@noble/post-quantum 0.6.1 → 0.7.0

package/src/ml-kem.ts

@@ -131,23 +131,33 @@ const polyCoder = (d: number) => (d === 12 ? byteCoder(12) : crystals.bitsCoder(
 // Poly is mod Q, so 12 bits
 type Poly = Uint16Array;
 
+// Coefficients always stay reduced in [0, Q) here (samplers, NTT and coders all reduce),
+// so one conditional correction replaces the generic mod().
 function polyAdd(a_: TArg<Poly>, b_: TArg<Poly>) {
   const a = a_ as Poly;
   const b = b_ as Poly;
   // Mutates `a` in place; callers must pass two N=256 polynomials.
-  for (let i = 0; i < N; i++) a[i] = crystals.mod(a[i] + b[i]); // a += b
+  for (let i = 0; i < N; i++) {
+    const r = a[i] + b[i]; // a += b
+    a[i] = r >= Q ? r - Q : r;
+  }
 }
 function polySub(a_: TArg<Poly>, b_: TArg<Poly>) {
   const a = a_ as Poly;
   const b = b_ as Poly;
   // Mutates `a` in place; callers must pass two N=256 polynomials.
-  for (let i = 0; i < N; i++) a[i] = crystals.mod(a[i] - b[i]); // a -= b
+  for (let i = 0; i < N; i++) {
+    const r = a[i] - b[i]; // a -= b
+    a[i] = r < 0 ? r + Q : r;
+  }
 }
 
 // FIPS-203: Computes the product of two degree-one polynomials with respect to a quadratic modulus
 function BaseCaseMultiply(a0: number, a1: number, b0: number, b1: number, zeta: number) {
   // `zeta` here is Algorithm 11's γ = ζ^(2BitRev_7(i)+1).
-  const c0 = crystals.mod(a1 * b1 * zeta + a0 * b0);
+  // Reduce a1*b1 before multiplying by zeta: a1*b1*zeta would reach ~2^35, forcing JS engines
+  // into slow float fmod; with the extra reduction every intermediate fits int32.
+  const c0 = crystals.mod(crystals.mod(a1 * b1) * zeta + a0 * b0);
   const c1 = crystals.mod(a0 * b1 + a1 * b0);
   return { c0, c1 };
 }
@@ -169,6 +179,33 @@ function MultiplyNTTs(f_: TArg<Poly>, g_: TArg<Poly>): TRet<Poly> {
 
 type PRF = (l: number, key: Uint8Array, nonce: number) => Uint8Array;
 
+/**
+ * Prepared (pre-expanded) ML-KEM public key. Experimental prototype.
+ * Caches only public data: packed ek, the expanded matrix Â, decoded t̂ and H(ek). No secret
+ * material is retained between calls; secret keys passed to `decapsulate` are decoded and wiped
+ * per call, exactly like the one-shot API. `clean()` wipes the expanded Â/t̂ cache; the packed
+ * public key and H(ek) are public and are not wiped. The object must not be used afterwards.
+ */
+export type KEMPrepared = {
+  /**
+   * Detached copy of the source public key. Treat as read-only while the prepared object is in use.
+   * Callers may wipe it after final use; any mutation invalidates subsequent operations.
+   */
+  publicKey: Uint8Array;
+  /** Same as `KEM.encapsulate`, minus per-call ek re-validation and  re-expansion. */
+  encapsulate: (msg?: Uint8Array) => { cipherText: Uint8Array; sharedSecret: Uint8Array };
+  /**
+   * Same as `KEM.decapsulate`; throws if `secretKey` does not embed this public key.
+   * The embedded-ek byte comparison plus stored-hash comparison is equivalent to the
+   * FIPS 203 §7.3 hash input check.
+   */
+  decapsulate: (cipherText: Uint8Array, secretKey: Uint8Array) => Uint8Array;
+  /** Wipe cached (public) data. */
+  clean: () => void;
+};
+/** KEM with prepared-key support. */
+export type MLKEM = KEM & { prepare: (publicKey: Uint8Array) => KEMPrepared };
+
 type XofGet = ReturnType<ReturnType<XOF>['get']>;
 
