leviathan-crypto 2.0.1 → 3.0.0

package/dist/mldsa/hashvariant.d.ts

@@ -0,0 +1,32 @@
+import type { Sha3Exports } from './types.js';
+import type { Sha2Exports } from '../sha2/types.js';
+/** FIPS 204 §5.4.1, approved pre-hash functions. Names follow the spec
+ *  spelling (no hyphens between SHAKE and the digit). The SHAKE entries
+ *  are XOFs with fixed output lengths set by FIPS 204 §5.4.1:
+ *  SHAKE128 → 256-bit (32-byte) output, SHAKE256 → 512-bit (64-byte). */
+export type PreHashAlgorithm = 'SHA2-224' | 'SHA2-256' | 'SHA2-384' | 'SHA2-512' | 'SHA2-512/224' | 'SHA2-512/256' | 'SHA3-224' | 'SHA3-256' | 'SHA3-384' | 'SHA3-512' | 'SHAKE128' | 'SHAKE256';
+/** Look up the FIPS 204 §5.4.1 OID DER bytes for `algo`. Returns a fresh
+ *  Uint8Array each call so callers can wipe / mutate without aliasing the
+ *  module-private constant. */
+export declare function getOid(algo: PreHashAlgorithm): Uint8Array;
+/** FIPS 204 §5.4.1 PH_M byte length for `algo`. SHAKE128 / SHAKE256 are
+ *  XOFs but the spec fixes their HashML-DSA output to 32 / 64 bytes
+ *  respectively; the SHA-3 and SHA-2 entries return their natural digest
+ *  size. Used by `validateDigest` to bound the caller-supplied prehash. */
+export declare function digestSize(algo: PreHashAlgorithm): number;
+/** True iff `algo` is one of the SHA-2 family pre-hashes (and therefore
+ *  requires `init({ sha2: ... })`). The SHA-3 family and SHAKE variants
+ *  use the same `sha3` module mldsa already requires. */
+export declare function algoNeedsSha2(algo: PreHashAlgorithm): boolean;
+/**
+ * Pre-hash dispatcher, applies the FIPS 204 §5.4.1 hash function `algo`
+ * to message `M` and returns PH_M (the bytes that go into M' alongside
+ * the OID).
+ *
+ * `sha2x` may be `undefined` if `algo` does not need the sha2 module
+ * (i.e. SHA3-* / SHAKE*). When `algo` is a SHA-2 variant, the dispatcher
+ * throws if `sha2x` is missing rather than NPE'ing on a member access.
+ * The arrangement keeps sha2 strictly optional for pure-ML-DSA users and
+ * SHA3-prehash HashML-DSA users.
+ */
+export declare function preHashMessage(sx: Sha3Exports, sha2x: Sha2Exports | undefined, algo: PreHashAlgorithm, M: Uint8Array): Uint8Array;

package/dist/mldsa/hashvariant.js

@@ -0,0 +1,248 @@
+//                  ▄▄▄▄▄▄▄▄▄▄
+//           ▄████████████████████▄▄          ▒  ▄▀▀ ▒ ▒ █ ▄▀▄ ▀█▀ █ ▒ ▄▀▄ █▀▄
+//        ▄██████████████████████ ▀████▄      ▓  ▓▀  ▓ ▓ ▓ ▓▄▓  ▓  ▓▀▓ ▓▄▓ ▓ ▓
+//      ▄█████████▀▀▀     ▀███████▄▄███████▌  ▀▄ ▀▄▄ ▀▄▀ ▒ ▒ ▒  ▒  ▒ █ ▒ ▒ ▒ █
+//     ▐████████▀   ▄▄▄▄     ▀████████▀██▀█▌
+//     ████████      ███▀▀     ████▀  █▀ █▀       Leviathan Crypto Library
+//     ███████▌    ▀██▀         ███
+//      ███████   ▀███           ▀██ ▀█▄      Repository & Mirror:
+//       ▀██████   ▄▄██            ▀▀  ██▄    github.com/xero/leviathan-crypto
+//         ▀█████▄   ▄██▄             ▄▀▄▀    unpkg.com/leviathan-crypto
+//            ▀████▄   ▄██▄
+//              ▐████   ▐███                  Author: xero (https://x-e.ro)
+//       ▄▄██████████    ▐███         ▄▄      License: MIT
+//    ▄██▀▀▀▀▀▀▀▀▀▀     ▄████      ▄██▀
+//  ▄▀  ▄▄█████████▄▄  ▀▀▀▀▀     ▄███         This file is provided completely
+//   ▄██████▀▀▀▀▀▀██████▄ ▀▄▄▄▄████▀          free, "as is", and without
+//  ████▀    ▄▄▄▄▄▄▄ ▀████▄ ▀█████▀  ▄▄▄▄     warranty of any kind. The author
+//  █████▄▄█████▀▀▀▀▀▀▄ ▀███▄      ▄████      assumes absolutely no liability
+//   ▀██████▀             ▀████▄▄▄████▀       for its {ab,mis,}use.
+//                           ▀█████▀▀
+//
+// src/ts/mldsa/hashvariant.ts
+//
+// HashML-DSA pre-hash dispatcher and OID DER table.
+// FIPS 204 §5.4 / §5.4.1, Algorithm 4 (HashML-DSA.Sign) and Algorithm 5
+// (HashML-DSA.Verify) build M' = 0x01 ‖ |ctx| ‖ ctx ‖ OID ‖ PH_M, where
+//   • PH_M = H_PH(M) for the caller-selected approved pre-hash function PH
+//   • OID  = the DER encoding of PH's NIST CSOR object identifier
+//
+// The 12 approved pre-hash functions (FIPS 204 §5.4.1) are SHA2-{224,256,
+// 384,512,512/224,512/256}, SHA3-{224,256,384,512}, and the two XOFs
+// SHAKE128 / SHAKE256 with fixed 256- / 512-bit outputs respectively.
+//
+// All OIDs share the 10-byte DER prefix `06 09 60 86 48 01 65 03 04 02`
+// (joint-iso-itu-t.country(2).us(16).organization(840).gov(1).csor(101)
+// .nistalgorithm(3).hashalgs(4).hashalg(2)) and are distinguished by the
+// trailing arc byte. Spec authority: FIPS 204 Algorithm 4 lines 12, 15,
+// 18 enumerates SHA-256 (.01), SHA-512 (.03), and SHAKE128 (.0B) by
+// example; the remaining nine arcs are the NIST CSOR registrations
+// (RFC 5754 / RFC 8702) on the same 2.16.840.1.101.3.4.2.x branch and
+// must match the verifying-party expectation byte-for-byte.
+import { sha3Absorb } from './sha3-helpers.js';
+// ── OID DER table, FIPS 204 §5.4.1 ─────────────────────────────────────────
+// Shared 10-byte DER prefix: tag 0x06 (OBJECT IDENTIFIER), length 0x09,
+// then the encoded ancestor arcs 2.16.840.1.101.3.4.2:
+//   2.16   → 0x60 0x86 0x48                  (joint-iso-itu-t.country)
+//   .1     → 0x01                            (us)
+//   .101   → 0x65                            (organization → gov)
+//   .3.4.2 → 0x03 0x04 0x02                  (csor.nistalgorithm.hashalgs)
+// The trailing byte is the per-algorithm arc.
+const DER_PREFIX = Object.freeze([0x06, 0x09, 0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02]);
+function oid(arc) {
+    const out = new Uint8Array(11);
+    for (let i = 0; i < 10; i++)
+        out[i] = DER_PREFIX[i];
+    out[10] = arc & 0xFF;
+    return out;
+}
+// id-sha224, 2.16.840.1.101.3.4.2.4
+const OID_SHA2_224 = oid(0x04);
+// id-sha256, 2.16.840.1.101.3.4.2.1 (FIPS 204 §5.4.1 Algorithm 4 line 12)
+const OID_SHA2_256 = oid(0x01);
+// id-sha384, 2.16.840.1.101.3.4.2.2
+const OID_SHA2_384 = oid(0x02);
+// id-sha512, 2.16.840.1.101.3.4.2.3 (FIPS 204 §5.4.1 Algorithm 4 line 15)
+const OID_SHA2_512 = oid(0x03);
+// id-sha512-224, 2.16.840.1.101.3.4.2.5
+const OID_SHA2_512_224 = oid(0x05);
+// id-sha512-256, 2.16.840.1.101.3.4.2.6
+const OID_SHA2_512_256 = oid(0x06);
+// id-sha3-224, 2.16.840.1.101.3.4.2.7
+const OID_SHA3_224 = oid(0x07);
+// id-sha3-256, 2.16.840.1.101.3.4.2.8
+const OID_SHA3_256 = oid(0x08);
+// id-sha3-384, 2.16.840.1.101.3.4.2.9
+const OID_SHA3_384 = oid(0x09);
+// id-sha3-512, 2.16.840.1.101.3.4.2.10
+const OID_SHA3_512 = oid(0x0A);
+// id-shake128, 2.16.840.1.101.3.4.2.11 (FIPS 204 §5.4.1 Algorithm 4 line 18)
+const OID_SHAKE128 = oid(0x0B);
+// id-shake256, 2.16.840.1.101.3.4.2.12
+const OID_SHAKE256 = oid(0x0C);
+const OID_TABLE = Object.freeze({
+    'SHA2-224': OID_SHA2_224,
+    'SHA2-256': OID_SHA2_256,
+    'SHA2-384': OID_SHA2_384,
+    'SHA2-512': OID_SHA2_512,
+    'SHA2-512/224': OID_SHA2_512_224,
