pq_crypto 0.6.3 → 0.6.5

data/ext/pqcrypto/extconf.rb

@@ -3,6 +3,8 @@
 
 require "mkmf"
 require "rbconfig"
+require "rubygems/version"
+require "shellwords"
 require_relative "../../lib/pq_crypto/version"
 
 def generate_version_header!
@@ -27,7 +29,14 @@ generate_version_header!
 
 $CFLAGS << " -std=c11 -Wall -Wextra -O3"
 $CFLAGS << " -fstack-protector-strong -D_FORTIFY_SOURCE=2"
-$LDFLAGS << " -Wl,-no_warn_duplicate_libraries" if RbConfig::CONFIG["host_os"] =~ /darwin/
+if RbConfig::CONFIG["host_os"] =~ /darwin/
+  $DLDFLAGS = $DLDFLAGS.to_s
+    .gsub(/(?:\A|\s)-Wl,-multiply_defined,suppress(?=\s|\z)/, " ")
+    .gsub(/(?:\A|\s)-multiply_defined\s+suppress(?=\s|\z)/, " ")
+    .strip
+
+  $LDFLAGS << " -Wl,-no_warn_duplicate_libraries"
+end
 
 VENDOR_ONLY_CFLAGS = "-Wno-unused-parameter -Wno-unused-function -Wno-strict-prototypes -Wno-pedantic -Wno-c23-extensions -Wno-undef"
 
@@ -94,30 +103,245 @@ if ENV["PQCRYPTO_NATIVE_TUNE"] == "1"
   VENDOR_ASM_ARCH_FLAGS << " -march=native -mtune=native"
 end
 
+def openssl_library_dirs(prefix)
+  dirs = Dir.glob(File.join(prefix, "lib", "*-linux-gnu"))
+  dirs.concat([File.join(prefix, "lib64"), File.join(prefix, "lib")])
+  dirs.select { |dir| File.directory?(dir) }.uniq
+end
+
+def openssl_library_file(dir, name)
+  candidates = [
+    File.join(dir, "lib#{name}.so.3"),
+    *Dir.glob(File.join(dir, "lib#{name}.so.3.*")).sort,
+    File.join(dir, "lib#{name}.so"),
+    File.join(dir, "lib#{name}.3.dylib"),
+    *Dir.glob(File.join(dir, "lib#{name}.3.*.dylib")).sort,
+    File.join(dir, "lib#{name}.dylib"),
+    File.join(dir, "lib#{name}.a"),
+    File.join(dir, "lib#{name}.dll.a"),
+    File.join(dir, "#{name}.lib")
+  ]
+
+  path = candidates.find { |candidate| File.file?(candidate) }
+  path && File.realpath(path)
+rescue Errno::ENOENT
+  nil
+end
+
+def openssl_library_present?(dir, name)
+  !openssl_library_file(dir, name).nil?
+end
+
+def openssl_prefix_usable?(prefix)
+  return false if prefix.nil?
+
+  prefix = prefix.strip
+  return false if prefix.empty?
+  return false unless File.exist?(File.join(prefix, "include", "openssl", "opensslv.h"))
+
+  openssl_library_dirs(prefix).any? do |dir|
+    openssl_library_present?(dir, "crypto")
+  end
+end
+
+def explicit_openssl_prefix
+  %w[OPENSSL_ROOT_DIR OPENSSL_DIR].each do |var|
+    value = ENV[var]
+    next if value.nil? || value.strip.empty?
+
+    prefix = File.expand_path(value.strip)
+    abort <<~MSG unless openssl_prefix_usable?(prefix)
+      #{var}=#{value.inspect} does not point to a complete OpenSSL installation.
+
+      Expected OpenSSL headers under:
+        #{File.join(prefix, "include", "openssl")}
+
+      And libcrypto under lib, lib64, or a Linux multiarch lib directory.
+    MSG
+
+    return prefix
+  end
+
+  nil
+end
+
+def resolve_openssl_prefix
+  explicit = explicit_openssl_prefix
+  return explicit if explicit
+
+  candidates = []
+  if find_executable("brew")
+    %w[openssl@3 openssl].each do |formula|
+      prefix = `brew --prefix #{formula} 2>/dev/null`.strip
+      candidates << prefix unless prefix.empty?
+    end
+  end
+  candidates.concat(["/opt/homebrew/opt/openssl@3", "/usr/local/opt/openssl@3"])
+  candidates.uniq.find { |prefix| openssl_prefix_usable?(prefix) }
+end
+
+def pkg_config_value(variable)
+  value = `pkg-config --variable=#{variable} openssl 2>/dev/null`.strip
+  return nil unless $?.success?
+  return nil if value.empty?
+
+  File.expand_path(value)
+end
+
+def openssl_pkg_config
+  return nil unless find_executable("pkg-config")
+
+  version = `pkg-config --modversion openssl 2>/dev/null`.strip
+  return nil unless $?.success?
+  return nil if version.empty?
+  return { version: version } unless openssl_version_at_least_3?(version)
+
+  incdir = pkg_config_value("includedir")
+  libdir = pkg_config_value("libdir")
+  return { version: version } unless incdir && libdir
+  return { version: version } unless File.exist?(File.join(incdir, "openssl", "opensslv.h"))
+  crypto_lib = openssl_library_file(libdir, "crypto")
+  return { version: version } unless crypto_lib
+
+  { version: version, incdir: incdir, libdir: libdir, crypto_lib: crypto_lib }
+end
+
+def openssl_version_at_least_3?(version)
+  Gem::Version.new(version) >= Gem::Version.new("3.0.0")
+rescue ArgumentError
+  false
+end
+
+def normalize_existing_path(path)
+  File.realpath(path)
+rescue Errno::ENOENT
+  File.expand_path(path)
+end
+
+def include_paths_from_flags(flags)
+  tokens = Shellwords.split(flags.to_s)
+  paths = []
+  index = 0
+
+  while index < tokens.length
+    token = tokens[index]
+
+    case token
+    when "-I", "-isystem"
+      paths << tokens[index + 1] if tokens[index + 1]
+      index += 2
+      next
+    when /\A-I(.+)\z/
+      paths << Regexp.last_match(1)
+    when /\A-isystem(.+)\z/
+      paths << Regexp.last_match(1)
+    end
+
+    index += 1
+  end
+
+  paths
+rescue ArgumentError
+  []
+end
+
+def strip_include_path(flags, path)
+  escaped = Regexp.escape(path)
+
+  flags.to_s
+    .gsub(/(?:\A|\s)-I\s*#{escaped}(?=\s|\z)/, " ")
+    .gsub(/(?:\A|\s)-isystem\s*#{escaped}(?=\s|\z)/, " ")
+    .strip
+end
+
+def remove_competing_openssl_headers!(selected_incdir)
+  selected = normalize_existing_path(selected_incdir)
+  flag_values = [$INCFLAGS, $CPPFLAGS, $CFLAGS]
+
+  competing = flag_values
+    .flat_map { |flags| include_paths_from_flags(flags) }.uniq.select do |path|
+      next false unless File.file?(File.join(path, "openssl", "opensslv.h"))
+
+      normalize_existing_path(path) != selected
+    end
+
+  competing.each do |path|
+    $INCFLAGS = strip_include_path($INCFLAGS, path)
+    $CPPFLAGS = strip_include_path($CPPFLAGS, path)
+    $CFLAGS = strip_include_path($CFLAGS, path)
+    puts "Ignoring competing OpenSSL headers: #{path}"
+  end
+end
+
+def configure_openssl_paths(incdir, libdir, crypto_lib:)
+  if defined?($configure_args) && $configure_args
+    $configure_args["--with-openssl-dir"] = File.dirname(incdir)
+    $configure_args["--with-openssl-include"] = incdir
+    $configure_args["--with-openssl-lib"] = libdir
+  end
+
+  remove_competing_openssl_headers!(incdir)
+
+  $INCFLAGS = "-I#{incdir} #{$INCFLAGS}".strip
+  $CPPFLAGS = "-I#{incdir} #{$CPPFLAGS}".strip
+  $LIBPATH.unshift(libdir) unless $LIBPATH.include?(libdir)
+
+  selected_libs = [crypto_lib].map { |path| Shellwords.escape(path) }.join(" ")
+  $LOCAL_LIBS = "#{selected_libs} #{$LOCAL_LIBS}".strip
+
+  unless host_os =~ /mswin|mingw|cygwin/i || libdir.start_with?("/usr/lib")
+    $LDFLAGS = "-Wl,-rpath,#{Shellwords.escape(libdir)} #{$LDFLAGS}".strip
+  end
+end
+
+def configure_openssl_prefix(prefix, source:)
+  incdir = File.join(prefix, "include")
+  libdir = openssl_library_dirs(prefix).find do |dir|
+    openssl_library_present?(dir, "crypto")
+  end
+  crypto_lib = openssl_library_file(libdir, "crypto")
+
+  configure_openssl_paths(incdir, libdir, crypto_lib: crypto_lib)
+  puts "OpenSSL #{source}: #{prefix}"
+  puts "OpenSSL include dir: #{incdir}"
+  puts "OpenSSL library dir: #{libdir}"
+  puts "OpenSSL libcrypto: #{crypto_lib}"
+end
+
 def configure_compiler_environment
-  if RUBY_PLATFORM.include?("darwin")
-    dir_config("homebrew", "/opt/homebrew")
-    $CPPFLAGS << " -I/opt/homebrew/include"
-    $LDFLAGS << " -L/opt/homebrew/lib"
+  prefix = resolve_openssl_prefix
+  if prefix
+    configure_openssl_prefix(prefix, source: "prefix")
     return
   end
 
-  openssl_root = ENV["OPENSSL_ROOT_DIR"] || ENV["OPENSSL_DIR"]
-  if openssl_root && !openssl_root.strip.empty? && File.directory?(openssl_root)
-    $CPPFLAGS << " -I#{openssl_root}/include"
-    %w[lib64 lib].each do |suffix|
-      libdir = File.join(openssl_root, suffix)
-      next unless File.directory?(libdir)
+  pkg = openssl_pkg_config
+  if pkg && pkg[:incdir] && pkg[:libdir]
+    configure_openssl_paths(pkg[:incdir], pkg[:libdir], crypto_lib: pkg[:crypto_lib])
+    puts "OpenSSL pkg-config: #{pkg[:version]}"
+    puts "OpenSSL include dir: #{pkg[:incdir]}"
+    puts "OpenSSL library dir: #{pkg[:libdir]}"
+    puts "OpenSSL libcrypto: #{pkg[:crypto_lib]}"
+    return
+  end
 
-      $LDFLAGS << " -L#{libdir} -Wl,-rpath,#{libdir}"
-      break
+  if pkg && pkg[:version]
+    if openssl_version_at_least_3?(pkg[:version])
+      puts "Ignoring incomplete pkg-config OpenSSL #{pkg[:version]}; headers or libraries were not found"
+    else
+      puts "Ignoring pkg-config OpenSSL #{pkg[:version]}; OpenSSL 3.0 or later is required"
     end
-  elsif find_executable("pkg-config")
-    cflags = `pkg-config --cflags openssl 2>/dev/null`.strip
-    libs = `pkg-config --libs-only-L openssl 2>/dev/null`.strip
-    $CPPFLAGS << " #{cflags}" unless cflags.empty?
-    $LDFLAGS << " #{libs}" unless libs.empty?
+  else
+    puts "OpenSSL pkg-config: unavailable"
   end
+
+  conventional = ["/usr/local", "/usr"].find { |candidate| openssl_prefix_usable?(candidate) }
+  if conventional
+    configure_openssl_prefix(conventional, source: "system prefix")
+    return
+  end
+
+  puts "OpenSSL prefix: (none resolved; using compiler defaults)"
 end
 
 def native_vendor_sources_for(vendor_dir)
@@ -196,8 +420,6 @@ end
 def configure_openssl!
   configure_compiler_environment
 
