Skip to content

mldsa: backfill μ, re-add draft-celi-acvp-ml-dsa table 1 and 2 vectors#213

Merged
cpu merged 5 commits intoC2SP:mainfrom
cpu:cpu-mldsa-acvp-rejection-vecs-round2
Feb 6, 2026
Merged

mldsa: backfill μ, re-add draft-celi-acvp-ml-dsa table 1 and 2 vectors#213
cpu merged 5 commits intoC2SP:mainfrom
cpu:cpu-mldsa-acvp-rejection-vecs-round2

Conversation

@cpu
Copy link
Member

@cpu cpu commented Feb 4, 2026

This is a follow up to #207, which was reverted in #210 based on the feedback from #209.

A new commit is added up-front that backfills the calculated μ for both the seed & noseed ML-DSA sign test vectors. The common schema is updated to add mu as an optional field.

Then, the draft-celi-acvp-ml-dsa §6.1.2 table 1 and 2 test vectors are re-added, this time without msg but with mu calculated properly from the input M' values. The common schema is updated to make msg an optional field to allow these new vectors where we have mu but not msg. Unlike in #207 both the seed and noseed vectors are updated with the table 1 and 2 vectors.

Updates #193
Replaces #207
Resolves #208
Resolves #209

The `mldsa_sign_common.json` schema used by both seed & noseed sign
tests is updated to describe an optional `mu` field.

The calculated `mu` value is added to all existing vectors except for
the test cases with the `InvalidContext` flag where `mu` would be
undefined.
@cpu cpu requested review from FiloSottile and sgmenda February 4, 2026 16:44
@cpu cpu self-assigned this Feb 4, 2026
@cpu
Copy link
Member Author

cpu commented Feb 4, 2026

cc @abbra

@abbra
Copy link

abbra commented Feb 4, 2026

In my case (high-level PyCA API), we do not plan to expose mu (yet), so it would be good to have a clear indication whether those tests that have no msg are internal for ML-DSA implementations. Perhaps, add a flag for that?

@cpu
Copy link
Member Author

cpu commented Feb 4, 2026

Perhaps, add a flag for that?

@abbra I would be open to that 👍

We should also perhaps amend the msg field schema description from mldsa_sign_common.json to say something like:

[optional] The message to sign (if omitted, mu is present to use with Sign_internal)

@abbra
Copy link

abbra commented Feb 4, 2026

Make sense to amend a description.

As for the flag, maybe follow sign_internal and verify_internal as in FIPS204 document?

@cpu cpu mentioned this pull request Feb 4, 2026
cpu added 3 commits February 5, 2026 11:05
The NIST ACVP specification for ML-DSA includes a table with "Known
Answer Tests for Rejection Cases".

These Known Answer Tests exercise all rejection paths in FIPS 204
Algorithm 7 (`ML-DSA.Sign_internal`):

- ML-DSA-44: `z`, `r0`, `ct0`, `h` rejections
- ML-DSA-65/87: `z`, `r0`, `h` rejections

Notably, the `ct0` rejection (`||ct0||∞ ≥ γ2`) is unique to ML-DSA-44.
The NIST ACVP specification for ML-DSA includes a table with "Known
Answer Tests for Number of Rejection Cases".

These tests verify at least 32 rejections occur, detecting
implementations that abort early and potentially leak information about
the underlying key.
@cpu cpu force-pushed the cpu-mldsa-acvp-rejection-vecs-round2 branch from 16b988d to 38d7080 Compare February 5, 2026 16:05
@cpu
Copy link
Member Author

cpu commented Feb 5, 2026

cpu force-pushed the cpu-mldsa-acvp-rejection-vecs-round2 branch from 16b988d to 38d7080

Updated w/ the schema description change & a new Internal flag for the relevant test cases.

@abbra
Copy link

abbra commented Feb 5, 2026

Looks good to me.

Copy link
Contributor

@sgmenda sgmenda left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

lgtm, re not possible in json with schema, we should maybe consider toml or something more flexible.

A `mu` value should be provided for each `mldsa_sign_common.json` test
case with the exception of `"result": "invalid"` test cases.
@cpu
Copy link
Member Author

cpu commented Feb 6, 2026

Thanks for the reviews :-)

re not possible in json with schema

It ended up being possible after all (373a022).

we should maybe consider toml or something more flexible.

I'm not a huge fan of JSON or JSON schema, but I also don't love TOML 😆 In either case I think it would be a big project to change the format of the vectors and schemas at this point and would probably want to prioritize other things first.

@cpu cpu merged commit c441f3c into C2SP:main Feb 6, 2026
1 check passed
@cpu cpu deleted the cpu-mldsa-acvp-rejection-vecs-round2 branch February 6, 2026 14:56
@sgmenda
Copy link
Contributor

sgmenda commented Feb 6, 2026

@cpu nice!! thanks for the PR. 🫶🏽

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

ML-DSA rejection test vectors lack metadata to specify signing interface Add external µ to ML-DSA test vectors

4 participants