@ttsc/win32-arm64 0.33.1 → 0.34.0

package/bin/go/src/crypto/internal/fips140/edwards25519/field/fe.go

@@ -115,65 +115,40 @@ func (v *Element) Negate(a *Element) *Element {
 //
 // If z == 0, Invert returns v = 0.
 func (v *Element) Invert(z *Element) *Element {
-	// Inversion is implemented as exponentiation with exponent p − 2. It uses the
-	// same sequence of 255 squarings and 11 multiplications as [Curve25519].
-	var z2, z9, z11, z2_5_0, z2_10_0, z2_20_0, z2_50_0, z2_100_0, t Element
-
-	z2.Square(z)             // 2
-	t.Square(&z2)            // 4
-	t.Square(&t)             // 8
-	z9.Multiply(&t, z)       // 9
-	z11.Multiply(&z9, &z2)   // 11
-	t.Square(&z11)           // 22
-	z2_5_0.Multiply(&t, &z9) // 31 = 2^5 - 2^0
-
-	t.Square(&z2_5_0) // 2^6 - 2^1
-	for i := 0; i < 4; i++ {
-		t.Square(&t) // 2^10 - 2^5
-	}
-	z2_10_0.Multiply(&t, &z2_5_0) // 2^10 - 2^0
+	// Inversion is implemented as exponentiation with exponent p − 2.
+	// It uses 254 squarings and 11 multiplications, grouping squarings to use SquareN.
+	var z11, t0, t1, t2, t Element
 
-	t.Square(&z2_10_0) // 2^11 - 2^1
-	for i := 0; i < 9; i++ {
-		t.Square(&t) // 2^20 - 2^10
-	}
-	z2_20_0.Multiply(&t, &z2_10_0) // 2^20 - 2^0
+	t1.Square(z)           // 2
+	t.Square(&t1)          // 4
+	t.Square(&t)           // 8
+	t2.Multiply(&t, z)     // 9
+	z11.Multiply(&t2, &t1) // 11
+	t.Square(&z11)         // 22
+	t0.Multiply(&t, &t2)   // 31 = 2^5 - 2^0
 
-	t.Square(&z2_20_0) // 2^21 - 2^1
-	for i := 0; i < 19; i++ {
-		t.Square(&t) // 2^40 - 2^20
-	}
-	t.Multiply(&t, &z2_20_0) // 2^40 - 2^0
+	t.SquareN(&t0, 5)    // 2^10 - 2^5
+	t2.Multiply(&t, &t0) // 2^10 - 1
 
-	t.Square(&t) // 2^41 - 2^1
-	for i := 0; i < 9; i++ {
-		t.Square(&t) // 2^50 - 2^10
-	}
-	z2_50_0.Multiply(&t, &z2_10_0) // 2^50 - 2^0
+	t.SquareN(&t2, 5)    // 2^15 - 2^5
+	t0.Multiply(&t, &t0) // 2^15 - 1
 
-	t.Square(&z2_50_0) // 2^51 - 2^1
-	for i := 0; i < 49; i++ {
-		t.Square(&t) // 2^100 - 2^50
-	}
-	z2_100_0.Multiply(&t, &z2_50_0) // 2^100 - 2^0
+	t.SquareN(&t0, 15)   // 2^30 - 2^15
+	t1.Multiply(&t, &t0) // 2^30 - 1
 
-	t.Square(&z2_100_0) // 2^101 - 2^1
-	for i := 0; i < 99; i++ {
-		t.Square(&t) // 2^200 - 2^100
-	}
-	t.Multiply(&t, &z2_100_0) // 2^200 - 2^0
+	t.SquareN(&t1, 30)   // 2^60 - 2^30
+	t0.Multiply(&t, &t1) // 2^60 - 1
 
-	t.Square(&t) // 2^201 - 2^1
-	for i := 0; i < 49; i++ {
-		t.Square(&t) // 2^250 - 2^50
-	}
-	t.Multiply(&t, &z2_50_0) // 2^250 - 2^0
+	t.SquareN(&t0, 60)   // 2^120 - 2^60
+	t1.Multiply(&t, &t0) // 2^120 - 1
 
