verify memory usage: Unpack hints h on the fly

[mkannwischer]

This commit splits up the signature unpacking into two parts: unpack_sig_c_z and unpack_sig_h.
This allows delaying unpacking of the hints h until later during the verification which in turn allows re-using the buffer used for the matrix. This cuts memory consumption by L KiB.

• Hoisted out from [TEST] Reduce crypto_sign_verify_internal stack usage #751

[github-actions]

Mac Mini (M1, 2020) benchmarks (opt)

Details

Benchmark suite	Current: f6503be	Previous: 8933db9	Ratio
ML-DSA-44 keypair	46204 cycles	46204 cycles	1
ML-DSA-44 sign	131270 cycles	131278 cycles	1.00
ML-DSA-44 verify	47776 cycles	47765 cycles	1.00
ML-DSA-65 keypair	81015 cycles	81031 cycles	1.00
ML-DSA-65 sign	215698 cycles	215800 cycles	1.00
ML-DSA-65 verify	80361 cycles	80058 cycles	1.00
ML-DSA-87 keypair	132160 cycles	132172 cycles	1.00
ML-DSA-87 sign	276871 cycles	276892 cycles	1.00
ML-DSA-87 verify	130562 cycles	130410 cycles	1.00

This comment was automatically generated by workflow using github-action-benchmark.

[github-actions]

Mac Mini (M1, 2020) benchmarks (no-opt)

Details

Benchmark suite	Current: f6503be	Previous: 8933db9	Ratio
ML-DSA-44 keypair	114193 cycles	114156 cycles	1.00
ML-DSA-44 sign	418150 cycles	418052 cycles	1.00
ML-DSA-44 verify	122661 cycles	122255 cycles	1.00
ML-DSA-65 keypair	195474 cycles	195490 cycles	1.00
ML-DSA-65 sign	682605 cycles	682460 cycles	1.00
ML-DSA-65 verify	198053 cycles	197755 cycles	1.00
ML-DSA-87 keypair	322541 cycles	322642 cycles	1.00
ML-DSA-87 sign	864349 cycles	864696 cycles	1.00
ML-DSA-87 verify	328718 cycles	328644 cycles	1.00

This comment was automatically generated by workflow using github-action-benchmark.

[github-actions]

Arm Cortex-A76 (Raspberry Pi 5) benchmarks (opt)

Details

Benchmark suite	Current: f6503be	Previous: 8933db9	Ratio
ML-DSA-44 keypair	113417 cycles	113348 cycles	1.00
ML-DSA-44 sign	356123 cycles	355932 cycles	1.00
ML-DSA-44 verify	117980 cycles	118018 cycles	1.00
ML-DSA-65 keypair	196577 cycles	196546 cycles	1.00
ML-DSA-65 sign	589169 cycles	589059 cycles	1.00
ML-DSA-65 verify	194566 cycles	194746 cycles	1.00
ML-DSA-87 keypair	322422 cycles	322709 cycles	1.00
ML-DSA-87 sign	752735 cycles	753072 cycles	1.00
ML-DSA-87 verify	319942 cycles	320128 cycles	1.00

This comment was automatically generated by workflow using github-action-benchmark.

[oqs-bot]

Intel Xeon 4th gen (c7i)

Details

Benchmark suite	Current: f6503be	Previous: 8933db9	Ratio
ML-DSA-44 keypair	35141 cycles	34372 cycles	1.02
ML-DSA-44 sign	120136 cycles	120027 cycles	1.00
ML-DSA-44 verify	38187 cycles	38103 cycles	1.00
ML-DSA-65 keypair	60745 cycles	60659 cycles	1.00
ML-DSA-65 sign	200543 cycles	200397 cycles	1.00
ML-DSA-65 verify	62781 cycles	62812 cycles	1.00
ML-DSA-87 keypair	94010 cycles	93992 cycles	1.00
ML-DSA-87 sign	239553 cycles	238255 cycles	1.01
ML-DSA-87 verify	96178 cycles	94920 cycles	1.01

This comment was automatically generated by workflow using github-action-benchmark.

[oqs-bot]

Intel Xeon 4th gen (c7i) (no-opt)

Details

Benchmark suite	Current: f6503be	Previous: 8933db9	Ratio
ML-DSA-44 keypair	93587 cycles	94201 cycles	0.99
ML-DSA-44 sign	333236 cycles	334218 cycles	1.00
ML-DSA-44 verify	99980 cycles	99867 cycles	1.00
ML-DSA-65 keypair	159709 cycles	160034 cycles	1.00
ML-DSA-65 sign	545589 cycles	545365 cycles	1.00
ML-DSA-65 verify	161523 cycles	160650 cycles	1.01
ML-DSA-87 keypair	267333 cycles	268199 cycles	1.00
ML-DSA-87 sign	706937 cycles	707903 cycles	1.00
ML-DSA-87 verify	270917 cycles	270461 cycles	1.00

This comment was automatically generated by workflow using github-action-benchmark.

[github-actions]

Arm Cortex-A76 (Raspberry Pi 5) benchmarks (no-opt)

Details

Benchmark suite	Current: f6503be	Previous: 8933db9	Ratio
ML-DSA-44 keypair	212633 cycles	212419 cycles	1.00
ML-DSA-44 sign	759965 cycles	759723 cycles	1.00
ML-DSA-44 verify	228830 cycles	228844 cycles	1.00
ML-DSA-65 keypair	380315 cycles	380545 cycles	1.00
ML-DSA-65 sign	1253538 cycles	1252640 cycles	1.00
ML-DSA-65 verify	371994 cycles	371680 cycles	1.00
ML-DSA-87 keypair	604406 cycles	604445 cycles	1.00
ML-DSA-87 sign	1597737 cycles	1594215 cycles	1.00
ML-DSA-87 verify	617054 cycles	618697 cycles	1.00

This comment was automatically generated by workflow using github-action-benchmark.

[oqs-bot]

AMD EPYC 3rd gen (c6a)

Details

Benchmark suite	Current: f6503be	Previous: 8933db9	Ratio
ML-DSA-44 keypair	68963 cycles	68940 cycles	1.00
ML-DSA-44 sign	187390 cycles	187846 cycles	1.00
ML-DSA-44 verify	69100 cycles	69282 cycles	1.00
ML-DSA-65 keypair	119833 cycles	119446 cycles	1.00
ML-DSA-65 sign	300090 cycles	301247 cycles	1.00
ML-DSA-65 verify	115173 cycles	115447 cycles	1.00
ML-DSA-87 keypair	203799 cycles	202992 cycles	1.00
ML-DSA-87 sign	394125 cycles	393314 cycles	1.00
ML-DSA-87 verify	194984 cycles	195680 cycles	1.00

This comment was automatically generated by workflow using github-action-benchmark.

