pq_crypto 0.6.5 → 0.6.7

data/ext/pqcrypto/vendor/mlkem-native/mlkem/mlkem_native_config.h

@@ -104,7 +104,7 @@
  *
  * By default, mlkem-native includes support for generating key pairs.
  * If you don't need this, set MLK_CONFIG_NO_KEYPAIR_API to exclude
- * crypto_kem_keypair and crypto_kem_keypair_derand, and all internal
+ * keypair and keypair_derand, and all internal
  * APIs only needed by those functions.
  */
 /* #define MLK_CONFIG_NO_KEYPAIR_API */
@@ -114,11 +114,11 @@
  *
  * By default, mlkem-native includes support for encapsulation. If you
  * don't need this, set MLK_CONFIG_NO_ENCAPS_API to exclude
- * crypto_kem_enc, crypto_kem_enc_derand, crypto_kem_check_pk, and
+ * enc, enc_derand, check_pk, and
  * all internal APIs only needed by those functions.
  *
  * @note Setting this option is incompatible with MLK_CONFIG_KEYGEN_PCT
- *       as the current PCT implementation requires crypto_kem_enc().
+ *       as the current PCT implementation requires enc().
  */
 /* #define MLK_CONFIG_NO_ENCAPS_API */
 
@@ -127,11 +127,11 @@
  *
  * By default, mlkem-native includes support for decapsulation. If you
  * don't need this, set MLK_CONFIG_NO_DECAPS_API to exclude
- * crypto_kem_dec, crypto_kem_check_sk, and all internal APIs only
+ * dec, check_sk, and all internal APIs only
  * needed by those functions.
  *
  * @note Setting this option is incompatible with MLK_CONFIG_KEYGEN_PCT
- *       as the current PCT implementation requires crypto_kem_dec().
+ *       as the current PCT implementation requires dec().
  */
 /* #define MLK_CONFIG_NO_DECAPS_API */
 
@@ -139,28 +139,16 @@
  * MLK_CONFIG_NO_RANDOMIZED_API
  *
  * If this option is set, mlkem-native will be built without the randomized
- * API functions (crypto_kem_keypair and crypto_kem_enc). This allows users
+ * API functions (keypair and enc). This allows users
  * to build mlkem-native without providing a randombytes() implementation
- * if they only need the deterministic API (crypto_kem_keypair_derand,
- * crypto_kem_enc_derand, crypto_kem_dec).
+ * if they only need the deterministic API (keypair_derand,
+ * enc_derand, dec).
  *
  * @note This option is incompatible with MLK_CONFIG_KEYGEN_PCT as the
- *       current PCT implementation requires crypto_kem_enc().
+ *       current PCT implementation requires enc().
  */
 /* #define MLK_CONFIG_NO_RANDOMIZED_API */
 
-/**
- * MLK_CONFIG_NO_SUPERCOP
- *
- * By default, mlkem_native.h exposes the mlkem-native API in the SUPERCOP
- * naming convention (crypto_kem_xxx). If you don't need this, set
- * MLK_CONFIG_NO_SUPERCOP.
- *
- * @note You must set this for a multi-level build as the SUPERCOP naming
- *       does not disambiguate between the parameter sets.
- */
-/* #define MLK_CONFIG_NO_SUPERCOP */
-
 /**
  * MLK_CONFIG_CONSTANTS_ONLY
  *
@@ -328,7 +316,7 @@
  * implementation, different from the one shipped with mlkem-native.
  *
  * If set, it must be the name of a file serving as the replacement for
- * mlkem/fips202/fips202.h, and exposing the same API (see FIPS202.md).
+ * mlkem/src/fips202/fips202.h, and exposing the same API (see FIPS202.md).
  */
 /* #define MLK_CONFIG_FIPS202_CUSTOM_HEADER "SOME_FILE.h" */
 
@@ -341,7 +329,7 @@
  * implementation, different from the one shipped with mlkem-native.
  *
  * If set, it must be the name of a file serving as the replacement for
- * mlkem/fips202/fips202x4.h, and exposing the same API (see FIPS202.md).
+ * mlkem/src/fips202/fips202x4.h, and exposing the same API (see FIPS202.md).
  */
 /* #define MLK_CONFIG_FIPS202X4_CUSTOM_HEADER "SOME_FILE.h" */
 
