Skip to content

mldsa_native.h: Add PCT-aware MLD_TOTAL_ALLOC constants #869

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
mkannwischer wants to merge 3 commits into
base: main
Choose a base branch
from
+94 −24
Open

mldsa_native.h: Add PCT-aware MLD_TOTAL_ALLOC constants #869

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
db0baed
Examples: Set MLD_CONFIG_NO_SUPERCOP for multilevel builds
mkannwischer Jan 11, 2026
2a763c0
mldsa_native.h: Add PCT-aware MLD_TOTAL_ALLOC constants
mkannwischer Jan 10, 2026
9e2cd19
CI: Add REDUCE_RAM config-variations tests
mkannwischer Jan 10, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
31 changes: 30 additions & 1 deletion .github/actions/config-variations/action.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,7 +8,7 @@ inputs:
description: 'GitHub token'
required: true
tests:
description: 'List of tests to run (space-separated IDs) or "all" for all tests. Available IDs: pct-enabled, pct-enabled-broken, custom-alloc-heap, custom-zeroize, native-cap-ON, native-cap-OFF, native-cap-ID_AA64PFR1_EL1, native-cap-CPUID_AVX2, no-asm, serial-fips202, custom-randombytes, custom-memcpy, custom-memset, custom-stdlib'
description: 'List of tests to run (space-separated IDs) or "all" for all tests. Available IDs: pct-enabled, pct-enabled-broken, reduce-ram, reduce-ram-pct, custom-alloc-heap, custom-zeroize, native-cap-ON, native-cap-OFF, native-cap-ID_AA64PFR1_EL1, native-cap-CPUID_AVX2, no-asm, serial-fips202, custom-randombytes, custom-memcpy, custom-memset, custom-stdlib'
required: false
default: 'all'
opt:
Expand All @@ -32,6 +32,35 @@ runs:
opt: ${{ inputs.opt }}
examples: true
extra_args: "--exclude-example basic_deterministic"
- name: "REDUCE_RAM"
if: ${{ inputs.tests == 'all' || contains(inputs.tests, 'reduce-ram') }}
uses: ./.github/actions/multi-functest
with:
gh_token: ${{ inputs.gh_token }}
compile_mode: native
cflags: "-DMLD_CONFIG_REDUCE_RAM -fsanitize=address -fsanitize=undefined -fno-sanitize-recover=all"
ldflags: "-fsanitize=address -fsanitize=undefined -fno-sanitize-recover=all"
func: true
kat: true
acvp: true
alloc: true
opt: ${{ inputs.opt }}
examples: true
- name: "REDUCE_RAM + PCT"
if: ${{ inputs.tests == 'all' || contains(inputs.tests, 'reduce-ram-pct') }}
uses: ./.github/actions/multi-functest
with:
gh_token: ${{ inputs.gh_token }}
compile_mode: native
cflags: "-DMLD_CONFIG_REDUCE_RAM -DMLD_CONFIG_KEYGEN_PCT -fsanitize=address -fsanitize=undefined -fno-sanitize-recover=all"
ldflags: "-fsanitize=address -fsanitize=undefined -fno-sanitize-recover=all"
func: true
kat: true
acvp: true
alloc: true
opt: ${{ inputs.opt }}
examples: true
extra_args: "--exclude-example basic_deterministic"
- name: "PCT enabled + broken"
if: ${{ inputs.tests == 'all' || contains(inputs.tests, 'pct-enabled-broken') }}
shell: bash
Expand Down
3 changes: 3 additions & 0 deletions examples/basic_lowram/mldsa_native/mldsa_native_config.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -686,7 +686,10 @@
* Its scope and configuration may change at any time.
*
*****************************************************************************/
#if !defined(MLD_CONFIG_REDUCE_RAM)
#define MLD_CONFIG_REDUCE_RAM
#endif


/************************* Config internals ********************************/

Expand Down
3 changes: 2 additions & 1 deletion examples/monolithic_build_multilevel/mldsa_native/mldsa_native_config.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -29,6 +29,7 @@
*
* This configuration differs from the default mldsa/mldsa_native_config.h in
* the following places:
* - MLD_CONFIG_NO_SUPERCOP
* - MLD_CONFIG_MULTILEVEL_BUILD
* - MLD_CONFIG_NAMESPACE_PREFIX
* - MLD_CONFIG_INTERNAL_API_QUALIFIER
Expand Down Expand Up @@ -157,7 +158,7 @@
* naming does not disambiguate between the parameter sets.
*
*****************************************************************************/
/* #define MLD_CONFIG_NO_SUPERCOP */
#define MLD_CONFIG_NO_SUPERCOP

/******************************************************************************
* Name: MLD_CONFIG_CONSTANTS_ONLY
Expand Down
3 changes: 2 additions & 1 deletion examples/monolithic_build_multilevel_native/mldsa_native/mldsa_native_config.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -29,6 +29,7 @@
*
* This configuration differs from the default mldsa/mldsa_native_config.h in
* the following places:
* - MLD_CONFIG_NO_SUPERCOP
* - MLD_CONFIG_MULTILEVEL_BUILD
* - MLD_CONFIG_NAMESPACE_PREFIX
* - MLD_CONFIG_USE_NATIVE_BACKEND_ARITH
Expand Down Expand Up @@ -161,7 +162,7 @@
* naming does not disambiguate between the parameter sets.
*
*****************************************************************************/
/* #define MLD_CONFIG_NO_SUPERCOP */
#define MLD_CONFIG_NO_SUPERCOP

/******************************************************************************
* Name: MLD_CONFIG_CONSTANTS_ONLY
Expand Down
3 changes: 2 additions & 1 deletion examples/multilevel_build/mldsa_native/mldsa_native_config.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -29,6 +29,7 @@
*
* This configuration differs from the default mldsa/mldsa_native_config.h in
* the following places:
* - MLD_CONFIG_NO_SUPERCOP
* - MLD_CONFIG_MULTILEVEL_BUILD
* - MLD_CONFIG_NAMESPACE_PREFIX
*/
Expand Down Expand Up @@ -156,7 +157,7 @@
* naming does not disambiguate between the parameter sets.
*
*****************************************************************************/
/* #define MLD_CONFIG_NO_SUPERCOP */
#define MLD_CONFIG_NO_SUPERCOP

/******************************************************************************
* Name: MLD_CONFIG_CONSTANTS_ONLY
Expand Down
3 changes: 2 additions & 1 deletion examples/multilevel_build_native/mldsa_native/mldsa_native_config.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -29,6 +29,7 @@
*
* This configuration differs from the default mldsa/mldsa_native_config.h in
* the following places:
* - MLD_CONFIG_NO_SUPERCOP
* - MLD_CONFIG_MULTILEVEL_BUILD
* - MLD_CONFIG_NAMESPACE_PREFIX
* - MLD_CONFIG_USE_NATIVE_BACKEND_ARITH
Expand Down Expand Up @@ -158,7 +159,7 @@
* naming does not disambiguate between the parameter sets.
*
*****************************************************************************/
/* #define MLD_CONFIG_NO_SUPERCOP */
#define MLD_CONFIG_NO_SUPERCOP

