@noble/post-quantum 0.4.1 → 0.5.1

package/hybrid.js

@@ -0,0 +1,283 @@
+/**
+ * Post-Quantum Hybrid Cryptography
+ *
+ * The current implementation is flawed and likely redundant. We should offer
+ * a small, generic API to compose hybrid schemes instead of reimplementing
+ * protocol-specific logic (SSH, GPG, etc.) with ad hoc encodings.
+ *
+ * 1. Core Issues
+ *    - sign/verify: implemented as two separate operations with different keys.
+ *    - EC getSharedSecret: could be refactored into a proper KEM.
+ *    - Multiple calls: keys, signatures, and shared secrets could be
+ *      concatenated to reduce the number of API invocations.
+ *    - Reinvention: most libraries add strange domain separations and
+ *      encodings instead of simple byte concatenation.
+ *
+ * 2. API Goals
+ *    - Provide primitives to build hybrids generically.
+ *    - Avoid embedding SSH- or GPG-specific formats in the core API.
+ *
+ * 3. Edge Cases
+ *    • Variable-length signatures:
+ *      - DER-encoded (Weierstrass curves).
+ *      - Falcon (unpadded).
+ *      - Concatenation works only if length is fixed; otherwise a length
+ *        prefix is required (but that breaks compatibility).
+ *
+ *    • getSharedSecret:
+ *      - Default: non-KEM (authenticated ECDH).
+ *      - KEM conversion: generate a random SK to remove implicit auth.
+ *
+ * 4. Common Pitfalls
+ *    - Seed expansion:
+ *      • Expanding a small seed into multiple keys reduces entropy.
+ *      • API should allow identity mapping (no expansion).
+ *
+ *    - Skipping full point encoding:
+ *      • Some omit the compression byte (parity) for WebCrypto compatibility.
+ *      • Better: hash the raw secret; coordinate output is already non-uniform.
+ *      • Some curves (e.g., X448) produce secrets that must be re-hashed to match
+ *        symmetric-key lengths.
+ *
+ *    - Combiner inconsistencies:
+ *      • Different domain separations and encodings across libraries.
+ *      • Should live at the application layer, since key lengths vary.
+ *
+ * 5. Protocol Examples
+ *    - SSH:
+ *      • Concatenate keys.
+ *      • Combiner: SHA-512.
+ *
+ *    - GPG:
+ *      • Concatenate keys.
+ *      • Combiner: SHA3-256(kemShare || ecdhShare || ciphertext || pubKey || algId || domSep || len(domSep))
+ *
+ *    - TLS:
+ *      • Transcript-based derivation (HKDF).
+ *
+ * 6. Relevant Specs & Implementations
+ *    - IETF Hybrid KEM drafts:
+ *      • draft-irtf-cfrg-hybrid-kems
+ *      • draft-connolly-cfrg-xwing-kem
+ *      • draft-westerbaan-tls-xyber768d00
+ *
+ *    - PQC Libraries:
+ *      • superdilithium (cyph/pqcrypto.js) – low adoption.
+ *      • hybrid-pqc (DogeProtocol, quantumcoinproject) – complex encodings.
+ *
+ * 7. Signatures
+ *    - Ed25519: fixed-size, easy to support.
+ *    - Variable-size: introduces custom format requirements; best left to
+ *      higher-level code.
+ *
+ * @module
+ */
+/*! noble-post-quantum - MIT License (c) 2024 Paul Miller (paulmillr.com) */
+import {} from '@noble/curves/abstract/edwards.js';
+import {} from '@noble/curves/abstract/montgomery.js';
+import {} from '@noble/curves/abstract/weierstrass.js';
+import { x25519 } from '@noble/curves/ed25519.js';
+import { p256, p384 } from '@noble/curves/nist.js';
+import { asciiToBytes, bytesToNumberBE, bytesToNumberLE, concatBytes, numberToBytesBE, } from '@noble/curves/utils.js';
+import { expand, extract } from '@noble/hashes/hkdf.js';
+import { sha256 } from '@noble/hashes/sha2.js';
+import { sha3_256, shake256 } from '@noble/hashes/sha3.js';
+import { abytes, ahash, anumber } from '@noble/hashes/utils.js';
+import { ml_kem1024, ml_kem768 } from "./ml-kem.js";
+import { cleanBytes, randomBytes, splitCoder, } from "./utils.js";
+// Can re-use if decide to signatures support, on other hand getSecretKey is specific and ugly
+function ecKeygen(curve, allowZeroKey = false) {
+    const lengths = curve.lengths;
+    let keygen = curve.keygen;
+    if (allowZeroKey) {
+        // This is ugly, but we need to return exact results here.
+        const wCurve = curve;
+        const Fn = wCurve.Point.Fn;
+        if (!Fn)
+            throw new Error('No Point.Fn');
+        keygen = (seed = randomBytes(lengths.seed)) => {
+            abytes(seed, lengths.seed, 'seed');
+            const seedScalar = Fn.isLE ? bytesToNumberLE(seed) : bytesToNumberBE(seed);
+            const secretKey = Fn.toBytes(Fn.create(seedScalar)); // Fixes modulo bias, but not zero
+            return { secretKey, publicKey: curve.getPublicKey(secretKey) };
+        };
+    }
+    return {
+        lengths: { secretKey: lengths.secretKey, publicKey: lengths.publicKey, seed: lengths.seed },
+        keygen,
+        getPublicKey: (secretKey) => curve.getPublicKey(secretKey),
+    };
+}
+export const ecdhKem = (curve, allowZeroKey = false) => {
+    const kg = ecKeygen(curve, allowZeroKey);
+    if (!curve.getSharedSecret)
+        throw new Error('wrong curve'); // ed25519 doesn't have one!
+    return {
+        lengths: { ...kg.lengths, msg: kg.lengths.seed, cipherText: kg.lengths.publicKey },
+        keygen: kg.keygen,
+        getPublicKey: kg.getPublicKey,
+        encapsulate(publicKey, rand = randomBytes(curve.lengths.secretKey)) {
+            const ek = this.keygen(rand).secretKey;
+            const sharedSecret = this.decapsulate(publicKey, ek);
+            const cipherText = curve.getPublicKey(ek);
+            cleanBytes(ek);
+            return { sharedSecret, cipherText };
+        },
+        decapsulate(cipherText, secretKey) {
+            const res = curve.getSharedSecret(secretKey, cipherText);
+            return curve.lengths.publicKeyHasPrefix ? res.subarray(1) : res;
+        },
+    };
+};
+export const ecSigner = (curve, allowZeroKey = false) => {
+    const kg = ecKeygen(curve, allowZeroKey);
+    if (!curve.sign || !curve.verify)
+        throw new Error('wrong curve'); // ed25519 doesn't have one!
+    return {
+        lengths: { ...kg.lengths, signature: curve.lengths.signature, signRand: 0 },
+        keygen: kg.keygen,
+        getPublicKey: kg.getPublicKey,
+        sign: (message, secretKey) => curve.sign(message, secretKey),
+        verify: (signature, message, publicKey) => curve.verify(signature, message, publicKey),
+    };
+};
+function splitLengths(lst, name) {
+    return splitCoder(name, ...lst.map((i) => {
+        if (typeof i.lengths[name] !== 'number')
+            throw new Error('wrong length: ' + name);
+        return i.lengths[name];
+    }));
+}
+// It is XOF for most cases, but can be more complex!
+export function expandSeedXof(xof) {
+    return (seed, seedLen) => xof(seed, { dkLen: seedLen });
+}
+function combineKeys(realSeedLen, // how much bytes expandSeed expects
+expandSeed, ...ck) {
+    const seedCoder = splitLengths(ck, 'seed');
+    const pkCoder = splitLengths(ck, 'publicKey');
+    // Allows to use identity functions for combiner/expandSeed
+    if (realSeedLen === undefined)
+        realSeedLen = seedCoder.bytesLen;
+    anumber(realSeedLen);
+    function expandDecapsulationKey(seed) {
+        abytes(seed, realSeedLen);
+        const expanded = seedCoder.decode(expandSeed(seed, seedCoder.bytesLen));
+        const keys = ck.map((i, j) => i.keygen(expanded[j]));
+        const secretKey = keys.map((i) => i.secretKey);
+        const publicKey = keys.map((i) => i.publicKey);
+        return { secretKey, publicKey };
+    }
+    return {
+        info: { lengths: { seed: realSeedLen, publicKey: pkCoder.bytesLen, secretKey: realSeedLen } },
+        getPublicKey(secretKey) {
+            return this.keygen(secretKey).publicKey;
+        },
+        keygen(seed = randomBytes(realSeedLen)) {
+            const { publicKey: pk, secretKey } = expandDecapsulationKey(seed);
+            const publicKey = pkCoder.encode(pk);
+            cleanBytes(pk);
+            cleanBytes(secretKey);
+            return { secretKey: seed, publicKey };
+        },
+        expandDecapsulationKey,
+        realSeedLen,
+    };
+}
+// This generic function that combines multiple KEMs into single one
+export function combineKEMS(realSeedLen, // how much bytes expandSeed expects
+realMsgLen, // how much bytes combiner returns
+expandSeed, combiner, ...kems) {
+    const keys = combineKeys(realSeedLen, expandSeed, ...kems);
+    const ctCoder = splitLengths(kems, 'cipherText');