-  abort "OpenSSL libcrypto is required" unless have_library("crypto")
-  abort "OpenSSL libssl is required" unless have_library("ssl")
   abort "openssl/evp.h is required" unless have_header("openssl/evp.h")
   abort "openssl/rand.h is required" unless have_header("openssl/rand.h")
   abort "openssl/crypto.h is required" unless have_header("openssl/crypto.h")
@@ -205,13 +427,31 @@ def configure_openssl!
   abort "openssl/pkcs12.h is required" unless have_header("openssl/pkcs12.h")
 
   version_check = <<~SRC
+    #include <openssl/crypto.h>
     #include <openssl/opensslv.h>
     #if OPENSSL_VERSION_NUMBER < 0x30000000L
     #error "OpenSSL 3.0 or later is required"
     #endif
-    int main(void) { return 0; }
+    int main(void) {
+        return (int)OPENSSL_version_major();
+    }
   SRC
-  abort "OpenSSL 3.0 or later is required" unless try_compile(version_check)
+  abort <<~MSG unless try_link(version_check)
+    OpenSSL 3.0 or later is required, but the compiler and linker did not find
+    a consistent OpenSSL 3 headers + libcrypto pair. See mkmf.log for the exact
+    include paths, library paths, and linker error.
+
+    macOS with Homebrew:
+      brew install openssl@3
+      OPENSSL_ROOT_DIR="$(brew --prefix openssl@3)" bundle exec rake clean compile
+
+    Debian/Ubuntu:
+      sudo apt-get install libssl-dev pkg-config
+      pkg-config --modversion openssl   # must report 3.x
+
+    If an old Ruby toolchain injects OpenSSL 1.1 through CPPFLAGS or
+    PKG_CONFIG_PATH, inspect mkmf.log and point the build at OpenSSL 3.
+  MSG
 
   sha3_check = <<~SRC
     #include <openssl/evp.h>
@@ -220,7 +460,7 @@ def configure_openssl!
         return md == NULL ? 1 : 0;
     }
   SRC
-  abort "OpenSSL SHA3-256 is required (X-Wing combiner)" unless try_compile(sha3_check)
+  abort "OpenSSL SHA3-256 is required (X-Wing combiner)" unless try_link(sha3_check)
 
   shake_check = <<~SRC
     #include <openssl/evp.h>
@@ -229,7 +469,7 @@ def configure_openssl!
         return md == NULL ? 1 : 0;
     }
   SRC
-  abort "OpenSSL SHAKE256 is required (X-Wing key expansion / ML-DSA streaming mu)" unless try_compile(shake_check)
+  abort "OpenSSL SHAKE256 is required (X-Wing key expansion / ML-DSA streaming mu)" unless try_link(shake_check)
 
   $CFLAGS << " -DHAVE_OPENSSL_EVP_H -DHAVE_OPENSSL_RAND_H"
 end

data/ext/pqcrypto/pqcrypto_version.h

@@ -2,6 +2,6 @@
 #ifndef PQCRYPTO_VERSION_H
 #define PQCRYPTO_VERSION_H
 
-#define PQCRYPTO_VERSION "0.6.3"
+#define PQCRYPTO_VERSION "0.6.5"
 
 #endif

data/ext/pqcrypto/vendor/.vendored

@@ -2,11 +2,11 @@
 backend=PQ Code Package native only
 pqclean=removed
 mlkem_native_repo=https://github.com/pq-code-package/mlkem-native.git
-mlkem_native_ref=v1.2.0
-mlkem_native_commit=0ba906cb14b1c241476134d7403a811b382ca498
-mlkem_native_tree_sha256=cc78ed199b8c65abe68635b23a13b294d5a8deb20c8bc7b4d76590c00976bb2d
+mlkem_native_ref=v1.3.0
+mlkem_native_commit=398050c877ff4353c96305c6434b63528accfc37
+mlkem_native_tree_sha256=3cd7af93cde256f73ce5ffde3ac3accd31e4361616e275f1bf1c39d462c2149e
 mldsa_native_repo=https://github.com/pq-code-package/mldsa-native.git
 mldsa_native_ref=v1.0.0-beta2
 mldsa_native_commit=9b0ee84f4cf399043eca59eca4e5f8531ca1d61b
 mldsa_native_tree_sha256=2887f59926c18a877e8c5a5e30727e84497c357032093d00d7135aedf53f011e
-manifest_sha256=011e9d7d1160c7d612869695d950e17f9e330dac6bf782883639593f96fee951
+manifest_sha256=6fc387662d86d42905f6cbed29c92bc83abf18e8678a21500eb27fce14a89c7d

data/ext/pqcrypto/vendor/mlkem-native/README.md

@@ -2,9 +2,7 @@
 
 # mlkem-native
 
-![Base tests](https://github.com/pq-code-package/mlkem-native/actions/workflows/base.yml/badge.svg)
-![Extended tests](https://github.com/pq-code-package/mlkem-native/actions/workflows/ci.yml/badge.svg)
-![Proof: CBMC](https://github.com/pq-code-package/mlkem-native/actions/workflows/cbmc.yml/badge.svg)
+![CI](https://github.com/pq-code-package/mlkem-native/actions/workflows/all.yml/badge.svg)
 ![Proof: HOL-Light](https://github.com/pq-code-package/mlkem-native/actions/workflows/hol_light.yml/badge.svg)
 ![Benchmarks](https://github.com/pq-code-package/mlkem-native/actions/workflows/bench.yml/badge.svg)
 ![C90](https://img.shields.io/badge/language-C90-blue.svg)
@@ -102,7 +100,7 @@ mlkem-native currently offers the following backends:
 If you'd like contribute new backends, please reach out or just open a PR.
 
 Our AArch64 assembly is developed using the [SLOTHY](https://github.com/slothy-optimizer/slothy) superoptimizer, following the approach described in the SLOTHY paper[^SLOTHY_Paper]:
-We write 'clean' assembly by hand and automate micro-optimizations (e.g. see the [clean](dev/aarch64_clean/src/ntt_aarch64_asm.S) vs [optimized](dev/aarch64_opt/src/ntt_aarch64_asm.S) AArch64 NTT).
+We write 'clean' assembly by hand and automate micro-optimizations (e.g. see the [clean](dev/aarch64_clean/src/mlkem_ntt_aarch64_asm.S) vs [optimized](dev/aarch64_opt/src/mlkem_ntt_aarch64_asm.S) AArch64 NTT).
 See [dev/README.md](dev/README.md) for more details.
 
 ## Test Vectors

data/ext/pqcrypto/vendor/mlkem-native/RELEASE.md

@@ -1,5 +1,103 @@
 [//]: # (SPDX-License-Identifier: CC-BY-4.0)
 
