pq_crypto 0.6.5 → 0.6.7

data/ext/pqcrypto/vendor/mldsa-native/mldsa/src/native/x86_64/src/mldsa_rej_uniform_eta4_avx2_asm.S

@@ -0,0 +1,176 @@
+/*
+ * Copyright (c) The mldsa-native project authors
+ * SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT
+ */
+
+/* References
+ * ==========
+ *
+ * - [REF_AVX2]
+ *   CRYSTALS-Dilithium optimized AVX2 implementation
+ *   Bai, Ducas, Kiltz, Lepoint, Lyubashevsky, Schwabe, Seiler, Stehlé
+ *   https://github.com/pq-crystals/dilithium/tree/master/avx2
+ */
+
+/*
+ * This file is derived from the public domain
+ * AVX2 Dilithium implementation @[REF_AVX2].
+ */
+
+/*yaml
+  Name: rej_uniform_eta4_avx2_asm
+  Description: x86_64 AVX2 rejection sampling of eta=4 secret coefficients.
+    Extracts 4-bit nibbles from the input byte buffer, accepts those < 9,
+    and maps an accepted nibble n to the coefficient 4 - n, producing
+    values in [-4, 4].
+  Signature: unsigned mld_rej_uniform_eta4_avx2_asm(int32_t *r, const uint8_t *buf, const uint8_t table[256][8])
+  ABI:
+    Architecture: x86_64
+    CallingConvention: SysV
+    Features: [AVX2]
+    rdi:
+      type: buffer
+      size_bytes: 1024
+      permissions: write-only
+      c_parameter: int32_t *r
+      description: Output coefficient buffer (256 x int32_t)
+    rsi:
+      type: buffer
+      size_bytes: 272
+      permissions: read-only
+      c_parameter: const uint8_t *buf
+      description: Input byte buffer (MLD_AVX2_REJ_UNIFORM_ETA4_BUFLEN = 272)
+    rdx:
+      type: buffer
+      size_bytes: 2048
+      permissions: read-only
+      c_parameter: const uint8_t *table
+      description: Lookup table (256 x 8 uint8_t = mld_rej_uniform_table)
+*/
+
+#include "../../../common.h"
+#if defined(MLD_ARITH_BACKEND_X86_64_DEFAULT) && !defined(MLD_CONFIG_MULTILEVEL_NO_SHARED)
+
+/*
+ * WARNING: This file is auto-derived from the mldsa-native source file
+ *   dev/x86_64/src/mldsa_rej_uniform_eta4_avx2_asm.S using scripts/simpasm. Do not modify it directly.
+ */
+
+.text
+.balign 4
+.global MLD_ASM_NAMESPACE(rej_uniform_eta4_avx2_asm)
+MLD_ASM_FN_SYMBOL(rej_uniform_eta4_avx2_asm)
+
+        .cfi_startproc
+        movl $0xf0f0f0f, %r8d        # imm = 0xF0F0F0F
+        vmovd %r8d, %xmm2
+        vpbroadcastd %xmm2, %ymm2
+        movl $0x4040404, %r8d        # imm = 0x4040404
+        vmovd %r8d, %xmm3
+        vpbroadcastd %xmm3, %ymm3
+        movl $0x9090909, %r8d        # imm = 0x9090909
+        vmovd %r8d, %xmm4
+        vpbroadcastd %xmm4, %ymm4
+        xorl %eax, %eax
+        xorl %ecx, %ecx
+
+Lmld_rej_uniform_eta4_avx2_asm_loop:
+        cmpl $0xf8, %eax
+        ja Lmld_rej_uniform_eta4_avx2_asm_scalar
+        cmpl $0x100, %ecx            # imm = 0x100
+        ja Lmld_rej_uniform_eta4_avx2_asm_scalar
+        vpmovzxbw (%rsi,%rcx), %ymm0
+        vpsllw $0x4, %ymm0, %ymm1
+        vpor %ymm1, %ymm0, %ymm0
+        vpand %ymm2, %ymm0, %ymm0
+        vpsubb %ymm4, %ymm0, %ymm1
+        vpsubb %ymm0, %ymm3, %ymm0
