@noble/post-quantum 0.6.0 → 0.7.0

package/slh-dsa.js

@@ -28,9 +28,10 @@
  */
 /*! noble-post-quantum - MIT License (c) 2024 Paul Miller (paulmillr.com) */
 import { hmac } from '@noble/hashes/hmac.js';
+import { bytesToNumberBE, numberToBytesBE } from '@noble/curves/utils.js';
 import { sha256, sha512 } from '@noble/hashes/sha2.js';
 import { shake256 } from '@noble/hashes/sha3.js';
-import { bytesToHex, concatBytes, createView, hexToBytes, } from '@noble/hashes/utils.js';
+import { concatBytes, createView } from '@noble/hashes/utils.js';
 import { abytes, checkHash, cleanBytes, copyBytes, equalBytes, getMask, getMessage, getMessagePrehash, randomBytes, splitCoder, validateSigOpts, validateVerOpts, vecCoder, } from "./utils.js";
 /** Winternitz signature params. */
 /**
@@ -41,13 +42,13 @@ import { abytes, checkHash, cleanBytes, copyBytes, equalBytes, getMask, getMessa
  * Other Table 2 columns such as `m`, public-key bytes, and signature bytes
  * stay derived at the export layer.
  */
-export const PARAMS = /* @__PURE__ */ (() => ({
-    '128f': { W: 16, N: 16, H: 66, D: 22, K: 33, A: 6, securityLevel: 128 },
-    '128s': { W: 16, N: 16, H: 63, D: 7, K: 14, A: 12, securityLevel: 128 },
-    '192f': { W: 16, N: 24, H: 66, D: 22, K: 33, A: 8, securityLevel: 192 },
-    '192s': { W: 16, N: 24, H: 63, D: 7, K: 17, A: 14, securityLevel: 192 },
-    '256f': { W: 16, N: 32, H: 68, D: 17, K: 35, A: 9, securityLevel: 256 },
-    '256s': { W: 16, N: 32, H: 64, D: 8, K: 22, A: 14, securityLevel: 256 },
+export const PARAMS = /* @__PURE__ */ (() => Object.freeze({
+    '128f': Object.freeze({ W: 16, N: 16, H: 66, D: 22, K: 33, A: 6, securityLevel: 128 }),
+    '128s': Object.freeze({ W: 16, N: 16, H: 63, D: 7, K: 14, A: 12, securityLevel: 128 }),
+    '192f': Object.freeze({ W: 16, N: 24, H: 66, D: 22, K: 33, A: 8, securityLevel: 192 }),
+    '192s': Object.freeze({ W: 16, N: 24, H: 63, D: 7, K: 17, A: 14, securityLevel: 192 }),
+    '256f': Object.freeze({ W: 16, N: 32, H: 68, D: 17, K: 35, A: 9, securityLevel: 256 }),
+    '256s': Object.freeze({ W: 16, N: 32, H: 64, D: 8, K: 22, A: 14, securityLevel: 256 }),
 }))();
 // FIPS 205 `ADRS.setTypeAndClear(...)` selectors. Local names shorten the spec labels
 // (`WOTS_HASH` -> `WOTS`, `TREE` -> `HASHTREE`, `FORS_ROOTS` -> `FORSPK`), and `setAddr({ type })`
@@ -61,19 +62,6 @@ const AddressType = {
     WOTSPRF: 5,
     FORSPRF: 6,
 };
-function hexToNumber(hex) {
-    if (typeof hex !== 'string')
-        throw new Error('hex string expected, got ' + typeof hex);
-    return BigInt(hex === '' ? '0' : '0x' + hex); // Big Endian
-}
-// BE: Big Endian, LE: Little Endian. This is the local FIPS 205 `toInt(...)` equivalent.
-function bytesToNumberBE(bytes) {
-    return hexToNumber(bytesToHex(bytes));
-}
-// Local in-range FIPS 205 `toByte(x, n)` equivalent; callers must keep `n < 256^len`.
