@quantakrypto/sieve 0.1.0

package/dist/categories/signature.js

@@ -0,0 +1,259 @@
+/**
+ * Generic signature self-consistency category (FIPS 204 ML-DSA, FIPS 205
+ * SLH-DSA).
+ *
+ * Both schemes expose the same black-box surface — keygen, sign, verify — so a
+ * single driver covers them. Signing is randomized (hedged) by default, so we
+ * cannot assert exact signature bytes without official vectors; but several
+ * properties hold for any conforming implementation and need no external data:
+ *
+ *   - sizes:            pk/sk lengths match the parameter set; signature length
+ *                       matches the fixed encoding.
+ *   - sign-then-verify: verify(pk, msg, sign(sk, msg)) === true, over N msgs.
+ *   - tamper-message:   verify(pk, msg', sig) === false when msg' != msg.
+ *   - tamper-signature: verify(pk, msg, flip-a-bit(sig)) === false.
+ *   - wrong-length verify input is rejected with a defined error (AF-05).
+ *   - signing-mode (advisory): detect whether sign(sk, msg) is deterministic or
+ *     hedged by signing one fixed message twice and comparing. BOTH are valid;
+ *     this never fails — it only surfaces the observed behavior.
+ *
+ * Exact-value KAT (sigVer vectors) is handled separately by the kat category.
+ */
+import { fail, pass, rollUp, skip, } from "./types.js";
+import { flipBitB64, zerosB64 } from "./helpers.js";
+import { fromB64, toB64 } from "../protocol.js";
+import { asSignatureSizes } from "../sizes.js";
+const BUG_SIZE = "AF-05";
+/**
+ * Build a signature category bound to a family. The same logic drives ML-DSA
+ * and SLH-DSA; only the family tag on the wire requests differs.
+ */
+export function makeSignatureCategory(name, family) {
+    return async (ctx) => {
+        const d = asSignatureSizes(ctx.sizes);
+        if (!d || d.family !== family) {
+            return {
+                category: name,
+                status: "skip",
+                checks: [],
+                summary: `${name} category applies only to ${family} parameter sets`,
+            };
+        }
+        return runSignature(name, family, d, ctx);
+    };
+}
+async function runSignature(name, family, d, ctx) {
+    const param = d.id;
+    const checks = [];
+    const msgs = makeMessages(ctx.iterations);
+    // Keygen once; reuse the key pair across messages.
+    let pkB64;
+    let skB64;
+    try {
+        const kg = await ctx.runner.send({ family, param, op: "keygen" });
+        if (kg.ok !== true || !("pk" in kg) || !("sk" in kg)) {
+            return wrap(name, checks, [fail("keygen", `${family} keygen did not return pk/sk`)]);
+        }
+        pkB64 = kg.pk;
+        skB64 = kg.sk;
+        const pk = fromB64(pkB64);
+        const sk = fromB64(skB64);
+        checks.push(pk.length === d.publicKey
+            ? pass("pk-length", `verification key ${pk.length} bytes (expected ${d.publicKey})`, BUG_SIZE)
+            : fail("pk-length", `verification key ${pk.length} bytes, expected ${d.publicKey}`, BUG_SIZE));
+        checks.push(sk.length === d.secretKey
+            ? pass("sk-length", `signing key ${sk.length} bytes (expected ${d.secretKey})`, BUG_SIZE)
+            : fail("sk-length", `signing key ${sk.length} bytes, expected ${d.secretKey}`, BUG_SIZE));
+    }
+    catch (err) {
+        return wrap(name, checks, [fail("keygen", `harness error: ${err.message}`)]);
+    }
+    // --- Round-trips. Each message's sign is independent, so we PIPELINE the
+    // sign requests (bounded concurrency), then process verdicts. Verify probes
+    // for a given message are independent across messages too. ----------------
+    let signed;
+    try {
+        signed = await ctx.runner.sendMany(msgs.map((msg) => ({ family, param, op: "sign", sk: skB64, msg })), ctx.pipelineDepth ?? 16);
+    }
+    catch (err) {
+        return wrap(name, checks, [fail("sign", `harness error: ${err.message}`)]);
+    }
+    let goodVerify = 0;
+    let tamperMsgCaught = 0;
+    let tamperSigCaught = 0;
+    let sigLenOk = 0;
+    let attempts = 0;
+    for (let i = 0; i < msgs.length; i++) {
+        const msgB64 = msgs[i];
+        const s = signed[i];
+        attempts++;
+        if (s.ok !== true || !("sig" in s)) {
+            checks.push(fail(`sign[${i}]`, "sign did not return a signature"));
+            continue;
+        }
+        const sigB64 = s.sig;
+        const sig = fromB64(sigB64);
+        if (sig.length === d.signature) {
+            sigLenOk++;
+        }
+        else if (i < 3) {
+            checks.push(fail(`sig-length[${i}]`, `signature ${sig.length} bytes, expected ${d.signature}`, BUG_SIZE));
+        }
+        try {
+            // The three verify probes for this message are independent → pipeline them.
+            const tamperedMsg = flipBitB64(msgB64.length > 0 ? msgB64 : toB64(new Uint8Array([0])), 0, 1);
+            const tamperedSig = flipBitB64(sigB64, sig.length >> 1, 3);
+            const [good, badMsg, badSig] = await ctx.runner.sendMany([
+                { family, param, op: "verify", pk: pkB64, msg: msgB64, sig: sigB64 },
+                { family, param, op: "verify", pk: pkB64, msg: tamperedMsg, sig: sigB64 },
+                { family, param, op: "verify", pk: pkB64, msg: msgB64, sig: tamperedSig },
+            ], ctx.pipelineDepth ?? 16);
+            if (verdict(good)) {
+                goodVerify++;
+            }
+            else if (i < 3) {
+                checks.push(fail(`verify[${i}]`, "a freshly produced signature failed to verify"));
+            }
+            if (!verdict(badMsg)) {
+                tamperMsgCaught++;
+            }
+            else if (i < 3) {
+                checks.push(fail(`tamper-msg[${i}]`, "signature verified against a different message"));
+            }
+            if (!verdict(badSig)) {
