@noble/post-quantum 0.6.1 → 0.7.0

package/falcon.js

@@ -403,6 +403,17 @@ const Q = 12289; // 12 * 1024 + 1
 // Falcon's midpoint floor(q/2); the only live use is the mirrored G-reconstruction reduction below.
 const Qhalf = Q >> 1;
 const QBig = BigInt(Q);
+const _0n = /* @__PURE__ */ BigInt(0);
+const _1n = /* @__PURE__ */ BigInt(1);
+const _10n = /* @__PURE__ */ BigInt(10);
+const _25n = /* @__PURE__ */ BigInt(25);
+const _31n = /* @__PURE__ */ BigInt(31);
+const _32n = /* @__PURE__ */ BigInt(32);
+const _63n = /* @__PURE__ */ BigInt(63);
+const _64n = /* @__PURE__ */ BigInt(64);
+// Low 32 bits and low 63 bits of a bigint, used by the chacha20 counter and gaussian sampler.
+const MASK_32n = /* @__PURE__ */ BigInt('0xffffffff');
+const MASK_63n = /* @__PURE__ */ BigInt('0x7fffffffffffffff');
 //const R = 4091; // 2^16 mod q
 // This 16-bit Montgomery kernel uses R = 2^16, so mul(x, R2) converts x into Montgomery form.
 const R2 = 10952; // 2^32 mod q
@@ -439,35 +450,35 @@ const BITLENGTH = [
 // Smaller Falcon dimensions reuse the N = 1024, q = 12289 table by summing 2^(10-logn) draws.
 // The trailing 0 sentinel guarantees gaussSingle()
 // always selects a tail bucket when x = 0 is missed.
-const gauss_1024_12289 = [
-    1283868770400643928n,
-    6416574995475331444n,
-    4078260278032692663n,
-    2353523259288686585n,
-    1227179971273316331n,
-    575931623374121527n,
-    242543240509105209n,
-    91437049221049666n,
-    30799446349977173n,
-    9255276791179340n,
-    2478152334826140n,
-    590642893610164n,
-    125206034929641n,
-    23590435911403n,
-    3948334035941n,
-    586753615614n,
-    77391054539n,
-    9056793210n,
-    940121950n,
-    86539696n,
-    7062824n,
-    510971n,
-    32764n,
-    1862n,
-    94n,
-    4n,
-    0n,
-];
+const gauss_1024_12289 = /* @__PURE__ */ [
+    '1283868770400643928',
+    '6416574995475331444',
+    '4078260278032692663',
+    '2353523259288686585',
+    '1227179971273316331',
+    '575931623374121527',
+    '242543240509105209',
+    '91437049221049666',
+    '30799446349977173',
+    '9255276791179340',
+    '2478152334826140',
+    '590642893610164',
+    '125206034929641',
+    '23590435911403',
+    '3948334035941',
+    '586753615614',
+    '77391054539',
+    '9056793210',
+    '940121950',
+    '86539696',
+    '7062824',
+    '510971',
+    '32764',
+    '1862',
+    '94',
+    '4',
+    '0',
+].map(BigInt);
 // Exact binary64 1/sigma payloads from round-3 fpr.h. Nearby decimal spellings round 1 ULP low in
 // JS, so keep these as decoded bit patterns and recheck the raw payloads after edits.
