Add signing hooks for observing signature attempts and implementing restartable signing

[hanno-becker]

• Based on common: Split context-parameter machinery into context.h #1238

sign: Add configurable signing hooks (resume/attempt/finish)

The runtime of ML-DSA signatures is theoretically unbounded. Even the
bound of max 814 signature attempts -- approved by NIST as lowering the
chance of signing failure below 2^{-256} -- leaves a performance
distribution whose peak percentiles can be unacceptable for constrained
systems with strict timing requirements.

The library already provides MLD_CONFIG_MAX_SIGNING_ATTEMPTS to cap the
number of signing attempts. However, FIPS 204 forbids lowering that bound
below 814, rendering the option non-compliant in constrained environments.

As a remedy, this commit introduces three optional 'signing hooks' around
the core rejection-sampling loop, keyed by the attempt counter (the loop
iteration; the spec counter is kappa = attempt*MLDSA_L):

- `attempt = sign_resume()`: Return the attempt to resume the operation
  from. `0` for an initial / non-restartable signing operation.
- `sign_attempt(attempt)`: Called before each attempt. Returns 0 to
  proceed, or non-zero to pause: signing then returns MLD_ERR_SIGNING_PAUSED
  with `attempt` as the resume point.
- `sign_finish(attempt)`: Called on success with the succeeding attempt.

Together, resume + attempt make signing _restartable_: a caller can pause
after a bounded number of attempts and later resume from the recorded
attempt, bounding per-call runtime while keeping a FIPS-compliant overall
bound and reproducing the same signature as an uninterrupted run.

This only works if the consumer drives the deterministic internal API: the
randomized API would choose a fresh seed on each (re-)start, so the resume
hook requires MLD_CONFIG_NO_RANDOMIZED_API and is incompatible with
MLD_CONFIG_KEYGEN_PCT (whose one-shot internal signature cannot be resumed).
The attempt and finish hooks also serve standalone uses with any API, e.g.
logging or benchmarking the per-signature attempt distribution.

Pausing is independent of MLD_CONFIG_MAX_SIGNING_ATTEMPTS, the upper bound on
the total number of attempts (>= 814 for FIPS 204 compliance) after which
signing gives up with the distinct error MLD_ERR_SIGN_ATTEMPTS_EXHAUSTED; it
must not be lowered as a restart mechanism.

sign_{resume|attempt|finish} can be implemented on mutable globals or on a
context, so they are introduced under the existing MLD_CONFIG_CONTEXT_PARAMETER
wrapper, which lets functions be called with or without an
application-specific context pointer.

Concretely, this commit:

- Adds independent MLD_CONFIG_SIGN_HOOK_{RESUME,ATTEMPT,FINISH} options. When
  set, the integration provides, respectively:

  - `attempt = mld_sign_hook_resume([ctx])`: provide initial/resume attempt
  - `mld_sign_hook_attempt(attempt [, ctx])`: per-attempt hook; pause via
    non-zero return
  - `mld_sign_hook_finish(attempt [, ctx])`: note the succeeding attempt

  The unset dummies leave the default build (and its proofs) unchanged.

- Adds the MLD_ERR_SIGNING_PAUSED error code returned when the attempt hook
  pauses signing.

- Adds CBMC proofs for the three hooks and threads them through the existing
  signing proofs.

- Adds test/src/test_sign_hook.c (a new `sign_hook` test), which checks that
  restartable signing -- single-step and with random attempts-per-call --
  reproduces one-shot signing exactly, and gathers an attempts-per-signature
  distribution that it checks against the expected geometric mean per
  parameter set.

[oqs-bot]

CBMC Results (ML-DSA-44, REDUCE-RAM)

Full Results (209 proofs)

Proof	Status	Current	Previous	Change
**TOTAL**	✅	1448s	1364s	+6.2%
polyvec_matrix_pointwise_montgomery_yvec	✅	153s	149s	+3%
poly_pointwise_montgomery_c	✅	126s	112s	+12%
mld_invntt_layer	✅	109s	105s	+4%
polyveck_chknorm	✅	66s	67s	-1%
sign_verify_internal	✅	54s	49s	+10%
fqmul	✅	43s	39s	+10%
mld_ntt_layer	✅	41s	41s	+0%
keccakf1600x4_permute_native	✅	24s	22s	+9%
mld_ntt_butterfly_block	✅	22s	23s	-4%
mld_attempt_signature_generation	✅	20s	19s	+5%
poly_ntt_c	✅	19s	21s	-10%
rej_uniform_c	✅	16s	16s	+0%
polyeta_unpack	✅	15s	14s	+7%
poly_chknorm_c	✅	14s	11s	+27%
poly_uniform_eta_4x	✅	14s	12s	+17%
mld_check_pct	✅	13s	15s	-13%
polyvecl_chknorm	✅	13s	11s	+18%
compute_pack_t0_t1	✅	11s	12s	-8%
poly_invntt_tomont_c	✅	11s	11s	+0%
polyt0_unpack	✅	11s	12s	-8%
rej_uniform_native_x86_64	✅	10s	-	new
keccak_absorb_once_x4	✅	9s	8s	+12%
mld_compute_pack_z	✅	8s	6s	+33%
polyveck_decompose	✅	8s	7s	+14%
polyz_unpack_c	✅	8s	8s	+0%
sign_pk_from_sk	✅	8s	5s	+60%
poly_add	✅	7s	7s	+0%
rej_uniform	✅	7s	8s	-12%
keccak_absorb	✅	6s	3s	+100%
mld_keccakf1600_permute_c	✅	6s	7s	-14%
pointwise_acc_native_aarch64	✅	6s	6s	+0%
pointwise_native_x86_64	✅	6s	4s	+50%
polyvec_matrix_pointwise_montgomery_row	✅	6s	6s	+0%
polyveck_reduce	✅	6s	4s	+50%
keccak_squeezeblocks_x4	✅	5s	3s	+67%
keccakf1600_permute	✅	5s	2s	+150%
mld_polymat_expand_entry	✅	5s	2s	+150%
pointwise_acc_native_x86_64	✅	5s	4s	+25%
poly_caddq	✅	5s	4s	+25%
poly_caddq_native_x86_64	✅	5s	4s	+25%
poly_decompose_c	✅	5s	5s	+0%
poly_reduce	✅	5s	4s	+25%
poly_uniform	✅	5s	3s	+67%
rej_eta_native	✅	5s	3s	+67%
rej_uniform_eta_native_aarch64	✅	5s	3s	+67%
rej_uniform_native	✅	5s	5s	+0%
rej_uniform_native_aarch64	✅	5s	3s	+67%
shake256_squeeze	✅	5s	2s	+150%
sign_keypair_internal	✅	5s	4s	+25%
sign_verify	✅	5s	4s	+25%
sign_verify_extmu	✅	5s	5s	+0%
sign_verify_pre_hash_shake256	✅	5s	5s	+0%
sk_s2hat_get_poly	✅	5s	5s	+0%
decompose	✅	4s	3s	+33%
keccak_f1600_x1_native_aarch64_v84a	✅	4s	2s	+100%
keccak_f1600_x4_native_aarch64_v8a_scalar_hybrid	✅	4s	2s	+100%
keccak_finalize	✅	4s	2s	+100%
mld_ct_get_optblocker_i64	✅	4s	4s	+0%
mld_sample_s1_s2_serial	✅	4s	4s	+0%
mld_sign_finish	✅	4s	-	new
mld_value_barrier_u8	✅	4s	4s	+0%
nttunpack_native_x86_64	✅	4s	4s	+0%
pack_sig_c	✅	4s	5s	-20%
pack_sk_rho_key_tr_s2	✅	4s	5s	-20%
poly_caddq_c	✅	4s	3s	+33%
poly_caddq_native	✅	4s	3s	+33%
poly_challenge	✅	4s	6s	-33%
poly_chknorm	✅	4s	3s	+33%
poly_chknorm_native	✅	4s	4s	+0%
poly_chknorm_native_x86_64	✅	4s	2s	+100%
poly_decompose_88_native_aarch64	✅	4s	3s	+33%
poly_decompose_native	✅	4s	2s	+100%
poly_power2round	✅	4s	4s	+0%
poly_sub	✅	4s	3s	+33%
poly_uniform_4x	✅	4s	3s	+33%
poly_uniform_eta	✅	4s	2s	+100%
poly_uniform_gamma1	✅	4s	3s	+33%
poly_uniform_gamma1_4x	✅	4s	5s	-20%
polyt0_pack	✅	4s	4s	+0%
polyvec_matrix_expand	✅	4s	3s	+33%
polyveck_caddq	✅	4s	3s	+33%
polyvecl_pointwise_acc_montgomery	✅	4s	3s	+33%
polyvecl_uniform_gamma1_serial	✅	4s	2s	+100%
polyvecl_unpack_z	✅	4s	3s	+33%
polyw1_pack_32	✅	4s	3s	+33%
polyz_unpack	✅	4s	3s	+33%
polyz_unpack_native	✅	4s	3s	+33%
shake128_squeeze	✅	4s	2s	+100%
shake256	✅	4s	1s	+300%
sign_keypair	✅	4s	5s	-20%
sign_signature_extmu	✅	4s	4s	+0%
sign_signature_internal	✅	4s	4s	+0%
sign_signature_pre_hash_internal	✅	4s	4s	+0%
sys_check_capability	✅	4s	2s	+100%
yvec_get_poly	✅	4s	3s	+33%
caddq	✅	3s	6s	-50%
intt_native_x86_64	✅	3s	2s	+50%
keccak_f1600_x1_native_aarch64	✅	3s	3s	+0%
keccak_f1600_x4_native_aarch64_v8a_v84a_scalar_hybrid	✅	3s	3s	+0%
keccak_init	✅	3s	3s	+0%
keccakf1600_extract_bytes (big endian)	✅	3s	4s	-25%
keccakf1600_permute_native	✅	3s	3s	+0%
keccakf1600_xor_bytes (big endian)	✅	3s	6s	-50%
keccakf1600x4_extract_bytes_native	✅	3s	4s	-25%
mld_ct_abs_i32	✅	3s	3s	+0%
mld_ct_cmask_neg_i32	✅	3s	2s	+50%
mld_ct_cmask_nonzero_u8	✅	3s	2s	+50%
mld_ct_get_optblocker_u8	✅	3s	2s	+50%
mld_ct_memcmp	✅	3s	1s	+200%
mld_ct_sel_int32	✅	3s	3s	+0%
mld_h	✅	3s	4s	-25%
mld_keccakf1600_extract_bytes	✅	3s	2s	+50%
mld_sign_attempt	✅	3s	-	new
mld_sign_resume	✅	3s	-	new
mld_value_barrier_i64	✅	3s	3s	+0%
montgomery_reduce	✅	3s	2s	+50%
ntt_native_aarch64	✅	3s	4s	-25%
ntt_native_x86_64	✅	3s	3s	+0%
pointwise_native_aarch64	✅	3s	2s	+50%
poly_caddq_native_aarch64	✅	3s	3s	+0%
poly_chknorm_native_aarch64	✅	3s	2s	+50%
poly_decompose	✅	3s	2s	+50%
poly_decompose_32_native_aarch64	✅	3s	4s	-25%
poly_invntt_tomont	✅	3s	2s	+50%
poly_invntt_tomont_native	✅	3s	3s	+0%
poly_ntt	✅	3s	3s	+0%
poly_permute_bitrev_to_custom_optional	✅	3s	5s	-40%
poly_permute_bitrev_to_custom_optional_native	✅	3s	3s	+0%
poly_pointwise_montgomery	✅	3s	3s	+0%
poly_pointwise_montgomery_native	✅	3s	2s	+50%
poly_use_hint_c	✅	3s	5s	-40%
poly_use_hint_native	✅	3s	3s	+0%
poly_use_hint_native_aarch64	✅	3s	3s	+0%
poly_use_hint_native_x86_64	✅	3s	-	new
polyeta_pack	✅	3s	3s	+0%
polyt1_unpack	✅	3s	2s	+50%
polyvec_matrix_expand_serial	✅	3s	4s	-25%
polyveck_invntt_tomont	✅	3s	5s	-40%
polyveck_ntt	✅	3s	2s	+50%
polyveck_pack_w1	✅	3s	3s	+0%
polyveck_unpack_eta	✅	3s	2s	+50%
polyvecl_pack_eta	✅	3s	2s	+50%
polyvecl_pointwise_acc_montgomery_native	✅	3s	3s	+0%
polyw1_pack	✅	3s	4s	-25%
polyw1_pack_88	✅	3s	2s	+50%
polyz_pack	✅	3s	2s	+50%
polyz_unpack_17_native_aarch64	✅	3s	2s	+50%
polyz_unpack_19_native_aarch64	✅	3s	4s	-25%
polyz_unpack_native_x86_64	✅	3s	3s	+0%
power2round	✅	3s	2s	+50%
rej_eta	✅	3s	5s	-40%
shake128_absorb	✅	3s	3s	+0%
shake128_finalize	✅	3s	3s	+0%
shake128_init	✅	3s	2s	+50%
shake256_absorb	✅	3s	2s	+50%
shake256_init	✅	3s	4s	-25%
sig_unpack_hints	✅	3s	2s	+50%
sign_signature_pre_hash_shake256	✅	3s	4s	-25%
sk_t0hat_get_poly	✅	3s	1s	+200%
unpack_pk_t1	✅	3s	3s	+0%
unpack_sk_s1hat	✅	3s	3s	+0%
unpack_sk_s2hat	✅	3s	4s	-25%
unpack_sk_t0hat	✅	3s	2s	+50%
yvec_init	✅	3s	1s	+200%
intt_native_aarch64	✅	2s	3s	-33%
keccak_f1600_x4_native_aarch64_v84a	✅	2s	3s	-33%
keccak_f1600_x4_native_avx2	✅	2s	2s	+0%
keccak_squeeze	✅	2s	2s	+0%
keccakf1600_xor_bytes	✅	2s	3s	-33%
keccakf1600x4_extract_bytes	✅	2s	2s	+0%
keccakf1600x4_permute	✅	2s	4s	-50%
keccakf1600x4_xor_bytes	✅	2s	3s	-33%
make_hint	✅	2s	3s	-33%
mld_ct_cmask_nonzero_u32	✅	2s	3s	-33%
mld_ct_get_optblocker_u32	✅	2s	2s	+0%
mld_keccakf1600x4_extract_bytes_c	✅	2s	4s	-50%
mld_prepare_domain_separation_prefix	✅	2s	3s	-33%
mld_sample_s1_s2	✅	2s	1s	+100%
pack_sig_h	✅	2s	4s	-50%
pack_sig_z	✅	2s	2s	+0%
pack_sk_s1	✅	2s	3s	-33%
poly_decompose_native_x86_64	✅	2s	2s	+0%
poly_use_hint	✅	2s	2s	+0%
polyt1_pack	✅	2s	3s	-33%
polyveck_pack_eta	✅	2s	4s	-50%
polyvecl_ntt	✅	2s	3s	-33%
polyvecl_pointwise_acc_montgomery_c	✅	2s	4s	-50%
polyvecl_unpack_eta	✅	2s	4s	-50%
reduce32	✅	2s	3s	-33%
rej_eta_c	✅	2s	4s	-50%
shake128_release	✅	2s	2s	+0%
shake128x4_absorb_once	✅	2s	2s	+0%
shake128x4_squeezeblocks	✅	2s	2s	+0%
shake256_finalize	✅	2s	2s	+0%
shake256_release	✅	2s	1s	+100%
shake256x4_absorb_once	✅	2s	1s	+100%
sign_signature	✅	2s	6s	-67%
sign_verify_pre_hash_internal	✅	2s	5s	-60%
sk_s1hat_get_poly	✅	2s	2s	+0%
unpack_sk	✅	2s	3s	-33%
use_hint	✅	2s	2s	+0%
fqscale	✅	1s	2s	-50%
keccakf1600x4_xor_bytes_native	✅	1s	5s	-80%
mld_keccakf1600x4_xor_bytes_c	✅	1s	4s	-75%
mld_value_barrier_u32	✅	1s	1s	+0%
poly_ntt_native	✅	1s	3s	-67%
poly_shiftl	✅	1s	4s	-75%
polyvecl_uniform_gamma1	✅	1s	2s	-50%
shake256x4_squeezeblocks	✅	1s	2s	-50%

[oqs-bot]

CBMC Results (ML-DSA-65)

Full Results (209 proofs)

Proof	Status	Current	Previous	Change
**TOTAL**	✅	1910s	1784s	+7.1%
polyvecl_pointwise_acc_montgomery_c	✅	232s	210s	+10%
sign_verify_internal	✅	178s	177s	+1%
poly_pointwise_montgomery_c	✅	126s	125s	+1%
mld_invntt_layer	✅	117s	109s	+7%
polyvec_matrix_expand	✅	111s	110s	+1%
mld_attempt_signature_generation	✅	66s	63s	+5%
sign_signature_internal	✅	61s	55s	+11%
mld_ntt_layer	✅	43s	41s	+5%
fqmul	✅	42s	40s	+5%
polyvec_matrix_expand_serial	✅	30s	27s	+11%
keccakf1600x4_permute_native	✅	23s	23s	+0%
mld_ntt_butterfly_block	✅	22s	24s	-8%
poly_ntt_c	✅	19s	19s	+0%
polyvec_matrix_pointwise_montgomery_yvec	✅	18s	18s	+0%
rej_uniform	✅	17s	18s	-6%
polyt0_unpack	✅	16s	16s	+0%
rej_uniform_c	✅	16s	14s	+14%
mld_check_pct	✅	15s	14s	+7%
poly_chknorm_c	✅	15s	15s	+0%
polyz_unpack_c	✅	14s	13s	+8%
poly_uniform_4x	✅	13s	13s	+0%
compute_pack_t0_t1	✅	12s	13s	-8%
poly_invntt_tomont_c	✅	12s	11s	+9%
polyveck_decompose	✅	12s	12s	+0%
keccak_absorb_once_x4	✅	11s	8s	+38%
poly_uniform_eta_4x	✅	11s	14s	-21%
polyveck_invntt_tomont	✅	10s	8s	+25%
rej_uniform_native_x86_64	✅	10s	-	new
mld_compute_pack_z	✅	9s	7s	+29%
pointwise_acc_native_aarch64	✅	8s	6s	+33%
poly_add	✅	8s	9s	-11%
polyveck_ntt	✅	8s	7s	+14%
mld_keccakf1600_permute_c	✅	7s	6s	+17%
pointwise_acc_native_x86_64	✅	7s	8s	-12%
poly_decompose_c	✅	7s	5s	+40%
poly_use_hint_c	✅	7s	5s	+40%
polyeta_unpack	✅	7s	8s	-12%
polyveck_chknorm	✅	7s	6s	+17%
polyvecl_ntt	✅	7s	4s	+75%
sign_pk_from_sk	✅	7s	6s	+17%
sk_t0hat_get_poly	✅	7s	2s	+250%
mld_sample_s1_s2_serial	✅	6s	4s	+50%
poly_permute_bitrev_to_custom_optional_native	✅	6s	4s	+50%
poly_reduce	✅	6s	3s	+100%
polyvec_matrix_pointwise_montgomery_row	✅	6s	1s	+500%
polyveck_pack_w1	✅	6s	3s	+100%
unpack_sk_t0hat	✅	6s	5s	+20%
keccak_squeezeblocks_x4	✅	5s	5s	+0%
pack_sig_c	✅	5s	5s	+0%
poly_challenge	✅	5s	6s	-17%
poly_decompose_native	✅	5s	3s	+67%
poly_invntt_tomont	✅	5s	3s	+67%
poly_uniform	✅	5s	4s	+25%
polyveck_caddq	✅	5s	6s	-17%
polyw1_pack	✅	5s	4s	+25%
polyz_unpack_17_native_aarch64	✅	5s	3s	+67%
rej_eta_c	✅	5s	5s	+0%
rej_eta_native	✅	5s	3s	+67%
sign_signature	✅	5s	6s	-17%
sign_verify_extmu	✅	5s	3s	+67%
sign_verify_pre_hash_internal	✅	5s	5s	+0%
unpack_sk	✅	5s	3s	+67%
unpack_sk_s1hat	✅	5s	2s	+150%
intt_native_x86_64	✅	4s	3s	+33%
keccak_f1600_x1_native_aarch64	✅	4s	2s	+100%
keccak_f1600_x4_native_aarch64_v84a	✅	4s	4s	+0%
keccakf1600_xor_bytes	✅	4s	2s	+100%
mld_ct_abs_i32	✅	4s	2s	+100%
mld_ct_cmask_nonzero_u8	✅	4s	3s	+33%
mld_ct_get_optblocker_u8	✅	4s	2s	+100%
mld_ct_memcmp	✅	4s	2s	+100%
mld_ct_sel_int32	✅	4s	3s	+33%
mld_sample_s1_s2	✅	4s	6s	-33%
mld_sign_resume	✅	4s	-	new
ntt_native_aarch64	✅	4s	2s	+100%
nttunpack_native_x86_64	✅	4s	3s	+33%
pack_sig_h	✅	4s	5s	-20%
pack_sig_z	✅	4s	2s	+100%
poly_caddq	✅	4s	2s	+100%
poly_caddq_native_x86_64	✅	4s	3s	+33%
poly_chknorm	✅	4s	4s	+0%
poly_decompose_32_native_aarch64	✅	4s	3s	+33%
poly_pointwise_montgomery_native	✅	4s	3s	+33%
poly_power2round	✅	4s	4s	+0%
poly_sub	✅	4s	3s	+33%
poly_uniform_eta	✅	4s	4s	+0%
poly_use_hint	✅	4s	3s	+33%
poly_use_hint_native	✅	4s	2s	+100%
polyeta_pack	✅	4s	3s	+33%
polyt0_pack	✅	4s	3s	+33%
polyveck_pack_eta	✅	4s	4s	+0%
polyveck_reduce	✅	4s	4s	+0%
polyvecl_chknorm	✅	4s	7s	-43%
polyvecl_unpack_z	✅	4s	3s	+33%
polyw1_pack_32	✅	4s	4s	+0%
polyw1_pack_88	✅	4s	2s	+100%
polyz_pack	✅	4s	3s	+33%
polyz_unpack	✅	4s	3s	+33%
rej_uniform_native	✅	4s	4s	+0%
sign_keypair_internal	✅	4s	5s	-20%
sign_signature_extmu	✅	4s	2s	+100%
sign_signature_pre_hash_internal	✅	4s	3s	+33%
sk_s2hat_get_poly	✅	4s	2s	+100%
sys_check_capability	✅	4s	4s	+0%
yvec_init	✅	4s	3s	+33%
fqscale	✅	3s	3s	+0%
keccak_absorb	✅	3s	3s	+0%
keccak_f1600_x4_native_aarch64_v8a_scalar_hybrid	✅	3s	2s	+50%
keccak_f1600_x4_native_aarch64_v8a_v84a_scalar_hybrid	✅	3s	2s	+50%
keccak_f1600_x4_native_avx2	✅	3s	2s	+50%
keccak_squeeze	✅	3s	4s	-25%
keccakf1600_permute_native	✅	3s	3s	+0%
keccakf1600_xor_bytes (big endian)	✅	3s	2s	+50%
keccakf1600x4_extract_bytes	✅	3s	4s	-25%
keccakf1600x4_extract_bytes_native	✅	3s	4s	-25%
make_hint	✅	3s	2s	+50%
mld_ct_cmask_neg_i32	✅	3s	2s	+50%
mld_ct_cmask_nonzero_u32	✅	3s	4s	-25%
mld_keccakf1600x4_xor_bytes_c	✅	3s	2s	+50%
mld_polymat_expand_entry	✅	3s	4s	-25%
mld_prepare_domain_separation_prefix	✅	3s	2s	+50%
mld_sign_attempt	✅	3s	-	new
mld_sign_finish	✅	3s	-	new
mld_value_barrier_i64	✅	3s	2s	+50%
pack_sk_s1	✅	3s	5s	-40%
pointwise_native_aarch64	✅	3s	5s	-40%
pointwise_native_x86_64	✅	3s	3s	+0%
poly_caddq_native	✅	3s	2s	+50%
poly_caddq_native_aarch64	✅	3s	2s	+50%
poly_chknorm_native	✅	3s	2s	+50%
poly_decompose_88_native_aarch64	✅	3s	1s	+200%
poly_ntt	✅	3s	2s	+50%
poly_ntt_native	✅	3s	4s	-25%
poly_permute_bitrev_to_custom_optional	✅	3s	2s	+50%
poly_pointwise_montgomery	✅	3s	3s	+0%
poly_shiftl	✅	3s	3s	+0%
poly_uniform_gamma1_4x	✅	3s	4s	-25%
poly_use_hint_native_aarch64	✅	3s	3s	+0%
polyt1_unpack	✅	3s	5s	-40%
polyvecl_pack_eta	✅	3s	3s	+0%
polyvecl_pointwise_acc_montgomery	✅	3s	3s	+0%
polyvecl_uniform_gamma1	✅	3s	2s	+50%
polyvecl_uniform_gamma1_serial	✅	3s	3s	+0%
polyz_unpack_19_native_aarch64	✅	3s	3s	+0%
polyz_unpack_native	✅	3s	4s	-25%
polyz_unpack_native_x86_64	✅	3s	3s	+0%
rej_uniform_native_aarch64	✅	3s	3s	+0%
shake128_absorb	✅	3s	2s	+50%
shake128_finalize	✅	3s	1s	+200%
shake128_init	✅	3s	2s	+50%
shake128x4_absorb_once	✅	3s	3s	+0%
shake128x4_squeezeblocks	✅	3s	3s	+0%
shake256_init	✅	3s	2s	+50%
shake256_squeeze	✅	3s	3s	+0%
shake256x4_absorb_once	✅	3s	3s	+0%
shake256x4_squeezeblocks	✅	3s	2s	+50%
sig_unpack_hints	✅	3s	2s	+50%
sign_keypair	✅	3s	3s	+0%
sign_signature_pre_hash_shake256	✅	3s	3s	+0%
sign_verify	✅	3s	3s	+0%
sign_verify_pre_hash_shake256	✅	3s	5s	-40%
unpack_sk_s2hat	✅	3s	4s	-25%
use_hint	✅	3s	2s	+50%
caddq	✅	2s	3s	-33%
decompose	✅	2s	1s	+100%
intt_native_aarch64	✅	2s	3s	-33%
keccak_f1600_x1_native_aarch64_v84a	✅	2s	3s	-33%
keccak_finalize	✅	2s	2s	+0%
keccak_init	✅	2s	1s	+100%
keccakf1600_extract_bytes (big endian)	✅	2s	2s	+0%
keccakf1600_permute	✅	2s	2s	+0%
keccakf1600x4_permute	✅	2s	4s	-50%
keccakf1600x4_xor_bytes_native	✅	2s	3s	-33%
mld_ct_get_optblocker_i64	✅	2s	2s	+0%
mld_ct_get_optblocker_u32	✅	2s	3s	-33%
mld_h	✅	2s	2s	+0%
mld_keccakf1600_extract_bytes	✅	2s	1s	+100%
mld_value_barrier_u32	✅	2s	3s	-33%
ntt_native_x86_64	✅	2s	2s	+0%
pack_sk_rho_key_tr_s2	✅	2s	2s	+0%
poly_caddq_c	✅	2s	2s	+0%
poly_chknorm_native_aarch64	✅	2s	3s	-33%
poly_chknorm_native_x86_64	✅	2s	3s	-33%
poly_decompose	✅	2s	2s	+0%
poly_decompose_native_x86_64	✅	2s	3s	-33%
poly_invntt_tomont_native	✅	2s	2s	+0%
poly_uniform_gamma1	✅	2s	3s	-33%
poly_use_hint_native_x86_64	✅	2s	-	new
polyvecl_pointwise_acc_montgomery_native	✅	2s	2s	+0%
polyvecl_unpack_eta	✅	2s	3s	-33%
power2round	✅	2s	1s	+100%
rej_eta	✅	2s	2s	+0%
rej_uniform_eta_native_aarch64	✅	2s	4s	-50%
shake128_release	✅	2s	3s	-33%
shake128_squeeze	✅	2s	2s	+0%
shake256	✅	2s	2s	+0%
shake256_finalize	✅	2s	1s	+100%
shake256_release	✅	2s	2s	+0%
sk_s1hat_get_poly	✅	2s	6s	-67%
unpack_pk_t1	✅	2s	5s	-60%
yvec_get_poly	✅	2s	3s	-33%
keccakf1600x4_xor_bytes	✅	1s	1s	+0%
mld_keccakf1600x4_extract_bytes_c	✅	1s	3s	-67%
mld_value_barrier_u8	✅	1s	3s	-67%
montgomery_reduce	✅	1s	4s	-75%
polyt1_pack	✅	1s	3s	-67%
polyveck_unpack_eta	✅	1s	6s	-83%
reduce32	✅	1s	3s	-67%
shake256_absorb	✅	1s	2s	-50%

[oqs-bot]

CBMC Results (ML-DSA-44)

Full Results (209 proofs)

