pq_crypto 0.6.5 → 0.6.7

data/ext/pqcrypto/pqcrypto_ruby_secure.c

@@ -173,11 +173,11 @@ typedef struct {
 
 static const pq_mldsa_profile_t MLDSA_PROFILES[] = {
     {"ml_dsa_44", MLDSA44_PUBLICKEYBYTES, MLDSA44_SECRETKEYBYTES, MLDSA44_BYTES,
-     pqcr_mldsa44_pk_from_sk, pqcr_mldsa44_signature_extmu, pqcr_mldsa44_verify_extmu},
+     pqcr_mldsa44_pk_from_sk, pq_mldsa44_signature_extmu_compat, pq_mldsa44_verify_extmu_compat},
     {"ml_dsa_65", MLDSA65_PUBLICKEYBYTES, MLDSA65_SECRETKEYBYTES, MLDSA65_BYTES,
-     pqcr_mldsa65_pk_from_sk, pqcr_mldsa65_signature_extmu, pqcr_mldsa65_verify_extmu},
+     pqcr_mldsa65_pk_from_sk, pq_mldsa65_signature_extmu_compat, pq_mldsa65_verify_extmu_compat},
     {"ml_dsa_87", MLDSA87_PUBLICKEYBYTES, MLDSA87_SECRETKEYBYTES, MLDSA87_BYTES,
-     pqcr_mldsa87_pk_from_sk, pqcr_mldsa87_signature_extmu, pqcr_mldsa87_verify_extmu},
+     pqcr_mldsa87_pk_from_sk, pq_mldsa87_signature_extmu_compat, pq_mldsa87_verify_extmu_compat},
 };
 
 static const pq_mldsa_profile_t *pq_mldsa_profile_from_value(VALUE algorithm) {
@@ -718,6 +718,12 @@ __attribute__((noreturn)) static void pq_raise_general_error(int err) {
     case PQ_ERROR_OPENSSL:
         rb_raise(ePQCryptoError, "OpenSSL error");
         break;
+    case PQ_ERROR_INVALID_PUBLIC_KEY:
+        rb_raise(ePQCryptoError, "Invalid public key");
+        break;
+    case PQ_ERROR_INVALID_SECRET_KEY:
+        rb_raise(ePQCryptoError, "Invalid secret key");
+        break;
     default:
         rb_raise(ePQCryptoError, "Unknown error: %d", err);
         break;
@@ -765,6 +771,28 @@ static VALUE pq_run_kem_keypair_from_seed(void *(*nogvl)(void *), VALUE seed, si
     X(ml_kem_1024, MLKEM1024_PUBLICKEYBYTES, MLKEM1024_SECRETKEYBYTES, MLKEM1024_CIPHERTEXTBYTES, \
       MLKEM1024_SHAREDSECRETBYTES)
 
+static VALUE pq_run_key_check(int (*check)(const uint8_t *), VALUE key, size_t expected_len) {
+    uint8_t *buffer;
+    size_t copied_len = 0;
+    int result;
+
+    StringValue(key);
+    if ((size_t)RSTRING_LEN(key) != expected_len) {
+        return Qfalse;
+    }
+
+    buffer = pq_copy_ruby_string(key, &copied_len);
+    result = check(buffer);
+    pq_secure_wipe(buffer, copied_len);
+    free(buffer);
+
+    if (result == PQ_ERROR_NOMEM) {
+        rb_raise(rb_eNoMemError, "Memory allocation failed");
+    }
+
+    return result == PQ_SUCCESS ? Qtrue : Qfalse;
+}
+
 #define PQ_DEFINE_RUBY_KEM(rb_name, pk_bytes, sk_bytes, ct_bytes, ss_bytes)                   \
     static VALUE pqcrypto_##rb_name##_keypair(VALUE self) {                                   \
         (void)self;                                                                           \
@@ -787,6 +815,41 @@ static VALUE pq_run_kem_keypair_from_seed(void *(*nogvl)(void *), VALUE seed, si
                                       secret_key, sk_bytes, ss_bytes);                        \
     }
 
