Skip to content

lowmem: Unpack z lazily in verification#1025

Draft
mkannwischer wants to merge 1 commit intomainfrom
verify-stream-z
Draft

lowmem: Unpack z lazily in verification#1025
mkannwischer wants to merge 1 commit intomainfrom
verify-stream-z

Conversation

@mkannwischer
Copy link
Copy Markdown
Contributor

@mkannwischer mkannwischer commented Apr 7, 2026 •
edited
Loading

Introduce mld_zvec following the lazy polyvec pattern (eager / lazy
variants with #define dispatch on MLD_CONFIG_REDUCE_RAM):

  • mld_zvec_init: in eager mode unpacks the full polyvecl, performs the
    polyvecl-wide infinity-norm bound check, and NTTs in place. In lazy
    mode it just stores a pointer to the packed signature bytes.
  • mld_zvec_get_poly: in eager mode copies a single polynomial from
    the precomputed vector. In lazy mode unpacks one polynomial,
    performs the per-poly infinity-norm bound check, and NTTs into
    the caller-provided buffer.

The norm check thus moves out of mld_sign_verify_internal into the
zvec init / get_poly accessors, so the verify body no longer has to
sequence chknorm explicitly.

Add a fused matrix-vector helper
mld_polyvec_matrix_pointwise_montgomery_zvec used by verify:

  • The eager variant is a thin wrapper around the existing
    mld_polyvec_matrix_pointwise_montgomery_eager (z is already NTT'd
    by mld_zvec_init).
  • The lazy variant streams z via mld_zvec_get_poly_lazy and generates
    the matrix on-the-fly column-by-column,
    accumulating A[*,l] * z[l] into w.

In REDUCE_RAM mode this avoids holding the full unpacked polyvecl z
in memory at once, reducing verify allocation by 2-5 KiB per parameter
set.

@oqs-bot
Copy link
Copy Markdown
Contributor

oqs-bot commented Apr 7, 2026 •
edited
Loading

CBMC Results (ML-DSA-44)

⚠️ Attention Required

Proof Status Current Previous Change
polyvecl_pointwise_acc_montgomery_c ⚠️ 183s 116s +58%
Full Results (203 proofs)
Proof Status Current Previous Change
**TOTAL** ✅ 1708s 1631s +4.7%
polyvecl_pointwise_acc_montgomery_c ⚠️ 183s 116s +58%
rej_uniform_native ✅ 111s 110s +1%
sign_verify_internal ✅ 93s 133s -30%
mld_invntt_layer ✅ 89s 92s -3%
poly_pointwise_montgomery_c ✅ 84s 86s -2%
mld_ct_memcmp ✅ 70s 74s -5%
mld_attempt_signature_generation ✅ 57s 53s +8%
mld_ntt_layer ✅ 42s 42s +0%
polyvec_matrix_expand ✅ 30s 25s +20%
fqmul ✅ 29s 28s +4%
sign_keypair_internal ✅ 22s 27s -19%
keccakf1600x4_permute_native ✅ 21s 22s -5%
polyvec_matrix_pointwise_montgomery ✅ 20s 23s -13%
sign_pk_from_sk ✅ 19s 20s -5%
sign_signature_internal ✅ 19s 21s -10%
rej_uniform_c ✅ 18s 22s -18%
mld_check_pct ✅ 17s 15s +13%
poly_chknorm_c ✅ 17s 16s +6%
polyveck_power2round ✅ 16s 6s +167%
polyt0_unpack ✅ 15s 14s +7%
rej_uniform ✅ 15s 15s +0%
mld_ntt_butterfly_block ✅ 14s 16s -12%
poly_uniform_eta_4x ✅ 12s 12s +0%
polyvec_matrix_pointwise_montgomery_zvec ✅ 12s - new
polyz_unpack_c ✅ 12s 12s +0%
poly_add ✅ 11s 10s +10%
poly_uniform_4x ✅ 11s 11s +0%
polyeta_unpack ✅ 11s 13s -15%
polyveck_decompose ✅ 11s 7s +57%
keccak_absorb_once_x4 ✅ 9s 8s +12%
polyvec_matrix_expand_serial ✅ 9s 4s +125%
polyveck_pointwise_poly_montgomery ✅ 9s 6s +50%
mld_compute_pack_z ✅ 8s 7s +14%
poly_invntt_tomont_c ✅ 8s 8s +0%
poly_power2round ✅ 8s 12s -33%
polyveck_add ✅ 8s 4s +100%
polyvecl_ntt ✅ 8s 8s +0%
keccak_absorb ✅ 7s 7s +0%
pointwise_acc_native_x86_64 ✅ 7s 4s +75%
poly_shiftl ✅ 7s 4s +75%
polyveck_pack_w1 ✅ 7s 2s +250%
keccakf1600_permute ✅ 6s 7s -14%
keccakf1600_permute_native ✅ 6s 7s -14%
poly_caddq_c ✅ 6s 5s +20%
poly_pointwise_montgomery ✅ 6s 3s +100%
polyvec_matrix_pointwise_montgomery_yvec ✅ 6s 12s -50%
polyveck_shiftl ✅ 6s 3s +100%
polyveck_unpack_eta ✅ 6s 5s +20%
polyvecl_pointwise_acc_montgomery ✅ 6s 3s +100%
rej_eta_c ✅ 6s 8s -25%
sign ✅ 6s 3s +100%
keccakf1600x4_permute ✅ 5s 1s +400%
mld_ct_cmask_nonzero_u32 ✅ 5s 3s +67%
mld_sample_s1_s2 ✅ 5s 4s +25%
ntt_native_aarch64 ✅ 5s 4s +25%
ntt_native_x86_64 ✅ 5s 3s +67%
pointwise_acc_native_aarch64 ✅ 5s 4s +25%
poly_caddq_native_aarch64 ✅ 5s 3s +67%
polyveck_chknorm ✅ 5s 15s -67%
polyveck_reduce ✅ 5s 4s +25%
rej_eta_native ✅ 5s 3s +67%
sig_unpack_hints ✅ 5s 3s +67%
sk_s1hat_get_poly ✅ 5s 2s +150%
use_hint ✅ 5s 3s +67%
caddq ✅ 4s 5s -20%
keccak_f1600_x4_native_aarch64_v8a_v84a_scalar_hybrid ✅ 4s 2s +100%
keccakf1600x4_extract_bytes ✅ 4s 4s +0%
mld_ct_abs_i32 ✅ 4s 2s +100%
mld_ct_get_optblocker_u32 ✅ 4s 3s +33%