+    'SHA2-512/256': OID_SHA2_512_256,
+    'SHA3-224': OID_SHA3_224,
+    'SHA3-256': OID_SHA3_256,
+    'SHA3-384': OID_SHA3_384,
+    'SHA3-512': OID_SHA3_512,
+    'SHAKE128': OID_SHAKE128,
+    'SHAKE256': OID_SHAKE256,
+});
+/** Look up the FIPS 204 §5.4.1 OID DER bytes for `algo`. Returns a fresh
+ *  Uint8Array each call so callers can wipe / mutate without aliasing the
+ *  module-private constant. */
+export function getOid(algo) {
+    const tab = OID_TABLE[algo];
+    if (!tab)
+        throw new RangeError(`leviathan-crypto: unsupported HashML-DSA pre-hash algorithm '${algo}'`);
+    return tab.slice();
+}
+/** FIPS 204 §5.4.1 PH_M byte length for `algo`. SHAKE128 / SHAKE256 are
+ *  XOFs but the spec fixes their HashML-DSA output to 32 / 64 bytes
+ *  respectively; the SHA-3 and SHA-2 entries return their natural digest
+ *  size. Used by `validateDigest` to bound the caller-supplied prehash. */
+export function digestSize(algo) {
+    switch (algo) {
+        case 'SHA2-224': return 28;
+        case 'SHA2-256': return 32;
+        case 'SHA2-384': return 48;
+        case 'SHA2-512': return 64;
+        case 'SHA2-512/224': return 28;
+        case 'SHA2-512/256': return 32;
+        case 'SHA3-224': return 28;
+        case 'SHA3-256': return 32;
+        case 'SHA3-384': return 48;
+        case 'SHA3-512': return 64;
+        case 'SHAKE128': return 32;
+        case 'SHAKE256': return 64;
+        default: {
+            const exhaustive = algo;
+            throw new RangeError(`leviathan-crypto: unsupported HashML-DSA pre-hash algorithm '${exhaustive}'`);
+        }
+    }
+}
+/** True iff `algo` is one of the SHA-2 family pre-hashes (and therefore
+ *  requires `init({ sha2: ... })`). The SHA-3 family and SHAKE variants
+ *  use the same `sha3` module mldsa already requires. */
+export function algoNeedsSha2(algo) {
+    switch (algo) {
+        case 'SHA2-224':
+        case 'SHA2-256':
+        case 'SHA2-384':
+        case 'SHA2-512':
+        case 'SHA2-512/224':
+        case 'SHA2-512/256':
+            return true;
+        default:
+            return false;
+    }
+}
+// ── SHA-2 driver ────────────────────────────────────────────────────────────
+// Mirrors the `feedHash` pattern in src/ts/sha2/index.ts, but kept inline
+// here so hashvariant.ts is the only file that needs to know about HashML-DSA's
+// SHA-2 dispatch table.
+function feedSha2(x, msg, inputOff, chunkSize, updateFn) {
+    const mem = new Uint8Array(x.memory.buffer);
+    let pos = 0;
+    while (pos < msg.length) {
+        const n = Math.min(msg.length - pos, chunkSize);
+        mem.set(msg.subarray(pos, pos + n), inputOff);
+        updateFn(n);
+        pos += n;
+    }
+}
+function sha2Hash(x, msg, initFn, finalFn, inputOff, outOff, blockSize, updateFn, outLen) {
+    initFn();
+    feedSha2(x, msg, inputOff, blockSize, updateFn);
+    finalFn();
+    const mem = new Uint8Array(x.memory.buffer);
+    return mem.slice(outOff, outOff + outLen);
+}
+// ── SHA-3 fixed-length driver ───────────────────────────────────────────────
+// `sha3Absorb` from sha3-helpers handles ≤168-byte chunks. Final functions
+// land the digest at OUT_OFFSET; we slice it out into a fresh Uint8Array.