+#define PQ_DEFINE_RUBY_KEM_CHECK(rb_name, c_name)                               \
+    static VALUE pqcrypto_##rb_name##_check_public_key(VALUE self, VALUE key) { \
+        (void)self;                                                             \
+        return pq_run_key_check(pq_##c_name##_check_public_key, key,            \
+                                (size_t)c_name##_PUBLICKEYBYTES_VALUE);         \
+    }                                                                           \
+    static VALUE pqcrypto_##rb_name##_check_secret_key(VALUE self, VALUE key) { \
+        (void)self;                                                             \
+        return pq_run_key_check(pq_##c_name##_check_secret_key, key,            \
+                                (size_t)c_name##_SECRETKEYBYTES_VALUE);         \
+    }
+
+#define mlkem_PUBLICKEYBYTES_VALUE     PQ_MLKEM_PUBLICKEYBYTES
+#define mlkem_SECRETKEYBYTES_VALUE     PQ_MLKEM_SECRETKEYBYTES
+#define mlkem512_PUBLICKEYBYTES_VALUE  MLKEM512_PUBLICKEYBYTES
+#define mlkem512_SECRETKEYBYTES_VALUE  MLKEM512_SECRETKEYBYTES
+#define mlkem1024_PUBLICKEYBYTES_VALUE MLKEM1024_PUBLICKEYBYTES
+#define mlkem1024_SECRETKEYBYTES_VALUE MLKEM1024_SECRETKEYBYTES
+
+PQ_KEM_KEYPAIR_NOGVL_VARIANTS(PQ_DEFINE_RUBY_KEM_CHECK)
+
+#undef PQ_DEFINE_RUBY_KEM_CHECK
+
+#define PQ_DEFINE_RUBY_MLDSA_CHECK_SK(rb_name, c_name, sk_bytes)                          \
+    static VALUE pqcrypto_##rb_name##_check_secret_key(VALUE self, VALUE key) {           \
+        (void)self;                                                                       \
+        return pq_run_key_check(pq_##c_name##_check_secret_key, key, (size_t)(sk_bytes)); \
+    }
+
+PQ_DEFINE_RUBY_MLDSA_CHECK_SK(ml_dsa, mldsa, MLDSA65_SECRETKEYBYTES)
+PQ_DEFINE_RUBY_MLDSA_CHECK_SK(ml_dsa_44, mldsa44, MLDSA44_SECRETKEYBYTES)
+PQ_DEFINE_RUBY_MLDSA_CHECK_SK(ml_dsa_87, mldsa87, MLDSA87_SECRETKEYBYTES)
+
+#undef PQ_DEFINE_RUBY_MLDSA_CHECK_SK
+
 PQ_RUBY_KEM_VARIANTS(PQ_DEFINE_RUBY_KEM)
 
 #undef PQ_DEFINE_RUBY_KEM
@@ -1306,7 +1369,8 @@ PQ_DEFINE_RUBY_MLDSA_SIGN(ml_dsa_87_sign, mldsa_87_sign, MLDSA87_SECRETKEYBYTES,
 #undef PQ_DEFINE_RUBY_MLDSA_SIGN
 
 static VALUE pq_run_verify(void *(*nogvl)(void *), VALUE message, VALUE signature, VALUE public_key,
-                           VALUE context, size_t public_key_len_expected) {
+                           VALUE context, size_t public_key_len_expected,
+                           size_t signature_len_expected) {
     StringValue(signature);
     pq_validate_bytes_argument(public_key, public_key_len_expected, "public key");
     StringValue(context);
@@ -1314,6 +1378,10 @@ static VALUE pq_run_verify(void *(*nogvl)(void *), VALUE message, VALUE signatur
         rb_raise(rb_eArgError, "ML-DSA context length must be <= 255 bytes");
     }
 
+    if ((size_t)RSTRING_LEN(signature) != signature_len_expected) {
+        return Qfalse;
+    }
+
     verify_call_t call = {0};
     size_t public_key_len = 0;
     size_t signature_len = 0;
@@ -1341,7 +1409,7 @@ static VALUE pq_run_verify(void *(*nogvl)(void *), VALUE message, VALUE signatur
     pq_raise_general_error(call.result);
 }
 
-#define PQ_DEFINE_RUBY_MLDSA_VERIFY(rb_name, nogvl_stem, pk_bytes)                             \
+#define PQ_DEFINE_RUBY_MLDSA_VERIFY(rb_name, nogvl_stem, pk_bytes, sig_bytes)                  \
     static VALUE pqcrypto_##rb_name(int argc, VALUE *argv, VALUE self) {                       \
         (void)self;                                                                            \
         VALUE message, signature, public_key, context;                                         \
@@ -1350,12 +1418,14 @@ static VALUE pq_run_verify(void *(*nogvl)(void *), VALUE message, VALUE signatur
             context = rb_str_new("", 0);                                                       \
         }                                                                                      \
         return pq_run_verify(pq_##nogvl_stem##_nogvl, message, signature, public_key, context, \
-                             pk_bytes);                                                        \
+                             pk_bytes, sig_bytes);                                             \
     }
 
-PQ_DEFINE_RUBY_MLDSA_VERIFY(verify, verify, PQ_MLDSA_PUBLICKEYBYTES)
-PQ_DEFINE_RUBY_MLDSA_VERIFY(ml_dsa_44_verify, mldsa_44_verify, MLDSA44_PUBLICKEYBYTES)
-PQ_DEFINE_RUBY_MLDSA_VERIFY(ml_dsa_87_verify, mldsa_87_verify, MLDSA87_PUBLICKEYBYTES)
+PQ_DEFINE_RUBY_MLDSA_VERIFY(verify, verify, PQ_MLDSA_PUBLICKEYBYTES, PQ_MLDSA_BYTES)
+PQ_DEFINE_RUBY_MLDSA_VERIFY(ml_dsa_44_verify, mldsa_44_verify, MLDSA44_PUBLICKEYBYTES,
+                            MLDSA44_BYTES)
+PQ_DEFINE_RUBY_MLDSA_VERIFY(ml_dsa_87_verify, mldsa_87_verify, MLDSA87_PUBLICKEYBYTES,
+                            MLDSA87_BYTES)
 
