pq_crypto 0.6.5 → 0.6.7

data/ext/pqcrypto/vendor/mldsa-native/README.md

@@ -3,7 +3,6 @@
 # mldsa-native
 
 ![CI](https://github.com/pq-code-package/mldsa-native/actions/workflows/all.yml/badge.svg)
-![Proof: HOL-Light](https://github.com/pq-code-package/mldsa-native/actions/workflows/hol_light.yml/badge.svg)
 ![Benchmarks](https://github.com/pq-code-package/mldsa-native/actions/workflows/bench.yml/badge.svg)
 ![C90](https://img.shields.io/badge/language-C90-blue.svg)
 
@@ -52,18 +51,25 @@ make test
 mldsa-native is used in
  - AWS' Cryptography library [AWS-LC](https://github.com/aws/aws-lc/)
  - [libOQS](https://github.com/open-quantum-safe/liboqs/) of the Open Quantum Safe project
- - The [zeroRISC's fork of OpenTitan](https://github.com/zerorisc/expo) - an open source silicon Root of Trust (RoT)
+ - [Pavona](https://github.com/pavona/pavona) - a library of modular, tapeout-proven, and secure-by-default open silicon blocks
  - [CHERIoT-PQC](https://github.com/CHERIoT-Platform/cheriot-pqc) — post-quantum cryptography support for the CHERIoT platform
 
 ## Formal Verification
 
 We use the [C Bounded Model Checker (CBMC)](https://github.com/diffblue/cbmc) to prove absence of various classes of undefined behaviour in C, including out of bounds memory accesses and integer overflows. The proofs cover all C code in [mldsa/src/*](mldsa) and [mldsa/src/fips202/*](mldsa/src/fips202) involved in running mldsa-native with its C backend. See [proofs/cbmc](proofs/cbmc) for details.
 
-HOL-Light functional correctness proofs can be found in [proofs/hol_light](proofs/hol_light). See the [HOL-Light README](proofs/hol_light/README.md) for the list of functions that have been proven correct. These proofs utilize the verification infrastructure in [s2n-bignum](https://github.com/awslabs/s2n-bignum).
+All AArch64 and x86_64 assembly is proved functionally correct and memory-safe at the object-code level, using
+[HOL-Light](https://hol-light.github.io/) and the [s2n-bignum](https://github.com/awslabs/s2n-bignum) verification
+infrastructure. All routines are additionally proved to have secret-independent timing, with two exceptions. The
+matrix sampler `rej_uniform` operates on public data only, and is deliberately variable-time. The secret-vector
+samplers `rej_uniform_eta{2,4}` _do_ have secret-independent timing, but this property is not yet backed by proof.
+See [proofs/hol_light](proofs/hol_light) for details.
 
 Finally, [proofs/isabelle](proofs/isabelle/compress) contains proofs in [Isabelle/HOL](https://isabelle.in.tum.de/) of the correctness of
 different approaches for computing the scalar decomposition routines used in ML-DSA. Those are still experimental and do not yet operate
-on the source level.
+on the source level. [proofs/isabelle/neon_ntt](proofs/isabelle/neon_ntt) additionally provides a machine-checked formalisation of the
+modular-arithmetic core of the Neon NTT paper[^NeonNTT], covering the Barrett and Montgomery primitives underlying the AArch64 NTT and
+pointwise-multiplication assembly; see its [README](proofs/isabelle/neon_ntt/README.md).
 
 **NOTE:** Formal Verification is never absolute. See [SOUNDNESS.md](SOUNDNESS.md) for an analysis of the scope, assumptions and risks of the formal verification efforts around mldsa-native.
 
@@ -157,6 +163,8 @@ For CI benchmark results and historical performance data, see the [benchmarking
 
 If you want to use mldsa-native, import [mldsa](mldsa) into your project's source tree and build using your favourite build system. See [examples/basic](examples/basic) for a simple example. The build system provided in this repository is for development purposes only.
 
+See [API-CONVENTIONS.md](API-CONVENTIONS.md) for conventions that apply to all public functions, such as return values, pointer validity, and the state of output buffers on error.
+
 ### Can I bring my own FIPS-202?
 
 mldsa-native relies on and comes with an implementation of FIPS-202[^FIPS202]. If your library has its own FIPS-202 implementation, you
@@ -185,11 +193,15 @@ Yes. mldsa-native provides a compile-time option `MLD_CONFIG_REDUCE_RAM` that re
 
 To enable this mode, define `MLD_CONFIG_REDUCE_RAM` in [mldsa_native_config.h](mldsa/mldsa_native_config.h) or pass `-DMLD_CONFIG_REDUCE_RAM` as a compiler flag.
 
+### Can I bound or restart the signing loop for real-time systems?
+
+Yes. Signing hooks allow you to pause and restart ML-DSA signature operations, thereby bounding their runtime. See [examples/restartable_sign](examples/restartable_sign) for an example.
+
 ### Does mldsa-native use hedged or deterministic signing?
 
 By default, mldsa-native uses the randomized "hedged" signing variant as specified in FIPS 204 Section 3.4. The hedged variant uses both fresh randomness at signing time and precomputed randomness from the private key. This helps mitigate fault injection attacks and side-channel attacks while protecting against potential flaws in the random number generator.
 
