pq_crypto 0.6.4 → 0.6.6

data/ext/pqcrypto/pqcrypto_secure.c

@@ -322,27 +322,29 @@ PQ_DEFINE_MLDSA_SIGN_KEYPAIR(mldsa87_sign, pqcr_mldsa87)
 
 #undef PQ_DEFINE_MLDSA_SIGN_KEYPAIR
 
-#define PQ_DEFINE_MLDSA_SIGN(name, native)                                                      \
-    int pq_##name(uint8_t *signature, size_t *signature_len, const uint8_t *message,            \
-                  size_t message_len, const uint8_t *ctx, size_t ctx_len,                       \
-                  const uint8_t *secret_key) {                                                  \
-        if (!signature || !signature_len || !secret_key || (message_len > 0 && !message) ||     \
-            (ctx_len > 0 && !ctx) || ctx_len > 255) {                                           \
-            return PQ_ERROR_BUFFER;                                                             \
-        }                                                                                       \
-        return native##_signature(signature, signature_len, message, message_len, ctx, ctx_len, \
-                                  secret_key) == 0                                              \
-                   ? PQ_SUCCESS                                                                 \
-                   : PQ_ERROR_SIGN;                                                             \
-    }
-
-PQ_DEFINE_MLDSA_SIGN(sign, pqcr_mldsa65)
-PQ_DEFINE_MLDSA_SIGN(mldsa44_sign, pqcr_mldsa44)
-PQ_DEFINE_MLDSA_SIGN(mldsa87_sign, pqcr_mldsa87)
+#define PQ_DEFINE_MLDSA_SIGN(name, native, sig_bytes)                                             \
+    int pq_##name(uint8_t *signature, size_t *signature_len, const uint8_t *message,              \
+                  size_t message_len, const uint8_t *ctx, size_t ctx_len,                         \
+                  const uint8_t *secret_key) {                                                    \
+        if (!signature || !signature_len || !secret_key || (message_len > 0 && !message) ||       \
+            (ctx_len > 0 && !ctx) || ctx_len > 255) {                                             \
+            return PQ_ERROR_BUFFER;                                                               \
+        }                                                                                         \
+        if (native##_signature(signature, message, message_len, ctx, ctx_len, secret_key) != 0) { \
+            *signature_len = 0;                                                                   \
+            return PQ_ERROR_SIGN;                                                                 \
+        }                                                                                         \
+        *signature_len = (size_t)(sig_bytes);                                                     \
+        return PQ_SUCCESS;                                                                        \
+    }
+
+PQ_DEFINE_MLDSA_SIGN(sign, pqcr_mldsa65, MLDSA65_BYTES)
+PQ_DEFINE_MLDSA_SIGN(mldsa44_sign, pqcr_mldsa44, MLDSA44_BYTES)
+PQ_DEFINE_MLDSA_SIGN(mldsa87_sign, pqcr_mldsa87, MLDSA87_BYTES)
 
 #undef PQ_DEFINE_MLDSA_SIGN
 
-#define PQ_DEFINE_MLDSA_VERIFY(name, native)                                                       \
+#define PQ_DEFINE_MLDSA_VERIFY(name, native, sig_bytes)                                            \
     int pq_##name(const uint8_t *signature, size_t signature_len, const uint8_t *message,          \
                   size_t message_len, const uint8_t *ctx, size_t ctx_len,                          \
                   const uint8_t *public_key) {                                                     \
@@ -350,29 +352,32 @@ PQ_DEFINE_MLDSA_SIGN(mldsa87_sign, pqcr_mldsa87)
             ctx_len > 255) {                                                                       \
             return PQ_ERROR_BUFFER;                                                                \
         }                                                                                          \
-        return native##_verify(signature, signature_len, message, message_len, ctx, ctx_len,       \
-                               public_key) == 0                                                    \
+        if (signature_len != (size_t)(sig_bytes)) {                                                \
+            return PQ_ERROR_VERIFY;                                                                \
+        }                                                                                          \
+        return native##_verify(signature, message, message_len, ctx, ctx_len, public_key) == 0     \
                    ? PQ_SUCCESS                                                                    \
                    : PQ_ERROR_VERIFY;                                                              \
     }
 
-PQ_DEFINE_MLDSA_VERIFY(verify, pqcr_mldsa65)
-PQ_DEFINE_MLDSA_VERIFY(mldsa44_verify, pqcr_mldsa44)
-PQ_DEFINE_MLDSA_VERIFY(mldsa87_verify, pqcr_mldsa87)
+PQ_DEFINE_MLDSA_VERIFY(verify, pqcr_mldsa65, MLDSA65_BYTES)
+PQ_DEFINE_MLDSA_VERIFY(mldsa44_verify, pqcr_mldsa44, MLDSA44_BYTES)
+PQ_DEFINE_MLDSA_VERIFY(mldsa87_verify, pqcr_mldsa87, MLDSA87_BYTES)
 
 #undef PQ_DEFINE_MLDSA_VERIFY
 
 static int pq_testing_mldsa_sign_from_seed_with(
     uint8_t *signature, size_t *signature_len, const uint8_t *message, size_t message_len,
-    const uint8_t *secret_key, const uint8_t *seed, size_t seed_len,
-    int (*signature_internal)(uint8_t *, size_t *, const uint8_t *, size_t, const uint8_t *, size_t,
+    const uint8_t *secret_key, const uint8_t *seed, size_t seed_len, size_t expected_signature_len,
+    int (*signature_internal)(uint8_t *, const uint8_t *, size_t, const uint8_t *, size_t,
                               const uint8_t *, const uint8_t *, int),
     size_t (*prepare_prefix)(uint8_t *, const uint8_t *, size_t, const uint8_t *, size_t, int)) {
     uint8_t pre[MLDSA_DOMAIN_SEPARATION_MAX_BYTES];
     size_t pre_len;
 
     if (!signature || !signature_len || !secret_key || !seed || seed_len != MLDSA_RNDBYTES ||
-        !signature_internal || !prepare_prefix || (message_len > 0 && !message)) {
+        !signature_internal || !prepare_prefix || expected_signature_len == 0 ||
+        (message_len > 0 && !message)) {
         return PQ_ERROR_BUFFER;
     }
 
