Split ambiguous MLK_ERR_FAIL into specific error codes by hanno-becker · Pull Request #1852 · pq-code-package/mlkem-native

hanno-becker · 2026-08-05T04:43:38Z

Resolves: Split ambiguous MLK_ERR_FAIL into separate error codes #1846

Previously, MLK_ERR_FAIL was returned for several externally distinct failure conditions: a public key rejected by the FIPS 203 'modulus check', a secret key rejected by the FIPS 203 'hash check', and a failed pairwise consistency test (PCT). An integrator translating mlkem-native return codes into their own error space could not tell these apart without extra work.

This commit adds three dedicated error codes:

MLK_ERR_INVALID_PK (-4) check_pk / encaps rejected the public key
MLK_ERR_INVALID_SK (-5) check_sk / decaps rejected the secret key
MLK_ERR_PCT_FAIL (-6) keygen PCT self-test failed

The existing codes (-1..-3) are unchanged. In particular, MLK_ERR_FAIL remains, but is no longer returned by any function.

Since the key pair tested by the PCT was just generated by this library, a key check rejecting it hints at a faulty implementation rather than at bad input; mlk_check_pct therefore maps MLK_ERR_INVALID_{PK,SK} to MLK_ERR_PCT_FAIL and passes platform failures through unmodified.

The commit also makes the CBMC ensures contracts specific instead of admitting MLK_ERR_FAIL everywhere, and drops it from the indcpa contracts, which only ever return 0 or MLK_ERR_OUT_OF_MEMORY.

oqs-bot · 2026-08-05T05:25:27Z

CBMC Results (ML-KEM-768)

⚠️ Attention Required

Proof	Status	Current	Previous	Change
`mlk_indcpa_dec`	⚠️	23s	10s	+130%
`mlk_indcpa_enc`	⚠️	402s	252s	+60%
`mlk_polyvec_basemul_acc_montgomery_cached_c`	⚠️	82s	46s	+78%
`mlk_rej_uniform_c`	⚠️	183s	114s	+61%
`polyvec_basemul_acc_montgomery_cached_native`	⚠️	21s	14s	+50%

Full Results (191 proofs)

Proof	Status	Current	Previous	Change
`TOTAL`	✅	1699s	1645s	+3.3%
`mlk_indcpa_enc`	⚠️	402s	252s	+60%
`mlk_rej_uniform_c`	⚠️	183s	114s	+61%
`mlk_indcpa_keypair_derand`	✅	134s	318s	-58%
`mlk_polyvec_basemul_acc_montgomery_cached_c`	⚠️	82s	46s	+78%
`rej_uniform_native_aarch64`	✅	48s	45s	+7%
`poly_ntt_native`	✅	45s	39s	+15%
`mlk_poly_rej_uniform`	✅	39s	129s	-70%
`mlk_ntt_layer`	✅	38s	29s	+31%
`rej_uniform_native_x86_64`	✅	38s	55s	-31%
`mlk_poly_reduce_native`	✅	37s	34s	+9%
`mlk_keccak_squeezeblocks_x4`	✅	27s	24s	+12%
`mlk_indcpa_dec`	⚠️	23s	10s	+130%
`polyvec_basemul_acc_montgomery_cached_native`	⚠️	21s	14s	+50%
`keccakf1600x4_permute_native_x4`	✅	18s	21s	-14%
`mlk_poly_decompress_d10_native`	✅	18s	15s	+20%
`mlk_poly_decompress_d4_native`	✅	17s	12s	+42%
`mlk_polyvec_add`	✅	15s	12s	+25%
`mlk_poly_frommsg`	✅	12s	9s	+33%
`mlk_poly_frombytes_native`	✅	10s	8s	+25%
`mlk_poly_rej_uniform_x4`	✅	10s	5s	+100%
`kem_dec`	✅	9s	5s	+80%
`mlk_keccak_squeezeblocks`	✅	9s	8s	+12%
`mlk_ntt_butterfly_block`	✅	9s	7s	+29%
`mlk_keccak_squeeze_once`	✅	8s	7s	+14%
`mlk_poly_ntt`	✅	7s	5s	+40%
`mlk_check_pct`	✅	6s	3s	+100%
`mlk_invntt_layer`	✅	6s	4s	+50%
`mlk_keccak_absorb_once_x4`	✅	6s	5s	+20%
`polyvec_basemul_acc_montgomery_cached_k2_native_aarch64`	✅	6s	3s	+100%
`mlk_fqmul`	✅	5s	16s	-69%
`mlk_gen_matrix_serial`	✅	5s	2s	+150%
`mlk_keccakf1600_permute_c`	✅	5s	6s	-17%
`mlk_poly_add`	✅	5s	7s	-29%
`mlk_poly_compress_d5_native`	✅	5s	2s	+150%
`mlk_poly_decompress_d4_c`	✅	5s	4s	+25%
`mlk_poly_mulcache_compute_native`	✅	5s	1s	+400%
`mlk_poly_sub`	✅	5s	10s	-50%
`mlk_polyvec_ntt`	✅	5s	4s	+25%
`mlk_shake256x4`	✅	5s	3s	+67%
`mlk_value_barrier_u8`	✅	5s	2s	+150%
`poly_decompress_d10_native_x86_64`	✅	5s	5s	+0%
`poly_decompress_d4_native_x86_64`	✅	5s	6s	-17%
`poly_frombytes_native_x86_64`	✅	5s	5s	+0%
`poly_reduce_native_aarch64`	✅	5s	2s	+150%
`keccakf1600_permute_native`	✅	4s	3s	+33%
`kem_keypair`	✅	4s	2s	+100%
`kem_keypair_derand`	✅	4s	2s	+100%
`mlk_gen_matrix`	✅	4s	2s	+100%
`mlk_keccakf1600_extract_bytes`	✅	4s	4s	+0%
`mlk_keccakf1600_extract_bytes (big endian)`	✅	4s	2s	+100%
`mlk_keccakf1600x4_extract_bytes_c`	✅	4s	2s	+100%
`mlk_matvec_mul`	✅	4s	4s	+0%
`mlk_poly_compress_d10_native`	✅	4s	2s	+100%
`mlk_poly_frombytes_c`	✅	4s	4s	+0%
`mlk_poly_getnoise_eta1_4x_native`	✅	4s	3s	+33%
`mlk_poly_tobytes`	✅	4s	3s	+33%
`mlk_poly_tobytes_c`	✅	4s	1s	+300%
`mlk_polymat_permute_bitrev_to_custom`	✅	4s	3s	+33%
`mlk_polyvec_basemul_acc_montgomery_cached`	✅	4s	4s	+0%
`mlk_scalar_compress_d1`	✅	4s	2s	+100%
`mlk_shake128x4_absorb_once`	✅	4s	3s	+33%
`mlk_shake256`	✅	4s	2s	+100%
`nttunpack_native_x86_64`	✅	4s	3s	+33%
`intt_native_aarch64`	✅	3s	5s	-40%
`keccak_f1600_x4_native_aarch64_v8a_scalar_hybrid`	✅	3s	3s	+0%
`keccakf1600x4_xor_bytes_native`	✅	3s	2s	+50%
`kem_check_sk`	✅	3s	2s	+50%
`kem_enc`	✅	3s	2s	+50%
`kem_enc_derand`	✅	3s	3s	+0%
`mlk_ct_cmask_nonzero_u8`	✅	3s	4s	-25%
`mlk_ct_get_optblocker_u8`	✅	3s	2s	+50%
`mlk_ct_memcmp`	✅	3s	4s	-25%
`mlk_keccak_absorb_once`	✅	3s	3s	+0%
`mlk_keccakf1600_permute`	✅	3s	1s	+200%
