linux-kernel - Re: [PATCH 1/4] lib/crypto: Add ML-DSA verification support

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <2590973.1763629800@warthog.procyon.org.uk>
Date: Thu, 20 Nov 2025 09:10:00 +0000
From: David Howells <dhowells@...hat.com>
To: Eric Biggers <ebiggers@...nel.org>
Cc: dhowells@...hat.com, linux-crypto@...r.kernel.org,
    Herbert Xu <herbert@...dor.apana.org.au>,
    Luis Chamberlain <mcgrof@...nel.org>,
    Petr Pavlu <petr.pavlu@...e.com>, Daniel Gomez <da.gomez@...nel.org>,
    Sami Tolvanen <samitolvanen@...gle.com>,
    "Jason A . Donenfeld" <Jason@...c4.com>,
    Ard Biesheuvel <ardb@...nel.org>,
    Stephan Mueller <smueller@...onox.de>,
    Lukas Wunner <lukas@...ner.de>,
    Ignat Korchagin <ignat@...udflare.com>, keyrings@...r.kernel.org,
    linux-modules@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH 1/4] lib/crypto: Add ML-DSA verification support

Eric Biggers <ebiggers@...nel.org> wrote:

>   - Is about 600 lines of source code instead of 4800.

There's less shareable code for other algos that I'm sure people are going to
ask for, but that's probably fine.

>   - Generates about 4 KB of object code instead of 28 KB.
>   - Uses 9-13 KB of memory to verify a signature instead of 31-84 KB.

That's definitely good.

>   - Is 3-5% faster, depending on the ML-DSA parameter set.

That's not quite what I see.  For Leancrypto:

    # benchmark_mldsa44: 8672 ops/s
    # benchmark_mldsa65: 5470 ops/s
    # benchmark_mldsa87: 3350 ops/s

For your implementation:

    # benchmark_mldsa44: 8707 ops/s
    # benchmark_mldsa65: 5423 ops/s
    # benchmark_mldsa87: 3352 ops/s

This may reflect differences in CPU (mine's an i3-4170).

The numbers are pretty stable with the cpu frequency governor set to
performance and without rebooting betweentimes.

Interesting that your mldsa44 is consistently faster, but your mldsa65 is
consistently slower.  mldsa87 is consistently about the same.

I don't think the time differences are particularly significant.

David