Add configs to disable unused APIs [full CI] by mkannwischer · Pull Request #1000 · pq-code-package/mldsa-native

mkannwischer · 2026-03-21T01:31:34Z

Continuation of #960 by @flynd to run full CI.

oqs-bot · 2026-03-21T02:14:17Z

CBMC Results (ML-DSA-65)

Full Results (184 proofs)

Proof	Status	Current	Previous	Change
`TOTAL`	✅	2448s	2314s	+5.8%
`sign_verify_internal`	✅	413s	319s	+29%
`mld_attempt_signature_generation`	✅	289s	269s	+7%
`polyvecl_pointwise_acc_montgomery_c`	✅	177s	167s	+6%
`rej_uniform_native`	✅	148s	145s	+2%
`poly_pointwise_montgomery_c`	✅	144s	142s	+1%
`polyvec_matrix_expand`	✅	88s	116s	-24%
`mld_invntt_layer`	✅	85s	92s	-8%
`mld_ct_memcmp`	✅	73s	71s	+3%
`polyvec_matrix_expand_serial`	✅	66s	66s	+0%
`mld_ntt_layer`	✅	40s	52s	-23%
`mld_compute_t0_t1_tr_from_sk_components`	✅	29s	24s	+21%
`sign_signature_internal`	✅	26s	25s	+4%
`poly_chknorm_c`	✅	23s	19s	+21%
`fqmul`	✅	22s	18s	+22%
`rej_uniform`	✅	20s	20s	+0%
`poly_uniform_eta_4x`	✅	18s	16s	+12%
`polymat_permute_bitrev_to_custom`	✅	18s	27s	-33%
`polyveck_decompose`	✅	15s	15s	+0%
`mld_ntt_butterfly_block`	✅	14s	12s	+17%
`polyt0_unpack`	✅	14s	13s	+8%
`rej_uniform_c`	✅	14s	14s	+0%
`poly_uniform_4x`	✅	13s	17s	-24%
`keccakf1600x4_permute_native`	✅	12s	14s	-14%
`mld_check_pct`	✅	12s	10s	+20%
`polyveck_sub`	✅	12s	12s	+0%
`poly_add`	✅	11s	10s	+10%
`polyvec_matrix_pointwise_montgomery`	✅	11s	11s	+0%
`polyveck_add`	✅	11s	9s	+22%
`polyvecl_chknorm`	✅	11s	12s	-8%
`polyveck_power2round`	✅	10s	12s	-17%
`mld_polyvecl_permute_bitrev_to_custom_native`	✅	9s	8s	+12%
`polyveck_invntt_tomont`	✅	9s	8s	+12%
`polyveck_reduce`	✅	9s	7s	+29%
`polyveck_shiftl`	✅	9s	9s	+0%
`polyvecl_ntt`	✅	9s	8s	+12%
`keccak_absorb_once_x4`	✅	8s	10s	-20%
`keccakf1600_permute`	✅	8s	8s	+0%
`keccakf1600_permute_native`	✅	8s	8s	+0%
`poly_decompose_c`	✅	8s	8s	+0%
`poly_uniform_gamma1`	✅	8s	4s	+100%
`polyveck_ntt`	✅	8s	6s	+33%
`polyveck_pointwise_poly_montgomery_t0`	✅	8s	5s	+60%
`polyveck_use_hint`	✅	8s	7s	+14%
`sign_pk_from_sk`	✅	8s	7s	+14%
`poly_invntt_tomont_c`	✅	7s	4s	+75%
`poly_pointwise_montgomery`	✅	7s	2s	+250%
`poly_power2round`	✅	7s	3s	+133%
`polyvecl_unpack_eta`	✅	7s	4s	+75%
`sign`	✅	7s	7s	+0%
`keccak_absorb`	✅	6s	9s	-33%
`mld_compute_pack_z`	✅	6s	8s	-25%
`mld_h`	✅	6s	5s	+20%
`mld_sample_s1_s2`	✅	6s	7s	-14%
`poly_uniform_gamma1_4x`	✅	6s	3s	+100%
`polyeta_unpack`	✅	6s	4s	+50%
`polyveck_caddq`	✅	6s	6s	+0%
`polyveck_make_hint`	✅	6s	5s	+20%
`polyveck_pointwise_poly_montgomery`	✅	6s	6s	+0%
`polyveck_pointwise_poly_montgomery_s2`	✅	6s	5s	+20%
`sign_keypair_internal`	✅	6s	5s	+20%
`sign_open`	✅	6s	4s	+50%
`sign_signature_pre_hash_internal`	✅	6s	4s	+50%
`mld_prepare_domain_separation_prefix`	✅	5s	6s	-17%
`mld_sample_s1_s2_serial`	✅	5s	6s	-17%
`pack_sig_c_h`	✅	5s	3s	+67%
`pack_sk`	✅	5s	3s	+67%
`poly_uniform`	✅	5s	4s	+25%
`polyveck_chknorm`	✅	5s	6s	-17%
`polyveck_pack_t0`	✅	5s	3s	+67%
`polyvecl_pack_eta`	✅	5s	3s	+67%
`polyvecl_pointwise_acc_montgomery`	✅	5s	3s	+67%
`polyvecl_pointwise_acc_montgomery_native`	✅	5s	5s	+0%
`polyz_unpack_c`	✅	5s	5s	+0%
`sign_signature`	✅	5s	2s	+150%
`sign_signature_extmu`	✅	5s	5s	+0%
`unpack_sk`	✅	5s	7s	-29%
`caddq`	✅	4s	3s	+33%
`keccak_f1600_x4_native_aarch64_v8a_scalar_hybrid`	✅	4s	5s	-20%
`keccak_squeezeblocks_x4`	✅	4s	6s	-33%
`mld_ct_cmask_nonzero_u32`	✅	4s	3s	+33%
`mld_ct_get_optblocker_u8`	✅	4s	2s	+100%
`montgomery_reduce`	✅	4s	2s	+100%
`poly_caddq_c`	✅	4s	7s	-43%
`poly_challenge`	✅	4s	2s	+100%