Proof	Status	Current	Previous	Change
**TOTAL**	✅	1535s	1514s	+1.4%
polyvecl_pointwise_acc_montgomery_c	✅	129s	131s	-2%
sign_verify_internal	✅	121s	114s	+6%
poly_pointwise_montgomery_c	✅	119s	114s	+4%
mld_invntt_layer	✅	101s	107s	-6%
mld_attempt_signature_generation	✅	58s	58s	+0%
compute_pack_t0_t1	✅	49s	50s	-2%
mld_ntt_layer	✅	42s	42s	+0%
fqmul	✅	40s	39s	+3%
polyvec_matrix_expand	✅	27s	28s	-4%
sign_signature_internal	✅	26s	26s	+0%
keccakf1600x4_permute_native	✅	21s	22s	-5%
mld_ntt_butterfly_block	✅	19s	23s	-17%
poly_ntt_c	✅	18s	19s	-5%
polyvec_matrix_pointwise_montgomery_yvec	✅	15s	15s	+0%
rej_uniform_c	✅	15s	15s	+0%
poly_chknorm_c	✅	14s	17s	-18%
polyeta_unpack	✅	14s	14s	+0%
polyt0_unpack	✅	14s	15s	-7%
rej_uniform	✅	13s	18s	-28%
mld_check_pct	✅	12s	14s	-14%
poly_invntt_tomont_c	✅	11s	11s	+0%
poly_uniform_4x	✅	11s	14s	-21%
poly_uniform_eta_4x	✅	11s	11s	+0%
keccak_absorb_once_x4	✅	10s	9s	+11%
polyz_unpack_c	✅	10s	11s	-9%
pointwise_acc_native_aarch64	✅	9s	4s	+125%
polyvecl_chknorm	✅	9s	10s	-10%
rej_uniform_native_x86_64	✅	9s	-	new
mld_compute_pack_z	✅	7s	7s	+0%
mld_keccakf1600_permute_c	✅	7s	8s	-12%
caddq	✅	6s	2s	+200%
mld_sign_resume	✅	6s	-	new
pointwise_acc_native_x86_64	✅	6s	7s	-14%
polyvec_matrix_expand_serial	✅	6s	8s	-25%
rej_uniform_native	✅	6s	4s	+50%
sign_pk_from_sk	✅	6s	5s	+20%
keccak_f1600_x1_native_aarch64_v84a	✅	5s	3s	+67%
keccakf1600x4_permute	✅	5s	4s	+25%
poly_add	✅	5s	7s	-29%
poly_ntt_native	✅	5s	5s	+0%
poly_reduce	✅	5s	3s	+67%
poly_uniform_eta	✅	5s	5s	+0%
poly_use_hint_native_x86_64	✅	5s	-	new
polyvec_matrix_pointwise_montgomery_row	✅	5s	2s	+150%
polyveck_decompose	✅	5s	4s	+25%
rej_eta	✅	5s	3s	+67%
shake256	✅	5s	1s	+400%
sign_keypair_internal	✅	5s	4s	+25%
sign_signature	✅	5s	3s	+67%
sign_verify_pre_hash_internal	✅	5s	3s	+67%
unpack_sk_t0hat	✅	5s	3s	+67%
fqscale	✅	4s	3s	+33%
intt_native_aarch64	✅	4s	9s	-56%
intt_native_x86_64	✅	4s	4s	+0%
keccak_squeeze	✅	4s	1s	+300%
keccak_squeezeblocks_x4	✅	4s	4s	+0%
mld_ct_cmask_nonzero_u32	✅	4s	2s	+100%
mld_ct_cmask_nonzero_u8	✅	4s	2s	+100%
mld_h	✅	4s	4s	+0%
mld_prepare_domain_separation_prefix	✅	4s	4s	+0%
mld_sample_s1_s2_serial	✅	4s	3s	+33%
mld_sign_finish	✅	4s	-	new
mld_value_barrier_u8	✅	4s	3s	+33%
montgomery_reduce	✅	4s	3s	+33%
nttunpack_native_x86_64	✅	4s	1s	+300%
pack_sig_h	✅	4s	3s	+33%
pack_sig_z	✅	4s	4s	+0%
pointwise_native_aarch64	✅	4s	5s	-20%
poly_caddq_native	✅	4s	5s	-20%
poly_challenge	✅	4s	3s	+33%
poly_ntt	✅	4s	3s	+33%
poly_pointwise_montgomery_native	✅	4s	2s	+100%
poly_uniform	✅	4s	6s	-33%
poly_uniform_gamma1	✅	4s	4s	+0%
poly_use_hint_native	✅	4s	4s	+0%
poly_use_hint_native_aarch64	✅	4s	2s	+100%
polyt1_unpack	✅	4s	5s	-20%
polyveck_caddq	✅	4s	3s	+33%
polyveck_chknorm	✅	4s	5s	-20%
polyveck_invntt_tomont	✅	4s	5s	-20%
polyveck_ntt	✅	4s	5s	-20%
polyveck_reduce	✅	4s	5s	-20%
polyveck_unpack_eta	✅	4s	2s	+100%
polyvecl_ntt	✅	4s	2s	+100%
polyvecl_pointwise_acc_montgomery_native	✅	4s	2s	+100%
polyvecl_unpack_eta	✅	4s	2s	+100%
polyw1_pack	✅	4s	3s	+33%
polyz_unpack_19_native_aarch64	✅	4s	5s	-20%
power2round	✅	4s	3s	+33%
rej_eta_c	✅	4s	4s	+0%
rej_uniform_eta_native_aarch64	✅	4s	2s	+100%
shake128_absorb	✅	4s	2s	+100%
shake128_release	✅	4s	1s	+300%
shake128x4_absorb_once	✅	4s	3s	+33%
shake128x4_squeezeblocks	✅	4s	1s	+300%
sign_signature_extmu	✅	4s	4s	+0%
sign_signature_pre_hash_internal	✅	4s	6s	-33%
sign_verify	✅	4s	4s	+0%
sign_verify_extmu	✅	4s	3s	+33%
unpack_sk	✅	4s	3s	+33%
decompose	✅	3s	2s	+50%
keccak_absorb	✅	3s	5s	-40%
keccak_init	✅	3s	3s	+0%
keccakf1600_permute	✅	3s	2s	+50%
keccakf1600_xor_bytes (big endian)	✅	3s	4s	-25%
keccakf1600x4_extract_bytes	✅	3s	2s	+50%
keccakf1600x4_extract_bytes_native	✅	3s	3s	+0%
keccakf1600x4_xor_bytes_native	✅	3s	3s	+0%
make_hint	✅	3s	3s	+0%
mld_ct_get_optblocker_i64	✅	3s	4s	-25%
mld_ct_get_optblocker_u32	✅	3s	1s	+200%
mld_ct_get_optblocker_u8	✅	3s	1s	+200%
mld_ct_memcmp	✅	3s	3s	+0%
mld_keccakf1600x4_xor_bytes_c	✅	3s	2s	+50%
mld_sample_s1_s2	✅	3s	4s	-25%
mld_value_barrier_i64	✅	3s	2s	+50%
mld_value_barrier_u32	✅	3s	2s	+50%
ntt_native_aarch64	✅	3s	3s	+0%
ntt_native_x86_64	✅	3s	3s	+0%
pack_sig_c	✅	3s	2s	+50%
pack_sk_s1	✅	3s	2s	+50%
pointwise_native_x86_64	✅	3s	4s	-25%
poly_caddq_native_aarch64	✅	3s	4s	-25%
poly_chknorm_native	✅	3s	4s	-25%
poly_decompose	✅	3s	3s	+0%
poly_decompose_32_native_aarch64	✅	3s	2s	+50%
poly_decompose_c	✅	3s	4s	-25%
poly_invntt_tomont_native	✅	3s	4s	-25%
poly_power2round	✅	3s	4s	-25%
poly_shiftl	✅	3s	3s	+0%
poly_sub	✅	3s	3s	+0%
polyeta_pack	✅	3s	3s	+0%
polyt0_pack	✅	3s	2s	+50%
polyveck_pack_eta	✅	3s	2s	+50%
polyvecl_pointwise_acc_montgomery	✅	3s	4s	-25%
polyvecl_unpack_z	✅	3s	2s	+50%
polyz_unpack	✅	3s	3s	+0%
reduce32	✅	3s	2s	+50%
rej_eta_native	✅	3s	6s	-50%
rej_uniform_native_aarch64	✅	3s	5s	-40%
shake128_init	✅	3s	3s	+0%
shake128_squeeze	✅	3s	1s	+200%
shake256_finalize	✅	3s	2s	+50%
shake256_init	✅	3s	3s	+0%
shake256_release	✅	3s	2s	+50%
shake256_squeeze	✅	3s	2s	+50%
shake256x4_absorb_once	✅	3s	3s	+0%
sig_unpack_hints	✅	3s	2s	+50%
sign_keypair	✅	3s	4s	-25%
sign_signature_pre_hash_shake256	✅	3s	3s	+0%
sign_verify_pre_hash_shake256	✅	3s	5s	-40%
sk_s2hat_get_poly	✅	3s	2s	+50%
sk_t0hat_get_poly	✅	3s	2s	+50%
unpack_pk_t1	✅	3s	5s	-40%
unpack_sk_s1hat	✅	3s	1s	+200%
unpack_sk_s2hat	✅	3s	4s	-25%
use_hint	✅	3s	2s	+50%
yvec_init	✅	3s	3s	+0%
keccak_f1600_x4_native_aarch64_v84a	✅	2s	2s	+0%
keccak_f1600_x4_native_avx2	✅	2s	3s	-33%
keccak_finalize	✅	2s	3s	-33%
keccakf1600_permute_native	✅	2s	3s	-33%
keccakf1600_xor_bytes	✅	2s	1s	+100%
keccakf1600x4_xor_bytes	✅	2s	2s	+0%
mld_ct_cmask_neg_i32	✅	2s	3s	-33%
mld_ct_sel_int32	✅	2s	2s	+0%
mld_keccakf1600_extract_bytes	✅	2s	2s	+0%
mld_keccakf1600x4_extract_bytes_c	✅	2s	2s	+0%
mld_polymat_expand_entry	✅	2s	3s	-33%
mld_sign_attempt	✅	2s	-	new
pack_sk_rho_key_tr_s2	✅	2s	3s	-33%
poly_caddq	✅	2s	2s	+0%
poly_caddq_c	✅	2s	2s	+0%
poly_caddq_native_x86_64	✅	2s	4s	-50%
poly_chknorm	✅	2s	4s	-50%
poly_chknorm_native_aarch64	✅	2s	4s	-50%
poly_chknorm_native_x86_64	✅	2s	2s	+0%
poly_decompose_88_native_aarch64	✅	2s	4s	-50%
poly_decompose_native	✅	2s	3s	-33%
poly_decompose_native_x86_64	✅	2s	3s	-33%
poly_invntt_tomont	✅	2s	4s	-50%
poly_permute_bitrev_to_custom_optional	✅	2s	2s	+0%
poly_permute_bitrev_to_custom_optional_native	✅	2s	4s	-50%
poly_pointwise_montgomery	✅	2s	3s	-33%
poly_uniform_gamma1_4x	✅	2s	5s	-60%
poly_use_hint	✅	2s	4s	-50%
poly_use_hint_c	✅	2s	3s	-33%
polyt1_pack	✅	2s	4s	-50%
polyveck_pack_w1	✅	2s	1s	+100%
polyvecl_uniform_gamma1	✅	2s	3s	-33%
polyvecl_uniform_gamma1_serial	✅	2s	2s	+0%
polyw1_pack_32	✅	2s	2s	+0%
polyw1_pack_88	✅	2s	1s	+100%
polyz_unpack_17_native_aarch64	✅	2s	5s	-60%
polyz_unpack_native_x86_64	✅	2s	3s	-33%
shake256_absorb	✅	2s	3s	-33%
shake256x4_squeezeblocks	✅	2s	4s	-50%
sk_s1hat_get_poly	✅	2s	3s	-33%
sys_check_capability	✅	2s	4s	-50%
yvec_get_poly	✅	2s	3s	-33%
keccak_f1600_x1_native_aarch64	✅	1s	2s	-50%
keccak_f1600_x4_native_aarch64_v8a_scalar_hybrid	✅	1s	3s	-67%
keccak_f1600_x4_native_aarch64_v8a_v84a_scalar_hybrid	✅	1s	1s	+0%
keccakf1600_extract_bytes (big endian)	✅	1s	2s	-50%
mld_ct_abs_i32	✅	1s	2s	-50%
polyvecl_pack_eta	✅	1s	3s	-67%
polyz_pack	✅	1s	2s	-50%
polyz_unpack_native	✅	1s	2s	-50%
shake128_finalize	✅	1s	2s	-50%

[oqs-bot]

CBMC Results (ML-DSA-87)

⚠️ Attention Required

Proof	Status	Current	Previous	Change
sign_signature_internal	⚠️	114s	42s	+171%

Full Results (209 proofs)

Proof	Status	Current	Previous	Change
**TOTAL**	✅	2208s	2151s	+2.6%
polyvecl_pointwise_acc_montgomery_c	✅	342s	353s	-3%
polyvec_matrix_expand	✅	307s	324s	-5%
poly_pointwise_montgomery_c	✅	131s	144s	-9%
mld_invntt_layer	✅	117s	115s	+2%
sign_signature_internal	⚠️	114s	42s	+171%
sign_verify_internal	✅	99s	97s	+2%
mld_attempt_signature_generation	✅	56s	55s	+2%
mld_ntt_layer	✅	46s	45s	+2%
fqmul	✅	42s	43s	-2%
polyvec_matrix_expand_serial	✅	38s	38s	+0%
mld_ntt_butterfly_block	✅	25s	24s	+4%
keccakf1600x4_permute_native	✅	23s	23s	+0%
poly_ntt_c	✅	20s	21s	-5%
polyvec_matrix_pointwise_montgomery_yvec	✅	19s	18s	+6%
compute_pack_t0_t1	✅	18s	19s	-5%
poly_chknorm_c	✅	17s	15s	+13%
polyeta_unpack	✅	17s	17s	+0%
polyt0_unpack	✅	16s	14s	+14%
rej_uniform_c	✅	15s	19s	-21%
rej_uniform	✅	13s	15s	-13%
mld_compute_pack_z	✅	12s	8s	+50%
poly_uniform_4x	✅	12s	13s	-8%
poly_uniform_eta_4x	✅	12s	11s	+9%
mld_check_pct	✅	11s	16s	-31%
polyveck_decompose	✅	10s	13s	-23%
rej_uniform_native_x86_64	✅	10s	-	new
sign_pk_from_sk	✅	10s	6s	+67%
keccak_absorb_once_x4	✅	9s	9s	+0%
pointwise_acc_native_x86_64	✅	9s	6s	+50%
poly_invntt_tomont_c	✅	9s	12s	-25%
polyveck_invntt_tomont	✅	9s	9s	+0%
pointwise_acc_native_aarch64	✅	8s	6s	+33%
polyveck_caddq	✅	8s	8s	+0%
polyveck_ntt	✅	8s	11s	-27%
polyvecl_ntt	✅	8s	7s	+14%
mld_sample_s1_s2	✅	7s	6s	+17%
ntt_native_x86_64	✅	7s	2s	+250%
polyt0_pack	✅	7s	4s	+75%
sign_keypair_internal	✅	7s	6s	+17%
sign_verify_pre_hash_shake256	✅	7s	3s	+133%
intt_native_aarch64	✅	6s	3s	+100%
mld_ct_sel_int32	✅	6s	3s	+100%
mld_keccakf1600_permute_c	✅	6s	7s	-14%
poly_chknorm_native_x86_64	✅	6s	2s	+200%
poly_pointwise_montgomery	✅	6s	4s	+50%
poly_uniform_gamma1_4x	✅	6s	3s	+100%
polyveck_unpack_eta	✅	6s	4s	+50%
polyz_pack	✅	6s	5s	+20%
caddq	✅	5s	4s	+25%
fqscale	✅	5s	3s	+67%
keccakf1600_xor_bytes (big endian)	✅	5s	2s	+150%
pack_sig_z	✅	5s	5s	+0%
poly_add	✅	5s	6s	-17%
poly_caddq_c	✅	5s	3s	+67%
poly_challenge	✅	5s	5s	+0%
poly_decompose_c	✅	5s	5s	+0%
poly_ntt	✅	5s	3s	+67%
poly_ntt_native	✅	5s	3s	+67%
polyt1_pack	✅	5s	3s	+67%
polyt1_unpack	✅	5s	4s	+25%
polyvecl_uniform_gamma1	✅	5s	2s	+150%
polyvecl_unpack_eta	✅	5s	5s	+0%
polyw1_pack_88	✅	5s	3s	+67%
power2round	✅	5s	4s	+25%
rej_uniform_native_aarch64	✅	5s	2s	+150%
sign_keypair	✅	5s	4s	+25%
sign_signature_pre_hash_internal	✅	5s	5s	+0%
sign_signature_pre_hash_shake256	✅	5s	6s	-17%
sign_verify	✅	5s	5s	+0%
sign_verify_pre_hash_internal	✅	5s	3s	+67%
unpack_sk_t0hat	✅	5s	7s	-29%
decompose	✅	4s	3s	+33%
intt_native_x86_64	✅	4s	3s	+33%
keccak_f1600_x4_native_aarch64_v8a_scalar_hybrid	✅	4s	3s	+33%
keccak_f1600_x4_native_aarch64_v8a_v84a_scalar_hybrid	✅	4s	4s	+0%
keccak_finalize	✅	4s	1s	+300%
keccak_squeeze	✅	4s	2s	+100%
keccak_squeezeblocks_x4	✅	4s	4s	+0%
mld_ct_get_optblocker_i64	✅	4s	3s	+33%
mld_sample_s1_s2_serial	✅	4s	8s	-50%
pack_sig_c	✅	4s	4s	+0%
pointwise_native_aarch64	✅	4s	5s	-20%
pointwise_native_x86_64	✅	4s	2s	+100%
poly_decompose_native	✅	4s	2s	+100%
poly_power2round	✅	4s	3s	+33%
poly_reduce	✅	4s	2s	+100%
poly_uniform_eta	✅	4s	4s	+0%
polyveck_pack_eta	✅	4s	6s	-33%
polyvecl_chknorm	✅	4s	7s	-43%
polyvecl_pointwise_acc_montgomery_native	✅	4s	3s	+33%
polyvecl_unpack_z	✅	4s	4s	+0%
polyz_unpack_17_native_aarch64	✅	4s	3s	+33%
rej_eta	✅	4s	4s	+0%
rej_eta_native	✅	4s	6s	-33%
rej_uniform_native	✅	4s	8s	-50%
shake128_finalize	✅	4s	2s	+100%
shake256x4_absorb_once	✅	4s	2s	+100%
shake256x4_squeezeblocks	✅	4s	1s	+300%
sign_verify_extmu	✅	4s	3s	+33%
sk_s2hat_get_poly	✅	4s	3s	+33%
sys_check_capability	✅	4s	3s	+33%
unpack_pk_t1	✅	4s	1s	+300%
keccak_absorb	✅	3s	3s	+0%
keccakf1600x4_permute	✅	3s	3s	+0%
keccakf1600x4_xor_bytes	✅	3s	3s	+0%
make_hint	✅	3s	3s	+0%
mld_ct_cmask_nonzero_u32	✅	3s	2s	+50%
mld_ct_get_optblocker_u32	✅	3s	2s	+50%
mld_ct_get_optblocker_u8	✅	3s	3s	+0%
mld_ct_memcmp	✅	3s	3s	+0%
mld_h	✅	3s	3s	+0%
mld_keccakf1600x4_xor_bytes_c	✅	3s	4s	-25%
mld_sign_attempt	✅	3s	-	new
mld_sign_resume	✅	3s	-	new
mld_value_barrier_u8	✅	3s	3s	+0%
montgomery_reduce	✅	3s	3s	+0%
nttunpack_native_x86_64	✅	3s	3s	+0%
pack_sig_h	✅	3s	4s	-25%
pack_sk_rho_key_tr_s2	✅	3s	3s	+0%
pack_sk_s1	✅	3s	1s	+200%
poly_caddq_native	✅	3s	4s	-25%
poly_caddq_native_aarch64	✅	3s	3s	+0%
poly_caddq_native_x86_64	✅	3s	2s	+50%
poly_chknorm	✅	3s	3s	+0%
poly_chknorm_native	✅	3s	4s	-25%
poly_chknorm_native_aarch64	✅	3s	4s	-25%
poly_decompose	✅	3s	3s	+0%
poly_decompose_32_native_aarch64	✅	3s	5s	-40%
poly_decompose_88_native_aarch64	✅	3s	2s	+50%
poly_decompose_native_x86_64	✅	3s	2s	+50%
poly_invntt_tomont_native	✅	3s	5s	-40%
poly_permute_bitrev_to_custom_optional	✅	3s	3s	+0%
poly_pointwise_montgomery_native	✅	3s	5s	-40%
poly_uniform	✅	3s	4s	-25%
poly_uniform_gamma1	✅	3s	4s	-25%
poly_use_hint	✅	3s	1s	+200%
poly_use_hint_c	✅	3s	2s	+50%
poly_use_hint_native_x86_64	✅	3s	-	new
polyveck_chknorm	✅	3s	3s	+0%
polyveck_pack_w1	✅	3s	3s	+0%
polyvecl_pack_eta	✅	3s	3s	+0%
polyvecl_pointwise_acc_montgomery	✅	3s	5s	-40%
polyw1_pack	✅	3s	4s	-25%
polyw1_pack_32	✅	3s	4s	-25%
polyz_unpack	✅	3s	2s	+50%
polyz_unpack_native	✅	3s	4s	-25%
rej_eta_c	✅	3s	5s	-40%
shake128_squeeze	✅	3s	2s	+50%
shake128x4_squeezeblocks	✅	3s	3s	+0%
shake256	✅	3s	2s	+50%
shake256_absorb	✅	3s	2s	+50%
shake256_release	✅	3s	3s	+0%
sig_unpack_hints	✅	3s	3s	+0%
sign_signature	✅	3s	5s	-40%
sk_t0hat_get_poly	✅	3s	4s	-25%
unpack_sk_s1hat	✅	3s	2s	+50%
unpack_sk_s2hat	✅	3s	3s	+0%
yvec_get_poly	✅	3s	4s	-25%
keccak_f1600_x1_native_aarch64	✅	2s	1s	+100%
keccak_f1600_x1_native_aarch64_v84a	✅	2s	1s	+100%
keccak_f1600_x4_native_avx2	✅	2s	2s	+0%
keccak_init	✅	2s	3s	-33%
keccakf1600_extract_bytes (big endian)	✅	2s	3s	-33%
keccakf1600_permute	✅	2s	3s	-33%
keccakf1600_permute_native	✅	2s	4s	-50%
keccakf1600_xor_bytes	✅	2s	3s	-33%
keccakf1600x4_extract_bytes	✅	2s	2s	+0%
keccakf1600x4_extract_bytes_native	✅	2s	2s	+0%
keccakf1600x4_xor_bytes_native	✅	2s	3s	-33%
mld_ct_abs_i32	✅	2s	3s	-33%
mld_ct_cmask_neg_i32	✅	2s	4s	-50%
mld_ct_cmask_nonzero_u8	✅	2s	3s	-33%
mld_keccakf1600_extract_bytes	✅	2s	4s	-50%
mld_keccakf1600x4_extract_bytes_c	✅	2s	2s	+0%
mld_polymat_expand_entry	✅	2s	3s	-33%
mld_prepare_domain_separation_prefix	✅	2s	4s	-50%
mld_sign_finish	✅	2s	-	new
mld_value_barrier_u32	✅	2s	2s	+0%
ntt_native_aarch64	✅	2s	6s	-67%
poly_caddq	✅	2s	2s	+0%
poly_invntt_tomont	✅	2s	1s	+100%
poly_permute_bitrev_to_custom_optional_native	✅	2s	5s	-60%
poly_shiftl	✅	2s	4s	-50%
poly_use_hint_native	✅	2s	3s	-33%
poly_use_hint_native_aarch64	✅	2s	2s	+0%
polyeta_pack	✅	2s	4s	-50%
polyvec_matrix_pointwise_montgomery_row	✅	2s	3s	-33%
polyveck_reduce	✅	2s	3s	-33%
polyvecl_uniform_gamma1_serial	✅	2s	4s	-50%
polyz_unpack_19_native_aarch64	✅	2s	4s	-50%
polyz_unpack_c	✅	2s	3s	-33%
polyz_unpack_native_x86_64	✅	2s	3s	-33%
reduce32	✅	2s	3s	-33%
rej_uniform_eta_native_aarch64	✅	2s	5s	-60%
shake128_absorb	✅	2s	4s	-50%
shake128_init	✅	2s	1s	+100%
shake128_release	✅	2s	4s	-50%
shake128x4_absorb_once	✅	2s	5s	-60%
shake256_finalize	✅	2s	2s	+0%
shake256_init	✅	2s	2s	+0%
sign_signature_extmu	✅	2s	4s	-50%
sk_s1hat_get_poly	✅	2s	3s	-33%
unpack_sk	✅	2s	5s	-60%
use_hint	✅	2s	3s	-33%
yvec_init	✅	2s	4s	-50%
keccak_f1600_x4_native_aarch64_v84a	✅	1s	4s	-75%
mld_value_barrier_i64	✅	1s	1s	+0%
poly_sub	✅	1s	3s	-67%
shake256_squeeze	✅	1s	2s	-50%