mld_h ✅ 4s 2s +100%
nttunpack_native_x86_64 ✅ 4s 3s +33%
pack_sig_z ✅ 4s 2s +100%
pack_sk_rho_key_tr_s2_t0 ✅ 4s 3s +33%
pointwise_native_aarch64 ✅ 4s 5s -20%
poly_caddq ✅ 4s 4s +0%
poly_chknorm_native ✅ 4s 4s +0%
poly_decompose ✅ 4s 3s +33%
poly_decompose_c ✅ 4s 4s +0%
poly_invntt_tomont_native ✅ 4s 4s +0%
poly_make_hint ✅ 4s 2s +100%
poly_ntt_c ✅ 4s 2s +100%
poly_ntt_native ✅ 4s 3s +33%
poly_reduce ✅ 4s 4s +0%
poly_uniform_gamma1_4x ✅ 4s 7s -43%
poly_use_hint_c ✅ 4s 2s +100%
poly_use_hint_native ✅ 4s 1s +300%
poly_use_hint_native_aarch64 ✅ 4s 2s +100%
polyt0_pack ✅ 4s 3s +33%
polyt1_pack ✅ 4s 3s +33%
polyveck_caddq ✅ 4s 4s +0%
polyveck_pack_t0 ✅ 4s 3s +33%
polyveck_sub ✅ 4s 4s +0%
polyveck_use_hint ✅ 4s 8s -50%
polyvecl_unpack_z ✅ 4s 2s +100%
polyw1_pack ✅ 4s 4s +0%
polyz_unpack ✅ 4s 5s -20%
polyz_unpack_17_native_aarch64 ✅ 4s 4s +0%
power2round ✅ 4s 2s +100%
shake128x4_absorb_once ✅ 4s 5s -20%
shake256 ✅ 4s 1s +300%
sign_keypair ✅ 4s 3s +33%
sign_open ✅ 4s 5s -20%
sign_signature_pre_hash_shake256 ✅ 4s 3s +33%
sk_s2hat_get_poly ✅ 4s 2s +100%
sys_check_capability ✅ 4s 3s +33%
unpack_sk_t0hat ✅ 4s 3s +33%
yvec_get_poly ✅ 4s 2s +100%
zvec_get_poly ✅ 4s - new
decompose ✅ 3s 4s -25%
intt_native_x86_64 ✅ 3s 4s -25%
keccak_f1600_x4_native_avx2 ✅ 3s 3s +0%
keccak_squeezeblocks_x4 ✅ 3s 3s +0%
keccakf1600_extract_bytes (big endian) ✅ 3s 1s +200%
keccakf1600x4_xor_bytes ✅ 3s 3s +0%
mld_ct_cmask_neg_i32 ✅ 3s 2s +50%
mld_ct_get_optblocker_i64 ✅ 3s 2s +50%
mld_keccakf1600_extract_bytes ✅ 3s 2s +50%
mld_sample_s1_s2_serial ✅ 3s 2s +50%
mld_value_barrier_i64 ✅ 3s 1s +200%
pack_pk ✅ 3s 4s -25%
pack_sig_h_poly ✅ 3s 5s -40%
pack_sk_s1 ✅ 3s 2s +50%
pointwise_native_x86_64 ✅ 3s 4s -25%
poly_caddq_native ✅ 3s 4s -25%
poly_challenge ✅ 3s 2s +50%
poly_ntt ✅ 3s 2s +50%
poly_permute_bitrev_to_custom_optional ✅ 3s 4s -25%
poly_permute_bitrev_to_custom_optional_native ✅ 3s 3s +0%
poly_sub ✅ 3s 3s +0%
poly_uniform_gamma1 ✅ 3s 2s +50%
polyt1_unpack ✅ 3s 5s -40%
polyveck_invntt_tomont ✅ 3s 4s -25%
polyveck_ntt ✅ 3s 4s -25%
polyveck_pack_eta ✅ 3s 3s +0%
polyveck_unpack_t0 ✅ 3s 1s +200%
polyvecl_chknorm ✅ 3s 7s -57%
polyvecl_uniform_gamma1 ✅ 3s 3s +0%
polyvecl_uniform_gamma1_serial ✅ 3s 3s +0%
polyz_pack ✅ 3s 3s +0%
polyz_unpack_native ✅ 3s 4s -25%
reduce32 ✅ 3s 2s +50%
rej_eta ✅ 3s 4s -25%
shake128_finalize ✅ 3s 2s +50%
shake128_init ✅ 3s 2s +50%
shake128_release ✅ 3s 3s +0%
shake128_squeeze ✅ 3s 3s +0%
shake256_absorb ✅ 3s 3s +0%
shake256_init ✅ 3s 2s +50%
sign_signature ✅ 3s 3s +0%
sign_signature_extmu ✅ 3s 4s -25%
sign_signature_pre_hash_internal ✅ 3s 3s +0%
sign_verify_extmu ✅ 3s 3s +0%
sign_verify_pre_hash_internal ✅ 3s 4s -25%
sign_verify_pre_hash_shake256 ✅ 3s 3s +0%
sk_t0hat_get_poly ✅ 3s 2s +50%
unpack_pk_t1 ✅ 3s 2s +50%
unpack_sk_s2hat ✅ 3s 2s +50%
yvec_init ✅ 3s 5s -40%
zvec_init ✅ 3s - new
keccak_f1600_x1_native_aarch64 ✅ 2s 2s +0%
keccak_f1600_x1_native_aarch64_v84a ✅ 2s 2s +0%
keccak_f1600_x4_native_aarch64_v84a ✅ 2s 4s -50%
keccak_init ✅ 2s 2s +0%
keccak_squeeze ✅ 2s 2s +0%
keccakf1600_xor_bytes (big endian) ✅ 2s 3s -33%
make_hint ✅ 2s 4s -50%
mld_ct_cmask_nonzero_u8 ✅ 2s 4s -50%
mld_ct_get_optblocker_u8 ✅ 2s 2s +0%
mld_polymat_expand_entry ✅ 2s 3s -33%
mld_prepare_domain_separation_prefix ✅ 2s 3s -33%
mld_value_barrier_u32 ✅ 2s 3s -33%
mld_value_barrier_u8 ✅ 2s 1s +100%
montgomery_reduce ✅ 2s 5s -60%
pack_sig_c ✅ 2s 2s +0%
poly_chknorm_native_aarch64 ✅ 2s 3s -33%
poly_decompose_native ✅ 2s 4s -50%
poly_invntt_tomont ✅ 2s 3s -33%
poly_pointwise_montgomery_native ✅ 2s 4s -50%
poly_uniform ✅ 2s 5s -60%
poly_uniform_eta ✅ 2s 3s -33%
poly_use_hint ✅ 2s 2s +0%
polyeta_pack ✅ 2s 2s +0%
polyvec_matrix_pointwise_montgomery_row ✅ 2s 2s +0%
polyvecl_pack_eta ✅ 2s 3s -33%
polyvecl_pointwise_acc_montgomery_native ✅ 2s 2s +0%
polyvecl_unpack_eta ✅ 2s 3s -33%
shake128x4_squeezeblocks ✅ 2s 3s -33%
shake256_squeeze ✅ 2s 2s +0%
shake256x4_absorb_once ✅ 2s 2s +0%
shake256x4_squeezeblocks ✅ 2s 2s +0%
sign_verify ✅ 2s 2s +0%
unpack_sk ✅ 2s 4s -50%
unpack_sk_s1hat ✅ 2s 3s -33%
fqscale ✅ 1s 2s -50%
keccak_f1600_x4_native_aarch64_v8a_scalar_hybrid ✅ 1s 2s -50%
keccak_finalize ✅ 1s 2s -50%
keccakf1600_xor_bytes ✅ 1s 2s -50%
mld_ct_sel_int32 ✅ 1s 1s +0%
poly_chknorm ✅ 1s 2s -50%
polyz_unpack_19_native_aarch64 ✅ 1s 4s -75%
shake128_absorb ✅ 1s 1s +0%
shake256_finalize ✅ 1s 1s +0%
shake256_release ✅ 1s 2s -50%