[oqs-bot]

Intel Xeon 3rd gen (c6i)

Details

Benchmark suite	Current: f6503be	Previous: 8933db9	Ratio
ML-DSA-44 keypair	56510 cycles	57044 cycles	0.99
ML-DSA-44 sign	181510 cycles	181848 cycles	1.00
ML-DSA-44 verify	61226 cycles	61082 cycles	1.00
ML-DSA-65 keypair	98821 cycles	98510 cycles	1.00
ML-DSA-65 sign	298523 cycles	299264 cycles	1.00
ML-DSA-65 verify	100377 cycles	100372 cycles	1.00
ML-DSA-87 keypair	152801 cycles	152400 cycles	1.00
ML-DSA-87 sign	354475 cycles	355097 cycles	1.00
ML-DSA-87 verify	153732 cycles	153647 cycles	1.00

This comment was automatically generated by workflow using github-action-benchmark.

[oqs-bot]

AMD EPYC 4th gen (c7a)

Details

Benchmark suite	Current: f6503be	Previous: 8933db9	Ratio
ML-DSA-44 keypair	41579 cycles	41768 cycles	1.00
ML-DSA-44 sign	134840 cycles	134643 cycles	1.00
ML-DSA-44 verify	44687 cycles	44801 cycles	1.00
ML-DSA-65 keypair	72607 cycles	73157 cycles	0.99
ML-DSA-65 sign	215866 cycles	217074 cycles	0.99
ML-DSA-65 verify	75115 cycles	73831 cycles	1.02
ML-DSA-87 keypair	107561 cycles	108344 cycles	0.99
ML-DSA-87 sign	251470 cycles	252157 cycles	1.00
ML-DSA-87 verify	109366 cycles	110026 cycles	0.99

This comment was automatically generated by workflow using github-action-benchmark.

[oqs-bot]

AMD EPYC 3rd gen (c6a) (no-opt)

Details

Benchmark suite	Current: f6503be	Previous: 8933db9	Ratio
ML-DSA-44 keypair	134907 cycles	134815 cycles	1.00
ML-DSA-44 sign	523677 cycles	524851 cycles	1.00
ML-DSA-44 verify	147315 cycles	147535 cycles	1.00
ML-DSA-65 keypair	226868 cycles	226816 cycles	1.00
ML-DSA-65 sign	860135 cycles	861519 cycles	1.00
ML-DSA-65 verify	234724 cycles	234798 cycles	1.00
ML-DSA-87 keypair	371386 cycles	372163 cycles	1.00
ML-DSA-87 sign	1083150 cycles	1081624 cycles	1.00
ML-DSA-87 verify	383992 cycles	383383 cycles	1.00

This comment was automatically generated by workflow using github-action-benchmark.

[oqs-bot]

Intel Xeon 3rd gen (c6i) (no-opt)

Details

Benchmark suite	Current: f6503be	Previous: 8933db9	Ratio
ML-DSA-44 keypair	157793 cycles	158774 cycles	0.99
ML-DSA-44 sign	549648 cycles	553689 cycles	0.99
ML-DSA-44 verify	169942 cycles	170266 cycles	1.00
ML-DSA-65 keypair	268891 cycles	268386 cycles	1.00
ML-DSA-65 sign	907860 cycles	904101 cycles	1.00
ML-DSA-65 verify	275702 cycles	274733 cycles	1.00
ML-DSA-87 keypair	448617 cycles	448848 cycles	1.00
ML-DSA-87 sign	1158163 cycles	1158629 cycles	1.00
ML-DSA-87 verify	460215 cycles	459042 cycles	1.00

This comment was automatically generated by workflow using github-action-benchmark.

[oqs-bot]

Graviton4

Details

Benchmark suite	Current: f6503be	Previous: 8933db9	Ratio
ML-DSA-44 keypair	68464 cycles	68285 cycles	1.00
ML-DSA-44 sign	201880 cycles	201946 cycles	1.00
ML-DSA-44 verify	70902 cycles	70642 cycles	1.00
ML-DSA-65 keypair	121022 cycles	121073 cycles	1.00
ML-DSA-65 sign	330661 cycles	331230 cycles	1.00
ML-DSA-65 verify	117884 cycles	117970 cycles	1.00
ML-DSA-87 keypair	198310 cycles	198361 cycles	1.00
ML-DSA-87 sign	426820 cycles	426811 cycles	1.00
ML-DSA-87 verify	194029 cycles	194224 cycles	1.00

This comment was automatically generated by workflow using github-action-benchmark.

[oqs-bot]

AMD EPYC 4th gen (c7a) (no-opt)

Details

Benchmark suite	Current: f6503be	Previous: 8933db9	Ratio
ML-DSA-44 keypair	120072 cycles	121340 cycles	0.99
ML-DSA-44 sign	447197 cycles	450417 cycles	0.99
ML-DSA-44 verify	130084 cycles	131705 cycles	0.99
ML-DSA-65 keypair	204835 cycles	206768 cycles	0.99
ML-DSA-65 sign	729102 cycles	730995 cycles	1.00
ML-DSA-65 verify	210498 cycles	211843 cycles	0.99
ML-DSA-87 keypair	337641 cycles	340681 cycles	0.99
ML-DSA-87 sign	923064 cycles	929434 cycles	0.99
ML-DSA-87 verify	346540 cycles	347157 cycles	1.00

This comment was automatically generated by workflow using github-action-benchmark.

[oqs-bot]

Graviton3

Details

Benchmark suite	Current: f6503be	Previous: 8933db9	Ratio
ML-DSA-44 keypair	72250 cycles	72206 cycles	1.00
ML-DSA-44 sign	212030 cycles	212085 cycles	1.00
ML-DSA-44 verify	75754 cycles	75732 cycles	1.00
ML-DSA-65 keypair	127381 cycles	127427 cycles	1.00
ML-DSA-65 sign	350265 cycles	350098 cycles	1.00
ML-DSA-65 verify	125532 cycles	125335 cycles	1.00
ML-DSA-87 keypair	205895 cycles	208160 cycles	0.99
ML-DSA-87 sign	444237 cycles	448888 cycles	0.99
ML-DSA-87 verify	205727 cycles	205075 cycles	1.00

This comment was automatically generated by workflow using github-action-benchmark.

[oqs-bot]

Graviton4 (no-opt)

Details

Benchmark suite	Current: f6503be	Previous: 8933db9	Ratio
ML-DSA-44 keypair	128554 cycles	128290 cycles	1.00
ML-DSA-44 sign	447128 cycles	447683 cycles	1.00
ML-DSA-44 verify	138110 cycles	138350 cycles	1.00
ML-DSA-65 keypair	220383 cycles	220301 cycles	1.00
ML-DSA-65 sign	726363 cycles	727535 cycles	1.00
ML-DSA-65 verify	222829 cycles	223194 cycles	1.00
ML-DSA-87 keypair	365105 cycles	365100 cycles	1.00
ML-DSA-87 sign	926679 cycles	926074 cycles	1.00
ML-DSA-87 verify	372574 cycles	372724 cycles	1.00

This comment was automatically generated by workflow using github-action-benchmark.

[oqs-bot]

Graviton2

Details

Benchmark suite	Current: f6503be	Previous: 8933db9	Ratio
ML-DSA-44 keypair	114074 cycles	113737 cycles	1.00
ML-DSA-44 sign	356790 cycles	356305 cycles	1.00
ML-DSA-44 verify	118382 cycles	118106 cycles	1.00
ML-DSA-65 keypair	196886 cycles	196661 cycles	1.00
ML-DSA-65 sign	590040 cycles	589237 cycles	1.00
ML-DSA-65 verify	194865 cycles	194763 cycles	1.00
ML-DSA-87 keypair	323008 cycles	323538 cycles	1.00
ML-DSA-87 sign	753229 cycles	754524 cycles	1.00
ML-DSA-87 verify	320370 cycles	320437 cycles	1.00

This comment was automatically generated by workflow using github-action-benchmark.

[oqs-bot]

Graviton3 (no-opt)

Details

Benchmark suite	Current: f6503be	Previous: 8933db9	Ratio
ML-DSA-44 keypair	138678 cycles	138511 cycles	1.00
ML-DSA-44 sign	483594 cycles	484146 cycles	1.00
ML-DSA-44 verify	148450 cycles	148699 cycles	1.00
ML-DSA-65 keypair	242267 cycles	242282 cycles	1.00
ML-DSA-65 sign	792332 cycles	792625 cycles	1.00
ML-DSA-65 verify	240741 cycles	241147 cycles	1.00
ML-DSA-87 keypair	395864 cycles	396266 cycles	1.00
ML-DSA-87 sign	1012467 cycles	1012387 cycles	1.00
ML-DSA-87 verify	402710 cycles	402523 cycles	1.00

This comment was automatically generated by workflow using github-action-benchmark.

[oqs-bot]

Graviton2 (no-opt)

Details

Benchmark suite	Current: f6503be	Previous: 8933db9	Ratio
ML-DSA-44 keypair	212963 cycles	212757 cycles	1.00
ML-DSA-44 sign	760596 cycles	760583 cycles	1.00
ML-DSA-44 verify	229256 cycles	229095 cycles	1.00
ML-DSA-65 keypair	380644 cycles	380969 cycles	1.00
ML-DSA-65 sign	1252949 cycles	1254036 cycles	1.00
ML-DSA-65 verify	372381 cycles	371934 cycles	1.00
ML-DSA-87 keypair	605930 cycles	604475 cycles	1.00
ML-DSA-87 sign	1596320 cycles	1595118 cycles	1.00
ML-DSA-87 verify	618008 cycles	618516 cycles	1.00

This comment was automatically generated by workflow using github-action-benchmark.

[github-actions]

SpacemiT K1 8 (Banana Pi F3) benchmarks (no-opt)

Details

Benchmark suite	Current: f6503be	Previous: 8933db9	Ratio
ML-DSA-44 keypair	829217 cycles	827059 cycles	1.00
ML-DSA-44 sign	3235321 cycles	3231963 cycles	1.00
ML-DSA-44 verify	922407 cycles	922300 cycles	1.00
ML-DSA-65 keypair	1408325 cycles	1412898 cycles	1.00
ML-DSA-65 sign	5337316 cycles	5354291 cycles	1.00
ML-DSA-65 verify	1478483 cycles	1480666 cycles	1.00
ML-DSA-87 keypair	2309529 cycles	2312958 cycles	1.00
ML-DSA-87 sign	6650066 cycles	6668645 cycles	1.00
ML-DSA-87 verify	2408322 cycles	2409942 cycles	1.00

This comment was automatically generated by workflow using github-action-benchmark.

[github-actions]

Arm Cortex-A72 (Raspberry Pi 4) benchmarks (opt)

Details

Benchmark suite	Current: f6503be	Previous: 8933db9	Ratio
ML-DSA-44 keypair	229171 cycles	228876 cycles	1.00
ML-DSA-44 sign	629704 cycles	614814 cycles	1.02
ML-DSA-44 verify	234317 cycles	217070 cycles	1.08
ML-DSA-65 keypair	386832 cycles	394718 cycles	0.98
ML-DSA-65 sign	1018531 cycles	991561 cycles	1.03
ML-DSA-65 verify	370168 cycles	376152 cycles	0.98
ML-DSA-87 keypair	658975 cycles	646097 cycles	1.02
ML-DSA-87 sign	1406876 cycles	1332158 cycles	1.06
ML-DSA-87 verify	647532 cycles	625886 cycles	1.03

This comment was automatically generated by workflow using github-action-benchmark.

[github-actions]

⚠️ Performance Alert ⚠️

Possible performance regression was detected for benchmark 'Arm Cortex-A72 (Raspberry Pi 4) benchmarks (opt)'.
Benchmark result of this commit is worse than the previous benchmark result exceeding threshold 1.03.

Benchmark suite	Current: f6503be	Previous: 8933db9	Ratio
ML-DSA-44 verify	234317 cycles	217070 cycles	1.08
ML-DSA-87 sign	1406876 cycles	1332158 cycles	1.06
ML-DSA-87 verify	647532 cycles	625886 cycles	1.03

This comment was automatically generated by workflow using github-action-benchmark.

[github-actions]

Arm Cortex-A55 (Snapdragon 888) benchmarks (opt)

Details

Benchmark suite	Current: f6503be	Previous: 8933db9	Ratio
ML-DSA-44 keypair	272086 cycles	273072 cycles	1.00
ML-DSA-44 sign	799452 cycles	805254 cycles	0.99
ML-DSA-44 verify	272361 cycles	273857 cycles	0.99
ML-DSA-65 keypair	468476 cycles	468169 cycles	1.00
ML-DSA-65 sign	1317665 cycles	1319237 cycles	1.00
ML-DSA-65 verify	451223 cycles	449707 cycles	1.00
ML-DSA-87 keypair	805715 cycles	804538 cycles	1.00
ML-DSA-87 sign	1808353 cycles	1809292 cycles	1.00
ML-DSA-87 verify	778420 cycles	779109 cycles	1.00

This comment was automatically generated by workflow using github-action-benchmark.

[github-actions]

Arm Cortex-A72 (Raspberry Pi 4) benchmarks (no-opt)

Details

Benchmark suite	Current: f6503be	Previous: 8933db9	Ratio
ML-DSA-44 keypair	309867 cycles	312735 cycles	0.99
ML-DSA-44 sign	1154040 cycles	1199505 cycles	0.96
ML-DSA-44 verify	333978 cycles	345578 cycles	0.97
ML-DSA-65 keypair	565534 cycles	582435 cycles	0.97
ML-DSA-65 sign	1932069 cycles	1976366 cycles	0.98
ML-DSA-65 verify	526835 cycles	554587 cycles	0.95
ML-DSA-87 keypair	856162 cycles	873951 cycles	0.98
ML-DSA-87 sign	2425164 cycles	2499834 cycles	0.97
ML-DSA-87 verify	882491 cycles	890351 cycles	0.99

This comment was automatically generated by workflow using github-action-benchmark.

[github-actions]

Arm Cortex-A55 (Snapdragon 888) benchmarks (no-opt)

Details

Benchmark suite	Current: f6503be	Previous: 8933db9	Ratio
ML-DSA-44 keypair	462570 cycles	461655 cycles	1.00
ML-DSA-44 sign	2138045 cycles	2136241 cycles	1.00
ML-DSA-44 verify	547668 cycles	547092 cycles	1.00
ML-DSA-65 keypair	774877 cycles	774826 cycles	1.00
ML-DSA-65 sign	3499244 cycles	3500411 cycles	1.00
ML-DSA-65 verify	849141 cycles	850053 cycles	1.00
ML-DSA-87 keypair	1251533 cycles	1249873 cycles	1.00
ML-DSA-87 sign	4339029 cycles	4335460 cycles	1.00
ML-DSA-87 verify	1364449 cycles	1366205 cycles	1.00

This comment was automatically generated by workflow using github-action-benchmark.

[oqs-bot]

CBMC Results (ML-DSA-44)

⚠️ Attention Required

Proof	Status	Current	Previous	Change
sign_verify_internal	❌	-	162s	-

Full Results (173 proofs)

Proof	Status	Current	Previous	Change
**TOTAL**	✅	1731s	1942s	-10.9%
mld_attempt_signature_generation	✅	220s	207s	+6%
polyvecl_pointwise_acc_montgomery_c	✅	206s	217s	-5%
poly_pointwise_montgomery_c	✅	129s	141s	-9%
rej_uniform_native	✅	125s	130s	-4%
mld_ct_memcmp	✅	78s	85s	-8%
mld_invntt_layer	✅	71s	74s	-4%
keccak_squeezeblocks_x4	✅	42s	44s	-5%
mld_ntt_layer	✅	40s	45s	-11%
sign_signature_internal	✅	32s	35s	-9%
rej_uniform	✅	19s	23s	-17%
polyvec_matrix_expand	✅	18s	19s	-5%
rej_uniform_c	✅	18s	18s	+0%
fqmul	✅	17s	21s	-19%
poly_uniform_eta_4x	✅	17s	16s	+6%
polymat_permute_bitrev_to_custom	✅	17s	15s	+13%
poly_add	✅	16s	14s	+14%
poly_chknorm_c	✅	16s	19s	-16%
poly_uniform_4x	✅	14s	14s	+0%
polyt0_unpack	✅	14s	16s	-12%
keccakf1600x4_permute_native	✅	13s	13s	+0%
keccak_absorb_once_x4	✅	12s	15s	-20%
mld_ntt_butterfly_block	✅	12s	12s	+0%
polyeta_unpack	✅	11s	12s	-8%
polyz_unpack_c	✅	10s	13s	-23%
keccakf1600_permute	✅	9s	6s	+50%
keccakf1600_permute_native	✅	9s	8s	+12%
mld_compute_t0_t1_tr_from_sk_components	✅	9s	15s	-40%
poly_invntt_tomont_c	✅	9s	10s	-10%
polyvec_matrix_expand_serial	✅	8s	7s	+14%
polyvec_matrix_pointwise_montgomery	✅	8s	8s	+0%
mld_polyvecl_permute_bitrev_to_custom_native	✅	7s	9s	-22%
polyveck_chknorm	✅	7s	4s	+75%
polyveck_decompose	✅	7s	8s	-12%
polyvecl_uniform_gamma1	✅	7s	4s	+75%
mld_check_pct	✅	6s	6s	+0%
mld_sample_s1_s2_serial	✅	6s	3s	+100%
poly_challenge	✅	6s	5s	+20%
poly_decompose	✅	6s	4s	+50%
polyveck_ntt	✅	6s	4s	+50%
polyveck_pack_t0	✅	6s	3s	+100%
polyveck_power2round	✅	6s	7s	-14%
polyveck_shiftl	✅	6s	4s	+50%
polyveck_sub	✅	6s	6s	+0%
polyvecl_ntt	✅	6s	5s	+20%
sign	✅	6s	6s	+0%
sign_keypair	✅	6s	5s	+20%
sign_open	✅	6s	4s	+50%
mld_compute_pack_z	✅	5s	4s	+25%
mld_sample_s1_s2	✅	5s	5s	+0%
pack_sk	✅	5s	5s	+0%
poly_uniform	✅	5s	5s	+0%
poly_uniform_gamma1_4x	✅	5s	4s	+25%
polyveck_add	✅	5s	8s	-38%
polyveck_caddq	✅	5s	4s	+25%
polyveck_invntt_tomont	✅	5s	5s	+0%
polyveck_pointwise_poly_montgomery	✅	5s	4s	+25%
polyveck_reduce	✅	5s	4s	+25%
polyveck_use_hint	✅	5s	4s	+25%
polyvecl_chknorm	✅	5s	4s	+25%
polyvecl_unpack_z	✅	5s	5s	+0%
rej_eta_native	✅	5s	3s	+67%
shake256x4_squeezeblocks	✅	5s	3s	+67%
sign_keypair_internal	✅	5s	6s	-17%
sign_signature	✅	5s	4s	+25%
sign_signature_extmu	✅	5s	3s	+67%
keccak_absorb	✅	4s	6s	-33%
keccak_finalize	✅	4s	4s	+0%
keccakf1600_xor_bytes	✅	4s	4s	+0%
make_hint	✅	4s	4s	+0%
mld_ct_get_optblocker_i64	✅	4s	3s	+33%
mld_ct_get_optblocker_u32	✅	4s	3s	+33%
mld_h	✅	4s	4s	+0%
montgomery_reduce	✅	4s	2s	+100%
ntt_native_x86_64	✅	4s	3s	+33%
pack_pk	✅	4s	3s	+33%
pack_sig_c_h	✅	4s	2s	+100%
pack_sig_z	✅	4s	1s	+300%
poly_decompose_c	✅	4s	2s	+100%
poly_decompose_native	✅	4s	3s	+33%
poly_invntt_tomont	✅	4s	5s	-20%
poly_ntt_c	✅	4s	4s	+0%
poly_pointwise_montgomery	✅	4s	3s	+33%
poly_uniform_eta	✅	4s	3s	+33%
poly_use_hint_c	✅	4s	4s	+0%
poly_use_hint_native	✅	4s	7s	-43%
polyt0_pack	✅	4s	2s	+100%
polyt1_unpack	✅	4s	2s	+100%
