include/openssl/mldsa.h

// Copyright 2024 The BoringSSL Authors
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
//     https://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.

#ifndef OPENSSL_HEADER_MLDSA_H_
#define OPENSSL_HEADER_MLDSA_H_

#include <openssl/base.h>  // IWYU pragma: export

#if defined(__cplusplus)
extern "C" {
#endif


// ML-DSA.
//
// This implements the Module-Lattice-Based Digital Signature Standard from
// https://csrc.nist.gov/pubs/fips/204/final


// MLDSA_SEED_BYTES is the number of bytes in an ML-DSA seed value.
#define MLDSA_SEED_BYTES 32

// MLDSA_MU_BYTES is the number of bytes in an ML-DSA mu value.
#define MLDSA_MU_BYTES 64


// ML-DSA-65.

// MLDSA65_private_key contains an ML-DSA-65 private key. The contents of this
// object should never leave the address space since the format is unstable.
struct MLDSA65_private_key {
  union {
    uint8_t bytes[(32 + 64 + 256 * 4 * 6) + 32 + 256 * 4 * (5 + 6 + 6)];
    uint32_t alignment;
  } opaque;
};

// MLDSA65_public_key contains an ML-DSA-65 public key. The contents of this
// object should never leave the address space since the format is unstable.
struct MLDSA65_public_key {
  union {
    uint8_t bytes[32 + 64 + 256 * 4 * 6];
    uint32_t alignment;
  } opaque;
};

// MLDSA65_prehash contains a pre-hash context for ML-DSA-65. The contents of
// this object should never leave the address space since the format is
// unstable.
struct MLDSA65_prehash {
  union {
    uint8_t bytes[200 + 4 + 4 + 4 * sizeof(size_t)];
    uint64_t alignment;
  } opaque;
};

// MLDSA65_PUBLIC_KEY_BYTES is the number of bytes in an encoded ML-DSA-65
// public key.
#define MLDSA65_PUBLIC_KEY_BYTES 1952

// MLDSA65_SIGNATURE_BYTES is the number of bytes in an encoded ML-DSA-65
// signature.
#define MLDSA65_SIGNATURE_BYTES 3309

// MLDSA65_generate_key generates a random public/private key pair, writes the
// encoded public key to `out_encoded_public_key`, writes the seed to
// `out_seed`, and sets `out_private_key` to the private key. Returns 1 on
// success and 0 on allocation failure.
OPENSSL_EXPORT int MLDSA65_generate_key(
    uint8_t out_encoded_public_key[MLDSA65_PUBLIC_KEY_BYTES],
    uint8_t out_seed[MLDSA_SEED_BYTES],
    struct MLDSA65_private_key *out_private_key);

// MLDSA65_private_key_from_seed regenerates a private key from a seed value
// that was generated by `MLDSA65_generate_key`. Returns 1 on success and 0 on
// allocation failure or if `seed_len` is incorrect.
OPENSSL_EXPORT int MLDSA65_private_key_from_seed(
    struct MLDSA65_private_key *out_private_key, const uint8_t *seed,
    size_t seed_len);

// MLDSA65_public_from_private sets `*out_public_key` to the public key that
// corresponds to `private_key`. Returns 1 on success and 0 on failure.
OPENSSL_EXPORT int MLDSA65_public_from_private(
    struct MLDSA65_public_key *out_public_key,
    const struct MLDSA65_private_key *private_key);

// MLDSA65_sign generates a signature for the message `msg` of length
// `msg_len` using `private_key` (following the randomized algorithm), and
// writes the encoded signature to `out_encoded_signature`. The `context`
// argument is also signed over and can be used to include implicit contextual
// information that isn't included in `msg`. The same value of `context` must be
// presented to `MLDSA65_verify` in order for the generated signature to be
// considered valid. `context` and `context_len` may be `NULL` and 0 to use an
// empty context (this is common). Returns 1 on success and 0 on failure.
OPENSSL_EXPORT int MLDSA65_sign(
    uint8_t out_encoded_signature[MLDSA65_SIGNATURE_BYTES],
    const struct MLDSA65_private_key *private_key, const uint8_t *msg,
    size_t msg_len, const uint8_t *context, size_t context_len);

