@atlasauth/pca-mpc 0.1.0 → 0.2.0

package/dist/hybrid-ot.d.ts

@@ -0,0 +1,153 @@
+/**
+ * Hybrid base OT — a SOUND combiner of the malicious-secure EC base OT (`ot.ts`/`ec.ts`) and the
+ * post-quantum committed ML-KEM base OT (`kem-ot.ts`), run together so the stack inherits the BEST
+ * guarantee of each half instead of the weakest.
+ *
+ * ─── WHY A COMBINER ────────────────────────────────────────────────────────────────────────────────
+ * The two base OTs this package ships have complementary weaknesses:
+ *   • The EC base OT (`malBaseRandomOT`) is MALICIOUS-secure against both roles — a Schnorr NIZK proof
+ *     of knowledge of `y` on `S = y·B`, full prime-order-subgroup validation of every transmitted
+ *     point, and a random-OT core with no sender-chosen ciphertexts — but its hardness is the curve25519
+ *     discrete log, which a QUANTUM adversary breaks with Shor.
+ *   • The ML-KEM base OT (`kemBaseOtMalRandom`) is POST-QUANTUM (Module-LWE) and has unconditional,
+ *     even-against-a-quantum-sender choice privacy, but against an actively-malicious receiver it has an
+ *     IRREDUCIBLE residue from the opaque primitive: a receiver that runs keygen twice and keeps BOTH
+ *     secret keys learns both messages, and the decisional-MLWE indistinguishability that gives choice
+ *     privacy makes that cheat undetectable to the sender (see `kem-ot.ts` header).
+ *
+ * The combiner runs BOTH base OTs on the SAME choice bit and the SAME session, then derives each
+ * transfer key from BOTH halves' shared secrets:
+ *
+ *     k_b = H( DOMAIN_SEP ‖ sid ‖ i ‖ b ‖ ss_ec_b ‖ ss_kem_b )        for b ∈ {0, 1}
+ *
+ * where `ss_ec_b` is the EC random-OT pad (`malBaseRandomOT`) and `ss_kem_b` the committed ML-KEM
+ * random-OT secret (`kemBaseOtMalRandom`, the hardened variant — never the semi-honest one). The sender
+ * one-time-pads `m_b` under `k_b` and commits to it (`com_b`); the honest receiver reconstructs only
+ * `k_c` (it holds only `ss_ec_c` and `ss_kem_c`) and checks `com_c`.
+ *
+ * ─── WHAT THIS ACHIEVES (precise) ───────────────────────────────────────────────────────────────────
+ * To recover `m_{1−c}` an adversary needs `k_{1−c}`, hence BOTH `ss_ec_{1−c}` AND `ss_kem_{1−c}` (the
+ * hash is a random oracle; missing either input leaves the pad pseudorandom). Therefore:
+ *   • vs a CLASSICAL malicious receiver — MALICIOUS-secure. Even a receiver that defeats the KEM half
+ *     entirely by keeping both ML-KEM secrets (so it holds `ss_kem_{1−c}`) still cannot obtain
+ *     `ss_ec_{1−c}`: the EC base OT is malicious-secure and `ss_ec_{1−c} = H(y·R − T)` is a point the
+ *     receiver cannot compute without the discrete log of `S`. No `ss_ec_{1−c}` ⇒ no `k_{1−c}` ⇒ `m_{1−c}`
+ *     stays hidden. This is the KILLER property the tests prove.
+ *   • SENDER PRIVACY vs a SEMI-HONEST QUANTUM receiver — holds via the KEM half (Module-LWE): a quantum
+ *     receiver that follows the protocol (discards the non-chosen material) cannot get `ss_kem_{1−c}`,
+ *     so again `k_{1−c}` is unobtainable even though it could break the EC half with Shor.
+ *   • CHOICE PRIVACY — POST-QUANTUM. The KEM half's choice privacy is unconditional (two i.i.d. real
+ *     ML-KEM public keys on the wire); the EC half's is information-theoretic in its transcript (`R` is a
+ *     uniform subgroup element whatever `c` is). Neither leaks `c`, against any adversary.
+ *   • SESSION BINDING — both halves are bound to a COMMON `sid` derived from BOTH sub-protocols'
+ *     session material (the KEM `(rn, sn)` nonces and the EC point `S`), and `sid` is hashed into every
+ *     transfer key and commitment, so secrets from one session/opened-key-set cannot be replayed into
+ *     another. The KEM half additionally aborts (`KemBaseOtAbort`) if the receiver opens keys other than
+ *     the ones it committed to; the EC half aborts (`BaseOtAbort`/`PointValidationError`) on a bad proof
+ *     or an off-/small-order point; and the combiner aborts (`HybridOtAbort`) if a tampered ciphertext
+ *     fails its commitment.
+ *
+ * ─── THE HONEST BOUNDARY (NOT faked) ────────────────────────────────────────────────────────────────
+ * The one residue this combiner does NOT close is a receiver that is SIMULTANEOUSLY actively-malicious
+ * AND quantum: such a receiver could break the classical EC half with Shor (recovering `ss_ec_{1−c}`
+ * from the transcript) WHILE keeping both ML-KEM secrets (recovering `ss_kem_{1−c}`), and so assemble
+ * `k_{1−c}`. Closing THAT requires a base OT that is BOTH post-quantum AND malicious-secure in one
+ * primitive — i.e. an endemic/UC OT from Module-LWE with a CRS, which needs direct lattice module
+ * arithmetic (sampling / adding in ML-KEM's structured public-key space to plant a secretless slot).
+ * The opaque `ml_kem768` keygen/encaps/decaps interface this package is restricted to does NOT expose
+ * that arithmetic, and hand-rolling it is exactly the lattice crypto the module forbids. So this is the
+ * honest limit of what a KEM-opaque + EC combiner can reach; it is stated, not papered over.
+ *
+ * No hand-rolled crypto: the EC half goes through `malBaseRandomOT` (unchanged), the KEM half through
+ * `kemBaseOtMalRandom` (unchanged), and this module only hashes (SHA-256 RO) and XORs their outputs.
+ */
+import { type Point } from './ec';
+import { type BaseOtTamper, type OtChannel, type OtRandom } from './ot';
+import { type KemMalTamper } from './kem-ot';
+/** Raised when the hybrid combiner aborts: a sender ciphertext inconsistent with its commitment is caught. */
+export declare class HybridOtAbort extends Error {
+    constructor(message: string);
+}
+/**
+ * The COMMON session id binding both halves: `H(TAG ‖ kemSid ‖ encode(ecS))`. It folds the KEM
+ * sub-protocol's two-nonce session id (`rn, sn`) and the EC sub-protocol's point `S`, so neither party
+ * alone fixes it and secrets cannot be mixed across sessions. Both parties derive the same value from
+ * the public transcript.
