iaik.security.pq.mldsa

Class MLDSA

java.lang.Object

java.security.SignatureSpi

iaik.security.pq.mldsa.MLDSA

Direct Known Subclasses:

HashMLDSA44SHA512, HashMLDSA65SHA512, HashMLDSA87SHA512, MLDSA44, MLDSA65, MLDSA87

public class MLDSA
extends SignatureSpi

This class implements the ML-DSA signature algorithm as specified by NIST in FIPS 204.

The standard defines three security levels for MLDSA: 2, 3 and 5, corresponding to MLDSA-44, MLDSA-65 and MLDSA-87.

Furthermore each of these variants has a Hash variant, HashMLDSA-44 for MLDSA44, etc. At the moment only SHA512 is supported.

Use the non-hash variant if the data is hashed beforehand. If the data is not hashed beforehand, both variants are fine. The non-hash (aka. pure) variant is generally preferred.

For signing some message or verifying a signature using MLDSA, generally an application will have to perform three steps:

• First an instance of the desired signature algorithm has to be created by using a proper getInstance method, e.g.:

   Signature mldsa = Signature.getInstance("MLDSA");
   

• Second, the Signature object just created has to be properly initialized for signing a message respectively verifying a signature using a MLDSA private respectively MLDSA public key, e.g.:
  • Initialize for Signing: mldsa.initSign(mldsaPrivateKey);
  • Initialize for Verifying: mldsa.initVerify(mldsaPublicKey);

• Finally, if the Signature object has been initialized for signing, the data to be signed is supplied to it and subsequently the signature is created by calling the sign method returning the signature as a byte array. Otherwise, if the Signature object has been initialized for verifying, first the data to be verified is supplied to the Signature object, and subsequently the signature is verified by calling the verify method, supplied with the byte array holding the corresponding signature:
  • Supply data to be signed, and subsequently sign it:

     mldsa.update(data);
     byte[] signature = mldsa.sign();
     

  • Supply data to be verified, and verify the signature:

     mldsa.update(data);
     System.out.println("Signature "
         + (mldsa.verify(signature) ? "correct!" : "not correct!"));
     

References:

See Also:

FIPS 204

Field Summary

Fields inherited from class java.security.SignatureSpi

appRandom

Constructor Summary

Constructors

Constructor and Description
MLDSA() The default constructor.

Method Summary

Modifier and Type	Method and Description
protected Object	engineGetParameter(String s) Not Supported
protected AlgorithmParameters	engineGetParameters() Not Supported
protected void	engineInitSign(PrivateKey privateKey)
protected void	engineInitSign(PrivateKey privateKey, SecureRandom random)
protected void	engineInitVerify(PublicKey publicKey)
protected void	engineSetParameter(AlgorithmParameterSpec parameterSpec) Sets the Signature Instance to the values defined by the SettingsMLDSAAlgorithmParameterSpec object
protected void	engineSetParameter(String param, Object o) Not Supported
protected byte[]	engineSign()
protected void	engineUpdate(byte b)
protected void	engineUpdate(byte[] bytes, int off, int len)
protected boolean	engineVerify(byte[] sigBytes)
protected iaik.asn1.structures.AlgorithmID	getOID()

Methods inherited from class java.security.SignatureSpi

clone, engineSign, engineUpdate, engineVerify

Methods inherited from class java.lang.Object

equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Detail

MLDSA

public MLDSA()

The default constructor. Normally, it is advisable to use Signature.getInstance("MLDSA"); to create a new signature object.

See Also:

Signature.getInstance(String)

Method Detail

getOID

protected iaik.asn1.structures.AlgorithmID getOID()

engineInitVerify

protected void engineInitVerify(PublicKey publicKey)
                         throws InvalidKeyException

Specified by:

engineInitVerify in class SignatureSpi

Throws:

InvalidKeyException

engineInitSign

protected void engineInitSign(PrivateKey privateKey,
                              SecureRandom random)
                       throws InvalidKeyException

Overrides:

engineInitSign in class SignatureSpi

Throws:

InvalidKeyException

engineInitSign

protected void engineInitSign(PrivateKey privateKey)
                       throws InvalidKeyException

Specified by:

engineInitSign in class SignatureSpi

Throws:

InvalidKeyException

engineUpdate

protected void engineUpdate(byte b)

Specified by:

engineUpdate in class SignatureSpi

engineUpdate

protected void engineUpdate(byte[] bytes,
                            int off,
                            int len)
                     throws SignatureException

Specified by:

engineUpdate in class SignatureSpi

Throws:

SignatureException

engineSign

protected byte[] engineSign()
                     throws SignatureException

Specified by:

engineSign in class SignatureSpi

Throws:

SignatureException

engineVerify

protected boolean engineVerify(byte[] sigBytes)
                        throws SignatureException

Specified by:

engineVerify in class SignatureSpi

Throws:

SignatureException

engineSetParameter

protected void engineSetParameter(String param,
                                  Object o)
                           throws InvalidParameterException

Not Supported

Specified by:

engineSetParameter in class SignatureSpi

Throws:

InvalidParameterException

engineSetParameter

protected void engineSetParameter(AlgorithmParameterSpec parameterSpec)
                           throws InvalidAlgorithmParameterException

Sets the Signature Instance to the values defined by the SettingsMLDSAAlgorithmParameterSpec object

Overrides:

engineSetParameter in class SignatureSpi

Parameters:

parameterSpec - the parameters, has to be an instance of type SettingsMLDSAAlgorithmParameterSpec

Throws:

InvalidAlgorithmParameterException - when the AlgorithmParameterSpec is not an instance of MlDsaAlgorithmParameterSpec, or when the method is called after initialization.

engineGetParameter

protected Object engineGetParameter(String s)
                             throws InvalidParameterException

Not Supported

Specified by:

engineGetParameter in class SignatureSpi

Throws:

InvalidParameterException

engineGetParameters

protected AlgorithmParameters engineGetParameters()

Not Supported

Overrides:

engineGetParameters in class SignatureSpi