[TEST] sign: Keep w1 in packed form during signature generation

[mkannwischer]

The signing attempt held w1 as a full mld_polyveck, but w1 is only needed as the w1Encode input to H and, coefficient-wise, as the a1 argument of MakeHint. Both work from the packed encoding, so Decompose and w1Encode now run one polynomial at a time into a MLDSA_K * MLDSA_POLYW1_PACKEDBYTES buffer, and mld_pack_sig_h recovers each row with the new mld_polyw1_unpack.

With w1 gone, the matrix-vector scratch is the sole remaining user of the buffer the two shared. In REDUCE_RAM mode that scratch is a single polynomial rather than a polyvecl, and it now shares storage with z, so the buffer disappears.

Signing allocation in bytes:

	default	REDUCE_RAM
ML-DSA-44	44704 -> 44448	13120 -> 9792
ML-DSA-65	69312 -> 68032	17248 -> 11872
ML-DSA-87	108224 -> 107200	21344 -> 14176

mld_polyveck_decompose and mld_polyveck_pack_w1 have no other callers and are replaced by the fused mld_polyveck_decompose_pack_w1.

[github-actions]

Mac Mini (M1, 2020) benchmarks (opt)

Details

Benchmark suite	Current: 5d4def8	Previous: 7851260	Ratio
ML-DSA-44 keypair	46499 cycles	46693 cycles	1.00
ML-DSA-44 sign	131422 cycles	131639 cycles	1.00
ML-DSA-44 verify	47330 cycles	47512 cycles	1.00
ML-DSA-65 keypair	81677 cycles	82139 cycles	0.99
ML-DSA-65 sign	215318 cycles	216693 cycles	0.99
ML-DSA-65 verify	79307 cycles	79749 cycles	0.99
ML-DSA-87 keypair	132460 cycles	132410 cycles	1.00
ML-DSA-87 sign	277573 cycles	277436 cycles	1.00
ML-DSA-87 verify	133609 cycles	133557 cycles	1.00

This comment was automatically generated by workflow using github-action-benchmark.

[github-actions]

Mac Mini (M1, 2020) benchmarks (no-opt)

Details

Benchmark suite	Current: 5d4def8	Previous: 7851260	Ratio
ML-DSA-44 keypair	113041 cycles	112719 cycles	1.00
ML-DSA-44 sign	403582 cycles	401054 cycles	1.01
ML-DSA-44 verify	119649 cycles	119337 cycles	1.00
ML-DSA-65 keypair	193797 cycles	192910 cycles	1.00
ML-DSA-65 sign	651522 cycles	649886 cycles	1.00
ML-DSA-65 verify	192968 cycles	193003 cycles	1.00
ML-DSA-87 keypair	318881 cycles	318938 cycles	1.00
ML-DSA-87 sign	831201 cycles	828901 cycles	1.00
ML-DSA-87 verify	321851 cycles	321792 cycles	1.00

This comment was automatically generated by workflow using github-action-benchmark.

[oqs-bot]

AMD EPYC 3rd gen (c6a)

Details

Benchmark suite	Current: 5d4def8	Previous: 7851260	Ratio
ML-DSA-44 keypair	51992 cycles	52024 cycles	1.00
ML-DSA-44 sign	156912 cycles	155466 cycles	1.01
ML-DSA-44 verify	54278 cycles	54360 cycles	1.00
ML-DSA-65 keypair	89436 cycles	89551 cycles	1.00
ML-DSA-65 sign	253046 cycles	253989 cycles	1.00
ML-DSA-65 verify	89333 cycles	89083 cycles	1.00
ML-DSA-87 keypair	142176 cycles	143154 cycles	0.99
ML-DSA-87 sign	310131 cycles	312610 cycles	0.99
ML-DSA-87 verify	138978 cycles	140028 cycles	0.99

This comment was automatically generated by workflow using github-action-benchmark.

[oqs-bot]

Graviton5

Details

Benchmark suite	Current: 5d4def8	Previous: 7851260	Ratio
ML-DSA-44 keypair	51531 cycles	51548 cycles	1.00
ML-DSA-44 sign	162157 cycles	162106 cycles	1.00
ML-DSA-44 verify	54767 cycles	54690 cycles	1.00
ML-DSA-65 keypair	90115 cycles	90141 cycles	1.00
ML-DSA-65 sign	266058 cycles	267359 cycles	1.00
ML-DSA-65 verify	89751 cycles	89806 cycles	1.00
ML-DSA-87 keypair	145895 cycles	145936 cycles	1.00
ML-DSA-87 sign	334652 cycles	336077 cycles	1.00
ML-DSA-87 verify	144986 cycles	145423 cycles	1.00

This comment was automatically generated by workflow using github-action-benchmark.

[oqs-bot]

AMD EPYC 4th gen (c7a)

Details

Benchmark suite	Current: 5d4def8	Previous: 7851260	Ratio
ML-DSA-44 keypair	47015 cycles	47187 cycles	1.00
ML-DSA-44 sign	139350 cycles	139486 cycles	1.00
ML-DSA-44 verify	49313 cycles	49375 cycles	1.00
ML-DSA-65 keypair	82024 cycles	81987 cycles	1.00
ML-DSA-65 sign	226868 cycles	226201 cycles	1.00
ML-DSA-65 verify	82176 cycles	81854 cycles	1.00
ML-DSA-87 keypair	129457 cycles	129501 cycles	1.00
ML-DSA-87 sign	281321 cycles	280015 cycles	1.00
ML-DSA-87 verify	129129 cycles	128702 cycles	1.00

This comment was automatically generated by workflow using github-action-benchmark.

[github-actions]

Arm Cortex-A76 (Raspberry Pi 5) benchmarks (opt)

Details

Benchmark suite	Current: 5d4def8	Previous: 054cbd9	Ratio
ML-DSA-44 keypair	112264 cycles	112330 cycles	1.00
ML-DSA-44 sign	354127 cycles	353551 cycles	1.00
ML-DSA-44 verify	117167 cycles	117062 cycles	1.00
ML-DSA-65 keypair	194664 cycles	194722 cycles	1.00
ML-DSA-65 sign	583414 cycles	583744 cycles	1.00
ML-DSA-65 verify	193029 cycles	192815 cycles	1.00
ML-DSA-87 keypair	321121 cycles	320714 cycles	1.00
ML-DSA-87 sign	748068 cycles	747066 cycles	1.00
ML-DSA-87 verify	318551 cycles	318491 cycles	1.00

This comment was automatically generated by workflow using github-action-benchmark.

[oqs-bot]

Graviton5 (no-opt)

Details

Benchmark suite	Current: 5d4def8	Previous: 7851260	Ratio
ML-DSA-44 keypair	100120 cycles	99901 cycles	1.00
ML-DSA-44 sign	369041 cycles	368991 cycles	1.00
ML-DSA-44 verify	110325 cycles	110046 cycles	1.00
ML-DSA-65 keypair	175728 cycles	175343 cycles	1.00
ML-DSA-65 sign	596071 cycles	596955 cycles	1.00
ML-DSA-65 verify	177190 cycles	177450 cycles	1.00
ML-DSA-87 keypair	285818 cycles	286772 cycles	1.00
ML-DSA-87 sign	756579 cycles	757666 cycles	1.00
ML-DSA-87 verify	296564 cycles	295759 cycles	1.00

This comment was automatically generated by workflow using github-action-benchmark.

[oqs-bot]

AMD EPYC 3rd gen (c6a) (no-opt)

Details

Benchmark suite	Current: 5d4def8	Previous: 7851260	Ratio
ML-DSA-44 keypair	133305 cycles	133062 cycles	1.00
ML-DSA-44 sign	520085 cycles	518046 cycles	1.00
ML-DSA-44 verify	146409 cycles	146758 cycles	1.00
ML-DSA-65 keypair	225051 cycles	224764 cycles	1.00
ML-DSA-65 sign	851592 cycles	844924 cycles	1.01
ML-DSA-65 verify	235552 cycles	234589 cycles	1.00
ML-DSA-87 keypair	367491 cycles	368287 cycles	1.00
ML-DSA-87 sign	1063877 cycles	1062237 cycles	1.00
ML-DSA-87 verify	381119 cycles	382393 cycles	1.00

This comment was automatically generated by workflow using github-action-benchmark.

[oqs-bot]

Intel Xeon 4th gen (c7i)

Details

Benchmark suite	Current: 5d4def8	Previous: 7851260	Ratio
ML-DSA-44 keypair	43262 cycles	43280 cycles	1.00
ML-DSA-44 sign	130031 cycles	130363 cycles	1.00
ML-DSA-44 verify	45205 cycles	45207 cycles	1.00
ML-DSA-65 keypair	76253 cycles	75602 cycles	1.01
ML-DSA-65 sign	213649 cycles	213745 cycles	1.00
ML-DSA-65 verify	74412 cycles	74499 cycles	1.00
ML-DSA-87 keypair	122977 cycles	122953 cycles	1.00
ML-DSA-87 sign	270651 cycles	271264 cycles	1.00
ML-DSA-87 verify	120626 cycles	120625 cycles	1.00

This comment was automatically generated by workflow using github-action-benchmark.

[oqs-bot]

Intel Xeon 3rd gen (c6i)

Details

Benchmark suite	Current: 5d4def8	Previous: 7851260	Ratio
ML-DSA-44 keypair	61866 cycles	61551 cycles	1.01
ML-DSA-44 sign	189032 cycles	187830 cycles	1.01
ML-DSA-44 verify	66403 cycles	65936 cycles	1.01
ML-DSA-65 keypair	110865 cycles	109602 cycles	1.01
ML-DSA-65 sign	315673 cycles	312017 cycles	1.01
ML-DSA-65 verify	110386 cycles	110468 cycles	1.00
ML-DSA-87 keypair	170638 cycles	170364 cycles	1.00
ML-DSA-87 sign	380537 cycles	379739 cycles	1.00
ML-DSA-87 verify	171021 cycles	171438 cycles	1.00

This comment was automatically generated by workflow using github-action-benchmark.

[oqs-bot]

AMD EPYC 4th gen (c7a) (no-opt)

Details

Benchmark suite	Current: 5d4def8	Previous: 7851260	Ratio
ML-DSA-44 keypair	118279 cycles	118530 cycles	1.00
ML-DSA-44 sign	456205 cycles	461161 cycles	0.99
ML-DSA-44 verify	130727 cycles	131315 cycles	1.00
ML-DSA-65 keypair	202035 cycles	201098 cycles	1.00
ML-DSA-65 sign	739962 cycles	749188 cycles	0.99
ML-DSA-65 verify	209288 cycles	210745 cycles	0.99
ML-DSA-87 keypair	331683 cycles	330323 cycles	1.00
ML-DSA-87 sign	949179 cycles	936042 cycles	1.01
ML-DSA-87 verify	344442 cycles	343086 cycles	1.00

This comment was automatically generated by workflow using github-action-benchmark.

[oqs-bot]

Graviton4

Details

Benchmark suite	Current: 5d4def8	Previous: 7851260	Ratio
ML-DSA-44 keypair	67394 cycles	67420 cycles	1.00
ML-DSA-44 sign	198887 cycles	198371 cycles	1.00
ML-DSA-44 verify	70234 cycles	70138 cycles	1.00
ML-DSA-65 keypair	119319 cycles	119364 cycles	1.00
ML-DSA-65 sign	325570 cycles	325865 cycles	1.00
ML-DSA-65 verify	116764 cycles	116672 cycles	1.00
ML-DSA-87 keypair	196104 cycles	196322 cycles	1.00
ML-DSA-87 sign	421279 cycles	421757 cycles	1.00
ML-DSA-87 verify	193124 cycles	193271 cycles	1.00

This comment was automatically generated by workflow using github-action-benchmark.

[oqs-bot]

Intel Xeon 4th gen (c7i) (no-opt)

Details

Benchmark suite	Current: 5d4def8	Previous: 7851260	Ratio
ML-DSA-44 keypair	92073 cycles	91747 cycles	1.00
ML-DSA-44 sign	348906 cycles	351522 cycles	0.99
ML-DSA-44 verify	99722 cycles	99477 cycles	1.00
ML-DSA-65 keypair	154705 cycles	154194 cycles	1.00
ML-DSA-65 sign	567740 cycles	570514 cycles	1.00
ML-DSA-65 verify	160150 cycles	159873 cycles	1.00
ML-DSA-87 keypair	255566 cycles	255155 cycles	1.00
ML-DSA-87 sign	725121 cycles	721323 cycles	1.01
ML-DSA-87 verify	264110 cycles	264456 cycles	1.00

This comment was automatically generated by workflow using github-action-benchmark.

[oqs-bot]

Intel Xeon 3rd gen (c6i) (no-opt)

Details

Benchmark suite	Current: 5d4def8	Previous: 7851260	Ratio
ML-DSA-44 keypair	154335 cycles	158422 cycles	0.97
ML-DSA-44 sign	590593 cycles	601014 cycles	0.98
ML-DSA-44 verify	169673 cycles	172894 cycles	0.98
ML-DSA-65 keypair	262410 cycles	264399 cycles	0.99
ML-DSA-65 sign	958273 cycles	968865 cycles	0.99
ML-DSA-65 verify	271961 cycles	273964 cycles	0.99
ML-DSA-87 keypair	431560 cycles	431365 cycles	1.00
ML-DSA-87 sign	1216608 cycles	1212110 cycles	1.00
ML-DSA-87 verify	447494 cycles	447223 cycles	1.00

This comment was automatically generated by workflow using github-action-benchmark.

[github-actions]

Arm Cortex-A76 (Raspberry Pi 5) benchmarks (no-opt)

Details

Benchmark suite	Current: 5d4def8	Previous: 054cbd9	Ratio
ML-DSA-44 keypair	211726 cycles	211728 cycles	1.00
ML-DSA-44 sign	760199 cycles	760109 cycles	1.00
ML-DSA-44 verify	229468 cycles	229502 cycles	1.00
ML-DSA-65 keypair	376009 cycles	376008 cycles	1.00
ML-DSA-65 sign	1244841 cycles	1247901 cycles	1.00
ML-DSA-65 verify	371742 cycles	372060 cycles	1.00
ML-DSA-87 keypair	601802 cycles	601421 cycles	1.00
ML-DSA-87 sign	1584132 cycles	1584160 cycles	1.00
ML-DSA-87 verify	617412 cycles	617191 cycles	1.00

This comment was automatically generated by workflow using github-action-benchmark.

[oqs-bot]

Graviton4 (no-opt)

Details

Benchmark suite	Current: 5d4def8	Previous: 7851260	Ratio
ML-DSA-44 keypair	127901 cycles	127813 cycles	1.00
ML-DSA-44 sign	441463 cycles	441084 cycles	1.00
ML-DSA-44 verify	136454 cycles	136359 cycles	1.00
ML-DSA-65 keypair	222974 cycles	221541 cycles	1.01
ML-DSA-65 sign	714072 cycles	714023 cycles	1.00
ML-DSA-65 verify	220721 cycles	220550 cycles	1.00
ML-DSA-87 keypair	364166 cycles	364478 cycles	1.00
ML-DSA-87 sign	914711 cycles	915447 cycles	1.00
ML-DSA-87 verify	371322 cycles	371015 cycles	1.00

This comment was automatically generated by workflow using github-action-benchmark.

[oqs-bot]

Graviton3

Details

Benchmark suite	Current: 5d4def8	Previous: 7851260	Ratio
ML-DSA-44 keypair	71557 cycles	71597 cycles	1.00
ML-DSA-44 sign	209686 cycles	209159 cycles	1.00
ML-DSA-44 verify	74884 cycles	74852 cycles	1.00
ML-DSA-65 keypair	126010 cycles	125984 cycles	1.00
ML-DSA-65 sign	344287 cycles	345430 cycles	1.00
ML-DSA-65 verify	124018 cycles	124063 cycles	1.00
ML-DSA-87 keypair	206404 cycles	206135 cycles	1.00
ML-DSA-87 sign	439208 cycles	439538 cycles	1.00
ML-DSA-87 verify	204341 cycles	204587 cycles	1.00

This comment was automatically generated by workflow using github-action-benchmark.

[oqs-bot]

Graviton3 (no-opt)

Details

Benchmark suite	Current: 5d4def8	Previous: 7851260	Ratio
ML-DSA-44 keypair	138383 cycles	138182 cycles	1.00
ML-DSA-44 sign	486327 cycles	485648 cycles	1.00
ML-DSA-44 verify	149365 cycles	149256 cycles	1.00
ML-DSA-65 keypair	241228 cycles	241821 cycles	1.00
ML-DSA-65 sign	790653 cycles	791607 cycles	1.00
ML-DSA-65 verify	241725 cycles	241496 cycles	1.00
ML-DSA-87 keypair	395267 cycles	395204 cycles	1.00
ML-DSA-87 sign	1011918 cycles	1014180 cycles	1.00
ML-DSA-87 verify	404516 cycles	404073 cycles	1.00

This comment was automatically generated by workflow using github-action-benchmark.

[oqs-bot]

Graviton2

Details

Benchmark suite	Current: 5d4def8	Previous: 7851260	Ratio
ML-DSA-44 keypair	112286 cycles	112551 cycles	1.00
ML-DSA-44 sign	354432 cycles	353962 cycles	1.00
ML-DSA-44 verify	117401 cycles	117328 cycles	1.00
ML-DSA-65 keypair	194334 cycles	195236 cycles	1.00
ML-DSA-65 sign	583906 cycles	585268 cycles	1.00
ML-DSA-65 verify	193425 cycles	193635 cycles	1.00
ML-DSA-87 keypair	320609 cycles	321368 cycles	1.00
ML-DSA-87 sign	748016 cycles	752084 cycles	0.99
ML-DSA-87 verify	318431 cycles	319287 cycles	1.00

This comment was automatically generated by workflow using github-action-benchmark.

[oqs-bot]

Graviton2 (no-opt)

Details

Benchmark suite	Current: 5d4def8	Previous: 7851260	Ratio
ML-DSA-44 keypair	212071 cycles	212480 cycles	1.00
ML-DSA-44 sign	762178 cycles	761123 cycles	1.00
ML-DSA-44 verify	229335 cycles	230097 cycles	1.00
ML-DSA-65 keypair	375384 cycles	376199 cycles	1.00
ML-DSA-65 sign	1246307 cycles	1248075 cycles	1.00
ML-DSA-65 verify	371258 cycles	372300 cycles	1.00
ML-DSA-87 keypair	601011 cycles	601461 cycles	1.00
ML-DSA-87 sign	1587542 cycles	1607787 cycles	0.99
ML-DSA-87 verify	616778 cycles	617478 cycles	1.00

This comment was automatically generated by workflow using github-action-benchmark.

[github-actions]

Arm Cortex-A72 (Raspberry Pi 4) benchmarks (opt)

Details

Benchmark suite	Current: 5d4def8	Previous: f4cf612	Ratio
ML-DSA-44 keypair	217861 cycles	215701 cycles	1.01
ML-DSA-44 sign	597632 cycles	594374 cycles	1.01
ML-DSA-44 verify	216158 cycles	214981 cycles	1.01
ML-DSA-65 keypair	377361 cycles	378444 cycles	1.00
ML-DSA-65 sign	978888 cycles	978381 cycles	1.00
ML-DSA-65 verify	366624 cycles	360940 cycles	1.02
ML-DSA-87 keypair	637540 cycles	636245 cycles	1.00
ML-DSA-87 sign	1317451 cycles	1316684 cycles	1.00
ML-DSA-87 verify	618384 cycles	618556 cycles	1.00

This comment was automatically generated by workflow using github-action-benchmark.

[github-actions]

Arm Cortex-A72 (Raspberry Pi 4) benchmarks (no-opt)

Details

Benchmark suite	Current: 5d4def8	Previous: f4cf612	Ratio
ML-DSA-44 keypair	298055 cycles	301643 cycles	0.99
ML-DSA-44 sign	1129253 cycles	1141890 cycles	0.99
ML-DSA-44 verify	327651 cycles	331704 cycles	0.99
ML-DSA-65 keypair	545806 cycles	547829 cycles	1.00
ML-DSA-65 sign	1859339 cycles	1866763 cycles	1.00
ML-DSA-65 verify	526525 cycles	529253 cycles	0.99
ML-DSA-87 keypair	841421 cycles	850050 cycles	0.99
ML-DSA-87 sign	2355899 cycles	2368120 cycles	0.99
ML-DSA-87 verify	869227 cycles	877810 cycles	0.99

This comment was automatically generated by workflow using github-action-benchmark.

[github-actions]

Arm Cortex-A55 (Snapdragon 888) benchmarks (opt)

Details

Benchmark suite	Current: 5d4def8	Previous: f4cf612	Ratio
ML-DSA-44 keypair	272071 cycles	271896 cycles	1.00
ML-DSA-44 sign	824044 cycles	812577 cycles	1.01
ML-DSA-44 verify	275127 cycles	273810 cycles	1.00
ML-DSA-65 keypair	466362 cycles	465436 cycles	1.00
ML-DSA-65 sign	1340432 cycles	1340764 cycles	1.00
ML-DSA-65 verify	449951 cycles	453631 cycles	0.99
ML-DSA-87 keypair	799353 cycles	798294 cycles	1.00
ML-DSA-87 sign	1841464 cycles	1827503 cycles	1.01
ML-DSA-87 verify	774277 cycles	773667 cycles	1.00

This comment was automatically generated by workflow using github-action-benchmark.

[github-actions]

Arm Cortex-A55 (Snapdragon 888) benchmarks (no-opt)

Details

Benchmark suite	Current: 5d4def8	Previous: f4cf612	Ratio
ML-DSA-44 keypair	465762 cycles	466025 cycles	1.00
ML-DSA-44 sign	2138629 cycles	2142080 cycles	1.00
ML-DSA-44 verify	557640 cycles	558559 cycles	1.00
ML-DSA-65 keypair	783662 cycles	784222 cycles	1.00
ML-DSA-65 sign	3493400 cycles	3496946 cycles	1.00
ML-DSA-65 verify	868965 cycles	867603 cycles	1.00
ML-DSA-87 keypair	1265942 cycles	1269447 cycles	1.00
ML-DSA-87 sign	4371817 cycles	4335969 cycles	1.01
ML-DSA-87 verify	1391508 cycles	1393383 cycles	1.00

This comment was automatically generated by workflow using github-action-benchmark.

[github-actions]

SpacemiT K1 8 (Banana Pi F3) benchmarks (no-opt)

Details

Benchmark suite	Current: 5d4def8	Previous: 054cbd9	Ratio
ML-DSA-44 keypair	757636 cycles	760547 cycles	1.00
ML-DSA-44 sign	3138764 cycles	3141975 cycles	1.00
ML-DSA-44 verify	856752 cycles	859659 cycles	1.00
ML-DSA-65 keypair	1288516 cycles	1289672 cycles	1.00
ML-DSA-65 sign	5078002 cycles	5094204 cycles	1.00
ML-DSA-65 verify	1368078 cycles	1368660 cycles	1.00
ML-DSA-87 keypair	2110252 cycles	2109927 cycles	1.00
ML-DSA-87 sign	6353839 cycles	6359962 cycles	1.00
ML-DSA-87 verify	2226495 cycles	2226328 cycles	1.00

This comment was automatically generated by workflow using github-action-benchmark.

[oqs-bot]

CBMC Results (ML-DSA-87, REDUCE-RAM)

⚠️ Attention Required

Proof	Status	Current	Previous	Change
**TOTAL**	⚠️	2027s	1436s	+41.2%
compute_pack_t0_t1	⚠️	41s	12s	+242%
mld_attempt_signature_generation	⚠️	182s	34s	+435%
sig_unpack_hints	⚠️	31s	4s	+675%
sign_pk_from_sk	⚠️	40s	6s	+567%
sign_verify_internal	⚠️	262s	47s	+457%

Full Results (212 proofs)