`poly_chknorm_native`	✅	4s	2s	+100%
`poly_decompose`	✅	4s	5s	-20%
`poly_decompose_native`	✅	4s	4s	+0%
`poly_ntt`	✅	4s	4s	+0%
`poly_shiftl`	✅	4s	3s	+33%
`poly_sub`	✅	4s	4s	+0%
`poly_use_hint_c`	✅	4s	4s	+0%
`polyt0_pack`	✅	4s	3s	+33%
`polyveck_pack_eta`	✅	4s	3s	+33%
`polyveck_unpack_t0`	✅	4s	4s	+0%
`polyvecl_permute_bitrev_to_custom`	✅	4s	5s	-20%
`power2round`	✅	4s	1s	+300%
`rej_eta`	✅	4s	3s	+33%
`rej_eta_native`	✅	4s	3s	+33%
`shake256_finalize`	✅	4s	1s	+300%
`shake256x4_squeezeblocks`	✅	4s	5s	-20%
`sign_keypair`	✅	4s	6s	-33%
`sign_signature_pre_hash_shake256`	✅	4s	2s	+100%
`sign_verify`	✅	4s	6s	-33%
`sign_verify_pre_hash_internal`	✅	4s	4s	+0%
`fqscale`	✅	3s	4s	-25%
`intt_native_x86_64`	✅	3s	3s	+0%
`keccak_f1600_x4_native_aarch64_v8a_v84a_scalar_hybrid`	✅	3s	3s	+0%
`keccakf1600_xor_bytes (big endian)`	✅	3s	3s	+0%
`keccakf1600x4_xor_bytes`	✅	3s	1s	+200%
`make_hint`	✅	3s	5s	-40%
`mld_ct_cmask_neg_i32`	✅	3s	1s	+200%
`mld_ct_get_optblocker_u32`	✅	3s	2s	+50%
`ntt_native_aarch64`	✅	3s	6s	-50%
`ntt_native_x86_64`	✅	3s	4s	-25%
`poly_caddq`	✅	3s	1s	+200%
`poly_caddq_native`	✅	3s	5s	-40%
`poly_caddq_native_aarch64`	✅	3s	3s	+0%
`poly_chknorm_native_aarch64`	✅	3s	2s	+50%
`poly_invntt_tomont`	✅	3s	4s	-25%
`poly_ntt_native`	✅	3s	2s	+50%
`poly_uniform_eta`	✅	3s	3s	+0%
`poly_use_hint`	✅	3s	1s	+200%
`polyeta_pack`	✅	3s	3s	+0%
`polyt1_pack`	✅	3s	3s	+0%
`polyt1_unpack`	✅	3s	2s	+50%
`polyveck_pack_w1`	✅	3s	2s	+50%
`polyveck_unpack_eta`	✅	3s	2s	+50%
`polyvecl_uniform_gamma1`	✅	3s	2s	+50%
`polyvecl_unpack_z`	✅	3s	2s	+50%
`polyw1_pack`	✅	3s	3s	+0%
`polyz_unpack`	✅	3s	4s	-25%
`polyz_unpack_native`	✅	3s	2s	+50%
`reduce32`	✅	3s	3s	+0%
`rej_eta_c`	✅	3s	4s	-25%
`shake128_absorb`	✅	3s	3s	+0%
`shake128_release`	✅	3s	2s	+50%
`shake128_squeeze`	✅	3s	3s	+0%
`shake128x4_absorb_once`	✅	3s	2s	+50%
`shake256`	✅	3s	1s	+200%
`shake256_release`	✅	3s	3s	+0%
`shake256x4_absorb_once`	✅	3s	2s	+50%
`sign_verify_extmu`	✅	3s	5s	-40%
`sign_verify_pre_hash_shake256`	✅	3s	6s	-50%
`unpack_hints`	✅	3s	5s	-40%
`unpack_pk`	✅	3s	2s	+50%
`unpack_sig`	✅	3s	3s	+0%
`decompose`	✅	2s	3s	-33%
`keccak_f1600_x1_native_aarch64`	✅	2s	2s	+0%
`keccak_f1600_x4_native_aarch64_v84a`	✅	2s	1s	+100%
`keccak_finalize`	✅	2s	3s	-33%
`keccak_init`	✅	2s	3s	-33%
`keccakf1600_extract_bytes (big endian)`	✅	2s	1s	+100%
`keccakf1600_xor_bytes`	✅	2s	5s	-60%
`keccakf1600x4_extract_bytes`	✅	2s	4s	-50%
`keccakf1600x4_permute`	✅	2s	1s	+100%
`mld_ct_abs_i32`	✅	2s	4s	-50%
`mld_ct_cmask_nonzero_u8`	✅	2s	1s	+100%
`mld_ct_get_optblocker_i64`	✅	2s	2s	+0%
`mld_ct_sel_int32`	✅	2s	1s	+100%
`mld_keccakf1600_extract_bytes`	✅	2s	1s	+100%
`mld_value_barrier_i64`	✅	2s	2s	+0%
`mld_value_barrier_u8`	✅	2s	2s	+0%
`pack_pk`	✅	2s	3s	-33%
`pack_sig_z`	✅	2s	1s	+100%
`poly_chknorm`	✅	2s	4s	-50%
`poly_invntt_tomont_native`	✅	2s	3s	-33%
`poly_ntt_c`	✅	2s	3s	-33%
`poly_reduce`	✅	2s	1s	+100%
`poly_use_hint_native`	✅	2s	2s	+0%
`polyvecl_uniform_gamma1_serial`	✅	2s	3s	-33%
`polyz_pack`	✅	2s	2s	+0%
`shake128_finalize`	✅	2s	1s	+100%
`shake128_init`	✅	2s	2s	+0%
`shake128x4_squeezeblocks`	✅	2s	2s	+0%
`shake256_absorb`	✅	2s	2s	+0%
`shake256_init`	✅	2s	4s	-50%
`shake256_squeeze`	✅	2s	3s	-33%
`sys_check_capability`	✅	2s	1s	+100%
`use_hint`	✅	2s	2s	+0%
`keccak_f1600_x1_native_aarch64_v84a`	✅	1s	1s	+0%
`keccak_squeeze`	✅	1s	4s	-75%
`mld_value_barrier_u32`	✅	1s	1s	+0%
`poly_make_hint`	✅	1s	2s	-50%
`poly_pointwise_montgomery_native`	✅	1s	3s	-67%

oqs-bot · 2026-03-21T02:15:14Z

CBMC Results (ML-DSA-44)

