pq_crypto 0.6.4 → 0.6.6

data/ext/pqcrypto/vendor/mldsa-native/mldsa/src/fips202/native/auto.h

@@ -16,14 +16,15 @@
 #include "aarch64/auto.h"
 #endif
 
-#if defined(MLD_SYS_X86_64) && defined(MLD_SYS_X86_64_AVX2) &&               \
+/* The x86_64 backend requires toolchain support for the SysV ABI */
+#if defined(MLD_SYS_X86_64_AVX2) && defined(MLD_SYSV_ABI_SUPPORTED) &&       \
     (!defined(MLD_CONFIG_NO_KEYPAIR_API) ||                                  \
      !defined(MLD_CONFIG_NO_SIGN_API) || !defined(MLD_CONFIG_REDUCE_RAM)) && \
     !defined(MLD_CONFIG_SERIAL_FIPS202_ONLY)
 #include "x86_64/keccak_f1600_x4_avx2.h"
-#endif /* MLD_SYS_X86_64 && MLD_SYS_X86_64_AVX2 && (!MLD_CONFIG_NO_KEYPAIR_API \
-          || !MLD_CONFIG_NO_SIGN_API || !MLD_CONFIG_REDUCE_RAM) &&             \
-          !MLD_CONFIG_SERIAL_FIPS202_ONLY */
+#endif /* MLD_SYS_X86_64_AVX2 && MLD_SYSV_ABI_SUPPORTED &&          \
+          (!MLD_CONFIG_NO_KEYPAIR_API || !MLD_CONFIG_NO_SIGN_API || \
+          !MLD_CONFIG_REDUCE_RAM) && !MLD_CONFIG_SERIAL_FIPS202_ONLY */
 
 /* We do not yet include the FIPS202 backend for Armv8.1-M+MVE by default
  * as it is still experimental and undergoing review. */

data/ext/pqcrypto/vendor/mldsa-native/mldsa/src/fips202/native/x86_64/keccak_f1600_x4_avx2.h

@@ -12,7 +12,7 @@
 #define MLD_FIPS202_X86_64_NEED_X4_AVX2
 
 /* Part of backend API */
-#define MLD_USE_FIPS202_X4_NATIVE
+#define MLD_USE_NATIVE_FIPS202_X4
 
 #if !defined(__ASSEMBLER__)
 #include "../api.h"
@@ -20,7 +20,7 @@
 MLD_MUST_CHECK_RETURN_VALUE
 static MLD_INLINE int mld_keccak_f1600_x4_native(uint64_t *state)
 {
-  if (!mld_sys_check_capability(MLD_SYS_CAP_AVX2))
+  if (!mld_sys_check_capability(MLD_SYS_CAP_X86_64_AVX2))
   {
     return MLD_NATIVE_FUNC_FALLBACK;
   }

data/ext/pqcrypto/vendor/mldsa-native/mldsa/src/fips202/native/x86_64/src/fips202_native_x86_64.h

@@ -28,6 +28,7 @@ MLD_INTERNAL_DATA_DECLARATION const uint64_t mld_keccak_rho8[4];
 MLD_INTERNAL_DATA_DECLARATION const uint64_t mld_keccak_rho56[4];
 
 #define mld_keccak_f1600_x4_avx2_asm MLD_NAMESPACE(keccak_f1600_x4_avx2_asm)
+MLD_SYSV_ABI
 void mld_keccak_f1600_x4_avx2_asm(uint64_t states[100], const uint64_t rc[24],
                                   const uint64_t rho8[4],
                                   const uint64_t rho56[4])

data/ext/pqcrypto/vendor/mldsa-native/mldsa/src/fips202/native/x86_64/src/keccak_f1600_x4_avx2_asm.S

@@ -3,6 +3,40 @@
  * Copyright (c) The mldsa-native project authors
  * SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT
  */
+/*yaml
+  Name: keccak_f1600_x4_avx2_asm
+  Description: x86_64 AVX2 Keccak-f[1600] permutation for four sequential states
+  Signature: void mld_keccak_f1600_x4_avx2_asm(uint64_t states[100], const uint64_t rc[24], const uint64_t rho8[4], const uint64_t rho56[4])
+  ABI:
+    Architecture: x86_64
+    CallingConvention: SysV
+    Features: [AVX2]
+    rdi:
+      type: buffer
+      size_bytes: 800
+      permissions: read/write
+      c_parameter: uint64_t states[100]
+      description: Four sequential Keccak states (4 x 25 x uint64_t)
+    rsi:
+      type: buffer
+      size_bytes: 192
+      permissions: read-only
+      c_parameter: const uint64_t rc[24]
+      description: Round constants (24 x uint64_t)
+    rdx:
+      type: buffer
+      size_bytes: 32
+      permissions: read-only
+      c_parameter: const uint64_t rho8[4]
+      description: Rotation constant rho8 (4 x uint64_t)
+    rcx:
+      type: buffer
+      size_bytes: 32
+      permissions: read-only
+      c_parameter: const uint64_t rho56[4]
+      description: Rotation constant rho56 (4 x uint64_t)
+*/
+
 #include "../../../../common.h"
 
 #if defined(MLD_FIPS202_X86_64_NEED_X4_AVX2) && \
@@ -120,7 +154,7 @@ MLD_ASM_FN_SYMBOL(keccak_f1600_x4_avx2_asm)
         vinserti128 $0x1, %xmm0, %ymm1, %ymm2
         movq $0x0, %r10
 