Proof	Status	Current	Previous	Change
**TOTAL**	⚠️	2027s	1436s	+41.2%
polyvec_matrix_pointwise_montgomery_yvec	✅	283s	196s	+44%
sign_verify_internal	⚠️	262s	47s	+457%
mld_attempt_signature_generation	⚠️	182s	34s	+435%
poly_pointwise_montgomery_c	✅	109s	125s	-13%
mld_invntt_layer	✅	99s	111s	-11%
compute_pack_t0_t1	⚠️	41s	12s	+242%
fqmul	✅	41s	39s	+5%
mld_ntt_layer	✅	41s	44s	-7%
sign_pk_from_sk	⚠️	40s	6s	+567%
sig_unpack_hints	⚠️	31s	4s	+675%
keccakf1600x4_permute_native	✅	21s	25s	-16%
rej_uniform_c	✅	21s	18s	+17%
mld_ntt_butterfly_block	✅	20s	23s	-13%
poly_ntt_c	✅	20s	19s	+5%
polyeta_unpack	✅	18s	13s	+38%
rej_uniform	✅	18s	7s	+157%
sign_keypair_internal	✅	17s	6s	+183%
rej_uniform_native_x86_64	✅	16s	-	new
sign_signature_internal	✅	16s	3s	+433%
polyt0_unpack	✅	14s	14s	+0%
poly_uniform_eta_4x	✅	13s	12s	+8%
poly_chknorm_c	✅	11s	13s	-15%
poly_invntt_tomont_c	✅	11s	9s	+22%
polyvec_matrix_pointwise_montgomery_row	✅	10s	13s	-23%
polyveck_chknorm	✅	10s	9s	+11%
mld_keccakf1600_permute_c	✅	9s	8s	+12%
pointwise_acc_native_aarch64	✅	9s	5s	+80%
polyveck_decompose_pack_w1	✅	9s	-	new
sign_keypair	✅	9s	4s	+125%
mld_sample_s1_s2	✅	8s	8s	+0%
poly_power2round	✅	8s	7s	+14%
keccak_absorb	✅	7s	4s	+75%
keccak_absorb_once_x4	✅	7s	8s	-12%
mld_check_pct	✅	7s	15s	-53%
pointwise_acc_native_x86_64	✅	7s	8s	-12%
poly_add	✅	7s	8s	-12%
poly_decompose_c	✅	7s	6s	+17%
polyveck_caddq	✅	7s	8s	-12%
mld_prepare_domain_separation_prefix	✅	6s	3s	+100%
poly_decompose_32_native_aarch64	✅	6s	3s	+100%
polyw1_unpack_32	✅	6s	-	new
polyz_unpack_c	✅	6s	7s	-14%
power2round	✅	6s	3s	+100%
sign_signature	✅	6s	4s	+50%
sign_verify_pre_hash_shake256	✅	6s	7s	-14%
mld_compute_pack_z	✅	5s	6s	-17%
mld_h	✅	5s	2s	+150%
mld_sample_s1_s2_serial	✅	5s	6s	-17%
pack_sig_z	✅	5s	3s	+67%
poly_chknorm_native_x86_64	✅	5s	2s	+150%
poly_sub	✅	5s	5s	+0%
poly_uniform	✅	5s	4s	+25%
poly_uniform_eta	✅	5s	5s	+0%
poly_use_hint	✅	5s	4s	+25%
poly_use_hint_native	✅	5s	1s	+400%
polyt1_unpack	✅	5s	3s	+67%
polyveck_invntt_tomont	✅	5s	4s	+25%
polyveck_reduce	✅	5s	6s	-17%
polyveck_unpack_eta	✅	5s	3s	+67%
polyvecl_ntt	✅	5s	8s	-38%
shake128_squeeze	✅	5s	1s	+400%
shake256x4_squeezeblocks	✅	5s	4s	+25%
sign_signature_extmu	✅	5s	4s	+25%
sign_verify_pre_hash_internal	✅	5s	3s	+67%
use_hint	✅	5s	3s	+67%
keccak_squeezeblocks_x4	✅	4s	4s	+0%
keccakf1600_permute	✅	4s	2s	+100%
keccakf1600_xor_bytes	✅	4s	1s	+300%
keccakf1600x4_xor_bytes	✅	4s	1s	+300%
mld_ct_get_optblocker_u32	✅	4s	2s	+100%
mld_sign_attempt	✅	4s	-	new
mld_sign_finish	✅	4s	-	new
montgomery_reduce	✅	4s	2s	+100%
nttunpack_native_x86_64	✅	4s	3s	+33%
pointwise_native_x86_64	✅	4s	5s	-20%
poly_caddq_c	✅	4s	3s	+33%
poly_caddq_native_x86_64	✅	4s	3s	+33%
poly_challenge	✅	4s	4s	+0%
poly_chknorm	✅	4s	4s	+0%
poly_chknorm_native	✅	4s	1s	+300%
poly_decompose_88_native_aarch64	✅	4s	2s	+100%
poly_decompose_native	✅	4s	2s	+100%
poly_decompose_native_x86_64	✅	4s	3s	+33%
poly_invntt_tomont	✅	4s	4s	+0%
poly_ntt	✅	4s	2s	+100%
poly_ntt_native	✅	4s	4s	+0%
poly_uniform_gamma1	✅	4s	3s	+33%
poly_use_hint_c	✅	4s	4s	+0%
polyeta_pack	✅	4s	3s	+33%
polyvec_matrix_expand_serial	✅	4s	3s	+33%
polyvecl_chknorm	✅	4s	38s	-89%
polyvecl_unpack_z	✅	4s	3s	+33%
polyw1_pack	✅	4s	2s	+100%
polyw1_pack_32	✅	4s	3s	+33%
polyz_unpack_native_x86_64	✅	4s	3s	+33%
rej_eta	✅	4s	2s	+100%
rej_eta_native	✅	4s	4s	+0%
rej_uniform_eta_native_x86_64	✅	4s	-	new
rej_uniform_native_aarch64	✅	4s	3s	+33%
shake128_finalize	✅	4s	2s	+100%
shake256_finalize	✅	4s	3s	+33%
shake256_squeeze	✅	4s	2s	+100%
sign_verify	✅	4s	2s	+100%
sk_s1hat_get_poly	✅	4s	3s	+33%
unpack_sk_s2hat	✅	4s	3s	+33%
yvec_init	✅	4s	4s	+0%
caddq	✅	3s	3s	+0%
fqscale	✅	3s	1s	+200%
keccak_f1600_x1_native_aarch64	✅	3s	2s	+50%
keccak_f1600_x4_native_aarch64_v84a	✅	3s	1s	+200%
keccak_f1600_x4_native_avx2	✅	3s	3s	+0%
keccak_finalize	✅	3s	1s	+200%
keccakf1600_extract_bytes (big endian)	✅	3s	3s	+0%
keccakf1600x4_extract_bytes	✅	3s	1s	+200%
keccakf1600x4_xor_bytes_native	✅	3s	2s	+50%
make_hint	✅	3s	2s	+50%
mld_ct_cmask_neg_i32	✅	3s	2s	+50%
mld_ct_cmask_nonzero_u32	✅	3s	5s	-40%
mld_ct_cmask_nonzero_u8	✅	3s	2s	+50%
mld_ct_get_optblocker_i64	✅	3s	2s	+50%
mld_ct_get_optblocker_u8	✅	3s	3s	+0%
mld_keccakf1600x4_xor_bytes_c	✅	3s	1s	+200%
mld_value_barrier_u8	✅	3s	2s	+50%
ntt_native_aarch64	✅	3s	4s	-25%
poly_decompose	✅	3s	2s	+50%
poly_invntt_tomont_native	✅	3s	2s	+50%
poly_permute_bitrev_to_custom_optional	✅	3s	2s	+50%
poly_permute_bitrev_to_custom_optional_native	✅	3s	3s	+0%
poly_pointwise_montgomery_native	✅	3s	3s	+0%
poly_reduce	✅	3s	4s	-25%
poly_uniform_4x	✅	3s	3s	+0%
poly_use_hint_native_x86_64	✅	3s	-	new
polyt0_pack	✅	3s	3s	+0%
polyveck_ntt	✅	3s	3s	+0%
polyvecl_pointwise_acc_montgomery	✅	3s	2s	+50%
polyvecl_uniform_gamma1_serial	✅	3s	2s	+50%
polyvecl_unpack_eta	✅	3s	3s	+0%
polyw1_unpack	✅	3s	-	new
polyw1_unpack_88	✅	3s	-	new
polyz_pack	✅	3s	4s	-25%
polyz_unpack	✅	3s	3s	+0%
polyz_unpack_19_native_aarch64	✅	3s	5s	-40%
reduce32	✅	3s	3s	+0%
rej_eta_c	✅	3s	4s	-25%
rej_uniform_native	✅	3s	5s	-40%
shake128_init	✅	3s	2s	+50%
shake128x4_absorb_once	✅	3s	4s	-25%
shake256_absorb	✅	3s	3s	+0%
shake256_release	✅	3s	5s	-40%
sign_signature_pre_hash_internal	✅	3s	2s	+50%
sign_signature_pre_hash_shake256	✅	3s	3s	+0%
sign_verify_extmu	✅	3s	4s	-25%
sys_check_capability	✅	3s	2s	+50%
unpack_sk_t0hat	✅	3s	4s	-25%
decompose	✅	2s	2s	+0%
intt_native_aarch64	✅	2s	4s	-50%
intt_native_x86_64	✅	2s	4s	-50%
keccak_f1600_x1_native_aarch64_v84a	✅	2s	2s	+0%
keccak_f1600_x4_native_aarch64_v8a_scalar_hybrid	✅	2s	2s	+0%
keccak_init	✅	2s	1s	+100%
keccakf1600_permute_native	✅	2s	3s	-33%
keccakf1600_xor_bytes (big endian)	✅	2s	2s	+0%
keccakf1600x4_extract_bytes_native	✅	2s	4s	-50%
keccakf1600x4_permute	✅	2s	2s	+0%
mld_ct_abs_i32	✅	2s	1s	+100%
mld_ct_memcmp	✅	2s	1s	+100%
mld_keccakf1600_extract_bytes	✅	2s	1s	+100%
mld_keccakf1600x4_extract_bytes_c	✅	2s	3s	-33%
mld_polymat_expand_entry	✅	2s	4s	-50%
mld_sign_resume	✅	2s	-	new
mld_value_barrier_i64	✅	2s	2s	+0%
mld_value_barrier_u32	✅	2s	3s	-33%
ntt_native_x86_64	✅	2s	2s	+0%
pack_sig_c	✅	2s	2s	+0%
pack_sig_h	✅	2s	3s	-33%
pack_sk_rho_key_tr_s2	✅	2s	2s	+0%
pack_sk_s1	✅	2s	2s	+0%
pointwise_native_aarch64	✅	2s	4s	-50%
poly_caddq	✅	2s	5s	-60%
poly_caddq_native	✅	2s	3s	-33%
poly_caddq_native_aarch64	✅	2s	3s	-33%
poly_chknorm_native_aarch64	✅	2s	5s	-60%
poly_pointwise_montgomery	✅	2s	3s	-33%
poly_shiftl	✅	2s	4s	-50%
poly_uniform_gamma1_4x	✅	2s	3s	-33%
poly_use_hint_native_aarch64	✅	2s	3s	-33%
polyt1_pack	✅	2s	5s	-60%
polyvec_matrix_expand	✅	2s	3s	-33%
polyveck_pack_eta	✅	2s	5s	-60%
polyvecl_pack_eta	✅	2s	2s	+0%
polyvecl_pointwise_acc_montgomery_c	✅	2s	2s	+0%
polyvecl_uniform_gamma1	✅	2s	3s	-33%
polyw1_pack_88	✅	2s	2s	+0%
polyz_unpack_17_native_aarch64	✅	2s	4s	-50%
polyz_unpack_native	✅	2s	1s	+100%
rej_uniform_eta_native_aarch64	✅	2s	3s	-33%
shake128_absorb	✅	2s	2s	+0%
shake128_release	✅	2s	3s	-33%
shake128x4_squeezeblocks	✅	2s	1s	+100%
shake256	✅	2s	3s	-33%
shake256_init	✅	2s	3s	-33%
shake256x4_absorb_once	✅	2s	5s	-60%
sk_t0hat_get_poly	✅	2s	3s	-33%
unpack_pk_t1	✅	2s	2s	+0%
unpack_sk	✅	2s	4s	-50%
unpack_sk_s1hat	✅	2s	3s	-33%
yvec_get_poly	✅	2s	2s	+0%
keccak_f1600_x4_native_aarch64_v8a_v84a_scalar_hybrid	✅	1s	2s	-50%
keccak_squeeze	✅	1s	5s	-80%
mld_ct_sel_int32	✅	1s	2s	-50%
polyvecl_pointwise_acc_montgomery_native	✅	1s	2s	-50%
sk_s2hat_get_poly	✅	1s	2s	-50%

[oqs-bot]

CBMC Results (ML-DSA-65, REDUCE-RAM)

⚠️ Attention Required

Proof	Status	Current	Previous	Change
**TOTAL**	⚠️	2286s	1482s	+54.3%
compute_pack_t0_t1	⚠️	50s	7s	+614%
mld_attempt_signature_generation	⚠️	429s	31s	+1284%
rej_uniform_c	⚠️	24s	16s	+50%
sig_unpack_hints	⚠️	31s	1s	+3000%
sign_pk_from_sk	⚠️	55s	5s	+1000%
sign_verify_internal	⚠️	259s	71s	+265%

Full Results (212 proofs)