+                tamperSigCaught++;
+            }
+            else if (i < 3) {
+                checks.push(fail(`tamper-sig[${i}]`, "a bit-flipped signature still verified"));
+            }
+        }
+        catch (err) {
+            checks.push(fail(`verify[${i}]`, `harness error: ${err.message}`));
+        }
+    }
+    if (attempts > 0) {
+        if (goodVerify === attempts) {
+            checks.push(pass("sign-verify", `${goodVerify}/${attempts} signatures verified`));
+        }
+        if (tamperMsgCaught === attempts) {
+            checks.push(pass("tamper-msg", `${tamperMsgCaught}/${attempts} altered-message forgeries rejected`));
+        }
+        if (tamperSigCaught === attempts) {
+            checks.push(pass("tamper-sig", `${tamperSigCaught}/${attempts} altered-signature forgeries rejected`));
+        }
+        if (sigLenOk === attempts) {
+            checks.push(pass("sig-length", `all ${sigLenOk} signatures had the expected ${d.signature} bytes`, BUG_SIZE));
+        }
+    }
+    // --- Advisory: deterministic vs hedged signing ---------------------------
+    await probeSigningMode(checks, ctx, family, param, skB64, pkB64);
+    // --- Negative: wrong-length verify inputs must be rejected cleanly -------
+    await expectVerifyReject(checks, "verify-pk-too-short", () => ctx.runner.send({
+        family,
+        param,
+        op: "verify",
+        pk: zerosB64(d.publicKey - 1),
+        msg: toB64(new Uint8Array([1, 2, 3])),
+        sig: zerosB64(d.signature),
+    }));
+    await expectVerifyReject(checks, "verify-sig-too-long", () => ctx.runner.send({
+        family,
+        param,
+        op: "verify",
+        pk: pkB64,
+        msg: toB64(new Uint8Array([1, 2, 3])),
+        sig: zerosB64(d.signature + 1),
+    }));
+    return wrap(name, checks, []);
+}
+function verdict(resp) {
+    if (resp.ok !== true || !("valid" in resp)) {
+        throw new Error("verify did not return a 'valid' verdict");
+    }
+    return resp.valid;
+}
+/**
+ * Advisory probe: sign one fixed message twice and report whether the SUT is
+ * deterministic (identical signatures) or hedged (differing signatures). BOTH
+ * are FIPS-conforming, so this NEVER fails — it records a `skip`-status note (so
+ * it cannot affect the verdict) describing the observed behavior. We also
+ * confirm both signatures verify, which IS asserted.
+ */
+async function probeSigningMode(checks, ctx, family, param, skB64, pkB64) {
+    const msgB64 = toB64(new Uint8Array([0x73, 0x69, 0x67, 0x6d, 0x6f, 0x64, 0x65])); // "sigmode"
+    try {
+        const [a, b] = await ctx.runner.sendMany([
+            { family, param, op: "sign", sk: skB64, msg: msgB64 },
+            { family, param, op: "sign", sk: skB64, msg: msgB64 },
+        ], 
+        // Keep these two strictly ordered/serial-equivalent is unnecessary; they
+        // are independent. A depth of 2 is fine.
+        2);
+        if (a.ok !== true || !("sig" in a) || b.ok !== true || !("sig" in b)) {
+            checks.push(skip("signing-mode", "could not obtain two signatures to compare (advisory)"));
+            return;
+        }
+        const deterministic = a.sig === b.sig;
+        checks.push(skip("signing-mode", deterministic
+            ? "advisory: sign(sk, msg) is DETERMINISTIC (identical signatures for a repeated message)"
+            : "advisory: sign(sk, msg) is HEDGED/randomized (signatures differ across calls)"));
+        // Both must still verify — this part IS asserted.
+        const [va, vb] = await ctx.runner.sendMany([
+            { family, param, op: "verify", pk: pkB64, msg: msgB64, sig: a.sig },
+            { family, param, op: "verify", pk: pkB64, msg: msgB64, sig: b.sig },
+        ], 2);
+        if (verdict(va) && verdict(vb)) {
+            checks.push(pass("signing-mode-verify", "both repeated-message signatures verify"));
+        }
+        else {
+            checks.push(fail("signing-mode-verify", "a repeated-message signature failed to verify"));
+        }
+    }
+    catch (err) {
+        checks.push(skip("signing-mode", `advisory probe could not run: ${err.message}`));
+    }
+}
+function wrap(name, checks, extra) {
+    const all = [...checks, ...extra];
+    const status = rollUp(all);
+    return {
+        category: name,
+        status,
+        checks: all,
+        summary: status === "pass"
+            ? `${name} sign/verify self-consistency holds`
+            : `${all.filter((c) => c.status === "fail").length} ${name} issue(s)`,
+    };
+}
+async function expectVerifyReject(checks, name, op) {
+    try {
+        const resp = await op();
+        if (resp.ok === false) {
+            checks.push(pass(name, `rejected with defined error: ${resp.code}`, BUG_SIZE));
+        }
+        else if ("valid" in resp && resp.valid === false) {
+            // Returning a false verdict for malformed input is also acceptable.
+            checks.push(pass(name, "wrong-length input verified as false (acceptable)", BUG_SIZE));
+        }
+        else {
+            checks.push(fail(name, "SUT accepted a wrong-length verify input and verified true", BUG_SIZE));
+        }
+    }
+    catch (err) {
+        checks.push(fail(name, `SUT crashed/hung on wrong-length verify input: ${err.message}`, BUG_SIZE));
+    }
+}
+/** Deterministic, varied messages of assorted lengths (incl. empty). */
+function makeMessages(n) {
+    const out = [];
+    const count = Math.max(1, Math.min(n, 16));
+    for (let i = 0; i < count; i++) {
+        const len = (i * 7) % 33; // 0..32 varying lengths
+        const bytes = new Uint8Array(len);
+        for (let j = 0; j < len; j++)
+            bytes[j] = (i * 31 + j * 17) & 0xff;
+        out.push(toB64(bytes));
+    }
+    return out;
+}
+//# sourceMappingURL=signature.js.map