-LLkeccak_f1600_x4_avx2_asm:
+LLmld_keccak_f1600_x4_avx2_asm:
         vmovdqu 0xa0(%rsp), %ymm4
         vpxor 0x1c0(%rsp), %ymm9, %ymm0
         vmovdqu %ymm9, 0x200(%rsp)
@@ -344,7 +378,7 @@ LLkeccak_f1600_x4_avx2_asm:
         addq $0x8, %rsi
         addq $0x1, %r10
         cmpq $0x18, %r10
-        jne LLkeccak_f1600_x4_avx2_asm
+        jne LLmld_keccak_f1600_x4_avx2_asm
         vmovdqu (%rsp), %ymm4
         vmovdqu 0x40(%rsp), %ymm5
         vmovdqu 0x20(%rsp), %ymm0

data/ext/pqcrypto/vendor/mldsa-native/mldsa/src/native/aarch64/meta.h

@@ -38,6 +38,10 @@
 MLD_MUST_CHECK_RETURN_VALUE
 static MLD_INLINE int mld_ntt_native(int32_t data[MLDSA_N])
 {
+  if (!mld_sys_check_capability(MLD_SYS_CAP_AARCH64_NEON))
+  {
+    return MLD_NATIVE_FUNC_FALLBACK;
+  }
   mld_ntt_aarch64_asm(data, mld_aarch64_ntt_zetas_layer123456,
                       mld_aarch64_ntt_zetas_layer78);
   return MLD_NATIVE_FUNC_SUCCESS;
@@ -46,6 +50,10 @@ static MLD_INLINE int mld_ntt_native(int32_t data[MLDSA_N])
 MLD_MUST_CHECK_RETURN_VALUE
 static MLD_INLINE int mld_intt_native(int32_t data[MLDSA_N])
 {
+  if (!mld_sys_check_capability(MLD_SYS_CAP_AARCH64_NEON))
+  {
+    return MLD_NATIVE_FUNC_FALLBACK;
+  }
   mld_intt_aarch64_asm(data, mld_aarch64_intt_zetas_layer78,
                        mld_aarch64_intt_zetas_layer123456);
   return MLD_NATIVE_FUNC_SUCCESS;
@@ -56,8 +64,8 @@ static MLD_INLINE int mld_rej_uniform_native(int32_t *r, unsigned len,
                                              const uint8_t *buf,
                                              unsigned buflen)
 {
-  if (len != MLDSA_N ||
-      buflen % 24 != 0) /* NEON support is mandatory for AArch64 */
+  if (!mld_sys_check_capability(MLD_SYS_CAP_AARCH64_NEON) || len != MLDSA_N ||
+      buflen % 24 != 0)
   {
     return MLD_NATIVE_FUNC_FALLBACK;
   }
@@ -76,7 +84,8 @@ static MLD_INLINE int mld_rej_uniform_eta2_native(int32_t *r, unsigned len,
 {
   uint64_t outlen;
   /* AArch64 implementation assumes specific buffer lengths */
-  if (len != MLDSA_N || buflen != MLD_AARCH64_REJ_UNIFORM_ETA2_BUFLEN)
+  if (!mld_sys_check_capability(MLD_SYS_CAP_AARCH64_NEON) || len != MLDSA_N ||
+      buflen != MLD_AARCH64_REJ_UNIFORM_ETA2_BUFLEN)
   {
     return MLD_NATIVE_FUNC_FALLBACK;
   }
@@ -104,7 +113,8 @@ static MLD_INLINE int mld_rej_uniform_eta4_native(int32_t *r, unsigned len,
 {
   uint64_t outlen;
   /* AArch64 implementation assumes specific buffer lengths */
-  if (len != MLDSA_N || buflen != MLD_AARCH64_REJ_UNIFORM_ETA4_BUFLEN)
+  if (!mld_sys_check_capability(MLD_SYS_CAP_AARCH64_NEON) || len != MLDSA_N ||
+      buflen != MLD_AARCH64_REJ_UNIFORM_ETA4_BUFLEN)
   {
     return MLD_NATIVE_FUNC_FALLBACK;
   }
@@ -131,6 +141,10 @@ static MLD_INLINE int mld_rej_uniform_eta4_native(int32_t *r, unsigned len,
 MLD_MUST_CHECK_RETURN_VALUE
 static MLD_INLINE int mld_poly_decompose_32_native(int32_t *a1, int32_t *a0)
 {
+  if (!mld_sys_check_capability(MLD_SYS_CAP_AARCH64_NEON))
+  {
+    return MLD_NATIVE_FUNC_FALLBACK;
+  }
   mld_poly_decompose_32_aarch64_asm(a1, a0);
   return MLD_NATIVE_FUNC_SUCCESS;
 }
@@ -141,6 +155,10 @@ static MLD_INLINE int mld_poly_decompose_32_native(int32_t *a1, int32_t *a0)
 MLD_MUST_CHECK_RETURN_VALUE
 static MLD_INLINE int mld_poly_decompose_88_native(int32_t *a1, int32_t *a0)
 {
+  if (!mld_sys_check_capability(MLD_SYS_CAP_AARCH64_NEON))
+  {
+    return MLD_NATIVE_FUNC_FALLBACK;
+  }
   mld_poly_decompose_88_aarch64_asm(a1, a0);
   return MLD_NATIVE_FUNC_SUCCESS;
 }
@@ -151,6 +169,10 @@ static MLD_INLINE int mld_poly_decompose_88_native(int32_t *a1, int32_t *a0)
 MLD_MUST_CHECK_RETURN_VALUE
 static MLD_INLINE int mld_poly_caddq_native(int32_t a[MLDSA_N])
 {
+  if (!mld_sys_check_capability(MLD_SYS_CAP_AARCH64_NEON))
+  {
+    return MLD_NATIVE_FUNC_FALLBACK;
+  }
   mld_poly_caddq_aarch64_asm(a);
   return MLD_NATIVE_FUNC_SUCCESS;
 }
@@ -161,6 +183,10 @@ static MLD_INLINE int mld_poly_caddq_native(int32_t a[MLDSA_N])
 MLD_MUST_CHECK_RETURN_VALUE
 static MLD_INLINE int mld_poly_use_hint_32_native(int32_t *a, const int32_t *h)
 {
+  if (!mld_sys_check_capability(MLD_SYS_CAP_AARCH64_NEON))
+  {
+    return MLD_NATIVE_FUNC_FALLBACK;
+  }
   mld_poly_use_hint_32_aarch64_asm(a, h);
   return MLD_NATIVE_FUNC_SUCCESS;
 }
@@ -171,6 +197,10 @@ static MLD_INLINE int mld_poly_use_hint_32_native(int32_t *a, const int32_t *h)
 MLD_MUST_CHECK_RETURN_VALUE
 static MLD_INLINE int mld_poly_use_hint_88_native(int32_t *a, const int32_t *h)
 {
+  if (!mld_sys_check_capability(MLD_SYS_CAP_AARCH64_NEON))
+  {
+    return MLD_NATIVE_FUNC_FALLBACK;
+  }
   mld_poly_use_hint_88_aarch64_asm(a, h);
   return MLD_NATIVE_FUNC_SUCCESS;
 }
@@ -181,6 +211,10 @@ static MLD_INLINE int mld_poly_use_hint_88_native(int32_t *a, const int32_t *h)
 MLD_MUST_CHECK_RETURN_VALUE
 static MLD_INLINE int mld_poly_chknorm_native(const int32_t *a, int32_t B)
 {
+  if (!mld_sys_check_capability(MLD_SYS_CAP_AARCH64_NEON))
+  {
+    return MLD_NATIVE_FUNC_FALLBACK;
+  }
   return mld_poly_chknorm_aarch64_asm(a, B);
 }
 
