pq_crypto 0.6.4 → 0.6.6

data/ext/pqcrypto/vendor/mlkem-native/mlkem/src/native/x86_64/src/{polyvec_basemul_acc_montgomery_cached_k3_avx2_asm.S → mlkem_polyvec_basemul_acc_montgomery_cached_k3_avx2_asm.S}

@@ -7,10 +7,44 @@
 #if defined(MLK_ARITH_BACKEND_X86_64_DEFAULT) && \
     !defined(MLK_CONFIG_MULTILEVEL_NO_SHARED) && \
     (defined(MLK_CONFIG_MULTILEVEL_WITH_SHARED) || MLKEM_K == 3)
+/*yaml
+  Name: polyvec_basemul_acc_montgomery_cached_k3_avx2_asm
+  Description: x86_64 AVX2 base multiplication with accumulation (k=3)
+  Signature: void mlk_polyvec_basemul_acc_montgomery_cached_k3_avx2_asm(int16_t *r, const int16_t *a, const int16_t *b, const int16_t *b_cache)
+  ABI:
+    Architecture: x86_64
+    CallingConvention: SysV
+    Features: [AVX2]
+    rdi:
+      type: buffer
+      size_bytes: 512
+      permissions: read/write
+      c_parameter: int16_t *r
+      description: Output polynomial (256 x int16_t)
+    rsi:
+      type: buffer
+      size_bytes: 1536
+      permissions: read-only
+      c_parameter: const int16_t *a
+      description: Input polyvec a (3 x 256 x int16_t)
+    rdx:
+      type: buffer
+      size_bytes: 1536
+      permissions: read-only
+      c_parameter: const int16_t *b
+      description: Input polyvec b (3 x 256 x int16_t)
+    rcx:
+      type: buffer
+      size_bytes: 768
+      permissions: read-only
+      c_parameter: const int16_t *b_cache
+      description: Mulcache for b (3 x 128 x int16_t)
+*/
+
 
 /*
  * WARNING: This file is auto-derived from the mlkem-native source file
- *   dev/x86_64/src/polyvec_basemul_acc_montgomery_cached_k3_avx2_asm.S using scripts/simpasm. Do not modify it directly.
+ *   dev/x86_64/src/mlkem_polyvec_basemul_acc_montgomery_cached_k3_avx2_asm.S using scripts/simpasm. Do not modify it directly.
  */
 
 .text

data/ext/pqcrypto/vendor/mlkem-native/mlkem/src/native/x86_64/src/{polyvec_basemul_acc_montgomery_cached_k4_avx2_asm.S → mlkem_polyvec_basemul_acc_montgomery_cached_k4_avx2_asm.S}

@@ -7,10 +7,44 @@
 #if defined(MLK_ARITH_BACKEND_X86_64_DEFAULT) && \
     !defined(MLK_CONFIG_MULTILEVEL_NO_SHARED) && \
     (defined(MLK_CONFIG_MULTILEVEL_WITH_SHARED) || MLKEM_K == 4)
+/*yaml
+  Name: polyvec_basemul_acc_montgomery_cached_k4_avx2_asm
+  Description: x86_64 AVX2 base multiplication with accumulation (k=4)
+  Signature: void mlk_polyvec_basemul_acc_montgomery_cached_k4_avx2_asm(int16_t *r, const int16_t *a, const int16_t *b, const int16_t *b_cache)
+  ABI:
+    Architecture: x86_64
+    CallingConvention: SysV
+    Features: [AVX2]
+    rdi:
+      type: buffer
+      size_bytes: 512
+      permissions: read/write
+      c_parameter: int16_t *r
+      description: Output polynomial (256 x int16_t)
+    rsi:
+      type: buffer
+      size_bytes: 2048
+      permissions: read-only
+      c_parameter: const int16_t *a
+      description: Input polyvec a (4 x 256 x int16_t)
+    rdx:
+      type: buffer
+      size_bytes: 2048
+      permissions: read-only
+      c_parameter: const int16_t *b
+      description: Input polyvec b (4 x 256 x int16_t)
+    rcx:
+      type: buffer
+      size_bytes: 1024
+      permissions: read-only
+      c_parameter: const int16_t *b_cache
+      description: Mulcache for b (4 x 128 x int16_t)
+*/
+
 
 /*
  * WARNING: This file is auto-derived from the mlkem-native source file
- *   dev/x86_64/src/polyvec_basemul_acc_montgomery_cached_k4_avx2_asm.S using scripts/simpasm. Do not modify it directly.
+ *   dev/x86_64/src/mlkem_polyvec_basemul_acc_montgomery_cached_k4_avx2_asm.S using scripts/simpasm. Do not modify it directly.
  */
 
