Skip to content

CT: Strengthen post-condition of ct_memcmp #1463

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
mkannwischer merged 1 commit into from
Jan 17, 2026
Merged

CT: Strengthen post-condition of ct_memcmp #1463

mkannwischer merged 1 commit into from
Jan 17, 2026
+2 −1

Conversation

@mkannwischer
Copy link
Contributor

@mkannwischer mkannwischer commented Jan 8, 2026

To align with mldsa-native, this ports the strengthening of the post-condition: The return value is now guaranteed to be 0x00 (equal) or 0xFF (not-equal), rather than 0x00 (equal), not-0x00 (not-equal).

@mkannwischer
Copy link
Contributor Author

mkannwischer commented Jan 8, 2026

Should we rename verify.{c,h} to ct.{c,h} to align with mldsa-native?
It does not have much in common with the reference implementation's verify anymore.

@mkannwischer mkannwischer marked this pull request as ready for review January 17, 2026 06:16
@mkannwischer mkannwischer requested a review from a team as a code owner January 17, 2026 06:16
@mkannwischer
CT: Strengthen post-condition of ct_memcmp
b6b3b95 
To align with mldsa-native, this ports the strengthening of the
post-condition: The return value is now guaranteed to be 0x00 (equal) or
0xFF (not-equal), rather than 0x00 (equal), not-0x00 (not-equal).

Signed-off-by: Matthias J. Kannwischer <[email protected]>
@oqs-bot
Copy link
Contributor

oqs-bot commented Jan 17, 2026

CBMC Results (ML-KEM-512)

