@noble/post-quantum 0.6.1 → 0.7.0

package/slh-dsa.js

@@ -28,9 +28,10 @@
  */
 /*! noble-post-quantum - MIT License (c) 2024 Paul Miller (paulmillr.com) */
 import { hmac } from '@noble/hashes/hmac.js';
+import { bytesToNumberBE, numberToBytesBE } from '@noble/curves/utils.js';
 import { sha256, sha512 } from '@noble/hashes/sha2.js';
 import { shake256 } from '@noble/hashes/sha3.js';
-import { bytesToHex, concatBytes, createView, hexToBytes, } from '@noble/hashes/utils.js';
+import { concatBytes, createView } from '@noble/hashes/utils.js';
 import { abytes, checkHash, cleanBytes, copyBytes, equalBytes, getMask, getMessage, getMessagePrehash, randomBytes, splitCoder, validateSigOpts, validateVerOpts, vecCoder, } from "./utils.js";
 /** Winternitz signature params. */
 /**
@@ -61,19 +62,6 @@ const AddressType = {
     WOTSPRF: 5,
     FORSPRF: 6,
 };
-function hexToNumber(hex) {
-    if (typeof hex !== 'string')
-        throw new Error('hex string expected, got ' + typeof hex);
-    return BigInt(hex === '' ? '0' : '0x' + hex); // Big Endian
-}
-// BE: Big Endian, LE: Little Endian. This is the local FIPS 205 `toInt(...)` equivalent.
-function bytesToNumberBE(bytes) {
-    return hexToNumber(bytesToHex(bytes));
-}
-// Local in-range FIPS 205 `toByte(x, n)` equivalent; callers must keep `n < 256^len`.
-function numberToBytesBE(n, len) {
-    return hexToBytes(n.toString(16).padStart(len * 2, '0'));
-}
 // Local FIPS 205 Algorithm 4 `base_2^b(...)` implementation. Bits are consumed in big-endian
 // order within each input byte, and callers must provide at least `ceil(outLen * b / 8)` bytes;
 // short inputs are not rejected and would zero-extend implicitly.
@@ -92,8 +80,11 @@ const base2b = (outLen, b) => {
         return baseB;
     };
 };
+const _1n = /* @__PURE__ */ BigInt(1);
+const _8n = /* @__PURE__ */ BigInt(8);
+const _0xffn = /* @__PURE__ */ BigInt(0xff);
 function getMaskBig(bits) {
-    return (1n << BigInt(bits)) - 1n; // 4 -> 0b1111
+    return (_1n << BigInt(bits)) - _1n; // 4 -> 0b1111
 }
 /** One parameter/hash instantiation of the public SLH-DSA API.
  * `keygen(seed)` is a deterministic 3N-byte library hook around the internal keygen flow,
@@ -139,7 +130,6 @@ function gen(opts, hashOpts_) {
     const setAddr = (opts, addr = new Uint8Array(ADDR_BYTES)) => {
         const { type, height, tree, layer, index, chain, hash, keypair } = opts;
         const { subtreeAddr, keypairAddr } = opts;
-        const v = createView(addr);
         if (height !== undefined)
             addr[OFFSET_CHAIN_ADDR] = height;
         if (layer !== undefined)
@@ -150,12 +140,21 @@ function gen(opts, hashOpts_) {
             addr[OFFSET_CHAIN_ADDR] = chain;
         if (hash !== undefined)
             addr[OFFSET_HASH_ADDR] = hash;
-        if (index !== undefined)
-            v.setUint32(OFFSET_TREE_INDEX, index, false);
+        // Manual big-endian writes: setAddr runs in the innermost WOTS/tree loops, and creating a
+        // DataView per call was a measurable share of sign() time.
+        if (index !== undefined) {
+            addr[OFFSET_TREE_INDEX + 0] = index >>> 24;
+            addr[OFFSET_TREE_INDEX + 1] = index >>> 16;
+            addr[OFFSET_TREE_INDEX + 2] = index >>> 8;
+            addr[OFFSET_TREE_INDEX + 3] = index;
+        }
         if (subtreeAddr)
             addr.set(subtreeAddr.subarray(0, OFFSET_TREE + 8));
-        if (tree !== undefined)
-            v.setBigUint64(OFFSET_TREE, tree, false);
+        if (tree !== undefined) {
+            let t = tree;
+            for (let i = 7; i >= 0; i--, t >>= _8n)
+                addr[OFFSET_TREE + i] = Number(t & _0xffn);
+        }
         if (keypair !== undefined) {
             addr[OFFSET_KP_ADDR1] = keypair;
             if (TREE_HEIGHT > 8)
@@ -209,10 +208,12 @@ function gen(opts, hashOpts_) {
         const maxIdx = (1 << height) - 1;
         const stack = new Uint8Array(height * N);
         const authPath = new Uint8Array(height * N);
+        // One node buffer per treehash call (not per leaf): both halves are fully overwritten at
+        // each use, and the returned root aliases cur1, which is never reused after return.
