Skip to main content
https://github.com/mupq/pqm4
12 December 2024, 07:39:28 UTC
sort by:
RevisionAuthorDateMessageCommit Date
8d44b72 Matthias J. Kannwischer13 August 2024, 00:06:44 UTCinit msg buffer in {speed,hashing}.c (#351)13 August 2024, 00:06:44 UTC
6554684 Matthias J. Kannwischer12 August 2024, 13:38:20 UTCUpdate AIMer implementations (#350) * add skiplist entries for new aimer implementations * remove old aimer benchmarks * add AIMer benchmarks * add missing aimer-128f benchmarks * track correct version of mupq12 August 2024, 13:38:20 UTC
7cead3c Matthias J. Kannwischer06 August 2024, 07:27:24 UTCAdd dependabot06 August 2024, 07:27:24 UTC
f2b698a Matthias J. Kannwischer06 August 2024, 07:21:58 UTCImprove Dilithium (speed) verification stack usage (#346) * Improve Dilithium (speed) verification stack usage Once upon a time, we wrote a paper on memory-efficient Dilithium [1] which included a speed-optimized version of verification that still included some memory optimizations that don't come at a performance penalty. Unfortunately with the update of the reference code to round 3 that version did not get migrated leading to some complaints about verification memory consumption. I finally found some time to port these. Verficication speed is essentially unchanged, but stack consumption is much better. [1] https://eprint.iacr.org/2020/1278.pdf * update benchmarks06 August 2024, 07:21:58 UTC
cda61fb Matthias J. Kannwischer03 July 2024, 03:02:34 UTCKyber: Fixed secret-dependent branch in poly_fromsg (#345) * Fixed secret-dependent branch in poly_fromsg * update mupq * update Kyber benchmarks * add missing prototype * extend skiplist * add Falcon benchmarks03 July 2024, 03:02:34 UTC
006a109 Amin Abdulrahman22 April 2024, 04:56:30 UTCSymlinks for dilithium m4fstack (#342)22 April 2024, 04:56:30 UTC
4584cfc Matthias J. Kannwischer16 April 2024, 01:24:06 UTCFix inlining of Kyber re-encryption (#339) * fix inlining of Kyber reencryption * update benchmarks16 April 2024, 01:24:06 UTC
149bfc7 Amin Abdulrahman16 April 2024, 01:00:42 UTCDilithium/ML-DSA Stack Optimizations (#340) * Init dilithium3 stack optimized variant * Start stack optimization [Passing] * Based on ideas from https://eprint.iacr.org/2022/323.pdf, based on code by Matthias J. Kannwischer * Sample A on-the-fly * Compressed c * Schoolbook mul for ct1 * Compress w * Eliminate z, y * Eliminate cp * Eliminate s1, s2 * Eliminate second poly needed for A*y * Note: Reverts poly_uniform_pointwise_montgomery_polywadd_stack to prior state * Inline sampling uniform and uniform_gamma1 * Inline hint generation * Inline polyw subtraction * Refactor decompose to high/lowbits * Inline Keccak state * Shared buffer for polynomials * rm 257 FFT * Union for small and big poly * Eliminate some smaller buffers * Remove asym small mul * Stack friendly uniform_gamma1 w/o add * Stack optimized Dilithium{2,5} * Switch to Plantard-based 769 NTT * First batch of stack opt for Verify * On-the-fly matrix generation * Schoolbook for ct1 * Challenge compression * On-the-fly unpacking for z, h * Compress w * rm tmp poly, subtract on wcomp * Verify Stack Optimizations * Stack friendly hint decoding * Eliminate second full poly * Remove K-loop from hint unpacking * rm buffers/unionize in Verify * Stack opt key pair * Minor clean up * Overlap buffers * Stack optimized challenge generation * Match 769 Plantard to m4f code * update skiplist * update benchmarks --------- Co-authored-by: Matthias J. Kannwischer <matthias@kannwischer.eu>16 April 2024, 01:00:42 UTC