@oqs-bot
Copy link
Copy Markdown
Contributor

oqs-bot commented Apr 7, 2026 •
edited
Loading

CBMC Results (ML-DSA-65)

Full Results (203 proofs)
Proof Status Current Previous Change
**TOTAL** ✅ 1901s 2292s -17.1%
sign_verify_internal ✅ 198s 252s -21%
rej_uniform_native ✅ 121s 119s +2%
polyvecl_pointwise_acc_montgomery_c ✅ 117s 489s -76%
polyvec_matrix_expand ✅ 116s 122s -5%
poly_pointwise_montgomery_c ✅ 91s 93s -2%
mld_invntt_layer ✅ 89s 88s +1%
mld_ct_memcmp ✅ 73s 73s +0%
mld_attempt_signature_generation ✅ 57s 40s +43%
mld_ntt_layer ✅ 42s 41s +2%
polyvec_matrix_expand_serial ✅ 32s 24s +33%
sign_keypair_internal ✅ 32s 31s +3%
fqmul ✅ 27s 31s -13%
sign_signature_internal ✅ 25s 26s -4%
polyvec_matrix_pointwise_montgomery_yvec ✅ 24s 20s +20%
keccakf1600x4_permute_native ✅ 23s 24s -4%
sign_pk_from_sk ✅ 23s 18s +28%
rej_uniform_c ✅ 18s 20s -10%
poly_chknorm_c ✅ 17s 14s +21%
polyvec_matrix_pointwise_montgomery ✅ 17s 21s -19%
rej_uniform ✅ 16s 16s +0%
mld_ntt_butterfly_block ✅ 15s 14s +7%
polyveck_power2round ✅ 14s 13s +8%
poly_add ✅ 13s 10s +30%
polyt0_unpack ✅ 13s 14s -7%
polyveck_pointwise_poly_montgomery ✅ 13s 7s +86%
poly_uniform_4x ✅ 12s 12s +0%
poly_uniform_eta_4x ✅ 12s 12s +0%
polyveck_decompose ✅ 12s 13s -8%
mld_check_pct ✅ 11s 9s +22%
polyveck_use_hint ✅ 11s 10s +10%
polyveck_add ✅ 10s 9s +11%
mld_compute_pack_z ✅ 9s 8s +12%
poly_invntt_tomont_c ✅ 9s 9s +0%
polyveck_sub ✅ 9s 5s +80%
keccakf1600_permute ✅ 8s 6s +33%
poly_power2round ✅ 8s 9s -11%
polyveck_ntt ✅ 8s 5s +60%
polyvecl_ntt ✅ 8s 7s +14%
sign ✅ 8s 7s +14%
keccak_absorb ✅ 7s 8s -12%
keccak_absorb_once_x4 ✅ 7s 10s -30%
mld_prepare_domain_separation_prefix ✅ 7s 5s +40%
poly_use_hint_native ✅ 7s 2s +250%
polyveck_chknorm ✅ 7s 4s +75%
polyveck_reduce ✅ 7s 5s +40%
polyvecl_chknorm ✅ 7s 7s +0%
rej_eta_native ✅ 7s 4s +75%
keccakf1600_permute_native ✅ 6s 9s -33%
mld_sample_s1_s2_serial ✅ 6s 5s +20%
mld_value_barrier_u8 ✅ 6s 1s +500%
pointwise_acc_native_aarch64 ✅ 6s 5s +20%
poly_uniform_gamma1_4x ✅ 6s 3s +100%
polyeta_unpack ✅ 6s 3s +100%
polyveck_caddq ✅ 6s 8s -25%
polyveck_shiftl ✅ 6s 5s +20%
polyz_unpack_c ✅ 6s 6s +0%
sig_unpack_hints ✅ 6s 6s +0%
fqscale ✅ 5s 5s +0%
mld_h ✅ 5s 3s +67%
mld_sample_s1_s2 ✅ 5s 6s -17%
pointwise_acc_native_x86_64 ✅ 5s 6s -17%
pointwise_native_x86_64 ✅ 5s 3s +67%
poly_caddq_native_aarch64 ✅ 5s 3s +67%
poly_make_hint ✅ 5s 2s +150%
poly_permute_bitrev_to_custom_optional_native ✅ 5s 3s +67%
polyveck_invntt_tomont ✅ 5s 5s +0%
polyvecl_pointwise_acc_montgomery_native ✅ 5s 3s +67%
polyz_unpack_17_native_aarch64 ✅ 5s 4s +25%
polyz_unpack_native ✅ 5s 4s +25%
rej_eta_c ✅ 5s 3s +67%
sign_open ✅ 5s 7s -29%
sign_signature ✅ 5s 3s +67%
sign_signature_extmu ✅ 5s 3s +67%
sign_verify_pre_hash_shake256 ✅ 5s 4s +25%
sys_check_capability ✅ 5s 3s +67%
unpack_sk_t0hat ✅ 5s 3s +67%
zvec_init ✅ 5s - new
intt_native_x86_64 ✅ 4s 2s +100%
keccak_squeezeblocks_x4 ✅ 4s 3s +33%
mld_ct_cmask_nonzero_u32 ✅ 4s 5s -20%
ntt_native_aarch64 ✅ 4s 4s +0%
pack_pk ✅ 4s 2s +100%
pack_sig_c ✅ 4s 3s +33%
poly_challenge ✅ 4s 5s -20%
poly_chknorm_native ✅ 4s 2s +100%
poly_chknorm_native_aarch64 ✅ 4s 2s +100%
poly_decompose_c ✅ 4s 3s +33%
poly_invntt_tomont_native ✅ 4s 4s +0%
poly_ntt_native ✅ 4s 2s +100%
poly_shiftl ✅ 4s 4s +0%
poly_use_hint_c ✅ 4s 4s +0%
poly_use_hint_native_aarch64 ✅ 4s 5s -20%
polyt1_pack ✅ 4s 2s +100%
polyvec_matrix_pointwise_montgomery_zvec ✅ 4s - new
polyveck_unpack_eta ✅ 4s 3s +33%
shake256_finalize ✅ 4s 2s +100%
sign_keypair ✅ 4s 3s +33%
unpack_sk_s1hat ✅ 4s 4s +0%
decompose ✅ 3s 3s +0%
keccak_f1600_x1_native_aarch64 ✅ 3s 3s +0%
keccak_squeeze ✅ 3s 3s +0%
keccakf1600x4_permute ✅ 3s 4s -25%
mld_ct_cmask_nonzero_u8 ✅ 3s 4s -25%
mld_ct_get_optblocker_i64 ✅ 3s 3s +0%
mld_ct_get_optblocker_u32 ✅ 3s 3s +0%
mld_ct_sel_int32 ✅ 3s 1s +200%
mld_keccakf1600_extract_bytes ✅ 3s 3s +0%
mld_polymat_expand_entry ✅ 3s 5s -40%
ntt_native_x86_64 ✅ 3s 5s -40%
nttunpack_native_x86_64 ✅ 3s 3s +0%
pack_sig_h_poly ✅ 3s 4s -25%
poly_caddq_native ✅ 3s 3s +0%
poly_decompose ✅ 3s 2s +50%
poly_decompose_native ✅ 3s 4s -25%
poly_invntt_tomont ✅ 3s 3s +0%
poly_ntt_c ✅ 3s 2s +50%
poly_pointwise_montgomery ✅ 3s 4s -25%
poly_pointwise_montgomery_native ✅ 3s 4s -25%
poly_sub ✅ 3s 2s +50%
poly_uniform_eta ✅ 3s 3s +0%
poly_uniform_gamma1 ✅ 3s 3s +0%
poly_use_hint ✅ 3s 3s +0%
polyt1_unpack ✅ 3s 5s -40%
polyveck_pack_t0 ✅ 3s 4s -25%
polyveck_pack_w1 ✅ 3s 3s +0%
polyveck_unpack_t0 ✅ 3s 5s -40%
polyvecl_pointwise_acc_montgomery ✅ 3s 4s -25%
polyvecl_unpack_z ✅ 3s 3s +0%
polyz_pack ✅ 3s 2s +50%
polyz_unpack ✅ 3s 2s +50%
shake128_squeeze ✅ 3s 2s +50%
shake128x4_absorb_once ✅ 3s 1s +200%
shake256_init ✅ 3s 2s +50%
shake256_release ✅ 3s 2s +50%
shake256_squeeze ✅ 3s 7s -57%
shake256x4_squeezeblocks ✅ 3s 3s +0%
sign_signature_pre_hash_internal ✅ 3s 6s -50%
sign_signature_pre_hash_shake256 ✅ 3s 8s -62%
sign_verify_pre_hash_internal ✅ 3s 3s +0%
sk_s1hat_get_poly ✅ 3s 3s +0%
unpack_sk ✅ 3s 4s -25%
yvec_init ✅ 3s 2s +50%
caddq ✅ 2s 3s -33%
keccak_f1600_x4_native_aarch64_v84a ✅ 2s 2s +0%
keccak_f1600_x4_native_aarch64_v8a_scalar_hybrid ✅ 2s 1s +100%
keccak_f1600_x4_native_aarch64_v8a_v84a_scalar_hybrid ✅ 2s 2s +0%
keccak_f1600_x4_native_avx2 ✅ 2s 3s -33%
keccak_finalize ✅ 2s 2s +0%
keccak_init ✅ 2s 2s +0%
keccakf1600_extract_bytes (big endian) ✅ 2s 3s -33%
keccakf1600_xor_bytes ✅ 2s 2s +0%
keccakf1600_xor_bytes (big endian) ✅ 2s 2s +0%
make_hint ✅ 2s 3s -33%
mld_ct_get_optblocker_u8 ✅ 2s 2s +0%
montgomery_reduce ✅ 2s 4s -50%
pack_sig_z ✅ 2s 4s -50%
pack_sk_rho_key_tr_s2_t0 ✅ 2s 3s -33%
pack_sk_s1 ✅ 2s 3s -33%
pointwise_native_aarch64 ✅ 2s 3s -33%
poly_caddq ✅ 2s 3s -33%
poly_caddq_c ✅ 2s 5s -60%
poly_ntt ✅ 2s 3s -33%
poly_permute_bitrev_to_custom_optional ✅ 2s 3s -33%
poly_reduce ✅ 2s 2s +0%
poly_uniform ✅ 2s 3s -33%
polyeta_pack ✅ 2s 3s -33%
polyt0_pack ✅ 2s 5s -60%
polyvec_matrix_pointwise_montgomery_row ✅ 2s 5s -60%
polyveck_pack_eta ✅ 2s 2s +0%
polyvecl_uniform_gamma1 ✅ 2s 3s -33%
polyvecl_uniform_gamma1_serial ✅ 2s 3s -33%
polyz_unpack_19_native_aarch64 ✅ 2s 1s +100%
power2round ✅ 2s 2s +0%
rej_eta ✅ 2s 3s -33%
shake128_absorb ✅ 2s 2s +0%
shake128_finalize ✅ 2s 6s -67%
shake128_release ✅ 2s 4s -50%
shake128x4_squeezeblocks ✅ 2s 1s +100%
shake256 ✅ 2s 3s -33%
shake256_absorb ✅ 2s 3s -33%
shake256x4_absorb_once ✅ 2s 2s +0%
sign_verify ✅ 2s 4s -50%
sign_verify_extmu ✅ 2s 4s -50%
sk_s2hat_get_poly ✅ 2s 2s +0%
sk_t0hat_get_poly ✅ 2s 3s -33%
unpack_sk_s2hat ✅ 2s 4s -50%
use_hint ✅ 2s 2s +0%
yvec_get_poly ✅ 2s 3s -33%
zvec_get_poly ✅ 2s - new
keccak_f1600_x1_native_aarch64_v84a ✅ 1s 3s -67%
keccakf1600x4_extract_bytes ✅ 1s 3s -67%
keccakf1600x4_xor_bytes ✅ 1s 3s -67%
mld_ct_abs_i32 ✅ 1s 2s -50%
mld_ct_cmask_neg_i32 ✅ 1s 4s -75%
mld_value_barrier_i64 ✅ 1s 1s +0%
mld_value_barrier_u32 ✅ 1s 1s +0%
poly_chknorm ✅ 1s 4s -75%
polyvecl_pack_eta ✅ 1s 2s -50%
polyvecl_unpack_eta ✅ 1s 2s -50%
polyw1_pack ✅ 1s 3s -67%
reduce32 ✅ 1s 4s -75%
shake128_init ✅ 1s 3s -67%
unpack_pk_t1 ✅ 1s 2s -50%

@oqs-bot
Copy link
Copy Markdown
Contributor

oqs-bot commented Apr 7, 2026 •
edited
Loading

CBMC Results (ML-DSA-87)

⚠️ Attention Required

Proof Status Current Previous Change
polyveck_decompose ⚠️ 22s 10s +120%
Full Results (203 proofs)
Proof Status Current Previous Change
**TOTAL** ✅ 2539s 2475s +2.6%
sign_verify_internal ✅ 555s 375s +48%
polyvecl_pointwise_acc_montgomery_c ✅ 239s 322s -26%
polyvec_matrix_expand ✅ 170s 156s +9%
rej_uniform_native ✅ 124s 117s +6%
poly_pointwise_montgomery_c ✅ 95s 90s +6%
mld_invntt_layer ✅ 90s 92s -2%
mld_ct_memcmp ✅ 74s 70s +6%
mld_attempt_signature_generation ✅ 68s 108s -37%
sign_keypair_internal ✅ 50s 53s -6%
polyvec_matrix_expand_serial ✅ 46s 53s -13%
mld_ntt_layer ✅ 41s 40s +2%
sign_signature_internal ✅ 30s 36s -17%
fqmul ✅ 27s 27s +0%
keccakf1600x4_permute_native ✅ 24s 25s -4%
sign_pk_from_sk ✅ 24s 33s -27%
polyvec_matrix_pointwise_montgomery ✅ 23s 28s -18%
polyveck_decompose ⚠️ 22s 10s +120%
poly_chknorm_c ✅ 18s 17s +6%
rej_uniform_c ✅ 18s 17s +6%
mld_ntt_butterfly_block ✅ 17s 18s -6%
polyvec_matrix_pointwise_montgomery_yvec ✅ 16s 19s -16%
polyveck_power2round ✅ 16s 33s -52%
poly_uniform_eta_4x ✅ 15s 13s +15%
polyt0_unpack ✅ 15s 13s +15%
polyveck_use_hint ✅ 14s 8s +75%
rej_uniform ✅ 14s 17s -18%
mld_check_pct ✅ 13s 8s +62%
polyvecl_chknorm ✅ 13s 5s +160%
polyeta_unpack ✅ 12s 15s -20%
poly_uniform_4x ✅ 11s 12s -8%
keccak_absorb_once_x4 ✅ 10s 8s +25%
polyveck_pointwise_poly_montgomery ✅ 10s 9s +11%
poly_add ✅ 9s 12s -25%
poly_decompose_c ✅ 9s 7s +29%
poly_power2round ✅ 9s 9s +0%
polyveck_caddq ✅ 9s 4s +125%
polyvec_matrix_pointwise_montgomery_zvec ✅ 8s - new
polyvecl_ntt ✅ 8s 7s +14%
intt_native_x86_64 ✅ 7s 3s +133%
keccak_absorb ✅ 7s 8s -12%
keccakf1600_permute ✅ 7s 8s -12%
mld_compute_pack_z ✅ 7s 7s +0%
mld_sample_s1_s2 ✅ 7s 5s +40%
pointwise_acc_native_x86_64 ✅ 7s 6s +17%
poly_invntt_tomont_c ✅ 7s 8s -12%
polyveck_invntt_tomont ✅ 7s 7s +0%
polyz_unpack_c ✅ 7s 8s -12%
sig_unpack_hints ✅ 7s 6s +17%
sign ✅ 7s 7s +0%
sign_verify_pre_hash_internal ✅ 7s 4s +75%
keccak_init ✅ 6s 3s +100%
keccakf1600_permute_native ✅ 6s 9s -33%
mld_prepare_domain_separation_prefix ✅ 6s 6s +0%
pointwise_acc_native_aarch64 ✅ 6s 8s -25%
polyveck_add ✅ 6s 12s -50%
polyveck_shiftl ✅ 6s 6s +0%
polyveck_sub ✅ 6s 8s -25%
shake128_init ✅ 6s 3s +100%
sign_signature_extmu ✅ 6s 3s +100%
sign_verify_extmu ✅ 6s 3s +100%
sign_verify_pre_hash_shake256 ✅ 6s 2s +200%
unpack_sk ✅ 6s 2s +200%
mld_h ✅ 5s 2s +150%
mld_keccakf1600_extract_bytes ✅ 5s 2s +150%
pointwise_native_aarch64 ✅ 5s 3s +67%
poly_caddq_c ✅ 5s 3s +67%
poly_permute_bitrev_to_custom_optional ✅ 5s 3s +67%
poly_permute_bitrev_to_custom_optional_native ✅ 5s 3s +67%
poly_reduce ✅ 5s 3s +67%
poly_use_hint_c ✅ 5s 3s +67%
poly_use_hint_native ✅ 5s 4s +25%
polyveck_chknorm ✅ 5s 5s +0%
polyveck_ntt ✅ 5s 11s -55%
polyveck_reduce ✅ 5s 6s -17%
polyveck_unpack_t0 ✅ 5s 5s +0%
polyvecl_pointwise_acc_montgomery_native ✅ 5s 7s -29%
polyvecl_uniform_gamma1 ✅ 5s 6s -17%
polyvecl_unpack_z ✅ 5s 3s +67%
reduce32 ✅ 5s 1s +400%
sign_open ✅ 5s 3s +67%
sys_check_capability ✅ 5s 2s +150%
unpack_sk_s1hat ✅ 5s 4s +25%
keccak_squeezeblocks_x4 ✅ 4s 3s +33%
mld_sample_s1_s2_serial ✅ 4s 5s -20%
ntt_native_aarch64 ✅ 4s 2s +100%
nttunpack_native_x86_64 ✅ 4s 5s -20%
pack_sig_c ✅ 4s 3s +33%
pack_sig_h_poly ✅ 4s 3s +33%
poly_chknorm ✅ 4s 5s -20%
poly_chknorm_native ✅ 4s 3s +33%
poly_shiftl ✅ 4s 3s +33%
poly_sub ✅ 4s 3s +33%
poly_uniform_eta ✅ 4s 5s -20%
poly_uniform_gamma1_4x ✅ 4s 5s -20%
poly_use_hint ✅ 4s 2s +100%
polyveck_pack_t0 ✅ 4s 6s -33%
polyveck_unpack_eta ✅ 4s 4s +0%
polyvecl_pointwise_acc_montgomery ✅ 4s 3s +33%
polyvecl_uniform_gamma1_serial ✅ 4s 3s +33%
polyvecl_unpack_eta ✅ 4s 4s +0%
shake128_squeeze ✅ 4s 4s +0%
shake128x4_squeezeblocks ✅ 4s 3s +33%
sign_signature_pre_hash_shake256 ✅ 4s 5s -20%
sign_verify ✅ 4s 5s -20%
unpack_pk_t1 ✅ 4s 4s +0%
use_hint ✅ 4s 4s +0%
zvec_init ✅ 4s - new
caddq ✅ 3s 4s -25%
fqscale ✅ 3s 2s +50%
keccak_squeeze ✅ 3s 4s -25%
keccakf1600_xor_bytes (big endian) ✅ 3s 1s +200%
keccakf1600x4_extract_bytes ✅ 3s 3s +0%
mld_ct_cmask_nonzero_u8 ✅ 3s 3s +0%
mld_polymat_expand_entry ✅ 3s 2s +50%
pack_pk ✅ 3s 3s +0%
pack_sk_rho_key_tr_s2_t0 ✅ 3s 3s +0%
pointwise_native_x86_64 ✅ 3s 5s -40%
poly_caddq ✅ 3s 2s +50%
poly_caddq_native ✅ 3s 5s -40%
poly_caddq_native_aarch64 ✅ 3s 2s +50%
poly_challenge ✅ 3s 3s +0%
poly_decompose ✅ 3s 2s +50%
poly_decompose_native ✅ 3s 3s +0%
poly_ntt_c ✅ 3s 2s +50%
poly_uniform ✅ 3s 4s -25%
poly_uniform_gamma1 ✅ 3s 2s +50%
poly_use_hint_native_aarch64 ✅ 3s 4s -25%
polyt0_pack ✅ 3s 4s -25%
polyt1_pack ✅ 3s 3s +0%
polyvec_matrix_pointwise_montgomery_row ✅ 3s 2s +50%
polyveck_pack_eta ✅ 3s 5s -40%
polyveck_pack_w1 ✅ 3s 5s -40%
polyvecl_pack_eta ✅ 3s 4s -25%
polyz_unpack_17_native_aarch64 ✅ 3s 4s -25%
polyz_unpack_native ✅ 3s 3s +0%
rej_eta_c ✅ 3s 3s +0%
shake128_absorb ✅ 3s 2s +50%
shake256 ✅ 3s 1s +200%
shake256_absorb ✅ 3s 2s +50%
shake256x4_absorb_once ✅ 3s 3s +0%
sign_keypair ✅ 3s 5s -40%
sign_signature ✅ 3s 4s -25%
sk_s2hat_get_poly ✅ 3s 4s -25%
unpack_sk_s2hat ✅ 3s 5s -40%
unpack_sk_t0hat ✅ 3s 2s +50%
zvec_get_poly ✅ 3s - new
decompose ✅ 2s 3s -33%
keccak_f1600_x1_native_aarch64 ✅ 2s 1s +100%
keccak_f1600_x4_native_aarch64_v84a ✅ 2s 4s -50%
keccak_f1600_x4_native_avx2 ✅ 2s 3s -33%
keccak_finalize ✅ 2s 1s +100%
keccakf1600_xor_bytes ✅ 2s 2s +0%
keccakf1600x4_permute ✅ 2s 1s +100%
make_hint ✅ 2s 1s +100%
mld_ct_abs_i32 ✅ 2s 3s -33%
mld_ct_cmask_neg_i32 ✅ 2s 3s -33%
mld_ct_get_optblocker_u32 ✅ 2s 4s -50%
mld_ct_get_optblocker_u8 ✅ 2s 1s +100%
mld_ct_sel_int32 ✅ 2s 4s -50%
mld_value_barrier_i64 ✅ 2s 2s +0%
mld_value_barrier_u32 ✅ 2s 2s +0%
mld_value_barrier_u8 ✅ 2s 1s +100%
montgomery_reduce ✅ 2s 4s -50%
ntt_native_x86_64 ✅ 2s 3s -33%
pack_sig_z ✅ 2s 4s -50%
pack_sk_s1 ✅ 2s 2s +0%
poly_invntt_tomont_native ✅ 2s 3s -33%
poly_ntt ✅ 2s 2s +0%
poly_ntt_native ✅ 2s 3s -33%
poly_pointwise_montgomery ✅ 2s 3s -33%
poly_pointwise_montgomery_native ✅ 2s 3s -33%
polyeta_pack ✅ 2s 2s +0%
polyt1_unpack ✅ 2s 1s +100%
polyw1_pack ✅ 2s 5s -60%
polyz_pack ✅ 2s 4s -50%
polyz_unpack ✅ 2s 2s +0%
polyz_unpack_19_native_aarch64 ✅ 2s 2s +0%
power2round ✅ 2s 2s +0%
rej_eta ✅ 2s 4s -50%
rej_eta_native ✅ 2s 5s -60%
shake128_finalize ✅ 2s 1s +100%
shake128_release ✅ 2s 3s -33%
shake256_init ✅ 2s 4s -50%
shake256_release ✅ 2s 2s +0%
sign_signature_pre_hash_internal ✅ 2s 3s -33%
sk_s1hat_get_poly ✅ 2s 5s -60%
sk_t0hat_get_poly ✅ 2s 3s -33%
yvec_get_poly ✅ 2s 4s -50%
yvec_init ✅ 2s 5s -60%
keccak_f1600_x1_native_aarch64_v84a ✅ 1s 2s -50%
keccak_f1600_x4_native_aarch64_v8a_scalar_hybrid ✅ 1s 3s -67%
keccak_f1600_x4_native_aarch64_v8a_v84a_scalar_hybrid ✅ 1s 2s -50%
keccakf1600_extract_bytes (big endian) ✅ 1s 2s -50%
keccakf1600x4_xor_bytes ✅ 1s 1s +0%
mld_ct_cmask_nonzero_u32 ✅ 1s 4s -75%
mld_ct_get_optblocker_i64 ✅ 1s 3s -67%
poly_chknorm_native_aarch64 ✅ 1s 3s -67%
poly_invntt_tomont ✅ 1s 3s -67%
poly_make_hint ✅ 1s 5s -80%
shake128x4_absorb_once ✅ 1s 2s -50%
shake256_finalize ✅ 1s 1s +0%
shake256_squeeze ✅ 1s 3s -67%
shake256x4_squeezeblocks ✅ 1s 2s -50%

@mkannwischer mkannwischer marked this pull request as ready for review April 7, 2026 08:01
@mkannwischer mkannwischer requested a review from a team as a code owner April 7, 2026 08:01
@mkannwischer mkannwischer marked this pull request as draft May 2, 2026 13:16
@mkannwischer mkannwischer force-pushed the verify-stream-z branch 2 times, most recently from 770cd6a to 2e91517 Compare May 2, 2026 13:39
@oqs-bot
Copy link
Copy Markdown
Contributor

oqs-bot commented May 2, 2026 •
edited
Loading

CBMC Results (ML-DSA-65, REDUCE-RAM)

Full Results (203 proofs)
Proof Status Current Previous Change
**TOTAL** ✅ 1724s 1537s +12.2%
poly_pointwise_montgomery_c ✅ 190s 174s +9%
mld_invntt_layer ✅ 113s 104s +9%
rej_uniform_native ✅ 113s 106s +7%
polyvec_matrix_pointwise_montgomery_zvec ✅ 110s - new
polyvec_matrix_pointwise_montgomery_yvec ✅ 104s 75s +39%
mld_ct_memcmp ✅ 80s 71s +13%
mld_ntt_layer ✅ 45s 42s +7%
fqmul ✅ 28s 27s +4%
mld_attempt_signature_generation ✅ 27s 30s -10%
sign_keypair_internal ✅ 25s 23s +9%
keccakf1600x4_permute_native ✅ 22s 24s -8%
sign_verify_internal ✅ 21s 21s +0%
rej_uniform ✅ 20s 21s -5%
rej_uniform_c ✅ 20s 20s +0%
polyveck_power2round ✅ 19s 15s +27%
polyveck_sub ✅ 17s 6s +183%
mld_ntt_butterfly_block ✅ 16s 14s +14%
poly_uniform_eta_4x ✅ 13s 12s +8%
polyveck_decompose ✅ 13s 17s -24%
polyveck_pointwise_poly_montgomery ✅ 13s 8s +62%
mld_check_pct ✅ 12s 11s +9%
poly_chknorm_c ✅ 12s 14s -14%
polyveck_use_hint ✅ 12s 9s +33%
sign_pk_from_sk ✅ 11s 13s -15%
keccak_absorb_once_x4 ✅ 10s 9s +11%
poly_add ✅ 10s 10s +0%
polyt0_unpack ✅ 10s 10s +0%
polyveck_add ✅ 10s 12s -17%
poly_caddq_c ✅ 9s 8s +12%
polyvec_matrix_pointwise_montgomery_row ✅ 9s 15s -40%
polyvecl_chknorm ✅ 9s 7s +29%
keccakf1600_permute_native ✅ 8s 11s -27%
pointwise_acc_native_aarch64 ✅ 8s 6s +33%
poly_invntt_tomont_c ✅ 8s 9s -11%
poly_power2round ✅ 8s 8s +0%
polyveck_invntt_tomont ✅ 8s 7s +14%
polyveck_shiftl ✅ 8s 4s +100%
polyvecl_ntt ✅ 8s 8s +0%
keccak_absorb ✅ 7s 7s +0%
keccakf1600_permute ✅ 7s 8s -12%
pointwise_acc_native_x86_64 ✅ 7s 5s +40%
polyveck_caddq ✅ 7s 8s -12%
polyveck_ntt ✅ 7s 6s +17%
sig_unpack_hints ✅ 7s 6s +17%
sign ✅ 7s 7s +0%
mld_prepare_domain_separation_prefix ✅ 6s 6s +0%
mld_sample_s1_s2 ✅ 6s 5s +20%
poly_chknorm_native_aarch64 ✅ 6s 2s +200%
polyveck_chknorm ✅ 6s 8s -25%
polyveck_reduce ✅ 6s 6s +0%
polyvecl_pointwise_acc_montgomery_c ✅ 6s 3s +100%
sign_signature ✅ 6s 5s +20%
keccak_f1600_x4_native_aarch64_v84a ✅ 5s 3s +67%
mld_compute_pack_z ✅ 5s 7s -29%
poly_challenge ✅ 5s 4s +25%
poly_chknorm ✅ 5s 2s +150%
poly_invntt_tomont_native ✅ 5s 4s +25%
poly_sub ✅ 5s 2s +150%
poly_uniform_4x ✅ 5s 3s +67%
polyvec_matrix_pointwise_montgomery ✅ 5s 4s +25%
polyveck_pack_t0 ✅ 5s 2s +150%
polyvecl_pack_eta ✅ 5s 3s +67%
polyz_unpack ✅ 5s 4s +25%
sign_signature_internal ✅ 5s 4s +25%
sign_signature_pre_hash_internal ✅ 5s 3s +67%
sign_verify ✅ 5s 5s +0%
caddq ✅ 4s 1s +300%
keccak_squeezeblocks_x4 ✅ 4s 5s -20%
keccakf1600x4_permute ✅ 4s 4s +0%
mld_polymat_expand_entry ✅ 4s 2s +100%
ntt_native_x86_64 ✅ 4s 1s +300%
nttunpack_native_x86_64 ✅ 4s 2s +100%
pack_pk ✅ 4s 3s +33%
pack_sig_z ✅ 4s 2s +100%
pointwise_native_aarch64 ✅ 4s 3s +33%
poly_caddq ✅ 4s 4s +0%
poly_caddq_native ✅ 4s 5s -20%
poly_ntt_c ✅ 4s 2s +100%
poly_pointwise_montgomery_native ✅ 4s 4s +0%
poly_shiftl ✅ 4s 7s -43%
poly_uniform_eta ✅ 4s 4s +0%
poly_uniform_gamma1 ✅ 4s 3s +33%
poly_use_hint ✅ 4s 1s +300%
poly_use_hint_c ✅ 4s 5s -20%
poly_use_hint_native ✅ 4s 5s -20%
polyt0_pack ✅ 4s 6s -33%
polyveck_pack_eta ✅ 4s 3s +33%
polyveck_pack_w1 ✅ 4s 1s +300%
polyvecl_uniform_gamma1_serial ✅ 4s 4s +0%
polyvecl_unpack_eta ✅ 4s 2s +100%
polyz_unpack_17_native_aarch64 ✅ 4s 3s +33%
rej_eta_c ✅ 4s 2s +100%
sign_keypair ✅ 4s 2s +100%
sign_open ✅ 4s 4s +0%
sign_signature_pre_hash_shake256 ✅ 4s 4s +0%
sign_verify_extmu ✅ 4s 3s +33%
sign_verify_pre_hash_internal ✅ 4s 3s +33%
unpack_pk_t1 ✅ 4s 3s +33%
unpack_sk ✅ 4s 4s +0%
unpack_sk_s1hat ✅ 4s 2s +100%
yvec_init ✅ 4s 4s +0%
zvec_get_poly ✅ 4s - new
decompose ✅ 3s 2s +50%
intt_native_x86_64 ✅ 3s 5s -40%
keccak_f1600_x1_native_aarch64_v84a ✅ 3s 1s +200%
keccak_f1600_x4_native_aarch64_v8a_scalar_hybrid ✅ 3s 4s -25%
keccak_f1600_x4_native_aarch64_v8a_v84a_scalar_hybrid ✅ 3s 1s +200%
keccak_finalize ✅ 3s 2s +50%
keccakf1600_extract_bytes (big endian) ✅ 3s 3s +0%
mld_ct_cmask_neg_i32 ✅ 3s 2s +50%
mld_ct_cmask_nonzero_u32 ✅ 3s 2s +50%
mld_ct_sel_int32 ✅ 3s 3s +0%
mld_h ✅ 3s 6s -50%
mld_sample_s1_s2_serial ✅ 3s 5s -40%
mld_value_barrier_i64 ✅ 3s 2s +50%
ntt_native_aarch64 ✅ 3s 4s -25%
pack_sig_h_poly ✅ 3s 2s +50%
pointwise_native_x86_64 ✅ 3s 3s +0%
poly_decompose_c ✅ 3s 4s -25%
poly_decompose_native ✅ 3s 5s -40%
poly_invntt_tomont ✅ 3s 3s +0%
poly_ntt_native ✅ 3s 6s -50%
poly_permute_bitrev_to_custom_optional ✅ 3s 4s -25%
poly_pointwise_montgomery ✅ 3s 2s +50%
poly_uniform ✅ 3s 3s +0%
poly_uniform_gamma1_4x ✅ 3s 3s +0%
poly_use_hint_native_aarch64 ✅ 3s 3s +0%
polyeta_pack ✅ 3s 4s -25%
polyt1_pack ✅ 3s 2s +50%
polyvec_matrix_expand ✅ 3s 2s +50%
polyvec_matrix_expand_serial ✅ 3s 3s +0%
polyveck_unpack_eta ✅ 3s 4s -25%
polyvecl_pointwise_acc_montgomery_native ✅ 3s 3s +0%
polyvecl_uniform_gamma1 ✅ 3s 3s +0%
polyw1_pack ✅ 3s 3s +0%
polyz_unpack_19_native_aarch64 ✅ 3s 3s +0%
polyz_unpack_c ✅ 3s 4s -25%
polyz_unpack_native ✅ 3s 4s -25%
rej_eta ✅ 3s 7s -57%
rej_eta_native ✅ 3s 3s +0%
shake128_release ✅ 3s 1s +200%
shake128x4_absorb_once ✅ 3s 2s +50%
shake128x4_squeezeblocks ✅ 3s 5s -40%
shake256_absorb ✅ 3s 2s +50%
shake256_finalize ✅ 3s 2s +50%
shake256_init ✅ 3s 3s +0%
shake256_squeeze ✅ 3s 2s +50%
sign_verify_pre_hash_shake256 ✅ 3s 2s +50%
sk_s2hat_get_poly ✅ 3s 4s -25%
sk_t0hat_get_poly ✅ 3s 1s +200%
sys_check_capability ✅ 3s 5s -40%
unpack_sk_t0hat ✅ 3s 4s -25%
yvec_get_poly ✅ 3s 2s +50%
fqscale ✅ 2s 4s -50%
keccak_init ✅ 2s 3s -33%
keccak_squeeze ✅ 2s 3s -33%
keccakf1600_xor_bytes (big endian) ✅ 2s 1s +100%
keccakf1600x4_extract_bytes ✅ 2s 1s +100%
keccakf1600x4_xor_bytes ✅ 2s 1s +100%
make_hint ✅ 2s 3s -33%
mld_ct_get_optblocker_u32 ✅ 2s 4s -50%
mld_ct_get_optblocker_u8 ✅ 2s 3s -33%
mld_keccakf1600_extract_bytes ✅ 2s 1s +100%
mld_value_barrier_u32 ✅ 2s 2s +0%
montgomery_reduce ✅ 2s 2s +0%
pack_sig_c ✅ 2s 3s -33%
pack_sk_rho_key_tr_s2_t0 ✅ 2s 1s +100%
pack_sk_s1 ✅ 2s 2s +0%
poly_caddq_native_aarch64 ✅ 2s 3s -33%
poly_chknorm_native ✅ 2s 3s -33%
poly_decompose ✅ 2s 3s -33%
poly_make_hint ✅ 2s 5s -60%
poly_ntt ✅ 2s 4s -50%
poly_permute_bitrev_to_custom_optional_native ✅ 2s 5s -60%
poly_reduce ✅ 2s 2s +0%
polyeta_unpack ✅ 2s 5s -60%
polyt1_unpack ✅ 2s 6s -67%
polyveck_unpack_t0 ✅ 2s 3s -33%
polyvecl_pointwise_acc_montgomery ✅ 2s 2s +0%
polyvecl_unpack_z ✅ 2s 4s -50%
polyz_pack ✅ 2s 3s -33%
shake128_absorb ✅ 2s 6s -67%
shake128_finalize ✅ 2s 2s +0%
shake128_squeeze ✅ 2s 3s -33%
shake256 ✅ 2s 2s +0%
sign_signature_extmu ✅ 2s 5s -60%
sk_s1hat_get_poly ✅ 2s 5s -60%
unpack_sk_s2hat ✅ 2s 4s -50%
use_hint ✅ 2s 4s -50%
zvec_init ✅ 2s - new
keccak_f1600_x1_native_aarch64 ✅ 1s 3s -67%
keccak_f1600_x4_native_avx2 ✅ 1s 2s -50%
keccakf1600_xor_bytes ✅ 1s 3s -67%
mld_ct_abs_i32 ✅ 1s 1s +0%
mld_ct_cmask_nonzero_u8 ✅ 1s 5s -80%
mld_ct_get_optblocker_i64 ✅ 1s 3s -67%
mld_value_barrier_u8 ✅ 1s 3s -67%
power2round ✅ 1s 6s -83%
reduce32 ✅ 1s 2s -50%
shake128_init ✅ 1s 4s -75%
shake256_release ✅ 1s 1s +0%
shake256x4_absorb_once ✅ 1s 3s -67%
shake256x4_squeezeblocks ✅ 1s 2s -50%