 type KyberOpts = KEMParam & {
@@ -253,6 +290,38 @@ const genKPKE = (opts_: TArg<KyberOpts>) => {
   const secretCoder = vecCoder(polyCoder(12), K);
   const cipherCoder = splitCoder('ciphertext', vecCoder(polyU, K), polyV);
   const seedCoder = splitCoder('seed', 32, 32);
+  // Algorithm 14 (K-PKE.Encrypt) core, after ek parsing. `tHat` and every poly returned by
+  // `getA(i, j)` are treated as disposable scratch: they are mutated in place and wiped/dropped,
+  // so callers holding cached copies must pass fresh copies.
+  const encryptCore = (
+    tHat: TArg<Poly[]>,
+    getA: TArg<(i: number, j: number) => Poly>,
+    msg: TArg<Uint8Array>,
+    seed: TArg<Uint8Array>
+  ): TRet<Uint8Array> => {
+    const rHat = [];
+    for (let i = 0; i < K; i++) rHat.push(crystals.NTT.encode(sampleCBD(PRF, seed, i, ETA1)));
+    const tmp2 = new Uint16Array(N);
+    const u = [];
+    for (let i = 0; i < K; i++) {
+      const e1 = sampleCBD(PRF, seed, K + i, ETA2);
+      const tmp = new Uint16Array(N);
+      for (let j = 0; j < K; j++) {
+        const aij = getA(i, j); // A[j][i], inplace transpose access
+        polyAdd(tmp, MultiplyNTTs(aij, rHat[j])); // t += aij * rHat[j]
+      }
+      polyAdd(e1, crystals.NTT.decode(tmp)); // e1 += tmp
+      u.push(e1);
+      polyAdd(tmp2, MultiplyNTTs(tHat[i], rHat[i])); // t2 += tHat[i] * rHat[i]
+      cleanBytes(tmp);
+    }
+    const e2 = sampleCBD(PRF, seed, 2 * K, ETA2);
+    polyAdd(e2, crystals.NTT.decode(tmp2)); // e2 += tmp2
+    const v = poly1.decode(msg); // encode plaintext m into polynomial v
+    polyAdd(v, e2); // v += e2
+    cleanBytes(tHat, rHat, tmp2, e2);
+    return cipherCoder.encode([u, v]) as TRet<Uint8Array>;
+  };
   return {
     secretCoder,
     lengths: {
@@ -297,30 +366,31 @@ const genKPKE = (opts_: TArg<KyberOpts>) => {
       seed: TArg<Uint8Array>
     ): TRet<Uint8Array> => {
       const [tHat, rho] = publicCoder.decode(publicKey);
-      const rHat = [];
-      for (let i = 0; i < K; i++) rHat.push(crystals.NTT.encode(sampleCBD(PRF, seed, i, ETA1)));
       const x = XOF(rho);
-      const tmp2 = new Uint16Array(N);
-      const u = [];
-      for (let i = 0; i < K; i++) {
-        const e1 = sampleCBD(PRF, seed, K + i, ETA2);
-        const tmp = new Uint16Array(N);
-        for (let j = 0; j < K; j++) {
-          const aij = SampleNTT(x.get(i, j)); // A[j][i], inplace transpose access
-          polyAdd(tmp, MultiplyNTTs(aij, rHat[j])); // t += aij * rHat[j]
-        }
-        polyAdd(e1, crystals.NTT.decode(tmp)); // e1 += tmp
-        u.push(e1);
-        polyAdd(tmp2, MultiplyNTTs(tHat[i], rHat[i])); // t2 += tHat[i] * rHat[i]
-        cleanBytes(tmp);
-      }
+      const res = encryptCore(tHat as Poly[], (i, j) => SampleNTT(x.get(i, j)) as Poly, msg, seed);
       x.clean();
-      const e2 = sampleCBD(PRF, seed, 2 * K, ETA2);
-      polyAdd(e2, crystals.NTT.decode(tmp2)); // e2 += tmp2
-      const v = poly1.decode(msg); // encode plaintext m into polynomial v
-      polyAdd(v, e2); // v += e2
-      cleanBytes(tHat, rHat, tmp2, e2);
-      return cipherCoder.encode([u, v]) as TRet<Uint8Array>;
+      return res;
+    },
+    // Expands the full  matrix (public data derived from rho) once, so repeated encryptions
+    // against the same ek skip the K² SampleNTT XOF expansions. Cached polys are copied per
+    // call because encryptCore mutates its inputs in place.
+    prepare: (publicKey: TArg<Uint8Array>) => {
+      const [tHat, rho] = publicCoder.decode(publicKey);
+      const x = XOF(rho);
+      const A: Poly[] = [];
+      for (let i = 0; i < K; i++)
+        for (let j = 0; j < K; j++) A.push(SampleNTT(x.get(i, j)) as Poly);
+      x.clean();
+      return {
+        encrypt: (msg: TArg<Uint8Array>, seed: TArg<Uint8Array>): TRet<Uint8Array> =>
+          encryptCore(
+            (tHat as Poly[]).map((p) => p.slice() as Poly),
+            (i, j) => A[i * K + j].slice() as Poly,
+            msg,
+            seed
+          ),
+        clean: () => cleanBytes(tHat as Poly[], A),
+      };
     },
     decrypt: (cipherText: TArg<Uint8Array>, privateKey: TArg<Uint8Array>): TRet<Uint8Array> => {
       const [u, v] = cipherCoder.decode(cipherText);
@@ -344,7 +414,7 @@ const genKPKE = (opts_: TArg<KyberOpts>) => {
  * mismatch, and zeroizing the non-returned shared-secret candidate; JS/JIT still provides no
  * constant-time guarantees for that path.
  */
-function createKyber(opts: TArg<KyberOpts>): TRet<KEM> {
+function createKyber(opts: TArg<KyberOpts>): TRet<MLKEM> {
   const rawOpts = opts as KyberOpts;
   const KPKE = genKPKE(rawOpts);
   const { HASH256, HASH512, KDF } = rawOpts;
@@ -352,6 +422,17 @@ function createKyber(opts: TArg<KyberOpts>): TRet<KEM> {
   const secretCoder = splitCoder('secretKey', lengths.secretKey, lengths.publicKey, 32, 32);
   const msgLen = 32;
   const seedLen = 64;
+  // FIPS-203 includes additional verification check for modulus
+  const validateModulus = (publicKey: TArg<Uint8Array>, fn: string) => {
