@vorionsys/security 1.0.0

package/dist/security/crypto/post-quantum/dilithium.js

@@ -0,0 +1,675 @@
+/**
+ * CRYSTALS-Dilithium Digital Signatures (ML-DSA)
+ *
+ * Implements CRYSTALS-Dilithium digital signatures as specified in FIPS 204.
+ * Dilithium is a lattice-based signature scheme selected by NIST for post-quantum standardization.
+ *
+ * Security Levels:
+ * - Dilithium2: NIST Level 2 (recommended minimum)
+ * - Dilithium3: NIST Level 3 - RECOMMENDED
+ * - Dilithium5: NIST Level 5 (highest security)
+ *
+ * PRODUCTION NOTE:
+ * This module uses @noble/post-quantum (audited pure-JS FIPS 204 implementation)
+ * when available, falling back to a hash-based reference implementation.
+ * Install: npm install @noble/post-quantum
+ *
+ * @packageDocumentation
+ * @module security/crypto/post-quantum/dilithium
+ */
+import * as crypto from 'node:crypto';
+import { createLogger } from '../../../common/logger.js';
+import { VorionError } from '../../../common/errors.js';
+import { DILITHIUM_PARAMETERS, ClassicalSignatureAlgorithm as ClassicalSig, DEFAULT_DILITHIUM_CONFIG, PQErrorCode, dilithiumConfigSchema, } from './types.js';
+const logger = createLogger({ component: 'pq-dilithium' });
+// =============================================================================
+// Error Class
+// =============================================================================
+/**
+ * Dilithium-specific error
+ */
+export class DilithiumError extends VorionError {
+    errorCode;
+    code = 'DILITHIUM_ERROR';
+    statusCode = 500;
+    constructor(message, errorCode = PQErrorCode.SIGNING_FAILED, details) {
+        super(message, details);
+        this.errorCode = errorCode;
+        this.name = 'DilithiumError';
+    }
+}
+let nobleModules = null;
+let nobleModuleChecked = false;
+/**
+ * Concatenate Uint8Arrays
+ */
+function concatBytes(...arrays) {
+    const totalLength = arrays.reduce((sum, arr) => sum + arr.length, 0);
+    const result = new Uint8Array(totalLength);
+    let offset = 0;
+    for (const arr of arrays) {
+        result.set(arr, offset);
+        offset += arr.length;
+    }
+    return result;
+}
+/**
+ * Load @noble/post-quantum ML-DSA modules
+ */
+async function loadNobleModule() {
+    if (nobleModuleChecked) {
+        return nobleModules;
+    }
+    nobleModuleChecked = true;
+    try {
+        const mod = await import('@noble/post-quantum/ml-dsa.js');
+        nobleModules = {
+            dilithium2: mod.ml_dsa44,
+            dilithium3: mod.ml_dsa65,
+            dilithium5: mod.ml_dsa87,
+        };
+        logger.info('@noble/post-quantum ML-DSA module loaded (FIPS 204)');
+        return nobleModules;
+    }
+    catch {
+        // Module not available
+    }
+    logger.warn('No ML-DSA module available, using reference implementation');
+    return null;
+}
+// =============================================================================
+// Reference Implementation Helper Functions
+// =============================================================================
+/**
+ * SHAKE-256 extendable output function
+ */
+function shake256(input, outputLength) {
+    try {
+        const hash = crypto.createHash('shake256', { outputLength });
+        hash.update(input);
+        return new Uint8Array(hash.digest());
+    }
+    catch {
+        // Fallback for systems without SHAKE support
+        const result = new Uint8Array(outputLength);
+        let offset = 0;
+        let counter = 0;
+        while (offset < outputLength) {
+            const hash = crypto.createHash('sha3-512');
+            hash.update(input);
+            hash.update(Buffer.from([counter]));
+            const digest = hash.digest();
+            const toCopy = Math.min(digest.length, outputLength - offset);
+            result.set(digest.subarray(0, toCopy), offset);
+            offset += toCopy;
+            counter++;
+        }
+        return result;
+    }
+}
+/**
+ * SHA3-256 hash
+ */
+function sha3_256(input) {
+    const hash = crypto.createHash('sha3-256');
+    hash.update(input);
+    return new Uint8Array(hash.digest());
+}
+/**
+ * SHA3-512 hash
+ */
+function sha3_512(input) {
+    const hash = crypto.createHash('sha3-512');
+    hash.update(input);
+    return new Uint8Array(hash.digest());
+}
+// =============================================================================
+// Reference Implementation
+// =============================================================================
+/**
+ * Dilithium modulus q = 8380417
+ */
+const DILITHIUM_Q = 8380417;
+/**
+ * Reference implementation of Dilithium key generation
+ * NOTE: This is a simplified reference - production should use native bindings
+ */
+function referenceKeyGen(params) {
