pq_crypto 0.6.5 → 0.6.7

data/ext/pqcrypto/vendor/mlkem-native/mlkem/src/kem.c

@@ -60,7 +60,8 @@ int mlk_kem_check_pk(const uint8_t pk[MLKEM_INDCCA_PUBLICKEYBYTES],
 
   /* We use a constant-time memcmp here to avoid having to
    * declassify the PK before the PCT has succeeded. */
-  ret = mlk_ct_memcmp(pk, p_reencoded, MLKEM_POLYVECBYTES) ? MLK_ERR_FAIL : 0;
+  ret = mlk_ct_memcmp(pk, p_reencoded, MLKEM_POLYVECBYTES) ? MLK_ERR_INVALID_PK
+                                                           : 0;
 
 cleanup:
   /* Specification: Partially implements
@@ -107,7 +108,7 @@ int mlk_kem_check_sk(const uint8_t sk[MLKEM_INDCCA_SECRETKEYBYTES],
    * of minimizing stdlib dependency, we use our constant-time one anyway. */
   ret = mlk_ct_memcmp(sk + MLKEM_INDCCA_SECRETKEYBYTES - 2 * MLKEM_SYMBYTES,
                       test, MLKEM_SYMBYTES)
-            ? MLK_ERR_FAIL
+            ? MLK_ERR_INVALID_SK
             : 0;
 
 cleanup:
@@ -126,9 +127,9 @@ static int mlk_check_pct(uint8_t const pk[MLKEM_INDCCA_PUBLICKEYBYTES],
 __contract__(
   requires(memory_no_alias(pk, MLKEM_INDCCA_PUBLICKEYBYTES))
   requires(memory_no_alias(sk, MLKEM_INDCCA_SECRETKEYBYTES))
-  ensures(return_value == 0 || return_value == MLK_ERR_FAIL ||
-          return_value == MLK_ERR_OUT_OF_MEMORY ||
-          return_value == MLK_ERR_RNG_FAIL)
+  ensures(return_value == 0 || return_value == MLK_ERR_OUT_OF_MEMORY ||
+          return_value == MLK_ERR_RNG_FAIL ||
+          return_value == MLK_ERR_PCT_FAIL)
 );
 
 #if defined(MLK_CONFIG_KEYGEN_PCT)
@@ -136,7 +137,13 @@ __contract__(
  * Partially implements 'Pairwise Consistency Test' @[FIPS140_3_IG, p.87] and
  * @[FIPS203, Section 7.1, Pairwise Consistency]. */
 
-/* Reference: Not implemented in the reference implementation @[REF]. */
+/* Reference: Not implemented in the reference implementation @[REF].
+ *
+ * @retval 0                     Success.
+ * @retval MLK_ERR_OUT_OF_MEMORY MLK_CONFIG_CUSTOM_ALLOC_FREE was used and
+ *                               MLK_CUSTOM_ALLOC returned NULL.
+ * @retval MLK_ERR_RNG_FAIL      Random number generation failed.
+ * @retval MLK_ERR_PCT_FAIL      The consistency check failed. */
 MLK_MUST_CHECK_RETURN_VALUE
 static int mlk_check_pct(uint8_t const pk[MLKEM_INDCCA_PUBLICKEYBYTES],
                          uint8_t const sk[MLKEM_INDCCA_SECRETKEYBYTES],
@@ -179,7 +186,7 @@ static int mlk_check_pct(uint8_t const pk[MLKEM_INDCCA_PUBLICKEYBYTES],
 
   if (ret != 0)
   {
-    ret = MLK_ERR_FAIL;
+    ret = MLK_ERR_PCT_FAIL;
   }
 
 cleanup:
@@ -189,9 +196,21 @@ cleanup:
   MLK_FREE(ss_dec, uint8_t, MLKEM_SSBYTES, context);
   MLK_FREE(ss_enc, uint8_t, MLKEM_SSBYTES, context);
   MLK_FREE(ct, uint8_t, MLKEM_INDCCA_CIPHERTEXTBYTES, context);
+
+  /* The key pair being tested was just generated by this library, so a key
+   * check rejecting it hints at a faulty implementation rather than at bad
+   * input. Report it as a PCT failure. */
+  if (ret == MLK_ERR_INVALID_PK || ret == MLK_ERR_INVALID_SK)
+  {
+    ret = MLK_ERR_PCT_FAIL;
+  }
+
+  /* Other error codes, e.g. platform failures like out of memory or
+   * randomness failure, are passed on unmodified. */
+
   return ret;
 }
-#else /* MLK_CONFIG_KEYGEN_PCT */
+#else  /* MLK_CONFIG_KEYGEN_PCT */
 MLK_MUST_CHECK_RETURN_VALUE
 static int mlk_check_pct(uint8_t const pk[MLKEM_INDCCA_PUBLICKEYBYTES],
                          uint8_t const sk[MLKEM_INDCCA_SECRETKEYBYTES],
@@ -200,9 +219,7 @@ static int mlk_check_pct(uint8_t const pk[MLKEM_INDCCA_PUBLICKEYBYTES],
   /* Skip PCT */
   ((void)pk);
   ((void)sk);
-#if defined(MLK_CONFIG_CONTEXT_PARAMETER)
-  ((void)context);
-#endif
+  MLK_CONTEXT_UNUSED(context);
   return 0;
 }
 #endif /* !MLK_CONFIG_KEYGEN_PCT */

