pq_crypto 0.2.0 → 0.3.1

data/ext/pqcrypto/pqcrypto_secure.c

@@ -6,18 +6,16 @@
 #include <unistd.h>
 #include <limits.h>
 
-#if defined(__linux__)
-#include <sys/random.h>
-#endif
-
 #ifndef HAVE_OPENSSL_EVP_H
 #error \
     "OpenSSL with EVP support is required for secure cryptographic operations. Install OpenSSL development packages."
 #endif
 
+#include <openssl/crypto.h>
 #include <openssl/evp.h>
 #include <openssl/rand.h>
-#include <openssl/kdf.h>
+#include <openssl/bio.h>
+#include <openssl/buffer.h>
 
 #if OPENSSL_VERSION_NUMBER < 0x30000000L
 #error "OpenSSL 3.0 or later is required for pq_crypto"
@@ -29,11 +27,11 @@
 
 #include "mlkem_api.h"
 #include "mldsa_api.h"
-#include "fips202.h"
-#include "packing.h"
-#include "params.h"
 
 void pq_secure_wipe(void *ptr, size_t len) {
+    if (ptr == NULL) {
+        return;
+    }
     volatile uint8_t *p = ptr;
     while (len--) {
         *p++ = 0;
@@ -64,33 +62,6 @@ static int pq_is_pem_whitespace(char c) {
     return c == '\n' || c == '\r' || c == ' ' || c == '\t';
 }
 
-static int pq_randombytes(uint8_t *buf, size_t len) {
-#ifdef HAVE_OPENSSL_RAND_H
-    if (len > INT_MAX) {
-        return PQ_ERROR_BUFFER;
-    }
-    if (RAND_bytes(buf, (int)len) == 1) {
-        return 0;
-    }
-
-#endif
-
-#if defined(__linux__)
-    ssize_t ret = getrandom(buf, len, 0);
-    return (ret == (ssize_t)len) ? 0 : PQ_ERROR_RANDOM;
-#elif defined(__APPLE__)
-    arc4random_buf(buf, len);
-    return 0;
-#else
-    FILE *f = fopen("/dev/urandom", "rb");
-    if (!f)
-        return PQ_ERROR_RANDOM;
-    size_t read = fread(buf, 1, len, f);
-    fclose(f);
-    return (read == len) ? 0 : PQ_ERROR_RANDOM;
-#endif
-}
-
 static int x25519_keypair(uint8_t *pk, uint8_t *sk) {
     EVP_PKEY_CTX *ctx = NULL;
     EVP_PKEY *pkey = NULL;
@@ -128,6 +99,32 @@ cleanup:
     return ret;
 }
 
+static int x25519_public_from_private(uint8_t *pk, const uint8_t *sk) {
+    EVP_PKEY *pkey = NULL;
+    size_t pklen = X25519_PUBLICKEYBYTES;
+    int ret = PQ_ERROR_KEYPAIR;
+
+    if (!pk || !sk) {
+        return PQ_ERROR_BUFFER;
+    }
+
+    pkey = EVP_PKEY_new_raw_private_key(EVP_PKEY_X25519, NULL, sk, X25519_SECRETKEYBYTES);
+    if (!pkey)
+        goto cleanup;
+
+    if (EVP_PKEY_get_raw_public_key(pkey, pk, &pklen) <= 0)
+        goto cleanup;
+    if (pklen != X25519_PUBLICKEYBYTES)
+        goto cleanup;
+
+    ret = PQ_SUCCESS;
+
+cleanup:
+    if (pkey)
+        EVP_PKEY_free(pkey);
+    return ret;
+}
+
 static int x25519_shared_secret(uint8_t *shared, const uint8_t *their_pk, const uint8_t *my_sk) {
     EVP_PKEY_CTX *ctx = NULL;
     EVP_PKEY *pkey = NULL;
@@ -171,201 +168,116 @@ cleanup:
     return ret;
 }
 
-static int x25519_public_from_secret(uint8_t *pk, const uint8_t *sk) {
-    EVP_PKEY *pkey = NULL;
-    size_t pklen = X25519_PUBLICKEYBYTES;
-    int ret = PQ_ERROR_KEYPAIR;
+static const uint8_t XWING_LABEL[6] = {0x5c, 0x2e, 0x2f, 0x2f, 0x5e, 0x5c};
 
-    pkey = EVP_PKEY_new_raw_private_key(EVP_PKEY_X25519, NULL, sk, X25519_SECRETKEYBYTES);
-    if (!pkey) {
-        return ret;
-    }
+static int xwing_combiner(uint8_t shared_secret[HYBRID_SHAREDSECRETBYTES],
+                          const uint8_t ss_M[MLKEM_SHAREDSECRETBYTES],
+                          const uint8_t ss_X[X25519_SHAREDSECRETBYTES],
+                          const uint8_t ct_X[X25519_PUBLICKEYBYTES],
+                          const uint8_t pk_X[X25519_PUBLICKEYBYTES]) {
+    EVP_MD_CTX *ctx = EVP_MD_CTX_new();
+    unsigned int out_len = 0;
+    int ret = PQ_ERROR_OPENSSL;
 
-    if (EVP_PKEY_get_raw_public_key(pkey, pk, &pklen) <= 0 || pklen != X25519_PUBLICKEYBYTES) {
-        EVP_PKEY_free(pkey);
-        return ret;
+    if (!ctx) {
+        return PQ_ERROR_OPENSSL;
     }
 
-    EVP_PKEY_free(pkey);
-    return PQ_SUCCESS;
-}
+    if (EVP_DigestInit_ex(ctx, EVP_sha3_256(), NULL) != 1)
+        goto cleanup;
+    if (EVP_DigestUpdate(ctx, ss_M, MLKEM_SHAREDSECRETBYTES) != 1)
+        goto cleanup;
+    if (EVP_DigestUpdate(ctx, ss_X, X25519_SHAREDSECRETBYTES) != 1)
+        goto cleanup;
+    if (EVP_DigestUpdate(ctx, ct_X, X25519_PUBLICKEYBYTES) != 1)
+        goto cleanup;
+    if (EVP_DigestUpdate(ctx, pk_X, X25519_PUBLICKEYBYTES) != 1)
+        goto cleanup;
+    if (EVP_DigestUpdate(ctx, XWING_LABEL, sizeof(XWING_LABEL)) != 1)
+        goto cleanup;
+    if (EVP_DigestFinal_ex(ctx, shared_secret, &out_len) != 1)
+        goto cleanup;
+    if (out_len != HYBRID_SHAREDSECRETBYTES)
+        goto cleanup;
 
-static int size_t_to_int_checked(size_t value, int *out) {
-    if (value > INT_MAX) {
-        return PQ_ERROR_BUFFER;
-    }
+    ret = PQ_SUCCESS;
 
