@noble/post-quantum 0.7.0 → 0.7.1

package/src/ml-kem.ts

@@ -222,7 +222,7 @@ function SampleNTT(xof_: TArg<XofGet>): TRet<Poly> {
   // The reader must already bind the Algorithm 7 seed||j||i bytes
   // and return block lengths divisible by 3.
   const r: Poly = new Uint16Array(N);
-  for (let j = 0; j < N; ) {
+  for (let j = 0; j < N;) {
     const b = xof();
     if (b.length % 3) throw new Error('SampleNTT: unaligned block');
     for (let i = 0; j < N && i + 3 <= b.length; i += 3) {
@@ -399,8 +399,11 @@ const genKPKE = (opts_: TArg<KyberOpts>) => {
       // tmp += sk[i] * u[i]
       for (let i = 0; i < K; i++) polyAdd(tmp, MultiplyNTTs(sk[i], crystals.NTT.encode(u[i])));
       polySub(v, crystals.NTT.decode(tmp)); // w = v' - tmp
-      cleanBytes(tmp, sk, u);
-      return poly1.encode(v) as TRet<Uint8Array>;
+      // `v` now holds w, from which the plaintext is just a 1-bit threshold away, so wipe it too.
+      // encode() allocates its own buffer, so the returned bytes do not alias `v`.
+      const res = poly1.encode(v) as TRet<Uint8Array>;
+      cleanBytes(tmp, sk, u, v);
+      return res;
     },
   };
 };
@@ -409,6 +412,11 @@ const genKPKE = (opts_: TArg<KyberOpts>) => {
  * Public ML-KEM wrapper over the internal K-PKE subroutine.
  * `keygen(seed)` and `encapsulate(publicKey, msg)` are deterministic/test-oriented hooks that map
  * more directly to Algorithms 16-17 than to the pure no-input / random-internal Algorithms 19-20.
+ * `encapsulate`'s optional `msg` is the 32-byte message randomness `m` of Algorithm 17, the
+ * pre-image the shared secret is derived from, NOT a plaintext to encrypt: ML-KEM is a key
+ * encapsulation mechanism, not a cipher. Omit it to draw fresh randomness; pass it only to
+ * reproduce a known-answer vector, and only as 32 uniformly random bytes, since a low-entropy or
+ * reused value makes the shared secret predictable. The same holds for `keygen`'s optional `seed`.
  * decapsulate() tries to follow the Algorithms 18/21 implicit-reject structure as closely as
  * practical here by re-encrypting, comparing ciphertexts, returning `Khat` on match or `Kbar` on
  * mismatch, and zeroizing the non-returned shared-secret candidate; JS/JIT still provides no
@@ -443,34 +451,58 @@ function createKyber(opts: TArg<KyberOpts>): TRet<MLKEM> {
   return Object.freeze({
     info: Object.freeze({ type: 'ml-kem' }),
     lengths: kemLengths,
-    keygen: (seed: TArg<Uint8Array> = randomBytes(seedLen)) => {
-      abytes(seed, seedLen, 'seed');
-      const { publicKey, secretKey: sk } = KPKE.keygen(seed.subarray(0, 32));
-      const publicKeyHash = HASH256(publicKey);
-      // (dkPKE||ek||H(ek)||z)
-      const secretKey = secretCoder.encode([sk, publicKey, publicKeyHash, seed.subarray(32)]);
-      cleanBytes(sk, publicKeyHash);
-      return {
-        publicKey: publicKey as TRet<Uint8Array>,
-        secretKey: secretKey as TRet<Uint8Array>,
-      };
+    keygen: (seed?: TArg<Uint8Array>) => {
+      // A generated seed carries z (the implicit-rejection secret) and must be wiped once the
+      // secret key holds a copy, matching ml-dsa / slh-dsa / falcon keygen. A caller-supplied
+      // seed is the caller's to manage (and the immutability test requires it stay untouched).
