pq_crypto 0.6.6 → 0.6.8

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 273b83c96db2314540118b933a9f70a22c954e59a6fb38377f7c6cd1f337d698
-  data.tar.gz: 0a6f4b88a3aefde58049f41f582548aa10f2aa939e98a8b60791ff23c8a5be0e
+  metadata.gz: db8e5b65d14cc5dcc4950a2da14b781efcf4c8dd17774cffc076e9d5591509ca
+  data.tar.gz: '09cf8c3e990a416ab0f8f77fe2a2a6067fdd8a3f4d00607a4162e4259d6044bd'
 SHA512:
-  metadata.gz: f4905490a34b75ae7548a896cbb379b135c7615dfba9dca564add76892fb6074a6e0a12220ca3158417ea3264c2dcb2dc432b0a49fa91f8429eaebeef966d895
-  data.tar.gz: 854941b5a331956cba2aa91ef1777148f9a93713eec6ce746fe01475b126b69f409ad0dbcf631a1db5c7c09d127d55053d59585850bcf06a8047f8b2ae14adec
+  metadata.gz: 81a8509efb9d280100975a8e4a9a0a6aab70061b49bbc48a396de490723c316abe63442cfb041c68dbeefd9383fba647b198318082723ffb9bace9d0ffd12c78
+  data.tar.gz: 1055665295f23df22a53880fbf02a2e8d0c0cb33f1b65a43b1fe2f1f040da829bcaf4895440093addc432f15fb9c21792f28bf41e2949c90b9c93bc2784e5e93