-    *out = (int)value;
-    return PQ_SUCCESS;
+cleanup:
+    EVP_MD_CTX_free(ctx);
+    return ret;
 }
 
-static int secure_hkdf(uint8_t *output, size_t output_len, const uint8_t *ikm, size_t ikm_len,
-                       const uint8_t *salt, size_t salt_len, const uint8_t *info, size_t info_len) {
-    int ikm_len_i = 0;
-    int salt_len_i = 0;
-    int info_len_i = 0;
+static int xwing_expand_secret_key(hybrid_expanded_secret_key_t *expanded_key,
+                                   const uint8_t seed[HYBRID_SECRETKEYBYTES]) {
+    EVP_MD_CTX *ctx = NULL;
+    uint8_t expanded[XWING_EXPANDEDBYTES];
+    int ret = PQ_ERROR_OPENSSL;
 
-    if (size_t_to_int_checked(ikm_len, &ikm_len_i) != PQ_SUCCESS)
-        return PQ_ERROR_BUFFER;
-    if (size_t_to_int_checked(salt_len, &salt_len_i) != PQ_SUCCESS)
+    if (!expanded_key || !seed) {
         return PQ_ERROR_BUFFER;
-    if (size_t_to_int_checked(info_len, &info_len_i) != PQ_SUCCESS)
-        return PQ_ERROR_BUFFER;
-
-    EVP_PKEY_CTX *pctx = EVP_PKEY_CTX_new_id(EVP_PKEY_HKDF, NULL);
-    if (!pctx)
-        return PQ_ERROR_OPENSSL;
-
-    if (EVP_PKEY_derive_init(pctx) <= 0) {
-        EVP_PKEY_CTX_free(pctx);
-        return PQ_ERROR_OPENSSL;
     }
 
-    if (EVP_PKEY_CTX_set_hkdf_md(pctx, EVP_sha256()) <= 0) {
-        EVP_PKEY_CTX_free(pctx);
-        return PQ_ERROR_OPENSSL;
-    }
+    memset(expanded_key, 0, sizeof(*expanded_key));
+    memset(expanded, 0, sizeof(expanded));
 
-    if (EVP_PKEY_CTX_set1_hkdf_key(pctx, ikm, ikm_len_i) <= 0) {
-        EVP_PKEY_CTX_free(pctx);
-        return PQ_ERROR_OPENSSL;
-    }
+    ctx = EVP_MD_CTX_new();
+    if (!ctx)
+        goto cleanup;
 
-    if (salt && salt_len > 0) {
-        if (EVP_PKEY_CTX_set1_hkdf_salt(pctx, salt, salt_len_i) <= 0) {
-            EVP_PKEY_CTX_free(pctx);
-            return PQ_ERROR_OPENSSL;
-        }
-    }
+    if (EVP_DigestInit_ex(ctx, EVP_shake256(), NULL) != 1)
+        goto cleanup;
+    if (EVP_DigestUpdate(ctx, seed, HYBRID_SECRETKEYBYTES) != 1)
+        goto cleanup;
+    if (EVP_DigestFinalXOF(ctx, expanded, sizeof(expanded)) != 1)
+        goto cleanup;
 
-    if (info && info_len > 0) {
-        if (EVP_PKEY_CTX_add1_hkdf_info(pctx, info, info_len_i) <= 0) {
-            EVP_PKEY_CTX_free(pctx);
-            return PQ_ERROR_OPENSSL;
-        }
+    ret = PQCLEAN_MLKEM768_CLEAN_crypto_kem_keypair_derand(expanded_key->mlkem_pk,
+                                                           expanded_key->mlkem_sk, expanded);
+    if (ret != 0) {
+        ret = PQ_ERROR_KEYPAIR;
+        goto cleanup;
     }
 
-    size_t outlen = output_len;
-    if (EVP_PKEY_derive(pctx, output, &outlen) <= 0) {
-        EVP_PKEY_CTX_free(pctx);
-        return PQ_ERROR_OPENSSL;
+    memcpy(expanded_key->x25519_sk, expanded + 64, X25519_SECRETKEYBYTES);
+    ret = x25519_public_from_private(expanded_key->x25519_pk, expanded_key->x25519_sk);
+    if (ret != PQ_SUCCESS) {
+        goto cleanup;
     }
 
-    EVP_PKEY_CTX_free(pctx);
-    return (outlen == output_len) ? 0 : PQ_ERROR_KDF;
-}
-
-static int secure_sha256(uint8_t *output, const uint8_t *input, size_t input_len) {
-    EVP_MD_CTX *ctx = EVP_MD_CTX_new();
-    unsigned int out_len = 0;
-
-    if (!ctx) {
-        return PQ_ERROR_OPENSSL;
-    }
+    ret = PQ_SUCCESS;
 
-    if (EVP_DigestInit_ex(ctx, EVP_sha256(), NULL) != 1 ||
-        EVP_DigestUpdate(ctx, input, input_len) != 1 ||
-        EVP_DigestFinal_ex(ctx, output, &out_len) != 1) {
+cleanup:
+    if (ctx)
         EVP_MD_CTX_free(ctx);
-        return PQ_ERROR_OPENSSL;
-    }
-
-    EVP_MD_CTX_free(ctx);
-    return out_len == 32 ? PQ_SUCCESS : PQ_ERROR_OPENSSL;
-}
-
-static int hybrid_combiner(uint8_t *shared_secret, const uint8_t *mlkem_ss,
-                           const uint8_t *x25519_ss, const uint8_t *recipient_x25519_pk,
-                           const hybrid_ciphertext_t *ct) {
-    static const uint8_t label[] = "pqcrypto/v1/hybrid-kem";
-    uint8_t ikm[MLKEM_SHAREDSECRETBYTES + X25519_SHAREDSECRETBYTES];
-    uint8_t salt[32];
-    int ret = PQ_SUCCESS;
-    size_t transcript_len = sizeof(label) - 1 + X25519_PUBLICKEYBYTES + HYBRID_CIPHERTEXTBYTES;
-    uint8_t *transcript = malloc(transcript_len);
-
-    if (!transcript) {
-        return PQ_ERROR_NOMEM;
-    }
-
-    memcpy(ikm, mlkem_ss, MLKEM_SHAREDSECRETBYTES);
-    memcpy(ikm + MLKEM_SHAREDSECRETBYTES, x25519_ss, X25519_SHAREDSECRETBYTES);
-
-    memcpy(transcript, label, sizeof(label) - 1);
-    memcpy(transcript + sizeof(label) - 1, recipient_x25519_pk, X25519_PUBLICKEYBYTES);
-    memcpy(transcript + sizeof(label) - 1 + X25519_PUBLICKEYBYTES, ct, HYBRID_CIPHERTEXTBYTES);
-
-    ret = secure_sha256(salt, transcript, transcript_len);
-    if (ret == PQ_SUCCESS) {
-        ret = secure_hkdf(shared_secret, HYBRID_SHAREDSECRETBYTES, ikm, sizeof(ikm), salt,
-                          sizeof(salt), transcript, transcript_len);
+    pq_secure_wipe(expanded, sizeof(expanded));
+    if (ret != PQ_SUCCESS && expanded_key) {
+        pq_secure_wipe(expanded_key, sizeof(*expanded_key));
     }
-
-    pq_secure_wipe(ikm, sizeof(ikm));
-    pq_secure_wipe(salt, sizeof(salt));
-    pq_secure_wipe(transcript, transcript_len);
-    free(transcript);
     return ret;
 }
 
