@noble/post-quantum 0.6.1 → 0.7.1

package/src/falcon.ts

@@ -27,6 +27,7 @@ import {
   baswap64If,
   type BytesCoderLen,
   cleanBytes,
+  copyBytes,
   type Coder,
   type CryptoKeys,
   getMask,
@@ -37,6 +38,7 @@ import {
   type TRet,
   validateSigOpts,
   validateVerOpts,
+  SIG_OPT_KEYS,
   type VerOpts,
 } from './utils.ts';
 /*
@@ -256,7 +258,12 @@ const compCoder = (n: number) => {
         const sign = readBits(1);
         const low = readBits(7);
         let high = 0;
-        for (; !readBits(1); high++);
+        // Reference comp_decode adds 128 for each unary zero and rejects immediately above 2047.
+        // Waiting for the terminating one first lets an invalid coefficient scan the entire input.
+        while (!readBits(1)) {
+          high++;
+          if (high > LIMIT >>> 7) throw new Error(`limit: ${low | (high << 7)} > ${LIMIT}`);
+        }
         const v = low | (high << 7);
         if (sign && v === 0) throw new Error('negative zero encoding');
         if (v > LIMIT) throw new Error(`limit: ${v} > ${LIMIT}`);
@@ -443,6 +450,17 @@ const Q: number = 12289; // 12 * 1024 + 1
 // Falcon's midpoint floor(q/2); the only live use is the mirrored G-reconstruction reduction below.
 const Qhalf: number = Q >> 1;
 const QBig = BigInt(Q);
+const _0n = /* @__PURE__ */ BigInt(0);
+const _1n = /* @__PURE__ */ BigInt(1);
+const _10n = /* @__PURE__ */ BigInt(10);
+const _25n = /* @__PURE__ */ BigInt(25);
+const _31n = /* @__PURE__ */ BigInt(31);
+const _32n = /* @__PURE__ */ BigInt(32);
+const _63n = /* @__PURE__ */ BigInt(63);
+const _64n = /* @__PURE__ */ BigInt(64);
+// Low 32 bits and low 63 bits of a bigint, used by the chacha20 counter and gaussian sampler.
+const MASK_32n = /* @__PURE__ */ BigInt('0xffffffff');
+const MASK_63n = /* @__PURE__ */ BigInt('0x7fffffffffffffff');
 //const R = 4091; // 2^16 mod q
 // This 16-bit Montgomery kernel uses R = 2^16, so mul(x, R2) converts x into Montgomery form.
 const R2 = 10952; // 2^32 mod q
@@ -479,35 +497,35 @@ const BITLENGTH = [
 // Smaller Falcon dimensions reuse the N = 1024, q = 12289 table by summing 2^(10-logn) draws.
 // The trailing 0 sentinel guarantees gaussSingle()
 // always selects a tail bucket when x = 0 is missed.
-const gauss_1024_12289 = [
-  1283868770400643928n,
-  6416574995475331444n,
-  4078260278032692663n,
-  2353523259288686585n,
-  1227179971273316331n,
-  575931623374121527n,
-  242543240509105209n,
-  91437049221049666n,
-  30799446349977173n,
-  9255276791179340n,
-  2478152334826140n,
-  590642893610164n,
-  125206034929641n,
-  23590435911403n,
-  3948334035941n,
-  586753615614n,
-  77391054539n,
-  9056793210n,
-  940121950n,
-  86539696n,
-  7062824n,
-  510971n,
-  32764n,
-  1862n,
-  94n,
-  4n,
-  0n,
-];
+const gauss_1024_12289 = /* @__PURE__ */ [
+  '1283868770400643928',
+  '6416574995475331444',
+  '4078260278032692663',
+  '2353523259288686585',
+  '1227179971273316331',
+  '575931623374121527',
+  '242543240509105209',
+  '91437049221049666',
+  '30799446349977173',
+  '9255276791179340',
+  '2478152334826140',
+  '590642893610164',
+  '125206034929641',
+  '23590435911403',
+  '3948334035941',
+  '586753615614',
+  '77391054539',
+  '9056793210',
+  '940121950',
+  '86539696',
+  '7062824',
+  '510971',
+  '32764',
+  '1862',
+  '94',
+  '4',
+  '0',
+].map(BigInt);
 
 // Exact binary64 1/sigma payloads from round-3 fpr.h. Nearby decimal spellings round 1 ULP low in
 // JS, so keep these as decoded bit patterns and recheck the raw payloads after edits.
