@noble/post-quantum 0.6.0 → 0.7.0

package/ml-kem.js

@@ -48,10 +48,10 @@ const crystals = /* @__PURE__ */ genCrystals({
  * `RBGstrength` is Table 2's required randomness-source strength in bits,
  * not a generic security label.
  */
-export const PARAMS = /* @__PURE__ */ (() => ({
-    512: { N, Q, K: 2, ETA1: 3, ETA2: 2, du: 10, dv: 4, RBGstrength: 128 },
-    768: { N, Q, K: 3, ETA1: 2, ETA2: 2, du: 10, dv: 4, RBGstrength: 192 },
-    1024: { N, Q, K: 4, ETA1: 2, ETA2: 2, du: 11, dv: 5, RBGstrength: 256 },
+export const PARAMS = /* @__PURE__ */ (() => Object.freeze({
+    512: Object.freeze({ N, Q, K: 2, ETA1: 3, ETA2: 2, du: 10, dv: 4, RBGstrength: 128 }),
+    768: Object.freeze({ N, Q, K: 3, ETA1: 2, ETA2: 2, du: 10, dv: 4, RBGstrength: 192 }),
+    1024: Object.freeze({ N, Q, K: 4, ETA1: 2, ETA2: 2, du: 11, dv: 5, RBGstrength: 256 }),
 }))();
 // FIPS-203: compress/decompress
 const compress = (d) => {
@@ -84,26 +84,40 @@ const byteCoder = (d) => crystals.bitsCoder(d, d === 12
 // Kinda like convertRadix2 from @scure/base.
 // decode(encode(t)) == t, but there is loss of information on encode(decode(t))
 const polyCoder = (d) => (d === 12 ? byteCoder(12) : crystals.bitsCoder(d, compress(d)));
-function polyAdd(a, b) {
+// Coefficients always stay reduced in [0, Q) here (samplers, NTT and coders all reduce),
+// so one conditional correction replaces the generic mod().
+function polyAdd(a_, b_) {
+    const a = a_;
+    const b = b_;
     // Mutates `a` in place; callers must pass two N=256 polynomials.
-    for (let i = 0; i < N; i++)
-        a[i] = crystals.mod(a[i] + b[i]); // a += b
+    for (let i = 0; i < N; i++) {
+        const r = a[i] + b[i]; // a += b
+        a[i] = r >= Q ? r - Q : r;
+    }
 }
-function polySub(a, b) {
+function polySub(a_, b_) {
+    const a = a_;
+    const b = b_;
     // Mutates `a` in place; callers must pass two N=256 polynomials.
-    for (let i = 0; i < N; i++)
-        a[i] = crystals.mod(a[i] - b[i]); // a -= b
+    for (let i = 0; i < N; i++) {
+        const r = a[i] - b[i]; // a -= b
+        a[i] = r < 0 ? r + Q : r;
+    }
 }
 // FIPS-203: Computes the product of two degree-one polynomials with respect to a quadratic modulus
 function BaseCaseMultiply(a0, a1, b0, b1, zeta) {
     // `zeta` here is Algorithm 11's γ = ζ^(2BitRev_7(i)+1).
-    const c0 = crystals.mod(a1 * b1 * zeta + a0 * b0);
+    // Reduce a1*b1 before multiplying by zeta: a1*b1*zeta would reach ~2^35, forcing JS engines
+    // into slow float fmod; with the extra reduction every intermediate fits int32.
+    const c0 = crystals.mod(crystals.mod(a1 * b1) * zeta + a0 * b0);
     const c1 = crystals.mod(a0 * b1 + a1 * b0);
     return { c0, c1 };
 }
 // FIPS-203: Computes the product (in the ring Tq) of two NTT representations.
 // Works in place on `f`; `g` is read-only and both inputs must already be in NTT form.
