@noble/post-quantum 0.7.0 → 0.7.1

package/ml-kem.js

@@ -296,8 +296,11 @@ const genKPKE = (opts_) => {
             for (let i = 0; i < K; i++)
                 polyAdd(tmp, MultiplyNTTs(sk[i], crystals.NTT.encode(u[i])));
             polySub(v, crystals.NTT.decode(tmp)); // w = v' - tmp
-            cleanBytes(tmp, sk, u);
-            return poly1.encode(v);
+            // `v` now holds w, from which the plaintext is just a 1-bit threshold away, so wipe it too.
+            // encode() allocates its own buffer, so the returned bytes do not alias `v`.
+            const res = poly1.encode(v);
+            cleanBytes(tmp, sk, u, v);
+            return res;
         },
     };
 };
@@ -305,6 +308,11 @@ const genKPKE = (opts_) => {
  * Public ML-KEM wrapper over the internal K-PKE subroutine.
  * `keygen(seed)` and `encapsulate(publicKey, msg)` are deterministic/test-oriented hooks that map
  * more directly to Algorithms 16-17 than to the pure no-input / random-internal Algorithms 19-20.
+ * `encapsulate`'s optional `msg` is the 32-byte message randomness `m` of Algorithm 17, the
+ * pre-image the shared secret is derived from, NOT a plaintext to encrypt: ML-KEM is a key
+ * encapsulation mechanism, not a cipher. Omit it to draw fresh randomness; pass it only to
+ * reproduce a known-answer vector, and only as 32 uniformly random bytes, since a low-entropy or
+ * reused value makes the shared secret predictable. The same holds for `keygen`'s optional `seed`.
  * decapsulate() tries to follow the Algorithms 18/21 implicit-reject structure as closely as
  * practical here by re-encrypting, comparing ciphertexts, returning `Khat` on match or `Kbar` on
  * mismatch, and zeroizing the non-returned shared-secret candidate; JS/JIT still provides no
@@ -340,34 +348,65 @@ function createKyber(opts) {
     return Object.freeze({
         info: Object.freeze({ type: 'ml-kem' }),
         lengths: kemLengths,
-        keygen: (seed = randomBytes(seedLen)) => {
-            abytes(seed, seedLen, 'seed');
-            const { publicKey, secretKey: sk } = KPKE.keygen(seed.subarray(0, 32));
-            const publicKeyHash = HASH256(publicKey);
-            // (dkPKE||ek||H(ek)||z)
-            const secretKey = secretCoder.encode([sk, publicKey, publicKeyHash, seed.subarray(32)]);
-            cleanBytes(sk, publicKeyHash);
-            return {
-                publicKey: publicKey,
-                secretKey: secretKey,
-            };
+        keygen: (seed) => {
+            // A generated seed carries z (the implicit-rejection secret) and must be wiped once the
+            // secret key holds a copy, matching ml-dsa / slh-dsa / falcon keygen. A caller-supplied
+            // seed is the caller's to manage (and the immutability test requires it stay untouched).
+            const ownSeed = seed === undefined;
+            const s = ownSeed ? randomBytes(seedLen) : seed;
+            let sk;
+            let publicKeyHash;
+            try {
+                abytes(s, seedLen, 'seed');
+                const keys = KPKE.keygen(s.subarray(0, 32));
+                const publicKey = keys.publicKey;
+                sk = keys.secretKey;
+                publicKeyHash = HASH256(publicKey);
+                // (dkPKE||ek||H(ek)||z)
+                const secretKey = secretCoder.encode([sk, publicKey, publicKeyHash, s.subarray(32)]);
+                return {
+                    publicKey: publicKey,
+                    secretKey: secretKey,
+                };
+            }
+            finally {
+                if (sk !== undefined)
+                    cleanBytes(sk);
+                if (publicKeyHash !== undefined)
+                    cleanBytes(publicKeyHash);
+                if (ownSeed)
+                    cleanBytes(s);
+            }
         },
         getPublicKey: (secretKey) => {
             const [_sk, publicKey, _publicKeyHash, _z] = secretCoder.decode(secretKey);
