grpc 1.84.0 → 1.85.0.pre1

data/third_party/boringssl-with-bazel/crypto/fipsmodule/bcm_interface.h

@@ -15,9 +15,11 @@
 #ifndef OPENSSL_HEADER_CRYPTO_FIPSMODULE_BCM_INTERFACE_H
 #define OPENSSL_HEADER_CRYPTO_FIPSMODULE_BCM_INTERFACE_H
 
-// For the moment, we reach out for AES_KEY.
 #include <openssl/aes.h>
-#include <openssl/bcm_public.h>
+#include <openssl/mldsa.h>
+#include <openssl/mlkem.h>
+#include <openssl/sha.h>
+#include <openssl/sha2.h>
 
 
 // This header will eventually become the interface between BCM and the
@@ -28,9 +30,7 @@
 // Over time, calls from libcrypto to BCM will all move to this header
 // and the separation will become more meaningful.
 
-#if defined(__cplusplus)
-extern "C" {
-#endif
+BSSL_NAMESPACE_BEGIN
 
 // Enumerated types for return values from bcm functions, both infallible
 // and fallible functions. Two success values are used to correspond to the
@@ -73,111 +73,95 @@ inline bcm_status_t bcm_as_not_approved_status(int result) {
 
 #endif  // BORINGSSL_FIPS
 
-// BCM_rand_load_entropy supplies |entropy_len| bytes of entropy to the BCM
-// module. The |want_additional_input| parameter is true iff the entropy was
-// obtained from a source other than the system, e.g. directly from the CPU.
-bcm_infallible BCM_rand_load_entropy(const uint8_t *entropy, size_t entropy_len,
-                                     int want_additional_input);
-
-// BCM_rand_bytes is the same as the public |RAND_bytes| function, other
+// BCM_rand_bytes is the same as the public `RAND_bytes` function, other
 // than returning a bcm_infallible status indicator.
-OPENSSL_EXPORT bcm_infallible BCM_rand_bytes(uint8_t *out, size_t out_len);
+bcm_infallible BCM_rand_bytes(uint8_t *out, size_t out_len);
 
-// BCM_rand_bytes_hwrng attempts to fill |out| with |len| bytes of entropy from
+// BCM_rand_bytes_hwrng attempts to fill `out` with `len` bytes of entropy from
 // the CPU hardware random number generator if one is present.
 // bcm_status_approved is returned on success, and a failure status is
 // returned otherwise.
 bcm_status BCM_rand_bytes_hwrng(uint8_t *out, size_t len);
 
 // BCM_rand_bytes_with_additional_data samples from the RNG after mixing 32
-// bytes from |user_additional_data| in.
+// bytes from `user_additional_data` in.
 bcm_infallible BCM_rand_bytes_with_additional_data(
     uint8_t *out, size_t out_len, const uint8_t user_additional_data[32]);
 
 
 // SHA-1
 
-// BCM_SHA_DIGEST_LENGTH is the length of a SHA-1 digest.
-#define BCM_SHA_DIGEST_LENGTH 20
-
-// BCM_sha1_init initialises |sha|.
+// BCM_sha1_init initialises `sha`.
 bcm_infallible BCM_sha1_init(SHA_CTX *sha);
 
-// BCM_SHA1_transform is a low-level function that performs a single, SHA-1
-// block transformation using the state from |sha| and |SHA_CBLOCK| bytes from
-// |block|.
-bcm_infallible BCM_sha1_transform(SHA_CTX *c,
-                                  const uint8_t data[BCM_SHA_CBLOCK]);
+// SHA1_transform is a low-level function that performs a single, SHA-1
+// block transformation using the state from `sha` and `SHA_CBLOCK` bytes from
+// `block`.
+bcm_infallible BCM_sha1_transform(SHA_CTX *c, const uint8_t data[SHA_CBLOCK]);
 
-// BCM_sha1_update adds |len| bytes from |data| to |sha|.
+// BCM_sha1_update adds `len` bytes from `data` to `sha`.
 bcm_infallible BCM_sha1_update(SHA_CTX *c, const void *data, size_t len);
 
-// BCM_sha1_final adds the final padding to |sha| and writes the resulting
-// digest to |out|, which must have at least |SHA_DIGEST_LENGTH| bytes of space.
-bcm_infallible BCM_sha1_final(uint8_t out[BCM_SHA_DIGEST_LENGTH], SHA_CTX *c);
+// BCM_sha1_final adds the final padding to `sha` and writes the resulting
+// digest to `out`, which must have at least `SHA_DIGEST_LENGTH` bytes of space.
+bcm_infallible BCM_sha1_final(uint8_t out[SHA_DIGEST_LENGTH], SHA_CTX *c);
 
 
-// BCM_fips_186_2_prf derives |out_len| bytes from |xkey| using the PRF
+// BCM_fips_186_2_prf derives `out_len` bytes from `xkey` using the PRF
 // defined in FIPS 186-2, Appendix 3.1, with change notice 1 applied. The b
 // parameter is 160 and seed, XKEY, is also 160 bits. The optional XSEED user
 // input is all zeros.
 //
 // The PRF generates a sequence of 320-bit numbers. Each number is encoded as a
-// 40-byte string in big-endian and then concatenated to form |out|. If
-// |out_len| is not a multiple of 40, the result is truncated. This matches the
+// 40-byte string in big-endian and then concatenated to form `out`. If
+// `out_len` is not a multiple of 40, the result is truncated. This matches the
 // construction used in Section 7 of RFC 4186 and Section 7 of RFC 4187.
 //
 // This PRF is based on SHA-1, a weak hash function, and should not be used
 // in new protocols. It is provided for compatibility with some legacy EAP
 // methods.
 bcm_infallible BCM_fips_186_2_prf(uint8_t *out, size_t out_len,
-                                  const uint8_t xkey[BCM_SHA_DIGEST_LENGTH]);
+                                  const uint8_t xkey[SHA_DIGEST_LENGTH]);
 
 
 // SHA-224
 
-// SHA224_DIGEST_LENGTH is the length of a SHA-224 digest.
-#define BCM_SHA224_DIGEST_LENGTH 28
-
-// BCM_sha224_unit initialises |sha|.
+// BCM_sha224_unit initialises `sha`.
 bcm_infallible BCM_sha224_init(SHA256_CTX *sha);
 
-// BCM_sha224_update adds |len| bytes from |data| to |sha|.
+// BCM_sha224_update adds `len` bytes from `data` to `sha`.
 bcm_infallible BCM_sha224_update(SHA256_CTX *sha, const void *data, size_t len);
 
-// BCM_sha224_final adds the final padding to |sha| and writes the resulting
-// digest to |out|, which must have at least |SHA224_DIGEST_LENGTH| bytes of
+// BCM_sha224_final adds the final padding to `sha` and writes the resulting
+// digest to `out`, which must have at least `SHA224_DIGEST_LENGTH` bytes of
 // space. It aborts on programmer error.
-bcm_infallible BCM_sha224_final(uint8_t out[BCM_SHA224_DIGEST_LENGTH],
+bcm_infallible BCM_sha224_final(uint8_t out[SHA224_DIGEST_LENGTH],
                                 SHA256_CTX *sha);
 
 
 // SHA-256
 
-// BCM_SHA256_DIGEST_LENGTH is the length of a SHA-256 digest.
-#define BCM_SHA256_DIGEST_LENGTH 32
-
-// BCM_sha256_init initialises |sha|.
+// BCM_sha256_init initialises `sha`.
 bcm_infallible BCM_sha256_init(SHA256_CTX *sha);
 
-// BCM_sha256_update adds |len| bytes from |data| to |sha|.
+// BCM_sha256_update adds `len` bytes from `data` to `sha`.
 bcm_infallible BCM_sha256_update(SHA256_CTX *sha, const void *data, size_t len);
 
-// BCM_sha256_final adds the final padding to |sha| and writes the resulting
-// digest to |out|, which must have at least |BCM_SHA256_DIGEST_LENGTH| bytes of
+// BCM_sha256_final adds the final padding to `sha` and writes the resulting
+// digest to `out`, which must have at least `SHA256_DIGEST_LENGTH` bytes of
 // space. It aborts on programmer error.
-bcm_infallible BCM_sha256_final(uint8_t out[BCM_SHA256_DIGEST_LENGTH],
+bcm_infallible BCM_sha256_final(uint8_t out[SHA256_DIGEST_LENGTH],
                                 SHA256_CTX *sha);
 
 // BCM_sha256_transform is a low-level function that performs a single, SHA-256
-// block transformation using the state from |sha| and |BCM_SHA256_CBLOCK| bytes
-// from |block|.
+// block transformation using the state from `sha` and `SHA256_CBLOCK` bytes
+// from `block`.
 bcm_infallible BCM_sha256_transform(SHA256_CTX *sha,
-                                    const uint8_t block[BCM_SHA256_CBLOCK]);
+                                    const uint8_t block[SHA256_CBLOCK]);
 
-// BCM_sha256_transform_blocks is a low-level function that takes |num_blocks| *
-// |BCM_SHA256_CBLOCK| bytes of data and performs SHA-256 transforms on it to
-// update |state|.
+// BCM_sha256_transform_blocks is a low-level function that takes `num_blocks` *
+// `SHA256_CBLOCK` bytes of data and performs SHA-256 transforms on it to update
+// `state`.
 bcm_infallible BCM_sha256_transform_blocks(uint32_t state[8],
                                            const uint8_t *data,
                                            size_t num_blocks);
@@ -185,63 +169,55 @@ bcm_infallible BCM_sha256_transform_blocks(uint32_t state[8],
 
 // SHA-384.
 
-// BCM_SHA384_DIGEST_LENGTH is the length of a SHA-384 digest.
-#define BCM_SHA384_DIGEST_LENGTH 48
-
-// BCM_sha384_init initialises |sha|.
+// BCM_sha384_init initialises `sha`.
 bcm_infallible BCM_sha384_init(SHA512_CTX *sha);
 
-// BCM_sha384_update adds |len| bytes from |data| to |sha|.
+// BCM_sha384_update adds `len` bytes from `data` to `sha`.
 bcm_infallible BCM_sha384_update(SHA512_CTX *sha, const void *data, size_t len);
 
-// BCM_sha384_final adds the final padding to |sha| and writes the resulting
-// digest to |out|, which must have at least |BCM_sha384_DIGEST_LENGTH| bytes of
+// BCM_sha384_final adds the final padding to `sha` and writes the resulting
+// digest to `out`, which must have at least `SHA384_DIGEST_LENGTH` bytes of
 // space. It may abort on programmer error.
-bcm_infallible BCM_sha384_final(uint8_t out[BCM_SHA384_DIGEST_LENGTH],
+bcm_infallible BCM_sha384_final(uint8_t out[SHA384_DIGEST_LENGTH],
                                 SHA512_CTX *sha);
 
 
 // SHA-512.
 
-// BCM_SHA512_DIGEST_LENGTH is the length of a SHA-512 digest.
-#define BCM_SHA512_DIGEST_LENGTH 64
-
-// BCM_sha512_init initialises |sha|.
+// BCM_sha512_init initialises `sha`.
 bcm_infallible BCM_sha512_init(SHA512_CTX *sha);
 
-// BCM_sha512_update adds |len| bytes from |data| to |sha|.
+// BCM_sha512_update adds `len` bytes from `data` to `sha`.
 bcm_infallible BCM_sha512_update(SHA512_CTX *sha, const void *data, size_t len);
 
-// BCM_sha512_final adds the final padding to |sha| and writes the resulting
-// digest to |out|, which must have at least |BCM_sha512_DIGEST_LENGTH| bytes of
+// BCM_sha512_final adds the final padding to `sha` and writes the resulting
+// digest to `out`, which must have at least `SHA512_DIGEST_LENGTH` bytes of
 // space.
-bcm_infallible BCM_sha512_final(uint8_t out[BCM_SHA512_DIGEST_LENGTH],
+bcm_infallible BCM_sha512_final(uint8_t out[SHA512_DIGEST_LENGTH],
                                 SHA512_CTX *sha);
 
 // BCM_sha512_transform is a low-level function that performs a single, SHA-512
-// block transformation using the state from |sha| and |BCM_sha512_CBLOCK| bytes
-// from |block|.
+// block transformation using the state from `sha` and `SHA512_CBLOCK` bytes
+// from `block`.
 bcm_infallible BCM_sha512_transform(SHA512_CTX *sha,
-                                    const uint8_t block[BCM_SHA512_CBLOCK]);
+                                    const uint8_t block[SHA512_CBLOCK]);
 
 
 // SHA-512-256
 //
 // See https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.180-4.pdf section 5.3.6
 
-#define BCM_SHA512_256_DIGEST_LENGTH 32
-
-// BCM_sha512_256_init initialises |sha|.
+// BCM_sha512_256_init initialises `sha`.
 bcm_infallible BCM_sha512_256_init(SHA512_CTX *sha);
 
-// BCM_sha512_256_update adds |len| bytes from |data| to |sha|.
+// BCM_sha512_256_update adds `len` bytes from `data` to `sha`.
 bcm_infallible BCM_sha512_256_update(SHA512_CTX *sha, const void *data,
                                      size_t len);
 
-// BCM_sha512_256_final adds the final padding to |sha| and writes the resulting
-// digest to |out|, which must have at least |BCM_sha512_256_DIGEST_LENGTH|
-// bytes of space. It may abort on programmer error.
-bcm_infallible BCM_sha512_256_final(uint8_t out[BCM_SHA512_256_DIGEST_LENGTH],
+// BCM_sha512_256_final adds the final padding to `sha` and writes the resulting
+// digest to `out`, which must have at least `SHA512_256_DIGEST_LENGTH` bytes of
+// space. It may abort on programmer error.
+bcm_infallible BCM_sha512_256_final(uint8_t out[SHA512_256_DIGEST_LENGTH],
                                     SHA512_CTX *sha);
 
 
@@ -254,227 +230,357 @@ bcm_infallible BCM_sha512_256_final(uint8_t out[BCM_SHA512_256_DIGEST_LENGTH],
 // random entropy necessary to generate a signature in randomized mode.
 #define BCM_MLDSA_SIGNATURE_RANDOMIZER_BYTES 32
 
-// BCM_MLDSA_SEED_BYTES is the number of bytes in an ML-DSA seed value.
-#define BCM_MLDSA_SEED_BYTES 32
-
 // BCM_MLDSA65_PRIVATE_KEY_BYTES is the number of bytes in an encoded ML-DSA-65
 // private key.
 #define BCM_MLDSA65_PRIVATE_KEY_BYTES 4032
 
-// BCM_MLDSA65_PUBLIC_KEY_BYTES is the number of bytes in an encoded ML-DSA-65
-// public key.
-#define BCM_MLDSA65_PUBLIC_KEY_BYTES 1952
-
-// BCM_MLDSA65_SIGNATURE_BYTES is the number of bytes in an encoded ML-DSA-65
-// signature.
-#define BCM_MLDSA65_SIGNATURE_BYTES 3309
-
-struct BCM_mldsa65_private_key {
-  union {
-    uint8_t bytes[32 + 32 + 64 + 256 * 4 * (5 + 6 + 6)];
-    uint32_t alignment;
-  } opaque;
-};
-
-struct BCM_mldsa65_public_key {
-  union {
-    uint8_t bytes[32 + 64 + 256 * 4 * 6];
-    uint32_t alignment;
-  } opaque;
-};
-
 OPENSSL_EXPORT bcm_status BCM_mldsa65_generate_key(
-    uint8_t out_encoded_public_key[BCM_MLDSA65_PUBLIC_KEY_BYTES],
-    uint8_t out_seed[BCM_MLDSA_SEED_BYTES],
-    struct BCM_mldsa65_private_key *out_private_key);
+    uint8_t out_encoded_public_key[MLDSA65_PUBLIC_KEY_BYTES],
+    uint8_t out_seed[MLDSA_SEED_BYTES], MLDSA65_private_key *out_private_key);
 
 OPENSSL_EXPORT bcm_status BCM_mldsa65_private_key_from_seed(
-    struct BCM_mldsa65_private_key *out_private_key,
-    const uint8_t seed[BCM_MLDSA_SEED_BYTES]);
+    MLDSA65_private_key *out_private_key, const uint8_t seed[MLDSA_SEED_BYTES]);
 
 OPENSSL_EXPORT bcm_status BCM_mldsa65_public_from_private(
-    struct BCM_mldsa65_public_key *out_public_key,
-    const struct BCM_mldsa65_private_key *private_key);
+    MLDSA65_public_key *out_public_key, const MLDSA65_private_key *private_key);
+
+// BCM_mldsa65_public_of_private returns the public half of `private_key`.
+const MLDSA65_public_key *BCM_mldsa65_public_of_private(
+    const MLDSA65_private_key *private_key);
 
 OPENSSL_EXPORT bcm_status
-BCM_mldsa65_check_key_fips(struct BCM_mldsa65_private_key *private_key);
+BCM_mldsa65_check_key_fips(MLDSA65_private_key *private_key);
 
 OPENSSL_EXPORT bcm_status BCM_mldsa65_generate_key_fips(
-    uint8_t out_encoded_public_key[BCM_MLDSA65_PUBLIC_KEY_BYTES],
-    uint8_t out_seed[BCM_MLDSA_SEED_BYTES],
-    struct BCM_mldsa65_private_key *out_private_key);
+    uint8_t out_encoded_public_key[MLDSA65_PUBLIC_KEY_BYTES],
+    uint8_t out_seed[MLDSA_SEED_BYTES], MLDSA65_private_key *out_private_key);
 
 OPENSSL_EXPORT bcm_status BCM_mldsa65_private_key_from_seed_fips(
-    struct BCM_mldsa65_private_key *out_private_key,
-    const uint8_t seed[BCM_MLDSA_SEED_BYTES]);
+    MLDSA65_private_key *out_private_key, const uint8_t seed[MLDSA_SEED_BYTES]);
 
-OPENSSL_EXPORT bcm_status BCM_mldsa65_sign(
-    uint8_t out_encoded_signature[BCM_MLDSA65_SIGNATURE_BYTES],
-    const struct BCM_mldsa65_private_key *private_key, const uint8_t *msg,
-    size_t msg_len, const uint8_t *context, size_t context_len);
+OPENSSL_EXPORT bcm_status
+BCM_mldsa65_sign(uint8_t out_encoded_signature[MLDSA65_SIGNATURE_BYTES],
+                 const MLDSA65_private_key *private_key, const uint8_t *msg,
+                 size_t msg_len, const uint8_t *context, size_t context_len);
 
 OPENSSL_EXPORT bcm_status BCM_mldsa65_verify(
-    const struct BCM_mldsa65_public_key *public_key,
-    const uint8_t signature[BCM_MLDSA65_SIGNATURE_BYTES], const uint8_t *msg,
+    const MLDSA65_public_key *public_key,
+    const uint8_t signature[MLDSA65_SIGNATURE_BYTES], const uint8_t *msg,
     size_t msg_len, const uint8_t *context, size_t context_len);
 
-OPENSSL_EXPORT bcm_status BCM_mldsa65_marshal_public_key(
-    CBB *out, const struct BCM_mldsa65_public_key *public_key);
+OPENSSL_EXPORT void BCM_mldsa65_prehash_init(
+    MLDSA65_prehash *out_prehash_ctx, const MLDSA65_public_key *public_key,
+    const uint8_t *context, size_t context_len);
 
-OPENSSL_EXPORT bcm_status BCM_mldsa65_parse_public_key(
-    struct BCM_mldsa65_public_key *public_key, CBS *in);
+OPENSSL_EXPORT void BCM_mldsa65_prehash_update(
+    MLDSA65_prehash *inout_prehash_ctx, const uint8_t *msg, size_t msg_len);
 
-OPENSSL_EXPORT bcm_status BCM_mldsa65_parse_private_key(
-    struct BCM_mldsa65_private_key *private_key, CBS *in);
+OPENSSL_EXPORT void BCM_mldsa65_prehash_finalize(
+    uint8_t out_msg_rep[MLDSA_MU_BYTES], MLDSA65_prehash *inout_prehash_ctx);
+
+OPENSSL_EXPORT bcm_status BCM_mldsa65_sign_message_representative(
+    uint8_t out_encoded_signature[MLDSA65_SIGNATURE_BYTES],
+    const MLDSA65_private_key *private_key,
+    const uint8_t msg_rep[MLDSA_MU_BYTES]);
+
+OPENSSL_EXPORT bcm_status BCM_mldsa65_verify_message_representative(
+    const MLDSA65_public_key *public_key,
+    const uint8_t signature[MLDSA65_SIGNATURE_BYTES],
+    const uint8_t msg_rep[MLDSA_MU_BYTES]);
+
+OPENSSL_EXPORT bcm_status
+BCM_mldsa65_marshal_public_key(CBB *out, const MLDSA65_public_key *public_key);
+
+OPENSSL_EXPORT bcm_status
+BCM_mldsa65_parse_public_key(MLDSA65_public_key *public_key, CBS *in);
+
+OPENSSL_EXPORT bcm_status
+BCM_mldsa65_parse_private_key(MLDSA65_private_key *private_key, CBS *in);
 
 // BCM_mldsa65_generate_key_external_entropy generates a public/private key pair
 // using the given seed, writes the encoded public key to
-// |out_encoded_public_key| and sets |out_private_key| to the private key.
+// `out_encoded_public_key` and sets `out_private_key` to the private key.
 OPENSSL_EXPORT bcm_status BCM_mldsa65_generate_key_external_entropy(
-    uint8_t out_encoded_public_key[BCM_MLDSA65_PUBLIC_KEY_BYTES],
-    struct BCM_mldsa65_private_key *out_private_key,
-    const uint8_t entropy[BCM_MLDSA_SEED_BYTES]);
+    uint8_t out_encoded_public_key[MLDSA65_PUBLIC_KEY_BYTES],
+    MLDSA65_private_key *out_private_key,
+    const uint8_t entropy[MLDSA_SEED_BYTES]);
 
 OPENSSL_EXPORT bcm_status BCM_mldsa65_generate_key_external_entropy_fips(
-    uint8_t out_encoded_public_key[BCM_MLDSA65_PUBLIC_KEY_BYTES],
-    struct BCM_mldsa65_private_key *out_private_key,
-    const uint8_t entropy[BCM_MLDSA_SEED_BYTES]);
+    uint8_t out_encoded_public_key[MLDSA65_PUBLIC_KEY_BYTES],
+    MLDSA65_private_key *out_private_key,
+    const uint8_t entropy[MLDSA_SEED_BYTES]);
 
-// BCM_mldsa5_sign_internal signs |msg| using |private_key| and writes the
-// signature to |out_encoded_signature|. The |context_prefix| and |context| are
-// prefixed to the message, in that order, before signing. The |randomizer|
+// BCM_mldsa5_sign_internal signs `msg` using `private_key` and writes the
+// signature to `out_encoded_signature`. The `context_prefix` and `context` are
+// prefixed to the message, in that order, before signing. The `randomizer`
 // value can be set to zero bytes in order to make a deterministic signature, or
-// else filled with entropy for the usual |MLDSA_sign| behavior.
+// else filled with entropy for the usual `MLDSA_sign` behavior.
 OPENSSL_EXPORT bcm_status BCM_mldsa65_sign_internal(
-    uint8_t out_encoded_signature[BCM_MLDSA65_SIGNATURE_BYTES],
-    const struct BCM_mldsa65_private_key *private_key, const uint8_t *msg,
-    size_t msg_len, const uint8_t *context_prefix, size_t context_prefix_len,
+    uint8_t out_encoded_signature[MLDSA65_SIGNATURE_BYTES],
+    const MLDSA65_private_key *private_key, const uint8_t *msg, size_t msg_len,
+    const uint8_t *context_prefix, size_t context_prefix_len,
     const uint8_t *context, size_t context_len,
     const uint8_t randomizer[BCM_MLDSA_SIGNATURE_RANDOMIZER_BYTES]);
 
-// BCM_mldsa5_verify_internal verifies that |encoded_signature| is a valid
-// signature of |msg| by |public_key|. The |context_prefix| and |context| are
+OPENSSL_EXPORT bcm_status BCM_mldsa65_sign_mu_internal(
+    uint8_t out_encoded_signature[MLDSA65_SIGNATURE_BYTES],
+    const MLDSA65_private_key *private_key,
+    const uint8_t msg_rep[MLDSA_MU_BYTES],
+    const uint8_t randomizer[BCM_MLDSA_SIGNATURE_RANDOMIZER_BYTES]);
+
+// BCM_mldsa5_verify_internal verifies that `encoded_signature` is a valid
+// signature of `msg` by `public_key`. The `context_prefix` and `context` are
 // prefixed to the message before verification, in that order.
 OPENSSL_EXPORT bcm_status BCM_mldsa65_verify_internal(
-    const struct BCM_mldsa65_public_key *public_key,
-    const uint8_t encoded_signature[BCM_MLDSA65_SIGNATURE_BYTES],
+    const MLDSA65_public_key *public_key,
+    const uint8_t encoded_signature[MLDSA65_SIGNATURE_BYTES],
     const uint8_t *msg, size_t msg_len, const uint8_t *context_prefix,
     size_t context_prefix_len, const uint8_t *context, size_t context_len);
 
-// BCM_mldsa65_marshal_private_key serializes |private_key| to |out| in the
+// BCM_mldsa65_marshal_private_key serializes `private_key` to `out` in the
 // NIST format for ML-DSA-65 private keys.
 OPENSSL_EXPORT bcm_status BCM_mldsa65_marshal_private_key(
-    CBB *out, const struct BCM_mldsa65_private_key *private_key);
+    CBB *out, const MLDSA65_private_key *private_key);
+
+// BCM_mldsa65_public_keys_equal returns one if `a` and `b` are equal and zero
+// otherwise.
+int BCM_mldsa65_public_keys_equal(const MLDSA65_public_key *a,
+                                  const MLDSA65_public_key *b);
 
 
 // BCM_MLDSA87_PRIVATE_KEY_BYTES is the number of bytes in an encoded ML-DSA-87
 // private key.
 #define BCM_MLDSA87_PRIVATE_KEY_BYTES 4896
 
-// BCM_MLDSA87_PUBLIC_KEY_BYTES is the number of bytes in an encoded ML-DSA-87
-// public key.
-#define BCM_MLDSA87_PUBLIC_KEY_BYTES 2592
-
-// BCM_MLDSA87_SIGNATURE_BYTES is the number of bytes in an encoded ML-DSA-87
-// signature.
-#define BCM_MLDSA87_SIGNATURE_BYTES 4627
-
-struct BCM_mldsa87_private_key {
-  union {
-    uint8_t bytes[32 + 32 + 64 + 256 * 4 * (7 + 8 + 8)];
-    uint32_t alignment;
-  } opaque;
-};
-
-struct BCM_mldsa87_public_key {
-  union {
-    uint8_t bytes[32 + 64 + 256 * 4 * 8];
-    uint32_t alignment;
-  } opaque;
-};
-
 OPENSSL_EXPORT bcm_status BCM_mldsa87_generate_key(
-    uint8_t out_encoded_public_key[BCM_MLDSA87_PUBLIC_KEY_BYTES],
-    uint8_t out_seed[BCM_MLDSA_SEED_BYTES],
-    struct BCM_mldsa87_private_key *out_private_key);
+    uint8_t out_encoded_public_key[MLDSA87_PUBLIC_KEY_BYTES],
+    uint8_t out_seed[MLDSA_SEED_BYTES], MLDSA87_private_key *out_private_key);
 
 OPENSSL_EXPORT bcm_status BCM_mldsa87_private_key_from_seed(
-    struct BCM_mldsa87_private_key *out_private_key,
-    const uint8_t seed[BCM_MLDSA_SEED_BYTES]);
+    MLDSA87_private_key *out_private_key, const uint8_t seed[MLDSA_SEED_BYTES]);
 
 OPENSSL_EXPORT bcm_status BCM_mldsa87_public_from_private(
-    struct BCM_mldsa87_public_key *out_public_key,
-    const struct BCM_mldsa87_private_key *private_key);
+    MLDSA87_public_key *out_public_key, const MLDSA87_private_key *private_key);
+
+// BCM_mldsa87_public_of_private returns the public half of `private_key`.
+const MLDSA87_public_key *BCM_mldsa87_public_of_private(
+    const MLDSA87_private_key *private_key);
 
 OPENSSL_EXPORT bcm_status
-BCM_mldsa87_check_key_fips(struct BCM_mldsa87_private_key *private_key);
+BCM_mldsa87_check_key_fips(MLDSA87_private_key *private_key);
 
 OPENSSL_EXPORT bcm_status BCM_mldsa87_generate_key_fips(
-    uint8_t out_encoded_public_key[BCM_MLDSA87_PUBLIC_KEY_BYTES],
-    uint8_t out_seed[BCM_MLDSA_SEED_BYTES],
-    struct BCM_mldsa87_private_key *out_private_key);
+    uint8_t out_encoded_public_key[MLDSA87_PUBLIC_KEY_BYTES],
+    uint8_t out_seed[MLDSA_SEED_BYTES], MLDSA87_private_key *out_private_key);
 
 OPENSSL_EXPORT bcm_status BCM_mldsa87_private_key_from_seed_fips(
-    struct BCM_mldsa87_private_key *out_private_key,
-    const uint8_t seed[BCM_MLDSA_SEED_BYTES]);
+    MLDSA87_private_key *out_private_key, const uint8_t seed[MLDSA_SEED_BYTES]);
 
-OPENSSL_EXPORT bcm_status BCM_mldsa87_sign(
-    uint8_t out_encoded_signature[BCM_MLDSA87_SIGNATURE_BYTES],
-    const struct BCM_mldsa87_private_key *private_key, const uint8_t *msg,
-    size_t msg_len, const uint8_t *context, size_t context_len);
+OPENSSL_EXPORT bcm_status
+BCM_mldsa87_sign(uint8_t out_encoded_signature[MLDSA87_SIGNATURE_BYTES],
+                 const MLDSA87_private_key *private_key, const uint8_t *msg,
+                 size_t msg_len, const uint8_t *context, size_t context_len);
 
 OPENSSL_EXPORT bcm_status
-BCM_mldsa87_verify(const struct BCM_mldsa87_public_key *public_key,
+BCM_mldsa87_verify(const MLDSA87_public_key *public_key,
                    const uint8_t *signature, const uint8_t *msg, size_t msg_len,
                    const uint8_t *context, size_t context_len);
 
-OPENSSL_EXPORT bcm_status BCM_mldsa87_marshal_public_key(
-    CBB *out, const struct BCM_mldsa87_public_key *public_key);
+OPENSSL_EXPORT void BCM_mldsa87_prehash_init(
+    MLDSA87_prehash *out_prehash_ctx, const MLDSA87_public_key *public_key,
+    const uint8_t *context, size_t context_len);
+
+OPENSSL_EXPORT void BCM_mldsa87_prehash_update(
+    MLDSA87_prehash *inout_prehash_ctx, const uint8_t *msg, size_t msg_len);
+
+OPENSSL_EXPORT void BCM_mldsa87_prehash_finalize(
+    uint8_t out_msg_rep[MLDSA_MU_BYTES], MLDSA87_prehash *inout_prehash_ctx);
+
+OPENSSL_EXPORT bcm_status BCM_mldsa87_sign_message_representative(
+    uint8_t out_encoded_signature[MLDSA87_SIGNATURE_BYTES],
+    const MLDSA87_private_key *private_key,
+    const uint8_t msg_rep[MLDSA_MU_BYTES]);
+
+OPENSSL_EXPORT bcm_status BCM_mldsa87_verify_message_representative(
+    const MLDSA87_public_key *public_key,
+    const uint8_t signature[MLDSA87_SIGNATURE_BYTES],
+    const uint8_t msg_rep[MLDSA_MU_BYTES]);
+
+OPENSSL_EXPORT bcm_status
+BCM_mldsa87_marshal_public_key(CBB *out, const MLDSA87_public_key *public_key);
 
-OPENSSL_EXPORT bcm_status BCM_mldsa87_parse_public_key(
-    struct BCM_mldsa87_public_key *public_key, CBS *in);
+OPENSSL_EXPORT bcm_status
+BCM_mldsa87_parse_public_key(MLDSA87_public_key *public_key, CBS *in);
 
-OPENSSL_EXPORT bcm_status BCM_mldsa87_parse_private_key(
-    struct BCM_mldsa87_private_key *private_key, CBS *in);
+OPENSSL_EXPORT bcm_status
+BCM_mldsa87_parse_private_key(MLDSA87_private_key *private_key, CBS *in);
 
 // BCM_mldsa87_generate_key_external_entropy generates a public/private key pair
 // using the given seed, writes the encoded public key to
-// |out_encoded_public_key| and sets |out_private_key| to the private key.
+// `out_encoded_public_key` and sets `out_private_key` to the private key.
 OPENSSL_EXPORT bcm_status BCM_mldsa87_generate_key_external_entropy(
-    uint8_t out_encoded_public_key[BCM_MLDSA87_PUBLIC_KEY_BYTES],
-    struct BCM_mldsa87_private_key *out_private_key,
-    const uint8_t entropy[BCM_MLDSA_SEED_BYTES]);
+    uint8_t out_encoded_public_key[MLDSA87_PUBLIC_KEY_BYTES],
+    MLDSA87_private_key *out_private_key,
+    const uint8_t entropy[MLDSA_SEED_BYTES]);
 
 OPENSSL_EXPORT bcm_status BCM_mldsa87_generate_key_external_entropy_fips(
-    uint8_t out_encoded_public_key[BCM_MLDSA87_PUBLIC_KEY_BYTES],
-    struct BCM_mldsa87_private_key *out_private_key,
-    const uint8_t entropy[BCM_MLDSA_SEED_BYTES]);
+    uint8_t out_encoded_public_key[MLDSA87_PUBLIC_KEY_BYTES],
+    MLDSA87_private_key *out_private_key,
+    const uint8_t entropy[MLDSA_SEED_BYTES]);
 
-// BCM_mldsa87_sign_internal signs |msg| using |private_key| and writes the
-// signature to |out_encoded_signature|. The |context_prefix| and |context| are
-// prefixed to the message, in that order, before signing. The |randomizer|
+// BCM_mldsa87_sign_internal signs `msg` using `private_key` and writes the
+// signature to `out_encoded_signature`. The `context_prefix` and `context` are
+// prefixed to the message, in that order, before signing. The `randomizer`
 // value can be set to zero bytes in order to make a deterministic signature, or
-// else filled with entropy for the usual |MLDSA_sign| behavior.
+// else filled with entropy for the usual `MLDSA_sign` behavior.
 OPENSSL_EXPORT bcm_status BCM_mldsa87_sign_internal(
-    uint8_t out_encoded_signature[BCM_MLDSA87_SIGNATURE_BYTES],
-    const struct BCM_mldsa87_private_key *private_key, const uint8_t *msg,
-    size_t msg_len, const uint8_t *context_prefix, size_t context_prefix_len,
+    uint8_t out_encoded_signature[MLDSA87_SIGNATURE_BYTES],
+    const MLDSA87_private_key *private_key, const uint8_t *msg, size_t msg_len,
+    const uint8_t *context_prefix, size_t context_prefix_len,
     const uint8_t *context, size_t context_len,
     const uint8_t randomizer[BCM_MLDSA_SIGNATURE_RANDOMIZER_BYTES]);
 
-// BCM_mldsa87_verify_internal verifies that |encoded_signature| is a valid
-// signature of |msg| by |public_key|. The |context_prefix| and |context| are
+OPENSSL_EXPORT bcm_status BCM_mldsa87_sign_mu_internal(
+    uint8_t out_encoded_signature[MLDSA87_SIGNATURE_BYTES],
+    const MLDSA87_private_key *private_key,
+    const uint8_t msg_rep[MLDSA_MU_BYTES],
+    const uint8_t randomizer[BCM_MLDSA_SIGNATURE_RANDOMIZER_BYTES]);
+
+// BCM_mldsa87_verify_internal verifies that `encoded_signature` is a valid
+// signature of `msg` by `public_key`. The `context_prefix` and `context` are
 // prefixed to the message before verification, in that order.
 OPENSSL_EXPORT bcm_status BCM_mldsa87_verify_internal(
-    const struct BCM_mldsa87_public_key *public_key,
-    const uint8_t encoded_signature[BCM_MLDSA87_SIGNATURE_BYTES],
+    const MLDSA87_public_key *public_key,
+    const uint8_t encoded_signature[MLDSA87_SIGNATURE_BYTES],
     const uint8_t *msg, size_t msg_len, const uint8_t *context_prefix,
     size_t context_prefix_len, const uint8_t *context, size_t context_len);
 