data/CHANGELOG.md

@@ -1,5 +1,113 @@
 # Changelog
 
+## [0.6.8] - 2026-10-28
+
+### Changed
+
+- **Refactored Ruby serialization and streaming paths.** Split SPKI and PKCS#8
+  decoding into focused validation steps, shared the seed/expanded-key codecs,
+  and consolidated ML-DSA streaming builder cleanup. SPKI algorithm matching
+  now uses one shared validator. Public APIs and encoded formats are unchanged.
+
+## [0.6.7] - 2026-08-10
+
+### Fixed
+
+- **DER parsers could raise exceptions outside the `PQCrypto::Error` hierarchy.**
+  `OpenSSL::ASN1.decode` raises more than `OpenSSL::ASN1::ASN1Error`, and
+  re-encoding a successfully decoded object can fail as well. Three shapes
+  escaped the previous handling in `PQCrypto::SPKI`:
+
+  - `"\x0A\x01\xFF"` (ENUMERATED) raised `OpenSSL::OpenSSLError`
+  - `"\x17\x00"` / `"\x18\x00"` (empty UTCTIME / GENERALIZEDTIME) raised `TypeError`
+  - `"\x10\x00"` (universal SEQUENCE tag without the constructed bit) decoded
+    cleanly but raised `TypeError` from the `to_der` round trip used for the
+    trailing-data check
+
+  `TypeError` does not descend from `OpenSSL::OpenSSLError`, so widening the
+  rescue to the OpenSSL base class alone was not sufficient. Both rescue sites
+  now catch `OpenSSL::OpenSSLError, TypeError`, and `SPKI.decode_der` is guarded
+  end to end rather than only around the decode call.
+
+  Impact: code written as `rescue PQCrypto::Error` around key loading could be
+  bypassed by malformed input. No memory-safety consequence. Covered by a
+  systematic tag sweep over 1,280 DER shapes × three entry points
+  (`Key.from_der`, `SPKI.decode_der`, `PKCS8.decode_der`).
+
+### Added
+
+- **FIPS 203 key validation for ML-KEM (boundary diagnostics).** mlkem-native
+  v2 exposes `check_pk` and `check_sk`, which this gem did not use. Both are
+  now wired in and run when a `PQCrypto::KEM::PublicKey` or `SecretKey` is
+  constructed:
+
+  - public keys get the Section 7.2 modulus check (coefficients in `[0,q-1]`)
+  - secret keys get the Section 7.3 hash check (`H(pk)` embedded in the sk)
+
+  Scope limits (intentional, matching FIPS 203):
+
+  - these checks are **diagnostics at import**, not a substitute for the
+    checks already performed inside encapsulation / decapsulation
+  - Section 7.3 does **not** detect a corrupted IND-CPA secret (`dk`) when
+    the embedded `H(pk)` is still intact — `#valid?` can still be true
+  - X-Wing public keys validate only the ML-KEM-768 half; the X25519 half is
+    unrestricted. X-Wing secret keys are 32-byte seeds and are not structure-
+    checked
+
+  `#valid?` is exposed on both key classes. Failures raise
+  `PQCrypto::InvalidKeyError`. Public-key internal buffers are frozen after
+  construction to block post-validation mutation; secret-key buffers stay
+  mutable so `#wipe!` can still zero them in place.
+
+  New C API: `pq_mlkem{,512,1024}_check_public_key` / `_check_secret_key`,
+  plus `PQ_ERROR_INVALID_PUBLIC_KEY` (-11) and `PQ_ERROR_INVALID_SECRET_KEY`
+  (-12). Upstream OOM (`-2`) is mapped to `PQ_ERROR_NOMEM` rather than
+  “invalid key”.
+
+- **ML-DSA secret-key structure check on import.** Expanded ML-DSA secret
+  keys are validated via upstream `pk_from_sk` (coefficient norms, recomputed
+  `t0`, and `tr = H(pk)`). This matches the check mldsa-native documents for
+  importers and is enforced on `Signature::SecretKey` construction with
+  `#valid?` exposed. Public keys remain length-checked only (FIPS 204 has no
+  ML-KEM-style modulus check for the public key).
+
+  The check runs on import only. Keys produced by this process's own key
+  generation are valid by construction, and `pk_from_sk` re-derives the public
+  key, so validating them would roughly double the cost of every ML-DSA
+  keypair. Upstream also documents `pk_from_sk` as leaking secret-key validity
+  through its return value and timing.
+
+  New C API: `pq_mldsa{,44,87}_check_secret_key`.
+
+- **`PQCRYPTO_KEYGEN_PCT=1` build option.** Enables the FIPS 140-3 pairwise
+  consistency test in both backends (`MLK_CONFIG_KEYGEN_PCT` /
+  `MLD_CONFIG_KEYGEN_PCT`): after generating a keypair it is exercised to catch
+  a faulty RNG or memory corruption at generation time. Upstream ships this
+  opt-in because it makes key generation noticeably more expensive, and it stays
+  opt-in here for the same reason. The selected setting is reported in the
+  build configuration banner.
+
+- **`require_encrypted:` for PKCS#8 loading.** Supplying a passphrase states an
+  expectation that the key at rest is encrypted, but an unencrypted
+  PrivateKeyInfo was previously accepted and the passphrase left unused. An
+  encrypted key file replaced with a plaintext one therefore loaded without
+  complaint.
+
+  `require_encrypted: true` enforces that the input is an
+  EncryptedPrivateKeyInfo (DER content, not PEM label — relabeling a plaintext
+  key as `ENCRYPTED PRIVATE KEY` does not satisfy the policy). Available on
+  `PKCS8.decode_der` / `decode_pem`, `Key.from_der` / `from_pem`, and
+  `secret_key_from_pkcs8_der` / `_pem` on both `KEM` and `Signature`.
+
+  Limits (documented so the flag is not over-read):
+
+  - default is `false`; other loaders (`from_bytes`, `pqc_container_*`) are
+    unchanged
+  - the flag checks **format**, not passphrase strength (empty passphrase and
+    low PBKDF iterations still count as encrypted)
+  - the value must be a real boolean (`true`/`false`); strings like `"false"`
+    raise `ArgumentError` instead of being treated as truthy
+
 ## [0.6.6] - 2026-08-10
 
 ### Changed

data/README.md

@@ -101,6 +101,13 @@ can be tested explicitly with:
 PQCRYPTO_NATIVE_ASM=1 bundle exec rake compile
 ```
 
+The FIPS 140-3 pairwise consistency test is available but off by default,
+because it makes key generation noticeably more expensive:
+
+```bash
+PQCRYPTO_KEYGEN_PCT=1 bundle exec rake compile
+```
+
 ## Security status
 
 `pq_crypto` is experimental and not audited. Treat it as a low-level primitive
@@ -125,8 +132,12 @@ PQCrypto::Signature.secret_key_from_seed(:ml_dsa_65, seed_32_bytes)
 
 PQCrypto::HybridKEM.generate(:ml_kem_768_x25519_xwing)
 PQCrypto::Key.from_pem(pem, passphrase: passphrase)
+PQCrypto::Key.from_pem(pem, passphrase: passphrase, require_encrypted: true)
+keypair.public_key.valid?  # ML-KEM structure check; ML-DSA public keys are length-only
+keypair.secret_key.valid?
 ```
 