@@ -385,13 +390,18 @@ static int pq_testing_mldsa_sign_from_seed_with(
      */
     pre_len = prepare_prefix(pre, NULL, 0, NULL, 0, MLDSA_PREHASH_NONE);
     if (pre_len == 0) {
+        *signature_len = 0;
         return PQ_ERROR_SIGN;
     }
 
-    return signature_internal(signature, signature_len, message, message_len, pre, pre_len, seed,
-                              secret_key, 0) == 0
-               ? PQ_SUCCESS
-               : PQ_ERROR_SIGN;
+    if (signature_internal(signature, message, message_len, pre, pre_len, seed, secret_key, 0) !=
+        0) {
+        *signature_len = 0;
+        return PQ_ERROR_SIGN;
+    }
+
+    *signature_len = expected_signature_len;
+    return PQ_SUCCESS;
 }
 
 int pq_mldsa44_keypair_from_seed(uint8_t *public_key, uint8_t *secret_key, const uint8_t *seed32) {
@@ -447,7 +457,7 @@ int pq_testing_mldsa_sign_from_seed(uint8_t *signature, size_t *signature_len,
                                     const uint8_t *secret_key, const uint8_t *seed,
                                     size_t seed_len) {
     return pq_testing_mldsa_sign_from_seed_with(
-        signature, signature_len, message, message_len, secret_key, seed, seed_len,
+        signature, signature_len, message, message_len, secret_key, seed, seed_len, MLDSA65_BYTES,
         pqcr_mldsa65_signature_internal, pqcr_mldsa65_prepare_domain_separation_prefix);
 }
 
@@ -456,7 +466,7 @@ int pq_testing_mldsa44_sign_from_seed(uint8_t *signature, size_t *signature_len,
                                       const uint8_t *secret_key, const uint8_t *seed,
                                       size_t seed_len) {
     return pq_testing_mldsa_sign_from_seed_with(
-        signature, signature_len, message, message_len, secret_key, seed, seed_len,
+        signature, signature_len, message, message_len, secret_key, seed, seed_len, MLDSA44_BYTES,
         pqcr_mldsa44_signature_internal, pqcr_mldsa44_prepare_domain_separation_prefix);
 }
 
@@ -465,7 +475,7 @@ int pq_testing_mldsa87_sign_from_seed(uint8_t *signature, size_t *signature_len,
                                       const uint8_t *secret_key, const uint8_t *seed,
                                       size_t seed_len) {
     return pq_testing_mldsa_sign_from_seed_with(
-        signature, signature_len, message, message_len, secret_key, seed, seed_len,
+        signature, signature_len, message, message_len, secret_key, seed, seed_len, MLDSA87_BYTES,
         pqcr_mldsa87_signature_internal, pqcr_mldsa87_prepare_domain_separation_prefix);
 }
 

data/ext/pqcrypto/pqcrypto_secure.h

@@ -69,15 +69,13 @@ void pq_secure_wipe(void *ptr, size_t len);
 int pq_mlkem_keypair(uint8_t *public_key, uint8_t *secret_key);
 int pq_mlkem512_keypair(uint8_t *public_key, uint8_t *secret_key);
 int pq_mlkem1024_keypair(uint8_t *public_key, uint8_t *secret_key);
-int pq_mlkem_keypair_from_seed(uint8_t *public_key, uint8_t *secret_key,
-                               const uint8_t *seed64);
-int pq_mlkem512_keypair_from_seed(uint8_t *public_key, uint8_t *secret_key,
-                                  const uint8_t *seed64);
-int pq_mlkem1024_keypair_from_seed(uint8_t *public_key, uint8_t *secret_key,
-                                   const uint8_t *seed64);
+int pq_mlkem_keypair_from_seed(uint8_t *public_key, uint8_t *secret_key, const uint8_t *seed64);
+int pq_mlkem512_keypair_from_seed(uint8_t *public_key, uint8_t *secret_key, const uint8_t *seed64);
+int pq_mlkem1024_keypair_from_seed(uint8_t *public_key, uint8_t *secret_key, const uint8_t *seed64);
 int pq_mlkem_encapsulate(uint8_t *ciphertext, uint8_t *shared_secret, const uint8_t *public_key);
 int pq_mlkem512_encapsulate(uint8_t *ciphertext, uint8_t *shared_secret, const uint8_t *public_key);
-int pq_mlkem1024_encapsulate(uint8_t *ciphertext, uint8_t *shared_secret, const uint8_t *public_key);
+int pq_mlkem1024_encapsulate(uint8_t *ciphertext, uint8_t *shared_secret,
+                             const uint8_t *public_key);
 int pq_mlkem_decapsulate(uint8_t *shared_secret, const uint8_t *ciphertext,
                          const uint8_t *secret_key);
 int pq_mlkem512_decapsulate(uint8_t *shared_secret, const uint8_t *ciphertext,
@@ -88,53 +86,49 @@ int pq_mlkem1024_decapsulate(uint8_t *shared_secret, const uint8_t *ciphertext,
 int pq_sign_keypair(uint8_t *public_key, uint8_t *secret_key);
 int pq_mldsa44_sign_keypair(uint8_t *public_key, uint8_t *secret_key);
 int pq_mldsa87_sign_keypair(uint8_t *public_key, uint8_t *secret_key);
-int pq_mldsa44_keypair_from_seed(uint8_t *public_key, uint8_t *secret_key,
-                                  const uint8_t *seed32);
-int pq_mldsa_keypair_from_seed(uint8_t *public_key, uint8_t *secret_key,
-                               const uint8_t *seed32);
-int pq_mldsa87_keypair_from_seed(uint8_t *public_key, uint8_t *secret_key,
-                                  const uint8_t *seed32);
+int pq_mldsa44_keypair_from_seed(uint8_t *public_key, uint8_t *secret_key, const uint8_t *seed32);
+int pq_mldsa_keypair_from_seed(uint8_t *public_key, uint8_t *secret_key, const uint8_t *seed32);
+int pq_mldsa87_keypair_from_seed(uint8_t *public_key, uint8_t *secret_key, const uint8_t *seed32);
 int pq_sign(uint8_t *signature, size_t *signature_len, const uint8_t *message, size_t message_len,
             const uint8_t *ctx, size_t ctx_len, const uint8_t *secret_key);
-int pq_mldsa44_sign(uint8_t *signature, size_t *signature_len, const uint8_t *message, size_t message_len,
-                    const uint8_t *ctx, size_t ctx_len, const uint8_t *secret_key);
-int pq_mldsa87_sign(uint8_t *signature, size_t *signature_len, const uint8_t *message, size_t message_len,
-                    const uint8_t *ctx, size_t ctx_len, const uint8_t *secret_key);
+int pq_mldsa44_sign(uint8_t *signature, size_t *signature_len, const uint8_t *message,
+                    size_t message_len, const uint8_t *ctx, size_t ctx_len,
+                    const uint8_t *secret_key);
+int pq_mldsa87_sign(uint8_t *signature, size_t *signature_len, const uint8_t *message,
+                    size_t message_len, const uint8_t *ctx, size_t ctx_len,
+                    const uint8_t *secret_key);
 int pq_verify(const uint8_t *signature, size_t signature_len, const uint8_t *message,
               size_t message_len, const uint8_t *ctx, size_t ctx_len, const uint8_t *public_key);
 int pq_mldsa44_verify(const uint8_t *signature, size_t signature_len, const uint8_t *message,
-                      size_t message_len, const uint8_t *ctx, size_t ctx_len, const uint8_t *public_key);
+                      size_t message_len, const uint8_t *ctx, size_t ctx_len,
+                      const uint8_t *public_key);
 int pq_mldsa87_verify(const uint8_t *signature, size_t signature_len, const uint8_t *message,
-                      size_t message_len, const uint8_t *ctx, size_t ctx_len, const uint8_t *public_key);
+                      size_t message_len, const uint8_t *ctx, size_t ctx_len,
+                      const uint8_t *public_key);
 
 int pq_public_key_to_pqc_container_der(uint8_t **output, size_t *output_len,
-                                       const uint8_t *public_key,
-                                       size_t public_key_len, const char *algorithm);
-int pq_public_key_to_pqc_container_pem(char **output, size_t *output_len,
-                                       const uint8_t *public_key,
+                                       const uint8_t *public_key, size_t public_key_len,
+                                       const char *algorithm);
+int pq_public_key_to_pqc_container_pem(char **output, size_t *output_len, const uint8_t *public_key,
                                        size_t public_key_len, const char *algorithm);
 int pq_secret_key_to_pqc_container_der(uint8_t **output, size_t *output_len,
-                                        const uint8_t *secret_key,
-                                        size_t secret_key_len, const char *algorithm);
-int pq_secret_key_to_pqc_container_pem(char **output, size_t *output_len,
-                                        const uint8_t *secret_key,
-                                        size_t secret_key_len, const char *algorithm);
+                                       const uint8_t *secret_key, size_t secret_key_len,
+                                       const char *algorithm);
+int pq_secret_key_to_pqc_container_pem(char **output, size_t *output_len, const uint8_t *secret_key,
+                                       size_t secret_key_len, const char *algorithm);
 int pq_public_key_from_pqc_container_der(char **algorithm_out, uint8_t **key_out,
                                          size_t *key_len_out, const uint8_t *input,
                                          size_t input_len);
 int pq_public_key_from_pqc_container_pem(char **algorithm_out, uint8_t **key_out,
-                                         size_t *key_len_out, const char *input,
-                                         size_t input_len);
+                                         size_t *key_len_out, const char *input, size_t input_len);
 int pq_secret_key_from_pqc_container_der(char **algorithm_out, uint8_t **key_out,
-                                          size_t *key_len_out, const uint8_t *input,
-                                          size_t input_len);
+                                         size_t *key_len_out, const uint8_t *input,
+                                         size_t input_len);
 int pq_secret_key_from_pqc_container_pem(char **algorithm_out, uint8_t **key_out,
-                                          size_t *key_len_out, const char *input,
-                                          size_t input_len);
+                                         size_t *key_len_out, const char *input, size_t input_len);
 
-int pq_pkcs8_private_key_info_to_der(uint8_t **output, size_t *output_len,
-                                     const char *oid_text, const uint8_t *private_key,
-                                     size_t private_key_len);
+int pq_pkcs8_private_key_info_to_der(uint8_t **output, size_t *output_len, const char *oid_text,
+                                     const uint8_t *private_key, size_t private_key_len);
 int pq_pkcs8_private_key_info_from_der(char **oid_text_out, uint8_t **private_key_out,
                                        size_t *private_key_len_out, const uint8_t *input,
                                        size_t input_len);
@@ -143,9 +137,8 @@ int pq_pkcs8_encrypt_private_key_info_der(uint8_t **output, size_t *output_len,
                                           const char *passphrase, size_t passphrase_len,
                                           int iterations);
 int pq_pkcs8_decrypt_private_key_info_der(uint8_t **output, size_t *output_len,
-                                          const uint8_t *encrypted_der,
-                                          size_t encrypted_der_len, const char *passphrase,
-                                          size_t passphrase_len);
+                                          const uint8_t *encrypted_der, size_t encrypted_der_len,
+                                          const char *passphrase, size_t passphrase_len);
 int pq_pkcs8_der_is_encrypted_private_key_info(const uint8_t *input, size_t input_len);
 int pq_pkcs8_der_to_pem(char **output, size_t *output_len, const uint8_t *der, size_t der_len,
                         int encrypted);
@@ -197,7 +190,7 @@ const char *pq_version(void);
 #define PQ_MLKEM_CIPHERTEXTBYTES   MLKEM_CIPHERTEXTBYTES
 #define PQ_MLKEM_SHAREDSECRETBYTES MLKEM_SHAREDSECRETBYTES
 
