lcx_mldsa.h

Go to the documentation of this file.

/*****************************************************************************
 *   (c) 2026 Ledger SAS.
 *
 *  Licensed under the Apache License, Version 2.0 (the "License");
 *  you may not use this file except in compliance with the License.
 *  You may obtain a copy of the License at
 *
 *      http://www.apache.org/licenses/LICENSE-2.0
 *
 *  Unless required by applicable law or agreed to in writing, software
 *  distributed under the License is distributed on an "AS IS" BASIS,
 *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 *  See the License for the specific language governing permissions and
 *  limitations under the License.
 *****************************************************************************/
#ifndef MLDSA_H
#define MLDSA_H
 
#include <stdint.h>
#include <stddef.h>
#include "cx_errors.h"
 
#define MLDSA_N         256U    
#define MLDSA_Q         8380417 
#define MLDSA_D         13U     
#define MLDSA_SEEDBYTES 32U     
#define MLDSA_CRHBYTES  64U     
#define MLDSA_TRBYTES   64U     
#define MLDSA_RNDBYTES  32U     
#define MLDSA_POLYT1_PACKEDBYTES 320U 
#define MLDSA_POLYT0_PACKEDBYTES 416U 
#define MLDSA44_K      4U                   
#define MLDSA44_L      4U                   
#define MLDSA44_ETA    2U                   
#define MLDSA44_TAU    39U                  
#define MLDSA44_BETA   78U                  
#define MLDSA44_GAMMA1 (1 << 17)            
#define MLDSA44_GAMMA2 ((MLDSA_Q - 1) / 88) 
#define MLDSA44_OMEGA  80U                  
#define MLDSA44_CTILDEBYTES         32U  
#define MLDSA44_POLYETA_PACKEDBYTES 96U  
#define MLDSA44_POLYZ_PACKEDBYTES   576U 
#define MLDSA44_POLYW1_PACKEDBYTES  192U 
#define MLDSA44_POLYVECH_PACKEDBYTES (MLDSA44_OMEGA + MLDSA44_K) 
#define MLDSA44_PUBLICKEYBYTES \
    (MLDSA_SEEDBYTES + MLDSA44_K * MLDSA_POLYT1_PACKEDBYTES) 
#define MLDSA44_SECRETKEYBYTES                                                      \
    (2U * MLDSA_SEEDBYTES + MLDSA_TRBYTES + MLDSA44_L * MLDSA44_POLYETA_PACKEDBYTES \
     + MLDSA44_K * MLDSA44_POLYETA_PACKEDBYTES                                      \
     + MLDSA44_K * MLDSA_POLYT0_PACKEDBYTES) 
#define MLDSA44_SIGBYTES                                         \
    (MLDSA44_CTILDEBYTES + MLDSA44_L * MLDSA44_POLYZ_PACKEDBYTES \
     + MLDSA44_POLYVECH_PACKEDBYTES) 
#define MLDSA65_K      6U                   
#define MLDSA65_L      5U                   
#define MLDSA65_ETA    4U                   
#define MLDSA65_TAU    49U                  
#define MLDSA65_BETA   196U                 
#define MLDSA65_GAMMA1 (1 << 19)            
#define MLDSA65_GAMMA2 ((MLDSA_Q - 1) / 32) 
#define MLDSA65_OMEGA  55U                  
#define MLDSA65_CTILDEBYTES         48U  
#define MLDSA65_POLYETA_PACKEDBYTES 128U 
#define MLDSA65_POLYZ_PACKEDBYTES   640U 
#define MLDSA65_POLYW1_PACKEDBYTES  128U 
#define MLDSA65_POLYVECH_PACKEDBYTES (MLDSA65_OMEGA + MLDSA65_K) 
#define MLDSA65_PUBLICKEYBYTES \
    (MLDSA_SEEDBYTES + MLDSA65_K * MLDSA_POLYT1_PACKEDBYTES) 
#define MLDSA65_SECRETKEYBYTES                                                      \
    (2U * MLDSA_SEEDBYTES + MLDSA_TRBYTES + MLDSA65_L * MLDSA65_POLYETA_PACKEDBYTES \
     + MLDSA65_K * MLDSA65_POLYETA_PACKEDBYTES                                      \
     + MLDSA65_K * MLDSA_POLYT0_PACKEDBYTES) 
#define MLDSA65_SIGBYTES                                         \
    (MLDSA65_CTILDEBYTES + MLDSA65_L * MLDSA65_POLYZ_PACKEDBYTES \
     + MLDSA65_POLYVECH_PACKEDBYTES) 
#ifdef HAVE_MLDSA_87
#define MLDSA87_K      8U                   
#define MLDSA87_L      7U                   
#define MLDSA87_ETA    2U                   
#define MLDSA87_TAU    60U                  
#define MLDSA87_BETA   120U                 
#define MLDSA87_GAMMA1 (1 << 19)            
#define MLDSA87_GAMMA2 ((MLDSA_Q - 1) / 32) 
#define MLDSA87_OMEGA  75U                  
#define MLDSA87_CTILDEBYTES         64U  
#define MLDSA87_POLYETA_PACKEDBYTES 96U  
#define MLDSA87_POLYZ_PACKEDBYTES   640U 
#define MLDSA87_POLYW1_PACKEDBYTES  128U 
#define MLDSA87_POLYVECH_PACKEDBYTES (MLDSA87_OMEGA + MLDSA87_K) 
#define MLDSA87_PUBLICKEYBYTES \
    (MLDSA_SEEDBYTES + MLDSA87_K * MLDSA_POLYT1_PACKEDBYTES) 
#define MLDSA87_SECRETKEYBYTES                                                      \
    (2U * MLDSA_SEEDBYTES + MLDSA_TRBYTES + MLDSA87_L * MLDSA87_POLYETA_PACKEDBYTES \
     + MLDSA87_K * MLDSA87_POLYETA_PACKEDBYTES                                      \
     + MLDSA87_K * MLDSA_POLYT0_PACKEDBYTES) 
#define MLDSA87_SIGBYTES                                         \
    (MLDSA87_CTILDEBYTES + MLDSA87_L * MLDSA87_POLYZ_PACKEDBYTES \
     + MLDSA87_POLYVECH_PACKEDBYTES) 
#endif /* HAVE_MLDSA_87 */
 