@oqs-bot
Copy link
Copy Markdown
Contributor

oqs-bot commented May 2, 2026 •
edited
Loading

CBMC Results (ML-DSA-44, REDUCE-RAM)

⚠️ Attention Required

Proof Status Current Previous Change
polyvec_matrix_pointwise_montgomery_yvec ⚠️ 109s 63s +73%
Full Results (203 proofs)
Proof Status Current Previous Change
**TOTAL** ✅ 1540s 1504s +2.4%
poly_pointwise_montgomery_c ✅ 169s 178s -5%
polyvec_matrix_pointwise_montgomery_yvec ⚠️ 109s 63s +73%
mld_invntt_layer ✅ 105s 108s -3%
rej_uniform_native ✅ 104s 111s -6%
mld_ct_memcmp ✅ 76s 80s -5%
polyvec_matrix_pointwise_montgomery_zvec ✅ 53s - new
mld_ntt_layer ✅ 42s 44s -5%
fqmul ✅ 28s 32s -12%
keccakf1600x4_permute_native ✅ 23s 23s +0%
rej_uniform ✅ 22s 20s +10%
mld_attempt_signature_generation ✅ 21s 17s +24%
rej_uniform_c ✅ 21s 19s +11%
polyeta_unpack ✅ 18s 18s +0%
sign_verify_internal ✅ 17s 28s -39%
mld_ntt_butterfly_block ✅ 15s 15s +0%
poly_chknorm_c ✅ 13s 12s +8%
sign_keypair_internal ✅ 13s 15s -13%
sign_pk_from_sk ✅ 13s 11s +18%
polyt0_unpack ✅ 12s 12s +0%
poly_uniform_eta_4x ✅ 11s 13s -15%
polyveck_use_hint ✅ 11s 15s -27%
poly_add ✅ 10s 12s -17%
poly_power2round ✅ 10s 8s +25%
mld_check_pct ✅ 9s 12s -25%
pointwise_acc_native_x86_64 ✅ 9s 4s +125%
keccak_absorb ✅ 8s 7s +14%
keccak_absorb_once_x4 ✅ 8s 8s +0%
keccakf1600_permute ✅ 8s 5s +60%
keccakf1600_permute_native ✅ 8s 6s +33%
poly_invntt_tomont_c ✅ 8s 10s -20%
poly_caddq_c ✅ 7s 7s +0%
polyvec_matrix_pointwise_montgomery_row ✅ 7s 6s +17%
polyveck_add ✅ 7s 7s +0%
polyveck_chknorm ✅ 7s 6s +17%
mld_compute_pack_z ✅ 6s 5s +20%
pointwise_acc_native_aarch64 ✅ 6s 5s +20%
poly_caddq_native ✅ 6s 2s +200%
poly_decompose_c ✅ 6s 8s -25%
polyveck_invntt_tomont ✅ 6s 5s +20%
polyveck_pointwise_poly_montgomery ✅ 6s 8s -25%
polyveck_shiftl ✅ 6s 3s +100%
polyveck_sub ✅ 6s 4s +50%
polyz_unpack_c ✅ 6s 2s +200%
rej_eta_c ✅ 6s 4s +50%
poly_pointwise_montgomery ✅ 5s 3s +67%
poly_shiftl ✅ 5s 9s -44%
poly_uniform ✅ 5s 5s +0%
polyveck_caddq ✅ 5s 5s +0%
polyveck_decompose ✅ 5s 6s -17%
polyveck_power2round ✅ 5s 6s -17%
polyz_unpack_17_native_aarch64 ✅ 5s 2s +150%
shake128_release ✅ 5s 2s +150%
shake256_init ✅ 5s 6s -17%
sig_unpack_hints ✅ 5s 5s +0%
sign ✅ 5s 6s -17%
sign_keypair ✅ 5s 4s +25%
sign_signature_internal ✅ 5s 3s +67%
sign_verify ✅ 5s 4s +25%
sign_verify_extmu ✅ 5s 3s +67%
keccak_squeeze ✅ 4s 2s +100%
keccak_squeezeblocks_x4 ✅ 4s 3s +33%
mld_prepare_domain_separation_prefix ✅ 4s 3s +33%
ntt_native_aarch64 ✅ 4s 4s +0%
pack_pk ✅ 4s 4s +0%
pack_sig_z ✅ 4s 2s +100%
pack_sk_rho_key_tr_s2_t0 ✅ 4s 2s +100%
poly_caddq ✅ 4s 4s +0%
poly_caddq_native_aarch64 ✅ 4s 2s +100%
poly_challenge ✅ 4s 4s +0%
poly_chknorm_native ✅ 4s 2s +100%
poly_decompose ✅ 4s 4s +0%
poly_pointwise_montgomery_native ✅ 4s 4s +0%
poly_reduce ✅ 4s 4s +0%
poly_use_hint_c ✅ 4s 2s +100%
polyt0_pack ✅ 4s 6s -33%
polyvec_matrix_pointwise_montgomery ✅ 4s 3s +33%
polyveck_pack_eta ✅ 4s 3s +33%
polyveck_pack_w1 ✅ 4s 3s +33%
polyveck_unpack_eta ✅ 4s 3s +33%
polyvecl_ntt ✅ 4s 5s -20%
polyvecl_pointwise_acc_montgomery_native ✅ 4s 2s +100%
power2round ✅ 4s 4s +0%
shake128_init ✅ 4s 5s -20%
shake128_squeeze ✅ 4s 2s +100%
shake256x4_squeezeblocks ✅ 4s 2s +100%
sign_signature_extmu ✅ 4s 6s -33%
sign_signature_pre_hash_shake256 ✅ 4s 3s +33%
sign_verify_pre_hash_internal ✅ 4s 4s +0%
unpack_sk ✅ 4s 6s -33%
caddq ✅ 3s 4s -25%
fqscale ✅ 3s 2s +50%
intt_native_x86_64 ✅ 3s 3s +0%
keccakf1600_extract_bytes (big endian) ✅ 3s 3s +0%
keccakf1600x4_extract_bytes ✅ 3s 4s -25%
keccakf1600x4_permute ✅ 3s 2s +50%
keccakf1600x4_xor_bytes ✅ 3s 5s -40%
mld_ct_abs_i32 ✅ 3s 2s +50%
mld_ct_cmask_nonzero_u32 ✅ 3s 4s -25%
mld_ct_cmask_nonzero_u8 ✅ 3s 3s +0%
mld_ct_get_optblocker_i64 ✅ 3s 1s +200%
mld_ct_get_optblocker_u8 ✅ 3s 1s +200%
mld_keccakf1600_extract_bytes ✅ 3s 3s +0%
mld_sample_s1_s2 ✅ 3s 6s -50%
mld_sample_s1_s2_serial ✅ 3s 5s -40%
mld_value_barrier_i64 ✅ 3s 3s +0%
montgomery_reduce ✅ 3s 5s -40%
ntt_native_x86_64 ✅ 3s 4s -25%
nttunpack_native_x86_64 ✅ 3s 3s +0%
pack_sig_c ✅ 3s 2s +50%
pack_sig_h_poly ✅ 3s 4s -25%
pointwise_native_x86_64 ✅ 3s 2s +50%
poly_chknorm ✅ 3s 3s +0%
poly_chknorm_native_aarch64 ✅ 3s 3s +0%
poly_decompose_native ✅ 3s 4s -25%
poly_invntt_tomont_native ✅ 3s 2s +50%
poly_ntt ✅ 3s 2s +50%
poly_ntt_c ✅ 3s 3s +0%
poly_ntt_native ✅ 3s 3s +0%
poly_permute_bitrev_to_custom_optional ✅ 3s 3s +0%
poly_permute_bitrev_to_custom_optional_native ✅ 3s 3s +0%
poly_uniform_4x ✅ 3s 2s +50%
poly_uniform_eta ✅ 3s 5s -40%
poly_uniform_gamma1_4x ✅ 3s 2s +50%
polyt1_pack ✅ 3s 2s +50%
polyt1_unpack ✅ 3s 2s +50%
polyvec_matrix_expand ✅ 3s 3s +0%
polyveck_ntt ✅ 3s 5s -40%
polyveck_reduce ✅ 3s 7s -57%
polyveck_unpack_t0 ✅ 3s 4s -25%
polyvecl_chknorm ✅ 3s 6s -50%
polyvecl_pack_eta ✅ 3s 3s +0%
polyvecl_pointwise_acc_montgomery_c ✅ 3s 5s -40%
polyvecl_uniform_gamma1 ✅ 3s 4s -25%
polyvecl_unpack_eta ✅ 3s 2s +50%
polyvecl_unpack_z ✅ 3s 3s +0%
polyw1_pack ✅ 3s 4s -25%
polyz_pack ✅ 3s 4s -25%
polyz_unpack ✅ 3s 4s -25%
polyz_unpack_native ✅ 3s 2s +50%
reduce32 ✅ 3s 3s +0%
rej_eta_native ✅ 3s 2s +50%
shake128_finalize ✅ 3s 1s +200%
shake256 ✅ 3s 2s +50%
shake256_absorb ✅ 3s 3s +0%
sign_open ✅ 3s 5s -40%
sign_signature ✅ 3s 7s -57%
sign_verify_pre_hash_shake256 ✅ 3s 3s +0%
sk_t0hat_get_poly ✅ 3s 2s +50%
sys_check_capability ✅ 3s 1s +200%
unpack_sk_s1hat ✅ 3s 3s +0%
unpack_sk_s2hat ✅ 3s 3s +0%
unpack_sk_t0hat ✅ 3s 5s -40%
use_hint ✅ 3s 4s -25%
zvec_init ✅ 3s - new
decompose ✅ 2s 2s +0%
keccak_f1600_x1_native_aarch64 ✅ 2s 6s -67%
keccak_f1600_x4_native_aarch64_v8a_scalar_hybrid ✅ 2s 2s +0%
keccak_f1600_x4_native_avx2 ✅ 2s 4s -50%
keccakf1600_xor_bytes ✅ 2s 4s -50%
keccakf1600_xor_bytes (big endian) ✅ 2s 5s -60%
make_hint ✅ 2s 2s +0%
mld_ct_cmask_neg_i32 ✅ 2s 4s -50%
mld_ct_get_optblocker_u32 ✅ 2s 1s +100%
mld_ct_sel_int32 ✅ 2s 2s +0%
mld_h ✅ 2s 3s -33%
mld_polymat_expand_entry ✅ 2s 3s -33%
mld_value_barrier_u32 ✅ 2s 4s -50%
mld_value_barrier_u8 ✅ 2s 3s -33%
pointwise_native_aarch64 ✅ 2s 3s -33%
poly_invntt_tomont ✅ 2s 2s +0%
poly_sub ✅ 2s 3s -33%
poly_uniform_gamma1 ✅ 2s 2s +0%
poly_use_hint ✅ 2s 2s +0%
poly_use_hint_native_aarch64 ✅ 2s 3s -33%
polyeta_pack ✅ 2s 5s -60%
polyvec_matrix_expand_serial ✅ 2s 6s -67%
polyveck_pack_t0 ✅ 2s 2s +0%
polyvecl_pointwise_acc_montgomery ✅ 2s 4s -50%
polyvecl_uniform_gamma1_serial ✅ 2s 3s -33%
polyz_unpack_19_native_aarch64 ✅ 2s 4s -50%
rej_eta ✅ 2s 3s -33%
shake128_absorb ✅ 2s 3s -33%
shake128x4_absorb_once ✅ 2s 2s +0%
shake128x4_squeezeblocks ✅ 2s 1s +100%
shake256_finalize ✅ 2s 2s +0%
shake256_release ✅ 2s 3s -33%
shake256_squeeze ✅ 2s 2s +0%
shake256x4_absorb_once ✅ 2s 4s -50%
sign_signature_pre_hash_internal ✅ 2s 2s +0%
sk_s1hat_get_poly ✅ 2s 3s -33%
sk_s2hat_get_poly ✅ 2s 4s -50%
unpack_pk_t1 ✅ 2s 3s -33%
yvec_get_poly ✅ 2s 3s -33%
keccak_f1600_x1_native_aarch64_v84a ✅ 1s 2s -50%
keccak_f1600_x4_native_aarch64_v84a ✅ 1s 3s -67%
keccak_f1600_x4_native_aarch64_v8a_v84a_scalar_hybrid ✅ 1s 1s +0%
keccak_finalize ✅ 1s 4s -75%
keccak_init ✅ 1s 2s -50%
pack_sk_s1 ✅ 1s 5s -80%
poly_make_hint ✅ 1s 3s -67%
poly_use_hint_native ✅ 1s 2s -50%
yvec_init ✅ 1s 3s -67%
zvec_get_poly ✅ 1s - new