package/dist/categories/signature.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"signature.js","sourceRoot":"","sources":["../../src/categories/signature.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EAKL,IAAI,EACJ,IAAI,EACJ,MAAM,EACN,IAAI,GACL,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AACpD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAuC,MAAM,gBAAgB,CAAC;AACrF,OAAO,EAAE,gBAAgB,EAAsC,MAAM,aAAa,CAAC;AAEnF,MAAM,QAAQ,GAAG,OAAgB,CAAC;AAElC;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CAAC,IAAY,EAAE,MAAuB;IACzE,OAAO,KAAK,EAAE,GAAG,EAA2B,EAAE;QAC5C,MAAM,CAAC,GAAG,gBAAgB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACtC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAC9B,OAAO;gBACL,QAAQ,EAAE,IAAI;gBACd,MAAM,EAAE,MAAM;gBACd,MAAM,EAAE,EAAE;gBACV,OAAO,EAAE,GAAG,IAAI,6BAA6B,MAAM,iBAAiB;aACrE,CAAC;QACJ,CAAC;QACD,OAAO,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC;IAC5C,CAAC,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,YAAY,CACzB,IAAY,EACZ,MAAuB,EACvB,CAAiB,EACjB,GAAoB;IAEpB,MAAM,KAAK,GAAG,CAAC,CAAC,EAAE,CAAC;IACnB,MAAM,MAAM,GAAY,EAAE,CAAC;IAC3B,MAAM,IAAI,GAAG,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IAE1C,mDAAmD;IACnD,IAAI,KAAa,CAAC;IAClB,IAAI,KAAa,CAAC;IAClB,IAAI,CAAC;QACH,MAAM,EAAE,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC;QAClE,IAAI,EAAE,CAAC,EAAE,KAAK,IAAI,IAAI,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,IAAI,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,EAAE,CAAC;YACrD,OAAO,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,MAAM,8BAA8B,CAAC,CAAC,CAAC,CAAC;QACvF,CAAC;QACD,KAAK,GAAG,EAAE,CAAC,EAAE,CAAC;QACd,KAAK,GAAG,EAAE,CAAC,EAAE,CAAC;QACd,MAAM,EAAE,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;QAC1B,MAAM,EAAE,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;QAC1B,MAAM,CAAC,IAAI,CACT,EAAE,CAAC,MAAM,KAAK,CAAC,CAAC,SAAS;YACvB,CAAC,CAAC,IAAI,CACF,WAAW,EACX,oBAAoB,EAAE,CAAC,MAAM,oBAAoB,CAAC,CAAC,SAAS,GAAG,EAC/D,QAAQ,CACT;YACH,CAAC,CAAC,IAAI,CACF,WAAW,EACX,oBAAoB,EAAE,CAAC,MAAM,oBAAoB,CAAC,CAAC,SAAS,EAAE,EAC9D,QAAQ,CACT,CACN,CAAC;QACF,MAAM,CAAC,IAAI,CACT,EAAE,CAAC,MAAM,KAAK,CAAC,CAAC,SAAS;YACvB,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,eAAe,EAAE,CAAC,MAAM,oBAAoB,CAAC,CAAC,SAAS,GAAG,EAAE,QAAQ,CAAC;YACzF,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,eAAe,EAAE,CAAC,MAAM,oBAAoB,CAAC,CAAC,SAAS,EAAE,EAAE,QAAQ,CAAC,CAC3F,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,IAAI,CAAC,QAAQ,EAAE,kBAAmB,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC;IAC1F,CAAC;IAED,0EAA0E;IAC1E,4EAA4E;IAC5E,4EAA4E;IAC5E,IAAI,MAAkB,CAAC;IACvB,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC,QAAQ,CAChC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,EAAE,MAAe,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC,EAC3E,GAAG,CAAC,aAAa,IAAI,EAAE,CACxB,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,IAAI,CAAC,MAAM,EAAE,kBAAmB,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC;IACxF,CAAC;IAED,IAAI,UAAU,GAAG,CAAC,CAAC;IACnB,IAAI,eAAe,GAAG,CAAC,CAAC;IACxB,IAAI,eAAe,GAAG,CAAC,CAAC;IACxB,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,IAAI,QAAQ,GAAG,CAAC,CAAC;IAEjB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,MAAM,GAAG,IAAI,CAAC,CAAC,CAAW,CAAC;QACjC,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAa,CAAC;QAChC,QAAQ,EAAE,CAAC;QACX,IAAI,CAAC,CAAC,EAAE,KAAK,IAAI,IAAI,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,EAAE,CAAC;YACnC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,iCAAiC,CAAC,CAAC,CAAC;YACnE,SAAS;QACX,CAAC;QACD,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC;QACrB,MAAM,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;QAC5B,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,CAAC,SAAS,EAAE,CAAC;YAC/B,QAAQ,EAAE,CAAC;QACb,CAAC;aAAM,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YACjB,MAAM,CAAC,IAAI,CACT,IAAI,CACF,cAAc,CAAC,GAAG,EAClB,aAAa,GAAG,CAAC,MAAM,oBAAoB,CAAC,CAAC,SAAS,EAAE,EACxD,QAAQ,CACT,CACF,CAAC;QACJ,CAAC;QAED,IAAI,CAAC;YACH,4EAA4E;YAC5E,MAAM,WAAW,GAAG,UAAU,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;YAC9F,MAAM,WAAW,GAAG,UAAU,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;YAC3D,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC,QAAQ,CACtD;gBACE,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,EAAE,QAAiB,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE;gBAC7E,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,EAAE,QAAiB,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM,EAAE;gBAClF,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,EAAE,QAAiB,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE;aACnF,EACD,GAAG,CAAC,aAAa,IAAI,EAAE,CACxB,CAAC;YAEF,IAAI,OAAO,CAAC,IAAgB,CAAC,EAAE,CAAC;gBAC9B,UAAU,EAAE,CAAC;YACf,CAAC;iBAAM,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;gBACjB,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,+CAA+C,CAAC,CAAC,CAAC;YACrF,CAAC;YACD,IAAI,CAAC,OAAO,CAAC,MAAkB,CAAC,EAAE,CAAC;gBACjC,eAAe,EAAE,CAAC;YACpB,CAAC;iBAAM,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;gBACjB,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,GAAG,EAAE,gDAAgD,CAAC,CAAC,CAAC;YAC1F,CAAC;YACD,IAAI,CAAC,OAAO,CAAC,MAAkB,CAAC,EAAE,CAAC;gBACjC,eAAe,EAAE,CAAC;YACpB,CAAC;iBAAM,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;gBACjB,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,GAAG,EAAE,wCAAwC,CAAC,CAAC,CAAC;YAClF,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,kBAAmB,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QAChF,CAAC;IACH,CAAC;IAED,IAAI,QAAQ,GAAG,CAAC,EAAE,CAAC;QACjB,IAAI,UAAU,KAAK,QAAQ,EAAE,CAAC;YAC5B,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,GAAG,UAAU,IAAI,QAAQ,sBAAsB,CAAC,CAAC,CAAC;QACpF,CAAC;QACD,IAAI,eAAe,KAAK,QAAQ,EAAE,CAAC;YACjC,MAAM,CAAC,IAAI,CACT,IAAI,CAAC,YAAY,EAAE,GAAG,eAAe,IAAI,QAAQ,qCAAqC,CAAC,CACxF,CAAC;QACJ,CAAC;QACD,IAAI,eAAe,KAAK,QAAQ,EAAE,CAAC;YACjC,MAAM,CAAC,IAAI,CACT,IAAI,CAAC,YAAY,EAAE,GAAG,eAAe,IAAI,QAAQ,uCAAuC,CAAC,CAC1F,CAAC;QACJ,CAAC;QACD,