 .text

data/ext/pqcrypto/vendor/mlkem-native/mlkem/src/native/x86_64/src/{reduce_avx2_asm.S → mlkem_reduce_avx2_asm.S}

@@ -27,10 +27,26 @@
 
 #if defined(MLK_ARITH_BACKEND_X86_64_DEFAULT) && \
     !defined(MLK_CONFIG_MULTILEVEL_NO_SHARED)
+/*yaml
+  Name: reduce_avx2_asm
+  Description: x86_64 AVX2 modular reduction
+  Signature: void mlk_reduce_avx2_asm(int16_t *r)
+  ABI:
+    Architecture: x86_64
+    CallingConvention: SysV
+    Features: [AVX2]
+    rdi:
+      type: buffer
+      size_bytes: 512
+      permissions: read/write
+      c_parameter: int16_t *r
+      description: Input/output polynomial (256 x int16_t)
+*/
+
 
 /*
  * WARNING: This file is auto-derived from the mlkem-native source file
- *   dev/x86_64/src/reduce_avx2_asm.S using scripts/simpasm. Do not modify it directly.
+ *   dev/x86_64/src/mlkem_reduce_avx2_asm.S using scripts/simpasm. Do not modify it directly.
  */
 
 .text

data/ext/pqcrypto/vendor/mlkem-native/mlkem/src/native/x86_64/src/{rej_uniform_avx2_asm.S → mlkem_rej_uniform_avx2_asm.S}

@@ -22,10 +22,43 @@
 
 #if defined(MLK_ARITH_BACKEND_X86_64_DEFAULT) && \
     !defined(MLK_CONFIG_MULTILEVEL_NO_SHARED)
+/*yaml
+  Name: rej_uniform_avx2_asm
+  Description: x86_64 AVX2 rejection sampling
+  Signature: uint64_t mlk_rej_uniform_avx2_asm(int16_t *r, const uint8_t *buf, unsigned buflen, const uint8_t *table)
+  ABI:
+    Architecture: x86_64
+    CallingConvention: SysV
+    Features: [AVX2]
+    rdi:
+      type: buffer
+      size_bytes: 512
+      permissions: write-only
+      c_parameter: int16_t *r
+      description: Output buffer (256 x int16_t)
+    rsi:
+      type: buffer
+      size_bytes: rdx
+      permissions: read-only
+      c_parameter: const uint8_t *buf
+      description: Input buffer
+    rdx:
+      type: scalar
+      c_parameter: unsigned buflen
+      description: Length of input buffer (must be multiple of 12)
+      test_with: 504  # MLKEM_GEN_MATRIX_NBLOCKS * MLK_XOF_RATE
+    rcx:
+      type: buffer
+      size_bytes: 4096
+      permissions: read-only
+      c_parameter: const uint8_t *table
+      description: Lookup table
+*/
+
 
 /*
  * WARNING: This file is auto-derived from the mlkem-native source file
- *   dev/x86_64/src/rej_uniform_avx2_asm.S using scripts/simpasm. Do not modify it directly.
+ *   dev/x86_64/src/mlkem_rej_uniform_avx2_asm.S using scripts/simpasm. Do not modify it directly.
  */
 
 .text
@@ -38,7 +71,7 @@ MLK_ASM_FN_SYMBOL(rej_uniform_avx2_asm)
         .cfi_adjust_cfa_offset 0x210
         xorl %eax, %eax
         testq %rdx, %rdx
-        je Lrej_uniform_asm_end
+        je Lmlk_rej_uniform_asm_end
         movabsq $0xd010d010d010d01, %rax # imm = 0xD010D010D010D01
         movq %rax, %xmm0
         pinsrq $0x1, %rax, %xmm0
@@ -53,7 +86,7 @@ MLK_ASM_FN_SYMBOL(rej_uniform_avx2_asm)
         movq $0x0, %r8
         movq $0x5555, %r9            # imm = 0x5555
 
-Lrej_uniform_asm_loop_start:
+Lmlk_rej_uniform_asm_loop_start:
         movq (%rsi,%r8), %xmm2
         pinsrd $0x2, 0x8(%rsi,%r8), %xmm2
         pshufb %xmm4, %xmm2
@@ -73,12 +106,12 @@ Lrej_uniform_asm_loop_start:
         popcntq %r11, %r11
         addq %r11, %rax
         cmpq $0x100, %rax            # imm = 0x100
-        jae Lrej_uniform_asm_final_copy
+        jae Lmlk_rej_uniform_asm_final_copy
         addq $0xc, %r8
         cmpq %r8, %rdx
-        ja Lrej_uniform_asm_loop_start
+        ja Lmlk_rej_uniform_asm_loop_start
 
