Option for using mldsa-native's SHAKE in the PSA XOF API #630

New issue

Open

opened 2026-01-05 05:34:32 -06:00 by gilles-peskine-arm · 0 comments

gilles-peskine-arm commented

2026-01-05 05:34:32 -06:00

(Migrated from github.com)

TF-PSA-Crypto integrates mldsa-native, which comes with a SHAKE implementation. We also have our own SHAKE implementation in sha3.c, and there can be a third-party PSA SHAKE driver.

It's likely that depending on the platform, one or the other implementation might be better (in terms of code size and performance). So we may want to allow three different configurations:

mldsa-native uses its own SHAKE and everything else uses sha3.c or the PSA driver. This is the least-effort way to integrate mldsa-native, done in https://github.com/Mbed-TLS/TF-PSA-Crypto/issues/628.
Only sha3.c or the PSA driver gets used. The SHAKE implementation in mldsa-native is not built. This is possible since https://github.com/Mbed-TLS/TF-PSA-Crypto/issues/629.
The SHAKE implementation from mldsa-native is used as a PSA accelerator, and the one in sha3.c is not used. Note that mldsa-native only implements SHAKE128 and SHAKE256, not SHA3. (But maybe we could add SHA3 on top of some internal function.)

The goal of this issue is to add the third option where mldsa-native's SHAKE is used everywhere.

Note that it's not yet clear whether this is desirable. We should only do this if there is a demonstrated performance advantage.

TF-PSA-Crypto integrates [mldsa-native](https://github.com/pq-code-package/mldsa-native), which comes with a SHAKE implementation. We also have our [own SHAKE implementation](https://github.com/Mbed-TLS/TF-PSA-Crypto/issues/621) in `sha3.c`, and there can be a third-party PSA SHAKE driver. It's likely that depending on the platform, one or the other implementation might be better (in terms of code size and performance). So we may want to allow three different configurations: * mldsa-native uses its own SHAKE and everything else uses `sha3.c` or the PSA driver. This is the least-effort way to integrate mldsa-native, done in https://github.com/Mbed-TLS/TF-PSA-Crypto/issues/628. * Only `sha3.c` or the PSA driver gets used. The SHAKE implementation in mldsa-native is not built. This is possible since https://github.com/Mbed-TLS/TF-PSA-Crypto/issues/629. * The SHAKE implementation from mldsa-native is used as a PSA accelerator, and the one in `sha3.c` is not used. Note that mldsa-native only implements SHAKE128 and SHAKE256, not SHA3. (But maybe we could add SHA3 on top of some internal function.) The goal of this issue is to add the third option where mldsa-native's SHAKE is used everywhere. Note that it's not yet clear whether this is desirable. We should only do this if there is a demonstrated performance advantage.

No milestone

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

gh-Mbed-TLS/TF-PSA-Crypto#630

No description provided.

Rows
Columns