9c2bc41 Huang Junhao15 April 2024, 07:30:22 UTCRevisiting Keccak and Dilithium Implementations on ARMv7-M (#338) * Use Plantard arithmetic for NTT_769 in Dilithium * rm old smallntt.S * update benchmarks --------- Co-authored-by: Matthias J. Kannwischer <matthias@kannwischer.eu>15 April 2024, 07:30:22 UTC
2c48508 Richard Petri27 March 2024, 14:10:26 UTCMerge pull request #337 from mupq/moreci More CI and add excluded schemes on all platforms27 March 2024, 14:10:26 UTC
4f5b5ce Richard Petri26 March 2024, 21:19:31 UTCMerge pull request #335 from mupq/duallicense Merge branch 'master' of github.com:mupq/pqm426 March 2024, 21:20:08 UTC
cc3481a Matthias J. Kannwischer26 March 2024, 21:09:22 UTCfix build for other platforms26 March 2024, 21:09:22 UTC
c33fab9 Matthias J. Kannwischer26 March 2024, 13:56:42 UTCfix nucleo-l476rg build26 March 2024, 13:56:42 UTC
c83565b Matthias J. Kannwischer26 March 2024, 13:42:01 UTCmore CI26 March 2024, 13:45:42 UTC
0c12777 Matthias J. Kannwischer26 March 2024, 13:32:23 UTCmore CI26 March 2024, 13:32:23 UTC
82c6d7a Matthias J. Kannwischer25 March 2024, 19:59:12 UTCadd uov to exluded schemes on nucleo_l446rg.mk25 March 2024, 19:59:12 UTC
5d0fe86 Matthias J. Kannwischer20 March 2024, 03:13:23 UTCAdds Apache-2.0 license in addition to CC0 To enable re-use in https://github.com/pq-code-package/mlkem-c-embedded. This is applied only to the sources of pqm4 itself that are to a vast degree written by the pqm4 maintainers. The scheme implementations plus symmetric primitives have other licenses.20 March 2024, 03:24:17 UTC
4b2fc60 Richard Petri19 March 2024, 12:35:18 UTCMerge pull request #333 from mupq/benchmarkupdate Update benchmarks and skiplist19 March 2024, 12:35:18 UTC
527e9d6 Richard Petri17 March 2024, 20:36:16 UTCUpdate benchmarks17 March 2024, 20:38:49 UTC
470917e Richard Petri17 March 2024, 20:38:08 UTCUpdate mupq17 March 2024, 20:38:49 UTC
b15618e Richard Petri27 February 2024, 20:55:55 UTCUpdate README.md to reflect the changes27 February 2024, 20:55:55 UTC
e698764 Richard Petri27 February 2024, 20:38:09 UTCUpdate skiplist.py27 February 2024, 20:38:09 UTC
e852f55 Richard Petri27 February 2024, 20:37:53 UTCUpdate mupq27 February 2024, 20:37:53 UTC
403c694 Richard Petri27 February 2024, 19:26:51 UTCMerge pull request #332 from mupq/nistdraftkyberdilithium NIST Draft version of Kyber and Dilithium; remove divisions by KYBER_Q27 February 2024, 19:26:51 UTC
c4fd63c Matthias J. Kannwischer23 February 2024, 07:51:58 UTCfix build on stm32f4discovery23 February 2024, 07:51:58 UTC
619a125 Matthias J. Kannwischer23 February 2024, 07:51:41 UTCinclude compat.h to allow SPHINCS+ to build23 February 2024, 07:51:41 UTC
0fa8f56 Matthias J. Kannwischer23 February 2024, 05:14:13 UTCDilithium compatibility with NIST draft23 February 2024, 07:50:49 UTC
edcf6f6 Matthias J. Kannwischer23 February 2024, 03:11:58 UTCeliminate / KYBER_Q that may result in variable time division This applies the patches from upstream to poly_compress and polyvec_compress See https://github.com/pq-crystals/kyber/commit/272125f6acc8e8b6850fd68ceb901a660ff48196 https://groups.google.com/a/list.nist.gov/g/pqc-forum/c/ldX0ThYJuBo/m/ovODsdY7AwAJ23 February 2024, 03:29:50 UTC
f418bf6 Matthias J. Kannwischer23 February 2024, 02:56:55 UTCupdate M4 Kyber to be compatible with NIST Draft23 February 2024, 02:56:55 UTC
5087fd8 Matthias J. Kannwischer23 February 2024, 02:56:33 UTCremove Kyber-90s; won't be standardized23 February 2024, 02:56:33 UTC
c839498 Matthias J. Kannwischer23 February 2024, 02:55:57 UTCupdate PQClean23 February 2024, 02:55:57 UTC