 #undef PQ_DEFINE_RUBY_MLDSA_VERIFY
 
@@ -1992,6 +2062,24 @@ void Init_pqcrypto_secure(void) {
                               pqcrypto_ml_kem_1024_encapsulate, 1);
     rb_define_module_function(mPQCrypto, "ml_kem_1024_decapsulate",
                               pqcrypto_ml_kem_1024_decapsulate, 2);
+    rb_define_module_function(mPQCrypto, "ml_kem_check_public_key",
+                              pqcrypto_ml_kem_check_public_key, 1);
+    rb_define_module_function(mPQCrypto, "ml_kem_check_secret_key",
+                              pqcrypto_ml_kem_check_secret_key, 1);
+    rb_define_module_function(mPQCrypto, "ml_kem_512_check_public_key",
+                              pqcrypto_ml_kem_512_check_public_key, 1);
+    rb_define_module_function(mPQCrypto, "ml_kem_512_check_secret_key",
+                              pqcrypto_ml_kem_512_check_secret_key, 1);
+    rb_define_module_function(mPQCrypto, "ml_kem_1024_check_public_key",
+                              pqcrypto_ml_kem_1024_check_public_key, 1);
+    rb_define_module_function(mPQCrypto, "ml_kem_1024_check_secret_key",
+                              pqcrypto_ml_kem_1024_check_secret_key, 1);
+    rb_define_module_function(mPQCrypto, "ml_dsa_check_secret_key",
+                              pqcrypto_ml_dsa_check_secret_key, 1);
+    rb_define_module_function(mPQCrypto, "ml_dsa_44_check_secret_key",
+                              pqcrypto_ml_dsa_44_check_secret_key, 1);
+    rb_define_module_function(mPQCrypto, "ml_dsa_87_check_secret_key",
+                              pqcrypto_ml_dsa_87_check_secret_key, 1);
     rb_define_module_function(mPQCrypto, "hybrid_kem_keypair", pqcrypto_hybrid_kem_keypair, 0);
     rb_define_module_function(mPQCrypto, "hybrid_kem_encapsulate", pqcrypto_hybrid_kem_encapsulate,
                               1);

data/ext/pqcrypto/pqcrypto_secure.c

@@ -265,12 +265,64 @@ cleanup:
             return PQ_ERROR_BUFFER;                                                          \
         }                                                                                    \
         return native##_dec(ss, ct, sk) == 0 ? PQ_SUCCESS : PQ_ERROR_DECAPSULATE;            \
+    }                                                                                        \
+    int pq_##prefix##_check_public_key(const uint8_t *pk) {                                  \
+        int rc;                                                                              \
+        if (!pk) {                                                                           \
+            return PQ_ERROR_BUFFER;                                                          \
+        }                                                                                    \
+        rc = native##_check_pk(pk);                                                          \
+        if (rc == 0) {                                                                       \
+            return PQ_SUCCESS;                                                               \
+        }                                                                                    \
+        if (rc == -2) {                                                                      \
+            return PQ_ERROR_NOMEM;                                                           \
+        }                                                                                    \
+        return PQ_ERROR_INVALID_PUBLIC_KEY;                                                  \
+    }                                                                                        \
+    int pq_##prefix##_check_secret_key(const uint8_t *sk) {                                  \
+        int rc;                                                                              \
+        if (!sk) {                                                                           \
+            return PQ_ERROR_BUFFER;                                                          \
+        }                                                                                    \
+        rc = native##_check_sk(sk);                                                          \
+        if (rc == 0) {                                                                       \
+            return PQ_SUCCESS;                                                               \
+        }                                                                                    \
+        if (rc == -2) {                                                                      \
+            return PQ_ERROR_NOMEM;                                                           \
+        }                                                                                    \
+        return PQ_ERROR_INVALID_SECRET_KEY;                                                  \
     }
 
 PQ_MLKEM_VARIANTS(PQ_DEFINE_MLKEM_SHIMS)
 
 #undef PQ_DEFINE_MLKEM_SHIMS
 
+#define PQ_DEFINE_MLDSA_CHECK_SK(prefix, native, pk_bytes)  \
+    int pq_##prefix##_check_secret_key(const uint8_t *sk) { \
+        uint8_t pk[(pk_bytes)];                             \
+        int rc;                                             \
+        if (!sk) {                                          \
+            return PQ_ERROR_BUFFER;                         \
+        }                                                   \
+        rc = native##_pk_from_sk(pk, sk);                   \
+        pq_secure_wipe(pk, sizeof(pk));                     \
+        if (rc == 0) {                                      \
+            return PQ_SUCCESS;                              \
+        }                                                   \
+        if (rc == -2) {                                     \
+            return PQ_ERROR_NOMEM;                          \
+        }                                                   \
+        return PQ_ERROR_INVALID_SECRET_KEY;                 \
+    }
+
+PQ_DEFINE_MLDSA_CHECK_SK(mldsa, pqcr_mldsa65, MLDSA65_PUBLICKEYBYTES)
+PQ_DEFINE_MLDSA_CHECK_SK(mldsa44, pqcr_mldsa44, MLDSA44_PUBLICKEYBYTES)
+PQ_DEFINE_MLDSA_CHECK_SK(mldsa87, pqcr_mldsa87, MLDSA87_PUBLICKEYBYTES)
+
+#undef PQ_DEFINE_MLDSA_CHECK_SK
+
 static int pq_testing_mlkem_keypair_from_seed_with(uint8_t *public_key, uint8_t *secret_key,
                                                    const uint8_t *seed, size_t seed_len,
                                                    int (*keypair_derand)(uint8_t *, uint8_t *,
@@ -322,27 +374,29 @@ PQ_DEFINE_MLDSA_SIGN_KEYPAIR(mldsa87_sign, pqcr_mldsa87)
 
