Add signing hooks for observing signature attempts and implementing restartable signing

[hanno-becker]

• Based on common: Split context-parameter machinery into context.h #1238

sign: Add configurable signing hooks (resume/attempt/finish)

The runtime of ML-DSA signatures is theoretically unbounded. Even the
bound of max 814 signature attempts -- approved by NIST as lowering the
chance of signing failure below 2^{-256} -- leaves a performance
distribution whose peak percentiles can be unacceptable for constrained
systems with strict timing requirements.

The library already provides MLD_CONFIG_MAX_SIGNING_ATTEMPTS to cap the
number of signing attempts. However, FIPS 204 forbids lowering that bound
below 814, rendering the option non-compliant in constrained environments.

As a remedy, this commit introduces three optional 'signing hooks' around
the core rejection-sampling loop, keyed by the attempt counter (the loop
iteration; the spec counter is kappa = attempt*MLDSA_L):

- `attempt = sign_resume()`: Return the attempt to resume the operation
  from. `0` for an initial / non-restartable signing operation.
- `sign_attempt(attempt)`: Called before each attempt. Returns 0 to
  proceed, or non-zero to pause: signing then returns MLD_ERR_SIGNING_PAUSED
  with `attempt` as the resume point.
- `sign_finish(attempt)`: Called on success with the succeeding attempt.

Together, resume + attempt make signing _restartable_: a caller can pause
after a bounded number of attempts and later resume from the recorded
attempt, bounding per-call runtime while keeping a FIPS-compliant overall
bound and reproducing the same signature as an uninterrupted run.

This only works if the consumer drives the deterministic internal API: the
randomized API would choose a fresh seed on each (re-)start, so the resume
hook requires MLD_CONFIG_NO_RANDOMIZED_API and is incompatible with
MLD_CONFIG_KEYGEN_PCT (whose one-shot internal signature cannot be resumed).
The attempt and finish hooks also serve standalone uses with any API, e.g.
logging or benchmarking the per-signature attempt distribution.

Pausing is independent of MLD_CONFIG_MAX_SIGNING_ATTEMPTS, the upper bound on
the total number of attempts (>= 814 for FIPS 204 compliance) after which
signing gives up with the distinct error MLD_ERR_SIGN_ATTEMPTS_EXHAUSTED; it
must not be lowered as a restart mechanism.

sign_{resume|attempt|finish} can be implemented on mutable globals or on a
context, so they are introduced under the existing MLD_CONFIG_CONTEXT_PARAMETER
wrapper, which lets functions be called with or without an
application-specific context pointer.

Concretely, this commit:

- Adds independent MLD_CONFIG_SIGN_HOOK_{RESUME,ATTEMPT,FINISH} options. When
  set, the integration provides, respectively:

  - `attempt = mld_sign_hook_resume([ctx])`: provide initial/resume attempt
  - `mld_sign_hook_attempt(attempt [, ctx])`: per-attempt hook; pause via
    non-zero return
  - `mld_sign_hook_finish(attempt [, ctx])`: note the succeeding attempt

  The unset dummies leave the default build (and its proofs) unchanged.

- Adds the MLD_ERR_SIGNING_PAUSED error code returned when the attempt hook
  pauses signing.

- Adds CBMC proofs for the three hooks and threads them through the existing
  signing proofs.

- Adds test/src/test_sign_hook.c (a new `sign_hook` test), which checks that
  restartable signing -- single-step and with random attempts-per-call --
  reproduces one-shot signing exactly, and gathers an attempts-per-signature
  distribution that it checks against the expected geometric mean per
  parameter set.

[oqs-bot]

CBMC Results (ML-DSA-44, REDUCE-RAM)

Full Results (208 proofs)

Proof	Status	Current	Previous	Change
**TOTAL**	✅	1367s	1364s	+0.2%
polyvec_matrix_pointwise_montgomery_yvec	✅	147s	149s	-1%
poly_pointwise_montgomery_c	✅	109s	112s	-3%
mld_invntt_layer	✅	108s	105s	+3%
polyveck_chknorm	✅	64s	67s	-4%
sign_verify_internal	✅	51s	49s	+4%
mld_ntt_layer	✅	43s	41s	+5%
fqmul	✅	39s	39s	+0%
keccakf1600x4_permute_native	✅	22s	22s	+0%
poly_ntt_c	✅	21s	21s	+0%
mld_ntt_butterfly_block	✅	19s	23s	-17%
mld_attempt_signature_generation	✅	18s	19s	-5%
rej_uniform_c	✅	16s	16s	+0%
compute_pack_t0_t1	✅	15s	12s	+25%
polyeta_unpack	✅	14s	14s	+0%
mld_check_pct	✅	13s	15s	-13%
poly_chknorm_c	✅	13s	11s	+18%
poly_invntt_tomont_c	✅	11s	11s	+0%
poly_uniform_eta_4x	✅	11s	12s	-8%
polyt0_unpack	✅	11s	12s	-8%
polyvecl_chknorm	✅	11s	11s	+0%
keccak_absorb_once_x4	✅	9s	8s	+12%
mld_compute_pack_z	✅	8s	6s	+33%
poly_decompose_c	✅	8s	5s	+60%
poly_add	✅	7s	7s	+0%
poly_uniform	✅	7s	3s	+133%
polyveck_decompose	✅	7s	7s	+0%
mld_keccakf1600_permute_c	✅	6s	7s	-14%
ntt_native_x86_64	✅	6s	3s	+100%
pointwise_acc_native_x86_64	✅	6s	4s	+50%
polyveck_reduce	✅	6s	4s	+50%
polyz_unpack_19_native_aarch64	✅	6s	4s	+50%
polyz_unpack_c	✅	6s	8s	-25%
rej_uniform	✅	6s	8s	-25%
sign_keypair	✅	6s	5s	+20%
mld_ct_get_optblocker_i64	✅	5s	4s	+25%
mld_h	✅	5s	4s	+25%
mld_sample_s1_s2	✅	5s	1s	+400%
mld_sample_s1_s2_serial	✅	5s	4s	+25%
mld_sign_finish	✅	5s	-	new
mld_sign_resume	✅	5s	-	new
pack_sig_z	✅	5s	2s	+150%
poly_challenge	✅	5s	6s	-17%
poly_chknorm_native	✅	5s	4s	+25%
poly_invntt_tomont	✅	5s	2s	+150%
poly_reduce	✅	5s	4s	+25%
poly_shiftl	✅	5s	4s	+25%
polyvec_matrix_pointwise_montgomery_row	✅	5s	6s	-17%
polyveck_caddq	✅	5s	3s	+67%
rej_eta_native	✅	5s	3s	+67%
rej_uniform_native	✅	5s	5s	+0%