-Lrej_uniform_asm_final_copy:
+Lmlk_rej_uniform_asm_final_copy:
         movq $0x100, %rcx            # imm = 0x100
         cmpq $0x100, %rax            # imm = 0x100
         cmovaq %rcx, %rax
@@ -87,7 +120,7 @@ Lrej_uniform_asm_final_copy:
         shlq %rcx
         rep  movsb (%rsi), %es:(%rdi)
 
-Lrej_uniform_asm_end:
+Lmlk_rej_uniform_asm_end:
         addq $0x210, %rsp            # imm = 0x210
         .cfi_adjust_cfa_offset -0x210
         retq

data/ext/pqcrypto/vendor/mlkem-native/mlkem/src/native/x86_64/src/{tomont_avx2_asm.S → mlkem_tomont_avx2_asm.S}

@@ -24,11 +24,28 @@
 
 #include "../../../common.h"
 #if defined(MLK_ARITH_BACKEND_X86_64_DEFAULT) && \
-    !defined(MLK_CONFIG_MULTILEVEL_NO_SHARED)
+    !defined(MLK_CONFIG_MULTILEVEL_NO_SHARED) && \
+    !defined(MLK_CONFIG_NO_KEYPAIR_API)
+/*yaml
+  Name: tomont_avx2_asm
+  Description: x86_64 AVX2 Montgomery conversion
+  Signature: void mlk_tomont_avx2_asm(int16_t *r)
+  ABI:
+    Architecture: x86_64
+    CallingConvention: SysV
+    Features: [AVX2]
+    rdi:
+      type: buffer
+      size_bytes: 512
+      permissions: read/write
+      c_parameter: int16_t *r
+      description: Input/output polynomial (256 x int16_t)
+*/
+
 
 /*
  * WARNING: This file is auto-derived from the mlkem-native source file
- *   dev/x86_64/src/tomont_avx2_asm.S using scripts/simpasm. Do not modify it directly.
+ *   dev/x86_64/src/mlkem_tomont_avx2_asm.S using scripts/simpasm. Do not modify it directly.
  */
 
 .text
@@ -148,7 +165,7 @@ MLK_ASM_FN_SYMBOL(tomont_avx2_asm)
 MLK_ASM_FN_SIZE(tomont_avx2_asm)
 
 #endif /* MLK_ARITH_BACKEND_X86_64_DEFAULT && !MLK_CONFIG_MULTILEVEL_NO_SHARED \
-        */
+          && !MLK_CONFIG_NO_KEYPAIR_API */
 
 #if defined(__ELF__)
 .section .note.GNU-stack,"",%progbits

data/ext/pqcrypto/vendor/mlkem-native/mlkem/src/poly.c

@@ -105,6 +105,7 @@ __contract__(
   return res;
 }
 
+#if !defined(MLK_CONFIG_NO_KEYPAIR_API)
 /* Reference: `poly_tomont()` in the reference implementation @[REF]. */
 MLK_STATIC_TESTABLE void mlk_poly_tomont_c(mlk_poly *r)
 __contract__(
@@ -142,6 +143,7 @@ void mlk_poly_tomont(mlk_poly *r)
 
   mlk_poly_tomont_c(r);
 }
+#endif /* !MLK_CONFIG_NO_KEYPAIR_API */
 
 /**
  * Constant-time conversion of signed representatives modulo MLKEM_Q within
@@ -241,6 +243,7 @@ void mlk_poly_add(mlk_poly *r, const mlk_poly *b)
   }
 }
 
+#if !defined(MLK_CONFIG_NO_DECAPS_API)
 /* Reference: `poly_sub()` in the reference implementation @[REF].
  *            - We use destructive version (output=first input) to avoid
  *              reasoning about aliasing in the CBMC specification */
@@ -259,6 +262,7 @@ void mlk_poly_sub(mlk_poly *r, const mlk_poly *b)
     r->coeffs[i] = (int16_t)(r->coeffs[i] - b->coeffs[i]);
   }
 }
+#endif /* !MLK_CONFIG_NO_DECAPS_API */
 
 #include "zetas.inc"
 
@@ -470,6 +474,7 @@ void mlk_poly_ntt(mlk_poly *r)
 }
 
 
+#if !defined(MLK_CONFIG_NO_ENCAPS_API) || !defined(MLK_CONFIG_NO_DECAPS_API)
 /* Compute one layer of inverse NTT */
 
 /* Reference: Embedded into `invntt()` in the reference implementation @[REF] */
@@ -568,8 +573,8 @@ void mlk_poly_invntt_tomont(mlk_poly *r)
 
   mlk_poly_invntt_tomont_c(r);
 }
-
-#else /* !MLK_CONFIG_MULTILEVEL_NO_SHARED */
+#endif /* !MLK_CONFIG_NO_ENCAPS_API || !MLK_CONFIG_NO_DECAPS_API */
+#else  /* !MLK_CONFIG_MULTILEVEL_NO_SHARED */
 