⚠️ Attention Required

Proof	Status	Current	Previous	Change
`mld_invntt_layer`	⚠️	149s	88s	+69%
`poly_invntt_tomont_c`	⚠️	140s	7s	+1900%
`sign_verify_internal`	⚠️	282s	184s	+53%

Full Results (184 proofs)

Proof	Status	Current	Previous	Change
`TOTAL`	✅	2321s	2059s	+12.7%
`sign_verify_internal`	⚠️	282s	184s	+53%
`mld_attempt_signature_generation`	✅	236s	255s	-7%
`polyvecl_pointwise_acc_montgomery_c`	✅	218s	214s	+2%
`poly_pointwise_montgomery_c`	✅	160s	163s	-2%
`mld_invntt_layer`	⚠️	149s	88s	+69%
`rej_uniform_native`	✅	148s	148s	+0%
`poly_invntt_tomont_c`	⚠️	140s	7s	+1900%
`mld_ct_memcmp`	✅	76s	72s	+6%
`mld_ntt_layer`	✅	55s	56s	-2%
`rej_uniform`	✅	22s	23s	-4%
`poly_chknorm_c`	✅	20s	21s	-5%
`sign_signature_internal`	✅	19s	19s	+0%
`fqmul`	✅	18s	19s	-5%
`poly_uniform_eta_4x`	✅	17s	18s	-6%
`polyeta_unpack`	✅	17s	16s	+6%
`mld_compute_t0_t1_tr_from_sk_components`	✅	16s	13s	+23%
`poly_uniform_4x`	✅	16s	17s	-6%
`polymat_permute_bitrev_to_custom`	✅	15s	17s	-12%
`polyt0_unpack`	✅	15s	14s	+7%
`polyvec_matrix_expand`	✅	15s	18s	-17%
`polyvec_matrix_expand_serial`	✅	14s	11s	+27%
`rej_uniform_c`	✅	14s	15s	-7%
`keccakf1600x4_permute_native`	✅	13s	12s	+8%
`mld_ntt_butterfly_block`	✅	13s	16s	-19%
`polyvec_matrix_pointwise_montgomery`	✅	12s	12s	+0%
`keccak_absorb_once_x4`	✅	11s	9s	+22%
`poly_add`	✅	11s	11s	+0%
`polyveck_power2round`	✅	11s	12s	-8%
`polyz_unpack_c`	✅	11s	12s	-8%
`mld_check_pct`	✅	9s	7s	+29%
`unpack_sk`	✅	9s	7s	+29%
`keccakf1600_permute_native`	✅	8s	10s	-20%
`mld_polyvecl_permute_bitrev_to_custom_native`	✅	8s	8s	+0%
`keccakf1600_permute`	✅	7s	9s	-22%
`poly_use_hint_c`	✅	7s	6s	+17%
`polyveck_add`	✅	7s	7s	+0%
`polyveck_decompose`	✅	7s	5s	+40%
`polyveck_ntt`	✅	7s	4s	+75%
`decompose`	✅	6s	4s	+50%
`keccak_squeezeblocks_x4`	✅	6s	7s	-14%
`mld_prepare_domain_separation_prefix`	✅	6s	3s	+100%
`mld_value_barrier_u32`	✅	6s	3s	+100%
`poly_invntt_tomont_native`	✅	6s	3s	+100%
`poly_power2round`	✅	6s	5s	+20%
`polyveck_caddq`	✅	6s	5s	+20%
`polyveck_chknorm`	✅	6s	5s	+20%
`polyveck_invntt_tomont`	✅	6s	6s	+0%
`polyveck_shiftl`	✅	6s	7s	-14%
`polyveck_use_hint`	✅	6s	8s	-25%
`sign`	✅	6s	6s	+0%
`sign_pk_from_sk`	✅	6s	7s	-14%
`sign_signature_pre_hash_internal`	✅	6s	3s	+100%
`sign_verify_pre_hash_shake256`	✅	6s	4s	+50%
`keccak_absorb`	✅	5s	6s	-17%
`mld_compute_pack_z`	✅	5s	4s	+25%
`mld_sample_s1_s2_serial`	✅	5s	6s	-17%
`polyveck_reduce`	✅	5s	4s	+25%
`polyveck_sub`	✅	5s	4s	+25%
`polyvecl_ntt`	✅	5s	4s	+25%
`polyvecl_uniform_gamma1`	✅	5s	3s	+67%
`sign_open`	✅	5s	4s	+25%
`intt_native_x86_64`	✅	4s	1s	+300%
`keccak_squeeze`	✅	4s	3s	+33%
`keccakf1600x4_extract_bytes`	✅	4s	2s	+100%
`keccakf1600x4_xor_bytes`	✅	4s	3s	+33%
`mld_ct_get_optblocker_u32`	✅	4s	3s	+33%
`mld_h`	✅	4s	4s	+0%
`mld_sample_s1_s2`	✅	4s	4s	+0%
`pack_pk`	✅	4s	2s	+100%
`pack_sig_c_h`	✅	4s	3s	+33%
`pack_sk`	✅	4s	2s	+100%
`poly_caddq_c`	✅	4s	4s	+0%
`poly_challenge`	✅	4s	6s	-33%
`poly_chknorm_native`	✅	4s	5s	-20%
`poly_decompose_c`	✅	4s	5s	-20%
`poly_invntt_tomont`	✅	4s	4s	+0%
`poly_pointwise_montgomery`	✅	4s	2s	+100%
`poly_reduce`	✅	4s	3s	+33%
`poly_uniform`	✅	4s	4s	+0%
`poly_uniform_eta`	✅	4s	7s	-43%
`polyeta_pack`	✅	4s	1s	+300%
`polyt0_pack`	✅	4s	5s	-20%
`polyveck_pointwise_poly_montgomery_t0`	✅	4s	5s	-20%
`polyvecl_permute_bitrev_to_custom`	✅	4s	1s	+300%
`polyvecl_unpack_eta`	✅	4s	3s	+33%
`polyz_pack`	✅	4s	3s	+33%
`rej_eta_c`	✅	4s	4s	+0%
`rej_eta_native`	✅	4s	5s	-20%