`mlk_keccakf1600x4_extract_bytes`	✅	3s	4s	-25%
`mlk_keypair_getnoise_eta1`	✅	3s	2s	+50%
`mlk_poly_compress_d10`	✅	3s	2s	+50%
`mlk_poly_compress_d11_native`	✅	3s	4s	-25%
`mlk_poly_compress_d4_c`	✅	3s	1s	+200%
`mlk_poly_compress_du`	✅	3s	1s	+200%
`mlk_poly_decompress_d10`	✅	3s	2s	+50%
`mlk_poly_decompress_dv`	✅	3s	2s	+50%
`mlk_poly_getnoise_eta1122_4x`	✅	3s	1s	+200%
`mlk_poly_tomont`	✅	3s	1s	+200%
`mlk_poly_tomont_c`	✅	3s	3s	+0%
`mlk_poly_tomsg`	✅	3s	3s	+0%
`mlk_polyvec_permute_bitrev_to_custom`	✅	3s	1s	+200%
`mlk_polyvec_reduce`	✅	3s	1s	+200%
`mlk_polyvec_tobytes`	✅	3s	1s	+200%
`mlk_polyvec_tomont`	✅	3s	1s	+200%
`mlk_rej_uniform`	✅	3s	1s	+200%
`mlk_scalar_compress_d11`	✅	3s	1s	+200%
`mlk_scalar_signed_to_unsigned_q`	✅	3s	5s	-40%
`mlk_shake128_absorb_once`	✅	3s	1s	+200%
`mlk_value_barrier_u32`	✅	3s	2s	+50%
`poly_compress_d4_native_x86_64`	✅	3s	3s	+0%
`poly_decompress_d5_native_x86_64`	✅	3s	4s	-25%
`poly_tobytes_native_aarch64`	✅	3s	1s	+200%
`poly_tobytes_native_x86_64`	✅	3s	3s	+0%
`poly_tomont_native_x86_64`	✅	3s	1s	+200%
`polyvec_basemul_acc_montgomery_cached_k3_native_x86_64`	✅	3s	2s	+50%
`polyvec_basemul_acc_montgomery_cached_k4_native_aarch64`	✅	3s	1s	+200%
`keccak_f1600_x1_native_aarch64`	✅	2s	1s	+100%
`keccak_f1600_x1_native_aarch64_v84a`	✅	2s	3s	-33%
`keccak_f1600_x4_native_aarch64_v84a`	✅	2s	2s	+0%
`keccak_f1600_x4_native_avx2`	✅	2s	2s	+0%
`keccakf1600x4_extract_bytes_native`	✅	2s	3s	-33%
`kem_check_pk`	✅	2s	2s	+0%
`mlk_barrett_reduce`	✅	2s	2s	+0%
`mlk_ct_cmov_zero`	✅	2s	3s	-33%
`mlk_ct_get_optblocker_i32`	✅	2s	1s	+100%
`mlk_ct_get_optblocker_u32`	✅	2s	1s	+100%
`mlk_ct_sel_uint8`	✅	2s	1s	+100%
`mlk_enc_getnoise_eta1_eta2`	✅	2s	3s	-33%
`mlk_keccakf1600_xor_bytes (big endian)`	✅	2s	1s	+100%
`mlk_keccakf1600x4_permute`	✅	2s	4s	-50%
`mlk_keccakf1600x4_xor_bytes`	✅	2s	2s	+0%
`mlk_keccakf1600x4_xor_bytes_c`	✅	2s	1s	+100%
`mlk_montgomery_reduce`	✅	2s	1s	+100%
`mlk_poly_compress_d10_c`	✅	2s	2s	+0%
`mlk_poly_compress_d11_c`	✅	2s	1s	+100%
`mlk_poly_compress_d4`	✅	2s	3s	-33%
`mlk_poly_compress_d4_native`	✅	2s	3s	-33%
`mlk_poly_compress_d5`	✅	2s	2s	+0%
`mlk_poly_compress_d5_c`	✅	2s	1s	+100%
`mlk_poly_decompress_d10_c`	✅	2s	1s	+100%
`mlk_poly_decompress_d11`	✅	2s	2s	+0%
`mlk_poly_decompress_d11_native`	✅	2s	1s	+100%
`mlk_poly_decompress_d4`	✅	2s	3s	-33%
`mlk_poly_decompress_d5_native`	✅	2s	3s	-33%
`mlk_poly_decompress_du`	✅	2s	1s	+100%
`mlk_poly_getnoise_eta1_4x`	✅	2s	2s	+0%
`mlk_poly_getnoise_eta2`	✅	2s	2s	+0%
`mlk_poly_invntt_tomont`	✅	2s	4s	-50%
`mlk_poly_mulcache_compute`	✅	2s	2s	+0%
`mlk_poly_mulcache_compute_c`	✅	2s	2s	+0%
`mlk_poly_reduce`	✅	2s	2s	+0%
`mlk_poly_reduce_c`	✅	2s	3s	-33%
`mlk_poly_tomont_native`	✅	2s	3s	-33%
`mlk_polyvec_compress_du`	✅	2s	1s	+100%
`mlk_polyvec_decompress_du`	✅	2s	4s	-50%
`mlk_polyvec_invntt_tomont`	✅	2s	1s	+100%
`mlk_polyvec_mulcache_compute`	✅	2s	2s	+0%
`mlk_scalar_decompress_d4`	✅	2s	2s	+0%
`mlk_sha3_256`	✅	2s	2s	+0%
`mlk_shake128x4_squeezeblocks`	✅	2s	1s	+100%
`ntt_native_aarch64`	✅	2s	3s	-33%
`ntt_native_x86_64`	✅	2s	3s	-33%
`poly_compress_d10_native_x86_64`	✅	2s	5s	-60%
`poly_compress_d11_native_x86_64`	✅	2s	3s	-33%
`poly_compress_d5_native_x86_64`	✅	2s	2s	+0%
`poly_getnoise_eta1122_4x_native`	✅	2s	1s	+100%
`poly_mulcache_compute_native_aarch64`	✅	2s	6s	-67%
`poly_mulcache_compute_native_x86_64`	✅	2s	3s	-33%
`poly_reduce_native_x86_64`	✅	2s	2s	+0%
`poly_tomont_native_aarch64`	✅	2s	1s	+100%
`polyvec_basemul_acc_montgomery_cached_k2_native_x86_64`	✅	2s	4s	-50%
`polyvec_basemul_acc_montgomery_cached_k3_native_aarch64`	✅	2s	2s	+0%
`polyvec_basemul_acc_montgomery_cached_k4_native_x86_64`	✅	2s	2s	+0%
`rej_uniform_native`	✅	2s	2s	+0%
`sys_check_capability`	✅	2s	3s	-33%
`intt_native_x86_64`	✅	1s	3s	-67%
`keccak_f1600_x4_native_aarch64_v8a_v84a_scalar_hybrid`	✅	1s	1s	+0%
`mlk_ct_cmask_neg_i16`	✅	1s	3s	-67%
`mlk_ct_cmask_nonzero_u16`	✅	1s	4s	-75%
`mlk_ct_sel_int16`	✅	1s	3s	-67%
`mlk_keccakf1600_xor_bytes`	✅	1s	3s	-67%
`mlk_poly_cbd_eta1`	✅	1s	1s	+0%
`mlk_poly_cbd_eta2`	✅	1s	2s	-50%
`mlk_poly_compress_d11`	✅	1s	1s	+0%
`mlk_poly_compress_dv`	✅	1s	1s	+0%
`mlk_poly_decompress_d11_c`	✅	1s	3s	-67%
`mlk_poly_decompress_d5`	✅	1s	2s	-50%
`mlk_poly_decompress_d5_c`	✅	1s	3s	-67%
`mlk_poly_frombytes`	✅	1s	2s	-50%
`mlk_poly_invntt_tomont_c`	✅	1s	2s	-50%
`mlk_poly_ntt_c`	✅	1s	1s	+0%
`mlk_poly_tobytes_native`	✅	1s	1s	+0%
`mlk_polyvec_frombytes`	✅	1s	3s	-67%
`mlk_polyvec_permute_bitrev_to_custom_native`	✅	1s	2s	-50%
`mlk_scalar_compress_d10`	✅	1s	2s	-50%
`mlk_scalar_compress_d4`	✅	1s	2s	-50%
`mlk_scalar_compress_d5`	✅	1s	1s	+0%
`mlk_scalar_decompress_d10`	✅	1s	2s	-50%
`mlk_scalar_decompress_d11`	✅	1s	3s	-67%
`mlk_scalar_decompress_d5`	✅	1s	2s	-50%
`mlk_sha3_512`	✅	1s	3s	-67%
`mlk_shake128_squeezeblocks`	✅	1s	3s	-67%
`mlk_value_barrier_i32`	✅	1s	2s	-50%
`poly_decompress_d11_native_x86_64`	✅	1s	1s	+0%
`poly_invntt_tomont_native`	✅	1s	2s	-50%