+      const ownSeed = seed === undefined;
+      const s = ownSeed ? randomBytes(seedLen) : (seed as TArg<Uint8Array>);
+      let sk: Uint8Array | undefined;
+      let publicKeyHash: Uint8Array | undefined;
+      try {
+        abytes(s, seedLen, 'seed');
+        const keys = KPKE.keygen(s.subarray(0, 32));
+        const publicKey = keys.publicKey;
+        sk = keys.secretKey as Uint8Array;
+        publicKeyHash = HASH256(publicKey);
+        // (dkPKE||ek||H(ek)||z)
+        const secretKey = secretCoder.encode([sk, publicKey, publicKeyHash, s.subarray(32)]);
+        return {
+          publicKey: publicKey as TRet<Uint8Array>,
+          secretKey: secretKey as TRet<Uint8Array>,
+        };
+      } finally {
+        if (sk !== undefined) cleanBytes(sk);
+        if (publicKeyHash !== undefined) cleanBytes(publicKeyHash);
+        if (ownSeed) cleanBytes(s);
+      }
     },
     getPublicKey: (secretKey: TArg<Uint8Array>): TRet<Uint8Array> => {
       const [_sk, publicKey, _publicKeyHash, _z] = secretCoder.decode(secretKey);
       return Uint8Array.from(publicKey) as TRet<Uint8Array>;
     },
-    encapsulate: (publicKey: TArg<Uint8Array>, msg: TArg<Uint8Array> = randomBytes(msgLen)) => {
-      abytes(publicKey, lengths.publicKey, 'publicKey');
-      abytes(msg, msgLen, 'message');
-      validateModulus(publicKey, 'encapsulate');
-      // derive randomness
-      const kr = HASH512.create().update(msg).update(HASH256(publicKey)).digest();
-      const cipherText = KPKE.encrypt(publicKey, msg, kr.subarray(32, 64));
-      cleanBytes(kr.subarray(32));
-      return {
-        cipherText: cipherText as TRet<Uint8Array>,
-        sharedSecret: kr.subarray(0, 32) as TRet<Uint8Array>,
-      };
+    encapsulate: (publicKey: TArg<Uint8Array>, msg?: TArg<Uint8Array>) => {
+      // A generated message is the preimage of the shared secret (K = G(m || H(ek))[0:32]) and
+      // must be wiped. A caller-supplied message is the deterministic-randomness hook and the
+      // caller's to manage (the immutability test requires it stay untouched).
+      const ownMsg = msg === undefined;
+      const m = ownMsg ? randomBytes(msgLen) : (msg as TArg<Uint8Array>);
+      let kr: Uint8Array | undefined;
+      try {
+        abytes(publicKey, lengths.publicKey, 'publicKey');
+        abytes(m, msgLen, 'message');
+        validateModulus(publicKey, 'encapsulate');
+        // derive randomness
+        kr = HASH512.create().update(m).update(HASH256(publicKey)).digest();
+        const cipherText = KPKE.encrypt(publicKey, m, kr.subarray(32, 64));
+        return {
+          cipherText: cipherText as TRet<Uint8Array>,
+          sharedSecret: kr.subarray(0, 32) as TRet<Uint8Array>,
+        };
+      } finally {
+        if (kr !== undefined) cleanBytes(kr.subarray(32));
+        if (ownMsg) cleanBytes(m);
+      }
     },
     decapsulate: (cipherText: TArg<Uint8Array>, secretKey: TArg<Uint8Array>): TRet<Uint8Array> => {
       abytes(secretKey, secretCoder.bytesLen, 'secretKey'); // 768*k + 96
@@ -509,15 +541,24 @@ function createKyber(opts: TArg<KyberOpts>): TRet<MLKEM> {
       const cached = KPKE.prepare(ek);
       return Object.freeze({
         publicKey: ek as TRet<Uint8Array>,
-        encapsulate: (msg: TArg<Uint8Array> = randomBytes(msgLen)) => {
-          abytes(msg, msgLen, 'message');
-          const kr = HASH512.create().update(msg).update(publicKeyHash).digest();
-          const cipherText = cached.encrypt(msg, kr.subarray(32, 64));
-          cleanBytes(kr.subarray(32));
-          return {
-            cipherText: cipherText as TRet<Uint8Array>,
-            sharedSecret: kr.subarray(0, 32) as TRet<Uint8Array>,
-          };
+        encapsulate: (msg?: TArg<Uint8Array>) => {
+          // As in the non-prepared encapsulate: a generated message is the shared-secret
+          // preimage and is wiped; a caller-supplied one is left untouched.
+          const ownMsg = msg === undefined;
+          const m = ownMsg ? randomBytes(msgLen) : (msg as TArg<Uint8Array>);
+          let kr: Uint8Array | undefined;
+          try {
+            abytes(m, msgLen, 'message');
+            kr = HASH512.create().update(m).update(publicKeyHash).digest();
+            const cipherText = cached.encrypt(m, kr.subarray(32, 64));
+            return {
+              cipherText: cipherText as TRet<Uint8Array>,
+              sharedSecret: kr.subarray(0, 32) as TRet<Uint8Array>,
+            };
+          } finally {
+            if (kr !== undefined) cleanBytes(kr.subarray(32));
+            if (ownMsg) cleanBytes(m);
+          }
         },
         decapsulate: (
           cipherText: TArg<Uint8Array>,

package/src/slh-dsa.ts

@@ -53,6 +53,13 @@ import {
   type VerOpts,
 } from './utils.ts';
 
+// Keys the internal SLH-DSA surface accepts. `context` is deliberately absent: the public
+// wrappers consume it when they format M' and must not forward it, because a key that is
+// accepted and then never read is the same silent downgrade this validation exists to prevent.
+// `extraEntropy` is signing-only, so verification (which takes no options of its own) has none.
+const INTERNAL_SIG_OPT_KEYS = /* @__PURE__ */ Object.freeze(['extraEntropy'] as const);
+const INTERNAL_VER_OPT_KEYS = /* @__PURE__ */ Object.freeze([] as const);
+
 /**
  * * N: Security parameter (in bytes). W: Winternitz parameter
  * * H: Hypertree height. D: Hypertree layers
@@ -83,6 +90,8 @@ export type SphincsHashOpts = {
   getContext: GetContext;
 };
 
+type InternalSphincsHashOpts = SphincsHashOpts & { isCompressed: boolean };
+
 /** Winternitz signature params. */
 /**
  * Built-in SLH-DSA Table 2 subset keyed by strength/profile.
@@ -218,8 +227,8 @@ export type SphincsSigner = Signer & {
  * and `getPublicKey(secretKey)` only extracts the embedded public key
  * instead of recomputing `PK.root`.
  */
-function gen(opts: SphincsOpts, hashOpts_: TArg<SphincsHashOpts>): TRet<SphincsSigner> {
-  const hashOpts = hashOpts_ as SphincsHashOpts;
+function gen(opts: SphincsOpts, hashOpts_: TArg<InternalSphincsHashOpts>): TRet<SphincsSigner> {
+  const hashOpts = hashOpts_ as InternalSphincsHashOpts;
   const { N, W, H, D, K, A, securityLevel: securityLevel } = opts;
   const getContext = hashOpts.getContext(opts);
   if (W !== 16) throw new Error('Unsupported Winternitz parameter');
@@ -270,8 +279,18 @@ function gen(opts: SphincsOpts, hashOpts_: TArg<SphincsHashOpts>): TRet<SphincsS
     }>,
     addr: TArg<ADRS> = new Uint8Array(ADDR_BYTES)
   ) => {
-    const { type, height, tree, layer, index, chain, hash, keypair } = opts;
-    const { subtreeAddr, keypairAddr } = opts;
+    // These objects are created in hot internal loops, so avoid cloning them. Read only own fields:
+    // absent address words must stay absent even if Object.prototype was polluted.
