Re: Pure ML-DSA signature verification

On Tue, Feb 24, 2026 at 02:55:44PM +0100, Christian Schmidt wrote:

> You wrote it yourself - openssl is lacking a (simple) API that enables a
> simple init - update - final verification for algorithms that process the
> signature early (here: calculate the µ value), and people that just want to
> work with a cryptographic library need to deep-dive into algorithms.

Actually, that API is also present, but the initial ML-DSA integration
into the OpenSSL 3.5 default provider did not have the requesite
handlers for EVP_PKEY_{sign,verify}_message_{update,final}().  These
were added in OpenSSL 3.6.

> The lack of such an API, that could be easily generalized with an
> init_ex function that accepts the signature to be verified, is as such
> a limitation of OpenSSL.

Good things come to those who wait...  With EdDSA the limiation is
fundamental, and there's a "prehash" variant for those who must have
IUF.  With ML-DSA IUF is possible, and now available in two different
ways.  Just not through the EVP_Digest{Sign,Verify} APIs which are for
"traditional" signature algorithms that operate on precomputed message
digests with the aid of a separately specified digest algorithm.

-- 
    Viktor.  🇺🇦 Слава Україні!

-- 
You received this message because you are subscribed to the Google Groups "openssl-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to openssl-users+unsubscribe-MCmKBN63+Bmbup2nOX2J7Q@public.gmane.org
To view this discussion visit https://groups.google.com/a/openssl.org/d/msgid/openssl-users/aZ20wX_Rh4tza1dZ%40chardros.imrryr.org.