 const INV_SIGMA = /* @__PURE__ */ Object.freeze([
@@ -1147,9 +1158,9 @@ function genFalcon(opts) {
             let val = 0;
             for (let i = 0; i < g; i++) {
                 const r128 = bytesToNumberLE(this.shake.xof(16));
-                const r1 = r128 & 0x7fffffffffffffffn;
-                const r2 = (r128 >> 64n) & 0x7fffffffffffffffn;
-                const sign = Number((r128 >> 63n) & 1n);
+                const r1 = r128 & MASK_63n;
+                const r2 = (r128 >> _64n) & MASK_63n;
+                const sign = Number((r128 >> _63n) & _1n);
                 let f = r1 < gauss_1024_12289[0] ? 1 : 0;
                 let v = 0;
                 for (let k = 1; k < gauss_1024_12289.length; k++) {
@@ -1186,7 +1197,7 @@ function genFalcon(opts) {
             const n = 1 << logn;
             const d = new Array(n >> 1);
             for (let k = 0; k < n; k += 2) {
-                let s = 0n;
+                let s = _0n;
                 for (let i = 0; i <= k; i += 2)
                     s += a[i] * a[k - i];
                 for (let i = k + 2; i < n; i += 2)
@@ -1194,7 +1205,7 @@ function genFalcon(opts) {
                 d[k >>> 1] = s;
             }
             for (let k = 0; k < n; k += 2) {
-                let s = 0n;
+                let s = _0n;
                 for (let i = 1; i < k; i += 2)
                     s += a[i] * a[k - i];
                 for (let i = k + 1; i < n; i += 2)
@@ -1206,7 +1217,7 @@ function genFalcon(opts) {
         mulConjD(logn, d, a, b) {
             const n = 1 << logn;
             for (let k = 0; k < n; k++) {
-                let s = 0n;
+                let s = _0n;
                 for (let i = 0; i <= k; i += 2)
                     s += b[i >>> 1] * a[k - i];
                 for (let i = k + 2 - (k & 1); i < n; i += 2)
@@ -1221,7 +1232,7 @@ function genFalcon(opts) {
         subMul(logn, a, b, c, e) {
             const n = 1 << logn;
             for (let k = 0; k < n; k++) {
-                let s = 0n;
+                let s = _0n;
                 for (let i = 0; i <= k; i++)
                     s += b[i] * c[k - i];
                 for (let i = k + 1; i < n; i++)
@@ -1265,7 +1276,7 @@ function genFalcon(opts) {
             const Gx = new Float64Array(n);
             const k = new Array(n);
             while (true) {
-                let scaleFG = 31n * (FGlen - 10n);
+                let scaleFG = _31n * (FGlen - _10n);
                 for (let i = 0; i < n; i++) {
                     Fx[i] = Number(F[i] >> scaleFG);
                     Gx[i] = Number(G[i] >> scaleFG);
@@ -1284,16 +1295,16 @@ function genFalcon(opts) {
                 }
                 F = this.subMul(logn, F, f, k, scaleK); // 3:     F ← F - kf
                 G = this.subMul(logn, G, g, k, scaleK); // 4:     G ← G - kg
-                const maxfgNew = scaleK + BigInt(Math.round(fgMaxBits)) + 10n;
+                const maxfgNew = scaleK + BigInt(Math.round(fgMaxBits)) + _10n;
                 if (maxfgNew < maxFGBits)
                     maxFGBits = maxfgNew;
-                if (FGlen > 1n && FGlen * 31n >= maxFGBits + 31n)
+                if (FGlen > _1n && FGlen * _31n >= maxFGBits + _31n)
                     FGlen--;
-                if (scaleK <= 0n)
+                if (scaleK <= _0n)
                     break;
-                scaleK -= 25n;
-                if (scaleK < 0n)
-                    scaleK = 0n;
+                scaleK -= _25n;
+                if (scaleK < _0n)
+                    scaleK = _0n;
             }
             return true;
         }
@@ -1321,11 +1332,11 @@ function genFalcon(opts) {
                 const xf = f[0];
                 const xg = g[0];
                 // We can rely on 'invert' to throw if they are not coprime.
-                if (xf <= 0n || xg <= 0n)
+                if (xf <= _0n || xg <= _0n)
                     return false;
                 try {
                     const u1 = invert(xf, xg); //  if gcd(f, g) ≠ 1 then
-                    const v1 = (1n - u1 * xf) / xg;
+                    const v1 = (_1n - u1 * xf) / xg;
                     F[0] = -v1 * QBig; // 5:     (F, G) ← (vq, uq)
                     G[0] = u1 * QBig;
                     return true;
@@ -1607,7 +1618,14 @@ function genFalcon(opts) {
                 return headerCoder(0x30 + logn, splitCoder('falcon.signature', NONCELEN, sigLen, msg.length)).encode([nonce, pad(sigLen).encode(s2), msg]);
             },
             decode(data) {
+                // Keep API misuse on the coder's TypeError path before reading the container length.