 MLK_EMPTY_CU(mlk_poly)
 

data/ext/pqcrypto/vendor/mlkem-native/mlkem/src/poly.h

@@ -99,6 +99,7 @@ __contract__(
   return (int16_t)r;
 }
 
+#if !defined(MLK_CONFIG_NO_KEYPAIR_API)
 #define mlk_poly_tomont MLK_NAMESPACE(poly_tomont)
 /**
  * In-place conversion of all coefficients of a polynomial from the normal
@@ -119,6 +120,7 @@ __contract__(
   assigns(memory_slice(r, sizeof(mlk_poly)))
   ensures(array_abs_bound(r->coeffs, 0, MLKEM_N, MLKEM_Q))
 );
+#endif /* !MLK_CONFIG_NO_KEYPAIR_API */
 
 #define mlk_poly_mulcache_compute MLK_NAMESPACE(poly_mulcache_compute)
 /**
@@ -207,6 +209,7 @@ __contract__(
   assigns(memory_slice(r, sizeof(mlk_poly)))
 );
 
+#if !defined(MLK_CONFIG_NO_DECAPS_API)
 #define mlk_poly_sub MLK_NAMESPACE(poly_sub)
 /**
  * Subtract two polynomials; no modular reduction is performed.
@@ -231,6 +234,7 @@ __contract__(
   ensures(forall(k, 0, MLKEM_N, r->coeffs[k] == old(*r).coeffs[k] - b->coeffs[k]))
   assigns(memory_slice(r, sizeof(mlk_poly)))
 );
+#endif /* !MLK_CONFIG_NO_DECAPS_API */
 
 #define mlk_poly_ntt MLK_NAMESPACE(poly_ntt)
 /**
@@ -260,6 +264,7 @@ __contract__(
   ensures(array_abs_bound(r->coeffs, 0, MLKEM_N, MLK_NTT_BOUND))
 );
 
+#if !defined(MLK_CONFIG_NO_ENCAPS_API) || !defined(MLK_CONFIG_NO_DECAPS_API)
 #define mlk_poly_invntt_tomont MLK_NAMESPACE(poly_invntt_tomont)
 /**
  * Compute the inverse negacyclic number-theoretic transform (NTT) of a
@@ -286,5 +291,6 @@ __contract__(
   assigns(memory_slice(r, sizeof(mlk_poly)))
   ensures(array_abs_bound(r->coeffs, 0, MLKEM_N, MLK_INVNTT_BOUND))
 );
+#endif /* !MLK_CONFIG_NO_ENCAPS_API || !MLK_CONFIG_NO_DECAPS_API */
 
 #endif /* !MLK_POLY_H */

data/ext/pqcrypto/vendor/mlkem-native/mlkem/src/poly_k.c

@@ -39,6 +39,7 @@
   MLK_ADD_PARAM_SET(mlk_polyvec_basemul_acc_montgomery_cached_c)
 /* End of parameter set namespacing */
 
+#if !defined(MLK_CONFIG_NO_ENCAPS_API) || !defined(MLK_CONFIG_NO_DECAPS_API)
 /* Reference: `polyvec_compress()` in the reference implementation @[REF]
  *            - In contrast to the reference implementation, we assume
  *              unsigned canonical coefficients here.
@@ -56,7 +57,9 @@ void mlk_polyvec_compress_du(uint8_t r[MLKEM_POLYVECCOMPRESSEDBYTES_DU],
     mlk_poly_compress_du(r + i * MLKEM_POLYCOMPRESSEDBYTES_DU, &a->vec[i]);
   }
 }
+#endif /* !MLK_CONFIG_NO_ENCAPS_API || !MLK_CONFIG_NO_DECAPS_API */
 
+#if !defined(MLK_CONFIG_NO_DECAPS_API)
 /* Reference: `polyvec_decompress()` in the reference implementation @[REF]. */
 MLK_INTERNAL_API
 void mlk_polyvec_decompress_du(mlk_polyvec *r,
@@ -70,7 +73,9 @@ void mlk_polyvec_decompress_du(mlk_polyvec *r,
 
   mlk_assert_bound_2d(r->vec, MLKEM_K, MLKEM_N, 0, MLKEM_Q);
 }
+#endif /* !MLK_CONFIG_NO_DECAPS_API */
 