@@ -189,6 +223,10 @@ static MLD_INLINE int mld_poly_chknorm_native(const int32_t *a, int32_t B)
 MLD_MUST_CHECK_RETURN_VALUE
 static MLD_INLINE int mld_polyz_unpack_17_native(int32_t *r, const uint8_t *buf)
 {
+  if (!mld_sys_check_capability(MLD_SYS_CAP_AARCH64_NEON))
+  {
+    return MLD_NATIVE_FUNC_FALLBACK;
+  }
   mld_polyz_unpack_17_aarch64_asm(r, buf, mld_polyz_unpack_17_indices);
   return MLD_NATIVE_FUNC_SUCCESS;
 }
@@ -200,6 +238,10 @@ static MLD_INLINE int mld_polyz_unpack_17_native(int32_t *r, const uint8_t *buf)
 MLD_MUST_CHECK_RETURN_VALUE
 static MLD_INLINE int mld_polyz_unpack_19_native(int32_t *r, const uint8_t *buf)
 {
+  if (!mld_sys_check_capability(MLD_SYS_CAP_AARCH64_NEON))
+  {
+    return MLD_NATIVE_FUNC_FALLBACK;
+  }
   mld_polyz_unpack_19_aarch64_asm(r, buf, mld_polyz_unpack_19_indices);
   return MLD_NATIVE_FUNC_SUCCESS;
 }
@@ -213,6 +255,10 @@ MLD_MUST_CHECK_RETURN_VALUE
 static MLD_INLINE int mld_poly_pointwise_montgomery_native(
     int32_t a[MLDSA_N], const int32_t b[MLDSA_N])
 {
+  if (!mld_sys_check_capability(MLD_SYS_CAP_AARCH64_NEON))
+  {
+    return MLD_NATIVE_FUNC_FALLBACK;
+  }
   mld_poly_pointwise_montgomery_aarch64_asm(a, b);
   return MLD_NATIVE_FUNC_SUCCESS;
 }
@@ -225,6 +271,10 @@ static MLD_INLINE int mld_polyvecl_pointwise_acc_montgomery_l4_native(
     int32_t w[MLDSA_N], const int32_t u[4][MLDSA_N],
     const int32_t v[4][MLDSA_N])
 {
+  if (!mld_sys_check_capability(MLD_SYS_CAP_AARCH64_NEON))
+  {
+    return MLD_NATIVE_FUNC_FALLBACK;
+  }
   mld_polyvecl_pointwise_acc_montgomery_l4_aarch64_asm(w, u, v);
   return MLD_NATIVE_FUNC_SUCCESS;
 }
@@ -236,6 +286,10 @@ static MLD_INLINE int mld_polyvecl_pointwise_acc_montgomery_l5_native(
     int32_t w[MLDSA_N], const int32_t u[5][MLDSA_N],
     const int32_t v[5][MLDSA_N])
 {
+  if (!mld_sys_check_capability(MLD_SYS_CAP_AARCH64_NEON))
+  {
+    return MLD_NATIVE_FUNC_FALLBACK;
+  }
   mld_polyvecl_pointwise_acc_montgomery_l5_aarch64_asm(w, u, v);
   return MLD_NATIVE_FUNC_SUCCESS;
 }
@@ -247,6 +301,10 @@ static MLD_INLINE int mld_polyvecl_pointwise_acc_montgomery_l7_native(
     int32_t w[MLDSA_N], const int32_t u[7][MLDSA_N],
     const int32_t v[7][MLDSA_N])
 {
+  if (!mld_sys_check_capability(MLD_SYS_CAP_AARCH64_NEON))
+  {
+    return MLD_NATIVE_FUNC_FALLBACK;
+  }
   mld_polyvecl_pointwise_acc_montgomery_l7_aarch64_asm(w, u, v);
   return MLD_NATIVE_FUNC_SUCCESS;
 }