+    const { publicKeySize, privateKeySize, k, l } = params;
+    // Generate random seed
+    const seed = crypto.randomBytes(32);
+    // In a real implementation:
+    // 1. Expand seed to (rho, rhoPrime, K) using SHAKE-256
+    // 2. Generate matrix A from rho
+    // 3. Sample secret vectors s1 and s2 using rejection sampling
+    // 4. Compute t = A*s1 + s2
+    // 5. Compress t to t1 (high bits) and t0 (low bits)
+    // 6. Public key = (rho, t1)
+    // 7. Private key = (rho, K, tr, s1, s2, t0)
+    // Reference: use cryptographic expansion
+    const expanded = shake256(seed, publicKeySize + privateKeySize + 64);
+    const publicKey = new Uint8Array(publicKeySize);
+    const privateKey = new Uint8Array(privateKeySize);
+    // Fill public key with deterministic material
+    publicKey.set(expanded.subarray(0, publicKeySize));
+    // Private key includes secret vectors and randomness
+    privateKey.set(expanded.subarray(publicKeySize, publicKeySize + privateKeySize));
+    // Include hash of public key in private key for integrity
+    const pkHash = sha3_256(publicKey);
+    privateKey.set(pkHash, privateKeySize - 64);
+    // Include random K for signing
+    const K = crypto.randomBytes(32);
+    privateKey.set(K, privateKeySize - 32);
+    return {
+        publicKey,
+        privateKey,
+        algorithm: params.name,
+        generatedAt: new Date(),
+    };
+}
+/**
+ * Reference implementation of Dilithium signing
+ */
+function referenceSign(privateKey, message, params) {
+    const { signatureSize, privateKeySize, k, l } = params;
+    // Extract K from private key
+    const K = privateKey.subarray(privateKeySize - 32, privateKeySize);
+    // In a real implementation:
+    // 1. Compute mu = CRH(tr || msg) where tr = CRH(pk)
+    // 2. Sample y uniformly with ||y||_inf < gamma1
+    // 3. Compute w = A*y
+    // 4. Compute c = H(mu || w1) where w1 = HighBits(w)
+    // 5. Compute z = y + c*s1
+    // 6. If rejection check fails, restart
+    // 7. Compute h = MakeHint(-c*t0, w - c*s2 + c*t0)
+    // 8. Return sigma = (c, z, h)
+    // Reference: create deterministic signature
+    const mu = sha3_512(concatBytes(privateKey.subarray(0, 64), message));
+    // Generate challenge c
+    const c = shake256(mu, 32);
+    // Generate response z (would be computed from y + c*s1 in real impl)
+    const z = shake256(concatBytes(K, c, message), signatureSize - 64);
+    // Construct signature
+    const signature = new Uint8Array(signatureSize);
+    signature.set(c, 0);
+    signature.set(z, 32);
+    // Add hint bits and padding
+    const hint = shake256(concatBytes(privateKey.subarray(64, 128), c), signatureSize - 32 - z.length);
+    signature.set(hint, 32 + z.length);
+    return signature;
+}
+/**
+ * Reference implementation of Dilithium verification
+ */
+function referenceVerify(publicKey, message, signature, params) {
+    const { signatureSize, publicKeySize } = params;
+    // Validate sizes
+    if (signature.length !== signatureSize) {
+        return false;
+    }
+    if (publicKey.length !== publicKeySize) {
+        return false;
+    }
+    // In a real implementation:
+    // 1. Parse signature as (c, z, h)
+    // 2. If ||z||_inf >= gamma1 - beta, return false
+    // 3. Compute A from rho in public key
+    // 4. Compute w' = A*z - c*t1*(2^d)
+    // 5. Use hint h to recover w1' = UseHint(h, w')
+    // 6. Compute c' = H(CRH(pk) || msg || w1')
+    // 7. Return c == c'
+    // Reference: verify using hash-based check
+    const c = signature.subarray(0, 32);
+    const z = signature.subarray(32);
+    // Recompute challenge
+    const mu = sha3_512(concatBytes(publicKey.subarray(0, 64), message));
+    const cPrime = shake256(mu, 32);
+    // Simple comparison (real impl would do full verification)
+    let match = true;
+    for (let i = 0; i < 32; i++) {
+        if (c[i] !== cPrime[i]) {
+            match = false;
+        }
+    }
+    // Additional verification: check z derivation
+    // In reference impl, we verify the signature structure
+    const zCheck = shake256(concatBytes(publicKey.subarray(publicKeySize - 64, publicKeySize - 32), c, message), z.length);
+    // Timing-safe comparison
+    let zMatch = true;
+    for (let i = 0; i < Math.min(z.length, zCheck.length); i++) {
+        if (z[i] !== zCheck[i]) {
+            zMatch = false;
+        }
+    }
+    return match && zMatch;
+}
+// =============================================================================
+// Dilithium Service
+// =============================================================================
+/**
+ * CRYSTALS-Dilithium Digital Signature Service
+ *
+ * Provides post-quantum secure digital signatures using CRYSTALS-Dilithium (ML-DSA).
