pq_crypto 0.6.4 → 0.6.6

data/ext/pqcrypto/vendor/mldsa-native/mldsa/src/native/aarch64/src/{polyz_unpack_17_aarch64_asm.S → mldsa_polyz_unpack_17_aarch64_asm.S}

@@ -4,6 +4,34 @@
  * SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT
  */
 
+/*yaml
+  Name: polyz_unpack_17_aarch64_asm
+  Description: AArch64 unpacking of 17-bit packed coefficients
+  Signature: void mld_polyz_unpack_17_aarch64_asm(int32_t r[256], const uint8_t buf[576], const uint8_t indices[64])
+  ABI:
+    Architecture: aarch64
+    CallingConvention: AAPCS64
+    Features: [NEON]
+    x0:
+      type: buffer
+      size_bytes: 1024
+      permissions: write-only
+      c_parameter: int32_t r[256]
+      description: Output polynomial (256 x int32_t)
+    x1:
+      type: buffer
+      size_bytes: 576
+      permissions: read-only
+      c_parameter: const uint8_t buf[576]
+      description: Packed input bytes
+    x2:
+      type: buffer
+      size_bytes: 64
+      permissions: read-only
+      c_parameter: const uint8_t indices[64]
+      description: Permutation index table (64 x uint8_t)
+*/
+
  #include "../../../common.h"
 #if defined(MLD_ARITH_BACKEND_AARCH64) && \
            (!defined(MLD_CONFIG_NO_SIGN_API) || !defined(MLD_CONFIG_NO_VERIFY_API)) && \
@@ -12,7 +40,7 @@
 
 /*
  * WARNING: This file is auto-derived from the mldsa-native source file
- *   dev/aarch64_opt/src/polyz_unpack_17_aarch64_asm.S using scripts/simpasm. Do not modify it directly.
+ *   dev/aarch64_opt/src/mldsa_polyz_unpack_17_aarch64_asm.S using scripts/simpasm. Do not modify it directly.
  */
 
 .text
@@ -34,7 +62,7 @@ MLD_ASM_FN_SYMBOL(polyz_unpack_17_aarch64_asm)
         movi v30.4s, #0x2, lsl #16
         mov x9, #0x10               // =16
 
-Lpolyz_unpack_17_loop:
+Lmld_polyz_unpack_17_loop:
         ld1 { v0.16b, v1.16b }, [x1]
         add x1, x1, #0x14
         ld1 { v2.16b }, [x1], #16
@@ -59,7 +87,7 @@ Lpolyz_unpack_17_loop:
         str q7, [x0, #0x30]
         str q4, [x0], #0x40
         subs x9, x9, #0x1
-        b.ne Lpolyz_unpack_17_loop
+        b.ne Lmld_polyz_unpack_17_loop
         ret
         .cfi_endproc
 

data/ext/pqcrypto/vendor/mldsa-native/mldsa/src/native/aarch64/src/{polyz_unpack_19_aarch64_asm.S → mldsa_polyz_unpack_19_aarch64_asm.S}

@@ -4,6 +4,34 @@
  * SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT
  */
 
+/*yaml
+  Name: polyz_unpack_19_aarch64_asm
+  Description: AArch64 unpacking of 19-bit packed coefficients
+  Signature: void mld_polyz_unpack_19_aarch64_asm(int32_t r[256], const uint8_t buf[640], const uint8_t indices[64])
+  ABI:
+    Architecture: aarch64
+    CallingConvention: AAPCS64
+    Features: [NEON]
+    x0:
+      type: buffer
+      size_bytes: 1024
+      permissions: write-only
+      c_parameter: int32_t r[256]
+      description: Output polynomial (256 x int32_t)
+    x1:
+      type: buffer
+      size_bytes: 640
+      permissions: read-only
+      c_parameter: const uint8_t buf[640]
+      description: Packed input bytes
+    x2:
+      type: buffer
+      size_bytes: 64
+      permissions: read-only
+      c_parameter: const uint8_t indices[64]
+      description: Permutation index table (64 x uint8_t)
+*/
+
  #include "../../../common.h"
 #if defined(MLD_ARITH_BACKEND_AARCH64) && \
            (!defined(MLD_CONFIG_NO_SIGN_API) || !defined(MLD_CONFIG_NO_VERIFY_API)) && \
@@ -12,7 +40,7 @@
 