sign_signature_pre_hash_shake256	✅	5s	4s	+25%
sign_verify	✅	5s	4s	+25%
unpack_pk_t1	✅	5s	3s	+67%
unpack_sk_t0hat	✅	5s	2s	+150%
decompose	✅	4s	3s	+33%
intt_native_aarch64	✅	4s	3s	+33%
keccak_f1600_x4_native_aarch64_v8a_v84a_scalar_hybrid	✅	4s	3s	+33%
mld_keccakf1600x4_extract_bytes_c	✅	4s	4s	+0%
mld_keccakf1600x4_xor_bytes_c	✅	4s	4s	+0%
mld_value_barrier_i64	✅	4s	3s	+33%
pack_sig_h	✅	4s	4s	+0%
pack_sk_s1	✅	4s	3s	+33%
pointwise_acc_native_aarch64	✅	4s	6s	-33%
pointwise_native_x86_64	✅	4s	4s	+0%
poly_caddq_c	✅	4s	3s	+33%
poly_chknorm_native_x86_64	✅	4s	2s	+100%
poly_decompose	✅	4s	2s	+100%
poly_permute_bitrev_to_custom_optional	✅	4s	5s	-20%
poly_power2round	✅	4s	4s	+0%
poly_use_hint	✅	4s	2s	+100%
polyveck_invntt_tomont	✅	4s	5s	-20%
polyvecl_ntt	✅	4s	3s	+33%
polyvecl_pointwise_acc_montgomery_native	✅	4s	3s	+33%
polyvecl_uniform_gamma1	✅	4s	2s	+100%
polyw1_pack	✅	4s	4s	+0%
polyw1_pack_32	✅	4s	3s	+33%
polyw1_pack_88	✅	4s	2s	+100%
polyz_unpack_17_native_aarch64	✅	4s	2s	+100%
polyz_unpack_native	✅	4s	3s	+33%
power2round	✅	4s	2s	+100%
rej_eta_c	✅	4s	4s	+0%
sign_pk_from_sk	✅	4s	5s	-20%
sign_signature_internal	✅	4s	4s	+0%
sign_verify_extmu	✅	4s	5s	-20%
sign_verify_pre_hash_internal	✅	4s	5s	-20%
yvec_init	✅	4s	1s	+300%
caddq	✅	3s	6s	-50%
fqscale	✅	3s	2s	+50%
intt_native_x86_64	✅	3s	2s	+50%
keccak_absorb	✅	3s	3s	+0%
keccak_f1600_x1_native_aarch64_v84a	✅	3s	2s	+50%
keccak_f1600_x4_native_aarch64_v8a_scalar_hybrid	✅	3s	2s	+50%
keccak_finalize	✅	3s	2s	+50%
keccak_init	✅	3s	3s	+0%
keccak_squeezeblocks_x4	✅	3s	3s	+0%
keccakf1600_permute	✅	3s	2s	+50%
keccakf1600_xor_bytes	✅	3s	3s	+0%
keccakf1600x4_permute	✅	3s	4s	-25%
mld_ct_abs_i32	✅	3s	3s	+0%
mld_ct_cmask_nonzero_u8	✅	3s	2s	+50%
mld_prepare_domain_separation_prefix	✅	3s	3s	+0%
mld_sign_attempt	✅	3s	-	new
mld_value_barrier_u32	✅	3s	1s	+200%
mld_value_barrier_u8	✅	3s	4s	-25%
nttunpack_native_x86_64	✅	3s	4s	-25%
pack_sk_rho_key_tr_s2	✅	3s	5s	-40%
pointwise_native_aarch64	✅	3s	2s	+50%
poly_caddq	✅	3s	4s	-25%
poly_caddq_native	✅	3s	3s	+0%
poly_caddq_native_x86_64	✅	3s	4s	-25%
poly_chknorm_native_aarch64	✅	3s	2s	+50%
poly_decompose_32_native_aarch64	✅	3s	4s	-25%
poly_decompose_88_native_aarch64	✅	3s	3s	+0%
poly_decompose_native	✅	3s	2s	+50%
poly_ntt	✅	3s	3s	+0%
poly_permute_bitrev_to_custom_optional_native	✅	3s	3s	+0%
poly_uniform_4x	✅	3s	3s	+0%
poly_uniform_eta	✅	3s	2s	+50%
poly_use_hint_c	✅	3s	5s	-40%
poly_use_hint_native_aarch64	✅	3s	3s	+0%
polyeta_pack	✅	3s	3s	+0%
polyt0_pack	✅	3s	4s	-25%
polyt1_unpack	✅	3s	2s	+50%
polyveck_ntt	✅	3s	2s	+50%
polyveck_pack_eta	✅	3s	4s	-25%
polyvecl_pack_eta	✅	3s	2s	+50%
polyvecl_uniform_gamma1_serial	✅	3s	2s	+50%
polyvecl_unpack_eta	✅	3s	4s	-25%
reduce32	✅	3s	3s	+0%
rej_eta	✅	3s	5s	-40%
rej_uniform_eta_native_aarch64	✅	3s	3s	+0%
shake128_finalize	✅	3s	3s	+0%
shake128x4_absorb_once	✅	3s	2s	+50%
shake128x4_squeezeblocks	✅	3s	2s	+50%
shake256_finalize	✅	3s	2s	+50%
shake256_init	✅	3s	4s	-25%
shake256x4_absorb_once	✅	3s	1s	+200%
sign_signature	✅	3s	6s	-50%
sk_s1hat_get_poly	✅	3s	2s	+50%
unpack_sk	✅	3s	3s	+0%
unpack_sk_s1hat	✅	3s	3s	+0%
unpack_sk_s2hat	✅	3s	4s	-25%
use_hint	✅	3s	2s	+50%
keccak_f1600_x1_native_aarch64	✅	2s	3s	-33%
keccak_f1600_x4_native_aarch64_v84a	✅	2s	3s	-33%
keccak_f1600_x4_native_avx2	✅	2s	2s	+0%
keccak_squeeze	✅	2s	2s	+0%
keccakf1600_extract_bytes (big endian)	✅	2s	4s	-50%
keccakf1600_permute_native	✅	2s	3s	-33%
keccakf1600x4_extract_bytes	✅	2s	2s	+0%
keccakf1600x4_extract_bytes_native	✅	2s	4s	-50%
make_hint	✅	2s	3s	-33%
mld_ct_cmask_neg_i32	✅	2s	2s	+0%
mld_ct_cmask_nonzero_u32	✅	2s	3s	-33%
mld_ct_get_optblocker_u32	✅	2s	2s	+0%
mld_ct_memcmp	✅	2s	1s	+100%
mld_keccakf1600_extract_bytes	✅	2s	2s	+0%
mld_polymat_expand_entry	✅	2s	2s	+0%
montgomery_reduce	✅	2s	2s	+0%
ntt_native_aarch64	✅	2s	4s	-50%
pack_sig_c	✅	2s	5s	-60%
poly_caddq_native_aarch64	✅	2s	3s	-33%
poly_chknorm	✅	2s	3s	-33%
poly_decompose_native_x86_64	✅	2s	2s	+0%
poly_invntt_tomont_native	✅	2s	3s	-33%
poly_ntt_native	✅	2s	3s	-33%
poly_pointwise_montgomery	✅	2s	3s	-33%
poly_pointwise_montgomery_native	✅	2s	2s	+0%
poly_sub	✅	2s	3s	-33%
poly_uniform_gamma1	✅	2s	3s	-33%
poly_use_hint_native	✅	2s	3s	-33%
poly_use_hint_native_x86_64	✅	2s	-	new
polyt1_pack	✅	2s	3s	-33%
polyvec_matrix_expand	✅	2s	3s	-33%
polyvec_matrix_expand_serial	✅	2s	4s	-50%
polyveck_pack_w1	✅	2s	3s	-33%
polyveck_unpack_eta	✅	2s	2s	+0%
polyvecl_pointwise_acc_montgomery_c	✅	2s	4s	-50%
polyvecl_unpack_z	✅	2s	3s	-33%
polyz_unpack_native_x86_64	✅	2s	3s	-33%
rej_uniform_native_aarch64	✅	2s	3s	-33%
shake128_init	✅	2s	2s	+0%
shake128_release	✅	2s	2s	+0%
shake256	✅	2s	1s	+100%
shake256_release	✅	2s	1s	+100%
shake256_squeeze	✅	2s	2s	+0%
shake256x4_squeezeblocks	✅	2s	2s	+0%
sig_unpack_hints	✅	2s	2s	+0%
sign_keypair_internal	✅	2s	4s	-50%
sign_signature_extmu	✅	2s	4s	-50%
sign_signature_pre_hash_internal	✅	2s	4s	-50%
sign_verify_pre_hash_shake256	✅	2s	5s	-60%
sk_s2hat_get_poly	✅	2s	5s	-60%
sk_t0hat_get_poly	✅	2s	1s	+100%
sys_check_capability	✅	2s	2s	+0%
yvec_get_poly	✅	2s	3s	-33%
keccakf1600_xor_bytes (big endian)	✅	1s	6s	-83%
keccakf1600x4_xor_bytes	✅	1s	3s	-67%
keccakf1600x4_xor_bytes_native	✅	1s	5s	-80%
mld_ct_get_optblocker_u8	✅	1s	2s	-50%
mld_ct_sel_int32	✅	1s	3s	-67%
poly_uniform_gamma1_4x	✅	1s	5s	-80%
polyvecl_pointwise_acc_montgomery	✅	1s	3s	-67%
polyz_pack	✅	1s	2s	-50%
polyz_unpack	✅	1s	3s	-67%
shake128_absorb	✅	1s	3s	-67%
shake128_squeeze	✅	1s	2s	-50%
shake256_absorb	✅	1s	2s	-50%

