pq_crypto 0.6.5 → 0.6.6

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 68e8c2cd661300cb364be85b4939787590eb88217a2f3cb3463e262b66c4c662
-  data.tar.gz: fef5359500d367c68b50b2a72b54cfc8980b3c6dfd6b0e132998212e34cbd47a
+  metadata.gz: 273b83c96db2314540118b933a9f70a22c954e59a6fb38377f7c6cd1f337d698
+  data.tar.gz: 0a6f4b88a3aefde58049f41f582548aa10f2aa939e98a8b60791ff23c8a5be0e
 SHA512:
-  metadata.gz: 12bfac65233efde5fa34a30df51494bc6da59985287ae2b3954b377dc9afa949f16b509e98db25d7af2a61a7f3b6a4e572b21f33ff85e797a153ee0e0dde10a0
-  data.tar.gz: 25ccfe8a57150355da41a115c401d7ccee2b10a0a6a42957f8335cd3c97024d14261188ee676bc6a122557f52a4ea5894d67062dace53f983b51b4244d9d1a6a
+  metadata.gz: f4905490a34b75ae7548a896cbb379b135c7615dfba9dca564add76892fb6074a6e0a12220ca3158417ea3264c2dcb2dc432b0a49fa91f8429eaebeef966d895
+  data.tar.gz: 854941b5a331956cba2aa91ef1777148f9a93713eec6ce746fe01475b126b69f409ad0dbcf631a1db5c7c09d127d55053d59585850bcf06a8047f8b2ae14adec

data/CHANGELOG.md

@@ -1,5 +1,139 @@
 # Changelog
 
+## [0.6.6] - 2026-08-10
+
+### Changed
+
+- update native mlkem `v1.3.0` -> `v2.0.0` and mldsa `v1.0.0-beta2` -> `v2.0.0`
+
+  `mldsa-native` v2.0.0 is that project's first stable release; it is numbered
+  `2` only to align its API and configuration with `mlkem-native` v2. Upstream
+  now guarantees that non-experimental APIs and configuration options stay
+  stable until a `v3`.
+
+  No cryptographic output changed. All six `kat-sha256` values in the upstream
+  `META.yml` files are identical to the previously vendored versions, and the
+  vendored ML-KEM-768 keygen, ML-DSA-65 keygen and ML-DSA-65 siggen KAT vectors
+  reproduce byte-for-byte. This release is purely an API migration.
+
+### Breaking upstream changes handled
+
+- **`siglen` removed from the ML-DSA signing and verification APIs.** Upstream
+  signatures are always exactly `MLDSA_BYTES(level)`, so `signature`,
+  `signature_internal`, `verify`, `signature_extmu` and `verify_extmu` no longer
+  carry a length parameter. Fifteen declarations in
+  `ext/pqcrypto/pqcrypto_native_api.h` were updated accordingly.
+
+  The `pq_crypto` C API is deliberately *not* changed to match: `pq_sign`,
+  `pq_verify`, `pq_sign_mu` and `pq_verify_mu` keep their length parameters.
+  The adaptation happens at the vendor boundary instead.
+
+- **`pq_crypto` now owns the signing output length.** Because the backend no
+  longer reports it, every signing wrapper sets `*signature_len` itself from a
+  compile-time constant and clears it to `0` when the signing operation fails,
+  reproducing the pre-v2 behaviour. This affects `pq_sign`, `pq_mldsa44_sign`,
+  `pq_mldsa87_sign`, the level-agnostic deterministic helper
+  `pq_testing_mldsa_sign_from_seed_with`, and `pq_sign_mu`.
+
+  Argument-validation failures (`PQ_ERROR_BUFFER`) still leave `*signature_len`
+  untouched, exactly as before, since the pointer itself may be the invalid one.
+
+- **`pq_crypto` now validates signature length before verifying (security
+  relevant).** Prior to v2, `mldsa-native` rejected a wrongly sized signature
+  itself via `if (siglen != MLDSA_BYTES) return -1;`, and `pq_crypto` relied on
+  that. In v2 the verification entry points take a fixed-size array and read
+  `MLDSA_BYTES(level)` bytes unconditionally, so a short caller-supplied buffer
+  would be an out-of-bounds read. `pq_verify`, `pq_mldsa44_verify` and
+  `pq_mldsa87_verify` now enforce the exact length and return `PQ_ERROR_VERIFY`
+  otherwise; the Ruby bindings additionally reject the wrong length before
+  copying the buffer.
+
+  This was not exploitable in 0.6.5 or earlier: the previously vendored
+  `mldsa-native` performed the check. It is a latent contract dependency that a
+  naive port to v2 would have turned into a real memory-safety bug. Verified
+  with AddressSanitizer: removing this check alone reproduces a
+  `heap-buffer-overflow` read inside `pqcr_mldsa65_verify_internal`.
+
+  Observable Ruby behaviour is unchanged: a wrongly sized signature is a failed
+  verification (`false`), never an `ArgumentError`.
+
+- **ExternalMu callbacks adapted rather than re-typed.** Six new adapters,
+  `pq_mldsa{44,65,87}_{signature,verify}_extmu_compat`, sit between the
+  pre-v2 callback contract and the fixed-size v2 API. `pq_sign_mu` and
+  `pq_verify_mu` therefore keep their existing signatures and no consumer of the
+  C interface has to change.
+
+- **`MLK_CONFIG_NO_SUPERCOP` / `MLD_CONFIG_NO_SUPERCOP` removed upstream**
+  along with the SUPERCOP `crypto_*` aliases themselves. The define is no longer
+  passed by `extconf.rb`. Upstream has no guard against the stale macro, so it
+  would have been a silently dead `-D` rather than a build failure.
+
+- **Legacy `MLK_CONFIG_API_*` / `MLD_CONFIG_API_*` configuration removed
+  upstream.** The extension build already used the modern `*_CONFIG_*` macros;
+  only `test/native_api_conformance` still used the legacy path and has been
+  converted.
+
+Upstream breaking changes that do not affect this gem, checked explicitly: the
+SUPERCOP `crypto_*` and signed-message APIs (never used), the split of
+`*_ERR_FAIL` into specific error codes (all call sites compare against `0`), the
+`*_SYS_CAP_*` and `*_USE_NATIVE_FIPS202_*` renames (only relevant to custom
+backends), and the raised `MLD_CONFIG_MAX_SIGNING_ATTEMPTS` floor of 821, which
+this build does not set. `MLD_CONFIG_KEYGEN_PCT` / `MLK_CONFIG_KEYGEN_PCT`
+remain opt-in upstream and are not enabled here, so key generation gains no new
+failure mode or cost.
+
+### Testing
+
+- `test/native_api_conformance` reworked. It previously proved size agreement
+  via `_Static_assert` and, through the double declaration of upstream and
+  gem headers, prototype agreement. It could not detect a symbol that upstream
+  removed entirely, because it only ever compiled to an object file and both a
+  plain compile and a relocatable link tolerate unresolved symbols. The harness
+  now also builds the vendored objects with the same flags `extconf.rb` uses
+  (including which level owns the shared code) and diffs `nm -u` on the probe
+  object against the symbols the vendored build actually defines.
+
+- Conformance now covers `pqcr_mlkem_shake256` and `pqcr_mlkem_sha3_256`, the
+  extension's only dependency on a non-public part of `mlkem-native` (they back
+  the X-Wing key expansion and combiner). They were absent from `probes[]`
+  entirely, and because they are not declared in `mlkem_native.h` the
+  double-declaration check could not reach them either. The shared-level
+  conformance unit now includes the internal `src/fips202/fips202.h` so that
+  prototype drift in these two is caught as well.
+
+- Added `test/c_api`, direct tests for the `pq_crypto` C API, runnable under
+  AddressSanitizer via `PQCRYPTO_SANITIZE=address test/c_api/run.sh`. The Ruby
+  bindings pre-set `call.signature_len` before invoking the signing entry points
+  and read the same field back afterwards, so a wrapper that stopped writing
+  `*signature_len` would leave the entire Ruby suite green. That contract, and
+  the new signature-length validation, now have coverage that does not go
+  through Ruby.
+
+- `rake test` now runs the native API conformance and C API checks alongside the
+  Ruby suite.
+
+- The C API tests were themselves audited by mutation testing: each contract
+  this release changes was deliberately broken in turn and the suite had to
+  fail. That found three checks which passed against broken code and have been
+  rewritten:
+
+  - The ML-DSA-44 output-length check was phrased as "signing failed OR the
+    length is right" and reused the ML-DSA-65 secret key, so a
+    `pq_mldsa44_sign` that always returned an error satisfied it. ML-DSA-44 and
+    -87 now have their own key material and unconditional assertions.
+  - The ExternalMu failure check used a stub callback that cleared `*siglen`
+    itself, so it passed even when the real adapter had stopped doing so. It now
+    drives the genuine backend error path by exhausting the thread-local test
+    seed in `pq_randombytes.c`, which makes `randombytes()` fail. The same
+    technique gives `pq_sign` real coverage of its own error path.
+  - The verify adapters' length guards were unreachable through `pq_verify_mu`,
+    which validates the length first, so they were never exercised. They are now
+    called directly.
+
+  Two further gaps were closed: `pq_sign`'s recovery after a transient RNG
+  failure is now asserted, and a poisoned `*signature_len` that was set but
+  never checked is now checked.
+
 ## [0.6.5] - 2026-08-04
 
 ### Changed

data/README.md

@@ -88,9 +88,11 @@ bundle exec rake compile
 ```
 
 Upstream pins are recorded in `ext/pqcrypto/vendor/.vendored` and enforced by
-`bundle exec rake vendor:verify`. `mlkem-native` is pinned at `v1.3.0`, which
-upstream describes as the last release before a breaking `v2`; `release/v1.3` is
-the upstream support branch. `mldsa-native` is pinned at `v1.0.0-beta2`.
+`bundle exec rake vendor:verify`. Both `mlkem-native` and `mldsa-native` are
+pinned at `v2.0.0`. For `mldsa-native` this is the first stable release; it
+carries the major version `2` only so that its API and configuration line up
+with `mlkem-native` v2. Upstream guarantees that APIs and configuration options
+not marked experimental stay stable until a `v3`.
 
 The default build uses the portable native source path. Upstream native assembly
 can be tested explicitly with:

data/ext/pqcrypto/extconf.rb

@@ -524,7 +524,10 @@ def native_flags(kind, level, shared:)
   flags << "-D#{prefix}_CONFIG_MULTILEVEL_BUILD"
   flags << "-D#{prefix}_CONFIG_PARAMETER_SET=#{level}"
   flags << "-D#{prefix}_CONFIG_NAMESPACE_PREFIX=#{ns}"
-  flags << "-D#{prefix}_CONFIG_NO_SUPERCOP"
+  # NOTE: MLK/MLD_CONFIG_NO_SUPERCOP was removed in mlkem-native v2.0.0 and
+  # mldsa-native v2.0.0 along with the SUPERCOP crypto_* aliases themselves.