-static int mlkem_keypair(uint8_t *pk, uint8_t *sk) {
-    return PQCLEAN_MLKEM768_CLEAN_crypto_kem_keypair(pk, sk);
-}
-
-static int mlkem_encapsulate(uint8_t *ct, uint8_t *ss, const uint8_t *pk) {
-    return PQCLEAN_MLKEM768_CLEAN_crypto_kem_enc(ct, ss, pk);
-}
-
-static int mlkem_decapsulate(uint8_t *ss, const uint8_t *ct, const uint8_t *sk) {
-    return PQCLEAN_MLKEM768_CLEAN_crypto_kem_dec(ss, ct, sk);
-}
-
-static int mldsa_keypair(uint8_t *pk, uint8_t *sk) {
-    return PQCLEAN_MLDSA65_CLEAN_crypto_sign_keypair(pk, sk);
+int pq_mlkem_keypair(uint8_t *pk, uint8_t *sk) {
+    return PQCLEAN_MLKEM768_CLEAN_crypto_kem_keypair(pk, sk) == 0 ? PQ_SUCCESS : PQ_ERROR_KEYPAIR;
 }
 
-static int mldsa_sign(uint8_t *sig, size_t *siglen, const uint8_t *msg, size_t msglen,
-                      const uint8_t *sk) {
-    return PQCLEAN_MLDSA65_CLEAN_crypto_sign_signature(sig, siglen, msg, msglen, sk);
+int pq_mlkem_encapsulate(uint8_t *ct, uint8_t *ss, const uint8_t *pk) {
+    return PQCLEAN_MLKEM768_CLEAN_crypto_kem_enc(ct, ss, pk) == 0 ? PQ_SUCCESS
+                                                                  : PQ_ERROR_ENCAPSULATE;
 }
 
-static int mldsa_verify(const uint8_t *sig, size_t siglen, const uint8_t *msg, size_t msglen,
-                        const uint8_t *pk) {
-    return PQCLEAN_MLDSA65_CLEAN_crypto_sign_verify(sig, siglen, msg, msglen, pk);
+int pq_mlkem_decapsulate(uint8_t *ss, const uint8_t *ct, const uint8_t *sk) {
+    return PQCLEAN_MLKEM768_CLEAN_crypto_kem_dec(ss, ct, sk) == 0 ? PQ_SUCCESS
+                                                                  : PQ_ERROR_DECAPSULATE;
 }
 
 int pq_testing_mlkem_keypair_from_seed(uint8_t *public_key, uint8_t *secret_key,
                                        const uint8_t *seed, size_t seed_len) {
-    uint8_t expanded_seed[64];
-    int ret;
-
-    if (!public_key || !secret_key || !seed) {
+    if (!public_key || !secret_key || !seed || seed_len != 64) {
         return PQ_ERROR_BUFFER;
     }
-
-    if (seed_len == 64) {
-        return PQCLEAN_MLKEM768_CLEAN_crypto_kem_keypair_derand(public_key, secret_key, seed) == 0
-                   ? PQ_SUCCESS
-                   : PQ_ERROR_KEYPAIR;
-    }
-
-    if (seed_len != 32) {
-        return PQ_ERROR_BUFFER;
-    }
-
-    ret = secure_hkdf(expanded_seed, sizeof(expanded_seed), seed, seed_len, NULL, 0,
-                      (const uint8_t *)"pqcrypto-test-mlkem-keypair", 26);
-    if (ret != PQ_SUCCESS) {
-        pq_secure_wipe(expanded_seed, sizeof(expanded_seed));
-        return ret;
-    }
-
-    ret =
-        PQCLEAN_MLKEM768_CLEAN_crypto_kem_keypair_derand(public_key, secret_key, expanded_seed) == 0
-            ? PQ_SUCCESS
-            : PQ_ERROR_KEYPAIR;
-    pq_secure_wipe(expanded_seed, sizeof(expanded_seed));
-    return ret;
+    return PQCLEAN_MLKEM768_CLEAN_crypto_kem_keypair_derand(public_key, secret_key, seed) == 0
+               ? PQ_SUCCESS
+               : PQ_ERROR_KEYPAIR;
 }
 
 int pq_testing_mlkem_encapsulate_from_seed(uint8_t *ciphertext, uint8_t *shared_secret,
@@ -374,258 +286,148 @@ int pq_testing_mlkem_encapsulate_from_seed(uint8_t *ciphertext, uint8_t *shared_
     if (!ciphertext || !shared_secret || !public_key || !seed || seed_len != 32) {
         return PQ_ERROR_BUFFER;
     }
-
     return PQCLEAN_MLKEM768_CLEAN_crypto_kem_enc_derand(ciphertext, shared_secret, public_key,
                                                         seed) == 0
                ? PQ_SUCCESS
                : PQ_ERROR_ENCAPSULATE;
 }
 
-static int pq_testing_mldsa_keypair_from_seed_impl(uint8_t *public_key, uint8_t *secret_key,
-                                                   const uint8_t seed[SEEDBYTES]) {
-    uint8_t seedbuf[2 * SEEDBYTES + CRHBYTES];
-    uint8_t tr[TRBYTES];
-    const uint8_t *rho, *rhoprime, *key;
-    polyvecl mat[K];
-    polyvecl s1, s1hat;
-    polyveck s2, t1, t0;
-
-    memcpy(seedbuf, seed, SEEDBYTES);
-    seedbuf[SEEDBYTES + 0] = K;
-    seedbuf[SEEDBYTES + 1] = L;
-    shake256(seedbuf, 2 * SEEDBYTES + CRHBYTES, seedbuf, SEEDBYTES + 2);
-    rho = seedbuf;
-    rhoprime = rho + SEEDBYTES;
-    key = rhoprime + CRHBYTES;
-
-    PQCLEAN_MLDSA65_CLEAN_polyvec_matrix_expand(mat, rho);
-    PQCLEAN_MLDSA65_CLEAN_polyvecl_uniform_eta(&s1, rhoprime, 0);
-    PQCLEAN_MLDSA65_CLEAN_polyveck_uniform_eta(&s2, rhoprime, L);
-
-    s1hat = s1;
-    PQCLEAN_MLDSA65_CLEAN_polyvecl_ntt(&s1hat);
-    PQCLEAN_MLDSA65_CLEAN_polyvec_matrix_pointwise_montgomery(&t1, mat, &s1hat);
-    PQCLEAN_MLDSA65_CLEAN_polyveck_reduce(&t1);
-    PQCLEAN_MLDSA65_CLEAN_polyveck_invntt_tomont(&t1);
-
-    PQCLEAN_MLDSA65_CLEAN_polyveck_add(&t1, &t1, &s2);
-    PQCLEAN_MLDSA65_CLEAN_polyveck_caddq(&t1);
-    PQCLEAN_MLDSA65_CLEAN_polyveck_power2round(&t1, &t0, &t1);
-    PQCLEAN_MLDSA65_CLEAN_pack_pk(public_key, rho, &t1);
-
-    shake256(tr, TRBYTES, public_key, PQCLEAN_MLDSA65_CLEAN_CRYPTO_PUBLICKEYBYTES);
-    PQCLEAN_MLDSA65_CLEAN_pack_sk(secret_key, rho, tr, key, &t0, &s1, &s2);
-
-    pq_secure_wipe(seedbuf, sizeof(seedbuf));
-    pq_secure_wipe(tr, sizeof(tr));
-    pq_secure_wipe(&s1, sizeof(s1));
-    pq_secure_wipe(&s1hat, sizeof(s1hat));
-    pq_secure_wipe(&s2, sizeof(s2));
-    pq_secure_wipe(&t1, sizeof(t1));
-    pq_secure_wipe(&t0, sizeof(t0));
-    pq_secure_wipe(mat, sizeof(mat));
-    return PQ_SUCCESS;
+int pq_sign_keypair(uint8_t *public_key, uint8_t *secret_key) {
+    return PQCLEAN_MLDSA65_CLEAN_crypto_sign_keypair(public_key, secret_key) == 0
+               ? PQ_SUCCESS
+               : PQ_ERROR_KEYPAIR;
 }
 
-static int pq_testing_mldsa_sign_from_seed_impl(uint8_t *signature, size_t *signature_len,
-                                                const uint8_t *message, size_t message_len,
-                                                const uint8_t *secret_key,
-                                                const uint8_t seed[RNDBYTES]) {
-    unsigned int n;
-    uint8_t seedbuf[2 * SEEDBYTES + TRBYTES + RNDBYTES + 2 * CRHBYTES];
-    uint8_t *rho, *tr, *key, *mu, *rhoprime, *rnd;
-    uint16_t nonce = 0;
-    polyvecl mat[K], s1, y, z;
-    polyveck t0, s2, w1, w0, h;
-    poly cp;
-    shake256incctx state;
-
-    rho = seedbuf;
-    tr = rho + SEEDBYTES;
-    key = tr + TRBYTES;
-    rnd = key + SEEDBYTES;
-    mu = rnd + RNDBYTES;
-    rhoprime = mu + CRHBYTES;
-    PQCLEAN_MLDSA65_CLEAN_unpack_sk(rho, tr, key, &t0, &s1, &s2, secret_key);
-
-    mu[0] = 0;
-    mu[1] = 0;
-    shake256_inc_init(&state);
-    shake256_inc_absorb(&state, tr, TRBYTES);
-    shake256_inc_absorb(&state, mu, 2);
-    shake256_inc_absorb(&state, message, message_len);
-    shake256_inc_finalize(&state);
-    shake256_inc_squeeze(mu, CRHBYTES, &state);
-    shake256_inc_ctx_release(&state);
-
-    memcpy(rnd, seed, RNDBYTES);
-    shake256(rhoprime, CRHBYTES, key, SEEDBYTES + RNDBYTES + CRHBYTES);
-
-    PQCLEAN_MLDSA65_CLEAN_polyvec_matrix_expand(mat, rho);
-    PQCLEAN_MLDSA65_CLEAN_polyvecl_ntt(&s1);
-    PQCLEAN_MLDSA65_CLEAN_polyveck_ntt(&s2);
-    PQCLEAN_MLDSA65_CLEAN_polyveck_ntt(&t0);
-
-rej:
-    PQCLEAN_MLDSA65_CLEAN_polyvecl_uniform_gamma1(&y, rhoprime, nonce++);
-
-    z = y;
-    PQCLEAN_MLDSA65_CLEAN_polyvecl_ntt(&z);
-    PQCLEAN_MLDSA65_CLEAN_polyvec_matrix_pointwise_montgomery(&w1, mat, &z);
-    PQCLEAN_MLDSA65_CLEAN_polyveck_reduce(&w1);
-    PQCLEAN_MLDSA65_CLEAN_polyveck_invntt_tomont(&w1);
-
-    PQCLEAN_MLDSA65_CLEAN_polyveck_caddq(&w1);
-    PQCLEAN_MLDSA65_CLEAN_polyveck_decompose(&w1, &w0, &w1);
-    PQCLEAN_MLDSA65_CLEAN_polyveck_pack_w1(signature, &w1);
-
-    shake256_inc_init(&state);
-    shake256_inc_absorb(&state, mu, CRHBYTES);
-    shake256_inc_absorb(&state, signature, K * POLYW1_PACKEDBYTES);
-    shake256_inc_finalize(&state);
-    shake256_inc_squeeze(signature, CTILDEBYTES, &state);
-    shake256_inc_ctx_release(&state);
-    PQCLEAN_MLDSA65_CLEAN_poly_challenge(&cp, signature);
-    PQCLEAN_MLDSA65_CLEAN_poly_ntt(&cp);
-
-    PQCLEAN_MLDSA65_CLEAN_polyvecl_pointwise_poly_montgomery(&z, &cp, &s1);
-    PQCLEAN_MLDSA65_CLEAN_polyvecl_invntt_tomont(&z);
-    PQCLEAN_MLDSA65_CLEAN_polyvecl_add(&z, &z, &y);
-    PQCLEAN_MLDSA65_CLEAN_polyvecl_reduce(&z);
-    if (PQCLEAN_MLDSA65_CLEAN_polyvecl_chknorm(&z, GAMMA1 - BETA)) {
-        goto rej;
-    }
-
-    PQCLEAN_MLDSA65_CLEAN_polyveck_pointwise_poly_montgomery(&h, &cp, &s2);
-    PQCLEAN_MLDSA65_CLEAN_polyveck_invntt_tomont(&h);
-    PQCLEAN_MLDSA65_CLEAN_polyveck_sub(&w0, &w0, &h);
-    PQCLEAN_MLDSA65_CLEAN_polyveck_reduce(&w0);
-    if (PQCLEAN_MLDSA65_CLEAN_polyveck_chknorm(&w0, GAMMA2 - BETA)) {
-        goto rej;
-    }
-
-    PQCLEAN_MLDSA65_CLEAN_polyveck_pointwise_poly_montgomery(&h, &cp, &t0);
-    PQCLEAN_MLDSA65_CLEAN_polyveck_invntt_tomont(&h);
-    PQCLEAN_MLDSA65_CLEAN_polyveck_reduce(&h);
-    if (PQCLEAN_MLDSA65_CLEAN_polyveck_chknorm(&h, GAMMA2)) {
-        goto rej;
-    }
-
-    PQCLEAN_MLDSA65_CLEAN_polyveck_add(&w0, &w0, &h);
-    n = PQCLEAN_MLDSA65_CLEAN_polyveck_make_hint(&h, &w0, &w1);
-    if (n > OMEGA) {
-        goto rej;
-    }
+int pq_sign(uint8_t *signature, size_t *signature_len, const uint8_t *message, size_t message_len,
+            const uint8_t *secret_key) {
+    return PQCLEAN_MLDSA65_CLEAN_crypto_sign_signature(signature, signature_len, message,
+                                                       message_len, secret_key) == 0
+               ? PQ_SUCCESS
+               : PQ_ERROR_SIGN;
+}
 
