)]}'
{
  "commit": "af41e135bc1714981fb8a791e9dda4fc6ff140c3",
  "tree": "68526bcae2a2ce95476c03ef546db87ab0a91ab0",
  "parents": [
    "1f2ee5e97ae0a1718672ca5fcf904f3e6d462713"
  ],
  "author": {
    "name": "Jakub Patałuch",
    "email": "jjpat@google.com",
    "time": "Mon Oct 12 11:00:08 2026 +0000"
  },
  "committer": {
    "name": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com",
    "email": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com",
    "time": "Wed Oct 21 14:24:27 2026 -0700"
  },
  "message": "Precompute the PK.seed SHA-256 state in SLH-DSA-SHA2\n\nIn the SHA2 instantiation of SLH-DSA (FIPS 205, section 11.2), every\ncall to F, H, T_l, T_k and PRF starts by hashing\nPK.seed || toByte(0, 64 - n). That is exactly one SHA-256 block, and it\nis the same for every call made with a given key. The SPHINCS+ round\n3.1 specification (section 8.1.6) pads PK.seed to a full block for this\nreason, so that implementations can compute the state after that block\nonce instead of on every call.\n\nCompute that state once per key generation, signing or verification\noperation and keep it, with PK.seed, in a new slhdsa_hash_ctx. The\ncontext replaces the raw PK.seed argument of the internal WOTS+, FORS,\nXMSS and thash functions.\n\nAfter the cached block, the rest of an F, H or PRF input (ADRSc and one\nor two n-byte values) fits in a single block together with the SHA-256\npadding. Build that block directly and process it with one call to\nBCM_sha256_transform_blocks, rather than going through SHA256_Update\nand SHA256_Final. For PRF calls the block contains SK.seed, and for F\ncalls it can contain secret WOTS+ or FORS values, so clear it with\nOPENSSL_cleanse afterwards. Previously, SHA256_Final cleared the\nequivalent buffer. T_l and T_k still use SHA256_Update and\nSHA256_Final, starting from the precomputed state.\n\nThe output is unchanged, and so are the self-test known-answer values.\nThe fast path does not call SHA256_Final, so it does not update the\nFIPS service indicator. Every SLH-DSA operation still calls\nSHA256_Final at least once (for T_l, and for H_msg when signing or\nverifying), so the indicator still moves during each operation, as it\ndid before. SLH-DSA-SHAKE-256f is not affected.\n\nSLH-DSA-SHA2-128s on an Intel Xeon at 2.0 GHz without SHA-NI, median\nof 15 runs:\n\n           Before      After       Speedup\n  keygen    158.3 ms    74.7 ms    2.12x\n  sign     1204.6 ms   568.1 ms    2.12x\n  verify    1.176 ms   0.565 ms    2.08x\n\nChange-Id: Ib57a2fd38a113d65f2e0b3bbf03b884b616941ae\nReviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/104029\nReviewed-by: David Benjamin \u003cdavidben@google.com\u003e\nCommit-Queue: David Benjamin \u003cdavidben@google.com\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "dafceda506a4f0156034eb9d58acf11cc023db8d",
      "old_mode": 33188,
      "old_path": "crypto/fipsmodule/slhdsa/fors.cc.inc",
      "new_id": "2f1678820feb4f35b853c83606a103ffadd3e132",
      "new_mode": 33188,
      "new_path": "crypto/fipsmodule/slhdsa/fors.cc.inc"
    },
    {
      "type": "modify",
      "old_id": "f123a22fe2a9dfb3189631a57a288af2a082a3ce",
      "old_mode": 33188,
      "old_path": "crypto/fipsmodule/slhdsa/fors.h",
      "new_id": "9963778db3f4cd72c4153fc0bfa87453391d9acf",
      "new_mode": 33188,
      "new_path": "crypto/fipsmodule/slhdsa/fors.h"
    },
    {
      "type": "modify",
      "old_id": "84602c88bad91cd5885ff12dd8730f7ca3a2348e",
      "old_mode": 33188,
      "old_path": "crypto/fipsmodule/slhdsa/merkle.cc.inc",
      "new_id": "243982efbc45bd0016e7c141566c2e806890cfac",
      "new_mode": 33188,
      "new_path": "crypto/fipsmodule/slhdsa/merkle.cc.inc"
    },
    {
      "type": "modify",
      "old_id": "c13b6ff37110fa46b83fc4289a89c54d2d869ddd",
      "old_mode": 33188,
      "old_path": "crypto/fipsmodule/slhdsa/merkle.h",
      "new_id": "5d2a140cd661a07916fefead8cab86ebbbea0bbc",
      "new_mode": 33188,
      "new_path": "crypto/fipsmodule/slhdsa/merkle.h"
    },
    {
      "type": "modify",
      "old_id": "525127747b7df4f1812e649e2d476c205f34a2a1",
      "old_mode": 33188,
      "old_path": "crypto/fipsmodule/slhdsa/slhdsa.cc.inc",
      "new_id": "91c25647698706f85de034ab30138a98e328b3ce",
      "new_mode": 33188,
      "new_path": "crypto/fipsmodule/slhdsa/slhdsa.cc.inc"
    },
    {
      "type": "modify",
      "old_id": "2cb608fb149e4801390348514e0db0cee3bdd4bc",
      "old_mode": 33188,
      "old_path": "crypto/fipsmodule/slhdsa/thash.cc.inc",
      "new_id": "6e76b5640ea6d3330c4e3c36afbd90ae4a44afcd",
      "new_mode": 33188,
      "new_path": "crypto/fipsmodule/slhdsa/thash.cc.inc"
    },
    {
      "type": "modify",
      "old_id": "23a42c6bae9be41706a0f73269804e1b72d2eb10",
      "old_mode": 33188,
      "old_path": "crypto/fipsmodule/slhdsa/thash.h",
      "new_id": "b72e0faed6056dff17923cc1f88fbb0e87e52165",
      "new_mode": 33188,
      "new_path": "crypto/fipsmodule/slhdsa/thash.h"
    },
    {
      "type": "modify",
      "old_id": "e8bc990093a8e3547f045c495bf02a8e71daddb1",
      "old_mode": 33188,
      "old_path": "crypto/fipsmodule/slhdsa/wots.cc.inc",
      "new_id": "7a073b9d34d8ffbc9e452ed502f65debda22580d",
      "new_mode": 33188,
      "new_path": "crypto/fipsmodule/slhdsa/wots.cc.inc"
    },
    {
      "type": "modify",
      "old_id": "28afeb0577722483c2fa9612e642091b73057e47",
      "old_mode": 33188,
      "old_path": "crypto/fipsmodule/slhdsa/wots.h",
      "new_id": "a41f26c92de05b9689716cfae9da222d88898e0b",
      "new_mode": 33188,
      "new_path": "crypto/fipsmodule/slhdsa/wots.h"
    }
  ]
}