[oqs-bot]

CBMC Results (ML-DSA-65)

Full Results (208 proofs)

Proof	Status	Current	Previous	Change
**TOTAL**	✅	1782s	1784s	-0.1%
polyvecl_pointwise_acc_montgomery_c	✅	208s	210s	-1%
sign_verify_internal	✅	169s	177s	-5%
poly_pointwise_montgomery_c	✅	122s	125s	-2%
polyvec_matrix_expand	✅	107s	110s	-3%
mld_invntt_layer	✅	100s	109s	-8%
mld_attempt_signature_generation	✅	64s	63s	+2%
sign_signature_internal	✅	62s	55s	+13%
mld_ntt_layer	✅	41s	41s	+0%
fqmul	✅	39s	40s	-3%
polyvec_matrix_expand_serial	✅	29s	27s	+7%
keccakf1600x4_permute_native	✅	24s	23s	+4%
mld_ntt_butterfly_block	✅	22s	24s	-8%
polyvec_matrix_pointwise_montgomery_yvec	✅	18s	18s	+0%
mld_check_pct	✅	17s	14s	+21%
poly_ntt_c	✅	17s	19s	-11%
rej_uniform_c	✅	15s	14s	+7%
compute_pack_t0_t1	✅	14s	13s	+8%
poly_chknorm_c	✅	14s	15s	-7%
polyveck_decompose	✅	14s	12s	+17%
poly_uniform_4x	✅	13s	13s	+0%
polyt0_unpack	✅	13s	16s	-19%
rej_uniform	✅	13s	18s	-28%
polyz_unpack_c	✅	12s	13s	-8%
poly_invntt_tomont_c	✅	10s	11s	-9%
poly_uniform_eta_4x	✅	10s	14s	-29%
keccak_absorb_once_x4	✅	9s	8s	+12%
mld_compute_pack_z	✅	9s	7s	+29%
polyveck_invntt_tomont	✅	8s	8s	+0%
polyvecl_chknorm	✅	8s	7s	+14%
poly_add	✅	7s	9s	-22%
poly_decompose_c	✅	7s	5s	+40%
polyveck_chknorm	✅	7s	6s	+17%
polyveck_ntt	✅	7s	7s	+0%
rej_uniform_native	✅	7s	4s	+75%
keccakf1600x4_extract_bytes	✅	6s	4s	+50%
mld_sample_s1_s2_serial	✅	6s	4s	+50%
poly_use_hint_c	✅	6s	5s	+20%
polyeta_unpack	✅	6s	8s	-25%
polyveck_unpack_eta	✅	6s	6s	+0%
polyvecl_ntt	✅	6s	4s	+50%
sign_keypair	✅	6s	3s	+100%
keccak_absorb	✅	5s	3s	+67%
make_hint	✅	5s	2s	+150%
mld_keccakf1600_permute_c	✅	5s	6s	-17%
mld_polymat_expand_entry	✅	5s	4s	+25%
pointwise_acc_native_x86_64	✅	5s	8s	-38%
poly_challenge	✅	5s	6s	-17%
poly_decompose	✅	5s	2s	+150%
poly_decompose_native_x86_64	✅	5s	3s	+67%
poly_uniform_gamma1_4x	✅	5s	4s	+25%
polyt0_pack	✅	5s	3s	+67%
polyt1_unpack	✅	5s	5s	+0%
polyveck_caddq	✅	5s	6s	-17%
polyvecl_pointwise_acc_montgomery_native	✅	5s	2s	+150%
shake128_init	✅	5s	2s	+150%
sign_keypair_internal	✅	5s	5s	+0%
sign_pk_from_sk	✅	5s	6s	-17%
sign_verify_pre_hash_shake256	✅	5s	5s	+0%
unpack_sk_s1hat	✅	5s	2s	+150%
unpack_sk_t0hat	✅	5s	5s	+0%
caddq	✅	4s	3s	+33%
intt_native_aarch64	✅	4s	3s	+33%
keccakf1600_permute	✅	4s	2s	+100%
keccakf1600x4_permute	✅	4s	4s	+0%
mld_h	✅	4s	2s	+100%
mld_sample_s1_s2	✅	4s	6s	-33%
mld_sign_attempt	✅	4s	-	new
mld_sign_resume	✅	4s	-	new
pack_sk_rho_key_tr_s2	✅	4s	2s	+100%
pointwise_acc_native_aarch64	✅	4s	6s	-33%
pointwise_native_x86_64	✅	4s	3s	+33%
poly_caddq	✅	4s	2s	+100%
poly_caddq_c	✅	4s	2s	+100%
poly_caddq_native	✅	4s	2s	+100%
poly_caddq_native_x86_64	✅	4s	3s	+33%
poly_decompose_native	✅	4s	3s	+33%
poly_invntt_tomont	✅	4s	3s	+33%
poly_invntt_tomont_native	✅	4s	2s	+100%
poly_ntt	✅	4s	2s	+100%
poly_power2round	✅	4s	4s	+0%
poly_shiftl	✅	4s	3s	+33%
poly_uniform	✅	4s	4s	+0%
poly_uniform_gamma1	✅	4s	3s	+33%
poly_use_hint_native	✅	4s	2s	+100%
poly_use_hint_native_aarch64	✅	4s	3s	+33%
polyvecl_pointwise_acc_montgomery	✅	4s	3s	+33%
polyvecl_unpack_z	✅	4s	3s	+33%
polyw1_pack_88	✅	4s	2s	+100%
polyz_unpack_native	✅	4s	4s	+0%
polyz_unpack_native_x86_64	✅	4s	3s	+33%
rej_eta_native	✅	4s	3s	+33%
shake128_absorb	✅	4s	2s	+100%
sig_unpack_hints	✅	4s	2s	+100%
sign_signature_extmu	✅	4s	2s	+100%
sign_signature_pre_hash_shake256	✅	4s	3s	+33%
sign_verify	✅	4s	3s	+33%
sign_verify_pre_hash_internal	✅	4s	5s	-20%
unpack_sk	✅	4s	3s	+33%
decompose	✅	3s	1s	+200%
fqscale	✅	3s	3s	+0%
intt_native_x86_64	✅	3s	3s	+0%
keccak_f1600_x1_native_aarch64	✅	3s	2s	+50%
keccak_f1600_x1_native_aarch64_v84a	✅	3s	3s	+0%
keccak_f1600_x4_native_aarch64_v8a_scalar_hybrid	✅	3s	2s	+50%
keccak_finalize	✅	3s	2s	+50%
keccak_squeeze	✅	3s	4s	-25%
keccak_squeezeblocks_x4	✅	3s	5s	-40%
mld_ct_cmask_nonzero_u8	✅	3s	3s	+0%
mld_ct_get_optblocker_u8	✅	3s	2s	+50%
mld_ct_sel_int32	✅	3s	3s	+0%
mld_value_barrier_i64	✅	3s	2s	+50%
mld_value_barrier_u8	✅	3s	3s	+0%
pack_sig_c	✅	3s	5s	-40%
pack_sig_h	✅	3s	5s	-40%
pack_sig_z	✅	3s	2s	+50%
poly_chknorm	✅	3s	4s	-25%
poly_chknorm_native	✅	3s	2s	+50%
poly_chknorm_native_aarch64	✅	3s	3s	+0%
poly_chknorm_native_x86_64	✅	3s	3s	+0%
poly_decompose_32_native_aarch64	✅	3s	3s	+0%
poly_decompose_88_native_aarch64	✅	3s	1s	+200%
poly_permute_bitrev_to_custom_optional_native	✅	3s	4s	-25%
poly_pointwise_montgomery_native	✅	3s	3s	+0%
poly_reduce	✅	3s	3s	+0%
poly_sub	✅	3s	3s	+0%
poly_uniform_eta	✅	3s	4s	-25%
polyeta_pack	✅	3s	3s	+0%
polyvec_matrix_pointwise_montgomery_row	✅	3s	1s	+200%
polyveck_pack_w1	✅	3s	3s	+0%
polyvecl_pack_eta	✅	3s	3s	+0%
polyvecl_uniform_gamma1	✅	3s	2s	+50%
polyw1_pack_32	✅	3s	4s	-25%
polyz_unpack_19_native_aarch64	✅	3s	3s	+0%
power2round	✅	3s	1s	+200%
rej_eta	✅	3s	2s	+50%
rej_eta_c	✅	3s	5s	-40%
rej_uniform_eta_native_aarch64	✅	3s	4s	-25%
rej_uniform_native_aarch64	✅	3s	3s	+0%
shake128_finalize	✅	3s	1s	+200%
shake128x4_squeezeblocks	✅	3s	3s	+0%
shake256_finalize	✅	3s	1s	+200%
shake256_squeeze	✅	3s	3s	+0%
sign_signature	✅	3s	6s	-50%
sign_signature_pre_hash_internal	✅	3s	3s	+0%
sk_s1hat_get_poly	✅	3s	6s	-50%
sk_s2hat_get_poly	✅	3s	2s	+50%
unpack_pk_t1	✅	3s	5s	-40%
unpack_sk_s2hat	✅	3s	4s	-25%
keccak_init	✅	2s	1s	+100%
keccakf1600_permute_native	✅	2s	3s	-33%
keccakf1600_xor_bytes	✅	2s	2s	+0%
keccakf1600_xor_bytes (big endian)	✅	2s	2s	+0%
keccakf1600x4_extract_bytes_native	✅	2s	4s	-50%
keccakf1600x4_xor_bytes	✅	2s	1s	+100%
keccakf1600x4_xor_bytes_native	✅	2s	3s	-33%
mld_ct_abs_i32	✅	2s	2s	+0%
mld_ct_get_optblocker_i64	✅	2s	2s	+0%
mld_ct_get_optblocker_u32	✅	2s	3s	-33%
mld_ct_memcmp	✅	2s	2s	+0%
mld_keccakf1600_extract_bytes	✅	2s	1s	+100%
mld_keccakf1600x4_extract_bytes_c	✅	2s	3s	-33%
mld_prepare_domain_separation_prefix	✅	2s	2s	+0%
mld_sign_finish	✅	2s	-	new
mld_value_barrier_u32	✅	2s	3s	-33%
montgomery_reduce	✅	2s	4s	-50%
ntt_native_aarch64	✅	2s	2s	+0%
ntt_native_x86_64	✅	2s	2s	+0%
nttunpack_native_x86_64	✅	2s	3s	-33%
pack_sk_s1	✅	2s	5s	-60%
pointwise_native_aarch64	✅	2s	5s	-60%
poly_caddq_native_aarch64	✅	2s	2s	+0%
poly_ntt_native	✅	2s	4s	-50%
poly_permute_bitrev_to_custom_optional	✅	2s	2s	+0%
poly_use_hint	✅	2s	3s	-33%
poly_use_hint_native_x86_64	✅	2s	-	new
polyt1_pack	✅	2s	3s	-33%
polyveck_pack_eta	✅	2s	4s	-50%
polyveck_reduce	✅	2s	4s	-50%
polyvecl_uniform_gamma1_serial	✅	2s	3s	-33%
polyvecl_unpack_eta	✅	2s	3s	-33%
polyz_pack	✅	2s	3s	-33%
polyz_unpack_17_native_aarch64	✅	2s	3s	-33%
reduce32	✅	2s	3s	-33%
shake128_squeeze	✅	2s	2s	+0%
shake128x4_absorb_once	✅	2s	3s	-33%
shake256	✅	2s	2s	+0%
shake256_absorb	✅	2s	2s	+0%
shake256_release	✅	2s	2s	+0%
shake256x4_absorb_once	✅	2s	3s	-33%
shake256x4_squeezeblocks	✅	2s	2s	+0%
sign_verify_extmu	✅	2s	3s	-33%
sk_t0hat_get_poly	✅	2s	2s	+0%
use_hint	✅	2s	2s	+0%
yvec_get_poly	✅	2s	3s	-33%
yvec_init	✅	2s	3s	-33%
keccak_f1600_x4_native_aarch64_v84a	✅	1s	4s	-75%
keccak_f1600_x4_native_aarch64_v8a_v84a_scalar_hybrid	✅	1s	2s	-50%
keccak_f1600_x4_native_avx2	✅	1s	2s	-50%
keccakf1600_extract_bytes (big endian)	✅	1s	2s	-50%
mld_ct_cmask_neg_i32	✅	1s	2s	-50%
mld_ct_cmask_nonzero_u32	✅	1s	4s	-75%
mld_keccakf1600x4_xor_bytes_c	✅	1s	2s	-50%
poly_pointwise_montgomery	✅	1s	3s	-67%
polyw1_pack	✅	1s	4s	-75%
polyz_unpack	✅	1s	3s	-67%
shake128_release	✅	1s	3s	-67%
shake256_init	✅	1s	2s	-50%
sys_check_capability	✅	1s	4s	-75%

[oqs-bot]

CBMC Results (ML-DSA-44)

Full Results (208 proofs)

