Re: Pure ML-DSA signature verification

On 2/24/26 2:42 PM, Viktor Dukhovni wrote:
> On Tue, Feb 24, 2026 at 02:38:03PM +0100, Christian Schmidt wrote:
> 
>> Looking at page 27 of FIPS 204 to me implies that in ML-DSA the signature
>> that is to be verified also is processed before the actual message data,
>> though I did not actually try to understand the algorithm in detail. So
>> ML-DSA would also need an init_ex function that can receive the signature
>> early.
>>
>> As such, I'd say it's a limitation of openssl for ML-DSA, too.
> 
> Or you could just not make up the answer out of thin air. :-)

You wrote it yourself - openssl is lacking a (simple) API that enables a 
simple init - update - final verification for algorithms that process 
the signature early (here: calculate the µ value), and people that just 
want to work with a cryptographic library need to deep-dive into algorithms.

The lack of such an API, that could be easily generalized with an 
init_ex function that accepts the signature to be verified, is as such a 
limitation of openssl.

Regards,
Christian

PS: If you have an idea how to do the same for ED25519 I'd be highly 
interested. Having to continuously port patches forward is kind of 
annoying, and the core ED25519 functions are not exposed enough to be 
called externally.

-- 
You received this message because you are subscribed to the Google Groups "openssl-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to openssl-users+unsubscribe-MCmKBN63+Bmbup2nOX2J7Q@public.gmane.org
To view this discussion visit https://groups.google.com/a/openssl.org/d/msgid/openssl-users/c0f94e77-6136-4e35-bb5b-053e7ba0b191%40digadd.de.