+#if !defined(MLK_CONFIG_NO_KEYPAIR_API) || !defined(MLK_CONFIG_NO_ENCAPS_API)
 /* Reference: `polyvec_tobytes()` in the reference implementation @[REF].
  *            - In contrast to the reference implementation, we assume
  *              unsigned canonical coefficients here.
@@ -92,7 +97,9 @@ void mlk_polyvec_tobytes(uint8_t r[MLKEM_POLYVECBYTES], const mlk_polyvec *a)
     mlk_poly_tobytes(&r[i * MLKEM_POLYBYTES], &a->vec[i]);
   }
 }
+#endif /* !MLK_CONFIG_NO_KEYPAIR_API || !MLK_CONFIG_NO_ENCAPS_API */
 
+#if !defined(MLK_CONFIG_NO_ENCAPS_API) || !defined(MLK_CONFIG_NO_DECAPS_API)
 /* Reference: `polyvec_frombytes()` in the reference implementation @[REF]. */
 MLK_INTERNAL_API
 void mlk_polyvec_frombytes(mlk_polyvec *r, const uint8_t a[MLKEM_POLYVECBYTES])
@@ -105,6 +112,7 @@ void mlk_polyvec_frombytes(mlk_polyvec *r, const uint8_t a[MLKEM_POLYVECBYTES])
 
   mlk_assert_bound_2d(r->vec, MLKEM_K, MLKEM_N, 0, MLKEM_UINT12_LIMIT);
 }
+#endif /* !MLK_CONFIG_NO_ENCAPS_API || !MLK_CONFIG_NO_DECAPS_API */
 
 /* Reference: `polyvec_ntt()` in the reference implementation @[REF]. */
 MLK_INTERNAL_API
@@ -124,6 +132,7 @@ void mlk_polyvec_ntt(mlk_polyvec *r)
  *              while the reference implementation normalizes at
  *              the end. This allows us to drop a call to `poly_reduce()`
  *              from the base multiplication. */
+#if !defined(MLK_CONFIG_NO_ENCAPS_API) || !defined(MLK_CONFIG_NO_DECAPS_API)
 MLK_INTERNAL_API
 void mlk_polyvec_invntt_tomont(mlk_polyvec *r)
 {
@@ -135,6 +144,7 @@ void mlk_polyvec_invntt_tomont(mlk_polyvec *r)
 
   mlk_assert_abs_bound_2d(r->vec, MLKEM_K, MLKEM_N, MLK_INVNTT_BOUND);
 }
+#endif /* !MLK_CONFIG_NO_ENCAPS_API || !MLK_CONFIG_NO_DECAPS_API */
 
 /* Reference: `polyvec_basemul_acc_montgomery()` in the
  *            reference implementation @[REF].
@@ -279,6 +289,7 @@ void mlk_polyvec_add(mlk_polyvec *r, const mlk_polyvec *b)
   }
 }
 
+#if !defined(MLK_CONFIG_NO_KEYPAIR_API)
 /* Reference: `polyvec_tomont()` in the reference implementation @[REF]. */
 MLK_INTERNAL_API
 void mlk_polyvec_tomont(mlk_polyvec *r)
@@ -291,6 +302,7 @@ void mlk_polyvec_tomont(mlk_polyvec *r)
 
   mlk_assert_abs_bound_2d(r->vec, MLKEM_K, MLKEM_N, MLKEM_Q);
 }
+#endif /* !MLK_CONFIG_NO_KEYPAIR_API */
 
 
 /**
@@ -325,6 +337,9 @@ __contract__(
 #endif
 }
 
+#if !defined(MLK_CONFIG_NO_KEYPAIR_API) ||                              \
+    (MLKEM_ETA1 == MLKEM_ETA2 && (!defined(MLK_CONFIG_NO_ENCAPS_API) || \
+                                  !defined(MLK_CONFIG_NO_DECAPS_API)))
 /* Reference: Does not exist in the reference implementation @[REF].
  *            - This implements a x4-batched version of `poly_getnoise_eta1()`
  *              from the reference implementation, to leverage
@@ -378,8 +393,11 @@ void mlk_poly_getnoise_eta1_4x(mlk_poly *r0, mlk_poly *r1, mlk_poly *r2,
   mlk_zeroize(buf, sizeof(buf));
   mlk_zeroize(extkey, sizeof(extkey));
 }
+#endif /* !MLK_CONFIG_NO_KEYPAIR_API || (MLKEM_ETA1 == MLKEM_ETA2 && \
+          (!MLK_CONFIG_NO_ENCAPS_API || !MLK_CONFIG_NO_DECAPS_API)) */
 
-#if MLKEM_K == 2 || MLKEM_K == 4
+#if (MLKEM_K == 2 || MLKEM_K == 4) && \
+    (!defined(MLK_CONFIG_NO_ENCAPS_API) || !defined(MLK_CONFIG_NO_DECAPS_API))
 /**
  * Given an array of uniformly random bytes, compute a polynomial with
  * coefficients distributed according to a centered binomial distribution
@@ -431,9 +449,11 @@ void mlk_poly_getnoise_eta2(mlk_poly *r, const uint8_t seed[MLKEM_SYMBYTES],
   mlk_zeroize(buf, sizeof(buf));
   mlk_zeroize(extkey, sizeof(extkey));
 }
-#endif /* MLKEM_K == 2 || MLKEM_K == 4 */
+#endif /* (MLKEM_K == 2 || MLKEM_K == 4) && (!MLK_CONFIG_NO_ENCAPS_API || \
+          !MLK_CONFIG_NO_DECAPS_API) */
 
-#if MLKEM_K == 2
+#if MLKEM_K == 2 && \
+    (!defined(MLK_CONFIG_NO_ENCAPS_API) || !defined(MLK_CONFIG_NO_DECAPS_API))
 /* Reference: Does not exist in the reference implementation @[REF].
  *            - This implements a x4-batched version of `poly_getnoise_eta1()`
  *              and `poly_getnoise_eta2()` from the reference implementation,
@@ -492,7 +512,8 @@ void mlk_poly_getnoise_eta1122_4x(mlk_poly *r0, mlk_poly *r1, mlk_poly *r2,
   mlk_zeroize(buf, sizeof(buf));
   mlk_zeroize(extkey, sizeof(extkey));
 }
-#endif /* MLKEM_K == 2 */
+#endif /* MLKEM_K == 2 && (!MLK_CONFIG_NO_ENCAPS_API || \
+          !MLK_CONFIG_NO_DECAPS_API) */
 
 /* To facilitate single-compilation-unit (SCU) builds, undefine all macros.
  * Don't modify by hand -- this is auto-generated by scripts/autogen. */

data/ext/pqcrypto/vendor/mlkem-native/mlkem/src/poly_k.h

@@ -46,6 +46,7 @@ typedef struct
   mlk_poly_mulcache vec[MLKEM_K]; /**< Per-component caches. */
 } MLK_ALIGN mlk_polyvec_mulcache;
 
+#if !defined(MLK_CONFIG_NO_ENCAPS_API) || !defined(MLK_CONFIG_NO_DECAPS_API)
 #define mlk_poly_compress_du MLK_NAMESPACE_K(poly_compress_du)
 /**
  * Compression (du bits) and subsequent serialization of a polynomial.
@@ -75,7 +76,9 @@ __contract__(
 #error "Invalid value of MLKEM_DU"
 #endif
 }
+#endif /* !MLK_CONFIG_NO_ENCAPS_API || !MLK_CONFIG_NO_DECAPS_API */
 
+#if !defined(MLK_CONFIG_NO_DECAPS_API)
 #define mlk_poly_decompress_du MLK_NAMESPACE_K(poly_decompress_du)
 /**
  * De-serialization and subsequent decompression (du bits) of a polynomial;
@@ -108,7 +111,9 @@ __contract__(
 #error "Invalid value of MLKEM_DU"
 #endif
 }
+#endif /* !MLK_CONFIG_NO_DECAPS_API */
 
+#if !defined(MLK_CONFIG_NO_ENCAPS_API) || !defined(MLK_CONFIG_NO_DECAPS_API)
 #define mlk_poly_compress_dv MLK_NAMESPACE_K(poly_compress_dv)
 /**
  * Compression (dv bits) and subsequent serialization of a polynomial.
@@ -138,8 +143,10 @@ __contract__(
 #error "Invalid value of MLKEM_DV"
 #endif
 }
+#endif /* !MLK_CONFIG_NO_ENCAPS_API || !MLK_CONFIG_NO_DECAPS_API */
 
 
+#if !defined(MLK_CONFIG_NO_DECAPS_API)
 #define mlk_poly_decompress_dv MLK_NAMESPACE_K(poly_decompress_dv)
 /**
  * De-serialization and subsequent decompression (dv bits) of a polynomial;
@@ -172,7 +179,9 @@ __contract__(
 #error "Invalid value of MLKEM_DV"
 #endif
 }
+#endif /* !MLK_CONFIG_NO_DECAPS_API */
 
+#if !defined(MLK_CONFIG_NO_ENCAPS_API) || !defined(MLK_CONFIG_NO_DECAPS_API)
 #define mlk_polyvec_compress_du MLK_NAMESPACE_K(polyvec_compress_du)
 /**
  * Compress and serialize a vector of polynomials.
@@ -196,7 +205,9 @@ __contract__(
          array_bound(a->vec[k0].coeffs, 0, MLKEM_N, 0, MLKEM_Q)))
   assigns(memory_slice(r, MLKEM_POLYVECCOMPRESSEDBYTES_DU))
 );
+#endif /* !MLK_CONFIG_NO_ENCAPS_API || !MLK_CONFIG_NO_DECAPS_API */
 