-// BCM_mldsa87_marshal_private_key serializes |private_key| to |out| in the
+// BCM_mldsa87_marshal_private_key serializes `private_key` to `out` in the
 // NIST format for ML-DSA-87 private keys.
 OPENSSL_EXPORT bcm_status BCM_mldsa87_marshal_private_key(
-    CBB *out, const struct BCM_mldsa87_private_key *private_key);
+    CBB *out, const MLDSA87_private_key *private_key);
+
+// BCM_mldsa87_public_keys_equal returns one if `a` and `b` are equal and zero
+// otherwise.
+int BCM_mldsa87_public_keys_equal(const MLDSA87_public_key *a,
+                                  const MLDSA87_public_key *b);
+
+// BCM_MLDSA44_PRIVATE_KEY_BYTES is the number of bytes in an encoded ML-DSA-44
+// private key.
+#define BCM_MLDSA44_PRIVATE_KEY_BYTES 2560
+
+OPENSSL_EXPORT bcm_status BCM_mldsa44_generate_key(
+    uint8_t out_encoded_public_key[MLDSA44_PUBLIC_KEY_BYTES],
+    uint8_t out_seed[MLDSA_SEED_BYTES], MLDSA44_private_key *out_private_key);
+
+OPENSSL_EXPORT bcm_status BCM_mldsa44_private_key_from_seed(
+    MLDSA44_private_key *out_private_key, const uint8_t seed[MLDSA_SEED_BYTES]);
+
+OPENSSL_EXPORT bcm_status BCM_mldsa44_public_from_private(
+    MLDSA44_public_key *out_public_key, const MLDSA44_private_key *private_key);
+
+// BCM_mldsa44_public_of_private returns the public half of `private_key`.
+const MLDSA44_public_key *BCM_mldsa44_public_of_private(
+    const MLDSA44_private_key *private_key);
+
+OPENSSL_EXPORT bcm_status
+BCM_mldsa44_check_key_fips(MLDSA44_private_key *private_key);
+
+OPENSSL_EXPORT bcm_status BCM_mldsa44_generate_key_fips(
+    uint8_t out_encoded_public_key[MLDSA44_PUBLIC_KEY_BYTES],
+    uint8_t out_seed[MLDSA_SEED_BYTES], MLDSA44_private_key *out_private_key);
+
+OPENSSL_EXPORT bcm_status BCM_mldsa44_private_key_from_seed_fips(
+    MLDSA44_private_key *out_private_key, const uint8_t seed[MLDSA_SEED_BYTES]);
+
+OPENSSL_EXPORT bcm_status
+BCM_mldsa44_sign(uint8_t out_encoded_signature[MLDSA44_SIGNATURE_BYTES],
+                 const MLDSA44_private_key *private_key, const uint8_t *msg,
+                 size_t msg_len, const uint8_t *context, size_t context_len);
+
+OPENSSL_EXPORT bcm_status
+BCM_mldsa44_verify(const MLDSA44_public_key *public_key,
+                   const uint8_t *signature, const uint8_t *msg, size_t msg_len,
+                   const uint8_t *context, size_t context_len);
+
+OPENSSL_EXPORT void BCM_mldsa44_prehash_init(
+    MLDSA44_prehash *out_prehash_ctx, const MLDSA44_public_key *public_key,
+    const uint8_t *context, size_t context_len);
+
+OPENSSL_EXPORT void BCM_mldsa44_prehash_update(
+    MLDSA44_prehash *inout_prehash_ctx, const uint8_t *msg, size_t msg_len);
+
+OPENSSL_EXPORT void BCM_mldsa44_prehash_finalize(
+    uint8_t out_msg_rep[MLDSA_MU_BYTES], MLDSA44_prehash *inout_prehash_ctx);
+
+OPENSSL_EXPORT bcm_status BCM_mldsa44_sign_message_representative(
+    uint8_t out_encoded_signature[MLDSA44_SIGNATURE_BYTES],
+    const MLDSA44_private_key *private_key,
+    const uint8_t msg_rep[MLDSA_MU_BYTES]);
+
+OPENSSL_EXPORT bcm_status BCM_mldsa44_verify_message_representative(
+    const MLDSA44_public_key *public_key,
+    const uint8_t signature[MLDSA44_SIGNATURE_BYTES],
+    const uint8_t msg_rep[MLDSA_MU_BYTES]);
+
+OPENSSL_EXPORT bcm_status
+BCM_mldsa44_marshal_public_key(CBB *out, const MLDSA44_public_key *public_key);
+
+OPENSSL_EXPORT bcm_status
+BCM_mldsa44_parse_public_key(MLDSA44_public_key *public_key, CBS *in);
+
+OPENSSL_EXPORT bcm_status
+BCM_mldsa44_parse_private_key(MLDSA44_private_key *private_key, CBS *in);
+
+// BCM_mldsa44_generate_key_external_entropy generates a public/private key pair
+// using the given seed, writes the encoded public key to
+// `out_encoded_public_key` and sets `out_private_key` to the private key.
+OPENSSL_EXPORT bcm_status BCM_mldsa44_generate_key_external_entropy(
+    uint8_t out_encoded_public_key[MLDSA44_PUBLIC_KEY_BYTES],
+    MLDSA44_private_key *out_private_key,
+    const uint8_t entropy[MLDSA_SEED_BYTES]);
+
+OPENSSL_EXPORT bcm_status BCM_mldsa44_generate_key_external_entropy_fips(
+    uint8_t out_encoded_public_key[MLDSA44_PUBLIC_KEY_BYTES],
+    MLDSA44_private_key *out_private_key,
+    const uint8_t entropy[MLDSA_SEED_BYTES]);
+
+// BCM_mldsa44_sign_internal signs `msg` using `private_key` and writes the
+// signature to `out_encoded_signature`. The `context_prefix` and `context` are
+// prefixed to the message, in that order, before signing. The `randomizer`
+// value can be set to zero bytes in order to make a deterministic signature, or
+// else filled with entropy for the usual `MLDSA_sign` behavior.
+OPENSSL_EXPORT bcm_status BCM_mldsa44_sign_internal(
+    uint8_t out_encoded_signature[MLDSA44_SIGNATURE_BYTES],
+    const MLDSA44_private_key *private_key, const uint8_t *msg, size_t msg_len,
+    const uint8_t *context_prefix, size_t context_prefix_len,
+    const uint8_t *context, size_t context_len,
+    const uint8_t randomizer[BCM_MLDSA_SIGNATURE_RANDOMIZER_BYTES]);
+
+OPENSSL_EXPORT bcm_status BCM_mldsa44_sign_mu_internal(
+    uint8_t out_encoded_signature[MLDSA44_SIGNATURE_BYTES],
+    const MLDSA44_private_key *private_key,
+    const uint8_t msg_rep[MLDSA_MU_BYTES],
+    const uint8_t randomizer[BCM_MLDSA_SIGNATURE_RANDOMIZER_BYTES]);
+
+// BCM_mldsa44_verify_internal verifies that `encoded_signature` is a valid
+// signature of `msg` by `public_key`. The `context_prefix` and `context` are
+// prefixed to the message before verification, in that order.
+OPENSSL_EXPORT bcm_status BCM_mldsa44_verify_internal(
+    const MLDSA44_public_key *public_key,
+    const uint8_t encoded_signature[MLDSA44_SIGNATURE_BYTES],
+    const uint8_t *msg, size_t msg_len, const uint8_t *context_prefix,
+    size_t context_prefix_len, const uint8_t *context, size_t context_len);
+
+// BCM_mldsa44_marshal_private_key serializes `private_key` to `out` in the
+// NIST format for ML-DSA-44 private keys.
+OPENSSL_EXPORT bcm_status BCM_mldsa44_marshal_private_key(
+    CBB *out, const MLDSA44_private_key *private_key);
+
+// BCM_mldsa44_public_keys_equal returns one if `a` and `b` are equal and zero
+// otherwise.
+int BCM_mldsa44_public_keys_equal(const MLDSA44_public_key *a,
+                                  const MLDSA44_public_key *b);
 
 
 // ML-KEM
@@ -487,218 +593,182 @@ OPENSSL_EXPORT bcm_status BCM_mldsa87_marshal_private_key(
 // decapsulating party.
 #define BCM_MLKEM_ENCAP_ENTROPY 32
 
-// BCM_MLKEM768_PUBLIC_KEY_BYTES is the number of bytes in an encoded ML-KEM-768
-// public key.
-#define BCM_MLKEM768_PUBLIC_KEY_BYTES 1184
-
-// BCM_MLKEM1024_PUBLIC_KEY_BYTES is the number of bytes in an encoded
-// ML-KEM-1024 public key.
-#define BCM_MLKEM1024_PUBLIC_KEY_BYTES 1568
-
-// BCM_MLKEM768_CIPHERTEXT_BYTES is number of bytes in the ML-KEM-768
-// ciphertext.
-#define BCM_MLKEM768_CIPHERTEXT_BYTES 1088
-
-// BCM_MLKEM1024_CIPHERTEXT_BYTES is number of bytes in the ML-KEM-1024
-// ciphertext.
-#define BCM_MLKEM1024_CIPHERTEXT_BYTES 1568
-
 // BCM_MLKEM768_PRIVATE_KEY_BYTES is the length of the data produced by
-// |BCM_mlkem768_marshal_private_key|.
+// `BCM_mlkem768_marshal_private_key`.
 #define BCM_MLKEM768_PRIVATE_KEY_BYTES 2400
 
 // BCM_MLKEM1024_PRIVATE_KEY_BYTES is the length of the data produced by
-// |BCM_mlkem1024_marshal_private_key|.
+// `BCM_mlkem1024_marshal_private_key`.
 #define BCM_MLKEM1024_PRIVATE_KEY_BYTES 3168
 
-// BCM_MLKEM_SEED_BYTES is the number of bytes in an ML-KEM seed.
-#define BCM_MLKEM_SEED_BYTES 64
-
-// BCM_mlkem_SHARED_SECRET_BYTES is the number of bytes in an ML-KEM shared
-// secret.
-#define BCM_MLKEM_SHARED_SECRET_BYTES 32
-
-struct BCM_mlkem768_public_key {
-  union {
-    uint8_t bytes[512 * (3 + 9) + 32 + 32];
-    uint16_t alignment;
-  } opaque;
-};
-
-struct BCM_mlkem768_private_key {
-  union {
-    uint8_t bytes[512 * (3 + 3 + 9) + 32 + 32 + 32];
-    uint16_t alignment;
-  } opaque;
-};
-
-
-
 OPENSSL_EXPORT bcm_infallible BCM_mlkem768_generate_key(
-    uint8_t out_encoded_public_key[BCM_MLKEM768_PUBLIC_KEY_BYTES],
-    uint8_t optional_out_seed[BCM_MLKEM_SEED_BYTES],
-    struct BCM_mlkem768_private_key *out_private_key);
+    uint8_t out_encoded_public_key[MLKEM768_PUBLIC_KEY_BYTES],
+    uint8_t optional_out_seed[MLKEM_SEED_BYTES],
+    MLKEM768_private_key *out_private_key);
 
-OPENSSL_EXPORT bcm_status BCM_mlkem768_private_key_from_seed(
-    struct BCM_mlkem768_private_key *out_private_key, const uint8_t *seed,
-    size_t seed_len);
+OPENSSL_EXPORT bcm_status
+BCM_mlkem768_private_key_from_seed(MLKEM768_private_key *out_private_key,
+                                   const uint8_t *seed, size_t seed_len);
 
 OPENSSL_EXPORT bcm_status BCM_mlkem768_generate_key_fips(
-    uint8_t out_encoded_public_key[BCM_MLKEM768_PUBLIC_KEY_BYTES],
-    uint8_t optional_out_seed[BCM_MLKEM_SEED_BYTES],
-    struct BCM_mlkem768_private_key *out_private_key);
+    uint8_t out_encoded_public_key[MLKEM768_PUBLIC_KEY_BYTES],
+    uint8_t optional_out_seed[MLKEM_SEED_BYTES],
+    MLKEM768_private_key *out_private_key);
 
 OPENSSL_EXPORT bcm_status
-BCM_mlkem768_check_fips(const struct BCM_mlkem768_private_key *private_key);
+BCM_mlkem768_check_fips(const MLKEM768_private_key *private_key);
 
-OPENSSL_EXPORT bcm_infallible BCM_mlkem768_public_from_private(
-    struct BCM_mlkem768_public_key *out_public_key,
-    const struct BCM_mlkem768_private_key *private_key);
+OPENSSL_EXPORT bcm_infallible
+BCM_mlkem768_public_from_private(MLKEM768_public_key *out_public_key,
+                                 const MLKEM768_private_key *private_key);
+
+OPENSSL_EXPORT const MLKEM768_public_key *BCM_mlkem768_public_of_private(
+    const MLKEM768_private_key *private_key);
 
