)]}'
{
  "commit": "d98ee3a9f41e989b7502912a48254cab29ff719f",
  "tree": "3a2b3b6d79b48bd0ddd815b8ec9f909002108753",
  "parents": [
    "a896da906bc118ded5ae5f38e22b15124017326b"
  ],
  "author": {
    "name": "David Benjamin",
    "email": "davidben@google.com",
    "time": "Fri Jun 05 18:09:03 2026 -0400"
  },
  "committer": {
    "name": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com",
    "email": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com",
    "time": "Mon Jun 08 08:40:34 2026 -0700"
  },
  "message": "Make Montgomery reduction clearer in ML-DSA\n\nThis implementation has an uncommented optimization: our multiplication\nis Montgomery multiplication and takes on an extra R^-1 term. That term\nis canceled out in the NTT^-1 step, where we multiply not by 256^-1 R,\nas the comment suggests, but 256^-1 R^2.\n\nThis works out because happens that, between NTT and NTT^-1, each scalar\ngoes through exactly one multiplication and thus develops exactly one\nR^-1 term.\n\nChange-Id: Ifd3c6ad9d6479ce7d540c7e9075bd495932a844b\nReviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/96808\nCommit-Queue: David Benjamin \u003cdavidben@google.com\u003e\nReviewed-by: Adam Langley \u003cagl@google.com\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "838ae09f4617454624436d97d05885adaa007d22",
      "old_mode": 33188,
      "old_path": "crypto/fipsmodule/mldsa/mldsa.cc.inc",
      "new_id": "d8c9f1f2a2d96c5367f68b427bea4f856bac6e70",
      "new_mode": 33188,
      "new_path": "crypto/fipsmodule/mldsa/mldsa.cc.inc"
    }
  ]
}