+  # Upstream has no guard against the stale define, so passing it would be a
+  # silently dead -D rather than a build error. Do not reintroduce it.
   flags << (shared ? "-D#{prefix}_CONFIG_MULTILEVEL_WITH_SHARED" : "-D#{prefix}_CONFIG_MULTILEVEL_NO_SHARED")
   flags << "-D#{prefix}_CONFIG_USE_NATIVE_BACKEND_ARITH" if NATIVE_ARITH
   flags << "-D#{prefix}_CONFIG_USE_NATIVE_BACKEND_FIPS202" if NATIVE_FIPS202

data/ext/pqcrypto/pq_externalmu.c

@@ -66,6 +66,41 @@ int pq_mldsa_compute_tr_from_public_key(uint8_t *tr_out, const uint8_t *public_k
     return pq_shake256(tr_out, PQ_MLDSA_TRBYTES, public_key, public_key_len);
 }
 
+#define PQ_DEFINE_SIGNATURE_EXTMU_COMPAT(level, native, sig_bytes)                                \
+    int pq_mldsa##level##_signature_extmu_compat(uint8_t *sig, size_t *siglen, const uint8_t *mu, \
+                                                 const uint8_t *sk) {                             \
+        if (sig == NULL || siglen == NULL || mu == NULL || sk == NULL) {                          \
+            return -1;                                                                            \
+        }                                                                                         \
+        if (native##_signature_extmu(sig, mu, sk) != 0) {                                         \
+            *siglen = 0;                                                                          \
+            return -1;                                                                            \
+        }                                                                                         \
+        *siglen = (size_t)(sig_bytes);                                                            \
+        return 0;                                                                                 \
+    }
+
+PQ_DEFINE_SIGNATURE_EXTMU_COMPAT(44, pqcr_mldsa44, MLDSA44_BYTES)
+PQ_DEFINE_SIGNATURE_EXTMU_COMPAT(65, pqcr_mldsa65, MLDSA65_BYTES)
+PQ_DEFINE_SIGNATURE_EXTMU_COMPAT(87, pqcr_mldsa87, MLDSA87_BYTES)
+
+#undef PQ_DEFINE_SIGNATURE_EXTMU_COMPAT
+
+#define PQ_DEFINE_VERIFY_EXTMU_COMPAT(level, native, sig_bytes)                         \
+    int pq_mldsa##level##_verify_extmu_compat(const uint8_t *sig, size_t siglen,        \
+                                              const uint8_t *mu, const uint8_t *pk) {   \
+        if (sig == NULL || mu == NULL || pk == NULL || siglen != (size_t)(sig_bytes)) { \
+            return -1;                                                                  \
+        }                                                                               \
+        return native##_verify_extmu(sig, mu, pk);                                      \
+    }
+
+PQ_DEFINE_VERIFY_EXTMU_COMPAT(44, pqcr_mldsa44, MLDSA44_BYTES)
+PQ_DEFINE_VERIFY_EXTMU_COMPAT(65, pqcr_mldsa65, MLDSA65_BYTES)
+PQ_DEFINE_VERIFY_EXTMU_COMPAT(87, pqcr_mldsa87, MLDSA87_BYTES)
+
+#undef PQ_DEFINE_VERIFY_EXTMU_COMPAT
+
 int pq_sign_mu(uint8_t *signature, size_t *signature_len, const uint8_t *mu,
                const uint8_t *secret_key,
                int (*signature_extmu)(uint8_t *, size_t *, const uint8_t *, const uint8_t *)) {

data/ext/pqcrypto/pqcrypto_native_api.h

@@ -15,49 +15,62 @@
  *   MLD_CONFIG_NAMESPACE_PREFIX=pqcr_mldsa
  * and MLK/MLD_CONFIG_MULTILEVEL_BUILD enabled. Do not add PQClean aliases here:
  * we want one backend only so build/runtime failures point at the new stack.
+ *
+ * mldsa-native v2.0.0 removed the `siglen` in/out parameter from the signing
+ * and verification APIs: signatures are always exactly MLDSA_BYTES(level) and
+ * the buffer size is part of the API contract rather than a runtime value.
+ *
+ * Two consequences for every caller in this extension:
+ *   1. Signing no longer reports the produced length. Each pq_crypto wrapper
+ *      sets its own *signature_len from the compile-time constant, and clears
+ *      it to 0 on failure, preserving the pre-v2 pq_crypto contract.
+ *   2. Verification no longer rejects a wrongly sized signature. The caller
+ *      MUST check the length itself before handing the buffer to
+ *      pqcr_mldsa*_verify / pqcr_mldsa*_verify_extmu, which read
+ *      MLDSA_BYTES(level) bytes unconditionally.
