Clear ML-KEM outputs on KEM failure by tob-joe · Pull Request #1769 · pq-code-package/mlkem-native

tob-joe · 2026-06-29T18:20:59Z

Summary

clear caller-visible keypair outputs when ML-KEM key generation fails
clear encapsulation ciphertext/shared-secret outputs and decapsulation shared-secret outputs when public KEM paths fail
add RNG, invalid-key, and allocation-failure regression test coverage for stale caller buffers

Testing

make run_rng_fail
make run_func
make run_alloc

Related: pq-code-package/mldsa-native#1242 applies the same output-clearing behavior to ML-DSA signing failure paths.

Co-authored-by: Codex codex@openai.com
Signed-off-by: Joe Doyle joseph.doyle@trailofbits.com

This work was completed by Trail of Bits as part of the Patch The Planet project in collaboration with OpenAI. The issue was identified primarily by the Codex coding agent, and manually reviewed before submission.

oqs-bot · 2026-06-29T18:44:07Z

CBMC Results (ML-KEM-512)

Full Results (191 proofs)

Proof	Status	Current	Previous	Change
`TOTAL`	✅	1498s	1695s	-11.6%
`mlk_indcpa_enc`	✅	241s	262s	-8%
`mlk_indcpa_keypair_derand`	✅	203s	226s	-10%
`mlk_poly_rej_uniform`	✅	134s	154s	-13%
`mlk_rej_uniform_c`	✅	109s	146s	-25%
`rej_uniform_native_x86_64`	✅	57s	64s	-11%
`mlk_polyvec_basemul_acc_montgomery_cached_c`	✅	49s	55s	-11%
`rej_uniform_native_aarch64`	✅	35s	39s	-10%
`mlk_poly_reduce_native`	✅	33s	37s	-11%
`poly_ntt_native`	✅	33s	42s	-21%
`mlk_ntt_layer`	✅	28s	37s	-24%
`mlk_keccak_squeezeblocks_x4`	✅	26s	27s	-4%
`keccakf1600x4_permute_native_x4`	✅	16s	18s	-11%
`mlk_fqmul`	✅	16s	19s	-16%
`mlk_indcpa_dec`	✅	16s	18s	-11%
`mlk_poly_decompress_d10_native`	✅	13s	15s	-13%
`mlk_poly_decompress_d4_native`	✅	12s	16s	-25%
`mlk_poly_frommsg`	✅	10s	8s	+25%
`mlk_polyvec_add`	✅	9s	12s	-25%
`mlk_poly_rej_uniform_x4`	✅	8s	7s	+14%
`mlk_keccak_squeeze_once`	✅	7s	7s	+0%
`mlk_keccak_squeezeblocks`	✅	7s	8s	-12%
`mlk_ntt_butterfly_block`	✅	7s	9s	-22%
`mlk_poly_frombytes_native`	✅	7s	11s	-36%
`polyvec_basemul_acc_montgomery_cached_native`	✅	7s	10s	-30%
`mlk_invntt_layer`	✅	6s	5s	+20%
`mlk_keccak_absorb_once_x4`	✅	6s	6s	+0%
`mlk_poly_mulcache_compute`	✅	6s	1s	+500%
`mlk_poly_ntt`	✅	6s	7s	-14%
`mlk_poly_sub`	✅	6s	6s	+0%
`keccak_f1600_x4_native_aarch64_v84a`	✅	5s	1s	+400%
`kem_check_pk`	✅	5s	4s	+25%
`kem_dec`	✅	5s	4s	+25%
`mlk_keccakf1600_permute_c`	✅	5s	3s	+67%
`mlk_poly_add`	✅	5s	5s	+0%
`poly_frombytes_native_x86_64`	✅	5s	6s	-17%
`kem_enc`	✅	4s	5s	-20%
`mlk_keccak_absorb_once`	✅	4s	6s	-33%
`mlk_keccakf1600_xor_bytes`	✅	4s	4s	+0%
`mlk_poly_compress_d10_c`	✅	4s	2s	+100%
`mlk_poly_compress_d11_native`	✅	4s	3s	+33%
`mlk_poly_decompress_d11_native`	✅	4s	3s	+33%
`mlk_poly_decompress_d4_c`	✅	4s	6s	-33%
`mlk_poly_frombytes`	✅	4s	2s	+100%
`mlk_poly_frombytes_c`	✅	4s	5s	-20%
`mlk_poly_getnoise_eta1_4x`	✅	4s	4s	+0%
`mlk_poly_getnoise_eta1_4x_native`	✅	4s	5s	-20%
`mlk_poly_getnoise_eta2`	✅	4s	3s	+33%
`mlk_polyvec_tobytes`	✅	4s	2s	+100%
`poly_decompress_d4_native_x86_64`	✅	4s	5s	-20%
`polyvec_basemul_acc_montgomery_cached_k4_native_x86_64`	✅	4s	5s	-20%
`keccakf1600x4_extract_bytes_native`	✅	3s	2s	+50%
`keccakf1600x4_xor_bytes_native`	✅	3s	2s	+50%
`kem_check_sk`	✅	3s	3s	+0%
`mlk_ct_cmask_neg_i16`	✅	3s	2s	+50%
`mlk_ct_sel_int16`	✅	3s	1s	+200%
`mlk_ct_sel_uint8`	✅	3s	1s	+200%
`mlk_poly_cbd_eta2`	✅	3s	2s	+50%
`mlk_poly_compress_d10`	✅	3s	2s	+50%
`mlk_poly_compress_d11`	✅	3s	2s	+50%
`mlk_poly_compress_d5_c`	✅	3s	2s	+50%
`mlk_poly_decompress_d10_c`	✅	3s	2s	+50%
`mlk_poly_decompress_d5`	✅	3s	1s	+200%
`mlk_poly_decompress_d5_c`	✅	3s	2s	+50%
`mlk_poly_decompress_d5_native`	✅	3s	2s	+50%
`mlk_poly_getnoise_eta1122_4x`	✅	3s	4s	-25%
`mlk_poly_invntt_tomont_c`	✅	3s	1s	+200%
`mlk_poly_tobytes`	✅	3s	4s	-25%
`mlk_poly_tomont`	✅	3s	1s	+200%
`mlk_polyvec_basemul_acc_montgomery_cached`	✅	3s	2s	+50%
`mlk_polyvec_compress_du`	✅	3s	3s	+0%
`mlk_polyvec_decompress_du`	✅	3s	2s	+50%
`mlk_polyvec_invntt_tomont`	✅	3s	3s	+0%
`mlk_polyvec_mulcache_compute`	✅	3s	2s	+50%
`mlk_polyvec_ntt`	✅	3s	2s	+50%
`mlk_scalar_compress_d1`	✅	3s	2s	+50%
`mlk_scalar_decompress_d10`	✅	3s	2s	+50%
`mlk_scalar_decompress_d4`	✅	3s	2s	+50%
`mlk_scalar_decompress_d5`	✅	3s	2s	+50%
`mlk_shake256x4`	✅	3s	3s	+0%
`mlk_value_barrier_u32`	✅	3s	3s	+0%
`mlk_value_barrier_u8`	✅	3s	2s	+50%
`ntt_native_aarch64`	✅	3s	1s	+200%
`poly_compress_d10_native_x86_64`	✅	3s	3s	+0%
`poly_compress_d11_native_x86_64`	✅	3s	3s	+0%
`poly_compress_d4_native_x86_64`	✅	3s	3s	+0%