data/ext/pqcrypto/vendor/mlkem-native/mlkem/src/kem.h

@@ -80,7 +80,7 @@
  *                    MLK_CONFIG_CONTEXT_PARAMETER_TYPE.
  *
  * @retval 0                     Success.
- * @retval MLK_ERR_FAIL          Modulus check failed.
+ * @retval MLK_ERR_INVALID_PK    Modulus check failed.
  * @retval MLK_ERR_OUT_OF_MEMORY MLK_CONFIG_CUSTOM_ALLOC_FREE was used and
  *                               MLK_CUSTOM_ALLOC returned NULL.
  */
@@ -91,7 +91,7 @@ int mlk_kem_check_pk(const uint8_t pk[MLKEM_INDCCA_PUBLICKEYBYTES],
                      MLK_CONFIG_CONTEXT_PARAMETER_TYPE context)
 __contract__(
   requires(memory_no_alias(pk, MLKEM_INDCCA_PUBLICKEYBYTES))
-  ensures(return_value == 0 || return_value == MLK_ERR_FAIL ||
+  ensures(return_value == 0 || return_value == MLK_ERR_INVALID_PK ||
           return_value == MLK_ERR_OUT_OF_MEMORY)
 );
 #endif /* !MLK_CONFIG_NO_ENCAPS_API */
@@ -112,7 +112,7 @@ __contract__(
  *                    MLK_CONFIG_CONTEXT_PARAMETER_TYPE.
  *
  * @retval 0                     Success.
- * @retval MLK_ERR_FAIL          Public key hash check failed.
+ * @retval MLK_ERR_INVALID_SK    Public key hash check failed.
  * @retval MLK_ERR_OUT_OF_MEMORY MLK_CONFIG_CUSTOM_ALLOC_FREE was used and
  *                               MLK_CUSTOM_ALLOC returned NULL.
  */
@@ -123,7 +123,7 @@ int mlk_kem_check_sk(const uint8_t sk[MLKEM_INDCCA_SECRETKEYBYTES],
                      MLK_CONFIG_CONTEXT_PARAMETER_TYPE context)
 __contract__(
   requires(memory_no_alias(sk, MLKEM_INDCCA_SECRETKEYBYTES))
-  ensures(return_value == 0 || return_value == MLK_ERR_FAIL ||
+  ensures(return_value == 0 || return_value == MLK_ERR_INVALID_SK ||
           return_value == MLK_ERR_OUT_OF_MEMORY)
 );
 #endif /* !MLK_CONFIG_NO_DECAPS_API */
@@ -145,9 +145,11 @@ __contract__(
  *                     MLK_CONFIG_CONTEXT_PARAMETER_TYPE.
  *
  * @retval 0                     Success.
- * @retval MLK_ERR_FAIL          MLK_CONFIG_KEYGEN_PCT enabled and PCT failed.
+ * @retval MLK_ERR_PCT_FAIL      MLK_CONFIG_KEYGEN_PCT enabled and PCT failed.
  * @retval MLK_ERR_OUT_OF_MEMORY MLK_CONFIG_CUSTOM_ALLOC_FREE was used and
  *                               MLK_CUSTOM_ALLOC returned NULL.
+ * @retval MLK_ERR_RNG_FAIL      MLK_CONFIG_KEYGEN_PCT enabled and random
+ *                               number generation failed within the PCT.
  */
 MLK_EXTERNAL_API
 MLK_MUST_CHECK_RETURN_VALUE
@@ -161,9 +163,14 @@ __contract__(
   requires(memory_no_alias(coins, 2 * MLKEM_SYMBYTES))
   assigns(memory_slice(pk, MLKEM_INDCCA_PUBLICKEYBYTES))
   assigns(memory_slice(sk, MLKEM_INDCCA_SECRETKEYBYTES))
-  ensures(return_value == 0 || return_value == MLK_ERR_FAIL ||
+  ensures(return_value == 0 || return_value == MLK_ERR_PCT_FAIL ||
           return_value == MLK_ERR_OUT_OF_MEMORY ||
           return_value == MLK_ERR_RNG_FAIL)
+  /* Output buffers on error, per API-CONVENTIONS.md */
+  ensures(return_value != 0 ==>
+          array_unchanged_or_zeroized_u8(pk, MLKEM_INDCCA_PUBLICKEYBYTES))
+  ensures(return_value != 0 ==>
+          array_unchanged_or_zeroized_u8(sk, MLKEM_INDCCA_SECRETKEYBYTES))
 );
 
 #if !defined(MLK_CONFIG_NO_RANDOMIZED_API)
@@ -184,7 +191,7 @@ __contract__(
  * @retval MLK_ERR_OUT_OF_MEMORY MLK_CONFIG_CUSTOM_ALLOC_FREE was used and
  *                               MLK_CUSTOM_ALLOC returned NULL.
  * @retval MLK_ERR_RNG_FAIL      Random number generation failed.
- * @retval MLK_ERR_FAIL          MLK_CONFIG_KEYGEN_PCT enabled and PCT failed.
+ * @retval MLK_ERR_PCT_FAIL      MLK_CONFIG_KEYGEN_PCT enabled and PCT failed.
  */
 MLK_EXTERNAL_API
 MLK_MUST_CHECK_RETURN_VALUE
@@ -196,9 +203,14 @@ __contract__(
   requires(memory_no_alias(sk, MLKEM_INDCCA_SECRETKEYBYTES))
   assigns(memory_slice(pk, MLKEM_INDCCA_PUBLICKEYBYTES))
   assigns(memory_slice(sk, MLKEM_INDCCA_SECRETKEYBYTES))
-  ensures(return_value == 0 || return_value == MLK_ERR_FAIL ||
+  ensures(return_value == 0 || return_value == MLK_ERR_PCT_FAIL ||
           return_value == MLK_ERR_OUT_OF_MEMORY ||
           return_value == MLK_ERR_RNG_FAIL)
+  /* Output buffers on error, per API-CONVENTIONS.md */
+  ensures(return_value != 0 ==>
+          array_unchanged_or_zeroized_u8(pk, MLKEM_INDCCA_PUBLICKEYBYTES))
+  ensures(return_value != 0 ==>
+          array_unchanged_or_zeroized_u8(sk, MLKEM_INDCCA_SECRETKEYBYTES))
 );
 #endif /* !MLK_CONFIG_NO_RANDOMIZED_API */
 #endif /* !MLK_CONFIG_NO_KEYPAIR_API */
@@ -221,7 +233,7 @@ __contract__(
  *                     MLK_CONFIG_CONTEXT_PARAMETER_TYPE.
  *
  * @retval 0                     Success.
- * @retval MLK_ERR_FAIL          The 'modulus check' @[FIPS203, Section 7.2]
+ * @retval MLK_ERR_INVALID_PK    The 'modulus check' @[FIPS203, Section 7.2]
  *                               for the public key failed.
  * @retval MLK_ERR_OUT_OF_MEMORY MLK_CONFIG_CUSTOM_ALLOC_FREE was used and
  *                               MLK_CUSTOM_ALLOC returned NULL.
@@ -241,8 +253,13 @@ __contract__(
   requires(memory_no_alias(coins, MLKEM_SYMBYTES))
   assigns(memory_slice(ct, MLKEM_INDCCA_CIPHERTEXTBYTES))
   assigns(memory_slice(ss, MLKEM_SSBYTES))
-  ensures(return_value == 0 || return_value == MLK_ERR_FAIL ||
+  ensures(return_value == 0 || return_value == MLK_ERR_INVALID_PK ||
           return_value == MLK_ERR_OUT_OF_MEMORY)
+  /* Output buffers on error, per API-CONVENTIONS.md */
+  ensures(return_value != 0 ==>
+          array_unchanged_or_zeroized_u8(ct, MLKEM_INDCCA_CIPHERTEXTBYTES))
+  ensures(return_value != 0 ==>
+          array_unchanged_or_zeroized_u8(ss, MLKEM_SSBYTES))
 );
 
 #if !defined(MLK_CONFIG_NO_RANDOMIZED_API)
@@ -265,7 +282,7 @@ __contract__(
  * @retval MLK_ERR_OUT_OF_MEMORY MLK_CONFIG_CUSTOM_ALLOC_FREE was used and
  *                               MLK_CUSTOM_ALLOC returned NULL.
  * @retval MLK_ERR_RNG_FAIL      Random number generation failed.
- * @retval MLK_ERR_FAIL          The 'modulus check' @[FIPS203, Section 7.2]
+ * @retval MLK_ERR_INVALID_PK    The 'modulus check' @[FIPS203, Section 7.2]
  *                               for the public key failed.
  */
 MLK_EXTERNAL_API
@@ -280,9 +297,14 @@ __contract__(
   requires(memory_no_alias(pk, MLKEM_INDCCA_PUBLICKEYBYTES))
   assigns(memory_slice(ct, MLKEM_INDCCA_CIPHERTEXTBYTES))
   assigns(memory_slice(ss, MLKEM_SSBYTES))
-  ensures(return_value == 0 || return_value == MLK_ERR_FAIL ||
+  ensures(return_value == 0 || return_value == MLK_ERR_INVALID_PK ||
           return_value == MLK_ERR_OUT_OF_MEMORY ||
           return_value == MLK_ERR_RNG_FAIL)
+  /* Output buffers on error, per API-CONVENTIONS.md */
+  ensures(return_value != 0 ==>
+          array_unchanged_or_zeroized_u8(ct, MLKEM_INDCCA_CIPHERTEXTBYTES))
+  ensures(return_value != 0 ==>
+          array_unchanged_or_zeroized_u8(ss, MLKEM_SSBYTES))
 );
 #endif /* !MLK_CONFIG_NO_RANDOMIZED_API */
 #endif /* !MLK_CONFIG_NO_ENCAPS_API */
@@ -303,7 +325,7 @@ __contract__(
  *                     MLK_CONFIG_CONTEXT_PARAMETER_TYPE.
  *
  * @retval 0                     Success.
- * @retval MLK_ERR_FAIL          The 'hash check' @[FIPS203, Section 7.3]
+ * @retval MLK_ERR_INVALID_SK    The 'hash check' @[FIPS203, Section 7.3]
  *                               for the secret key failed.
  * @retval MLK_ERR_OUT_OF_MEMORY MLK_CONFIG_CUSTOM_ALLOC_FREE was used and
  *                               MLK_CUSTOM_ALLOC returned NULL.
@@ -320,8 +342,11 @@ __contract__(
   requires(memory_no_alias(ct, MLKEM_INDCCA_CIPHERTEXTBYTES))
   requires(memory_no_alias(sk, MLKEM_INDCCA_SECRETKEYBYTES))
   assigns(memory_slice(ss, MLKEM_SSBYTES))
-  ensures(return_value == 0 || return_value == MLK_ERR_FAIL ||
+  ensures(return_value == 0 || return_value == MLK_ERR_INVALID_SK ||
           return_value == MLK_ERR_OUT_OF_MEMORY)
+  /* Output buffers on error, per API-CONVENTIONS.md */
+  ensures(return_value != 0 ==>
+          array_unchanged_or_zeroized_u8(ss, MLKEM_SSBYTES))
 );
 #endif /* !MLK_CONFIG_NO_DECAPS_API */
 

data/ext/pqcrypto/vendor/mlkem-native/mlkem/src/native/aarch64/meta.h

@@ -28,7 +28,7 @@
 MLK_MUST_CHECK_RETURN_VALUE
 static MLK_INLINE int mlk_ntt_native(int16_t data[MLKEM_N])
 {
-  if (!mlk_sys_check_capability(MLK_SYS_CAP_NEON))
+  if (!mlk_sys_check_capability(MLK_SYS_CAP_AARCH64_NEON))
   {
     return MLK_NATIVE_FUNC_FALLBACK;
   }
@@ -41,7 +41,7 @@ static MLK_INLINE int mlk_ntt_native(int16_t data[MLKEM_N])
 MLK_MUST_CHECK_RETURN_VALUE
 static MLK_INLINE int mlk_intt_native(int16_t data[MLKEM_N])
 {
-  if (!mlk_sys_check_capability(MLK_SYS_CAP_NEON))
+  if (!mlk_sys_check_capability(MLK_SYS_CAP_AARCH64_NEON))
   {
     return MLK_NATIVE_FUNC_FALLBACK;
   }
@@ -54,7 +54,7 @@ static MLK_INLINE int mlk_intt_native(int16_t data[MLKEM_N])
 MLK_MUST_CHECK_RETURN_VALUE
 static MLK_INLINE int mlk_poly_reduce_native(int16_t data[MLKEM_N])
 {
-  if (!mlk_sys_check_capability(MLK_SYS_CAP_NEON))
+  if (!mlk_sys_check_capability(MLK_SYS_CAP_AARCH64_NEON))
   {
     return MLK_NATIVE_FUNC_FALLBACK;
   }
@@ -66,7 +66,7 @@ static MLK_INLINE int mlk_poly_reduce_native(int16_t data[MLKEM_N])
 MLK_MUST_CHECK_RETURN_VALUE
 static MLK_INLINE int mlk_poly_tomont_native(int16_t data[MLKEM_N])
 {
-  if (!mlk_sys_check_capability(MLK_SYS_CAP_NEON))
+  if (!mlk_sys_check_capability(MLK_SYS_CAP_AARCH64_NEON))
   {
     return MLK_NATIVE_FUNC_FALLBACK;
   }
@@ -79,7 +79,7 @@ MLK_MUST_CHECK_RETURN_VALUE
 static MLK_INLINE int mlk_poly_mulcache_compute_native(int16_t x[MLKEM_N / 2],
                                                        const int16_t y[MLKEM_N])
 {
-  if (!mlk_sys_check_capability(MLK_SYS_CAP_NEON))
+  if (!mlk_sys_check_capability(MLK_SYS_CAP_AARCH64_NEON))
   {
     return MLK_NATIVE_FUNC_FALLBACK;
   }
@@ -95,7 +95,7 @@ static MLK_INLINE int mlk_polyvec_basemul_acc_montgomery_cached_k2_native(
     int16_t r[MLKEM_N], const int16_t a[2 * MLKEM_N],
     const int16_t b[2 * MLKEM_N], const int16_t b_cache[2 * (MLKEM_N / 2)])
 {
-  if (!mlk_sys_check_capability(MLK_SYS_CAP_NEON))
+  if (!mlk_sys_check_capability(MLK_SYS_CAP_AARCH64_NEON))
   {
     return MLK_NATIVE_FUNC_FALLBACK;
   }
@@ -110,7 +110,7 @@ static MLK_INLINE int mlk_polyvec_basemul_acc_montgomery_cached_k3_native(
     int16_t r[MLKEM_N], const int16_t a[3 * MLKEM_N],
     const int16_t b[3 * MLKEM_N], const int16_t b_cache[3 * (MLKEM_N / 2)])
 {
-  if (!mlk_sys_check_capability(MLK_SYS_CAP_NEON))
+  if (!mlk_sys_check_capability(MLK_SYS_CAP_AARCH64_NEON))
   {
     return MLK_NATIVE_FUNC_FALLBACK;
   }
@@ -125,7 +125,7 @@ static MLK_INLINE int mlk_polyvec_basemul_acc_montgomery_cached_k4_native(
     int16_t r[MLKEM_N], const int16_t a[4 * MLKEM_N],
     const int16_t b[4 * MLKEM_N], const int16_t b_cache[4 * (MLKEM_N / 2)])
 {
-  if (!mlk_sys_check_capability(MLK_SYS_CAP_NEON))
+  if (!mlk_sys_check_capability(MLK_SYS_CAP_AARCH64_NEON))
   {
     return MLK_NATIVE_FUNC_FALLBACK;
   }
@@ -139,7 +139,7 @@ MLK_MUST_CHECK_RETURN_VALUE
 static MLK_INLINE int mlk_poly_tobytes_native(uint8_t r[MLKEM_POLYBYTES],
                                               const int16_t a[MLKEM_N])
 {
-  if (!mlk_sys_check_capability(MLK_SYS_CAP_NEON))
+  if (!mlk_sys_check_capability(MLK_SYS_CAP_AARCH64_NEON))
   {
     return MLK_NATIVE_FUNC_FALLBACK;
   }
@@ -153,7 +153,7 @@ static MLK_INLINE int mlk_rej_uniform_native(int16_t *r, unsigned len,
                                              const uint8_t *buf,
                                              unsigned buflen)
 {
-  if (!mlk_sys_check_capability(MLK_SYS_CAP_NEON) || len != MLKEM_N ||
+  if (!mlk_sys_check_capability(MLK_SYS_CAP_AARCH64_NEON) || len != MLKEM_N ||
       buflen % 24 != 0)
   {
     return MLK_NATIVE_FUNC_FALLBACK;

data/ext/pqcrypto/vendor/mlkem-native/mlkem/src/native/x86_64/meta.h

@@ -37,7 +37,7 @@
 
 static MLK_INLINE void mlk_poly_permute_bitrev_to_custom(int16_t data[MLKEM_N])
 {
-  if (mlk_sys_check_capability(MLK_SYS_CAP_AVX2))
+  if (mlk_sys_check_capability(MLK_SYS_CAP_X86_64_AVX2))
   {
     mlk_nttunpack_avx2_asm(data);
   }
@@ -48,7 +48,7 @@ static MLK_INLINE int mlk_rej_uniform_native(int16_t *r, unsigned len,
                                              const uint8_t *buf,
                                              unsigned buflen)
 {
-  if (!mlk_sys_check_capability(MLK_SYS_CAP_AVX2) || len != MLKEM_N ||
+  if (!mlk_sys_check_capability(MLK_SYS_CAP_X86_64_AVX2) || len != MLKEM_N ||
       buflen % 12 != 0)
   {
     return MLK_NATIVE_FUNC_FALLBACK;
@@ -59,7 +59,7 @@ static MLK_INLINE int mlk_rej_uniform_native(int16_t *r, unsigned len,
 MLK_MUST_CHECK_RETURN_VALUE
 static MLK_INLINE int mlk_ntt_native(int16_t data[MLKEM_N])
 {
-  if (!mlk_sys_check_capability(MLK_SYS_CAP_AVX2))
+  if (!mlk_sys_check_capability(MLK_SYS_CAP_X86_64_AVX2))
   {
     return MLK_NATIVE_FUNC_FALLBACK;
   }
@@ -72,7 +72,7 @@ static MLK_INLINE int mlk_ntt_native(int16_t data[MLKEM_N])
 MLK_MUST_CHECK_RETURN_VALUE
 static MLK_INLINE int mlk_intt_native(int16_t data[MLKEM_N])
 {
-  if (!mlk_sys_check_capability(MLK_SYS_CAP_AVX2))
+  if (!mlk_sys_check_capability(MLK_SYS_CAP_X86_64_AVX2))
   {
     return MLK_NATIVE_FUNC_FALLBACK;
   }
@@ -85,7 +85,7 @@ static MLK_INLINE int mlk_intt_native(int16_t data[MLKEM_N])
 MLK_MUST_CHECK_RETURN_VALUE
 static MLK_INLINE int mlk_poly_reduce_native(int16_t data[MLKEM_N])
 {
-  if (!mlk_sys_check_capability(MLK_SYS_CAP_AVX2))
+  if (!mlk_sys_check_capability(MLK_SYS_CAP_X86_64_AVX2))
   {
     return MLK_NATIVE_FUNC_FALLBACK;
   }
@@ -98,7 +98,7 @@ static MLK_INLINE int mlk_poly_reduce_native(int16_t data[MLKEM_N])
 MLK_MUST_CHECK_RETURN_VALUE
 static MLK_INLINE int mlk_poly_tomont_native(int16_t data[MLKEM_N])
 {
-  if (!mlk_sys_check_capability(MLK_SYS_CAP_AVX2))
+  if (!mlk_sys_check_capability(MLK_SYS_CAP_X86_64_AVX2))
   {
     return MLK_NATIVE_FUNC_FALLBACK;
   }
@@ -112,7 +112,7 @@ MLK_MUST_CHECK_RETURN_VALUE
 static MLK_INLINE int mlk_poly_mulcache_compute_native(int16_t x[MLKEM_N / 2],
                                                        const int16_t y[MLKEM_N])
 {
-  if (!mlk_sys_check_capability(MLK_SYS_CAP_AVX2))
+  if (!mlk_sys_check_capability(MLK_SYS_CAP_X86_64_AVX2))
   {
     return MLK_NATIVE_FUNC_FALLBACK;
   }
@@ -127,7 +127,7 @@ static MLK_INLINE int mlk_polyvec_basemul_acc_montgomery_cached_k2_native(
     int16_t r[MLKEM_N], const int16_t a[2 * MLKEM_N],
     const int16_t b[2 * MLKEM_N], const int16_t b_cache[2 * (MLKEM_N / 2)])
 {
-  if (!mlk_sys_check_capability(MLK_SYS_CAP_AVX2))
+  if (!mlk_sys_check_capability(MLK_SYS_CAP_X86_64_AVX2))
   {
     return MLK_NATIVE_FUNC_FALLBACK;
   }
@@ -143,7 +143,7 @@ static MLK_INLINE int mlk_polyvec_basemul_acc_montgomery_cached_k3_native(
     int16_t r[MLKEM_N], const int16_t a[3 * MLKEM_N],
     const int16_t b[3 * MLKEM_N], const int16_t b_cache[3 * (MLKEM_N / 2)])
 {
-  if (!mlk_sys_check_capability(MLK_SYS_CAP_AVX2))
+  if (!mlk_sys_check_capability(MLK_SYS_CAP_X86_64_AVX2))
   {
     return MLK_NATIVE_FUNC_FALLBACK;
   }
@@ -159,7 +159,7 @@ static MLK_INLINE int mlk_polyvec_basemul_acc_montgomery_cached_k4_native(
     int16_t r[MLKEM_N], const int16_t a[4 * MLKEM_N],
     const int16_t b[4 * MLKEM_N], const int16_t b_cache[4 * (MLKEM_N / 2)])
 {