+                abytes(data, undefined, 'signature');
+                // The compressed-signature field is fixed-width here; only the message is variable. A
+                // container shorter than the fixed part would make the s2 field borrow bytes from nowhere
+                // and let a truncated encoding open to the same message.
                 const msgLen = data.length - NONCELEN - sigLen - 1;
+                if (msgLen < 0)
+                    throw new Error('signature coder: wrong length');
                 const [nonce, s2, msg] = headerCoder(0x30 + logn, splitCoder('falcon.signature', NONCELEN, sigLen, msgLen)).decode(data);
                 return { nonce, s2: decodeSig(s2), msg };
             },
@@ -1622,7 +1640,13 @@ function genFalcon(opts) {
                 return headerCoder(0x30 + logn, splitCoder('falcon.detachedSignature', NONCELEN, getSigLen(s2))).encode([nonce, opts.padded ? pad(sigLen).encode(s2) : s2]);
             },
             decode(data) {
-                const [nonce, raw] = headerCoder(0x30 + logn, splitCoder('falcon.detachedSignature', NONCELEN, data.length - NONCELEN - 1)).decode(data);
+                // Padded detached signatures are fixed-length (`lengths.signature`), so the payload width
+                // must come from the parameter set, not from the input: deriving it would accept appended
+                // zero bytes and truncated padding as extra valid encodings of the same signature.
+                // Unpadded signatures are variable-length; decodeUnpaddedSig() enforces the exact canonical
+                // bitlength of whatever remains.
+                const payloadLen = opts.padded ? sigLen : data.length - NONCELEN - 1;
+                const [nonce, raw] = headerCoder(0x30 + logn, splitCoder('falcon.detachedSignature', NONCELEN, payloadLen)).decode(data);
                 const s2 = decodeSig(raw);
                 return { nonce, s2 };
             },
@@ -1710,7 +1734,7 @@ function genFalcon(opts) {
         shakeBuf;
         ctrView;
         // ChaCha
-        ctr = 0n;
+        ctr = _0n;
         buf;
         buf32;
         pos;
@@ -1760,8 +1784,8 @@ function genFalcon(opts) {
             const out32 = swap32IfBE(this.buf32);
             for (let i = 0; i < 8; i++, this.ctr++) {
                 const n = swap32IfBE(this.nonce32.slice()); // [n0, n1, n2, n3]
-                n[2] ^= Number(this.ctr & 0xffffffffn);
-                n[3] ^= Number(this.ctr >> 32n);
+                n[2] ^= Number(this.ctr & MASK_32n);
+                n[3] ^= Number(this.ctr >> _32n);
                 // chacha20() takes raw nonce bytes; on BE the word-normalized temp must be swapped back.
                 swap32IfBE(n.subarray(1));
                 chacha20(this.key, u8(n.subarray(1)), EMPTY_CHACHA20_BLOCK, this.curBlock, n[0]);
@@ -2078,7 +2102,8 @@ function genFalcon(opts) {
         //         ▷ Remove 1 byte for the header, and 40 bytes for r
         // 11: while (s = ⊥)
         // 12: return sig = (r, s)
-        abytes(msg);
+        abytes(msg, undefined, 'msg');
+        abytes(sk, secretKeyCoder.bytesLen, 'secretKey');
         // One RNG stream drives both the public 40-byte nonce and the 48-byte sampler seed, so
         // deterministic rnd hooks make signatures deterministic for fixed secretKey/message inputs.
         const nonce = rnd(40);
@@ -2184,6 +2209,8 @@ function genFalcon(opts) {
         validateSigOpts(opts);
         if (opts.context !== undefined)
             throw new Error('context is not supported');
+        if (opts.random !== undefined && typeof opts.random !== 'function')
+            throw new TypeError('"opts.random" expected function, got type=' + typeof opts.random);
         if (opts.random !== undefined)
             return opts.random;
         if (opts.extraEntropy === undefined)
@@ -2223,6 +2250,7 @@ function genFalcon(opts) {
         return { publicKey: pk, secretKey: sk };
     };
     const getPublicKey = (sk) => {
+        abytes(sk, secretKeyCoder.bytesLen, 'secretKey');
         const [f, g, F] = secretKeyCoder.decode(sk);
         try {
             const h = computePublic(f, g);
@@ -2245,9 +2273,10 @@ function genFalcon(opts) {
      */
     const verify = (sig, msg, pk, verOpts = {}) => {
         checkVerOpts(verOpts);
-        abytes(sig);
-        abytes(msg);
-        abytes(pk);
+        abytes(sig, undefined, 'signature');
+        abytes(msg, undefined, 'msg');
+        // Length/canonical public-key failures are decoded below and return false; only type is fatal.