oqs-bot · 2026-08-05T05:26:04Z

CBMC Results (ML-KEM-512)

⚠️ Attention Required

Proof	Status	Current	Previous	Change
`mlk_indcpa_dec`	⚠️	21s	14s	+50%
`mlk_indcpa_enc`	⚠️	423s	255s	+66%
`mlk_indcpa_keypair_derand`	⚠️	412s	213s	+93%

Full Results (191 proofs)

Proof	Status	Current	Previous	Change
`TOTAL`	✅	1986s	1614s	+23.0%
`mlk_indcpa_enc`	⚠️	423s	255s	+66%
`mlk_indcpa_keypair_derand`	⚠️	412s	213s	+93%
`mlk_rej_uniform_c`	✅	191s	135s	+41%
`mlk_polyvec_basemul_acc_montgomery_cached_c`	✅	72s	55s	+31%
`poly_ntt_native`	✅	46s	45s	+2%
`rej_uniform_native_aarch64`	✅	46s	43s	+7%
`rej_uniform_native_x86_64`	✅	43s	57s	-25%
`mlk_poly_rej_uniform`	✅	39s	150s	-74%
`mlk_ntt_layer`	✅	38s	32s	+19%
`mlk_poly_reduce_native`	✅	37s	35s	+6%
`mlk_keccak_squeezeblocks_x4`	✅	28s	26s	+8%
`mlk_indcpa_dec`	⚠️	21s	14s	+50%
`keccakf1600x4_permute_native_x4`	✅	17s	16s	+6%
`mlk_poly_decompress_d10_native`	✅	15s	15s	+0%
`mlk_poly_decompress_d4_native`	✅	15s	14s	+7%
`mlk_polyvec_add`	✅	14s	11s	+27%
`mlk_poly_frommsg`	✅	12s	10s	+20%
`mlk_poly_frombytes_native`	✅	11s	8s	+38%
`mlk_keccak_squeezeblocks`	✅	9s	9s	+0%
`polyvec_basemul_acc_montgomery_cached_native`	✅	9s	8s	+12%
`mlk_invntt_layer`	✅	8s	4s	+100%
`mlk_ntt_butterfly_block`	✅	8s	9s	-11%
`mlk_poly_ntt`	✅	8s	5s	+60%
`mlk_poly_rej_uniform_x4`	✅	8s	8s	+0%
`mlk_keccak_squeeze_once`	✅	7s	8s	-12%
`kem_dec`	✅	6s	5s	+20%
`mlk_keccak_absorb_once_x4`	✅	6s	5s	+20%
`mlk_poly_compress_d10`	✅	6s	4s	+50%
`mlk_poly_sub`	✅	6s	6s	+0%
`poly_decompress_d11_native_x86_64`	✅	6s	1s	+500%
`keccak_f1600_x4_native_aarch64_v84a`	✅	5s	3s	+67%
`mlk_keccakf1600_permute_c`	✅	5s	5s	+0%
`mlk_poly_add`	✅	5s	4s	+25%
`mlk_poly_frombytes_c`	✅	5s	4s	+25%
`mlk_poly_invntt_tomont`	✅	5s	2s	+150%
`mlk_poly_mulcache_compute_c`	✅	5s	4s	+25%
`mlk_poly_tomsg`	✅	5s	3s	+67%
`mlk_scalar_signed_to_unsigned_q`	✅	5s	1s	+400%
`poly_decompress_d4_native_x86_64`	✅	5s	4s	+25%
`poly_frombytes_native_x86_64`	✅	5s	5s	+0%
`polyvec_basemul_acc_montgomery_cached_k2_native_x86_64`	✅	5s	3s	+67%
`keccak_f1600_x4_native_aarch64_v8a_scalar_hybrid`	✅	4s	3s	+33%
`keccakf1600x4_extract_bytes_native`	✅	4s	1s	+300%
`kem_enc`	✅	4s	2s	+100%
`mlk_barrett_reduce`	✅	4s	2s	+100%
`mlk_check_pct`	✅	4s	5s	-20%
`mlk_gen_matrix`	✅	4s	2s	+100%
`mlk_poly_cbd_eta2`	✅	4s	3s	+33%
`mlk_poly_compress_d11`	✅	4s	3s	+33%
`mlk_poly_decompress_d4_c`	✅	4s	7s	-43%
`mlk_poly_getnoise_eta1122_4x`	✅	4s	3s	+33%
`mlk_poly_getnoise_eta2`	✅	4s	3s	+33%
`mlk_poly_mulcache_compute_native`	✅	4s	2s	+100%
`mlk_polyvec_frombytes`	✅	4s	2s	+100%
`mlk_scalar_decompress_d5`	✅	4s	3s	+33%
`mlk_shake256x4`	✅	4s	5s	-20%
`nttunpack_native_x86_64`	✅	4s	2s	+100%
`poly_reduce_native_aarch64`	✅	4s	1s	+300%
`polyvec_basemul_acc_montgomery_cached_k4_native_aarch64`	✅	4s	3s	+33%
`intt_native_aarch64`	✅	3s	2s	+50%
`keccak_f1600_x1_native_aarch64_v84a`	✅	3s	2s	+50%
`keccak_f1600_x4_native_aarch64_v8a_v84a_scalar_hybrid`	✅	3s	3s	+0%
`kem_enc_derand`	✅	3s	3s	+0%
`kem_keypair`	✅	3s	4s	-25%
`mlk_ct_cmov_zero`	✅	3s	3s	+0%
`mlk_ct_get_optblocker_i32`	✅	3s	2s	+50%
`mlk_ct_get_optblocker_u32`	✅	3s	3s	+0%
`mlk_ct_memcmp`	✅	3s	3s	+0%
`mlk_ct_sel_uint8`	✅	3s	2s	+50%
`mlk_fqmul`	✅	3s	17s	-82%
`mlk_gen_matrix_serial`	✅	3s	3s	+0%
`mlk_keccak_absorb_once`	✅	3s	3s	+0%
`mlk_keccakf1600_permute`	✅	3s	1s	+200%
`mlk_keccakf1600_xor_bytes (big endian)`	✅	3s	2s	+50%
`mlk_keccakf1600x4_xor_bytes`	✅	3s	2s	+50%
`mlk_keypair_getnoise_eta1`	✅	3s	1s	+200%
`mlk_matvec_mul`	✅	3s	3s	+0%
`mlk_montgomery_reduce`	✅	3s	2s	+50%
`mlk_poly_compress_d10_native`	✅	3s	1s	+200%
`mlk_poly_compress_d4`	✅	3s	3s	+0%
`mlk_poly_compress_d4_c`	✅	3s	3s	+0%
`mlk_poly_compress_d5_c`	✅	3s	3s	+0%
`mlk_poly_compress_d5_native`	✅	3s	3s	+0%
`mlk_poly_decompress_d10`	✅	3s	2s	+50%
`mlk_poly_decompress_d10_c`	✅	3s	4s	-25%
`mlk_poly_decompress_d4`	✅	3s	3s	+0%
`mlk_poly_frombytes`	✅	3s	1s	+200%
`mlk_poly_getnoise_eta1_4x`	✅	3s	5s	-40%
`mlk_poly_invntt_tomont_c`	✅	3s	3s	+0%
`mlk_poly_tobytes_c`	✅	3s	3s	+0%
`mlk_poly_tomont_native`	✅	3s	2s	+50%
`mlk_polyvec_basemul_acc_montgomery_cached`	✅	3s	1s	+200%
`mlk_polyvec_compress_du`	✅	3s	2s	+50%
`mlk_polyvec_reduce`	✅	3s	2s	+50%
`mlk_polyvec_tobytes`	✅	3s	3s	+0%
`mlk_rej_uniform`	✅	3s	5s	-40%
`mlk_scalar_compress_d4`	✅	3s	1s	+200%
`mlk_scalar_decompress_d4`	✅	3s	3s	+0%
`mlk_sha3_256`	✅	3s	2s	+50%
`mlk_shake128x4_absorb_once`	✅	3s	2s	+50%
`mlk_value_barrier_u8`	✅	3s	4s	-25%
`ntt_native_aarch64`	✅	3s	2s	+50%
`poly_compress_d4_native_x86_64`	✅	3s	1s	+200%
`poly_compress_d5_native_x86_64`	✅	3s	2s	+50%
`poly_decompress_d10_native_x86_64`	✅	3s	9s	-67%
`poly_decompress_d5_native_x86_64`	✅	3s	2s	+50%
`poly_getnoise_eta1122_4x_native`	✅	3s	1s	+200%
`poly_mulcache_compute_native_x86_64`	✅	3s	1s	+200%
`poly_reduce_native_x86_64`	✅	3s	2s	+50%
`intt_native_x86_64`	✅	2s	2s	+0%
`keccak_f1600_x1_native_aarch64`	✅	2s	2s	+0%
`keccak_f1600_x4_native_avx2`	✅	2s	2s	+0%
`keccakf1600_permute_native`	✅	2s	1s	+100%
`keccakf1600x4_xor_bytes_native`	✅	2s	1s	+100%
`kem_check_pk`	✅	2s	4s	-50%
`kem_check_sk`	✅	2s	2s	+0%
`kem_keypair_derand`	✅	2s	3s	-33%
`mlk_ct_get_optblocker_u8`	✅	2s	2s	+0%
`mlk_ct_sel_int16`	✅	2s	1s	+100%
`mlk_enc_getnoise_eta1_eta2`	✅	2s	2s	+0%
`mlk_keccakf1600_xor_bytes`	✅	2s	1s	+100%
`mlk_keccakf1600x4_extract_bytes`	✅	2s	2s	+0%
`mlk_keccakf1600x4_extract_bytes_c`	✅	2s	3s	-33%
`mlk_keccakf1600x4_xor_bytes_c`	✅	2s	2s	+0%
`mlk_poly_cbd_eta1`	✅	2s	2s	+0%
`mlk_poly_compress_d10_c`	✅	2s	2s	+0%
`mlk_poly_compress_d11_c`	✅	2s	2s	+0%
`mlk_poly_compress_d11_native`	✅	2s	3s	-33%
`mlk_poly_compress_d4_native`	✅	2s	2s	+0%
`mlk_poly_compress_d5`	✅	2s	2s	+0%
`mlk_poly_compress_dv`	✅	2s	3s	-33%
`mlk_poly_decompress_d11_c`	✅	2s	2s	+0%
`mlk_poly_decompress_d11_native`	✅	2s	3s	-33%
`mlk_poly_decompress_d5`	✅	2s	1s	+100%
`mlk_poly_decompress_d5_native`	✅	2s	2s	+0%
`mlk_poly_decompress_du`	✅	2s	2s	+0%
`mlk_poly_decompress_dv`	✅	2s	2s	+0%
`mlk_poly_getnoise_eta1_4x_native`	✅	2s	2s	+0%
`mlk_poly_mulcache_compute`	✅	2s	2s	+0%
`mlk_poly_ntt_c`	✅	2s	2s	+0%
`mlk_poly_reduce_c`	✅	2s	3s	-33%
`mlk_poly_tobytes`	✅	2s	3s	-33%
`mlk_poly_tobytes_native`	✅	2s	2s	+0%
`mlk_poly_tomont_c`	✅	2s	2s	+0%
`mlk_polymat_permute_bitrev_to_custom`	✅	2s	2s	+0%
`mlk_polyvec_decompress_du`	✅	2s	2s	+0%
`mlk_polyvec_mulcache_compute`	✅	2s	5s	-60%
`mlk_polyvec_ntt`	✅	2s	1s	+100%
`mlk_polyvec_permute_bitrev_to_custom`	✅	2s	2s	+0%
`mlk_polyvec_permute_bitrev_to_custom_native`	✅	2s	2s	+0%
`mlk_polyvec_tomont`	✅	2s	1s	+100%
`mlk_scalar_compress_d1`	✅	2s	2s	+0%
`mlk_scalar_compress_d10`	✅	2s	2s	+0%
`mlk_scalar_compress_d11`	✅	2s	2s	+0%
`mlk_scalar_decompress_d11`	✅	2s	2s	+0%
`mlk_sha3_512`	✅	2s	2s	+0%
`mlk_shake128_absorb_once`	✅	2s	3s	-33%
`mlk_value_barrier_u32`	✅	2s	3s	-33%
`ntt_native_x86_64`	✅	2s	2s	+0%
`poly_compress_d10_native_x86_64`	✅	2s	3s	-33%
`poly_invntt_tomont_native`	✅	2s	2s	+0%
`poly_mulcache_compute_native_aarch64`	✅	2s	3s	-33%
`poly_tobytes_native_aarch64`	✅	2s	2s	+0%
`poly_tomont_native_aarch64`	✅	2s	2s	+0%
`polyvec_basemul_acc_montgomery_cached_k2_native_aarch64`	✅	2s	3s	-33%
`polyvec_basemul_acc_montgomery_cached_k3_native_aarch64`	✅	2s	3s	-33%
`polyvec_basemul_acc_montgomery_cached_k4_native_x86_64`	✅	2s	2s	+0%
`rej_uniform_native`	✅	2s	1s	+100%
`sys_check_capability`	✅	2s	1s	+100%
`mlk_ct_cmask_neg_i16`	✅	1s	3s	-67%
`mlk_ct_cmask_nonzero_u16`	✅	1s	2s	-50%
`mlk_ct_cmask_nonzero_u8`	✅	1s	1s	+0%
`mlk_keccakf1600_extract_bytes`	✅	1s	2s	-50%
`mlk_keccakf1600_extract_bytes (big endian)`	✅	1s	5s	-80%
`mlk_keccakf1600x4_permute`	✅	1s	4s	-75%
`mlk_poly_compress_du`	✅	1s	3s	-67%
`mlk_poly_decompress_d11`	✅	1s	2s	-50%
`mlk_poly_decompress_d5_c`	✅	1s	1s	+0%
`mlk_poly_reduce`	✅	1s	1s	+0%
`mlk_poly_tomont`	✅	1s	1s	+0%
`mlk_polyvec_invntt_tomont`	✅	1s	3s	-67%
`mlk_scalar_compress_d5`	✅	1s	2s	-50%
`mlk_scalar_decompress_d10`	✅	1s	2s	-50%
`mlk_shake128_squeezeblocks`	✅	1s	3s	-67%
`mlk_shake128x4_squeezeblocks`	✅	1s	1s	+0%
`mlk_shake256`	✅	1s	2s	-50%
`mlk_value_barrier_i32`	✅	1s	2s	-50%
`poly_compress_d11_native_x86_64`	✅	1s	2s	-50%
`poly_tobytes_native_x86_64`	✅	1s	1s	+0%
`poly_tomont_native_x86_64`	✅	1s	2s	-50%
`polyvec_basemul_acc_montgomery_cached_k3_native_x86_64`	✅	1s	2s	-50%