 #undef PQ_DEFINE_MLDSA_SIGN_KEYPAIR
 
-#define PQ_DEFINE_MLDSA_SIGN(name, native)                                                      \
-    int pq_##name(uint8_t *signature, size_t *signature_len, const uint8_t *message,            \
-                  size_t message_len, const uint8_t *ctx, size_t ctx_len,                       \
-                  const uint8_t *secret_key) {                                                  \
-        if (!signature || !signature_len || !secret_key || (message_len > 0 && !message) ||     \
-            (ctx_len > 0 && !ctx) || ctx_len > 255) {                                           \
-            return PQ_ERROR_BUFFER;                                                             \
-        }                                                                                       \
-        return native##_signature(signature, signature_len, message, message_len, ctx, ctx_len, \
-                                  secret_key) == 0                                              \
-                   ? PQ_SUCCESS                                                                 \
-                   : PQ_ERROR_SIGN;                                                             \
-    }
-
-PQ_DEFINE_MLDSA_SIGN(sign, pqcr_mldsa65)
-PQ_DEFINE_MLDSA_SIGN(mldsa44_sign, pqcr_mldsa44)
-PQ_DEFINE_MLDSA_SIGN(mldsa87_sign, pqcr_mldsa87)
+#define PQ_DEFINE_MLDSA_SIGN(name, native, sig_bytes)                                             \
+    int pq_##name(uint8_t *signature, size_t *signature_len, const uint8_t *message,              \
+                  size_t message_len, const uint8_t *ctx, size_t ctx_len,                         \
+                  const uint8_t *secret_key) {                                                    \
+        if (!signature || !signature_len || !secret_key || (message_len > 0 && !message) ||       \
+            (ctx_len > 0 && !ctx) || ctx_len > 255) {                                             \
+            return PQ_ERROR_BUFFER;                                                               \
+        }                                                                                         \
+        if (native##_signature(signature, message, message_len, ctx, ctx_len, secret_key) != 0) { \
+            *signature_len = 0;                                                                   \
+            return PQ_ERROR_SIGN;                                                                 \
+        }                                                                                         \
+        *signature_len = (size_t)(sig_bytes);                                                     \
+        return PQ_SUCCESS;                                                                        \
+    }
+
+PQ_DEFINE_MLDSA_SIGN(sign, pqcr_mldsa65, MLDSA65_BYTES)
+PQ_DEFINE_MLDSA_SIGN(mldsa44_sign, pqcr_mldsa44, MLDSA44_BYTES)
+PQ_DEFINE_MLDSA_SIGN(mldsa87_sign, pqcr_mldsa87, MLDSA87_BYTES)
 
 #undef PQ_DEFINE_MLDSA_SIGN
 
-#define PQ_DEFINE_MLDSA_VERIFY(name, native)                                                       \
+#define PQ_DEFINE_MLDSA_VERIFY(name, native, sig_bytes)                                            \
     int pq_##name(const uint8_t *signature, size_t signature_len, const uint8_t *message,          \
                   size_t message_len, const uint8_t *ctx, size_t ctx_len,                          \
                   const uint8_t *public_key) {                                                     \
@@ -350,29 +404,32 @@ PQ_DEFINE_MLDSA_SIGN(mldsa87_sign, pqcr_mldsa87)
             ctx_len > 255) {                                                                       \
             return PQ_ERROR_BUFFER;                                                                \
         }                                                                                          \
-        return native##_verify(signature, signature_len, message, message_len, ctx, ctx_len,       \
-                               public_key) == 0                                                    \
+        if (signature_len != (size_t)(sig_bytes)) {                                                \
+            return PQ_ERROR_VERIFY;                                                                \
+        }                                                                                          \
+        return native##_verify(signature, message, message_len, ctx, ctx_len, public_key) == 0     \
                    ? PQ_SUCCESS                                                                    \
                    : PQ_ERROR_VERIFY;                                                              \
     }
 
-PQ_DEFINE_MLDSA_VERIFY(verify, pqcr_mldsa65)
-PQ_DEFINE_MLDSA_VERIFY(mldsa44_verify, pqcr_mldsa44)
-PQ_DEFINE_MLDSA_VERIFY(mldsa87_verify, pqcr_mldsa87)
+PQ_DEFINE_MLDSA_VERIFY(verify, pqcr_mldsa65, MLDSA65_BYTES)
+PQ_DEFINE_MLDSA_VERIFY(mldsa44_verify, pqcr_mldsa44, MLDSA44_BYTES)
+PQ_DEFINE_MLDSA_VERIFY(mldsa87_verify, pqcr_mldsa87, MLDSA87_BYTES)
 
 #undef PQ_DEFINE_MLDSA_VERIFY
 
 static int pq_testing_mldsa_sign_from_seed_with(
     uint8_t *signature, size_t *signature_len, const uint8_t *message, size_t message_len,
-    const uint8_t *secret_key, const uint8_t *seed, size_t seed_len,
-    int (*signature_internal)(uint8_t *, size_t *, const uint8_t *, size_t, const uint8_t *, size_t,
+    const uint8_t *secret_key, const uint8_t *seed, size_t seed_len, size_t expected_signature_len,
+    int (*signature_internal)(uint8_t *, const uint8_t *, size_t, const uint8_t *, size_t,
                               const uint8_t *, const uint8_t *, int),
     size_t (*prepare_prefix)(uint8_t *, const uint8_t *, size_t, const uint8_t *, size_t, int)) {
     uint8_t pre[MLDSA_DOMAIN_SEPARATION_MAX_BYTES];
     size_t pre_len;
 
     if (!signature || !signature_len || !secret_key || !seed || seed_len != MLDSA_RNDBYTES ||
-        !signature_internal || !prepare_prefix || (message_len > 0 && !message)) {
+        !signature_internal || !prepare_prefix || expected_signature_len == 0 ||
+        (message_len > 0 && !message)) {
         return PQ_ERROR_BUFFER;
     }
 