polyveck_make_hint	✅	4s	4s	+0%
polyveck_unpack_t0	✅	4s	3s	+33%
polyvecl_permute_bitrev_to_custom	✅	4s	3s	+33%
polyvecl_pointwise_acc_montgomery	✅	4s	3s	+33%
polyvecl_unpack_eta	✅	4s	3s	+33%
polyz_pack	✅	4s	2s	+100%
reduce32	✅	4s	2s	+100%
rej_eta_c	✅	4s	6s	-33%
shake128_absorb	✅	4s	3s	+33%
shake128_release	✅	4s	3s	+33%
sign_pk_from_sk	✅	4s	4s	+0%
sign_signature_pre_hash_shake256	✅	4s	4s	+0%
sign_verify_extmu	✅	4s	4s	+0%
sign_verify_pre_hash_internal	✅	4s	3s	+33%
sign_verify_pre_hash_shake256	✅	4s	3s	+33%
unpack_sig_h	✅	4s	-	new
fqscale	✅	3s	3s	+0%
keccak_squeeze	✅	3s	5s	-40%
keccakf1600x4_extract_bytes	✅	3s	1s	+200%
keccakf1600x4_permute	✅	3s	4s	-25%
mld_ct_cmask_nonzero_u8	✅	3s	4s	-25%
mld_ct_get_optblocker_u8	✅	3s	2s	+50%
mld_ct_sel_int32	✅	3s	2s	+50%
mld_keccakf1600_extract_bytes	✅	3s	3s	+0%
mld_prepare_domain_separation_prefix	✅	3s	3s	+0%
mld_value_barrier_i64	✅	3s	4s	-25%
poly_caddq_native	✅	3s	2s	+50%
poly_chknorm	✅	3s	3s	+0%
poly_invntt_tomont_native	✅	3s	3s	+0%
poly_make_hint	✅	3s	3s	+0%
poly_ntt	✅	3s	5s	-40%
poly_ntt_native	✅	3s	5s	-40%
poly_power2round	✅	3s	3s	+0%
poly_shiftl	✅	3s	4s	-25%
poly_sub	✅	3s	2s	+50%
poly_uniform_gamma1	✅	3s	2s	+50%
polyeta_pack	✅	3s	2s	+50%
polyt1_pack	✅	3s	4s	-25%
polyveck_pack_eta	✅	3s	3s	+0%
polyvecl_pack_eta	✅	3s	2s	+50%
polyvecl_pointwise_acc_montgomery_native	✅	3s	4s	-25%
polyz_unpack	✅	3s	2s	+50%
polyz_unpack_native	✅	3s	2s	+50%
shake128_init	✅	3s	6s	-50%
shake256_init	✅	3s	3s	+0%
shake256x4_absorb_once	✅	3s	2s	+50%
sign_signature_pre_hash_internal	✅	3s	3s	+0%
sys_check_capability	✅	3s	1s	+200%
unpack_sk	✅	3s	4s	-25%
use_hint	✅	3s	3s	+0%
decompose	✅	2s	3s	-33%
keccak_init	✅	2s	1s	+100%
keccakf1600_extract_bytes (big endian)	✅	2s	3s	-33%
keccakf1600x4_xor_bytes	✅	2s	4s	-50%
mld_ct_abs_i32	✅	2s	2s	+0%
mld_ct_cmask_neg_i32	✅	2s	2s	+0%
mld_ct_cmask_nonzero_u32	✅	2s	3s	-33%
mld_value_barrier_u32	✅	2s	2s	+0%
poly_caddq	✅	2s	3s	-33%
poly_caddq_c	✅	2s	3s	-33%
poly_pointwise_montgomery_native	✅	2s	3s	-33%
poly_reduce	✅	2s	4s	-50%
poly_use_hint	✅	2s	3s	-33%
polyveck_pack_w1	✅	2s	3s	-33%
polyveck_unpack_eta	✅	2s	3s	-33%
polyvecl_uniform_gamma1_serial	✅	2s	3s	-33%
polyw1_pack	✅	2s	2s	+0%
power2round	✅	2s	2s	+0%
rej_eta	✅	2s	4s	-50%
shake128_finalize	✅	2s	3s	-33%
shake128_squeeze	✅	2s	2s	+0%
shake256_absorb	✅	2s	2s	+0%
shake256_finalize	✅	2s	2s	+0%
shake256_release	✅	2s	2s	+0%
sign_verify	✅	2s	5s	-60%
unpack_pk	✅	2s	4s	-50%
unpack_sig_c_z	✅	2s	-	new
sign_verify_internal	❌	-	162s	-
caddq	✅	1s	3s	-67%
keccakf1600_xor_bytes (big endian)	✅	1s	6s	-83%
mld_value_barrier_u8	✅	1s	2s	-50%
poly_chknorm_native	✅	1s	3s	-67%
shake128x4_absorb_once	✅	1s	5s	-80%
shake128x4_squeezeblocks	✅	1s	4s	-75%
shake256	✅	1s	5s	-80%
shake256_squeeze	✅	1s	3s	-67%

[oqs-bot]

CBMC Results (ML-DSA-87)

⚠️ Attention Required

Proof	Status	Current	Previous	Change
sign_verify_internal	❌	-	140s	-

Full Results (173 proofs)