-If you need the deterministic variant of ML-DSA, you can call `crypto_sign_signature_internal`
+If you need the deterministic variant of ML-DSA, you can call `signature_internal`
 directly with an all-zero `rnd` argument.
 However, note that FIPS 204 warns that this should not be used on platforms where fault injection attacks and side-channel attacks are a concern, as the lack of fresh randomness makes fault attacks more difficult to mitigate.
 
@@ -204,8 +216,8 @@ External mu mode enables applications to compute the message digest (mu) externa
 Yes. mldsa-native supports HashML-DSA, the pre-hashing variant of ML-DSA defined in FIPS 204 Algorithms 4 and 5.
 
 mldsa-native provides two levels of API:
-- `crypto_sign_signature_pre_hash_internal` and `crypto_sign_verify_pre_hash_internal` - Low-level functions that accept a pre-hashed message digest. This function supports all 12 allowed hash functions.
-- `crypto_sign_signature_pre_hash_shake256` and `crypto_sign_verify_pre_hash_shake256` - High-level functions that perform SHAKE256 pre-hashing internally for convenience. Currently, only SHAKE256 is supported. If you require another hash function, use the `*_pre_hash_internal` functions or open an issue.
+- `signature_pre_hash_internal` and `verify_pre_hash_internal` - Low-level functions that accept a pre-hashed message digest. This function supports all 12 allowed hash functions.
+- `signature_pre_hash_shake256` and `verify_pre_hash_shake256` - High-level functions that perform SHAKE256 pre-hashing internally for convenience. Currently, only SHAKE256 is supported. If you require another hash function, use the `*_pre_hash_internal` functions or open an issue.
 
 ## Have a Question?
 
@@ -229,6 +241,7 @@ through the [PQCA Discord](https://discord.com/invite/xyVnwzfg5R). See also [CON
 [^FIPS204]: National Institute of Standards and Technology: FIPS 204 Module-Lattice-Based Digital Signature Standard, [https://csrc.nist.gov/pubs/fips/204/final](https://csrc.nist.gov/pubs/fips/204/final)
 [^NIST_FAQ]: National Institute of Standards and Technology: Post-Quantum Cryptography FAQs, [https://csrc.nist.gov/Projects/post-quantum-cryptography/faqs#Rdc7](https://csrc.nist.gov/Projects/post-quantum-cryptography/faqs#Rdc7)
 [^NIST_FIPS204_SEC6]: National Institute of Standards and Technology: FIPS 204 Section 6 Guidance, [https://csrc.nist.gov/csrc/media/Projects/post-quantum-cryptography/documents/faq/fips204-sec6-03192025.pdf](https://csrc.nist.gov/csrc/media/Projects/post-quantum-cryptography/documents/faq/fips204-sec6-03192025.pdf)
+[^NeonNTT]: Becker, Hwang, Kannwischer, Yang, Yang: Neon NTT: Faster Dilithium, Kyber, and Saber on Cortex-A72 and Apple M1, [https://eprint.iacr.org/2021/986](https://eprint.iacr.org/2021/986)
 [^REF]: Bai, Ducas, Kiltz, Lepoint, Lyubashevsky, Schwabe, Seiler, Stehlé: CRYSTALS-Dilithium reference implementation, [https://github.com/pq-crystals/dilithium/tree/master/ref](https://github.com/pq-crystals/dilithium/tree/master/ref)
 [^tiny_sha3]: Markku-Juhani O. Saarinen: tiny_sha3, [https://github.com/mjosaarinen/tiny_sha3](https://github.com/mjosaarinen/tiny_sha3)
 [^wycheproof]: Community Cryptography Specification Project: Project Wycheproof, [https://github.com/C2SP/wycheproof](https://github.com/C2SP/wycheproof)