+mlkem-native v1.3.0
+===================
+
+Release notes
+-------------
+
+mlkem-native v1.3.0 adds configuration options to control which KEM operations
+are included in a build. It also improves AArch64 feature detection and runtime
+dispatch, and introduces ABI compliance checks for assembly backends. Embedded
+testing now uses Zephyr across a broader range of Arm targets, while assembly
+namespacing and source naming improve integration with projects such as AWS-LC.
+
+See the full change log here:
+https://github.com/pq-code-package/mlkem-native/compare/v1.2.0...v1.3.0
+
+What's next? mlkem-native v2
+----------------------------
+
+This is expected to be the last release prior to mlkem-native v2. Between
+v1.3.0 and v2, breaking changes to the `main` branch will be made.
+
+Long-Term Support
+-----------------
+
+`release/v1.3` will act as a support branch until 6 months after
+mlkem-native v2 is established. It will receive bugfixes, but no new features.
+We do currently not plan to offer long-term support for mlkem-native v1.x
+beyond that timeframe.
+
+If you are deploying mlkem-native v1.3 and expect to be unable to upgrade to
+mlkem-native v2 within 6 months of its release, please contact us to discuss
+a potential extension of the support schedule.
+
+What's New
+----------
+
+### Configuration / API
+
+- Add `MLK_CONFIG_NO_KEYPAIR_API`, `MLK_CONFIG_NO_ENCAPS_API`, and
+  `MLK_CONFIG_NO_DECAPS_API`, allowing unused KEM operations and their internal
+  dependencies to be excluded. All non-empty API combinations are covered in
+  CI. ([#1787](https://github.com/pq-code-package/mlkem-native/pull/1787))
+- Gate the AArch64 arithmetic and FIPS-202 backends on compile-time NEON
+  availability and the new `MLK_SYS_CAP_NEON` runtime capability. Integrators
+  can now fall back to portable C on AArch64 systems without usable NEON.
+  ([#1805](https://github.com/pq-code-package/mlkem-native/pull/1805),
+  [#1809](https://github.com/pq-code-package/mlkem-native/pull/1809))
+- Add `MLK_SYS_AARCH64_FAST_SHA3` to select the pure-Neon Armv8.4-A SHA3
+  implementation on CPUs with sufficient SHA3 execution capacity, including
+  Graviton5. ([#1784](https://github.com/pq-code-package/mlkem-native/pull/1784))
+
+### Assurance / Testing
+
+- Fix deterministic-only builds using `MLK_CONFIG_NO_RANDOMIZED_API`, including
+  test, example, and stack-measurement coverage.
+  ([#1816](https://github.com/pq-code-package/mlkem-native/pull/1816))
+- Upgrade CBMC to v6.10.0, the newest release of CBMC including the fix
+  [cbmc/#9011](https://github.com/diffblue/cbmc/pull/9011) to the Z3 soundness
+  issue [z3/#9550](https://github.com/Z3Prover/z3/issues/9550). mlkem-native v1.2
+  had pinned CBMC to an unstable version between v6.9 and v6.10 which already
+  included that fix.
+  ([#1762](https://github.com/pq-code-package/mlkem-native/pull/1762))
+- Add assembly ABI checkers for AArch64, x86_64 SysV, ppc64le ELFv2, and
+  Armv8.1-M MVE. The checkers verify preservation of callee-saved registers and
+  run as part of the standard test suite.
+  ([#1135](https://github.com/pq-code-package/mlkem-native/pull/1135))
+- Add Zephyr-based testing for QEMU Cortex-M3, M4, M7, M33, and M55 targets,
+  replacing the previous custom MPS baremetal platforms. Add test and benchmark
+  support for the NUCLEO-N657X0-Q board.
+  ([#1750](https://github.com/pq-code-package/mlkem-native/pull/1750),
+  [#1547](https://github.com/pq-code-package/mlkem-native/pull/1547))
+- Strengthen HOL Light tooling with cross-architecture proof execution and
+  checks that every expected theorem is present
+  ([#1634](https://github.com/pq-code-package/mlkem-native/pull/1634))
+- Strengthen Wycheproof validation by checking newly specified fields, rejecting
+  unknown schema fields, and tracking upstream vector changes.
+  ([#1801](https://github.com/pq-code-package/mlkem-native/pull/1801))
+- Extend Windows MSVC coverage to allocation-failure, RNG-failure, and
+  Wycheproof tests ([#1738](https://github.com/pq-code-package/mlkem-native/pull/1738))
+- Add emulated testing on x86_64 without AVX2.
+  ([#1753](https://github.com/pq-code-package/mlkem-native/pull/1753))
+- Correct decapsulation stack measurements, which previously returned before
+  the full operation and understated peak stack use by around 10%.
+  ([#1823](https://github.com/pq-code-package/mlkem-native/pull/1823))
+
+### Integration / Upgrade Notes
+
+- Namespace assembly-local labels with an `mlk_` prefix, preventing collisions
+  when mlkem-native and other projects are combined into one assembly unit.
+  ([#1813](https://github.com/pq-code-package/mlkem-native/pull/1813))
+- Rename backend assembly files to be self-identifying. Arithmetic assembly
+  filenames now use an `mlkem_` prefix. Downstream build systems with explicit
+  source lists must update those paths.
+  ([#1821](https://github.com/pq-code-package/mlkem-native/pull/1821))
+- Move context-parameter support into the new `mlkem/src/context.h`; downstream
+  source manifests must include this file.
+  ([#1768](https://github.com/pq-code-package/mlkem-native/pull/1768))
+
 mlkem-native v1.2.0
 ===================
 