+    const eke = (publicKey as Uint8Array).subarray(0, 384 * rawOpts.K);
+    // Copy because of inplace encoding
+    const ek = KPKESecretCoder.encode(KPKESecretCoder.decode(copyBytes(eke)));
+    // (Modulus check.) Perform the computation ek ← ByteEncode12(ByteDecode12(eke)).
+    // If ek = ̸ eke, the input is invalid. (See Section 4.2.1.)
+    const ok = equalBytes(ek, eke);
+    cleanBytes(ek);
+    if (!ok) throw new Error(`ML-KEM.${fn}: wrong publicKey modulus`);
+  };
   const kemLengths = Object.freeze({
     ...lengths,
     seed: 64,
@@ -381,18 +462,7 @@ function createKyber(opts: TArg<KyberOpts>): TRet<KEM> {
     encapsulate: (publicKey: TArg<Uint8Array>, msg: TArg<Uint8Array> = randomBytes(msgLen)) => {
       abytes(publicKey, lengths.publicKey, 'publicKey');
       abytes(msg, msgLen, 'message');
-
-      // FIPS-203 includes additional verification check for modulus
-      const eke = publicKey.subarray(0, 384 * opts.K);
-      // Copy because of inplace encoding
-      const ek = KPKESecretCoder.encode(KPKESecretCoder.decode(copyBytes(eke)));
-      // (Modulus check.) Perform the computation ek ← ByteEncode12(ByteDecode12(eke)).
-      // If ek = ̸ eke, the input is invalid. (See Section 4.2.1.)
-      if (!equalBytes(ek, eke)) {
-        cleanBytes(ek);
-        throw new Error('ML-KEM.encapsulate: wrong publicKey modulus');
-      }
-      cleanBytes(ek);
+      validateModulus(publicKey, 'encapsulate');
       // derive randomness
       const kr = HASH512.create().update(msg).update(HASH256(publicKey)).digest();
       const cipherText = KPKE.encrypt(publicKey, msg, kr.subarray(32, 64));
@@ -422,9 +492,60 @@ function createKyber(opts: TArg<KyberOpts>): TRet<KEM> {
       // if ciphertexts do not match, “implicitly reject”
       const isValid = equalBytes(cipherText, cipherText2);
       const Kbar = KDF.create({ dkLen: 32 }).update(z).update(cipherText).digest();
-      cleanBytes(msg, cipherText2, !isValid ? Khat : Kbar);
+      // kr[32:64] is the derived K-PKE encryption randomness: wipe it like encapsulate() does.
+      cleanBytes(msg, cipherText2, kr.subarray(32), !isValid ? Khat : Kbar);
       return (isValid ? Khat : Kbar) as TRet<Uint8Array>;
     },
+    /**
+     * Experimental prototype: pre-expand a public key so repeated encapsulate/decapsulate
+     * against the same key skip re-validation, H(ek), t̂ decoding and the K² SampleNTT
+     * XOF expansions of Â. Only public data is cached; see {@link KEMPrepared}.
+     */
+    prepare: (publicKey: TArg<Uint8Array>): TRet<KEMPrepared> => {
+      abytes(publicKey, lengths.publicKey, 'publicKey');
+      validateModulus(publicKey, 'prepare');
+      const ek = copyBytes(publicKey); // detach from the caller before caching
+      const publicKeyHash = HASH256(ek);
+      const cached = KPKE.prepare(ek);
+      return Object.freeze({
+        publicKey: ek as TRet<Uint8Array>,
+        encapsulate: (msg: TArg<Uint8Array> = randomBytes(msgLen)) => {
+          abytes(msg, msgLen, 'message');
+          const kr = HASH512.create().update(msg).update(publicKeyHash).digest();
+          const cipherText = cached.encrypt(msg, kr.subarray(32, 64));
+          cleanBytes(kr.subarray(32));
+          return {
+            cipherText: cipherText as TRet<Uint8Array>,
+            sharedSecret: kr.subarray(0, 32) as TRet<Uint8Array>,
+          };
+        },
+        decapsulate: (
+          cipherText: TArg<Uint8Array>,
+          secretKey: TArg<Uint8Array>
+        ): TRet<Uint8Array> => {
+          abytes(secretKey, secretCoder.bytesLen, 'secretKey');
+          abytes(cipherText, lengths.cipherText, 'cipherText');
+          const [sk, ekEmbedded, storedHash, z] = secretCoder.decode(secretKey);
+          // Under KEMPrepared's read-only publicKey contract, bind dk to the prepared key.
+          // Together with publicKeyHash = H(ek) computed in prepare(), this is equivalent to (and
+          // stronger than) FIPS 203 §7.3's `H(dk[384k : 768k+32]) == dk[768k+32 : 768k+64]`.
+          if (!equalBytes(ekEmbedded, ek) || !equalBytes(storedHash, publicKeyHash))
+            throw new Error('ML-KEM.decapsulate: secretKey does not match prepared publicKey');
+          const msg = KPKE.decrypt(cipherText, sk);
+          // derive randomness, Khat, rHat = G(mHat || h)
+          const kr = HASH512.create().update(msg).update(publicKeyHash).digest();
+          const Khat = kr.subarray(0, 32);
+          // re-encrypt using the derived randomness and cached Â/t̂
+          const cipherText2 = cached.encrypt(msg, kr.subarray(32, 64));
+          // if ciphertexts do not match, “implicitly reject”
+          const isValid = equalBytes(cipherText, cipherText2);
+          const Kbar = KDF.create({ dkLen: 32 }).update(z).update(cipherText).digest();
+          cleanBytes(msg, cipherText2, kr.subarray(32), !isValid ? Khat : Kbar);
+          return (isValid ? Khat : Kbar) as TRet<Uint8Array>;
+        },
+        clean: cached.clean,
+      }) as TRet<KEMPrepared>;
+    },
   });
 }
 