+#if !defined(MLK_CONFIG_NO_DECAPS_API)
 #define mlk_polyvec_decompress_du MLK_NAMESPACE_K(polyvec_decompress_du)
 /**
  * De-serialize and decompress a vector of polynomials; approximate inverse
@@ -221,7 +232,9 @@ __contract__(
   ensures(forall(k0, 0, MLKEM_K,
          array_bound(r->vec[k0].coeffs, 0, MLKEM_N, 0, MLKEM_Q)))
 );
+#endif /* !MLK_CONFIG_NO_DECAPS_API */
 
+#if !defined(MLK_CONFIG_NO_KEYPAIR_API) || !defined(MLK_CONFIG_NO_ENCAPS_API)
 #define mlk_polyvec_tobytes MLK_NAMESPACE_K(polyvec_tobytes)
 /**
  * Serialize a vector of polynomials.
@@ -243,7 +256,9 @@ __contract__(
          array_bound(a->vec[k0].coeffs, 0, MLKEM_N, 0, MLKEM_Q)))
   assigns(memory_slice(r, MLKEM_POLYVECBYTES))
 );
+#endif /* !MLK_CONFIG_NO_KEYPAIR_API || !MLK_CONFIG_NO_ENCAPS_API */
 
+#if !defined(MLK_CONFIG_NO_ENCAPS_API) || !defined(MLK_CONFIG_NO_DECAPS_API)
 #define mlk_polyvec_frombytes MLK_NAMESPACE_K(polyvec_frombytes)
 /**
  * De-serialize a vector of polynomials; inverse of mlk_polyvec_tobytes.
@@ -265,6 +280,7 @@ __contract__(
   ensures(forall(k0, 0, MLKEM_K,
         array_bound(r->vec[k0].coeffs, 0, MLKEM_N, 0, MLKEM_UINT12_LIMIT)))
 );
+#endif /* !MLK_CONFIG_NO_ENCAPS_API || !MLK_CONFIG_NO_DECAPS_API */
 
 #define mlk_polyvec_ntt MLK_NAMESPACE_K(polyvec_ntt)
 /**
@@ -292,6 +308,7 @@ __contract__(
   array_abs_bound(r->vec[j].coeffs, 0, MLKEM_N, MLK_NTT_BOUND)))
 );
 
+#if !defined(MLK_CONFIG_NO_ENCAPS_API) || !defined(MLK_CONFIG_NO_DECAPS_API)
 #define mlk_polyvec_invntt_tomont MLK_NAMESPACE_K(polyvec_invntt_tomont)
 /**
  * Apply inverse NTT to all elements of a vector of polynomials and multiply
@@ -316,6 +333,7 @@ __contract__(
   ensures(forall(j, 0, MLKEM_K,
   array_abs_bound(r->vec[j].coeffs, 0, MLKEM_N, MLK_INVNTT_BOUND)))
 );
+#endif /* !MLK_CONFIG_NO_ENCAPS_API || !MLK_CONFIG_NO_DECAPS_API */
 
 #define mlk_polyvec_basemul_acc_montgomery_cached \
   MLK_NAMESPACE_K(polyvec_basemul_acc_montgomery_cached)
@@ -442,6 +460,7 @@ __contract__(
   assigns(memory_slice(r, sizeof(mlk_polyvec)))
 );
 
+#if !defined(MLK_CONFIG_NO_KEYPAIR_API)
 #define mlk_polyvec_tomont MLK_NAMESPACE_K(polyvec_tomont)
 /**
  * In-place conversion of all coefficients of a polynomial vector from the
@@ -463,7 +482,11 @@ __contract__(
   ensures(forall(j, 0, MLKEM_K,
     array_abs_bound(r->vec[j].coeffs, 0, MLKEM_N, MLKEM_Q)))
 );
+#endif /* !MLK_CONFIG_NO_KEYPAIR_API */
 
+#if !defined(MLK_CONFIG_NO_KEYPAIR_API) ||                              \
+    (MLKEM_ETA1 == MLKEM_ETA2 && (!defined(MLK_CONFIG_NO_ENCAPS_API) || \
+                                  !defined(MLK_CONFIG_NO_DECAPS_API)))
 #define mlk_poly_getnoise_eta1_4x MLK_NAMESPACE_K(poly_getnoise_eta1_4x)
 /**
  * Batch sample four polynomials deterministically from a seed and nonces,
@@ -515,8 +538,11 @@ __contract__(
  */
 #define mlk_poly_getnoise_eta2_4x mlk_poly_getnoise_eta1_4x
 #endif /* MLKEM_ETA1 == MLKEM_ETA2 */
+#endif /* !MLK_CONFIG_NO_KEYPAIR_API || (MLKEM_ETA1 == MLKEM_ETA2 && \
+          (!MLK_CONFIG_NO_ENCAPS_API || !MLK_CONFIG_NO_DECAPS_API)) */
 
