Remove crypto_sign_* aliases, NO_SUPERCOP and CRYPTO_* constants

mldsa_native.h exposed the public API under the crypto_sign_* SUPERCOP
naming scheme, gated by MLD_CONFIG_NO_SUPERCOP. Of these, only
crypto_sign_keypair (with the already-removed crypto_sign / crypto_sign_open)
was an actual SUPERCOP API; the signature/verify variants were mldsa-native
additions stapled onto the same prefix.

This commit removes those aliases, the MLD_CONFIG_NO_SUPERCOP configuration,
and the CRYPTO_{PUBLICKEY,SECRETKEY,}BYTES size constants -- the last remnant
of the SUPERCOP naming -- along with the related documentation and #error
messages.

Consumers and tests now use the native namespaced API directly. Examples call
the namespaced functions (e.g. mldsa_keypair); tests reconstruct the names via
test/src/test_namespace.h. For the key and signature sizes, examples and tests
derive them from MLD_CONFIG_PARAMETER_SET via local MLDSA_{PK,SK,SIG}_BYTES
abbreviations, since they are built for all parameter sets (44, 65, 87).

Signed-off-by: Matthias J. Kannwischer <matthias@zerorisc.com>
Signed-off-by: Hanno Becker <beckphan@amazon.co.uk>

Author: mkannwischer

README.md

@@ -191,7 +191,7 @@ To enable this mode, define `MLD_CONFIG_REDUCE_RAM` in [mldsa_native_config.h](m
 
 By default, mldsa-native uses the randomized "hedged" signing variant as specified in FIPS 204 Section 3.4. The hedged variant uses both fresh randomness at signing time and precomputed randomness from the private key. This helps mitigate fault injection attacks and side-channel attacks while protecting against potential flaws in the random number generator.
 
-If you need the deterministic variant of ML-DSA, you can call `crypto_sign_signature_internal`
+If you need the deterministic variant of ML-DSA, you can call `signature_internal`
 directly with an all-zero `rnd` argument.
 However, note that FIPS 204 warns that this should not be used on platforms where fault injection attacks and side-channel attacks are a concern, as the lack of fresh randomness makes fault attacks more difficult to mitigate.
 
@@ -206,8 +206,8 @@ External mu mode enables applications to compute the message digest (mu) externa
 Yes. mldsa-native supports HashML-DSA, the pre-hashing variant of ML-DSA defined in FIPS 204 Algorithms 4 and 5.
 
 mldsa-native provides two levels of API:
-- `crypto_sign_signature_pre_hash_internal` and `crypto_sign_verify_pre_hash_internal` - Low-level functions that accept a pre-hashed message digest. This function supports all 12 allowed hash functions.
-- `crypto_sign_signature_pre_hash_shake256` and `crypto_sign_verify_pre_hash_shake256` - High-level functions that perform SHAKE256 pre-hashing internally for convenience. Currently, only SHAKE256 is supported. If you require another hash function, use the `*_pre_hash_internal` functions or open an issue.
+- `signature_pre_hash_internal` and `verify_pre_hash_internal` - Low-level functions that accept a pre-hashed message digest. This function supports all 12 allowed hash functions.
+- `signature_pre_hash_shake256` and `verify_pre_hash_shake256` - High-level functions that perform SHAKE256 pre-hashing internally for convenience. Currently, only SHAKE256 is supported. If you require another hash function, use the `*_pre_hash_internal` functions or open an issue.
 
 ## Have a Question?
 

examples/basic/main.c

@@ -17,6 +17,19 @@
 #include "expected_test_vectors.h"
 #include "test_only_rng/notrandombytes.h"
 