@@ -458,18 +579,29 @@ const mk = (params: KEMParam) =>
 /**
  * ML-KEM-512: Table 2 row `k=2, η1=3, η2=2, du=10, dv=4`; Table 3 sizes `800/1632/768/32`.
  * The ASD lifecycle note here is external policy guidance, not a FIPS 203 requirement.
+ * @example
+ * Generate deterministic ML-KEM-512 keys, encapsulate a shared secret, and decapsulate it.
+ * ```ts
+ * import { ml_kem512 } from '@noble/post-quantum/ml-kem.js';
+ * const seed = new Uint8Array(ml_kem512.lengths.seed!);
+ * const { secretKey, publicKey } = ml_kem512.keygen(seed);
+ * const msg = new Uint8Array(ml_kem512.lengths.msgRand!);
+ * const { cipherText, sharedSecret } = ml_kem512.encapsulate(publicKey, msg);
+ * const recovered = ml_kem512.decapsulate(cipherText, secretKey);
+ * const publicKey2 = ml_kem512.getPublicKey(secretKey);
+ * ```
  */
-export const ml_kem512: TRet<KEM> = /* @__PURE__ */ (() => mk(PARAMS[512]))();
+export const ml_kem512: TRet<MLKEM> = /* @__PURE__ */ (() => mk(PARAMS[512]))();
 /**
  * ML-KEM-768: Table 2 row `k=3, η1=2, η2=2, du=10, dv=4`; Table 3 sizes `1184/2400/1088/32`.
  * The ASD lifecycle note here is external policy guidance, not a FIPS 203 requirement.
  */
-export const ml_kem768: TRet<KEM> = /* @__PURE__ */ (() => mk(PARAMS[768]))();
+export const ml_kem768: TRet<MLKEM> = /* @__PURE__ */ (() => mk(PARAMS[768]))();
 /**
  * ML-KEM-1024: Table 2 row `k=4, η1=2, η2=2, du=11, dv=5`; Table 3 sizes `1568/3168/1568/32`.
  * The ASD lifecycle note here is external policy guidance, not a FIPS 203 requirement.
  */
-export const ml_kem1024: TRet<KEM> = /* @__PURE__ */ (() => mk(PARAMS[1024]))();
+export const ml_kem1024: TRet<MLKEM> = /* @__PURE__ */ (() => mk(PARAMS[1024]))();
 