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAC1B,MAAM,CAAC,IAAI,CACT,IAAI,CACF,YAAY,EACZ,OAAO,QAAQ,gCAAgC,CAAC,CAAC,SAAS,QAAQ,EAClE,QAAQ,CACT,CACF,CAAC;QACJ,CAAC;IACH,CAAC;IAED,4EAA4E;IAC5E,MAAM,gBAAgB,CAAC,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;IAEjE,4EAA4E;IAC5E,MAAM,kBAAkB,CAAC,MAAM,EAAE,qBAAqB,EAAE,GAAG,EAAE,CAC3D,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC;QACd,MAAM;QACN,KAAK;QACL,EAAE,EAAE,QAAQ;QACZ,EAAE,EAAE,QAAQ,CAAC,CAAC,CAAC,SAAS,GAAG,CAAC,CAAC;QAC7B,GAAG,EAAE,KAAK,CAAC,IAAI,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QACrC,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;KAC3B,CAAC,CACH,CAAC;IACF,MAAM,kBAAkB,CAAC,MAAM,EAAE,qBAAqB,EAAE,GAAG,EAAE,CAC3D,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC;QACd,MAAM;QACN,KAAK;QACL,EAAE,EAAE,QAAQ;QACZ,EAAE,EAAE,KAAK;QACT,GAAG,EAAE,KAAK,CAAC,IAAI,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QACrC,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAC,SAAS,GAAG,CAAC,CAAC;KAC/B,CAAC,CACH,CAAC;IAEF,OAAO,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;AAChC,CAAC;AAED,SAAS,OAAO,CAAC,IAAc;IAC7B,IAAI,IAAI,CAAC,EAAE,KAAK,IAAI,IAAI,CAAC,CAAC,OAAO,IAAI,IAAI,CAAC,EAAE,CAAC;QAC3C,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;IAC7D,CAAC;IACD,OAAO,IAAI,CAAC,KAAK,CAAC;AACpB,CAAC;AAED;;;;;;GAMG;AACH,KAAK,UAAU,gBAAgB,CAC7B,MAAe,EACf,GAAoB,EACpB,MAAuB,EACvB,KAAe,EACf,KAAa,EACb,KAAa;IAEb,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,UAAU,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,YAAY;IAC9F,IAAI,CAAC;QACH,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC,QAAQ,CACtC;YACE,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,EAAE,MAAe,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE;YAC9D,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,EAAE,MAAe,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE;SAC/D;QACD,yEAAyE;QACzE,yCAAyC;QACzC,CAAC,CACF,CAAC;QACF,IAAI,CAAC,CAAC,EAAE,KAAK,IAAI,IAAI,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,KAAK,IAAI,IAAI,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,EAAE,CAAC;YACrE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,uDAAuD,CAAC,CAAC,CAAC;YAC3F,OAAO;QACT,CAAC;QACD,MAAM,aAAa,GAAG,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC;QACtC,MAAM,CAAC,IAAI,CACT,IAAI,CACF,cAAc,EACd,aAAa;YACX,CAAC,CAAC,wFAAwF;YAC1F,CAAC,CAAC,+EAA+E,CACpF,CACF,CAAC;QACF,kDAAkD;QAClD,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC,QAAQ,CACxC;YACE,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,EAAE,QAAiB,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE;YAC5E,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,EAAE,QAAiB,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE;SAC7E,EACD,CAAC,CACF,CAAC;QACF,IAAI,OAAO,CAAC,EAAc,CAAC,IAAI,OAAO,CAAC,EAAc,CAAC,EAAE,CAAC;YACvD,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,qBAAqB,EAAE,yCAAyC,CAAC,CAAC,CAAC;QACtF,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,qBAAqB,EAAE,+CAA+C,CAAC,CAAC,CAAC;QAC5F,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,iCAAkC,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;IAC/F,CAAC;AACH,CAAC;AAED,SAAS,IAAI,CAAC,IAAY,EAAE,MAAe,EAAE,KAAc;IACzD,MAAM,GAAG,GAAG,CAAC,GAAG,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC;IAClC,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;IAC3B,OAAO;QACL,QAAQ,EAAE,IAAI;QACd,MAAM;QACN,MAAM,EAAE,GAAG;QACX,OAAO,EACL,MAAM,KAAK,MAAM;YACf,CAAC,CAAC,GAAG,IAAI,qCAAqC;YAC9C,CAAC,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,MAAM,IAAI,IAAI,WAAW;KAC1E,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,kBAAkB,CAC/B,MAAe,EACf,IAAY,EACZ,EAA2B;IAE3B,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,EAAE,EAAE,CAAC;QACxB,IAAI,IAAI,CAAC,EAAE,KAAK,KAAK,EAAE,CAAC;YACtB,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,gCAAgC,IAAI,CAAC,IAAI,EAAE,EAAE,QAAQ,CAAC,CAAC,CAAC;QACjF,CAAC;aAAM,IAAI,OAAO,IAAI,IAAI,IAAI,IAAI,CAAC,KAAK,KAAK,KAAK,EAAE,CAAC;YACnD,oEAAoE;YACpE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,mDAAmD,EAAE,QAAQ,CAAC,CAAC,CAAC;QACzF,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,IAAI,CACT,IAAI,CAAC,IAAI,EAAE,4DAA4D,EAAE,QAAQ,CAAC,CACnF,CAAC;QACJ,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,IAAI,CACT,IAAI,CACF,IAAI,EACJ,kDAAmD,GAAa,CAAC,OAAO,EAAE,EAC1E,QAAQ,CACT,CACF,CAAC;IACJ,CAAC;AACH,CAAC;AAED,wEAAwE;AACxE,SAAS,YAAY,CAAC,CAAS;IAC7B,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;IAC3C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC;QAC/B,MAAM,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,wBAAwB;QAClD,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC;QAClC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,EAAE,CAAC,EAAE;YAAE,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC;QAClE,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;IACzB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/categories/sizes.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Sizes/format category — AF-05 family (ML-KEM).
+ *
+ * Two complementary checks:
+ *
+ *   A. Positive — emitted artifacts have the standardized byte lengths.
+ *      keygen pk/sk, encaps ct/ss, decaps ss must match the parameter set's
+ *      sizes from the public size table (the only constants we trust).
+ *
+ *   B. Negative — the SUT rejects wrong-length inputs with a *defined error*,
+ *      not a crash and not a silent success. We feed:
+ *        - a too-short and too-long public key to encaps,
+ *        - a too-short and too-long ciphertext to decaps,
+ *        - a too-short secret key to decaps.
+ *      Each must yield a protocol `error` response (ok:false) OR be otherwise
+ *      cleanly handled; accepting it and returning a normal result is a fail.
+ *
+ * AF-05 is size/format confusion: an implementation that doesn't length-check
+ * its inputs can read out of bounds or accept malformed material.
+ */
+import { type Category } from "./types.js";
+export declare const sizes: Category;
+//# sourceMappingURL=sizes.d.ts.map