+function sha3HashFixed(sx, msg, initFn, finalFn, outLen) {
+    initFn();
+    sha3Absorb(sx, msg);
+    finalFn();
+    const mem = new Uint8Array(sx.memory.buffer);
+    const off = sx.getOutOffset();
+    return mem.slice(off, off + outLen);
+}
+// ── SHAKE driver, fixed output length per FIPS 204 §5.4.1 ──────────────────
+function shakeHashFixed(sx, msg, initFn, rate, outLen) {
+    initFn();
+    sha3Absorb(sx, msg);
+    sx.shakePad();
+    const mem = new Uint8Array(sx.memory.buffer);
+    const off = sx.getOutOffset();
+    const out = new Uint8Array(outLen);
+    let pos = 0;
+    while (pos < outLen) {
+        sx.shakeSqueezeBlock();
+        const take = Math.min(outLen - pos, rate);
+        out.set(mem.subarray(off, off + take), pos);
+        pos += take;
+    }
+    return out;
+}
+/**
+ * Pre-hash dispatcher, applies the FIPS 204 §5.4.1 hash function `algo`
+ * to message `M` and returns PH_M (the bytes that go into M' alongside
+ * the OID).
+ *
+ * `sha2x` may be `undefined` if `algo` does not need the sha2 module
+ * (i.e. SHA3-* / SHAKE*). When `algo` is a SHA-2 variant, the dispatcher
+ * throws if `sha2x` is missing rather than NPE'ing on a member access.
+ * The arrangement keeps sha2 strictly optional for pure-ML-DSA users and
+ * SHA3-prehash HashML-DSA users.
+ */
+export function preHashMessage(sx, sha2x, algo, M) {
+    // SHA-3 / SHAKE branches don't touch sha2x, handle them first so
+    // the SHA-2 cases below operate on a narrowed non-undefined sha2x.
+    switch (algo) {
+        case 'SHA3-224':
+            return sha3HashFixed(sx, M, sx.sha3_224Init, sx.sha3_224Final, 28);
+        case 'SHA3-256':
+            return sha3HashFixed(sx, M, sx.sha3_256Init, sx.sha3_256Final, 32);
+        case 'SHA3-384':
+            return sha3HashFixed(sx, M, sx.sha3_384Init, sx.sha3_384Final, 48);
+        case 'SHA3-512':
+            return sha3HashFixed(sx, M, sx.sha3_512Init, sx.sha3_512Final, 64);
+        case 'SHAKE128':
+            // FIPS 204 §5.4.1, SHAKE128 fixed at 256-bit / 32-byte output.
+            return shakeHashFixed(sx, M, sx.shake128Init, 168, 32);
+        case 'SHAKE256':
+            // FIPS 204 §5.4.1, SHAKE256 fixed at 512-bit / 64-byte output.
+            return shakeHashFixed(sx, M, sx.shake256Init, 136, 64);
+    }
+    if (sha2x === undefined)
+        throw new Error('leviathan-crypto: HashML-DSA SHA-2 pre-hash requires the sha2 module to be initialized');
+    const x = sha2x;
+    switch (algo) {
+        case 'SHA2-224':
+            return sha2Hash(x, M, x.sha224Init, x.sha224Final, x.getSha256InputOffset(), x.getSha256OutOffset(), 64, x.sha256Update, 28);
+        case 'SHA2-256':
+            return sha2Hash(x, M, x.sha256Init, x.sha256Final, x.getSha256InputOffset(), x.getSha256OutOffset(), 64, x.sha256Update, 32);
+        case 'SHA2-384':
+            return sha2Hash(x, M, x.sha384Init, x.sha384Final, x.getSha512InputOffset(), x.getSha512OutOffset(), 128, x.sha512Update, 48);
+        case 'SHA2-512':
+            return sha2Hash(x, M, x.sha512Init, x.sha512Final, x.getSha512InputOffset(), x.getSha512OutOffset(), 128, x.sha512Update, 64);
+        case 'SHA2-512/224':
+            return sha2Hash(x, M, x.sha512_224Init, x.sha512_224Final, x.getSha512InputOffset(), x.getSha512OutOffset(), 128, x.sha512Update, 28);
+        case 'SHA2-512/256':
+            return sha2Hash(x, M, x.sha512_256Init, x.sha512_256Final, x.getSha512InputOffset(), x.getSha512OutOffset(), 128, x.sha512Update, 32);
+        default: {
+            // Defensive: type system should rule this out, but a dynamic
+            // dispatch (e.g. parsing a vector file) could widen the type.
