include/openssl/mldsa.h

// Copyright 2024 The BoringSSL Authors
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
//     https://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.

#ifndef OPENSSL_HEADER_MLDSA_H_
#define OPENSSL_HEADER_MLDSA_H_

#include <openssl/base.h>  // IWYU pragma: export

#if defined(__cplusplus)
extern "C" {
#endif


// ML-DSA.
//
// This implements the Module-Lattice-Based Digital Signature Standard from
// https://csrc.nist.gov/pubs/fips/204/final


// MLDSA_SEED_BYTES is the number of bytes in an ML-DSA seed value.
#define MLDSA_SEED_BYTES 32

// MLDSA_MU_BYTES is the number of bytes in an ML-DSA mu value.
#define MLDSA_MU_BYTES 64


// ML-DSA-65.

// MLDSA65_private_key contains an ML-DSA-65 private key. The contents of this
// object should never leave the address space since the format is unstable.
struct MLDSA65_private_key {
  union {
    uint8_t bytes[(32 + 64 + 256 * 4 * 6) + 32 + 256 * 4 * (5 + 6 + 6)];
    uint32_t alignment;
  } opaque;
};

// MLDSA65_public_key contains an ML-DSA-65 public key. The contents of this
// object should never leave the address space since the format is unstable.
struct MLDSA65_public_key {
  union {
    uint8_t bytes[32 + 64 + 256 * 4 * 6];
    uint32_t alignment;
  } opaque;
};

// MLDSA65_prehash contains a pre-hash context for ML-DSA-65. The contents of
// this object should never leave the address space since the format is
// unstable.
struct MLDSA65_prehash {
  union {
    uint8_t bytes[200 + 4 + 4 + 4 * sizeof(size_t)];
    uint64_t alignment;
  } opaque;
};

// MLDSA65_PUBLIC_KEY_BYTES is the number of bytes in an encoded ML-DSA-65
// public key.
#define MLDSA65_PUBLIC_KEY_BYTES 1952

// MLDSA65_SIGNATURE_BYTES is the number of bytes in an encoded ML-DSA-65
// signature.
#define MLDSA65_SIGNATURE_BYTES 3309

// MLDSA65_generate_key generates a random public/private key pair, writes the
// encoded public key to |out_encoded_public_key|, writes the seed to
// |out_seed|, and sets |out_private_key| to the private key. Returns 1 on
// success and 0 on allocation failure.
OPENSSL_EXPORT int MLDSA65_generate_key(
    uint8_t out_encoded_public_key[MLDSA65_PUBLIC_KEY_BYTES],
    uint8_t out_seed[MLDSA_SEED_BYTES],
    struct MLDSA65_private_key *out_private_key);

// MLDSA65_private_key_from_seed regenerates a private key from a seed value
// that was generated by |MLDSA65_generate_key|. Returns 1 on success and 0 on
// allocation failure or if |seed_len| is incorrect.
OPENSSL_EXPORT int MLDSA65_private_key_from_seed(
    struct MLDSA65_private_key *out_private_key, const uint8_t *seed,
    size_t seed_len);

// MLDSA65_public_from_private sets |*out_public_key| to the public key that
// corresponds to |private_key|. Returns 1 on success and 0 on failure.
OPENSSL_EXPORT int MLDSA65_public_from_private(
    struct MLDSA65_public_key *out_public_key,
    const struct MLDSA65_private_key *private_key);

// MLDSA65_sign generates a signature for the message |msg| of length
// |msg_len| using |private_key| (following the randomized algorithm), and
// writes the encoded signature to |out_encoded_signature|. The |context|
// argument is also signed over and can be used to include implicit contextual
// information that isn't included in |msg|. The same value of |context| must be
// presented to |MLDSA65_verify| in order for the generated signature to be
// considered valid. |context| and |context_len| may be |NULL| and 0 to use an
// empty context (this is common). Returns 1 on success and 0 on failure.
OPENSSL_EXPORT int MLDSA65_sign(
    uint8_t out_encoded_signature[MLDSA65_SIGNATURE_BYTES],
    const struct MLDSA65_private_key *private_key, const uint8_t *msg,
    size_t msg_len, const uint8_t *context, size_t context_len);