Proof	Status	Current	Previous	Change
**TOTAL**	✅	1694s	1514s	+11.9%
polyvecl_pointwise_acc_montgomery_c	✅	166s	131s	+27%
poly_pointwise_montgomery_c	✅	144s	114s	+26%
sign_verify_internal	✅	125s	114s	+10%
mld_invntt_layer	✅	121s	107s	+13%
mld_attempt_signature_generation	✅	63s	58s	+9%
compute_pack_t0_t1	✅	51s	50s	+2%
mld_ntt_layer	✅	44s	42s	+5%
fqmul	✅	43s	39s	+10%
polyvec_matrix_expand	✅	30s	28s	+7%
sign_signature_internal	✅	29s	26s	+12%
mld_ntt_butterfly_block	✅	23s	23s	+0%
poly_ntt_c	✅	23s	19s	+21%
keccakf1600x4_permute_native	✅	22s	22s	+0%
rej_uniform	✅	19s	18s	+6%
polyt0_unpack	✅	17s	15s	+13%
polyvec_matrix_pointwise_montgomery_yvec	✅	17s	15s	+13%
poly_chknorm_c	✅	16s	17s	-6%
poly_uniform_4x	✅	15s	14s	+7%
polyeta_unpack	✅	15s	14s	+7%
rej_uniform_c	✅	15s	15s	+0%
poly_invntt_tomont_c	✅	13s	11s	+18%
poly_uniform_eta_4x	✅	12s	11s	+9%
mld_check_pct	✅	11s	14s	-21%
polyz_unpack_c	✅	11s	11s	+0%
keccak_absorb_once_x4	✅	10s	9s	+11%
polyvec_matrix_expand_serial	✅	10s	8s	+25%
polyvecl_chknorm	✅	10s	10s	+0%
mld_compute_pack_z	✅	8s	7s	+14%
pointwise_acc_native_x86_64	✅	8s	7s	+14%
mld_keccakf1600_permute_c	✅	7s	8s	-12%
mld_sample_s1_s2	✅	7s	4s	+75%
pointwise_acc_native_aarch64	✅	7s	4s	+75%
poly_add	✅	7s	7s	+0%
sign_signature	✅	7s	3s	+133%
sign_signature_pre_hash_internal	✅	7s	6s	+17%
poly_chknorm_native_aarch64	✅	6s	4s	+50%
polyveck_invntt_tomont	✅	6s	5s	+20%
sign_verify	✅	6s	4s	+50%
keccak_squeezeblocks_x4	✅	5s	4s	+25%
mld_ct_sel_int32	✅	5s	2s	+150%
mld_prepare_domain_separation_prefix	✅	5s	4s	+25%
mld_sample_s1_s2_serial	✅	5s	3s	+67%
mld_sign_resume	✅	5s	-	new
pack_sig_c	✅	5s	2s	+150%
poly_caddq	✅	5s	2s	+150%
poly_challenge	✅	5s	3s	+67%
poly_decompose_c	✅	5s	4s	+25%
poly_permute_bitrev_to_custom_optional_native	✅	5s	4s	+25%
poly_shiftl	✅	5s	3s	+67%
poly_uniform_gamma1_4x	✅	5s	5s	+0%
poly_use_hint_native_x86_64	✅	5s	-	new
polyt0_pack	✅	5s	2s	+150%
polyt1_unpack	✅	5s	5s	+0%
polyveck_decompose	✅	5s	4s	+25%
polyveck_ntt	✅	5s	5s	+0%
polyvecl_pack_eta	✅	5s	3s	+67%
polyw1_pack_32	✅	5s	2s	+150%
rej_eta_native	✅	5s	6s	-17%
rej_uniform_native	✅	5s	4s	+25%
shake256_absorb	✅	5s	3s	+67%
sign_keypair_internal	✅	5s	4s	+25%
sign_signature_extmu	✅	5s	4s	+25%
use_hint	✅	5s	2s	+150%
decompose	✅	4s	2s	+100%
keccak_finalize	✅	4s	3s	+33%
keccakf1600_extract_bytes (big endian)	✅	4s	2s	+100%
keccakf1600_permute	✅	4s	2s	+100%
keccakf1600_xor_bytes	✅	4s	1s	+300%
keccakf1600_xor_bytes (big endian)	✅	4s	4s	+0%
keccakf1600x4_extract_bytes_native	✅	4s	3s	+33%
mld_ct_abs_i32	✅	4s	2s	+100%
mld_ct_cmask_nonzero_u32	✅	4s	2s	+100%
mld_ct_memcmp	✅	4s	3s	+33%
mld_h	✅	4s	4s	+0%
mld_keccakf1600_extract_bytes	✅	4s	2s	+100%
mld_sign_finish	✅	4s	-	new
ntt_native_aarch64	✅	4s	3s	+33%
ntt_native_x86_64	✅	4s	3s	+33%
pointwise_native_x86_64	✅	4s	4s	+0%
poly_caddq_native_aarch64	✅	4s	4s	+0%
poly_chknorm	✅	4s	4s	+0%
poly_chknorm_native_x86_64	✅	4s	2s	+100%
poly_uniform	✅	4s	6s	-33%
polyvec_matrix_pointwise_montgomery_row	✅	4s	2s	+100%
polyveck_chknorm	✅	4s	5s	-20%
polyveck_pack_w1	✅	4s	1s	+300%
polyvecl_uniform_gamma1_serial	✅	4s	2s	+100%
polyw1_pack	✅	4s	3s	+33%
polyz_unpack_native	✅	4s	2s	+100%
rej_uniform_eta_native_aarch64	✅	4s	2s	+100%
rej_uniform_native_aarch64	✅	4s	5s	-20%
shake256_squeeze	✅	4s	2s	+100%
shake256x4_absorb_once	✅	4s	3s	+33%
sign_keypair	✅	4s	4s	+0%
sign_pk_from_sk	✅	4s	5s	-20%
sign_signature_pre_hash_shake256	✅	4s	3s	+33%
sk_s2hat_get_poly	✅	4s	2s	+100%
unpack_sk_s1hat	✅	4s	1s	+300%
unpack_sk_t0hat	✅	4s	3s	+33%
yvec_get_poly	✅	4s	3s	+33%
caddq	✅	3s	2s	+50%
intt_native_aarch64	✅	3s	9s	-67%
keccak_absorb	✅	3s	5s	-40%
keccak_f1600_x1_native_aarch64	✅	3s	2s	+50%
keccak_f1600_x4_native_aarch64_v8a_v84a_scalar_hybrid	✅	3s	1s	+200%
keccak_f1600_x4_native_avx2	✅	3s	3s	+0%
keccak_squeeze	✅	3s	1s	+200%
keccakf1600_permute_native	✅	3s	3s	+0%
keccakf1600x4_permute	✅	3s	4s	-25%
make_hint	✅	3s	3s	+0%
mld_ct_cmask_nonzero_u8	✅	3s	2s	+50%
mld_ct_get_optblocker_u8	✅	3s	1s	+200%
mld_keccakf1600x4_xor_bytes_c	✅	3s	2s	+50%
mld_sign_attempt	✅	3s	-	new
mld_value_barrier_u8	✅	3s	3s	+0%
montgomery_reduce	✅	3s	3s	+0%
nttunpack_native_x86_64	✅	3s	1s	+200%
pack_sig_z	✅	3s	4s	-25%
pack_sk_rho_key_tr_s2	✅	3s	3s	+0%
pointwise_native_aarch64	✅	3s	5s	-40%
poly_caddq_c	✅	3s	2s	+50%
poly_caddq_native	✅	3s	5s	-40%
poly_caddq_native_x86_64	✅	3s	4s	-25%
poly_chknorm_native	✅	3s	4s	-25%
poly_decompose	✅	3s	3s	+0%
poly_decompose_88_native_aarch64	✅	3s	4s	-25%
poly_decompose_native	✅	3s	3s	+0%
poly_decompose_native_x86_64	✅	3s	3s	+0%
poly_ntt	✅	3s	3s	+0%
poly_ntt_native	✅	3s	5s	-40%
poly_permute_bitrev_to_custom_optional	✅	3s	2s	+50%
poly_pointwise_montgomery_native	✅	3s	2s	+50%
poly_power2round	✅	3s	4s	-25%
poly_reduce	✅	3s	3s	+0%
poly_sub	✅	3s	3s	+0%
poly_uniform_eta	✅	3s	5s	-40%
poly_uniform_gamma1	✅	3s	4s	-25%
poly_use_hint	✅	3s	4s	-25%
poly_use_hint_c	✅	3s	3s	+0%
poly_use_hint_native	✅	3s	4s	-25%
poly_use_hint_native_aarch64	✅	3s	2s	+50%
polyeta_pack	✅	3s	3s	+0%
polyveck_caddq	✅	3s	3s	+0%
polyvecl_ntt	✅	3s	2s	+50%
polyvecl_uniform_gamma1	✅	3s	3s	+0%
polyvecl_unpack_z	✅	3s	2s	+50%
polyw1_pack_88	✅	3s	1s	+200%
polyz_pack	✅	3s	2s	+50%
polyz_unpack_17_native_aarch64	✅	3s	5s	-40%
reduce32	✅	3s	2s	+50%
rej_eta_c	✅	3s	4s	-25%
shake128x4_absorb_once	✅	3s	3s	+0%
shake128x4_squeezeblocks	✅	3s	1s	+200%
shake256	✅	3s	1s	+200%
shake256_finalize	✅	3s	2s	+50%
sign_verify_pre_hash_internal	✅	3s	3s	+0%
sign_verify_pre_hash_shake256	✅	3s	5s	-40%
sk_t0hat_get_poly	✅	3s	2s	+50%
sys_check_capability	✅	3s	4s	-25%
unpack_sk	✅	3s	3s	+0%
unpack_sk_s2hat	✅	3s	4s	-25%
fqscale	✅	2s	3s	-33%
intt_native_x86_64	✅	2s	4s	-50%
keccak_f1600_x1_native_aarch64_v84a	✅	2s	3s	-33%
keccak_f1600_x4_native_aarch64_v84a	✅	2s	2s	+0%
keccak_f1600_x4_native_aarch64_v8a_scalar_hybrid	✅	2s	3s	-33%
keccak_init	✅	2s	3s	-33%
keccakf1600x4_extract_bytes	✅	2s	2s	+0%
keccakf1600x4_xor_bytes	✅	2s	2s	+0%
keccakf1600x4_xor_bytes_native	✅	2s	3s	-33%
mld_ct_cmask_neg_i32	✅	2s	3s	-33%
mld_ct_get_optblocker_i64	✅	2s	4s	-50%
mld_ct_get_optblocker_u32	✅	2s	1s	+100%
mld_keccakf1600x4_extract_bytes_c	✅	2s	2s	+0%
mld_polymat_expand_entry	✅	2s	3s	-33%
mld_value_barrier_i64	✅	2s	2s	+0%
mld_value_barrier_u32	✅	2s	2s	+0%
pack_sk_s1	✅	2s	2s	+0%
poly_invntt_tomont	✅	2s	4s	-50%
poly_pointwise_montgomery	✅	2s	3s	-33%
polyt1_pack	✅	2s	4s	-50%
polyveck_pack_eta	✅	2s	2s	+0%
polyveck_reduce	✅	2s	5s	-60%
polyveck_unpack_eta	✅	2s	2s	+0%
polyvecl_pointwise_acc_montgomery	✅	2s	4s	-50%
polyvecl_pointwise_acc_montgomery_native	✅	2s	2s	+0%
polyvecl_unpack_eta	✅	2s	2s	+0%
polyz_unpack	✅	2s	3s	-33%
polyz_unpack_native_x86_64	✅	2s	3s	-33%
power2round	✅	2s	3s	-33%
shake128_absorb	✅	2s	2s	+0%
shake128_finalize	✅	2s	2s	+0%
shake128_init	✅	2s	3s	-33%
shake128_release	✅	2s	1s	+100%
shake128_squeeze	✅	2s	1s	+100%
shake256_init	✅	2s	3s	-33%
sig_unpack_hints	✅	2s	2s	+0%
sign_verify_extmu	✅	2s	3s	-33%
sk_s1hat_get_poly	✅	2s	3s	-33%
unpack_pk_t1	✅	2s	5s	-60%
yvec_init	✅	2s	3s	-33%
pack_sig_h	✅	1s	3s	-67%
poly_decompose_32_native_aarch64	✅	1s	2s	-50%
poly_invntt_tomont_native	✅	1s	4s	-75%
polyz_unpack_19_native_aarch64	✅	1s	5s	-80%
rej_eta	✅	1s	3s	-67%
shake256_release	✅	1s	2s	-50%
shake256x4_squeezeblocks	✅	1s	4s	-75%

[oqs-bot]

CBMC Results (ML-DSA-87)

⚠️ Attention Required

Proof	Status	Current	Previous	Change
sign_signature_internal	⚠️	109s	42s	+160%

Full Results (208 proofs)