-#define PQ_HYBRID_PUBLICKEYBYTES    HYBRID_PUBLICKEYBYTES
+#define PQ_HYBRID_PUBLICKEYBYTES          HYBRID_PUBLICKEYBYTES
 #define PQ_HYBRID_SECRETKEYBYTES          HYBRID_SECRETKEYBYTES
 #define PQ_HYBRID_EXPANDED_SECRETKEYBYTES HYBRID_EXPANDED_SECRETKEYBYTES
 #define PQ_HYBRID_CIPHERTEXTBYTES         HYBRID_CIPHERTEXTBYTES
@@ -215,15 +208,27 @@ int pq_mldsa_extract_tr_from_secret_key(uint8_t *tr_out, const uint8_t *secret_k
 int pq_mldsa_compute_tr_from_public_key(uint8_t *tr_out, const uint8_t *public_key,
                                         size_t public_key_len);
 
-int pq_sign_mu(uint8_t *signature, size_t *signature_len,
-               const uint8_t *mu, const uint8_t *secret_key,
+int pq_mldsa44_signature_extmu_compat(uint8_t *sig, size_t *siglen, const uint8_t *mu,
+                                      const uint8_t *sk);
+int pq_mldsa65_signature_extmu_compat(uint8_t *sig, size_t *siglen, const uint8_t *mu,
+                                      const uint8_t *sk);
+int pq_mldsa87_signature_extmu_compat(uint8_t *sig, size_t *siglen, const uint8_t *mu,
+                                      const uint8_t *sk);
+int pq_mldsa44_verify_extmu_compat(const uint8_t *sig, size_t siglen, const uint8_t *mu,
+                                   const uint8_t *pk);
+int pq_mldsa65_verify_extmu_compat(const uint8_t *sig, size_t siglen, const uint8_t *mu,
+                                   const uint8_t *pk);
+int pq_mldsa87_verify_extmu_compat(const uint8_t *sig, size_t siglen, const uint8_t *mu,
+                                   const uint8_t *pk);
+
+int pq_sign_mu(uint8_t *signature, size_t *signature_len, const uint8_t *mu,
+               const uint8_t *secret_key,
                int (*signature_extmu)(uint8_t *, size_t *, const uint8_t *, const uint8_t *));
-int pq_verify_mu(const uint8_t *signature, size_t signature_len,
-                 const uint8_t *mu, const uint8_t *public_key, size_t expected_signature_len,
+int pq_verify_mu(const uint8_t *signature, size_t signature_len, const uint8_t *mu,
+                 const uint8_t *public_key, size_t expected_signature_len,
                  int (*verify_extmu)(const uint8_t *, size_t, const uint8_t *, const uint8_t *));
 void *pq_mu_builder_new(void);
-int pq_mu_builder_init(void *state, const uint8_t *tr,
-                       const uint8_t *ctx, size_t ctxlen);
+int pq_mu_builder_init(void *state, const uint8_t *tr, const uint8_t *ctx, size_t ctxlen);
 int pq_mu_builder_absorb(void *state, const uint8_t *chunk, size_t chunk_len);
 int pq_mu_builder_finalize(void *state, uint8_t *mu_out);
 void pq_mu_builder_release(void *state);

data/ext/pqcrypto/pqcrypto_version.h

@@ -2,6 +2,6 @@
 #ifndef PQCRYPTO_VERSION_H
 #define PQCRYPTO_VERSION_H
 
-#define PQCRYPTO_VERSION "0.6.4"
+#define PQCRYPTO_VERSION "0.6.6"
 
 #endif

data/ext/pqcrypto/vendor/.vendored

@@ -2,11 +2,11 @@
 backend=PQ Code Package native only
 pqclean=removed
 mlkem_native_repo=https://github.com/pq-code-package/mlkem-native.git
-mlkem_native_ref=v1.2.0
-mlkem_native_commit=0ba906cb14b1c241476134d7403a811b382ca498
-mlkem_native_tree_sha256=cc78ed199b8c65abe68635b23a13b294d5a8deb20c8bc7b4d76590c00976bb2d
+mlkem_native_ref=v2.0.0
+mlkem_native_commit=d1b2fe782888bdb761a50336012923180be7f502
+mlkem_native_tree_sha256=18bfa9ea4e2232bdf56f8ec374b62d10e50b99a30cb08aafc18d0b97e00cd06f
 mldsa_native_repo=https://github.com/pq-code-package/mldsa-native.git
-mldsa_native_ref=v1.0.0-beta2
-mldsa_native_commit=9b0ee84f4cf399043eca59eca4e5f8531ca1d61b
-mldsa_native_tree_sha256=2887f59926c18a877e8c5a5e30727e84497c357032093d00d7135aedf53f011e
-manifest_sha256=011e9d7d1160c7d612869695d950e17f9e330dac6bf782883639593f96fee951
+mldsa_native_ref=v2.0.0
+mldsa_native_commit=834a90d5e846ffa1e1611bd24e160bb2e9b86d35
+mldsa_native_tree_sha256=25b3c3949d2ed37d1ad5d4722c8476d13deb2a0bb945f12444f463378d69375d
+manifest_sha256=4bcf7cc4d0ac0d0e66ebb9612042960dc1197838f26bbedb16e3b6a3978e264c

data/ext/pqcrypto/vendor/mldsa-native/BUILDING.md

@@ -73,11 +73,14 @@ For detailed information on how to use the script, please refer to
 
 You can also build **mldsa-native** on Windows using `nmake` and an MSVC compiler.
 