⚠️ Attention Required

Proof Status Current Previous Change
mlk_keccak_squeezeblocks_x4 ⚠️ 122s 80s +52%
Full Results (139 proofs)
Proof Status Current Previous Change
mlk_indcpa_keypair_derand ✅ 165s 195s -15%
mlk_indcpa_enc ✅ 163s 141s +16%
mlk_keccak_squeezeblocks_x4 ⚠️ 122s 80s +52%
mlk_rej_uniform_c ✅ 67s 67s +0%
mlk_polyvec_basemul_acc_montgomery_cached_c ✅ 39s 43s -9%
mlk_poly_rej_uniform ✅ 31s 34s -9%
mlk_ntt_layer ✅ 22s 18s +22%
keccakf1600x4_permute_native_x4 ✅ 19s 18s +6%
poly_ntt_native ✅ 19s 25s -24%
polyvec_basemul_acc_montgomery_cached_native ✅ 19s 21s -10%
mlk_poly_reduce_native ✅ 13s 12s +8%
mlk_indcpa_dec ✅ 10s 11s -9%
mlk_keccak_absorb_once_x4 ✅ 10s 12s -17%
mlk_ntt_butterfly_block ✅ 10s 7s +43%
mlk_fqmul ✅ 8s 6s +33%
mlk_poly_rej_uniform_x4 ✅ 8s 8s +0%
mlk_poly_sub ✅ 8s 9s -11%
mlk_polyvec_add ✅ 8s 8s +0%
keccakf1600_permute_native ✅ 7s 4s +75%
mlk_keccak_squeeze_once ✅ 7s 7s +0%
mlk_keccak_squeezeblocks ✅ 7s 7s +0%
mlk_poly_frombytes_native ✅ 7s 5s +40%
mlk_poly_frommsg ✅ 7s 5s +40%
kem_dec ✅ 5s 5s +0%
mlk_ct_memcmp ✅ 5s 3s +67%
mlk_keccakf1600x4_xor_bytes ✅ 5s 1s +400%
mlk_poly_getnoise_eta1_4x ✅ 5s 5s +0%
mlk_polymat_permute_bitrev_to_custom ✅ 5s 3s +67%
mlk_polyvec_permute_bitrev_to_custom_native ✅ 5s 2s +150%
rej_uniform_native_aarch64 ✅ 5s 3s +67%
kem_check_pk ✅ 4s 7s -43%
kem_enc ✅ 4s 3s +33%
kem_enc_derand ✅ 4s 3s +33%
kem_keypair ✅ 4s 2s +100%
mlk_gen_matrix_serial ✅ 4s 1s +300%
mlk_invntt_layer ✅ 4s 3s +33%
mlk_keccakf1600_permute ✅ 4s 3s +33%
mlk_poly_compress_du ✅ 4s 3s +33%
mlk_poly_compress_dv ✅ 4s 3s +33%
mlk_poly_decompress_dv ✅ 4s 2s +100%
mlk_poly_getnoise_eta2 ✅ 4s 3s +33%
mlk_poly_mulcache_compute_native ✅ 4s 3s +33%
mlk_rej_uniform ✅ 4s 4s +0%
mlk_shake256x4 ✅ 4s 5s -20%
mlk_value_barrier_u32 ✅ 4s 2s +100%
intt_native_aarch64 ✅ 3s 2s +50%
kem_check_sk ✅ 3s 2s +50%
mlk_ct_cmov_zero ✅ 3s 3s +0%
mlk_keccak_absorb_once ✅ 3s 3s +0%
mlk_keccakf1600_xor_bytes ✅ 3s 1s +200%
mlk_keccakf1600_xor_bytes (big endian) ✅ 3s 2s +50%
mlk_keccakf1600x4_extract_bytes ✅ 3s 2s +50%
mlk_poly_cbd_eta2 ✅ 3s 3s +0%
mlk_poly_getnoise_eta1122_4x ✅ 3s 3s +0%
mlk_poly_invntt_tomont_c ✅ 3s 3s +0%
mlk_poly_mulcache_compute_c ✅ 3s 3s +0%
mlk_poly_reduce_c ✅ 3s 2s +50%
mlk_poly_tobytes_c ✅ 3s 3s +0%
mlk_polyvec_basemul_acc_montgomery_cached ✅ 3s 4s -25%
mlk_polyvec_frombytes ✅ 3s 2s +50%
mlk_polyvec_invntt_tomont ✅ 3s 2s +50%
mlk_polyvec_mulcache_compute ✅ 3s 2s +50%
mlk_polyvec_tomont ✅ 3s 2s +50%
mlk_scalar_compress_d1 ✅ 3s 2s +50%
mlk_scalar_compress_d5 ✅ 3s 2s +50%
mlk_scalar_decompress_d4 ✅ 3s 2s +50%
mlk_scalar_decompress_d5 ✅ 3s 1s +200%
mlk_scalar_signed_to_unsigned_q ✅ 3s 2s +50%
mlk_sha3_256 ✅ 3s 3s +0%