@@ -349,25 +337,35 @@
  * MLK_CONFIG_CUSTOM_ZEROIZE
  *
  * In compliance with @[FIPS203, Section 3.3], mlkem-native zeroizes
- * intermediate stack buffers before returning from function calls.
+ * intermediate buffers before returning from function calls. By default,
+ * those buffers are allocated from the stack; if MLK_CONFIG_CUSTOM_ALLOC_FREE
+ * is set, they are (mostly -- few exceptions remain at present) allocated from
+ * the configured custom allocator.
+ *
+ * mlkem-native also zeroizes caller-owned output buffers as needed to uphold
+ * the API convention that outputs be either unmodified or zeroized upon
+ * failure.
  *
  * Set this option and define `mlk_zeroize` if you want to use a custom
- * method to zeroize intermediate stack buffers. The default implementation
- * uses SecureZeroMemory on Windows and a memset + compiler barrier
- * otherwise. If neither of those is available on the target platform,
- * compilation will fail, and you will need to use MLK_CONFIG_CUSTOM_ZEROIZE
- * to provide a custom implementation of `mlk_zeroize()`.
- *
- * @warning The explicit stack zeroization conducted by mlkem-native reduces
- *          the likelihood of data leaking on the stack, but does not
- *          eliminate it. The C standard makes no guarantee about where a
- *          compiler allocates structures and whether/where it makes copies
- *          of them. Also, in addition to entire structures, there may also
- *          be potentially exploitable leakage of individual values on the
- *          stack. If you need bullet-proof zeroization of the stack, you
- *          need to consider additional measures instead of what this
- *          feature provides. In this case, you can set mlk_zeroize to a
- *          no-op.
+ * method to zeroize intermediate and output buffers.
+ *
+ * The default implementation uses SecureZeroMemory on Windows and a
+ * memset + compiler barrier otherwise. If neither of those is available on
+ * the target platform, compilation will fail, and you will need to use
+ * MLK_CONFIG_CUSTOM_ZEROIZE to provide a custom implementation of
+ * `mlk_zeroize()`.
+ *
+ * @warning
+ *   The zeroization conducted by mlkem-native reduces the likelihood of data
+ *   leaking on the stack or custom allocators, but it does not eliminate it.
+ *   For example, the C standard makes no guarantee about where a compiler
+ *   allocates local structures and whether/where it makes copies of them.
+ *   Also, in addition to entire structures, there may also be potentially
+ *   exploitable leakage of individual values on the stack. If you need
+ *   bullet-proof zeroization of the stack, you need to consider additional
+ *   measures instead of what this feature provides. In this case, you can
+ *   set mlk_zeroize to a no-op. Note that in this case you are also responsible
+ *   for zeroizing output buffers upon failure.
  */
 /* #define MLK_CONFIG_CUSTOM_ZEROIZE
    #if !defined(__ASSEMBLER__)
@@ -458,7 +456,7 @@
  *
  * @warning This option is experimental. Its scope, configuration and
  *          function/macro signatures may change at any time. We expect a
- *          stable API for v2.
+ *          stable API in a future version.
  *
  * @note Even if this option is set, some allocations further down the call
  *       stack will still be made from the stack, consuming up to 3KB of
@@ -585,8 +583,8 @@
  * can be exported.
  *
  * Set this option if such a check should be implemented. In this case,
- * crypto_kem_keypair_derand and crypto_kem_keypair will return a non-zero
- * error code if the PCT failed.
+ * keypair_derand and keypair will return
+ * MLK_ERR_PCT_FAIL if the PCT failed.
  *
  * @note This feature will drastically lower the performance of key
  *       generation.
@@ -670,7 +668,11 @@
  * e.g., PQCP_MLKEM_NATIVE_MLKEM512_
  */
 
-#if MLK_CONFIG_PARAMETER_SET == 512
+#if defined(MLK_CONFIG_MULTILEVEL_BUILD)
+/* In a multi-level build the parameter set is appended by the namespacing
+ * machinery, so the default prefix must not embed it. */
+#define MLK_DEFAULT_NAMESPACE_PREFIX PQCP_MLKEM_NATIVE_MLKEM
+#elif MLK_CONFIG_PARAMETER_SET == 512
 #define MLK_DEFAULT_NAMESPACE_PREFIX PQCP_MLKEM_NATIVE_MLKEM512
 #elif MLK_CONFIG_PARAMETER_SET == 768
 #define MLK_DEFAULT_NAMESPACE_PREFIX PQCP_MLKEM_NATIVE_MLKEM768

data/ext/pqcrypto/vendor/mlkem-native/mlkem/src/cbmc.h

@@ -180,8 +180,33 @@
 
 #define array_unchanged_u64(array_var, N) \
     array_unchanged_u64_core(CBMC_CONCAT(_cbmc_idx, __COUNTER__), 0, (N), (array_var))
+
+#define array_unchanged_u8_core(qvar, array_var, N)                     \
+  forall(qvar, 0, (N),                                                  \
+    ((array_var)[(qvar)]) == (old(* (uint8_t (*)[(N)])(array_var)))[(qvar)])
+
+#define array_unchanged_u8(array_var, N) \
+    array_unchanged_u8_core(CBMC_CONCAT(_cbmc_idx, __COUNTER__), (array_var), (N))
+
+#define array_zeroized_u8_core(qvar, array_var, N) \
+    forall(qvar, 0, (N), ((array_var)[(qvar)]) == 0)
+
+#define array_zeroized_u8(array_var, N) \
+    array_zeroized_u8_core(CBMC_CONCAT(_cbmc_idx, __COUNTER__), (array_var), (N))
 /* clang-format on */
 