data/ext/pqcrypto/vendor/mldsa-native/RELEASE.md

@@ -0,0 +1,160 @@
+[//]: # (SPDX-License-Identifier: CC-BY-4.0)
+
+mldsa-native v2.0.0
+===================
+
+Release notes
+-------------
+
+v2.0.0 is the first stable release of mldsa-native, a secure, fast and portable C90 implementation of
+[ML-DSA](https://csrc.nist.gov/pubs/fips/204/final) derived from the
+[ML-DSA reference implementation](https://github.com/pq-crystals/dilithium).
+It carries the version number v2.0.0 rather than v1.0.0 because its public API and configuration are aligned with
+those of the upcoming v2 release of the sister project
+[mlkem-native](https://github.com/pq-code-package/mlkem-native).
+
+mldsa-native v2.0.0 offers:
+* High maintainability and extensibility through modular frontend/backend design.
+* High performance through AArch64 (Neon) and x86_64 (AVX2) assembly backends and the use of the
+  [SLOTHY super-optimizer](https://github.com/slothy-optimizer/slothy).
+* High assurance through memory- and type-safety proofs for the C frontend and backend (CBMC),
+  functional-correctness and memory-safety proofs for both the AArch64 and x86_64 assembly
+  backends (HOL Light and s2n-bignum), and extensive constant-time testing.
+
+mldsa-native v2.0.0 is uniformly licensed Apache-2.0 OR MIT OR ISC, giving consumers the choice to use any of these
+licenses.
+
+Assurance
+---------
+
+v2.0.0 marks the completion of the two formal-verification efforts underpinning mldsa-native: the HOL Light proofs for
+the AArch64 (Neon) and x86_64 (AVX2) assembly backends and the CBMC proofs for the C code are now both complete.
+
+- **AArch64 and x86_64 assembly proved in HOL Light.** Every routine in both the AArch64 (Neon) and x86_64 (AVX2)
+  backends is proved functionally correct and memory-safe at the object-code level, using
+  [HOL Light](https://hol-light.github.io/) and the [s2n-bignum](https://github.com/awslabs/s2n-bignum) verification
+  infrastructure. All routines except the secret-vector rejection samplers (`rej_uniform_eta{2,4}`) are additionally
+  proved to have secret-independent timing (those samplers _do_ have secret-independent timing, but this property is
+  not yet backed by proof).
+- **CBMC proofs for the C code**, establishing memory safety, type safety and absence of various classes of undefined
+  behaviour for all C code involved in running mldsa-native with its C backend.
+
+See [SOUNDNESS.md](SOUNDNESS.md) for more detail on the scope, assumptions and residual risks of the verification
+work; it shares its methodology, formal models and trusted computing base with the sister project
+[mlkem-native](https://github.com/pq-code-package/mlkem-native).
+
+Breaking changes since v1.0.0-beta2
+-----------------------------------
+
+Between the last beta release
+([v1.0.0-beta2](https://github.com/pq-code-package/mldsa-native/releases/tag/v1.0.0-beta2)) and this release, a number
+of breaking changes to the public API and configuration have been introduced. Consumers upgrading from
+`v1.0.0-beta2` should be aware of the following:
+
+- **`siglen` removed from the signing and verification APIs.** Signing functions no longer take a `size_t *siglen`
+  out-parameter and verification functions no longer take a `size_t siglen` in-parameter; signatures are always
+  `MLDSA_BYTES(MLD_CONFIG_PARAMETER_SET)` bytes and verification now takes a fixed-size signature array. Drop the
+  `siglen` argument at every call site. ([#1240](https://github.com/pq-code-package/mldsa-native/pull/1240))
+- **SUPERCOP-style aliases and constants removed.** The `crypto_sign_keypair` / `crypto_sign_signature` /
+  `crypto_sign_verify` aliases, the `CRYPTO_SECRETKEYBYTES` / `CRYPTO_PUBLICKEYBYTES` / `CRYPTO_BYTES` size macros, and
+  the `MLD_CONFIG_NO_SUPERCOP` option were removed. Use the namespaced API directly and derive sizes from
+  `MLDSA_SECRETKEYBYTES` / `MLDSA_PUBLICKEYBYTES` / `MLDSA_BYTES`.
+  ([#1248](https://github.com/pq-code-package/mldsa-native/pull/1248))
+- **SUPERCOP signed-message API removed.** The combined signed-message functions (`crypto_sign` / `crypto_sign_open`
+  and their namespaced equivalents, which produced/consumed signature-prepended messages) were removed. Applications
+  needing that format should build it on top of the detached `signature` / `verify` API.
+  ([#1236](https://github.com/pq-code-package/mldsa-native/pull/1236))
+- **`MLD_ERR_FAIL` split into specific error codes.** Failure conditions that previously all surfaced as
+  `MLD_ERR_FAIL` now have dedicated codes: `MLD_ERR_INVALID_SIGNATURE` (verification rejected the signature),
+  `MLD_ERR_INVALID_KEY` (`pk_from_sk` found the secret key malformed or internally inconsistent), `MLD_ERR_PCT_FAIL`
+  (the key-generation pairwise consistency test failed) and `MLD_ERR_INVALID_ARG` (unsupported pre-hash algorithm or
+  context string longer than 255 bytes). The previously existing codes keep their values, but callers matching on
+  `MLD_ERR_FAIL` must be updated; it is no longer externally observable.
+  ([#1309](https://github.com/pq-code-package/mldsa-native/pull/1309))
+- **Legacy header-time configuration removed.** The deprecated `MLD_CONFIG_API_*` macros
+  (`MLD_CONFIG_API_PARAMETER_SET`, `MLD_CONFIG_API_NAMESPACE_PREFIX`, `MLD_CONFIG_API_NO_SUPERCOP`,
+  `MLD_CONFIG_API_CONSTANTS_ONLY`, `MLD_CONFIG_API_QUALIFIER`) were removed in favour of configuring through the
+  [config file](mldsa/mldsa_native_config.h) (`MLD_CONFIG_PARAMETER_SET`, `MLD_CONFIG_NAMESPACE_PREFIX`,
+  `MLD_CONFIG_CONSTANTS_ONLY`, `MLD_CONFIG_EXTERNAL_API_QUALIFIER`). For multi-level builds, set
+  `MLD_CONFIG_MULTILEVEL_BUILD` and do not bake the 44/65/87 suffix into the namespace prefix; the security level is
