@noble/post-quantum 0.6.1 → 0.7.1

package/ml-kem.js

@@ -84,24 +84,32 @@ const byteCoder = (d) => crystals.bitsCoder(d, d === 12
 // Kinda like convertRadix2 from @scure/base.
 // decode(encode(t)) == t, but there is loss of information on encode(decode(t))
 const polyCoder = (d) => (d === 12 ? byteCoder(12) : crystals.bitsCoder(d, compress(d)));
+// Coefficients always stay reduced in [0, Q) here (samplers, NTT and coders all reduce),
+// so one conditional correction replaces the generic mod().
 function polyAdd(a_, b_) {
     const a = a_;
     const b = b_;
     // Mutates `a` in place; callers must pass two N=256 polynomials.
-    for (let i = 0; i < N; i++)
-        a[i] = crystals.mod(a[i] + b[i]); // a += b
+    for (let i = 0; i < N; i++) {
+        const r = a[i] + b[i]; // a += b
+        a[i] = r >= Q ? r - Q : r;
+    }
 }
 function polySub(a_, b_) {
     const a = a_;
     const b = b_;
     // Mutates `a` in place; callers must pass two N=256 polynomials.
-    for (let i = 0; i < N; i++)
-        a[i] = crystals.mod(a[i] - b[i]); // a -= b
+    for (let i = 0; i < N; i++) {
+        const r = a[i] - b[i]; // a -= b
+        a[i] = r < 0 ? r + Q : r;
+    }
 }
 // FIPS-203: Computes the product of two degree-one polynomials with respect to a quadratic modulus
 function BaseCaseMultiply(a0, a1, b0, b1, zeta) {
     // `zeta` here is Algorithm 11's γ = ζ^(2BitRev_7(i)+1).
-    const c0 = crystals.mod(a1 * b1 * zeta + a0 * b0);
+    // Reduce a1*b1 before multiplying by zeta: a1*b1*zeta would reach ~2^35, forcing JS engines
+    // into slow float fmod; with the extra reduction every intermediate fits int32.
+    const c0 = crystals.mod(crystals.mod(a1 * b1) * zeta + a0 * b0);
     const c1 = crystals.mod(a0 * b1 + a1 * b0);
     return { c0, c1 };
 }
@@ -191,6 +199,34 @@ const genKPKE = (opts_) => {
     const secretCoder = vecCoder(polyCoder(12), K);
     const cipherCoder = splitCoder('ciphertext', vecCoder(polyU, K), polyV);
     const seedCoder = splitCoder('seed', 32, 32);
+    // Algorithm 14 (K-PKE.Encrypt) core, after ek parsing. `tHat` and every poly returned by
+    // `getA(i, j)` are treated as disposable scratch: they are mutated in place and wiped/dropped,
+    // so callers holding cached copies must pass fresh copies.
+    const encryptCore = (tHat, getA, msg, seed) => {
+        const rHat = [];
+        for (let i = 0; i < K; i++)
+            rHat.push(crystals.NTT.encode(sampleCBD(PRF, seed, i, ETA1)));
+        const tmp2 = new Uint16Array(N);
+        const u = [];
+        for (let i = 0; i < K; i++) {
+            const e1 = sampleCBD(PRF, seed, K + i, ETA2);
+            const tmp = new Uint16Array(N);
+            for (let j = 0; j < K; j++) {
+                const aij = getA(i, j); // A[j][i], inplace transpose access
+                polyAdd(tmp, MultiplyNTTs(aij, rHat[j])); // t += aij * rHat[j]
+            }
+            polyAdd(e1, crystals.NTT.decode(tmp)); // e1 += tmp
+            u.push(e1);
+            polyAdd(tmp2, MultiplyNTTs(tHat[i], rHat[i])); // t2 += tHat[i] * rHat[i]
+            cleanBytes(tmp);
+        }
+        const e2 = sampleCBD(PRF, seed, 2 * K, ETA2);
+        polyAdd(e2, crystals.NTT.decode(tmp2)); // e2 += tmp2
+        const v = poly1.decode(msg); // encode plaintext m into polynomial v
+        polyAdd(v, e2); // v += e2
+        cleanBytes(tHat, rHat, tmp2, e2);
+        return cipherCoder.encode([u, v]);
+    };
     return {
         secretCoder,
         lengths: {
@@ -231,31 +267,26 @@ const genKPKE = (opts_) => {
         },
         encrypt: (publicKey, msg, seed) => {
             const [tHat, rho] = publicCoder.decode(publicKey);
-            const rHat = [];
-            for (let i = 0; i < K; i++)
-                rHat.push(crystals.NTT.encode(sampleCBD(PRF, seed, i, ETA1)));
             const x = XOF(rho);
-            const tmp2 = new Uint16Array(N);
-            const u = [];
-            for (let i = 0; i < K; i++) {
-                const e1 = sampleCBD(PRF, seed, K + i, ETA2);
-                const tmp = new Uint16Array(N);
-                for (let j = 0; j < K; j++) {
-                    const aij = SampleNTT(x.get(i, j)); // A[j][i], inplace transpose access
-                    polyAdd(tmp, MultiplyNTTs(aij, rHat[j])); // t += aij * rHat[j]
-                }
-                polyAdd(e1, crystals.NTT.decode(tmp)); // e1 += tmp
-                u.push(e1);
-                polyAdd(tmp2, MultiplyNTTs(tHat[i], rHat[i])); // t2 += tHat[i] * rHat[i]
-                cleanBytes(tmp);
-            }
+            const res = encryptCore(tHat, (i, j) => SampleNTT(x.get(i, j)), msg, seed);
+            x.clean();
+            return res;
+        },
+        // Expands the full  matrix (public data derived from rho) once, so repeated encryptions
+        // against the same ek skip the K² SampleNTT XOF expansions. Cached polys are copied per
+        // call because encryptCore mutates its inputs in place.
+        prepare: (publicKey) => {
+            const [tHat, rho] = publicCoder.decode(publicKey);
+            const x = XOF(rho);
+            const A = [];
+            for (let i = 0; i < K; i++)
+                for (let j = 0; j < K; j++)
+                    A.push(SampleNTT(x.get(i, j)));
             x.clean();
-            const e2 = sampleCBD(PRF, seed, 2 * K, ETA2);
-            polyAdd(e2, crystals.NTT.decode(tmp2)); // e2 += tmp2
-            const v = poly1.decode(msg); // encode plaintext m into polynomial v
-            polyAdd(v, e2); // v += e2
-            cleanBytes(tHat, rHat, tmp2, e2);
-            return cipherCoder.encode([u, v]);
+            return {
+                encrypt: (msg, seed) => encryptCore(tHat.map((p) => p.slice()), (i, j) => A[i * K + j].slice(), msg, seed),
+                clean: () => cleanBytes(tHat, A),
+            };
         },
         decrypt: (cipherText, privateKey) => {
             const [u, v] = cipherCoder.decode(cipherText);
@@ -265,8 +296,11 @@ const genKPKE = (opts_) => {
             for (let i = 0; i < K; i++)
                 polyAdd(tmp, MultiplyNTTs(sk[i], crystals.NTT.encode(u[i])));
             polySub(v, crystals.NTT.decode(tmp)); // w = v' - tmp
-            cleanBytes(tmp, sk, u);
-            return poly1.encode(v);
+            // `v` now holds w, from which the plaintext is just a 1-bit threshold away, so wipe it too.
+            // encode() allocates its own buffer, so the returned bytes do not alias `v`.
+            const res = poly1.encode(v);
+            cleanBytes(tmp, sk, u, v);
+            return res;
         },
     };
 };
@@ -274,6 +308,11 @@ const genKPKE = (opts_) => {
  * Public ML-KEM wrapper over the internal K-PKE subroutine.
  * `keygen(seed)` and `encapsulate(publicKey, msg)` are deterministic/test-oriented hooks that map
  * more directly to Algorithms 16-17 than to the pure no-input / random-internal Algorithms 19-20.
+ * `encapsulate`'s optional `msg` is the 32-byte message randomness `m` of Algorithm 17, the
+ * pre-image the shared secret is derived from, NOT a plaintext to encrypt: ML-KEM is a key
+ * encapsulation mechanism, not a cipher. Omit it to draw fresh randomness; pass it only to
+ * reproduce a known-answer vector, and only as 32 uniformly random bytes, since a low-entropy or
+ * reused value makes the shared secret predictable. The same holds for `keygen`'s optional `seed`.