+        vpmovmskb %ymm1, %r8d
+        vextracti128 $0x0, %ymm0, %xmm5
+        movzbl %r8b, %r10d
+        vmovq (%rdx,%r10,8), %xmm6
+        vpshufb %xmm6, %xmm5, %xmm6
+        vpmovsxbd %xmm6, %ymm1
+        vmovdqu %ymm1, (%rdi,%rax,4)
+        popcntl %r10d, %r9d
+        addl %r9d, %eax
+        shrl $0x8, %r8d
+        addl $0x4, %ecx
+        cmpl $0xf8, %eax
+        ja Lmld_rej_uniform_eta4_avx2_asm_scalar
+        vpsrldq $0x8, %xmm5, %xmm5      # xmm5 = xmm5[8,9,10,11,12,13,14,15],zero,zero,zero,zero,zero,zero,zero,zero
+        movzbl %r8b, %r10d
+        vmovq (%rdx,%r10,8), %xmm6
+        vpshufb %xmm6, %xmm5, %xmm6
+        vpmovsxbd %xmm6, %ymm1
+        vmovdqu %ymm1, (%rdi,%rax,4)
+        popcntl %r10d, %r9d
+        addl %r9d, %eax
+        shrl $0x8, %r8d
+        addl $0x4, %ecx
+        cmpl $0xf8, %eax
+        ja Lmld_rej_uniform_eta4_avx2_asm_scalar
+        vextracti128 $0x1, %ymm0, %xmm5
+        movzbl %r8b, %r10d
+        vmovq (%rdx,%r10,8), %xmm6
+        vpshufb %xmm6, %xmm5, %xmm6
+        vpmovsxbd %xmm6, %ymm1
+        vmovdqu %ymm1, (%rdi,%rax,4)
+        popcntl %r10d, %r9d
+        addl %r9d, %eax
+        shrl $0x8, %r8d
+        addl $0x4, %ecx
+        cmpl $0xf8, %eax
+        ja Lmld_rej_uniform_eta4_avx2_asm_scalar
+        vpsrldq $0x8, %xmm5, %xmm5      # xmm5 = xmm5[8,9,10,11,12,13,14,15],zero,zero,zero,zero,zero,zero,zero,zero
+        movzbl %r8b, %r10d
+        vmovq (%rdx,%r10,8), %xmm6
+        vpshufb %xmm6, %xmm5, %xmm6
+        vpmovsxbd %xmm6, %ymm1
+        vmovdqu %ymm1, (%rdi,%rax,4)
+        popcntl %r10d, %r9d
+        addl %r9d, %eax
+        addl $0x4, %ecx
+        jmp Lmld_rej_uniform_eta4_avx2_asm_loop
+
+Lmld_rej_uniform_eta4_avx2_asm_scalar:
+        cmpl $0x100, %eax            # imm = 0x100
+        jae Lmld_rej_uniform_eta4_avx2_asm_done
+        cmpl $0x110, %ecx            # imm = 0x110
+        jae Lmld_rej_uniform_eta4_avx2_asm_done
+        movzbl (%rsi,%rcx), %r11d
+        incl %ecx
+        movl %r11d, %r10d
+        andl $0xf, %r10d
+        cmpl $0x9, %r10d
+        jae Lmld_rej_uniform_eta4_avx2_asm_high_nibble
+        movl $0x4, %r9d
+        subl %r10d, %r9d
+        movl %r9d, (%rdi,%rax,4)
+        incl %eax
+        cmpl $0x100, %eax            # imm = 0x100
+        jae Lmld_rej_uniform_eta4_avx2_asm_done
+
+Lmld_rej_uniform_eta4_avx2_asm_high_nibble:
+        shrl $0x4, %r11d
+        andl $0xf, %r11d
+        cmpl $0x9, %r11d
+        jae Lmld_rej_uniform_eta4_avx2_asm_scalar
+        movl $0x4, %r10d
+        subl %r11d, %r10d
+        movl %r10d, (%rdi,%rax,4)
+        incl %eax
+        jmp Lmld_rej_uniform_eta4_avx2_asm_scalar
+
+Lmld_rej_uniform_eta4_avx2_asm_done:
+        retq
+        .cfi_endproc
+
+MLD_ASM_FN_SIZE(rej_uniform_eta4_avx2_asm)
+
+#endif /* MLD_ARITH_BACKEND_X86_64_DEFAULT && !MLD_CONFIG_MULTILEVEL_NO_SHARED \
+        */
+
+#if defined(__ELF__)
+.section .note.GNU-stack,"",%progbits
+#endif