+/*
+ * Output-buffer discipline on failure, as documented in API-CONVENTIONS.md:
+ * when a function fails, each caller-owned output buffer is left either
+ * fully unchanged or fully zeroized -- never holding partially computed or
+ * stale data that could be mistaken for a valid result.
+ *
+ * Note the disjunction is over the buffer as a whole: it is not enough for
+ * each byte to be individually either unchanged or zero.
+ */
+#define array_unchanged_or_zeroized_u8(array_var, N) \
+  (array_unchanged_u8((array_var), (N)) || array_zeroized_u8((array_var), (N)))
+
 /* Wrapper around array_bound operating on absolute values.
  *
  * The absolute value bound `k` is exclusive.

data/ext/pqcrypto/vendor/mlkem-native/mlkem/src/common.h

@@ -2,6 +2,22 @@
  * Copyright (c) The mlkem-native project authors
  * SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT
  */
+
+/* References
+ * ==========
+ *
+ * - [FIPS140_3_IG]
+ *   Implementation Guidance for FIPS 140-3 and the Cryptographic Module
+ *   Validation Program
+ *   National Institute of Standards and Technology
+ *   https://csrc.nist.gov/projects/cryptographic-module-validation-program/fips-140-3-ig-announcements
+ *
+ * - [FIPS203]
+ *   FIPS 203 Module-Lattice-Based Key-Encapsulation Mechanism Standard
+ *   National Institute of Standards and Technology
+ *   https://csrc.nist.gov/pubs/fips/203/final
+ */
+
 #ifndef MLK_COMMON_H
 #define MLK_COMMON_H
 
@@ -64,7 +80,7 @@
 #define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s)
 
 /* On Apple platforms, we need to emit leading underscore
- * in front of assembly symbols. We thus introducee a separate
+ * in front of assembly symbols. We thus introduce a separate
  * namespace wrapper for ASM symbols. */
 #if !defined(__APPLE__)
 #define MLK_ASM_NAMESPACE(sym) MLK_NAMESPACE(sym)
@@ -122,15 +138,15 @@
 #endif
 
 #if defined(MLK_CONFIG_NO_RANDOMIZED_API) && defined(MLK_CONFIG_KEYGEN_PCT)
-#error Bad configuration: MLK_CONFIG_NO_RANDOMIZED_API is incompatible with MLK_CONFIG_KEYGEN_PCT as the current PCT implementation requires crypto_kem_enc()
+#error Bad configuration: MLK_CONFIG_NO_RANDOMIZED_API is incompatible with MLK_CONFIG_KEYGEN_PCT as the current PCT implementation requires enc()
 #endif
 
 #if defined(MLK_CONFIG_NO_ENCAPS_API) && defined(MLK_CONFIG_KEYGEN_PCT)
-#error Bad configuration: MLK_CONFIG_NO_ENCAPS_API is incompatible with MLK_CONFIG_KEYGEN_PCT as the current PCT implementation requires crypto_kem_enc()
+#error Bad configuration: MLK_CONFIG_NO_ENCAPS_API is incompatible with MLK_CONFIG_KEYGEN_PCT as the current PCT implementation requires enc()
 #endif
 
 #if defined(MLK_CONFIG_NO_DECAPS_API) && defined(MLK_CONFIG_KEYGEN_PCT)
-#error Bad configuration: MLK_CONFIG_NO_DECAPS_API is incompatible with MLK_CONFIG_KEYGEN_PCT as the current PCT implementation requires crypto_kem_dec()
+#error Bad configuration: MLK_CONFIG_NO_DECAPS_API is incompatible with MLK_CONFIG_KEYGEN_PCT as the current PCT implementation requires dec()
 #endif
 
 #if defined(MLK_CONFIG_USE_NATIVE_BACKEND_ARITH)
@@ -220,6 +236,7 @@
 #define MLK_FREE(v, T, N, context)                     \
   do                                                   \
   {                                                    \
+    MLK_CONTEXT_UNUSED(context);                       \
     mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \
     (v) = NULL;                                        \
   } while (0)
@@ -251,14 +268,28 @@
 
