ML-DSA on x86-64: sample verification's  as one run of entries (verify −8% with AVX2, −9% baseline ML-DSA-87)

[alex]

Stacked on #537; the diff shows only this change. This is the follow-up promised in #534. It removes the duplicated entry that made the baseline ML-DSA-87 verification 7% slower there.

What

Verification kept Â[r, s] at polynomial 20 + 8r + s, so a group of four entries for vg_mldsa_rej_ntt_poly4 could not cross a row:

• for ℓ = 7, the second group of each row sampled entry 3 again;
• for ℓ = 5, the last entry of each row was sampled alone.

Â[r, s] is now entry e = ℓr + s, at polynomial 20 + e (pA l r s). Verification samples the kℓ entries as key generation and signing do:

• kℓ/4 groups of four (aGrp), where each seed's index bytes are e mod ℓ and e / ℓ;
• then the last kℓ mod 4 entries one at a time (aOne).

As a result:

	four-way calls	single calls
ML-DSA-44	4	0 (as before)
ML-DSA-65	7	2 (was 6 and 6)
ML-DSA-87	14	0 (was 16 four-way calls with 8 duplicates)

The working space of vg_mldsa_rej_ntt_poly4 stays at polynomial 20 + 8k, which is after Â for every ℓ, so the scratch layout is otherwise unchanged.

Proofs (untrusted)

• StageA and CTSample now count sampled entries by number: Done ℓ e r' c' := ℓr' + c' < e, with rc_eq recovering (r', c') from e. aGrp_ok/aGrp_tr cover entries 4g … 4g + 3, and aOne_ok/aOne_tr cover entry e.
• StageC, Correct and CTCompute only pass ℓ to pA.
• Instrs follows the new samples.

There are no TCB or Spec changes.

Performance

Instructions per verification (callgrind: 20 verifications, minus key generation and one signature; base is #537's head):

	AVX2	baseline (VG_CPU_FEATURES=none)
ML-DSA-44	unchanged	unchanged
ML-DSA-65	1.061M → 0.977M (−7.9%)	unchanged
ML-DSA-87	1.677M → 1.540M (−8.1%)	3.276M → 2.971M (−9.3%)

Checks run

• lake build and the emitter
• check_lean_imports, check_lean_speed, check_vectors, check_arch_gates, check_variants, check_mcdt
• cargo fmt --check and cargo clippy --all-targets -D warnings
• cargo test --release with Wycheproof, both on the default path and with VG_CPU_FEATURES=none --features cpu-features-env

🤖 Generated with Claude Code

https://claude.ai/code/session_01Ddof3szoTi7HB8iCsM2MCr

---

Generated by Claude Code