@@ -541,6 +559,9 @@ const SIGMA_MIN = /* @__PURE__ */ Object.freeze([
   f64b(BigInt('4608433670533905013')),
   f64b(BigInt('4608525754002622308')),
 ]);
+// Upper end of the SamplerZ proof interval from Falcon section 3.9.1. The per-leaf sigma is
+// derived from the reconstructed private basis, so imported keys must be checked against it.
+const SIGMA_MAX = 1.8205;
 
 // Falcon Table 3.1 RCDT values for chi, split into 24-bit limbs; storage is [high, mid, low],
 // so gaussian0() intentionally compares them against v0, v1, v2 in reverse order. The final
@@ -1153,6 +1174,54 @@ function getFloatPoly(logn: number) {
   };
 }
 
+function ldlFFT(logn: number, g00t: CPoly, g01t: CPoly, g11t: CPoly) {
+  // Algorithm 8: LDL*(G)
+  // (Page 37)
+  // Require: A full-rank self-adjoint matrix G = (Gᵢⱼ) ∈ FFT(Q[x]/(φ))²ˣ²
+  // Ensure: The LDL* decomposition G = LDL* over FFT(Q[x]/(φ))
+  // Format: All polynomials are in FFT representation.
+  // 1: D₀₀ ← G₀₀
+  // 2: L₁₀ ← G₁₀/G₀₀
+  // 3: D₁₁ ← G₁₁ - L₁₀ ⊙ L₁₀* ⊙ G₀₀
+  // 4: L ← [ 1 0 ; L₁₀ 1 ], D ← [ D₀₀ 0 ; 0 D₁₁ ]
+  // 5: return (L, D)
+
+  // Algorithm 9: ffLDL*(G)
+  // (Page 37)
+  // Require: A full-rank Gram matrix G ∈ FFT(Q[x]/(xⁿ + 1))²ˣ²
+  // Ensure: A binary tree T
+  // Format: All polynomials are in FFT representation.
+  // 1: (L, D) ← LDL*(G) ▷ L = [ 1 0 ; L₁₀ 1 ], D = [ D₀₀ 0 ; 0 D₁₁ ]
+  // 2: T.value ← L₁₀
+  // 3: if (n = 2) then
+  // 4:     T.leftchild ← D₀₀
+  // 5:     T.rightchild ← D₁₁
+  // 6:     return T
+  // 7: else
+  // 8:     d₀₀, d₀₁ ← splitfft(D₀₀) ▷ dᵢⱼ ∈ FFT(Q[x]/(x^{n/2} + 1))
+  // 9:     d₁₀, d₁₁ ← splitfft(D₁₁)
+  // 10:     G₀ ← [ d₀₀ d₀₁ ; d₀₁* d₀₀ ], G₁ ← [ d₁₀ d₁₁ ; d₁₁* d₁₀ ]
+  //         ▷ Since D₀₀, D₁₁ are self-adjoint, (3.30) applies
+  // 11:     T.leftchild ← ffLDL*(G₀) ▷ Recursive calls
+  // 12:     T.rightchild ← ffLDL*(G₁)
+  // 13:     return T
+
+  // Recursive calls may alias g00t and g11t, and the top-level arrays persist across signing
+  // retries. LDL replaces array entries, so shallow copies keep both kinds of caller state intact.
+  g00t = g00t.slice();
+  g01t = g01t.slice();
+  g11t = g11t.slice();
+  const hn = 1 << (logn - 1);
+  for (let i = 0; i < hn; i++) {
+    const g01 = g01t[i];
+    const g11 = g11t[i];
+    const mu = fComplex.scale(g01, 1.0 / g00t[i].re);
+    g11t[i] = { re: g11.re - (mu.re * g01.re + mu.im * g01.im), im: g11.im };
+    g01t[i] = fComplex.conj(mu);
+  }
+  return { g00: g00t, g01: g01t, g11: g11t };
+}
+
 function ApproxExp(x: number, ccs: number): number {
   // Algorithm 13: ApproxExp(x, ccs), (Page 42)
   // Require: Floating-point values x ∈ [0, ln(2)] and ccs ∈ [0, 1]
@@ -1184,19 +1253,16 @@ function ApproxExp(x: number, ccs: number): number {
 // Actual api
 type FalconOpts = {
   N: number;
-  // Table 3.3 total padded detached bytes; kept as reference config, not read by genFalcon() today.
