pq_crypto 0.6.3 → 0.6.5

data/ext/pqcrypto/vendor/mlkem-native/mlkem/mlkem_native_asm.S

@@ -22,7 +22,7 @@
  * levels, you should include this file once with
  * MLK_CONFIG_MULTILEVEL_WITH_SHARED set.
  *
- * (You could also follow the same pattern as for mlkem_native_monobuild.c
+ * (You could also follow the same pattern as for mlkem_native.c
  *  and include it for every level, setting MLK_CONFIG_MULTILEVEL_NO_SHARED
  *  for all but one. For builds with MLK_CONFIG_MULTILEVEL_NO_SHARED, this
  *  file will then be ignored.)
@@ -60,46 +60,46 @@
 
 #if defined(MLK_CONFIG_USE_NATIVE_BACKEND_ARITH)
 #if defined(MLK_SYS_AARCH64)
-#include "src/native/aarch64/src/intt_aarch64_asm.S"
-#include "src/native/aarch64/src/ntt_aarch64_asm.S"
-#include "src/native/aarch64/src/poly_mulcache_compute_aarch64_asm.S"
-#include "src/native/aarch64/src/poly_reduce_aarch64_asm.S"
-#include "src/native/aarch64/src/poly_tobytes_aarch64_asm.S"
-#include "src/native/aarch64/src/poly_tomont_aarch64_asm.S"
-#include "src/native/aarch64/src/polyvec_basemul_acc_montgomery_cached_k2_aarch64_asm.S"
-#include "src/native/aarch64/src/polyvec_basemul_acc_montgomery_cached_k3_aarch64_asm.S"
-#include "src/native/aarch64/src/polyvec_basemul_acc_montgomery_cached_k4_aarch64_asm.S"
-#include "src/native/aarch64/src/rej_uniform_aarch64_asm.S"
+#include "src/native/aarch64/src/mlkem_intt_aarch64_asm.S"
+#include "src/native/aarch64/src/mlkem_ntt_aarch64_asm.S"
+#include "src/native/aarch64/src/mlkem_poly_mulcache_compute_aarch64_asm.S"
+#include "src/native/aarch64/src/mlkem_poly_reduce_aarch64_asm.S"
+#include "src/native/aarch64/src/mlkem_poly_tobytes_aarch64_asm.S"
+#include "src/native/aarch64/src/mlkem_poly_tomont_aarch64_asm.S"
+#include "src/native/aarch64/src/mlkem_polyvec_basemul_acc_montgomery_cached_k2_aarch64_asm.S"
+#include "src/native/aarch64/src/mlkem_polyvec_basemul_acc_montgomery_cached_k3_aarch64_asm.S"
+#include "src/native/aarch64/src/mlkem_polyvec_basemul_acc_montgomery_cached_k4_aarch64_asm.S"
+#include "src/native/aarch64/src/mlkem_rej_uniform_aarch64_asm.S"
 #endif /* MLK_SYS_AARCH64 */
 #if defined(MLK_SYS_X86_64)
-#include "src/native/x86_64/src/intt_avx2_asm.S"
-#include "src/native/x86_64/src/ntt_avx2_asm.S"
-#include "src/native/x86_64/src/nttfrombytes_avx2_asm.S"
-#include "src/native/x86_64/src/ntttobytes_avx2_asm.S"
-#include "src/native/x86_64/src/nttunpack_avx2_asm.S"
-#include "src/native/x86_64/src/poly_compress_d10_avx2_asm.S"
-#include "src/native/x86_64/src/poly_compress_d11_avx2_asm.S"
-#include "src/native/x86_64/src/poly_compress_d4_avx2_asm.S"
-#include "src/native/x86_64/src/poly_compress_d5_avx2_asm.S"
-#include "src/native/x86_64/src/poly_decompress_d10_avx2_asm.S"
-#include "src/native/x86_64/src/poly_decompress_d11_avx2_asm.S"
-#include "src/native/x86_64/src/poly_decompress_d4_avx2_asm.S"
-#include "src/native/x86_64/src/poly_decompress_d5_avx2_asm.S"
-#include "src/native/x86_64/src/poly_mulcache_compute_avx2_asm.S"
-#include "src/native/x86_64/src/polyvec_basemul_acc_montgomery_cached_k2_avx2_asm.S"
-#include "src/native/x86_64/src/polyvec_basemul_acc_montgomery_cached_k3_avx2_asm.S"
-#include "src/native/x86_64/src/polyvec_basemul_acc_montgomery_cached_k4_avx2_asm.S"
-#include "src/native/x86_64/src/reduce_avx2_asm.S"
-#include "src/native/x86_64/src/rej_uniform_avx2_asm.S"
-#include "src/native/x86_64/src/tomont_avx2_asm.S"
+#include "src/native/x86_64/src/mlkem_intt_avx2_asm.S"
+#include "src/native/x86_64/src/mlkem_ntt_avx2_asm.S"
+#include "src/native/x86_64/src/mlkem_nttfrombytes_avx2_asm.S"
+#include "src/native/x86_64/src/mlkem_ntttobytes_avx2_asm.S"
+#include "src/native/x86_64/src/mlkem_nttunpack_avx2_asm.S"
+#include "src/native/x86_64/src/mlkem_poly_compress_d10_avx2_asm.S"
+#include "src/native/x86_64/src/mlkem_poly_compress_d11_avx2_asm.S"
+#include "src/native/x86_64/src/mlkem_poly_compress_d4_avx2_asm.S"
+#include "src/native/x86_64/src/mlkem_poly_compress_d5_avx2_asm.S"
+#include "src/native/x86_64/src/mlkem_poly_decompress_d10_avx2_asm.S"
+#include "src/native/x86_64/src/mlkem_poly_decompress_d11_avx2_asm.S"
+#include "src/native/x86_64/src/mlkem_poly_decompress_d4_avx2_asm.S"
+#include "src/native/x86_64/src/mlkem_poly_decompress_d5_avx2_asm.S"
+#include "src/native/x86_64/src/mlkem_poly_mulcache_compute_avx2_asm.S"
+#include "src/native/x86_64/src/mlkem_polyvec_basemul_acc_montgomery_cached_k2_avx2_asm.S"
+#include "src/native/x86_64/src/mlkem_polyvec_basemul_acc_montgomery_cached_k3_avx2_asm.S"
+#include "src/native/x86_64/src/mlkem_polyvec_basemul_acc_montgomery_cached_k4_avx2_asm.S"
+#include "src/native/x86_64/src/mlkem_reduce_avx2_asm.S"
+#include "src/native/x86_64/src/mlkem_rej_uniform_avx2_asm.S"
+#include "src/native/x86_64/src/mlkem_tomont_avx2_asm.S"
 #endif /* MLK_SYS_X86_64 */
 #if defined(MLK_SYS_RISCV64)
 #endif
 #if defined(MLK_SYS_PPC64LE)
-#include "src/native/ppc64le/src/intt_ppc_asm.S"
-#include "src/native/ppc64le/src/ntt_ppc_asm.S"
-#include "src/native/ppc64le/src/poly_tomont_ppc_asm.S"
-#include "src/native/ppc64le/src/reduce_ppc_asm.S"
+#include "src/native/ppc64le/src/mlkem_intt_ppc_asm.S"
+#include "src/native/ppc64le/src/mlkem_ntt_ppc_asm.S"
+#include "src/native/ppc64le/src/mlkem_poly_tomont_ppc_asm.S"
+#include "src/native/ppc64le/src/mlkem_reduce_ppc_asm.S"
 #endif /* MLK_SYS_PPC64LE */
 #endif /* MLK_CONFIG_USE_NATIVE_BACKEND_ARITH */
 
@@ -116,8 +116,8 @@
 #endif
 #if defined(MLK_SYS_ARMV81M_MVE)
 #include "src/fips202/native/armv81m/src/keccak_f1600_x4_mve.S"
-#include "src/fips202/native/armv81m/src/state_extract_bytes_x4_mve.S"
-#include "src/fips202/native/armv81m/src/state_xor_bytes_x4_mve.S"
+#include "src/fips202/native/armv81m/src/keccak_f1600_x4_state_extract_bytes_mve.S"
+#include "src/fips202/native/armv81m/src/keccak_f1600_x4_state_xor_bytes_mve.S"
 #endif
 #endif /* MLK_CONFIG_USE_NATIVE_BACKEND_FIPS202 */
 
@@ -226,11 +226,6 @@
 #undef MLK_COMMON_H
 #undef MLK_CONCAT
 #undef MLK_CONCAT_
-#undef MLK_CONTEXT_PARAMETERS_0
-#undef MLK_CONTEXT_PARAMETERS_1
-#undef MLK_CONTEXT_PARAMETERS_2
-#undef MLK_CONTEXT_PARAMETERS_3
-#undef MLK_CONTEXT_PARAMETERS_4
 #undef MLK_EMPTY_CU
 #undef MLK_ERR_FAIL
 #undef MLK_ERR_OUT_OF_MEMORY
@@ -335,6 +330,13 @@
 #undef mlk_poly_frommsg
 #undef mlk_poly_tobytes
 #undef mlk_poly_tomsg
+/* mlkem/src/context.h */
+#undef MLK_CONTEXT_H
+#undef MLK_CONTEXT_PARAMETERS_0
+#undef MLK_CONTEXT_PARAMETERS_1
+#undef MLK_CONTEXT_PARAMETERS_2
+#undef MLK_CONTEXT_PARAMETERS_3
+#undef MLK_CONTEXT_PARAMETERS_4
 /* mlkem/src/debug.h */
 #undef MLK_DEBUG_H
 #undef mlk_assert
@@ -401,6 +403,7 @@
 #undef MLK_SYSV_ABI_SUPPORTED
 #undef MLK_SYS_AARCH64
 #undef MLK_SYS_AARCH64_EB
+#undef MLK_SYS_AARCH64_NEON
 #undef MLK_SYS_APPLE
 #undef MLK_SYS_ARMV81M_MVE
 #undef MLK_SYS_BIG_ENDIAN
@@ -532,8 +535,6 @@
 #undef MLK_USE_FIPS202_X4_NATIVE
 #undef MLK_USE_FIPS202_X4_XOR_BYTES_NATIVE
 #undef mlk_keccak_f1600_x4_native_impl
-#undef mlk_keccak_f1600_x4_state_extract_bytes
-#undef mlk_keccak_f1600_x4_state_xor_bytes
 /* mlkem/src/fips202/native/armv81m/src/fips202_native_armv81m.h */
 #undef MLK_FIPS202_NATIVE_ARMV81M_SRC_FIPS202_NATIVE_ARMV81M_H
 #undef mlk_keccak_f1600_x4_mve_asm

data/ext/pqcrypto/vendor/mlkem-native/mlkem/mlkem_native_config.h

@@ -99,6 +99,42 @@
  */
 /* #define MLK_CONFIG_EXTERNAL_API_QUALIFIER */
 
+/**
+ * MLK_CONFIG_NO_KEYPAIR_API
+ *
+ * By default, mlkem-native includes support for generating key pairs.
+ * If you don't need this, set MLK_CONFIG_NO_KEYPAIR_API to exclude
+ * crypto_kem_keypair and crypto_kem_keypair_derand, and all internal
+ * APIs only needed by those functions.
+ */
+/* #define MLK_CONFIG_NO_KEYPAIR_API */
+
+/**
+ * MLK_CONFIG_NO_ENCAPS_API
+ *
+ * By default, mlkem-native includes support for encapsulation. If you
+ * don't need this, set MLK_CONFIG_NO_ENCAPS_API to exclude
+ * crypto_kem_enc, crypto_kem_enc_derand, crypto_kem_check_pk, and
+ * all internal APIs only needed by those functions.
+ *
+ * @note Setting this option is incompatible with MLK_CONFIG_KEYGEN_PCT
+ *       as the current PCT implementation requires crypto_kem_enc().
+ */
+/* #define MLK_CONFIG_NO_ENCAPS_API */
+
+/**
+ * MLK_CONFIG_NO_DECAPS_API
+ *
+ * By default, mlkem-native includes support for decapsulation. If you
+ * don't need this, set MLK_CONFIG_NO_DECAPS_API to exclude
+ * crypto_kem_dec, crypto_kem_check_sk, and all internal APIs only
+ * needed by those functions.
+ *
+ * @note Setting this option is incompatible with MLK_CONFIG_KEYGEN_PCT
+ *       as the current PCT implementation requires crypto_kem_dec().
+ */
+/* #define MLK_CONFIG_NO_DECAPS_API */
+
 /**
  * MLK_CONFIG_NO_RANDOMIZED_API
  *

data/ext/pqcrypto/vendor/mlkem-native/mlkem/src/common.h

@@ -125,6 +125,14 @@
 #error Bad configuration: MLK_CONFIG_NO_RANDOMIZED_API is incompatible with MLK_CONFIG_KEYGEN_PCT as the current PCT implementation requires crypto_kem_enc()
 #endif
 
+#if defined(MLK_CONFIG_NO_ENCAPS_API) && defined(MLK_CONFIG_KEYGEN_PCT)
+#error Bad configuration: MLK_CONFIG_NO_ENCAPS_API is incompatible with MLK_CONFIG_KEYGEN_PCT as the current PCT implementation requires crypto_kem_enc()
+#endif
+
+#if defined(MLK_CONFIG_NO_DECAPS_API) && defined(MLK_CONFIG_KEYGEN_PCT)
+#error Bad configuration: MLK_CONFIG_NO_DECAPS_API is incompatible with MLK_CONFIG_KEYGEN_PCT as the current PCT implementation requires crypto_kem_dec()
+#endif
+
 #if defined(MLK_CONFIG_USE_NATIVE_BACKEND_ARITH)
 #include MLK_CONFIG_ARITH_BACKEND_FILE
 /* Include to enforce consistency of API and implementation,
@@ -188,36 +196,11 @@
 #error Bad configuration: MLK_CONFIG_CUSTOM_ALLOC_FREE must be set together with MLK_CUSTOM_ALLOC and MLK_CUSTOM_FREE
 #endif
 
-/*
- * If the integration wants to provide a context parameter for use in
- * platform-specific hooks, then it should define this parameter.
- *
- * The MLK_CONTEXT_PARAMETERS_n macros are intended to be used with macros
- * defining the function names and expand to either pass or discard the context
- * argument as required by the current build.  If there is no context parameter
- * requested then these are removed from the prototypes and from all calls.
- */
-#ifdef MLK_CONFIG_CONTEXT_PARAMETER
-#define MLK_CONTEXT_PARAMETERS_0(context) (context)
-#define MLK_CONTEXT_PARAMETERS_1(arg0, context) (arg0, context)
-#define MLK_CONTEXT_PARAMETERS_2(arg0, arg1, context) (arg0, arg1, context)
-#define MLK_CONTEXT_PARAMETERS_3(arg0, arg1, arg2, context) \
-  (arg0, arg1, arg2, context)
-#define MLK_CONTEXT_PARAMETERS_4(arg0, arg1, arg2, arg3, context) \
-  (arg0, arg1, arg2, arg3, context)
-#else /* MLK_CONFIG_CONTEXT_PARAMETER */
-#define MLK_CONTEXT_PARAMETERS_0(context) ()
-#define MLK_CONTEXT_PARAMETERS_1(arg0, context) (arg0)
-#define MLK_CONTEXT_PARAMETERS_2(arg0, arg1, context) (arg0, arg1)
-#define MLK_CONTEXT_PARAMETERS_3(arg0, arg1, arg2, context) (arg0, arg1, arg2)
-#define MLK_CONTEXT_PARAMETERS_4(arg0, arg1, arg2, arg3, context) \
-  (arg0, arg1, arg2, arg3)
-#endif /* !MLK_CONFIG_CONTEXT_PARAMETER */
-
-#if defined(MLK_CONFIG_CONTEXT_PARAMETER_TYPE) != \
-    defined(MLK_CONFIG_CONTEXT_PARAMETER)
-#error MLK_CONFIG_CONTEXT_PARAMETER_TYPE must be defined if and only if MLK_CONFIG_CONTEXT_PARAMETER is defined
-#endif
+/* Context-parameter machinery (MLK_CONTEXT_PARAMETERS_n and related config
+ * checks). Kept in a separate, level-generic header for readability; included
+ * here so it is available to the allocation macros below and to all consumers
+ * of common.h. */
+#include "context.h"
 
 #if !defined(MLK_CONFIG_CUSTOM_ALLOC_FREE)
 /* Default: stack allocation */

data/ext/pqcrypto/vendor/mlkem-native/mlkem/src/compress.c

@@ -26,7 +26,10 @@
 #include "debug.h"
 #include "verify.h"
 
-#if defined(MLK_CONFIG_MULTILEVEL_WITH_SHARED) || (MLKEM_K == 2 || MLKEM_K == 3)
+#if (!defined(MLK_CONFIG_NO_ENCAPS_API) ||                         \
+     !defined(MLK_CONFIG_NO_DECAPS_API)) &&                        \
+    (defined(MLK_CONFIG_MULTILEVEL_WITH_SHARED) || MLKEM_K == 2 || \
+     MLKEM_K == 3)
 /* Reference: `poly_compress()` in the reference implementation @[REF],
  *            for ML-KEM-{512,768}.
  *            - In contrast to the reference implementation, we assume
@@ -158,6 +161,7 @@ __contract__(
   mlk_poly_compress_d10_c(r, a);
 }
 
+#if !defined(MLK_CONFIG_NO_DECAPS_API)
 /* Reference: `poly_decompress()` in the reference implementation @[REF],
  *            for ML-KEM-{512,768}. */
 MLK_STATIC_TESTABLE void mlk_poly_decompress_d4_c(
@@ -268,9 +272,14 @@ __contract__(
 
   mlk_poly_decompress_d10_c(r, a);
 }
-#endif /* MLK_CONFIG_MULTILEVEL_WITH_SHARED || MLKEM_K == 2 || MLKEM_K == 3 */
-
-#if defined(MLK_CONFIG_MULTILEVEL_WITH_SHARED) || MLKEM_K == 4
+#endif /* !MLK_CONFIG_NO_DECAPS_API */
+#endif /* (!MLK_CONFIG_NO_ENCAPS_API || !MLK_CONFIG_NO_DECAPS_API) &&         \
+          (MLK_CONFIG_MULTILEVEL_WITH_SHARED || MLKEM_K == 2 || MLKEM_K == 3) \
+        */
+
+#if (!defined(MLK_CONFIG_NO_ENCAPS_API) ||  \
+     !defined(MLK_CONFIG_NO_DECAPS_API)) && \
+    (defined(MLK_CONFIG_MULTILEVEL_WITH_SHARED) || MLKEM_K == 4)
 /* Reference: `poly_compress()` in the reference implementation @[REF],
  *            for ML-KEM-1024.
  *            - In contrast to the reference implementation, we assume
@@ -409,6 +418,7 @@ __contract__(
   mlk_poly_compress_d11_c(r, a);
 }
 
+#if !defined(MLK_CONFIG_NO_DECAPS_API)
 /* Reference: `poly_decompress()` in the reference implementation @[REF],
  *            for ML-KEM-1024. */
 MLK_STATIC_TESTABLE void mlk_poly_decompress_d5_c(
@@ -554,8 +564,11 @@ __contract__(
   mlk_poly_decompress_d11_c(r, a);
 }
 
-#endif /* MLK_CONFIG_MULTILEVEL_WITH_SHARED || MLKEM_K == 4 */
+#endif /* !MLK_CONFIG_NO_DECAPS_API */
+#endif /* (!MLK_CONFIG_NO_ENCAPS_API || !MLK_CONFIG_NO_DECAPS_API) && \
+          (MLK_CONFIG_MULTILEVEL_WITH_SHARED || MLKEM_K == 4) */
 
+#if !defined(MLK_CONFIG_NO_KEYPAIR_API) || !defined(MLK_CONFIG_NO_ENCAPS_API)
 /* Reference: `poly_tobytes()` in the reference implementation @[REF].
  *            - In contrast to the reference implementation, we assume
  *              unsigned canonical coefficients here.
@@ -620,7 +633,9 @@ void mlk_poly_tobytes(uint8_t r[MLKEM_POLYBYTES], const mlk_poly *a)
 
   mlk_poly_tobytes_c(r, a);
 }
+#endif /* !MLK_CONFIG_NO_KEYPAIR_API || !MLK_CONFIG_NO_ENCAPS_API */
 
+#if !defined(MLK_CONFIG_NO_ENCAPS_API) || !defined(MLK_CONFIG_NO_DECAPS_API)
 /* Reference: `poly_frombytes()` in the reference implementation @[REF]. */
 MLK_STATIC_TESTABLE void mlk_poly_frombytes_c(mlk_poly *r,
                                               const uint8_t a[MLKEM_POLYBYTES])
@@ -668,7 +683,9 @@ void mlk_poly_frombytes(mlk_poly *r, const uint8_t a[MLKEM_POLYBYTES])
 
   mlk_poly_frombytes_c(r, a);
 }
+#endif /* !MLK_CONFIG_NO_ENCAPS_API || !MLK_CONFIG_NO_DECAPS_API */
 
+#if !defined(MLK_CONFIG_NO_ENCAPS_API) || !defined(MLK_CONFIG_NO_DECAPS_API)
 /* Reference: `poly_frommsg()` in the reference implementation @[REF].
  *            - We use a value barrier around the bit-selection mask to
  *              reduce the risk of compiler-introduced branches.
@@ -706,7 +723,9 @@ void mlk_poly_frommsg(mlk_poly *r, const uint8_t msg[MLKEM_INDCPA_MSGBYTES])
   }
   mlk_assert_abs_bound(r, MLKEM_N, MLKEM_Q);
 }
+#endif /* !MLK_CONFIG_NO_ENCAPS_API || !MLK_CONFIG_NO_DECAPS_API */
 
+#if !defined(MLK_CONFIG_NO_DECAPS_API)
 /* Reference: `poly_tomsg()` in the reference implementation @[REF].
  *            - In contrast to the reference implementation, we assume
  *              unsigned canonical coefficients here.
@@ -735,6 +754,7 @@ void mlk_poly_tomsg(uint8_t msg[MLKEM_INDCPA_MSGBYTES], const mlk_poly *r)
     }
   }
 }
+#endif /* !MLK_CONFIG_NO_DECAPS_API */
 
 #else /* !MLK_CONFIG_MULTILEVEL_NO_SHARED */
 

data/ext/pqcrypto/vendor/mlkem-native/mlkem/src/compress.h

@@ -333,6 +333,7 @@ __contract__(
   return (int16_t)((((uint32_t)u * MLKEM_Q) + 1024) >> 11);
 }
 
+#if !defined(MLK_CONFIG_NO_ENCAPS_API) || !defined(MLK_CONFIG_NO_DECAPS_API)
 #if defined(MLK_CONFIG_MULTILEVEL_WITH_SHARED) || (MLKEM_K == 2 || MLKEM_K == 3)
 #define mlk_poly_compress_d4 MLK_NAMESPACE(poly_compress_d4)
 /**
@@ -374,6 +375,7 @@ MLK_INTERNAL_API
 void mlk_poly_compress_d10(uint8_t r[MLKEM_POLYCOMPRESSEDBYTES_D10],
                            const mlk_poly *a);
 
+#if !defined(MLK_CONFIG_NO_DECAPS_API)
 #define mlk_poly_decompress_d4 MLK_NAMESPACE(poly_decompress_d4)
 /**
  * De-serialization and subsequent decompression (4 bits) of a polynomial;
@@ -419,6 +421,7 @@ void mlk_poly_decompress_d4(mlk_poly *r,
 MLK_INTERNAL_API
 void mlk_poly_decompress_d10(mlk_poly *r,
                              const uint8_t a[MLKEM_POLYCOMPRESSEDBYTES_D10]);
+#endif /* !MLK_CONFIG_NO_DECAPS_API */
 #endif /* MLK_CONFIG_MULTILEVEL_WITH_SHARED || MLKEM_K == 2 || MLKEM_K == 3 */
 
 #if defined(MLK_CONFIG_MULTILEVEL_WITH_SHARED) || MLKEM_K == 4
@@ -462,6 +465,7 @@ MLK_INTERNAL_API
 void mlk_poly_compress_d11(uint8_t r[MLKEM_POLYCOMPRESSEDBYTES_D11],
                            const mlk_poly *a);
 
+#if !defined(MLK_CONFIG_NO_DECAPS_API)
 #define mlk_poly_decompress_d5 MLK_NAMESPACE(poly_decompress_d5)
 /**
  * De-serialization and subsequent decompression (5 bits) of a polynomial;
@@ -507,8 +511,11 @@ void mlk_poly_decompress_d5(mlk_poly *r,
 MLK_INTERNAL_API
 void mlk_poly_decompress_d11(mlk_poly *r,
                              const uint8_t a[MLKEM_POLYCOMPRESSEDBYTES_D11]);
+#endif /* !MLK_CONFIG_NO_DECAPS_API */
 #endif /* MLK_CONFIG_MULTILEVEL_WITH_SHARED || MLKEM_K == 4 */
+#endif /* !MLK_CONFIG_NO_ENCAPS_API || !MLK_CONFIG_NO_DECAPS_API */
 
+#if !defined(MLK_CONFIG_NO_KEYPAIR_API) || !defined(MLK_CONFIG_NO_ENCAPS_API)
 #define mlk_poly_tobytes MLK_NAMESPACE(poly_tobytes)
 /**
  * Serialization of a polynomial. Signed coefficients are converted to
@@ -529,8 +536,10 @@ __contract__(
   requires(array_bound(a->coeffs, 0, MLKEM_N, 0, MLKEM_Q))
   assigns(memory_slice(r, MLKEM_POLYBYTES))
 );
+#endif /* !MLK_CONFIG_NO_KEYPAIR_API || !MLK_CONFIG_NO_ENCAPS_API */
 
 
+#if !defined(MLK_CONFIG_NO_ENCAPS_API) || !defined(MLK_CONFIG_NO_DECAPS_API)
 #define mlk_poly_frombytes MLK_NAMESPACE(poly_frombytes)
 /**
  * De-serialization of a polynomial.
@@ -550,8 +559,10 @@ __contract__(
   assigns(memory_slice(r, sizeof(mlk_poly)))
   ensures(array_bound(r->coeffs, 0, MLKEM_N, 0, MLKEM_UINT12_LIMIT))
 );
+#endif /* !MLK_CONFIG_NO_ENCAPS_API || !MLK_CONFIG_NO_DECAPS_API */
 
 
+#if !defined(MLK_CONFIG_NO_ENCAPS_API) || !defined(MLK_CONFIG_NO_DECAPS_API)
 #define mlk_poly_frommsg MLK_NAMESPACE(poly_frommsg)
 /**
  * Convert a 32-byte message to a polynomial.
@@ -573,7 +584,9 @@ __contract__(
   assigns(memory_slice(r, sizeof(mlk_poly)))
   ensures(array_bound(r->coeffs, 0, MLKEM_N, 0, MLKEM_Q))
 );
+#endif /* !MLK_CONFIG_NO_ENCAPS_API || !MLK_CONFIG_NO_DECAPS_API */
 
+#if !defined(MLK_CONFIG_NO_DECAPS_API)
 #define mlk_poly_tomsg MLK_NAMESPACE(poly_tomsg)
 /**
  * Convert a polynomial to a 32-byte message.
@@ -595,5 +608,6 @@ __contract__(
   requires(array_bound(r->coeffs, 0, MLKEM_N, 0, MLKEM_Q))
   assigns(memory_slice(msg, MLKEM_INDCPA_MSGBYTES))
 );
+#endif /* !MLK_CONFIG_NO_DECAPS_API */
 
 #endif /* !MLK_COMPRESS_H */

data/ext/pqcrypto/vendor/mlkem-native/mlkem/src/context.h

@@ -0,0 +1,42 @@
+/*
+ * Copyright (c) The mlkem-native project authors
+ * SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT
+ */
+#ifndef MLK_CONTEXT_H
+#define MLK_CONTEXT_H
+
+/* This header is included by common.h once the configuration has been pulled
+ * in; it is not meant to be included directly. */
+
+/*
+ * If the integration wants to provide a context parameter for use in
+ * platform-specific hooks, then it should define this parameter.
+ *
+ * The MLK_CONTEXT_PARAMETERS_n macros are intended to be used with macros
+ * defining the function names and expand to either pass or discard the context
+ * argument as required by the current build.  If there is no context parameter
+ * requested then these are removed from the prototypes and from all calls.
+ */
+#ifdef MLK_CONFIG_CONTEXT_PARAMETER
+#define MLK_CONTEXT_PARAMETERS_0(context) (context)
+#define MLK_CONTEXT_PARAMETERS_1(arg0, context) (arg0, context)
+#define MLK_CONTEXT_PARAMETERS_2(arg0, arg1, context) (arg0, arg1, context)
+#define MLK_CONTEXT_PARAMETERS_3(arg0, arg1, arg2, context) \
+  (arg0, arg1, arg2, context)
+#define MLK_CONTEXT_PARAMETERS_4(arg0, arg1, arg2, arg3, context) \
+  (arg0, arg1, arg2, arg3, context)
+#else /* MLK_CONFIG_CONTEXT_PARAMETER */
+#define MLK_CONTEXT_PARAMETERS_0(context) ()
+#define MLK_CONTEXT_PARAMETERS_1(arg0, context) (arg0)
+#define MLK_CONTEXT_PARAMETERS_2(arg0, arg1, context) (arg0, arg1)
+#define MLK_CONTEXT_PARAMETERS_3(arg0, arg1, arg2, context) (arg0, arg1, arg2)
+#define MLK_CONTEXT_PARAMETERS_4(arg0, arg1, arg2, arg3, context) \
+  (arg0, arg1, arg2, arg3)
+#endif /* !MLK_CONFIG_CONTEXT_PARAMETER */
+
+#if defined(MLK_CONFIG_CONTEXT_PARAMETER_TYPE) != \
+    defined(MLK_CONFIG_CONTEXT_PARAMETER)
+#error MLK_CONFIG_CONTEXT_PARAMETER_TYPE must be defined if and only if MLK_CONFIG_CONTEXT_PARAMETER is defined
+#endif
+
+#endif /* !MLK_CONTEXT_H */

data/ext/pqcrypto/vendor/mlkem-native/mlkem/src/fips202/native/aarch64/auto.h

@@ -24,38 +24,44 @@
 /*
  * Keccak-f1600
  *
- * - On Arm-based Apple CPUs, we pick a pure Neon implementation.
+ * - On Arm-based Apple CPUs, or if MLK_SYS_AARCH64_FAST_SHA3 is set,
+ *   we pick a pure Neon implementation.
  * - Otherwise, unless MLK_SYS_AARCH64_SLOW_BARREL_SHIFTER is set,
  *   we use lazy-rotation scalar assembly from @[HYBRID].
  * - Otherwise, if MLK_SYS_AARCH64_SLOW_BARREL_SHIFTER is set, we
  *   fall back to the standard C implementation.
  */
-#if defined(__ARM_FEATURE_SHA3) && defined(__APPLE__)
+#if defined(__ARM_FEATURE_SHA3) && \
+    (defined(__APPLE__) || defined(MLK_SYS_AARCH64_FAST_SHA3))
 #include "x1_v84a.h"
 #elif !defined(MLK_SYS_AARCH64_SLOW_BARREL_SHIFTER)
 #include "x1_scalar.h"
 #endif
 
+/* Batched, SIMD-based Keccak-f1600 implementations. */
+#if defined(MLK_SYS_AARCH64_NEON)
+
 /*
  * Keccak-f1600x2/x4
  *
  * The optimal implementation is highly CPU-specific; see @[HYBRID].
  *
  * For now, if v8.4-A is not implemented, we fall back to Keccak-f1600.
- * If v8.4-A is implemented and we are on an Apple CPU, we use a plain
- * Neon-based implementation.
- * If v8.4-A is implemented and we are not on an Apple CPU, we use a
- * scalar/Neon/Neon hybrid.
- * The reason for this distinction is that Apple CPUs appear to implement
- * the SHA3 instructions on all SIMD units, while Arm CPUs prior to Cortex-X4
- * don't, and ordinary Neon instructions are still needed.
+ * If v8.4-A is implemented and we are on an Apple CPU or
+ * MLK_SYS_AARCH64_FAST_SHA3 is set, we use a plain Neon-based
+ * implementation.
+ * Otherwise, if v8.4-A is implemented, we use a scalar/Neon/Neon hybrid.
+ * The reason for this distinction is that Apple CPUs (and CPUs flagged with
+ * MLK_SYS_AARCH64_FAST_SHA3) implement the SHA3 instructions on all SIMD
+ * units, while Arm CPUs prior to Cortex-X4 don't, and ordinary Neon
+ * instructions are still needed.
  */
 #if defined(__ARM_FEATURE_SHA3)
 /*
- * For Apple-M cores, we use a plain implementation leveraging SHA3
- * instructions only.
+ * For Apple-M cores (and CPUs flagged with MLK_SYS_AARCH64_FAST_SHA3), we
+ * use a plain implementation leveraging SHA3 instructions only.
  */
-#if defined(__APPLE__)
+#if defined(__APPLE__) || defined(MLK_SYS_AARCH64_FAST_SHA3)
 #include "x2_v84a.h"
 #else
 #include "x4_v8a_v84a_scalar.h"
@@ -67,4 +73,6 @@
 
 #endif /* !__ARM_FEATURE_SHA3 */
 
+#endif /* MLK_SYS_AARCH64_NEON */
+
 #endif /* !MLK_FIPS202_NATIVE_AARCH64_AUTO_H */

data/ext/pqcrypto/vendor/mlkem-native/mlkem/src/fips202/native/aarch64/src/keccak_f1600_x1_scalar_aarch64_asm.S

@@ -13,6 +13,8 @@
   Description: AArch64 scalar implementation of Keccak-f[1600] permutation for single state
   Signature: void mlk_keccak_f1600_x1_scalar_aarch64_asm(uint64_t state[25], const uint64_t rc[24])
   ABI:
+    Architecture: aarch64
+    CallingConvention: AAPCS64
     x0:
       type: buffer
       size_bytes: 200
@@ -66,7 +68,7 @@ MLK_ASM_FN_SYMBOL(keccak_f1600_x1_scalar_aarch64_asm)
         .cfi_rel_offset x29, 0x70
         .cfi_rel_offset x30, 0x78
 
-Lkeccak_f1600_x1_scalar_initial:
+Lmlk_keccak_f1600_x1_scalar_initial:
         mov x26, x1
         str x1, [sp, #0x8]
         ldp x1, x6, [x0]
@@ -191,7 +193,7 @@ Lkeccak_f1600_x1_scalar_initial:
         eor x14, x26, x6, ror #46
         eor x6, x27, x29, ror #41
 
-Lkeccak_f1600_x1_scalar_loop:
+Lmlk_keccak_f1600_x1_scalar_loop:
         eor x0, x15, x11, ror #52
         eor x0, x0, x13, ror #48
         eor x26, x8, x9, ror #57
@@ -304,7 +306,7 @@ Lkeccak_f1600_x1_scalar_loop:
         bic x3, x0, x30, ror #5
         eor x23, x3, x26, ror #52
         eor x3, x29, x30, ror #24
-        b.le Lkeccak_f1600_x1_scalar_loop
+        b.le Lmlk_keccak_f1600_x1_scalar_loop
         ror x6, x6, #0x2b
         ror x11, x11, #0x32
         ror x21, x21, #0x14

data/ext/pqcrypto/vendor/mlkem-native/mlkem/src/fips202/native/aarch64/src/keccak_f1600_x1_v84a_aarch64_asm.S

@@ -19,6 +19,9 @@
   Description: AArch64 ARMv8.4-A implementation of Keccak-f[1600] permutation for single state
   Signature: void mlk_keccak_f1600_x1_v84a_aarch64_asm(uint64_t state[25], const uint64_t rc[24])
   ABI:
+    Architecture: aarch64
+    CallingConvention: AAPCS64
+    Features: [NEON, SHA3]
     x0:
       type: buffer
       size_bytes: 200
@@ -91,7 +94,7 @@ MLK_ASM_FN_SYMBOL(keccak_f1600_x1_v84a_aarch64_asm)
         ldr d24, [x0, #0xc0]
         mov x2, #0x18               // =24
 
-Lkeccak_f1600_x1_v84a_loop:
+Lmlk_keccak_f1600_x1_v84a_loop:
         eor3 v30.16b, v0.16b, v5.16b, v10.16b
         eor3 v29.16b, v1.16b, v6.16b, v11.16b
         eor3 v28.16b, v2.16b, v7.16b, v12.16b
@@ -160,7 +163,7 @@ Lkeccak_f1600_x1_v84a_loop:
         bcax v4.16b, v4.16b, v27.16b, v30.16b
         eor v0.16b, v0.16b, v31.16b
         sub x2, x2, #0x1
-        cbnz x2, Lkeccak_f1600_x1_v84a_loop
+        cbnz x2, Lmlk_keccak_f1600_x1_v84a_loop
         stp d0, d1, [x0]
         stp d2, d3, [x0, #0x10]
         stp d4, d5, [x0, #0x20]

data/ext/pqcrypto/vendor/mlkem-native/mlkem/src/fips202/native/aarch64/src/keccak_f1600_x2_v84a_aarch64_asm.S

@@ -19,6 +19,9 @@
   Description: AArch64 ARMv8.4-A implementation of Keccak-f[1600] permutation for two sequential states
   Signature: void mlk_keccak_f1600_x2_v84a_aarch64_asm(uint64_t state[50], const uint64_t rc[24])
   ABI:
+    Architecture: aarch64
+    CallingConvention: AAPCS64
+    Features: [NEON, SHA3]
     x0:
       type: buffer
       size_bytes: 400
@@ -118,7 +121,7 @@ MLK_ASM_FN_SYMBOL(keccak_f1600_x2_v84a_aarch64_asm)
         trn1 v24.2d, v25.2d, v27.2d
         mov x2, #0x18               // =24
 
-Lkeccak_f1600_x2_v84a_loop:
+Lmlk_keccak_f1600_x2_v84a_loop:
         eor3 v30.16b, v0.16b, v5.16b, v10.16b
         eor3 v29.16b, v1.16b, v6.16b, v11.16b
         eor3 v28.16b, v2.16b, v7.16b, v12.16b
@@ -187,7 +190,7 @@ Lkeccak_f1600_x2_v84a_loop:
         bcax v4.16b, v4.16b, v27.16b, v30.16b
         eor v0.16b, v0.16b, v31.16b
         sub x2, x2, #0x1
-        cbnz x2, Lkeccak_f1600_x2_v84a_loop
+        cbnz x2, Lmlk_keccak_f1600_x2_v84a_loop
         sub x0, x0, #0xc0
         add x2, x0, #0xc8
         trn1 v25.2d, v0.2d, v1.2d