+ */
+export declare function hybridSessionId(kemSid: Uint8Array, ecS: Point): Uint8Array;
+/**
+ * The hybrid transfer key for one slot: `H(TAG ‖ sid ‖ i ‖ slot ‖ ss_ec ‖ ss_kem)` expanded (SHA-256
+ * counter mode) to `len` bytes. Modelled as a random oracle: the key is pseudorandom unless BOTH
+ * `ss_ec` and `ss_kem` (for that exact slot/index/session) are supplied — the soundness crux of the
+ * combiner.
+ */
+export declare function hybridTransferKey(sid: Uint8Array, index: number, slot: number, ssEc: Uint8Array, ssKem: Uint8Array, len: number): Uint8Array;
+/** The sender's wire message of the hybrid combiner: one-time-padded messages + per-message commitments. */
+export interface HybridSenderMessage {
+    /** For each transfer i, `[E_0, E_1]` with `E_b = m_b ⊕ k_b`. */
+    encrypted: Array<[Uint8Array, Uint8Array]>;
+    /** For each transfer i, `[com_0, com_1]` with `com_b = H(sid ‖ i ‖ b ‖ m_b ‖ k_b)`. */
+    commitments: Array<[Uint8Array, Uint8Array]>;
+}
+/**
+ * SENDER side of the combiner: given BOTH halves' per-slot shared secrets, derive both transfer keys,
+ * one-time-pad each message, and commit to each. `ecSecrets[i] = [ss_ec_0, ss_ec_1]` (the EC random-OT
+ * `senderPads`), `kemSecrets[i] = [ss_kem_0, ss_kem_1]` (the committed-KEM `senderSecrets`).
+ */
+export declare function hybridSenderEncrypt(sid: Uint8Array, messages: Array<[Uint8Array, Uint8Array]>, ecSecrets: Array<[Uint8Array, Uint8Array]>, kemSecrets: Array<[Uint8Array, Uint8Array]>): HybridSenderMessage;
+/**
+ * RECEIVER side of the combiner: reconstruct ONLY the chosen transfer key (from the chosen EC and KEM
+ * secrets the receiver legitimately holds), unmask the chosen message, and CHECK the commitment.
+ * `ecRecv[i] = ss_ec_{choices[i]}` (the EC `recvPads`), `kemRecv[i] = ss_kem_{choices[i]}` (the
+ * committed-KEM `recvSecrets`). Aborts (`HybridOtAbort`) if the recovered message fails its commitment.
+ */
+export declare function hybridReceiverRecover(sid: Uint8Array, choices: number[], sender: HybridSenderMessage, ecRecv: Uint8Array[], kemRecv: Uint8Array[]): Uint8Array[];
+/**
+ * TEST-ONLY injection points modelling malicious behaviour in the hybrid combiner. The `ec` / `kem`
+ * bags are forwarded to the respective sub-OTs (so each half's real malicious checks run against the
+ * adversarial value); `tamperEncrypted` corrupts the hybrid sender's ciphertexts on the wire (caught by
+ * the commitment check).
+ */
+export interface HybridBaseOtTamper {
+    /** Forwarded to the EC half (`malBaseRandomOT`): malicious sender/receiver on the EC sub-OT. */
+    ec?: BaseOtTamper;
+    /** Forwarded to the KEM half (`kemBaseOtMalRandom`): malicious receiver on the committed KEM sub-OT. */
+    kem?: KemMalTamper;
+    /** Malicious hybrid SENDER: corrupt the padded messages on the wire (inconsistent with the commitment). */
+    tamperEncrypted?: (encrypted: Array<[Uint8Array, Uint8Array]>) => void;
+}
+/** A full hybrid base-OT transcript, exposed for inspection/tests. */
+export interface HybridBaseOtTranscript {
+    /** The common session id both halves are bound to. */
+    sid: Uint8Array;
+    /** The EC sub-OT's public point `S` (with its Schnorr proof available via the EC half). */
+    ecS: Point;
+    /** The committed-KEM sub-OT session id `H(rn ‖ sn)`. */
+    kemSid: Uint8Array;
+    encrypted: Array<[Uint8Array, Uint8Array]>;
+    commitments: Array<[Uint8Array, Uint8Array]>;
+}
+export interface HybridBaseOtResult {
+    /** Receiver's recovered messages `m_{i, choices[i]}`. */
+    received: Uint8Array[];
+    transcript: HybridBaseOtTranscript;
+}
+/**
+ * In-process combined simulator (both parties in one call), matching the shape of `baseOT`/`kemBaseOT`
+ * so it is a drop-in for `OtChannel`'s `baseOtFn` (`withHybridBaseOt`). Runs the malicious-secure EC
+ * base OT and the committed ML-KEM base OT on the SAME choices, binds both to a common `sid`, and
+ * combines their per-slot secrets into the transfer keys. A cheating party is caught by whichever
+ * half's check applies (EC proof/point validation, KEM commitment, or the hybrid ciphertext
+ * commitment). `tamper` injects malicious behaviour for tests.
+ */
+export declare function hybridBaseOT(messages: Array<[Uint8Array, Uint8Array]>, choices: number[], rng?: OtRandom, tamper?: HybridBaseOtTamper): HybridBaseOtResult;
+/**
+ * Wire the HYBRID base OT into the KOS OT-extension: a drop-in for `withKemBaseOt`/`withKemBaseOtMal`
+ * that makes `OtChannel` run its κ setup base OTs over the combiner. The extension inherits the
+ * combiner's guarantee — malicious security vs a classical receiver, PQ sender-privacy vs a semi-honest
+ * quantum one, and PQ choice privacy — with everything above the base OT (IKNP matrix, KOS correlation
+ * check, correlation-robust hash) unchanged.
+ *
+ *   const ch = new OtChannel(secureOtRandom(), withHybridBaseOt());
+ */
+export declare function withHybridBaseOt(): ConstructorParameters<typeof OtChannel>[1];

package/dist/hybrid-ot.js

@@ -0,0 +1,241 @@
+"use strict";
+/**
+ * Hybrid base OT — a SOUND combiner of the malicious-secure EC base OT (`ot.ts`/`ec.ts`) and the
+ * post-quantum committed ML-KEM base OT (`kem-ot.ts`), run together so the stack inherits the BEST
+ * guarantee of each half instead of the weakest.