Proof	Status	Current	Previous	Change
**TOTAL**	⚠️	2286s	1482s	+54.3%
mld_attempt_signature_generation	⚠️	429s	31s	+1284%
sign_verify_internal	⚠️	259s	71s	+265%
polyvec_matrix_pointwise_montgomery_yvec	✅	167s	201s	-17%
poly_pointwise_montgomery_c	✅	138s	116s	+19%
mld_invntt_layer	✅	122s	108s	+13%
sign_pk_from_sk	⚠️	55s	5s	+1000%
compute_pack_t0_t1	⚠️	50s	7s	+614%
fqmul	✅	43s	40s	+7%
mld_ntt_layer	✅	42s	43s	-2%
sig_unpack_hints	⚠️	31s	1s	+3000%
keccakf1600x4_permute_native	✅	24s	22s	+9%
rej_uniform_c	⚠️	24s	16s	+50%
poly_ntt_c	✅	22s	22s	+0%
mld_ntt_butterfly_block	✅	21s	25s	-16%
rej_uniform	✅	19s	7s	+171%
sign_keypair_internal	✅	18s	3s	+500%
poly_uniform_eta_4x	✅	17s	13s	+31%
sign_signature_internal	✅	17s	6s	+183%
rej_uniform_native_x86_64	✅	14s	-	new
polyt0_unpack	✅	13s	13s	+0%
poly_chknorm_c	✅	11s	13s	-15%
poly_invntt_tomont_c	✅	11s	10s	+10%
polyveck_caddq	✅	11s	7s	+57%
sign_keypair	✅	11s	4s	+175%
polyeta_unpack	✅	9s	4s	+125%
polyvec_matrix_pointwise_montgomery_row	✅	9s	8s	+12%
polyveck_decompose_pack_w1	✅	8s	-	new
polyw1_unpack_32	✅	8s	-	new
decompose	✅	7s	4s	+75%
keccak_absorb_once_x4	✅	7s	10s	-30%
pointwise_acc_native_aarch64	✅	7s	6s	+17%
pointwise_acc_native_x86_64	✅	7s	5s	+40%
poly_decompose_c	✅	7s	8s	-12%
poly_power2round	✅	7s	7s	+0%
polyvec_matrix_expand	✅	7s	6s	+17%
polyveck_chknorm	✅	7s	36s	-81%
polyveck_invntt_tomont	✅	7s	7s	+0%
polyvecl_ntt	✅	7s	7s	+0%
shake128_absorb	✅	7s	2s	+250%
keccak_absorb	✅	6s	3s	+100%
mld_check_pct	✅	6s	12s	-50%
mld_compute_pack_z	✅	6s	5s	+20%
mld_keccakf1600_permute_c	✅	6s	7s	-14%
mld_prepare_domain_separation_prefix	✅	6s	4s	+50%
mld_sample_s1_s2	✅	6s	6s	+0%
pack_sig_c	✅	6s	3s	+100%
poly_add	✅	6s	7s	-14%
poly_challenge	✅	6s	5s	+20%
poly_chknorm	✅	6s	3s	+100%
poly_decompose_native_x86_64	✅	6s	2s	+200%
poly_sub	✅	6s	4s	+50%
poly_use_hint_native_aarch64	✅	6s	4s	+50%
polyt0_pack	✅	6s	5s	+20%
polyveck_reduce	✅	6s	6s	+0%
polyvecl_uniform_gamma1_serial	✅	6s	1s	+500%
sign_verify	✅	6s	6s	+0%
intt_native_x86_64	✅	5s	4s	+25%
keccak_squeezeblocks_x4	✅	5s	4s	+25%
mld_sign_resume	✅	5s	-	new
mld_value_barrier_u32	✅	5s	4s	+25%
pack_sk_rho_key_tr_s2	✅	5s	2s	+150%
poly_caddq_native_aarch64	✅	5s	2s	+150%
poly_shiftl	✅	5s	3s	+67%
poly_uniform_gamma1_4x	✅	5s	3s	+67%
polyeta_pack	✅	5s	1s	+400%
polyt1_unpack	✅	5s	3s	+67%
polyvecl_chknorm	✅	5s	43s	-88%
polyvecl_pointwise_acc_montgomery_native	✅	5s	3s	+67%
polyz_unpack_17_native_aarch64	✅	5s	2s	+150%
polyz_unpack_c	✅	5s	9s	-44%
polyz_unpack_native_x86_64	✅	5s	3s	+67%
rej_eta	✅	5s	5s	+0%
rej_uniform_eta_native_x86_64	✅	5s	-	new
rej_uniform_native	✅	5s	4s	+25%
sign_verify_pre_hash_internal	✅	5s	5s	+0%
sk_s2hat_get_poly	✅	5s	1s	+400%
caddq	✅	4s	2s	+100%
fqscale	✅	4s	3s	+33%
intt_native_aarch64	✅	4s	2s	+100%
keccak_f1600_x4_native_aarch64_v8a_v84a_scalar_hybrid	✅	4s	3s	+33%
keccakf1600_permute	✅	4s	4s	+0%
make_hint	✅	4s	3s	+33%
mld_ct_abs_i32	✅	4s	6s	-33%
mld_ct_cmask_nonzero_u32	✅	4s	3s	+33%
mld_ct_get_optblocker_u8	✅	4s	4s	+0%
mld_sign_attempt	✅	4s	-	new
montgomery_reduce	✅	4s	1s	+300%
pack_sig_h	✅	4s	2s	+100%
pack_sk_s1	✅	4s	3s	+33%
poly_chknorm_native	✅	4s	4s	+0%
poly_chknorm_native_aarch64	✅	4s	2s	+100%
poly_chknorm_native_x86_64	✅	4s	4s	+0%
poly_decompose	✅	4s	2s	+100%
poly_decompose_native	✅	4s	5s	-20%
poly_ntt_native	✅	4s	2s	+100%
poly_pointwise_montgomery	✅	4s	2s	+100%
poly_pointwise_montgomery_native	✅	4s	4s	+0%
poly_uniform	✅	4s	2s	+100%
poly_uniform_eta	✅	4s	5s	-20%
polyvec_matrix_expand_serial	✅	4s	3s	+33%
polyvecl_pack_eta	✅	4s	2s	+100%
polyvecl_uniform_gamma1	✅	4s	4s	+0%
polyw1_pack_88	✅	4s	3s	+33%
polyw1_unpack_88	✅	4s	-	new
polyz_unpack	✅	4s	3s	+33%
rej_eta_native	✅	4s	3s	+33%
shake128x4_absorb_once	✅	4s	2s	+100%
shake128x4_squeezeblocks	✅	4s	2s	+100%
sign_signature_extmu	✅	4s	4s	+0%
sign_signature_pre_hash_internal	✅	4s	3s	+33%
sign_signature_pre_hash_shake256	✅	4s	7s	-43%
sign_verify_extmu	✅	4s	2s	+100%
sign_verify_pre_hash_shake256	✅	4s	6s	-33%
unpack_sk_s1hat	✅	4s	1s	+300%
unpack_sk_t0hat	✅	4s	4s	+0%
keccak_f1600_x1_native_aarch64_v84a	✅	3s	2s	+50%
keccak_f1600_x4_native_aarch64_v8a_scalar_hybrid	✅	3s	3s	+0%
keccak_f1600_x4_native_avx2	✅	3s	2s	+50%
keccak_finalize	✅	3s	2s	+50%
keccak_squeeze	✅	3s	2s	+50%
keccakf1600_extract_bytes (big endian)	✅	3s	3s	+0%
keccakf1600x4_extract_bytes	✅	3s	4s	-25%
keccakf1600x4_permute	✅	3s	1s	+200%
mld_ct_cmask_neg_i32	✅	3s	3s	+0%
mld_ct_get_optblocker_i64	✅	3s	1s	+200%
mld_ct_sel_int32	✅	3s	2s	+50%
mld_h	✅	3s	3s	+0%
mld_keccakf1600_extract_bytes	✅	3s	2s	+50%
mld_keccakf1600x4_xor_bytes_c	✅	3s	2s	+50%
mld_polymat_expand_entry	✅	3s	3s	+0%
mld_sample_s1_s2_serial	✅	3s	3s	+0%
mld_sign_finish	✅	3s	-	new
mld_value_barrier_i64	✅	3s	2s	+50%
mld_value_barrier_u8	✅	3s	1s	+200%
ntt_native_aarch64	✅	3s	3s	+0%
ntt_native_x86_64	✅	3s	5s	-40%
pack_sig_z	✅	3s	1s	+200%
pointwise_native_aarch64	✅	3s	3s	+0%
pointwise_native_x86_64	✅	3s	2s	+50%
poly_caddq	✅	3s	3s	+0%
poly_caddq_native	✅	3s	4s	-25%
poly_caddq_native_x86_64	✅	3s	1s	+200%
poly_decompose_32_native_aarch64	✅	3s	4s	-25%
poly_permute_bitrev_to_custom_optional	✅	3s	3s	+0%
poly_permute_bitrev_to_custom_optional_native	✅	3s	3s	+0%
poly_reduce	✅	3s	4s	-25%
poly_uniform_4x	✅	3s	4s	-25%
poly_use_hint	✅	3s	3s	+0%
poly_use_hint_c	✅	3s	2s	+50%
poly_use_hint_native	✅	3s	7s	-57%
poly_use_hint_native_x86_64	✅	3s	-	new
polyt1_pack	✅	3s	3s	+0%
polyveck_ntt	✅	3s	4s	-25%
polyveck_pack_eta	✅	3s	3s	+0%
polyveck_unpack_eta	✅	3s	3s	+0%
polyvecl_pointwise_acc_montgomery	✅	3s	3s	+0%
polyvecl_pointwise_acc_montgomery_c	✅	3s	3s	+0%
polyvecl_unpack_z	✅	3s	1s	+200%
polyz_pack	✅	3s	3s	+0%
polyz_unpack_19_native_aarch64	✅	3s	5s	-40%
polyz_unpack_native	✅	3s	3s	+0%
power2round	✅	3s	2s	+50%
rej_eta_c	✅	3s	4s	-25%
rej_uniform_eta_native_aarch64	✅	3s	5s	-40%
shake128_release	✅	3s	2s	+50%
shake256	✅	3s	2s	+50%
shake256_absorb	✅	3s	4s	-25%
shake256_squeeze	✅	3s	4s	-25%
shake256x4_squeezeblocks	✅	3s	2s	+50%
sign_signature	✅	3s	5s	-40%
unpack_sk	✅	3s	3s	+0%
unpack_sk_s2hat	✅	3s	3s	+0%
use_hint	✅	3s	2s	+50%
yvec_init	✅	3s	5s	-40%
keccak_f1600_x4_native_aarch64_v84a	✅	2s	2s	+0%
keccak_init	✅	2s	4s	-50%
keccakf1600_permute_native	✅	2s	2s	+0%
keccakf1600_xor_bytes (big endian)	✅	2s	2s	+0%
keccakf1600x4_extract_bytes_native	✅	2s	1s	+100%
keccakf1600x4_xor_bytes	✅	2s	2s	+0%
keccakf1600x4_xor_bytes_native	✅	2s	2s	+0%
mld_ct_cmask_nonzero_u8	✅	2s	2s	+0%
mld_ct_get_optblocker_u32	✅	2s	3s	-33%
mld_ct_memcmp	✅	2s	4s	-50%
mld_keccakf1600x4_extract_bytes_c	✅	2s	2s	+0%
nttunpack_native_x86_64	✅	2s	3s	-33%
poly_caddq_c	✅	2s	5s	-60%
poly_decompose_88_native_aarch64	✅	2s	2s	+0%
poly_invntt_tomont	✅	2s	5s	-60%
poly_invntt_tomont_native	✅	2s	5s	-60%
poly_ntt	✅	2s	2s	+0%
poly_uniform_gamma1	✅	2s	3s	-33%
polyvecl_unpack_eta	✅	2s	2s	+0%
polyw1_pack_32	✅	2s	2s	+0%
polyw1_unpack	✅	2s	-	new
reduce32	✅	2s	2s	+0%
rej_uniform_native_aarch64	✅	2s	5s	-60%
shake128_finalize	✅	2s	2s	+0%
shake128_init	✅	2s	6s	-67%
shake128_squeeze	✅	2s	3s	-33%
shake256_finalize	✅	2s	1s	+100%
shake256_init	✅	2s	4s	-50%
shake256x4_absorb_once	✅	2s	2s	+0%
sk_s1hat_get_poly	✅	2s	3s	-33%
sk_t0hat_get_poly	✅	2s	1s	+100%
unpack_pk_t1	✅	2s	2s	+0%
yvec_get_poly	✅	2s	3s	-33%
keccak_f1600_x1_native_aarch64	✅	1s	2s	-50%
keccakf1600_xor_bytes	✅	1s	4s	-75%
polyw1_pack	✅	1s	3s	-67%
shake256_release	✅	1s	3s	-67%
sys_check_capability	✅	1s	1s	+0%

[oqs-bot]

CBMC Results (ML-DSA-87)

⚠️ Attention Required

Proof	Status	Current	Previous	Change
**TOTAL**	⚠️	3306s	2151s	+53.7%
compute_pack_t0_t1	⚠️	197s	19s	+937%
mld_attempt_signature_generation	⚠️	439s	55s	+698%
poly_pointwise_montgomery_c	⚠️	246s	144s	+71%
sig_unpack_hints	⚠️	61s	3s	+1933%
sign_pk_from_sk	⚠️	50s	6s	+733%
sign_signature_internal	⚠️	144s	42s	+243%
sign_verify_internal	⚠️	437s	97s	+351%

Full Results (212 proofs)