+    const pkCoder = splitLengths(kems, 'publicKey');
+    const msgCoder = splitLengths(kems, 'msg');
+    if (realMsgLen === undefined)
+        realMsgLen = msgCoder.bytesLen;
+    anumber(realMsgLen);
+    return {
+        lengths: {
+            ...keys.info.lengths,
+            msg: realMsgLen,
+            msgRand: msgCoder.bytesLen,
+            cipherText: ctCoder.bytesLen,
+        },
+        getPublicKey: keys.getPublicKey,
+        keygen: keys.keygen,
+        encapsulate(pk, randomness = randomBytes(msgCoder.bytesLen)) {
+            const pks = pkCoder.decode(pk);
+            const rand = msgCoder.decode(randomness);
+            const enc = kems.map((i, j) => i.encapsulate(pks[j], rand[j]));
+            const sharedSecret = enc.map((i) => i.sharedSecret);
+            const cipherText = enc.map((i) => i.cipherText);
+            const res = {
+                sharedSecret: combiner(pks, cipherText, sharedSecret),
+                cipherText: ctCoder.encode(cipherText),
+            };
+            cleanBytes(sharedSecret, cipherText, pks);
+            return res;
+        },
+        decapsulate(ct, seed) {
+            const cts = ctCoder.decode(ct);
+            const { publicKey, secretKey } = keys.expandDecapsulationKey(seed);
+            const sharedSecret = kems.map((i, j) => i.decapsulate(cts[j], secretKey[j]));
+            return combiner(publicKey, cts, sharedSecret);
+        },
+    };
+}
+// There is no specs for this, but can be useful
+// realSeedLen: how much bytes expandSeed expects.
+export function combineSigners(realSeedLen, expandSeed, ...signers) {
+    const keys = combineKeys(realSeedLen, expandSeed, ...signers);
+    const sigCoder = splitLengths(signers, 'signature');
+    const pkCoder = splitLengths(signers, 'publicKey');
+    return {
+        lengths: { ...keys.info.lengths, signature: sigCoder.bytesLen, signRand: 0 },
+        getPublicKey: keys.getPublicKey,
+        keygen: keys.keygen,
+        sign(message, seed) {
+            const { secretKey } = keys.expandDecapsulationKey(seed);
+            // NOTE: we probably can make different hashes for different algorithms
+            // same way as we do for kem, but not sure if this a good idea.
+            const sigs = signers.map((i, j) => i.sign(message, secretKey[j]));
+            return sigCoder.encode(sigs);
+        },
+        verify: (signature, message, publicKey) => {
+            const pks = pkCoder.decode(publicKey);
+            const sigs = sigCoder.decode(signature);
+            for (let i = 0; i < signers.length; i++) {
+                if (!signers[i].verify(sigs[i], message, pks[i]))
+                    return false;
+            }
+            return true;
+        },
+    };
+}
+export function QSF(label, pqc, curveKEM, xof, kdf) {
+    ahash(xof);
+    ahash(kdf);
+    return combineKEMS(32, 32, expandSeedXof(xof), (pk, ct, ss) => kdf(concatBytes(ss[0], ss[1], ct[1], pk[1], asciiToBytes(label))), pqc, curveKEM);
+}
+export const QSFMLKEM768P256 = QSF('QSF-KEM(ML-KEM-768,P-256)-XOF(SHAKE256)-KDF(SHA3-256)', ml_kem768, ecdhKem(p256, true), shake256, sha3_256);
+export const QSFMLKEM1024P384 = QSF('QSF-KEM(ML-KEM-1024,P-384)-XOF(SHAKE256)-KDF(SHA3-256)', ml_kem1024, ecdhKem(p384, true), shake256, sha3_256);
+export function KitchenSink(label, pqc, curveKEM, xof, hash) {
+    ahash(xof);
+    ahash(hash);
+    return combineKEMS(32, 32, expandSeedXof(xof), (pk, ct, ss) => {
+        const preimage = concatBytes(ss[0], ss[1], ct[0], pk[0], ct[1], pk[1], asciiToBytes(label));
+        const len = 32;
+        const ikm = concatBytes(asciiToBytes('hybrid_prk'), preimage);
+        const prk = extract(hash, ikm);
+        const info = concatBytes(numberToBytesBE(len, 2), asciiToBytes('shared_secret'), asciiToBytes(''));
+        const res = expand(hash, prk, info, len);
+        cleanBytes(prk, info, ikm, preimage);
+        return res;
+    }, pqc, curveKEM);
+}
+const x25519kem = ecdhKem(x25519);
+export const KitchenSinkMLKEM768X25519 = KitchenSink('KitchenSink-KEM(ML-KEM-768,X25519)-XOF(SHAKE256)-KDF(HKDF-SHA-256)', ml_kem768, x25519kem, shake256, sha256);
+// Always X25519 and ML-KEM - 768, no point to export
+export const XWing = combineKEMS(32, 32, expandSeedXof(shake256), 
+// Awesome label, so much escaping hell in a single line.