-  // In padded mode it still drives `.lengths.signature`
-  // and the payload width `sigLen - 1 - NONCELEN`.
+  // Table 3.3 total padded detached bytes. In padded mode it drives `.lengths.signature` and the
+  // payload width `sigLen - 1 - NONCELEN`.
   sigLen: number;
-  padded?: boolean;
+  padded: boolean;
   fgBits: number;
   FGBits: number;
   // Compressed-s payload bytes only, excluding the detached header byte and 40-byte nonce.
   paddedLen: number;
-  // Max compressed-s payload bytes only, excluding the detached header byte and 40-byte nonce.
-  // Reference unpadded payload ceiling only: detached encode/decode use each signature's runtime
-  // `s2` length, while signRaw() enforces `maxS2Len` separately.
-  detachedLen: number;
+  // Maximum compressed-s payload emitted by sign(). Unpadded detached verification enforces the
+  // same Round-3 ceiling before decoding.
   maxS2Len: number;
 };
 
@@ -1219,7 +1285,7 @@ export type FalconAttached = CryptoKeys & {
    * @param sig Attached Falcon signature bytes.
    * @param publicKey Falcon public key bytes.
    * @param opts Optional verification options.
-   * @returns Embedded message bytes when the signature is valid.
+   * @returns Fresh message bytes that do not alias either input when the signature is valid.
    */
   open(sig: Uint8Array, publicKey: Uint8Array, opts?: VerOpts): Uint8Array;
 };
@@ -1248,9 +1314,9 @@ function genFalcon(opts: FalconOpts): TRet<Falcon> {
       let val = 0;
       for (let i = 0; i < g; i++) {
         const r128 = bytesToNumberLE(this.shake.xof(16));
-        const r1 = r128 & 0x7fffffffffffffffn;
-        const r2 = (r128 >> 64n) & 0x7fffffffffffffffn;
-        const sign = Number((r128 >> 63n) & 1n);
+        const r1 = r128 & MASK_63n;
+        const r2 = (r128 >> _64n) & MASK_63n;
+        const sign = Number((r128 >> _63n) & _1n);
         let f = r1 < gauss_1024_12289[0] ? 1 : 0;
         let v = 0;
         for (let k = 1; k < gauss_1024_12289.length; k++) {
@@ -1283,13 +1349,13 @@ function genFalcon(opts: FalconOpts): TRet<Falcon> {
       const n = 1 << logn;
       const d = new Array(n >> 1);
       for (let k = 0; k < n; k += 2) {
-        let s: bigint = 0n;
+        let s: bigint = _0n;
         for (let i = 0; i <= k; i += 2) s += a[i] * a[k - i];
         for (let i = k + 2; i < n; i += 2) s -= a[i] * a[k + n - i];
         d[k >>> 1] = s;
       }
       for (let k = 0; k < n; k += 2) {
-        let s: bigint = 0n;
+        let s: bigint = _0n;
         for (let i = 1; i < k; i += 2) s += a[i] * a[k - i];
         for (let i = k + 1; i < n; i += 2) s -= a[i] * a[k + n - i];
         d[k >>> 1] -= s;
@@ -1299,7 +1365,7 @@ function genFalcon(opts: FalconOpts): TRet<Falcon> {
     private mulConjD(logn: number, d: BPoly, a: BPoly, b: BPoly): BPoly {
       const n = 1 << logn;
       for (let k = 0; k < n; k++) {
-        let s: bigint = 0n;
+        let s: bigint = _0n;
         for (let i = 0; i <= k; i += 2) s += b[i >>> 1] * a[k - i];
         for (let i = k + 2 - (k & 1); i < n; i += 2) s -= b[i >>> 1] * a[k + n - i];
         if ((k & 1) === 0) d[k] = s;
@@ -1310,7 +1376,7 @@ function genFalcon(opts: FalconOpts): TRet<Falcon> {
     private subMul(logn: number, a: BPoly, b: BPoly, c: BPoly, e: bigint): BPoly {
       const n = 1 << logn;
       for (let k = 0; k < n; k++) {
-        let s: bigint = 0n;
+        let s: bigint = _0n;
         for (let i = 0; i <= k; i++) s += b[i] * c[k - i];
         for (let i = k + 1; i < n; i++) s -= b[i] * c[k + n - i];
         a[k] -= s << e;
@@ -1353,7 +1419,7 @@ function genFalcon(opts: FalconOpts): TRet<Falcon> {
       const Gx = new Float64Array(n);
       const k = new Array(n);
       while (true) {
-        let scaleFG = 31n * (FGlen - 10n);
+        let scaleFG = _31n * (FGlen - _10n);
         for (let i = 0; i < n; i++) {
           Fx[i] = Number(F[i] >> scaleFG);
           Gx[i] = Number(G[i] >> scaleFG);
@@ -1373,12 +1439,12 @@ function genFalcon(opts: FalconOpts): TRet<Falcon> {
         }
         F = this.subMul(logn, F, f, k, scaleK); // 3:     F ← F - kf
         G = this.subMul(logn, G, g, k, scaleK); // 4:     G ← G - kg
-        const maxfgNew = scaleK + BigInt(Math.round(fgMaxBits)) + 10n;
+        const maxfgNew = scaleK + BigInt(Math.round(fgMaxBits)) + _10n;
         if (maxfgNew < maxFGBits) maxFGBits = maxfgNew;
-        if (FGlen > 1n && FGlen * 31n >= maxFGBits + 31n) FGlen--;
-        if (scaleK <= 0n) break;
-        scaleK -= 25n;
-        if (scaleK < 0n) scaleK = 0n;
+        if (FGlen > _1n && FGlen * _31n >= maxFGBits + _31n) FGlen--;
+        if (scaleK <= _0n) break;
+        scaleK -= _25n;
+        if (scaleK < _0n) scaleK = _0n;
       }
       return true;
     }
@@ -1406,10 +1472,10 @@ function genFalcon(opts: FalconOpts): TRet<Falcon> {
         const xf = f[0];
         const xg = g[0];
         // We can rely on 'invert' to throw if they are not coprime.
-        if (xf <= 0n || xg <= 0n) return false;
+        if (xf <= _0n || xg <= _0n) return false;
         try {
           const u1 = invert(xf, xg); //  if gcd(f, g) ≠ 1 then
-          const v1 = (1n - u1 * xf) / xg;
+          const v1 = (_1n - u1 * xf) / xg;
           F[0] = -v1 * QBig; // 5:     (F, G) ← (vq, uq)
           G[0] = u1 * QBig;
           return true;
@@ -1672,7 +1738,13 @@ function genFalcon(opts: FalconOpts): TRet<Falcon> {
         ).encode([nonce, pad(sigLen).encode(s2), msg]);
       },
       decode(data: TArg<Uint8Array>): TRet<SignatureRaw> {
+        // Keep API misuse on the coder's TypeError path before reading the container length.
+        abytes(data, undefined, 'signature');
+        // The compressed-signature field is fixed-width here; only the message is variable. A
+        // container shorter than the fixed part would make the s2 field borrow bytes from nowhere
+        // and let a truncated encoding open to the same message.
         const msgLen = data.length - NONCELEN - sigLen - 1;
+        if (msgLen < 0) throw new Error('signature coder: wrong length');
         const [nonce, s2, msg] = headerCoder(
           0x30 + logn,
           splitCoder('falcon.signature', NONCELEN, sigLen, msgLen)
@@ -1683,22 +1755,33 @@ function genFalcon(opts: FalconOpts): TRet<Falcon> {
   };
   // [ 1B header ] [ 40B nonce ] [ compressed_sig ]
   const SignatureCoderDetached = (logn: number) => {
-    const sigLen = opts.padded ? opts.sigLen - 1 - NONCELEN : opts.detachedLen;
-    const getSigLen = (s2: TArg<Uint8Array>) => (opts.padded ? sigLen : s2.length);
+    const paddedSigLen = opts.sigLen - 1 - NONCELEN;
+    const getSigLen = (s2: TArg<Uint8Array>) => (opts.padded ? paddedSigLen : s2.length);
     return {
       encode({ nonce, s2 }: TArg<{ nonce: Uint8Array; s2: Uint8Array }>): TRet<Uint8Array> {
         return headerCoder(
           0x30 + logn,
           splitCoder('falcon.detachedSignature', NONCELEN, getSigLen(s2))
-        ).encode([nonce, opts.padded ? pad(sigLen).encode(s2) : s2]);
+        ).encode([nonce, opts.padded ? pad(paddedSigLen).encode(s2) : s2]);
       },
       decode(data: TArg<Uint8Array>): TRet<{
         nonce: Uint8Array;
         s2: Uint8Array;
       }> {
+        // Unpadded Round-3 signatures have parameter-set maxima (header + nonce + s2):
+        // 752 bytes for Falcon-512 and 1462 for Falcon-1024. Reject before creating views or
+        // entering the bit decoder so attacker-sized inputs cannot cause proportional work.