-	t.Square(&t) // 2^251 - 2^1
-	t.Square(&t) // 2^252 - 2^2
-	t.Square(&t) // 2^253 - 2^3
-	t.Square(&t) // 2^254 - 2^4
-	t.Square(&t) // 2^255 - 2^5
+	t.SquareN(&t1, 120) // 2^240 - 2^120
+	t.Multiply(&t, &t1) // 2^240 - 1
+
+	t.SquareN(&t, 10)   // 2^250 - 2^10
+	t.Multiply(&t, &t2) // 2^250 - 1
+
+	t.SquareN(&t, 5) // 2^255 - 2^5
 
 	return v.Multiply(&t, &z11) // 2^255 - 21
 }
@@ -311,6 +286,12 @@ func (v *Element) Square(x *Element) *Element {
 	return v
 }
 
+// SquareN sets v = x^(2^n), and returns v. n must be positive.
+func (v *Element) SquareN(x *Element, n int) *Element {
+	feSquareN(v, x, n)
+	return v
+}
+
 // Mult32 sets v = x * y, and returns v.
 func (v *Element) Mult32(x *Element, y uint32) *Element {
 	x0lo, x0hi := mul51(x.l0, y)
@@ -340,51 +321,37 @@ func mul51(a uint64, b uint32) (lo uint64, hi uint64) {
 func (v *Element) Pow22523(x *Element) *Element {
 	var t0, t1, t2 Element
 
-	t0.Square(x)             // x^2
-	t1.Square(&t0)           // x^4
-	t1.Square(&t1)           // x^8
-	t1.Multiply(x, &t1)      // x^9
-	t0.Multiply(&t0, &t1)    // x^11
-	t0.Square(&t0)           // x^22
-	t0.Multiply(&t1, &t0)    // x^31
-	t1.Square(&t0)           // x^62
-	for i := 1; i < 5; i++ { // x^992
-		t1.Square(&t1)
-	}
-	t0.Multiply(&t1, &t0)     // x^1023 -> 1023 = 2^10 - 1
-	t1.Square(&t0)            // 2^11 - 2
-	for i := 1; i < 10; i++ { // 2^20 - 2^10
-		t1.Square(&t1)
-	}
-	t1.Multiply(&t1, &t0)     // 2^20 - 1
-	t2.Square(&t1)            // 2^21 - 2
-	for i := 1; i < 20; i++ { // 2^40 - 2^20
-		t2.Square(&t2)
-	}
-	t1.Multiply(&t2, &t1)     // 2^40 - 1
-	t1.Square(&t1)            // 2^41 - 2
-	for i := 1; i < 10; i++ { // 2^50 - 2^10
-		t1.Square(&t1)
-	}
-	t0.Multiply(&t1, &t0)     // 2^50 - 1
-	t1.Square(&t0)            // 2^51 - 2
-	for i := 1; i < 50; i++ { // 2^100 - 2^50
-		t1.Square(&t1)
-	}
-	t1.Multiply(&t1, &t0)      // 2^100 - 1
-	t2.Square(&t1)             // 2^101 - 2
-	for i := 1; i < 100; i++ { // 2^200 - 2^100
-		t2.Square(&t2)
-	}
-	t1.Multiply(&t2, &t1)     // 2^200 - 1
-	t1.Square(&t1)            // 2^201 - 2
-	for i := 1; i < 50; i++ { // 2^250 - 2^50
-		t1.Square(&t1)
-	}
-	t0.Multiply(&t1, &t0)     // 2^250 - 1
-	t0.Square(&t0)            // 2^251 - 2
-	t0.Square(&t0)            // 2^252 - 4
-	return v.Multiply(&t0, x) // 2^252 - 3 -> x^(2^252-3)
+	t0.Square(x)          // x^2
+	t1.Multiply(x, &t0)   // x^3
+	t0.Square(&t1)        // x^6
+	t0.Square(&t0)        // x^12
+	t0.Multiply(&t1, &t0) // x^15
+	t0.Square(&t0)        // x^30
+	t0.Multiply(x, &t0)   // x^31 = 2^5 - 1
+
+	t1.SquareN(&t0, 5)    // 2^10 - 2^5
+	t1.Multiply(&t1, &t0) // 2^10 - 1
+
+	t2.SquareN(&t1, 5)    // 2^15 - 2^5
+	t0.Multiply(&t2, &t0) // 2^15 - 1
+
+	t2.SquareN(&t0, 15)   // 2^30 - 2^15
+	t2.Multiply(&t2, &t0) // 2^30 - 1
+
+	t0.SquareN(&t2, 30)   // 2^60 - 2^30
+	t0.Multiply(&t0, &t2) // 2^60 - 1
+
+	t2.SquareN(&t0, 60)   // 2^120 - 2^60
+	t2.Multiply(&t2, &t0) // 2^120 - 1
+
+	t0.SquareN(&t2, 120)  // 2^240 - 2^120
+	t0.Multiply(&t0, &t2) // 2^240 - 1
+
+	t0.SquareN(&t0, 10)   // 2^250 - 2^10
+	t0.Multiply(&t0, &t1) // 2^250 - 1
+
+	t0.SquareN(&t0, 2)        // 2^252 - 4
+	return v.Multiply(&t0, x) // 2^252 - 3
 }
 