-To build and run the tests (only support functional testing for non-opt implementation for now), use the following `nmake` targets:
+To build and run the tests, use the following `nmake` target:
 ```powershell
-nmke /f .\Makefile.Microsoft_nmake quickcheck
+nmake /f .\Makefile.Microsoft_nmake quickcheck
 ```
 
+This runs the functional, RNG-failure, allocation, ACVP, KAT and Wycheproof tests. The assembly backends are not yet
+supported on Windows, so the tests are built for the C backend only.
+
 # Checking the proofs
 
 ## CBMC

data/ext/pqcrypto/vendor/mldsa-native/LICENSE

@@ -6,14 +6,33 @@ implementation are made available under the Apache-2.0 license OR
 the ISC license OR the MIT license. These licenses are
 reproduced at the bottom of this file.
 
-The code in test/notrandombytes/* is derived from
+Files outside the library itself may carry different terms. Every file
+states its own SPDX-License-Identifier, which determines the terms that
+apply to it. In particular:
+
+The code in test/notrandombytes/*, and its copies in
+examples/*/test_only_rng/* and scripts/notrandombytes, is derived from
 https://cr.yp.to/papers.html#surf and licensed under
 LicenseRef-PD-hp OR CC0-1.0 OR 0BSD OR MIT-0 OR MIT.
 It is only used for testing purposes.
 
-The benchmarking code in test/hal/hal.c carries the
+The benchmarking code in test/hal/* carries the
 MIT license. It is only used for testing purposes.
 