-function numberToBytesBE(n, len) {
-    return hexToBytes(n.toString(16).padStart(len * 2, '0'));
-}
 // Local FIPS 205 Algorithm 4 `base_2^b(...)` implementation. Bits are consumed in big-endian
 // order within each input byte, and callers must provide at least `ceil(outLen * b / 8)` bytes;
 // short inputs are not rejected and would zero-extend implicitly.
@@ -92,15 +80,19 @@ const base2b = (outLen, b) => {
         return baseB;
     };
 };
+const _1n = /* @__PURE__ */ BigInt(1);
+const _8n = /* @__PURE__ */ BigInt(8);
+const _0xffn = /* @__PURE__ */ BigInt(0xff);
 function getMaskBig(bits) {
-    return (1n << BigInt(bits)) - 1n; // 4 -> 0b1111
+    return (_1n << BigInt(bits)) - _1n; // 4 -> 0b1111
 }
 /** One parameter/hash instantiation of the public SLH-DSA API.
  * `keygen(seed)` is a deterministic 3N-byte library hook around the internal keygen flow,
  * and `getPublicKey(secretKey)` only extracts the embedded public key
  * instead of recomputing `PK.root`.
  */
-function gen(opts, hashOpts) {
+function gen(opts, hashOpts_) {
+    const hashOpts = hashOpts_;
     const { N, W, H, D, K, A, securityLevel: securityLevel } = opts;
     const getContext = hashOpts.getContext(opts);
     if (W !== 16)
@@ -138,7 +130,6 @@ function gen(opts, hashOpts) {
     const setAddr = (opts, addr = new Uint8Array(ADDR_BYTES)) => {
         const { type, height, tree, layer, index, chain, hash, keypair } = opts;
         const { subtreeAddr, keypairAddr } = opts;
-        const v = createView(addr);
         if (height !== undefined)
             addr[OFFSET_CHAIN_ADDR] = height;
         if (layer !== undefined)
@@ -149,12 +140,21 @@ function gen(opts, hashOpts) {
             addr[OFFSET_CHAIN_ADDR] = chain;
         if (hash !== undefined)
             addr[OFFSET_HASH_ADDR] = hash;
-        if (index !== undefined)
-            v.setUint32(OFFSET_TREE_INDEX, index, false);
+        // Manual big-endian writes: setAddr runs in the innermost WOTS/tree loops, and creating a
+        // DataView per call was a measurable share of sign() time.
+        if (index !== undefined) {
+            addr[OFFSET_TREE_INDEX + 0] = index >>> 24;
+            addr[OFFSET_TREE_INDEX + 1] = index >>> 16;
+            addr[OFFSET_TREE_INDEX + 2] = index >>> 8;
+            addr[OFFSET_TREE_INDEX + 3] = index;
+        }
         if (subtreeAddr)
             addr.set(subtreeAddr.subarray(0, OFFSET_TREE + 8));
-        if (tree !== undefined)
-            v.setBigUint64(OFFSET_TREE, tree, false);
+        if (tree !== undefined) {
+            let t = tree;
+            for (let i = 7; i >= 0; i--, t >>= _8n)
+                addr[OFFSET_TREE + i] = Number(t & _0xffn);
+        }
         if (keypair !== undefined) {
             addr[OFFSET_KP_ADDR1] = keypair;
             if (TREE_HEIGHT > 8)
@@ -191,8 +191,9 @@ function gen(opts, hashOpts) {
     // `pkSeed` is the full public key byte string `PK.seed || PK.root`; after splitting `Hmsg`,
     // mask away any spare high bits so `idx_tree` / `idx_leaf` match the spec's final mod-2^k steps.
     const hashMessage = (R, pkSeed, msg, context) => {
+        const rawContext = context;
         // digest ← Hmsg(R, PK.seed, PK.root, M)
-        const digest = context.Hmsg(R, pkSeed, msg, hashMsgCoder.bytesLen);
+        const digest = rawContext.Hmsg(R, pkSeed, msg, hashMsgCoder.bytesLen);
         const [md, tmpIdxTree, tmpIdxLeaf] = hashMsgCoder.decode(digest);
         const tree = bytesToNumberBE(tmpIdxTree) & getMaskBig(TREE_BITS);
         const leafIdx = Number(bytesToNumberBE(tmpIdxLeaf)) & getMask(LEAF_BITS);
@@ -202,15 +203,19 @@ function gen(opts, hashOpts) {
     // sibling pairs on `stack`, and record the sibling whenever the current subtree is the auth-path
     // neighbor of the target leaf at that height.
     const treehash = (height, fn) => function treehash_i(context, leafIdx, idxOffset, treeAddr, info) {
+        const rawContext = context;
+        const leafFn = fn;
         const maxIdx = (1 << height) - 1;
         const stack = new Uint8Array(height * N);
         const authPath = new Uint8Array(height * N);
+        // One node buffer per treehash call (not per leaf): both halves are fully overwritten at
+        // each use, and the returned root aliases cur1, which is never reused after return.
+        const current = new Uint8Array(2 * N);
+        const cur0 = current.subarray(0, N);
+        const cur1 = current.subarray(N);
         for (let idx = 0;; idx++) {
-            const current = new Uint8Array(2 * N);
-            const cur0 = current.subarray(0, N);
-            const cur1 = current.subarray(N);
             const addrOffset = idx + idxOffset;
-            cur1.set(fn(leafIdx, addrOffset, context, info));
+            cur1.set(leafFn(leafIdx, addrOffset, rawContext, info));
             let h = 0;
             for (let i = idx, o = idxOffset, l = leafIdx;; h++, i >>>= 1, l >>>= 1, o >>>= 1) {
                 if (h === height)
@@ -221,7 +226,7 @@ function gen(opts, hashOpts) {
                     break;
                 setAddr({ height: h + 1, index: (i >> 1) + (o >> 1) }, treeAddr);
                 cur0.set(stack.subarray(h * N).subarray(0, N));
-                cur1.set(context.thashN(2, current, treeAddr));
+                cur1.set(rawContext.thashN(2, current, treeAddr));
             }
             stack.subarray(h * N).set(cur1); // stack.push(cur1)
         }
@@ -229,6 +234,7 @@ function gen(opts, hashOpts) {
         throw new Error('Unreachable code path reached, report this error');
     };
     const wotsTreehash = treehash(TREE_HEIGHT, (leafIdx, addrOffset, context, info) => {
+        const rawContext = context;
         const wotsPk = new Uint8Array(WOTS_LEN * N);
         // `keygen()` passes `leafIdx = ~0 >>> 0`, so no real XMSS leaf matches and this suppresses
         // WOTS signature capture while still hashing every chain to its public-key endpoint.
@@ -239,7 +245,7 @@ function gen(opts, hashOpts) {
             const wotsK = info.wotsSteps[i] | wotsKmask;
             const pk = wotsPk.subarray(i * N, (i + 1) * N);
             setAddr({ chain: i, hash: 0, type: AddressType.WOTSPRF }, info.leafAddr);
-            pk.set(context.PRFaddr(info.leafAddr));
+            pk.set(rawContext.PRFaddr(info.leafAddr));
             setAddr({ type: AddressType.WOTS }, info.leafAddr);
             for (let k = 0;; k++) {
                 if (k === wotsK)
@@ -247,16 +253,17 @@ function gen(opts, hashOpts) {
                 if (k === W - 1)
                     break;
                 setAddr({ hash: k }, info.leafAddr);
-                pk.set(context.thash1(pk, info.leafAddr));
+                pk.set(rawContext.thash1(pk, info.leafAddr));
             }
         }
-        return context.thashN(WOTS_LEN, wotsPk, info.pkAddr);
+        return rawContext.thashN(WOTS_LEN, wotsPk, info.pkAddr);
     });
     const forsTreehash = treehash(A, (_, addrOffset, context, forsLeafAddr) => {
+        const rawContext = context;
         setAddr({ type: AddressType.FORSPRF, index: addrOffset }, forsLeafAddr);
-        const prf = context.PRFaddr(forsLeafAddr);
+        const prf = rawContext.PRFaddr(forsLeafAddr);
         setAddr({ type: AddressType.FORSTREE }, forsLeafAddr);
-        return context.thash1(prf, forsLeafAddr);
+        return rawContext.thash1(prf, forsLeafAddr);
     });
     // Fuse `xmss_sign` with the subtree-root computation needed by `ht_sign`, so one tree walk
     // yields both the WOTS/auth-path signature and the root that the next hypertree layer signs.