Proof	Status	Current	Previous	Change
**TOTAL**	⚠️	3306s	2151s	+53.7%
mld_attempt_signature_generation	⚠️	439s	55s	+698%
sign_verify_internal	⚠️	437s	97s	+351%
polyvecl_pointwise_acc_montgomery_c	✅	367s	353s	+4%
poly_pointwise_montgomery_c	⚠️	246s	144s	+71%
polyvec_matrix_expand	✅	223s	324s	-31%
compute_pack_t0_t1	⚠️	197s	19s	+937%
sign_signature_internal	⚠️	144s	42s	+243%
mld_invntt_layer	✅	110s	115s	-4%
sig_unpack_hints	⚠️	61s	3s	+1933%
sign_pk_from_sk	⚠️	50s	6s	+733%
fqmul	✅	41s	43s	-5%
mld_ntt_layer	✅	41s	45s	-9%
polyvec_matrix_expand_serial	✅	40s	38s	+5%
polyvec_matrix_pointwise_montgomery_yvec	✅	24s	18s	+33%
keccakf1600x4_permute_native	✅	23s	23s	+0%
mld_ntt_butterfly_block	✅	22s	24s	-8%
poly_ntt_c	✅	20s	21s	-5%
polyt0_unpack	✅	17s	14s	+21%
rej_uniform_native_x86_64	✅	17s	-	new
sign_keypair_internal	✅	17s	6s	+183%
rej_uniform	✅	16s	15s	+7%
polyveck_decompose_pack_w1	✅	15s	-	new
polyeta_unpack	✅	14s	17s	-18%
poly_chknorm_c	✅	12s	15s	-20%
poly_invntt_tomont_c	✅	12s	12s	+0%
rej_uniform_c	✅	12s	19s	-37%
poly_uniform_eta_4x	✅	11s	11s	+0%
mld_compute_pack_z	✅	10s	8s	+25%
poly_uniform_4x	✅	10s	13s	-23%
polyz_unpack_c	✅	10s	3s	+233%
sign_keypair	✅	9s	4s	+125%
keccak_absorb_once_x4	✅	8s	9s	-11%
mld_check_pct	✅	8s	16s	-50%
poly_power2round	✅	8s	3s	+167%
poly_use_hint_c	✅	8s	2s	+300%
polyveck_invntt_tomont	✅	8s	9s	-11%
keccak_absorb	✅	7s	3s	+133%
mld_sample_s1_s2	✅	7s	6s	+17%
pointwise_acc_native_x86_64	✅	7s	6s	+17%
polyveck_caddq	✅	7s	8s	-12%
polyw1_unpack_32	✅	7s	-	new
mld_ct_get_optblocker_u32	✅	6s	2s	+200%
mld_keccakf1600_permute_c	✅	6s	7s	-14%
pointwise_acc_native_aarch64	✅	6s	6s	+0%
poly_decompose_c	✅	6s	5s	+20%
polyveck_chknorm	✅	6s	3s	+100%
polyveck_ntt	✅	6s	11s	-45%
sign_signature	✅	6s	5s	+20%
sign_signature_extmu	✅	6s	4s	+50%
intt_native_aarch64	✅	5s	3s	+67%
intt_native_x86_64	✅	5s	3s	+67%
keccakf1600x4_xor_bytes_native	✅	5s	3s	+67%
mld_h	✅	5s	3s	+67%
mld_polymat_expand_entry	✅	5s	3s	+67%
mld_sample_s1_s2_serial	✅	5s	8s	-38%
mld_sign_finish	✅	5s	-	new
pack_sk_rho_key_tr_s2	✅	5s	3s	+67%
poly_add	✅	5s	6s	-17%
poly_caddq_native_aarch64	✅	5s	3s	+67%
poly_caddq_native_x86_64	✅	5s	2s	+150%
poly_challenge	✅	5s	5s	+0%
poly_chknorm_native_aarch64	✅	5s	4s	+25%
poly_decompose_32_native_aarch64	✅	5s	5s	+0%
poly_uniform	✅	5s	4s	+25%
poly_uniform_gamma1_4x	✅	5s	3s	+67%
polyveck_unpack_eta	✅	5s	4s	+25%
polyvecl_ntt	✅	5s	7s	-29%
polyvecl_pointwise_acc_montgomery_native	✅	5s	3s	+67%
shake128_absorb	✅	5s	4s	+25%
sign_signature_pre_hash_internal	✅	5s	5s	+0%
sign_signature_pre_hash_shake256	✅	5s	6s	-17%
sign_verify_pre_hash_shake256	✅	5s	3s	+67%
sk_s2hat_get_poly	✅	5s	3s	+67%
sys_check_capability	✅	5s	3s	+67%
unpack_sk_t0hat	✅	5s	7s	-29%
caddq	✅	4s	4s	+0%
keccak_squeezeblocks_x4	✅	4s	4s	+0%
keccakf1600x4_extract_bytes_native	✅	4s	2s	+100%
keccakf1600x4_xor_bytes	✅	4s	3s	+33%
mld_ct_cmask_neg_i32	✅	4s	4s	+0%
mld_ct_cmask_nonzero_u32	✅	4s	2s	+100%
mld_ct_memcmp	✅	4s	3s	+33%
mld_prepare_domain_separation_prefix	✅	4s	4s	+0%
nttunpack_native_x86_64	✅	4s	3s	+33%
pack_sig_c	✅	4s	4s	+0%
pack_sig_h	✅	4s	4s	+0%
pack_sig_z	✅	4s	5s	-20%
poly_decompose_88_native_aarch64	✅	4s	2s	+100%
poly_ntt	✅	4s	3s	+33%
poly_permute_bitrev_to_custom_optional	✅	4s	3s	+33%
poly_permute_bitrev_to_custom_optional_native	✅	4s	5s	-20%
poly_pointwise_montgomery	✅	4s	4s	+0%
polyt0_pack	✅	4s	4s	+0%
polyveck_pack_eta	✅	4s	6s	-33%
polyvecl_uniform_gamma1_serial	✅	4s	4s	+0%
polyvecl_unpack_eta	✅	4s	5s	-20%
polyw1_pack	✅	4s	4s	+0%
polyw1_unpack	✅	4s	-	new
polyz_unpack_17_native_aarch64	✅	4s	3s	+33%
rej_eta_c	✅	4s	5s	-20%
rej_eta_native	✅	4s	6s	-33%
rej_uniform_eta_native_aarch64	✅	4s	5s	-20%
rej_uniform_eta_native_x86_64	✅	4s	-	new
rej_uniform_native	✅	4s	8s	-50%
rej_uniform_native_aarch64	✅	4s	2s	+100%
shake128_release	✅	4s	4s	+0%
shake128_squeeze	✅	4s	2s	+100%
shake256_release	✅	4s	3s	+33%
shake256_squeeze	✅	4s	2s	+100%
shake256x4_absorb_once	✅	4s	2s	+100%
sign_verify_extmu	✅	4s	3s	+33%
sign_verify_pre_hash_internal	✅	4s	3s	+33%
sk_s1hat_get_poly	✅	4s	3s	+33%
sk_t0hat_get_poly	✅	4s	4s	+0%
unpack_pk_t1	✅	4s	1s	+300%
fqscale	✅	3s	3s	+0%
keccak_f1600_x1_native_aarch64_v84a	✅	3s	1s	+200%
keccak_f1600_x4_native_aarch64_v84a	✅	3s	4s	-25%
keccak_f1600_x4_native_aarch64_v8a_scalar_hybrid	✅	3s	3s	+0%
keccak_finalize	✅	3s	1s	+200%
keccak_squeeze	✅	3s	2s	+50%
keccakf1600_permute_native	✅	3s	4s	-25%
keccakf1600_xor_bytes	✅	3s	3s	+0%
make_hint	✅	3s	3s	+0%
mld_ct_get_optblocker_u8	✅	3s	3s	+0%
mld_keccakf1600x4_extract_bytes_c	✅	3s	2s	+50%
mld_keccakf1600x4_xor_bytes_c	✅	3s	4s	-25%
montgomery_reduce	✅	3s	3s	+0%
ntt_native_aarch64	✅	3s	6s	-50%
pack_sk_s1	✅	3s	1s	+200%
pointwise_native_aarch64	✅	3s	5s	-40%
poly_caddq	✅	3s	2s	+50%
poly_caddq_c	✅	3s	3s	+0%
poly_caddq_native	✅	3s	4s	-25%
poly_chknorm	✅	3s	3s	+0%
poly_chknorm_native	✅	3s	4s	-25%
poly_decompose	✅	3s	3s	+0%
poly_invntt_tomont_native	✅	3s	5s	-40%
poly_ntt_native	✅	3s	3s	+0%
poly_shiftl	✅	3s	4s	-25%
poly_uniform_eta	✅	3s	4s	-25%
poly_use_hint_native_aarch64	✅	3s	2s	+50%
poly_use_hint_native_x86_64	✅	3s	-	new
polyeta_pack	✅	3s	4s	-25%
polyt1_pack	✅	3s	3s	+0%
polyvecl_chknorm	✅	3s	7s	-57%
polyvecl_pack_eta	✅	3s	3s	+0%
polyw1_pack_32	✅	3s	4s	-25%
polyw1_pack_88	✅	3s	3s	+0%
polyz_pack	✅	3s	5s	-40%
polyz_unpack	✅	3s	2s	+50%
rej_eta	✅	3s	4s	-25%
shake128x4_absorb_once	✅	3s	5s	-40%
shake256_absorb	✅	3s	2s	+50%
shake256_finalize	✅	3s	2s	+50%
shake256x4_squeezeblocks	✅	3s	1s	+200%
sign_verify	✅	3s	5s	-40%
unpack_sk_s1hat	✅	3s	2s	+50%
decompose	✅	2s	3s	-33%
keccak_f1600_x1_native_aarch64	✅	2s	1s	+100%
keccakf1600_extract_bytes (big endian)	✅	2s	3s	-33%
keccakf1600_xor_bytes (big endian)	✅	2s	2s	+0%
mld_ct_abs_i32	✅	2s	3s	-33%
mld_ct_cmask_nonzero_u8	✅	2s	3s	-33%
mld_keccakf1600_extract_bytes	✅	2s	4s	-50%
mld_sign_attempt	✅	2s	-	new
mld_sign_resume	✅	2s	-	new
mld_value_barrier_u32	✅	2s	2s	+0%
mld_value_barrier_u8	✅	2s	3s	-33%
ntt_native_x86_64	✅	2s	2s	+0%
pointwise_native_x86_64	✅	2s	2s	+0%
poly_chknorm_native_x86_64	✅	2s	2s	+0%
poly_decompose_native	✅	2s	2s	+0%
poly_decompose_native_x86_64	✅	2s	2s	+0%
poly_invntt_tomont	✅	2s	1s	+100%
poly_pointwise_montgomery_native	✅	2s	5s	-60%
poly_reduce	✅	2s	2s	+0%
poly_sub	✅	2s	3s	-33%
poly_uniform_gamma1	✅	2s	4s	-50%
poly_use_hint	✅	2s	1s	+100%
poly_use_hint_native	✅	2s	3s	-33%
polyt1_unpack	✅	2s	4s	-50%
polyvec_matrix_pointwise_montgomery_row	✅	2s	3s	-33%
polyveck_reduce	✅	2s	3s	-33%
polyvecl_uniform_gamma1	✅	2s	2s	+0%
polyvecl_unpack_z	✅	2s	4s	-50%
polyw1_unpack_88	✅	2s	-	new
polyz_unpack_19_native_aarch64	✅	2s	4s	-50%
polyz_unpack_native	✅	2s	4s	-50%
power2round	✅	2s	4s	-50%
reduce32	✅	2s	3s	-33%
shake128_finalize	✅	2s	2s	+0%
shake128_init	✅	2s	1s	+100%
shake128x4_squeezeblocks	✅	2s	3s	-33%
shake256	✅	2s	2s	+0%
shake256_init	✅	2s	2s	+0%
unpack_sk	✅	2s	5s	-60%
unpack_sk_s2hat	✅	2s	3s	-33%
use_hint	✅	2s	3s	-33%
yvec_get_poly	✅	2s	4s	-50%
yvec_init	✅	2s	4s	-50%
keccak_f1600_x4_native_aarch64_v8a_v84a_scalar_hybrid	✅	1s	4s	-75%
keccak_f1600_x4_native_avx2	✅	1s	2s	-50%
keccak_init	✅	1s	3s	-67%
keccakf1600_permute	✅	1s	3s	-67%
keccakf1600x4_extract_bytes	✅	1s	2s	-50%
keccakf1600x4_permute	✅	1s	3s	-67%
mld_ct_get_optblocker_i64	✅	1s	3s	-67%
mld_ct_sel_int32	✅	1s	3s	-67%
mld_value_barrier_i64	✅	1s	1s	+0%
polyvecl_pointwise_acc_montgomery	✅	1s	5s	-80%
polyz_unpack_native_x86_64	✅	1s	3s	-67%

[oqs-bot]

CBMC Results (ML-DSA-44)

⚠️ Attention Required

Proof	Status	Current	Previous	Change
**TOTAL**	⚠️	2775s	1514s	+83.3%
mld_attempt_signature_generation	⚠️	268s	58s	+362%
poly_pointwise_montgomery_c	⚠️	260s	114s	+128%
polyvecl_pointwise_acc_montgomery_c	⚠️	337s	131s	+157%
sig_unpack_hints	⚠️	67s	2s	+3250%
sign_pk_from_sk	⚠️	37s	5s	+640%
sign_signature_internal	⚠️	181s	26s	+596%
sign_verify_internal	⚠️	414s	114s	+263%

Full Results (212 proofs)

