mldsa_gh 0.1.0

data/ext/mldsa_gh_native/vendor/mldsa-native/mldsa/src/fips202/native/aarch64/src/keccakf1600_round_constants.c

@@ -0,0 +1,47 @@
+/*
+ * Copyright (c) The mldsa-native project authors
+ * SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT
+ */
+
+/*
+ * WARNING: This file is auto-generated from scripts/autogen
+ *          in the mldsa-native repository.
+ *          Do not modify it directly.
+ */
+
+#include "../../../../common.h"
+
+#if (defined(MLD_FIPS202_AARCH64_NEED_X1_SCALAR) ||                  \
+     defined(MLD_FIPS202_AARCH64_NEED_X1_V84A) ||                    \
+     defined(MLD_FIPS202_AARCH64_NEED_X2_V84A) ||                    \
+     defined(MLD_FIPS202_AARCH64_NEED_X4_V8A_SCALAR_HYBRID) ||       \
+     defined(MLD_FIPS202_AARCH64_NEED_X4_V8A_V84A_SCALAR_HYBRID)) && \
+    !defined(MLD_CONFIG_MULTILEVEL_NO_SHARED)
+
+#include "fips202_native_aarch64.h"
+
+MLD_ALIGN MLD_INTERNAL_DATA_DEFINITION const uint64_t
+    mld_keccakf1600_round_constants[24] = {
+        0x0000000000000001, 0x0000000000008082, 0x800000000000808a,
+        0x8000000080008000, 0x000000000000808b, 0x0000000080000001,
+        0x8000000080008081, 0x8000000000008009, 0x000000000000008a,
+        0x0000000000000088, 0x0000000080008009, 0x000000008000000a,
+        0x000000008000808b, 0x800000000000008b, 0x8000000000008089,
+        0x8000000000008003, 0x8000000000008002, 0x8000000000000080,
+        0x000000000000800a, 0x800000008000000a, 0x8000000080008081,
+        0x8000000000008080, 0x0000000080000001, 0x8000000080008008,
+};
+
+#else /* (MLD_FIPS202_AARCH64_NEED_X1_SCALAR ||                               \
+         MLD_FIPS202_AARCH64_NEED_X1_V84A || MLD_FIPS202_AARCH64_NEED_X2_V84A \
+         || MLD_FIPS202_AARCH64_NEED_X4_V8A_SCALAR_HYBRID ||                  \
+         MLD_FIPS202_AARCH64_NEED_X4_V8A_V84A_SCALAR_HYBRID) &&               \
+         !MLD_CONFIG_MULTILEVEL_NO_SHARED */
+
+MLD_EMPTY_CU(fips202_aarch64_round_constants)
+
+#endif /* !((MLD_FIPS202_AARCH64_NEED_X1_SCALAR ||                             \
+          MLD_FIPS202_AARCH64_NEED_X1_V84A || MLD_FIPS202_AARCH64_NEED_X2_V84A \
+          || MLD_FIPS202_AARCH64_NEED_X4_V8A_SCALAR_HYBRID ||                  \
+          MLD_FIPS202_AARCH64_NEED_X4_V8A_V84A_SCALAR_HYBRID) &&               \
+          !MLD_CONFIG_MULTILEVEL_NO_SHARED) */

data/ext/mldsa_gh_native/vendor/mldsa-native/mldsa/src/fips202/native/aarch64/x1_scalar.h

@@ -0,0 +1,27 @@
+/*
+ * Copyright (c) The mlkem-native project authors
+ * Copyright (c) The mldsa-native project authors
+ * SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT
+ */
+
+#ifndef MLD_FIPS202_NATIVE_AARCH64_X1_SCALAR_H
+#define MLD_FIPS202_NATIVE_AARCH64_X1_SCALAR_H
+
+/* Part of backend API */
+#define MLD_USE_NATIVE_FIPS202_X1
+/* Guard for assembly file */
+#define MLD_FIPS202_AARCH64_NEED_X1_SCALAR
+
+#if !defined(__ASSEMBLER__)
+#include "../api.h"
+#include "src/fips202_native_aarch64.h"
+MLD_MUST_CHECK_RETURN_VALUE
+static MLD_INLINE int mld_keccak_f1600_x1_native(uint64_t *state)
+{
+  mld_keccak_f1600_x1_scalar_aarch64_asm(state,
+                                         mld_keccakf1600_round_constants);
+  return MLD_NATIVE_FUNC_SUCCESS;
+}
+#endif /* !__ASSEMBLER__ */
+
+#endif /* !MLD_FIPS202_NATIVE_AARCH64_X1_SCALAR_H */

data/ext/mldsa_gh_native/vendor/mldsa-native/mldsa/src/fips202/native/aarch64/x1_v84a.h