@@ -385,13 +442,18 @@ static int pq_testing_mldsa_sign_from_seed_with(
      */
     pre_len = prepare_prefix(pre, NULL, 0, NULL, 0, MLDSA_PREHASH_NONE);
     if (pre_len == 0) {
+        *signature_len = 0;
         return PQ_ERROR_SIGN;
     }
 
-    return signature_internal(signature, signature_len, message, message_len, pre, pre_len, seed,
-                              secret_key, 0) == 0
-               ? PQ_SUCCESS
-               : PQ_ERROR_SIGN;
+    if (signature_internal(signature, message, message_len, pre, pre_len, seed, secret_key, 0) !=
+        0) {
+        *signature_len = 0;
+        return PQ_ERROR_SIGN;
+    }
+
+    *signature_len = expected_signature_len;
+    return PQ_SUCCESS;
 }
 
 int pq_mldsa44_keypair_from_seed(uint8_t *public_key, uint8_t *secret_key, const uint8_t *seed32) {
@@ -447,7 +509,7 @@ int pq_testing_mldsa_sign_from_seed(uint8_t *signature, size_t *signature_len,
                                     const uint8_t *secret_key, const uint8_t *seed,
                                     size_t seed_len) {
     return pq_testing_mldsa_sign_from_seed_with(
-        signature, signature_len, message, message_len, secret_key, seed, seed_len,
+        signature, signature_len, message, message_len, secret_key, seed, seed_len, MLDSA65_BYTES,
         pqcr_mldsa65_signature_internal, pqcr_mldsa65_prepare_domain_separation_prefix);
 }
 
@@ -456,7 +518,7 @@ int pq_testing_mldsa44_sign_from_seed(uint8_t *signature, size_t *signature_len,
                                       const uint8_t *secret_key, const uint8_t *seed,
                                       size_t seed_len) {
     return pq_testing_mldsa_sign_from_seed_with(
-        signature, signature_len, message, message_len, secret_key, seed, seed_len,
+        signature, signature_len, message, message_len, secret_key, seed, seed_len, MLDSA44_BYTES,
         pqcr_mldsa44_signature_internal, pqcr_mldsa44_prepare_domain_separation_prefix);
 }
 
@@ -465,7 +527,7 @@ int pq_testing_mldsa87_sign_from_seed(uint8_t *signature, size_t *signature_len,
                                       const uint8_t *secret_key, const uint8_t *seed,
                                       size_t seed_len) {
     return pq_testing_mldsa_sign_from_seed_with(
-        signature, signature_len, message, message_len, secret_key, seed, seed_len,
+        signature, signature_len, message, message_len, secret_key, seed, seed_len, MLDSA87_BYTES,
         pqcr_mldsa87_signature_internal, pqcr_mldsa87_prepare_domain_separation_prefix);
 }
 

data/ext/pqcrypto/pqcrypto_secure.h

@@ -29,7 +29,9 @@ typedef enum {
     PQ_ERROR_RANDOM = -7,
     PQ_ERROR_BUFFER = -8,
     PQ_ERROR_NOMEM = -9,
-    PQ_ERROR_OPENSSL = -10
+    PQ_ERROR_OPENSSL = -10,
+    PQ_ERROR_INVALID_PUBLIC_KEY = -11,
+    PQ_ERROR_INVALID_SECRET_KEY = -12
 } pq_error_t;
 
 typedef struct {
@@ -69,15 +71,13 @@ void pq_secure_wipe(void *ptr, size_t len);
 int pq_mlkem_keypair(uint8_t *public_key, uint8_t *secret_key);
 int pq_mlkem512_keypair(uint8_t *public_key, uint8_t *secret_key);
 int pq_mlkem1024_keypair(uint8_t *public_key, uint8_t *secret_key);
-int pq_mlkem_keypair_from_seed(uint8_t *public_key, uint8_t *secret_key,
-                               const uint8_t *seed64);
-int pq_mlkem512_keypair_from_seed(uint8_t *public_key, uint8_t *secret_key,
-                                  const uint8_t *seed64);
-int pq_mlkem1024_keypair_from_seed(uint8_t *public_key, uint8_t *secret_key,
-                                   const uint8_t *seed64);
+int pq_mlkem_keypair_from_seed(uint8_t *public_key, uint8_t *secret_key, const uint8_t *seed64);
+int pq_mlkem512_keypair_from_seed(uint8_t *public_key, uint8_t *secret_key, const uint8_t *seed64);
+int pq_mlkem1024_keypair_from_seed(uint8_t *public_key, uint8_t *secret_key, const uint8_t *seed64);
 int pq_mlkem_encapsulate(uint8_t *ciphertext, uint8_t *shared_secret, const uint8_t *public_key);
 int pq_mlkem512_encapsulate(uint8_t *ciphertext, uint8_t *shared_secret, const uint8_t *public_key);
-int pq_mlkem1024_encapsulate(uint8_t *ciphertext, uint8_t *shared_secret, const uint8_t *public_key);
+int pq_mlkem1024_encapsulate(uint8_t *ciphertext, uint8_t *shared_secret,
+                             const uint8_t *public_key);
 int pq_mlkem_decapsulate(uint8_t *shared_secret, const uint8_t *ciphertext,
                          const uint8_t *secret_key);
 int pq_mlkem512_decapsulate(uint8_t *shared_secret, const uint8_t *ciphertext,
@@ -85,56 +85,63 @@ int pq_mlkem512_decapsulate(uint8_t *shared_secret, const uint8_t *ciphertext,
 int pq_mlkem1024_decapsulate(uint8_t *shared_secret, const uint8_t *ciphertext,
                              const uint8_t *secret_key);
 