+        abytes(pk, undefined, 'publicKey');
         try {
             const { s2, nonce } = SignatureCoderDetached(logn).decode(sig);
             return verifyRaw(pk, s2, nonce, msg);
@@ -2382,4 +2411,3 @@ export const __tests = /* @__PURE__ */ (() => Object.freeze({
     falcon1024: falcon1024.__test,
     falcon1024padded: falcon1024padded.__test,
 }))();
-//# sourceMappingURL=falcon.js.map

package/hybrid.d.ts

@@ -190,7 +190,11 @@ expandSeed: TArg<ExpandSeed>, combiner: TArg<Combiner>, ...kems: TArg<KEM[]>): T
  * import { combineSigners, expandSeedXof } from '@noble/post-quantum/hybrid.js';
  * import { ml_dsa44 } from '@noble/post-quantum/ml-dsa.js';
  * const hybrid = combineSigners(32, expandSeedXof(shake256), ml_dsa44, ml_dsa44);
- * const { publicKey } = hybrid.keygen();
+ * const seed = new Uint8Array(hybrid.lengths.seed!).fill(1);
+ * const { secretKey, publicKey } = hybrid.keygen(seed);
+ * const msg = new TextEncoder().encode('hello noble');
+ * const sig = hybrid.sign(msg, secretKey);
+ * const isValid = hybrid.verify(sig, msg, publicKey);
  * ```
  */
 export declare function combineSigners(realSeedLen: number | undefined, expandSeed: TArg<ExpandSeed>, ...signers: TArg<Signer[]>): TRet<Signer>;
@@ -263,19 +267,4 @@ export declare const ml_kem768_x25519: TRet<KEM>;
 export declare const ml_kem768_p256: TRet<KEM>;
 /** P-384 + ML-KEM-1024 hybrid preset. */
 export declare const ml_kem1024_p384: TRet<KEM>;
-/** Legacy alias for `ml_kem768_x25519`. */
-export declare const XWing: TRet<KEM>;
-/** Legacy alias for `ml_kem768_x25519`. */
-export declare const MLKEM768X25519: TRet<KEM>;
-/** Legacy alias for `ml_kem768_p256`. */
-export declare const MLKEM768P256: TRet<KEM>;
-/** Legacy alias for `ml_kem1024_p384`. */
-export declare const MLKEM1024P384: TRet<KEM>;
-/** Legacy alias for `QSF_ml_kem768_p256`. */
-export declare const QSFMLKEM768P256: TRet<KEM>;
-/** Legacy alias for `QSF_ml_kem1024_p384`. */
-export declare const QSFMLKEM1024P384: TRet<KEM>;
-/** Legacy alias for `KitchenSink_ml_kem768_x25519`. */
-export declare const KitchenSinkMLKEM768X25519: TRet<KEM>;
 export {};
-//# sourceMappingURL=hybrid.d.ts.map

package/hybrid.js

@@ -79,15 +79,38 @@ import {} from '@noble/curves/abstract/montgomery.js';
 import {} from '@noble/curves/abstract/weierstrass.js';
 import { x25519 } from '@noble/curves/ed25519.js';
 import { p256, p384 } from '@noble/curves/nist.js';
-import { asciiToBytes, bytesToNumberBE, bytesToNumberLE, concatBytes, numberToBytesBE, } from '@noble/curves/utils.js';
+import { abool, afunction, asciiToBytes, bytesToNumberBE, bytesToNumberLE, concatBytes, numberToBytesBE, } from '@noble/curves/utils.js';
 import { expand, extract } from '@noble/hashes/hkdf.js';
 import { sha256 } from '@noble/hashes/sha2.js';
 import { sha3_256, shake256 } from '@noble/hashes/sha3.js';
 import { abytes, ahash, anumber } from '@noble/hashes/utils.js';
 import { ml_kem1024, ml_kem768 } from "./ml-kem.js";
-import { cleanBytes, copyBytes, randomBytes, splitCoder, validateSigOpts, validateVerOpts, } from "./utils.js";
+import { aobject, astring, cleanBytes, copyBytes, randomBytes, splitCoder, validateSigOpts, validateVerOpts, } from "./utils.js";
+const validateKEM = (kem, title) => {
+    const k = aobject(kem, title);
+    aobject(k.lengths, `${title}.lengths`);