data/ext/pqcrypto/vendor/mldsa-native/mldsa/src/packing.c

@@ -22,7 +22,7 @@ void mld_unpack_pk_t1(mld_poly *t1,
                       const uint8_t pk[MLDSA_CRYPTO_PUBLICKEYBYTES],
                       unsigned int i)
 {
-  mld_polyt1_unpack(t1, pk + MLDSA_SEEDBYTES + i * MLDSA_POLYT1_PACKEDBYTES);
+  mld_polyt1_unpack(t1, pk + MLDSA_PK_T1_OFFSET + i * MLDSA_POLYT1_PACKEDBYTES);
 }
 #endif /* !MLD_CONFIG_NO_VERIFY_API */
 
@@ -31,7 +31,7 @@ MLD_INTERNAL_API
 void mld_pack_sk_s1(uint8_t sk[MLDSA_CRYPTO_SECRETKEYBYTES],
                     const mld_polyvecl *s1)
 {
-  mld_polyvecl_pack_eta(sk + 2 * MLDSA_SEEDBYTES + MLDSA_TRBYTES, s1);
+  mld_polyvecl_pack_eta(sk + MLDSA_SK_S1_OFFSET, s1);
 }
 
 MLD_INTERNAL_API
@@ -41,19 +41,11 @@ void mld_pack_sk_rho_key_tr_s2(uint8_t sk[MLDSA_CRYPTO_SECRETKEYBYTES],
                                const uint8_t key[MLDSA_SEEDBYTES],
                                const mld_polyveck *s2)
 {
-  mld_memcpy(sk, rho, MLDSA_SEEDBYTES);
-  sk += MLDSA_SEEDBYTES;
-
-  mld_memcpy(sk, key, MLDSA_SEEDBYTES);
-  sk += MLDSA_SEEDBYTES;
-
-  mld_memcpy(sk, tr, MLDSA_TRBYTES);
-  sk += MLDSA_TRBYTES;
-
+  mld_memcpy(sk + MLDSA_SK_RHO_OFFSET, rho, MLDSA_SEEDBYTES);
+  mld_memcpy(sk + MLDSA_SK_KEY_OFFSET, key, MLDSA_SEEDBYTES);
+  mld_memcpy(sk + MLDSA_SK_TR_OFFSET, tr, MLDSA_TRBYTES);
   /* s1 already packed via mld_pack_sk_s1 */
-  sk += MLDSA_L * MLDSA_POLYETA_PACKEDBYTES;
-
-  mld_polyveck_pack_eta(sk, s2);
+  mld_polyveck_pack_eta(sk + MLDSA_SK_S2_OFFSET, s2);
   /* t0 already packed via mld_compute_pack_t0_t1 */
 }
 #endif /* !MLD_CONFIG_NO_KEYPAIR_API */
@@ -65,22 +57,12 @@ void mld_unpack_sk(uint8_t rho[MLDSA_SEEDBYTES], uint8_t tr[MLDSA_TRBYTES],
                    mld_sk_s1hat *s1, mld_sk_s2hat *s2,
                    const uint8_t sk[MLDSA_CRYPTO_SECRETKEYBYTES])
 {
-  mld_memcpy(rho, sk, MLDSA_SEEDBYTES);
-  sk += MLDSA_SEEDBYTES;
-
-  mld_memcpy(key, sk, MLDSA_SEEDBYTES);
-  sk += MLDSA_SEEDBYTES;
-
-  mld_memcpy(tr, sk, MLDSA_TRBYTES);
-  sk += MLDSA_TRBYTES;
-
-  mld_unpack_sk_s1hat(s1, sk);
-  sk += MLDSA_L * MLDSA_POLYETA_PACKEDBYTES;
-
-  mld_unpack_sk_s2hat(s2, sk);
-  sk += MLDSA_K * MLDSA_POLYETA_PACKEDBYTES;
-
-  mld_unpack_sk_t0hat(t0, sk);
+  mld_memcpy(rho, sk + MLDSA_SK_RHO_OFFSET, MLDSA_SEEDBYTES);
+  mld_memcpy(key, sk + MLDSA_SK_KEY_OFFSET, MLDSA_SEEDBYTES);
+  mld_memcpy(tr, sk + MLDSA_SK_TR_OFFSET, MLDSA_TRBYTES);
+  mld_unpack_sk_s1hat(s1, sk + MLDSA_SK_S1_OFFSET);
+  mld_unpack_sk_s2hat(s2, sk + MLDSA_SK_S2_OFFSET);
+  mld_unpack_sk_t0hat(t0, sk + MLDSA_SK_T0_OFFSET);
 }
 
