Skip to content

HOL-Light: improve tooling and CI#1634

Open
L-series wants to merge 2 commits into
mainfrom
HOL-Light-CI
Open

HOL-Light: improve tooling and CI#1634
L-series wants to merge 2 commits into
mainfrom
HOL-Light-CI

Conversation

@L-series
Copy link
Copy Markdown
Contributor

@L-series L-series commented Mar 20, 2026 •
edited
Loading

This commit aims to resolve the two following issues:

Note that the check-theorems script will currently fail the HOL-Light CI because for AArch, the naming convention for the memory safety proof (usually _SAFE) is not respected in mlkem_rej_uniform (it uses _MEMSAFE). @hanno-becker please advise if I should modify this.

@oqs-bot
Copy link
Copy Markdown
Contributor

oqs-bot commented Mar 20, 2026 •
edited
Loading

CBMC Results (ML-KEM-768)

Full Results (191 proofs)
Proof Status Current Previous Change
**TOTAL** ✅ 1294s 1338s -3.3%
mlk_indcpa_keypair_derand ✅ 201s 202s -0%
mlk_indcpa_enc ✅ 179s 185s -3%
mlk_rej_uniform_c ✅ 127s 144s -12%
mlk_polyvec_basemul_acc_montgomery_cached_c ✅ 51s 48s +6%
mlk_ntt_layer ✅ 34s 36s -6%
mlk_poly_rej_uniform ✅ 31s 33s -6%
mlk_keccak_squeezeblocks_x4 ✅ 26s 27s -4%
poly_ntt_native ✅ 23s 27s -15%
mlk_poly_reduce_native ✅ 22s 22s +0%
keccakf1600x4_permute_native_x4 ✅ 18s 18s +0%
polyvec_basemul_acc_montgomery_cached_native ✅ 18s 21s -14%
mlk_fqmul ✅ 15s 17s -12%
mlk_poly_decompress_d4_native ✅ 15s 14s +7%
mlk_indcpa_dec ✅ 13s 13s +0%
mlk_poly_decompress_d10_native ✅ 13s 17s -24%
mlk_poly_frombytes_native ✅ 11s 9s +22%
mlk_poly_frommsg ✅ 9s 8s +12%
mlk_keccak_squeeze_once ✅ 8s 10s -20%
mlk_ntt_butterfly_block ✅ 8s 8s +0%
mlk_polyvec_add ✅ 8s 10s -20%
kem_check_pk ✅ 7s 3s +133%
mlk_keccak_absorb_once_x4 ✅ 7s 7s +0%
mlk_keccak_squeezeblocks ✅ 7s 8s -12%
mlk_poly_ntt ✅ 7s 8s -12%
kem_dec ✅ 6s 4s +50%
mlk_poly_rej_uniform_x4 ✅ 6s 6s +0%
poly_mulcache_compute_native_aarch64 ✅ 6s 1s +500%
mlk_keccakf1600_permute_c ✅ 5s 6s -17%
mlk_polyvec_permute_bitrev_to_custom_native ✅ 5s 3s +67%
mlk_scalar_compress_d10 ✅ 5s 4s +25%
mlk_shake128_absorb_once ✅ 5s 2s +150%
poly_decompress_d4_native_x86_64 ✅ 5s 6s -17%
poly_frombytes_native_x86_64 ✅ 5s 6s -17%
poly_reduce_native_aarch64 ✅ 5s 1s +400%
poly_tomont_native_x86_64 ✅ 5s 3s +67%
rej_uniform_native_x86_64 ✅ 5s 6s -17%
mlk_ct_memcmp ✅ 4s 2s +100%
mlk_enc_getnoise_eta1_eta2 ✅ 4s 1s +300%
mlk_invntt_layer ✅ 4s 5s -20%
mlk_keccak_absorb_once ✅ 4s 3s +33%
mlk_matvec_mul ✅ 4s 2s +100%
mlk_poly_compress_d4_c ✅ 4s 2s +100%
mlk_poly_decompress_d11_native ✅ 4s 2s +100%
mlk_poly_decompress_d4 ✅ 4s 1s +300%
mlk_poly_frombytes ✅ 4s 1s +300%
mlk_poly_ntt_c ✅ 4s 3s +33%
mlk_poly_tobytes_native ✅ 4s 1s +300%
mlk_scalar_decompress_d10 ✅ 4s 2s +100%
mlk_shake256x4 ✅ 4s 3s +33%
mlk_value_barrier_u32 ✅ 4s 4s +0%
polyvec_basemul_acc_montgomery_cached_k4_native_x86_64 ✅ 4s 2s +100%
intt_native_x86_64 ✅ 3s 2s +50%
keccak_f1600_x4_native_aarch64_v84a ✅ 3s 3s +0%
keccak_f1600_x4_native_aarch64_v8a_v84a_scalar_hybrid ✅ 3s 2s +50%
keccak_f1600_x4_native_avx2 ✅ 3s 2s +50%
kem_enc_derand ✅ 3s 3s +0%
kem_keypair ✅ 3s 4s -25%
kem_keypair_derand ✅ 3s 1s +200%
mlk_check_pct ✅ 3s 1s +200%
mlk_ct_cmask_neg_i16 ✅ 3s 2s +50%
mlk_ct_cmov_zero ✅ 3s 4s -25%
mlk_ct_sel_int16 ✅ 3s 2s +50%
mlk_gen_matrix ✅ 3s 3s +0%
mlk_gen_matrix_serial ✅ 3s 3s +0%
mlk_keccakf1600x4_permute ✅ 3s 4s -25%
mlk_montgomery_reduce ✅ 3s 2s +50%
mlk_poly_cbd_eta2 ✅ 3s 2s +50%
mlk_poly_compress_d10_c ✅ 3s 3s +0%
mlk_poly_compress_d10_native ✅ 3s 3s +0%
mlk_poly_compress_d11_c ✅ 3s 2s +50%
mlk_poly_compress_d4 ✅ 3s 2s +50%
mlk_poly_compress_d4_native ✅ 3s 2s +50%
mlk_poly_compress_du ✅ 3s 2s +50%
mlk_poly_compress_dv ✅ 3s 2s +50%
mlk_poly_decompress_d10 ✅ 3s 4s -25%
mlk_poly_frombytes_c ✅ 3s 3s +0%
mlk_poly_getnoise_eta1_4x ✅ 3s 2s +50%
mlk_poly_getnoise_eta1_4x_native ✅ 3s 1s +200%
mlk_poly_mulcache_compute ✅ 3s 3s +0%
mlk_poly_mulcache_compute_c ✅ 3s 3s +0%
mlk_poly_reduce_c ✅ 3s 2s +50%
mlk_poly_sub ✅ 3s 4s -25%
mlk_poly_tobytes_c ✅ 3s 2s +50%
mlk_poly_tomont_native ✅ 3s 2s +50%
mlk_polyvec_frombytes ✅ 3s 2s +50%
mlk_polyvec_invntt_tomont ✅ 3s 2s +50%
mlk_polyvec_mulcache_compute ✅ 3s 5s -40%