+The tiny_sha3 code in
+examples/bring_your_own_fips202/custom_fips202/tiny_sha3/* and
+examples/custom_backend/mldsa_native/src/fips202/native/custom/src/*
+carries the MIT license. It is only used to demonstrate custom
+FIPS-202 implementations.
+
+The proofs in proofs/* are in part derived from Amazon Web Services
+verification infrastructure and licensed under
+Apache-2.0 OR ISC OR MIT-0, MIT-0, or MIT-0 AND Apache-2.0. The IACR
+document class proofs/isabelle/neon_ntt/document/iacrtrans.cls is
+licensed under CC0-1.0. None of this is part of the library.
+
+Documentation is licensed under CC-BY-4.0.
+
 ```
 Copyright (c) The mldsa-native project authors
 Copyright (c) The mlkem-native project authors

data/ext/pqcrypto/vendor/mldsa-native/README.md

@@ -3,7 +3,6 @@
 # mldsa-native
 
 ![CI](https://github.com/pq-code-package/mldsa-native/actions/workflows/all.yml/badge.svg)
-![Proof: HOL-Light](https://github.com/pq-code-package/mldsa-native/actions/workflows/hol_light.yml/badge.svg)
 ![Benchmarks](https://github.com/pq-code-package/mldsa-native/actions/workflows/bench.yml/badge.svg)
 ![C90](https://img.shields.io/badge/language-C90-blue.svg)
 
@@ -52,18 +51,25 @@ make test
 mldsa-native is used in
  - AWS' Cryptography library [AWS-LC](https://github.com/aws/aws-lc/)
  - [libOQS](https://github.com/open-quantum-safe/liboqs/) of the Open Quantum Safe project
- - The [zeroRISC's fork of OpenTitan](https://github.com/zerorisc/expo) - an open source silicon Root of Trust (RoT)
+ - [Pavona](https://github.com/pavona/pavona) - a library of modular, tapeout-proven, and secure-by-default open silicon blocks
  - [CHERIoT-PQC](https://github.com/CHERIoT-Platform/cheriot-pqc) — post-quantum cryptography support for the CHERIoT platform
 
 ## Formal Verification
 
 We use the [C Bounded Model Checker (CBMC)](https://github.com/diffblue/cbmc) to prove absence of various classes of undefined behaviour in C, including out of bounds memory accesses and integer overflows. The proofs cover all C code in [mldsa/src/*](mldsa) and [mldsa/src/fips202/*](mldsa/src/fips202) involved in running mldsa-native with its C backend. See [proofs/cbmc](proofs/cbmc) for details.
 
-HOL-Light functional correctness proofs can be found in [proofs/hol_light](proofs/hol_light). See the [HOL-Light README](proofs/hol_light/README.md) for the list of functions that have been proven correct. These proofs utilize the verification infrastructure in [s2n-bignum](https://github.com/awslabs/s2n-bignum).
+All AArch64 and x86_64 assembly is proved functionally correct and memory-safe at the object-code level, using
+[HOL-Light](https://hol-light.github.io/) and the [s2n-bignum](https://github.com/awslabs/s2n-bignum) verification
+infrastructure. All routines are additionally proved to have secret-independent timing, with two exceptions. The
+matrix sampler `rej_uniform` operates on public data only, and is deliberately variable-time. The secret-vector
+samplers `rej_uniform_eta{2,4}` _do_ have secret-independent timing, but this property is not yet backed by proof.
+See [proofs/hol_light](proofs/hol_light) for details.
 
 Finally, [proofs/isabelle](proofs/isabelle/compress) contains proofs in [Isabelle/HOL](https://isabelle.in.tum.de/) of the correctness of
 different approaches for computing the scalar decomposition routines used in ML-DSA. Those are still experimental and do not yet operate
-on the source level.
+on the source level. [proofs/isabelle/neon_ntt](proofs/isabelle/neon_ntt) additionally provides a machine-checked formalisation of the
+modular-arithmetic core of the Neon NTT paper[^NeonNTT], covering the Barrett and Montgomery primitives underlying the AArch64 NTT and
+pointwise-multiplication assembly; see its [README](proofs/isabelle/neon_ntt/README.md).
 
 **NOTE:** Formal Verification is never absolute. See [SOUNDNESS.md](SOUNDNESS.md) for an analysis of the scope, assumptions and risks of the formal verification efforts around mldsa-native.
 
@@ -157,6 +163,8 @@ For CI benchmark results and historical performance data, see the [benchmarking
 
 If you want to use mldsa-native, import [mldsa](mldsa) into your project's source tree and build using your favourite build system. See [examples/basic](examples/basic) for a simple example. The build system provided in this repository is for development purposes only.
 
+See [API-CONVENTIONS.md](API-CONVENTIONS.md) for conventions that apply to all public functions, such as return values, pointer validity, and the state of output buffers on error.
+
 ### Can I bring my own FIPS-202?
 
 mldsa-native relies on and comes with an implementation of FIPS-202[^FIPS202]. If your library has its own FIPS-202 implementation, you
@@ -185,11 +193,15 @@ Yes. mldsa-native provides a compile-time option `MLD_CONFIG_REDUCE_RAM` that re
 
 To enable this mode, define `MLD_CONFIG_REDUCE_RAM` in [mldsa_native_config.h](mldsa/mldsa_native_config.h) or pass `-DMLD_CONFIG_REDUCE_RAM` as a compiler flag.
 
+### Can I bound or restart the signing loop for real-time systems?
+
+Yes. Signing hooks allow you to pause and restart ML-DSA signature operations, thereby bounding their runtime. See [examples/restartable_sign](examples/restartable_sign) for an example.
+
 ### Does mldsa-native use hedged or deterministic signing?
 
 By default, mldsa-native uses the randomized "hedged" signing variant as specified in FIPS 204 Section 3.4. The hedged variant uses both fresh randomness at signing time and precomputed randomness from the private key. This helps mitigate fault injection attacks and side-channel attacks while protecting against potential flaws in the random number generator.
 
-If you need the deterministic variant of ML-DSA, you can call `crypto_sign_signature_internal`
+If you need the deterministic variant of ML-DSA, you can call `signature_internal`
 directly with an all-zero `rnd` argument.
 However, note that FIPS 204 warns that this should not be used on platforms where fault injection attacks and side-channel attacks are a concern, as the lack of fresh randomness makes fault attacks more difficult to mitigate.
 
@@ -204,8 +216,8 @@ External mu mode enables applications to compute the message digest (mu) externa
 Yes. mldsa-native supports HashML-DSA, the pre-hashing variant of ML-DSA defined in FIPS 204 Algorithms 4 and 5.
 
 mldsa-native provides two levels of API:
-- `crypto_sign_signature_pre_hash_internal` and `crypto_sign_verify_pre_hash_internal` - Low-level functions that accept a pre-hashed message digest. This function supports all 12 allowed hash functions.
-- `crypto_sign_signature_pre_hash_shake256` and `crypto_sign_verify_pre_hash_shake256` - High-level functions that perform SHAKE256 pre-hashing internally for convenience. Currently, only SHAKE256 is supported. If you require another hash function, use the `*_pre_hash_internal` functions or open an issue.