// MLDSA65_verify verifies that `signature` constitutes a valid
// signature for the message `msg` of length `msg_len` using `public_key`. The
// value of `context` must equal the value that was passed to `MLDSA65_sign`
// when the signature was generated. Returns 1 on success or 0 on error.
OPENSSL_EXPORT int MLDSA65_verify(const struct MLDSA65_public_key *public_key,
                                  const uint8_t *signature,
                                  size_t signature_len, const uint8_t *msg,
                                  size_t msg_len, const uint8_t *context,
                                  size_t context_len);

// MLDSA65_prehash_init initializes a pre-hashing state using `public_key`. The
// `context` argument can be used to include implicit contextual information
// that isn't included in the message. The same value of `context` must be
// presented to `MLDSA65_verify` in order for the generated signature to be
// considered valid. `context` and `context_len` may be `NULL` and 0 to use an
// empty context (this is common). Returns 1 on success and 0 on failure (if the
// context is too long).
OPENSSL_EXPORT int MLDSA65_prehash_init(
    struct MLDSA65_prehash *out_state,
    const struct MLDSA65_public_key *public_key, const uint8_t *context,
    size_t context_len);

// MLDSA65_prehash_update incorporates the given `msg` of length `msg_len` into
// the pre-hashing state. This can be called multiple times on successive chunks
// of the message. This should be called after `MLDSA65_prehash_init` and before
// `MLDSA65_prehash_finalize`.
OPENSSL_EXPORT void MLDSA65_prehash_update(struct MLDSA65_prehash *inout_state,
                                           const uint8_t *msg, size_t msg_len);

// MLDSA65_prehash_finalize extracts a pre-hashed message representative from
// the given pre-hashing state. This should be called after
// `MLDSA65_prehash_init` and `MLDSA65_prehash_update`. The resulting
// `out_msg_rep` should then be passed to `MLDSA65_sign_message_representative`
// to obtain a signature.
OPENSSL_EXPORT void MLDSA65_prehash_finalize(
    uint8_t out_msg_rep[MLDSA_MU_BYTES], struct MLDSA65_prehash *inout_state);

// MLDSA65_sign_message_representative generates a signature for the pre-hashed
// message `msg_rep` using `private_key` (following the randomized algorithm),
// and writes the encoded signature to `out_encoded_signature`. The `msg_rep`
// should be obtained via calls to `MLDSA65_prehash_init`,
// `MLDSA65_prehash_update` and `MLDSA65_prehash_finalize` using the public key
// from the same key pair, otherwise the signature will not verify. Returns 1 on
// success and 0 on failure.
OPENSSL_EXPORT int MLDSA65_sign_message_representative(
    uint8_t out_encoded_signature[MLDSA65_SIGNATURE_BYTES],
    const struct MLDSA65_private_key *private_key,
    const uint8_t msg_rep[MLDSA_MU_BYTES]);

// MLDSA65_verify_message_representative verifies that `signature` constitutes a
// valid signature for the pre-hashed message `msg_rep` using `public_key`. The
// `msg_rep` should be obtained via calls to `MLDSA65_prehash_init`,
// `MLDSA65_prehash_update` and `MLDSA65_prehash_finalize` using `public_key`
// and the same context as when the signature was generated. Returns 1 on
// success or 0 on error.
OPENSSL_EXPORT int MLDSA65_verify_message_representative(
    const struct MLDSA65_public_key *public_key,
    const uint8_t *signature, size_t signature_len,
    const uint8_t msg_rep[MLDSA_MU_BYTES]);

// MLDSA65_marshal_public_key serializes `public_key` to `out` in the standard
// format for ML-DSA-65 public keys. It returns 1 on success or 0 on
// allocation error.
OPENSSL_EXPORT int MLDSA65_marshal_public_key(
    CBB *out, const struct MLDSA65_public_key *public_key);

// MLDSA65_parse_public_key parses a public key, in the format generated by
// `MLDSA65_marshal_public_key`, from `in` and writes the result to
// `out_public_key`. It returns 1 on success or 0 on parse error or if
// there are trailing bytes in `in`.
OPENSSL_EXPORT int MLDSA65_parse_public_key(
    struct MLDSA65_public_key *public_key, CBS *in);


// ML-DSA-87.
//
// ML-DSA-87 is excessively and unnecessarily large. Use -65 unless you are
// specifically attempting to achieve CNSA 2.0 compliance.