-function MultiplyNTTs(f, g) {
+function MultiplyNTTs(f_, g_) {
+    const f = f_;
+    const g = g_;
     for (let i = 0; i < N / 2; i++) {
         let z = crystals.nttZetas[64 + (i >> 1)];
         if (i & 1)
@@ -115,7 +129,8 @@ function MultiplyNTTs(f, g) {
     return f;
 }
 // Return poly in NTT representation
-function SampleNTT(xof) {
+function SampleNTT(xof_) {
+    const xof = xof_;
     // The reader must already bind the Algorithm 7 seed||j||i bytes
     // and return block lengths divisible by 3.
     const r = new Uint16Array(N);
@@ -166,14 +181,16 @@ const sampleCBDBytes = (buf, eta) => {
         throw new Error(`sampleCBD: leftover bits: ${len}`);
     return r;
 };
-function sampleCBD(PRF, seed, nonce, eta) {
+function sampleCBD(PRF_, seed, nonce, eta) {
+    const PRF = PRF_;
     return sampleCBDBytes(PRF((eta * N) / 4, seed, nonce), eta);
 }
 // K-PKE
 // Internal ML-KEM subroutine only: exact 32-byte `seed` / `msg` inputs
 // come from Algorithms 13-15, and the helper mutates decoded temporary
 // polynomials in place while leaving caller byte arrays unchanged.
-const genKPKE = (opts) => {
+const genKPKE = (opts_) => {
+    const opts = opts_;
     const { K, PRF, XOF, HASH512, ETA1, ETA2, du, dv } = opts;
     const poly1 = polyCoder(1);
     const polyV = polyCoder(dv);
@@ -182,6 +199,34 @@ const genKPKE = (opts) => {
     const secretCoder = vecCoder(polyCoder(12), K);
     const cipherCoder = splitCoder('ciphertext', vecCoder(polyU, K), polyV);
     const seedCoder = splitCoder('seed', 32, 32);
+    // Algorithm 14 (K-PKE.Encrypt) core, after ek parsing. `tHat` and every poly returned by
+    // `getA(i, j)` are treated as disposable scratch: they are mutated in place and wiped/dropped,
+    // so callers holding cached copies must pass fresh copies.
+    const encryptCore = (tHat, getA, msg, seed) => {
+        const rHat = [];
+        for (let i = 0; i < K; i++)
+            rHat.push(crystals.NTT.encode(sampleCBD(PRF, seed, i, ETA1)));
+        const tmp2 = new Uint16Array(N);
+        const u = [];
+        for (let i = 0; i < K; i++) {
+            const e1 = sampleCBD(PRF, seed, K + i, ETA2);
+            const tmp = new Uint16Array(N);
+            for (let j = 0; j < K; j++) {
+                const aij = getA(i, j); // A[j][i], inplace transpose access
+                polyAdd(tmp, MultiplyNTTs(aij, rHat[j])); // t += aij * rHat[j]
+            }
+            polyAdd(e1, crystals.NTT.decode(tmp)); // e1 += tmp
+            u.push(e1);
+            polyAdd(tmp2, MultiplyNTTs(tHat[i], rHat[i])); // t2 += tHat[i] * rHat[i]
+            cleanBytes(tmp);
+        }
+        const e2 = sampleCBD(PRF, seed, 2 * K, ETA2);
+        polyAdd(e2, crystals.NTT.decode(tmp2)); // e2 += tmp2
+        const v = poly1.decode(msg); // encode plaintext m into polynomial v
+        polyAdd(v, e2); // v += e2
+        cleanBytes(tHat, rHat, tmp2, e2);
+        return cipherCoder.encode([u, v]);
+    };
     return {
         secretCoder,
         lengths: {
@@ -222,31 +267,26 @@ const genKPKE = (opts) => {
         },
         encrypt: (publicKey, msg, seed) => {
             const [tHat, rho] = publicCoder.decode(publicKey);
-            const rHat = [];
-            for (let i = 0; i < K; i++)
-                rHat.push(crystals.NTT.encode(sampleCBD(PRF, seed, i, ETA1)));
             const x = XOF(rho);
-            const tmp2 = new Uint16Array(N);
-            const u = [];
-            for (let i = 0; i < K; i++) {
-                const e1 = sampleCBD(PRF, seed, K + i, ETA2);
-                const tmp = new Uint16Array(N);
-                for (let j = 0; j < K; j++) {
-                    const aij = SampleNTT(x.get(i, j)); // A[j][i], inplace transpose access
-                    polyAdd(tmp, MultiplyNTTs(aij, rHat[j])); // t += aij * rHat[j]
-                }
-                polyAdd(e1, crystals.NTT.decode(tmp)); // e1 += tmp
-                u.push(e1);
-                polyAdd(tmp2, MultiplyNTTs(tHat[i], rHat[i])); // t2 += tHat[i] * rHat[i]
-                cleanBytes(tmp);
-            }
+            const res = encryptCore(tHat, (i, j) => SampleNTT(x.get(i, j)), msg, seed);
             x.clean();
-            const e2 = sampleCBD(PRF, seed, 2 * K, ETA2);
-            polyAdd(e2, crystals.NTT.decode(tmp2)); // e2 += tmp2
-            const v = poly1.decode(msg); // encode plaintext m into polynomial v
-            polyAdd(v, e2); // v += e2
-            cleanBytes(tHat, rHat, tmp2, e2);
-            return cipherCoder.encode([u, v]);
+            return res;
+        },
+        // Expands the full  matrix (public data derived from rho) once, so repeated encryptions
+        // against the same ek skip the K² SampleNTT XOF expansions. Cached polys are copied per
+        // call because encryptCore mutates its inputs in place.