+    afunction(k.keygen, `${title}.keygen`);
+    afunction(k.getPublicKey, `${title}.getPublicKey`);
+    afunction(k.encapsulate, `${title}.encapsulate`);
+    afunction(k.decapsulate, `${title}.decapsulate`);
+    return k;
+};
+const validateSigner = (signer, title) => {
+    const s = aobject(signer, title);
+    aobject(s.lengths, `${title}.lengths`);
+    afunction(s.keygen, `${title}.keygen`);
+    afunction(s.getPublicKey, `${title}.getPublicKey`);
+    afunction(s.sign, `${title}.sign`);
+    afunction(s.verify, `${title}.verify`);
+    return s;
+};
 // Can re-use if decide to signatures support, on other hand getSecretKey is specific and ugly
 function ecKeygen(curve, allowZeroKey = false) {
+    const c = aobject(curve, 'curve');
+    aobject(c.lengths, 'curve.lengths');
+    afunction(c.keygen, 'curve.keygen');
+    afunction(c.getPublicKey, 'curve.getPublicKey');
+    abool(allowZeroKey, 'allowZeroKey');
     const lengths = curve.lengths;
     let keygen = curve.keygen;
     if (allowZeroKey) {
@@ -149,6 +172,11 @@ export function ecdhKem(curve, allowZeroKey = false) {
     const kg = ecKeygen(curve, allowZeroKey);
     if (!curve.getSharedSecret)
         throw new Error('wrong curve'); // ed25519 doesn't have one!
+    // Standalone (not `this.decapsulate`) so encapsulate works even when methods are destructured.
+    const decapsulate = (cipherText, secretKey) => {
+        const res = curve.getSharedSecret(secretKey, cipherText);
+        return (curve.lengths.publicKeyHasPrefix ? res.subarray(1) : res);
+    };
     return {
         lengths: { ...kg.lengths, msg: kg.lengths.seed, cipherText: kg.lengths.publicKey },
         keygen: kg.keygen,
@@ -159,8 +187,8 @@ export function ecdhKem(curve, allowZeroKey = false) {
             const seed = copyBytes(rand);
             let ek = undefined;
             try {
-                ek = this.keygen(seed).secretKey;
-                const sharedSecret = this.decapsulate(publicKey, ek);
+                ek = kg.keygen(seed).secretKey;
+                const sharedSecret = decapsulate(publicKey, ek);
                 const cipherText = curve.getPublicKey(ek);
                 return { sharedSecret, cipherText };
             }
@@ -172,10 +200,7 @@ export function ecdhKem(curve, allowZeroKey = false) {
                     cleanBytes(ek);
             }
         },
-        decapsulate(cipherText, secretKey) {
-            const res = curve.getSharedSecret(secretKey, cipherText);
-            return (curve.lengths.publicKeyHasPrefix ? res.subarray(1) : res);
-        },
+        decapsulate,
     };
 }
 /**
@@ -303,26 +328,43 @@ expandSeed_, ...ck_) {
                 cleanBytes(secretKey);
         }
     }
-    return {
-        info: { lengths: { seed: realSeedLen, publicKey: pkCoder.bytesLen, secretKey: realSeedLen } },
-        getPublicKey(secretKey) {
-            // Composite secret keys are root seeds, so public-key derivation reruns key expansion from
-            // that seed instead of decoding a packed child-secret-key structure.
-            return this.keygen(secretKey).publicKey;
-        },
-        keygen(seed = randomBytes(realSeedLen)) {
-            const { publicKey: pk, secretKey } = expandDecapsulationKey(seed);
+    // Standalone (not a method) so getPublicKey / destructured usage never depends on `this`.