 // NOTE: for tests only, don't use. This keeps the exact internal ML-KEM math surfaces available
 // without re-implementing them in separate test code.

package/src/slh-dsa.ts

@@ -28,15 +28,10 @@
  */
 /*! noble-post-quantum - MIT License (c) 2024 Paul Miller (paulmillr.com) */
 import { hmac } from '@noble/hashes/hmac.js';
+import { bytesToNumberBE, numberToBytesBE } from '@noble/curves/utils.js';
 import { sha256, sha512 } from '@noble/hashes/sha2.js';
 import { shake256 } from '@noble/hashes/sha3.js';
-import {
-  bytesToHex,
-  concatBytes,
-  createView,
-  hexToBytes,
-  type CHash,
-} from '@noble/hashes/utils.js';
+import { concatBytes, createView, type CHash } from '@noble/hashes/utils.js';
 import {
   abytes,
   checkHash,
@@ -123,12 +118,16 @@ const AddressType = {
 /** Address byte array of size `ADDR_BYTES`. */
 export type ADRS = Uint8Array;
 
-/** Hash and tweakable-hash callbacks bound to one SLH-DSA keypair context. */
+/** Hash and tweakable-hash callbacks bound to one SLH-DSA keypair context.
+ * Buffer-aliasing contract: `PRFaddr`, `thash1` and `thashN` return views into per-context
+ * scratch buffers (one per lane), so callers must consume or copy a result before the next
+ * call on the same lane. `clean()` wipes the scratch buffers along with the hash states.
+ */
 export type Context = {
   /**
    * Derive a PRF output for one address.
    * @param addr - Address bytes.
-   * @returns PRF output bytes.
+   * @returns PRF output bytes (scratch view; copy to retain).
    */
   PRFaddr: (addr: TArg<ADRS>) => TRet<Uint8Array>;
   /**
@@ -180,21 +179,6 @@ export type GetContext = (
   opts: SphincsOpts
 ) => (pub_seed: TArg<Uint8Array>, sk_seed?: TArg<Uint8Array>) => TRet<Context>;
 
-function hexToNumber(hex: string): bigint {
-  if (typeof hex !== 'string') throw new Error('hex string expected, got ' + typeof hex);
-  return BigInt(hex === '' ? '0' : '0x' + hex); // Big Endian
-}
-
-// BE: Big Endian, LE: Little Endian. This is the local FIPS 205 `toInt(...)` equivalent.
-function bytesToNumberBE(bytes: TArg<Uint8Array>): bigint {
-  return hexToNumber(bytesToHex(bytes));
-}
-
-// Local in-range FIPS 205 `toByte(x, n)` equivalent; callers must keep `n < 256^len`.
-function numberToBytesBE(n: number | bigint, len: number): TRet<Uint8Array> {
-  return hexToBytes(n.toString(16).padStart(len * 2, '0'));
-}
-
 // Local FIPS 205 Algorithm 4 `base_2^b(...)` implementation. Bits are consumed in big-endian
 // order within each input byte, and callers must provide at least `ceil(outLen * b / 8)` bytes;
 // short inputs are not rejected and would zero-extend implicitly.
@@ -214,8 +198,12 @@ const base2b = (outLen: number, b: number) => {
   };
 };
 
+const _1n = /* @__PURE__ */ BigInt(1);
+const _8n = /* @__PURE__ */ BigInt(8);
+const _0xffn = /* @__PURE__ */ BigInt(0xff);
+
 function getMaskBig(bits: number) {
-  return (1n << BigInt(bits)) - 1n; // 4 -> 0b1111
+  return (_1n << BigInt(bits)) - _1n; // 4 -> 0b1111
 }
 
