/src/openssl/providers/implementations/signature/ml_dsa_sig.c

Source (jump to first uncovered line)
/*
 * Copyright 2024-2025 The OpenSSL Project Authors. All Rights Reserved.
 *
 * Licensed under the Apache License 2.0 (the "License").  You may not use
 * this file except in compliance with the License.  You can obtain a copy
 * in the file LICENSE in the source distribution or at
 * https://www.openssl.org/source/license.html
 */


#include "internal/deprecated.h"

#include <assert.h>
#include <string.h> /* memset */
#include <openssl/core_names.h>
#include <openssl/err.h>
#include <openssl/rand.h>
#include <openssl/proverr.h>
#include "prov/implementations.h"
#include "prov/providercommon.h"
#include "prov/provider_ctx.h"
#include "prov/der_ml_dsa.h"
#include "crypto/ml_dsa.h"
#include "internal/common.h"
#include "internal/packet.h"
#include "internal/sizes.h"

#define ML_DSA_MESSAGE_ENCODE_RAW  0
#define ML_DSA_MESSAGE_ENCODE_PURE 1

static OSSL_FUNC_signature_sign_message_init_fn ml_dsa_sign_msg_init;
static OSSL_FUNC_signature_sign_message_update_fn ml_dsa_signverify_msg_update;
static OSSL_FUNC_signature_sign_message_final_fn ml_dsa_sign_msg_final;
static OSSL_FUNC_signature_sign_fn ml_dsa_sign;
static OSSL_FUNC_signature_verify_message_init_fn ml_dsa_verify_msg_init;
static OSSL_FUNC_signature_verify_message_update_fn ml_dsa_signverify_msg_update;
static OSSL_FUNC_signature_verify_message_final_fn ml_dsa_verify_msg_final;
static OSSL_FUNC_signature_verify_fn ml_dsa_verify;
static OSSL_FUNC_signature_digest_sign_init_fn ml_dsa_digest_signverify_init;
static OSSL_FUNC_signature_digest_sign_fn ml_dsa_digest_sign;
static OSSL_FUNC_signature_digest_verify_fn ml_dsa_digest_verify;
static OSSL_FUNC_signature_freectx_fn ml_dsa_freectx;
static OSSL_FUNC_signature_set_ctx_params_fn ml_dsa_set_ctx_params;
static OSSL_FUNC_signature_settable_ctx_params_fn ml_dsa_settable_ctx_params;
static OSSL_FUNC_signature_get_ctx_params_fn ml_dsa_get_ctx_params;
static OSSL_FUNC_signature_gettable_ctx_params_fn ml_dsa_gettable_ctx_params;
static OSSL_FUNC_signature_dupctx_fn ml_dsa_dupctx;

typedef struct {
    ML_DSA_KEY *key;
    OSSL_LIB_CTX *libctx;
    uint8_t context_string[ML_DSA_MAX_CONTEXT_STRING_LEN];
    size_t context_string_len;
    uint8_t test_entropy[ML_DSA_ENTROPY_LEN];
    size_t test_entropy_len;
    int msg_encode;
    int deterministic;
    int evp_type;
    /* The Algorithm Identifier of the signature algorithm */
    uint8_t aid_buf[OSSL_MAX_ALGORITHM_ID_SIZE];
    size_t  aid_len;
    int mu;     /* Flag indicating we should begin from \mu, not the message */

    int operation;
    EVP_MD_CTX *md_ctx; /* Ctx for msg_init/update/final interface */
    unsigned char *sig; /* Signature, for verification */
    size_t siglen;
} PROV_ML_DSA_CTX;

static void ml_dsa_freectx(void *vctx)
{
    PROV_ML_DSA_CTX *ctx = (PROV_ML_DSA_CTX *)vctx;

    EVP_MD_CTX_free(ctx->md_ctx);
    OPENSSL_cleanse(ctx->test_entropy, ctx->test_entropy_len);
    OPENSSL_free(ctx->sig);
    OPENSSL_free(ctx);
}

static void *ml_dsa_newctx(void *provctx, int evp_type, const char *propq)
{
    PROV_ML_DSA_CTX *ctx;

    if (!ossl_prov_is_running())
        return NULL;

    ctx = OPENSSL_zalloc(sizeof(PROV_ML_DSA_CTX));
    if (ctx == NULL)
        return NULL;

    ctx->libctx = PROV_LIBCTX_OF(provctx);
    ctx->msg_encode = ML_DSA_MESSAGE_ENCODE_PURE;
    ctx->evp_type = evp_type;
    return ctx;
}

static void *ml_dsa_dupctx(void *vctx)
{
    PROV_ML_DSA_CTX *srcctx = (PROV_ML_DSA_CTX *)vctx;
    PROV_ML_DSA_CTX *dstctx;

    if (!ossl_prov_is_running())
        return NULL;

    /*
     * Note that the ML_DSA_KEY is ref counted via EVP_PKEY so we can just copy
     * the key here.
     */
    dstctx = OPENSSL_memdup(srcctx, sizeof(*srcctx));

    if (dstctx == NULL)
        return NULL;

    if (srcctx->sig != NULL) {
        dstctx->sig = OPENSSL_memdup(srcctx->sig, srcctx->siglen);
        if (dstctx->sig == NULL) {
            /*
             * Can't call ml_dsa_freectx() here, as it would free
             * md_ctx which has not been duplicated yet.
             */
            OPENSSL_free(dstctx);
            return NULL;
        }
    }

    if (srcctx->md_ctx != NULL) {
        dstctx->md_ctx = EVP_MD_CTX_dup(srcctx->md_ctx);
        if (dstctx->md_ctx == NULL) {
            ml_dsa_freectx(dstctx);
            return NULL;
        }
    }

    return dstctx;
}

static int set_alg_id_buffer(PROV_ML_DSA_CTX *ctx)
{
    int ret;
    WPACKET pkt;
    uint8_t *aid = NULL;

    /*
     * We do not care about DER writing errors.
     * All it really means is that for some reason, there's no
     * AlgorithmIdentifier to be had, but the operation itself is
     * still valid, just as long as it's not used to construct
     * anything that needs an AlgorithmIdentifier.
     */
    ctx->aid_len = 0;
    ret = WPACKET_init_der(&pkt, ctx->aid_buf, sizeof(ctx->aid_buf));
    ret = ret && ossl_DER_w_algorithmIdentifier_ML_DSA(&pkt, -1, ctx->key);
    if (ret && WPACKET_finish(&pkt)) {
        WPACKET_get_total_written(&pkt, &ctx->aid_len);
        aid = WPACKET_get_curr(&pkt);
    }
    WPACKET_cleanup(&pkt);
    if (aid != NULL && ctx->aid_len != 0)
        memmove(ctx->aid_buf, aid, ctx->aid_len);
    return 1;
}

static int ml_dsa_signverify_msg_init(void *vctx, void *vkey,
                                      const OSSL_PARAM params[], int operation,
                                      const char *desc)
{
    PROV_ML_DSA_CTX *ctx = (PROV_ML_DSA_CTX *)vctx;
    ML_DSA_KEY *key = vkey;

    if (!ossl_prov_is_running()
            || ctx == NULL)
        return 0;

    if (vkey == NULL && ctx->key == NULL) {
        ERR_raise(ERR_LIB_PROV, PROV_R_NO_KEY_SET);
        return 0;
    }

    if (key != NULL)
        ctx->key = vkey;
    if (!ossl_ml_dsa_key_matches(ctx->key, ctx->evp_type))
        return 0;

    set_alg_id_buffer(ctx);
    ctx->mu = 0;
    ctx->operation = operation;