 OPENSSL_EXPORT bcm_infallible
-BCM_mlkem768_encap(uint8_t out_ciphertext[BCM_MLKEM768_CIPHERTEXT_BYTES],
-                   uint8_t out_shared_secret[BCM_MLKEM_SHARED_SECRET_BYTES],
-                   const struct BCM_mlkem768_public_key *public_key);
+BCM_mlkem768_encap(uint8_t out_ciphertext[MLKEM768_CIPHERTEXT_BYTES],
+                   uint8_t out_shared_secret[MLKEM_SHARED_SECRET_BYTES],
+                   const MLKEM768_public_key *public_key);
 
 OPENSSL_EXPORT bcm_status
-BCM_mlkem768_decap(uint8_t out_shared_secret[BCM_MLKEM_SHARED_SECRET_BYTES],
+BCM_mlkem768_decap(uint8_t out_shared_secret[MLKEM_SHARED_SECRET_BYTES],
                    const uint8_t *ciphertext, size_t ciphertext_len,
-                   const struct BCM_mlkem768_private_key *private_key);
+                   const MLKEM768_private_key *private_key);
 
 OPENSSL_EXPORT bcm_status BCM_mlkem768_marshal_public_key(
-    CBB *out, const struct BCM_mlkem768_public_key *public_key);
+    CBB *out, const MLKEM768_public_key *public_key);
+
+// BCM_mlkem768_public_keys_equal returns one if `a` and `b` are equal and zero
+// otherwise.
+int BCM_mlkem768_public_keys_equal(const MLKEM768_public_key *a,
+                                   const MLKEM768_public_key *b);
 
-OPENSSL_EXPORT bcm_status BCM_mlkem768_parse_public_key(
-    struct BCM_mlkem768_public_key *out_public_key, CBS *in);
+OPENSSL_EXPORT bcm_status
+BCM_mlkem768_parse_public_key(MLKEM768_public_key *out_public_key, CBS *in);
 
 // BCM_mlkem768_parse_private_key parses a private key, in NIST's format for
-// private keys, from |in| and writes the result to |out_private_key|. It
+// private keys, from `in` and writes the result to `out_private_key`. It
 // returns one on success or zero on parse error or if there are trailing bytes
-// in |in|. This format is verbose and should be avoided. Private keys should be
-// stored as seeds and parsed using |BCM_mlkem768_private_key_from_seed|.
-OPENSSL_EXPORT bcm_status BCM_mlkem768_parse_private_key(
-    struct BCM_mlkem768_private_key *out_private_key, CBS *in);
+// in `in`. This format is verbose and should be avoided. Private keys should be
+// stored as seeds and parsed using `BCM_mlkem768_private_key_from_seed`.
+OPENSSL_EXPORT bcm_status
+BCM_mlkem768_parse_private_key(MLKEM768_private_key *out_private_key, CBS *in);
 
 // BCM_mlkem768_generate_key_external_seed is a deterministic function to create
 // a pair of ML-KEM-768 keys, using the supplied seed. The seed needs to be
 // uniformly random. This function should only be used for tests; regular
-// callers should use the non-deterministic |BCM_mlkem768_generate_key|
+// callers should use the non-deterministic `BCM_mlkem768_generate_key`
 // directly.
 OPENSSL_EXPORT bcm_infallible BCM_mlkem768_generate_key_external_seed(
-    uint8_t out_encoded_public_key[BCM_MLKEM768_PUBLIC_KEY_BYTES],
-    struct BCM_mlkem768_private_key *out_private_key,
-    const uint8_t seed[BCM_MLKEM_SEED_BYTES]);
+    uint8_t out_encoded_public_key[MLKEM768_PUBLIC_KEY_BYTES],
+    MLKEM768_private_key *out_private_key,
+    const uint8_t seed[MLKEM_SEED_BYTES]);
 
-// BCM_mlkem768_encap_external_entropy behaves like |MLKEM768_encap|, but uses
-// |MLKEM_ENCAP_ENTROPY| bytes of |entropy| for randomization. The decapsulating
-// side will be able to recover |entropy| in full. This function should only be
+// BCM_mlkem768_encap_external_entropy behaves like `MLKEM768_encap`, but uses
+// `MLKEM_ENCAP_ENTROPY` bytes of `entropy` for randomization. The decapsulating
+// side will be able to recover `entropy` in full. This function should only be
 // used for tests, regular callers should use the non-deterministic
-// |BCM_mlkem768_encap| directly.
+// `BCM_mlkem768_encap` directly.
 OPENSSL_EXPORT bcm_infallible BCM_mlkem768_encap_external_entropy(
-    uint8_t out_ciphertext[BCM_MLKEM768_CIPHERTEXT_BYTES],
-    uint8_t out_shared_secret[BCM_MLKEM_SHARED_SECRET_BYTES],
-    const struct BCM_mlkem768_public_key *public_key,
+    uint8_t out_ciphertext[MLKEM768_CIPHERTEXT_BYTES],
+    uint8_t out_shared_secret[MLKEM_SHARED_SECRET_BYTES],
+    const MLKEM768_public_key *public_key,
     const uint8_t entropy[BCM_MLKEM_ENCAP_ENTROPY]);
 
-// BCM_mlkem768_marshal_private_key serializes |private_key| to |out| in the
+// BCM_mlkem768_marshal_private_key serializes `private_key` to `out` in the
 // NIST format for ML-KEM-768 private keys. (Note that one can also save just
-// the seed value produced by |BCM_mlkem768_generate_key|, which is
+// the seed value produced by `BCM_mlkem768_generate_key`, which is
 // significantly smaller.)
 OPENSSL_EXPORT bcm_status BCM_mlkem768_marshal_private_key(
-    CBB *out, const struct BCM_mlkem768_private_key *private_key);
-
-struct BCM_mlkem1024_public_key {
-  union {
-    uint8_t bytes[512 * (4 + 16) + 32 + 32];
-    uint16_t alignment;
-  } opaque;
-};
-
-struct BCM_mlkem1024_private_key {
-  union {
-    uint8_t bytes[512 * (4 + 4 + 16) + 32 + 32 + 32];
-    uint16_t alignment;
-  } opaque;
-};
+    CBB *out, const MLKEM768_private_key *private_key);
 
 OPENSSL_EXPORT bcm_infallible BCM_mlkem1024_generate_key(
-    uint8_t out_encoded_public_key[BCM_MLKEM1024_PUBLIC_KEY_BYTES],
-    uint8_t optional_out_seed[BCM_MLKEM_SEED_BYTES],
-    struct BCM_mlkem1024_private_key *out_private_key);
+    uint8_t out_encoded_public_key[MLKEM1024_PUBLIC_KEY_BYTES],
+    uint8_t optional_out_seed[MLKEM_SEED_BYTES],
+    MLKEM1024_private_key *out_private_key);
 
 OPENSSL_EXPORT bcm_status BCM_mlkem1024_generate_key_fips(
-    uint8_t out_encoded_public_key[BCM_MLKEM1024_PUBLIC_KEY_BYTES],
-    uint8_t optional_out_seed[BCM_MLKEM_SEED_BYTES],
-    struct BCM_mlkem1024_private_key *out_private_key);
+    uint8_t out_encoded_public_key[MLKEM1024_PUBLIC_KEY_BYTES],
+    uint8_t optional_out_seed[MLKEM_SEED_BYTES],
+    MLKEM1024_private_key *out_private_key);
 
 OPENSSL_EXPORT bcm_status
-BCM_mlkem1024_check_fips(const struct BCM_mlkem1024_private_key *private_key);
+BCM_mlkem1024_check_fips(const MLKEM1024_private_key *private_key);
 
-OPENSSL_EXPORT bcm_status BCM_mlkem1024_private_key_from_seed(
-    struct BCM_mlkem1024_private_key *out_private_key, const uint8_t *seed,
-    size_t seed_len);
+OPENSSL_EXPORT bcm_status
+BCM_mlkem1024_private_key_from_seed(MLKEM1024_private_key *out_private_key,
+                                    const uint8_t *seed, size_t seed_len);
 
-OPENSSL_EXPORT bcm_infallible BCM_mlkem1024_public_from_private(
-    struct BCM_mlkem1024_public_key *out_public_key,
-    const struct BCM_mlkem1024_private_key *private_key);
+OPENSSL_EXPORT bcm_infallible
+BCM_mlkem1024_public_from_private(MLKEM1024_public_key *out_public_key,
+                                  const MLKEM1024_private_key *private_key);
+
+OPENSSL_EXPORT const MLKEM1024_public_key *BCM_mlkem1024_public_of_private(
+    const MLKEM1024_private_key *private_key);
 
 OPENSSL_EXPORT bcm_infallible
-BCM_mlkem1024_encap(uint8_t out_ciphertext[BCM_MLKEM1024_CIPHERTEXT_BYTES],
-                    uint8_t out_shared_secret[BCM_MLKEM_SHARED_SECRET_BYTES],
-                    const struct BCM_mlkem1024_public_key *public_key);
+BCM_mlkem1024_encap(uint8_t out_ciphertext[MLKEM1024_CIPHERTEXT_BYTES],
+                    uint8_t out_shared_secret[MLKEM_SHARED_SECRET_BYTES],
+                    const MLKEM1024_public_key *public_key);
 
 OPENSSL_EXPORT bcm_status
-BCM_mlkem1024_decap(uint8_t out_shared_secret[BCM_MLKEM_SHARED_SECRET_BYTES],
+BCM_mlkem1024_decap(uint8_t out_shared_secret[MLKEM_SHARED_SECRET_BYTES],
                     const uint8_t *ciphertext, size_t ciphertext_len,
-                    const struct BCM_mlkem1024_private_key *private_key);
+                    const MLKEM1024_private_key *private_key);
 