 // sqrtM1 is 2^((p-1)/4), which squared is equal to -1 by Euler's Criterion.

package/bin/go/src/crypto/internal/fips140/edwards25519/field/fe_amd64.go

@@ -8,8 +8,3 @@ package field
 //
 //go:noescape
 func feMul(out *Element, a *Element, b *Element)
-
-// feSquare sets out = a * a. It works like feSquareGeneric.
-//
-//go:noescape
-func feSquare(out *Element, a *Element)

package/bin/go/src/crypto/internal/fips140/edwards25519/field/fe_amd64.s

@@ -229,170 +229,3 @@ TEXT ·feMul(SB), NOSPLIT, $0-24
 	MOVQ R13, 24(AX)
 	MOVQ R15, 32(AX)
 	RET
-
-// func feSquare(out *Element, a *Element)
-TEXT ·feSquare(SB), NOSPLIT, $0-16
-	MOVQ a+8(FP), CX
-
-	// r0 = l0×l0
-	MOVQ (CX), AX
-	MULQ (CX)
-	MOVQ AX, SI
-	MOVQ DX, BX
-
-	// r0 += 38×l1×l4
-	MOVQ 8(CX), DX
-	LEAQ (DX)(DX*8), AX
-	LEAQ (DX)(AX*2), AX
-	SHLQ $0x01, AX
-	MULQ 32(CX)
-	ADDQ AX, SI
-	ADCQ DX, BX
-
-	// r0 += 38×l2×l3
-	MOVQ 16(CX), DX
-	LEAQ (DX)(DX*8), AX
-	LEAQ (DX)(AX*2), AX
-	SHLQ $0x01, AX
-	MULQ 24(CX)
-	ADDQ AX, SI
-	ADCQ DX, BX
-
-	// r1 = 2×l0×l1
-	MOVQ (CX), AX
-	SHLQ $0x01, AX
-	MULQ 8(CX)
-	MOVQ AX, R8
-	MOVQ DX, DI
-
-	// r1 += 38×l2×l4
-	MOVQ 16(CX), DX
-	LEAQ (DX)(DX*8), AX
-	LEAQ (DX)(AX*2), AX
-	SHLQ $0x01, AX
-	MULQ 32(CX)
-	ADDQ AX, R8
-	ADCQ DX, DI
-
-	// r1 += 19×l3×l3
-	MOVQ 24(CX), DX
-	LEAQ (DX)(DX*8), AX
-	LEAQ (DX)(AX*2), AX
-	MULQ 24(CX)
-	ADDQ AX, R8
-	ADCQ DX, DI
-
-	// r2 = 2×l0×l2
-	MOVQ (CX), AX
-	SHLQ $0x01, AX
-	MULQ 16(CX)
-	MOVQ AX, R10
-	MOVQ DX, R9
-
-	// r2 += l1×l1
-	MOVQ 8(CX), AX
-	MULQ 8(CX)
-	ADDQ AX, R10
-	ADCQ DX, R9
-
-	// r2 += 38×l3×l4
-	MOVQ 24(CX), DX
-	LEAQ (DX)(DX*8), AX
-	LEAQ (DX)(AX*2), AX
-	SHLQ $0x01, AX
-	MULQ 32(CX)
-	ADDQ AX, R10
-	ADCQ DX, R9
-
-	// r3 = 2×l0×l3
-	MOVQ (CX), AX
-	SHLQ $0x01, AX
-	MULQ 24(CX)
-	MOVQ AX, R12
-	MOVQ DX, R11
-
-	// r3 += 2×l1×l2
-	MOVQ 8(CX), AX
-	SHLQ $0x01, AX
-	MULQ 16(CX)
-	ADDQ AX, R12
-	ADCQ DX, R11
-
-	// r3 += 19×l4×l4
-	MOVQ 32(CX), DX
-	LEAQ (DX)(DX*8), AX
-	LEAQ (DX)(AX*2), AX
-	MULQ 32(CX)
-	ADDQ AX, R12
-	ADCQ DX, R11
-
-	// r4 = 2×l0×l4
-	MOVQ (CX), AX
-	SHLQ $0x01, AX
-	MULQ 32(CX)
-	MOVQ AX, R14
-	MOVQ DX, R13
-
-	// r4 += 2×l1×l3
-	MOVQ 8(CX), AX
-	SHLQ $0x01, AX
-	MULQ 24(CX)
-	ADDQ AX, R14
-	ADCQ DX, R13
-
-	// r4 += l2×l2
-	MOVQ 16(CX), AX
-	MULQ 16(CX)
-	ADDQ AX, R14
-	ADCQ DX, R13
-
-	// First reduction chain
-	MOVQ   $0x0007ffffffffffff, AX
-	SHLQ   $0x0d, SI, BX
-	SHLQ   $0x0d, R8, DI
-	SHLQ   $0x0d, R10, R9
-	SHLQ   $0x0d, R12, R11
-	SHLQ   $0x0d, R14, R13
-	ANDQ   AX, SI
-	IMUL3Q $0x13, R13, R13
-	ADDQ   R13, SI
-	ANDQ   AX, R8
-	ADDQ   BX, R8
-	ANDQ   AX, R10
-	ADDQ   DI, R10
-	ANDQ   AX, R12
-	ADDQ   R9, R12
-	ANDQ   AX, R14
-	ADDQ   R11, R14
-
-	// Second reduction chain (carryPropagate)
-	MOVQ   SI, BX
-	SHRQ   $0x33, BX
-	MOVQ   R8, DI
-	SHRQ   $0x33, DI
-	MOVQ   R10, R9
-	SHRQ   $0x33, R9
-	MOVQ   R12, R11
-	SHRQ   $0x33, R11
-	MOVQ   R14, R13
-	SHRQ   $0x33, R13
-	ANDQ   AX, SI
-	IMUL3Q $0x13, R13, R13
-	ADDQ   R13, SI
-	ANDQ   AX, R8
-	ADDQ   BX, R8
-	ANDQ   AX, R10
-	ADDQ   DI, R10
-	ANDQ   AX, R12
-	ADDQ   R9, R12
-	ANDQ   AX, R14
-	ADDQ   R11, R14
-
-	// Store output
-	MOVQ out+0(FP), AX
-	MOVQ SI, (AX)
-	MOVQ R8, 8(AX)
-	MOVQ R10, 16(AX)
-	MOVQ R12, 24(AX)
-	MOVQ R14, 32(AX)
-	RET