 /****************************** Error codes ***********************************/
 
-/* Generic failure condition */
+/* Generic failure condition. Currently not returned by any function;
+ * reserved for failures that no more specific code covers. */
 #define MLK_ERR_FAIL (-1)
 /* An allocation failed. This can only happen if MLK_CONFIG_CUSTOM_ALLOC_FREE
  * is defined and the provided MLK_CUSTOM_ALLOC can fail. */
 #define MLK_ERR_OUT_OF_MEMORY (-2)
-/* An rng failure occured. Might be due to insufficient entropy or
+/* An RNG failure occurred. Might be due to insufficient entropy or
  * system misconfiguration. */
 #define MLK_ERR_RNG_FAIL (-3)
+/* Public key validation failed: the @[FIPS203, Section 7.2, 'modulus check']
+ * found a coefficient outside [0,q-1]. Returned by check_pk and by the
+ * encapsulation API. */
+#define MLK_ERR_INVALID_PK (-4)
+/* Secret key validation failed: the @[FIPS203, Section 7.3, 'hash check']
+ * found the embedded public key hash inconsistent. Returned by check_sk and
+ * by the decapsulation API. */
+#define MLK_ERR_INVALID_SK (-5)
+/* The 'Pairwise Consistency Test' @[FIPS140_3_IG, p.87] and
+ * @[FIPS203, Section 7.1, Pairwise Consistency] failed. Only possible when
+ * MLK_CONFIG_KEYGEN_PCT is enabled; signals that the freshly generated key
+ * pair failed its encaps/decaps self-test. */
+#define MLK_ERR_PCT_FAIL (-6)
 
 #endif /* !__ASSEMBLER__ */
 

data/ext/pqcrypto/vendor/mlkem-native/mlkem/src/context.h

@@ -34,6 +34,15 @@
   (arg0, arg1, arg2, arg3)
 #endif /* !MLK_CONFIG_CONTEXT_PARAMETER */
 
+/* Consume a context parameter carried only for the integration's benefit,
+ * avoiding -Wunused-parameter; expands to nothing when no context is
+ * configured. */
+#if defined(MLK_CONFIG_CONTEXT_PARAMETER)
+#define MLK_CONTEXT_UNUSED(context) ((void)(context))
+#else
+#define MLK_CONTEXT_UNUSED(context) ((void)0)
+#endif
+
 #if defined(MLK_CONFIG_CONTEXT_PARAMETER_TYPE) != \
     defined(MLK_CONFIG_CONTEXT_PARAMETER)
 #error MLK_CONFIG_CONTEXT_PARAMETER_TYPE must be defined if and only if MLK_CONFIG_CONTEXT_PARAMETER is defined

data/ext/pqcrypto/vendor/mlkem-native/mlkem/src/fips202/fips202.h

@@ -132,12 +132,12 @@ __contract__(
 );
 
 #if !defined(MLK_CONFIG_USE_NATIVE_BACKEND_FIPS202) || \
-    !defined(MLK_USE_FIPS202_X4_NATIVE)
+    !defined(MLK_USE_NATIVE_FIPS202_X4)
 /* If you provide your own FIPS-202 implementation where the x4-
  * Keccak-f1600-x4 implementation falls back to 4-fold Keccak-f1600,
  * set this to gain a small speedup. */
 #define FIPS202_X4_DEFAULT_IMPLEMENTATION
-#endif /* !MLK_CONFIG_USE_NATIVE_BACKEND_FIPS202 || !MLK_USE_FIPS202_X4_NATIVE \
+#endif /* !MLK_CONFIG_USE_NATIVE_BACKEND_FIPS202 || !MLK_USE_NATIVE_FIPS202_X4 \
         */
 
 

data/ext/pqcrypto/vendor/mlkem-native/mlkem/src/fips202/keccakf1600.c

@@ -115,14 +115,14 @@ void mlk_keccakf1600x4_extract_bytes(uint64_t *state, unsigned char *data0,
                                      unsigned char *data3, unsigned offset,
                                      unsigned length)
 {
-#if defined(MLK_USE_FIPS202_X4_EXTRACT_BYTES_NATIVE)
+#if defined(MLK_USE_NATIVE_FIPS202_X4_EXTRACT_BYTES)
   if (mlk_keccakf1600_extract_bytes_x4_native(state, data0, data1, data2, data3,
                                               offset, length) ==
       MLK_NATIVE_FUNC_SUCCESS)
   {
     return;
   }
-#endif /* MLK_USE_FIPS202_X4_EXTRACT_BYTES_NATIVE */
+#endif /* MLK_USE_NATIVE_FIPS202_X4_EXTRACT_BYTES */
   mlk_keccakf1600x4_extract_bytes_c(state, data0, data1, data2, data3, offset,
                                     length);
 }
@@ -164,26 +164,26 @@ void mlk_keccakf1600x4_xor_bytes(uint64_t *state, const unsigned char *data0,
                                  const unsigned char *data3, unsigned offset,
                                  unsigned length)
 {
-#if defined(MLK_USE_FIPS202_X4_XOR_BYTES_NATIVE)
+#if defined(MLK_USE_NATIVE_FIPS202_X4_XOR_BYTES)
   if (mlk_keccakf1600_xor_bytes_x4_native(state, data0, data1, data2, data3,
                                           offset,
                                           length) == MLK_NATIVE_FUNC_SUCCESS)
   {
     return;
   }
-#endif /* MLK_USE_FIPS202_X4_XOR_BYTES_NATIVE */
+#endif /* MLK_USE_NATIVE_FIPS202_X4_XOR_BYTES */
   mlk_keccakf1600x4_xor_bytes_c(state, data0, data1, data2, data3, offset,
                                 length);
 }
 