oqs-bot · 2026-08-05T05:29:48Z

CBMC Results (ML-KEM-1024)

⚠️ Attention Required

Proof	Status	Current	Previous	Change
`mlk_indcpa_keypair_derand`	⚠️	296s	176s	+68%
`mlk_polyvec_basemul_acc_montgomery_cached_c`	⚠️	143s	79s	+81%

Full Results (191 proofs)

Proof	Status	Current	Previous	Change
`TOTAL`	✅	1980s	1885s	+5.0%
`mlk_indcpa_enc`	✅	418s	402s	+4%
`mlk_indcpa_keypair_derand`	⚠️	296s	176s	+68%
`mlk_rej_uniform_c`	✅	190s	144s	+32%
`mlk_polyvec_basemul_acc_montgomery_cached_c`	⚠️	143s	79s	+81%
`rej_uniform_native_aarch64`	✅	49s	53s	-8%
`poly_ntt_native`	✅	46s	43s	+7%
`rej_uniform_native_x86_64`	✅	41s	67s	-39%
`mlk_poly_rej_uniform`	✅	39s	161s	-76%
`mlk_ntt_layer`	✅	38s	38s	+0%
`mlk_poly_reduce_native`	✅	38s	40s	-5%
`polyvec_basemul_acc_montgomery_cached_native`	✅	34s	31s	+10%
`mlk_keccak_squeezeblocks_x4`	✅	28s	26s	+8%
`mlk_polyvec_add`	✅	19s	18s	+6%
`mlk_poly_decompress_d5_native`	✅	17s	18s	-6%
`keccakf1600x4_permute_native_x4`	✅	15s	15s	+0%
`mlk_indcpa_dec`	✅	15s	11s	+36%
`mlk_poly_decompress_d11_native`	✅	15s	16s	-6%
`mlk_poly_frommsg`	✅	14s	10s	+40%
`mlk_poly_frombytes_native`	✅	13s	10s	+30%
`kem_dec`	✅	11s	5s	+120%
`mlk_ntt_butterfly_block`	✅	11s	9s	+22%
`mlk_poly_ntt`	✅	10s	8s	+25%
`mlk_keccak_squeezeblocks`	✅	9s	9s	+0%
`mlk_poly_add`	✅	9s	5s	+80%
`mlk_keccak_squeeze_once`	✅	8s	10s	-20%
`mlk_poly_rej_uniform_x4`	✅	8s	7s	+14%
`mlk_gen_matrix_serial`	✅	7s	4s	+75%
`mlk_invntt_layer`	✅	7s	6s	+17%
`mlk_keccak_absorb_once_x4`	✅	7s	5s	+40%
`mlk_poly_sub`	✅	7s	8s	-12%
`mlk_keccakf1600_permute_c`	✅	6s	6s	+0%
`mlk_polyvec_ntt`	✅	6s	12s	-50%
`mlk_ct_memcmp`	✅	5s	3s	+67%
`mlk_fqmul`	✅	5s	20s	-75%
`mlk_gen_matrix`	✅	5s	2s	+150%
`mlk_keccak_absorb_once`	✅	5s	4s	+25%
`mlk_poly_compress_d4`	✅	5s	3s	+67%
`mlk_poly_tomont_native`	✅	5s	4s	+25%
`mlk_polyvec_basemul_acc_montgomery_cached`	✅	5s	2s	+150%
`mlk_shake256x4`	✅	5s	4s	+25%
`poly_decompress_d11_native_x86_64`	✅	5s	5s	+0%
`poly_decompress_d4_native_x86_64`	✅	5s	2s	+150%
`poly_decompress_d5_native_x86_64`	✅	5s	5s	+0%
`poly_reduce_native_x86_64`	✅	5s	3s	+67%
`keccakf1600x4_xor_bytes_native`	✅	4s	2s	+100%
`kem_check_pk`	✅	4s	4s	+0%
`kem_enc`	✅	4s	2s	+100%
`kem_keypair`	✅	4s	2s	+100%
`mlk_check_pct`	✅	4s	1s	+300%
`mlk_ct_cmov_zero`	✅	4s	3s	+33%
`mlk_keccakf1600x4_extract_bytes`	✅	4s	2s	+100%
`mlk_poly_compress_d11_c`	✅	4s	4s	+0%
`mlk_poly_decompress_d4_native`	✅	4s	3s	+33%
`mlk_poly_frombytes_c`	✅	4s	3s	+33%
`mlk_poly_getnoise_eta1_4x`	✅	4s	2s	+100%
`mlk_poly_getnoise_eta1_4x_native`	✅	4s	3s	+33%
`mlk_poly_reduce`	✅	4s	2s	+100%
`mlk_poly_tomsg`	✅	4s	3s	+33%
`mlk_polyvec_decompress_du`	✅	4s	2s	+100%
`mlk_polyvec_mulcache_compute`	✅	4s	4s	+0%
`mlk_polyvec_permute_bitrev_to_custom_native`	✅	4s	6s	-33%
`mlk_scalar_decompress_d5`	✅	4s	2s	+100%
`mlk_shake128x4_squeezeblocks`	✅	4s	2s	+100%
`poly_compress_d11_native_x86_64`	✅	4s	3s	+33%
`poly_frombytes_native_x86_64`	✅	4s	5s	-20%
`polyvec_basemul_acc_montgomery_cached_k3_native_aarch64`	✅	4s	2s	+100%
`intt_native_aarch64`	✅	3s	3s	+0%
`intt_native_x86_64`	✅	3s	2s	+50%
`keccak_f1600_x4_native_aarch64_v8a_scalar_hybrid`	✅	3s	3s	+0%
`kem_check_sk`	✅	3s	3s	+0%
`kem_keypair_derand`	✅	3s	1s	+200%
`mlk_ct_cmask_nonzero_u8`	✅	3s	1s	+200%
`mlk_ct_sel_uint8`	✅	3s	2s	+50%
`mlk_enc_getnoise_eta1_eta2`	✅	3s	4s	-25%
`mlk_keccakf1600_extract_bytes (big endian)`	✅	3s	2s	+50%
`mlk_keccakf1600x4_xor_bytes`	✅	3s	2s	+50%
`mlk_matvec_mul`	✅	3s	5s	-40%
`mlk_poly_cbd_eta1`	✅	3s	3s	+0%
`mlk_poly_compress_d10`	✅	3s	2s	+50%
`mlk_poly_compress_d10_c`	✅	3s	3s	+0%
`mlk_poly_compress_d5_native`	✅	3s	4s	-25%
`mlk_poly_decompress_d11`	✅	3s	3s	+0%
`mlk_poly_decompress_d4`	✅	3s	3s	+0%
`mlk_poly_decompress_d4_c`	✅	3s	4s	-25%
`mlk_poly_decompress_dv`	✅	3s	2s	+50%
`mlk_poly_frombytes`	✅	3s	2s	+50%
`mlk_poly_getnoise_eta1122_4x`	✅	3s	3s	+0%
`mlk_poly_getnoise_eta2`	✅	3s	1s	+200%
`mlk_poly_mulcache_compute_c`	✅	3s	3s	+0%
`mlk_poly_ntt_c`	✅	3s	1s	+200%
`mlk_poly_tobytes`	✅	3s	3s	+0%
`mlk_poly_tomont_c`	✅	3s	3s	+0%
`mlk_polymat_permute_bitrev_to_custom`	✅	3s	5s	-40%
`mlk_polyvec_invntt_tomont`	✅	3s	1s	+200%
`mlk_polyvec_permute_bitrev_to_custom`	✅	3s	4s	-25%
