)]}'
{
  "commit": "ff43c4eb7f048a99c099201f3f058f0d0655a6fc",
  "tree": "5733d1d487cc73e9b0931c84736066063474679f",
  "parents": [
    "d5549900f2e255353c8fd99cc427e5659ce761a7"
  ],
  "author": {
    "name": "David Benjamin",
    "email": "davidben@google.com",
    "time": "Fri Jun 05 16:50:16 2026 -0400"
  },
  "committer": {
    "name": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com",
    "email": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com",
    "time": "Mon Jun 08 21:23:43 2026 -0700"
  },
  "message": "Store ML-DSA\u0027s s1, s2, and t0 in NTT form\n\nML-DSA sign only uses those in NTT form, so this avoids doing a\nconversion on every signature operation. The result is that signing gets\nfaster, but keygen gets slower, because we shift some of those\nconversions to keygen time.\n\nKeygen itself needs s1 in NTT form anyway, so keygen gains two NTTs\nwhile signing loses three, so even single-use keys (1x keygen + 1x sign)\nget faster.\n\nThis complicates the ridiculous semi-expanded key format, which encodes\nthe three vectors in non-NTT form, but since we only implement it for\nACVP testing, it doesn\u0027t matter if that needs extra operations.\n\nBenchmarks on a AMD Ryzen Threadripper PRO 7945WX 12-Cores below. Note\nthe percentages are misleading because the denominator for keygen was\nlower.\n\nBenchmark                                                 Time             CPU      Time Old      Time New       CPU Old       CPU New\n--------------------------------------------------------------------------------------------------------------------------------------\nBM_SpeedMLDSAKeyGen/ml_dsa_44/threads:1                +0.1576         +0.1576         33140         38362         33137         38358\nBM_SpeedMLDSASign/ml_dsa_44/threads:1                  -0.0852         -0.0852        136175        124570        136165        124559\nBM_SpeedMLDSAKeyGen/ml_dsa_65/threads:1                +0.1320         +0.1319         63872         72300         63862         72289\nBM_SpeedMLDSASign/ml_dsa_65/threads:1                  -0.0384         -0.0383        210115        202048        210076        202027\nBM_SpeedMLDSAKeyGen/ml_dsa_87/threads:1                +0.1130         +0.1131         90237        100437         90230        100431\nBM_SpeedMLDSASign/ml_dsa_87/threads:1                  -0.0645         -0.0645        250679        234521        250656        234486\n\nChange-Id: Ibdcf5591dc74c61fc694988828b2fa254f8112f2\nReviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/96810\nCommit-Queue: David Benjamin \u003cdavidben@google.com\u003e\nReviewed-by: Adam Langley \u003cagl@google.com\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "504844fb67c7a371e4b1a8b5a43a99653bf6d91b",
      "old_mode": 33188,
      "old_path": "crypto/fipsmodule/mldsa/mldsa.cc.inc",
      "new_id": "d5d1e963a63b7c2513df1d914cb33197ce20e54f",
      "new_mode": 33188,
      "new_path": "crypto/fipsmodule/mldsa/mldsa.cc.inc"
    }
  ]
}