+  now appended automatically. ([#1206](https://github.com/pq-code-package/mldsa-native/pull/1206),
+  [#1270](https://github.com/pq-code-package/mldsa-native/pull/1270))
+- **FIPS-202 backend flags renamed to the `MLD_USE_NATIVE_*` convention.** Custom FIPS-202 backends must rename the
+  flags they define: `MLD_USE_FIPS202_X1_NATIVE` -> `MLD_USE_NATIVE_FIPS202_X1`, `MLD_USE_FIPS202_X4_NATIVE` ->
+  `MLD_USE_NATIVE_FIPS202_X4`, `MLD_USE_FIPS202_X4_XOR_BYTES_NATIVE` -> `MLD_USE_NATIVE_FIPS202_X4_XOR_BYTES`, and
+  `MLD_USE_FIPS202_X4_EXTRACT_BYTES_NATIVE` -> `MLD_USE_NATIVE_FIPS202_X4_EXTRACT_BYTES`. Default builds are
+  unaffected. ([#1207](https://github.com/pq-code-package/mldsa-native/pull/1207))
+- **Capability enum values prefixed with the architecture.** `mld_sys_cap` values were renamed
+  (`MLD_SYS_CAP_AVX2` -> `MLD_SYS_CAP_X86_64_AVX2`, `MLD_SYS_CAP_SHA3` -> `MLD_SYS_CAP_AARCH64_SHA3`,
+  `MLD_SYS_CAP_MVE` -> `MLD_SYS_CAP_ARMV81M_MVE`). This affects integrators with custom native backends or a custom
+  capability-check function. ([#1208](https://github.com/pq-code-package/mldsa-native/pull/1208))
+- **Minimum FIPS 204 signing-attempt bound raised from 814 to 821.** Builds that set
+  `MLD_CONFIG_MAX_SIGNING_ATTEMPTS` explicitly must now use a value of at least 821; 814 through 820 no longer compile.
+  The [FIPS 204 errata](https://csrc.nist.gov/files/pubs/fips/204/final/docs/fips-204-potential-updates.xlsx) revises
+  the Repetitions row of Table 1 to 4.36 / 5.14 / 3.91 and, with it, the minimum loop-iteration limit for
+  `ML-DSA.Sign_internal` in Table 3 from 814 to 821.
+  ([#1349](https://github.com/pq-code-package/mldsa-native/pull/1349))
+
+We hope these simplifications make integrations easier for the majority of consumers. Moving forward, APIs and
+configuration options not marked as experimental are guaranteed to be stable until a new major version (`v3`) is
+released; additional APIs and configuration options may be introduced at any time.
+
+If the breaking changes above cause any issues for your application, please
+[open a GitHub issue](https://github.com/pq-code-package/mldsa-native/issues). If your application could benefit from
+additional APIs or configuration options, please open an issue as well.
+
+What's New
+----------
+
+### Restartable and bounded signing for real-time systems
+
+ML-DSA signing is a rejection-sampling loop: it draws a candidate signature and retries until one passes the
+bounds checks. The number of attempts is not known in advance, so a single signing call has an *unbounded* worst-case
+runtime.
+For environments with strict timing requirements that is a problem: a signing call cannot be allowed to run for an
+arbitrary number of iterations before returning control to the caller.
+
+mldsa-native addresses this with three optional, independent **signing hooks** around the rejection-sampling loop,
+enabled with `MLD_CONFIG_SIGN_HOOK_ATTEMPT`, `MLD_CONFIG_SIGN_HOOK_RESUME` and `MLD_CONFIG_SIGN_HOOK_FINISH`. The
+attempt hook runs before each attempt and may **pause** the operation; signing then returns the new
+`MLD_ERR_SIGNING_PAUSED` code instead of iterating further. At the start of the next call the resume hook is queried
+for the attempt to restart from (the one the attempt hook recorded when it paused), so signing continues exactly where
+it left off; the finish hook fires with the succeeding attempt once a signature is found. The split, resumed run
+produces exactly the same signature as a single uninterrupted call.
+
+To bound per-call runtime, the attempt hook pauses once a per-call budget is spent, and the caller re-invokes signing
+in a loop until it completes.
+
+For concurrent or interleaved signers, hold the resume state per caller by enabling `MLD_CONFIG_CONTEXT_PARAMETER`
+instead of a global; each API function then forwards a context argument to the hooks. A complete example is in
+[examples/restartable_sign](examples/restartable_sign).
+([#1237](https://github.com/pq-code-package/mldsa-native/pull/1237))
+
+This feature is experimental: its scope, configuration and hook signatures may change, including after v2.
+We would love to hear your feedback on this feature.
+
+### API and configuration
+
+- **`MLD_SYS_AARCH64_FAST_SHA3`** opts non-Apple AArch64 cores with fast SHA3 instructions into the SHA3-instruction
+  path. ([#1254](https://github.com/pq-code-package/mldsa-native/pull/1254))
+
+### Platforms and testing
+
+- **Windows MSVC** test support (KAT, Wycheproof, allocation-failure and RNG-failure tests).
+  ([#1247](https://github.com/pq-code-package/mldsa-native/pull/1247))
+- **AVR baremetal / 16-bit** platform support. ([#1158](https://github.com/pq-code-package/mldsa-native/pull/1158))
+- **Zephyr** hardware and QEMU test platforms, including NUCLEO-N657X0-Q.
+  ([#1259](https://github.com/pq-code-package/mldsa-native/pull/1259),
+  [#1269](https://github.com/pq-code-package/mldsa-native/pull/1269))
+- **ABI checker** for AArch64, x86_64 (SysV) and Armv8.1-M+MVE.
+  ([#1195](https://github.com/pq-code-package/mldsa-native/pull/1195))
+
+### Documentation
+
+- **FIPS 204 references** annotated throughout the code and expanded in the documentation, mapping the implementation
+  to [the standard](https://csrc.nist.gov/pubs/fips/204/final).
+- **[API-CONVENTIONS.md](API-CONVENTIONS.md)** documents the conventions shared by all public functions: return
+  values, pointer validity (all pointers are assumed valid and non-NULL, except a pointer paired with a length, which
+  may be NULL when that length is `0`), and the state of output buffers on error (left either unchanged or fully
+  zeroized, never holding partially computed data).
+