`poly_compress_d5_native_x86_64`	✅	3s	2s	+50%
`poly_decompress_d10_native_x86_64`	✅	3s	4s	-25%
`poly_decompress_d5_native_x86_64`	✅	3s	4s	-25%
`poly_invntt_tomont_native`	✅	3s	4s	-25%
`poly_mulcache_compute_native_x86_64`	✅	3s	3s	+0%
`poly_tomont_native_x86_64`	✅	3s	3s	+0%
`polyvec_basemul_acc_montgomery_cached_k3_native_aarch64`	✅	3s	2s	+50%
`polyvec_basemul_acc_montgomery_cached_k3_native_x86_64`	✅	3s	4s	-25%
`polyvec_basemul_acc_montgomery_cached_k4_native_aarch64`	✅	3s	2s	+50%
`sys_check_capability`	✅	3s	2s	+50%
`intt_native_x86_64`	✅	2s	2s	+0%
`keccak_f1600_x1_native_aarch64`	✅	2s	1s	+100%
`keccak_f1600_x1_native_aarch64_v84a`	✅	2s	1s	+100%
`keccak_f1600_x4_native_aarch64_v8a_scalar_hybrid`	✅	2s	4s	-50%
`keccak_f1600_x4_native_avx2`	✅	2s	2s	+0%
`keccakf1600_permute_native`	✅	2s	2s	+0%
`kem_enc_derand`	✅	2s	1s	+100%
`kem_keypair`	✅	2s	2s	+0%
`kem_keypair_derand`	✅	2s	2s	+0%
`mlk_barrett_reduce`	✅	2s	3s	-33%
`mlk_check_pct`	✅	2s	5s	-60%
`mlk_ct_cmask_nonzero_u16`	✅	2s	2s	+0%
`mlk_ct_cmask_nonzero_u8`	✅	2s	3s	-33%
`mlk_ct_get_optblocker_i32`	✅	2s	2s	+0%
`mlk_ct_get_optblocker_u32`	✅	2s	1s	+100%
`mlk_ct_get_optblocker_u8`	✅	2s	3s	-33%
`mlk_ct_memcmp`	✅	2s	5s	-60%
`mlk_enc_getnoise_eta1_eta2`	✅	2s	2s	+0%
`mlk_gen_matrix`	✅	2s	4s	-50%
`mlk_gen_matrix_serial`	✅	2s	3s	-33%
`mlk_keccakf1600_extract_bytes (big endian)`	✅	2s	2s	+0%
`mlk_keccakf1600_xor_bytes (big endian)`	✅	2s	1s	+100%
`mlk_keccakf1600x4_extract_bytes`	✅	2s	3s	-33%
`mlk_keccakf1600x4_permute`	✅	2s	2s	+0%
`mlk_keccakf1600x4_xor_bytes_c`	✅	2s	2s	+0%
`mlk_keypair_getnoise_eta1`	✅	2s	2s	+0%
`mlk_matvec_mul`	✅	2s	2s	+0%
`mlk_montgomery_reduce`	✅	2s	3s	-33%
`mlk_poly_cbd_eta1`	✅	2s	3s	-33%
`mlk_poly_compress_d11_c`	✅	2s	2s	+0%
`mlk_poly_compress_d5`	✅	2s	4s	-50%
`mlk_poly_compress_d5_native`	✅	2s	3s	-33%
`mlk_poly_compress_du`	✅	2s	2s	+0%
`mlk_poly_compress_dv`	✅	2s	3s	-33%
`mlk_poly_decompress_d10`	✅	2s	1s	+100%
`mlk_poly_decompress_du`	✅	2s	2s	+0%
`mlk_poly_decompress_dv`	✅	2s	3s	-33%
`mlk_poly_mulcache_compute_c`	✅	2s	3s	-33%
`mlk_poly_mulcache_compute_native`	✅	2s	3s	-33%
`mlk_poly_ntt_c`	✅	2s	2s	+0%
`mlk_poly_reduce_c`	✅	2s	1s	+100%
`mlk_poly_tomont_c`	✅	2s	2s	+0%
`mlk_poly_tomsg`	✅	2s	3s	-33%
`mlk_polymat_permute_bitrev_to_custom`	✅	2s	2s	+0%
`mlk_polyvec_frombytes`	✅	2s	4s	-50%
`mlk_polyvec_permute_bitrev_to_custom`	✅	2s	2s	+0%
`mlk_polyvec_permute_bitrev_to_custom_native`	✅	2s	3s	-33%
`mlk_polyvec_reduce`	✅	2s	2s	+0%
`mlk_rej_uniform`	✅	2s	3s	-33%
`mlk_scalar_compress_d10`	✅	2s	4s	-50%
`mlk_scalar_compress_d4`	✅	2s	1s	+100%
`mlk_scalar_compress_d5`	✅	2s	3s	-33%
`mlk_scalar_signed_to_unsigned_q`	✅	2s	4s	-50%
`mlk_shake128_squeezeblocks`	✅	2s	5s	-60%
`mlk_shake128x4_absorb_once`	✅	2s	3s	-33%
`mlk_shake128x4_squeezeblocks`	✅	2s	3s	-33%
`mlk_value_barrier_i32`	✅	2s	2s	+0%
`nttunpack_native_x86_64`	✅	2s	1s	+100%
`poly_getnoise_eta1122_4x_native`	✅	2s	2s	+0%
`poly_mulcache_compute_native_aarch64`	✅	2s	3s	-33%
`poly_reduce_native_x86_64`	✅	2s	3s	-33%
`poly_tobytes_native_aarch64`	✅	2s	4s	-50%
`polyvec_basemul_acc_montgomery_cached_k2_native_aarch64`	✅	2s	4s	-50%
`polyvec_basemul_acc_montgomery_cached_k2_native_x86_64`	✅	2s	2s	+0%
`intt_native_aarch64`	✅	1s	1s	+0%
`keccak_f1600_x4_native_aarch64_v8a_v84a_scalar_hybrid`	✅	1s	3s	-67%
`mlk_ct_cmov_zero`	✅	1s	2s	-50%
`mlk_keccakf1600_extract_bytes`	✅	1s	1s	+0%
`mlk_keccakf1600_permute`	✅	1s	1s	+0%
`mlk_keccakf1600x4_extract_bytes_c`	✅	1s	1s	+0%
`mlk_keccakf1600x4_xor_bytes`	✅	1s	2s	-50%
`mlk_poly_compress_d10_native`	✅	1s	3s	-67%
`mlk_poly_compress_d4`	✅	1s	3s	-67%
`mlk_poly_compress_d4_c`	✅	1s	3s	-67%
`mlk_poly_compress_d4_native`	✅	1s	3s	-67%
`mlk_poly_decompress_d11`	✅	1s	3s	-67%
`mlk_poly_decompress_d11_c`	✅	1s	2s	-50%
`mlk_poly_decompress_d4`	✅	1s	2s	-50%
`mlk_poly_invntt_tomont`	✅	1s	2s	-50%
`mlk_poly_reduce`	✅	1s	3s	-67%
`mlk_poly_tobytes_c`	✅	1s	3s	-67%
`mlk_poly_tobytes_native`	✅	1s	2s	-50%
`mlk_poly_tomont_native`	✅	1s	5s	-80%
`mlk_polyvec_tomont`	✅	1s	2s	-50%
`mlk_scalar_compress_d11`	✅	1s	2s	-50%
`mlk_scalar_decompress_d11`	✅	1s	2s	-50%
`mlk_sha3_256`	✅	1s	2s	-50%
`mlk_sha3_512`	✅	1s	1s	+0%
`mlk_shake128_absorb_once`	✅	1s	2s	-50%
`mlk_shake256`	✅	1s	2s	-50%
`ntt_native_x86_64`	✅	1s	2s	-50%
`poly_decompress_d11_native_x86_64`	✅	1s	2s	-50%
`poly_reduce_native_aarch64`	✅	1s	1s	+0%
`poly_tobytes_native_x86_64`	✅	1s	3s	-67%
`poly_tomont_native_aarch64`	✅	1s	3s	-67%
`rej_uniform_native`	✅	1s	1s	+0%