@@ -277,6 +284,7 @@ function gen(opts, hashOpts) {
         };
     };
     const computeRoot = (leaf, leafIdx, idxOffset, authPath, treeHeight, context, addr) => {
+        const rawContext = context;
         const buffer = new Uint8Array(2 * N);
         const b0 = buffer.subarray(0, N);
         const b1 = buffer.subarray(N, 2 * N);
@@ -300,17 +308,17 @@ function gen(opts, hashOpts) {
             setAddr({ height: i + 1, index: leafIdx + idxOffset }, addr);
             const a = authPath.subarray((i + 1) * N, (i + 2) * N);
             if ((leafIdx & 1) !== 0) {
-                b1.set(context.thashN(2, buffer, addr));
+                b1.set(rawContext.thashN(2, buffer, addr));
                 b0.set(a);
             }
             else {
-                buffer.set(context.thashN(2, buffer, addr));
+                buffer.set(rawContext.thashN(2, buffer, addr));
                 b1.set(a);
             }
         }
         // Root
         setAddr({ height: treeHeight, index: leafIdx + idxOffset }, addr);
-        return context.thashN(2, buffer, addr);
+        return rawContext.thashN(2, buffer, addr);
     };
     const seedCoder = splitCoder('seed', N, N, N);
     const publicCoder = splitCoder('publicKey', N, N);
@@ -318,15 +326,15 @@ function gen(opts, hashOpts) {
     const forsCoder = vecCoder(splitCoder('fors', N, N * A), K);
     const wotsCoder = vecCoder(splitCoder('wots', WOTS_LEN * N, TREE_HEIGHT * N), D);
     const sigCoder = splitCoder('signature', N, forsCoder, wotsCoder); // random || fors || wots
-    const internal = {
-        info: { type: 'internal-slh-dsa' },
-        lengths: {
+    const internal = Object.freeze({
+        info: Object.freeze({ type: 'internal-slh-dsa' }),
+        lengths: Object.freeze({
             publicKey: publicCoder.bytesLen,
             secretKey: secretCoder.bytesLen,
             signature: sigCoder.bytesLen,
             seed: seedCoder.bytesLen,
             signRand: N,
-        },
+        }),
         keygen(seed) {
             if (seed !== undefined)
                 abytes(seed, seedCoder.bytesLen, 'seed');
@@ -343,7 +351,10 @@ function gen(opts, hashOpts) {
             const secretKey = secretCoder.encode([secretSeed, secretPRF, publicKey]);
             context.clean();
             cleanBytes(secretSeed, secretPRF, root, wotsAddr, topTreeAddr);
-            return { publicKey, secretKey };
+            return {
+                publicKey: publicKey,
+                secretKey: secretKey,
+            };
         },
         getPublicKey: (secretKey) => {
             const [_skSeed, _skPRF, pk] = secretCoder.decode(secretKey);
@@ -384,7 +395,9 @@ function gen(opts, hashOpts) {
                     height: 0,
                     index: indices[i] + idxOffset,
                 }, forsTreeAddr);
-                const prf = context.PRFaddr(forsTreeAddr);
+                // Copy: PRFaddr returns a per-context scratch view, and this value is retained in
+                // `fors` across the many PRFaddr calls inside forsTreehash below.
+                const prf = copyBytes(context.PRFaddr(forsTreeAddr));
                 setAddr({ type: AddressType.FORSTREE }, forsTreeAddr);
                 const { root, authPath } = forsTreehash(context, indices[i], idxOffset, forsTreeAddr, forsLeaf);
                 roots.push(root);
@@ -394,7 +407,9 @@ function gen(opts, hashOpts) {
                 type: AddressType.FORSPK,
                 keypairAddr: wotsAddr,
             });
-            const root = context.thashN(K, concatBytes(...roots), forsPkAddr);
+            // Copy: thashN returns a per-context scratch view, and `root` lives across every hash
+            // call in the hypertree loop below (it is also mutated via root.set).