 MLD_INTERNAL_API
@@ -104,7 +86,7 @@ int mld_pack_sig_h(uint8_t sig[MLDSA_CRYPTO_BYTES], const mld_polyveck *w0,
    *
    * The final K bytes record a running tally of the number of hints
    * coming from each of the K polynomials. */
-  uint8_t *sig_h = sig + MLDSA_CTILDEBYTES + MLDSA_L * MLDSA_POLYZ_PACKEDBYTES;
+  uint8_t *sig_h = sig + MLDSA_SIG_H_OFFSET;
 
   mld_memset(sig_h, 0, MLDSA_POLYVECH_PACKEDBYTES);
   n = 0;
@@ -157,9 +139,7 @@ MLD_INTERNAL_API
 void mld_pack_sig_z(uint8_t sig[MLDSA_CRYPTO_BYTES], const mld_poly *zi,
                     unsigned i)
 {
-  sig += MLDSA_CTILDEBYTES;
-  sig += i * MLDSA_POLYZ_PACKEDBYTES;
-  mld_polyz_pack(sig, zi);
+  mld_polyz_pack(sig + MLDSA_SIG_Z_OFFSET + i * MLDSA_POLYZ_PACKEDBYTES, zi);
 }
 #endif /* !MLD_CONFIG_NO_SIGN_API */
 
@@ -168,8 +148,7 @@ MLD_INTERNAL_API
 int mld_sig_unpack_hints(mld_poly *h, const uint8_t sig[MLDSA_CRYPTO_BYTES],
                          unsigned int i)
 {
-  const uint8_t *packed_hints =
-      sig + MLDSA_CTILDEBYTES + MLDSA_L * MLDSA_POLYZ_PACKEDBYTES;
+  const uint8_t *packed_hints = sig + MLDSA_SIG_H_OFFSET;
   const unsigned int old_hint_count =
       (i == 0) ? 0 : packed_hints[MLDSA_OMEGA + i - 1];
   const unsigned int new_hint_count = packed_hints[MLDSA_OMEGA + i];
@@ -187,6 +166,9 @@ int mld_sig_unpack_hints(mld_poly *h, const uint8_t sig[MLDSA_CRYPTO_BYTES],
     invariant(j >= old_hint_count && j <= new_hint_count &&
               new_hint_count <= MLDSA_OMEGA)
     invariant(array_bound(h->coeffs, 0, MLDSA_N, 0, 2))
+    invariant(forall(p, 0, MLDSA_N,
+      (h->coeffs[p] == 1) ==
+      exists(hj, old_hint_count, j, packed_hints[hj] == p)))
     decreases(new_hint_count - j)
   )
   {
@@ -214,6 +196,15 @@ int mld_sig_unpack_hints(mld_poly *h, const uint8_t sig[MLDSA_CRYPTO_BYTES],
     }
   }
 
+  /* On success, h->coeffs[p] is 1 exactly for the hint indices decoded for this
+   * row, i.e. packed_hints[old_hint_count, new_hint_count). Asserted here
+   * rather than posted as a contract to not unnecessarily increase proof
+   * complexity at callers that do not need the functional description. */
+  cassert(forall(
+      p, 0, MLDSA_N,
+      (h->coeffs[p] == 1) ==
+          exists(hj, old_hint_count, new_hint_count, packed_hints[hj] == p)));
+
   return 0;
 }
 #endif /* !MLD_CONFIG_NO_VERIFY_API */

data/ext/pqcrypto/vendor/mldsa-native/mldsa/src/packing.h

@@ -2,6 +2,16 @@
  * Copyright (c) The mldsa-native project authors
  * SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT
  */
+
+/* References
+ * ==========
+ *
+ * - [FIPS204]
+ *   FIPS 204 Module-Lattice-Based Digital Signature Standard
+ *   National Institute of Standards and Technology
+ *   https://csrc.nist.gov/pubs/fips/204/final
+ */
+
 #ifndef MLD_PACKING_H
 #define MLD_PACKING_H
 
@@ -13,6 +23,9 @@
 /**
  * Bit-pack the s1 component into the secret key.
  *
+ * @spec{Partially implements @[FIPS204, Algorithm 24, skEncode] (s1
+ * component).}
+ *
  * @param[out] sk Output byte array.
  * @param[in]  s1 Pointer to vector s1.
  */
@@ -34,6 +47,9 @@ __contract__(
  * s1 must already be packed via mld_pack_sk_s1, and t0 via
  * mld_compute_pack_t0_t1.
  *
+ * @spec{Partially implements @[FIPS204, Algorithm 24, skEncode] (rho, key, tr,
+ * s2 components).}
+ *
  * @param[out] sk  Output byte array.
  * @param[in]  rho Byte array containing rho.
  * @param[in]  tr  Byte array containing tr.
@@ -64,6 +80,9 @@ __contract__(
 /**
  * Bit-pack challenge c into sig = (c, z, h).
  *
+ * @spec{Partially implements @[FIPS204, Algorithm 26, sigEncode] (c
+ * component).}
+ *
  * @param[out] sig Output byte array.
  * @param[in]  c   Pointer to challenge hash.
  */
@@ -80,6 +99,14 @@ __contract__(
 /**
  * Compute hints from (w0, w1) and pack them into the hint section of sig.
  *
+ * @spec{Combines the hint computation @[FIPS204, Algorithm 39, MakeHint] with
+ * the packing @[FIPS204, Algorithm 20, HintBitPack] (the h component of
+ * @[FIPS204, Algorithm 26, sigEncode]): it computes the hint vector h from
+ * (w0, w1) and packs it, rather than receiving a ready-made h as HintBitPack
+ * does. The hints are computed via mld_make_hint (rounding.h), a specialized
+ * MakeHint valid only for the values arising during signing; see the block
+ * comment in mld_attempt_signature_generation (sign.c).}
+ *
  * @param[in,out] sig Byte array containing signature.
  * @param[in]     w0  Pointer to low part of input vector.
  * @param[in]     w1  Pointer to high part of input vector.
@@ -98,9 +125,7 @@ __contract__(
   requires(memory_no_alias(sig, MLDSA_CRYPTO_BYTES))
   requires(memory_no_alias(w0, sizeof(mld_polyveck)))
   requires(memory_no_alias(w1, sizeof(mld_polyveck)))
-  assigns(memory_slice(
-    sig + MLDSA_CTILDEBYTES + MLDSA_L * MLDSA_POLYZ_PACKEDBYTES,
-    MLDSA_POLYVECH_PACKEDBYTES))
+  assigns(memory_slice(sig + MLDSA_SIG_H_OFFSET, MLDSA_POLYVECH_PACKEDBYTES))
   ensures(return_value == 0 || return_value == MLD_ERR_FAIL)
 );
 