 void mlk_keccakf1600x4_permute(uint64_t *state)
 {
-#if defined(MLK_USE_FIPS202_X4_NATIVE)
+#if defined(MLK_USE_NATIVE_FIPS202_X4)
   if (mlk_keccak_f1600_x4_native(state) == MLK_NATIVE_FUNC_SUCCESS)
   {
     return;
   }
-#endif /* MLK_USE_FIPS202_X4_NATIVE */
+#endif /* MLK_USE_NATIVE_FIPS202_X4 */
   mlk_keccakf1600_permute(state + MLK_KECCAK_LANES * 0);
   mlk_keccakf1600_permute(state + MLK_KECCAK_LANES * 1);
   mlk_keccakf1600_permute(state + MLK_KECCAK_LANES * 2);
@@ -478,12 +478,12 @@ __contract__(
 
 void mlk_keccakf1600_permute(uint64_t *state)
 {
-#if defined(MLK_USE_FIPS202_X1_NATIVE)
+#if defined(MLK_USE_NATIVE_FIPS202_X1)
   if (mlk_keccak_f1600_x1_native(state) == MLK_NATIVE_FUNC_SUCCESS)
   {
     return;
   }
-#endif /* MLK_USE_FIPS202_X1_NATIVE */
+#endif /* MLK_USE_NATIVE_FIPS202_X1 */
   mlk_keccakf1600_permute_c(state);
 }
 

data/ext/pqcrypto/vendor/mlkem-native/mlkem/src/fips202/native/aarch64/x1_scalar.h

@@ -7,7 +7,7 @@
 #define MLK_FIPS202_NATIVE_AARCH64_X1_SCALAR_H
 
 /* Part of backend API */
-#define MLK_USE_FIPS202_X1_NATIVE
+#define MLK_USE_NATIVE_FIPS202_X1
 /* Guard for assembly file */
 #define MLK_FIPS202_AARCH64_NEED_X1_SCALAR
 

data/ext/pqcrypto/vendor/mlkem-native/mlkem/src/fips202/native/aarch64/x1_v84a.h

@@ -11,7 +11,7 @@
 #endif
 
 /* Part of backend API */
-#define MLK_USE_FIPS202_X1_NATIVE
+#define MLK_USE_NATIVE_FIPS202_X1
 /* Guard for assembly file */
 #define MLK_FIPS202_AARCH64_NEED_X1_V84A
 
@@ -21,8 +21,8 @@
 MLK_MUST_CHECK_RETURN_VALUE
 static MLK_INLINE int mlk_keccak_f1600_x1_native(uint64_t *state)
 {
-  if (!mlk_sys_check_capability(MLK_SYS_CAP_NEON) ||
-      !mlk_sys_check_capability(MLK_SYS_CAP_SHA3))
+  if (!mlk_sys_check_capability(MLK_SYS_CAP_AARCH64_NEON) ||
+      !mlk_sys_check_capability(MLK_SYS_CAP_AARCH64_SHA3))
   {
     return MLK_NATIVE_FUNC_FALLBACK;
   }

data/ext/pqcrypto/vendor/mlkem-native/mlkem/src/fips202/native/aarch64/x2_v84a.h

@@ -11,7 +11,7 @@
 #endif
 
 /* Part of backend API */
-#define MLK_USE_FIPS202_X4_NATIVE
+#define MLK_USE_NATIVE_FIPS202_X4
 /* Guard for assembly file */
 #define MLK_FIPS202_AARCH64_NEED_X2_V84A
 
@@ -21,8 +21,8 @@
 MLK_MUST_CHECK_RETURN_VALUE
 static MLK_INLINE int mlk_keccak_f1600_x4_native(uint64_t *state)
 {
-  if (!mlk_sys_check_capability(MLK_SYS_CAP_NEON) ||
-      !mlk_sys_check_capability(MLK_SYS_CAP_SHA3))
+  if (!mlk_sys_check_capability(MLK_SYS_CAP_AARCH64_NEON) ||
+      !mlk_sys_check_capability(MLK_SYS_CAP_AARCH64_SHA3))
   {
     return MLK_NATIVE_FUNC_FALLBACK;
   }

data/ext/pqcrypto/vendor/mlkem-native/mlkem/src/fips202/native/aarch64/x4_v8a_scalar.h

@@ -7,7 +7,7 @@
 #define MLK_FIPS202_NATIVE_AARCH64_X4_V8A_SCALAR_H
 
 /* Part of backend API */
-#define MLK_USE_FIPS202_X4_NATIVE
+#define MLK_USE_NATIVE_FIPS202_X4
 /* Guard for assembly file */
 #define MLK_FIPS202_AARCH64_NEED_X4_V8A_SCALAR_HYBRID
 
@@ -17,7 +17,7 @@
 MLK_MUST_CHECK_RETURN_VALUE
 static MLK_INLINE int mlk_keccak_f1600_x4_native(uint64_t *state)
 {
-  if (!mlk_sys_check_capability(MLK_SYS_CAP_NEON))
+  if (!mlk_sys_check_capability(MLK_SYS_CAP_AARCH64_NEON))
   {
     return MLK_NATIVE_FUNC_FALLBACK;
   }

data/ext/pqcrypto/vendor/mlkem-native/mlkem/src/fips202/native/aarch64/x4_v8a_v84a_scalar.h

@@ -11,7 +11,7 @@
 #endif
 
 /* Part of backend API */
-#define MLK_USE_FIPS202_X4_NATIVE
+#define MLK_USE_NATIVE_FIPS202_X4
 /* Guard for assembly file */
 #define MLK_FIPS202_AARCH64_NEED_X4_V8A_V84A_SCALAR_HYBRID
 
@@ -21,8 +21,8 @@
 MLK_MUST_CHECK_RETURN_VALUE
 static MLK_INLINE int mlk_keccak_f1600_x4_native(uint64_t *state)
 {
-  if (!mlk_sys_check_capability(MLK_SYS_CAP_NEON) ||
-      !mlk_sys_check_capability(MLK_SYS_CAP_SHA3))
+  if (!mlk_sys_check_capability(MLK_SYS_CAP_AARCH64_NEON) ||
+      !mlk_sys_check_capability(MLK_SYS_CAP_AARCH64_SHA3))
   {
     return MLK_NATIVE_FUNC_FALLBACK;
   }

data/ext/pqcrypto/vendor/mlkem-native/mlkem/src/fips202/native/api.h

@@ -29,13 +29,13 @@
  * A _backend_ is a specific implementation of parts of this interface.
  *
  * You can replace 1-fold or 4-fold batched Keccak-F1600.
- * To enable, set MLK_USE_FIPS202_X1_NATIVE or MLK_USE_FIPS202_X4_NATIVE
+ * To enable, set MLK_USE_NATIVE_FIPS202_X1 or MLK_USE_NATIVE_FIPS202_X4
  * in your backend, and define the inline wrappers mlk_keccak_f1600_x1_native()
  * and/or mlk_keccak_f1600_x4_native(), respectively, to forward to your
  * implementation.
  */
 
-#if defined(MLK_USE_FIPS202_X1_NATIVE)
+#if defined(MLK_USE_NATIVE_FIPS202_X1)
 MLK_MUST_CHECK_RETURN_VALUE
 static MLK_INLINE int mlk_keccak_f1600_x1_native(uint64_t *state)
 __contract__(
@@ -43,8 +43,8 @@ __contract__(
   assigns(memory_slice(state, sizeof(uint64_t) * 25 * 1))
   ensures(return_value == MLK_NATIVE_FUNC_FALLBACK || return_value == MLK_NATIVE_FUNC_SUCCESS)
   ensures((return_value == MLK_NATIVE_FUNC_FALLBACK) ==> array_unchanged_u64(state, 25 * 1)));
-#endif /* MLK_USE_FIPS202_X1_NATIVE */
-#if defined(MLK_USE_FIPS202_X4_NATIVE)
+#endif /* MLK_USE_NATIVE_FIPS202_X1 */
+#if defined(MLK_USE_NATIVE_FIPS202_X4)
 MLK_MUST_CHECK_RETURN_VALUE
 static MLK_INLINE int mlk_keccak_f1600_x4_native(uint64_t *state)
 __contract__(
@@ -52,7 +52,7 @@ __contract__(
   assigns(memory_slice(state, sizeof(uint64_t) * 25 * 4))
   ensures(return_value == MLK_NATIVE_FUNC_FALLBACK || return_value == MLK_NATIVE_FUNC_SUCCESS)
   ensures((return_value == MLK_NATIVE_FUNC_FALLBACK) ==> array_unchanged_u64(state, 25 * 4)));
-#endif /* MLK_USE_FIPS202_X4_NATIVE */
+#endif /* MLK_USE_NATIVE_FIPS202_X4 */
 