+            const root = copyBytes(context.thashN(K, concatBytes(...roots), forsPkAddr));
             // WOTS signatures
             const treeAddr = setAddr({ type: AddressType.HASHTREE });
             const wots = [];
@@ -414,10 +429,14 @@ function gen(opts, hashOpts) {
         },
         verify: (sig, msg, publicKey) => {
             const [pkSeed, pubRoot] = publicCoder.decode(publicKey);
-            const [random, forsVec, wotsVec] = sigCoder.decode(sig);
             const pk = publicKey;
+            // FIPS 205 Algorithm 20 step 1: wrong-length signatures return false instead of throwing
+            // (same as ml-dsa). Must run before sigCoder.decode, which throws on length mismatch.
+            // Preserve TypeError for non-byte API arguments before treating byte lengths as invalid.
+            abytes(sig, undefined, 'signature');
             if (sig.length !== sigCoder.bytesLen)
                 return false;
+            const [random, forsVec, wotsVec] = sigCoder.decode(sig);
             const context = getContext(pkSeed);
             let { tree, leafIdx, md } = hashMessage(random, pk, msg, context);
             const wotsAddr = setAddr({
@@ -437,14 +456,16 @@ function gen(opts, hashOpts) {
                 const idxOffset = i << A;
                 setAddr({ height: 0, index: indices[i] + idxOffset }, forsTreeAddr);
                 const leaf = context.thash1(prf, forsTreeAddr);
-                // Compute inplace, because we need all roots in same byte array
-                roots.push(computeRoot(leaf, indices[i], idxOffset, authPath, A, context, forsTreeAddr));
+                // Copy: computeRoot returns a thashN scratch view, and roots are retained across the
+                // remaining FORS iterations (computeRoot itself copies `leaf` before hashing).
+                roots.push(copyBytes(computeRoot(leaf, indices[i], idxOffset, authPath, A, context, forsTreeAddr)));
             }
             const forsPkAddr = setAddr({
                 type: AddressType.FORSPK,
                 keypairAddr: wotsAddr,
             });
-            let root = context.thashN(K, concatBytes(...roots), forsPkAddr); // root = thash()
+            // Copy: `root` must survive the thash1/thashN calls of the WOTS chain loop below.
+            let root = copyBytes(context.thashN(K, concatBytes(...roots), forsPkAddr)); // root = thash()
             // WOTS signature
             const treeAddr = setAddr({ type: AddressType.HASHTREE });
             const wotsPkAddr = setAddr({ type: AddressType.WOTSPK });
@@ -467,14 +488,15 @@ function gen(opts, hashOpts) {
                     }
                 }
                 const leaf = context.thashN(WOTS_LEN, wotsPk, wotsPkAddr);
-                root = computeRoot(leaf, leafIdx, 0, sigAuth, TREE_HEIGHT, context, treeAddr);
+                // Copy: `root` is read by chainLengths / equalBytes after later hash calls.
+                root = copyBytes(computeRoot(leaf, leafIdx, 0, sigAuth, TREE_HEIGHT, context, treeAddr));
                 leafIdx = Number(tree & getMaskBig(TREE_HEIGHT));
             }
             return equalBytes(root, pubRoot);
         },
-    };
-    return {
-        info: { type: 'slh-dsa' },
+    });
+    return Object.freeze({
+        info: Object.freeze({ type: 'slh-dsa' }),
         internal,
         securityLevel: securityLevel,
         lengths: internal.lengths,
@@ -493,25 +515,26 @@ function gen(opts, hashOpts) {
         },
         prehash: (hash) => {
             checkHash(hash, securityLevel);
-            return {
-                info: { type: 'hashslh-dsa' },
+            const rawHash = hash;
+            return Object.freeze({
+                info: Object.freeze({ type: 'hashslh-dsa' }),
                 lengths: internal.lengths,
                 keygen: internal.keygen,
                 getPublicKey: internal.getPublicKey,
                 sign: (msg, secretKey, opts = {}) => {
                     validateSigOpts(opts);
-                    const M = getMessagePrehash(hash, msg, opts.context);
+                    const M = getMessagePrehash(rawHash, msg, opts.context);
                     const res = internal.sign(M, secretKey, opts);
                     cleanBytes(M);
                     return res;
                 },
                 verify: (sig, msg, publicKey, opts = {}) => {
                     validateVerOpts(opts);
-                    return internal.verify(sig, getMessagePrehash(hash, msg, opts.context), publicKey);
+                    return internal.verify(sig, getMessagePrehash(rawHash, msg, opts.context), publicKey);
                 },
-            };
+            });
         },
-    };
+    });
 }
 // FIPS 205 §11.1 SHAKE instantiation: this path hashes the full uncompressed address bytes,
 // unlike the compressed 22-byte SHA2 path in §11.2.
