Google Git
Sign in
boringssl/boringssl/850a037a1a600d9a4e8661ee3c1f8d65c4d071c3
commit
850a037a1a600d9a4e8661ee3c1f8d65c4d071c3
[log]
author
Rudolf Polzer <rpolzer@google.com>
Tue Sep 01 09:34:47 2026 -0700
committer
boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com <boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com>
Wed Sep 02 22:26:50 2026 -0700
tree
e1a0d129fd6ca805a95fd1bd8c58c593fd7d95e5
parent
c66572ad4dcdbd388a2802378a7e422a7f7d82e1 [diff]
ML-DSA: Add branchless pre-paths to `scalar_from_keccak_block_vartime`.

Step sizes were tuned to be two steps below the performance cliff on the
two machines I could test on - as such, it might be possible to go one
power of two up with both, but I have not tested x86-32 with gcc yet.

This mirrors I29afe4aa283b686b9fc3877e059931f46a6a6964.

Benchmark results show visible improvements on aarch64, and minor
improvements (and some noise) on x86-64.

aarch64 Apple M1 Pro:

Did 478406 BM_SpeedMLDSAKeyGen/ml_dsa_44/threads:1 operations (34062.0 ops/sec) [+2.3%]
Did 113081 BM_SpeedMLDSASign/ml_dsa_44/threads:1 operations (8081.8 ops/sec) [+0.7%]
Did 548225 BM_SpeedMLDSAVerify/ml_dsa_44/threads:1 operations (38954.3 ops/sec) [+3.5%]
Did 550051 BM_SpeedMLDSAVerifyBadSignature/ml_dsa_44/threads:1 operations (39301.2 ops/sec) [+4.3%]
Did 292483 BM_SpeedMLDSAKeyGen/ml_dsa_65/threads:1 operations (20914.8 ops/sec) [+4.2%]
Did 72096 BM_SpeedMLDSASign/ml_dsa_65/threads:1 operations (5259.3 ops/sec) [+2.6%]
Did 353481 BM_SpeedMLDSAVerify/ml_dsa_65/threads:1 operations (25263.4 ops/sec) [+4.0%]
Did 353876 BM_SpeedMLDSAVerifyBadSignature/ml_dsa_65/threads:1 operations (25129.6 ops/sec) [+3.0%]
Did 188579 BM_SpeedMLDSAKeyGen/ml_dsa_87/threads:1 operations (13391.8 ops/sec) [+4.3%]
Did 63078 BM_SpeedMLDSASign/ml_dsa_87/threads:1 operations (4445.1 ops/sec) [+1.9%]
Did 212113 BM_SpeedMLDSAVerify/ml_dsa_87/threads:1 operations (15163.5 ops/sec) [+3.2%]
Did 212799 BM_SpeedMLDSAVerifyBadSignature/ml_dsa_87/threads:1 operations (15245.3 ops/sec) [+4.2%]

x86-64 AMD EPYC 7B13:

Did 282226 BM_SpeedMLDSAKeyGen/ml_dsa_44/threads:1 operations (20139.5 ops/sec) [+1.0%]
Did 72860 BM_SpeedMLDSASign/ml_dsa_44/threads:1 operations (5151.6 ops/sec) [+0.5%]
Did 338622 BM_SpeedMLDSAVerify/ml_dsa_44/threads:1 operations (24190.9 ops/sec) [-0.1%]
Did 338496 BM_SpeedMLDSAVerifyBadSignature/ml_dsa_44/threads:1 operations (24209.9 ops/sec) [-0.3%]
Did 169634 BM_SpeedMLDSAKeyGen/ml_dsa_65/threads:1 operations (12109.9 ops/sec) [+0.6%]
Did 47056 BM_SpeedMLDSASign/ml_dsa_65/threads:1 operations (3360.3 ops/sec) [+0.0%]
Did 213332 BM_SpeedMLDSAVerify/ml_dsa_65/threads:1 operations (15228.8 ops/sec) [+0.6%]
Did 213440 BM_SpeedMLDSAVerifyBadSignature/ml_dsa_65/threads:1 operations (15239.7 ops/sec) [+0.7%]
Did 112765 BM_SpeedMLDSAKeyGen/ml_dsa_87/threads:1 operations (8066.8 ops/sec) [+1.6%]
Did 40735 BM_SpeedMLDSASign/ml_dsa_87/threads:1 operations (2908.1 ops/sec) [-0.2%]
Did 132878 BM_SpeedMLDSAVerify/ml_dsa_87/threads:1 operations (9494.2 ops/sec) [+0.3%]
Did 133291 BM_SpeedMLDSAVerifyBadSignature/ml_dsa_87/threads:1 operations (9490.9 ops/sec) [+0.6%]

Bug: 503700354
Change-Id: If01af7f92b2050176c96b77844505f216a6a6964
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/102108
Reviewed-by: David Benjamin <davidben@google.com>
Auto-Submit: Rudolf Polzer <rpolzer@google.com>
Commit-Queue: Rudolf Polzer <rpolzer@google.com>
1 file changed
tree: e1a0d129fd6ca805a95fd1bd8c58c593fd7d95e5
  1. .agents/
  2. .bcr/
  3. .github/
  4. agents/
  5. bench/
  6. cmake/
  7. crypto/
  8. decrepit/
  9. docs/
  10. fuzz/
  11. gen/
  12. include/
  13. infra/
  14. pki/
  15. rust/
  16. ssl/
  17. third_party/
  18. tool/
  19. util/
  20. .bazelignore
  21. .bazelrc
  22. .bazelversion
  23. .clang-format
  24. .clang-format-ignore
  25. .clangd
  26. .gitattributes
  27. .gitignore
  28. API-CONVENTIONS.md
  29. AUTHORS
  30. BREAKING-CHANGES.md
  31. BUILD.bazel
  32. build.json
  33. BUILDING.md
  34. CMakeLists.txt
  35. codereview.settings
  36. CONTRIBUTING.md
  37. FUZZING.md
  38. go.mod
  39. go.sum
  40. INCORPORATING.md
  41. LICENSE
  42. MODULE.bazel
  43. MODULE.bazel.lock
  44. PORTING.md
  45. PRESUBMIT.py
  46. PrivacyInfo.xcprivacy
  47. README.md
  48. SANDBOXING.md
  49. SECURITY.md
  50. STYLE.md
README.md

BoringSSL

BoringSSL is a fork of OpenSSL that is designed to meet Google's needs.

Although BoringSSL is an open source project, it is not intended for general use, as OpenSSL is. We don't recommend that third parties depend upon it. Doing so is likely to be frustrating because there are no guarantees of API or ABI stability.

Programs ship their own copies of BoringSSL when they use it and we update everything as needed when deciding to make API changes. This allows us to mostly avoid compromises in the name of compatibility. It works for us, but it may not work for you.

BoringSSL arose because Google used OpenSSL for many years in various ways and, over time, built up a large number of patches that were maintained while tracking upstream OpenSSL. As Google's product portfolio became more complex, more copies of OpenSSL sprung up and the effort involved in maintaining all these patches in multiple places was growing steadily.

Currently BoringSSL is the SSL library in Chrome/Chromium, Android (but it's not part of the NDK) and a number of other apps/programs.

Project links:

To file a security issue, use the Chromium process and mention in the report this is for BoringSSL. You can ignore the parts of the process that are specific to Chromium/Chrome.

There are other files in this directory which might be helpful: