keygen: Stream s1 and s2 to reduce memory footprint

[mkannwischer]

Key generation held s1 and s2 as full vectors from sampling until the end, although both are only needed one polynomial at a time: s1 for the bit-packing and the in-place NTT, s2 as the addend of row k of A*s1hat + s2.

Sampling now runs in batches of MLD_SAMPLE_BATCH polynomials that are bit-packed into sk as they are produced, so only the batch is held in memory; s1 is read back from sk for the in-place NTT.

The batch size is fixed at four regardless of
MLD_CONFIG_SERIAL_FIPS202_ONLY so that the allocation does not depend on the FIPS202 backend configuration.

mld_compute_pack_t0_t1 correspondingly takes the bit-packed s2 and unpacks row k on demand into the scratch buffer that afterwards receives t1[k].

Keypair allocation in bytes:

              default            REDUCE_RAM
  ML-DSA-44   26912 -> 22816    11584 ->  7488
  ML-DSA-65   44320 -> 38176    14656 ->  8512
  ML-DSA-87   75040 -> 66848    18752 -> 10560

[github-actions]

Mac Mini (M1, 2020) benchmarks (opt)

Details

Benchmark suite	Current: d754692	Previous: 5a21649	Ratio
ML-DSA-44 keypair	48150 cycles	46514 cycles	1.04
ML-DSA-44 sign	132054 cycles	131105 cycles	1.01
ML-DSA-44 verify	47630 cycles	47334 cycles	1.01
ML-DSA-65 keypair	82591 cycles	81690 cycles	1.01
ML-DSA-65 sign	217115 cycles	215357 cycles	1.01
ML-DSA-65 verify	79875 cycles	79299 cycles	1.01
ML-DSA-87 keypair	134952 cycles	132541 cycles	1.02
ML-DSA-87 sign	277896 cycles	277657 cycles	1.00
ML-DSA-87 verify	133728 cycles	133600 cycles	1.00

This comment was automatically generated by workflow using github-action-benchmark.

[github-actions]

Mac Mini (M1, 2020) benchmarks (no-opt)

Details

Benchmark suite	Current: d754692	Previous: 5a21649	Ratio
ML-DSA-44 keypair	114994 cycles	112756 cycles	1.02
ML-DSA-44 sign	404028 cycles	401203 cycles	1.01
ML-DSA-44 verify	120301 cycles	119382 cycles	1.01
ML-DSA-65 keypair	249079 cycles	192915 cycles	1.29
ML-DSA-65 sign	651172 cycles	649931 cycles	1.00
ML-DSA-65 verify	193282 cycles	193012 cycles	1.00
ML-DSA-87 keypair	321866 cycles	318911 cycles	1.01
ML-DSA-87 sign	830037 cycles	828661 cycles	1.00
ML-DSA-87 verify	322354 cycles	321767 cycles	1.00

This comment was automatically generated by workflow using github-action-benchmark.

[github-actions]

⚠️ Performance Alert ⚠️

Possible performance regression was detected for benchmark 'Mac Mini (M1, 2020) benchmarks (no-opt)'.
Benchmark result of this commit is worse than the previous benchmark result exceeding threshold 1.03.

Benchmark suite	Current: d754692	Previous: 5a21649	Ratio
ML-DSA-65 keypair	249079 cycles	192915 cycles	1.29

This comment was automatically generated by workflow using github-action-benchmark.

[github-actions]

Arm Cortex-A72 (Raspberry Pi 4) benchmarks (opt)

Details

Benchmark suite	Current: d754692	Previous: 5a21649	Ratio
ML-DSA-44 keypair	219794 cycles	216756 cycles	1.01
ML-DSA-44 sign	593490 cycles	599662 cycles	0.99
ML-DSA-44 verify	215712 cycles	218576 cycles	0.99
ML-DSA-65 keypair	383319 cycles	382553 cycles	1.00
ML-DSA-65 sign	986023 cycles	991078 cycles	0.99
ML-DSA-65 verify	365839 cycles	366619 cycles	1.00
ML-DSA-87 keypair	643917 cycles	643881 cycles	1.00
ML-DSA-87 sign	1308035 cycles	1331767 cycles	0.98
ML-DSA-87 verify	617303 cycles	621211 cycles	0.99

This comment was automatically generated by workflow using github-action-benchmark.

[oqs-bot]

Intel Xeon 4th gen (c7i)

Details

Benchmark suite	Current: d754692	Previous: 5a21649	Ratio
ML-DSA-44 keypair	44718 cycles	43430 cycles	1.03
ML-DSA-44 sign	130135 cycles	130083 cycles	1.00
ML-DSA-44 verify	45240 cycles	45192 cycles	1.00
ML-DSA-65 keypair	75701 cycles	75802 cycles	1.00
ML-DSA-65 sign	213842 cycles	213832 cycles	1.00
ML-DSA-65 verify	74378 cycles	74497 cycles	1.00
ML-DSA-87 keypair	125582 cycles	122973 cycles	1.02
ML-DSA-87 sign	271157 cycles	271178 cycles	1.00
ML-DSA-87 verify	120753 cycles	120739 cycles	1.00

This comment was automatically generated by workflow using github-action-benchmark.

[oqs-bot]

Intel Xeon 4th gen (c7i) (no-opt)

Details

Benchmark suite	Current: d754692	Previous: 5a21649	Ratio
ML-DSA-44 keypair	92534 cycles	91692 cycles	1.01
ML-DSA-44 sign	349981 cycles	351662 cycles	1.00
ML-DSA-44 verify	99774 cycles	99535 cycles	1.00
ML-DSA-65 keypair	154772 cycles	154072 cycles	1.00
ML-DSA-65 sign	569039 cycles	567980 cycles	1.00
ML-DSA-65 verify	159367 cycles	159633 cycles	1.00
ML-DSA-87 keypair	259282 cycles	255184 cycles	1.02
ML-DSA-87 sign	719628 cycles	719063 cycles	1.00
ML-DSA-87 verify	263524 cycles	263975 cycles	1.00

This comment was automatically generated by workflow using github-action-benchmark.

[oqs-bot]

AMD EPYC 4th gen (c7a)

Details

Benchmark suite	Current: d754692	Previous: 5a21649	Ratio
ML-DSA-44 keypair	48574 cycles	47069 cycles	1.03
ML-DSA-44 sign	139001 cycles	140117 cycles	0.99
ML-DSA-44 verify	49481 cycles	49586 cycles	1.00
ML-DSA-65 keypair	82793 cycles	82975 cycles	1.00
ML-DSA-65 sign	229613 cycles	228193 cycles	1.01
ML-DSA-65 verify	82681 cycles	82573 cycles	1.00
ML-DSA-87 keypair	133398 cycles	130858 cycles	1.02
ML-DSA-87 sign	281230 cycles	281432 cycles	1.00
ML-DSA-87 verify	129188 cycles	129429 cycles	1.00

This comment was automatically generated by workflow using github-action-benchmark.

[oqs-bot]

⚠️ Performance Alert ⚠️

Possible performance regression was detected for benchmark 'AMD EPYC 4th gen (c7a)'.
Benchmark result of this commit is worse than the previous benchmark result exceeding threshold 1.03.

Benchmark suite	Current: d754692	Previous: 5a21649	Ratio
ML-DSA-44 keypair	48574 cycles	47069 cycles	1.03

This comment was automatically generated by workflow using github-action-benchmark.

[oqs-bot]

AMD EPYC 3rd gen (c6a)

Details

Benchmark suite	Current: d754692	Previous: 5a21649	Ratio
ML-DSA-44 keypair	53680 cycles	52044 cycles	1.03
ML-DSA-44 sign	155060 cycles	154478 cycles	1.00
ML-DSA-44 verify	54273 cycles	54171 cycles	1.00
ML-DSA-65 keypair	90114 cycles	90288 cycles	1.00
ML-DSA-65 sign	254983 cycles	255159 cycles	1.00
ML-DSA-65 verify	89391 cycles	89723 cycles	1.00
ML-DSA-87 keypair	146111 cycles	144023 cycles	1.01
ML-DSA-87 sign	310615 cycles	311435 cycles	1.00
ML-DSA-87 verify	139031 cycles	139380 cycles	1.00

This comment was automatically generated by workflow using github-action-benchmark.

[oqs-bot]

⚠️ Performance Alert ⚠️

Possible performance regression was detected for benchmark 'AMD EPYC 3rd gen (c6a)'.
Benchmark result of this commit is worse than the previous benchmark result exceeding threshold 1.03.

Benchmark suite	Current: d754692	Previous: 5a21649	Ratio
ML-DSA-44 keypair	53680 cycles	52044 cycles	1.03

This comment was automatically generated by workflow using github-action-benchmark.

[oqs-bot]

Graviton5

Details

Benchmark suite	Current: d754692	Previous: 5a21649	Ratio
ML-DSA-44 keypair	53198 cycles	51548 cycles	1.03
ML-DSA-44 sign	162360 cycles	162113 cycles	1.00
ML-DSA-44 verify	54802 cycles	54690 cycles	1.00
ML-DSA-65 keypair	91798 cycles	90140 cycles	1.02
ML-DSA-65 sign	267266 cycles	267396 cycles	1.00
ML-DSA-65 verify	89749 cycles	89797 cycles	1.00
ML-DSA-87 keypair	149170 cycles	145755 cycles	1.02
ML-DSA-87 sign	336380 cycles	336130 cycles	1.00
ML-DSA-87 verify	144922 cycles	145410 cycles	1.00

This comment was automatically generated by workflow using github-action-benchmark.

[oqs-bot]

⚠️ Performance Alert ⚠️

Possible performance regression was detected for benchmark 'Graviton5'.
Benchmark result of this commit is worse than the previous benchmark result exceeding threshold 1.03.

Benchmark suite	Current: d754692	Previous: 5a21649	Ratio
ML-DSA-44 keypair	53198 cycles	51548 cycles	1.03

This comment was automatically generated by workflow using github-action-benchmark.

[oqs-bot]

Intel Xeon 3rd gen (c6i)

Details

Benchmark suite	Current: d754692	Previous: 5a21649	Ratio
ML-DSA-44 keypair	63659 cycles	61828 cycles	1.03
ML-DSA-44 sign	188048 cycles	187695 cycles	1.00
ML-DSA-44 verify	66261 cycles	66104 cycles	1.00
ML-DSA-65 keypair	110201 cycles	108718 cycles	1.01
ML-DSA-65 sign	312645 cycles	312467 cycles	1.00
ML-DSA-65 verify	109602 cycles	109821 cycles	1.00
ML-DSA-87 keypair	174229 cycles	170106 cycles	1.02
ML-DSA-87 sign	378340 cycles	378541 cycles	1.00
ML-DSA-87 verify	171706 cycles	171030 cycles	1.00

This comment was automatically generated by workflow using github-action-benchmark.

[oqs-bot]

AMD EPYC 4th gen (c7a) (no-opt)

Details

Benchmark suite	Current: d754692	Previous: 5a21649	Ratio
ML-DSA-44 keypair	120408 cycles	118953 cycles	1.01
ML-DSA-44 sign	457094 cycles	459598 cycles	0.99
ML-DSA-44 verify	130575 cycles	130974 cycles	1.00
ML-DSA-65 keypair	200701 cycles	201005 cycles	1.00
ML-DSA-65 sign	743817 cycles	744567 cycles	1.00
ML-DSA-65 verify	209070 cycles	209501 cycles	1.00
ML-DSA-87 keypair	334607 cycles	330311 cycles	1.01
ML-DSA-87 sign	941430 cycles	935570 cycles	1.01
ML-DSA-87 verify	343621 cycles	343111 cycles	1.00

This comment was automatically generated by workflow using github-action-benchmark.

[oqs-bot]

AMD EPYC 3rd gen (c6a) (no-opt)

Details

Benchmark suite	Current: d754692	Previous: 5a21649	Ratio
ML-DSA-44 keypair	134625 cycles	133208 cycles	1.01
ML-DSA-44 sign	517573 cycles	517943 cycles	1.00
ML-DSA-44 verify	145957 cycles	146617 cycles	1.00
ML-DSA-65 keypair	225045 cycles	224548 cycles	1.00
ML-DSA-65 sign	844745 cycles	845053 cycles	1.00
ML-DSA-65 verify	234352 cycles	234404 cycles	1.00
ML-DSA-87 keypair	372612 cycles	368072 cycles	1.01
ML-DSA-87 sign	1064680 cycles	1059535 cycles	1.00
ML-DSA-87 verify	381584 cycles	381179 cycles	1.00

This comment was automatically generated by workflow using github-action-benchmark.

[oqs-bot]

Graviton5 (no-opt)

Details

Benchmark suite	Current: d754692	Previous: 5a21649	Ratio
ML-DSA-44 keypair	101908 cycles	100305 cycles	1.02
ML-DSA-44 sign	369460 cycles	368863 cycles	1.00
ML-DSA-44 verify	110264 cycles	110142 cycles	1.00
ML-DSA-65 keypair	176353 cycles	175442 cycles	1.01
ML-DSA-65 sign	597271 cycles	596517 cycles	1.00
ML-DSA-65 verify	177033 cycles	177401 cycles	1.00
ML-DSA-87 keypair	288966 cycles	286665 cycles	1.01
ML-DSA-87 sign	757652 cycles	757698 cycles	1.00
ML-DSA-87 verify	296289 cycles	295740 cycles	1.00

This comment was automatically generated by workflow using github-action-benchmark.