data/ext/pqcrypto/vendor/mlkem-native/mlkem/mlkem_native.c

@@ -202,11 +202,6 @@
 #undef MLK_COMMON_H
 #undef MLK_CONCAT
 #undef MLK_CONCAT_
-#undef MLK_CONTEXT_PARAMETERS_0
-#undef MLK_CONTEXT_PARAMETERS_1
-#undef MLK_CONTEXT_PARAMETERS_2
-#undef MLK_CONTEXT_PARAMETERS_3
-#undef MLK_CONTEXT_PARAMETERS_4
 #undef MLK_EMPTY_CU
 #undef MLK_ERR_FAIL
 #undef MLK_ERR_OUT_OF_MEMORY
@@ -311,6 +306,13 @@
 #undef mlk_poly_frommsg
 #undef mlk_poly_tobytes
 #undef mlk_poly_tomsg
+/* mlkem/src/context.h */
+#undef MLK_CONTEXT_H
+#undef MLK_CONTEXT_PARAMETERS_0
+#undef MLK_CONTEXT_PARAMETERS_1
+#undef MLK_CONTEXT_PARAMETERS_2
+#undef MLK_CONTEXT_PARAMETERS_3
+#undef MLK_CONTEXT_PARAMETERS_4
 /* mlkem/src/debug.h */
 #undef MLK_DEBUG_H
 #undef mlk_assert
@@ -377,6 +379,7 @@
 #undef MLK_SYSV_ABI_SUPPORTED
 #undef MLK_SYS_AARCH64
 #undef MLK_SYS_AARCH64_EB
+#undef MLK_SYS_AARCH64_NEON
 #undef MLK_SYS_APPLE
 #undef MLK_SYS_ARMV81M_MVE
 #undef MLK_SYS_BIG_ENDIAN
@@ -508,8 +511,6 @@
 #undef MLK_USE_FIPS202_X4_NATIVE
 #undef MLK_USE_FIPS202_X4_XOR_BYTES_NATIVE
 #undef mlk_keccak_f1600_x4_native_impl
-#undef mlk_keccak_f1600_x4_state_extract_bytes
-#undef mlk_keccak_f1600_x4_state_xor_bytes
 /* mlkem/src/fips202/native/armv81m/src/fips202_native_armv81m.h */
 #undef MLK_FIPS202_NATIVE_ARMV81M_SRC_FIPS202_NATIVE_ARMV81M_H
 #undef mlk_keccak_f1600_x4_mve_asm

data/ext/pqcrypto/vendor/mlkem-native/mlkem/mlkem_native.h

@@ -191,6 +191,7 @@ extern "C"
 {
 #endif
 
+#if !defined(MLK_CONFIG_NO_KEYPAIR_API)
 /**
  * Generate a public/private keypair for the ML-KEM key encapsulation mechanism.
  *
@@ -255,7 +256,9 @@ int MLK_API_NAMESPACE(keypair)(
 #endif
 );
 #endif /* !MLK_CONFIG_NO_RANDOMIZED_API */
+#endif /* !MLK_CONFIG_NO_KEYPAIR_API */
 