@@ -522,25 +545,36 @@ const genShake = () => (opts) => (pubSeed, skSeed) => {
     // for each address-bound call instead of reabsorbing the same seed every time.
     const h0 = shake256.create({}).update(pubSeed);
     const h0tmp = h0.clone();
+    // Per-context output scratch: thash1/thashN/PRFaddr return these buffers directly, so
+    // callers must consume or copy a result before the next call on the same lane.
+    const thashOut = new Uint8Array(N);
+    const prfOut = new Uint8Array(N);
     const thash = (blocks, input, addr) => {
         stats.thash++;
-        return h0
-            ._cloneInto(h0tmp)
+        const len = blocks * N;
+        h0._cloneInto(h0tmp)
             .update(addr)
-            .update(input.subarray(0, blocks * N))
-            .xof(N);
+            .update(input.length === len ? input : input.subarray(0, len))
+            .xofInto(thashOut);
+        return thashOut;
     };
     return {
         PRFaddr: (addr) => {
             if (!skSeed)
                 throw new Error('no sk seed');
             stats.prf++;
-            const res = h0._cloneInto(h0tmp).update(addr).update(skSeed).xof(N);
-            return res;
+            h0._cloneInto(h0tmp).update(addr).update(skSeed).xofInto(prfOut);
+            return prfOut;
         },
         PRFmsg: (skPRF, random, msg) => {
             stats.gen_message_random++;
-            return shake256.create({}).update(skPRF).update(random).update(msg).digest().subarray(0, N);
+            return shake256
+                .create({})
+                .update(skPRF)
+                .update(random)
+                .update(msg)
+                .digest()
+                .subarray(0, N);
         },
         Hmsg: (R, pk, m, outLen) => {
             stats.hmsg++;
@@ -551,6 +585,7 @@ const genShake = () => (opts) => (pubSeed, skSeed) => {
         clean: () => {
             h0.destroy();
             h0tmp.destroy();
+            cleanBytes(thashOut, prfOut);
             //console.log(stats);
         },
     };
@@ -618,6 +653,16 @@ const genSha = (h0, h1) => (opts) => (pub_seed, sk_seed) => {
         .update(new Uint8Array(h1.blockLen - N));
     const h0tmp = h0ps.clone();
     const h1tmp = h1ps.clone();
+    // Per-context output scratch: thash1/thashN/PRFaddr return views into these buffers, so
+    // callers must consume or copy a result before the next call on the same lane (see Context
+    // docs). digestInto also skips digest()'s per-call destroy(): the tmp states are fully
+    // overwritten by the next _cloneInto and wiped in clean().