/******************************************************************************
* Name: MLD_CONFIG_CONSTANTS_ONLY
Expand Down
6 changes: 6 additions & 0 deletions mldsa/mldsa_native.S
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -196,14 +196,20 @@
#undef MLD_PREHASH_SHAKE_256
#undef MLD_TOTAL_ALLOC_44
#undef MLD_TOTAL_ALLOC_44_KEYPAIR
#undef MLD_TOTAL_ALLOC_44_KEYPAIR_NO_PCT
#undef MLD_TOTAL_ALLOC_44_KEYPAIR_PCT
#undef MLD_TOTAL_ALLOC_44_SIGN
#undef MLD_TOTAL_ALLOC_44_VERIFY
#undef MLD_TOTAL_ALLOC_65
#undef MLD_TOTAL_ALLOC_65_KEYPAIR
#undef MLD_TOTAL_ALLOC_65_KEYPAIR_NO_PCT
#undef MLD_TOTAL_ALLOC_65_KEYPAIR_PCT
#undef MLD_TOTAL_ALLOC_65_SIGN
#undef MLD_TOTAL_ALLOC_65_VERIFY
#undef MLD_TOTAL_ALLOC_87
#undef MLD_TOTAL_ALLOC_87_KEYPAIR
#undef MLD_TOTAL_ALLOC_87_KEYPAIR_NO_PCT
#undef MLD_TOTAL_ALLOC_87_KEYPAIR_PCT
#undef MLD_TOTAL_ALLOC_87_SIGN
#undef MLD_TOTAL_ALLOC_87_VERIFY
#undef crypto_sign
Expand Down
6 changes: 6 additions & 0 deletions mldsa/mldsa_native.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -192,14 +192,20 @@
#undef MLD_PREHASH_SHAKE_256
#undef MLD_TOTAL_ALLOC_44
#undef MLD_TOTAL_ALLOC_44_KEYPAIR
#undef MLD_TOTAL_ALLOC_44_KEYPAIR_NO_PCT
#undef MLD_TOTAL_ALLOC_44_KEYPAIR_PCT
#undef MLD_TOTAL_ALLOC_44_SIGN
#undef MLD_TOTAL_ALLOC_44_VERIFY
#undef MLD_TOTAL_ALLOC_65
#undef MLD_TOTAL_ALLOC_65_KEYPAIR
#undef MLD_TOTAL_ALLOC_65_KEYPAIR_NO_PCT
#undef MLD_TOTAL_ALLOC_65_KEYPAIR_PCT
#undef MLD_TOTAL_ALLOC_65_SIGN
#undef MLD_TOTAL_ALLOC_65_VERIFY
#undef MLD_TOTAL_ALLOC_87
#undef MLD_TOTAL_ALLOC_87_KEYPAIR
#undef MLD_TOTAL_ALLOC_87_KEYPAIR_NO_PCT
#undef MLD_TOTAL_ALLOC_87_KEYPAIR_PCT
#undef MLD_TOTAL_ALLOC_87_SIGN
#undef MLD_TOTAL_ALLOC_87_VERIFY
#undef crypto_sign
Expand Down
35 changes: 27 additions & 8 deletions mldsa/mldsa_native.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -827,33 +827,52 @@ int MLD_API_NAMESPACE(pk_from_sk)(
*/
/* check-magic: off */
#if defined(MLD_API_LEGACY_CONFIG) || !defined(MLD_CONFIG_REDUCE_RAM)
#define MLD_TOTAL_ALLOC_44_KEYPAIR 56640
#define MLD_TOTAL_ALLOC_44_KEYPAIR_NO_PCT 45248
Copy link
Contributor

@hanno-becker hanno-becker Jan 10, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Nit: I would suggest MLD_TOTAL_XXX (no PCT) as the default, and MLD_TOTAL_XXX_PCT for configurations with PCT. The MLK_CONFIG_KEYGEN_PCT is also a positive option that's disabled by default.

Copy link
Contributor Author

@mkannwischer mkannwischer Jan 10, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

hmm, lower in the file MLD_TOTAL_XXX is defined depending on the actual value of MLK_CONFIG_KEYGEN_PCT.

Copy link
Contributor

@hanno-becker hanno-becker Jan 10, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Nevermind, I hadn't yet seen the wrapper below.