+        prepare: (publicKey) => {
+            const [tHat, rho] = publicCoder.decode(publicKey);
+            const x = XOF(rho);
+            const A = [];
+            for (let i = 0; i < K; i++)
+                for (let j = 0; j < K; j++)
+                    A.push(SampleNTT(x.get(i, j)));
+            x.clean();
+            return {
+                encrypt: (msg, seed) => encryptCore(tHat.map((p) => p.slice()), (i, j) => A[i * K + j].slice(), msg, seed),
+                clean: () => cleanBytes(tHat, A),
+            };
         },
         decrypt: (cipherText, privateKey) => {
             const [u, v] = cipherCoder.decode(cipherText);
@@ -271,21 +311,35 @@ const genKPKE = (opts) => {
  * constant-time guarantees for that path.
  */
 function createKyber(opts) {
-    const KPKE = genKPKE(opts);
-    const { HASH256, HASH512, KDF } = opts;
+    const rawOpts = opts;
+    const KPKE = genKPKE(rawOpts);
+    const { HASH256, HASH512, KDF } = rawOpts;
     const { secretCoder: KPKESecretCoder, lengths } = KPKE;
     const secretCoder = splitCoder('secretKey', lengths.secretKey, lengths.publicKey, 32, 32);
     const msgLen = 32;
     const seedLen = 64;
-    return {
-        info: { type: 'ml-kem' },
-        lengths: {
-            ...lengths,
-            seed: 64,
-            msg: msgLen,
-            msgRand: msgLen,
-            secretKey: secretCoder.bytesLen,
-        },
+    // FIPS-203 includes additional verification check for modulus
+    const validateModulus = (publicKey, fn) => {
+        const eke = publicKey.subarray(0, 384 * rawOpts.K);
+        // Copy because of inplace encoding
+        const ek = KPKESecretCoder.encode(KPKESecretCoder.decode(copyBytes(eke)));
+        // (Modulus check.) Perform the computation ek ← ByteEncode12(ByteDecode12(eke)).
+        // If ek = ̸ eke, the input is invalid. (See Section 4.2.1.)
+        const ok = equalBytes(ek, eke);
+        cleanBytes(ek);
+        if (!ok)
+            throw new Error(`ML-KEM.${fn}: wrong publicKey modulus`);
+    };
+    const kemLengths = Object.freeze({
+        ...lengths,
+        seed: 64,
+        msg: msgLen,
+        msgRand: msgLen,
+        secretKey: secretCoder.bytesLen,
+    });
+    return Object.freeze({
+        info: Object.freeze({ type: 'ml-kem' }),
+        lengths: kemLengths,
         keygen: (seed = randomBytes(seedLen)) => {
             abytes(seed, seedLen, 'seed');
             const { publicKey, secretKey: sk } = KPKE.keygen(seed.subarray(0, 32));
@@ -293,7 +347,10 @@ function createKyber(opts) {
             // (dkPKE||ek||H(ek)||z)
             const secretKey = secretCoder.encode([sk, publicKey, publicKeyHash, seed.subarray(32)]);
             cleanBytes(sk, publicKeyHash);
-            return { publicKey, secretKey };
+            return {
+                publicKey: publicKey,
+                secretKey: secretKey,
+            };
         },
         getPublicKey: (secretKey) => {
             const [_sk, publicKey, _publicKeyHash, _z] = secretCoder.decode(secretKey);
@@ -302,22 +359,15 @@ function createKyber(opts) {
         encapsulate: (publicKey, msg = randomBytes(msgLen)) => {
             abytes(publicKey, lengths.publicKey, 'publicKey');
             abytes(msg, msgLen, 'message');
-            // FIPS-203 includes additional verification check for modulus
-            const eke = publicKey.subarray(0, 384 * opts.K);
-            // Copy because of inplace encoding
-            const ek = KPKESecretCoder.encode(KPKESecretCoder.decode(copyBytes(eke)));
-            // (Modulus check.) Perform the computation ek ← ByteEncode12(ByteDecode12(eke)).