mlk_shake128x4_squeezeblocks ✅ 3s 3s +0%
mlk_shake256 ✅ 3s 2s +50%
mlk_value_barrier_i32 ✅ 3s 2s +50%
mlk_value_barrier_u8 ✅ 3s 2s +50%
poly_mulcache_compute_native_aarch64 ✅ 3s 4s -25%
poly_tomont_native_aarch64 ✅ 3s 3s +0%
polyvec_basemul_acc_montgomery_cached_k4_native_aarch64 ✅ 3s 2s +50%
sys_check_capability ✅ 3s 3s +0%
keccak_f1600_x1_native_aarch64 ✅ 2s 3s -33%
keccak_f1600_x4_native_aarch64_v8a_v84a_scalar_hybrid ✅ 2s 3s -33%
kem_keypair_derand ✅ 2s 5s -60%
mlk_barrett_reduce ✅ 2s 3s -33%
mlk_check_pct ✅ 2s 3s -33%
mlk_ct_cmask_nonzero_u16 ✅ 2s 1s +100%
mlk_ct_cmask_nonzero_u8 ✅ 2s 2s +0%
mlk_ct_sel_int16 ✅ 2s 2s +0%
mlk_ct_sel_uint8 ✅ 2s 2s +0%
mlk_gen_matrix ✅ 2s 5s -60%
mlk_keccakf1600x4_permute ✅ 2s 2s +0%
mlk_matvec_mul ✅ 2s 4s -50%
mlk_poly_add ✅ 2s 2s +0%
mlk_poly_cbd_eta1 ✅ 2s 2s +0%
mlk_poly_frombytes ✅ 2s 1s +100%
mlk_poly_ntt ✅ 2s 3s -33%
mlk_poly_tobytes ✅ 2s 3s -33%
mlk_poly_tobytes_native ✅ 2s 5s -60%
mlk_poly_tomont_c ✅ 2s 3s -33%
mlk_poly_tomont_native ✅ 2s 2s +0%
mlk_poly_tomsg ✅ 2s 2s +0%
mlk_polyvec_compress_du ✅ 2s 3s -33%
mlk_scalar_compress_d10 ✅ 2s 1s +100%
mlk_scalar_decompress_d10 ✅ 2s 2s +0%
mlk_scalar_decompress_d11 ✅ 2s 2s +0%
mlk_sha3_512 ✅ 2s 2s +0%
mlk_shake128_absorb_once ✅ 2s 1s +100%
poly_getnoise_eta1122_4x_native ✅ 2s 1s +100%
poly_reduce_native_aarch64 ✅ 2s 2s +0%
poly_tobytes_native_aarch64 ✅ 2s 1s +100%
polyvec_basemul_acc_montgomery_cached_k2_native_aarch64 ✅ 2s 1s +100%
polyvec_basemul_acc_montgomery_cached_k3_native_aarch64 ✅ 2s 2s +0%
keccak_f1600_x1_native_aarch64_v84a ✅ 1s 2s -50%
keccak_f1600_x4_native_aarch64_v84a ✅ 1s 1s +0%
keccak_f1600_x4_native_aarch64_v8a_scalar_hybrid ✅ 1s 2s -50%
mlk_ct_cmask_neg_i16 ✅ 1s 3s -67%
mlk_ct_get_optblocker_i32 ✅ 1s 1s +0%
mlk_ct_get_optblocker_u32 ✅ 1s 2s -50%
mlk_ct_get_optblocker_u8 ✅ 1s 4s -75%
mlk_keccakf1600_extract_bytes ✅ 1s 1s +0%
mlk_keccakf1600_extract_bytes (big endian) ✅ 1s 2s -50%
mlk_montgomery_reduce ✅ 1s 3s -67%
mlk_poly_decompress_du ✅ 1s 2s -50%
mlk_poly_frombytes_c ✅ 1s 3s -67%
mlk_poly_getnoise_eta1_4x_native ✅ 1s 1s +0%
mlk_poly_invntt_tomont ✅ 1s 1s +0%
mlk_poly_mulcache_compute ✅ 1s 2s -50%
mlk_poly_ntt_c ✅ 1s 4s -75%
mlk_poly_reduce ✅ 1s 2s -50%
mlk_poly_tomont ✅ 1s 3s -67%
mlk_polyvec_decompress_du ✅ 1s 2s -50%
mlk_polyvec_ntt ✅ 1s 3s -67%
mlk_polyvec_permute_bitrev_to_custom ✅ 1s 4s -75%
mlk_polyvec_reduce ✅ 1s 4s -75%
mlk_polyvec_tobytes ✅ 1s 2s -50%
mlk_scalar_compress_d11 ✅ 1s 5s -80%
mlk_scalar_compress_d4 ✅ 1s 2s -50%
mlk_shake128_squeezeblocks ✅ 1s 2s -50%
mlk_shake128x4_absorb_once ✅ 1s 2s -50%
ntt_native_aarch64 ✅ 1s 3s -67%
poly_invntt_tomont_native ✅ 1s 1s +0%
rej_uniform_native ✅ 1s 4s -75%

