Leave intermediates partially reduced in ML-DSA NTT Credit to Filippo Valsorda for doing something similar in https://go-review.googlesource.com/c/go/+/822040/ This is quite effective on aarch64 (Apple M1 Pro): Benchmark Time CPU Time Old Time New CPU Old CPU New -------------------------------------------------------------------------------------------------------------------------------------------------- BM_SpeedMLDSAKeyGen/ml_dsa_44/threads:1 -0.1039 -0.1039 33944 30417 33944 30416 BM_SpeedMLDSASign/ml_dsa_44/threads:1 -0.1277 -0.1280 140310 122385 140308 122343 BM_SpeedMLDSAParsePubKey/ml_dsa_44/threads:1 +0.0080 +0.0049 2417 2436 2417 2429 BM_SpeedMLDSAVerify/ml_dsa_44/threads:1 -0.0991 -0.0990 29312 26406 29308 26406 BM_SpeedMLDSAVerifyBadSignature/ml_dsa_44/threads:1 -0.0993 -0.0993 29266 26360 29266 26360 BM_SpeedMLDSAKeyGen/ml_dsa_65/threads:1 -0.0786 -0.0784 67418 62122 67405 62121 BM_SpeedMLDSASign/ml_dsa_65/threads:1 -0.1127 -0.1127 221116 196194 221066 196151 BM_SpeedMLDSAParsePubKey/ml_dsa_65/threads:1 +0.0040 +0.0034 3581 3595 3580 3593 BM_SpeedMLDSAVerify/ml_dsa_65/threads:1 -0.0940 -0.0937 45508 41230 45492 41229 BM_SpeedMLDSAVerifyBadSignature/ml_dsa_65/threads:1 -0.0920 -0.0913 45578 41383 45535 41378 BM_SpeedMLDSAKeyGen/ml_dsa_87/threads:1 -0.0817 -0.0818 86174 79132 86174 79126 BM_SpeedMLDSASign/ml_dsa_87/threads:1 -0.1084 -0.1084 251821 224521 251813 224520 BM_SpeedMLDSAParsePubKey/ml_dsa_87/threads:1 +0.0004 -0.0004 4793 4795 4786 4785 BM_SpeedMLDSAVerify/ml_dsa_87/threads:1 -0.0695 -0.0696 74345 69180 74344 69170 BM_SpeedMLDSAVerifyBadSignature/ml_dsa_87/threads:1 -0.0717 -0.0717 74405 69072 74405 69071 Less visible on x86_64 (AMD Ryzen Threadripper PRO 7945WX 12-Cores) Benchmark Time CPU Time Old Time New CPU Old CPU New -------------------------------------------------------------------------------------------------------------------------------------------------- BM_SpeedMLDSAKeyGen/ml_dsa_44/threads:1 -0.0184 -0.0184 38295 37591 38293 37589 BM_SpeedMLDSASign/ml_dsa_44/threads:1 -0.0041 -0.0041 124470 123958 124458 123949 BM_SpeedMLDSAParsePubKey/ml_dsa_44/threads:1 -0.0043 -0.0043 2740 2728 2740 2728 BM_SpeedMLDSAVerify/ml_dsa_44/threads:1 -0.0216 -0.0216 31537 30855 31534 30854 BM_SpeedMLDSAVerifyBadSignature/ml_dsa_44/threads:1 -0.0272 -0.0271 31575 30718 31572 30716 BM_SpeedMLDSAKeyGen/ml_dsa_65/threads:1 -0.0191 -0.0191 72158 70780 72153 70775 BM_SpeedMLDSASign/ml_dsa_65/threads:1 -0.0304 -0.0305 198536 192510 198519 192470 BM_SpeedMLDSAParsePubKey/ml_dsa_65/threads:1 -0.0004 -0.0003 4084 4083 4084 4082 BM_SpeedMLDSAVerify/ml_dsa_65/threads:1 -0.0168 -0.0168 49948 49111 49944 49107 BM_SpeedMLDSAVerifyBadSignature/ml_dsa_65/threads:1 -0.0197 -0.0197 50288 49299 50286 49297 BM_SpeedMLDSAKeyGen/ml_dsa_87/threads:1 -0.0161 -0.0161 101991 100347 101979 100335 BM_SpeedMLDSASign/ml_dsa_87/threads:1 -0.0132 -0.0132 240216 237045 240183 237024 BM_SpeedMLDSAParsePubKey/ml_dsa_87/threads:1 -0.0052 -0.0051 5468 5439 5467 5439 BM_SpeedMLDSAVerify/ml_dsa_87/threads:1 -0.0275 -0.0276 84974 82635 84969 82625 BM_SpeedMLDSAVerifyBadSignature/ml_dsa_87/threads:1 -0.0258 -0.0257 84841 82652 84829 82649 Bug: 503700354 Change-Id: I14b83d24c3585a42959241907bab2005d1e4f5aa Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/101807 Reviewed-by: Lily Chen <chlily@google.com> Commit-Queue: David Benjamin <davidben@google.com>
BoringSSL is a fork of OpenSSL that is designed to meet Google's needs.
Although BoringSSL is an open source project, it is not intended for general use, as OpenSSL is. We don't recommend that third parties depend upon it. Doing so is likely to be frustrating because there are no guarantees of API or ABI stability.
Programs ship their own copies of BoringSSL when they use it and we update everything as needed when deciding to make API changes. This allows us to mostly avoid compromises in the name of compatibility. It works for us, but it may not work for you.
BoringSSL arose because Google used OpenSSL for many years in various ways and, over time, built up a large number of patches that were maintained while tracking upstream OpenSSL. As Google's product portfolio became more complex, more copies of OpenSSL sprung up and the effort involved in maintaining all these patches in multiple places was growing steadily.
Currently BoringSSL is the SSL library in Chrome/Chromium, Android (but it's not part of the NDK) and a number of other apps/programs.
Project links:
To file a security issue, use the Chromium process and mention in the report this is for BoringSSL. You can ignore the parts of the process that are specific to Chromium/Chrome.
There are other files in this directory which might be helpful: