)]}'
{
  "commit": "b6981118a3f91da409956ea191dd020ead45d6e2",
  "tree": "c55bc8bd7b3f4ad01c3f94fd22747a29cd6b741c",
  "parents": [
    "cac4d9b973a583d1f00d5fadce5d03675da1ecd1"
  ],
  "author": {
    "name": "Jakub Patałuch",
    "email": "jjpat@google.com",
    "time": "Tue Oct 13 13:21:46 2026 +0000"
  },
  "committer": {
    "name": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com",
    "email": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com",
    "time": "Sun Oct 18 12:30:10 2026 -0700"
  },
  "message": "Use lazy reduction and parallel ExpandMask in ML-DSA\n\nmatrix_mult_montgomery Montgomery-reduced every product and then added\nit to the output with a conditional subtraction. The inputs are fully\nreduced, so for each coefficient the sum of the L products is at most\n7 * (8380417 - 1)^2, well within the range reduce_montgomery accepts.\nInstead, sum the 64-bit products and reduce once per coefficient. A\nstatic_assert checks the bound. This speeds up the matrix-vector product\nin key generation, signing and verification.\n\nvector_expand_mask sampled the L scalars of y one at a time, each a\nseparate SHAKE256 computation of about five Keccak permutations, on\nevery signing attempt. The scalars are independent, so sample them with\nthe parallel x4 and x2 Keccak implementations, as vector_expand_short\nalready does for s1 and s2. A shared helper sets up the SHAKE256 input,\nso every variant absorbs the same bytes.\n\nThe output is unchanged, as are the self-test known-answer values, and\nthe code remains constant-time.\n\nMedian of 15 runs on an Intel Xeon (Skylake-SP) at 2.0 GHz, in\nmicroseconds:\n\n                  Before     After   Speedup\n  ML-DSA-44\n    keygen          73.1      71.2     1.03x\n    sign           274.8     224.2     1.23x\n    verify          58.7      56.9     1.03x\n  ML-DSA-65\n    keygen         125.1     120.7     1.04x\n    sign           424.7     371.3     1.14x\n    verify          93.1      89.0     1.05x\n  ML-DSA-87\n    keygen         187.6     176.7     1.06x\n    sign           502.7     421.9     1.19x\n    verify         149.2     139.6     1.07x\n\nChange-Id: I9f50a41319acff3846af7021fc89670cddc83c65\nReviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/104088\nCommit-Queue: David Benjamin \u003cdavidben@google.com\u003e\nReviewed-by: David Benjamin \u003cdavidben@google.com\u003e\nPresubmit-BoringSSL-Verified: boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com \u003cboringssl-scoped@luci-project-accounts.iam.gserviceaccount.com\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "e0fa058492f3f10fac9826370e601ea782b93a9f",
      "old_mode": 33188,
      "old_path": "crypto/fipsmodule/mldsa/mldsa.cc.inc",
      "new_id": "ca93741410b4d47564ffceded5b253ad42cf872e",
      "new_mode": 33188,
      "new_path": "crypto/fipsmodule/mldsa/mldsa.cc.inc"
    }
  ]
}