@oqs-bot
Copy link
Contributor

oqs-bot commented Jan 17, 2026

CBMC Results (ML-KEM-1024)

⚠️ Attention Required

Proof Status Current Previous Change
mlk_keccak_squeezeblocks_x4 ⚠️ 137s 78s +76%
poly_ntt_native ⚠️ 43s 24s +79%
Full Results (139 proofs)
Proof Status Current Previous Change
mlk_indcpa_enc ✅ 372s 267s +39%
mlk_indcpa_keypair_derand ✅ 266s 287s -7%
mlk_keccak_squeezeblocks_x4 ⚠️ 137s 78s +76%
mlk_polyvec_add ✅ 129s 122s +6%
polyvec_basemul_acc_montgomery_cached_native ✅ 124s 113s +10%
mlk_rej_uniform_c ✅ 86s 69s +25%
mlk_polyvec_basemul_acc_montgomery_cached_c ✅ 49s 47s +4%
poly_ntt_native ⚠️ 43s 24s +79%
mlk_poly_rej_uniform ✅ 42s 37s +14%
mlk_poly_decompress_dv ✅ 32s 22s +45%
mlk_ntt_layer ✅ 30s 22s +36%
mlk_indcpa_dec ✅ 21s 15s +40%
keccakf1600x4_permute_native_x4 ✅ 19s 21s -10%
mlk_poly_reduce_native ✅ 15s 13s +15%
mlk_poly_frombytes_native ✅ 12s 10s +20%
mlk_keccak_absorb_once_x4 ✅ 10s 9s +11%
mlk_ntt_butterfly_block ✅ 10s 9s +11%
mlk_poly_sub ✅ 10s 9s +11%
mlk_poly_frommsg ✅ 8s 14s -43%
kem_dec ✅ 7s 6s +17%
mlk_gen_matrix ✅ 7s 7s +0%
mlk_poly_rej_uniform_x4 ✅ 7s 8s -12%
keccakf1600_permute_native ✅ 6s 5s +20%
mlk_fqmul ✅ 6s 6s +0%
mlk_keccak_squeeze_once ✅ 6s 6s +0%
mlk_keccak_squeezeblocks ✅ 6s 8s -25%
mlk_poly_compress_du ✅ 6s 5s +20%
mlk_polymat_permute_bitrev_to_custom ✅ 6s 4s +50%
mlk_sha3_512 ✅ 6s 3s +100%
kem_check_pk ✅ 5s 2s +150%
mlk_gen_matrix_serial ✅ 5s 5s +0%
mlk_poly_tobytes_c ✅ 5s 3s +67%
mlk_poly_tomont ✅ 5s 1s +400%
mlk_polyvec_tobytes ✅ 5s 1s +400%
mlk_shake256x4 ✅ 5s 3s +67%
polyvec_basemul_acc_montgomery_cached_k4_native_aarch64 ✅ 5s 2s +150%
kem_enc ✅ 4s 2s +100%
mlk_check_pct ✅ 4s 2s +100%
mlk_ct_cmask_nonzero_u8 ✅ 4s 1s +300%
mlk_invntt_layer ✅ 4s 5s -20%
mlk_keccak_absorb_once ✅ 4s 6s -33%
mlk_keccakf1600x4_extract_bytes ✅ 4s 3s +33%
mlk_matvec_mul ✅ 4s 3s +33%
mlk_poly_cbd_eta2 ✅ 4s 4s +0%
mlk_poly_getnoise_eta1_4x ✅ 4s 1s +300%
mlk_poly_getnoise_eta1_4x_native ✅ 4s 2s +100%
mlk_poly_getnoise_eta2 ✅ 4s 2s +100%
mlk_poly_mulcache_compute_native ✅ 4s 2s +100%
mlk_polyvec_invntt_tomont ✅ 4s 4s +0%
mlk_polyvec_ntt ✅ 4s 12s -67%
mlk_polyvec_permute_bitrev_to_custom_native ✅ 4s 3s +33%
mlk_polyvec_reduce ✅ 4s 3s +33%
mlk_shake256 ✅ 4s 5s -20%
mlk_value_barrier_i32 ✅ 4s 2s +100%
poly_tobytes_native_aarch64 ✅ 4s 2s +100%
rej_uniform_native_aarch64 ✅ 4s 4s +0%
sys_check_capability ✅ 4s 4s +0%
keccak_f1600_x1_native_aarch64_v84a ✅ 3s 1s +200%
keccak_f1600_x4_native_aarch64_v8a_v84a_scalar_hybrid ✅ 3s 1s +200%
kem_keypair ✅ 3s 3s +0%
kem_keypair_derand ✅ 3s 1s +200%
mlk_ct_get_optblocker_i32 ✅ 3s 2s +50%
mlk_ct_get_optblocker_u8 ✅ 3s 1s +200%
mlk_keccakf1600_permute ✅ 3s 2s +50%
mlk_keccakf1600_xor_bytes ✅ 3s 3s +0%
mlk_keccakf1600x4_permute ✅ 3s 2s +50%