`mlk_value_barrier_i32`	✅	3s	3s	+0%
`ntt_native_x86_64`	✅	3s	2s	+50%
`poly_compress_d10_native_x86_64`	✅	3s	2s	+50%
`poly_decompress_d10_native_x86_64`	✅	3s	4s	-25%
`poly_getnoise_eta1122_4x_native`	✅	3s	3s	+0%
`polyvec_basemul_acc_montgomery_cached_k3_native_x86_64`	✅	3s	2s	+50%
`polyvec_basemul_acc_montgomery_cached_k4_native_x86_64`	✅	3s	2s	+50%
`sys_check_capability`	✅	3s	2s	+50%
`keccak_f1600_x1_native_aarch64`	✅	2s	1s	+100%
`keccak_f1600_x1_native_aarch64_v84a`	✅	2s	2s	+0%
`keccak_f1600_x4_native_aarch64_v84a`	✅	2s	3s	-33%
`keccak_f1600_x4_native_aarch64_v8a_v84a_scalar_hybrid`	✅	2s	3s	-33%
`keccakf1600_permute_native`	✅	2s	2s	+0%
`keccakf1600x4_extract_bytes_native`	✅	2s	2s	+0%
`kem_enc_derand`	✅	2s	3s	-33%
`mlk_ct_cmask_neg_i16`	✅	2s	3s	-33%
`mlk_ct_get_optblocker_i32`	✅	2s	3s	-33%
`mlk_ct_get_optblocker_u32`	✅	2s	3s	-33%
`mlk_ct_sel_int16`	✅	2s	4s	-50%
`mlk_keccakf1600_extract_bytes`	✅	2s	2s	+0%
`mlk_keccakf1600_permute`	✅	2s	2s	+0%
`mlk_keccakf1600_xor_bytes (big endian)`	✅	2s	2s	+0%
`mlk_keccakf1600x4_extract_bytes_c`	✅	2s	3s	-33%
`mlk_keccakf1600x4_xor_bytes_c`	✅	2s	5s	-60%
`mlk_keypair_getnoise_eta1`	✅	2s	5s	-60%
`mlk_poly_cbd_eta2`	✅	2s	3s	-33%
`mlk_poly_compress_d11`	✅	2s	3s	-33%
`mlk_poly_compress_d4_c`	✅	2s	4s	-50%
`mlk_poly_compress_d4_native`	✅	2s	2s	+0%
`mlk_poly_compress_d5`	✅	2s	5s	-60%
`mlk_poly_compress_d5_c`	✅	2s	4s	-50%
`mlk_poly_compress_du`	✅	2s	2s	+0%
`mlk_poly_decompress_d10`	✅	2s	2s	+0%
`mlk_poly_decompress_d10_c`	✅	2s	2s	+0%
`mlk_poly_decompress_d10_native`	✅	2s	2s	+0%
`mlk_poly_decompress_d11_c`	✅	2s	2s	+0%
`mlk_poly_decompress_d5_c`	✅	2s	2s	+0%
`mlk_poly_decompress_du`	✅	2s	1s	+100%
`mlk_poly_invntt_tomont`	✅	2s	3s	-33%
`mlk_poly_invntt_tomont_c`	✅	2s	2s	+0%
`mlk_poly_mulcache_compute`	✅	2s	2s	+0%
`mlk_poly_mulcache_compute_native`	✅	2s	3s	-33%
`mlk_poly_tobytes_native`	✅	2s	1s	+100%
`mlk_poly_tomont`	✅	2s	2s	+0%
`mlk_polyvec_frombytes`	✅	2s	5s	-60%
`mlk_polyvec_tomont`	✅	2s	2s	+0%
`mlk_rej_uniform`	✅	2s	2s	+0%
`mlk_scalar_compress_d1`	✅	2s	3s	-33%
`mlk_scalar_compress_d11`	✅	2s	4s	-50%
`mlk_scalar_compress_d4`	✅	2s	1s	+100%
`mlk_scalar_decompress_d10`	✅	2s	2s	+0%
`mlk_scalar_decompress_d11`	✅	2s	2s	+0%
`mlk_scalar_decompress_d4`	✅	2s	3s	-33%
`mlk_scalar_signed_to_unsigned_q`	✅	2s	3s	-33%
`mlk_shake128_absorb_once`	✅	2s	2s	+0%
`mlk_shake256`	✅	2s	1s	+100%
`mlk_value_barrier_u8`	✅	2s	1s	+100%
`ntt_native_aarch64`	✅	2s	3s	-33%
`nttunpack_native_x86_64`	✅	2s	2s	+0%
`poly_compress_d4_native_x86_64`	✅	2s	2s	+0%
`poly_mulcache_compute_native_x86_64`	✅	2s	5s	-60%
`poly_reduce_native_aarch64`	✅	2s	2s	+0%
`poly_tobytes_native_x86_64`	✅	2s	3s	-33%
`poly_tomont_native_aarch64`	✅	2s	3s	-33%
`poly_tomont_native_x86_64`	✅	2s	2s	+0%
`polyvec_basemul_acc_montgomery_cached_k2_native_x86_64`	✅	2s	2s	+0%
`polyvec_basemul_acc_montgomery_cached_k4_native_aarch64`	✅	2s	2s	+0%
`keccak_f1600_x4_native_avx2`	✅	1s	2s	-50%
`mlk_barrett_reduce`	✅	1s	2s	-50%
`mlk_ct_cmask_nonzero_u16`	✅	1s	2s	-50%
`mlk_ct_get_optblocker_u8`	✅	1s	2s	-50%
`mlk_keccakf1600_xor_bytes`	✅	1s	1s	+0%
`mlk_keccakf1600x4_permute`	✅	1s	2s	-50%
`mlk_montgomery_reduce`	✅	1s	2s	-50%
`mlk_poly_compress_d10_native`	✅	1s	3s	-67%
`mlk_poly_compress_d11_native`	✅	1s	3s	-67%
`mlk_poly_compress_dv`	✅	1s	1s	+0%
`mlk_poly_decompress_d5`	✅	1s	3s	-67%
`mlk_poly_reduce_c`	✅	1s	1s	+0%
`mlk_poly_tobytes_c`	✅	1s	4s	-75%
`mlk_polyvec_compress_du`	✅	1s	3s	-67%
`mlk_polyvec_reduce`	✅	1s	2s	-50%
`mlk_polyvec_tobytes`	✅	1s	1s	+0%
`mlk_scalar_compress_d10`	✅	1s	2s	-50%
`mlk_scalar_compress_d5`	✅	1s	4s	-75%
`mlk_sha3_256`	✅	1s	2s	-50%
`mlk_sha3_512`	✅	1s	1s	+0%
`mlk_shake128_squeezeblocks`	✅	1s	1s	+0%
`mlk_shake128x4_absorb_once`	✅	1s	2s	-50%
`mlk_value_barrier_u32`	✅	1s	3s	-67%
`poly_compress_d5_native_x86_64`	✅	1s	4s	-75%
`poly_invntt_tomont_native`	✅	1s	3s	-67%
`poly_mulcache_compute_native_aarch64`	✅	1s	3s	-67%
`poly_tobytes_native_aarch64`	✅	1s	3s	-67%
`polyvec_basemul_acc_montgomery_cached_k2_native_aarch64`	✅	1s	1s	+0%
`rej_uniform_native`	✅	1s	1s	+0%

mkannwischer

Thanks @hanno-becker! LGTM!