 /** Public SLH-DSA signer with prehash customization. */
@@ -284,16 +272,25 @@ function gen(opts: SphincsOpts, hashOpts_: TArg<SphincsHashOpts>): TRet<SphincsS
   ) => {
     const { type, height, tree, layer, index, chain, hash, keypair } = opts;
     const { subtreeAddr, keypairAddr } = opts;
-    const v = createView(addr);
 
     if (height !== undefined) addr[OFFSET_CHAIN_ADDR] = height;
     if (layer !== undefined) addr[OFFSET_LAYER] = layer;
     if (type !== undefined) addr[OFFSET_TYPE] = type;
     if (chain !== undefined) addr[OFFSET_CHAIN_ADDR] = chain;
     if (hash !== undefined) addr[OFFSET_HASH_ADDR] = hash;
-    if (index !== undefined) v.setUint32(OFFSET_TREE_INDEX, index, false);
+    // Manual big-endian writes: setAddr runs in the innermost WOTS/tree loops, and creating a
+    // DataView per call was a measurable share of sign() time.
+    if (index !== undefined) {
+      addr[OFFSET_TREE_INDEX + 0] = index >>> 24;
+      addr[OFFSET_TREE_INDEX + 1] = index >>> 16;
+      addr[OFFSET_TREE_INDEX + 2] = index >>> 8;
+      addr[OFFSET_TREE_INDEX + 3] = index;
+    }
     if (subtreeAddr) addr.set(subtreeAddr.subarray(0, OFFSET_TREE + 8));
-    if (tree !== undefined) v.setBigUint64(OFFSET_TREE, tree, false);
+    if (tree !== undefined) {
+      let t = tree;
+      for (let i = 7; i >= 0; i--, t >>= _8n) addr[OFFSET_TREE + i] = Number(t & _0xffn);
+    }
     if (keypair !== undefined) {
       addr[OFFSET_KP_ADDR1] = keypair;
       if (TREE_HEIGHT > 8) addr[OFFSET_KP_ADDR2] = keypair >>> 8;
@@ -372,10 +369,12 @@ function gen(opts: SphincsOpts, hashOpts_: TArg<SphincsHashOpts>): TRet<SphincsS
       const maxIdx = (1 << height) - 1;
       const stack = new Uint8Array(height * N);
       const authPath = new Uint8Array(height * N);
+      // One node buffer per treehash call (not per leaf): both halves are fully overwritten at
+      // each use, and the returned root aliases cur1, which is never reused after return.
+      const current = new Uint8Array(2 * N);
+      const cur0 = current.subarray(0, N);
+      const cur1 = current.subarray(N);
       for (let idx = 0; ; idx++) {
-        const current = new Uint8Array(2 * N);
-        const cur0 = current.subarray(0, N);
-        const cur1 = current.subarray(N);
         const addrOffset = idx + idxOffset;
         cur1.set(leafFn(leafIdx, addrOffset, rawContext, info));
         let h = 0;
@@ -582,7 +581,9 @@ function gen(opts: SphincsOpts, hashOpts_: TArg<SphincsHashOpts>): TRet<SphincsS
           },
           forsTreeAddr
         );
-        const prf = context.PRFaddr(forsTreeAddr);
+        // Copy: PRFaddr returns a per-context scratch view, and this value is retained in
+        // `fors` across the many PRFaddr calls inside forsTreehash below.
+        const prf = copyBytes(context.PRFaddr(forsTreeAddr));
         setAddr({ type: AddressType.FORSTREE }, forsTreeAddr);
         const { root, authPath } = forsTreehash(
           context,
@@ -598,7 +599,9 @@ function gen(opts: SphincsOpts, hashOpts_: TArg<SphincsHashOpts>): TRet<SphincsS
         type: AddressType.FORSPK,
         keypairAddr: wotsAddr,
       });
-      const root = context.thashN(K, concatBytes(...roots), forsPkAddr);
+      // Copy: thashN returns a per-context scratch view, and `root` lives across every hash
+      // call in the hypertree loop below (it is also mutated via root.set).
+      const root = copyBytes(context.thashN(K, concatBytes(...roots), forsPkAddr));
       // WOTS signatures
       const treeAddr = setAddr({ type: AddressType.HASHTREE });
       const wots: [Uint8Array, Uint8Array][] = [];
@@ -622,9 +625,13 @@ function gen(opts: SphincsOpts, hashOpts_: TArg<SphincsHashOpts>): TRet<SphincsS
     },
     verify: (sig: TArg<Uint8Array>, msg: TArg<Uint8Array>, publicKey: TArg<Uint8Array>) => {
       const [pkSeed, pubRoot] = publicCoder.decode(publicKey);
-      const [random, forsVec, wotsVec] = sigCoder.decode(sig);
       const pk = publicKey;
+      // FIPS 205 Algorithm 20 step 1: wrong-length signatures return false instead of throwing