             return Uint8Array.from(publicKey);
         },
-        encapsulate: (publicKey, msg = randomBytes(msgLen)) => {
-            abytes(publicKey, lengths.publicKey, 'publicKey');
-            abytes(msg, msgLen, 'message');
-            validateModulus(publicKey, 'encapsulate');
-            // derive randomness
-            const kr = HASH512.create().update(msg).update(HASH256(publicKey)).digest();
-            const cipherText = KPKE.encrypt(publicKey, msg, kr.subarray(32, 64));
-            cleanBytes(kr.subarray(32));
-            return {
-                cipherText: cipherText,
-                sharedSecret: kr.subarray(0, 32),
-            };
+        encapsulate: (publicKey, msg) => {
+            // A generated message is the preimage of the shared secret (K = G(m || H(ek))[0:32]) and
+            // must be wiped. A caller-supplied message is the deterministic-randomness hook and the
+            // caller's to manage (the immutability test requires it stay untouched).
+            const ownMsg = msg === undefined;
+            const m = ownMsg ? randomBytes(msgLen) : msg;
+            let kr;
+            try {
+                abytes(publicKey, lengths.publicKey, 'publicKey');
+                abytes(m, msgLen, 'message');
+                validateModulus(publicKey, 'encapsulate');
+                // derive randomness
+                kr = HASH512.create().update(m).update(HASH256(publicKey)).digest();
+                const cipherText = KPKE.encrypt(publicKey, m, kr.subarray(32, 64));
+                return {
+                    cipherText: cipherText,
+                    sharedSecret: kr.subarray(0, 32),
+                };
+            }
+            finally {
+                if (kr !== undefined)
+                    cleanBytes(kr.subarray(32));
+                if (ownMsg)
+                    cleanBytes(m);
+            }
         },
         decapsulate: (cipherText, secretKey) => {
             abytes(secretKey, secretCoder.bytesLen, 'secretKey'); // 768*k + 96
@@ -406,15 +445,27 @@ function createKyber(opts) {
             const cached = KPKE.prepare(ek);
             return Object.freeze({
                 publicKey: ek,
-                encapsulate: (msg = randomBytes(msgLen)) => {
-                    abytes(msg, msgLen, 'message');
-                    const kr = HASH512.create().update(msg).update(publicKeyHash).digest();
-                    const cipherText = cached.encrypt(msg, kr.subarray(32, 64));
-                    cleanBytes(kr.subarray(32));
-                    return {
-                        cipherText: cipherText,
-                        sharedSecret: kr.subarray(0, 32),
-                    };
+                encapsulate: (msg) => {
+                    // As in the non-prepared encapsulate: a generated message is the shared-secret
+                    // preimage and is wiped; a caller-supplied one is left untouched.
+                    const ownMsg = msg === undefined;
+                    const m = ownMsg ? randomBytes(msgLen) : msg;
+                    let kr;
+                    try {
+                        abytes(m, msgLen, 'message');
+                        kr = HASH512.create().update(m).update(publicKeyHash).digest();
+                        const cipherText = cached.encrypt(m, kr.subarray(32, 64));
+                        return {
+                            cipherText: cipherText,
+                            sharedSecret: kr.subarray(0, 32),
+                        };
+                    }
+                    finally {
+                        if (kr !== undefined)
+                            cleanBytes(kr.subarray(32));
+                        if (ownMsg)
+                            cleanBytes(m);
+                    }
                 },
                 decapsulate: (cipherText, secretKey) => {
                     abytes(secretKey, secretCoder.bytesLen, 'secretKey');

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@noble/post-quantum",
-  "version": "0.7.0",
+  "version": "0.7.1",
   "description": "Auditable & minimal JS implementation of post-quantum cryptography: FIPS 203, 204, 205, Falcon",
   "files": [
     "*.js",
@@ -8,25 +8,28 @@
     "src"
   ],
   "dependencies": {
-    "@noble/ciphers": "~2.3.0",
-    "@noble/curves": "~2.3.0",
-    "@noble/hashes": "~2.3.0"
+    "@noble/ciphers": "2.4.0",
+    "@noble/curves": "2.4.0",
+    "@noble/hashes": "2.4.0"
   },
   "devDependencies": {
-    "@paulmillr/jsbt": "0.6.5",
-    "@types/node": "25.3.0",
+    "@paulmillr/jsbt": "0.7.1",
+    "bismar": "0.1.8",
+    "@types/node": "26.2.0",
     "fast-check": "4.2.0",
-    "prettier": "3.6.2",
-    "typescript": "6.0.2"
+    "prettier": "3.9.6",
+    "typescript": "6.0.3"
   },
   "scripts": {
     "benchmark": "node benchmark/pq.ts",
-    "benchmark:size": "npx bismar@0.1 -s",
+    "benchmark:size": "bismar -bsm",
     "build": "tsc",
     "check": "jsbt-check",
     "build:clean": "rm *.{js,d.ts} 2> /dev/null",
     "format": "prettier --write 'src/**/*.{js,ts}' 'test/**/*.{js,ts,mjs}'",
-    "test": "node test/index.ts",
+    "test": "node --no-warnings test/index.ts",
+    "test:bun": "bun test/index.ts",
+    "test:deno": "deno --allow-env --allow-read test/index.ts",
     "test:slow": "SLOW_TESTS=1 node test/index.ts"
   },
   "exports": {
@@ -37,7 +40,8 @@
     "./ml-dsa.js": "./ml-dsa.js",
     "./ml-kem.js": "./ml-kem.js",
     "./slh-dsa.js": "./slh-dsa.js",
-    "./utils.js": "./utils.js"
+    "./utils.js": "./utils.js",
+    "./webcrypto.js": "./webcrypto.js"
   },
   "engines": {
     "node": ">= 20.19.0"