  */
 
-#define MLKEM512_SECRETKEYBYTES     1632
-#define MLKEM512_PUBLICKEYBYTES     800
-#define MLKEM512_CIPHERTEXTBYTES    768
-#define MLKEM512_SHAREDSECRETBYTES  32
+#define MLKEM512_SECRETKEYBYTES    1632
+#define MLKEM512_PUBLICKEYBYTES    800
+#define MLKEM512_CIPHERTEXTBYTES   768
+#define MLKEM512_SHAREDSECRETBYTES 32
 
-#define MLKEM768_SECRETKEYBYTES     2400
-#define MLKEM768_PUBLICKEYBYTES     1184
-#define MLKEM768_CIPHERTEXTBYTES    1088
-#define MLKEM768_SHAREDSECRETBYTES  32
+#define MLKEM768_SECRETKEYBYTES    2400
+#define MLKEM768_PUBLICKEYBYTES    1184
+#define MLKEM768_CIPHERTEXTBYTES   1088
+#define MLKEM768_SHAREDSECRETBYTES 32
 
 #define MLKEM1024_SECRETKEYBYTES    3168
 #define MLKEM1024_PUBLICKEYBYTES    1568
 #define MLKEM1024_CIPHERTEXTBYTES   1568
 #define MLKEM1024_SHAREDSECRETBYTES 32
 
-#define MLKEM_PUBLICKEYBYTES        MLKEM768_PUBLICKEYBYTES
-#define MLKEM_SECRETKEYBYTES        MLKEM768_SECRETKEYBYTES
-#define MLKEM_CIPHERTEXTBYTES       MLKEM768_CIPHERTEXTBYTES
-#define MLKEM_SHAREDSECRETBYTES     MLKEM768_SHAREDSECRETBYTES
-
-#define MLDSA44_SECRETKEYBYTES      2560
-#define MLDSA44_PUBLICKEYBYTES      1312
-#define MLDSA44_BYTES               2420
-
-#define MLDSA65_SECRETKEYBYTES      4032
-#define MLDSA65_PUBLICKEYBYTES      1952
-#define MLDSA65_BYTES               3309
-
-#define MLDSA87_SECRETKEYBYTES      4896
-#define MLDSA87_PUBLICKEYBYTES      2592
-#define MLDSA87_BYTES               4627
-
-#define MLDSA_PUBLICKEYBYTES        MLDSA65_PUBLICKEYBYTES
-#define MLDSA_SECRETKEYBYTES        MLDSA65_SECRETKEYBYTES
-#define MLDSA_BYTES                 MLDSA65_BYTES
-#define MLDSA_SEEDBYTES             32
-#define MLDSA_RNDBYTES              32
-#define MLDSA_TRBYTES               64
-#define MLDSA_CRHBYTES              64
+#define MLKEM_PUBLICKEYBYTES    MLKEM768_PUBLICKEYBYTES
+#define MLKEM_SECRETKEYBYTES    MLKEM768_SECRETKEYBYTES
+#define MLKEM_CIPHERTEXTBYTES   MLKEM768_CIPHERTEXTBYTES
+#define MLKEM_SHAREDSECRETBYTES MLKEM768_SHAREDSECRETBYTES
+
+#define MLDSA44_SECRETKEYBYTES 2560
+#define MLDSA44_PUBLICKEYBYTES 1312
+#define MLDSA44_BYTES          2420
+
+#define MLDSA65_SECRETKEYBYTES 4032
+#define MLDSA65_PUBLICKEYBYTES 1952
+#define MLDSA65_BYTES          3309
+
+#define MLDSA87_SECRETKEYBYTES 4896
+#define MLDSA87_PUBLICKEYBYTES 2592
+#define MLDSA87_BYTES          4627
+
+#define MLDSA_PUBLICKEYBYTES              MLDSA65_PUBLICKEYBYTES
+#define MLDSA_SECRETKEYBYTES              MLDSA65_SECRETKEYBYTES
+#define MLDSA_BYTES                       MLDSA65_BYTES
+#define MLDSA_SEEDBYTES                   32
+#define MLDSA_RNDBYTES                    32
+#define MLDSA_TRBYTES                     64
+#define MLDSA_CRHBYTES                    64
 #define MLDSA_DOMAIN_SEPARATION_MAX_BYTES (2 + 255 + 11 + 64)
-#define MLDSA_PREHASH_NONE          0
+#define MLDSA_PREHASH_NONE                0
 
 /* mlkem-native symbols: namespace prefix pqcr_mlkem + level suffix. */
 int pqcr_mlkem512_keypair(uint8_t *pk, uint8_t *sk);
@@ -84,58 +97,55 @@ void pqcr_mlkem_sha3_256(uint8_t *output, const uint8_t *input, size_t inlen);
 /* mldsa-native symbols: namespace prefix pqcr_mldsa + level suffix. */
 int pqcr_mldsa44_keypair(uint8_t *pk, uint8_t *sk);
 int pqcr_mldsa44_keypair_internal(uint8_t *pk, uint8_t *sk, const uint8_t seed[MLDSA_SEEDBYTES]);
-int pqcr_mldsa44_signature(uint8_t *sig, size_t *siglen, const uint8_t *m, size_t mlen,
-                           const uint8_t *ctx, size_t ctxlen, const uint8_t *sk);
-int pqcr_mldsa44_signature_internal(uint8_t *sig, size_t *siglen, const uint8_t *m,
-                                    size_t mlen, const uint8_t *pre, size_t prelen,
-                                    const uint8_t rnd[MLDSA_RNDBYTES], const uint8_t *sk,
-                                    int externalmu);
-int pqcr_mldsa44_verify(const uint8_t *sig, size_t siglen, const uint8_t *m, size_t mlen,
-                        const uint8_t *ctx, size_t ctxlen, const uint8_t *pk);
-size_t pqcr_mldsa44_prepare_domain_separation_prefix(
-    uint8_t prefix[MLDSA_DOMAIN_SEPARATION_MAX_BYTES], const uint8_t *ph, size_t phlen,
-    const uint8_t *ctx, size_t ctxlen, int hashalg);
-int pqcr_mldsa44_signature_extmu(uint8_t *sig, size_t *siglen, const uint8_t mu[MLDSA_CRHBYTES],
-                                 const uint8_t *sk);
-int pqcr_mldsa44_verify_extmu(const uint8_t *sig, size_t siglen, const uint8_t mu[MLDSA_CRHBYTES],
+int pqcr_mldsa44_signature(uint8_t *sig, const uint8_t *m, size_t mlen, const uint8_t *ctx,
+                           size_t ctxlen, const uint8_t *sk);
+int pqcr_mldsa44_signature_internal(uint8_t *sig, const uint8_t *m, size_t mlen, const uint8_t *pre,
+                                    size_t prelen, const uint8_t rnd[MLDSA_RNDBYTES],
+                                    const uint8_t *sk, int externalmu);
+int pqcr_mldsa44_verify(const uint8_t *sig, const uint8_t *m, size_t mlen, const uint8_t *ctx,
+                        size_t ctxlen, const uint8_t *pk);
+size_t
+pqcr_mldsa44_prepare_domain_separation_prefix(uint8_t prefix[MLDSA_DOMAIN_SEPARATION_MAX_BYTES],
+                                              const uint8_t *ph, size_t phlen, const uint8_t *ctx,
+                                              size_t ctxlen, int hashalg);
+int pqcr_mldsa44_signature_extmu(uint8_t *sig, const uint8_t mu[MLDSA_CRHBYTES], const uint8_t *sk);
+int pqcr_mldsa44_verify_extmu(const uint8_t *sig, const uint8_t mu[MLDSA_CRHBYTES],
                               const uint8_t *pk);
 int pqcr_mldsa44_pk_from_sk(uint8_t *pk, const uint8_t *sk);
 
 int pqcr_mldsa65_keypair(uint8_t *pk, uint8_t *sk);
 int pqcr_mldsa65_keypair_internal(uint8_t *pk, uint8_t *sk, const uint8_t seed[MLDSA_SEEDBYTES]);
-int pqcr_mldsa65_signature(uint8_t *sig, size_t *siglen, const uint8_t *m, size_t mlen,
-                           const uint8_t *ctx, size_t ctxlen, const uint8_t *sk);
-int pqcr_mldsa65_signature_internal(uint8_t *sig, size_t *siglen, const uint8_t *m,
-                                    size_t mlen, const uint8_t *pre, size_t prelen,
-                                    const uint8_t rnd[MLDSA_RNDBYTES], const uint8_t *sk,
-                                    int externalmu);
-int pqcr_mldsa65_verify(const uint8_t *sig, size_t siglen, const uint8_t *m, size_t mlen,
-                        const uint8_t *ctx, size_t ctxlen, const uint8_t *pk);
-size_t pqcr_mldsa65_prepare_domain_separation_prefix(
-    uint8_t prefix[MLDSA_DOMAIN_SEPARATION_MAX_BYTES], const uint8_t *ph, size_t phlen,
-    const uint8_t *ctx, size_t ctxlen, int hashalg);
-int pqcr_mldsa65_signature_extmu(uint8_t *sig, size_t *siglen, const uint8_t mu[MLDSA_CRHBYTES],
-                                 const uint8_t *sk);
-int pqcr_mldsa65_verify_extmu(const uint8_t *sig, size_t siglen, const uint8_t mu[MLDSA_CRHBYTES],
+int pqcr_mldsa65_signature(uint8_t *sig, const uint8_t *m, size_t mlen, const uint8_t *ctx,
+                           size_t ctxlen, const uint8_t *sk);
+int pqcr_mldsa65_signature_internal(uint8_t *sig, const uint8_t *m, size_t mlen, const uint8_t *pre,
+                                    size_t prelen, const uint8_t rnd[MLDSA_RNDBYTES],
+                                    const uint8_t *sk, int externalmu);
+int pqcr_mldsa65_verify(const uint8_t *sig, const uint8_t *m, size_t mlen, const uint8_t *ctx,
+                        size_t ctxlen, const uint8_t *pk);
+size_t
+pqcr_mldsa65_prepare_domain_separation_prefix(uint8_t prefix[MLDSA_DOMAIN_SEPARATION_MAX_BYTES],
+                                              const uint8_t *ph, size_t phlen, const uint8_t *ctx,
+                                              size_t ctxlen, int hashalg);
+int pqcr_mldsa65_signature_extmu(uint8_t *sig, const uint8_t mu[MLDSA_CRHBYTES], const uint8_t *sk);
+int pqcr_mldsa65_verify_extmu(const uint8_t *sig, const uint8_t mu[MLDSA_CRHBYTES],
                               const uint8_t *pk);
 int pqcr_mldsa65_pk_from_sk(uint8_t *pk, const uint8_t *sk);
 
 int pqcr_mldsa87_keypair(uint8_t *pk, uint8_t *sk);
 int pqcr_mldsa87_keypair_internal(uint8_t *pk, uint8_t *sk, const uint8_t seed[MLDSA_SEEDBYTES]);
-int pqcr_mldsa87_signature(uint8_t *sig, size_t *siglen, const uint8_t *m, size_t mlen,
-                           const uint8_t *ctx, size_t ctxlen, const uint8_t *sk);
-int pqcr_mldsa87_signature_internal(uint8_t *sig, size_t *siglen, const uint8_t *m,
-                                    size_t mlen, const uint8_t *pre, size_t prelen,
-                                    const uint8_t rnd[MLDSA_RNDBYTES], const uint8_t *sk,
-                                    int externalmu);
-int pqcr_mldsa87_verify(const uint8_t *sig, size_t siglen, const uint8_t *m, size_t mlen,
-                        const uint8_t *ctx, size_t ctxlen, const uint8_t *pk);
-size_t pqcr_mldsa87_prepare_domain_separation_prefix(
-    uint8_t prefix[MLDSA_DOMAIN_SEPARATION_MAX_BYTES], const uint8_t *ph, size_t phlen,
-    const uint8_t *ctx, size_t ctxlen, int hashalg);
-int pqcr_mldsa87_signature_extmu(uint8_t *sig, size_t *siglen, const uint8_t mu[MLDSA_CRHBYTES],
-                                 const uint8_t *sk);
-int pqcr_mldsa87_verify_extmu(const uint8_t *sig, size_t siglen, const uint8_t mu[MLDSA_CRHBYTES],