data/ext/pqcrypto/vendor/mldsa-native/SECURITY.md

@@ -4,5 +4,5 @@
 
 ## Reporting security bugs
 
-If you think you have found a security bug in mlkem-native, please report the vulnerability through
+If you think you have found a security bug in mldsa-native, please report the vulnerability through
 Github's [private vulnerability reporting](https://github.com/pq-code-package/mldsa-native/security).

data/ext/pqcrypto/vendor/mldsa-native/mldsa/README.md

@@ -8,7 +8,7 @@ This is the main source tree of mldsa-native.
 
 To build mldsa-native for a fixed parameter set (ML-DSA-44/65/87), build the compilation units in `src/*` separately, and link to an RNG and your application. See [examples/basic](../examples/basic) for a simple example.
 
-Alternatively, you can use the auto-generated helper files [mldsa_native.c](mldsa_native.c) and [mldsa_native_asm.S](mldsa_native_asm.S), which bundle all *.c and *.S files together. See [examples/monolithic_build](../examples/monolithic_build) and [examples/monolithic_build_native](../examples/monolithic_build_native) for examples with and without native code.
+Alternatively, you can use the auto-generated helper files [mldsa_native.c](mldsa_native.c) and [mldsa_native_asm.S](mldsa_native_asm.S), which bundle all *.c and *.S files together. See [examples/monolithic_build](../examples/monolithic_build) and [examples/monolithic_build_native](../examples/monolithic_build_native) for examples without and with native code.
 
 ## Configuration
 
@@ -20,4 +20,4 @@ The public API is defined in [mldsa_native.h](mldsa_native.h).
 
 ## Supporting multiple parameter sets
 
-If you want to support multiple parameter sets, build the library once per parameter set you want to support. Set `MLD_CONFIG_MULTILEVEL_WITH_SHARED` for one of the builds, and `MLD_CONFIG_MULTILEVEL_NO_SHARED` for the others, to avoid duplicating shared functionality. Finally, link with RNG and your application as before. This is demonstrated in the examples [examples/multilevel_build](../examples/multilevel_build), [examples/multilevel_build_native](../examples/multilevel_build_native), [examples/monolithic_build_multilevel](../examples/monolithic_build_multilevel) and [examples/monolithic_build_multilevel_native](../examples/monolithic_build_multilevel_native).
+If you want to support multiple parameter sets, build the library once per parameter set you want to support. Set `MLD_CONFIG_MULTILEVEL_BUILD` for all builds, `MLD_CONFIG_MULTILEVEL_WITH_SHARED` for one of them, and `MLD_CONFIG_MULTILEVEL_NO_SHARED` for the others, to avoid duplicating shared functionality. Finally, link with RNG and your application as before. This is demonstrated in the examples [examples/multilevel_build](../examples/multilevel_build), [examples/multilevel_build_native](../examples/multilevel_build_native), [examples/monolithic_build_multilevel](../examples/monolithic_build_multilevel) and [examples/monolithic_build_multilevel_native](../examples/monolithic_build_multilevel_native).

data/ext/pqcrypto/vendor/mldsa-native/mldsa/mldsa_native.c

@@ -83,18 +83,8 @@
 #endif /* MLD_SYS_AARCH64 */
 #if defined(MLD_SYS_X86_64)
 #include "src/native/x86_64/src/consts.c"
-#include "src/native/x86_64/src/poly_chknorm_avx2.c"
-#include "src/native/x86_64/src/poly_decompose_32_avx2.c"
-#include "src/native/x86_64/src/poly_decompose_88_avx2.c"
-#include "src/native/x86_64/src/poly_use_hint_32_avx2.c"
-#include "src/native/x86_64/src/poly_use_hint_88_avx2.c"
-#include "src/native/x86_64/src/polyz_unpack_17_avx2.c"
-#include "src/native/x86_64/src/polyz_unpack_19_avx2.c"
-#include "src/native/x86_64/src/rej_uniform_avx2.c"
-#include "src/native/x86_64/src/rej_uniform_eta2_avx2.c"
-#include "src/native/x86_64/src/rej_uniform_eta4_avx2.c"
 #include "src/native/x86_64/src/rej_uniform_table.c"
-#endif /* MLD_SYS_X86_64 */
+#endif
 #endif /* MLD_CONFIG_USE_NATIVE_BACKEND_ARITH */
 