// MLDSA87_private_key contains an ML-DSA-87 private key. The contents of this
// object should never leave the address space since the format is unstable.
struct MLDSA87_private_key {
  union {
    uint8_t bytes[(32 + 64 + 256 * 4 * 8) + 32 + 256 * 4 * (7 + 8 + 8)];
    uint32_t alignment;
  } opaque;
};

// MLDSA87_public_key contains an ML-DSA-87 public key. The contents of this
// object should never leave the address space since the format is unstable.
struct MLDSA87_public_key {
  union {
    uint8_t bytes[32 + 64 + 256 * 4 * 8];
    uint32_t alignment;
  } opaque;
};

// MLDSA87_prehash contains a pre-hash context for ML-DSA-87. The contents of
// this object should never leave the address space since the format is
// unstable.
struct MLDSA87_prehash {
  union {
    uint8_t bytes[200 + 4 + 4 + 4 * sizeof(size_t)];
    uint64_t alignment;
  } opaque;
};

// MLDSA87_PUBLIC_KEY_BYTES is the number of bytes in an encoded ML-DSA-87
// public key.
#define MLDSA87_PUBLIC_KEY_BYTES 2592

// MLDSA87_SIGNATURE_BYTES is the number of bytes in an encoded ML-DSA-87
// signature.
#define MLDSA87_SIGNATURE_BYTES 4627

// MLDSA87_generate_key generates a random public/private key pair, writes the
// encoded public key to `out_encoded_public_key`, writes the seed to
// `out_seed`, and sets `out_private_key` to the private key. Returns 1 on
// success and 0 on allocation failure.
OPENSSL_EXPORT int MLDSA87_generate_key(
    uint8_t out_encoded_public_key[MLDSA87_PUBLIC_KEY_BYTES],
    uint8_t out_seed[MLDSA_SEED_BYTES],
    struct MLDSA87_private_key *out_private_key);

// MLDSA87_private_key_from_seed regenerates a private key from a seed value
// that was generated by `MLDSA87_generate_key`. Returns 1 on success and 0 on
// allocation failure or if `seed_len` is incorrect.
OPENSSL_EXPORT int MLDSA87_private_key_from_seed(
    struct MLDSA87_private_key *out_private_key, const uint8_t *seed,
    size_t seed_len);

// MLDSA87_public_from_private sets `*out_public_key` to the public key that
// corresponds to `private_key`. Returns 1 on success and 0 on failure.
OPENSSL_EXPORT int MLDSA87_public_from_private(
    struct MLDSA87_public_key *out_public_key,
    const struct MLDSA87_private_key *private_key);

// MLDSA87_sign generates a signature for the message `msg` of length
// `msg_len` using `private_key` (following the randomized algorithm), and
// writes the encoded signature to `out_encoded_signature`. The `context`
// argument is also signed over and can be used to include implicit contextual
// information that isn't included in `msg`. The same value of `context` must be
// presented to `MLDSA87_verify` in order for the generated signature to be
// considered valid. `context` and `context_len` may be `NULL` and 0 to use an
// empty context (this is common). Returns 1 on success and 0 on failure.
OPENSSL_EXPORT int MLDSA87_sign(
    uint8_t out_encoded_signature[MLDSA87_SIGNATURE_BYTES],
    const struct MLDSA87_private_key *private_key, const uint8_t *msg,
    size_t msg_len, const uint8_t *context, size_t context_len);