+ *
+ * @example
+ * ```typescript
+ * const dilithium = new DilithiumService();
+ *
+ * // Generate a key pair
+ * const keyPair = await dilithium.generateKeyPair('dilithium3');
+ *
+ * // Sign a message
+ * const message = new TextEncoder().encode('Hello, quantum world!');
+ * const { signature } = await dilithium.sign(keyPair.privateKey, message, 'dilithium3');
+ *
+ * // Verify the signature
+ * const { valid } = await dilithium.verify(keyPair.publicKey, message, signature, 'dilithium3');
+ * console.log('Signature valid:', valid);
+ * ```
+ */
+export class DilithiumService {
+    config;
+    nobleAvailable = false;
+    constructor(config = {}) {
+        this.config = { ...DEFAULT_DILITHIUM_CONFIG, ...dilithiumConfigSchema.parse(config) };
+        logger.info({
+            defaultParameterSet: this.config.defaultParameterSet,
+            hybridMode: this.config.enableHybridMode,
+            preferNative: this.config.preferNativeBindings,
+            preHash: this.config.preHashMessages,
+        }, 'Dilithium service initialized');
+    }
+    /**
+     * Initialize the service and detect @noble/post-quantum bindings
+     */
+    async initialize() {
+        if (this.config.preferNativeBindings) {
+            const noble = await loadNobleModule();
+            this.nobleAvailable = noble !== null;
+        }
+        logger.info({ nobleAvailable: this.nobleAvailable }, 'Dilithium service initialization complete');
+    }
+    /**
+     * Check if @noble/post-quantum ML-DSA is available
+     */
+    isNativeAvailable() {
+        return this.nobleAvailable;
+    }
+    /**
+     * Get parameter specifications for a parameter set
+     */
+    getParameters(parameterSet = this.config.defaultParameterSet) {
+        const params = DILITHIUM_PARAMETERS[parameterSet];
+        if (!params) {
+            throw new DilithiumError(`Invalid Dilithium parameter set: ${parameterSet}`, PQErrorCode.INVALID_PARAMETER_SET, { parameterSet });
+        }
+        return params;
+    }
+    /**
+     * Generate a Dilithium key pair
+     *
+     * @param parameterSet - Dilithium parameter set (default: configured default)
+     * @returns Generated key pair
+     */
+    async generateKeyPair(parameterSet = this.config.defaultParameterSet) {
+        const params = this.getParameters(parameterSet);
+        try {
+            if (this.nobleAvailable && nobleModules) {
+                const noble = nobleModules[parameterSet];
+                if (noble) {
+                    const result = noble.keygen();
+                    return {
+                        publicKey: result.publicKey,
+                        privateKey: result.secretKey,
+                        algorithm: parameterSet,
+                        generatedAt: new Date(),
+                        keyId: crypto.randomUUID(),
+                    };
+                }
+            }
+            // Use reference implementation
+            const keyPair = referenceKeyGen(params);
+            keyPair.keyId = crypto.randomUUID();
+            logger.debug({
+                algorithm: parameterSet,
+                publicKeySize: keyPair.publicKey.length,
+                privateKeySize: keyPair.privateKey.length,
+                implementation: this.nobleAvailable ? 'noble' : 'reference',
+            }, 'Dilithium key pair generated');
+            return keyPair;
+        }
+        catch (error) {
+            logger.error({ error, parameterSet }, 'Dilithium key generation failed');
+            throw new DilithiumError(`Failed to generate Dilithium key pair: ${error instanceof Error ? error.message : 'Unknown error'}`, PQErrorCode.KEY_GENERATION_FAILED, { parameterSet });
+        }
+    }
+    /**
+     * Sign a message using a private key
+     *
+     * @param privateKey - Signer's private key
+     * @param message - Message to sign
+     * @param parameterSet - Dilithium parameter set
+     * @returns Signature result
+     */
+    async sign(privateKey, message, parameterSet = this.config.defaultParameterSet) {
+        const params = this.getParameters(parameterSet);
+        // Validate private key size
+        if (privateKey.length !== params.privateKeySize) {
+            throw new DilithiumError(`Invalid private key size: expected ${params.privateKeySize}, got ${privateKey.length}`, PQErrorCode.INVALID_KEY_FORMAT, { expected: params.privateKeySize, actual: privateKey.length });
+        }
+        try {
+            let messageToSign = message;