-    PQCLEAN_MLDSA65_CLEAN_pack_sig(signature, signature, &z, &h);
-    *signature_len = PQCLEAN_MLDSA65_CLEAN_CRYPTO_BYTES;
-
-    pq_secure_wipe(seedbuf, sizeof(seedbuf));
-    pq_secure_wipe(&s1, sizeof(s1));
-    pq_secure_wipe(&y, sizeof(y));
-    pq_secure_wipe(&z, sizeof(z));
-    pq_secure_wipe(&t0, sizeof(t0));
-    pq_secure_wipe(&s2, sizeof(s2));
-    pq_secure_wipe(&w1, sizeof(w1));
-    pq_secure_wipe(&w0, sizeof(w0));
-    pq_secure_wipe(&h, sizeof(h));
-    pq_secure_wipe(&cp, sizeof(cp));
-    pq_secure_wipe(mat, sizeof(mat));
-    return PQ_SUCCESS;
+int pq_verify(const uint8_t *signature, size_t signature_len, const uint8_t *message,
+              size_t message_len, const uint8_t *public_key) {
+    return PQCLEAN_MLDSA65_CLEAN_crypto_sign_verify(signature, signature_len, message, message_len,
+                                                    public_key) == 0
+               ? PQ_SUCCESS
+               : PQ_ERROR_VERIFY;
 }
 
 int pq_testing_mldsa_keypair_from_seed(uint8_t *public_key, uint8_t *secret_key,
                                        const uint8_t *seed, size_t seed_len) {
-    if (!public_key || !secret_key || !seed || seed_len != SEEDBYTES) {
+    int rc;
+    if (!public_key || !secret_key || !seed) {
         return PQ_ERROR_BUFFER;
     }
 
-    return pq_testing_mldsa_keypair_from_seed_impl(public_key, secret_key, seed);
+    if (seed_len != 32) {
+        return PQ_ERROR_BUFFER;
+    }
+
+    pq_testing_set_seed(seed, seed_len);
+    rc = PQCLEAN_MLDSA65_CLEAN_crypto_sign_keypair(public_key, secret_key);
+    pq_testing_clear_seed();
+    return rc == 0 ? PQ_SUCCESS : PQ_ERROR_KEYPAIR;
 }
 
 int pq_testing_mldsa_sign_from_seed(uint8_t *signature, size_t *signature_len,
                                     const uint8_t *message, size_t message_len,
                                     const uint8_t *secret_key, const uint8_t *seed,
                                     size_t seed_len) {
-    if (!signature || !signature_len || !message || !secret_key || !seed || seed_len != RNDBYTES) {
+    int rc;
+    if (!signature || !signature_len || !secret_key || !seed) {
         return PQ_ERROR_BUFFER;
     }
 
-    return pq_testing_mldsa_sign_from_seed_impl(signature, signature_len, message, message_len,
-                                                secret_key, seed);
-}
-
-int pq_mlkem_keypair(uint8_t *public_key, uint8_t *secret_key) {
-    return mlkem_keypair(public_key, secret_key) == 0 ? PQ_SUCCESS : PQ_ERROR_KEYPAIR;
-}
-
-int pq_mlkem_encapsulate(uint8_t *ciphertext, uint8_t *shared_secret, const uint8_t *public_key) {
-    return mlkem_encapsulate(ciphertext, shared_secret, public_key) == 0 ? PQ_SUCCESS
-                                                                         : PQ_ERROR_ENCAPSULATE;
-}
+    if (seed_len != 32) {
+        return PQ_ERROR_BUFFER;
+    }
 
-int pq_mlkem_decapsulate(uint8_t *shared_secret, const uint8_t *ciphertext,
-                         const uint8_t *secret_key) {
-    return mlkem_decapsulate(shared_secret, ciphertext, secret_key) == 0 ? PQ_SUCCESS
-                                                                         : PQ_ERROR_DECAPSULATE;
+    pq_testing_set_seed(seed, seed_len);
+    rc = PQCLEAN_MLDSA65_CLEAN_crypto_sign_signature(signature, signature_len, message, message_len,
+                                                     secret_key);
+    pq_testing_clear_seed();
+    return rc == 0 ? PQ_SUCCESS : PQ_ERROR_SIGN;
 }
 
 int pq_hybrid_kem_keypair(uint8_t *public_key, uint8_t *secret_key) {
-    hybrid_public_key_t *pk = (hybrid_public_key_t *)public_key;
-    hybrid_secret_key_t *sk = (hybrid_secret_key_t *)secret_key;
+    hybrid_public_key_t pk;
+    hybrid_expanded_secret_key_t expanded;
+    uint8_t seed[HYBRID_SECRETKEYBYTES];
+    int ret = PQ_SUCCESS;
 
-    memset(sk, 0, sizeof(*sk));
+    if (!public_key || !secret_key) {
+        return PQ_ERROR_BUFFER;
+    }
+
+    memset(&pk, 0, sizeof(pk));
+    memset(&expanded, 0, sizeof(expanded));
+    memset(seed, 0, sizeof(seed));
 
-    if (mlkem_keypair(pk->mlkem_pk, sk->mlkem_sk) != 0) {
-        pq_secure_wipe(sk, sizeof(*sk));
-        return PQ_ERROR_KEYPAIR;
+    if (RAND_bytes(seed, sizeof(seed)) != 1) {
+        ret = PQ_ERROR_RANDOM;
+        goto cleanup;
     }
 
-    if (x25519_keypair(pk->x25519_pk, sk->x25519_sk) != 0) {
-        pq_secure_wipe(sk, sizeof(*sk));
-        return PQ_ERROR_KEYPAIR;
+    ret = xwing_expand_secret_key(&expanded, seed);
+    if (ret != PQ_SUCCESS) {
+        goto cleanup;
     }
 