-            // If ek = ̸ eke, the input is invalid. (See Section 4.2.1.)
-            if (!equalBytes(ek, eke)) {
-                cleanBytes(ek);
-                throw new Error('ML-KEM.encapsulate: wrong publicKey modulus');
-            }
-            cleanBytes(ek);
+            validateModulus(publicKey, 'encapsulate');
             // derive randomness
             const kr = HASH512.create().update(msg).update(HASH256(publicKey)).digest();
             const cipherText = KPKE.encrypt(publicKey, msg, kr.subarray(32, 64));
             cleanBytes(kr.subarray(32));
-            return { cipherText, sharedSecret: kr.subarray(0, 32) };
+            return {
+                cipherText: cipherText,
+                sharedSecret: kr.subarray(0, 32),
+            };
         },
         decapsulate: (cipherText, secretKey) => {
             abytes(secretKey, secretCoder.bytesLen, 'secretKey'); // 768*k + 96
@@ -339,10 +389,58 @@ function createKyber(opts) {
             // if ciphertexts do not match, “implicitly reject”
             const isValid = equalBytes(cipherText, cipherText2);
             const Kbar = KDF.create({ dkLen: 32 }).update(z).update(cipherText).digest();
-            cleanBytes(msg, cipherText2, !isValid ? Khat : Kbar);
-            return isValid ? Khat : Kbar;
+            // kr[32:64] is the derived K-PKE encryption randomness: wipe it like encapsulate() does.
+            cleanBytes(msg, cipherText2, kr.subarray(32), !isValid ? Khat : Kbar);
+            return (isValid ? Khat : Kbar);
         },
-    };
+        /**
+         * Experimental prototype: pre-expand a public key so repeated encapsulate/decapsulate
+         * against the same key skip re-validation, H(ek), t̂ decoding and the K² SampleNTT
+         * XOF expansions of Â. Only public data is cached; see {@link KEMPrepared}.
+         */
+        prepare: (publicKey) => {
+            abytes(publicKey, lengths.publicKey, 'publicKey');
+            validateModulus(publicKey, 'prepare');
+            const ek = copyBytes(publicKey); // detach from the caller before caching
+            const publicKeyHash = HASH256(ek);
+            const cached = KPKE.prepare(ek);
+            return Object.freeze({
+                publicKey: ek,
+                encapsulate: (msg = randomBytes(msgLen)) => {
+                    abytes(msg, msgLen, 'message');
+                    const kr = HASH512.create().update(msg).update(publicKeyHash).digest();
+                    const cipherText = cached.encrypt(msg, kr.subarray(32, 64));
+                    cleanBytes(kr.subarray(32));
+                    return {
+                        cipherText: cipherText,
+                        sharedSecret: kr.subarray(0, 32),
+                    };
+                },
+                decapsulate: (cipherText, secretKey) => {
+                    abytes(secretKey, secretCoder.bytesLen, 'secretKey');
+                    abytes(cipherText, lengths.cipherText, 'cipherText');
+                    const [sk, ekEmbedded, storedHash, z] = secretCoder.decode(secretKey);
+                    // Under KEMPrepared's read-only publicKey contract, bind dk to the prepared key.
+                    // Together with publicKeyHash = H(ek) computed in prepare(), this is equivalent to (and
+                    // stronger than) FIPS 203 §7.3's `H(dk[384k : 768k+32]) == dk[768k+32 : 768k+64]`.