Proof	Status	Current	Previous	Change
**TOTAL**	✅	2073s	2151s	-3.6%
polyvecl_pointwise_acc_montgomery_c	✅	326s	353s	-8%
polyvec_matrix_expand	✅	285s	324s	-12%
poly_pointwise_montgomery_c	✅	116s	144s	-19%
sign_signature_internal	⚠️	109s	42s	+160%
mld_invntt_layer	✅	107s	115s	-7%
sign_verify_internal	✅	97s	97s	+0%
mld_attempt_signature_generation	✅	54s	55s	-2%
mld_ntt_layer	✅	42s	45s	-7%
fqmul	✅	41s	43s	-5%
polyvec_matrix_expand_serial	✅	36s	38s	-5%
keccakf1600x4_permute_native	✅	23s	23s	+0%
mld_ntt_butterfly_block	✅	22s	24s	-8%
poly_ntt_c	✅	19s	21s	-10%
polyeta_unpack	✅	19s	17s	+12%
polyvec_matrix_pointwise_montgomery_yvec	✅	17s	18s	-6%
compute_pack_t0_t1	✅	16s	19s	-16%
mld_check_pct	✅	16s	16s	+0%
polyt0_unpack	✅	15s	14s	+7%
rej_uniform_c	✅	15s	19s	-21%
poly_chknorm_c	✅	14s	15s	-7%
rej_uniform	✅	14s	15s	-7%
poly_uniform_4x	✅	13s	13s	+0%
mld_compute_pack_z	✅	12s	8s	+50%
poly_invntt_tomont_c	✅	12s	12s	+0%
poly_uniform_eta_4x	✅	11s	11s	+0%
polyveck_decompose	✅	10s	13s	-23%
keccak_absorb_once_x4	✅	9s	9s	+0%
pointwise_acc_native_x86_64	✅	9s	6s	+50%
pointwise_acc_native_aarch64	✅	8s	6s	+33%
polyveck_ntt	✅	8s	11s	-27%
polyvecl_ntt	✅	8s	7s	+14%
mld_keccakf1600_permute_c	✅	7s	7s	+0%
mld_sample_s1_s2	✅	7s	6s	+17%
mld_sample_s1_s2_serial	✅	7s	8s	-12%
polyveck_invntt_tomont	✅	7s	9s	-22%
sign_pk_from_sk	✅	7s	6s	+17%
unpack_sk	✅	7s	5s	+40%
poly_add	✅	6s	6s	+0%
poly_challenge	✅	6s	5s	+20%
poly_use_hint_native	✅	6s	3s	+100%
polyt1_unpack	✅	6s	4s	+50%
polyveck_caddq	✅	6s	8s	-25%
rej_uniform_native	✅	6s	8s	-25%
rej_uniform_native_aarch64	✅	6s	2s	+200%
sign_keypair_internal	✅	6s	6s	+0%
sign_verify_pre_hash_shake256	✅	6s	3s	+100%
keccak_f1600_x1_native_aarch64_v84a	✅	5s	1s	+400%
keccakf1600x4_xor_bytes_native	✅	5s	3s	+67%
mld_ct_get_optblocker_u32	✅	5s	2s	+150%
poly_chknorm	✅	5s	3s	+67%
poly_decompose	✅	5s	3s	+67%
polyvecl_uniform_gamma1_serial	✅	5s	4s	+25%
polyz_unpack_19_native_aarch64	✅	5s	4s	+25%
shake128x4_squeezeblocks	✅	5s	3s	+67%
sign_verify	✅	5s	5s	+0%
unpack_sk_t0hat	✅	5s	7s	-29%
caddq	✅	4s	4s	+0%
fqscale	✅	4s	3s	+33%
intt_native_aarch64	✅	4s	3s	+33%
keccakf1600_permute	✅	4s	3s	+33%
keccakf1600_xor_bytes	✅	4s	3s	+33%
keccakf1600x4_extract_bytes_native	✅	4s	2s	+100%
keccakf1600x4_xor_bytes	✅	4s	3s	+33%
mld_prepare_domain_separation_prefix	✅	4s	4s	+0%
mld_sign_resume	✅	4s	-	new
ntt_native_aarch64	✅	4s	6s	-33%
pack_sig_c	✅	4s	4s	+0%
poly_caddq_native_x86_64	✅	4s	2s	+100%
poly_decompose_c	✅	4s	5s	-20%
poly_decompose_native_x86_64	✅	4s	2s	+100%
poly_invntt_tomont_native	✅	4s	5s	-20%
poly_ntt_native	✅	4s	3s	+33%
poly_shiftl	✅	4s	4s	+0%
poly_uniform	✅	4s	4s	+0%
poly_uniform_gamma1_4x	✅	4s	3s	+33%
poly_use_hint_c	✅	4s	2s	+100%
polyvec_matrix_pointwise_montgomery_row	✅	4s	3s	+33%
polyveck_chknorm	✅	4s	3s	+33%
polyveck_pack_w1	✅	4s	3s	+33%
polyveck_reduce	✅	4s	3s	+33%
polyvecl_chknorm	✅	4s	7s	-43%
polyvecl_pointwise_acc_montgomery	✅	4s	5s	-20%
polyvecl_pointwise_acc_montgomery_native	✅	4s	3s	+33%
polyvecl_unpack_z	✅	4s	4s	+0%
polyz_unpack_17_native_aarch64	✅	4s	3s	+33%
power2round	✅	4s	4s	+0%
shake128_absorb	✅	4s	4s	+0%
shake128_release	✅	4s	4s	+0%
shake256	✅	4s	2s	+100%
shake256_absorb	✅	4s	2s	+100%
shake256_init	✅	4s	2s	+100%
sign_keypair	✅	4s	4s	+0%
sign_signature_pre_hash_shake256	✅	4s	6s	-33%
sign_verify_extmu	✅	4s	3s	+33%
sign_verify_pre_hash_internal	✅	4s	3s	+33%
unpack_pk_t1	✅	4s	1s	+300%
unpack_sk_s1hat	✅	4s	2s	+100%
yvec_init	✅	4s	4s	+0%
decompose	✅	3s	3s	+0%
intt_native_x86_64	✅	3s	3s	+0%
keccak_absorb	✅	3s	3s	+0%
keccak_f1600_x1_native_aarch64	✅	3s	1s	+200%
keccak_squeezeblocks_x4	✅	3s	4s	-25%
keccakf1600_permute_native	✅	3s	4s	-25%
keccakf1600x4_extract_bytes	✅	3s	2s	+50%
keccakf1600x4_permute	✅	3s	3s	+0%
mld_ct_abs_i32	✅	3s	3s	+0%
mld_ct_get_optblocker_i64	✅	3s	3s	+0%
mld_ct_sel_int32	✅	3s	3s	+0%
mld_h	✅	3s	3s	+0%
mld_polymat_expand_entry	✅	3s	3s	+0%
mld_sign_finish	✅	3s	-	new
mld_value_barrier_u8	✅	3s	3s	+0%
ntt_native_x86_64	✅	3s	2s	+50%
nttunpack_native_x86_64	✅	3s	3s	+0%
pack_sig_z	✅	3s	5s	-40%
pack_sk_rho_key_tr_s2	✅	3s	3s	+0%
pointwise_native_x86_64	✅	3s	2s	+50%
poly_caddq_native_aarch64	✅	3s	3s	+0%
poly_chknorm_native_aarch64	✅	3s	4s	-25%
poly_chknorm_native_x86_64	✅	3s	2s	+50%
poly_decompose_native	✅	3s	2s	+50%
poly_permute_bitrev_to_custom_optional_native	✅	3s	5s	-40%
poly_pointwise_montgomery	✅	3s	4s	-25%
poly_pointwise_montgomery_native	✅	3s	5s	-40%
poly_sub	✅	3s	3s	+0%
poly_use_hint_native_aarch64	✅	3s	2s	+50%
poly_use_hint_native_x86_64	✅	3s	-	new
polyveck_unpack_eta	✅	3s	4s	-25%
polyvecl_uniform_gamma1	✅	3s	2s	+50%
polyw1_pack_88	✅	3s	3s	+0%
polyz_unpack_native	✅	3s	4s	-25%
polyz_unpack_native_x86_64	✅	3s	3s	+0%
rej_eta	✅	3s	4s	-25%
rej_eta_c	✅	3s	5s	-40%
rej_eta_native	✅	3s	6s	-50%
shake128_init	✅	3s	1s	+200%
shake128_squeeze	✅	3s	2s	+50%
sig_unpack_hints	✅	3s	3s	+0%
sign_signature	✅	3s	5s	-40%
sign_signature_extmu	✅	3s	4s	-25%
sign_signature_pre_hash_internal	✅	3s	5s	-40%
sk_s1hat_get_poly	✅	3s	3s	+0%
sk_s2hat_get_poly	✅	3s	3s	+0%
unpack_sk_s2hat	✅	3s	3s	+0%
use_hint	✅	3s	3s	+0%
yvec_get_poly	✅	3s	4s	-25%
keccak_f1600_x4_native_aarch64_v84a	✅	2s	4s	-50%
keccak_f1600_x4_native_aarch64_v8a_v84a_scalar_hybrid	✅	2s	4s	-50%
keccak_finalize	✅	2s	1s	+100%
keccak_init	✅	2s	3s	-33%
keccak_squeeze	✅	2s	2s	+0%
make_hint	✅	2s	3s	-33%
mld_ct_cmask_neg_i32	✅	2s	4s	-50%
mld_ct_cmask_nonzero_u32	✅	2s	2s	+0%
mld_ct_cmask_nonzero_u8	✅	2s	3s	-33%
mld_ct_get_optblocker_u8	✅	2s	3s	-33%
mld_ct_memcmp	✅	2s	3s	-33%
mld_keccakf1600_extract_bytes	✅	2s	4s	-50%
mld_keccakf1600x4_extract_bytes_c	✅	2s	2s	+0%
mld_keccakf1600x4_xor_bytes_c	✅	2s	4s	-50%
mld_sign_attempt	✅	2s	-	new
mld_value_barrier_u32	✅	2s	2s	+0%
montgomery_reduce	✅	2s	3s	-33%
pack_sig_h	✅	2s	4s	-50%
pack_sk_s1	✅	2s	1s	+100%
pointwise_native_aarch64	✅	2s	5s	-60%
poly_caddq	✅	2s	2s	+0%
poly_caddq_c	✅	2s	3s	-33%
poly_caddq_native	✅	2s	4s	-50%
poly_chknorm_native	✅	2s	4s	-50%
poly_decompose_32_native_aarch64	✅	2s	5s	-60%
poly_decompose_88_native_aarch64	✅	2s	2s	+0%
poly_invntt_tomont	✅	2s	1s	+100%
poly_ntt	✅	2s	3s	-33%
poly_permute_bitrev_to_custom_optional	✅	2s	3s	-33%
poly_power2round	✅	2s	3s	-33%
poly_reduce	✅	2s	2s	+0%
poly_uniform_eta	✅	2s	4s	-50%
poly_uniform_gamma1	✅	2s	4s	-50%
poly_use_hint	✅	2s	1s	+100%
polyveck_pack_eta	✅	2s	6s	-67%
polyvecl_pack_eta	✅	2s	3s	-33%
polyz_pack	✅	2s	5s	-60%
polyz_unpack	✅	2s	2s	+0%
polyz_unpack_c	✅	2s	3s	-33%
reduce32	✅	2s	3s	-33%
rej_uniform_eta_native_aarch64	✅	2s	5s	-60%
shake128_finalize	✅	2s	2s	+0%
shake128x4_absorb_once	✅	2s	5s	-60%
shake256_finalize	✅	2s	2s	+0%
shake256_release	✅	2s	3s	-33%
shake256_squeeze	✅	2s	2s	+0%
shake256x4_squeezeblocks	✅	2s	1s	+100%
sys_check_capability	✅	2s	3s	-33%
keccak_f1600_x4_native_aarch64_v8a_scalar_hybrid	✅	1s	3s	-67%
keccak_f1600_x4_native_avx2	✅	1s	2s	-50%
keccakf1600_extract_bytes (big endian)	✅	1s	3s	-67%
keccakf1600_xor_bytes (big endian)	✅	1s	2s	-50%
mld_value_barrier_i64	✅	1s	1s	+0%
polyeta_pack	✅	1s	4s	-75%
polyt0_pack	✅	1s	4s	-75%
polyt1_pack	✅	1s	3s	-67%
polyvecl_unpack_eta	✅	1s	5s	-80%
polyw1_pack	✅	1s	4s	-75%
polyw1_pack_32	✅	1s	4s	-75%
shake256x4_absorb_once	✅	1s	2s	-50%
sk_t0hat_get_poly	✅	1s	4s	-75%