@@ -0,0 +1,36 @@
+/*
+ * Copyright (c) The mlkem-native project authors
+ * Copyright (c) The mldsa-native project authors
+ * SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT
+ */
+
+#ifndef MLD_FIPS202_NATIVE_AARCH64_X1_V84A_H
+#define MLD_FIPS202_NATIVE_AARCH64_X1_V84A_H
+
+#if !defined(__ARM_FEATURE_SHA3)
+#error This backend can only be used if SHA3 extensions are available.
+#endif
+
+/* Part of backend API */
+#define MLD_USE_NATIVE_FIPS202_X1
+/* Guard for assembly file */
+#define MLD_FIPS202_AARCH64_NEED_X1_V84A
+
+#if !defined(__ASSEMBLER__)
+#include "../api.h"
+#include "src/fips202_native_aarch64.h"
+MLD_MUST_CHECK_RETURN_VALUE
+static MLD_INLINE int mld_keccak_f1600_x1_native(uint64_t *state)
+{
+  if (!mld_sys_check_capability(MLD_SYS_CAP_AARCH64_NEON) ||
+      !mld_sys_check_capability(MLD_SYS_CAP_AARCH64_SHA3))
+  {
+    return MLD_NATIVE_FUNC_FALLBACK;
+  }
+
+  mld_keccak_f1600_x1_v84a_aarch64_asm(state, mld_keccakf1600_round_constants);
+  return MLD_NATIVE_FUNC_SUCCESS;
+}
+#endif /* !__ASSEMBLER__ */
+
+#endif /* !MLD_FIPS202_NATIVE_AARCH64_X1_V84A_H */

data/ext/mldsa_gh_native/vendor/mldsa-native/mldsa/src/fips202/native/aarch64/x2_v84a.h

@@ -0,0 +1,40 @@
+/*
+ * Copyright (c) The mlkem-native project authors
+ * Copyright (c) The mldsa-native project authors
+ * SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT
+ */
+
+#ifndef MLD_FIPS202_NATIVE_AARCH64_X2_V84A_H
+#define MLD_FIPS202_NATIVE_AARCH64_X2_V84A_H
+
+#if !defined(__ARM_FEATURE_SHA3)
+#error This backend can only be used if SHA3 extensions are available.
+#endif
+
+/* Part of backend API */
+#define MLD_USE_NATIVE_FIPS202_X4
+/* Guard for assembly file */
+#define MLD_FIPS202_AARCH64_NEED_X2_V84A
+
+#if !defined(__ASSEMBLER__)
+#include "../api.h"
+#include "src/fips202_native_aarch64.h"
+
+MLD_MUST_CHECK_RETURN_VALUE
+static MLD_INLINE int mld_keccak_f1600_x4_native(uint64_t *state)
+{
+  if (!mld_sys_check_capability(MLD_SYS_CAP_AARCH64_NEON) ||
+      !mld_sys_check_capability(MLD_SYS_CAP_AARCH64_SHA3))
+  {
+    return MLD_NATIVE_FUNC_FALLBACK;
+  }
+
+  mld_keccak_f1600_x2_v84a_aarch64_asm(state + 0 * 25,
+                                       mld_keccakf1600_round_constants);
+  mld_keccak_f1600_x2_v84a_aarch64_asm(state + 2 * 25,
+                                       mld_keccakf1600_round_constants);
+  return MLD_NATIVE_FUNC_SUCCESS;
+}
+#endif /* !__ASSEMBLER__ */
+
+#endif /* !MLD_FIPS202_NATIVE_AARCH64_X2_V84A_H */

data/ext/mldsa_gh_native/vendor/mldsa-native/mldsa/src/fips202/native/aarch64/x4_v8a_scalar.h

@@ -0,0 +1,32 @@
+/*
+ * Copyright (c) The mlkem-native project authors
+ * Copyright (c) The mldsa-native project authors
+ * SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT
+ */
+
+#ifndef MLD_FIPS202_NATIVE_AARCH64_X4_V8A_SCALAR_H
+#define MLD_FIPS202_NATIVE_AARCH64_X4_V8A_SCALAR_H
+
+/* Part of backend API */
+#define MLD_USE_NATIVE_FIPS202_X4
+/* Guard for assembly file */
+#define MLD_FIPS202_AARCH64_NEED_X4_V8A_SCALAR_HYBRID
+
+#if !defined(__ASSEMBLER__)
+#include "../api.h"
+#include "src/fips202_native_aarch64.h"
+MLD_MUST_CHECK_RETURN_VALUE
+static MLD_INLINE int mld_keccak_f1600_x4_native(uint64_t *state)
+{
+  if (!mld_sys_check_capability(MLD_SYS_CAP_AARCH64_NEON))
+  {
+    return MLD_NATIVE_FUNC_FALLBACK;
+  }
+
+  mld_keccak_f1600_x4_v8a_scalar_hybrid_aarch64_asm(
+      state, mld_keccakf1600_round_constants);
+  return MLD_NATIVE_FUNC_SUCCESS;
+}
+#endif /* !__ASSEMBLER__ */
+
+#endif /* !MLD_FIPS202_NATIVE_AARCH64_X4_V8A_SCALAR_H */

data/ext/mldsa_gh_native/vendor/mldsa-native/mldsa/src/fips202/native/aarch64/x4_v8a_v84a_scalar.h

@@ -0,0 +1,37 @@
+/*
+ * Copyright (c) The mlkem-native project authors
+ * Copyright (c) The mldsa-native project authors
+ * SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT
+ */
+
+#ifndef MLD_FIPS202_NATIVE_AARCH64_X4_V8A_V84A_SCALAR_H
+#define MLD_FIPS202_NATIVE_AARCH64_X4_V8A_V84A_SCALAR_H
+
+#if !defined(__ARM_FEATURE_SHA3)
+#error This backend can only be used if SHA3 extensions are available.
+#endif
+
+/* Part of backend API */
+#define MLD_USE_NATIVE_FIPS202_X4
+/* Guard for assembly file */
+#define MLD_FIPS202_AARCH64_NEED_X4_V8A_V84A_SCALAR_HYBRID
+
+#if !defined(__ASSEMBLER__)
+#include "../api.h"
+#include "src/fips202_native_aarch64.h"
+MLD_MUST_CHECK_RETURN_VALUE
+static MLD_INLINE int mld_keccak_f1600_x4_native(uint64_t *state)
+{
+  if (!mld_sys_check_capability(MLD_SYS_CAP_AARCH64_NEON) ||
+      !mld_sys_check_capability(MLD_SYS_CAP_AARCH64_SHA3))
+  {
+    return MLD_NATIVE_FUNC_FALLBACK;
+  }
+
+  mld_keccak_f1600_x4_v8a_v84a_scalar_hybrid_aarch64_asm(
+      state, mld_keccakf1600_round_constants);
+  return MLD_NATIVE_FUNC_SUCCESS;
+}
+#endif /* !__ASSEMBLER__ */
+
+#endif /* !MLD_FIPS202_NATIVE_AARCH64_X4_V8A_V84A_SCALAR_H */

