Skip to content

[TEST] Reduce crypto_sign_verify_internal stack usage #751

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
mkannwischer wants to merge 8 commits into
base: main
Choose a base branch
from
Draft

[TEST] Reduce crypto_sign_verify_internal stack usage #751

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
8 commits
Select commit Hold shift + click to select a range
c15215f
Introduce mld_polymat_get_row() helper function
hanno-becker Nov 25, 2025
4f2a1aa
Add configuration option for reduced memory usage
hanno-becker Nov 25, 2025
24a2d2a
[TEST] Enable reduced RAM option by default
hanno-becker Nov 25, 2025
d5f7fe6
verify stack usage: Reuse t1/w1 polyveck
mkannwischer Nov 29, 2025
33ae864
verify stack usage: reuse mat/c2 buffer
mkannwischer Nov 29, 2025
77b9c0c
verify stack usage: Unpack h on the fly
mkannwischer Nov 29, 2025
5c3053b
verify stack usage: unpack t1 on the fly + share tmp/mat buffer
mkannwischer Nov 29, 2025
90a2202
verify stack usage: reuse z/cp buffer
mkannwischer Nov 29, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions BIBLIOGRAPHY.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -30,6 +30,7 @@ source code and documentation.
- [examples/monolithic_build/mldsa_native/mldsa_native_config.h](examples/monolithic_build/mldsa_native/mldsa_native_config.h)
- [examples/monolithic_build_multilevel/mldsa_native/mldsa_native_config.h](examples/monolithic_build_multilevel/mldsa_native/mldsa_native_config.h)
- [examples/monolithic_build_multilevel_native/mldsa_native/mldsa_native_config.h](examples/monolithic_build_multilevel_native/mldsa_native/mldsa_native_config.h)
- [examples/monolithic_build_native/config_65.h](examples/monolithic_build_native/config_65.h)
- [examples/monolithic_build_native/mldsa_native/mldsa_native_config.h](examples/monolithic_build_native/mldsa_native/mldsa_native_config.h)
- [examples/multilevel_build/mldsa_native/mldsa_native_config.h](examples/multilevel_build/mldsa_native/mldsa_native_config.h)
- [examples/multilevel_build_native/mldsa_native/mldsa_native_config.h](examples/multilevel_build_native/mldsa_native/mldsa_native_config.h)
Expand Down Expand Up @@ -76,6 +77,7 @@ source code and documentation.
- [examples/monolithic_build/mldsa_native/mldsa_native_config.h](examples/monolithic_build/mldsa_native/mldsa_native_config.h)
- [examples/monolithic_build_multilevel/mldsa_native/mldsa_native_config.h](examples/monolithic_build_multilevel/mldsa_native/mldsa_native_config.h)
- [examples/monolithic_build_multilevel_native/mldsa_native/mldsa_native_config.h](examples/monolithic_build_multilevel_native/mldsa_native/mldsa_native_config.h)
- [examples/monolithic_build_native/config_65.h](examples/monolithic_build_native/config_65.h)
- [examples/monolithic_build_native/mldsa_native/mldsa_native_config.h](examples/monolithic_build_native/mldsa_native/mldsa_native_config.h)
- [examples/multilevel_build/mldsa_native/mldsa_native_config.h](examples/multilevel_build/mldsa_native/mldsa_native_config.h)
- [examples/multilevel_build_native/mldsa_native/mldsa_native_config.h](examples/multilevel_build_native/mldsa_native/mldsa_native_config.h)
Expand Down
9 changes: 9 additions & 0 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -151,6 +151,15 @@ contracts and loop invariants from the code; they will be ignored unless `CBMC`

Yes. mldsa-native supports all three ML-DSA security levels (ML-DSA-44, ML-DSA-65, ML-DSA-87) as defined in FIPS 204. The security level is a compile-time parameter configured by setting `MLD_CONFIG_PARAMETER_SET=44/65/87` in [config.h](mldsa/src/config.h).