 #if defined(MLD_CONFIG_USE_NATIVE_BACKEND_FIPS202)
@@ -125,9 +115,6 @@
  * Undefine macros from MLD_CONFIG_PARAMETER_SET-specific files
  */
 /* mldsa/mldsa_native.h */
-#undef CRYPTO_BYTES
-#undef CRYPTO_PUBLICKEYBYTES
-#undef CRYPTO_SECRETKEYBYTES
 #undef MLDSA44_BYTES
 #undef MLDSA44_CRHBYTES
 #undef MLDSA44_PUBLICKEYBYTES
@@ -162,19 +149,19 @@
 #undef MLD_API_CONCAT
 #undef MLD_API_CONCAT_
 #undef MLD_API_CONCAT_UNDERSCORE
-#undef MLD_API_LEGACY_CONFIG
 #undef MLD_API_MUST_CHECK_RETURN_VALUE
 #undef MLD_API_NAMESPACE
+#undef MLD_API_NAMESPACE_PREFIX
 #undef MLD_API_QUALIFIER
-#undef MLD_CONFIG_API_CONSTANTS_ONLY
-#undef MLD_CONFIG_API_NAMESPACE_PREFIX
-#undef MLD_CONFIG_API_NO_SUPERCOP
-#undef MLD_CONFIG_API_PARAMETER_SET
-#undef MLD_CONFIG_API_QUALIFIER
 #undef MLD_DOMAIN_SEPARATION_MAX_BYTES
 #undef MLD_ERR_FAIL
+#undef MLD_ERR_INVALID_ARG
+#undef MLD_ERR_INVALID_KEY
+#undef MLD_ERR_INVALID_SIGNATURE
 #undef MLD_ERR_OUT_OF_MEMORY
+#undef MLD_ERR_PCT_FAIL
 #undef MLD_ERR_RNG_FAIL
+#undef MLD_ERR_SIGNING_PAUSED
 #undef MLD_ERR_SIGN_ATTEMPTS_EXHAUSTED
 #undef MLD_H
 #undef MLD_MAX3_
@@ -213,15 +200,9 @@
 #undef MLD_TOTAL_ALLOC_87_PK_FROM_SK
 #undef MLD_TOTAL_ALLOC_87_SIGN
 #undef MLD_TOTAL_ALLOC_87_VERIFY
-#undef crypto_sign
-#undef crypto_sign_keypair
-#undef crypto_sign_open
-#undef crypto_sign_signature
-#undef crypto_sign_verify
 /* mldsa/src/common.h */
 #undef MLD_ADD_PARAM_SET
 #undef MLD_ALLOC
-#undef MLD_ANY_ERROR
 #undef MLD_APPLY
 #undef MLD_ASM_FN_SIZE
 #undef MLD_ASM_FN_SYMBOL
@@ -230,20 +211,15 @@
 #undef MLD_COMMON_H
 #undef MLD_CONCAT
 #undef MLD_CONCAT_
-#undef MLD_CONTEXT_PARAMETERS_0
-#undef MLD_CONTEXT_PARAMETERS_1
-#undef MLD_CONTEXT_PARAMETERS_2
-#undef MLD_CONTEXT_PARAMETERS_3
-#undef MLD_CONTEXT_PARAMETERS_4
-#undef MLD_CONTEXT_PARAMETERS_5
-#undef MLD_CONTEXT_PARAMETERS_6
-#undef MLD_CONTEXT_PARAMETERS_7
-#undef MLD_CONTEXT_PARAMETERS_8
-#undef MLD_CONTEXT_PARAMETERS_9
 #undef MLD_EMPTY_CU
 #undef MLD_ERR_FAIL
+#undef MLD_ERR_INVALID_ARG
+#undef MLD_ERR_INVALID_KEY
+#undef MLD_ERR_INVALID_SIGNATURE
 #undef MLD_ERR_OUT_OF_MEMORY
+#undef MLD_ERR_PCT_FAIL
 #undef MLD_ERR_RNG_FAIL
+#undef MLD_ERR_SIGNING_PAUSED
 #undef MLD_ERR_SIGN_ATTEMPTS_EXHAUSTED
 #undef MLD_EXTERNAL_API
 #undef MLD_FIPS202X4_HEADER_FILE
@@ -280,22 +256,52 @@
 #undef MLDSA_ETA
 #undef MLDSA_GAMMA1
 #undef MLDSA_GAMMA2
+#undef MLDSA_GAMMA2_32
+#undef MLDSA_GAMMA2_88
 #undef MLDSA_K
 #undef MLDSA_L
 #undef MLDSA_N
 #undef MLDSA_OMEGA
+#undef MLDSA_PK_END
+#undef MLDSA_PK_RHO_BYTES
+#undef MLDSA_PK_RHO_OFFSET
+#undef MLDSA_PK_T1_BYTES
+#undef MLDSA_PK_T1_OFFSET
 #undef MLDSA_POLYETA_PACKEDBYTES
 #undef MLDSA_POLYT0_PACKEDBYTES
 #undef MLDSA_POLYT1_PACKEDBYTES
 #undef MLDSA_POLYVECH_PACKEDBYTES
 #undef MLDSA_POLYW1_PACKEDBYTES
+#undef MLDSA_POLYW1_PACKEDBYTES_32
+#undef MLDSA_POLYW1_PACKEDBYTES_88
 #undef MLDSA_POLYZ_PACKEDBYTES
 #undef MLDSA_Q
 #undef MLDSA_Q_HALF
 #undef MLDSA_RNDBYTES
 #undef MLDSA_SEEDBYTES