oqs-bot · 2026-06-29T18:45:38Z

CBMC Results (ML-KEM-768)

Full Results (191 proofs)

Proof	Status	Current	Previous	Change
`TOTAL`	✅	1653s	1839s	-10.1%
`mlk_indcpa_keypair_derand`	✅	310s	347s	-11%
`mlk_indcpa_enc`	✅	251s	252s	-0%
`mlk_poly_rej_uniform`	✅	127s	163s	-22%
`mlk_rej_uniform_c`	✅	117s	147s	-20%
`rej_uniform_native_x86_64`	✅	57s	59s	-3%
`mlk_polyvec_basemul_acc_montgomery_cached_c`	✅	50s	60s	-17%
`rej_uniform_native_aarch64`	✅	35s	39s	-10%
`mlk_poly_reduce_native`	✅	34s	38s	-11%
`poly_ntt_native`	✅	34s	44s	-23%
`mlk_ntt_layer`	✅	30s	42s	-29%
`mlk_keccak_squeezeblocks_x4`	✅	23s	30s	-23%
`keccakf1600x4_permute_native_x4`	✅	16s	19s	-16%
`polyvec_basemul_acc_montgomery_cached_native`	✅	16s	18s	-11%
`mlk_fqmul`	✅	15s	19s	-21%
`mlk_poly_decompress_d10_native`	✅	13s	16s	-19%
`mlk_poly_decompress_d4_native`	✅	12s	18s	-33%
`mlk_polyvec_add`	✅	11s	13s	-15%
`mlk_indcpa_dec`	✅	10s	12s	-17%
`mlk_poly_frommsg`	✅	10s	14s	-29%
`mlk_keccak_absorb_once_x4`	✅	9s	9s	+0%
`mlk_keccak_squeezeblocks`	✅	9s	8s	+12%
`mlk_poly_frombytes_native`	✅	9s	10s	-10%
`mlk_poly_ntt`	✅	8s	7s	+14%
`mlk_poly_rej_uniform_x4`	✅	8s	4s	+100%
`mlk_keccak_squeeze_once`	✅	7s	8s	-12%
`mlk_ntt_butterfly_block`	✅	7s	9s	-22%
`mlk_poly_sub`	✅	7s	8s	-12%
`poly_decompress_d4_native_x86_64`	✅	7s	7s	+0%
`kem_dec`	✅	6s	6s	+0%
`mlk_ct_cmov_zero`	✅	6s	2s	+200%
`mlk_keccakf1600_permute_c`	✅	6s	5s	+20%
`poly_frombytes_native_x86_64`	✅	6s	4s	+50%
`kem_check_pk`	✅	5s	4s	+25%
`mlk_invntt_layer`	✅	5s	6s	-17%
`mlk_poly_add`	✅	5s	5s	+0%
`mlk_poly_compress_d10_c`	✅	5s	4s	+25%
`mlk_polyvec_frombytes`	✅	5s	1s	+400%
`mlk_polyvec_invntt_tomont`	✅	5s	2s	+150%
`mlk_shake256x4`	✅	5s	3s	+67%
`mlk_ct_cmask_nonzero_u8`	✅	4s	2s	+100%
`mlk_keccak_absorb_once`	✅	4s	5s	-20%
`mlk_keypair_getnoise_eta1`	✅	4s	1s	+300%
`mlk_matvec_mul`	✅	4s	4s	+0%
`mlk_montgomery_reduce`	✅	4s	1s	+300%
`mlk_poly_compress_dv`	✅	4s	3s	+33%
`mlk_poly_decompress_d4_c`	✅	4s	3s	+33%
`mlk_poly_frombytes_c`	✅	4s	4s	+0%
`mlk_poly_getnoise_eta1_4x_native`	✅	4s	2s	+100%
`mlk_poly_invntt_tomont_c`	✅	4s	4s	+0%
`mlk_poly_ntt_c`	✅	4s	3s	+33%
`mlk_polyvec_ntt`	✅	4s	2s	+100%
`mlk_polyvec_tomont`	✅	4s	3s	+33%
`mlk_scalar_decompress_d5`	✅	4s	3s	+33%
`ntt_native_aarch64`	✅	4s	1s	+300%
`poly_compress_d10_native_x86_64`	✅	4s	3s	+33%
`poly_tobytes_native_aarch64`	✅	4s	2s	+100%
`sys_check_capability`	✅	4s	5s	-20%
`keccak_f1600_x1_native_aarch64_v84a`	✅	3s	1s	+200%
`keccak_f1600_x4_native_aarch64_v84a`	✅	3s	3s	+0%
`keccakf1600_permute_native`	✅	3s	3s	+0%
`kem_keypair_derand`	✅	3s	5s	-40%
`mlk_check_pct`	✅	3s	1s	+200%
`mlk_ct_cmask_nonzero_u16`	✅	3s	1s	+200%
`mlk_gen_matrix_serial`	✅	3s	3s	+0%
`mlk_keccakf1600_extract_bytes`	✅	3s	3s	+0%
`mlk_keccakf1600_xor_bytes (big endian)`	✅	3s	2s	+50%
`mlk_keccakf1600x4_extract_bytes_c`	✅	3s	1s	+200%
`mlk_poly_cbd_eta1`	✅	3s	2s	+50%
`mlk_poly_cbd_eta2`	✅	3s	3s	+0%
`mlk_poly_compress_d4`	✅	3s	2s	+50%
`mlk_poly_compress_d5_native`	✅	3s	3s	+0%
`mlk_poly_decompress_d11_native`	✅	3s	3s	+0%
`mlk_poly_decompress_d5_c`	✅	3s	3s	+0%
`mlk_poly_decompress_d5_native`	✅	3s	3s	+0%
`mlk_poly_decompress_dv`	✅	3s	4s	-25%
`mlk_poly_mulcache_compute`	✅	3s	3s	+0%
`mlk_poly_mulcache_compute_native`	✅	3s	1s	+200%
`mlk_poly_tomont`	✅	3s	2s	+50%
`mlk_poly_tomont_c`	✅	3s	2s	+50%
`mlk_poly_tomsg`	✅	3s	3s	+0%
`mlk_polyvec_compress_du`	✅	3s	2s	+50%
`mlk_polyvec_tobytes`	✅	3s	3s	+0%
`mlk_scalar_compress_d4`	✅	3s	2s	+50%
`mlk_sha3_256`	✅	3s	2s	+50%
`mlk_sha3_512`	✅	3s	3s	+0%
`mlk_shake128_absorb_once`	✅	3s	1s	+200%
`mlk_shake128x4_absorb_once`	✅	3s	4s	-25%
`mlk_shake256`	✅	3s	2s	+50%
`ntt_native_x86_64`	✅	3s	2s	+50%
`poly_decompress_d10_native_x86_64`	✅	3s	6s	-50%
`poly_getnoise_eta1122_4x_native`	✅	3s	2s	+50%
`poly_invntt_tomont_native`	✅	3s	4s	-25%
`poly_reduce_native_x86_64`	✅	3s	1s	+200%
`poly_tobytes_native_x86_64`	✅	3s	2s	+50%
`polyvec_basemul_acc_montgomery_cached_k2_native_x86_64`	✅	3s	4s	-25%
`polyvec_basemul_acc_montgomery_cached_k4_native_aarch64`	✅	3s	4s	-25%
`rej_uniform_native`	✅	3s	3s	+0%
`intt_native_aarch64`	✅	2s	1s	+100%
`intt_native_x86_64`	✅	2s	2s	+0%
`keccak_f1600_x4_native_aarch64_v8a_scalar_hybrid`	✅	2s	2s	+0%
`keccak_f1600_x4_native_aarch64_v8a_v84a_scalar_hybrid`	✅	2s	3s	-33%
`keccak_f1600_x4_native_avx2`	✅	2s	1s	+100%
`keccakf1600x4_extract_bytes_native`	✅	2s	2s	+0%
`keccakf1600x4_xor_bytes_native`	✅	2s	4s	-50%
`kem_check_sk`	✅	2s	3s	-33%
`kem_enc`	✅	2s	1s	+100%
`mlk_barrett_reduce`	✅	2s	1s	+100%
`mlk_ct_get_optblocker_i32`	✅	2s	2s	+0%
`mlk_ct_get_optblocker_u32`	✅	2s	2s	+0%
`mlk_ct_get_optblocker_u8`	✅	2s	1s	+100%
`mlk_ct_memcmp`	✅	2s	6s	-67%
`mlk_enc_getnoise_eta1_eta2`	✅	2s	2s	+0%
`mlk_gen_matrix`	✅	2s	3s	-33%
`mlk_keccakf1600_extract_bytes (big endian)`	✅	2s	1s	+100%
`mlk_keccakf1600x4_extract_bytes`	✅	2s	2s	+0%
`mlk_keccakf1600x4_permute`	✅	2s	1s	+100%
`mlk_poly_compress_d10`	✅	2s	3s	-33%
`mlk_poly_compress_d10_native`	✅	2s	3s	-33%
`mlk_poly_compress_d11`	✅	2s	2s	+0%
`mlk_poly_compress_d4_c`	✅	2s	2s	+0%
`mlk_poly_compress_d5`	✅	2s	4s	-50%
`mlk_poly_compress_d5_c`	✅	2s	3s	-33%
`mlk_poly_compress_du`	✅	2s	1s	+100%
`mlk_poly_decompress_d10`	✅	2s	3s	-33%
`mlk_poly_decompress_d10_c`	✅	2s	2s	+0%
`mlk_poly_decompress_d11_c`	✅	2s	1s	+100%
`mlk_poly_getnoise_eta1_4x`	✅	2s	4s	-50%
`mlk_poly_invntt_tomont`	✅	2s	5s	-60%
`mlk_poly_reduce`	✅	2s	3s	-33%
`mlk_poly_reduce_c`	✅	2s	2s	+0%
`mlk_poly_tobytes`	✅	2s	4s	-50%
`mlk_poly_tobytes_c`	✅	2s	2s	+0%
`mlk_poly_tobytes_native`	✅	2s	2s	+0%
`mlk_polymat_permute_bitrev_to_custom`	✅	2s	3s	-33%
`mlk_polyvec_basemul_acc_montgomery_cached`	✅	2s	4s	-50%
`mlk_polyvec_decompress_du`	✅	2s	3s	-33%
`mlk_polyvec_mulcache_compute`	✅	2s	2s	+0%
`mlk_polyvec_permute_bitrev_to_custom_native`	✅	2s	3s	-33%
`mlk_rej_uniform`	✅	2s	1s	+100%
`mlk_scalar_compress_d10`	✅	2s	2s	+0%
`mlk_scalar_compress_d11`	✅	2s	2s	+0%
`mlk_scalar_decompress_d10`	✅	2s	3s	-33%
`mlk_scalar_decompress_d11`	✅	2s	3s	-33%
`mlk_scalar_decompress_d4`	✅	2s	3s	-33%
`mlk_scalar_signed_to_unsigned_q`	✅	2s	2s	+0%
`mlk_shake128_squeezeblocks`	✅	2s	2s	+0%
`mlk_shake128x4_squeezeblocks`	✅	2s	3s	-33%
`mlk_value_barrier_i32`	✅	2s	2s	+0%
`mlk_value_barrier_u32`	✅	2s	1s	+100%
`mlk_value_barrier_u8`	✅	2s	3s	-33%
`nttunpack_native_x86_64`	✅	2s	3s	-33%
`poly_compress_d4_native_x86_64`	✅	2s	3s	-33%
`poly_compress_d5_native_x86_64`	✅	2s	3s	-33%
`poly_decompress_d11_native_x86_64`	✅	2s	2s	+0%
`poly_decompress_d5_native_x86_64`	✅	2s	1s	+100%
`poly_mulcache_compute_native_x86_64`	✅	2s	2s	+0%
`poly_reduce_native_aarch64`	✅	2s	2s	+0%
`poly_tomont_native_aarch64`	✅	2s	4s	-50%
`poly_tomont_native_x86_64`	✅	2s	2s	+0%
`polyvec_basemul_acc_montgomery_cached_k2_native_aarch64`	✅	2s	3s	-33%
`polyvec_basemul_acc_montgomery_cached_k3_native_aarch64`	✅	2s	3s	-33%
`polyvec_basemul_acc_montgomery_cached_k3_native_x86_64`	✅	2s	2s	+0%
`polyvec_basemul_acc_montgomery_cached_k4_native_x86_64`	✅	2s	5s	-60%
`keccak_f1600_x1_native_aarch64`	✅	1s	2s	-50%
`kem_enc_derand`	✅	1s	2s	-50%
`kem_keypair`	✅	1s	1s	+0%
`mlk_ct_cmask_neg_i16`	✅	1s	1s	+0%
`mlk_ct_sel_int16`	✅	1s	1s	+0%
`mlk_ct_sel_uint8`	✅	1s	2s	-50%
`mlk_keccakf1600_permute`	✅	1s	2s	-50%
`mlk_keccakf1600_xor_bytes`	✅	1s	2s	-50%
`mlk_keccakf1600x4_xor_bytes`	✅	1s	2s	-50%
`mlk_keccakf1600x4_xor_bytes_c`	✅	1s	1s	+0%
`mlk_poly_compress_d11_c`	✅	1s	2s	-50%
`mlk_poly_compress_d11_native`	✅	1s	3s	-67%
`mlk_poly_compress_d4_native`	✅	1s	2s	-50%
`mlk_poly_decompress_d11`	✅	1s	2s	-50%
`mlk_poly_decompress_d4`	✅	1s	1s	+0%
`mlk_poly_decompress_d5`	✅	1s	2s	-50%
`mlk_poly_decompress_du`	✅	1s	3s	-67%
`mlk_poly_frombytes`	✅	1s	3s	-67%
`mlk_poly_getnoise_eta1122_4x`	✅	1s	4s	-75%
`mlk_poly_getnoise_eta2`	✅	1s	2s	-50%
`mlk_poly_mulcache_compute_c`	✅	1s	3s	-67%
`mlk_poly_tomont_native`	✅	1s	1s	+0%
`mlk_polyvec_permute_bitrev_to_custom`	✅	1s	3s	-67%
`mlk_polyvec_reduce`	✅	1s	4s	-75%
`mlk_scalar_compress_d1`	✅	1s	2s	-50%
`mlk_scalar_compress_d5`	✅	1s	3s	-67%
`poly_compress_d11_native_x86_64`	✅	1s	2s	-50%
`poly_mulcache_compute_native_aarch64`	✅	1s	1s	+0%