package/dist/categories/sizes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sizes.d.ts","sourceRoot":"","sources":["../../src/categories/sizes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAE,KAAK,QAAQ,EAAuD,MAAM,YAAY,CAAC;AAahG,eAAO,MAAM,KAAK,EAAE,QA4HnB,CAAC"}

package/dist/categories/sizes.js

@@ -0,0 +1,150 @@
+/**
+ * Sizes/format category — AF-05 family (ML-KEM).
+ *
+ * Two complementary checks:
+ *
+ *   A. Positive — emitted artifacts have the standardized byte lengths.
+ *      keygen pk/sk, encaps ct/ss, decaps ss must match the parameter set's
+ *      sizes from the public size table (the only constants we trust).
+ *
+ *   B. Negative — the SUT rejects wrong-length inputs with a *defined error*,
+ *      not a crash and not a silent success. We feed:
+ *        - a too-short and too-long public key to encaps,
+ *        - a too-short and too-long ciphertext to decaps,
+ *        - a too-short secret key to decaps.
+ *      Each must yield a protocol `error` response (ok:false) OR be otherwise
+ *      cleanly handled; accepting it and returning a normal result is a fail.
+ *
+ * AF-05 is size/format confusion: an implementation that doesn't length-check
+ * its inputs can read out of bounds or accept malformed material.
+ */
+import { fail, pass, rollUp } from "./types.js";
+import { kemDecapsRaw, kemEncapsRaw, kemKeygen, requireKem, UnexpectedResponse, zerosB64, } from "./helpers.js";
+import { toB64 } from "../protocol.js";
+const BUG = "AF-05";
+export const sizes = async (ctx) => {
+    const checks = [];
+    if (ctx.sizes.family !== "ml-kem") {
+        return {
+            category: "sizes",
+            status: "skip",
+            bugClass: BUG,
+            checks: [],
+            summary: "size checks for ML-DSA live in the dsa category",
+        };
+    }
+    const km = requireKem(ctx.sizes);
+    const param = km.id;
+    // --- A. Positive: emitted lengths -----------------------------------------
+    let pkB64;
+    try {
+        const { pk, sk } = await kemKeygen(ctx.runner, param);
+        pkB64 = toB64(pk);
+        checks.push(pk.length === km.publicKey
+            ? pass("pk-length", `public key is ${pk.length} bytes (expected ${km.publicKey})`, BUG)
+            : fail("pk-length", `public key is ${pk.length} bytes, expected ${km.publicKey}`, BUG));
+        checks.push(sk.length === km.secretKey
+            ? pass("sk-length", `secret key is ${sk.length} bytes (expected ${km.secretKey})`, BUG)
+            : fail("sk-length", `secret key is ${sk.length} bytes, expected ${km.secretKey}`, BUG));
+        // encaps ct/ss lengths
+        const enc = await ctx.runner.send({ family: "ml-kem", param, op: "encaps", pk: pkB64 });
+        if (enc.ok === true && "ct" in enc && "ss" in enc) {
+            const ct = Buffer.from(enc.ct, "base64");
+            const ss = Buffer.from(enc.ss, "base64");
+            checks.push(ct.length === km.ciphertext
+                ? pass("ct-length", `ciphertext is ${ct.length} bytes (expected ${km.ciphertext})`, BUG)
+                : fail("ct-length", `ciphertext is ${ct.length} bytes, expected ${km.ciphertext}`, BUG));
+            checks.push(ss.length === km.sharedSecret
+                ? pass("ss-length", `shared secret is ${ss.length} bytes (expected ${km.sharedSecret})`, BUG)
+                : fail("ss-length", `shared secret is ${ss.length} bytes, expected ${km.sharedSecret}`, BUG));
+        }
+        else {
+            checks.push(fail("encaps-shape", "encaps did not return ct/ss for a valid public key", BUG));
+        }
+    }
+    catch (err) {
+        const detail = err instanceof UnexpectedResponse
+            ? `SUT returned an unexpected response: ${err.message}`
+            : `harness error: ${err.message}`;
+        checks.push(fail("positive-sizes", detail, BUG));
+        pkB64 = "";
+    }
+    // --- B. Negative: wrong-length inputs must be rejected cleanly -------------
+    // Wrong-length public key to encaps.
+    await expectReject(checks, "encaps-pk-too-short", () => kemEncapsRaw(ctx.runner, param, zerosB64(km.publicKey - 1)));
+    await expectReject(checks, "encaps-pk-too-long", () => kemEncapsRaw(ctx.runner, param, zerosB64(km.publicKey + 1)));
+    // Wrong-length ciphertext to decaps (use a valid-length sk of zeros).
+    const skZeros = zerosB64(km.secretKey);
+    await expectReject(checks, "decaps-ct-too-short", () => kemDecapsRaw(ctx.runner, param, skZeros, zerosB64(km.ciphertext - 1)));
+    await expectReject(checks, "decaps-ct-too-long", () => kemDecapsRaw(ctx.runner, param, skZeros, zerosB64(km.ciphertext + 1)));
+    // Wrong-length secret key to decaps (use a valid-length ct of zeros).
+    await expectReject(checks, "decaps-sk-too-short", () => kemDecapsRaw(ctx.runner, param, zerosB64(km.secretKey - 1), zerosB64(km.ciphertext)));
+    // --- C. FIPS 203 §7.2 encapsulation-key modulus-range check ---------------
+    // A correctly-SIZED ek whose t̂ coefficients are NOT reduced mod q (< 3329)
+    // must be rejected: §7.2 requires encaps to perform the "modulus check"
+    // (ek must round-trip through ByteEncode₁₂/ByteDecode₁₂). The length checks
+    // above do NOT catch this — an ek with an out-of-range coefficient still has
+    // the right byte length. We take a VALID ek from keygen and force its first
+    // 12-bit coefficient to 0xFFF (4095 ≥ 3329) while preserving the length, then
+    // require encaps to reject it with a defined error. We assert NO crypto bytes.
+    if (pkB64.length > 0) {
+        await expectReject(checks, "encaps-ek-coeff-out-of-range", () => kemEncapsRaw(ctx.runner, param, outOfRangeEk(pkB64)));
+    }
+    else {
+        checks.push(fail("encaps-ek-coeff-out-of-range", "could not obtain a valid ek from keygen to build the modulus-range probe", BUG));
+    }
+    const status = rollUp(checks);
+    return {
+        category: "sizes",
+        status,
+        bugClass: BUG,
+        checks,
+        summary: status === "pass"
+            ? "all artifact lengths correct; wrong-length inputs rejected"
+            : `${checks.filter((c) => c.status === "fail").length} size/format issue(s)`,
+    };
+};
+/**
+ * Build a same-length-but-out-of-range encapsulation key from a valid one.
+ *
+ * FIPS 203 packs t̂ with ByteEncode₁₂: each consecutive 3 bytes [b0,b1,b2] hold
+ * two 12-bit little-endian coefficients
+ *   d0 = b0 | ((b1 & 0x0F) << 8)
+ *   d1 = (b1 >> 4) | (b2 << 4)
+ * We set the FIRST coefficient d0 to 0xFFF (4095), which is ≥ q (3329) and thus
+ * NOT a valid reduced coefficient — this is the classic "ek not reduced mod q"
+ * malleability. The byte length is unchanged, so only a real §7.2 modulus check
+ * (not a length check) catches it. We touch only b0/b1, leaving everything else
+ * (including ρ) intact, so the ek stays structurally well-formed apart from the
+ * single out-of-range coefficient. No cryptographic values are fabricated.
+ */
+function outOfRangeEk(ekB64) {
+    const buf = Buffer.from(ekB64, "base64");
+    if (buf.length >= 2) {
+        buf[0] = 0xff; // low 8 bits of d0
+        buf[1] = buf[1] | 0x0f; // high 4 bits of d0 -> d0 = 0xFFF = 4095
+    }
+    return buf.toString("base64");
+}
+/**
+ * Run an operation that SHOULD be rejected. A clean protocol `error` (ok:false)
+ * passes. A normal success (the SUT accepted a wrong-length input) fails. A
+ * harness error such as a crash or timeout also fails — a conforming SUT must
+ * reject gracefully, not die.
+ */
+async function expectReject(checks, name, op) {
+    try {
+        const resp = await op();
+        if (resp.ok === false) {
+            checks.push(pass(name, `rejected with defined error: ${resp.code} (${resp.message})`, BUG));
+        }
+        else {
+            checks.push(fail(name, "SUT accepted a wrong-length input and returned a success result", BUG));
+        }
+    }
+    catch (err) {
+        checks.push(fail(name, `SUT crashed/hung on a wrong-length input instead of returning a defined error: ` +
+            `${err.message}`, BUG));
+    }
+}
+//# sourceMappingURL=sizes.js.map