// MLDSA65_verify verifies that |signature| constitutes a valid
// signature for the message |msg| of length |msg_len| using |public_key|. The
// value of |context| must equal the value that was passed to |MLDSA65_sign|
// when the signature was generated. Returns 1 on success or 0 on error.
OPENSSL_EXPORT int MLDSA65_verify(const struct MLDSA65_public_key *public_key,
                                  const uint8_t *signature,
                                  size_t signature_len, const uint8_t *msg,
                                  size_t msg_len, const uint8_t *context,
                                  size_t context_len);

// MLDSA65_prehash_init initializes a pre-hashing state using |public_key|. The
// |context| argument can be used to include implicit contextual information
// that isn't included in the message. The same value of |context| must be
// presented to |MLDSA65_verify| in order for the generated signature to be
// considered valid. |context| and |context_len| may be |NULL| and 0 to use an
// empty context (this is common). Returns 1 on success and 0 on failure (if the
// context is too long).
OPENSSL_EXPORT int MLDSA65_prehash_init(
    struct MLDSA65_prehash *out_state,
    const struct MLDSA65_public_key *public_key, const uint8_t *context,
    size_t context_len);

// MLDSA65_prehash_update incorporates the given |msg| of length |msg_len| into
// the pre-hashing state. This can be called multiple times on successive chunks
// of the message. This should be called after |MLDSA65_prehash_init| and before
// |MLDSA65_prehash_finalize|.
OPENSSL_EXPORT void MLDSA65_prehash_update(struct MLDSA65_prehash *inout_state,
                                           const uint8_t *msg, size_t msg_len);

// MLDSA65_prehash_finalize extracts a pre-hashed message representative from
// the given pre-hashing state. This should be called after
// |MLDSA65_prehash_init| and |MLDSA65_prehash_update|. The resulting
// |out_msg_rep| should then be passed to |MLDSA65_sign_message_representative|
// to obtain a signature.
OPENSSL_EXPORT void MLDSA65_prehash_finalize(
    uint8_t out_msg_rep[MLDSA_MU_BYTES], struct MLDSA65_prehash *inout_state);

// MLDSA65_sign_message_representative generates a signature for the pre-hashed
// message |msg_rep| using |private_key| (following the randomized algorithm),
// and writes the encoded signature to |out_encoded_signature|. The |msg_rep|
// should be obtained via calls to |MLDSA65_prehash_init|,
// |MLDSA65_prehash_update| and |MLDSA65_prehash_finalize| using the public key
// from the same key pair, otherwise the signature will not verify. Returns 1 on
// success and 0 on failure.
OPENSSL_EXPORT int MLDSA65_sign_message_representative(
    uint8_t out_encoded_signature[MLDSA65_SIGNATURE_BYTES],
    const struct MLDSA65_private_key *private_key,
    const uint8_t msg_rep[MLDSA_MU_BYTES]);

// MLDSA65_verify_message_representative verifies that |signature| constitutes a
// valid signature for the pre-hashed message |msg_rep| using |public_key|. The
// |msg_rep| should be obtained via calls to |MLDSA65_prehash_init|,
// |MLDSA65_prehash_update| and |MLDSA65_prehash_finalize| using |public key|
// and the same context as when the signature was generated. Returns 1 on
// success or 0 on error.
OPENSSL_EXPORT int MLDSA65_verify_message_representative(
    const struct MLDSA65_public_key *public_key,
    const uint8_t *signature, size_t signature_len,
    const uint8_t msg_rep[MLDSA_MU_BYTES]);

// MLDSA65_marshal_public_key serializes |public_key| to |out| in the standard
// format for ML-DSA-65 public keys. It returns 1 on success or 0 on
// allocation error.
OPENSSL_EXPORT int MLDSA65_marshal_public_key(
    CBB *out, const struct MLDSA65_public_key *public_key);

// MLDSA65_parse_public_key parses a public key, in the format generated by
// |MLDSA65_marshal_public_key|, from |in| and writes the result to
// |out_public_key|. It returns 1 on success or 0 on parse error or if
// there are trailing bytes in |in|.
OPENSSL_EXPORT int MLDSA65_parse_public_key(
    struct MLDSA65_public_key *public_key, CBS *in);


// ML-DSA-87.
//
// ML-DSA-87 is excessively and unnecessarily large. Use -65 unless you are
// specifically attempting to achieve CNSA 2.0 compliance.