+
 ## More examples
 
 Detailed usage examples live in [`GET_STARTED.md`](GET_STARTED.md):

data/SECURITY.md

@@ -127,6 +127,52 @@ into `mldsa-native` `signature_internal`; for an empty context this prefix is
 Outside of test-only deterministic calls, production randomness delegates
 directly to OpenSSL `RAND_bytes`.
 
+## Key import validation (0.6.7+)
+
+ML-KEM public/secret keys and ML-DSA secret keys are structure-checked when
+the corresponding Ruby key objects are constructed:
+
+| Object | Check | Source |
+| --- | --- | --- |
+| `KEM::PublicKey` | FIPS 203 §7.2 modulus check | `check_pk` |
+| `KEM::SecretKey` | FIPS 203 §7.3 `H(pk)` check | `check_sk` |
+| `Signature::SecretKey` | norms / `t0` / `tr` consistency | `pk_from_sk` |
+| `Signature::PublicKey` | length only | — |
+| X-Wing public key | ML-KEM-768 half only | `check_pk` |
+| X-Wing secret key | none (32-byte seed) | — |
+
+These are **import diagnostics**. Encapsulation, decapsulation, signing, and
+verification still apply their own backend checks. A true `#valid?` result
+does not prove full cryptographic integrity of every field (for example an
+ML-KEM secret key with a corrupted IND-CPA `dk` but intact `H(pk)` still
+passes §7.3).
+
+The checks run on import. Keys produced by this process's own key generation
+are valid by construction and are not re-checked, because the ML-DSA check
+re-derives the public key and would roughly double the cost of every keypair.
+
+The ML-DSA check (`pk_from_sk`) is documented upstream as leaking whether the
+secret key is valid, through both its return value and its timing.
+
+`require_encrypted:` applies only to the PKCS#8 branch. `PQCrypto::Key.from_der`
+and `.from_pem` also accept SPKI public keys, and for those inputs the flag has
+no effect and is silently ignored.
+
+Public-key internal buffers are frozen after construction. Secret-key buffers
+remain mutable so `#wipe!` can zero them.
+
+### `require_encrypted:`
+
+`require_encrypted: true` on PKCS#8 loaders rejects plaintext PrivateKeyInfo
+and requires EncryptedPrivateKeyInfo (classified from DER, not PEM labels).
+It does **not**:
+
+- apply to `from_bytes` / `pqc_container_*` loaders
+- enforce passphrase quality or PBKDF iteration count
+- default on (default remains `false`)
+
+The flag must be a boolean; non-boolean values raise `ArgumentError`.
+
 ## Memory wiping
 
 `PQCrypto.secure_wipe` clears mutable Ruby strings in place. Ruby key objects

data/ext/pqcrypto/extconf.rb

@@ -84,6 +84,8 @@ def env_bool(name, default)
   end
 end
 
+KEYGEN_PCT = env_bool("PQCRYPTO_KEYGEN_PCT", false)
+
 NATIVE_ASM = env_bool("PQCRYPTO_NATIVE_ASM", native_asm_supported_by_default?)
 NATIVE_ARITH = env_bool("PQCRYPTO_NATIVE_ARITH", NATIVE_ASM)
 NATIVE_FIPS202 = env_bool("PQCRYPTO_NATIVE_FIPS202", NATIVE_ASM)
@@ -529,6 +531,7 @@ def native_flags(kind, level, shared:)
   # Upstream has no guard against the stale define, so passing it would be a
   # silently dead -D rather than a build error. Do not reintroduce it.
   flags << (shared ? "-D#{prefix}_CONFIG_MULTILEVEL_WITH_SHARED" : "-D#{prefix}_CONFIG_MULTILEVEL_NO_SHARED")
+  flags << "-D#{prefix}_CONFIG_KEYGEN_PCT" if KEYGEN_PCT
   flags << "-D#{prefix}_CONFIG_USE_NATIVE_BACKEND_ARITH" if NATIVE_ARITH
   flags << "-D#{prefix}_CONFIG_USE_NATIVE_BACKEND_FIPS202" if NATIVE_FIPS202
   flags.join(" ")
@@ -615,6 +618,7 @@ puts "Vendor ASM arch flags: #{VENDOR_ASM_ARCH_FLAGS.empty? ? '(none)' : VENDOR_
 if x86_64_host? && (NATIVE_ARITH || NATIVE_FIPS202)
   puts "x86_64 native backend: AVX2 build flags enabled"
 end
+puts "Keygen PCT (FIPS 140-3): #{KEYGEN_PCT ? 'enabled' : 'disabled'}"
 puts "PQClean fallback: removed"
 puts "Output: pqcrypto/pqcrypto_secure"
 puts "===================================="