    return ml_dsa_set_ctx_params(ctx, params);
}

static int ml_dsa_sign_msg_init(void *vctx, void *vkey, const OSSL_PARAM params[])
{
    return ml_dsa_signverify_msg_init(vctx, vkey, params,
                                      EVP_PKEY_OP_SIGNMSG, "ML_DSA Sign Init");
}

static int ml_dsa_digest_signverify_init(void *vctx, const char *mdname,
                                         void *vkey, const OSSL_PARAM params[])
{
    PROV_ML_DSA_CTX *ctx = (PROV_ML_DSA_CTX *)vctx;

    if (mdname != NULL && mdname[0] != '\0') {
        ERR_raise_data(ERR_LIB_PROV, PROV_R_INVALID_DIGEST,
                       "Explicit digest not supported for ML-DSA operations");
        return 0;
    }

    ctx->mu = 0;

    if (vkey == NULL && ctx->key != NULL)
        return ml_dsa_set_ctx_params(ctx, params);

    return ml_dsa_signverify_msg_init(vctx, vkey, params,
                                      EVP_PKEY_OP_SIGN, "ML_DSA Sign Init");
}

static int ml_dsa_signverify_msg_update(void *vctx,
                                        const unsigned char *data,
                                        size_t datalen)
{
    PROV_ML_DSA_CTX *ctx = (PROV_ML_DSA_CTX *)vctx;

    if (ctx == NULL)
        return 0;

    if (!ossl_prov_is_running())
        return 0;

    if (ctx->mu)
        return 0;

    if (ctx->md_ctx == NULL) {
        ctx->md_ctx = ossl_ml_dsa_mu_init(ctx->key, ctx->msg_encode,
                                          ctx->context_string,
                                          ctx->context_string_len);
        if (ctx->md_ctx == NULL)
            return 0;
    }

    return ossl_ml_dsa_mu_update(ctx->md_ctx, data, datalen);
}

static int ml_dsa_sign_msg_final(void *vctx, unsigned char *sig,
                                 size_t *siglen, size_t sigsize)
{
    PROV_ML_DSA_CTX *ctx = (PROV_ML_DSA_CTX *)vctx;
    uint8_t rand_tmp[ML_DSA_ENTROPY_LEN], *rnd = NULL;
    uint8_t mu[ML_DSA_MU_BYTES];
    int ret = 0;

    if (ctx == NULL)
        return 0;

    if (!ossl_prov_is_running())
        return 0;

    if (ctx->md_ctx == NULL)
        return 0;

    if (sig != NULL) {
        if (ctx->test_entropy_len != 0) {
            rnd = ctx->test_entropy;
        } else {
            rnd = rand_tmp;

            if (ctx->deterministic == 1)
                memset(rnd, 0, sizeof(rand_tmp));
            else if (RAND_priv_bytes_ex(ctx->libctx, rnd, sizeof(rand_tmp), 0) <= 0)
                return 0;
        }

        if (!ossl_ml_dsa_mu_finalize(ctx->md_ctx, mu, sizeof(mu)))
            return 0;
    }

    ret = ossl_ml_dsa_sign(ctx->key, 1, mu, sizeof(mu), NULL, 0, rnd,
                           sizeof(rand_tmp), 0, sig, siglen, sigsize);
    if (rnd != ctx->test_entropy)
        OPENSSL_cleanse(rand_tmp, sizeof(rand_tmp));
    return ret;
}

static int ml_dsa_sign(void *vctx, uint8_t *sig, size_t *siglen, size_t sigsize,
                       const uint8_t *msg, size_t msg_len)
{
    int ret = 0;
    PROV_ML_DSA_CTX *ctx = (PROV_ML_DSA_CTX *)vctx;
    uint8_t rand_tmp[ML_DSA_ENTROPY_LEN], *rnd = NULL;

    if (!ossl_prov_is_running())
        return 0;

    if (sig != NULL) {
        if (ctx->test_entropy_len != 0) {
            rnd = ctx->test_entropy;
        } else {
            rnd = rand_tmp;

            if (ctx->deterministic == 1)
                memset(rnd, 0, sizeof(rand_tmp));
            else if (RAND_priv_bytes_ex(ctx->libctx, rnd, sizeof(rand_tmp), 0) <= 0)
                return 0;
        }
    }
    ret = ossl_ml_dsa_sign(ctx->key, ctx->mu, msg, msg_len,
                           ctx->context_string, ctx->context_string_len,
                           rnd, sizeof(rand_tmp), ctx->msg_encode,
                           sig, siglen, sigsize);
    if (rnd != ctx->test_entropy)
        OPENSSL_cleanse(rand_tmp, sizeof(rand_tmp));
    return ret;
}

static int ml_dsa_digest_sign(void *vctx, uint8_t *sig, size_t *siglen, size_t sigsize,
                              const uint8_t *tbs, size_t tbslen)
{
    return ml_dsa_sign(vctx, sig, siglen, sigsize, tbs, tbslen);
}

static int ml_dsa_verify_msg_init(void *vctx, void *vkey, const OSSL_PARAM params[])
{
    return ml_dsa_signverify_msg_init(vctx, vkey, params, EVP_PKEY_OP_VERIFYMSG,
                                      "ML_DSA Verify Init");
}

static int ml_dsa_verify_msg_final(void *vctx)
{
    PROV_ML_DSA_CTX *ctx = (PROV_ML_DSA_CTX *)vctx;
    uint8_t mu[ML_DSA_MU_BYTES];

    if (!ossl_prov_is_running())
        return 0;

    if (ctx->md_ctx == NULL)
        return 0;

    if (!ossl_ml_dsa_mu_finalize(ctx->md_ctx, mu, sizeof(mu)))
        return 0;

    return ossl_ml_dsa_verify(ctx->key, 1, mu, sizeof(mu), NULL, 0, 0,
                              ctx->sig, ctx->siglen);
}

static int ml_dsa_verify(void *vctx, const uint8_t *sig, size_t siglen,
                         const uint8_t *msg, size_t msg_len)
{
    PROV_ML_DSA_CTX *ctx = (PROV_ML_DSA_CTX *)vctx;

    if (!ossl_prov_is_running())
        return 0;
    return ossl_ml_dsa_verify(ctx->key, ctx->mu, msg, msg_len,
                              ctx->context_string, ctx->context_string_len,
                              ctx->msg_encode, sig, siglen);
}
static int ml_dsa_digest_verify(void *vctx,
                                const uint8_t *sig, size_t siglen,
                                const uint8_t *tbs, size_t tbslen)
{
    return ml_dsa_verify(vctx, sig, siglen, tbs, tbslen);
}

/*
 * Only need the param list for the signing case.  The decoder and structure
 * are shared between the sign and verify cases.
 */
#define ml_dsa_set_ctx_params_st        ml_dsa_verifymsg_set_ctx_params_st
#define ml_dsa_set_ctx_params_decoder   ml_dsa_verifymsg_set_ctx_params_decoder

/* Machine generated by util/perl/OpenSSL/paramnames.pm */
#ifndef ml_dsa_set_ctx_params_list
static const OSSL_PARAM ml_dsa_set_ctx_params_list[] = {
    OSSL_PARAM_octet_string(OSSL_SIGNATURE_PARAM_CONTEXT_STRING, NULL, 0),
    OSSL_PARAM_octet_string(OSSL_SIGNATURE_PARAM_TEST_ENTROPY, NULL, 0),
    OSSL_PARAM_int(OSSL_SIGNATURE_PARAM_DETERMINISTIC, NULL),
    OSSL_PARAM_int(OSSL_SIGNATURE_PARAM_MESSAGE_ENCODING, NULL),
    OSSL_PARAM_int(OSSL_SIGNATURE_PARAM_MU, NULL),
    OSSL_PARAM_END
};
#endif