oqs-bot · 2026-06-29T18:45:44Z

CBMC Results (ML-KEM-1024)

Full Results (191 proofs)

Proof	Status	Current	Previous	Change
`TOTAL`	✅	1686s	1875s	-10.1%
`mlk_indcpa_enc`	✅	361s	402s	-10%
`mlk_indcpa_keypair_derand`	✅	164s	177s	-7%
`mlk_poly_rej_uniform`	✅	134s	170s	-21%
`mlk_rej_uniform_c`	✅	122s	147s	-17%
`mlk_polyvec_basemul_acc_montgomery_cached_c`	✅	72s	78s	-8%
`rej_uniform_native_x86_64`	✅	57s	63s	-10%
`rej_uniform_native_aarch64`	✅	35s	42s	-17%
`mlk_poly_reduce_native`	✅	34s	42s	-19%
`poly_ntt_native`	✅	34s	45s	-24%
`mlk_ntt_layer`	✅	30s	35s	-14%
`polyvec_basemul_acc_montgomery_cached_native`	✅	26s	28s	-7%
`mlk_keccak_squeezeblocks_x4`	✅	24s	29s	-17%
`mlk_fqmul`	✅	18s	16s	+12%
`keccakf1600x4_permute_native_x4`	✅	17s	18s	-6%
`mlk_polyvec_add`	✅	17s	19s	-11%
`mlk_poly_decompress_d11_native`	✅	13s	16s	-19%
`mlk_poly_decompress_d5_native`	✅	12s	18s	-33%
`mlk_indcpa_dec`	✅	11s	14s	-21%
`mlk_keccak_squeezeblocks`	✅	9s	9s	+0%
`mlk_poly_frombytes_native`	✅	9s	9s	+0%
`mlk_poly_frommsg`	✅	9s	12s	-25%
`mlk_poly_sub`	✅	9s	6s	+50%
`mlk_polyvec_ntt`	✅	9s	10s	-10%
`poly_frombytes_native_x86_64`	✅	9s	5s	+80%
`mlk_ntt_butterfly_block`	✅	8s	8s	+0%
`mlk_keccak_squeeze_once`	✅	7s	8s	-12%
`mlk_keccak_absorb_once_x4`	✅	6s	8s	-25%
`mlk_keccakf1600_permute_c`	✅	6s	5s	+20%
`mlk_poly_add`	✅	6s	5s	+20%
`mlk_poly_rej_uniform_x4`	✅	6s	6s	+0%
`poly_decompress_d11_native_x86_64`	✅	6s	5s	+20%
`keccak_f1600_x4_native_aarch64_v84a`	✅	5s	4s	+25%
`kem_check_pk`	✅	5s	3s	+67%
`kem_dec`	✅	5s	3s	+67%
`mlk_keccakf1600x4_extract_bytes_c`	✅	5s	3s	+67%
`mlk_poly_frombytes_c`	✅	5s	6s	-17%
`mlk_poly_ntt`	✅	5s	9s	-44%
`ntt_native_aarch64`	✅	5s	3s	+67%
`polyvec_basemul_acc_montgomery_cached_k2_native_aarch64`	✅	5s	2s	+150%
`sys_check_capability`	✅	5s	5s	+0%
`kem_check_sk`	✅	4s	3s	+33%
`mlk_ct_cmask_neg_i16`	✅	4s	2s	+100%
`mlk_gen_matrix`	✅	4s	6s	-33%
`mlk_gen_matrix_serial`	✅	4s	4s	+0%
`mlk_keccak_absorb_once`	✅	4s	2s	+100%
`mlk_keccakf1600_extract_bytes (big endian)`	✅	4s	2s	+100%
`mlk_poly_cbd_eta1`	✅	4s	3s	+33%
`mlk_poly_compress_d11_c`	✅	4s	1s	+300%
`mlk_poly_decompress_d11_c`	✅	4s	3s	+33%
`mlk_poly_decompress_d5`	✅	4s	2s	+100%
`mlk_poly_decompress_du`	✅	4s	5s	-20%
`mlk_poly_invntt_tomont`	✅	4s	1s	+300%
`mlk_poly_invntt_tomont_c`	✅	4s	2s	+100%
`mlk_scalar_compress_d1`	✅	4s	1s	+300%
`mlk_scalar_compress_d11`	✅	4s	1s	+300%
`poly_compress_d5_native_x86_64`	✅	4s	2s	+100%
`poly_decompress_d5_native_x86_64`	✅	4s	3s	+33%
`poly_reduce_native_x86_64`	✅	4s	2s	+100%
`intt_native_aarch64`	✅	3s	3s	+0%
`intt_native_x86_64`	✅	3s	2s	+50%
`keccakf1600_permute_native`	✅	3s	2s	+50%
`keccakf1600x4_xor_bytes_native`	✅	3s	4s	-25%
`kem_enc_derand`	✅	3s	3s	+0%
`kem_keypair`	✅	3s	5s	-40%
`mlk_ct_cmask_nonzero_u8`	✅	3s	4s	-25%
`mlk_ct_cmov_zero`	✅	3s	3s	+0%
`mlk_ct_get_optblocker_i32`	✅	3s	3s	+0%
`mlk_enc_getnoise_eta1_eta2`	✅	3s	4s	-25%
`mlk_invntt_layer`	✅	3s	5s	-40%
`mlk_keccakf1600_permute`	✅	3s	2s	+50%
`mlk_keccakf1600_xor_bytes`	✅	3s	3s	+0%
`mlk_keccakf1600_xor_bytes (big endian)`	✅	3s	3s	+0%
`mlk_keccakf1600x4_permute`	✅	3s	3s	+0%
`mlk_keccakf1600x4_xor_bytes_c`	✅	3s	3s	+0%
`mlk_matvec_mul`	✅	3s	3s	+0%
`mlk_poly_compress_d10_c`	✅	3s	2s	+50%
`mlk_poly_compress_d10_native`	✅	3s	2s	+50%
`mlk_poly_compress_d4_c`	✅	3s	2s	+50%
`mlk_poly_compress_d5_c`	✅	3s	2s	+50%
`mlk_poly_decompress_d10_c`	✅	3s	1s	+200%
`mlk_poly_frombytes`	✅	3s	1s	+200%
`mlk_poly_getnoise_eta1122_4x`	✅	3s	3s	+0%
`mlk_poly_getnoise_eta1_4x_native`	✅	3s	5s	-40%
`mlk_poly_mulcache_compute`	✅	3s	2s	+50%
`mlk_poly_mulcache_compute_native`	✅	3s	2s	+50%
`mlk_poly_reduce_c`	✅	3s	1s	+200%
`mlk_poly_tobytes_native`	✅	3s	2s	+50%
`mlk_poly_tomont`	✅	3s	3s	+0%
`mlk_poly_tomsg`	✅	3s	4s	-25%
`mlk_polymat_permute_bitrev_to_custom`	✅	3s	4s	-25%
`mlk_polyvec_frombytes`	✅	3s	3s	+0%
`mlk_polyvec_tobytes`	✅	3s	4s	-25%
`mlk_polyvec_tomont`	✅	3s	1s	+200%
`mlk_scalar_compress_d4`	✅	3s	1s	+200%
`mlk_scalar_compress_d5`	✅	3s	2s	+50%
`mlk_shake256`	✅	3s	4s	-25%
`mlk_shake256x4`	✅	3s	3s	+0%
`mlk_value_barrier_u32`	✅	3s	1s	+200%
`mlk_value_barrier_u8`	✅	3s	1s	+200%
`poly_decompress_d10_native_x86_64`	✅	3s	3s	+0%
`poly_decompress_d4_native_x86_64`	✅	3s	2s	+50%
`poly_getnoise_eta1122_4x_native`	✅	3s	2s	+50%
`poly_invntt_tomont_native`	✅	3s	1s	+200%
`poly_tobytes_native_x86_64`	✅	3s	1s	+200%
`polyvec_basemul_acc_montgomery_cached_k2_native_x86_64`	✅	3s	4s	-25%
`polyvec_basemul_acc_montgomery_cached_k3_native_aarch64`	✅	3s	4s	-25%
`polyvec_basemul_acc_montgomery_cached_k3_native_x86_64`	✅	3s	2s	+50%
`polyvec_basemul_acc_montgomery_cached_k4_native_x86_64`	✅	3s	1s	+200%
`keccak_f1600_x1_native_aarch64_v84a`	✅	2s	2s	+0%
`keccak_f1600_x4_native_aarch64_v8a_scalar_hybrid`	✅	2s	1s	+100%
`keccak_f1600_x4_native_aarch64_v8a_v84a_scalar_hybrid`	✅	2s	3s	-33%
`keccakf1600x4_extract_bytes_native`	✅	2s	1s	+100%
`kem_keypair_derand`	✅	2s	3s	-33%
`mlk_barrett_reduce`	✅	2s	3s	-33%
`mlk_check_pct`	✅	2s	2s	+0%
`mlk_ct_cmask_nonzero_u16`	✅	2s	3s	-33%
`mlk_ct_get_optblocker_u32`	✅	2s	1s	+100%
`mlk_ct_sel_int16`	✅	2s	3s	-33%
`mlk_keccakf1600x4_xor_bytes`	✅	2s	2s	+0%
`mlk_keypair_getnoise_eta1`	✅	2s	2s	+0%
`mlk_poly_cbd_eta2`	✅	2s	2s	+0%
`mlk_poly_compress_d10`	✅	2s	2s	+0%
`mlk_poly_compress_d11`	✅	2s	5s	-60%
`mlk_poly_compress_d11_native`	✅	2s	2s	+0%
`mlk_poly_compress_d4`	✅	2s	1s	+100%
`mlk_poly_compress_d4_native`	✅	2s	2s	+0%
`mlk_poly_compress_d5`	✅	2s	1s	+100%
`mlk_poly_compress_du`	✅	2s	1s	+100%
`mlk_poly_decompress_d10`	✅	2s	2s	+0%
`mlk_poly_decompress_d10_native`	✅	2s	2s	+0%
`mlk_poly_decompress_d4_c`	✅	2s	3s	-33%
`mlk_poly_decompress_d5_c`	✅	2s	3s	-33%
`mlk_poly_decompress_dv`	✅	2s	1s	+100%
`mlk_poly_getnoise_eta1_4x`	✅	2s	3s	-33%
`mlk_poly_getnoise_eta2`	✅	2s	3s	-33%
`mlk_poly_mulcache_compute_c`	✅	2s	4s	-50%
`mlk_poly_tobytes`	✅	2s	2s	+0%
`mlk_poly_tobytes_c`	✅	2s	2s	+0%
`mlk_polyvec_basemul_acc_montgomery_cached`	✅	2s	2s	+0%
`mlk_polyvec_compress_du`	✅	2s	3s	-33%
`mlk_polyvec_decompress_du`	✅	2s	3s	-33%
`mlk_polyvec_mulcache_compute`	✅	2s	1s	+100%
`mlk_polyvec_permute_bitrev_to_custom_native`	✅	2s	3s	-33%
`mlk_polyvec_reduce`	✅	2s	4s	-50%
`mlk_scalar_decompress_d11`	✅	2s	2s	+0%
`mlk_scalar_decompress_d4`	✅	2s	3s	-33%
`mlk_scalar_decompress_d5`	✅	2s	3s	-33%
`mlk_sha3_256`	✅	2s	7s	-71%
`mlk_sha3_512`	✅	2s	5s	-60%
`mlk_shake128_absorb_once`	✅	2s	2s	+0%
`mlk_shake128_squeezeblocks`	✅	2s	5s	-60%
`mlk_shake128x4_absorb_once`	✅	2s	3s	-33%
`mlk_shake128x4_squeezeblocks`	✅	2s	2s	+0%
`mlk_value_barrier_i32`	✅	2s	1s	+100%
`ntt_native_x86_64`	✅	2s	2s	+0%
`nttunpack_native_x86_64`	✅	2s	3s	-33%
`poly_compress_d10_native_x86_64`	✅	2s	3s	-33%
`poly_compress_d11_native_x86_64`	✅	2s	2s	+0%
`poly_compress_d4_native_x86_64`	✅	2s	3s	-33%
`poly_mulcache_compute_native_aarch64`	✅	2s	3s	-33%
`poly_mulcache_compute_native_x86_64`	✅	2s	2s	+0%
`poly_reduce_native_aarch64`	✅	2s	5s	-60%
`poly_tomont_native_x86_64`	✅	2s	2s	+0%
`polyvec_basemul_acc_montgomery_cached_k4_native_aarch64`	✅	2s	2s	+0%
`keccak_f1600_x1_native_aarch64`	✅	1s	1s	+0%
`keccak_f1600_x4_native_avx2`	✅	1s	4s	-75%
`kem_enc`	✅	1s	3s	-67%
`mlk_ct_get_optblocker_u8`	✅	1s	3s	-67%
`mlk_ct_memcmp`	✅	1s	6s	-83%
`mlk_ct_sel_uint8`	✅	1s	3s	-67%
`mlk_keccakf1600_extract_bytes`	✅	1s	2s	-50%
`mlk_keccakf1600x4_extract_bytes`	✅	1s	2s	-50%
`mlk_montgomery_reduce`	✅	1s	1s	+0%
`mlk_poly_compress_d5_native`	✅	1s	4s	-75%
`mlk_poly_compress_dv`	✅	1s	2s	-50%
`mlk_poly_decompress_d11`	✅	1s	2s	-50%
`mlk_poly_decompress_d4`	✅	1s	2s	-50%
`mlk_poly_decompress_d4_native`	✅	1s	5s	-80%
`mlk_poly_ntt_c`	✅	1s	2s	-50%
`mlk_poly_reduce`	✅	1s	1s	+0%
`mlk_poly_tomont_c`	✅	1s	2s	-50%
`mlk_poly_tomont_native`	✅	1s	2s	-50%
`mlk_polyvec_invntt_tomont`	✅	1s	2s	-50%
`mlk_polyvec_permute_bitrev_to_custom`	✅	1s	2s	-50%
`mlk_rej_uniform`	✅	1s	2s	-50%
`mlk_scalar_compress_d10`	✅	1s	1s	+0%
`mlk_scalar_decompress_d10`	✅	1s	1s	+0%
`mlk_scalar_signed_to_unsigned_q`	✅	1s	2s	-50%
`poly_tobytes_native_aarch64`	✅	1s	1s	+0%
`poly_tomont_native_aarch64`	✅	1s	1s	+0%
`rej_uniform_native`	✅	1s	4s	-75%