data/ext/pqcrypto/pqcrypto_native_api.h

@@ -78,18 +78,24 @@ int pqcr_mlkem512_keypair_derand(uint8_t *pk, uint8_t *sk, const uint8_t *coins)
 int pqcr_mlkem512_enc(uint8_t *ct, uint8_t *ss, const uint8_t *pk);
 int pqcr_mlkem512_enc_derand(uint8_t *ct, uint8_t *ss, const uint8_t *pk, const uint8_t *coins);
 int pqcr_mlkem512_dec(uint8_t *ss, const uint8_t *ct, const uint8_t *sk);
+int pqcr_mlkem512_check_pk(const uint8_t *pk);
+int pqcr_mlkem512_check_sk(const uint8_t *sk);
 
 int pqcr_mlkem768_keypair(uint8_t *pk, uint8_t *sk);
 int pqcr_mlkem768_keypair_derand(uint8_t *pk, uint8_t *sk, const uint8_t *coins);
 int pqcr_mlkem768_enc(uint8_t *ct, uint8_t *ss, const uint8_t *pk);
 int pqcr_mlkem768_enc_derand(uint8_t *ct, uint8_t *ss, const uint8_t *pk, const uint8_t *coins);
 int pqcr_mlkem768_dec(uint8_t *ss, const uint8_t *ct, const uint8_t *sk);
+int pqcr_mlkem768_check_pk(const uint8_t *pk);
+int pqcr_mlkem768_check_sk(const uint8_t *sk);
 
 int pqcr_mlkem1024_keypair(uint8_t *pk, uint8_t *sk);
 int pqcr_mlkem1024_keypair_derand(uint8_t *pk, uint8_t *sk, const uint8_t *coins);
 int pqcr_mlkem1024_enc(uint8_t *ct, uint8_t *ss, const uint8_t *pk);
 int pqcr_mlkem1024_enc_derand(uint8_t *ct, uint8_t *ss, const uint8_t *pk, const uint8_t *coins);
 int pqcr_mlkem1024_dec(uint8_t *ss, const uint8_t *ct, const uint8_t *sk);
+int pqcr_mlkem1024_check_pk(const uint8_t *pk);
+int pqcr_mlkem1024_check_sk(const uint8_t *sk);
 
 void pqcr_mlkem_shake256(uint8_t *output, size_t outlen, const uint8_t *input, size_t inlen);
 void pqcr_mlkem_sha3_256(uint8_t *output, const uint8_t *input, size_t inlen);

data/ext/pqcrypto/pqcrypto_ruby_secure.c

@@ -8,6 +8,8 @@
 #if defined(__clang__) || defined(__GNUC__)
 #pragma GCC diagnostic pop
 #endif
+#include <stdbool.h>
+#include <stdatomic.h>
 #include <stdlib.h>
 #include <string.h>
 
@@ -718,6 +720,12 @@ __attribute__((noreturn)) static void pq_raise_general_error(int err) {
     case PQ_ERROR_OPENSSL:
         rb_raise(ePQCryptoError, "OpenSSL error");
         break;
+    case PQ_ERROR_INVALID_PUBLIC_KEY:
+        rb_raise(ePQCryptoError, "Invalid public key");
+        break;
+    case PQ_ERROR_INVALID_SECRET_KEY:
+        rb_raise(ePQCryptoError, "Invalid secret key");
+        break;
     default:
         rb_raise(ePQCryptoError, "Unknown error: %d", err);
         break;
@@ -765,6 +773,28 @@ static VALUE pq_run_kem_keypair_from_seed(void *(*nogvl)(void *), VALUE seed, si
     X(ml_kem_1024, MLKEM1024_PUBLICKEYBYTES, MLKEM1024_SECRETKEYBYTES, MLKEM1024_CIPHERTEXTBYTES, \
       MLKEM1024_SHAREDSECRETBYTES)
 