// MLDSA87_private_key contains an ML-DSA-87 private key. The contents of this
// object should never leave the address space since the format is unstable.
struct MLDSA87_private_key {
  union {
    uint8_t bytes[(32 + 64 + 256 * 4 * 8) + 32 + 256 * 4 * (7 + 8 + 8)];
    uint32_t alignment;
  } opaque;
};

// MLDSA87_public_key contains an ML-DSA-87 public key. The contents of this
// object should never leave the address space since the format is unstable.
struct MLDSA87_public_key {
  union {
    uint8_t bytes[32 + 64 + 256 * 4 * 8];
    uint32_t alignment;
  } opaque;
};

// MLDSA87_prehash contains a pre-hash context for ML-DSA-87. The contents of
// this object should never leave the address space since the format is
// unstable.
struct MLDSA87_prehash {
  union {
    uint8_t bytes[200 + 4 + 4 + 4 * sizeof(size_t)];
    uint64_t alignment;
  } opaque;
};

// MLDSA87_PUBLIC_KEY_BYTES is the number of bytes in an encoded ML-DSA-87
// public key.
#define MLDSA87_PUBLIC_KEY_BYTES 2592

// MLDSA87_SIGNATURE_BYTES is the number of bytes in an encoded ML-DSA-87
// signature.
#define MLDSA87_SIGNATURE_BYTES 4627

// MLDSA87_generate_key generates a random public/private key pair, writes the
// encoded public key to |out_encoded_public_key|, writes the seed to
// |out_seed|, and sets |out_private_key| to the private key. Returns 1 on
// success and 0 on allocation failure.
OPENSSL_EXPORT int MLDSA87_generate_key(
    uint8_t out_encoded_public_key[MLDSA87_PUBLIC_KEY_BYTES],
    uint8_t out_seed[MLDSA_SEED_BYTES],
    struct MLDSA87_private_key *out_private_key);

// MLDSA87_private_key_from_seed regenerates a private key from a seed value
// that was generated by |MLDSA87_generate_key|. Returns 1 on success and 0 on
// allocation failure or if |seed_len| is incorrect.
OPENSSL_EXPORT int MLDSA87_private_key_from_seed(
    struct MLDSA87_private_key *out_private_key, const uint8_t *seed,
    size_t seed_len);

// MLDSA87_public_from_private sets |*out_public_key| to the public key that
// corresponds to |private_key|. Returns 1 on success and 0 on failure.
OPENSSL_EXPORT int MLDSA87_public_from_private(
    struct MLDSA87_public_key *out_public_key,
    const struct MLDSA87_private_key *private_key);

// MLDSA87_sign generates a signature for the message |msg| of length
// |msg_len| using |private_key| (following the randomized algorithm), and
// writes the encoded signature to |out_encoded_signature|. The |context|
// argument is also signed over and can be used to include implicit contextual
// information that isn't included in |msg|. The same value of |context| must be
// presented to |MLDSA87_verify| in order for the generated signature to be
// considered valid. |context| and |context_len| may be |NULL| and 0 to use an
// empty context (this is common). Returns 1 on success and 0 on failure.
OPENSSL_EXPORT int MLDSA87_sign(
    uint8_t out_encoded_signature[MLDSA87_SIGNATURE_BYTES],
    const struct MLDSA87_private_key *private_key, const uint8_t *msg,
    size_t msg_len, const uint8_t *context, size_t context_len);