mlk_polyvec_tobytes ✅ 3s 2s +50%
mlk_scalar_compress_d11 ✅ 3s 2s +50%
mlk_scalar_compress_d5 ✅ 3s 4s -25%
mlk_scalar_decompress_d11 ✅ 3s 3s +0%
mlk_scalar_decompress_d4 ✅ 3s 2s +50%
mlk_sha3_256 ✅ 3s 4s -25%
mlk_shake128_squeezeblocks ✅ 3s 3s +0%
mlk_shake128x4_squeezeblocks ✅ 3s 1s +200%
mlk_value_barrier_u8 ✅ 3s 2s +50%
ntt_native_aarch64 ✅ 3s 2s +50%
nttunpack_native_x86_64 ✅ 3s 4s -25%
poly_compress_d4_native_x86_64 ✅ 3s 3s +0%
poly_decompress_d10_native_x86_64 ✅ 3s 7s -57%
poly_decompress_d11_native_x86_64 ✅ 3s 3s +0%
poly_decompress_d5_native_x86_64 ✅ 3s 1s +200%
poly_invntt_tomont_native ✅ 3s 2s +50%
poly_mulcache_compute_native_x86_64 ✅ 3s 2s +50%
poly_tobytes_native_x86_64 ✅ 3s 2s +50%
polyvec_basemul_acc_montgomery_cached_k2_native_aarch64 ✅ 3s 4s -25%
polyvec_basemul_acc_montgomery_cached_k2_native_x86_64 ✅ 3s 4s -25%
polyvec_basemul_acc_montgomery_cached_k3_native_aarch64 ✅ 3s 3s +0%
polyvec_basemul_acc_montgomery_cached_k3_native_x86_64 ✅ 3s 2s +50%
rej_uniform_native ✅ 3s 3s +0%
rej_uniform_native_aarch64 ✅ 3s 2s +50%
intt_native_aarch64 ✅ 2s 2s +0%
keccak_f1600_x1_native_aarch64 ✅ 2s 1s +100%
keccak_f1600_x1_native_aarch64_v84a ✅ 2s 3s -33%
keccak_f1600_x4_native_aarch64_v8a_scalar_hybrid ✅ 2s 3s -33%
kem_check_sk ✅ 2s 5s -60%
mlk_barrett_reduce ✅ 2s 2s +0%
mlk_ct_cmask_nonzero_u16 ✅ 2s 1s +100%
mlk_ct_get_optblocker_u32 ✅ 2s 1s +100%
mlk_ct_get_optblocker_u8 ✅ 2s 3s -33%
mlk_keccakf1600_extract_bytes ✅ 2s 2s +0%
mlk_keccakf1600_extract_bytes (big endian) ✅ 2s 3s -33%
mlk_keccakf1600_permute ✅ 2s 4s -50%
mlk_keccakf1600x4_extract_bytes ✅ 2s 3s -33%
mlk_keccakf1600x4_extract_bytes_c ✅ 2s 2s +0%
mlk_keccakf1600x4_xor_bytes_c ✅ 2s 3s -33%
mlk_poly_add ✅ 2s 3s -33%
mlk_poly_cbd_eta1 ✅ 2s 2s +0%
mlk_poly_compress_d11 ✅ 2s 2s +0%
mlk_poly_compress_d11_native ✅ 2s 2s +0%
mlk_poly_compress_d5_c ✅ 2s 3s -33%
mlk_poly_decompress_d11 ✅ 2s 2s +0%
mlk_poly_decompress_d11_c ✅ 2s 2s +0%
mlk_poly_decompress_d4_c ✅ 2s 1s +100%
mlk_poly_decompress_d5 ✅ 2s 5s -60%
mlk_poly_decompress_d5_c ✅ 2s 3s -33%
mlk_poly_decompress_d5_native ✅ 2s 4s -50%
mlk_poly_decompress_du ✅ 2s 3s -33%
mlk_poly_decompress_dv ✅ 2s 3s -33%
mlk_poly_getnoise_eta1122_4x ✅ 2s 3s -33%
mlk_poly_invntt_tomont_c ✅ 2s 1s +100%
mlk_poly_mulcache_compute_native ✅ 2s 4s -50%
mlk_poly_reduce ✅ 2s 1s +100%
mlk_poly_tobytes ✅ 2s 2s +0%
mlk_poly_tomont_c ✅ 2s 3s -33%
mlk_polymat_permute_bitrev_to_custom ✅ 2s 4s -50%
mlk_polyvec_basemul_acc_montgomery_cached ✅ 2s 6s -67%
mlk_polyvec_decompress_du ✅ 2s 2s +0%
mlk_polyvec_ntt ✅ 2s 2s +0%
mlk_polyvec_permute_bitrev_to_custom ✅ 2s 2s +0%
mlk_polyvec_tomont ✅ 2s 2s +0%
mlk_rej_uniform ✅ 2s 2s +0%
mlk_scalar_signed_to_unsigned_q ✅ 2s 2s +0%
mlk_sha3_512 ✅ 2s 4s -50%
mlk_shake128x4_absorb_once ✅ 2s 2s +0%
mlk_shake256 ✅ 2s 1s +100%
mlk_value_barrier_i32 ✅ 2s 3s -33%
ntt_native_x86_64 ✅ 2s 2s +0%
poly_compress_d10_native_x86_64 ✅ 2s 4s -50%
poly_compress_d11_native_x86_64 ✅ 2s 2s +0%
poly_getnoise_eta1122_4x_native ✅ 2s 3s -33%
poly_tobytes_native_aarch64 ✅ 2s 2s +0%
poly_tomont_native_aarch64 ✅ 2s 4s -50%
polyvec_basemul_acc_montgomery_cached_k4_native_aarch64 ✅ 2s 2s +0%
keccakf1600_permute_native ✅ 1s 3s -67%
keccakf1600x4_extract_bytes_native ✅ 1s 2s -50%
keccakf1600x4_xor_bytes_native ✅ 1s 3s -67%
kem_enc ✅ 1s 1s +0%
mlk_ct_cmask_nonzero_u8 ✅ 1s 3s -67%
mlk_ct_get_optblocker_i32 ✅ 1s 2s -50%
mlk_ct_sel_uint8 ✅ 1s 2s -50%
mlk_keccakf1600_xor_bytes ✅ 1s 3s -67%
mlk_keccakf1600_xor_bytes (big endian) ✅ 1s 3s -67%
mlk_keccakf1600x4_xor_bytes ✅ 1s 3s -67%
mlk_keypair_getnoise_eta1 ✅ 1s 6s -83%
mlk_poly_compress_d10 ✅ 1s 2s -50%
mlk_poly_compress_d5 ✅ 1s 2s -50%
mlk_poly_compress_d5_native ✅ 1s 2s -50%
mlk_poly_decompress_d10_c ✅ 1s 3s -67%
mlk_poly_getnoise_eta2 ✅ 1s 1s +0%
mlk_poly_invntt_tomont ✅ 1s 3s -67%
mlk_poly_tomont ✅ 1s 2s -50%
mlk_poly_tomsg ✅ 1s 1s +0%
mlk_polyvec_compress_du ✅ 1s 2s -50%
mlk_polyvec_reduce ✅ 1s 2s -50%
mlk_scalar_compress_d1 ✅ 1s 3s -67%
mlk_scalar_compress_d4 ✅ 1s 1s +0%
mlk_scalar_decompress_d5 ✅ 1s 2s -50%
poly_compress_d5_native_x86_64 ✅ 1s 2s -50%
poly_reduce_native_x86_64 ✅ 1s 4s -75%
sys_check_capability ✅ 1s 2s -50%