+        const current = new Uint8Array(2 * N);
+        const cur0 = current.subarray(0, N);
+        const cur1 = current.subarray(N);
         for (let idx = 0;; idx++) {
-            const current = new Uint8Array(2 * N);
-            const cur0 = current.subarray(0, N);
-            const cur1 = current.subarray(N);
             const addrOffset = idx + idxOffset;
             cur1.set(leafFn(leafIdx, addrOffset, rawContext, info));
             let h = 0;
@@ -394,7 +395,9 @@ function gen(opts, hashOpts_) {
                     height: 0,
                     index: indices[i] + idxOffset,
                 }, forsTreeAddr);
-                const prf = context.PRFaddr(forsTreeAddr);
+                // Copy: PRFaddr returns a per-context scratch view, and this value is retained in
+                // `fors` across the many PRFaddr calls inside forsTreehash below.
+                const prf = copyBytes(context.PRFaddr(forsTreeAddr));
                 setAddr({ type: AddressType.FORSTREE }, forsTreeAddr);
                 const { root, authPath } = forsTreehash(context, indices[i], idxOffset, forsTreeAddr, forsLeaf);
                 roots.push(root);
@@ -404,7 +407,9 @@ function gen(opts, hashOpts_) {
                 type: AddressType.FORSPK,
                 keypairAddr: wotsAddr,
             });
-            const root = context.thashN(K, concatBytes(...roots), forsPkAddr);
+            // Copy: thashN returns a per-context scratch view, and `root` lives across every hash
+            // call in the hypertree loop below (it is also mutated via root.set).
+            const root = copyBytes(context.thashN(K, concatBytes(...roots), forsPkAddr));
             // WOTS signatures
             const treeAddr = setAddr({ type: AddressType.HASHTREE });
             const wots = [];
@@ -424,10 +429,14 @@ function gen(opts, hashOpts_) {
         },
         verify: (sig, msg, publicKey) => {
             const [pkSeed, pubRoot] = publicCoder.decode(publicKey);
-            const [random, forsVec, wotsVec] = sigCoder.decode(sig);
             const pk = publicKey;
+            // FIPS 205 Algorithm 20 step 1: wrong-length signatures return false instead of throwing
+            // (same as ml-dsa). Must run before sigCoder.decode, which throws on length mismatch.
+            // Preserve TypeError for non-byte API arguments before treating byte lengths as invalid.
+            abytes(sig, undefined, 'signature');
             if (sig.length !== sigCoder.bytesLen)
                 return false;
+            const [random, forsVec, wotsVec] = sigCoder.decode(sig);
             const context = getContext(pkSeed);
             let { tree, leafIdx, md } = hashMessage(random, pk, msg, context);
             const wotsAddr = setAddr({
@@ -447,14 +456,16 @@ function gen(opts, hashOpts_) {
                 const idxOffset = i << A;
                 setAddr({ height: 0, index: indices[i] + idxOffset }, forsTreeAddr);
                 const leaf = context.thash1(prf, forsTreeAddr);
-                // Compute inplace, because we need all roots in same byte array
-                roots.push(computeRoot(leaf, indices[i], idxOffset, authPath, A, context, forsTreeAddr));
+                // Copy: computeRoot returns a thashN scratch view, and roots are retained across the
+                // remaining FORS iterations (computeRoot itself copies `leaf` before hashing).
+                roots.push(copyBytes(computeRoot(leaf, indices[i], idxOffset, authPath, A, context, forsTreeAddr)));
             }
             const forsPkAddr = setAddr({
                 type: AddressType.FORSPK,
                 keypairAddr: wotsAddr,
             });
-            let root = context.thashN(K, concatBytes(...roots), forsPkAddr); // root = thash()
+            // Copy: `root` must survive the thash1/thashN calls of the WOTS chain loop below.