+    const keygen = (seed) => {
+        // Detach the root: the exported secretKey must not alias caller-owned seed bytes, so later
+        // caller mutation of the seed cannot silently change the secret key (and vice versa).
+        const root = seed === undefined ? randomBytes(realSeedLen) : copyBytes(seed);
+        let res;
+        try {
+            const { publicKey: pk, secretKey } = expandDecapsulationKey(root);
             try {
-                const publicKey = pkCoder.encode(pk);
-                return { secretKey: seed, publicKey };
+                res = {
+                    secretKey: root,
+                    publicKey: pkCoder.encode(pk),
+                };
             }
             finally {
-                cleanBytes(pk);
-                // The exported secretKey is the caller/root seed itself; child secret keys are internal
+                // The exported secretKey is the (detached) root seed; child secret keys are internal
                 // expansion outputs that are cleaned whether encoding succeeds or throws.
-                cleanBytes(secretKey);
+                cleanBytes(pk, secretKey);
             }
+            return res;
+        }
+        finally {
+            if (!res)
+                cleanBytes(root);
+        }
+    };
+    return {
+        info: { lengths: { seed: realSeedLen, publicKey: pkCoder.bytesLen, secretKey: realSeedLen } },
+        // Composite secret keys are root seeds, so public-key derivation reruns key expansion from
+        // that seed instead of decoding a packed child-secret-key structure.
+        getPublicKey: (secretKey) => {
+            const keys = keygen(secretKey);
+            // keygen detaches its exported root; getPublicKey discards that half of the result.
+            cleanBytes(keys.secretKey);
+            return keys.publicKey;
         },
+        keygen,
         expandDecapsulationKey,
         realSeedLen,
     };
@@ -356,15 +398,25 @@ expandSeed_, ...ck_) {
 export function combineKEMS(realSeedLen, // how much bytes expandSeed expects
 realMsgLen, // how much bytes combiner returns
 expandSeed, combiner, ...kems) {
+    if (realSeedLen !== undefined)
+        anumber(realSeedLen, 'realSeedLen');
+    if (realMsgLen !== undefined)
+        anumber(realMsgLen, 'realMsgLen');
+    if (typeof expandSeed !== 'function')
+        throw new TypeError('"expandSeed" expected function, got type=' + typeof expandSeed);
+    if (typeof combiner !== 'function')
+        throw new TypeError('"combiner" expected function, got type=' + typeof combiner);
     const rawCombiner = combiner;
     const rawKems = kems;
+    for (let i = 0; i < rawKems.length; i++)
+        validateKEM(rawKems[i], `kems[${i}]`);
     const keys = combineKeys(realSeedLen, expandSeed, ...rawKems);
     const ctCoder = splitLengths(rawKems, 'cipherText');
     const pkCoder = splitLengths(rawKems, 'publicKey');
     const msgCoder = splitLengths(rawKems, 'msg');
     if (realMsgLen === undefined)
         realMsgLen = msgCoder.bytesLen;
-    anumber(realMsgLen);
+    anumber(realMsgLen, 'realMsgLen');
     const lengths = Object.freeze({
         ...keys.info.lengths,
         msg: realMsgLen,
@@ -431,11 +483,21 @@ expandSeed, combiner, ...kems) {
  * import { combineSigners, expandSeedXof } from '@noble/post-quantum/hybrid.js';
  * import { ml_dsa44 } from '@noble/post-quantum/ml-dsa.js';
  * const hybrid = combineSigners(32, expandSeedXof(shake256), ml_dsa44, ml_dsa44);
- * const { publicKey } = hybrid.keygen();
+ * const seed = new Uint8Array(hybrid.lengths.seed!).fill(1);
+ * const { secretKey, publicKey } = hybrid.keygen(seed);
+ * const msg = new TextEncoder().encode('hello noble');
+ * const sig = hybrid.sign(msg, secretKey);
+ * const isValid = hybrid.verify(sig, msg, publicKey);
  * ```
  */
 export function combineSigners(realSeedLen, expandSeed, ...signers) {
+    if (realSeedLen !== undefined)
+        anumber(realSeedLen, 'realSeedLen');
+    if (typeof expandSeed !== 'function')
+        throw new TypeError('"expandSeed" expected function, got type=' + typeof expandSeed);
     const rawSigners = signers;
+    for (let i = 0; i < rawSigners.length; i++)
+        validateSigner(rawSigners[i], `signers[${i}]`);
     const keys = combineKeys(realSeedLen, expandSeed, ...rawSigners);
     const sigCoder = splitLengths(rawSigners, 'signature');
     const pkCoder = splitLengths(rawSigners, 'publicKey');
@@ -464,14 +526,21 @@ export function combineSigners(realSeedLen, expandSeed, ...signers) {
             }
         },
         /** Verify one combined signature.
