pq_crypto 0.6.4 → 0.6.6

data/ext/pqcrypto/vendor/mlkem-native/mlkem/src/kem.h

@@ -46,14 +46,24 @@
 
 #endif /* MLK_CHECK_APIS */
 
+#if !defined(MLK_CONFIG_NO_KEYPAIR_API)
 #define mlk_kem_keypair_derand \
   MLK_NAMESPACE_K(keypair_derand) MLK_CONTEXT_PARAMETERS_3
+#if !defined(MLK_CONFIG_NO_RANDOMIZED_API)
 #define mlk_kem_keypair MLK_NAMESPACE_K(keypair) MLK_CONTEXT_PARAMETERS_2
+#endif
+#endif /* !MLK_CONFIG_NO_KEYPAIR_API */
+#if !defined(MLK_CONFIG_NO_ENCAPS_API)
 #define mlk_kem_enc_derand MLK_NAMESPACE_K(enc_derand) MLK_CONTEXT_PARAMETERS_4
+#if !defined(MLK_CONFIG_NO_RANDOMIZED_API)
 #define mlk_kem_enc MLK_NAMESPACE_K(enc) MLK_CONTEXT_PARAMETERS_3
-#define mlk_kem_dec MLK_NAMESPACE_K(dec) MLK_CONTEXT_PARAMETERS_3
+#endif
 #define mlk_kem_check_pk MLK_NAMESPACE_K(check_pk) MLK_CONTEXT_PARAMETERS_1
+#endif /* !MLK_CONFIG_NO_ENCAPS_API */
+#if !defined(MLK_CONFIG_NO_DECAPS_API)
+#define mlk_kem_dec MLK_NAMESPACE_K(dec) MLK_CONTEXT_PARAMETERS_3
 #define mlk_kem_check_sk MLK_NAMESPACE_K(check_sk) MLK_CONTEXT_PARAMETERS_1
+#endif
 
 /**
  * Implements modulus check mandated by FIPS 203, i.e., ensures that
@@ -70,19 +80,21 @@
  *                    MLK_CONFIG_CONTEXT_PARAMETER_TYPE.
  *
  * @retval 0                     Success.
- * @retval MLK_ERR_FAIL          Modulus check failed.
+ * @retval MLK_ERR_INVALID_PK    Modulus check failed.
  * @retval MLK_ERR_OUT_OF_MEMORY MLK_CONFIG_CUSTOM_ALLOC_FREE was used and
  *                               MLK_CUSTOM_ALLOC returned NULL.
  */
+#if !defined(MLK_CONFIG_NO_ENCAPS_API)
 MLK_EXTERNAL_API
 MLK_MUST_CHECK_RETURN_VALUE
 int mlk_kem_check_pk(const uint8_t pk[MLKEM_INDCCA_PUBLICKEYBYTES],
                      MLK_CONFIG_CONTEXT_PARAMETER_TYPE context)
 __contract__(
   requires(memory_no_alias(pk, MLKEM_INDCCA_PUBLICKEYBYTES))
-  ensures(return_value == 0 || return_value == MLK_ERR_FAIL ||
+  ensures(return_value == 0 || return_value == MLK_ERR_INVALID_PK ||
           return_value == MLK_ERR_OUT_OF_MEMORY)
 );
+#endif /* !MLK_CONFIG_NO_ENCAPS_API */
 
 
 /**
@@ -100,20 +112,23 @@ __contract__(
  *                    MLK_CONFIG_CONTEXT_PARAMETER_TYPE.
  *
  * @retval 0                     Success.
- * @retval MLK_ERR_FAIL          Public key hash check failed.
+ * @retval MLK_ERR_INVALID_SK    Public key hash check failed.
  * @retval MLK_ERR_OUT_OF_MEMORY MLK_CONFIG_CUSTOM_ALLOC_FREE was used and
  *                               MLK_CUSTOM_ALLOC returned NULL.
  */
+#if !defined(MLK_CONFIG_NO_DECAPS_API)
 MLK_EXTERNAL_API
 MLK_MUST_CHECK_RETURN_VALUE
 int mlk_kem_check_sk(const uint8_t sk[MLKEM_INDCCA_SECRETKEYBYTES],
                      MLK_CONFIG_CONTEXT_PARAMETER_TYPE context)
 __contract__(
   requires(memory_no_alias(sk, MLKEM_INDCCA_SECRETKEYBYTES))
-  ensures(return_value == 0 || return_value == MLK_ERR_FAIL ||
+  ensures(return_value == 0 || return_value == MLK_ERR_INVALID_SK ||
           return_value == MLK_ERR_OUT_OF_MEMORY)
 );
+#endif /* !MLK_CONFIG_NO_DECAPS_API */
 