+- `signature_pre_hash_internal` and `verify_pre_hash_internal` - Low-level functions that accept a pre-hashed message digest. This function supports all 12 allowed hash functions.
+- `signature_pre_hash_shake256` and `verify_pre_hash_shake256` - High-level functions that perform SHAKE256 pre-hashing internally for convenience. Currently, only SHAKE256 is supported. If you require another hash function, use the `*_pre_hash_internal` functions or open an issue.
 
 ## Have a Question?
 
@@ -229,6 +241,7 @@ through the [PQCA Discord](https://discord.com/invite/xyVnwzfg5R). See also [CON
 [^FIPS204]: National Institute of Standards and Technology: FIPS 204 Module-Lattice-Based Digital Signature Standard, [https://csrc.nist.gov/pubs/fips/204/final](https://csrc.nist.gov/pubs/fips/204/final)
 [^NIST_FAQ]: National Institute of Standards and Technology: Post-Quantum Cryptography FAQs, [https://csrc.nist.gov/Projects/post-quantum-cryptography/faqs#Rdc7](https://csrc.nist.gov/Projects/post-quantum-cryptography/faqs#Rdc7)
 [^NIST_FIPS204_SEC6]: National Institute of Standards and Technology: FIPS 204 Section 6 Guidance, [https://csrc.nist.gov/csrc/media/Projects/post-quantum-cryptography/documents/faq/fips204-sec6-03192025.pdf](https://csrc.nist.gov/csrc/media/Projects/post-quantum-cryptography/documents/faq/fips204-sec6-03192025.pdf)
+[^NeonNTT]: Becker, Hwang, Kannwischer, Yang, Yang: Neon NTT: Faster Dilithium, Kyber, and Saber on Cortex-A72 and Apple M1, [https://eprint.iacr.org/2021/986](https://eprint.iacr.org/2021/986)
 [^REF]: Bai, Ducas, Kiltz, Lepoint, Lyubashevsky, Schwabe, Seiler, Stehlé: CRYSTALS-Dilithium reference implementation, [https://github.com/pq-crystals/dilithium/tree/master/ref](https://github.com/pq-crystals/dilithium/tree/master/ref)
 [^tiny_sha3]: Markku-Juhani O. Saarinen: tiny_sha3, [https://github.com/mjosaarinen/tiny_sha3](https://github.com/mjosaarinen/tiny_sha3)
 [^wycheproof]: Community Cryptography Specification Project: Project Wycheproof, [https://github.com/C2SP/wycheproof](https://github.com/C2SP/wycheproof)

data/ext/pqcrypto/vendor/mldsa-native/RELEASE.md

@@ -0,0 +1,160 @@
+[//]: # (SPDX-License-Identifier: CC-BY-4.0)
+
+mldsa-native v2.0.0
+===================
+
+Release notes
+-------------
+
+v2.0.0 is the first stable release of mldsa-native, a secure, fast and portable C90 implementation of
+[ML-DSA](https://csrc.nist.gov/pubs/fips/204/final) derived from the
+[ML-DSA reference implementation](https://github.com/pq-crystals/dilithium).
+It carries the version number v2.0.0 rather than v1.0.0 because its public API and configuration are aligned with
+those of the upcoming v2 release of the sister project
+[mlkem-native](https://github.com/pq-code-package/mlkem-native).
+
+mldsa-native v2.0.0 offers:
+* High maintainability and extensibility through modular frontend/backend design.
+* High performance through AArch64 (Neon) and x86_64 (AVX2) assembly backends and the use of the
+  [SLOTHY super-optimizer](https://github.com/slothy-optimizer/slothy).
+* High assurance through memory- and type-safety proofs for the C frontend and backend (CBMC),
+  functional-correctness and memory-safety proofs for both the AArch64 and x86_64 assembly
+  backends (HOL Light and s2n-bignum), and extensive constant-time testing.
+
+mldsa-native v2.0.0 is uniformly licensed Apache-2.0 OR MIT OR ISC, giving consumers the choice to use any of these
+licenses.
+
+Assurance
+---------
+
+v2.0.0 marks the completion of the two formal-verification efforts underpinning mldsa-native: the HOL Light proofs for
+the AArch64 (Neon) and x86_64 (AVX2) assembly backends and the CBMC proofs for the C code are now both complete.
+
+- **AArch64 and x86_64 assembly proved in HOL Light.** Every routine in both the AArch64 (Neon) and x86_64 (AVX2)
+  backends is proved functionally correct and memory-safe at the object-code level, using
+  [HOL Light](https://hol-light.github.io/) and the [s2n-bignum](https://github.com/awslabs/s2n-bignum) verification
+  infrastructure. All routines except the secret-vector rejection samplers (`rej_uniform_eta{2,4}`) are additionally
+  proved to have secret-independent timing (those samplers _do_ have secret-independent timing, but this property is
+  not yet backed by proof).
+- **CBMC proofs for the C code**, establishing memory safety, type safety and absence of various classes of undefined
+  behaviour for all C code involved in running mldsa-native with its C backend.
+
+See [SOUNDNESS.md](SOUNDNESS.md) for more detail on the scope, assumptions and residual risks of the verification
+work; it shares its methodology, formal models and trusted computing base with the sister project
+[mlkem-native](https://github.com/pq-code-package/mlkem-native).
+
+Breaking changes since v1.0.0-beta2
+-----------------------------------
+
+Between the last beta release
+([v1.0.0-beta2](https://github.com/pq-code-package/mldsa-native/releases/tag/v1.0.0-beta2)) and this release, a number
+of breaking changes to the public API and configuration have been introduced. Consumers upgrading from
+`v1.0.0-beta2` should be aware of the following:
+
+- **`siglen` removed from the signing and verification APIs.** Signing functions no longer take a `size_t *siglen`
+  out-parameter and verification functions no longer take a `size_t siglen` in-parameter; signatures are always
+  `MLDSA_BYTES(MLD_CONFIG_PARAMETER_SET)` bytes and verification now takes a fixed-size signature array. Drop the
+  `siglen` argument at every call site. ([#1240](https://github.com/pq-code-package/mldsa-native/pull/1240))
+- **SUPERCOP-style aliases and constants removed.** The `crypto_sign_keypair` / `crypto_sign_signature` /
+  `crypto_sign_verify` aliases, the `CRYPTO_SECRETKEYBYTES` / `CRYPTO_PUBLICKEYBYTES` / `CRYPTO_BYTES` size macros, and
+  the `MLD_CONFIG_NO_SUPERCOP` option were removed. Use the namespaced API directly and derive sizes from
+  `MLDSA_SECRETKEYBYTES` / `MLDSA_PUBLICKEYBYTES` / `MLDSA_BYTES`.
+  ([#1248](https://github.com/pq-code-package/mldsa-native/pull/1248))
+- **SUPERCOP signed-message API removed.** The combined signed-message functions (`crypto_sign` / `crypto_sign_open`
+  and their namespaced equivalents, which produced/consumed signature-prepended messages) were removed. Applications
+  needing that format should build it on top of the detached `signature` / `verify` API.
+  ([#1236](https://github.com/pq-code-package/mldsa-native/pull/1236))
+- **`MLD_ERR_FAIL` split into specific error codes.** Failure conditions that previously all surfaced as
+  `MLD_ERR_FAIL` now have dedicated codes: `MLD_ERR_INVALID_SIGNATURE` (verification rejected the signature),