-         * Returns `false` when the aggregate signature/publicKey decode succeeds but any child verify
-         * check fails. Throws on unsupported generic opts or malformed aggregate encodings.
+         * Wrong-length aggregate signatures return `false` (matching ml-dsa / slh-dsa behavior), as
+         * does any failing child verify. Throws on unsupported generic opts or malformed publicKey.
          */
         verify: (signature, message, publicKey, opts = {}) => {
             validateVerOpts(opts);
             if (opts.context !== undefined)
                 throw new Error('combineSigners does not support context; use the underlying signer directly');
+            // Malformed signature *length* is a verification failure, not a thrown type error —
+            // consistent with ml-dsa / slh-dsa. Must run before sigCoder.decode, which throws.
+            // Preserve TypeError for non-byte API arguments before treating byte lengths as invalid.
+            abytes(signature, undefined, 'signature');
+            // A signature failure must not hide malformed aggregate public-key bytes.
             const pks = pkCoder.decode(publicKey);
+            if (signature.length !== sigCoder.bytesLen)
+                return false;
             const sigs = sigCoder.decode(signature);
             for (let i = 0; i < rawSigners.length; i++) {
                 if (!rawSigners[i].verify(sigs[i], message, pks[i]))
@@ -506,7 +575,14 @@ export function combineSigners(realSeedLen, expandSeed, ...signers) {
  * ```
  */
 export function QSF(label, pqc, curveKEM, xof, kdf) {
+    astring(label, 'label');
+    validateKEM(pqc, 'pqc');
+    validateKEM(curveKEM, 'curveKEM');
+    if (typeof xof !== 'function' || typeof xof.create !== 'function')
+        throw new TypeError('"xof" expected hash function, got type=' + typeof xof);
     ahash(xof);
+    if (typeof kdf !== 'function' || typeof kdf.create !== 'function')
+        throw new TypeError('"kdf" expected hash function, got type=' + typeof kdf);
     ahash(kdf);
     return combineKEMS(32, kdf.outputLen, expandSeedXof(xof), (pk, ct, ss) => kdf(concatBytes(ss[0], ss[1], ct[1], pk[1], asciiToBytes(label))), pqc, curveKEM);
 }
@@ -541,7 +617,14 @@ export const QSF_ml_kem1024_p384 = /* @__PURE__ */ (() => QSF('QSF-KEM(ML-KEM-10
  * ```
  */
 export function createKitchenSink(label, pqc, curveKEM, xof, hash) {
+    astring(label, 'label');
+    validateKEM(pqc, 'pqc');
+    validateKEM(curveKEM, 'curveKEM');
+    if (typeof xof !== 'function' || typeof xof.create !== 'function')
+        throw new TypeError('"xof" expected hash function, got type=' + typeof xof);
     ahash(xof);
+    if (typeof hash !== 'function' || typeof hash.create !== 'function')
+        throw new TypeError('"hash" expected hash function, got type=' + typeof hash);
     ahash(hash);
     return combineKEMS(32, 32, expandSeedXof(xof), (pk, ct, ss) => {
         const preimage = concatBytes(ss[0], ss[1], ct[0], pk[0], ct[1], pk[1], asciiToBytes(label));
@@ -596,6 +679,11 @@ function nistCurveKem(curve, scalarLen, elemLen, nseed) {
         const publicKey = curve.getPublicKey(secretKey, false);
         return { secretKey, publicKey };
     }
+    // Standalone (not `this.decapsulate`) so encapsulate works even when methods are destructured.
+    const decapsulate = (cipherText, secretKey) => {
+        const full = curve.getSharedSecret(secretKey, cipherText);
+        return full.subarray(1);
+    };
     return {
         lengths: {
             secretKey: scalarLen,
@@ -616,7 +704,7 @@ function nistCurveKem(curve, scalarLen, elemLen, nseed) {
             let ek = undefined;
             try {
                 ek = rejectionSampling(rand).secretKey;
-                const sharedSecret = this.decapsulate(publicKey, ek);
+                const sharedSecret = decapsulate(publicKey, ek);
                 const cipherText = curve.getPublicKey(ek, false);
                 return { sharedSecret, cipherText };
             }
@@ -627,10 +715,7 @@ function nistCurveKem(curve, scalarLen, elemLen, nseed) {
                     cleanBytes(ek);
             }
         },
-        decapsulate(cipherText, secretKey) {
-            const full = curve.getSharedSecret(secretKey, cipherText);
-            return full.subarray(1);
-        },
+        decapsulate,
     };
 }
 /**
@@ -650,29 +735,14 @@ function concreteHybridKem(label, mlkem, curve, nseed) {
     const totalSeedLen = mlkemSeedLen + nseed;
     return combineKEMS(32, 32, (seed) => {
         abytes(seed, 32);
-        const expanded = shake256(seed, { dkLen: totalSeedLen });
-        const mlkemSeed = expanded.subarray(0, mlkemSeedLen);
-        const curveSeed = expanded.subarray(mlkemSeedLen, totalSeedLen);
-        return concatBytes(mlkemSeed, curveSeed);
+        // One SHAKE256 stream split by the seed coder as mlkemSeed (64) || curveSeed (nseed).
+        // Returned directly: the previous concatBytes of two adjacent subarrays produced an
+        // identical copy while leaving this original buffer unwiped; expandDecapsulationKey
+        // wipes the returned buffer after the child seeds are copied out.
+        return shake256(seed, { dkLen: totalSeedLen });
     }, (pk, ct, ss) => sha3_256(concatBytes(ss[0], ss[1], ct[1], pk[1], asciiToBytes(label))), mlkem, curveKem);
 }
 /** P-256 + ML-KEM-768 hybrid preset. */
 export const ml_kem768_p256 = /* @__PURE__ */ (() => concreteHybridKem('MLKEM768-P256', ml_kem768, p256, 128))();
 /** P-384 + ML-KEM-1024 hybrid preset. */
 export const ml_kem1024_p384 = /* @__PURE__ */ (() => concreteHybridKem('MLKEM1024-P384', ml_kem1024, p384, 48))();
-// Legacy aliases
-/** Legacy alias for `ml_kem768_x25519`. */
-export const XWing = /* @__PURE__ */ (() => ml_kem768_x25519)();
-/** Legacy alias for `ml_kem768_x25519`. */
-export const MLKEM768X25519 = /* @__PURE__ */ (() => ml_kem768_x25519)();
-/** Legacy alias for `ml_kem768_p256`. */
-export const MLKEM768P256 = /* @__PURE__ */ (() => ml_kem768_p256)();
-/** Legacy alias for `ml_kem1024_p384`. */
-export const MLKEM1024P384 = /* @__PURE__ */ (() => ml_kem1024_p384)();
-/** Legacy alias for `QSF_ml_kem768_p256`. */
-export const QSFMLKEM768P256 = /* @__PURE__ */ (() => QSF_ml_kem768_p256)();
-/** Legacy alias for `QSF_ml_kem1024_p384`. */
-export const QSFMLKEM1024P384 = /* @__PURE__ */ (() => QSF_ml_kem1024_p384)();
-/** Legacy alias for `KitchenSink_ml_kem768_x25519`. */
-export const KitchenSinkMLKEM768X25519 = /* @__PURE__ */ (() => KitchenSink_ml_kem768_x25519)();
-//# sourceMappingURL=hybrid.js.map

package/index.d.ts

@@ -1,2 +1 @@
 export {};
-//# sourceMappingURL=index.d.ts.map

package/index.js

@@ -26,4 +26,3 @@ import {
  */
 throw new Error('root module cannot be imported: import submodules instead. Check out README');
 export {};
-//# sourceMappingURL=index.js.map