[oqs-bot]

Intel Xeon 3rd gen (c6i) (no-opt)

Details

Benchmark suite	Current: d754692	Previous: 5a21649	Ratio
ML-DSA-44 keypair	157204 cycles	154677 cycles	1.02
ML-DSA-44 sign	591127 cycles	589008 cycles	1.00
ML-DSA-44 verify	170268 cycles	169721 cycles	1.00
ML-DSA-65 keypair	262641 cycles	261373 cycles	1.00
ML-DSA-65 sign	964442 cycles	962347 cycles	1.00
ML-DSA-65 verify	272112 cycles	271274 cycles	1.00
ML-DSA-87 keypair	437568 cycles	436223 cycles	1.00
ML-DSA-87 sign	1217416 cycles	1229252 cycles	0.99
ML-DSA-87 verify	448706 cycles	452607 cycles	0.99

This comment was automatically generated by workflow using github-action-benchmark.

[github-actions]

Arm Cortex-A72 (Raspberry Pi 4) benchmarks (no-opt)

Details

Benchmark suite	Current: d754692	Previous: 5a21649	Ratio
ML-DSA-44 keypair	301678 cycles	300414 cycles	1.00
ML-DSA-44 sign	1127279 cycles	1139126 cycles	0.99
ML-DSA-44 verify	328231 cycles	331046 cycles	0.99
ML-DSA-65 keypair	547039 cycles	548825 cycles	1.00
ML-DSA-65 sign	1853184 cycles	1869608 cycles	0.99
ML-DSA-65 verify	525326 cycles	529294 cycles	0.99
ML-DSA-87 keypair	846962 cycles	849946 cycles	1.00
ML-DSA-87 sign	2362980 cycles	2373676 cycles	1.00
ML-DSA-87 verify	868280 cycles	881562 cycles	0.98

This comment was automatically generated by workflow using github-action-benchmark.

[oqs-bot]

Graviton4

Details

Benchmark suite	Current: d754692	Previous: 5a21649	Ratio
ML-DSA-44 keypair	69120 cycles	67437 cycles	1.02
ML-DSA-44 sign	198254 cycles	198251 cycles	1.00
ML-DSA-44 verify	70346 cycles	70273 cycles	1.00
ML-DSA-65 keypair	120739 cycles	119404 cycles	1.01
ML-DSA-65 sign	325685 cycles	325857 cycles	1.00
ML-DSA-65 verify	116824 cycles	116855 cycles	1.00
ML-DSA-87 keypair	199778 cycles	196729 cycles	1.02
ML-DSA-87 sign	422686 cycles	422612 cycles	1.00
ML-DSA-87 verify	193212 cycles	193340 cycles	1.00

This comment was automatically generated by workflow using github-action-benchmark.

[oqs-bot]

Graviton3

Details

Benchmark suite	Current: d754692	Previous: 5a21649	Ratio
ML-DSA-44 keypair	73253 cycles	71611 cycles	1.02
ML-DSA-44 sign	209286 cycles	209434 cycles	1.00
ML-DSA-44 verify	75035 cycles	74963 cycles	1.00
ML-DSA-65 keypair	127581 cycles	126094 cycles	1.01
ML-DSA-65 sign	345382 cycles	345749 cycles	1.00
ML-DSA-65 verify	124420 cycles	124181 cycles	1.00
ML-DSA-87 keypair	209885 cycles	206303 cycles	1.02
ML-DSA-87 sign	439883 cycles	439718 cycles	1.00
ML-DSA-87 verify	204487 cycles	204622 cycles	1.00

This comment was automatically generated by workflow using github-action-benchmark.

[oqs-bot]

Graviton4 (no-opt)

Details

Benchmark suite	Current: d754692	Previous: 5a21649	Ratio
ML-DSA-44 keypair	129631 cycles	128049 cycles	1.01
ML-DSA-44 sign	441116 cycles	441168 cycles	1.00
ML-DSA-44 verify	136518 cycles	136467 cycles	1.00
ML-DSA-65 keypair	223131 cycles	221666 cycles	1.01
ML-DSA-65 sign	714869 cycles	714474 cycles	1.00
ML-DSA-65 verify	220998 cycles	220904 cycles	1.00
ML-DSA-87 keypair	368214 cycles	365008 cycles	1.01
ML-DSA-87 sign	916856 cycles	916566 cycles	1.00
ML-DSA-87 verify	371703 cycles	371340 cycles	1.00

This comment was automatically generated by workflow using github-action-benchmark.

[oqs-bot]

Graviton3 (no-opt)

Details

Benchmark suite	Current: d754692	Previous: 5a21649	Ratio
ML-DSA-44 keypair	140216 cycles	138707 cycles	1.01
ML-DSA-44 sign	487346 cycles	486846 cycles	1.00
ML-DSA-44 verify	149713 cycles	149535 cycles	1.00
ML-DSA-65 keypair	244296 cycles	242459 cycles	1.01
ML-DSA-65 sign	794080 cycles	793806 cycles	1.00
ML-DSA-65 verify	242221 cycles	242128 cycles	1.00
ML-DSA-87 keypair	399157 cycles	395846 cycles	1.01
ML-DSA-87 sign	1017342 cycles	1016691 cycles	1.00
ML-DSA-87 verify	405466 cycles	404895 cycles	1.00

This comment was automatically generated by workflow using github-action-benchmark.

[oqs-bot]

Graviton2

Details

Benchmark suite	Current: d754692	Previous: 5a21649	Ratio
ML-DSA-44 keypair	115133 cycles	112613 cycles	1.02
ML-DSA-44 sign	354181 cycles	354097 cycles	1.00
ML-DSA-44 verify	117569 cycles	117356 cycles	1.00
ML-DSA-65 keypair	196792 cycles	194908 cycles	1.01
ML-DSA-65 sign	584510 cycles	584211 cycles	1.00
ML-DSA-65 verify	193690 cycles	193186 cycles	1.00
ML-DSA-87 keypair	325055 cycles	321947 cycles	1.01
ML-DSA-87 sign	749467 cycles	749473 cycles	1.00
ML-DSA-87 verify	319097 cycles	319705 cycles	1.00

This comment was automatically generated by workflow using github-action-benchmark.

[oqs-bot]

Graviton2 (no-opt)

Details

Benchmark suite	Current: d754692	Previous: 5a21649	Ratio
ML-DSA-44 keypair	214544 cycles	212605 cycles	1.01
ML-DSA-44 sign	760320 cycles	761270 cycles	1.00
ML-DSA-44 verify	229546 cycles	230160 cycles	1.00
ML-DSA-65 keypair	377324 cycles	376264 cycles	1.00
ML-DSA-65 sign	1247556 cycles	1248079 cycles	1.00
ML-DSA-65 verify	371353 cycles	372327 cycles	1.00
ML-DSA-87 keypair	604538 cycles	601548 cycles	1.00
ML-DSA-87 sign	1585682 cycles	1584951 cycles	1.00
ML-DSA-87 verify	616284 cycles	617704 cycles	1.00

This comment was automatically generated by workflow using github-action-benchmark.

[github-actions]

Arm Cortex-A55 (Snapdragon 888) benchmarks (opt)

Details

Benchmark suite	Current: d754692	Previous: 5a21649	Ratio
ML-DSA-44 keypair	277824 cycles	271982 cycles	1.02
ML-DSA-44 sign	823694 cycles	811078 cycles	1.02
ML-DSA-44 verify	275049 cycles	273238 cycles	1.01
ML-DSA-65 keypair	474095 cycles	466703 cycles	1.02
ML-DSA-65 sign	1331198 cycles	1368970 cycles	0.97
ML-DSA-65 verify	453959 cycles	454427 cycles	1.00
ML-DSA-87 keypair	806322 cycles	799628 cycles	1.01
ML-DSA-87 sign	1824451 cycles	1881952 cycles	0.97
ML-DSA-87 verify	771985 cycles	779593 cycles	0.99

This comment was automatically generated by workflow using github-action-benchmark.

[github-actions]

Arm Cortex-A76 (Raspberry Pi 5) benchmarks (opt)

Details

Benchmark suite	Current: d754692	Previous: 5a21649	Ratio
ML-DSA-44 keypair	114986 cycles	112035 cycles	1.03
ML-DSA-44 sign	353789 cycles	353427 cycles	1.00
ML-DSA-44 verify	117051 cycles	117277 cycles	1.00
ML-DSA-65 keypair	196619 cycles	194588 cycles	1.01
ML-DSA-65 sign	583519 cycles	583734 cycles	1.00
ML-DSA-65 verify	192930 cycles	193178 cycles	1.00
ML-DSA-87 keypair	325288 cycles	320562 cycles	1.01
ML-DSA-87 sign	746290 cycles	746825 cycles	1.00
ML-DSA-87 verify	318268 cycles	318130 cycles	1.00

This comment was automatically generated by workflow using github-action-benchmark.

[github-actions]

Arm Cortex-A76 (Raspberry Pi 5) benchmarks (no-opt)

Details

Benchmark suite	Current: d754692	Previous: 5a21649	Ratio
ML-DSA-44 keypair	214318 cycles	211494 cycles	1.01
ML-DSA-44 sign	760599 cycles	759270 cycles	1.00
ML-DSA-44 verify	229627 cycles	228971 cycles	1.00
ML-DSA-65 keypair	377876 cycles	375085 cycles	1.01
ML-DSA-65 sign	1246744 cycles	1247662 cycles	1.00
ML-DSA-65 verify	371702 cycles	371342 cycles	1.00
ML-DSA-87 keypair	605887 cycles	600696 cycles	1.01
ML-DSA-87 sign	1584024 cycles	1584815 cycles	1.00
ML-DSA-87 verify	617210 cycles	616331 cycles	1.00

This comment was automatically generated by workflow using github-action-benchmark.

[github-actions]

Arm Cortex-A55 (Snapdragon 888) benchmarks (no-opt)

Details

Benchmark suite	Current: d754692	Previous: 5a21649	Ratio
ML-DSA-44 keypair	472521 cycles	465334 cycles	1.02
ML-DSA-44 sign	2135043 cycles	2136027 cycles	1.00
ML-DSA-44 verify	556744 cycles	556763 cycles	1.00
ML-DSA-65 keypair	788323 cycles	784205 cycles	1.01
ML-DSA-65 sign	3513127 cycles	3490891 cycles	1.01
ML-DSA-65 verify	869319 cycles	869429 cycles	1.00
ML-DSA-87 keypair	1276017 cycles	1267792 cycles	1.01
ML-DSA-87 sign	4343905 cycles	4336698 cycles	1.00
ML-DSA-87 verify	1386552 cycles	1394843 cycles	0.99

This comment was automatically generated by workflow using github-action-benchmark.

[github-actions]

SpacemiT K1 8 (Banana Pi F3) benchmarks (no-opt)

Details

Benchmark suite	Current: d754692	Previous: 5a21649	Ratio
ML-DSA-44 keypair	776194 cycles	760609 cycles	1.02
ML-DSA-44 sign	3144181 cycles	3141192 cycles	1.00
ML-DSA-44 verify	859251 cycles	859636 cycles	1.00
ML-DSA-65 keypair	1295405 cycles	1288789 cycles	1.01
ML-DSA-65 sign	5089426 cycles	5078763 cycles	1.00
ML-DSA-65 verify	1367872 cycles	1368051 cycles	1.00
ML-DSA-87 keypair	2136388 cycles	2110967 cycles	1.01
ML-DSA-87 sign	6358431 cycles	6371124 cycles	1.00
ML-DSA-87 verify	2225827 cycles	2227585 cycles	1.00

This comment was automatically generated by workflow using github-action-benchmark.

[oqs-bot]

CBMC Results (ML-DSA-44, REDUCE-RAM)

⚠️ Attention Required

Proof	Status	Current	Previous	Change
compute_pack_t0_t1	⚠️	28s	12s	+133%
mld_attempt_signature_generation	⚠️	163s	19s	+758%
polyvecl_chknorm	⚠️	33s	11s	+200%
sign_pk_from_sk	⚠️	26s	5s	+420%
sign_verify_internal	⚠️	159s	49s	+224%

Full Results (207 proofs)