mlk_keccakf1600x4_xor_bytes ✅ 3s 1s +200%
mlk_poly_cbd_eta1 ✅ 3s 3s +0%
mlk_poly_mulcache_compute ✅ 3s 2s +50%
mlk_poly_mulcache_compute_c ✅ 3s 3s +0%
mlk_poly_ntt_c ✅ 3s 4s -25%
mlk_poly_reduce ✅ 3s 2s +50%
mlk_poly_tobytes_native ✅ 3s 2s +50%
mlk_polyvec_mulcache_compute ✅ 3s 3s +0%
mlk_rej_uniform ✅ 3s 3s +0%
mlk_scalar_decompress_d4 ✅ 3s 3s +0%
mlk_shake128_squeezeblocks ✅ 3s 2s +50%
mlk_shake128x4_absorb_once ✅ 3s 2s +50%
mlk_value_barrier_u8 ✅ 3s 2s +50%
ntt_native_aarch64 ✅ 3s 1s +200%
poly_mulcache_compute_native_aarch64 ✅ 3s 2s +50%
polyvec_basemul_acc_montgomery_cached_k3_native_aarch64 ✅ 3s 2s +50%
rej_uniform_native ✅ 3s 1s +200%
keccak_f1600_x4_native_aarch64_v8a_scalar_hybrid ✅ 2s 1s +100%
kem_enc_derand ✅ 2s 2s +0%
mlk_barrett_reduce ✅ 2s 3s -33%
mlk_ct_cmask_neg_i16 ✅ 2s 2s +0%
mlk_ct_sel_int16 ✅ 2s 2s +0%
mlk_keccakf1600_extract_bytes (big endian) ✅ 2s 2s +0%
mlk_keccakf1600_xor_bytes (big endian) ✅ 2s 1s +100%
mlk_montgomery_reduce ✅ 2s 3s -33%
mlk_poly_compress_dv ✅ 2s 2s +0%
mlk_poly_decompress_du ✅ 2s 3s -33%
mlk_poly_frombytes_c ✅ 2s 2s +0%
mlk_poly_invntt_tomont ✅ 2s 3s -33%
mlk_poly_invntt_tomont_c ✅ 2s 3s -33%
mlk_poly_ntt ✅ 2s 4s -50%
mlk_poly_reduce_c ✅ 2s 3s -33%
mlk_poly_tobytes ✅ 2s 2s +0%
mlk_poly_tomont_c ✅ 2s 2s +0%
mlk_poly_tomont_native ✅ 2s 1s +100%
mlk_poly_tomsg ✅ 2s 2s +0%
mlk_polyvec_basemul_acc_montgomery_cached ✅ 2s 2s +0%
mlk_polyvec_compress_du ✅ 2s 3s -33%
mlk_polyvec_decompress_du ✅ 2s 3s -33%
mlk_polyvec_permute_bitrev_to_custom ✅ 2s 2s +0%
mlk_polyvec_tomont ✅ 2s 2s +0%
mlk_scalar_compress_d1 ✅ 2s 2s +0%
mlk_scalar_compress_d10 ✅ 2s 2s +0%
mlk_scalar_compress_d11 ✅ 2s 6s -67%
mlk_scalar_compress_d4 ✅ 2s 3s -33%
mlk_scalar_decompress_d5 ✅ 2s 2s +0%
mlk_scalar_signed_to_unsigned_q ✅ 2s 3s -33%
mlk_shake128_absorb_once ✅ 2s 1s +100%
mlk_shake128x4_squeezeblocks ✅ 2s 4s -50%
mlk_value_barrier_u32 ✅ 2s 3s -33%
poly_invntt_tomont_native ✅ 2s 2s +0%
poly_tomont_native_aarch64 ✅ 2s 3s -33%
polyvec_basemul_acc_montgomery_cached_k2_native_aarch64 ✅ 2s 2s +0%
intt_native_aarch64 ✅ 1s 4s -75%
keccak_f1600_x1_native_aarch64 ✅ 1s 1s +0%
keccak_f1600_x4_native_aarch64_v84a ✅ 1s 2s -50%
kem_check_sk ✅ 1s 3s -67%
mlk_ct_cmask_nonzero_u16 ✅ 1s 2s -50%
mlk_ct_cmov_zero ✅ 1s 2s -50%
mlk_ct_get_optblocker_u32 ✅ 1s 1s +0%
mlk_ct_memcmp ✅ 1s 2s -50%
mlk_ct_sel_uint8 ✅ 1s 3s -67%
mlk_keccakf1600_extract_bytes ✅ 1s 2s -50%
mlk_poly_add ✅ 1s 3s -67%
mlk_poly_frombytes ✅ 1s 2s -50%
mlk_poly_getnoise_eta1122_4x ✅ 1s 2s -50%
mlk_polyvec_frombytes ✅ 1s 1s +0%
mlk_scalar_compress_d5 ✅ 1s 1s +0%
mlk_scalar_decompress_d10 ✅ 1s 2s -50%
mlk_scalar_decompress_d11 ✅ 1s 1s +0%
mlk_sha3_256 ✅ 1s 3s -67%
poly_getnoise_eta1122_4x_native ✅ 1s 3s -67%
poly_reduce_native_aarch64 ✅ 1s 2s -50%

@oqs-bot
Copy link
Contributor

oqs-bot commented Jan 17, 2026

CBMC Results (ML-KEM-768)

⚠️ Attention Required

Proof Status Current Previous Change
mlk_indcpa_keypair_derand ⚠️ 386s 218s +77%
poly_ntt_native ⚠️ 51s 31s +65%
Full Results (139 proofs)
Proof Status Current Previous Change
mlk_indcpa_keypair_derand ⚠️ 386s 218s +77%
mlk_indcpa_enc ✅ 240s 238s +1%
mlk_keccak_squeezeblocks_x4 ✅ 130s 143s -9%
mlk_rej_uniform_c ✅ 88s 80s +10%
mlk_polyvec_basemul_acc_montgomery_cached_c ✅ 83s 79s +5%
polyvec_basemul_acc_montgomery_cached_native ✅ 61s 59s +3%
poly_ntt_native ⚠️ 51s 31s +65%
mlk_poly_rej_uniform ✅ 42s 43s -2%
mlk_ntt_layer ✅ 29s 29s +0%
keccakf1600x4_permute_native_x4 ✅ 20s 18s +11%
mlk_indcpa_dec ✅ 17s 17s +0%
mlk_poly_reduce_native ✅ 17s 15s +13%
mlk_polyvec_add ✅ 12s 10s +20%
mlk_keccak_absorb_once_x4 ✅ 11s 9s +22%
mlk_ntt_butterfly_block ✅ 11s 10s +10%
mlk_poly_sub ✅ 11s 11s +0%
mlk_keccak_squeeze_once ✅ 8s 6s +33%
mlk_keccak_squeezeblocks ✅ 8s 9s -11%
mlk_poly_rej_uniform_x4 ✅ 8s 8s +0%
kem_dec ✅ 7s 3s +133%
mlk_poly_frombytes_native ✅ 7s 9s -22%
mlk_gen_matrix_serial ✅ 6s 5s +20%
mlk_invntt_layer ✅ 6s 6s +0%
mlk_poly_frommsg ✅ 6s 8s -25%
mlk_polymat_permute_bitrev_to_custom ✅ 6s 4s +50%
mlk_scalar_compress_d11 ✅ 6s 4s +50%
mlk_scalar_compress_d5 ✅ 6s 2s +200%
poly_invntt_tomont_native ✅ 6s 3s +100%
kem_enc_derand ✅ 5s 2s +150%
mlk_fqmul ✅ 5s 6s -17%
mlk_gen_matrix ✅ 5s 3s +67%
mlk_keccak_absorb_once ✅ 5s 5s +0%
keccak_f1600_x4_native_aarch64_v84a ✅ 4s 2s +100%
keccakf1600_permute_native ✅ 4s 7s -43%
kem_check_pk ✅ 4s 2s +100%
mlk_check_pct ✅ 4s 4s +0%
mlk_matvec_mul ✅ 4s 3s +33%
mlk_poly_cbd_eta1 ✅ 4s 3s +33%
mlk_poly_compress_du ✅ 4s 3s +33%
mlk_poly_getnoise_eta2 ✅ 4s 2s +100%
mlk_poly_ntt ✅ 4s 2s +100%
mlk_poly_ntt_c ✅ 4s 1s +300%
mlk_poly_tobytes_c ✅ 4s 3s +33%
mlk_poly_tomont_c ✅ 4s 2s +100%
mlk_polyvec_compress_du ✅ 4s 3s +33%
mlk_polyvec_mulcache_compute ✅ 4s 3s +33%
mlk_polyvec_permute_bitrev_to_custom_native ✅ 4s 1s +300%
