lo/libsoliton
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages 1 Wiki Activity Actions

wiki updates

Browse source 
Signed-off-by: Kamal Tufekcic <kamal@lo.sh>
This commit is contained in:
Kamal Tufekcic 2026-04-23 08:14:02 +03:00
commit 65c7bcc8e5
No known key found for this signature in database
7 changed files with 366 additions and 17 deletions
Download patch file Download diff file Expand all files Collapse all files

14
Formal-Analysis.md
View file

@ -136,16 +136,16 @@ HybridSig combines Ed25519 (classical) and ML-DSA-65 (post-quantum). Key pairs
satisfy pk = (pk_E, pk_P), sk = (sk_E, sk_P).
**Sign(sk, m)** → σ = (σ_E ‖ σ_P): both components computed independently and
concatenated. ML-DSA-65 uses hedged signing via `sign_internal` (FIPS 204 §5.2 /
Algorithm 2); fresh randomness is mixed per signing operation for
concatenated. ML-DSA-65 uses hedged signing via `sign_internal` (FIPS 204 §6.2 /
Algorithm 7); fresh randomness is mixed per signing operation for
fault-injection resistance. **FIPS 204 compatibility note**: The implementation
calls `sign_internal` directly — the raw internal signing function with no
context string or domain prefix. This is structurally incompatible with FIPS 204
§6.2 (`ML-DSA.Sign`, which prepends a context-dependent domain separator before
calling `sign_internal`). A FIPS 204 §6.2 verifier expecting the domain-prefixed
message format will reject Soliton ML-DSA-65 signatures. A formal model or test
vector suite must use the `sign_internal` / `verify_internal` interface, not the
§6.2 external interface. For adversary models that include fault injection,
[§5.2](#52-kem-ratchet-step-send) (`ML-DSA.Sign` / Algorithm 2, which prepends a context-dependent domain
separator before calling `sign_internal`). A FIPS 204 §5.2 verifier expecting
the domain-prefixed message format will reject Soliton ML-DSA-65 signatures. A
formal model or test vector suite must use the `sign_internal` /
`verify_internal` interface, not the [§5.2](#52-kem-ratchet-step-send) external interface. For adversary models that include fault injection,
hedged signing provides resistance to differential fault analysis that
deterministic signing does not. **RNG implication**: Every HybridSig.Sign
invocation consumes randomness (from ML-DSA-65's hedged component). In the [§8.2](#82-corruption-queries)