data/ext/pqcrypto/vendor/mldsa-native/mldsa/src/native/aarch64/src/arith_native_aarch64.h

@@ -61,12 +61,13 @@ MLD_INTERNAL_DATA_DECLARATION const uint8_t mld_polyz_unpack_19_indices[64];
 #define MLD_AARCH64_REJ_UNIFORM_ETA4_BUFLEN (2 * 136)
 
 #define mld_ntt_aarch64_asm MLD_NAMESPACE(ntt_aarch64_asm)
-void mld_ntt_aarch64_asm(int32_t *r, const int32_t *zetas_l123456,
-                         const int32_t *zetas_l78)
+void mld_ntt_aarch64_asm(int32_t r[MLDSA_N], const int32_t zetas_l123456[144],
+                         const int32_t zetas_l78[384])
 /* This must be kept in sync with the HOL-Light specification
- * in proofs/hol_light/aarch64/proofs/ntt_aarch64_asm.ml */
+ * in proofs/hol_light/aarch64/proofs/mldsa_ntt_aarch64_asm.ml */
 __contract__(
   requires(memory_no_alias(r, sizeof(int32_t) * MLDSA_N))
+  /* check-magic: 8380417 == MLDSA_Q */
   requires(array_abs_bound(r, 0, MLDSA_N, 8380417))
   requires(zetas_l123456 == mld_aarch64_ntt_zetas_layer123456)
   requires(zetas_l78 == mld_aarch64_ntt_zetas_layer78)
@@ -77,10 +78,10 @@ __contract__(
 );
 
 #define mld_intt_aarch64_asm MLD_NAMESPACE(intt_aarch64_asm)
-void mld_intt_aarch64_asm(int32_t *r, const int32_t *zetas_l78,
-                          const int32_t *zetas_l123456)
+void mld_intt_aarch64_asm(int32_t r[MLDSA_N], const int32_t zetas_l78[384],
+                          const int32_t zetas_l123456[160])
 /* This must be kept in sync with the HOL-Light specification
- * in proofs/hol_light/aarch64/proofs/intt_aarch64_asm.ml */
+ * in proofs/hol_light/aarch64/proofs/mldsa_intt_aarch64_asm.ml */
 __contract__(
   requires(memory_no_alias(r, sizeof(int32_t) * MLDSA_N))
   requires(array_abs_bound(r, 0, MLDSA_N, 8380417))
@@ -94,10 +95,10 @@ __contract__(
 
 #define mld_rej_uniform_aarch64_asm MLD_NAMESPACE(rej_uniform_aarch64_asm)
 MLD_MUST_CHECK_RETURN_VALUE
-uint64_t mld_rej_uniform_aarch64_asm(int32_t *r, const uint8_t *buf,
-                                     unsigned buflen, const uint8_t *table)
+uint64_t mld_rej_uniform_aarch64_asm(int32_t r[MLDSA_N], const uint8_t *buf,
+                                     unsigned buflen, const uint8_t table[256])
 /* This must be kept in sync with the HOL-Light specification
- * in proofs/hol_light/aarch64/proofs/rej_uniform_aarch64_asm.ml. */
+ * in proofs/hol_light/aarch64/proofs/mldsa_rej_uniform_aarch64_asm.ml. */
 __contract__(
   requires(buflen % 24 == 0)
   requires(memory_no_alias(buf, buflen))
@@ -112,24 +113,50 @@ __contract__(
 #define mld_rej_uniform_eta2_aarch64_asm \
   MLD_NAMESPACE(rej_uniform_eta2_aarch64_asm)
 MLD_MUST_CHECK_RETURN_VALUE
-uint64_t mld_rej_uniform_eta2_aarch64_asm(int32_t *r, const uint8_t *buf,
-                                          unsigned buflen,
-                                          const uint8_t *table);
+uint64_t mld_rej_uniform_eta2_aarch64_asm(int32_t r[MLDSA_N],
+                                          const uint8_t *buf, unsigned buflen,
+                                          const uint8_t table[4096])
+/* This must be kept in sync with the HOL-Light specification
+ * in proofs/hol_light/aarch64/proofs/mldsa_rej_uniform_eta2_aarch64_asm.ml */
+__contract__(
+  requires(buflen % 8 == 0)
+  requires(buflen >= 8)
+  requires(memory_no_alias(r, sizeof(int32_t) * MLDSA_N))
+  requires(memory_no_alias(buf, buflen))
+  requires(table == mld_rej_uniform_eta_table)
+  assigns(memory_slice(r, sizeof(int32_t) * MLDSA_N))
+  ensures(return_value <= MLDSA_N)
+  /* check-magic: 3 == 2 + 1 (asm is eta=2-specific) */
+  ensures(array_abs_bound(r, 0, return_value, 3))
+);
 