@oqs-bot
Copy link
Copy Markdown
Contributor

oqs-bot commented Mar 20, 2026 •
edited
Loading

CBMC Results (ML-KEM-512)

Full Results (191 proofs)
Proof Status Current Previous Change
**TOTAL** ✅ 1391s 1270s +9.5%
mlk_indcpa_keypair_derand ✅ 254s 235s +8%
mlk_indcpa_enc ✅ 181s 167s +8%
mlk_rej_uniform_c ✅ 146s 121s +21%
mlk_polyvec_basemul_acc_montgomery_cached_c ✅ 59s 51s +16%
mlk_ntt_layer ✅ 42s 31s +35%
mlk_poly_rej_uniform ✅ 33s 34s -3%
poly_ntt_native ✅ 29s 27s +7%
mlk_keccak_squeezeblocks_x4 ✅ 28s 26s +8%
mlk_poly_reduce_native ✅ 23s 19s +21%
keccakf1600x4_permute_native_x4 ✅ 17s 16s +6%
mlk_poly_decompress_d4_native ✅ 17s 15s +13%
mlk_fqmul ✅ 16s 16s +0%
mlk_poly_decompress_d10_native ✅ 16s 13s +23%
mlk_indcpa_dec ✅ 13s 13s +0%
mlk_poly_frombytes_native ✅ 13s 9s +44%
mlk_poly_frommsg ✅ 13s 7s +86%
mlk_polyvec_add ✅ 13s 11s +18%
mlk_keccak_squeezeblocks ✅ 10s 9s +11%
mlk_keccak_absorb_once_x4 ✅ 8s 6s +33%
mlk_poly_ntt ✅ 8s 6s +33%
mlk_invntt_layer ✅ 7s 4s +75%
mlk_keccak_squeeze_once ✅ 7s 7s +0%
mlk_keccakf1600_permute_c ✅ 7s 6s +17%
mlk_ntt_butterfly_block ✅ 7s 9s -22%
mlk_poly_rej_uniform_x4 ✅ 7s 6s +17%
rej_uniform_native_x86_64 ✅ 7s 5s +40%
mlk_poly_cbd_eta2 ✅ 6s 5s +20%
polyvec_basemul_acc_montgomery_cached_native ✅ 6s 7s -14%
kem_check_sk ✅ 5s 1s +400%
mlk_gen_matrix ✅ 5s 4s +25%
mlk_gen_matrix_serial ✅ 5s 2s +150%
mlk_matvec_mul ✅ 5s 2s +150%
mlk_poly_compress_d4_c ✅ 5s 4s +25%
mlk_poly_invntt_tomont_c ✅ 5s 2s +150%
mlk_poly_mulcache_compute_native ✅ 5s 4s +25%
mlk_polyvec_permute_bitrev_to_custom_native ✅ 5s 2s +150%
mlk_value_barrier_u32 ✅ 5s 1s +400%
nttunpack_native_x86_64 ✅ 5s 4s +25%
poly_decompress_d4_native_x86_64 ✅ 5s 4s +25%
polyvec_basemul_acc_montgomery_cached_k3_native_x86_64 ✅ 5s 3s +67%
kem_check_pk ✅ 4s 1s +300%
kem_enc ✅ 4s 2s +100%
mlk_ct_memcmp ✅ 4s 2s +100%
mlk_keccak_absorb_once ✅ 4s 4s +0%
mlk_keccakf1600_extract_bytes (big endian) ✅ 4s 3s +33%
mlk_poly_compress_d4 ✅ 4s 1s +300%
mlk_polyvec_reduce ✅ 4s 3s +33%
mlk_shake256x4 ✅ 4s 2s +100%
ntt_native_x86_64 ✅ 4s 1s +300%
poly_decompress_d10_native_x86_64 ✅ 4s 5s -20%
poly_frombytes_native_x86_64 ✅ 4s 5s -20%
poly_getnoise_eta1122_4x_native ✅ 4s 1s +300%
poly_mulcache_compute_native_x86_64 ✅ 4s 2s +100%
polyvec_basemul_acc_montgomery_cached_k4_native_x86_64 ✅ 4s 1s +300%
rej_uniform_native_aarch64 ✅ 4s 3s +33%
intt_native_aarch64 ✅ 3s 2s +50%
keccak_f1600_x1_native_aarch64 ✅ 3s 1s +200%
keccak_f1600_x1_native_aarch64_v84a ✅ 3s 3s +0%
keccak_f1600_x4_native_aarch64_v84a ✅ 3s 1s +200%
keccak_f1600_x4_native_aarch64_v8a_scalar_hybrid ✅ 3s 3s +0%
keccak_f1600_x4_native_aarch64_v8a_v84a_scalar_hybrid ✅ 3s 2s +50%
kem_dec ✅ 3s 2s +50%
kem_keypair ✅ 3s 5s -40%
mlk_ct_cmov_zero ✅ 3s 3s +0%
mlk_ct_sel_int16 ✅ 3s 1s +200%
mlk_keccakf1600x4_extract_bytes ✅ 3s 3s +0%
mlk_poly_add ✅ 3s 2s +50%
mlk_poly_compress_d10_c ✅ 3s 3s +0%
mlk_poly_compress_d5_c ✅ 3s 1s +200%
mlk_poly_compress_du ✅ 3s 2s +50%
mlk_poly_decompress_d11_c ✅ 3s 3s +0%
mlk_poly_decompress_d5 ✅ 3s 2s +50%
mlk_poly_frombytes ✅ 3s 1s +200%
mlk_poly_getnoise_eta1_4x ✅ 3s 3s +0%
mlk_poly_getnoise_eta2 ✅ 3s 3s +0%
mlk_poly_ntt_c ✅ 3s 4s -25%
mlk_poly_tobytes ✅ 3s 4s -25%
mlk_poly_tobytes_native ✅ 3s 3s +0%
mlk_poly_tomsg ✅ 3s 3s +0%
mlk_polyvec_basemul_acc_montgomery_cached ✅ 3s 2s +50%
mlk_polyvec_decompress_du ✅ 3s 1s +200%
mlk_polyvec_frombytes ✅ 3s 3s +0%
mlk_polyvec_invntt_tomont ✅ 3s 4s -25%
mlk_polyvec_permute_bitrev_to_custom ✅ 3s 4s -25%
mlk_polyvec_tomont ✅ 3s 1s +200%
mlk_rej_uniform ✅ 3s 1s +200%
mlk_scalar_compress_d10 ✅ 3s 3s +0%
mlk_scalar_compress_d11 ✅ 3s 4s -25%
mlk_scalar_decompress_d10 ✅ 3s 1s +200%
mlk_scalar_decompress_d4 ✅ 3s 1s +200%
mlk_shake256 ✅ 3s 2s +50%
mlk_value_barrier_i32 ✅ 3s 2s +50%
poly_reduce_native_aarch64 ✅ 3s 2s +50%
poly_tobytes_native_aarch64 ✅ 3s 2s +50%