Proof	Status	Current	Previous	Change
**TOTAL**	✅	2103s	2119s	-0.8%
mld_attempt_signature_generation	✅	225s	193s	+17%
polyvecl_pointwise_acc_montgomery_c	✅	187s	158s	+18%
polyvec_matrix_expand	✅	148s	134s	+10%
poly_pointwise_montgomery_c	✅	145s	132s	+10%
rej_uniform_native	✅	132s	126s	+5%
polyvec_matrix_expand_serial	✅	122s	116s	+5%
mld_ct_memcmp	✅	85s	77s	+10%
mld_invntt_layer	✅	63s	57s	+11%
keccak_squeezeblocks_x4	✅	45s	43s	+5%
mld_ntt_layer	✅	45s	44s	+2%
sign_signature_internal	✅	45s	48s	-6%
polymat_permute_bitrev_to_custom	✅	25s	26s	-4%
rej_uniform	✅	22s	21s	+5%
fqmul	✅	21s	18s	+17%
mld_compute_t0_t1_tr_from_sk_components	✅	19s	21s	-10%
poly_uniform_eta_4x	✅	18s	17s	+6%
rej_uniform_c	✅	18s	17s	+6%
poly_chknorm_c	✅	17s	18s	-6%
poly_uniform_4x	✅	16s	16s	+0%
polyeta_unpack	✅	15s	15s	+0%
mld_ntt_butterfly_block	✅	14s	11s	+27%
poly_add	✅	14s	10s	+40%
polyveck_add	✅	14s	13s	+8%
keccak_absorb_once_x4	✅	13s	15s	-13%
keccakf1600x4_permute_native	✅	13s	13s	+0%
mld_polyvecl_permute_bitrev_to_custom_native	✅	13s	12s	+8%
polyt0_unpack	✅	13s	12s	+8%
poly_invntt_tomont_c	✅	10s	8s	+25%
polyvecl_ntt	✅	10s	8s	+25%
sign	✅	10s	6s	+67%
mld_check_pct	✅	9s	7s	+29%
polyvec_matrix_pointwise_montgomery	✅	9s	9s	+0%
polyveck_decompose	✅	9s	9s	+0%
polyveck_use_hint	✅	9s	9s	+0%
keccakf1600_permute	✅	8s	7s	+14%
keccakf1600_permute_native	✅	8s	7s	+14%
poly_decompose_c	✅	8s	10s	-20%
polyveck_ntt	✅	8s	6s	+33%
polyveck_pointwise_poly_montgomery	✅	8s	8s	+0%
polyveck_power2round	✅	8s	7s	+14%
polyveck_shiftl	✅	8s	5s	+60%
sign_pk_from_sk	✅	8s	9s	-11%
unpack_sig_h	✅	8s	-	new
mld_sample_s1_s2_serial	✅	7s	6s	+17%
polyveck_caddq	✅	7s	6s	+17%
polyveck_invntt_tomont	✅	7s	9s	-22%
polyveck_reduce	✅	7s	9s	-22%
polyveck_sub	✅	7s	9s	-22%
polyvecl_uniform_gamma1	✅	7s	5s	+40%
keccak_absorb	✅	6s	4s	+50%
mld_compute_pack_z	✅	6s	8s	-25%
mld_sample_s1_s2	✅	6s	6s	+0%
poly_invntt_tomont	✅	6s	2s	+200%
poly_use_hint	✅	6s	4s	+50%
poly_use_hint_native	✅	6s	3s	+100%
polyveck_chknorm	✅	6s	5s	+20%
rej_eta_c	✅	6s	5s	+20%
sign_keypair_internal	✅	6s	3s	+100%
unpack_sk	✅	6s	7s	-14%
keccakf1600_xor_bytes	✅	5s	2s	+150%
mld_prepare_domain_separation_prefix	✅	5s	3s	+67%
montgomery_reduce	✅	5s	4s	+25%
poly_challenge	✅	5s	3s	+67%
poly_shiftl	✅	5s	5s	+0%
poly_uniform	✅	5s	4s	+25%
polyveck_unpack_t0	✅	5s	5s	+0%
polyvecl_chknorm	✅	5s	7s	-29%
polyvecl_pointwise_acc_montgomery_native	✅	5s	6s	-17%
polyw1_pack	✅	5s	4s	+25%
rej_eta_native	✅	5s	3s	+67%
sign_keypair	✅	5s	4s	+25%
sign_signature	✅	5s	2s	+150%
sign_signature_extmu	✅	5s	4s	+25%
sign_signature_pre_hash_internal	✅	5s	4s	+25%
decompose	✅	4s	4s	+0%
keccak_finalize	✅	4s	1s	+300%
keccak_init	✅	4s	3s	+33%
keccakf1600_xor_bytes (big endian)	✅	4s	3s	+33%
mld_value_barrier_u8	✅	4s	2s	+100%
poly_caddq_c	✅	4s	4s	+0%
poly_decompose_native	✅	4s	3s	+33%
poly_pointwise_montgomery	✅	4s	5s	-20%
poly_uniform_eta	✅	4s	3s	+33%
poly_uniform_gamma1_4x	✅	4s	4s	+0%
polyt0_pack	✅	4s	4s	+0%
polyveck_make_hint	✅	4s	3s	+33%
polyvecl_pack_eta	✅	4s	4s	+0%
polyvecl_unpack_z	✅	4s	4s	+0%
polyz_unpack_c	✅	4s	6s	-33%
power2round	✅	4s	4s	+0%
shake128_release	✅	4s	3s	+33%
shake256x4_squeezeblocks	✅	4s	2s	+100%
sign_signature_pre_hash_shake256	✅	4s	6s	-33%
sign_verify	✅	4s	4s	+0%
sign_verify_pre_hash_shake256	✅	4s	4s	+0%
unpack_sig_c_z	✅	4s	-	new
use_hint	✅	4s	1s	+300%
keccak_squeeze	✅	3s	4s	-25%
keccakf1600x4_xor_bytes	✅	3s	1s	+200%
mld_ct_get_optblocker_i64	✅	3s	2s	+50%
mld_ct_get_optblocker_u32	✅	3s	2s	+50%
mld_value_barrier_u32	✅	3s	3s	+0%
ntt_native_x86_64	✅	3s	5s	-40%
pack_pk	✅	3s	3s	+0%
pack_sig_c_h	✅	3s	4s	-25%
pack_sk	✅	3s	2s	+50%
poly_caddq	✅	3s	5s	-40%
poly_caddq_native	✅	3s	4s	-25%
poly_chknorm_native	✅	3s	2s	+50%
poly_invntt_tomont_native	✅	3s	2s	+50%
poly_ntt_c	✅	3s	2s	+50%
poly_pointwise_montgomery_native	✅	3s	8s	-62%
poly_power2round	✅	3s	4s	-25%
poly_reduce	✅	3s	7s	-57%
poly_use_hint_c	✅	3s	3s	+0%
polyeta_pack	✅	3s	3s	+0%
polyt1_unpack	✅	3s	3s	+0%
polyveck_pack_eta	✅	3s	3s	+0%
polyveck_pack_t0	✅	3s	4s	-25%
polyveck_pack_w1	✅	3s	3s	+0%
polyvecl_permute_bitrev_to_custom	✅	3s	4s	-25%
polyvecl_pointwise_acc_montgomery	✅	3s	1s	+200%
polyvecl_unpack_eta	✅	3s	4s	-25%
polyz_pack	✅	3s	6s	-50%
polyz_unpack	✅	3s	3s	+0%
polyz_unpack_native	✅	3s	3s	+0%
reduce32	✅	3s	2s	+50%
shake128_absorb	✅	3s	2s	+50%
shake128_finalize	✅	3s	4s	-25%
shake128_init	✅	3s	3s	+0%
shake128x4_absorb_once	✅	3s	3s	+0%
shake128x4_squeezeblocks	✅	3s	3s	+0%
shake256	✅	3s	2s	+50%
shake256_finalize	✅	3s	2s	+50%
shake256x4_absorb_once	✅	3s	5s	-40%
sign_open	✅	3s	6s	-50%
sign_verify_extmu	✅	3s	5s	-40%
sign_verify_pre_hash_internal	✅	3s	4s	-25%
unpack_pk	✅	3s	1s	+200%
caddq	✅	2s	2s	+0%
fqscale	✅	2s	3s	-33%
keccakf1600_extract_bytes (big endian)	✅	2s	3s	-33%
keccakf1600x4_extract_bytes	✅	2s	2s	+0%
keccakf1600x4_permute	✅	2s	4s	-50%
make_hint	✅	2s	4s	-50%
mld_ct_abs_i32	✅	2s	3s	-33%
mld_ct_cmask_nonzero_u8	✅	2s	6s	-67%
mld_ct_get_optblocker_u8	✅	2s	3s	-33%
mld_ct_sel_int32	✅	2s	1s	+100%
mld_h	✅	2s	4s	-50%
mld_keccakf1600_extract_bytes	✅	2s	3s	-33%
mld_value_barrier_i64	✅	2s	4s	-50%
pack_sig_z	✅	2s	3s	-33%
poly_chknorm	✅	2s	3s	-33%
poly_decompose	✅	2s	4s	-50%
poly_make_hint	✅	2s	3s	-33%
poly_ntt	✅	2s	3s	-33%
poly_ntt_native	✅	2s	3s	-33%
poly_sub	✅	2s	2s	+0%
poly_uniform_gamma1	✅	2s	4s	-50%
polyt1_pack	✅	2s	3s	-33%
polyveck_unpack_eta	✅	2s	3s	-33%
polyvecl_uniform_gamma1_serial	✅	2s	4s	-50%
rej_eta	✅	2s	3s	-33%
shake128_squeeze	✅	2s	2s	+0%
shake256_absorb	✅	2s	2s	+0%
shake256_init	✅	2s	2s	+0%
shake256_release	✅	2s	5s	-60%
sys_check_capability	✅	2s	3s	-33%
sign_verify_internal	❌	-	140s	-
mld_ct_cmask_neg_i32	✅	1s	2s	-50%
mld_ct_cmask_nonzero_u32	✅	1s	3s	-67%
shake256_squeeze	✅	1s	2s	-50%