+int pqcr_mldsa87_signature(uint8_t *sig, const uint8_t *m, size_t mlen, const uint8_t *ctx,
+                           size_t ctxlen, const uint8_t *sk);
+int pqcr_mldsa87_signature_internal(uint8_t *sig, const uint8_t *m, size_t mlen, const uint8_t *pre,
+                                    size_t prelen, const uint8_t rnd[MLDSA_RNDBYTES],
+                                    const uint8_t *sk, int externalmu);
+int pqcr_mldsa87_verify(const uint8_t *sig, const uint8_t *m, size_t mlen, const uint8_t *ctx,
+                        size_t ctxlen, const uint8_t *pk);
+size_t
+pqcr_mldsa87_prepare_domain_separation_prefix(uint8_t prefix[MLDSA_DOMAIN_SEPARATION_MAX_BYTES],
+                                              const uint8_t *ph, size_t phlen, const uint8_t *ctx,
+                                              size_t ctxlen, int hashalg);
+int pqcr_mldsa87_signature_extmu(uint8_t *sig, const uint8_t mu[MLDSA_CRHBYTES], const uint8_t *sk);
+int pqcr_mldsa87_verify_extmu(const uint8_t *sig, const uint8_t mu[MLDSA_CRHBYTES],
                               const uint8_t *pk);
 int pqcr_mldsa87_pk_from_sk(uint8_t *pk, const uint8_t *sk);
 

data/ext/pqcrypto/pqcrypto_ruby_secure.c

@@ -173,11 +173,11 @@ typedef struct {
 
 static const pq_mldsa_profile_t MLDSA_PROFILES[] = {
     {"ml_dsa_44", MLDSA44_PUBLICKEYBYTES, MLDSA44_SECRETKEYBYTES, MLDSA44_BYTES,
-     pqcr_mldsa44_pk_from_sk, pqcr_mldsa44_signature_extmu, pqcr_mldsa44_verify_extmu},
+     pqcr_mldsa44_pk_from_sk, pq_mldsa44_signature_extmu_compat, pq_mldsa44_verify_extmu_compat},
     {"ml_dsa_65", MLDSA65_PUBLICKEYBYTES, MLDSA65_SECRETKEYBYTES, MLDSA65_BYTES,
-     pqcr_mldsa65_pk_from_sk, pqcr_mldsa65_signature_extmu, pqcr_mldsa65_verify_extmu},
+     pqcr_mldsa65_pk_from_sk, pq_mldsa65_signature_extmu_compat, pq_mldsa65_verify_extmu_compat},
     {"ml_dsa_87", MLDSA87_PUBLICKEYBYTES, MLDSA87_SECRETKEYBYTES, MLDSA87_BYTES,
-     pqcr_mldsa87_pk_from_sk, pqcr_mldsa87_signature_extmu, pqcr_mldsa87_verify_extmu},
+     pqcr_mldsa87_pk_from_sk, pq_mldsa87_signature_extmu_compat, pq_mldsa87_verify_extmu_compat},
 };
 
 static const pq_mldsa_profile_t *pq_mldsa_profile_from_value(VALUE algorithm) {
@@ -1306,7 +1306,8 @@ PQ_DEFINE_RUBY_MLDSA_SIGN(ml_dsa_87_sign, mldsa_87_sign, MLDSA87_SECRETKEYBYTES,
 #undef PQ_DEFINE_RUBY_MLDSA_SIGN
 
 static VALUE pq_run_verify(void *(*nogvl)(void *), VALUE message, VALUE signature, VALUE public_key,
-                           VALUE context, size_t public_key_len_expected) {
+                           VALUE context, size_t public_key_len_expected,
+                           size_t signature_len_expected) {
     StringValue(signature);
     pq_validate_bytes_argument(public_key, public_key_len_expected, "public key");
     StringValue(context);
@@ -1314,6 +1315,10 @@ static VALUE pq_run_verify(void *(*nogvl)(void *), VALUE message, VALUE signatur
         rb_raise(rb_eArgError, "ML-DSA context length must be <= 255 bytes");
     }
 
+    if ((size_t)RSTRING_LEN(signature) != signature_len_expected) {
+        return Qfalse;
+    }
+
     verify_call_t call = {0};
     size_t public_key_len = 0;
     size_t signature_len = 0;
@@ -1341,7 +1346,7 @@ static VALUE pq_run_verify(void *(*nogvl)(void *), VALUE message, VALUE signatur
     pq_raise_general_error(call.result);
 }
 
-#define PQ_DEFINE_RUBY_MLDSA_VERIFY(rb_name, nogvl_stem, pk_bytes)                             \
+#define PQ_DEFINE_RUBY_MLDSA_VERIFY(rb_name, nogvl_stem, pk_bytes, sig_bytes)                  \
     static VALUE pqcrypto_##rb_name(int argc, VALUE *argv, VALUE self) {                       \
         (void)self;                                                                            \
         VALUE message, signature, public_key, context;                                         \
@@ -1350,12 +1355,14 @@ static VALUE pq_run_verify(void *(*nogvl)(void *), VALUE message, VALUE signatur
             context = rb_str_new("", 0);                                                       \
         }                                                                                      \
         return pq_run_verify(pq_##nogvl_stem##_nogvl, message, signature, public_key, context, \
-                             pk_bytes);                                                        \
+                             pk_bytes, sig_bytes);                                             \
     }
 
-PQ_DEFINE_RUBY_MLDSA_VERIFY(verify, verify, PQ_MLDSA_PUBLICKEYBYTES)
-PQ_DEFINE_RUBY_MLDSA_VERIFY(ml_dsa_44_verify, mldsa_44_verify, MLDSA44_PUBLICKEYBYTES)
-PQ_DEFINE_RUBY_MLDSA_VERIFY(ml_dsa_87_verify, mldsa_87_verify, MLDSA87_PUBLICKEYBYTES)
+PQ_DEFINE_RUBY_MLDSA_VERIFY(verify, verify, PQ_MLDSA_PUBLICKEYBYTES, PQ_MLDSA_BYTES)
+PQ_DEFINE_RUBY_MLDSA_VERIFY(ml_dsa_44_verify, mldsa_44_verify, MLDSA44_PUBLICKEYBYTES,
+                            MLDSA44_BYTES)
+PQ_DEFINE_RUBY_MLDSA_VERIFY(ml_dsa_87_verify, mldsa_87_verify, MLDSA87_PUBLICKEYBYTES,
+                            MLDSA87_BYTES)
 
 #undef PQ_DEFINE_RUBY_MLDSA_VERIFY
 

data/ext/pqcrypto/pqcrypto_secure.c

@@ -322,27 +322,29 @@ PQ_DEFINE_MLDSA_SIGN_KEYPAIR(mldsa87_sign, pqcr_mldsa87)
 
 #undef PQ_DEFINE_MLDSA_SIGN_KEYPAIR
 
-#define PQ_DEFINE_MLDSA_SIGN(name, native)                                                      \
-    int pq_##name(uint8_t *signature, size_t *signature_len, const uint8_t *message,            \
-                  size_t message_len, const uint8_t *ctx, size_t ctx_len,                       \
-                  const uint8_t *secret_key) {                                                  \
-        if (!signature || !signature_len || !secret_key || (message_len > 0 && !message) ||     \
-            (ctx_len > 0 && !ctx) || ctx_len > 255) {                                           \
-            return PQ_ERROR_BUFFER;                                                             \
-        }                                                                                       \
-        return native##_signature(signature, signature_len, message, message_len, ctx, ctx_len, \
-                                  secret_key) == 0                                              \
-                   ? PQ_SUCCESS                                                                 \
-                   : PQ_ERROR_SIGN;                                                             \
-    }
-
-PQ_DEFINE_MLDSA_SIGN(sign, pqcr_mldsa65)
-PQ_DEFINE_MLDSA_SIGN(mldsa44_sign, pqcr_mldsa44)
-PQ_DEFINE_MLDSA_SIGN(mldsa87_sign, pqcr_mldsa87)
+#define PQ_DEFINE_MLDSA_SIGN(name, native, sig_bytes)                                             \
+    int pq_##name(uint8_t *signature, size_t *signature_len, const uint8_t *message,              \
+                  size_t message_len, const uint8_t *ctx, size_t ctx_len,                         \
+                  const uint8_t *secret_key) {                                                    \
+        if (!signature || !signature_len || !secret_key || (message_len > 0 && !message) ||       \
+            (ctx_len > 0 && !ctx) || ctx_len > 255) {                                             \
+            return PQ_ERROR_BUFFER;                                                               \
+        }                                                                                         \
+        if (native##_signature(signature, message, message_len, ctx, ctx_len, secret_key) != 0) { \
+            *signature_len = 0;                                                                   \
+            return PQ_ERROR_SIGN;                                                                 \
+        }                                                                                         \
+        *signature_len = (size_t)(sig_bytes);                                                     \
+        return PQ_SUCCESS;                                                                        \
+    }
+
+PQ_DEFINE_MLDSA_SIGN(sign, pqcr_mldsa65, MLDSA65_BYTES)
+PQ_DEFINE_MLDSA_SIGN(mldsa44_sign, pqcr_mldsa44, MLDSA44_BYTES)
+PQ_DEFINE_MLDSA_SIGN(mldsa87_sign, pqcr_mldsa87, MLDSA87_BYTES)
 
 #undef PQ_DEFINE_MLDSA_SIGN
 
-#define PQ_DEFINE_MLDSA_VERIFY(name, native)                                                       \
+#define PQ_DEFINE_MLDSA_VERIFY(name, native, sig_bytes)                                            \
     int pq_##name(const uint8_t *signature, size_t signature_len, const uint8_t *message,          \
                   size_t message_len, const uint8_t *ctx, size_t ctx_len,                          \
                   const uint8_t *public_key) {                                                     \
@@ -350,29 +352,32 @@ PQ_DEFINE_MLDSA_SIGN(mldsa87_sign, pqcr_mldsa87)
             ctx_len > 255) {                                                                       \
             return PQ_ERROR_BUFFER;                                                                \
         }                                                                                          \
-        return native##_verify(signature, signature_len, message, message_len, ctx, ctx_len,       \
-                               public_key) == 0                                                    \