+            let root = copyBytes(context.thashN(K, concatBytes(...roots), forsPkAddr)); // root = thash()
             // WOTS signature
             const treeAddr = setAddr({ type: AddressType.HASHTREE });
             const wotsPkAddr = setAddr({ type: AddressType.WOTSPK });
@@ -477,7 +488,8 @@ function gen(opts, hashOpts_) {
                     }
                 }
                 const leaf = context.thashN(WOTS_LEN, wotsPk, wotsPkAddr);
-                root = computeRoot(leaf, leafIdx, 0, sigAuth, TREE_HEIGHT, context, treeAddr);
+                // Copy: `root` is read by chainLengths / equalBytes after later hash calls.
+                root = copyBytes(computeRoot(leaf, leafIdx, 0, sigAuth, TREE_HEIGHT, context, treeAddr));
                 leafIdx = Number(tree & getMaskBig(TREE_HEIGHT));
             }
             return equalBytes(root, pubRoot);
@@ -533,21 +545,26 @@ const genShake = () => (opts) => (pubSeed, skSeed) => {
     // for each address-bound call instead of reabsorbing the same seed every time.
     const h0 = shake256.create({}).update(pubSeed);
     const h0tmp = h0.clone();
+    // Per-context output scratch: thash1/thashN/PRFaddr return these buffers directly, so
+    // callers must consume or copy a result before the next call on the same lane.
+    const thashOut = new Uint8Array(N);
+    const prfOut = new Uint8Array(N);
     const thash = (blocks, input, addr) => {
         stats.thash++;
-        return h0
-            ._cloneInto(h0tmp)
+        const len = blocks * N;
+        h0._cloneInto(h0tmp)
             .update(addr)
-            .update(input.subarray(0, blocks * N))
-            .xof(N);
+            .update(input.length === len ? input : input.subarray(0, len))
+            .xofInto(thashOut);
+        return thashOut;
     };
     return {
         PRFaddr: (addr) => {
             if (!skSeed)
                 throw new Error('no sk seed');
             stats.prf++;
-            const res = h0._cloneInto(h0tmp).update(addr).update(skSeed).xof(N);
-            return res;
+            h0._cloneInto(h0tmp).update(addr).update(skSeed).xofInto(prfOut);
+            return prfOut;
         },
         PRFmsg: (skPRF, random, msg) => {
             stats.gen_message_random++;
@@ -568,6 +585,7 @@ const genShake = () => (opts) => (pubSeed, skSeed) => {
         clean: () => {
             h0.destroy();
             h0tmp.destroy();
+            cleanBytes(thashOut, prfOut);
             //console.log(stats);
         },
     };
@@ -635,6 +653,16 @@ const genSha = (h0, h1) => (opts) => (pub_seed, sk_seed) => {
         .update(new Uint8Array(h1.blockLen - N));
     const h0tmp = h0ps.clone();
     const h1tmp = h1ps.clone();
+    // Per-context output scratch: thash1/thashN/PRFaddr return views into these buffers, so
+    // callers must consume or copy a result before the next call on the same lane (see Context
+    // docs). digestInto also skips digest()'s per-call destroy(): the tmp states are fully
+    // overwritten by the next _cloneInto and wiped in clean().
+    const h0out = new Uint8Array(h0.outputLen);
+    const h1out = new Uint8Array(h1.outputLen);
+    const prfOut = new Uint8Array(h0.outputLen);
+    const h0outN = h0out.subarray(0, N);
+    const h1outN = h1out.subarray(0, N);
+    const prfOutN = prfOut.subarray(0, N);
     // https://www.rfc-editor.org/rfc/rfc8017.html#appendix-B.2.1
     // This local helper is intentionally stricter than generic MGF1 reuse: current SLH-DSA callers
     // only request tiny `m`-byte outputs, but the guard below rejects `length > 2^32` instead of
@@ -653,27 +681,26 @@ const genSha = (h0, h1) => (opts) => (pub_seed, sk_seed) => {
         cleanBytes(out.subarray(length));
         return out.subarray(0, length);
     }
-    const thash = (_, h, hTmp) => (blocks, input, addr) => {
+    const thash = (h, hTmp, out, outN) => (blocks, input, addr) => {
         stats.thash++;
-        const d = h
-            ._cloneInto(hTmp)
+        const len = blocks * N;
+        h._cloneInto(hTmp)
             .update(addr)
-            .update(input.subarray(0, blocks * N))
-            .digest();
-        return d.subarray(0, N);
+            .update(input.length === len ? input : input.subarray(0, len))
+            .digestInto(out);
+        return outN;
     };
     return {
         PRFaddr: (addr) => {
             if (!sk_seed)
                 throw new Error('No sk seed');
             stats.prf++;
-            const res = h0ps
+            h0ps
                 ._cloneInto(h0tmp)
                 .update(addr)
                 .update(sk_seed)
-                .digest()
-                .subarray(0, N);
-            return res;
+                .digestInto(prfOut);
+            return prfOutN;
         },
         PRFmsg: (skPRF, random, msg) => {
             stats.gen_message_random++;
@@ -689,13 +716,14 @@ const genSha = (h0, h1) => (opts) => (pub_seed, sk_seed) => {
             const seed = concatBytes(R.subarray(0, N), pk.subarray(0, N), h1.create().update(R.subarray(0, N)).update(pk).update(m).digest());
             return mgf1(seed, outLen, h1);
         },
-        thash1: thash(h0, h0ps, h0tmp).bind(null, 1),
-        thashN: thash(h1, h1ps, h1tmp),
+        thash1: thash(h0ps, h0tmp, h0out, h0outN).bind(null, 1),
+        thashN: thash(h1ps, h1tmp, h1out, h1outN),
         clean: () => {
             h0ps.destroy();
             h1ps.destroy();
             h0tmp.destroy();
             h1tmp.destroy();
+            cleanBytes(h0out, h1out, prfOut);
             //console.log(stats);
         },
     };
@@ -712,6 +740,23 @@ const SHA512_SIMPLE = /* @__PURE__ */ (() => ({
  * SLH-DSA-SHA2-128f: Table 2 row `n=16, h=66, d=22, h'=3, a=6, k=33, lg w=4, m=34`;
  * lengths `publicKey=32`, `secretKey=64`, `signature=17088`, `seed=48`, `signRand=16`.
  * Also exposes `.prehash(...)`.
+ * @example
+ * Generate deterministic SLH-DSA keys, sign one message, and verify the signature.
+ * ```ts
+ * import { sha256 } from '@noble/hashes/sha2.js';
+ * import { slh_dsa_sha2_128f } from '@noble/post-quantum/slh-dsa.js';
+ * const seed = new Uint8Array(slh_dsa_sha2_128f.lengths.seed!);
+ * const { secretKey, publicKey } = slh_dsa_sha2_128f.keygen(seed);
+ * const msg = new TextEncoder().encode('hello noble');
+ * const sig = slh_dsa_sha2_128f.sign(msg, secretKey);
+ * const isValid = slh_dsa_sha2_128f.verify(sig, msg, publicKey);
+ * const recovered = slh_dsa_sha2_128f.getPublicKey(secretKey);
+ * const context = new Uint8Array([1, 2, 3]);
+ * const prehash = slh_dsa_sha2_128f.prehash(sha256);
+ * const preSig = prehash.sign(msg, secretKey, { context });
+ * const preValid = prehash.verify(preSig, msg, publicKey, { context });
+ * const internalSig = slh_dsa_sha2_128f.internal.sign(msg, secretKey);
+ * ```
  */
 export const slh_dsa_sha2_128f = /* @__PURE__ */ (() => gen(PARAMS['128f'], SHA256_SIMPLE))();
 /**
@@ -744,4 +789,3 @@ export const slh_dsa_sha2_256f = /* @__PURE__ */ (() => gen(PARAMS['256f'], SHA5
  * Also exposes `.prehash(...)`.
  */
 export const slh_dsa_sha2_256s = /* @__PURE__ */ (() => gen(PARAMS['256s'], SHA512_SIMPLE))();
-//# sourceMappingURL=slh-dsa.js.map

package/src/_crystals.ts

@@ -73,9 +73,15 @@ type Crystals<T extends TypedArray> = {
   smod: (a: number, modulo?: number) => number;
   nttZetas: T;
   NTT: {
-    /** Forward transform in place. Mutates and returns `r`. */
+    /**
+     * Forward transform in place. Mutates and returns `r`.
+     * Kyber-mode input coefficients must already use canonical representatives in `[0, Q)`.
+     */
     encode: (r: T) => T;
-    /** Inverse transform in place. Mutates and returns `r`. */
+    /**
+     * Inverse transform in place. Mutates and returns `r`.
+     * Kyber-mode input coefficients must already use canonical representatives in `[0, Q)`.
+     */
     decode: (r: T) => T;
   };
   bitsCoder: (d: number, c: Coder<number, number>) => BytesCoderLen<T>;
@@ -135,14 +141,34 @@ export const genCrystals = <T extends TypedArray>(opts: CrystalOpts<T>): TRet<Cr
   // Kyber has slightly different params, since there is no 512th primitive root of unity mod q,
   // only 256th primitive root of unity mod. Which also complicates MultiplyNTT.
 
-  const field = {
-    add: (a: number, b: number) => mod((a | 0) + (b | 0)) | 0,
-    sub: (a: number, b: number) => mod((a | 0) - (b | 0)) | 0,
-    mul: (a: number, b: number) => mod((a | 0) * (b | 0)) | 0,
-    inv: (_a: number) => {
-      throw new Error('not implemented');
-    },
+  const inv = (_a: number) => {
+    throw new Error('not implemented');
   };
+  // ML-KEM (Kyber) polynomials always enter the transform reduced to [0, Q), so add/sub only
+  // need one conditional correction instead of `%`; measured ~20% faster NTT there.
+  // ML-DSA keeps the generic mod() path on purpose: its first forward stage sees centered
+  // (negative) coefficients, and `sub(a, t)` can drop below -Q (t is a mul output in [0, Q)),
+  // so a single correction is not enough. A guarded fast path with mod() fallback was measured
+  // slower than plain `%` for the 23-bit Q (V8 int32 modulo is one div; the branches lose).
+  const field = isKyber
+    ? {
+        add: (a: number, b: number) => {
+          const r = (a + b) | 0;
+          return r >= Q ? (r - Q) | 0 : r;
+        },
+        sub: (a: number, b: number) => {
+          const r = (a - b) | 0;
+          return r < 0 ? (r + Q) | 0 : r;
+        },
+        mul: (a: number, b: number) => mod((a | 0) * (b | 0)) | 0,
+        inv,
+      }
+    : {
+        add: (a: number, b: number) => mod((a | 0) + (b | 0)) | 0,
+        sub: (a: number, b: number) => mod((a | 0) - (b | 0)) | 0,
+        mul: (a: number, b: number) => mod((a | 0) * (b | 0)) | 0,
+        inv,
+      };
   const nttOpts = {
     N,
     roots: nttZetas as any,
@@ -168,6 +194,12 @@ export const genCrystals = <T extends TypedArray>(opts: CrystalOpts<T>): TRet<Cr
   // Pack one little-endian `d`-bit word per coefficient, matching FIPS 203 ByteEncode /
   // ByteDecode and the FIPS 204 BitsToBytes-based polynomial packing helpers.
   const bitsCoder = (d: number, c: Coder<number, number>): TRet<BytesCoderLen<T>> => {
+    // Validate the carry shape once: JS bitwise operations silently truncate wider accumulators.
+    for (let i = 0, bufLen = 0; i < N; i++) {
+      bufLen += d;
+      if (bufLen > 32) getMask(bufLen);
+      bufLen %= 8;
+    }
     const mask = getMask(d);
     const bytesLen = d * (N / 8);
     return {
@@ -178,7 +210,9 @@ export const genCrystals = <T extends TypedArray>(opts: CrystalOpts<T>): TRet<Cr
         for (let i = 0, buf = 0, bufLen = 0, pos = 0; i < poly.length; i++) {
           buf |= (c.encode(poly[i]) & mask) << bufLen;
           bufLen += d;
-          for (; bufLen >= 8; bufLen -= 8, buf >>= 8) r[pos++] = buf & getMask(bufLen);
+          // Take the low byte directly: `& 0xff` matches the previous getMask(bufLen) result
+          // after Uint8Array truncation, without a validated function call per output byte.
+          for (; bufLen >= 8; bufLen -= 8, buf >>= 8) r[pos++] = buf & 0xff;
         }
         return r as TRet<Uint8Array>;
       },

package/src/falcon.ts

@@ -443,6 +443,17 @@ const Q: number = 12289; // 12 * 1024 + 1
 // Falcon's midpoint floor(q/2); the only live use is the mirrored G-reconstruction reduction below.
 const Qhalf: number = Q >> 1;
 const QBig = BigInt(Q);
+const _0n = /* @__PURE__ */ BigInt(0);
+const _1n = /* @__PURE__ */ BigInt(1);
+const _10n = /* @__PURE__ */ BigInt(10);
+const _25n = /* @__PURE__ */ BigInt(25);
+const _31n = /* @__PURE__ */ BigInt(31);
+const _32n = /* @__PURE__ */ BigInt(32);
+const _63n = /* @__PURE__ */ BigInt(63);
+const _64n = /* @__PURE__ */ BigInt(64);
+// Low 32 bits and low 63 bits of a bigint, used by the chacha20 counter and gaussian sampler.