+#undef MLDSA_SIG_C_BYTES
+#undef MLDSA_SIG_C_OFFSET
+#undef MLDSA_SIG_END
+#undef MLDSA_SIG_H_BYTES
+#undef MLDSA_SIG_H_OFFSET
+#undef MLDSA_SIG_Z_BYTES
+#undef MLDSA_SIG_Z_OFFSET
+#undef MLDSA_SK_END
+#undef MLDSA_SK_KEY_BYTES
+#undef MLDSA_SK_KEY_OFFSET
+#undef MLDSA_SK_RHO_BYTES
+#undef MLDSA_SK_RHO_OFFSET
+#undef MLDSA_SK_S1_BYTES
+#undef MLDSA_SK_S1_OFFSET
+#undef MLDSA_SK_S2_BYTES
+#undef MLDSA_SK_S2_OFFSET
+#undef MLDSA_SK_T0_BYTES
+#undef MLDSA_SK_T0_OFFSET
+#undef MLDSA_SK_TR_BYTES
+#undef MLDSA_SK_TR_OFFSET
 #undef MLDSA_TAU
 #undef MLDSA_TRBYTES
+#undef MLD_MAX_KAPPA
 #undef MLD_PARAMS_H
 /* mldsa/src/poly_kl.h */
 #undef MLD_POLYETA_UNPACK_LOWER_BOUND
@@ -408,10 +414,8 @@
 #undef MLD_PREHASH_SHAKE_256
 #undef MLD_SIGN_H
 #undef mld_prepare_domain_separation_prefix
-#undef mld_sign
 #undef mld_sign_keypair
 #undef mld_sign_keypair_internal
-#undef mld_sign_open
 #undef mld_sign_pk_from_sk
 #undef mld_sign_signature
 #undef mld_sign_signature_extmu
@@ -428,6 +432,22 @@
 /*
  * Undefine macros from MLD_CONFIG_PARAMETER_SET-generic files
  */
+/* mldsa/src/context.h */
+#undef MLD_CONTEXT_H
+#undef MLD_CONTEXT_PARAMETERS_0
+#undef MLD_CONTEXT_PARAMETERS_1
+#undef MLD_CONTEXT_PARAMETERS_2
+#undef MLD_CONTEXT_PARAMETERS_3
+#undef MLD_CONTEXT_PARAMETERS_4
+#undef MLD_CONTEXT_PARAMETERS_5
+#undef MLD_CONTEXT_PARAMETERS_6
+#undef MLD_CONTEXT_PARAMETERS_7
+#undef MLD_CONTEXT_PARAMETERS_8
+#undef MLD_CONTEXT_PARAMETERS_9
+#undef MLD_CONTEXT_UNUSED
+#undef mld_sign_attempt
+#undef mld_sign_finish
+#undef mld_sign_resume
 /* mldsa/src/ct.h */
 #undef MLD_CT_H
 #undef MLD_USE_ASM_VALUE_BARRIER
@@ -442,6 +462,7 @@
 #undef mld_debug_check_assert
 #undef mld_debug_check_bounds
 /* mldsa/src/poly.h */
+#undef MLD_FQMUL_BOUND
 #undef MLD_INTT_BOUND
 #undef MLD_NTT_BOUND
 #undef MLD_POLY_H
@@ -461,6 +482,8 @@
 #undef mld_polyt0_unpack
 #undef mld_polyt1_pack
 #undef mld_polyt1_unpack
+#undef mld_polyw1_pack_32
+#undef mld_polyw1_pack_88
 /* mldsa/src/randombytes.h */
 #undef MLD_RANDOMBYTES_H
 /* mldsa/src/reduce.h */
@@ -503,10 +526,14 @@
 #undef MLD_HAVE_INLINE_ASM
 #undef MLD_INLINE
 #undef MLD_MUST_CHECK_RETURN_VALUE
+#undef MLD_NOINLINE
 #undef MLD_RESTRICT
 #undef MLD_STATIC_TESTABLE
+#undef MLD_SYSV_ABI
+#undef MLD_SYSV_ABI_SUPPORTED
 #undef MLD_SYS_AARCH64
 #undef MLD_SYS_AARCH64_EB
+#undef MLD_SYS_AARCH64_NEON
 #undef MLD_SYS_APPLE
 #undef MLD_SYS_ARMV81M_MVE
 #undef MLD_SYS_BIG_ENDIAN
@@ -595,23 +622,23 @@
 /* mldsa/src/fips202/native/aarch64/x1_scalar.h */
 #undef MLD_FIPS202_AARCH64_NEED_X1_SCALAR
 #undef MLD_FIPS202_NATIVE_AARCH64_X1_SCALAR_H
-#undef MLD_USE_FIPS202_X1_NATIVE
+#undef MLD_USE_NATIVE_FIPS202_X1
 /* mldsa/src/fips202/native/aarch64/x1_v84a.h */
 #undef MLD_FIPS202_AARCH64_NEED_X1_V84A
 #undef MLD_FIPS202_NATIVE_AARCH64_X1_V84A_H
-#undef MLD_USE_FIPS202_X1_NATIVE
+#undef MLD_USE_NATIVE_FIPS202_X1
 /* mldsa/src/fips202/native/aarch64/x2_v84a.h */
 #undef MLD_FIPS202_AARCH64_NEED_X2_V84A