+static VALUE pq_run_key_check(int (*check)(const uint8_t *), VALUE key, size_t expected_len) {
+    uint8_t *buffer;
+    size_t copied_len = 0;
+    int result;
+
+    StringValue(key);
+    if ((size_t)RSTRING_LEN(key) != expected_len) {
+        return Qfalse;
+    }
+
+    buffer = pq_copy_ruby_string(key, &copied_len);
+    result = check(buffer);
+    pq_secure_wipe(buffer, copied_len);
+    free(buffer);
+
+    if (result == PQ_ERROR_NOMEM) {
+        rb_raise(rb_eNoMemError, "Memory allocation failed");
+    }
+
+    return result == PQ_SUCCESS ? Qtrue : Qfalse;
+}
+
 #define PQ_DEFINE_RUBY_KEM(rb_name, pk_bytes, sk_bytes, ct_bytes, ss_bytes)                   \
     static VALUE pqcrypto_##rb_name##_keypair(VALUE self) {                                   \
         (void)self;                                                                           \
@@ -787,6 +817,41 @@ static VALUE pq_run_kem_keypair_from_seed(void *(*nogvl)(void *), VALUE seed, si
                                       secret_key, sk_bytes, ss_bytes);                        \
     }
 
+#define PQ_DEFINE_RUBY_KEM_CHECK(rb_name, c_name)                               \
+    static VALUE pqcrypto_##rb_name##_check_public_key(VALUE self, VALUE key) { \
+        (void)self;                                                             \
+        return pq_run_key_check(pq_##c_name##_check_public_key, key,            \
+                                (size_t)c_name##_PUBLICKEYBYTES_VALUE);         \
+    }                                                                           \
+    static VALUE pqcrypto_##rb_name##_check_secret_key(VALUE self, VALUE key) { \
+        (void)self;                                                             \
+        return pq_run_key_check(pq_##c_name##_check_secret_key, key,            \
+                                (size_t)c_name##_SECRETKEYBYTES_VALUE);         \
+    }
+
+#define mlkem_PUBLICKEYBYTES_VALUE     PQ_MLKEM_PUBLICKEYBYTES
+#define mlkem_SECRETKEYBYTES_VALUE     PQ_MLKEM_SECRETKEYBYTES
+#define mlkem512_PUBLICKEYBYTES_VALUE  MLKEM512_PUBLICKEYBYTES
+#define mlkem512_SECRETKEYBYTES_VALUE  MLKEM512_SECRETKEYBYTES
+#define mlkem1024_PUBLICKEYBYTES_VALUE MLKEM1024_PUBLICKEYBYTES
+#define mlkem1024_SECRETKEYBYTES_VALUE MLKEM1024_SECRETKEYBYTES
+
+PQ_KEM_KEYPAIR_NOGVL_VARIANTS(PQ_DEFINE_RUBY_KEM_CHECK)
+
+#undef PQ_DEFINE_RUBY_KEM_CHECK
+
+#define PQ_DEFINE_RUBY_MLDSA_CHECK_SK(rb_name, c_name, sk_bytes)                          \
+    static VALUE pqcrypto_##rb_name##_check_secret_key(VALUE self, VALUE key) {           \
+        (void)self;                                                                       \
+        return pq_run_key_check(pq_##c_name##_check_secret_key, key, (size_t)(sk_bytes)); \
+    }
+
+PQ_DEFINE_RUBY_MLDSA_CHECK_SK(ml_dsa, mldsa, MLDSA65_SECRETKEYBYTES)
+PQ_DEFINE_RUBY_MLDSA_CHECK_SK(ml_dsa_44, mldsa44, MLDSA44_SECRETKEYBYTES)
+PQ_DEFINE_RUBY_MLDSA_CHECK_SK(ml_dsa_87, mldsa87, MLDSA87_SECRETKEYBYTES)
+
+#undef PQ_DEFINE_RUBY_MLDSA_CHECK_SK
+
 PQ_RUBY_KEM_VARIANTS(PQ_DEFINE_RUBY_KEM)
 
