CT: Make poly_chknorm constant flow by mkannwischer · Pull Request #392 · pq-code-package/mldsa-native

mkannwischer · 2025-07-29T03:19:48Z

Resolves Make poly_chknorm constant flow #153
Depends on Constant-time hardening for caddq, poly_chknorm, decompose #371

The reference implementation implements poly_chknorm in variables time.
It argues that while the input coefficients itself are secret in some call
sites, it is okay to leak which coefficient lead to rejection.
It, hence, does absolute value computation in constant-time and then checks
the bound using a conditional.

This approach appears safe, but somewhat unclean as it is still operating on
secret data. When performing constant-time testing it also requires a
number of declassifications.

This commit takes a more conservative approach and changes poly_chknorm to
a constant-time implementation in the hope tha the performance penalty is
acceptable.

A minor change is that the API of poly_chknorm is changed to returning
0xFFFFFFFF in the case of failure to be able to re-use existing constant-time
primitives.
CBMC proofs are adjusted accordingly.

github-actions

Mac Mini (M1, 2020) benchmarks (opt)

Details

Benchmark suite	Current: `2694688`	Previous: `334c7a2`	Ratio
`ML-DSA-44 keypair`	`50493` cycles	`48802` cycles	`1.03`
`ML-DSA-44 sign`	`221604` cycles	`182512` cycles	`1.21`
`ML-DSA-44 verify`	`72864` cycles	`67786` cycles	`1.07`
`ML-DSA-65 keypair`	`87461` cycles	`84879` cycles	`1.03`
`ML-DSA-65 sign`	`356027` cycles	`290742` cycles	`1.22`
`ML-DSA-65 verify`	`112734` cycles	`105851` cycles	`1.07`
`ML-DSA-87 keypair`	`140005` cycles	`136419` cycles	`1.03`
`ML-DSA-87 sign`	`425631` cycles	`355398` cycles	`1.20`
`ML-DSA-87 verify`	`173194` cycles	`163912` cycles	`1.06`

This comment was automatically generated by workflow using github-action-benchmark.

github-actions

⚠️ Performance Alert ⚠️

Possible performance regression was detected for benchmark 'Mac Mini (M1, 2020) benchmarks (opt)'.
Benchmark result of this commit is worse than the previous benchmark result exceeding threshold 1.03.

Benchmark suite	Current: `2694688`	Previous: `334c7a2`	Ratio
`ML-DSA-44 keypair`	`50493` cycles	`48802` cycles	`1.03`
`ML-DSA-44 sign`	`221604` cycles	`182512` cycles	`1.21`
`ML-DSA-44 verify`	`72864` cycles	`67786` cycles	`1.07`
`ML-DSA-65 keypair`	`87461` cycles	`84879` cycles	`1.03`
`ML-DSA-65 sign`	`356027` cycles	`290742` cycles	`1.22`
`ML-DSA-65 verify`	`112734` cycles	`105851` cycles	`1.07`
`ML-DSA-87 sign`	`425631` cycles	`355398` cycles	`1.20`
`ML-DSA-87 verify`	`173194` cycles	`163912` cycles	`1.06`

This comment was automatically generated by workflow using github-action-benchmark.

github-actions

Mac Mini (M1, 2020) benchmarks (no-opt)

Details

Benchmark suite	Current: `2694688`	Previous: `334c7a2`	Ratio
`ML-DSA-44 keypair`	`116022` cycles	`114258` cycles	`1.02`
`ML-DSA-44 sign`	`453777` cycles	`414438` cycles	`1.09`
`ML-DSA-44 verify`	`136877` cycles	`131651` cycles	`1.04`
`ML-DSA-65 keypair`	`197966` cycles	`195527` cycles	`1.01`
`ML-DSA-65 sign`	`733143` cycles	`668417` cycles	`1.10`
`ML-DSA-65 verify`	`216930` cycles	`210000` cycles	`1.03`
`ML-DSA-87 keypair`	`325076` cycles	`321618` cycles	`1.01`
`ML-DSA-87 sign`	`914871` cycles	`844770` cycles	`1.08`
`ML-DSA-87 verify`	`353153` cycles	`343995` cycles	`1.03`

This comment was automatically generated by workflow using github-action-benchmark.

github-actions

⚠️ Performance Alert ⚠️

Possible performance regression was detected for benchmark 'Mac Mini (M1, 2020) benchmarks (no-opt)'.
Benchmark result of this commit is worse than the previous benchmark result exceeding threshold 1.03.

Benchmark suite	Current: `2694688`	Previous: `334c7a2`	Ratio
`ML-DSA-44 sign`	`453777` cycles	`414438` cycles	`1.09`
`ML-DSA-44 verify`	`136877` cycles	`131651` cycles	`1.04`
`ML-DSA-65 sign`	`733143` cycles	`668417` cycles	`1.10`
`ML-DSA-65 verify`	`216930` cycles	`210000` cycles	`1.03`
`ML-DSA-87 sign`	`914871` cycles	`844770` cycles	`1.08`

This comment was automatically generated by workflow using github-action-benchmark.

oqs-bot

Intel Xeon 4th gen (c7i)

Details

Benchmark suite	Current: `2694688`	Previous: `334c7a2`	Ratio
`ML-DSA-44 keypair`	`37429` cycles	`36230` cycles	`1.03`
`ML-DSA-44 sign`	`169114` cycles	`138487` cycles	`1.22`
`ML-DSA-44 verify`	`50031` cycles	`46045` cycles	`1.09`
`ML-DSA-65 keypair`	`66563` cycles	`64566` cycles	`1.03`
`ML-DSA-65 sign`	`280021` cycles	`230597` cycles	`1.21`
`ML-DSA-65 verify`	`78911` cycles	`71433` cycles	`1.10`
`ML-DSA-87 keypair`	`100193` cycles	`98741` cycles	`1.01`
`ML-DSA-87 sign`	`325576` cycles	`274945` cycles	`1.18`
`ML-DSA-87 verify`	`117581` cycles	`107165` cycles	`1.10`

This comment was automatically generated by workflow using github-action-benchmark.

oqs-bot

⚠️ Performance Alert ⚠️

Possible performance regression was detected for benchmark 'Intel Xeon 4th gen (c7i)'.
Benchmark result of this commit is worse than the previous benchmark result exceeding threshold 1.03.

Benchmark suite	Current: `2694688`	Previous: `334c7a2`	Ratio
`ML-DSA-44 keypair`	`37429` cycles	`36230` cycles	`1.03`
`ML-DSA-44 sign`	`169114` cycles	`138487` cycles	`1.22`
`ML-DSA-44 verify`	`50031` cycles	`46045` cycles	`1.09`
`ML-DSA-65 keypair`	`66563` cycles	`64566` cycles	`1.03`
`ML-DSA-65 sign`	`280021` cycles	`230597` cycles	`1.21`
`ML-DSA-65 verify`	`78911` cycles	`71433` cycles	`1.10`
`ML-DSA-87 sign`	`325576` cycles	`274945` cycles	`1.18`
`ML-DSA-87 verify`	`117581` cycles	`107165` cycles	`1.10`

This comment was automatically generated by workflow using github-action-benchmark.

github-actions

Arm Cortex-A72 (Raspberry Pi 4) benchmarks (opt)

Details

Benchmark suite	Current: `2694688`	Previous: `334c7a2`	Ratio
`ML-DSA-44 keypair`	`241295` cycles	`234574` cycles	`1.03`
`ML-DSA-44 sign`	`847366` cycles	`746549` cycles	`1.14`
`ML-DSA-44 verify`	`277227` cycles	`245039` cycles	`1.13`
`ML-DSA-65 keypair`	`416418` cycles	`402008` cycles	`1.04`
`ML-DSA-65 sign`	`1336051` cycles	`1184030` cycles	`1.13`
`ML-DSA-65 verify`	`425305` cycles	`403607` cycles	`1.05`
`ML-DSA-87 keypair`	`694436` cycles	`661696` cycles	`1.05`
`ML-DSA-87 sign`	`1731691` cycles	`1538472` cycles	`1.13`
`ML-DSA-87 verify`	`708092` cycles	`670999` cycles	`1.06`

This comment was automatically generated by workflow using github-action-benchmark.

oqs-bot

Intel Xeon 4th gen (c7i) (no-opt)

Details

Benchmark suite	Current: `2694688`	Previous: `334c7a2`	Ratio
`ML-DSA-44 keypair`	`96194` cycles	`95582` cycles	`1.01`
`ML-DSA-44 sign`	`351759` cycles	`322946` cycles	`1.09`
`ML-DSA-44 verify`	`105198` cycles	`101532` cycles	`1.04`
`ML-DSA-65 keypair`	`164341` cycles	`162604` cycles	`1.01`
`ML-DSA-65 sign`	`578102` cycles	`522372` cycles	`1.11`
`ML-DSA-65 verify`	`170272` cycles	`162706` cycles	`1.05`
`ML-DSA-87 keypair`	`275301` cycles	`273426` cycles	`1.01`
`ML-DSA-87 sign`	`731122` cycles	`673052` cycles	`1.09`
`ML-DSA-87 verify`	`281415` cycles	`271672` cycles	`1.04`

This comment was automatically generated by workflow using github-action-benchmark.

github-actions

⚠️ Performance Alert ⚠️

Possible performance regression was detected for benchmark 'Arm Cortex-A72 (Raspberry Pi 4) benchmarks (opt)'.
Benchmark result of this commit is worse than the previous benchmark result exceeding threshold 1.03.

Benchmark suite	Current: `2694688`	Previous: `334c7a2`	Ratio
`ML-DSA-44 sign`	`847366` cycles	`746549` cycles	`1.14`
`ML-DSA-44 verify`	`277227` cycles	`245039` cycles	`1.13`
`ML-DSA-65 keypair`	`416418` cycles	`402008` cycles	`1.04`
`ML-DSA-65 sign`	`1336051` cycles	`1184030` cycles	`1.13`
`ML-DSA-65 verify`	`425305` cycles	`403607` cycles	`1.05`
`ML-DSA-87 keypair`	`694436` cycles	`661696` cycles	`1.05`
`ML-DSA-87 sign`	`1731691` cycles	`1538472` cycles	`1.13`
`ML-DSA-87 verify`	`708092` cycles	`670999` cycles	`1.06`

This comment was automatically generated by workflow using github-action-benchmark.

oqs-bot

⚠️ Performance Alert ⚠️

Possible performance regression was detected for benchmark 'Intel Xeon 4th gen (c7i) (no-opt)'.
Benchmark result of this commit is worse than the previous benchmark result exceeding threshold 1.03.

Benchmark suite	Current: `2694688`	Previous: `334c7a2`	Ratio
`ML-DSA-44 sign`	`351759` cycles	`322946` cycles	`1.09`
`ML-DSA-44 verify`	`105198` cycles	`101532` cycles	`1.04`
`ML-DSA-65 sign`	`578102` cycles	`522372` cycles	`1.11`
`ML-DSA-65 verify`	`170272` cycles	`162706` cycles	`1.05`
`ML-DSA-87 sign`	`731122` cycles	`673052` cycles	`1.09`
`ML-DSA-87 verify`	`281415` cycles	`271672` cycles	`1.04`

This comment was automatically generated by workflow using github-action-benchmark.

oqs-bot

Intel Xeon 3rd gen (c6i)

Details

Benchmark suite	Current: `2694688`	Previous: `334c7a2`	Ratio
`ML-DSA-44 keypair`	`60734` cycles	`59212` cycles	`1.03`
`ML-DSA-44 sign`	`264173` cycles	`211541` cycles	`1.25`
`ML-DSA-44 verify`	`80454` cycles	`73884` cycles	`1.09`
`ML-DSA-65 keypair`	`106678` cycles	`104326` cycles	`1.02`
`ML-DSA-65 sign`	`436140` cycles	`347410` cycles	`1.26`
`ML-DSA-65 verify`	`127470` cycles	`115218` cycles	`1.11`
`ML-DSA-87 keypair`	`163568` cycles	`162599` cycles	`1.01`
`ML-DSA-87 sign`	`508874` cycles	`421422` cycles	`1.21`
`ML-DSA-87 verify`	`189604` cycles	`177621` cycles	`1.07`

This comment was automatically generated by workflow using github-action-benchmark.

oqs-bot

⚠️ Performance Alert ⚠️

Possible performance regression was detected for benchmark 'Intel Xeon 3rd gen (c6i)'.
Benchmark result of this commit is worse than the previous benchmark result exceeding threshold 1.03.

Benchmark suite	Current: `2694688`	Previous: `334c7a2`	Ratio
`ML-DSA-44 sign`	`264173` cycles	`211541` cycles	`1.25`
`ML-DSA-44 verify`	`80454` cycles	`73884` cycles	`1.09`
`ML-DSA-65 sign`	`436140` cycles	`347410` cycles	`1.26`
`ML-DSA-65 verify`	`127470` cycles	`115218` cycles	`1.11`
`ML-DSA-87 sign`	`508874` cycles	`421422` cycles	`1.21`
`ML-DSA-87 verify`	`189604` cycles	`177621` cycles	`1.07`

This comment was automatically generated by workflow using github-action-benchmark.

oqs-bot

AMD EPYC 3rd gen (c6a)

Details

Benchmark suite	Current: `2694688`	Previous: `334c7a2`	Ratio
`ML-DSA-44 keypair`	`73890` cycles	`72434` cycles	`1.02`
`ML-DSA-44 sign`	`269079` cycles	`224246` cycles	`1.20`
`ML-DSA-44 verify`	`88940` cycles	`83522` cycles	`1.06`
`ML-DSA-65 keypair`	`126697` cycles	`124793` cycles	`1.02`
`ML-DSA-65 sign`	`435185` cycles	`362808` cycles	`1.20`
`ML-DSA-65 verify`	`142652` cycles	`132717` cycles	`1.07`
`ML-DSA-87 keypair`	`211018` cycles	`207762` cycles	`1.02`
`ML-DSA-87 sign`	`544592` cycles	`464500` cycles	`1.17`
`ML-DSA-87 verify`	`229844` cycles	`216400` cycles	`1.06`

This comment was automatically generated by workflow using github-action-benchmark.

oqs-bot

⚠️ Performance Alert ⚠️

Possible performance regression was detected for benchmark 'AMD EPYC 3rd gen (c6a)'.
Benchmark result of this commit is worse than the previous benchmark result exceeding threshold 1.03.

Benchmark suite	Current: `2694688`	Previous: `334c7a2`	Ratio
`ML-DSA-44 sign`	`269079` cycles	`224246` cycles	`1.20`
`ML-DSA-44 verify`	`88940` cycles	`83522` cycles	`1.06`
`ML-DSA-65 sign`	`435185` cycles	`362808` cycles	`1.20`
`ML-DSA-65 verify`	`142652` cycles	`132717` cycles	`1.07`
`ML-DSA-87 sign`	`544592` cycles	`464500` cycles	`1.17`
`ML-DSA-87 verify`	`229844` cycles	`216400` cycles	`1.06`

This comment was automatically generated by workflow using github-action-benchmark.

oqs-bot

Intel Xeon 3rd gen (c6i) (no-opt)

Details

Benchmark suite	Current: `2694688`	Previous: `334c7a2`	Ratio
`ML-DSA-44 keypair`	`159131` cycles	`157139` cycles	`1.01`
`ML-DSA-44 sign`	`574721` cycles	`521064` cycles	`1.10`
`ML-DSA-44 verify`	`175501` cycles	`167947` cycles	`1.04`
`ML-DSA-65 keypair`	`271517` cycles	`271243` cycles	`1.00`
`ML-DSA-65 sign`	`936105` cycles	`852337` cycles	`1.10`
`ML-DSA-65 verify`	`282214` cycles	`272681` cycles	`1.03`
`ML-DSA-87 keypair`	`453075` cycles	`448838` cycles	`1.01`
`ML-DSA-87 sign`	`1188826` cycles	`1089952` cycles	`1.09`
`ML-DSA-87 verify`	`468848` cycles	`451807` cycles	`1.04`

This comment was automatically generated by workflow using github-action-benchmark.

oqs-bot

AMD EPYC 3rd gen (c6a) (no-opt)

Details

Benchmark suite	Current: `2694688`	Previous: `334c7a2`	Ratio
`ML-DSA-44 keypair`	`136460` cycles	`135071` cycles	`1.01`
`ML-DSA-44 sign`	`553704` cycles	`510595` cycles	`1.08`
`ML-DSA-44 verify`	`154524` cycles	`149244` cycles	`1.04`
`ML-DSA-65 keypair`	`228258` cycles	`226517` cycles	`1.01`
`ML-DSA-65 sign`	`889602` cycles	`820635` cycles	`1.08`
`ML-DSA-65 verify`	`244157` cycles	`234097` cycles	`1.04`
`ML-DSA-87 keypair`	`377059` cycles	`372954` cycles	`1.01`
`ML-DSA-87 sign`	`1116784` cycles	`1035711` cycles	`1.08`
`ML-DSA-87 verify`	`397660` cycles	`384434` cycles	`1.03`

This comment was automatically generated by workflow using github-action-benchmark.

oqs-bot

⚠️ Performance Alert ⚠️

Possible performance regression was detected for benchmark 'Intel Xeon 3rd gen (c6i) (no-opt)'.
Benchmark result of this commit is worse than the previous benchmark result exceeding threshold 1.03.

Benchmark suite	Current: `2694688`	Previous: `334c7a2`	Ratio
`ML-DSA-44 sign`	`574721` cycles	`521064` cycles	`1.10`
`ML-DSA-44 verify`	`175501` cycles	`167947` cycles	`1.04`
`ML-DSA-65 sign`	`936105` cycles	`852337` cycles	`1.10`
`ML-DSA-65 verify`	`282214` cycles	`272681` cycles	`1.03`
`ML-DSA-87 sign`	`1188826` cycles	`1089952` cycles	`1.09`
`ML-DSA-87 verify`	`468848` cycles	`451807` cycles	`1.04`

This comment was automatically generated by workflow using github-action-benchmark.

oqs-bot

⚠️ Performance Alert ⚠️

Possible performance regression was detected for benchmark 'AMD EPYC 3rd gen (c6a) (no-opt)'.
Benchmark result of this commit is worse than the previous benchmark result exceeding threshold 1.03.

Benchmark suite	Current: `2694688`	Previous: `334c7a2`	Ratio
`ML-DSA-44 sign`	`553704` cycles	`510595` cycles	`1.08`
`ML-DSA-44 verify`	`154524` cycles	`149244` cycles	`1.04`
`ML-DSA-65 sign`	`889602` cycles	`820635` cycles	`1.08`
`ML-DSA-65 verify`	`244157` cycles	`234097` cycles	`1.04`
`ML-DSA-87 sign`	`1116784` cycles	`1035711` cycles	`1.08`
`ML-DSA-87 verify`	`397660` cycles	`384434` cycles	`1.03`

This comment was automatically generated by workflow using github-action-benchmark.

oqs-bot

Graviton4

Details

Benchmark suite	Current: `2694688`	Previous: `334c7a2`	Ratio
`ML-DSA-44 keypair`	`72975` cycles	`71188` cycles	`1.03`
`ML-DSA-44 sign`	`282602` cycles	`236961` cycles	`1.19`
`ML-DSA-44 verify`	`86926` cycles	`81190` cycles	`1.07`
`ML-DSA-65 keypair`	`128499` cycles	`125629` cycles	`1.02`
`ML-DSA-65 sign`	`461377` cycles	`384709` cycles	`1.20`
`ML-DSA-65 verify`	`138961` cycles	`131226` cycles	`1.06`
`ML-DSA-87 keypair`	`207549` cycles	`203823` cycles	`1.02`
`ML-DSA-87 sign`	`563173` cycles	`486383` cycles	`1.16`
`ML-DSA-87 verify`	`222393` cycles	`212160` cycles	`1.05`

This comment was automatically generated by workflow using github-action-benchmark.

oqs-bot

⚠️ Performance Alert ⚠️

Possible performance regression was detected for benchmark 'Graviton4'.
Benchmark result of this commit is worse than the previous benchmark result exceeding threshold 1.03.

Benchmark suite	Current: `2694688`	Previous: `334c7a2`	Ratio
`ML-DSA-44 sign`	`282602` cycles	`236961` cycles	`1.19`
`ML-DSA-44 verify`	`86926` cycles	`81190` cycles	`1.07`
`ML-DSA-65 sign`	`461377` cycles	`384709` cycles	`1.20`
`ML-DSA-65 verify`	`138961` cycles	`131226` cycles	`1.06`
`ML-DSA-87 sign`	`563173` cycles	`486383` cycles	`1.16`
`ML-DSA-87 verify`	`222393` cycles	`212160` cycles	`1.05`

This comment was automatically generated by workflow using github-action-benchmark.

oqs-bot

Graviton2

Details

Benchmark suite	Current: `2694688`	Previous: `334c7a2`	Ratio
`ML-DSA-44 keypair`	`120832` cycles	`117704` cycles	`1.03`
`ML-DSA-44 sign`	`488466` cycles	`419317` cycles	`1.16`
`ML-DSA-44 verify`	`146032` cycles	`137009` cycles	`1.07`
`ML-DSA-65 keypair`	`208030` cycles	`202971` cycles	`1.02`
`ML-DSA-65 sign`	`802713` cycles	`691577` cycles	`1.16`
`ML-DSA-65 verify`	`231768` cycles	`220514` cycles	`1.05`
`ML-DSA-87 keypair`	`337480` cycles	`331100` cycles	`1.02`
`ML-DSA-87 sign`	`985827` cycles	`869010` cycles	`1.13`
`ML-DSA-87 verify`	`369625` cycles	`354605` cycles	`1.04`

This comment was automatically generated by workflow using github-action-benchmark.

oqs-bot

⚠️ Performance Alert ⚠️

Possible performance regression was detected for benchmark 'Graviton2'.
Benchmark result of this commit is worse than the previous benchmark result exceeding threshold 1.03.

Benchmark suite	Current: `2694688`	Previous: `334c7a2`	Ratio
`ML-DSA-44 sign`	`488466` cycles	`419317` cycles	`1.16`
`ML-DSA-44 verify`	`146032` cycles	`137009` cycles	`1.07`
`ML-DSA-65 sign`	`802713` cycles	`691577` cycles	`1.16`
`ML-DSA-65 verify`	`231768` cycles	`220514` cycles	`1.05`
`ML-DSA-87 sign`	`985827` cycles	`869010` cycles	`1.13`
`ML-DSA-87 verify`	`369625` cycles	`354605` cycles	`1.04`

This comment was automatically generated by workflow using github-action-benchmark.

github-actions

SpacemiT K1 8 (Banana Pi F3) benchmarks (no-opt)

Details

Benchmark suite	Current: `2694688`	Previous: `334c7a2`	Ratio
`ML-DSA-44 keypair`	`946439` cycles	`944595` cycles	`1.00`
`ML-DSA-44 sign`	`4437845` cycles	`4357225` cycles	`1.02`
`ML-DSA-44 verify`	`1091215` cycles	`1075353` cycles	`1.01`
`ML-DSA-65 keypair`	`1578794` cycles	`1570727` cycles	`1.01`
`ML-DSA-65 sign`	`7349885` cycles	`7186436` cycles	`1.02`
`ML-DSA-65 verify`	`1726278` cycles	`1701260` cycles	`1.01`
`ML-DSA-87 keypair`	`2546749` cycles	`2540962` cycles	`1.00`
`ML-DSA-87 sign`	`8996170` cycles	`8815371` cycles	`1.02`
`ML-DSA-87 verify`	`2752817` cycles	`2720024` cycles	`1.01`

This comment was automatically generated by workflow using github-action-benchmark.

oqs-bot

Graviton3

Details

Benchmark suite	Current: `2694688`	Previous: `334c7a2`	Ratio
`ML-DSA-44 keypair`	`78068` cycles	`75505` cycles	`1.03`
`ML-DSA-44 sign`	`303851` cycles	`253017` cycles	`1.20`
`ML-DSA-44 verify`	`95583` cycles	`88996` cycles	`1.07`
`ML-DSA-65 keypair`	`135047` cycles	`131592` cycles	`1.03`
`ML-DSA-65 sign`	`496713` cycles	`415538` cycles	`1.20`
`ML-DSA-65 verify`	`151284` cycles	`141805` cycles	`1.07`
`ML-DSA-87 keypair`	`217701` cycles	`212810` cycles	`1.02`
`ML-DSA-87 sign`	`606626` cycles	`519380` cycles	`1.17`
`ML-DSA-87 verify`	`239556` cycles	`226824` cycles	`1.06`

This comment was automatically generated by workflow using github-action-benchmark.

oqs-bot

⚠️ Performance Alert ⚠️

Possible performance regression was detected for benchmark 'Graviton3'.
Benchmark result of this commit is worse than the previous benchmark result exceeding threshold 1.03.

Benchmark suite	Current: `2694688`	Previous: `334c7a2`	Ratio
`ML-DSA-44 keypair`	`78068` cycles	`75505` cycles	`1.03`
`ML-DSA-44 sign`	`303851` cycles	`253017` cycles	`1.20`
`ML-DSA-44 verify`	`95583` cycles	`88996` cycles	`1.07`
`ML-DSA-65 sign`	`496713` cycles	`415538` cycles	`1.20`
`ML-DSA-65 verify`	`151284` cycles	`141805` cycles	`1.07`
`ML-DSA-87 sign`	`606626` cycles	`519380` cycles	`1.17`
`ML-DSA-87 verify`	`239556` cycles	`226824` cycles	`1.06`

This comment was automatically generated by workflow using github-action-benchmark.

oqs-bot

Graviton4 (no-opt)

Details

Benchmark suite	Current: `2694688`	Previous: `334c7a2`	Ratio
`ML-DSA-44 keypair`	`134783` cycles	`132708` cycles	`1.02`
`ML-DSA-44 sign`	`507323` cycles	`471356` cycles	`1.08`
`ML-DSA-44 verify`	`149539` cycles	`143518` cycles	`1.04`
`ML-DSA-65 keypair`	`228738` cycles	`226009` cycles	`1.01`
`ML-DSA-65 sign`	`820367` cycles	`739063` cycles	`1.11`
`ML-DSA-65 verify`	`237472` cycles	`228696` cycles	`1.04`
`ML-DSA-87 keypair`	`377080` cycles	`374200` cycles	`1.01`
`ML-DSA-87 sign`	`1029914` cycles	`945390` cycles	`1.09`
`ML-DSA-87 verify`	`391267` cycles	`378937` cycles	`1.03`

This comment was automatically generated by workflow using github-action-benchmark.

oqs-bot

⚠️ Performance Alert ⚠️

Possible performance regression was detected for benchmark 'Graviton4 (no-opt)'.
Benchmark result of this commit is worse than the previous benchmark result exceeding threshold 1.03.

Benchmark suite	Current: `2694688`	Previous: `334c7a2`	Ratio
`ML-DSA-44 sign`	`507323` cycles	`471356` cycles	`1.08`
`ML-DSA-44 verify`	`149539` cycles	`143518` cycles	`1.04`
`ML-DSA-65 sign`	`820367` cycles	`739063` cycles	`1.11`
`ML-DSA-65 verify`	`237472` cycles	`228696` cycles	`1.04`
`ML-DSA-87 sign`	`1029914` cycles	`945390` cycles	`1.09`
`ML-DSA-87 verify`	`391267` cycles	`378937` cycles	`1.03`

This comment was automatically generated by workflow using github-action-benchmark.

oqs-bot

AMD EPYC 4th gen (c7a)

Details

Benchmark suite	Current: `2694688`	Previous: `334c7a2`	Ratio
`ML-DSA-44 keypair`	`47831` cycles	`43880` cycles	`1.09`
`ML-DSA-44 sign`	`205390` cycles	`153569` cycles	`1.34`
`ML-DSA-44 verify`	`62785` cycles	`55229` cycles	`1.14`
`ML-DSA-65 keypair`	`76431` cycles	`74426` cycles	`1.03`
`ML-DSA-65 sign`	`319204` cycles	`246006` cycles	`1.30`
`ML-DSA-65 verify`	`93812` cycles	`84283` cycles	`1.11`
`ML-DSA-87 keypair`	`116448` cycles	`114067` cycles	`1.02`
`ML-DSA-87 sign`	`368957` cycles	`295714` cycles	`1.25`
`ML-DSA-87 verify`	`137780` cycles	`128169` cycles	`1.07`

This comment was automatically generated by workflow using github-action-benchmark.

oqs-bot

⚠️ Performance Alert ⚠️

Possible performance regression was detected for benchmark 'AMD EPYC 4th gen (c7a)'.
Benchmark result of this commit is worse than the previous benchmark result exceeding threshold 1.03.

Benchmark suite	Current: `2694688`	Previous: `334c7a2`	Ratio
`ML-DSA-44 keypair`	`47831` cycles	`43880` cycles	`1.09`
`ML-DSA-44 sign`	`205390` cycles	`153569` cycles	`1.34`
`ML-DSA-44 verify`	`62785` cycles	`55229` cycles	`1.14`
`ML-DSA-65 sign`	`319204` cycles	`246006` cycles	`1.30`
`ML-DSA-65 verify`	`93812` cycles	`84283` cycles	`1.11`
`ML-DSA-87 sign`	`368957` cycles	`295714` cycles	`1.25`
`ML-DSA-87 verify`	`137780` cycles	`128169` cycles	`1.07`

This comment was automatically generated by workflow using github-action-benchmark.

oqs-bot

⚠️ Performance Alert ⚠️

Possible performance regression was detected for benchmark 'Graviton2 (no-opt)'.
Benchmark result of this commit is worse than the previous benchmark result exceeding threshold 1.03.

Benchmark suite	Current: `2694688`	Previous: `334c7a2`	Ratio
`ML-DSA-44 sign`	`797555` cycles	`742145` cycles	`1.07`
`ML-DSA-44 verify`	`239848` cycles	`230539` cycles	`1.04`
`ML-DSA-65 sign`	`1309096` cycles	`1199264` cycles	`1.09`
`ML-DSA-65 verify`	`385228` cycles	`373938` cycles	`1.03`
`ML-DSA-87 sign`	`1668507` cycles	`1547667` cycles	`1.08`

This comment was automatically generated by workflow using github-action-benchmark.

oqs-bot

⚠️ Performance Alert ⚠️

Possible performance regression was detected for benchmark 'Graviton3 (no-opt)'.
Benchmark result of this commit is worse than the previous benchmark result exceeding threshold 1.03.

Benchmark suite	Current: `2694688`	Previous: `334c7a2`	Ratio
`ML-DSA-44 sign`	`505651` cycles	`454171` cycles	`1.11`
`ML-DSA-44 verify`	`154470` cycles	`147815` cycles	`1.05`
`ML-DSA-65 sign`	`822221` cycles	`740730` cycles	`1.11`
`ML-DSA-65 verify`	`248582` cycles	`238979` cycles	`1.04`
`ML-DSA-87 sign`	`1042946` cycles	`955507` cycles	`1.09`
`ML-DSA-87 verify`	`411435` cycles	`398960` cycles	`1.03`

This comment was automatically generated by workflow using github-action-benchmark.

oqs-bot

AMD EPYC 4th gen (c7a) (no-opt)

Details

Benchmark suite	Current: `2694688`	Previous: `334c7a2`	Ratio
`ML-DSA-44 keypair`	`123124` cycles	`120631` cycles	`1.02`
`ML-DSA-44 sign`	`469795` cycles	`424505` cycles	`1.11`
`ML-DSA-44 verify`	`137789` cycles	`132270` cycles	`1.04`
`ML-DSA-65 keypair`	`205452` cycles	`203949` cycles	`1.01`
`ML-DSA-65 sign`	`752042` cycles	`677550` cycles	`1.11`
`ML-DSA-65 verify`	`217455` cycles	`207064` cycles	`1.05`
`ML-DSA-87 keypair`	`340882` cycles	`337594` cycles	`1.01`
`ML-DSA-87 sign`	`949300` cycles	`871359` cycles	`1.09`
`ML-DSA-87 verify`	`356629` cycles	`343109` cycles	`1.04`

This comment was automatically generated by workflow using github-action-benchmark.

oqs-bot

⚠️ Performance Alert ⚠️

Possible performance regression was detected for benchmark 'AMD EPYC 4th gen (c7a) (no-opt)'.
Benchmark result of this commit is worse than the previous benchmark result exceeding threshold 1.03.

Benchmark suite	Current: `2694688`	Previous: `334c7a2`	Ratio
`ML-DSA-44 sign`	`469795` cycles	`424505` cycles	`1.11`
`ML-DSA-44 verify`	`137789` cycles	`132270` cycles	`1.04`
`ML-DSA-65 sign`	`752042` cycles	`677550` cycles	`1.11`
`ML-DSA-65 verify`	`217455` cycles	`207064` cycles	`1.05`
`ML-DSA-87 sign`	`949300` cycles	`871359` cycles	`1.09`
`ML-DSA-87 verify`	`356629` cycles	`343109` cycles	`1.04`

This comment was automatically generated by workflow using github-action-benchmark.

github-actions

Arm Cortex-A76 (Raspberry Pi 5) benchmarks (opt)

Details

Benchmark suite	Current: `2694688`	Previous: `334c7a2`	Ratio
`ML-DSA-44 keypair`	`120436` cycles	`117180` cycles	`1.03`
`ML-DSA-44 sign`	`487817` cycles	`418808` cycles	`1.16`
`ML-DSA-44 verify`	`145682` cycles	`136607` cycles	`1.07`
`ML-DSA-65 keypair`	`207775` cycles	`202735` cycles	`1.02`
`ML-DSA-65 sign`	`802217` cycles	`691398` cycles	`1.16`
`ML-DSA-65 verify`	`231569` cycles	`220366` cycles	`1.05`
`ML-DSA-87 keypair`	`337070` cycles	`329898` cycles	`1.02`
`ML-DSA-87 sign`	`984429` cycles	`867176` cycles	`1.14`
`ML-DSA-87 verify`	`369773` cycles	`353920` cycles	`1.04`

This comment was automatically generated by workflow using github-action-benchmark.

github-actions

Arm Cortex-A72 (Raspberry Pi 4) benchmarks (no-opt)

Details

Benchmark suite	Current: `2694688`	Previous: `334c7a2`	Ratio
`ML-DSA-44 keypair`	`312930` cycles	`307872` cycles	`1.02`
`ML-DSA-44 sign`	`1222195` cycles	`1140862` cycles	`1.07`
`ML-DSA-44 verify`	`349239` cycles	`337492` cycles	`1.03`
`ML-DSA-65 keypair`	`559024` cycles	`578597` cycles	`0.97`
`ML-DSA-65 sign`	`1962781` cycles	`1867708` cycles	`1.05`
`ML-DSA-65 verify`	`545559` cycles	`551173` cycles	`0.99`
`ML-DSA-87 keypair`	`866787` cycles	`872509` cycles	`0.99`
`ML-DSA-87 sign`	`2465518` cycles	`2349579` cycles	`1.05`
`ML-DSA-87 verify`	`904582` cycles	`879687` cycles	`1.03`

This comment was automatically generated by workflow using github-action-benchmark.

github-actions

⚠️ Performance Alert ⚠️

Possible performance regression was detected for benchmark 'Arm Cortex-A76 (Raspberry Pi 5) benchmarks (opt)'.
Benchmark result of this commit is worse than the previous benchmark result exceeding threshold 1.03.

Benchmark suite	Current: `2694688`	Previous: `334c7a2`	Ratio
`ML-DSA-44 sign`	`487817` cycles	`418808` cycles	`1.16`
`ML-DSA-44 verify`	`145682` cycles	`136607` cycles	`1.07`
`ML-DSA-65 sign`	`802217` cycles	`691398` cycles	`1.16`
`ML-DSA-65 verify`	`231569` cycles	`220366` cycles	`1.05`
`ML-DSA-87 sign`	`984429` cycles	`867176` cycles	`1.14`
`ML-DSA-87 verify`	`369773` cycles	`353920` cycles	`1.04`

This comment was automatically generated by workflow using github-action-benchmark.

github-actions

⚠️ Performance Alert ⚠️

Possible performance regression was detected for benchmark 'Arm Cortex-A72 (Raspberry Pi 4) benchmarks (no-opt)'.
Benchmark result of this commit is worse than the previous benchmark result exceeding threshold 1.03.

Benchmark suite	Current: `2694688`	Previous: `334c7a2`	Ratio
`ML-DSA-44 sign`	`1222195` cycles	`1140862` cycles	`1.07`
`ML-DSA-44 verify`	`349239` cycles	`337492` cycles	`1.03`
`ML-DSA-65 sign`	`1962781` cycles	`1867708` cycles	`1.05`
`ML-DSA-87 sign`	`2465518` cycles	`2349579` cycles	`1.05`

This comment was automatically generated by workflow using github-action-benchmark.

github-actions

Arm Cortex-A76 (Raspberry Pi 5) benchmarks (no-opt)

Details

Benchmark suite	Current: `2694688`	Previous: `334c7a2`	Ratio
`ML-DSA-44 keypair`	`214978` cycles	`211899` cycles	`1.01`
`ML-DSA-44 sign`	`796394` cycles	`728995` cycles	`1.09`
`ML-DSA-44 verify`	`239321` cycles	`230645` cycles	`1.04`
`ML-DSA-65 keypair`	`383699` cycles	`379766` cycles	`1.01`
`ML-DSA-65 sign`	`1308174` cycles	`1202194` cycles	`1.09`
`ML-DSA-65 verify`	`384889` cycles	`373177` cycles	`1.03`
`ML-DSA-87 keypair`	`611270` cycles	`606265` cycles	`1.01`
`ML-DSA-87 sign`	`1665433` cycles	`1545920` cycles	`1.08`
`ML-DSA-87 verify`	`637205` cycles	`622020` cycles	`1.02`

This comment was automatically generated by workflow using github-action-benchmark.

github-actions

⚠️ Performance Alert ⚠️

Possible performance regression was detected for benchmark 'Arm Cortex-A76 (Raspberry Pi 5) benchmarks (no-opt)'.
Benchmark result of this commit is worse than the previous benchmark result exceeding threshold 1.03.

Benchmark suite	Current: `2694688`	Previous: `334c7a2`	Ratio
`ML-DSA-44 sign`	`796394` cycles	`728995` cycles	`1.09`
`ML-DSA-44 verify`	`239321` cycles	`230645` cycles	`1.04`
`ML-DSA-65 sign`	`1308174` cycles	`1202194` cycles	`1.09`
`ML-DSA-65 verify`	`384889` cycles	`373177` cycles	`1.03`
`ML-DSA-87 sign`	`1665433` cycles	`1545920` cycles	`1.08`

This comment was automatically generated by workflow using github-action-benchmark.

github-actions

Arm Cortex-A55 (Snapdragon 888) benchmarks (opt)

Details

Benchmark suite	Current: `2694688`	Previous: `334c7a2`	Ratio
`ML-DSA-44 keypair`	`293040` cycles	`285837` cycles	`1.03`
`ML-DSA-44 sign`	`1226539` cycles	`1017744` cycles	`1.21`
`ML-DSA-44 verify`	`356053` cycles	`327753` cycles	`1.09`
`ML-DSA-65 keypair`	`500055` cycles	`487572` cycles	`1.03`
`ML-DSA-65 sign`	`1979290` cycles	`1663334` cycles	`1.19`
`ML-DSA-65 verify`	`554307` cycles	`513217` cycles	`1.08`
`ML-DSA-87 keypair`	`843126` cycles	`825275` cycles	`1.02`
`ML-DSA-87 sign`	`2552321` cycles	`2186302` cycles	`1.17`
`ML-DSA-87 verify`	`917579` cycles	`856528` cycles	`1.07`

This comment was automatically generated by workflow using github-action-benchmark.

github-actions

⚠️ Performance Alert ⚠️

Possible performance regression was detected for benchmark 'Arm Cortex-A55 (Snapdragon 888) benchmarks (opt)'.
Benchmark result of this commit is worse than the previous benchmark result exceeding threshold 1.03.

Benchmark suite	Current: `2694688`	Previous: `334c7a2`	Ratio
`ML-DSA-44 sign`	`1226539` cycles	`1017744` cycles	`1.21`
`ML-DSA-44 verify`	`356053` cycles	`327753` cycles	`1.09`
`ML-DSA-65 sign`	`1979290` cycles	`1663334` cycles	`1.19`
`ML-DSA-65 verify`	`554307` cycles	`513217` cycles	`1.08`
`ML-DSA-87 sign`	`2552321` cycles	`2186302` cycles	`1.17`
`ML-DSA-87 verify`	`917579` cycles	`856528` cycles	`1.07`

This comment was automatically generated by workflow using github-action-benchmark.

github-actions

Arm Cortex-A55 (Snapdragon 888) benchmarks (no-opt)

Details

Benchmark suite	Current: `2694688`	Previous: `334c7a2`	Ratio
`ML-DSA-44 keypair`	`464982` cycles	`458473` cycles	`1.01`
`ML-DSA-44 sign`	`2235015` cycles	`2031159` cycles	`1.10`
`ML-DSA-44 verify`	`560034` cycles	`532359` cycles	`1.05`
`ML-DSA-65 keypair`	`779167` cycles	`769535` cycles	`1.01`
`ML-DSA-65 sign`	`3681113` cycles	`3353844` cycles	`1.10`
`ML-DSA-65 verify`	`867066` cycles	`827247` cycles	`1.05`
`ML-DSA-87 keypair`	`1255241` cycles	`1241079` cycles	`1.01`
`ML-DSA-87 sign`	`4483019` cycles	`4186890` cycles	`1.07`
`ML-DSA-87 verify`	`1386458` cycles	`1328345` cycles	`1.04`

This comment was automatically generated by workflow using github-action-benchmark.

github-actions

⚠️ Performance Alert ⚠️

Possible performance regression was detected for benchmark 'Arm Cortex-A55 (Snapdragon 888) benchmarks (no-opt)'.
Benchmark result of this commit is worse than the previous benchmark result exceeding threshold 1.03.

Benchmark suite	Current: `2694688`	Previous: `334c7a2`	Ratio
`ML-DSA-44 sign`	`2235015` cycles	`2031159` cycles	`1.10`
`ML-DSA-44 verify`	`560034` cycles	`532359` cycles	`1.05`
`ML-DSA-65 sign`	`3681113` cycles	`3353844` cycles	`1.10`
`ML-DSA-65 verify`	`867066` cycles	`827247` cycles	`1.05`
`ML-DSA-87 sign`	`4483019` cycles	`4186890` cycles	`1.07`
`ML-DSA-87 verify`	`1386458` cycles	`1328345` cycles	`1.04`

This comment was automatically generated by workflow using github-action-benchmark.

The reference implementation implements poly_chknorm in variables time. It argues that while the input coefficients itself are secret in some call sites, it is okay to leak which coefficient lead to rejection. It, hence, does absolute value computation in constant-time and then checks the bound using a conditional. This approach appears safe, but somewhat unclean as it is still operating on _secret data_. When performing constant-time testing it also requires a number of declassifications. This commit takes a more conservative approach and changes poly_chknorm to a constant-time implementation in the hope tha the performance penalty is acceptable. A minor change is that the API of poly_chknorm is changed to returning 0xFFFFFFFF in the case of failure to be able to re-use existing constant-time primitives. CBMC proofs are adjusted accordingly. Resolves #153 Signed-off-by: Matthias J. Kannwischer <matthias@kannwischer.eu>

The reference implementation implements polyvecl_chknorm and polyveck_chknorm in variable time, i.e., it leaks which polynomial violated the rejection bound. This approach appears safe, but somewhat unclean as it is still operating on _secret data_. When performing constant-time testing it also requires a number of declassifications. This commit takes a more conservative approach and changes both funcitons to constant-time implementations in the hope tha the performance penalty is acceptable. A minor change is that the API is changed to returning 0xFFFFFFFF in the case of failure to be able to re-use existing constant-time primitives. CBMC proofs are adjusted accordingly. Signed-off-by: Matthias J. Kannwischer <matthias@kannwischer.eu>

hanno-becker

LGTM. I support the attempt to make the functions constant-time to avoid refined reasoning about partial declassification.

### Issues: Resolves #V1982530715 and #V1982532566 ### Description of changes: The reference implementation implements `poly_chknorm` in variables time. It argues that while the input coefficients itself are secret in some call sites, it is okay to leak which coefficient lead to rejection. It, hence, does absolute value computation in constant-time and then checks the bound using a conditional. This approach appears safe, but somewhat unclean as it is still operating on secret data. When performing constant-time testing it also requires a number of declassifications. This commit takes a more conservative approach and changes `poly_chknorm` to a constant-time implementation in the hope that the performance penalty is acceptable. A minor change is that the API of `poly_chknorm` is changed to returning `0xFFFFFFFF` in the case of failure to be able to re-use existing constant-time primitives. ### Call-outs: PR source adapted from: Upstream PR in pq-code-package/mldsa-native#392. By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license and the ISC license.

mkannwischer added the benchmark label Jul 29, 2025