[oqs-bot]

CBMC Results (ML-DSA-65, REDUCE-RAM)

Full Results (209 proofs)

Proof	Status	Current	Previous	Change
**TOTAL**	✅	1663s	1482s	+12.2%
polyvec_matrix_pointwise_montgomery_yvec	✅	226s	201s	+12%
poly_pointwise_montgomery_c	✅	140s	116s	+21%
mld_invntt_layer	✅	124s	108s	+15%
sign_verify_internal	✅	80s	71s	+13%
mld_ntt_layer	✅	50s	43s	+16%
polyvecl_chknorm	✅	48s	43s	+12%
fqmul	✅	46s	40s	+15%
polyveck_chknorm	✅	38s	36s	+6%
mld_attempt_signature_generation	✅	34s	31s	+10%
mld_ntt_butterfly_block	✅	25s	25s	+0%
keccakf1600x4_permute_native	✅	23s	22s	+5%
poly_ntt_c	✅	21s	22s	-5%
rej_uniform_c	✅	18s	16s	+12%
poly_chknorm_c	✅	16s	13s	+23%
mld_check_pct	✅	15s	12s	+25%
poly_invntt_tomont_c	✅	15s	10s	+50%
poly_uniform_eta_4x	✅	14s	13s	+8%
polyveck_decompose	✅	14s	14s	+0%
polyt0_unpack	✅	13s	13s	+0%
keccak_absorb_once_x4	✅	11s	10s	+10%
rej_uniform_native_x86_64	✅	11s	-	new
polyz_unpack_c	✅	10s	9s	+11%
polyvec_matrix_pointwise_montgomery_row	✅	9s	8s	+12%
rej_uniform	✅	9s	7s	+29%
pointwise_acc_native_aarch64	✅	8s	6s	+33%
poly_add	✅	8s	7s	+14%
polyveck_reduce	✅	8s	6s	+33%
rej_uniform_native	✅	8s	4s	+100%
compute_pack_t0_t1	✅	7s	7s	+0%
mld_compute_pack_z	✅	7s	5s	+40%
pointwise_acc_native_x86_64	✅	7s	5s	+40%
poly_caddq_c	✅	7s	5s	+40%
poly_decompose_c	✅	7s	8s	-12%
polyveck_caddq	✅	7s	7s	+0%
polyveck_invntt_tomont	✅	7s	7s	+0%
polyveck_unpack_eta	✅	7s	3s	+133%
polyvecl_unpack_z	✅	7s	1s	+600%
sign_pk_from_sk	✅	7s	5s	+40%
mld_keccakf1600_permute_c	✅	6s	7s	-14%
mld_prepare_domain_separation_prefix	✅	6s	4s	+50%
polyt0_pack	✅	6s	5s	+20%
polyvecl_pack_eta	✅	6s	2s	+200%
rej_uniform_eta_native_aarch64	✅	6s	5s	+20%
sign_keypair	✅	6s	4s	+50%
sign_signature_internal	✅	6s	6s	+0%
sign_signature_pre_hash_shake256	✅	6s	7s	-14%
keccak_squeezeblocks_x4	✅	5s	4s	+25%
mld_sign_resume	✅	5s	-	new
ntt_native_x86_64	✅	5s	5s	+0%
pack_sig_c	✅	5s	3s	+67%
pointwise_native_x86_64	✅	5s	2s	+150%
poly_caddq_native	✅	5s	4s	+25%
poly_chknorm_native_x86_64	✅	5s	4s	+25%
poly_invntt_tomont_native	✅	5s	5s	+0%
poly_power2round	✅	5s	7s	-29%
poly_reduce	✅	5s	4s	+25%
polyvecl_ntt	✅	5s	7s	-29%
polyz_unpack_17_native_aarch64	✅	5s	2s	+150%
polyz_unpack_19_native_aarch64	✅	5s	5s	+0%
power2round	✅	5s	2s	+150%
sign_signature	✅	5s	5s	+0%
sign_verify_pre_hash_internal	✅	5s	5s	+0%
decompose	✅	4s	4s	+0%
keccak_absorb	✅	4s	3s	+33%
keccak_f1600_x4_native_aarch64_v8a_v84a_scalar_hybrid	✅	4s	3s	+33%
keccak_squeeze	✅	4s	2s	+100%
mld_ct_abs_i32	✅	4s	6s	-33%
mld_ct_cmask_nonzero_u8	✅	4s	2s	+100%
mld_ct_memcmp	✅	4s	4s	+0%
mld_polymat_expand_entry	✅	4s	3s	+33%
mld_sample_s1_s2	✅	4s	6s	-33%
mld_sample_s1_s2_serial	✅	4s	3s	+33%
mld_sign_finish	✅	4s	-	new
pack_sig_h	✅	4s	2s	+100%
pack_sig_z	✅	4s	1s	+300%
pack_sk_rho_key_tr_s2	✅	4s	2s	+100%
poly_caddq_native_x86_64	✅	4s	1s	+300%
poly_challenge	✅	4s	5s	-20%
poly_chknorm_native	✅	4s	4s	+0%
poly_decompose_32_native_aarch64	✅	4s	4s	+0%
poly_decompose_88_native_aarch64	✅	4s	2s	+100%
poly_decompose_native	✅	4s	5s	-20%
poly_ntt_native	✅	4s	2s	+100%
poly_permute_bitrev_to_custom_optional_native	✅	4s	3s	+33%
poly_pointwise_montgomery	✅	4s	2s	+100%
poly_pointwise_montgomery_native	✅	4s	4s	+0%
poly_uniform_eta	✅	4s	5s	-20%
poly_use_hint_native_aarch64	✅	4s	4s	+0%
poly_use_hint_native_x86_64	✅	4s	-	new
polyeta_unpack	✅	4s	4s	+0%
polyt1_unpack	✅	4s	3s	+33%
polyveck_pack_w1	✅	4s	4s	+0%
polyvecl_pointwise_acc_montgomery_c	✅	4s	3s	+33%
polyvecl_uniform_gamma1	✅	4s	4s	+0%
rej_eta	✅	4s	5s	-20%
rej_eta_native	✅	4s	3s	+33%
shake256	✅	4s	2s	+100%
shake256_finalize	✅	4s	1s	+300%
shake256_init	✅	4s	4s	+0%
shake256x4_absorb_once	✅	4s	2s	+100%
sign_verify	✅	4s	6s	-33%
sign_verify_pre_hash_shake256	✅	4s	6s	-33%
sk_t0hat_get_poly	✅	4s	1s	+300%
unpack_sk	✅	4s	3s	+33%
unpack_sk_s1hat	✅	4s	1s	+300%
unpack_sk_t0hat	✅	4s	4s	+0%
yvec_get_poly	✅	4s	3s	+33%
caddq	✅	3s	2s	+50%
fqscale	✅	3s	3s	+0%
intt_native_x86_64	✅	3s	4s	-25%
keccak_f1600_x1_native_aarch64_v84a	✅	3s	2s	+50%
keccak_finalize	✅	3s	2s	+50%
keccakf1600_xor_bytes	✅	3s	4s	-25%
keccakf1600x4_xor_bytes_native	✅	3s	2s	+50%
mld_ct_cmask_neg_i32	✅	3s	3s	+0%
mld_ct_cmask_nonzero_u32	✅	3s	3s	+0%
mld_ct_get_optblocker_u8	✅	3s	4s	-25%
mld_keccakf1600_extract_bytes	✅	3s	2s	+50%
mld_keccakf1600x4_extract_bytes_c	✅	3s	2s	+50%
mld_keccakf1600x4_xor_bytes_c	✅	3s	2s	+50%
mld_value_barrier_i64	✅	3s	2s	+50%
mld_value_barrier_u32	✅	3s	4s	-25%
nttunpack_native_x86_64	✅	3s	3s	+0%
pack_sk_s1	✅	3s	3s	+0%
poly_chknorm	✅	3s	3s	+0%
poly_chknorm_native_aarch64	✅	3s	2s	+50%
poly_decompose	✅	3s	2s	+50%
poly_invntt_tomont	✅	3s	5s	-40%
poly_shiftl	✅	3s	3s	+0%
poly_sub	✅	3s	4s	-25%
poly_uniform	✅	3s	2s	+50%
poly_uniform_gamma1	✅	3s	3s	+0%
poly_uniform_gamma1_4x	✅	3s	3s	+0%
poly_use_hint_c	✅	3s	2s	+50%
poly_use_hint_native	✅	3s	7s	-57%
polyt1_pack	✅	3s	3s	+0%
polyveck_pack_eta	✅	3s	3s	+0%
polyvecl_uniform_gamma1_serial	✅	3s	1s	+200%
polyvecl_unpack_eta	✅	3s	2s	+50%
polyw1_pack_32	✅	3s	2s	+50%
polyz_pack	✅	3s	3s	+0%
polyz_unpack	✅	3s	3s	+0%
polyz_unpack_native	✅	3s	3s	+0%
reduce32	✅	3s	2s	+50%
rej_uniform_native_aarch64	✅	3s	5s	-40%
shake128_init	✅	3s	6s	-50%
shake256_absorb	✅	3s	4s	-25%
shake256_release	✅	3s	3s	+0%
shake256x4_squeezeblocks	✅	3s	2s	+50%
sign_keypair_internal	✅	3s	3s	+0%
sign_signature_pre_hash_internal	✅	3s	3s	+0%
sign_verify_extmu	✅	3s	2s	+50%
sk_s1hat_get_poly	✅	3s	3s	+0%
sk_s2hat_get_poly	✅	3s	1s	+200%
sys_check_capability	✅	3s	1s	+200%
unpack_sk_s2hat	✅	3s	3s	+0%
intt_native_aarch64	✅	2s	2s	+0%
keccak_f1600_x4_native_aarch64_v84a	✅	2s	2s	+0%
keccak_f1600_x4_native_aarch64_v8a_scalar_hybrid	✅	2s	3s	-33%
keccak_f1600_x4_native_avx2	✅	2s	2s	+0%
keccak_init	✅	2s	4s	-50%
keccakf1600_permute	✅	2s	4s	-50%
keccakf1600_permute_native	✅	2s	2s	+0%
keccakf1600_xor_bytes (big endian)	✅	2s	2s	+0%
keccakf1600x4_extract_bytes	✅	2s	4s	-50%
keccakf1600x4_extract_bytes_native	✅	2s	1s	+100%
keccakf1600x4_permute	✅	2s	1s	+100%
keccakf1600x4_xor_bytes	✅	2s	2s	+0%
make_hint	✅	2s	3s	-33%
mld_ct_get_optblocker_i64	✅	2s	1s	+100%
mld_h	✅	2s	3s	-33%
mld_sign_attempt	✅	2s	-	new
mld_value_barrier_u8	✅	2s	1s	+100%
montgomery_reduce	✅	2s	1s	+100%
ntt_native_aarch64	✅	2s	3s	-33%
pointwise_native_aarch64	✅	2s	3s	-33%
poly_caddq_native_aarch64	✅	2s	2s	+0%
poly_decompose_native_x86_64	✅	2s	2s	+0%
poly_ntt	✅	2s	2s	+0%
poly_permute_bitrev_to_custom_optional	✅	2s	3s	-33%
poly_use_hint	✅	2s	3s	-33%
polyeta_pack	✅	2s	1s	+100%
polyvec_matrix_expand	✅	2s	6s	-67%
polyveck_ntt	✅	2s	4s	-50%
polyvecl_pointwise_acc_montgomery_native	✅	2s	3s	-33%
polyw1_pack	✅	2s	3s	-33%
polyw1_pack_88	✅	2s	3s	-33%
polyz_unpack_native_x86_64	✅	2s	3s	-33%
shake128_absorb	✅	2s	2s	+0%
shake128_finalize	✅	2s	2s	+0%
shake128_release	✅	2s	2s	+0%
shake128_squeeze	✅	2s	3s	-33%
shake128x4_absorb_once	✅	2s	2s	+0%
shake128x4_squeezeblocks	✅	2s	2s	+0%
sig_unpack_hints	✅	2s	1s	+100%
sign_signature_extmu	✅	2s	4s	-50%
unpack_pk_t1	✅	2s	2s	+0%
use_hint	✅	2s	2s	+0%
yvec_init	✅	2s	5s	-60%
keccak_f1600_x1_native_aarch64	✅	1s	2s	-50%
keccakf1600_extract_bytes (big endian)	✅	1s	3s	-67%
mld_ct_get_optblocker_u32	✅	1s	3s	-67%
mld_ct_sel_int32	✅	1s	2s	-50%
poly_caddq	✅	1s	3s	-67%
poly_uniform_4x	✅	1s	4s	-75%
polyvec_matrix_expand_serial	✅	1s	3s	-67%
polyvecl_pointwise_acc_montgomery	✅	1s	3s	-67%
rej_eta_c	✅	1s	4s	-75%
shake256_squeeze	✅	1s	4s	-75%