polyvec_basemul_acc_montgomery_cached_k2_native_aarch64 ✅ 3s 2s +50%
polyvec_basemul_acc_montgomery_cached_k3_native_aarch64 ✅ 3s 3s +0%
intt_native_x86_64 ✅ 2s 2s +0%
keccakf1600x4_xor_bytes_native ✅ 2s 2s +0%
kem_enc_derand ✅ 2s 2s +0%
mlk_barrett_reduce ✅ 2s 2s +0%
mlk_check_pct ✅ 2s 3s -33%
mlk_ct_cmask_neg_i16 ✅ 2s 2s +0%
mlk_ct_cmask_nonzero_u16 ✅ 2s 1s +100%
mlk_ct_cmask_nonzero_u8 ✅ 2s 2s +0%
mlk_ct_get_optblocker_u32 ✅ 2s 2s +0%
mlk_keccakf1600_extract_bytes ✅ 2s 3s -33%
mlk_keccakf1600_permute ✅ 2s 2s +0%
mlk_keccakf1600_xor_bytes ✅ 2s 2s +0%
mlk_keccakf1600x4_extract_bytes_c ✅ 2s 3s -33%
mlk_keccakf1600x4_permute ✅ 2s 2s +0%
mlk_keccakf1600x4_xor_bytes ✅ 2s 2s +0%
mlk_keccakf1600x4_xor_bytes_c ✅ 2s 2s +0%
mlk_keypair_getnoise_eta1 ✅ 2s 2s +0%
mlk_montgomery_reduce ✅ 2s 2s +0%
mlk_poly_cbd_eta1 ✅ 2s 4s -50%
mlk_poly_compress_d10 ✅ 2s 2s +0%
mlk_poly_compress_d10_native ✅ 2s 3s -33%
mlk_poly_compress_d11 ✅ 2s 2s +0%
mlk_poly_compress_d11_c ✅ 2s 3s -33%
mlk_poly_compress_d11_native ✅ 2s 3s -33%
mlk_poly_compress_d5 ✅ 2s 2s +0%
mlk_poly_compress_d5_native ✅ 2s 2s +0%
mlk_poly_decompress_d10 ✅ 2s 3s -33%
mlk_poly_decompress_d10_c ✅ 2s 3s -33%
mlk_poly_decompress_d4_c ✅ 2s 3s -33%
mlk_poly_decompress_d5_c ✅ 2s 2s +0%
mlk_poly_decompress_dv ✅ 2s 2s +0%
mlk_poly_frombytes_c ✅ 2s 1s +100%
mlk_poly_getnoise_eta1122_4x ✅ 2s 3s -33%
mlk_poly_getnoise_eta1_4x_native ✅ 2s 2s +0%
mlk_poly_invntt_tomont ✅ 2s 1s +100%
mlk_poly_mulcache_compute ✅ 2s 3s -33%
mlk_poly_mulcache_compute_c ✅ 2s 3s -33%
mlk_poly_reduce ✅ 2s 2s +0%
mlk_poly_reduce_c ✅ 2s 2s +0%
mlk_poly_sub ✅ 2s 1s +100%
mlk_poly_tomont ✅ 2s 4s -50%
mlk_poly_tomont_native ✅ 2s 2s +0%
mlk_polymat_permute_bitrev_to_custom ✅ 2s 3s -33%
mlk_polyvec_mulcache_compute ✅ 2s 3s -33%
mlk_polyvec_ntt ✅ 2s 1s +100%
mlk_scalar_compress_d1 ✅ 2s 2s +0%
mlk_scalar_compress_d4 ✅ 2s 1s +100%
mlk_scalar_decompress_d11 ✅ 2s 3s -33%
mlk_scalar_decompress_d5 ✅ 2s 4s -50%
mlk_scalar_signed_to_unsigned_q ✅ 2s 1s +100%
mlk_sha3_256 ✅ 2s 3s -33%
mlk_shake128_squeezeblocks ✅ 2s 1s +100%
mlk_value_barrier_u8 ✅ 2s 1s +100%
poly_compress_d10_native_x86_64 ✅ 2s 2s +0%
poly_compress_d11_native_x86_64 ✅ 2s 4s -50%
poly_invntt_tomont_native ✅ 2s 3s -33%
poly_reduce_native_x86_64 ✅ 2s 3s -33%
poly_tomont_native_aarch64 ✅ 2s 1s +100%
polyvec_basemul_acc_montgomery_cached_k4_native_aarch64 ✅ 2s 1s +100%
sys_check_capability ✅ 2s 2s +0%
keccak_f1600_x4_native_avx2 ✅ 1s 3s -67%
keccakf1600_permute_native ✅ 1s 2s -50%
keccakf1600x4_extract_bytes_native ✅ 1s 3s -67%
kem_keypair_derand ✅ 1s 2s -50%
mlk_ct_get_optblocker_i32 ✅ 1s 3s -67%
mlk_ct_get_optblocker_u8 ✅ 1s 3s -67%
mlk_ct_sel_uint8 ✅ 1s 2s -50%
mlk_enc_getnoise_eta1_eta2 ✅ 1s 3s -67%
mlk_keccakf1600_xor_bytes (big endian) ✅ 1s 3s -67%
mlk_poly_compress_d4_native ✅ 1s 1s +0%
mlk_poly_compress_dv ✅ 1s 1s +0%
mlk_poly_decompress_d11 ✅ 1s 3s -67%
mlk_poly_decompress_d11_native ✅ 1s 3s -67%
mlk_poly_decompress_d4 ✅ 1s 3s -67%
mlk_poly_decompress_d5_native ✅ 1s 1s +0%
mlk_poly_decompress_du ✅ 1s 2s -50%
mlk_poly_tobytes_c ✅ 1s 1s +0%
mlk_poly_tomont_c ✅ 1s 5s -80%
mlk_polyvec_compress_du ✅ 1s 1s +0%
mlk_polyvec_tobytes ✅ 1s 3s -67%
mlk_scalar_compress_d5 ✅ 1s 2s -50%
mlk_sha3_512 ✅ 1s 2s -50%
mlk_shake128_absorb_once ✅ 1s 2s -50%
mlk_shake128x4_absorb_once ✅ 1s 2s -50%
mlk_shake128x4_squeezeblocks ✅ 1s 2s -50%
ntt_native_aarch64 ✅ 1s 2s -50%
poly_compress_d4_native_x86_64 ✅ 1s 4s -75%
poly_compress_d5_native_x86_64 ✅ 1s 2s -50%
poly_decompress_d11_native_x86_64 ✅ 1s 3s -67%
poly_decompress_d5_native_x86_64 ✅ 1s 3s -67%
poly_mulcache_compute_native_aarch64 ✅ 1s 3s -67%
poly_tobytes_native_x86_64 ✅ 1s 2s -50%
poly_tomont_native_x86_64 ✅ 1s 2s -50%
polyvec_basemul_acc_montgomery_cached_k2_native_x86_64 ✅ 1s 5s -80%
rej_uniform_native ✅ 1s 3s -67%