+        if (!opts.padded && data.length > 1 + NONCELEN + opts.maxS2Len)
+          throw new Error('detached signature too long');
+        // Padded detached signatures are fixed-length (`lengths.signature`), so the payload width
+        // must come from the parameter set, not from the input: deriving it would accept appended
+        // zero bytes and truncated padding as extra valid encodings of the same signature.
+        // Unpadded signatures are variable-length; decodeUnpaddedSig() enforces the exact canonical
+        // bitlength of whatever remains.
+        const payloadLen = opts.padded ? paddedSigLen : data.length - NONCELEN - 1;
         const [nonce, raw] = headerCoder(
           0x30 + logn,
-          splitCoder('falcon.detachedSignature', NONCELEN, data.length - NONCELEN - 1)
+          splitCoder('falcon.detachedSignature', NONCELEN, payloadLen)
         ).decode(data);
         const s2 = decodeSig(raw);
         return { nonce, s2 } as TRet<{ nonce: Uint8Array; s2: Uint8Array }>;
@@ -1769,7 +1852,7 @@ function genFalcon(opts: FalconOpts): TRet<Falcon> {
     // Round-3 Falcon keeps 16-bit draws only in 0..61444, i.e. below 61445 = 5*q, the largest
     // 16-bit multiple of q below 2^16; a literal ceil(2^16/q)*q would accept every sample.
     const kQ = 5 * Q;
-    for (let i = 0; i < N; ) {
+    for (let i = 0; i < N;) {
       const tmp = h.xof(2); // 6:     t ← SHAKE-256-Extract(ctx, 16)
       let w = (tmp[0] << 8) | tmp[1];
       if (w < kQ) c[i++] = w % Q; // 8:         cᵢ ← t mod q
@@ -1785,7 +1868,7 @@ function genFalcon(opts: FalconOpts): TRet<Falcon> {
     private shakeBuf: Uint8Array;
     private ctrView: DataView;
     // ChaCha
-    private ctr: bigint = 0n;
+    private ctr: bigint = _0n;
     private buf: Uint8Array;
     private buf32: Uint32Array;
     private pos: number;
@@ -1835,8 +1918,8 @@ function genFalcon(opts: FalconOpts): TRet<Falcon> {
       const out32 = swap32IfBE(this.buf32);
       for (let i = 0; i < 8; i++, this.ctr++) {
         const n = swap32IfBE(this.nonce32.slice()); // [n0, n1, n2, n3]
-        n[2] ^= Number(this.ctr & 0xffffffffn);
-        n[3] ^= Number(this.ctr >> 32n);
+        n[2] ^= Number(this.ctr & MASK_32n);
+        n[3] ^= Number(this.ctr >> _32n);
         // chacha20() takes raw nonce bytes; on BE the word-normalized temp must be swapped back.
         swap32IfBE(n.subarray(1));
         chacha20(this.key, u8(n.subarray(1)), EMPTY_CHACHA20_BLOCK, this.curBlock, n[0]);
@@ -1947,48 +2030,6 @@ function genFalcon(opts: FalconOpts): TRet<Falcon> {
         if (this.berExp(x, ccs)) return s + z;
       }
     }
-    private ldlFFT(logn: number, g00t: CPoly, g01t: CPoly, g11t: CPoly) {
-      // Algorithm 8: LDL*(G)
-      // (Page 37)
-      // Require: A full-rank self-adjoint matrix G = (Gᵢⱼ) ∈ FFT(Q[x]/(φ))²ˣ²
-      // Ensure: The LDL* decomposition G = LDL* over FFT(Q[x]/(φ))
-      // Format: All polynomials are in FFT representation.