package/slh-dsa.js

@@ -33,6 +33,12 @@ import { sha256, sha512 } from '@noble/hashes/sha2.js';
 import { shake256 } from '@noble/hashes/sha3.js';
 import { concatBytes, createView } from '@noble/hashes/utils.js';
 import { abytes, checkHash, cleanBytes, copyBytes, equalBytes, getMask, getMessage, getMessagePrehash, randomBytes, splitCoder, validateSigOpts, validateVerOpts, vecCoder, } from "./utils.js";
+// Keys the internal SLH-DSA surface accepts. `context` is deliberately absent: the public
+// wrappers consume it when they format M' and must not forward it, because a key that is
+// accepted and then never read is the same silent downgrade this validation exists to prevent.
+// `extraEntropy` is signing-only, so verification (which takes no options of its own) has none.
+const INTERNAL_SIG_OPT_KEYS = /* @__PURE__ */ Object.freeze(['extraEntropy']);
+const INTERNAL_VER_OPT_KEYS = /* @__PURE__ */ Object.freeze([]);
 /** Winternitz signature params. */
 /**
  * Built-in SLH-DSA Table 2 subset keyed by strength/profile.
@@ -128,8 +134,18 @@ function gen(opts, hashOpts_) {
     // `height` / `chain` and `index` / `hash` share the same spec words, so callers must use the
     // address-type-specific combinations instead of mixing both meanings in one call.
     const setAddr = (opts, addr = new Uint8Array(ADDR_BYTES)) => {
-        const { type, height, tree, layer, index, chain, hash, keypair } = opts;
-        const { subtreeAddr, keypairAddr } = opts;
+        // These objects are created in hot internal loops, so avoid cloning them. Read only own fields:
+        // absent address words must stay absent even if Object.prototype was polluted.
+        const type = Object.hasOwn(opts, 'type') ? opts.type : undefined;
+        const height = Object.hasOwn(opts, 'height') ? opts.height : undefined;
+        const tree = Object.hasOwn(opts, 'tree') ? opts.tree : undefined;
+        const layer = Object.hasOwn(opts, 'layer') ? opts.layer : undefined;
+        const index = Object.hasOwn(opts, 'index') ? opts.index : undefined;
+        const chain = Object.hasOwn(opts, 'chain') ? opts.chain : undefined;
+        const hash = Object.hasOwn(opts, 'hash') ? opts.hash : undefined;
+        const keypair = Object.hasOwn(opts, 'keypair') ? opts.keypair : undefined;
+        const subtreeAddr = Object.hasOwn(opts, 'subtreeAddr') ? opts.subtreeAddr : undefined;
+        const keypairAddr = Object.hasOwn(opts, 'keypairAddr') ? opts.keypairAddr : undefined;
         if (height !== undefined)
             addr[OFFSET_CHAIN_ADDR] = height;
         if (layer !== undefined)
@@ -361,7 +377,7 @@ function gen(opts, hashOpts_) {
             return Uint8Array.from(pk);
         },
         sign: (msg, sk, opts = {}) => {
-            validateSigOpts(opts);
+            opts = validateSigOpts(opts, INTERNAL_SIG_OPT_KEYS);
             let { extraEntropy: random } = opts;
             const [skSeed, skPRF, pk] = secretCoder.decode(sk); // todo: fix
             const [pkSeed, _] = publicCoder.decode(pk);
@@ -427,7 +443,11 @@ function gen(opts, hashOpts_) {
             cleanBytes(R, random, treeAddr, wotsAddr, forsLeaf, forsTreeAddr, indices, roots);
             return SIG;
         },
-        verify: (sig, msg, publicKey) => {
+        verify: (sig, msg, publicKey, opts = {}) => {
+            // The internal verify reads no options; reject any so a stray key (e.g. a caller
+            // mistaking this for the public verify and passing `context`) is reported rather than
+            // silently swallowed by this function's arity.
+            validateVerOpts(opts, INTERNAL_VER_OPT_KEYS);
             const [pkSeed, pubRoot] = publicCoder.decode(publicKey);
             const pk = publicKey;
             // FIPS 205 Algorithm 20 step 1: wrong-length signatures return false instead of throwing
@@ -503,14 +523,16 @@ function gen(opts, hashOpts_) {
         keygen: internal.keygen,
         getPublicKey: internal.getPublicKey,
         sign: (msg, secretKey, opts = {}) => {
-            validateSigOpts(opts);
+            opts = validateSigOpts(opts);
             const M = getMessage(msg, opts.context);
-            const res = internal.sign(M, secretKey, opts);
+            // `context` is consumed by getMessage() above; forwarding it would make the internal
+            // surface accept a key it never reads.
+            const res = internal.sign(M, secretKey, { extraEntropy: opts.extraEntropy });
             cleanBytes(M);
             return res;
         },
         verify: (sig, msg, publicKey, opts = {}) => {
-            validateVerOpts(opts);
+            opts = validateVerOpts(opts);
             return internal.verify(sig, getMessage(msg, opts.context), publicKey);
         },
         prehash: (hash) => {
@@ -522,14 +544,15 @@ function gen(opts, hashOpts_) {
                 keygen: internal.keygen,
                 getPublicKey: internal.getPublicKey,
                 sign: (msg, secretKey, opts = {}) => {
-                    validateSigOpts(opts);
+                    opts = validateSigOpts(opts);
                     const M = getMessagePrehash(rawHash, msg, opts.context);
-                    const res = internal.sign(M, secretKey, opts);
+                    // As above: getMessagePrehash() consumes `context`, so it must not travel further.
+                    const res = internal.sign(M, secretKey, { extraEntropy: opts.extraEntropy });
                     cleanBytes(M);
                     return res;
                 },
                 verify: (sig, msg, publicKey, opts = {}) => {
-                    validateVerOpts(opts);
+                    opts = validateVerOpts(opts);
                     return internal.verify(sig, getMessagePrehash(rawHash, msg, opts.context), publicKey);
                 },
             });
@@ -590,7 +613,7 @@ const genShake = () => (opts) => (pubSeed, skSeed) => {
         },
     };
 };
-const SHAKE_SIMPLE = /* @__PURE__ */ (() => ({ getContext: genShake() }))();
+const SHAKE_SIMPLE = /* @__PURE__ */ (() => ({ isCompressed: false, getContext: genShake() }))();
 /**
  * SLH-DSA-SHAKE-128f: Table 2 row `n=16, h=66, d=22, h'=3, a=6, k=33, lg w=4, m=34`;
  * lengths `publicKey=32`, `secretKey=64`, `signature=17088`, `seed=48`, `signRand=16`.

package/src/_crystals.ts

@@ -112,7 +112,7 @@ export const genCrystals = <T extends TypedArray>(opts: CrystalOpts<T>): TRet<Cr
   // Normalize JS `%` into the canonical Z_m representative `[0, modulo-1]` expected by
   // FIPS 203 §2.3 / FIPS 204 §2.3 before downstream mod-q arithmetic.
   const mod = (a: number, modulo = Q): number => {
-    const result = a % modulo | 0;
+    const result = (a % modulo) | 0;
     return (result >= 0 ? result | 0 : (modulo + result) | 0) | 0;
   };
   // FIPS 204 §7.4 uses the centered `mod ±` representative for low bits, keeping the