`shake128_absorb`	✅	4s	2s	+100%
`shake128_finalize`	✅	4s	3s	+33%
`shake256_squeeze`	✅	4s	2s	+100%
`sign_signature_pre_hash_shake256`	✅	4s	6s	-33%
`sign_verify`	✅	4s	4s	+0%
`sign_verify_extmu`	✅	4s	3s	+33%
`sign_verify_pre_hash_internal`	✅	4s	5s	-20%
`unpack_hints`	✅	4s	5s	-20%
`unpack_pk`	✅	4s	4s	+0%
`keccak_f1600_x1_native_aarch64_v84a`	✅	3s	3s	+0%
`keccak_f1600_x4_native_aarch64_v8a_scalar_hybrid`	✅	3s	2s	+50%
`keccak_f1600_x4_native_aarch64_v8a_v84a_scalar_hybrid`	✅	3s	1s	+200%
`keccak_finalize`	✅	3s	2s	+50%
`keccakf1600_extract_bytes (big endian)`	✅	3s	2s	+50%
`mld_ct_cmask_nonzero_u32`	✅	3s	2s	+50%
`mld_ct_get_optblocker_i64`	✅	3s	4s	-25%
`mld_ct_get_optblocker_u8`	✅	3s	1s	+200%
`mld_keccakf1600_extract_bytes`	✅	3s	3s	+0%
`mld_value_barrier_i64`	✅	3s	1s	+200%
`ntt_native_aarch64`	✅	3s	5s	-40%
`ntt_native_x86_64`	✅	3s	2s	+50%
`pack_sig_z`	✅	3s	3s	+0%
`poly_caddq`	✅	3s	3s	+0%
`poly_chknorm`	✅	3s	2s	+50%
`poly_chknorm_native_aarch64`	✅	3s	3s	+0%
`poly_decompose_native`	✅	3s	2s	+50%
`poly_make_hint`	✅	3s	3s	+0%
`poly_ntt_c`	✅	3s	4s	-25%
`poly_ntt_native`	✅	3s	3s	+0%
`poly_pointwise_montgomery_native`	✅	3s	3s	+0%
`poly_shiftl`	✅	3s	2s	+50%
`poly_sub`	✅	3s	4s	-25%
`poly_use_hint`	✅	3s	3s	+0%
`poly_use_hint_native`	✅	3s	5s	-40%
`polyt1_unpack`	✅	3s	4s	-25%
`polyveck_make_hint`	✅	3s	6s	-50%
`polyveck_pack_eta`	✅	3s	3s	+0%
`polyveck_pack_w1`	✅	3s	3s	+0%
`polyveck_pointwise_poly_montgomery_s2`	✅	3s	7s	-57%
`polyveck_unpack_t0`	✅	3s	5s	-40%
`polyvecl_pointwise_acc_montgomery_native`	✅	3s	3s	+0%
`polyvecl_uniform_gamma1_serial`	✅	3s	4s	-25%
`polyvecl_unpack_z`	✅	3s	2s	+50%
`polyz_unpack`	✅	3s	2s	+50%
`reduce32`	✅	3s	2s	+50%
`rej_eta`	✅	3s	2s	+50%
`shake128_init`	✅	3s	1s	+200%
`shake128_release`	✅	3s	3s	+0%
`shake128_squeeze`	✅	3s	3s	+0%
`shake256_finalize`	✅	3s	2s	+50%
`shake256x4_squeezeblocks`	✅	3s	3s	+0%
`sign_keypair_internal`	✅	3s	6s	-50%
`sign_signature`	✅	3s	6s	-50%
`sign_signature_extmu`	✅	3s	3s	+0%
`sys_check_capability`	✅	3s	3s	+0%
`unpack_sig`	✅	3s	4s	-25%
`caddq`	✅	2s	2s	+0%
`keccak_f1600_x1_native_aarch64`	✅	2s	7s	-71%
`keccakf1600_xor_bytes`	✅	2s	1s	+100%
`keccakf1600_xor_bytes (big endian)`	✅	2s	2s	+0%
`keccakf1600x4_permute`	✅	2s	4s	-50%
`make_hint`	✅	2s	2s	+0%
`mld_ct_abs_i32`	✅	2s	3s	-33%
`mld_ct_cmask_neg_i32`	✅	2s	3s	-33%
`mld_ct_cmask_nonzero_u8`	✅	2s	3s	-33%
`mld_ct_sel_int32`	✅	2s	3s	-33%
`mld_value_barrier_u8`	✅	2s	4s	-50%
`montgomery_reduce`	✅	2s	3s	-33%
`poly_caddq_native`	✅	2s	2s	+0%
`poly_caddq_native_aarch64`	✅	2s	3s	-33%
`poly_decompose`	✅	2s	3s	-33%
`poly_ntt`	✅	2s	2s	+0%
`poly_uniform_gamma1`	✅	2s	3s	-33%
`poly_uniform_gamma1_4x`	✅	2s	4s	-50%
`polyt1_pack`	✅	2s	3s	-33%
`polyveck_pack_t0`	✅	2s	3s	-33%
`polyveck_pointwise_poly_montgomery`	✅	2s	4s	-50%
`polyvecl_chknorm`	✅	2s	6s	-67%
`polyvecl_pack_eta`	✅	2s	4s	-50%
`polyvecl_pointwise_acc_montgomery`	✅	2s	2s	+0%
`polyw1_pack`	✅	2s	4s	-50%
`polyz_unpack_native`	✅	2s	3s	-33%
`power2round`	✅	2s	4s	-50%
`shake128x4_squeezeblocks`	✅	2s	1s	+100%
`shake256`	✅	2s	2s	+0%
`shake256_absorb`	✅	2s	3s	-33%
`shake256_init`	✅	2s	2s	+0%
`shake256_release`	✅	2s	2s	+0%
`sign_keypair`	✅	2s	4s	-50%
`fqscale`	✅	1s	3s	-67%
`keccak_f1600_x4_native_aarch64_v84a`	✅	1s	2s	-50%
`keccak_init`	✅	1s	2s	-50%
`polyveck_unpack_eta`	✅	1s	4s	-75%
`shake128x4_absorb_once`	✅	1s	1s	+0%
`shake256x4_absorb_once`	✅	1s	3s	-67%
`use_hint`	✅	1s	4s	-75%

oqs-bot · 2026-03-21T02:15:47Z

CBMC Results (ML-DSA-87)

Full Results (184 proofs)

Proof	Status	Current	Previous	Change
`TOTAL`	✅	2475s	2628s	-5.8%
`polyvecl_pointwise_acc_montgomery_c`	✅	275s	303s	-9%
`mld_attempt_signature_generation`	✅	256s	238s	+8%
`sign_verify_internal`	✅	163s	221s	-26%
`polyvec_matrix_expand`	✅	152s	192s	-21%
`poly_pointwise_montgomery_c`	✅	150s	175s	-14%
`rej_uniform_native`	✅	144s	154s	-6%
`mld_invntt_layer`	✅	87s	98s	-11%
`polyvec_matrix_expand_serial`	✅	82s	85s	-4%
`mld_ct_memcmp`	✅	76s	80s	-5%
`polyveck_decompose`	✅	61s	59s	+3%
`polymat_permute_bitrev_to_custom`	✅	47s	47s	+0%
`sign_signature_internal`	✅	45s	39s	+15%
`mld_ntt_layer`	✅	38s	54s	-30%
`mld_compute_t0_t1_tr_from_sk_components`	✅	24s	26s	-8%
`fqmul`	✅	20s	23s	-13%
`rej_uniform`	✅	20s	21s	-5%
`poly_chknorm_c`	✅	19s	22s	-14%
`polyeta_unpack`	✅	17s	16s	+6%
`rej_uniform_c`	✅	17s	15s	+13%
`poly_uniform_eta_4x`	✅	16s	18s	-11%
`keccakf1600x4_permute_native`	✅	14s	13s	+8%
`mld_polyvecl_permute_bitrev_to_custom_native`	✅	13s	13s	+0%
`poly_uniform_4x`	✅	13s	15s	-13%
`polyt0_unpack`	✅	13s	15s	-13%
`polyveck_use_hint`	✅	13s	8s	+62%
`mld_check_pct`	✅	12s	9s	+33%
`mld_ntt_butterfly_block`	✅	12s	14s	-14%
`polyveck_reduce`	✅	12s	8s	+50%
`poly_add`	✅	11s	13s	-15%
`polyvec_matrix_pointwise_montgomery`	✅	11s	12s	-8%
`polyvecl_ntt`	✅	11s	11s	+0%
`keccakf1600_permute`	✅	10s	8s	+25%
`poly_power2round`	✅	10s	6s	+67%
`polyveck_add`	✅	10s	10s	+0%
`keccak_absorb_once_x4`	✅	9s	10s	-10%
`mld_sample_s1_s2_serial`	✅	9s	7s	+29%
`polyveck_caddq`	✅	9s	7s	+29%
`polyveck_invntt_tomont`	✅	9s	4s	+125%
`polyz_unpack_c`	✅	9s	11s	-18%
`keccakf1600_permute_native`	✅	8s	8s	+0%
`mld_sample_s1_s2`	✅	8s	8s	+0%
`polyveck_power2round`	✅	8s	12s	-33%
`sign_pk_from_sk`	✅	8s	7s	+14%
`keccak_absorb`	✅	7s	6s	+17%
`mld_compute_pack_z`	✅	7s	6s	+17%
`poly_decompose_c`	✅	7s	7s	+0%
`poly_invntt_tomont_c`	✅	7s	6s	+17%
`polyveck_chknorm`	✅	7s	5s	+40%
`polyveck_ntt`	✅	7s	7s	+0%
`polyveck_pointwise_poly_montgomery`	✅	7s	8s	-12%
`polyveck_pointwise_poly_montgomery_t0`	✅	7s	10s	-30%
`polyveck_shiftl`	✅	7s	5s	+40%
`polyveck_sub`	✅	7s	8s	-12%
`sign`	✅	7s	7s	+0%
`unpack_sk`	✅	7s	7s	+0%
`mld_h`	✅	6s	5s	+20%
`pack_sk`	✅	6s	3s	+100%
`polyveck_make_hint`	✅	6s	5s	+20%
`polyveck_unpack_t0`	✅	6s	5s	+20%
`polyvecl_pointwise_acc_montgomery_native`	✅	6s	3s	+100%
`sign_signature_extmu`	✅	6s	4s	+50%
`sign_signature_pre_hash_internal`	✅	6s	4s	+50%
`sign_signature_pre_hash_shake256`	✅	6s	6s	+0%
`sign_verify_extmu`	✅	6s	7s	-14%
`unpack_sig`	✅	6s	6s	+0%
`keccak_squeezeblocks_x4`	✅	5s	5s	+0%
`poly_caddq`	✅	5s	3s	+67%
`poly_caddq_c`	✅	5s	6s	-17%
`poly_caddq_native`	✅	5s	2s	+150%
`poly_challenge`	✅	5s	5s	+0%
`poly_pointwise_montgomery`	✅	5s	5s	+0%
`poly_uniform`	✅	5s	1s	+400%
`poly_uniform_eta`	✅	5s	5s	+0%
`polyt0_pack`	✅	5s	4s	+25%
`polyveck_unpack_eta`	✅	5s	4s	+25%
`rej_eta`	✅	5s	2s	+150%
`sign_keypair_internal`	✅	5s	7s	-29%
`sign_verify_pre_hash_shake256`	✅	5s	3s	+67%
`caddq`	✅	4s	4s	+0%
`decompose`	✅	4s	5s	-20%
`keccak_f1600_x4_native_aarch64_v84a`	✅	4s	3s	+33%
`keccak_squeeze`	✅	4s	4s	+0%
`mld_ct_cmask_nonzero_u32`	✅	4s	3s	+33%
`mld_ct_cmask_nonzero_u8`	✅	4s	4s	+0%
`mld_ct_get_optblocker_i64`	✅	4s	2s	+100%
`mld_prepare_domain_separation_prefix`	✅	4s	3s	+33%
`pack_sig_z`	✅	4s	3s	+33%
`poly_caddq_native_aarch64`	✅	4s	4s	+0%
`poly_chknorm_native_aarch64`	✅	4s	4s	+0%
`poly_decompose`	✅	4s	3s	+33%
`poly_decompose_native`	✅	4s	3s	+33%
`poly_ntt`	✅	4s	3s	+33%
`poly_ntt_c`	✅	4s	5s	-20%
`poly_ntt_native`	✅	4s	2s	+100%
`poly_shiftl`	✅	4s	2s	+100%
`poly_use_hint_c`	✅	4s	6s	-33%
`polyveck_pack_eta`	✅	4s	5s	-20%
`polyveck_pointwise_poly_montgomery_s2`	✅	4s	7s	-43%
`polyvecl_chknorm`	✅	4s	3s	+33%
`polyvecl_pack_eta`	✅	4s	4s	+0%
`polyvecl_uniform_gamma1`	✅	4s	4s	+0%
`polyvecl_unpack_eta`	✅	4s	4s	+0%
`polyw1_pack`	✅	4s	2s	+100%
`polyz_unpack_native`	✅	4s	4s	+0%
`rej_eta_c`	✅	4s	4s	+0%
`rej_eta_native`	✅	4s	4s	+0%
`shake256`	✅	4s	2s	+100%
`shake256x4_squeezeblocks`	✅	4s	2s	+100%
`sign_keypair`	✅	4s	3s	+33%
`sign_open`	✅	4s	3s	+33%
`sign_verify`	✅	4s	2s	+100%
`sign_verify_pre_hash_internal`	✅	4s	4s	+0%
`sys_check_capability`	✅	4s	4s	+0%
`unpack_hints`	✅	4s	5s	-20%
`fqscale`	✅	3s	3s	+0%
`intt_native_x86_64`	✅	3s	2s	+50%
`keccak_f1600_x1_native_aarch64_v84a`	✅	3s	2s	+50%
`keccak_f1600_x4_native_aarch64_v8a_v84a_scalar_hybrid`	✅	3s	3s	+0%
`keccak_init`	✅	3s	1s	+200%
`keccakf1600_xor_bytes`	✅	3s	3s	+0%
`keccakf1600_xor_bytes (big endian)`	✅	3s	4s	-25%
`keccakf1600x4_extract_bytes`	✅	3s	5s	-40%
`keccakf1600x4_xor_bytes`	✅	3s	4s	-25%
`mld_ct_abs_i32`	✅	3s	3s	+0%
`mld_ct_cmask_neg_i32`	✅	3s	2s	+50%
`mld_ct_get_optblocker_u8`	✅	3s	4s	-25%
`mld_keccakf1600_extract_bytes`	✅	3s	3s	+0%
`mld_value_barrier_u32`	✅	3s	3s	+0%
`ntt_native_aarch64`	✅	3s	3s	+0%
`ntt_native_x86_64`	✅	3s	3s	+0%
`pack_sig_c_h`	✅	3s	3s	+0%
`poly_chknorm`	✅	3s	3s	+0%
`poly_chknorm_native`	✅	3s	2s	+50%
`poly_invntt_tomont`	✅	3s	5s	-40%
`poly_invntt_tomont_native`	✅	3s	4s	-25%
`poly_make_hint`	✅	3s	2s	+50%
`poly_sub`	✅	3s	3s	+0%
`poly_use_hint`	✅	3s	3s	+0%
`polyt1_unpack`	✅	3s	4s	-25%
`polyvecl_pointwise_acc_montgomery`	✅	3s	2s	+50%
`polyvecl_uniform_gamma1_serial`	✅	3s	3s	+0%
`polyvecl_unpack_z`	✅	3s	3s	+0%
`polyz_unpack`	✅	3s	2s	+50%
`power2round`	✅	3s	2s	+50%
`shake128_absorb`	✅	3s	3s	+0%
`shake128_finalize`	✅	3s	2s	+50%
`shake128_init`	✅	3s	2s	+50%
`shake256_release`	✅	3s	4s	-25%
`shake256_squeeze`	✅	3s	2s	+50%
`sign_signature`	✅	3s	5s	-40%
`use_hint`	✅	3s	2s	+50%
`keccak_f1600_x4_native_aarch64_v8a_scalar_hybrid`	✅	2s	3s	-33%
`keccak_finalize`	✅	2s	3s	-33%
`keccakf1600x4_permute`	✅	2s	1s	+100%
`make_hint`	✅	2s	2s	+0%
`mld_ct_sel_int32`	✅	2s	3s	-33%
`mld_value_barrier_i64`	✅	2s	2s	+0%
`mld_value_barrier_u8`	✅	2s	2s	+0%
`montgomery_reduce`	✅	2s	1s	+100%
`pack_pk`	✅	2s	2s	+0%
`poly_pointwise_montgomery_native`	✅	2s	1s	+100%
`poly_reduce`	✅	2s	2s	+0%
`poly_uniform_gamma1`	✅	2s	4s	-50%
`poly_uniform_gamma1_4x`	✅	2s	5s	-60%
`poly_use_hint_native`	✅	2s	4s	-50%
`polyeta_pack`	✅	2s	2s	+0%
`polyt1_pack`	✅	2s	3s	-33%
`polyveck_pack_t0`	✅	2s	5s	-60%
`polyveck_pack_w1`	✅	2s	4s	-50%
`polyvecl_permute_bitrev_to_custom`	✅	2s	4s	-50%
`polyz_pack`	✅	2s	4s	-50%
`reduce32`	✅	2s	3s	-33%
`shake128_release`	✅	2s	2s	+0%
`shake128x4_squeezeblocks`	✅	2s	3s	-33%
`shake256_finalize`	✅	2s	1s	+100%
`shake256_init`	✅	2s	3s	-33%
`shake256x4_absorb_once`	✅	2s	3s	-33%
`unpack_pk`	✅	2s	4s	-50%
`keccak_f1600_x1_native_aarch64`	✅	1s	3s	-67%
`keccakf1600_extract_bytes (big endian)`	✅	1s	2s	-50%
`mld_ct_get_optblocker_u32`	✅	1s	3s	-67%
`shake128_squeeze`	✅	1s	3s	-67%
`shake128x4_absorb_once`	✅	1s	3s	-67%
`shake256_absorb`	✅	1s	3s	-67%