Previously, MLK_ERR_FAIL was returned for several externally distinct failure conditions: a public key rejected by the FIPS 203 'modulus check', a secret key rejected by the FIPS 203 'hash check', and a failed pairwise consistency test (PCT). An integrator translating mlkem-native return codes into their own error space could not tell these apart without extra work. This commit adds three dedicated error codes: MLK_ERR_INVALID_PK (-4) check_pk / encaps rejected the public key MLK_ERR_INVALID_SK (-5) check_sk / decaps rejected the secret key MLK_ERR_PCT_FAIL (-6) keygen PCT self-test failed The existing codes (-1..-3) are unchanged. In particular, MLK_ERR_FAIL remains, but is no longer returned by any function. Since the key pair tested by the PCT was just generated by this library, a key check rejecting it hints at a faulty implementation rather than at bad input; mlk_check_pct therefore maps MLK_ERR_INVALID_{PK,SK} to MLK_ERR_PCT_FAIL and passes platform failures through unmodified. The commit also makes the CBMC ensures contracts specific instead of admitting MLK_ERR_FAIL everywhere, and drops it from the indcpa contracts, which only ever return 0 or MLK_ERR_OUT_OF_MEMORY. Resolves: #1846 Signed-off-by: Hanno Becker <beckphan@amazon.co.uk>

The tests asserted return codes with CHECK(call == RC), which reports only a file and line on failure. Diagnosing a mismatch meant looking up the line and mapping numeric codes by hand. It also hid gaps: the PCT breakage CI job asserted no more than "keygen returned non-zero", so swapping MLK_ERR_PCT_FAIL for another code kept CI green. This commit adds CHECK_ERR(call, expected), which prints both codes numerically and by name: ERROR (test/src/test_mlkem.c,83): Expected -4 (MLK_ERR_INVALID_PK) for crypto_kem_enc(ct, key_b, pk), but got 0 (Success) CHECK_ERR is used only where the value really is an MLK_ERR_XXX code, i.e. the crypto_kem_xxx API. It deliberately does not cover randombytes(), which is consumer-provided and returns an unspecified non-zero value on failure, nor values aggregating several return codes. Those keep using CHECK, as do conditions that are not return codes at all, such as memcmp() comparisons. Both macros, together with the code-to-name mapping, now live in the new test/src/test_common.h, replacing seven near-identical copies of CHECK. The 'return 1' and 'exit(1)' variants that motivated two of those copies are unified behind MLK_TEST_CHECK_EXIT, which the ACVP and Wycheproof drivers set because their test-case handlers return void. The fault injection loops in test_alloc.c and test_rng_fail.c keep their own reporting, but now name the codes they print. With the code visible in the output, the PCT breakage job can assert on it, closing the gap noted above. Signed-off-by: Hanno Becker <beckphan@amazon.co.uk>

oqs-bot

Mac Mini (M1, 2020) benchmarks

Details

Benchmark suite	Current: `326de4f`	Previous: `23f0c0f`	Ratio
`ML-KEM-512 keypair`	`12321` cycles	`12323` cycles	`1.00`
`ML-KEM-512 encaps`	`14756` cycles	`14759` cycles	`1.00`
`ML-KEM-512 decaps`	`19312` cycles	`19315` cycles	`1.00`
`ML-KEM-768 keypair`	`21180` cycles	`21176` cycles	`1.00`
`ML-KEM-768 encaps`	`23515` cycles	`23511` cycles	`1.00`
`ML-KEM-768 decaps`	`30058` cycles	`30053` cycles	`1.00`
`ML-KEM-1024 keypair`	`30330` cycles	`30330` cycles	`1`
`ML-KEM-1024 encaps`	`34110` cycles	`34110` cycles	`1`
`ML-KEM-1024 decaps`	`43666` cycles	`43682` cycles	`1.00`

This comment was automatically generated by workflow using github-action-benchmark.

oqs-bot

Intel Xeon 4th gen (c7i)

Details

Benchmark suite	Current: `326de4f`	Previous: `23f0c0f`	Ratio
`ML-KEM-512 keypair`	`11927` cycles	`11795` cycles	`1.01`
`ML-KEM-512 encaps`	`13192` cycles	`13069` cycles	`1.01`
`ML-KEM-512 decaps`	`17194` cycles	`17187` cycles	`1.00`
`ML-KEM-768 keypair`	`19459` cycles	`19376` cycles	`1.00`
`ML-KEM-768 encaps`	`20762` cycles	`20670` cycles	`1.00`
`ML-KEM-768 decaps`	`26377` cycles	`26400` cycles	`1.00`
`ML-KEM-1024 keypair`	`28196` cycles	`28186` cycles	`1.00`
`ML-KEM-1024 encaps`	`30192` cycles	`30158` cycles	`1.00`
`ML-KEM-1024 decaps`	`37495` cycles	`37657` cycles	`1.00`

This comment was automatically generated by workflow using github-action-benchmark.

oqs-bot

AMD EPYC 3rd gen (c6a)

Details

Benchmark suite	Current: `326de4f`	Previous: `0457037`	Ratio
`ML-KEM-512 keypair`	`14450` cycles	`14425` cycles	`1.00`
`ML-KEM-512 encaps`	`15962` cycles	`15949` cycles	`1.00`
`ML-KEM-512 decaps`	`21357` cycles	`21332` cycles	`1.00`
`ML-KEM-768 keypair`	`23626` cycles	`23630` cycles	`1.00`
`ML-KEM-768 encaps`	`25052` cycles	`25017` cycles	`1.00`
`ML-KEM-768 decaps`	`32873` cycles	`32859` cycles	`1.00`
`ML-KEM-1024 keypair`	`33585` cycles	`33510` cycles	`1.00`
`ML-KEM-1024 encaps`	`35899` cycles	`35857` cycles	`1.00`
`ML-KEM-1024 decaps`	`46319` cycles	`46281` cycles	`1.00`

This comment was automatically generated by workflow using github-action-benchmark.

oqs-bot

Intel Xeon 4th gen (c7i) (no-opt)

Details

Benchmark suite	Current: `326de4f`	Previous: `23f0c0f`	Ratio
`ML-KEM-512 keypair`	`27597` cycles	`27600` cycles	`1.00`
`ML-KEM-512 encaps`	`34385` cycles	`34781` cycles	`0.99`
`ML-KEM-512 decaps`	`43969` cycles	`44408` cycles	`0.99`
`ML-KEM-768 keypair`	`44242` cycles	`44301` cycles	`1.00`
`ML-KEM-768 encaps`	`54932` cycles	`54825` cycles	`1.00`
`ML-KEM-768 decaps`	`68252` cycles	`68175` cycles	`1.00`
`ML-KEM-1024 keypair`	`67537` cycles	`67472` cycles	`1.00`
`ML-KEM-1024 encaps`	`78752` cycles	`78795` cycles	`1.00`
`ML-KEM-1024 decaps`	`96068` cycles	`96056` cycles	`1.00`

This comment was automatically generated by workflow using github-action-benchmark.

oqs-bot

ppc64le (POWER10) benchmarks

Details

Benchmark suite	Current: `326de4f`	Previous: `0457037`	Ratio
`ML-KEM-512 keypair`	`38760` cycles	`38629` cycles	`1.00`
`ML-KEM-512 encaps`	`43594` cycles	`43485` cycles	`1.00`
`ML-KEM-512 decaps`	`54034` cycles	`54190` cycles	`1.00`
`ML-KEM-768 keypair`	`69292` cycles	`67305` cycles	`1.03`
`ML-KEM-768 encaps`	`78002` cycles	`76272` cycles	`1.02`
`ML-KEM-768 decaps`	`92700` cycles	`90605` cycles	`1.02`
`ML-KEM-1024 keypair`	`113988` cycles	`113226` cycles	`1.01`
`ML-KEM-1024 encaps`	`124748` cycles	`123745` cycles	`1.01`
`ML-KEM-1024 decaps`	`143185` cycles	`142646` cycles	`1.00`

This comment was automatically generated by workflow using github-action-benchmark.

oqs-bot

Graviton5

Details

Benchmark suite	Current: `326de4f`	Previous: `23f0c0f`	Ratio
`ML-KEM-512 keypair`	`13436` cycles	`13462` cycles	`1.00`
`ML-KEM-512 encaps`	`15780` cycles	`15781` cycles	`1.00`
`ML-KEM-512 decaps`	`21301` cycles	`21329` cycles	`1.00`
`ML-KEM-768 keypair`	`22875` cycles	`22836` cycles	`1.00`
`ML-KEM-768 encaps`	`25297` cycles	`25301` cycles	`1.00`
`ML-KEM-768 decaps`	`33174` cycles	`33118` cycles	`1.00`
`ML-KEM-1024 keypair`	`33289` cycles	`33222` cycles	`1.00`
`ML-KEM-1024 encaps`	`36931` cycles	`37029` cycles	`1.00`
`ML-KEM-1024 decaps`	`47155` cycles	`47148` cycles	`1.00`

This comment was automatically generated by workflow using github-action-benchmark.

oqs-bot

Arm Cortex-A76 (Raspberry Pi 5) benchmarks

Details

Benchmark suite	Current: `326de4f`	Previous: `23f0c0f`	Ratio
`ML-KEM-512 keypair`	`28246` cycles	`28247` cycles	`1.00`
`ML-KEM-512 encaps`	`34127` cycles	`34125` cycles	`1.00`
`ML-KEM-512 decaps`	`44532` cycles	`44477` cycles	`1.00`
`ML-KEM-768 keypair`	`47565` cycles	`47615` cycles	`1.00`
`ML-KEM-768 encaps`	`53876` cycles	`53862` cycles	`1.00`
`ML-KEM-768 decaps`	`68528` cycles	`68526` cycles	`1.00`
`ML-KEM-1024 keypair`	`70253` cycles	`70186` cycles	`1.00`
`ML-KEM-1024 encaps`	`78655` cycles	`78595` cycles	`1.00`
`ML-KEM-1024 decaps`	`98306` cycles	`98348` cycles	`1.00`

This comment was automatically generated by workflow using github-action-benchmark.

oqs-bot

Intel Xeon 3rd gen (c6i)