Zero caller-visible keypair, encapsulation, and decapsulation outputs whenever the public KEM paths return an error. Add regression test coverage for RNG failure, invalid key validation, and allocation-failure cleanup so stale caller buffers cannot be mistaken for successful outputs. Verification: - pre-fix targeted tests reproduced uncleared output on RNG and invalid-key paths - make run_rng_fail - make run_func - make run_alloc Co-authored-by: Codex <codex@openai.com> Signed-off-by: Joe Doyle <joseph.doyle@trailofbits.com>

oqs-bot

Mac Mini (M1, 2020) benchmarks

Details

Benchmark suite	Current: `e53c19c`	Previous: `0922724`	Ratio
`ML-KEM-512 keypair`	`12315` cycles	`12317` cycles	`1.00`
`ML-KEM-512 encaps`	`14759` cycles	`14761` cycles	`1.00`
`ML-KEM-512 decaps`	`19313` cycles	`19316` cycles	`1.00`
`ML-KEM-768 keypair`	`21266` cycles	`21262` cycles	`1.00`
`ML-KEM-768 encaps`	`23485` cycles	`23509` cycles	`1.00`
`ML-KEM-768 decaps`	`30033` cycles	`30053` cycles	`1.00`
`ML-KEM-1024 keypair`	`30319` cycles	`30315` cycles	`1.00`
`ML-KEM-1024 encaps`	`34084` cycles	`34082` cycles	`1.00`
`ML-KEM-1024 decaps`	`43701` cycles	`43695` cycles	`1.00`

This comment was automatically generated by workflow using github-action-benchmark.

oqs-bot

Intel Xeon 4th gen (c7i)

Details

Benchmark suite	Current: `e53c19c`	Previous: `0922724`	Ratio
`ML-KEM-512 keypair`	`11782` cycles	`11782` cycles	`1`
`ML-KEM-512 encaps`	`13076` cycles	`13074` cycles	`1.00`
`ML-KEM-512 decaps`	`17026` cycles	`17046` cycles	`1.00`
`ML-KEM-768 keypair`	`19420` cycles	`19384` cycles	`1.00`
`ML-KEM-768 encaps`	`20591` cycles	`20603` cycles	`1.00`
`ML-KEM-768 decaps`	`26286` cycles	`26347` cycles	`1.00`
`ML-KEM-1024 keypair`	`28106` cycles	`28160` cycles	`1.00`
`ML-KEM-1024 encaps`	`30453` cycles	`30391` cycles	`1.00`
`ML-KEM-1024 decaps`	`37662` cycles	`37658` cycles	`1.00`

This comment was automatically generated by workflow using github-action-benchmark.

oqs-bot

ppc64le (POWER10) benchmarks

Details

Benchmark suite	Current: `e53c19c`	Previous: `0922724`	Ratio
`ML-KEM-512 keypair`	`38203` cycles	`38902` cycles	`0.98`
`ML-KEM-512 encaps`	`43831` cycles	`44922` cycles	`0.98`
`ML-KEM-512 decaps`	`54353` cycles	`55002` cycles	`0.99`
`ML-KEM-768 keypair`	`69387` cycles	`68715` cycles	`1.01`
`ML-KEM-768 encaps`	`78019` cycles	`77989` cycles	`1.00`
`ML-KEM-768 decaps`	`92879` cycles	`92587` cycles	`1.00`
`ML-KEM-1024 keypair`	`107859` cycles	`109182` cycles	`0.99`
`ML-KEM-1024 encaps`	`118317` cycles	`120044` cycles	`0.99`
`ML-KEM-1024 decaps`	`137296` cycles	`138458` cycles	`0.99`

This comment was automatically generated by workflow using github-action-benchmark.

oqs-bot

AMD EPYC 4th gen (c7a)

Details

Benchmark suite	Current: `e53c19c`	Previous: `0922724`	Ratio
`ML-KEM-512 keypair`	`12782` cycles	`12800` cycles	`1.00`
`ML-KEM-512 encaps`	`14216` cycles	`14238` cycles	`1.00`
`ML-KEM-512 decaps`	`18992` cycles	`18990` cycles	`1.00`
`ML-KEM-768 keypair`	`21546` cycles	`21562` cycles	`1.00`
`ML-KEM-768 encaps`	`22717` cycles	`22734` cycles	`1.00`
`ML-KEM-768 decaps`	`29679` cycles	`29801` cycles	`1.00`
`ML-KEM-1024 keypair`	`30609` cycles	`30521` cycles	`1.00`
`ML-KEM-1024 encaps`	`32592` cycles	`32789` cycles	`0.99`
`ML-KEM-1024 decaps`	`41852` cycles	`41969` cycles	`1.00`

This comment was automatically generated by workflow using github-action-benchmark.

oqs-bot

AMD EPYC 3rd gen (c6a)

Details

Benchmark suite	Current: `e53c19c`	Previous: `0922724`	Ratio
`ML-KEM-512 keypair`	`14454` cycles	`14447` cycles	`1.00`
`ML-KEM-512 encaps`	`15940` cycles	`15938` cycles	`1.00`
`ML-KEM-512 decaps`	`21336` cycles	`21342` cycles	`1.00`
`ML-KEM-768 keypair`	`23785` cycles	`23776` cycles	`1.00`
`ML-KEM-768 encaps`	`25205` cycles	`25221` cycles	`1.00`
`ML-KEM-768 decaps`	`32955` cycles	`32971` cycles	`1.00`
`ML-KEM-1024 keypair`	`33333` cycles	`33389` cycles	`1.00`
`ML-KEM-1024 encaps`	`35852` cycles	`35885` cycles	`1.00`
`ML-KEM-1024 decaps`	`46153` cycles	`46154` cycles	`1.00`

This comment was automatically generated by workflow using github-action-benchmark.

oqs-bot

Graviton5

Details

Benchmark suite	Current: `e53c19c`	Previous: `0922724`	Ratio
`ML-KEM-512 keypair`	`13466` cycles	`13450` cycles	`1.00`
`ML-KEM-512 encaps`	`15783` cycles	`15780` cycles	`1.00`
`ML-KEM-512 decaps`	`21307` cycles	`21311` cycles	`1.00`
`ML-KEM-768 keypair`	`22907` cycles	`22906` cycles	`1.00`
`ML-KEM-768 encaps`	`25221` cycles	`25223` cycles	`1.00`
`ML-KEM-768 decaps`	`33163` cycles	`33170` cycles	`1.00`
`ML-KEM-1024 keypair`	`33229` cycles	`33229` cycles	`1`
`ML-KEM-1024 encaps`	`37051` cycles	`37040` cycles	`1.00`
`ML-KEM-1024 decaps`	`47069` cycles	`47101` cycles	`1.00`

This comment was automatically generated by workflow using github-action-benchmark.