dev/fips202/aarch64/auto.h

examples/disabled_apis_native/Makefile

Only one table is used for each parameter set, so add conditions to remove the unused table from non-shared builds. Signed-off-by: Anders Sonmark <Anders.Sonmark@axis.com>

Make it possible to exclude key generation when not needed, together with all internal functions not needed for signature creation or verification. Signed-off-by: Anders Sonmark <Anders.Sonmark@axis.com>

Make it possible to exclude signature creation when not needed, together with all internal functions not needed for key generation or signature verification. Signed-off-by: Anders Sonmark <Anders.Sonmark@axis.com>

Make it possible to exclude signature verification when not needed, together with all internal functions not needed for key generation or signature creation. Signed-off-by: Anders Sonmark <Anders.Sonmark@axis.com>

Make it possible to exclude code only used for signature creation or verification. Signed-off-by: Anders Sonmark <Anders.Sonmark@axis.com>

Make it possible to exclude code only used for key generation or verification. Signed-off-by: Anders Sonmark <Anders.Sonmark@axis.com>

Make it possible to exclude code only used for key generation or signature creation. Signed-off-by: Anders Sonmark <Anders.Sonmark@axis.com>

Make it possible to exclude the wrapper APIs if not needed and build only the internal API functions. Signed-off-by: Anders Sonmark <Anders.Sonmark@axis.com>

When building with MLD_CONFIG_REDUCE_RAM and only verifying or with MLD_CONFIG_SERIAL_FIPS202_ONLY, Keccak-f1600x2/x4 is not used and can be skipped. Signed-off-by: Anders Sonmark <Anders.Sonmark@axis.com>

Add examples testing four disabled API combinations (keygen-only, sign-only, verify-only, sign+verify) across all three parameter sets. disabled_apis_native additionally enables native arithmetic and FIPS-202 backends. Signed-off-by: Matthias J. Kannwischer <matthias@zerorisc.com>

Signed-off-by: Matthias J. Kannwischer <matthias@zerorisc.com>

… APIs The PCT implementation internally calls crypto_sign_signature() and crypto_sign_verify(), so it is incompatible with MLD_CONFIG_NO_SIGN_API and MLD_CONFIG_NO_VERIFY_API. Signed-off-by: Matthias J. Kannwischer <matthias@zerorisc.com>

Match the AArch64 behavior and skip the native Keccak-f1600x4 backend when MLD_CONFIG_SERIAL_FIPS202_ONLY or MLD_CONFIG_REDUCE_RAM is set. Signed-off-by: Matthias J. Kannwischer <matthias@zerorisc.com>

flynd · 2026-04-07T09:24:49Z

@hanno-becker : Any chance this can be approved soon? It's been almost 2 months since the first version of these changes and due to the size I need to do a lot of updates when rebasing onto other changes on main.
Also, we're very close to getting the final approval for the project where we will make use of mldsa-native so it would be good to have it on master so I can present a version that works without local patches.

hanno-becker · 2026-04-08T04:48:01Z

examples/multilevel_build_native/mldsa_native/mldsa_native_config.h

+/******************************************************************************
+ * Name:        MLD_CONFIG_INTERNAL_API_ONLY
+ *
+ * Description: Set this to remove all public APIs except
+ *              crypto_sign_keypair_internal, crypto_sign_signature_internal,
+ *              and crypto_sign_verify_internal.
+ *
+ *****************************************************************************/
+/* #define MLD_CONFIG_INTERNAL_API_ONLY */


The name of this option is confusing because it overlaps with the use of "internal API" for internal functions of external linkage.

Suggestion: MLD_CONFIG_CORE_API_ONLY

hanno-becker · 2026-04-08T05:01:14Z

examples/disabled_apis/main.c

@@ -0,0 +1,91 @@
+/*


Hmm... why is this a custom example rather than a custom config?

Right now, if I take out-of-the-box mldsa-native and just set MLD_CONFIG_NO_SIGN_API, a plain make fails.

Also, with the current approach we don't exercise a monobuild with reduced config, which would be useful to catch unused functions.

I would prefer custom configurations rather than a custom example here, and adjusting all existing tests and examples to only run those tests which make sense in the chosen configuration. This means make test works out of the box for any valid config, plus we extend coverage to monobuild and multilevel build.

This is currently a blocker to me.

hanno-becker

Apologies for the long silence, and thank you very much for all the work on this, @flynd @mkannwischer!

I support the change in principle, but the build + test story needs more work:

A plain make test should work with any valid config -- right now, it doesn't. The existing tests and examples need adjusting to only exercise the API that is enabled in the config.
Testing the reduced configurations through examples introduces test gaps; e.g., we don't exercise them in monobuilds.

