diff --git a/docs/algorithms/sig/cross.md b/docs/algorithms/sig/cross.md index 50573b5f5b..63cdc3827f 100644 --- a/docs/algorithms/sig/cross.md +++ b/docs/algorithms/sig/cross.md @@ -22,26 +22,26 @@ ## Parameter set summary -| Parameter set | Parameter set alias | Security model | Claimed NIST Level | Public key size (bytes) | Secret key size (bytes) | Signature size (bytes) | -|:------------------------:|:----------------------|:-----------------|---------------------:|--------------------------:|--------------------------:|-------------------------:| -| cross-rsdp-128-balanced | NA | EUF-CMA | 1 | 77 | 32 | 13152 | -| cross-rsdp-128-fast | NA | EUF-CMA | 1 | 77 | 32 | 18432 | -| cross-rsdp-128-small | NA | EUF-CMA | 1 | 77 | 32 | 12432 | -| cross-rsdp-192-balanced | NA | EUF-CMA | 3 | 115 | 48 | 29853 | -| cross-rsdp-192-fast | NA | EUF-CMA | 3 | 115 | 48 | 41406 | -| cross-rsdp-192-small | NA | EUF-CMA | 3 | 115 | 48 | 28391 | -| cross-rsdp-256-balanced | NA | EUF-CMA | 5 | 153 | 64 | 53527 | -| cross-rsdp-256-fast | NA | EUF-CMA | 5 | 153 | 64 | 74590 | -| cross-rsdp-256-small | NA | EUF-CMA | 5 | 153 | 64 | 50818 | -| cross-rsdpg-128-balanced | NA | EUF-CMA | 1 | 54 | 32 | 9120 | -| cross-rsdpg-128-fast | NA | EUF-CMA | 1 | 54 | 32 | 11980 | -| cross-rsdpg-128-small | NA | EUF-CMA | 1 | 54 | 32 | 8960 | -| cross-rsdpg-192-balanced | NA | EUF-CMA | 3 | 83 | 48 | 22464 | -| cross-rsdpg-192-fast | NA | EUF-CMA | 3 | 83 | 48 | 26772 | -| cross-rsdpg-192-small | NA | EUF-CMA | 3 | 83 | 48 | 20452 | -| cross-rsdpg-256-balanced | NA | EUF-CMA | 5 | 106 | 64 | 40100 | -| cross-rsdpg-256-fast | NA | EUF-CMA | 5 | 106 | 64 | 48102 | -| cross-rsdpg-256-small | NA | EUF-CMA | 5 | 106 | 64 | 36454 | +| Parameter set | Parameter set alias | Security model | Claimed NIST Level | Public key size (bytes) | Secret key size (bytes) | Signature size (bytes) | Keypair seed size (bytes) | +|:------------------------:|:----------------------|:-----------------|---------------------:|--------------------------:|--------------------------:|-------------------------:|:----------------------------| +| cross-rsdp-128-balanced | NA | EUF-CMA | 1 | 77 | 32 | 13152 | NA | +| cross-rsdp-128-fast | NA | EUF-CMA | 1 | 77 | 32 | 18432 | NA | +| cross-rsdp-128-small | NA | EUF-CMA | 1 | 77 | 32 | 12432 | NA | +| cross-rsdp-192-balanced | NA | EUF-CMA | 3 | 115 | 48 | 29853 | NA | +| cross-rsdp-192-fast | NA | EUF-CMA | 3 | 115 | 48 | 41406 | NA | +| cross-rsdp-192-small | NA | EUF-CMA | 3 | 115 | 48 | 28391 | NA | +| cross-rsdp-256-balanced | NA | EUF-CMA | 5 | 153 | 64 | 53527 | NA | +| cross-rsdp-256-fast | NA | EUF-CMA | 5 | 153 | 64 | 74590 | NA | +| cross-rsdp-256-small | NA | EUF-CMA | 5 | 153 | 64 | 50818 | NA | +| cross-rsdpg-128-balanced | NA | EUF-CMA | 1 | 54 | 32 | 9120 | NA | +| cross-rsdpg-128-fast | NA | EUF-CMA | 1 | 54 | 32 | 11980 | NA | +| cross-rsdpg-128-small | NA | EUF-CMA | 1 | 54 | 32 | 8960 | NA | +| cross-rsdpg-192-balanced | NA | EUF-CMA | 3 | 83 | 48 | 22464 | NA | +| cross-rsdpg-192-fast | NA | EUF-CMA | 3 | 83 | 48 | 26772 | NA | +| cross-rsdpg-192-small | NA | EUF-CMA | 3 | 83 | 48 | 20452 | NA | +| cross-rsdpg-256-balanced | NA | EUF-CMA | 5 | 106 | 64 | 40100 | NA | +| cross-rsdpg-256-fast | NA | EUF-CMA | 5 | 106 | 64 | 48102 | NA | +| cross-rsdpg-256-small | NA | EUF-CMA | 5 | 106 | 64 | 36454 | NA | ## cross-rsdp-128-balanced implementation characteristics diff --git a/docs/algorithms/sig/falcon.md b/docs/algorithms/sig/falcon.md index 94f0f6d9ac..e136b436d6 100644 --- a/docs/algorithms/sig/falcon.md +++ b/docs/algorithms/sig/falcon.md @@ -25,12 +25,12 @@ ## Parameter set summary -| Parameter set | Parameter set alias | Security model | Claimed NIST Level | Public key size (bytes) | Secret key size (bytes) | Signature size (bytes) | -|:------------------:|:----------------------|:-----------------|---------------------:|--------------------------:|--------------------------:|-------------------------:| -| Falcon-512 | NA | EUF-CMA | 1 | 897 | 1281 | 752 | -| Falcon-1024 | NA | EUF-CMA | 5 | 1793 | 2305 | 1462 | -| Falcon-padded-512 | NA | EUF-CMA | 1 | 897 | 1281 | 666 | -| Falcon-padded-1024 | NA | EUF-CMA | 5 | 1793 | 2305 | 1280 | +| Parameter set | Parameter set alias | Security model | Claimed NIST Level | Public key size (bytes) | Secret key size (bytes) | Signature size (bytes) | Keypair seed size (bytes) | +|:------------------:|:----------------------|:-----------------|---------------------:|--------------------------:|--------------------------:|-------------------------:|:----------------------------| +| Falcon-512 | NA | EUF-CMA | 1 | 897 | 1281 | 752 | NA | +| Falcon-1024 | NA | EUF-CMA | 5 | 1793 | 2305 | 1462 | NA | +| Falcon-padded-512 | NA | EUF-CMA | 1 | 897 | 1281 | 666 | NA | +| Falcon-padded-1024 | NA | EUF-CMA | 5 | 1793 | 2305 | 1280 | NA | ## Falcon-512 implementation characteristics diff --git a/docs/algorithms/sig/mayo.md b/docs/algorithms/sig/mayo.md index df795f910e..0323b1fb32 100644 --- a/docs/algorithms/sig/mayo.md +++ b/docs/algorithms/sig/mayo.md @@ -24,12 +24,12 @@ ## Parameter set summary -| Parameter set | Parameter set alias | Security model | Claimed NIST Level | Public key size (bytes) | Secret key size (bytes) | Signature size (bytes) | -|:---------------:|:----------------------|:-----------------|---------------------:|--------------------------:|--------------------------:|-------------------------:| -| MAYO-1 | NA | EUF-CMA | 1 | 1420 | 24 | 454 | -| MAYO-2 | NA | EUF-CMA | 1 | 4912 | 24 | 186 | -| MAYO-3 | NA | EUF-CMA | 3 | 2986 | 32 | 681 | -| MAYO-5 | NA | EUF-CMA | 5 | 5554 | 40 | 964 | +| Parameter set | Parameter set alias | Security model | Claimed NIST Level | Public key size (bytes) | Secret key size (bytes) | Signature size (bytes) | Keypair seed size (bytes) | +|:---------------:|:----------------------|:-----------------|---------------------:|--------------------------:|--------------------------:|-------------------------:|:----------------------------| +| MAYO-1 | NA | EUF-CMA | 1 | 1420 | 24 | 454 | NA | +| MAYO-2 | NA | EUF-CMA | 1 | 4912 | 24 | 186 | NA | +| MAYO-3 | NA | EUF-CMA | 3 | 2986 | 32 | 681 | NA | +| MAYO-5 | NA | EUF-CMA | 5 | 5554 | 40 | 964 | NA | ## MAYO-1 implementation characteristics diff --git a/docs/algorithms/sig/ml_dsa.md b/docs/algorithms/sig/ml_dsa.md index eaeb15285c..0f31056be5 100644 --- a/docs/algorithms/sig/ml_dsa.md +++ b/docs/algorithms/sig/ml_dsa.md @@ -25,11 +25,11 @@ ## Parameter set summary -| Parameter set | Parameter set alias | Security model | Claimed NIST Level | Public key size (bytes) | Secret key size (bytes) | Signature size (bytes) | -|:---------------:|:----------------------|:-----------------|---------------------:|--------------------------:|--------------------------:|-------------------------:| -| ML-DSA-44 | NA | SUF-CMA | 2 | 1312 | 2560 | 2420 | -| ML-DSA-65 | NA | SUF-CMA | 3 | 1952 | 4032 | 3309 | -| ML-DSA-87 | NA | SUF-CMA | 5 | 2592 | 4896 | 4627 | +| Parameter set | Parameter set alias | Security model | Claimed NIST Level | Public key size (bytes) | Secret key size (bytes) | Signature size (bytes) | Keypair seed size (bytes) | +|:---------------:|:----------------------|:-----------------|---------------------:|--------------------------:|--------------------------:|-------------------------:|----------------------------:| +| ML-DSA-44 | NA | SUF-CMA | 2 | 1312 | 2560 | 2420 | 32 | +| ML-DSA-65 | NA | SUF-CMA | 3 | 1952 | 4032 | 3309 | 32 | +| ML-DSA-87 | NA | SUF-CMA | 5 | 2592 | 4896 | 4627 | 32 | ## ML-DSA-44 implementation characteristics diff --git a/docs/algorithms/sig/ml_dsa.yml b/docs/algorithms/sig/ml_dsa.yml index 665e1d8d50..9524835634 100644 --- a/docs/algorithms/sig/ml_dsa.yml +++ b/docs/algorithms/sig/ml_dsa.yml @@ -28,6 +28,7 @@ parameter-sets: length-public-key: 1312 length-secret-key: 2560 length-signature: 2420 + length-keypair-seed: 32 implementations-switch-on-runtime-cpu-features: true implementations: - upstream: primary-upstream @@ -73,6 +74,7 @@ parameter-sets: length-public-key: 1952 length-secret-key: 4032 length-signature: 3309 + length-keypair-seed: 32 implementations-switch-on-runtime-cpu-features: true implementations: - upstream: primary-upstream @@ -118,6 +120,7 @@ parameter-sets: length-public-key: 2592 length-secret-key: 4896 length-signature: 4627 + length-keypair-seed: 32 implementations-switch-on-runtime-cpu-features: true implementations: - upstream: primary-upstream diff --git a/docs/algorithms/sig/mqom.md b/docs/algorithms/sig/mqom.md index f437493040..3741147b47 100644 --- a/docs/algorithms/sig/mqom.md +++ b/docs/algorithms/sig/mqom.md @@ -24,20 +24,20 @@ ## Parameter set summary -| Parameter set | Parameter set alias | Security model | Claimed NIST Level | Public key size (bytes) | Secret key size (bytes) | Signature size (bytes) | -|:----------------------------:|:----------------------|:-----------------|---------------------:|--------------------------:|--------------------------:|-------------------------:| -| mqom2\_cat1\_gf16\_fast\_r5 | NA | EUF-CMA | 1 | 60 | 88 | 3280 | -| mqom2\_cat1\_gf16\_fast\_r3 | NA | EUF-CMA | 1 | 60 | 88 | 3484 | -| mqom2\_cat1\_gf16\_short\_r5 | NA | EUF-CMA | 1 | 60 | 88 | 2916 | -| mqom2\_cat1\_gf16\_short\_r3 | NA | EUF-CMA | 1 | 60 | 88 | 3060 | -| mqom2\_cat3\_gf16\_fast\_r5 | NA | EUF-CMA | 3 | 90 | 132 | 7738 | -| mqom2\_cat3\_gf16\_fast\_r3 | NA | EUF-CMA | 3 | 90 | 132 | 8224 | -| mqom2\_cat3\_gf16\_short\_r5 | NA | EUF-CMA | 3 | 90 | 132 | 6496 | -| mqom2\_cat3\_gf16\_short\_r3 | NA | EUF-CMA | 3 | 90 | 132 | 6820 | -| mqom2\_cat5\_gf16\_fast\_r5 | NA | EUF-CMA | 5 | 122 | 180 | 13772 | -| mqom2\_cat5\_gf16\_fast\_r3 | NA | EUF-CMA | 5 | 122 | 180 | 14708 | -| mqom2\_cat5\_gf16\_short\_r5 | NA | EUF-CMA | 5 | 122 | 180 | 12014 | -| mqom2\_cat5\_gf16\_short\_r3 | NA | EUF-CMA | 5 | 122 | 180 | 12664 | +| Parameter set | Parameter set alias | Security model | Claimed NIST Level | Public key size (bytes) | Secret key size (bytes) | Signature size (bytes) | Keypair seed size (bytes) | +|:----------------------------:|:----------------------|:-----------------|---------------------:|--------------------------:|--------------------------:|-------------------------:|:----------------------------| +| mqom2\_cat1\_gf16\_fast\_r5 | NA | EUF-CMA | 1 | 60 | 88 | 3280 | NA | +| mqom2\_cat1\_gf16\_fast\_r3 | NA | EUF-CMA | 1 | 60 | 88 | 3484 | NA | +| mqom2\_cat1\_gf16\_short\_r5 | NA | EUF-CMA | 1 | 60 | 88 | 2916 | NA | +| mqom2\_cat1\_gf16\_short\_r3 | NA | EUF-CMA | 1 | 60 | 88 | 3060 | NA | +| mqom2\_cat3\_gf16\_fast\_r5 | NA | EUF-CMA | 3 | 90 | 132 | 7738 | NA | +| mqom2\_cat3\_gf16\_fast\_r3 | NA | EUF-CMA | 3 | 90 | 132 | 8224 | NA | +| mqom2\_cat3\_gf16\_short\_r5 | NA | EUF-CMA | 3 | 90 | 132 | 6496 | NA | +| mqom2\_cat3\_gf16\_short\_r3 | NA | EUF-CMA | 3 | 90 | 132 | 6820 | NA | +| mqom2\_cat5\_gf16\_fast\_r5 | NA | EUF-CMA | 5 | 122 | 180 | 13772 | NA | +| mqom2\_cat5\_gf16\_fast\_r3 | NA | EUF-CMA | 5 | 122 | 180 | 14708 | NA | +| mqom2\_cat5\_gf16\_short\_r5 | NA | EUF-CMA | 5 | 122 | 180 | 12014 | NA | +| mqom2\_cat5\_gf16\_short\_r3 | NA | EUF-CMA | 5 | 122 | 180 | 12664 | NA | ## mqom2\_cat1\_gf16\_fast\_r5 implementation characteristics diff --git a/docs/algorithms/sig/slh_dsa.md b/docs/algorithms/sig/slh_dsa.md index 2b323f281d..de362d0b2b 100644 --- a/docs/algorithms/sig/slh_dsa.md +++ b/docs/algorithms/sig/slh_dsa.md @@ -22,164 +22,164 @@ ## Parameter set summary -| Parameter set | Parameter set alias | Security model | Claimed NIST Level | Public key size (bytes) | Secret key size (bytes) | Signature size (bytes) | -|:----------------------------------------------:|:----------------------|:-----------------|---------------------:|--------------------------:|--------------------------:|-------------------------:| -| SLH\_DSA\_PURE\_SHA2\_128S | NA | EUF-CMA | 1 | 32 | 64 | 7856 | -| SLH\_DSA\_PURE\_SHA2\_128F | NA | EUF-CMA | 1 | 32 | 64 | 17088 | -| SLH\_DSA\_PURE\_SHA2\_192S | NA | EUF-CMA | 3 | 48 | 96 | 16224 | -| SLH\_DSA\_PURE\_SHA2\_192F | NA | EUF-CMA | 3 | 48 | 96 | 35664 | -| SLH\_DSA\_PURE\_SHA2\_256S | NA | EUF-CMA | 5 | 64 | 128 | 29792 | -| SLH\_DSA\_PURE\_SHA2\_256F | NA | EUF-CMA | 5 | 64 | 128 | 49856 | -| SLH\_DSA\_PURE\_SHAKE\_128S | NA | EUF-CMA | 1 | 32 | 64 | 7856 | -| SLH\_DSA\_PURE\_SHAKE\_128F | NA | EUF-CMA | 1 | 32 | 64 | 17088 | -| SLH\_DSA\_PURE\_SHAKE\_192S | NA | EUF-CMA | 3 | 48 | 96 | 16224 | -| SLH\_DSA\_PURE\_SHAKE\_192F | NA | EUF-CMA | 3 | 48 | 96 | 35664 | -| SLH\_DSA\_PURE\_SHAKE\_256S | NA | EUF-CMA | 5 | 64 | 128 | 29792 | -| SLH\_DSA\_PURE\_SHAKE\_256F | NA | EUF-CMA | 5 | 64 | 128 | 49856 | -| SLH\_DSA\_SHA2\_224\_PREHASH\_SHA2\_128S | NA | EUF-CMA | 1 | 32 | 64 | 7856 | -| SLH\_DSA\_SHA2\_256\_PREHASH\_SHA2\_128S | NA | EUF-CMA | 1 | 32 | 64 | 7856 | -| SLH\_DSA\_SHA2\_384\_PREHASH\_SHA2\_128S | NA | EUF-CMA | 1 | 32 | 64 | 7856 | -| SLH\_DSA\_SHA2\_512\_PREHASH\_SHA2\_128S | NA | EUF-CMA | 1 | 32 | 64 | 7856 | -| SLH\_DSA\_SHA2\_512\_224\_PREHASH\_SHA2\_128S | NA | EUF-CMA | 1 | 32 | 64 | 7856 | -| SLH\_DSA\_SHA2\_512\_256\_PREHASH\_SHA2\_128S | NA | EUF-CMA | 1 | 32 | 64 | 7856 | -| SLH\_DSA\_SHA3\_224\_PREHASH\_SHA2\_128S | NA | EUF-CMA | 1 | 32 | 64 | 7856 | -| SLH\_DSA\_SHA3\_256\_PREHASH\_SHA2\_128S | NA | EUF-CMA | 1 | 32 | 64 | 7856 | -| SLH\_DSA\_SHA3\_384\_PREHASH\_SHA2\_128S | NA | EUF-CMA | 1 | 32 | 64 | 7856 | -| SLH\_DSA\_SHA3\_512\_PREHASH\_SHA2\_128S | NA | EUF-CMA | 1 | 32 | 64 | 7856 | -| SLH\_DSA\_SHAKE\_128\_PREHASH\_SHA2\_128S | NA | EUF-CMA | 1 | 32 | 64 | 7856 | -| SLH\_DSA\_SHAKE\_256\_PREHASH\_SHA2\_128S | NA | EUF-CMA | 1 | 32 | 64 | 7856 | -| SLH\_DSA\_SHA2\_224\_PREHASH\_SHA2\_128F | NA | EUF-CMA | 1 | 32 | 64 | 17088 | -| SLH\_DSA\_SHA2\_256\_PREHASH\_SHA2\_128F | NA | EUF-CMA | 1 | 32 | 64 | 17088 | -| SLH\_DSA\_SHA2\_384\_PREHASH\_SHA2\_128F | NA | EUF-CMA | 1 | 32 | 64 | 17088 | -| SLH\_DSA\_SHA2\_512\_PREHASH\_SHA2\_128F | NA | EUF-CMA | 1 | 32 | 64 | 17088 | -| SLH\_DSA\_SHA2\_512\_224\_PREHASH\_SHA2\_128F | NA | EUF-CMA | 1 | 32 | 64 | 17088 | -| SLH\_DSA\_SHA2\_512\_256\_PREHASH\_SHA2\_128F | NA | EUF-CMA | 1 | 32 | 64 | 17088 | -| SLH\_DSA\_SHA3\_224\_PREHASH\_SHA2\_128F | NA | EUF-CMA | 1 | 32 | 64 | 17088 | -| SLH\_DSA\_SHA3\_256\_PREHASH\_SHA2\_128F | NA | EUF-CMA | 1 | 32 | 64 | 17088 | -| SLH\_DSA\_SHA3\_384\_PREHASH\_SHA2\_128F | NA | EUF-CMA | 1 | 32 | 64 | 17088 | -| SLH\_DSA\_SHA3\_512\_PREHASH\_SHA2\_128F | NA | EUF-CMA | 1 | 32 | 64 | 17088 | -| SLH\_DSA\_SHAKE\_128\_PREHASH\_SHA2\_128F | NA | EUF-CMA | 1 | 32 | 64 | 17088 | -| SLH\_DSA\_SHAKE\_256\_PREHASH\_SHA2\_128F | NA | EUF-CMA | 1 | 32 | 64 | 17088 | -| SLH\_DSA\_SHA2\_224\_PREHASH\_SHA2\_192S | NA | EUF-CMA | 3 | 48 | 96 | 16224 | -| SLH\_DSA\_SHA2\_256\_PREHASH\_SHA2\_192S | NA | EUF-CMA | 3 | 48 | 96 | 16224 | -| SLH\_DSA\_SHA2\_384\_PREHASH\_SHA2\_192S | NA | EUF-CMA | 3 | 48 | 96 | 16224 | -| SLH\_DSA\_SHA2\_512\_PREHASH\_SHA2\_192S | NA | EUF-CMA | 3 | 48 | 96 | 16224 | -| SLH\_DSA\_SHA2\_512\_224\_PREHASH\_SHA2\_192S | NA | EUF-CMA | 3 | 48 | 96 | 16224 | -| SLH\_DSA\_SHA2\_512\_256\_PREHASH\_SHA2\_192S | NA | EUF-CMA | 3 | 48 | 96 | 16224 | -| SLH\_DSA\_SHA3\_224\_PREHASH\_SHA2\_192S | NA | EUF-CMA | 3 | 48 | 96 | 16224 | -| SLH\_DSA\_SHA3\_256\_PREHASH\_SHA2\_192S | NA | EUF-CMA | 3 | 48 | 96 | 16224 | -| SLH\_DSA\_SHA3\_384\_PREHASH\_SHA2\_192S | NA | EUF-CMA | 3 | 48 | 96 | 16224 | -| SLH\_DSA\_SHA3\_512\_PREHASH\_SHA2\_192S | NA | EUF-CMA | 3 | 48 | 96 | 16224 | -| SLH\_DSA\_SHAKE\_128\_PREHASH\_SHA2\_192S | NA | EUF-CMA | 3 | 48 | 96 | 16224 | -| SLH\_DSA\_SHAKE\_256\_PREHASH\_SHA2\_192S | NA | EUF-CMA | 3 | 48 | 96 | 16224 | -| SLH\_DSA\_SHA2\_224\_PREHASH\_SHA2\_192F | NA | EUF-CMA | 3 | 48 | 96 | 35664 | -| SLH\_DSA\_SHA2\_256\_PREHASH\_SHA2\_192F | NA | EUF-CMA | 3 | 48 | 96 | 35664 | -| SLH\_DSA\_SHA2\_384\_PREHASH\_SHA2\_192F | NA | EUF-CMA | 3 | 48 | 96 | 35664 | -| SLH\_DSA\_SHA2\_512\_PREHASH\_SHA2\_192F | NA | EUF-CMA | 3 | 48 | 96 | 35664 | -| SLH\_DSA\_SHA2\_512\_224\_PREHASH\_SHA2\_192F | NA | EUF-CMA | 3 | 48 | 96 | 35664 | -| SLH\_DSA\_SHA2\_512\_256\_PREHASH\_SHA2\_192F | NA | EUF-CMA | 3 | 48 | 96 | 35664 | -| SLH\_DSA\_SHA3\_224\_PREHASH\_SHA2\_192F | NA | EUF-CMA | 3 | 48 | 96 | 35664 | -| SLH\_DSA\_SHA3\_256\_PREHASH\_SHA2\_192F | NA | EUF-CMA | 3 | 48 | 96 | 35664 | -| SLH\_DSA\_SHA3\_384\_PREHASH\_SHA2\_192F | NA | EUF-CMA | 3 | 48 | 96 | 35664 | -| SLH\_DSA\_SHA3\_512\_PREHASH\_SHA2\_192F | NA | EUF-CMA | 3 | 48 | 96 | 35664 | -| SLH\_DSA\_SHAKE\_128\_PREHASH\_SHA2\_192F | NA | EUF-CMA | 3 | 48 | 96 | 35664 | -| SLH\_DSA\_SHAKE\_256\_PREHASH\_SHA2\_192F | NA | EUF-CMA | 3 | 48 | 96 | 35664 | -| SLH\_DSA\_SHA2\_224\_PREHASH\_SHA2\_256S | NA | EUF-CMA | 5 | 64 | 128 | 29792 | -| SLH\_DSA\_SHA2\_256\_PREHASH\_SHA2\_256S | NA | EUF-CMA | 5 | 64 | 128 | 29792 | -| SLH\_DSA\_SHA2\_384\_PREHASH\_SHA2\_256S | NA | EUF-CMA | 5 | 64 | 128 | 29792 | -| SLH\_DSA\_SHA2\_512\_PREHASH\_SHA2\_256S | NA | EUF-CMA | 5 | 64 | 128 | 29792 | -| SLH\_DSA\_SHA2\_512\_224\_PREHASH\_SHA2\_256S | NA | EUF-CMA | 5 | 64 | 128 | 29792 | -| SLH\_DSA\_SHA2\_512\_256\_PREHASH\_SHA2\_256S | NA | EUF-CMA | 5 | 64 | 128 | 29792 | -| SLH\_DSA\_SHA3\_224\_PREHASH\_SHA2\_256S | NA | EUF-CMA | 5 | 64 | 128 | 29792 | -| SLH\_DSA\_SHA3\_256\_PREHASH\_SHA2\_256S | NA | EUF-CMA | 5 | 64 | 128 | 29792 | -| SLH\_DSA\_SHA3\_384\_PREHASH\_SHA2\_256S | NA | EUF-CMA | 5 | 64 | 128 | 29792 | -| SLH\_DSA\_SHA3\_512\_PREHASH\_SHA2\_256S | NA | EUF-CMA | 5 | 64 | 128 | 29792 | -| SLH\_DSA\_SHAKE\_128\_PREHASH\_SHA2\_256S | NA | EUF-CMA | 5 | 64 | 128 | 29792 | -| SLH\_DSA\_SHAKE\_256\_PREHASH\_SHA2\_256S | NA | EUF-CMA | 5 | 64 | 128 | 29792 | -| SLH\_DSA\_SHA2\_224\_PREHASH\_SHA2\_256F | NA | EUF-CMA | 5 | 64 | 128 | 49856 | -| SLH\_DSA\_SHA2\_256\_PREHASH\_SHA2\_256F | NA | EUF-CMA | 5 | 64 | 128 | 49856 | -| SLH\_DSA\_SHA2\_384\_PREHASH\_SHA2\_256F | NA | EUF-CMA | 5 | 64 | 128 | 49856 | -| SLH\_DSA\_SHA2\_512\_PREHASH\_SHA2\_256F | NA | EUF-CMA | 5 | 64 | 128 | 49856 | -| SLH\_DSA\_SHA2\_512\_224\_PREHASH\_SHA2\_256F | NA | EUF-CMA | 5 | 64 | 128 | 49856 | -| SLH\_DSA\_SHA2\_512\_256\_PREHASH\_SHA2\_256F | NA | EUF-CMA | 5 | 64 | 128 | 49856 | -| SLH\_DSA\_SHA3\_224\_PREHASH\_SHA2\_256F | NA | EUF-CMA | 5 | 64 | 128 | 49856 | -| SLH\_DSA\_SHA3\_256\_PREHASH\_SHA2\_256F | NA | EUF-CMA | 5 | 64 | 128 | 49856 | -| SLH\_DSA\_SHA3\_384\_PREHASH\_SHA2\_256F | NA | EUF-CMA | 5 | 64 | 128 | 49856 | -| SLH\_DSA\_SHA3\_512\_PREHASH\_SHA2\_256F | NA | EUF-CMA | 5 | 64 | 128 | 49856 | -| SLH\_DSA\_SHAKE\_128\_PREHASH\_SHA2\_256F | NA | EUF-CMA | 5 | 64 | 128 | 49856 | -| SLH\_DSA\_SHAKE\_256\_PREHASH\_SHA2\_256F | NA | EUF-CMA | 5 | 64 | 128 | 49856 | -| SLH\_DSA\_SHA2\_224\_PREHASH\_SHAKE\_128S | NA | EUF-CMA | 1 | 32 | 64 | 7856 | -| SLH\_DSA\_SHA2\_256\_PREHASH\_SHAKE\_128S | NA | EUF-CMA | 1 | 32 | 64 | 7856 | -| SLH\_DSA\_SHA2\_384\_PREHASH\_SHAKE\_128S | NA | EUF-CMA | 1 | 32 | 64 | 7856 | -| SLH\_DSA\_SHA2\_512\_PREHASH\_SHAKE\_128S | NA | EUF-CMA | 1 | 32 | 64 | 7856 | -| SLH\_DSA\_SHA2\_512\_224\_PREHASH\_SHAKE\_128S | NA | EUF-CMA | 1 | 32 | 64 | 7856 | -| SLH\_DSA\_SHA2\_512\_256\_PREHASH\_SHAKE\_128S | NA | EUF-CMA | 1 | 32 | 64 | 7856 | -| SLH\_DSA\_SHA3\_224\_PREHASH\_SHAKE\_128S | NA | EUF-CMA | 1 | 32 | 64 | 7856 | -| SLH\_DSA\_SHA3\_256\_PREHASH\_SHAKE\_128S | NA | EUF-CMA | 1 | 32 | 64 | 7856 | -| SLH\_DSA\_SHA3\_384\_PREHASH\_SHAKE\_128S | NA | EUF-CMA | 1 | 32 | 64 | 7856 | -| SLH\_DSA\_SHA3\_512\_PREHASH\_SHAKE\_128S | NA | EUF-CMA | 1 | 32 | 64 | 7856 | -| SLH\_DSA\_SHAKE\_128\_PREHASH\_SHAKE\_128S | NA | EUF-CMA | 1 | 32 | 64 | 7856 | -| SLH\_DSA\_SHAKE\_256\_PREHASH\_SHAKE\_128S | NA | EUF-CMA | 1 | 32 | 64 | 7856 | -| SLH\_DSA\_SHA2\_224\_PREHASH\_SHAKE\_128F | NA | EUF-CMA | 1 | 32 | 64 | 17088 | -| SLH\_DSA\_SHA2\_256\_PREHASH\_SHAKE\_128F | NA | EUF-CMA | 1 | 32 | 64 | 17088 | -| SLH\_DSA\_SHA2\_384\_PREHASH\_SHAKE\_128F | NA | EUF-CMA | 1 | 32 | 64 | 17088 | -| SLH\_DSA\_SHA2\_512\_PREHASH\_SHAKE\_128F | NA | EUF-CMA | 1 | 32 | 64 | 17088 | -| SLH\_DSA\_SHA2\_512\_224\_PREHASH\_SHAKE\_128F | NA | EUF-CMA | 1 | 32 | 64 | 17088 | -| SLH\_DSA\_SHA2\_512\_256\_PREHASH\_SHAKE\_128F | NA | EUF-CMA | 1 | 32 | 64 | 17088 | -| SLH\_DSA\_SHA3\_224\_PREHASH\_SHAKE\_128F | NA | EUF-CMA | 1 | 32 | 64 | 17088 | -| SLH\_DSA\_SHA3\_256\_PREHASH\_SHAKE\_128F | NA | EUF-CMA | 1 | 32 | 64 | 17088 | -| SLH\_DSA\_SHA3\_384\_PREHASH\_SHAKE\_128F | NA | EUF-CMA | 1 | 32 | 64 | 17088 | -| SLH\_DSA\_SHA3\_512\_PREHASH\_SHAKE\_128F | NA | EUF-CMA | 1 | 32 | 64 | 17088 | -| SLH\_DSA\_SHAKE\_128\_PREHASH\_SHAKE\_128F | NA | EUF-CMA | 1 | 32 | 64 | 17088 | -| SLH\_DSA\_SHAKE\_256\_PREHASH\_SHAKE\_128F | NA | EUF-CMA | 1 | 32 | 64 | 17088 | -| SLH\_DSA\_SHA2\_224\_PREHASH\_SHAKE\_192S | NA | EUF-CMA | 3 | 48 | 96 | 16224 | -| SLH\_DSA\_SHA2\_256\_PREHASH\_SHAKE\_192S | NA | EUF-CMA | 3 | 48 | 96 | 16224 | -| SLH\_DSA\_SHA2\_384\_PREHASH\_SHAKE\_192S | NA | EUF-CMA | 3 | 48 | 96 | 16224 | -| SLH\_DSA\_SHA2\_512\_PREHASH\_SHAKE\_192S | NA | EUF-CMA | 3 | 48 | 96 | 16224 | -| SLH\_DSA\_SHA2\_512\_224\_PREHASH\_SHAKE\_192S | NA | EUF-CMA | 3 | 48 | 96 | 16224 | -| SLH\_DSA\_SHA2\_512\_256\_PREHASH\_SHAKE\_192S | NA | EUF-CMA | 3 | 48 | 96 | 16224 | -| SLH\_DSA\_SHA3\_224\_PREHASH\_SHAKE\_192S | NA | EUF-CMA | 3 | 48 | 96 | 16224 | -| SLH\_DSA\_SHA3\_256\_PREHASH\_SHAKE\_192S | NA | EUF-CMA | 3 | 48 | 96 | 16224 | -| SLH\_DSA\_SHA3\_384\_PREHASH\_SHAKE\_192S | NA | EUF-CMA | 3 | 48 | 96 | 16224 | -| SLH\_DSA\_SHA3\_512\_PREHASH\_SHAKE\_192S | NA | EUF-CMA | 3 | 48 | 96 | 16224 | -| SLH\_DSA\_SHAKE\_128\_PREHASH\_SHAKE\_192S | NA | EUF-CMA | 3 | 48 | 96 | 16224 | -| SLH\_DSA\_SHAKE\_256\_PREHASH\_SHAKE\_192S | NA | EUF-CMA | 3 | 48 | 96 | 16224 | -| SLH\_DSA\_SHA2\_224\_PREHASH\_SHAKE\_192F | NA | EUF-CMA | 3 | 48 | 96 | 35664 | -| SLH\_DSA\_SHA2\_256\_PREHASH\_SHAKE\_192F | NA | EUF-CMA | 3 | 48 | 96 | 35664 | -| SLH\_DSA\_SHA2\_384\_PREHASH\_SHAKE\_192F | NA | EUF-CMA | 3 | 48 | 96 | 35664 | -| SLH\_DSA\_SHA2\_512\_PREHASH\_SHAKE\_192F | NA | EUF-CMA | 3 | 48 | 96 | 35664 | -| SLH\_DSA\_SHA2\_512\_224\_PREHASH\_SHAKE\_192F | NA | EUF-CMA | 3 | 48 | 96 | 35664 | -| SLH\_DSA\_SHA2\_512\_256\_PREHASH\_SHAKE\_192F | NA | EUF-CMA | 3 | 48 | 96 | 35664 | -| SLH\_DSA\_SHA3\_224\_PREHASH\_SHAKE\_192F | NA | EUF-CMA | 3 | 48 | 96 | 35664 | -| SLH\_DSA\_SHA3\_256\_PREHASH\_SHAKE\_192F | NA | EUF-CMA | 3 | 48 | 96 | 35664 | -| SLH\_DSA\_SHA3\_384\_PREHASH\_SHAKE\_192F | NA | EUF-CMA | 3 | 48 | 96 | 35664 | -| SLH\_DSA\_SHA3\_512\_PREHASH\_SHAKE\_192F | NA | EUF-CMA | 3 | 48 | 96 | 35664 | -| SLH\_DSA\_SHAKE\_128\_PREHASH\_SHAKE\_192F | NA | EUF-CMA | 3 | 48 | 96 | 35664 | -| SLH\_DSA\_SHAKE\_256\_PREHASH\_SHAKE\_192F | NA | EUF-CMA | 3 | 48 | 96 | 35664 | -| SLH\_DSA\_SHA2\_224\_PREHASH\_SHAKE\_256S | NA | EUF-CMA | 5 | 64 | 128 | 29792 | -| SLH\_DSA\_SHA2\_256\_PREHASH\_SHAKE\_256S | NA | EUF-CMA | 5 | 64 | 128 | 29792 | -| SLH\_DSA\_SHA2\_384\_PREHASH\_SHAKE\_256S | NA | EUF-CMA | 5 | 64 | 128 | 29792 | -| SLH\_DSA\_SHA2\_512\_PREHASH\_SHAKE\_256S | NA | EUF-CMA | 5 | 64 | 128 | 29792 | -| SLH\_DSA\_SHA2\_512\_224\_PREHASH\_SHAKE\_256S | NA | EUF-CMA | 5 | 64 | 128 | 29792 | -| SLH\_DSA\_SHA2\_512\_256\_PREHASH\_SHAKE\_256S | NA | EUF-CMA | 5 | 64 | 128 | 29792 | -| SLH\_DSA\_SHA3\_224\_PREHASH\_SHAKE\_256S | NA | EUF-CMA | 5 | 64 | 128 | 29792 | -| SLH\_DSA\_SHA3\_256\_PREHASH\_SHAKE\_256S | NA | EUF-CMA | 5 | 64 | 128 | 29792 | -| SLH\_DSA\_SHA3\_384\_PREHASH\_SHAKE\_256S | NA | EUF-CMA | 5 | 64 | 128 | 29792 | -| SLH\_DSA\_SHA3\_512\_PREHASH\_SHAKE\_256S | NA | EUF-CMA | 5 | 64 | 128 | 29792 | -| SLH\_DSA\_SHAKE\_128\_PREHASH\_SHAKE\_256S | NA | EUF-CMA | 5 | 64 | 128 | 29792 | -| SLH\_DSA\_SHAKE\_256\_PREHASH\_SHAKE\_256S | NA | EUF-CMA | 5 | 64 | 128 | 29792 | -| SLH\_DSA\_SHA2\_224\_PREHASH\_SHAKE\_256F | NA | EUF-CMA | 5 | 64 | 128 | 49856 | -| SLH\_DSA\_SHA2\_256\_PREHASH\_SHAKE\_256F | NA | EUF-CMA | 5 | 64 | 128 | 49856 | -| SLH\_DSA\_SHA2\_384\_PREHASH\_SHAKE\_256F | NA | EUF-CMA | 5 | 64 | 128 | 49856 | -| SLH\_DSA\_SHA2\_512\_PREHASH\_SHAKE\_256F | NA | EUF-CMA | 5 | 64 | 128 | 49856 | -| SLH\_DSA\_SHA2\_512\_224\_PREHASH\_SHAKE\_256F | NA | EUF-CMA | 5 | 64 | 128 | 49856 | -| SLH\_DSA\_SHA2\_512\_256\_PREHASH\_SHAKE\_256F | NA | EUF-CMA | 5 | 64 | 128 | 49856 | -| SLH\_DSA\_SHA3\_224\_PREHASH\_SHAKE\_256F | NA | EUF-CMA | 5 | 64 | 128 | 49856 | -| SLH\_DSA\_SHA3\_256\_PREHASH\_SHAKE\_256F | NA | EUF-CMA | 5 | 64 | 128 | 49856 | -| SLH\_DSA\_SHA3\_384\_PREHASH\_SHAKE\_256F | NA | EUF-CMA | 5 | 64 | 128 | 49856 | -| SLH\_DSA\_SHA3\_512\_PREHASH\_SHAKE\_256F | NA | EUF-CMA | 5 | 64 | 128 | 49856 | -| SLH\_DSA\_SHAKE\_128\_PREHASH\_SHAKE\_256F | NA | EUF-CMA | 5 | 64 | 128 | 49856 | -| SLH\_DSA\_SHAKE\_256\_PREHASH\_SHAKE\_256F | NA | EUF-CMA | 5 | 64 | 128 | 49856 | +| Parameter set | Parameter set alias | Security model | Claimed NIST Level | Public key size (bytes) | Secret key size (bytes) | Signature size (bytes) | Keypair seed size (bytes) | +|:----------------------------------------------:|:----------------------|:-----------------|---------------------:|--------------------------:|--------------------------:|-------------------------:|:----------------------------| +| SLH\_DSA\_PURE\_SHA2\_128S | NA | EUF-CMA | 1 | 32 | 64 | 7856 | NA | +| SLH\_DSA\_PURE\_SHA2\_128F | NA | EUF-CMA | 1 | 32 | 64 | 17088 | NA | +| SLH\_DSA\_PURE\_SHA2\_192S | NA | EUF-CMA | 3 | 48 | 96 | 16224 | NA | +| SLH\_DSA\_PURE\_SHA2\_192F | NA | EUF-CMA | 3 | 48 | 96 | 35664 | NA | +| SLH\_DSA\_PURE\_SHA2\_256S | NA | EUF-CMA | 5 | 64 | 128 | 29792 | NA | +| SLH\_DSA\_PURE\_SHA2\_256F | NA | EUF-CMA | 5 | 64 | 128 | 49856 | NA | +| SLH\_DSA\_PURE\_SHAKE\_128S | NA | EUF-CMA | 1 | 32 | 64 | 7856 | NA | +| SLH\_DSA\_PURE\_SHAKE\_128F | NA | EUF-CMA | 1 | 32 | 64 | 17088 | NA | +| SLH\_DSA\_PURE\_SHAKE\_192S | NA | EUF-CMA | 3 | 48 | 96 | 16224 | NA | +| SLH\_DSA\_PURE\_SHAKE\_192F | NA | EUF-CMA | 3 | 48 | 96 | 35664 | NA | +| SLH\_DSA\_PURE\_SHAKE\_256S | NA | EUF-CMA | 5 | 64 | 128 | 29792 | NA | +| SLH\_DSA\_PURE\_SHAKE\_256F | NA | EUF-CMA | 5 | 64 | 128 | 49856 | NA | +| SLH\_DSA\_SHA2\_224\_PREHASH\_SHA2\_128S | NA | EUF-CMA | 1 | 32 | 64 | 7856 | NA | +| SLH\_DSA\_SHA2\_256\_PREHASH\_SHA2\_128S | NA | EUF-CMA | 1 | 32 | 64 | 7856 | NA | +| SLH\_DSA\_SHA2\_384\_PREHASH\_SHA2\_128S | NA | EUF-CMA | 1 | 32 | 64 | 7856 | NA | +| SLH\_DSA\_SHA2\_512\_PREHASH\_SHA2\_128S | NA | EUF-CMA | 1 | 32 | 64 | 7856 | NA | +| SLH\_DSA\_SHA2\_512\_224\_PREHASH\_SHA2\_128S | NA | EUF-CMA | 1 | 32 | 64 | 7856 | NA | +| SLH\_DSA\_SHA2\_512\_256\_PREHASH\_SHA2\_128S | NA | EUF-CMA | 1 | 32 | 64 | 7856 | NA | +| SLH\_DSA\_SHA3\_224\_PREHASH\_SHA2\_128S | NA | EUF-CMA | 1 | 32 | 64 | 7856 | NA | +| SLH\_DSA\_SHA3\_256\_PREHASH\_SHA2\_128S | NA | EUF-CMA | 1 | 32 | 64 | 7856 | NA | +| SLH\_DSA\_SHA3\_384\_PREHASH\_SHA2\_128S | NA | EUF-CMA | 1 | 32 | 64 | 7856 | NA | +| SLH\_DSA\_SHA3\_512\_PREHASH\_SHA2\_128S | NA | EUF-CMA | 1 | 32 | 64 | 7856 | NA | +| SLH\_DSA\_SHAKE\_128\_PREHASH\_SHA2\_128S | NA | EUF-CMA | 1 | 32 | 64 | 7856 | NA | +| SLH\_DSA\_SHAKE\_256\_PREHASH\_SHA2\_128S | NA | EUF-CMA | 1 | 32 | 64 | 7856 | NA | +| SLH\_DSA\_SHA2\_224\_PREHASH\_SHA2\_128F | NA | EUF-CMA | 1 | 32 | 64 | 17088 | NA | +| SLH\_DSA\_SHA2\_256\_PREHASH\_SHA2\_128F | NA | EUF-CMA | 1 | 32 | 64 | 17088 | NA | +| SLH\_DSA\_SHA2\_384\_PREHASH\_SHA2\_128F | NA | EUF-CMA | 1 | 32 | 64 | 17088 | NA | +| SLH\_DSA\_SHA2\_512\_PREHASH\_SHA2\_128F | NA | EUF-CMA | 1 | 32 | 64 | 17088 | NA | +| SLH\_DSA\_SHA2\_512\_224\_PREHASH\_SHA2\_128F | NA | EUF-CMA | 1 | 32 | 64 | 17088 | NA | +| SLH\_DSA\_SHA2\_512\_256\_PREHASH\_SHA2\_128F | NA | EUF-CMA | 1 | 32 | 64 | 17088 | NA | +| SLH\_DSA\_SHA3\_224\_PREHASH\_SHA2\_128F | NA | EUF-CMA | 1 | 32 | 64 | 17088 | NA | +| SLH\_DSA\_SHA3\_256\_PREHASH\_SHA2\_128F | NA | EUF-CMA | 1 | 32 | 64 | 17088 | NA | +| SLH\_DSA\_SHA3\_384\_PREHASH\_SHA2\_128F | NA | EUF-CMA | 1 | 32 | 64 | 17088 | NA | +| SLH\_DSA\_SHA3\_512\_PREHASH\_SHA2\_128F | NA | EUF-CMA | 1 | 32 | 64 | 17088 | NA | +| SLH\_DSA\_SHAKE\_128\_PREHASH\_SHA2\_128F | NA | EUF-CMA | 1 | 32 | 64 | 17088 | NA | +| SLH\_DSA\_SHAKE\_256\_PREHASH\_SHA2\_128F | NA | EUF-CMA | 1 | 32 | 64 | 17088 | NA | +| SLH\_DSA\_SHA2\_224\_PREHASH\_SHA2\_192S | NA | EUF-CMA | 3 | 48 | 96 | 16224 | NA | +| SLH\_DSA\_SHA2\_256\_PREHASH\_SHA2\_192S | NA | EUF-CMA | 3 | 48 | 96 | 16224 | NA | +| SLH\_DSA\_SHA2\_384\_PREHASH\_SHA2\_192S | NA | EUF-CMA | 3 | 48 | 96 | 16224 | NA | +| SLH\_DSA\_SHA2\_512\_PREHASH\_SHA2\_192S | NA | EUF-CMA | 3 | 48 | 96 | 16224 | NA | +| SLH\_DSA\_SHA2\_512\_224\_PREHASH\_SHA2\_192S | NA | EUF-CMA | 3 | 48 | 96 | 16224 | NA | +| SLH\_DSA\_SHA2\_512\_256\_PREHASH\_SHA2\_192S | NA | EUF-CMA | 3 | 48 | 96 | 16224 | NA | +| SLH\_DSA\_SHA3\_224\_PREHASH\_SHA2\_192S | NA | EUF-CMA | 3 | 48 | 96 | 16224 | NA | +| SLH\_DSA\_SHA3\_256\_PREHASH\_SHA2\_192S | NA | EUF-CMA | 3 | 48 | 96 | 16224 | NA | +| SLH\_DSA\_SHA3\_384\_PREHASH\_SHA2\_192S | NA | EUF-CMA | 3 | 48 | 96 | 16224 | NA | +| SLH\_DSA\_SHA3\_512\_PREHASH\_SHA2\_192S | NA | EUF-CMA | 3 | 48 | 96 | 16224 | NA | +| SLH\_DSA\_SHAKE\_128\_PREHASH\_SHA2\_192S | NA | EUF-CMA | 3 | 48 | 96 | 16224 | NA | +| SLH\_DSA\_SHAKE\_256\_PREHASH\_SHA2\_192S | NA | EUF-CMA | 3 | 48 | 96 | 16224 | NA | +| SLH\_DSA\_SHA2\_224\_PREHASH\_SHA2\_192F | NA | EUF-CMA | 3 | 48 | 96 | 35664 | NA | +| SLH\_DSA\_SHA2\_256\_PREHASH\_SHA2\_192F | NA | EUF-CMA | 3 | 48 | 96 | 35664 | NA | +| SLH\_DSA\_SHA2\_384\_PREHASH\_SHA2\_192F | NA | EUF-CMA | 3 | 48 | 96 | 35664 | NA | +| SLH\_DSA\_SHA2\_512\_PREHASH\_SHA2\_192F | NA | EUF-CMA | 3 | 48 | 96 | 35664 | NA | +| SLH\_DSA\_SHA2\_512\_224\_PREHASH\_SHA2\_192F | NA | EUF-CMA | 3 | 48 | 96 | 35664 | NA | +| SLH\_DSA\_SHA2\_512\_256\_PREHASH\_SHA2\_192F | NA | EUF-CMA | 3 | 48 | 96 | 35664 | NA | +| SLH\_DSA\_SHA3\_224\_PREHASH\_SHA2\_192F | NA | EUF-CMA | 3 | 48 | 96 | 35664 | NA | +| SLH\_DSA\_SHA3\_256\_PREHASH\_SHA2\_192F | NA | EUF-CMA | 3 | 48 | 96 | 35664 | NA | +| SLH\_DSA\_SHA3\_384\_PREHASH\_SHA2\_192F | NA | EUF-CMA | 3 | 48 | 96 | 35664 | NA | +| SLH\_DSA\_SHA3\_512\_PREHASH\_SHA2\_192F | NA | EUF-CMA | 3 | 48 | 96 | 35664 | NA | +| SLH\_DSA\_SHAKE\_128\_PREHASH\_SHA2\_192F | NA | EUF-CMA | 3 | 48 | 96 | 35664 | NA | +| SLH\_DSA\_SHAKE\_256\_PREHASH\_SHA2\_192F | NA | EUF-CMA | 3 | 48 | 96 | 35664 | NA | +| SLH\_DSA\_SHA2\_224\_PREHASH\_SHA2\_256S | NA | EUF-CMA | 5 | 64 | 128 | 29792 | NA | +| SLH\_DSA\_SHA2\_256\_PREHASH\_SHA2\_256S | NA | EUF-CMA | 5 | 64 | 128 | 29792 | NA | +| SLH\_DSA\_SHA2\_384\_PREHASH\_SHA2\_256S | NA | EUF-CMA | 5 | 64 | 128 | 29792 | NA | +| SLH\_DSA\_SHA2\_512\_PREHASH\_SHA2\_256S | NA | EUF-CMA | 5 | 64 | 128 | 29792 | NA | +| SLH\_DSA\_SHA2\_512\_224\_PREHASH\_SHA2\_256S | NA | EUF-CMA | 5 | 64 | 128 | 29792 | NA | +| SLH\_DSA\_SHA2\_512\_256\_PREHASH\_SHA2\_256S | NA | EUF-CMA | 5 | 64 | 128 | 29792 | NA | +| SLH\_DSA\_SHA3\_224\_PREHASH\_SHA2\_256S | NA | EUF-CMA | 5 | 64 | 128 | 29792 | NA | +| SLH\_DSA\_SHA3\_256\_PREHASH\_SHA2\_256S | NA | EUF-CMA | 5 | 64 | 128 | 29792 | NA | +| SLH\_DSA\_SHA3\_384\_PREHASH\_SHA2\_256S | NA | EUF-CMA | 5 | 64 | 128 | 29792 | NA | +| SLH\_DSA\_SHA3\_512\_PREHASH\_SHA2\_256S | NA | EUF-CMA | 5 | 64 | 128 | 29792 | NA | +| SLH\_DSA\_SHAKE\_128\_PREHASH\_SHA2\_256S | NA | EUF-CMA | 5 | 64 | 128 | 29792 | NA | +| SLH\_DSA\_SHAKE\_256\_PREHASH\_SHA2\_256S | NA | EUF-CMA | 5 | 64 | 128 | 29792 | NA | +| SLH\_DSA\_SHA2\_224\_PREHASH\_SHA2\_256F | NA | EUF-CMA | 5 | 64 | 128 | 49856 | NA | +| SLH\_DSA\_SHA2\_256\_PREHASH\_SHA2\_256F | NA | EUF-CMA | 5 | 64 | 128 | 49856 | NA | +| SLH\_DSA\_SHA2\_384\_PREHASH\_SHA2\_256F | NA | EUF-CMA | 5 | 64 | 128 | 49856 | NA | +| SLH\_DSA\_SHA2\_512\_PREHASH\_SHA2\_256F | NA | EUF-CMA | 5 | 64 | 128 | 49856 | NA | +| SLH\_DSA\_SHA2\_512\_224\_PREHASH\_SHA2\_256F | NA | EUF-CMA | 5 | 64 | 128 | 49856 | NA | +| SLH\_DSA\_SHA2\_512\_256\_PREHASH\_SHA2\_256F | NA | EUF-CMA | 5 | 64 | 128 | 49856 | NA | +| SLH\_DSA\_SHA3\_224\_PREHASH\_SHA2\_256F | NA | EUF-CMA | 5 | 64 | 128 | 49856 | NA | +| SLH\_DSA\_SHA3\_256\_PREHASH\_SHA2\_256F | NA | EUF-CMA | 5 | 64 | 128 | 49856 | NA | +| SLH\_DSA\_SHA3\_384\_PREHASH\_SHA2\_256F | NA | EUF-CMA | 5 | 64 | 128 | 49856 | NA | +| SLH\_DSA\_SHA3\_512\_PREHASH\_SHA2\_256F | NA | EUF-CMA | 5 | 64 | 128 | 49856 | NA | +| SLH\_DSA\_SHAKE\_128\_PREHASH\_SHA2\_256F | NA | EUF-CMA | 5 | 64 | 128 | 49856 | NA | +| SLH\_DSA\_SHAKE\_256\_PREHASH\_SHA2\_256F | NA | EUF-CMA | 5 | 64 | 128 | 49856 | NA | +| SLH\_DSA\_SHA2\_224\_PREHASH\_SHAKE\_128S | NA | EUF-CMA | 1 | 32 | 64 | 7856 | NA | +| SLH\_DSA\_SHA2\_256\_PREHASH\_SHAKE\_128S | NA | EUF-CMA | 1 | 32 | 64 | 7856 | NA | +| SLH\_DSA\_SHA2\_384\_PREHASH\_SHAKE\_128S | NA | EUF-CMA | 1 | 32 | 64 | 7856 | NA | +| SLH\_DSA\_SHA2\_512\_PREHASH\_SHAKE\_128S | NA | EUF-CMA | 1 | 32 | 64 | 7856 | NA | +| SLH\_DSA\_SHA2\_512\_224\_PREHASH\_SHAKE\_128S | NA | EUF-CMA | 1 | 32 | 64 | 7856 | NA | +| SLH\_DSA\_SHA2\_512\_256\_PREHASH\_SHAKE\_128S | NA | EUF-CMA | 1 | 32 | 64 | 7856 | NA | +| SLH\_DSA\_SHA3\_224\_PREHASH\_SHAKE\_128S | NA | EUF-CMA | 1 | 32 | 64 | 7856 | NA | +| SLH\_DSA\_SHA3\_256\_PREHASH\_SHAKE\_128S | NA | EUF-CMA | 1 | 32 | 64 | 7856 | NA | +| SLH\_DSA\_SHA3\_384\_PREHASH\_SHAKE\_128S | NA | EUF-CMA | 1 | 32 | 64 | 7856 | NA | +| SLH\_DSA\_SHA3\_512\_PREHASH\_SHAKE\_128S | NA | EUF-CMA | 1 | 32 | 64 | 7856 | NA | +| SLH\_DSA\_SHAKE\_128\_PREHASH\_SHAKE\_128S | NA | EUF-CMA | 1 | 32 | 64 | 7856 | NA | +| SLH\_DSA\_SHAKE\_256\_PREHASH\_SHAKE\_128S | NA | EUF-CMA | 1 | 32 | 64 | 7856 | NA | +| SLH\_DSA\_SHA2\_224\_PREHASH\_SHAKE\_128F | NA | EUF-CMA | 1 | 32 | 64 | 17088 | NA | +| SLH\_DSA\_SHA2\_256\_PREHASH\_SHAKE\_128F | NA | EUF-CMA | 1 | 32 | 64 | 17088 | NA | +| SLH\_DSA\_SHA2\_384\_PREHASH\_SHAKE\_128F | NA | EUF-CMA | 1 | 32 | 64 | 17088 | NA | +| SLH\_DSA\_SHA2\_512\_PREHASH\_SHAKE\_128F | NA | EUF-CMA | 1 | 32 | 64 | 17088 | NA | +| SLH\_DSA\_SHA2\_512\_224\_PREHASH\_SHAKE\_128F | NA | EUF-CMA | 1 | 32 | 64 | 17088 | NA | +| SLH\_DSA\_SHA2\_512\_256\_PREHASH\_SHAKE\_128F | NA | EUF-CMA | 1 | 32 | 64 | 17088 | NA | +| SLH\_DSA\_SHA3\_224\_PREHASH\_SHAKE\_128F | NA | EUF-CMA | 1 | 32 | 64 | 17088 | NA | +| SLH\_DSA\_SHA3\_256\_PREHASH\_SHAKE\_128F | NA | EUF-CMA | 1 | 32 | 64 | 17088 | NA | +| SLH\_DSA\_SHA3\_384\_PREHASH\_SHAKE\_128F | NA | EUF-CMA | 1 | 32 | 64 | 17088 | NA | +| SLH\_DSA\_SHA3\_512\_PREHASH\_SHAKE\_128F | NA | EUF-CMA | 1 | 32 | 64 | 17088 | NA | +| SLH\_DSA\_SHAKE\_128\_PREHASH\_SHAKE\_128F | NA | EUF-CMA | 1 | 32 | 64 | 17088 | NA | +| SLH\_DSA\_SHAKE\_256\_PREHASH\_SHAKE\_128F | NA | EUF-CMA | 1 | 32 | 64 | 17088 | NA | +| SLH\_DSA\_SHA2\_224\_PREHASH\_SHAKE\_192S | NA | EUF-CMA | 3 | 48 | 96 | 16224 | NA | +| SLH\_DSA\_SHA2\_256\_PREHASH\_SHAKE\_192S | NA | EUF-CMA | 3 | 48 | 96 | 16224 | NA | +| SLH\_DSA\_SHA2\_384\_PREHASH\_SHAKE\_192S | NA | EUF-CMA | 3 | 48 | 96 | 16224 | NA | +| SLH\_DSA\_SHA2\_512\_PREHASH\_SHAKE\_192S | NA | EUF-CMA | 3 | 48 | 96 | 16224 | NA | +| SLH\_DSA\_SHA2\_512\_224\_PREHASH\_SHAKE\_192S | NA | EUF-CMA | 3 | 48 | 96 | 16224 | NA | +| SLH\_DSA\_SHA2\_512\_256\_PREHASH\_SHAKE\_192S | NA | EUF-CMA | 3 | 48 | 96 | 16224 | NA | +| SLH\_DSA\_SHA3\_224\_PREHASH\_SHAKE\_192S | NA | EUF-CMA | 3 | 48 | 96 | 16224 | NA | +| SLH\_DSA\_SHA3\_256\_PREHASH\_SHAKE\_192S | NA | EUF-CMA | 3 | 48 | 96 | 16224 | NA | +| SLH\_DSA\_SHA3\_384\_PREHASH\_SHAKE\_192S | NA | EUF-CMA | 3 | 48 | 96 | 16224 | NA | +| SLH\_DSA\_SHA3\_512\_PREHASH\_SHAKE\_192S | NA | EUF-CMA | 3 | 48 | 96 | 16224 | NA | +| SLH\_DSA\_SHAKE\_128\_PREHASH\_SHAKE\_192S | NA | EUF-CMA | 3 | 48 | 96 | 16224 | NA | +| SLH\_DSA\_SHAKE\_256\_PREHASH\_SHAKE\_192S | NA | EUF-CMA | 3 | 48 | 96 | 16224 | NA | +| SLH\_DSA\_SHA2\_224\_PREHASH\_SHAKE\_192F | NA | EUF-CMA | 3 | 48 | 96 | 35664 | NA | +| SLH\_DSA\_SHA2\_256\_PREHASH\_SHAKE\_192F | NA | EUF-CMA | 3 | 48 | 96 | 35664 | NA | +| SLH\_DSA\_SHA2\_384\_PREHASH\_SHAKE\_192F | NA | EUF-CMA | 3 | 48 | 96 | 35664 | NA | +| SLH\_DSA\_SHA2\_512\_PREHASH\_SHAKE\_192F | NA | EUF-CMA | 3 | 48 | 96 | 35664 | NA | +| SLH\_DSA\_SHA2\_512\_224\_PREHASH\_SHAKE\_192F | NA | EUF-CMA | 3 | 48 | 96 | 35664 | NA | +| SLH\_DSA\_SHA2\_512\_256\_PREHASH\_SHAKE\_192F | NA | EUF-CMA | 3 | 48 | 96 | 35664 | NA | +| SLH\_DSA\_SHA3\_224\_PREHASH\_SHAKE\_192F | NA | EUF-CMA | 3 | 48 | 96 | 35664 | NA | +| SLH\_DSA\_SHA3\_256\_PREHASH\_SHAKE\_192F | NA | EUF-CMA | 3 | 48 | 96 | 35664 | NA | +| SLH\_DSA\_SHA3\_384\_PREHASH\_SHAKE\_192F | NA | EUF-CMA | 3 | 48 | 96 | 35664 | NA | +| SLH\_DSA\_SHA3\_512\_PREHASH\_SHAKE\_192F | NA | EUF-CMA | 3 | 48 | 96 | 35664 | NA | +| SLH\_DSA\_SHAKE\_128\_PREHASH\_SHAKE\_192F | NA | EUF-CMA | 3 | 48 | 96 | 35664 | NA | +| SLH\_DSA\_SHAKE\_256\_PREHASH\_SHAKE\_192F | NA | EUF-CMA | 3 | 48 | 96 | 35664 | NA | +| SLH\_DSA\_SHA2\_224\_PREHASH\_SHAKE\_256S | NA | EUF-CMA | 5 | 64 | 128 | 29792 | NA | +| SLH\_DSA\_SHA2\_256\_PREHASH\_SHAKE\_256S | NA | EUF-CMA | 5 | 64 | 128 | 29792 | NA | +| SLH\_DSA\_SHA2\_384\_PREHASH\_SHAKE\_256S | NA | EUF-CMA | 5 | 64 | 128 | 29792 | NA | +| SLH\_DSA\_SHA2\_512\_PREHASH\_SHAKE\_256S | NA | EUF-CMA | 5 | 64 | 128 | 29792 | NA | +| SLH\_DSA\_SHA2\_512\_224\_PREHASH\_SHAKE\_256S | NA | EUF-CMA | 5 | 64 | 128 | 29792 | NA | +| SLH\_DSA\_SHA2\_512\_256\_PREHASH\_SHAKE\_256S | NA | EUF-CMA | 5 | 64 | 128 | 29792 | NA | +| SLH\_DSA\_SHA3\_224\_PREHASH\_SHAKE\_256S | NA | EUF-CMA | 5 | 64 | 128 | 29792 | NA | +| SLH\_DSA\_SHA3\_256\_PREHASH\_SHAKE\_256S | NA | EUF-CMA | 5 | 64 | 128 | 29792 | NA | +| SLH\_DSA\_SHA3\_384\_PREHASH\_SHAKE\_256S | NA | EUF-CMA | 5 | 64 | 128 | 29792 | NA | +| SLH\_DSA\_SHA3\_512\_PREHASH\_SHAKE\_256S | NA | EUF-CMA | 5 | 64 | 128 | 29792 | NA | +| SLH\_DSA\_SHAKE\_128\_PREHASH\_SHAKE\_256S | NA | EUF-CMA | 5 | 64 | 128 | 29792 | NA | +| SLH\_DSA\_SHAKE\_256\_PREHASH\_SHAKE\_256S | NA | EUF-CMA | 5 | 64 | 128 | 29792 | NA | +| SLH\_DSA\_SHA2\_224\_PREHASH\_SHAKE\_256F | NA | EUF-CMA | 5 | 64 | 128 | 49856 | NA | +| SLH\_DSA\_SHA2\_256\_PREHASH\_SHAKE\_256F | NA | EUF-CMA | 5 | 64 | 128 | 49856 | NA | +| SLH\_DSA\_SHA2\_384\_PREHASH\_SHAKE\_256F | NA | EUF-CMA | 5 | 64 | 128 | 49856 | NA | +| SLH\_DSA\_SHA2\_512\_PREHASH\_SHAKE\_256F | NA | EUF-CMA | 5 | 64 | 128 | 49856 | NA | +| SLH\_DSA\_SHA2\_512\_224\_PREHASH\_SHAKE\_256F | NA | EUF-CMA | 5 | 64 | 128 | 49856 | NA | +| SLH\_DSA\_SHA2\_512\_256\_PREHASH\_SHAKE\_256F | NA | EUF-CMA | 5 | 64 | 128 | 49856 | NA | +| SLH\_DSA\_SHA3\_224\_PREHASH\_SHAKE\_256F | NA | EUF-CMA | 5 | 64 | 128 | 49856 | NA | +| SLH\_DSA\_SHA3\_256\_PREHASH\_SHAKE\_256F | NA | EUF-CMA | 5 | 64 | 128 | 49856 | NA | +| SLH\_DSA\_SHA3\_384\_PREHASH\_SHAKE\_256F | NA | EUF-CMA | 5 | 64 | 128 | 49856 | NA | +| SLH\_DSA\_SHA3\_512\_PREHASH\_SHAKE\_256F | NA | EUF-CMA | 5 | 64 | 128 | 49856 | NA | +| SLH\_DSA\_SHAKE\_128\_PREHASH\_SHAKE\_256F | NA | EUF-CMA | 5 | 64 | 128 | 49856 | NA | +| SLH\_DSA\_SHAKE\_256\_PREHASH\_SHAKE\_256F | NA | EUF-CMA | 5 | 64 | 128 | 49856 | NA | ## SLH\_DSA\_PURE\_SHA2\_128S implementation characteristics diff --git a/docs/algorithms/sig/snova.md b/docs/algorithms/sig/snova.md index 087560bb69..5b72b4dfb4 100644 --- a/docs/algorithms/sig/snova.md +++ b/docs/algorithms/sig/snova.md @@ -24,20 +24,20 @@ ## Parameter set summary -| Parameter set | Parameter set alias | Security model | Claimed NIST Level | Public key size (bytes) | Secret key size (bytes) | Signature size (bytes) | -|:---------------------------:|:----------------------|:-----------------|---------------------:|--------------------------:|--------------------------:|-------------------------:| -| SNOVA\_24\_5\_4 | NA | EUF-CMA | 1 | 1016 | 48 | 248 | -| SNOVA\_24\_5\_4\_SHAKE | NA | EUF-CMA | 1 | 1016 | 48 | 248 | -| SNOVA\_24\_5\_4\_esk | NA | EUF-CMA | 1 | 1016 | 36848 | 248 | -| SNOVA\_24\_5\_4\_SHAKE\_esk | NA | EUF-CMA | 1 | 1016 | 36848 | 248 | -| SNOVA\_37\_17\_2 | NA | EUF-CMA | 1 | 9842 | 48 | 124 | -| SNOVA\_25\_8\_3 | NA | EUF-CMA | 1 | 2320 | 48 | 165 | -| SNOVA\_56\_25\_2 | NA | EUF-CMA | 3 | 31266 | 48 | 178 | -| SNOVA\_49\_11\_3 | NA | EUF-CMA | 3 | 6006 | 48 | 286 | -| SNOVA\_37\_8\_4 | NA | EUF-CMA | 3 | 4112 | 48 | 376 | -| SNOVA\_24\_5\_5 | NA | EUF-CMA | 3 | 1579 | 48 | 379 | -| SNOVA\_60\_10\_4 | NA | EUF-CMA | 5 | 8016 | 48 | 576 | -| SNOVA\_29\_6\_5 | NA | EUF-CMA | 5 | 2716 | 48 | 454 | +| Parameter set | Parameter set alias | Security model | Claimed NIST Level | Public key size (bytes) | Secret key size (bytes) | Signature size (bytes) | Keypair seed size (bytes) | +|:---------------------------:|:----------------------|:-----------------|---------------------:|--------------------------:|--------------------------:|-------------------------:|:----------------------------| +| SNOVA\_24\_5\_4 | NA | EUF-CMA | 1 | 1016 | 48 | 248 | NA | +| SNOVA\_24\_5\_4\_SHAKE | NA | EUF-CMA | 1 | 1016 | 48 | 248 | NA | +| SNOVA\_24\_5\_4\_esk | NA | EUF-CMA | 1 | 1016 | 36848 | 248 | NA | +| SNOVA\_24\_5\_4\_SHAKE\_esk | NA | EUF-CMA | 1 | 1016 | 36848 | 248 | NA | +| SNOVA\_37\_17\_2 | NA | EUF-CMA | 1 | 9842 | 48 | 124 | NA | +| SNOVA\_25\_8\_3 | NA | EUF-CMA | 1 | 2320 | 48 | 165 | NA | +| SNOVA\_56\_25\_2 | NA | EUF-CMA | 3 | 31266 | 48 | 178 | NA | +| SNOVA\_49\_11\_3 | NA | EUF-CMA | 3 | 6006 | 48 | 286 | NA | +| SNOVA\_37\_8\_4 | NA | EUF-CMA | 3 | 4112 | 48 | 376 | NA | +| SNOVA\_24\_5\_5 | NA | EUF-CMA | 3 | 1579 | 48 | 379 | NA | +| SNOVA\_60\_10\_4 | NA | EUF-CMA | 5 | 8016 | 48 | 576 | NA | +| SNOVA\_29\_6\_5 | NA | EUF-CMA | 5 | 2716 | 48 | 454 | NA | ## SNOVA\_24\_5\_4 implementation characteristics diff --git a/docs/algorithms/sig/uov.md b/docs/algorithms/sig/uov.md index f8b5dfe389..b178653bb4 100644 --- a/docs/algorithms/sig/uov.md +++ b/docs/algorithms/sig/uov.md @@ -24,20 +24,20 @@ ## Parameter set summary -| Parameter set | Parameter set alias | Security model | Claimed NIST Level | Public key size (bytes) | Secret key size (bytes) | Signature size (bytes) | -|:---------------:|:----------------------|:-----------------|---------------------:|--------------------------:|--------------------------:|-------------------------:| -| OV-Is | NA | EUF-CMA | 1 | 412160 | 348704 | 96 | -| OV-Ip | NA | EUF-CMA | 1 | 278432 | 237896 | 128 | -| OV-III | NA | EUF-CMA | 3 | 1225440 | 1044320 | 200 | -| OV-V | NA | EUF-CMA | 5 | 2869440 | 2436704 | 260 | -| OV-Is-pkc | NA | EUF-CMA | 1 | 66576 | 348704 | 96 | -| OV-Ip-pkc | NA | EUF-CMA | 1 | 43576 | 237896 | 128 | -| OV-III-pkc | NA | EUF-CMA | 3 | 189232 | 1044320 | 200 | -| OV-V-pkc | NA | EUF-CMA | 5 | 446992 | 2436704 | 260 | -| OV-Is-pkc-skc | NA | EUF-CMA | 1 | 66576 | 32 | 96 | -| OV-Ip-pkc-skc | NA | EUF-CMA | 1 | 43576 | 32 | 128 | -| OV-III-pkc-skc | NA | EUF-CMA | 3 | 189232 | 32 | 200 | -| OV-V-pkc-skc | NA | EUF-CMA | 5 | 446992 | 32 | 260 | +| Parameter set | Parameter set alias | Security model | Claimed NIST Level | Public key size (bytes) | Secret key size (bytes) | Signature size (bytes) | Keypair seed size (bytes) | +|:---------------:|:----------------------|:-----------------|---------------------:|--------------------------:|--------------------------:|-------------------------:|:----------------------------| +| OV-Is | NA | EUF-CMA | 1 | 412160 | 348704 | 96 | NA | +| OV-Ip | NA | EUF-CMA | 1 | 278432 | 237896 | 128 | NA | +| OV-III | NA | EUF-CMA | 3 | 1225440 | 1044320 | 200 | NA | +| OV-V | NA | EUF-CMA | 5 | 2869440 | 2436704 | 260 | NA | +| OV-Is-pkc | NA | EUF-CMA | 1 | 66576 | 348704 | 96 | NA | +| OV-Ip-pkc | NA | EUF-CMA | 1 | 43576 | 237896 | 128 | NA | +| OV-III-pkc | NA | EUF-CMA | 3 | 189232 | 1044320 | 200 | NA | +| OV-V-pkc | NA | EUF-CMA | 5 | 446992 | 2436704 | 260 | NA | +| OV-Is-pkc-skc | NA | EUF-CMA | 1 | 66576 | 32 | 96 | NA | +| OV-Ip-pkc-skc | NA | EUF-CMA | 1 | 43576 | 32 | 128 | NA | +| OV-III-pkc-skc | NA | EUF-CMA | 3 | 189232 | 32 | 200 | NA | +| OV-V-pkc-skc | NA | EUF-CMA | 5 | 446992 | 32 | 260 | NA | ## OV-Is implementation characteristics diff --git a/scripts/copy_from_upstream/copy_from_upstream.py b/scripts/copy_from_upstream/copy_from_upstream.py index 955e7b52fa..65cfd6a842 100755 --- a/scripts/copy_from_upstream/copy_from_upstream.py +++ b/scripts/copy_from_upstream/copy_from_upstream.py @@ -417,6 +417,16 @@ def load_instructions(file='copy_from_upstream.yml'): scheme['metadata']['implementations'], key=lambda imp: (0 if imp.get('memory_optimized', False) else 1) ) + if metadata.get('derandomized_keypair'): + scheme['derandomized_keypair'] = metadata['derandomized_keypair'] + elif (not 'derandomized_keypair' in scheme) and 'derandomized_keypair' in family: + scheme['derandomized_keypair'] = family['derandomized_keypair'] + if scheme.get('derandomized_keypair'): + for imp in scheme['metadata']['implementations']: + if 'signature_keypair_derand' not in imp: + raise RuntimeError( + "Scheme {} implementation {} marks derandomized_keypair but is missing signature_keypair_derand in META".format( + scheme['pretty_name_full'], imp['name'])) if not 'scheme_paths' in scheme: scheme['scheme_paths'] = {} for imp in scheme['metadata']['implementations']: diff --git a/scripts/copy_from_upstream/copy_from_upstream.yml b/scripts/copy_from_upstream/copy_from_upstream.yml index ef1b6b17e9..b94f4e7581 100644 --- a/scripts/copy_from_upstream/copy_from_upstream.yml +++ b/scripts/copy_from_upstream/copy_from_upstream.yml @@ -70,6 +70,7 @@ upstreams: git_commit: 9b0ee84f4cf399043eca59eca4e5f8531ca1d61b sig_meta_path: 'integration/liboqs/{pretty_name_full}_META.yml' sig_scheme_path: '.' + patches: [mldsa-native-derandomized-keypair.patch] preserve_folder_structure: True - name: pqmayo diff --git a/scripts/copy_from_upstream/patches/mldsa-native-derandomized-keypair.patch b/scripts/copy_from_upstream/patches/mldsa-native-derandomized-keypair.patch new file mode 100644 index 0000000000..c8a1e985c5 --- /dev/null +++ b/scripts/copy_from_upstream/patches/mldsa-native-derandomized-keypair.patch @@ -0,0 +1,111 @@ +diff --git a/integration/liboqs/ML-DSA-44_META.yml b/integration/liboqs/ML-DSA-44_META.yml +index 31f9507..bfa51e5 100644 +--- a/integration/liboqs/ML-DSA-44_META.yml ++++ b/integration/liboqs/ML-DSA-44_META.yml +@@ -7,6 +7,8 @@ claimed-security: SUF-CMA + length-public-key: 1312 + length-secret-key: 2560 + length-signature: 2420 ++length-keypair-seed: 32 ++derandomized_keypair: true + length-mu: 64 + nistkat-sha256: 9a196e7fb32fbc93757dc2d8dc1924460eab66303c0c08aeb8b798fb8d8f8cf3 + testvectors-sha256: 5f0d135c0f7fd43f3fb9727265fcd6ec3651eb8c67c04ea5f3d8dfa1d99740d2 +@@ -26,6 +28,7 @@ implementations: + folder_name: . + compile_opts: -DMLD_CONFIG_PARAMETER_SET=44 -DMLD_CONFIG_FILE="../../integration/liboqs/config_c.h" + signature_keypair: PQCP_MLDSA_NATIVE_MLDSA44_C_keypair ++ signature_keypair_derand: PQCP_MLDSA_NATIVE_MLDSA44_C_keypair_internal + signature_signature: PQCP_MLDSA_NATIVE_MLDSA44_C_signature + signature_verify: PQCP_MLDSA_NATIVE_MLDSA44_C_verify + signature_signature_extmu: PQCP_MLDSA_NATIVE_MLDSA44_C_signature_extmu +@@ -43,6 +46,7 @@ implementations: + folder_name: . + compile_opts: -DMLD_CONFIG_PARAMETER_SET=44 -DMLD_CONFIG_FILE="../../integration/liboqs/config_x86_64.h" + signature_keypair: PQCP_MLDSA_NATIVE_MLDSA44_X86_64_keypair ++ signature_keypair_derand: PQCP_MLDSA_NATIVE_MLDSA44_X86_64_keypair_internal + signature_signature: PQCP_MLDSA_NATIVE_MLDSA44_X86_64_signature + signature_verify: PQCP_MLDSA_NATIVE_MLDSA44_X86_64_verify + signature_signature_extmu: PQCP_MLDSA_NATIVE_MLDSA44_X86_64_signature_extmu +@@ -70,6 +74,7 @@ implementations: + folder_name: . + compile_opts: -DMLD_CONFIG_PARAMETER_SET=44 -DMLD_CONFIG_FILE="../../integration/liboqs/config_aarch64.h" + signature_keypair: PQCP_MLDSA_NATIVE_MLDSA44_AARCH64_keypair ++ signature_keypair_derand: PQCP_MLDSA_NATIVE_MLDSA44_AARCH64_keypair_internal + signature_signature: PQCP_MLDSA_NATIVE_MLDSA44_AARCH64_signature + signature_verify: PQCP_MLDSA_NATIVE_MLDSA44_AARCH64_verify + signature_signature_extmu: PQCP_MLDSA_NATIVE_MLDSA44_AARCH64_signature_extmu +diff --git a/integration/liboqs/ML-DSA-65_META.yml b/integration/liboqs/ML-DSA-65_META.yml +index 5c58b47..d4d36c9 100644 +--- a/integration/liboqs/ML-DSA-65_META.yml ++++ b/integration/liboqs/ML-DSA-65_META.yml +@@ -7,6 +7,8 @@ claimed-security: SUF-CMA + length-public-key: 1952 + length-secret-key: 4032 + length-signature: 3309 ++length-keypair-seed: 32 ++derandomized_keypair: true + length-mu: 64 + nistkat-sha256: 7cb96242eac9907a55b5c84c202f0ebd552419c50b2e986dc2e28f07ecebf072 + testvectors-sha256: 14bf84918ee90e7afbd580191d3eb890d4557e0900b1145e39a8399ef7dd3fba +@@ -26,6 +28,7 @@ implementations: + folder_name: . + compile_opts: -DMLD_CONFIG_PARAMETER_SET=65 -DMLD_CONFIG_FILE="../../integration/liboqs/config_c.h" + signature_keypair: PQCP_MLDSA_NATIVE_MLDSA65_C_keypair ++ signature_keypair_derand: PQCP_MLDSA_NATIVE_MLDSA65_C_keypair_internal + signature_signature: PQCP_MLDSA_NATIVE_MLDSA65_C_signature + signature_verify: PQCP_MLDSA_NATIVE_MLDSA65_C_verify + signature_signature_extmu: PQCP_MLDSA_NATIVE_MLDSA65_C_signature_extmu +@@ -43,6 +46,7 @@ implementations: + folder_name: . + compile_opts: -DMLD_CONFIG_PARAMETER_SET=65 -DMLD_CONFIG_FILE="../../integration/liboqs/config_x86_64.h" + signature_keypair: PQCP_MLDSA_NATIVE_MLDSA65_X86_64_keypair ++ signature_keypair_derand: PQCP_MLDSA_NATIVE_MLDSA65_X86_64_keypair_internal + signature_signature: PQCP_MLDSA_NATIVE_MLDSA65_X86_64_signature + signature_verify: PQCP_MLDSA_NATIVE_MLDSA65_X86_64_verify + signature_signature_extmu: PQCP_MLDSA_NATIVE_MLDSA65_X86_64_signature_extmu +@@ -70,6 +74,7 @@ implementations: + folder_name: . + compile_opts: -DMLD_CONFIG_PARAMETER_SET=65 -DMLD_CONFIG_FILE="../../integration/liboqs/config_aarch64.h" + signature_keypair: PQCP_MLDSA_NATIVE_MLDSA65_AARCH64_keypair ++ signature_keypair_derand: PQCP_MLDSA_NATIVE_MLDSA65_AARCH64_keypair_internal + signature_signature: PQCP_MLDSA_NATIVE_MLDSA65_AARCH64_signature + signature_verify: PQCP_MLDSA_NATIVE_MLDSA65_AARCH64_verify + signature_signature_extmu: PQCP_MLDSA_NATIVE_MLDSA65_AARCH64_signature_extmu +diff --git a/integration/liboqs/ML-DSA-87_META.yml b/integration/liboqs/ML-DSA-87_META.yml +index e676330..3ab0246 100644 +--- a/integration/liboqs/ML-DSA-87_META.yml ++++ b/integration/liboqs/ML-DSA-87_META.yml +@@ -7,6 +7,8 @@ claimed-security: SUF-CMA + length-public-key: 2592 + length-secret-key: 4896 + length-signature: 4627 ++length-keypair-seed: 32 ++derandomized_keypair: true + length-mu: 64 + nistkat-sha256: 4537905d2aabcf302fab2f242baed293459ecda7c230e6a67063b02c7e2840ed + testvectors-sha256: 759a3ba35210c7e27ff90a7ce5e399295533b82ef125e6ec98af158e00268e44 +@@ -26,6 +28,7 @@ implementations: + folder_name: . + compile_opts: -DMLD_CONFIG_PARAMETER_SET=87 -DMLD_CONFIG_FILE="../../integration/liboqs/config_c.h" + signature_keypair: PQCP_MLDSA_NATIVE_MLDSA87_C_keypair ++ signature_keypair_derand: PQCP_MLDSA_NATIVE_MLDSA87_C_keypair_internal + signature_signature: PQCP_MLDSA_NATIVE_MLDSA87_C_signature + signature_verify: PQCP_MLDSA_NATIVE_MLDSA87_C_verify + signature_signature_extmu: PQCP_MLDSA_NATIVE_MLDSA87_C_signature_extmu +@@ -43,6 +46,7 @@ implementations: + folder_name: . + compile_opts: -DMLD_CONFIG_PARAMETER_SET=87 -DMLD_CONFIG_FILE="../../integration/liboqs/config_x86_64.h" + signature_keypair: PQCP_MLDSA_NATIVE_MLDSA87_X86_64_keypair ++ signature_keypair_derand: PQCP_MLDSA_NATIVE_MLDSA87_X86_64_keypair_internal + signature_signature: PQCP_MLDSA_NATIVE_MLDSA87_X86_64_signature + signature_verify: PQCP_MLDSA_NATIVE_MLDSA87_X86_64_verify + signature_signature_extmu: PQCP_MLDSA_NATIVE_MLDSA87_X86_64_signature_extmu +@@ -70,6 +74,7 @@ implementations: + folder_name: . + compile_opts: -DMLD_CONFIG_PARAMETER_SET=87 -DMLD_CONFIG_FILE="../../integration/liboqs/config_aarch64.h" + signature_keypair: PQCP_MLDSA_NATIVE_MLDSA87_AARCH64_keypair ++ signature_keypair_derand: PQCP_MLDSA_NATIVE_MLDSA87_AARCH64_keypair_internal + signature_signature: PQCP_MLDSA_NATIVE_MLDSA87_AARCH64_signature + signature_verify: PQCP_MLDSA_NATIVE_MLDSA87_AARCH64_verify + signature_signature_extmu: PQCP_MLDSA_NATIVE_MLDSA87_AARCH64_signature_extmu diff --git a/scripts/copy_from_upstream/src/sig/family/sig_family.h b/scripts/copy_from_upstream/src/sig/family/sig_family.h index bcf31bc198..4a947c7618 100644 --- a/scripts/copy_from_upstream/src/sig/family/sig_family.h +++ b/scripts/copy_from_upstream/src/sig/family/sig_family.h @@ -14,8 +14,13 @@ {%- if scheme.is_extmu and 'length-mu' in scheme['metadata'] %} #define OQS_SIG_{{ family }}_{{ scheme['scheme'] }}_length_mu {{ scheme['metadata']['length-mu'] }} {%- endif %} - +{%- if scheme.get('derandomized_keypair') %} +#define OQS_SIG_{{ family }}_{{ scheme['scheme'] }}_length_keypair_seed {{ scheme['metadata']['length-keypair-seed'] }} +{%- endif %} OQS_SIG *OQS_SIG_{{ family }}_{{ scheme['scheme'] }}_new(void); +{%- if scheme.get('derandomized_keypair') %} +OQS_API OQS_STATUS OQS_SIG_{{ family }}_{{ scheme['scheme'] }}_keypair_derand(uint8_t *public_key, uint8_t *secret_key, const uint8_t *seed); +{%- endif %} OQS_API OQS_STATUS OQS_SIG_{{ family }}_{{ scheme['scheme'] }}_keypair(uint8_t *public_key, uint8_t *secret_key); OQS_API OQS_STATUS OQS_SIG_{{ family }}_{{ scheme['scheme'] }}_sign(uint8_t *signature, size_t *signature_len, const uint8_t *message, size_t message_len, const uint8_t *secret_key); OQS_API OQS_STATUS OQS_SIG_{{ family }}_{{ scheme['scheme'] }}_verify(const uint8_t *message, size_t message_len, const uint8_t *signature, size_t signature_len, const uint8_t *public_key); diff --git a/scripts/copy_from_upstream/src/sig/family/sig_scheme.c b/scripts/copy_from_upstream/src/sig/family/sig_scheme.c index 6235b36f9a..d86fa6f1d0 100644 --- a/scripts/copy_from_upstream/src/sig/family/sig_scheme.c +++ b/scripts/copy_from_upstream/src/sig/family/sig_scheme.c @@ -31,7 +31,13 @@ OQS_SIG *OQS_SIG_{{ family }}_{{ scheme['scheme'] }}_new(void) { sig->length_public_key = OQS_SIG_{{ family }}_{{ scheme['scheme'] }}_length_public_key; sig->length_secret_key = OQS_SIG_{{ family }}_{{ scheme['scheme'] }}_length_secret_key; sig->length_signature = OQS_SIG_{{ family }}_{{ scheme['scheme'] }}_length_signature; + {%- if scheme.get('derandomized_keypair') %} + sig->length_keypair_seed = OQS_SIG_{{ family }}_{{ scheme['scheme'] }}_length_keypair_seed; + {%- endif %} + {%- if scheme.get('derandomized_keypair') %} + sig->keypair_derand = OQS_SIG_{{ family }}_{{ scheme['scheme'] }}_keypair_derand; + {%- endif %} sig->keypair = OQS_SIG_{{ family }}_{{ scheme['scheme'] }}_keypair; sig->sign = OQS_SIG_{{ family }}_{{ scheme['scheme'] }}_sign; sig->verify = OQS_SIG_{{ family }}_{{ scheme['scheme'] }}_verify; @@ -64,7 +70,13 @@ OQS_SIG *OQS_SIG_{{ family }}_{{ scheme['alias_scheme'] }}_new(void) { sig->length_public_key = OQS_SIG_{{ family }}_{{ scheme['scheme'] }}_length_public_key; sig->length_secret_key = OQS_SIG_{{ family }}_{{ scheme['scheme'] }}_length_secret_key; sig->length_signature = OQS_SIG_{{ family }}_{{ scheme['scheme'] }}_length_signature; + {%- if scheme.get('derandomized_keypair') %} + sig->length_keypair_seed = OQS_SIG_{{ family }}_{{ scheme['scheme'] }}_length_keypair_seed; + {%- endif %} + {%- if scheme.get('derandomized_keypair') %} + sig->keypair_derand = OQS_SIG_{{ family }}_{{ scheme['scheme'] }}_keypair_derand; + {%- endif %} sig->keypair = OQS_SIG_{{ family }}_{{ scheme['scheme'] }}_keypair; sig->sign = OQS_SIG_{{ family }}_{{ scheme['scheme'] }}_sign; sig->verify = OQS_SIG_{{ family }}_{{ scheme['scheme'] }}_verify; @@ -91,6 +103,11 @@ OQS_SIG *OQS_SIG_{{ family }}_{{ scheme['alias_scheme'] }}_new(void) { extern int {{ scheme['metadata']['default_keypair_signature'] }}(uint8_t *pk, uint8_t *sk); + {%- if impl.get('signature_keypair_derand') %} + {%- set cleankeypairderand = scheme['metadata'].update({'default_keypair_derand_signature': impl['signature_keypair_derand']}) %} +extern int {{ scheme['metadata']['default_keypair_derand_signature'] }}(uint8_t *pk, uint8_t *sk, const uint8_t *seed); + {%- endif %} + {%- if impl['signature_signature'] %} {%- set cleansignature = scheme['metadata'].update({'default_signature_signature': impl['signature_signature']}) -%} {%- else %} @@ -124,6 +141,10 @@ extern int {{ impl['signature_keypair'] }}(uint8_t *pk, uint8_t *sk); extern int PQCLEAN_{{ scheme['pqclean_scheme_c']|upper }}_{{ impl['name']|upper }}_crypto_sign_keypair(uint8_t *pk, uint8_t *sk); {%- endif %} + {%- if impl.get('signature_keypair_derand') %} +extern int {{ impl['signature_keypair_derand'] }}(uint8_t *pk, uint8_t *sk, const uint8_t *seed); + {%- endif %} + {%- if impl['signature_signature'] %} {%- if 'api-with-context-string' in impl and impl['api-with-context-string'] %} extern int {{ impl['signature_signature'] }}(uint8_t *sig, size_t *siglen, const uint8_t *m, size_t mlen, const uint8_t *ctx, size_t ctxlen, const uint8_t *sk); @@ -145,7 +166,37 @@ extern int PQCLEAN_{{ scheme['pqclean_scheme_c']|upper }}_{{ impl['name']|upper {%- endif %} #endif {%- endfor %} - +{% if scheme.get('derandomized_keypair') %} +OQS_API OQS_STATUS OQS_SIG_{{ family }}_{{ scheme['scheme'] }}_keypair_derand(uint8_t *public_key, uint8_t *secret_key, const uint8_t *seed) { + {%- for impl in scheme['metadata']['implementations'] if impl['name'] != scheme['default_implementation'] and impl.get('signature_keypair_derand') %} + {%- if loop.first %} +#if defined(OQS_ENABLE_SIG_{{ family }}_{{ scheme['scheme'] }}_{{ impl['name'] }}) {%- if 'alias_scheme' in scheme %} || defined(OQS_ENABLE_SIG_{{ family }}_{{ scheme['alias_scheme'] }}_{{ impl['name'] }}){%- endif %} + {%- else %} +#elif defined(OQS_ENABLE_SIG_{{ family }}_{{ scheme['scheme'] }}_{{ impl['name'] }}) {%- if 'alias_scheme' in scheme %} || defined(OQS_ENABLE_SIG_{{ family }}_{{ scheme['alias_scheme'] }}_{{ impl['name'] }}){%- endif %} + {%- endif %} + {%- if impl.get('required_flags', false) %} +#if defined(OQS_DIST_BUILD) + if ({%- for flag in impl['required_flags'] -%}OQS_CPU_has_extension(OQS_CPU_EXT_{{ flag|upper }}){%- if not loop.last %} && {% endif -%}{%- endfor -%}) { +#endif /* OQS_DIST_BUILD */ + {%- endif %} + {% if impl.get('required_flags', false) %} {% endif %}return (OQS_STATUS) {{ impl['signature_keypair_derand'] }}(public_key, secret_key, seed); + {%- if impl.get('required_flags', false) %} +#if defined(OQS_DIST_BUILD) + } else { + return (OQS_STATUS) {{ scheme['metadata']['default_keypair_derand_signature'] }}(public_key, secret_key, seed); + } +#endif /* OQS_DIST_BUILD */ + {%- endif %} + {%- endfor %} + {%- if scheme['metadata']['implementations']|rejectattr('name', 'equalto', scheme['default_implementation'])|selectattr('signature_keypair_derand')|list %} +#else + {%- endif %} + return (OQS_STATUS) {{ scheme['metadata']['default_keypair_derand_signature'] }}(public_key, secret_key, seed); + {%- if scheme['metadata']['implementations']|rejectattr('name', 'equalto', scheme['default_implementation'])|selectattr('signature_keypair_derand')|list %} +#endif + {%- endif %} +} +{% endif %} OQS_API OQS_STATUS OQS_SIG_{{ family }}_{{ scheme['scheme'] }}_keypair(uint8_t *public_key, uint8_t *secret_key) { {%- for impl in scheme['metadata']['implementations'] if impl['name'] != scheme['default_implementation'] %} {%- if loop.first %} diff --git a/scripts/copy_from_upstream/update_upstream_alg_docs.py b/scripts/copy_from_upstream/update_upstream_alg_docs.py index d630746af0..34a849a33e 100755 --- a/scripts/copy_from_upstream/update_upstream_alg_docs.py +++ b/scripts/copy_from_upstream/update_upstream_alg_docs.py @@ -392,6 +392,9 @@ def update_upstream_sig_alg_docs(liboqs_root, sigs, upstream_info, write_changes oqs_scheme_yaml['length-secret-key'] = rhs_if_not_equal(oqs_scheme_yaml['length-secret-key'], upstream_yaml['length-secret-key'], "legnth-secret-key") oqs_scheme_yaml['length-signature'] = rhs_if_not_equal(oqs_scheme_yaml['length-signature'], upstream_yaml['length-signature'], "length-signature") + if "length-keypair-seed" in oqs_scheme_yaml and "length-keypair-seed" in upstream_yaml: + oqs_scheme_yaml['length-keypair-seed'] = rhs_if_not_equal(oqs_scheme_yaml['length-keypair-seed'], upstream_yaml['length-keypair-seed'], "length-keypair-seed") + _upstream_yaml = upstream_yaml for impl_index, impl in enumerate(oqs_scheme_yaml['implementations']): upstream_yaml = _upstream_yaml diff --git a/scripts/update_docs_from_yaml.py b/scripts/update_docs_from_yaml.py index bb086a6c9e..cec25497a3 100755 --- a/scripts/update_docs_from_yaml.py +++ b/scripts/update_docs_from_yaml.py @@ -244,7 +244,8 @@ def do_it(liboqs_root): 'Claimed NIST Level', 'Public key size (bytes)', 'Secret key size (bytes)', - 'Signature size (bytes)']] + 'Signature size (bytes)', + 'Keypair seed size (bytes)']] for parameter_set in sig_yaml['parameter-sets']: table.append([parameter_set['name'].replace('_', '\\_'), parameter_set['alias'] if 'alias' in parameter_set else "NA", @@ -252,7 +253,8 @@ def do_it(liboqs_root): parameter_set['claimed-nist-level'], parameter_set['length-public-key'], parameter_set['length-secret-key'], - parameter_set['length-signature']]) + parameter_set['length-signature'], + parameter_set['length-keypair-seed'] if 'length-keypair-seed' in parameter_set else "NA"]) out_md.write(tabulate.tabulate(table, tablefmt="pipe", headers="firstrow", colalign=("center",))) out_md.write('\n') diff --git a/src/sig/ml_dsa/sig_ml_dsa.h b/src/sig/ml_dsa/sig_ml_dsa.h index fd64811e9d..07a59ef64c 100644 --- a/src/sig/ml_dsa/sig_ml_dsa.h +++ b/src/sig/ml_dsa/sig_ml_dsa.h @@ -9,8 +9,10 @@ #define OQS_SIG_ml_dsa_44_length_public_key 1312 #define OQS_SIG_ml_dsa_44_length_secret_key 2560 #define OQS_SIG_ml_dsa_44_length_signature 2420 +#define OQS_SIG_ml_dsa_44_length_keypair_seed 32 OQS_SIG *OQS_SIG_ml_dsa_44_new(void); +OQS_API OQS_STATUS OQS_SIG_ml_dsa_44_keypair_derand(uint8_t *public_key, uint8_t *secret_key, const uint8_t *seed); OQS_API OQS_STATUS OQS_SIG_ml_dsa_44_keypair(uint8_t *public_key, uint8_t *secret_key); OQS_API OQS_STATUS OQS_SIG_ml_dsa_44_sign(uint8_t *signature, size_t *signature_len, const uint8_t *message, size_t message_len, const uint8_t *secret_key); OQS_API OQS_STATUS OQS_SIG_ml_dsa_44_verify(const uint8_t *message, size_t message_len, const uint8_t *signature, size_t signature_len, const uint8_t *public_key); @@ -22,8 +24,10 @@ OQS_API OQS_STATUS OQS_SIG_ml_dsa_44_verify_with_ctx_str(const uint8_t *message, #define OQS_SIG_ml_dsa_65_length_public_key 1952 #define OQS_SIG_ml_dsa_65_length_secret_key 4032 #define OQS_SIG_ml_dsa_65_length_signature 3309 +#define OQS_SIG_ml_dsa_65_length_keypair_seed 32 OQS_SIG *OQS_SIG_ml_dsa_65_new(void); +OQS_API OQS_STATUS OQS_SIG_ml_dsa_65_keypair_derand(uint8_t *public_key, uint8_t *secret_key, const uint8_t *seed); OQS_API OQS_STATUS OQS_SIG_ml_dsa_65_keypair(uint8_t *public_key, uint8_t *secret_key); OQS_API OQS_STATUS OQS_SIG_ml_dsa_65_sign(uint8_t *signature, size_t *signature_len, const uint8_t *message, size_t message_len, const uint8_t *secret_key); OQS_API OQS_STATUS OQS_SIG_ml_dsa_65_verify(const uint8_t *message, size_t message_len, const uint8_t *signature, size_t signature_len, const uint8_t *public_key); @@ -35,8 +39,10 @@ OQS_API OQS_STATUS OQS_SIG_ml_dsa_65_verify_with_ctx_str(const uint8_t *message, #define OQS_SIG_ml_dsa_87_length_public_key 2592 #define OQS_SIG_ml_dsa_87_length_secret_key 4896 #define OQS_SIG_ml_dsa_87_length_signature 4627 +#define OQS_SIG_ml_dsa_87_length_keypair_seed 32 OQS_SIG *OQS_SIG_ml_dsa_87_new(void); +OQS_API OQS_STATUS OQS_SIG_ml_dsa_87_keypair_derand(uint8_t *public_key, uint8_t *secret_key, const uint8_t *seed); OQS_API OQS_STATUS OQS_SIG_ml_dsa_87_keypair(uint8_t *public_key, uint8_t *secret_key); OQS_API OQS_STATUS OQS_SIG_ml_dsa_87_sign(uint8_t *signature, size_t *signature_len, const uint8_t *message, size_t message_len, const uint8_t *secret_key); OQS_API OQS_STATUS OQS_SIG_ml_dsa_87_verify(const uint8_t *message, size_t message_len, const uint8_t *signature, size_t signature_len, const uint8_t *public_key); diff --git a/src/sig/ml_dsa/sig_ml_dsa_44.c b/src/sig/ml_dsa/sig_ml_dsa_44.c index 8a70f29d19..79475732ca 100644 --- a/src/sig/ml_dsa/sig_ml_dsa_44.c +++ b/src/sig/ml_dsa/sig_ml_dsa_44.c @@ -22,7 +22,9 @@ OQS_SIG *OQS_SIG_ml_dsa_44_new(void) { sig->length_public_key = OQS_SIG_ml_dsa_44_length_public_key; sig->length_secret_key = OQS_SIG_ml_dsa_44_length_secret_key; sig->length_signature = OQS_SIG_ml_dsa_44_length_signature; + sig->length_keypair_seed = OQS_SIG_ml_dsa_44_length_keypair_seed; + sig->keypair_derand = OQS_SIG_ml_dsa_44_keypair_derand; sig->keypair = OQS_SIG_ml_dsa_44_keypair; sig->sign = OQS_SIG_ml_dsa_44_sign; sig->verify = OQS_SIG_ml_dsa_44_verify; @@ -33,21 +35,50 @@ OQS_SIG *OQS_SIG_ml_dsa_44_new(void) { } extern int PQCP_MLDSA_NATIVE_MLDSA44_C_keypair(uint8_t *pk, uint8_t *sk); +extern int PQCP_MLDSA_NATIVE_MLDSA44_C_keypair_internal(uint8_t *pk, uint8_t *sk, const uint8_t *seed); extern int PQCP_MLDSA_NATIVE_MLDSA44_C_signature(uint8_t *sig, size_t *siglen, const uint8_t *m, size_t mlen, const uint8_t *ctx, size_t ctxlen, const uint8_t *sk); extern int PQCP_MLDSA_NATIVE_MLDSA44_C_verify(const uint8_t *sig, size_t siglen, const uint8_t *m, size_t mlen, const uint8_t *ctx, size_t ctxlen, const uint8_t *pk); #if defined(OQS_ENABLE_SIG_ml_dsa_44_x86_64) extern int PQCP_MLDSA_NATIVE_MLDSA44_X86_64_keypair(uint8_t *pk, uint8_t *sk); +extern int PQCP_MLDSA_NATIVE_MLDSA44_X86_64_keypair_internal(uint8_t *pk, uint8_t *sk, const uint8_t *seed); extern int PQCP_MLDSA_NATIVE_MLDSA44_X86_64_signature(uint8_t *sig, size_t *siglen, const uint8_t *m, size_t mlen, const uint8_t *ctx, size_t ctxlen, const uint8_t *sk); extern int PQCP_MLDSA_NATIVE_MLDSA44_X86_64_verify(const uint8_t *sig, size_t siglen, const uint8_t *m, size_t mlen, const uint8_t *ctx, size_t ctxlen, const uint8_t *pk); #endif #if defined(OQS_ENABLE_SIG_ml_dsa_44_aarch64) extern int PQCP_MLDSA_NATIVE_MLDSA44_AARCH64_keypair(uint8_t *pk, uint8_t *sk); +extern int PQCP_MLDSA_NATIVE_MLDSA44_AARCH64_keypair_internal(uint8_t *pk, uint8_t *sk, const uint8_t *seed); extern int PQCP_MLDSA_NATIVE_MLDSA44_AARCH64_signature(uint8_t *sig, size_t *siglen, const uint8_t *m, size_t mlen, const uint8_t *ctx, size_t ctxlen, const uint8_t *sk); extern int PQCP_MLDSA_NATIVE_MLDSA44_AARCH64_verify(const uint8_t *sig, size_t siglen, const uint8_t *m, size_t mlen, const uint8_t *ctx, size_t ctxlen, const uint8_t *pk); #endif +OQS_API OQS_STATUS OQS_SIG_ml_dsa_44_keypair_derand(uint8_t *public_key, uint8_t *secret_key, const uint8_t *seed) { +#if defined(OQS_ENABLE_SIG_ml_dsa_44_x86_64) +#if defined(OQS_DIST_BUILD) + if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2) && OQS_CPU_has_extension(OQS_CPU_EXT_BMI2) && OQS_CPU_has_extension(OQS_CPU_EXT_POPCNT)) { +#endif /* OQS_DIST_BUILD */ + return (OQS_STATUS) PQCP_MLDSA_NATIVE_MLDSA44_X86_64_keypair_internal(public_key, secret_key, seed); +#if defined(OQS_DIST_BUILD) + } else { + return (OQS_STATUS) PQCP_MLDSA_NATIVE_MLDSA44_C_keypair_internal(public_key, secret_key, seed); + } +#endif /* OQS_DIST_BUILD */ +#elif defined(OQS_ENABLE_SIG_ml_dsa_44_aarch64) +#if defined(OQS_DIST_BUILD) + if (OQS_CPU_has_extension(OQS_CPU_EXT_ARM_NEON)) { +#endif /* OQS_DIST_BUILD */ + return (OQS_STATUS) PQCP_MLDSA_NATIVE_MLDSA44_AARCH64_keypair_internal(public_key, secret_key, seed); +#if defined(OQS_DIST_BUILD) + } else { + return (OQS_STATUS) PQCP_MLDSA_NATIVE_MLDSA44_C_keypair_internal(public_key, secret_key, seed); + } +#endif /* OQS_DIST_BUILD */ +#else + return (OQS_STATUS) PQCP_MLDSA_NATIVE_MLDSA44_C_keypair_internal(public_key, secret_key, seed); +#endif +} + OQS_API OQS_STATUS OQS_SIG_ml_dsa_44_keypair(uint8_t *public_key, uint8_t *secret_key) { #if defined(OQS_ENABLE_SIG_ml_dsa_44_x86_64) #if defined(OQS_DIST_BUILD) diff --git a/src/sig/ml_dsa/sig_ml_dsa_65.c b/src/sig/ml_dsa/sig_ml_dsa_65.c index 76c3aadd12..57393c04ca 100644 --- a/src/sig/ml_dsa/sig_ml_dsa_65.c +++ b/src/sig/ml_dsa/sig_ml_dsa_65.c @@ -22,7 +22,9 @@ OQS_SIG *OQS_SIG_ml_dsa_65_new(void) { sig->length_public_key = OQS_SIG_ml_dsa_65_length_public_key; sig->length_secret_key = OQS_SIG_ml_dsa_65_length_secret_key; sig->length_signature = OQS_SIG_ml_dsa_65_length_signature; + sig->length_keypair_seed = OQS_SIG_ml_dsa_65_length_keypair_seed; + sig->keypair_derand = OQS_SIG_ml_dsa_65_keypair_derand; sig->keypair = OQS_SIG_ml_dsa_65_keypair; sig->sign = OQS_SIG_ml_dsa_65_sign; sig->verify = OQS_SIG_ml_dsa_65_verify; @@ -33,21 +35,50 @@ OQS_SIG *OQS_SIG_ml_dsa_65_new(void) { } extern int PQCP_MLDSA_NATIVE_MLDSA65_C_keypair(uint8_t *pk, uint8_t *sk); +extern int PQCP_MLDSA_NATIVE_MLDSA65_C_keypair_internal(uint8_t *pk, uint8_t *sk, const uint8_t *seed); extern int PQCP_MLDSA_NATIVE_MLDSA65_C_signature(uint8_t *sig, size_t *siglen, const uint8_t *m, size_t mlen, const uint8_t *ctx, size_t ctxlen, const uint8_t *sk); extern int PQCP_MLDSA_NATIVE_MLDSA65_C_verify(const uint8_t *sig, size_t siglen, const uint8_t *m, size_t mlen, const uint8_t *ctx, size_t ctxlen, const uint8_t *pk); #if defined(OQS_ENABLE_SIG_ml_dsa_65_x86_64) extern int PQCP_MLDSA_NATIVE_MLDSA65_X86_64_keypair(uint8_t *pk, uint8_t *sk); +extern int PQCP_MLDSA_NATIVE_MLDSA65_X86_64_keypair_internal(uint8_t *pk, uint8_t *sk, const uint8_t *seed); extern int PQCP_MLDSA_NATIVE_MLDSA65_X86_64_signature(uint8_t *sig, size_t *siglen, const uint8_t *m, size_t mlen, const uint8_t *ctx, size_t ctxlen, const uint8_t *sk); extern int PQCP_MLDSA_NATIVE_MLDSA65_X86_64_verify(const uint8_t *sig, size_t siglen, const uint8_t *m, size_t mlen, const uint8_t *ctx, size_t ctxlen, const uint8_t *pk); #endif #if defined(OQS_ENABLE_SIG_ml_dsa_65_aarch64) extern int PQCP_MLDSA_NATIVE_MLDSA65_AARCH64_keypair(uint8_t *pk, uint8_t *sk); +extern int PQCP_MLDSA_NATIVE_MLDSA65_AARCH64_keypair_internal(uint8_t *pk, uint8_t *sk, const uint8_t *seed); extern int PQCP_MLDSA_NATIVE_MLDSA65_AARCH64_signature(uint8_t *sig, size_t *siglen, const uint8_t *m, size_t mlen, const uint8_t *ctx, size_t ctxlen, const uint8_t *sk); extern int PQCP_MLDSA_NATIVE_MLDSA65_AARCH64_verify(const uint8_t *sig, size_t siglen, const uint8_t *m, size_t mlen, const uint8_t *ctx, size_t ctxlen, const uint8_t *pk); #endif +OQS_API OQS_STATUS OQS_SIG_ml_dsa_65_keypair_derand(uint8_t *public_key, uint8_t *secret_key, const uint8_t *seed) { +#if defined(OQS_ENABLE_SIG_ml_dsa_65_x86_64) +#if defined(OQS_DIST_BUILD) + if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2) && OQS_CPU_has_extension(OQS_CPU_EXT_BMI2) && OQS_CPU_has_extension(OQS_CPU_EXT_POPCNT)) { +#endif /* OQS_DIST_BUILD */ + return (OQS_STATUS) PQCP_MLDSA_NATIVE_MLDSA65_X86_64_keypair_internal(public_key, secret_key, seed); +#if defined(OQS_DIST_BUILD) + } else { + return (OQS_STATUS) PQCP_MLDSA_NATIVE_MLDSA65_C_keypair_internal(public_key, secret_key, seed); + } +#endif /* OQS_DIST_BUILD */ +#elif defined(OQS_ENABLE_SIG_ml_dsa_65_aarch64) +#if defined(OQS_DIST_BUILD) + if (OQS_CPU_has_extension(OQS_CPU_EXT_ARM_NEON)) { +#endif /* OQS_DIST_BUILD */ + return (OQS_STATUS) PQCP_MLDSA_NATIVE_MLDSA65_AARCH64_keypair_internal(public_key, secret_key, seed); +#if defined(OQS_DIST_BUILD) + } else { + return (OQS_STATUS) PQCP_MLDSA_NATIVE_MLDSA65_C_keypair_internal(public_key, secret_key, seed); + } +#endif /* OQS_DIST_BUILD */ +#else + return (OQS_STATUS) PQCP_MLDSA_NATIVE_MLDSA65_C_keypair_internal(public_key, secret_key, seed); +#endif +} + OQS_API OQS_STATUS OQS_SIG_ml_dsa_65_keypair(uint8_t *public_key, uint8_t *secret_key) { #if defined(OQS_ENABLE_SIG_ml_dsa_65_x86_64) #if defined(OQS_DIST_BUILD) diff --git a/src/sig/ml_dsa/sig_ml_dsa_87.c b/src/sig/ml_dsa/sig_ml_dsa_87.c index e1556d143b..4bf751308a 100644 --- a/src/sig/ml_dsa/sig_ml_dsa_87.c +++ b/src/sig/ml_dsa/sig_ml_dsa_87.c @@ -22,7 +22,9 @@ OQS_SIG *OQS_SIG_ml_dsa_87_new(void) { sig->length_public_key = OQS_SIG_ml_dsa_87_length_public_key; sig->length_secret_key = OQS_SIG_ml_dsa_87_length_secret_key; sig->length_signature = OQS_SIG_ml_dsa_87_length_signature; + sig->length_keypair_seed = OQS_SIG_ml_dsa_87_length_keypair_seed; + sig->keypair_derand = OQS_SIG_ml_dsa_87_keypair_derand; sig->keypair = OQS_SIG_ml_dsa_87_keypair; sig->sign = OQS_SIG_ml_dsa_87_sign; sig->verify = OQS_SIG_ml_dsa_87_verify; @@ -33,21 +35,50 @@ OQS_SIG *OQS_SIG_ml_dsa_87_new(void) { } extern int PQCP_MLDSA_NATIVE_MLDSA87_C_keypair(uint8_t *pk, uint8_t *sk); +extern int PQCP_MLDSA_NATIVE_MLDSA87_C_keypair_internal(uint8_t *pk, uint8_t *sk, const uint8_t *seed); extern int PQCP_MLDSA_NATIVE_MLDSA87_C_signature(uint8_t *sig, size_t *siglen, const uint8_t *m, size_t mlen, const uint8_t *ctx, size_t ctxlen, const uint8_t *sk); extern int PQCP_MLDSA_NATIVE_MLDSA87_C_verify(const uint8_t *sig, size_t siglen, const uint8_t *m, size_t mlen, const uint8_t *ctx, size_t ctxlen, const uint8_t *pk); #if defined(OQS_ENABLE_SIG_ml_dsa_87_x86_64) extern int PQCP_MLDSA_NATIVE_MLDSA87_X86_64_keypair(uint8_t *pk, uint8_t *sk); +extern int PQCP_MLDSA_NATIVE_MLDSA87_X86_64_keypair_internal(uint8_t *pk, uint8_t *sk, const uint8_t *seed); extern int PQCP_MLDSA_NATIVE_MLDSA87_X86_64_signature(uint8_t *sig, size_t *siglen, const uint8_t *m, size_t mlen, const uint8_t *ctx, size_t ctxlen, const uint8_t *sk); extern int PQCP_MLDSA_NATIVE_MLDSA87_X86_64_verify(const uint8_t *sig, size_t siglen, const uint8_t *m, size_t mlen, const uint8_t *ctx, size_t ctxlen, const uint8_t *pk); #endif #if defined(OQS_ENABLE_SIG_ml_dsa_87_aarch64) extern int PQCP_MLDSA_NATIVE_MLDSA87_AARCH64_keypair(uint8_t *pk, uint8_t *sk); +extern int PQCP_MLDSA_NATIVE_MLDSA87_AARCH64_keypair_internal(uint8_t *pk, uint8_t *sk, const uint8_t *seed); extern int PQCP_MLDSA_NATIVE_MLDSA87_AARCH64_signature(uint8_t *sig, size_t *siglen, const uint8_t *m, size_t mlen, const uint8_t *ctx, size_t ctxlen, const uint8_t *sk); extern int PQCP_MLDSA_NATIVE_MLDSA87_AARCH64_verify(const uint8_t *sig, size_t siglen, const uint8_t *m, size_t mlen, const uint8_t *ctx, size_t ctxlen, const uint8_t *pk); #endif +OQS_API OQS_STATUS OQS_SIG_ml_dsa_87_keypair_derand(uint8_t *public_key, uint8_t *secret_key, const uint8_t *seed) { +#if defined(OQS_ENABLE_SIG_ml_dsa_87_x86_64) +#if defined(OQS_DIST_BUILD) + if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2) && OQS_CPU_has_extension(OQS_CPU_EXT_BMI2) && OQS_CPU_has_extension(OQS_CPU_EXT_POPCNT)) { +#endif /* OQS_DIST_BUILD */ + return (OQS_STATUS) PQCP_MLDSA_NATIVE_MLDSA87_X86_64_keypair_internal(public_key, secret_key, seed); +#if defined(OQS_DIST_BUILD) + } else { + return (OQS_STATUS) PQCP_MLDSA_NATIVE_MLDSA87_C_keypair_internal(public_key, secret_key, seed); + } +#endif /* OQS_DIST_BUILD */ +#elif defined(OQS_ENABLE_SIG_ml_dsa_87_aarch64) +#if defined(OQS_DIST_BUILD) + if (OQS_CPU_has_extension(OQS_CPU_EXT_ARM_NEON)) { +#endif /* OQS_DIST_BUILD */ + return (OQS_STATUS) PQCP_MLDSA_NATIVE_MLDSA87_AARCH64_keypair_internal(public_key, secret_key, seed); +#if defined(OQS_DIST_BUILD) + } else { + return (OQS_STATUS) PQCP_MLDSA_NATIVE_MLDSA87_C_keypair_internal(public_key, secret_key, seed); + } +#endif /* OQS_DIST_BUILD */ +#else + return (OQS_STATUS) PQCP_MLDSA_NATIVE_MLDSA87_C_keypair_internal(public_key, secret_key, seed); +#endif +} + OQS_API OQS_STATUS OQS_SIG_ml_dsa_87_keypair(uint8_t *public_key, uint8_t *secret_key) { #if defined(OQS_ENABLE_SIG_ml_dsa_87_x86_64) #if defined(OQS_DIST_BUILD) diff --git a/src/sig/sig.c b/src/sig/sig.c index 3474d14759..24aef20493 100644 --- a/src/sig/sig.c +++ b/src/sig/sig.c @@ -3104,6 +3104,14 @@ OQS_API OQS_SIG *OQS_SIG_new(const char *method_name) { } } +OQS_API OQS_STATUS OQS_SIG_keypair_derand(const OQS_SIG *sig, uint8_t *public_key, uint8_t *secret_key, const uint8_t *seed) { + if (sig == NULL || sig->keypair_derand == NULL) { + return OQS_ERROR; + } else { + return sig->keypair_derand(public_key, secret_key, seed); + } +} + OQS_API OQS_STATUS OQS_SIG_keypair(const OQS_SIG *sig, uint8_t *public_key, uint8_t *secret_key) { if (sig == NULL || sig->keypair == NULL || sig->keypair(public_key, secret_key) != OQS_SUCCESS) { return OQS_ERROR; diff --git a/src/sig/sig.h b/src/sig/sig.h index 83eb9f80ff..9aa5285051 100644 --- a/src/sig/sig.h +++ b/src/sig/sig.h @@ -558,6 +558,26 @@ typedef struct OQS_SIG { size_t length_secret_key; /** The (maximum) length, in bytes, of signatures for this signature