+            const exhaustive = algo;
+            throw new RangeError(`leviathan-crypto: unsupported HashML-DSA pre-hash algorithm '${exhaustive}'`);
+        }
+    }
+}

package/dist/mldsa/index.d.ts

@@ -0,0 +1,142 @@
+import { isInitialized } from '../init.js';
+import type { WasmSource } from '../wasm-source.js';
+import type { MlDsaKeyPair } from './types.js';
+import { MlDsaParams, MLDSA44, MLDSA65, MLDSA87 } from './params.js';
+import { type PreHashAlgorithm } from './hashvariant.js';
+export declare function mldsaInit(source: WasmSource): Promise<void>;
+export type { WasmSource };
+export type { MlDsaKeyPair, MlDsaExports, Sha3Exports } from './types.js';
+export { MLDSA44, MLDSA65, MLDSA87 };
+export type { MlDsaParams };
+export type { PreHashAlgorithm } from './hashvariant.js';
+export { isInitialized };
+export declare class MlDsaBase {
+    readonly params: MlDsaParams;
+    constructor(params: MlDsaParams);
+    private get mx();
+    private get sx();
+    private get sha2x();
+    /**
+     * Deterministic key generation, FIPS 204 §6.1 Algorithm 6.
+     * @param xi 32-byte seed. The sole input; ml-dsa keygen has no
+     *           additional rejection-tied randomness.
+     */
+    keygenDerand(xi: Uint8Array): MlDsaKeyPair;
+    /** Random key generation, wraps `keygenDerand` with `randomBytes(32)`. */
+    keygen(): MlDsaKeyPair;
+    /**
+     * Hedged signing, FIPS 204 §3.4 (recommended default).
+     * Generates a fresh 32-byte rnd via `randomBytes()` per signature; the
+     * rnd is mixed into ρ'' so two signatures over the same (sk, M) produce
+     * different bytes. Hedged signatures are recommended over deterministic
+     * because they remain unforgeable under fault attacks that bias the
+     * rejection-sampling stream (FIPS 204 §3.4 / §3.6.1).
+     */
+    sign(sk: Uint8Array, M: Uint8Array, ctx?: Uint8Array): Uint8Array;
+    /**
+     * Deterministic signing, FIPS 204 §3.4. Sets rnd ← 0³² so two
+     * signatures over the same (sk, M) produce identical bytes. Caller
+     * accepts the §3.4 caveat: deterministic signatures are vulnerable to
+     * fault attacks that bias the SampleInBall stream, use only when no
+     * entropy is available or determinism is a hard protocol requirement.
+     */
+    signDeterministic(sk: Uint8Array, M: Uint8Array, ctx?: Uint8Array): Uint8Array;
+    /**
+     * Externally-randomised signing, testing / CAVP API. Caller supplies
+     * the 32-byte rnd; library does not mix in additional entropy. Hard
+     * contract on the caller: rnd MUST come from an approved RBG and MUST
+     * NOT be reused across signatures. ACVP `sigGen` test vectors (with a
+     * supplied rnd) drive this path.
+     */
+    signDerand(sk: Uint8Array, M: Uint8Array, ctx: Uint8Array, rnd: Uint8Array): Uint8Array;
+    /**
+     * Pure ML-DSA verify, FIPS 204 §5.3 Algorithm 3 / §6.3 Algorithm 8.
+     *
+     * Returns boolean, `true` only if (a) the FIPS 204 norm bound on z
+     * holds and (b) the constant-time comparison of c̃ to the recomputed
+     * c̃' succeeds. Throws RangeError only on caller-side contract
+     * violations (`ctx.length > 255`). Wrong-length pk/sig and malformed
+     * hint encodings are NOT contract violations: they cause `verify` to
+     * return false (FIPS 204 §3.6.2 / §D.3).
+     */
+    verify(vk: Uint8Array, M: Uint8Array, sig: Uint8Array, ctx?: Uint8Array): boolean;
+    private _assertHashPrereqs;
+    /**
+     * Hedged HashML-DSA sign, FIPS 204 §5.4 Algorithm 4.
+     *
+     * Pre-hashes `M` with the chosen approved function `ph`, builds
+     * M' = 0x01 ‖ |ctx| ‖ ctx ‖ OID(ph) ‖ PH_M, then drives
+     * ML-DSA.Sign_internal with a fresh 32-byte rnd (FIPS 204 §3.4
+     * recommended default; see {@link sign} for the rationale).