+                    if (!equalBytes(ekEmbedded, ek) || !equalBytes(storedHash, publicKeyHash))
+                        throw new Error('ML-KEM.decapsulate: secretKey does not match prepared publicKey');
+                    const msg = KPKE.decrypt(cipherText, sk);
+                    // derive randomness, Khat, rHat = G(mHat || h)
+                    const kr = HASH512.create().update(msg).update(publicKeyHash).digest();
+                    const Khat = kr.subarray(0, 32);
+                    // re-encrypt using the derived randomness and cached Â/t̂
+                    const cipherText2 = cached.encrypt(msg, kr.subarray(32, 64));
+                    // if ciphertexts do not match, “implicitly reject”
+                    const isValid = equalBytes(cipherText, cipherText2);
+                    const Kbar = KDF.create({ dkLen: 32 }).update(z).update(cipherText).digest();
+                    cleanBytes(msg, cipherText2, kr.subarray(32), !isValid ? Khat : Kbar);
+                    return (isValid ? Khat : Kbar);
+                },
+                clean: cached.clean,
+            });
+        },
+    });
 }
 // FIPS 203's PRF_eta binding: current callers use only 32-byte keys, one-byte nonces,
 // and dkLen values {128, 192}; out-of-range nonce numbers still wrap modulo 256 here.
@@ -371,6 +469,17 @@ const mk = (params) => createKyber({
 /**
  * ML-KEM-512: Table 2 row `k=2, η1=3, η2=2, du=10, dv=4`; Table 3 sizes `800/1632/768/32`.
  * The ASD lifecycle note here is external policy guidance, not a FIPS 203 requirement.
+ * @example
+ * Generate deterministic ML-KEM-512 keys, encapsulate a shared secret, and decapsulate it.
+ * ```ts
+ * import { ml_kem512 } from '@noble/post-quantum/ml-kem.js';
+ * const seed = new Uint8Array(ml_kem512.lengths.seed!);
+ * const { secretKey, publicKey } = ml_kem512.keygen(seed);
+ * const msg = new Uint8Array(ml_kem512.lengths.msgRand!);
+ * const { cipherText, sharedSecret } = ml_kem512.encapsulate(publicKey, msg);
+ * const recovered = ml_kem512.decapsulate(cipherText, secretKey);
+ * const publicKey2 = ml_kem512.getPublicKey(secretKey);
+ * ```
  */
 export const ml_kem512 = /* @__PURE__ */ (() => mk(PARAMS[512]))();
 /**
@@ -385,7 +494,7 @@ export const ml_kem768 = /* @__PURE__ */ (() => mk(PARAMS[768]))();
 export const ml_kem1024 = /* @__PURE__ */ (() => mk(PARAMS[1024]))();
 // NOTE: for tests only, don't use. This keeps the exact internal ML-KEM math surfaces available
 // without re-implementing them in separate test code.
-export const __tests = /* @__PURE__ */ (() => ({
+export const __tests = /* @__PURE__ */ (() => Object.freeze({
     Compress_d: (x, d) => {
         if (d < 1 || d > 11)
             throw new Error(`Compress_d: expected d in [1..11], got ${d}`);
@@ -424,4 +533,3 @@ export const __tests = /* @__PURE__ */ (() => ({
         }
     },
 }))();
-//# sourceMappingURL=ml-kem.js.map

package/package.json

@@ -1,40 +1,32 @@
 {
   "name": "@noble/post-quantum",
-  "version": "0.6.0",
+  "version": "0.7.0",
   "description": "Auditable & minimal JS implementation of post-quantum cryptography: FIPS 203, 204, 205, Falcon",
   "files": [
     "*.js",
-    "*.js.map",
     "*.d.ts",
-    "*.d.ts.map",
     "src"
   ],
   "dependencies": {
-    "@noble/ciphers": "~2.0.0",
-    "@noble/curves": "~2.0.0",
-    "@noble/hashes": "~2.0.0"
+    "@noble/ciphers": "~2.3.0",
+    "@noble/curves": "~2.3.0",
+    "@noble/hashes": "~2.3.0"
   },
   "devDependencies": {
-    "@paulmillr/jsbt": "0.5.0",
+    "@paulmillr/jsbt": "0.6.5",