+/* Convenience abbreviations for the key and signature sizes.
+ *
+ * Ordinarily you know the parameter set you're working with, so you would
+ * just use the level-specific constants directly, e.g. MLDSA44_PUBLICKEYBYTES,
+ * MLDSA65_BYTES, or MLDSA87_SECRETKEYBYTES.
+ *
+ * These examples, however, are compiled for all three parameter sets (44, 65,
+ * 87), so we keep things generic by deriving the sizes from the configured
+ * MLD_CONFIG_PARAMETER_SET. */
+#define MLDSA_PK_BYTES MLDSA_PUBLICKEYBYTES(MLD_CONFIG_PARAMETER_SET)
+#define MLDSA_SK_BYTES MLDSA_SECRETKEYBYTES(MLD_CONFIG_PARAMETER_SET)
+#define MLDSA_SIG_BYTES MLDSA_BYTES(MLD_CONFIG_PARAMETER_SET)
+
 #define CHECK(x)                                              \
   do                                                          \
   {                                                           \
@@ -32,13 +45,13 @@
 #if !defined(MLD_CONFIG_NO_KEYPAIR_API)
 static int example_keygen(void)
 {
-  uint8_t pk[CRYPTO_PUBLICKEYBYTES];
-  uint8_t sk[CRYPTO_SECRETKEYBYTES];
+  uint8_t pk[MLDSA_PK_BYTES];
+  uint8_t sk[MLDSA_SK_BYTES];
 
   printf("Generating keypair... ");
-  CHECK(crypto_sign_keypair(pk, sk) == 0);
-  CHECK(memcmp(pk, test_vector_pk, CRYPTO_PUBLICKEYBYTES) == 0);
-  CHECK(memcmp(sk, test_vector_sk, CRYPTO_SECRETKEYBYTES) == 0);
+  CHECK(mldsa_keypair(pk, sk) == 0);
+  CHECK(memcmp(pk, test_vector_pk, MLDSA_PK_BYTES) == 0);
+  CHECK(memcmp(sk, test_vector_sk, MLDSA_SK_BYTES) == 0);
   printf("DONE\n");
   return 0;
 }
@@ -53,14 +66,13 @@ static int example_keygen(void)
 #if !defined(MLD_CONFIG_NO_SIGN_API)
 static int example_sign(void)
 {
-  uint8_t sig[CRYPTO_BYTES];
+  uint8_t sig[MLDSA_SIG_BYTES];
   size_t siglen;
 
   printf("Signing message... ");
-  CHECK(crypto_sign_signature(sig, &siglen, (const uint8_t *)TEST_VECTOR_MSG,
-                              TEST_VECTOR_MSG_LEN,
-                              (const uint8_t *)TEST_VECTOR_CTX,
-                              TEST_VECTOR_CTX_LEN, test_vector_sk) == 0);
+  CHECK(mldsa_signature(sig, &siglen, (const uint8_t *)TEST_VECTOR_MSG,
+                        TEST_VECTOR_MSG_LEN, (const uint8_t *)TEST_VECTOR_CTX,
+                        TEST_VECTOR_CTX_LEN, test_vector_sk) == 0);
   CHECK(siglen == sizeof(test_vector_sig));
   CHECK(memcmp(sig, test_vector_sig, siglen) == 0);
   printf("DONE\n");
@@ -78,11 +90,10 @@ static int example_sign(void)
 static int example_verify(void)
 {
   printf("Verifying signature... ");
-  CHECK(crypto_sign_verify(test_vector_sig, sizeof(test_vector_sig),
-                           (const uint8_t *)TEST_VECTOR_MSG,
-                           TEST_VECTOR_MSG_LEN,
-                           (const uint8_t *)TEST_VECTOR_CTX,
-                           TEST_VECTOR_CTX_LEN, test_vector_pk) == 0);
+  CHECK(mldsa_verify(test_vector_sig, sizeof(test_vector_sig),
+                     (const uint8_t *)TEST_VECTOR_MSG, TEST_VECTOR_MSG_LEN,
+                     (const uint8_t *)TEST_VECTOR_CTX, TEST_VECTOR_CTX_LEN,
+                     test_vector_pk) == 0);
   printf("DONE\n");
   return 0;
 }

examples/basic_deterministic/README.md

@@ -8,7 +8,7 @@ without requiring a `randombytes()` implementation.
 