+#if !defined(MLK_CONFIG_NO_KEYPAIR_API)
 /**
  * Generate a public/private keypair for the ML-KEM key encapsulation mechanism.
  *
@@ -130,9 +145,11 @@ __contract__(
  *                     MLK_CONFIG_CONTEXT_PARAMETER_TYPE.
  *
  * @retval 0                     Success.
- * @retval MLK_ERR_FAIL          MLK_CONFIG_KEYGEN_PCT enabled and PCT failed.
+ * @retval MLK_ERR_PCT_FAIL      MLK_CONFIG_KEYGEN_PCT enabled and PCT failed.
  * @retval MLK_ERR_OUT_OF_MEMORY MLK_CONFIG_CUSTOM_ALLOC_FREE was used and
  *                               MLK_CUSTOM_ALLOC returned NULL.
+ * @retval MLK_ERR_RNG_FAIL      MLK_CONFIG_KEYGEN_PCT enabled and random
+ *                               number generation failed within the PCT.
  */
 MLK_EXTERNAL_API
 MLK_MUST_CHECK_RETURN_VALUE
@@ -146,11 +163,17 @@ __contract__(
   requires(memory_no_alias(coins, 2 * MLKEM_SYMBYTES))
   assigns(memory_slice(pk, MLKEM_INDCCA_PUBLICKEYBYTES))
   assigns(memory_slice(sk, MLKEM_INDCCA_SECRETKEYBYTES))
-  ensures(return_value == 0 || return_value == MLK_ERR_FAIL ||
+  ensures(return_value == 0 || return_value == MLK_ERR_PCT_FAIL ||
           return_value == MLK_ERR_OUT_OF_MEMORY ||
           return_value == MLK_ERR_RNG_FAIL)
+  /* Output buffers on error, per API-CONVENTIONS.md */
+  ensures(return_value != 0 ==>
+          array_unchanged_or_zeroized_u8(pk, MLKEM_INDCCA_PUBLICKEYBYTES))
+  ensures(return_value != 0 ==>
+          array_unchanged_or_zeroized_u8(sk, MLKEM_INDCCA_SECRETKEYBYTES))
 );
 
+#if !defined(MLK_CONFIG_NO_RANDOMIZED_API)
 /**
  * Generate a public/private keypair for the ML-KEM key encapsulation mechanism.
  *
@@ -168,7 +191,7 @@ __contract__(
  * @retval MLK_ERR_OUT_OF_MEMORY MLK_CONFIG_CUSTOM_ALLOC_FREE was used and
  *                               MLK_CUSTOM_ALLOC returned NULL.
  * @retval MLK_ERR_RNG_FAIL      Random number generation failed.
- * @retval MLK_ERR_FAIL          MLK_CONFIG_KEYGEN_PCT enabled and PCT failed.
+ * @retval MLK_ERR_PCT_FAIL      MLK_CONFIG_KEYGEN_PCT enabled and PCT failed.
  */
 MLK_EXTERNAL_API
 MLK_MUST_CHECK_RETURN_VALUE
@@ -180,10 +203,17 @@ __contract__(
   requires(memory_no_alias(sk, MLKEM_INDCCA_SECRETKEYBYTES))
   assigns(memory_slice(pk, MLKEM_INDCCA_PUBLICKEYBYTES))
   assigns(memory_slice(sk, MLKEM_INDCCA_SECRETKEYBYTES))
-  ensures(return_value == 0 || return_value == MLK_ERR_FAIL ||
+  ensures(return_value == 0 || return_value == MLK_ERR_PCT_FAIL ||
           return_value == MLK_ERR_OUT_OF_MEMORY ||
           return_value == MLK_ERR_RNG_FAIL)
+  /* Output buffers on error, per API-CONVENTIONS.md */
+  ensures(return_value != 0 ==>
+          array_unchanged_or_zeroized_u8(pk, MLKEM_INDCCA_PUBLICKEYBYTES))
+  ensures(return_value != 0 ==>
+          array_unchanged_or_zeroized_u8(sk, MLKEM_INDCCA_SECRETKEYBYTES))
 );
+#endif /* !MLK_CONFIG_NO_RANDOMIZED_API */
+#endif /* !MLK_CONFIG_NO_KEYPAIR_API */
 
 /**
  * Generate ciphertext and shared secret for a given public key.
@@ -203,11 +233,12 @@ __contract__(
  *                     MLK_CONFIG_CONTEXT_PARAMETER_TYPE.
  *
  * @retval 0                     Success.
- * @retval MLK_ERR_FAIL          The 'modulus check' @[FIPS203, Section 7.2]
+ * @retval MLK_ERR_INVALID_PK    The 'modulus check' @[FIPS203, Section 7.2]
  *                               for the public key failed.
  * @retval MLK_ERR_OUT_OF_MEMORY MLK_CONFIG_CUSTOM_ALLOC_FREE was used and
  *                               MLK_CUSTOM_ALLOC returned NULL.
  */
+#if !defined(MLK_CONFIG_NO_ENCAPS_API)
 MLK_EXTERNAL_API
 MLK_MUST_CHECK_RETURN_VALUE
 int mlk_kem_enc_derand(uint8_t ct[MLKEM_INDCCA_CIPHERTEXTBYTES],
@@ -222,10 +253,16 @@ __contract__(
   requires(memory_no_alias(coins, MLKEM_SYMBYTES))
   assigns(memory_slice(ct, MLKEM_INDCCA_CIPHERTEXTBYTES))
   assigns(memory_slice(ss, MLKEM_SSBYTES))
-  ensures(return_value == 0 || return_value == MLK_ERR_FAIL ||
+  ensures(return_value == 0 || return_value == MLK_ERR_INVALID_PK ||
           return_value == MLK_ERR_OUT_OF_MEMORY)
+  /* Output buffers on error, per API-CONVENTIONS.md */
+  ensures(return_value != 0 ==>
+          array_unchanged_or_zeroized_u8(ct, MLKEM_INDCCA_CIPHERTEXTBYTES))
+  ensures(return_value != 0 ==>
+          array_unchanged_or_zeroized_u8(ss, MLKEM_SSBYTES))
 );
 