  * decapsulate() tries to follow the Algorithms 18/21 implicit-reject structure as closely as
  * practical here by re-encrypting, comparing ciphertexts, returning `Khat` on match or `Kbar` on
  * mismatch, and zeroizing the non-returned shared-secret candidate; JS/JIT still provides no
@@ -287,6 +326,18 @@ function createKyber(opts) {
     const secretCoder = splitCoder('secretKey', lengths.secretKey, lengths.publicKey, 32, 32);
     const msgLen = 32;
     const seedLen = 64;
+    // FIPS-203 includes additional verification check for modulus
+    const validateModulus = (publicKey, fn) => {
+        const eke = publicKey.subarray(0, 384 * rawOpts.K);
+        // Copy because of inplace encoding
+        const ek = KPKESecretCoder.encode(KPKESecretCoder.decode(copyBytes(eke)));
+        // (Modulus check.) Perform the computation ek ← ByteEncode12(ByteDecode12(eke)).
+        // If ek = ̸ eke, the input is invalid. (See Section 4.2.1.)
+        const ok = equalBytes(ek, eke);
+        cleanBytes(ek);
+        if (!ok)
+            throw new Error(`ML-KEM.${fn}: wrong publicKey modulus`);
+    };
     const kemLengths = Object.freeze({
         ...lengths,
         seed: 64,
@@ -297,44 +348,65 @@ function createKyber(opts) {
     return Object.freeze({
         info: Object.freeze({ type: 'ml-kem' }),
         lengths: kemLengths,
-        keygen: (seed = randomBytes(seedLen)) => {
-            abytes(seed, seedLen, 'seed');
-            const { publicKey, secretKey: sk } = KPKE.keygen(seed.subarray(0, 32));
-            const publicKeyHash = HASH256(publicKey);
-            // (dkPKE||ek||H(ek)||z)
-            const secretKey = secretCoder.encode([sk, publicKey, publicKeyHash, seed.subarray(32)]);
-            cleanBytes(sk, publicKeyHash);
-            return {
-                publicKey: publicKey,
-                secretKey: secretKey,
-            };
+        keygen: (seed) => {
+            // A generated seed carries z (the implicit-rejection secret) and must be wiped once the
+            // secret key holds a copy, matching ml-dsa / slh-dsa / falcon keygen. A caller-supplied
+            // seed is the caller's to manage (and the immutability test requires it stay untouched).
+            const ownSeed = seed === undefined;
+            const s = ownSeed ? randomBytes(seedLen) : seed;
+            let sk;
+            let publicKeyHash;
+            try {
+                abytes(s, seedLen, 'seed');
+                const keys = KPKE.keygen(s.subarray(0, 32));
+                const publicKey = keys.publicKey;
+                sk = keys.secretKey;
+                publicKeyHash = HASH256(publicKey);
+                // (dkPKE||ek||H(ek)||z)
+                const secretKey = secretCoder.encode([sk, publicKey, publicKeyHash, s.subarray(32)]);
+                return {
+                    publicKey: publicKey,
+                    secretKey: secretKey,
+                };
+            }
+            finally {
+                if (sk !== undefined)
+                    cleanBytes(sk);
+                if (publicKeyHash !== undefined)
+                    cleanBytes(publicKeyHash);
+                if (ownSeed)
+                    cleanBytes(s);
+            }
         },
         getPublicKey: (secretKey) => {
             const [_sk, publicKey, _publicKeyHash, _z] = secretCoder.decode(secretKey);
             return Uint8Array.from(publicKey);
         },
-        encapsulate: (publicKey, msg = randomBytes(msgLen)) => {
-            abytes(publicKey, lengths.publicKey, 'publicKey');
-            abytes(msg, msgLen, 'message');
-            // FIPS-203 includes additional verification check for modulus
-            const eke = publicKey.subarray(0, 384 * opts.K);
-            // Copy because of inplace encoding
-            const ek = KPKESecretCoder.encode(KPKESecretCoder.decode(copyBytes(eke)));
-            // (Modulus check.) Perform the computation ek ← ByteEncode12(ByteDecode12(eke)).
-            // If ek = ̸ eke, the input is invalid. (See Section 4.2.1.)
-            if (!equalBytes(ek, eke)) {
-                cleanBytes(ek);
-                throw new Error('ML-KEM.encapsulate: wrong publicKey modulus');
+        encapsulate: (publicKey, msg) => {
+            // A generated message is the preimage of the shared secret (K = G(m || H(ek))[0:32]) and
+            // must be wiped. A caller-supplied message is the deterministic-randomness hook and the
+            // caller's to manage (the immutability test requires it stay untouched).