 Use this approach when:
 - Your application manages its own entropy/randomness externally
-- You only need `crypto_sign_keypair_internal` and `crypto_sign_signature_internal` (deterministic variants)
+- You only need `mldsa_keypair_internal` and `mldsa_signature_internal` (deterministic variants)
 
 ## Components
 
@@ -20,7 +20,7 @@ No `randombytes()` implementation is required.
 ## Configuration
 
 The configuration file [mldsa_native_config.h](mldsa_native/mldsa_native_config.h) sets:
-- `MLD_CONFIG_NO_RANDOMIZED_API`: Disables `crypto_sign_keypair`, `crypto_sign_signature`, etc. 
+- `MLD_CONFIG_NO_RANDOMIZED_API`: Disables `mldsa_keypair`, `mldsa_signature`, etc. 
 - `MLD_CONFIG_PARAMETER_SET`: Security level (default 65)
 - `MLD_CONFIG_NAMESPACE_PREFIX`: Symbol prefix (set to `mldsa`)
 

examples/basic_deterministic/main.c

@@ -16,6 +16,19 @@
 #include <mldsa_native.h>
 #include "expected_test_vectors.h"
 
+/* Convenience abbreviations for the key and signature sizes.
+ *
+ * Ordinarily you know the parameter set you're working with, so you would
+ * just use the level-specific constants directly, e.g. MLDSA44_PUBLICKEYBYTES,
+ * MLDSA65_BYTES, or MLDSA87_SECRETKEYBYTES.
+ *
+ * These examples, however, are compiled for all three parameter sets (44, 65,
+ * 87), so we keep things generic by deriving the sizes from the configured
+ * MLD_CONFIG_PARAMETER_SET. */
+#define MLDSA_PK_BYTES MLDSA_PUBLICKEYBYTES(MLD_CONFIG_PARAMETER_SET)
+#define MLDSA_SK_BYTES MLDSA_SECRETKEYBYTES(MLD_CONFIG_PARAMETER_SET)
+#define MLDSA_SIG_BYTES MLDSA_BYTES(MLD_CONFIG_PARAMETER_SET)
+
 /* For testing, we use the same randomness that would be generated by our
  * deterministic test rng such that we can produce the same keys and
  * signatures as in the basic example.
@@ -43,13 +56,13 @@
 #if !defined(MLD_CONFIG_NO_KEYPAIR_API)
 static int example_keygen(void)
 {
-  uint8_t pk[CRYPTO_PUBLICKEYBYTES];
-  uint8_t sk[CRYPTO_SECRETKEYBYTES];
+  uint8_t pk[MLDSA_PK_BYTES];
+  uint8_t sk[MLDSA_SK_BYTES];
 
   printf("Generating keypair... ");
   CHECK(mldsa_keypair_internal(pk, sk, test_vector_rnd) == 0);
-  CHECK(memcmp(pk, test_vector_pk, CRYPTO_PUBLICKEYBYTES) == 0);
-  CHECK(memcmp(sk, test_vector_sk, CRYPTO_SECRETKEYBYTES) == 0);
+  CHECK(memcmp(pk, test_vector_pk, MLDSA_PK_BYTES) == 0);
+  CHECK(memcmp(sk, test_vector_sk, MLDSA_SK_BYTES) == 0);
   printf("DONE\n");
   return 0;
 }
@@ -64,7 +77,7 @@ static int example_keygen(void)
 #if !defined(MLD_CONFIG_NO_SIGN_API)
 static int example_sign(void)
 {
-  uint8_t sig[CRYPTO_BYTES];
+  uint8_t sig[MLDSA_SIG_BYTES];
   size_t siglen;
   uint8_t pre[TEST_VECTOR_CTX_LEN + 2]; /* prefix string (0, ctxlen, ctx) */
 

examples/basic_deterministic/mldsa_native/mldsa_native_config.h

@@ -127,8 +127,8 @@
  *
  * By default, mldsa-native includes support for generating key
  * pairs. If you don't need this, set MLD_CONFIG_NO_KEYPAIR_API
- * to exclude crypto_sign_keypair, crypto_sign_keypair_internal,
- * crypto_sign_pk_from_sk, and all internal APIs only needed by
+ * to exclude keypair, keypair_internal,
+ * pk_from_sk, and all internal APIs only needed by
  * those functions.
  */
 /* #define MLD_CONFIG_NO_KEYPAIR_API */
@@ -138,10 +138,10 @@
  *
  * By default, mldsa-native includes support for creating
  * signatures. If you don't need this, set MLD_CONFIG_NO_SIGN_API
- * to exclude crypto_sign_signature,
- * crypto_sign_signature_extmu, crypto_sign_signature_internal,
- * crypto_sign_signature_pre_hash_internal,
- * crypto_sign_signature_pre_hash_shake256, and all internal APIs
+ * to exclude signature,
+ * signature_extmu, signature_internal,
+ * signature_pre_hash_internal,
+ * signature_pre_hash_shake256, and all internal APIs
  * only needed by those functions.
  */
 /* #define MLD_CONFIG_NO_SIGN_API */
@@ -151,10 +151,10 @@
  *
  * By default, mldsa-native includes support for verifying
  * signatures. If you don't need this, set
- * MLD_CONFIG_NO_VERIFY_API to exclude crypto_sign_verify,
- * crypto_sign_verify_extmu, crypto_sign_verify_internal,
- * crypto_sign_verify_pre_hash_internal,
- * crypto_sign_verify_pre_hash_shake256, and all internal APIs
+ * MLD_CONFIG_NO_VERIFY_API to exclude verify,
+ * verify_extmu, verify_internal,
+ * verify_pre_hash_internal,
+ * verify_pre_hash_shake256, and all internal APIs
  * only needed by those functions.
  */
 /* #define MLD_CONFIG_NO_VERIFY_API */
@@ -163,40 +163,28 @@
  * MLD_CONFIG_CORE_API_ONLY
  *
  * Set this to remove all public APIs except
- * crypto_sign_keypair_internal, crypto_sign_signature_internal,
- * and crypto_sign_verify_internal.
+ * keypair_internal, signature_internal,
+ * and verify_internal.
  */
 /* #define MLD_CONFIG_CORE_API_ONLY */
 
 /**
  * MLD_CONFIG_NO_RANDOMIZED_API
  *
  * If this option is set, mldsa-native will be built without the
- * randomized API functions (crypto_sign_keypair,
- * crypto_sign_signature, and crypto_sign_signature_extmu).
+ * randomized API functions (keypair,
+ * signature, and signature_extmu).
  * This allows users to build mldsa-native without providing a
  * randombytes() implementation if they only need the
  * internal deterministic API
- * (crypto_sign_keypair_internal, crypto_sign_signature_internal).
+ * (keypair_internal, signature_internal).
  *
  * @note This option is incompatible with MLD_CONFIG_KEYGEN_PCT
  * as the current PCT implementation requires
- * crypto_sign_signature().
+ * signature().
  */
 #define MLD_CONFIG_NO_RANDOMIZED_API
 
-/**
- * MLD_CONFIG_NO_SUPERCOP
- *
- * By default, mldsa_native.h exposes the mldsa-native API in the
- * SUPERCOP naming convention (crypto_sign_xxx). If you don't need
- * this, set MLD_CONFIG_NO_SUPERCOP.
- *
- * @note You must set this for a multi-level build as the SUPERCOP
- * naming does not disambiguate between the parameter sets.
- */
-/* #define MLD_CONFIG_NO_SUPERCOP */
-
 /**
  * MLD_CONFIG_CONSTANTS_ONLY
  *
@@ -632,16 +620,16 @@
  * generated keypair before it can be exported.
  *
  * Set this option if such a check should be implemented.
- * In this case, crypto_sign_keypair_internal and
- * crypto_sign_keypair will return a non-zero error code if the
+ * In this case, keypair_internal and
+ * keypair will return a non-zero error code if the
  * PCT failed.
  *
  * @note This feature will drastically lower the performance of
  * key generation.
  *
  * @note This option is incompatible with MLD_CONFIG_NO_SIGN_API
  * and MLD_CONFIG_NO_VERIFY_API as the current PCT implementation
- * requires crypto_sign_signature() and crypto_sign_verify().
+ * requires signature() and verify().
  */
 /* #define MLD_CONFIG_KEYGEN_PCT */
 

examples/basic_lowram/main.c

@@ -17,6 +17,19 @@
 #include "expected_test_vectors.h"
 #include "test_only_rng/notrandombytes.h"
 
+/* Convenience abbreviations for the key and signature sizes.
+ *
+ * Ordinarily you know the parameter set you're working with, so you would
+ * just use the level-specific constants directly, e.g. MLDSA44_PUBLICKEYBYTES,
+ * MLDSA65_BYTES, or MLDSA87_SECRETKEYBYTES.
+ *
+ * These examples, however, are compiled for all three parameter sets (44, 65,
+ * 87), so we keep things generic by deriving the sizes from the configured
+ * MLD_CONFIG_PARAMETER_SET. */
+#define MLDSA_PK_BYTES MLDSA_PUBLICKEYBYTES(MLD_CONFIG_PARAMETER_SET)
+#define MLDSA_SK_BYTES MLDSA_SECRETKEYBYTES(MLD_CONFIG_PARAMETER_SET)
+#define MLDSA_SIG_BYTES MLDSA_BYTES(MLD_CONFIG_PARAMETER_SET)
+
 #define CHECK(x)                                              \
   do                                                          \
   {                                                           \
@@ -32,13 +45,13 @@
 #if !defined(MLD_CONFIG_NO_KEYPAIR_API)
 static int example_keygen(void)
 {
-  uint8_t pk[CRYPTO_PUBLICKEYBYTES];
-  uint8_t sk[CRYPTO_SECRETKEYBYTES];
+  uint8_t pk[MLDSA_PK_BYTES];
+  uint8_t sk[MLDSA_SK_BYTES];
 
   printf("Generating keypair... ");
-  CHECK(crypto_sign_keypair(pk, sk) == 0);
-  CHECK(memcmp(pk, test_vector_pk, CRYPTO_PUBLICKEYBYTES) == 0);
-  CHECK(memcmp(sk, test_vector_sk, CRYPTO_SECRETKEYBYTES) == 0);
+  CHECK(mldsa_keypair(pk, sk) == 0);
+  CHECK(memcmp(pk, test_vector_pk, MLDSA_PK_BYTES) == 0);
+  CHECK(memcmp(sk, test_vector_sk, MLDSA_SK_BYTES) == 0);
   printf("DONE\n");
   return 0;
 }
@@ -53,14 +66,13 @@ static int example_keygen(void)
 #if !defined(MLD_CONFIG_NO_SIGN_API)
 static int example_sign(void)
 {
-  uint8_t sig[CRYPTO_BYTES];
+  uint8_t sig[MLDSA_SIG_BYTES];
   size_t siglen;
 
   printf("Signing message... ");
-  CHECK(crypto_sign_signature(sig, &siglen, (const uint8_t *)TEST_VECTOR_MSG,
-                              TEST_VECTOR_MSG_LEN,
-                              (const uint8_t *)TEST_VECTOR_CTX,
-                              TEST_VECTOR_CTX_LEN, test_vector_sk) == 0);
+  CHECK(mldsa_signature(sig, &siglen, (const uint8_t *)TEST_VECTOR_MSG,
+                        TEST_VECTOR_MSG_LEN, (const uint8_t *)TEST_VECTOR_CTX,
+                        TEST_VECTOR_CTX_LEN, test_vector_sk) == 0);
   CHECK(siglen == sizeof(test_vector_sig));
   CHECK(memcmp(sig, test_vector_sig, siglen) == 0);
   printf("DONE\n");
@@ -78,11 +90,10 @@ static int example_sign(void)
 static int example_verify(void)
 {
   printf("Verifying signature... ");
-  CHECK(crypto_sign_verify(test_vector_sig, sizeof(test_vector_sig),
-                           (const uint8_t *)TEST_VECTOR_MSG,
-                           TEST_VECTOR_MSG_LEN,
-                           (const uint8_t *)TEST_VECTOR_CTX,
-                           TEST_VECTOR_CTX_LEN, test_vector_pk) == 0);
+  CHECK(mldsa_verify(test_vector_sig, sizeof(test_vector_sig),
+                     (const uint8_t *)TEST_VECTOR_MSG, TEST_VECTOR_MSG_LEN,
+                     (const uint8_t *)TEST_VECTOR_CTX, TEST_VECTOR_CTX_LEN,
+                     test_vector_pk) == 0);
   printf("DONE\n");
   return 0;
 }