+ *
+ * ─── WHY A COMBINER ────────────────────────────────────────────────────────────────────────────────
+ * The two base OTs this package ships have complementary weaknesses:
+ *   • The EC base OT (`malBaseRandomOT`) is MALICIOUS-secure against both roles — a Schnorr NIZK proof
+ *     of knowledge of `y` on `S = y·B`, full prime-order-subgroup validation of every transmitted
+ *     point, and a random-OT core with no sender-chosen ciphertexts — but its hardness is the curve25519
+ *     discrete log, which a QUANTUM adversary breaks with Shor.
+ *   • The ML-KEM base OT (`kemBaseOtMalRandom`) is POST-QUANTUM (Module-LWE) and has unconditional,
+ *     even-against-a-quantum-sender choice privacy, but against an actively-malicious receiver it has an
+ *     IRREDUCIBLE residue from the opaque primitive: a receiver that runs keygen twice and keeps BOTH
+ *     secret keys learns both messages, and the decisional-MLWE indistinguishability that gives choice
+ *     privacy makes that cheat undetectable to the sender (see `kem-ot.ts` header).
+ *
+ * The combiner runs BOTH base OTs on the SAME choice bit and the SAME session, then derives each
+ * transfer key from BOTH halves' shared secrets:
+ *
+ *     k_b = H( DOMAIN_SEP ‖ sid ‖ i ‖ b ‖ ss_ec_b ‖ ss_kem_b )        for b ∈ {0, 1}
+ *
+ * where `ss_ec_b` is the EC random-OT pad (`malBaseRandomOT`) and `ss_kem_b` the committed ML-KEM
+ * random-OT secret (`kemBaseOtMalRandom`, the hardened variant — never the semi-honest one). The sender
+ * one-time-pads `m_b` under `k_b` and commits to it (`com_b`); the honest receiver reconstructs only
+ * `k_c` (it holds only `ss_ec_c` and `ss_kem_c`) and checks `com_c`.
+ *
+ * ─── WHAT THIS ACHIEVES (precise) ───────────────────────────────────────────────────────────────────
+ * To recover `m_{1−c}` an adversary needs `k_{1−c}`, hence BOTH `ss_ec_{1−c}` AND `ss_kem_{1−c}` (the
+ * hash is a random oracle; missing either input leaves the pad pseudorandom). Therefore:
+ *   • vs a CLASSICAL malicious receiver — MALICIOUS-secure. Even a receiver that defeats the KEM half
+ *     entirely by keeping both ML-KEM secrets (so it holds `ss_kem_{1−c}`) still cannot obtain
+ *     `ss_ec_{1−c}`: the EC base OT is malicious-secure and `ss_ec_{1−c} = H(y·R − T)` is a point the
+ *     receiver cannot compute without the discrete log of `S`. No `ss_ec_{1−c}` ⇒ no `k_{1−c}` ⇒ `m_{1−c}`
+ *     stays hidden. This is the KILLER property the tests prove.
+ *   • SENDER PRIVACY vs a SEMI-HONEST QUANTUM receiver — holds via the KEM half (Module-LWE): a quantum
+ *     receiver that follows the protocol (discards the non-chosen material) cannot get `ss_kem_{1−c}`,
+ *     so again `k_{1−c}` is unobtainable even though it could break the EC half with Shor.
+ *   • CHOICE PRIVACY — POST-QUANTUM. The KEM half's choice privacy is unconditional (two i.i.d. real
+ *     ML-KEM public keys on the wire); the EC half's is information-theoretic in its transcript (`R` is a
+ *     uniform subgroup element whatever `c` is). Neither leaks `c`, against any adversary.
+ *   • SESSION BINDING — both halves are bound to a COMMON `sid` derived from BOTH sub-protocols'
+ *     session material (the KEM `(rn, sn)` nonces and the EC point `S`), and `sid` is hashed into every
+ *     transfer key and commitment, so secrets from one session/opened-key-set cannot be replayed into
+ *     another. The KEM half additionally aborts (`KemBaseOtAbort`) if the receiver opens keys other than
+ *     the ones it committed to; the EC half aborts (`BaseOtAbort`/`PointValidationError`) on a bad proof
+ *     or an off-/small-order point; and the combiner aborts (`HybridOtAbort`) if a tampered ciphertext
+ *     fails its commitment.
+ *
+ * ─── THE HONEST BOUNDARY (NOT faked) ────────────────────────────────────────────────────────────────
+ * The one residue this combiner does NOT close is a receiver that is SIMULTANEOUSLY actively-malicious
+ * AND quantum: such a receiver could break the classical EC half with Shor (recovering `ss_ec_{1−c}`
+ * from the transcript) WHILE keeping both ML-KEM secrets (recovering `ss_kem_{1−c}`), and so assemble
+ * `k_{1−c}`. Closing THAT requires a base OT that is BOTH post-quantum AND malicious-secure in one
+ * primitive — i.e. an endemic/UC OT from Module-LWE with a CRS, which needs direct lattice module
+ * arithmetic (sampling / adding in ML-KEM's structured public-key space to plant a secretless slot).
+ * The opaque `ml_kem768` keygen/encaps/decaps interface this package is restricted to does NOT expose
+ * that arithmetic, and hand-rolling it is exactly the lattice crypto the module forbids. So this is the
+ * honest limit of what a KEM-opaque + EC combiner can reach; it is stated, not papered over.