Proof	Status	Current	Previous	Change
**TOTAL**	✅	1212s	1364s	-11.1%
mld_attempt_signature_generation	⚠️	163s	19s	+758%
sign_verify_internal	⚠️	159s	49s	+224%
poly_pointwise_montgomery_c	✅	65s	112s	-42%
mld_invntt_layer	✅	56s	105s	-47%
polyvec_matrix_pointwise_montgomery_yvec	✅	41s	149s	-72%
polyvecl_chknorm	⚠️	33s	11s	+200%
compute_pack_t0_t1	⚠️	28s	12s	+133%
sign_pk_from_sk	⚠️	26s	5s	+420%
fqmul	✅	22s	39s	-44%
mld_ntt_layer	✅	21s	41s	-49%
sig_unpack_hints	✅	18s	2s	+800%
sign_keypair_internal	✅	18s	4s	+350%
keccakf1600x4_permute_native	✅	13s	22s	-41%
rej_uniform_c	✅	13s	16s	-19%
mld_ntt_butterfly_block	✅	10s	23s	-57%
sign_signature_internal	✅	10s	4s	+150%
poly_ntt_c	✅	9s	21s	-57%
polyeta_unpack	✅	9s	14s	-36%
polyt0_unpack	✅	9s	12s	-25%
rej_uniform	✅	8s	8s	+0%
rej_uniform_native	✅	8s	5s	+60%
rej_uniform_native_x86_64	✅	8s	-	new
polyz_unpack_c	✅	7s	8s	-12%
keccak_absorb_once_x4	✅	6s	8s	-25%
poly_chknorm_c	✅	6s	11s	-45%
poly_invntt_tomont_c	✅	6s	11s	-45%
poly_pointwise_montgomery_native	✅	6s	2s	+200%
polyvec_matrix_pointwise_montgomery_row	✅	6s	6s	+0%
sign_keypair	✅	6s	5s	+20%
fqscale	✅	5s	2s	+150%
mld_check_pct	✅	5s	15s	-67%
poly_uniform_eta_4x	✅	5s	12s	-58%
polyveck_decompose	✅	5s	7s	-29%
sign_signature_extmu	✅	5s	4s	+25%
keccakf1600_xor_bytes	✅	4s	3s	+33%
make_hint	✅	4s	3s	+33%
mld_keccakf1600_permute_c	✅	4s	7s	-43%
mld_keccakf1600x4_extract_bytes_c	✅	4s	4s	+0%
mld_polymat_expand_entry	✅	4s	2s	+100%
mld_sample_pack_s1_s2	✅	4s	-	new
ntt_native_aarch64	✅	4s	4s	+0%
poly_add	✅	4s	7s	-43%
poly_challenge	✅	4s	6s	-33%
poly_chknorm_native	✅	4s	4s	+0%
poly_decompose_32_native_aarch64	✅	4s	4s	+0%
poly_decompose_88_native_aarch64	✅	4s	3s	+33%
poly_sub	✅	4s	3s	+33%
poly_use_hint_c	✅	4s	5s	-20%
polyt0_pack	✅	4s	4s	+0%
polyveck_invntt_tomont	✅	4s	5s	-20%
polyveck_reduce	✅	4s	4s	+0%
polyz_unpack_native_x86_64	✅	4s	3s	+33%
rej_uniform_native_aarch64	✅	4s	3s	+33%
sign_signature_pre_hash_shake256	✅	4s	4s	+0%
sk_t0hat_get_poly	✅	4s	1s	+300%
decompose	✅	3s	3s	+0%
intt_native_aarch64	✅	3s	3s	+0%
intt_native_x86_64	✅	3s	2s	+50%
keccak_absorb	✅	3s	3s	+0%
keccak_f1600_x1_native_aarch64	✅	3s	3s	+0%
keccakf1600x4_xor_bytes	✅	3s	3s	+0%
mld_compute_pack_z	✅	3s	6s	-50%
mld_ct_memcmp	✅	3s	1s	+200%
mld_h	✅	3s	4s	-25%
mld_prepare_domain_separation_prefix	✅	3s	3s	+0%
mld_sign_attempt	✅	3s	-	new
mld_sign_resume	✅	3s	-	new
mld_value_barrier_u8	✅	3s	4s	-25%
nttunpack_native_x86_64	✅	3s	4s	-25%
pack_sk_rho_key_tr	✅	3s	-	new
pointwise_acc_native_aarch64	✅	3s	6s	-50%
pointwise_acc_native_x86_64	✅	3s	4s	-25%
poly_caddq_native	✅	3s	3s	+0%
poly_chknorm	✅	3s	3s	+0%
poly_decompose	✅	3s	2s	+50%
poly_decompose_native	✅	3s	2s	+50%
poly_decompose_native_x86_64	✅	3s	2s	+50%
poly_permute_bitrev_to_custom_optional	✅	3s	5s	-40%
poly_permute_bitrev_to_custom_optional_native	✅	3s	3s	+0%
poly_uniform	✅	3s	3s	+0%
poly_uniform_4x	✅	3s	3s	+0%
poly_use_hint	✅	3s	2s	+50%
poly_use_hint_native_aarch64	✅	3s	3s	+0%
polyvec_matrix_expand	✅	3s	3s	+0%
polyveck_caddq	✅	3s	3s	+0%
polyveck_pack_w1	✅	3s	3s	+0%
polyveck_unpack_eta	✅	3s	2s	+50%
polyveck_unpack_eta_chknorm	✅	3s	-	new
polyvecl_ntt	✅	3s	3s	+0%
polyvecl_pointwise_acc_montgomery	✅	3s	3s	+0%
polyw1_pack	✅	3s	4s	-25%
polyw1_pack_32	✅	3s	3s	+0%
rej_eta	✅	3s	5s	-40%
rej_uniform_eta_native_x86_64	✅	3s	-	new
shake128_absorb	✅	3s	3s	+0%
shake128_squeeze	✅	3s	2s	+50%
shake128x4_absorb_once	✅	3s	2s	+50%
shake256	✅	3s	1s	+200%
shake256_finalize	✅	3s	2s	+50%
sign_signature	✅	3s	6s	-50%
sign_verify	✅	3s	4s	-25%
sign_verify_extmu	✅	3s	5s	-40%
sign_verify_pre_hash_internal	✅	3s	5s	-40%
sk_s2hat_get_poly	✅	3s	5s	-40%
unpack_sk	✅	3s	3s	+0%
unpack_sk_t0hat	✅	3s	2s	+50%
keccak_f1600_x4_native_aarch64_v84a	✅	2s	3s	-33%
keccak_f1600_x4_native_aarch64_v8a_scalar_hybrid	✅	2s	2s	+0%
keccak_f1600_x4_native_aarch64_v8a_v84a_scalar_hybrid	✅	2s	3s	-33%
keccak_f1600_x4_native_avx2	✅	2s	2s	+0%
keccak_finalize	✅	2s	2s	+0%
keccakf1600_extract_bytes (big endian)	✅	2s	4s	-50%
keccakf1600x4_extract_bytes	✅	2s	2s	+0%
keccakf1600x4_extract_bytes_native	✅	2s	4s	-50%
keccakf1600x4_permute	✅	2s	4s	-50%
mld_ct_cmask_neg_i32	✅	2s	2s	+0%
mld_ct_cmask_nonzero_u8	✅	2s	2s	+0%
mld_ct_get_optblocker_u8	✅	2s	2s	+0%
mld_ct_sel_int32	✅	2s	3s	-33%
mld_sample_pack_s1_s2_serial	✅	2s	-	new
mld_value_barrier_i64	✅	2s	3s	-33%
mld_value_barrier_u32	✅	2s	1s	+100%
ntt_native_x86_64	✅	2s	3s	-33%
pack_sig_c	✅	2s	5s	-60%
pack_sig_h	✅	2s	4s	-50%
pack_sig_z	✅	2s	2s	+0%
pointwise_native_aarch64	✅	2s	2s	+0%
poly_caddq	✅	2s	4s	-50%
poly_chknorm_native_aarch64	✅	2s	2s	+0%
poly_chknorm_native_x86_64	✅	2s	2s	+0%
poly_decompose_c	✅	2s	5s	-60%
poly_invntt_tomont	✅	2s	2s	+0%
poly_ntt_native	✅	2s	3s	-33%
poly_power2round	✅	2s	4s	-50%
poly_shiftl	✅	2s	4s	-50%
poly_uniform_eta	✅	2s	2s	+0%
poly_uniform_gamma1	✅	2s	3s	-33%
poly_uniform_gamma1_4x	✅	2s	5s	-60%
poly_use_hint_native	✅	2s	3s	-33%
poly_use_hint_native_x86_64	✅	2s	-	new
polyeta_pack	✅	2s	3s	-33%
polyt1_pack	✅	2s	3s	-33%
polyt1_unpack	✅	2s	2s	+0%
polyvec_matrix_expand_serial	✅	2s	4s	-50%
polyvecl_pointwise_acc_montgomery_c	✅	2s	4s	-50%
polyz_pack	✅	2s	2s	+0%
polyz_unpack_17_native_aarch64	✅	2s	2s	+0%
power2round	✅	2s	2s	+0%
rej_eta_c	✅	2s	4s	-50%
rej_eta_native	✅	2s	3s	-33%
rej_uniform_eta_native_aarch64	✅	2s	3s	-33%
shake128_finalize	✅	2s	3s	-33%
shake128x4_squeezeblocks	✅	2s	2s	+0%
shake256_init	✅	2s	4s	-50%
shake256_release	✅	2s	1s	+100%
shake256_squeeze	✅	2s	2s	+0%
shake256x4_absorb_once	✅	2s	1s	+100%
shake256x4_squeezeblocks	✅	2s	2s	+0%
sign_signature_pre_hash_internal	✅	2s	4s	-50%
sign_verify_pre_hash_shake256	✅	2s	5s	-60%
unpack_pk_t1	✅	2s	3s	-33%
unpack_sk_s1hat	✅	2s	3s	-33%
use_hint	✅	2s	2s	+0%
yvec_get_poly	✅	2s	3s	-33%
yvec_init	✅	2s	1s	+100%
caddq	✅	1s	6s	-83%
keccak_f1600_x1_native_aarch64_v84a	✅	1s	2s	-50%
keccak_init	✅	1s	3s	-67%
keccak_squeeze	✅	1s	2s	-50%
keccak_squeezeblocks_x4	✅	1s	3s	-67%
keccakf1600_permute	✅	1s	2s	-50%
keccakf1600_permute_native	✅	1s	3s	-67%
keccakf1600_xor_bytes (big endian)	✅	1s	6s	-83%
keccakf1600x4_xor_bytes_native	✅	1s	5s	-80%
mld_ct_abs_i32	✅	1s	3s	-67%
mld_ct_cmask_nonzero_u32	✅	1s	3s	-67%
mld_ct_get_optblocker_i64	✅	1s	4s	-75%
mld_ct_get_optblocker_u32	✅	1s	2s	-50%
mld_keccakf1600_extract_bytes	✅	1s	2s	-50%
mld_keccakf1600x4_xor_bytes_c	✅	1s	4s	-75%
mld_sign_finish	✅	1s	-	new
montgomery_reduce	✅	1s	2s	-50%
pointwise_native_x86_64	✅	1s	4s	-75%
poly_caddq_c	✅	1s	3s	-67%
poly_caddq_native_aarch64	✅	1s	3s	-67%
poly_caddq_native_x86_64	✅	1s	4s	-75%
poly_invntt_tomont_native	✅	1s	3s	-67%
poly_ntt	✅	1s	3s	-67%
poly_pointwise_montgomery	✅	1s	3s	-67%
poly_reduce	✅	1s	4s	-75%
polyveck_ntt	✅	1s	2s	-50%
polyvecl_pointwise_acc_montgomery_native	✅	1s	3s	-67%
polyvecl_uniform_gamma1	✅	1s	2s	-50%
polyvecl_uniform_gamma1_serial	✅	1s	2s	-50%
polyvecl_unpack_eta	✅	1s	4s	-75%
polyvecl_unpack_z	✅	1s	3s	-67%
polyw1_pack_88	✅	1s	2s	-50%
polyz_unpack	✅	1s	3s	-67%
polyz_unpack_19_native_aarch64	✅	1s	4s	-75%
polyz_unpack_native	✅	1s	3s	-67%
reduce32	✅	1s	3s	-67%
shake128_init	✅	1s	2s	-50%
shake128_release	✅	1s	2s	-50%
shake256_absorb	✅	1s	2s	-50%
sk_s1hat_get_poly	✅	1s	2s	-50%
sys_check_capability	✅	1s	2s	-50%
unpack_sk_s2hat	✅	1s	4s	-75%

[oqs-bot]

CBMC Results (ML-DSA-87, REDUCE-RAM)

⚠️ Attention Required

Proof	Status	Current	Previous	Change
compute_pack_t0_t1	⚠️	26s	12s	+117%
mld_attempt_signature_generation	⚠️	175s	34s	+415%
sign_keypair_internal	⚠️	37s	6s	+517%
sign_pk_from_sk	⚠️	40s	6s	+567%
sign_verify_internal	⚠️	189s	47s	+302%

Full Results (207 proofs)