@oqs-bot
Copy link
Copy Markdown
Contributor

oqs-bot commented May 2, 2026 •
edited
Loading

CBMC Results (ML-DSA-87, REDUCE-RAM)

⚠️ Attention Required

Proof Status Current Previous Change
polyveck_decompose ⚠️ 53s 13s +308%
Full Results (203 proofs)
Proof Status Current Previous Change
**TOTAL** ✅ 1762s 1701s +3.6%
poly_pointwise_montgomery_c ✅ 169s 194s -13%
polyvec_matrix_pointwise_montgomery_zvec ✅ 120s - new
polyvec_matrix_pointwise_montgomery_yvec ✅ 113s 146s -23%
rej_uniform_native ✅ 105s 109s -4%
mld_invntt_layer ✅ 99s 108s -8%
mld_ct_memcmp ✅ 73s 80s -9%
polyveck_decompose ⚠️ 53s 13s +308%
mld_ntt_layer ✅ 39s 46s -15%
sign_verify_internal ✅ 37s 43s -14%
sign_keypair_internal ✅ 34s 37s -8%
fqmul ✅ 27s 33s -18%
keccakf1600x4_permute_native ✅ 23s 23s +0%
mld_attempt_signature_generation ✅ 21s 27s -22%
rej_uniform ✅ 20s 18s +11%
rej_uniform_c ✅ 17s 20s -15%
polyeta_unpack ✅ 16s 19s -16%
sign_pk_from_sk ✅ 15s 21s -29%
mld_ntt_butterfly_block ✅ 14s 18s -22%
poly_uniform_eta_4x ✅ 13s 14s -7%
mld_check_pct ✅ 12s 13s -8%
poly_chknorm_c ✅ 11s 17s -35%
polyvec_matrix_pointwise_montgomery_row ✅ 11s 13s -15%
polyveck_pointwise_poly_montgomery ✅ 11s 10s +10%
keccak_absorb_once_x4 ✅ 10s 8s +25%
pointwise_acc_native_x86_64 ✅ 10s 7s +43%
poly_invntt_tomont_c ✅ 10s 10s +0%
polyt0_unpack ✅ 10s 12s -17%
polyveck_ntt ✅ 10s 7s +43%
polyveck_use_hint ✅ 10s 8s +25%
mld_sample_s1_s2 ✅ 9s 7s +29%
poly_add ✅ 9s 11s -18%
poly_caddq_c ✅ 9s 9s +0%
polyveck_invntt_tomont ✅ 9s 8s +12%
polyvecl_ntt ✅ 9s 8s +12%
sig_unpack_hints ✅ 9s 7s +29%
mld_compute_pack_z ✅ 8s 6s +33%
pointwise_acc_native_aarch64 ✅ 8s 7s +14%
polyveck_add ✅ 8s 10s -20%
polyveck_power2round ✅ 8s 9s -11%
sign ✅ 8s 7s +14%
keccakf1600_permute ✅ 7s 6s +17%
mld_sample_s1_s2_serial ✅ 7s 5s +40%
poly_power2round ✅ 7s 6s +17%
polyveck_chknorm ✅ 7s 6s +17%
polyveck_shiftl ✅ 7s 5s +40%
polyveck_sub ✅ 7s 4s +75%
rej_eta_native ✅ 7s 4s +75%
keccak_absorb ✅ 6s 5s +20%
keccakf1600_permute_native ✅ 6s 6s +0%
poly_use_hint_c ✅ 6s 6s +0%
polyveck_caddq ✅ 6s 8s -25%
polyveck_reduce ✅ 6s 4s +50%
polyvecl_chknorm ✅ 6s 6s +0%
polyz_unpack_c ✅ 6s 5s +20%
sign_signature_internal ✅ 6s 5s +20%
sk_s1hat_get_poly ✅ 6s 3s +100%
keccak_squeezeblocks_x4 ✅ 5s 4s +25%
mld_value_barrier_u32 ✅ 5s 2s +150%
poly_decompose_c ✅ 5s 4s +25%
poly_pointwise_montgomery ✅ 5s 3s +67%
poly_pointwise_montgomery_native ✅ 5s 4s +25%
poly_shiftl ✅ 5s 6s -17%
poly_sub ✅ 5s 5s +0%
poly_uniform ✅ 5s 6s -17%
polyt0_pack ✅ 5s 5s +0%
polyt1_pack ✅ 5s 4s +25%
polyvecl_pointwise_acc_montgomery ✅ 5s 2s +150%
rej_eta_c ✅ 5s 3s +67%
shake256_squeeze ✅ 5s 2s +150%
sign_open ✅ 5s 5s +0%
sign_signature_extmu ✅ 5s 2s +150%
sign_verify_extmu ✅ 5s 4s +25%
sys_check_capability ✅ 5s 2s +150%
unpack_sk ✅ 5s 5s +0%
caddq ✅ 4s 5s -20%
intt_native_x86_64 ✅ 4s 2s +100%
keccak_f1600_x1_native_aarch64 ✅ 4s 2s +100%
keccak_f1600_x4_native_aarch64_v8a_v84a_scalar_hybrid ✅ 4s 3s +33%
keccak_squeeze ✅ 4s 1s +300%
mld_ct_cmask_nonzero_u32 ✅ 4s 3s +33%
mld_value_barrier_i64 ✅ 4s 2s +100%
ntt_native_aarch64 ✅ 4s 5s -20%
ntt_native_x86_64 ✅ 4s 4s +0%
pack_pk ✅ 4s 2s +100%
pack_sig_z ✅ 4s 3s +33%
pointwise_native_x86_64 ✅ 4s 3s +33%
poly_chknorm_native ✅ 4s 4s +0%
poly_decompose ✅ 4s 1s +300%
poly_decompose_native ✅ 4s 3s +33%
poly_invntt_tomont_native ✅ 4s 4s +0%
poly_ntt_c ✅ 4s 3s +33%
poly_reduce ✅ 4s 1s +300%
polyeta_pack ✅ 4s 2s +100%
polyveck_unpack_t0 ✅ 4s 5s -20%
polyvecl_pack_eta ✅ 4s 4s +0%
polyvecl_pointwise_acc_montgomery_native ✅ 4s 3s +33%
polyvecl_unpack_eta ✅ 4s 4s +0%
polyvecl_unpack_z ✅ 4s 4s +0%
polyz_unpack_17_native_aarch64 ✅ 4s 2s +100%
rej_eta ✅ 4s 3s +33%
shake128_init ✅ 4s 1s +300%
shake256_release ✅ 4s 4s +0%
shake256x4_squeezeblocks ✅ 4s 4s +0%
sign_signature ✅ 4s 6s -33%
sign_verify ✅ 4s 3s +33%
sign_verify_pre_hash_internal ✅ 4s 4s +0%
unpack_pk_t1 ✅ 4s 3s +33%
decompose ✅ 3s 3s +0%
fqscale ✅ 3s 3s +0%
keccak_f1600_x4_native_aarch64_v84a ✅ 3s 2s +50%
keccak_init ✅ 3s 3s +0%
keccakf1600_extract_bytes (big endian) ✅ 3s 3s +0%
keccakf1600_xor_bytes ✅ 3s 4s -25%
make_hint ✅ 3s 3s +0%
mld_ct_get_optblocker_i64 ✅ 3s 1s +200%
mld_h ✅ 3s 5s -40%
mld_keccakf1600_extract_bytes ✅ 3s 1s +200%
mld_value_barrier_u8 ✅ 3s 2s +50%
nttunpack_native_x86_64 ✅ 3s 4s -25%
pack_sig_h_poly ✅ 3s 4s -25%
pack_sk_rho_key_tr_s2_t0 ✅ 3s 3s +0%
pack_sk_s1 ✅ 3s 2s +50%
pointwise_native_aarch64 ✅ 3s 4s -25%
poly_caddq ✅ 3s 2s +50%
poly_caddq_native ✅ 3s 3s +0%
poly_caddq_native_aarch64 ✅ 3s 3s +0%
poly_challenge ✅ 3s 5s -40%
poly_make_hint ✅ 3s 2s +50%
poly_ntt ✅ 3s 2s +50%
poly_ntt_native ✅ 3s 3s +0%
poly_uniform_4x ✅ 3s 4s -25%
poly_uniform_gamma1 ✅ 3s 1s +200%
poly_use_hint ✅ 3s 3s +0%
polyt1_unpack ✅ 3s 5s -40%
polyvec_matrix_expand ✅ 3s 1s +200%
polyvec_matrix_pointwise_montgomery ✅ 3s 4s -25%
polyveck_pack_eta ✅ 3s 1s +200%
polyveck_pack_t0 ✅ 3s 6s -50%
polyveck_pack_w1 ✅ 3s 5s -40%
polyvecl_uniform_gamma1 ✅ 3s 3s +0%
polyvecl_uniform_gamma1_serial ✅ 3s 4s -25%
polyw1_pack ✅ 3s 2s +50%
polyz_pack ✅ 3s 2s +50%
polyz_unpack ✅ 3s 2s +50%
polyz_unpack_native ✅ 3s 4s -25%
shake128_absorb ✅ 3s 2s +50%
shake128_release ✅ 3s 3s +0%
shake256_absorb ✅ 3s 3s +0%
shake256x4_absorb_once ✅ 3s 3s +0%
sign_keypair ✅ 3s 3s +0%
sign_signature_pre_hash_internal ✅ 3s 4s -25%
sign_signature_pre_hash_shake256 ✅ 3s 6s -50%
sign_verify_pre_hash_shake256 ✅ 3s 4s -25%
sk_s2hat_get_poly ✅ 3s 3s +0%
unpack_sk_t0hat ✅ 3s 3s +0%
keccak_f1600_x4_native_aarch64_v8a_scalar_hybrid ✅ 2s 5s -60%
keccak_f1600_x4_native_avx2 ✅ 2s 2s +0%
keccak_finalize ✅ 2s 3s -33%
keccakf1600_xor_bytes (big endian) ✅ 2s 4s -50%
keccakf1600x4_extract_bytes ✅ 2s 3s -33%
keccakf1600x4_permute ✅ 2s 1s +100%
keccakf1600x4_xor_bytes ✅ 2s 1s +100%
mld_ct_abs_i32 ✅ 2s 5s -60%
mld_ct_cmask_neg_i32 ✅ 2s 3s -33%
mld_ct_cmask_nonzero_u8 ✅ 2s 3s -33%
mld_ct_get_optblocker_u32 ✅ 2s 3s -33%
mld_polymat_expand_entry ✅ 2s 3s -33%
mld_prepare_domain_separation_prefix ✅ 2s 5s -60%
pack_sig_c ✅ 2s 4s -50%
poly_chknorm ✅ 2s 3s -33%
poly_chknorm_native_aarch64 ✅ 2s 2s +0%
poly_invntt_tomont ✅ 2s 3s -33%
poly_permute_bitrev_to_custom_optional ✅ 2s 2s +0%
poly_permute_bitrev_to_custom_optional_native ✅ 2s 2s +0%
poly_uniform_gamma1_4x ✅ 2s 2s +0%
poly_use_hint_native ✅ 2s 4s -50%
poly_use_hint_native_aarch64 ✅ 2s 5s -60%
polyvec_matrix_expand_serial ✅ 2s 2s +0%
polyveck_unpack_eta ✅ 2s 3s -33%
polyvecl_pointwise_acc_montgomery_c ✅ 2s 3s -33%
polyz_unpack_19_native_aarch64 ✅ 2s 2s +0%
power2round ✅ 2s 2s +0%
shake128_squeeze ✅ 2s 3s -33%
shake128x4_squeezeblocks ✅ 2s 2s +0%
shake256 ✅ 2s 1s +100%
shake256_init ✅ 2s 3s -33%
sk_t0hat_get_poly ✅ 2s 4s -50%
unpack_sk_s1hat ✅ 2s 4s -50%
unpack_sk_s2hat ✅ 2s 4s -50%
use_hint ✅ 2s 4s -50%
yvec_get_poly ✅ 2s 3s -33%
yvec_init ✅ 2s 3s -33%
zvec_get_poly ✅ 2s - new
keccak_f1600_x1_native_aarch64_v84a ✅ 1s 2s -50%
mld_ct_get_optblocker_u8 ✅ 1s 2s -50%
mld_ct_sel_int32 ✅ 1s 2s -50%
montgomery_reduce ✅ 1s 2s -50%
poly_uniform_eta ✅ 1s 3s -67%
reduce32 ✅ 1s 5s -80%
shake128_finalize ✅ 1s 4s -75%
shake128x4_absorb_once ✅ 1s 3s -67%
shake256_finalize ✅ 1s 1s +0%
zvec_init ✅ 1s - new

@mkannwischer mkannwischer force-pushed the verify-stream-z branch 9 times, most recently from 90b809b to 3797d11 Compare May 4, 2026 08:57
@mkannwischer
lowmem: Unpack z lazily in verification
926bbe1 
Introduce mld_zvec (eager / lazy, dispatched by MLD_CONFIG_REDUCE_RAM):

  - mld_zvec_init: eager unpacks the full polyvecl, runs the polyvecl-wide
    norm check, and NTTs in place; lazy stores a pointer.
  - mld_zvec_get_poly: eager copies one poly from the precomputed vector;
    lazy unpacks one poly, norm-checks it, and NTTs into the caller's buf.

The norm check moves out of mld_sign_verify_internal into the accessors.

Add a fused mld_polyvec_matrix_pointwise_montgomery_zvec helper used by
verify: eager is a thin wrapper around the standard matrix-vector multiply
(z is already NTT'd); lazy streams z via mld_zvec_get_poly_lazy and
samples the matrix column-by-column.

In REDUCE_RAM mode this avoids holding the full unpacked polyvecl z,
reducing verify allocation by 2-5 KiB per parameter set.

Signed-off-by: Matthias J. Kannwischer <matthias@zerorisc.com>
@mkannwischer mkannwischer marked this pull request as ready for review May 4, 2026 09:43
@mkannwischer mkannwischer marked this pull request as draft May 4, 2026 11:10
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

@hanno-becker hanno-becker

Labels

low-ram

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@mkannwischer @oqs-bot @hanno-becker