+ *
+ * No hand-rolled crypto: the EC half goes through `malBaseRandomOT` (unchanged), the KEM half through
+ * `kemBaseOtMalRandom` (unchanged), and this module only hashes (SHA-256 RO) and XORs their outputs.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.HybridOtAbort = void 0;
+exports.hybridSessionId = hybridSessionId;
+exports.hybridTransferKey = hybridTransferKey;
+exports.hybridSenderEncrypt = hybridSenderEncrypt;
+exports.hybridReceiverRecover = hybridReceiverRecover;
+exports.hybridBaseOT = hybridBaseOT;
+exports.withHybridBaseOt = withHybridBaseOt;
+const node_crypto_1 = require("node:crypto");
+const ec_1 = require("./ec");
+const ot_1 = require("./ot");
+const kem_ot_1 = require("./kem-ot");
+const csprng_1 = require("./csprng");
+const TAG_HYBRID_SID = new TextEncoder().encode('atlas-pca-mpc/hybrid-ot-sid');
+const TAG_HYBRID_KEY = new TextEncoder().encode('atlas-pca-mpc/hybrid-ot-transfer-key');
+const TAG_HYBRID_COMMIT = new TextEncoder().encode('atlas-pca-mpc/hybrid-ot-msg-commit');
+function sha256(...chunks) {
+    const h = (0, node_crypto_1.createHash)('sha256');
+    for (const c of chunks)
+        h.update(c);
+    return new Uint8Array(h.digest());
+}
+function u32(x) {
+    const b = new Uint8Array(4);
+    b[0] = (x >>> 24) & 0xff;
+    b[1] = (x >>> 16) & 0xff;
+    b[2] = (x >>> 8) & 0xff;
+    b[3] = x & 0xff;
+    return b;
+}
+function xorBytes(a, b) {
+    if (a.length !== b.length)
+        throw new Error('hybrid-ot: XOR length mismatch');
+    const out = new Uint8Array(a.length);
+    for (let i = 0; i < a.length; i++)
+        out[i] = a[i] ^ b[i];
+    return out;
+}
+function ctEqual(a, b) {
+    return a.length === b.length && (0, node_crypto_1.timingSafeEqual)(Buffer.from(a), Buffer.from(b));
+}
+/** Raised when the hybrid combiner aborts: a sender ciphertext inconsistent with its commitment is caught. */
+class HybridOtAbort extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'HybridOtAbort';
+    }
+}
+exports.HybridOtAbort = HybridOtAbort;
+/**
+ * The COMMON session id binding both halves: `H(TAG ‖ kemSid ‖ encode(ecS))`. It folds the KEM
+ * sub-protocol's two-nonce session id (`rn, sn`) and the EC sub-protocol's point `S`, so neither party
+ * alone fixes it and secrets cannot be mixed across sessions. Both parties derive the same value from
+ * the public transcript.
+ */
+function hybridSessionId(kemSid, ecS) {
+    return sha256(TAG_HYBRID_SID, kemSid, (0, ec_1.encodePoint)(ecS));
+}
+/**
+ * The hybrid transfer key for one slot: `H(TAG ‖ sid ‖ i ‖ slot ‖ ss_ec ‖ ss_kem)` expanded (SHA-256
+ * counter mode) to `len` bytes. Modelled as a random oracle: the key is pseudorandom unless BOTH
+ * `ss_ec` and `ss_kem` (for that exact slot/index/session) are supplied — the soundness crux of the
+ * combiner.
+ */
+function hybridTransferKey(sid, index, slot, ssEc, ssKem, len) {
+    const out = new Uint8Array(len);
+    let produced = 0;
+    let ctr = 0;
+    while (produced < len) {
+        const block = sha256(TAG_HYBRID_KEY, sid, u32(index), Uint8Array.of(slot & 1), u32(ctr), ssEc, ssKem);
+        for (let k = 0; k < block.length && produced < len; k++)
+            out[produced++] = block[k];
+        ctr++;
+    }
+    return out;
+}
+/** Per-message RO commitment `com = H(TAG ‖ sid ‖ i ‖ slot ‖ msg ‖ key)`, bound to the session. */
+function hybridCommit(sid, index, slot, msg, key) {
+    return sha256(TAG_HYBRID_COMMIT, sid, u32(index), Uint8Array.of(slot & 1), msg, key);
+}
+/**
+ * SENDER side of the combiner: given BOTH halves' per-slot shared secrets, derive both transfer keys,
+ * one-time-pad each message, and commit to each. `ecSecrets[i] = [ss_ec_0, ss_ec_1]` (the EC random-OT
+ * `senderPads`), `kemSecrets[i] = [ss_kem_0, ss_kem_1]` (the committed-KEM `senderSecrets`).
+ */
+function hybridSenderEncrypt(sid, messages, ecSecrets, kemSecrets) {
+    if (messages.length !== ecSecrets.length || messages.length !== kemSecrets.length) {
+        throw new Error('hybridSenderEncrypt: messages/ecSecrets/kemSecrets length mismatch');
+    }
+    const encrypted = [];
+    const commitments = [];
+    for (let i = 0; i < messages.length; i++) {
+        const [m0, m1] = messages[i];
+        if (m0.length !== m1.length) {
+            throw new Error(`hybridSenderEncrypt (index ${i}): the two messages must be equal length`);
+        }
+        const k0 = hybridTransferKey(sid, i, 0, ecSecrets[i][0], kemSecrets[i][0], m0.length);
+        const k1 = hybridTransferKey(sid, i, 1, ecSecrets[i][1], kemSecrets[i][1], m1.length);
+        encrypted.push([xorBytes(m0, k0), xorBytes(m1, k1)]);
+        commitments.push([hybridCommit(sid, i, 0, m0, k0), hybridCommit(sid, i, 1, m1, k1)]);
+    }
+    return { encrypted, commitments };
+}
+/**
+ * RECEIVER side of the combiner: reconstruct ONLY the chosen transfer key (from the chosen EC and KEM
+ * secrets the receiver legitimately holds), unmask the chosen message, and CHECK the commitment.
+ * `ecRecv[i] = ss_ec_{choices[i]}` (the EC `recvPads`), `kemRecv[i] = ss_kem_{choices[i]}` (the
+ * committed-KEM `recvSecrets`). Aborts (`HybridOtAbort`) if the recovered message fails its commitment.
+ */
+function hybridReceiverRecover(sid, choices, sender, ecRecv, kemRecv) {
+    const { encrypted, commitments } = sender;
+    if (encrypted.length !== choices.length ||
+        commitments.length !== choices.length ||
+        ecRecv.length !== choices.length ||
+        kemRecv.length !== choices.length) {
+        throw new Error('hybridReceiverRecover: length mismatch');
+    }
+    const received = [];
+    for (let i = 0; i < choices.length; i++) {
+        const c = choices[i] & 1;
+        const e = encrypted[i][c];
+        const key = hybridTransferKey(sid, i, c, ecRecv[i], kemRecv[i], e.length);
+        const m = xorBytes(e, key);
+        const check = hybridCommit(sid, i, c, m, key);
+        if (!ctEqual(check, commitments[i][c])) {
+            throw new HybridOtAbort(`hybrid base OT (index ${i}): sender ciphertext inconsistent with its commitment; aborting`);
+        }
+        received.push(m);
+    }
+    return received;
+}
+/**
+ * In-process combined simulator (both parties in one call), matching the shape of `baseOT`/`kemBaseOT`
+ * so it is a drop-in for `OtChannel`'s `baseOtFn` (`withHybridBaseOt`). Runs the malicious-secure EC
+ * base OT and the committed ML-KEM base OT on the SAME choices, binds both to a common `sid`, and
+ * combines their per-slot secrets into the transfer keys. A cheating party is caught by whichever
+ * half's check applies (EC proof/point validation, KEM commitment, or the hybrid ciphertext
+ * commitment). `tamper` injects malicious behaviour for tests.