-      // 1: D₀₀ ← G₀₀
-      // 2: L₁₀ ← G₁₀/G₀₀
-      // 3: D₁₁ ← G₁₁ - L₁₀ ⊙ L₁₀* ⊙ G₀₀
-      // 4: L ← [ 1 0 ; L₁₀ 1 ], D ← [ D₀₀ 0 ; 0 D₁₁ ]
-      // 5: return (L, D)
-
-      // Algorithm 9: ffLDL*(G)
-      // (Page 37)
-      // Require: A full-rank Gram matrix G ∈ FFT(Q[x]/(xⁿ + 1))²ˣ²
-      // Ensure: A binary tree T
-      // Format: All polynomials are in FFT representation.
-      // 1: (L, D) ← LDL*(G) ▷ L = [ 1 0 ; L₁₀ 1 ], D = [ D₀₀ 0 ; 0 D₁₁ ]
-      // 2: T.value ← L₁₀
-      // 3: if (n = 2) then
-      // 4:     T.leftchild ← D₀₀
-      // 5:     T.rightchild ← D₁₁
-      // 6:     return T
-      // 7: else
-      // 8:     d₀₀, d₀₁ ← splitfft(D₀₀) ▷ dᵢⱼ ∈ FFT(Q[x]/(x^{n/2} + 1))
-      // 9:     d₁₀, d₁₁ ← splitfft(D₁₁)
-      // 10:     G₀ ← [ d₀₀ d₀₁ ; d₀₁* d₀₀ ], G₁ ← [ d₁₀ d₁₁ ; d₁₁* d₁₀ ]
-      //         ▷ Since D₀₀, D₁₁ are self-adjoint, (3.30) applies
-      // 11:     T.leftchild ← ffLDL*(G₀) ▷ Recursive calls
-      // 12:     T.rightchild ← ffLDL*(G₁)
-      // 13:     return T
-      g00t = g00t.slice(); // can be same as g11t and everything will break!
-      const hn = 1 << (logn - 1);
-      for (let i = 0; i < hn; i++) {
-        const g01 = g01t[i];
-        const g11 = g11t[i];
-        const mu = fComplex.scale(g01, 1.0 / g00t[i].re);
-        g11t[i] = { re: g11.re - (mu.re * g01.re + mu.im * g01.im), im: g11.im };
-        g01t[i] = fComplex.conj(mu);
-      }
-      return { g00: g00t, g01: g01t, g11: g11t };
-    }
     private splitFFT(logn: number, f: CPoly) {
       // Algorithm 1: splitfft(FFT(f))
       // (Page 29)
@@ -2104,7 +2145,13 @@ function genFalcon(opts: FalconOpts): TRet<Falcon> {
       // 13: z₀ ← mergefft(z'₀)
       // 14: return z = (z₀, z₁)
       if (logn === 0) {
+        // The dynamic sampler stores 1/σ' instead of σ'. Keygen guarantees this interval,
+        // but an imported compact key may reconstruct an invalid basis. Check the actual LDL*
+        // leaf before it can drive SamplerZ; the negated comparison also rejects NaN/infinity.
         const leaf = Math.sqrt(g00i[0].re) * INV_SIGMA[this.logn];
+        const sigmaPrime = 1 / leaf;
+        if (!(sigmaPrime >= SIGMA_MIN[this.logn] && sigmaPrime <= SIGMA_MAX))
+          throw new Error('invalid secretKey: sampler sigma out of range');
         // 3:     z₀ ← SamplerZ(t₀, σ')
         //        ▷ Since n=1, tᵢ = invFFT(tᵢ) ∈ Q and zᵢ = invFFT(zᵢ) ∈ Z
         const t0re = this.samplerZ(t0[0].re, leaf);
@@ -2112,7 +2159,7 @@ function genFalcon(opts: FalconOpts): TRet<Falcon> {
         return { t0: [{ re: t0re, im: 0.0 }], t1: [{ re: t1re, im: 0.0 }] };
       }
       // 6: (l, T₀, T₁) ← (T.value, T.leftchild, T.rightchild)
-      const { g00, g01, g11 } = this.ldlFFT(logn, g00i, g01i, g11i);
+      const { g00, g01, g11 } = ldlFFT(logn, g00i, g01i, g11i);
       const { f0: g00f0, f1: g00f1 } = this.splitSelfAdjFFT(logn, g00);
       const { f0: g11f0, f1: g11f1 } = this.splitSelfAdjFFT(logn, g11);
       // 7: t'₁ ← splitfft(t₁)
@@ -2181,7 +2228,8 @@ function genFalcon(opts: FalconOpts): TRet<Falcon> {
     //         ▷ Remove 1 byte for the header, and 40 bytes for r
     // 11: while (s = ⊥)
     // 12: return sig = (r, s)
-    abytes(msg);
+    abytes(msg, undefined, 'msg');
+    abytes(sk, secretKeyCoder.bytesLen, 'secretKey');
     // One RNG stream drives both the public 40-byte nonce and the 48-byte sampler seed, so
     // deterministic rnd hooks make signatures deterministic for fixed secretKey/message inputs.
