA-65 verify 363319 cycles 363919 cycles 1.00
ML-DSA-87 keypair 636094 cycles 636641 cycles 1.00
ML-DSA-87 sign 1312206 cycles 1318452 cycles 1.00
ML-DSA-87 verify 617779 cycles 619777 cycles 1.00

This comment was automatically generated by workflow using github-action-benchmark.

github-actions[bot]
github-actions Bot reviewed Aug 4, 2026
View reviewed changes

@github-actions github-actions Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Arm Cortex-A72 (Raspberry Pi 4) benchmarks (no-opt)

Details
Benchmark suite Current: 91039f7 Previous: 27aebe7 Ratio
ML-DSA-44 keypair 301299 cycles 301210 cycles 1.00
ML-DSA-44 sign 1140771 cycles 1141652 cycles 1.00
ML-DSA-44 verify 333412 cycles 330898 cycles 1.01
ML-DSA-65 keypair 550692 cycles 543839 cycles 1.01
ML-DSA-65 sign 1876845 cycles 1856990 cycles 1.01
ML-DSA-65 verify 533547 cycles 525059 cycles 1.02
ML-DSA-87 keypair 845041 cycles 846962 cycles 1.00
ML-DSA-87 sign 2351108 cycles 2362668 cycles 1.00
ML-DSA-87 verify 874370 cycles 876584 cycles 1.00

This comment was automatically generated by workflow using github-action-benchmark.

github-actions[bot]
github-actions Bot reviewed Aug 4, 2026
View reviewed changes

@github-actions github-actions Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

SpacemiT K1 8 (Banana Pi F3) benchmarks (no-opt)

Details
Benchmark suite Current: 91039f7 Previous: 27aebe7 Ratio
ML-DSA-44 keypair 760366 cycles 760367 cycles 1.00
ML-DSA-44 sign 3142358 cycles 3140398 cycles 1.00
ML-DSA-44 verify 859639 cycles 859497 cycles 1.00
ML-DSA-65 keypair 1287922 cycles 1289584 cycles 1.00
ML-DSA-65 sign 5081104 cycles 5091406 cycles 1.00
ML-DSA-65 verify 1367411 cycles 1368454 cycles 1.00
ML-DSA-87 keypair 2109891 cycles 2109786 cycles 1.00
ML-DSA-87 sign 6360762 cycles 6373090 cycles 1.00
ML-DSA-87 verify 2224537 cycles 2226888 cycles 1.00

This comment was automatically generated by workflow using github-action-benchmark.

@bremoran
Armv8.1-M: preserve Keccak metadata through SLOTHY
962c9f9 
Make the clean M7 Keccak source self-contained so SLOTHY retains its ABI metadata and integration guards during regeneration.

Signed-off-by: Brendan Moran <brendan.moran@arm.com>
@bremoran

bremoran commented Aug 5, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor Author

Added metadata YAML to the input source file so that slothy will preserve it and autogen will pass. This is a comment-only change and benchmarks do not need to be re-run.

@bremoran bremoran mentioned this pull request Aug 5, 2026
Open
@bremoran
bremoran marked this pull request as ready for review August 6, 2026 08:14
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@github-actions github-actions[bot] github-actions[bot] left review comments
@oqs-bot oqs-bot oqs-bot left review comments
@hanno-becker hanno-becker Awaiting requested review from hanno-becker
@mkannwischer mkannwischer Awaiting requested review from mkannwischer

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Armv8.1-M: add regular and SLOTHY-optimized Armv7-M Keccak x1

2 participants

@bremoran @oqs-bot