#ifndef ml_dsa_set_ctx_params_st
struct ml_dsa_set_ctx_params_st {
    OSSL_PARAM *ctx;
    OSSL_PARAM *det;
    OSSL_PARAM *ent;
    OSSL_PARAM *msgenc;
    OSSL_PARAM *mu;
};
#endif

#ifndef ml_dsa_set_ctx_params_decoder
static struct ml_dsa_set_ctx_params_st
ml_dsa_set_ctx_params_decoder(const OSSL_PARAM params[]) {
    struct ml_dsa_set_ctx_params_st r;
    const OSSL_PARAM *p;
    const char *s;

    memset(&r, 0, sizeof(r));
    for (p = params; (s = p->key) != NULL; p++)
        switch(s[0]) {
        default:
            break;
        case 'c':
            if (ossl_likely(r.ctx == NULL && strcmp("ontext-string", s + 1) == 0))
                r.ctx = (OSSL_PARAM *)p;
            break;
        case 'd':
            if (ossl_likely(r.det == NULL && strcmp("eterministic", s + 1) == 0))
                r.det = (OSSL_PARAM *)p;
            break;
        case 'm':
            switch(s[1]) {
            default:
                break;
            case 'e':
                if (ossl_likely(r.msgenc == NULL && strcmp("ssage-encoding", s + 2) == 0))
                    r.msgenc = (OSSL_PARAM *)p;
                break;
            case 'u':
                switch(s[2]) {
                default:
                    break;
                case '\0':
                    r.mu = ossl_likely(r.mu == NULL) ? (OSSL_PARAM *)p : r.mu;
                }
            }
            break;
        case 't':
            if (ossl_likely(r.ent == NULL && strcmp("est-entropy", s + 1) == 0))
                r.ent = (OSSL_PARAM *)p;
        }
    return r;
}
#endif
/* End of machine generated */

/* Machine generated by util/perl/OpenSSL/paramnames.pm */
#ifndef ml_dsa_verifymsg_set_ctx_params_list
static const OSSL_PARAM ml_dsa_verifymsg_set_ctx_params_list[] = {
    OSSL_PARAM_octet_string(OSSL_SIGNATURE_PARAM_CONTEXT_STRING, NULL, 0),
    OSSL_PARAM_octet_string(OSSL_SIGNATURE_PARAM_TEST_ENTROPY, NULL, 0),
    OSSL_PARAM_int(OSSL_SIGNATURE_PARAM_DETERMINISTIC, NULL),
    OSSL_PARAM_int(OSSL_SIGNATURE_PARAM_MESSAGE_ENCODING, NULL),
    OSSL_PARAM_int(OSSL_SIGNATURE_PARAM_MU, NULL),
    OSSL_PARAM_octet_string(OSSL_SIGNATURE_PARAM_SIGNATURE, NULL, 0),
    OSSL_PARAM_END
};
#endif

#ifndef ml_dsa_verifymsg_set_ctx_params_st
struct ml_dsa_verifymsg_set_ctx_params_st {
    OSSL_PARAM *ctx;
    OSSL_PARAM *det;
    OSSL_PARAM *ent;
    OSSL_PARAM *msgenc;
    OSSL_PARAM *mu;
    OSSL_PARAM *sig;
};
#endif

#ifndef ml_dsa_verifymsg_set_ctx_params_decoder
static struct ml_dsa_verifymsg_set_ctx_params_st
ml_dsa_verifymsg_set_ctx_params_decoder(const OSSL_PARAM params[]) {
    struct ml_dsa_verifymsg_set_ctx_params_st r;
    const OSSL_PARAM *p;
    const char *s;

    memset(&r, 0, sizeof(r));
    for (p = params; (s = p->key) != NULL; p++)
        switch(s[0]) {
        default:
            break;
        case 'c':
            if (ossl_likely(r.ctx == NULL && strcmp("ontext-string", s + 1) == 0))
                r.ctx = (OSSL_PARAM *)p;
            break;
        case 'd':
            if (ossl_likely(r.det == NULL && strcmp("eterministic", s + 1) == 0))
                r.det = (OSSL_PARAM *)p;
            break;
        case 'm':
            switch(s[1]) {
            default:
                break;
            case 'e':
                if (ossl_likely(r.msgenc == NULL && strcmp("ssage-encoding", s + 2) == 0))
                    r.msgenc = (OSSL_PARAM *)p;
                break;
            case 'u':
                switch(s[2]) {
                default:
                    break;
                case '\0':
                    r.mu = ossl_likely(r.mu == NULL) ? (OSSL_PARAM *)p : r.mu;
                }
            }
            break;
        case 's':
            if (ossl_likely(r.sig == NULL && strcmp("ignature", s + 1) == 0))
                r.sig = (OSSL_PARAM *)p;
            break;
        case 't':
            if (ossl_likely(r.ent == NULL && strcmp("est-entropy", s + 1) == 0))
                r.ent = (OSSL_PARAM *)p;
        }
    return r;
}
#endif
/* End of machine generated */

static int ml_dsa_set_ctx_params(void *vctx, const OSSL_PARAM params[])
{
    PROV_ML_DSA_CTX *pctx = (PROV_ML_DSA_CTX *)vctx;
    struct ml_dsa_verifymsg_set_ctx_params_st p;

    if (pctx == NULL)
        return 0;
    if (ossl_param_is_empty(params))
        return 1;

    p = ml_dsa_verifymsg_set_ctx_params_decoder(params);

    if (p.ctx != NULL) {
        void *vp = pctx->context_string;

        if (!OSSL_PARAM_get_octet_string(p.ctx, &vp, sizeof(pctx->context_string),
                                         &(pctx->context_string_len))) {
            pctx->context_string_len = 0;
            return 0;
        }
    }

    if (p.ent != NULL) {
        void *vp = pctx->test_entropy;

        pctx->test_entropy_len = 0;
        if (!OSSL_PARAM_get_octet_string(p.ent, &vp, sizeof(pctx->test_entropy),
                                         &(pctx->test_entropy_len)))
                return 0;
        if (pctx->test_entropy_len != sizeof(pctx->test_entropy)) {
            pctx->test_entropy_len = 0;
            ERR_raise(ERR_LIB_PROV, PROV_R_INVALID_SEED_LENGTH);
            return 0;
        }
    }

    if (p.det != NULL && !OSSL_PARAM_get_int(p.det, &pctx->deterministic))
        return 0;

    if (p.msgenc != NULL && !OSSL_PARAM_get_int(p.msgenc, &pctx->msg_encode))
        return 0;

    if (p.mu != NULL && !OSSL_PARAM_get_int(p.mu, &pctx->mu))
        return 0;

    if (p.sig != NULL && pctx->operation == EVP_PKEY_OP_VERIFYMSG) {
        OPENSSL_free(pctx->sig);
        pctx->sig = NULL;
        pctx->siglen = 0;
        if (!OSSL_PARAM_get_octet_string(p.sig, (void **)&pctx->sig,
                                         0, &pctx->siglen))
            return 0;
    }

    return 1;
}

static const OSSL_PARAM *ml_dsa_settable_ctx_params(void *vctx,
                                                    ossl_unused void *provctx)
{
    PROV_ML_DSA_CTX *pctx = (PROV_ML_DSA_CTX *)vctx;

    if (pctx != NULL && pctx->operation == EVP_PKEY_OP_VERIFYMSG)
        return ml_dsa_verifymsg_set_ctx_params_list;
    else
        return ml_dsa_set_ctx_params_list;
}