     const nonce = rnd(40);
@@ -2284,11 +2332,18 @@ function genFalcon(opts: FalconOpts): TRet<Falcon> {
     publicKey: publicKeyCoder.bytesLen,
     secretKey: secretKeyCoder.bytesLen,
   });
+  // Falcon takes a sampler callback the other schemes do not, and rejects `context`
+  // with its own message; both stay in the accepted set so the specific errors fire.
+  const FALCON_SIG_OPT_KEYS = [...SIG_OPT_KEYS, 'random'] as const;
   // Noble exposes a 48-byte sampler-seed hook,
   // but Falcon still samples/encodes a separate 40-byte nonce per signature.
   const getRnd = (opts: TArg<FalconSigOpts> = {}): TRet<FalconRandom> => {
-    validateSigOpts(opts);
+    // `context` stays in the accepted set so the specific "not supported" error below
+    // still fires, rather than the generic unexpected-option one.
+    opts = validateSigOpts(opts, FALCON_SIG_OPT_KEYS);
     if (opts.context !== undefined) throw new Error('context is not supported');
+    if (opts.random !== undefined && typeof opts.random !== 'function')
+      throw new TypeError('"opts.random" expected function, got type=' + typeof opts.random);
     if (opts.random !== undefined) return opts.random as TRet<FalconRandom>;
     if (opts.extraEntropy === undefined) return randomBytes;
     const seed = opts.extraEntropy === false ? new Uint8Array(48) : opts.extraEntropy;
@@ -2297,8 +2352,8 @@ function genFalcon(opts: FalconOpts): TRet<Falcon> {
     return (len = 0) => drbg.randomBytes(len) as TRet<Uint8Array>;
   };
   const checkVerOpts = (opts: TArg<VerOpts> = {}) => {
-    validateVerOpts(opts);
-    if (opts.context !== undefined) throw new Error('context is not supported');
+    const normalized = validateVerOpts(opts);
+    if (normalized.context !== undefined) throw new Error('context is not supported');
   };
   const tests = Object.freeze({
     publicKeyCoder: Object.freeze(publicKeyCoder),
@@ -2328,6 +2383,7 @@ function genFalcon(opts: FalconOpts): TRet<Falcon> {
     }>;
   };
   const getPublicKey = (sk: TArg<Uint8Array>): TRet<Uint8Array> => {
+    abytes(sk, secretKeyCoder.bytesLen, 'secretKey');
     const [f, g, F] = secretKeyCoder.decode(sk);
     try {
       const h = computePublic(f, g);
@@ -2358,9 +2414,10 @@ function genFalcon(opts: FalconOpts): TRet<Falcon> {
     verOpts: TArg<VerOpts> = {}
   ) => {
     checkVerOpts(verOpts);
-    abytes(sig);
-    abytes(msg);
-    abytes(pk);
+    abytes(sig, undefined, 'signature');
+    abytes(msg, undefined, 'msg');
+    // Length/canonical public-key failures are decoded below and return false; only type is fatal.