@@ -111,6 +136,9 @@ __contract__(
  * The c and h components are packed separately using mld_pack_sig_c and
  * mld_pack_sig_h.
  *
+ * @spec{Partially implements @[FIPS204, Algorithm 26, sigEncode] (one
+ * polynomial of the z component).}
+ *
  * @param[in,out] sig Output byte array.
  * @param[in]     zi  Pointer to a single polynomial in z.
  * @param         i   Index of zi in vector z.
@@ -133,6 +161,9 @@ __contract__(
  * Unpack a single polynomial of the t1 component of a public key
  * pk = (rho, t1).
  *
+ * @spec{Partially implements @[FIPS204, Algorithm 23, pkDecode] (one polynomial
+ * of t1).}
+ *
  * @param[out] t1 Pointer to output polynomial t1[i].
  * @param[in]  pk Byte array containing bit-packed pk.
  * @param      i  Row index, must be < MLDSA_K.
@@ -157,6 +188,8 @@ __contract__(
  *
  * NOTE: In REDUCE_RAM mode, s1/s2/t0 borrow from sk rather than copying.
  *
+ * @spec{Implements @[FIPS204, Algorithm 25, skDecode].}
+ *
  * @param[out] rho Output byte array for rho.
  * @param[out] tr  Output byte array for tr.
  * @param[out] key Output byte array for key.
@@ -193,11 +226,9 @@ __contract__(
       array_abs_bound(s2->vec.vec[k2].coeffs, 0, MLDSA_N, MLD_NTT_BOUND)))
   )
   MLD_IF_REDUCE_RAM(
-    ensures(s1->packed == old(sk) + 2 * MLDSA_SEEDBYTES + MLDSA_TRBYTES)
-    ensures(s2->packed == old(sk) + 2 * MLDSA_SEEDBYTES + MLDSA_TRBYTES +
-                          MLDSA_L * MLDSA_POLYETA_PACKEDBYTES)
-    ensures(t0->packed == old(sk) + 2 * MLDSA_SEEDBYTES + MLDSA_TRBYTES +
-                          (MLDSA_L + MLDSA_K) * MLDSA_POLYETA_PACKEDBYTES)
+    ensures(s1->packed == old(sk) + MLDSA_SK_S1_OFFSET)
+    ensures(s2->packed == old(sk) + MLDSA_SK_S2_OFFSET)
+    ensures(t0->packed == old(sk) + MLDSA_SK_T0_OFFSET)
   )
 );
 #endif /* !MLD_CONFIG_NO_SIGN_API */
@@ -219,6 +250,9 @@ __contract__(
  * call returns MLD_ERR_FAIL the encoding is malformed and the signature must
  * be rejected.
  *
+ * @spec{Implements @[FIPS204, Algorithm 21, HintBitUnpack] (one row; part of
+ * @[FIPS204, Algorithm 27, sigDecode]).}
+ *
  * @param[out] h   Pointer to output polynomial h[i].
  * @param[in]  sig Signature buffer.
  * @param      i   Row index, must be < MLDSA_K.

data/ext/pqcrypto/vendor/mldsa-native/mldsa/src/params.h

@@ -14,6 +14,11 @@
 #define MLDSA_Q_HALF ((MLDSA_Q + 1) / 2)
 #define MLDSA_D 13
 
+#define MLDSA_GAMMA2_88 ((MLDSA_Q - 1) / 88)
+#define MLDSA_GAMMA2_32 ((MLDSA_Q - 1) / 32)
+#define MLDSA_POLYW1_PACKEDBYTES_88 192
+#define MLDSA_POLYW1_PACKEDBYTES_32 128
+
 #if MLD_CONFIG_PARAMETER_SET == 44
 
 #define MLDSA_K 4
@@ -21,12 +26,12 @@
 #define MLDSA_ETA 2
 #define MLDSA_TAU 39
 #define MLDSA_BETA 78
-#define MLDSA_GAMMA1 (1 << 17)
-#define MLDSA_GAMMA2 ((MLDSA_Q - 1) / 88)
+#define MLDSA_GAMMA1 ((int32_t)1 << 17)
+#define MLDSA_GAMMA2 MLDSA_GAMMA2_88
 #define MLDSA_OMEGA 80
 #define MLDSA_CTILDEBYTES 32
 #define MLDSA_POLYZ_PACKEDBYTES 576
-#define MLDSA_POLYW1_PACKEDBYTES 192
+#define MLDSA_POLYW1_PACKEDBYTES MLDSA_POLYW1_PACKEDBYTES_88
 #define MLDSA_POLYETA_PACKEDBYTES 96
 
 #elif MLD_CONFIG_PARAMETER_SET == 65
@@ -36,12 +41,12 @@
 #define MLDSA_ETA 4
 #define MLDSA_TAU 49
 #define MLDSA_BETA 196
-#define MLDSA_GAMMA1 (1 << 19)
-#define MLDSA_GAMMA2 ((MLDSA_Q - 1) / 32)
+#define MLDSA_GAMMA1 ((int32_t)1 << 19)
+#define MLDSA_GAMMA2 MLDSA_GAMMA2_32
 #define MLDSA_OMEGA 55
 #define MLDSA_CTILDEBYTES 48
 #define MLDSA_POLYZ_PACKEDBYTES 640
-#define MLDSA_POLYW1_PACKEDBYTES 128
+#define MLDSA_POLYW1_PACKEDBYTES MLDSA_POLYW1_PACKEDBYTES_32
 #define MLDSA_POLYETA_PACKEDBYTES 128
 
 #elif MLD_CONFIG_PARAMETER_SET == 87
@@ -51,12 +56,12 @@
 #define MLDSA_ETA 2
 #define MLDSA_TAU 60
 #define MLDSA_BETA 120
-#define MLDSA_GAMMA1 (1 << 19)
-#define MLDSA_GAMMA2 ((MLDSA_Q - 1) / 32)
+#define MLDSA_GAMMA1 ((int32_t)1 << 19)
+#define MLDSA_GAMMA2 MLDSA_GAMMA2_32
 #define MLDSA_OMEGA 75
 #define MLDSA_CTILDEBYTES 64
 #define MLDSA_POLYZ_PACKEDBYTES 640
-#define MLDSA_POLYW1_PACKEDBYTES 128
+#define MLDSA_POLYW1_PACKEDBYTES MLDSA_POLYW1_PACKEDBYTES_32
 #define MLDSA_POLYETA_PACKEDBYTES 96
 
 #endif /* MLD_CONFIG_PARAMETER_SET == 87 */
@@ -65,13 +70,84 @@
 #define MLDSA_POLYT0_PACKEDBYTES 416
 #define MLDSA_POLYVECH_PACKEDBYTES (MLDSA_OMEGA + MLDSA_K)
 