// Maximum dimensions across supported parameter sets.
#ifdef HAVE_MLDSA_87
#define MLDSA_MAX_K          MLDSA87_K 
#define MLDSA_MAX_L          MLDSA87_L 
#define MLDSA_NUM_PARAM_SETS 3U        
#else
#define MLDSA_MAX_K          MLDSA65_K 
#define MLDSA_MAX_L          MLDSA65_L 
#define MLDSA_NUM_PARAM_SETS 2U        
#endif
 
typedef enum MLDSA_param_e {
    MLDSA_44 = 0, 
    MLDSA_65,     
#ifdef HAVE_MLDSA_87
    MLDSA_87, 
#endif
} MLDSA_param_t;
 
typedef struct MLDSA_param_info_s {
    uint8_t  k;                     
    uint8_t  l;                     
    uint8_t  eta;                   
    uint8_t  tau;                   
    uint16_t beta;                  
    int32_t  gamma1;                
    int32_t  gamma2;                
    uint8_t  omega;                 
    uint8_t  ctilde_bytes;          
    uint16_t polyeta_packed_bytes;  
    uint16_t polyz_packed_bytes;    
    uint16_t polyw1_packed_bytes;   
    uint16_t polyvech_packed_bytes; 
    uint16_t pk_bytes;              
    uint16_t sk_bytes;              
    uint16_t sig_bytes;             
} MLDSA_param_info_t;
 
extern const MLDSA_param_info_t MLDSA_PARAM[MLDSA_NUM_PARAM_SETS];
 
cx_err_t MLDSA_keygen(uint8_t *pk, size_t pk_len, uint8_t *sk, size_t sk_len, MLDSA_param_t param);
 
cx_err_t MLDSA_sign(uint8_t       *sig,
                    size_t         sig_len,
                    size_t        *sig_actual_len,
                    const uint8_t *msg,
                    size_t         msg_len,
                    const uint8_t *ctx,
                    size_t         ctx_len,
                    const uint8_t *sk,
                    size_t         sk_len,
                    MLDSA_param_t  param);
 
cx_err_t MLDSA_verify(const uint8_t *sig,
                      size_t         sig_len,
                      const uint8_t *msg,
                      size_t         msg_len,
                      const uint8_t *ctx,
                      size_t         ctx_len,
                      const uint8_t *pk,
                      size_t         pk_len,
                      MLDSA_param_t  param);
 
#define MLDSA_PREHASH_OID_LEN 11U
 
typedef enum MLDSA_prehash_e {
    MLDSA_PREHASH_SHA256 = 0, 
    MLDSA_PREHASH_SHA512,     
    MLDSA_PREHASH_SHA3_256,   
    MLDSA_PREHASH_SHA3_512,   
    MLDSA_PREHASH_SHAKE128,   
    MLDSA_PREHASH_SHAKE256,   
    MLDSA_NUM_PREHASH_ALGS    
} MLDSA_prehash_t;
 
cx_err_t MLDSA_sign_prehash(uint8_t        *sig,
                            size_t          sig_len,
                            size_t         *sig_actual_len,
                            const uint8_t  *ph,
                            size_t          ph_len,
                            const uint8_t  *ctx,
                            size_t          ctx_len,
                            const uint8_t  *sk,
                            size_t          sk_len,
                            MLDSA_prehash_t prehash_alg,
                            MLDSA_param_t   param);
 
cx_err_t MLDSA_verify_prehash(const uint8_t  *sig,
                              size_t          sig_len,
                              const uint8_t  *ph,
                              size_t          ph_len,
                              const uint8_t  *ctx,
                              size_t          ctx_len,
                              const uint8_t  *pk,
                              size_t          pk_len,
                              MLDSA_prehash_t prehash_alg,
                              MLDSA_param_t   param);
 
#endif /* MLDSA_H */