+#if !defined(MLK_CONFIG_NO_RANDOMIZED_API)
 /**
  * Generate ciphertext and shared secret for a given public key.
  *
@@ -245,7 +282,7 @@ __contract__(
  * @retval MLK_ERR_OUT_OF_MEMORY MLK_CONFIG_CUSTOM_ALLOC_FREE was used and
  *                               MLK_CUSTOM_ALLOC returned NULL.
  * @retval MLK_ERR_RNG_FAIL      Random number generation failed.
- * @retval MLK_ERR_FAIL          The 'modulus check' @[FIPS203, Section 7.2]
+ * @retval MLK_ERR_INVALID_PK    The 'modulus check' @[FIPS203, Section 7.2]
  *                               for the public key failed.
  */
 MLK_EXTERNAL_API
@@ -260,10 +297,17 @@ __contract__(
   requires(memory_no_alias(pk, MLKEM_INDCCA_PUBLICKEYBYTES))
   assigns(memory_slice(ct, MLKEM_INDCCA_CIPHERTEXTBYTES))
   assigns(memory_slice(ss, MLKEM_SSBYTES))
-  ensures(return_value == 0 || return_value == MLK_ERR_FAIL ||
+  ensures(return_value == 0 || return_value == MLK_ERR_INVALID_PK ||
           return_value == MLK_ERR_OUT_OF_MEMORY ||
           return_value == MLK_ERR_RNG_FAIL)
+  /* Output buffers on error, per API-CONVENTIONS.md */
+  ensures(return_value != 0 ==>
+          array_unchanged_or_zeroized_u8(ct, MLKEM_INDCCA_CIPHERTEXTBYTES))
+  ensures(return_value != 0 ==>
+          array_unchanged_or_zeroized_u8(ss, MLKEM_SSBYTES))
 );
+#endif /* !MLK_CONFIG_NO_RANDOMIZED_API */
+#endif /* !MLK_CONFIG_NO_ENCAPS_API */
 
 /**
  * Generate shared secret for a given ciphertext and private key.
@@ -281,11 +325,12 @@ __contract__(
  *                     MLK_CONFIG_CONTEXT_PARAMETER_TYPE.
  *
  * @retval 0                     Success.
- * @retval MLK_ERR_FAIL          The 'hash check' @[FIPS203, Section 7.3]
+ * @retval MLK_ERR_INVALID_SK    The 'hash check' @[FIPS203, Section 7.3]
  *                               for the secret key failed.
  * @retval MLK_ERR_OUT_OF_MEMORY MLK_CONFIG_CUSTOM_ALLOC_FREE was used and
  *                               MLK_CUSTOM_ALLOC returned NULL.
  */
+#if !defined(MLK_CONFIG_NO_DECAPS_API)
 MLK_EXTERNAL_API
 MLK_MUST_CHECK_RETURN_VALUE
 int mlk_kem_dec(uint8_t ss[MLKEM_SSBYTES],
@@ -297,8 +342,12 @@ __contract__(
   requires(memory_no_alias(ct, MLKEM_INDCCA_CIPHERTEXTBYTES))
   requires(memory_no_alias(sk, MLKEM_INDCCA_SECRETKEYBYTES))
   assigns(memory_slice(ss, MLKEM_SSBYTES))
-  ensures(return_value == 0 || return_value == MLK_ERR_FAIL ||
+  ensures(return_value == 0 || return_value == MLK_ERR_INVALID_SK ||
           return_value == MLK_ERR_OUT_OF_MEMORY)
+  /* Output buffers on error, per API-CONVENTIONS.md */
+  ensures(return_value != 0 ==>
+          array_unchanged_or_zeroized_u8(ss, MLKEM_SSBYTES))
 );
+#endif /* !MLK_CONFIG_NO_DECAPS_API */
 
 #endif /* !MLK_KEM_H */

data/ext/pqcrypto/vendor/mlkem-native/mlkem/src/native/aarch64/meta.h

@@ -28,37 +28,61 @@
 MLK_MUST_CHECK_RETURN_VALUE
 static MLK_INLINE int mlk_ntt_native(int16_t data[MLKEM_N])
 {
+  if (!mlk_sys_check_capability(MLK_SYS_CAP_AARCH64_NEON))
+  {
+    return MLK_NATIVE_FUNC_FALLBACK;
+  }
   mlk_ntt_aarch64_asm(data, mlk_aarch64_ntt_zetas_layer12345,
                       mlk_aarch64_ntt_zetas_layer67);
   return MLK_NATIVE_FUNC_SUCCESS;
 }
 