+(pk, ct, ss) => sha3_256(concatBytes(ss[0], ss[1], ct[1], pk[1], asciiToBytes('\\.//^\\'))), ml_kem768, x25519kem);
+//# sourceMappingURL=hybrid.js.map

package/hybrid.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hybrid.js","sourceRoot":"","sources":["src/hybrid.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyEG;AACH,4EAA4E;AAC5E,OAAO,EAAc,MAAM,mCAAmC,CAAC;AAC/D,OAAO,EAAuB,MAAM,sCAAsC,CAAC;AAC3E,OAAO,EAAc,MAAM,uCAAuC,CAAC;AACnE,OAAO,EAAE,MAAM,EAAE,MAAM,0BAA0B,CAAC;AAClD,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,uBAAuB,CAAC;AACnD,OAAO,EACL,YAAY,EACZ,eAAe,EACf,eAAe,EACf,WAAW,EACX,eAAe,GAChB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAC;AAC/C,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AAC3D,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAA6B,MAAM,wBAAwB,CAAC;AAC3F,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACpD,OAAO,EACL,UAAU,EACV,WAAW,EACX,UAAU,GAIX,MAAM,YAAY,CAAC;AAMpB,8FAA8F;AAC9F,SAAS,QAAQ,CAAC,KAAe,EAAE,eAAwB,KAAK;IAC9D,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;IAC9B,IAAI,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;IAC1B,IAAI,YAAY,EAAE,CAAC;QACjB,0DAA0D;QAC1D,MAAM,MAAM,GAAG,KAAoB,CAAC;QACpC,MAAM,EAAE,GAAG,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;QAC3B,IAAI,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,aAAa,CAAC,CAAC;QACxC,MAAM,GAAG,CAAC,OAAmB,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE;YACxD,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,IAAK,EAAE,MAAM,CAAC,CAAC;YACpC,MAAM,UAAU,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;YAC3E,MAAM,SAAS,GAAG,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,kCAAkC;YACvF,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,KAAK,CAAC,YAAY,CAAC,SAAS,CAAC,EAAE,CAAC;QACjE,CAAC,CAAC;IACJ,CAAC;IACD,OAAO;QACL,OAAO,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE;QAC3F,MAAM;QACN,YAAY,EAAE,CAAC,SAAqB,EAAE,EAAE,CAAC,KAAK,CAAC,YAAY,CAAC,SAAS,CAAC;KACvE,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,MAAM,OAAO,GAAG,CAAC,KAAgB,EAAE,eAAwB,KAAK,EAAO,EAAE;IAC9E,MAAM,EAAE,GAAG,QAAQ,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC;IACzC,IAAI,CAAC,KAAK,CAAC,eAAe;QAAE,MAAM,IAAI,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC,4BAA4B;IACxF,OAAO;QACL,OAAO,EAAE,EAAE,GAAG,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,UAAU,EAAE,EAAE,CAAC,OAAO,CAAC,SAAS,EAAE;QAClF,MAAM,EAAE,EAAE,CAAC,MAAM;QACjB,YAAY,EAAE,EAAE,CAAC,YAAY;QAC7B,WAAW,CAAC,SAAqB,EAAE,OAAmB,WAAW,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC;YACxF,MAAM,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC;YACvC,MAAM,YAAY,GAAG,IAAI,CAAC,WAAW,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;YACrD,MAAM,UAAU,GAAG,KAAK,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;YAC1C,UAAU,CAAC,EAAE,CAAC,CAAC;YACf,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,CAAC;QACtC,CAAC;QACD,WAAW,CAAC,UAAsB,EAAE,SAAqB;YACvD,MAAM,GAAG,GAAG,KAAK,CAAC,eAAe,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;YACzD,OAAO,KAAK,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;QAClE,CAAC;KACF,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC,KAAgB,EAAE,eAAwB,KAAK,EAAU,EAAE;IAClF,MAAM,EAAE,GAAG,QAAQ,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC;IACzC,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC,4BAA4B;IAC9F,OAAO;QACL,OAAO,EAAE,EAAE,GAAG,EAAE,CAAC,OAAO,EAAE,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,SAAS,EAAE,QAAQ,EAAE,CAAC,EAAE;QAC3E,MAAM,EAAE,EAAE,CAAC,MAAM;QACjB,YAAY,EAAE,EAAE,CAAC,YAAY;QAC7B,IAAI,EAAE,CAAC,OAAO,EAAE,SAAS,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,CAAC;QAC5D,MAAM,EAAE,CAAC,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,EAAE,OAAO,EAAE,SAAS,CAAC;KACvF,CAAC;AACJ,CAAC,CAAC;AAEF,SAAS,YAAY,CACnB,GAAQ,EACR,IAAO;IAEP,OAAO,UAAU,CACf,IAAI,EACJ,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QACf,IAAI,OAAO,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAAC;QAClF,OAAO,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACzB,CAAC,CAAC,CACH,CAAC;AACJ,CAAC;AAKD,qDAAqD;AACrD,MAAM,UAAU,aAAa,CAAC,GAAQ;IACpC,OAAO,CAAC,IAAgB,EAAE,OAAe,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;AAC9E,CAAC;AAQD,SAAS,WAAW,CAClB,WAA+B,EAAE,oCAAoC;AACrE,UAAsB,EACtB,GAAG,EAAgB;IAEnB,MAAM,SAAS,GAAG,YAAY,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;IAC3C,MAAM,OAAO,GAAG,YAAY,CAAC,EAAE,EAAE,WAAW,CAAC,CAAC;IAC9C,2DAA2D;IAC3D,IAAI,WAAW,KAAK,SAAS;QAAE,WAAW,GAAG,SAAS,CAAC,QAAQ,CAAC;IAChE,OAAO,CAAC,WAAW,CAAC,CAAC;IACrB,SAAS,sBAAsB,CAAC,IAAgB;QAC9C,MAAM,CAAC,IAAI,EAAE,WAAY,CAAC,CAAC;QAC3B,MAAM,QAAQ,GAAG,SAAS,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC;QACxE,MAAM,IAAI,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACrD,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QAC/C,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QAC/C,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC;IAClC,CAAC;IACD,OAAO;QACL,IAAI,EAAE,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,SAAS,EAAE,OAAO,CAAC,QAAQ,EAAE,SAAS,EAAE,WAAW,EAAE,EAAE;QAC7F,YAAY,CAAC,SAAqB;YAChC,OAAO,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,SAAS,CAAC;QAC1C,CAAC;QACD,MAAM,CAAC,OAAmB,WAAW,CAAC,WAAW,CAAC;YAChD,MAAM,EAAE,SAAS,EAAE,EAAE,EAAE,SAAS,EAAE,GAAG,sBAAsB,CAAC,IAAI,CAAC,CAAC;YAClE,MAAM,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YACrC,UAAU,CAAC,EAAE,CAAC,CAAC;YACf,UAAU,CAAC,SAAS,CAAC,CAAC;YACtB,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;QACxC,CAAC;QACD,sBAAsB;QACtB,WAAW;KACZ,CAAC;AACJ,CAAC;AAED,oEAAoE;AACpE,MAAM,UAAU,WAAW,CACzB,WAA+B,EAAE,oCAAoC;AACrE,UAA8B,EAAE,kCAAkC;AAClE,UAAsB,EACtB,QAAkB,EAClB,GAAG,IAAW;IAEd,MAAM,IAAI,GAAG,WAAW,CAAC,WAAW,EAAE,UAAU,EAAE,GAAG,IAAI,CAAC,CAAC;IAC3D,MAAM,OAAO,GAAG,YAAY,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;IACjD,MAAM,OAAO,GAAG,YAAY,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;IAChD,MAAM,QAAQ,GAAG,YAAY,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC3C,IAAI,UAAU,KAAK,SAAS;QAAE,UAAU,GAAG,QAAQ,CAAC,QAAQ,CAAC;IAC7D,OAAO,CAAC,UAAU,CAAC,CAAC;IACpB,OAAO;QACL,OAAO,EAAE;YACP,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO;YACpB,GAAG,EAAE,UAAU;YACf,OAAO,EAAE,QAAQ,CAAC,QAAQ;YAC1B,UAAU,EAAE,OAAO,CAAC,QAAQ;SAC7B;QACD,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,WAAW,CAAC,EAAc,EAAE,aAAyB,WAAW,CAAC,QAAQ,CAAC,QAAQ,CAAC;YACjF,MAAM,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YAC/B,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;YACzC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAC/D,MAAM,YAAY,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC;YACpD,MAAM,UAAU,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;YAChD,MAAM,GAAG,GAAG;gBACV,YAAY,EAAE,QAAQ,CAAC,GAAG,EAAE,UAAU,EAAE,YAAY,CAAC;gBACrD,UAAU,EAAE,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC;aACvC,CAAC;YACF,UAAU,CAAC,YAAY,EAAE,UAAU,EAAE,GAAG,CAAC,CAAC;YAC1C,OAAO,GAAG,CAAC;QACb,CAAC;QACD,WAAW,CAAC,EAAc,EAAE,IAAgB;YAC1C,MAAM,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YAC/B,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,GAAG,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,CAAC;YACnE,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAC7E,OAAO,QAAQ,CAAC,SAAS,EAAE,GAAG,EAAE,YAAY,CAAC,CAAC;QAChD,CAAC;KACF,CAAC;AACJ,CAAC;AACD,gDAAgD;AAChD,kDAAkD;AAClD,MAAM,UAAU,cAAc,CAC5B,WAA+B,EAC/B,UAAsB,EACtB,GAAG,OAAiB;IAEpB,MAAM,IAAI,GAAG,WAAW,CAAC,WAAW,EAAE,UAAU,EAAE,GAAG,OAAO,CAAC,CAAC;IAC9D,MAAM,QAAQ,GAAG,YAAY,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;IACpD,MAAM,OAAO,GAAG,YAAY,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;IACnD,OAAO;QACL,OAAO,EAAE,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,EAAE,QAAQ,CAAC,QAAQ,EAAE,QAAQ,EAAE,CAAC,EAAE;QAC5E,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,IAAI,CAAC,OAAO,EAAE,IAAI;YAChB,MAAM,EAAE,SAAS,EAAE,GAAG,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,CAAC;YACxD,uEAAuE;YACvE,+DAA+D;YAC/D,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAClE,OAAO,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAC/B,CAAC;QACD,MAAM,EAAE,CAAC,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,EAAE;YACxC,MAAM,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YACtC,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YACxC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;gBACxC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC;oBAAE,OAAO,KAAK,CAAC;YACjE,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;KACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,GAAG,CAAC,KAAa,EAAE,GAAQ,EAAE,QAAa,EAAE,GAAQ,EAAE,GAAU;IAC9E,KAAK,CAAC,GAAG,CAAC,CAAC;IACX,KAAK,CAAC,GAAG,CAAC,CAAC;IACX,OAAO,WAAW,CAChB,EAAE,EACF,EAAE,EACF,aAAa,CAAC,GAAG,CAAC,EAClB,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,EACjF,GAAG,EACH,QAAQ,CACT,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,MAAM,eAAe,GAAQ,GAAG,CACrC,uDAAuD,EACvD,SAAS,EACT,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,EACnB,QAAQ,EACR,QAAQ,CACT,CAAC;AAEF,MAAM,CAAC,MAAM,gBAAgB,GAAQ,GAAG,CACtC,wDAAwD,EACxD,UAAU,EACV,