package/bin/go/src/crypto/internal/fips140/edwards25519/field/fe_amd64_noasm.go

@@ -7,5 +7,3 @@
 package field
 
 func feMul(v, x, y *Element) { feMulGeneric(v, x, y) }
-
-func feSquare(v, x *Element) { feSquareGeneric(v, x) }

package/bin/go/src/crypto/internal/fips140/edwards25519/field/fe_generic.go

@@ -183,7 +183,7 @@ func feMulGeneric(v, a, b *Element) {
 	v.l4 = rr4&maskLow51Bits + rr3>>51
 }
 
-func feSquareGeneric(v, a *Element) {
+func feSquare(v, a *Element) {
 	l0 := a.l0
 	l1 := a.l1
 	l2 := a.l2
@@ -256,6 +256,62 @@ func feSquareGeneric(v, a *Element) {
 	v.l4 = rr4&maskLow51Bits + rr3>>51
 }
 
+// feSquareN squares a n times and writes the result to v.
+// It uses local variables to keep limbs in registers.
+func feSquareN(v, a *Element, n int) {
+	l0 := a.l0
+	l1 := a.l1
+	l2 := a.l2
+	l3 := a.l3
+	l4 := a.l4
+
+	for range n {
+		r0 := mul(l0, l0)
+		r0 = addMul38(r0, l1, l4)
+		r0 = addMul38(r0, l2, l3)
+
+		r1 := mul(l0*2, l1)
+		r1 = addMul38(r1, l2, l4)
+		r1 = addMul19(r1, l3, l3)
+
+		r2 := mul(l0*2, l2)
+		r2 = addMul(r2, l1, l1)
+		r2 = addMul38(r2, l3, l4)
+
+		r3 := mul(l0*2, l3)
+		r3 = addMul(r3, l1*2, l2)
+		r3 = addMul19(r3, l4, l4)
+
+		r4 := mul(l0*2, l4)
+		r4 = addMul(r4, l1*2, l3)
+		r4 = addMul(r4, l2, l2)
+
+		c0 := shiftRightBy51(r0)
+		c1 := shiftRightBy51(r1)
+		c2 := shiftRightBy51(r2)
+		c3 := shiftRightBy51(r3)
+		c4 := shiftRightBy51(r4)
+
+		rr0 := r0.lo&maskLow51Bits + mul19(c4)
+		rr1 := r1.lo&maskLow51Bits + c0
+		rr2 := r2.lo&maskLow51Bits + c1
+		rr3 := r3.lo&maskLow51Bits + c2
+		rr4 := r4.lo&maskLow51Bits + c3
+
+		l0 = rr0&maskLow51Bits + mul19(rr4>>51)
+		l1 = rr1&maskLow51Bits + rr0>>51
+		l2 = rr2&maskLow51Bits + rr1>>51
+		l3 = rr3&maskLow51Bits + rr2>>51
+		l4 = rr4&maskLow51Bits + rr3>>51
+	}
+
+	v.l0 = l0
+	v.l1 = l1
+	v.l2 = l2
+	v.l3 = l3
+	v.l4 = l4
+}
+
 // carryPropagate brings the limbs below 52 bits by applying the reduction
 // identity (a * 2²⁵⁵ + b = a * 19 + b) to the l4 carry.
 func (v *Element) carryPropagate() *Element {

package/bin/go/src/crypto/internal/fips140/edwards25519/scalarmult.go

@@ -167,10 +167,11 @@ func (v *Point) VarTimeDoubleScalarBaseMult(a *Scalar, A *Point, b *Scalar) *Poi
 
 	// Find the first nonzero coefficient.
 	i := 255
-	for j := i; j >= 0; j-- {
-		if aNaf[j] != 0 || bNaf[j] != 0 {
+	for i >= 0 {
+		if aNaf[i] != 0 || bNaf[i] != 0 {
 			break
 		}
+		i--
 	}
 
 	multA := &projCached{}

package/bin/go/src/crypto/internal/fips140/mldsa/mldsa.go

@@ -58,6 +58,8 @@ const maxPubKeySize = PublicKeySize87
 type PrivateKey struct {
 	seed [32]byte
 	pub  PublicKey
+	a    [maxK * maxL]nttElement
+	t1   [maxK]nttElement // NTT(t₁ ⋅ 2ᵈ)
 	s1   [maxL]nttElement
 	s2   [maxK]nttElement
 	t0   [maxK]nttElement
@@ -82,9 +84,7 @@ func (priv *PrivateKey) PublicKey() *PublicKey {
 type PublicKey struct {
 	raw [maxPubKeySize]byte
 	p   parameters
-	a   [maxK * maxL]nttElement
-	t1  [maxK]nttElement // NTT(t₁ ⋅ 2ᵈ)
-	tr  [64]byte         // public key hash
+	tr  [64]byte // public key hash
 }
 
 func (pub *PublicKey) Equal(x *PublicKey) bool {
@@ -183,7 +183,7 @@ func newPrivateKey(seed *[32]byte, p parameters) *PrivateKey {
 	ξ.Read(ρs)
 	ξ.Read(priv.k[:])
 
-	A := priv.pub.a[:k*l]
+	A := priv.a[:k*l]
 	computeMatrixA(A, ρ, p)
 
 	s1 := priv.s1[:l]
@@ -219,13 +219,9 @@ func newPrivateKey(seed *[32]byte, p parameters) *PrivateKey {
 		t0[i] = ntt(w)
 	}
 