+const MASK_32n = /* @__PURE__ */ BigInt('0xffffffff');
+const MASK_63n = /* @__PURE__ */ BigInt('0x7fffffffffffffff');
 //const R = 4091; // 2^16 mod q
 // This 16-bit Montgomery kernel uses R = 2^16, so mul(x, R2) converts x into Montgomery form.
 const R2 = 10952; // 2^32 mod q
@@ -479,35 +490,35 @@ const BITLENGTH = [
 // Smaller Falcon dimensions reuse the N = 1024, q = 12289 table by summing 2^(10-logn) draws.
 // The trailing 0 sentinel guarantees gaussSingle()
 // always selects a tail bucket when x = 0 is missed.
-const gauss_1024_12289 = [
-  1283868770400643928n,
-  6416574995475331444n,
-  4078260278032692663n,
-  2353523259288686585n,
-  1227179971273316331n,
-  575931623374121527n,
-  242543240509105209n,
-  91437049221049666n,
-  30799446349977173n,
-  9255276791179340n,
-  2478152334826140n,
-  590642893610164n,
-  125206034929641n,
-  23590435911403n,
-  3948334035941n,
-  586753615614n,
-  77391054539n,
-  9056793210n,
-  940121950n,
-  86539696n,
-  7062824n,
-  510971n,
-  32764n,
-  1862n,
-  94n,
-  4n,
-  0n,
-];
+const gauss_1024_12289 = /* @__PURE__ */ [
+  '1283868770400643928',
+  '6416574995475331444',
+  '4078260278032692663',
+  '2353523259288686585',
+  '1227179971273316331',
+  '575931623374121527',
+  '242543240509105209',
+  '91437049221049666',
+  '30799446349977173',
+  '9255276791179340',
+  '2478152334826140',
+  '590642893610164',
+  '125206034929641',
+  '23590435911403',
+  '3948334035941',
+  '586753615614',
+  '77391054539',
+  '9056793210',
+  '940121950',
+  '86539696',
+  '7062824',
+  '510971',
+  '32764',
+  '1862',
+  '94',
+  '4',
+  '0',
+].map(BigInt);
 
 // Exact binary64 1/sigma payloads from round-3 fpr.h. Nearby decimal spellings round 1 ULP low in
 // JS, so keep these as decoded bit patterns and recheck the raw payloads after edits.
@@ -1248,9 +1259,9 @@ function genFalcon(opts: FalconOpts): TRet<Falcon> {
       let val = 0;
       for (let i = 0; i < g; i++) {
         const r128 = bytesToNumberLE(this.shake.xof(16));
-        const r1 = r128 & 0x7fffffffffffffffn;
-        const r2 = (r128 >> 64n) & 0x7fffffffffffffffn;
-        const sign = Number((r128 >> 63n) & 1n);
+        const r1 = r128 & MASK_63n;
+        const r2 = (r128 >> _64n) & MASK_63n;
+        const sign = Number((r128 >> _63n) & _1n);
         let f = r1 < gauss_1024_12289[0] ? 1 : 0;
         let v = 0;
         for (let k = 1; k < gauss_1024_12289.length; k++) {
@@ -1283,13 +1294,13 @@ function genFalcon(opts: FalconOpts): TRet<Falcon> {
       const n = 1 << logn;
       const d = new Array(n >> 1);
       for (let k = 0; k < n; k += 2) {
-        let s: bigint = 0n;
+        let s: bigint = _0n;
         for (let i = 0; i <= k; i += 2) s += a[i] * a[k - i];
         for (let i = k + 2; i < n; i += 2) s -= a[i] * a[k + n - i];
         d[k >>> 1] = s;
       }
       for (let k = 0; k < n; k += 2) {
-        let s: bigint = 0n;
+        let s: bigint = _0n;
         for (let i = 1; i < k; i += 2) s += a[i] * a[k - i];
         for (let i = k + 1; i < n; i += 2) s -= a[i] * a[k + n - i];
         d[k >>> 1] -= s;
@@ -1299,7 +1310,7 @@ function genFalcon(opts: FalconOpts): TRet<Falcon> {
     private mulConjD(logn: number, d: BPoly, a: BPoly, b: BPoly): BPoly {
       const n = 1 << logn;
       for (let k = 0; k < n; k++) {
-        let s: bigint = 0n;
+        let s: bigint = _0n;
         for (let i = 0; i <= k; i += 2) s += b[i >>> 1] * a[k - i];
         for (let i = k + 2 - (k & 1); i < n; i += 2) s -= b[i >>> 1] * a[k + n - i];