-    return PQ_SUCCESS;
+    memcpy(pk.mlkem_pk, expanded.mlkem_pk, MLKEM_PUBLICKEYBYTES);
+    memcpy(pk.x25519_pk, expanded.x25519_pk, X25519_PUBLICKEYBYTES);
+    memcpy(public_key, &pk, HYBRID_PUBLICKEYBYTES);
+    memcpy(secret_key, seed, HYBRID_SECRETKEYBYTES);
+
+cleanup:
+    pq_secure_wipe(seed, sizeof(seed));
+    pq_secure_wipe(&expanded, sizeof(expanded));
+    return ret;
 }
 
 int pq_hybrid_kem_encapsulate(uint8_t *ciphertext, uint8_t *shared_secret,
                               const uint8_t *public_key) {
-    const hybrid_public_key_t *pk = (const hybrid_public_key_t *)public_key;
-    hybrid_ciphertext_t *ct = (hybrid_ciphertext_t *)ciphertext;
-
+    hybrid_public_key_t pk;
+    hybrid_ciphertext_t ct;
     uint8_t mlkem_ss[MLKEM_SHAREDSECRETBYTES];
     uint8_t x25519_ss[X25519_SHAREDSECRETBYTES];
     uint8_t x25519_ephemeral_sk[X25519_SECRETKEYBYTES];
     int ret = PQ_SUCCESS;
 
+    if (!ciphertext || !shared_secret || !public_key) {
+        return PQ_ERROR_BUFFER;
+    }
+
+    memcpy(&pk, public_key, HYBRID_PUBLICKEYBYTES);
+    memset(&ct, 0, sizeof(ct));
     memset(mlkem_ss, 0, sizeof(mlkem_ss));
     memset(x25519_ss, 0, sizeof(x25519_ss));
     memset(x25519_ephemeral_sk, 0, sizeof(x25519_ephemeral_sk));
 
-    if (mlkem_encapsulate(ct->mlkem_ct, mlkem_ss, pk->mlkem_pk) != 0) {
+    if (PQCLEAN_MLKEM768_CLEAN_crypto_kem_enc(ct.mlkem_ct, mlkem_ss, pk.mlkem_pk) != 0) {
         ret = PQ_ERROR_ENCAPSULATE;
         goto cleanup;
     }
 
-    ret = x25519_keypair(ct->x25519_ephemeral, x25519_ephemeral_sk);
+    ret = x25519_keypair(ct.x25519_ephemeral, x25519_ephemeral_sk);
     if (ret != PQ_SUCCESS) {
         ret = PQ_ERROR_ENCAPSULATE;
         goto cleanup;
     }
 
-    ret = x25519_shared_secret(x25519_ss, pk->x25519_pk, x25519_ephemeral_sk);
+    ret = x25519_shared_secret(x25519_ss, pk.x25519_pk, x25519_ephemeral_sk);
     if (ret != PQ_SUCCESS) {
         ret = PQ_ERROR_ENCAPSULATE;
         goto cleanup;
     }
 
-    ret = hybrid_combiner(shared_secret, mlkem_ss, x25519_ss, pk->x25519_pk, ct);
+    ret = xwing_combiner(shared_secret, mlkem_ss, x25519_ss, ct.x25519_ephemeral, pk.x25519_pk);
     if (ret != PQ_SUCCESS) {
         goto cleanup;
     }
 
-    ret = PQ_SUCCESS;
+    memcpy(ciphertext, &ct, HYBRID_CIPHERTEXTBYTES);
 
 cleanup:
     pq_secure_wipe(mlkem_ss, sizeof(mlkem_ss));
@@ -636,63 +438,48 @@ cleanup:
 
 int pq_hybrid_kem_decapsulate(uint8_t *shared_secret, const uint8_t *ciphertext,
                               const uint8_t *secret_key) {
-    const hybrid_ciphertext_t *ct = (const hybrid_ciphertext_t *)ciphertext;
-    uint8_t recipient_x25519_pk[X25519_PUBLICKEYBYTES];
-    const hybrid_secret_key_t *sk = (const hybrid_secret_key_t *)secret_key;
-
+    hybrid_ciphertext_t ct;
+    hybrid_expanded_secret_key_t expanded;
     uint8_t mlkem_ss[MLKEM_SHAREDSECRETBYTES];
     uint8_t x25519_ss[X25519_SHAREDSECRETBYTES];
     int ret = PQ_SUCCESS;
 
-    memset(recipient_x25519_pk, 0, sizeof(recipient_x25519_pk));
+    if (!shared_secret || !ciphertext || !secret_key) {
+        return PQ_ERROR_BUFFER;
+    }
+
+    memcpy(&ct, ciphertext, HYBRID_CIPHERTEXTBYTES);
+    memset(&expanded, 0, sizeof(expanded));
     memset(mlkem_ss, 0, sizeof(mlkem_ss));
     memset(x25519_ss, 0, sizeof(x25519_ss));
 
-    ret = mlkem_decapsulate(mlkem_ss, ct->mlkem_ct, sk->mlkem_sk) == 0 ? PQ_SUCCESS
-                                                                       : PQ_ERROR_DECAPSULATE;
+    ret = xwing_expand_secret_key(&expanded, secret_key);
     if (ret != PQ_SUCCESS) {
+        ret = PQ_ERROR_DECAPSULATE;
         goto cleanup;
     }
 
-    ret = x25519_shared_secret(x25519_ss, ct->x25519_ephemeral, sk->x25519_sk);
-    if (ret != PQ_SUCCESS) {
+    if (PQCLEAN_MLKEM768_CLEAN_crypto_kem_dec(mlkem_ss, ct.mlkem_ct, expanded.mlkem_sk) != 0) {
         ret = PQ_ERROR_DECAPSULATE;
         goto cleanup;
     }
 
-    ret = x25519_public_from_secret(recipient_x25519_pk, sk->x25519_sk);
+    ret = x25519_shared_secret(x25519_ss, ct.x25519_ephemeral, expanded.x25519_sk);
     if (ret != PQ_SUCCESS) {
         ret = PQ_ERROR_DECAPSULATE;
         goto cleanup;
     }
 
-    ret = hybrid_combiner(shared_secret, mlkem_ss, x25519_ss, recipient_x25519_pk, ct);
+    ret =
+        xwing_combiner(shared_secret, mlkem_ss, x25519_ss, ct.x25519_ephemeral, expanded.x25519_pk);
 
 cleanup:
-    pq_secure_wipe(recipient_x25519_pk, sizeof(recipient_x25519_pk));
     pq_secure_wipe(mlkem_ss, sizeof(mlkem_ss));
     pq_secure_wipe(x25519_ss, sizeof(x25519_ss));
+    pq_secure_wipe(&expanded, sizeof(expanded));
     return ret;
 }
 