data/ext/mldsa_gh_native/vendor/mldsa-native/mldsa/src/fips202/native/api.h

@@ -0,0 +1,129 @@
+/*
+ * Copyright (c) The mlkem-native project authors
+ * Copyright (c) The mldsa-native project authors
+ * SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT
+ */
+
+#ifndef MLD_FIPS202_NATIVE_API_H
+#define MLD_FIPS202_NATIVE_API_H
+/*
+ * FIPS-202 native interface
+ *
+ * This header is primarily for documentation purposes.
+ * It should not be included by backend implementations.
+ */
+
+#include "../../cbmc.h"
+#include "../../common.h"
+
+/* Backends must return MLD_NATIVE_FUNC_SUCCESS upon success. */
+#define MLD_NATIVE_FUNC_SUCCESS (0)
+/* Backends may return MLD_NATIVE_FUNC_FALLBACK to signal to the frontend that
+ * the target/parameters are unsupported; typically, this would be because of
+ * dependencies on CPU features not detected on the host CPU. In this case,
+ * the frontend falls back to the default C implementation.
+ *
+ * IMPORTANT: Backend implementations must ensure that the decision of whether
+ * to fallback (return MLD_NATIVE_FUNC_FALLBACK) or not must never depend on
+ * the input data itself. Fallback decisions may only depend on system
+ * capabilities (e.g., CPU features) and, where present, length information.
+ * This requirement applies to all backend functions to maintain constant-time
+ * properties.
+ */
+#define MLD_NATIVE_FUNC_FALLBACK (-1)
+
+/*
+ * This is the C<->native interface allowing for the drop-in
+ * of custom Keccak-F1600 implementations.
+ *
+ * A _backend_ is a specific implementation of parts of this interface.
+ *
+ * You can replace 1-fold or 4-fold batched Keccak-F1600.
+ * To enable, set MLD_USE_NATIVE_FIPS202_X1 or MLD_USE_NATIVE_FIPS202_X4
+ * in your backend, and define the inline wrappers mld_keccak_f1600_x1_native()
+ * and/or mld_keccak_f1600_x4_native(), respectively, to forward to your
+ * implementation.
+ */
+
+#if defined(MLD_USE_NATIVE_FIPS202_X1)
+MLD_MUST_CHECK_RETURN_VALUE
+static MLD_INLINE int mld_keccak_f1600_x1_native(uint64_t *state)
+__contract__(
+    requires(memory_no_alias(state, sizeof(uint64_t) * 25 * 1))
+    assigns(memory_slice(state, sizeof(uint64_t) * 25 * 1))
+    ensures(return_value == MLD_NATIVE_FUNC_FALLBACK || return_value == MLD_NATIVE_FUNC_SUCCESS)
+    ensures((return_value == MLD_NATIVE_FUNC_FALLBACK) ==> array_unchanged_u64(state, 25 * 1))
+);
+#endif /* MLD_USE_NATIVE_FIPS202_X1 */
+#if defined(MLD_USE_NATIVE_FIPS202_X4)
+MLD_MUST_CHECK_RETURN_VALUE
+static MLD_INLINE int mld_keccak_f1600_x4_native(uint64_t *state)
+__contract__(
+    requires(memory_no_alias(state, sizeof(uint64_t) * 25 * 4))
+    assigns(memory_slice(state, sizeof(uint64_t) * 25 * 4))
+    ensures(return_value == MLD_NATIVE_FUNC_FALLBACK || return_value == MLD_NATIVE_FUNC_SUCCESS)
+    ensures((return_value == MLD_NATIVE_FUNC_FALLBACK) ==> array_unchanged_u64(state, 25 * 4))