+ */
+function hybridBaseOT(messages, choices, rng = (0, csprng_1.secureOtRandom)(), tamper) {
+    if (messages.length !== choices.length) {
+        throw new Error('hybridBaseOT: messages/choices length mismatch');
+    }
+    // EC half: malicious-secure random OT with ALL checks ON (Schnorr proof + subgroup validation).
+    const ec = (0, ot_1.malBaseRandomOT)(choices, rng, tamper?.ec);
+    // KEM half: the committed/session-bound random OT (aborts on an opened-key/commitment mismatch).
+    const kem = (0, kem_ot_1.kemBaseOtMalRandom)(choices, rng, tamper?.kem);
+    const sid = hybridSessionId(kem.sid, ec.S);
+    const sender = hybridSenderEncrypt(sid, messages, ec.senderPads, kem.senderSecrets);
+    // A malicious hybrid SENDER may corrupt the ciphertexts on the wire (test-injected).
+    if (tamper?.tamperEncrypted)
+        tamper.tamperEncrypted(sender.encrypted);
+    const received = hybridReceiverRecover(sid, choices, sender, ec.recvPads, kem.recvSecrets);
+    return {
+        received,
+        transcript: {
+            sid,
+            ecS: ec.S,
+            kemSid: kem.sid,
+            encrypted: sender.encrypted,
+            commitments: sender.commitments,
+        },
+    };
+}
+/**
+ * Wire the HYBRID base OT into the KOS OT-extension: a drop-in for `withKemBaseOt`/`withKemBaseOtMal`
+ * that makes `OtChannel` run its κ setup base OTs over the combiner. The extension inherits the
+ * combiner's guarantee — malicious security vs a classical receiver, PQ sender-privacy vs a semi-honest
+ * quantum one, and PQ choice privacy — with everything above the base OT (IKNP matrix, KOS correlation
+ * check, correlation-robust hash) unchanged.
+ *
+ *   const ch = new OtChannel(secureOtRandom(), withHybridBaseOt());
+ */
+function withHybridBaseOt() {
+    return { baseOtFn: (m, c, r) => ({ received: hybridBaseOT(m, c, r).received }) };
+}
+//# sourceMappingURL=hybrid-ot.js.map

package/dist/hybrid-ot.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hybrid-ot.js","sourceRoot":"","sources":["../src/hybrid-ot.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8DG;;;AA4DH,0CAEC;AAQD,8CAyBC;AA0BD,kDAsBC;AAQD,sDA+BC;AA2CD,oCA+BC;AAWD,4CAEC;AA3QD,6CAA0D;AAC1D,6BAA+C;AAC/C,6BAKc;AACd,qCAGkB;AAClB,qCAA0C;AAE1C,MAAM,cAAc,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,6BAA6B,CAAC,CAAC;AAC/E,MAAM,cAAc,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,sCAAsC,CAAC,CAAC;AACxF,MAAM,iBAAiB,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,oCAAoC,CAAC,CAAC;AAEzF,SAAS,MAAM,CAAC,GAAG,MAAoB;IACrC,MAAM,CAAC,GAAG,IAAA,wBAAU,EAAC,QAAQ,CAAC,CAAC;IAC/B,KAAK,MAAM,CAAC,IAAI,MAAM;QAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IACpC,OAAO,IAAI,UAAU,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;AACpC,CAAC;AAED,SAAS,GAAG,CAAC,CAAS;IACpB,MAAM,CAAC,GAAG,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC;IAC5B,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,CAAC,GAAG,IAAI,CAAC;IACzB,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,CAAC,GAAG,IAAI,CAAC;IACzB,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,IAAI,CAAC;IACxB,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC;IAChB,OAAO,CAAC,CAAC;AACX,CAAC;AAED,SAAS,QAAQ,CAAC,CAAa,EAAE,CAAa;IAC5C,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;IAC7E,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IACrC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAE,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC;IAC1D,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,OAAO,CAAC,CAAa,EAAE,CAAa;IAC3C,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,IAAI,IAAA,6BAAe,EAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;AAClF,CAAC;AAED,8GAA8G;AAC9G,MAAa,aAAc,SAAQ,KAAK;IACtC,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,eAAe,CAAC;IAC9B,CAAC;CACF;AALD,sCAKC;AAED;;;;;GAKG;AACH,SAAgB,eAAe,CAAC,MAAkB,EAAE,GAAU;IAC5D,OAAO,MAAM,CAAC,cAAc,EAAE,MAAM,EAAE,IAAA,gBAAW,EAAC,GAAG,CAAC,CAAC,CAAC;AAC1D,CAAC;AAED;;;;;GAKG;AACH,SAAgB,iBAAiB,CAC/B,GAAe,EACf,KAAa,EACb,IAAY,EACZ,IAAgB,EAChB,KAAiB,EACjB,GAAW;IAEX,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC;IAChC,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,IAAI,GAAG,GAAG,CAAC,CAAC;IACZ,OAAO,QAAQ,GAAG,GAAG,EAAE,CAAC;QACtB,MAAM,KAAK,GAAG,MAAM,CAClB,cAAc,EACd,GAAG,EACH,GAAG,CAAC,KAAK,CAAC,EACV,UAAU,CAAC,EAAE,CAAC,IAAI,GAAG,CAAC,CAAC,EACvB,GAAG,CAAC,GAAG,CAAC,EACR,IAAI,EACJ,KAAK,CACN,CAAC;QACF,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,IAAI,QAAQ,GAAG,GAAG,EAAE,CAAC,EAAE;YAAE,GAAG,CAAC,QAAQ,EAAE,CAAC,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC;QACrF,GAAG,EAAE,CAAC;IACR,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,mGAAmG;AACnG,SAAS,YAAY,CACnB,GAAe,EACf,KAAa,EACb,IAAY,EACZ,GAAe,EACf,GAAe;IAEf,OAAO,MAAM,CAAC,iBAAiB,EAAE,GAAG,EAAE,GAAG,CAAC,KAAK,CAAC,EAAE,UAAU,CAAC,EAAE,CAAC,IAAI,GAAG,CAAC,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;AACvF,CAAC;AAUD;;;;GAIG;AACH,SAAgB,mBAAmB,CACjC,GAAe,EACf,QAAyC,EACzC,SAA0C,EAC1C,UAA2C;IAE3C,IAAI,QAAQ,CAAC,MAAM,KAAK,SAAS,CAAC,MAAM,IAAI,QAAQ,CAAC,MAAM,KAAK,UAAU,CAAC,MAAM,EAAE,CAAC;QAClF,MAAM,IAAI,KAAK,CAAC,oEAAoE,CAAC,CAAC;IACxF,CAAC;IACD,MAAM,SAAS,GAAoC,EAAE,CAAC;IACtD,MAAM,WAAW,GAAoC,EAAE,CAAC;IACxD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACzC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,GAAG,QAAQ,CAAC,CAAC,CAAE,CAAC;QAC9B,IAAI,EAAE,CAAC,MAAM,KAAK,EAAE,CAAC,MAAM,EAAE,CAAC