+        if (signature_len != (size_t)(sig_bytes)) {                                                \
+            return PQ_ERROR_VERIFY;                                                                \
+        }                                                                                          \
+        return native##_verify(signature, message, message_len, ctx, ctx_len, public_key) == 0     \
                    ? PQ_SUCCESS                                                                    \
                    : PQ_ERROR_VERIFY;                                                              \
     }
 
-PQ_DEFINE_MLDSA_VERIFY(verify, pqcr_mldsa65)
-PQ_DEFINE_MLDSA_VERIFY(mldsa44_verify, pqcr_mldsa44)
-PQ_DEFINE_MLDSA_VERIFY(mldsa87_verify, pqcr_mldsa87)
+PQ_DEFINE_MLDSA_VERIFY(verify, pqcr_mldsa65, MLDSA65_BYTES)
+PQ_DEFINE_MLDSA_VERIFY(mldsa44_verify, pqcr_mldsa44, MLDSA44_BYTES)
+PQ_DEFINE_MLDSA_VERIFY(mldsa87_verify, pqcr_mldsa87, MLDSA87_BYTES)
 
 #undef PQ_DEFINE_MLDSA_VERIFY
 
 static int pq_testing_mldsa_sign_from_seed_with(
     uint8_t *signature, size_t *signature_len, const uint8_t *message, size_t message_len,
-    const uint8_t *secret_key, const uint8_t *seed, size_t seed_len,
-    int (*signature_internal)(uint8_t *, size_t *, const uint8_t *, size_t, const uint8_t *, size_t,
+    const uint8_t *secret_key, const uint8_t *seed, size_t seed_len, size_t expected_signature_len,
+    int (*signature_internal)(uint8_t *, const uint8_t *, size_t, const uint8_t *, size_t,
                               const uint8_t *, const uint8_t *, int),
     size_t (*prepare_prefix)(uint8_t *, const uint8_t *, size_t, const uint8_t *, size_t, int)) {
     uint8_t pre[MLDSA_DOMAIN_SEPARATION_MAX_BYTES];
     size_t pre_len;
 
     if (!signature || !signature_len || !secret_key || !seed || seed_len != MLDSA_RNDBYTES ||
-        !signature_internal || !prepare_prefix || (message_len > 0 && !message)) {
+        !signature_internal || !prepare_prefix || expected_signature_len == 0 ||
+        (message_len > 0 && !message)) {
         return PQ_ERROR_BUFFER;
     }
 
@@ -385,13 +390,18 @@ static int pq_testing_mldsa_sign_from_seed_with(
      */
     pre_len = prepare_prefix(pre, NULL, 0, NULL, 0, MLDSA_PREHASH_NONE);
     if (pre_len == 0) {
+        *signature_len = 0;
         return PQ_ERROR_SIGN;
     }
 
-    return signature_internal(signature, signature_len, message, message_len, pre, pre_len, seed,
-                              secret_key, 0) == 0
-               ? PQ_SUCCESS
-               : PQ_ERROR_SIGN;
+    if (signature_internal(signature, message, message_len, pre, pre_len, seed, secret_key, 0) !=
+        0) {
+        *signature_len = 0;
+        return PQ_ERROR_SIGN;
+    }
+
+    *signature_len = expected_signature_len;
+    return PQ_SUCCESS;
 }
 
 int pq_mldsa44_keypair_from_seed(uint8_t *public_key, uint8_t *secret_key, const uint8_t *seed32) {
@@ -447,7 +457,7 @@ int pq_testing_mldsa_sign_from_seed(uint8_t *signature, size_t *signature_len,
                                     const uint8_t *secret_key, const uint8_t *seed,
                                     size_t seed_len) {
     return pq_testing_mldsa_sign_from_seed_with(
-        signature, signature_len, message, message_len, secret_key, seed, seed_len,
+        signature, signature_len, message, message_len, secret_key, seed, seed_len, MLDSA65_BYTES,
         pqcr_mldsa65_signature_internal, pqcr_mldsa65_prepare_domain_separation_prefix);
 }
 
@@ -456,7 +466,7 @@ int pq_testing_mldsa44_sign_from_seed(uint8_t *signature, size_t *signature_len,
                                       const uint8_t *secret_key, const uint8_t *seed,
                                       size_t seed_len) {
     return pq_testing_mldsa_sign_from_seed_with(
-        signature, signature_len, message, message_len, secret_key, seed, seed_len,
+        signature, signature_len, message, message_len, secret_key, seed, seed_len, MLDSA44_BYTES,
         pqcr_mldsa44_signature_internal, pqcr_mldsa44_prepare_domain_separation_prefix);
 }
 
@@ -465,7 +475,7 @@ int pq_testing_mldsa87_sign_from_seed(uint8_t *signature, size_t *signature_len,
                                       const uint8_t *secret_key, const uint8_t *seed,
                                       size_t seed_len) {
     return pq_testing_mldsa_sign_from_seed_with(
-        signature, signature_len, message, message_len, secret_key, seed, seed_len,
+        signature, signature_len, message, message_len, secret_key, seed, seed_len, MLDSA87_BYTES,
         pqcr_mldsa87_signature_internal, pqcr_mldsa87_prepare_domain_separation_prefix);
 }