// MLDSA87_verify verifies that `signature` constitutes a valid
// signature for the message `msg` of length `msg_len` using `public_key`. The
// value of `context` must equal the value that was passed to `MLDSA87_sign`
// when the signature was generated. Returns 1 on success or 0 on error.
OPENSSL_EXPORT int MLDSA87_verify(const struct MLDSA87_public_key *public_key,
                                  const uint8_t *signature,
                                  size_t signature_len, const uint8_t *msg,
                                  size_t msg_len, const uint8_t *context,
                                  size_t context_len);

// MLDSA87_prehash_init initializes a pre-hashing state using `public_key`. The
// `context` argument can be used to include implicit contextual information
// that isn't included in the message. The same value of `context` must be
// presented to `MLDSA87_verify` in order for the generated signature to be
// considered valid. `context` and `context_len` may be `NULL` and 0 to use an
// empty context (this is common). Returns 1 on success and 0 on failure (if the
// context is too long).
OPENSSL_EXPORT int MLDSA87_prehash_init(
    struct MLDSA87_prehash *out_state,
    const struct MLDSA87_public_key *public_key, const uint8_t *context,
    size_t context_len);

// MLDSA87_prehash_update incorporates the given `msg` of length `msg_len` into
// the pre-hashing state. This can be called multiple times on successive chunks
// of the message. This should be called after `MLDSA87_prehash_init` and before
// `MLDSA87_prehash_finalize`.
OPENSSL_EXPORT void MLDSA87_prehash_update(struct MLDSA87_prehash *inout_state,
                                           const uint8_t *msg, size_t msg_len);

// MLDSA87_prehash_finalize extracts a pre-hashed message representative from
// the given pre-hashing state. This should be called after
// `MLDSA87_prehash_init` and `MLDSA87_prehash_update`. The resulting
// `out_msg_rep` should then be passed to `MLDSA87_sign_message_representative`
// to obtain a signature.
OPENSSL_EXPORT void MLDSA87_prehash_finalize(
    uint8_t out_msg_rep[MLDSA_MU_BYTES], struct MLDSA87_prehash *inout_state);

// MLDSA87_sign_message_representative generates a signature for the pre-hashed
// message `msg_rep` using `private_key` (following the randomized algorithm),
// and writes the encoded signature to `out_encoded_signature`. The `msg_rep`
// should be obtained via calls to `MLDSA87_prehash_init`,
// `MLDSA87_prehash_update` and `MLDSA87_prehash_finalize` using the public key
// from the same key pair, otherwise the signature will not verify. Returns 1 on
// success and 0 on failure.
OPENSSL_EXPORT int MLDSA87_sign_message_representative(
    uint8_t out_encoded_signature[MLDSA87_SIGNATURE_BYTES],
    const struct MLDSA87_private_key *private_key,
    const uint8_t msg_rep[MLDSA_MU_BYTES]);

// MLDSA87_verify_message_representative verifies that `signature` constitutes a
// valid signature for the pre-hashed message `msg_rep` using `public_key`. The
// `msg_rep` should be obtained via calls to `MLDSA87_prehash_init`,
// `MLDSA87_prehash_update` and `MLDSA87_prehash_finalize` using `public_key`
// and the same context as when the signature was generated. Returns 1 on
// success or 0 on error.
OPENSSL_EXPORT int MLDSA87_verify_message_representative(
    const struct MLDSA87_public_key *public_key,
    const uint8_t *signature, size_t signature_len,
    const uint8_t msg_rep[MLDSA_MU_BYTES]);

// MLDSA87_marshal_public_key serializes `public_key` to `out` in the standard
// format for ML-DSA-87 public keys. It returns 1 on success or 0 on
// allocation error.
OPENSSL_EXPORT int MLDSA87_marshal_public_key(
    CBB *out, const struct MLDSA87_public_key *public_key);

// MLDSA87_parse_public_key parses a public key, in the format generated by
// `MLDSA87_marshal_public_key`, from `in` and writes the result to
// `out_public_key`. It returns 1 on success or 0 on parse error or if
// there are trailing bytes in `in`.
OPENSSL_EXPORT int MLDSA87_parse_public_key(
    struct MLDSA87_public_key *public_key, CBS *in);


// ML-DSA-44.