 /*
  * Native x4 XOR bytes and extract bytes interface.
@@ -66,12 +66,12 @@ __contract__(
  * NOTE: We assume that the custom representation of the zero state is the
  * all-zero state.
  *
- * MLK_USE_FIPS202_X4_XOR_BYTES_NATIVE: Backend provides native XOR bytes
- * MLK_USE_FIPS202_X4_EXTRACT_BYTES_NATIVE: Backend provides native extract
+ * MLK_USE_NATIVE_FIPS202_X4_XOR_BYTES: Backend provides native XOR bytes
+ * MLK_USE_NATIVE_FIPS202_X4_EXTRACT_BYTES: Backend provides native extract
  * bytes
  */
 
-#if defined(MLK_USE_FIPS202_X4_XOR_BYTES_NATIVE)
+#if defined(MLK_USE_NATIVE_FIPS202_X4_XOR_BYTES)
 MLK_MUST_CHECK_RETURN_VALUE
 static MLK_INLINE int mlk_keccakf1600_xor_bytes_x4_native(
     uint64_t *state, const unsigned char *data0, const unsigned char *data1,
@@ -91,9 +91,9 @@ __contract__(
   assigns(memory_slice(state, sizeof(uint64_t) * 25 * 4))
   ensures(return_value == MLK_NATIVE_FUNC_FALLBACK || return_value == MLK_NATIVE_FUNC_SUCCESS)
   ensures((return_value == MLK_NATIVE_FUNC_FALLBACK) ==> array_unchanged_u64(state, 25 * 4)));
-#endif /* MLK_USE_FIPS202_X4_XOR_BYTES_NATIVE */
+#endif /* MLK_USE_NATIVE_FIPS202_X4_XOR_BYTES */
 
-#if defined(MLK_USE_FIPS202_X4_EXTRACT_BYTES_NATIVE)
+#if defined(MLK_USE_NATIVE_FIPS202_X4_EXTRACT_BYTES)
 MLK_MUST_CHECK_RETURN_VALUE
 static MLK_INLINE int mlk_keccakf1600_extract_bytes_x4_native(
     uint64_t *state, unsigned char *data0, unsigned char *data1,
@@ -112,6 +112,6 @@ __contract__(
   assigns(memory_slice(data2, length))
   assigns(memory_slice(data3, length))
   ensures(return_value == MLK_NATIVE_FUNC_FALLBACK || return_value == MLK_NATIVE_FUNC_SUCCESS));
-#endif /* MLK_USE_FIPS202_X4_EXTRACT_BYTES_NATIVE */
+#endif /* MLK_USE_NATIVE_FIPS202_X4_EXTRACT_BYTES */
 
 #endif /* !MLK_FIPS202_NATIVE_API_H */

data/ext/pqcrypto/vendor/mlkem-native/mlkem/src/fips202/native/armv81m/mve.h

@@ -9,9 +9,9 @@
 #define MLK_FIPS202_NATIVE_ARMV81M
 
 /* Part of backend API */
-#define MLK_USE_FIPS202_X4_NATIVE
-#define MLK_USE_FIPS202_X4_XOR_BYTES_NATIVE
-#define MLK_USE_FIPS202_X4_EXTRACT_BYTES_NATIVE
+#define MLK_USE_NATIVE_FIPS202_X4
+#define MLK_USE_NATIVE_FIPS202_X4_XOR_BYTES
+#define MLK_USE_NATIVE_FIPS202_X4_EXTRACT_BYTES
 /* Guard for assembly file */
 #define MLK_FIPS202_ARMV81M_NEED_X4
 

data/ext/pqcrypto/vendor/mlkem-native/mlkem/src/fips202/native/x86_64/keccak_f1600_x4_avx2.h

@@ -11,7 +11,7 @@
 #define MLK_FIPS202_X86_64_NEED_X4_AVX2
 
 /* Part of backend API */
-#define MLK_USE_FIPS202_X4_NATIVE
+#define MLK_USE_NATIVE_FIPS202_X4
 