mlk_sha3_256 ✅ 4s 2s +100%
mlk_shake128_absorb_once ✅ 4s 2s +100%
mlk_shake256x4 ✅ 4s 2s +100%
keccak_f1600_x4_native_aarch64_v8a_v84a_scalar_hybrid ✅ 3s 2s +50%
kem_check_sk ✅ 3s 3s +0%
kem_keypair ✅ 3s 1s +200%
mlk_ct_cmov_zero ✅ 3s 2s +50%
mlk_ct_get_optblocker_i32 ✅ 3s 2s +50%
mlk_ct_get_optblocker_u8 ✅ 3s 1s +200%
mlk_ct_memcmp ✅ 3s 3s +0%
mlk_ct_sel_int16 ✅ 3s 1s +200%
mlk_keccakf1600_extract_bytes (big endian) ✅ 3s 2s +50%
mlk_keccakf1600_permute ✅ 3s 3s +0%
mlk_poly_cbd_eta2 ✅ 3s 3s +0%
mlk_poly_decompress_dv ✅ 3s 2s +50%
mlk_poly_getnoise_eta1122_4x ✅ 3s 2s +50%
mlk_poly_getnoise_eta1_4x ✅ 3s 3s +0%
mlk_poly_invntt_tomont ✅ 3s 1s +200%
mlk_poly_invntt_tomont_c ✅ 3s 1s +200%
mlk_poly_mulcache_compute_native ✅ 3s 4s -25%
mlk_poly_reduce ✅ 3s 3s +0%
mlk_poly_tomont ✅ 3s 3s +0%
mlk_polyvec_basemul_acc_montgomery_cached ✅ 3s 2s +50%
mlk_polyvec_decompress_du ✅ 3s 2s +50%
mlk_polyvec_frombytes ✅ 3s 3s +0%
mlk_polyvec_tobytes ✅ 3s 5s -40%
mlk_rej_uniform ✅ 3s 2s +50%
mlk_scalar_compress_d4 ✅ 3s 1s +200%
mlk_scalar_decompress_d10 ✅ 3s 4s -25%
mlk_scalar_decompress_d4 ✅ 3s 3s +0%
mlk_scalar_decompress_d5 ✅ 3s 2s +50%
mlk_scalar_signed_to_unsigned_q ✅ 3s 1s +200%
mlk_shake128x4_squeezeblocks ✅ 3s 2s +50%
mlk_value_barrier_i32 ✅ 3s 2s +50%
ntt_native_aarch64 ✅ 3s 3s +0%
poly_mulcache_compute_native_aarch64 ✅ 3s 3s +0%
polyvec_basemul_acc_montgomery_cached_k2_native_aarch64 ✅ 3s 3s +0%
polyvec_basemul_acc_montgomery_cached_k3_native_aarch64 ✅ 3s 2s +50%
polyvec_basemul_acc_montgomery_cached_k4_native_aarch64 ✅ 3s 3s +0%
intt_native_aarch64 ✅ 2s 3s -33%
kem_enc ✅ 2s 1s +100%
mlk_barrett_reduce ✅ 2s 1s +100%
mlk_ct_cmask_neg_i16 ✅ 2s 1s +100%
mlk_ct_cmask_nonzero_u8 ✅ 2s 1s +100%
mlk_ct_sel_uint8 ✅ 2s 2s +0%
mlk_keccakf1600_extract_bytes ✅ 2s 3s -33%
mlk_keccakf1600_xor_bytes ✅ 2s 3s -33%
mlk_keccakf1600_xor_bytes (big endian) ✅ 2s 3s -33%
mlk_keccakf1600x4_xor_bytes ✅ 2s 4s -50%
mlk_montgomery_reduce ✅ 2s 3s -33%