@oqs-bot
Copy link
Copy Markdown
Contributor

oqs-bot commented Mar 20, 2026 •
edited
Loading

CBMC Results (ML-KEM-1024)

Full Results (191 proofs)
Proof Status Current Previous Change
**TOTAL** ✅ 1263s 1177s +7.3%
mlk_indcpa_enc ✅ 151s 141s +7%
mlk_indcpa_keypair_derand ✅ 132s 127s +4%
mlk_rej_uniform_c ✅ 121s 117s +3%
mlk_polyvec_basemul_acc_montgomery_cached_c ✅ 83s 74s +12%
polyvec_basemul_acc_montgomery_cached_native ✅ 36s 31s +16%
mlk_poly_rej_uniform ✅ 34s 30s +13%
mlk_ntt_layer ✅ 32s 30s +7%
mlk_keccak_squeezeblocks_x4 ✅ 28s 24s +17%
poly_ntt_native ✅ 27s 24s +12%
mlk_poly_reduce_native ✅ 20s 20s +0%
mlk_poly_decompress_d11_native ✅ 17s 14s +21%
keccakf1600x4_permute_native_x4 ✅ 16s 17s -6%
mlk_poly_decompress_d5_native ✅ 16s 14s +14%
mlk_fqmul ✅ 15s 16s -6%
mlk_polyvec_add ✅ 12s 11s +9%
mlk_indcpa_dec ✅ 11s 9s +22%
mlk_keccak_squeezeblocks ✅ 10s 9s +11%
mlk_poly_frombytes_native ✅ 10s 7s +43%
mlk_ntt_butterfly_block ✅ 9s 7s +29%
mlk_poly_frommsg ✅ 9s 8s +12%
mlk_poly_ntt ✅ 9s 10s -10%
mlk_gen_matrix ✅ 8s 5s +60%
mlk_keccak_squeeze_once ✅ 8s 7s +14%
mlk_keccak_absorb_once_x4 ✅ 7s 5s +40%
poly_decompress_d11_native_x86_64 ✅ 7s 7s +0%
rej_uniform_native_x86_64 ✅ 7s 5s +40%
kem_dec ✅ 6s 5s +20%
mlk_invntt_layer ✅ 6s 5s +20%
mlk_poly_rej_uniform_x4 ✅ 6s 6s +0%
mlk_poly_compress_d11_c ✅ 5s 5s +0%
mlk_poly_mulcache_compute ✅ 5s 2s +150%
mlk_poly_tobytes_native ✅ 5s 2s +150%
mlk_poly_tomont ✅ 5s 3s +67%
mlk_polymat_permute_bitrev_to_custom ✅ 5s 6s -17%
mlk_polyvec_frombytes ✅ 5s 1s +400%
poly_frombytes_native_x86_64 ✅ 5s 4s +25%
intt_native_aarch64 ✅ 4s 2s +100%
kem_check_pk ✅ 4s 4s +0%
mlk_ct_cmask_neg_i16 ✅ 4s 4s +0%
mlk_enc_getnoise_eta1_eta2 ✅ 4s 3s +33%
mlk_gen_matrix_serial ✅ 4s 5s -20%
mlk_keccak_absorb_once ✅ 4s 4s +0%
mlk_keccakf1600_permute_c ✅ 4s 4s +0%
mlk_matvec_mul ✅ 4s 3s +33%
mlk_poly_compress_d10_c ✅ 4s 4s +0%
mlk_poly_compress_d11_native ✅ 4s 2s +100%
mlk_poly_decompress_d10_native ✅ 4s 2s +100%
mlk_poly_getnoise_eta1_4x_native ✅ 4s 2s +100%
mlk_poly_getnoise_eta2 ✅ 4s 2s +100%
mlk_poly_tomont_c ✅ 4s 4s +0%
mlk_poly_tomsg ✅ 4s 1s +300%
mlk_polyvec_compress_du ✅ 4s 3s +33%
mlk_polyvec_ntt ✅ 4s 3s +33%
mlk_shake256x4 ✅ 4s 2s +100%
nttunpack_native_x86_64 ✅ 4s 3s +33%
poly_mulcache_compute_native_x86_64 ✅ 4s 3s +33%
rej_uniform_native ✅ 4s 3s +33%
intt_native_x86_64 ✅ 3s 3s +0%
keccak_f1600_x4_native_aarch64_v8a_v84a_scalar_hybrid ✅ 3s 3s +0%
kem_enc_derand ✅ 3s 1s +200%
mlk_check_pct ✅ 3s 2s +50%
mlk_ct_get_optblocker_u32 ✅ 3s 3s +0%
mlk_keccakf1600_extract_bytes ✅ 3s 2s +50%
mlk_keccakf1600x4_extract_bytes ✅ 3s 2s +50%
mlk_keccakf1600x4_extract_bytes_c ✅ 3s 5s -40%
mlk_keccakf1600x4_xor_bytes ✅ 3s 2s +50%
mlk_keypair_getnoise_eta1 ✅ 3s 2s +50%
mlk_poly_cbd_eta1 ✅ 3s 4s -25%
mlk_poly_cbd_eta2 ✅ 3s 2s +50%
mlk_poly_compress_d10_native ✅ 3s 1s +200%
mlk_poly_compress_d11 ✅ 3s 2s +50%
mlk_poly_compress_d4_c ✅ 3s 1s +200%
mlk_poly_compress_d4_native ✅ 3s 2s +50%
mlk_poly_compress_dv ✅ 3s 2s +50%
mlk_poly_decompress_d10_c ✅ 3s 2s +50%
mlk_poly_decompress_d11 ✅ 3s 3s +0%
mlk_poly_decompress_d4 ✅ 3s 3s +0%
mlk_poly_decompress_d5 ✅ 3s 2s +50%
mlk_poly_getnoise_eta1_4x ✅ 3s 2s +50%
mlk_poly_ntt_c ✅ 3s 3s +0%
mlk_poly_reduce ✅ 3s 2s +50%
mlk_poly_tobytes_c ✅ 3s 2s +50%
mlk_polyvec_basemul_acc_montgomery_cached ✅ 3s 4s -25%
mlk_polyvec_invntt_tomont ✅ 3s 2s +50%
mlk_polyvec_reduce ✅ 3s 1s +200%
mlk_polyvec_tomont ✅ 3s 2s +50%
mlk_rej_uniform ✅ 3s 2s +50%
mlk_scalar_compress_d1 ✅ 3s 4s -25%
mlk_scalar_decompress_d10 ✅ 3s 1s +200%
mlk_scalar_decompress_d11 ✅ 3s 3s +0%
mlk_scalar_decompress_d4 ✅ 3s 2s +50%
mlk_scalar_signed_to_unsigned_q ✅ 3s 1s +200%
mlk_sha3_256 ✅ 3s 2s +50%
mlk_sha3_512 ✅ 3s 2s +50%
mlk_shake128_absorb_once ✅ 3s 3s +0%
mlk_value_barrier_u32 ✅ 3s 3s +0%
ntt_native_x86_64 ✅ 3s 2s +50%