ISTM that we should test this through config variations rather than new examples; this would force/solve both issues above.

mkannwischer mentioned this pull request Mar 21, 2026

Add configs to disable unused APIs #960

Closed

mkannwischer force-pushed the config-disable-apis branch 2 times, most recently from 0e7f1ba to 6b89fae Compare March 21, 2026 02:42

mkannwischer marked this pull request as ready for review March 21, 2026 03:52

mkannwischer requested a review from a team as a code owner March 21, 2026 03:52

hanno-becker force-pushed the config-disable-apis branch from 6b89fae to 69d203c Compare March 23, 2026 03:56

hanno-becker reviewed Mar 23, 2026

View reviewed changes

dev/fips202/aarch64/auto.h Outdated Show resolved Hide resolved

hanno-becker reviewed Mar 23, 2026

View reviewed changes

examples/disabled_apis_native/Makefile Outdated Show resolved Hide resolved

flynd force-pushed the config-disable-apis branch 2 times, most recently from 54b3c74 to ec9c236 Compare March 23, 2026 13:17

mkannwischer force-pushed the config-disable-apis branch 2 times, most recently from d868b27 to 70be886 Compare April 1, 2026 15:12

mkannwischer assigned hanno-becker Apr 1, 2026

flynd added 2 commits April 6, 2026 12:17

aarch64/src/polyz_unpack_table.c: Disable unused tables

52852f5

Only one table is used for each parameter set, so add conditions to remove the unused table from non-shared builds. Signed-off-by: Anders Sonmark <Anders.Sonmark@axis.com>

Add config to disable key generation API

697e8e3

Make it possible to exclude key generation when not needed, together with all internal functions not needed for signature creation or verification. Signed-off-by: Anders Sonmark <Anders.Sonmark@axis.com>

flynd force-pushed the config-disable-apis branch 3 times, most recently from d48354d to 9ac9432 Compare April 6, 2026 19:41

flynd and others added 9 commits April 6, 2026 22:07

Add config to disable signature creation API

f4299db

Make it possible to exclude signature creation when not needed, together with all internal functions not needed for key generation or signature verification. Signed-off-by: Anders Sonmark <Anders.Sonmark@axis.com>

Add config to disable signature verification API

1be6cd5

Make it possible to exclude signature verification when not needed, together with all internal functions not needed for key generation or signature creation. Signed-off-by: Anders Sonmark <Anders.Sonmark@axis.com>

Disable functions not used for key generation

c032f0f

Make it possible to exclude code only used for signature creation or verification. Signed-off-by: Anders Sonmark <Anders.Sonmark@axis.com>

Disable functions not used for signature creation

ede1b60

Make it possible to exclude code only used for key generation or verification. Signed-off-by: Anders Sonmark <Anders.Sonmark@axis.com>

Disable functions not used for signature verification

a6675fa

Make it possible to exclude code only used for key generation or signature creation. Signed-off-by: Anders Sonmark <Anders.Sonmark@axis.com>

Add config to use only the internal API

a8af40c

Make it possible to exclude the wrapper APIs if not needed and build only the internal API functions. Signed-off-by: Anders Sonmark <Anders.Sonmark@axis.com>

fips202: Don't build Keccak-f1600x2/x4 unless used

1e318e1

When building with MLD_CONFIG_REDUCE_RAM and only verifying or with MLD_CONFIG_SERIAL_FIPS202_ONLY, Keccak-f1600x2/x4 is not used and can be skipped. Signed-off-by: Anders Sonmark <Anders.Sonmark@axis.com>

Autogen: Preserve NO_XXX_API config guards in generated table files

f3bdd54

Signed-off-by: Matthias J. Kannwischer <matthias@zerorisc.com>

mkannwischer added 2 commits April 6, 2026 22:12

FIPS202/x86_64: Don't use native x4 backend on x86_64 when not needed

dff98f0

Match the AArch64 behavior and skip the native Keccak-f1600x4 backend when MLD_CONFIG_SERIAL_FIPS202_ONLY or MLD_CONFIG_REDUCE_RAM is set. Signed-off-by: Matthias J. Kannwischer <matthias@zerorisc.com>

flynd force-pushed the config-disable-apis branch from 9ac9432 to dff98f0 Compare April 6, 2026 20:15

hanno-becker reviewed Apr 8, 2026

View reviewed changes

hanno-becker requested changes Apr 8, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add configs to disable unused APIs [full CI]#1000

Add configs to disable unused APIs [full CI]#1000
mkannwischer wants to merge 13 commits intomainfrom
config-disable-apis

mkannwischer commented Mar 21, 2026

Uh oh!

oqs-bot commented Mar 21, 2026 •

edited

Loading

Uh oh!

oqs-bot commented Mar 21, 2026 •

edited

Loading

Uh oh!

oqs-bot commented Mar 21, 2026 •

edited

Loading

Uh oh!

Uh oh!

Uh oh!

flynd commented Apr 7, 2026

Uh oh!

hanno-becker Apr 8, 2026

Uh oh!

hanno-becker Apr 8, 2026 •

edited

Loading

Uh oh!

hanno-becker left a comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Conversation

mkannwischer commented Mar 21, 2026

Uh oh!

oqs-bot commented Mar 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

CBMC Results (ML-DSA-65)

Uh oh!

oqs-bot commented Mar 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

CBMC Results (ML-DSA-44)

Uh oh!

oqs-bot commented Mar 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

CBMC Results (ML-DSA-87)

Uh oh!

Uh oh!

Uh oh!

flynd commented Apr 7, 2026

Uh oh!

hanno-becker Apr 8, 2026

Choose a reason for hiding this comment

Uh oh!

hanno-becker Apr 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

hanno-becker left a comment

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

oqs-bot commented Mar 21, 2026 •

edited

Loading

oqs-bot commented Mar 21, 2026 •

edited

Loading

oqs-bot commented Mar 21, 2026 •

edited

Loading

hanno-becker Apr 8, 2026 •

edited

Loading