-  if (!mlk_sys_check_capability(MLK_SYS_CAP_AVX2))
+  if (!mlk_sys_check_capability(MLK_SYS_CAP_X86_64_AVX2))
   {
     return MLK_NATIVE_FUNC_FALLBACK;
   }
@@ -174,7 +174,7 @@ MLK_MUST_CHECK_RETURN_VALUE
 static MLK_INLINE int mlk_poly_tobytes_native(uint8_t r[MLKEM_POLYBYTES],
                                               const int16_t a[MLKEM_N])
 {
-  if (!mlk_sys_check_capability(MLK_SYS_CAP_AVX2))
+  if (!mlk_sys_check_capability(MLK_SYS_CAP_X86_64_AVX2))
   {
     return MLK_NATIVE_FUNC_FALLBACK;
   }
@@ -189,7 +189,7 @@ MLK_MUST_CHECK_RETURN_VALUE
 static MLK_INLINE int mlk_poly_frombytes_native(
     int16_t r[MLKEM_N], const uint8_t a[MLKEM_POLYBYTES])
 {
-  if (!mlk_sys_check_capability(MLK_SYS_CAP_AVX2))
+  if (!mlk_sys_check_capability(MLK_SYS_CAP_X86_64_AVX2))
   {
     return MLK_NATIVE_FUNC_FALLBACK;
   }
@@ -207,7 +207,7 @@ MLK_MUST_CHECK_RETURN_VALUE
 static MLK_INLINE int mlk_poly_compress_d4_native(
     uint8_t r[MLKEM_POLYCOMPRESSEDBYTES_D4], const int16_t a[MLKEM_N])
 {
-  if (!mlk_sys_check_capability(MLK_SYS_CAP_AVX2))
+  if (!mlk_sys_check_capability(MLK_SYS_CAP_X86_64_AVX2))
   {
     return MLK_NATIVE_FUNC_FALLBACK;
   }
@@ -220,7 +220,7 @@ MLK_MUST_CHECK_RETURN_VALUE
 static MLK_INLINE int mlk_poly_compress_d10_native(
     uint8_t r[MLKEM_POLYCOMPRESSEDBYTES_D10], const int16_t a[MLKEM_N])
 {
-  if (!mlk_sys_check_capability(MLK_SYS_CAP_AVX2))
+  if (!mlk_sys_check_capability(MLK_SYS_CAP_X86_64_AVX2))
   {
     return MLK_NATIVE_FUNC_FALLBACK;
   }
@@ -234,7 +234,7 @@ MLK_MUST_CHECK_RETURN_VALUE
 static MLK_INLINE int mlk_poly_decompress_d4_native(
     int16_t r[MLKEM_N], const uint8_t a[MLKEM_POLYCOMPRESSEDBYTES_D4])
 {
-  if (!mlk_sys_check_capability(MLK_SYS_CAP_AVX2))
+  if (!mlk_sys_check_capability(MLK_SYS_CAP_X86_64_AVX2))
   {
     return MLK_NATIVE_FUNC_FALLBACK;
   }
@@ -247,7 +247,7 @@ MLK_MUST_CHECK_RETURN_VALUE
 static MLK_INLINE int mlk_poly_decompress_d10_native(
     int16_t r[MLKEM_N], const uint8_t a[MLKEM_POLYCOMPRESSEDBYTES_D10])
 {
-  if (!mlk_sys_check_capability(MLK_SYS_CAP_AVX2))
+  if (!mlk_sys_check_capability(MLK_SYS_CAP_X86_64_AVX2))
   {
     return MLK_NATIVE_FUNC_FALLBACK;
   }
@@ -267,7 +267,7 @@ MLK_MUST_CHECK_RETURN_VALUE
 static MLK_INLINE int mlk_poly_compress_d5_native(
     uint8_t r[MLKEM_POLYCOMPRESSEDBYTES_D5], const int16_t a[MLKEM_N])
 {
-  if (!mlk_sys_check_capability(MLK_SYS_CAP_AVX2))
+  if (!mlk_sys_check_capability(MLK_SYS_CAP_X86_64_AVX2))
   {
     return MLK_NATIVE_FUNC_FALLBACK;
   }
@@ -280,7 +280,7 @@ MLK_MUST_CHECK_RETURN_VALUE
 static MLK_INLINE int mlk_poly_compress_d11_native(
     uint8_t r[MLKEM_POLYCOMPRESSEDBYTES_D11], const int16_t a[MLKEM_N])
 {
-  if (!mlk_sys_check_capability(MLK_SYS_CAP_AVX2))
+  if (!mlk_sys_check_capability(MLK_SYS_CAP_X86_64_AVX2))
   {
     return MLK_NATIVE_FUNC_FALLBACK;
   }
@@ -294,7 +294,7 @@ MLK_MUST_CHECK_RETURN_VALUE
 static MLK_INLINE int mlk_poly_decompress_d5_native(
     int16_t r[MLKEM_N], const uint8_t a[MLKEM_POLYCOMPRESSEDBYTES_D5])
 {
-  if (!mlk_sys_check_capability(MLK_SYS_CAP_AVX2))
+  if (!mlk_sys_check_capability(MLK_SYS_CAP_X86_64_AVX2))
   {
     return MLK_NATIVE_FUNC_FALLBACK;
   }
@@ -307,7 +307,7 @@ MLK_MUST_CHECK_RETURN_VALUE
 static MLK_INLINE int mlk_poly_decompress_d11_native(
     int16_t r[MLKEM_N], const uint8_t a[MLKEM_POLYCOMPRESSEDBYTES_D11])
 {
-  if (!mlk_sys_check_capability(MLK_SYS_CAP_AVX2))
+  if (!mlk_sys_check_capability(MLK_SYS_CAP_X86_64_AVX2))
   {
     return MLK_NATIVE_FUNC_FALLBACK;
   }