[oqs-bot]

CBMC Results (ML-DSA-65)

⚠️ Attention Required

Proof	Status	Current	Previous	Change
sign_verify_internal	❌	-	97s	-

Full Results (173 proofs)

Proof	Status	Current	Previous	Change
**TOTAL**	✅	2174s	2163s	+0.5%
mld_attempt_signature_generation	✅	272s	240s	+13%
polyvecl_pointwise_acc_montgomery_c	✅	248s	227s	+9%
poly_pointwise_montgomery_c	✅	146s	137s	+7%
polyvec_matrix_expand	✅	138s	131s	+5%
rej_uniform_native	✅	136s	130s	+5%
mld_ct_memcmp	✅	85s	86s	-1%
mld_invntt_layer	✅	66s	63s	+5%
polyvec_matrix_expand_serial	✅	58s	59s	-2%
mld_ntt_layer	✅	47s	45s	+4%
keccak_squeezeblocks_x4	✅	46s	45s	+2%
sign_signature_internal	✅	45s	48s	-6%
polyveck_ntt	✅	24s	25s	-4%
fqmul	✅	22s	20s	+10%
polymat_permute_bitrev_to_custom	✅	21s	20s	+5%
rej_uniform	✅	21s	21s	+0%
rej_uniform_c	✅	21s	19s	+11%
poly_uniform_eta_4x	✅	17s	17s	+0%
polyveck_decompose	✅	17s	16s	+6%
mld_compute_t0_t1_tr_from_sk_components	✅	16s	17s	-6%
polyt0_unpack	✅	15s	11s	+36%
poly_uniform_4x	✅	14s	16s	-12%
keccak_absorb_once_x4	✅	13s	13s	+0%
keccakf1600x4_permute_native	✅	13s	13s	+0%
mld_ntt_butterfly_block	✅	13s	14s	-7%
poly_chknorm_c	✅	12s	13s	-8%
polyvec_matrix_pointwise_montgomery	✅	12s	14s	-14%
polyveck_add	✅	11s	11s	+0%
polyveck_power2round	✅	11s	11s	+0%
polyveck_pointwise_poly_montgomery	✅	10s	7s	+43%
sign	✅	10s	11s	-9%
mld_polyvecl_permute_bitrev_to_custom_native	✅	9s	9s	+0%
poly_add	✅	9s	9s	+0%
polyveck_caddq	✅	9s	5s	+80%
polyveck_sub	✅	9s	10s	-10%
poly_invntt_tomont_c	✅	8s	10s	-20%
polyeta_unpack	✅	8s	7s	+14%
polyveck_invntt_tomont	✅	8s	10s	-20%
polyveck_use_hint	✅	8s	7s	+14%
polyz_unpack_c	✅	8s	5s	+60%
sign_open	✅	8s	5s	+60%
sign_pk_from_sk	✅	8s	8s	+0%
keccak_absorb	✅	7s	7s	+0%
keccakf1600_permute	✅	7s	7s	+0%
keccakf1600_permute_native	✅	7s	8s	-12%
poly_decompose_c	✅	7s	10s	-30%
poly_pointwise_montgomery_native	✅	7s	2s	+250%
poly_use_hint_c	✅	7s	5s	+40%
polyvecl_ntt	✅	7s	7s	+0%
sign_keypair_internal	✅	7s	5s	+40%
mld_check_pct	✅	6s	5s	+20%
mld_compute_pack_z	✅	6s	6s	+0%
poly_caddq_c	✅	6s	5s	+20%
poly_caddq_native	✅	6s	7s	-14%
poly_challenge	✅	6s	5s	+20%
poly_make_hint	✅	6s	5s	+20%
poly_power2round	✅	6s	4s	+50%
poly_use_hint_native	✅	6s	3s	+100%
polyeta_pack	✅	6s	3s	+100%
polyveck_reduce	✅	6s	6s	+0%
polyveck_shiftl	✅	6s	10s	-40%
sign_signature_extmu	✅	6s	5s	+20%
sign_verify	✅	6s	4s	+50%
sign_verify_pre_hash_shake256	✅	6s	4s	+50%
decompose	✅	5s	2s	+150%
mld_h	✅	5s	5s	+0%
mld_keccakf1600_extract_bytes	✅	5s	2s	+150%
mld_sample_s1_s2	✅	5s	5s	+0%
mld_sample_s1_s2_serial	✅	5s	6s	-17%
ntt_native_x86_64	✅	5s	3s	+67%
polyt0_pack	✅	5s	3s	+67%
polyt1_unpack	✅	5s	2s	+150%
polyveck_chknorm	✅	5s	5s	+0%
polyveck_unpack_eta	✅	5s	2s	+150%
polyvecl_pointwise_acc_montgomery	✅	5s	2s	+150%
polyvecl_unpack_eta	✅	5s	4s	+25%
rej_eta_c	✅	5s	6s	-17%
shake256_release	✅	5s	3s	+67%
unpack_sig_h	✅	5s	-	new
unpack_sk	✅	5s	4s	+25%
caddq	✅	4s	4s	+0%
keccakf1600_extract_bytes (big endian)	✅	4s	3s	+33%
keccakf1600_xor_bytes	✅	4s	3s	+33%
pack_sig_z	✅	4s	5s	-20%
pack_sk	✅	4s	4s	+0%
poly_decompose	✅	4s	2s	+100%
poly_invntt_tomont	✅	4s	4s	+0%
poly_invntt_tomont_native	✅	4s	2s	+100%
poly_ntt	✅	4s	3s	+33%
poly_ntt_native	✅	4s	5s	-20%
poly_sub	✅	4s	2s	+100%
poly_uniform	✅	4s	6s	-33%
poly_uniform_eta	✅	4s	4s	+0%
polyveck_make_hint	✅	4s	6s	-33%
polyveck_pack_t0	✅	4s	2s	+100%
polyvecl_chknorm	✅	4s	5s	-20%
polyvecl_pack_eta	✅	4s	3s	+33%
polyvecl_pointwise_acc_montgomery_native	✅	4s	3s	+33%
polyvecl_uniform_gamma1_serial	✅	4s	2s	+100%
polyw1_pack	✅	4s	5s	-20%
polyz_unpack_native	✅	4s	4s	+0%
rej_eta_native	✅	4s	6s	-33%
shake128_init	✅	4s	2s	+100%
shake128x4_squeezeblocks	✅	4s	4s	+0%
shake256_absorb	✅	4s	3s	+33%
shake256x4_squeezeblocks	✅	4s	3s	+33%
sign_signature_pre_hash_shake256	✅	4s	5s	-20%
sys_check_capability	✅	4s	3s	+33%
fqscale	✅	3s	3s	+0%
keccak_finalize	✅	3s	1s	+200%
keccak_init	✅	3s	2s	+50%
keccak_squeeze	✅	3s	3s	+0%
keccakf1600x4_extract_bytes	✅	3s	5s	-40%
keccakf1600x4_permute	✅	3s	2s	+50%
keccakf1600x4_xor_bytes	✅	3s	3s	+0%
make_hint	✅	3s	1s	+200%
mld_ct_cmask_neg_i32	✅	3s	2s	+50%
mld_ct_cmask_nonzero_u32	✅	3s	2s	+50%
mld_ct_cmask_nonzero_u8	✅	3s	3s	+0%
mld_ct_get_optblocker_i64	✅	3s	4s	-25%
mld_ct_get_optblocker_u32	✅	3s	1s	+200%
mld_value_barrier_i64	✅	3s	2s	+50%
mld_value_barrier_u32	✅	3s	2s	+50%
pack_pk	✅	3s	2s	+50%
poly_caddq	✅	3s	3s	+0%
poly_chknorm_native	✅	3s	5s	-40%
poly_decompose_native	✅	3s	7s	-57%
poly_ntt_c	✅	3s	4s	-25%
poly_pointwise_montgomery	✅	3s	2s	+50%
poly_reduce	✅	3s	4s	-25%
poly_shiftl	✅	3s	2s	+50%
poly_uniform_gamma1	✅	3s	2s	+50%
poly_uniform_gamma1_4x	✅	3s	3s	+0%
poly_use_hint	✅	3s	3s	+0%
polyveck_pack_w1	✅	3s	5s	-40%
polyveck_unpack_t0	✅	3s	2s	+50%
polyvecl_uniform_gamma1	✅	3s	4s	-25%
power2round	✅	3s	3s	+0%
reduce32	✅	3s	4s	-25%
rej_eta	✅	3s	3s	+0%
shake128_finalize	✅	3s	3s	+0%
shake128_squeeze	✅	3s	4s	-25%
shake256_finalize	✅	3s	2s	+50%
shake256_squeeze	✅	3s	3s	+0%
shake256x4_absorb_once	✅	3s	2s	+50%
sign_signature	✅	3s	6s	-50%
sign_signature_pre_hash_internal	✅	3s	5s	-40%
sign_verify_pre_hash_internal	✅	3s	5s	-40%
unpack_pk	✅	3s	2s	+50%
use_hint	✅	3s	1s	+200%
keccakf1600_xor_bytes (big endian)	✅	2s	3s	-33%
mld_ct_abs_i32	✅	2s	2s	+0%
mld_ct_sel_int32	✅	2s	2s	+0%
mld_prepare_domain_separation_prefix	✅	2s	2s	+0%
mld_value_barrier_u8	✅	2s	3s	-33%
montgomery_reduce	✅	2s	2s	+0%
pack_sig_c_h	✅	2s	3s	-33%
poly_chknorm	✅	2s	3s	-33%
polyt1_pack	✅	2s	3s	-33%
polyveck_pack_eta	✅	2s	3s	-33%
polyvecl_permute_bitrev_to_custom	✅	2s	3s	-33%
polyvecl_unpack_z	✅	2s	3s	-33%
polyz_pack	✅	2s	2s	+0%
polyz_unpack	✅	2s	5s	-60%
shake128_absorb	✅	2s	3s	-33%
shake128_release	✅	2s	5s	-60%
shake128x4_absorb_once	✅	2s	3s	-33%
shake256_init	✅	2s	2s	+0%
sign_keypair	✅	2s	3s	-33%
sign_verify_extmu	✅	2s	3s	-33%
unpack_sig_c_z	✅	2s	-	new
sign_verify_internal	❌	-	97s	-
mld_ct_get_optblocker_u8	✅	1s	3s	-67%
shake256	✅	1s	3s	-67%