 /*
  * WARNING: This file is auto-derived from the mldsa-native source file
- *   dev/aarch64_opt/src/polyz_unpack_19_aarch64_asm.S using scripts/simpasm. Do not modify it directly.
+ *   dev/aarch64_opt/src/mldsa_polyz_unpack_19_aarch64_asm.S using scripts/simpasm. Do not modify it directly.
  */
 
 .text
@@ -31,7 +59,7 @@ MLD_ASM_FN_SYMBOL(polyz_unpack_19_aarch64_asm)
         movi v30.4s, #0x8, lsl #16
         mov x9, #0x10               // =16
 
-Lpolyz_unpack_19_loop:
+Lmld_polyz_unpack_19_loop:
         ld1 { v0.16b, v1.16b }, [x1]
         add x1, x1, #0x18
         ld1 { v2.16b }, [x1], #16
@@ -56,7 +84,7 @@ Lpolyz_unpack_19_loop:
         str q7, [x0, #0x30]
         str q4, [x0], #0x40
         subs x9, x9, #0x1
-        b.ne Lpolyz_unpack_19_loop
+        b.ne Lmld_polyz_unpack_19_loop
         ret
         .cfi_endproc
 

data/ext/pqcrypto/vendor/mldsa-native/mldsa/src/native/aarch64/src/{rej_uniform_aarch64_asm.S → mldsa_rej_uniform_aarch64_asm.S}

@@ -4,13 +4,46 @@
  * SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT
  */
 
+/*yaml
+  Name: rej_uniform_aarch64_asm
+  Description: AArch64 rejection sampling of uniform coefficients mod q
+  Signature: uint64_t mld_rej_uniform_aarch64_asm(int32_t r[256], const uint8_t *buf, unsigned buflen, const uint8_t table[256])
+  ABI:
+    Architecture: aarch64
+    CallingConvention: AAPCS64
+    Features: [NEON]
+    x0:
+      type: buffer
+      size_bytes: 1024
+      permissions: write-only
+      c_parameter: int32_t r[256]
+      description: Output buffer (256 x int32_t)
+    x1:
+      type: buffer
+      size_bytes: x2
+      permissions: read-only
+      c_parameter: const uint8_t *buf
+      description: Input buffer
+    x2:
+      type: scalar
+      c_parameter: unsigned buflen
+      description: Length of input buffer (must be a multiple of 24)
+      test_with: 840  # MLD_POLY_UNIFORM_NBLOCKS * SHAKE128_RATE = 5 * 168
+    x3:
+      type: buffer
+      size_bytes: 256
+      permissions: read-only
+      c_parameter: const uint8_t table[256]
+      description: Lookup table (256 x uint8_t)
+*/
+
  #include "../../../common.h"
 #if defined(MLD_ARITH_BACKEND_AARCH64) && \
     !defined(MLD_CONFIG_MULTILEVEL_NO_SHARED)
 
 /*
  * WARNING: This file is auto-derived from the mldsa-native source file
- *   dev/aarch64_opt/src/rej_uniform_aarch64_asm.S using scripts/simpasm. Do not modify it directly.
+ *   dev/aarch64_opt/src/mldsa_rej_uniform_aarch64_asm.S using scripts/simpasm. Do not modify it directly.
  */
 
 .text
@@ -35,23 +68,23 @@ MLD_ASM_FN_SYMBOL(rej_uniform_aarch64_asm)
         mov x11, #0x0               // =0
         eor v16.16b, v16.16b, v16.16b
 
-Lrej_uniform_initial_zero:
+Lmld_rej_uniform_initial_zero:
         str q16, [x7], #0x40
         stur q16, [x7, #-0x30]
         stur q16, [x7, #-0x20]
         stur q16, [x7, #-0x10]
         add x11, x11, #0x10
         cmp x11, #0x100
-        b.lt Lrej_uniform_initial_zero
+        b.lt Lmld_rej_uniform_initial_zero
         mov x7, x8
         mov x9, #0x0                // =0
         mov x4, #0x100              // =256
         cmp x2, #0x30
-        b.lo Lrej_uniform_loop48_end
+        b.lo Lmld_rej_uniform_loop48_end
 
-Lrej_uniform_loop48:
+Lmld_rej_uniform_loop48:
         cmp x9, x4
-        b.hs Lrej_uniform_memory_copy
+        b.hs Lmld_rej_uniform_memory_copy
         sub x2, x2, #0x30
         ld3 { v0.16b, v1.16b, v2.16b }, [x1], #48
         movi v4.16b, #0x80
@@ -113,13 +146,13 @@ Lrej_uniform_loop48:
         add x9, x9, x12
         add x9, x9, x14
         cmp x2, #0x30
-        b.hs Lrej_uniform_loop48
+        b.hs Lmld_rej_uniform_loop48
 
-Lrej_uniform_loop48_end:
+Lmld_rej_uniform_loop48_end:
         cmp x9, x4
-        b.hs Lrej_uniform_memory_copy
+        b.hs Lmld_rej_uniform_memory_copy
         cmp x2, #0x18
-        b.lo Lrej_uniform_memory_copy
+        b.lo Lmld_rej_uniform_memory_copy
         sub x2, x2, #0x18
         ld3 { v0.8b, v1.8b, v2.8b }, [x1], #24
         movi v4.16b, #0x80
@@ -153,13 +186,13 @@ Lrej_uniform_loop48_end:
         add x9, x9, x12
         add x9, x9, x13
 
-Lrej_uniform_memory_copy:
+Lmld_rej_uniform_memory_copy:
         cmp x9, x4
         csel x9, x9, x4, lo
         mov x11, #0x0               // =0
         mov x7, x8
 
-Lrej_uniform_final_copy:
+Lmld_rej_uniform_final_copy:
         ldr q16, [x7], #0x40
         ldur q17, [x7, #-0x30]
         ldur q18, [x7, #-0x20]
@@ -170,11 +203,11 @@ Lrej_uniform_final_copy:
         stur q19, [x0, #-0x10]
         add x11, x11, #0x10
         cmp x11, #0x100
-        b.lt Lrej_uniform_final_copy
+        b.lt Lmld_rej_uniform_final_copy
         mov x0, x9
-        b Lrej_uniform_return
+        b Lmld_rej_uniform_return
 
-Lrej_uniform_return:
+Lmld_rej_uniform_return:
         add sp, sp, #0x440
         .cfi_adjust_cfa_offset -0x440
         ret

data/ext/pqcrypto/vendor/mldsa-native/mldsa/src/native/aarch64/src/{rej_uniform_eta2_aarch64_asm.S → mldsa_rej_uniform_eta2_aarch64_asm.S}

@@ -4,6 +4,39 @@
  * SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT
  */
 
+/*yaml
+  Name: rej_uniform_eta2_aarch64_asm
+  Description: AArch64 rejection sampling of eta=2 secret coefficients
+  Signature: uint64_t mld_rej_uniform_eta2_aarch64_asm(int32_t r[256], const uint8_t *buf, unsigned buflen, const uint8_t table[4096])
+  ABI:
+    Architecture: aarch64
+    CallingConvention: AAPCS64
+    Features: [NEON]
+    x0:
+      type: buffer
+      size_bytes: 1024
+      permissions: write-only
+      c_parameter: int32_t r[256]
+      description: Output buffer (256 x int32_t)
+    x1:
+      type: buffer
+      size_bytes: x2
+      permissions: read-only
+      c_parameter: const uint8_t *buf
+      description: Input buffer
+    x2:
+      type: scalar
+      c_parameter: unsigned buflen
+      description: Length of input buffer (must be a multiple of 8)
+      test_with: 136  # MLD_AARCH64_REJ_UNIFORM_ETA2_BUFLEN
+    x3:
+      type: buffer
+      size_bytes: 4096
+      permissions: read-only
+      c_parameter: const uint8_t table[4096]
+      description: Lookup table (4096 x uint8_t)
+*/
+
 #include "../../../common.h"
 #if defined(MLD_ARITH_BACKEND_AARCH64) && \
     !defined(MLD_CONFIG_NO_KEYPAIR_API) && \
@@ -12,7 +45,7 @@
 
 /*
  * WARNING: This file is auto-derived from the mldsa-native source file
- *   dev/aarch64_opt/src/rej_uniform_eta2_aarch64_asm.S using scripts/simpasm. Do not modify it directly.
+ *   dev/aarch64_opt/src/mldsa_rej_uniform_eta2_aarch64_asm.S using scripts/simpasm. Do not modify it directly.
  */
 
 .text
@@ -39,21 +72,21 @@ MLD_ASM_FN_SYMBOL(rej_uniform_eta2_aarch64_asm)
         mov x11, #0x0               // =0
         eor v16.16b, v16.16b, v16.16b
 
-Lrej_uniform_eta2_initial_zero:
+Lmld_rej_uniform_eta2_initial_zero:
         str q16, [x7], #0x40
         stur q16, [x7, #-0x30]
         stur q16, [x7, #-0x20]
         stur q16, [x7, #-0x10]
         add x11, x11, #0x20
         cmp x11, #0x100
-        b.lt Lrej_uniform_eta2_initial_zero
+        b.lt Lmld_rej_uniform_eta2_initial_zero
         mov x7, x8
         mov x9, #0x0                // =0
         mov x4, #0x100              // =256
 
-Lrej_uniform_eta2_loop8:
+Lmld_rej_uniform_eta2_loop8:
         cmp x9, x4
-        b.hs Lrej_uniform_eta2_memory_copy
+        b.hs Lmld_rej_uniform_eta2_memory_copy
         sub x2, x2, #0x8
         ld1 { v0.8b }, [x1], #8
         movi v26.8b, #0xf
@@ -88,9 +121,9 @@ Lrej_uniform_eta2_loop8:
         add x12, x12, x13
         add x9, x9, x12
         cmp x2, #0x8
-        b.hs Lrej_uniform_eta2_loop8
+        b.hs Lmld_rej_uniform_eta2_loop8
 
-Lrej_uniform_eta2_memory_copy:
+Lmld_rej_uniform_eta2_memory_copy:
         cmp x9, x4
         csel x9, x9, x4, lo
         mov w7, #0x199a             // =6554
@@ -100,7 +133,7 @@ Lrej_uniform_eta2_memory_copy:
         mov x11, #0x0               // =0
         mov x7, x8
 
-Lrej_uniform_eta2_final_copy:
+Lmld_rej_uniform_eta2_final_copy:
         ldr q16, [x7], #0x20
         ldur q18, [x7, #-0x10]
         sqdmulh v28.8h, v16.8h, v26.8h
@@ -119,7 +152,7 @@ Lrej_uniform_eta2_final_copy:
         stur q19, [x0, #-0x10]
         add x11, x11, #0x10
         cmp x11, #0x100
-        b.lt Lrej_uniform_eta2_final_copy
+        b.lt Lmld_rej_uniform_eta2_final_copy
         mov x0, x9
         add sp, sp, #0x240
         .cfi_adjust_cfa_offset -0x240

data/ext/pqcrypto/vendor/mldsa-native/mldsa/src/native/aarch64/src/{rej_uniform_eta4_aarch64_asm.S → mldsa_rej_uniform_eta4_aarch64_asm.S}

