xoonya 3.1.11 → 3.1.13

package/RELEASE_NOTES.md

@@ -1,4 +1,4 @@
-`xoonya` 3.1.11 is a packaging and classification refresh. The proof engine, verification behavior, vectors, and routes are unchanged.
+`xoonya` 3.1.13 adds ML-DSA (FIPS-204) to detached-signature verification.
 
-- The published package no longer carries a Python bytecode cache (it embedded a local build path); a `.gitignore` and a nested `.npmignore` keep caches, env files, and key material out of the repository and the tarball.
-- The crypto-agility matrix now classifies ML-DSA and SLH-DSA as runtime-supported and vector-covered, with the boundary stated honestly: the Ed25519 + ML-DSA-65 hybrid is exercised live via the paid x402 lane; SLH-DSA hybrids are implemented and vector-covered but not yet run through the paid lane. This is machine-evidence verification only — not an identity, custody, or chain-truth claim.
+- `verifyExternalProofSignature` (and the import-path detached verify) now accepts `ML-DSA-44`, `ML-DSA-65`, and `ML-DSA-87` with SPKI public keys, alongside EdDSA, ECDSA, and RSA. The declared algorithm is bound to the key's parameter set, so an ML-DSA signature cannot be checked under another algorithm, and key refs use the same `<key type>-spki-sha256:<hex>` format, so a declared `expected_key_ref` anchors trust exactly as before.
+- This lets xoonya independently verify both legs of a hybrid Ed25519 + ML-DSA-65 signature, such as the signed delivery receipts the naxytra runtime issues. Machine-evidence verification only — not identity, custody, or chain truth.

package/lib/external_proof_verify.js

@@ -17,8 +17,9 @@
 // itself, treated as trusted.
 //
 // Dependency-free (node crypto). Supports compact JWS (EdDSA, ES256/384/512,
-// ES256K, RS256/384/512, PS256/384/512) and generic detached signatures. Private
-// key material (e.g. a JWK with a `d` component) is refused.
+// ES256K, RS256/384/512, PS256/384/512) and generic detached signatures, which
+// additionally accept ML-DSA-44/65/87 (FIPS-204, SPKI keys). Private key material
+// (e.g. a JWK with a `d` component) is refused.
 
 const crypto = require("crypto");
 
@@ -41,7 +42,12 @@ const JWS_ALG = {
   RS512: { hash: "sha512", kind: "rsa" },
   PS256: { hash: "sha256", kind: "rsapss" },
   PS384: { hash: "sha384", kind: "rsapss" },
-  PS512: { hash: "sha512", kind: "rsapss" }
+  PS512: { hash: "sha512", kind: "rsapss" },
+  // FIPS-204 ML-DSA (pure mode, as named by the JOSE ML-DSA draft). Needs Node >= 24
+  // (node:crypto ML-DSA); on an older runtime the key cannot be parsed and verify fails closed.
+  "ML-DSA-44": { hash: null, kind: "mldsa", keyType: "ml-dsa-44" },
+  "ML-DSA-65": { hash: null, kind: "mldsa", keyType: "ml-dsa-65" },
+  "ML-DSA-87": { hash: null, kind: "mldsa", keyType: "ml-dsa-87" }
 };
 
 function isPrivateJwk(obj) {
@@ -82,6 +88,7 @@ function keyMatchesAlg(keyObject, alg) {
   if (!spec || !keyObject) return false;
   const t = keyObject.asymmetricKeyType;
   if (spec.kind === "eddsa") return t === "ed25519";
+  if (spec.kind === "mldsa") return t === spec.keyType;
   if (spec.kind === "ecdsa") {
     if (t !== "ec") return false;
     const details = keyObject.asymmetricKeyDetails || {};
@@ -97,7 +104,7 @@ function verifyWithAlg(alg, signingInput, signature, keyObject) {
   if (!keyMatchesAlg(keyObject, alg)) return false; // bind declared alg to the key
   const data = Buffer.isBuffer(signingInput) ? signingInput : Buffer.from(String(signingInput), "utf8");
   try {
-    if (spec.kind === "eddsa") return crypto.verify(null, data, keyObject, signature);
+    if (spec.kind === "eddsa" || spec.kind === "mldsa") return crypto.verify(null, data, keyObject, signature);
     if (spec.kind === "ecdsa") return crypto.verify(spec.hash, data, { key: keyObject, dsaEncoding: "ieee-p1363" }, signature);
     if (spec.kind === "rsa") return crypto.verify(spec.hash, data, keyObject, signature);
     if (spec.kind === "rsapss") {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "xoonya",
-  "version": "3.1.11",
+  "version": "3.1.13",
   "description": "Deterministic proof and review engine with post-quantum verification (Ed25519 + ML-DSA-65 hybrid) for receipts, handoffs, governance, and the native XNYA machine-evidence format. Verified live via the paid x402 lane.",
   "main": "index.js",
   "bin": {

package/scripts/verify_external_proof_signature.js

@@ -122,6 +122,20 @@ function main() {
   assert.strictEqual(proofSdk.verifyExternalProofSignature({ jws: edJws, trusted_public_key: edPubPem }).signature_valid, true);
   assert.strictEqual(proofSdk.verifyExternalProofSignature({}).reason, "no_signature_verification_input");
 
+  // Detached ML-DSA-65 (FIPS-204): valid verifies + anchors to the declared key ref; tampered
+  // material fails; the declared alg is bound to the key type (no cross-alg confusion).
+  const mldsa = crypto.generateKeyPairSync("ml-dsa-65");
+  const mlSpki = mldsa.publicKey.export({ type: "spki", format: "der" }).toString("base64");
+  const mlRef = "ml-dsa-65-spki-sha256:" + crypto.createHash("sha256").update(mldsa.publicKey.export({ type: "spki", format: "der" })).digest("hex");
+  const mlMaterial = '{"receipt":"x","v":1}';
+  const mlSig = crypto.sign(null, Buffer.from(mlMaterial, "utf8"), mldsa.privateKey).toString("base64");
+  const mlOk = proofSdk.verifyExternalProofSignature({ material: mlMaterial, signature: mlSig, algorithm: "ML-DSA-65", public_key: mlSpki, expected_key_ref: mlRef });
+  assert.strictEqual(mlOk.signature_valid, true, "ML-DSA-65 detached signature verifies");
+  assert.strictEqual(mlOk.trust_anchored, true, "ML-DSA-65 anchors to the declared key ref");
+  assert.strictEqual(proofSdk.verifyExternalProofSignature({ material: mlMaterial + " ", signature: mlSig, algorithm: "ML-DSA-65", public_key: mlSpki }).signature_valid, false, "ML-DSA-65 tampered material fails");
+  assert.strictEqual(proofSdk.verifyExternalProofSignature({ material: mlMaterial, signature: mlSig, algorithm: "ML-DSA-44", public_key: mlSpki }).signature_valid, false, "ML-DSA alg bound to the key's parameter set");
+  assert.strictEqual(proofSdk.verifyExternalProofSignature({ material: mlMaterial, signature: mlSig, algorithm: "EdDSA", public_key: mlSpki }).signature_valid, false, "EdDSA cannot verify with an ML-DSA key");
+
   console.log("verify_external_proof_signature: all checks passed");
 }