#define MLD_TOTAL_ALLOC_44_KEYPAIR_PCT 56640
#define MLD_TOTAL_ALLOC_44_SIGN 52896
#define MLD_TOTAL_ALLOC_44_VERIFY 38816
#define MLD_TOTAL_ALLOC_65_KEYPAIR 85856
#define MLD_TOTAL_ALLOC_65_KEYPAIR_NO_PCT 71872
#define MLD_TOTAL_ALLOC_65_KEYPAIR_PCT 85856
#define MLD_TOTAL_ALLOC_65_SIGN 80576
#define MLD_TOTAL_ALLOC_65_VERIFY 62432
#define MLD_TOTAL_ALLOC_87_KEYPAIR 130816
#define MLD_TOTAL_ALLOC_87_KEYPAIR_NO_PCT 112832
#define MLD_TOTAL_ALLOC_87_KEYPAIR_PCT 130816
#define MLD_TOTAL_ALLOC_87_SIGN 123584
#define MLD_TOTAL_ALLOC_87_VERIFY 99552
#else /* MLD_API_LEGACY_CONFIG || !MLD_CONFIG_REDUCE_RAM */
#define MLD_TOTAL_ALLOC_44_KEYPAIR 36192
#define MLD_TOTAL_ALLOC_44_KEYPAIR_NO_PCT 32992
#define MLD_TOTAL_ALLOC_44_KEYPAIR_PCT 36192
#define MLD_TOTAL_ALLOC_44_SIGN 32448
#define MLD_TOTAL_ALLOC_44_VERIFY 26560
#define MLD_TOTAL_ALLOC_65_KEYPAIR 50048
#define MLD_TOTAL_ALLOC_65_KEYPAIR_NO_PCT 46304
#define MLD_TOTAL_ALLOC_65_KEYPAIR_PCT 50048
#define MLD_TOTAL_ALLOC_65_SIGN 44768
#define MLD_TOTAL_ALLOC_65_VERIFY 36864
#define MLD_TOTAL_ALLOC_87_KEYPAIR 66336
#define MLD_TOTAL_ALLOC_87_KEYPAIR_NO_PCT 62688
#define MLD_TOTAL_ALLOC_87_KEYPAIR_PCT 66336
#define MLD_TOTAL_ALLOC_87_SIGN 59104
#define MLD_TOTAL_ALLOC_87_VERIFY 49408
#endif /* !(MLD_API_LEGACY_CONFIG || !MLD_CONFIG_REDUCE_RAM) */
/* check-magic: on */

/*
* MLD_TOTAL_ALLOC_*_KEYPAIR adapts based on MLD_CONFIG_KEYGEN_PCT.
* For legacy config, we don't know which options are used, so assume
* the worst case (PCT enabled).
*/
#if defined(MLD_API_LEGACY_CONFIG) || defined(MLD_CONFIG_KEYGEN_PCT)
#define MLD_TOTAL_ALLOC_44_KEYPAIR MLD_TOTAL_ALLOC_44_KEYPAIR_PCT
#define MLD_TOTAL_ALLOC_65_KEYPAIR MLD_TOTAL_ALLOC_65_KEYPAIR_PCT
#define MLD_TOTAL_ALLOC_87_KEYPAIR MLD_TOTAL_ALLOC_87_KEYPAIR_PCT
#else
#define MLD_TOTAL_ALLOC_44_KEYPAIR MLD_TOTAL_ALLOC_44_KEYPAIR_NO_PCT
#define MLD_TOTAL_ALLOC_65_KEYPAIR MLD_TOTAL_ALLOC_65_KEYPAIR_NO_PCT
#define MLD_TOTAL_ALLOC_87_KEYPAIR MLD_TOTAL_ALLOC_87_KEYPAIR_NO_PCT
#endif

/*
* `MLD_MAX_TOTAL_ALLOC_{KEYPAIR,SIGN,VERIFY}` is the maximum across all
* parameter sets for each operation.
* `MLD_MAX_TOTAL_ALLOC` is the maximum across all parameter sets and
* operations.
*/
#define MLD_MAX_TOTAL_ALLOC_KEYPAIR MLD_TOTAL_ALLOC_87_KEYPAIR
#define MLD_MAX_TOTAL_ALLOC_SIGN MLD_TOTAL_ALLOC_87_SIGN
Expand Down
15 changes: 9 additions & 6 deletions test/configs/configs.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -302,6 +302,7 @@ configs:
- path: examples/monolithic_build_multilevel/mldsa_native/mldsa_native_config.h
description: "Multilevel monolithic build config"
defines:
MLD_CONFIG_NO_SUPERCOP: true
MLD_CONFIG_MULTILEVEL_BUILD: true
MLD_CONFIG_NAMESPACE_PREFIX: mldsa
MLD_CONFIG_INTERNAL_API_QUALIFIER: static
Expand All @@ -311,6 +312,7 @@ configs:
- path: examples/multilevel_build/mldsa_native/mldsa_native_config.h
description: "Multilevel build config"
defines:
MLD_CONFIG_NO_SUPERCOP: true
MLD_CONFIG_MULTILEVEL_BUILD: true
MLD_CONFIG_NAMESPACE_PREFIX: mldsa
MLD_CONFIG_FILE:
Expand All @@ -319,6 +321,7 @@ configs:
- path: examples/multilevel_build_native/mldsa_native/mldsa_native_config.h
description: "Multilevel build config"
defines:
MLD_CONFIG_NO_SUPERCOP: true
MLD_CONFIG_MULTILEVEL_BUILD: true
MLD_CONFIG_NAMESPACE_PREFIX: mldsa
MLD_CONFIG_USE_NATIVE_BACKEND_ARITH: true
Expand All @@ -329,6 +332,7 @@ configs:
- path: examples/monolithic_build_multilevel_native/mldsa_native/mldsa_native_config.h
description: "Multilevel monolithic build config with native backends"
defines:
MLD_CONFIG_NO_SUPERCOP: true
MLD_CONFIG_MULTILEVEL_BUILD: true
MLD_CONFIG_NAMESPACE_PREFIX: mldsa
MLD_CONFIG_USE_NATIVE_BACKEND_ARITH: true
Expand Down Expand Up @@ -401,19 +405,18 @@ configs:
description: "Configuration for low RAM build of mldsa-native"
defines:
MLD_CONFIG_NAMESPACE_PREFIX: mldsa
MLD_CONFIG_REDUCE_RAM: true
MLD_CONFIG_REDUCE_RAM:
content: |
#if !defined(MLD_CONFIG_REDUCE_RAM)
#define MLD_CONFIG_REDUCE_RAM
#endif
MLD_CONFIG_FILE:
comment: "/* No need to set this -- we _are_ already in a custom config */"