/* Machine generated by util/perl/OpenSSL/paramnames.pm */
#ifndef ml_dsa_get_ctx_params_list
static const OSSL_PARAM ml_dsa_get_ctx_params_list[] = {
    OSSL_PARAM_octet_string(OSSL_SIGNATURE_PARAM_ALGORITHM_ID, NULL, 0),
    OSSL_PARAM_END
};
#endif

#ifndef ml_dsa_get_ctx_params_st
struct ml_dsa_get_ctx_params_st {
    OSSL_PARAM *id;
};
#endif

#ifndef ml_dsa_get_ctx_params_decoder
static struct ml_dsa_get_ctx_params_st
ml_dsa_get_ctx_params_decoder(const OSSL_PARAM params[]) {
    struct ml_dsa_get_ctx_params_st r;
    const OSSL_PARAM *p;
    const char *s;

    memset(&r, 0, sizeof(r));
    for (p = params; (s = p->key) != NULL; p++)
        if (ossl_likely(r.id == NULL && strcmp("algorithm-id", s + 0) == 0))
            r.id = (OSSL_PARAM *)p;
    return r;
}
#endif
/* End of machine generated */

static const OSSL_PARAM *ml_dsa_gettable_ctx_params(ossl_unused void *vctx,
                                                    ossl_unused void *provctx)
{
    return ml_dsa_get_ctx_params_list;
}

static int ml_dsa_get_ctx_params(void *vctx, OSSL_PARAM *params)
{
    PROV_ML_DSA_CTX *ctx = (PROV_ML_DSA_CTX *)vctx;
    struct ml_dsa_get_ctx_params_st p;

    if (ctx == NULL)
        return 0;

    p = ml_dsa_get_ctx_params_decoder(params);

    if (p.id != NULL
        && !OSSL_PARAM_set_octet_string(p.id,
                                        ctx->aid_len == 0 ? NULL : ctx->aid_buf,
                                        ctx->aid_len))
        return 0;

    return 1;
}

#define MAKE_SIGNATURE_FUNCTIONS(alg)                                          \
    static OSSL_FUNC_signature_newctx_fn ml_dsa_##alg##_newctx;                \
    static void *ml_dsa_##alg##_newctx(void *provctx, const char *propq)       \
    {                                                                          \
        return ml_dsa_newctx(provctx, EVP_PKEY_ML_DSA_##alg, propq);           \
    }                                                                          \
    const OSSL_DISPATCH ossl_ml_dsa_##alg##_signature_functions[] = {          \
        { OSSL_FUNC_SIGNATURE_NEWCTX, (void (*)(void))ml_dsa_##alg##_newctx }, \
        { OSSL_FUNC_SIGNATURE_SIGN_MESSAGE_INIT,                               \
          (void (*)(void))ml_dsa_sign_msg_init },                              \
        { OSSL_FUNC_SIGNATURE_SIGN_MESSAGE_UPDATE,                             \
          (void (*)(void))ml_dsa_signverify_msg_update },                      \
        { OSSL_FUNC_SIGNATURE_SIGN_MESSAGE_FINAL,                              \
          (void (*)(void))ml_dsa_sign_msg_final },                             \
        { OSSL_FUNC_SIGNATURE_SIGN, (void (*)(void))ml_dsa_sign },             \
        { OSSL_FUNC_SIGNATURE_VERIFY_MESSAGE_INIT,                             \
          (void (*)(void))ml_dsa_verify_msg_init },                            \
        { OSSL_FUNC_SIGNATURE_VERIFY_MESSAGE_UPDATE,                           \
          (void (*)(void))ml_dsa_signverify_msg_update },                      \
        { OSSL_FUNC_SIGNATURE_VERIFY_MESSAGE_FINAL,                            \
          (void (*)(void))ml_dsa_verify_msg_final },                           \
        { OSSL_FUNC_SIGNATURE_VERIFY, (void (*)(void))ml_dsa_verify },         \
        { OSSL_FUNC_SIGNATURE_DIGEST_SIGN_INIT,                                \
          (void (*)(void))ml_dsa_digest_signverify_init },                     \
        { OSSL_FUNC_SIGNATURE_DIGEST_SIGN,                                     \
          (void (*)(void))ml_dsa_digest_sign },                                \
        { OSSL_FUNC_SIGNATURE_DIGEST_VERIFY_INIT,                              \
          (void (*)(void))ml_dsa_digest_signverify_init },                     \
        { OSSL_FUNC_SIGNATURE_DIGEST_VERIFY,                                   \
          (void (*)(void))ml_dsa_digest_verify },                              \
        { OSSL_FUNC_SIGNATURE_FREECTX, (void (*)(void))ml_dsa_freectx },       \
        { OSSL_FUNC_SIGNATURE_SET_CTX_PARAMS,                                  \
          (void (*)(void))ml_dsa_set_ctx_params },                             \
        { OSSL_FUNC_SIGNATURE_SETTABLE_CTX_PARAMS,                             \
          (void (*)(void))ml_dsa_settable_ctx_params },                        \
        { OSSL_FUNC_SIGNATURE_GET_CTX_PARAMS,                                  \
          (void (*)(void))ml_dsa_get_ctx_params },                             \
        { OSSL_FUNC_SIGNATURE_GETTABLE_CTX_PARAMS,                             \
          (void (*)(void))ml_dsa_gettable_ctx_params },                        \
        { OSSL_FUNC_SIGNATURE_DUPCTX, (void (*)(void))ml_dsa_dupctx },         \
        OSSL_DISPATCH_END                                                      \
    }

MAKE_SIGNATURE_FUNCTIONS(44);
MAKE_SIGNATURE_FUNCTIONS(65);
MAKE_SIGNATURE_FUNCTIONS(87);

Coverage Report

Created: 2025-07-23 06:08

Line	Count	Source (jump to first uncovered line)
1		/*
2		* Copyright 2024-2025 The OpenSSL Project Authors. All Rights Reserved.
3		*
4		* Licensed under the Apache License 2.0 (the "License"). You may not use
5		* this file except in compliance with the License. You can obtain a copy
6		* in the file LICENSE in the source distribution or at
7		* https://www.openssl.org/source/license.html
8		*/
9
10
11		#include "internal/deprecated.h"
12
13		#include <assert.h>
14		#include <string.h> /* memset */
15		#include <openssl/core_names.h>
16		#include <openssl/err.h>
17		#include <openssl/rand.h>
18		#include <openssl/proverr.h>
19		#include "prov/implementations.h"
20		#include "prov/providercommon.h"
21		#include "prov/provider_ctx.h"
22		#include "prov/der_ml_dsa.h"
23		#include "crypto/ml_dsa.h"
24		#include "internal/common.h"
25		#include "internal/packet.h"
26		#include "internal/sizes.h"
27
28		#define ML_DSA_MESSAGE_ENCODE_RAW 0
29	0	#define ML_DSA_MESSAGE_ENCODE_PURE 1
30
31		static OSSL_FUNC_signature_sign_message_init_fn ml_dsa_sign_msg_init;
32		static OSSL_FUNC_signature_sign_message_update_fn ml_dsa_signverify_msg_update;
33		static OSSL_FUNC_signature_sign_message_final_fn ml_dsa_sign_msg_final;
34		static OSSL_FUNC_signature_sign_fn ml_dsa_sign;
35		static OSSL_FUNC_signature_verify_message_init_fn ml_dsa_verify_msg_init;
36		static OSSL_FUNC_signature_verify_message_update_fn ml_dsa_signverify_msg_update;
37		static OSSL_FUNC_signature_verify_message_final_fn ml_dsa_verify_msg_final;
38		static OSSL_FUNC_signature_verify_fn ml_dsa_verify;
39		static OSSL_FUNC_signature_digest_sign_init_fn ml_dsa_digest_signverify_init;
40		static OSSL_FUNC_signature_digest_sign_fn ml_dsa_digest_sign;
41		static OSSL_FUNC_signature_digest_verify_fn ml_dsa_digest_verify;
42		static OSSL_FUNC_signature_freectx_fn ml_dsa_freectx;
43		static OSSL_FUNC_signature_set_ctx_params_fn ml_dsa_set_ctx_params;
44		static OSSL_FUNC_signature_settable_ctx_params_fn ml_dsa_settable_ctx_params;
45		static OSSL_FUNC_signature_get_ctx_params_fn ml_dsa_get_ctx_params;
46		static OSSL_FUNC_signature_gettable_ctx_params_fn ml_dsa_gettable_ctx_params;
47		static OSSL_FUNC_signature_dupctx_fn ml_dsa_dupctx;
48
49		typedef struct {
50		ML_DSA_KEY *key;
51		OSSL_LIB_CTX *libctx;
52		uint8_t context_string[ML_DSA_MAX_CONTEXT_STRING_LEN];
53		size_t context_string_len;
54		uint8_t test_entropy[ML_DSA_ENTROPY_LEN];
55		size_t test_entropy_len;
56		int msg_encode;
57		int deterministic;
58		int evp_type;
59		/* The Algorithm Identifier of the signature algorithm */
60		uint8_t aid_buf[OSSL_MAX_ALGORITHM_ID_SIZE];
61		size_t aid_len;
62		int mu; /* Flag indicating we should begin from \mu, not the message */
63
64		int operation;
65		EVP_MD_CTX md_ctx; / Ctx for msg_init/update/final interface */
66		unsigned char sig; / Signature, for verification */
67		size_t siglen;
68		} PROV_ML_DSA_CTX;
69
70		static void ml_dsa_freectx(void *vctx)
71	0	{
72	0	PROV_ML_DSA_CTX ctx = (PROV_ML_DSA_CTX )vctx;
73
74	0	EVP_MD_CTX_free(ctx->md_ctx);
75	0	OPENSSL_cleanse(ctx->test_entropy, ctx->test_entropy_len);
76	0	OPENSSL_free(ctx->sig);
77	0	OPENSSL_free(ctx);
78	0	}
79
80		static void ml_dsa_newctx(void provctx, int evp_type, const char *propq)
81	0	{
82	0	PROV_ML_DSA_CTX *ctx;
83
84	0	if (!ossl_prov_is_running())
85	0	return NULL;
86
87	0	ctx = OPENSSL_zalloc(sizeof(PROV_ML_DSA_CTX));
88	0	if (ctx == NULL)
89	0	return NULL;
90
91	0	ctx->libctx = PROV_LIBCTX_OF(provctx);
92	0	ctx->msg_encode = ML_DSA_MESSAGE_ENCODE_PURE;
93	0	ctx->evp_type = evp_type;
94	0	return ctx;
95	0	}
96
97		static void ml_dsa_dupctx(void vctx)
98	0	{
99	0	PROV_ML_DSA_CTX srcctx = (PROV_ML_DSA_CTX )vctx;
100	0	PROV_ML_DSA_CTX *dstctx;
101
102	0	if (!ossl_prov_is_running())
103	0	return NULL;
104
105		/*
106		* Note that the ML_DSA_KEY is ref counted via EVP_PKEY so we can just copy
107		* the key here.
108		*/
109	0	dstctx = OPENSSL_memdup(srcctx, sizeof(*srcctx));
110
111	0	if (dstctx == NULL)
112	0	return NULL;
113
114	0	if (srcctx->sig != NULL) {
115	0	dstctx->sig = OPENSSL_memdup(srcctx->sig, srcctx->siglen);
116	0	if (dstctx->sig == NULL) {
117		/*
118		* Can't call ml_dsa_freectx() here, as it would free
119		* md_ctx which has not been duplicated yet.
120		*/
121	0	OPENSSL_free(dstctx);
122	0	return NULL;
123	0	}
124	0	}
125
126	0	if (srcctx->md_ctx != NULL) {
127	0	dstctx->md_ctx = EVP_MD_CTX_dup(srcctx->md_ctx);
128	0	if (dstctx->md_ctx == NULL) {
129	0	ml_dsa_freectx(dstctx);
130	0	return NULL;
131	0	}
132	0	}
133
134	0	return dstctx;
135	0	}
136
137		static int set_alg_id_buffer(PROV_ML_DSA_CTX *ctx)
138	0	{
139	0	int ret;
140	0	WPACKET pkt;
141	0	uint8_t *aid = NULL;
142
143		/*
144		* We do not care about DER writing errors.
145		* All it really means is that for some reason, there's no
146		* AlgorithmIdentifier to be had, but the operation itself is
147		* still valid, just as long as it's not used to construct
148		* anything that needs an AlgorithmIdentifier.
149		*/
150	0	ctx->aid_len = 0;
151	0	ret = WPACKET_init_der(&pkt, ctx->aid_buf, sizeof(ctx->aid_buf));
152	0	ret = ret && ossl_DER_w_algorithmIdentifier_ML_DSA(&pkt, -1, ctx->key);
153	0	if (ret && WPACKET_finish(&pkt)) {
154	0	WPACKET_get_total_written(&pkt, &ctx->aid_len);
155	0	aid = WPACKET_get_curr(&pkt);
156	0	}
157	0	WPACKET_cleanup(&pkt);