         if ((k & 1) === 0) d[k] = s;
@@ -1310,7 +1321,7 @@ function genFalcon(opts: FalconOpts): TRet<Falcon> {
     private subMul(logn: number, a: BPoly, b: BPoly, c: BPoly, e: bigint): BPoly {
       const n = 1 << logn;
       for (let k = 0; k < n; k++) {
-        let s: bigint = 0n;
+        let s: bigint = _0n;
         for (let i = 0; i <= k; i++) s += b[i] * c[k - i];
         for (let i = k + 1; i < n; i++) s -= b[i] * c[k + n - i];
         a[k] -= s << e;
@@ -1353,7 +1364,7 @@ function genFalcon(opts: FalconOpts): TRet<Falcon> {
       const Gx = new Float64Array(n);
       const k = new Array(n);
       while (true) {
-        let scaleFG = 31n * (FGlen - 10n);
+        let scaleFG = _31n * (FGlen - _10n);
         for (let i = 0; i < n; i++) {
           Fx[i] = Number(F[i] >> scaleFG);
           Gx[i] = Number(G[i] >> scaleFG);
@@ -1373,12 +1384,12 @@ function genFalcon(opts: FalconOpts): TRet<Falcon> {
         }
         F = this.subMul(logn, F, f, k, scaleK); // 3:     F ← F - kf
         G = this.subMul(logn, G, g, k, scaleK); // 4:     G ← G - kg
-        const maxfgNew = scaleK + BigInt(Math.round(fgMaxBits)) + 10n;
+        const maxfgNew = scaleK + BigInt(Math.round(fgMaxBits)) + _10n;
         if (maxfgNew < maxFGBits) maxFGBits = maxfgNew;
-        if (FGlen > 1n && FGlen * 31n >= maxFGBits + 31n) FGlen--;
-        if (scaleK <= 0n) break;
-        scaleK -= 25n;
-        if (scaleK < 0n) scaleK = 0n;
+        if (FGlen > _1n && FGlen * _31n >= maxFGBits + _31n) FGlen--;
+        if (scaleK <= _0n) break;
+        scaleK -= _25n;
+        if (scaleK < _0n) scaleK = _0n;
       }
       return true;
     }
@@ -1406,10 +1417,10 @@ function genFalcon(opts: FalconOpts): TRet<Falcon> {
         const xf = f[0];
         const xg = g[0];
         // We can rely on 'invert' to throw if they are not coprime.
-        if (xf <= 0n || xg <= 0n) return false;
+        if (xf <= _0n || xg <= _0n) return false;
         try {
           const u1 = invert(xf, xg); //  if gcd(f, g) ≠ 1 then
-          const v1 = (1n - u1 * xf) / xg;
+          const v1 = (_1n - u1 * xf) / xg;
           F[0] = -v1 * QBig; // 5:     (F, G) ← (vq, uq)
           G[0] = u1 * QBig;
           return true;
@@ -1672,7 +1683,13 @@ function genFalcon(opts: FalconOpts): TRet<Falcon> {
         ).encode([nonce, pad(sigLen).encode(s2), msg]);
       },
       decode(data: TArg<Uint8Array>): TRet<SignatureRaw> {
+        // Keep API misuse on the coder's TypeError path before reading the container length.
+        abytes(data, undefined, 'signature');
+        // The compressed-signature field is fixed-width here; only the message is variable. A
+        // container shorter than the fixed part would make the s2 field borrow bytes from nowhere
+        // and let a truncated encoding open to the same message.
         const msgLen = data.length - NONCELEN - sigLen - 1;
+        if (msgLen < 0) throw new Error('signature coder: wrong length');
         const [nonce, s2, msg] = headerCoder(
           0x30 + logn,
           splitCoder('falcon.signature', NONCELEN, sigLen, msgLen)
@@ -1696,9 +1713,15 @@ function genFalcon(opts: FalconOpts): TRet<Falcon> {
         nonce: Uint8Array;
         s2: Uint8Array;
       }> {
+        // Padded detached signatures are fixed-length (`lengths.signature`), so the payload width
+        // must come from the parameter set, not from the input: deriving it would accept appended
+        // zero bytes and truncated padding as extra valid encodings of the same signature.