+      // (same as ml-dsa). Must run before sigCoder.decode, which throws on length mismatch.
+      // Preserve TypeError for non-byte API arguments before treating byte lengths as invalid.
+      abytes(sig, undefined, 'signature');
       if (sig.length !== sigCoder.bytesLen) return false;
+      const [random, forsVec, wotsVec] = sigCoder.decode(sig);
       const context = getContext(pkSeed);
       let { tree, leafIdx, md } = hashMessage(random, pk, msg, context);
       const wotsAddr = setAddr({
@@ -644,14 +651,18 @@ function gen(opts: SphincsOpts, hashOpts_: TArg<SphincsHashOpts>): TRet<SphincsS
         const idxOffset = i << A;
         setAddr({ height: 0, index: indices[i] + idxOffset }, forsTreeAddr);
         const leaf = context.thash1(prf, forsTreeAddr);
-        // Compute inplace, because we need all roots in same byte array
-        roots.push(computeRoot(leaf, indices[i], idxOffset, authPath, A, context, forsTreeAddr));
+        // Copy: computeRoot returns a thashN scratch view, and roots are retained across the
+        // remaining FORS iterations (computeRoot itself copies `leaf` before hashing).
+        roots.push(
+          copyBytes(computeRoot(leaf, indices[i], idxOffset, authPath, A, context, forsTreeAddr))
+        );
       }
       const forsPkAddr = setAddr({
         type: AddressType.FORSPK,
         keypairAddr: wotsAddr,
       });
-      let root = context.thashN(K, concatBytes(...roots), forsPkAddr); // root = thash()
+      // Copy: `root` must survive the thash1/thashN calls of the WOTS chain loop below.
+      let root = copyBytes(context.thashN(K, concatBytes(...roots), forsPkAddr)); // root = thash()
       // WOTS signature
       const treeAddr = setAddr({ type: AddressType.HASHTREE });
       const wotsPkAddr = setAddr({ type: AddressType.WOTSPK });
@@ -674,7 +685,8 @@ function gen(opts: SphincsOpts, hashOpts_: TArg<SphincsHashOpts>): TRet<SphincsS
           }
         }
         const leaf = context.thashN(WOTS_LEN, wotsPk, wotsPkAddr);
-        root = computeRoot(leaf, leafIdx, 0, sigAuth, TREE_HEIGHT, context, treeAddr);
+        // Copy: `root` is read by chainLengths / equalBytes after later hash calls.
+        root = copyBytes(computeRoot(leaf, leafIdx, 0, sigAuth, TREE_HEIGHT, context, treeAddr));
         leafIdx = Number(tree & getMaskBig(TREE_HEIGHT));
       }
       return equalBytes(root, pubRoot);
@@ -744,20 +756,27 @@ const genShake =
     // for each address-bound call instead of reabsorbing the same seed every time.
     const h0 = shake256.create({}).update(pubSeed);
     const h0tmp = h0.clone();
+    // Per-context output scratch: thash1/thashN/PRFaddr return these buffers directly, so
+    // callers must consume or copy a result before the next call on the same lane.
+    const thashOut = new Uint8Array(N);
+    const prfOut = new Uint8Array(N);
     const thash = (blocks: number, input: TArg<Uint8Array>, addr: TArg<ADRS>): TRet<Uint8Array> => {
       stats.thash++;
-      return h0
-        ._cloneInto(h0tmp)
+      const len = blocks * N;
+      h0._cloneInto(h0tmp)
         .update(addr)
-        .update(input.subarray(0, blocks * N))
-        .xof(N) as TRet<Uint8Array>;
+        .update(
+          input.length === len ? (input as Uint8Array) : (input as Uint8Array).subarray(0, len)
+        )
+        .xofInto(thashOut);
+      return thashOut as TRet<Uint8Array>;
     };
     return {
       PRFaddr: (addr: TArg<ADRS>): TRet<Uint8Array> => {
         if (!skSeed) throw new Error('no sk seed');
         stats.prf++;
-        const res = h0._cloneInto(h0tmp).update(addr).update(skSeed).xof(N);
-        return res as TRet<Uint8Array>;
+        h0._cloneInto(h0tmp).update(addr).update(skSeed).xofInto(prfOut);
+        return prfOut as TRet<Uint8Array>;
       },
       PRFmsg: (
         skPRF: TArg<Uint8Array>,
@@ -787,6 +806,7 @@ const genShake =
       clean: () => {
         h0.destroy();
         h0tmp.destroy();
+        cleanBytes(thashOut, prfOut);
         //console.log(stats);
       },
     } as TRet<Context>;
@@ -869,6 +889,16 @@ const genSha =
 