+            const ownMsg = msg === undefined;
+            const m = ownMsg ? randomBytes(msgLen) : msg;
+            let kr;
+            try {
+                abytes(publicKey, lengths.publicKey, 'publicKey');
+                abytes(m, msgLen, 'message');
+                validateModulus(publicKey, 'encapsulate');
+                // derive randomness
+                kr = HASH512.create().update(m).update(HASH256(publicKey)).digest();
+                const cipherText = KPKE.encrypt(publicKey, m, kr.subarray(32, 64));
+                return {
+                    cipherText: cipherText,
+                    sharedSecret: kr.subarray(0, 32),
+                };
+            }
+            finally {
+                if (kr !== undefined)
+                    cleanBytes(kr.subarray(32));
+                if (ownMsg)
+                    cleanBytes(m);
             }
-            cleanBytes(ek);
-            // derive randomness
-            const kr = HASH512.create().update(msg).update(HASH256(publicKey)).digest();
-            const cipherText = KPKE.encrypt(publicKey, msg, kr.subarray(32, 64));
-            cleanBytes(kr.subarray(32));
-            return {
-                cipherText: cipherText,
-                sharedSecret: kr.subarray(0, 32),
-            };
         },
         decapsulate: (cipherText, secretKey) => {
             abytes(secretKey, secretCoder.bytesLen, 'secretKey'); // 768*k + 96
@@ -356,9 +428,69 @@ function createKyber(opts) {
             // if ciphertexts do not match, “implicitly reject”
             const isValid = equalBytes(cipherText, cipherText2);
             const Kbar = KDF.create({ dkLen: 32 }).update(z).update(cipherText).digest();
-            cleanBytes(msg, cipherText2, !isValid ? Khat : Kbar);
+            // kr[32:64] is the derived K-PKE encryption randomness: wipe it like encapsulate() does.
+            cleanBytes(msg, cipherText2, kr.subarray(32), !isValid ? Khat : Kbar);
             return (isValid ? Khat : Kbar);
         },
+        /**
+         * Experimental prototype: pre-expand a public key so repeated encapsulate/decapsulate
+         * against the same key skip re-validation, H(ek), t̂ decoding and the K² SampleNTT
+         * XOF expansions of Â. Only public data is cached; see {@link KEMPrepared}.
+         */
+        prepare: (publicKey) => {
+            abytes(publicKey, lengths.publicKey, 'publicKey');
+            validateModulus(publicKey, 'prepare');
+            const ek = copyBytes(publicKey); // detach from the caller before caching
+            const publicKeyHash = HASH256(ek);
+            const cached = KPKE.prepare(ek);
+            return Object.freeze({
+                publicKey: ek,
+                encapsulate: (msg) => {
+                    // As in the non-prepared encapsulate: a generated message is the shared-secret
+                    // preimage and is wiped; a caller-supplied one is left untouched.
+                    const ownMsg = msg === undefined;
+                    const m = ownMsg ? randomBytes(msgLen) : msg;
+                    let kr;
+                    try {
+                        abytes(m, msgLen, 'message');
+                        kr = HASH512.create().update(m).update(publicKeyHash).digest();
+                        const cipherText = cached.encrypt(m, kr.subarray(32, 64));
+                        return {
+                            cipherText: cipherText,
+                            sharedSecret: kr.subarray(0, 32),
+                        };
+                    }
+                    finally {
+                        if (kr !== undefined)
+                            cleanBytes(kr.subarray(32));
+                        if (ownMsg)
+                            cleanBytes(m);
+                    }
+                },
+                decapsulate: (cipherText, secretKey) => {
+                    abytes(secretKey, secretCoder.bytesLen, 'secretKey');
+                    abytes(cipherText, lengths.cipherText, 'cipherText');
+                    const [sk, ekEmbedded, storedHash, z] = secretCoder.decode(secretKey);
+                    // Under KEMPrepared's read-only publicKey contract, bind dk to the prepared key.
+                    // Together with publicKeyHash = H(ek) computed in prepare(), this is equivalent to (and
+                    // stronger than) FIPS 203 §7.3's `H(dk[384k : 768k+32]) == dk[768k+32 : 768k+64]`.