 #define mld_rej_uniform_eta4_aarch64_asm \
   MLD_NAMESPACE(rej_uniform_eta4_aarch64_asm)
 MLD_MUST_CHECK_RETURN_VALUE
-uint64_t mld_rej_uniform_eta4_aarch64_asm(int32_t *r, const uint8_t *buf,
-                                          unsigned buflen,
-                                          const uint8_t *table);
+uint64_t mld_rej_uniform_eta4_aarch64_asm(int32_t r[MLDSA_N],
+                                          const uint8_t *buf, unsigned buflen,
+                                          const uint8_t table[4096])
+/* This must be kept in sync with the HOL-Light specification
+ * in proofs/hol_light/aarch64/proofs/mldsa_rej_uniform_eta4_aarch64_asm.ml */
+__contract__(
+  requires(buflen % 8 == 0)
+  requires(buflen >= 8)
+  requires(memory_no_alias(r, sizeof(int32_t) * MLDSA_N))
+  requires(memory_no_alias(buf, buflen))
+  requires(table == mld_rej_uniform_eta_table)
+  assigns(memory_slice(r, sizeof(int32_t) * MLDSA_N))
+  ensures(return_value <= MLDSA_N)
+  /* check-magic: 5 == 4 + 1 (asm is eta=4-specific) */
+  ensures(array_abs_bound(r, 0, return_value, 5))
+);
 #endif /* !MLD_CONFIG_NO_KEYPAIR_API */
 
 #if !defined(MLD_CONFIG_NO_SIGN_API)
 #define mld_poly_decompose_32_aarch64_asm \
   MLD_NAMESPACE(poly_decompose_32_aarch64_asm)
-void mld_poly_decompose_32_aarch64_asm(int32_t *a1, int32_t *a0)
+void mld_poly_decompose_32_aarch64_asm(int32_t a1[MLDSA_N], int32_t a0[MLDSA_N])
 /* This must be kept in sync with the HOL-Light specification
- * in proofs/hol_light/aarch64/proofs/poly_decompose_32_aarch64_asm.ml */
+ * in proofs/hol_light/aarch64/proofs/mldsa_poly_decompose_32_aarch64_asm.ml */
 __contract__(
   requires(memory_no_alias(a1, sizeof(int32_t) * MLDSA_N))
   requires(memory_no_alias(a0, sizeof(int32_t) * MLDSA_N))
@@ -144,9 +171,9 @@ __contract__(
 
 #define mld_poly_decompose_88_aarch64_asm \
   MLD_NAMESPACE(poly_decompose_88_aarch64_asm)
-void mld_poly_decompose_88_aarch64_asm(int32_t *a1, int32_t *a0)
+void mld_poly_decompose_88_aarch64_asm(int32_t a1[MLDSA_N], int32_t a0[MLDSA_N])
 /* This must be kept in sync with the HOL-Light specification
- * in proofs/hol_light/aarch64/proofs/poly_decompose_88_aarch64_asm.ml */
+ * in proofs/hol_light/aarch64/proofs/mldsa_poly_decompose_88_aarch64_asm.ml */
 __contract__(
   requires(memory_no_alias(a1, sizeof(int32_t) * MLDSA_N))
   requires(memory_no_alias(a0, sizeof(int32_t) * MLDSA_N))
@@ -161,9 +188,9 @@ __contract__(
 #endif /* !MLD_CONFIG_NO_SIGN_API */
 
 #define mld_poly_caddq_aarch64_asm MLD_NAMESPACE(poly_caddq_aarch64_asm)
-void mld_poly_caddq_aarch64_asm(int32_t *a)
+void mld_poly_caddq_aarch64_asm(int32_t a[MLDSA_N])
 /* This must be kept in sync with the HOL-Light specification
- * in proofs/hol_light/aarch64/proofs/poly_caddq_aarch64_asm.ml */
+ * in proofs/hol_light/aarch64/proofs/mldsa_poly_caddq_aarch64_asm.ml */
 __contract__(
   requires(memory_no_alias(a, sizeof(int32_t) * MLDSA_N))
   requires(array_abs_bound(a, 0, MLDSA_N, MLDSA_Q))
@@ -174,9 +201,10 @@ __contract__(
 #if !defined(MLD_CONFIG_NO_VERIFY_API)
 #define mld_poly_use_hint_32_aarch64_asm \
   MLD_NAMESPACE(poly_use_hint_32_aarch64_asm)
-void mld_poly_use_hint_32_aarch64_asm(int32_t *a, const int32_t *h)
+void mld_poly_use_hint_32_aarch64_asm(int32_t a[MLDSA_N],
+                                      const int32_t h[MLDSA_N])
 /* This must be kept in sync with the HOL-Light specification
- * in proofs/hol_light/aarch64/proofs/poly_use_hint_32_aarch64_asm.ml */
+ * in proofs/hol_light/aarch64/proofs/mldsa_poly_use_hint_32_aarch64_asm.ml */
 __contract__(
   requires(memory_no_alias(a, sizeof(int32_t) * MLDSA_N))
   requires(memory_no_alias(h, sizeof(int32_t) * MLDSA_N))
@@ -188,9 +216,10 @@ __contract__(
 