+);
+#endif /* MLD_USE_NATIVE_FIPS202_X4 */
+
+/*
+ * Native x4 XOR bytes and extract bytes interface.
+ *
+ * These functions allow backends to provide optimized implementations for
+ * XORing input data into the state and extracting output data from the state.
+ * This is particularly useful for backends that use a different internal state
+ * representation (e.g., bit-interleaved), as conversion can happen during
+ * XOR/extract rather than before/after each permutation.
+ *
+ * NOTE: We assume that the custom representation of the zero state is the
+ * all-zero state.
+ *
+ * MLD_USE_NATIVE_FIPS202_X4_XOR_BYTES: Backend provides native XOR bytes
+ * MLD_USE_NATIVE_FIPS202_X4_EXTRACT_BYTES: Backend provides native extract
+ * bytes
+ */
+
+#if defined(MLD_USE_NATIVE_FIPS202_X4_XOR_BYTES)
+MLD_MUST_CHECK_RETURN_VALUE
+static MLD_INLINE int mld_keccakf1600_xor_bytes_x4_native(
+    uint64_t *state, const unsigned char *data0, const unsigned char *data1,
+    const unsigned char *data2, const unsigned char *data3, unsigned offset,
+    unsigned length)
+__contract__(
+  requires(0 <= offset && offset <= 25 * sizeof(uint64_t) &&
+           0 <= length && length <= 25 * sizeof(uint64_t) - offset)
+  requires(memory_no_alias(state, sizeof(uint64_t) * 25 * 4))
+  requires(memory_no_alias(data0, length))
+  requires((data0 == data1 &&
+            data0 == data2 &&
+            data0 == data3) ||
+           (memory_no_alias(data1, length) &&
+            memory_no_alias(data2, length) &&
+            memory_no_alias(data3, length)))
+  assigns(memory_slice(state, sizeof(uint64_t) * 25 * 4))
+  ensures(return_value == MLD_NATIVE_FUNC_FALLBACK || return_value == MLD_NATIVE_FUNC_SUCCESS)
+  ensures((return_value == MLD_NATIVE_FUNC_FALLBACK) ==> array_unchanged_u64(state, 25 * 4)));
+#endif /* MLD_USE_NATIVE_FIPS202_X4_XOR_BYTES */
+
+#if defined(MLD_USE_NATIVE_FIPS202_X4_EXTRACT_BYTES)
+MLD_MUST_CHECK_RETURN_VALUE
+static MLD_INLINE int mld_keccakf1600_extract_bytes_x4_native(
+    uint64_t *state, unsigned char *data0, unsigned char *data1,
+    unsigned char *data2, unsigned char *data3, unsigned offset,
+    unsigned length)
+__contract__(
+  requires(0 <= offset && offset <= 25 * sizeof(uint64_t) &&
+           0 <= length && length <= 25 * sizeof(uint64_t) - offset)
+  requires(memory_no_alias(state, sizeof(uint64_t) * 25 * 4))
+  requires(memory_no_alias(data0, length))
+  requires(memory_no_alias(data1, length))
+  requires(memory_no_alias(data2, length))
+  requires(memory_no_alias(data3, length))
+  assigns(memory_slice(data0, length))
+  assigns(memory_slice(data1, length))
+  assigns(memory_slice(data2, length))
+  assigns(memory_slice(data3, length))
+  ensures(return_value == MLD_NATIVE_FUNC_FALLBACK || return_value == MLD_NATIVE_FUNC_SUCCESS));
+#endif /* MLD_USE_NATIVE_FIPS202_X4_EXTRACT_BYTES */
+
+#endif /* !MLD_FIPS202_NATIVE_API_H */