     "@types/node": "25.3.0",
     "fast-check": "4.2.0",
     "prettier": "3.6.2",
     "typescript": "6.0.2"
   },
   "scripts": {
-    "bench": "node test/benchmark.ts",
+    "benchmark": "node benchmark/pq.ts",
+    "benchmark:size": "npx bismar@0.1 -s",
     "build": "tsc",
-    "build:release": "npx --no @paulmillr/jsbt esbuild test/build",
-    "check": "npm run check:readme && npm run check:treeshake && npm run check:jsdoc",
-    "check:readme": "npx --no @paulmillr/jsbt readme package.json",
-    "check:treeshake": "npx --no @paulmillr/jsbt treeshake package.json test/build/out-treeshake",
-    "check:jsdoc": "npx --no @paulmillr/jsbt tsdoc package.json",
-    "build:clean": "rm *.{js,js.map,d.ts,d.ts.map} 2> /dev/null",
+    "check": "jsbt-check",
+    "build:clean": "rm *.{js,d.ts} 2> /dev/null",
     "format": "prettier --write 'src/**/*.{js,ts}' 'test/**/*.{js,ts,mjs}'",
-    "test": "node --experimental-strip-types --no-warnings test/index.ts",
-    "test:bun": "bun test/index.ts",
-    "test:deno": "deno --allow-env --allow-read test/index.ts",
-    "test:node20": "cd test; npx tsc; node compiled/test/index.js",
+    "test": "node test/index.ts",
     "test:slow": "SLOW_TESTS=1 node test/index.ts"
   },
   "exports": {

package/slh-dsa.d.ts

@@ -1,5 +1,5 @@
 import { type CHash } from '@noble/hashes/utils.js';
-import { type Signer } from './utils.ts';
+import { type Signer, type TArg, type TRet } from './utils.ts';
 /**
  * * N: Security parameter (in bytes). W: Winternitz parameter
  * * H: Hypertree height. D: Hypertree layers
@@ -40,14 +40,18 @@ export type SphincsHashOpts = {
 export declare const PARAMS: Record<string, SphincsOpts>;
 /** Address byte array of size `ADDR_BYTES`. */
 export type ADRS = Uint8Array;
-/** Hash and tweakable-hash callbacks bound to one SLH-DSA keypair context. */
+/** Hash and tweakable-hash callbacks bound to one SLH-DSA keypair context.
+ * Buffer-aliasing contract: `PRFaddr`, `thash1` and `thashN` return views into per-context
+ * scratch buffers (one per lane), so callers must consume or copy a result before the next
+ * call on the same lane. `clean()` wipes the scratch buffers along with the hash states.
+ */
 export type Context = {
     /**
      * Derive a PRF output for one address.
      * @param addr - Address bytes.
-     * @returns PRF output bytes.
+     * @returns PRF output bytes (scratch view; copy to retain).
      */
-    PRFaddr: (addr: ADRS) => Uint8Array;
+    PRFaddr: (addr: TArg<ADRS>) => TRet<Uint8Array>;
     /**
      * Derive the randomized message hash prefix.
      * @param skPRF - Secret PRF seed.
@@ -55,7 +59,7 @@ export type Context = {
      * @param msg - Message bytes.
      * @returns PRF output bytes.
      */
-    PRFmsg: (skPRF: Uint8Array, random: Uint8Array, msg: Uint8Array) => Uint8Array;
+    PRFmsg: (skPRF: TArg<Uint8Array>, random: TArg<Uint8Array>, msg: TArg<Uint8Array>) => TRet<Uint8Array>;
     /**
      * Hash one randomized message transcript.
      * @param R - Randomized message prefix.
@@ -64,14 +68,14 @@ export type Context = {
      * @param outLen - Output length in bytes.
      * @returns Transcript hash bytes.
      */
-    Hmsg: (R: Uint8Array, pk: Uint8Array, m: Uint8Array, outLen: number) => Uint8Array;
+    Hmsg: (R: TArg<Uint8Array>, pk: TArg<Uint8Array>, m: TArg<Uint8Array>, outLen: number) => TRet<Uint8Array>;
     /**
      * Tweakable hash over one input block.
      * @param input - Input block.
      * @param addr - Address bytes.
      * @returns Hash output bytes.