### Can I reduce RAM usage for embedded systems?

Yes. mldsa-native provides a compile-time option `MLD_CONFIG_REDUCE_RAM` that reduces RAM usage by generating matrix rows on-demand rather than storing the entire matrix in memory. This trades memory for performance:

- **Memory savings**: 12 KB (ML-DSA-44), 25 KB (ML-DSA-65), 49 KB (ML-DSA-87)
- **Performance cost**: Matrix generation is no longer batched, resulting in slower signing and verification

To enable this mode, define `MLD_CONFIG_REDUCE_RAM` in [config.h](mldsa/src/config.h) or pass `-DMLD_CONFIG_REDUCE_RAM` as a compiler flag.

### Does mldsa-native use hedged or deterministic signing?

By default, mldsa-native uses the randomized "hedged" signing variant as specified in FIPS 204 Section 3.4. The hedged variant uses both fresh randomness at signing time and precomputed randomness from the private key. This helps mitigate fault injection attacks and side-channel attacks while protecting against potential flaws in the random number generator.
Expand Down
18 changes: 18 additions & 0 deletions examples/basic_deterministic/mldsa_native/mldsa_native_config.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -621,6 +621,24 @@
*****************************************************************************/
/* #define MLD_CONFIG_SERIAL_FIPS202_ONLY */

/******************************************************************************
* Name: MLD_CONFIG_REDUCE_RAM
*
* Description: Set this to reduce RAM usage by generating matrix rows
* on-demand rather than storing the entire matrix in memory.
*
* This trades memory for performance:
* - Memory savings: 12 KB (ML-DSA-44), 25 KB (ML-DSA-65),
* 49 KB (ML-DSA-87)
* - Performance cost: Matrix generation is no longer batched,
* resulting in slower signing and verification
*
* This option is useful for embedded systems with tight RAM
* constraints but relaxed performance requirements.
*
*****************************************************************************/
#define MLD_CONFIG_REDUCE_RAM

/************************* Config internals ********************************/

#endif /* MLD_BUILD_INTERNAL */
Expand Down
18 changes: 18 additions & 0 deletions examples/bring_your_own_fips202/mldsa_native/mldsa_native_config.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -621,6 +621,24 @@
*****************************************************************************/
/* #define MLD_CONFIG_SERIAL_FIPS202_ONLY */

/******************************************************************************
* Name: MLD_CONFIG_REDUCE_RAM
*
* Description: Set this to reduce RAM usage by generating matrix rows
* on-demand rather than storing the entire matrix in memory.
*
* This trades memory for performance:
* - Memory savings: 12 KB (ML-DSA-44), 25 KB (ML-DSA-65),
* 49 KB (ML-DSA-87)
* - Performance cost: Matrix generation is no longer batched,
* resulting in slower signing and verification
*
* This option is useful for embedded systems with tight RAM
* constraints but relaxed performance requirements.
*
*****************************************************************************/
#define MLD_CONFIG_REDUCE_RAM

/************************* Config internals ********************************/

#endif /* MLD_BUILD_INTERNAL */
Expand Down
18 changes: 18 additions & 0 deletions examples/bring_your_own_fips202_static/mldsa_native/mldsa_native_config.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -622,6 +622,24 @@
*****************************************************************************/
#define MLD_CONFIG_SERIAL_FIPS202_ONLY

/******************************************************************************
* Name: MLD_CONFIG_REDUCE_RAM
*
* Description: Set this to reduce RAM usage by generating matrix rows
* on-demand rather than storing the entire matrix in memory.
*
* This trades memory for performance:
* - Memory savings: 12 KB (ML-DSA-44), 25 KB (ML-DSA-65),
* 49 KB (ML-DSA-87)
* - Performance cost: Matrix generation is no longer batched,
* resulting in slower signing and verification
*
* This option is useful for embedded systems with tight RAM
* constraints but relaxed performance requirements.
*
*****************************************************************************/
#define MLD_CONFIG_REDUCE_RAM

/************************* Config internals ********************************/

#endif /* MLD_BUILD_INTERNAL */
Expand Down
18 changes: 18 additions & 0 deletions examples/custom_backend/mldsa_native/mldsa_native_config.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -617,6 +617,24 @@
*****************************************************************************/
/* #define MLD_CONFIG_SERIAL_FIPS202_ONLY */