poly_decompress_d10_native_x86_64 ✅ 3s 1s +200%
poly_decompress_d4_native_x86_64 ✅ 3s 4s -25%
poly_decompress_d5_native_x86_64 ✅ 3s 5s -40%
poly_invntt_tomont_native ✅ 3s 2s +50%
poly_tobytes_native_x86_64 ✅ 3s 2s +50%
polyvec_basemul_acc_montgomery_cached_k2_native_aarch64 ✅ 3s 2s +50%
polyvec_basemul_acc_montgomery_cached_k4_native_x86_64 ✅ 3s 3s +0%
rej_uniform_native_aarch64 ✅ 3s 3s +0%
keccak_f1600_x1_native_aarch64 ✅ 2s 2s +0%
keccak_f1600_x4_native_aarch64_v8a_scalar_hybrid ✅ 2s 1s +100%
keccak_f1600_x4_native_avx2 ✅ 2s 1s +100%
keccakf1600_permute_native ✅ 2s 3s -33%
keccakf1600x4_xor_bytes_native ✅ 2s 2s +0%
kem_check_sk ✅ 2s 2s +0%
kem_enc ✅ 2s 4s -50%
kem_keypair ✅ 2s 3s -33%
kem_keypair_derand ✅ 2s 3s -33%
mlk_ct_cmask_nonzero_u16 ✅ 2s 3s -33%
mlk_ct_get_optblocker_i32 ✅ 2s 3s -33%
mlk_ct_get_optblocker_u8 ✅ 2s 2s +0%
mlk_ct_memcmp ✅ 2s 4s -50%
mlk_ct_sel_int16 ✅ 2s 4s -50%
mlk_ct_sel_uint8 ✅ 2s 2s +0%
mlk_keccakf1600_extract_bytes (big endian) ✅ 2s 2s +0%
mlk_keccakf1600_permute ✅ 2s 2s +0%
mlk_keccakf1600_xor_bytes ✅ 2s 3s -33%
mlk_keccakf1600_xor_bytes (big endian) ✅ 2s 2s +0%
mlk_keccakf1600x4_xor_bytes_c ✅ 2s 2s +0%
mlk_poly_add ✅ 2s 2s +0%
mlk_poly_compress_d10 ✅ 2s 2s +0%
mlk_poly_compress_d4 ✅ 2s 3s -33%
mlk_poly_compress_d5 ✅ 2s 2s +0%
mlk_poly_compress_d5_c ✅ 2s 2s +0%
mlk_poly_compress_du ✅ 2s 1s +100%
mlk_poly_decompress_d11_c ✅ 2s 2s +0%
mlk_poly_decompress_d4_c ✅ 2s 2s +0%
mlk_poly_decompress_du ✅ 2s 2s +0%
mlk_poly_decompress_dv ✅ 2s 1s +100%
mlk_poly_frombytes_c ✅ 2s 4s -50%
mlk_poly_getnoise_eta1122_4x ✅ 2s 2s +0%
mlk_poly_invntt_tomont ✅ 2s 2s +0%
mlk_poly_mulcache_compute_c ✅ 2s 3s -33%
mlk_poly_mulcache_compute_native ✅ 2s 1s +100%
mlk_poly_sub ✅ 2s 1s +100%
mlk_poly_tobytes ✅ 2s 3s -33%
mlk_polyvec_decompress_du ✅ 2s 2s +0%
mlk_polyvec_mulcache_compute ✅ 2s 1s +100%
mlk_polyvec_permute_bitrev_to_custom_native ✅ 2s 2s +0%
mlk_polyvec_tobytes ✅ 2s 4s -50%
mlk_scalar_compress_d10 ✅ 2s 2s +0%
mlk_scalar_compress_d11 ✅ 2s 2s +0%
mlk_scalar_compress_d5 ✅ 2s 2s +0%
mlk_shake128x4_absorb_once ✅ 2s 2s +0%
mlk_shake128x4_squeezeblocks ✅ 2s 3s -33%
mlk_shake256 ✅ 2s 2s +0%
mlk_value_barrier_i32 ✅ 2s 2s +0%
mlk_value_barrier_u8 ✅ 2s 1s +100%
ntt_native_aarch64 ✅ 2s 1s +100%
poly_compress_d10_native_x86_64 ✅ 2s 2s +0%
poly_compress_d11_native_x86_64 ✅ 2s 3s -33%
poly_compress_d5_native_x86_64 ✅ 2s 2s +0%
poly_getnoise_eta1122_4x_native ✅ 2s 2s +0%
poly_tobytes_native_aarch64 ✅ 2s 3s -33%
poly_tomont_native_aarch64 ✅ 2s 2s +0%
poly_tomont_native_x86_64 ✅ 2s 4s -50%
polyvec_basemul_acc_montgomery_cached_k2_native_x86_64 ✅ 2s 2s +0%
polyvec_basemul_acc_montgomery_cached_k3_native_aarch64 ✅ 2s 1s +100%
polyvec_basemul_acc_montgomery_cached_k3_native_x86_64 ✅ 2s 2s +0%
polyvec_basemul_acc_montgomery_cached_k4_native_aarch64 ✅ 2s 2s +0%
keccak_f1600_x1_native_aarch64_v84a ✅ 1s 2s -50%
keccak_f1600_x4_native_aarch64_v84a ✅ 1s 5s -80%
keccakf1600x4_extract_bytes_native ✅ 1s 1s +0%
mlk_barrett_reduce ✅ 1s 2s -50%
mlk_ct_cmask_nonzero_u8 ✅ 1s 4s -75%
mlk_ct_cmov_zero ✅ 1s 3s -67%
mlk_keccakf1600x4_permute ✅ 1s 1s +0%
mlk_montgomery_reduce ✅ 1s 2s -50%
mlk_poly_compress_d5_native ✅ 1s 2s -50%
mlk_poly_decompress_d10 ✅ 1s 2s -50%
mlk_poly_decompress_d4_native ✅ 1s 2s -50%
mlk_poly_decompress_d5_c ✅ 1s 4s -75%
mlk_poly_frombytes ✅ 1s 1s +0%
mlk_poly_invntt_tomont_c ✅ 1s 1s +0%
mlk_poly_reduce_c ✅ 1s 2s -50%
mlk_poly_tomont_native ✅ 1s 1s +0%
mlk_polyvec_permute_bitrev_to_custom ✅ 1s 3s -67%
mlk_scalar_compress_d4 ✅ 1s 2s -50%
mlk_scalar_decompress_d5 ✅ 1s 1s +0%
mlk_shake128_squeezeblocks ✅ 1s 2s -50%
poly_compress_d4_native_x86_64 ✅ 1s 4s -75%
poly_mulcache_compute_native_aarch64 ✅ 1s 3s -67%
poly_reduce_native_aarch64 ✅ 1s 1s +0%
poly_reduce_native_x86_64 ✅ 1s 2s -50%
sys_check_capability ✅ 1s 3s -67%