// MLDSA87_verify verifies that |signature| constitutes a valid
// signature for the message |msg| of length |msg_len| using |public_key|. The
// value of |context| must equal the value that was passed to |MLDSA87_sign|
// when the signature was generated. Returns 1 on success or 0 on error.
OPENSSL_EXPORT int MLDSA87_verify(const struct MLDSA87_public_key *public_key,
                                  const uint8_t *signature,
                                  size_t signature_len, const uint8_t *msg,
                                  size_t msg_len, const uint8_t *context,
                                  size_t context_len);

// MLDSA87_prehash_init initializes a pre-hashing state using |public_key|. The
// |context| argument can be used to include implicit contextual information
// that isn't included in the message. The same value of |context| must be
// presented to |MLDSA87_verify| in order for the generated signature to be
// considered valid. |context| and |context_len| may be |NULL| and 0 to use an
// empty context (this is common). Returns 1 on success and 0 on failure (if the
// context is too long).
OPENSSL_EXPORT int MLDSA87_prehash_init(
    struct MLDSA87_prehash *out_state,
    const struct MLDSA87_public_key *public_key, const uint8_t *context,
    size_t context_len);

// MLDSA87_prehash_update incorporates the given |msg| of length |msg_len| into
// the pre-hashing state. This can be called multiple times on successive chunks
// of the message. This should be called after |MLDSA87_prehash_init| and before
// |MLDSA87_prehash_finalize|.
OPENSSL_EXPORT void MLDSA87_prehash_update(struct MLDSA87_prehash *inout_state,
                                           const uint8_t *msg, size_t msg_len);

// MLDSA87_prehash_finalize extracts a pre-hashed message representative from
// the given pre-hashing state. This should be called after
// |MLDSA87_prehash_init| and |MLDSA87_prehash_update|. The resulting
// |out_msg_rep| should then be passed to |MLDSA87_sign_message_representative|
// to obtain a signature.
OPENSSL_EXPORT void MLDSA87_prehash_finalize(
    uint8_t out_msg_rep[MLDSA_MU_BYTES], struct MLDSA87_prehash *inout_state);

// MLDSA87_sign_message_representative generates a signature for the pre-hashed
// message |msg_rep| using |private_key| (following the randomized algorithm),
// and writes the encoded signature to |out_encoded_signature|. The |msg_rep|
// should be obtained via calls to |MLDSA87_prehash_init|,
// |MLDSA87_prehash_update| and |MLDSA87_prehash_finalize| using the public key
// from the same key pair, otherwise the signature will not verify. Returns 1 on
// success and 0 on failure.
OPENSSL_EXPORT int MLDSA87_sign_message_representative(
    uint8_t out_encoded_signature[MLDSA87_SIGNATURE_BYTES],
    const struct MLDSA87_private_key *private_key,
    const uint8_t msg_rep[MLDSA_MU_BYTES]);

// MLDSA87_verify_message_representative verifies that |signature| constitutes a
// valid signature for the pre-hashed message |msg_rep| using |public_key|. The
// |msg_rep| should be obtained via calls to |MLDSA87_prehash_init|,
// |MLDSA87_prehash_update| and |MLDSA87_prehash_finalize| using |public key|
// and the same context as when the signature was generated. Returns 1 on
// success or 0 on error.
OPENSSL_EXPORT int MLDSA87_verify_message_representative(
    const struct MLDSA87_public_key *public_key,
    const uint8_t *signature, size_t signature_len,
    const uint8_t msg_rep[MLDSA_MU_BYTES]);

// MLDSA87_marshal_public_key serializes |public_key| to |out| in the standard
// format for ML-DSA-87 public keys. It returns 1 on success or 0 on
// allocation error.
OPENSSL_EXPORT int MLDSA87_marshal_public_key(
    CBB *out, const struct MLDSA87_public_key *public_key);

// MLDSA87_parse_public_key parses a public key, in the format generated by
// |MLDSA87_marshal_public_key|, from |in| and writes the result to
// |out_public_key|. It returns 1 on success or 0 on parse error or if
// there are trailing bytes in |in|.
OPENSSL_EXPORT int MLDSA87_parse_public_key(
    struct MLDSA87_public_key *public_key, CBS *in);


// ML-DSA-44.