      */
-    thash1: (input: Uint8Array, addr: ADRS) => Uint8Array;
+    thash1: (input: TArg<Uint8Array>, addr: TArg<ADRS>) => TRet<Uint8Array>;
     /**
      * Tweakable hash over multiple input blocks.
      * @param blocks - Number of input blocks.
@@ -79,88 +83,104 @@ export type Context = {
      * @param addr - Address bytes.
      * @returns Hash output bytes.
      */
-    thashN: (blocks: number, input: Uint8Array, addr: ADRS) => Uint8Array;
+    thashN: (blocks: number, input: TArg<Uint8Array>, addr: TArg<ADRS>) => TRet<Uint8Array>;
     /** Wipe any buffered hash state for the current context. */
     clean: () => void;
 };
 /** Factory that creates a context generator for one SLH-DSA parameter set. */
-export type GetContext = (opts: SphincsOpts) => (pub_seed: Uint8Array, sk_seed?: Uint8Array) => Context;
+export type GetContext = (opts: SphincsOpts) => (pub_seed: TArg<Uint8Array>, sk_seed?: TArg<Uint8Array>) => TRet<Context>;
 /** Public SLH-DSA signer with prehash customization. */
 export type SphincsSigner = Signer & {
-    internal: Signer;
+    internal: TRet<Signer>;
     securityLevel: number;
-    prehash: (hash: CHash) => Signer;
+    prehash: (hash: TArg<CHash>) => TRet<Signer>;
 };
 /**
  * SLH-DSA-SHAKE-128f: Table 2 row `n=16, h=66, d=22, h'=3, a=6, k=33, lg w=4, m=34`;
  * lengths `publicKey=32`, `secretKey=64`, `signature=17088`, `seed=48`, `signRand=16`.
  * Also exposes `.prehash(...)`.
  */
-export declare const slh_dsa_shake_128f: SphincsSigner;
+export declare const slh_dsa_shake_128f: TRet<SphincsSigner>;
 /**
  * SLH-DSA-SHAKE-128s: Table 2 row `n=16, h=63, d=7, h'=9, a=12, k=14, lg w=4, m=30`;
  * lengths `publicKey=32`, `secretKey=64`, `signature=7856`, `seed=48`, `signRand=16`.
  * Also exposes `.prehash(...)`.
  */
-export declare const slh_dsa_shake_128s: SphincsSigner;
+export declare const slh_dsa_shake_128s: TRet<SphincsSigner>;
 /**
  * SLH-DSA-SHAKE-192f: Table 2 row `n=24, h=66, d=22, h'=3, a=8, k=33, lg w=4, m=42`;
  * lengths `publicKey=48`, `secretKey=96`, `signature=35664`, `seed=72`, `signRand=24`.
  * Also exposes `.prehash(...)`.
  */
-export declare const slh_dsa_shake_192f: SphincsSigner;
+export declare const slh_dsa_shake_192f: TRet<SphincsSigner>;
 /**
  * SLH-DSA-SHAKE-192s: Table 2 row `n=24, h=63, d=7, h'=9, a=14, k=17, lg w=4, m=39`;
  * lengths `publicKey=48`, `secretKey=96`, `signature=16224`, `seed=72`, `signRand=24`.
  * Also exposes `.prehash(...)`.
  */
-export declare const slh_dsa_shake_192s: SphincsSigner;
+export declare const slh_dsa_shake_192s: TRet<SphincsSigner>;
 /**
  * SLH-DSA-SHAKE-256f: Table 2 row `n=32, h=68, d=17, h'=4, a=9, k=35, lg w=4, m=49`;
  * lengths `publicKey=64`, `secretKey=128`, `signature=49856`, `seed=96`, `signRand=32`.
  * Also exposes `.prehash(...)`.
  */
-export declare const slh_dsa_shake_256f: SphincsSigner;
+export declare const slh_dsa_shake_256f: TRet<SphincsSigner>;
 /**
  * SLH-DSA-SHAKE-256s: Table 2 row `n=32, h=64, d=8, h'=8, a=14, k=22, lg w=4, m=47`;
  * lengths `publicKey=64`, `secretKey=128`, `signature=29792`, `seed=96`, `signRand=32`.
  * Also exposes `.prehash(...)`.