Proof	Status	Current	Previous	Change
**TOTAL**	✅	1286s	1436s	-10.4%
sign_verify_internal	⚠️	189s	47s	+302%
mld_attempt_signature_generation	⚠️	175s	34s	+415%
poly_pointwise_montgomery_c	✅	68s	125s	-46%
mld_invntt_layer	✅	60s	111s	-46%
polyvec_matrix_pointwise_montgomery_yvec	✅	55s	196s	-72%
sign_pk_from_sk	⚠️	40s	6s	+567%
sign_keypair_internal	⚠️	37s	6s	+517%
compute_pack_t0_t1	⚠️	26s	12s	+117%
fqmul	✅	24s	39s	-38%
mld_ntt_layer	✅	22s	44s	-50%
mld_ntt_butterfly_block	✅	13s	23s	-43%
rej_uniform_c	✅	13s	18s	-28%
keccakf1600x4_permute_native	✅	12s	25s	-52%
sig_unpack_hints	✅	12s	4s	+200%
sign_signature_internal	✅	12s	3s	+300%
polyt0_unpack	✅	10s	14s	-29%
polyveck_decompose	✅	10s	12s	-17%
rej_uniform	✅	10s	7s	+43%
poly_ntt_c	✅	9s	19s	-53%
polyeta_unpack	✅	8s	13s	-38%
mld_keccakf1600_permute_c	✅	7s	8s	-12%
mld_sample_pack_s1_s2	✅	7s	-	new
poly_uniform_eta_4x	✅	7s	12s	-42%
rej_uniform_native_x86_64	✅	7s	-	new
poly_caddq_native_x86_64	✅	6s	3s	+100%
poly_invntt_tomont_c	✅	6s	9s	-33%
polyveck_caddq	✅	6s	8s	-25%
sign_keypair	✅	6s	4s	+50%
sign_signature_pre_hash_shake256	✅	6s	3s	+100%
keccak_absorb_once_x4	✅	5s	8s	-38%
mld_check_pct	✅	5s	15s	-67%
ntt_native_aarch64	✅	5s	4s	+25%
pointwise_acc_native_aarch64	✅	5s	5s	+0%
pointwise_acc_native_x86_64	✅	5s	8s	-38%
poly_chknorm_c	✅	5s	13s	-62%
poly_shiftl	✅	5s	4s	+25%
polyvec_matrix_pointwise_montgomery_row	✅	5s	13s	-62%
polyveck_invntt_tomont	✅	5s	4s	+25%
polyveck_reduce	✅	5s	6s	-17%
sign_signature	✅	5s	4s	+25%
caddq	✅	4s	3s	+33%
keccakf1600x4_extract_bytes	✅	4s	1s	+300%
mld_ct_cmask_nonzero_u32	✅	4s	5s	-20%
mld_sample_pack_s1_s2_serial	✅	4s	-	new
pointwise_native_x86_64	✅	4s	5s	-20%
poly_add	✅	4s	8s	-50%
poly_decompose_c	✅	4s	6s	-33%
poly_permute_bitrev_to_custom_optional_native	✅	4s	3s	+33%
poly_uniform	✅	4s	4s	+0%
polyt1_unpack	✅	4s	3s	+33%
polyvecl_ntt	✅	4s	8s	-50%
power2round	✅	4s	3s	+33%
rej_uniform_native	✅	4s	5s	-20%
sk_t0hat_get_poly	✅	4s	3s	+33%
decompose	✅	3s	2s	+50%
intt_native_x86_64	✅	3s	4s	-25%
keccak_squeezeblocks_x4	✅	3s	4s	-25%
keccakf1600_permute_native	✅	3s	3s	+0%
mld_compute_pack_z	✅	3s	6s	-50%
mld_ct_cmask_neg_i32	✅	3s	2s	+50%
mld_ct_get_optblocker_i64	✅	3s	2s	+50%
mld_ct_get_optblocker_u32	✅	3s	2s	+50%
mld_h	✅	3s	2s	+50%
mld_keccakf1600_extract_bytes	✅	3s	1s	+200%
mld_polymat_expand_entry	✅	3s	4s	-25%
mld_prepare_domain_separation_prefix	✅	3s	3s	+0%
mld_sign_attempt	✅	3s	-	new
mld_sign_resume	✅	3s	-	new
montgomery_reduce	✅	3s	2s	+50%
pack_sig_h	✅	3s	3s	+0%
pointwise_native_aarch64	✅	3s	4s	-25%
poly_challenge	✅	3s	4s	-25%
poly_chknorm_native	✅	3s	1s	+200%
poly_chknorm_native_x86_64	✅	3s	2s	+50%
poly_decompose_native	✅	3s	2s	+50%
poly_invntt_tomont	✅	3s	4s	-25%
poly_ntt	✅	3s	2s	+50%
poly_ntt_native	✅	3s	4s	-25%
poly_power2round	✅	3s	7s	-57%
poly_reduce	✅	3s	4s	-25%
poly_sub	✅	3s	5s	-40%
poly_use_hint_native_x86_64	✅	3s	-	new
polyt1_pack	✅	3s	5s	-40%
polyveck_unpack_eta	✅	3s	3s	+0%
polyvecl_chknorm	✅	3s	38s	-92%
polyvecl_unpack_eta	✅	3s	3s	+0%
polyvecl_unpack_z	✅	3s	3s	+0%
polyw1_pack_88	✅	3s	2s	+50%
polyz_unpack_19_native_aarch64	✅	3s	5s	-40%
polyz_unpack_c	✅	3s	7s	-57%
polyz_unpack_native_x86_64	✅	3s	3s	+0%
reduce32	✅	3s	3s	+0%
rej_uniform_native_aarch64	✅	3s	3s	+0%
shake128_absorb	✅	3s	2s	+50%
shake128_init	✅	3s	2s	+50%
shake128_squeeze	✅	3s	1s	+200%
shake256_init	✅	3s	3s	+0%
shake256_squeeze	✅	3s	2s	+50%
sign_signature_extmu	✅	3s	4s	-25%
sign_signature_pre_hash_internal	✅	3s	2s	+50%
sign_verify_pre_hash_internal	✅	3s	3s	+0%
unpack_sk	✅	3s	4s	-25%
keccak_absorb	✅	2s	4s	-50%
keccak_f1600_x1_native_aarch64_v84a	✅	2s	2s	+0%
keccak_f1600_x4_native_aarch64_v84a	✅	2s	1s	+100%
keccak_f1600_x4_native_aarch64_v8a_scalar_hybrid	✅	2s	2s	+0%
keccak_f1600_x4_native_aarch64_v8a_v84a_scalar_hybrid	✅	2s	2s	+0%
keccak_f1600_x4_native_avx2	✅	2s	3s	-33%
keccak_squeeze	✅	2s	5s	-60%
keccakf1600_extract_bytes (big endian)	✅	2s	3s	-33%
keccakf1600x4_permute	✅	2s	2s	+0%
keccakf1600x4_xor_bytes	✅	2s	1s	+100%
keccakf1600x4_xor_bytes_native	✅	2s	2s	+0%
make_hint	✅	2s	2s	+0%
mld_ct_abs_i32	✅	2s	1s	+100%
mld_ct_cmask_nonzero_u8	✅	2s	2s	+0%
mld_ct_get_optblocker_u8	✅	2s	3s	-33%
mld_ct_memcmp	✅	2s	1s	+100%
mld_ct_sel_int32	✅	2s	2s	+0%
mld_keccakf1600x4_extract_bytes_c	✅	2s	3s	-33%
mld_keccakf1600x4_xor_bytes_c	✅	2s	1s	+100%
mld_sign_finish	✅	2s	-	new
mld_value_barrier_i64	✅	2s	2s	+0%
ntt_native_x86_64	✅	2s	2s	+0%
nttunpack_native_x86_64	✅	2s	3s	-33%
pack_sig_c	✅	2s	2s	+0%
poly_caddq	✅	2s	5s	-60%
poly_caddq_c	✅	2s	3s	-33%
poly_chknorm_native_aarch64	✅	2s	5s	-60%
poly_decompose	✅	2s	2s	+0%
poly_decompose_32_native_aarch64	✅	2s	3s	-33%
poly_decompose_native_x86_64	✅	2s	3s	-33%
poly_pointwise_montgomery	✅	2s	3s	-33%
poly_uniform_eta	✅	2s	5s	-60%
poly_uniform_gamma1	✅	2s	3s	-33%
poly_uniform_gamma1_4x	✅	2s	3s	-33%
poly_use_hint	✅	2s	4s	-50%
poly_use_hint_c	✅	2s	4s	-50%
poly_use_hint_native	✅	2s	1s	+100%
polyeta_pack	✅	2s	3s	-33%
polyt0_pack	✅	2s	3s	-33%
polyvec_matrix_expand	✅	2s	3s	-33%
polyveck_pack_w1	✅	2s	3s	-33%
polyveck_unpack_eta_chknorm	✅	2s	-	new
polyvecl_pointwise_acc_montgomery	✅	2s	2s	+0%
polyvecl_pointwise_acc_montgomery_native	✅	2s	2s	+0%
polyvecl_uniform_gamma1	✅	2s	3s	-33%
polyw1_pack_32	✅	2s	3s	-33%
rej_eta	✅	2s	2s	+0%
rej_eta_c	✅	2s	4s	-50%
rej_uniform_eta_native_aarch64	✅	2s	3s	-33%
rej_uniform_eta_native_x86_64	✅	2s	-	new
shake128_finalize	✅	2s	2s	+0%
shake128_release	✅	2s	3s	-33%
shake256_finalize	✅	2s	3s	-33%
shake256x4_absorb_once	✅	2s	5s	-60%
shake256x4_squeezeblocks	✅	2s	4s	-50%
sign_verify	✅	2s	2s	+0%
sign_verify_extmu	✅	2s	4s	-50%
sign_verify_pre_hash_shake256	✅	2s	7s	-71%
unpack_sk_s1hat	✅	2s	3s	-33%
unpack_sk_s2hat	✅	2s	3s	-33%
unpack_sk_t0hat	✅	2s	4s	-50%
use_hint	✅	2s	3s	-33%
yvec_init	✅	2s	4s	-50%
fqscale	✅	1s	1s	+0%
intt_native_aarch64	✅	1s	4s	-75%
keccak_f1600_x1_native_aarch64	✅	1s	2s	-50%
keccak_finalize	✅	1s	1s	+0%
keccak_init	✅	1s	1s	+0%
keccakf1600_permute	✅	1s	2s	-50%
keccakf1600_xor_bytes	✅	1s	1s	+0%
keccakf1600_xor_bytes (big endian)	✅	1s	2s	-50%
keccakf1600x4_extract_bytes_native	✅	1s	4s	-75%
mld_value_barrier_u32	✅	1s	3s	-67%
mld_value_barrier_u8	✅	1s	2s	-50%
pack_sig_z	✅	1s	3s	-67%
pack_sk_rho_key_tr	✅	1s	-	new
poly_caddq_native	✅	1s	3s	-67%
poly_caddq_native_aarch64	✅	1s	3s	-67%
poly_chknorm	✅	1s	4s	-75%
poly_decompose_88_native_aarch64	✅	1s	2s	-50%
poly_invntt_tomont_native	✅	1s	2s	-50%
poly_permute_bitrev_to_custom_optional	✅	1s	2s	-50%
poly_pointwise_montgomery_native	✅	1s	3s	-67%
poly_uniform_4x	✅	1s	3s	-67%
poly_use_hint_native_aarch64	✅	1s	3s	-67%
polyvec_matrix_expand_serial	✅	1s	3s	-67%
polyveck_ntt	✅	1s	3s	-67%
polyvecl_pointwise_acc_montgomery_c	✅	1s	2s	-50%
polyvecl_uniform_gamma1_serial	✅	1s	2s	-50%
polyw1_pack	✅	1s	2s	-50%
polyz_pack	✅	1s	4s	-75%
polyz_unpack	✅	1s	3s	-67%
polyz_unpack_17_native_aarch64	✅	1s	4s	-75%
polyz_unpack_native	✅	1s	1s	+0%
rej_eta_native	✅	1s	4s	-75%
shake128x4_absorb_once	✅	1s	4s	-75%
shake128x4_squeezeblocks	✅	1s	1s	+0%
shake256	✅	1s	3s	-67%
shake256_absorb	✅	1s	3s	-67%
shake256_release	✅	1s	5s	-80%
sk_s1hat_get_poly	✅	1s	3s	-67%
sk_s2hat_get_poly	✅	1s	2s	-50%
sys_check_capability	✅	1s	2s	-50%
unpack_pk_t1	✅	1s	2s	-50%
yvec_get_poly	✅	1s	2s	-50%

[oqs-bot]

CBMC Results (ML-DSA-65, REDUCE-RAM)

⚠️ Attention Required

Proof	Status	Current	Previous	Change
compute_pack_t0_t1	⚠️	39s	7s	+457%
mld_attempt_signature_generation	⚠️	149s	31s	+381%
sign_keypair_internal	⚠️	22s	3s	+633%
sign_pk_from_sk	⚠️	23s	5s	+360%
sign_verify_internal	⚠️	180s	71s	+154%

Full Results (207 proofs)