+int pq_mlkem_check_public_key(const uint8_t *public_key);
+int pq_mlkem_check_secret_key(const uint8_t *secret_key);
+int pq_mlkem512_check_public_key(const uint8_t *public_key);
+int pq_mlkem512_check_secret_key(const uint8_t *secret_key);
+int pq_mlkem1024_check_public_key(const uint8_t *public_key);
+int pq_mlkem1024_check_secret_key(const uint8_t *secret_key);
+
+int pq_mldsa_check_secret_key(const uint8_t *secret_key);
+int pq_mldsa44_check_secret_key(const uint8_t *secret_key);
+int pq_mldsa87_check_secret_key(const uint8_t *secret_key);
+
 int pq_sign_keypair(uint8_t *public_key, uint8_t *secret_key);
 int pq_mldsa44_sign_keypair(uint8_t *public_key, uint8_t *secret_key);
 int pq_mldsa87_sign_keypair(uint8_t *public_key, uint8_t *secret_key);
-int pq_mldsa44_keypair_from_seed(uint8_t *public_key, uint8_t *secret_key,
-                                  const uint8_t *seed32);
-int pq_mldsa_keypair_from_seed(uint8_t *public_key, uint8_t *secret_key,
-                               const uint8_t *seed32);
-int pq_mldsa87_keypair_from_seed(uint8_t *public_key, uint8_t *secret_key,
-                                  const uint8_t *seed32);
+int pq_mldsa44_keypair_from_seed(uint8_t *public_key, uint8_t *secret_key, const uint8_t *seed32);
+int pq_mldsa_keypair_from_seed(uint8_t *public_key, uint8_t *secret_key, const uint8_t *seed32);
+int pq_mldsa87_keypair_from_seed(uint8_t *public_key, uint8_t *secret_key, const uint8_t *seed32);
 int pq_sign(uint8_t *signature, size_t *signature_len, const uint8_t *message, size_t message_len,
             const uint8_t *ctx, size_t ctx_len, const uint8_t *secret_key);
-int pq_mldsa44_sign(uint8_t *signature, size_t *signature_len, const uint8_t *message, size_t message_len,
-                    const uint8_t *ctx, size_t ctx_len, const uint8_t *secret_key);
-int pq_mldsa87_sign(uint8_t *signature, size_t *signature_len, const uint8_t *message, size_t message_len,
-                    const uint8_t *ctx, size_t ctx_len, const uint8_t *secret_key);
+int pq_mldsa44_sign(uint8_t *signature, size_t *signature_len, const uint8_t *message,
+                    size_t message_len, const uint8_t *ctx, size_t ctx_len,
+                    const uint8_t *secret_key);
+int pq_mldsa87_sign(uint8_t *signature, size_t *signature_len, const uint8_t *message,
+                    size_t message_len, const uint8_t *ctx, size_t ctx_len,
+                    const uint8_t *secret_key);
 int pq_verify(const uint8_t *signature, size_t signature_len, const uint8_t *message,
               size_t message_len, const uint8_t *ctx, size_t ctx_len, const uint8_t *public_key);
 int pq_mldsa44_verify(const uint8_t *signature, size_t signature_len, const uint8_t *message,
-                      size_t message_len, const uint8_t *ctx, size_t ctx_len, const uint8_t *public_key);
+                      size_t message_len, const uint8_t *ctx, size_t ctx_len,
+                      const uint8_t *public_key);
 int pq_mldsa87_verify(const uint8_t *signature, size_t signature_len, const uint8_t *message,
-                      size_t message_len, const uint8_t *ctx, size_t ctx_len, const uint8_t *public_key);
+                      size_t message_len, const uint8_t *ctx, size_t ctx_len,
+                      const uint8_t *public_key);
 