;YAC5B,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,0CAA0C,CAAC,CAAC;QAC7F,CAAC;QACD,MAAM,EAAE,GAAG,iBAAiB,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,EAAE,SAAS,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC;QACxF,MAAM,EAAE,GAAG,iBAAiB,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,EAAE,SAAS,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC;QACxF,SAAS,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,QAAQ,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;QACrD,WAAW,CAAC,IAAI,CAAC,CAAC,YAAY,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,YAAY,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;IACvF,CAAC;IACD,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,CAAC;AACpC,CAAC;AAED;;;;;GAKG;AACH,SAAgB,qBAAqB,CACnC,GAAe,EACf,OAAiB,EACjB,MAA2B,EAC3B,MAAoB,EACpB,OAAqB;IAErB,MAAM,EAAE,SAAS,EAAE,WAAW,EAAE,GAAG,MAAM,CAAC;IAC1C,IACE,SAAS,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM;QACnC,WAAW,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM;QACrC,MAAM,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM;QAChC,OAAO,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM,EACjC,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;IAC5D,CAAC;IACD,MAAM,QAAQ,GAAiB,EAAE,CAAC;IAClC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACxC,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,CAAE,GAAG,CAAC,CAAC;QAC1B,MAAM,CAAC,GAAG,SAAS,CAAC,CAAC,CAAE,CAAC,CAAC,CAAE,CAAC;QAC5B,MAAM,GAAG,GAAG,iBAAiB,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC,CAAE,EAAE,OAAO,CAAC,CAAC,CAAE,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC;QAC5E,MAAM,CAAC,GAAG,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QAC3B,MAAM,KAAK,GAAG,YAAY,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC;QAC9C,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC,CAAE,CAAC,CAAC,CAAE,CAAC,EAAE,CAAC;YACzC,MAAM,IAAI,aAAa,CACrB,yBAAyB,CAAC,iEAAiE,CAC5F,CAAC;QACJ,CAAC;QACD,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACnB,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAmCD;;;;;;;GAOG;AACH,SAAgB,YAAY,CAC1B,QAAyC,EACzC,OAAiB,EACjB,MAAgB,IAAA,uBAAc,GAAE,EAChC,MAA2B;IAE3B,IAAI,QAAQ,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC;QACvC,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;IACpE,CAAC;IACD,gGAAgG;IAChG,MAAM,EAAE,GAAG,IAAA,oBAAe,EAAC,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;IACrD,iGAAiG;IACjG,MAAM,GAAG,GAAG,IAAA,2BAAkB,EAAC,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC;IAE1D,MAAM,GAAG,GAAG,eAAe,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;IAC3C,MAAM,MAAM,GAAG,mBAAmB,CAAC,GAAG,EAAE,QAAQ,EAAE,EAAE,CAAC,UAAU,EAAE,GAAG,CAAC,aAAa,CAAC,CAAC;IAEpF,qFAAqF;IACrF,IAAI,MAAM,EAAE,eAAe;QAAE,MAAM,CAAC,eAAe,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IAEtE,MAAM,QAAQ,GAAG,qBAAqB,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,CAAC,QAAQ,EAAE,GAAG,CAAC,WAAW,CAAC,CAAC;IAC3F,OAAO;QACL,QAAQ;QACR,UAAU,EAAE;YACV,GAAG;YACH,GAAG,EAAE,EAAE,CAAC,CAAC;YACT,MAAM,EAAE,GAAG,CAAC,GAAG;YACf,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,WAAW,EAAE,MAAM,CAAC,WAAW;SAChC;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,SAAgB,gBAAgB;IAC9B,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,YAAY,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,EAAE,CAAC;AACnF,CAAC"}

package/dist/index.d.ts

@@ -24,4 +24,6 @@ export * from './gf128';
 export * from './csprng';
 export * from './ot';
 export * from './kem-ot';
+export * from './hybrid-ot';
 export * from './mascot';
+export * from './endemic-ot';

package/dist/index.js

@@ -40,5 +40,7 @@ __exportStar(require("./gf128"), exports);
 __exportStar(require("./csprng"), exports);
 __exportStar(require("./ot"), exports);
 __exportStar(require("./kem-ot"), exports);
+__exportStar(require("./hybrid-ot"), exports);
 __exportStar(require("./mascot"), exports);
+__exportStar(require("./endemic-ot"), exports);
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;GAWG;;;;;;;;;;;;;;;;AAEH,0CAAwB;AACxB,4CAA0B;AAC1B,2CAAyB;AACzB,gDAA8B;AAC9B,0CAAwB;AACxB,4CAA0B;AAC1B,2CAAyB;AACzB,yCAAuB;AACvB,gDAA8B;AAC9B,uCAAqB;AACrB,0CAAwB;AACxB,2CAAyB;AACzB,uCAAqB;AACrB,2CAAyB;AACzB,2CAAyB"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;GAWG;;;;;;;;;;;;;;;;AAEH,0CAAwB;AACxB,4CAA0B;AAC1B,2CAAyB;AACzB,gDAA8B;AAC9B,0CAAwB;AACxB,4CAA0B;AAC1B,2CAAyB;AACzB,yCAAuB;AACvB,gDAA8B;AAC9B,uCAAqB;AACrB,0CAAwB;AACxB,2CAAyB;AACzB,uCAAqB;AACrB,2CAAyB;AACzB,8CAA4B;AAC5B,2CAAyB;AACzB,+CAA6B"}

package/dist/kem-ot.d.ts

@@ -43,18 +43,41 @@
  *     rests on Module-LWE (ML-KEM-768, NIST security level ~3) and a hash in the ROM — no classical
  *     discrete-log anywhere, which is the entire point of P3.
  *
- * ─── LIFTING TOWARD MALICIOUS (how this plugs into the stack) ──────────────────────────────────────
- * These base OTs feed the existing KOS OT-extension (`ot.ts`). KOS runs the base OTs with ROLES
- * INVERTED (the extension *sender* is the base *receiver*, holding the secret selector s) and then adds
- * the KOS correlation check over sacrifice rows, which catches an extension receiver that deviates. The
- * malicious surface a semi-honest base OT leaves open — a base receiver keeping both secrets — maps to
- * the extension *sender* learning the extension *receiver*'s seed pairs; KOS's consistency machinery and
- * the correlation-robust hash are what constrain that, exactly as documented for the IKNP/KOS layer.