mlk_poly_add ✅ 2s 2s +0%
mlk_poly_frombytes ✅ 2s 2s +0%
mlk_poly_frombytes_c ✅ 2s 3s -33%
mlk_poly_mulcache_compute ✅ 2s 4s -50%
mlk_poly_reduce_c ✅ 2s 7s -71%
mlk_poly_tomont_native ✅ 2s 3s -33%
mlk_poly_tomsg ✅ 2s 2s +0%
mlk_polyvec_permute_bitrev_to_custom ✅ 2s 2s +0%
mlk_polyvec_reduce ✅ 2s 1s +100%
mlk_polyvec_tomont ✅ 2s 2s +0%
mlk_scalar_compress_d1 ✅ 2s 2s +0%
mlk_scalar_compress_d10 ✅ 2s 2s +0%
mlk_sha3_512 ✅ 2s 2s +0%
mlk_shake128x4_absorb_once ✅ 2s 1s +100%
mlk_value_barrier_u8 ✅ 2s 2s +0%
poly_reduce_native_aarch64 ✅ 2s 3s -33%
poly_tomont_native_aarch64 ✅ 2s 1s +100%
rej_uniform_native ✅ 2s 2s +0%
rej_uniform_native_aarch64 ✅ 2s 1s +100%
sys_check_capability ✅ 2s 3s -33%
keccak_f1600_x1_native_aarch64 ✅ 1s 2s -50%
keccak_f1600_x1_native_aarch64_v84a ✅ 1s 1s +0%
keccak_f1600_x4_native_aarch64_v8a_scalar_hybrid ✅ 1s 2s -50%
kem_keypair_derand ✅ 1s 3s -67%
mlk_ct_cmask_nonzero_u16 ✅ 1s 3s -67%
mlk_ct_get_optblocker_u32 ✅ 1s 3s -67%
mlk_keccakf1600x4_extract_bytes ✅ 1s 1s +0%
mlk_keccakf1600x4_permute ✅ 1s 2s -50%
mlk_poly_compress_dv ✅ 1s 4s -75%
mlk_poly_decompress_du ✅ 1s 1s +0%
mlk_poly_getnoise_eta1_4x_native ✅ 1s 1s +0%
mlk_poly_mulcache_compute_c ✅ 1s 1s +0%
mlk_poly_tobytes ✅ 1s 3s -67%
mlk_poly_tobytes_native ✅ 1s 2s -50%
mlk_polyvec_invntt_tomont ✅ 1s 2s -50%
mlk_polyvec_ntt ✅ 1s 2s -50%
mlk_scalar_decompress_d11 ✅ 1s 3s -67%
mlk_shake128_squeezeblocks ✅ 1s 3s -67%
mlk_shake256 ✅ 1s 3s -67%
mlk_value_barrier_u32 ✅ 1s 2s -50%
poly_getnoise_eta1122_4x_native ✅ 1s 3s -67%
poly_tobytes_native_aarch64 ✅ 1s 2s -50%

@mkannwischer mkannwischer merged commit 51f6420 into main Jan 17, 2026
779 of 781 checks passed
@mkannwischer mkannwischer deleted the ct-memcmp branch January 17, 2026 08:47
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@hanno-becker hanno-becker hanno-becker approved these changes

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

4 participants

@mkannwischer @oqs-bot @hanno-becker