[oqs-bot]

CBMC Results (ML-DSA-87, REDUCE-RAM)

⚠️ Attention Required

Proof	Status	Current	Previous	Change
**TOTAL**	⚠️	1963s	1436s	+36.7%
fqmul	⚠️	66s	39s	+69%
mld_check_pct	⚠️	23s	15s	+53%
mld_ntt_butterfly_block	⚠️	37s	23s	+61%
poly_chknorm_c	⚠️	22s	13s	+69%
poly_invntt_tomont_c	⚠️	20s	9s	+122%
poly_ntt_c	⚠️	46s	19s	+142%
polyeta_unpack	⚠️	21s	13s	+62%
polyvecl_chknorm	⚠️	65s	38s	+71%
rej_uniform_c	⚠️	28s	18s	+56%

Full Results (209 proofs)

Proof	Status	Current	Previous	Change
**TOTAL**	⚠️	1963s	1436s	+36.7%
polyvec_matrix_pointwise_montgomery_yvec	✅	213s	196s	+9%
poly_pointwise_montgomery_c	✅	158s	125s	+26%
mld_invntt_layer	✅	135s	111s	+22%
sign_verify_internal	✅	70s	47s	+49%
fqmul	⚠️	66s	39s	+69%
polyvecl_chknorm	⚠️	65s	38s	+71%
mld_ntt_layer	✅	57s	44s	+30%
mld_attempt_signature_generation	✅	47s	34s	+38%
poly_ntt_c	⚠️	46s	19s	+142%
mld_ntt_butterfly_block	⚠️	37s	23s	+61%
rej_uniform_c	⚠️	28s	18s	+56%
keccakf1600x4_permute_native	✅	27s	25s	+8%
mld_check_pct	⚠️	23s	15s	+53%
poly_chknorm_c	⚠️	22s	13s	+69%
polyeta_unpack	⚠️	21s	13s	+62%
poly_invntt_tomont_c	⚠️	20s	9s	+122%
polyt0_unpack	✅	19s	14s	+36%
compute_pack_t0_t1	✅	17s	12s	+42%
keccak_absorb_once_x4	✅	17s	8s	+112%
poly_uniform_eta_4x	✅	17s	12s	+42%
polyveck_decompose	✅	17s	12s	+42%
polyvec_matrix_pointwise_montgomery_row	✅	16s	13s	+23%
polyveck_chknorm	✅	15s	9s	+67%
rej_uniform_native_x86_64	✅	15s	-	new
polyvecl_ntt	✅	14s	8s	+75%
polyveck_caddq	✅	13s	8s	+62%
rej_uniform	✅	13s	7s	+86%
poly_decompose_c	✅	12s	6s	+100%
polyz_unpack_c	✅	12s	7s	+71%
polyveck_reduce	✅	11s	6s	+83%
mld_sample_s1_s2	✅	10s	8s	+25%
poly_add	✅	10s	8s	+25%
sign_signature_internal	✅	10s	3s	+233%
pointwise_acc_native_x86_64	✅	9s	8s	+12%
sign_pk_from_sk	✅	9s	6s	+50%
mld_keccakf1600_permute_c	✅	8s	8s	+0%
pointwise_acc_native_aarch64	✅	8s	5s	+60%
poly_reduce	✅	8s	4s	+100%
poly_uniform	✅	8s	4s	+100%
rej_uniform_eta_native_aarch64	✅	8s	3s	+167%
sign_signature_pre_hash_shake256	✅	8s	3s	+167%
keccak_squeezeblocks_x4	✅	7s	4s	+75%
mld_sign_finish	✅	7s	-	new
poly_decompose_native_x86_64	✅	7s	3s	+133%
rej_eta_native	✅	7s	4s	+75%
rej_uniform_native	✅	7s	5s	+40%
sk_s2hat_get_poly	✅	7s	2s	+250%
keccak_absorb	✅	6s	4s	+50%
keccakf1600_xor_bytes (big endian)	✅	6s	2s	+200%
mld_compute_pack_z	✅	6s	6s	+0%
mld_sample_s1_s2_serial	✅	6s	6s	+0%
mld_sign_attempt	✅	6s	-	new
pack_sig_c	✅	6s	2s	+200%
pointwise_native_x86_64	✅	6s	5s	+20%
poly_uniform_gamma1_4x	✅	6s	3s	+100%
polyveck_invntt_tomont	✅	6s	4s	+50%
polyvecl_pointwise_acc_montgomery_c	✅	6s	2s	+200%
polyz_unpack_native	✅	6s	1s	+500%
rej_eta_c	✅	6s	4s	+50%
sign_keypair	✅	6s	4s	+50%
sign_verify	✅	6s	2s	+200%
sign_verify_pre_hash_shake256	✅	6s	7s	-14%
intt_native_aarch64	✅	5s	4s	+25%
keccakf1600x4_permute	✅	5s	2s	+150%
mld_ct_cmask_neg_i32	✅	5s	2s	+150%
mld_keccakf1600_extract_bytes	✅	5s	1s	+400%
poly_caddq_c	✅	5s	3s	+67%
poly_challenge	✅	5s	4s	+25%
poly_chknorm_native	✅	5s	1s	+400%
poly_decompose_32_native_aarch64	✅	5s	3s	+67%
poly_invntt_tomont_native	✅	5s	2s	+150%
poly_power2round	✅	5s	7s	-29%
poly_uniform_eta	✅	5s	5s	+0%
poly_uniform_gamma1	✅	5s	3s	+67%
poly_use_hint_c	✅	5s	4s	+25%
polyt1_pack	✅	5s	5s	+0%
polyvec_matrix_expand	✅	5s	3s	+67%
polyveck_unpack_eta	✅	5s	3s	+67%
polyvecl_pack_eta	✅	5s	2s	+150%
polyvecl_unpack_z	✅	5s	3s	+67%
rej_eta	✅	5s	2s	+150%
shake128_squeeze	✅	5s	1s	+400%
sign_keypair_internal	✅	5s	6s	-17%
sign_signature_extmu	✅	5s	4s	+25%
sign_verify_extmu	✅	5s	4s	+25%
sys_check_capability	✅	5s	2s	+150%
fqscale	✅	4s	1s	+300%
keccak_init	✅	4s	1s	+300%
mld_ct_cmask_nonzero_u32	✅	4s	5s	-20%
mld_ct_get_optblocker_i64	✅	4s	2s	+100%
mld_ct_get_optblocker_u8	✅	4s	3s	+33%
mld_ct_sel_int32	✅	4s	2s	+100%
mld_h	✅	4s	2s	+100%
mld_prepare_domain_separation_prefix	✅	4s	3s	+33%
mld_value_barrier_i64	✅	4s	2s	+100%
poly_caddq_native_aarch64	✅	4s	3s	+33%
poly_chknorm_native_x86_64	✅	4s	2s	+100%
poly_decompose_native	✅	4s	2s	+100%
poly_ntt	✅	4s	2s	+100%
poly_permute_bitrev_to_custom_optional_native	✅	4s	3s	+33%
poly_pointwise_montgomery_native	✅	4s	3s	+33%
poly_shiftl	✅	4s	4s	+0%
poly_uniform_4x	✅	4s	3s	+33%
poly_use_hint	✅	4s	4s	+0%
poly_use_hint_native	✅	4s	1s	+300%
polyt0_pack	✅	4s	3s	+33%
polyvec_matrix_expand_serial	✅	4s	3s	+33%
polyveck_ntt	✅	4s	3s	+33%
polyvecl_pointwise_acc_montgomery	✅	4s	2s	+100%
polyvecl_pointwise_acc_montgomery_native	✅	4s	2s	+100%
polyvecl_uniform_gamma1	✅	4s	3s	+33%
polyvecl_uniform_gamma1_serial	✅	4s	2s	+100%
polyvecl_unpack_eta	✅	4s	3s	+33%
polyw1_pack	✅	4s	2s	+100%
polyw1_pack_32	✅	4s	3s	+33%
polyw1_pack_88	✅	4s	2s	+100%
polyz_pack	✅	4s	4s	+0%
polyz_unpack_17_native_aarch64	✅	4s	4s	+0%
polyz_unpack_19_native_aarch64	✅	4s	5s	-20%
power2round	✅	4s	3s	+33%
reduce32	✅	4s	3s	+33%
shake128_init	✅	4s	2s	+100%
shake256_init	✅	4s	3s	+33%
sig_unpack_hints	✅	4s	4s	+0%
sign_signature	✅	4s	4s	+0%
sign_signature_pre_hash_internal	✅	4s	2s	+100%
sign_verify_pre_hash_internal	✅	4s	3s	+33%
sk_s1hat_get_poly	✅	4s	3s	+33%
sk_t0hat_get_poly	✅	4s	3s	+33%
unpack_pk_t1	✅	4s	2s	+100%
unpack_sk_s1hat	✅	4s	3s	+33%
caddq	✅	3s	3s	+0%
intt_native_x86_64	✅	3s	4s	-25%
keccak_f1600_x1_native_aarch64_v84a	✅	3s	2s	+50%
keccak_f1600_x4_native_avx2	✅	3s	3s	+0%
keccak_squeeze	✅	3s	5s	-40%
keccakf1600_permute	✅	3s	2s	+50%
mld_ct_abs_i32	✅	3s	1s	+200%
mld_ct_cmask_nonzero_u8	✅	3s	2s	+50%
mld_keccakf1600x4_xor_bytes_c	✅	3s	1s	+200%
mld_polymat_expand_entry	✅	3s	4s	-25%
mld_sign_resume	✅	3s	-	new
mld_value_barrier_u32	✅	3s	3s	+0%
mld_value_barrier_u8	✅	3s	2s	+50%
ntt_native_aarch64	✅	3s	4s	-25%
ntt_native_x86_64	✅	3s	2s	+50%
pack_sig_h	✅	3s	3s	+0%
pack_sig_z	✅	3s	3s	+0%
pack_sk_rho_key_tr_s2	✅	3s	2s	+50%
pack_sk_s1	✅	3s	2s	+50%
pointwise_native_aarch64	✅	3s	4s	-25%
poly_caddq	✅	3s	5s	-40%
poly_caddq_native	✅	3s	3s	+0%
poly_chknorm	✅	3s	4s	-25%
poly_chknorm_native_aarch64	✅	3s	5s	-40%
poly_decompose	✅	3s	2s	+50%
poly_invntt_tomont	✅	3s	4s	-25%
poly_ntt_native	✅	3s	4s	-25%
poly_pointwise_montgomery	✅	3s	3s	+0%
poly_sub	✅	3s	5s	-40%
poly_use_hint_native_aarch64	✅	3s	3s	+0%
poly_use_hint_native_x86_64	✅	3s	-	new
polyt1_unpack	✅	3s	3s	+0%
polyveck_pack_eta	✅	3s	5s	-40%
polyveck_pack_w1	✅	3s	3s	+0%
polyz_unpack_native_x86_64	✅	3s	3s	+0%
rej_uniform_native_aarch64	✅	3s	3s	+0%
shake128_absorb	✅	3s	2s	+50%
shake128x4_absorb_once	✅	3s	4s	-25%
shake256	✅	3s	3s	+0%
shake256_finalize	✅	3s	3s	+0%
shake256_squeeze	✅	3s	2s	+50%
shake256x4_absorb_once	✅	3s	5s	-40%
shake256x4_squeezeblocks	✅	3s	4s	-25%
unpack_sk_s2hat	✅	3s	3s	+0%
decompose	✅	2s	2s	+0%
keccak_f1600_x1_native_aarch64	✅	2s	2s	+0%
keccak_f1600_x4_native_aarch64_v84a	✅	2s	1s	+100%
keccakf1600_extract_bytes (big endian)	✅	2s	3s	-33%
keccakf1600_permute_native	✅	2s	3s	-33%
keccakf1600_xor_bytes	✅	2s	1s	+100%
keccakf1600x4_extract_bytes_native	✅	2s	4s	-50%
keccakf1600x4_xor_bytes	✅	2s	1s	+100%
keccakf1600x4_xor_bytes_native	✅	2s	2s	+0%
make_hint	✅	2s	2s	+0%
mld_ct_memcmp	✅	2s	1s	+100%
mld_keccakf1600x4_extract_bytes_c	✅	2s	3s	-33%
montgomery_reduce	✅	2s	2s	+0%
nttunpack_native_x86_64	✅	2s	3s	-33%
poly_caddq_native_x86_64	✅	2s	3s	-33%
poly_decompose_88_native_aarch64	✅	2s	2s	+0%
polyeta_pack	✅	2s	3s	-33%
polyz_unpack	✅	2s	3s	-33%
shake128_finalize	✅	2s	2s	+0%
shake128x4_squeezeblocks	✅	2s	1s	+100%
shake256_release	✅	2s	5s	-60%
unpack_sk	✅	2s	4s	-50%
unpack_sk_t0hat	✅	2s	4s	-50%
use_hint	✅	2s	3s	-33%
yvec_get_poly	✅	2s	2s	+0%
yvec_init	✅	2s	4s	-50%
keccak_f1600_x4_native_aarch64_v8a_scalar_hybrid	✅	1s	2s	-50%
keccak_f1600_x4_native_aarch64_v8a_v84a_scalar_hybrid	✅	1s	2s	-50%
keccak_finalize	✅	1s	1s	+0%
keccakf1600x4_extract_bytes	✅	1s	1s	+0%
mld_ct_get_optblocker_u32	✅	1s	2s	-50%
poly_permute_bitrev_to_custom_optional	✅	1s	2s	-50%
shake128_release	✅	1s	3s	-67%
shake256_absorb	✅	1s	3s	-67%