// MLDSA44_private_key contains an ML-DSA-44 private key. The contents of this
// object should never leave the address space since the format is unstable.
struct MLDSA44_private_key {
  union {
    uint8_t bytes[(32 + 64 + 256 * 4 * 4) + 32 + 256 * 4 * (4 + 4 + 4)];
    uint32_t alignment;
  } opaque;
};

// MLDSA44_public_key contains an ML-DSA-44 public key. The contents of this
// object should never leave the address space since the format is unstable.
struct MLDSA44_public_key {
  union {
    uint8_t bytes[32 + 64 + 256 * 4 * 4];
    uint32_t alignment;
  } opaque;
};

// MLDSA44_prehash contains a pre-hash context for ML-DSA-44. The contents of
// this object should never leave the address space since the format is
// unstable.
struct MLDSA44_prehash {
  union {
    uint8_t bytes[200 + 4 + 4 + 4 * sizeof(size_t)];
    uint64_t alignment;
  } opaque;
};

// MLDSA44_PUBLIC_KEY_BYTES is the number of bytes in an encoded ML-DSA-44
// public key.
#define MLDSA44_PUBLIC_KEY_BYTES 1312

// MLDSA44_SIGNATURE_BYTES is the number of bytes in an encoded ML-DSA-44
// signature.
#define MLDSA44_SIGNATURE_BYTES 2420

// MLDSA44_generate_key generates a random public/private key pair, writes the
// encoded public key to `out_encoded_public_key`, writes the seed to
// `out_seed`, and sets `out_private_key` to the private key. Returns 1 on
// success and 0 on allocation failure.
OPENSSL_EXPORT int MLDSA44_generate_key(
    uint8_t out_encoded_public_key[MLDSA44_PUBLIC_KEY_BYTES],
    uint8_t out_seed[MLDSA_SEED_BYTES],
    struct MLDSA44_private_key *out_private_key);

// MLDSA44_private_key_from_seed regenerates a private key from a seed value
// that was generated by `MLDSA44_generate_key`. Returns 1 on success and 0 on
// allocation failure or if `seed_len` is incorrect.
OPENSSL_EXPORT int MLDSA44_private_key_from_seed(
    struct MLDSA44_private_key *out_private_key, const uint8_t *seed,
    size_t seed_len);

// MLDSA44_public_from_private sets `*out_public_key` to the public key that
// corresponds to `private_key`. Returns 1 on success and 0 on failure.
OPENSSL_EXPORT int MLDSA44_public_from_private(
    struct MLDSA44_public_key *out_public_key,
    const struct MLDSA44_private_key *private_key);

// MLDSA44_sign generates a signature for the message `msg` of length
// `msg_len` using `private_key` (following the randomized algorithm), and
// writes the encoded signature to `out_encoded_signature`. The `context`
// argument is also signed over and can be used to include implicit contextual
// information that isn't included in `msg`. The same value of `context` must be
// presented to `MLDSA44_verify` in order for the generated signature to be
// considered valid. `context` and `context_len` may be `NULL` and 0 to use an
// empty context (this is common). Returns 1 on success and 0 on failure.
OPENSSL_EXPORT int MLDSA44_sign(
    uint8_t out_encoded_signature[MLDSA44_SIGNATURE_BYTES],
    const struct MLDSA44_private_key *private_key, const uint8_t *msg,
    size_t msg_len, const uint8_t *context, size_t context_len);

// MLDSA44_verify verifies that `signature` constitutes a valid
// signature for the message `msg` of length `msg_len` using `public_key`. The
// value of `context` must equal the value that was passed to `MLDSA44_sign`
// when the signature was generated. Returns 1 on success or 0 on error.
OPENSSL_EXPORT int MLDSA44_verify(const struct MLDSA44_public_key *public_key,
                                  const uint8_t *signature,
                                  size_t signature_len, const uint8_t *msg,
                                  size_t msg_len, const uint8_t *context,
                                  size_t context_len);