package/dist/categories/sizes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sizes.js","sourceRoot":"","sources":["../../src/categories/sizes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAkD,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AAChG,OAAO,EACL,YAAY,EACZ,YAAY,EACZ,SAAS,EACT,UAAU,EACV,kBAAkB,EAClB,QAAQ,GACT,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,KAAK,EAAE,MAAM,gBAAgB,CAAC;AAEvC,MAAM,GAAG,GAAG,OAAgB,CAAC;AAE7B,MAAM,CAAC,MAAM,KAAK,GAAa,KAAK,EAAE,GAAG,EAA2B,EAAE;IACpE,MAAM,MAAM,GAAY,EAAE,CAAC;IAE3B,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QAClC,OAAO;YACL,QAAQ,EAAE,OAAO;YACjB,MAAM,EAAE,MAAM;YACd,QAAQ,EAAE,GAAG;YACb,MAAM,EAAE,EAAE;YACV,OAAO,EAAE,iDAAiD;SAC3D,CAAC;IACJ,CAAC;IAED,MAAM,EAAE,GAAG,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACjC,MAAM,KAAK,GAAG,EAAE,CAAC,EAAE,CAAC;IAEpB,6EAA6E;IAC7E,IAAI,KAAa,CAAC;IAClB,IAAI,CAAC;QACH,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,GAAG,MAAM,SAAS,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QACtD,KAAK,GAAG,KAAK,CAAC,EAAE,CAAC,CAAC;QAElB,MAAM,CAAC,IAAI,CACT,EAAE,CAAC,MAAM,KAAK,EAAE,CAAC,SAAS;YACxB,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,iBAAiB,EAAE,CAAC,MAAM,oBAAoB,EAAE,CAAC,SAAS,GAAG,EAAE,GAAG,CAAC;YACvF,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,iBAAiB,EAAE,CAAC,MAAM,oBAAoB,EAAE,CAAC,SAAS,EAAE,EAAE,GAAG,CAAC,CACzF,CAAC;QACF,MAAM,CAAC,IAAI,CACT,EAAE,CAAC,MAAM,KAAK,EAAE,CAAC,SAAS;YACxB,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,iBAAiB,EAAE,CAAC,MAAM,oBAAoB,EAAE,CAAC,SAAS,GAAG,EAAE,GAAG,CAAC;YACvF,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,iBAAiB,EAAE,CAAC,MAAM,oBAAoB,EAAE,CAAC,SAAS,EAAE,EAAE,GAAG,CAAC,CACzF,CAAC;QAEF,uBAAuB;QACvB,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;QACxF,IAAI,GAAG,CAAC,EAAE,KAAK,IAAI,IAAI,IAAI,IAAI,GAAG,IAAI,IAAI,IAAI,GAAG,EAAE,CAAC;YAClD,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;YACzC,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;YACzC,MAAM,CAAC,IAAI,CACT,EAAE,CAAC,MAAM,KAAK,EAAE,CAAC,UAAU;gBACzB,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,iBAAiB,EAAE,CAAC,MAAM,oBAAoB,EAAE,CAAC,UAAU,GAAG,EAAE,GAAG,CAAC;gBACxF,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,iBAAiB,EAAE,CAAC,MAAM,oBAAoB,EAAE,CAAC,UAAU,EAAE,EAAE,GAAG,CAAC,CAC1F,CAAC;YACF,MAAM,CAAC,IAAI,CACT,EAAE,CAAC,MAAM,KAAK,EAAE,CAAC,YAAY;gBAC3B,CAAC,CAAC,IAAI,CACF,WAAW,EACX,oBAAoB,EAAE,CAAC,MAAM,oBAAoB,EAAE,CAAC,YAAY,GAAG,EACnE,GAAG,CACJ;gBACH,CAAC,CAAC,IAAI,CACF,WAAW,EACX,oBAAoB,EAAE,CAAC,MAAM,oBAAoB,EAAE,CAAC,YAAY,EAAE,EAClE,GAAG,CACJ,CACN,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,oDAAoD,EAAE,GAAG,CAAC,CAAC,CAAC;QAC/F,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,MAAM,GACV,GAAG,YAAY,kBAAkB;YAC/B,CAAC,CAAC,wCAAwC,GAAG,CAAC,OAAO,EAAE;YACvD,CAAC,CAAC,kBAAmB,GAAa,CAAC,OAAO,EAAE,CAAC;QACjD,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC;QACjD,KAAK,GAAG,EAAE,CAAC;IACb,CAAC;IAED,8EAA8E;IAC9E,qCAAqC;IACrC,MAAM,YAAY,CAAC,MAAM,EAAE,qBAAqB,EAAE,GAAG,EAAE,CACrD,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,EAAE,QAAQ,CAAC,EAAE,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,CAC5D,CAAC;IACF,MAAM,YAAY,CAAC,MAAM,EAAE,oBAAoB,EAAE,GAAG,EAAE,CACpD,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,EAAE,QAAQ,CAAC,EAAE,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,CAC5D,CAAC;IAEF,sEAAsE;IACtE,MAAM,OAAO,GAAG,QAAQ,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC;IACvC,MAAM,YAAY,CAAC,MAAM,EAAE,qBAAqB,EAAE,GAAG,EAAE,CACrD,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,CAAC,EAAE,CAAC,UAAU,GAAG,CAAC,CAAC,CAAC,CACtE,CAAC;IACF,MAAM,YAAY,CAAC,MAAM,EAAE,oBAAoB,EAAE,GAAG,EAAE,CACpD,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,CAAC,EAAE,CAAC,UAAU,GAAG,CAAC,CAAC,CAAC,CACtE,CAAC;IAEF,sEAAsE;IACtE,MAAM,YAAY,CAAC,MAAM,EAAE,qBAAqB,EAAE,GAAG,EAAE,CACrD,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,EAAE,QAAQ,CAAC,EAAE,CAAC,SAAS,GAAG,CAAC,CAAC,EAAE,QAAQ,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,CACrF,CAAC;IAEF,6EAA6E;IAC7E,4EAA4E;IAC5E,wEAAwE;IACxE,4EAA4E;IAC5E,6EAA6E;IAC7E,4EAA4E;IAC5E,8EAA8E;IAC9E,+EAA+E;IAC/E,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACrB,MAAM,YAAY,CAAC,MAAM,EAAE,8BAA8B,EAAE,GAAG,EAAE,CAC9D,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,EAAE,YAAY,CAAC,KAAK,CAAC,CAAC,CACrD,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,MAAM,CAAC,IAAI,CACT,IAAI,CACF,8BAA8B,EAC9B,0EAA0E,EAC1E,GAAG,CACJ,CACF,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;IAC9B,OAAO;QACL,QAAQ,EAAE,OAAO;QACjB,MAAM;QACN,QAAQ,EAAE,GAAG;QACb,MAAM;QACN,OAAO,EACL,MAAM,KAAK,MAAM;YACf,CAAC,CAAC,4DAA4D;YAC9D,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,MAAM,uBAAuB;KACjF,CAAC;AACJ,CAAC,CAAC;AAEF;;;;;;;;;;;;;GAaG;AACH,SAAS,YAAY,CAAC,KAAa;IACjC,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IACzC,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;QACpB,GAAG,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,mBAAmB;QAClC,GAAG,CAAC,CAAC,CAAC,GAAI,GAAG,CAAC,CAAC,CAAY,GAAG,IAAI,CAAC,CAAC,yCAAyC;IAC/E,CAAC;IACD,OAAO,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;AAChC,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,YAAY,CACzB,MAAe,EACf,IAAY,EACZ,EAAoD;IAEpD,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,EAAE,EAAE,CAAC;QACxB,IAAI,IAAI,CAAC,EAAE,KAAK,KAAK,EAAE,CAAC;YACtB,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,gCAAgC,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC,OAAO,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;QAC9F,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,IAAI,CACT,IAAI,CAAC,IAAI,EAAE,iEAAiE,EAAE,GAAG,CAAC,CACnF,CAAC;QACJ,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,IAAI,CACT,IAAI,CACF,IAAI,EACJ,iFAAiF;YAC/E,GAAI,GAAa,CAAC,OAAO,EAAE,EAC7B,GAAG,CACJ,CACF,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/categories/slh-dsa.d.ts