 #undef MLD_FIPS202_NATIVE_AARCH64_X2_V84A_H
-#undef MLD_USE_FIPS202_X4_NATIVE
+#undef MLD_USE_NATIVE_FIPS202_X4
 /* mldsa/src/fips202/native/aarch64/x4_v8a_scalar.h */
 #undef MLD_FIPS202_AARCH64_NEED_X4_V8A_SCALAR_HYBRID
 #undef MLD_FIPS202_NATIVE_AARCH64_X4_V8A_SCALAR_H
-#undef MLD_USE_FIPS202_X4_NATIVE
+#undef MLD_USE_NATIVE_FIPS202_X4
 /* mldsa/src/fips202/native/aarch64/x4_v8a_v84a_scalar.h */
 #undef MLD_FIPS202_AARCH64_NEED_X4_V8A_V84A_SCALAR_HYBRID
 #undef MLD_FIPS202_NATIVE_AARCH64_X4_V8A_V84A_SCALAR_H
-#undef MLD_USE_FIPS202_X4_NATIVE
+#undef MLD_USE_NATIVE_FIPS202_X4
 #endif /* MLD_SYS_AARCH64 */
 #if defined(MLD_SYS_X86_64)
 /*
@@ -620,7 +647,7 @@
 /* mldsa/src/fips202/native/x86_64/keccak_f1600_x4_avx2.h */
 #undef MLD_FIPS202_NATIVE_X86_64_KECCAK_F1600_X4_AVX2_H
 #undef MLD_FIPS202_X86_64_NEED_X4_AVX2
-#undef MLD_USE_FIPS202_X4_NATIVE
+#undef MLD_USE_NATIVE_FIPS202_X4
 /* mldsa/src/fips202/native/x86_64/src/fips202_native_x86_64.h */
 #undef MLD_FIPS202_NATIVE_X86_64_SRC_FIPS202_NATIVE_X86_64_H
 #undef mld_keccak_f1600_x4_avx2_asm
@@ -636,12 +663,10 @@
 #undef MLD_FIPS202_ARMV81M_NEED_X4
 #undef MLD_FIPS202_NATIVE_ARMV81M
 #undef MLD_FIPS202_NATIVE_ARMV81M_MVE_H
-#undef MLD_USE_FIPS202_X4_EXTRACT_BYTES_NATIVE
-#undef MLD_USE_FIPS202_X4_NATIVE
-#undef MLD_USE_FIPS202_X4_XOR_BYTES_NATIVE
+#undef MLD_USE_NATIVE_FIPS202_X4
+#undef MLD_USE_NATIVE_FIPS202_X4_EXTRACT_BYTES
+#undef MLD_USE_NATIVE_FIPS202_X4_XOR_BYTES
 #undef mld_keccak_f1600_x4_native_impl
-#undef mld_keccak_f1600_x4_state_extract_bytes
-#undef mld_keccak_f1600_x4_state_xor_bytes
 /* mldsa/src/fips202/native/armv81m/src/fips202_native_armv81m.h */
 #undef MLD_FIPS202_NATIVE_ARMV81M_SRC_FIPS202_NATIVE_ARMV81M_H
 #undef mld_keccak_f1600_x4_mve_asm
@@ -652,6 +677,7 @@
 #endif /* MLD_CONFIG_USE_NATIVE_BACKEND_FIPS202 */
 #if defined(MLD_CONFIG_USE_NATIVE_BACKEND_ARITH)
 /* mldsa/src/native/api.h */
+#undef MLD_FQMUL_BOUND
 #undef MLD_INTT_BOUND
 #undef MLD_NATIVE_API_H
 #undef MLD_NATIVE_FUNC_FALLBACK
@@ -752,16 +778,16 @@
 #undef mld_pointwise_acc_l7_avx2_asm
 #undef mld_pointwise_avx2_asm
 #undef mld_poly_caddq_avx2_asm
-#undef mld_poly_chknorm_avx2
-#undef mld_poly_decompose_32_avx2
-#undef mld_poly_decompose_88_avx2
-#undef mld_poly_use_hint_32_avx2
-#undef mld_poly_use_hint_88_avx2
-#undef mld_polyz_unpack_17_avx2
-#undef mld_polyz_unpack_19_avx2
-#undef mld_rej_uniform_avx2
-#undef mld_rej_uniform_eta2_avx2
-#undef mld_rej_uniform_eta4_avx2
+#undef mld_poly_chknorm_avx2_asm
+#undef mld_poly_decompose_32_avx2_asm
+#undef mld_poly_decompose_88_avx2_asm
+#undef mld_poly_use_hint_32_avx2_asm
+#undef mld_poly_use_hint_88_avx2_asm
+#undef mld_polyz_unpack_17_avx2_asm
+#undef mld_polyz_unpack_19_avx2_asm
+#undef mld_rej_uniform_avx2_asm
+#undef mld_rej_uniform_eta2_avx2_asm
+#undef mld_rej_uniform_eta4_avx2_asm
 #undef mld_rej_uniform_table
 /* mldsa/src/native/x86_64/src/consts.h */
 #undef MLD_AVX2_BACKEND_DATA_OFFSET_8XDIV