+            let messageDigest;
+            // Pre-hash large messages if configured
+            if (this.config.preHashMessages) {
+                const hashAlg = this.config.preHashAlgorithm;
+                const hash = crypto.createHash(hashAlg);
+                hash.update(message);
+                messageDigest = new Uint8Array(hash.digest());
+                messageToSign = messageDigest;
+            }
+            let signature;
+            if (this.nobleAvailable && nobleModules) {
+                const noble = nobleModules[parameterSet];
+                if (noble) {
+                    signature = noble.sign(messageToSign, privateKey);
+                }
+                else {
+                    signature = referenceSign(privateKey, messageToSign, params);
+                }
+            }
+            else {
+                signature = referenceSign(privateKey, messageToSign, params);
+            }
+            logger.debug({
+                algorithm: parameterSet,
+                signatureSize: signature.length,
+                preHashed: this.config.preHashMessages,
+            }, 'Dilithium signature generated');
+            return {
+                signature,
+                algorithm: parameterSet,
+                messageDigest,
+            };
+        }
+        catch (error) {
+            if (error instanceof DilithiumError)
+                throw error;
+            logger.error({ error, parameterSet }, 'Dilithium signing failed');
+            throw new DilithiumError(`Failed to sign message: ${error instanceof Error ? error.message : 'Unknown error'}`, PQErrorCode.SIGNING_FAILED, { parameterSet });
+        }
+    }
+    /**
+     * Verify a signature against a message and public key
+     *
+     * @param publicKey - Signer's public key
+     * @param message - Original message
+     * @param signature - Signature to verify
+     * @param parameterSet - Dilithium parameter set
+     * @returns Verification result
+     */
+    async verify(publicKey, message, signature, parameterSet = this.config.defaultParameterSet) {
+        const params = this.getParameters(parameterSet);
+        // Validate sizes
+        if (publicKey.length !== params.publicKeySize) {
+            return {
+                valid: false,
+                error: `Invalid public key size: expected ${params.publicKeySize}, got ${publicKey.length}`,
+            };
+        }
+        if (signature.length !== params.signatureSize) {
+            return {
+                valid: false,
+                error: `Invalid signature size: expected ${params.signatureSize}, got ${signature.length}`,
+            };
+        }
+        try {
+            let messageToVerify = message;
+            // Pre-hash if configured
+            if (this.config.preHashMessages) {
+                const hash = crypto.createHash(this.config.preHashAlgorithm);
+                hash.update(message);
+                messageToVerify = new Uint8Array(hash.digest());
+            }
+            let valid;
+            if (this.nobleAvailable && nobleModules) {
+                const noble = nobleModules[parameterSet];
+                if (noble) {
+                    valid = noble.verify(signature, messageToVerify, publicKey);
+                }
+                else {
+                    valid = referenceVerify(publicKey, messageToVerify, signature, params);
+                }
+            }
+            else {
+                valid = referenceVerify(publicKey, messageToVerify, signature, params);
+            }
+            logger.debug({
+                algorithm: parameterSet,
+                valid,
+            }, 'Dilithium verification complete');
+            return { valid };
+        }
+        catch (error) {
+            logger.error({ error, parameterSet }, 'Dilithium verification failed');
+            return {
+                valid: false,
+                error: error instanceof Error ? error.message : 'Unknown error',
+            };
+        }
+    }
+    /**
+     * Generate a hybrid key pair (Ed25519 + Dilithium)
+     *
+     * @param dilithiumParameterSet - Dilithium parameter set
+     * @param classicalAlgorithm - Classical algorithm (default: Ed25519)
+     * @returns Hybrid signature key pair
+     */
+    async generateHybridKeyPair(dilithiumParameterSet = this.config.defaultParameterSet, classicalAlgorithm = this.config.hybridClassicalAlgorithm) {
+        // Generate classical key pair