 #define mld_poly_use_hint_88_aarch64_asm \
   MLD_NAMESPACE(poly_use_hint_88_aarch64_asm)
-void mld_poly_use_hint_88_aarch64_asm(int32_t *a, const int32_t *h)
+void mld_poly_use_hint_88_aarch64_asm(int32_t a[MLDSA_N],
+                                      const int32_t h[MLDSA_N])
 /* This must be kept in sync with the HOL-Light specification
- * in proofs/hol_light/aarch64/proofs/poly_use_hint_88_aarch64_asm.ml */
+ * in proofs/hol_light/aarch64/proofs/mldsa_poly_use_hint_88_aarch64_asm.ml */
 __contract__(
   requires(memory_no_alias(a, sizeof(int32_t) * MLDSA_N))
   requires(memory_no_alias(h, sizeof(int32_t) * MLDSA_N))
@@ -203,9 +232,9 @@ __contract__(
 
 #define mld_poly_chknorm_aarch64_asm MLD_NAMESPACE(poly_chknorm_aarch64_asm)
 MLD_MUST_CHECK_RETURN_VALUE
-int mld_poly_chknorm_aarch64_asm(const int32_t *a, int32_t B)
+int mld_poly_chknorm_aarch64_asm(const int32_t a[MLDSA_N], int32_t B)
 /* This must be kept in sync with the HOL-Light specification
- * in proofs/hol_light/aarch64/proofs/poly_chknorm_aarch64_asm.ml */
+ * in proofs/hol_light/aarch64/proofs/mldsa_poly_chknorm_aarch64_asm.ml */
 __contract__(
   requires(memory_no_alias(a, sizeof(int32_t) * MLDSA_N))
   /* HOL Light precondition: abs(ival(x i)) < 2^31, i.e., a[i] != INT32_MIN */
@@ -218,10 +247,10 @@ __contract__(
 #if defined(MLD_CONFIG_MULTILEVEL_WITH_SHARED) || MLD_CONFIG_PARAMETER_SET == 44
 #define mld_polyz_unpack_17_aarch64_asm \
   MLD_NAMESPACE(polyz_unpack_17_aarch64_asm)
-void mld_polyz_unpack_17_aarch64_asm(int32_t *r, const uint8_t *buf,
-                                     const uint8_t *indices)
+void mld_polyz_unpack_17_aarch64_asm(int32_t r[MLDSA_N], const uint8_t buf[576],
+                                     const uint8_t indices[64])
 /* This must be kept in sync with the HOL-Light specification
- * in proofs/hol_light/aarch64/proofs/polyz_unpack_17_aarch64_asm.ml */
+ * in proofs/hol_light/aarch64/proofs/mldsa_polyz_unpack_17_aarch64_asm.ml */
 __contract__(
   requires(memory_no_alias(r, sizeof(int32_t) * MLDSA_N))
   requires(memory_no_alias(buf, 576))
@@ -236,10 +265,10 @@ __contract__(
     (MLD_CONFIG_PARAMETER_SET == 65 || MLD_CONFIG_PARAMETER_SET == 87)
 #define mld_polyz_unpack_19_aarch64_asm \
   MLD_NAMESPACE(polyz_unpack_19_aarch64_asm)
-void mld_polyz_unpack_19_aarch64_asm(int32_t *r, const uint8_t *buf,
-                                     const uint8_t *indices)
+void mld_polyz_unpack_19_aarch64_asm(int32_t r[MLDSA_N], const uint8_t buf[640],
+                                     const uint8_t indices[64])
 /* This must be kept in sync with the HOL-Light specification
- * in proofs/hol_light/aarch64/proofs/polyz_unpack_19_aarch64_asm.ml */
+ * in proofs/hol_light/aarch64/proofs/mldsa_polyz_unpack_19_aarch64_asm.ml */
 __contract__(
   requires(memory_no_alias(r, sizeof(int32_t) * MLDSA_N))
   requires(memory_no_alias(buf, 640))
@@ -255,18 +284,22 @@ __contract__(
     defined(MLD_CONFIG_REDUCE_RAM) || defined(MLD_UNIT_TEST)
 #define mld_poly_pointwise_montgomery_aarch64_asm \
   MLD_NAMESPACE(poly_pointwise_montgomery_aarch64_asm)
-void mld_poly_pointwise_montgomery_aarch64_asm(int32_t *a, const int32_t *b)
+void mld_poly_pointwise_montgomery_aarch64_asm(int32_t a[MLDSA_N],
+                                               const int32_t b[MLDSA_N])
 /* This must be kept in sync with the HOL-Light specification
- * in proofs/hol_light/aarch64/proofs/pointwise_montgomery_aarch64_asm.ml */
+ * in proofs/hol_light/aarch64/proofs/mldsa_pointwise_montgomery_aarch64_asm.ml
+ */
 __contract__(
   requires(memory_no_alias(a, sizeof(int32_t) * MLDSA_N))
   requires(memory_no_alias(b, sizeof(int32_t) * MLDSA_N))
-  /* check-magic: off */
-  requires(array_abs_bound(a, 0, MLDSA_N, 75423753))
-  requires(array_abs_bound(b, 0, MLDSA_N, 75423753))
+  /* Input bound MLD_NTT_BOUND = 9 * MLD_FQMUL_BOUND, the guaranteed bound of
+   * any forward NTT implementation. Hardcoded here to keep this header free
+   * of poly.h. */
+  /* check-magic: 94279698 == 9 * ((5 * MLDSA_Q + 3) / 4) */
+  requires(array_abs_bound(a, 0, MLDSA_N, 94279698))
+  requires(array_abs_bound(b, 0, MLDSA_N, 94279698))
   assigns(memory_slice(a, sizeof(int32_t) * MLDSA_N))
   ensures(array_abs_bound(a, 0, MLDSA_N, 8380417))
-  /* check-magic: on */
 );
 #endif /* !MLD_CONFIG_NO_SIGN_API || !MLD_CONFIG_NO_VERIFY_API || \
           MLD_CONFIG_REDUCE_RAM || MLD_UNIT_TEST */
@@ -274,61 +307,61 @@ __contract__(
 #define mld_polyvecl_pointwise_acc_montgomery_l4_aarch64_asm \
   MLD_NAMESPACE(polyvecl_pointwise_acc_montgomery_l4_aarch64_asm)
 void mld_polyvecl_pointwise_acc_montgomery_l4_aarch64_asm(
-    int32_t *r, const int32_t a[4][MLDSA_N], const int32_t b[4][MLDSA_N])
+    int32_t r[MLDSA_N], const int32_t a[4][MLDSA_N],
+    const int32_t b[4][MLDSA_N])
 /* This must be kept in sync with the HOL-Light specification
  * in
- * proofs/hol_light/aarch64/proofs/mld_polyvecl_pointwise_acc_montgomery_l4_aarch64_asm.ml
+ * proofs/hol_light/aarch64/proofs/mldsa_polyvecl_pointwise_acc_montgomery_l4_aarch64_asm.ml
  */
 __contract__(
   requires(memory_no_alias(r, sizeof(int32_t) * MLDSA_N))
   requires(memory_no_alias(a, sizeof(int32_t) * 4 * MLDSA_N))
   requires(memory_no_alias(b, sizeof(int32_t) * 4 * MLDSA_N))
-  /* check-magic: off */
   requires(forall(l0, 0, 4, array_abs_bound(a[l0], 0, MLDSA_N, 8380417)))
-  requires(forall(l1, 0, 4, array_abs_bound(b[l1], 0, MLDSA_N, 75423753)))
+  /* check-magic: 94279698 == 9 * ((5 * MLDSA_Q + 3) / 4) */
+  requires(forall(l1, 0, 4, array_abs_bound(b[l1], 0, MLDSA_N, 94279698)))
   assigns(memory_slice(r, sizeof(int32_t) * MLDSA_N))
   ensures(array_abs_bound(r, 0, MLDSA_N, 8380417))
-  /* check-magic: on */
 );
 