@@ -0,0 +1,23 @@
+/**
+ * SLH-DSA self-consistency category (FIPS 205).
+ *
+ * SLH-DSA (the standardized SPHINCS+) presents the same black-box surface as
+ * ML-DSA — keygen / sign / verify — so it reuses the shared signature driver
+ * in signature.ts with the family fixed to "slh-dsa". It covers, for each of
+ * the 12 standardized parameter sets:
+ *   - pk/sk/sig size conformance (FIPS 205 Table 2),
+ *   - sign→verify correctness round-trips,
+ *   - verify rejects a tampered signature and a wrong message,
+ *   - a deterministic-vs-hedged signing advisory probe (SLH-DSA supports both),
+ *   - wrong-length verify inputs rejected with a defined error (AF-05).
+ *
+ * No external vectors are needed for self-consistency; exact-value KAT would
+ * come from official ACVP files via the kat category. We assert NO crypto bytes.
+ *
+ * Out of scope: SP 800-208 stateful hash signatures (LMS / XMSS / HSS). Those
+ * require state-management guarantees a stateless request/response harness
+ * cannot model; see README.md.
+ */
+import type { Category } from "./types.js";
+export declare const slhDsa: Category;
+//# sourceMappingURL=slh-dsa.d.ts.map

package/dist/categories/slh-dsa.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"slh-dsa.d.ts","sourceRoot":"","sources":["../../src/categories/slh-dsa.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAG3C,eAAO,MAAM,MAAM,EAAE,QAAsD,CAAC"}

package/dist/categories/slh-dsa.js

@@ -0,0 +1,23 @@
+/**
+ * SLH-DSA self-consistency category (FIPS 205).
+ *
+ * SLH-DSA (the standardized SPHINCS+) presents the same black-box surface as
+ * ML-DSA — keygen / sign / verify — so it reuses the shared signature driver
+ * in signature.ts with the family fixed to "slh-dsa". It covers, for each of
+ * the 12 standardized parameter sets:
+ *   - pk/sk/sig size conformance (FIPS 205 Table 2),
+ *   - sign→verify correctness round-trips,
+ *   - verify rejects a tampered signature and a wrong message,
+ *   - a deterministic-vs-hedged signing advisory probe (SLH-DSA supports both),
+ *   - wrong-length verify inputs rejected with a defined error (AF-05).
+ *
+ * No external vectors are needed for self-consistency; exact-value KAT would
+ * come from official ACVP files via the kat category. We assert NO crypto bytes.
+ *
+ * Out of scope: SP 800-208 stateful hash signatures (LMS / XMSS / HSS). Those
+ * require state-management guarantees a stateless request/response harness
+ * cannot model; see README.md.
+ */
+import { makeSignatureCategory } from "./signature.js";
+export const slhDsa = makeSignatureCategory("slh-dsa", "slh-dsa");
+//# sourceMappingURL=slh-dsa.js.map

package/dist/categories/slh-dsa.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"slh-dsa.js","sourceRoot":"","sources":["../../src/categories/slh-dsa.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAGH,OAAO,EAAE,qBAAqB,EAAE,MAAM,gBAAgB,CAAC;AAEvD,MAAM,CAAC,MAAM,MAAM,GAAa,qBAAqB,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC"}

package/dist/categories/timing.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Timing category — ADVISORY ONLY (ML-KEM).
+ *
+ * Coarsely compares decapsulation wall-clock time for valid vs. invalid
+ * ciphertexts over many trials. A large, consistent difference can hint at a
+ * non-constant-time reject path (an AF-02-adjacent timing oracle).
+ *
+ * THIS IS NOT A CONFORMANCE VERDICT. Cross-process timing over stdin/stdout is
+ * dominated by IPC and scheduler noise, so the result is reported as ADVISORY
+ * and NEVER fails the overall run. Real constant-time analysis needs in-process
+ * statistical tooling (e.g. dudect), not a black-box harness. Treat any signal
+ * here as "worth a closer look", not proof.
+ */
+import { type Category } from "./types.js";
+export declare const timing: Category;
+//# sourceMappingURL=timing.d.ts.map

package/dist/categories/timing.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"timing.d.ts","sourceRoot":"","sources":["../../src/categories/timing.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,KAAK,QAAQ,EAA+C,MAAM,YAAY,CAAC;AAIxF,eAAO,MAAM,MAAM,EAAE,QAwEpB,CAAC"}

package/dist/categories/timing.js

@@ -0,0 +1,98 @@
+/**
+ * Timing category — ADVISORY ONLY (ML-KEM).
+ *
+ * Coarsely compares decapsulation wall-clock time for valid vs. invalid
+ * ciphertexts over many trials. A large, consistent difference can hint at a
+ * non-constant-time reject path (an AF-02-adjacent timing oracle).
+ *
+ * THIS IS NOT A CONFORMANCE VERDICT. Cross-process timing over stdin/stdout is
+ * dominated by IPC and scheduler noise, so the result is reported as ADVISORY
+ * and NEVER fails the overall run. Real constant-time analysis needs in-process
+ * statistical tooling (e.g. dudect), not a black-box harness. Treat any signal
+ * here as "worth a closer look", not proof.
+ */
+import { pass, skip } from "./types.js";
+import { flipBitB64, kemDecapsRaw, kemEncaps, kemKeygen, requireKem } from "./helpers.js";
+import { toB64 } from "../protocol.js";
+export const timing = async (ctx) => {
+    if (ctx.sizes.family !== "ml-kem") {
+        return {
+            category: "timing",
+            status: "skip",
+            checks: [skip("applicability", "timing probe targets ML-KEM decaps")],
+            summary: "skipped (not ML-KEM)",
+        };
+    }
+    const km = requireKem(ctx.sizes);
+    const param = km.id;
+    const checks = [];
+    // Establish a single key + honest ct + one corrupted ct.
+    let skB64;
+    let honestCtB64;
+    let badCtB64;
+    try {
+        const { pk, sk } = await kemKeygen(ctx.runner, param);
+        skB64 = toB64(sk);
+        const { ct } = await kemEncaps(ctx.runner, param, toB64(pk));
+        honestCtB64 = toB64(ct);
+        badCtB64 = flipBitB64(honestCtB64, 0, 0);
+    }
+    catch (err) {
+        return {
+            category: "timing",
+            status: "skip",
+            checks: [skip("setup", `could not set up timing probe: ${err.message}`)],
+            summary: "skipped — setup failed",
+        };
+    }
+    const trials = Math.max(50, Math.min(ctx.iterations * 20, 2000));
+    // Warm-up to amortize JIT/spawn effects.
+    for (let i = 0; i < 10; i++) {
+        await kemDecapsRaw(ctx.runner, param, skB64, honestCtB64);
+        await kemDecapsRaw(ctx.runner, param, skB64, badCtB64);
+    }
+    const validTimes = await measure(ctx, skB64, honestCtB64, trials, param);
+    const invalidTimes = await measure(ctx, skB64, badCtB64, trials, param);
+    const vMed = median(validTimes);
+    const iMed = median(invalidTimes);
+    const denom = Math.min(vMed, iMed) || 1;
+    const relDiff = Math.abs(vMed - iMed) / denom;
+    // Heuristic, intentionally loose threshold given cross-process noise.
+    const ADVISORY_THRESHOLD = 0.25; // 25% median difference
+    const signal = relDiff > ADVISORY_THRESHOLD;
+    const detail = `valid decaps median ${vMed.toFixed(3)}ms, invalid median ${iMed.toFixed(3)}ms ` +
+        `(rel. diff ${(relDiff * 100).toFixed(1)}%, ${trials} trials each). ` +
+        (signal
+            ? "ADVISORY: noticeable timing gap between valid/invalid decaps — investigate with " +
+                "in-process constant-time tooling; cross-process timing is noisy and not conclusive."
+            : "no strong cross-process timing signal (this is NOT proof of constant-time behavior).");
+    // Always a pass/skip — never fails the run.
+    checks.push(pass("decaps-timing", detail));
+    return {
+        category: "timing",
+        status: "pass",
+        checks,
+        summary: signal
+            ? `ADVISORY timing signal: ${(relDiff * 100).toFixed(1)}% median gap (not a verdict)`
+            : `no strong timing signal (${(relDiff * 100).toFixed(1)}% median gap, advisory)`,
+    };
+};
+async function measure(ctx, skB64, ctB64, trials, param) {
+    const out = [];
+    for (let i = 0; i < trials; i++) {
+        const t0 = performance.now();
+        await kemDecapsRaw(ctx.runner, param, skB64, ctB64);
+        out.push(performance.now() - t0);
+    }
+    return out;
+}
+function median(xs) {
+    if (xs.length === 0)
+        return 0;
+    const sorted = [...xs].sort((a, b) => a - b);
+    const mid = sorted.length >> 1;
+    return sorted.length % 2 === 0
+        ? (sorted[mid - 1] + sorted[mid]) / 2
+        : sorted[mid];
+}
+//# sourceMappingURL=timing.js.map