kaidokert / krabipqc-rs / 27866731019

94%

push

github

ML-DSA: lowmem feature — stream sign secrets to cut stack (#15)

* ML-DSA: lowmem feature streams sign secrets row-by-row

The default sign path holds s1_hat / s2_hat / t0_hat — the NTT+Mont
forms of the secret key — across the whole kappa loop. On the larger
parameter sets those three PolyVecs are a big slice of the sign stack.

`--features lowmem` leaves the secrets encoded in the caller's `sk`
and re-derives one row at a time inside each retry. `SkSecretReader`
carves the s1 / s2 / t0 regions once (borrow-only, no secret stack)
and yields a row via `chunks_exact(..).nth(i)`; each consumer
(c·s1 for z, c·s2 for r0, c·t0 for the hint) decodes, NTTs, and blinds
its row on demand. Direct cfg-blocks at each consumer rather than an
accessor that returns a Poly into the hot default path. The reader is
panic-free — regions split with `split_at_checked`, chunk sizes
`saturating_mul`, indices via `nth` — matching the decode discipline
on the default path.

23 of 23 new or added lines in 1 file covered. (100.0%)

2991 of 3227 relevant lines covered (92.69%)

52042.25 hits per line