 #define mld_polyvecl_pointwise_acc_montgomery_l5_aarch64_asm \
   MLD_NAMESPACE(polyvecl_pointwise_acc_montgomery_l5_aarch64_asm)
 void mld_polyvecl_pointwise_acc_montgomery_l5_aarch64_asm(
-    int32_t *r, const int32_t a[5][MLDSA_N], const int32_t b[5][MLDSA_N])
+    int32_t r[MLDSA_N], const int32_t a[5][MLDSA_N],
+    const int32_t b[5][MLDSA_N])
 /* This must be kept in sync with the HOL-Light specification
  * in
- * proofs/hol_light/aarch64/proofs/mld_polyvecl_pointwise_acc_montgomery_l5_aarch64_asm.ml
+ * proofs/hol_light/aarch64/proofs/mldsa_polyvecl_pointwise_acc_montgomery_l5_aarch64_asm.ml
  */
 __contract__(
   requires(memory_no_alias(r, sizeof(int32_t) * MLDSA_N))
   requires(memory_no_alias(a, sizeof(int32_t) * 5 * MLDSA_N))
   requires(memory_no_alias(b, sizeof(int32_t) * 5 * MLDSA_N))
-  /* check-magic: off */
   requires(forall(l0, 0, 5, array_abs_bound(a[l0], 0, MLDSA_N, 8380417)))
-  requires(forall(l1, 0, 5, array_abs_bound(b[l1], 0, MLDSA_N, 75423753)))
+  /* check-magic: 94279698 == 9 * ((5 * MLDSA_Q + 3) / 4) */
+  requires(forall(l1, 0, 5, array_abs_bound(b[l1], 0, MLDSA_N, 94279698)))
   assigns(memory_slice(r, sizeof(int32_t) * MLDSA_N))
   ensures(array_abs_bound(r, 0, MLDSA_N, 8380417))
-  /* check-magic: on */
 );
 
 #define mld_polyvecl_pointwise_acc_montgomery_l7_aarch64_asm \
   MLD_NAMESPACE(polyvecl_pointwise_acc_montgomery_l7_aarch64_asm)
 void mld_polyvecl_pointwise_acc_montgomery_l7_aarch64_asm(
-    int32_t *r, const int32_t a[7][MLDSA_N], const int32_t b[7][MLDSA_N])
+    int32_t r[MLDSA_N], const int32_t a[7][MLDSA_N],
+    const int32_t b[7][MLDSA_N])
 /* This must be kept in sync with the HOL-Light specification
  * in
- * proofs/hol_light/aarch64/proofs/mld_polyvecl_pointwise_acc_montgomery_l7_aarch64_asm.ml
+ * proofs/hol_light/aarch64/proofs/mldsa_polyvecl_pointwise_acc_montgomery_l7_aarch64_asm.ml
  */
 __contract__(
   requires(memory_no_alias(r, sizeof(int32_t) * MLDSA_N))
   requires(memory_no_alias(a, sizeof(int32_t) * 7 * MLDSA_N))
   requires(memory_no_alias(b, sizeof(int32_t) * 7 * MLDSA_N))
-  /* check-magic: off */
   requires(forall(l0, 0, 7, array_abs_bound(a[l0], 0, MLDSA_N, 8380417)))
-  requires(forall(l1, 0, 7, array_abs_bound(b[l1], 0, MLDSA_N, 75423753)))
+  /* check-magic: 94279698 == 9 * ((5 * MLDSA_Q + 3) / 4) */
+  requires(forall(l1, 0, 7, array_abs_bound(b[l1], 0, MLDSA_N, 94279698)))
   assigns(memory_slice(r, sizeof(int32_t) * MLDSA_N))
   ensures(array_abs_bound(r, 0, MLDSA_N, 8380417))
-  /* check-magic: on */
 );
 