+    const type = Object.hasOwn(opts, 'type') ? opts.type : undefined;
+    const height = Object.hasOwn(opts, 'height') ? opts.height : undefined;
+    const tree = Object.hasOwn(opts, 'tree') ? opts.tree : undefined;
+    const layer = Object.hasOwn(opts, 'layer') ? opts.layer : undefined;
+    const index = Object.hasOwn(opts, 'index') ? opts.index : undefined;
+    const chain = Object.hasOwn(opts, 'chain') ? opts.chain : undefined;
+    const hash = Object.hasOwn(opts, 'hash') ? opts.hash : undefined;
+    const keypair = Object.hasOwn(opts, 'keypair') ? opts.keypair : undefined;
+    const subtreeAddr = Object.hasOwn(opts, 'subtreeAddr') ? opts.subtreeAddr : undefined;
+    const keypairAddr = Object.hasOwn(opts, 'keypairAddr') ? opts.keypairAddr : undefined;
 
     if (height !== undefined) addr[OFFSET_CHAIN_ADDR] = height;
     if (layer !== undefined) addr[OFFSET_LAYER] = layer;
@@ -547,7 +566,7 @@ function gen(opts: SphincsOpts, hashOpts_: TArg<SphincsHashOpts>): TRet<SphincsS
       return Uint8Array.from(pk) as TRet<Uint8Array>;
     },
     sign: (msg: TArg<Uint8Array>, sk: TArg<Uint8Array>, opts: TArg<SigOpts> = {}) => {
-      validateSigOpts(opts);
+      opts = validateSigOpts(opts, INTERNAL_SIG_OPT_KEYS);
       let { extraEntropy: random } = opts;
       const [skSeed, skPRF, pk] = secretCoder.decode(sk); // todo: fix
       const [pkSeed, _] = publicCoder.decode(pk);
@@ -623,7 +642,16 @@ function gen(opts: SphincsOpts, hashOpts_: TArg<SphincsHashOpts>): TRet<SphincsS
       cleanBytes(R, random, treeAddr, wotsAddr, forsLeaf, forsTreeAddr, indices, roots);
       return SIG as TRet<Uint8Array>;
     },
-    verify: (sig: TArg<Uint8Array>, msg: TArg<Uint8Array>, publicKey: TArg<Uint8Array>) => {
+    verify: (
+      sig: TArg<Uint8Array>,
+      msg: TArg<Uint8Array>,
+      publicKey: TArg<Uint8Array>,
+      opts: TArg<VerOpts> = {}
+    ) => {
+      // The internal verify reads no options; reject any so a stray key (e.g. a caller
+      // mistaking this for the public verify and passing `context`) is reported rather than
+      // silently swallowed by this function's arity.
+      validateVerOpts(opts, INTERNAL_VER_OPT_KEYS);
       const [pkSeed, pubRoot] = publicCoder.decode(publicKey);
       const pk = publicKey;
       // FIPS 205 Algorithm 20 step 1: wrong-length signatures return false instead of throwing
@@ -700,9 +728,11 @@ function gen(opts: SphincsOpts, hashOpts_: TArg<SphincsHashOpts>): TRet<SphincsS
     keygen: internal.keygen,
     getPublicKey: internal.getPublicKey,
     sign: (msg: TArg<Uint8Array>, secretKey: TArg<Uint8Array>, opts: TArg<SigOpts> = {}) => {
-      validateSigOpts(opts);
+      opts = validateSigOpts(opts);
       const M = getMessage(msg, opts.context);
-      const res = internal.sign(M, secretKey, opts);
+      // `context` is consumed by getMessage() above; forwarding it would make the internal
+      // surface accept a key it never reads.