Proof	Status	Current	Previous	Change
**TOTAL**	✅	1242s	1482s	-16.2%
sign_verify_internal	⚠️	180s	71s	+154%
mld_attempt_signature_generation	⚠️	149s	31s	+381%
polyvec_matrix_pointwise_montgomery_yvec	✅	105s	201s	-48%
poly_pointwise_montgomery_c	✅	63s	116s	-46%
mld_invntt_layer	✅	53s	108s	-51%
compute_pack_t0_t1	⚠️	39s	7s	+457%
sign_pk_from_sk	⚠️	23s	5s	+360%
fqmul	✅	22s	40s	-45%
sign_keypair_internal	⚠️	22s	3s	+633%
mld_ntt_layer	✅	19s	43s	-56%
rej_uniform_c	✅	12s	16s	-25%
sig_unpack_hints	✅	12s	1s	+1100%
sign_signature_internal	✅	12s	6s	+100%
keccakf1600x4_permute_native	✅	11s	22s	-50%
mld_ntt_butterfly_block	✅	11s	25s	-56%
polyveck_decompose	✅	11s	14s	-21%
poly_ntt_c	✅	10s	22s	-55%
rej_uniform	✅	10s	7s	+43%
poly_uniform_eta_4x	✅	9s	13s	-31%
polyt0_unpack	✅	9s	13s	-31%
polyvecl_chknorm	✅	9s	43s	-79%
rej_uniform_native_x86_64	✅	9s	-	new
poly_chknorm_c	✅	7s	13s	-46%
poly_invntt_tomont_c	✅	6s	10s	-40%
polyt1_pack	✅	6s	3s	+100%
polyveck_invntt_tomont	✅	6s	7s	-14%
polyveck_reduce	✅	6s	6s	+0%
keccak_absorb_once_x4	✅	5s	10s	-50%
mld_check_pct	✅	5s	12s	-58%
mld_sample_pack_s1_s2	✅	5s	-	new
polyeta_unpack	✅	5s	4s	+25%
intt_native_aarch64	✅	4s	2s	+100%
mld_sample_pack_s1_s2_serial	✅	4s	-	new
poly_caddq_native_x86_64	✅	4s	1s	+300%
poly_chknorm_native_aarch64	✅	4s	2s	+100%
poly_chknorm_native_x86_64	✅	4s	4s	+0%
poly_decompose_native	✅	4s	5s	-20%
poly_invntt_tomont	✅	4s	5s	-20%
poly_pointwise_montgomery_native	✅	4s	4s	+0%
poly_uniform	✅	4s	2s	+100%
poly_uniform_eta	✅	4s	5s	-20%
poly_uniform_gamma1	✅	4s	3s	+33%
polyt1_unpack	✅	4s	3s	+33%
polyveck_caddq	✅	4s	7s	-43%
polyvecl_ntt	✅	4s	7s	-43%
polyvecl_uniform_gamma1_serial	✅	4s	1s	+300%
polyw1_pack_88	✅	4s	3s	+33%
polyz_unpack_c	✅	4s	9s	-56%
shake128_absorb	✅	4s	2s	+100%
shake128x4_squeezeblocks	✅	4s	2s	+100%
sign_keypair	✅	4s	4s	+0%
sign_signature_pre_hash_shake256	✅	4s	7s	-43%
unpack_sk_s1hat	✅	4s	1s	+300%
keccak_absorb	✅	3s	3s	+0%
keccak_f1600_x4_native_aarch64_v8a_scalar_hybrid	✅	3s	3s	+0%
keccak_init	✅	3s	4s	-25%
keccakf1600_xor_bytes (big endian)	✅	3s	2s	+50%
mld_compute_pack_z	✅	3s	5s	-40%
mld_ct_cmask_nonzero_u8	✅	3s	2s	+50%
mld_ct_get_optblocker_u32	✅	3s	3s	+0%
mld_ct_memcmp	✅	3s	4s	-25%
mld_keccakf1600_permute_c	✅	3s	7s	-57%
mld_sign_finish	✅	3s	-	new
nttunpack_native_x86_64	✅	3s	3s	+0%
pack_sig_c	✅	3s	3s	+0%
pack_sig_z	✅	3s	1s	+200%
pack_sk_rho_key_tr	✅	3s	-	new
pointwise_acc_native_aarch64	✅	3s	6s	-50%
pointwise_native_x86_64	✅	3s	2s	+50%
poly_caddq_native_aarch64	✅	3s	2s	+50%
poly_challenge	✅	3s	5s	-40%
poly_decompose_88_native_aarch64	✅	3s	2s	+50%
poly_decompose_c	✅	3s	8s	-62%
poly_ntt_native	✅	3s	2s	+50%
poly_permute_bitrev_to_custom_optional	✅	3s	3s	+0%
poly_uniform_gamma1_4x	✅	3s	3s	+0%
poly_use_hint_c	✅	3s	2s	+50%
poly_use_hint_native_x86_64	✅	3s	-	new
polyvec_matrix_pointwise_montgomery_row	✅	3s	8s	-62%
polyvecl_pointwise_acc_montgomery_c	✅	3s	3s	+0%
polyw1_pack	✅	3s	3s	+0%
polyw1_pack_32	✅	3s	2s	+50%
polyz_unpack_native	✅	3s	3s	+0%
polyz_unpack_native_x86_64	✅	3s	3s	+0%
power2round	✅	3s	2s	+50%
reduce32	✅	3s	2s	+50%
rej_eta_c	✅	3s	4s	-25%
shake256	✅	3s	2s	+50%
shake256_init	✅	3s	4s	-25%
sign_signature	✅	3s	5s	-40%
sign_signature_extmu	✅	3s	4s	-25%
sign_signature_pre_hash_internal	✅	3s	3s	+0%
sign_verify_pre_hash_internal	✅	3s	5s	-40%
sign_verify_pre_hash_shake256	✅	3s	6s	-50%
unpack_pk_t1	✅	3s	2s	+50%
decompose	✅	2s	4s	-50%
intt_native_x86_64	✅	2s	4s	-50%
keccak_finalize	✅	2s	2s	+0%
keccak_squeeze	✅	2s	2s	+0%
keccak_squeezeblocks_x4	✅	2s	4s	-50%
keccakf1600_extract_bytes (big endian)	✅	2s	3s	-33%
keccakf1600_permute_native	✅	2s	2s	+0%
keccakf1600x4_extract_bytes	✅	2s	4s	-50%
keccakf1600x4_xor_bytes_native	✅	2s	2s	+0%
mld_ct_abs_i32	✅	2s	6s	-67%
mld_ct_cmask_neg_i32	✅	2s	3s	-33%
mld_ct_cmask_nonzero_u32	✅	2s	3s	-33%
mld_ct_get_optblocker_i64	✅	2s	1s	+100%
mld_ct_sel_int32	✅	2s	2s	+0%
mld_keccakf1600x4_extract_bytes_c	✅	2s	2s	+0%
mld_keccakf1600x4_xor_bytes_c	✅	2s	2s	+0%
mld_polymat_expand_entry	✅	2s	3s	-33%
mld_prepare_domain_separation_prefix	✅	2s	4s	-50%
mld_sign_resume	✅	2s	-	new
mld_value_barrier_i64	✅	2s	2s	+0%
mld_value_barrier_u32	✅	2s	4s	-50%
mld_value_barrier_u8	✅	2s	1s	+100%
ntt_native_aarch64	✅	2s	3s	-33%
ntt_native_x86_64	✅	2s	5s	-60%
pack_sig_h	✅	2s	2s	+0%
pointwise_acc_native_x86_64	✅	2s	5s	-60%
pointwise_native_aarch64	✅	2s	3s	-33%
poly_add	✅	2s	7s	-71%
poly_caddq_native	✅	2s	4s	-50%
poly_chknorm	✅	2s	3s	-33%
poly_chknorm_native	✅	2s	4s	-50%
poly_decompose_32_native_aarch64	✅	2s	4s	-50%
poly_ntt	✅	2s	2s	+0%
poly_pointwise_montgomery	✅	2s	2s	+0%
poly_power2round	✅	2s	7s	-71%
poly_shiftl	✅	2s	3s	-33%
poly_sub	✅	2s	4s	-50%
poly_uniform_4x	✅	2s	4s	-50%
poly_use_hint	✅	2s	3s	-33%
poly_use_hint_native	✅	2s	7s	-71%
poly_use_hint_native_aarch64	✅	2s	4s	-50%
polyeta_pack	✅	2s	1s	+100%
polyveck_unpack_eta	✅	2s	3s	-33%
polyveck_unpack_eta_chknorm	✅	2s	-	new
polyvecl_unpack_eta	✅	2s	2s	+0%
polyz_unpack_19_native_aarch64	✅	2s	5s	-60%
rej_eta	✅	2s	5s	-60%
rej_uniform_eta_native_aarch64	✅	2s	5s	-60%
rej_uniform_eta_native_x86_64	✅	2s	-	new
rej_uniform_native	✅	2s	4s	-50%
shake128_finalize	✅	2s	2s	+0%
shake128_squeeze	✅	2s	3s	-33%
shake128x4_absorb_once	✅	2s	2s	+0%
shake256_absorb	✅	2s	4s	-50%
shake256_finalize	✅	2s	1s	+100%
shake256_release	✅	2s	3s	-33%
shake256x4_absorb_once	✅	2s	2s	+0%
shake256x4_squeezeblocks	✅	2s	2s	+0%
sign_verify	✅	2s	6s	-67%
sk_s1hat_get_poly	✅	2s	3s	-33%
sk_t0hat_get_poly	✅	2s	1s	+100%
sys_check_capability	✅	2s	1s	+100%
unpack_sk	✅	2s	3s	-33%
unpack_sk_t0hat	✅	2s	4s	-50%
yvec_init	✅	2s	5s	-60%
caddq	✅	1s	2s	-50%
fqscale	✅	1s	3s	-67%
keccak_f1600_x1_native_aarch64	✅	1s	2s	-50%
keccak_f1600_x1_native_aarch64_v84a	✅	1s	2s	-50%
keccak_f1600_x4_native_aarch64_v84a	✅	1s	2s	-50%
keccak_f1600_x4_native_aarch64_v8a_v84a_scalar_hybrid	✅	1s	3s	-67%
keccak_f1600_x4_native_avx2	✅	1s	2s	-50%
keccakf1600_permute	✅	1s	4s	-75%
keccakf1600_xor_bytes	✅	1s	4s	-75%
keccakf1600x4_extract_bytes_native	✅	1s	1s	+0%
keccakf1600x4_permute	✅	1s	1s	+0%
keccakf1600x4_xor_bytes	✅	1s	2s	-50%
make_hint	✅	1s	3s	-67%
mld_ct_get_optblocker_u8	✅	1s	4s	-75%
mld_h	✅	1s	3s	-67%
mld_keccakf1600_extract_bytes	✅	1s	2s	-50%
mld_sign_attempt	✅	1s	-	new
montgomery_reduce	✅	1s	1s	+0%
poly_caddq	✅	1s	3s	-67%
poly_caddq_c	✅	1s	5s	-80%
poly_decompose	✅	1s	2s	-50%
poly_decompose_native_x86_64	✅	1s	2s	-50%
poly_invntt_tomont_native	✅	1s	5s	-80%
poly_permute_bitrev_to_custom_optional_native	✅	1s	3s	-67%
poly_reduce	✅	1s	4s	-75%
polyt0_pack	✅	1s	5s	-80%
polyvec_matrix_expand	✅	1s	6s	-83%
polyvec_matrix_expand_serial	✅	1s	3s	-67%
polyveck_ntt	✅	1s	4s	-75%
polyveck_pack_w1	✅	1s	4s	-75%
polyvecl_pointwise_acc_montgomery	✅	1s	3s	-67%
polyvecl_pointwise_acc_montgomery_native	✅	1s	3s	-67%
polyvecl_uniform_gamma1	✅	1s	4s	-75%
polyvecl_unpack_z	✅	1s	1s	+0%
polyz_pack	✅	1s	3s	-67%
polyz_unpack	✅	1s	3s	-67%
polyz_unpack_17_native_aarch64	✅	1s	2s	-50%
rej_eta_native	✅	1s	3s	-67%
rej_uniform_native_aarch64	✅	1s	5s	-80%
shake128_init	✅	1s	6s	-83%
shake128_release	✅	1s	2s	-50%
shake256_squeeze	✅	1s	4s	-75%
sign_verify_extmu	✅	1s	2s	-50%
sk_s2hat_get_poly	✅	1s	1s	+0%
unpack_sk_s2hat	✅	1s	3s	-67%
use_hint	✅	1s	2s	-50%
yvec_get_poly	✅	1s	3s	-67%

[oqs-bot]

CBMC Results (ML-DSA-44)

⚠️ Attention Required

Proof	Status	Current	Previous	Change
compute_pack_t0_t1	⚠️	80s	50s	+60%
mld_attempt_signature_generation	⚠️	203s	58s	+250%
sig_unpack_hints	⚠️	22s	2s	+1000%
sign_keypair_internal	⚠️	20s	4s	+400%
sign_pk_from_sk	⚠️	32s	5s	+540%
sign_signature_internal	⚠️	123s	26s	+373%
sign_verify_internal	⚠️	315s	114s	+176%

Full Results (207 proofs)

Proof	Status	Current	Previous	Change
**TOTAL**	✅	1730s	1514s	+14.3%
sign_verify_internal	⚠️	315s	114s	+176%
mld_attempt_signature_generation	⚠️	203s	58s	+250%
poly_pointwise_montgomery_c	✅	141s	114s	+24%
polyvecl_pointwise_acc_montgomery_c	✅	127s	131s	-3%
sign_signature_internal	⚠️	123s	26s	+373%
compute_pack_t0_t1	⚠️	80s	50s	+60%
mld_invntt_layer	✅	56s	107s	-48%
sign_pk_from_sk	⚠️	32s	5s	+540%
fqmul	✅	22s	39s	-44%
mld_ntt_layer	✅	22s	42s	-48%
sig_unpack_hints	⚠️	22s	2s	+1000%
sign_keypair_internal	⚠️	20s	4s	+400%
polyvec_matrix_expand	✅	19s	28s	-32%
mld_ntt_butterfly_block	✅	14s	23s	-39%
keccakf1600x4_permute_native	✅	11s	22s	-50%
poly_chknorm_c	✅	9s	17s	-47%
poly_ntt_c	✅	9s	19s	-53%
polyt0_unpack	✅	9s	15s	-40%
rej_uniform	✅	8s	18s	-56%
rej_uniform_native_x86_64	✅	8s	-	new
keccak_absorb_once_x4	✅	7s	9s	-22%
poly_invntt_tomont_c	✅	7s	11s	-36%
poly_uniform_4x	✅	7s	14s	-50%
polyeta_unpack	✅	7s	14s	-50%
poly_uniform_eta_4x	✅	6s	11s	-45%
rej_uniform_c	✅	6s	15s	-60%
sign_keypair	✅	6s	4s	+50%
pointwise_acc_native_x86_64	✅	5s	7s	-29%
polyvec_matrix_expand_serial	✅	5s	8s	-38%
polyz_unpack_c	✅	5s	11s	-55%
sign_signature_pre_hash_shake256	✅	5s	3s	+67%
sk_s1hat_get_poly	✅	5s	3s	+67%
caddq	✅	4s	2s	+100%
keccak_squeezeblocks_x4	✅	4s	4s	+0%
mld_check_pct	✅	4s	14s	-71%
mld_compute_pack_z	✅	4s	7s	-43%
mld_sign_resume	✅	4s	-	new
pack_sig_z	✅	4s	4s	+0%
pointwise_native_x86_64	✅	4s	4s	+0%
poly_challenge	✅	4s	3s	+33%
poly_chknorm_native	✅	4s	4s	+0%
poly_decompose	✅	4s	3s	+33%
poly_power2round	✅	4s	4s	+0%
polyvec_matrix_pointwise_montgomery_row	✅	4s	2s	+100%
polyveck_pack_w1	✅	4s	1s	+300%
rej_eta	✅	4s	3s	+33%
rej_uniform_eta_native_x86_64	✅	4s	-	new
rej_uniform_native_aarch64	✅	4s	5s	-20%
shake256_squeeze	✅	4s	2s	+100%
sign_signature_pre_hash_internal	✅	4s	6s	-33%
sign_verify_extmu	✅	4s	3s	+33%
sys_check_capability	✅	4s	4s	+0%
yvec_get_poly	✅	4s	3s	+33%
yvec_init	✅	4s	3s	+33%
keccak_absorb	✅	3s	5s	-40%
keccak_finalize	✅	3s	3s	+0%
keccakf1600x4_permute	✅	3s	4s	-25%
mld_ct_cmask_nonzero_u8	✅	3s	2s	+50%
mld_ct_get_optblocker_i64	✅	3s	4s	-25%
mld_ct_get_optblocker_u32	✅	3s	1s	+200%
mld_ct_get_optblocker_u8	✅	3s	1s	+200%
mld_h	✅	3s	4s	-25%
mld_keccakf1600_permute_c	✅	3s	8s	-62%
mld_keccakf1600x4_xor_bytes_c	✅	3s	2s	+50%
mld_sign_attempt	✅	3s	-	new
mld_sign_finish	✅	3s	-	new
ntt_native_x86_64	✅	3s	3s	+0%
pack_sig_c	✅	3s	2s	+50%
pack_sk_rho_key_tr	✅	3s	-	new
pointwise_acc_native_aarch64	✅	3s	4s	-25%
pointwise_native_aarch64	✅	3s	5s	-40%
poly_add	✅	3s	7s	-57%
poly_caddq_c	✅	3s	2s	+50%
poly_caddq_native_aarch64	✅	3s	4s	-25%
poly_chknorm	✅	3s	4s	-25%
poly_chknorm_native_aarch64	✅	3s	4s	-25%
poly_invntt_tomont	✅	3s	4s	-25%
poly_permute_bitrev_to_custom_optional_native	✅	3s	4s	-25%
poly_reduce	✅	3s	3s	+0%
poly_uniform	✅	3s	6s	-50%
poly_uniform_gamma1_4x	✅	3s	5s	-40%
poly_use_hint	✅	3s	4s	-25%
poly_use_hint_native_aarch64	✅	3s	2s	+50%
poly_use_hint_native_x86_64	✅	3s	-	new
polyt0_pack	✅	3s	2s	+50%
polyt1_pack	✅	3s	4s	-25%
polyveck_decompose	✅	3s	4s	-25%
polyveck_ntt	✅	3s	5s	-40%
polyveck_unpack_eta	✅	3s	2s	+50%
polyvecl_ntt	✅	3s	2s	+50%
polyvecl_pointwise_acc_montgomery_native	✅	3s	2s	+50%
polyvecl_unpack_z	✅	3s	2s	+50%
polyw1_pack	✅	3s	3s	+0%
reduce32	✅	3s	2s	+50%
rej_eta_c	✅	3s	4s	-25%
rej_uniform_eta_native_aarch64	✅	3s	2s	+50%
rej_uniform_native	✅	3s	4s	-25%
shake128_finalize	✅	3s	2s	+50%
shake128x4_squeezeblocks	✅	3s	1s	+200%
shake256	✅	3s	1s	+200%
shake256_release	✅	3s	2s	+50%
sign_signature	✅	3s	3s	+0%
sign_verify_pre_hash_shake256	✅	3s	5s	-40%
sk_s2hat_get_poly	✅	3s	2s	+50%
unpack_pk_t1	✅	3s	5s	-40%
unpack_sk	✅	3s	3s	+0%
unpack_sk_t0hat	✅	3s	3s	+0%
decompose	✅	2s	2s	+0%
fqscale	✅	2s	3s	-33%
intt_native_aarch64	✅	2s	9s	-78%
intt_native_x86_64	✅	2s	4s	-50%
keccak_f1600_x1_native_aarch64_v84a	✅	2s	3s	-33%
keccak_f1600_x4_native_aarch64_v8a_scalar_hybrid	✅	2s	3s	-33%
keccak_f1600_x4_native_aarch64_v8a_v84a_scalar_hybrid	✅	2s	1s	+100%
keccak_init	✅	2s	3s	-33%
keccakf1600_extract_bytes (big endian)	✅	2s	2s	+0%
keccakf1600_permute_native	✅	2s	3s	-33%
keccakf1600_xor_bytes	✅	2s	1s	+100%
keccakf1600_xor_bytes (big endian)	✅	2s	4s	-50%
keccakf1600x4_extract_bytes	✅	2s	2s	+0%
keccakf1600x4_extract_bytes_native	✅	2s	3s	-33%
keccakf1600x4_xor_bytes	✅	2s	2s	+0%
mld_ct_cmask_nonzero_u32	✅	2s	2s	+0%
mld_ct_memcmp	✅	2s	3s	-33%
mld_ct_sel_int32	✅	2s	2s	+0%
mld_polymat_expand_entry	✅	2s	3s	-33%
mld_prepare_domain_separation_prefix	✅	2s	4s	-50%
mld_sample_pack_s1_s2	✅	2s	-	new
mld_value_barrier_i64	✅	2s	2s	+0%
mld_value_barrier_u32	✅	2s	2s	+0%
mld_value_barrier_u8	✅	2s	3s	-33%
nttunpack_native_x86_64	✅	2s	1s	+100%
pack_sig_h	✅	2s	3s	-33%
poly_caddq_native_x86_64	✅	2s	4s	-50%
poly_chknorm_native_x86_64	✅	2s	2s	+0%
poly_decompose_native	✅	2s	3s	-33%
poly_invntt_tomont_native	✅	2s	4s	-50%
poly_ntt	✅	2s	3s	-33%
poly_permute_bitrev_to_custom_optional	✅	2s	2s	+0%
poly_pointwise_montgomery_native	✅	2s	2s	+0%
poly_sub	✅	2s	3s	-33%
poly_uniform_eta	✅	2s	5s	-60%
poly_uniform_gamma1	✅	2s	4s	-50%
poly_use_hint_c	✅	2s	3s	-33%
poly_use_hint_native	✅	2s	4s	-50%
polyvec_matrix_pointwise_montgomery_yvec	✅	2s	15s	-87%
polyveck_invntt_tomont	✅	2s	5s	-60%
polyveck_unpack_eta_chknorm	✅	2s	-	new
polyvecl_pointwise_acc_montgomery	✅	2s	4s	-50%
polyvecl_unpack_eta	✅	2s	2s	+0%
polyw1_pack_88	✅	2s	1s	+100%
polyz_unpack	✅	2s	3s	-33%
polyz_unpack_17_native_aarch64	✅	2s	5s	-60%
polyz_unpack_19_native_aarch64	✅	2s	5s	-60%
power2round	✅	2s	3s	-33%
rej_eta_native	✅	2s	6s	-67%
shake128_absorb	✅	2s	2s	+0%
shake128_init	✅	2s	3s	-33%
shake128_release	✅	2s	1s	+100%
shake128_squeeze	✅	2s	1s	+100%
shake128x4_absorb_once	✅	2s	3s	-33%
shake256_absorb	✅	2s	3s	-33%
shake256_init	✅	2s	3s	-33%
shake256x4_absorb_once	✅	2s	3s	-33%
sign_signature_extmu	✅	2s	4s	-50%
sign_verify	✅	2s	4s	-50%
sign_verify_pre_hash_internal	✅	2s	3s	-33%
sk_t0hat_get_poly	✅	2s	2s	+0%
unpack_sk_s1hat	✅	2s	1s	+100%
keccak_f1600_x1_native_aarch64	✅	1s	2s	-50%
keccak_f1600_x4_native_aarch64_v84a	✅	1s	2s	-50%
keccak_f1600_x4_native_avx2	✅	1s	3s	-67%
keccak_squeeze	✅	1s	1s	+0%
keccakf1600_permute	✅	1s	2s	-50%
keccakf1600x4_xor_bytes_native	✅	1s	3s	-67%
make_hint	✅	1s	3s	-67%
mld_ct_abs_i32	✅	1s	2s	-50%
mld_ct_cmask_neg_i32	✅	1s	3s	-67%
mld_keccakf1600_extract_bytes	✅	1s	2s	-50%
mld_keccakf1600x4_extract_bytes_c	✅	1s	2s	-50%
mld_sample_pack_s1_s2_serial	✅	1s	-	new
montgomery_reduce	✅	1s	3s	-67%
ntt_native_aarch64	✅	1s	3s	-67%
poly_caddq	✅	1s	2s	-50%
poly_caddq_native	✅	1s	5s	-80%
poly_decompose_32_native_aarch64	✅	1s	2s	-50%
poly_decompose_88_native_aarch64	✅	1s	4s	-75%
poly_decompose_c	✅	1s	4s	-75%
poly_decompose_native_x86_64	✅	1s	3s	-67%
poly_ntt_native	✅	1s	5s	-80%
poly_pointwise_montgomery	✅	1s	3s	-67%
poly_shiftl	✅	1s	3s	-67%
polyeta_pack	✅	1s	3s	-67%
polyt1_unpack	✅	1s	5s	-80%
polyveck_caddq	✅	1s	3s	-67%
polyveck_reduce	✅	1s	5s	-80%
polyvecl_chknorm	✅	1s	10s	-90%
polyvecl_uniform_gamma1	✅	1s	3s	-67%
polyvecl_uniform_gamma1_serial	✅	1s	2s	-50%
polyw1_pack_32	✅	1s	2s	-50%
polyz_pack	✅	1s	2s	-50%
polyz_unpack_native	✅	1s	2s	-50%
polyz_unpack_native_x86_64	✅	1s	3s	-67%
shake256_finalize	✅	1s	2s	-50%
shake256x4_squeezeblocks	✅	1s	4s	-75%
unpack_sk_s2hat	✅	1s	4s	-75%
use_hint	✅	1s	2s	-50%

[oqs-bot]

CBMC Results (ML-DSA-65)

⚠️ Attention Required

Proof	Status	Current	Previous	Change
compute_pack_t0_t1	⚠️	130s	13s	+900%
mld_attempt_signature_generation	⚠️	242s	63s	+284%
sign_pk_from_sk	⚠️	40s	6s	+567%
sign_signature_internal	⚠️	191s	55s	+247%
sign_verify_internal	⚠️	367s	177s	+107%

Full Results (207 proofs)

Proof	Status	Current	Previous	Change
**TOTAL**	✅	1984s	1784s	+11.2%
sign_verify_internal	⚠️	367s	177s	+107%
mld_attempt_signature_generation	⚠️	242s	63s	+284%
sign_signature_internal	⚠️	191s	55s	+247%
poly_pointwise_montgomery_c	✅	134s	125s	+7%
compute_pack_t0_t1	⚠️	130s	13s	+900%
polyvecl_pointwise_acc_montgomery_c	✅	103s	210s	-51%
polyvec_matrix_expand	✅	69s	110s	-37%
mld_invntt_layer	✅	57s	109s	-48%
sign_pk_from_sk	⚠️	40s	6s	+567%
mld_ntt_layer	✅	22s	41s	-46%
fqmul	✅	21s	40s	-48%
sign_keypair_internal	✅	19s	5s	+280%
polyvec_matrix_expand_serial	✅	16s	27s	-41%
polyvec_matrix_pointwise_montgomery_yvec	✅	15s	18s	-17%
sig_unpack_hints	✅	15s	2s	+650%
keccakf1600x4_permute_native	✅	13s	23s	-43%
poly_ntt_c	✅	11s	19s	-42%
mld_ntt_butterfly_block	✅	10s	24s	-58%
polyveck_decompose	✅	10s	12s	-17%
rej_uniform	✅	10s	18s	-44%
polyt0_unpack	✅	9s	16s	-44%
rej_uniform_native_x86_64	✅	9s	-	new
poly_invntt_tomont_c	✅	8s	11s	-27%
poly_uniform_eta_4x	✅	8s	14s	-43%
poly_chknorm_c	✅	7s	15s	-53%
polyvecl_ntt	✅	6s	4s	+50%
rej_uniform_c	✅	6s	14s	-57%
mld_check_pct	✅	5s	14s	-64%
poly_add	✅	5s	9s	-44%
poly_challenge	✅	5s	6s	-17%
poly_decompose	✅	5s	2s	+150%
poly_decompose_c	✅	5s	5s	+0%
poly_uniform_4x	✅	5s	13s	-62%
poly_use_hint_c	✅	5s	5s	+0%
polyveck_caddq	✅	5s	6s	-17%
polyz_unpack_c	✅	5s	13s	-62%
rej_eta_native	✅	5s	3s	+67%
rej_uniform_native	✅	5s	4s	+25%
sign_verify_extmu	✅	5s	3s	+67%
keccakf1600x4_xor_bytes	✅	4s	1s	+300%
mld_compute_pack_z	✅	4s	7s	-43%
mld_sample_pack_s1_s2_serial	✅	4s	-	new
pointwise_acc_native_x86_64	✅	4s	8s	-50%
poly_caddq_native_x86_64	✅	4s	3s	+33%
poly_decompose_32_native_aarch64	✅	4s	3s	+33%
polyt1_pack	✅	4s	3s	+33%
polyveck_invntt_tomont	✅	4s	8s	-50%
polyveck_ntt	✅	4s	7s	-43%
polyw1_pack	✅	4s	4s	+0%
polyz_pack	✅	4s	3s	+33%
rej_eta_c	✅	4s	5s	-20%
sign_keypair	✅	4s	3s	+33%
sign_signature_pre_hash_internal	✅	4s	3s	+33%
unpack_sk_s2hat	✅	4s	4s	+0%
keccak_absorb	✅	3s	3s	+0%
keccak_absorb_once_x4	✅	3s	8s	-62%
keccak_squeezeblocks_x4	✅	3s	5s	-40%
keccakf1600x4_extract_bytes_native	✅	3s	4s	-25%
make_hint	✅	3s	2s	+50%
mld_ct_get_optblocker_u32	✅	3s	3s	+0%
mld_keccakf1600_permute_c	✅	3s	6s	-50%
mld_sample_pack_s1_s2	✅	3s	-	new
mld_sign_attempt	✅	3s	-	new
mld_value_barrier_u8	✅	3s	3s	+0%
ntt_native_aarch64	✅	3s	2s	+50%
ntt_native_x86_64	✅	3s	2s	+50%
pack_sig_z	✅	3s	2s	+50%
pointwise_acc_native_aarch64	✅	3s	6s	-50%
poly_caddq	✅	3s	2s	+50%
poly_chknorm_native	✅	3s	2s	+50%
poly_chknorm_native_aarch64	✅	3s	3s	+0%
poly_chknorm_native_x86_64	✅	3s	3s	+0%
poly_decompose_88_native_aarch64	✅	3s	1s	+200%
poly_pointwise_montgomery_native	✅	3s	3s	+0%
poly_power2round	✅	3s	4s	-25%
poly_sub	✅	3s	3s	+0%
poly_use_hint_native_x86_64	✅	3s	-	new
polyvec_matrix_pointwise_montgomery_row	✅	3s	1s	+200%
polyveck_unpack_eta_chknorm	✅	3s	-	new
polyvecl_chknorm	✅	3s	7s	-57%
polyvecl_unpack_z	✅	3s	3s	+0%
polyw1_pack_32	✅	3s	4s	-25%
reduce32	✅	3s	3s	+0%
rej_eta	✅	3s	2s	+50%
shake128x4_absorb_once	✅	3s	3s	+0%
shake256_release	✅	3s	2s	+50%
shake256_squeeze	✅	3s	3s	+0%
shake256x4_absorb_once	✅	3s	3s	+0%
shake256x4_squeezeblocks	✅	3s	2s	+50%
sign_signature	✅	3s	6s	-50%
sign_signature_extmu	✅	3s	2s	+50%
sign_signature_pre_hash_shake256	✅	3s	3s	+0%
sign_verify_pre_hash_shake256	✅	3s	5s	-40%
sk_s1hat_get_poly	✅	3s	6s	-50%
unpack_sk_s1hat	✅	3s	2s	+50%
use_hint	✅	3s	2s	+50%
caddq	✅	2s	3s	-33%
intt_native_aarch64	✅	2s	3s	-33%
keccak_f1600_x1_native_aarch64	✅	2s	2s	+0%
keccak_f1600_x1_native_aarch64_v84a	✅	2s	3s	-33%
keccak_f1600_x4_native_aarch64_v84a	✅	2s	4s	-50%
keccak_f1600_x4_native_aarch64_v8a_scalar_hybrid	✅	2s	2s	+0%
keccak_f1600_x4_native_aarch64_v8a_v84a_scalar_hybrid	✅	2s	2s	+0%
keccak_init	✅	2s	1s	+100%
keccak_squeeze	✅	2s	4s	-50%
keccakf1600_extract_bytes (big endian)	✅	2s	2s	+0%
keccakf1600_permute_native	✅	2s	3s	-33%
keccakf1600_xor_bytes	✅	2s	2s	+0%
keccakf1600x4_extract_bytes	✅	2s	4s	-50%
keccakf1600x4_permute	✅	2s	4s	-50%
keccakf1600x4_xor_bytes_native	✅	2s	3s	-33%
mld_ct_abs_i32	✅	2s	2s	+0%
mld_ct_cmask_neg_i32	✅	2s	2s	+0%
mld_ct_cmask_nonzero_u8	✅	2s	3s	-33%
mld_ct_get_optblocker_i64	✅	2s	2s	+0%
mld_ct_get_optblocker_u8	✅	2s	2s	+0%
mld_ct_memcmp	✅	2s	2s	+0%
mld_h	✅	2s	2s	+0%
mld_keccakf1600_extract_bytes	✅	2s	1s	+100%
mld_keccakf1600x4_extract_bytes_c	✅	2s	3s	-33%
mld_polymat_expand_entry	✅	2s	4s	-50%
mld_prepare_domain_separation_prefix	✅	2s	2s	+0%
mld_sign_resume	✅	2s	-	new
mld_value_barrier_i64	✅	2s	2s	+0%
mld_value_barrier_u32	✅	2s	3s	-33%
pack_sig_c	✅	2s	5s	-60%
pack_sk_rho_key_tr	✅	2s	-	new
pointwise_native_aarch64	✅	2s	5s	-60%
pointwise_native_x86_64	✅	2s	3s	-33%
poly_caddq_c	✅	2s	2s	+0%
poly_caddq_native_aarch64	✅	2s	2s	+0%
poly_chknorm	✅	2s	4s	-50%
poly_decompose_native_x86_64	✅	2s	3s	-33%
poly_invntt_tomont	✅	2s	3s	-33%
poly_invntt_tomont_native	✅	2s	2s	+0%
poly_ntt	✅	2s	2s	+0%
poly_ntt_native	✅	2s	4s	-50%
poly_permute_bitrev_to_custom_optional	✅	2s	2s	+0%
poly_reduce	✅	2s	3s	-33%
poly_shiftl	✅	2s	3s	-33%
poly_uniform	✅	2s	4s	-50%
poly_uniform_eta	✅	2s	4s	-50%
poly_uniform_gamma1	✅	2s	3s	-33%
poly_use_hint	✅	2s	3s	-33%
poly_use_hint_native	✅	2s	2s	+0%
poly_use_hint_native_aarch64	✅	2s	3s	-33%
polyeta_unpack	✅	2s	8s	-75%
polyt0_pack	✅	2s	3s	-33%
polyt1_unpack	✅	2s	5s	-60%
polyveck_pack_w1	✅	2s	3s	-33%
polyveck_reduce	✅	2s	4s	-50%
polyveck_unpack_eta	✅	2s	6s	-67%
polyvecl_pointwise_acc_montgomery_native	✅	2s	2s	+0%
polyvecl_uniform_gamma1	✅	2s	2s	+0%
polyvecl_unpack_eta	✅	2s	3s	-33%
polyw1_pack_88	✅	2s	2s	+0%
polyz_unpack_17_native_aarch64	✅	2s	3s	-33%
polyz_unpack_19_native_aarch64	✅	2s	3s	-33%
power2round	✅	2s	1s	+100%
rej_uniform_eta_native_x86_64	✅	2s	-	new
rej_uniform_native_aarch64	✅	2s	3s	-33%
shake128_absorb	✅	2s	2s	+0%
shake128_release	✅	2s	3s	-33%
shake128_squeeze	✅	2s	2s	+0%
shake128x4_squeezeblocks	✅	2s	3s	-33%
shake256_absorb	✅	2s	2s	+0%
shake256_finalize	✅	2s	1s	+100%
sign_verify	✅	2s	3s	-33%
sign_verify_pre_hash_internal	✅	2s	5s	-60%
sk_s2hat_get_poly	✅	2s	2s	+0%
sys_check_capability	✅	2s	4s	-50%
unpack_pk_t1	✅	2s	5s	-60%
unpack_sk	✅	2s	3s	-33%
unpack_sk_t0hat	✅	2s	5s	-60%
yvec_init	✅	2s	3s	-33%
decompose	✅	1s	1s	+0%
fqscale	✅	1s	3s	-67%
intt_native_x86_64	✅	1s	3s	-67%
keccak_f1600_x4_native_avx2	✅	1s	2s	-50%
keccak_finalize	✅	1s	2s	-50%
keccakf1600_permute	✅	1s	2s	-50%
keccakf1600_xor_bytes (big endian)	✅	1s	2s	-50%
mld_ct_cmask_nonzero_u32	✅	1s	4s	-75%
mld_ct_sel_int32	✅	1s	3s	-67%
mld_keccakf1600x4_xor_bytes_c	✅	1s	2s	-50%
mld_sign_finish	✅	1s	-	new
montgomery_reduce	✅	1s	4s	-75%
nttunpack_native_x86_64	✅	1s	3s	-67%
pack_sig_h	✅	1s	5s	-80%
poly_caddq_native	✅	1s	2s	-50%
poly_decompose_native	✅	1s	3s	-67%
poly_permute_bitrev_to_custom_optional_native	✅	1s	4s	-75%
poly_pointwise_montgomery	✅	1s	3s	-67%
poly_uniform_gamma1_4x	✅	1s	4s	-75%
polyeta_pack	✅	1s	3s	-67%
polyvecl_pointwise_acc_montgomery	✅	1s	3s	-67%
polyvecl_uniform_gamma1_serial	✅	1s	3s	-67%
polyz_unpack	✅	1s	3s	-67%
polyz_unpack_native	✅	1s	4s	-75%
polyz_unpack_native_x86_64	✅	1s	3s	-67%
rej_uniform_eta_native_aarch64	✅	1s	4s	-75%
shake128_finalize	✅	1s	1s	+0%
shake128_init	✅	1s	2s	-50%
shake256	✅	1s	2s	-50%
shake256_init	✅	1s	2s	-50%
sk_t0hat_get_poly	✅	1s	2s	-50%
yvec_get_poly	✅	1s	3s	-67%

[oqs-bot]

CBMC Results (ML-DSA-87)

⚠️ Attention Required

Proof	Status	Current	Previous	Change
compute_pack_t0_t1	⚠️	214s	19s	+1026%
mld_attempt_signature_generation	⚠️	276s	55s	+402%
sign_keypair_internal	⚠️	32s	6s	+433%
sign_pk_from_sk	⚠️	50s	6s	+733%
sign_signature_internal	⚠️	344s	42s	+719%
sign_verify_internal	⚠️	579s	97s	+497%

Full Results (207 proofs)