 int pq_public_key_to_pqc_container_der(uint8_t **output, size_t *output_len,
-                                       const uint8_t *public_key,
-                                       size_t public_key_len, const char *algorithm);
-int pq_public_key_to_pqc_container_pem(char **output, size_t *output_len,
-                                       const uint8_t *public_key,
+                                       const uint8_t *public_key, size_t public_key_len,
+                                       const char *algorithm);
+int pq_public_key_to_pqc_container_pem(char **output, size_t *output_len, const uint8_t *public_key,
                                        size_t public_key_len, const char *algorithm);
 int pq_secret_key_to_pqc_container_der(uint8_t **output, size_t *output_len,
-                                        const uint8_t *secret_key,
-                                        size_t secret_key_len, const char *algorithm);
-int pq_secret_key_to_pqc_container_pem(char **output, size_t *output_len,
-                                        const uint8_t *secret_key,
-                                        size_t secret_key_len, const char *algorithm);
+                                       const uint8_t *secret_key, size_t secret_key_len,
+                                       const char *algorithm);
+int pq_secret_key_to_pqc_container_pem(char **output, size_t *output_len, const uint8_t *secret_key,
+                                       size_t secret_key_len, const char *algorithm);
 int pq_public_key_from_pqc_container_der(char **algorithm_out, uint8_t **key_out,
                                          size_t *key_len_out, const uint8_t *input,
                                          size_t input_len);
 int pq_public_key_from_pqc_container_pem(char **algorithm_out, uint8_t **key_out,
-                                         size_t *key_len_out, const char *input,
-                                         size_t input_len);
+                                         size_t *key_len_out, const char *input, size_t input_len);
 int pq_secret_key_from_pqc_container_der(char **algorithm_out, uint8_t **key_out,
-                                          size_t *key_len_out, const uint8_t *input,
-                                          size_t input_len);
+                                         size_t *key_len_out, const uint8_t *input,
+                                         size_t input_len);
 int pq_secret_key_from_pqc_container_pem(char **algorithm_out, uint8_t **key_out,
-                                          size_t *key_len_out, const char *input,
-                                          size_t input_len);
+                                         size_t *key_len_out, const char *input, size_t input_len);
 
-int pq_pkcs8_private_key_info_to_der(uint8_t **output, size_t *output_len,
-                                     const char *oid_text, const uint8_t *private_key,
-                                     size_t private_key_len);
+int pq_pkcs8_private_key_info_to_der(uint8_t **output, size_t *output_len, const char *oid_text,
+                                     const uint8_t *private_key, size_t private_key_len);
 int pq_pkcs8_private_key_info_from_der(char **oid_text_out, uint8_t **private_key_out,
                                        size_t *private_key_len_out, const uint8_t *input,
                                        size_t input_len);
@@ -143,9 +150,8 @@ int pq_pkcs8_encrypt_private_key_info_der(uint8_t **output, size_t *output_len,
                                           const char *passphrase, size_t passphrase_len,
                                           int iterations);
 int pq_pkcs8_decrypt_private_key_info_der(uint8_t **output, size_t *output_len,
-                                          const uint8_t *encrypted_der,
-                                          size_t encrypted_der_len, const char *passphrase,
-                                          size_t passphrase_len);
+                                          const uint8_t *encrypted_der, size_t encrypted_der_len,
+                                          const char *passphrase, size_t passphrase_len);
 int pq_pkcs8_der_is_encrypted_private_key_info(const uint8_t *input, size_t input_len);
 int pq_pkcs8_der_to_pem(char **output, size_t *output_len, const uint8_t *der, size_t der_len,
                         int encrypted);
@@ -197,7 +203,7 @@ const char *pq_version(void);
 #define PQ_MLKEM_CIPHERTEXTBYTES   MLKEM_CIPHERTEXTBYTES
 #define PQ_MLKEM_SHAREDSECRETBYTES MLKEM_SHAREDSECRETBYTES
 
-#define PQ_HYBRID_PUBLICKEYBYTES    HYBRID_PUBLICKEYBYTES
+#define PQ_HYBRID_PUBLICKEYBYTES          HYBRID_PUBLICKEYBYTES
 #define PQ_HYBRID_SECRETKEYBYTES          HYBRID_SECRETKEYBYTES
 #define PQ_HYBRID_EXPANDED_SECRETKEYBYTES HYBRID_EXPANDED_SECRETKEYBYTES
 #define PQ_HYBRID_CIPHERTEXTBYTES         HYBRID_CIPHERTEXTBYTES
@@ -215,15 +221,27 @@ int pq_mldsa_extract_tr_from_secret_key(uint8_t *tr_out, const uint8_t *secret_k
 int pq_mldsa_compute_tr_from_public_key(uint8_t *tr_out, const uint8_t *public_key,
                                         size_t public_key_len);
 
-int pq_sign_mu(uint8_t *signature, size_t *signature_len,
-               const uint8_t *mu, const uint8_t *secret_key,
+int pq_mldsa44_signature_extmu_compat(uint8_t *sig, size_t *siglen, const uint8_t *mu,
+                                      const uint8_t *sk);
+int pq_mldsa65_signature_extmu_compat(uint8_t *sig, size_t *siglen, const uint8_t *mu,
+                                      const uint8_t *sk);
+int pq_mldsa87_signature_extmu_compat(uint8_t *sig, size_t *siglen, const uint8_t *mu,
+                                      const uint8_t *sk);
+int pq_mldsa44_verify_extmu_compat(const uint8_t *sig, size_t siglen, const uint8_t *mu,
+                                   const uint8_t *pk);
+int pq_mldsa65_verify_extmu_compat(const uint8_t *sig, size_t siglen, const uint8_t *mu,
+                                   const uint8_t *pk);
+int pq_mldsa87_verify_extmu_compat(const uint8_t *sig, size_t siglen, const uint8_t *mu,
+                                   const uint8_t *pk);
+
+int pq_sign_mu(uint8_t *signature, size_t *signature_len, const uint8_t *mu,
+               const uint8_t *secret_key,
                int (*signature_extmu)(uint8_t *, size_t *, const uint8_t *, const uint8_t *));
-int pq_verify_mu(const uint8_t *signature, size_t signature_len,
-                 const uint8_t *mu, const uint8_t *public_key, size_t expected_signature_len,
+int pq_verify_mu(const uint8_t *signature, size_t signature_len, const uint8_t *mu,
+                 const uint8_t *public_key, size_t expected_signature_len,
                  int (*verify_extmu)(const uint8_t *, size_t, const uint8_t *, const uint8_t *));
 void *pq_mu_builder_new(void);
-int pq_mu_builder_init(void *state, const uint8_t *tr,
-                       const uint8_t *ctx, size_t ctxlen);
+int pq_mu_builder_init(void *state, const uint8_t *tr, const uint8_t *ctx, size_t ctxlen);
 int pq_mu_builder_absorb(void *state, const uint8_t *chunk, size_t chunk_len);
 int pq_mu_builder_finalize(void *state, uint8_t *mu_out);
 void pq_mu_builder_release(void *state);