@L-series L-series changed the title HOL-Light: improve tooling and CI" HOL-Light: improve tooling and CI Mar 20, 2026
@L-series L-series force-pushed the HOL-Light-CI branch 2 times, most recently from 724e0b1 to 9a3e91a Compare March 23, 2026 14:16
@L-series L-series marked this pull request as ready for review March 23, 2026 14:16
@L-series L-series requested a review from a team as a code owner March 23, 2026 14:16
@L-series
Copy link
Copy Markdown
Contributor Author

L-series commented Mar 23, 2026

Modified the two remaining occurences of _MEMSAFE to _SAFE in order to fit the expected format for aarch proofs.

@L-series L-series force-pushed the HOL-Light-CI branch 2 times, most recently from 25cad96 to 3e258d8 Compare March 23, 2026 14:55
@L-series L-series mentioned this pull request Apr 1, 2026
Draft
@mkannwischer mkannwischer self-assigned this Apr 2, 2026
mkannwischer
mkannwischer requested changes Apr 2, 2026
View reviewed changes
Copy link
Copy Markdown
Contributor

@mkannwischer mkannwischer left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks @L-series - I left a couple of comments.

This PR actually takes another approach that I had in mind: I thought that after running each HOL-Light proof we check for the expected theorems to be present.
The approach implemented here is more like a linter. But I support the addition!
The -a flag is highly appreciated - thank you!

