Re: Pure ML-DSA signature verification

On Tue, Feb 24, 2026 at 05:49:18PM +0530, Manish Patidar wrote:

> I am attempting to verify the Pure ML-DSA signature, but I have
> encountered an issue. OpenSSL does not support the Verify update
> operation, meaning the data to be verified must be provided in one
> instance.  Is this a limitation of OpenSSL or the Pure ML-DSA
> algorithm?

Pure ML-DSA requires the entire message to be provided in one shot, or
that the caller pre-computes the external-μ value, and passes that,
indicating that the input is the μ value.  See EVP_SIGNATURE-ML-DSA(7)
for details.

The upcoming OpenSSL 4.0 will include support for "ML-DSA-MU" as a
pseudo-digest, that you can use with EVP_DigestInit_ex(3) to compute the
external-μ value given the target public key and incremental chunks of
the message.  See EVP_MD-ML-DSA-MU(7) (in the OpenSSL 4.0 source tree,
or installed image).

With OpenSSL 3.5 and 3.6 you can compute external-μ yourself, it is just
a 64-byte SHAKE256 digest of the message representative prefixed with a
couple of parameters as described FIPS204 (the public digest key `tr`,
the context string, a domain-separation byte and an optional OID for
HashML-DSA).

-- 
    Viktor.  🇺🇦 Слава Україні!

-- 
You received this message because you are subscribed to the Google Groups "openssl-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to openssl-users+unsubscribe-MCmKBN63+Bmbup2nOX2J7Q@public.gmane.org
To view this discussion visit https://groups.google.com/a/openssl.org/d/msgid/openssl-users/aZ2qVy2Kx-fQIKim%40chardros.imrryr.org.