+     */
+    signHash(sk: Uint8Array, M: Uint8Array, ph: PreHashAlgorithm, ctx?: Uint8Array): Uint8Array;
+    /**
+     * Deterministic HashML-DSA sign, FIPS 204 §5.4 Algorithm 4 with
+     * rnd ← 0³². Same fault-attack caveat as {@link signDeterministic}.
+     */
+    signHashDeterministic(sk: Uint8Array, M: Uint8Array, ph: PreHashAlgorithm, ctx?: Uint8Array): Uint8Array;
+    /**
+     * Externally-randomised HashML-DSA sign, testing / CAVP API. Caller
+     * supplies the 32-byte rnd (same contract as {@link signDerand}). Used
+     * to oracle ACVP HashML-DSA sigGen vectors with byte-identical output.
+     */
+    signHashDerand(sk: Uint8Array, M: Uint8Array, ph: PreHashAlgorithm, ctx: Uint8Array, rnd: Uint8Array): Uint8Array;
+    /**
+     * HashML-DSA verify, FIPS 204 §5.4 Algorithm 5.
+     *
+     * Same return / throw posture as {@link verify}: returns boolean for
+     * every signature outcome (including malformed-σ → false), throws
+     * RangeError only on caller-side contract violations such as
+     * `ctx.length > 255` or unsupported `ph`.
+     */
+    verifyHash(vk: Uint8Array, M: Uint8Array, sig: Uint8Array, ph: PreHashAlgorithm, ctx?: Uint8Array): boolean;
+    /**
+     * Hedged HashML-DSA sign with a caller-supplied prehash, FIPS 204
+     * §5.4 Algorithm 4 lines 22-24 (the post-PH path).
+     *
+     * `digest` must be exactly `digestSize(ph)` bytes (FIPS 204 §5.4.1);
+     * a mismatch throws `SigningError('sig-malformed-input')`. The caller
+     * owns `digest` and is responsible for wiping it; this method never
+     * mutates the buffer.
+     *
+     * Hedged variant generates a fresh 32-byte rnd internally per
+     * signature, see {@link sign} for the §3.4 rationale.
+     */
+    signHashPrehashed(sk: Uint8Array, digest: Uint8Array, ph: PreHashAlgorithm, ctx?: Uint8Array): Uint8Array;
+    /**
+     * Deterministic HashML-DSA sign with a caller-supplied prehash, rnd
+     * ← 0³² per FIPS 204 §3.4. Same fault-attack caveat as
+     * {@link signDeterministic}.
+     */
+    signHashPrehashedDeterministic(sk: Uint8Array, digest: Uint8Array, ph: PreHashAlgorithm, ctx?: Uint8Array): Uint8Array;
+    /**
+     * Externally-randomised HashML-DSA sign with a caller-supplied
+     * prehash, testing / CAVP API. Caller supplies the 32-byte rnd (same
+     * contract as {@link signDerand}): rnd MUST come from an approved RBG
+     * and MUST NOT be reused across signatures.
+     */
+    signHashPrehashedDerand(sk: Uint8Array, digest: Uint8Array, ph: PreHashAlgorithm, rnd: Uint8Array, ctx?: Uint8Array): Uint8Array;
+    /**
+     * HashML-DSA verify with a caller-supplied prehash, FIPS 204 §5.4
+     * Algorithm 5 lines 17-19 (the post-PH path).
+     *
+     * Returns boolean for every signature outcome. Wrong-length pk / σ
+     * and wrong-size `digest` all return `false` (FIPS 204 §3.6.2
+     * structural mismatch). Throws `RangeError` only on caller-side
+     * contract violations (`ctx.length > 255`, unsupported `ph`).
+     */
+    verifyHashPrehashed(vk: Uint8Array, digest: Uint8Array, sig: Uint8Array, ph: PreHashAlgorithm, ctx?: Uint8Array): boolean;
+    dispose(): void;
+}
+/** ML-DSA-44, FIPS 204 §4 Table 1 (NIST security category 2). */
+export declare class MlDsa44 extends MlDsaBase {
+    constructor();
+}
+/** ML-DSA-65, FIPS 204 §4 Table 1 (NIST security category 3). */
+export declare class MlDsa65 extends MlDsaBase {
+    constructor();
+}
+/** ML-DSA-87, FIPS 204 §4 Table 1 (NIST security category 5). */
+export declare class MlDsa87 extends MlDsaBase {
+    constructor();
+}