data/ext/pqcrypto/vendor/mlkem-native/mlkem/src/sys.h

@@ -210,7 +210,7 @@
 #endif
 
 
-/* New X86_64 CPUs support Conflow-flow protection using the CET instructions.
+/* New X86_64 CPUs support control-flow protection using the CET instructions.
  * When enabled (through -fcf-protection=), all compilation units (including
  * empty ones) need to support CET for this to work.
  * For assembly, this means that source files need to signal support for
@@ -288,12 +288,12 @@
 typedef enum
 {
   /* x86_64 */
-  MLK_SYS_CAP_AVX2,
+  MLK_SYS_CAP_X86_64_AVX2,
   /* AArch64 */
-  MLK_SYS_CAP_NEON,
-  MLK_SYS_CAP_SHA3,
+  MLK_SYS_CAP_AARCH64_NEON,
+  MLK_SYS_CAP_AARCH64_SHA3,
   /* Armv8.1-M */
-  MLK_SYS_CAP_MVE
+  MLK_SYS_CAP_ARMV81M_MVE
 } mlk_sys_cap;
 
 #if !defined(MLK_CONFIG_CUSTOM_CAPABILITY_FUNC)

data/ext/pqcrypto/vendor/mlkem-native/mlkem/src/verify.h

@@ -419,17 +419,20 @@ __contract__(
 #if !defined(MLK_CONFIG_CUSTOM_ZEROIZE)
 #if defined(MLK_SYS_WINDOWS)
 #include <windows.h>
+#elif !defined(MLK_HAVE_INLINE_ASM)
+#error No plausibly-secure implementation of mlk_zeroize available. Please provide your own using MLK_CONFIG_CUSTOM_ZEROIZE.
+#endif
+
 static MLK_INLINE void mlk_zeroize(void *ptr, size_t len)
 __contract__(
+  requires(len <= UINT32_MAX)
   requires(memory_no_alias(ptr, len))
-  assigns(memory_slice(ptr, len))) { SecureZeroMemory(ptr, len); }
-#elif defined(MLK_HAVE_INLINE_ASM)
-#include <string.h>
-static MLK_INLINE void mlk_zeroize(void *ptr, size_t len)
-__contract__(
-  requires(memory_no_alias(ptr, len))
-  assigns(memory_slice(ptr, len)))
+  assigns(memory_slice(ptr, len))
+  ensures(array_zeroized_u8((uint8_t *)ptr, len)))
 {
+#if defined(MLK_SYS_WINDOWS)
+  SecureZeroMemory(ptr, len);
+#else
   mlk_memset(ptr, 0, len);
   /* This follows OpenSSL and seems sufficient to prevent the compiler
    * from optimizing away the memset.
@@ -437,10 +440,8 @@ __contract__(
    * If there was a reliable way to detect availability of memset_s(),
    * that would be preferred. */
   __asm__ volatile("" : : "r"(ptr) : "memory");
+#endif /* !MLK_SYS_WINDOWS */
 }
-#else /* !MLK_SYS_WINDOWS && MLK_HAVE_INLINE_ASM */
-#error No plausibly-secure implementation of mlk_zeroize available. Please provide your own using MLK_CONFIG_CUSTOM_ZEROIZE.
-#endif /* !MLK_SYS_WINDOWS && !MLK_HAVE_INLINE_ASM */
 #endif /* !MLK_CONFIG_CUSTOM_ZEROIZE */
 
 #endif /* !MLK_VERIFY_H */

data/lib/pq_crypto/internal.rb

@@ -8,6 +8,16 @@ module PQCrypto
       String(value).b
     end
 
+    def frozen_binary_string(value)
+      binary_string(value).freeze
+    end
+
+    def strict_boolean!(value, name:)
+      return value if value.equal?(true) || value.equal?(false)
+
+      raise ArgumentError, "#{name} must be true or false (got #{value.inspect})"
+    end
+
     def safe_wipe(value)
       return unless value.is_a?(String) && !value.frozen?