- * HONEST CAVEAT: a semi-honest base OT does not give a fully malicious base OT on its own; a
- * deployment wanting malicious base security would add a base-OT consistency/commitment round (as the
- * EC `baseOT` wrapper does with its per-message RO commitment). The KOS layer above raises the overall
- * extension to malicious-with-abort against a cheating *extension receiver*, which is the attack IKNP is
- * vulnerable to; see `ot.ts` for that argument.
+ * ─── MALICIOUS-RECEIVER HARDENING (`kemBaseOtMal`, below) ──────────────────────────────────────────
+ * The semi-honest base OT above leaves two malicious-receiver surfaces. The committed variant
+ * `kemBaseOtMal` closes the one that CAN be closed from an opaque KEM, and documents — precisely,
+ * rather than faking a defence — the one that cannot:
+ *
+ *   CLOSED (by an RO-commitment + session binding, mirroring the EC `baseOT`'s commit round):
+ *     • ADAPTIVE / MALLEABLE / REPLAYED key material. The receiver first sends only a RO-commitment
+ *       `com = H(rn ‖ pk_0 ‖ pk_1)` to its ordered public keys (and a receiver nonce `rn`); the sender
+ *       replies with a fresh nonce `sn`; the parties set `sid = H(rn ‖ sn)`; only THEN does the receiver
+ *       open `(pk_0, pk_1)` and the sender encapsulate, binding every pad to `(sid, com)`. The sender
+ *       recomputes `com` from the opened keys and ABORTS on any mismatch. So the receiver must fix its
+ *       keys BEFORE it learns `sn` (no adaptive/precomputed/related-key choice, no cross-session replay),
+ *       and cannot open keys other than the ones it committed to — exactly the non-malleability the EC
+ *       base OT gets from `R` being a single committed group element.
+ *
+ *   NOT CLOSABLE from an OPAQUE ML-KEM, and WHY (an impossibility, not a shortcut):
+ *     • A receiver that simply runs keygen TWICE and keeps BOTH secret keys learns both messages. To
+ *       stop it the protocol would have to force one slot to a public key whose secret NOBODY knows
+ *       (the Masny–Rindal "endemic OT" idea: `pk_{1−c}` derived in the public-key space from a random
+ *       oracle / a common reference). That needs either (i) sampling / adding in ML-KEM's structured
+ *       public-key space — reaching into the Module-LWE internals this module forbids (no hand-rolled
+ *       lattice crypto), or (ii) a trusted setup / CRS. Crucially, the SAME decisional-Module-LWE
+ *       indistinguishability that makes choice privacy hold (a real `pk` ≈ a uniform one) is what makes
+ *       a cheating "both-keys-real" receiver UNDETECTABLE to the sender: it cannot tell a secretless
+ *       slot from a real one. So this residue is intrinsic to the opaque primitive.
+ *
+ * ─── LIFTING THE RESIDUE (how this plugs into the stack) ───────────────────────────────────────────
+ * The residue is closed exactly where the EC stack closes its analogue: the KOS OT-extension (`ot.ts`).
+ * KOS runs the base OTs with ROLES INVERTED (the extension *sender* is the base *receiver*, holding the
+ * secret selector s) and adds the correlation check over sacrifice rows. A base receiver keeping both
+ * secrets maps to the extension *sender* learning the extension *receiver*'s seed pairs; the KOS
+ * consistency machinery + correlation-robust hash constrain that, raising the overall extension to
+ * malicious-with-abort against a cheating extension receiver — the attack IKNP is vulnerable to. So
+ * `kemBaseOtMal` is the right base layer: it hardens everything the opaque KEM allows (commitment /
+ * binding), and defers only the intrinsic residue to the layer that already handles it.
  *
  * No hand-rolled lattice crypto: all PQ operations go through `ml_kem768` (keygen/encapsulate/
  * decapsulate) as a black box. Randomness follows the module policy — a CSPRNG (`secureOtRandom`) by
@@ -135,3 +158,135 @@ export declare function kemBaseOT(messages: Array<[Uint8Array, Uint8Array]>, cho
  *   const ch = new OtChannel(secureOtRandom(), withKemBaseOt());
  */
 export declare function withKemBaseOt(): ConstructorParameters<typeof OtChannel>[1];
+/** Raised when the committed KEM base OT aborts: a cheating receiver (opened keys ≠ commitment) is caught. */
+export declare class KemBaseOtAbort extends Error {
+    constructor(message: string);
+}
+/** Receiver round-1 message: a nonce + the per-transfer commitments (public keys NOT yet revealed). */
+export interface KemMalCommitMessage {
+    /** Receiver nonce `rn`, bound into every commitment and into `sid`. */
+    rn: Uint8Array;
+    /** Per-transfer RO-commitment `com_i = H(rn ‖ i ‖ pk_0 ‖ pk_1)`. */
+    commitments: Uint8Array[];
+}
+/** Receiver round-3 message: the opening of the committed public keys. */
+export interface KemMalOpenMessage {
+    /** For each transfer i, the ordered public keys `[pk_0, pk_1]` the sender encapsulates under. */
+    publicKeys: Array<[Uint8Array, Uint8Array]>;
+}
+/** Sender round-2 message: the sender nonce `sn` completing the session id. */
+export interface KemMalSenderNonce {
+    sn: Uint8Array;
+}
+/** Sender round-4 message: ciphertexts + `(sid, com)`-bound padded messages. */
+export interface KemMalSenderMessage {
+    ciphertexts: Array<[Uint8Array, Uint8Array]>;
+    encrypted: Array<[Uint8Array, Uint8Array]>;
+}
+/** The receiver's retained state across the committed flow. */
+export interface KemMalReceiverState {
+    choices: number[];
+    /** The chosen secret key per transfer (`sk_{choices[i]}`); the non-chosen secret is discarded. */
+    secretKeys: Uint8Array[];
+    /** The ordered public keys (opened in round 3). */
+    publicKeys: Array<[Uint8Array, Uint8Array]>;
+    rn: Uint8Array;
+}
+/** A full committed KEM base-OT transcript, exposed for inspection/tests. */
+export interface KemMalTranscript extends KemMalCommitMessage, KemMalOpenMessage, KemMalSenderNonce, KemMalSenderMessage {
+}
+export interface KemBaseOtMalResult {
+    received: Uint8Array[];
+    transcript: KemMalTranscript;
+}
+/**
+ * TEST-ONLY injection points modelling a malicious RECEIVER in the committed flow. Each hook mutates a
+ * value exactly where it crosses the wire, so the honest sender's checks run against the adversarial
+ * value.