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,EACnB,QAAQ,EACR,QAAQ,CACT,CAAC;AAEF,MAAM,UAAU,WAAW,CAAC,KAAa,EAAE,GAAQ,EAAE,QAAa,EAAE,GAAQ,EAAE,IAAW;IACvF,KAAK,CAAC,GAAG,CAAC,CAAC;IACX,KAAK,CAAC,IAAI,CAAC,CAAC;IACZ,OAAO,WAAW,CAChB,EAAE,EACF,EAAE,EACF,aAAa,CAAC,GAAG,CAAC,EAClB,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE;QACb,MAAM,QAAQ,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC;QAC5F,MAAM,GAAG,GAAG,EAAE,CAAC;QACf,MAAM,GAAG,GAAG,WAAW,CAAC,YAAY,CAAC,YAAY,CAAC,EAAE,QAAQ,CAAC,CAAC;QAC9D,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QAC/B,MAAM,IAAI,GAAG,WAAW,CACtB,eAAe,CAAC,GAAG,EAAE,CAAC,CAAC,EACvB,YAAY,CAAC,eAAe,CAAC,EAC7B,YAAY,CAAC,EAAE,CAAC,CACjB,CAAC;QACF,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;QACzC,UAAU,CAAC,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAC;QACrC,OAAO,GAAG,CAAC;IACb,CAAC,EACD,GAAG,EACH,QAAQ,CACT,CAAC;AACJ,CAAC;AAED,MAAM,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;AAClC,MAAM,CAAC,MAAM,yBAAyB,GAAQ,WAAW,CACvD,oEAAoE,EACpE,SAAS,EACT,SAAS,EACT,QAAQ,EACR,MAAM,CACP,CAAC;AAEF,qDAAqD;AACrD,MAAM,CAAC,MAAM,KAAK,GAAQ,WAAW,CACnC,EAAE,EACF,EAAE,EACF,aAAa,CAAC,QAAQ,CAAC;AACvB,yDAAyD;AACzD,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,YAAY,CAAC,UAAU,CAAC,CAAC,CAAC,EAC3F,SAAS,EACT,SAAS,CACV,CAAC"}

package/index.d.ts

@@ -1 +1,2 @@
+export {};
 //# sourceMappingURL=index.d.ts.map

package/index.js

@@ -1,12 +1,11 @@
-"use strict";
 /**
  * Auditable & minimal JS implementation of post-quantum public-key cryptography.
  * Check out individual modules.
  * @module
  * @example
 ```js
-import { ml_kem512, ml_kem768, ml_kem1024 } from '@noble/post-quantum/ml-kem';
-import { ml_dsa44, ml_dsa65, ml_dsa87 } from '@noble/post-quantum/ml-dsa';
+import { ml_kem512, ml_kem768, ml_kem1024 } from '@noble/post-quantum/ml-kem.js';
+import { ml_dsa44, ml_dsa65, ml_dsa87 } from '@noble/post-quantum/ml-dsa.js';
 import {
   slh_dsa_sha2_128f, slh_dsa_sha2_128s,
   slh_dsa_sha2_192f, slh_dsa_sha2_192s,
@@ -14,8 +13,9 @@ import {
   slh_dsa_shake_128f, slh_dsa_shake_128s,
   slh_dsa_shake_192f, slh_dsa_shake_192s,
   slh_dsa_shake_256f, slh_dsa_shake_256s,
-} from '@noble/post-quantum/slh-dsa';
+} from '@noble/post-quantum/slh-dsa.js';
 ```
  */
 throw new Error('root module cannot be imported: import submodules instead. Check out README');
+export {};
 //# sourceMappingURL=index.js.map

package/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["src/index.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,IAAI,KAAK,CAAC,6EAA6E,CAAC,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,IAAI,KAAK,CAAC,6EAA6E,CAAC,CAAC"}

package/ml-dsa.d.ts

@@ -1,4 +1,16 @@
-import { type Signer } from './utils.ts';
+import { type CryptoKeys, type Signer, type SigOpts, type VerOpts } from './utils.ts';
+export type DSAInternalOpts = {
+    externalMu?: boolean;
+};
+/** Signer API, containing internal methods */
+export type DSAInternal = CryptoKeys & {
+    lengths: Signer['lengths'];
+    sign: (msg: Uint8Array, secretKey: Uint8Array, opts?: SigOpts & DSAInternalOpts) => Uint8Array;
+    verify: (sig: Uint8Array, msg: Uint8Array, pubKey: Uint8Array, opts?: VerOpts & DSAInternalOpts) => boolean;
+};
+export type DSA = Signer & {
+    internal: DSAInternal;
+};
 /** Various lattice params. */
 export type DSAParam = {
     K: number;
@@ -12,14 +24,10 @@ export type DSAParam = {
 };
 /** Internal params for different versions of ML-DSA  */
 export declare const PARAMS: Record<string, DSAParam>;
-/** Signer API, containing internal methods */
-export type SignerWithInternal = Signer & {
-    internal: Signer;
-};
 /** ML-DSA-44 for 128-bit security level. Not recommended after 2030, as per ASD. */
-export declare const ml_dsa44: SignerWithInternal;
+export declare const ml_dsa44: DSA;
 /** ML-DSA-65 for 192-bit security level. Not recommended after 2030, as per ASD. */
-export declare const ml_dsa65: SignerWithInternal;
+export declare const ml_dsa65: DSA;
 /** ML-DSA-87 for 256-bit security level. OK after 2030, as per ASD. */
-export declare const ml_dsa87: SignerWithInternal;
+export declare const ml_dsa87: DSA;
 //# sourceMappingURL=ml-dsa.d.ts.map

package/ml-dsa.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ml-dsa.d.ts","sourceRoot":"","sources":["src/ml-dsa.ts"],"names":[],"mappings":"AAYA,OAAO,EASL,KAAK,MAAM,EAGZ,MAAM,YAAY,CAAC;AAgBpB,8BAA8B;AAC9B,MAAM,MAAM,QAAQ,GAAG;IACrB,CAAC,EAAE,MAAM,CAAC;IACV,CAAC,EAAE,MAAM,CAAC;IACV,CAAC,EAAE,MAAM,CAAC;IACV,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;CACf,CAAC;AACF,wDAAwD;AAExD,eAAO,MAAM,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,CAIlC,CAAC;AAmeX,8CAA8C;AAC9C,MAAM,MAAM,kBAAkB,GAAG,MAAM,GAAG;IAAE,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC;AAE/D,oFAAoF;AACpF,eAAO,MAAM,QAAQ,EAAE,kBAOrB,CAAC;AAEH,oFAAoF;AACpF,eAAO,MAAM,QAAQ,EAAE,kBAOrB,CAAC;AAEH,uEAAuE;AACvE,eAAO,MAAM,QAAQ,EAAE,kBAOrB,CAAC"}
+{"version":3,"file":"ml-dsa.d.ts","sourceRoot":"","sources":["src/ml-dsa.ts"],"names":[],"mappings":"AAcA,OAAO,EAKL,KAAK,UAAU,EAKf,KAAK,MAAM,EACX,KAAK,OAAO,EAMZ,KAAK,OAAO,EACb,MAAM,YAAY,CAAC;AAEpB,MAAM,MAAM,eAAe,GAAG;IAAE,UAAU,CAAC,EAAE,OAAO,CAAA;CAAE,CAAC;AAMvD,8CAA8C;AAC9C,MAAM,MAAM,WAAW,GAAG,UAAU,GAAG;IACrC,OAAO,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;IAC3B,IAAI,EAAE,CAAC,GAAG,EAAE,UAAU,EAAE,SAAS,EAAE,UAAU,EAAE,IAAI,CAAC,EAAE,OAAO,GAAG,eAAe,KAAK,UAAU,CAAC;IAC/F,MAAM,EAAE,CACN,GAAG,EAAE,UAAU,EACf,GAAG,EAAE,UAAU,EACf,MAAM,EAAE,UAAU,EAClB,IAAI,CAAC,EAAE,OAAO,GAAG,eAAe,KAC7B,OAAO,CAAC;CACd,CAAC;AACF,MAAM,MAAM,GAAG,GAAG,MAAM,GAAG;IAAE,QAAQ,EAAE,WAAW,CAAA;CAAE,CAAC;AAgBrD,8BAA8B;AAC9B,MAAM,MAAM,QAAQ,GAAG;IACrB,CAAC,EAAE,MAAM,CAAC;IACV,CAAC,EAAE,MAAM,CAAC;IACV,CAAC,EAAE,MAAM,CAAC;IACV,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;CACf,CAAC;AACF,wDAAwD;AAExD,eAAO,MAAM,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,CAIlC,CAAC;AA+hBX,oFAAoF;AACpF,eAAO,MAAM,QAAQ,EAAE,GAQrB,CAAC;AAEH,oFAAoF;AACpF,eAAO,MAAM,QAAQ,EAAE,GAQrB,CAAC;AAEH,uEAAuE;AACvE,eAAO,MAAM,QAAQ,EAAE,GAQrB,CAAC"}