+      const res = internal.sign(M, secretKey, { extraEntropy: opts.extraEntropy });
       cleanBytes(M);
       return res as TRet<Uint8Array>;
     },
@@ -712,7 +742,7 @@ function gen(opts: SphincsOpts, hashOpts_: TArg<SphincsHashOpts>): TRet<SphincsS
       publicKey: TArg<Uint8Array>,
       opts: TArg<VerOpts> = {}
     ) => {
-      validateVerOpts(opts);
+      opts = validateVerOpts(opts);
       return internal.verify(sig, getMessage(msg, opts.context), publicKey);
     },
     prehash: (hash: TArg<CHash>): TRet<Signer> => {
@@ -724,9 +754,10 @@ function gen(opts: SphincsOpts, hashOpts_: TArg<SphincsHashOpts>): TRet<SphincsS
         keygen: internal.keygen,
         getPublicKey: internal.getPublicKey,
         sign: (msg: TArg<Uint8Array>, secretKey: TArg<Uint8Array>, opts: TArg<SigOpts> = {}) => {
-          validateSigOpts(opts);
+          opts = validateSigOpts(opts);
           const M = getMessagePrehash(rawHash, msg, opts.context);
-          const res = internal.sign(M, secretKey, opts);
+          // As above: getMessagePrehash() consumes `context`, so it must not travel further.
+          const res = internal.sign(M, secretKey, { extraEntropy: opts.extraEntropy });
           cleanBytes(M);
           return res as TRet<Uint8Array>;
         },
@@ -736,7 +767,7 @@ function gen(opts: SphincsOpts, hashOpts_: TArg<SphincsHashOpts>): TRet<SphincsS
           publicKey: TArg<Uint8Array>,
           opts: TArg<VerOpts> = {}
         ) => {
-          validateVerOpts(opts);
+          opts = validateVerOpts(opts);
           return internal.verify(sig, getMessagePrehash(rawHash, msg, opts.context), publicKey);
         },
       });
@@ -812,7 +843,7 @@ const genShake =
     } as TRet<Context>;
   };
 
-const SHAKE_SIMPLE = /* @__PURE__ */ (() => ({ getContext: genShake() }))();
+const SHAKE_SIMPLE = /* @__PURE__ */ (() => ({ isCompressed: false, getContext: genShake() }))();
 
 /**
  * SLH-DSA-SHAKE-128f: Table 2 row `n=16, h=66, d=22, h'=3, a=6, k=33, lg w=4, m=34`;

package/src/utils.ts

@@ -10,6 +10,7 @@ import {
   abytes as abytes_,
   ahash as ahash_,
   anumber,
+  bytesToHex,
   concatBytes,
   isBytes,
   isLE,
@@ -215,9 +216,10 @@ export function equalBytes(a: TArg<Uint8Array>, b: TArg<Uint8Array>): boolean {
  * ```
  */
 export function copyBytes(bytes: TArg<Uint8Array>): TRet<Uint8Array> {
-  // `Uint8Array.from(...)` would also accept arrays / other typed arrays. Keep this helper strict
-  // because callers use it at byte-validation boundaries before mutating the detached copy.
-  return Uint8Array.from(abytes(bytes)) as TRet<Uint8Array>;
+  // The typed-array constructor copies a typed-array source through its internal byte storage.
+  // Unlike `Uint8Array.from`, it does not invoke a subclass-overridden iterator. Keep the explicit
+  // validation because the constructor itself would also accept arrays and other typed arrays.
+  return new Uint8Array(abytes(bytes)) as TRet<Uint8Array>;
 }
 
 /**
@@ -315,6 +317,66 @@ export function validateOpts(opts: object): void {
   // Arrays silently passed here before, but these call sites expect named option-bag fields.
   if (isBytes(opts)) throw new TypeError('"opts" expected object, got Uint8Array');
   aobject(opts, 'opts');
+  const proto = Object.getPrototypeOf(opts);
+  // Options are security parameters, not general class instances. Restricting the bag to own
+  // properties prevents values injected through Object.prototype (or a custom shared prototype)
+  // from silently changing signing behavior. Null-prototype records remain supported.
+  if (proto !== null && proto !== Object.prototype)
+    throw new TypeError('"opts" expected a plain object');
+}
+
+// Frozen because they are exported: an unfrozen array export lets anything in the
+// process push a key onto the accepted set and silently re-open exactly the hole this
+// validation closes.
+/** Keys accepted by `verify`. */
+export const VER_OPT_KEYS: readonly ['context'] = /* @__PURE__ */ Object.freeze([
+  'context',
+] as const);
+/** Keys accepted by `sign`. */
+export const SIG_OPT_KEYS: readonly ['context', 'extraEntropy'] = /* @__PURE__ */ Object.freeze([
+  'context',
+  'extraEntropy',
+] as const);
+
+/**
+ * Rejects option keys the caller did not mean to set.