data/ext/mldsa_gh_native/vendor/mldsa-native/mldsa/src/fips202/native/armv81m/README.md

@@ -0,0 +1,10 @@
+[//]: # (SPDX-License-Identifier: CC-BY-4.0)
+
+# FIPS202 backend for Armv8.1-M + MVE
+
+This directory contains the source code for a FIPS202 backend targeting
+the Armv8.1-M + MVE/Helium architecture. It is automatically derived from
+the respective development source in [dev/fips202/armv81m](../../../../../dev/fips202/armv81m).
+
+**Warning:** This backend is still in active development and has not yet undergone
+the same level of review as the rest of the code. Use at your own risk!

data/ext/mldsa_gh_native/vendor/mldsa-native/mldsa/src/fips202/native/armv81m/mve.h

@@ -0,0 +1,67 @@
+/*
+ * Copyright (c) The mlkem-native project authors
+ * Copyright (c) The mldsa-native project authors
+ * SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT
+ */
+
+#ifndef MLD_FIPS202_NATIVE_ARMV81M_MVE_H
+#define MLD_FIPS202_NATIVE_ARMV81M_MVE_H
+
+#define MLD_FIPS202_NATIVE_ARMV81M
+
+/* Part of backend API */
+#define MLD_USE_NATIVE_FIPS202_X4
+#define MLD_USE_NATIVE_FIPS202_X4_XOR_BYTES
+#define MLD_USE_NATIVE_FIPS202_X4_EXTRACT_BYTES
+/* Guard for assembly file */
+#define MLD_FIPS202_ARMV81M_NEED_X4
+
+#if !defined(__ASSEMBLER__)
+#include "../api.h"
+#include "src/fips202_native_armv81m.h"
+
+/*
+ * Native x4 permutation
+ * State is kept in bit-interleaved format.
+ */
+#define mld_keccak_f1600_x4_native_impl \
+  MLD_NAMESPACE(keccak_f1600_x4_native_impl)
+MLD_INTERNAL_API
+int mld_keccak_f1600_x4_native_impl(uint64_t *state);
+
+MLD_MUST_CHECK_RETURN_VALUE
+static MLD_INLINE int mld_keccak_f1600_x4_native(uint64_t *state)
+{
+  return mld_keccak_f1600_x4_native_impl(state);
+}
+
+/*
+ * Native x4 XOR bytes (with on-the-fly bit interleaving)
+ */
+MLD_MUST_CHECK_RETURN_VALUE
+static MLD_INLINE int mld_keccakf1600_xor_bytes_x4_native(
+    uint64_t *state, const uint8_t *data0, const uint8_t *data1,
+    const uint8_t *data2, const uint8_t *data3, unsigned offset,
+    unsigned length)
+{
+  mld_keccak_f1600_x4_state_xor_bytes_asm(state, data0, data1, data2, data3,
+                                          offset, length);
+  return MLD_NATIVE_FUNC_SUCCESS;
+}
+
+/*
+ * Native x4 extract bytes (with on-the-fly bit de-interleaving)
+ */
+MLD_MUST_CHECK_RETURN_VALUE
+static MLD_INLINE int mld_keccakf1600_extract_bytes_x4_native(
+    uint64_t *state, uint8_t *data0, uint8_t *data1, uint8_t *data2,
+    uint8_t *data3, unsigned offset, unsigned length)
+{
+  mld_keccak_f1600_x4_state_extract_bytes_asm(state, data0, data1, data2, data3,
+                                              offset, length);
+  return MLD_NATIVE_FUNC_SUCCESS;
+}
+
+#endif /* !__ASSEMBLER__ */
+
+#endif /* !MLD_FIPS202_NATIVE_ARMV81M_MVE_H */

data/ext/mldsa_gh_native/vendor/mldsa-native/mldsa/src/fips202/native/armv81m/src/fips202_native_armv81m.h

@@ -0,0 +1,37 @@
+/*
+ * Copyright (c) The mlkem-native project authors
+ * Copyright (c) The mldsa-native project authors
+ * SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT
+ */
+#ifndef MLD_FIPS202_NATIVE_ARMV81M_SRC_FIPS202_NATIVE_ARMV81M_H
+#define MLD_FIPS202_NATIVE_ARMV81M_SRC_FIPS202_NATIVE_ARMV81M_H
+
+#include "../../../../common.h"
+
+/* Keccak round constants in bit-interleaved form */
+#define mld_keccakf1600_round_constants \
+  MLD_NAMESPACE(keccakf1600_round_constants)
+MLD_INTERNAL_DATA_DECLARATION const uint32_t
+    mld_keccakf1600_round_constants[48];
+
+#define mld_keccak_f1600_x4_mve_asm MLD_NAMESPACE(keccak_f1600_x4_mve_asm)
+void mld_keccak_f1600_x4_mve_asm(uint64_t state[100], uint64_t tmpstate[100],
+                                 const uint32_t rc[48]);
+
+#define mld_keccak_f1600_x4_state_xor_bytes_asm \
+  MLD_NAMESPACE(keccak_f1600_x4_state_xor_bytes_asm)
+void mld_keccak_f1600_x4_state_xor_bytes_asm(void *state, const uint8_t *d0,
+                                             const uint8_t *d1,
+                                             const uint8_t *d2,
+                                             const uint8_t *d3, unsigned offset,
+                                             unsigned length);
+
+#define mld_keccak_f1600_x4_state_extract_bytes_asm \
+  MLD_NAMESPACE(keccak_f1600_x4_state_extract_bytes_asm)
+void mld_keccak_f1600_x4_state_extract_bytes_asm(void *state, uint8_t *data0,
+                                                 uint8_t *data1, uint8_t *data2,
+                                                 uint8_t *data3,
+                                                 unsigned offset,
+                                                 unsigned length);
+
+#endif /* !MLD_FIPS202_NATIVE_ARMV81M_SRC_FIPS202_NATIVE_ARMV81M_H */