+        // Unpadded signatures are variable-length; decodeUnpaddedSig() enforces the exact canonical
+        // bitlength of whatever remains.
+        const payloadLen = opts.padded ? sigLen : data.length - NONCELEN - 1;
         const [nonce, raw] = headerCoder(
           0x30 + logn,
-          splitCoder('falcon.detachedSignature', NONCELEN, data.length - NONCELEN - 1)
+          splitCoder('falcon.detachedSignature', NONCELEN, payloadLen)
         ).decode(data);
         const s2 = decodeSig(raw);
         return { nonce, s2 } as TRet<{ nonce: Uint8Array; s2: Uint8Array }>;
@@ -1785,7 +1808,7 @@ function genFalcon(opts: FalconOpts): TRet<Falcon> {
     private shakeBuf: Uint8Array;
     private ctrView: DataView;
     // ChaCha
-    private ctr: bigint = 0n;
+    private ctr: bigint = _0n;
     private buf: Uint8Array;
     private buf32: Uint32Array;
     private pos: number;
@@ -1835,8 +1858,8 @@ function genFalcon(opts: FalconOpts): TRet<Falcon> {
       const out32 = swap32IfBE(this.buf32);
       for (let i = 0; i < 8; i++, this.ctr++) {
         const n = swap32IfBE(this.nonce32.slice()); // [n0, n1, n2, n3]
-        n[2] ^= Number(this.ctr & 0xffffffffn);
-        n[3] ^= Number(this.ctr >> 32n);
+        n[2] ^= Number(this.ctr & MASK_32n);
+        n[3] ^= Number(this.ctr >> _32n);
         // chacha20() takes raw nonce bytes; on BE the word-normalized temp must be swapped back.
         swap32IfBE(n.subarray(1));
         chacha20(this.key, u8(n.subarray(1)), EMPTY_CHACHA20_BLOCK, this.curBlock, n[0]);
@@ -2181,7 +2204,8 @@ function genFalcon(opts: FalconOpts): TRet<Falcon> {
     //         ▷ Remove 1 byte for the header, and 40 bytes for r
     // 11: while (s = ⊥)
     // 12: return sig = (r, s)
-    abytes(msg);
+    abytes(msg, undefined, 'msg');
+    abytes(sk, secretKeyCoder.bytesLen, 'secretKey');
     // One RNG stream drives both the public 40-byte nonce and the 48-byte sampler seed, so
     // deterministic rnd hooks make signatures deterministic for fixed secretKey/message inputs.
     const nonce = rnd(40);
@@ -2289,6 +2313,8 @@ function genFalcon(opts: FalconOpts): TRet<Falcon> {
   const getRnd = (opts: TArg<FalconSigOpts> = {}): TRet<FalconRandom> => {
     validateSigOpts(opts);
     if (opts.context !== undefined) throw new Error('context is not supported');
+    if (opts.random !== undefined && typeof opts.random !== 'function')
+      throw new TypeError('"opts.random" expected function, got type=' + typeof opts.random);
     if (opts.random !== undefined) return opts.random as TRet<FalconRandom>;
     if (opts.extraEntropy === undefined) return randomBytes;
     const seed = opts.extraEntropy === false ? new Uint8Array(48) : opts.extraEntropy;
@@ -2328,6 +2354,7 @@ function genFalcon(opts: FalconOpts): TRet<Falcon> {
     }>;
   };
   const getPublicKey = (sk: TArg<Uint8Array>): TRet<Uint8Array> => {
+    abytes(sk, secretKeyCoder.bytesLen, 'secretKey');
     const [f, g, F] = secretKeyCoder.decode(sk);
     try {
       const h = computePublic(f, g);
@@ -2358,9 +2385,10 @@ function genFalcon(opts: FalconOpts): TRet<Falcon> {
     verOpts: TArg<VerOpts> = {}
   ) => {
     checkVerOpts(verOpts);
-    abytes(sig);
-    abytes(msg);
-    abytes(pk);
+    abytes(sig, undefined, 'signature');
+    abytes(msg, undefined, 'msg');
+    // Length/canonical public-key failures are decoded below and return false; only type is fatal.
+    abytes(pk, undefined, 'publicKey');
     try {
       const { s2, nonce } = SignatureCoderDetached(logn).decode(sig);
       return verifyRaw(pk, s2, nonce, msg);