+ *
+ * Validating the types of known keys while ignoring unknown ones makes a typo
+ * indistinguishable from an omission, and for these options an omission is a
+ * security downgrade rather than a no-op: `{ ctx }` instead of `{ context }` signs
+ * with no domain separation, succeeds, and verifies for anyone who also supplies
+ * none. Nothing at any layer reports it. TypeScript catches this through excess
+ * property checks, so the exposure is JavaScript callers specifically.
+ *
+ * @param opts - Options object to check.
+ * @param allowed - The keys this call site accepts.
+ * Returns a frozen null-prototype snapshot so later reads cannot fall through to a polluted
+ * prototype. Like `checkOpts()` in noble-hashes, only enumerable own properties are copied.
+ * @throws If any other copied key is present or the bag has a custom prototype. {@link TypeError}
+ * @returns Sanitized snapshot of the enumerable own options.
+ * @example
+ * Accept a known option key. A key the list does not name, such as `ctx`, throws instead.
+ * ```ts
+ * import { checkOptKeys } from '@noble/post-quantum/utils.js';
+ * checkOptKeys({ context: new Uint8Array() }, ['context']);
+ * ```
+ */
+export function checkOptKeys<T extends object>(opts: T, allowed: readonly string[]): T {
+  validateOpts(opts);
+  // Snapshot once before validation: Object.assign follows the same own-enumerable option-bag
+  // semantics as noble-hashes, while the null prototype keeps omitted fields immune to pollution.
+  const normalized = Object.assign(Object.create(null), opts) as Record<string, unknown>;
+  for (const [k, v] of Object.entries(normalized)) {
+    // `undefined` means unset everywhere else in these validators, and building an options bag by
+    // spread is a normal way to reach these calls, so present-but-undefined stays equivalent to
+    // omission.
+    if (v === undefined) continue;
+    if (!allowed.includes(k))
+      throw new TypeError(
+        'unexpected option "' + String(k) + '"; expected one of: ' + allowed.join(', ')
+      );
+  }
+  return Object.freeze(normalized) as T;
 }
 
 /**
@@ -322,16 +384,23 @@ export function validateOpts(opts: object): void {
  * `context` itself is validated with `abytes(...)`, and individual algorithms may narrow support
  * further after this shared plain-object gate.
  * @param opts - Verification options. See {@link VerOpts}.
+ * @param allowed - Keys this call site accepts. Defaults to {@link VER_OPT_KEYS}; surfaces that
+ * take extra keys, or take fewer, pass their own list.
  * @throws On wrong argument types. {@link TypeError}
+ * @returns Frozen null-prototype snapshot of the validated options.
  * @example
  * Validate common verification options.
  * ```ts
  * validateVerOpts({ context: new Uint8Array([1]) });
  * ```
  */
-export function validateVerOpts(opts: TArg<VerOpts>): void {
-  validateOpts(opts);
-  if (opts.context !== undefined) abytes(opts.context, undefined, 'opts.context');
+export function validateVerOpts<T extends TArg<VerOpts>>(
+  opts: T,
+  allowed: readonly string[] = VER_OPT_KEYS
+): T {
+  const normalized = checkOptKeys(opts, allowed);
+  if (normalized.context !== undefined) abytes(normalized.context, undefined, 'opts.context');
+  return normalized;
 }
 
 /**
@@ -339,17 +408,25 @@ export function validateVerOpts(opts: TArg<VerOpts>): void {
  * `extraEntropy` is validated with `abytes(...)`; exact lengths and extra algorithm-specific
  * restrictions are enforced later by callers.
  * @param opts - Signing options. See {@link SigOpts}.
+ * @param allowed - Keys this call site accepts. Defaults to {@link SIG_OPT_KEYS}; surfaces that
+ * take extra keys, or take fewer, pass their own list.