  */
-export declare const slh_dsa_shake_256s: SphincsSigner;
+export declare const slh_dsa_shake_256s: TRet<SphincsSigner>;
 /**
  * SLH-DSA-SHA2-128f: Table 2 row `n=16, h=66, d=22, h'=3, a=6, k=33, lg w=4, m=34`;
  * lengths `publicKey=32`, `secretKey=64`, `signature=17088`, `seed=48`, `signRand=16`.
  * Also exposes `.prehash(...)`.
+ * @example
+ * Generate deterministic SLH-DSA keys, sign one message, and verify the signature.
+ * ```ts
+ * import { sha256 } from '@noble/hashes/sha2.js';
+ * import { slh_dsa_sha2_128f } from '@noble/post-quantum/slh-dsa.js';
+ * const seed = new Uint8Array(slh_dsa_sha2_128f.lengths.seed!);
+ * const { secretKey, publicKey } = slh_dsa_sha2_128f.keygen(seed);
+ * const msg = new TextEncoder().encode('hello noble');
+ * const sig = slh_dsa_sha2_128f.sign(msg, secretKey);
+ * const isValid = slh_dsa_sha2_128f.verify(sig, msg, publicKey);
+ * const recovered = slh_dsa_sha2_128f.getPublicKey(secretKey);
+ * const context = new Uint8Array([1, 2, 3]);
+ * const prehash = slh_dsa_sha2_128f.prehash(sha256);
+ * const preSig = prehash.sign(msg, secretKey, { context });
+ * const preValid = prehash.verify(preSig, msg, publicKey, { context });
+ * const internalSig = slh_dsa_sha2_128f.internal.sign(msg, secretKey);
+ * ```
  */
-export declare const slh_dsa_sha2_128f: SphincsSigner;
+export declare const slh_dsa_sha2_128f: TRet<SphincsSigner>;
 /**
  * SLH-DSA-SHA2-128s: Table 2 row `n=16, h=63, d=7, h'=9, a=12, k=14, lg w=4, m=30`;
  * lengths `publicKey=32`, `secretKey=64`, `signature=7856`, `seed=48`, `signRand=16`.
  * Also exposes `.prehash(...)`.
  */
-export declare const slh_dsa_sha2_128s: SphincsSigner;
+export declare const slh_dsa_sha2_128s: TRet<SphincsSigner>;
 /**
  * SLH-DSA-SHA2-192f: Table 2 row `n=24, h=66, d=22, h'=3, a=8, k=33, lg w=4, m=42`;
  * lengths `publicKey=48`, `secretKey=96`, `signature=35664`, `seed=72`, `signRand=24`.
  * Also exposes `.prehash(...)`.
  */
-export declare const slh_dsa_sha2_192f: SphincsSigner;
+export declare const slh_dsa_sha2_192f: TRet<SphincsSigner>;
 /**
  * SLH-DSA-SHA2-192s: Table 2 row `n=24, h=63, d=7, h'=9, a=14, k=17, lg w=4, m=39`;
  * lengths `publicKey=48`, `secretKey=96`, `signature=16224`, `seed=72`, `signRand=24`.
  * Also exposes `.prehash(...)`.
  */
-export declare const slh_dsa_sha2_192s: SphincsSigner;
+export declare const slh_dsa_sha2_192s: TRet<SphincsSigner>;
 /**
  * SLH-DSA-SHA2-256f: Table 2 row `n=32, h=68, d=17, h'=4, a=9, k=35, lg w=4, m=49`;
  * lengths `publicKey=64`, `secretKey=128`, `signature=49856`, `seed=96`, `signRand=32`.
  * Also exposes `.prehash(...)`.
  */
-export declare const slh_dsa_sha2_256f: SphincsSigner;
+export declare const slh_dsa_sha2_256f: TRet<SphincsSigner>;
 /**
  * SLH-DSA-SHA2-256s: Table 2 row `n=32, h=64, d=8, h'=8, a=14, k=22, lg w=4, m=47`;
  * lengths `publicKey=64`, `secretKey=128`, `signature=29792`, `seed=96`, `signRand=32`.
  * Also exposes `.prehash(...)`.
  */
-export declare const slh_dsa_sha2_256s: SphincsSigner;
-//# sourceMappingURL=slh-dsa.d.ts.map
+export declare const slh_dsa_sha2_256s: TRet<SphincsSigner>;