+#if !defined(MLK_CONFIG_NO_ENCAPS_API) || !defined(MLK_CONFIG_NO_DECAPS_API)
 MLK_MUST_CHECK_RETURN_VALUE
 static MLK_INLINE int mlk_intt_native(int16_t data[MLKEM_N])
 {
+  if (!mlk_sys_check_capability(MLK_SYS_CAP_AARCH64_NEON))
+  {
+    return MLK_NATIVE_FUNC_FALLBACK;
+  }
   mlk_intt_aarch64_asm(data, mlk_aarch64_invntt_zetas_layer12345,
                        mlk_aarch64_invntt_zetas_layer67);
   return MLK_NATIVE_FUNC_SUCCESS;
 }
+#endif /* !MLK_CONFIG_NO_ENCAPS_API || !MLK_CONFIG_NO_DECAPS_API */
 
 MLK_MUST_CHECK_RETURN_VALUE
 static MLK_INLINE int mlk_poly_reduce_native(int16_t data[MLKEM_N])
 {
+  if (!mlk_sys_check_capability(MLK_SYS_CAP_AARCH64_NEON))
+  {
+    return MLK_NATIVE_FUNC_FALLBACK;
+  }
   mlk_poly_reduce_aarch64_asm(data);
   return MLK_NATIVE_FUNC_SUCCESS;
 }
 
+#if !defined(MLK_CONFIG_NO_KEYPAIR_API)
 MLK_MUST_CHECK_RETURN_VALUE
 static MLK_INLINE int mlk_poly_tomont_native(int16_t data[MLKEM_N])
 {
+  if (!mlk_sys_check_capability(MLK_SYS_CAP_AARCH64_NEON))
+  {
+    return MLK_NATIVE_FUNC_FALLBACK;
+  }
   mlk_poly_tomont_aarch64_asm(data);
   return MLK_NATIVE_FUNC_SUCCESS;
 }
+#endif /* !MLK_CONFIG_NO_KEYPAIR_API */
 
 MLK_MUST_CHECK_RETURN_VALUE
 static MLK_INLINE int mlk_poly_mulcache_compute_native(int16_t x[MLKEM_N / 2],
                                                        const int16_t y[MLKEM_N])
 {
+  if (!mlk_sys_check_capability(MLK_SYS_CAP_AARCH64_NEON))
+  {
+    return MLK_NATIVE_FUNC_FALLBACK;
+  }
   mlk_poly_mulcache_compute_aarch64_asm(
       x, y, mlk_aarch64_zetas_mulcache_native,
       mlk_aarch64_zetas_mulcache_twisted_native);
@@ -71,6 +95,10 @@ static MLK_INLINE int mlk_polyvec_basemul_acc_montgomery_cached_k2_native(
     int16_t r[MLKEM_N], const int16_t a[2 * MLKEM_N],
     const int16_t b[2 * MLKEM_N], const int16_t b_cache[2 * (MLKEM_N / 2)])
 {
+  if (!mlk_sys_check_capability(MLK_SYS_CAP_AARCH64_NEON))
+  {
+    return MLK_NATIVE_FUNC_FALLBACK;
+  }
   mlk_polyvec_basemul_acc_montgomery_cached_k2_aarch64_asm(r, a, b, b_cache);
   return MLK_NATIVE_FUNC_SUCCESS;
 }
@@ -82,6 +110,10 @@ static MLK_INLINE int mlk_polyvec_basemul_acc_montgomery_cached_k3_native(
     int16_t r[MLKEM_N], const int16_t a[3 * MLKEM_N],
     const int16_t b[3 * MLKEM_N], const int16_t b_cache[3 * (MLKEM_N / 2)])
 {
+  if (!mlk_sys_check_capability(MLK_SYS_CAP_AARCH64_NEON))
+  {
+    return MLK_NATIVE_FUNC_FALLBACK;
+  }
   mlk_polyvec_basemul_acc_montgomery_cached_k3_aarch64_asm(r, a, b, b_cache);
   return MLK_NATIVE_FUNC_SUCCESS;
 }
@@ -93,26 +125,36 @@ static MLK_INLINE int mlk_polyvec_basemul_acc_montgomery_cached_k4_native(
     int16_t r[MLKEM_N], const int16_t a[4 * MLKEM_N],
     const int16_t b[4 * MLKEM_N], const int16_t b_cache[4 * (MLKEM_N / 2)])
 {
+  if (!mlk_sys_check_capability(MLK_SYS_CAP_AARCH64_NEON))
+  {
+    return MLK_NATIVE_FUNC_FALLBACK;
+  }
   mlk_polyvec_basemul_acc_montgomery_cached_k4_aarch64_asm(r, a, b, b_cache);
   return MLK_NATIVE_FUNC_SUCCESS;
 }
 #endif /* MLK_CONFIG_MULTILEVEL_WITH_SHARED || MLKEM_K == 4 */
 
+#if !defined(MLK_CONFIG_NO_KEYPAIR_API) || !defined(MLK_CONFIG_NO_ENCAPS_API)
 MLK_MUST_CHECK_RETURN_VALUE
 static MLK_INLINE int mlk_poly_tobytes_native(uint8_t r[MLKEM_POLYBYTES],
                                               const int16_t a[MLKEM_N])
 {
+  if (!mlk_sys_check_capability(MLK_SYS_CAP_AARCH64_NEON))
+  {
+    return MLK_NATIVE_FUNC_FALLBACK;
+  }
   mlk_poly_tobytes_aarch64_asm(r, a);
   return MLK_NATIVE_FUNC_SUCCESS;
 }
+#endif /* !MLK_CONFIG_NO_KEYPAIR_API || !MLK_CONFIG_NO_ENCAPS_API */
 