+ */
+export interface KemMalTamper {
+    /** Malicious receiver: open public keys DIFFERENT from the committed ones (→ sender abort). */
+    tamperOpenedKeys?: (publicKeys: Array<[Uint8Array, Uint8Array]>) => void;
+    /** Malicious receiver/MITM: tamper the sender nonce the receiver binds `sid` with (→ pad mismatch). */
+    tamperReceiverSid?: (sid: Uint8Array) => Uint8Array;
+}
+/**
+ * RECEIVER round 1: generate the keypairs (keeping only the chosen secret), draw a nonce `rn`, and send
+ * only the COMMITMENTS to the ordered public keys. Returns the round-1 wire message plus the retained
+ * state (which holds the not-yet-revealed public keys for the round-3 opening).
+ */
+export declare function kemBaseOtMalCommit(choices: number[], rng?: OtRandom): {
+    message: KemMalCommitMessage;
+    state: KemMalReceiverState;
+};
+/** SENDER round 2: draw the sender nonce `sn` completing the session id. */
+export declare function kemBaseOtMalSenderNonce(rng?: OtRandom): KemMalSenderNonce;
+/** RECEIVER round 3: open the committed public keys (the sender will re-check them against `com`). */
+export declare function kemBaseOtMalOpen(state: KemMalReceiverState): KemMalOpenMessage;
+/**
+ * SENDER round 4: VERIFY the opened keys against the round-1 commitments (ABORT on mismatch), then
+ * encapsulate under each and one-time-pad each message with a `(sid, com)`-bound pad.
+ */
+export declare function kemBaseOtMalSend(messages: Array<[Uint8Array, Uint8Array]>, commit: KemMalCommitMessage, senderNonce: KemMalSenderNonce, opening: KemMalOpenMessage, rng?: OtRandom): KemMalSenderMessage;
+/**
+ * RECEIVER round 5: decapsulate ONLY the chosen ciphertext and unmask with the `(sid, com)`-bound pad.
+ */
+export declare function kemBaseOtMalRecover(state: KemMalReceiverState, senderNonce: KemMalSenderNonce, senderMessage: KemMalSenderMessage, tamper?: KemMalTamper): Uint8Array[];
+/**
+ * In-process combined simulator for the MALICIOUS-HARDENED committed KEM base OT, matching the shape of
+ * `kemBaseOT` so it is a drop-in for `OtChannel`'s `baseOtFn` (`withKemBaseOtMal`). Runs all five
+ * rounds; a cheating receiver (opened keys ≠ commitment) makes the sender throw `KemBaseOtAbort`. The
+ * `tamper` hook injects malicious-receiver behaviour for tests.
+ */
+export declare function kemBaseOtMal(messages: Array<[Uint8Array, Uint8Array]>, choices: number[], rng?: OtRandom, tamper?: KemMalTamper): KemBaseOtMalResult;
+/**
+ * Wire the MALICIOUS-HARDENED committed ML-KEM base OT into the KOS OT-extension — the recommended
+ * post-quantum base. Like `withKemBaseOt`, but the κ setup base OTs run the committed/session-bound
+ * protocol (and abort on a cheating receiver). Everything above the base OT is unchanged.
+ *
+ *   const ch = new OtChannel(secureOtRandom(), withKemBaseOtMal());
+ */
+export declare function withKemBaseOtMal(): ConstructorParameters<typeof OtChannel>[1];
+/** Byte length of a derived committed-KEM random-OT shared secret. */
+export declare const KEM_OT_SECRET_BYTES = 32;
+/** Sender round-4 message of the committed KEM RANDOM OT: ciphertexts (wire) + both per-slot secrets (sender-local). */
+export interface KemMalRandomSenderMessage {
+    /** For each transfer i, the ML-KEM ciphertexts `[ct_0, ct_1]` (the only part that crosses the wire). */
+    ciphertexts: Array<[Uint8Array, Uint8Array]>;
+    /** Sender-LOCAL: the two session-bound shared secrets `[ss_0, ss_1]` per transfer (never sent). */
+    senderSecrets: Array<[Uint8Array, Uint8Array]>;
+}
+/** A full committed KEM RANDOM-OT transcript + the two parties' shared-secret outputs. */
+export interface KemBaseOtMalRandomResult {
+    /** Sender's per-slot shared secrets `[ss_0, ss_1]` per transfer (the sender learns BOTH). */
+    senderSecrets: Array<[Uint8Array, Uint8Array]>;
+    /** Receiver's chosen shared secret `ss_{choices[i]}` per transfer (the honest receiver learns ONE). */
+    recvSecrets: Uint8Array[];
+    /** The session id `sid = H(rn ‖ sn)` the secrets are bound to (public; both parties derive it). */
+    sid: Uint8Array;
+    transcript: {
+        rn: Uint8Array;
+        commitments: Uint8Array[];
+        sn: Uint8Array;
+        publicKeys: Array<[Uint8Array, Uint8Array]>;
+        ciphertexts: Array<[Uint8Array, Uint8Array]>;
+    };
+}
+/**
+ * SENDER round 4 (RANDOM variant): VERIFY the opened keys against the round-1 commitments (ABORT on
+ * mismatch), encapsulate under each, and derive BOTH per-slot session-bound shared secrets. No messages
+ * are padded — the two secrets per transfer ARE the random output.
+ */
+export declare function kemBaseOtMalRandomSend(commit: KemMalCommitMessage, senderNonce: KemMalSenderNonce, opening: KemMalOpenMessage, rng?: OtRandom): KemMalRandomSenderMessage;
+/**
+ * RECEIVER round 5 (RANDOM variant): decapsulate ONLY the chosen ciphertext and derive the chosen
+ * session-bound shared secret. The receiver never touches the non-chosen slot (it kept no secret for it).
+ */
+export declare function kemBaseOtMalRandomRecover(state: KemMalReceiverState, senderNonce: KemMalSenderNonce, senderMessage: KemMalRandomSenderMessage, tamper?: KemMalTamper): Uint8Array[];
+/**
+ * In-process combined simulator for the committed KEM RANDOM OT. Runs the same five rounds as
+ * `kemBaseOtMal` (commit → sender nonce → open → verify+encapsulate → recover) but outputs per-slot
+ * shared secrets instead of padded messages. A cheating receiver (opened keys ≠ commitment) makes the
+ * sender throw `KemBaseOtAbort`. The `tamper` hook injects malicious-receiver behaviour for tests.
+ */
+export declare function kemBaseOtMalRandom(choices: number[], rng?: OtRandom, tamper?: KemMalTamper): KemBaseOtMalRandomResult;