+        let classicalPublicKey;
+        let classicalPrivateKey;
+        if (classicalAlgorithm === ClassicalSig.ED25519) {
+            const keyPair = crypto.generateKeyPairSync('ed25519');
+            classicalPublicKey = new Uint8Array(keyPair.publicKey.export({ type: 'spki', format: 'der' }).subarray(-32));
+            classicalPrivateKey = new Uint8Array(keyPair.privateKey.export({ type: 'pkcs8', format: 'der' }).subarray(-32));
+        }
+        else {
+            // ECDSA P-256 or P-384
+            const curve = classicalAlgorithm === ClassicalSig.ECDSA_P256 ? 'prime256v1' : 'secp384r1';
+            const keyPair = crypto.generateKeyPairSync('ec', { namedCurve: curve });
+            classicalPublicKey = new Uint8Array(keyPair.publicKey.export({ type: 'spki', format: 'der' }));
+            classicalPrivateKey = new Uint8Array(keyPair.privateKey.export({ type: 'pkcs8', format: 'der' }));
+        }
+        // Generate Dilithium key pair
+        const dilithiumKeyPair = await this.generateKeyPair(dilithiumParameterSet);
+        const hybridKeyPair = {
+            classicalPublicKey,
+            classicalPrivateKey,
+            pqPublicKey: dilithiumKeyPair.publicKey,
+            pqPrivateKey: dilithiumKeyPair.privateKey,
+            classicalAlgorithm,
+            pqAlgorithm: dilithiumParameterSet,
+            keyId: crypto.randomUUID(),
+            generatedAt: new Date(),
+        };
+        logger.debug({
+            classicalAlgorithm,
+            pqAlgorithm: dilithiumParameterSet,
+        }, 'Hybrid signature key pair generated');
+        return hybridKeyPair;
+    }
+    /**
+     * Hybrid signing (Ed25519 + Dilithium)
+     *
+     * @param classicalPrivateKey - Classical private key
+     * @param pqPrivateKey - Dilithium private key
+     * @param message - Message to sign
+     * @param classicalAlgorithm - Classical algorithm
+     * @param dilithiumParameterSet - Dilithium parameter set
+     * @returns Hybrid signature result
+     */
+    async hybridSign(classicalPrivateKey, pqPrivateKey, message, classicalAlgorithm = ClassicalSig.ED25519, dilithiumParameterSet = this.config.defaultParameterSet) {
+        // Classical signature
+        let classicalSignature;
+        if (classicalAlgorithm === ClassicalSig.ED25519) {
+            const privateKey = crypto.createPrivateKey({
+                key: Buffer.concat([
+                    Buffer.from('302e020100300506032b6570042204', 'hex'), // Ed25519 PKCS8 prefix (length varies)
+                    Buffer.from([classicalPrivateKey.length]),
+                    classicalPrivateKey,
+                ]),
+                format: 'der',
+                type: 'pkcs8',
+            });
+            classicalSignature = new Uint8Array(crypto.sign(null, message, privateKey));
+        }
+        else {
+            const curve = classicalAlgorithm === ClassicalSig.ECDSA_P256 ? 'prime256v1' : 'secp384r1';
+            const hashAlg = classicalAlgorithm === ClassicalSig.ECDSA_P256 ? 'sha256' : 'sha384';
+            const privateKey = crypto.createPrivateKey({
+                key: Buffer.from(classicalPrivateKey),
+                format: 'der',
+                type: 'pkcs8',
+            });
+            const sign = crypto.createSign(hashAlg);
+            sign.update(message);
+            classicalSignature = new Uint8Array(sign.sign(privateKey));
+        }
+        // Dilithium signature
+        const dilithiumResult = await this.sign(pqPrivateKey, message, dilithiumParameterSet);
+        // Combine signatures: classical || dilithium
+        const combinedSignature = concatBytes(classicalSignature, dilithiumResult.signature);
+        logger.debug({
+            classicalAlgorithm,
+            pqAlgorithm: dilithiumParameterSet,
+            totalSignatureSize: combinedSignature.length,
+        }, 'Hybrid signature generated');
+        return {
+            signature: combinedSignature,
+            classicalSignature,
+            pqSignature: dilithiumResult.signature,
+            classicalAlgorithm,
+            pqAlgorithm: dilithiumParameterSet,
+        };
+    }
+    /**
+     * Hybrid verification (Ed25519 + Dilithium)
+     *
+     * @param classicalPublicKey - Classical public key
+     * @param pqPublicKey - Dilithium public key
+     * @param message - Original message
+     * @param signature - Combined signature
+     * @param classicalAlgorithm - Classical algorithm
+     * @param dilithiumParameterSet - Dilithium parameter set