+                    if (!equalBytes(ekEmbedded, ek) || !equalBytes(storedHash, publicKeyHash))
+                        throw new Error('ML-KEM.decapsulate: secretKey does not match prepared publicKey');
+                    const msg = KPKE.decrypt(cipherText, sk);
+                    // derive randomness, Khat, rHat = G(mHat || h)
+                    const kr = HASH512.create().update(msg).update(publicKeyHash).digest();
+                    const Khat = kr.subarray(0, 32);
+                    // re-encrypt using the derived randomness and cached Â/t̂
+                    const cipherText2 = cached.encrypt(msg, kr.subarray(32, 64));
+                    // if ciphertexts do not match, “implicitly reject”
+                    const isValid = equalBytes(cipherText, cipherText2);
+                    const Kbar = KDF.create({ dkLen: 32 }).update(z).update(cipherText).digest();
+                    cleanBytes(msg, cipherText2, kr.subarray(32), !isValid ? Khat : Kbar);
+                    return (isValid ? Khat : Kbar);
+                },
+                clean: cached.clean,
+            });
+        },
     });
 }
 // FIPS 203's PRF_eta binding: current callers use only 32-byte keys, one-byte nonces,
@@ -388,6 +520,17 @@ const mk = (params) => createKyber({
 /**
  * ML-KEM-512: Table 2 row `k=2, η1=3, η2=2, du=10, dv=4`; Table 3 sizes `800/1632/768/32`.
  * The ASD lifecycle note here is external policy guidance, not a FIPS 203 requirement.
+ * @example
+ * Generate deterministic ML-KEM-512 keys, encapsulate a shared secret, and decapsulate it.
+ * ```ts
+ * import { ml_kem512 } from '@noble/post-quantum/ml-kem.js';
+ * const seed = new Uint8Array(ml_kem512.lengths.seed!);
+ * const { secretKey, publicKey } = ml_kem512.keygen(seed);
+ * const msg = new Uint8Array(ml_kem512.lengths.msgRand!);
+ * const { cipherText, sharedSecret } = ml_kem512.encapsulate(publicKey, msg);
+ * const recovered = ml_kem512.decapsulate(cipherText, secretKey);
+ * const publicKey2 = ml_kem512.getPublicKey(secretKey);
+ * ```
  */
 export const ml_kem512 = /* @__PURE__ */ (() => mk(PARAMS[512]))();
 /**
@@ -441,4 +584,3 @@ export const __tests = /* @__PURE__ */ (() => Object.freeze({
         }
     },
 }))();
-//# sourceMappingURL=ml-kem.js.map

package/package.json

@@ -1,40 +1,35 @@
 {
   "name": "@noble/post-quantum",
-  "version": "0.6.1",
+  "version": "0.7.1",
   "description": "Auditable & minimal JS implementation of post-quantum cryptography: FIPS 203, 204, 205, Falcon",
   "files": [
     "*.js",
-    "*.js.map",
     "*.d.ts",
-    "*.d.ts.map",
     "src"
   ],
   "dependencies": {
-    "@noble/ciphers": "~2.2.0",
-    "@noble/curves": "~2.2.0",
-    "@noble/hashes": "~2.2.0"
+    "@noble/ciphers": "2.4.0",
+    "@noble/curves": "2.4.0",
+    "@noble/hashes": "2.4.0"
   },
   "devDependencies": {
-    "@paulmillr/jsbt": "0.5.0",
-    "@types/node": "25.3.0",
+    "@paulmillr/jsbt": "0.7.1",
+    "bismar": "0.1.8",
+    "@types/node": "26.2.0",
     "fast-check": "4.2.0",
-    "prettier": "3.6.2",
-    "typescript": "6.0.2"
+    "prettier": "3.9.6",
+    "typescript": "6.0.3"
   },
   "scripts": {
-    "bench": "node test/benchmark.ts",
+    "benchmark": "node benchmark/pq.ts",
+    "benchmark:size": "bismar -bsm",
     "build": "tsc",
-    "build:release": "npx --no @paulmillr/jsbt esbuild test/build",
-    "check": "npm run check:readme && npm run check:treeshake && npm run check:jsdoc",
-    "check:readme": "npx --no @paulmillr/jsbt readme package.json",