62244ef rpls24 January 2024, 11:30:45 UTCMerge pull request #331 from mupq/haetae-fix Use fixed HAETAE reference24 January 2024, 11:30:45 UTC
a39a172 Richard Petri24 January 2024, 11:29:33 UTCUse fixed HAETAE reference24 January 2024, 11:29:33 UTC
82f4e23 Richard Petri20 January 2024, 22:39:05 UTCMerge branch 'update-PERK-m4' improve compression for PERK short levels I and II #32820 January 2024, 22:39:05 UTC
4702ce9 Marco Palumbi20 January 2024, 09:21:05 UTCimprove compression for short levels I and II20 January 2024, 09:21:05 UTC
ca8b4f3 rpls19 January 2024, 14:03:07 UTCMerge pull request #327 from mupq/tuov Add Tuov19 January 2024, 14:03:07 UTC
1ccd61f Richard Petri19 January 2024, 13:42:57 UTCExclude tuov from builds19 January 2024, 13:57:15 UTC
f514356 Richard Petri19 January 2024, 13:36:36 UTCAdd Tuov19 January 2024, 13:36:36 UTC
bfd8248 rpls18 January 2024, 12:22:15 UTCMerge pull request #325 from mupq/mirith-fix Update for MiRitH18 January 2024, 12:22:15 UTC
a0dec92 Richard Petri18 January 2024, 12:20:05 UTCUse updated version of mirith, add embedded optimized version18 January 2024, 12:20:05 UTC
54d8313 Richard Petri16 January 2024, 22:34:10 UTCRun only on push to master, and when PR review requested16 January 2024, 22:37:11 UTC
d2a8800 Richard Petri16 January 2024, 21:36:40 UTCProperly wrap missing libc functions and shut up linker warning16 January 2024, 22:37:11 UTC
dfc968a rpls24 November 2023, 12:21:04 UTCUpdate workflow dependencies16 January 2024, 22:37:11 UTC
0a47489 rpls03 November 2022, 22:00:33 UTCCheckout submodules recursively16 January 2024, 22:37:11 UTC
ee2a6ea rpls03 November 2022, 21:55:10 UTCAdd a github workflow16 January 2024, 22:37:11 UTC
b381da5 Richard Petri16 January 2024, 21:06:29 UTCExclude all non-building schemes for cw308t-stm32f41516 January 2024, 21:20:31 UTC
5398081 Richard Petri16 January 2024, 20:58:48 UTCMerge branch 'master' of https://github.com/37eex9/pqm4 into cw308t-stm32f41516 January 2024, 20:58:48 UTC
ff6b7ab Richard Petri16 January 2024, 20:57:20 UTCMerge remote-tracking branch 'origin/mirith'16 January 2024, 20:57:20 UTC
cf017cd Richard Petri16 January 2024, 20:56:42 UTCMerge remote-tracking branch 'origin/biscuit'16 January 2024, 20:56:42 UTC
1c27aa0 Richard Petri16 January 2024, 20:54:18 UTCAdd MEDS16 January 2024, 20:54:18 UTC
d93ba34 Richard Petri16 January 2024, 19:41:35 UTCMerge remote-tracking branch 'origin/aimer' into master16 January 2024, 19:41:35 UTC
de6b4d9 Richard Petri16 January 2024, 18:06:55 UTCMerge remote-tracking branch 'origin/sphinca' into sphincsa Add SPHINCS-alpha #31216 January 2024, 18:06:55 UTC
57bb7dc Matthias J. Kannwischer15 January 2024, 13:19:53 UTCupdate mupq15 January 2024, 13:19:53 UTC
a34a481 Matthias J. Kannwischer12 January 2024, 14:46:55 UTCadd AIMer12 January 2024, 16:23:54 UTC
8e64b0e Richard Petri11 January 2024, 19:48:54 UTCMerge remote-tracking branch 'origin/snova'11 January 2024, 19:48:54 UTC
fbebf44 Richard Petri11 January 2024, 18:30:42 UTCRemove old perk entries from skiplist Fixes #32111 January 2024, 18:30:42 UTC
c3dbd50 Matthias J. Kannwischer11 January 2024, 10:14:04 UTCadd skiplist entries for mqom11 January 2024, 18:22:33 UTC
759389b Richard Petri07 January 2024, 23:21:31 UTCAdd HAETAE to skiplist and update mupq07 January 2024, 23:21:31 UTC
4ad3ef6 Richard Petri07 January 2024, 23:08:59 UTCMerge branch 'haetae' of https://github.com/mmoeller23/pqm4 into mmoeller23-haetae07 January 2024, 23:08:59 UTC
1fa2eac Richard Petri07 January 2024, 23:04:19 UTCAdd perk to skiplist and update mupq07 January 2024, 23:04:19 UTC
f376768 Richard Petri07 January 2024, 22:28:47 UTCMerge branch 'add-PERK-m4' of https://github.com/marco-palumbi/pqm4 into marco-palumbi-add-PERK-m407 January 2024, 22:28:47 UTC
a7fe0c1 Marco Palumbi05 January 2024, 18:19:56 UTCuse symbolic links whenever possible05 January 2024, 18:19:56 UTC
d98a162 Matthias J. Kannwischer18 December 2023, 02:07:27 UTCUpdate Kyber poly_tomsg to fix timing leak (w/ -Os) This (partially) addresses https://github.com/mupq/pqm4/issues/319. The function poly_tomsg from the reference implementation of Kyber (which was copied into the M4-optimized implementations) would result in a variable-time udiv instruction operating on secret data when compiled with gcc using -Os. I tried a couple of versions from gcc 11 to gcc 13, but did not see any difference. This commit updates the m4-specific code to use the patch from https://github.com/pq-crystals/kyber/commit/dda29cc63af721981ee2c831cf00822e69be3220. Note that the code in PQClean has not yet been updated and hence the clean implementation within pqm4 is still vulnerable.19 December 2023, 13:44:24 UTC
4956a30 Marco Palumbi07 December 2023, 13:17:04 UTCfix ldscripts for the stm32f4discovery board07 December 2023, 13:17:04 UTC
d581941 Marco Palumbi07 December 2023, 13:10:59 UTCuse fullram linker script with some version07 December 2023, 13:10:59 UTC
8dc5cf5 Marco Palumbi07 December 2023, 12:59:00 UTCadd PERK for all NIST levels Implementation compliant with version v1.1 of 2023/10/16 https://pqc-perk.org/07 December 2023, 13:06:08 UTC
8719b8e Marc01 December 2023, 10:39:22 UTCMove reference implementations to MUPQ/MUPQ The pure C reference implementations were removed from this pull request. A corresponding pull request in MUPQ/MUPQ has been initiated: https://github.com/mupq/mupq/pull/13101 December 2023, 10:39:30 UTC
f7aedf0 Marc01 December 2023, 08:30:58 UTCAdd low-mem ref implementation to all schemes Add slightly modified reference implementations to haetae2, haetae3 and haetae5, labeled as `ref`, with lower stack memory footprint than the original reference implementation. This enables running testvectors.py for all schemes. CAVEAT: This commit modifies the following PQM4 core files * ldscripts/stm32f4discovery.ld * ldscripts/stm32f4discovery_fullram.ld * mk/stm32f4discovery.mk The two load scripts are modified as recommended in [issue 310](https://github.com/mupq/pqm4/issues/310#issuecomment-1810255939). The make file is modified to use full ram for the implementations m4f and ref of scheme haetae5, as they would run out of memory otherwise, similar to dilithium5. The stack memory footprint was reduced by: * Storing A1 using uint16 instead of int32, halving its footprint * Grouping some vectors inside `crypto_sign_signature()`, whose periods of liveliness do not overlap, into unions. The modification is light enough to easily verify consistency with the reference implementation.01 December 2023, 08:38:02 UTC
e122421 Marc01 December 2023, 08:17:04 UTCadd low-mem ref implementation to all schemes Add slightly modified reference implementations to haetae2, Add slightly modified reference implementations to haetae2, haetae3 and haetae5 with lower stack memory footprint than the original reference implementation. This enables the test vector comparison for all schemes. CAVEAT: This commit modifies the following PQM4 core files * ldscripts/stm32f4discovery.ld * ldscripts/stm32f4discovery_fullram.ld * mk/stm32f4discovery.mk The two load scripts are modified as recommended in [issue 310](https://github.com/mupq/pqm4/issues/310#issuecomment-1810255939). The make file is modified to use full ram for the implementations m4f and ref of scheme haetae5, as they would run out of memory otherwise, similar to dilithium5. The stack memory footprint was reduced by: * Storing A1 using uint16 instead of int32, halving its footprint * Grouping some vectors inside `crypto_sign_signature()`, whose periods of liveliness do not overlap, into unions. The modification is light enough to easily verify consistency with the reference implementation.01 December 2023, 08:18:31 UTC