[oqs-bot]

CBMC Results (ML-DSA-65, REDUCE-RAM)

Full Results (208 proofs)

Proof	Status	Current	Previous	Change
**TOTAL**	✅	1597s	1482s	+7.8%
polyvec_matrix_pointwise_montgomery_yvec	✅	216s	201s	+7%
poly_pointwise_montgomery_c	✅	139s	116s	+20%
mld_invntt_layer	✅	122s	108s	+13%
sign_verify_internal	✅	74s	71s	+4%
mld_ntt_layer	✅	47s	43s	+9%
polyvecl_chknorm	✅	46s	43s	+7%
fqmul	✅	45s	40s	+12%
polyveck_chknorm	✅	37s	36s	+3%
mld_attempt_signature_generation	✅	36s	31s	+16%
keccakf1600x4_permute_native	✅	23s	22s	+5%
mld_ntt_butterfly_block	✅	23s	25s	-8%
poly_ntt_c	✅	20s	22s	-9%
mld_check_pct	✅	16s	12s	+33%
rej_uniform_c	✅	16s	16s	+0%
polyt0_unpack	✅	13s	13s	+0%
polyveck_decompose	✅	13s	14s	-7%
poly_chknorm_c	✅	12s	13s	-8%
poly_invntt_tomont_c	✅	12s	10s	+20%
keccak_absorb_once_x4	✅	10s	10s	+0%
poly_uniform_eta_4x	✅	10s	13s	-23%
polyz_unpack_c	✅	10s	9s	+11%
rej_uniform	✅	10s	7s	+43%
poly_decompose_c	✅	9s	8s	+12%
pointwise_acc_native_x86_64	✅	8s	5s	+60%
poly_add	✅	8s	7s	+14%
polyvec_matrix_pointwise_montgomery_row	✅	8s	8s	+0%
polyvecl_ntt	✅	8s	7s	+14%
compute_pack_t0_t1	✅	7s	7s	+0%
mld_compute_pack_z	✅	7s	5s	+40%
mld_sign_resume	✅	7s	-	new
polyveck_invntt_tomont	✅	7s	7s	+0%
polyveck_reduce	✅	7s	6s	+17%
sign_signature_internal	✅	7s	6s	+17%
keccak_squeeze	✅	6s	2s	+200%
mld_keccakf1600_permute_c	✅	6s	7s	-14%
mld_prepare_domain_separation_prefix	✅	6s	4s	+50%
mld_sample_s1_s2	✅	6s	6s	+0%
pointwise_native_aarch64	✅	6s	3s	+100%
poly_caddq_c	✅	6s	5s	+20%
poly_reduce	✅	6s	4s	+50%
polyt0_pack	✅	6s	5s	+20%
sign_verify_pre_hash_shake256	✅	6s	6s	+0%
keccak_squeezeblocks_x4	✅	5s	4s	+25%
keccakf1600_permute	✅	5s	4s	+25%
keccakf1600x4_extract_bytes_native	✅	5s	1s	+400%
ntt_native_aarch64	✅	5s	3s	+67%
ntt_native_x86_64	✅	5s	5s	+0%
pack_sig_c	✅	5s	3s	+67%
pointwise_acc_native_aarch64	✅	5s	6s	-17%
poly_decompose_native	✅	5s	5s	+0%
poly_shiftl	✅	5s	3s	+67%
polyveck_caddq	✅	5s	7s	-29%
polyveck_unpack_eta	✅	5s	3s	+67%
polyz_pack	✅	5s	3s	+67%
polyz_unpack_19_native_aarch64	✅	5s	5s	+0%
rej_eta_native	✅	5s	3s	+67%
sign_keypair_internal	✅	5s	3s	+67%
sign_signature_pre_hash_shake256	✅	5s	7s	-29%
sign_verify	✅	5s	6s	-17%
sign_verify_pre_hash_internal	✅	5s	5s	+0%
caddq	✅	4s	2s	+100%
decompose	✅	4s	4s	+0%
fqscale	✅	4s	3s	+33%
intt_native_x86_64	✅	4s	4s	+0%
keccakf1600_xor_bytes (big endian)	✅	4s	2s	+100%
keccakf1600x4_permute	✅	4s	1s	+300%
make_hint	✅	4s	3s	+33%
mld_ct_get_optblocker_u8	✅	4s	4s	+0%
mld_polymat_expand_entry	✅	4s	3s	+33%
mld_sample_s1_s2_serial	✅	4s	3s	+33%
mld_sign_attempt	✅	4s	-	new
mld_value_barrier_u32	✅	4s	4s	+0%
nttunpack_native_x86_64	✅	4s	3s	+33%
pack_sig_z	✅	4s	1s	+300%
pack_sk_s1	✅	4s	3s	+33%
poly_caddq_native	✅	4s	4s	+0%
poly_caddq_native_x86_64	✅	4s	1s	+300%
poly_chknorm	✅	4s	3s	+33%
poly_power2round	✅	4s	7s	-43%
poly_uniform_eta	✅	4s	5s	-20%
poly_uniform_gamma1	✅	4s	3s	+33%
poly_use_hint_native	✅	4s	7s	-43%
polyeta_unpack	✅	4s	4s	+0%
polyt1_unpack	✅	4s	3s	+33%
polyvecl_unpack_z	✅	4s	1s	+300%
polyw1_pack_32	✅	4s	2s	+100%
polyz_unpack_17_native_aarch64	✅	4s	2s	+100%
polyz_unpack_native_x86_64	✅	4s	3s	+33%
rej_uniform_eta_native_aarch64	✅	4s	5s	-20%
shake128_release	✅	4s	2s	+100%
shake128x4_squeezeblocks	✅	4s	2s	+100%
shake256_finalize	✅	4s	1s	+300%
sign_pk_from_sk	✅	4s	5s	-20%
sign_signature	✅	4s	5s	-20%
sign_signature_extmu	✅	4s	4s	+0%
sk_s1hat_get_poly	✅	4s	3s	+33%
unpack_sk_s2hat	✅	4s	3s	+33%
intt_native_aarch64	✅	3s	2s	+50%
keccak_absorb	✅	3s	3s	+0%
keccakf1600_extract_bytes (big endian)	✅	3s	3s	+0%
keccakf1600_xor_bytes	✅	3s	4s	-25%
keccakf1600x4_xor_bytes	✅	3s	2s	+50%
keccakf1600x4_xor_bytes_native	✅	3s	2s	+50%
mld_ct_abs_i32	✅	3s	6s	-50%
mld_ct_cmask_nonzero_u32	✅	3s	3s	+0%
mld_ct_get_optblocker_i64	✅	3s	1s	+200%
mld_ct_get_optblocker_u32	✅	3s	3s	+0%
mld_ct_sel_int32	✅	3s	2s	+50%
mld_h	✅	3s	3s	+0%
mld_keccakf1600x4_xor_bytes_c	✅	3s	2s	+50%
mld_sign_finish	✅	3s	-	new
mld_value_barrier_i64	✅	3s	2s	+50%
montgomery_reduce	✅	3s	1s	+200%
pack_sk_rho_key_tr_s2	✅	3s	2s	+50%
poly_caddq	✅	3s	3s	+0%
poly_caddq_native_aarch64	✅	3s	2s	+50%
poly_challenge	✅	3s	5s	-40%
poly_chknorm_native_aarch64	✅	3s	2s	+50%
poly_chknorm_native_x86_64	✅	3s	4s	-25%
poly_decompose	✅	3s	2s	+50%
poly_decompose_32_native_aarch64	✅	3s	4s	-25%
poly_decompose_native_x86_64	✅	3s	2s	+50%
poly_ntt	✅	3s	2s	+50%
poly_permute_bitrev_to_custom_optional_native	✅	3s	3s	+0%
poly_pointwise_montgomery	✅	3s	2s	+50%
poly_sub	✅	3s	4s	-25%
poly_uniform	✅	3s	2s	+50%
poly_uniform_4x	✅	3s	4s	-25%
poly_uniform_gamma1_4x	✅	3s	3s	+0%
poly_use_hint	✅	3s	3s	+0%
poly_use_hint_native_aarch64	✅	3s	4s	-25%
poly_use_hint_native_x86_64	✅	3s	-	new
polyt1_pack	✅	3s	3s	+0%
polyvec_matrix_expand	✅	3s	6s	-50%
polyveck_pack_eta	✅	3s	3s	+0%
polyvecl_pack_eta	✅	3s	2s	+50%
polyvecl_pointwise_acc_montgomery_c	✅	3s	3s	+0%
polyvecl_pointwise_acc_montgomery_native	✅	3s	3s	+0%
polyvecl_uniform_gamma1	✅	3s	4s	-25%
polyvecl_uniform_gamma1_serial	✅	3s	1s	+200%
polyvecl_unpack_eta	✅	3s	2s	+50%
polyw1_pack	✅	3s	3s	+0%
polyz_unpack	✅	3s	3s	+0%
polyz_unpack_native	✅	3s	3s	+0%
rej_eta_c	✅	3s	4s	-25%
rej_uniform_native	✅	3s	4s	-25%
shake128_absorb	✅	3s	2s	+50%
shake128_init	✅	3s	6s	-50%
shake256_absorb	✅	3s	4s	-25%
shake256_release	✅	3s	3s	+0%
sign_keypair	✅	3s	4s	-25%
sign_verify_extmu	✅	3s	2s	+50%
sk_t0hat_get_poly	✅	3s	1s	+200%
sys_check_capability	✅	3s	1s	+200%
unpack_pk_t1	✅	3s	2s	+50%
unpack_sk	✅	3s	3s	+0%
yvec_get_poly	✅	3s	3s	+0%
yvec_init	✅	3s	5s	-40%
keccak_f1600_x1_native_aarch64	✅	2s	2s	+0%
keccak_f1600_x4_native_aarch64_v8a_v84a_scalar_hybrid	✅	2s	3s	-33%
keccak_init	✅	2s	4s	-50%
keccakf1600_permute_native	✅	2s	2s	+0%
keccakf1600x4_extract_bytes	✅	2s	4s	-50%
mld_ct_cmask_neg_i32	✅	2s	3s	-33%
mld_ct_memcmp	✅	2s	4s	-50%
mld_keccakf1600_extract_bytes	✅	2s	2s	+0%
mld_keccakf1600x4_extract_bytes_c	✅	2s	2s	+0%
pack_sig_h	✅	2s	2s	+0%
pointwise_native_x86_64	✅	2s	2s	+0%
poly_chknorm_native	✅	2s	4s	-50%
poly_decompose_88_native_aarch64	✅	2s	2s	+0%
poly_invntt_tomont	✅	2s	5s	-60%
poly_invntt_tomont_native	✅	2s	5s	-60%
poly_ntt_native	✅	2s	2s	+0%
poly_permute_bitrev_to_custom_optional	✅	2s	3s	-33%
poly_pointwise_montgomery_native	✅	2s	4s	-50%
poly_use_hint_c	✅	2s	2s	+0%
polyeta_pack	✅	2s	1s	+100%
polyveck_ntt	✅	2s	4s	-50%
polyveck_pack_w1	✅	2s	4s	-50%
polyvecl_pointwise_acc_montgomery	✅	2s	3s	-33%
polyw1_pack_88	✅	2s	3s	-33%
power2round	✅	2s	2s	+0%
reduce32	✅	2s	2s	+0%
rej_eta	✅	2s	5s	-60%
rej_uniform_native_aarch64	✅	2s	5s	-60%
shake128_finalize	✅	2s	2s	+0%
shake128_squeeze	✅	2s	3s	-33%
shake256	✅	2s	2s	+0%
shake256_init	✅	2s	4s	-50%
shake256x4_absorb_once	✅	2s	2s	+0%
shake256x4_squeezeblocks	✅	2s	2s	+0%
sig_unpack_hints	✅	2s	1s	+100%
sign_signature_pre_hash_internal	✅	2s	3s	-33%
sk_s2hat_get_poly	✅	2s	1s	+100%
unpack_sk_s1hat	✅	2s	1s	+100%
unpack_sk_t0hat	✅	2s	4s	-50%
keccak_f1600_x1_native_aarch64_v84a	✅	1s	2s	-50%
keccak_f1600_x4_native_aarch64_v84a	✅	1s	2s	-50%
keccak_f1600_x4_native_aarch64_v8a_scalar_hybrid	✅	1s	3s	-67%
keccak_f1600_x4_native_avx2	✅	1s	2s	-50%
keccak_finalize	✅	1s	2s	-50%
mld_ct_cmask_nonzero_u8	✅	1s	2s	-50%
mld_value_barrier_u8	✅	1s	1s	+0%
polyvec_matrix_expand_serial	✅	1s	3s	-67%
shake128x4_absorb_once	✅	1s	2s	-50%
shake256_squeeze	✅	1s	4s	-75%
use_hint	✅	1s	2s	-50%

[oqs-bot]

CBMC Results (ML-DSA-87, REDUCE-RAM)

Full Results (208 proofs)

Proof	Status	Current	Previous	Change
**TOTAL**	✅	1426s	1436s	-0.7%
polyvec_matrix_pointwise_montgomery_yvec	✅	180s	196s	-8%
poly_pointwise_montgomery_c	✅	116s	125s	-7%
mld_invntt_layer	✅	104s	111s	-6%
sign_verify_internal	✅	46s	47s	-2%
mld_ntt_layer	✅	41s	44s	-7%
fqmul	✅	39s	39s	+0%
mld_attempt_signature_generation	✅	35s	34s	+3%
polyvecl_chknorm	✅	35s	38s	-8%
mld_ntt_butterfly_block	✅	22s	23s	-4%
keccakf1600x4_permute_native	✅	21s	25s	-16%
poly_ntt_c	✅	18s	19s	-5%
polyeta_unpack	✅	17s	13s	+31%
rej_uniform_c	✅	17s	18s	-6%
polyvec_matrix_pointwise_montgomery_row	✅	16s	13s	+23%
poly_chknorm_c	✅	14s	13s	+8%
poly_uniform_eta_4x	✅	14s	12s	+17%
poly_invntt_tomont_c	✅	13s	9s	+44%
compute_pack_t0_t1	✅	12s	12s	+0%
mld_check_pct	✅	11s	15s	-27%
polyveck_decompose	✅	11s	12s	-8%
keccak_absorb_once_x4	✅	10s	8s	+25%
polyt0_unpack	✅	10s	14s	-29%
mld_compute_pack_z	✅	9s	6s	+50%
mld_sign_finish	✅	9s	-	new
polyveck_caddq	✅	9s	8s	+12%
polyveck_chknorm	✅	9s	9s	+0%
polyvecl_ntt	✅	9s	8s	+12%
poly_add	✅	8s	8s	+0%
poly_reduce	✅	8s	4s	+100%
polyz_unpack_c	✅	8s	7s	+14%
rej_uniform	✅	8s	7s	+14%
sign_keypair_internal	✅	8s	6s	+33%
mld_keccakf1600_permute_c	✅	7s	8s	-12%
mld_sample_s1_s2	✅	7s	8s	-12%
pointwise_acc_native_x86_64	✅	7s	8s	-12%
poly_decompose_c	✅	7s	6s	+17%
polyveck_reduce	✅	7s	6s	+17%
rej_uniform_eta_native_aarch64	✅	7s	3s	+133%
fqscale	✅	6s	1s	+500%
pointwise_acc_native_aarch64	✅	6s	5s	+20%
keccak_squeezeblocks_x4	✅	5s	4s	+25%
mld_prepare_domain_separation_prefix	✅	5s	3s	+67%
mld_sample_s1_s2_serial	✅	5s	6s	-17%
pack_sig_h	✅	5s	3s	+67%
pack_sk_rho_key_tr_s2	✅	5s	2s	+150%
poly_challenge	✅	5s	4s	+25%
poly_use_hint_native_x86_64	✅	5s	-	new
polyveck_invntt_tomont	✅	5s	4s	+25%
polyveck_unpack_eta	✅	5s	3s	+67%
polyw1_pack_88	✅	5s	2s	+150%
shake128_release	✅	5s	3s	+67%
sig_unpack_hints	✅	5s	4s	+25%
sign_pk_from_sk	✅	5s	6s	-17%
sign_signature_extmu	✅	5s	4s	+25%
sign_verify_pre_hash_shake256	✅	5s	7s	-29%
sk_s2hat_get_poly	✅	5s	2s	+150%
sk_t0hat_get_poly	✅	5s	3s	+67%
caddq	✅	4s	3s	+33%
intt_native_x86_64	✅	4s	4s	+0%
keccak_absorb	✅	4s	4s	+0%
keccakf1600x4_extract_bytes_native	✅	4s	4s	+0%
mld_ct_abs_i32	✅	4s	1s	+300%
mld_ct_cmask_nonzero_u32	✅	4s	5s	-20%
mld_keccakf1600x4_extract_bytes_c	✅	4s	3s	+33%
mld_keccakf1600x4_xor_bytes_c	✅	4s	1s	+300%
montgomery_reduce	✅	4s	2s	+100%
ntt_native_x86_64	✅	4s	2s	+100%
poly_caddq_c	✅	4s	3s	+33%
poly_caddq_native	✅	4s	3s	+33%
poly_caddq_native_x86_64	✅	4s	3s	+33%
poly_decompose_native_x86_64	✅	4s	3s	+33%
poly_ntt_native	✅	4s	4s	+0%
poly_pointwise_montgomery	✅	4s	3s	+33%
poly_power2round	✅	4s	7s	-43%
poly_uniform	✅	4s	4s	+0%
poly_uniform_eta	✅	4s	5s	-20%
poly_uniform_gamma1	✅	4s	3s	+33%
polyveck_ntt	✅	4s	3s	+33%
polyw1_pack_32	✅	4s	3s	+33%
rej_eta_c	✅	4s	4s	+0%
rej_uniform_native	✅	4s	5s	-20%
shake128x4_squeezeblocks	✅	4s	1s	+300%
shake256	✅	4s	3s	+33%
shake256x4_squeezeblocks	✅	4s	4s	+0%
sign_signature_internal	✅	4s	3s	+33%
sign_signature_pre_hash_shake256	✅	4s	3s	+33%
sign_verify_extmu	✅	4s	4s	+0%
unpack_pk_t1	✅	4s	2s	+100%
decompose	✅	3s	2s	+50%
intt_native_aarch64	✅	3s	4s	-25%
keccak_f1600_x4_native_avx2	✅	3s	3s	+0%
keccak_init	✅	3s	1s	+200%
keccakf1600_permute	✅	3s	2s	+50%
keccakf1600_permute_native	✅	3s	3s	+0%
keccakf1600x4_xor_bytes_native	✅	3s	2s	+50%
mld_sign_attempt	✅	3s	-	new
mld_value_barrier_i64	✅	3s	2s	+50%
mld_value_barrier_u8	✅	3s	2s	+50%
ntt_native_aarch64	✅	3s	4s	-25%
nttunpack_native_x86_64	✅	3s	3s	+0%
pack_sig_c	✅	3s	2s	+50%
pack_sig_z	✅	3s	3s	+0%
pointwise_native_x86_64	✅	3s	5s	-40%
poly_caddq_native_aarch64	✅	3s	3s	+0%
poly_chknorm	✅	3s	4s	-25%
poly_chknorm_native_aarch64	✅	3s	5s	-40%
poly_chknorm_native_x86_64	✅	3s	2s	+50%
poly_decompose	✅	3s	2s	+50%
poly_decompose_32_native_aarch64	✅	3s	3s	+0%
poly_decompose_88_native_aarch64	✅	3s	2s	+50%
poly_invntt_tomont	✅	3s	4s	-25%
poly_invntt_tomont_native	✅	3s	2s	+50%
poly_permute_bitrev_to_custom_optional	✅	3s	2s	+50%
poly_permute_bitrev_to_custom_optional_native	✅	3s	3s	+0%
poly_shiftl	✅	3s	4s	-25%
poly_uniform_4x	✅	3s	3s	+0%
poly_uniform_gamma1_4x	✅	3s	3s	+0%
poly_use_hint_native	✅	3s	1s	+200%
polyeta_pack	✅	3s	3s	+0%
polyvec_matrix_expand	✅	3s	3s	+0%
polyvecl_uniform_gamma1_serial	✅	3s	2s	+50%
polyz_unpack_19_native_aarch64	✅	3s	5s	-40%
polyz_unpack_native_x86_64	✅	3s	3s	+0%
rej_eta_native	✅	3s	4s	-25%
rej_uniform_native_aarch64	✅	3s	3s	+0%
shake128_absorb	✅	3s	2s	+50%
shake128_finalize	✅	3s	2s	+50%
shake128_squeeze	✅	3s	1s	+200%
shake256_finalize	✅	3s	3s	+0%
shake256_init	✅	3s	3s	+0%
shake256_release	✅	3s	5s	-40%
shake256_squeeze	✅	3s	2s	+50%
sign_signature	✅	3s	4s	-25%
sign_verify	✅	3s	2s	+50%
sign_verify_pre_hash_internal	✅	3s	3s	+0%
sys_check_capability	✅	3s	2s	+50%
unpack_sk	✅	3s	4s	-25%
unpack_sk_s1hat	✅	3s	3s	+0%
unpack_sk_s2hat	✅	3s	3s	+0%
unpack_sk_t0hat	✅	3s	4s	-25%
keccak_f1600_x1_native_aarch64	✅	2s	2s	+0%
keccak_f1600_x1_native_aarch64_v84a	✅	2s	2s	+0%
keccak_f1600_x4_native_aarch64_v84a	✅	2s	1s	+100%
keccak_f1600_x4_native_aarch64_v8a_v84a_scalar_hybrid	✅	2s	2s	+0%
keccak_squeeze	✅	2s	5s	-60%
keccakf1600_xor_bytes	✅	2s	1s	+100%
keccakf1600_xor_bytes (big endian)	✅	2s	2s	+0%
keccakf1600x4_extract_bytes	✅	2s	1s	+100%
keccakf1600x4_permute	✅	2s	2s	+0%
keccakf1600x4_xor_bytes	✅	2s	1s	+100%
mld_ct_cmask_neg_i32	✅	2s	2s	+0%
mld_ct_cmask_nonzero_u8	✅	2s	2s	+0%
mld_ct_get_optblocker_i64	✅	2s	2s	+0%
mld_ct_get_optblocker_u32	✅	2s	2s	+0%
mld_ct_get_optblocker_u8	✅	2s	3s	-33%
mld_ct_memcmp	✅	2s	1s	+100%
mld_h	✅	2s	2s	+0%
mld_sign_resume	✅	2s	-	new
pack_sk_s1	✅	2s	2s	+0%
pointwise_native_aarch64	✅	2s	4s	-50%
poly_caddq	✅	2s	5s	-60%
poly_decompose_native	✅	2s	2s	+0%
poly_ntt	✅	2s	2s	+0%
poly_pointwise_montgomery_native	✅	2s	3s	-33%
poly_sub	✅	2s	5s	-60%
poly_use_hint	✅	2s	4s	-50%
poly_use_hint_c	✅	2s	4s	-50%
poly_use_hint_native_aarch64	✅	2s	3s	-33%
polyt0_pack	✅	2s	3s	-33%
polyt1_pack	✅	2s	5s	-60%
polyvec_matrix_expand_serial	✅	2s	3s	-33%
polyveck_pack_eta	✅	2s	5s	-60%
polyveck_pack_w1	✅	2s	3s	-33%
polyvecl_pack_eta	✅	2s	2s	+0%
polyvecl_pointwise_acc_montgomery	✅	2s	2s	+0%
polyvecl_pointwise_acc_montgomery_c	✅	2s	2s	+0%
polyvecl_pointwise_acc_montgomery_native	✅	2s	2s	+0%
polyvecl_unpack_eta	✅	2s	3s	-33%
polyw1_pack	✅	2s	2s	+0%
polyz_pack	✅	2s	4s	-50%
polyz_unpack	✅	2s	3s	-33%
polyz_unpack_17_native_aarch64	✅	2s	4s	-50%
polyz_unpack_native	✅	2s	1s	+100%
reduce32	✅	2s	3s	-33%
rej_eta	✅	2s	2s	+0%
shake256_absorb	✅	2s	3s	-33%
shake256x4_absorb_once	✅	2s	5s	-60%
sign_keypair	✅	2s	4s	-50%
sign_signature_pre_hash_internal	✅	2s	2s	+0%
sk_s1hat_get_poly	✅	2s	3s	-33%
use_hint	✅	2s	3s	-33%
yvec_init	✅	2s	4s	-50%
keccak_f1600_x4_native_aarch64_v8a_scalar_hybrid	✅	1s	2s	-50%
keccak_finalize	✅	1s	1s	+0%
keccakf1600_extract_bytes (big endian)	✅	1s	3s	-67%
make_hint	✅	1s	2s	-50%
mld_ct_sel_int32	✅	1s	2s	-50%
mld_keccakf1600_extract_bytes	✅	1s	1s	+0%
mld_polymat_expand_entry	✅	1s	4s	-75%
mld_value_barrier_u32	✅	1s	3s	-67%
poly_chknorm_native	✅	1s	1s	+0%
polyt1_unpack	✅	1s	3s	-67%
polyvecl_uniform_gamma1	✅	1s	3s	-67%
polyvecl_unpack_z	✅	1s	3s	-67%
power2round	✅	1s	3s	-67%
shake128_init	✅	1s	2s	-50%
shake128x4_absorb_once	✅	1s	4s	-75%
yvec_get_poly	✅	1s	2s	-50%