 MLK_MUST_CHECK_RETURN_VALUE
 static MLK_INLINE int mlk_rej_uniform_native(int16_t *r, unsigned len,
                                              const uint8_t *buf,
                                              unsigned buflen)
 {
-  if (len != MLKEM_N ||
-      buflen % 24 != 0) /* NEON support is mandatory for AArch64 */
+  if (!mlk_sys_check_capability(MLK_SYS_CAP_AARCH64_NEON) || len != MLKEM_N ||
+      buflen % 24 != 0)
   {
     return MLK_NATIVE_FUNC_FALLBACK;
   }

data/ext/pqcrypto/vendor/mlkem-native/mlkem/src/native/aarch64/src/aarch64_zetas.c

@@ -79,6 +79,7 @@ MLK_ALIGN MLK_INTERNAL_DATA_DEFINITION const int16_t
         10129,  10129,  -3878,  -3878,  -11566, -11566,
 };
 
+#if !defined(MLK_CONFIG_NO_ENCAPS_API) || !defined(MLK_CONFIG_NO_DECAPS_API)
 MLK_ALIGN MLK_INTERNAL_DATA_DEFINITION const int16_t
     mlk_aarch64_invntt_zetas_layer12345[80] = {
         1583,  15582, -821,   -8081,  1355,  13338, 0,      0,     -569,
@@ -138,6 +139,7 @@ MLK_ALIGN MLK_INTERNAL_DATA_DEFINITION const int16_t
         1041,   -1637,  -1637,  -583,   -583,   -17,    -17,    10247,  10247,
         -16113, -16113, -5739,  -5739,  -167,   -167,
 };
+#endif /* !MLK_CONFIG_NO_ENCAPS_API || !MLK_CONFIG_NO_DECAPS_API */
 
 MLK_ALIGN MLK_INTERNAL_DATA_DEFINITION const int16_t
     mlk_aarch64_zetas_mulcache_native[128] = {

data/ext/pqcrypto/vendor/mlkem-native/mlkem/src/native/aarch64/src/arith_native_aarch64.h