 OPENSSL_EXPORT bcm_status BCM_mlkem1024_marshal_public_key(
-    CBB *out, const struct BCM_mlkem1024_public_key *public_key);
+    CBB *out, const MLKEM1024_public_key *public_key);
 
-OPENSSL_EXPORT bcm_status BCM_mlkem1024_parse_public_key(
-    struct BCM_mlkem1024_public_key *out_public_key, CBS *in);
+// BCM_mlkem1024_public_keys_equal returns one if `a` and `b` are equal and zero
+// otherwise.
+int BCM_mlkem1024_public_keys_equal(const MLKEM1024_public_key *a,
+                                    const MLKEM1024_public_key *b);
+
+OPENSSL_EXPORT bcm_status
+BCM_mlkem1024_parse_public_key(MLKEM1024_public_key *out_public_key, CBS *in);
 
 // BCM_mlkem1024_parse_private_key parses a private key, in NIST's format for
-// private keys, from |in| and writes the result to |out_private_key|. It
+// private keys, from `in` and writes the result to `out_private_key`. It
 // returns one on success or zero on parse error or if there are trailing bytes
-// in |in|. This format is verbose and should be avoided. Private keys should be
-// stored as seeds and parsed using |BCM_mlkem1024_private_key_from_seed|.
+// in `in`. This format is verbose and should be avoided. Private keys should be
+// stored as seeds and parsed using `BCM_mlkem1024_private_key_from_seed`.
 OPENSSL_EXPORT bcm_status BCM_mlkem1024_parse_private_key(
-    struct BCM_mlkem1024_private_key *out_private_key, CBS *in);
+    MLKEM1024_private_key *out_private_key, CBS *in);
 
 // BCM_mlkem1024_generate_key_external_seed is a deterministic function to
 // create a pair of ML-KEM-1024 keys, using the supplied seed. The seed needs to
 // be uniformly random. This function should only be used for tests, regular
-// callers should use the non-deterministic |BCM_mlkem1024_generate_key|
+// callers should use the non-deterministic `BCM_mlkem1024_generate_key`
 // directly.
 OPENSSL_EXPORT bcm_infallible BCM_mlkem1024_generate_key_external_seed(
-    uint8_t out_encoded_public_key[BCM_MLKEM1024_PUBLIC_KEY_BYTES],
-    struct BCM_mlkem1024_private_key *out_private_key,
-    const uint8_t seed[BCM_MLKEM_SEED_BYTES]);
+    uint8_t out_encoded_public_key[MLKEM1024_PUBLIC_KEY_BYTES],
+    MLKEM1024_private_key *out_private_key,
+    const uint8_t seed[MLKEM_SEED_BYTES]);
 
-// BCM_mlkem1024_encap_external_entropy behaves like |MLKEM1024_encap|, but uses
-// |MLKEM_ENCAP_ENTROPY| bytes of |entropy| for randomization. The
-// decapsulating side will be able to recover |entropy| in full. This function
+// BCM_mlkem1024_encap_external_entropy behaves like `MLKEM1024_encap`, but uses
+// `MLKEM_ENCAP_ENTROPY` bytes of `entropy` for randomization. The
+// decapsulating side will be able to recover `entropy` in full. This function
 // should only be used for tests, regular callers should use the
-// non-deterministic |BCM_mlkem1024_encap| directly.
+// non-deterministic `BCM_mlkem1024_encap` directly.
 OPENSSL_EXPORT bcm_infallible BCM_mlkem1024_encap_external_entropy(
-    uint8_t out_ciphertext[BCM_MLKEM1024_CIPHERTEXT_BYTES],
-    uint8_t out_shared_secret[BCM_MLKEM_SHARED_SECRET_BYTES],
-    const struct BCM_mlkem1024_public_key *public_key,
+    uint8_t out_ciphertext[MLKEM1024_CIPHERTEXT_BYTES],
+    uint8_t out_shared_secret[MLKEM_SHARED_SECRET_BYTES],
+    const MLKEM1024_public_key *public_key,
     const uint8_t entropy[BCM_MLKEM_ENCAP_ENTROPY]);
 
-// BCM_mlkem1024_marshal_private_key serializes |private_key| to |out| in the
+// BCM_mlkem1024_marshal_private_key serializes `private_key` to `out` in the
 // NIST format for ML-KEM-1024 private keys. (Note that one can also save just
-// the seed value produced by |BCM_mlkem1024_generate_key|, which is
+// the seed value produced by `BCM_mlkem1024_generate_key`, which is
 // significantly smaller.)
 OPENSSL_EXPORT bcm_status BCM_mlkem1024_marshal_private_key(
-    CBB *out, const struct BCM_mlkem1024_private_key *private_key);
+    CBB *out, const MLKEM1024_private_key *private_key);
 
 
 // SLH-DSA
 
 // Output length of the hash function.
 #define BCM_SLHDSA_SHA2_128S_N 16
+#define BCM_SLHDSA_SHAKE_256F_N 32
 
 // The number of bytes at the beginning of M', the augmented message, before the
 // context.
@@ -707,23 +777,31 @@ OPENSSL_EXPORT bcm_status BCM_mlkem1024_marshal_private_key(
 // SLHDSA_SHA2_128S_PUBLIC_KEY_BYTES is the number of bytes in an
 // SLH-DSA-SHA2-128s public key.
 #define BCM_SLHDSA_SHA2_128S_PUBLIC_KEY_BYTES 32
+#define BCM_SLHDSA_SHAKE_256F_PUBLIC_KEY_BYTES 64
 
 // BCM_SLHDSA_SHA2_128S_PRIVATE_KEY_BYTES is the number of bytes in an
 // SLH-DSA-SHA2-128s private key.
 #define BCM_SLHDSA_SHA2_128S_PRIVATE_KEY_BYTES 64
+#define BCM_SLHDSA_SHAKE_256F_PRIVATE_KEY_BYTES 128
 
 // BCM_SLHDSA_SHA2_128S_SIGNATURE_BYTES is the number of bytes in an
 // SLH-DSA-SHA2-128s signature.
 #define BCM_SLHDSA_SHA2_128S_SIGNATURE_BYTES 7856
+#define BCM_SLHDSA_SHAKE_256F_SIGNATURE_BYTES 49856
 
 // BCM_slhdsa_sha2_128s_generate_key_from_seed generates an SLH-DSA-SHA2-128s
-// key pair from a 48-byte seed and writes the result to |out_public_key| and
-// |out_secret_key|.
+// key pair from a 48-byte seed and writes the result to `out_public_key` and
+// `out_secret_key`.
 OPENSSL_EXPORT bcm_infallible BCM_slhdsa_sha2_128s_generate_key_from_seed(
     uint8_t out_public_key[BCM_SLHDSA_SHA2_128S_PUBLIC_KEY_BYTES],
     uint8_t out_secret_key[BCM_SLHDSA_SHA2_128S_PRIVATE_KEY_BYTES],
     const uint8_t seed[3 * BCM_SLHDSA_SHA2_128S_N]);
 
+OPENSSL_EXPORT bcm_infallible BCM_slhdsa_shake_256f_generate_key_from_seed(
+    uint8_t out_public_key[BCM_SLHDSA_SHAKE_256F_PUBLIC_KEY_BYTES],
+    uint8_t out_secret_key[BCM_SLHDSA_SHAKE_256F_PRIVATE_KEY_BYTES],
+    const uint8_t seed[3 * BCM_SLHDSA_SHAKE_256F_N]);
+
 // BCM_slhdsa_sha2_128s_generate_key_from_seed_fips does the same thing as
 // `BCM_slhdsa_sha2_128s_generate_key_from_seed` but implements the required
 // second check before generating a key by testing for nullptr arguments.
@@ -732,11 +810,16 @@ OPENSSL_EXPORT bcm_status BCM_slhdsa_sha2_128s_generate_key_from_seed_fips(
     uint8_t out_secret_key[BCM_SLHDSA_SHA2_128S_PRIVATE_KEY_BYTES],
     const uint8_t seed[3 * BCM_SLHDSA_SHA2_128S_N]);
 
-// BCM_slhdsa_sha2_128s_sign_internal acts like |SLHDSA_SHA2_128S_sign| but
+OPENSSL_EXPORT bcm_status BCM_slhdsa_shake_256f_generate_key_from_seed_fips(
+    uint8_t out_public_key[BCM_SLHDSA_SHAKE_256F_PUBLIC_KEY_BYTES],
+    uint8_t out_secret_key[BCM_SLHDSA_SHAKE_256F_PRIVATE_KEY_BYTES],
+    const uint8_t seed[3 * BCM_SLHDSA_SHAKE_256F_N]);
+
+// BCM_slhdsa_sha2_128s_sign_internal acts like `SLHDSA_SHA2_128S_sign` but
 // accepts an explicit entropy input, which can be PK.seed (bytes 32..48 of
 // the private key) to generate deterministic signatures. It also takes the
 // input message in three parts so that the "internal" version of the signing
-// function, from section 9.2, can be implemented. The |header| argument may be
+// function, from section 9.2, can be implemented. The `header` argument may be
 // NULL to omit it.
 OPENSSL_EXPORT bcm_infallible BCM_slhdsa_sha2_128s_sign_internal(
     uint8_t out_signature[BCM_SLHDSA_SHA2_128S_SIGNATURE_BYTES],
@@ -745,9 +828,16 @@ OPENSSL_EXPORT bcm_infallible BCM_slhdsa_sha2_128s_sign_internal(
     size_t context_len, const uint8_t *msg, size_t msg_len,
     const uint8_t entropy[BCM_SLHDSA_SHA2_128S_N]);
 