[mkannwischer]

Thanks @hanno-becker. I have done a design review for now and have some questions - a full review will follow later.

Could you elaborate why you went for hooks to implement this approach rather than adding a _restartable() API that gets a context argument?

It would be good to add an example of how the new hooks can be used. We'll also need to add documentation.

[mkannwischer]

What is mld_sign_finish needed for? It looks like the same information is passed to the last mld_sign_attempt

[hanno-becker]

It's for ease of use and a symmetric API. For example, if you only care about pairing your benchmarks with information of how many signing attempts were performanced, finish gives you that information most directly.

But you are right, in theory one can get away without it. I'd prefer not to.

[hanno-becker]

Could you elaborate why you went for hooks to implement this approach rather than adding a _restartable() API that gets a context argument?

Hooks are more flexible and less work for us. The details of how to build a restartable API on top of them are left to the user -- by design. For example, you'd probably also want randomized signing to be restartable; that's something you can easily build yourself. If, on the other hand, we were to do it ourselves, we'd have to define some kind of restart context, which then clashes with the customer's context and is also hard to keep stable if we introduce, say, structured keys. The hooks are the core mechanism.

And the hooks are useful for statistics and benchmarking too, not just for restartability.

[hanno-becker]

It would be good to add an example of how the new hooks can be used. We'll also need to add documentation.

What documentation do you want, beyond the extensive one in mldsa_native_config.h?

I can add an example. Added an example.

[mkannwischer]

Thanks @hanno-becker for all the work!
Found a few small issues - otherwise I'm very happy with this feature!
Zephyr CI is having some issues, could you fix that?

What documentation do you want, beyond the extensive one in mldsa_native_config.h?

Maybe a paragraph in the root README like we have for DMLD_CONFIG_REDUCE_RAM? We may want to revisit the README before v1 anyway though.

[mkannwischer]

Shall we mark the feature as experimental allowing us to still tweak it after v1 is out?

[mkannwischer]

We need to include stdint.h ... this only works out of luck.
(but the int32_t casts would fail if we would be out of luck)

[mkannwischer]

This never gets executed in CI if I see correctly. Should we add a separate job for it?

[hanno-becker]

This is a good point. I'll switch to 2000 iterations by default at a 10% interval (according to Claude, covering >99.999% of the cases), as well as a single 100k iteration run with a narrower band.

[mkannwischer]

This may read confusing to the reader.
If the default is chosen such that the failure probability is < 2^{-256}, you would use the NIST bound of 814.

[hanno-becker]

Any bound >= 814 has that probability. I deliberately omitted the specific value here because I felt it's irrelevant to the user. But point taken, if you're confused, so will be others. I'll reconsider.

[hanno-becker]

I'll just drop "The default is chosen so that the failure probability is * < 2^{-256}, that is, signatures will practically always succeed." here.

[mkannwischer]

Do we still need MLD_CONFIG_MAX_SIGNING_ATTEMPTS? May be worth removing to reduce complexity for v1.

[hanno-becker]

One could emulate this using an attempt-hook, if we gave the attempt-hook the possibility to inject a failure, not just a pause. But I think the added complexity of this approach -- both on our side, and on the user's side -- outweighs the benefit of removing this option.

One could consider defaulting to 814, but that's slightly odd seeing FIPS204 says one "SHOULD NOT" do this.

Setting this to 814 is quite natural, IMO, to improve observability in case of a faulty implementation looping; esp. on low-end systems.

Altogether, I prefer leaving this option.

[mkannwischer]

I'm not in favor of defaulting to 814 due to the SHOULD NOT.
Still I don't see why any consumer would set MLD_CONFIG_MAX_SIGNING_ATTEMPTS to anything other than 814 or the max value.

What do you think about making it a binary option to use 814 instead of the default?

[hanno-becker]

I'm in favor of keeping it as it is. It gives the consumer more flexibility, if only for testing purposes, without making things any more difficult on our end.

[mkannwischer]

keypair and keypair_internal can now also return MLD_ERR_SIGNING_PAUSED in case PCT and HOOK_ATTEMPT is configured. That should be documented.

[hanno-becker]

No, that's not allowed -- there would be no way to restart the PCT. The combination of hooks and PCT is checked for.

[mkannwischer]

Can you please double check this? The way I read the config (+ config validation) is that PCT is incompatible with RESUME, but not with ATTEMPT. Am I getting something wrong here?

[hanno-becker]

You spotted a real issue there, thank you. Initially, attempt couldn't signal pause (pause was handled via MAX_SIGNING_ATTEMPTS), in which case it was safe to use with PCT. Now, it is indeed ATTEMPT which cannot be used with PCT, while RESUME and FINISH, in theory, could.