oqs-bot

Graviton4

Details

Benchmark suite	Current: `e53c19c`	Previous: `0922724`	Ratio
`ML-KEM-512 keypair`	`17696` cycles	`17689` cycles	`1.00`
`ML-KEM-512 encaps`	`20601` cycles	`20598` cycles	`1.00`
`ML-KEM-512 decaps`	`27034` cycles	`27018` cycles	`1.00`
`ML-KEM-768 keypair`	`29903` cycles	`29895` cycles	`1.00`
`ML-KEM-768 encaps`	`32636` cycles	`32637` cycles	`1.00`
`ML-KEM-768 decaps`	`41905` cycles	`41918` cycles	`1.00`
`ML-KEM-1024 keypair`	`43710` cycles	`43721` cycles	`1.00`
`ML-KEM-1024 encaps`	`48694` cycles	`48676` cycles	`1.00`
`ML-KEM-1024 decaps`	`61312` cycles	`61385` cycles	`1.00`

This comment was automatically generated by workflow using github-action-benchmark.

oqs-bot

Intel Xeon 4th gen (c7i) (no-opt)

Details

Benchmark suite	Current: `e53c19c`	Previous: `0922724`	Ratio
`ML-KEM-512 keypair`	`27601` cycles	`27625` cycles	`1.00`
`ML-KEM-512 encaps`	`35423` cycles	`35524` cycles	`1.00`
`ML-KEM-512 decaps`	`44495` cycles	`44177` cycles	`1.01`
`ML-KEM-768 keypair`	`44178` cycles	`44179` cycles	`1.00`
`ML-KEM-768 encaps`	`55105` cycles	`55063` cycles	`1.00`
`ML-KEM-768 decaps`	`68162` cycles	`68157` cycles	`1.00`
`ML-KEM-1024 keypair`	`67834` cycles	`67908` cycles	`1.00`
`ML-KEM-1024 encaps`	`79046` cycles	`78978` cycles	`1.00`
`ML-KEM-1024 decaps`	`96269` cycles	`96169` cycles	`1.00`

This comment was automatically generated by workflow using github-action-benchmark.

oqs-bot

Arm Cortex-A76 (Raspberry Pi 5) benchmarks

Details

Benchmark suite	Current: `e53c19c`	Previous: `0922724`	Ratio
`ML-KEM-512 keypair`	`28235` cycles	`28241` cycles	`1.00`
`ML-KEM-512 encaps`	`34126` cycles	`34125` cycles	`1.00`
`ML-KEM-512 decaps`	`44484` cycles	`44474` cycles	`1.00`
`ML-KEM-768 keypair`	`47614` cycles	`47612` cycles	`1.00`
`ML-KEM-768 encaps`	`53856` cycles	`53863` cycles	`1.00`
`ML-KEM-768 decaps`	`68527` cycles	`68519` cycles	`1.00`
`ML-KEM-1024 keypair`	`70225` cycles	`70247` cycles	`1.00`
`ML-KEM-1024 encaps`	`78537` cycles	`78707` cycles	`1.00`
`ML-KEM-1024 decaps`	`98340` cycles	`98275` cycles	`1.00`

This comment was automatically generated by workflow using github-action-benchmark.

oqs-bot

Intel Xeon 3rd gen (c6i)

Details

Benchmark suite	Current: `e53c19c`	Previous: `0922724`	Ratio
`ML-KEM-512 keypair`	`17925` cycles	`17845` cycles	`1.00`
`ML-KEM-512 encaps`	`20043` cycles	`20030` cycles	`1.00`
`ML-KEM-512 decaps`	`26727` cycles	`26634` cycles	`1.00`
`ML-KEM-768 keypair`	`29981` cycles	`29953` cycles	`1.00`
`ML-KEM-768 encaps`	`31775` cycles	`32797` cycles	`0.97`
`ML-KEM-768 decaps`	`41376` cycles	`41404` cycles	`1.00`
`ML-KEM-1024 keypair`	`42124` cycles	`41901` cycles	`1.01`
`ML-KEM-1024 encaps`	`45159` cycles	`45156` cycles	`1.00`
`ML-KEM-1024 decaps`	`58014` cycles	`57962` cycles	`1.00`

This comment was automatically generated by workflow using github-action-benchmark.

oqs-bot

Graviton5 (no-opt)

Details

Benchmark suite	Current: `e53c19c`	Previous: `0922724`	Ratio
`ML-KEM-512 keypair`	`27456` cycles	`27482` cycles	`1.00`
`ML-KEM-512 encaps`	`31607` cycles	`31685` cycles	`1.00`
`ML-KEM-512 decaps`	`40586` cycles	`40494` cycles	`1.00`
`ML-KEM-768 keypair`	`44421` cycles	`44189` cycles	`1.01`
`ML-KEM-768 encaps`	`50600` cycles	`50702` cycles	`1.00`
`ML-KEM-768 decaps`	`62271` cycles	`62155` cycles	`1.00`
`ML-KEM-1024 keypair`	`67961` cycles	`67980` cycles	`1.00`
`ML-KEM-1024 encaps`	`76107` cycles	`76068` cycles	`1.00`
`ML-KEM-1024 decaps`	`90835` cycles	`90823` cycles	`1.00`

This comment was automatically generated by workflow using github-action-benchmark.

oqs-bot

AMD EPYC 4th gen (c7a) (no-opt)

Details

Benchmark suite	Current: `e53c19c`	Previous: `0922724`	Ratio
`ML-KEM-512 keypair`	`36785` cycles	`36813` cycles	`1.00`
`ML-KEM-512 encaps`	`42808` cycles	`42853` cycles	`1.00`
`ML-KEM-512 decaps`	`55581` cycles	`55615` cycles	`1.00`
`ML-KEM-768 keypair`	`58007` cycles	`58061` cycles	`1.00`
`ML-KEM-768 encaps`	`66888` cycles	`66948` cycles	`1.00`
`ML-KEM-768 decaps`	`83583` cycles	`83605` cycles	`1.00`
`ML-KEM-1024 keypair`	`88626` cycles	`88614` cycles	`1.00`
`ML-KEM-1024 encaps`	`99129` cycles	`99080` cycles	`1.00`
`ML-KEM-1024 decaps`	`120532` cycles	`120589` cycles	`1.00`

This comment was automatically generated by workflow using github-action-benchmark.

oqs-bot

AMD EPYC 3rd gen (c6a) (no-opt)

Details

Benchmark suite	Current: `e53c19c`	Previous: `0922724`	Ratio
`ML-KEM-512 keypair`	`40275` cycles	`40223` cycles	`1.00`
`ML-KEM-512 encaps`	`48397` cycles	`48357` cycles	`1.00`
`ML-KEM-512 decaps`	`62176` cycles	`62181` cycles	`1.00`
`ML-KEM-768 keypair`	`62593` cycles	`62612` cycles	`1.00`
`ML-KEM-768 encaps`	`74811` cycles	`74816` cycles	`1.00`
`ML-KEM-768 decaps`	`92698` cycles	`92404` cycles	`1.00`
`ML-KEM-1024 keypair`	`94947` cycles	`95043` cycles	`1.00`
`ML-KEM-1024 encaps`	`109993` cycles	`109922` cycles	`1.00`
`ML-KEM-1024 decaps`	`132395` cycles	`132339` cycles	`1.00`

This comment was automatically generated by workflow using github-action-benchmark.

oqs-bot

Graviton4 (no-opt)

Details

Benchmark suite	Current: `e53c19c`	Previous: `0922724`	Ratio
`ML-KEM-512 keypair`	`35222` cycles	`35282` cycles	`1.00`
`ML-KEM-512 encaps`	`39972` cycles	`40021` cycles	`1.00`
`ML-KEM-512 decaps`	`50657` cycles	`50625` cycles	`1.00`
`ML-KEM-768 keypair`	`56402` cycles	`56807` cycles	`0.99`
`ML-KEM-768 encaps`	`63947` cycles	`64051` cycles	`1.00`
`ML-KEM-768 decaps`	`78552` cycles	`78497` cycles	`1.00`
`ML-KEM-1024 keypair`	`87333` cycles	`87382` cycles	`1.00`
`ML-KEM-1024 encaps`	`96690` cycles	`96680` cycles	`1.00`
`ML-KEM-1024 decaps`	`114724` cycles	`114713` cycles	`1.00`

This comment was automatically generated by workflow using github-action-benchmark.