258a11f Marc27 November 2023, 10:36:32 UTCadd ref implementation for haetae2 stack usage (keypair/sign/verify): * haetae2: 26152 / 83128 / 2985601 December 2023, 08:14:29 UTC
76f069c Till Eifert27 October 2023, 05:48:26 UTCstm32f415: enable hw rng and extend clock setup update interface.py platform_memory to handle stm32f41526 November 2023, 12:06:42 UTC
bd9b47d Matthias J. Kannwischer25 November 2023, 07:24:26 UTCrecompute static tables25 November 2023, 07:24:26 UTC
c8b3456 Matthias J. Kannwischer24 November 2023, 09:11:57 UTCdo expensive pre-computation only once24 November 2023, 09:11:57 UTC
dc26f54 Richard Petri24 November 2023, 08:56:49 UTCUpdate mupq24 November 2023, 08:56:49 UTC
991a5b6 Richard Petri24 November 2023, 08:53:06 UTCUpdate skiplist for bike24 November 2023, 08:54:00 UTC
c37de3c Richard Petri24 November 2023, 08:36:28 UTCMerge branch 'bike-round4' of https://github.com/37eex9/pqm4 into 37eex9-bike-round424 November 2023, 08:36:28 UTC
8821d31 Richard Petri24 November 2023, 08:05:20 UTCAdd MiRitH24 November 2023, 08:05:20 UTC
71f0daa Richard Petri24 November 2023, 07:58:50 UTCAdd biscuit24 November 2023, 08:02:41 UTC
d436546 Richard Petri24 November 2023, 07:54:08 UTCMerge remote-tracking branch 'origin/cross'24 November 2023, 07:54:08 UTC
694a4a8 Matthias J. Kannwischer24 November 2023, 07:52:07 UTCeliminate static memory24 November 2023, 07:52:07 UTC
968fbef Richard Petri24 November 2023, 07:51:35 UTCMerge remote-tracking branch 'origin/asconsign'24 November 2023, 07:51:35 UTC
f955de1 Richard Petri24 November 2023, 07:49:22 UTCMerge remote-tracking branch 'origin/perk'24 November 2023, 07:49:22 UTC
111ea35 Richard Petri24 November 2023, 07:48:02 UTCMerge remote-tracking branch 'origin/hawk'24 November 2023, 07:48:02 UTC
a35e15b Richard Petri24 November 2023, 07:45:36 UTCMerge remote-tracking branch 'origin/mayo'24 November 2023, 07:45:36 UTC
c2438e0 Matthias J. Kannwischer24 November 2023, 07:41:59 UTCturn into symlinks24 November 2023, 07:41:59 UTC
3bac106 Marc23 November 2023, 09:44:48 UTCAdds HAETAE This commit implements the post-quantum signature scheme HAETAE from https://eprint.iacr.org/2023/624 https://kpqc.cryptolab.co.kr/haetae The stack strategy can be selected in config.h by setting STACK_STRATEGY to the appropriate value (run "make clean" after the change). * 0 or undefined: Optimized for speed (default). * 1: Disable buffers for the polynomials of the verification key in crypto_sign_keypair() and crypto_sign(). This reduces speed, as the key needs to be recomputed after each rejection. * 2: In addition to 1, sample the hyperball in multiple passes, such that some intermediate values are computed on demand, rather than being buffered. This roughly doubles the runtime of crypto_sign().23 November 2023, 09:44:59 UTC
8e19ad7 Matthias J. Kannwischer23 November 2023, 09:07:07 UTCadd SPHINCS-alpha23 November 2023, 09:07:07 UTC