@@ -38,7 +38,7 @@ MLK_INTERNAL_DATA_DECLARATION const uint8_t mlk_rej_uniform_table[4096];
 void mlk_ntt_aarch64_asm(int16_t p[256], const int16_t twiddles12345[80],
                          const int16_t twiddles56[384])
 /* This must be kept in sync with the HOL-Light specification
- * in proofs/hol_light/aarch64/proofs/ntt_aarch64_asm.ml */
+ * in proofs/hol_light/aarch64/proofs/mlkem_ntt_aarch64_asm.ml */
 __contract__(
   requires(memory_no_alias(p, sizeof(int16_t) * MLKEM_N))
   requires(array_abs_bound(p, 0, MLKEM_N, 8192))
@@ -54,7 +54,7 @@ __contract__(
 void mlk_intt_aarch64_asm(int16_t p[256], const int16_t twiddles12345[80],
                           const int16_t twiddles56[384])
 /* This must be kept in sync with the HOL-Light specification
- * in proofs/hol_light/aarch64/proofs/intt_aarch64_asm.ml */
+ * in proofs/hol_light/aarch64/proofs/mlkem_intt_aarch64_asm.ml */
 __contract__(
   requires(memory_no_alias(p, sizeof(int16_t) * MLKEM_N))
   requires(twiddles12345 == mlk_aarch64_invntt_zetas_layer12345)
@@ -68,7 +68,7 @@ __contract__(
 #define mlk_poly_reduce_aarch64_asm MLK_NAMESPACE(poly_reduce_aarch64_asm)
 void mlk_poly_reduce_aarch64_asm(int16_t p[256])
 /* This must be kept in sync with the HOL-Light specification
- * in proofs/hol_light/aarch64/proofs/poly_reduce_aarch64_asm.ml */
+ * in proofs/hol_light/aarch64/proofs/mlkem_poly_reduce_aarch64_asm.ml */
 __contract__(
   requires(memory_no_alias(p, sizeof(int16_t) * MLKEM_N))
   assigns(memory_slice(p, sizeof(int16_t) * MLKEM_N))
@@ -78,7 +78,7 @@ __contract__(
 #define mlk_poly_tomont_aarch64_asm MLK_NAMESPACE(poly_tomont_aarch64_asm)
 void mlk_poly_tomont_aarch64_asm(int16_t p[256])
 /* This must be kept in sync with the HOL-Light specification
- * in proofs/hol_light/aarch64/proofs/poly_tomont_aarch64_asm.ml */
+ * in proofs/hol_light/aarch64/proofs/mlkem_poly_tomont_aarch64_asm.ml */
 __contract__(
   requires(memory_no_alias(p, sizeof(int16_t) * MLKEM_N))
   assigns(memory_slice(p, sizeof(int16_t) * MLKEM_N))
@@ -92,7 +92,8 @@ void mlk_poly_mulcache_compute_aarch64_asm(int16_t cache[128],
                                            const int16_t zetas[128],
                                            const int16_t zetas_twisted[128])
 /* This must be kept in sync with the HOL-Light specification
- * in proofs/hol_light/aarch64/proofs/poly_mulcache_compute_aarch64_asm.ml */
+ * in proofs/hol_light/aarch64/proofs/mlkem_poly_mulcache_compute_aarch64_asm.ml
+ */
 __contract__(
   requires(memory_no_alias(cache, sizeof(int16_t) * (MLKEM_N / 2)))
   requires(memory_no_alias(mlk_poly, sizeof(int16_t) * MLKEM_N))
@@ -105,7 +106,7 @@ __contract__(
 #define mlk_poly_tobytes_aarch64_asm MLK_NAMESPACE(poly_tobytes_aarch64_asm)
 void mlk_poly_tobytes_aarch64_asm(uint8_t r[384], const int16_t a[256])
 /* This must be kept in sync with the HOL-Light specification
- * in proofs/hol_light/aarch64/proofs/poly_tobytes_aarch64_asm.ml */
+ * in proofs/hol_light/aarch64/proofs/mlkem_poly_tobytes_aarch64_asm.ml */
 __contract__(
   requires(memory_no_alias(r, MLKEM_POLYBYTES))
   requires(memory_no_alias(a, sizeof(int16_t) * MLKEM_N))
@@ -119,7 +120,7 @@ void mlk_polyvec_basemul_acc_montgomery_cached_k2_aarch64_asm(
     int16_t r[256], const int16_t a[512], const int16_t b[512],
     const int16_t b_cache[256])
 /* This must be kept in sync with the HOL-Light specification in
- * proofs/hol_light/aarch64/proofs/polyvec_basemul_acc_montgomery_cached_k2_aarch64_asm.ml.
+ * proofs/hol_light/aarch64/proofs/mlkem_polyvec_basemul_acc_montgomery_cached_k2_aarch64_asm.ml.
  */
 __contract__(
     requires(memory_no_alias(r, sizeof(int16_t) * MLKEM_N))
@@ -136,7 +137,7 @@ void mlk_polyvec_basemul_acc_montgomery_cached_k3_aarch64_asm(
     int16_t r[256], const int16_t a[768], const int16_t b[768],
     const int16_t b_cache[384])
 /* This must be kept in sync with the HOL-Light specification in
- * proofs/hol_light/aarch64/proofs/polyvec_basemul_acc_montgomery_cached_k3_aarch64_asm.ml.
+ * proofs/hol_light/aarch64/proofs/mlkem_polyvec_basemul_acc_montgomery_cached_k3_aarch64_asm.ml.
  */
 __contract__(
     requires(memory_no_alias(r, sizeof(int16_t) * MLKEM_N))
@@ -153,7 +154,7 @@ void mlk_polyvec_basemul_acc_montgomery_cached_k4_aarch64_asm(
     int16_t r[256], const int16_t a[1024], const int16_t b[1024],
     const int16_t b_cache[512])
 /* This must be kept in sync with the HOL-Light specification in
- * proofs/hol_light/aarch64/proofs/polyvec_basemul_acc_montgomery_cached_k4_aarch64_asm.ml.
+ * proofs/hol_light/aarch64/proofs/mlkem_polyvec_basemul_acc_montgomery_cached_k4_aarch64_asm.ml.
  */
 __contract__(
     requires(memory_no_alias(r, sizeof(int16_t) * MLKEM_N))
@@ -169,7 +170,7 @@ MLK_MUST_CHECK_RETURN_VALUE
 uint64_t mlk_rej_uniform_aarch64_asm(int16_t r[256], const uint8_t *buf,
                                      unsigned buflen, const uint8_t table[4096])
 /* This must be kept in sync with the HOL-Light specification
- * in proofs/hol_light/aarch64/proofs/rej_uniform_aarch64_asm.ml. */
+ * in proofs/hol_light/aarch64/proofs/mlkem_rej_uniform_aarch64_asm.ml. */
 __contract__(
     requires(buflen % 24 == 0)
     requires(memory_no_alias(buf, buflen))

data/ext/pqcrypto/vendor/mlkem-native/mlkem/src/native/aarch64/src/{intt_aarch64_asm.S → mlkem_intt_aarch64_asm.S}

@@ -24,6 +24,9 @@
   Description: AArch64 ML-KEM inverse NTT following @[NeonNTT] and @[SLOTHY_Paper]
   Signature: void mlk_intt_aarch64_asm(int16_t p[256], const int16_t twiddles12345[80], const int16_t twiddles56[384])
   ABI:
+    Architecture: aarch64
+    CallingConvention: AAPCS64
+    Features: [NEON]
     x0:
       type: buffer
       size_bytes: 512
@@ -48,11 +51,14 @@
 */
 