@@ -4,6 +4,39 @@
  * SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT
  */
 
+/*yaml
+  Name: rej_uniform_eta4_aarch64_asm
+  Description: AArch64 rejection sampling of eta=4 secret coefficients
+  Signature: uint64_t mld_rej_uniform_eta4_aarch64_asm(int32_t r[256], const uint8_t *buf, unsigned buflen, const uint8_t table[4096])
+  ABI:
+    Architecture: aarch64
+    CallingConvention: AAPCS64
+    Features: [NEON]
+    x0:
+      type: buffer
+      size_bytes: 1024
+      permissions: write-only
+      c_parameter: int32_t r[256]
+      description: Output buffer (256 x int32_t)
+    x1:
+      type: buffer
+      size_bytes: x2
+      permissions: read-only
+      c_parameter: const uint8_t *buf
+      description: Input buffer
+    x2:
+      type: scalar
+      c_parameter: unsigned buflen
+      description: Length of input buffer (must be a multiple of 8)
+      test_with: 272  # MLD_AARCH64_REJ_UNIFORM_ETA4_BUFLEN
+    x3:
+      type: buffer
+      size_bytes: 4096
+      permissions: read-only
+      c_parameter: const uint8_t table[4096]
+      description: Lookup table (4096 x uint8_t)
+*/
+
 #include "../../../common.h"
 #if defined(MLD_ARITH_BACKEND_AARCH64) && \
     !defined(MLD_CONFIG_NO_KEYPAIR_API) && \
@@ -12,7 +45,7 @@
 
 /*
  * WARNING: This file is auto-derived from the mldsa-native source file
- *   dev/aarch64_opt/src/rej_uniform_eta4_aarch64_asm.S using scripts/simpasm. Do not modify it directly.
+ *   dev/aarch64_opt/src/mldsa_rej_uniform_eta4_aarch64_asm.S using scripts/simpasm. Do not modify it directly.
  */
 
 .text
@@ -40,21 +73,21 @@ MLD_ASM_FN_SYMBOL(rej_uniform_eta4_aarch64_asm)
         mov x11, #0x0               // =0
         eor v16.16b, v16.16b, v16.16b
 
-Lrej_uniform_eta4_initial_zero:
+Lmld_rej_uniform_eta4_initial_zero:
         str q16, [x7], #0x40
         stur q16, [x7, #-0x30]
         stur q16, [x7, #-0x20]
         stur q16, [x7, #-0x10]
         add x11, x11, #0x20
         cmp x11, #0x100
-        b.lt Lrej_uniform_eta4_initial_zero
+        b.lt Lmld_rej_uniform_eta4_initial_zero
         mov x7, x8
         mov x9, #0x0                // =0
         mov x4, #0x100              // =256
 
-Lrej_uniform_eta4_loop8:
+Lmld_rej_uniform_eta4_loop8:
         cmp x9, x4
-        b.hs Lrej_uniform_eta4_memory_copy
+        b.hs Lmld_rej_uniform_eta4_memory_copy
         sub x2, x2, #0x8
         ld1 { v0.8b }, [x1], #8
         movi v26.8b, #0xf
@@ -89,15 +122,15 @@ Lrej_uniform_eta4_loop8:
         add x12, x12, x13
         add x9, x9, x12
         cmp x2, #0x8
-        b.hs Lrej_uniform_eta4_loop8
+        b.hs Lmld_rej_uniform_eta4_loop8
 
-Lrej_uniform_eta4_memory_copy:
+Lmld_rej_uniform_eta4_memory_copy:
         cmp x9, x4
         csel x9, x9, x4, lo
         mov x11, #0x0               // =0
         mov x7, x8
 
-Lrej_uniform_eta4_final_copy:
+Lmld_rej_uniform_eta4_final_copy:
         ldr q16, [x7], #0x20
         ldur q18, [x7, #-0x10]
         sub v16.8h, v7.8h, v16.8h
@@ -112,7 +145,7 @@ Lrej_uniform_eta4_final_copy:
         stur q19, [x0, #-0x10]
         add x11, x11, #0x10
         cmp x11, #0x100
-        b.lt Lrej_uniform_eta4_final_copy
+        b.lt Lmld_rej_uniform_eta4_final_copy
         mov x0, x9
         add sp, sp, #0x240
         .cfi_adjust_cfa_offset -0x240

data/ext/pqcrypto/vendor/mldsa-native/mldsa/src/native/api.h

@@ -37,11 +37,17 @@
  */
 #define MLD_NATIVE_FUNC_FALLBACK (-1)
 
+/* Absolute exclusive upper bound for the output of fqmul.
+ *
+ * NOTE: This is the same bound as in poly.h and has to be kept
+ * in sync. */
+#define MLD_FQMUL_BOUND ((5 * MLDSA_Q + 3) / 4)
+
 /* Bound on absolute value of coefficients after NTT.
  *
  * NOTE: This is the same bound as in poly.h and has to be kept
  * in sync. */
-#define MLD_NTT_BOUND (9 * MLDSA_Q)
+#define MLD_NTT_BOUND (9 * MLD_FQMUL_BOUND)
 
 /* Absolute exclusive upper bound for the output of the inverse NTT
  *
@@ -215,7 +221,8 @@ __contract__(
   requires(memory_no_alias(buf, buflen))
   assigns(memory_slice(r, sizeof(int32_t) * len))
   ensures(return_value == MLD_NATIVE_FUNC_FALLBACK || (0 <= return_value && return_value <= len))
-  ensures((return_value != MLD_NATIVE_FUNC_FALLBACK) ==> (array_abs_bound(r, 0, return_value, MLDSA_ETA + 1)))
+  /* check-magic: 3 == 2 + 1 (decl gated on MLDSA_ETA == 2) */
+  ensures((return_value != MLD_NATIVE_FUNC_FALLBACK) ==> (array_abs_bound(r, 0, return_value, 3)))
 );
 #endif /* MLD_CONFIG_MULTILEVEL_WITH_SHARED || MLDSA_ETA == 2 */
 #endif /* MLD_USE_NATIVE_REJ_UNIFORM_ETA2 */
@@ -249,7 +256,8 @@ __contract__(
   requires(memory_no_alias(buf, buflen))
   assigns(memory_slice(r, sizeof(int32_t) * len))
   ensures(return_value == MLD_NATIVE_FUNC_FALLBACK || (0 <= return_value && return_value <= len))
-  ensures((return_value != MLD_NATIVE_FUNC_FALLBACK) ==> (array_abs_bound(r, 0, return_value, MLDSA_ETA + 1)))
+  /* check-magic: 5 == 4 + 1 (decl gated on MLDSA_ETA == 4) */
+  ensures((return_value != MLD_NATIVE_FUNC_FALLBACK) ==> (array_abs_bound(r, 0, return_value, 5)))
 );
 #endif /* MLD_CONFIG_MULTILEVEL_WITH_SHARED || MLDSA_ETA == 4 */
 #endif /* MLD_USE_NATIVE_REJ_UNIFORM_ETA4 */

data/ext/pqcrypto/vendor/mldsa-native/mldsa/src/native/meta.h

@@ -12,11 +12,12 @@
  */
 #include "../sys.h"
 
-#ifdef MLD_SYS_AARCH64
+#ifdef MLD_SYS_AARCH64_NEON
 #include "aarch64/meta.h"
 #endif
 
-#ifdef MLD_SYS_X86_64_AVX2
+/* The x86_64 backend requires toolchain support for the SysV ABI */
+#if defined(MLD_SYS_X86_64_AVX2) && defined(MLD_SYSV_ABI_SUPPORTED)
 #include "x86_64/meta.h"
 #endif