  * @throws On wrong argument types. {@link TypeError}
+ * @returns Frozen null-prototype snapshot of the validated options.
  * @example
  * Validate common signing options.
  * ```ts
  * validateSigOpts({ extraEntropy: new Uint8Array([1]) });
  * ```
  */
-export function validateSigOpts(opts: TArg<SigOpts>): void {
-  validateVerOpts(opts);
-  if (opts.extraEntropy !== false && opts.extraEntropy !== undefined)
-    abytes(opts.extraEntropy, undefined, 'opts.extraEntropy');
+export function validateSigOpts<T extends TArg<SigOpts>>(
+  opts: T,
+  allowed: readonly string[] = SIG_OPT_KEYS
+): T {
+  const normalized = checkOptKeys(opts, allowed);
+  if (normalized.context !== undefined) abytes(normalized.context, undefined, 'opts.context');
+  if (normalized.extraEntropy !== false && normalized.extraEntropy !== undefined)
+    abytes(normalized.extraEntropy, undefined, 'opts.extraEntropy');
+  return normalized;
 }
 
 /** Generic signature interface with key generation, signing, and verification. */
@@ -617,6 +694,20 @@ export function getMessage(msg: TArg<Uint8Array>, ctx: TArg<Uint8Array> = EMPTY)
 // 06 09 60 86 48 01 65 03 04 02
 const oidNistP = /* @__PURE__ */ Uint8Array.from([6, 9, 0x60, 0x86, 0x48, 1, 0x65, 3, 4, 2]);
 
+/**
+ * Output length, in bytes, that each XOF OID under this arc denotes.
+ *
+ * Unlike a fixed hash, an XOF's OID is a promise about the digest length: RFC 8702
+ * defines id-shake128 as SHAKE128 with 256-bit output and id-shake256 as SHAKE256 with
+ * 512-bit output, and FIPS 204 / FIPS 205 use exactly those pairings for pre-hash. Both
+ * bare noble-hashes defaults are half these values, so neither can be signed under its
+ * own OID.
+ */
+const XOF_OID_OUTPUT_LEN: Record<string, number> = /* @__PURE__ */ (() => ({
+  '060960864801650304020b': 32, // id-shake128, SHAKE128(M, 256)
+  '060960864801650304020c': 64, // id-shake256, SHAKE256(M, 512)
+}))();
+
 /**
  * Validates that a hash exposes a NIST hash OID and enough collision resistance.
  * Current accepted surface is broader than the FIPS algorithm tables: any hash/XOF under the NIST
@@ -646,6 +737,20 @@ export function checkHash(hash: CHash, requiredStrength: number = 0): void {
   // FIPS 204 / FIPS 205 require both collision and second-preimage strength; for approved NIST
   // hashes/XOFs under this OID subtree, the collision bound from the configured digest length is
   // the tighter runtime check, so enforce that lower bound here.
+  // XOFs under this arc are identified by an OID that fixes their output length:
+  // FIPS 204 §5.4.1 (SHAKE128) and FIPS 205 §10.2.2 (both SHAKEs), matching RFC 8702, pair
+  // id-shake128 with SHAKE128(M, 256) and id-shake256 with SHAKE256(M, 512). getMessagePrehash embeds
+  // hash.oid beside hash(msg), so a shorter digest signs an M' that claims a length
+  // it does not have: noble-hashes' bare shake256 defaults to 32 bytes and cleared
+  // the collision bound at the 128-bit level, producing signatures a conformant
+  // verifier rejects because it recomputes 512 bits. Check the length the OID
+  // denotes rather than the generic bound.
+  const xofLen = XOF_OID_OUTPUT_LEN[bytesToHex(oid as Uint8Array)];
+  if (xofLen !== undefined && hash.outputLen !== xofLen) {
+    throw new Error(
+      'Pre-hash XOF output length must be ' + xofLen + ' bytes for this OID, got: ' + hash.outputLen
+    );
+  }
   const collisionResistance = (hash.outputLen * 8) / 2;
   if (requiredStrength > collisionResistance) {
     throw new Error(