 #include "../../../common.h"
-#if defined(MLK_ARITH_BACKEND_AARCH64) &&  !defined(MLK_CONFIG_MULTILEVEL_NO_SHARED)
+#if defined(MLK_ARITH_BACKEND_AARCH64) && \
+    !defined(MLK_CONFIG_MULTILEVEL_NO_SHARED) && \
+    (!defined(MLK_CONFIG_NO_ENCAPS_API) || \
+     !defined(MLK_CONFIG_NO_DECAPS_API))
 
 /*
  * WARNING: This file is auto-derived from the mlkem-native source file
- *   dev/aarch64_opt/src/intt_aarch64_asm.S using scripts/simpasm. Do not modify it directly.
+ *   dev/aarch64_opt/src/mlkem_intt_aarch64_asm.S using scripts/simpasm. Do not modify it directly.
  */
 
 .text
@@ -200,7 +206,7 @@ MLK_ASM_FN_SYMBOL(intt_aarch64_asm)
         mls v24.8h, v19.8h, v7.h[0]
         sub x4, x4, #0x2
 
-Lintt_layer4567_start:
+Lmlk_intt_layer4567_start:
         add v16.8h, v21.8h, v10.8h
         mul v18.8h, v6.8h, v15.8h
         sub v19.8h, v20.8h, v25.8h
@@ -293,8 +299,8 @@ Lintt_layer4567_start:
         sqrdmulh v31.8h, v8.8h, v11.h[5]
         sub v14.8h, v21.8h, v10.8h
         stur q0, [x3, #-0x30]
-        subs x4, x4, #0x1
-        cbnz x4, Lintt_layer4567_start
+        sub x4, x4, #0x1
+        cbnz x4, Lmlk_intt_layer4567_start
         mul v15.8h, v6.8h, v15.8h
         sub v22.8h, v20.8h, v25.8h
         add v4.8h, v21.8h, v10.8h
@@ -442,7 +448,7 @@ Lintt_layer4567_start:
         sqrdmulh v10.8h, v10.8h, v0.h[1]
         sub x4, x4, #0x2
 
-Lintt_layer123_start:
+Lmlk_intt_layer123_start:
         sub v12.8h, v3.8h, v30.8h
         mul v11.8h, v21.8h, v1.h[0]
         add v28.8h, v4.8h, v8.8h
@@ -519,8 +525,8 @@ Lintt_layer123_start:
         sqrdmulh v9.8h, v13.8h, v0.h[1]
         str q17, [x0, #0x130]
         mul v17.8h, v19.8h, v0.h[0]
-        subs x4, x4, #0x1
-        cbnz x4, Lintt_layer123_start
+        sub x4, x4, #0x1
+        cbnz x4, Lmlk_intt_layer123_start
         mls v23.8h, v10.8h, v7.h[0]
         ldr q11, [x0, #0x190]
         str q18, [x0, #0x100]
@@ -621,7 +627,8 @@ Lintt_layer123_start:
 
 MLK_ASM_FN_SIZE(intt_aarch64_asm)
 
-#endif /* MLK_ARITH_BACKEND_AARCH64 && !MLK_CONFIG_MULTILEVEL_NO_SHARED */
+#endif /* MLK_ARITH_BACKEND_AARCH64 && !MLK_CONFIG_MULTILEVEL_NO_SHARED && \
+          (!MLK_CONFIG_NO_ENCAPS_API || !MLK_CONFIG_NO_DECAPS_API) */
 
 #if defined(__ELF__)
 .section .note.GNU-stack,"",%progbits

data/ext/pqcrypto/vendor/mlkem-native/mlkem/src/native/aarch64/src/{ntt_aarch64_asm.S → mlkem_ntt_aarch64_asm.S}

@@ -24,6 +24,9 @@
   Description: AArch64 ML-KEM forward NTT following @[NeonNTT] and @[SLOTHY_Paper]
   Signature: void mlk_ntt_aarch64_asm(int16_t p[256], const int16_t twiddles12345[80], const int16_t twiddles56[384])
   ABI:
+    Architecture: aarch64
+    CallingConvention: AAPCS64
+    Features: [NEON]
     x0:
       type: buffer
       size_bytes: 512
@@ -52,7 +55,7 @@
 
 /*
  * WARNING: This file is auto-derived from the mlkem-native source file
- *   dev/aarch64_opt/src/ntt_aarch64_asm.S using scripts/simpasm. Do not modify it directly.
+ *   dev/aarch64_opt/src/mlkem_ntt_aarch64_asm.S using scripts/simpasm. Do not modify it directly.
  */
 
 .text
@@ -144,7 +147,7 @@ MLK_ASM_FN_SYMBOL(ntt_aarch64_asm)
         mul v4.8h, v5.8h, v1.h[0]
         sub x4, x4, #0x2
 
-Lntt_layer123_start:
+Lmlk_ntt_layer123_start:
         mls v23.8h, v15.8h, v7.h[0]
         ldr q6, [x0, #0x190]
         ldr q15, [x0, #0x90]
@@ -221,8 +224,8 @@ Lntt_layer123_start:
         add v28.8h, v13.8h, v23.8h
         sub v13.8h, v13.8h, v23.8h
         mul v23.8h, v20.8h, v0.h[2]
-        subs x4, x4, #0x1
-        cbnz x4, Lntt_layer123_start
+        sub x4, x4, #0x1
+        cbnz x4, Lmlk_ntt_layer123_start
         sqrdmulh v3.8h, v5.8h, v1.h[1]
         mls v23.8h, v15.8h, v7.h[0]
         ldr q5, [x0, #0x190]
@@ -396,7 +399,7 @@ Lntt_layer123_start:
         mls v23.8h, v16.8h, v7.h[0]
         sub x4, x4, #0x2
 