scheme. */ size_t length_signature; + /** The length, in bytes, of seeds for derandomized keypair generation for this signature scheme, or 0 if derandomized keypair generation is not supported. */ + size_t length_keypair_seed; + + /** + * Derandomized keypair generation algorithm. + * + * If this signature scheme does not support derandomized keypair generation, + * this function pointer is `NULL`, and `OQS_SIG_keypair_derand` returns + * `OQS_ERROR`. + * + * Caller is responsible for allocating sufficient memory for `public_key` and + * `secret_key`, based on the `length_*` members in this object or the per-scheme + * compile-time macros `OQS_SIG_*_length_*`. + * + * @param[out] public_key The public key represented as a byte string. + * @param[out] secret_key The secret key represented as a byte string. + * @param[in] seed The input randomness represented as a byte string of length `length_keypair_seed`. + * @return OQS_SUCCESS or OQS_ERROR + */ + OQS_STATUS (*keypair_derand)(uint8_t *public_key, uint8_t *secret_key, const uint8_t *seed); /** * Keypair generation algorithm. @@ -646,6 +666,24 @@ typedef struct OQS_SIG { */ OQS_API OQS_SIG *OQS_SIG_new(const char *method_name); +/** + * Derandomized keypair generation algorithm. + * + * Caller is responsible for allocating sufficient memory for `public_key` and + * `secret_key`, based on the `length_*` members in this object or the per-scheme + * compile-time macros `OQS_SIG_*_length_*`. + * + * Returns `OQS_ERROR` if the signature scheme does not support derandomized + * keypair generation (i.e., if `sig->keypair_derand` is `NULL`). + * + * @param[in] sig The OQS_SIG object representing the signature scheme. + * @param[out] public_key The public key represented as a byte string. + * @param[out] secret_key The secret key represented as a byte string. + * @param[in] seed The input randomness represented as a byte string of length `sig->length_keypair_seed`. + * @return OQS_SUCCESS or OQS_ERROR + */ +OQS_API OQS_STATUS OQS_SIG_keypair_derand(const OQS_SIG *sig, uint8_t *public_key, uint8_t *secret_key, const uint8_t *seed); + /** * Keypair generation algorithm. * diff --git a/tests/fuzz_test_sig.c b/tests/fuzz_test_sig.c index 96b37dba35..decb907667 100644 --- a/tests/fuzz_test_sig.c +++ b/tests/fuzz_test_sig.c @@ -107,6 +107,16 @@ static OQS_STATUS fuzz_sig(const uint8_t *data, size_t data_len) { exit(1); } + /* Exercise derandomized keypair generation under the fuzzer/ASAN, where supported. */ + if (sig->keypair_derand != NULL && ctx.data_len >= sig->length_keypair_seed) { + rc = OQS_SIG_keypair_derand(sig, public_key, secret_key, ctx.data); + if (rc != OQS_SUCCESS) { + fprintf(stderr, "ERROR: OQS_SIG_keypair_derand failed!\n"); + cleanup_heap(public_key, secret_key, signature, sig); + return OQS_ERROR; + } + } + cleanup_heap(public_key, secret_key, signature, sig); return OQS_SUCCESS; // success } diff --git a/tests/test_sig.c b/tests/test_sig.c index 4d31547ef1..3f149f6ced 100644 --- a/tests/test_sig.c +++ b/tests/test_sig.c @@ -21,6 +21,129 @@ typedef struct magic_s { uint8_t val[31]; } magic_t; +/* Tests derandomized (seed-based) keypair generation, if supported by the scheme. + * + * - If sig->keypair_derand is NULL, length_keypair_seed must be 0 and + * OQS_SIG_keypair_derand must return OQS_ERROR. + * - Otherwise, the same seed must reproduce byte-identical (pk, sk), and the + * derived keypair must be functional (sign/verify round-trip). + */ +static OQS_STATUS sig_test_derand(OQS_SIG *sig) { + OQS_STATUS ret = OQS_ERROR; + OQS_STATUS rc; + uint8_t *seed = NULL, *seed2 = NULL; + uint8_t *pk1 = NULL, *sk1 = NULL, *pk2 = NULL, *sk2 = NULL, *pk3 = NULL, *sk3 = NULL; + uint8_t *sigbuf = NULL; + size_t sig_len = 0; + const uint8_t msg[] = "derand keypair functional test"; + + if (sig->keypair_derand == NULL) { + if (sig->length_keypair_seed != 0) { + fprintf(stderr, "ERROR: keypair_derand is NULL but length_keypair_seed (%zu) != 0\n", sig->length_keypair_seed); + return OQS_ERROR; + } + rc = OQS_SIG_keypair_derand(sig, NULL, NULL, NULL); + if (rc != OQS_ERROR) { + fprintf(stderr, "ERROR: OQS_SIG_keypair_derand succeeded but a failure was expected (unsupported)\n"); + return OQS_ERROR; + } + printf("OQS_SIG_keypair_derand failed, as expected (derandomized keygen not supported)\n"); + return OQS_SUCCESS; + } + + if (sig->length_keypair_seed == 0) { + fprintf(stderr, "ERROR: keypair_derand is set but length_keypair_seed == 0\n"); + return OQS_ERROR; + } + + seed = OQS_MEM_malloc(sig->length_keypair_seed); + seed2 = OQS_MEM_malloc(sig->length_keypair_seed); + pk1 = OQS_MEM_malloc(sig->length_public_key); + sk1 = OQS_MEM_malloc(sig->length_secret_key); + pk2 = OQS_MEM_malloc(sig->length_public_key); + sk2 = OQS_MEM_malloc(sig->length_secret_key); + pk3 = OQS_MEM_malloc(sig->length_public_key); + sk3 = OQS_MEM_malloc(sig->length_secret_key); + sigbuf = OQS_MEM_malloc(sig->length_signature); + if (seed == NULL || seed2 == NULL || pk1 == NULL || sk1 == NULL || pk2 == NULL || sk2 == NULL || pk3 == NULL || sk3 == NULL || sigbuf == NULL) { + fprintf(stderr, "ERROR: OQS_MEM_malloc failed in sig_test_derand\n"); + goto cleanup; + } + + OQS_randombytes(seed, sig->length_keypair_seed); + OQS_TEST_CT_DECLASSIFY(seed, sig->length_keypair_seed); + + rc = OQS_SIG_keypair_derand(sig, pk1, sk1, seed); + if (rc != OQS_SUCCESS) { + fprintf(stderr, "ERROR: OQS_SIG_keypair_derand failed (first call)\n"); + goto cleanup; + } + rc = OQS_SIG_keypair_derand(sig, pk2, sk2, seed); + if (rc != OQS_SUCCESS) { + fprintf(stderr, "ERROR: OQS_SIG_keypair_derand failed (second call)\n"); + goto cleanup; + } + + OQS_TEST_CT_DECLASSIFY(pk1, sig->length_public_key); + OQS_TEST_CT_DECLASSIFY(pk2, sig->length_public_key); + OQS_TEST_CT_DECLASSIFY(sk1, sig->length_secret_key); + OQS_TEST_CT_DECLASSIFY(sk2, sig->length_secret_key); + + if (memcmp(pk1, pk2, sig->length_public_key) != 0) { + fprintf(stderr, "ERROR: OQS_SIG_keypair_derand is not deterministic (public keys differ)\n"); + goto cleanup; + } + if (memcmp(sk1, sk2, sig->length_secret_key) != 0) { + fprintf(stderr, "ERROR: OQS_SIG_keypair_derand is not deterministic (secret keys differ)\n"); + goto cleanup; + } + + /* A different seed must produce a different keypair: this proves the output + * actually depends on the seed, ruling out an implementation that returns a + * fixed/constant keypair (which would still pass the determinism check above). */ + memcpy(seed2, seed, sig->length_keypair_seed); + seed2[0] ^= 0x01; + OQS_TEST_CT_DECLASSIFY(seed2, sig->length_keypair_seed); + rc = OQS_SIG_keypair_derand(sig, pk3, sk3, seed2); + if (rc != OQS_SUCCESS) { + fprintf(stderr, "ERROR: OQS_SIG_keypair_derand failed (different seed)\n"); + goto cleanup; + } + OQS_TEST_CT_DECLASSIFY(pk3, sig->length_public_key); + if (memcmp(pk1, pk3, sig->length_public_key) == 0) { + fprintf(stderr, "ERROR: OQS_SIG_keypair_derand produced an identical public key for a different seed\n"); + goto cleanup; + } + + /* The derived keypair must be usable. */ + rc = OQS_SIG_sign(sig, sigbuf, &sig_len, msg, sizeof(msg), sk1); + if (rc != OQS_SUCCESS) { + fprintf(stderr, "ERROR: OQS_SIG_sign failed on a derand-generated secret key\n"); + goto cleanup; + } + OQS_TEST_CT_DECLASSIFY(sigbuf, sig_len); + rc = OQS_SIG_verify(sig, msg, sizeof(msg), sigbuf, sig_len, pk1); + if (rc != OQS_SUCCESS) { + fprintf(stderr, "ERROR: OQS_SIG_verify failed on a derand-generated public key\n"); + goto cleanup; + } + + printf("OQS_SIG_keypair_derand is deterministic and produces a functional keypair\n"); + ret = OQS_SUCCESS; + +cleanup: + OQS_MEM_insecure_free(pk1); + OQS_MEM_insecure_free(pk2); + OQS_MEM_insecure_free(pk3); + OQS_MEM_insecure_free(sigbuf); + OQS_MEM_secure_free(sk1, sig->length_secret_key); + OQS_MEM_secure_free(sk2, sig->length_secret_key); + OQS_MEM_secure_free(sk3, sig->length_secret_key); + OQS_MEM_secure_free(seed, sig->length_keypair_seed); + OQS_MEM_secure_free(seed2, sig->length_keypair_seed); + return ret; +} + static OQS_STATUS sig_test_correctness(const char *method_name, bool bitflips_all[2], size_t bitflips[2], bool extended_tests) { OQS_SIG *sig = NULL; @@ -107,6 +230,10 @@ static OQS_STATUS sig_test_correctness(const char *method_name, bool bitflips_al goto err; } + if (sig_test_derand(sig) != OQS_SUCCESS) { + goto err; + } + rc = OQS_SIG_sign(sig, signature, &signature_len, message, message_len, secret_key); OQS_TEST_CT_DECLASSIFY(&rc, sizeof rc); if (rc != OQS_SUCCESS) { diff --git a/tests/vectors_sig.c b/tests/vectors_sig.c index 01c315921e..58c68ecc65 100644 --- a/tests/vectors_sig.c +++ b/tests/vectors_sig.c @@ -323,6 +323,8 @@ static OQS_STATUS sig_kg_vector(const char *method_name, OQS_SIG *sig = NULL; uint8_t *public_key = NULL; uint8_t *secret_key = NULL; + uint8_t *derand_public_key = NULL; + uint8_t *derand_secret_key = NULL; OQS_STATUS rc, ret = OQS_ERROR; void (*randombytes_init)(const uint8_t *, const uint8_t *) = NULL; @@ -378,6 +380,34 @@ static OQS_STATUS sig_kg_vector(const char *method_name, } else { ret = OQS_ERROR; fprintf(stderr, "[vectors_sig] %s ERROR: public key or private key doesn't match!\n", method_name); + goto cleanup; + } + + /* For schemes exposing derandomized keygen (ML-DSA), the ACVP keyGen seed is + * exactly FIPS-204's xi. Feed it straight to OQS_SIG_keypair_derand and require + * the result to match the same known-answer pk/sk, proving the public API really + * computes ML-DSA.KeyGen_internal(xi). */ + if (sig->keypair_derand != NULL) { + if (sig->length_keypair_seed != MLDSA_RNDBYTES) { + fprintf(stderr, "[vectors_sig] %s ERROR: unexpected length_keypair_seed %zu for derand keyGen vector!\n", method_name, sig->length_keypair_seed); + goto err; + } + derand_public_key = OQS_MEM_malloc(sig->length_public_key); + derand_secret_key = OQS_MEM_malloc(sig->length_secret_key); + if ((derand_public_key == NULL) || (derand_secret_key == NULL)) { + fprintf(stderr, "[vectors_sig] %s ERROR: OQS_MEM_malloc failed!\n", method_name); + goto err; + } + rc = OQS_SIG_keypair_derand(sig, derand_public_key, derand_secret_key, prng_output_stream); + if (rc) { + fprintf(stderr, "[vectors_sig] %s ERROR: OQS_SIG_keypair_derand failed!\n", method_name); + goto err; + } + if (memcmp(derand_public_key, kg_pk, sig->length_public_key) || memcmp(derand_secret_key, kg_sk, sig->length_secret_key)) { + ret = OQS_ERROR; + fprintf(stderr, "[vectors_sig] %s ERROR: derandomized public key or private key doesn't match!\n", method_name); + goto cleanup; + } } goto cleanup; @@ -391,11 +421,13 @@ static OQS_STATUS sig_kg_vector(const char *method_name, cleanup: if (sig != NULL) { OQS_MEM_secure_free(secret_key, sig->length_secret_key); + OQS_MEM_secure_free(derand_secret_key, sig->length_secret_key); } if (randombytes_free != NULL) { randombytes_free(); } OQS_MEM_insecure_free(public_key); + OQS_MEM_insecure_free(derand_public_key); OQS_SIG_free(sig); return ret; }