ML-DSA on x86-64: sample  four entries at a time in key generation (keygen −29 to −37% instructions with AVX2)

[alex]

Stacked on #534, which adds vg_mldsa_rej_ntt_poly4. The base is #534's branch, so the diff shows only this change.

What

Key generation calls vg_mldsa_rej_ntt_poly4 once for each group of four consecutive entries of Â:

• the AVX2 variant runs four SHAKE128 instances at once; the baseline makes four calls of vg_mldsa_rej_ntt_poly;
• each call reads four seeds at oSA4, each holding ρ and its entry's indices;
• its 8 KiB of working space is after the polynomials;
• the last kℓ mod 4 entries are sampled one at a time, as before.

Each call's result is ANDed into r15 and masks the four polynomials it sampled, as the result for a single entry already does. The calls now use 24 bytes of stack, within the 32 bytes key generation's contract already allows.

Proofs (untrusted)

• KeyGen/Samp4 (new): one group; its seeds (Seeds); the result in r15 (Mask).
• Call, Inst, Lay: the rej4 callee, which needs at most three frames of stack.

There are no TCB or Spec changes.

Performance

Instructions per key generation (callgrind, AVX2):

	before	after
ML-DSA-44	23.5M	16.8M	−29%
ML-DSA-65	38.4M	26.7M	−31%
ML-DSA-87	64.4M	40.8M	−37%

The baseline is unchanged (+0.06%), and the README tables are regenerated.

Checks run

• lake build and the emitter
• check_lean_imports, check_lean_speed, check_vectors, check_arch_gates, check_variants, check_mcdt, algorithms_table
• cargo fmt --check and cargo clippy --all-targets -D warnings
• cargo test --release with Wycheproof, both on the default path and with VG_CPU_FEATURES=none --features cpu-features-env

🤖 Generated with Claude Code

https://claude.ai/code/session_01Ddof3szoTi7HB8iCsM2MCr

---

Generated by Claude Code

[alex]

Merged main, now with #534, in 3c23c2a. Only the docs notes and the README conflicted (regenerated), and the diff against main is just this PR's files. The check scripts and cargo test (default and VG_CPU_FEATURES=none) pass. #536, #537 and #544 are updated on top.

---

Generated by Claude Code