[mkannwischer]

Thanks @hanno-becker. I have done a design review for now and have some questions - a full review will follow later.

Could you elaborate why you went for hooks to implement this approach rather than adding a _restartable() API that gets a context argument?

It would be good to add an example of how the new hooks can be used. We'll also need to add documentation.

[mkannwischer]

What is mld_sign_finish needed for? It looks like the same information is passed to the last mld_sign_attempt

[hanno-becker]

It's for ease of use and a symmetric API. For example, if you only care about pairing your benchmarks with information of how many signing attempts were performanced, finish gives you that information most directly.

But you are right, in theory one can get away without it. I'd prefer not to.

[hanno-becker]

Could you elaborate why you went for hooks to implement this approach rather than adding a _restartable() API that gets a context argument?

Hooks are more flexible and less work for us. The details of how to build a restartable API on top of them are left to the user -- by design. For example, you'd probably also want randomized signing to be restartable; that's something you can easily build yourself. If, on the other hand, we were to do it ourselves, we'd have to define some kind of restart context, which then clashes with the customer's context and is also hard to keep stable if we introduce, say, structured keys. The hooks are the core mechanism.

And the hooks are useful for statistics and benchmarking too, not just for restartability.

[hanno-becker]

It would be good to add an example of how the new hooks can be used. We'll also need to add documentation.

What documentation do you want, beyond the extensive one in mldsa_native_config.h?

I can add an example. Added an example.

[mkannwischer]

Thanks @hanno-becker for all the work!
Found a few small issues - otherwise I'm very happy with this feature!
Zephyr CI is having some issues, could you fix that?

What documentation do you want, beyond the extensive one in mldsa_native_config.h?

Maybe a paragraph in the root README like we have for DMLD_CONFIG_REDUCE_RAM? We may want to revisit the README before v1 anyway though.

[mkannwischer]

Shall we mark the feature as experimental allowing us to still tweak it after v1 is out?

[mkannwischer]

We need to include stdint.h ... this only works out of luck.
(but the int32_t casts would fail if we would be out of luck)

[mkannwischer]

This never gets executed in CI if I see correctly. Should we add a separate job for it?

[hanno-becker]

This is a good point. I'll switch to 2000 iterations by default at a 10% interval (according to Claude, covering >99.999% of the cases), as well as a single 100k iteration run with a narrower band.

[mkannwischer]

This may read confusing to the reader.
If the default is chosen such that the failure probability is < 2^{-256}, you would use the NIST bound of 814.

[hanno-becker]

Any bound >= 814 has that probability. I deliberately omitted the specific value here because I felt it's irrelevant to the user. But point taken, if you're confused, so will be others. I'll reconsider.

[hanno-becker]

I'll just drop "The default is chosen so that the failure probability is * < 2^{-256}, that is, signatures will practically always succeed." here.

[mkannwischer]

Do we still need MLD_CONFIG_MAX_SIGNING_ATTEMPTS? May be worth removing to reduce complexity for v1.

[hanno-becker]

One could emulate this using an attempt-hook, if we gave the attempt-hook the possibility to inject a failure, not just a pause. But I think the added complexity of this approach -- both on our side, and on the user's side -- outweighs the benefit of removing this option.

One could consider defaulting to 814, but that's slightly odd seeing FIPS204 says one "SHOULD NOT" do this.

Setting this to 814 is quite natural, IMO, to improve observability in case of a faulty implementation looping; esp. on low-end systems.

Altogether, I prefer leaving this option.

[mkannwischer]

I'm not in favor of defaulting to 814 due to the SHOULD NOT.
Still I don't see why any consumer would set MLD_CONFIG_MAX_SIGNING_ATTEMPTS to anything other than 814 or the max value.

What do you think about making it a binary option to use 814 instead of the default?

[hanno-becker]

I'm in favor of keeping it as it is. It gives the consumer more flexibility, if only for testing purposes, without making things any more difficult on our end.

[mkannwischer]

keypair and keypair_internal can now also return MLD_ERR_SIGNING_PAUSED in case PCT and HOOK_ATTEMPT is configured. That should be documented.

[hanno-becker]

No, that's not allowed -- there would be no way to restart the PCT. The combination of hooks and PCT is checked for.

[mkannwischer]

Can you please double check this? The way I read the config (+ config validation) is that PCT is incompatible with RESUME, but not with ATTEMPT. Am I getting something wrong here?

[hanno-becker]

You spotted a real issue there, thank you. Initially, attempt couldn't signal pause (pause was handled via MAX_SIGNING_ATTEMPTS), in which case it was safe to use with PCT. Now, it is indeed ATTEMPT which cannot be used with PCT, while RESUME and FINISH, in theory, could.