-	// The computations below (and their storage in the PrivateKey struct) are
-	// not strictly necessary and could be deferred to PrivateKey.PublicKey().
-	// That would require keeping or re-deriving ρ and t/t1, though.
-
 	pk := pkEncode(priv.pub.raw[:0], ρ, t1, p)
 	priv.pub.tr = computePublicKeyHash(pk)
-	computeT1Hat(priv.pub.t1[:k], t1) // NTT(t₁ ⋅ 2ᵈ)
+	computeT1Hat(priv.t1[:k], t1) // NTT(t₁ ⋅ 2ᵈ)
 
 	return priv
 }
@@ -302,31 +298,32 @@ func pkDecode(pk []byte, t1 [][n]uint16, p parameters) (ρ []byte, err error) {
 var errInvalidPublicKeyLength = errors.New("mldsa: invalid public key length")
 
 func NewPublicKey44(pk []byte) (*PublicKey, error) {
-	return newPublicKey(pk, params44)
+	return newPublicKey(&PublicKey{}, pk, params44)
 }
 
 func NewPublicKey65(pk []byte) (*PublicKey, error) {
-	return newPublicKey(pk, params65)
+	return newPublicKey(&PublicKey{}, pk, params65)
 }
 
 func NewPublicKey87(pk []byte) (*PublicKey, error) {
-	return newPublicKey(pk, params87)
+	return newPublicKey(&PublicKey{}, pk, params87)
 }
 
-func newPublicKey(pk []byte, p parameters) (*PublicKey, error) {
-	k, l := p.k, p.l
-
-	t1 := make([][n]uint16, k, maxK)
-	ρ, err := pkDecode(pk, t1, p)
-	if err != nil {
-		return nil, err
+func newPublicKey(pub *PublicKey, pk []byte, p parameters) (*PublicKey, error) {
+	if len(pk) != pubKeySize(p) {
+		return nil, errInvalidPublicKeyLength
 	}
 
-	pub := &PublicKey{p: p}
+	// We don't precompute A and t1Hat here, because they would make the
+	// PublicKey over 68KB. Unlike private keys, public keys are often used to
+	// verify a signature only once, so precomputation doesn't help as often,
+	// but they can stay around in memory, for example as part of a TLS
+	// connection's PeerCertificates, so their size is more of a concern.
+	// Instead, we compute A and t1Hat on demand in Verify.
+
+	pub.p = p
 	copy(pub.raw[:], pk)
-	computeMatrixA(pub.a[:k*l], ρ, p)
 	pub.tr = computePublicKeyHash(pk)
-	computeT1Hat(pub.t1[:k], t1) // NTT(t₁ ⋅ 2ᵈ)
 
 	return pub, nil
 }
@@ -423,7 +420,7 @@ func computeMessageHash(tr []byte, msg []byte, context string) ([64]byte, error)
 
 func signInternal(priv *PrivateKey, μ *[64]byte, random *[32]byte) []byte {
 	p, k, l := priv.pub.p, priv.pub.p.k, priv.pub.p.l
-	A, s1, s2, t0 := priv.pub.a[:k*l], priv.s1[:l], priv.s2[:k], priv.t0[:k]
+	A, s1, s2, t0 := priv.a[:k*l], priv.s1[:l], priv.s2[:k], priv.t0[:k]
 
 	β := p.τ * p.η
 	γ1 := uint32(1 << p.γ1)
@@ -654,12 +651,21 @@ func VerifyExternalMu(pub *PublicKey, μ []byte, sig []byte) error {
 
 func verifyInternal(pub *PublicKey, μ *[64]byte, sig []byte) error {
 	p, k, l := pub.p, pub.p.k, pub.p.l
-	t1, A := pub.t1[:k], pub.a[:k*l]
 
 	β := p.τ * p.η
 	γ1 := uint32(1 << p.γ1)
 	γ1β := γ1 - uint32(β)
 
+	t1 := make([][n]uint16, k, maxK)
+	ρ, err := pkDecode(pub.raw[:pubKeySize(pub.p)], t1, p)
+	if err != nil {
+		return err
+	}
+	A := make([]nttElement, k*l, maxK*maxL)
+	computeMatrixA(A, ρ, p)
+	t1Hat := make([]nttElement, k, maxK)
+	computeT1Hat(t1Hat, t1) // NTT(t₁ ⋅ 2ᵈ)
+
 	z := make([]ringElement, l, maxL)
 	h := make([][n]byte, k, maxK)
 	ch, err := sigDecode(sig, z, h, p)
@@ -680,7 +686,7 @@ func verifyInternal(pub *PublicKey, μ *[64]byte, sig []byte) error {
 		for j := range l {
 			wHat = polyAdd(wHat, nttMul(A[i*l+j], zHat[j]))
 		}
-		wHat = polySub(wHat, nttMul(c, t1[i]))
+		wHat = polySub(wHat, nttMul(c, t1Hat[i]))
 		w[i] = inverseNTT(wHat)
 	}
 

package/bin/go/src/crypto/internal/fips140/mldsa/semiexpanded.go

@@ -57,7 +57,7 @@ func TestingOnlyNewPrivateKeyFromSemiExpanded(sk []byte) (*PrivateKey, error) {
 	priv := &PrivateKey{pub: PublicKey{p: p}}
 	priv.k = K
 	priv.pub.tr = tr
-	A := priv.pub.a[:k*l]
+	A := priv.a[:k*l]
 	computeMatrixA(A, ρ[:], p)
 	for r := range l {
 		priv.s1[r] = ntt(s1[r])
@@ -110,7 +110,7 @@ func TestingOnlyNewPrivateKeyFromSemiExpanded(sk []byte) (*PrivateKey, error) {
 	if computePublicKeyHash(pk) != tr {
 		return nil, errors.New("mldsa: semi-expanded private key inconsistent with public key hash")
 	}
-	computeT1Hat(priv.pub.t1[:k], t1) // NTT(t₁ ⋅ 2ᵈ)
+	computeT1Hat(priv.t1[:k], t1) // NTT(t₁ ⋅ 2ᵈ)
 
 	return priv, nil
 }

package/bin/go/src/crypto/internal/fips140/nistec/_asm/go.mod

@@ -1,11 +1,11 @@
 module crypto/internal/fips140/nistec/_asm
 
-go 1.24
+go 1.26.0
 
 require github.com/mmcloughlin/avo v0.6.0
 
 require (
-	golang.org/x/mod v0.20.0 // indirect
-	golang.org/x/sync v0.8.0 // indirect
-	golang.org/x/tools v0.24.0 // indirect
+	golang.org/x/mod v0.33.0 // indirect
+	golang.org/x/sync v0.19.0 // indirect
+	golang.org/x/tools v0.42.0 // indirect
 )

package/bin/go/src/crypto/internal/fips140/nistec/_asm/go.sum

@@ -2,7 +2,13 @@ github.com/mmcloughlin/avo v0.6.0 h1:QH6FU8SKoTLaVs80GA8TJuLNkUYl4VokHKlPhVDg4YY
 github.com/mmcloughlin/avo v0.6.0/go.mod h1:8CoAGaCSYXtCPR+8y18Y9aB/kxb8JSS6FRI7mSkvD+8=
 golang.org/x/mod v0.20.0 h1:utOm6MM3R3dnawAiJgn0y+xvuYRsm1RKM/4giyfDgV0=
 golang.org/x/mod v0.20.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
+golang.org/x/mod v0.33.0 h1:tHFzIWbBifEmbwtGz65eaWyGiGZatSrT9prnU8DbVL8=
+golang.org/x/mod v0.33.0/go.mod h1:swjeQEj+6r7fODbD2cqrnje9PnziFuw4bmLbBZFrQ5w=
 golang.org/x/sync v0.8.0 h1:3NFvSEYkUoMifnESzZl15y791HH1qU2xm6eCJU5ZPXQ=
 golang.org/x/sync v0.8.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
+golang.org/x/sync v0.19.0 h1:vV+1eWNmZ5geRlYjzm2adRgW2/mcpevXNg50YZtPCE4=
+golang.org/x/sync v0.19.0/go.mod h1:9KTHXmSnoGruLpwFjVSX0lNNA75CykiMECbovNTZqGI=
 golang.org/x/tools v0.24.0 h1:J1shsA93PJUEVaUSaay7UXAyE8aimq3GW0pjlolpa24=
 golang.org/x/tools v0.24.0/go.mod h1:YhNqVBIfWHdzvTLs0d8LCuMhkKUgSUKldakyV7W/WDQ=
+golang.org/x/tools v0.42.0 h1:uNgphsn75Tdz5Ji2q36v/nsFSfR/9BRFvqhGBaJGd5k=
+golang.org/x/tools v0.42.0/go.mod h1:Ma6lCIwGZvHK6XtgbswSoWroEkhugApmsXyrUmBhfr0=