-int pq_sign_keypair(uint8_t *public_key, uint8_t *secret_key) {
-    return mldsa_keypair(public_key, secret_key) == 0 ? PQ_SUCCESS : PQ_ERROR_KEYPAIR;
-}
-
-int pq_sign(uint8_t *signature, size_t *signature_len, const uint8_t *message, size_t message_len,
-            const uint8_t *secret_key) {
-    return mldsa_sign(signature, signature_len, message, message_len, secret_key) == 0
-               ? PQ_SUCCESS
-               : PQ_ERROR_SIGN;
-}
-
-int pq_verify(const uint8_t *signature, size_t signature_len, const uint8_t *message,
-              size_t message_len, const uint8_t *public_key) {
-    return mldsa_verify(signature, signature_len, message, message_len, public_key) == 0
-               ? PQ_SUCCESS
-               : PQ_ERROR_VERIFY;
-}
-
 #define PQC_SERIALIZATION_MAGIC_0     'P'
 #define PQC_SERIALIZATION_MAGIC_1     'Q'
 #define PQC_SERIALIZATION_MAGIC_2     'C'
@@ -702,8 +489,8 @@ int pq_verify(const uint8_t *signature, size_t signature_len, const uint8_t *mes
 #define PQC_SERIALIZATION_TYPE_SECRET 0x02
 
 static const char PQC_OID_ML_KEM_768[] = "2.25.186599352125448088867056807454444238446";
-static const char PQC_OID_ML_KEM_768_X25519_HKDF_SHA256[] =
-    "2.25.260242945110721168101139140490528778800";
+
+static const char PQC_OID_ML_KEM_768_X25519_XWING[] = "1.3.6.1.4.1.62253.25722";
 static const char PQC_OID_ML_DSA_65[] = "2.25.305232938483772195555080795650659207792";
 static const char PQC_PUBLIC_KEY_PEM_LABEL[] = "PQC PUBLIC KEY CONTAINER";
 static const char PQC_PRIVATE_KEY_PEM_LABEL[] = "PQC PRIVATE KEY CONTAINER";
@@ -717,8 +504,8 @@ typedef struct {
 
 static const pq_serialization_algorithm_t PQC_SERIALIZATION_ALGORITHMS[] = {
     {"ml_kem_768", PQC_OID_ML_KEM_768, PQ_MLKEM_PUBLICKEYBYTES, PQ_MLKEM_SECRETKEYBYTES},
-    {"ml_kem_768_x25519_hkdf_sha256", PQC_OID_ML_KEM_768_X25519_HKDF_SHA256,
-     PQ_HYBRID_PUBLICKEYBYTES, PQ_HYBRID_SECRETKEYBYTES},
+    {"ml_kem_768_x25519_xwing", PQC_OID_ML_KEM_768_X25519_XWING, PQ_HYBRID_PUBLICKEYBYTES,
+     PQ_HYBRID_SECRETKEYBYTES},
     {"ml_dsa_65", PQC_OID_ML_DSA_65, MLDSA_PUBLICKEYBYTES, MLDSA_SECRETKEYBYTES},
 };
 
@@ -895,17 +682,17 @@ static int pq_decode_serialized_key(const uint8_t *input, size_t input_len, uint
 
 static int pq_der_to_pem(const char *label, const uint8_t *der, size_t der_len, char **output,
                          size_t *output_len) {
-    size_t encoded_len = 0;
-    size_t line_count = 0;
-    size_t body_len = 0;
-    size_t total_len = 0;
-    unsigned char *encoded = NULL;
-    char *pem = NULL;
+    BIO *bio_mem = NULL;
+    BIO *bio_b64 = NULL;
+    BIO *bio_chain = NULL;
+    BUF_MEM *bptr = NULL;
     char header[64];
     char footer[64];
-    char *cursor;
     int header_len, footer_len;
-    int ret;
+    int ret = PQ_ERROR_OPENSSL;
+    char *pem = NULL;
+    size_t total_len = 0;
+    size_t needed = 0;
 
     if (!label || !der || !output || !output_len)
         return PQ_ERROR_BUFFER;
@@ -918,55 +705,68 @@ static int pq_der_to_pem(const char *label, const uint8_t *der, size_t der_len,
     if (der_len > (size_t)INT_MAX)
         return PQ_ERROR_BUFFER;
 
-    ret = pq_size_mul((der_len + 2) / 3, 4, &encoded_len);
-    if (ret != PQ_SUCCESS)
-        return ret;
-    ret = pq_size_add(encoded_len, 63, &line_count);
-    if (ret != PQ_SUCCESS)
-        return ret;
-    line_count /= 64;
-    ret = pq_size_add(encoded_len, line_count, &body_len);
-    if (ret != PQ_SUCCESS)
-        return ret;
-    ret = pq_size_add((size_t)header_len, body_len, &total_len);
-    if (ret != PQ_SUCCESS)
-        return ret;
-    ret = pq_size_add(total_len, (size_t)footer_len, &total_len);
-    if (ret != PQ_SUCCESS)
-        return ret;
+    bio_b64 = BIO_new(BIO_f_base64());
+    bio_mem = BIO_new(BIO_s_mem());
+    if (!bio_b64 || !bio_mem) {
+        ret = PQ_ERROR_NOMEM;
+        goto cleanup;
+    }
 
-    encoded = malloc(encoded_len + 1);
-    pem = malloc(total_len + 1);
-    if (!encoded || !pem) {
-        free(encoded);
-        free(pem);
-        return PQ_ERROR_NOMEM;
+    bio_chain = BIO_push(bio_b64, bio_mem);
+
+    if (BIO_write(bio_chain, der, (int)der_len) != (int)der_len)
+        goto cleanup;
+    if (BIO_flush(bio_chain) != 1)
+        goto cleanup;
+    BIO_get_mem_ptr(bio_chain, &bptr);
+    if (!bptr || !bptr->data)
+        goto cleanup;
+
+    {
+        size_t body_len = bptr->length;
+        needed = (size_t)header_len + 1 + body_len;
+        if (body_len == 0 || bptr->data[body_len - 1] != '\n')
+            needed += 1;
+        needed += (size_t)footer_len + 1;
+
+        pem = malloc(needed);
+        if (!pem) {
+            ret = PQ_ERROR_NOMEM;
+            goto cleanup;
+        }
+        char *cur = pem;
+        memcpy(cur, header, (size_t)header_len);
+        cur += header_len;
+        *cur++ = '\n';
+        memcpy(cur, bptr->data, body_len);
+        cur += body_len;
+        if (body_len == 0 || bptr->data[body_len - 1] != '\n')
+            *cur++ = '\n';
+        memcpy(cur, footer, (size_t)footer_len);
+        cur += footer_len;
+        *cur = '\0';
+        total_len = (size_t)(cur - pem);
     }
-    if (EVP_EncodeBlock(encoded, der, (int)der_len) != (int)encoded_len) {
-        free(encoded);
-        pq_secure_wipe(pem, total_len + 1);
+
+    *output = pem;
+    *output_len = total_len;
+    pem = NULL;
+    ret = PQ_SUCCESS;
+
+cleanup:
+    if (bio_chain) {
+        BIO_free_all(bio_chain);
+    } else {
+        if (bio_b64)
+            BIO_free(bio_b64);
+        if (bio_mem)
+            BIO_free(bio_mem);
+    }
+    if (pem) {
+        pq_secure_wipe(pem, needed);
         free(pem);
-        return PQ_ERROR_OPENSSL;
-    }
-    cursor = pem;
-    memcpy(cursor, header, (size_t)header_len);
-    cursor += header_len;
-    for (size_t off = 0; off < encoded_len; off += 64) {
-        size_t chunk = encoded_len - off;
-        if (chunk > 64)
-            chunk = 64;
-        memcpy(cursor, encoded + off, chunk);
-        cursor += chunk;
-        *cursor++ = '\n';
     }
-    memcpy(cursor, footer, (size_t)footer_len);
-    cursor += footer_len;
-    *cursor = '\0';
-    *output = pem;
-    *output_len = (size_t)(cursor - pem);
-    pq_secure_wipe(encoded, encoded_len + 1);
-    free(encoded);
-    return PQ_SUCCESS;
+    return ret;
 }
 
 static int pq_pem_to_der(const char *label, const char *input, size_t input_len, uint8_t **der_out,
@@ -975,13 +775,13 @@ static int pq_pem_to_der(const char *label, const char *input, size_t input_len,
     int header_len, footer_len;
     const char *body_start, *footer_pos;
     const char *tail;
-    char *encoded = NULL;
     uint8_t *der = NULL;
-    size_t encoded_len = 0;
-    size_t der_capacity = 0;
-    int decoded_len;
+    size_t body_len = 0;
     int ret;
-    size_t pad = 0;
+    BIO *bio_b64 = NULL;
+    BIO *bio_mem = NULL;
+    BIO *bio_chain = NULL;
+    int decoded_len = 0;
 
     if (!label || !input || !der_out || !der_len_out)
         return PQ_ERROR_BUFFER;
@@ -1021,63 +821,57 @@ static int pq_pem_to_der(const char *label, const char *input, size_t input_len,
         tail++;
     }
 
-    encoded = malloc((size_t)(footer_pos - body_start) + 1);
-    if (!encoded)
-        return PQ_ERROR_NOMEM;
-    for (const char *p = body_start; p < footer_pos; ++p) {
-        if (pq_is_pem_whitespace(*p))
-            continue;
-        encoded[encoded_len++] = *p;
-    }
-    if (encoded_len == 0 || (encoded_len % 4) != 0) {
-        free(encoded);
+    body_len = (size_t)(footer_pos - body_start);
+    if (body_len > (size_t)INT_MAX)
         return PQ_ERROR_BUFFER;
-    }
-    encoded[encoded_len] = '\0';
 
-    ret = pq_size_mul(encoded_len / 4, 3, &der_capacity);
-    if (ret != PQ_SUCCESS) {
-        pq_secure_wipe(encoded, encoded_len + 1);
-        free(encoded);
-        return ret;
-    }
-    ret = pq_size_add(der_capacity, 1, &der_capacity);
-    if (ret != PQ_SUCCESS || der_capacity == 0) {
-        pq_secure_wipe(encoded, encoded_len + 1);
-        free(encoded);
-        return PQ_ERROR_BUFFER;
-    }
+    {
+        size_t der_cap = (body_len * 3) / 4 + 3;
+        der = malloc(der_cap ? der_cap : 1);
+        if (!der)
+            return PQ_ERROR_NOMEM;
 
-    der = malloc(der_capacity);
-    if (!der) {
-        pq_secure_wipe(encoded, encoded_len + 1);
-        free(encoded);
-        return PQ_ERROR_NOMEM;
-    }
-    decoded_len = EVP_DecodeBlock(der, (unsigned char *)encoded, (int)encoded_len);
-    if (decoded_len < 0) {
-        pq_secure_wipe(encoded, encoded_len + 1);
-        free(encoded);
-        pq_secure_wipe(der, der_capacity);
-        free(der);
-        return PQ_ERROR_BUFFER;
+        bio_mem = BIO_new_mem_buf(body_start, (int)body_len);
+        bio_b64 = BIO_new(BIO_f_base64());
+        if (!bio_mem || !bio_b64) {
+            ret = PQ_ERROR_NOMEM;
+            goto cleanup;
+        }
+        bio_chain = BIO_push(bio_b64, bio_mem);
+
+        decoded_len = BIO_read(bio_chain, der, (int)der_cap);
+        if (decoded_len <= 0) {
+            ret = PQ_ERROR_BUFFER;
+            goto cleanup;
+        }
+        {
+            unsigned char tail_byte;
+            int extra = BIO_read(bio_chain, &tail_byte, 1);
+            if (extra > 0) {
+                ret = PQ_ERROR_BUFFER;
+                goto cleanup;
+            }
+        }
+
+        *der_len_out = (size_t)decoded_len;
+        *der_out = der;
+        der = NULL;
+        ret = PQ_SUCCESS;
     }
-    if (encoded_len >= 1 && encoded[encoded_len - 1] == '=')
-        pad++;
-    if (encoded_len >= 2 && encoded[encoded_len - 2] == '=')
-        pad++;
-    if ((size_t)decoded_len < pad) {
-        pq_secure_wipe(encoded, encoded_len + 1);
-        free(encoded);
-        pq_secure_wipe(der, der_capacity);
+
+cleanup:
+    if (bio_chain) {
+        BIO_free_all(bio_chain);
+    } else {
+        if (bio_b64)
+            BIO_free(bio_b64);
+        if (bio_mem)
+            BIO_free(bio_mem);
+    }
+    if (der) {
         free(der);
-        return PQ_ERROR_BUFFER;
     }
-    *der_len_out = (size_t)decoded_len - pad;
-    *der_out = der;
-    pq_secure_wipe(encoded, encoded_len + 1);
-    free(encoded);
-    return PQ_SUCCESS;
+    return ret;
 }
 
 int pq_public_key_to_pqc_container_der(uint8_t **output, size_t *output_len,
@@ -1165,5 +959,5 @@ int pq_secret_key_from_pqc_container_pem(char **algorithm_out, uint8_t **key_out
 }
 
 const char *pq_version(void) {
-    return "0.2.0";
+    return "0.3.0";
 }