-    "check:treeshake": "npx --no @paulmillr/jsbt treeshake package.json test/build/out-treeshake",
-    "check:jsdoc": "npx --no @paulmillr/jsbt tsdoc package.json",
-    "build:clean": "rm *.{js,js.map,d.ts,d.ts.map} 2> /dev/null",
+    "check": "jsbt-check",
+    "build:clean": "rm *.{js,d.ts} 2> /dev/null",
     "format": "prettier --write 'src/**/*.{js,ts}' 'test/**/*.{js,ts,mjs}'",
-    "test": "node test/index.ts",
+    "test": "node --no-warnings test/index.ts",
     "test:bun": "bun test/index.ts",
     "test:deno": "deno --allow-env --allow-read test/index.ts",
-    "test:node20": "cd test; npx tsc; node compiled/test/index.js",
     "test:slow": "SLOW_TESTS=1 node test/index.ts"
   },
   "exports": {
@@ -45,7 +40,8 @@
     "./ml-dsa.js": "./ml-dsa.js",
     "./ml-kem.js": "./ml-kem.js",
     "./slh-dsa.js": "./slh-dsa.js",
-    "./utils.js": "./utils.js"
+    "./utils.js": "./utils.js",
+    "./webcrypto.js": "./webcrypto.js"
   },
   "engines": {
     "node": ">= 20.19.0"

package/slh-dsa.d.ts

@@ -40,12 +40,16 @@ export type SphincsHashOpts = {
 export declare const PARAMS: Record<string, SphincsOpts>;
 /** Address byte array of size `ADDR_BYTES`. */
 export type ADRS = Uint8Array;
-/** Hash and tweakable-hash callbacks bound to one SLH-DSA keypair context. */
+/** Hash and tweakable-hash callbacks bound to one SLH-DSA keypair context.
+ * Buffer-aliasing contract: `PRFaddr`, `thash1` and `thashN` return views into per-context
+ * scratch buffers (one per lane), so callers must consume or copy a result before the next
+ * call on the same lane. `clean()` wipes the scratch buffers along with the hash states.
+ */
 export type Context = {
     /**
      * Derive a PRF output for one address.
      * @param addr - Address bytes.
-     * @returns PRF output bytes.
+     * @returns PRF output bytes (scratch view; copy to retain).
      */
     PRFaddr: (addr: TArg<ADRS>) => TRet<Uint8Array>;
     /**
@@ -131,6 +135,23 @@ export declare const slh_dsa_shake_256s: TRet<SphincsSigner>;
  * SLH-DSA-SHA2-128f: Table 2 row `n=16, h=66, d=22, h'=3, a=6, k=33, lg w=4, m=34`;
  * lengths `publicKey=32`, `secretKey=64`, `signature=17088`, `seed=48`, `signRand=16`.
  * Also exposes `.prehash(...)`.
+ * @example
+ * Generate deterministic SLH-DSA keys, sign one message, and verify the signature.
+ * ```ts
+ * import { sha256 } from '@noble/hashes/sha2.js';
+ * import { slh_dsa_sha2_128f } from '@noble/post-quantum/slh-dsa.js';
+ * const seed = new Uint8Array(slh_dsa_sha2_128f.lengths.seed!);
+ * const { secretKey, publicKey } = slh_dsa_sha2_128f.keygen(seed);
+ * const msg = new TextEncoder().encode('hello noble');
+ * const sig = slh_dsa_sha2_128f.sign(msg, secretKey);
+ * const isValid = slh_dsa_sha2_128f.verify(sig, msg, publicKey);
+ * const recovered = slh_dsa_sha2_128f.getPublicKey(secretKey);
+ * const context = new Uint8Array([1, 2, 3]);
+ * const prehash = slh_dsa_sha2_128f.prehash(sha256);
+ * const preSig = prehash.sign(msg, secretKey, { context });
+ * const preValid = prehash.verify(preSig, msg, publicKey, { context });
+ * const internalSig = slh_dsa_sha2_128f.internal.sign(msg, secretKey);
+ * ```
  */
 export declare const slh_dsa_sha2_128f: TRet<SphincsSigner>;
 /**
@@ -163,4 +184,3 @@ export declare const slh_dsa_sha2_256f: TRet<SphincsSigner>;
  * Also exposes `.prehash(...)`.
  */
 export declare const slh_dsa_sha2_256s: TRet<SphincsSigner>;
-//# sourceMappingURL=slh-dsa.d.ts.map