+    abytes(pk, undefined, 'publicKey');
     try {
       const { s2, nonce } = SignatureCoderDetached(logn).decode(sig);
       return verifyRaw(pk, s2, nonce, msg);
@@ -2379,11 +2436,39 @@ function genFalcon(opts: FalconOpts): TRet<Falcon> {
     },
     open(sig: TArg<Uint8Array>, pk: TArg<Uint8Array>, verOpts: TArg<VerOpts> = {}) {
       checkVerOpts(verOpts);
-      const { s2, nonce, msg } = SignatureCoder.decode(sig);
-      // Zero-copy API: returned message aliases the caller-provided signature buffer.
-      // Copy it if ownership is needed.
-      if (verifyRaw(pk, s2, nonce, msg)) return msg;
-      throw new Error('invalid signature');
+      // Wrong argument types are caller bugs and must stay TypeErrors; only what happens
+      // after this is untrusted input. Detached verify() type-checks the public key the same
+      // way, so open() does too: a wrong type is fatal, and a malformed (wrong-length or
+      // non-canonical) key folds into the single rejection below rather than leaking a raw
+      // codec error, exactly as detached verify() folds it into `false`.
+      abytes(sig, undefined, 'signature');
+      abytes(pk, undefined, 'publicKey');
+      // Decode and verify owned snapshots. Apart from keeping the authenticated result stable
+      // after open() returns, this ensures every verification step observes the same bytes when
+      // an input is backed by SharedArrayBuffer or has subclass-overridden view methods.
+      const ownedSig = copyBytes(sig);
+      const ownedPk = copyBytes(pk);
+      // Decode failures and malformed-key failures are rejected signatures, not internal
+      // faults. Letting the codec's own errors out gave a caller handling untrusted input
+      // several different messages for one corrupt byte, including "end of buffer: len=2
+      // buf=0 lastByte=undefined", which reads as a library bug. Detached verify already
+      // treats every such failure uniformly; open() collapses them into one Error (the
+      // original preserved as `cause`). A well-formed signature that simply does not
+      // validate falls through to the same message with no cause.
+      try {
+        let verifiedMsg: Uint8Array | undefined;
+        try {
+          const { s2, nonce, msg } = SignatureCoder.decode(ownedSig);
+          if (verifyRaw(ownedPk, s2, nonce, msg)) verifiedMsg = msg;
+        } catch (cause) {
+          throw new Error('invalid signature', { cause });
+        }
+        if (verifiedMsg === undefined) throw new Error('invalid signature');
+        // Do not retain or expose the full attached-signature allocation through `.buffer`.
+        return copyBytes(verifiedMsg);
+      } finally {
+        cleanBytes(ownedSig, ownedPk);
+      }
     },
   });
   const res = {
@@ -2401,14 +2486,14 @@ function genFalcon(opts: FalconOpts): TRet<Falcon> {
 
 const falcon512opts = {
   N: 512,
+  // Keep the mode an own property: omitted config fields must not inherit from Object.prototype.
+  padded: false,
   // Table 3.3 fixed padded detached bytes, including the detached header byte and 40-byte nonce.
   sigLen: 666,
   fgBits: 6,
   FGBits: 8,
   // Compressed-s payload bytes only, excluding the detached header byte and 40-byte nonce.
   paddedLen: 625,
-  // Payload-only budget: genFalcon() adds the detached header byte and 40-byte nonce around it.
-  detachedLen: 690,
 };
 /**
  * Falcon-512 detached-signature API with the attached helper exposed as `.attached`.
@@ -2443,14 +2528,13 @@ export const falcon512padded: TRet<Falcon> = /* @__PURE__ */ (() =>
 
 const falcon1024opts = {
   N: 1024,
+  padded: false,
   // Table 3.3 fixed padded detached bytes, including the detached header byte and 40-byte nonce.
   sigLen: 1280,
   fgBits: 5,
   FGBits: 8,
   // Compressed-s payload bytes only, excluding the detached header byte and 40-byte nonce.
   paddedLen: 1239,
-  // Payload-only budget: genFalcon() adds the detached header byte and 40-byte nonce around it.
-  detachedLen: 1280,
 };
 /**
  * Falcon-1024 detached-signature API with the attached helper exposed as `.attached`.
@@ -2495,6 +2579,7 @@ export const __tests: any = /* @__PURE__ */ (() =>
     INV_SIGMA,
     SIGMA_MIN,
     getFloatPoly,
+    ldlFFT,
     cleanCPoly,
     falcon512: (falcon512 as any).__test,
     falcon512padded: (falcon512padded as any).__test,