/******************************************************************************
* Name: MLD_CONFIG_REDUCE_RAM
*
* Description: Set this to reduce RAM usage by generating matrix rows
* on-demand rather than storing the entire matrix in memory.
*
* This trades memory for performance:
* - Memory savings: 12 KB (ML-DSA-44), 25 KB (ML-DSA-65),
* 49 KB (ML-DSA-87)
* - Performance cost: Matrix generation is no longer batched,
* resulting in slower signing and verification
*
* This option is useful for embedded systems with tight RAM
* constraints but relaxed performance requirements.
*
*****************************************************************************/
#define MLD_CONFIG_REDUCE_RAM

/************************* Config internals ********************************/

#endif /* MLD_BUILD_INTERNAL */
Expand Down
18 changes: 18 additions & 0 deletions examples/monolithic_build/mldsa_native/mldsa_native_config.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -620,6 +620,24 @@
*****************************************************************************/
/* #define MLD_CONFIG_SERIAL_FIPS202_ONLY */

/******************************************************************************
* Name: MLD_CONFIG_REDUCE_RAM
*
* Description: Set this to reduce RAM usage by generating matrix rows
* on-demand rather than storing the entire matrix in memory.
*
* This trades memory for performance:
* - Memory savings: 12 KB (ML-DSA-44), 25 KB (ML-DSA-65),
* 49 KB (ML-DSA-87)
* - Performance cost: Matrix generation is no longer batched,
* resulting in slower signing and verification
*
* This option is useful for embedded systems with tight RAM
* constraints but relaxed performance requirements.
*
*****************************************************************************/
#define MLD_CONFIG_REDUCE_RAM

/************************* Config internals ********************************/

#endif /* MLD_BUILD_INTERNAL */
Expand Down
18 changes: 18 additions & 0 deletions examples/monolithic_build_multilevel/mldsa_native/mldsa_native_config.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -621,6 +621,24 @@
*****************************************************************************/
/* #define MLD_CONFIG_SERIAL_FIPS202_ONLY */

/******************************************************************************
* Name: MLD_CONFIG_REDUCE_RAM
*
* Description: Set this to reduce RAM usage by generating matrix rows
* on-demand rather than storing the entire matrix in memory.
*
* This trades memory for performance:
* - Memory savings: 12 KB (ML-DSA-44), 25 KB (ML-DSA-65),
* 49 KB (ML-DSA-87)
* - Performance cost: Matrix generation is no longer batched,
* resulting in slower signing and verification
*
* This option is useful for embedded systems with tight RAM
* constraints but relaxed performance requirements.
*
*****************************************************************************/
#define MLD_CONFIG_REDUCE_RAM

/************************* Config internals ********************************/

#endif /* MLD_BUILD_INTERNAL */
Expand Down
18 changes: 18 additions & 0 deletions examples/monolithic_build_multilevel_native/mldsa_native/mldsa_native_config.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -628,6 +628,24 @@ static MLD_INLINE void mld_randombytes(uint8_t *ptr, size_t len)
*****************************************************************************/
/* #define MLD_CONFIG_SERIAL_FIPS202_ONLY */

/******************************************************************************
* Name: MLD_CONFIG_REDUCE_RAM
*
* Description: Set this to reduce RAM usage by generating matrix rows
* on-demand rather than storing the entire matrix in memory.
*
* This trades memory for performance:
* - Memory savings: 12 KB (ML-DSA-44), 25 KB (ML-DSA-65),
* 49 KB (ML-DSA-87)
* - Performance cost: Matrix generation is no longer batched,
* resulting in slower signing and verification
*
* This option is useful for embedded systems with tight RAM
* constraints but relaxed performance requirements.
*
*****************************************************************************/
#define MLD_CONFIG_REDUCE_RAM

/************************* Config internals ********************************/

#endif /* MLD_BUILD_INTERNAL */
Expand Down
Loading
Loading