 #endif /* !MLD_NATIVE_AARCH64_SRC_ARITH_NATIVE_AARCH64_H */

data/ext/pqcrypto/vendor/mldsa-native/mldsa/src/native/aarch64/src/{intt_aarch64_asm.S → mldsa_intt_aarch64_asm.S}

@@ -14,20 +14,53 @@
  *   Becker, Hwang, Kannwischer, Yang, Yang
  *   https://eprint.iacr.org/2021/986
  *
+ * - [NeonNTT_Autoformalised]
+ *   Neon NTT - (Auto)formalised
+ *   Hanno Becker
+ *   https://eprint.iacr.org/2026/1223
+ *
  * - [SLOTHY_Paper]
  *   Fast and Clean: Auditable high-performance assembly via constraint solving
  *   Abdulrahman, Becker, Kannwischer, Klein
  *   https://eprint.iacr.org/2022/1303
  */
 
-/* AArch64 ML-DSA inverse NTT following @[NeonNTT] and @[SLOTHY_Paper] */
+/* AArch64 ML-DSA inverse NTT following @[NeonNTT], @[SLOTHY_Paper], and @[NeonNTT_Autoformalised] */
+
+/*yaml
+  Name: intt_aarch64_asm
+  Description: AArch64 ML-DSA inverse NTT
+  Signature: void mld_intt_aarch64_asm(int32_t r[256], const int32_t zetas_l78[384], const int32_t zetas_l123456[160])
+  ABI:
+    Architecture: aarch64
+    CallingConvention: AAPCS64
+    Features: [NEON]
+    x0:
+      type: buffer
+      size_bytes: 1024
+      permissions: read/write
+      c_parameter: int32_t r[256]
+      description: Input/output polynomial (256 x int32_t)
+    x1:
+      type: buffer
+      size_bytes: 1536
+      permissions: read-only
+      c_parameter: const int32_t zetas_l78[384]
+      description: Twiddle factors for layers 7-8 (384 x int32_t)
+    x2:
+      type: buffer
+      size_bytes: 640
+      permissions: read-only
+      c_parameter: const int32_t zetas_l123456[160]
+      description: Twiddle factors for layers 1-6 (160 x int32_t)
+*/
 
 #include "../../../common.h"
 #if defined(MLD_ARITH_BACKEND_AARCH64) &&  !defined(MLD_CONFIG_MULTILEVEL_NO_SHARED)
 
 /*
  * WARNING: This file is auto-derived from the mldsa-native source file
- *   dev/aarch64_opt/src/intt_aarch64_asm.S using scripts/simpasm. Do not modify it directly.
+ *   dev/aarch64_opt/src/mldsa_intt_aarch64_asm.S using scripts/simpasm. Do not modify it directly.
  */
 
 .text
@@ -156,7 +189,7 @@ MLD_ASM_FN_SYMBOL(intt_aarch64_asm)
         ldr q17, [x1], #0x60
         sub x4, x4, #0x2
 
-Lintt_layer5678_start:
+Lmld_intt_layer5678_start:
         ldr d4, [x2], #0x20
         mul v0.4s, v21.4s, v17.4s
         ldr q7, [x3, #0xa0]
@@ -230,7 +263,7 @@ Lintt_layer5678_start:
         mul v8.4s, v19.4s, v4.s[0]
         sqrdmulh v24.4s, v21.4s, v2.4s
         subs x4, x4, #0x1
-        cbnz x4, Lintt_layer5678_start
+        cbnz x4, Lmld_intt_layer5678_start
         sqrdmulh v19.4s, v3.4s, v2.4s
         trn2 v0.4s, v14.4s, v26.4s
         str q15, [x3], #0x40
@@ -400,7 +433,7 @@ Lintt_layer5678_start:
         mul v25.4s, v9.4s, v2.s[0]
         sub x4, x4, #0x1
 
-Lintt_layer1234_start:
+Lmld_intt_layer1234_start:
         sub v22.4s, v21.4s, v16.4s
         mls v25.4s, v12.4s, v31.s[0]
         add v12.4s, v21.4s, v16.4s
@@ -618,7 +651,7 @@ Lintt_layer1234_start:
         sqrdmulh v8.4s, v24.4s, v0.s[3]
         mul v25.4s, v22.4s, v2.s[0]
         subs x4, x4, #0x1
-        cbnz x4, Lintt_layer1234_start
+        cbnz x4, Lmld_intt_layer1234_start
         mul v22.4s, v24.4s, v0.s[2]
         sqrdmulh v9.4s, v23.4s, v30.4s
         mls v25.4s, v12.4s, v31.s[0]