+  `MLD_ERR_INVALID_KEY` (`pk_from_sk` found the secret key malformed or internally inconsistent), `MLD_ERR_PCT_FAIL`
+  (the key-generation pairwise consistency test failed) and `MLD_ERR_INVALID_ARG` (unsupported pre-hash algorithm or
+  context string longer than 255 bytes). The previously existing codes keep their values, but callers matching on
+  `MLD_ERR_FAIL` must be updated; it is no longer externally observable.
+  ([#1309](https://github.com/pq-code-package/mldsa-native/pull/1309))
+- **Legacy header-time configuration removed.** The deprecated `MLD_CONFIG_API_*` macros
+  (`MLD_CONFIG_API_PARAMETER_SET`, `MLD_CONFIG_API_NAMESPACE_PREFIX`, `MLD_CONFIG_API_NO_SUPERCOP`,
+  `MLD_CONFIG_API_CONSTANTS_ONLY`, `MLD_CONFIG_API_QUALIFIER`) were removed in favour of configuring through the
+  [config file](mldsa/mldsa_native_config.h) (`MLD_CONFIG_PARAMETER_SET`, `MLD_CONFIG_NAMESPACE_PREFIX`,
+  `MLD_CONFIG_CONSTANTS_ONLY`, `MLD_CONFIG_EXTERNAL_API_QUALIFIER`). For multi-level builds, set
+  `MLD_CONFIG_MULTILEVEL_BUILD` and do not bake the 44/65/87 suffix into the namespace prefix; the security level is
+  now appended automatically. ([#1206](https://github.com/pq-code-package/mldsa-native/pull/1206),
+  [#1270](https://github.com/pq-code-package/mldsa-native/pull/1270))
+- **FIPS-202 backend flags renamed to the `MLD_USE_NATIVE_*` convention.** Custom FIPS-202 backends must rename the
+  flags they define: `MLD_USE_FIPS202_X1_NATIVE` -> `MLD_USE_NATIVE_FIPS202_X1`, `MLD_USE_FIPS202_X4_NATIVE` ->
+  `MLD_USE_NATIVE_FIPS202_X4`, `MLD_USE_FIPS202_X4_XOR_BYTES_NATIVE` -> `MLD_USE_NATIVE_FIPS202_X4_XOR_BYTES`, and
+  `MLD_USE_FIPS202_X4_EXTRACT_BYTES_NATIVE` -> `MLD_USE_NATIVE_FIPS202_X4_EXTRACT_BYTES`. Default builds are
+  unaffected. ([#1207](https://github.com/pq-code-package/mldsa-native/pull/1207))
+- **Capability enum values prefixed with the architecture.** `mld_sys_cap` values were renamed
+  (`MLD_SYS_CAP_AVX2` -> `MLD_SYS_CAP_X86_64_AVX2`, `MLD_SYS_CAP_SHA3` -> `MLD_SYS_CAP_AARCH64_SHA3`,
+  `MLD_SYS_CAP_MVE` -> `MLD_SYS_CAP_ARMV81M_MVE`). This affects integrators with custom native backends or a custom
+  capability-check function. ([#1208](https://github.com/pq-code-package/mldsa-native/pull/1208))
+- **Minimum FIPS 204 signing-attempt bound raised from 814 to 821.** Builds that set
+  `MLD_CONFIG_MAX_SIGNING_ATTEMPTS` explicitly must now use a value of at least 821; 814 through 820 no longer compile.
+  The [FIPS 204 errata](https://csrc.nist.gov/files/pubs/fips/204/final/docs/fips-204-potential-updates.xlsx) revises
+  the Repetitions row of Table 1 to 4.36 / 5.14 / 3.91 and, with it, the minimum loop-iteration limit for
+  `ML-DSA.Sign_internal` in Table 3 from 814 to 821.
+  ([#1349](https://github.com/pq-code-package/mldsa-native/pull/1349))
+
+We hope these simplifications make integrations easier for the majority of consumers. Moving forward, APIs and
+configuration options not marked as experimental are guaranteed to be stable until a new major version (`v3`) is
+released; additional APIs and configuration options may be introduced at any time.
+
+If the breaking changes above cause any issues for your application, please
+[open a GitHub issue](https://github.com/pq-code-package/mldsa-native/issues). If your application could benefit from
+additional APIs or configuration options, please open an issue as well.
+
+What's New
+----------
+
+### Restartable and bounded signing for real-time systems
+
+ML-DSA signing is a rejection-sampling loop: it draws a candidate signature and retries until one passes the
+bounds checks. The number of attempts is not known in advance, so a single signing call has an *unbounded* worst-case
+runtime.
+For environments with strict timing requirements that is a problem: a signing call cannot be allowed to run for an
+arbitrary number of iterations before returning control to the caller.
+
+mldsa-native addresses this with three optional, independent **signing hooks** around the rejection-sampling loop,
+enabled with `MLD_CONFIG_SIGN_HOOK_ATTEMPT`, `MLD_CONFIG_SIGN_HOOK_RESUME` and `MLD_CONFIG_SIGN_HOOK_FINISH`. The
+attempt hook runs before each attempt and may **pause** the operation; signing then returns the new
+`MLD_ERR_SIGNING_PAUSED` code instead of iterating further. At the start of the next call the resume hook is queried
+for the attempt to restart from (the one the attempt hook recorded when it paused), so signing continues exactly where
+it left off; the finish hook fires with the succeeding attempt once a signature is found. The split, resumed run
+produces exactly the same signature as a single uninterrupted call.
+
+To bound per-call runtime, the attempt hook pauses once a per-call budget is spent, and the caller re-invokes signing
+in a loop until it completes.
+
+For concurrent or interleaved signers, hold the resume state per caller by enabling `MLD_CONFIG_CONTEXT_PARAMETER`
+instead of a global; each API function then forwards a context argument to the hooks. A complete example is in
+[examples/restartable_sign](examples/restartable_sign).
+([#1237](https://github.com/pq-code-package/mldsa-native/pull/1237))
+
+This feature is experimental: its scope, configuration and hook signatures may change, including after v2.
+We would love to hear your feedback on this feature.
+
+### API and configuration
+
+- **`MLD_SYS_AARCH64_FAST_SHA3`** opts non-Apple AArch64 cores with fast SHA3 instructions into the SHA3-instruction
+  path. ([#1254](https://github.com/pq-code-package/mldsa-native/pull/1254))
+
+### Platforms and testing
+
+- **Windows MSVC** test support (KAT, Wycheproof, allocation-failure and RNG-failure tests).
+  ([#1247](https://github.com/pq-code-package/mldsa-native/pull/1247))
+- **AVR baremetal / 16-bit** platform support. ([#1158](https://github.com/pq-code-package/mldsa-native/pull/1158))
+- **Zephyr** hardware and QEMU test platforms, including NUCLEO-N657X0-Q.
+  ([#1259](https://github.com/pq-code-package/mldsa-native/pull/1259),
+  [#1269](https://github.com/pq-code-package/mldsa-native/pull/1269))
+- **ABI checker** for AArch64, x86_64 (SysV) and Armv8.1-M+MVE.
+  ([#1195](https://github.com/pq-code-package/mldsa-native/pull/1195))
+
+### Documentation
+
+- **FIPS 204 references** annotated throughout the code and expanded in the documentation, mapping the implementation
+  to [the standard](https://csrc.nist.gov/pubs/fips/204/final).
+- **[API-CONVENTIONS.md](API-CONVENTIONS.md)** documents the conventions shared by all public functions: return
+  values, pointer validity (all pointers are assumed valid and non-NULL, except a pointer paired with a length, which
+  may be NULL when that length is `0`), and the state of output buffers on error (left either unchanged or fully
+  zeroized, never holding partially computed data).
+