Adds Armv8.1-M MVE fast paths for x1 Keccak state byte XOR and extraction.

BIBLIOGRAPHY.md

@@ -36,6 +36,17 @@ source code and documentation.
 * Referenced from:
   - [README.md](README.md)
 
+### `ADOMNICAI23`
+
+* An update on Keccak performance on ARMv7-M
+* Author(s):
+  - Alexandre Adomnicai
+* URL: https://eprint.iacr.org/2023/773
+* Referenced from:
+  - [dev/fips202/armv81m_clean/src/keccak_f1600_x1_armv81m.S](dev/fips202/armv81m_clean/src/keccak_f1600_x1_armv81m.S)
+  - [dev/fips202/armv81m_opt/src/keccak_f1600_x1_armv7m_opt_m55.S](dev/fips202/armv81m_opt/src/keccak_f1600_x1_armv7m_opt_m55.S)
+  - [mldsa/src/fips202/native/armv81m/src/keccak_f1600_x1_armv7m_opt_m55.S](mldsa/src/fips202/native/armv81m/src/keccak_f1600_x1_armv7m_opt_m55.S)
+
 ### `ArmARMv8M`
 
 * Armv8-M Architecture Reference Manual (DDI 0553)
@@ -371,6 +382,19 @@ source code and documentation.
   - [mldsa/src/sign.c](mldsa/src/sign.c)
   - [proofs/hol_light/README.md](proofs/hol_light/README.md)
 
+### `SLOTHYM7`
+
+* Enabling Microarchitectural Agility: Taking ML-KEM and ML-DSA from Cortex-M4 to M7 with SLOTHY
+* Author(s):
+  - Amin Abdulrahman
+  - Matthias J. Kannwischer
+  - Joel Lim
+* URL: https://eprint.iacr.org/2025/366
+* Referenced from:
+  - [dev/fips202/armv81m_clean/src/keccak_f1600_x1_armv81m.S](dev/fips202/armv81m_clean/src/keccak_f1600_x1_armv81m.S)
+  - [dev/fips202/armv81m_opt/src/keccak_f1600_x1_armv7m_opt_m55.S](dev/fips202/armv81m_opt/src/keccak_f1600_x1_armv7m_opt_m55.S)
+  - [mldsa/src/fips202/native/armv81m/src/keccak_f1600_x1_armv7m_opt_m55.S](mldsa/src/fips202/native/armv81m/src/keccak_f1600_x1_armv7m_opt_m55.S)
+
 ### `SLOTHY_Paper`
 
 * Fast and Clean: Auditable high-performance assembly via constraint solving
@@ -404,6 +428,21 @@ source code and documentation.
   - [test/abicheck/README.md](test/abicheck/README.md)
   - [test/abicheck/x86_64/abicheck_x86_64.c](test/abicheck/x86_64/abicheck_x86_64.c)
 
+### `XKCP`
+
+* eXtended Keccak Code Package
+* Author(s):
+  - Guido Bertoni
+  - Joan Daemen
+  - Michaël Peeters
+  - Gilles Van Assche
+  - Ronny Van Keer
+* URL: https://github.com/XKCP/XKCP
+* Referenced from:
+  - [dev/fips202/armv81m_clean/src/keccak_f1600_x1_armv81m.S](dev/fips202/armv81m_clean/src/keccak_f1600_x1_armv81m.S)
+  - [dev/fips202/armv81m_opt/src/keccak_f1600_x1_armv7m_opt_m55.S](dev/fips202/armv81m_opt/src/keccak_f1600_x1_armv7m_opt_m55.S)
+  - [mldsa/src/fips202/native/armv81m/src/keccak_f1600_x1_armv7m_opt_m55.S](mldsa/src/fips202/native/armv81m/src/keccak_f1600_x1_armv7m_opt_m55.S)
+
 ### `libmceliece`
 
 * libmceliece implementation of Classic McEliece

BIBLIOGRAPHY.yml

@@ -109,6 +109,29 @@
   - Klein, Fabien
   url: https://eprint.iacr.org/2022/1303
 
+- id: ADOMNICAI23
+  name: "An update on Keccak performance on ARMv7-M"
+  author: Adomnicai, Alexandre
+  url: https://eprint.iacr.org/2023/773
+
+- id: SLOTHYM7
+  name: "Enabling Microarchitectural Agility: Taking ML-KEM and ML-DSA from Cortex-M4 to M7 with SLOTHY"
+  author:
+  - Abdulrahman, Amin
+  - Kannwischer, Matthias J.
+  - Lim, Joel
+  url: https://eprint.iacr.org/2025/366
+
+- id: XKCP
+  name: eXtended Keccak Code Package
+  author:
+  - Bertoni, Guido
+  - Daemen, Joan
+  - Peeters, Michaël
+  - Van Assche, Gilles
+  - Van Keer, Ronny
+  url: https://github.com/XKCP/XKCP
+
 - id: NeonNTT
   name: "Neon NTT: Faster Dilithium, Kyber, and Saber on Cortex-A72 and Apple M1"
   year: 2022

LICENSE

@@ -14,11 +14,17 @@ It is only used for testing purposes.
 The benchmarking code in test/hal/hal.c carries the
 MIT license. It is only used for testing purposes.
 