Proof	Status	Current	Previous	Change
**TOTAL**	⚠️	2775s	1514s	+83.3%
sign_verify_internal	⚠️	414s	114s	+263%
polyvecl_pointwise_acc_montgomery_c	⚠️	337s	131s	+157%
mld_attempt_signature_generation	⚠️	268s	58s	+362%
poly_pointwise_montgomery_c	⚠️	260s	114s	+128%
sign_signature_internal	⚠️	181s	26s	+596%
mld_invntt_layer	✅	112s	107s	+5%
compute_pack_t0_t1	✅	74s	50s	+48%
sig_unpack_hints	⚠️	67s	2s	+3250%
mld_ntt_layer	✅	44s	42s	+5%
fqmul	✅	40s	39s	+3%
sign_pk_from_sk	⚠️	37s	5s	+640%
polyvec_matrix_expand	✅	32s	28s	+14%
keccakf1600x4_permute_native	✅	22s	22s	+0%
mld_ntt_butterfly_block	✅	21s	23s	-9%
poly_ntt_c	✅	19s	19s	+0%
polyeta_unpack	✅	16s	14s	+14%
polyt0_unpack	✅	15s	15s	+0%
rej_uniform	✅	15s	18s	-17%
rej_uniform_c	✅	15s	15s	+0%
rej_uniform_native_x86_64	✅	15s	-	new
sign_keypair_internal	✅	15s	4s	+275%
polyvec_matrix_pointwise_montgomery_yvec	✅	14s	15s	-7%
poly_uniform_4x	✅	13s	14s	-7%
polyvec_matrix_expand_serial	✅	13s	8s	+62%
poly_chknorm_c	✅	12s	17s	-29%
poly_uniform_eta_4x	✅	12s	11s	+9%
polyz_unpack_c	✅	12s	11s	+9%
mld_compute_pack_z	✅	11s	7s	+57%
poly_invntt_tomont_c	✅	10s	11s	-9%
polyvecl_ntt	✅	10s	2s	+400%
polyveck_chknorm	✅	9s	5s	+80%
polyvecl_chknorm	✅	9s	10s	-10%
sign_keypair	✅	9s	4s	+125%
keccak_absorb	✅	8s	5s	+60%
keccak_absorb_once_x4	✅	8s	9s	-11%
mld_keccakf1600_permute_c	✅	8s	8s	+0%
poly_challenge	✅	8s	3s	+167%
poly_shiftl	✅	8s	3s	+167%
pointwise_acc_native_x86_64	✅	7s	7s	+0%
poly_add	✅	7s	7s	+0%
poly_power2round	✅	7s	4s	+75%
poly_uniform_eta	✅	7s	5s	+40%
polyveck_decompose_pack_w1	✅	7s	-	new
sign_verify_pre_hash_shake256	✅	7s	5s	+40%
keccak_squeezeblocks_x4	✅	6s	4s	+50%
mld_check_pct	✅	6s	14s	-57%
mld_sign_resume	✅	6s	-	new
montgomery_reduce	✅	6s	3s	+100%
poly_chknorm	✅	6s	4s	+50%
poly_uniform_gamma1_4x	✅	6s	5s	+20%
polyveck_caddq	✅	6s	3s	+100%
polyveck_ntt	✅	6s	5s	+20%
polyw1_unpack_88	✅	6s	-	new
sign_signature	✅	6s	3s	+100%
sign_verify_pre_hash_internal	✅	6s	3s	+100%
caddq	✅	5s	2s	+150%
keccak_f1600_x4_native_avx2	✅	5s	3s	+67%
mld_sample_s1_s2_serial	✅	5s	3s	+67%
mld_sign_attempt	✅	5s	-	new
ntt_native_x86_64	✅	5s	3s	+67%
pack_sig_h	✅	5s	3s	+67%
pointwise_acc_native_aarch64	✅	5s	4s	+25%
poly_chknorm_native	✅	5s	4s	+25%
poly_ntt	✅	5s	3s	+67%
rej_eta_native	✅	5s	6s	-17%
rej_uniform_native	✅	5s	4s	+25%
sign_verify_extmu	✅	5s	3s	+67%
keccak_f1600_x4_native_aarch64_v84a	✅	4s	2s	+100%
keccakf1600_permute	✅	4s	2s	+100%
keccakf1600_xor_bytes (big endian)	✅	4s	4s	+0%
mld_prepare_domain_separation_prefix	✅	4s	4s	+0%
mld_value_barrier_i64	✅	4s	2s	+100%
ntt_native_aarch64	✅	4s	3s	+33%
nttunpack_native_x86_64	✅	4s	1s	+300%
pack_sk_rho_key_tr_s2	✅	4s	3s	+33%
pack_sk_s1	✅	4s	2s	+100%
poly_caddq_native_x86_64	✅	4s	4s	+0%
poly_chknorm_native_x86_64	✅	4s	2s	+100%
poly_decompose_32_native_aarch64	✅	4s	2s	+100%
poly_decompose_native	✅	4s	3s	+33%
poly_invntt_tomont	✅	4s	4s	+0%
poly_permute_bitrev_to_custom_optional_native	✅	4s	4s	+0%
poly_pointwise_montgomery	✅	4s	3s	+33%
poly_uniform	✅	4s	6s	-33%
poly_uniform_gamma1	✅	4s	4s	+0%
poly_use_hint	✅	4s	4s	+0%
poly_use_hint_c	✅	4s	3s	+33%
polyt0_pack	✅	4s	2s	+100%
polyt1_pack	✅	4s	4s	+0%
polyveck_invntt_tomont	✅	4s	5s	-20%
polyvecl_pointwise_acc_montgomery	✅	4s	4s	+0%
polyvecl_pointwise_acc_montgomery_native	✅	4s	2s	+100%
polyw1_unpack	✅	4s	-	new
polyz_unpack_17_native_aarch64	✅	4s	5s	-20%
polyz_unpack_19_native_aarch64	✅	4s	5s	-20%
polyz_unpack_native	✅	4s	2s	+100%
rej_eta_c	✅	4s	4s	+0%
shake128x4_squeezeblocks	✅	4s	1s	+300%
shake256	✅	4s	1s	+300%
sign_signature_pre_hash_internal	✅	4s	6s	-33%
sign_signature_pre_hash_shake256	✅	4s	3s	+33%
sign_verify	✅	4s	4s	+0%
sk_s1hat_get_poly	✅	4s	3s	+33%
sk_s2hat_get_poly	✅	4s	2s	+100%
sys_check_capability	✅	4s	4s	+0%
unpack_sk_s2hat	✅	4s	4s	+0%
intt_native_aarch64	✅	3s	9s	-67%
intt_native_x86_64	✅	3s	4s	-25%
keccak_f1600_x1_native_aarch64	✅	3s	2s	+50%
keccak_f1600_x1_native_aarch64_v84a	✅	3s	3s	+0%
keccak_finalize	✅	3s	3s	+0%
keccakf1600_extract_bytes (big endian)	✅	3s	2s	+50%
keccakf1600_permute_native	✅	3s	3s	+0%
keccakf1600_xor_bytes	✅	3s	1s	+200%
keccakf1600x4_extract_bytes	✅	3s	2s	+50%
keccakf1600x4_extract_bytes_native	✅	3s	3s	+0%
keccakf1600x4_permute	✅	3s	4s	-25%
keccakf1600x4_xor_bytes	✅	3s	2s	+50%
mld_ct_cmask_neg_i32	✅	3s	3s	+0%
mld_ct_sel_int32	✅	3s	2s	+50%
mld_keccakf1600x4_extract_bytes_c	✅	3s	2s	+50%
mld_keccakf1600x4_xor_bytes_c	✅	3s	2s	+50%
mld_sign_finish	✅	3s	-	new
pack_sig_z	✅	3s	4s	-25%
poly_caddq_c	✅	3s	2s	+50%
poly_chknorm_native_aarch64	✅	3s	4s	-25%
poly_decompose_88_native_aarch64	✅	3s	4s	-25%
poly_decompose_c	✅	3s	4s	-25%
poly_decompose_native_x86_64	✅	3s	3s	+0%
poly_invntt_tomont_native	✅	3s	4s	-25%
poly_ntt_native	✅	3s	5s	-40%
poly_permute_bitrev_to_custom_optional	✅	3s	2s	+50%
poly_sub	✅	3s	3s	+0%
poly_use_hint_native_aarch64	✅	3s	2s	+50%
poly_use_hint_native_x86_64	✅	3s	-	new
polyveck_pack_eta	✅	3s	2s	+50%
polyveck_unpack_eta	✅	3s	2s	+50%
polyvecl_uniform_gamma1_serial	✅	3s	2s	+50%
polyvecl_unpack_z	✅	3s	2s	+50%
polyw1_pack	✅	3s	3s	+0%
polyz_pack	✅	3s	2s	+50%
polyz_unpack	✅	3s	3s	+0%
reduce32	✅	3s	2s	+50%
rej_eta	✅	3s	3s	+0%
rej_uniform_eta_native_aarch64	✅	3s	2s	+50%
rej_uniform_native_aarch64	✅	3s	5s	-40%
shake128_finalize	✅	3s	2s	+50%
shake128_init	✅	3s	3s	+0%
shake128_release	✅	3s	1s	+200%
shake128_squeeze	✅	3s	1s	+200%
shake128x4_absorb_once	✅	3s	3s	+0%
shake256_absorb	✅	3s	3s	+0%
shake256_release	✅	3s	2s	+50%
shake256_squeeze	✅	3s	2s	+50%
shake256x4_absorb_once	✅	3s	3s	+0%
shake256x4_squeezeblocks	✅	3s	4s	-25%
unpack_sk	✅	3s	3s	+0%
use_hint	✅	3s	2s	+50%
yvec_init	✅	3s	3s	+0%
fqscale	✅	2s	3s	-33%
keccak_f1600_x4_native_aarch64_v8a_scalar_hybrid	✅	2s	3s	-33%
keccak_f1600_x4_native_aarch64_v8a_v84a_scalar_hybrid	✅	2s	1s	+100%
keccak_squeeze	✅	2s	1s	+100%
keccakf1600x4_xor_bytes_native	✅	2s	3s	-33%
make_hint	✅	2s	3s	-33%
mld_ct_abs_i32	✅	2s	2s	+0%
mld_ct_cmask_nonzero_u32	✅	2s	2s	+0%
mld_ct_cmask_nonzero_u8	✅	2s	2s	+0%
mld_ct_get_optblocker_i64	✅	2s	4s	-50%
mld_ct_get_optblocker_u32	✅	2s	1s	+100%
mld_ct_get_optblocker_u8	✅	2s	1s	+100%
mld_ct_memcmp	✅	2s	3s	-33%
mld_h	✅	2s	4s	-50%
mld_polymat_expand_entry	✅	2s	3s	-33%
mld_sample_s1_s2	✅	2s	4s	-50%
mld_value_barrier_u8	✅	2s	3s	-33%
pack_sig_c	✅	2s	2s	+0%
pointwise_native_aarch64	✅	2s	5s	-60%
pointwise_native_x86_64	✅	2s	4s	-50%
poly_caddq	✅	2s	2s	+0%
poly_caddq_native_aarch64	✅	2s	4s	-50%
poly_decompose	✅	2s	3s	-33%
poly_pointwise_montgomery_native	✅	2s	2s	+0%
poly_reduce	✅	2s	3s	-33%
poly_use_hint_native	✅	2s	4s	-50%
polyeta_pack	✅	2s	3s	-33%
polyt1_unpack	✅	2s	5s	-60%
polyvec_matrix_pointwise_montgomery_row	✅	2s	2s	+0%
polyvecl_pack_eta	✅	2s	3s	-33%
polyvecl_unpack_eta	✅	2s	2s	+0%
polyw1_pack_32	✅	2s	2s	+0%
polyw1_pack_88	✅	2s	1s	+100%
polyw1_unpack_32	✅	2s	-	new
polyz_unpack_native_x86_64	✅	2s	3s	-33%
power2round	✅	2s	3s	-33%
rej_uniform_eta_native_x86_64	✅	2s	-	new
shake128_absorb	✅	2s	2s	+0%
shake256_finalize	✅	2s	2s	+0%
shake256_init	✅	2s	3s	-33%
sign_signature_extmu	✅	2s	4s	-50%
sk_t0hat_get_poly	✅	2s	2s	+0%
unpack_pk_t1	✅	2s	5s	-60%
unpack_sk_s1hat	✅	2s	1s	+100%
unpack_sk_t0hat	✅	2s	3s	-33%
yvec_get_poly	✅	2s	3s	-33%
decompose	✅	1s	2s	-50%
keccak_init	✅	1s	3s	-67%
mld_keccakf1600_extract_bytes	✅	1s	2s	-50%
mld_value_barrier_u32	✅	1s	2s	-50%
poly_caddq_native	✅	1s	5s	-80%
polyveck_reduce	✅	1s	5s	-80%
polyvecl_uniform_gamma1	✅	1s	3s	-67%

[oqs-bot]

CBMC Results (ML-DSA-65)

⚠️ Attention Required

Proof	Status	Current	Previous	Change
**TOTAL**	⚠️	2502s	1784s	+40.2%
compute_pack_t0_t1	⚠️	73s	13s	+462%
mld_attempt_signature_generation	⚠️	279s	63s	+343%
poly_pointwise_montgomery_c	⚠️	255s	125s	+104%
sig_unpack_hints	⚠️	22s	2s	+1000%
sign_pk_from_sk	⚠️	41s	6s	+583%
sign_signature_internal	⚠️	97s	55s	+76%
sign_verify_internal	⚠️	318s	177s	+80%

Full Results (212 proofs)

Proof	Status	Current	Previous	Change
**TOTAL**	⚠️	2502s	1784s	+40.2%
sign_verify_internal	⚠️	318s	177s	+80%
mld_attempt_signature_generation	⚠️	279s	63s	+343%
poly_pointwise_montgomery_c	⚠️	255s	125s	+104%
polyvecl_pointwise_acc_montgomery_c	✅	207s	210s	-1%
polyvec_matrix_expand	✅	117s	110s	+6%
mld_invntt_layer	✅	116s	109s	+6%
sign_signature_internal	⚠️	97s	55s	+76%
compute_pack_t0_t1	⚠️	73s	13s	+462%
mld_ntt_layer	✅	42s	41s	+2%
fqmul	✅	41s	40s	+2%
sign_pk_from_sk	⚠️	41s	6s	+583%
polyvec_matrix_expand_serial	✅	26s	27s	-4%
mld_ntt_butterfly_block	✅	22s	24s	-8%
sig_unpack_hints	⚠️	22s	2s	+1000%
keccakf1600x4_permute_native	✅	21s	23s	-9%
poly_ntt_c	✅	20s	19s	+5%
polyt0_unpack	✅	17s	16s	+6%
polyvec_matrix_pointwise_montgomery_yvec	✅	17s	18s	-6%
rej_uniform	✅	17s	18s	-6%
rej_uniform_native_x86_64	✅	17s	-	new
rej_uniform_c	✅	15s	14s	+7%
sign_keypair_internal	✅	15s	5s	+200%
poly_uniform_4x	✅	13s	13s	+0%
poly_chknorm_c	✅	12s	15s	-20%
poly_invntt_tomont_c	✅	12s	11s	+9%
poly_uniform_eta_4x	✅	11s	14s	-21%
polyz_unpack_c	✅	10s	13s	-23%
sign_keypair	✅	10s	3s	+233%
keccak_absorb_once_x4	✅	9s	8s	+12%
poly_decompose_c	✅	9s	5s	+80%
polyveck_invntt_tomont	✅	9s	8s	+12%
mld_check_pct	✅	8s	14s	-43%
mld_compute_pack_z	✅	8s	7s	+14%
poly_use_hint_c	✅	8s	5s	+60%
polyveck_ntt	✅	8s	7s	+14%
poly_power2round	✅	7s	4s	+75%
polyveck_decompose_pack_w1	✅	7s	-	new
mld_keccakf1600_permute_c	✅	6s	6s	+0%
pointwise_acc_native_aarch64	✅	6s	6s	+0%
pointwise_acc_native_x86_64	✅	6s	8s	-25%
poly_add	✅	6s	9s	-33%
poly_decompose_native_x86_64	✅	6s	3s	+100%
polyt1_unpack	✅	6s	5s	+20%
polyveck_caddq	✅	6s	6s	+0%
polyveck_chknorm	✅	6s	6s	+0%
polyvecl_ntt	✅	6s	4s	+50%
polyvecl_unpack_eta	✅	6s	3s	+100%
sign_signature_extmu	✅	6s	2s	+200%
keccak_absorb	✅	5s	3s	+67%
keccakf1600x4_xor_bytes_native	✅	5s	3s	+67%
mld_sample_s1_s2	✅	5s	6s	-17%
mld_sign_attempt	✅	5s	-	new
pointwise_native_x86_64	✅	5s	3s	+67%
poly_challenge	✅	5s	6s	-17%
poly_invntt_tomont_native	✅	5s	2s	+150%
poly_ntt	✅	5s	2s	+150%
poly_uniform_gamma1_4x	✅	5s	4s	+25%
poly_use_hint_native_aarch64	✅	5s	3s	+67%
polyw1_unpack_32	✅	5s	-	new
reduce32	✅	5s	3s	+67%
unpack_sk	✅	5s	3s	+67%
unpack_sk_t0hat	✅	5s	5s	+0%
caddq	✅	4s	3s	+33%
fqscale	✅	4s	3s	+33%
intt_native_x86_64	✅	4s	3s	+33%
keccak_f1600_x4_native_aarch64_v8a_scalar_hybrid	✅	4s	2s	+100%
keccak_squeezeblocks_x4	✅	4s	5s	-20%
keccakf1600_extract_bytes (big endian)	✅	4s	2s	+100%
keccakf1600x4_xor_bytes	✅	4s	1s	+300%
mld_h	✅	4s	2s	+100%
mld_sample_s1_s2_serial	✅	4s	4s	+0%
mld_sign_finish	✅	4s	-	new
mld_sign_resume	✅	4s	-	new
mld_value_barrier_u8	✅	4s	3s	+33%
montgomery_reduce	✅	4s	4s	+0%
nttunpack_native_x86_64	✅	4s	3s	+33%
pack_sk_rho_key_tr_s2	✅	4s	2s	+100%
poly_caddq_native	✅	4s	2s	+100%
poly_ntt_native	✅	4s	4s	+0%
poly_permute_bitrev_to_custom_optional_native	✅	4s	4s	+0%
poly_reduce	✅	4s	3s	+33%
poly_shiftl	✅	4s	3s	+33%
poly_uniform_eta	✅	4s	4s	+0%
poly_use_hint_native_x86_64	✅	4s	-	new
polyeta_pack	✅	4s	3s	+33%
polyeta_unpack	✅	4s	8s	-50%
polyveck_reduce	✅	4s	4s	+0%
polyveck_unpack_eta	✅	4s	6s	-33%
polyvecl_chknorm	✅	4s	7s	-43%
polyvecl_pointwise_acc_montgomery_native	✅	4s	2s	+100%
polyw1_pack_32	✅	4s	4s	+0%
polyw1_unpack	✅	4s	-	new
rej_eta_c	✅	4s	5s	-20%
rej_uniform_eta_native_aarch64	✅	4s	4s	+0%
rej_uniform_eta_native_x86_64	✅	4s	-	new
rej_uniform_native	✅	4s	4s	+0%
shake256_release	✅	4s	2s	+100%
sign_signature_pre_hash_internal	✅	4s	3s	+33%
sign_signature_pre_hash_shake256	✅	4s	3s	+33%
sign_verify_extmu	✅	4s	3s	+33%
sign_verify_pre_hash_shake256	✅	4s	5s	-20%
sk_t0hat_get_poly	✅	4s	2s	+100%
sys_check_capability	✅	4s	4s	+0%
yvec_get_poly	✅	4s	3s	+33%
decompose	✅	3s	1s	+200%
intt_native_aarch64	✅	3s	3s	+0%
keccak_f1600_x1_native_aarch64	✅	3s	2s	+50%
keccak_f1600_x4_native_aarch64_v84a	✅	3s	4s	-25%
keccak_f1600_x4_native_aarch64_v8a_v84a_scalar_hybrid	✅	3s	2s	+50%
keccakf1600_permute	✅	3s	2s	+50%
keccakf1600_xor_bytes (big endian)	✅	3s	2s	+50%
make_hint	✅	3s	2s	+50%
mld_ct_abs_i32	✅	3s	2s	+50%
mld_ct_cmask_neg_i32	✅	3s	2s	+50%
mld_ct_cmask_nonzero_u32	✅	3s	4s	-25%
mld_ct_cmask_nonzero_u8	✅	3s	3s	+0%
mld_ct_get_optblocker_i64	✅	3s	2s	+50%
mld_ct_memcmp	✅	3s	2s	+50%
mld_keccakf1600_extract_bytes	✅	3s	1s	+200%
mld_keccakf1600x4_extract_bytes_c	✅	3s	3s	+0%
mld_keccakf1600x4_xor_bytes_c	✅	3s	2s	+50%
mld_polymat_expand_entry	✅	3s	4s	-25%
mld_prepare_domain_separation_prefix	✅	3s	2s	+50%
mld_value_barrier_u32	✅	3s	3s	+0%
ntt_native_aarch64	✅	3s	2s	+50%
ntt_native_x86_64	✅	3s	2s	+50%
pack_sig_h	✅	3s	5s	-40%
pack_sk_s1	✅	3s	5s	-40%
poly_caddq	✅	3s	2s	+50%
poly_caddq_native_aarch64	✅	3s	2s	+50%
poly_chknorm	✅	3s	4s	-25%
poly_chknorm_native	✅	3s	2s	+50%
poly_decompose_88_native_aarch64	✅	3s	1s	+200%
poly_invntt_tomont	✅	3s	3s	+0%
poly_pointwise_montgomery	✅	3s	3s	+0%
poly_sub	✅	3s	3s	+0%
poly_uniform	✅	3s	4s	-25%
poly_uniform_gamma1	✅	3s	3s	+0%
poly_use_hint	✅	3s	3s	+0%
polyt0_pack	✅	3s	3s	+0%
polyt1_pack	✅	3s	3s	+0%
polyvec_matrix_pointwise_montgomery_row	✅	3s	1s	+200%
polyvecl_pack_eta	✅	3s	3s	+0%
polyvecl_pointwise_acc_montgomery	✅	3s	3s	+0%
polyvecl_uniform_gamma1	✅	3s	2s	+50%
polyvecl_uniform_gamma1_serial	✅	3s	3s	+0%
polyvecl_unpack_z	✅	3s	3s	+0%
polyw1_pack_88	✅	3s	2s	+50%
polyw1_unpack_88	✅	3s	-	new
polyz_unpack	✅	3s	3s	+0%
polyz_unpack_native	✅	3s	4s	-25%
polyz_unpack_native_x86_64	✅	3s	3s	+0%
rej_uniform_native_aarch64	✅	3s	3s	+0%
shake128_absorb	✅	3s	2s	+50%
shake128_init	✅	3s	2s	+50%
shake128_release	✅	3s	3s	+0%
shake256_finalize	✅	3s	1s	+200%
shake256_init	✅	3s	2s	+50%
sign_verify	✅	3s	3s	+0%
sign_verify_pre_hash_internal	✅	3s	5s	-40%
sk_s1hat_get_poly	✅	3s	6s	-50%
sk_s2hat_get_poly	✅	3s	2s	+50%
yvec_init	✅	3s	3s	+0%
keccak_f1600_x1_native_aarch64_v84a	✅	2s	3s	-33%
keccak_f1600_x4_native_avx2	✅	2s	2s	+0%
keccak_finalize	✅	2s	2s	+0%
keccak_init	✅	2s	1s	+100%
keccakf1600_permute_native	✅	2s	3s	-33%
keccakf1600_xor_bytes	✅	2s	2s	+0%
keccakf1600x4_extract_bytes	✅	2s	4s	-50%
keccakf1600x4_permute	✅	2s	4s	-50%
mld_ct_sel_int32	✅	2s	3s	-33%
mld_value_barrier_i64	✅	2s	2s	+0%
pack_sig_z	✅	2s	2s	+0%
pointwise_native_aarch64	✅	2s	5s	-60%
poly_caddq_c	✅	2s	2s	+0%
poly_chknorm_native_aarch64	✅	2s	3s	-33%
poly_chknorm_native_x86_64	✅	2s	3s	-33%
poly_decompose	✅	2s	2s	+0%
poly_decompose_32_native_aarch64	✅	2s	3s	-33%
poly_decompose_native	✅	2s	3s	-33%
poly_permute_bitrev_to_custom_optional	✅	2s	2s	+0%
poly_pointwise_montgomery_native	✅	2s	3s	-33%
poly_use_hint_native	✅	2s	2s	+0%
polyz_pack	✅	2s	3s	-33%
polyz_unpack_19_native_aarch64	✅	2s	3s	-33%
power2round	✅	2s	1s	+100%
rej_eta	✅	2s	2s	+0%
shake128_finalize	✅	2s	1s	+100%
shake128x4_absorb_once	✅	2s	3s	-33%
shake128x4_squeezeblocks	✅	2s	3s	-33%
shake256_absorb	✅	2s	2s	+0%
shake256_squeeze	✅	2s	3s	-33%
shake256x4_absorb_once	✅	2s	3s	-33%
shake256x4_squeezeblocks	✅	2s	2s	+0%
sign_signature	✅	2s	6s	-67%
unpack_pk_t1	✅	2s	5s	-60%
unpack_sk_s1hat	✅	2s	2s	+0%
use_hint	✅	2s	2s	+0%
keccak_squeeze	✅	1s	4s	-75%
keccakf1600x4_extract_bytes_native	✅	1s	4s	-75%
mld_ct_get_optblocker_u32	✅	1s	3s	-67%
mld_ct_get_optblocker_u8	✅	1s	2s	-50%
pack_sig_c	✅	1s	5s	-80%
poly_caddq_native_x86_64	✅	1s	3s	-67%
polyveck_pack_eta	✅	1s	4s	-75%
polyw1_pack	✅	1s	4s	-75%
polyz_unpack_17_native_aarch64	✅	1s	3s	-67%
rej_eta_native	✅	1s	3s	-67%
shake128_squeeze	✅	1s	2s	-50%
shake256	✅	1s	2s	-50%
unpack_sk_s2hat	✅	1s	4s	-75%

[oqs-bot]

CBMC Results (ML-DSA-44, REDUCE-RAM)

⚠️ Attention Required

Proof	Status	Current	Previous	Change
**TOTAL**	⚠️	1984s	1364s	+45.5%
compute_pack_t0_t1	⚠️	42s	12s	+250%
mld_attempt_signature_generation	⚠️	181s	19s	+853%
rej_uniform_c	⚠️	24s	16s	+50%
sig_unpack_hints	⚠️	29s	2s	+1350%
sign_pk_from_sk	⚠️	42s	5s	+740%
sign_verify_internal	⚠️	286s	49s	+484%

Full Results (212 proofs)

Proof	Status	Current	Previous	Change
**TOTAL**	⚠️	1984s	1364s	+45.5%
sign_verify_internal	⚠️	286s	49s	+484%
polyvec_matrix_pointwise_montgomery_yvec	✅	193s	149s	+30%
mld_attempt_signature_generation	⚠️	181s	19s	+853%
poly_pointwise_montgomery_c	✅	126s	112s	+12%
mld_invntt_layer	✅	115s	105s	+10%
mld_ntt_layer	✅	45s	41s	+10%
compute_pack_t0_t1	⚠️	42s	12s	+250%
sign_pk_from_sk	⚠️	42s	5s	+740%
fqmul	✅	41s	39s	+5%
sig_unpack_hints	⚠️	29s	2s	+1350%
rej_uniform_c	⚠️	24s	16s	+50%
keccakf1600x4_permute_native	✅	23s	22s	+5%
mld_ntt_butterfly_block	✅	23s	23s	+0%
poly_ntt_c	✅	20s	21s	-5%
sign_signature_internal	✅	18s	4s	+350%
polyeta_unpack	✅	16s	14s	+14%
rej_uniform	✅	16s	8s	+100%
rej_uniform_native_x86_64	✅	15s	-	new
polyt0_unpack	✅	14s	12s	+17%
sign_keypair_internal	✅	14s	4s	+250%
poly_chknorm_c	✅	12s	11s	+9%
poly_invntt_tomont_c	✅	12s	11s	+9%
poly_uniform_eta_4x	✅	12s	12s	+0%
polyz_unpack_c	✅	12s	8s	+50%
polyvec_matrix_pointwise_montgomery_row	✅	11s	6s	+83%
sign_keypair	✅	9s	5s	+80%
keccak_absorb_once_x4	✅	8s	8s	+0%
poly_challenge	✅	8s	6s	+33%
mld_check_pct	✅	7s	15s	-53%
mld_compute_pack_z	✅	7s	6s	+17%
mld_keccakf1600_permute_c	✅	7s	7s	+0%
pointwise_acc_native_x86_64	✅	7s	4s	+75%
polyvecl_ntt	✅	7s	3s	+133%
rej_uniform_native	✅	7s	5s	+40%
intt_native_aarch64	✅	6s	3s	+100%
intt_native_x86_64	✅	6s	2s	+200%
keccak_absorb	✅	6s	3s	+100%
keccak_squeezeblocks_x4	✅	6s	3s	+100%
pointwise_acc_native_aarch64	✅	6s	6s	+0%
poly_add	✅	6s	7s	-14%
poly_power2round	✅	6s	4s	+50%
poly_uniform_gamma1	✅	6s	3s	+100%
poly_use_hint_native_aarch64	✅	6s	3s	+100%
polyveck_caddq	✅	6s	3s	+100%
polyveck_chknorm	✅	6s	67s	-91%
polyveck_invntt_tomont	✅	6s	5s	+20%
polyz_unpack_19_native_aarch64	✅	6s	4s	+50%
rej_eta_native	✅	6s	3s	+100%
unpack_sk_t0hat	✅	6s	2s	+200%
keccak_squeeze	✅	5s	2s	+150%
keccakf1600x4_xor_bytes_native	✅	5s	5s	+0%
mld_ct_cmask_nonzero_u8	✅	5s	2s	+150%
mld_sign_attempt	✅	5s	-	new
nttunpack_native_x86_64	✅	5s	4s	+25%
poly_decompose	✅	5s	2s	+150%
poly_decompose_32_native_aarch64	✅	5s	4s	+25%
poly_ntt	✅	5s	3s	+67%
poly_uniform	✅	5s	3s	+67%
poly_use_hint_native	✅	5s	3s	+67%
polyt1_unpack	✅	5s	2s	+150%
polyvecl_chknorm	✅	5s	11s	-55%
polyvecl_pointwise_acc_montgomery_native	✅	5s	3s	+67%
polyw1_unpack	✅	5s	-	new
polyz_unpack_native_x86_64	✅	5s	3s	+67%
rej_uniform_eta_native_aarch64	✅	5s	3s	+67%
shake256x4_absorb_once	✅	5s	1s	+400%
sign_signature_pre_hash_internal	✅	5s	4s	+25%
sign_signature_pre_hash_shake256	✅	5s	4s	+25%
sign_verify_extmu	✅	5s	5s	+0%
keccak_f1600_x1_native_aarch64	✅	4s	3s	+33%
keccakf1600_xor_bytes	✅	4s	3s	+33%
mld_ct_abs_i32	✅	4s	3s	+33%
mld_ct_cmask_nonzero_u32	✅	4s	3s	+33%
mld_h	✅	4s	4s	+0%
mld_sample_s1_s2_serial	✅	4s	4s	+0%
mld_sign_resume	✅	4s	-	new
ntt_native_aarch64	✅	4s	4s	+0%
poly_caddq_native	✅	4s	3s	+33%
poly_caddq_native_x86_64	✅	4s	4s	+0%
poly_chknorm_native_aarch64	✅	4s	2s	+100%
poly_ntt_native	✅	4s	3s	+33%
poly_permute_bitrev_to_custom_optional_native	✅	4s	3s	+33%
poly_pointwise_montgomery_native	✅	4s	2s	+100%
poly_reduce	✅	4s	4s	+0%
poly_uniform_4x	✅	4s	3s	+33%
poly_uniform_eta	✅	4s	2s	+100%
poly_use_hint	✅	4s	2s	+100%
polyeta_pack	✅	4s	3s	+33%
polyt0_pack	✅	4s	4s	+0%
polyveck_decompose_pack_w1	✅	4s	-	new
polyveck_reduce	✅	4s	4s	+0%
polyw1_pack_88	✅	4s	2s	+100%
polyw1_unpack_88	✅	4s	-	new
polyz_unpack_native	✅	4s	3s	+33%
power2round	✅	4s	2s	+100%
shake128_absorb	✅	4s	3s	+33%
shake128x4_squeezeblocks	✅	4s	2s	+100%
shake256	✅	4s	1s	+300%
sign_verify	✅	4s	4s	+0%
sign_verify_pre_hash_internal	✅	4s	5s	-20%
sign_verify_pre_hash_shake256	✅	4s	5s	-20%
unpack_sk	✅	4s	3s	+33%
unpack_sk_s2hat	✅	4s	4s	+0%
use_hint	✅	4s	2s	+100%
decompose	✅	3s	3s	+0%
keccak_f1600_x4_native_aarch64_v8a_scalar_hybrid	✅	3s	2s	+50%
keccak_f1600_x4_native_aarch64_v8a_v84a_scalar_hybrid	✅	3s	3s	+0%
keccak_f1600_x4_native_avx2	✅	3s	2s	+50%
keccakf1600x4_extract_bytes_native	✅	3s	4s	-25%
mld_ct_memcmp	✅	3s	1s	+200%
mld_sign_finish	✅	3s	-	new
mld_value_barrier_u8	✅	3s	4s	-25%
pack_sig_h	✅	3s	4s	-25%
pack_sk_rho_key_tr_s2	✅	3s	5s	-40%
pack_sk_s1	✅	3s	3s	+0%
pointwise_native_x86_64	✅	3s	4s	-25%
poly_caddq	✅	3s	4s	-25%
poly_caddq_native_aarch64	✅	3s	3s	+0%
poly_chknorm	✅	3s	3s	+0%
poly_chknorm_native	✅	3s	4s	-25%
poly_decompose_88_native_aarch64	✅	3s	3s	+0%
poly_decompose_c	✅	3s	5s	-40%
poly_decompose_native_x86_64	✅	3s	2s	+50%
poly_invntt_tomont_native	✅	3s	3s	+0%
poly_permute_bitrev_to_custom_optional	✅	3s	5s	-40%
poly_pointwise_montgomery	✅	3s	3s	+0%
poly_uniform_gamma1_4x	✅	3s	5s	-40%
poly_use_hint_c	✅	3s	5s	-40%
poly_use_hint_native_x86_64	✅	3s	-	new
polyvec_matrix_expand	✅	3s	3s	+0%
polyvec_matrix_expand_serial	✅	3s	4s	-25%
polyveck_ntt	✅	3s	2s	+50%
polyvecl_uniform_gamma1	✅	3s	2s	+50%
polyw1_unpack_32	✅	3s	-	new
polyz_unpack_17_native_aarch64	✅	3s	2s	+50%
reduce32	✅	3s	3s	+0%
rej_eta	✅	3s	5s	-40%
rej_eta_c	✅	3s	4s	-25%
rej_uniform_eta_native_x86_64	✅	3s	-	new
shake128_finalize	✅	3s	3s	+0%
shake256_init	✅	3s	4s	-25%
shake256_release	✅	3s	1s	+200%
sign_signature	✅	3s	6s	-50%
sign_signature_extmu	✅	3s	4s	-25%
sk_s1hat_get_poly	✅	3s	2s	+50%
sys_check_capability	✅	3s	2s	+50%
unpack_pk_t1	✅	3s	3s	+0%
yvec_init	✅	3s	1s	+200%
caddq	✅	2s	6s	-67%
fqscale	✅	2s	2s	+0%
keccak_f1600_x4_native_aarch64_v84a	✅	2s	3s	-33%
keccak_init	✅	2s	3s	-33%
keccakf1600_permute	✅	2s	2s	+0%
keccakf1600_permute_native	✅	2s	3s	-33%
keccakf1600_xor_bytes (big endian)	✅	2s	6s	-67%
keccakf1600x4_extract_bytes	✅	2s	2s	+0%
keccakf1600x4_permute	✅	2s	4s	-50%
keccakf1600x4_xor_bytes	✅	2s	3s	-33%
make_hint	✅	2s	3s	-33%
mld_ct_cmask_neg_i32	✅	2s	2s	+0%
mld_ct_get_optblocker_i64	✅	2s	4s	-50%
mld_ct_get_optblocker_u32	✅	2s	2s	+0%
mld_keccakf1600_extract_bytes	✅	2s	2s	+0%
mld_keccakf1600x4_extract_bytes_c	✅	2s	4s	-50%
mld_polymat_expand_entry	✅	2s	2s	+0%
mld_prepare_domain_separation_prefix	✅	2s	3s	-33%
mld_sample_s1_s2	✅	2s	1s	+100%
mld_value_barrier_i64	✅	2s	3s	-33%
mld_value_barrier_u32	✅	2s	1s	+100%
montgomery_reduce	✅	2s	2s	+0%
ntt_native_x86_64	✅	2s	3s	-33%
pack_sig_c	✅	2s	5s	-60%
pack_sig_z	✅	2s	2s	+0%
poly_caddq_c	✅	2s	3s	-33%
poly_chknorm_native_x86_64	✅	2s	2s	+0%
poly_invntt_tomont	✅	2s	2s	+0%
poly_shiftl	✅	2s	4s	-50%
polyveck_pack_eta	✅	2s	4s	-50%
polyveck_unpack_eta	✅	2s	2s	+0%
polyvecl_pack_eta	✅	2s	2s	+0%
polyvecl_pointwise_acc_montgomery	✅	2s	3s	-33%
polyvecl_uniform_gamma1_serial	✅	2s	2s	+0%
polyvecl_unpack_eta	✅	2s	4s	-50%
polyvecl_unpack_z	✅	2s	3s	-33%
polyw1_pack	✅	2s	4s	-50%
polyw1_pack_32	✅	2s	3s	-33%
polyz_pack	✅	2s	2s	+0%
polyz_unpack	✅	2s	3s	-33%
rej_uniform_native_aarch64	✅	2s	3s	-33%
shake128_release	✅	2s	2s	+0%
shake128_squeeze	✅	2s	2s	+0%
shake128x4_absorb_once	✅	2s	2s	+0%
shake256_squeeze	✅	2s	2s	+0%
shake256x4_squeezeblocks	✅	2s	2s	+0%
sk_t0hat_get_poly	✅	2s	1s	+100%
unpack_sk_s1hat	✅	2s	3s	-33%
yvec_get_poly	✅	2s	3s	-33%
keccak_f1600_x1_native_aarch64_v84a	✅	1s	2s	-50%
keccak_finalize	✅	1s	2s	-50%
keccakf1600_extract_bytes (big endian)	✅	1s	4s	-75%
mld_ct_get_optblocker_u8	✅	1s	2s	-50%
mld_ct_sel_int32	✅	1s	3s	-67%
mld_keccakf1600x4_xor_bytes_c	✅	1s	4s	-75%
pointwise_native_aarch64	✅	1s	2s	-50%
poly_decompose_native	✅	1s	2s	-50%
poly_sub	✅	1s	3s	-67%
polyt1_pack	✅	1s	3s	-67%
polyvecl_pointwise_acc_montgomery_c	✅	1s	4s	-75%
shake128_init	✅	1s	2s	-50%
shake256_absorb	✅	1s	2s	-50%
shake256_finalize	✅	1s	2s	-50%
sk_s2hat_get_poly	✅	1s	5s	-80%

[github-actions]

Arm Cortex-M55 (NUCLEO-N657X0-Q) benchmarks (opt)

Details

Benchmark suite	Current: 5d4def8	Previous: 054cbd9	Ratio
ML-DSA-44 keypair	2328425 cycles	2328440 cycles	1.00
ML-DSA-44 sign	17791719 cycles	17851737 cycles	1.00
ML-DSA-44 verify	2398854 cycles	2398876 cycles	1.00
ML-DSA-65 keypair	4025137 cycles	4025122 cycles	1.00
ML-DSA-65 sign	15034565 cycles	14793522 cycles	1.02
ML-DSA-65 verify	4012799 cycles	4012792 cycles	1.00
ML-DSA-87 keypair	6864894 cycles	6864887 cycles	1.00
ML-DSA-87 sign	25049136 cycles	24785157 cycles	1.01
ML-DSA-87 verify	6864405 cycles	6864412 cycles	1.00

This comment was automatically generated by workflow using github-action-benchmark.

[github-actions]

Arm Cortex-M55 (NUCLEO-N657X0-Q) benchmarks (no-opt)

Details

Benchmark suite	Current: 5d4def8	Previous: 054cbd9	Ratio
ML-DSA-44 keypair	2328425 cycles	2328440 cycles	1.00
ML-DSA-44 sign	17791719 cycles	17851737 cycles	1.00
ML-DSA-44 verify	2398854 cycles	2398876 cycles	1.00
ML-DSA-65 keypair	4025137 cycles	4025122 cycles	1.00
ML-DSA-65 sign	15034565 cycles	14793522 cycles	1.02
ML-DSA-65 verify	4012799 cycles	4012792 cycles	1.00
ML-DSA-87 keypair	6864894 cycles	6864887 cycles	1.00
ML-DSA-87 sign	25049136 cycles	24785157 cycles	1.01
ML-DSA-87 verify	6864405 cycles	6864412 cycles	1.00

This comment was automatically generated by workflow using github-action-benchmark.

[jakemas]

Interesting! What motivated this idea? Was it just from poking around in the area?

[mkannwischer]

Interesting! What motivated this idea? Was it just from poking around in the area?

The motivation is to reduce memory consumption during signing. For many consumers that's the biggest issue for ML-DSA so every KiB we can save is going to make someone more happy.

The idea isn't new. We've done that on embedded platforms for a while, see https://eprint.iacr.org/2022/323.
I was curious what the performance impact would be if we implemented it unconditionally and I'm happy to see that it seems to be negligible.

I still have to go through the implementation to see if something can be simplified. I'd be very happy to see this merged for v2.1 though. If this makes it into the release, we should also revisit keygen as that then needs more memory than signing which is only because I stopped optimizing after it was below signing memory.