Skip to content

Conversation

@mkannwischer
Copy link
Contributor

This PR reduces the stack usage of crypto_sign_verify_internal based on top of #743 using simple restructuring and sharing buffers.

CBMC proofs are not yet adjusted.

@mkannwischer mkannwischer force-pushed the verify-internal-ram branch 2 times, most recently from e5c0a95 to a136a71 Compare November 29, 2025 04:56
@hanno-becker
Copy link
Contributor

Runtime stack usage for verify, according to tests/stack:

| Level      |      main |    branch | Reduction |
|------------|----------:|----------:|----------:|
| ML-DSA-44  |  43,872 B |  18,288 B |      -58% |
| ML-DSA-65  |  69,024 B |  24,960 B |      -64% |
| ML-DSA-87  | 108,112 B |  33,328 B |      -69% |

@hanno-becker

This comment was marked as outdated.

hanno-becker and others added 8 commits December 17, 2025 16:42
- Add mld_polymat_get_row() to retrieve matrix row pointer
- Update mld_polyvec_matrix_pointwise_montgomery() to use helper

Addresses #738 (steps 2-3 of #736)

Signed-off-by: Hanno Becker <[email protected]>
crypto_sign_verify_internal stack:

before: 26928/37232/49776
after: 22784/31040/41536

Signed-off-by: Matthias J. Kannwischer <[email protected]>
crypto_sign_verify_internal stack: 21743/30016/40515

Signed-off-by: Matthias J. Kannwischer <[email protected]>
crypto_sign_verify_internal stack: 17664/24864/33312

Signed-off-by: Matthias J. Kannwischer <[email protected]>
crypto_sign_verify_internal stack: 14592/19744/26144

Signed-off-by: Matthias J. Kannwischer <[email protected]>
crypto_sign_verify_internal stack: 13568/18720/25120

Signed-off-by: Matthias J. Kannwischer <[email protected]>
mkannwischer added a commit that referenced this pull request Jan 9, 2026
This commit is the first of a series of commits reducing the stack usage of
verification.
It is hoisted out from #751

This commit places the t1 and w1 buffers into a union saving K KiB of memory.
As CBMC struggles with unions (issue 8813), we use the same workaround
present in signing: Use a struct by default, and a union when
MLD_CONFIG_REDUCE_RAM is set.

Signed-off-by: Matthias J. Kannwischer <[email protected]>
mkannwischer added a commit that referenced this pull request Jan 9, 2026
This commit is the first of a series of commits reducing the stack usage of
verification.
It is hoisted out from #751

This commit places the t1 and w1 buffers into a union saving K KiB of memory.
Operations using it are slightly reordered such that their lifetime does not
overlap.
As CBMC struggles with unions (issue 8813), we use the same workaround
present in signing: Use a struct by default, and a union when
MLD_CONFIG_REDUCE_RAM is set.

Signed-off-by: Matthias J. Kannwischer <[email protected]>
mkannwischer added a commit that referenced this pull request Jan 9, 2026
This commit is the first of a series of commits reducing the stack usage of
verification.
It is hoisted out from #751

This commit places the t1 and w1 buffers into a union saving K KiB of memory.
Operations using it are slightly reordered such that their lifetime does not
overlap.
As CBMC struggles with unions (issue 8813), we use the same workaround
present in signing: Use a struct by default, and a union when
MLD_CONFIG_REDUCE_RAM is set.

Signed-off-by: Matthias J. Kannwischer <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants