Uses a similar strategy to `rsa`, cloning the Wycheproof test vectors as
a submodule and parsing the JSON files directly (I tried to use
`wycheproof2blb` and it seems really out of date).
Adds the following as an initial integration:
- `mldsa_44_sign_seed_test`
- `mldsa_65_sign_seed_test`
- `mldsa_87_sign_seed_test`
Includes changes to the `BoxedMontyForm::new` API, and also bumps
`crypto-primes` to v0.7.0-rc.6 which includes the associated updates
to that crate for the API change.
Renames `EncodedSigningKey` to `ExpandedSigningKey` to contrast it with
seeds, the preferred API. Also renames the `decode` and `encode`
functions to `from_expanded` and `to_expanded`, similar to the changes
made to `ml-kem`'s `DecapsulationKey` in RustCrypto/KEMs#163,
which also deprecated these APIs.
We don't properly implement validation of such keys which can lead to
panics in the event they were improperly or maliciously generated
(#1133), a problem avoided by using seeds. For now, this merely
documents the panic condition.
Most implementers have opted not to provide support for this key format
due to these problems (it's also actually more expensive to validate an
expanded key than it is to use a seed), and also where seeds are the
same size regardless of security level, the expanded keys vary in size.
Adds a macro for writing `criterion` benchmarks for ECDSA signing and
verification, similar to other benchmark macros recently added to
`elliptic-curve` and `primeorder`.
The macro should be compatible with both `criterion` v0.7 and v0.8,
allowing for downstream users to ship with MSRV 1.85 support then
upgrade later without requiring breaking changes to this macro.
The `signature` test was too tightly coupled with the precise RNG
output, in effect not just testing the DSA signature/verification logic
but also testing that the exact bit sequence was produced by the
dependent crate.
We already have tests against deterministic keys and signatures at
`tests/deterministic.rs`, so modify `tests/signature.rs` to instead
generate a random keypair using the system RNG, then generate a
signature with that keypair, and then verify that signature.
The existing hard-coded signatures have been left in place as they are
used to test PKCS decoding and encoding.
Switches every crate except `slh-dsa` away from a direct `rand`
dependency they don't need. Right now we can't publish any crate that
directly depends on `rand`.
Uses a consistent default strategy for RNGs: `SysRng`, sourced from the
`getrandom` or as `rand::rngs::SysRng` in the case of `slh-dsa` which is
actually using `rand`-specific features.
If this causes too much of a slowdown, we can re-evaluate and go (back)
to `ChaCha8Rng` where needed for testing.
This PR is meant to address issue #1035.
It introduces an optimisation mentioned in section 8.1.6. of SPHINCS+
specification: caching the intermediate state during SHA-2 computations.
On my laptop, I observe an improvement in signing/verification time in the range
of ~15-25% (using the criterion benchmark provided).
Tony Arcieri