-#define MLDSA_CRYPTO_PUBLICKEYBYTES \
-  (MLDSA_SEEDBYTES + MLDSA_K * MLDSA_POLYT1_PACKEDBYTES)
-#define MLDSA_CRYPTO_SECRETKEYBYTES                                            \
-  (2 * MLDSA_SEEDBYTES + MLDSA_TRBYTES + MLDSA_L * MLDSA_POLYETA_PACKEDBYTES + \
-   MLDSA_K * MLDSA_POLYETA_PACKEDBYTES + MLDSA_K * MLDSA_POLYT0_PACKEDBYTES)
-#define MLDSA_CRYPTO_BYTES                                 \
-  (MLDSA_CTILDEBYTES + MLDSA_L * MLDSA_POLYZ_PACKEDBYTES + \
-   MLDSA_POLYVECH_PACKEDBYTES)
+/* Sampling y from counter kappa uses nonces kappa, ..., kappa+L-1, which fit in
+ * uint16_t iff kappa <= UINT16_MAX - MLDSA_L. With kappa = attempt*MLDSA_L this
+ * bounds the number of signing attempts by MLD_MAX_KAPPA / MLDSA_L; see
+ * MLD_MAX_SIGNING_ATTEMPTS in sign.c. */
+#define MLD_MAX_KAPPA (UINT16_MAX - MLDSA_L)
+
+/* Layout of the packed public key pk[MLDSA_CRYPTO_PUBLICKEYBYTES] = (rho, t1):
+ *
+ *   +-------------+--------------------------+
+ *   | rho         | t1                       |
+ *   +-------------+--------------------------+
+ *   | SEEDBYTES   | K * POLYT1_PACKEDBYTES   |
+ *   +-------------+--------------------------+
+ */
+#define MLDSA_PK_RHO_OFFSET 0
+#define MLDSA_PK_RHO_BYTES MLDSA_SEEDBYTES
+
+#define MLDSA_PK_T1_OFFSET (MLDSA_PK_RHO_OFFSET + MLDSA_PK_RHO_BYTES)
+#define MLDSA_PK_T1_BYTES (MLDSA_K * MLDSA_POLYT1_PACKEDBYTES)
+
+#define MLDSA_PK_END (MLDSA_PK_T1_OFFSET + MLDSA_PK_T1_BYTES)
+
+#define MLDSA_CRYPTO_PUBLICKEYBYTES MLDSA_PK_END
+
+/* Layout of the packed secret key
+ *  sk[MLDSA_CRYPTO_SECRETKEYBYTES] = (rho, key, tr, s1, s2, t0):
+ *
+ *   +-----------+-----------+-----------+-----------+-----------+-----------+
+ *   | rho       | key       | tr        | s1        | s2        | t0        |
+ *   +-----------+-----------+-----------+-----------+-----------+-----------+
+ *   | SEEDBYTES | SEEDBYTES | TRBYTES   | L *       | K *       | K *       |
+ *   |           |           |           | POLYETA_  | POLYETA_  | POLYT0_   |
+ *   |           |           |           | PACKED-   | PACKED-   | PACKED-   |
+ *   |           |           |           | BYTES     | BYTES     | BYTES     |
+ *   +-----------+-----------+-----------+-----------+-----------+-----------+
+ */
+#define MLDSA_SK_RHO_OFFSET 0
+#define MLDSA_SK_RHO_BYTES MLDSA_SEEDBYTES
+
+#define MLDSA_SK_KEY_OFFSET (MLDSA_SK_RHO_OFFSET + MLDSA_SK_RHO_BYTES)
+#define MLDSA_SK_KEY_BYTES MLDSA_SEEDBYTES
+
+#define MLDSA_SK_TR_OFFSET (MLDSA_SK_KEY_OFFSET + MLDSA_SK_KEY_BYTES)
+#define MLDSA_SK_TR_BYTES MLDSA_TRBYTES
+
+#define MLDSA_SK_S1_OFFSET (MLDSA_SK_TR_OFFSET + MLDSA_SK_TR_BYTES)
+#define MLDSA_SK_S1_BYTES (MLDSA_L * MLDSA_POLYETA_PACKEDBYTES)
+
+#define MLDSA_SK_S2_OFFSET (MLDSA_SK_S1_OFFSET + MLDSA_SK_S1_BYTES)
+#define MLDSA_SK_S2_BYTES (MLDSA_K * MLDSA_POLYETA_PACKEDBYTES)
+
+#define MLDSA_SK_T0_OFFSET (MLDSA_SK_S2_OFFSET + MLDSA_SK_S2_BYTES)
+#define MLDSA_SK_T0_BYTES (MLDSA_K * MLDSA_POLYT0_PACKEDBYTES)
+
+#define MLDSA_SK_END (MLDSA_SK_T0_OFFSET + MLDSA_SK_T0_BYTES)
+
+#define MLDSA_CRYPTO_SECRETKEYBYTES MLDSA_SK_END
+
+/* Layout of the packed signature sig[MLDSA_CRYPTO_BYTES] = (c, z, h):
+ *
+ *   +----------------+-------------------+----------------------+
+ *   | c (challenge)  | z                 | h (hints)            |
+ *   +----------------+-------------------+----------------------+
+ *   | CTILDEBYTES    | L *               | POLYVECH_PACKEDBYTES |
+ *   |                | POLYZ_PACKEDBYTES | (= OMEGA + K)        |
+ *   +----------------+-------------------+----------------------+
+ */
+#define MLDSA_SIG_C_OFFSET 0
+#define MLDSA_SIG_C_BYTES MLDSA_CTILDEBYTES
+
+#define MLDSA_SIG_Z_OFFSET (MLDSA_SIG_C_OFFSET + MLDSA_SIG_C_BYTES)
+#define MLDSA_SIG_Z_BYTES (MLDSA_L * MLDSA_POLYZ_PACKEDBYTES)
+
+#define MLDSA_SIG_H_OFFSET (MLDSA_SIG_Z_OFFSET + MLDSA_SIG_Z_BYTES)
+#define MLDSA_SIG_H_BYTES MLDSA_POLYVECH_PACKEDBYTES
+
+#define MLDSA_SIG_END (MLDSA_SIG_H_OFFSET + MLDSA_SIG_H_BYTES)
+
+#define MLDSA_CRYPTO_BYTES MLDSA_SIG_END
 
 #endif /* !MLD_PARAMS_H */