oqs-bot

Graviton2

Details

Benchmark suite	Current: `e53c19c`	Previous: `0922724`	Ratio
`ML-KEM-512 keypair`	`28262` cycles	`28236` cycles	`1.00`
`ML-KEM-512 encaps`	`34137` cycles	`34121` cycles	`1.00`
`ML-KEM-512 decaps`	`44497` cycles	`44478` cycles	`1.00`
`ML-KEM-768 keypair`	`47617` cycles	`47613` cycles	`1.00`
`ML-KEM-768 encaps`	`53863` cycles	`53871` cycles	`1.00`
`ML-KEM-768 decaps`	`68546` cycles	`68553` cycles	`1.00`
`ML-KEM-1024 keypair`	`70274` cycles	`70255` cycles	`1.00`
`ML-KEM-1024 encaps`	`78561` cycles	`78635` cycles	`1.00`
`ML-KEM-1024 decaps`	`98427` cycles	`98286` cycles	`1.00`

This comment was automatically generated by workflow using github-action-benchmark.

oqs-bot

Graviton3

Details

Benchmark suite	Current: `e53c19c`	Previous: `0922724`	Ratio
`ML-KEM-512 keypair`	`18682` cycles	`18664` cycles	`1.00`
`ML-KEM-512 encaps`	`21858` cycles	`21853` cycles	`1.00`
`ML-KEM-512 decaps`	`28846` cycles	`28830` cycles	`1.00`
`ML-KEM-768 keypair`	`31577` cycles	`31576` cycles	`1.00`
`ML-KEM-768 encaps`	`34684` cycles	`34667` cycles	`1.00`
`ML-KEM-768 decaps`	`44783` cycles	`44804` cycles	`1.00`
`ML-KEM-1024 keypair`	`46139` cycles	`46148` cycles	`1.00`
`ML-KEM-1024 encaps`	`51475` cycles	`51480` cycles	`1.00`
`ML-KEM-1024 decaps`	`65007` cycles	`64973` cycles	`1.00`

This comment was automatically generated by workflow using github-action-benchmark.

oqs-bot

Intel Xeon 3rd gen (c6i) (no-opt)

Details

Benchmark suite	Current: `e53c19c`	Previous: `0922724`	Ratio
`ML-KEM-512 keypair`	`46776` cycles	`46758` cycles	`1.00`
`ML-KEM-512 encaps`	`55581` cycles	`55519` cycles	`1.00`
`ML-KEM-512 decaps`	`71267` cycles	`71169` cycles	`1.00`
`ML-KEM-768 keypair`	`74514` cycles	`74349` cycles	`1.00`
`ML-KEM-768 encaps`	`85921` cycles	`85841` cycles	`1.00`
`ML-KEM-768 decaps`	`107080` cycles	`107017` cycles	`1.00`
`ML-KEM-1024 keypair`	`111418` cycles	`111396` cycles	`1.00`
`ML-KEM-1024 encaps`	`126132` cycles	`126045` cycles	`1.00`
`ML-KEM-1024 decaps`	`152253` cycles	`152018` cycles	`1.00`

This comment was automatically generated by workflow using github-action-benchmark.

oqs-bot

Graviton3 (no-opt)

Details

Benchmark suite	Current: `e53c19c`	Previous: `0922724`	Ratio
`ML-KEM-512 keypair`	`38913` cycles	`38898` cycles	`1.00`
`ML-KEM-512 encaps`	`44395` cycles	`44385` cycles	`1.00`
`ML-KEM-512 decaps`	`56205` cycles	`56204` cycles	`1.00`
`ML-KEM-768 keypair`	`62239` cycles	`62493` cycles	`1.00`
`ML-KEM-768 encaps`	`70434` cycles	`70438` cycles	`1.00`
`ML-KEM-768 decaps`	`86365` cycles	`86367` cycles	`1.00`
`ML-KEM-1024 keypair`	`95824` cycles	`95885` cycles	`1.00`
`ML-KEM-1024 encaps`	`106123` cycles	`106089` cycles	`1.00`
`ML-KEM-1024 decaps`	`125768` cycles	`125741` cycles	`1.00`

This comment was automatically generated by workflow using github-action-benchmark.

oqs-bot

Graviton2 (no-opt)

Details

Benchmark suite	Current: `e53c19c`	Previous: `0922724`	Ratio
`ML-KEM-512 keypair`	`58714` cycles	`58656` cycles	`1.00`
`ML-KEM-512 encaps`	`68580` cycles	`68467` cycles	`1.00`
`ML-KEM-512 decaps`	`87338` cycles	`87424` cycles	`1.00`
`ML-KEM-768 keypair`	`94844` cycles	`94440` cycles	`1.00`
`ML-KEM-768 encaps`	`109215` cycles	`108775` cycles	`1.00`
`ML-KEM-768 decaps`	`133998` cycles	`133747` cycles	`1.00`
`ML-KEM-1024 keypair`	`150849` cycles	`150981` cycles	`1.00`
`ML-KEM-1024 encaps`	`165260` cycles	`165617` cycles	`1.00`
`ML-KEM-1024 decaps`	`198740` cycles	`198909` cycles	`1.00`

This comment was automatically generated by workflow using github-action-benchmark.

oqs-bot

SpacemiT K1 8 (Banana Pi F3) benchmarks

Details

Benchmark suite	Current: `e53c19c`	Previous: `0922724`	Ratio
`ML-KEM-512 keypair`	`143663` cycles	`142990` cycles	`1.00`
`ML-KEM-512 encaps`	`151991` cycles	`151336` cycles	`1.00`
`ML-KEM-512 decaps`	`190580` cycles	`189617` cycles	`1.01`
`ML-KEM-768 keypair`	`233063` cycles	`233048` cycles	`1.00`
`ML-KEM-768 encaps`	`250269` cycles	`250226` cycles	`1.00`
`ML-KEM-768 decaps`	`304891` cycles	`304913` cycles	`1.00`
`ML-KEM-1024 keypair`	`365487` cycles	`365541` cycles	`1.00`
`ML-KEM-1024 encaps`	`387942` cycles	`387905` cycles	`1.00`
`ML-KEM-1024 decaps`	`458209` cycles	`458300` cycles	`1.00`

This comment was automatically generated by workflow using github-action-benchmark.

tob-joe requested a review from a team as a code owner June 29, 2026 18:21

tob-joe force-pushed the ptp/mlkem-clear-kem-outputs-on-failure branch from 3e3a920 to e53c19c Compare July 7, 2026 21:30

mkannwischer added the benchmark this PR should be benchmarked in CI label Jul 8, 2026

oqs-bot reviewed Jul 8, 2026

View reviewed changes

Uh oh!

Conversation

tob-joe commented Jun 29, 2026

Summary

Testing

Uh oh!

oqs-bot commented Jun 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

CBMC Results (ML-KEM-512)

Uh oh!

oqs-bot commented Jun 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

CBMC Results (ML-KEM-768)

Uh oh!

oqs-bot commented Jun 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

CBMC Results (ML-KEM-1024)

Uh oh!

oqs-bot left a comment

Choose a reason for hiding this comment

Mac Mini (M1, 2020) benchmarks

Uh oh!

oqs-bot left a comment

Choose a reason for hiding this comment

Intel Xeon 4th gen (c7i)

Uh oh!

oqs-bot left a comment

Choose a reason for hiding this comment

ppc64le (POWER10) benchmarks

Uh oh!

oqs-bot left a comment

Choose a reason for hiding this comment

AMD EPYC 4th gen (c7a)

Uh oh!

oqs-bot left a comment

Choose a reason for hiding this comment

AMD EPYC 3rd gen (c6a)

Uh oh!

oqs-bot left a comment

Choose a reason for hiding this comment

Graviton5

Uh oh!

oqs-bot left a comment

Choose a reason for hiding this comment

Graviton4

Uh oh!

oqs-bot left a comment

Choose a reason for hiding this comment

Intel Xeon 4th gen (c7i) (no-opt)

Uh oh!

oqs-bot left a comment

Choose a reason for hiding this comment

Arm Cortex-A76 (Raspberry Pi 5) benchmarks

Uh oh!

oqs-bot left a comment

Choose a reason for hiding this comment

Intel Xeon 3rd gen (c6i)

Uh oh!

oqs-bot left a comment

Choose a reason for hiding this comment

Graviton5 (no-opt)

Uh oh!

oqs-bot left a comment

Choose a reason for hiding this comment

AMD EPYC 4th gen (c7a) (no-opt)

Uh oh!

oqs-bot left a comment

Choose a reason for hiding this comment

AMD EPYC 3rd gen (c6a) (no-opt)

Uh oh!

oqs-bot left a comment

Choose a reason for hiding this comment

Graviton4 (no-opt)

Uh oh!

oqs-bot left a comment

Choose a reason for hiding this comment

Graviton2

Uh oh!

oqs-bot left a comment

Choose a reason for hiding this comment

oqs-bot commented Jun 29, 2026 •

edited

Loading

oqs-bot commented Jun 29, 2026 •

edited

Loading

oqs-bot commented Jun 29, 2026 •

edited

Loading