+    const h0out = new Uint8Array(h0.outputLen);
+    const h1out = new Uint8Array(h1.outputLen);
+    const prfOut = new Uint8Array(h0.outputLen);
+    const h0outN = h0out.subarray(0, N);
+    const h1outN = h1out.subarray(0, N);
+    const prfOutN = prfOut.subarray(0, N);
     // https://www.rfc-editor.org/rfc/rfc8017.html#appendix-B.2.1
     // This local helper is intentionally stricter than generic MGF1 reuse: current SLH-DSA callers
     // only request tiny `m`-byte outputs, but the guard below rejects `length > 2^32` instead of
@@ -636,44 +681,49 @@ const genSha = (h0, h1) => (opts) => (pub_seed, sk_seed) => {
         cleanBytes(out.subarray(length));
         return out.subarray(0, length);
     }
-    const thash = (_, h, hTmp) => (blocks, input, addr) => {
+    const thash = (h, hTmp, out, outN) => (blocks, input, addr) => {
         stats.thash++;
-        const d = h
-            ._cloneInto(hTmp)
+        const len = blocks * N;
+        h._cloneInto(hTmp)
             .update(addr)
-            .update(input.subarray(0, blocks * N))
-            .digest();
-        return d.subarray(0, N);
+            .update(input.length === len ? input : input.subarray(0, len))
+            .digestInto(out);
+        return outN;
     };
     return {
         PRFaddr: (addr) => {
             if (!sk_seed)
                 throw new Error('No sk seed');
             stats.prf++;
-            const res = h0ps
+            h0ps
                 ._cloneInto(h0tmp)
                 .update(addr)
                 .update(sk_seed)
-                .digest()
-                .subarray(0, N);
-            return res;
+                .digestInto(prfOut);
+            return prfOutN;
         },
         PRFmsg: (skPRF, random, msg) => {
             stats.gen_message_random++;
-            return hmac.create(h1, skPRF).update(random).update(msg).digest().subarray(0, N);
+            return hmac
+                .create(h1, skPRF)
+                .update(random)
+                .update(msg)
+                .digest()
+                .subarray(0, N);
         },
         Hmsg: (R, pk, m, outLen) => {
             stats.hmsg++;
             const seed = concatBytes(R.subarray(0, N), pk.subarray(0, N), h1.create().update(R.subarray(0, N)).update(pk).update(m).digest());
             return mgf1(seed, outLen, h1);
         },
-        thash1: thash(h0, h0ps, h0tmp).bind(null, 1),
-        thashN: thash(h1, h1ps, h1tmp),
+        thash1: thash(h0ps, h0tmp, h0out, h0outN).bind(null, 1),
+        thashN: thash(h1ps, h1tmp, h1out, h1outN),
         clean: () => {
             h0ps.destroy();
             h1ps.destroy();
             h0tmp.destroy();
             h1tmp.destroy();
+            cleanBytes(h0out, h1out, prfOut);
             //console.log(stats);
         },
     };
@@ -690,6 +740,23 @@ const SHA512_SIMPLE = /* @__PURE__ */ (() => ({
  * SLH-DSA-SHA2-128f: Table 2 row `n=16, h=66, d=22, h'=3, a=6, k=33, lg w=4, m=34`;
  * lengths `publicKey=32`, `secretKey=64`, `signature=17088`, `seed=48`, `signRand=16`.
  * Also exposes `.prehash(...)`.
+ * @example
+ * Generate deterministic SLH-DSA keys, sign one message, and verify the signature.
+ * ```ts
+ * import { sha256 } from '@noble/hashes/sha2.js';
+ * import { slh_dsa_sha2_128f } from '@noble/post-quantum/slh-dsa.js';
+ * const seed = new Uint8Array(slh_dsa_sha2_128f.lengths.seed!);
+ * const { secretKey, publicKey } = slh_dsa_sha2_128f.keygen(seed);
+ * const msg = new TextEncoder().encode('hello noble');
+ * const sig = slh_dsa_sha2_128f.sign(msg, secretKey);
+ * const isValid = slh_dsa_sha2_128f.verify(sig, msg, publicKey);
+ * const recovered = slh_dsa_sha2_128f.getPublicKey(secretKey);
+ * const context = new Uint8Array([1, 2, 3]);
+ * const prehash = slh_dsa_sha2_128f.prehash(sha256);
+ * const preSig = prehash.sign(msg, secretKey, { context });
+ * const preValid = prehash.verify(preSig, msg, publicKey, { context });
+ * const internalSig = slh_dsa_sha2_128f.internal.sign(msg, secretKey);
+ * ```
  */
 export const slh_dsa_sha2_128f = /* @__PURE__ */ (() => gen(PARAMS['128f'], SHA256_SIMPLE))();
 /**
@@ -722,4 +789,3 @@ export const slh_dsa_sha2_256f = /* @__PURE__ */ (() => gen(PARAMS['256f'], SHA5
  * Also exposes `.prehash(...)`.
  */
 export const slh_dsa_sha2_256s = /* @__PURE__ */ (() => gen(PARAMS['256s'], SHA512_SIMPLE))();
-//# sourceMappingURL=slh-dsa.js.map