-#if MLKEM_K == 2 || MLKEM_K == 4
+#if (MLKEM_K == 2 || MLKEM_K == 4) && \
+    (!defined(MLK_CONFIG_NO_ENCAPS_API) || !defined(MLK_CONFIG_NO_DECAPS_API))
 #define mlk_poly_getnoise_eta2 MLK_NAMESPACE_K(poly_getnoise_eta2)
 /**
  * Sample a polynomial deterministically from a seed and a nonce, with
@@ -541,9 +567,11 @@ __contract__(
   assigns(memory_slice(r, sizeof(mlk_poly)))
   ensures(array_abs_bound(r->coeffs, 0, MLKEM_N, MLKEM_ETA2 + 1))
 );
-#endif /* MLKEM_K == 2 || MLKEM_K == 4 */
+#endif /* (MLKEM_K == 2 || MLKEM_K == 4) && (!MLK_CONFIG_NO_ENCAPS_API || \
+          !MLK_CONFIG_NO_DECAPS_API) */
 
-#if MLKEM_K == 2
+#if MLKEM_K == 2 && \
+    (!defined(MLK_CONFIG_NO_ENCAPS_API) || !defined(MLK_CONFIG_NO_DECAPS_API))
 #define mlk_poly_getnoise_eta1122_4x MLK_NAMESPACE_K(poly_getnoise_eta1122_4x)
 /**
  * Batch sample four polynomials deterministically from a seed and nonces,
@@ -588,6 +616,7 @@ __contract__(
        && array_abs_bound(r2->coeffs,0, MLKEM_N, MLKEM_ETA2 + 1)
        && array_abs_bound(r3->coeffs,0, MLKEM_N, MLKEM_ETA2 + 1))
 );
-#endif /* MLKEM_K == 2 */
+#endif /* MLKEM_K == 2 && (!MLK_CONFIG_NO_ENCAPS_API || \
+          !MLK_CONFIG_NO_DECAPS_API) */
 
 #endif /* !MLK_POLY_K_H */

data/ext/pqcrypto/vendor/mlkem-native/mlkem/src/sampling.c

@@ -251,6 +251,8 @@ void mlk_poly_rej_uniform(mlk_poly *entry, uint8_t seed[MLKEM_SYMBYTES + 2])
   mlk_zeroize(buf, sizeof(buf));
 }
 
+#if defined(MLK_CONFIG_MULTILEVEL_WITH_SHARED) || MLKEM_ETA1 == 2 || \
+    !defined(MLK_CONFIG_NO_ENCAPS_API) || !defined(MLK_CONFIG_NO_DECAPS_API)
 /**
  * Load 4 bytes into a 32-bit integer in little-endian order.
  *
@@ -300,6 +302,8 @@ void mlk_poly_cbd2(mlk_poly *r, const uint8_t buf[2 * MLKEM_N / 4])
     }
   }
 }
+#endif /* MLK_CONFIG_MULTILEVEL_WITH_SHARED || MLKEM_ETA1 == 2 || \
+          !MLK_CONFIG_NO_ENCAPS_API || !MLK_CONFIG_NO_DECAPS_API */
 
 #if defined(MLK_CONFIG_MULTILEVEL_WITH_SHARED) || MLKEM_ETA1 == 3
 /**

data/ext/pqcrypto/vendor/mlkem-native/mlkem/src/sampling.h

@@ -19,6 +19,8 @@
 #include "common.h"
 #include "poly.h"
 
+#if defined(MLK_CONFIG_MULTILEVEL_WITH_SHARED) || MLKEM_ETA1 == 2 || \
+    !defined(MLK_CONFIG_NO_ENCAPS_API) || !defined(MLK_CONFIG_NO_DECAPS_API)
 #define mlk_poly_cbd2 MLK_NAMESPACE(poly_cbd2)
 /**
  * Given an array of uniformly random bytes, compute a polynomial with
@@ -32,6 +34,8 @@
  */
 MLK_INTERNAL_API
 void mlk_poly_cbd2(mlk_poly *r, const uint8_t buf[2 * MLKEM_N / 4]);
+#endif /* MLK_CONFIG_MULTILEVEL_WITH_SHARED || MLKEM_ETA1 == 2 || \
+          !MLK_CONFIG_NO_ENCAPS_API || !MLK_CONFIG_NO_DECAPS_API */
 
 #if defined(MLK_CONFIG_MULTILEVEL_WITH_SHARED) || MLKEM_ETA1 == 3
 #define mlk_poly_cbd3 MLK_NAMESPACE(poly_cbd3)