-Lntt_layer4567_start:
+Lmlk_ntt_layer4567_start:
         ldr q19, [x2, #0x50]
         sub v31.8h, v30.8h, v23.8h
         mls v0.8h, v29.8h, v7.h[0]
@@ -468,8 +471,8 @@ Lntt_layer4567_start:
         sub v30.8h, v21.8h, v17.8h
         mul v0.8h, v16.8h, v1.8h
         trn1 v28.4s, v6.4s, v12.4s
-        subs x4, x4, #0x1
-        cbnz x4, Lntt_layer4567_start
+        sub x4, x4, #0x1
+        cbnz x4, Lmlk_ntt_layer4567_start
         add v22.8h, v11.8h, v8.8h
         mul v27.8h, v27.8h, v4.h[2]
         trn2 v17.4s, v6.4s, v12.4s

data/ext/pqcrypto/vendor/mlkem-native/mlkem/src/native/aarch64/src/{poly_mulcache_compute_aarch64_asm.S → mlkem_poly_mulcache_compute_aarch64_asm.S}

@@ -8,6 +8,9 @@
   Description: Compute multiplication cache for polynomial
   Signature: void mlk_poly_mulcache_compute_aarch64_asm(int16_t cache[128], const int16_t mlk_poly[256], const int16_t zetas[128], const int16_t zetas_twisted[128])
   ABI:
+    Architecture: aarch64
+    CallingConvention: AAPCS64
+    Features: [NEON]
     x0:
       type: buffer
       size_bytes: 256
@@ -41,7 +44,7 @@
 
 /*
  * WARNING: This file is auto-derived from the mlkem-native source file
- *   dev/aarch64_opt/src/poly_mulcache_compute_aarch64_asm.S using scripts/simpasm. Do not modify it directly.
+ *   dev/aarch64_opt/src/mlkem_poly_mulcache_compute_aarch64_asm.S using scripts/simpasm. Do not modify it directly.
  */
 
 .text
@@ -79,7 +82,7 @@ MLK_ASM_FN_SYMBOL(poly_mulcache_compute_aarch64_asm)
         lsr x4, x4, #1
         sub x4, x4, #0x2
 
-Lpoly_mulcache_compute_loop_start:
+Lmlk_poly_mulcache_compute_loop_start:
         str q5, [x0], #0x10
         sqrdmulh v22.8h, v29.8h, v17.8h
         ldr q28, [x2], #0x10
@@ -99,7 +102,7 @@ Lpoly_mulcache_compute_loop_start:
         str q26, [x0], #0x10
         mul v26.8h, v23.8h, v18.8h
         subs x4, x4, #0x1
-        cbnz x4, Lpoly_mulcache_compute_loop_start
+        cbnz x4, Lmlk_poly_mulcache_compute_loop_start
         mls v26.8h, v4.8h, v6.h[0]
         str q5, [x0], #0x10
         ldr q5, [x2], #0x10

data/ext/pqcrypto/vendor/mlkem-native/mlkem/src/native/aarch64/src/{poly_reduce_aarch64_asm.S → mlkem_poly_reduce_aarch64_asm.S}

@@ -8,6 +8,9 @@
   Description: Barrett reduction of polynomial coefficients
   Signature: void mlk_poly_reduce_aarch64_asm(int16_t p[256])
   ABI:
+    Architecture: aarch64
+    CallingConvention: AAPCS64
+    Features: [NEON]
     x0:
       type: buffer
       size_bytes: 512
@@ -23,7 +26,7 @@
 
 /*
  * WARNING: This file is auto-derived from the mlkem-native source file
- *   dev/aarch64_opt/src/poly_reduce_aarch64_asm.S using scripts/simpasm. Do not modify it directly.
+ *   dev/aarch64_opt/src/mlkem_poly_reduce_aarch64_asm.S using scripts/simpasm. Do not modify it directly.
  */
 
 .text
@@ -64,7 +67,7 @@ MLK_ASM_FN_SYMBOL(poly_reduce_aarch64_asm)
         and v31.16b, v3.16b, v31.16b
         sub x1, x1, #0x2
 
-Lpoly_reduce_loop_start:
+Lmlk_poly_reduce_loop_start:
         add v21.8h, v18.8h, v21.8h
         ldur q18, [x0, #-0x20]
         add v25.8h, v0.8h, v31.8h
@@ -98,7 +101,7 @@ Lpoly_reduce_loop_start:
         and v31.16b, v3.16b, v20.16b
         sqdmulh v2.8h, v26.8h, v4.h[0]
         subs x1, x1, #0x1
-        cbnz x1, Lpoly_reduce_loop_start
+        cbnz x1, Lmlk_poly_reduce_loop_start
         add v28.8h, v0.8h, v31.8h
         ldur q29, [x0, #-0x10]
         add v21.8h, v18.8h, v21.8h