- path: test/configs/test_alloc_config.h
description: "Using custom allocation that can be made fail at specific invocation"
defines:
MLD_CONFIG_NAMESPACE_PREFIX: mld
MLD_CONFIG_KEYGEN_PCT:
content: |
#if !defined(MLD_CONFIG_KEYGEN_PCT)
#define MLD_CONFIG_KEYGEN_PCT
#endif
MLD_CONFIG_CUSTOM_ALLOC_FREE:
content: |
#define MLD_CONFIG_CUSTOM_ALLOC_FREE
Expand Down
6 changes: 1 addition & 5 deletions test/configs/test_alloc_config.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -31,7 +31,6 @@
* This configuration differs from the default mldsa/mldsa_native_config.h in
* the following places:
* - MLD_CONFIG_NAMESPACE_PREFIX
* - MLD_CONFIG_KEYGEN_PCT
* - MLD_CONFIG_CUSTOM_ALLOC_FREE
*/

Expand Down Expand Up @@ -630,10 +629,7 @@ void custom_free(void *p, size_t sz, const char *file, int line,
* key generation.
*
*****************************************************************************/
#if !defined(MLD_CONFIG_KEYGEN_PCT)
#define MLD_CONFIG_KEYGEN_PCT
#endif

/* #define MLD_CONFIG_KEYGEN_PCT */

/******************************************************************************
* Name: MLD_CONFIG_KEYGEN_PCT_BREAKAGE_TEST
Expand Down
4 changes: 4 additions & 0 deletions test/src/test_alloc.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,6 +17,9 @@
* Level-dependent allocation limit macros.
* These expand to the right MLD_TOTAL_ALLOC_{44,65,87}_* constant
* based on MLD_CONFIG_API_PARAMETER_SET.
*
* Note: MLD_TOTAL_ALLOC_*_KEYPAIR in the header automatically adapts
* based on MLD_CONFIG_KEYGEN_PCT.
*/
#define MLD_TOTAL_ALLOC_KEYPAIR__(LVL) MLD_TOTAL_ALLOC_##LVL##_KEYPAIR
#define MLD_TOTAL_ALLOC_KEYPAIR_(LVL) MLD_TOTAL_ALLOC_KEYPAIR__(LVL)
Expand Down Expand Up @@ -644,6 +647,7 @@ int main(void)
/*
* For parameter set 87, also check that the high watermarks match
* the MLD_MAX_TOTAL_ALLOC_* constants (which are defined as the 87 values).
* MLD_MAX_TOTAL_ALLOC_KEYPAIR adapts based on MLD_CONFIG_KEYGEN_PCT.
*/
#if MLD_CONFIG_API_PARAMETER_SET == 87
CHECK_ALLOC_MATCH(global_bump_high_mark_keypair, MLD_MAX_TOTAL_ALLOC_KEYPAIR);
Expand Down