// MLDSA44_private_key contains an ML-DSA-44 private key. The contents of this
// object should never leave the address space since the format is unstable.
struct MLDSA44_private_key {
  union {
    uint8_t bytes[(32 + 64 + 256 * 4 * 4) + 32 + 256 * 4 * (4 + 4 + 4)];
    uint32_t alignment;
  } opaque;
};

// MLDSA44_public_key contains an ML-DSA-44 public key. The contents of this
// object should never leave the address space since the format is unstable.
struct MLDSA44_public_key {
  union {
    uint8_t bytes[32 + 64 + 256 * 4 * 4];
    uint32_t alignment;
  } opaque;
};

// MLDSA44_prehash contains a pre-hash context for ML-DSA-44. The contents of
// this object should never leave the address space since the format is
// unstable.
struct MLDSA44_prehash {
  union {
    uint8_t bytes[200 + 4 + 4 + 4 * sizeof(size_t)];
    uint64_t alignment;
  } opaque;
};

// MLDSA44_PUBLIC_KEY_BYTES is the number of bytes in an encoded ML-DSA-44
// public key.
#define MLDSA44_PUBLIC_KEY_BYTES 1312

// MLDSA44_SIGNATURE_BYTES is the number of bytes in an encoded ML-DSA-44
// signature.
#define MLDSA44_SIGNATURE_BYTES 2420

// MLDSA44_generate_key generates a random public/private key pair, writes the
// encoded public key to |out_encoded_public_key|, writes the seed to
// |out_seed|, and sets |out_private_key| to the private key. Returns 1 on
// success and 0 on allocation failure.
OPENSSL_EXPORT int MLDSA44_generate_key(
    uint8_t out_encoded_public_key[MLDSA44_PUBLIC_KEY_BYTES],
    uint8_t out_seed[MLDSA_SEED_BYTES],
    struct MLDSA44_private_key *out_private_key);

// MLDSA44_private_key_from_seed regenerates a private key from a seed value
// that was generated by |MLDSA44_generate_key|. Returns 1 on success and 0 on
// allocation failure or if |seed_len| is incorrect.
OPENSSL_EXPORT int MLDSA44_private_key_from_seed(
    struct MLDSA44_private_key *out_private_key, const uint8_t *seed,
    size_t seed_len);

// MLDSA44_public_from_private sets |*out_public_key| to the public key that
// corresponds to |private_key|. Returns 1 on success and 0 on failure.
OPENSSL_EXPORT int MLDSA44_public_from_private(
    struct MLDSA44_public_key *out_public_key,
    const struct MLDSA44_private_key *private_key);

// MLDSA44_sign generates a signature for the message |msg| of length
// |msg_len| using |private_key| (following the randomized algorithm), and
// writes the encoded signature to |out_encoded_signature|. The |context|
// argument is also signed over and can be used to include implicit contextual
// information that isn't included in |msg|. The same value of |context| must be
// presented to |MLDSA44_verify| in order for the generated signature to be
// considered valid. |context| and |context_len| may be |NULL| and 0 to use an
// empty context (this is common). Returns 1 on success and 0 on failure.
OPENSSL_EXPORT int MLDSA44_sign(
    uint8_t out_encoded_signature[MLDSA44_SIGNATURE_BYTES],
    const struct MLDSA44_private_key *private_key, const uint8_t *msg,
    size_t msg_len, const uint8_t *context, size_t context_len);

// MLDSA44_verify verifies that |signature| constitutes a valid
// signature for the message |msg| of length |msg_len| using |public_key|. The
// value of |context| must equal the value that was passed to |MLDSA44_sign|
// when the signature was generated. Returns 1 on success or 0 on error.
OPENSSL_EXPORT int MLDSA44_verify(const struct MLDSA44_public_key *public_key,
                                  const uint8_t *signature,
                                  size_t signature_len, const uint8_t *msg,
                                  size_t msg_len, const uint8_t *context,
                                  size_t context_len);