 #undef PQ_DEFINE_RUBY_KEM
@@ -1397,6 +1462,7 @@ static VALUE pqcrypto_version(VALUE self) {
 
 typedef struct {
     void *builder;
+    atomic_bool busy;
 } mu_builder_wrapper_t;
 
 typedef struct {
@@ -1463,15 +1529,29 @@ static const rb_data_type_t mu_builder_data_type = {
     .flags = RUBY_TYPED_FREE_IMMEDIATELY,
 };
 
-static mu_builder_wrapper_t *mu_builder_unwrap(VALUE obj) {
+static mu_builder_wrapper_t *mu_builder_lock(VALUE obj) {
     mu_builder_wrapper_t *wrapper;
     TypedData_Get_Struct(obj, mu_builder_wrapper_t, &mu_builder_data_type, wrapper);
-    if (wrapper == NULL || wrapper->builder == NULL) {
-        rb_raise(ePQCryptoError, "mu builder used after release");
+    if (wrapper == NULL) {
+        rb_raise(ePQCryptoError, "mu builder is unavailable");
+    }
+    if (atomic_exchange_explicit(&wrapper->busy, true, memory_order_acquire)) {
+        rb_raise(ePQCryptoError, "mu builder is busy");
     }
     return wrapper;
 }
 
+static void mu_builder_unlock(mu_builder_wrapper_t *wrapper) {
+    atomic_store_explicit(&wrapper->busy, false, memory_order_release);
+}
+
+static void mu_builder_require_active(mu_builder_wrapper_t *wrapper) {
+    if (wrapper->builder == NULL) {
+        mu_builder_unlock(wrapper);
+        rb_raise(ePQCryptoError, "mu builder used after release");
+    }
+}
+
 static VALUE pqcrypto__native_mldsa_extract_tr(int argc, VALUE *argv, VALUE self) {
     (void)self;
     VALUE algorithm = ID2SYM(rb_intern("ml_dsa_65"));
@@ -1551,6 +1631,7 @@ static VALUE pqcrypto__native_mldsa_mu_builder_new(VALUE self, VALUE tr, VALUE c
     VALUE obj =
         TypedData_Make_Struct(rb_cObject, mu_builder_wrapper_t, &mu_builder_data_type, wrapper);
     wrapper->builder = builder;
+    atomic_init(&wrapper->busy, false);
     return obj;
 }
 
@@ -1562,24 +1643,31 @@ static void *pq_mu_absorb_nogvl(void *arg) {
 
 static VALUE pqcrypto__native_mldsa_mu_builder_update(VALUE self, VALUE builder_obj, VALUE chunk) {
     (void)self;
-    mu_builder_wrapper_t *wrapper = mu_builder_unwrap(builder_obj);
     StringValue(chunk);
 
     size_t chunk_len = (size_t)RSTRING_LEN(chunk);
+    mu_builder_wrapper_t *wrapper = mu_builder_lock(builder_obj);
+    mu_builder_require_active(wrapper);
     if (chunk_len == 0) {
+        mu_builder_unlock(wrapper);
         return Qnil;
     }
 
     if (chunk_len < PQ_MU_ABSORB_NOGVL_MIN_BYTES) {
-        int rc =
-            pq_mu_builder_absorb(wrapper->builder, (const uint8_t *)RSTRING_PTR(chunk), chunk_len);
+        int rc = pq_mu_builder_absorb(wrapper->builder,
+                                      (const uint8_t *)RSTRING_PTR(chunk), chunk_len);
+        mu_builder_unlock(wrapper);
         if (rc != PQ_SUCCESS) {
             pq_raise_general_error(rc);
         }
         return Qnil;
     }
 
-    uint8_t *copy = pq_alloc_buffer(chunk_len);
+    uint8_t *copy = malloc(chunk_len);
+    if (copy == NULL) {
+        mu_builder_unlock(wrapper);
+        rb_raise(rb_eNoMemError, "Memory allocation failed");
+    }
     memcpy(copy, RSTRING_PTR(chunk), chunk_len);
 
     mu_absorb_call_t call = {0};
@@ -1588,7 +1676,9 @@ static VALUE pqcrypto__native_mldsa_mu_builder_update(VALUE self, VALUE builder_
     call.chunk_len = chunk_len;
 
     rb_nogvl(pq_mu_absorb_nogvl, &call, NULL, NULL, PQ_RB_NOGVL_OFFLOAD_SAFE);
+    RB_GC_GUARD(builder_obj);
     free(copy);
+    mu_builder_unlock(wrapper);
 
     if (call.result != PQ_SUCCESS) {
         pq_raise_general_error(call.result);
@@ -1604,7 +1694,8 @@ static void *pq_mu_finalize_nogvl(void *arg) {
 
 static VALUE pqcrypto__native_mldsa_mu_builder_finalize(VALUE self, VALUE builder_obj) {
     (void)self;
-    mu_builder_wrapper_t *wrapper = mu_builder_unwrap(builder_obj);
+    mu_builder_wrapper_t *wrapper = mu_builder_lock(builder_obj);
+    mu_builder_require_active(wrapper);
 
     uint8_t mu[PQ_MLDSA_MUBYTES];
 
@@ -1613,8 +1704,10 @@ static VALUE pqcrypto__native_mldsa_mu_builder_finalize(VALUE self, VALUE builde
     call.mu_out = mu;
 
     rb_nogvl(pq_mu_finalize_nogvl, &call, NULL, NULL, PQ_RB_NOGVL_OFFLOAD_SAFE);
+    RB_GC_GUARD(builder_obj);
 
     wrapper->builder = NULL;
+    mu_builder_unlock(wrapper);
 
     if (call.result != PQ_SUCCESS) {
         pq_secure_wipe(mu, sizeof(mu));
@@ -1628,12 +1721,12 @@ static VALUE pqcrypto__native_mldsa_mu_builder_finalize(VALUE self, VALUE builde
 
 static VALUE pqcrypto__native_mldsa_mu_builder_release(VALUE self, VALUE builder_obj) {
     (void)self;
-    mu_builder_wrapper_t *wrapper;
-    TypedData_Get_Struct(builder_obj, mu_builder_wrapper_t, &mu_builder_data_type, wrapper);
-    if (wrapper != NULL && wrapper->builder != NULL) {
+    mu_builder_wrapper_t *wrapper = mu_builder_lock(builder_obj);
+    if (wrapper->builder != NULL) {
         pq_mu_builder_release(wrapper->builder);
         wrapper->builder = NULL;
     }
+    mu_builder_unlock(wrapper);
     return Qnil;
 }
 
@@ -1999,6 +2092,24 @@ void Init_pqcrypto_secure(void) {
                               pqcrypto_ml_kem_1024_encapsulate, 1);
     rb_define_module_function(mPQCrypto, "ml_kem_1024_decapsulate",
                               pqcrypto_ml_kem_1024_decapsulate, 2);
+    rb_define_module_function(mPQCrypto, "ml_kem_check_public_key",
+                              pqcrypto_ml_kem_check_public_key, 1);
+    rb_define_module_function(mPQCrypto, "ml_kem_check_secret_key",
+                              pqcrypto_ml_kem_check_secret_key, 1);
+    rb_define_module_function(mPQCrypto, "ml_kem_512_check_public_key",
+                              pqcrypto_ml_kem_512_check_public_key, 1);
+    rb_define_module_function(mPQCrypto, "ml_kem_512_check_secret_key",
+                              pqcrypto_ml_kem_512_check_secret_key, 1);
+    rb_define_module_function(mPQCrypto, "ml_kem_1024_check_public_key",
+                              pqcrypto_ml_kem_1024_check_public_key, 1);
+    rb_define_module_function(mPQCrypto, "ml_kem_1024_check_secret_key",
+                              pqcrypto_ml_kem_1024_check_secret_key, 1);
+    rb_define_module_function(mPQCrypto, "ml_dsa_check_secret_key",
+                              pqcrypto_ml_dsa_check_secret_key, 1);
+    rb_define_module_function(mPQCrypto, "ml_dsa_44_check_secret_key",
+                              pqcrypto_ml_dsa_44_check_secret_key, 1);
+    rb_define_module_function(mPQCrypto, "ml_dsa_87_check_secret_key",
+                              pqcrypto_ml_dsa_87_check_secret_key, 1);
     rb_define_module_function(mPQCrypto, "hybrid_kem_keypair", pqcrypto_hybrid_kem_keypair, 0);
     rb_define_module_function(mPQCrypto, "hybrid_kem_encapsulate", pqcrypto_hybrid_kem_encapsulate,
                               1);