data/ext/pqcrypto/pqcrypto_version.h

@@ -2,6 +2,6 @@
 #ifndef PQCRYPTO_VERSION_H
 #define PQCRYPTO_VERSION_H
 
-#define PQCRYPTO_VERSION "0.6.5"
+#define PQCRYPTO_VERSION "0.6.7"
 
 #endif

data/ext/pqcrypto/vendor/.vendored

@@ -2,11 +2,11 @@
 backend=PQ Code Package native only
 pqclean=removed
 mlkem_native_repo=https://github.com/pq-code-package/mlkem-native.git
-mlkem_native_ref=v1.3.0
-mlkem_native_commit=398050c877ff4353c96305c6434b63528accfc37
-mlkem_native_tree_sha256=3cd7af93cde256f73ce5ffde3ac3accd31e4361616e275f1bf1c39d462c2149e
+mlkem_native_ref=v2.0.0
+mlkem_native_commit=d1b2fe782888bdb761a50336012923180be7f502
+mlkem_native_tree_sha256=18bfa9ea4e2232bdf56f8ec374b62d10e50b99a30cb08aafc18d0b97e00cd06f
 mldsa_native_repo=https://github.com/pq-code-package/mldsa-native.git
-mldsa_native_ref=v1.0.0-beta2
-mldsa_native_commit=9b0ee84f4cf399043eca59eca4e5f8531ca1d61b
-mldsa_native_tree_sha256=2887f59926c18a877e8c5a5e30727e84497c357032093d00d7135aedf53f011e
-manifest_sha256=6fc387662d86d42905f6cbed29c92bc83abf18e8678a21500eb27fce14a89c7d
+mldsa_native_ref=v2.0.0
+mldsa_native_commit=834a90d5e846ffa1e1611bd24e160bb2e9b86d35
+mldsa_native_tree_sha256=25b3c3949d2ed37d1ad5d4722c8476d13deb2a0bb945f12444f463378d69375d
+manifest_sha256=4bcf7cc4d0ac0d0e66ebb9612042960dc1197838f26bbedb16e3b6a3978e264c

data/ext/pqcrypto/vendor/mldsa-native/BUILDING.md

@@ -73,11 +73,14 @@ For detailed information on how to use the script, please refer to
 
 You can also build **mldsa-native** on Windows using `nmake` and an MSVC compiler.
 
-To build and run the tests (only support functional testing for non-opt implementation for now), use the following `nmake` targets:
+To build and run the tests, use the following `nmake` target:
 ```powershell
-nmke /f .\Makefile.Microsoft_nmake quickcheck
+nmake /f .\Makefile.Microsoft_nmake quickcheck
 ```
 
+This runs the functional, RNG-failure, allocation, ACVP, KAT and Wycheproof tests. The assembly backends are not yet
+supported on Windows, so the tests are built for the C backend only.
+
 # Checking the proofs
 
 ## CBMC

data/ext/pqcrypto/vendor/mldsa-native/LICENSE

@@ -6,14 +6,33 @@ implementation are made available under the Apache-2.0 license OR
 the ISC license OR the MIT license. These licenses are
 reproduced at the bottom of this file.
 
-The code in test/notrandombytes/* is derived from
+Files outside the library itself may carry different terms. Every file
+states its own SPDX-License-Identifier, which determines the terms that
+apply to it. In particular:
+
+The code in test/notrandombytes/*, and its copies in
+examples/*/test_only_rng/* and scripts/notrandombytes, is derived from
 https://cr.yp.to/papers.html#surf and licensed under
 LicenseRef-PD-hp OR CC0-1.0 OR 0BSD OR MIT-0 OR MIT.
 It is only used for testing purposes.
 
-The benchmarking code in test/hal/hal.c carries the
+The benchmarking code in test/hal/* carries the
 MIT license. It is only used for testing purposes.
 
+The tiny_sha3 code in
+examples/bring_your_own_fips202/custom_fips202/tiny_sha3/* and
+examples/custom_backend/mldsa_native/src/fips202/native/custom/src/*
+carries the MIT license. It is only used to demonstrate custom
+FIPS-202 implementations.
+
+The proofs in proofs/* are in part derived from Amazon Web Services
+verification infrastructure and licensed under
+Apache-2.0 OR ISC OR MIT-0, MIT-0, or MIT-0 AND Apache-2.0. The IACR
+document class proofs/isabelle/neon_ntt/document/iacrtrans.cls is
+licensed under CC0-1.0. None of this is part of the library.
+
+Documentation is licensed under CC-BY-4.0.
+
 ```
 Copyright (c) The mldsa-native project authors
 Copyright (c) The mlkem-native project authors