Proof	Status	Current	Previous	Change
**TOTAL**	✅	2523s	2151s	+17.3%
sign_verify_internal	⚠️	579s	97s	+497%
sign_signature_internal	⚠️	344s	42s	+719%
mld_attempt_signature_generation	⚠️	276s	55s	+402%
compute_pack_t0_t1	⚠️	214s	19s	+1026%
poly_pointwise_montgomery_c	✅	132s	144s	-8%
polyvecl_pointwise_acc_montgomery_c	✅	108s	353s	-69%
polyvec_matrix_expand	✅	82s	324s	-75%
mld_invntt_layer	✅	57s	115s	-50%
sign_pk_from_sk	⚠️	50s	6s	+733%
sign_keypair_internal	⚠️	32s	6s	+433%
mld_ntt_layer	✅	22s	45s	-51%
fqmul	✅	21s	43s	-51%
polyvec_matrix_expand_serial	✅	20s	38s	-47%
sig_unpack_hints	✅	13s	3s	+333%
keccakf1600x4_permute_native	✅	12s	23s	-48%
mld_ntt_butterfly_block	✅	12s	24s	-50%
polyvec_matrix_pointwise_montgomery_yvec	✅	12s	18s	-33%
poly_ntt_c	✅	11s	21s	-48%
polyt0_unpack	✅	11s	14s	-21%
poly_chknorm_c	✅	8s	15s	-47%
rej_uniform	✅	8s	15s	-47%
rej_uniform_native_x86_64	✅	8s	-	new
sign_signature	✅	8s	5s	+60%
keccak_absorb_once_x4	✅	7s	9s	-22%
mld_sign_finish	✅	7s	-	new
polyeta_unpack	✅	7s	17s	-59%
poly_uniform_eta_4x	✅	6s	11s	-45%
polyveck_decompose	✅	6s	13s	-54%
polyvecl_ntt	✅	6s	7s	-14%
rej_uniform_c	✅	6s	19s	-68%
sign_keypair	✅	6s	4s	+50%
keccak_absorb	✅	5s	3s	+67%
mld_check_pct	✅	5s	16s	-69%
mld_compute_pack_z	✅	5s	8s	-38%
mld_keccakf1600_permute_c	✅	5s	7s	-29%
poly_invntt_tomont_c	✅	5s	12s	-58%
poly_power2round	✅	5s	3s	+67%
poly_uniform_4x	✅	5s	13s	-62%
polyveck_ntt	✅	5s	11s	-55%
polyz_unpack_c	✅	5s	3s	+67%
sign_signature_pre_hash_shake256	✅	5s	6s	-17%
sign_verify_extmu	✅	5s	3s	+67%
intt_native_aarch64	✅	4s	3s	+33%
keccak_squeeze	✅	4s	2s	+100%
mld_ct_get_optblocker_u8	✅	4s	3s	+33%
mld_h	✅	4s	3s	+33%
mld_polymat_expand_entry	✅	4s	3s	+33%
mld_sample_pack_s1_s2	✅	4s	-	new
pointwise_acc_native_aarch64	✅	4s	6s	-33%
pointwise_acc_native_x86_64	✅	4s	6s	-33%
poly_chknorm_native	✅	4s	4s	+0%
poly_uniform	✅	4s	4s	+0%
poly_uniform_eta	✅	4s	4s	+0%
polyt0_pack	✅	4s	4s	+0%
polyvecl_pointwise_acc_montgomery_native	✅	4s	3s	+33%
polyz_pack	✅	4s	5s	-20%
power2round	✅	4s	4s	+0%
rej_uniform_eta_native_aarch64	✅	4s	5s	-20%
rej_uniform_eta_native_x86_64	✅	4s	-	new
sign_verify	✅	4s	5s	-20%
sign_verify_pre_hash_shake256	✅	4s	3s	+33%
sk_t0hat_get_poly	✅	4s	4s	+0%
use_hint	✅	4s	3s	+33%
decompose	✅	3s	3s	+0%
fqscale	✅	3s	3s	+0%
intt_native_x86_64	✅	3s	3s	+0%
keccak_f1600_x4_native_aarch64_v84a	✅	3s	4s	-25%
keccakf1600_permute_native	✅	3s	4s	-25%
keccakf1600_xor_bytes (big endian)	✅	3s	2s	+50%
keccakf1600x4_extract_bytes_native	✅	3s	2s	+50%
keccakf1600x4_xor_bytes	✅	3s	3s	+0%
make_hint	✅	3s	3s	+0%
mld_ct_abs_i32	✅	3s	3s	+0%
mld_ct_cmask_neg_i32	✅	3s	4s	-25%
mld_keccakf1600x4_extract_bytes_c	✅	3s	2s	+50%
mld_prepare_domain_separation_prefix	✅	3s	4s	-25%
mld_sample_pack_s1_s2_serial	✅	3s	-	new
ntt_native_x86_64	✅	3s	2s	+50%
pack_sig_c	✅	3s	4s	-25%
pack_sig_h	✅	3s	4s	-25%
pointwise_native_x86_64	✅	3s	2s	+50%
poly_chknorm	✅	3s	3s	+0%
poly_decompose_c	✅	3s	5s	-40%
poly_decompose_native_x86_64	✅	3s	2s	+50%
poly_invntt_tomont	✅	3s	1s	+200%
poly_ntt	✅	3s	3s	+0%
poly_ntt_native	✅	3s	3s	+0%
poly_permute_bitrev_to_custom_optional_native	✅	3s	5s	-40%
poly_reduce	✅	3s	2s	+50%
poly_use_hint_c	✅	3s	2s	+50%
poly_use_hint_native_x86_64	✅	3s	-	new
polyt1_pack	✅	3s	3s	+0%
polyveck_caddq	✅	3s	8s	-62%
polyveck_invntt_tomont	✅	3s	9s	-67%
polyveck_unpack_eta	✅	3s	4s	-25%
polyveck_unpack_eta_chknorm	✅	3s	-	new
polyz_unpack	✅	3s	2s	+50%
polyz_unpack_17_native_aarch64	✅	3s	3s	+0%
polyz_unpack_native_x86_64	✅	3s	3s	+0%
rej_eta	✅	3s	4s	-25%
rej_eta_native	✅	3s	6s	-50%
sign_signature_extmu	✅	3s	4s	-25%
sign_signature_pre_hash_internal	✅	3s	5s	-40%
sign_verify_pre_hash_internal	✅	3s	3s	+0%
unpack_sk_s1hat	✅	3s	2s	+50%
unpack_sk_t0hat	✅	3s	7s	-57%
keccak_f1600_x4_native_aarch64_v8a_scalar_hybrid	✅	2s	3s	-33%
keccak_f1600_x4_native_aarch64_v8a_v84a_scalar_hybrid	✅	2s	4s	-50%
keccak_finalize	✅	2s	1s	+100%
keccak_init	✅	2s	3s	-33%
keccak_squeezeblocks_x4	✅	2s	4s	-50%
keccakf1600_extract_bytes (big endian)	✅	2s	3s	-33%
keccakf1600_permute	✅	2s	3s	-33%
keccakf1600x4_extract_bytes	✅	2s	2s	+0%
keccakf1600x4_permute	✅	2s	3s	-33%
keccakf1600x4_xor_bytes_native	✅	2s	3s	-33%
mld_ct_cmask_nonzero_u8	✅	2s	3s	-33%
mld_ct_get_optblocker_i64	✅	2s	3s	-33%
mld_ct_get_optblocker_u32	✅	2s	2s	+0%
mld_ct_sel_int32	✅	2s	3s	-33%
mld_sign_attempt	✅	2s	-	new
ntt_native_aarch64	✅	2s	6s	-67%
pack_sig_z	✅	2s	5s	-60%
pointwise_native_aarch64	✅	2s	5s	-60%
poly_add	✅	2s	6s	-67%
poly_caddq	✅	2s	2s	+0%
poly_caddq_c	✅	2s	3s	-33%
poly_caddq_native_aarch64	✅	2s	3s	-33%
poly_caddq_native_x86_64	✅	2s	2s	+0%
poly_challenge	✅	2s	5s	-60%
poly_chknorm_native_aarch64	✅	2s	4s	-50%
poly_decompose	✅	2s	3s	-33%
poly_decompose_32_native_aarch64	✅	2s	5s	-60%
poly_decompose_native	✅	2s	2s	+0%
poly_invntt_tomont_native	✅	2s	5s	-60%
poly_permute_bitrev_to_custom_optional	✅	2s	3s	-33%
poly_pointwise_montgomery	✅	2s	4s	-50%
poly_shiftl	✅	2s	4s	-50%
poly_sub	✅	2s	3s	-33%
poly_use_hint	✅	2s	1s	+100%
poly_use_hint_native	✅	2s	3s	-33%
polyeta_pack	✅	2s	4s	-50%
polyveck_pack_w1	✅	2s	3s	-33%
polyvecl_chknorm	✅	2s	7s	-71%
polyvecl_pointwise_acc_montgomery	✅	2s	5s	-60%
polyvecl_uniform_gamma1	✅	2s	2s	+0%
polyvecl_uniform_gamma1_serial	✅	2s	4s	-50%
polyvecl_unpack_eta	✅	2s	5s	-60%
polyw1_pack	✅	2s	4s	-50%
polyz_unpack_19_native_aarch64	✅	2s	4s	-50%
rej_eta_c	✅	2s	5s	-60%
rej_uniform_native	✅	2s	8s	-75%
shake128_absorb	✅	2s	4s	-50%
shake128_release	✅	2s	4s	-50%
shake128x4_absorb_once	✅	2s	5s	-60%
shake128x4_squeezeblocks	✅	2s	3s	-33%
shake256	✅	2s	2s	+0%
shake256_absorb	✅	2s	2s	+0%
shake256_finalize	✅	2s	2s	+0%
shake256_release	✅	2s	3s	-33%
shake256x4_absorb_once	✅	2s	2s	+0%
shake256x4_squeezeblocks	✅	2s	1s	+100%
sk_s1hat_get_poly	✅	2s	3s	-33%
sk_s2hat_get_poly	✅	2s	3s	-33%
sys_check_capability	✅	2s	3s	-33%
unpack_pk_t1	✅	2s	1s	+100%
unpack_sk	✅	2s	5s	-60%
unpack_sk_s2hat	✅	2s	3s	-33%
yvec_get_poly	✅	2s	4s	-50%
caddq	✅	1s	4s	-75%
keccak_f1600_x1_native_aarch64	✅	1s	1s	+0%
keccak_f1600_x1_native_aarch64_v84a	✅	1s	1s	+0%
keccak_f1600_x4_native_avx2	✅	1s	2s	-50%
keccakf1600_xor_bytes	✅	1s	3s	-67%
mld_ct_cmask_nonzero_u32	✅	1s	2s	-50%
mld_ct_memcmp	✅	1s	3s	-67%
mld_keccakf1600_extract_bytes	✅	1s	4s	-75%
mld_keccakf1600x4_xor_bytes_c	✅	1s	4s	-75%
mld_sign_resume	✅	1s	-	new
mld_value_barrier_i64	✅	1s	1s	+0%
mld_value_barrier_u32	✅	1s	2s	-50%
mld_value_barrier_u8	✅	1s	3s	-67%
montgomery_reduce	✅	1s	3s	-67%
nttunpack_native_x86_64	✅	1s	3s	-67%
pack_sk_rho_key_tr	✅	1s	-	new
poly_caddq_native	✅	1s	4s	-75%
poly_chknorm_native_x86_64	✅	1s	2s	-50%
poly_decompose_88_native_aarch64	✅	1s	2s	-50%
poly_pointwise_montgomery_native	✅	1s	5s	-80%
poly_uniform_gamma1	✅	1s	4s	-75%
poly_uniform_gamma1_4x	✅	1s	3s	-67%
poly_use_hint_native_aarch64	✅	1s	2s	-50%
polyt1_unpack	✅	1s	4s	-75%
polyvec_matrix_pointwise_montgomery_row	✅	1s	3s	-67%
polyveck_reduce	✅	1s	3s	-67%
polyvecl_unpack_z	✅	1s	4s	-75%
polyw1_pack_32	✅	1s	4s	-75%
polyw1_pack_88	✅	1s	3s	-67%
polyz_unpack_native	✅	1s	4s	-75%
reduce32	✅	1s	3s	-67%
rej_uniform_native_aarch64	✅	1s	2s	-50%
shake128_finalize	✅	1s	2s	-50%
shake128_init	✅	1s	1s	+0%
shake128_squeeze	✅	1s	2s	-50%
shake256_init	✅	1s	2s	-50%
shake256_squeeze	✅	1s	2s	-50%
yvec_init	✅	1s	4s	-75%

[github-actions]

Arm Cortex-M55 (NUCLEO-N657X0-Q) benchmarks (opt)

Details

Benchmark suite	Current: d754692	Previous: 5a21649	Ratio
ML-DSA-44 keypair	2144222 cycles	2129870 cycles	1.01
ML-DSA-44 sign	17851722 cycles	17851737 cycles	1.00
ML-DSA-44 verify	2398854 cycles	2398861 cycles	1.00
ML-DSA-65 keypair	3737768 cycles	3731128 cycles	1.00
ML-DSA-65 sign	14799296 cycles	14793522 cycles	1.00
ML-DSA-65 verify	4013893 cycles	4012814 cycles	1.00
ML-DSA-87 keypair	6522906 cycles	6482838 cycles	1.01
ML-DSA-87 sign	24787769 cycles	24785143 cycles	1.00
ML-DSA-87 verify	6864906 cycles	6864412 cycles	1.00

This comment was automatically generated by workflow using github-action-benchmark.

[github-actions]

Arm Cortex-M55 (NUCLEO-N657X0-Q) benchmarks (no-opt)

Details

Benchmark suite	Current: d754692	Previous: 5a21649	Ratio
ML-DSA-44 keypair	2342009 cycles	2328440 cycles	1.01
ML-DSA-44 sign	17851737 cycles	17851737 cycles	1
ML-DSA-44 verify	2398868 cycles	2398876 cycles	1.00
ML-DSA-65 keypair	4031095 cycles	4025122 cycles	1.00
ML-DSA-65 sign	14793522 cycles	14793522 cycles	1
ML-DSA-65 verify	4012785 cycles	4012792 cycles	1.00
ML-DSA-87 keypair	6903169 cycles	6864887 cycles	1.01
ML-DSA-87 sign	24785165 cycles	24785157 cycles	1.00
ML-DSA-87 verify	6864426 cycles	6864412 cycles	1.00

This comment was automatically generated by workflow using github-action-benchmark.

[github-actions]

⚠️ Performance Alert ⚠️

Possible performance regression was detected for benchmark 'Mac Mini (M1, 2020) benchmarks (opt)'.
Benchmark result of this commit is worse than the previous benchmark result exceeding threshold 1.03.

Benchmark suite	Current: d754692	Previous: 5a21649	Ratio
ML-DSA-44 keypair	48123 cycles	46514 cycles	1.03

This comment was automatically generated by workflow using github-action-benchmark.

[github-actions]

⚠️ Performance Alert ⚠️

Possible performance regression was detected for benchmark 'Mac Mini (M1, 2020) benchmarks (opt)'.
Benchmark result of this commit is worse than the previous benchmark result exceeding threshold 1.03.

Benchmark suite	Current: d754692	Previous: 5a21649	Ratio
ML-DSA-44 keypair	48100 cycles	46514 cycles	1.03

This comment was automatically generated by workflow using github-action-benchmark.

[github-actions]

⚠️ Performance Alert ⚠️

Possible performance regression was detected for benchmark 'Mac Mini (M1, 2020) benchmarks (opt)'.
Benchmark result of this commit is worse than the previous benchmark result exceeding threshold 1.03.

Benchmark suite	Current: d754692	Previous: 5a21649	Ratio
ML-DSA-44 keypair	47935 cycles	46514 cycles	1.03

This comment was automatically generated by workflow using github-action-benchmark.

[github-actions]

⚠️ Performance Alert ⚠️

Possible performance regression was detected for benchmark 'Mac Mini (M1, 2020) benchmarks (opt)'.
Benchmark result of this commit is worse than the previous benchmark result exceeding threshold 1.03.

Benchmark suite	Current: d754692	Previous: 5a21649	Ratio
ML-DSA-44 keypair	48247 cycles	46514 cycles	1.04

This comment was automatically generated by workflow using github-action-benchmark.

[github-actions]

⚠️ Performance Alert ⚠️

Possible performance regression was detected for benchmark 'Mac Mini (M1, 2020) benchmarks (opt)'.
Benchmark result of this commit is worse than the previous benchmark result exceeding threshold 1.03.

Benchmark suite	Current: d754692	Previous: 5a21649	Ratio
ML-DSA-44 keypair	48150 cycles	46514 cycles	1.04

This comment was automatically generated by workflow using github-action-benchmark.