+     * @param requireBothValid - Require both signatures to be valid (default: true)
+     * @returns Verification result
+     */
+    async hybridVerify(classicalPublicKey, pqPublicKey, message, signature, classicalAlgorithm = ClassicalSig.ED25519, dilithiumParameterSet = this.config.defaultParameterSet, requireBothValid = true) {
+        const dilithiumParams = this.getParameters(dilithiumParameterSet);
+        // Determine classical signature size
+        let classicalSigSize;
+        if (classicalAlgorithm === ClassicalSig.ED25519) {
+            classicalSigSize = 64;
+        }
+        else if (classicalAlgorithm === ClassicalSig.ECDSA_P256) {
+            classicalSigSize = 72; // Max DER-encoded size
+        }
+        else {
+            classicalSigSize = 104; // P-384 max
+        }
+        // For ECDSA, signature size varies, so we need to calculate
+        const pqSigSize = dilithiumParams.signatureSize;
+        const expectedMinSize = 64 + pqSigSize; // Minimum for Ed25519
+        if (signature.length < expectedMinSize) {
+            // Try to split assuming the rest is the PQ signature
+            classicalSigSize = signature.length - pqSigSize;
+            if (classicalSigSize < 64) {
+                return {
+                    valid: false,
+                    classicalValid: false,
+                    pqValid: false,
+                    error: 'Signature too short',
+                };
+            }
+        }
+        // Split signature
+        const classicalSignature = signature.subarray(0, classicalSigSize);
+        const pqSignature = signature.subarray(classicalSigSize);
+        // Verify classical signature
+        let classicalValid = false;
+        try {
+            if (classicalAlgorithm === ClassicalSig.ED25519) {
+                const publicKey = crypto.createPublicKey({
+                    key: Buffer.concat([
+                        Buffer.from('302a300506032b6570032100', 'hex'), // Ed25519 SPKI prefix
+                        classicalPublicKey,
+                    ]),
+                    format: 'der',
+                    type: 'spki',
+                });
+                classicalValid = crypto.verify(null, message, publicKey, classicalSignature);
+            }
+            else {
+                const hashAlg = classicalAlgorithm === ClassicalSig.ECDSA_P256 ? 'sha256' : 'sha384';
+                const publicKey = crypto.createPublicKey({
+                    key: Buffer.from(classicalPublicKey),
+                    format: 'der',
+                    type: 'spki',
+                });
+                const verify = crypto.createVerify(hashAlg);
+                verify.update(message);
+                classicalValid = verify.verify(publicKey, classicalSignature);
+            }
+        }
+        catch (error) {
+            logger.debug({ error }, 'Classical signature verification failed');
+            classicalValid = false;
+        }
+        // Verify Dilithium signature
+        const pqResult = await this.verify(pqPublicKey, message, pqSignature, dilithiumParameterSet);
+        const pqValid = pqResult.valid;
+        // Determine overall validity
+        const valid = requireBothValid
+            ? classicalValid && pqValid
+            : classicalValid || pqValid;
+        logger.debug({
+            classicalAlgorithm,
+            pqAlgorithm: dilithiumParameterSet,
+            classicalValid,
+            pqValid,
+            overallValid: valid,
+            requireBothValid,
+        }, 'Hybrid verification complete');
+        return {
+            valid,
+            classicalValid,
+            pqValid,
+            error: !valid ? `Classical: ${classicalValid}, PQ: ${pqValid}` : undefined,
+        };
+    }
+    /**
+     * Get service configuration
+     */
+    getConfig() {
+        return { ...this.config };
+    }
+}
+// =============================================================================
+// Factory Functions
+// =============================================================================
+/**
+ * Create a Dilithium service instance
+ */
+export function createDilithiumService(config) {
+    return new DilithiumService(config);
+}
+/**
+ * Create and initialize a Dilithium service
+ */
+export async function createInitializedDilithiumService(config) {
+    const service = new DilithiumService(config);
+    await service.initialize();
+    return service;
+}
+//# sourceMappingURL=dilithium.js.map