Comment thread scripts/tests Outdated
Comment thread scripts/tests Outdated
Comment thread scripts/check-theorems Outdated
Comment thread .github/workflows/hol_light.yml Outdated
Comment thread scripts/check-theorems Outdated
Comment thread scripts/check-theorems Outdated
@L-series
Copy link
Copy Markdown
Contributor Author

L-series commented Apr 3, 2026

Thanks @L-series - I left a couple of comments.

This PR actually takes another approach that I had in mind: I thought that after running each HOL-Light proof we check for the expected theorems to be present. The approach implemented here is more like a linter. But I support the addition! The -a flag is highly appreciated - thank you!

Thank you for the review! Indeed, the idea I had in mind was that one should avoid using compute on proofs which do not contain the required theorems. However, I see now that there is still value running the HOL CI even if the routine is only partially proven.

mkannwischer
mkannwischer requested changes Apr 3, 2026
View reviewed changes
Copy link
Copy Markdown
Contributor

@mkannwischer mkannwischer left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks @L-series for the changes! I'm happy with the overall approach now.

Two comments still need to be addressed. Thank you!

Comment thread scripts/lint Outdated
Comment thread scripts/lint Outdated
mkannwischer
mkannwischer reviewed Apr 3, 2026
View reviewed changes
Comment thread proofs/hol_light/aarch64/proofs/mlkem_rej_uniform.ml Outdated
@mkannwischer
Copy link
Copy Markdown
Contributor

mkannwischer commented Apr 12, 2026

@L-series, gentle ping. Could you please adjust this PR so we can get this merged?

@mkannwischer
Copy link
Copy Markdown
Contributor

mkannwischer commented Apr 22, 2026

@L-series, are you still working on this?

@mkannwischer
Copy link
Copy Markdown
Contributor

mkannwischer commented May 3, 2026

@L-series, do you expect to finish this PR soon?

@L-series
Copy link
Copy Markdown
Contributor Author

L-series commented May 20, 2026

@L-series, do you expect to finish this PR soon?

Apologies for the long delay, I was away traveling this last month. I just pushed some changes and I've reworked check-theorems to derive the expected theorem prefix directly
from the filename (strip _aarch64_asm / _avx2_asm, uppercase, prepend MLKEM_ for
non-keccak) and grep for the fully-qualified theorem name. The only conditional is MEMSAFE
instead of SAFE for rej_uniform_*, per your earlier comment.

However, I just wanted to make sure that this is okay with you as it would require renaming around 15 proofs.

@mkannwischer
Copy link
Copy Markdown
Contributor

mkannwischer commented May 20, 2026 •
edited
Loading

@L-series, do you expect to finish this PR soon?

Apologies for the long delay, I was away traveling this last month. I just pushed some changes and I've reworked check-theorems to derive the expected theorem prefix directly from the filename (strip _aarch64_asm / _avx2_asm, uppercase, prepend MLKEM_ for non-keccak) and grep for the fully-qualified theorem name. The only conditional is MEMSAFE instead of SAFE for rej_uniform_*, per your earlier comment.

However, I just wanted to make sure that this is okay with you as it would require renaming around 15 proofs.

Thanks for picking this upa gain @L-series! Welcome back!
Renaming theorems to be uniform is no problem.

@L-series L-series force-pushed the HOL-Light-CI branch 2 times, most recently from 318c17a to ac97d80 Compare May 25, 2026 14:53
@mkannwischer
Copy link
Copy Markdown
Contributor

mkannwischer commented May 26, 2026 •
edited
Loading

@L-series, is this ready for review? Thanks for the work!

@L-series
Copy link
Copy Markdown
Contributor Author

L-series commented May 26, 2026

@mkannwischer Yes it is! Please let me know if the renaming scheme is appropriate. Given that the HOL proofing CI is passing I assume I didn't break any of the proofs 😅

@L-series L-series force-pushed the HOL-Light-CI branch 2 times, most recently from 594cb25 to 8a3f6d0 Compare May 27, 2026 13:01
L-series added 2 commits May 27, 2026 11:42
@L-series
testing: HOL-Light: add support for cross-proofing
31bf832 
This commit introduces a new flag --arch to the hol_light command of the
tests script that allows user specification of which architecture to
run/list the proofs for. If not passed, the behavior is unchanged.

Signed-off-by: Andreas Hatziiliou <andreas.hatziiliou@savoirfairelinux.com>
@L-series
lint: verify that all expected theorems are present
a583d82 
We add a check to the linting script called check-theorems that ensures that all HOL-Light
proofs provide the expected set of theorems depending on the
architecture.

Signed-off-by: Andreas Hatziiliou <andreas.hatziiliou@savoirfairelinux.com>
hanno-becker
hanno-becker reviewed May 28, 2026
View reviewed changes
Comment thread scripts/lint
Comment on lines +403 to +405
if ! grep -qE "^[[:space:]]*let ${theorem}[[:space:]]+=[[:space:]]+(time[[:space:]]+)?prove" "$file"; then
gh_error "${routine}" "" "Missing theorem" "${file}: ${theorem} not found"
success=false
Copy link
Copy Markdown
Contributor

@hanno-becker hanno-becker May 28, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggestion: Can we complement list_proofs.sh by list_thms.sh which runs this grep and emits all (so-declared) theorems? I'd like to have a little logic as possible in lint itself.

hanno-becker
hanno-becker reviewed May 28, 2026
View reviewed changes
Comment thread scripts/lint
Comment on lines +389 to +400
local expected=(
"${prefix}_CORRECT"
"${prefix}_SUBROUTINE_CORRECT"
"${prefix}_SUBROUTINE_${safe}"
)
if [[ $arch == "x86_64" ]]; then
expected+=(
"${prefix}_${safe}"
"${prefix}_NOIBT_SUBROUTINE_CORRECT"
"${prefix}_NOIBT_SUBROUTINE_${safe}"
)
fi
Copy link
Copy Markdown
Contributor

@hanno-becker hanno-becker May 28, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It would be nice to make this logic and exception more prominent... I wonder if one could define this in some TOML/YAML in proofs/{arch}... not sure if it's worth it. Ideas?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@mkannwischer mkannwischer mkannwischer requested changes

@hanno-becker hanno-becker hanno-becker left review comments

Requested changes must be addressed to merge this pull request.

Assignees

@mkannwischer mkannwischer

Labels

needs-mldsa-native-port

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

4 participants

@L-series @oqs-bot @mkannwischer @hanno-becker