-// BCM_slhdsa_sha2_128s_verify_internal acts like |SLHDSA_SHA2_128S_verify| but
+OPENSSL_EXPORT bcm_infallible BCM_slhdsa_shake_256f_sign_internal(
+    uint8_t out_signature[BCM_SLHDSA_SHAKE_256F_SIGNATURE_BYTES],
+    const uint8_t secret_key[BCM_SLHDSA_SHAKE_256F_PRIVATE_KEY_BYTES],
+    const uint8_t header[BCM_SLHDSA_M_PRIME_HEADER_LEN], const uint8_t *context,
+    size_t context_len, const uint8_t *msg, size_t msg_len,
+    const uint8_t entropy[BCM_SLHDSA_SHAKE_256F_N]);
+
+// BCM_slhdsa_sha2_128s_verify_internal acts like `SLHDSA_SHA2_128S_verify` but
 // takes the input message in three parts so that the "internal" version of the
-// verification function, from section 9.3, can be implemented. The |header|
+// verification function, from section 9.3, can be implemented. The `header`
 // argument may be NULL to omit it.
 OPENSSL_EXPORT bcm_status BCM_slhdsa_sha2_128s_verify_internal(
     const uint8_t *signature, size_t signature_len,
@@ -755,71 +845,109 @@ OPENSSL_EXPORT bcm_status BCM_slhdsa_sha2_128s_verify_internal(
     const uint8_t header[BCM_SLHDSA_M_PRIME_HEADER_LEN], const uint8_t *context,
     size_t context_len, const uint8_t *msg, size_t msg_len);
 
+OPENSSL_EXPORT bcm_status BCM_slhdsa_shake_256f_verify_internal(
+    const uint8_t *signature, size_t signature_len,
+    const uint8_t public_key[BCM_SLHDSA_SHAKE_256F_PUBLIC_KEY_BYTES],
+    const uint8_t header[BCM_SLHDSA_M_PRIME_HEADER_LEN], const uint8_t *context,
+    size_t context_len, const uint8_t *msg, size_t msg_len);
+
 OPENSSL_EXPORT bcm_infallible BCM_slhdsa_sha2_128s_generate_key(
     uint8_t out_public_key[BCM_SLHDSA_SHA2_128S_PUBLIC_KEY_BYTES],
     uint8_t out_private_key[BCM_SLHDSA_SHA2_128S_PRIVATE_KEY_BYTES]);
 
+OPENSSL_EXPORT bcm_infallible BCM_slhdsa_shake_256f_generate_key(
+    uint8_t out_public_key[BCM_SLHDSA_SHAKE_256F_PUBLIC_KEY_BYTES],
+    uint8_t out_private_key[BCM_SLHDSA_SHAKE_256F_PRIVATE_KEY_BYTES]);
+
 OPENSSL_EXPORT bcm_status BCM_slhdsa_sha2_128s_generate_key_fips(
     uint8_t out_public_key[BCM_SLHDSA_SHA2_128S_PUBLIC_KEY_BYTES],
     uint8_t out_private_key[BCM_SLHDSA_SHA2_128S_PRIVATE_KEY_BYTES]);
 
+OPENSSL_EXPORT bcm_status BCM_slhdsa_shake_256f_generate_key_fips(
+    uint8_t out_public_key[BCM_SLHDSA_SHAKE_256F_PUBLIC_KEY_BYTES],
+    uint8_t out_private_key[BCM_SLHDSA_SHAKE_256F_PRIVATE_KEY_BYTES]);
+
 OPENSSL_EXPORT bcm_infallible BCM_slhdsa_sha2_128s_public_from_private(
     uint8_t out_public_key[BCM_SLHDSA_SHA2_128S_PUBLIC_KEY_BYTES],
     const uint8_t private_key[BCM_SLHDSA_SHA2_128S_PRIVATE_KEY_BYTES]);
 
+OPENSSL_EXPORT bcm_infallible BCM_slhdsa_shake_256f_public_from_private(
+    uint8_t out_public_key[BCM_SLHDSA_SHAKE_256F_PUBLIC_KEY_BYTES],
+    const uint8_t private_key[BCM_SLHDSA_SHAKE_256F_PRIVATE_KEY_BYTES]);
+
 OPENSSL_EXPORT bcm_status BCM_slhdsa_sha2_128s_sign(
     uint8_t out_signature[BCM_SLHDSA_SHA2_128S_SIGNATURE_BYTES],
     const uint8_t private_key[BCM_SLHDSA_SHA2_128S_PRIVATE_KEY_BYTES],
     const uint8_t *msg, size_t msg_len, const uint8_t *context,
     size_t context_len);
 
+OPENSSL_EXPORT bcm_status BCM_slhdsa_shake_256f_sign(
+    uint8_t out_signature[BCM_SLHDSA_SHAKE_256F_SIGNATURE_BYTES],
+    const uint8_t private_key[BCM_SLHDSA_SHAKE_256F_PRIVATE_KEY_BYTES],
+    const uint8_t *msg, size_t msg_len, const uint8_t *context,
+    size_t context_len);
+
 OPENSSL_EXPORT bcm_status BCM_slhdsa_sha2_128s_verify(
     const uint8_t *signature, size_t signature_len,
     const uint8_t public_key[BCM_SLHDSA_SHA2_128S_PUBLIC_KEY_BYTES],
     const uint8_t *msg, size_t msg_len, const uint8_t *context,
     size_t context_len);
 
+OPENSSL_EXPORT bcm_status BCM_slhdsa_shake_256f_verify(
+    const uint8_t *signature, size_t signature_len,
+    const uint8_t public_key[BCM_SLHDSA_SHAKE_256F_PUBLIC_KEY_BYTES],
+    const uint8_t *msg, size_t msg_len, const uint8_t *context,
+    size_t context_len);
+
 OPENSSL_EXPORT bcm_status BCM_slhdsa_sha2_128s_prehash_sign(
     uint8_t out_signature[BCM_SLHDSA_SHA2_128S_SIGNATURE_BYTES],
     const uint8_t private_key[BCM_SLHDSA_SHA2_128S_PRIVATE_KEY_BYTES],
     const uint8_t *hashed_msg, size_t hashed_msg_len, int hash_nid,
     const uint8_t *context, size_t context_len);
 
+OPENSSL_EXPORT bcm_status BCM_slhdsa_shake_256f_prehash_sign(
+    uint8_t out_signature[BCM_SLHDSA_SHAKE_256F_SIGNATURE_BYTES],
+    const uint8_t private_key[BCM_SLHDSA_SHAKE_256F_PRIVATE_KEY_BYTES],
+    const uint8_t *hashed_msg, size_t hashed_msg_len, int hash_nid,
+    const uint8_t *context, size_t context_len);
+
 OPENSSL_EXPORT bcm_status BCM_slhdsa_sha2_128s_prehash_verify(
     const uint8_t *signature, size_t signature_len,
     const uint8_t public_key[BCM_SLHDSA_SHA2_128S_PUBLIC_KEY_BYTES],
     const uint8_t *hashed_msg, size_t hashed_msg_len, int hash_nid,
     const uint8_t *context, size_t context_len);
 
+OPENSSL_EXPORT bcm_status BCM_slhdsa_shake_256f_prehash_verify(
+    const uint8_t *signature, size_t signature_len,
+    const uint8_t public_key[BCM_SLHDSA_SHAKE_256F_PUBLIC_KEY_BYTES],
+    const uint8_t *hashed_msg, size_t hashed_msg_len, int hash_nid,
+    const uint8_t *context, size_t context_len);
+
 
 // AES
 
-// BCM_aes_encrypt encrypts a single block from |in| to |out| with |key|. The
-// |in| and |out| pointers may overlap.
-OPENSSL_EXPORT bcm_infallible BCM_aes_encrypt(const uint8_t *in, uint8_t *out,
-                                              const AES_KEY *key);
-// BCM_aes_decrypt decrypts a single block from |in| to |out| with |key|. The
-// |in| and |out| pointers may overlap.
-OPENSSL_EXPORT bcm_infallible BCM_aes_decrypt(const uint8_t *in, uint8_t *out,
-                                              const AES_KEY *key);
-
-// BCM_aes_set_encrypt_key configures |aeskey| to encrypt with the |bits|-bit
-// key, |key|. |key| must point to |bits|/8 bytes. It will return failure if
-// |bits| is an invalid AES key size.
-OPENSSL_EXPORT bcm_status BCM_aes_set_encrypt_key(const uint8_t *key,
-                                                  unsigned bits,
-                                                  AES_KEY *aeskey);
-
-// BCM_aes_set_decrypt_key configures |aeskey| to decrypt with the |bits|-bit
-// key, |key|. |key| must point to |bits|/8 bytes. It will return failure if
-// |bits| is an invalid AES key size.
-OPENSSL_EXPORT bcm_status BCM_aes_set_decrypt_key(const uint8_t *key,
-                                                  unsigned bits,
-                                                  AES_KEY *aeskey);
-
-
-#if defined(__cplusplus)
-}  // extern C
-#endif
+// BCM_aes_encrypt encrypts a single block from `in` to `out` with `key`. The
+// `in` and `out` pointers may overlap.
+bcm_infallible BCM_aes_encrypt(const uint8_t *in, uint8_t *out,
+                               const AES_KEY *key);
+// BCM_aes_decrypt decrypts a single block from `in` to `out` with `key`. The
+// `in` and `out` pointers may overlap.
+bcm_infallible BCM_aes_decrypt(const uint8_t *in, uint8_t *out,
+                               const AES_KEY *key);
+
+// BCM_aes_set_encrypt_key configures `aeskey` to encrypt with the `bits`-bit
+// key, `key`. `key` must point to `bits`/8 bytes. It will return failure if
+// `bits` is an invalid AES key size.
+bcm_status BCM_aes_set_encrypt_key(const uint8_t *key, unsigned bits,
+                                   AES_KEY *aeskey);
+
+// BCM_aes_set_decrypt_key configures `aeskey` to decrypt with the `bits`-bit
+// key, `key`. `key` must point to `bits`/8 bytes. It will return failure if
+// `bits` is an invalid AES key size.
+bcm_status BCM_aes_set_decrypt_key(const uint8_t *key, unsigned bits,
+                                   AES_KEY *aeskey);
+
+BSSL_NAMESPACE_END
+
 
 #endif  // OPENSSL_HEADER_CRYPTO_FIPSMODULE_BCM_INTERFACE_H