+#if !defined(MLK_CONFIG_NO_ENCAPS_API)
 /**
  * Generate ciphertext and shared secret for a given public key.
  *
@@ -324,7 +327,9 @@ int MLK_API_NAMESPACE(enc)(
 #endif
 );
 #endif /* !MLK_CONFIG_NO_RANDOMIZED_API */
+#endif /* !MLK_CONFIG_NO_ENCAPS_API */
 
+#if !defined(MLK_CONFIG_NO_DECAPS_API)
 /**
  * Generate shared secret for a given ciphertext and private key.
  *
@@ -356,6 +361,7 @@ int MLK_API_NAMESPACE(dec)(
     MLK_CONFIG_CONTEXT_PARAMETER_TYPE context
 #endif
 );
+#endif /* !MLK_CONFIG_NO_DECAPS_API */
 
 
 /**
@@ -375,6 +381,7 @@ int MLK_API_NAMESPACE(dec)(
  * @retval MLK_ERR_OUT_OF_MEMORY MLK_CONFIG_CUSTOM_ALLOC_FREE was used and
  *                               MLK_CUSTOM_ALLOC returned NULL.
  */
+#if !defined(MLK_CONFIG_NO_ENCAPS_API)
 MLK_API_QUALIFIER
 MLK_API_MUST_CHECK_RETURN_VALUE
 int MLK_API_NAMESPACE(check_pk)(
@@ -384,6 +391,7 @@ int MLK_API_NAMESPACE(check_pk)(
     MLK_CONFIG_CONTEXT_PARAMETER_TYPE context
 #endif
 );
+#endif /* !MLK_CONFIG_NO_ENCAPS_API */
 
 /**
  * Implements public key hash check mandated by FIPS 203, i.e., ensures that
@@ -402,6 +410,7 @@ int MLK_API_NAMESPACE(check_pk)(
  * @retval MLK_ERR_OUT_OF_MEMORY MLK_CONFIG_CUSTOM_ALLOC_FREE was used and
  *                               MLK_CUSTOM_ALLOC returned NULL.
  */
+#if !defined(MLK_CONFIG_NO_DECAPS_API)
 MLK_API_QUALIFIER
 MLK_API_MUST_CHECK_RETURN_VALUE
 int MLK_API_NAMESPACE(check_sk)(
@@ -411,6 +420,7 @@ int MLK_API_NAMESPACE(check_sk)(
     MLK_CONFIG_CONTEXT_PARAMETER_TYPE context
 #endif
 );
+#endif /* !MLK_CONFIG_NO_DECAPS_API */
 
 #ifdef __cplusplus
 }
@@ -427,13 +437,23 @@ int MLK_API_NAMESPACE(check_sk)(
 #define CRYPTO_SYMBYTES MLKEM_SYMBYTES
 #define CRYPTO_BYTES MLKEM_BYTES
 
+#if !defined(MLK_CONFIG_NO_KEYPAIR_API)
 #define crypto_kem_keypair_derand MLK_API_NAMESPACE(keypair_derand)
+#if !defined(MLK_CONFIG_NO_RANDOMIZED_API)
 #define crypto_kem_keypair MLK_API_NAMESPACE(keypair)
+#endif
+#endif /* !MLK_CONFIG_NO_KEYPAIR_API */
+#if !defined(MLK_CONFIG_NO_ENCAPS_API)
 #define crypto_kem_enc_derand MLK_API_NAMESPACE(enc_derand)
+#if !defined(MLK_CONFIG_NO_RANDOMIZED_API)
 #define crypto_kem_enc MLK_API_NAMESPACE(enc)
-#define crypto_kem_dec MLK_API_NAMESPACE(dec)
+#endif
 #define crypto_kem_check_pk MLK_API_NAMESPACE(check_pk)
+#endif /* !MLK_CONFIG_NO_ENCAPS_API */
+#if !defined(MLK_CONFIG_NO_DECAPS_API)
+#define crypto_kem_dec MLK_API_NAMESPACE(dec)
 #define crypto_kem_check_sk MLK_API_NAMESPACE(check_sk)
+#endif
 
 #else /* !MLK_CONFIG_API_NO_SUPERCOP */