+The Armv8.1-M Keccak implementation contains portions adapted from SLOTHY
+examples distributed under the MIT license. The applicable SLOTHY copyright
+notices are included below.
+
 ```
 Copyright (c) The mldsa-native project authors
 Copyright (c) The mlkem-native project authors
 Copyright (c) 2020 Dougall Johnson
 Copyright (c) 2022 Arm Limited
+Copyright (c) 2022 Hanno Becker
+Copyright (c) 2023 Amin Abdulrahman, Matthias Kannwischer
 SPDX-License-Identifier: MIT
 
 Permission is hereby granted, free of charge, to any person obtaining a copy

dev/fips202/armv81m/README.md

@@ -1,9 +1,14 @@
 [//]: # (SPDX-License-Identifier: CC-BY-4.0)
 
-# FIPS202 backend for Armv8.1-M + MVE: Development sources
+# FIPS202 backend for Armv8.1-M: Development sources
 
-This directory contains the development sources for a FIPS202 backend targeting
-the Armv8.1-M + MVE/Helium architecture.
+This directory contains the development sources for the Armv8.1-M FIPS202
+backend. Its `src/` directory contains the direct MVE/Helium x4
+implementation. The x1 permutation and MVE byte XOR/extract helpers are
+maintained in [`../armv81m_opt/src/`](../armv81m_opt/src/) and generated by
+SLOTHY from [`../armv81m_clean/src/`](../armv81m_clean/src/). Autogeneration
+combines the source files from `src/` and `../armv81m_opt/src/` into the
+production backend.
 
 **Warning:** This backend is still in active development and has not yet undergone
 the same level of review as the rest of the code. Use at your own risk!

dev/fips202/armv81m/mve_x1.h

@@ -0,0 +1,65 @@
+/*
+ * Copyright (c) The mlkem-native project authors
+ * Copyright (c) The mldsa-native project authors
+ * SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT
+ */
+
+#ifndef MLD_DEV_FIPS202_ARMV81M_MVE_X1_H
+#define MLD_DEV_FIPS202_ARMV81M_MVE_X1_H
+
+#define MLD_FIPS202_NATIVE_ARMV81M
+
+/* Part of backend API */
+#define MLD_USE_NATIVE_FIPS202_X1
+#define MLD_USE_NATIVE_FIPS202_X1_XOR_BYTES
+#define MLD_USE_NATIVE_FIPS202_X1_EXTRACT_BYTES
+/* Guard for assembly files */
+#define MLD_FIPS202_ARMV81M_NEED_X1
+
+#if !defined(__ASSEMBLER__)
+#include "../api.h"
+
+#define mld_keccak_f1600_x1_native_impl \
+  MLD_NAMESPACE(keccak_f1600_x1_native_impl)
+int mld_keccak_f1600_x1_native_impl(uint64_t *state);
+
+MLD_MUST_CHECK_RETURN_VALUE
+static MLD_INLINE int mld_keccak_f1600_x1_native(uint64_t *state)
+{
+  return mld_keccak_f1600_x1_native_impl(state);
+}
+
+#define mld_keccakf1600_xor_bytes_x1_native_impl \
+  MLD_NAMESPACE(keccakf1600_xor_bytes_x1_native_impl)
+int mld_keccakf1600_xor_bytes_x1_native_impl(uint64_t *state,
+                                             const uint8_t *data,
+                                             unsigned offset, unsigned length);
+
+MLD_MUST_CHECK_RETURN_VALUE
+static MLD_INLINE int mld_keccakf1600_xor_bytes_x1_native(uint64_t *state,
+                                                          const uint8_t *data,
+                                                          unsigned offset,
+                                                          unsigned length)
+{
+  return mld_keccakf1600_xor_bytes_x1_native_impl(state, data, offset, length);
+}
+
+#define mld_keccakf1600_extract_bytes_x1_native_impl \
+  MLD_NAMESPACE(keccakf1600_extract_bytes_x1_native_impl)
+int mld_keccakf1600_extract_bytes_x1_native_impl(uint64_t *state, uint8_t *data,
+                                                 unsigned offset,
+                                                 unsigned length);
+
+MLD_MUST_CHECK_RETURN_VALUE
+static MLD_INLINE int mld_keccakf1600_extract_bytes_x1_native(uint64_t *state,
+                                                              uint8_t *data,
+                                                              unsigned offset,
+                                                              unsigned length)
+{
+  return mld_keccakf1600_extract_bytes_x1_native_impl(state, data, offset,
+                                                      length);
+}
+
+#endif /* !__ASSEMBLER__ */
+
+#endif /* !MLD_DEV_FIPS202_ARMV81M_MVE_X1_H */