     const h0tmp = h0ps.clone();
     const h1tmp = h1ps.clone();
+    // Per-context output scratch: thash1/thashN/PRFaddr return views into these buffers, so
+    // callers must consume or copy a result before the next call on the same lane (see Context
+    // docs). digestInto also skips digest()'s per-call destroy(): the tmp states are fully
+    // overwritten by the next _cloneInto and wiped in clean().
+    const h0out = new Uint8Array(h0.outputLen);
+    const h1out = new Uint8Array(h1.outputLen);
+    const prfOut = new Uint8Array(h0.outputLen);
+    const h0outN = h0out.subarray(0, N);
+    const h1outN = h1out.subarray(0, N);
+    const prfOutN = prfOut.subarray(0, N);
 
     // https://www.rfc-editor.org/rfc/rfc8017.html#appendix-B.2.1
     // This local helper is intentionally stricter than generic MGF1 reuse: current SLH-DSA callers
@@ -889,27 +919,28 @@ const genSha =
     }
 
     const thash =
-      (_: ShaType, h: typeof h0ps, hTmp: typeof h0ps) =>
+      (h: typeof h0ps, hTmp: typeof h0ps, out: TArg<Uint8Array>, outN: TArg<Uint8Array>) =>
       (blocks: number, input: TArg<Uint8Array>, addr: TArg<ADRS>): TRet<Uint8Array> => {
         stats.thash++;
-        const d = h
-          ._cloneInto(hTmp as any)
+        const len = blocks * N;
+        h._cloneInto(hTmp as any)
           .update(addr)
-          .update(input.subarray(0, blocks * N))
-          .digest();
-        return d.subarray(0, N) as TRet<Uint8Array>;
+          .update(
+            input.length === len ? (input as Uint8Array) : (input as Uint8Array).subarray(0, len)
+          )
+          .digestInto(out);
+        return outN as TRet<Uint8Array>;
       };
     return {
       PRFaddr: (addr: TArg<ADRS>): TRet<Uint8Array> => {
         if (!sk_seed) throw new Error('No sk seed');
         stats.prf++;
-        const res = h0ps
+        h0ps
           ._cloneInto(h0tmp as any)
           .update(addr)
           .update(sk_seed)
-          .digest()
-          .subarray(0, N);
-        return res as TRet<Uint8Array>;
+          .digestInto(prfOut);
+        return prfOutN as TRet<Uint8Array>;
       },
       PRFmsg: (
         skPRF: TArg<Uint8Array>,
@@ -938,13 +969,14 @@ const genSha =
         );
         return mgf1(seed, outLen, h1);
       },
-      thash1: thash(h0, h0ps, h0tmp).bind(null, 1),
-      thashN: thash(h1, h1ps, h1tmp),
+      thash1: thash(h0ps, h0tmp, h0out, h0outN).bind(null, 1),
+      thashN: thash(h1ps, h1tmp, h1out, h1outN),
       clean: () => {
         h0ps.destroy();
         h1ps.destroy();
         h0tmp.destroy();
         h1tmp.destroy();
+        cleanBytes(h0out, h1out, prfOut);
         //console.log(stats);
       },
     } as TRet<Context>;
@@ -963,6 +995,23 @@ const SHA512_SIMPLE = /* @__PURE__ */ (() => ({
  * SLH-DSA-SHA2-128f: Table 2 row `n=16, h=66, d=22, h'=3, a=6, k=33, lg w=4, m=34`;
  * lengths `publicKey=32`, `secretKey=64`, `signature=17088`, `seed=48`, `signRand=16`.
  * Also exposes `.prehash(...)`.
+ * @example
+ * Generate deterministic SLH-DSA keys, sign one message, and verify the signature.
+ * ```ts
+ * import { sha256 } from '@noble/hashes/sha2.js';
+ * import { slh_dsa_sha2_128f } from '@noble/post-quantum/slh-dsa.js';
+ * const seed = new Uint8Array(slh_dsa_sha2_128f.lengths.seed!);
+ * const { secretKey, publicKey } = slh_dsa_sha2_128f.keygen(seed);
+ * const msg = new TextEncoder().encode('hello noble');
+ * const sig = slh_dsa_sha2_128f.sign(msg, secretKey);
+ * const isValid = slh_dsa_sha2_128f.verify(sig, msg, publicKey);
+ * const recovered = slh_dsa_sha2_128f.getPublicKey(secretKey);
+ * const context = new Uint8Array([1, 2, 3]);
+ * const prehash = slh_dsa_sha2_128f.prehash(sha256);
+ * const preSig = prehash.sign(msg, secretKey, { context });
+ * const preValid = prehash.verify(preSig, msg, publicKey, { context });
+ * const internalSig = slh_dsa_sha2_128f.internal.sign(msg, secretKey);
+ * ```
  */
 export const slh_dsa_sha2_128f: TRet<SphincsSigner> = /* @__PURE__ */ (() =>
   gen(PARAMS['128f'], SHA256_SIMPLE))();