// MLDSA44_prehash_init initializes a pre-hashing state using `public_key`. The
// `context` argument can be used to include implicit contextual information
// that isn't included in the message. The same value of `context` must be
// presented to `MLDSA44_verify` in order for the generated signature to be
// considered valid. `context` and `context_len` may be `NULL` and 0 to use an
// empty context (this is common). Returns 1 on success and 0 on failure (if the
// context is too long).
OPENSSL_EXPORT int MLDSA44_prehash_init(
    struct MLDSA44_prehash *out_state,
    const struct MLDSA44_public_key *public_key, const uint8_t *context,
    size_t context_len);

// MLDSA44_prehash_update incorporates the given `msg` of length `msg_len` into
// the pre-hashing state. This can be called multiple times on successive chunks
// of the message. This should be called after `MLDSA44_prehash_init` and before
// `MLDSA44_prehash_finalize`.
OPENSSL_EXPORT void MLDSA44_prehash_update(struct MLDSA44_prehash *inout_state,
                                           const uint8_t *msg, size_t msg_len);

// MLDSA44_prehash_finalize extracts a pre-hashed message representative from
// the given pre-hashing state. This should be called after
// `MLDSA44_prehash_init` and `MLDSA44_prehash_update`. The resulting
// `out_msg_rep` should then be passed to `MLDSA44_sign_message_representative`
// to obtain a signature.
OPENSSL_EXPORT void MLDSA44_prehash_finalize(
    uint8_t out_msg_rep[MLDSA_MU_BYTES], struct MLDSA44_prehash *inout_state);

// MLDSA44_sign_message_representative generates a signature for the pre-hashed
// message `msg_rep` using `private_key` (following the randomized algorithm),
// and writes the encoded signature to `out_encoded_signature`. The `msg_rep`
// should be obtained via calls to `MLDSA44_prehash_init`,
// `MLDSA44_prehash_update` and `MLDSA44_prehash_finalize` using the public key
// from the same key pair, otherwise the signature will not verify. Returns 1 on
// success and 0 on failure.
OPENSSL_EXPORT int MLDSA44_sign_message_representative(
    uint8_t out_encoded_signature[MLDSA44_SIGNATURE_BYTES],
    const struct MLDSA44_private_key *private_key,
    const uint8_t msg_rep[MLDSA_MU_BYTES]);

// MLDSA44_verify_message_representative verifies that `signature` constitutes a
// valid signature for the pre-hashed message `msg_rep` using `public_key`. The
// `msg_rep` should be obtained via calls to `MLDSA44_prehash_init`,
// `MLDSA44_prehash_update` and `MLDSA44_prehash_finalize` using `public_key`
// and the same context as when the signature was generated. Returns 1 on
// success or 0 on error.
OPENSSL_EXPORT int MLDSA44_verify_message_representative(
    const struct MLDSA44_public_key *public_key,
    const uint8_t *signature, size_t signature_len,
    const uint8_t msg_rep[MLDSA_MU_BYTES]);

// MLDSA44_marshal_public_key serializes `public_key` to `out` in the standard
// format for ML-DSA-44 public keys. It returns 1 on success or 0 on
// allocation error.
OPENSSL_EXPORT int MLDSA44_marshal_public_key(
    CBB *out, const struct MLDSA44_public_key *public_key);

// MLDSA44_parse_public_key parses a public key, in the format generated by
// `MLDSA44_marshal_public_key`, from `in` and writes the result to
// `out_public_key`. It returns 1 on success or 0 on parse error or if
// there are trailing bytes in `in`.
OPENSSL_EXPORT int MLDSA44_parse_public_key(
    struct MLDSA44_public_key *public_key, CBS *in);


#if defined(__cplusplus)
}  // extern C
#endif

#endif  // OPENSSL_HEADER_MLDSA_H_