Details

Benchmark suite	Current: `326de4f`	Previous: `0457037`	Ratio
`ML-KEM-512 keypair`	`17993` cycles	`17951` cycles	`1.00`
`ML-KEM-512 encaps`	`20179` cycles	`20124` cycles	`1.00`
`ML-KEM-512 decaps`	`26774` cycles	`26771` cycles	`1.00`
`ML-KEM-768 keypair`	`30113` cycles	`30060` cycles	`1.00`
`ML-KEM-768 encaps`	`31955` cycles	`31879` cycles	`1.00`
`ML-KEM-768 decaps`	`41525` cycles	`41517` cycles	`1.00`
`ML-KEM-1024 keypair`	`42121` cycles	`42145` cycles	`1.00`
`ML-KEM-1024 encaps`	`46226` cycles	`46574` cycles	`0.99`
`ML-KEM-1024 decaps`	`58104` cycles	`58442` cycles	`0.99`

This comment was automatically generated by workflow using github-action-benchmark.

oqs-bot

AMD EPYC 4th gen (c7a)

Details

Benchmark suite	Current: `326de4f`	Previous: `23f0c0f`	Ratio
`ML-KEM-512 keypair`	`12799` cycles	`12818` cycles	`1.00`
`ML-KEM-512 encaps`	`14208` cycles	`14216` cycles	`1.00`
`ML-KEM-512 decaps`	`18966` cycles	`18995` cycles	`1.00`
`ML-KEM-768 keypair`	`21606` cycles	`21624` cycles	`1.00`
`ML-KEM-768 encaps`	`22736` cycles	`22688` cycles	`1.00`
`ML-KEM-768 decaps`	`29654` cycles	`29727` cycles	`1.00`
`ML-KEM-1024 keypair`	`30489` cycles	`30459` cycles	`1.00`
`ML-KEM-1024 encaps`	`32651` cycles	`32651` cycles	`1`
`ML-KEM-1024 decaps`	`42055` cycles	`42044` cycles	`1.00`

This comment was automatically generated by workflow using github-action-benchmark.

oqs-bot

Graviton4

Details

Benchmark suite	Current: `326de4f`	Previous: `23f0c0f`	Ratio
`ML-KEM-512 keypair`	`17662` cycles	`17687` cycles	`1.00`
`ML-KEM-512 encaps`	`20547` cycles	`20543` cycles	`1.00`
`ML-KEM-512 decaps`	`27006` cycles	`27037` cycles	`1.00`
`ML-KEM-768 keypair`	`29862` cycles	`29832` cycles	`1.00`
`ML-KEM-768 encaps`	`32698` cycles	`32716` cycles	`1.00`
`ML-KEM-768 decaps`	`41918` cycles	`41858` cycles	`1.00`
`ML-KEM-1024 keypair`	`43720` cycles	`43689` cycles	`1.00`
`ML-KEM-1024 encaps`	`48623` cycles	`48703` cycles	`1.00`
`ML-KEM-1024 decaps`	`61397` cycles	`61374` cycles	`1.00`

This comment was automatically generated by workflow using github-action-benchmark.

oqs-bot

Graviton5 (no-opt)

Details

Benchmark suite	Current: `326de4f`	Previous: `23f0c0f`	Ratio
`ML-KEM-512 keypair`	`27346` cycles	`27363` cycles	`1.00`
`ML-KEM-512 encaps`	`31708` cycles	`31621` cycles	`1.00`
`ML-KEM-512 decaps`	`40432` cycles	`40544` cycles	`1.00`
`ML-KEM-768 keypair`	`44008` cycles	`44104` cycles	`1.00`
`ML-KEM-768 encaps`	`50703` cycles	`50582` cycles	`1.00`
`ML-KEM-768 decaps`	`62158` cycles	`62279` cycles	`1.00`
`ML-KEM-1024 keypair`	`68294` cycles	`68253` cycles	`1.00`
`ML-KEM-1024 encaps`	`75985` cycles	`76085` cycles	`1.00`
`ML-KEM-1024 decaps`	`90675` cycles	`90631` cycles	`1.00`

This comment was automatically generated by workflow using github-action-benchmark.

oqs-bot

AMD EPYC 3rd gen (c6a) (no-opt)

Details

Benchmark suite	Current: `326de4f`	Previous: `0457037`	Ratio
`ML-KEM-512 keypair`	`39915` cycles	`39854` cycles	`1.00`
`ML-KEM-512 encaps`	`48290` cycles	`48218` cycles	`1.00`
`ML-KEM-512 decaps`	`61734` cycles	`61732` cycles	`1.00`
`ML-KEM-768 keypair`	`62643` cycles	`62570` cycles	`1.00`
`ML-KEM-768 encaps`	`74853` cycles	`74777` cycles	`1.00`
`ML-KEM-768 decaps`	`92382` cycles	`92384` cycles	`1.00`
`ML-KEM-1024 keypair`	`95219` cycles	`95198` cycles	`1.00`
`ML-KEM-1024 encaps`	`110160` cycles	`110050` cycles	`1.00`
`ML-KEM-1024 decaps`	`132802` cycles	`132620` cycles	`1.00`

This comment was automatically generated by workflow using github-action-benchmark.

oqs-bot

Intel Xeon 3rd gen (c6i) (no-opt)

Details

Benchmark suite	Current: `326de4f`	Previous: `23f0c0f`	Ratio
`ML-KEM-512 keypair`	`47017` cycles	`46915` cycles	`1.00`
`ML-KEM-512 encaps`	`55767` cycles	`55723` cycles	`1.00`
`ML-KEM-512 decaps`	`71436` cycles	`71460` cycles	`1.00`
`ML-KEM-768 keypair`	`74462` cycles	`74407` cycles	`1.00`
`ML-KEM-768 encaps`	`85962` cycles	`85960` cycles	`1.00`
`ML-KEM-768 decaps`	`106946` cycles	`106977` cycles	`1.00`
`ML-KEM-1024 keypair`	`111440` cycles	`111323` cycles	`1.00`
`ML-KEM-1024 encaps`	`126156` cycles	`126051` cycles	`1.00`
`ML-KEM-1024 decaps`	`152195` cycles	`152138` cycles	`1.00`

This comment was automatically generated by workflow using github-action-benchmark.

oqs-bot

Graviton4 (no-opt)

Details

Benchmark suite	Current: `326de4f`	Previous: `23f0c0f`	Ratio
`ML-KEM-512 keypair`	`35217` cycles	`35184` cycles	`1.00`
`ML-KEM-512 encaps`	`40057` cycles	`39970` cycles	`1.00`
`ML-KEM-512 decaps`	`50570` cycles	`50607` cycles	`1.00`
`ML-KEM-768 keypair`	`56693` cycles	`56651` cycles	`1.00`
`ML-KEM-768 encaps`	`64088` cycles	`63988` cycles	`1.00`
`ML-KEM-768 decaps`	`78447` cycles	`78490` cycles	`1.00`
`ML-KEM-1024 keypair`	`87377` cycles	`87500` cycles	`1.00`
`ML-KEM-1024 encaps`	`96557` cycles	`96560` cycles	`1.00`
`ML-KEM-1024 decaps`	`114869` cycles	`114637` cycles	`1.00`

This comment was automatically generated by workflow using github-action-benchmark.

oqs-bot

AMD EPYC 4th gen (c7a) (no-opt)

Details

Benchmark suite	Current: `326de4f`	Previous: `23f0c0f`	Ratio
`ML-KEM-512 keypair`	`36721` cycles	`36727` cycles	`1.00`
`ML-KEM-512 encaps`	`42812` cycles	`42797` cycles	`1.00`
`ML-KEM-512 decaps`	`55529` cycles	`55543` cycles	`1.00`
`ML-KEM-768 keypair`	`58370` cycles	`58468` cycles	`1.00`
`ML-KEM-768 encaps`	`67042` cycles	`67072` cycles	`1.00`
`ML-KEM-768 decaps`	`83944` cycles	`83919` cycles	`1.00`
`ML-KEM-1024 keypair`	`88513` cycles	`88496` cycles	`1.00`
`ML-KEM-1024 encaps`	`99079` cycles	`99109` cycles	`1.00`
`ML-KEM-1024 decaps`	`120677` cycles	`120500` cycles	`1.00`

This comment was automatically generated by workflow using github-action-benchmark.

oqs-bot

Graviton3

Details

Benchmark suite	Current: `326de4f`	Previous: `23f0c0f`	Ratio
`ML-KEM-512 keypair`	`18637` cycles	`18653` cycles	`1.00`
`ML-KEM-512 encaps`	`21829` cycles	`21833` cycles	`1.00`
`ML-KEM-512 decaps`	`28837` cycles	`28874` cycles	`1.00`
`ML-KEM-768 keypair`	`31537` cycles	`31502` cycles	`1.00`
`ML-KEM-768 encaps`	`34746` cycles	`34750` cycles	`1.00`
`ML-KEM-768 decaps`	`44819` cycles	`44731` cycles	`1.00`
`ML-KEM-1024 keypair`	`46146` cycles	`46083` cycles	`1.00`
`ML-KEM-1024 encaps`	`51439` cycles	`51511` cycles	`1.00`
`ML-KEM-1024 decaps`	`64931` cycles	`64942` cycles	`1.00`

This comment was automatically generated by workflow using github-action-benchmark.

oqs-bot

Graviton3 (no-opt)

Details

Benchmark suite	Current: `326de4f`	Previous: `23f0c0f`	Ratio
`ML-KEM-512 keypair`	`38784` cycles	`38774` cycles	`1.00`
`ML-KEM-512 encaps`	`44461` cycles	`44429` cycles	`1.00`
`ML-KEM-512 decaps`	`56109` cycles	`56152` cycles	`1.00`
`ML-KEM-768 keypair`	`62350` cycles	`62275` cycles	`1.00`
`ML-KEM-768 encaps`	`70582` cycles	`70525` cycles	`1.00`
`ML-KEM-768 decaps`	`86241` cycles	`86297` cycles	`1.00`
`ML-KEM-1024 keypair`	`95600` cycles	`96017` cycles	`1.00`
`ML-KEM-1024 encaps`	`105885` cycles	`105890` cycles	`1.00`
`ML-KEM-1024 decaps`	`126025` cycles	`125734` cycles	`1.00`

This comment was automatically generated by workflow using github-action-benchmark.

oqs-bot

Graviton2

Details

Benchmark suite	Current: `326de4f`	Previous: `23f0c0f`	Ratio
`ML-KEM-512 keypair`	`28224` cycles	`28264` cycles	`1.00`
`ML-KEM-512 encaps`	`34093` cycles	`34089` cycles	`1.00`
`ML-KEM-512 decaps`	`44512` cycles	`44538` cycles	`1.00`
`ML-KEM-768 keypair`	`47622` cycles	`47615` cycles	`1.00`
`ML-KEM-768 encaps`	`53868` cycles	`53885` cycles	`1.00`
`ML-KEM-768 decaps`	`68573` cycles	`68528` cycles	`1.00`
`ML-KEM-1024 keypair`	`70176` cycles	`70167` cycles	`1.00`
`ML-KEM-1024 encaps`	`78620` cycles	`78569` cycles	`1.00`
`ML-KEM-1024 decaps`	`98228` cycles	`98312` cycles	`1.00`

This comment was automatically generated by workflow using github-action-benchmark.

oqs-bot

Graviton2 (no-opt)

Details

Benchmark suite	Current: `326de4f`	Previous: `23f0c0f`	Ratio
`ML-KEM-512 keypair`	`58716` cycles	`58695` cycles	`1.00`
`ML-KEM-512 encaps`	`68575` cycles	`68507` cycles	`1.00`
`ML-KEM-512 decaps`	`87424` cycles	`87279` cycles	`1.00`
`ML-KEM-768 keypair`	`94935` cycles	`94625` cycles	`1.00`
`ML-KEM-768 encaps`	`109275` cycles	`108873` cycles	`1.00`
`ML-KEM-768 decaps`	`134289` cycles	`133845` cycles	`1.00`
`ML-KEM-1024 keypair`	`151702` cycles	`151125` cycles	`1.00`
`ML-KEM-1024 encaps`	`166256` cycles	`165399` cycles	`1.01`
`ML-KEM-1024 decaps`	`199385` cycles	`199218` cycles	`1.00`

This comment was automatically generated by workflow using github-action-benchmark.

oqs-bot

SpacemiT K1 8 (Banana Pi F3) benchmarks

Details

Benchmark suite	Current: `326de4f`	Previous: `23f0c0f`	Ratio
`ML-KEM-512 keypair`	`143660` cycles	`143655` cycles	`1.00`
`ML-KEM-512 encaps`	`152006` cycles	`151977` cycles	`1.00`
`ML-KEM-512 decaps`	`190489` cycles	`190459` cycles	`1.00`
`ML-KEM-768 keypair`	`233989` cycles	`233932` cycles	`1.00`
`ML-KEM-768 encaps`	`251179` cycles	`251116` cycles	`1.00`
`ML-KEM-768 decaps`	`306561` cycles	`305962` cycles	`1.00`
`ML-KEM-1024 keypair`	`365554` cycles	`367148` cycles	`1.00`
`ML-KEM-1024 encaps`	`387857` cycles	`390444` cycles	`0.99`
`ML-KEM-1024 decaps`	`458387` cycles	`460969` cycles	`0.99`

This comment was automatically generated by workflow using github-action-benchmark.

oqs-bot

Arm Cortex-M55 (NUCLEO-N657X0-Q) benchmarks

Details

Benchmark suite	Current: `326de4f`	Previous: `23f0c0f`	Ratio
`ML-KEM-512 keypair`	`647367` cycles	`647367` cycles	`1`
`ML-KEM-512 encaps`	`728024` cycles	`728024` cycles	`1`
`ML-KEM-512 decaps`	`928692` cycles	`928690` cycles	`1.00`
`ML-KEM-768 keypair`	`1032214` cycles	`1032214` cycles	`1`
`ML-KEM-768 encaps`	`1162339` cycles	`1162339` cycles	`1`
`ML-KEM-768 decaps`	`1433590` cycles	`1433588` cycles	`1.00`
`ML-KEM-1024 keypair`	`1594936` cycles	`1594936` cycles	`1`
`ML-KEM-1024 encaps`	`1747347` cycles	`1747347` cycles	`1`
`ML-KEM-1024 decaps`	`2094866` cycles	`2094864` cycles	`1.00`

This comment was automatically generated by workflow using github-action-benchmark.

hanno-becker added the API-BREAK label Aug 5, 2026

hanno-becker added this to the v2 milestone Aug 5, 2026

hanno-becker force-pushed the err-refine branch 2 times, most recently from 68b3b47 to e0f568d Compare August 5, 2026 21:13

hanno-becker marked this pull request as ready for review August 5, 2026 21:14

hanno-becker requested a review from a team as a code owner August 5, 2026 21:14

hanno-becker requested a review from mkannwischer August 6, 2026 03:45

mkannwischer approved these changes Aug 6, 2026

View reviewed changes

mkannwischer added this pull request to the merge queue Aug 6, 2026

github-merge-queue Bot removed this pull request from the merge queue due to a conflict with the base branch Aug 6, 2026

hanno-becker force-pushed the err-refine branch 3 times, most recently from 48f23b5 to b15cd0f Compare August 6, 2026 14:03

hanno-becker marked this pull request as draft August 6, 2026 14:28

hanno-becker force-pushed the err-refine branch from b15cd0f to 32faffa Compare August 6, 2026 14:32

hanno-becker marked this pull request as ready for review August 6, 2026 14:38

hanno-becker enabled auto-merge August 6, 2026 14:47

hanno-becker added 2 commits August 7, 2026 04:26

hanno-becker force-pushed the err-refine branch from 32faffa to 326de4f Compare August 7, 2026 03:27

hanno-becker added the benchmark this PR should be benchmarked in CI label Aug 7, 2026

oqs-bot reviewed Aug 7, 2026

View reviewed changes

hanno-becker added this pull request to the merge queue Aug 7, 2026

oqs-bot reviewed Aug 7, 2026

View reviewed changes

Merged via the queue into main with commit 7c48efa Aug 7, 2026
394 of 396 checks passed

hanno-becker deleted the err-refine branch August 7, 2026 04:57

oqs-bot reviewed Aug 7, 2026

View reviewed changes

Uh oh!

Conversation

hanno-becker commented Aug 5, 2026

Uh oh!

oqs-bot commented Aug 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

CBMC Results (ML-KEM-768)

Uh oh!

oqs-bot commented Aug 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

CBMC Results (ML-KEM-512)

Uh oh!

oqs-bot commented Aug 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

CBMC Results (ML-KEM-1024)

Uh oh!

mkannwischer left a comment

Choose a reason for hiding this comment

Uh oh!

oqs-bot left a comment

Choose a reason for hiding this comment

Mac Mini (M1, 2020) benchmarks

Uh oh!

oqs-bot left a comment

Choose a reason for hiding this comment

Intel Xeon 4th gen (c7i)

Uh oh!

oqs-bot left a comment

Choose a reason for hiding this comment

AMD EPYC 3rd gen (c6a)

Uh oh!

oqs-bot left a comment

Choose a reason for hiding this comment

Intel Xeon 4th gen (c7i) (no-opt)

Uh oh!

oqs-bot left a comment

Choose a reason for hiding this comment

ppc64le (POWER10) benchmarks

Uh oh!

oqs-bot left a comment

Choose a reason for hiding this comment

Graviton5

Uh oh!

oqs-bot left a comment

Choose a reason for hiding this comment

Arm Cortex-A76 (Raspberry Pi 5) benchmarks

Uh oh!

oqs-bot left a comment

Choose a reason for hiding this comment

Intel Xeon 3rd gen (c6i)

Uh oh!

oqs-bot left a comment

Choose a reason for hiding this comment

AMD EPYC 4th gen (c7a)

Uh oh!

oqs-bot left a comment

Choose a reason for hiding this comment

Graviton4

Uh oh!

oqs-bot left a comment

Choose a reason for hiding this comment

Graviton5 (no-opt)

Uh oh!

oqs-bot left a comment

Choose a reason for hiding this comment

AMD EPYC 3rd gen (c6a) (no-opt)

Uh oh!

oqs-bot left a comment

Choose a reason for hiding this comment

Intel Xeon 3rd gen (c6i) (no-opt)

Uh oh!

oqs-bot left a comment

Choose a reason for hiding this comment

Graviton4 (no-opt)

Uh oh!

oqs-bot left a comment

Choose a reason for hiding this comment

AMD EPYC 4th gen (c7a) (no-opt)

Uh oh!

oqs-bot left a comment

oqs-bot commented Aug 5, 2026 •

edited

Loading

oqs-bot commented Aug 5, 2026 •

edited

Loading

oqs-bot commented Aug 5, 2026 •

edited

Loading