158	0	if (aid != NULL && ctx->aid_len != 0)
159	0	memmove(ctx->aid_buf, aid, ctx->aid_len);
160	0	return 1;
161	0	}
162
163		static int ml_dsa_signverify_msg_init(void vctx, void vkey,
164		const OSSL_PARAM params[], int operation,
165		const char *desc)
166	0	{
167	0	PROV_ML_DSA_CTX ctx = (PROV_ML_DSA_CTX )vctx;
168	0	ML_DSA_KEY *key = vkey;
169
170	0	if (!ossl_prov_is_running()
171	0	\|\| ctx == NULL)
172	0	return 0;
173
174	0	if (vkey == NULL && ctx->key == NULL) {
175	0	ERR_raise(ERR_LIB_PROV, PROV_R_NO_KEY_SET);
176	0	return 0;
177	0	}
178
179	0	if (key != NULL)
180	0	ctx->key = vkey;
181	0	if (!ossl_ml_dsa_key_matches(ctx->key, ctx->evp_type))
182	0	return 0;
183
184	0	set_alg_id_buffer(ctx);
185	0	ctx->mu = 0;
186	0	ctx->operation = operation;
187
188	0	return ml_dsa_set_ctx_params(ctx, params);
189	0	}
190
191		static int ml_dsa_sign_msg_init(void vctx, void vkey, const OSSL_PARAM params[])
192	0	{
193	0	return ml_dsa_signverify_msg_init(vctx, vkey, params,
194	0	EVP_PKEY_OP_SIGNMSG, "ML_DSA Sign Init");
195	0	}
196
197		static int ml_dsa_digest_signverify_init(void vctx, const char mdname,
198		void *vkey, const OSSL_PARAM params[])
199	0	{
200	0	PROV_ML_DSA_CTX ctx = (PROV_ML_DSA_CTX )vctx;
201
202	0	if (mdname != NULL && mdname[0] != '\0') {
203	0	ERR_raise_data(ERR_LIB_PROV, PROV_R_INVALID_DIGEST,
204	0	"Explicit digest not supported for ML-DSA operations");
205	0	return 0;
206	0	}
207
208	0	ctx->mu = 0;
209
210	0	if (vkey == NULL && ctx->key != NULL)
211	0	return ml_dsa_set_ctx_params(ctx, params);
212
213	0	return ml_dsa_signverify_msg_init(vctx, vkey, params,
214	0	EVP_PKEY_OP_SIGN, "ML_DSA Sign Init");
215	0	}
216
217		static int ml_dsa_signverify_msg_update(void *vctx,
218		const unsigned char *data,
219		size_t datalen)
220	0	{
221	0	PROV_ML_DSA_CTX ctx = (PROV_ML_DSA_CTX )vctx;
222
223	0	if (ctx == NULL)
224	0	return 0;
225
226	0	if (!ossl_prov_is_running())
227	0	return 0;
228
229	0	if (ctx->mu)
230	0	return 0;
231
232	0	if (ctx->md_ctx == NULL) {
233	0	ctx->md_ctx = ossl_ml_dsa_mu_init(ctx->key, ctx->msg_encode,
234	0	ctx->context_string,
235	0	ctx->context_string_len);
236	0	if (ctx->md_ctx == NULL)
237	0	return 0;
238	0	}
239
240	0	return ossl_ml_dsa_mu_update(ctx->md_ctx, data, datalen);
241	0	}
242
243		static int ml_dsa_sign_msg_final(void vctx, unsigned char sig,
244		size_t *siglen, size_t sigsize)
245	0	{
246	0	PROV_ML_DSA_CTX ctx = (PROV_ML_DSA_CTX )vctx;
247	0	uint8_t rand_tmp[ML_DSA_ENTROPY_LEN], *rnd = NULL;
248	0	uint8_t mu[ML_DSA_MU_BYTES];
249	0	int ret = 0;
250
251	0	if (ctx == NULL)
252	0	return 0;
253
254	0	if (!ossl_prov_is_running())
255	0	return 0;
256
257	0	if (ctx->md_ctx == NULL)
258	0	return 0;
259
260	0	if (sig != NULL) {
261	0	if (ctx->test_entropy_len != 0) {
262	0	rnd = ctx->test_entropy;
263	0	} else {
264	0	rnd = rand_tmp;
265
266	0	if (ctx->deterministic == 1)
267	0	memset(rnd, 0, sizeof(rand_tmp));
268	0	else if (RAND_priv_bytes_ex(ctx->libctx, rnd, sizeof(rand_tmp), 0) <= 0)
269	0	return 0;
270	0	}
271
272	0	if (!ossl_ml_dsa_mu_finalize(ctx->md_ctx, mu, sizeof(mu)))
273	0	return 0;
274	0	}
275
276	0	ret = ossl_ml_dsa_sign(ctx->key, 1, mu, sizeof(mu), NULL, 0, rnd,
277	0	sizeof(rand_tmp), 0, sig, siglen, sigsize);
278	0	if (rnd != ctx->test_entropy)
279	0	OPENSSL_cleanse(rand_tmp, sizeof(rand_tmp));
280	0	return ret;
281	0	}
282
283		static int ml_dsa_sign(void vctx, uint8_t sig, size_t *siglen, size_t sigsize,
284		const uint8_t *msg, size_t msg_len)
285	0	{
286	0	int ret = 0;
287	0	PROV_ML_DSA_CTX ctx = (PROV_ML_DSA_CTX )vctx;
288	0	uint8_t rand_tmp[ML_DSA_ENTROPY_LEN], *rnd = NULL;
289
290	0	if (!ossl_prov_is_running())
291	0	return 0;
292
293	0	if (sig != NULL) {
294	0	if (ctx->test_entropy_len != 0) {
295	0	rnd = ctx->test_entropy;
296	0	} else {
297	0	rnd = rand_tmp;
298
299	0	if (ctx->deterministic == 1)
300	0	memset(rnd, 0, sizeof(rand_tmp));
301	0	else if (RAND_priv_bytes_ex(ctx->libctx, rnd, sizeof(rand_tmp), 0) <= 0)
302	0	return 0;
303	0	}
304	0	}
305	0	ret = ossl_ml_dsa_sign(ctx->key, ctx->mu, msg, msg_len,
306	0	ctx->context_string, ctx->context_string_len,
307	0	rnd, sizeof(rand_tmp), ctx->msg_encode,
308	0	sig, siglen, sigsize);
309	0	if (rnd != ctx->test_entropy)
310	0	OPENSSL_cleanse(rand_tmp, sizeof(rand_tmp));
311	0	return ret;
312	0	}
313
314		static int ml_dsa_digest_sign(void vctx, uint8_t sig, size_t *siglen, size_t sigsize,
315		const uint8_t *tbs, size_t tbslen)
316	0	{
317	0	return ml_dsa_sign(vctx, sig, siglen, sigsize, tbs, tbslen);
318	0	}
319
320		static int ml_dsa_verify_msg_init(void vctx, void vkey, const OSSL_PARAM params[])
321	0	{
322	0	return ml_dsa_signverify_msg_init(vctx, vkey, params, EVP_PKEY_OP_VERIFYMSG,
323	0	"ML_DSA Verify Init");
324	0	}
325
326		static int ml_dsa_verify_msg_final(void *vctx)
327	0	{
328	0	PROV_ML_DSA_CTX ctx = (PROV_ML_DSA_CTX )vctx;
329	0	uint8_t mu[ML_DSA_MU_BYTES];
330
331	0	if (!ossl_prov_is_running())
332	0	return 0;
333
334	0	if (ctx->md_ctx == NULL)
335	0	return 0;
336
337	0	if (!ossl_ml_dsa_mu_finalize(ctx->md_ctx, mu, sizeof(mu)))
338	0	return 0;
339
340	0	return ossl_ml_dsa_verify(ctx->key, 1, mu, sizeof(mu), NULL, 0, 0,
341	0	ctx->sig, ctx->siglen);
342	0	}
343
344		static int ml_dsa_verify(void vctx, const uint8_t sig, size_t siglen,
345		const uint8_t *msg, size_t msg_len)
346	0	{
347	0	PROV_ML_DSA_CTX ctx = (PROV_ML_DSA_CTX )vctx;
348
349	0	if (!ossl_prov_is_running())
350	0	return 0;
351	0	return ossl_ml_dsa_verify(ctx->key, ctx->mu, msg, msg_len,
352	0	ctx->context_string, ctx->context_string_len,
353	0	ctx->msg_encode, sig, siglen);
354	0	}
355		static int ml_dsa_digest_verify(void *vctx,
356		const uint8_t *sig, size_t siglen,
357		const uint8_t *tbs, size_t tbslen)
358	0	{
359	0	return ml_dsa_verify(vctx, sig, siglen, tbs, tbslen);
360	0	}
361
362		/*
363		* Only need the param list for the signing case. The decoder and structure
364		* are shared between the sign and verify cases.
365		*/
366		#define ml_dsa_set_ctx_params_st ml_dsa_verifymsg_set_ctx_params_st
367		#define ml_dsa_set_ctx_params_decoder ml_dsa_verifymsg_set_ctx_params_decoder
368
369		/* Machine generated by util/perl/OpenSSL/paramnames.pm */
370		#ifndef ml_dsa_set_ctx_params_list
371		static const OSSL_PARAM ml_dsa_set_ctx_params_list[] = {
372		OSSL_PARAM_octet_string(OSSL_SIGNATURE_PARAM_CONTEXT_STRING, NULL, 0),
373		OSSL_PARAM_octet_string(OSSL_SIGNATURE_PARAM_TEST_ENTROPY, NULL, 0),
374		OSSL_PARAM_int(OSSL_SIGNATURE_PARAM_DETERMINISTIC, NULL),
375		OSSL_PARAM_int(OSSL_SIGNATURE_PARAM_MESSAGE_ENCODING, NULL),
376		OSSL_PARAM_int(OSSL_SIGNATURE_PARAM_MU, NULL),
377		OSSL_PARAM_END
378		};
379		#endif
380
381		#ifndef ml_dsa_set_ctx_params_st
382		struct ml_dsa_set_ctx_params_st {
383		OSSL_PARAM *ctx;
384		OSSL_PARAM *det;
385		OSSL_PARAM *ent;
386		OSSL_PARAM *msgenc;
387		OSSL_PARAM *mu;
388		};
389		#endif
390
391		#ifndef ml_dsa_set_ctx_params_decoder
392		static struct ml_dsa_set_ctx_params_st
393		ml_dsa_set_ctx_params_decoder(const OSSL_PARAM params[]) {
394		struct ml_dsa_set_ctx_params_st r;
395		const OSSL_PARAM *p;
396		const char *s;
397
398		memset(&r, 0, sizeof(r));
399		for (p = params; (s = p->key) != NULL; p++)
400		switch(s[0]) {
401		default:
402		break;
403		case 'c':
404		if (ossl_likely(r.ctx == NULL && strcmp("ontext-string", s + 1) == 0))
405		r.ctx = (OSSL_PARAM *)p;
406		break;
407		case 'd':
408		if (ossl_likely(r.det == NULL && strcmp("eterministic", s + 1) == 0))
409		r.det = (OSSL_PARAM *)p;
410		break;
411		case 'm':
412		switch(s[1]) {
413		default:
414		break;
415		case 'e':
416		if (ossl_likely(r.msgenc == NULL && strcmp("ssage-encoding", s + 2) == 0))
417		r.msgenc = (OSSL_PARAM *)p;
418		break;
419		case 'u':
420		switch(s[2]) {
421		default:
422		break;
423		case '\0':
424		r.mu = ossl_likely(r.mu == NULL) ? (OSSL_PARAM *)p : r.mu;
425		}
426		}
427		break;
428		case 't':
429		if (ossl_likely(r.ent == NULL && strcmp("est-entropy", s + 1) == 0))
430		r.ent = (OSSL_PARAM *)p;
431		}
432		return r;
433		}
434		#endif
435		/* End of machine generated */
436
437		/* Machine generated by util/perl/OpenSSL/paramnames.pm */
438		#ifndef ml_dsa_verifymsg_set_ctx_params_list
439		static const OSSL_PARAM ml_dsa_verifymsg_set_ctx_params_list[] = {
440		OSSL_PARAM_octet_string(OSSL_SIGNATURE_PARAM_CONTEXT_STRING, NULL, 0),
441		OSSL_PARAM_octet_string(OSSL_SIGNATURE_PARAM_TEST_ENTROPY, NULL, 0),
442		OSSL_PARAM_int(OSSL_SIGNATURE_PARAM_DETERMINISTIC, NULL),
443		OSSL_PARAM_int(OSSL_SIGNATURE_PARAM_MESSAGE_ENCODING, NULL),
444		OSSL_PARAM_int(OSSL_SIGNATURE_PARAM_MU, NULL),
445		OSSL_PARAM_octet_string(OSSL_SIGNATURE_PARAM_SIGNATURE, NULL, 0),
446		OSSL_PARAM_END
447		};
448		#endif
449
450		#ifndef ml_dsa_verifymsg_set_ctx_params_st
451		struct ml_dsa_verifymsg_set_ctx_params_st {
452		OSSL_PARAM *ctx;
453		OSSL_PARAM *det;
454		OSSL_PARAM *ent;
455		OSSL_PARAM *msgenc;
456		OSSL_PARAM *mu;
457		OSSL_PARAM *sig;
458		};
459		#endif
460
461		#ifndef ml_dsa_verifymsg_set_ctx_params_decoder
462		static struct ml_dsa_verifymsg_set_ctx_params_st
463	0	ml_dsa_verifymsg_set_ctx_params_decoder(const OSSL_PARAM params[]) {
464	0	struct ml_dsa_verifymsg_set_ctx_params_st r;
465	0	const OSSL_PARAM *p;
466	0	const char *s;
467
468	0	memset(&r, 0, sizeof(r));
469	0	for (p = params; (s = p->key) != NULL; p++)
470	0	switch(s[0]) {
471	0	default:
472	0	break;
473	0	case 'c':
474	0	if (ossl_likely(r.ctx == NULL && strcmp("ontext-string", s + 1) == 0))
475	0	r.ctx = (OSSL_PARAM *)p;
476	0	break;
477	0	case 'd':
478	0	if (ossl_likely(r.det == NULL && strcmp("eterministic", s + 1) == 0))
479	0	r.det = (OSSL_PARAM *)p;
480	0	break;
481	0	case 'm':
482	0	switch(s[1]) {
483	0	default:
484	0	break;
485	0	case 'e':
486	0	if (ossl_likely(r.msgenc == NULL && strcmp("ssage-encoding", s + 2) == 0))
487	0	r.msgenc = (OSSL_PARAM *)p;
488	0	break;
489	0	case 'u':
490	0	switch(s[2]) {
491	0	default:
492	0	break;
493	0	case '\0':
494	0	r.mu = ossl_likely(r.mu == NULL) ? (OSSL_PARAM *)p : r.mu;
495	0	}
496	0	}
497	0	break;
498	0	case 's':
499	0	if (ossl_likely(r.sig == NULL && strcmp("ignature", s + 1) == 0))
500	0	r.sig = (OSSL_PARAM *)p;
501	0	break;
502	0	case 't':
503	0	if (ossl_likely(r.ent == NULL && strcmp("est-entropy", s + 1) == 0))
504	0	r.ent = (OSSL_PARAM *)p;
505	0	}
506	0	return r;
507	0	}
508		#endif
509		/* End of machine generated */
510
511		static int ml_dsa_set_ctx_params(void *vctx, const OSSL_PARAM params[])
512	0	{
513	0	PROV_ML_DSA_CTX pctx = (PROV_ML_DSA_CTX )vctx;
514	0	struct ml_dsa_verifymsg_set_ctx_params_st p;
515
516	0	if (pctx == NULL)
517	0	return 0;
518	0	if (ossl_param_is_empty(params))
519	0	return 1;
520
521	0	p = ml_dsa_verifymsg_set_ctx_params_decoder(params);
522
523	0	if (p.ctx != NULL) {
524	0	void *vp = pctx->context_string;
525
526	0	if (!OSSL_PARAM_get_octet_string(p.ctx, &vp, sizeof(pctx->context_string),
527	0	&(pctx->context_string_len))) {
528	0	pctx->context_string_len = 0;
529	0	return 0;
530	0	}
531	0	}
532
533	0	if (p.ent != NULL) {
534	0	void *vp = pctx->test_entropy;
535
536	0	pctx->test_entropy_len = 0;
537	0	if (!OSSL_PARAM_get_octet_string(p.ent, &vp, sizeof(pctx->test_entropy),
538	0	&(pctx->test_entropy_len)))
539	0	return 0;
540	0	if (pctx->test_entropy_len != sizeof(pctx->test_entropy)) {
541	0	pctx->test_entropy_len = 0;
542	0	ERR_raise(ERR_LIB_PROV, PROV_R_INVALID_SEED_LENGTH);
543	0	return 0;
544	0	}
545	0	}
546
547	0	if (p.det != NULL && !OSSL_PARAM_get_int(p.det, &pctx->deterministic))
548	0	return 0;
549
550	0	if (p.msgenc != NULL && !OSSL_PARAM_get_int(p.msgenc, &pctx->msg_encode))
551	0	return 0;
552
553	0	if (p.mu != NULL && !OSSL_PARAM_get_int(p.mu, &pctx->mu))
554	0	return 0;
555
556	0	if (p.sig != NULL && pctx->operation == EVP_PKEY_OP_VERIFYMSG) {
557	0	OPENSSL_free(pctx->sig);
558	0	pctx->sig = NULL;
559	0	pctx->siglen = 0;
560	0	if (!OSSL_PARAM_get_octet_string(p.sig, (void **)&pctx->sig,
561	0	0, &pctx->siglen))
562	0	return 0;
563	0	}
564
565	0	return 1;
566	0	}
567
568		static const OSSL_PARAM ml_dsa_settable_ctx_params(void vctx,
569		ossl_unused void *provctx)
570	0	{
571	0	PROV_ML_DSA_CTX pctx = (PROV_ML_DSA_CTX )vctx;
572
573	0	if (pctx != NULL && pctx->operation == EVP_PKEY_OP_VERIFYMSG)
574	0	return ml_dsa_verifymsg_set_ctx_params_list;
575	0	else
576	0	return ml_dsa_set_ctx_params_list;
577	0	}
578
579		/* Machine generated by util/perl/OpenSSL/paramnames.pm */
580		#ifndef ml_dsa_get_ctx_params_list
581		static const OSSL_PARAM ml_dsa_get_ctx_params_list[] = {
582		OSSL_PARAM_octet_string(OSSL_SIGNATURE_PARAM_ALGORITHM_ID, NULL, 0),
583		OSSL_PARAM_END
584		};
585		#endif
586
587		#ifndef ml_dsa_get_ctx_params_st
588		struct ml_dsa_get_ctx_params_st {
589		OSSL_PARAM *id;
590		};
591		#endif
592
593		#ifndef ml_dsa_get_ctx_params_decoder
594		static struct ml_dsa_get_ctx_params_st
595	0	ml_dsa_get_ctx_params_decoder(const OSSL_PARAM params[]) {
596	0	struct ml_dsa_get_ctx_params_st r;
597	0	const OSSL_PARAM *p;
598	0	const char *s;
599
600	0	memset(&r, 0, sizeof(r));
601	0	for (p = params; (s = p->key) != NULL; p++)
602	0	if (ossl_likely(r.id == NULL && strcmp("algorithm-id", s + 0) == 0))
603	0	r.id = (OSSL_PARAM *)p;
604	0	return r;
605	0	}
606		#endif
607		/* End of machine generated */
608
609		static const OSSL_PARAM ml_dsa_gettable_ctx_params(ossl_unused void vctx,
610		ossl_unused void *provctx)
611	0	{
612	0	return ml_dsa_get_ctx_params_list;
613	0	}
614
615		static int ml_dsa_get_ctx_params(void vctx, OSSL_PARAM params)
616	0	{
617	0	PROV_ML_DSA_CTX ctx = (PROV_ML_DSA_CTX )vctx;
618	0	struct ml_dsa_get_ctx_params_st p;
619
620	0	if (ctx == NULL)
621	0	return 0;
622
623	0	p = ml_dsa_get_ctx_params_decoder(params);
624
625	0	if (p.id != NULL
626	0	&& !OSSL_PARAM_set_octet_string(p.id,
627	0	ctx->aid_len == 0 ? NULL : ctx->aid_buf,
628	0	ctx->aid_len))
629	0	return 0;
630
631	0	return 1;
632	0	}
633
634		#define MAKE_SIGNATURE_FUNCTIONS(alg) \
635		static OSSL_FUNC_signature_newctx_fn ml_dsa_##alg##_newctx; \
636		static void ml_dsa_##alg##_newctx(void provctx, const char *propq) \
637	0	{ \
638	0	return ml_dsa_newctx(provctx, EVP_PKEY_ML_DSA_##alg, propq); \
639	0	} \ Unexecuted instantiation: ml_dsa_sig.c:ml_dsa_44_newctx Unexecuted instantiation: ml_dsa_sig.c:ml_dsa_65_newctx Unexecuted instantiation: ml_dsa_sig.c:ml_dsa_87_newctx
640		const OSSL_DISPATCH ossl_ml_dsa_##alg##_signature_functions[] = { \
641		{ OSSL_FUNC_SIGNATURE_NEWCTX, (void (*)(void))ml_dsa_##alg##_newctx }, \
642		{ OSSL_FUNC_SIGNATURE_SIGN_MESSAGE_INIT, \
643		(void (*)(void))ml_dsa_sign_msg_init }, \
644		{ OSSL_FUNC_SIGNATURE_SIGN_MESSAGE_UPDATE, \
645		(void (*)(void))ml_dsa_signverify_msg_update }, \
646		{ OSSL_FUNC_SIGNATURE_SIGN_MESSAGE_FINAL, \
647		(void (*)(void))ml_dsa_sign_msg_final }, \
648		{ OSSL_FUNC_SIGNATURE_SIGN, (void (*)(void))ml_dsa_sign }, \
649		{ OSSL_FUNC_SIGNATURE_VERIFY_MESSAGE_INIT, \
650		(void (*)(void))ml_dsa_verify_msg_init }, \
651		{ OSSL_FUNC_SIGNATURE_VERIFY_MESSAGE_UPDATE, \
652		(void (*)(void))ml_dsa_signverify_msg_update }, \
653		{ OSSL_FUNC_SIGNATURE_VERIFY_MESSAGE_FINAL, \
654		(void (*)(void))ml_dsa_verify_msg_final }, \
655		{ OSSL_FUNC_SIGNATURE_VERIFY, (void (*)(void))ml_dsa_verify }, \
656		{ OSSL_FUNC_SIGNATURE_DIGEST_SIGN_INIT, \
657		(void (*)(void))ml_dsa_digest_signverify_init }, \
658		{ OSSL_FUNC_SIGNATURE_DIGEST_SIGN, \
659		(void (*)(void))ml_dsa_digest_sign }, \
660		{ OSSL_FUNC_SIGNATURE_DIGEST_VERIFY_INIT, \
661		(void (*)(void))ml_dsa_digest_signverify_init }, \
662		{ OSSL_FUNC_SIGNATURE_DIGEST_VERIFY, \
663		(void (*)(void))ml_dsa_digest_verify }, \
664		{ OSSL_FUNC_SIGNATURE_FREECTX, (void (*)(void))ml_dsa_freectx }, \
665		{ OSSL_FUNC_SIGNATURE_SET_CTX_PARAMS, \
666		(void (*)(void))ml_dsa_set_ctx_params }, \
667		{ OSSL_FUNC_SIGNATURE_SETTABLE_CTX_PARAMS, \
668		(void (*)(void))ml_dsa_settable_ctx_params }, \
669		{ OSSL_FUNC_SIGNATURE_GET_CTX_PARAMS, \
670		(void (*)(void))ml_dsa_get_ctx_params }, \
671		{ OSSL_FUNC_SIGNATURE_GETTABLE_CTX_PARAMS, \
672		(void (*)(void))ml_dsa_gettable_ctx_params }, \
673		{ OSSL_FUNC_SIGNATURE_DUPCTX, (void (*)(void))ml_dsa_dupctx }, \
674		OSSL_DISPATCH_END \
675		}
676
677		MAKE_SIGNATURE_FUNCTIONS(44);
678		MAKE_SIGNATURE_FUNCTIONS(65);
679		MAKE_SIGNATURE_FUNCTIONS(87);