b48968e Marc22 November 2023, 16:28:46 UTCUpdate HAETAE This commit implements the post-quantum signature scheme HAETAE from https://eprint.iacr.org/2023/624 https://kpqc.cryptolab.co.kr/haetae The stack strategy can be chosen config.h by setting STACK_STRATEGY to the appropriate value (run "make clean" when changing it). * 0 or undefined: Optimized for speed (default). * 1: Disable buffers for the polynomials of the verification key in crypto_sign_keypair() and crypto_sign(). This reduces speed, as the key needs to be recomputed after each rejection. * 2: In addition to 1, sample the hyperball in multiple passes, such that some intermediate values are computed on demand, rather than being buffered. This roughly doubles the runtime of crypto_sign(). The scheme HAETAE2 contains a reference implementation, which has been renamed from "clean" in previous commits to "ref". The reference implementation would run out of memory for schemes HAETAE3 and HAETAE5 and is therefore not included for these schemes.22 November 2023, 16:28:54 UTC
fe44f74 Marc22 November 2023, 16:13:43 UTCMerge branch 'haetae_dev' into haetae22 November 2023, 16:13:43 UTC
0bdc33e Marc22 November 2023, 16:10:51 UTCadd clean implementation for HAETAE2 The clean implementation is only minimally changed from the reference implementation to conform with the PQM4 API. The clean implementation would run out of memory for HAETAE3 and HAETAE5 and is therefore not added for those modes.22 November 2023, 16:10:51 UTC
a031ee4 Marc22 November 2023, 14:56:35 UTCadd STACK_STRATEGY switch to config.h This implementation offers different stack strategies: * 0: Optimized for speed. * 1: Does not buffer the polynomials of the verification key in crypto_sign_keypair() and crypto_sign_signature(), thus reducing stack usage at the cost of some speed. * 2: In addition to 1, the hyperballs are sampled in multiple passes in crypto_sign_signature(), which reduces the stack usage for temporary variables. This roughly doubles the execution time of crypto_sign_signature().22 November 2023, 14:56:44 UTC
7eee34e Marc21 November 2023, 22:58:03 UTCcompute challenge polynomial directly and sample hyperball coin deterministically * Move challenge seed generation from crypto_sign() to poly_challenge(). * Sample the random byte b deterministically inside of polyfixveclk_sample_hyperball(). It is used to: * determine the sign in hyperball sampling (bit mask 0x01) * reject with 50% odds in the overlap region (bit mask 0x02) * M4F version corresponds to reference version of 2023-11-20.22 November 2023, 07:33:13 UTC
564ac86 Marc20 November 2023, 23:01:11 UTCinitial commit of HAETAE M4F version corresponds to reference version of 2023-10-21.20 November 2023, 23:01:11 UTC
92f0187 Matthias J. Kannwischer16 November 2023, 06:32:42 UTCAdd SNOVA16 November 2023, 06:32:42 UTC
ec5c844 rpls15 November 2023, 15:56:12 UTCAdd progress bar support (#307) * Add progress bar support * Raise exit-code if tests fail * Update mupq * Add forgotten import * Update mupq15 November 2023, 15:56:12 UTC
f8fdca2 Matthias J. Kannwischer14 November 2023, 07:54:37 UTCuse pqm4/mupq sha214 November 2023, 07:54:37 UTC
179b50b Matthias J. Kannwischer14 November 2023, 07:11:47 UTCAdd cross-{sha2,sha3}-r-sdp{,g}-{1,3,5}-{small,fast}14 November 2023, 07:11:47 UTC
f638ce6 Matthias J. Kannwischer13 November 2023, 09:06:08 UTCAdd ascon-sign{128,192}{s,f}-{simple,robust}13 November 2023, 09:06:08 UTC
c96e268 Matthias J. Kannwischer07 November 2023, 07:22:21 UTCAdd perk perk-128-fast-{3,5} should be able to run on the 640 KB RAM board. The perk-{192,256}-short-* are out of reach even with 4 MB RAM in qemu, so I did not include those. The remaining ones run in 4 MB RAM, but won't run on the board.07 November 2023, 09:09:48 UTC
135cca9 Richard Petri07 November 2023, 07:26:49 UTCUpdate mupq07 November 2023, 07:26:49 UTC
back to top