 #if !defined(__ASSEMBLER__)
 #include "../api.h"
@@ -19,7 +19,7 @@
 MLK_MUST_CHECK_RETURN_VALUE
 static MLK_INLINE int mlk_keccak_f1600_x4_native(uint64_t *state)
 {
-  if (!mlk_sys_check_capability(MLK_SYS_CAP_AVX2))
+  if (!mlk_sys_check_capability(MLK_SYS_CAP_X86_64_AVX2))
   {
     return MLK_NATIVE_FUNC_FALLBACK;
   }

data/ext/pqcrypto/vendor/mlkem-native/mlkem/src/indcpa.h

@@ -64,10 +64,8 @@ __contract__(
  *                     MLK_CONFIG_CONTEXT_PARAMETER_TYPE.
  *
  * @retval 0                     Success.
- * @retval MLK_ERR_FAIL          MLK_CONFIG_KEYGEN_PCT enabled and PCT failed.
  * @retval MLK_ERR_OUT_OF_MEMORY MLK_CONFIG_CUSTOM_ALLOC_FREE was used and
  *                               MLK_CUSTOM_ALLOC returned NULL.
- * @retval MLK_ERR_RNG_FAIL      Random number generation failed.
  */
 MLK_INTERNAL_API
 MLK_MUST_CHECK_RETURN_VALUE
@@ -81,9 +79,12 @@ __contract__(
   requires(memory_no_alias(coins, MLKEM_SYMBYTES))
   assigns(memory_slice(pk, MLKEM_INDCPA_PUBLICKEYBYTES))
   assigns(memory_slice(sk, MLKEM_INDCPA_SECRETKEYBYTES))
-  ensures(return_value == 0 || return_value == MLK_ERR_FAIL ||
-          return_value == MLK_ERR_OUT_OF_MEMORY ||
-          return_value == MLK_ERR_RNG_FAIL)
+  ensures(return_value == 0 || return_value == MLK_ERR_OUT_OF_MEMORY)
+  /* Output buffers on error, per API-CONVENTIONS.md */
+  ensures(return_value != 0 ==>
+          array_unchanged_or_zeroized_u8(pk, MLKEM_INDCPA_PUBLICKEYBYTES))
+  ensures(return_value != 0 ==>
+          array_unchanged_or_zeroized_u8(sk, MLKEM_INDCPA_SECRETKEYBYTES))
 );
 #endif /* !MLK_CONFIG_NO_KEYPAIR_API */
 
@@ -106,7 +107,6 @@ __contract__(
  *                     MLK_CONFIG_CONTEXT_PARAMETER_TYPE.
  *
  * @retval 0                     Success.
- * @retval MLK_ERR_FAIL          Operation failed.
  * @retval MLK_ERR_OUT_OF_MEMORY MLK_CONFIG_CUSTOM_ALLOC_FREE was used and
  *                               MLK_CUSTOM_ALLOC returned NULL.
  */
@@ -123,8 +123,10 @@ __contract__(
   requires(memory_no_alias(pk, MLKEM_INDCPA_PUBLICKEYBYTES))
   requires(memory_no_alias(coins, MLKEM_SYMBYTES))
   assigns(memory_slice(c, MLKEM_INDCPA_BYTES))
-  ensures(return_value == 0 || return_value == MLK_ERR_FAIL ||
-          return_value == MLK_ERR_OUT_OF_MEMORY)
+  ensures(return_value == 0 || return_value == MLK_ERR_OUT_OF_MEMORY)
+  /* Output buffers on error, per API-CONVENTIONS.md */
+  ensures(return_value != 0 ==>
+          array_unchanged_or_zeroized_u8(c, MLKEM_INDCPA_BYTES))
 );
 #endif /* !MLK_CONFIG_NO_ENCAPS_API || !MLK_CONFIG_NO_DECAPS_API */
 
@@ -146,7 +148,6 @@ __contract__(
  *                     MLK_CONFIG_CONTEXT_PARAMETER_TYPE.
  *
  * @retval 0                     Success.
- * @retval MLK_ERR_FAIL          Operation failed.
  * @retval MLK_ERR_OUT_OF_MEMORY MLK_CONFIG_CUSTOM_ALLOC_FREE was used and
  *                               MLK_CUSTOM_ALLOC returned NULL.
  */
@@ -161,8 +162,10 @@ __contract__(
   requires(memory_no_alias(m, MLKEM_INDCPA_MSGBYTES))
   requires(memory_no_alias(sk, MLKEM_INDCPA_SECRETKEYBYTES))
   assigns(memory_slice(m, MLKEM_INDCPA_MSGBYTES))
-  ensures(return_value == 0 || return_value == MLK_ERR_FAIL ||
-          return_value == MLK_ERR_OUT_OF_MEMORY)
+  ensures(return_value == 0 || return_value == MLK_ERR_OUT_OF_MEMORY)
+  /* Output buffers on error, per API-CONVENTIONS.md */
+  ensures(return_value != 0 ==>
+          array_unchanged_or_zeroized_u8(m, MLKEM_INDCPA_MSGBYTES))
 );
 #endif /* !MLK_CONFIG_NO_DECAPS_API */