// MLDSA44_prehash_init initializes a pre-hashing state using |public_key|. The
// |context| argument can be used to include implicit contextual information
// that isn't included in the message. The same value of |context| must be
// presented to |MLDSA44_verify| in order for the generated signature to be
// considered valid. |context| and |context_len| may be |NULL| and 0 to use an
// empty context (this is common). Returns 1 on success and 0 on failure (if the
// context is too long).
OPENSSL_EXPORT int MLDSA44_prehash_init(
    struct MLDSA44_prehash *out_state,
    const struct MLDSA44_public_key *public_key, const uint8_t *context,
    size_t context_len);

// MLDSA44_prehash_update incorporates the given |msg| of length |msg_len| into
// the pre-hashing state. This can be called multiple times on successive chunks
// of the message. This should be called after |MLDSA44_prehash_init| and before
// |MLDSA44_prehash_finalize|.
OPENSSL_EXPORT void MLDSA44_prehash_update(struct MLDSA44_prehash *inout_state,
                                           const uint8_t *msg, size_t msg_len);

// MLDSA44_prehash_finalize extracts a pre-hashed message representative from
// the given pre-hashing state. This should be called after
// |MLDSA44_prehash_init| and |MLDSA44_prehash_update|. The resulting
// |out_msg_rep| should then be passed to |MLDSA44_sign_message_representative|
// to obtain a signature.
OPENSSL_EXPORT void MLDSA44_prehash_finalize(
    uint8_t out_msg_rep[MLDSA_MU_BYTES], struct MLDSA44_prehash *inout_state);

// MLDSA44_sign_message_representative generates a signature for the pre-hashed
// message |msg_rep| using |private_key| (following the randomized algorithm),
// and writes the encoded signature to |out_encoded_signature|. The |msg_rep|
// should be obtained via calls to |MLDSA44_prehash_init|,
// |MLDSA44_prehash_update| and |MLDSA44_prehash_finalize| using the public key
// from the same key pair, otherwise the signature will not verify. Returns 1 on
// success and 0 on failure.
OPENSSL_EXPORT int MLDSA44_sign_message_representative(
    uint8_t out_encoded_signature[MLDSA44_SIGNATURE_BYTES],
    const struct MLDSA44_private_key *private_key,
    const uint8_t msg_rep[MLDSA_MU_BYTES]);

// MLDSA44_verify_message_representative verifies that |signature| constitutes a
// valid signature for the pre-hashed message |msg_rep| using |public_key|. The
// |msg_rep| should be obtained via calls to |MLDSA44_prehash_init|,
// |MLDSA44_prehash_update| and |MLDSA44_prehash_finalize| using |public key|
// and the same context as when the signature was generated. Returns 1 on
// success or 0 on error.
OPENSSL_EXPORT int MLDSA44_verify_message_representative(
    const struct MLDSA44_public_key *public_key,
    const uint8_t *signature, size_t signature_len,
    const uint8_t msg_rep[MLDSA_MU_BYTES]);

// MLDSA44_marshal_public_key serializes |public_key| to |out| in the standard
// format for ML-DSA-44 public keys. It returns 1 on success or 0 on
// allocation error.
OPENSSL_EXPORT int MLDSA44_marshal_public_key(
    CBB *out, const struct MLDSA44_public_key *public_key);

// MLDSA44_parse_public_key parses a public key, in the format generated by
// |MLDSA44_marshal_public_key|, from |in| and writes the result to
// |out_public_key|. It returns 1 on success or 0 on parse error or if
// there are trailing bytes in |in|.
OPENSSL_EXPORT int MLDSA44_parse_public_key(
    struct MLDSA44_public_key *public_key, CBS *in);


#if defined(__cplusplus)
}  // extern C
#endif

#endif  // OPENSSL_HEADER_MLDSA_H_